Commit 395d8ef5 authored by Bartlomiej Zolnierkiewicz's avatar Bartlomiej Zolnierkiewicz
Browse files

ide-disk: fix flush requests (take 2) 



commit 813a0eb2
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Fri Jan 25 22:17:10 2008 +0100

    ide: switch idedisk_prepare_flush() to use REQ_TYPE_ATA_TASKFILE requests

...

broke flush requests.

Allocating IDE command structure on the stack for flush requests is not
a very brilliant idea:

- idedisk_prepare_flush() only prepares the request and it doesn't wait
  for it to be completed

- there are can be multiple flush requests queued in the queue

Fix the problem (per hints from James Bottomley) by:
- dynamically allocating ide_task_t instance using kmalloc(..., GFP_ATOMIC)
- adding new taskfile flag (IDE_TFLAG_DYN)
- calling kfree() in ide_end_drive_command() if IDE_TFLAG_DYN is set
  (while at it rename 'args' to 'task' and fix whitespace damage)

[ This will be fixed properly before 2.6.25 but this bug is rather
  critical and the proper solution requires some more work + testing. ]

Thanks to Sebastian Siewior and Christoph Hellwig for reporting the
problem and testing patches (extra thanks to Sebastian for bisecting
it to the guilty commmit).

Tested-by: default avatarSebastian Siewior <ide-bug@ml.breakpoint.cc>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Tejun Heo <htejun@gmail.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
parent 8e882ba1

drivers/ide/ide-disk.c

+11 −7
Original line number Diff line number Diff line
@@ -590,20 +590,24 @@ static ide_proc_entry_t idedisk_proc[] = { 
static void idedisk_prepare_flush(struct request_queue *q, struct request *rq)

{

	ide_drive_t *drive = q->queuedata;

	ide_task_t task;

	ide_task_t *task = kmalloc(sizeof(*task), GFP_ATOMIC);



	memset(&task, 0, sizeof(task));

	/* FIXME: map struct ide_taskfile on rq->cmd[] */

	BUG_ON(task == NULL);



	memset(task, 0, sizeof(*task));

	if (ide_id_has_flush_cache_ext(drive->id) &&

	    (drive->capacity64 >= (1UL << 28)))

		task.tf.command = WIN_FLUSH_CACHE_EXT;

		task->tf.command = WIN_FLUSH_CACHE_EXT;

	else

		task.tf.command = WIN_FLUSH_CACHE;

	task.tf_flags	= IDE_TFLAG_OUT_TF | IDE_TFLAG_OUT_DEVICE;

	task.data_phase	= TASKFILE_NO_DATA;

		task->tf.command = WIN_FLUSH_CACHE;

	task->tf_flags	 = IDE_TFLAG_OUT_TF | IDE_TFLAG_OUT_DEVICE |

			   IDE_TFLAG_DYN;

	task->data_phase = TASKFILE_NO_DATA;



	rq->cmd_type = REQ_TYPE_ATA_TASKFILE;

	rq->cmd_flags |= REQ_SOFTBARRIER;

	rq->special = &task;

	rq->special = task;

}



/*

drivers/ide/ide-io.c

+10 −6
Original line number Diff line number Diff line
@@ -361,17 +361,21 @@ void ide_end_drive_cmd (ide_drive_t *drive, u8 stat, u8 err) 
	spin_unlock_irqrestore(&ide_lock, flags);



	if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {

		ide_task_t *args = (ide_task_t *) rq->special;

		ide_task_t *task = (ide_task_t *)rq->special;



		if (rq->errors == 0)

			rq->errors = !OK_STAT(stat, READY_STAT, BAD_STAT);



		if (args) {

			struct ide_taskfile *tf = &args->tf;

		if (task) {

			struct ide_taskfile *tf = &task->tf;



			tf->error = err;

			tf->status = stat;



			ide_tf_read(drive, args);

			ide_tf_read(drive, task);



			if (task->tf_flags & IDE_TFLAG_DYN)

				kfree(task);

		}

	} else if (blk_pm_request(rq)) {

		struct request_pm_state *pm = rq->data;

include/linux/ide.h

+2 −0
Original line number Diff line number Diff line
@@ -906,6 +906,8 @@ enum { 
					  IDE_TFLAG_IN_DEVICE,

	/* force 16-bit I/O operations */

	IDE_TFLAG_IO_16BIT		= (1 << 30),

	/* ide_task_t was allocated using kmalloc() */

	IDE_TFLAG_DYN			= (1 << 31),

};



struct ide_taskfile {

CRA Git | Maintained and supported by SUSTech CRA and CCSE