diff --git a/arch/arm64/include/asm/kvm_s2mpu.h b/arch/arm64/include/asm/kvm_s2mpu.h
index d8c552da273f..b1075abd604c 100644
--- a/arch/arm64/include/asm/kvm_s2mpu.h
+++ b/arch/arm64/include/asm/kvm_s2mpu.h
@@ -51,15 +51,30 @@
 #define CTRL0_INTERRUPT_ENABLE			BIT(1)
 #define CTRL0_FAULT_RESP_TYPE_SLVERR		BIT(2) /* for v8 */
 #define CTRL0_FAULT_RESP_TYPE_DECERR		BIT(2) /* for v9 */
+#define CTRL0_MASK				(CTRL0_ENABLE | \
+						 CTRL0_INTERRUPT_ENABLE | \
+						 CTRL0_FAULT_RESP_TYPE_SLVERR | \
+						 CTRL0_FAULT_RESP_TYPE_DECERR)
 
 #define CTRL1_DISABLE_CHK_S1L1PTW		BIT(0)
 #define CTRL1_DISABLE_CHK_S1L2PTW		BIT(1)
 #define CTRL1_ENABLE_PAGE_SIZE_AWARENESS	BIT(2)
 #define CTRL1_DISABLE_CHK_USER_MATCHED_REQ	BIT(3)
+#define CTRL1_MASK				(CTRL1_DISABLE_CHK_S1L1PTW | \
+						 CTRL1_DISABLE_CHK_S1L2PTW | \
+						 CTRL1_ENABLE_PAGE_SIZE_AWARENESS | \
+						 CTRL1_DISABLE_CHK_USER_MATCHED_REQ)
 
 #define CFG_MPTW_CACHE_OVERRIDE			BIT(0)
+#define CFG_MPTW_CACHE_VALUE			GENMASK(7, 4)
 #define CFG_MPTW_QOS_OVERRIDE			BIT(8)
+#define CFG_MPTW_QOS_VALUE			GENMASK(15, 12)
 #define CFG_MPTW_SHAREABLE			BIT(16)
+#define CFG_MASK				(CFG_MPTW_CACHE_OVERRIDE | \
+						 CFG_MPTW_CACHE_VALUE | \
+						 CFG_MPTW_QOS_OVERRIDE | \
+						 CFG_MPTW_QOS_VALUE | \
+						 CFG_MPTW_SHAREABLE)
 
 /* For use with hi_lo_readq_relaxed(). */
 #define REG_NS_FAULT_PA_HIGH_LOW(vid)		REG_NS_FAULT_PA_LOW(vid)
diff --git a/arch/arm64/kvm/hyp/nvhe/iommu/s2mpu.c b/arch/arm64/kvm/hyp/nvhe/iommu/s2mpu.c
index 50f842a3b0de..ff5d7d1044e5 100644
--- a/arch/arm64/kvm/hyp/nvhe/iommu/s2mpu.c
+++ b/arch/arm64/kvm/hyp/nvhe/iommu/s2mpu.c
@@ -394,6 +394,13 @@ static u32 host_mmio_reg_access_mask(size_t off, bool is_write)
 	u32 masked_off;
 
 	switch (off) {
+	/* Allow reading control registers for debugging. */
+	case REG_NS_CTRL0:
+		return read_only & CTRL0_MASK;
+	case REG_NS_CTRL1:
+		return read_only & CTRL1_MASK;
+	case REG_NS_CFG:
+		return read_only & CFG_MASK;
 	/* Allow EL1 IRQ handler to clear interrupts. */
 	case REG_NS_INTERRUPT_CLEAR:
 		return write_only & ALL_VIDS_BITMAP;