Re: [PATCH v3] KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E

[Marc Zyngier]

On Tue, 20 Oct 2026 07:43:06 +0100, Fuad Tabba wrote:
> KVM uses the VM's ID registers as the source of truth for what the
> guest has, but userspace can expose S1PIE or S1POE without the features
> they imply. As per the architecture, both imply TCR2 and ATS1A, and
> S1POE also implies HPDS. With TCR2 hidden, the world switch skips
> PIR_EL1, PIRE0_EL1 and POR_EL1 while KVM doesn't trap them, so the guest
> accesses registers that are neither trapped nor switched. Under VHE,
> that leaks values between guests. On nVHE and hVHE, pKVM included, the
> host kernel resumes with the guest's PIR_EL1 and PIRE0_EL1.
> 
> [...]

Applied to fixes, thanks!

[1/1] KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
      commit: 68c11eed4f8097ef1b71c30679e96eb654df29e0

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.