Kernel Bug-Vulnerability-Comment library

sisi8408

1. 
   
2. /*
   
3. * 2.6.24.4-rt4
   
4. */
   
5. +static int ksoftirqd(void * __data)
   
6. +{
   
7. +        struct sched_param param = { .sched_priority = MAX_USER_RT_PRIO/2 };
   
8. +        struct softirqdata *data = __data;
   
9. +        u32 softirq_mask = (1 << data->nr);
   
10. +        struct softirq_action *h;
    
11. +        int cpu = data->cpu;
    
12. +
    
13. +#ifdef CONFIG_PREEMPT_SOFTIRQS
    
14. +        init_waitqueue_head(&data->wait);
    
15. +#endif
    
16. +
    
17. +        sys_sched_setscheduler(current->pid, SCHED_FIFO, &param);
    
18. +        current->flags |= PF_SOFTIRQ;
    
19.         set_current_state(TASK_INTERRUPTIBLE);
    

复制代码

1. 
   
2. /*
   
3. * 2.6.24.4
   
4. */
   
5. static void task_tick_rt(struct rq *rq, struct task_struct *p)
   
6. {
   
7.         update_curr_rt(rq);
   
8. 
   
9.         /*
   
10.          * RR tasks need a special form of timeslice management.
    
11.          * FIFO tasks have no timeslices.
    
12.          */
    
13.         if (p->policy != SCHED_RR)
    
14.                 return;
    
15. 
    
16.         if (--p->time_slice)
    
17.                 return;
    
18. 
    
19.         p->time_slice = DEF_TIMESLICE;
    
20. 
    
21.         /*
    
22.          * Requeue to the end of queue if we are not the only element
    
23.          * on the queue:
    
24.          */
    
25.         if (p->run_list.prev != p->run_list.next) {
    
26.                 requeue_task_rt(rq, p);
    
27.                 set_tsk_need_resched(p);
    
28.         }
    
29. }
    

复制代码

if ksoftirqd is RT & SCHED_FIFO, provided that FIFO tasks have no timeslices,
it is possible in many cases even in RT version that NET_TX_SOFTIRQ,
NET_RX_SOFTIRQ and others mask each other, which may result in unnormal behaviors,
say slab cache crash.

[ 本帖最后由 sisi8408 于 2008-5-11 00:30 编辑 ]

sisi8408

1. 
   
2. /* 2.6.24.4
   
3. * static void rebalance_domains(int cpu, enum cpu_idle_type idle)
   
4. */
   
5. -                if (interval > HZ * NR_CPUS /10)
   
6. -                        interval = HZ * NR_CPUS /10;
   
7. +                if (interval > (HZ /10) * num_online_cpus)
   
8. +                        interval = (HZ /10) * num_online_cpus;
   

复制代码

sisi8408

1. 
   
2. /** 2.6.24.4
   
3. static int __assign_irq_vector(int irq, cpumask_t mask)
   
4. */
   
5.                 if (unlikely(current_vector == vector))
   
6. -                        continue;
   
7. +                        goto next;               
   

复制代码

sisi8408

1. 
   
2. /*
   
3. * from 独孤九贱大侠的帖子
   
4. */
   
5. Unable to handle kernel paging request at virtual address 713401b6
   
6. 
   
7. printing eip: *pde = 00000000
   
8. Oops: 0000 [#1]
   
9. SMP
   
10. Modules linked in: uflux e1000 trusthost
    
11. CPU:    0
    
12. EIP:    0060:[<c03c1de6>]    Not tainted VLI
    
13. EFLAGS: 00010206   (2.6.12)
    
14. 
    
15. EIP is at ip_route_input+0x86/0x1d0
    
16. 
    
17. eax: df976fc0   ebx: c0629000   ecx: 7134010a   edx: 00000000
    
18. esi: 0121010a   edi: 2495313a   ebp: 00000003   esp: c0629f04
    
19. ds: 007b   es: 007b   ss: 0068
    
20. 
    
21. Process swapper (pid: 0, threadinfo=c0629000 task=c0508c20)
    
22. 
    
23. Stack: 0121010a 2495315a 00000000 00000000 df987800 00000000 df987800 dd0b6400
    
24.        00000000 006d8580 00000000 dd0b6400 dd14c620 c03c4fc0 c03c4eff dd0b6400
    
25.        0121010a 2495313a 00000000 df987800 c03c4fc0 80000000 dd18d440 dc7ef240
    
26. Call Trace:
    
27. [<c03c4fc0>] ip_rcv_finish+0x0/0x310
    
28. [<c03c4eff>] ip_rcv+0x4ef/0x5b0
    
29. [<c03c4fc0>] ip_rcv_finish+0x0/0x310
    
30. [<c039a771>] netif_receive_skb+0x1e1/0x280
    
31. [<c039a8a3>] process_backlog+0x93/0x130
    
32. [<c039a9ef>] net_rx_action+0xaf/0x1a0
    
33. [<c0129942>] __do_softirq+0x72/0xe0
    
34. [<c0106bcb>] do_softirq+0x5b/0x60
    
35. 
    
36. /* ------------------------------------------------ */
    
37. 
    
