kernel/git/stable/linux.git/drivers/misc/mei, branch linux-7.1.y

mei: pull kvfree out of spinlock

2026-08-19T16:20:25+00:00

commit b0495bb58af06a7de4628c72d500e3d5e180d808 upstream. The read buffer allocation was changed from kmalloc() to kvmalloc(). This buffer is part of mei_cl_cb structure that can be queued in rd_complete queue protected by spinlock. Releasing the structure leads to errors like below when freeing buffer that allocated non-contiguous: BUG: sleeping function called from invalid context at mm/vmalloc.c:3448 Separate mei_cl_cb structure dequeue and release to perform only dequeue under spinlock and push release out of spinlock. Cc: stable Fixes: 4adf613e01bf ("mei: use kvmalloc for read buffer") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16359 Reviewed-by: Menachem Adin Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260719-kvfree_out_of_spinlock-v1-1-e07d6333bea7@intel.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

mei: bus: access mei_device under device_lock on cleanup

2026-08-03T09:25:53+00:00

commit f112ea910e554d58b4b39a4492b7d302f0f4204f upstream. Fix couple of problems in mei_cl_bus_dev_release(): mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus. Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus). This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too. Cc: stable Fixes: 35e8a426b16a ("mei: bus: Check for still connected devices in mei_cl_bus_dev_release()") Reviewed-by: Menachem Adin Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260705151259.3054795-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

mei: me: add nova lake point H DID

2026-04-06T09:40:38+00:00

Add Nova Lake H device id. Cc: stable Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405141758.1634556-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: lb: add late binding version 2

2026-04-06T09:39:55+00:00

The second Late Binding version allows to send payload bigger than client MTU by splitting it to chunks and uses separate firmware client for transfer. The component interface is unchanged and driver doing all splitting. Only one Late Binding version is supported by firmware. When Late binding version 2 is supported, the new client is advertised by firmware and existing MKHI will have version 2. This helps driver to select the right mode of work. Reviewed-by: Andy Shevchenko Reviewed-by: Badal Nilawar Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405112326.1535208-3-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: bus: add mei_cldev_uuid

2026-04-06T09:39:54+00:00

Add mei_cldev_uuid API on mei bus to allow client to query what UUID it bound to. Reviewed-by: Andy Shevchenko Reviewed-by: Badal Nilawar Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260405112326.1535208-2-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

Merge tag 'v7.0-rc7' into char-misc-next

2026-04-06T07:04:53+00:00

We need the char/misc/iio/comedi fixes in here as well for testing Signed-off-by: Greg Kroah-Hartman

mei: csc: wake device while reading firmware status

2026-04-02T15:08:37+00:00

The CSC has firmware status registers in MMIO and they may be unaccessible while device is suspended. Wake device while reading firmware status via sysfs. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-8-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: csc: support controller with separate PCI device

2026-04-02T15:08:37+00:00

Intel PCI driver for chassis controller embedded in Intel graphics devices. An MEI device here called CSC can be embedded in discrete Intel graphics devices having separate PCI device, to support a range of chassis tasks such as graphics card firmware update and security tasks. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-7-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: convert PCI error to common errno

2026-04-02T15:08:37+00:00

Ensure that callers receive only < 0 return value on error. Convert PCI error returned by pci_read_config_dword() to common errno before returning from function. Reviewed-by: Mika Westerberg Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-6-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman

mei: trace: print return value of pci_cfg_read

2026-04-02T15:08:36+00:00

Extend debug capabilities. Add return value print in the trace_mei_pci_cfg_read(). Reviewed-by: Andy Shevchenko Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260201094358.1440593-5-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman