On 2021/3/19 13:53, Viresh Kumar wrote:
On 16-03-21, 18:35, Jie Deng wrote:+++ b/drivers/i2c/busses/i2c-virtio.c +static int virtio_i2c_send_reqs(struct virtqueue *vq, + struct virtio_i2c_req *reqs, + struct i2c_msg *msgs, int nr) +{ + struct scatterlist *sgs[3], out_hdr, msg_buf, in_hdr; + int i, outcnt, incnt, err = 0; + + for (i = 0; i < nr; i++) { + if (!msgs[i].len) + break; + + /* + * Only 7-bit mode supported for this moment. For the address format, + * Please check the Virtio I2C Specification. + */ + reqs[i].out_hdr.addr = cpu_to_le16(msgs[i].addr << 1); + + if (i != nr - 1) + reqs[i].out_hdr.flags = cpu_to_le32(VIRTIO_I2C_FLAGS_FAIL_NEXT); + + outcnt = incnt = 0; + sg_init_one(&out_hdr, &reqs[i].out_hdr, sizeof(reqs[i].out_hdr)); + sgs[outcnt++] = &out_hdr; + + reqs[i].buf = i2c_get_dma_safe_msg_buf(&msgs[i], 1);You allocate a buffer here, lets see if they are freeing properly or not (I remember that I gave same feedback earlier as well, but anyway).
"MAY" allocate a buffer here.
+ if (!reqs[i].buf) + break; + + sg_init_one(&msg_buf, reqs[i].buf, msgs[i].len); + + if (msgs[i].flags & I2C_M_RD) + sgs[outcnt + incnt++] = &msg_buf; + else + sgs[outcnt++] = &msg_buf; + + sg_init_one(&in_hdr, &reqs[i].in_hdr, sizeof(reqs[i].in_hdr)); + sgs[outcnt + incnt++] = &in_hdr; + + err = virtqueue_add_sgs(vq, sgs, outcnt, incnt, &reqs[i], GFP_KERNEL); + if (err < 0) { + pr_err("failed to add msg[%d] to virtqueue.\n", i); + i2c_put_dma_safe_msg_buf(reqs[i].buf, &msgs[i], false);On failure here, you freed the buffers for request "i" but not others..
Others still need to be sent and then be freed.
+ break; + } + } + + return i; +} + +static int virtio_i2c_complete_reqs(struct virtqueue *vq, + struct virtio_i2c_req *reqs, + struct i2c_msg *msgs, int nr) +{ + struct virtio_i2c_req *req; + unsigned int len; + int i, j; + + for (i = 0; i < nr; i++) { + req = virtqueue_get_buf(vq, &len); + if (!(req && req == &reqs[i])) { + pr_err("msg[%d]: addr=0x%x is out of order.\n", i, msgs[i].addr); + break;Since you break here, what will happen to the buffer ? I thought virtqueue_get_buf() will return a req only once and then you can't access it ?
Will refine it along with the latter loop.
+ } + + if (req->in_hdr.status != VIRTIO_I2C_MSG_OK) { + pr_err("msg[%d]: addr=0x%x backend error.\n", i, msgs[i].addr); + break; + } + + i2c_put_dma_safe_msg_buf(req->buf, &msgs[i], true); + } + + /* + * Detach all the used buffers from the vq and + * Release unused DMA safe buffer if any. + */ + for (j = i; j < nr; j++) { + req = virtqueue_get_buf(vq, &len); + if (req) + i2c_put_dma_safe_msg_buf(req->buf, &msgs[j], false);This will come in play only if something failed in the earlier loop ? Or my understanding incorrect ? Also this should be merged with the above for loop itself, it is just doing part of it.
Will refine it along with the earlier loop.
+ } + + return i; +} + +static int virtio_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) +{ + struct virtio_i2c *vi = i2c_get_adapdata(adap); + struct virtqueue *vq = vi->vq; + struct virtio_i2c_req *reqs; + unsigned long time_left; + int ret, nr; + + reqs = kcalloc(num, sizeof(*reqs), GFP_KERNEL); + if (!reqs) + return -ENOMEM; + + mutex_lock(&vi->lock); + + ret = virtio_i2c_send_reqs(vq, reqs, msgs, num); + if (ret == 0) + goto err_unlock_free; + + nr = ret; + reinit_completion(&vi->completion); + virtqueue_kick(vq); + + time_left = wait_for_completion_timeout(&vi->completion, adap->timeout); + if (!time_left) {On error here, we will surely not free the buffers, isn't it ?
Right. Will fix it. Thank you.
+ dev_err(&adap->dev, "virtio i2c backend timeout.\n"); + ret = -ETIMEDOUT; + goto err_unlock_free; + } + + ret = virtio_i2c_complete_reqs(vq, reqs, msgs, nr); + +err_unlock_free: + mutex_unlock(&vi->lock); + kfree(reqs); + return ret; +}
