--- /dev/null
+From stable+bounces-67769-greg=kroah.com@vger.kernel.org Thu Aug 15 14:50:23 2024
+From: Will Deacon <will@kernel.org>
+Date: Thu, 15 Aug 2024 13:50:03 +0100
+Subject: KVM: arm64: Don't pass a TLBI level hint when zapping table entries
+To: stable@vger.kernel.org
+Cc: Will Deacon <will@kernel.org>, Gavin Shan <gshan@redhat.com>, Marc Zyngier <maz@kernel.org>, Quentin Perret <qperret@google.com>, Shaoqin Huang <shahuang@redhat.com>, Oliver Upton <oliver.upton@linux.dev>
+Message-ID: <20240815125003.21813-1-will@kernel.org>
+
+From: Will Deacon <will@kernel.org>
+
+commit 36e008323926036650299cfbb2dca704c7aba849 upstream.
+
+The TLBI level hints are for leaf entries only, so take care not to pass
+them incorrectly after clearing a table entry.
+
+Cc: Gavin Shan <gshan@redhat.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Quentin Perret <qperret@google.com>
+Fixes: 82bb02445de5 ("KVM: arm64: Implement kvm_pgtable_hyp_unmap() at EL2")
+Fixes: 6d9d2115c480 ("KVM: arm64: Add support for stage-2 map()/unmap() in generic page-table")
+Reviewed-by: Shaoqin Huang <shahuang@redhat.com>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20240327124853.11206-3-will@kernel.org
+Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
+Cc: <stable@vger.kernel.org> # 6.1.y only
+[will@: Use '0' instead of TLBI_TTL_UNKNOWN_to indicate "no level". Force
+ level to 0 in stage2_put_pte() if we're clearing a table entry.]
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/hyp/pgtable.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/kvm/hyp/pgtable.c
++++ b/arch/arm64/kvm/hyp/pgtable.c
+@@ -475,7 +475,7 @@ static int hyp_unmap_walker(u64 addr, u6
+
+ kvm_clear_pte(ptep);
+ dsb(ishst);
+- __tlbi_level(vae2is, __TLBI_VADDR(addr, 0), level);
++ __tlbi_level(vae2is, __TLBI_VADDR(addr, 0), 0);
+ } else {
+ if (end - addr < granule)
+ return -EINVAL;
+@@ -699,8 +699,14 @@ static void stage2_put_pte(kvm_pte_t *pt
+ * Clear the existing PTE, and perform break-before-make with
+ * TLB maintenance if it was valid.
+ */
+- if (kvm_pte_valid(*ptep)) {
++ kvm_pte_t pte = *ptep;
++
++ if (kvm_pte_valid(pte)) {
+ kvm_clear_pte(ptep);
++
++ if (kvm_pte_table(pte, level))
++ level = 0;
++
+ kvm_call_hyp(__kvm_tlb_flush_vmid_ipa, mmu, addr, level);
+ }
+