mm: defer flush of writable TLB entries

If a PTE is unmapped and it's dirty then it was writable recently.  Due to
deferred TLB flushing, it's best to assume a writable TLB cache entry
exists.  With that assumption, the TLB must be flushed before any IO can
start or the page is freed to avoid lost writes or data corruption.  This
patch defers flushing of potentially writable TLBs as long as possible.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Reviewed-by: Rik van Riel <riel@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3c602c20c717cde86519bfe52376d69c6558ef22..a4ab9daa387c0bbcaca1923620ceb2ed74bfd84e 100644 (file)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1354,6 +1354,13 @@ struct tlbflush_unmap_batch {
 
        /* True if any bit in cpumask is set */
        bool flush_required;
+
+       /*
+        * If true then the PTE was dirty when unmapped. The entry must be
+        * flushed before IO is initiated or a stale TLB entry potentially
+        * allows an update without redirtying the page.
+        */
+       bool writable;
 };
 
 struct task_struct {

diff --git a/mm/internal.h b/mm/internal.h
index bd6372ac5f7f77af416f1884c39926de1ad8ab46..1195dd2d6a2b94214e9ebb11e8c2037cd0e0cea6 100644 (file)
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -431,10 +431,14 @@ struct tlbflush_unmap_batch;
 
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
 void try_to_unmap_flush(void);
+void try_to_unmap_flush_dirty(void);
 #else
 static inline void try_to_unmap_flush(void)
 {
 }
+static inline void try_to_unmap_flush_dirty(void)
+{
+}
 
 #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
 #endif /* __MM_INTERNAL_H */

diff --git a/mm/rmap.c b/mm/rmap.c
index 326d5d89e45cdadeb93131c2841208e4c135e052..0db38e7d0a72b20ce63a6653ba24934ac3ce7825 100644 (file)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -626,16 +626,34 @@ void try_to_unmap_flush(void)
        }
        cpumask_clear(&tlb_ubc->cpumask);
        tlb_ubc->flush_required = false;
+       tlb_ubc->writable = false;
        put_cpu();
 }
 
+/* Flush iff there are potentially writable TLB entries that can race with IO */
+void try_to_unmap_flush_dirty(void)
+{
+       struct tlbflush_unmap_batch *tlb_ubc = &current->tlb_ubc;
+
+       if (tlb_ubc->writable)
+               try_to_unmap_flush();
+}
+
 static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
-               struct page *page)
+               struct page *page, bool writable)
 {
        struct tlbflush_unmap_batch *tlb_ubc = &current->tlb_ubc;
 
        cpumask_or(&tlb_ubc->cpumask, &tlb_ubc->cpumask, mm_cpumask(mm));
        tlb_ubc->flush_required = true;
+
+       /*
+        * If the PTE was dirty then it's best to assume it's writable. The
+        * caller must use try_to_unmap_flush_dirty() or try_to_unmap_flush()
+        * before the page is queued for IO.
+        */
+       if (writable)
+               tlb_ubc->writable = true;
 }
 
 /*
@@ -658,7 +676,7 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags)
 }
 #else
 static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
-               struct page *page)
+               struct page *page, bool writable)
 {
 }
 
@@ -1315,11 +1333,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 */
                pteval = ptep_get_and_clear(mm, address, pte);
 
-               /* Potentially writable TLBs must be flushed before IO */
-               if (pte_dirty(pteval))
-                       flush_tlb_page(vma, address);
-               else
-                       set_tlb_ubc_flush_pending(mm, page);
+               set_tlb_ubc_flush_pending(mm, page, pte_dirty(pteval));
        } else {
                pteval = ptep_clear_flush(vma, address, pte);
        }

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 99ec00d6a5dd6ed910c5935b957f301e58266830..b1139039122a05389019aa569b82dcde442f25d7 100644 (file)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1098,7 +1098,12 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                        if (!sc->may_writepage)
                                goto keep_locked;
 
-                       /* Page is dirty, try to write it out here */
+                       /*
+                        * Page is dirty. Flush the TLB if a writable entry
+                        * potentially exists to avoid CPU writes after IO
+                        * starts and then write it out here.
+                        */
+                       try_to_unmap_flush_dirty();
                        switch (pageout(page, mapping, sc)) {
                        case PAGE_KEEP:
                                goto keep_locked;