drivers/misc/mei/mei_lb.c - third_party/linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2025 Intel Corporation
  */

 #include <linux/component.h>
 #include <linux/mei_cl_bus.h>
 #include <linux/module.h>
 #include <linux/overflow.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/uuid.h>

 #include <drm/intel/i915_component.h>
 #include <drm/intel/intel_lb_mei_interface.h>

 #include "mkhi.h"

 /**
  * DOC: Late Binding Firmware Update/Upload
  *
  * Late Binding is a firmware update/upload mechanism that allows configuration
  * payloads to be securely delivered and applied at runtime, rather than
  * being embedded in the system firmware image (e.g., IFWI or SPI flash).
  *
  * This mechanism is used to update device-level configuration such as:
  * - Fan controller
  * - Voltage regulator (VR)
  *
  * Key Characteristics:
  * ---------------------
  * - Runtime Delivery:
  *   Firmware blobs are loaded by the host driver (e.g., Xe KMD)
  *   after the GPU or SoC has booted.
  *
  * - Secure and Authenticated:
  *   All payloads are signed and verified by the authentication firmware.
  *
  * - No Firmware Flashing Required:
  *   Updates are applied in volatile memory and do not require SPI flash
  *   modification or system reboot.
  *
  * - Re-entrant:
  *   Multiple updates of the same or different types can be applied
  *   sequentially within a single boot session.
  *
  * - Version Controlled:
  *   Each payload includes version and security version number (SVN)
  *   metadata to support anti-rollback enforcement.
  *
  * Upload Flow:
  * ------------
  * 1. Host driver (KMD or user-space tool) loads the late binding firmware.
  * 2. Firmware is passed to the MEI interface and forwarded to
  *    authentication firmware.
  * 3. Authentication firmware authenticates the payload and extracts
  *    command and data arrays.
  * 4. Authentication firmware delivers the configuration to PUnit/PCODE.
  * 5. Status is returned back to the host via MEI.
  */

 /* Late Binding version 1 */

 #define INTEL_LB_CMD	0x12
 #define INTEL_LB_RSP	(INTEL_LB_CMD | 0x80)

 #define INTEL_LB_SEND_TIMEOUT_MSEC 3000
 #define INTEL_LB_RECV_TIMEOUT_MSEC 3000

 #define MEI_GUID_MKHI UUID_LE(0xe2c2afa2, 0x3817, 0x4d19, \
 			      0x9d, 0x95, 0x6, 0xb1, 0x6b, 0x58, 0x8a, 0x5d)

 /**
  * struct mei_lb_req - Late Binding request structure
  * @header: MKHI message header (see struct mkhi_msg_hdr)
  * @type: Type of the Late Binding payload
  * @flags: Flags to be passed to the authentication firmware (e.g. %INTEL_LB_FLAGS_IS_PERSISTENT)
  * @reserved: Reserved for future use by authentication firmware, must be set to 0
  * @payload_size: Size of the payload data in bytes
  * @payload: Payload data to be sent to the authentication firmware
  */
 struct mei_lb_req {
 	struct mkhi_msg_hdr header;
 	__le32 type;
 	__le32 flags;
 	__le32 reserved[2];
 	__le32 payload_size;
 	u8 payload[] __counted_by(payload_size);
 } __packed;

 /**
  * struct mei_lb_rsp - Late Binding response structure
  * @header: MKHI message header (see struct mkhi_msg_hdr)
  * @type: Type of the Late Binding payload
  * @reserved: Reserved for future use by authentication firmware, must be set to 0
  * @status: Status returned by authentication firmware (see &enum intel_lb_status)
  */
 struct mei_lb_rsp {
 	struct mkhi_msg_hdr header;
 	__le32 type;
 	__le32 reserved[2];
 	__le32 status;
 } __packed;

 /* Late Binding version 2 */

 #define MEI_LB2_CMD 0x01

 #define MEI_LB2_HDR_FLAG_RSP 0x01

 #define MEI_GUID_LB UUID_LE(0x4ed87243, 0x3980, 0x4d8e, \
 			    0xb1, 0xf9, 0x6f, 0xb7, 0xc0, 0x14, 0x8c, 0x4d)

 /**
  * struct mei_lb2_header - Late Binding2 header
  * @command_id:
  * @flags: Flags for transport layer (e.g. MEI_LB2_HDR_FLAG_RSP)
  * @reserved: Reserved for future use by authentication firmware, must be set to 0
  */
 struct mei_lb2_header {
 	__le32 command_id;
 	u8 flags;
 	u8 reserved[3];
 };

 /**
  * struct mei_lb2_rsp_header - Late Binding2 response header
  * @header: Common command header
  * @status: Status returned by authentication firmware (see &enum intel_lb_status)
  */
 struct mei_lb2_rsp_header {
 	struct mei_lb2_header header;
 	__le32 status;
 };

 #define MEI_LB2_FLAG_FST_CHUNK 0x02
 #define MEI_LB2_FLAG_LST_CHUNK 0x04

 /**
  * struct mei_lb2_req - Late Binding2 request
  * @header: Common command header
  * @type: Type of the Late Binding payload (see &enum intel_lb_type)
  * @flags: Flags to be passed to the authentication firmware (MEI_LB2_FLAG_*)
  * @reserved: Reserved for future use by authentication firmware, must be set to 0
  * @total_payload_size: Size of whole Late Binding package in bytes
  * @payload_size: Size of the payload chunk in bytes
  * @payload: Data chunk to be sent to the authentication firmware
  */
 struct mei_lb2_req {
 	struct mei_lb2_header header;
 	__le32 type;
 	__le32 flags;
 	__le32 reserved;
 	__le32 total_payload_size;
 	__le32 payload_size;
 	u8 payload[] __counted_by(payload_size);
 };

 /**
  * struct mei_lb2_rsp - Late Binding2 response
  * @rheader: Common response header
  * @type: Type of the Late Binding payload (see &enum intel_lb_type)
  * @reserved: Reserved for future use by authentication firmware, must be set to 0
  */
 struct mei_lb2_rsp {
 	struct mei_lb2_rsp_header rheader;
 	__le32 type;
 	__le32 reserved[2];
 };

 static bool mei_lb_check_response_v1(const struct device *dev, ssize_t bytes,
 				     struct mei_lb_rsp *rsp)
 {
 	/*
 	 * Received message size may be smaller than the full message size when
 	 * reply contains only MKHI header with result field set to the error code.
 	 * Check the header size and content first to output exact error, if needed,
 	 * and then process to the whole message.
 	 */
 	if (bytes < sizeof(rsp->header)) {
 		dev_err(dev, "Received less than header size from the firmware: %zd < %zu\n",
 			bytes, sizeof(rsp->header));
 		return false;
 	}
 	if (rsp->header.group_id != MKHI_GROUP_ID_GFX) {
 		dev_err(dev, "Mismatch group id: 0x%x instead of 0x%x\n",
 			rsp->header.group_id, MKHI_GROUP_ID_GFX);
 		return false;
 	}
 	if (rsp->header.command != INTEL_LB_RSP) {
 		dev_err(dev, "Mismatch command: 0x%x instead of 0x%x\n",
 			rsp->header.command, INTEL_LB_RSP);
 		return false;
 	}
 	if (rsp->header.result) {
 		dev_err(dev, "Error in result: 0x%x\n", rsp->header.result);
 		return false;
 	}
 	if (bytes < sizeof(*rsp)) {
 		dev_err(dev, "Received less than message size from the firmware: %zd < %zu\n",
 			bytes, sizeof(*rsp));
 		return false;
 	}

 	return true;
 }

 static int mei_lb_push_payload_v1(struct device *dev, struct mei_cl_device *cldev,
 				  u32 type, u32 flags, const void *payload, size_t payload_size)
 {
 	struct mei_lb_req *req = NULL;
 	struct mei_lb_rsp rsp;
 	size_t req_size;
 	ssize_t bytes;
 	int ret;

 	req_size = struct_size(req, payload, payload_size);
 	if (req_size > mei_cldev_mtu(cldev)) {
 		dev_err(dev, "Payload is too big: %zu\n", payload_size);
 		ret = -EMSGSIZE;
 		goto end;
 	}

 	req = kmalloc(req_size, GFP_KERNEL);
 	if (!req) {
 		ret = -ENOMEM;
 		goto end;
 	}

 	req->header.group_id = MKHI_GROUP_ID_GFX;
 	req->header.command = INTEL_LB_CMD;
 	req->type = cpu_to_le32(type);
 	req->flags = cpu_to_le32(flags);
 	req->reserved[0] = 0;
 	req->reserved[1] = 0;
 	req->payload_size = cpu_to_le32(payload_size);
 	memcpy(req->payload, payload, payload_size);

 	bytes = mei_cldev_send_timeout(cldev, (u8 *)req, req_size,
 				       INTEL_LB_SEND_TIMEOUT_MSEC);
 	if (bytes < 0) {
 		dev_err(dev, "Failed to send late binding request to firmware. %zd\n", bytes);
 		ret = bytes;
 		goto end;
 	}

 	bytes = mei_cldev_recv_timeout(cldev, (u8 *)&rsp, sizeof(rsp),
 				       INTEL_LB_RECV_TIMEOUT_MSEC);
 	if (bytes < 0) {
 		dev_err(dev, "Failed to receive late binding reply from MEI firmware. %zd\n",
 			bytes);
 		ret = bytes;
 		goto end;
 	}
 	if (!mei_lb_check_response_v1(dev, bytes, &rsp)) {
 		dev_err(dev, "Bad response from the firmware. header: %02x %02x %02x %02x\n",
 			rsp.header.group_id, rsp.header.command,
 			rsp.header.reserved, rsp.header.result);
 		ret = -EPROTO;
 		goto end;
 	}

 	dev_dbg(dev, "status = %u\n", le32_to_cpu(rsp.status));
 	ret = (int)le32_to_cpu(rsp.status);
 end:
 	kfree(req);
 	return ret;
 }

 static int mei_lb_check_response_v2(const struct device *dev, ssize_t bytes,
 				    struct mei_lb2_rsp *rsp)
 {
 	/*
 	 * Received message size may be smaller than the full message size when
 	 * reply contains only header with status field set to the error code.
 	 * Check the header size and content first to output exact error, if needed,
 	 * and then process to the whole message.
 	 */
 	if (bytes < sizeof(rsp->rheader)) {
 		dev_err(dev, "Received less than header size from the firmware: %zd < %zu\n",
 			bytes, sizeof(rsp->rheader));
 		return -ENOMSG;
 	}
 	if (rsp->rheader.header.command_id != MEI_LB2_CMD) {
 		dev_err(dev, "Mismatch command: 0x%x instead of 0x%x\n",
 			rsp->rheader.header.command_id, MEI_LB2_CMD);
 		return -EPROTO;
 	}
 	if (!(rsp->rheader.header.flags & MEI_LB2_HDR_FLAG_RSP)) {
 		dev_err(dev, "Not a response: 0x%x\n", rsp->rheader.header.flags);
 		return -EBADMSG;
 	}
 	if (rsp->rheader.status) {
 		dev_err(dev, "Error in result: 0x%x\n", rsp->rheader.status);
 		return (int)le32_to_cpu(rsp->rheader.status);
 	}
 	if (bytes < sizeof(*rsp)) {
 		dev_err(dev, "Received less than message size from the firmware: %zd < %zu\n",
 			bytes, sizeof(*rsp));
 		return -ENODATA;
 	}

 	return 0;
 }

 static int mei_lb_push_payload_v2(struct device *dev, struct mei_cl_device *cldev,
 				  u32 type, u32 flags, const void *payload, size_t payload_size)
 {
 	u32 first_chunk, last_chunk;
 	struct mei_lb2_rsp rsp;
 	size_t sent_data = 0;
 	size_t chunk_size;
 	size_t req_size;
 	ssize_t bytes;
 	int ret;

 	struct mei_lb2_req *req __free(kfree) = kzalloc(mei_cldev_mtu(cldev), GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;

 	first_chunk = MEI_LB2_FLAG_FST_CHUNK;
 	last_chunk = 0;
 	do {
 		chunk_size = min(payload_size - sent_data, mei_cldev_mtu(cldev) - sizeof(*req));

 		req_size = struct_size(req, payload, chunk_size);
 		if (sent_data + chunk_size == payload_size)
 			last_chunk = MEI_LB2_FLAG_LST_CHUNK;

 		req->header.command_id = MEI_LB2_CMD;
 		req->type = cpu_to_le32(type);
 		req->flags = cpu_to_le32(flags | first_chunk | last_chunk);
 		req->reserved = 0;
 		req->total_payload_size = cpu_to_le32(payload_size);
 		req->payload_size = cpu_to_le32(chunk_size);
 		memcpy(req->payload, payload + sent_data, chunk_size);

 		dev_dbg(dev, "Sending %zu bytes from offset %zu of %zu%s%s\n",
 			chunk_size, sent_data, payload_size,
 			first_chunk ? " first" : "", last_chunk ? " last" : "");

