--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -3743,6 +3743,10 @@ long do_mmu_update(
         {
             p2m_type_t p2mt;
 
+            rc = -EOPNOTSUPP;
+            if ( unlikely(paging_mode_refcounts(pt_owner)) )
+                break;
+
             rc = xsm_mmu_normal_update(d, pg_owner, req.val);
             if ( rc )
                 break;
