diff --git a/bio.c b/bio.c
index 36b258e..f847c2e 100644
--- a/bio.c
+++ b/bio.c
@@ -50,6 +50,19 @@ bread(uint dev, uint sector)
   return b;
 }
 
+void
+bwrite(uint dev, struct buf *b, uint sector)
+{
+  void *c;
+  extern struct spinlock ide_lock;
+
+  acquire(&ide_lock);
+  c = ide_start_rw(dev & 0xff, sector, b->data, 1, 0);
+  sleep (c, &ide_lock);
+  ide_finish(c);
+  release(&ide_lock);
+}
+
 void
 brelse(struct buf *b)
 {
diff --git a/defs.h b/defs.h
index 7cf1e08..51c4d34 100644
--- a/defs.h
+++ b/defs.h
@@ -96,7 +96,9 @@ int ide_finish(void *);
 
 // bio.c
 struct buf;
+struct buf *getblk(void);
 struct buf *bread(uint, uint);
+void bwrite(uint, struct buf *, uint);
 void brelse(struct buf *);
 
 // fs.c
diff --git a/ide.c b/ide.c
index bfc3d7c..d6bef6d 100644
--- a/ide.c
+++ b/ide.c
@@ -101,7 +101,10 @@ ide_start_request (void)
     outb(0x1F5, (r->secno >> 16) & 0xFF);
     outb(0x1F6, 0xE0 | ((r->diskno&1)<<4) | ((r->secno>>24)&0x0F));
     if (r->read) outb(0x1F7, 0x20); // read
-    else outb(0x1F7, 0x30); // write
+    else {
+      outb(0x1F7, 0x30); // write
+      outsl(0x1F0, r->addr, 512/4);
+    }
   }
 }
 
@@ -113,7 +116,7 @@ ide_start_rw(int diskno, uint secno, void *addr, uint nsecs, int read)
   if(!holding(&ide_lock))
     panic("ide_start_read: not holding ide_lock");
 
-  if(nsecs > 256)
+  if(nsecs > 1)
     panic("ide_start_read: nsecs too large");
 
   while ((head + 1) % NREQUEST == tail)
@@ -136,7 +139,7 @@ ide_start_rw(int diskno, uint secno, void *addr, uint nsecs, int read)
 int
 ide_finish(void *c)
 {
-  int r = 0;
+  int r;
   struct ide_request *req = (struct ide_request *) c;
 
   if(c != &request[tail])
@@ -144,11 +147,10 @@ ide_finish(void *c)
 
   if(!holding(&ide_lock))
     panic("ide_start_read: not holding ide_lock");
-  for (; req->nsecs > 0; req->nsecs--, req->addr += 512) {
-    if ((r = ide_wait_ready(1)) < 0)
-      break;
-    if (req->read) insl(0x1F0, req->addr, 512/4);
-    else outsl(0x1F0, req->addr, 512/4);
+
+  if (req->read) {
+    if ((r = ide_wait_ready(1)) >= 0)
+      insl(0x1F0, req->addr, 512/4);
   }
 
   if ((head + 1) % NREQUEST == tail) {
diff --git a/syscall.c b/syscall.c
index 77a16cd..29ebee8 100644
--- a/syscall.c
+++ b/syscall.c
@@ -426,6 +426,14 @@ sys_block(void)
     brelse(b);
   }
 
+#if 0
+  cprintf("overwrite fs.img!\n");
+  b = getblk();
+  memset (b->data, 'f', 10);
+  bwrite(1, b, 0);
+  cprintf("write is done\n");
+#endif
+
   ip = iget(1, 1);
   cprintf("iget 1: %d %d %d %d %d %d %d %d\n",
           ip->dev, ip->inum, ip->count, ip->busy,