| /* |
| * |
| * Intel Management Engine Interface (Intel MEI) Linux driver |
| * Copyright (c) 2003-2012, Intel Corporation. |
| * |
| * This program is free software; you can redistribute it and/or modify it |
| * under the terms and conditions of the GNU General Public License, |
| * version 2, as published by the Free Software Foundation. |
| * |
| * This program is distributed in the hope it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for |
| * more details. |
| * |
| */ |
| |
| #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| |
| #include <linux/module.h> |
| #include <linux/moduleparam.h> |
| #include <linux/kernel.h> |
| #include <linux/device.h> |
| #include <linux/fs.h> |
| #include <linux/errno.h> |
| #include <linux/types.h> |
| #include <linux/fcntl.h> |
| #include <linux/aio.h> |
| #include <linux/pci.h> |
| #include <linux/poll.h> |
| #include <linux/init.h> |
| #include <linux/ioctl.h> |
| #include <linux/cdev.h> |
| #include <linux/sched.h> |
| #include <linux/uuid.h> |
| #include <linux/compat.h> |
| #include <linux/jiffies.h> |
| #include <linux/interrupt.h> |
| #include <linux/miscdevice.h> |
| |
| #include <linux/mei.h> |
| |
| #include "mei_dev.h" |
| #include "hw-me.h" |
| #include "client.h" |
| |
| /** |
| * mei_open - the open function |
| * |
| * @inode: pointer to inode structure |
| * @file: pointer to file structure |
| e |
| * returns 0 on success, <0 on error |
| */ |
| static int mei_open(struct inode *inode, struct file *file) |
| { |
| struct miscdevice *misc = file->private_data; |
| struct pci_dev *pdev; |
| struct mei_cl *cl; |
| struct mei_device *dev; |
| |
| int err; |
| |
| err = -ENODEV; |
| if (!misc->parent) |
| goto out; |
| |
| pdev = container_of(misc->parent, struct pci_dev, dev); |
| |
| dev = pci_get_drvdata(pdev); |
| if (!dev) |
| goto out; |
| |
| mutex_lock(&dev->device_lock); |
| err = -ENOMEM; |
| cl = mei_cl_allocate(dev); |
| if (!cl) |
| goto out_unlock; |
| |
| err = -ENODEV; |
| if (dev->dev_state != MEI_DEV_ENABLED) { |
| dev_dbg(&dev->pdev->dev, "dev_state != MEI_ENABLED dev_state = %s\n", |
| mei_dev_state_str(dev->dev_state)); |
| goto out_unlock; |
| } |
| err = -EMFILE; |
| if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) { |
| dev_err(&dev->pdev->dev, "open_handle_count exceded %d", |
| MEI_MAX_OPEN_HANDLE_COUNT); |
| goto out_unlock; |
| } |
| |
| err = mei_cl_link(cl, MEI_HOST_CLIENT_ID_ANY); |
| if (err) |
| goto out_unlock; |
| |
| file->private_data = cl; |
| mutex_unlock(&dev->device_lock); |
| |
| return nonseekable_open(inode, file); |
| |
| out_unlock: |
| mutex_unlock(&dev->device_lock); |
| kfree(cl); |
| out: |
| return err; |
| } |
| |
| /** |
| * mei_release - the release function |
| * |
| * @inode: pointer to inode structure |
| * @file: pointer to file structure |
| * |
| * returns 0 on success, <0 on error |
| */ |
| static int mei_release(struct inode *inode, struct file *file) |
| { |
| struct mei_cl *cl = file->private_data; |
| struct mei_cl_cb *cb; |
| struct mei_device *dev; |
| int rets = 0; |
| |
