* [PATCH 1/3] Remove ->waiting member from struct request
2006-07-14 9:41 [PATCHSET] Shrink struct request Jens Axboe
@ 2006-07-14 9:41 ` Jens Axboe
2006-07-14 9:41 ` [PATCH 2/3] Remove struct request_list " Jens Axboe
2006-07-14 9:41 ` [PATCH 3/3] Remove ->rq_status " Jens Axboe
2 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2006-07-14 9:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Jens Axboe
As the comments indicates in blkdev.h, we can fold it into ->end_io_data
usage as that is really what ->waiting is. Fixup the users of
blk_end_sync_rq().
Signed-off-by: Jens Axboe <axboe@suse.de>
---
block/elevator.c | 3 +--
block/ll_rw_blk.c | 11 ++++-------
drivers/block/DAC960.c | 2 +-
drivers/block/paride/pd.c | 3 +--
drivers/block/pktcdvd.c | 2 +-
drivers/ide/ide-io.c | 3 +--
drivers/ide/ide-tape.c | 2 +-
include/linux/blkdev.h | 3 +--
8 files changed, 11 insertions(+), 18 deletions(-)
diff --git a/block/elevator.c b/block/elevator.c
index 9cd2805..69215a6 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -67,8 +67,7 @@ inline int elv_rq_merge_ok(struct reques
/*
* same device and no special stuff set, merge is ok
*/
- if (rq->rq_disk == bio->bi_bdev->bd_disk &&
- !rq->waiting && !rq->special)
+ if (rq->rq_disk == bio->bi_bdev->bd_disk && !rq->special)
return 1;
return 0;
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 4018254..0ed0e83 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -291,7 +291,6 @@ static inline void rq_init(request_queue
rq->buffer = NULL;
rq->ref_count = 1;
rq->q = q;
- rq->waiting = NULL;
rq->special = NULL;
rq->data_len = 0;
rq->data = NULL;
@@ -2536,10 +2535,9 @@ int blk_execute_rq(request_queue_t *q, s
rq->sense_len = 0;
}
- rq->waiting = &wait;
+ rq->end_io_data = &wait;
blk_execute_rq_nowait(q, bd_disk, rq, at_head, blk_end_sync_rq);
wait_for_completion(&wait);
- rq->waiting = NULL;
if (rq->errors)
err = -EIO;
@@ -2703,9 +2701,9 @@ EXPORT_SYMBOL(blk_put_request);
*/
void blk_end_sync_rq(struct request *rq, int error)
{
- struct completion *waiting = rq->waiting;
+ struct completion *waiting = rq->end_io_data;
- rq->waiting = NULL;
+ rq->end_io_data = NULL;
__blk_put_request(rq->q, rq);
/*
@@ -2756,7 +2754,7 @@ static int attempt_merge(request_queue_t
if (rq_data_dir(req) != rq_data_dir(next)
|| req->rq_disk != next->rq_disk
- || next->waiting || next->special)
+ || next->special)
return 0;
/*
@@ -2841,7 +2839,6 @@ static void init_request_from_bio(struct
req->nr_phys_segments = bio_phys_segments(req->q, bio);
req->nr_hw_segments = bio_hw_segments(req->q, bio);
req->buffer = bio_data(bio); /* see ->buffer comment above */
- req->waiting = NULL;
req->bio = req->biotail = bio;
req->ioprio = bio_prio(bio);
req->rq_disk = bio->bi_bdev->bd_disk;
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 4cd23c3..62cc2b2 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -3331,7 +3331,7 @@ static int DAC960_process_queue(DAC960_C
Command->DmaDirection = PCI_DMA_TODEVICE;
Command->CommandType = DAC960_WriteCommand;
}