38.     39c0:       a1 00 00 00 00          mov    0x0,%eax
    
39.     39c5:       8b 53 10                mov    0x10(%ebx),%edx
    
40.     39c8:       f7 d0                   not    %eax
    
41.     39ca:       8b 04 90                mov    (%eax,%edx,4),%eax
    
42.     39cd:       ff 40 38                incl   0x38(%eax)
    
43.     39d0:       8b 09                   mov    (%ecx),%ecx
    
44.     39d2:       85 c9                   test   %ecx,%ecx
    
45.     39d4:       74 7a                   je     3a50 <ip_route_input+0x100>
    
46.     39d6:       39 b1 ac 00 00 00       cmp    %esi,0xac(%ecx)
    

复制代码

1. 
   
2. 1,        EIP is at 39d6, as shown the original poster,
   
3.         and it is clear that the rt entry is still in hash table,
   
4.         otherwise the reader of rt hash table has no chance to see it.
   
5.         And there are at most 3 chances of hard irq, which will block
   
6.         the reader, from 39d0 to 39d6.
   
7. 
   
8. 2,        From call trace, the reader is in context of soft irq,
   
9.         and the NAPI is not active in the kernel used.
   
10. 
    
11. 3,        Since non-NAPI, what a pity, the NIC ISR is longer and completes when
    
12.         netif_rx() returns.
    
13. 
    
14. 4,        It is assumed that hardware works fine, anyway.
    
15.         An updater on another cpu, yeah, (if no ohter cpu oops has no chance to play
    
16.         its game, just because oops occurs in soft irq contxt,)
    
17.         deletes the rt entry in %ecx in 39d0,
    
18.         after happenly the reader is blocked by hard irq, say new skb is coming.
    
19. 
    
20. 5,        Of high probablity, the updater is from timer hard irq on another cpu,
    
21. 
    
22. /* 2.6.24.4
    
23. *
    
24. * Called from the timer interrupt handler,
    
25. * to charge one tick to the current process.
    
26. *
    
27. * user_tick is 1 if the tick is user time, 0 for system.
    
28. */
    
29. void update_process_times (int user_tick)
    
30. {
    
31.         struct task_struct *p = current;
    
32.         int cpu = smp_processor_id();
    
33. 
    
34.         account_process_tick(p, user_tick);
    
35.         run_local_timers();
    
36.        
    
37.         if (rcu_pending(cpu))
    
38.                 rcu_check_callbacks(cpu, user_tick);
    
39.        
    
40.         scheduler_tick();
    
41.         run_posix_cpu_timers(p);
    
42. }
    
43. 
    
44.         rt gc timer, execed by run_local_timers(),
    
45.         happenly deletes the rt entry in %ecx in 39d0,
    
46.         which is already seen by the reader and is not NULL,
    
47.         and delivers it to rcu core by calling call_rcu_bh().
    
48.        
    
49.         In rcu_pending(), there are 4 chances that
    
50.         fire rcu_check_callbacks(),
    
51.         in which tasklet_schedule(&per_cpu(rcu_tasklet, cpu)) is called in anyway.
    
52. 
    
53. 6,        Though rcu_tasklet is registered,
    
54. 
    
55. /*
    
56. * This does the RCU processing work from tasklet context.
    
57. */
    
58. static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp,
    
59.                                         struct rcu_data *rdp)
    
60. {
    
61.         if (rdp->curlist &&
    
62.             !rcu_batch_before(rcp->completed, rdp->batch)) {
    
63.                 *rdp->donetail = rdp->curlist;
    
64.                 rdp->donetail = rdp->curtail;
    
65.                 /*
    
66.                  * rcp->completed >= rdp->batch
    
67.                  */
    
68.                 rdp->curlist = NULL;
    
69.                 rdp->curtail = &rdp->curlist;
    
70.         }
    
71. 
    
72.         if (rdp->nxtlist && !rdp->curlist) {
    
73.                 local_irq_disable();
    
74.                 rdp->curlist = rdp->nxtlist;
    
75.                 rdp->curtail = rdp->nxttail;
    
76.                
    
77.                 rdp->nxtlist = NULL;
    
78.                 rdp->nxttail = &rdp->nxtlist;
    
79.                 local_irq_enable();
    
80.                
    
81.                 /*
    
82.                  * start the next batch of callbacks
    
83.                  */
    
84. 
    
85.                 /* determine batch number */
    
86.                 rdp->batch = rcp->cur + 1;
    
87.                
    
88.                 /* see the comment and corresponding wmb() in
    
89.                  * the rcu_start_batch()
    
90.                  */
    
91.                 smp_rmb();
    
92. 
    
93.                 if (!rcp->next_pending) {
    
94.                         /* and start it/schedule start if it's a new batch */
    
95.                         spin_lock(&rcp->lock);
    
96.                         rcp->next_pending = 1;
    
97.                         rcu_start_batch(rcp);
    
98.                         spin_unlock(&rcp->lock);
    
99.                 }
    
100.         }
     
101. 
     
102.         rcu_check_quiescent_state(rcp, rdp);
     
103.        
     
104.         if (rdp->donelist)
     
105.                 rcu_do_batch(rdp);
     
106. }
     
107. 
     
108.         call_rcu_bh() only add the victim to rdp->nxtlist,
     
109.         which will not be freed in the first exec of rcu_tasklet after
     
110.         timer hard irq, but maybe freed in the following execs of rcu_tasklet
     
111.         after the same timer hard irq becaude soft irqs are allowed more than once,
     
112.         if certain conditions match:
     
113.        
     
