Hey Marc, that all makes sense: Reviewed-by: David Brazdil <dbrazdil@xxxxxxxxxx> > @@ -2137,8 +2142,15 @@ static int __init early_kvm_mode_cfg(char *arg) > return 0; > } > > - if (strcmp(arg, "nvhe") == 0 && !WARN_ON(is_kernel_in_hyp_mode())) > + if (strcmp(arg, "nvhe") == 0 && !WARN_ON(is_kernel_in_hyp_mode())) { > + kvm_mode = KVM_MODE_DEFAULT; > return 0; > + } > + > + if (strcmp(arg, "none") == 0 && !WARN_ON(is_kernel_in_hyp_mode())) { nit: I noticed we check is_kernel_in_hyp_mode here for nvhe/none but for protected it is checked in is_kvm_protected_mode. May be worth unifying?