Re: KVM: mmu_notifiers release method

[Avi Kivity <avi@redhat.com>]

Marcelo Tosatti wrote:
> The destructor for huge pages uses the backing inode for adjusting
> hugetlbfs accounting.
>
> Hugepage mappings are destroyed by exit_mmap, after
> mmu_notifier_release, so there are no notifications through
> unmap_hugepage_range at this point.
>
> The hugetlbfs inode can be freed with pages backed by it referenced
> by the shadow. When the shadow releases its reference, the huge page
> destructor will access a now freed inode.
>
> Implement the release operation for kvm mmu notifiers to release page
> refs before the hugetlbfs inode is gone.
>
>   

I see this isn't it.  Andrea, comments?


> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
>
>
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index e7644b9..5bc38b5 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -741,11 +741,19 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
>  	return young;
>  }
>  
> +static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
> +				     struct mm_struct *mm)
> +{
> +	struct kvm *kvm = mmu_notifier_to_kvm(mn);
> +	kvm_arch_flush_shadow(kvm);
> +}
> +
>  static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
>  	.invalidate_page	= kvm_mmu_notifier_invalidate_page,
>  	.invalidate_range_start	= kvm_mmu_notifier_invalidate_range_start,
>  	.invalidate_range_end	= kvm_mmu_notifier_invalidate_range_end,
>  	.clear_flush_young	= kvm_mmu_notifier_clear_flush_young,
> +	.release		= kvm_mmu_notifier_release,
>  };
>  #endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
>  
>   


-- 
error compiling committee.c: too many arguments to function