114.         I,        if (rdp->nxtlist && !rdp->curlist) is true,
     
115.                 when the first exec of rcu_tasklet,
     
116.                 rdp->curlist = rdp->nxtlist;
     
117.        
     
118.         II,        if (rdp->nxtlist && !rdp->curlist) is true,
     
119.                 also when the first exec of rcu_tasklet,
     
120.        
     
121.         III,        rcu_bh_qsctr_inc(cpu) already called in rcu_check_callbacks()
     
122.        
     
123.         IV,        cpu_quiet() called by rcu_check_quiescent_state()
     
124.                 when the first exec of rcu_tasklet,
     
125.        
     
126.         V,        if (rdp->curlist &&
     
127.                         !rcu_batch_before(rcp->completed, rdp->batch))
     
128.                 is true,
     
129.                 when the second exec of rcu_tasklet,
     
130. 
     
131.         VI,        if the reader is blocked longer enough       
     

复制代码

[ 本帖最后由 sisi8408 于 2008-6-8 00:08 编辑 ]

sisi8408

1. 
   
2. ...
   
3.         schedstat_inc(rq, ttwu_count);
   
4. 
   
5.         if (cpu == this_cpu) {
   
6.                 schedstat_inc(rq, ttwu_local);
   
7.                 goto out_set_cpu;
   
8.         }
   
9. /* try_to_wake_up @ 2.6.24.4
   
10.         if (unlikely(!cpu_isset(this_cpu, p->cpus_allowed)))
    
11.                 goto out_set_cpu;
    
12. */
    
13.         for_each_domain(this_cpu, sd) {
    
14.                 if (cpu_isset(cpu, sd->span)) {
    
15.                         schedstat_inc(sd, ttwu_wake_remote);
    
16.                         this_sd = sd;
    
17.                         break;
    
18.                 }
    
19.         }
    
20. 
    
21.         if (unlikely(!cpu_isset(this_cpu, p->cpus_allowed)))
    
22.                 goto out_set_cpu;
    
23. 
    
24.         /*
    
25.          * Check for affine wakeup and passive balancing possibilities.
    
26.          */
    
27. ...
    

复制代码

sisi8408

1. 
   
2. ...
   
3.         /* build_sched_domains @ 2.6.24.4
   
4.          * Calculate CPU power for physical packages and nodes
   
5.          */
   
6. #ifdef CONFIG_SCHED_SMT
   
7.         for_each_cpu_mask(i, *cpu_map) {
   
8.                 struct sched_domain *sd = &per_cpu(cpu_domains, i);
   
9. 
   
10.                 init_sched_groups_power(i, sd);
    
11.         }
    
12. 
    
13. #elif defined(CONFIG_SCHED_MC)
    
14.         for_each_cpu_mask(i, *cpu_map) {
    
15.                 struct sched_domain *sd = &per_cpu(core_domains, i);
    
16. 
    
17.                 init_sched_groups_power(i, sd);
    
18.         }
    
19. #else
    
20. 
    
21.         for_each_cpu_mask(i, *cpu_map) {
    
22.                 struct sched_domain *sd = &per_cpu(phys_domains, i);
    
23. 
    
24.                 init_sched_groups_power(i, sd);
    
25.         }
    
26. #endif
    
27. 
    
28.         /* Attach the domains */
    
29. ...
    

复制代码

sisi8408

queue & sched in .26 blk layer

1. 
   
2. 1, blk init core
   
3.    =============
   
4. 
   
5. int __init blk_dev_init(void)
   
6. {
   
7.         int i;
   
8. 
   
9.         /* 1,
   
10.          * ops upon queue is based on `work',
    
11.          * it is asyn and in kthead context, goto see work queue,
    
12.          * like do_softirq and ksoftirqd/x
    
13.          */
    
14.         kblockd_workqueue = create_workqueue("kblockd");
    
15.         if (!kblockd_workqueue)
    
16.                 panic("Failed to create kblockd\n");
    
17. 
    
18.         request_cachep = kmem_cache_create("blkdev_requests",
    
19.                         sizeof(struct request), 0, SLAB_PANIC, NULL);
    
20.         /* 2,
    
21.          * like at other spots, kmem cache utilised for skb in net,
    
22.          * if u like to do something funny for skb, say 0-copy,
    
23.          * u have to maintain alloc/free_skb methods,
    
24.          * hard&hot isnt, shit?
    
25.          */
    
26.         blk_requestq_cachep = kmem_cache_create("blkdev_queue",
    
27.                         sizeof(struct request_queue), 0, SLAB_PANIC, NULL);
    
28. 
    
29.         for_each_possible_cpu(i)
    
30.                 INIT_LIST_HEAD(&per_cpu(blk_cpu_done, i));
    
31.         /* 3,
    
32.          * per cpu list prepared for BLOCK_SOFTIRQ,
    
33.          * powerful, and lockless of cough
    
34.          */
    
35.         open_softirq(BLOCK_SOFTIRQ, blk_done_softirq, NULL);
    
36.        
    
37.         register_hotcpu_notifier(&blk_cpu_notifier);
    
38. 
    
39.         return 0;
    
40. }
    

复制代码

sisi8408

1. 
   