| if (WARN_ON(!cl || !cl->dev)) |
| return -ENODEV; |
| |
| dev = cl->dev; |
| |
| mutex_lock(&dev->device_lock); |
| if (cl == &dev->iamthif_cl) { |
| rets = mei_amthif_release(dev, file); |
| goto out; |
| } |
| if (cl->state == MEI_FILE_CONNECTED) { |
| cl->state = MEI_FILE_DISCONNECTING; |
| dev_dbg(&dev->pdev->dev, |
| "disconnecting client host client = %d, " |
| "ME client = %d\n", |
| cl->host_client_id, |
| cl->me_client_id); |
| rets = mei_cl_disconnect(cl); |
| } |
| mei_cl_flush_queues(cl); |
| dev_dbg(&dev->pdev->dev, "remove client host client = %d, ME client = %d\n", |
| cl->host_client_id, |
| cl->me_client_id); |
| |
| if (dev->open_handle_count > 0) { |
| clear_bit(cl->host_client_id, dev->host_clients_map); |
| dev->open_handle_count--; |
| } |
| mei_cl_unlink(cl); |
| |
| |
| /* free read cb */ |
| cb = NULL; |
| if (cl->read_cb) { |
| cb = mei_cl_find_read_cb(cl); |
| /* Remove entry from read list */ |
| if (cb) |
| list_del(&cb->list); |
| |
| cb = cl->read_cb; |
| cl->read_cb = NULL; |
| } |
| |
| file->private_data = NULL; |
| |
| if (cb) { |
| mei_io_cb_free(cb); |
| cb = NULL; |
| } |
| |
| kfree(cl); |
| out: |
| mutex_unlock(&dev->device_lock); |
| return rets; |
| } |
| |
| |
| /** |
| * mei_read - the read function. |
| * |
| * @file: pointer to file structure |
| * @ubuf: pointer to user buffer |
| * @length: buffer length |
| * @offset: data offset in buffer |
| * |
| * returns >=0 data length on success , <0 on error |
| */ |
| static ssize_t mei_read(struct file *file, char __user *ubuf, |
| size_t length, loff_t *offset) |
| { |
| struct mei_cl *cl = file->private_data; |
| struct mei_cl_cb *cb_pos = NULL; |
| struct mei_cl_cb *cb = NULL; |
| struct mei_device *dev; |
| int i; |
| int rets; |
| int err; |
| |
| |
| if (WARN_ON(!cl || !cl->dev)) |
| return -ENODEV; |
| |
| dev = cl->dev; |
| |
| mutex_lock(&dev->device_lock); |
| if (dev->dev_state != MEI_DEV_ENABLED) { |
| rets = -ENODEV; |
| goto out; |
| } |
| |
| if ((cl->sm_state & MEI_WD_STATE_INDEPENDENCE_MSG_SENT) == 0) { |
| /* Do not allow to read watchdog client */ |
| i = mei_me_cl_by_uuid(dev, &mei_wd_guid); |
| if (i >= 0) { |
| struct mei_me_client *me_client = &dev->me_clients[i]; |
| if (cl->me_client_id == me_client->client_id) { |
| rets = -EBADF; |
| goto out; |
| } |
| } |
| } else { |
| cl->sm_state &= ~MEI_WD_STATE_INDEPENDENCE_MSG_SENT; |
| } |
| |
| if (cl == &dev->iamthif_cl) { |
| rets = mei_amthif_read(dev, file, ubuf, length, offset); |
| goto out; |
| } |
| |
| if (cl->read_cb && cl->read_cb->buf_idx > *offset) { |
| cb = cl->read_cb; |
| goto copy_buffer; |
| } else if (cl->read_cb && cl->read_cb->buf_idx > 0 && |
| cl->read_cb->buf_idx <= *offset) { |
| cb = cl->read_cb; |
| rets = 0; |
| goto free; |
| } else if ((!cl->read_cb || !cl->read_cb->buf_idx) && *offset > 0) { |
| /*Offset needs to be cleaned for contiguous reads*/ |
| *offset = 0; |
| rets = 0; |
| goto out; |
| } |
| |
| err = mei_cl_read_start(cl, length); |
| if (err && err != -EBUSY) { |
| dev_dbg(&dev->pdev->dev, |
| "mei start read failure with status = %d\n", err); |
