1# SPDX-License-Identifier: GPL-2.0 2# 3# KVM configuration 4# 5 6source "virt/kvm/Kconfig" 7 8menuconfig VIRTUALIZATION 9 bool "Virtualization" 10 default y 11 help 12 Say Y here to get to see options for using your Linux host to run other 13 operating systems inside virtual machines (guests). 14 This option alone does not add any kernel code. 15 16 If you say N, all options in this submenu will be skipped and disabled. 17 18if VIRTUALIZATION 19 20config KVM 21 tristate "Kernel-based Virtual Machine (KVM) support" 22 depends on HIGH_RES_TIMERS 23 depends on X86_LOCAL_APIC 24 select KVM_COMMON 25 select KVM_GENERIC_MMU_NOTIFIER 26 select HAVE_KVM_IRQCHIP 27 select HAVE_KVM_PFNCACHE 28 select HAVE_KVM_DIRTY_RING_TSO 29 select HAVE_KVM_DIRTY_RING_ACQ_REL 30 select HAVE_KVM_IRQ_BYPASS 31 select HAVE_KVM_IRQ_ROUTING 32 select HAVE_KVM_READONLY_MEM 33 select KVM_ASYNC_PF 34 select USER_RETURN_NOTIFIER 35 select KVM_MMIO 36 select SCHED_INFO 37 select PERF_EVENTS 38 select GUEST_PERF_EVENTS 39 select HAVE_KVM_MSI 40 select HAVE_KVM_CPU_RELAX_INTERCEPT 41 select HAVE_KVM_NO_POLL 42 select KVM_XFER_TO_GUEST_WORK 43 select KVM_GENERIC_DIRTYLOG_READ_PROTECT 44 select KVM_VFIO 45 select HAVE_KVM_PM_NOTIFIER if PM 46 select KVM_GENERIC_HARDWARE_ENABLING 47 select KVM_GENERIC_PRE_FAULT_MEMORY 48 select KVM_WERROR if WERROR 49 help 50 Support hosting fully virtualized guest machines using hardware 51 virtualization extensions. You will need a fairly recent 52 processor equipped with virtualization extensions. You will also 53 need to select one or more of the processor modules below. 54 55 This module provides access to the hardware capabilities through 56 a character device node named /dev/kvm. 57 58 To compile this as a module, choose M here: the module 59 will be called kvm. 60 61 If unsure, say N. 62 63config KVM_WERROR 64 bool "Compile KVM with -Werror" 65 # Disallow KVM's -Werror if KASAN is enabled, e.g. to guard against 66 # randomized configs from selecting KVM_WERROR=y, which doesn't play 67 # nice with KASAN. KASAN builds generates warnings for the default 68 # FRAME_WARN, i.e. KVM_WERROR=y with KASAN=y requires special tuning. 69 # Building KVM with -Werror and KASAN is still doable via enabling 70 # the kernel-wide WERROR=y. 71 depends on KVM && ((EXPERT && !KASAN) || WERROR) 72 help 73 Add -Werror to the build flags for KVM. 74 75 If in doubt, say "N". 76 77config KVM_SW_PROTECTED_VM 78 bool "Enable support for KVM software-protected VMs" 79 depends on EXPERT 80 depends on KVM && X86_64 81 select KVM_GENERIC_PRIVATE_MEM 82 help 83 Enable support for KVM software-protected VMs. Currently, software- 84 protected VMs are purely a development and testing vehicle for 85 KVM_CREATE_GUEST_MEMFD. Attempting to run a "real" VM workload as a 86 software-protected VM will fail miserably. 87 88 If unsure, say "N". 89 90config KVM_INTEL 91 tristate "KVM for Intel (and compatible) processors support" 92 depends on KVM && IA32_FEAT_CTL 93 help 94 Provides support for KVM on processors equipped with Intel's VT 95 extensions, a.k.a. Virtual Machine Extensions (VMX). 96 97 To compile this as a module, choose M here: the module 98 will be called kvm-intel. 99 100config KVM_INTEL_PROVE_VE 101 bool "Check that guests do not receive #VE exceptions" 102 depends on KVM_INTEL && EXPERT 103 help 104 Checks that KVM's page table management code will not incorrectly 105 let guests receive a virtualization exception. Virtualization 106 exceptions will be trapped by the hypervisor rather than injected 107 in the guest. 