From 395d8ef5bebe547a80737692f9789d2e36da16f2 Mon Sep 17 00:00:00 2001 From: Bartlomiej Zolnierkiewicz Date: Mon, 11 Feb 2008 00:32:14 +0100 Subject: [PATCH] ide-disk: fix flush requests (take 2) commit 813a0eb233ee67d7166241a8b389b6a76f2247f9 Author: Bartlomiej Zolnierkiewicz Date: Fri Jan 25 22:17:10 2008 +0100 ide: switch idedisk_prepare_flush() to use REQ_TYPE_ATA_TASKFILE requests ... broke flush requests. Allocating IDE command structure on the stack for flush requests is not a very brilliant idea: - idedisk_prepare_flush() only prepares the request and it doesn't wait for it to be completed - there are can be multiple flush requests queued in the queue Fix the problem (per hints from James Bottomley) by: - dynamically allocating ide_task_t instance using kmalloc(..., GFP_ATOMIC) - adding new taskfile flag (IDE_TFLAG_DYN) - calling kfree() in ide_end_drive_command() if IDE_TFLAG_DYN is set (while at it rename 'args' to 'task' and fix whitespace damage) [ This will be fixed properly before 2.6.25 but this bug is rather critical and the proper solution requires some more work + testing. ] Thanks to Sebastian Siewior and Christoph Hellwig for reporting the problem and testing patches (extra thanks to Sebastian for bisecting it to the guilty commmit). Tested-by: Sebastian Siewior Cc: Christoph Hellwig Cc: James Bottomley Cc: Jens Axboe Cc: Tejun Heo Cc: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz --- drivers/ide/ide-disk.c | 18 +++++++++++------- drivers/ide/ide-io.c | 16 ++++++++++------ include/linux/ide.h | 2 ++ 3 files changed, 23 insertions(+), 13 deletions(-) diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c index 3c69822507e2..aed8b31ca561 100644 --- a/drivers/ide/ide-disk.c +++ b/drivers/ide/ide-disk.c @@ -590,20 +590,24 @@ static ide_proc_entry_t idedisk_proc[] = { static void idedisk_prepare_flush(struct request_queue *q, struct request *rq) { ide_drive_t *drive = q->queuedata; - ide_task_t task; + ide_task_t *task = kmalloc(sizeof(*task), GFP_ATOMIC); - memset(&task, 0, sizeof(task)); + /* FIXME: map struct ide_taskfile on rq->cmd[] */ + BUG_ON(task == NULL); + + memset(task, 0, sizeof(*task)); if (ide_id_has_flush_cache_ext(drive->id) && (drive->capacity64 >= (1UL << 28))) - task.tf.command = WIN_FLUSH_CACHE_EXT; + task->tf.command = WIN_FLUSH_CACHE_EXT; else - task.tf.command = WIN_FLUSH_CACHE; - task.tf_flags = IDE_TFLAG_OUT_TF | IDE_TFLAG_OUT_DEVICE; - task.data_phase = TASKFILE_NO_DATA; + task->tf.command = WIN_FLUSH_CACHE; + task->tf_flags = IDE_TFLAG_OUT_TF | IDE_TFLAG_OUT_DEVICE | + IDE_TFLAG_DYN; + task->data_phase = TASKFILE_NO_DATA; rq->cmd_type = REQ_TYPE_ATA_TASKFILE; rq->cmd_flags |= REQ_SOFTBARRIER; - rq->special = &task; + rq->special = task; } /* diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c index e41383fa3a51..715379605a7b 100644 --- a/drivers/ide/ide-io.c +++ b/drivers/ide/ide-io.c @@ -361,17 +361,21 @@ void ide_end_drive_cmd (ide_drive_t *drive, u8 stat, u8 err) spin_unlock_irqrestore(&ide_lock, flags); if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) { - ide_task_t *args = (ide_task_t *) rq->special; + ide_task_t *task = (ide_task_t *)rq->special; + if (rq->errors == 0) - rq->errors = !OK_STAT(stat,READY_STAT,BAD_STAT); - - if (args) { - struct ide_taskfile *tf = &args->tf; + rq->errors = !OK_STAT(stat, READY_STAT, BAD_STAT); + + if (task) { + struct ide_taskfile *tf = &task->tf; tf->error = err; tf->status = stat; - ide_tf_read(drive, args); + ide_tf_read(drive, task); + + if (task->tf_flags & IDE_TFLAG_DYN) + kfree(task); } } else if (blk_pm_request(rq)) { struct request_pm_state *pm = rq->data; diff --git a/include/linux/ide.h b/include/linux/ide.h index 40a01c3592df..23fad89292df 100644 --- a/include/linux/ide.h +++ b/include/linux/ide.h @@ -906,6 +906,8 @@ enum { IDE_TFLAG_IN_DEVICE, /* force 16-bit I/O operations */ IDE_TFLAG_IO_16BIT = (1 << 30), + /* ide_task_t was allocated using kmalloc() */ + IDE_TFLAG_DYN = (1 << 31), }; struct ide_taskfile { -- 2.20.1