According to the VMX spec, the VMXON instruction takes a "VMXON region", a 4096 byte memory region which the VMX implementation (in this case, our emulation in nested VMX) may use for its needs. We currently have no need to for this memory area, because when our implementation needs to store extra data, it stores it in the vmx_vcpu structure (in L0 memory). However, we may want to store data in guest memory in the future - e.g. for making it easier to do live migration (see bug 53851). In any case, according to the VMX spec, the VMXON instruction is supposed to verify that the memory pointed by the VMXON operand is 4K aligned and has the right physical address width, and its content has the right VMCS revision field (copied from VMX_BASIC). We don't do this currently. Moreover, according to the spec, VMXON needs to save this pointer, and on VMPTRLD/VMCLEAR we need to verify that the given VMCS pointer is not the VMXON region.
Patches posted - https://lkml.org/lkml/2014/5/6/29