[xen staging-4.22] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page()

[patchbot@xxxxxxx]

commit 6959caf0fb711e3e5674de9375f5ac8249242ee9
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Jul 6 22:49:25 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 14 17:40:12 2026 +0100

    x86/pv: Only use the guest frame in pv_map_ldt_shadow_page()
    
    pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, 
then
    installs it into Xen's pagetables.  It has had this behaviour ever since LDT
    support was added in 2003.
    
    However, it allows the guest to control the software available bits and
    cacheability.  This happens to be benign right now, but is bad form.
    
    Use only the guest frame, and construct the mapping as regular RW frame, and
    notably includes NX.  This is how the GDT logic already works.
    
    Fixes: 005c2723972f ("Finished virtualisation of x86 LDT")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
    (cherry picked from commit 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58)
---
 xen/arch/x86/pv/mm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c
index 3f2e9dedcd..5378299b8c 100644
--- a/xen/arch/x86/pv/mm.c
+++ b/xen/arch/x86/pv/mm.c
@@ -53,7 +53,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset)
     struct vcpu *curr = current;
     struct domain *currd = curr->domain;
     struct page_info *page;
-    l1_pgentry_t gl1e, *pl1e;
+    l1_pgentry_t gl1e, *pl1e, nl1e;
     unsigned long linear = curr->arch.pv.ldt_base + offset;
 
     BUG_ON(in_irq());
@@ -88,9 +88,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset)
     }
 
     pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT];
-    l1e_add_flags(gl1e, _PAGE_RW);
+    nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW);
 
-    l1e_write(pl1e, gl1e);
+    l1e_write(pl1e, nl1e);
 
     return true;
 }
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.22