On Wed, 23 Oct 2019, Yang Shi wrote:
On 10/23/19 12:28 PM, Hugh Dickins wrote:
- return map_count >= 0 &&
You have added a map_count >= 0 test there. Okay, not wrong, but not necessary, and not consistent with what's returned in the PageAnon case (if this were called for an unmapped page).
I was thinking about this too. I'm wondering there might be a case that the PMD is split and it was the last PMD map, in this case subpage's _mapcount is also equal to compound_mapcount (both is -1). So, it would return true, then KVM may setup PMD map in EPT, but it might be PTE mapped later on the host. But, I'm not quite sure if this is really possible or if this is really a integrity problem. So, I thought it might be safer to add this check.
The mmu_notifier_invalidate_range_start.._end() in __split_huge_pmd(), with KVM's locking and sequence counting, is required to protect against such races.
Hugh