[PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

pKVM keeps its own mapping list for stage 2 operations. Its flush path
uses that list directly, so it lost the PTE attribute check done by the
generic stage 2 walker.

Record whether a mapping is cacheable and skip cache maintenance for
mappings that are not cacheable.

Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
Signed-off-by: Bradley Morgan <include@grrlz.net>
---
Changes since V3:
- addressed some review :)

 arch/arm64/kvm/pkvm.c | 51 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 41 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
index 053e4f733e4b..6d1cad890c7e 100644
--- a/arch/arm64/kvm/pkvm.c
+++ b/arch/arm64/kvm/pkvm.c
@@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct pkvm_mapping *m)
 	return m->gfn * PAGE_SIZE;
 }
 
+#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
+#define PKVM_MAPPING_NC                        BIT_ULL(48)
+
+static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
+{
+	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
+}
+
+static bool pkvm_mapping_is_nc(struct pkvm_mapping *m)
+{
+	return m->nr_pages & PKVM_MAPPING_NC;
+}
+
+static void pkvm_mapping_set_nr_pages(struct pkvm_mapping *m, u64 nr_pages,
+				      bool nc)
+{
+	WARN_ON_ONCE(nr_pages & ~PKVM_MAPPING_NR_PAGES_MASK);
+
+	m->nr_pages = nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
+	if (nc)
+		m->nr_pages |= PKVM_MAPPING_NC;
+}
+
 static u64 __pkvm_mapping_end(struct pkvm_mapping *m)
 {
-	return (m->gfn + m->nr_pages) * PAGE_SIZE - 1;
+	return (m->gfn + pkvm_mapping_nr_pages(m)) * PAGE_SIZE - 1;
 }
 
 INTERVAL_TREE_DEFINE(struct pkvm_mapping, node, u64, __subtree_last,
@@ -350,7 +373,7 @@ static int __pkvm_pgtable_stage2_reclaim(struct kvm_pgtable *pgt, u64 start, u64
 			continue;
 
 		page = pfn_to_page(mapping->pfn);
-		WARN_ON_ONCE(mapping->nr_pages != 1);
+	       WARN_ON_ONCE(pkvm_mapping_nr_pages(mapping) != 1);
 		unpin_user_pages_dirty_lock(&page, 1, true);
 		account_locked_vm(current->mm, 1, false);
 		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
@@ -369,7 +392,7 @@ static int __pkvm_pgtable_stage2_unshare(struct kvm_pgtable *pgt, u64 start, u64
 
 	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
 		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
-					mapping->nr_pages);
+				       pkvm_mapping_nr_pages(mapping));
 		if (WARN_ON(ret))
 			return ret;
 		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
@@ -448,7 +471,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
 		 * permission faults are handled in the relax_perms() path.
 		 */
 		if (mapping) {
-			if (size == (mapping->nr_pages * PAGE_SIZE))
+			if (size == (pkvm_mapping_nr_pages(mapping) * PAGE_SIZE))
 				return -EAGAIN;
 
 			/*
@@ -472,7 +495,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
 	swap(mapping, cache->mapping);
 	mapping->gfn = gfn;
 	mapping->pfn = pfn;
-	mapping->nr_pages = size / PAGE_SIZE;
+	pkvm_mapping_set_nr_pages(mapping, size / PAGE_SIZE,
+				  (prot & (KVM_PGTABLE_PROT_DEVICE |
+					   KVM_PGTABLE_PROT_NORMAL_NC)));
 	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
 
 	return ret;
@@ -503,7 +528,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size)
 	lockdep_assert_held(&kvm->mmu_lock);
 	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
 		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
-					mapping->nr_pages);
+				       pkvm_mapping_nr_pages(mapping));
 		if (WARN_ON(ret))
 			break;
 	}
@@ -517,9 +542,13 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size)
 	struct pkvm_mapping *mapping;
 
 	lockdep_assert_held(&kvm->mmu_lock);
-	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
+	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
+		if (pkvm_mapping_is_nc(mapping))
+			continue;
+
 		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
-					  PAGE_SIZE * mapping->nr_pages);
+					  PAGE_SIZE * pkvm_mapping_nr_pages(mapping));
+	}
 
 	return 0;
 }
@@ -536,8 +565,10 @@ bool pkvm_pgtable_stage2_test_clear_young(struct kvm_pgtable *pgt, u64 addr, u64
 
 	lockdep_assert_held(&kvm->mmu_lock);
 	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
-		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
-					   mapping->nr_pages, mkold);
+		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest,
+					   handle, mapping->gfn,
+					   pkvm_mapping_nr_pages(mapping),
+					   mkold);
 
 	return young;
 }
-- 
2.53.0

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Marc Zyngier]

+ Vincent, Leo

On Wed, 01 Jul 2026 20:24:28 +0100,
Bradley Morgan <include@grrlz.net> wrote:
> 
> pKVM keeps its own mapping list for stage 2 operations. Its flush path
> uses that list directly, so it lost the PTE attribute check done by the
> generic stage 2 walker.
> 
> Record whether a mapping is cacheable and skip cache maintenance for
> mappings that are not cacheable.
> 
> Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
> Signed-off-by: Bradley Morgan <include@grrlz.net>
> ---
> Changes since V3:
> - addressed some review :)

This isn't a change log. If you want to be taken seriously, I'd
suggest you start by following the process. You are otherwise wasting
people's time. Again.

You also failed to Cc people who have provided feedback on previous
versions. That's not right.

> 
>  arch/arm64/kvm/pkvm.c | 51 ++++++++++++++++++++++++++++++++++---------
>  1 file changed, 41 insertions(+), 10 deletions(-)
> 
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 053e4f733e4b..6d1cad890c7e 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct pkvm_mapping *m)
>  	return m->gfn * PAGE_SIZE;
>  }
>  
> +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
> +#define PKVM_MAPPING_NC                        BIT_ULL(48)
> +
> +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
> +{
> +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
> +}

No. You've been pointed to the correct data structure (an anonymous
structure containing bit fields). Please consider taking the review
comments into account.

This would avoid most of the churn in this patch, and make it easy to
backport. Something like the untested hack below.

	M.

diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
index 74fedd9c5ff02..cdddc9e3a11f5 100644
--- a/arch/arm64/include/asm/kvm_pkvm.h
+++ b/arch/arm64/include/asm/kvm_pkvm.h
@@ -195,7 +195,10 @@ struct pkvm_mapping {
 	struct rb_node node;
 	u64 gfn;
 	u64 pfn;
-	u64 nr_pages;
+	struct {
+		unsigned long nr_pages:48;
+		unsigned int  nc:1;
+	};
 	u64 __subtree_last;	/* Internal member for interval tree */
 };
 
diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
index 428723b1b0f5c..5932b93bded58 100644
--- a/arch/arm64/kvm/pkvm.c
+++ b/arch/arm64/kvm/pkvm.c
@@ -369,7 +369,7 @@ static int __pkvm_pgtable_stage2_unshare(struct kvm_pgtable *pgt, u64 start, u64
 
 	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
 		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
-					mapping->nr_pages);
+					(u64)mapping->nr_pages);
 		if (WARN_ON(ret))
 			return ret;
 		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
@@ -473,6 +473,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
 	mapping->gfn = gfn;
 	mapping->pfn = pfn;
 	mapping->nr_pages = size / PAGE_SIZE;
+	mapping->nc = !!(prot & (KVM_PGTABLE_PROT_DEVICE | KVM_PGTABLE_PROT_NORMAL_NC));
 	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
 
 	return ret;
@@ -503,7 +504,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size)
 	lockdep_assert_held(&kvm->mmu_lock);
 	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
 		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
-					mapping->nr_pages);
+					(u64)mapping->nr_pages);
 		if (WARN_ON(ret))
 			break;
 	}
@@ -517,10 +518,11 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size)
 	struct pkvm_mapping *mapping;
 
 	lockdep_assert_held(&kvm->mmu_lock);
-	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
-		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
-					  PAGE_SIZE * mapping->nr_pages);
-
+	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
+		if (!mapping->nc)
+			__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
+						  PAGE_SIZE * mapping->nr_pages);
+	}
 	return 0;
 }
 
@@ -537,7 +539,7 @@ bool pkvm_pgtable_stage2_test_clear_young(struct kvm_pgtable *pgt, u64 addr, u64
 	lockdep_assert_held(&kvm->mmu_lock);
 	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
 		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
-					   mapping->nr_pages, mkold);
+					   (u64)mapping->nr_pages, mkold);
 
 	return young;
 }

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Leonardo Bras]

On Thu, Jul 02, 2026 at 09:59:23AM +0100, Marc Zyngier wrote:
> + Vincent, Leo
> 
> On Wed, 01 Jul 2026 20:24:28 +0100,
> Bradley Morgan <include@grrlz.net> wrote:
> > 
> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
> > uses that list directly, so it lost the PTE attribute check done by the
> > generic stage 2 walker.
> > 
> > Record whether a mapping is cacheable and skip cache maintenance for
> > mappings that are not cacheable.
> > 
> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
> > Signed-off-by: Bradley Morgan <include@grrlz.net>
> > ---
> > Changes since V3:
> > - addressed some review :)
> 
> This isn't a change log. If you want to be taken seriously, I'd
> suggest you start by following the process. You are otherwise wasting
> people's time. Again.

Agree... the process has a reason: the changelog here helps the reviewer 
having an overview of what actually changed between versions, and that 
makes reviewing much easier, and costs very little to the contributor.

Also, the 1 week waiting time is really important, as mentioned before, as 
it allows more reviewers and maintainers to give feedback: different 
people, from different companies and lifestyles have different schedules 
for dev/rev, but in general it happens weekly. So waiting for a week is 
really recommended, as it tends to avoid people re-reading 2+ versions of 
the same patchset, and allows revs time to discuss the suggestions in the 
same thread.

(I know the waiting can be really frustating, and that sending a vN+1 fast 
seems to show that you are interested in it, but it really does not help)

> 
> You also failed to Cc people who have provided feedback on previous
> versions. That's not right.

(Bradley: usually you want as many people as possible to review your stuff, 
so CC'ing previous reviewers is actually good for you)

> 
> > 
> >  arch/arm64/kvm/pkvm.c | 51 ++++++++++++++++++++++++++++++++++---------
> >  1 file changed, 41 insertions(+), 10 deletions(-)
> > 
> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> > index 053e4f733e4b..6d1cad890c7e 100644
> > --- a/arch/arm64/kvm/pkvm.c
> > +++ b/arch/arm64/kvm/pkvm.c
> > @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct pkvm_mapping *m)
> >  	return m->gfn * PAGE_SIZE;
> >  }
> >  
> > +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
> > +#define PKVM_MAPPING_NC                        BIT_ULL(48)
> > +
> > +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
> > +{
> > +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
> > +}
> 
> No. You've been pointed to the correct data structure (an anonymous
> structure containing bit fields). Please consider taking the review
> comments into account.

(and if you do not agree with the suggestion, discuss it in the same 
thread. Although as Marc shows below, it becames much simpler like that)

Thanks! 
Leo


> 
> This would avoid most of the churn in this patch, and make it easy to
> backport. Something like the untested hack below.
> 
> 	M.
> 
> diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
> index 74fedd9c5ff02..cdddc9e3a11f5 100644
> --- a/arch/arm64/include/asm/kvm_pkvm.h
> +++ b/arch/arm64/include/asm/kvm_pkvm.h
> @@ -195,7 +195,10 @@ struct pkvm_mapping {
>  	struct rb_node node;
>  	u64 gfn;
>  	u64 pfn;
> -	u64 nr_pages;
> +	struct {
> +		unsigned long nr_pages:48;
> +		unsigned int  nc:1;
> +	};
>  	u64 __subtree_last;	/* Internal member for interval tree */
>  };
>  
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 428723b1b0f5c..5932b93bded58 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -369,7 +369,7 @@ static int __pkvm_pgtable_stage2_unshare(struct kvm_pgtable *pgt, u64 start, u64
>  
>  	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
>  		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
> -					mapping->nr_pages);
> +					(u64)mapping->nr_pages);
>  		if (WARN_ON(ret))
>  			return ret;
>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
> @@ -473,6 +473,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>  	mapping->gfn = gfn;
>  	mapping->pfn = pfn;
>  	mapping->nr_pages = size / PAGE_SIZE;
> +	mapping->nc = !!(prot & (KVM_PGTABLE_PROT_DEVICE | KVM_PGTABLE_PROT_NORMAL_NC));
>  	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
>  
>  	return ret;
> @@ -503,7 +504,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size)
>  	lockdep_assert_held(&kvm->mmu_lock);
>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>  		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
> -					mapping->nr_pages);
> +					(u64)mapping->nr_pages);
>  		if (WARN_ON(ret))
>  			break;
>  	}
> @@ -517,10 +518,11 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size)
>  	struct pkvm_mapping *mapping;
>  
>  	lockdep_assert_held(&kvm->mmu_lock);
> -	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
> -		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
> -					  PAGE_SIZE * mapping->nr_pages);
> -
> +	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
> +		if (!mapping->nc)
> +			__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
> +						  PAGE_SIZE * mapping->nr_pages);
> +	}
>  	return 0;
>  }
>  
> @@ -537,7 +539,7 @@ bool pkvm_pgtable_stage2_test_clear_young(struct kvm_pgtable *pgt, u64 addr, u64
>  	lockdep_assert_held(&kvm->mmu_lock);
>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
>  		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
> -					   mapping->nr_pages, mkold);
> +					   (u64)mapping->nr_pages, mkold);
>  
>  	return young;
>  }
> 
> -- 
> Without deviation from the norm, progress is not possible.

