1 files changed, 37 insertions, 2 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7f686251f711..f29abeb6a912 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -104,8 +104,26 @@ static pfn_t fault_pfn;
 inline int kvm_is_mmio_pfn(pfn_t pfn)
 {
         if (pfn_valid(pfn)) {
-                struct page *page = compound_head(pfn_to_page(pfn));
-                return PageReserved(page);
+                int reserved;
+                struct page *tail = pfn_to_page(pfn);
+                struct page *head = compound_trans_head(tail);
+                reserved = PageReserved(head);
+                if (head != tail) {
+                        /*
+                         * "head" is not a dangling pointer
+                         * (compound_trans_head takes care of that)
+                         * but the hugepage may have been splitted
+                         * from under us (and we may not hold a
+                         * reference count on the head page so it can
+                         * be reused before we run PageReferenced), so
+                         * we've to check PageTail before returning
+                         * what we just read.
+                         */
+                        smp_rmb();
+                        if (PageTail(tail))
+                                return reserved;
+                }
+                return PageReserved(tail);
         }
 
         return true;
@@ -352,6 +370,22 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
         return young;
 }
 
+static int kvm_mmu_notifier_test_young(struct mmu_notifier *mn,
+                                       struct mm_struct *mm,
+                                       unsigned long address)
+{
+        struct kvm *kvm = mmu_notifier_to_kvm(mn);
+        int young, idx;
+
+        idx = srcu_read_lock(&kvm->srcu);
+        spin_lock(&kvm->mmu_lock);
+        young = kvm_test_age_hva(kvm, address);
+        spin_unlock(&kvm->mmu_lock);
+        srcu_read_unlock(&kvm->srcu, idx);
+
+        return young;
+}
+
 static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
                                      struct mm_struct *mm)
 {
@@ -368,6 +402,7 @@ static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
         .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
         .invalidate_range_end   = kvm_mmu_notifier_invalidate_range_end,
         .clear_flush_young      = kvm_mmu_notifier_clear_flush_young,
+        .test_young             = kvm_mmu_notifier_test_young,
         .change_pte             = kvm_mmu_notifier_change_pte,
         .release                = kvm_mmu_notifier_release,
 };