aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/misc/mei/amthif.c8
-rw-r--r--drivers/misc/mei/bus.c6
-rw-r--r--drivers/misc/mei/client.c47
-rw-r--r--drivers/misc/mei/client.h3
-rw-r--r--drivers/misc/mei/interrupt.c16
-rw-r--r--drivers/misc/mei/main.c8
-rw-r--r--drivers/misc/mei/mei_dev.h6
7 files changed, 31 insertions, 63 deletions
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 4060e2f40286..2cc41cb3bb38 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -213,15 +213,15 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
213 * remove message from deletion list 213 * remove message from deletion list
214 */ 214 */
215 215
216 dev_dbg(dev->dev, "amthif cb->response_buffer size - %d\n", 216 dev_dbg(dev->dev, "amthif cb->buf size - %d\n",
217 cb->response_buffer.size); 217 cb->buf.size);
218 dev_dbg(dev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx); 218 dev_dbg(dev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx);
219 219
220 /* length is being truncated to PAGE_SIZE, however, 220 /* length is being truncated to PAGE_SIZE, however,
221 * the buf_idx may point beyond */ 221 * the buf_idx may point beyond */
222 length = min_t(size_t, length, (cb->buf_idx - *offset)); 222 length = min_t(size_t, length, (cb->buf_idx - *offset));
223 223
224 if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) { 224 if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
225 dev_dbg(dev->dev, "failed to copy data to userland\n"); 225 dev_dbg(dev->dev, "failed to copy data to userland\n");
226 rets = -EFAULT; 226 rets = -EFAULT;
227 } else { 227 } else {
@@ -260,7 +260,7 @@ static int mei_amthif_read_start(struct mei_cl *cl, struct file *file)
260 goto err; 260 goto err;
261 } 261 }
262 262
263 rets = mei_io_cb_alloc_resp_buf(cb, length); 263 rets = mei_io_cb_alloc_buf(cb, length);
264 if (rets) 264 if (rets)
265 goto err; 265 goto err;
266 266
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 025626f4467d..36b949a0fddb 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -261,11 +261,11 @@ static ssize_t ___mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
261 goto out; 261 goto out;
262 } 262 }
263 263
264 rets = mei_io_cb_alloc_req_buf(cb, length); 264 rets = mei_io_cb_alloc_buf(cb, length);
265 if (rets < 0) 265 if (rets < 0)
266 goto out; 266 goto out;
267 267
268 memcpy(cb->request_buffer.data, buf, length); 268 memcpy(cb->buf.data, buf, length);
269 269
270 rets = mei_cl_write(cl, cb, blocking); 270 rets = mei_cl_write(cl, cb, blocking);
271 271
@@ -328,7 +328,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
328 } 328 }
329 329
330 r_length = min_t(size_t, length, cb->buf_idx); 330 r_length = min_t(size_t, length, cb->buf_idx);
331 memcpy(buf, cb->response_buffer.data, r_length); 331 memcpy(buf, cb->buf.data, r_length);
332 rets = r_length; 332 rets = r_length;
333 333
334free: 334free:
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index d9f4e28ac972..5ecb6cc79d70 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -376,8 +376,7 @@ void mei_io_cb_free(struct mei_cl_cb *cb)
376 if (cb == NULL) 376 if (cb == NULL)
377 return; 377 return;
378 378
379 kfree(cb->request_buffer.data); 379 kfree(cb->buf.data);
380 kfree(cb->response_buffer.data);
381 kfree(cb); 380 kfree(cb);
382} 381}
383 382
@@ -406,7 +405,7 @@ struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp)
406} 405}
407 406
408/** 407/**
409 * mei_io_cb_alloc_req_buf - allocate request buffer 408 * mei_io_cb_alloc_buf - allocate callback buffer
410 * 409 *
411 * @cb: io callback structure 410 * @cb: io callback structure
412 * @length: size of the buffer 411 * @length: size of the buffer
@@ -415,7 +414,7 @@ struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp)
415 * -EINVAL if cb is NULL 414 * -EINVAL if cb is NULL
416 * -ENOMEM if allocation failed 415 * -ENOMEM if allocation failed
417 */ 416 */
418int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length) 417int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length)
419{ 418{
420 if (!cb) 419 if (!cb)
421 return -EINVAL; 420 return -EINVAL;
@@ -423,38 +422,12 @@ int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length)
423 if (length == 0) 422 if (length == 0)
424 return 0; 423 return 0;
425 424
426 cb->request_buffer.data = kmalloc(length, GFP_KERNEL); 425 cb->buf.data = kmalloc(length, GFP_KERNEL);
427 if (!cb->request_buffer.data) 426 if (!cb->buf.data)
428 return -ENOMEM; 427 return -ENOMEM;
429 cb->request_buffer.size = length; 428 cb->buf.size = length;
430 return 0; 429 return 0;
431} 430}
432/**
433 * mei_io_cb_alloc_resp_buf - allocate response buffer
434 *
435 * @cb: io callback structure
436 * @length: size of the buffer
437 *
438 * Return: 0 on success
439 * -EINVAL if cb is NULL
440 * -ENOMEM if allocation failed
441 */
442int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length)
443{
444 if (!cb)
445 return -EINVAL;
446
447 if (length == 0)
448 return 0;
449
450 cb->response_buffer.data = kmalloc(length, GFP_KERNEL);
451 if (!cb->response_buffer.data)
452 return -ENOMEM;
453 cb->response_buffer.size = length;
454 return 0;
455}
456
457
458 431
459/** 432/**
460 * mei_cl_flush_queues - flushes queue lists belonging to cl. 433 * mei_cl_flush_queues - flushes queue lists belonging to cl.
@@ -1005,7 +978,7 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
1005 goto out; 978 goto out;
1006 } 979 }
1007 980
1008 rets = mei_io_cb_alloc_resp_buf(cb, length); 981 rets = mei_io_cb_alloc_buf(cb, length);
1009 if (rets) 982 if (rets)
1010 goto out; 983 goto out;
1011 984
@@ -1059,7 +1032,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
1059 1032
1060 dev = cl->dev; 1033 dev = cl->dev;
1061 1034
1062 buf = &cb->request_buffer; 1035 buf = &cb->buf;
1063 1036
1064 rets = mei_cl_flow_ctrl_creds(cl); 1037 rets = mei_cl_flow_ctrl_creds(cl);
1065 if (rets < 0) 1038 if (rets < 0)
@@ -1094,7 +1067,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
1094 } 1067 }
1095 1068
1096 cl_dbg(dev, cl, "buf: size = %d idx = %lu\n", 1069 cl_dbg(dev, cl, "buf: size = %d idx = %lu\n",
1097 cb->request_buffer.size, cb->buf_idx); 1070 cb->buf.size, cb->buf_idx);
1098 1071
1099 rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx); 1072 rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
1100 if (rets) { 1073 if (rets) {
@@ -1144,7 +1117,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
1144 dev = cl->dev; 1117 dev = cl->dev;
1145 1118
1146 1119
1147 buf = &cb->request_buffer; 1120 buf = &cb->buf;
1148 1121
1149 cl_dbg(dev, cl, "size=%d\n", buf->size); 1122 cl_dbg(dev, cl, "size=%d\n", buf->size);
1150 1123
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 21cf626e8908..d430a6e09ae8 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -49,8 +49,7 @@ void mei_me_cl_rm_all(struct mei_device *dev);
49 */ 49 */
50struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp); 50struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp);
51void mei_io_cb_free(struct mei_cl_cb *priv_cb); 51void mei_io_cb_free(struct mei_cl_cb *priv_cb);
52int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length); 52int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length);
53int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length);
54 53
55 54
56/** 55/**
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 466c1d22fb16..60469a0053bb 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -134,19 +134,17 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
134 134
135 cl->reading_state = MEI_READING; 135 cl->reading_state = MEI_READING;
136 136
137 if (cb->response_buffer.size == 0 || 137 if (cb->buf.size == 0 || cb->buf.data == NULL) {
138 cb->response_buffer.data == NULL) {
139 cl_err(dev, cl, "response buffer is not allocated.\n"); 138 cl_err(dev, cl, "response buffer is not allocated.\n");
140 list_move_tail(&cb->list, &complete_list->list); 139 list_move_tail(&cb->list, &complete_list->list);
141 cb->status = -ENOMEM; 140 cb->status = -ENOMEM;
142 goto out; 141 goto out;
143 } 142 }
144 143
145 if (cb->response_buffer.size < mei_hdr->length + cb->buf_idx) { 144 if (cb->buf.size < mei_hdr->length + cb->buf_idx) {
146 cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n", 145 cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n",
147 cb->response_buffer.size, mei_hdr->length, cb->buf_idx); 146 cb->buf.size, mei_hdr->length, cb->buf_idx);
148 buffer = krealloc(cb->response_buffer.data, 147 buffer = krealloc(cb->buf.data, mei_hdr->length + cb->buf_idx,
149 mei_hdr->length + cb->buf_idx,
150 GFP_KERNEL); 148 GFP_KERNEL);
151 149
152 if (!buffer) { 150 if (!buffer) {
@@ -154,11 +152,11 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
154 list_move_tail(&cb->list, &complete_list->list); 152 list_move_tail(&cb->list, &complete_list->list);
155 goto out; 153 goto out;
156 } 154 }
157 cb->response_buffer.data = buffer; 155 cb->buf.data = buffer;
158 cb->response_buffer.size = mei_hdr->length + cb->buf_idx; 156 cb->buf.size = mei_hdr->length + cb->buf_idx;
159 } 157 }
160 158
161 buffer = cb->response_buffer.data + cb->buf_idx; 159 buffer = cb->buf.data + cb->buf_idx;
162 mei_read_slots(dev, buffer, mei_hdr->length); 160 mei_read_slots(dev, buffer, mei_hdr->length);
163 161
164 cb->buf_idx += mei_hdr->length; 162 cb->buf_idx += mei_hdr->length;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 9d1a8cba81c9..1d44d110ed94 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -264,7 +264,7 @@ copy_buffer:
264 } 264 }
265 265
266 dev_dbg(dev->dev, "buf.size = %d buf.idx= %ld\n", 266 dev_dbg(dev->dev, "buf.size = %d buf.idx= %ld\n",
267 cb->response_buffer.size, cb->buf_idx); 267 cb->buf.size, cb->buf_idx);
268 if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) { 268 if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
269 rets = -EMSGSIZE; 269 rets = -EMSGSIZE;
270 goto free; 270 goto free;
@@ -274,7 +274,7 @@ copy_buffer:
274 * however buf_idx may point beyond that */ 274 * however buf_idx may point beyond that */
275 length = min_t(size_t, length, cb->buf_idx - *offset); 275 length = min_t(size_t, length, cb->buf_idx - *offset);
276 276
277 if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) { 277 if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
278 dev_dbg(dev->dev, "failed to copy data to userland\n"); 278 dev_dbg(dev->dev, "failed to copy data to userland\n");
279 rets = -EFAULT; 279 rets = -EFAULT;
280 goto free; 280 goto free;
@@ -389,11 +389,11 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
389 rets = -ENOMEM; 389 rets = -ENOMEM;
390 goto out; 390 goto out;
391 } 391 }
392 rets = mei_io_cb_alloc_req_buf(write_cb, length); 392 rets = mei_io_cb_alloc_buf(write_cb, length);
393 if (rets) 393 if (rets)
394 goto out; 394 goto out;
395 395
396 rets = copy_from_user(write_cb->request_buffer.data, ubuf, length); 396 rets = copy_from_user(write_cb->buf.data, ubuf, length);
397 if (rets) { 397 if (rets) {
398 dev_dbg(dev->dev, "failed to copy data from userland\n"); 398 dev_dbg(dev->dev, "failed to copy data from userland\n");
399 rets = -EFAULT; 399 rets = -EFAULT;
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 57a47d6b63ee..1a0f6e9588b6 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -194,8 +194,7 @@ struct mei_cl;
194 * @list: link in callback queue 194 * @list: link in callback queue
195 * @cl: file client who is running this operation 195 * @cl: file client who is running this operation
196 * @fop_type: file operation type 196 * @fop_type: file operation type
197 * @request_buffer: buffer to store request data 197 * @buf: buffer for data associated with the callback
198 * @response_buffer: buffer to store response data
199 * @buf_idx: last read index 198 * @buf_idx: last read index
200 * @read_time: last read operation time stamp (iamthif) 199 * @read_time: last read operation time stamp (iamthif)
201 * @file_object: pointer to file structure 200 * @file_object: pointer to file structure
@@ -207,8 +206,7 @@ struct mei_cl_cb {
207 struct list_head list; 206 struct list_head list;
208 struct mei_cl *cl; 207 struct mei_cl *cl;
209 enum mei_cb_file_ops fop_type; 208 enum mei_cb_file_ops fop_type;
210 struct mei_msg_data request_buffer; 209 struct mei_msg_data buf;
211 struct mei_msg_data response_buffer;
212 unsigned long buf_idx; 210 unsigned long buf_idx;
213 unsigned long read_time; 211 unsigned long read_time;
214 struct file *file_object; 212 struct file *file_object;