| rets = err; |
| goto out; |
| } |
| |
| if (MEI_READ_COMPLETE != cl->reading_state && |
| !waitqueue_active(&cl->rx_wait)) { |
| if (file->f_flags & O_NONBLOCK) { |
| rets = -EAGAIN; |
| goto out; |
| } |
| |
| mutex_unlock(&dev->device_lock); |
| |
| if (wait_event_interruptible(cl->rx_wait, |
| MEI_READ_COMPLETE == cl->reading_state || |
| mei_cl_is_transitioning(cl))) { |
| |
| if (signal_pending(current)) |
| return -EINTR; |
| return -ERESTARTSYS; |
| } |
| |
| mutex_lock(&dev->device_lock); |
| if (mei_cl_is_transitioning(cl)) { |
| rets = -EBUSY; |
| goto out; |
| } |
| } |
| |
| cb = cl->read_cb; |
| |
| if (!cb) { |
| rets = -ENODEV; |
| goto out; |
| } |
| if (cl->reading_state != MEI_READ_COMPLETE) { |
| rets = 0; |
| goto out; |
| } |
| /* now copy the data to user space */ |
| copy_buffer: |
| dev_dbg(&dev->pdev->dev, "buf.size = %d buf.idx= %ld\n", |
| cb->response_buffer.size, cb->buf_idx); |
| if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) { |
| rets = -EMSGSIZE; |
| goto free; |
| } |
| |
| /* length is being truncated to PAGE_SIZE, |
| * however buf_idx may point beyond that */ |
| length = min_t(size_t, length, cb->buf_idx - *offset); |
| |
| if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) { |
| rets = -EFAULT; |
| goto free; |
| } |
| |
| rets = length; |
| *offset += length; |
| if ((unsigned long)*offset < cb->buf_idx) |
| goto out; |
| |
| free: |
| cb_pos = mei_cl_find_read_cb(cl); |
| /* Remove entry from read list */ |
| if (cb_pos) |
| list_del(&cb_pos->list); |
| mei_io_cb_free(cb); |
| cl->reading_state = MEI_IDLE; |
| cl->read_cb = NULL; |
| out: |
| dev_dbg(&dev->pdev->dev, "end mei read rets= %d\n", rets); |
| mutex_unlock(&dev->device_lock); |
| return rets; |
| } |
| /** |
| * mei_write - the write function. |
| * |
| * @file: pointer to file structure |
| * @ubuf: pointer to user buffer |
| * @length: buffer length |
| * @offset: data offset in buffer |
| * |
| * returns >=0 data length on success , <0 on error |
| */ |
| static ssize_t mei_write(struct file *file, const char __user *ubuf, |
| size_t length, loff_t *offset) |
| { |
| struct mei_cl *cl = file->private_data; |
| struct mei_cl_cb *write_cb = NULL; |
| struct mei_device *dev; |
| unsigned long timeout = 0; |
| int rets; |
| int id; |
| |
| if (WARN_ON(!cl || !cl->dev)) |
| return -ENODEV; |
| |
| dev = cl->dev; |
| |
| mutex_lock(&dev->device_lock); |
| |
| if (dev->dev_state != MEI_DEV_ENABLED) { |
| rets = -ENODEV; |
| goto out; |
| } |
| |
| id = mei_me_cl_by_id(dev, cl->me_client_id); |
| if (id < 0) { |
| rets = -ENODEV; |
| goto out; |
| } |
| if (length > dev->me_clients[id].props.max_msg_length || length <= 0) { |
| rets = -EMSGSIZE; |
| goto out; |
| } |
| |
| if (cl->state != MEI_FILE_CONNECTED) { |
| dev_err(&dev->pdev->dev, "host client = %d, is not connected to ME client = %d", |
| cl->host_client_id, cl->me_client_id); |
| rets = -ENODEV; |
| goto out; |
| } |
| if (cl == &dev->iamthif_cl) { |
| write_cb = mei_amthif_find_read_list_entry(dev, file); |
| |
| if (write_cb) { |
| timeout = write_cb->read_time + |
| mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER); |
| |
| if (time_after(jiffies, timeout) || |
| cl->reading_state == MEI_READ_COMPLETE) { |
| *offset = 0; |
| list_del(&write_cb->list); |
| mei_io_cb_free(write_cb); |
| write_cb = NULL; |
| } |
| } |
| } |
| |
| /* free entry used in read */ |
| if (cl->reading_state == MEI_READ_COMPLETE) { |
| *offset = 0; |
| write_cb = mei_cl_find_read_cb(cl); |
| if (write_cb) { |
| list_del(&write_cb->list); |
| mei_io_cb_free(write_cb); |
| write_cb = NULL; |
| cl->reading_state = MEI_IDLE; |
| cl->read_cb = NULL; |
| } |
| } else if (cl->reading_state == MEI_IDLE) |
| *offset = 0; |
| |
| |
| write_cb = mei_io_cb_init(cl, file); |
| if (!write_cb) { |
| dev_err(&dev->pdev->dev, "write cb allocation failed\n"); |
| rets = -ENOMEM; |
| goto out; |
| } |
| rets = mei_io_cb_alloc_req_buf(write_cb, length); |
| if (rets) |
| goto out; |
| |
| rets = copy_from_user(write_cb->request_buffer.data, ubuf, length); |
| if (rets) |
| goto out; |
| |
| cl->sm_state = 0; |
| if (length == 4 && |
| ((memcmp(mei_wd_state_independence_msg[0], |
| write_cb->request_buffer.data, 4) == 0) || |
| (memcmp(mei_wd_state_independence_msg[1], |
| write_cb->request_buffer.data, 4) == 0) || |
| (memcmp(mei_wd_state_independence_msg[2], |
| write_cb->request_buffer.data, 4) == 0))) |
| cl->sm_state |= MEI_WD_STATE_INDEPENDENCE_MSG_SENT; |
| |
| if (cl == &dev->iamthif_cl) { |
| rets = mei_amthif_write(dev, write_cb); |
| |
| if (rets) { |
| dev_err(&dev->pdev->dev, |
| "amthif write failed with status = %d\n", rets); |
| goto out; |
| } |
| mutex_unlock(&dev->device_lock); |
| return length; |
| } |
| |
| rets = mei_cl_write(cl, write_cb, false); |
| out: |
| mutex_unlock(&dev->device_lock); |
| if (rets < 0) |
| mei_io_cb_free(write_cb); |
| return rets; |
| } |
| |
| /** |
| * mei_ioctl_connect_client - the connect to fw client IOCTL function |
| * |
| * @dev: the device structure |
| * @data: IOCTL connect data, input and output parameters |
| * @file: private data of the file object |
| * |
| * Locking: called under "dev->device_lock" lock |
| * |
| * returns 0 on success, <0 on failure. |
| */ |
| static int mei_ioctl_connect_client(struct file *file, |
| struct mei_connect_client_data *data) |
| { |
| struct mei_device *dev; |
| struct mei_client *client; |
| struct mei_cl *cl; |
| int i; |
| int rets; |
| |
| cl = file->private_data; |
| if (WARN_ON(!cl || !cl->dev)) |
| return -ENODEV; |
| |
| dev = cl->dev; |
| |
| if (dev->dev_state != MEI_DEV_ENABLED) { |
| rets = -ENODEV; |
| goto end; |
| } |
| |
| if (cl->state != MEI_FILE_INITIALIZING && |
| cl->state != MEI_FILE_DISCONNECTED) { |
| rets = -EBUSY; |
| goto end; |
| } |
| |
| /* find ME client we're trying to connect to */ |
| i = mei_me_cl_by_uuid(dev, &data->in_client_uuid); |
| if (i < 0 || dev->me_clients[i].props.fixed_address) { |
| dev_dbg(&dev->pdev->dev, "Cannot connect to FW Client UUID = %pUl\n", |
| &data->in_client_uuid); |
| rets = -ENODEV; |
| goto end; |
| } |
| |
| cl->me_client_id = dev->me_clients[i].client_id; |
| cl->state = MEI_FILE_CONNECTING; |
| |
| dev_dbg(&dev->pdev->dev, "Connect to FW Client ID = %d\n", |
| cl->me_client_id); |
| dev_dbg(&dev->pdev->dev, "FW Client - Protocol Version = %d\n", |
| dev->me_clients[i].props.protocol_version); |
| dev_dbg(&dev->pdev->dev, "FW Client - Max Msg Len = %d\n", |
| dev->me_clients[i].props.max_msg_length); |
| |
| /* if we're connecting to amthif client then we will use the |
| * existing connection |
| */ |
| if (uuid_le_cmp(data->in_client_uuid, mei_amthif_guid) == 0) { |
| dev_dbg(&dev->pdev->dev, "FW Client is amthi\n"); |
| if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) { |
| rets = -ENODEV; |
| goto end; |
| } |
| clear_bit(cl->host_client_id, dev->host_clients_map); |
| mei_cl_unlink(cl); |
| |
| kfree(cl); |
| cl = NULL; |
| file->private_data = &dev->iamthif_cl; |
| |
| client = &data->out_client_properties; |
| client->max_msg_length = |
| dev->me_clients[i].props.max_msg_length; |
| client->protocol_version = |
| dev->me_clients[i].props.protocol_version; |
| rets = dev->iamthif_cl.status; |
| |
| goto end; |
| } |
| |
| |
| /* prepare the output buffer */ |
| client = &data->out_client_properties; |
| client->max_msg_length = dev->me_clients[i].props.max_msg_length; |
| client->protocol_version = dev->me_clients[i].props.protocol_version; |
| dev_dbg(&dev->pdev->dev, "Can connect?\n"); |
| |
| |
| rets = mei_cl_connect(cl, file); |
| |
| end: |
| return rets; |
| } |
| |
| |
| /** |
| * mei_ioctl - the IOCTL function |
| * |
| * @file: pointer to file structure |
| * @cmd: ioctl command |
| * @data: pointer to mei message structure |
| * |
| * returns 0 on success , <0 on error |
| */ |
| static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) |
| { |
| struct mei_device *dev; |
| struct mei_cl *cl = file->private_data; |
| struct mei_connect_client_data *connect_data = NULL; |
| int rets; |
| |
| if (cmd != IOCTL_MEI_CONNECT_CLIENT) |
| return -EINVAL; |
| |
| if (WARN_ON(!cl || !cl->dev)) |
| return -ENODEV; |
| |
| dev = cl->dev; |
| |
| dev_dbg(&dev->pdev->dev, "IOCTL cmd = 0x%x", cmd); |
| |
| mutex_lock(&dev->device_lock); |
| if (dev->dev_state != MEI_DEV_ENABLED) { |
| rets = -ENODEV; |
| goto out; |
| } |
| |
| dev_dbg(&dev->pdev->dev, ": IOCTL_MEI_CONNECT_CLIENT.\n"); |
| |
| connect_data = kzalloc(sizeof(struct mei_connect_client_data), |
| GFP_KERNEL); |
| if (!connect_data) { |
| rets = -ENOMEM; |
| goto out; |
| } |
| dev_dbg(&dev->pdev->dev, "copy connect data from user\n"); |
| if (copy_from_user(connect_data, (char __user *)data, |
| sizeof(struct mei_connect_client_data))) { |
| dev_dbg(&dev->pdev->dev, "failed to copy data from userland\n"); |
| rets = -EFAULT; |
| goto out; |
| } |
| |
| rets = mei_ioctl_connect_client(file, connect_data); |
| |
| /* if all is ok, copying the data back to user. */ |
| if (rets) |
| goto out; |
| |
| dev_dbg(&dev->pdev->dev, "copy connect data to user\n"); |
| if (copy_to_user((char __user *)data, connect_data, |
| sizeof(struct mei_connect_client_data))) { |