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

On July 2, 2026 12:18:58 PM GMT+01:00, Leonardo Bras <leo.bras@arm.com>
wrote:
>On Thu, Jul 02, 2026 at 09:59:23AM +0100, Marc Zyngier wrote:
>> + Vincent, Leo
>> 
>> On Wed, 01 Jul 2026 20:24:28 +0100,
>> Bradley Morgan <include@grrlz.net> wrote:
>> > 
>> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
>> > uses that list directly, so it lost the PTE attribute check done by
>the
>> > generic stage 2 walker.
>> > 
>> > Record whether a mapping is cacheable and skip cache maintenance for
>> > mappings that are not cacheable.
>> > 
>> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
>> > Signed-off-by: Bradley Morgan <include@grrlz.net>
>> > ---
>> > Changes since V3:
>> > - addressed some review :)
>> 
>> This isn't a change log. If you want to be taken seriously, I'd
>> suggest you start by following the process. You are otherwise wasting
>> people's time. Again.
>
>Agree... the process has a reason: the changelog here helps the reviewer 
>having an overview of what actually changed between versions, and that 
>makes reviewing much easier, and costs very little to the contributor.
>
>Also, the 1 week waiting time is really important, as mentioned before, as
>it allows more reviewers and maintainers to give feedback: different 
>people, from different companies and lifestyles have different schedules 
>for dev/rev, but in general it happens weekly. So waiting for a week is 
>really recommended, as it tends to avoid people re-reading 2+ versions of 
>the same patchset, and allows revs time to discuss the suggestions in the 
>same thread.
>
>(I know the waiting can be really frustating, and that sending a vN+1 fast
>seems to show that you are interested in it, but it really does not help)

Well, it's fair, let me give you reasoning on why I do quick Rerolls.

So, if I do something wrong, e.g: checkpatch, I don't want to wait a week,
because I would get grilled for a said checkpatch failure.


In this case, I was just excited /shrug.
>> 
>> You also failed to Cc people who have provided feedback on previous
>> versions. That's not right.
>
>(Bradley: usually you want as many people as possible to review your
>stuff, 
>so CC'ing previous reviewers is actually good for you)

Vincent not being CCed was dumb of me, no idea how I didn't get him on get
maintainers.

For you, I didn't want to annoy you with another patch, since maintainers
tend to be stressed and annoyed. And I didn't wanna add on to the pain.

>> 
>> > 
>> >  arch/arm64/kvm/pkvm.c | 51
>++++++++++++++++++++++++++++++++++---------
>> >  1 file changed, 41 insertions(+), 10 deletions(-)
>> > 
>> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
>> > index 053e4f733e4b..6d1cad890c7e 100644
>> > --- a/arch/arm64/kvm/pkvm.c
>> > +++ b/arch/arm64/kvm/pkvm.c
>> > @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct
>pkvm_mapping *m)
>> >  	return m->gfn * PAGE_SIZE;
>> >  }
>> >  
>> > +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
>> > +#define PKVM_MAPPING_NC                        BIT_ULL(48)
>> > +
>> > +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
>> > +{
>> > +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
>> > +}
>> 
>> No. You've been pointed to the correct data structure (an anonymous
>> structure containing bit fields). Please consider taking the review
>> comments into account.
>
>(and if you do not agree with the suggestion, discuss it in the same 
>thread. Although as Marc shows below, it becames much simpler like that)
>
>Thanks! 
>Leo
>

I'll test it. If it's good. I'll do 

Suggested-by? Or co-developed by?

I'll hold the patch on for a week.


Thanks you lot for taking my bull crap.

>> 
>> This would avoid most of the churn in this patch, and make it easy to
>> backport. Something like the untested hack below.
>> 
>> 	M.
>> 
>> diff --git a/arch/arm64/include/asm/kvm_pkvm.h
>b/arch/arm64/include/asm/kvm_pkvm.h
>> index 74fedd9c5ff02..cdddc9e3a11f5 100644
>> --- a/arch/arm64/include/asm/kvm_pkvm.h
>> +++ b/arch/arm64/include/asm/kvm_pkvm.h
>> @@ -195,7 +195,10 @@ struct pkvm_mapping {
>>  	struct rb_node node;
>>  	u64 gfn;
>>  	u64 pfn;
>> -	u64 nr_pages;
>> +	struct {
>> +		unsigned long nr_pages:48;
>> +		unsigned int  nc:1;
>> +	};
>>  	u64 __subtree_last;	/* Internal member for interval tree */
>>  };
>>  
>> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
>> index 428723b1b0f5c..5932b93bded58 100644
>> --- a/arch/arm64/kvm/pkvm.c
>> +++ b/arch/arm64/kvm/pkvm.c
>> @@ -369,7 +369,7 @@ static int __pkvm_pgtable_stage2_unshare(struct
>kvm_pgtable *pgt, u64 start, u64
>>  
>>  	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
>>  		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
>> -					mapping->nr_pages);
>> +					(u64)mapping->nr_pages);
>>  		if (WARN_ON(ret))
>>  			return ret;
>>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
>> @@ -473,6 +473,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt,
>u64 addr, u64 size,
>>  	mapping->gfn = gfn;
>>  	mapping->pfn = pfn;
>>  	mapping->nr_pages = size / PAGE_SIZE;
>> +	mapping->nc = !!(prot & (KVM_PGTABLE_PROT_DEVICE | KVM_PGTABLE_PROT_NORMAL_NC));
>>  	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
>>  
>>  	return ret;
>> @@ -503,7 +504,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable
>*pgt, u64 addr, u64 size)
>>  	lockdep_assert_held(&kvm->mmu_lock);
>>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>>  		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
>> -					mapping->nr_pages);
>> +					(u64)mapping->nr_pages);
>>  		if (WARN_ON(ret))
>>  			break;
>>  	}
>> @@ -517,10 +518,11 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable
>*pgt, u64 addr, u64 size)
>>  	struct pkvm_mapping *mapping;
>>  
>>  	lockdep_assert_held(&kvm->mmu_lock);
>> -	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
>> -		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
>> -					  PAGE_SIZE * mapping->nr_pages);
>> -
>> +	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>> +		if (!mapping->nc)
>> +			__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
>> +						  PAGE_SIZE * mapping->nr_pages);
>> +	}
>>  	return 0;
>>  }
>>  
>> @@ -537,7 +539,7 @@ bool pkvm_pgtable_stage2_test_clear_young(struct
>kvm_pgtable *pgt, u64 addr, u64
>>  	lockdep_assert_held(&kvm->mmu_lock);
>>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
>>  		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
>> -					   mapping->nr_pages, mkold);
>> +					   (u64)mapping->nr_pages, mkold);
>>  
>>  	return young;
>>  }
>> 
>> -- 
>> Without deviation from the norm, progress is not possible.
>

Thanks!

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Leonardo Bras]

On Thu, Jul 02, 2026 at 03:52:14PM +0100, Bradley Morgan wrote:
> On July 2, 2026 12:18:58 PM GMT+01:00, Leonardo Bras <leo.bras@arm.com>
> wrote:
> >On Thu, Jul 02, 2026 at 09:59:23AM +0100, Marc Zyngier wrote:
> >> + Vincent, Leo
> >> 
> >> On Wed, 01 Jul 2026 20:24:28 +0100,
> >> Bradley Morgan <include@grrlz.net> wrote:
> >> > 
> >> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
> >> > uses that list directly, so it lost the PTE attribute check done by
> >the
> >> > generic stage 2 walker.
> >> > 
> >> > Record whether a mapping is cacheable and skip cache maintenance for
> >> > mappings that are not cacheable.
> >> > 
> >> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
> >> > Signed-off-by: Bradley Morgan <include@grrlz.net>
> >> > ---
> >> > Changes since V3:
> >> > - addressed some review :)
> >> 
> >> This isn't a change log. If you want to be taken seriously, I'd
> >> suggest you start by following the process. You are otherwise wasting
> >> people's time. Again.
> >
> >Agree... the process has a reason: the changelog here helps the reviewer 
> >having an overview of what actually changed between versions, and that 
> >makes reviewing much easier, and costs very little to the contributor.
> >
> >Also, the 1 week waiting time is really important, as mentioned before, as
> >it allows more reviewers and maintainers to give feedback: different 
> >people, from different companies and lifestyles have different schedules 
> >for dev/rev, but in general it happens weekly. So waiting for a week is 
> >really recommended, as it tends to avoid people re-reading 2+ versions of 
> >the same patchset, and allows revs time to discuss the suggestions in the 
> >same thread.
> >
> >(I know the waiting can be really frustating, and that sending a vN+1 fast
> >seems to show that you are interested in it, but it really does not help)
> 
> Well, it's fair, let me give you reasoning on why I do quick Rerolls.
> 
> So, if I do something wrong, e.g: checkpatch, I don't want to wait a week,
> because I would get grilled for a said checkpatch failure.
> 

Fair, but people would not avoid reviewing your new version due to a 
checkpath/etc issue. It's common to just report/ignore that and go on with 
the code that matters. 

Also, checkpath is a good example of what you can run in your code before 
sending, so it does not become a respin.

> 
> In this case, I was just excited /shrug.

It's okay. Been there as well :)

> >> 
> >> You also failed to Cc people who have provided feedback on previous
> >> versions. That's not right.
> >
> >(Bradley: usually you want as many people as possible to review your
> >stuff, 
> >so CC'ing previous reviewers is actually good for you)
> 
> Vincent not being CCed was dumb of me, no idea how I didn't get him on get
> maintainers.
> 
> For you, I didn't want to annoy you with another patch, since maintainers
> tend to be stressed and annoyed. And I didn't wanna add on to the pain.
> 

Don't worry on this. Previous reviewers can just ignore the e-mail if 
they don't find it interesting anymore.

> >> 
> >> > 
> >> >  arch/arm64/kvm/pkvm.c | 51
> >++++++++++++++++++++++++++++++++++---------
> >> >  1 file changed, 41 insertions(+), 10 deletions(-)
> >> > 
> >> > diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> >> > index 053e4f733e4b..6d1cad890c7e 100644
> >> > --- a/arch/arm64/kvm/pkvm.c
> >> > +++ b/arch/arm64/kvm/pkvm.c
> >> > @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct
> >pkvm_mapping *m)
> >> >  	return m->gfn * PAGE_SIZE;
> >> >  }
> >> >  
> >> > +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
> >> > +#define PKVM_MAPPING_NC                        BIT_ULL(48)
> >> > +
> >> > +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
> >> > +{
> >> > +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
> >> > +}
> >> 
> >> No. You've been pointed to the correct data structure (an anonymous
> >> structure containing bit fields). Please consider taking the review
> >> comments into account.
> >
> >(and if you do not agree with the suggestion, discuss it in the same 
> >thread. Although as Marc shows below, it becames much simpler like that)
> >
> >Thanks! 
> >Leo
> >
> 
> I'll test it. If it's good. I'll do 
> 
> Suggested-by? Or co-developed by?

I would say none. It's just a change suggestion to your patch, made by a 
reviewer. 

IIRC 'Suggested-by' is used if someone suggested the idea for the patch, 
such as "ah, you should do this thing before", etc. It's both for giving 
credit and showing people the idea for that was not yours, for multiple 
reasons.

> 
> I'll hold the patch on for a week.
> 

Good! 
If you get too excited, I suggest reading other people's patches. Everybody 
makes mistakes, and the solutions / suggestions are really interesting :)

> 
> Thanks you lot for taking my bull crap.
> 

It's not bad, the process just goes like that for everybody.
It's just slower than people expect :)

We get slightly better over time, but still make mistakes.
(And try our best not to make the same mistakes again :)

