Linux-libre 3.0.32-gnu1
[librecmc/linux-libre.git] / drivers / staging / mei / main.c
1 /*
2  *
3  * Intel Management Engine Interface (Intel MEI) Linux driver
4  * Copyright (c) 2003-2011, Intel Corporation.
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  */
16
17
18
19 #include <linux/module.h>
20 #include <linux/moduleparam.h>
21 #include <linux/kernel.h>
22 #include <linux/device.h>
23 #include <linux/fs.h>
24 #include <linux/errno.h>
25 #include <linux/types.h>
26 #include <linux/fcntl.h>
27 #include <linux/aio.h>
28 #include <linux/pci.h>
29 #include <linux/poll.h>
30 #include <linux/init.h>
31 #include <linux/ioctl.h>
32 #include <linux/cdev.h>
33 #include <linux/version.h>
34 #include <linux/sched.h>
35 #include <linux/uuid.h>
36 #include <linux/compat.h>
37 #include <linux/jiffies.h>
38 #include <linux/interrupt.h>
39
40 #include "mei_dev.h"
41 #include "mei.h"
42 #include "interface.h"
43 #include "mei_version.h"
44
45
46 #define MEI_READ_TIMEOUT 45
47 #define MEI_DRIVER_NAME "mei"
48 #define MEI_DEV_NAME "mei"
49
50 /*
51  *  mei driver strings
52  */
53 static char mei_driver_name[] = MEI_DRIVER_NAME;
54 static const char mei_driver_string[] = "Intel(R) Management Engine Interface";
55 static const char mei_driver_version[] = MEI_DRIVER_VERSION;
56
57 /* mei char device for registration */
58 static struct cdev mei_cdev;
59
60 /* major number for device */
61 static int mei_major;
62 /* The device pointer */
63 /* Currently this driver works as long as there is only a single AMT device. */
64 static struct pci_dev *mei_device;
65
66 static struct class *mei_class;
67
68
69 /* mei_pci_tbl - PCI Device ID Table */
70 static DEFINE_PCI_DEVICE_TABLE(mei_pci_tbl) = {
71         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82946GZ)},
72         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G35)},
73         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82Q965)},
74         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G965)},
75         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GM965)},
76         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GME965)},
77         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q35)},
78         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82G33)},
79         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q33)},
80         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82X38)},
81         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_3200)},
82         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_6)},
83         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_7)},
84         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_8)},
85         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_9)},
86         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_10)},
87         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_1)},
88         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_2)},
89         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_3)},
90         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_4)},
91         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_1)},
92         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_2)},
93         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_3)},
94         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_4)},
95         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_1)},
96         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_2)},
97         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_CPT_1)},
98         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PBG_1)},
99         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
100         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
101         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
102
103         /* required last entry */
104         {0, }
105 };
106
107 MODULE_DEVICE_TABLE(pci, mei_pci_tbl);
108
109 static DEFINE_MUTEX(mei_mutex);
110
111 /**
112  * mei_probe - Device Initialization Routine
113  *
114  * @pdev: PCI device structure
115  * @ent: entry in kcs_pci_tbl
116  *
117  * returns 0 on success, <0 on failure.
118  */
119 static int __devinit mei_probe(struct pci_dev *pdev,
120                                 const struct pci_device_id *ent)
121 {
122         struct mei_device *dev;
123         int err;
124
125         mutex_lock(&mei_mutex);
126         if (mei_device) {
127                 err = -EEXIST;
128                 goto end;
129         }
130         /* enable pci dev */
131         err = pci_enable_device(pdev);
132         if (err) {
133                 printk(KERN_ERR "mei: Failed to enable pci device.\n");
134                 goto end;
135         }
136         /* set PCI host mastering  */
137         pci_set_master(pdev);
138         /* pci request regions for mei driver */
139         err = pci_request_regions(pdev, mei_driver_name);
140         if (err) {
141                 printk(KERN_ERR "mei: Failed to get pci regions.\n");
142                 goto disable_device;
143         }
144         /* allocates and initializes the mei dev structure */
145         dev = init_mei_device(pdev);
146         if (!dev) {
147                 err = -ENOMEM;
148                 goto release_regions;
149         }
150         /* mapping  IO device memory */
151         dev->mem_addr = pci_iomap(pdev, 0, 0);
152         if (!dev->mem_addr) {
153                 printk(KERN_ERR "mei: mapping I/O device memory failure.\n");
154                 err = -ENOMEM;
155                 goto free_device;
156         }
157         /* request and enable interrupt   */
158         err = request_threaded_irq(pdev->irq,
159                         mei_interrupt_quick_handler,
160                         mei_interrupt_thread_handler,
161                         IRQF_SHARED, mei_driver_name, dev);
162         if (err) {
163                 printk(KERN_ERR "mei: request_threaded_irq failure. irq = %d\n",
164                        pdev->irq);
165                 goto unmap_memory;
166         }
167         INIT_DELAYED_WORK(&dev->wd_work, mei_wd_timer);
168         if (mei_hw_init(dev)) {
169                 printk(KERN_ERR "mei: Init hw failure.\n");
170                 err = -ENODEV;
171                 goto release_irq;
172         }
173         mei_device = pdev;
174         pci_set_drvdata(pdev, dev);
175         schedule_delayed_work(&dev->wd_work, HZ);
176
177         mutex_unlock(&mei_mutex);
178
179         pr_debug("mei: Driver initialization successful.\n");
180
181         return 0;
182
183 release_irq:
184         /* disable interrupts */
185         dev->host_hw_state = mei_hcsr_read(dev);
186         mei_disable_interrupts(dev);
187         flush_scheduled_work();
188         free_irq(pdev->irq, dev);
189 unmap_memory:
190         pci_iounmap(pdev, dev->mem_addr);
191 free_device:
192         kfree(dev);
193 release_regions:
194         pci_release_regions(pdev);
195 disable_device:
196         pci_disable_device(pdev);
197 end:
198         mutex_unlock(&mei_mutex);
199         printk(KERN_ERR "mei: Driver initialization failed.\n");
200         return err;
201 }
202
203 /**
204  * mei_remove - Device Removal Routine
205  *
206  * @pdev: PCI device structure
207  *
208  * mei_remove is called by the PCI subsystem to alert the driver
209  * that it should release a PCI device.
