[PATCH] KVM: arm64: Optimize protected mode and FWB

From: Mostafa Saleh

Date: Mon Jul 20 2026 - 16:35:43 EST


KVM opportunistically enables FWB if supported by the system for guest
VMs, which allows it to elude cache maintenance for data as they are
forced to be cacheable from stage-2.
In that case, __clean_dcache_guest_page() will immediately return.
However in protected mode, before calling __clean_dcache_guest_page()
it loops over the range and fix_map/unmap it, issuing TLB
invalidations, dsb() and isb() unnecessarily.

This can be optimized by returning early if FWB is supported,
kvm_pgtable_stage2_map() already issues dsb() and tlb invalidation
functions issue dsb() for the unmap path.

Signed-off-by: Mostafa Saleh <smostafa@xxxxxxxxxx>
---
arch/arm64/kvm/hyp/nvhe/mem_protect.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index 4e329e39a695..6e9229106a25 100644
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -261,6 +261,10 @@ static void __apply_guest_page(void *va, size_t size,

static void clean_dcache_guest_page(void *va, size_t size)
{
+ /* See __clean_dcache_guest_page() */
+ if (cpus_have_final_cap(ARM64_HAS_STAGE2_FWB))
+ return;
+
__apply_guest_page(va, size, __clean_dcache_guest_page);
}

--
2.55.0.229.g6434b31f56-goog