2. 2, Q init
   
3.    ======
   
4. 
   
5. `blk layer` is connected to reiser/btr FS through left hand,
   
6. and through right hand connects scsi driver/controler.
   
7. 
   
8. general in all, `blk layer` represents the soft methods upon blk device,
   
9. including queue and scheduler, or simply elevator which is responsible for
   
10. managing whatever schedulers, if available.
    
11. 
    
12. in the eyes of elevator, blk device is a queue,
    
13. alloced by driver,
    
14. 
    
15. struct request_queue * blk_alloc_queue(gfp_t gfp_mask)
    
16. {
    
17.         return blk_alloc_queue_node(gfp_mask, -1);
    
18. }
    
19. 
    
20. struct request_queue * blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
    
21. {
    
22.         struct request_queue *q;
    
23.         int err;
    
24. 
    
25.         q = kmem_cache_alloc_node(blk_requestq_cachep,
    
26.                                 gfp_mask | __GFP_ZERO, node_id);
    
27.         if (!q)
    
28.                 return NULL;
    
29. 
    
30.         q->backing_dev_info.unplug_io_fn = blk_backing_dev_unplug;
    
31.         /* 1,
    
32.          * bdi, one concept in disk cache,
    
33.          * goto see and compare with ramdisk, nice example for pseudo device,
    
34.          * if u like to play game on SSD.
    
35.          */
    
36.         q->backing_dev_info.unplug_io_data = q;
    
37.        
    
38.         err = bdi_init(&q->backing_dev_info);
    
39.         if (err) {
    
40.                 kmem_cache_free(blk_requestq_cachep, q);
    
41.                 return NULL;
    
42.         }
    
43. 
    
44.         /* 2,
    
45.          * like hrtimer, simple machine for scheduling controler
    
46.          */
    
47.         init_timer(&q->unplug_timer);
    
48. 
    
49.         kobject_init(&q->kobj, &blk_queue_ktype);
    
50.         /* 3,
    
51.          * reguler sysfs socket, its papa looks cool
    
52.          */
    
53.         mutex_init(&q->sysfs_lock);
    
54.        
    
55.         spin_lock_init(&q->__queue_lock);
    
56.         return q;
    
57. }
    
58. 
    
59. 
    
60. and initilised in blk layer,
    
61. 
    
62. struct request_queue * blk_init_queue(request_fn_proc *rfn, spinlock_t *lock)
    
63. {
    
64.         return blk_init_queue_node(rfn, lock, -1);
    
65. }
    
66. 
    
67. struct request_queue *
    
68.         blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
    
69. {
    
70.         struct request_queue *q = blk_alloc_queue_node(GFP_KERNEL, node_id);
    
71. 
    
72.         if (!q)
    
73.                 return NULL;
    
74.         q->node = node_id;
    
75. 
    
76.         if (blk_init_free_list(q)) {
    
77.                 kmem_cache_free(blk_requestq_cachep, q);
    
78.                 return NULL;
    
79.         }
    
80. 
    
81.         /*
    
82.          * if caller didn't supply a lock,
    
83.          * they get per-queue locking with our embedded lock
    
84.          */
    
85.         if (!lock)
    
86.                 lock = &q->__queue_lock;
    
87.         q->queue_lock        = lock;
    
88. 
    
89.         q->request_fn                = rfn;
    
90.         q->prep_rq_fn                = NULL;
    
91.         q->unplug_fn                = generic_unplug_device;
    
92.         q->queue_flags                = (1 << QUEUE_FLAG_CLUSTER);
    
93. 
    
94.         blk_queue_segment_boundary(q, 0xffffffff);
    
95. 
    
96.         blk_queue_make_request(q, __make_request);
    
97.         blk_queue_max_segment_size(q, MAX_SEGMENT_SIZE);
    
98. 
    
99.         blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);
    
100.         blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);
     
101. 
     
102.         q->sg_reserved_size = INT_MAX;
     
103. 
     
104.         /*
     
105.          * all done
     
106.          *
     
107.          * info big brother, wheelz, ready for game
     
108.          */
     
109.         if (!elevator_init(q, NULL)) {
     
110.                 blk_queue_congestion_threshold(q);
     
111.                 return q;
     
112.         }
     
113. 
     
114.         blk_put_queue(q);
     
115.         return NULL;
     
116. }
     

复制代码

sisi8408

1. 
   
2. 3, basic methods for request alloc/free/prepare/init
   
3.    =================================================
   
4. 
   
5. FS dispatch bios to elevator, just for efficiency they are merged into request
   
6. if possible, then delivered to controler when necessary.
   
7. 
   
8. static struct request *
   
9.         get_request(struct request_queue *q, int rw_flags,
   
10.                         struct bio *bio, gfp_t gfp_mask)
    
11. {
    
12.         struct request *rq = NULL;
    
13.         struct request_list *rl = &q->rq;
    
14.         struct io_context *ioc = NULL;
    
15.         const int rw = rw_flags & 0x01;
    
16.         int may_queue, priv;
    
17. 
    
18.         may_queue = elv_may_queue(q, rw_flags);
    
19.         /* 1,
    
20.          * check resource not over limit, say cpu time.
    
21.          * the starv concept still play its role,
    
22.          * howto compensate?
    
