drivers/misc/mei/main.c

   1 /*
   2  *
   3  * Intel Management Engine Interface (Intel MEI) Linux driver
   4  * Copyright (c) 2003-2012, Intel Corporation.
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms and conditions of the GNU General Public License,
   8  * version 2, as published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope it will be useful, but WITHOUT
  11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  13  * more details.
  14  *
  15  */
  16
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18
  19 #include <linux/module.h>
  20 #include <linux/moduleparam.h>
  21 #include <linux/kernel.h>
  22 #include <linux/device.h>
  23 #include <linux/fs.h>
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/fcntl.h>
  27 #include <linux/aio.h>
  28 #include <linux/pci.h>
  29 #include <linux/poll.h>
  30 #include <linux/init.h>
  31 #include <linux/ioctl.h>
  32 #include <linux/cdev.h>
  33 #include <linux/sched.h>
  34 #include <linux/uuid.h>
  35 #include <linux/compat.h>
  36 #include <linux/jiffies.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/miscdevice.h>
  39
  40 #include <linux/mei.h>
  41
  42 #include "mei_dev.h"
  43 #include "hw-me.h"
  44 #include "client.h"
  45
  46 /* AMT device is a singleton on the platform */
  47 static struct pci_dev *mei_pdev;
  48
  49 /* mei_pci_tbl - PCI Device ID Table */
  50 static DEFINE_PCI_DEVICE_TABLE(mei_pci_tbl) = {
  51         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82946GZ)},
  52         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G35)},
  53         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82Q965)},
  54         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G965)},
  55         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GM965)},
  56         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GME965)},
  57         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q35)},
  58         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82G33)},
  59         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q33)},
  60         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82X38)},
  61         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_3200)},
  62         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_6)},
  63         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_7)},
  64         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_8)},
  65         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_9)},
  66         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_10)},
  67         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_1)},
  68         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_2)},
  69         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_3)},
  70         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_4)},
  71         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_1)},
  72         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_2)},
  73         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_3)},
  74         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_4)},
  75         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_1)},
  76         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_2)},
  77         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_CPT_1)},
  78         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PBG_1)},
  79         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
  80         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
  81         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
  82         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT)},
  83         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_LP)},
  84
  85         /* required last entry */
  86         {0, }
  87 };
  88
  89 MODULE_DEVICE_TABLE(pci, mei_pci_tbl);
  90
  91 static DEFINE_MUTEX(mei_mutex);
  92
  93
  94 /**
  95  * mei_open - the open function
  96  *
  97  * @inode: pointer to inode structure
  98  * @file: pointer to file structure
  99  *
 100  * returns 0 on success, <0 on error
 101  */
 102 static int mei_open(struct inode *inode, struct file *file)
 103 {
 104         struct mei_cl *cl;
 105         struct mei_device *dev;
 106         unsigned long cl_id;
 107         int err;
 108
 109         err = -ENODEV;
 110         if (!mei_pdev)
 111                 goto out;
 112
 113         dev = pci_get_drvdata(mei_pdev);
 114         if (!dev)
 115                 goto out;
 116
 117         mutex_lock(&dev->device_lock);
 118         err = -ENOMEM;
 119         cl = mei_cl_allocate(dev);
 120         if (!cl)
 121                 goto out_unlock;
 122
 123         err = -ENODEV;
 124         if (dev->dev_state != MEI_DEV_ENABLED) {
 125                 dev_dbg(&dev->pdev->dev, "dev_state != MEI_ENABLED  dev_state = %s\n",
 126                     mei_dev_state_str(dev->dev_state));
 127                 goto out_unlock;
 128         }
 129         err = -EMFILE;
 130         if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
 131                 dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
 132                         MEI_MAX_OPEN_HANDLE_COUNT);
 133                 goto out_unlock;
 134         }
 135
 136         cl_id = find_first_zero_bit(dev->host_clients_map, MEI_CLIENTS_MAX);
 137         if (cl_id >= MEI_CLIENTS_MAX) {
 138                 dev_err(&dev->pdev->dev, "client_id exceded %d",
 139                                 MEI_CLIENTS_MAX) ;
 140                 goto out_unlock;
 141         }
 142
 143         cl->host_client_id  = cl_id;
 144
 145         dev_dbg(&dev->pdev->dev, "client_id = %d\n", cl->host_client_id);
 146
 147         dev->open_handle_count++;
 148
 149         list_add_tail(&cl->link, &dev->file_list);
 150
 151         set_bit(cl->host_client_id, dev->host_clients_map);
 152         cl->state = MEI_FILE_INITIALIZING;
 153         cl->sm_state = 0;
 154
 155         file->private_data = cl;
 156         mutex_unlock(&dev->device_lock);
 157
 158         return nonseekable_open(inode, file);
 159
 160 out_unlock:
 161         mutex_unlock(&dev->device_lock);
 162         kfree(cl);
 163 out:
 164         return err;
 165 }
 166
 167 /**
 168  * mei_release - the release function
 169  *
 170  * @inode: pointer to inode structure
 171  * @file: pointer to file structure
 172  *
 173  * returns 0 on success, <0 on error
 174  */
 175 static int mei_release(struct inode *inode, struct file *file)
 176 {
 177         struct mei_cl *cl = file->private_data;
 178         struct mei_cl_cb *cb;
 179         struct mei_device *dev;
 180         int rets = 0;
 181
 182         if (WARN_ON(!cl || !cl->dev))
 183                 return -ENODEV;
 184
 185         dev = cl->dev;
 186
 187         mutex_lock(&dev->device_lock);
 188         if (cl == &dev->iamthif_cl) {
 189                 rets = mei_amthif_release(dev, file);
 190                 goto out;
 191         }
 192         if (cl->state == MEI_FILE_CONNECTED) {
 193                 cl->state = MEI_FILE_DISCONNECTING;
 194                 dev_dbg(&dev->pdev->dev,
 195                         "disconnecting client host client = %d, "
 196                     "ME client = %d\n",
 197                     cl->host_client_id,
 198                     cl->me_client_id);
 199                 rets = mei_cl_disconnect(cl);
 200         }
 201         mei_cl_flush_queues(cl);
 202         dev_dbg(&dev->pdev->dev, "remove client host client = %d, ME client = %d\n",
 203             cl->host_client_id,
 204             cl->me_client_id);
 205
 206         if (dev->open_handle_count > 0) {
 207                 clear_bit(cl->host_client_id, dev->host_clients_map);
 208                 dev->open_handle_count--;
 209         }
 210         mei_cl_unlink(cl);
 211
 212         /* free read cb */
 213         cb = NULL;
 214         if (cl->read_cb) {
 215                 cb = mei_cl_find_read_cb(cl);
 216                 /* Remove entry from read list */
 217                 if (cb)
 218                         list_del(&cb->list);
 219
 220                 cb = cl->read_cb;
 221                 cl->read_cb = NULL;
 222         }
 223
 224         file->private_data = NULL;
 225
 226         if (cb) {
 227                 mei_io_cb_free(cb);
 228                 cb = NULL;
 229         }
 230
 231         kfree(cl);
 232 out:
 233         mutex_unlock(&dev->device_lock);
 234         return rets;
 235 }
 236
 237
 238 /**
 239  * mei_read - the read function.
 240  *
 241  * @file: pointer to file structure
 242  * @ubuf: pointer to user buffer
 243  * @length: buffer length
 244  * @offset: data offset in buffer
 245  *
 246  * returns >=0 data length on success , <0 on error
 247  */
 248 static ssize_t mei_read(struct file *file, char __user *ubuf,
 249                         size_t length, loff_t *offset)
 250 {
 251         struct mei_cl *cl = file->private_data;
 252         struct mei_cl_cb *cb_pos = NULL;
 253         struct mei_cl_cb *cb = NULL;
 254         struct mei_device *dev;
 255         int i;
 256         int rets;
 257         int err;
 258
 259
 260         if (WARN_ON(!cl || !cl->dev))
 261                 return -ENODEV;
 262
 263         dev = cl->dev;
 264
 265         mutex_lock(&dev->device_lock);
 266         if (dev->dev_state != MEI_DEV_ENABLED) {
 267                 rets = -ENODEV;
 268                 goto out;
 269         }
 270
 271         if ((cl->sm_state & MEI_WD_STATE_INDEPENDENCE_MSG_SENT) == 0) {
 272                 /* Do not allow to read watchdog client */
 273                 i = mei_me_cl_by_uuid(dev, &mei_wd_guid);
 274                 if (i >= 0) {
 275                         struct mei_me_client *me_client = &dev->me_clients[i];
 276                         if (cl->me_client_id == me_client->client_id) {
 277                                 rets = -EBADF;
 278                                 goto out;
 279                         }
 280                 }
 281         } else {
 282                 cl->sm_state &= ~MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
 283         }
 284
 285         if (cl == &dev->iamthif_cl) {
 286                 rets = mei_amthif_read(dev, file, ubuf, length, offset);
 287                 goto out;
 288         }
 289
 290         if (cl->read_cb && cl->read_cb->buf_idx > *offset) {
 291                 cb = cl->read_cb;
 292                 goto copy_buffer;
 293         } else if (cl->read_cb && cl->read_cb->buf_idx > 0 &&
 294                    cl->read_cb->buf_idx <= *offset) {
 295                 cb = cl->read_cb;
 296                 rets = 0;
 297                 goto free;
 298         } else if ((!cl->read_cb || !cl->read_cb->buf_idx) && *offset > 0) {
 299                 /*Offset needs to be cleaned for contiguous reads*/
 300                 *offset = 0;
 301                 rets = 0;
 302                 goto out;
 303         }
 304
 305         err = mei_cl_read_start(cl);
 306         if (err && err != -EBUSY) {
 307                 dev_dbg(&dev->pdev->dev,
 308                         "mei start read failure with status = %d\n", err);
 309                 rets = err;
 310                 goto out;
 311         }
 312
 313         if (MEI_READ_COMPLETE != cl->reading_state &&
 314                         !waitqueue_active(&cl->rx_wait)) {
 315                 if (file->f_flags & O_NONBLOCK) {
 316                         rets = -EAGAIN;
 317                         goto out;
 318                 }
 319
 320                 mutex_unlock(&dev->device_lock);
 321
 322                 if (wait_event_interruptible(cl->rx_wait,
 323                         (MEI_READ_COMPLETE == cl->reading_state ||
 324                          MEI_FILE_INITIALIZING == cl->state ||
 325                          MEI_FILE_DISCONNECTED == cl->state ||
 326                          MEI_FILE_DISCONNECTING == cl->state))) {
 327                         if (signal_pending(current))
 328                                 return -EINTR;
 329                         return -ERESTARTSYS;
 330                 }
 331
 332                 mutex_lock(&dev->device_lock);
 333                 if (MEI_FILE_INITIALIZING == cl->state ||
 334                     MEI_FILE_DISCONNECTED == cl->state ||
 335                     MEI_FILE_DISCONNECTING == cl->state) {
 336                         rets = -EBUSY;
 337                         goto out;
 338                 }
 339         }
 340
 341         cb = cl->read_cb;
 342
 343         if (!cb) {
 344                 rets = -ENODEV;
 345                 goto out;
 346         }
 347         if (cl->reading_state != MEI_READ_COMPLETE) {
 348                 rets = 0;
 349                 goto out;
 350         }
 351         /* now copy the data to user space */
 352 copy_buffer:
 353         dev_dbg(&dev->pdev->dev, "cb->response_buffer size - %d\n",
 354             cb->response_buffer.size);
 355         dev_dbg(&dev->pdev->dev, "cb->buf_idx - %lu\n", cb->buf_idx);
 356         if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
 357                 rets = -EMSGSIZE;
 358                 goto free;
 359         }
 360
 361         /* length is being truncated to PAGE_SIZE,
 362          * however buf_idx may point beyond that */
 363         length = min_t(size_t, length, cb->buf_idx - *offset);
 364
 365         if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
 366                 rets = -EFAULT;
 367                 goto free;
 368         }
 369
 370         rets = length;
 371         *offset += length;
 372         if ((unsigned long)*offset < cb->buf_idx)
 373                 goto out;
 374
 375 free:
 376         cb_pos = mei_cl_find_read_cb(cl);
 377         /* Remove entry from read list */
 378         if (cb_pos)
 379                 list_del(&cb_pos->list);
 380         mei_io_cb_free(cb);
 381         cl->reading_state = MEI_IDLE;
 382         cl->read_cb = NULL;
 383         cl->read_pending = 0;
 384 out:
 385         dev_dbg(&dev->pdev->dev, "end mei read rets= %d\n", rets);
 386         mutex_unlock(&dev->device_lock);
 387         return rets;
 388 }
 389 /**
 390  * mei_write - the write function.
 391  *
 392  * @file: pointer to file structure
 393  * @ubuf: pointer to user buffer
 394  * @length: buffer length
 395  * @offset: data offset in buffer
 396  *
 397  * returns >=0 data length on success , <0 on error
 398  */
 399 static ssize_t mei_write(struct file *file, const char __user *ubuf,
 400                          size_t length, loff_t *offset)
 401 {
 402         struct mei_cl *cl = file->private_data;
 403         struct mei_cl_cb *write_cb = NULL;
 404         struct mei_msg_hdr mei_hdr;
 405         struct mei_device *dev;
 406         unsigned long timeout = 0;
 407         int rets;
 408         int i;
 409
 410         if (WARN_ON(!cl || !cl->dev))
 411                 return -ENODEV;
 412
 413         dev = cl->dev;
 414
 415         mutex_lock(&dev->device_lock);
 416
 417         if (dev->dev_state != MEI_DEV_ENABLED) {
 418                 rets = -ENODEV;
 419                 goto err;
 420         }
 421
 422         i = mei_me_cl_by_id(dev, cl->me_client_id);
 423         if (i < 0) {
 424                 rets = -ENODEV;
 425                 goto err;
 426         }
 427         if (length > dev->me_clients[i].props.max_msg_length || length <= 0) {
 428                 rets = -EMSGSIZE;
 429                 goto err;
 430         }
 431
 432         if (cl->state != MEI_FILE_CONNECTED) {
 433                 rets = -ENODEV;
 434                 dev_err(&dev->pdev->dev, "host client = %d,  is not connected to ME client = %d",
 435                         cl->host_client_id, cl->me_client_id);
 436                 goto err;
 437         }
 438         if (cl == &dev->iamthif_cl) {
 439                 write_cb = mei_amthif_find_read_list_entry(dev, file);
 440
 441                 if (write_cb) {
 442                         timeout = write_cb->read_time +
 443                                 mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
 444
 445                         if (time_after(jiffies, timeout) ||
 446                             cl->reading_state == MEI_READ_COMPLETE) {
 447                                 *offset = 0;
 448                                 list_del(&write_cb->list);
 449                                 mei_io_cb_free(write_cb);
 450                                 write_cb = NULL;
 451                         }
 452                 }
 453         }
 454
 455         /* free entry used in read */
 456         if (cl->reading_state == MEI_READ_COMPLETE) {
 457                 *offset = 0;
 458                 write_cb = mei_cl_find_read_cb(cl);
 459                 if (write_cb) {
 460                         list_del(&write_cb->list);
 461                         mei_io_cb_free(write_cb);
 462                         write_cb = NULL;
 463                         cl->reading_state = MEI_IDLE;
 464                         cl->read_cb = NULL;
 465                         cl->read_pending = 0;
 466                 }
 467         } else if (cl->reading_state == MEI_IDLE && !cl->read_pending)
 468                 *offset = 0;
 469
 470
 471         write_cb = mei_io_cb_init(cl, file);
 472         if (!write_cb) {
 473                 dev_err(&dev->pdev->dev, "write cb allocation failed\n");
 474                 rets = -ENOMEM;
 475                 goto err;
 476         }
 477         rets = mei_io_cb_alloc_req_buf(write_cb, length);
 478         if (rets)
 479                 goto err;
 480
 481         dev_dbg(&dev->pdev->dev, "cb request size = %zd\n", length);
 482
 483         rets = copy_from_user(write_cb->request_buffer.data, ubuf, length);
 484         if (rets)
 485                 goto err;
 486
 487         cl->sm_state = 0;
 488         if (length == 4 &&
 489             ((memcmp(mei_wd_state_independence_msg[0],
 490                                  write_cb->request_buffer.data, 4) == 0) ||
 491              (memcmp(mei_wd_state_independence_msg[1],
 492                                  write_cb->request_buffer.data, 4) == 0) ||
 493              (memcmp(mei_wd_state_independence_msg[2],
 494                                  write_cb->request_buffer.data, 4) == 0)))
 495                 cl->sm_state |= MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
 496
 497         if (cl == &dev->iamthif_cl) {
 498                 rets = mei_amthif_write(dev, write_cb);
 499
 500                 if (rets) {
 501                         dev_err(&dev->pdev->dev,
 502                                 "amthi write failed with status = %d\n", rets);
 503                         goto err;
 504                 }
 505                 mutex_unlock(&dev->device_lock);
 506                 return length;
 507         }
 508
 509         write_cb->fop_type = MEI_FOP_WRITE;
 510
 511         dev_dbg(&dev->pdev->dev, "host client = %d, ME client = %d\n",
 512             cl->host_client_id, cl->me_client_id);
 513         rets = mei_cl_flow_ctrl_creds(cl);
 514         if (rets < 0)
 515                 goto err;
 516
 517         if (rets == 0 || dev->mei_host_buffer_is_empty == false) {
 518                 write_cb->buf_idx = 0;
 519                 mei_hdr.msg_complete = 0;
 520                 cl->writing_state = MEI_WRITING;
 521                 goto out;
 522         }
 523
 524         dev->mei_host_buffer_is_empty = false;
 525         if (length >  mei_hbuf_max_data(dev)) {
 526                 mei_hdr.length = mei_hbuf_max_data(dev);
 527                 mei_hdr.msg_complete = 0;
 528         } else {
 529                 mei_hdr.length = length;
 530                 mei_hdr.msg_complete = 1;
 531         }
 532         mei_hdr.host_addr = cl->host_client_id;
 533         mei_hdr.me_addr = cl->me_client_id;
 534         mei_hdr.reserved = 0;
 535
 536         dev_dbg(&dev->pdev->dev, "write " MEI_HDR_FMT "\n",
 537                 MEI_HDR_PRM(&mei_hdr));
 538         if (mei_write_message(dev, &mei_hdr, write_cb->request_buffer.data)) {
 539                 rets = -ENODEV;
 540                 goto err;
 541         }
 542         cl->writing_state = MEI_WRITING;
 543         write_cb->buf_idx = mei_hdr.length;
 544
 545 out:
 546         if (mei_hdr.msg_complete) {
 547                 if (mei_cl_flow_ctrl_reduce(cl)) {
 548                         rets = -ENODEV;
 549                         goto err;
 550                 }
 551                 list_add_tail(&write_cb->list, &dev->write_waiting_list.list);
 552         } else {
 553                 list_add_tail(&write_cb->list, &dev->write_list.list);
 554         }
 555
 556         mutex_unlock(&dev->device_lock);
 557         return length;
 558
 559 err:
 560         mutex_unlock(&dev->device_lock);
 561         mei_io_cb_free(write_cb);
 562         return rets;
 563 }
 564
 565 /**
 566  * mei_ioctl_connect_client - the connect to fw client IOCTL function
 567  *
 568  * @dev: the device structure
 569  * @data: IOCTL connect data, input and output parameters
 570  * @file: private data of the file object
 571  *
 572  * Locking: called under "dev->device_lock" lock
 573  *
 574  * returns 0 on success, <0 on failure.
 575  */
 576 static int mei_ioctl_connect_client(struct file *file,
 577                         struct mei_connect_client_data *data)
 578 {
 579         struct mei_device *dev;
 580         struct mei_client *client;
 581         struct mei_cl *cl;
 582         int i;
 583         int rets;
 584
 585         cl = file->private_data;
 586         if (WARN_ON(!cl || !cl->dev))
 587                 return -ENODEV;
 588
 589         dev = cl->dev;
 590
 591         if (dev->dev_state != MEI_DEV_ENABLED) {
 592                 rets = -ENODEV;
 593                 goto end;
 594         }
 595
 596         if (cl->state != MEI_FILE_INITIALIZING &&
 597             cl->state != MEI_FILE_DISCONNECTED) {
 598                 rets = -EBUSY;
 599                 goto end;
 600         }
 601
 602         /* find ME client we're trying to connect to */
 603         i = mei_me_cl_by_uuid(dev, &data->in_client_uuid);
 604         if (i >= 0 && !dev->me_clients[i].props.fixed_address) {
 605                 cl->me_client_id = dev->me_clients[i].client_id;
 606                 cl->state = MEI_FILE_CONNECTING;
 607         }
 608
 609         dev_dbg(&dev->pdev->dev, "Connect to FW Client ID = %d\n",
 610                         cl->me_client_id);
 611         dev_dbg(&dev->pdev->dev, "FW Client - Protocol Version = %d\n",
 612                         dev->me_clients[i].props.protocol_version);
 613         dev_dbg(&dev->pdev->dev, "FW Client - Max Msg Len = %d\n",
 614                         dev->me_clients[i].props.max_msg_length);
 615
 616         /* if we're connecting to amthi client then we will use the
 617          * existing connection
 618          */
 619         if (uuid_le_cmp(data->in_client_uuid, mei_amthi_guid) == 0) {
 620                 dev_dbg(&dev->pdev->dev, "FW Client is amthi\n");
 621                 if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) {
 622                         rets = -ENODEV;
 623                         goto end;
 624                 }
 625                 clear_bit(cl->host_client_id, dev->host_clients_map);
 626                 mei_cl_unlink(cl);
 627
 628                 kfree(cl);
 629                 cl = NULL;
 630                 file->private_data = &dev->iamthif_cl;
 631
 632                 client = &data->out_client_properties;
 633                 client->max_msg_length =
 634                         dev->me_clients[i].props.max_msg_length;
 635                 client->protocol_version =
 636                         dev->me_clients[i].props.protocol_version;
 637                 rets = dev->iamthif_cl.status;
 638
 639                 goto end;
 640         }
 641
 642         if (cl->state != MEI_FILE_CONNECTING) {
 643                 rets = -ENODEV;
 644                 goto end;
 645         }
 646
 647
 648         /* prepare the output buffer */
 649         client = &data->out_client_properties;
 650         client->max_msg_length = dev->me_clients[i].props.max_msg_length;
 651         client->protocol_version = dev->me_clients[i].props.protocol_version;
 652         dev_dbg(&dev->pdev->dev, "Can connect?\n");
 653
 654
 655         rets = mei_cl_connect(cl, file);
 656
 657 end:
 658         dev_dbg(&dev->pdev->dev, "free connect cb memory.");
 659         return rets;
 660 }
 661
 662
 663 /**
 664  * mei_ioctl - the IOCTL function
 665  *
 666  * @file: pointer to file structure
 667  * @cmd: ioctl command
 668  * @data: pointer to mei message structure
 669  *
 670  * returns 0 on success , <0 on error
 671  */
 672 static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
 673 {
 674         struct mei_device *dev;
 675         struct mei_cl *cl = file->private_data;
 676         struct mei_connect_client_data *connect_data = NULL;
 677         int rets;
 678
 679         if (cmd != IOCTL_MEI_CONNECT_CLIENT)
 680                 return -EINVAL;
 681
 682         if (WARN_ON(!cl || !cl->dev))
 683                 return -ENODEV;
 684
 685         dev = cl->dev;
 686
 687         dev_dbg(&dev->pdev->dev, "IOCTL cmd = 0x%x", cmd);
 688
 689         mutex_lock(&dev->device_lock);
 690         if (dev->dev_state != MEI_DEV_ENABLED) {
 691                 rets = -ENODEV;
 692                 goto out;
 693         }
 694
 695         dev_dbg(&dev->pdev->dev, ": IOCTL_MEI_CONNECT_CLIENT.\n");
 696
 697         connect_data = kzalloc(sizeof(struct mei_connect_client_data),
 698                                                         GFP_KERNEL);
 699         if (!connect_data) {
 700                 rets = -ENOMEM;
 701                 goto out;
 702         }
 703         dev_dbg(&dev->pdev->dev, "copy connect data from user\n");
 704         if (copy_from_user(connect_data, (char __user *)data,
 705                                 sizeof(struct mei_connect_client_data))) {
 706                 dev_dbg(&dev->pdev->dev, "failed to copy data from userland\n");
 707                 rets = -EFAULT;
 708                 goto out;
 709         }
 710
 711         rets = mei_ioctl_connect_client(file, connect_data);
 712
 713         /* if all is ok, copying the data back to user. */
 714         if (rets)
 715                 goto out;
 716
 717         dev_dbg(&dev->pdev->dev, "copy connect data to user\n");
 718         if (copy_to_user((char __user *)data, connect_data,
 719                                 sizeof(struct mei_connect_client_data))) {
 720                 dev_dbg(&dev->pdev->dev, "failed to copy data to userland\n");
 721                 rets = -EFAULT;
 722                 goto out;
 723         }
 724
 725 out:
 726         kfree(connect_data);
 727         mutex_unlock(&dev->device_lock);
 728         return rets;
 729 }
 730
 731 /**
 732  * mei_compat_ioctl - the compat IOCTL function
 733  *
 734  * @file: pointer to file structure
 735  * @cmd: ioctl command
 736  * @data: pointer to mei message structure
 737  *
 738  * returns 0 on success , <0 on error
 739  */
 740 #ifdef CONFIG_COMPAT
 741 static long mei_compat_ioctl(struct file *file,
 742                         unsigned int cmd, unsigned long data)
 743 {
 744         return mei_ioctl(file, cmd, (unsigned long)compat_ptr(data));
 745 }
 746 #endif
 747
 748
 749 /**
 750  * mei_poll - the poll function
 751  *
 752  * @file: pointer to file structure
 753  * @wait: pointer to poll_table structure
 754  *
 755  * returns poll mask
 756  */
 757 static unsigned int mei_poll(struct file *file, poll_table *wait)
 758 {
 759         struct mei_cl *cl = file->private_data;
 760         struct mei_device *dev;
 761         unsigned int mask = 0;
 762
 763         if (WARN_ON(!cl || !cl->dev))
 764                 return mask;
 765
 766         dev = cl->dev;
 767
 768         mutex_lock(&dev->device_lock);
 769
 770         if (dev->dev_state != MEI_DEV_ENABLED)
 771                 goto out;
 772
 773
 774         if (cl == &dev->iamthif_cl) {
 775                 mask = mei_amthif_poll(dev, file, wait);
 776                 goto out;
 777         }
 778
 779         mutex_unlock(&dev->device_lock);
 780         poll_wait(file, &cl->tx_wait, wait);
 781         mutex_lock(&dev->device_lock);
 782         if (MEI_WRITE_COMPLETE == cl->writing_state)
 783                 mask |= (POLLIN | POLLRDNORM);
 784
 785 out:
 786         mutex_unlock(&dev->device_lock);
 787         return mask;
 788 }
 789
 790 /*
 791  * file operations structure will be used for mei char device.
 792  */
 793 static const struct file_operations mei_fops = {
 794         .owner = THIS_MODULE,
 795         .read = mei_read,
 796         .unlocked_ioctl = mei_ioctl,
 797 #ifdef CONFIG_COMPAT
 798         .compat_ioctl = mei_compat_ioctl,
 799 #endif
 800         .open = mei_open,
 801         .release = mei_release,
 802         .write = mei_write,
 803         .poll = mei_poll,
 804         .llseek = no_llseek
 805 };
 806
 807
 808 /*
 809  * Misc Device Struct
 810  */
 811 static struct miscdevice  mei_misc_device = {
 812                 .name = "mei",
 813                 .fops = &mei_fops,
 814                 .minor = MISC_DYNAMIC_MINOR,
 815 };
 816
 817 /**
 818  * mei_quirk_probe - probe for devices that doesn't valid ME interface
 819  * @pdev: PCI device structure
 820  * @ent: entry into pci_device_table
 821  *
 822  * returns true if ME Interface is valid, false otherwise
 823  */
 824 static bool mei_quirk_probe(struct pci_dev *pdev,
 825                                 const struct pci_device_id *ent)
 826 {
 827         u32 reg;
 828         if (ent->device == MEI_DEV_ID_PBG_1) {
 829                 pci_read_config_dword(pdev, 0x48, &reg);
 830                 /* make sure that bit 9 is up and bit 10 is down */
 831                 if ((reg & 0x600) == 0x200) {
 832                         dev_info(&pdev->dev, "Device doesn't have valid ME Interface\n");
 833                         return false;
 834                 }
 835         }
 836         return true;
 837 }
 838 /**
 839  * mei_probe - Device Initialization Routine
 840  *
 841  * @pdev: PCI device structure
 842  * @ent: entry in kcs_pci_tbl
 843  *
 844  * returns 0 on success, <0 on failure.
