diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h
index 26aa632bdaac..3595ad41b40b 100644
--- a/arch/arm64/include/asm/kvm_pgtable.h
+++ b/arch/arm64/include/asm/kvm_pgtable.h
@@ -259,6 +259,23 @@ enum kvm_pgtable_prot {
 	KVM_PGTABLE_PROT_SW3			= BIT(58),
 };
 
+/*
+ * Stage-2 invalid-PTE annotations. These are non-overlapping bitfields which
+ * define mutually-exclusive PTE states.
+ */
+
+/* (Host S2) The owner of the corresponding physical page. */
+#define KVM_INVALID_PTE_OWNER_MASK	GENMASK(9, 2)
+
+/*
+ * Used to indicate a pte for which a 'break-before-make' sequence is in
+ * progress.
+ */
+#define KVM_INVALID_PTE_LOCKED		BIT(10)
+
+/* Indicates a valid MMIO mapping registered via ioguard. */
+#define KVM_INVALID_PTE_MMIO_NOTE	BIT(11)
+
 #define KVM_PGTABLE_PROT_RW	(KVM_PGTABLE_PROT_R | KVM_PGTABLE_PROT_W)
 #define KVM_PGTABLE_PROT_RWX	(KVM_PGTABLE_PROT_RW | KVM_PGTABLE_PROT_X)
 
diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index c8a385d057b1..d8044c8267c6 100644
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -512,7 +512,6 @@ int host_stage2_idmap_locked(phys_addr_t addr, u64 size,
 	return host_stage2_try(__host_stage2_idmap, addr, addr + size, prot);
 }
 
-#define KVM_INVALID_PTE_OWNER_MASK	GENMASK(9, 2)
 #define KVM_MAX_OWNER_ID               FIELD_MAX(KVM_INVALID_PTE_OWNER_MASK)
 
 static kvm_pte_t kvm_init_invalid_leaf_owner(u8 owner_id)
@@ -1870,9 +1869,6 @@ unlock:
 	return ret;
 }
 
-/* Replace this with something more structured once day */
-#define MMIO_NOTE	(('M' << 24 | 'M' << 16 | 'I' << 8 | 'O') << 1)
-
 static bool __check_ioguard_page(struct pkvm_hyp_vcpu *hyp_vcpu, u64 ipa)
 {
 	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(hyp_vcpu);
@@ -1886,7 +1882,7 @@ static bool __check_ioguard_page(struct pkvm_hyp_vcpu *hyp_vcpu, u64 ipa)
 
 	/* Must be a PAGE_SIZE mapping with our annotation */
 	return (BIT(ARM64_HW_PGTABLE_LEVEL_SHIFT(level)) == PAGE_SIZE &&
-		pte == MMIO_NOTE);
+		pte == KVM_INVALID_PTE_MMIO_NOTE);
 }
 
 int __pkvm_install_ioguard_page(struct pkvm_hyp_vcpu *hyp_vcpu, u64 ipa)
@@ -1913,7 +1909,7 @@ int __pkvm_install_ioguard_page(struct pkvm_hyp_vcpu *hyp_vcpu, u64 ipa)
 		 * Already flagged as MMIO, let's accept it, and fail
 		 * otherwise
 		 */
-		if (pte != MMIO_NOTE)
+		if (pte != KVM_INVALID_PTE_MMIO_NOTE)
 			ret = -EBUSY;
 
 		goto unlock;
@@ -1921,7 +1917,7 @@ int __pkvm_install_ioguard_page(struct pkvm_hyp_vcpu *hyp_vcpu, u64 ipa)
 
 	ret = kvm_pgtable_stage2_annotate(&vm->pgt, ipa, PAGE_SIZE,
 					  &hyp_vcpu->vcpu.arch.pkvm_memcache,
-					  MMIO_NOTE);
+					  KVM_INVALID_PTE_MMIO_NOTE);
 
 unlock:
 	guest_unlock_component(vm);