210  */
211 static void __devexit mei_remove(struct pci_dev *pdev)
212 {
213         struct mei_device *dev;
214
215         if (mei_device != pdev)
216                 return;
217
218         dev = pci_get_drvdata(pdev);
219         if (!dev)
220                 return;
221
222         mutex_lock(&dev->device_lock);
223
224         mei_wd_stop(dev, false);
225
226         mei_device = NULL;
227
228         if (dev->iamthif_cl.state == MEI_FILE_CONNECTED) {
229                 dev->iamthif_cl.state = MEI_FILE_DISCONNECTING;
230                 mei_disconnect_host_client(dev, &dev->iamthif_cl);
231         }
232         if (dev->wd_cl.state == MEI_FILE_CONNECTED) {
233                 dev->wd_cl.state = MEI_FILE_DISCONNECTING;
234                 mei_disconnect_host_client(dev, &dev->wd_cl);
235         }
236
237         /* remove entry if already in list */
238         dev_dbg(&pdev->dev, "list del iamthif and wd file list.\n");
239         mei_remove_client_from_file_list(dev, dev->wd_cl.host_client_id);
240         mei_remove_client_from_file_list(dev, dev->iamthif_cl.host_client_id);
241
242         dev->iamthif_current_cb = NULL;
243         dev->num_mei_me_clients = 0;
244
245         mutex_unlock(&dev->device_lock);
246
247         flush_scheduled_work();
248
249         /* disable interrupts */
250         mei_disable_interrupts(dev);
251
252         free_irq(pdev->irq, dev);
253         pci_set_drvdata(pdev, NULL);
254
255         if (dev->mem_addr)
256                 pci_iounmap(pdev, dev->mem_addr);
257
258         kfree(dev);
259
260         pci_release_regions(pdev);
261         pci_disable_device(pdev);
262 }
263
264 /**
265  * mei_clear_list - removes all callbacks associated with file
266  *              from mei_cb_list
267  *
268  * @dev: device structure.
269  * @file: file structure
270  * @mei_cb_list: callbacks list
271  *
272  * mei_clear_list is called to clear resources associated with file
273  * when application calls close function or Ctrl-C was pressed
274  *
275  * returns true if callback removed from the list, false otherwise
276  */
277 static bool mei_clear_list(struct mei_device *dev,
278                 struct file *file, struct list_head *mei_cb_list)
279 {
280         struct mei_cl_cb *cb_pos = NULL;
281         struct mei_cl_cb *cb_next = NULL;
282         struct file *file_temp;
283         bool removed = false;
284
285         /* list all list member */
286         list_for_each_entry_safe(cb_pos, cb_next, mei_cb_list, cb_list) {
287                 file_temp = (struct file *)cb_pos->file_object;
288                 /* check if list member associated with a file */
289                 if (file_temp == file) {
290                         /* remove member from the list */
291                         list_del(&cb_pos->cb_list);
292                         /* check if cb equal to current iamthif cb */
293                         if (dev->iamthif_current_cb == cb_pos) {
294                                 dev->iamthif_current_cb = NULL;
295                                 /* send flow control to iamthif client */
296                                 mei_send_flow_control(dev, &dev->iamthif_cl);
297                         }
298                         /* free all allocated buffers */
299                         mei_free_cb_private(cb_pos);
300                         cb_pos = NULL;
301                         removed = true;
302                 }
303         }
304         return removed;
305 }
306
307 /**
308  * mei_clear_lists - removes all callbacks associated with file
309  *
310  * @dev: device structure
311  * @file: file structure
312  *
313  * mei_clear_lists is called to clear resources associated with file
314  * when application calls close function or Ctrl-C was pressed
315  *
316  * returns true if callback removed from the list, false otherwise
317  */
318 static bool mei_clear_lists(struct mei_device *dev, struct file *file)
319 {
320         bool removed = false;
321
322         /* remove callbacks associated with a file */
323         mei_clear_list(dev, file, &dev->amthi_cmd_list.mei_cb.cb_list);
324         if (mei_clear_list(dev, file,
325                             &dev->amthi_read_complete_list.mei_cb.cb_list))
326                 removed = true;
327
328         mei_clear_list(dev, file, &dev->ctrl_rd_list.mei_cb.cb_list);
329
330         if (mei_clear_list(dev, file, &dev->ctrl_wr_list.mei_cb.cb_list))
331                 removed = true;
332
333         if (mei_clear_list(dev, file, &dev->write_waiting_list.mei_cb.cb_list))
334                 removed = true;
335
336         if (mei_clear_list(dev, file, &dev->write_list.mei_cb.cb_list))
337                 removed = true;
338
339         /* check if iamthif_current_cb not NULL */
340         if (dev->iamthif_current_cb && !removed) {
341                 /* check file and iamthif current cb association */
342                 if (dev->iamthif_current_cb->file_object == file) {
343                         /* remove cb */
344                         mei_free_cb_private(dev->iamthif_current_cb);
345                         dev->iamthif_current_cb = NULL;
346                         removed = true;
347                 }
348         }
349         return removed;
350 }
351 /**
352  * find_read_list_entry - find read list entry
353  *
354  * @dev: device structure
355  * @file: pointer to file structure
356  *
357  * returns cb on success, NULL on error
358  */
359 static struct mei_cl_cb *find_read_list_entry(
360                 struct mei_device *dev,
361                 struct mei_cl *cl)
362 {
363         struct mei_cl_cb *cb_pos = NULL;
364         struct mei_cl_cb *cb_next = NULL;
365         struct mei_cl *cl_list_temp;
366
367         if (!dev->read_list.status &&
368             !list_empty(&dev->read_list.mei_cb.cb_list)) {
369
370                 dev_dbg(&dev->pdev->dev, "remove read_list CB\n");
371                 list_for_each_entry_safe(cb_pos, cb_next,
372                                 &dev->read_list.mei_cb.cb_list, cb_list) {
373
374                         cl_list_temp = (struct mei_cl *)
375                                 cb_pos->file_private;
376
377                         if (cl_list_temp &&
378                             mei_fe_same_id(cl, cl_list_temp))
379                                 return cb_pos;
380
381                 }
382         }
383         return NULL;
384 }
385
386 /**
387  * mei_open - the open function
388  *
389  * @inode: pointer to inode structure
390  * @file: pointer to file structure
391  *
392  * returns 0 on success, <0 on error
393  */
394 static int mei_open(struct inode *inode, struct file *file)
395 {
396         struct mei_cl *cl;
397         int if_num = iminor(inode), err;
398         struct mei_device *dev;
399
400         err = -ENODEV;
401         if (!mei_device)
402                 goto out;
403
404         dev = pci_get_drvdata(mei_device);
405         if (if_num != MEI_MINOR_NUMBER || !dev)
406                 goto out;
407
408         mutex_lock(&dev->device_lock);
409         err = -ENOMEM;
410         cl = mei_alloc_file_private(dev);
411         if (!cl)
412                 goto out;
413
414         err = -ENODEV;
415         if (dev->mei_state != MEI_ENABLED) {
416                 dev_dbg(&dev->pdev->dev, "mei_state != MEI_ENABLED  mei_state= %d\n",
417                     dev->mei_state);
418                 goto out_unlock;
419         }
420         err = -EMFILE;
421         if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT)
422                 goto out_unlock;
423
424         cl->host_client_id = find_first_zero_bit(dev->host_clients_map,
425                                                         MEI_CLIENTS_MAX);
426         if (cl->host_client_id > MEI_CLIENTS_MAX)
427                 goto out_unlock;
428
429         dev_dbg(&dev->pdev->dev, "client_id = %d\n", cl->host_client_id);
430
431         dev->open_handle_count++;
432         list_add_tail(&cl->link, &dev->file_list);
433
434         set_bit(cl->host_client_id, dev->host_clients_map);
435         cl->state = MEI_FILE_INITIALIZING;
436         cl->sm_state = 0;
437
438         file->private_data = cl;
439         mutex_unlock(&dev->device_lock);
440
441         return 0;
442
443 out_unlock:
444         mutex_unlock(&dev->device_lock);
445         kfree(cl);
446 out:
447         return err;
448 }
449
450 /**
451  * mei_release - the release function
452  *
453  * @inode: pointer to inode structure
454  * @file: pointer to file structure
455  *
456  * returns 0 on success, <0 on error
457  */
458 static int mei_release(struct inode *inode, struct file *file)
459 {
460         struct mei_cl *cl = file->private_data;
461         struct mei_cl_cb *cb;
462         struct mei_device *dev;
463         int rets = 0;
464
465         if (WARN_ON(!cl || !cl->dev))
466                 return -ENODEV;
467
468         dev = cl->dev;
469
470         mutex_lock(&dev->device_lock);
471         if (cl != &dev->iamthif_cl) {
472                 if (cl->state == MEI_FILE_CONNECTED) {
473                         cl->state = MEI_FILE_DISCONNECTING;
474                         dev_dbg(&dev->pdev->dev,
475                                 "disconnecting client host client = %d, "
476                             "ME client = %d\n",
477                             cl->host_client_id,
478                             cl->me_client_id);
479                         rets = mei_disconnect_host_client(dev, cl);
480                 }
481                 mei_flush_queues(dev, cl);
482                 dev_dbg(&dev->pdev->dev, "remove client host client = %d, ME client = %d\n",
483                     cl->host_client_id,
484                     cl->me_client_id);
485
486                 if (dev->open_handle_count > 0) {
487                         clear_bit(cl->host_client_id,
488                                   dev->host_clients_map);
489                         dev->open_handle_count--;
490                 }
491                 mei_remove_client_from_file_list(dev, cl->host_client_id);
492
493                 /* free read cb */
494                 cb = NULL;
495                 if (cl->read_cb) {
496                         cb = find_read_list_entry(dev, cl);
497                         /* Remove entry from read list */
498                         if (cb)
499                                 list_del(&cb->cb_list);
500
501                         cb = cl->read_cb;
502                         cl->read_cb = NULL;
503                 }
504
505                 file->private_data = NULL;
506
507                 if (cb) {
508                         mei_free_cb_private(cb);
509                         cb = NULL;
510                 }
511
512                 kfree(cl);
513         } else {
514                 if (dev->open_handle_count > 0)
515                         dev->open_handle_count--;
516
517                 if (dev->iamthif_file_object == file &&
518                     dev->iamthif_state != MEI_IAMTHIF_IDLE) {
519
520                         dev_dbg(&dev->pdev->dev, "amthi canceled iamthif state %d\n",
521                             dev->iamthif_state);
522                         dev->iamthif_canceled = 1;
523                         if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE) {
524                                 dev_dbg(&dev->pdev->dev, "run next amthi iamthif cb\n");
525                                 run_next_iamthif_cmd(dev);
526                         }
527                 }
528
529                 if (mei_clear_lists(dev, file))
530                         dev->iamthif_state = MEI_IAMTHIF_IDLE;
531
532         }
533         mutex_unlock(&dev->device_lock);
534         return rets;
535 }
536
537
538 /**
539  * mei_read - the read function.
540  *
541  * @file: pointer to file structure
542  * @ubuf: pointer to user buffer
543  * @length: buffer length
544  * @offset: data offset in buffer
545  *
546  * returns >=0 data length on success , <0 on error
547  */
548 static ssize_t mei_read(struct file *file, char __user *ubuf,
549                          size_t length, loff_t *offset)
550 {
551         struct mei_cl *cl = file->private_data;
552         struct mei_cl_cb *cb_pos = NULL;
553         struct mei_cl_cb *cb = NULL;
554         struct mei_device *dev;
555         int i;
556         int rets;
557         int err;
558
559
560         if (WARN_ON(!cl || !cl->dev))
561                 return -ENODEV;
562
563         dev = cl->dev;
564
565         mutex_lock(&dev->device_lock);
566         if (dev->mei_state != MEI_ENABLED) {
567                 rets = -ENODEV;
568                 goto out;
569         }
570
571         if ((cl->sm_state & MEI_WD_STATE_INDEPENDENCE_MSG_SENT) == 0) {
572                 /* Do not allow to read watchdog client */
573                 i = mei_find_me_client_index(dev, mei_wd_guid);
574                 if (i >= 0) {
575                         struct mei_me_client *me_client = &dev->me_clients[i];
576
577                         if (cl->me_client_id == me_client->client_id) {
578                                 rets = -EBADF;
579                                 goto out;
580                         }
581                 }
582         } else {
583                 cl->sm_state &= ~MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
584         }
585
586         if (cl == &dev->iamthif_cl) {
587                 rets = amthi_read(dev, file, ubuf, length, offset);
588                 goto out;
589         }
590
591         if (cl->read_cb && cl->read_cb->information > *offset) {
592                 cb = cl->read_cb;
593                 goto copy_buffer;
594         } else if (cl->read_cb && cl->read_cb->information > 0 &&
595                    cl->read_cb->information <= *offset) {
596                 cb = cl->read_cb;
597                 rets = 0;
598                 goto free;
599         } else if ((!cl->read_cb || !cl->read_cb->information) &&
600                     *offset > 0) {
601                 /*Offset needs to be cleaned for contingous reads*/
602                 *offset = 0;
603                 rets = 0;
604                 goto out;
605         }
606
607         err = mei_start_read(dev, cl);
608         if (err && err != -EBUSY) {
609                 dev_dbg(&dev->pdev->dev,
610                         "mei start read failure with status = %d\n", err);
611                 rets = err;
612                 goto out;
613         }
614
615         if (MEI_READ_COMPLETE != cl->reading_state &&
616                         !waitqueue_active(&cl->rx_wait)) {
617                 if (file->f_flags & O_NONBLOCK) {
618                         rets = -EAGAIN;
619                         goto out;
620                 }
621
622                 mutex_unlock(&dev->device_lock);
623
624                 if (wait_event_interruptible(cl->rx_wait,
625                         (MEI_READ_COMPLETE == cl->reading_state ||
626                          MEI_FILE_INITIALIZING == cl->state ||
627                          MEI_FILE_DISCONNECTED == cl->state ||
628                          MEI_FILE_DISCONNECTING == cl->state))) {
629                         if (signal_pending(current))
630                                 return -EINTR;
631                         return -ERESTARTSYS;
632                 }
633
634                 mutex_lock(&dev->device_lock);
635                 if (MEI_FILE_INITIALIZING == cl->state ||
636                     MEI_FILE_DISCONNECTED == cl->state ||
637                     MEI_FILE_DISCONNECTING == cl->state) {
638                         rets = -EBUSY;
639                         goto out;
640                 }
641         }
642
643         cb = cl->read_cb;
644
645         if (!cb) {
646                 rets = -ENODEV;
647                 goto out;
648         }
649         if (cl->reading_state != MEI_READ_COMPLETE) {
650                 rets = 0;
651                 goto out;
652         }
653         /* now copy the data to user space */
654 copy_buffer:
655         dev_dbg(&dev->pdev->dev, "cb->response_buffer size - %d\n",
656             cb->response_buffer.size);
657         dev_dbg(&dev->pdev->dev, "cb->information - %lu\n",
658             cb->information);
659         if (length == 0 || ubuf == NULL || *offset > cb->information) {
660                 rets = -EMSGSIZE;
661                 goto free;
662         }
663
664         /* length is being turncated to PAGE_SIZE, however, */
665         /* information size may be longer */
666         length = min_t(size_t, length, (cb->information - *offset));
667
668         if (copy_to_user(ubuf,
669                          cb->response_buffer.data + *offset,
670                          length)) {
671                 rets = -EFAULT;
672                 goto free;
673         }
674
675         rets = length;
676         *offset += length;
677         if ((unsigned long)*offset < cb->information)
678                 goto out;
679
680 free:
681         cb_pos = find_read_list_entry(dev, cl);
682         /* Remove entry from read list */
683         if (cb_pos)
684                 list_del(&cb_pos->cb_list);
685         mei_free_cb_private(cb);
686         cl->reading_state = MEI_IDLE;
687         cl->read_cb = NULL;
688         cl->read_pending = 0;
689 out:
690         dev_dbg(&dev->pdev->dev, "end mei read rets= %d\n", rets);
691         mutex_unlock(&dev->device_lock);
692         return rets;
693 }
694
695 /**
696  * mei_write - the write function.
697  *
698  * @file: pointer to file structure
699  * @ubuf: pointer to user buffer
700  * @length: buffer length
701  * @offset: data offset in buffer
702  *
703  * returns >=0 data length on success , <0 on error
704  */
705 static ssize_t mei_write(struct file *file, const char __user *ubuf,
706                           size_t length, loff_t *offset)
707 {
708         struct mei_cl *cl = file->private_data;
709         struct mei_cl_cb *write_cb = NULL;
710         struct mei_msg_hdr mei_hdr;
711         struct mei_device *dev;
712         unsigned long timeout = 0;
713         int rets;
714         int i;
715
716         if (WARN_ON(!cl || !cl->dev))
717                 return -ENODEV;
718
719         dev = cl->dev;
720
721         mutex_lock(&dev->device_lock);
722
723         if (dev->mei_state != MEI_ENABLED) {
724                 mutex_unlock(&dev->device_lock);
725                 return -ENODEV;
726         }
727
728         if (cl == &dev->iamthif_cl) {
729                 write_cb = find_amthi_read_list_entry(dev, file);
730
731                 if (write_cb) {
732                         timeout = write_cb->read_time +
733                                         msecs_to_jiffies(IAMTHIF_READ_TIMER);
734
735                         if (time_after(jiffies, timeout) ||
736                                  cl->reading_state == MEI_READ_COMPLETE) {
737                                         *offset = 0;
738                                         list_del(&write_cb->cb_list);
739                                         mei_free_cb_private(write_cb);
740                                         write_cb = NULL;
741                         }
742                 }
743         }
744
745         /* free entry used in read */
746         if (cl->reading_state == MEI_READ_COMPLETE) {
747                 *offset = 0;
748                 write_cb = find_read_list_entry(dev, cl);
749                 if (write_cb) {
750                         list_del(&write_cb->cb_list);
751                         mei_free_cb_private(write_cb);
752                         write_cb = NULL;
753                         cl->reading_state = MEI_IDLE;
754                         cl->read_cb = NULL;
755                         cl->read_pending = 0;
756                 }
757         } else if (cl->reading_state == MEI_IDLE &&
758                    !cl->read_pending)
759                 *offset = 0;
760
761
762         write_cb = kzalloc(sizeof(struct mei_cl_cb), GFP_KERNEL);
763         if (!write_cb) {
764                 mutex_unlock(&dev->device_lock);
765                 return -ENOMEM;
766         }
767
768         write_cb->file_object = file;
769         write_cb->file_private = cl;
770         write_cb->request_buffer.data = kmalloc(length, GFP_KERNEL);
771         rets = -ENOMEM;
772         if (!write_cb->request_buffer.data)
773                 goto unlock_dev;
774
775         dev_dbg(&dev->pdev->dev, "length =%d\n", (int) length);
776
777         rets = -EFAULT;
778         if (copy_from_user(write_cb->request_buffer.data, ubuf, length))
779                 goto unlock_dev;
780
781         cl->sm_state = 0;
782         if (length == 4 &&
783             ((memcmp(mei_wd_state_independence_msg[0],
784                                  write_cb->request_buffer.data, 4) == 0) ||
785              (memcmp(mei_wd_state_independence_msg[1],
786                                  write_cb->request_buffer.data, 4) == 0) ||
787              (memcmp(mei_wd_state_independence_msg[2],
788                                  write_cb->request_buffer.data, 4) == 0)))
789                 cl->sm_state |= MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
790
791         INIT_LIST_HEAD(&write_cb->cb_list);
792         if (cl == &dev->iamthif_cl) {
793                 write_cb->response_buffer.data =
794                     kmalloc(dev->iamthif_mtu, GFP_KERNEL);
795                 if (!write_cb->response_buffer.data) {
796                         rets = -ENOMEM;
797                         goto unlock_dev;
798                 }
799                 if (dev->mei_state != MEI_ENABLED) {
800                         rets = -ENODEV;
801                         goto unlock_dev;
802                 }
803                 for (i = 0; i < dev->num_mei_me_clients; i++) {
804                         if (dev->me_clients[i].client_id ==
805                                 dev->iamthif_cl.me_client_id)
806                                 break;
807                 }
808
809                 if (WARN_ON(dev->me_clients[i].client_id != cl->me_client_id)) {
810                         rets = -ENODEV;
811                         goto unlock_dev;
812                 }
813                 if (i == dev->num_mei_me_clients ||
814                     (dev->me_clients[i].client_id !=
815                       dev->iamthif_cl.me_client_id)) {
816                         rets = -ENODEV;
817                         goto unlock_dev;
818                 } else if (length > dev->me_clients[i].props.max_msg_length ||
819                            length <= 0) {
820                         rets = -EMSGSIZE;
821                         goto unlock_dev;
822                 }
823
824                 write_cb->response_buffer.size = dev->iamthif_mtu;
825                 write_cb->major_file_operations = MEI_IOCTL;
826                 write_cb->information = 0;
827                 write_cb->request_buffer.size = length;
828                 if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) {
829                         rets = -ENODEV;
830                         goto unlock_dev;
831                 }
832
833                 if (!list_empty(&dev->amthi_cmd_list.mei_cb.cb_list) ||
834                                 dev->iamthif_state != MEI_IAMTHIF_IDLE) {
835                         dev_dbg(&dev->pdev->dev, "amthi_state = %d\n",
836                                         (int) dev->iamthif_state);
837                         dev_dbg(&dev->pdev->dev, "add amthi cb to amthi cmd waiting list\n");
838                         list_add_tail(&write_cb->cb_list,
839                                         &dev->amthi_cmd_list.mei_cb.cb_list);
840                         rets = length;
841                 } else {
842                         dev_dbg(&dev->pdev->dev, "call amthi write\n");
843                         rets = amthi_write(dev, write_cb);
844
845                         if (rets) {
846                                 dev_dbg(&dev->pdev->dev, "amthi write failed with status = %d\n",
847                                     rets);
848                                 goto unlock_dev;
849                         }
850                         rets = length;
851                 }
852                 mutex_unlock(&dev->device_lock);
853                 return rets;
854         }
855
856         write_cb->major_file_operations = MEI_WRITE;
857         /* make sure information is zero before we start */
858
859         write_cb->information = 0;
860         write_cb->request_buffer.size = length;
861
862         dev_dbg(&dev->pdev->dev, "host client = %d, ME client = %d\n",
863             cl->host_client_id, cl->me_client_id);
864         if (cl->state != MEI_FILE_CONNECTED) {
865                 rets = -ENODEV;
866                 dev_dbg(&dev->pdev->dev, "host client = %d,  is not connected to ME client = %d",
867                     cl->host_client_id,
868                     cl->me_client_id);
869                 goto unlock_dev;
870         }
871         for (i = 0; i < dev->num_mei_me_clients; i++) {
872                 if (dev->me_clients[i].client_id ==
873                     cl->me_client_id)
874                         break;
875         }
876         if (WARN_ON(dev->me_clients[i].client_id != cl->me_client_id)) {
877                 rets = -ENODEV;
878                 goto unlock_dev;
879         }
880         if (i == dev->num_mei_me_clients) {
881                 rets = -ENODEV;
882                 goto unlock_dev;
883         }
884         if (length > dev->me_clients[i].props.max_msg_length || length <= 0) {
885                 rets = -EINVAL;
886                 goto unlock_dev;
887         }
888         write_cb->file_private = cl;
889
890         rets = mei_flow_ctrl_creds(dev, cl);
891         if (rets < 0)
892                 goto unlock_dev;
893
894         if (rets && dev->mei_host_buffer_is_empty) {
895                 rets = 0;
896                 dev->mei_host_buffer_is_empty = 0;
897                 if (length > ((((dev->host_hw_state & H_CBD) >> 24) *
898                         sizeof(u32)) - sizeof(struct mei_msg_hdr))) {
899
900                         mei_hdr.length =
901                                 (((dev->host_hw_state & H_CBD) >> 24) *
902                                 sizeof(u32)) -
903                                 sizeof(struct mei_msg_hdr);
904                         mei_hdr.msg_complete = 0;
905                 } else {
906                         mei_hdr.length = length;
907                         mei_hdr.msg_complete = 1;
908                 }
909                 mei_hdr.host_addr = cl->host_client_id;
910                 mei_hdr.me_addr = cl->me_client_id;
911                 mei_hdr.reserved = 0;
912                 dev_dbg(&dev->pdev->dev, "call mei_write_message header=%08x.\n",
913                     *((u32 *) &mei_hdr));
914                 if (!mei_write_message(dev, &mei_hdr,
915                         (unsigned char *) (write_cb->request_buffer.data),
916                         mei_hdr.length)) {
917                         rets = -ENODEV;
918                         goto unlock_dev;
919                 }
920                 cl->writing_state = MEI_WRITING;
921                 write_cb->information = mei_hdr.length;
922                 if (mei_hdr.msg_complete) {
923                         if (mei_flow_ctrl_reduce(dev, cl)) {
924                                 rets = -ENODEV;
925                                 goto unlock_dev;
926                         }
927                         list_add_tail(&write_cb->cb_list,
928                                       &dev->write_waiting_list.mei_cb.cb_list);
929                 } else {
930                         list_add_tail(&write_cb->cb_list,
931                                       &dev->write_list.mei_cb.cb_list);
932                 }
933
934         } else {
935
936                 write_cb->information = 0;
937                 cl->writing_state = MEI_WRITING;
938                 list_add_tail(&write_cb->cb_list,
939                               &dev->write_list.mei_cb.cb_list);
940         }
941         mutex_unlock(&dev->device_lock);
942         return length;
943
944 unlock_dev:
945         mutex_unlock(&dev->device_lock);
946         mei_free_cb_private(write_cb);
947         return rets;
948 }
949
950
951 /**
952  * mei_ioctl - the IOCTL function
953  *
954  * @file: pointer to file structure
955  * @cmd: ioctl command
956  * @data: pointer to mei message structure
957  *
958  * returns 0 on success , <0 on error
959  */
960 static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
961 {
962         struct mei_device *dev;
963         struct mei_cl *cl = file->private_data;
964         struct mei_connect_client_data *connect_data = NULL;
965         int rets;
966
967         if (cmd != IOCTL_MEI_CONNECT_CLIENT)
968                 return -EINVAL;
969
970         if (WARN_ON(!cl || !cl->dev))
971                 return -ENODEV;
972
973         dev = cl->dev;
974
975         dev_dbg(&dev->pdev->dev, "IOCTL cmd = 0x%x", cmd);
976
977         mutex_lock(&dev->device_lock);
978         if (dev->mei_state != MEI_ENABLED) {
979                 rets = -ENODEV;
980                 goto out;
981         }
982
983         dev_dbg(&dev->pdev->dev, ": IOCTL_MEI_CONNECT_CLIENT.\n");
984
985         connect_data = kzalloc(sizeof(struct mei_connect_client_data),
986                                                         GFP_KERNEL);
987         if (!connect_data) {
988                 rets = -ENOMEM;
989                 goto out;
990         }
991         dev_dbg(&dev->pdev->dev, "copy connect data from user\n");
992         if (copy_from_user(connect_data, (char __user *)data,
993                                 sizeof(struct mei_connect_client_data))) {