23.          */
    
24.         if (may_queue == ELV_MQUEUE_NO)
    
25.                 goto rq_starved;
    
26. 
    
27.         if (rl->count[rw] +1 >= queue_congestion_on_threshold(q)) {
    
28.                 /* 2,
    
29.                  * not only for efficiency, nice scheduling also imposes
    
30.                  * resource limit upon all tasks in system,
    
31.                  * fair play is considered here, with little to do with
    
32.                  * if u r root, but compensation is also fair.
    
33.                  */
    
34.                 if (rl->count[rw] +1 >= q->nr_requests) {
    
35.                         ioc = current_io_context(GFP_ATOMIC, q->node);
    
36.                         /*
    
37.                          * The queue will full after this allocation, so set
    
38.                          * it as full, and mark this process as "batching".
    
39.                          *
    
40.                          * This process will be allowed to complete a batch of
    
41.                          * requests, others will be blocked.
    
42.                          */
    
43.                         if (!blk_queue_full(q, rw)) {
    
44.                                 ioc_set_batching(q, ioc);
    
45.                                 blk_set_queue_full(q, rw);
    
46.                         } else {
    
47.                                 if (may_queue != ELV_MQUEUE_MUST
    
48.                                         && !ioc_batching(q, ioc)) {
    
49.                                         /*
    
50.                                          * The queue is full and the allocating
    
51.                                          * process is not a "batcher", and not
    
52.                                          * exempted by the IO scheduler
    
53.                                          */
    
54.                                         goto out;
    
55.                                 }
    
56.                                 /* else
    
57.                                  *
    
58.                                  * batcher is biased to allocate upto 50%
    
59.                                  * over the defined limit
    
60.                                  */
    
61.                         }
    
62.                 }
    
63.                 blk_set_queue_congested(q, rw);
    
64.         }
    
65. 
    
66.         /*
    
67.          * Only allow batching queuers to allocate up to 50% over the defined
    
68.          * limit of requests, otherwise we could have thousands of requests
    
69.          * allocated with any setting of ->nr_requests
    
70.          */
    
71.         if (rl->count[rw] >= (3 * q->nr_requests / 2))
    
72.                 goto out;
    
73. 
    
74.         rl->count[rw]++;
    
75.         rl->starved[rw] = 0;
    
76. 
    
77.         priv = !test_bit(QUEUE_FLAG_ELVSWITCH, &q->queue_flags);
    
78.         if (priv)
    
79.                 rl->elvpriv++;
    
80. 
    
81.         spin_unlock_irq(q->queue_lock);
    
82. 
    
83.         rq = blk_alloc_request(q, rw_flags, priv, gfp_mask);
    
84.         if (unlikely(!rq)) {
    
85.                 /*
    
86.                  * Allocation failed presumably due to memory. Undo anything
    
87.                  * we might have messed up.
    
88.                  *
    
89.                  * Allocating task should really be put onto the front of the
    
90.                  * wait queue, but this is pretty rare.
    
91.                  */
    
92.                 spin_lock_irq(q->queue_lock);
    
93.                 /* 3,
    
94.                  * nice scheduling is based upon housekeeper, right?
    
95.                  * is mm based on page frame?
    
96.                  */
    
97.                 freed_request(q, rw, priv);
    
98. 
    
99.                 /*
    
100.                  * in the very unlikely event that allocation failed and no
     
101.                  * requests for this direction was pending, mark us starved
     
102.                  * so that freeing of a request in the other direction will
     
103.                  * notice us. another possible fix would be to split the
     
104.                  * rq mempool into READ and WRITE
     
105.                  */
     
106. rq_starved:
     
107.                 if (unlikely(rl->count[rw] == 0))
     
108.                         rl->starved[rw] = 1;
     
109. 
     
110.                 goto out;
     
111.         }
     
112. 
     
113.         /*
     
114.          * ioc may be NULL here, and ioc_batching will be false. That's
     
115.          * OK, if the queue is under the request limit then requests need
     
116.          * not count toward the nr_batch_requests limit. There will always
     
117.          * be some limit enforced by BLK_BATCH_TIME.
     
118.          */
     
119.         if (ioc_batching(q, ioc))
     
120.                 ioc->nr_batch_requests--;
     
121. 
     
122.         blk_add_trace_generic(q, bio, rw, BLK_TA_GETRQ);
     
123. out:
     
124.         return rq;
     
125. }
     
126. 
     
127. static void freed_request(struct request_queue *q, int rw, int priv)
     
128. {
     
129.         struct request_list *rl = &q->rq;
     
130. 
     
131.         rl->count[rw]--;
     
132.        
     
133.         if (priv)
     
134.                 rl->elvpriv--;
     
135. 
     
136.         __freed_request(q, rw);
     
137. 
     
138.         if (unlikely(rl->starved[rw ^ 1]))
     
139.                 /* 1,
     
140.                  * today elevator has little to do with if u r reader,
     
141.                  * since nobody has enough power to declare blue blood is nicer,
     
142.                  */
     
143.                 __freed_request(q, rw ^ 1);
     
144. }
     
145. static void __freed_request(struct request_queue *q, int rw)
     
146. {
     
147.         struct request_list *rl = &q->rq;
     
148. 
     
149.         if (rl->count[rw] < queue_congestion_off_threshold(q))
     
150.                 blk_clear_queue_congested(q, rw);
     
151. 
     
