Checking hardware virtualization support and nested KVM before relying on it

Goal

Determine whether a Linux host's CPU and kernel configuration can run KVM guests, and whether nested virtualization (a guest that itself runs KVM) is available, before depending on either.

Prerequisites

Shell access to the physical or virtual host. The read-only checks below work without root (virt-host-validate gives the most complete picture when run as root); reloading the KVM module and writing /etc/modprobe.d/ need root. The package that ships virt-host-validate (for example libvirt-clients on Debian/Ubuntu, libvirt-client on RHEL-family systems) must be installed.

Steps

1. Confirm the CPU exposes virtualization extensions: grep -Ewo 'vmx|svm' /proc/cpuinfo | sort -u. /proc/cpuinfo (described in proc(5)) lists CPU-dependent items including the flags line; vmx marks Intel VT-x, svm marks AMD-V. No output means the CPU, a firmware setting or the outer hypervisor does not expose the extension to this OS.
2. Run the broader check: virt-host-validate qemu (or virt-host-validate with no argument for all drivers). It reports PASS/WARN/FAIL for CPU virtualization support, whether /dev/kvm is usable, cgroup controllers, and other prerequisites for running QEMU/KVM guests on this host.
3. For nesting, check the setting on the outer host (the one that runs the VM in which you want to run KVM): cat /sys/module/kvm_intel/parameters/nested (Intel) or cat /sys/module/kvm_amd/parameters/nested (AMD); 1/Y means enabled. Upstream kernels enable it by default since Linux 4.20, but distribution kernels and local modprobe options can differ. Inside the VM, step 1 then shows whether vmx/svm actually arrived.
4. To enable nesting on an Intel host: shut down or migrate away every running guest first (the module cannot be removed while in use), then sudo modprobe -r kvm_intel && sudo modprobe kvm_intel nested=1, and verify with the same cat as step 3. Make it persist across reboots with options kvm_intel nested=1 in a file such as /etc/modprobe.d/kvm.conf (AMD: kvm_amd). Undo by deleting that line and reloading the module the same way.
5. For the nested guest itself to use KVM acceleration, the outer hypervisor must expose a virtual CPU model with VMX/SVM to the inner guest (for example <cpu mode='host-passthrough'> in the libvirt domain XML), not just enable the host module parameter.

Expected result

virt-host-validate prints PASS for the QEMU driver's CPU check, and the nested parameter file reads Y/1 when nesting is active.

Limits and test basis

The kernel documentation on nested VMX describes nested virtualization on the Intel (VMX) path specifically; AMD's nested SVM support is controlled the same way but through the kvm_amd module, referenced here without a dedicated AMD source. A cloud or hosted VM's hypervisor may hide these flags entirely regardless of the underlying physical CPU, in which case no in-guest command can enable nested KVM.