diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
index d18c1fee2b..664b09f209 100644
--- a/xen/arch/x86/mm/shadow/common.c
+++ b/xen/arch/x86/mm/shadow/common.c
@@ -397,22 +397,14 @@ shadow_validate_guest_pt_write(struct vcpu *v, mfn_t gmfn,
     ASSERT(shadow_lock_is_acquired(v->domain));
     rc = __shadow_validate_guest_entry(v, gmfn, entry, size);
     if ( rc & SHADOW_SET_FLUSH )
-    {
-        // Flush everyone except the local processor, which will flush when it
-        // re-enters the HVM guest.
-        //
-        cpumask_t mask = d->domain_dirty_cpumask;
-        cpu_clear(v->processor, mask);
-        flush_tlb_mask(mask);
-    }
+        /* Need to flush TLBs to pick up shadow PT changes */
+        flush_tlb_mask(d->domain_dirty_cpumask);
     if ( rc & SHADOW_SET_ERROR ) 
     {
         /* This page is probably not a pagetable any more: tear it out of the 
          * shadows, along with any tables that reference it */
         shadow_remove_all_shadows_and_parents(v, gmfn);
     }
-    /* We ignore the other bits: since we are about to change CR3 on
-     * VMENTER we don't need to do any extra TLB flushes. */ 
 }
 
 
@@ -1129,7 +1121,7 @@ sh_gfn_to_mfn_foreign(struct domain *d, unsigned long gpfn)
 
 
 #if CONFIG_PAGING_LEVELS > 2
-    if ( gpfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) ) 
+    if ( gpfn >= (RO_MPT_VIRT_END-RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) ) 
         /* This pfn is higher than the p2m map can hold */
         return _mfn(INVALID_MFN);
 #endif
diff --git a/xen/arch/x86/mm/shadow/private.h b/xen/arch/x86/mm/shadow/private.h
index f470a874ba..eeb2d86342 100644
--- a/xen/arch/x86/mm/shadow/private.h
+++ b/xen/arch/x86/mm/shadow/private.h
@@ -555,7 +555,7 @@ vcpu_gfn_to_mfn_nofault(struct vcpu *v, unsigned long gfn)
         return _mfn(gfn);
 
 #if CONFIG_PAGING_LEVELS > 2
-    if ( gfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) ) 
+    if ( gfn >= (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) ) 
         /* This pfn is higher than the p2m map can hold */
         return _mfn(INVALID_MFN);
 #endif
diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index 2acdd2f23d..8263199824 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -368,7 +368,7 @@ static inline unsigned long get_mfn_from_gpfn(unsigned long pfn)
     int ret;
 
 #if CONFIG_PAGING_LEVELS > 2
-    if ( pfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof (l1_pgentry_t) ) 
+    if ( pfn >= (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) ) 
         /* This pfn is higher than the p2m map can hold */
         return INVALID_MFN;
 #endif