1# SPDX-License-Identifier: GPL-2.0 2# 3# KVM configuration 4# 5 6source "virt/kvm/Kconfig" 7 8menuconfig VIRTUALIZATION 9 bool "Virtualization" 10 default y 11 help 12 Say Y here to get to see options for using your Linux host to run other 13 operating systems inside virtual machines (guests). 14 This option alone does not add any kernel code. 15 16 If you say N, all options in this submenu will be skipped and disabled. 17 18if VIRTUALIZATION 19 20config KVM 21 tristate "Kernel-based Virtual Machine (KVM) support" 22 depends on X86_LOCAL_APIC 23 select KVM_COMMON 24 select KVM_GENERIC_MMU_NOTIFIER 25 select HAVE_KVM_IRQCHIP 26 select HAVE_KVM_PFNCACHE 27 select HAVE_KVM_DIRTY_RING_TSO 28 select HAVE_KVM_DIRTY_RING_ACQ_REL 29 select HAVE_KVM_IRQ_BYPASS 30 select HAVE_KVM_IRQ_ROUTING 31 select HAVE_KVM_READONLY_MEM 32 select KVM_ASYNC_PF 33 select USER_RETURN_NOTIFIER 34 select KVM_MMIO 35 select SCHED_INFO 36 select PERF_EVENTS 37 select GUEST_PERF_EVENTS 38 select HAVE_KVM_MSI 39 select HAVE_KVM_CPU_RELAX_INTERCEPT 40 select HAVE_KVM_NO_POLL 41 select KVM_XFER_TO_GUEST_WORK 42 select KVM_GENERIC_DIRTYLOG_READ_PROTECT 43 select KVM_VFIO 44 select HAVE_KVM_PM_NOTIFIER if PM 45 select KVM_GENERIC_HARDWARE_ENABLING 46 select KVM_GENERIC_PRE_FAULT_MEMORY 47 select KVM_WERROR if WERROR 48 help 49 Support hosting fully virtualized guest machines using hardware 50 virtualization extensions. You will need a fairly recent 51 processor equipped with virtualization extensions. You will also 52 need to select one or more of the processor modules below. 53 54 This module provides access to the hardware capabilities through 55 a character device node named /dev/kvm. 56 57 To compile this as a module, choose M here: the module 58 will be called kvm. 59 60 If unsure, say N. 61 62config KVM_WERROR 63 bool "Compile KVM with -Werror" 64 # Disallow KVM's -Werror if KASAN is enabled, e.g. to guard against 65 # randomized configs from selecting KVM_WERROR=y, which doesn't play 66 # nice with KASAN. KASAN builds generates warnings for the default 67 # FRAME_WARN, i.e. KVM_WERROR=y with KASAN=y requires special tuning. 68 # Building KVM with -Werror and KASAN is still doable via enabling 69 # the kernel-wide WERROR=y. 70 depends on KVM && ((EXPERT && !KASAN) || WERROR) 71 help 72 Add -Werror to the build flags for KVM. 73 74 If in doubt, say "N". 75 76config KVM_SW_PROTECTED_VM 77 bool "Enable support for KVM software-protected VMs" 78 depends on EXPERT 79 depends on KVM && X86_64 80 select KVM_GENERIC_PRIVATE_MEM 81 help 82 Enable support for KVM software-protected VMs. Currently, software- 83 protected VMs are purely a development and testing vehicle for 84 KVM_CREATE_GUEST_MEMFD. Attempting to run a "real" VM workload as a 85 software-protected VM will fail miserably. 86 87 If unsure, say "N". 88 89config KVM_INTEL 90 tristate "KVM for Intel (and compatible) processors support" 91 depends on KVM && IA32_FEAT_CTL 92 help 93 Provides support for KVM on processors equipped with Intel's VT 94 extensions, a.k.a. Virtual Machine Extensions (VMX). 95 96 To compile this as a module, choose M here: the module 97 will be called kvm-intel. 98 99config KVM_INTEL_PROVE_VE 100 bool "Check that guests do not receive #VE exceptions" 101 depends on KVM_INTEL && EXPERT 102 help 103 Checks that KVM's page table management code will not incorrectly 104 let guests receive a virtualization exception. Virtualization 105 exceptions will be trapped by the hypervisor rather than injected 106 in the guest. 107 108 Note: some CPUs appear to generate spurious EPT Violations #VEs 109 that trigger KVM's WARN, in particular with eptad=0 and/or nested 110 virtualization. 111 112 If unsure, say N. 113 114config X86_SGX_KVM 115 bool "Software Guard eXtensions (SGX) Virtualization" 116 depends on X86_SGX && KVM_INTEL 117 help 118 119 Enables KVM guests to create SGX enclaves. 120 121 This includes support to expose "raw" unreclaimable enclave memory to 122 guests via a device node, e.g. /dev/sgx_vepc. 123 124 If unsure, say N. 125 126config KVM_AMD 127 tristate "KVM for AMD processors support" 128 depends on KVM && (CPU_SUP_AMD || CPU_SUP_HYGON) 129 help 130 Provides support for KVM on AMD processors equipped with the AMD-V 131 (SVM) extensions. 132 133 To compile this as a module, choose M here: the module 134 will be called kvm-amd. 135 136config KVM_AMD_SEV 137 bool "AMD Secure Encrypted Virtualization (SEV) support" 138 default y 139 depends on KVM_AMD && X86_64 140 depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m) 141 select ARCH_HAS_CC_PLATFORM 142 select KVM_GENERIC_PRIVATE_MEM 143 select HAVE_KVM_ARCH_GMEM_PREPARE 144 select HAVE_KVM_ARCH_GMEM_INVALIDATE 145 help 146 Provides support for launching encrypted VMs which use Secure 147 Encrypted Virtualization (SEV), Secure Encrypted Virtualization with 148 Encrypted State (SEV-ES), and Secure Encrypted Virtualization with 149 Secure Nested Paging (SEV-SNP) technologies on AMD processors. 150 151config KVM_SMM 152 bool "System Management Mode emulation" 153 default y 154 depends on KVM 155 help 156 Provides support for KVM to emulate System Management Mode (SMM) 157 in virtual machines. This can be used by the virtual machine 158 firmware to implement UEFI secure boot. 159 160 If unsure, say Y. 161 162config KVM_HYPERV 163 bool "Support for Microsoft Hyper-V emulation" 164 depends on KVM 165 default y 166 help 167 Provides KVM support for emulating Microsoft Hyper-V. This allows KVM 168 to expose a subset of the paravirtualized interfaces defined in the 169 Hyper-V Hypervisor Top-Level Functional Specification (TLFS): 170 https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/reference/tlfs 171 These interfaces are required for the correct and performant functioning 172 of Windows and Hyper-V guests on KVM. 173 174 If unsure, say "Y". 175 176config KVM_XEN 177 bool "Support for Xen hypercall interface" 178 depends on KVM 179 help 180 Provides KVM support for the hosting Xen HVM guests and 181 passing Xen hypercalls to userspace. 182 183 If in doubt, say "N". 184 185config KVM_PROVE_MMU 186 bool "Prove KVM MMU correctness" 187 depends on DEBUG_KERNEL 188 depends on KVM 189 depends on EXPERT 190 help 191 Enables runtime assertions in KVM's MMU that are too costly to enable 192 in anything remotely resembling a production environment, e.g. this 193 gates code that verifies a to-be-freed page table doesn't have any 194 present SPTEs. 195 196 If in doubt, say "N". 197 198config KVM_EXTERNAL_WRITE_TRACKING 199 bool 200 201config KVM_MAX_NR_VCPUS 202 int "Maximum number of vCPUs per KVM guest" 203 depends on KVM 204 range 1024 4096 205 default 4096 if MAXSMP 206 default 1024 207 help 208 Set the maximum number of vCPUs per KVM guest. Larger values will increase 209 the memory footprint of each KVM guest, regardless of how many vCPUs are 210 created for a given VM. 211 212endif # VIRTUALIZATION 213