Require that the 'struct vie' be initialized before fetching and decoding
the instruction.
Fault in guest memory in response to EPT faults.

The EPT faults are distinguished as follows:

- Faults that point to an address that is assigned to a "memory" region
  will be resolved using vm_fault()

- All other EPT faults are resolved via instruction emulation under the
  assumption that they happened because of an instruction accessing MMIO.
Change the vcpu state handling in preparation for doing instruction emulation.

The long story:

Currently the instruction fetch, decode and emulation are done in the
vmx run loop i.e. in a critical section from the point of view of the host.
This is no longer feasible because the VM's memory is now pageable.

Accessing the VM's address space now relies on 'vm_fault_hold()' to hold
the 'vm_page' associated with the GPA and this cannot be done inside a
critical section.

However, as soon as we exit the critical section around VMRUN(), the VMCS
is no longer "active" and thus the vcpu cannot be in the RUNNING state.

We work around this by keeping the vcpu in the FROZEN state while it is
outside the VMRUN critical section. A vcpu in this state may transition
back into RUNNING state or may return to IDLE state on its way back to
userland.
Delay copying the exitinfo into vm_run.vm_exit until we know that we are
returning to userland.
Tidy up the vm_run() function by splitting the in-kernel handling of guest
'hlt' and 'paging' vm exits into separate functions.
Replace vm_gpa2hpa() with a pair of functions vm_gpa_hold()/vm_gpa_release().

We guarantee that the vm_page backing the 'gpa' is not reclaimed by
the page daemon until the caller indicates that they are done using it
by calling 'vm_gpa_release()'.
Move instruction emulation out of the critical section since it may need
to sleep waiting for the underlying page to be swapped in.

The processor-specific code now simply identifies the EPT fault as one
triggered during instruction execution and fills in the collateral (e.g.
gpa, gla, cr3).

The instruction fetch, decode and emulation is then done in the vm_run
loop.
Don't prevent the process address space from being swapped out while it is
trying to resolve a page fault. This could potentially aggravate an already
low memory condition and lead to a deadlock.

A more detailed explanation is here:
http://lists.freebsd.org/pipermail/svn-src-projects/2013-July/007215.html

Pointed out by:	kib
Get rid of unused cruft in ept.c.
If the 'PMAP_PDE_SUPERPAGE' bit is not set in 'pm_flags' then the pmap does
not support 2MB superpages. We don't allow superpage promotion within these
pmaps.

The X86 pmaps unconditionally set the PMAP_PDE_SUPERPAGE bit.

The EPT pmaps set the PMAP_PDE_SUPERPAGE bit only if the processor advertises
2MB superpages in the EPT.
Use the ternary if operator to simplify pmap_ps_enabled().

Submitted by:	alc
Use a function to convert the physical address of the EPT to the EPTP value
that is written to the VMCS.

This is needed because the value of bit 6 in the EPTP is based on the A/D bit
capability advertised by the processor and thus cannot be known at compile
time.

Also, store the EPTP value directly in the 'struct vmx' instead of storing
the physical address of the EPT PML4 table.
Stash the 'pmap' and 'eptp' for the VM in each vcpu's vmxctx since they are
accessed in the vmresume fast path.

Set the bit corresponding to 'curcpu' in nested pmap's 'pm_active' on a
vm enter. This allow's the TLB shootdown on the host to know what cpus need
to participate.

Invalidate the guest physical mappings using 'invept' if the 'vmxctx->eptgen'
if out-of-date with the nested pmap's 'pm_eptgen'. If the 'invept' instruction
fails then vmx_launch() or vmx_resume() may return with an error code of
'VMX_RETURN_INVEPT'.