| dev_dbg(&dev->pdev->dev, "failed to copy data to userland\n"); |
| rets = -EFAULT; |
| goto out; |
| } |
| |
| out: |
| kfree(connect_data); |
| mutex_unlock(&dev->device_lock); |
| return rets; |
| } |
| |
| /** |
| * mei_compat_ioctl - the compat IOCTL function |
| * |
| * @file: pointer to file structure |
| * @cmd: ioctl command |
| * @data: pointer to mei message structure |
| * |
| * returns 0 on success , <0 on error |
| */ |
| #ifdef CONFIG_COMPAT |
| static long mei_compat_ioctl(struct file *file, |
| unsigned int cmd, unsigned long data) |
| { |
| return mei_ioctl(file, cmd, (unsigned long)compat_ptr(data)); |
| } |
| #endif |
| |
| |
| /** |
| * mei_poll - the poll function |
| * |
| * @file: pointer to file structure |
| * @wait: pointer to poll_table structure |
| * |
| * returns poll mask |
| */ |
| static unsigned int mei_poll(struct file *file, poll_table *wait) |
| { |
| struct mei_cl *cl = file->private_data; |
| struct mei_device *dev; |
| unsigned int mask = 0; |
| |
| if (WARN_ON(!cl || !cl->dev)) |
| return mask; |
| |
| dev = cl->dev; |
| |
| mutex_lock(&dev->device_lock); |
| |
| if (dev->dev_state != MEI_DEV_ENABLED) |
| goto out; |
| |
| |
| if (cl == &dev->iamthif_cl) { |
| mask = mei_amthif_poll(dev, file, wait); |
| goto out; |
| } |
| |
| mutex_unlock(&dev->device_lock); |
| poll_wait(file, &cl->tx_wait, wait); |
| mutex_lock(&dev->device_lock); |
| if (MEI_WRITE_COMPLETE == cl->writing_state) |
| mask |= (POLLIN | POLLRDNORM); |
| |
| out: |
| mutex_unlock(&dev->device_lock); |
| return mask; |
| } |
| |
| /* |
| * file operations structure will be used for mei char device. |
| */ |
| static const struct file_operations mei_fops = { |
| .owner = THIS_MODULE, |
| .read = mei_read, |
| .unlocked_ioctl = mei_ioctl, |
| #ifdef CONFIG_COMPAT |
| .compat_ioctl = mei_compat_ioctl, |
| #endif |
| .open = mei_open, |
| .release = mei_release, |
| .write = mei_write, |
| .poll = mei_poll, |
| .llseek = no_llseek |
| }; |
| |
| /* |
| * Misc Device Struct |
| */ |
| static struct miscdevice mei_misc_device = { |
| .name = "mei", |
| .fops = &mei_fops, |
| .minor = MISC_DYNAMIC_MINOR, |
| }; |
| |
| |
| int mei_register(struct mei_device *dev) |
| { |
| int ret; |
| mei_misc_device.parent = &dev->pdev->dev; |
| ret = misc_register(&mei_misc_device); |
| if (ret) |
| return ret; |
| |
| if (mei_dbgfs_register(dev, mei_misc_device.name)) |
| dev_err(&dev->pdev->dev, "cannot register debugfs\n"); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL_GPL(mei_register); |
| |
| void mei_deregister(struct mei_device *dev) |
| { |
| mei_dbgfs_deregister(dev); |
| misc_deregister(&mei_misc_device); |
| mei_misc_device.parent = NULL; |
| } |
| EXPORT_SYMBOL_GPL(mei_deregister); |
| |
| static int __init mei_init(void) |
| { |
| return mei_cl_bus_init(); |
| } |
| |
| static void __exit mei_exit(void) |
| { |
| mei_cl_bus_exit(); |
| } |
| |
| module_init(mei_init); |
| module_exit(mei_exit); |
| |
| MODULE_AUTHOR("Intel Corporation"); |
| MODULE_DESCRIPTION("Intel(R) Management Engine Interface"); |
| MODULE_LICENSE("GPL v2"); |
| |