Enable ARM64 Virtualization Extension (VHE) for KVM

Desired Outcome

Enable the ARM64 Virtualization Extension (VHE) in a Linux host so that KVM can run guests directly on the CPU, achieving near‑native performance.

Prerequisites

• Host CPU that implements the Virtualization Extension (e.g., Cortex‑A57, Neoverse N1). Verify with `cat /proc/cpuinfo` for the svlvl flag.
• Linux kernel version 5.10 or newer, compiled with CONFIG_ARM64_VHE=y.
• Root or sudo privileges to modify kernel command line and libvirt configuration.
• UEFI firmware that supports Secure Boot if you intend to combine VHE with Secure Boot.

Procedure

1. Confirm hardware support. Run grep -E 'svlvl' /proc/cpuinfo. If no output appears, the CPU lacks VHE and the guide cannot continue.
2. Enable VHE in the kernel. On most distributions the option is already selected. Verify by inspecting the kernel config:r

   grep CONFIG_ARM64_VHE /boot/config-$(uname -r)

   If the line is missing or set to n, edit the configuration (e.g., `make menuconfig` or add `CONFIG_ARM64_VHE=y` in a custom fragment) and rebuild the kernel and its initramfs. Reboot after the new kernel is installed.
3. Verify kernel detection. After reboot, execute dmesg | grep -i vhe. Look for a line similar to “VHE enabled”. If the message is absent, the kernel did not recognize the extension; re‑check the config and reboot again.
4. Configure libvirt to require VHE. Edit the domain XML for the VM you wish to run. Add (or ensure) the following snippet inside the <features> element:r

   <feature policy='require' name='vhe'/>

   You can apply this change with virsh edit . The command must be run as root or with sudo.
5. Create or restart the VM. Using virsh define or virsh start will load the updated domain definition. If the VM was already running, a restart is required for the feature to take effect.
6. Validate guest support. The guest OS must run a kernel that includes CONFIG_ARM64_VHE or at least expose the virtualization interface. Recent Ubuntu 22.04, Fedora 36, and Debian 12 kernels satisfy this requirement. Check the guest kernel version with uname -r inside the VM.

Expected Checks

Run the following commands on the host to confirm that VHE is active:

1. dmesg | grep -i vhe – should display “VHE enabled”.
2. kvm-ok (from the cpu-checker package) – the output contains “SVL VL” indicating hardware virtualization support.
3. Inspect the domain XML:r

   virsh dumpxml  | grep vhe

   The line <feature policy='require' name='vhe'/> must be present.

If any check fails, consult the “Recovery” section.

Recovery / Rollback

Enabling VHE changes the kernel command line and libvirt domain definition, both of which are reversible.

• To revert the kernel setting, edit the kernel command line (usually in /etc/default/grub) and remove any vhe=on or related parameters, then run update-grub and reboot into the previous kernel.
• To undo the libvirt change, edit the domain XML again and delete the <feature> line, then reload the domain with virsh define --file /path/to/backup.xml or simply restart the VM.
• If the guest fails to boot after the change, boot the host into a rescue environment, select the older kernel from the GRUB menu, and verify that the VM starts without the VHE feature.

Practical Verification of Performance

After confirming that VHE is active, you can measure throughput improvement. A simple benchmark is to run fio with a mixed read/write workload on the guest and compare the IOPS against a VM that runs without VHE (e.g., using an older kernel or a software‑only KVM setup). A reduction of VM‑exit latency by up to 30 % is typical, which translates into higher CPU utilization and lower latency for I/O‑bound workloads.

Limitations

• Only CPUs that expose the svlvl feature support VHE; older ARM64 cores (e.g., Cortex‑A53) do not.
• Some guest kernels, particularly those older than 5.10, lack the required system‑call interface and may crash when VHE is enabled.
• Secure Boot must be configured with a key that validates the kernel image that includes VHE; otherwise the system may refuse to boot.

Summary

Enabling the ARM64 Virtualization Extension gives KVM a direct path to the CPU, cutting VM‑exit overhead and delivering near‑native performance for supported guests. The steps involve confirming hardware support, ensuring a recent kernel is built with VHE, updating the host’s boot parameters, configuring libvirt to require the feature, and verifying both host and guest sides. If problems arise, the outlined rollback procedures allow you to revert the kernel command line or the libvirt domain definition without data loss.