3 * Intel Management Engine Interface (Intel MEI) Linux driver
4 * Copyright (c) 2003-2012, Intel Corporation.
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms and conditions of the GNU General Public License,
8 * version 2, as published by the Free Software Foundation.
10 * This program is distributed in the hope it will be useful, but WITHOUT
11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
18 #include <linux/kernel.h>
20 #include <linux/errno.h>
21 #include <linux/types.h>
22 #include <linux/fcntl.h>
23 #include <linux/aio.h>
24 #include <linux/pci.h>
25 #include <linux/init.h>
26 #include <linux/ioctl.h>
27 #include <linux/cdev.h>
28 #include <linux/list.h>
29 #include <linux/delay.h>
30 #include <linux/sched.h>
31 #include <linux/uuid.h>
32 #include <linux/jiffies.h>
33 #include <linux/uaccess.h>
38 #include <linux/mei.h>
39 #include "interface.h"
44 * mei_ioctl_connect_client - the connect to fw client IOCTL function
46 * @dev: the device structure
47 * @data: IOCTL connect data, input and output parameters
48 * @file: private data of the file object
50 * Locking: called under "dev->device_lock" lock
52 * returns 0 on success, <0 on failure.
54 int mei_ioctl_connect_client(struct file
*file
,
55 struct mei_connect_client_data
*data
)
57 struct mei_device
*dev
;
59 struct mei_client
*client
;
61 struct mei_cl
*cl_pos
= NULL
;
62 struct mei_cl
*cl_next
= NULL
;
63 long timeout
= CONNECT_TIMEOUT
;
68 cl
= file
->private_data
;
69 if (WARN_ON(!cl
|| !cl
->dev
))
74 dev_dbg(&dev
->pdev
->dev
, "mei_ioctl_connect_client() Entry\n");
77 /* buffered ioctl cb */
78 cb
= kzalloc(sizeof(struct mei_cl_cb
), GFP_KERNEL
);
83 INIT_LIST_HEAD(&cb
->cb_list
);
85 cb
->major_file_operations
= MEI_IOCTL
;
87 if (dev
->mei_state
!= MEI_ENABLED
) {
91 if (cl
->state
!= MEI_FILE_INITIALIZING
&&
92 cl
->state
!= MEI_FILE_DISCONNECTED
) {
97 /* find ME client we're trying to connect to */
98 i
= mei_find_me_client_index(dev
, data
->in_client_uuid
);
99 if (i
>= 0 && !dev
->me_clients
[i
].props
.fixed_address
) {
100 cl
->me_client_id
= dev
->me_clients
[i
].client_id
;
101 cl
->state
= MEI_FILE_CONNECTING
;
104 dev_dbg(&dev
->pdev
->dev
, "Connect to FW Client ID = %d\n",
106 dev_dbg(&dev
->pdev
->dev
, "FW Client - Protocol Version = %d\n",
107 dev
->me_clients
[i
].props
.protocol_version
);
108 dev_dbg(&dev
->pdev
->dev
, "FW Client - Max Msg Len = %d\n",
109 dev
->me_clients
[i
].props
.max_msg_length
);
111 /* if we're connecting to amthi client then we will use the
112 * existing connection
114 if (uuid_le_cmp(data
->in_client_uuid
, mei_amthi_guid
) == 0) {
115 dev_dbg(&dev
->pdev
->dev
, "FW Client is amthi\n");
116 if (dev
->iamthif_cl
.state
!= MEI_FILE_CONNECTED
) {
120 clear_bit(cl
->host_client_id
, dev
->host_clients_map
);
121 list_for_each_entry_safe(cl_pos
, cl_next
,
122 &dev
->file_list
, link
) {
123 if (mei_cl_cmp_id(cl
, cl_pos
)) {
124 dev_dbg(&dev
->pdev
->dev
,
125 "remove file private data node host"
126 " client = %d, ME client = %d.\n",
127 cl_pos
->host_client_id
,
128 cl_pos
->me_client_id
);
129 list_del(&cl_pos
->link
);
133 dev_dbg(&dev
->pdev
->dev
, "free file private data memory.\n");
137 file
->private_data
= &dev
->iamthif_cl
;
139 client
= &data
->out_client_properties
;
140 client
->max_msg_length
=
141 dev
->me_clients
[i
].props
.max_msg_length
;
142 client
->protocol_version
=
143 dev
->me_clients
[i
].props
.protocol_version
;
144 rets
= dev
->iamthif_cl
.status
;
149 if (cl
->state
!= MEI_FILE_CONNECTING
) {
155 /* prepare the output buffer */
156 client
= &data
->out_client_properties
;
157 client
->max_msg_length
= dev
->me_clients
[i
].props
.max_msg_length
;
158 client
->protocol_version
= dev
->me_clients
[i
].props
.protocol_version
;
159 dev_dbg(&dev
->pdev
->dev
, "Can connect?\n");
160 if (dev
->mei_host_buffer_is_empty
161 && !mei_other_client_is_connecting(dev
, cl
)) {
162 dev_dbg(&dev
->pdev
->dev
, "Sending Connect Message\n");
163 dev
->mei_host_buffer_is_empty
= false;
164 if (mei_connect(dev
, cl
)) {
165 dev_dbg(&dev
->pdev
->dev
, "Sending connect message - failed\n");
169 dev_dbg(&dev
->pdev
->dev
, "Sending connect message - succeeded\n");
170 cl
->timer_count
= MEI_CONNECT_TIMEOUT
;
171 cb
->file_private
= cl
;
172 list_add_tail(&cb
->cb_list
,
173 &dev
->ctrl_rd_list
.mei_cb
.
