linux-toradex.git/drivers/misc, branch v3.12.25

mei: me: fix hw ready reset flow

2014-07-02T10:05:57+00:00

commit b04ada92ffaabb868497a1fce8e4f6bf74e5488f upstream

We cleared H_RST for H_CSR on spurious interrupt generated when ME_RDY
while cleared and not while  ME_RDY is set. The spurious interrupt
is not delivered on all platforms in this case the
driver may fail to initialize.

Cc: stable@vger.kernel.org #3.12
Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Slaby

mei: me: read H_CSR after asserting reset

2014-07-02T10:05:57+00:00

commit c40765d919d25d2d44d99c4ce39e48808f137e1e upstream.

According the spec the host should read H_CSR again
after asserting reset H_RST to ensure that reset was
read by the firmware

Cc: stable@vger.kernel.org #3.12
Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Jiri Slaby

mei: me: drop harmful wait optimization

2014-06-20T15:34:17+00:00

commit 07cd7be3d92eeeae1f92a017f2cfe4fdd9256526 upstream.

It my take time till ME_RDY will be cleared after the reset,
so we cannot check the bit before we got the interrupt

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Jiri Slaby

mei: ignore client writing state during cb completion

2014-05-15T07:54:52+00:00

commit 34ec43661fe8f1977dd0f05353302ae2ed10aabb upstream.

Ignore client writing state during cb completion to fix a memory
leak.

When moving cbs to the completion list we should not look at
writing_state as this state can be already overwritten by next
write, the fact that a cb is on the write waiting list means
that it was already written to the HW and we can safely complete it.

Same pays for wait in poll handler, we do not have to check the state
wake is done after completion list processing.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Jiri Slaby

mei: me: do not load the driver if the FW doesn't support MEI interface

2014-05-15T07:54:51+00:00

commit 5e6533a6f52f1a8283b2f818f5828be99a417dd6 upstream.

NM and SPS  FW types that may run on ME device on server platforms
do not have valid MEI/HECI interface and driver should not
be bound to it as this might lead to system hung.
In practice not all BIOSes effectively hide such devices from the
OS and in some cases it is not possible.

We determine FW type by examining Host FW status registers in order to
unbind the driver.
In this patch we are adding check for ME on Cougar Point, Lynx Point
Devices

Signed-off-by: Tomas Winkler 
Tested-by: Nikola Ciprich 
Signed-off-by: Jiri Slaby

mei: fix memory leak of pending write cb objects

2014-05-15T07:54:51+00:00

commit cc99ecfdac01215594c73907726b12f251c21e20 upstream.

Write callbacks are released on the write completed path but
when file handler is closed before the writes are
completed those are left dangling on write and write_waiting queues.

We add mei_io_list_free function to perform this task

Also move static functions to client.c form client.h

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Jiri Slaby

mei: set client's read_cb to NULL when flow control fails

2014-03-05T16:13:49+00:00

commit accb884b32e82f943340688c9cd30290531e73e0 upstream.

In mei_cl_read_start(), if it fails to send flow control request, it
will release "cl->read_cb" but forget to set pointer to NULL, leaving
"cl->read_cb" still pointing to random memory, next time this client is
operated like mei_release(), it has chance to refer to this wrong pointer.

Fixes:  PANIC at kfree in mei_release()

[228781.826904] Call Trace:
[228781.829737]  [] ? mei_cl_unlink+0x48/0xa0
[228781.835283]  [] mei_io_cb_free+0x17/0x30
[228781.840733]  [] mei_release+0xa8/0x180
[228781.845989]  [] ? __fsnotify_parent+0xa0/0xf0
[228781.851925]  [] __fput+0xd9/0x200
[228781.856696]  [] ____fput+0xd/0x10
[228781.861467]  [] task_work_run+0x81/0xb0
[228781.866821]  [] do_exit+0x283/0xa00
[228781.871786]  [] ? kprobe_flush_task+0x66/0xc0
[228781.877722]  [] ? __dequeue_signal+0x18/0x1a0
[228781.883657]  [] ? dequeue_signal+0x32/0x190
[228781.889397]  [] do_group_exit+0x34/0xa0
[228781.894750]  [] get_signal_to_deliver+0x206/0x610
[228781.901075]  [] do_signal+0x38/0x100
[228781.906136]  [] ? mei_read+0x42c/0x4e0
[228781.911393]  [] ? wake_up_bit+0x30/0x30
[228781.916745]  [] ? mei_poll+0x120/0x120
[228781.922001]  [] ? vfs_read+0x89/0x160
[228781.927158]  [] ? mei_poll+0x120/0x120
[228781.932414]  [] ? fget_light+0x44/0xe0
[228781.937670]  [] ? SyS_read+0x68/0x80
[228781.942730]  [] do_notify_resume+0x55/0x70
[228781.948376]  [] work_notifysig+0x29/0x30
[228781.953827]  [] ? bad_area+0x5/0x3e

Signed-off-by: Chao Bi 
Signed-off-by: Tomas Winkler 
Signed-off-by: Jiri Slaby

mei: don't unset read cb ptr on reset

2014-02-22T21:32:27+00:00

commit 5cb906c7035f03a3a44fecece9d3ff8fcc75d6e0 upstream.

Don't set read callback to NULL during reset as
this leads to memory leak of both cb and its buffer.
The memory is correctly freed during mei_release.

The memory leak is detectable by kmemleak if
application has open read call while system is going through
suspend/resume.

unreferenced object 0xecead780 (size 64):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 01 10 00 00 02 20 00 00 bf 30 f1 00 00 00 00  ...... ...0.....
    00 00 00 00 00 00 00 00 36 01 00 00 00 70 da e2  ........6....p..
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] kmem_cache_alloc_trace+0xc6/0x190
    [] mei_io_cb_init+0x29/0x50
    [] mei_cl_read_start+0x102/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff
unreferenced object 0xe2da7000 (size 512):
  comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
  hex dump (first 32 bytes):
    00 6c da e2 7c 00 00 00 00 00 00 00 c0 eb 0c 59  .l..|..........Y
    1b 00 00 00 01 00 00 00 02 10 00 00 01 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x3c/0xa0
    [] __kmalloc+0xe7/0x1d0
    [] mei_io_cb_alloc_resp_buf+0x2e/0x60
    [] mei_cl_read_start+0x12c/0x360
    [] mei_read+0x103/0x4e0
    [] vfs_read+0x89/0x160
    [] SyS_read+0x4f/0x80
    [] syscall_call+0x7/0xb
    [] 0xffffffff

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: clear write cb from waiting list on reset

2014-02-22T21:32:27+00:00

commit 30c54df7cb9b15b222529a028390b9c9582dd65e upstream.

Clear write callbacks sitting in write_waiting list on reset.
Otherwise these callbacks are left dangling and cause memory leak.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: mei_hbm_dispatch() returns void

2014-02-13T21:50:18+00:00

Building hbm.o for v3.13.2 triggers a GCC warning:
    drivers/misc/mei/hbm.c: In function 'mei_hbm_dispatch':
    drivers/misc/mei/hbm.c:596:3: warning: 'return' with a value, in function returning void [enabled by default]
       return 0;
       ^

GCC is correct, obviously. So let's return void instead of zero here.

Signed-off-by: Paul Bolle 
Acked-by: Tomas Winkler 
Cc: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman