[PATCH v3 00/17] KVM: arm64: Introduce pKVM hypervisor heap allocator

[Fuad Tabba]

Tested on QEMU: npVM/pVM boots, the in-hyp allocator selftest, and
hyp-trace buffer load; allocator top-up path confirmed via the
kvm_handle_pkvm_hyp_req tracepoint (HYP_ALLOC).

Tested-by: Fuad Tabba < fuad.tabba at linux.dev>

Cheers,
/fuad

On Mon, 20 Jul 2026 at 18:15, Vincent Donnefort <vdonnefort at google.com> wrote:
>
> pKVM historically lacked a dynamic memory allocator: all hypervisor-side
> VM and VCPU structures had to be sized on the host, allocated as
> contiguous pages and donated to the hypervisor.
>
> This design tightly coupled the hypervisor's memory footprint to
> host-side constraints, complicated memory reclaim, and severely
> restricted VM scalability.
>
> This patch series introduces a dynamically-mapped custom heap allocator
> (hyp_allocator) to the pKVM hypervisor. The initial users are the
> pkvm_hyp_vm and pkvm_hyp_vcpu structs, and the hypervisor tracing
> metadata.
>
> In the near future, this heap allocator is expected to be leveraged to
> support SVE in protected VMs and in the distant future, it will also
> support dynamic device assignment.
>
> By moving to a hypervisor-managed dynamic allocator, we also allow
> deduplicating the donation/reclaim path of EL2-private structures.
>
> The main building blocks for this series are:
>
> 1. pkvm_hyp_req:
> ----------------
> When the hypervisor heap allocator goes out of memory (-ENOMEM), it
> suspends the hypercall, embeds a PKVM_HYP_REQ_HYP_ALLOC top-up request
> into the SMCCC HVC return registers, and exits back to the host.
>
> This building block will also be useful for the future huge-mapping
> support in protected guests, allowing EL2 to raise requests such as
> block splitting back to the host.
>
> 2. hyp_allocator:
> ----------------
> This heap allocator manages a reserved VA space range, dynamically
> mapping and unmapping physical pages on-demand to minimise the pKVM
> hypervisor footprint. As memory is reclaimed and relinquished to the
> host, unmapped holes are introduced within the VA space. To prevent
> orphan mapped regions, neighboring unused chunks cannot be merged if
> they are separated by an unmapped region.
>
> The allocator chunk metadata is stored directly into the VA space range.
> To minimize metadata overhead, chunks only link to each other via a
> relative 32-bit offset.
>
> A simple hardening of the metadata is added via a simple 32-bit hash.
>
> 3. shrinker:
> ------------
> As the heap allocator isn't reclaimed actively on VM or tracing
> teardown, a shrinker is added to allow the host to reclaim unused memory
> from the hypervisor when the host is under heavy memory pressure.
>
> v2 -> v3:
>   - Remove unsafe WARN_ON(hyp_spin_is_locked(&pkvm_pgd_lock)) check in hyp_allocator_alloc() (Sashiko)
>   - Modify MIN_ALLOC_SIZE to 16-bytes to comply with FPSIMD alignment requirements (Sashiko)
>   - Allow hyp topup/reclaim HVCs pre-deprivilege
>   - Add enum symbols to pkvm_hyp_req_handle event (Fuad)
>   - Various clarification in commit descriptions (Fuad)
>   - Restore unmap_donated_memory() for PGD on error path (Fuad)