 845  */
 846 static int mei_probe(struct pci_dev *pdev,
 847                                 const struct pci_device_id *ent)
 848 {
 849         struct mei_device *dev;
 850         int err;
 851
 852         mutex_lock(&mei_mutex);
 853
 854         if (!mei_quirk_probe(pdev, ent)) {
 855                 err = -ENODEV;
 856                 goto end;
 857         }
 858
 859         if (mei_pdev) {
 860                 err = -EEXIST;
 861                 goto end;
 862         }
 863         /* enable pci dev */
 864         err = pci_enable_device(pdev);
 865         if (err) {
 866                 dev_err(&pdev->dev, "failed to enable pci device.\n");
 867                 goto end;
 868         }
 869         /* set PCI host mastering  */
 870         pci_set_master(pdev);
 871         /* pci request regions for mei driver */
 872         err = pci_request_regions(pdev, KBUILD_MODNAME);
 873         if (err) {
 874                 dev_err(&pdev->dev, "failed to get pci regions.\n");
 875                 goto disable_device;
 876         }
 877         /* allocates and initializes the mei dev structure */
 878         dev = mei_device_init(pdev);
 879         if (!dev) {
 880                 err = -ENOMEM;
 881                 goto release_regions;
 882         }
 883         /* mapping  IO device memory */
 884         dev->mem_addr = pci_iomap(pdev, 0, 0);
 885         if (!dev->mem_addr) {
 886                 dev_err(&pdev->dev, "mapping I/O device memory failure.\n");
 887                 err = -ENOMEM;
 888                 goto free_device;
 889         }
 890         pci_enable_msi(pdev);
 891
 892          /* request and enable interrupt */
 893         if (pci_dev_msi_enabled(pdev))
 894                 err = request_threaded_irq(pdev->irq,
 895                         NULL,
 896                         mei_interrupt_thread_handler,
 897                         IRQF_ONESHOT, KBUILD_MODNAME, dev);
 898         else
 899                 err = request_threaded_irq(pdev->irq,
 900                         mei_interrupt_quick_handler,
 901                         mei_interrupt_thread_handler,
 902                         IRQF_SHARED, KBUILD_MODNAME, dev);
 903
 904         if (err) {
 905                 dev_err(&pdev->dev, "request_threaded_irq failure. irq = %d\n",
 906                        pdev->irq);
 907                 goto disable_msi;
 908         }
 909         INIT_DELAYED_WORK(&dev->timer_work, mei_timer);
 910         INIT_WORK(&dev->init_work, mei_host_client_init);
 911
 912         if (mei_hw_init(dev)) {
 913                 dev_err(&pdev->dev, "init hw failure.\n");
 914                 err = -ENODEV;
 915                 goto release_irq;
 916         }
 917
 918         err = misc_register(&mei_misc_device);
 919         if (err)
 920                 goto release_irq;
 921
 922         mei_pdev = pdev;
 923         pci_set_drvdata(pdev, dev);
 924
 925
 926         schedule_delayed_work(&dev->timer_work, HZ);
 927
 928         mutex_unlock(&mei_mutex);
 929
 930         pr_debug("initialization successful.\n");
 931
 932         return 0;
 933
 934 release_irq:
 935         /* disable interrupts */
 936         dev->host_hw_state = mei_hcsr_read(dev);
 937         mei_disable_interrupts(dev);
 938         flush_scheduled_work();
 939         free_irq(pdev->irq, dev);
 940 disable_msi:
 941         pci_disable_msi(pdev);
 942         pci_iounmap(pdev, dev->mem_addr);
 943 free_device:
 944         kfree(dev);
 945 release_regions:
 946         pci_release_regions(pdev);
 947 disable_device:
 948         pci_disable_device(pdev);
 949 end:
 950         mutex_unlock(&mei_mutex);
 951         dev_err(&pdev->dev, "initialization failed.\n");
 952         return err;
 953 }
 954
 955 /**
 956  * mei_remove - Device Removal Routine
 957  *
 958  * @pdev: PCI device structure
 959  *
 960  * mei_remove is called by the PCI subsystem to alert the driver
 961  * that it should release a PCI device.