- Command->Completion = Request->waiting;
+ Command->Completion = Request->end_io_data;
Command->LogicalDriveNumber = (long)Request->rq_disk->private_data;
Command->BlockNumber = Request->sector;
Command->BlockCount = Request->nr_sectors;
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 2403721..87f6828 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -722,11 +722,10 @@ static int pd_special_command(struct pd_
rq.rq_status = RQ_ACTIVE;
rq.rq_disk = disk->gd;
rq.ref_count = 1;
- rq.waiting = &wait;
+ rq.end_io_data = &wait;
rq.end_io = blk_end_sync_rq;
blk_insert_request(disk->gd->queue, &rq, 0, func);
wait_for_completion(&wait);
- rq.waiting = NULL;
if (rq.errors)
err = -EIO;
blk_put_request(&rq);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index bde2c64..d79dcd0 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -375,7 +375,7 @@ static int pkt_generic_packet(struct pkt
rq->ref_count++;
rq->flags |= REQ_NOMERGE;
- rq->waiting = &wait;
+ rq->end_io_data = &wait;
rq->end_io = blk_end_sync_rq;
elv_add_request(q, rq, ELEVATOR_INSERT_BACK, 1);
generic_unplug_device(q);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index fb67952..8753a50 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -1718,7 +1718,7 @@ int ide_do_drive_cmd (ide_drive_t *drive
*/
if (must_wait) {
rq->ref_count++;
- rq->waiting = &wait;
+ rq->end_io_data = &wait;
rq->end_io = blk_end_sync_rq;
}
@@ -1736,7 +1736,6 @@ int ide_do_drive_cmd (ide_drive_t *drive
err = 0;
if (must_wait) {
wait_for_completion(&wait);
- rq->waiting = NULL;
if (rq->errors)
err = -EIO;
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 7067ab9..acf2e4f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -2773,7 +2773,7 @@ #if IDETAPE_DEBUG_BUGS
return;
}
#endif /* IDETAPE_DEBUG_BUGS */
- rq->waiting = &wait;
+ rq->end_io_data = &wait;
rq->end_io = blk_end_sync_rq;
spin_unlock_irq(&tape->spinlock);
wait_for_completion(&wait);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index ba4378f..575d3e8 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -185,7 +185,6 @@ struct request {
request_queue_t *q;
struct request_list *rl;
- struct completion *waiting;
void *special;
char *buffer;
@@ -204,7 +203,7 @@ struct request {
int retries;
/*
- * completion callback. end_io_data should be folded in with waiting
+ * completion callback.
*/
rq_end_io_fn *end_io;
void *end_io_data;
--
1.4.1.ged0e0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 2/3] Remove struct request_list from struct request
2006-07-14 9:41 [PATCHSET] Shrink struct request Jens Axboe
2006-07-14 9:41 ` [PATCH 1/3] Remove ->waiting member from " Jens Axboe
@ 2006-07-14 9:41 ` Jens Axboe
2006-07-14 9:41 ` [PATCH 3/3] Remove ->rq_status " Jens Axboe
2 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2006-07-14 9:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Jens Axboe
It is always identical to &q->rq, and we only use it for detecting
whether this request came out of our mempool or not. So replace it
with an additional ->flags bit flag.
