[RFC PATCH 0/5] KVM: arm64: Use TTBR1_EL2 for hVHE runtime mappings

From: Aneesh Kumar K.V (Arm)

Date: Thu Jul 16 2026 - 11:29:35 EST


hVHE currently disables TTBR1_EL2 and places both the identity mapping
and the hyp runtime mappings in TTBR0_EL2. As a result, it continues to
use the legacy nVHE virtual-address layout even though hVHE uses the
EL2&0 translation regime and can retain canonical kernel-image addresses.

This series moves the hVHE runtime mappings to TTBR1_EL2 and reserves
TTBR0_EL2 for the identity mapping used during MMU and page-table
transitions. Conventional VHE is unaffected, and nVHE continues to use
the existing TTBR0-only layout, including when protected mode is enabled.

The existing code does not consistently distinguish kernel-image symbols
from linear-map addresses because both currently use the same EL2
address transformation. The first four patches make this distinction
explicit by:

- adding helpers for kernel-image symbol addresses;
- splitting the hyp mapping APIs by address type;
- providing separate symbol and linear VA-to-PA conversions; and
- clarifying the private hyp VA allocation terminology.

The final patch implements the TTBR1 layout. Hyp symbols retain their
linked kernel-image VAs, while pools, per-CPU regions, SVE state and shared
memory continue to use linear-map addresses. A separate TTBR0 page table
contains the idmap, and both roots are installed during initial EL2 setup
and pKVM finalization.

The resulting layouts are:

nVHE:
TTBR0_EL2: idmap and runtime mappings
TTBR1_EL2: unused

hVHE:
TTBR0_EL2: idmap
TTBR1_EL2: runtime mappings

Cc: Marc Zyngier <maz@xxxxxxxxxx>
Cc: Oliver Upton <oupton@xxxxxxxxxx>
Cc: Joey Gouly <joey.gouly@xxxxxxx>
Cc: Steffen Eiden <seiden@xxxxxxxxxxxxx>
Cc: Suzuki K Poulose <suzuki.poulose@xxxxxxx>
Cc: Zenghui Yu <yuzenghui@xxxxxxxxxx>
Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
Cc: Will Deacon <will@xxxxxxxxxx>

Aneesh Kumar K.V (Arm) (5):
KVM: arm64: Make hyp symbol address conversion explicit
KVM: arm64: Split hyp mapping APIs by address type
KVM: arm64: Split hyp VA-to-PA conversion by address type
KVM: arm64: Rename the hyp private VA allocation base
KVM: arm64: Use TTBR1_EL2 for hVHE runtime mappings

arch/arm64/include/asm/kvm_asm.h | 13 +--
arch/arm64/include/asm/kvm_host.h | 2 +
arch/arm64/include/asm/kvm_hyp.h | 4 +-
arch/arm64/include/asm/kvm_mmu.h | 89 ++++++++++++++--
arch/arm64/include/asm/kvm_pgtable.h | 27 +++++
arch/arm64/include/asm/kvm_pkvm.h | 3 +
arch/arm64/kernel/asm-offsets.c | 5 +-
arch/arm64/kvm/arm.c | 92 +++++++++-------
arch/arm64/kvm/hyp/include/nvhe/memory.h | 13 +--
arch/arm64/kvm/hyp/include/nvhe/mm.h | 9 +-
arch/arm64/kvm/hyp/nvhe/early_alloc.c | 1 +
arch/arm64/kvm/hyp/nvhe/events.c | 2 +-
arch/arm64/kvm/hyp/nvhe/host.S | 4 +-
arch/arm64/kvm/hyp/nvhe/hyp-init.S | 29 ++++-
arch/arm64/kvm/hyp/nvhe/mem_protect.c | 30 +++---
arch/arm64/kvm/hyp/nvhe/mm.c | 110 +++++++++++++------
arch/arm64/kvm/hyp/nvhe/psci-relay.c | 12 +--
arch/arm64/kvm/hyp/nvhe/setup.c | 55 +++++++---
arch/arm64/kvm/hyp/pgtable.c | 62 ++++++++++-
arch/arm64/kvm/hyp_trace.c | 2 +-
arch/arm64/kvm/mmu.c | 128 ++++++++++++++++-------
arch/arm64/kvm/pkvm.c | 3 +
arch/arm64/kvm/va_layout.c | 32 +++++-
23 files changed, 546 insertions(+), 181 deletions(-)


base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
--
2.43.0