kernel/linux.git/drivers/misc/mei/interrupt.c, branch v6.18.22

mei: hook mei_device on class device

2025-09-06T17:50:54+00:00

mei_device lifetime was managed by devm procedure of parent device. But such memory is freed on device_del. Mei_device object is used by client object that may be alive after parent device is removed. It may lead to use-after-free if discrete graphics driver unloads mei_gsc auxiliary device while user-space holds open handle to mei character device. Connect mei_device structure lifteme to mei class device lifetime by adding mei_device free to class device remove callback. Move exising parent device pointer to separate field in mei_device to avoid misuse. Allocate character device dynamically and allow to control its own lifetime as it may outlive mei_device structure while character device closes after parent device is removed from the system. Leave power management on parent device as we overwrite pci runtime pm procedure and user-space is expecting it there. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201 Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: more prints with client prefix

2025-07-19T07:57:55+00:00

Use client-aware print macro instead of usual device print in more places to expand debug-ability. The client-aware print macro prefixes the usual device print with current connection endpoints. Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250717141112.1696482-3-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: Cast the cb->ext_hdr allocation type

2025-05-01T15:57:15+00:00

In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct mei_ext_hdr *", but the returned type will be "struct mei_ext_hdr_gsc_f2h *", which is a larger allocation size. This is by design as struct mei_ext_hdr_gsc_f2h contains struct mei_ext_hdr as its first member. Cast the allocation to the match the assignment. Signed-off-by: Kees Cook Acked-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250426061815.work.435-kees@kernel.org Signed-off-by: Greg Kroah-Hartman

misc: mei: interrupt.c: fix kernel-doc warnings

2023-10-18T08:01:34+00:00

Fix kernel-doc warnings in interrupt.c: interrupt.c:631: warning: contents before sections Signed-off-by: Randy Dunlap Cc: Tomas Winkler Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20231012024845.29169-7-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman

mei: docs: fix spelling errors

2023-10-18T08:01:33+00:00

Fix spelling errors in the mei code base. Signed-off-by: Tomas Winkler Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20231011074301.223879-4-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: add support to GSC extended header

2022-10-03T18:29:07+00:00

GSC extend header is of variable size and data is provided in a sgl list inside the header and not in the data buffers, need to enable the path. Signed-off-by: Tomas Winkler Signed-off-by: Daniele Ceraolo Spurio Cc: Vitaly Lubart Cc: Greg Kroah-Hartman Reviewed-by: Greg Kroah-Hartman Link: https://patchwork.freedesktop.org/patch/msgid/20220928004145.745803-2-daniele.ceraolospurio@intel.com

mei: avoid iterator usage outside of list_for_each_entry

2022-03-18T12:48:30+00:00

Usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Do not reference the loop variable outside of the loop, by rearranging the orders of execution. Instead of performing search loop and checking outside the loop if the end of the list was hit and no matching element was found, the execution is performed inside the loop upon a successful match followed by a goto statement to the next step, therefore no condition has to be performed after the loop has ended. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220308095926.300412-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: revamp mei extension header structure layout.

2021-06-22T10:40:31+00:00

The mei extension header was build as array of flexible structures which will not work if actually more headers are added. (Currently only vtag header was used). Sparse reports: drivers/misc/mei/hw.h:253:32: warning: array of flexible structures Use basic type u8 for the variable sized extension. Define explicitly mei_ext_hdr_vtag structure. And also fix mei_ext_next() function to point correctly to the end of the header. Note: the headers are part of firmware interface and need to be __packed. Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20210621193756.134027-2-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: request autosuspend after sending rx flow control

2021-05-27T13:17:19+00:00

A rx flow control waiting in the control queue may block autosuspend. Re-request autosuspend after flow control been sent to unblock the transition to the low power state. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20210526193334.445759-1-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman

mei: implement client dma setup.

2021-02-06T14:48:11+00:00

Implement HBM message protocol to setup and tear down DMA buffer on behalf of an client. On top there DMA buffer allocation and its life time management. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20210206144325.25682-5-tomas.winkler@intel.com Signed-off-by: Greg Kroah-Hartman