linux.git/drivers/misc, branch v3.14.27

mei: bus: fix possible boundaries violation

2014-10-30T16:38:21+00:00

commit cfda2794b5afe7ce64ee9605c64bef0e56a48125 upstream.

function 'strncpy' will fill whole buffer 'id.name' of fixed size (32)
with string value and will not leave place for NULL-terminator.
Possible buffer boundaries violation in following string operations.
Replace strncpy with strlcpy.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: nfc: fix memory leak in error path

2014-09-05T23:34:16+00:00

commit 8e8248b1369c97c7bb6f8bcaee1f05deeabab8ef upstream.

NFC will leak buffer if send failed.
Use single exit point that does the freeing

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: reset client state on queued connect request

2014-09-05T23:34:16+00:00

commit 73ab4232388b7a08f17c8d08141ff2099fa0b161 upstream.

If connect request is queued (e.g. device in pg) set client state
to initializing, thus avoid preliminary exit in wait if current
state is disconnected.

This is regression from:

commit e4d8270e604c3202131bac607969605ac397b893
Author: Alexander Usyskin 
mei: set connecting state just upon connection request is sent to the fw

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: start disconnect request timer consistently

2014-09-05T23:34:13+00:00

commit 22b987a325701223f9a37db700c6eb20b9924c6f upstream.

Link must be reset in case the fw doesn't
respond to client disconnect request.
We did charge the timer only in irq path
from mei_cl_irq_close and not in mei_cl_disconnect

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: me: read H_CSR after asserting reset

2014-06-16T20:40:33+00:00

commit c40765d919d25d2d44d99c4ce39e48808f137e1e upstream.

According the spec the host should read H_CSR again
after asserting reset H_RST to ensure that reset was
read by the firmware

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: me: drop harmful wait optimization

2014-06-16T20:40:33+00:00

commit 07cd7be3d92eeeae1f92a017f2cfe4fdd9256526 upstream.

It my take time till ME_RDY will be cleared after the reset,
so we cannot check the bit before we got the interrupt

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: me: fix hw ready reset flow

2014-06-16T20:40:33+00:00

commit b04ada92ffaabb868497a1fce8e4f6bf74e5488f upstream.

We cleared H_RST for H_CSR on spurious interrupt generated when ME_RDY
while cleared and not while  ME_RDY is set. The spurious interrupt
is not delivered on all platforms in this case the
driver may fail to initialize.

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman

mei: ignore client writing state during cb completion

2014-05-06T14:59:25+00:00

commit 34ec43661fe8f1977dd0f05353302ae2ed10aabb upstream.

Ignore client writing state during cb completion to fix a memory
leak.

When moving cbs to the completion list we should not look at
writing_state as this state can be already overwritten by next
write, the fact that a cb is on the write waiting list means
that it was already written to the HW and we can safely complete it.

Same pays for wait in poll handler, we do not have to check the state
wake is done after completion list processing.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: me: do not load the driver if the FW doesn't support MEI interface

2014-05-06T14:59:25+00:00

commit 5e6533a6f52f1a8283b2f818f5828be99a417dd6 upstream.

NM and SPS  FW types that may run on ME device on server platforms
do not have valid MEI/HECI interface and driver should not
be bound to it as this might lead to system hung.
In practice not all BIOSes effectively hide such devices from the
OS and in some cases it is not possible.

We determine FW type by examining Host FW status registers in order to
unbind the driver.
In this patch we are adding check for ME on Cougar Point, Lynx Point
Devices

Signed-off-by: Tomas Winkler 
Tested-by: Nikola Ciprich 
Signed-off-by: Greg Kroah-Hartman

mei: fix memory leak of pending write cb objects

2014-05-06T14:59:24+00:00

commit cc99ecfdac01215594c73907726b12f251c21e20 upstream.

Write callbacks are released on the write completed path but
when file handler is closed before the writes are
completed those are left dangling on write and write_waiting queues.

We add mei_io_list_free function to perform this task

Also move static functions to client.c form client.h

Signed-off-by: Tomas Winkler 
Signed-off-by: Alexander Usyskin 
Signed-off-by: Greg Kroah-Hartman