mei: normalize me host client linking routines

In order we can use the same code pattern for in-kernel
and user space host clients we replace mei_cl_link_to_me
with mei_cl_link function.
We then hav

mei: normalize me host client linking routines

In order we can use the same code pattern for in-kernel
and user space host clients we replace mei_cl_link_to_me
with mei_cl_link function.
We then have to keep me client lookupout of the new link function.

The unlinking cannot be yet symetric due to amthif connection
handling

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: rename remaining amthi strings to amthif

the only real thing that left was mei_amthi_guid
the rest was in the strings and comments

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed

mei: rename remaining amthi strings to amthif

the only real thing that left was mei_amthi_guid
the rest was in the strings and comments

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: drop read_pending member form struct mei_cl

read_pending never changes, it is a leftover from the old code.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Har

mei: drop read_pending member form struct mei_cl

read_pending never changes, it is a leftover from the old code.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: rename interface to hw-me

Rename hw-me.h to hw-me-regs.h as this file
contains only register definitions.
Files hw-me.[ch] now contains ME hw dependant
functionality

Signed-off-by: Tomas Winkl

mei: rename interface to hw-me

Rename hw-me.h to hw-me-regs.h as this file
contains only register definitions.
Files hw-me.[ch] now contains ME hw dependant
functionality

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: implement mei_cl_connect function

Implement mei_cl_connect that warps host client
parts of the connection and leave the ioctl specifics
in the mei_ioctl_connect_client function.
Move mei_ioctl_

mei: implement mei_cl_connect function

Implement mei_cl_connect that warps host client
parts of the connection and leave the ioctl specifics
in the mei_ioctl_connect_client function.
Move mei_ioctl_connect_client to main.c where it
belongs

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: fix client functions names

Use common prefix for function names:

mei_cl_ - for host clients
mei_me_ - for me clients
mei_io_ - for io callback functions

Because mei_cl holds mei_device bac

mei: fix client functions names

Use common prefix for function names:

mei_cl_ - for host clients
mei_me_ - for me clients
mei_io_ - for io callback functions

Because mei_cl holds mei_device back pointer
we can also drop the dev argument from the client
functions

add client.h header to export the clients API

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: move client functions to client.c

This file now contains me and host client functions
and also io callback helpers
We also kill iorw.c which is no longer needed

Signed-off-by: Tomas Winkler <t

mei: move client functions to client.c

This file now contains me and host client functions
and also io callback helpers
We also kill iorw.c which is no longer needed

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: handle tx queue flushing for vtag connections

Since multiple file pointers (fp) can be associated
with a single host client, upon close() only objects
associated with the fp has

mei: handle tx queue flushing for vtag connections

Since multiple file pointers (fp) can be associated
with a single host client, upon close() only objects
associated with the fp has to flushed from the tx queues.
The control queues should be flushed only when all
the connections are closed and the client is disconnected.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200818115147.2567012-9-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: add a vtag map for each client

Vtag map is a list of tuples of vtag and file pointer (struct
mei_cl_vtag) associated with a particular me host client.

Signed-off-by: Alexan

mei: add a vtag map for each client

Vtag map is a list of tuples of vtag and file pointer (struct
mei_cl_vtag) associated with a particular me host client.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200818115147.2567012-8-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: add a spin lock to protect rd_completed queue

In order to support vtags we need to access read completed
queue out of driver big lock.
Add a spin lock to protect rd_completed qu

mei: add a spin lock to protect rd_completed queue

In order to support vtags we need to access read completed
queue out of driver big lock.
Add a spin lock to protect rd_completed queue.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200818115147.2567012-7-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: add support for mei extended header.

Add an extend header beyond existing 4 bytes of the mei message header.
The extension is of variable length, starting with meta header
that

mei: add support for mei extended header.

Add an extend header beyond existing 4 bytes of the mei message header.
The extension is of variable length, starting with meta header
that contains the number of headers and the overall size of
the extended headers excluding meta header itself followed by
TLV list of extended headers. Currently only supported extension is
the vtag. From the HW perspective the extended headers is already
part of the payload.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://lore.kernel.org/r/20200818115147.2567012-5-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: client: use sizeof of variable instead of struct type

There is a possibility of bug when variable type has changed but
corresponding struct passed to the sizeof has not.

Cc

mei: client: use sizeof of variable instead of struct type

There is a possibility of bug when variable type has changed but
corresponding struct passed to the sizeof has not.

Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200723145927.882743-5-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: release me_cl object reference

Allow me_cl object to be freed by releasing the reference
that was acquired by one of the search functions:
__mei_me_cl_by_uuid_id() or __mei_me_

mei: release me_cl object reference

Allow me_cl object to be freed by releasing the reference
that was acquired by one of the search functions:
__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid()

Cc: <stable@vger.kernel.org>
Reported-by: 亿一 <teroincn@gmail.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: limit number of bytes in mei header.

The MEI message header provides only 9 bits for storing
the message size, limiting to 511.
In theory the host buffer (hbuf) can contain up t

mei: limit number of bytes in mei header.

The MEI message header provides only 9 bits for storing
the message size, limiting to 511.
In theory the host buffer (hbuf) can contain up to 1020 bytes
(limited by byte = 255 * 4)
With the current hardware and hbuf size 512, this is not a real issue,
but as hardening approach we enforce the limit.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200211160522.7562-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: expose device state in sysfs

Expose mei device state to user-space through sysfs.
This gives indication to applications that driver is in transition,
usefully mostly to detect l

mei: expose device state in sysfs

Expose mei device state to user-space through sysfs.
This gives indication to applications that driver is in transition,
usefully mostly to detect link reset state.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: adjust the copyright notice in the files.

Use unified version of the copyright notice in the files
Update copyright years according the year the files
were touched, except this

mei: adjust the copyright notice in the files.

Use unified version of the copyright notice in the files
Update copyright years according the year the files
were touched, except this patch and SPDX conversions.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: convert to SPDX license tags

Replace boiler plate licenses texts with the SPDX license
identifiers in the mei files header.

Signed-off-by: Tomas Winkler <tomas.winkler@inte

mei: convert to SPDX license tags

Replace boiler plate licenses texts with the SPDX license
identifiers in the mei files header.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: free read cb on ctrl_wr list flush

There is a little window during disconnection flow
when read cb is moved between lists and may be not freed.
Remove moving read cbs explicitly

mei: free read cb on ctrl_wr list flush

There is a little window during disconnection flow
when read cb is moved between lists and may be not freed.
Remove moving read cbs explicitly during flash fixes this memory
leak.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: dma ring: implement transmit flow

Implement a circular buffer on allocated system memory. Read and write
indices are stored on the control block which is also shared between the

mei: dma ring: implement transmit flow

Implement a circular buffer on allocated system memory. Read and write
indices are stored on the control block which is also shared between the
device and the host.
Two new functions are exported from the DMA module: mei_dma_ring_write,
and mei_dma_ring_empty_slots. The former simply copy a packet on the TX
DMA circular buffer and later, returns the number of empty slots on the
TX DMA circular buffer.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: dma ring: implement rx circular buffer logic

Implement circular buffer protocol over receive dma
buffer. Add extension to the mei message header that holds
length of the buffer

mei: dma ring: implement rx circular buffer logic

Implement circular buffer protocol over receive dma
buffer. Add extension to the mei message header that holds
length of the buffer on the dma buffer.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: expedite ioctl return on the notify set operation error

The notify set operation ioctl will wait till timeout is expired
even in case when the FW returned an error.
Check the st

mei: expedite ioctl return on the notify set operation error

The notify set operation ioctl will wait till timeout is expired
even in case when the FW returned an error.
Check the status field of the client object in wait_event_timeout()
to determine if the caller can return earlier.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: flush queues by the host client only

During queues flush, the me client in most cases is already
unlinked hence the me client id is unavailable. The host client
structure pointe

mei: flush queues by the host client only

During queues flush, the me client in most cases is already
unlinked hence the me client id is unavailable. The host client
structure pointer is enough for identification.
The function mei_cl_cmp_id() is dropped as it has no more usage.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: fix use-after-free in mei_cl_write

KASAN reports a use-after-free during startup, in mei_cl_write:

BUG: KASAN: use-after-free in mei_cl_write+0x601/0x870 [mei]
(

mei: fix use-after-free in mei_cl_write

KASAN reports a use-after-free during startup, in mei_cl_write:

BUG: KASAN: use-after-free in mei_cl_write+0x601/0x870 [mei]
(drivers/misc/mei/client.c:1770)

This is caused by commit 98e70866aacb ("mei: add support for variable
length mei headers."), which changed the return value from len, to
buf->size. That ends up using a stale buf pointer, because blocking
call, the cb (callback) is deleted in me_cl_complete() function.

However, fortunately, len remains unchanged throughout the function
(and I don't see anything else that would require re-reading buf->size
either), so the fix is to simply revert the change, and return len, as
before.

Fixes: 98e70866aacb ("mei: add support for variable length mei headers.")
CC: Arnd Bergmann <arnd@arndb.de>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: hbm: introduce dma bit in the message header

Add dma_ring bit in the mei message header for conveying
that the message data itself are on the dma ring.

Signed-off-by: Tomas

mei: hbm: introduce dma bit in the message header

Add dma_ring bit in the mei message header for conveying
that the message data itself are on the dma ring.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...

mei: add support for variable length mei headers.

Remove header size knowledge from me and txe hw layers,
this requires to change the write handler to accept
header and its length as

mei: add support for variable length mei headers.

Remove header size knowledge from me and txe hw layers,
this requires to change the write handler to accept
header and its length as well as data and its length.

HBM messages are fixed to use basic header, hence we add mei_hbm2slots()
that converts HBM message length and mei message header,
while mei_data2slots() converts data length directly to the slots.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

show more ...