KVM: arm64: Allow KVM to be disabled from the command line

Although KVM can be compiled out of the kernel, it cannot be disabled
at runtime. Allow this possibility by introducing a new mode that
will prevent KVM from initialising.

This is useful in the (limited) circumstances where you don't want
KVM to be available (what is wrong with you?), or when you want
to install another hypervisor instead (good luck with that).

Reviewed-by: David Brazdil <dbrazdil@google.com>
Acked-by: Will Deacon <will@kernel.org>
Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Andrew Scull <ascull@google.com>
Link: https://lore.kernel.org/r/20211001170553.3062988-1-maz@kernel.org

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 91ba391f9b328b46ecce8c3c187d8e8c9238f0fc..f268731a3d4dd4ca81e4f28ab8865e59bca72cc4 100644 (file)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2365,6 +2365,8 @@
        kvm-arm.mode=
                        [KVM,ARM] Select one of KVM/arm64's modes of operation.
 
+                       none: Forcefully disable KVM.
+
                        nvhe: Standard nVHE-based mode, without support for
                              protected guests.
 

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index f8be56d5342ba3eee95cd60c62ab26a8a9887df8..019490c6797683d9c1b818d6bdec86af50f91005 100644 (file)
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -58,6 +58,7 @@
 enum kvm_mode {
        KVM_MODE_DEFAULT,
        KVM_MODE_PROTECTED,
+       KVM_MODE_NONE,
 };
 enum kvm_mode kvm_get_mode(void);
 

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index fe102cd2e518354d8a84aebea8f6d372a839b0cf..658171231af9dbec7b4b24149382c7eff651b5a1 100644 (file)
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -2064,6 +2064,11 @@ int kvm_arch_init(void *opaque)
                return -ENODEV;
        }
 
+       if (kvm_get_mode() == KVM_MODE_NONE) {
+               kvm_info("KVM disabled from command line\n");
+               return -ENODEV;
+       }
+
        in_hyp_mode = is_kernel_in_hyp_mode();
 
        if (cpus_have_final_cap(ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE) ||
@@ -2137,8 +2142,15 @@ static int __init early_kvm_mode_cfg(char *arg)
                return 0;
        }
 
-       if (strcmp(arg, "nvhe") == 0 && !WARN_ON(is_kernel_in_hyp_mode()))
+       if (strcmp(arg, "nvhe") == 0 && !WARN_ON(is_kernel_in_hyp_mode())) {
+               kvm_mode = KVM_MODE_DEFAULT;
                return 0;
+       }
+
+       if (strcmp(arg, "none") == 0) {
+               kvm_mode = KVM_MODE_NONE;
+               return 0;
+       }
 
        return -EINVAL;
 }