Signed-off-by: Jens Axboe <axboe@suse.de>
---
block/ll_rw_blk.c | 10 ++--------
include/linux/blkdev.h | 3 ++-
2 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 0ed0e83..06b1fec 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -452,7 +452,6 @@ static void queue_flush(request_queue_t
rq->elevator_private = NULL;
rq->elevator_private2 = NULL;
rq->rq_disk = q->bar_rq.rq_disk;
- rq->rl = NULL;
rq->end_io = end_io;
q->prepare_flush_fn(q, rq);
@@ -478,7 +477,6 @@ static inline struct request *start_orde
rq->flags |= q->ordered & QUEUE_ORDERED_FUA ? REQ_FUA : 0;
rq->elevator_private = NULL;
rq->elevator_private2 = NULL;
- rq->rl = NULL;
init_request_from_bio(rq, q->orig_bar_rq->bio);
rq->end_io = bar_end_io;
@@ -1984,7 +1982,7 @@ blk_alloc_request(request_queue_t *q, in
* first three bits are identical in rq->flags and bio->bi_rw,
* see bio.h and blkdev.h
*/
- rq->flags = rw;
+ rq->flags = rw | REQ_ALLOCED;
if (priv) {
if (unlikely(elv_set_request(q, rq, bio, gfp_mask))) {
@@ -2162,7 +2160,6 @@ rq_starved:
ioc->nr_batch_requests--;
rq_init(q, rq);
- rq->rl = rl;
blk_add_trace_generic(q, bio, rw, BLK_TA_GETRQ);
out:
@@ -2646,8 +2643,6 @@ EXPORT_SYMBOL_GPL(disk_round_stats);
*/
void __blk_put_request(request_queue_t *q, struct request *req)
{
- struct request_list *rl = req->rl;
-
if (unlikely(!q))
return;
if (unlikely(--req->ref_count))
@@ -2656,13 +2651,12 @@ void __blk_put_request(request_queue_t *
elv_completed_request(q, req);
req->rq_status = RQ_INACTIVE;
- req->rl = NULL;
/*
* Request may not have originated from ll_rw_blk. if not,
* it didn't come out of our reserved rq pools
*/
- if (rl) {
+ if (req->flags & REQ_ALLOCED) {
int rw = rq_data_dir(req);
int priv = req->flags & REQ_ELVPRIV;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 575d3e8..1370687 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -183,7 +183,6 @@ struct request {
int ref_count;
request_queue_t *q;
- struct request_list *rl;
void *special;
char *buffer;
@@ -244,6 +243,7 @@ enum rq_flag_bits {
__REQ_PM_SHUTDOWN, /* shutdown request */
__REQ_ORDERED_COLOR, /* is before or after barrier */
__REQ_RW_SYNC, /* request is sync (O_DIRECT) */
+ __REQ_ALLOCED, /* request came from our alloc pool */
__REQ_NR_BITS, /* stops here */
};
@@ -274,6 +274,7 @@ #define REQ_PM_RESUME (1 << __REQ_PM_RES
#define REQ_PM_SHUTDOWN (1 << __REQ_PM_SHUTDOWN)
#define REQ_ORDERED_COLOR (1 << __REQ_ORDERED_COLOR)
#define REQ_RW_SYNC (1 << __REQ_RW_SYNC)
+#define REQ_ALLOCED (1 << __REQ_ALLOCED)
/*
* State information carried for REQ_PM_SUSPEND and REQ_PM_RESUME
--
1.4.1.ged0e0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 3/3] Remove ->rq_status from struct request
2006-07-14 9:41 [PATCHSET] Shrink struct request Jens Axboe
2006-07-14 9:41 ` [PATCH 1/3] Remove ->waiting member from " Jens Axboe
2006-07-14 9:41 ` [PATCH 2/3] Remove struct request_list " Jens Axboe
@ 2006-07-14 9:41 ` Jens Axboe
2 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2006-07-14 9:41 UTC (permalink / raw)
To: linux-kernel; +Cc: Jens Axboe
After Christophs SCSI change, the only usage left is RQ_ACTIVE
and RQ_INACTIVE. The block layer sets RQ_INACTIVE right before freeing
the request, so any check for RQ_INACTIVE in a driver is a bug and
indicates use-after-free.
So kill/clean the remaining users, straight forward.
Signed-off-by: Jens Axboe <axboe@suse.de>
---
arch/um/drivers/ubd_kern.c | 2 --
block/ll_rw_blk.c | 3 ---
drivers/block/paride/pd.c | 1 -
drivers/block/swim3.c | 4 ++--
drivers/block/swim_iop.c | 4 ++--
drivers/fc4/fc.c | 1 -
drivers/ide/ide-floppy.c | 3 +--
drivers/ide/ide-io.c | 1 -
drivers/ide/ide-tape.c | 4 ++--
drivers/scsi/ide-scsi.c | 2 +-
drivers/scsi/scsi.c | 2 +-
include/linux/blkdev.h | 13 +++++--------
12 files changed, 14 insertions(+), 26 deletions(-)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 3408531..baa98eb 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -986,8 +986,6 @@ static int prepare_request(struct reques
__u64 offset;
int len;
- if(req->rq_status == RQ_INACTIVE) return(1);
-
/* This should be impossible now */
if((rq_data_dir(req) == WRITE) && !dev->openflags.w){
printk("Write attempted on readonly ubd device %s\n",
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 06b1fec..09df381 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -283,7 +283,6 @@ static inline void rq_init(request_queue
INIT_LIST_HEAD(&rq->donelist);
rq->errors = 0;
- rq->rq_status = RQ_ACTIVE;
rq->bio = rq->biotail = NULL;
INIT_HLIST_NODE(&rq->hash);
RB_CLEAR_NODE(&rq->rb_node);
@@ -2650,8 +2649,6 @@ void __blk_put_request(request_queue_t *
elv_completed_request(q, req);
- req->rq_status = RQ_INACTIVE;
-
/*
* Request may not have originated from ll_rw_blk. if not,
* it didn't come out of our reserved rq pools
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 87f6828..975d071 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -719,7 +719,6 @@ static int pd_special_command(struct pd_
memset(&rq, 0, sizeof(rq));
rq.errors = 0;
- rq.rq_status = RQ_ACTIVE;
rq.rq_disk = disk->gd;
rq.ref_count = 1;
rq.end_io_data = &wait;
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index cc42e76..f2305ee 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -319,8 +319,8 @@ #if 0
printk("do_fd_req: dev=%s cmd=%d sec=%ld nr_sec=%ld buf=%p\n",
req->rq_disk->disk_name, req->cmd,
(long)req->sector, req->nr_sectors, req->buffer);
- printk(" rq_status=%d errors=%d current_nr_sectors=%ld\n",
- req->rq_status, req->errors, req->current_nr_sectors);
+ printk(" errors=%d current_nr_sectors=%ld\n",
+ req->errors, req->current_nr_sectors);
#endif
if (req->sector < 0 || req->sector >= fs->total_secs) {
diff --git a/drivers/block/swim_iop.c b/drivers/block/swim_iop.c
index 89e3c2f..dfda796 100644
--- a/drivers/block/swim_iop.c
+++ b/drivers/block/swim_iop.c
@@ -529,8 +529,8 @@ #if 0
printk("do_fd_req: dev=%s cmd=%d sec=%ld nr_sec=%ld buf=%p\n",
CURRENT->rq_disk->disk_name, CURRENT->cmd,
CURRENT->sector, CURRENT->nr_sectors, CURRENT->buffer);
- printk(" rq_status=%d errors=%d current_nr_sectors=%ld\n",
- CURRENT->rq_status, CURRENT->errors, CURRENT->current_nr_sectors);
+ printk(" errors=%d current_nr_sectors=%ld\n",
+ CURRENT->errors, CURRENT->current_nr_sectors);
#endif
if (CURRENT->sector < 0 || CURRENT->sector >= fs->total_secs) {
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 66d03f2..0c5a3b2 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -974,7 +974,6 @@ #if 0 /* broken junk, but if davem wants
*/
fc->rst_pkt->device->host->eh_action = &sem;
- fc->rst_pkt->request->rq_status = RQ_SCSI_BUSY;
fc->rst_pkt->done = fcp_scsi_reset_done;
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index adbe9f7..908f3da 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -1281,8 +1281,7 @@ static ide_startstop_t idefloppy_do_requ
idefloppy_pc_t *pc;
unsigned long block = (unsigned long)block_s;
- debug_log(KERN_INFO "rq_status: %d, dev: %s, flags: %lx, errors: %d\n",
- rq->rq_status,
+ debug_log(KERN_INFO "dev: %s, flags: %lx, errors: %d\n",
rq->rq_disk ? rq->rq_disk->disk_name : "?",
rq->flags, rq->errors);
debug_log(KERN_INFO "sector: %ld, nr_sectors: %ld, "
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 8753a50..f491b71 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -1710,7 +1710,6 @@ int ide_do_drive_cmd (ide_drive_t *drive
int must_wait = (action == ide_wait || action == ide_head_wait);
rq->errors = 0;
- rq->rq_status = RQ_ACTIVE;
/*
* we need to hold an extra reference to request for safe inspection
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index acf2e4f..e0899d6 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -2423,8 +2423,8 @@ static ide_startstop_t idetape_do_reques
#if IDETAPE_DEBUG_LOG
#if 0
if (tape->debug_level >= 5)
- printk(KERN_INFO "ide-tape: rq_status: %d, "
- "dev: %s, cmd: %ld, errors: %d\n", rq->rq_status,
+ printk(KERN_INFO "ide-tape: %d, "
+ "dev: %s, cmd: %ld, errors: %d\n",
rq->rq_disk->disk_name, rq->cmd[0], rq->errors);
#endif
if (tape->debug_level >= 2)
diff --git a/drivers/scsi/ide-scsi.c b/drivers/scsi/ide-scsi.c
index f7b5d73..b6b223f 100644
--- a/drivers/scsi/ide-scsi.c
+++ b/drivers/scsi/ide-scsi.c
@@ -708,7 +708,7 @@ static ide_startstop_t idescsi_issue_pc
static ide_startstop_t idescsi_do_request (ide_drive_t *drive, struct request *rq, sector_t block)
{
#if IDESCSI_DEBUG_LOG
- printk (KERN_INFO "rq_status: %d, dev: %s, cmd: %x, errors: %d\n",rq->rq_status, rq->rq_disk->disk_name,rq->cmd[0],rq->errors);
+ printk (KERN_INFO "dev: %s, cmd: %x, errors: %d\n", rq->rq_disk->disk_name,rq->cmd[0],rq->errors);
printk (KERN_INFO "sector: %ld, nr_sectors: %ld, current_nr_sectors: %d\n",rq->sector,rq->nr_sectors,rq->current_nr_sectors);
#endif /* IDESCSI_DEBUG_LOG */
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2ab7df0..07161f3 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1047,7 +1047,7 @@ int scsi_device_cancel(struct scsi_devic
spin_lock_irqsave(&sdev->list_lock, flags);
list_for_each_entry(scmd, &sdev->cmd_list, list) {
- if (scmd->request && scmd->request->rq_status != RQ_INACTIVE) {
+ if (scmd->request) {
/*
* If we are unable to remove the timer, it means
* that the command has already timed out or
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 1370687..73b0eeb 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -160,8 +160,6 @@ struct request {
void *completion_data;
- int rq_status; /* should split this into a few status bits */
- int errors;
struct gendisk *rq_disk;
unsigned long start_time;
@@ -179,14 +177,16 @@ struct request {
unsigned short ioprio;
- int tag;
-
- int ref_count;
request_queue_t *q;
void *special;
char *buffer;
+ int tag;
+ int errors;
+
+ int ref_count;
+
/*
* when request is used as a packet command carrier
*/
@@ -441,9 +441,6 @@ struct request_queue
struct mutex sysfs_lock;
};
-#define RQ_INACTIVE (-1)
-#define RQ_ACTIVE 1
-
#define QUEUE_FLAG_CLUSTER 0 /* cluster several segments into 1 */
#define QUEUE_FLAG_QUEUED 1 /* uses generic tag queueing */
#define QUEUE_FLAG_STOPPED 2 /* queue is stopped */
--
1.4.1.ged0e0
^ permalink raw reply related [flat|nested] 4+ messages in thread