linux-stable.git/drivers/misc/mei, branch v4.6.2 Linux kernel stable tree mei: bus: call mei_cl_read_start under device lock 2016-06-01T19:18:00+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-05-03T22:54:21+00:00 b54260fe250203657e9eac54771005fe99a5463a commit bc46b45a421a64a0895dd41a34d3d2086e1ac7f6 upstream. Ensure that mei_cl_read_start is called under the device lock also in the bus layer. The function updates global ctrl_wr_list which should be locked. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit bc46b45a421a64a0895dd41a34d3d2086e1ac7f6 upstream.

Ensure that mei_cl_read_start is called under the device lock
also in the bus layer. The function updates global ctrl_wr_list
which should be locked.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: amthif: discard not read messages 2016-06-01T19:18:00+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-04-17T16:16:04+00:00 293dc5cee23129f9a97b7661efb4705f43308cd9 commit 9d04ee11db7bf0d848266cbfd7db336097a0e239 upstream. When a message is received and amthif client is not in reading state the message is ignored and left dangling in the queue. This may happen after one of the amthif host connections is closed w/o completing the reading. Another client will pick up a wrong message on next read attempt which will lead to link reset. To prevent this the driver has to properly discard the message when amthif client is not in reading state. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 9d04ee11db7bf0d848266cbfd7db336097a0e239 upstream.

When a message is received and amthif client is not in reading state
the message is ignored and left dangling in the queue. This may happen
after one of the amthif host connections is closed w/o completing the
reading. Another client will pick up a wrong message on next read
attempt which will lead to link reset.
To prevent this the driver has to properly discard the message when
amthif client is not in reading state.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: fix NULL dereferencing during FW initiated disconnection 2016-06-01T19:18:00+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-04-17T16:16:03+00:00 7f41001cf02dbd4369f04b04e57aeba481d4e635 commit 6a8d648c8d1824117a9e9edb948ed1611fb013c0 upstream. In the case when disconnection is initiated from the FW the driver is flushing items from the write control list while iterating over it: mei_irq_write_handler() list_for_each_entry_safe(ctrl_wr_list) <-- outer loop mei_cl_irq_disconnect_rsp() mei_cl_set_disconnected() mei_io_list_flush(ctrl_wr_list) <-- destorying list We move the list flushing to the completion routine. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 6a8d648c8d1824117a9e9edb948ed1611fb013c0 upstream.

In the case when disconnection is initiated from the FW
the driver is flushing items from the write control list while
iterating over it:

mei_irq_write_handler()
    list_for_each_entry_safe(ctrl_wr_list)         <-- outer loop
         mei_cl_irq_disconnect_rsp()
             mei_cl_set_disconnected()
                 mei_io_list_flush(ctrl_wr_list)   <-- destorying list

We move the list flushing to the completion routine.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: me: add broxton pci device ids 2016-03-02T00:53:32+00:00 Tomas Winkler tomas.winkler@intel.com 2016-02-29T20:03:23+00:00 dd16f6cdeb4e02a728863d3cf99aaab352f0d761 Add device ids for Broxton SoC based devices. Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Add device ids for Broxton SoC based devices.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: fix format string in debug prints 2016-02-20T22:27:36+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-02-17T16:27:34+00:00 35bf7692e765c2275bf93fe573f7ca868ab73453 buf_idx type was changed to size_t, and few places missed out to change the print format from %ld to %zu. Use also uz for buf.size which is also of size_t Fixes: commit 56988f22e097 ("mei: fix possible integer overflow issue")' Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
buf_idx type was changed to size_t, and few places
missed out to change the print format from %ld to %zu.
Use also uz for buf.size which is also of size_t

Fixes:
commit 56988f22e097 ("mei: fix possible integer overflow issue")'

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge 4.5-rc4 into char-misc-next 2016-02-14T22:25:59+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2016-02-14T22:25:59+00:00 1b79dff672ca09a5461cc1d46ad81c62137841c5 We want those fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
We want those fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: fix double freeing of a cb during link reset 2016-02-12T03:23:28+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-02-10T21:57:26+00:00 6cbb097fd3903fd6b419303ee8dc7f72b47d06f0 Fix double freeing of the cb that can happen if link reset kicks in the middle of blocked write from a device on the cl bus. Free cb inside mei_cl_write function on failure and drop cb free operation from callers, during a link reset the mei_cl_write function returns with an error, but the caller doesn't know if the cb was already queued or not so it doesn't know if the cb will be freed upon queue reclaim or it has to free it itself. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Fix double freeing of the cb that can happen if link reset kicks  in the
middle of blocked write from a device on the cl bus.

Free cb inside mei_cl_write function on failure and drop cb free
operation from callers, during a link reset the mei_cl_write function
returns with an error,  but the caller doesn't know if the cb was
already queued or not so it doesn't know if the cb will be freed upon
queue reclaim or it has to free it itself.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: wd: drop AGAIN the watchdog code from the core mei driver 2016-02-10T01:31:50+00:00 Tomas Winkler tomas.winkler@intel.com 2016-02-08T22:00:17+00:00 4ddbdbb90d2ec7d7db93c98936faf3dad75f479b The file wd.c was remove from the driver by commit commit fdd9b8655933 ("mei: wd: drop the watchdog code from the core mei driver") Unfortunately it came back by mistake in rebasing in the commit commit 06ee536bcb15 ("mei: fill file pointer in read cb for fixed address client") Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The file wd.c was remove from the driver by commit
commit fdd9b8655933 ("mei: wd: drop the watchdog code from the core mei
driver")

Unfortunately it came back by mistake in rebasing in the commit
commit 06ee536bcb15 ("mei: fill file pointer in read cb for fixed
address client")

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: split amthif client init from end of clients enumeration 2016-02-07T22:47:20+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-02-07T21:35:43+00:00 025fb792bac33632c19fe12265ba1f6108921300 The amthif FW client can appear after the end of client enumeration. Amthif host client initialization is done now at FW client discovery time. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The amthif FW client can appear after the end of client enumeration.
Amthif host client initialization is done now at FW client discovery
time.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mei: hbm: send immediate reply flag in enum request 2016-02-07T22:47:20+00:00 Alexander Usyskin alexander.usyskin@intel.com 2016-02-07T21:35:42+00:00 27f476ea98ed495839662db4e3a76357bbeb1bb3 Signal the FW that it can send an HBM enumeration answer immediately, without waiting for FW initialization completion, meaning before all the FW clients are ready and registered. Organize enumeration response options to enum as a byproduct. Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Signal the FW that it can send an HBM enumeration answer immediately,
without waiting for FW initialization completion, meaning before
all the FW clients are ready and registered.

Organize enumeration response options to enum as a byproduct.

Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>