kernel/drivers/misc/mei/client.h, branch 0x221E-v0.0.1-v6.19

mei: hook mei_device on class device

2025-09-06T17:50:54Z

mei_device lifetime was managed by devm procedure of parent device. But such memory is freed on device_del. Mei_device object is used by client object that may be alive after parent device is removed. It may lead to use-after-free if discrete graphics driver unloads mei_gsc auxiliary device while user-space holds open handle to mei character device. Connect mei_device structure lifteme to mei class device lifetime by adding mei_device free to class device remove callback. Move exising parent device pointer to separate field in mei_device to avoid misuse. Allocate character device dynamically and allow to control its own lifetime as it may outlive mei_device structure while character device closes after parent device is removed from the system. Leave power management on parent device as we overwrite pci runtime pm procedure and user-space is expecting it there. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201 Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: Remove unused functions

2025-02-20T14:24:13Z

The following functions have been in the mei code for a long time but have never been used. mei_txe_setup_satt2() was added in 2014 by commit 32e2b59fca2c ("mei: txe: add hw-txe.c") mei_me_cl_rm_by_uuid_id() was added in 2015 by commit 79563db9ddd3 ("mei: add reference counting for me clients") mei_cldev_uuid() was added in 2015 by commit baeacd037697 ("mei: bus: export uuid and protocol version to mei_cl bus drivers") mei_cldev_recv_nonblock() was added in 2016 by commit 076802d00615 ("mei: bus: enable non-blocking RX") it is the only user of mei_cldev_recv_nonblock_vtag(). Remove them. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arnd Bergmann Reviewed-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250130012654.255119-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman

mei: add timeout to send

2022-11-23T18:43:33Z

When driver wakes up the firmware from the low power state, it is sending a memory ready message. The send is done via synchronous/blocking function to ensure that firmware is in ready state. However, in case of firmware undergoing reset send might be block forever. To address this issue a timeout is added to blocking write command on the internal bus. Introduce the __mei_cl_send_timeout function to use instead of __mei_cl_send in cases where timeout is required. The mei_cl_write has only two callers and there is no need to split it into two functions. Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20221116124735.2493847-2-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: constify passed buffers and structures

2021-07-29T15:08:04Z

Buffers and structures passed to MEI bus and client API can be made const for safer code and clear indication that it is not modified. Acked-by: Arnd Bergmann Acked-by: Tomas Winkler Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210729102803.46289-1-krzysztof.kozlowski@canonical.com Signed-off-by: Greg Kroah-Hartman

mei: implement client dma setup.

2021-02-06T14:48:11Z

Implement HBM message protocol to setup and tear down DMA buffer on behalf of an client. On top there DMA buffer allocation and its life time management. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20210206144325.25682-5-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: protect mei_cl_mtu from null dereference

2020-11-03T09:13:48Z

A receive callback is queued while the client is still connected but can still be called after the client was disconnected. Upon disconnect cl->me_cl is set to NULL, hence we need to check that ME client is not-NULL in mei_cl_mtu to avoid null dereference. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20201029095444.957924-2-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: add a vtag map for each client

2020-08-18T13:44:44Z

Vtag map is a list of tuples of vtag and file pointer (struct mei_cl_vtag) associated with a particular me host client. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20200818115147.2567012-8-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: add a spin lock to protect rd_completed queue

2020-08-18T13:44:43Z

In order to support vtags we need to access read completed queue out of driver big lock. Add a spin lock to protect rd_completed queue. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20200818115147.2567012-7-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: add vtag support bit in client properties

2020-08-18T13:44:43Z

Vtag support is on a client basis, meaning not every client supports it. The vtag capability is communicated via the client properties structure during client enumeration process. Export the propertiy via sysfs. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20200818115147.2567012-4-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: bus: add more client attributes to sysfs

2019-11-16T11:58:54Z

Export more client attributes via sysfs that are usually obtained upon connection. In some cases, for example a monitoring application may wish to know the attributes without actually performing the connection. Added attributes: max number of connections, fixed address, max message length. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20191116142136.17535-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman