Re: [PATCH v2] KVM: arm64: Enable S1PIE for hVHE

[Marc Zyngier <maz@kernel.org>]

On Tue, 08 Sep 2026 21:31:45 +0100,
sashiko-bot@kernel.org wrote:
> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] S1PIE permission indirection registers are incorrectly swapped for hVHE mode, zeroing PIRE0_EL2 and causing an immediate fatal Permission Fault upon MMU enable.
> --
> 
> commit 3004dc878365b596c5ed9c6a57b485c6d2028592
> Author: Mark Brown <broonie@kernel.org>
> Subject: KVM: arm64: Enable S1PIE for hVHE
> 
> This patch enables S1PIE for the hypervisor when running in hVHE mode. It
> configures permission indirection to map to non-PIE meanings to minimize
> page table manipulation changes. It also explicitly configures TCR2_EL2
> when running in VHE or hVHE modes.
>
> > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-init.S b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
> > --- a/arch/arm64/kvm/hyp/nvhe/hyp-init.S
> > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
> 
> [ ... ]
> 
> > @@ -137,8 +137,20 @@ alternative_if ARM64_HAS_CNP
> >  alternative_else_nop_endif
> >  	msr	ttbr0_el2, x2
> >  
> > -	ldr	x0, [x0, #NVHE_INIT_TCR_EL2]
> > -	msr	tcr_el2, x0
> > +	ldr	x1, [x0, #NVHE_INIT_TCR_EL2]
> > +	msr	tcr_el2, x1
> > +
> > +alternative_if ARM64_HAS_S1PIE
> > +	/* S1PIE is only enabled with TCR2_EL2.PIE if we are running hVHE */
> > +	mov_q	x1, KVM_HVHE_PIR_EL2
> > +	msr	REG_PIR_EL2, x1
> > +	msr	REG_PIRE0_EL2, xzr
> 
> [Severity: Critical]
> Does this initialization swap the target registers? Since hVHE uses TTBR0_EL2
> for its translation regime, permission indirection for this space is governed
> by PIRE0_EL2. By zeroing PIRE0_EL2 and writing the valid permissions to
> PIR_EL2, won't this cause the CPU to evaluate execution permissions as No
> Access and immediately trigger a Permission Fault when the MMU is enabled?

Utter nonsense. Refer to the definition and notice the "unprivileged"
qualifier.

	M.

-- 
Without deviation from the norm, progress is not possible.