cfq-iosched: properly protect ioc_gone and ioc count

[linux-2.6-omap-h63xx.git] / block / cfq-iosched.c

diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index b399c62936e01a503715273ffef29ac2fafef8a4..32aa3674f8a3d9423e3da00acf088470ce017fd7 100644 (file)
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -48,6 +48,7 @@ static struct kmem_cache *cfq_ioc_pool;
 
 static DEFINE_PER_CPU(unsigned long, ioc_count);
 static struct completion *ioc_gone;
+static DEFINE_SPINLOCK(ioc_gone_lock);
 
 #define CFQ_PRIO_LISTS         IOPRIO_BE_NR
 #define cfq_class_idle(cfqq)   ((cfqq)->ioprio_class == IOPRIO_CLASS_IDLE)
@@ -124,6 +125,8 @@ struct cfq_data {
 struct cfq_queue {
        /* reference count */
        atomic_t ref;
+       /* various state flags, see below */
+       unsigned int flags;
        /* parent cfq_data */
        struct cfq_data *cfqd;
        /* service_tree member */
@@ -138,14 +141,14 @@ struct cfq_queue {
        int queued[2];
        /* currently allocated requests */
        int allocated[2];
-       /* pending metadata requests */
-       int meta_pending;
        /* fifo list of requests in sort_list */
        struct list_head fifo;
 
        unsigned long slice_end;
        long slice_resid;
 
+       /* pending metadata requests */
+       int meta_pending;
        /* number of requests that are on the dispatch list or inside driver */
        int dispatched;
 
@@ -153,8 +156,6 @@ struct cfq_queue {
        unsigned short ioprio, org_ioprio;
        unsigned short ioprio_class, org_ioprio_class;
 
-       /* various state flags, see below */
-       unsigned int flags;
 };
 
 enum cfqq_state_flags {
@@ -1142,6 +1143,9 @@ static void cfq_put_queue(struct cfq_queue *cfqq)
        kmem_cache_free(cfq_pool, cfqq);
 }
 
+/*
+ * Must always be called with the rcu_read_lock() held
+ */
 static void
 __call_for_each_cic(struct io_context *ioc,
                    void (*func)(struct io_context *, struct cfq_io_context *))
@@ -1174,8 +1178,19 @@ static void cfq_cic_free_rcu(struct rcu_head *head)
        kmem_cache_free(cfq_ioc_pool, cic);
        elv_ioc_count_dec(ioc_count);
 
-       if (ioc_gone && !elv_ioc_count_read(ioc_count))
-               complete(ioc_gone);
+       if (ioc_gone) {
+               /*
+                * CFQ scheduler is exiting, grab exit lock and check
+                * the pending io context count. If it hits zero,
+                * complete ioc_gone and set it back to NULL
+                */
+               spin_lock(&ioc_gone_lock);
+               if (ioc_gone && !elv_ioc_count_read(ioc_count)) {
+                       complete(ioc_gone);
+                       ioc_gone = NULL;
+               }
+               spin_unlock(&ioc_gone_lock);
+       }
 }
 
 static void cfq_cic_free(struct cfq_io_context *cic)
@@ -1197,6 +1212,11 @@ static void cic_free_func(struct io_context *ioc, struct cfq_io_context *cic)
        cfq_cic_free(cic);
 }
 
+/*
+ * Must be called with rcu_read_lock() held or preemption otherwise disabled.
+ * Only two callers of this - ->dtor() which is called with the rcu_read_lock(),
+ * and ->trim() which is called with the task lock held
+ */
 static void cfq_free_io_context(struct io_context *ioc)
 {
        /*
@@ -1502,20 +1522,24 @@ static struct cfq_io_context *
 cfq_cic_lookup(struct cfq_data *cfqd, struct io_context *ioc)
 {
        struct cfq_io_context *cic;
+       unsigned long flags;
        void *k;
 
        if (unlikely(!ioc))
                return NULL;
 
+       rcu_read_lock();
+
        /*
         * we maintain a last-hit cache, to avoid browsing over the tree
         */
        cic = rcu_dereference(ioc->ioc_data);
-       if (cic && cic->key == cfqd)
+       if (cic && cic->key == cfqd) {
+               rcu_read_unlock();
                return cic;
+       }
 
        do {
-               rcu_read_lock();
                cic = radix_tree_lookup(&ioc->radix_root, (unsigned long) cfqd);
                rcu_read_unlock();
                if (!cic)
@@ -1524,10 +1548,13 @@ cfq_cic_lookup(struct cfq_data *cfqd, struct io_context *ioc)
                k = cic->key;
                if (unlikely(!k)) {
                        cfq_drop_dead_cic(cfqd, ioc, cic);
+                       rcu_read_lock();
                        continue;
                }
 
+               spin_lock_irqsave(&ioc->lock, flags);
                rcu_assign_pointer(ioc->ioc_data, cic);
+               spin_unlock_irqrestore(&ioc->lock, flags);
                break;
        } while (1);
 
@@ -2134,6 +2161,10 @@ static void *cfq_init_queue(struct request_queue *q)
 
 static void cfq_slab_kill(void)
 {
+       /*
+        * Caller already ensured that pending RCU callbacks are completed,
+        * so we should have no busy allocations at this point.
+        */
        if (cfq_pool)
                kmem_cache_destroy(cfq_pool);
        if (cfq_ioc_pool)
@@ -2292,8 +2323,13 @@ static void __exit cfq_exit(void)
        ioc_gone = &all_gone;
        /* ioc_gone's update must be visible before reading ioc_count */
        smp_wmb();
+
+       /*
+        * this also protects us from entering cfq_slab_kill() with
+        * pending RCU callbacks
+        */
        if (elv_ioc_count_read(ioc_count))
-               wait_for_completion(ioc_gone);
+               wait_for_completion(&all_gone);
        cfq_slab_kill();
 }