Thanks for contributing!
Leo


> >> 
> >> This would avoid most of the churn in this patch, and make it easy to
> >> backport. Something like the untested hack below.
> >> 
> >> 	M.
> >> 
> >> diff --git a/arch/arm64/include/asm/kvm_pkvm.h
> >b/arch/arm64/include/asm/kvm_pkvm.h
> >> index 74fedd9c5ff02..cdddc9e3a11f5 100644
> >> --- a/arch/arm64/include/asm/kvm_pkvm.h
> >> +++ b/arch/arm64/include/asm/kvm_pkvm.h
> >> @@ -195,7 +195,10 @@ struct pkvm_mapping {
> >>  	struct rb_node node;
> >>  	u64 gfn;
> >>  	u64 pfn;
> >> -	u64 nr_pages;
> >> +	struct {
> >> +		unsigned long nr_pages:48;
> >> +		unsigned int  nc:1;
> >> +	};
> >>  	u64 __subtree_last;	/* Internal member for interval tree */
> >>  };
> >>  
> >> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> >> index 428723b1b0f5c..5932b93bded58 100644
> >> --- a/arch/arm64/kvm/pkvm.c
> >> +++ b/arch/arm64/kvm/pkvm.c
> >> @@ -369,7 +369,7 @@ static int __pkvm_pgtable_stage2_unshare(struct
> >kvm_pgtable *pgt, u64 start, u64
> >>  
> >>  	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
> >>  		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
> >> -					mapping->nr_pages);
> >> +					(u64)mapping->nr_pages);
> >>  		if (WARN_ON(ret))
> >>  			return ret;
> >>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
> >> @@ -473,6 +473,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt,
> >u64 addr, u64 size,
> >>  	mapping->gfn = gfn;
> >>  	mapping->pfn = pfn;
> >>  	mapping->nr_pages = size / PAGE_SIZE;
> >> +	mapping->nc = !!(prot & (KVM_PGTABLE_PROT_DEVICE | KVM_PGTABLE_PROT_NORMAL_NC));
> >>  	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
> >>  
> >>  	return ret;
> >> @@ -503,7 +504,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable
> >*pgt, u64 addr, u64 size)
> >>  	lockdep_assert_held(&kvm->mmu_lock);
> >>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
> >>  		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
> >> -					mapping->nr_pages);
> >> +					(u64)mapping->nr_pages);
> >>  		if (WARN_ON(ret))
> >>  			break;
> >>  	}
> >> @@ -517,10 +518,11 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable
> >*pgt, u64 addr, u64 size)
> >>  	struct pkvm_mapping *mapping;
> >>  
> >>  	lockdep_assert_held(&kvm->mmu_lock);
> >> -	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
> >> -		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
> >> -					  PAGE_SIZE * mapping->nr_pages);
> >> -
> >> +	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
> >> +		if (!mapping->nc)
> >> +			__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
> >> +						  PAGE_SIZE * mapping->nr_pages);
> >> +	}
> >>  	return 0;
> >>  }
> >>  
> >> @@ -537,7 +539,7 @@ bool pkvm_pgtable_stage2_test_clear_young(struct
> >kvm_pgtable *pgt, u64 addr, u64
> >>  	lockdep_assert_held(&kvm->mmu_lock);
> >>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
> >>  		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
> >> -					   mapping->nr_pages, mkold);
> >> +					   (u64)mapping->nr_pages, mkold);
> >>  
> >>  	return young;
> >>  }
> >> 
> >> -- 
> >> Without deviation from the norm, progress is not possible.
> >
> 
> Thanks!

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Marc Zyngier]

On Thu, 02 Jul 2026 15:52:14 +0100,
Bradley Morgan <include@grrlz.net> wrote:
> 
> I'll test it. If it's good. I'll do
> 
> Suggested-by? Or co-developed by?

Sb if you want, definitely not Cdb. More importantly, I expect to you
to follow the process described at [1]. Nothing there is optional.

Thanks,

	M.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

On July 2, 2026 4:34:53 PM GMT+01:00, Marc Zyngier <maz@kernel.org> wrote:
>On Thu, 02 Jul 2026 15:52:14 +0100,
>Bradley Morgan <include@grrlz.net> wrote:
>> 
>> I'll test it. If it's good. I'll do
>> 
>> Suggested-by? Or co-developed by?
>
>Sb if you want, definitely not Cdb. More importantly, I expect to you
>to follow the process described at [1]. Nothing there is optional.
>
>Thanks,
>
>	M.
>
>[1]
>https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst
>
>


Hey, I've reviewed your code, LGTM, in a week (or when you tell me
discussion
is over)

I'll do V5! :)

I'll see if there is any modifications I can do to shorten
it, (of course if it fixes the bug)

Thanks maz for writing the fixed patch.

Thanks!

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Dev Jain]

On 02/07/26 12:54 am, Bradley Morgan wrote:
> pKVM keeps its own mapping list for stage 2 operations. Its flush path
> uses that list directly, so it lost the PTE attribute check done by the
> generic stage 2 walker.
> 
> Record whether a mapping is cacheable and skip cache maintenance for
> mappings that are not cacheable.
> 
> Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")

Is Fixes tag required? If I am reading correctly, Arm ARM says this:

"For VA-based cache maintenance instructions, the instruction operates on the
caches regardless of the memory type and cacheability attributes marked for
the memory address in the VMSA translation table entries. This means that
the effects of the cache maintenance instructions can apply regardless of:
  Whether the address accessed:
    Is Normal memory or Device memory.
    Has the Cacheable attribute or the Non-cacheable attribute."

So nothing goes wrong if we do dcache clean for non-cacheable memory.

> Signed-off-by: Bradley Morgan <include@grrlz.net>
> ---
> Changes since V3:
> - addressed some review :)
> 
>  arch/arm64/kvm/pkvm.c | 51 ++++++++++++++++++++++++++++++++++---------
>  1 file changed, 41 insertions(+), 10 deletions(-)
> 
> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
> index 053e4f733e4b..6d1cad890c7e 100644
> --- a/arch/arm64/kvm/pkvm.c
> +++ b/arch/arm64/kvm/pkvm.c
> @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct pkvm_mapping *m)
>  	return m->gfn * PAGE_SIZE;
>  }
>  
> +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
> +#define PKVM_MAPPING_NC                        BIT_ULL(48)
> +
> +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
> +{
> +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
> +}
> +
> +static bool pkvm_mapping_is_nc(struct pkvm_mapping *m)
> +{
> +	return m->nr_pages & PKVM_MAPPING_NC;
> +}
> +
> +static void pkvm_mapping_set_nr_pages(struct pkvm_mapping *m, u64 nr_pages,
> +				      bool nc)
> +{
> +	WARN_ON_ONCE(nr_pages & ~PKVM_MAPPING_NR_PAGES_MASK);
> +
> +	m->nr_pages = nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
> +	if (nc)
> +		m->nr_pages |= PKVM_MAPPING_NC;
> +}
> +
>  static u64 __pkvm_mapping_end(struct pkvm_mapping *m)
>  {
> -	return (m->gfn + m->nr_pages) * PAGE_SIZE - 1;
> +	return (m->gfn + pkvm_mapping_nr_pages(m)) * PAGE_SIZE - 1;
>  }
>  
>  INTERVAL_TREE_DEFINE(struct pkvm_mapping, node, u64, __subtree_last,
> @@ -350,7 +373,7 @@ static int __pkvm_pgtable_stage2_reclaim(struct kvm_pgtable *pgt, u64 start, u64
>  			continue;
>  
>  		page = pfn_to_page(mapping->pfn);
> -		WARN_ON_ONCE(mapping->nr_pages != 1);
> +	       WARN_ON_ONCE(pkvm_mapping_nr_pages(mapping) != 1);
>  		unpin_user_pages_dirty_lock(&page, 1, true);
>  		account_locked_vm(current->mm, 1, false);
>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
> @@ -369,7 +392,7 @@ static int __pkvm_pgtable_stage2_unshare(struct kvm_pgtable *pgt, u64 start, u64
>  
>  	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
>  		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
> -					mapping->nr_pages);
> +				       pkvm_mapping_nr_pages(mapping));
>  		if (WARN_ON(ret))
>  			return ret;
>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
> @@ -448,7 +471,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>  		 * permission faults are handled in the relax_perms() path.
>  		 */
>  		if (mapping) {
> -			if (size == (mapping->nr_pages * PAGE_SIZE))
> +			if (size == (pkvm_mapping_nr_pages(mapping) * PAGE_SIZE))
>  				return -EAGAIN;
>  
>  			/*
> @@ -472,7 +495,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,
>  	swap(mapping, cache->mapping);
>  	mapping->gfn = gfn;
>  	mapping->pfn = pfn;
> -	mapping->nr_pages = size / PAGE_SIZE;
> +	pkvm_mapping_set_nr_pages(mapping, size / PAGE_SIZE,
> +				  (prot & (KVM_PGTABLE_PROT_DEVICE |
> +					   KVM_PGTABLE_PROT_NORMAL_NC)));
>  	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
>  
>  	return ret;
> @@ -503,7 +528,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable *pgt, u64 addr, u64 size)
>  	lockdep_assert_held(&kvm->mmu_lock);
>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>  		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
> -					mapping->nr_pages);
> +				       pkvm_mapping_nr_pages(mapping));
>  		if (WARN_ON(ret))
>  			break;
>  	}
> @@ -517,9 +542,13 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size)
>  	struct pkvm_mapping *mapping;
>  
>  	lockdep_assert_held(&kvm->mmu_lock);
> -	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
> +	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
> +		if (pkvm_mapping_is_nc(mapping))
> +			continue;
> +
>  		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
> -					  PAGE_SIZE * mapping->nr_pages);
> +					  PAGE_SIZE * pkvm_mapping_nr_pages(mapping));
> +	}
>  
>  	return 0;
>  }
> @@ -536,8 +565,10 @@ bool pkvm_pgtable_stage2_test_clear_young(struct kvm_pgtable *pgt, u64 addr, u64
>  
>  	lockdep_assert_held(&kvm->mmu_lock);
>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
> -		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
> -					   mapping->nr_pages, mkold);
> +		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest,
> +					   handle, mapping->gfn,
> +					   pkvm_mapping_nr_pages(mapping),
> +					   mkold);
>  
>  	return young;
>  }

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

On July 5, 2026 3:08:58 PM GMT+01:00, Dev Jain <dev.jain@arm.com> wrote:
>
>
>On 02/07/26 12:54 am, Bradley Morgan wrote:
>> pKVM keeps its own mapping list for stage 2 operations. Its flush path
>> uses that list directly, so it lost the PTE attribute check done by the
>> generic stage 2 walker.
>> 
>> Record whether a mapping is cacheable and skip cache maintenance for
>> mappings that are not cacheable.
>> 
>> Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
>
>Is Fixes tag required? If I am reading correctly, Arm ARM says this:
>
>"For VA-based cache maintenance instructions, the instruction operates on
>the
>caches regardless of the memory type and cacheability attributes marked
>for
>the memory address in the VMSA translation table entries. This means that
>the effects of the cache maintenance instructions can apply regardless of:
>  Whether the address accessed:
>    Is Normal memory or Device memory.
>    Has the Cacheable attribute or the Non-cacheable attribute."
>
>So nothing goes wrong if we do dcache clean for non-cacheable memory.

hmmm. Makes sense, fair enough, in V5 I'll also remove the fixes tag


>> Signed-off-by: Bradley Morgan <include@grrlz.net>
>> ---
>> Changes since V3:
>> - addressed some review :)
>> 
>>  arch/arm64/kvm/pkvm.c | 51 ++++++++++++++++++++++++++++++++++---------
>>  1 file changed, 41 insertions(+), 10 deletions(-)
>> 
>> diff --git a/arch/arm64/kvm/pkvm.c b/arch/arm64/kvm/pkvm.c
>> index 053e4f733e4b..6d1cad890c7e 100644
>> --- a/arch/arm64/kvm/pkvm.c
>> +++ b/arch/arm64/kvm/pkvm.c
>> @@ -302,9 +302,32 @@ static u64 __pkvm_mapping_start(struct pkvm_mapping
>*m)
>>  	return m->gfn * PAGE_SIZE;
>>  }
>>  
>> +#define PKVM_MAPPING_NR_PAGES_MASK     GENMASK_ULL(47, 0)
>> +#define PKVM_MAPPING_NC                        BIT_ULL(48)
>> +
>> +static u64 pkvm_mapping_nr_pages(struct pkvm_mapping *m)
>> +{
>> +	return m->nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
>> +}
>> +
>> +static bool pkvm_mapping_is_nc(struct pkvm_mapping *m)
>> +{
>> +	return m->nr_pages & PKVM_MAPPING_NC;
>> +}
>> +
>> +static void pkvm_mapping_set_nr_pages(struct pkvm_mapping *m, u64
>nr_pages,
>> +				      bool nc)
>> +{
>> +	WARN_ON_ONCE(nr_pages & ~PKVM_MAPPING_NR_PAGES_MASK);
>> +
>> +	m->nr_pages = nr_pages & PKVM_MAPPING_NR_PAGES_MASK;
>> +	if (nc)
>> +		m->nr_pages |= PKVM_MAPPING_NC;
>> +}
>> +
>>  static u64 __pkvm_mapping_end(struct pkvm_mapping *m)
>>  {
>> -	return (m->gfn + m->nr_pages) * PAGE_SIZE - 1;
>> +	return (m->gfn + pkvm_mapping_nr_pages(m)) * PAGE_SIZE - 1;
>>  }
>>  
>>  INTERVAL_TREE_DEFINE(struct pkvm_mapping, node, u64, __subtree_last,
>> @@ -350,7 +373,7 @@ static int __pkvm_pgtable_stage2_reclaim(struct
>kvm_pgtable *pgt, u64 start, u64
>>  			continue;
>>  
>>  		page = pfn_to_page(mapping->pfn);
>> -		WARN_ON_ONCE(mapping->nr_pages != 1);
>> +	       WARN_ON_ONCE(pkvm_mapping_nr_pages(mapping) != 1);
>>  		unpin_user_pages_dirty_lock(&page, 1, true);
>>  		account_locked_vm(current->mm, 1, false);
>>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
>> @@ -369,7 +392,7 @@ static int __pkvm_pgtable_stage2_unshare(struct
>kvm_pgtable *pgt, u64 start, u64
>>  
>>  	for_each_mapping_in_range_safe(pgt, start, end, mapping) {
>>  		ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_guest, handle, mapping->gfn,
>> -					mapping->nr_pages);
>> +				       pkvm_mapping_nr_pages(mapping));
>>  		if (WARN_ON(ret))
>>  			return ret;
>>  		pkvm_mapping_remove(mapping, &pgt->pkvm_mappings);
>> @@ -448,7 +471,7 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt,
>u64 addr, u64 size,
>>  		 * permission faults are handled in the relax_perms() path.
>>  		 */
>>  		if (mapping) {
>> -			if (size == (mapping->nr_pages * PAGE_SIZE))
>> +			if (size == (pkvm_mapping_nr_pages(mapping) * PAGE_SIZE))
>>  				return -EAGAIN;
>>  
>>  			/*
>> @@ -472,7 +495,9 @@ int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt,
>u64 addr, u64 size,
>>  	swap(mapping, cache->mapping);
>>  	mapping->gfn = gfn;
>>  	mapping->pfn = pfn;
>> -	mapping->nr_pages = size / PAGE_SIZE;
>> +	pkvm_mapping_set_nr_pages(mapping, size / PAGE_SIZE,
>> +				  (prot & (KVM_PGTABLE_PROT_DEVICE |
>> +					   KVM_PGTABLE_PROT_NORMAL_NC)));
>>  	pkvm_mapping_insert(mapping, &pgt->pkvm_mappings);
>>  
>>  	return ret;
>> @@ -503,7 +528,7 @@ int pkvm_pgtable_stage2_wrprotect(struct kvm_pgtable
>*pgt, u64 addr, u64 size)
>>  	lockdep_assert_held(&kvm->mmu_lock);
>>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>>  		ret = kvm_call_hyp_nvhe(__pkvm_host_wrprotect_guest, handle, mapping->gfn,
>> -					mapping->nr_pages);
>> +				       pkvm_mapping_nr_pages(mapping));
>>  		if (WARN_ON(ret))
>>  			break;
>>  	}
>> @@ -517,9 +542,13 @@ int pkvm_pgtable_stage2_flush(struct kvm_pgtable
>*pgt, u64 addr, u64 size)
>>  	struct pkvm_mapping *mapping;
>>  
>>  	lockdep_assert_held(&kvm->mmu_lock);
>> -	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
>> +	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping) {
>> +		if (pkvm_mapping_is_nc(mapping))
>> +			continue;
>> +
>>  		__clean_dcache_guest_page(pfn_to_kaddr(mapping->pfn),
>> -					  PAGE_SIZE * mapping->nr_pages);
>> +					  PAGE_SIZE * pkvm_mapping_nr_pages(mapping));
>> +	}
>>  
>>  	return 0;
>>  }
>> @@ -536,8 +565,10 @@ bool pkvm_pgtable_stage2_test_clear_young(struct
>kvm_pgtable *pgt, u64 addr, u64
>>  
>>  	lockdep_assert_held(&kvm->mmu_lock);
>>  	for_each_mapping_in_range_safe(pgt, addr, addr + size, mapping)
>> -		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest, handle, mapping->gfn,
>> -					   mapping->nr_pages, mkold);
>> +		young |= kvm_call_hyp_nvhe(__pkvm_host_test_clear_young_guest,
>> +					   handle, mapping->gfn,
>> +					   pkvm_mapping_nr_pages(mapping),
>> +					   mkold);
>>  
>>  	return young;
>>  }
>
>

Thanks!

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Marc Zyngier]

On Sun, 05 Jul 2026 15:08:58 +0100,
Dev Jain <dev.jain@arm.com> wrote:
> 
> 
> 
> On 02/07/26 12:54 am, Bradley Morgan wrote:
> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
> > uses that list directly, so it lost the PTE attribute check done by the
> > generic stage 2 walker.
> > 
> > Record whether a mapping is cacheable and skip cache maintenance for
> > mappings that are not cacheable.
> > 
> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
> 
> Is Fixes tag required? If I am reading correctly, Arm ARM says this:
> 
> "For VA-based cache maintenance instructions, the instruction operates on the
> caches regardless of the memory type and cacheability attributes marked for
> the memory address in the VMSA translation table entries. This means that
> the effects of the cache maintenance instructions can apply regardless of:
>   Whether the address accessed:
>     Is Normal memory or Device memory.
>     Has the Cacheable attribute or the Non-cacheable attribute."
> 
> So nothing goes wrong if we do dcache clean for non-cacheable
> memory.

Two things:

- having to perform CMOs for something that is not *expected* to be
  cacheable is both pointless and a contradiction of the intent

- what you quote is about the nature of the *mapping*, and not the
  memory that is being mapped. Cleaning a dirty cache line on an
  unsuspecting MMIO endpoint is never going to end nicely. Just have a
  try.

My reading of all this is that a fix indeed is required, and therefore
a Fixes tag *must* be present.

	M.

-- 
Jazz isn't dead. It just smells funny.

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

On July 5, 2026 8:27:34 PM GMT+01:00, Marc Zyngier <maz@kernel.org> wrote:
>On Sun, 05 Jul 2026 15:08:58 +0100,
>Dev Jain <dev.jain@arm.com> wrote:
>> 
>> 
>> 
>> On 02/07/26 12:54 am, Bradley Morgan wrote:
>> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
>> > uses that list directly, so it lost the PTE attribute check done by
>the
>> > generic stage 2 walker.
>> > 
>> > Record whether a mapping is cacheable and skip cache maintenance for
>> > mappings that are not cacheable.
>> > 
>> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
>> 
>> Is Fixes tag required? If I am reading correctly, Arm ARM says this:
>> 
>> "For VA-based cache maintenance instructions, the instruction operates
>on the
>> caches regardless of the memory type and cacheability attributes marked
>for
>> the memory address in the VMSA translation table entries. This means
>that
>> the effects of the cache maintenance instructions can apply regardless
>of:
>>   Whether the address accessed:
>>     Is Normal memory or Device memory.
>>     Has the Cacheable attribute or the Non-cacheable attribute."
>> 
>> So nothing goes wrong if we do dcache clean for non-cacheable
>> memory.
>
>Two things:
>
>- having to perform CMOs for something that is not *expected* to be
>  cacheable is both pointless and a contradiction of the intent
>
>- what you quote is about the nature of the *mapping*, and not the
>  memory that is being mapped. Cleaning a dirty cache line on an
>  unsuspecting MMIO endpoint is never going to end nicely. Just have a
>  try.
>
>My reading of all this is that a fix indeed is required, and therefore
>a Fixes tag *must* be present.
>
>	M.
>
>


Well, fair enough.

It's kind of two things.

1: A fix
2: a optimization 

I say it's a fix, because it's not fun, no.

And I Also say it's a optimization because wasting cycles isn't a good
idea, trust me.

Thanks!

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Marc Zyngier]

On Sun, 05 Jul 2026 20:29:20 +0100,
Bradley Morgan <include@grrlz.net> wrote:
> 
> On July 5, 2026 8:27:34 PM GMT+01:00, Marc Zyngier <maz@kernel.org> wrote:
> >On Sun, 05 Jul 2026 15:08:58 +0100,
> >Dev Jain <dev.jain@arm.com> wrote:
> >> 
> >> 
> >> 
> >> On 02/07/26 12:54 am, Bradley Morgan wrote:
> >> > pKVM keeps its own mapping list for stage 2 operations. Its flush path
> >> > uses that list directly, so it lost the PTE attribute check done by
> >the
> >> > generic stage 2 walker.
> >> > 
> >> > Record whether a mapping is cacheable and skip cache maintenance for
> >> > mappings that are not cacheable.
> >> > 
> >> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
> >> 
> >> Is Fixes tag required? If I am reading correctly, Arm ARM says this:
> >> 
> >> "For VA-based cache maintenance instructions, the instruction operates
> >on the
> >> caches regardless of the memory type and cacheability attributes marked
> >for
> >> the memory address in the VMSA translation table entries. This means
> >that
> >> the effects of the cache maintenance instructions can apply regardless
> >of:
> >>   Whether the address accessed:
> >>     Is Normal memory or Device memory.
> >>     Has the Cacheable attribute or the Non-cacheable attribute."
> >> 
> >> So nothing goes wrong if we do dcache clean for non-cacheable
> >> memory.
> >
> >Two things:
> >
> >- having to perform CMOs for something that is not *expected* to be
> >  cacheable is both pointless and a contradiction of the intent
> >
> >- what you quote is about the nature of the *mapping*, and not the
> >  memory that is being mapped. Cleaning a dirty cache line on an
> >  unsuspecting MMIO endpoint is never going to end nicely. Just have a
> >  try.
> >
> >My reading of all this is that a fix indeed is required, and therefore
> >a Fixes tag *must* be present.
> >
> >	M.
> >
> >
> 
> 
> Well, fair enough.
> 
> It's kind of two things.
> 
> 1: A fix
> 2: a optimization 
> 
> I say it's a fix, because it's not fun, no.
>
> And I Also say it's a optimization because wasting cycles isn't a good
> idea, trust me.

This is getting tiresome. Really. And when it comes to wasting cycles,
you strike me as the expert here.

It's not an optimisation at all. If anything, the test is going to
cost cycles because there is statistically never a case that you map a
device with upstream pKVM.

If you call this an optimisation, I'll ask for numbers *proving* this
is actually one. Do you really want to get down that road?

	M.

-- 
Jazz isn't dead. It just smells funny.

Re: [PATCH v4] KVM: arm64: Record whether pKVM stage 2 mapping is cacheable

[Bradley Morgan]

On July 5, 2026 9:13:31 PM GMT+01:00, Marc Zyngier <maz@kernel.org> wrote:
>On Sun, 05 Jul 2026 20:29:20 +0100,
>Bradley Morgan <include@grrlz.net> wrote:
>> 
>> On July 5, 2026 8:27:34 PM GMT+01:00, Marc Zyngier <maz@kernel.org>
>wrote:
>> >On Sun, 05 Jul 2026 15:08:58 +0100,
>> >Dev Jain <dev.jain@arm.com> wrote:
>> >> 
>> >> 
>> >> 
>> >> On 02/07/26 12:54 am, Bradley Morgan wrote:
>> >> > pKVM keeps its own mapping list for stage 2 operations. Its flush
>path
>> >> > uses that list directly, so it lost the PTE attribute check done by
>> >the
>> >> > generic stage 2 walker.
>> >> > 
>> >> > Record whether a mapping is cacheable and skip cache maintenance
>for
>> >> > mappings that are not cacheable.
>> >> > 
>> >> > Fixes: e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU")
>> >> 
>> >> Is Fixes tag required? If I am reading correctly, Arm ARM says this:
>> >> 
>> >> "For VA-based cache maintenance instructions, the instruction
>operates
>> >on the
>> >> caches regardless of the memory type and cacheability attributes
>marked
>> >for
>> >> the memory address in the VMSA translation table entries. This means
>> >that
>> >> the effects of the cache maintenance instructions can apply
>regardless
>> >of:
>> >>   Whether the address accessed:
>> >>     Is Normal memory or Device memory.
>> >>     Has the Cacheable attribute or the Non-cacheable attribute."
>> >> 
>> >> So nothing goes wrong if we do dcache clean for non-cacheable
>> >> memory.
>> >
>> >Two things:
>> >
>> >- having to perform CMOs for something that is not *expected* to be
>> >  cacheable is both pointless and a contradiction of the intent
>> >
>> >- what you quote is about the nature of the *mapping*, and not the
>> >  memory that is being mapped. Cleaning a dirty cache line on an
>> >  unsuspecting MMIO endpoint is never going to end nicely. Just have a
>> >  try.
>> >
>> >My reading of all this is that a fix indeed is required, and therefore
>> >a Fixes tag *must* be present.
>> >
>> >	M.
>> >
>> >
>> 
>> 
>> Well, fair enough.
>> 
>> It's kind of two things.
>> 
>> 1: A fix
>> 2: a optimization 
>> 
>> I say it's a fix, because it's not fun, no.
>>
>> And I Also say it's a optimization because wasting cycles isn't a good
>> idea, trust me.
>
>This is getting tiresome. Really. And when it comes to wasting cycles,
>you strike me as the expert here.
>
>It's not an optimisation at all. If anything, the test is going to
>cost cycles because there is statistically never a case that you map a
>device with upstream pKVM.
>
>If you call this an optimisation, I'll ask for numbers *proving* this
>is actually one. Do you really want to get down that road?

yeah, lesson learned..

before I embarrass myself more, I'll only respond if I have to...

sorry.

>	M.
>
>

Thanks!