Revert "ANDROID: KVM: arm64: Ignore 'kvm-arm.mode=protected' when using VHE"

This reverts commit 13e73a21a9.

Bug: 233587962
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I14dafb03c3225941aafda6bdffbe5ca82ab338c0

Documentation/admin-guide/kernel-parameters.txt

@@ -2394,6 +2394,7 @@
 
 			protected: nVHE-based mode with support for guests whose
 				   state is kept private from the host.
+				   Not valid if the kernel is running in EL2.
 
 			Defaults to VHE/nVHE based on hardware support. Setting
 			mode to "protected" will disable kexec and hibernation

arch/arm64/kernel/cpufeature.c

@@ -1916,7 +1916,15 @@ static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap)
 #ifdef CONFIG_KVM
 static bool is_kvm_protected_mode(const struct arm64_cpu_capabilities *entry, int __unused)
 {
-	return kvm_get_mode() == KVM_MODE_PROTECTED;
+	if (kvm_get_mode() != KVM_MODE_PROTECTED)
+		return false;
+
+	if (is_kernel_in_hyp_mode()) {
+		pr_warn("Protected KVM not available with VHE\n");
+		return false;
+	}
+
+	return true;
 }
 #endif /* CONFIG_KVM */
 

arch/arm64/kvm/arm.c

@@ -2346,11 +2346,7 @@ static int __init early_kvm_mode_cfg(char *arg)
 		return -EINVAL;
 
 	if (strcmp(arg, "protected") == 0) {
-		if (!is_kernel_in_hyp_mode())
-			kvm_mode = KVM_MODE_PROTECTED;
-		else
-			pr_warn_once("Protected KVM not available with VHE\n");
-
+		kvm_mode = KVM_MODE_PROTECTED;
 		return 0;
 	}