Merge branch 'for-linus' of git://git.kernel.dk/linux-block
[pandora-kernel.git] / drivers / staging / mei / main.c
1 /*
2  *
3  * Intel Management Engine Interface (Intel MEI) Linux driver
4  * Copyright (c) 2003-2011, Intel Corporation.
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  */
16
17 #include <linux/module.h>
18 #include <linux/moduleparam.h>
19 #include <linux/kernel.h>
20 #include <linux/device.h>
21 #include <linux/fs.h>
22 #include <linux/errno.h>
23 #include <linux/types.h>
24 #include <linux/fcntl.h>
25 #include <linux/aio.h>
26 #include <linux/pci.h>
27 #include <linux/poll.h>
28 #include <linux/init.h>
29 #include <linux/ioctl.h>
30 #include <linux/cdev.h>
31 #include <linux/sched.h>
32 #include <linux/uuid.h>
33 #include <linux/compat.h>
34 #include <linux/jiffies.h>
35 #include <linux/interrupt.h>
36
37 #include "mei_dev.h"
38 #include "mei.h"
39 #include "interface.h"
40 #include "mei_version.h"
41
42
43 #define MEI_READ_TIMEOUT 45
44 #define MEI_DRIVER_NAME "mei"
45 #define MEI_DEV_NAME "mei"
46
47 /*
48  *  mei driver strings
49  */
50 static char mei_driver_name[] = MEI_DRIVER_NAME;
51 static const char mei_driver_string[] = "Intel(R) Management Engine Interface";
52 static const char mei_driver_version[] = MEI_DRIVER_VERSION;
53
54 /* mei char device for registration */
55 static struct cdev mei_cdev;
56
57 /* major number for device */
58 static int mei_major;
59 /* The device pointer */
60 /* Currently this driver works as long as there is only a single AMT device. */
61 static struct pci_dev *mei_device;
62
63 static struct class *mei_class;
64
65
66 /* mei_pci_tbl - PCI Device ID Table */
67 static DEFINE_PCI_DEVICE_TABLE(mei_pci_tbl) = {
68         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82946GZ)},
69         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G35)},
70         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82Q965)},
71         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82G965)},
72         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GM965)},
73         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_82GME965)},
74         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q35)},
75         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82G33)},
76         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82Q33)},
77         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_82X38)},
78         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_3200)},
79         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_6)},
80         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_7)},
81         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_8)},
82         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_9)},
83         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9_10)},
84         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_1)},
85         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_2)},
86         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_3)},
87         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH9M_4)},
88         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_1)},
89         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_2)},
90         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_3)},
91         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_ICH10_4)},
92         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_1)},
93         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_IBXPK_2)},
94         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_CPT_1)},
95         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PBG_1)},
96         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
97         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
98         {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
99
100         /* required last entry */
101         {0, }
102 };
103
104 MODULE_DEVICE_TABLE(pci, mei_pci_tbl);
105
106 static DEFINE_MUTEX(mei_mutex);
107
108 /**
109  * mei_probe - Device Initialization Routine
110  *
111  * @pdev: PCI device structure
112  * @ent: entry in kcs_pci_tbl
113  *
114  * returns 0 on success, <0 on failure.
115  */
116 static int __devinit mei_probe(struct pci_dev *pdev,
117                                 const struct pci_device_id *ent)
118 {
119         struct mei_device *dev;
120         int err;
121
122         mutex_lock(&mei_mutex);
123         if (mei_device) {
124                 err = -EEXIST;
125                 goto end;
126         }
127         /* enable pci dev */
128         err = pci_enable_device(pdev);
129         if (err) {
130                 printk(KERN_ERR "mei: Failed to enable pci device.\n");
131                 goto end;
132         }
133         /* set PCI host mastering  */
134         pci_set_master(pdev);
135         /* pci request regions for mei driver */
136         err = pci_request_regions(pdev, mei_driver_name);
137         if (err) {
138                 printk(KERN_ERR "mei: Failed to get pci regions.\n");
139                 goto disable_device;
140         }
141         /* allocates and initializes the mei dev structure */
142         dev = mei_device_init(pdev);
143         if (!dev) {
144                 err = -ENOMEM;
145                 goto release_regions;
146         }
147         /* mapping  IO device memory */
148         dev->mem_addr = pci_iomap(pdev, 0, 0);
149         if (!dev->mem_addr) {
150                 printk(KERN_ERR "mei: mapping I/O device memory failure.\n");
151                 err = -ENOMEM;
152                 goto free_device;
153         }
154         /* request and enable interrupt   */
155         err = request_threaded_irq(pdev->irq,
156                         mei_interrupt_quick_handler,
157                         mei_interrupt_thread_handler,
158                         IRQF_SHARED, mei_driver_name, dev);
159         if (err) {
160                 printk(KERN_ERR "mei: request_threaded_irq failure. irq = %d\n",
161                        pdev->irq);
162                 goto unmap_memory;
163         }
164         INIT_DELAYED_WORK(&dev->wd_work, mei_wd_timer);
165         if (mei_hw_init(dev)) {
166                 printk(KERN_ERR "mei: Init hw failure.\n");
167                 err = -ENODEV;
168                 goto release_irq;
169         }
170         mei_device = pdev;
171         pci_set_drvdata(pdev, dev);
172         schedule_delayed_work(&dev->wd_work, HZ);
173
174         mutex_unlock(&mei_mutex);
175
176         pr_debug("mei: Driver initialization successful.\n");
177
178         return 0;
179
180 release_irq:
181         /* disable interrupts */
182         dev->host_hw_state = mei_hcsr_read(dev);
183         mei_disable_interrupts(dev);
184         flush_scheduled_work();
185         free_irq(pdev->irq, dev);
186 unmap_memory:
187         pci_iounmap(pdev, dev->mem_addr);
188 free_device:
189         kfree(dev);
190 release_regions:
191         pci_release_regions(pdev);
192 disable_device:
193         pci_disable_device(pdev);
194 end:
195         mutex_unlock(&mei_mutex);
196         printk(KERN_ERR "mei: Driver initialization failed.\n");
197         return err;
198 }
199
200 /**
201  * mei_remove - Device Removal Routine
202  *
203  * @pdev: PCI device structure
204  *
205  * mei_remove is called by the PCI subsystem to alert the driver
206  * that it should release a PCI device.
207  */
208 static void __devexit mei_remove(struct pci_dev *pdev)
209 {
210         struct mei_device *dev;
211
212         if (mei_device != pdev)
213                 return;
214
215         dev = pci_get_drvdata(pdev);
216         if (!dev)
217                 return;
218
219         mutex_lock(&dev->device_lock);
220
221         mei_wd_stop(dev, false);
222
223         mei_device = NULL;
224
225         if (dev->iamthif_cl.state == MEI_FILE_CONNECTED) {
226                 dev->iamthif_cl.state = MEI_FILE_DISCONNECTING;
227                 mei_disconnect_host_client(dev, &dev->iamthif_cl);
228         }
229         if (dev->wd_cl.state == MEI_FILE_CONNECTED) {
230                 dev->wd_cl.state = MEI_FILE_DISCONNECTING;
231                 mei_disconnect_host_client(dev, &dev->wd_cl);
232         }
233
234         /* remove entry if already in list */
235         dev_dbg(&pdev->dev, "list del iamthif and wd file list.\n");
236         mei_remove_client_from_file_list(dev, dev->wd_cl.host_client_id);
237         mei_remove_client_from_file_list(dev, dev->iamthif_cl.host_client_id);
238
239         dev->iamthif_current_cb = NULL;
240         dev->me_clients_num = 0;
241
242         mutex_unlock(&dev->device_lock);
243
244         flush_scheduled_work();
245
246         /* disable interrupts */
247         mei_disable_interrupts(dev);
248
249         free_irq(pdev->irq, dev);
250         pci_set_drvdata(pdev, NULL);
251
252         if (dev->mem_addr)
253                 pci_iounmap(pdev, dev->mem_addr);
254
255         kfree(dev);
256
257         pci_release_regions(pdev);
258         pci_disable_device(pdev);
259 }
260
261 /**
262  * mei_clear_list - removes all callbacks associated with file
263  *              from mei_cb_list
264  *
265  * @dev: device structure.
266  * @file: file structure
267  * @mei_cb_list: callbacks list
268  *
269  * mei_clear_list is called to clear resources associated with file
270  * when application calls close function or Ctrl-C was pressed
271  *
272  * returns true if callback removed from the list, false otherwise
273  */
274 static bool mei_clear_list(struct mei_device *dev,
275                 struct file *file, struct list_head *mei_cb_list)
276 {
277         struct mei_cl_cb *cb_pos = NULL;
278         struct mei_cl_cb *cb_next = NULL;
279         struct file *file_temp;
280         bool removed = false;
281
282         /* list all list member */
283         list_for_each_entry_safe(cb_pos, cb_next, mei_cb_list, cb_list) {
284                 file_temp = (struct file *)cb_pos->file_object;
285                 /* check if list member associated with a file */
286                 if (file_temp == file) {
287                         /* remove member from the list */
288                         list_del(&cb_pos->cb_list);
289                         /* check if cb equal to current iamthif cb */
290                         if (dev->iamthif_current_cb == cb_pos) {
291                                 dev->iamthif_current_cb = NULL;
292                                 /* send flow control to iamthif client */
293                                 mei_send_flow_control(dev, &dev->iamthif_cl);
294                         }
295                         /* free all allocated buffers */
296                         mei_free_cb_private(cb_pos);
297                         cb_pos = NULL;
298                         removed = true;
299                 }
300         }
301         return removed;
302 }
303
304 /**
305  * mei_clear_lists - removes all callbacks associated with file
306  *
307  * @dev: device structure
308  * @file: file structure
309  *
310  * mei_clear_lists is called to clear resources associated with file
311  * when application calls close function or Ctrl-C was pressed
312  *
313  * returns true if callback removed from the list, false otherwise
314  */
315 static bool mei_clear_lists(struct mei_device *dev, struct file *file)
316 {
317         bool removed = false;
318
319         /* remove callbacks associated with a file */
320         mei_clear_list(dev, file, &dev->amthi_cmd_list.mei_cb.cb_list);
321         if (mei_clear_list(dev, file,
322                             &dev->amthi_read_complete_list.mei_cb.cb_list))
323                 removed = true;
324
325         mei_clear_list(dev, file, &dev->ctrl_rd_list.mei_cb.cb_list);
326
327         if (mei_clear_list(dev, file, &dev->ctrl_wr_list.mei_cb.cb_list))
328                 removed = true;
329
330         if (mei_clear_list(dev, file, &dev->write_waiting_list.mei_cb.cb_list))
331                 removed = true;
332
333         if (mei_clear_list(dev, file, &dev->write_list.mei_cb.cb_list))
334                 removed = true;
335
336         /* check if iamthif_current_cb not NULL */
337         if (dev->iamthif_current_cb && !removed) {
338                 /* check file and iamthif current cb association */
339                 if (dev->iamthif_current_cb->file_object == file) {
340                         /* remove cb */
341                         mei_free_cb_private(dev->iamthif_current_cb);
342                         dev->iamthif_current_cb = NULL;
343                         removed = true;
344                 }
345         }
346         return removed;
347 }
348 /**
349  * find_read_list_entry - find read list entry
350  *
351  * @dev: device structure
352  * @file: pointer to file structure
353  *
354  * returns cb on success, NULL on error
355  */
356 static struct mei_cl_cb *find_read_list_entry(
357                 struct mei_device *dev,
358                 struct mei_cl *cl)
359 {
360         struct mei_cl_cb *cb_pos = NULL;
361         struct mei_cl_cb *cb_next = NULL;
362
363         if (!dev->read_list.status &&
364             !list_empty(&dev->read_list.mei_cb.cb_list)) {
365
366                 dev_dbg(&dev->pdev->dev, "remove read_list CB\n");
367                 list_for_each_entry_safe(cb_pos, cb_next,
368                                 &dev->read_list.mei_cb.cb_list, cb_list) {
369                         struct mei_cl *cl_temp;
370                         cl_temp = (struct mei_cl *)cb_pos->file_private;
371
372                         if (mei_cl_cmp_id(cl, cl_temp))
373                                 return cb_pos;
374                 }
375         }
376         return NULL;
377 }
378
379 /**
380  * mei_open - the open function
381  *
382  * @inode: pointer to inode structure
383  * @file: pointer to file structure
384  *
385  * returns 0 on success, <0 on error
386  */
387 static int mei_open(struct inode *inode, struct file *file)
388 {
389         struct mei_cl *cl;
390         int if_num = iminor(inode), err;
391         struct mei_device *dev;
392
393         err = -ENODEV;
394         if (!mei_device)
395                 goto out;
396
397         dev = pci_get_drvdata(mei_device);
398         if (if_num != MEI_MINOR_NUMBER || !dev)
399                 goto out;
400
401         mutex_lock(&dev->device_lock);
402         err = -ENOMEM;
403         cl = mei_cl_allocate(dev);
404         if (!cl)
405                 goto out;
406
407         err = -ENODEV;
408         if (dev->mei_state != MEI_ENABLED) {
409                 dev_dbg(&dev->pdev->dev, "mei_state != MEI_ENABLED  mei_state= %d\n",
410                     dev->mei_state);
411                 goto out_unlock;
412         }
413         err = -EMFILE;
414         if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT)
415                 goto out_unlock;
416
417         cl->host_client_id = find_first_zero_bit(dev->host_clients_map,
418                                                         MEI_CLIENTS_MAX);
419         if (cl->host_client_id > MEI_CLIENTS_MAX)
420                 goto out_unlock;
421
422         dev_dbg(&dev->pdev->dev, "client_id = %d\n", cl->host_client_id);
423
424         dev->open_handle_count++;
425         list_add_tail(&cl->link, &dev->file_list);
426
427         set_bit(cl->host_client_id, dev->host_clients_map);
428         cl->state = MEI_FILE_INITIALIZING;
429         cl->sm_state = 0;
430
431         file->private_data = cl;
432         mutex_unlock(&dev->device_lock);
433
434         return 0;
435
436 out_unlock:
437         mutex_unlock(&dev->device_lock);
438         kfree(cl);
439 out:
440         return err;
441 }
442
443 /**
444  * mei_release - the release function
445  *
446  * @inode: pointer to inode structure
447  * @file: pointer to file structure
448  *
449  * returns 0 on success, <0 on error
450  */
451 static int mei_release(struct inode *inode, struct file *file)
452 {
453         struct mei_cl *cl = file->private_data;
454         struct mei_cl_cb *cb;
455         struct mei_device *dev;
456         int rets = 0;
457
458         if (WARN_ON(!cl || !cl->dev))
459                 return -ENODEV;
460
461         dev = cl->dev;
462
463         mutex_lock(&dev->device_lock);
464         if (cl != &dev->iamthif_cl) {
465                 if (cl->state == MEI_FILE_CONNECTED) {
466                         cl->state = MEI_FILE_DISCONNECTING;
467                         dev_dbg(&dev->pdev->dev,
468                                 "disconnecting client host client = %d, "
469                             "ME client = %d\n",
470                             cl->host_client_id,
471                             cl->me_client_id);
472                         rets = mei_disconnect_host_client(dev, cl);
473                 }
474                 mei_cl_flush_queues(cl);
475                 dev_dbg(&dev->pdev->dev, "remove client host client = %d, ME client = %d\n",
476                     cl->host_client_id,
477                     cl->me_client_id);
478
479                 if (dev->open_handle_count > 0) {
480                         clear_bit(cl->host_client_id,
481                                   dev->host_clients_map);
482                         dev->open_handle_count--;
483                 }
484                 mei_remove_client_from_file_list(dev, cl->host_client_id);
485
486                 /* free read cb */
487                 cb = NULL;
488                 if (cl->read_cb) {
489                         cb = find_read_list_entry(dev, cl);
490                         /* Remove entry from read list */
491                         if (cb)
492                                 list_del(&cb->cb_list);
493
494                         cb = cl->read_cb;
495                         cl->read_cb = NULL;
496                 }
497
498                 file->private_data = NULL;
499
500                 if (cb) {
501                         mei_free_cb_private(cb);
502                         cb = NULL;
503                 }
504
505                 kfree(cl);
506         } else {
507                 if (dev->open_handle_count > 0)
508                         dev->open_handle_count--;
509
510                 if (dev->iamthif_file_object == file &&
511                     dev->iamthif_state != MEI_IAMTHIF_IDLE) {
512
513                         dev_dbg(&dev->pdev->dev, "amthi canceled iamthif state %d\n",
514                             dev->iamthif_state);
515                         dev->iamthif_canceled = true;
516                         if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE) {
517                                 dev_dbg(&dev->pdev->dev, "run next amthi iamthif cb\n");
518                                 mei_run_next_iamthif_cmd(dev);
519                         }
520                 }
521
522                 if (mei_clear_lists(dev, file))
523                         dev->iamthif_state = MEI_IAMTHIF_IDLE;
524
525         }
526         mutex_unlock(&dev->device_lock);
527         return rets;
528 }
529
530
531 /**
532  * mei_read - the read function.
533  *
534  * @file: pointer to file structure
535  * @ubuf: pointer to user buffer
536  * @length: buffer length
537  * @offset: data offset in buffer
538  *
539  * returns >=0 data length on success , <0 on error
540  */
541 static ssize_t mei_read(struct file *file, char __user *ubuf,
542                          size_t length, loff_t *offset)
543 {
544         struct mei_cl *cl = file->private_data;
545         struct mei_cl_cb *cb_pos = NULL;
546         struct mei_cl_cb *cb = NULL;
547         struct mei_device *dev;
548         int i;
549         int rets;
550         int err;
551
552
553         if (WARN_ON(!cl || !cl->dev))
554                 return -ENODEV;
555
556         dev = cl->dev;
557
558         mutex_lock(&dev->device_lock);
559         if (dev->mei_state != MEI_ENABLED) {
560                 rets = -ENODEV;
561                 goto out;
562         }
563
564         if ((cl->sm_state & MEI_WD_STATE_INDEPENDENCE_MSG_SENT) == 0) {
565                 /* Do not allow to read watchdog client */
566                 i = mei_find_me_client_index(dev, mei_wd_guid);
567                 if (i >= 0) {
568                         struct mei_me_client *me_client = &dev->me_clients[i];
569
570                         if (cl->me_client_id == me_client->client_id) {
571                                 rets = -EBADF;
572                                 goto out;
573                         }
574                 }
575         } else {
576                 cl->sm_state &= ~MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
577         }
578
579         if (cl == &dev->iamthif_cl) {
580                 rets = amthi_read(dev, file, ubuf, length, offset);
581                 goto out;
582         }
583
584         if (cl->read_cb && cl->read_cb->information > *offset) {
585                 cb = cl->read_cb;
586                 goto copy_buffer;
587         } else if (cl->read_cb && cl->read_cb->information > 0 &&
588                    cl->read_cb->information <= *offset) {
589                 cb = cl->read_cb;
590                 rets = 0;
591                 goto free;
592         } else if ((!cl->read_cb || !cl->read_cb->information) &&
593                     *offset > 0) {
594                 /*Offset needs to be cleaned for contingous reads*/
595                 *offset = 0;
596                 rets = 0;
597                 goto out;
598         }
599
600         err = mei_start_read(dev, cl);
601         if (err && err != -EBUSY) {
602                 dev_dbg(&dev->pdev->dev,
603                         "mei start read failure with status = %d\n", err);
604                 rets = err;
605                 goto out;
606         }
607
608         if (MEI_READ_COMPLETE != cl->reading_state &&
609                         !waitqueue_active(&cl->rx_wait)) {
610                 if (file->f_flags & O_NONBLOCK) {
611                         rets = -EAGAIN;
612                         goto out;
613                 }
614
615                 mutex_unlock(&dev->device_lock);
616
617                 if (wait_event_interruptible(cl->rx_wait,
618                         (MEI_READ_COMPLETE == cl->reading_state ||
619                          MEI_FILE_INITIALIZING == cl->state ||
620                          MEI_FILE_DISCONNECTED == cl->state ||
621                          MEI_FILE_DISCONNECTING == cl->state))) {
622                         if (signal_pending(current))
623                                 return -EINTR;
624                         return -ERESTARTSYS;
625                 }
626
627                 mutex_lock(&dev->device_lock);
628                 if (MEI_FILE_INITIALIZING == cl->state ||
629                     MEI_FILE_DISCONNECTED == cl->state ||
630                     MEI_FILE_DISCONNECTING == cl->state) {
631                         rets = -EBUSY;
632                         goto out;
633                 }
634         }
635
636         cb = cl->read_cb;
637
638         if (!cb) {
639                 rets = -ENODEV;
640                 goto out;
641         }
642         if (cl->reading_state != MEI_READ_COMPLETE) {
643                 rets = 0;
644                 goto out;
645         }
646         /* now copy the data to user space */
647 copy_buffer:
648         dev_dbg(&dev->pdev->dev, "cb->response_buffer size - %d\n",
649             cb->response_buffer.size);
650         dev_dbg(&dev->pdev->dev, "cb->information - %lu\n",
651             cb->information);
652         if (length == 0 || ubuf == NULL || *offset > cb->information) {
653                 rets = -EMSGSIZE;
654                 goto free;
655         }
656
657         /* length is being turncated to PAGE_SIZE, however, */
658         /* information size may be longer */
659         length = min_t(size_t, length, (cb->information - *offset));
660
661         if (copy_to_user(ubuf,
662                          cb->response_buffer.data + *offset,
663                          length)) {
664                 rets = -EFAULT;
665                 goto free;
666         }
667
668         rets = length;
669         *offset += length;
670         if ((unsigned long)*offset < cb->information)
671                 goto out;
672
673 free:
674         cb_pos = find_read_list_entry(dev, cl);
675         /* Remove entry from read list */
676         if (cb_pos)
677                 list_del(&cb_pos->cb_list);
678         mei_free_cb_private(cb);
679         cl->reading_state = MEI_IDLE;
680         cl->read_cb = NULL;
681         cl->read_pending = 0;
682 out:
683         dev_dbg(&dev->pdev->dev, "end mei read rets= %d\n", rets);
684         mutex_unlock(&dev->device_lock);
685         return rets;
686 }
687
688 /**
689  * mei_write - the write function.
690  *
691  * @file: pointer to file structure
692  * @ubuf: pointer to user buffer
693  * @length: buffer length
694  * @offset: data offset in buffer
695  *
696  * returns >=0 data length on success , <0 on error
697  */
698 static ssize_t mei_write(struct file *file, const char __user *ubuf,
699                           size_t length, loff_t *offset)
700 {
701         struct mei_cl *cl = file->private_data;
702         struct mei_cl_cb *write_cb = NULL;
703         struct mei_msg_hdr mei_hdr;
704         struct mei_device *dev;
705         unsigned long timeout = 0;
706         int rets;
707         int i;
708
709         if (WARN_ON(!cl || !cl->dev))
710                 return -ENODEV;
711
712         dev = cl->dev;
713
714         mutex_lock(&dev->device_lock);
715
716         if (dev->mei_state != MEI_ENABLED) {
717                 mutex_unlock(&dev->device_lock);
718                 return -ENODEV;
719         }
720
721         if (cl == &dev->iamthif_cl) {
722                 write_cb = find_amthi_read_list_entry(dev, file);
723
724                 if (write_cb) {
725                         timeout = write_cb->read_time +
726                                         msecs_to_jiffies(IAMTHIF_READ_TIMER);
727
728                         if (time_after(jiffies, timeout) ||
729                                  cl->reading_state == MEI_READ_COMPLETE) {
730                                         *offset = 0;
731                                         list_del(&write_cb->cb_list);
732                                         mei_free_cb_private(write_cb);
733                                         write_cb = NULL;
734                         }
735                 }
736         }
737
738         /* free entry used in read */
739         if (cl->reading_state == MEI_READ_COMPLETE) {
740                 *offset = 0;
741                 write_cb = find_read_list_entry(dev, cl);
742                 if (write_cb) {
743                         list_del(&write_cb->cb_list);
744                         mei_free_cb_private(write_cb);
745                         write_cb = NULL;
746                         cl->reading_state = MEI_IDLE;
747                         cl->read_cb = NULL;
748                         cl->read_pending = 0;
749                 }
750         } else if (cl->reading_state == MEI_IDLE &&
751                    !cl->read_pending)
752                 *offset = 0;
753
754
755         write_cb = kzalloc(sizeof(struct mei_cl_cb), GFP_KERNEL);
756         if (!write_cb) {
757                 mutex_unlock(&dev->device_lock);
758                 return -ENOMEM;
759         }
760
761         write_cb->file_object = file;
762         write_cb->file_private = cl;
763         write_cb->request_buffer.data = kmalloc(length, GFP_KERNEL);
764         rets = -ENOMEM;
765         if (!write_cb->request_buffer.data)
766                 goto unlock_dev;
767
768         dev_dbg(&dev->pdev->dev, "length =%d\n", (int) length);
769
770         rets = -EFAULT;
771         if (copy_from_user(write_cb->request_buffer.data, ubuf, length))
772                 goto unlock_dev;
773
774         cl->sm_state = 0;
775         if (length == 4 &&
776             ((memcmp(mei_wd_state_independence_msg[0],
777                                  write_cb->request_buffer.data, 4) == 0) ||
778              (memcmp(mei_wd_state_independence_msg[1],
779                                  write_cb->request_buffer.data, 4) == 0) ||
780              (memcmp(mei_wd_state_independence_msg[2],
781                                  write_cb->request_buffer.data, 4) == 0)))
782                 cl->sm_state |= MEI_WD_STATE_INDEPENDENCE_MSG_SENT;
783
784         INIT_LIST_HEAD(&write_cb->cb_list);
785         if (cl == &dev->iamthif_cl) {
786                 write_cb->response_buffer.data =
787                     kmalloc(dev->iamthif_mtu, GFP_KERNEL);
788                 if (!write_cb->response_buffer.data) {
789                         rets = -ENOMEM;
790                         goto unlock_dev;
791                 }
792                 if (dev->mei_state != MEI_ENABLED) {
793                         rets = -ENODEV;
794                         goto unlock_dev;
795                 }
796                 for (i = 0; i < dev->me_clients_num; i++) {
797                         if (dev->me_clients[i].client_id ==
798                                 dev->iamthif_cl.me_client_id)
799                                 break;
800                 }
801
802                 if (WARN_ON(dev->me_clients[i].client_id != cl->me_client_id)) {
803                         rets = -ENODEV;
804                         goto unlock_dev;
805                 }
806                 if (i == dev->me_clients_num ||
807                     (dev->me_clients[i].client_id !=
808                       dev->iamthif_cl.me_client_id)) {
809                         rets = -ENODEV;
810                         goto unlock_dev;
811                 } else if (length > dev->me_clients[i].props.max_msg_length ||
812                            length <= 0) {
813                         rets = -EMSGSIZE;
814                         goto unlock_dev;
815                 }
816
817                 write_cb->response_buffer.size = dev->iamthif_mtu;
818                 write_cb->major_file_operations = MEI_IOCTL;
819                 write_cb->information = 0;
820                 write_cb->request_buffer.size = length;
821                 if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) {
822                         rets = -ENODEV;
823                         goto unlock_dev;
824                 }
825
826                 if (!list_empty(&dev->amthi_cmd_list.mei_cb.cb_list) ||
827                                 dev->iamthif_state != MEI_IAMTHIF_IDLE) {
828                         dev_dbg(&dev->pdev->dev, "amthi_state = %d\n",
829                                         (int) dev->iamthif_state);
830                         dev_dbg(&dev->pdev->dev, "add amthi cb to amthi cmd waiting list\n");
831                         list_add_tail(&write_cb->cb_list,
832                                         &dev->amthi_cmd_list.mei_cb.cb_list);
833                         rets = length;
834                 } else {
835                         dev_dbg(&dev->pdev->dev, "call amthi write\n");
836                         rets = amthi_write(dev, write_cb);
837
838                         if (rets) {
839                                 dev_dbg(&dev->pdev->dev, "amthi write failed with status = %d\n",
840                                     rets);
841                                 goto unlock_dev;
842                         }
843                         rets = length;
844                 }
845                 mutex_unlock(&dev->device_lock);
846                 return rets;
847         }
848
849         write_cb->major_file_operations = MEI_WRITE;
850         /* make sure information is zero before we start */
851
852         write_cb->information = 0;
853         write_cb->request_buffer.size = length;
854
855         dev_dbg(&dev->pdev->dev, "host client = %d, ME client = %d\n",
856             cl->host_client_id, cl->me_client_id);
857         if (cl->state != MEI_FILE_CONNECTED) {
858                 rets = -ENODEV;
859                 dev_dbg(&dev->pdev->dev, "host client = %d,  is not connected to ME client = %d",
860                     cl->host_client_id,
861                     cl->me_client_id);
862                 goto unlock_dev;
863         }
864         for (i = 0; i < dev->me_clients_num; i++) {
865                 if (dev->me_clients[i].client_id ==
866                     cl->me_client_id)
867                         break;
868         }
869         if (WARN_ON(dev->me_clients[i].client_id != cl->me_client_id)) {
870                 rets = -ENODEV;
871                 goto unlock_dev;
872         }
873         if (i == dev->me_clients_num) {
874                 rets = -ENODEV;
875                 goto unlock_dev;
876         }
877         if (length > dev->me_clients[i].props.max_msg_length || length <= 0) {
878                 rets = -EINVAL;
879                 goto unlock_dev;
880         }
881         write_cb->file_private = cl;
882
883         rets = mei_flow_ctrl_creds(dev, cl);
884         if (rets < 0)
885                 goto unlock_dev;
886
887         if (rets && dev->mei_host_buffer_is_empty) {
888                 rets = 0;
889                 dev->mei_host_buffer_is_empty = false;
890                 if (length > ((((dev->host_hw_state & H_CBD) >> 24) *
891                         sizeof(u32)) - sizeof(struct mei_msg_hdr))) {
892
893                         mei_hdr.length =
894                                 (((dev->host_hw_state & H_CBD) >> 24) *
895                                 sizeof(u32)) -
896                                 sizeof(struct mei_msg_hdr);
897                         mei_hdr.msg_complete = 0;
898                 } else {
899                         mei_hdr.length = length;
900                         mei_hdr.msg_complete = 1;
901                 }
902                 mei_hdr.host_addr = cl->host_client_id;
903                 mei_hdr.me_addr = cl->me_client_id;
904                 mei_hdr.reserved = 0;
905                 dev_dbg(&dev->pdev->dev, "call mei_write_message header=%08x.\n",
906                     *((u32 *) &mei_hdr));
907                 if (!mei_write_message(dev, &mei_hdr,
908                         (unsigned char *) (write_cb->request_buffer.data),
909                         mei_hdr.length)) {
910                         rets = -ENODEV;
911                         goto unlock_dev;
912                 }
913                 cl->writing_state = MEI_WRITING;
914                 write_cb->information = mei_hdr.length;
915                 if (mei_hdr.msg_complete) {
916                         if (mei_flow_ctrl_reduce(dev, cl)) {
917                                 rets = -ENODEV;
918                                 goto unlock_dev;
919                         }
920                         list_add_tail(&write_cb->cb_list,
921                                       &dev->write_waiting_list.mei_cb.cb_list);
922                 } else {
923                         list_add_tail(&write_cb->cb_list,
924                                       &dev->write_list.mei_cb.cb_list);
925                 }
926
927         } else {
928
929                 write_cb->information = 0;
930                 cl->writing_state = MEI_WRITING;
931                 list_add_tail(&write_cb->cb_list,
932                               &dev->write_list.mei_cb.cb_list);
933         }
934         mutex_unlock(&dev->device_lock);
935         return length;
936
937 unlock_dev:
938         mutex_unlock(&dev->device_lock);
939         mei_free_cb_private(write_cb);
940         return rets;
941 }
942
943
944 /**
945  * mei_ioctl - the IOCTL function
946  *
947  * @file: pointer to file structure
948  * @cmd: ioctl command
949  * @data: pointer to mei message structure
950  *
951  * returns 0 on success , <0 on error
952  */
953 static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
954 {
955         struct mei_device *dev;
956         struct mei_cl *cl = file->private_data;
957         struct mei_connect_client_data *connect_data = NULL;
958         int rets;
959
960         if (cmd != IOCTL_MEI_CONNECT_CLIENT)
961                 return -EINVAL;
962
963         if (WARN_ON(!cl || !cl->dev))
964                 return -ENODEV;
965
966         dev = cl->dev;
967
968         dev_dbg(&dev->pdev->dev, "IOCTL cmd = 0x%x", cmd);
969
970         mutex_lock(&dev->device_lock);
971         if (dev->mei_state != MEI_ENABLED) {
972                 rets = -ENODEV;
973                 goto out;
974         }
975
976         dev_dbg(&dev->pdev->dev, ": IOCTL_MEI_CONNECT_CLIENT.\n");
977
978         connect_data = kzalloc(sizeof(struct mei_connect_client_data),
979                                                         GFP_KERNEL);
980         if (!connect_data) {
981                 rets = -ENOMEM;
982                 goto out;
983         }
984         dev_dbg(&dev->pdev->dev, "copy connect data from user\n");
985         if (copy_from_user(connect_data, (char __user *)data,
986                                 sizeof(struct mei_connect_client_data))) {
987                 dev_dbg(&dev->pdev->dev, "failed to copy data from userland\n");
988                 rets = -EFAULT;
989                 goto out;
990         }
991         rets = mei_ioctl_connect_client(file, connect_data);
992
993         /* if all is ok, copying the data back to user. */
994         if (rets)
995                 goto out;
996
997         dev_dbg(&dev->pdev->dev, "copy connect data to user\n");
998         if (copy_to_user((char __user *)data, connect_data,
999                                 sizeof(struct mei_connect_client_data))) {
1000                 dev_dbg(&dev->pdev->dev, "failed to copy data to userland\n");
1001                 rets = -EFAULT;
1002                 goto out;
1003         }
1004
1005 out:
1006         kfree(connect_data);
1007         mutex_unlock(&dev->device_lock);
1008         return rets;
1009 }
1010
1011 /**
1012  * mei_compat_ioctl - the compat IOCTL function
1013  *
1014  * @file: pointer to file structure
1015  * @cmd: ioctl command
1016  * @data: pointer to mei message structure
1017  *
1018  * returns 0 on success , <0 on error
1019  */
1020 #ifdef CONFIG_COMPAT
1021 static long mei_compat_ioctl(struct file *file,
1022                       unsigned int cmd, unsigned long data)
1023 {
1024         return mei_ioctl(file, cmd, (unsigned long)compat_ptr(data));
1025 }
1026 #endif
1027
1028
1029 /**
1030  * mei_poll - the poll function
1031  *
1032  * @file: pointer to file structure
1033  * @wait: pointer to poll_table structure
1034  *
1035  * returns poll mask
1036  */
1037 static unsigned int mei_poll(struct file *file, poll_table *wait)
1038 {
1039         struct mei_cl *cl = file->private_data;
1040         struct mei_device *dev;
1041         unsigned int mask = 0;
1042
1043         if (WARN_ON(!cl || !cl->dev))
1044                 return mask;
1045
1046         dev = cl->dev;
1047
1048         mutex_lock(&dev->device_lock);
1049
1050         if (dev->mei_state != MEI_ENABLED)
1051                 goto out;
1052
1053
1054         if (cl == &dev->iamthif_cl) {
1055                 mutex_unlock(&dev->device_lock);
1056                 poll_wait(file, &dev->iamthif_cl.wait, wait);
1057                 mutex_lock(&dev->device_lock);
1058                 if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE &&
1059                         dev->iamthif_file_object == file) {
1060                         mask |= (POLLIN | POLLRDNORM);
1061                         dev_dbg(&dev->pdev->dev, "run next amthi cb\n");
1062                         mei_run_next_iamthif_cmd(dev);
1063                 }
1064                 goto out;
1065         }
1066
1067         mutex_unlock(&dev->device_lock);
1068         poll_wait(file, &cl->tx_wait, wait);
1069         mutex_lock(&dev->device_lock);
1070         if (MEI_WRITE_COMPLETE == cl->writing_state)
1071                 mask |= (POLLIN | POLLRDNORM);
1072
1073 out:
1074         mutex_unlock(&dev->device_lock);
1075         return mask;
1076 }
1077
1078 #ifdef CONFIG_PM
1079 static int mei_pci_suspend(struct device *device)
1080 {
1081         struct pci_dev *pdev = to_pci_dev(device);
1082         struct mei_device *dev = pci_get_drvdata(pdev);
1083         int err;
1084
1085         if (!dev)
1086                 return -ENODEV;
1087         mutex_lock(&dev->device_lock);
1088         /* Stop watchdog if exists */
1089         err = mei_wd_stop(dev, true);
1090         /* Set new mei state */
1091         if (dev->mei_state == MEI_ENABLED ||
1092             dev->mei_state == MEI_RECOVERING_FROM_RESET) {
1093                 dev->mei_state = MEI_POWER_DOWN;
1094                 mei_reset(dev, 0);
1095         }
1096         mutex_unlock(&dev->device_lock);
1097
1098         free_irq(pdev->irq, dev);
1099
1100
1101         return err;
1102 }
1103
1104 static int mei_pci_resume(struct device *device)
1105 {
1106         struct pci_dev *pdev = to_pci_dev(device);
1107         struct mei_device *dev;
1108         int err;
1109
1110         dev = pci_get_drvdata(pdev);
1111         if (!dev)
1112                 return -ENODEV;
1113
1114         /* request and enable interrupt   */
1115         err = request_threaded_irq(pdev->irq,
1116                         mei_interrupt_quick_handler,
1117                         mei_interrupt_thread_handler,
1118                         IRQF_SHARED, mei_driver_name, dev);
1119         if (err) {
1120                 printk(KERN_ERR "mei: Request_irq failure. irq = %d\n",
1121                        pdev->irq);
1122                 return err;
1123         }
1124
1125         mutex_lock(&dev->device_lock);
1126         dev->mei_state = MEI_POWER_UP;
1127         mei_reset(dev, 1);
1128         mutex_unlock(&dev->device_lock);
1129
1130         /* Start watchdog if stopped in suspend */
1131         if (dev->wd_timeout) {
1132                 mei_wd_start_setup(dev);
1133                 dev->wd_due_counter = 1;
1134                 schedule_delayed_work(&dev->wd_work, HZ);
1135         }
1136         return err;
1137 }
1138 static SIMPLE_DEV_PM_OPS(mei_pm_ops, mei_pci_suspend, mei_pci_resume);
1139 #define MEI_PM_OPS      (&mei_pm_ops)
1140 #else
1141 #define MEI_PM_OPS      NULL
1142 #endif /* CONFIG_PM */
1143 /*
1144  *  PCI driver structure
1145  */
1146 static struct pci_driver mei_driver = {
1147         .name = mei_driver_name,
1148         .id_table = mei_pci_tbl,
1149         .probe = mei_probe,
1150         .remove = __devexit_p(mei_remove),
1151         .shutdown = __devexit_p(mei_remove),
1152         .driver.pm = MEI_PM_OPS,
1153 };
1154
1155 /*
1156  * file operations structure will be used for mei char device.
1157  */
1158 static const struct file_operations mei_fops = {
1159         .owner = THIS_MODULE,
1160         .read = mei_read,
1161         .unlocked_ioctl = mei_ioctl,
1162 #ifdef CONFIG_COMPAT
1163         .compat_ioctl = mei_compat_ioctl,
1164 #endif
1165         .open = mei_open,
1166         .release = mei_release,
1167         .write = mei_write,
1168         .poll = mei_poll,
1169 };
1170
1171 /**
1172  * mei_registration_cdev - sets up the cdev structure for mei device.
1173  *
1174  * @dev: char device struct
1175  * @hminor: minor number for registration char device
1176  * @fops: file operations structure
1177  *
1178  * returns 0 on success, <0 on failure.
1179  */
1180 static int mei_registration_cdev(struct cdev *dev, int hminor,
1181                                   const struct file_operations *fops)
1182 {
1183         int ret, devno = MKDEV(mei_major, hminor);
1184
1185         cdev_init(dev, fops);
1186         dev->owner = THIS_MODULE;
1187         ret = cdev_add(dev, devno, 1);
1188         /* Fail gracefully if need be */
1189         if (ret)
1190                 printk(KERN_ERR "mei: Error %d registering mei device %d\n",
1191                        ret, hminor);
1192         return ret;
1193 }
1194
1195 /**
1196  * mei_register_cdev - registers mei char device
1197  *
1198  * returns 0 on success, <0 on failure.
1199  */
1200 static int mei_register_cdev(void)
1201 {
1202         int ret;
1203         dev_t dev;
1204
1205         /* registration of char devices */
1206         ret = alloc_chrdev_region(&dev, MEI_MINORS_BASE, MEI_MINORS_COUNT,
1207                                   MEI_DRIVER_NAME);
1208         if (ret) {
1209                 printk(KERN_ERR "mei: Error allocating char device region.\n");
1210                 return ret;
1211         }
1212
1213         mei_major = MAJOR(dev);
1214
1215         ret = mei_registration_cdev(&mei_cdev, MEI_MINOR_NUMBER,
1216                                      &mei_fops);
1217         if (ret)
1218                 unregister_chrdev_region(MKDEV(mei_major, MEI_MINORS_BASE),
1219                                          MEI_MINORS_COUNT);
1220
1221         return ret;
1222 }
1223
1224 /**
1225  * mei_unregister_cdev - unregisters mei char device
1226  */
1227 static void mei_unregister_cdev(void)
1228 {
1229         cdev_del(&mei_cdev);
1230         unregister_chrdev_region(MKDEV(mei_major, MEI_MINORS_BASE),
1231                                  MEI_MINORS_COUNT);
1232 }
1233
1234 /**
1235  * mei_sysfs_device_create - adds device entry to sysfs
1236  *
1237  * returns 0 on success, <0 on failure.
1238  */
1239 static int mei_sysfs_device_create(void)
1240 {
1241         struct class *class;
1242         void *tmphdev;
1243         int err;
1244
1245         class = class_create(THIS_MODULE, MEI_DRIVER_NAME);
1246         if (IS_ERR(class)) {
1247                 err = PTR_ERR(class);
1248                 printk(KERN_ERR "mei: Error creating mei class.\n");
1249                 goto err_out;
1250         }
1251
1252         tmphdev = device_create(class, NULL, mei_cdev.dev, NULL,
1253                                         MEI_DEV_NAME);
1254         if (IS_ERR(tmphdev)) {
1255                 err = PTR_ERR(tmphdev);
1256                 goto err_destroy;
1257         }
1258
1259         mei_class = class;
1260         return 0;
1261
1262 err_destroy:
1263         class_destroy(class);
1264 err_out:
1265         return err;
1266 }
1267
1268 /**
1269  * mei_sysfs_device_remove - unregisters the device entry on sysfs
1270  */
1271 static void mei_sysfs_device_remove(void)
1272 {
1273         if (IS_ERR_OR_NULL(mei_class))
1274                 return;
1275
1276         device_destroy(mei_class, mei_cdev.dev);
1277         class_destroy(mei_class);
1278 }
1279
1280 /**
1281  * mei_init_module - Driver Registration Routine
1282  *
1283  * mei_init_module is the first routine called when the driver is
1284  * loaded. All it does is to register with the PCI subsystem.
1285  *
1286  * returns 0 on success, <0 on failure.
1287  */
1288 static int __init mei_init_module(void)
1289 {
1290         int ret;
1291
1292         pr_debug("mei: %s - version %s\n",
1293                 mei_driver_string, mei_driver_version);
1294         /* init pci module */
1295         ret = pci_register_driver(&mei_driver);
1296         if (ret < 0) {
1297                 printk(KERN_ERR "mei: Error registering driver.\n");
1298                 goto end;
1299         }
1300
1301         ret = mei_register_cdev();
1302         if (ret)
1303                 goto unregister_pci;
1304
1305         ret = mei_sysfs_device_create();
1306         if (ret)
1307                 goto unregister_cdev;
1308
1309         return ret;
1310
1311 unregister_cdev:
1312         mei_unregister_cdev();
1313 unregister_pci:
1314         pci_unregister_driver(&mei_driver);
1315 end:
1316         return ret;
1317 }
1318
1319 module_init(mei_init_module);
1320
1321 /**
1322  * mei_exit_module - Driver Exit Cleanup Routine
1323  *
1324  * mei_exit_module is called just before the driver is removed
1325  * from memory.
1326  */
1327 static void __exit mei_exit_module(void)
1328 {
1329         mei_sysfs_device_remove();
1330         mei_unregister_cdev();
1331         pci_unregister_driver(&mei_driver);
1332
1333         pr_debug("mei: Driver unloaded successfully.\n");
1334 }
1335
1336 module_exit(mei_exit_module);
1337
1338
1339 MODULE_AUTHOR("Intel Corporation");
1340 MODULE_DESCRIPTION("Intel(R) Management Engine Interface");
1341 MODULE_LICENSE("GPL v2");
1342 MODULE_VERSION(MEI_DRIVER_VERSION);