diff --git a/arch/arm64/kvm/hyp/pgtable.c 

b/arch/arm64/kvm/hyp/pgtable.c
index a74a62283012..e3c6133567c4 100644

--- a/arch/arm64/kvm/hyp/pgtable.c
+++ b/arch/arm64/kvm/hyp/pgtable.c

@@ -45,6 +45,10 @@

 #define KVM_PTE_LEAF_ATTR_HI_S2_XN     BIT(54)

+#define KVM_PTE_LEAF_ATTR_S2_PERMS (KVM_PTE_LEAF_ATTR_LO_S2_S2AP_R | \
+        KVM_PTE_LEAF_ATTR_LO_S2_S2AP_W | \
+ KVM_PTE_LEAF_ATTR_HI_S2_XN)
+
 struct kvm_pgtable_walk_data {
        struct kvm_pgtable                   *pgt;
        struct kvm_pgtable_walker       *walker;

@@ -473,8 +477,13 @@ static bool stage2_map_walker_try_leaf(u64 addr,

u64 end, u32 level,

        new = kvm_init_valid_leaf_pte(phys, data->attr, level);
        if (kvm_pte_valid(old)) {
-               /* Tolerate KVM recreating the exact same mapping. */
-               if (old == new)
+               /*
+                * Skip updating the PTE with break-before-make if we 
are trying
+                * to recreate the exact same mapping or only change 
the access
+                * permissions. Actually, change of permissions will be 
handled
+                * through the relax_perms path next time if necessary.
+                */
+               if (!((old ^ new) & (~KVM_PTE_LEAF_ATTR_S2_PERMS)))
                        goto out;

                /* There's an existing different valid leaf entry, so 
perform