108 109 Note: some CPUs appear to generate spurious EPT Violations #VEs 110 that trigger KVM's WARN, in particular with eptad=0 and/or nested 111 virtualization. 112 113 If unsure, say N. 114 115config X86_SGX_KVM 116 bool "Software Guard eXtensions (SGX) Virtualization" 117 depends on X86_SGX && KVM_INTEL 118 help 119 120 Enables KVM guests to create SGX enclaves. 121 122 This includes support to expose "raw" unreclaimable enclave memory to 123 guests via a device node, e.g. /dev/sgx_vepc. 124 125 If unsure, say N. 126 127config KVM_AMD 128 tristate "KVM for AMD processors support" 129 depends on KVM && (CPU_SUP_AMD || CPU_SUP_HYGON) 130 help 131 Provides support for KVM on AMD processors equipped with the AMD-V 132 (SVM) extensions. 133 134 To compile this as a module, choose M here: the module 135 will be called kvm-amd. 136 137config KVM_AMD_SEV 138 bool "AMD Secure Encrypted Virtualization (SEV) support" 139 default y 140 depends on KVM_AMD && X86_64 141 depends on CRYPTO_DEV_SP_PSP && !(KVM_AMD=y && CRYPTO_DEV_CCP_DD=m) 142 select ARCH_HAS_CC_PLATFORM 143 select KVM_GENERIC_PRIVATE_MEM 144 select HAVE_KVM_ARCH_GMEM_PREPARE 145 select HAVE_KVM_ARCH_GMEM_INVALIDATE 146 help 147 Provides support for launching Encrypted VMs (SEV) and Encrypted VMs 148 with Encrypted State (SEV-ES) on AMD processors. 149 150config KVM_SMM 151 bool "System Management Mode emulation" 152 default y 153 depends on KVM 154 help 155 Provides support for KVM to emulate System Management Mode (SMM) 156 in virtual machines. This can be used by the virtual machine 157 firmware to implement UEFI secure boot. 158 159 If unsure, say Y. 160 161config KVM_HYPERV 162 bool "Support for Microsoft Hyper-V emulation" 163 depends on KVM 164 default y 165 help 166 Provides KVM support for emulating Microsoft Hyper-V. This allows KVM 167 to expose a subset of the paravirtualized interfaces defined in the 168 Hyper-V Hypervisor Top-Level Functional Specification (TLFS): 169 https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/reference/tlfs 170 These interfaces are required for the correct and performant functioning 171 of Windows and Hyper-V guests on KVM. 172 173 If unsure, say "Y". 174 175config KVM_XEN 176 bool "Support for Xen hypercall interface" 177 depends on KVM 178 help 179 Provides KVM support for the hosting Xen HVM guests and 180 passing Xen hypercalls to userspace. 181 182 If in doubt, say "N". 183 184config KVM_PROVE_MMU 185 bool "Prove KVM MMU correctness" 186 depends on DEBUG_KERNEL 187 depends on KVM 188 depends on EXPERT 189 help 190 Enables runtime assertions in KVM's MMU that are too costly to enable 191 in anything remotely resembling a production environment, e.g. this 192 gates code that verifies a to-be-freed page table doesn't have any 193 present SPTEs. 194 195 If in doubt, say "N". 196 197config KVM_EXTERNAL_WRITE_TRACKING 198 bool 199 200config KVM_MAX_NR_VCPUS 201 int "Maximum number of vCPUs per KVM guest" 202 depends on KVM 203 range 1024 4096 204 default 4096 if MAXSMP 205 default 1024 206 help 207 Set the maximum number of vCPUs per KVM guest. Larger values will increase 208 the memory footprint of each KVM guest, regardless of how many vCPUs are 209 created for a given VM. 210 211endif # VIRTUALIZATION 212