wireguard-linux/arch/arm64/kvm/hyp/include, branch stable

KVM: arm64: Check every private mapping is hyp-owned at pKVM init

2026-09-15T22:09:57Z

fix_host_ownership() transfers only what it walks, so a hyp mapping outside the linear map is not manipulated by the walk. Walk the quarter of the VA space holding the private range and the vmemmap once the transfer is done, and fail init unless every valid leaf is hyp-owned: in the vmemmap when the page is memory, and in the host stage-2, where hyp text may instead be mapped without write access. A leaf that is not memory has no vmemmap entry and is checked against the host stage-2 alone. Hyp text is matched by physical address, since the only executable mapping in the range is the Spectre-v3a vectors, whose VA is a private allocation, and an executable mapping of anything else must not be host-readable. The vmemmap can be block-mapped, so the walker checks each page of a leaf. Suggested-by: Will Deacon Signed-off-by: Fuad Tabba Reviewed-by: Vincent Donnefort Tested-by: Vincent Donnefort Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20260908110713.1540304-5-fuad.tabba@linux.dev Signed-off-by: Oliver Upton

KVM: arm64: Match hyp text by physical address in fix_host_ownership()

2026-09-15T22:09:57Z

On a non-hVHE host, fix_host_ownership_walker()'s test for PAGE_HYP_EXEC never matches: KVM_PGTABLE_PROT_UX is cleared at map time and only PX is reported on read-back. Hyp text is therefore donated rather than left read-only in the host stage-2, and the instruction dump in nvhe_hyp_panic_handler() reads a page the host has no access to. Match the text by physical address instead, in a helper a later patch reuses. A test on the permissions would leave any other executable mapping host-readable too. Fixes: 80cbfd7174f31 ("KVM: arm64: Honor UX/PX attributes for EL2 S1 mappings") Signed-off-by: Fuad Tabba Reviewed-by: Vincent Donnefort Tested-by: Vincent Donnefort Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20260908110713.1540304-3-fuad.tabba@linux.dev Signed-off-by: Oliver Upton

Merge branch 'kvm-arm64/feat-nv3' into next

2026-08-19T19:27:53Z

* kvm-arm64/feat-nv3: (29 commits) : Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier : : Couple of accelerations for nested virtualization: : : - Elide traps for EL1 alias registers when hardware guarantees that : EL2-only bits are stateful (NV2p1) : : - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that : remain 'in-context' (i.e. L1 kernel/userspace) arm64: Add override for ID_AA64MMFR4_EL1.NV_frac KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list KVM: arm64: Expose FEAT_NV3 to guests KVM: arm64: Add FEAT_NV3 detection KVM: arm64: Engage NV3 TLBI trap elision KVM: arm64: Engage NV3 ERET trap elision KVM: arm64: Add NVHCR_EL2 context switching KVM: arm64: Add routing for NVHCR_EL2 trap KVM: arm64: Add NVHCR_EL2 handling to the sysreg array KVM: arm64: Add sanitisation for NVHCR_EL2 KVM: arm64: Make HCR_EL2 a non-VNCR register KVM: arm64: Add kvm_has_nv{2,3}() predicates KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation KVM: arm64: Split NV-specific exit fixups from the non-NV handling arm64: Add ARM64_HAS_NV3 capability arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3 arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2 arm64: Add FEAT_NV2p1 detection KVM: arm64: Expose FEAT_NV2p1 to NV guests KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present ... Signed-off-by: Oliver Upton

Merge branch 'kvm-arm64/pkvm-7.3' into next

2026-08-19T19:27:35Z

* kvm-arm64/pkvm-7.3: (26 commits) : pKVM updates for 7.3 : : - Avoid name collision on trace_clock() when CONFIG_NVHE_EL2_TRACING is : disabled (Mostafa Saleh) : : - Clean up state tracking for whether the EL2 shadow VM has been : created (Fuad Tabba) : : - Synchronize SCTLR_EL1 when injecting an exception to use current : PAN/SSBS state (Fuad Tabba) : : - Avoid unnecessary cache maintenance when I/D-cache are known to be : coherent in pKVM (Mostafa Saleh) : : - Lazy vCPU context save/restore for pKVM (Fuad Tabba) : : - Various fixes to the stage-2 MMU for pKVM (Fuad Tabba) : : - Allow counter offsetting of non-protected guests in protected mode : (Mostafa Saleh) : : - Condition the 'broken CNTVOFF' mitigation on a VM actually having a : nonzero offset, fixing boot failures of pVMs on affected hardware : (Mostafa Saleh) KVM: arm64: Fix hvhe and broken CNTVOFF_EL2 KVM: arm64: Fix timer offsets for non-protected VMs KVM: arm64: Make timer_get_offset() work in all contexts KVM: arm64: selftests: Add stage-2 block transition test KVM: arm64: Don't advertise eager page splitting under pKVM KVM: arm64: Don't WARN on pKVM stage-2 map failures KVM: arm64: Skip pKVM stage-2 flush when FWB is enabled KVM: arm64: Top up stage-2 memcache for dirty logging faults KVM: arm64: Top up the memcache for pKVM permission faults KVM: arm64: Skip cache maintenance for non-cacheable pKVM mappings KVM: arm64: Implement lazy vCPU state sync for non-protected guests KVM: arm64: Add primitives to flush/sync the VGIC state at EL2 KVM: arm64: Minimise EL2's exposure of host VGIC state during world switch KVM: arm64: Add host and hypervisor vCPU lookup primitives KVM: arm64: Move PSCI helper functions to a shared header KVM: arm64: Factor out reusable vCPU reset helpers KVM: arm64: Make vcpu_{read,write}_sys_reg available to HYP code KVM: arm64: Extract MPIDR computation into a shared header KVM: arm64: selftests: Add a userspace watchpoint test KVM: arm64: Flush external_mdscr_el1 to the pKVM hyp vCPU ... Signed-off-by: Oliver Upton

KVM: arm64: Make timer_get_offset() work in all contexts

2026-08-08T18:38:49Z

We currently have two implementations of get_timer offset(), one in arm_arch_timer.h, and another one in switch.h. These two only differ by a pair of kern_hyp_va(), which seems a pretty weak reason to open-code it. Turn this function into a macro to avoid the include dependency hell on kern_hyp_va(), and make it work correctly in all contexts. Signed-off-by: Marc Zyngier Signed-off-by: Mostafa Saleh Link: https://patch.msgid.link/20260808085824.732659-2-smostafa@google.com Signed-off-by: Oliver Upton

KVM: arm64: Add NVHCR_EL2 context switching

2026-07-31T07:17:04Z

Since NVHCR_EL2 represents the HCR_EL2 state of the EL1 guest, it must be dealt with in some particular way: - for a guest in hyp context (an L1 by definition), NVHCR_EL2 directly reflects HCR_EL2 as read and written by the guest itself. It must therefore be eagerly synced back with the emulation code which only knows about HCR_EL2. This is unconditional if NV3 is available on the host. - For an L2 guest, NVHCR_EL2 is controlled by the L1 guest, and we just context switch it like any other EL1 register. Yes, EL1, as that's where this thing runs from the PoV of L1. This is conditioned on the guest using NV3. Reviewed-by: Joey Gouly Reviewed-by: Yuan Yao Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260730071022.296811-24-maz@kernel.org Signed-off-by: Oliver Upton

KVM: arm64: Relax CPTR_EL2 handling when FEAT_NV2p1 is present

2026-07-31T07:17:03Z

With FEAT_NV2P1, it is no longer necessary to trap CPTR_EL2 accesses via CPACR_EL1, as CPACR_EL1.TCPAC is guaranteed to be stateful. Prevent such trapping and context switch CPACTR_EL1 in NV contexts when NV2P1 is present. Reviewed-by: Joey Gouly Reviewed-by: Yuan Yao Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260730071022.296811-10-maz@kernel.org Signed-off-by: Oliver Upton

KVM: arm64: Merge guest's HCRX_EL2 using NV_HCRX_GUEST_EXCLUDE

2026-07-31T07:17:02Z

The way we merge the guest-provided HCRX_EL2 value with the host's is bonkers. We try to make it look like the FGT registers by using positive and negative polarities for traps, but most of these bits are not strictly about trapping, as they actively change the way some architectural state is managed. It would be far better to deal with these bits like we do for HCR_EL2, by enumerating the list of bits we don't allow the guest to override. This is simplified by the fact that HCRX_EL2 only affects EL1, and not EL2. Re-jig the HCRX_EL2 handling with a macro that list the bits excluded from the merge (TMEA, PTTWI, EnIDCP128). Reviewed-by: Yuan Yao Signed-off-by: Marc Zyngier Reviewed-by: Joey Gouly Link: https://patch.msgid.link/20260730071022.296811-4-maz@kernel.org Signed-off-by: Oliver Upton

Merge tag 'kvmarm-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

2026-07-15T10:12:37Z

KVM/arm64 fixes for 7.2, take #1 - Fix an accounting buglet when reclaiming pages from a protected guest - Fix a bunch of architectural compliance issues when injecting a synthesised exception, most of which were missing the PSTATE.IL bit indicating a 32bit-wide instruction - Another set of fixes addressing issues with translation of VNCR_EL2, including corner cases where the guest point that register at a RO page... - Don't warn when trapping accesses to ZCR_EL2 from an L2 guest, as that's not unexpected at all - Address a bunch of races with LPI migration vs LPIs being disabled - Fix a total howler of a bug combining FEAT_MOPS and NV, resulting in exception returning in the wrong place... - Coerce Fuad Tabba into a reviewer role, and may his Inbox catch fire!

KVM: arm64: Avoid naming collision in tracing

2026-07-13T22:30:19Z

When the hypervisor tracing (CONFIG_NVHE_EL2_TRACING) is disabled, it defines a static inline stub for trace_clock(). However, trace_clock() is already declared as an extern function in linux/trace_clock.h which is pulled in EL2 compilation. If the file is included when CONFIG_NVHE_EL2_TRACING is disabled (by including it manually in setup.c) it will cause: In file included from arch/arm64/kvm/hyp/nvhe/setup.c:22: ./arch/arm64/kvm/hyp/include/nvhe/clock.h:14:19: error: static declaration of ‘trace_clock’ follows non-static declaration 14 | static inline u64 trace_clock(void) { return 0; } | ^~~~~~~~~~~ on GCC and a linker error on LLVM (it seems to change the linkage to global) Although that is not a problem at the moment, as no other files include . That does not seem to be the intent of this code and that will cause issues with more users as the SMMUv3 driver. Signed-off-by: Mostafa Saleh Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: Vincent Donnefort Link: https://patch.msgid.link/20260713141320.4065600-1-smostafa@google.com Signed-off-by: Oliver Upton