# SPDX-License-Identifier: GPL-2.0
#
# KVM configuration
#

source "virt/kvm/Kconfig"

menuconfig VIRTUALIZATION
	bool "Virtualization"
	help
	  Say Y here to get to see options for using your Linux host to run
	  other operating systems inside virtual machines (guests).
	  This option alone does not add any kernel code.

	  If you say N, all options in this submenu will be skipped and
	  disabled.

if VIRTUALIZATION

menuconfig KVM
	bool "Kernel-based Virtual Machine (KVM) support"
	depends on AS_HAS_ARMV8_4
	select KVM_COMMON
	select KVM_GENERIC_HARDWARE_ENABLING
	select KVM_GENERIC_MMU_NOTIFIER
	select HAVE_KVM_CPU_RELAX_INTERCEPT
	select KVM_MMIO
	select KVM_GENERIC_DIRTYLOG_READ_PROTECT
	select KVM_XFER_TO_GUEST_WORK
	select KVM_VFIO
	select HAVE_KVM_DIRTY_RING_ACQ_REL
	select NEED_KVM_DIRTY_RING_WITH_BITMAP
	select HAVE_KVM_MSI
	select HAVE_KVM_IRQCHIP
	select HAVE_KVM_IRQ_ROUTING
	select HAVE_KVM_IRQ_BYPASS
	select HAVE_KVM_READONLY_MEM
	select HAVE_KVM_VCPU_RUN_PID_CHANGE
	select SCHED_INFO
	select GUEST_PERF_EVENTS if PERF_EVENTS
	help
	  Support hosting virtualized guest machines.

	  If unsure, say N.

if KVM

config PTDUMP_STAGE2_DEBUGFS
	bool "Present the stage-2 pagetables to debugfs"
	depends on DEBUG_KERNEL
	depends on DEBUG_FS
	depends on GENERIC_PTDUMP
	select PTDUMP_CORE
	default n
	help
	  Say Y here if you want to show the stage-2 kernel pagetables
	  layout in a debugfs file. This information is only useful for kernel developers
	  who are working in architecture specific areas of the kernel.
	  It is probably not a good idea to enable this feature in a production
	  kernel.

	  If in doubt, say N.

config PKVM_MODULE_PATH
	string "Path to pKVM modules"
	default ""
	help
	  Directory where the pKVM modules are found. If empty, the modules
	  will be searched into the default path /lib/modules/<uname>.

menuconfig PKVM_DEBUG
	bool "Debug mode for Protected KVM hypervisor"
	help
	  Say Y here to enable the debug mode for the Protected KVM (pKVM)
	  hypervisor. Failure reports will BUG() in the hypervisor. This is
	  intended for local EL2 hypervisor development.

	  If unsure, say N.

if PKVM_DEBUG

config PKVM_STRICT_CHECKS
	bool "Additional checks in the Protected KVM hypervisor"
	default y
	help
	  Say Y here to add more checks into the Protected KVM hypervisor.
          Those checks have a slight performance cost and will BUG() on a
          failure. This is intended for EL2 hypervisor development.

config PKVM_SELFTESTS
	bool "Protected KVM hypervisor selftests"
	default y
	help
	  Say Y here to enable Protected KVM (pKVM) hypervisor selftests
	  during boot. Failure reports will panic the hypervisor. This is
	  intended for EL2 hypervisor development.

	  If unsure, say N.

config PKVM_DUMP_TRACE_ON_PANIC
	bool "Dump Protected KVM hypervisor trace buffer on panic"
	default y
	help
	   Say Y here to dump the content of the pKVM hypervisor on either
           hypervisor or host panic. In the case of a hyp panic, only the tail
           page is dumped. It only has an effect if the command line option
           hyp_trace_printk is set.

config PKVM_FTRACE
	bool "Protected KVM hypervisor function tracing"
	depends on FTRACE
	default y
	help
	  Say Y here to enable func and func_ret hypervisor tracing events.
	  Those events are raised whenever the hypervisor branch to a
	  function.

	  If unsure, Say N.

config PKVM_STACKTRACE
	bool "Protected KVM hypervisor stacktraces"
	depends on PKVM_DISABLE_STAGE2_ON_PANIC
	default y
	help
	  Say Y here to enable pKVM hypervisor stacktraces on hyp_panic()

	  If using protected nVHE mode, but cannot afford the associated
	  memory cost (less than 0.75 page per CPU) of pKVM stacktraces,
	  say N.

	  If unsure, or not using protected nVHE (pKVM), say N.

config PKVM_DISABLE_STAGE2_ON_PANIC
	bool "Disable the host stage-2 on panic"
	default n
	help
	  If panic occurs while the host lock is held and if, plagued by bad
	  luck the panic path triggers a host stage-2 memory abort, a lockup
	  would happen. The only way out is to disable the stage-2 page-table.
	  This however tamper the system security. This option should therefore
	  solely be enabled to debug specific issues.

	  Just say N.

endif # PKVM_DEBUG
endif # KVM
endif # VIRTUALIZATION