 		bytes = mei_cldev_send_timeout(cldev, (u8 *)req, req_size,
 					       INTEL_LB_SEND_TIMEOUT_MSEC);
 		if (bytes < 0) {
 			dev_err(dev, "Failed to send late binding request to firmware. %zd\n",
 				bytes);
 			return bytes;
 		}

 		bytes = mei_cldev_recv_timeout(cldev, (u8 *)&rsp, sizeof(rsp),
 					       INTEL_LB_RECV_TIMEOUT_MSEC);
 		if (bytes < 0) {
 			dev_err(dev, "Failed to receive late binding reply from firmware. %zd\n",
 				bytes);
 			return bytes;
 		}
 		ret = mei_lb_check_response_v2(dev, bytes, &rsp);
 		if (ret)
 			return ret;

 		/* prepare for the next chunk */
 		sent_data += chunk_size;
 		first_chunk = 0;
 	} while (!last_chunk);

 	return 0;
 }

 static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
 			       const void *payload, size_t payload_size)
 {
 	struct mei_cl_device *cldev = to_mei_cl_device(dev);
 	int ret;

 	ret = mei_cldev_enable(cldev);
 	if (ret) {
 		dev_dbg(dev, "Failed to enable firmware client. %d\n", ret);
 		return ret;
 	}

 	if (memcmp(&MEI_GUID_LB, mei_cldev_uuid(cldev), sizeof(uuid_le)) == 0)
 		ret = mei_lb_push_payload_v2(dev, cldev, type, flags, payload, payload_size);
 	else
 		ret = mei_lb_push_payload_v1(dev, cldev, type, flags, payload, payload_size);

 	mei_cldev_disable(cldev);
 	return ret;
 }

 static const struct intel_lb_component_ops mei_lb_ops = {
 	.push_payload = mei_lb_push_payload,
 };

 static int mei_lb_component_master_bind(struct device *dev)
 {
 	return component_bind_all(dev, (void *)&mei_lb_ops);
 }

 static void mei_lb_component_master_unbind(struct device *dev)
 {
 	component_unbind_all(dev, (void *)&mei_lb_ops);
 }

 static const struct component_master_ops mei_lb_component_master_ops = {
 	.bind = mei_lb_component_master_bind,
 	.unbind = mei_lb_component_master_unbind,
 };

 static int mei_lb_component_match(struct device *dev, int subcomponent,
 				  void *data)
 {
 	/*
 	 * This function checks if requester is Intel vendor,
 	 * determines if MEI is standalone PCI device or the auxiliary one
 	 * and checks the following:
 	 * 0) PCI parent: (e.g. /sys/class/mei/mei0/device -> ../../../0000:15:00.0)
 	 *  the requester and MEI device has the same grand parent
 	 * 1) Auxiliary parent: (e.g. /sys/class/mei/mei1/device -> ../../../xe.mei-gscfi.768)
 	 *  the requester is the parent of MEI device
 	 */
 	struct device *base = data;
 	struct device *basep = dev;
 	struct pci_dev *pdev;

 	if (!dev)
 		return 0;

 	if (!dev_is_pci(dev))
 		return 0;

 	pdev = to_pci_dev(dev);

 	if (pdev->vendor != PCI_VENDOR_ID_INTEL)
 		return 0;

 	if (subcomponent != INTEL_COMPONENT_LB)
 		return 0;

 	base = base->parent;
 	if (!base) /* MEI device */
 		return 0;

 	if (dev_is_pci(base)) {
 		/* case 0) PCI parent */
 		base = base->parent; /* bridge 1 */
 		if (!base)
 			return 0;
 		base = base->parent; /* bridge 2 */

 		basep = basep->parent; /* bridge 1 */
 		if (!basep)
 			return 0;
 		basep = basep->parent; /* bridge 2 */
 	} else {
 		/* case 1) Auxiliary parent */
 		base = base->parent; /* PCI device */
 	}

 	return !!base && !!basep && base == basep;
 }

 static int mei_lb_probe(struct mei_cl_device *cldev,
 			const struct mei_cl_device_id *id)
 {
 	struct component_match *master_match = NULL;
 	int ret;

 	component_match_add_typed(&cldev->dev, &master_match,
 				  mei_lb_component_match, &cldev->dev);
 	if (IS_ERR_OR_NULL(master_match))
 		return -ENOMEM;