994                 dev_dbg(&dev->pdev->dev, "failed to copy data from userland\n");
995                 rets = -EFAULT;
996                 goto out;
997         }
998         rets = mei_ioctl_connect_client(file, connect_data);
999
1000         /* if all is ok, copying the data back to user. */
1001         if (rets)
1002                 goto out;
1003
1004         dev_dbg(&dev->pdev->dev, "copy connect data to user\n");
1005         if (copy_to_user((char __user *)data, connect_data,
1006                                 sizeof(struct mei_connect_client_data))) {
1007                 dev_dbg(&dev->pdev->dev, "failed to copy data to userland\n");
1008                 rets = -EFAULT;
1009                 goto out;
1010         }
1011
1012 out:
1013         kfree(connect_data);
1014         mutex_unlock(&dev->device_lock);
1015         return rets;
1016 }
1017
1018 /**
1019  * mei_compat_ioctl - the compat IOCTL function
1020  *
1021  * @file: pointer to file structure
1022  * @cmd: ioctl command
1023  * @data: pointer to mei message structure
1024  *
1025  * returns 0 on success , <0 on error
1026  */
1027 #ifdef CONFIG_COMPAT
1028 static long mei_compat_ioctl(struct file *file,
1029                       unsigned int cmd, unsigned long data)
1030 {
1031         return mei_ioctl(file, cmd, (unsigned long)compat_ptr(data));
1032 }
1033 #endif
1034
1035
1036 /**
1037  * mei_poll - the poll function
1038  *
1039  * @file: pointer to file structure
1040  * @wait: pointer to poll_table structure
1041  *
1042  * returns poll mask
1043  */
1044 static unsigned int mei_poll(struct file *file, poll_table *wait)
1045 {
1046         struct mei_cl *cl = file->private_data;
1047         struct mei_device *dev;
1048         unsigned int mask = 0;
1049
1050         if (WARN_ON(!cl || !cl->dev))
1051                 return mask;
1052
1053         dev = cl->dev;
1054
1055         mutex_lock(&dev->device_lock);
1056
1057         if (dev->mei_state != MEI_ENABLED)
1058                 goto out;
1059
1060
1061         if (cl == &dev->iamthif_cl) {
1062                 mutex_unlock(&dev->device_lock);
1063                 poll_wait(file, &dev->iamthif_cl.wait, wait);
1064                 mutex_lock(&dev->device_lock);
1065                 if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE &&
1066                         dev->iamthif_file_object == file) {
1067                         mask |= (POLLIN | POLLRDNORM);
1068                         dev_dbg(&dev->pdev->dev, "run next amthi cb\n");
1069                         run_next_iamthif_cmd(dev);
1070                 }
1071                 goto out;
1072         }
1073
1074         mutex_unlock(&dev->device_lock);
1075         poll_wait(file, &cl->tx_wait, wait);
1076         mutex_lock(&dev->device_lock);
1077         if (MEI_WRITE_COMPLETE == cl->writing_state)
1078                 mask |= (POLLIN | POLLRDNORM);
1079
1080 out:
1081         mutex_unlock(&dev->device_lock);
1082         return mask;
1083 }
1084
1085 #ifdef CONFIG_PM
1086 static int mei_pci_suspend(struct device *device)
1087 {
1088         struct pci_dev *pdev = to_pci_dev(device);
1089         struct mei_device *dev = pci_get_drvdata(pdev);
1090         int err;
1091
1092         if (!dev)
1093                 return -ENODEV;
1094         mutex_lock(&dev->device_lock);
1095         /* Stop watchdog if exists */
1096         err = mei_wd_stop(dev, true);
1097         /* Set new mei state */
1098         if (dev->mei_state == MEI_ENABLED ||
1099             dev->mei_state == MEI_RECOVERING_FROM_RESET) {
1100                 dev->mei_state = MEI_POWER_DOWN;
1101                 mei_reset(dev, 0);
1102         }
1103         mutex_unlock(&dev->device_lock);
1104
1105         free_irq(pdev->irq, dev);
1106
1107
1108         return err;
1109 }
1110
1111 static int mei_pci_resume(struct device *device)
1112 {
1113         struct pci_dev *pdev = to_pci_dev(device);
1114         struct mei_device *dev;
1115         int err;
1116
1117         dev = pci_get_drvdata(pdev);
1118         if (!dev)
1119                 return -ENODEV;
1120
1121         /* request and enable interrupt   */
1122         err = request_threaded_irq(pdev->irq,
1123                         mei_interrupt_quick_handler,
1124                         mei_interrupt_thread_handler,
1125                         IRQF_SHARED, mei_driver_name, dev);
1126         if (err) {
1127                 printk(KERN_ERR "mei: Request_irq failure. irq = %d\n",
1128                        pdev->irq);
1129                 return err;
1130         }
1131
1132         mutex_lock(&dev->device_lock);
1133         dev->mei_state = MEI_POWER_UP;
1134         mei_reset(dev, 1);
1135         mutex_unlock(&dev->device_lock);
1136
1137         /* Start watchdog if stopped in suspend */
1138         if (dev->wd_timeout) {
1139                 mei_wd_start_setup(dev);
1140                 dev->wd_due_counter = 1;
1141                 schedule_delayed_work(&dev->wd_work, HZ);
1142         }
1143         return err;
1144 }
1145 static SIMPLE_DEV_PM_OPS(mei_pm_ops, mei_pci_suspend, mei_pci_resume);
1146 #define MEI_PM_OPS      (&mei_pm_ops)
1147 #else
1148 #define MEI_PM_OPS      NULL
1149 #endif /* CONFIG_PM */
1150 /*
1151  *  PCI driver structure
1152  */
1153 static struct pci_driver mei_driver = {
1154         .name = mei_driver_name,
1155         .id_table = mei_pci_tbl,
1156         .probe = mei_probe,
1157         .remove = __devexit_p(mei_remove),
1158         .shutdown = __devexit_p(mei_remove),
1159         .driver.pm = MEI_PM_OPS,
1160 };
1161
1162 /*
1163  * file operations structure will be used for mei char device.
1164  */
1165 static const struct file_operations mei_fops = {
1166         .owner = THIS_MODULE,
1167         .read = mei_read,
1168         .unlocked_ioctl = mei_ioctl,
1169 #ifdef CONFIG_COMPAT
1170         .compat_ioctl = mei_compat_ioctl,
1171 #endif
1172         .open = mei_open,
1173         .release = mei_release,
1174         .write = mei_write,
1175         .poll = mei_poll,
1176 };
1177
1178 /**
1179  * mei_registration_cdev - sets up the cdev structure for mei device.
1180  *
1181  * @dev: char device struct
1182  * @hminor: minor number for registration char device
1183  * @fops: file operations structure
1184  *
1185  * returns 0 on success, <0 on failure.
1186  */
1187 static int mei_registration_cdev(struct cdev *dev, int hminor,
1188                                   const struct file_operations *fops)
1189 {
1190         int ret, devno = MKDEV(mei_major, hminor);
1191
1192         cdev_init(dev, fops);
1193         dev->owner = THIS_MODULE;
1194         ret = cdev_add(dev, devno, 1);
1195         /* Fail gracefully if need be */
1196         if (ret)
1197                 printk(KERN_ERR "mei: Error %d registering mei device %d\n",
1198                        ret, hminor);
1199         return ret;
1200 }
1201
1202 /**
1203  * mei_register_cdev - registers mei char device
1204  *
1205  * returns 0 on success, <0 on failure.
1206  */
1207 static int mei_register_cdev(void)
1208 {
1209         int ret;
1210         dev_t dev;
1211
1212         /* registration of char devices */
1213         ret = alloc_chrdev_region(&dev, MEI_MINORS_BASE, MEI_MINORS_COUNT,
1214                                   MEI_DRIVER_NAME);
1215         if (ret) {
1216                 printk(KERN_ERR "mei: Error allocating char device region.\n");
1217                 return ret;
1218         }
1219
1220         mei_major = MAJOR(dev);
1221
1222         ret = mei_registration_cdev(&mei_cdev, MEI_MINOR_NUMBER,
1223                                      &mei_fops);
1224         if (ret)
1225                 unregister_chrdev_region(MKDEV(mei_major, MEI_MINORS_BASE),
1226                                          MEI_MINORS_COUNT);
1227
1228         return ret;
1229 }
1230
1231 /**
1232  * mei_unregister_cdev - unregisters mei char device
1233  */
1234 static void mei_unregister_cdev(void)
1235 {
1236         cdev_del(&mei_cdev);
1237         unregister_chrdev_region(MKDEV(mei_major, MEI_MINORS_BASE),
1238                                  MEI_MINORS_COUNT);
1239 }
1240
1241 /**
1242  * mei_sysfs_device_create - adds device entry to sysfs
1243  *
1244  * returns 0 on success, <0 on failure.
1245  */
1246 static int mei_sysfs_device_create(void)
1247 {
1248         struct class *class;
1249         void *tmphdev;
1250         int err;
1251
1252         class = class_create(THIS_MODULE, MEI_DRIVER_NAME);
1253         if (IS_ERR(class)) {
1254                 err = PTR_ERR(class);
1255                 printk(KERN_ERR "mei: Error creating mei class.\n");
1256                 goto err_out;
1257         }
1258
1259         tmphdev = device_create(class, NULL, mei_cdev.dev, NULL,
1260                                         MEI_DEV_NAME);
1261         if (IS_ERR(tmphdev)) {
1262                 err = PTR_ERR(tmphdev);
1263                 goto err_destroy;
1264         }
1265
1266         mei_class = class;
1267         return 0;
1268
1269 err_destroy:
1270         class_destroy(class);
1271 err_out:
1272         return err;
1273 }
1274
1275 /**
1276  * mei_sysfs_device_remove - unregisters the device entry on sysfs
1277  */
1278 static void mei_sysfs_device_remove(void)
1279 {
1280         if (IS_ERR_OR_NULL(mei_class))
1281                 return;
1282
1283         device_destroy(mei_class, mei_cdev.dev);
1284         class_destroy(mei_class);
1285 }
1286
1287 /**
1288  * mei_init_module - Driver Registration Routine
1289  *
1290  * mei_init_module is the first routine called when the driver is
1291  * loaded. All it does is to register with the PCI subsystem.
1292  *
1293  * returns 0 on success, <0 on failure.
1294  */
1295 static int __init mei_init_module(void)
1296 {
1297         int ret;
1298
1299         pr_debug("mei: %s - version %s\n",
1300                 mei_driver_string, mei_driver_version);
1301         /* init pci module */
1302         ret = pci_register_driver(&mei_driver);
1303         if (ret < 0) {
1304                 printk(KERN_ERR "mei: Error registering driver.\n");
1305                 goto end;
1306         }
1307
1308         ret = mei_register_cdev();
1309         if (ret)
1310                 goto unregister_pci;
1311
1312         ret = mei_sysfs_device_create();
1313         if (ret)
1314                 goto unregister_cdev;
1315
1316         return ret;
1317
1318 unregister_cdev:
1319         mei_unregister_cdev();
1320 unregister_pci:
1321         pci_unregister_driver(&mei_driver);
1322 end:
1323         return ret;
1324 }
1325
1326 module_init(mei_init_module);
1327
1328 /**
1329  * mei_exit_module - Driver Exit Cleanup Routine
1330  *
1331  * mei_exit_module is called just before the driver is removed
1332  * from memory.
1333  */
1334 static void __exit mei_exit_module(void)
1335 {
1336         pci_unregister_driver(&mei_driver);
1337         mei_sysfs_device_remove();
1338         mei_unregister_cdev();
1339
1340         pr_debug("mei: Driver unloaded successfully.\n");
1341 }
1342
1343 module_exit(mei_exit_module);
1344
1345
1346 MODULE_AUTHOR("Intel Corporation");
1347 MODULE_DESCRIPTION("Intel(R) Management Engine Interface");
1348 MODULE_LICENSE("GPL v2");
1349 MODULE_VERSION(MEI_DRIVER_VERSION);