diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index f8116630c743b..9d7e134419fbd 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -316,6 +316,8 @@ static const struct midr_range apple_broken_seis_cpus[] = {
 	MIDR_ALL_VERSIONS(MIDR_APPLE_T6040_P),
 	MIDR_ALL_VERSIONS(MIDR_APPLE_TAHITI_E),
 	MIDR_ALL_VERSIONS(MIDR_APPLE_TAHITI_P),
+	MIDR_ALL_VERSIONS(MIDR_APPLE_T8142_E),
+	MIDR_ALL_VERSIONS(MIDR_APPLE_T8142_P),
 	{},
 };
 
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index f51c3d756b3d8..df4d4a3b479b0 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -2535,9 +2535,14 @@ static int set_id_aa64pfr1_el1(struct kvm_vcpu *vcpu,
 	 * ID_AA64PFR1_EL1.MTE_frac to 0. However, ignore it to avoid
 	 * incorrectly claiming hardware support for MTE_ASYNC in the
 	 * guest.
+	 *
+	 * Only a VM with MTE sees MTE_frac. Without MTE both fields read
+	 * as 0 and the 0 written back must stay 0, or the value no longer
+	 * matches the one KVM itself provided.
 	 */
 
-	if (mte == ID_AA64PFR1_EL1_MTE_MTE2 &&
+	if (kvm_has_mte(vcpu->kvm) &&
+	    mte == ID_AA64PFR1_EL1_MTE_MTE2 &&
 	    hw_mte_frac == ID_AA64PFR1_EL1_MTE_frac_NI &&
 	    user_mte_frac == ID_AA64PFR1_EL1_MTE_frac_ASYNC) {
 		user_val &= ~ID_AA64PFR1_EL1_MTE_frac_MASK;
diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c
index 393596ff6231b..21a43bd7737e5 100644
--- a/drivers/irqchip/irq-apple-aic.c
+++ b/drivers/irqchip/irq-apple-aic.c
@@ -1286,6 +1286,18 @@ static int __init aic_of_ic_init(struct device_node *node, struct device_node *p
 
 	irqc->info = *(struct aic_info *)match->data;
 
+	/*
+	 * The VM_TMR_FIQ_ENA_EL2 write that traps on T8142 was seen under
+	 * SPTM. A loader that runs the OS at EL2 in a CTXR execute window
+	 * starts no SPTM and says so with this property, and there the
+	 * register takes writes. Masking through the EL02 controls instead
+	 * sets IMASK in the guest's own timer, which KVM then keeps as
+	 * guest state: the guest gets no timer interrupt again.
+	 */
+	if (irqc->info.vm_timer_fiq_readonly && is_kernel_in_hyp_mode() &&
+	    of_property_present(of_chosen, "aurora,ctxr-exec-window"))
+		irqc->info.vm_timer_fiq_readonly = false;
+
 	aic_irqc = irqc;
 
 	switch (irqc->info.version) {