diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h
index 148ddc4acfb8..1b3d1ba6cf58 100644
--- a/arch/arm64/kernel/image-vars.h
+++ b/arch/arm64/kernel/image-vars.h
@@ -140,6 +140,10 @@ KVM_NVHE_ALIAS(__hyp_rodata_end);
 KVM_NVHE_ALIAS(__hyp_event_ids_start);
 KVM_NVHE_ALIAS(__hyp_event_ids_end);
 KVM_NVHE_ALIAS(__hyp_printk_fmts_start);
+#ifdef CONFIG_PROTECTED_NVHE_FTRACE
+KVM_NVHE_ALIAS(__hyp_patchable_function_entries_start);
+KVM_NVHE_ALIAS(__hyp_patchable_function_entries_end);
+#endif
 #endif
 
 /* pKVM static key */
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 481e88afb747..8cd796663aef 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -18,7 +18,11 @@
 	. = ALIGN(PAGE_SIZE);					\
 	__hyp_event_ids_start = .;				\
 	*(HYP_SECTION_NAME(.event_ids))				\
-	__hyp_event_ids_end = .;
+	__hyp_event_ids_end = .;				\
+	__hyp_patchable_function_entries_start = .;		\
+	*(HYP_SECTION_NAME(__patchable_function_entries))	\
+	__hyp_patchable_function_entries_end = .;
+
 #else
 #define HYPERVISOR_EVENT_IDS
 #endif
diff --git a/arch/arm64/kvm/hyp/nvhe/Makefile b/arch/arm64/kvm/hyp/nvhe/Makefile
index c3efa66b672a..bd1fb2453999 100644
--- a/arch/arm64/kvm/hyp/nvhe/Makefile
+++ b/arch/arm64/kvm/hyp/nvhe/Makefile
@@ -29,4 +29,10 @@ $(obj)/hyp.lds: $(src)/hyp.lds.S FORCE
 	$(call if_changed_dep,cpp_lds_S)
 
 include $(srctree)/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe
+
+CFLAGS_REMOVE_trace.nvhe.o := -fpatchable-function-entry=3
+CFLAGS_REMOVE_events.nvhe.o := -fpatchable-function-entry=3
+CFLAGS_REMOVE_ftrace.nvhe.o := -fpatchable-function-entry=3
+CFLAGS_REMOVE_setup.nvhe.o := -fpatchable-function-entry=3
+
 obj-y := kvm_nvhe.o
diff --git a/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe b/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe
index 71e574f0614f..582d0fcb084b 100644
--- a/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe
+++ b/arch/arm64/kvm/hyp/nvhe/Makefile.nvhe
@@ -14,6 +14,10 @@ ccflags-y += -fno-stack-protector	\
 	     -DDISABLE_BRANCH_PROFILING	\
 	     $(DISABLE_STACKLEAK_PLUGIN)
 
+ifeq ($(CONFIG_PROTECTED_NVHE_FTRACE), y)
+ccflags-y += -fpatchable-function-entry=3
+endif
+
 HYPREL := arch/arm64/tools/gen-hyprel
 
 ##
diff --git a/arch/arm64/kvm/hyp/nvhe/clock.c b/arch/arm64/kvm/hyp/nvhe/clock.c
index 0d1f74bc2e11..73866b3bfe3d 100644
--- a/arch/arm64/kvm/hyp/nvhe/clock.c
+++ b/arch/arm64/kvm/hyp/nvhe/clock.c
@@ -34,7 +34,7 @@ void trace_clock_update(u32 mult, u32 shift, u64 epoch_ns, u64 epoch_cyc)
 }
 
 /* Using host provided data. Do not use for anything else than debugging. */
-u64 trace_clock(void)
+u64 __attribute__((patchable_function_entry(0, 0))) trace_clock(void)
 {
 	struct clock_data *clock = &trace_clock_data;
 	u64 bank = smp_load_acquire(&clock->cur);
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp.lds.S b/arch/arm64/kvm/hyp/nvhe/hyp.lds.S
index f588c284bd25..912c4eb338e2 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp.lds.S
+++ b/arch/arm64/kvm/hyp/nvhe/hyp.lds.S
@@ -21,6 +21,7 @@ SECTIONS {
 	BEGIN_HYP_SECTION(.event_ids)
 		*(SORT(.hyp.event_ids.*))
 	END_HYP_SECTION
+	HYP_SECTION(__patchable_function_entries)
 #endif
 
 	/*