179 dev_dbg(&dev
->pdev
->dev
, "Queuing the connect request due to device busy\n");
180 cb
->file_private
= cl
;
181 dev_dbg(&dev
->pdev
->dev
, "add connect cb to control write list.\n");
182 list_add_tail(&cb
->cb_list
,
183 &dev
->ctrl_wr_list
.mei_cb
.cb_list
);
185 mutex_unlock(&dev
->device_lock
);
186 err
= wait_event_timeout(dev
->wait_recvd_msg
,
187 (MEI_FILE_CONNECTED
== cl
->state
||
188 MEI_FILE_DISCONNECTED
== cl
->state
),
191 mutex_lock(&dev
->device_lock
);
192 if (MEI_FILE_CONNECTED
== cl
->state
) {
193 dev_dbg(&dev
->pdev
->dev
, "successfully connected to FW client.\n");
197 dev_dbg(&dev
->pdev
->dev
, "failed to connect to FW client.cl->state = %d.\n",
200 dev_dbg(&dev
->pdev
->dev
,
201 "wait_event_interruptible_timeout failed on client"
202 " connect message fw response message.\n");
206 mei_io_list_flush(&dev
->ctrl_rd_list
, cl
);
207 mei_io_list_flush(&dev
->ctrl_wr_list
, cl
);
212 dev_dbg(&dev
->pdev
->dev
, "free connect cb memory.");
218 * find_amthi_read_list_entry - finds a amthilist entry for current file
220 * @dev: the device structure
221 * @file: pointer to file object
223 * returns returned a list entry on success, NULL on failure.
225 struct mei_cl_cb
*find_amthi_read_list_entry(
226 struct mei_device
*dev
,
229 struct mei_cl
*cl_temp
;
230 struct mei_cl_cb
*pos
= NULL
;
231 struct mei_cl_cb
*next
= NULL
;
233 list_for_each_entry_safe(pos
, next
,
234 &dev
->amthi_read_complete_list
.mei_cb
.cb_list
, cb_list
) {
235 cl_temp
= (struct mei_cl
*)pos
->file_private
;
236 if (cl_temp
&& cl_temp
== &dev
->iamthif_cl
&&
237 pos
->file_object
== file
)
244 * amthi_read - read data from AMTHI client
246 * @dev: the device structure
247 * @if_num: minor number
248 * @file: pointer to file object
249 * @*ubuf: pointer to user data in user space
250 * @length: data length to read
251 * @offset: data read offset
253 * Locking: called under "dev->device_lock" lock
256 * returned data length on success,
257 * zero if no data to read,
258 * negative on failure.
260 int amthi_read(struct mei_device
*dev
, struct file
*file
,
261 char __user
*ubuf
, size_t length
, loff_t
*offset
)
265 struct mei_cl_cb
*cb
= NULL
;
266 struct mei_cl
*cl
= file
->private_data
;
267 unsigned long timeout
;
270 /* Only Posible if we are in timeout */
271 if (!cl
|| cl
!= &dev
->iamthif_cl
) {
272 dev_dbg(&dev
->pdev
->dev
, "bad file ext.\n");
276 for (i
= 0; i
< dev
->me_clients_num
; i
++) {
277 if (dev
->me_clients
[i
].client_id
==
278 dev
->iamthif_cl
.me_client_id
)
282 if (i
== dev
->me_clients_num
) {
283 dev_dbg(&dev
->pdev
->dev
, "amthi client not found.\n");
286 if (WARN_ON(dev
->me_clients
[i
].client_id
!= cl
->me_client_id
))
289 dev_dbg(&dev
->pdev
->dev
, "checking amthi data\n");
290 cb
= find_amthi_read_list_entry(dev
, file
);
292 /* Check for if we can block or not*/
293 if (cb
== NULL
&& file
->f_flags
& O_NONBLOCK
)
297 dev_dbg(&dev
->pdev
->dev
, "waiting for amthi data\n");
299 /* unlock the Mutex */
300 mutex_unlock(&dev
->device_lock
);
302 wait_ret
= wait_event_interruptible(dev
->iamthif_cl
.wait
,
303 (cb
= find_amthi_read_list_entry(dev
, file
)));
308 dev_dbg(&dev
->pdev
->dev
, "woke up from sleep\n");
310 /* Locking again the Mutex */
311 mutex_lock(&dev
->device_lock
);
315 dev_dbg(&dev
->pdev
->dev
, "Got amthi data\n");
316 dev
->iamthif_timer
= 0;
319 timeout
= cb
->read_time
+
320 msecs_to_jiffies(IAMTHIF_READ_TIMER
);
321 dev_dbg(&dev
->pdev
->dev
, "amthi timeout = %lud\n",
324 if (time_after(jiffies
, timeout
)) {
325 dev_dbg(&dev
->pdev
->dev
, "amthi Time out\n");
326 /* 15 sec for the message has expired */
327 list_del(&cb
->cb_list
);
332 /* if the whole message will fit remove it from the list */
333 if (cb
->information
>= *offset
&& length
>= (cb
->information
- *offset
))
334 list_del(&cb
->cb_list
);
335 else if (cb
->information
> 0 && cb
->information
<= *offset
) {
336 /* end of the message has been reached */
337 list_del(&cb
->cb_list
);
341 /* else means that not full buffer will be read and do not
342 * remove message from deletion list
345 dev_dbg(&dev
->pdev
->dev
, "amthi cb->response_buffer size - %d\n",
346 cb
->response_buffer
.size
);
347 dev_dbg(&dev
->pdev
->dev
, "amthi cb->information - %lu\n",
350 /* length is being turncated to PAGE_SIZE, however,
351 * the information may be longer */
352 length
= min_t(size_t, length
, (cb
->information
- *offset
));
354 if (copy_to_user(ubuf
, cb
->response_buffer
.data
+ *offset
, length
))
358 if ((*offset
+ length
) < cb
->information
) {
364 dev_dbg(&dev
->pdev
->dev
, "free amthi cb memory.\n");
366 mei_free_cb_private(cb
);
372 * mei_start_read - the start read client message function.
374 * @dev: the device structure
375 * @if_num: minor number
376 * @cl: private data of the file object
378 * returns 0 on success, <0 on failure.
380 int mei_start_read(struct mei_device
*dev
, struct mei_cl
*cl
)
382 struct mei_cl_cb
*cb
;
386 if (cl
->state
!= MEI_FILE_CONNECTED
)
389 if (dev
->mei_state
!= MEI_ENABLED
)
392 dev_dbg(&dev
->pdev
->dev
, "check if read is pending.\n");
393 if (cl
->read_pending
|| cl
->read_cb
) {
394 dev_dbg(&dev
->pdev
->dev
, "read is pending.\n");
398 cb
= kzalloc(sizeof(struct mei_cl_cb
), GFP_KERNEL
);
402 dev_dbg(&dev
->pdev
->dev
, "allocation call back successful. host client = %d, ME client = %d\n",
403 cl
->host_client_id
, cl
->me_client_id
);
405 for (i
= 0; i
< dev
->me_clients_num
; i
++) {
406 if (dev
->me_clients
[i
].client_id
== cl
->me_client_id
)
411 if (WARN_ON(dev
->me_clients
[i
].client_id
!= cl
->me_client_id
)) {
416 if (i
== dev
->me_clients_num
) {
421 cb
->response_buffer
.size
= dev
->me_clients
[i
].props
.max_msg_length
;
422 cb
->response_buffer
.data
=
423 kmalloc(cb
->response_buffer
.size
, GFP_KERNEL
);
424 if (!cb
->response_buffer
.data
) {
428 dev_dbg(&dev
->pdev
->dev
, "allocation call back data success.\n");
429 cb
->major_file_operations
= MEI_READ
;
430 /* make sure information is zero before we start */
432 cb
->file_private
= (void *) cl
;
434 if (dev
->mei_host_buffer_is_empty
) {
435 dev
->mei_host_buffer_is_empty
= false;
436 if (mei_send_flow_control(dev
, cl
)) {
440 list_add_tail(&cb
->cb_list
, &dev
->read_list
.mei_cb
.cb_list
);
442 list_add_tail(&cb
->cb_list
, &dev
->ctrl_wr_list
.mei_cb
.cb_list
);
446 mei_free_cb_private(cb
);
451 * amthi_write - write iamthif data to amthi client
453 * @dev: the device structure
454 * @cb: mei call back struct
456 * returns 0 on success, <0 on failure.
458 int amthi_write(struct mei_device
*dev
, struct mei_cl_cb
*cb
)
460 struct mei_msg_hdr mei_hdr
;
466 dev_dbg(&dev
->pdev
->dev
, "write data to amthi client.\n");
468 dev
->iamthif_state
= MEI_IAMTHIF_WRITING
;
469 dev
->iamthif_current_cb
= cb
;
470 dev
->iamthif_file_object
= cb
->file_object
;
471 dev
->iamthif_canceled
= false;
472 dev
->iamthif_ioctl
= true;
473 dev
->iamthif_msg_buf_size
= cb
->request_buffer
.size
;
474 memcpy(dev
->iamthif_msg_buf
, cb
->request_buffer
.data
,
475 cb
->request_buffer
.size
);
477 ret
= mei_flow_ctrl_creds(dev
, &dev
->iamthif_cl
);
481 if (ret
&& dev
->mei_host_buffer_is_empty
) {
483 dev
->mei_host_buffer_is_empty
= false;
484 if (cb
->request_buffer
.size
> mei_hbuf_max_data(dev
)) {
485 mei_hdr
.length
= mei_hbuf_max_data(dev
);
486 mei_hdr
.msg_complete
= 0;
488 mei_hdr
.length
= cb
->request_buffer
.size
;
489 mei_hdr
.msg_complete
= 1;
492 mei_hdr
.host_addr
= dev
->iamthif_cl
.host_client_id
;
493 mei_hdr
.me_addr
= dev
->iamthif_cl
.me_client_id
;
494 mei_hdr
.reserved
= 0;
495 dev
->iamthif_msg_buf_index
+= mei_hdr
.length
;
496 if (mei_write_message(dev
, &mei_hdr
,
497 (unsigned char *)(dev
->iamthif_msg_buf
),
501 if (mei_hdr
.msg_complete
) {
502 if (mei_flow_ctrl_reduce(dev
, &dev
->iamthif_cl
))
504 dev
->iamthif_flow_control_pending
= true;
505 dev
->iamthif_state
= MEI_IAMTHIF_FLOW_CONTROL
;
506 dev_dbg(&dev
->pdev
->dev
, "add amthi cb to write waiting list\n");
507 dev
->iamthif_current_cb
= cb
;
508 dev
->iamthif_file_object
= cb
->file_object
;
509 list_add_tail(&cb
->cb_list
,
510 &dev
->write_waiting_list
.mei_cb
.cb_list
);
512 dev_dbg(&dev
->pdev
->dev
, "message does not complete, "
513 "so add amthi cb to write list.\n");
514 list_add_tail(&cb
->cb_list
,
515 &dev
->write_list
.mei_cb
.cb_list
);
518 if (!(dev
->mei_host_buffer_is_empty
))
519 dev_dbg(&dev
->pdev
->dev
, "host buffer is not empty");
521 dev_dbg(&dev
->pdev
->dev
, "No flow control credentials, "
522 "so add iamthif cb to write list.\n");
523 list_add_tail(&cb
->cb_list
, &dev
->write_list
.mei_cb
.cb_list
);
529 * iamthif_ioctl_send_msg - send cmd data to amthi client
531 * @dev: the device structure
533 * returns 0 on success, <0 on failure.
535 void mei_run_next_iamthif_cmd(struct mei_device
*dev
)
537 struct mei_cl
*cl_tmp
;
538 struct mei_cl_cb
*pos
= NULL
;
539 struct mei_cl_cb
*next
= NULL
;
545 dev
->iamthif_msg_buf_size
= 0;
546 dev
->iamthif_msg_buf_index
= 0;
547 dev
->iamthif_canceled
= false;
548 dev
->iamthif_ioctl
= true;
549 dev
->iamthif_state
= MEI_IAMTHIF_IDLE
;
550 dev
->iamthif_timer
= 0;
551 dev
->iamthif_file_object
= NULL
;
553 dev_dbg(&dev
->pdev
->dev
, "complete amthi cmd_list cb.\n");
555 list_for_each_entry_safe(pos
, next
,
556 &dev
->amthi_cmd_list
.mei_cb
.cb_list
, cb_list
) {
557 list_del(&pos
->cb_list
);
558 cl_tmp
= (struct mei_cl
*)pos
->file_private
;
560 if (cl_tmp
&& cl_tmp
== &dev
->iamthif_cl
) {
561 status
= amthi_write(dev
, pos
);
563 dev_dbg(&dev
->pdev
->dev
,
564 "amthi write failed status = %d\n",
574 * mei_free_cb_private - free mei_cb_private related memory
576 * @cb: mei callback struct
578 void mei_free_cb_private(struct mei_cl_cb
*cb
)
583 kfree(cb
->request_buffer
.data
);
584 kfree(cb
->response_buffer
.data
);