GENMASK(19, 18) |      \
                                 GENMASK(15, 0))
 
-/* Polarity masks for HCRX_EL2 */
-#define __HCRX_EL2_RES0         HCRX_EL2_RES0
-#define __HCRX_EL2_MASK                (BIT(6))
-#define __HCRX_EL2_nMASK       ~(__HCRX_EL2_RES0 | __HCRX_EL2_MASK)
+/*
+ * Polarity masks for HCRX_EL2, limited to the bits that we know about
+ * at this point in time. It doesn't mean that we actually *handle*
+ * them, but that at least those that are not advertised to a guest
+ * will be RES0 for that guest.
+ */
+#define __HCRX_EL2_MASK                (BIT_ULL(6))
+#define __HCRX_EL2_nMASK       (GENMASK_ULL(24, 14) | \
+                                GENMASK_ULL(11, 7)  | \
+                                GENMASK_ULL(5, 0))
+#define __HCRX_EL2_RES0                ~(__HCRX_EL2_nMASK | __HCRX_EL2_MASK)
+#define __HCRX_EL2_RES1                ~(__HCRX_EL2_nMASK | \
+                                 __HCRX_EL2_MASK  | \
+                                 __HCRX_EL2_RES0)
 
 /* Hyp Prefetch Fault Address Register (HPFAR/HDFAR) */
 #define HPFAR_MASK     (~UL(0xf))
 
        BUILD_BUG_ON(__NR_CGT_GROUP_IDS__ > BIT(TC_CGT_BITS));
        BUILD_BUG_ON(__NR_FGT_GROUP_IDS__ > BIT(TC_FGT_BITS));
        BUILD_BUG_ON(__NR_FG_FILTER_IDS__ > BIT(TC_FGF_BITS));
+       BUILD_BUG_ON(__HCRX_EL2_MASK & __HCRX_EL2_nMASK);
 
        for (int i = 0; i < ARRAY_SIZE(encoding_to_cgt); i++) {
                const struct encoding_to_trap_config *cgt = &encoding_to_cgt[i];
                }
        }
 
+       if (__HCRX_EL2_RES0 != HCRX_EL2_RES0)
+               kvm_info("Sanitised HCR_EL2_RES0 = %016llx, expecting %016llx\n",
+                        __HCRX_EL2_RES0, HCRX_EL2_RES0);
+
        kvm_info("nv: %ld coarse grained trap handlers\n",
                 ARRAY_SIZE(encoding_to_cgt));
 
 
        set_sysreg_masks(kvm, HCR_EL2, res0, res1);
 
        /* HCRX_EL2 */
-       res0 = HCRX_EL2_RES0;
-       res1 = HCRX_EL2_RES1;
+       res0 = __HCRX_EL2_RES0;
+       res1 = __HCRX_EL2_RES1;
        if (!kvm_has_feat(kvm, ID_AA64ISAR3_EL1, PACM, TRIVIAL_IMP))
                res0 |= HCRX_EL2_PACMEn;
        if (!kvm_has_feat(kvm, ID_AA64PFR2_EL1, FPMR, IMP))