Commit 49b32ddb87a3 for kernel

commit 49b32ddb87a3a109afecea89e55d70f73956b8bc
Author: Oliver Upton <oupton@kernel.org>
Date:   Tue Jun 2 09:59:00 2026 -0700

    KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX

    XN has already been extracted from its bitfield position so using
    FIELD_PREP() on the mask that clears XN[0] is completely broken, having
    the effect of unconditionally granting execute permissions...

    Fix the obvious mistake by manipulating the right bit.

    Cc: stable@vger.kernel.org
    Fixes: d93febe2ed2e ("KVM: arm64: nv: Forward FEAT_XNX permissions to the shadow stage-2")
    Reviewed-by: Wei-Lin Chang <weilin.chang@arm.com>
    Signed-off-by: Oliver Upton <oupton@kernel.org>
    Link: https://patch.msgid.link/20260602165901.52800-2-oupton@kernel.org
    Signed-off-by: Marc Zyngier <maz@kernel.org>

diff --git a/arch/arm64/include/asm/kvm_nested.h b/arch/arm64/include/asm/kvm_nested.h
index dc2957662ff2..cdf3e8422ea1 100644
--- a/arch/arm64/include/asm/kvm_nested.h
+++ b/arch/arm64/include/asm/kvm_nested.h
@@ -132,7 +132,7 @@ static inline bool kvm_s2_trans_exec_el0(struct kvm *kvm, struct kvm_s2_trans *t
 	u8 xn = FIELD_GET(KVM_PTE_LEAF_ATTR_HI_S2_XN, trans->desc);

 	if (!kvm_has_xnx(kvm))
-		xn &= FIELD_PREP(KVM_PTE_LEAF_ATTR_HI_S2_XN, 0b10);
+		xn &= 0b10;

 	switch (xn) {
 	case 0b00:
@@ -148,7 +148,7 @@ static inline bool kvm_s2_trans_exec_el1(struct kvm *kvm, struct kvm_s2_trans *t
 	u8 xn = FIELD_GET(KVM_PTE_LEAF_ATTR_HI_S2_XN, trans->desc);

 	if (!kvm_has_xnx(kvm))
-		xn &= FIELD_PREP(KVM_PTE_LEAF_ATTR_HI_S2_XN, 0b10);
+		xn &= 0b10;

 	switch (xn) {
 	case 0b00: