[xen stable-4.20] x86/pv: Only use the guest frame in pv_map_ldt_shadow_page()

[patchbot@xxxxxxx]

commit 0ef8e9b3715d23d85bbf3e9e0113037ce1d3e377
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Jul 20 13:32:11 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Jul 20 13:32:11 2026 +0200

    x86/pv: Only use the guest frame in pv_map_ldt_shadow_page()
    
    pv_map_ldt_shadow_page() takes the whole guest PTE, adds _PAGE_RW to it, 
then
    installs it into Xen's pagetables.  It has had this behaviour ever since LDT
    support was added in 2003.
    
    However, it allows the guest to control the software available bits and
    cacheability.  This happens to be benign right now, but is bad form.
    
    Use only the guest frame, and construct the mapping as regular RW frame, and
    notably includes NX.  This is how the GDT logic already works.
    
    Fixes: 005c2723972f ("Finished virtualisation of x86 LDT")
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 1cc1f4d7a0471f3bf9126ee7b1956db66ee28b58
    master date: 2026-07-14 17:31:08 +0100
---
 xen/arch/x86/pv/mm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/pv/mm.c b/xen/arch/x86/pv/mm.c
index 187f5f6a3e..c8533361e1 100644
--- a/xen/arch/x86/pv/mm.c
+++ b/xen/arch/x86/pv/mm.c
@@ -52,7 +52,7 @@ bool pv_map_ldt_shadow_page(unsigned int offset)
     struct vcpu *curr = current;
     struct domain *currd = curr->domain;
     struct page_info *page;
-    l1_pgentry_t gl1e, *pl1e;
+    l1_pgentry_t gl1e, *pl1e, nl1e;
     unsigned long linear = curr->arch.pv.ldt_base + offset;
 
     BUG_ON(in_irq());
@@ -87,9 +87,9 @@ bool pv_map_ldt_shadow_page(unsigned int offset)
     }
 
     pl1e = &pv_ldt_ptes(curr)[offset >> PAGE_SHIFT];
-    l1e_add_flags(gl1e, _PAGE_RW);
+    nl1e = l1e_from_pfn(l1e_get_pfn(gl1e), __PAGE_HYPERVISOR_RW);
 
-    l1e_write(pl1e, gl1e);
+    l1e_write(pl1e, nl1e);
 
     return true;
 }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20