>   - Renamed __hyp_allocator_map -> pkvm_map_private_va_range (Fuad)
>   - Collected Fuad's Reviewed-by tags
>   - Rebased on 7.2-rc4
>
> v1 -> v2:
>   - Rebased series on 7.2-rc2.
>   - Use scope-based hyp_spinlock.
>   - Fix best_missing/best_data_size priority in hyp_allocator_find_efficient_chunk() (Sashiko)
>   - Fix missing free_hyp_memcache() in pkvm_hyp_topup() (Sashiko)
>   - Fix unused selftest_init() warning when !CONFIG_NVHE_EL2_DEBUG (Sashiko)
>   - Fix missing shrinker_free() in teardown_hyp_mode() (Sashiko)
>
> v1: https://lore.kernel.org/r/20260520152650.4107895-1-vdonnefort@google.com
>
> Vincent Donnefort (17):
>   KVM: arm64: Add pkvm_private_va_range_pa
>   KVM: arm64: Add pkvm_remove_mappings
>   KVM: arm64: Add pkvm_map_private_va_range
>   KVM: arm64: Add a heap allocator for the pKVM hyp
>   KVM: arm64: Allow kvm_hyp_memcache usage outside of stage-2
>   KVM: arm64: Add pkvm_hyp_req infrastructure
>   KVM: arm64: Add PKVM_HYP_REQ_HYP_ALLOC request
>   KVM: arm64: Add reclaim interface for the pKVM heap alloc
>   KVM: arm64: Add selftests for the pKVM heap allocator
>   KVM: arm64: Add a shrinker for pKVM
>   KVM: arm64: Filter out non-kernel addresses in kern_hyp_va
>   KVM: arm64: Move hyp_vm refcount into the structure
>   KVM: arm64: Alloc pkvm_hyp_vm using pKVM heap allocator
>   KVM: arm64: Alloc pkvm_hyp_vcpu using pKVM heap allocator
>   KVM: arm64: Reject hyp trace descriptors with fewer CPUs than
>     hyp_nr_cpus
>   KVM: arm64: Reject hyp trace descriptors with fewer than 3 pages
>   KVM: arm64: Alloc simple_buffer_page using pKVM hyp allocator
>
>  arch/arm64/include/asm/kvm_asm.h           |    4 +
>  arch/arm64/include/asm/kvm_host.h          |   14 +-
>  arch/arm64/include/asm/kvm_mmu.h           |    3 +
>  arch/arm64/include/asm/kvm_pkvm.h          |  102 ++
>  arch/arm64/kvm/arm.c                       |    2 +
>  arch/arm64/kvm/hyp/hyp-constants.c         |    2 -
>  arch/arm64/kvm/hyp/include/nvhe/alloc.h    |   24 +
>  arch/arm64/kvm/hyp/include/nvhe/mm.h       |    3 +
>  arch/arm64/kvm/hyp/include/nvhe/pkvm.h     |   19 +-
>  arch/arm64/kvm/hyp/include/nvhe/spinlock.h |    4 +
>  arch/arm64/kvm/hyp/nvhe/Makefile           |    2 +-
>  arch/arm64/kvm/hyp/nvhe/alloc.c            | 1223 ++++++++++++++++++++
>  arch/arm64/kvm/hyp/nvhe/hyp-main.c         |  124 +-
>  arch/arm64/kvm/hyp/nvhe/mm.c               |   51 +
>  arch/arm64/kvm/hyp/nvhe/pkvm.c             |  100 +-
>  arch/arm64/kvm/hyp/nvhe/setup.c            |    6 +
>  arch/arm64/kvm/hyp/nvhe/trace.c            |   70 +-
>  arch/arm64/kvm/hyp_trace.c                 |   15 +-
>  arch/arm64/kvm/mmu.c                       |    4 +-
>  arch/arm64/kvm/pkvm.c                      |  159 ++-
>  arch/arm64/kvm/trace_pkvm.h                |   45 +
>  21 files changed, 1831 insertions(+), 145 deletions(-)
>  create mode 100644 arch/arm64/kvm/hyp/include/nvhe/alloc.h
>  create mode 100644 arch/arm64/kvm/hyp/nvhe/alloc.c
>  create mode 100644 arch/arm64/kvm/trace_pkvm.h
>
>
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
> --
> 2.55.0.229.g6434b31f56-goog
>