 962  */
 963 static void mei_remove(struct pci_dev *pdev)
 964 {
 965         struct mei_device *dev;
 966
 967         if (mei_pdev != pdev)
 968                 return;
 969
 970         dev = pci_get_drvdata(pdev);
 971         if (!dev)
 972                 return;
 973
 974         mutex_lock(&dev->device_lock);
 975
 976         cancel_delayed_work(&dev->timer_work);
 977
 978         mei_wd_stop(dev);
 979
 980         mei_pdev = NULL;
 981
 982         if (dev->iamthif_cl.state == MEI_FILE_CONNECTED) {
 983                 dev->iamthif_cl.state = MEI_FILE_DISCONNECTING;
 984                 mei_cl_disconnect(&dev->iamthif_cl);
 985         }
 986         if (dev->wd_cl.state == MEI_FILE_CONNECTED) {
 987                 dev->wd_cl.state = MEI_FILE_DISCONNECTING;
 988                 mei_cl_disconnect(&dev->wd_cl);
 989         }
 990
 991         /* Unregistering watchdog device */
 992         mei_watchdog_unregister(dev);
 993
 994         /* remove entry if already in list */
 995         dev_dbg(&pdev->dev, "list del iamthif and wd file list.\n");
 996         mei_cl_unlink(&dev->wd_cl);
 997         mei_cl_unlink(&dev->iamthif_cl);
 998
 999         dev->iamthif_current_cb = NULL;
1000         dev->me_clients_num = 0;
1001
1002         mutex_unlock(&dev->device_lock);
1003
1004         flush_scheduled_work();
1005
1006         /* disable interrupts */
1007         mei_disable_interrupts(dev);
1008
1009         free_irq(pdev->irq, dev);
1010         pci_disable_msi(pdev);
1011         pci_set_drvdata(pdev, NULL);
1012
1013         if (dev->mem_addr)
1014                 pci_iounmap(pdev, dev->mem_addr);
1015
1016         kfree(dev);
1017
1018         pci_release_regions(pdev);
1019         pci_disable_device(pdev);
1020
1021         misc_deregister(&mei_misc_device);
1022 }
1023 #ifdef CONFIG_PM
1024 static int mei_pci_suspend(struct device *device)
1025 {
1026         struct pci_dev *pdev = to_pci_dev(device);
1027         struct mei_device *dev = pci_get_drvdata(pdev);
1028         int err;
1029
1030         if (!dev)
1031                 return -ENODEV;
1032         mutex_lock(&dev->device_lock);
1033
1034         cancel_delayed_work(&dev->timer_work);
1035
1036         /* Stop watchdog if exists */
1037         err = mei_wd_stop(dev);
1038         /* Set new mei state */
1039         if (dev->dev_state == MEI_DEV_ENABLED ||
1040             dev->dev_state == MEI_DEV_RECOVERING_FROM_RESET) {
1041                 dev->dev_state = MEI_DEV_POWER_DOWN;
1042                 mei_reset(dev, 0);
1043         }
1044         mutex_unlock(&dev->device_lock);
1045
1046         free_irq(pdev->irq, dev);
1047         pci_disable_msi(pdev);
1048
1049         return err;
1050 }
1051
1052 static int mei_pci_resume(struct device *device)
1053 {
1054         struct pci_dev *pdev = to_pci_dev(device);
1055         struct mei_device *dev;
1056         int err;
1057
1058         dev = pci_get_drvdata(pdev);
1059         if (!dev)
1060                 return -ENODEV;
1061
1062         pci_enable_msi(pdev);
1063
1064         /* request and enable interrupt */
1065         if (pci_dev_msi_enabled(pdev))
1066                 err = request_threaded_irq(pdev->irq,
1067                         NULL,
1068                         mei_interrupt_thread_handler,
1069                         IRQF_ONESHOT, KBUILD_MODNAME, dev);
1070         else
1071                 err = request_threaded_irq(pdev->irq,
1072                         mei_interrupt_quick_handler,
1073                         mei_interrupt_thread_handler,
1074                         IRQF_SHARED, KBUILD_MODNAME, dev);
1075
1076         if (err) {
1077                 dev_err(&pdev->dev, "request_threaded_irq failed: irq = %d.\n",
1078                                 pdev->irq);
1079                 return err;
1080         }
1081
1082         mutex_lock(&dev->device_lock);
1083         dev->dev_state = MEI_DEV_POWER_UP;
1084         mei_reset(dev, 1);
1085         mutex_unlock(&dev->device_lock);
1086
1087         /* Start timer if stopped in suspend */
1088         schedule_delayed_work(&dev->timer_work, HZ);
1089
1090         return err;
1091 }
1092 static SIMPLE_DEV_PM_OPS(mei_pm_ops, mei_pci_suspend, mei_pci_resume);
1093 #define MEI_PM_OPS      (&mei_pm_ops)
1094 #else
1095 #define MEI_PM_OPS      NULL
1096 #endif /* CONFIG_PM */
1097 /*
1098  *  PCI driver structure
1099  */
1100 static struct pci_driver mei_driver = {
1101         .name = KBUILD_MODNAME,
1102         .id_table = mei_pci_tbl,
1103         .probe = mei_probe,
1104         .remove = mei_remove,
1105         .shutdown = mei_remove,
1106         .driver.pm = MEI_PM_OPS,
1107 };
1108
1109 module_pci_driver(mei_driver);
1110
1111 MODULE_AUTHOR("Intel Corporation");
1112 MODULE_DESCRIPTION("Intel(R) Management Engine Interface");
1113 MODULE_LICENSE("GPL v2");