152.         if (rl->count[rw] + 1 <= q->nr_requests) {
     
153.                 /* 2,
     
154.                  * but if and only if under control,
     
155.                  * chance for compensation still available to keep disk rotating
     
156.                  */
     
157.                 if (waitqueue_active(&rl->wait[rw]))
     
158.                         wake_up(&rl->wait[rw]);
     
159. 
     
160.                 blk_clear_queue_full(q, rw);
     
161.         }
     
162. }
     
163. 
     
164. 
     
165. void init_request_from_bio(struct request *req, struct bio *bio)
     
166. {
     
167.         req->cmd_type = REQ_TYPE_FS;
     
168. 
     
169.         /*
     
170.          * inherit FAILFAST from bio (for read-ahead, and explicit FAILFAST)
     
171.          */
     
172.         if (bio_rw_ahead(bio) || bio_failfast(bio))
     
173.                 req->cmd_flags |= REQ_FAILFAST;
     
174. 
     
175.         /*
     
176.          * REQ_BARRIER implies no merging, but lets make it explicit
     
177.          */
     
178.         if (unlikely(bio_barrier(bio)))
     
179.                 req->cmd_flags |= (REQ_HARDBARRIER | REQ_NOMERGE);
     
180. 
     
181.         if (bio_sync(bio))
     
182.                 req->cmd_flags |= REQ_RW_SYNC;
     
183.         if (bio_rw_meta(bio))
     
184.                 req->cmd_flags |= REQ_RW_META;
     
185. 
     
186.         req->errors = 0;
     
187.         req->hard_sector = req->sector = bio->bi_sector;
     
188.         /* 1,
     
189.          * prio also considered, but how is it defined?
     
190.          */
     
191.         req->ioprio = bio_prio(bio);
     
192.         req->start_time = jiffies;
     
193.        
     
194.         blk_rq_bio_prep(req->q, req, bio);
     
195. }
     
196. void blk_rq_bio_prep(struct request_queue *q, struct request *rq,
     
197.                      struct bio *bio)
     
198. {
     
199.         /* first two bits are identical in rq->cmd_flags and bio->bi_rw */
     
200.         rq->cmd_flags |= (bio->bi_rw & 3);
     
201. 
     
202.         rq->nr_phys_segments = bio_phys_segments(q, bio);
     
203.         rq->nr_hw_segments = bio_hw_segments(q, bio);
     
204.         rq->current_nr_sectors = bio_cur_sectors(bio);
     
205.         rq->hard_cur_sectors = rq->current_nr_sectors;
     
206.         rq->hard_nr_sectors = rq->nr_sectors = bio_sectors(bio);
     
207.         rq->buffer = bio_data(bio);
     
208.         rq->data_len = bio->bi_size;
     
209. 
     
210.         rq->bio = rq->biotail = bio;
     
211. 
     
212.         if (bio->bi_bdev)
     
213.                 rq->rq_disk = bio->bi_bdev->bd_disk;
     
214. }
     

复制代码

sisi8408

1. 
   
2. 4, basic method exported to FS
   
3.    ===========================
   
4. 
   
5. void submit_bio(int rw, struct bio *bio)
   
6. {
   
7.         int count = bio_sectors(bio);
   
8. 
   
9.         bio->bi_rw |= rw;
   
10. 
    
11.         /*
    
12.          * If it's a regular read/write or a barrier with data attached,
    
13.          * go through the normal accounting stuff before submission.
    
14.          */
    
15.         if (!bio_empty_barrier(bio)) {
    
16.                 BIO_BUG_ON(!bio->bi_size);
    
17.                 BIO_BUG_ON(!bio->bi_io_vec);
    
18. 
    
19.                 if (rw & WRITE) {
    
20.                         count_vm_events(PGPGOUT, count);
    
21.                 } else {
    
22.                         task_io_account_read(bio->bi_size);
    
23.                         count_vm_events(PGPGIN, count);
    
24.                 }
    
25. 
    
26.                 if (unlikely(block_dump)) {
    
27.                         char b[BDEVNAME_SIZE];
    
28.                        
    
29.                         printk(KERN_DEBUG "%s(%d): %s block %Lu on %s\n",
    
30.                         current->comm, task_pid_nr(current),
    
31.                                 (rw & WRITE) ? "WRITE" : "READ",
    
32.                                 (unsigned long long)bio->bi_sector,
    
33.                                 bdevname(bio->bi_bdev, b));
    
34.                 }
    
35.         }
    
36.         generic_make_request(bio);
    
37. }
    
38. 
    
39. void generic_make_request(struct bio *bio)
    
40. {
    
41.         if (current->bio_tail) { /* make_request is active */
    
42.                 *(current->bio_tail) = bio;
    
43.                 bio->bi_next = NULL;
    
44.                 current->bio_tail = &bio->bi_next;
    
45.                 return;
    
46.         }
    
47.         /* following loop may be a bit non-obvious, and so deserves some
    
48.          * explanation.
    
49.          * Before entering the loop, bio->bi_next is NULL (as all callers
    
50.          * ensure that) so we have a list with a single bio.
    
51.          *
    
52.          * We pretend that we have just taken it off a longer list, so
    
53.          * we assign bio_list to the next (which is NULL) and bio_tail
    
54.          * to &bio_list, thus initialising the bio_list of new bios to be
    
55.          * added.  __generic_make_request may indeed add some more bios
    
56.          * through a recursive call to generic_make_request.  If it
    
57.          * did, we find a non-NULL value in bio_list and re-enter the loop
    
58.          * from the top.  In this case we really did just take the bio
    
59.          * of the top of the list (no pretending) and so fixup bio_list and
    
60.          * bio_tail or bi_next, and call into __generic_make_request again.
    
61.          *
    
62.          * The loop was structured like this to make only one call to
    
63.          * __generic_make_request (which is important as it is large and
    
64.          * inlined) and to keep the structure simple.
    
65.          */
    
66.         BUG_ON(bio->bi_next);
    
67.        
    
68.         do {
    
69.                 current->bio_list = bio->bi_next;
    
70.                
    
71.                 if (bio->bi_next == NULL)
    
72.                         current->bio_tail = &current->bio_list;
    
73.                 else
    
74.                         bio->bi_next = NULL;
    
75.                
    
76.                 __generic_make_request(bio);
    
77.                 bio = current->bio_list;
    
78.         } while (bio);
    
79. 
    
80.         current->bio_tail = NULL; /* deactivate */
    
81. }
    
82. 
    
83. static inline void __generic_make_request(struct bio *bio)
    
84. {
    
85.         struct request_queue *q;
    
86.         sector_t old_sector;
    
87.         int ret, nr_sectors = bio_sectors(bio);
    
88.         dev_t old_dev;
    
89.         int err = -EIO;
    
90. 
    
91.         might_sleep();
    
92.         /* 1,
    
93.          * check physical overflow
    
94.          */
    
95.         if (bio_check_eod(bio, nr_sectors))
    
96.                 goto end_io;
    
97. 
    
98.         /*
    
99.          * Resolve the mapping until finished. (drivers are
    
100.          * still free to implement/resolve their own stacking
     
101.          * by explicitly returning 0)
     
102.          *
     
103.          * NOTE: we don't repeat the blk_size check for each new device.
     
104.          * Stacking drivers are expected to know what they are doing.
     
105.          */
     
106.         old_sector = -1;
     
107.         old_dev = 0;
     
108.         do {
     
109.                 char b[BDEVNAME_SIZE];
     
110.                 /* 2,
     
111.                  * determine physical disk
     
112.                  */
     
113.                 q = bdev_get_queue(bio->bi_bdev);
     
114.                 if (!q) {
     
115.                         printk(KERN_ERR
     
116.                                "generic_make_request: Trying to access "
     
117.                                 "nonexistent block-device %s (%Lu)\n",
     
118.                                 bdevname(bio->bi_bdev, b),
     
119.                                 (long long) bio->bi_sector);
     
120. end_io:
     
121.                         bio_endio(bio, err);
     
122.                         break;
     
123.                 }
     
124.                 /* 3,
     
125.                  * overflow controler's capability
     
126.                  */
     
127.                 if (unlikely(nr_sectors > q->max_hw_sectors)) {
     
128.                         printk(KERN_ERR "bio too big device %s (%u > %u)\n",
     
129.                                 bdevname(bio->bi_bdev, b),
     
130.                                 bio_sectors(bio),
     
131.                                 q->max_hw_sectors);
     
132.                         goto end_io;
     
133.                 }
     
134.                 /* 4,
     
135.                  * elevator still healthy
     
136.                  */
     
137.                 if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
     
138.                         goto end_io;
     
139.                 /* 5,
     
140.                  * if just a poke
     
141.                  */
     
142.                 if (should_fail_request(bio))
     
143.                         goto end_io;
     
144. 
     
145.                 /* 6,
     
146.                  * If this device has partitions, remap block n
     
147.                  * of partition p to block n+start(p) of the disk.
     
148.                  */
     
149.                 blk_partition_remap(bio);
     
150. 
     
151.                 if (old_sector != -1)
     
152.                         blk_add_trace_remap(q, bio, old_dev, bio->bi_sector,
     
153.                                             old_sector);
     
154. 
     
155.                 blk_add_trace_bio(q, bio, BLK_TA_QUEUE);
     
156. 
     
157.                 old_sector = bio->bi_sector;
     
158.                 old_dev = bio->bi_bdev->bd_dev;
     
159. 
     
160.                 if (bio_check_eod(bio, nr_sectors))
     
161.                         goto end_io;
     
162.                 /* 7,
     
163.                  * If hard to pose
     
164.                  */
     
165.                 if (bio_empty_barrier(bio) && !q->prepare_flush_fn) {
     
166.                         err = -EOPNOTSUPP;
     
167.                         goto end_io;
     
168.                 }
     
169.                 /* 8,
     
170.                  * do it, but where assigned?
     
171.                  * void blk_queue_make_request(struct request_queue *q,
     
172.                  *                                 make_request_fn *mfn)
     
173.                  * and how about __make_request?
     
174.                  * it is dft method when Q init
     
175.                  */
     
176.                 ret = q->make_request_fn(q, bio);
     
177.         } while (ret);
     
178. }
     
179. 
     
180. static int __make_request(struct request_queue *q, struct bio *bio)
     
181. {
     
182.         struct request *req;
     
183.         int el_ret, nr_sectors, barrier, err;
     
184.         const unsigned short prio = bio_prio(bio);
     
185.         const int sync = bio_sync(bio);
     
186.         int rw_flags;
     
187. 
     
188.         nr_sectors = bio_sectors(bio);
     
189. 
     
190.         /*
     
191.          * low level driver can indicate that it wants pages above a
     
192.          * certain limit bounced to low memory (ie for highmem, or even
     
193.          * ISA dma in theory)
     
194.          */
     
195.         blk_queue_bounce(q, &bio);
     
196. 
     
197.         barrier = bio_barrier(bio);
     
198.        
     
199.         if (unlikely(barrier) && (q->next_ordered == QUEUE_ORDERED_NONE)) {
     
200.                 err = -EOPNOTSUPP;
     
201.                 goto end_io;
     
202.         }
     
203. 
     
204.         spin_lock_irq(q->queue_lock);
     
205.         /* 1,
     
206.          * bar do no merge in principle
     
207.          */
     
208.         if (unlikely(barrier) || elv_queue_empty(q))
     
209.                 goto get_rq;
     
210.         /* 2,
     
211.          * try merge
     
212.          */
     
213.         el_ret = elv_merge(q, &req, bio);
     
214.        
     
215.         switch (el_ret) {
     
216.         case ELEVATOR_BACK_MERGE:
     
217.                 BUG_ON(!rq_mergeable(req));
     
218. 
     
219.                 if (!ll_back_merge_fn(q, req, bio))
     
220.                         break;
     
221. 
     
222.                 blk_add_trace_bio(q, bio, BLK_TA_BACKMERGE);
     
223. 
     
224.                 req->biotail->bi_next = bio;
     
225.                 req->biotail = bio;
     
226.                 req->nr_sectors = req->hard_nr_sectors += nr_sectors;
     
227.                 req->ioprio = ioprio_best(req->ioprio, prio);
     
228.                 drive_stat_acct(req, 0);
     
229.                
     
230.                 if (!attempt_back_merge(q, req))
     
231.                         elv_merged_request(q, req, el_ret);
     
232.                 goto out;
     
233. 
     
234.         case ELEVATOR_FRONT_MERGE:
     
235.                 BUG_ON(!rq_mergeable(req));
     
236. 
     
237.                 if (!ll_front_merge_fn(q, req, bio))
     
238.                         break;
     
239. 
     
240.                 blk_add_trace_bio(q, bio, BLK_TA_FRONTMERGE);
     
241. 
     
242.                 bio->bi_next = req->bio;
     
243.                 req->bio = bio;
     
244. 
     
245.                 /*
     
246.                  * may not be valid. if the low level driver said
     
247.                  * it didn't need a bounce buffer then it better
     
248.                  * not touch req->buffer either...
     
249.                  */
     
250.                 req->buffer = bio_data(bio);
     
251.                 req->current_nr_sectors = bio_cur_sectors(bio);
     
252.                 req->hard_cur_sectors = req->current_nr_sectors;
     
253.                 req->sector = req->hard_sector = bio->bi_sector;
     
254.                 req->nr_sectors = req->hard_nr_sectors += nr_sectors;
     
255.                 req->ioprio = ioprio_best(req->ioprio, prio);
     
256.                 drive_stat_acct(req, 0);
     
257.                 if (!attempt_front_merge(q, req))
     
258.                         elv_merged_request(q, req, el_ret);
     
259.                 goto out;
     
260. 
     
261.         /* ELV_NO_MERGE: elevator says don't/can't merge. */
     
262.         default:
     
263.                 break;
     
264.         }
     
265. 
     
266. get_rq:
     
267.         /*
     
268.          * This sync check and mask will be re-done in init_request_from_bio(),
     
269.          * but we need to set it earlier to expose the sync flag to the
     
270.          * rq allocator and io schedulers.
     
271.          */
     
272.         rw_flags = bio_data_dir(bio);
     
273.         if (sync)
     
274.                 rw_flags |= REQ_RW_SYNC;
     
275. 
     
276.         /* 3,
     
277.          * Grab a free request. This is might sleep but can not fail.
     
278.          * Returns with the queue unlocked.
     
279.          */
     
280.         req = get_request_wait(q, rw_flags, bio);
     
281. 
     
282.         /*
     
283.          * After dropping the lock and possibly sleeping here, our request
     
284.          * may now be mergeable after it had proven unmergeable (above).
     
285.          *
     
286.          * We don't worry about that case for efficiency. It won't happen
     
287.          * often, and the elevators are able to handle it.
     
288.          */
     
289.         init_request_from_bio(req, bio);
     
290. 
     
291.         spin_lock_irq(q->queue_lock);
     
292.        
     
293.         if (elv_queue_empty(q))
     
294.                 blk_plug_device(q);
     
295.         /* 4,
     
296.          * in case of new request, and then wait on queue
     
297.          */
     
298.         add_request(q, req);
     
299. out:
     
300.         if (sync) {
     
301.         /* 5,
     
302.          * if neccessary, drive disk rotating,
     
303.                  * even current gas is above $100
     
304.          */
     
305.                 __generic_unplug_device(q);
     
306.         }
     
307.         spin_unlock_irq(q->queue_lock);
     
308.         return 0;
     
309. end_io:
     
310.         bio_endio(bio, err);
     
311.         return 0;
     
312. }
     

复制代码