 	ret = component_master_add_with_match(&cldev->dev,
 					      &mei_lb_component_master_ops,
 					      master_match);
 	if (ret < 0)
 		dev_err(&cldev->dev, "Failed to add late binding master component. %d\n", ret);

 	return ret;
 }

 static void mei_lb_remove(struct mei_cl_device *cldev)
 {
 	component_master_del(&cldev->dev, &mei_lb_component_master_ops);
 }

 static const struct mei_cl_device_id mei_lb_tbl[] = {
 	{ .uuid = MEI_GUID_MKHI, .version = 1 },
 	{ .uuid = MEI_GUID_LB, .version = MEI_CL_VERSION_ANY },
 	{ }
 };
 MODULE_DEVICE_TABLE(mei, mei_lb_tbl);

 static struct mei_cl_driver mei_lb_driver = {
 	.id_table = mei_lb_tbl,
 	.name = "mei_lb",
 	.probe = mei_lb_probe,
 	.remove	= mei_lb_remove,
 };

 module_mei_cl_driver(mei_lb_driver);

 MODULE_AUTHOR("Intel Corporation");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MEI Late Binding Firmware Update/Upload");
	// SPDX-License-Identifier: GPL-2.0
	/*
	* Copyright (C) 2025 Intel Corporation
	*/

	#include <linux/component.h>
	#include <linux/mei_cl_bus.h>
	#include <linux/module.h>
	#include <linux/overflow.h>
	#include <linux/pci.h>
	#include <linux/slab.h>
	#include <linux/uuid.h>

	#include <drm/intel/i915_component.h>
	#include <drm/intel/intel_lb_mei_interface.h>

	#include "mkhi.h"

	/**
	* DOC: Late Binding Firmware Update/Upload
	*
	* Late Binding is a firmware update/upload mechanism that allows configuration
	* payloads to be securely delivered and applied at runtime, rather than
	* being embedded in the system firmware image (e.g., IFWI or SPI flash).
	*
	* This mechanism is used to update device-level configuration such as:
	* - Fan controller
	* - Voltage regulator (VR)
	*
	* Key Characteristics:
	* ---------------------
	* - Runtime Delivery:
	* Firmware blobs are loaded by the host driver (e.g., Xe KMD)
	* after the GPU or SoC has booted.
	*
	* - Secure and Authenticated:
	* All payloads are signed and verified by the authentication firmware.
	*
	* - No Firmware Flashing Required:
	* Updates are applied in volatile memory and do not require SPI flash
	* modification or system reboot.
	*
	* - Re-entrant:
	* Multiple updates of the same or different types can be applied
	* sequentially within a single boot session.
	*
	* - Version Controlled:
	* Each payload includes version and security version number (SVN)
	* metadata to support anti-rollback enforcement.
	*
	* Upload Flow:
	* ------------
	* 1. Host driver (KMD or user-space tool) loads the late binding firmware.
	* 2. Firmware is passed to the MEI interface and forwarded to
	* authentication firmware.
	* 3. Authentication firmware authenticates the payload and extracts
	* command and data arrays.
	* 4. Authentication firmware delivers the configuration to PUnit/PCODE.
	* 5. Status is returned back to the host via MEI.
	*/

	/* Late Binding version 1 */

	#define INTEL_LB_CMD 0x12
	#define INTEL_LB_RSP (INTEL_LB_CMD \| 0x80)

	#define INTEL_LB_SEND_TIMEOUT_MSEC 3000
	#define INTEL_LB_RECV_TIMEOUT_MSEC 3000

	#define MEI_GUID_MKHI UUID_LE(0xe2c2afa2, 0x3817, 0x4d19, \
	0x9d, 0x95, 0x6, 0xb1, 0x6b, 0x58, 0x8a, 0x5d)

	/**
	* struct mei_lb_req - Late Binding request structure
	* @header: MKHI message header (see struct mkhi_msg_hdr)
	* @type: Type of the Late Binding payload
	* @flags: Flags to be passed to the authentication firmware (e.g. %INTEL_LB_FLAGS_IS_PERSISTENT)
	* @reserved: Reserved for future use by authentication firmware, must be set to 0
	* @payload_size: Size of the payload data in bytes
	* @payload: Payload data to be sent to the authentication firmware
	*/
	struct mei_lb_req {
	struct mkhi_msg_hdr header;
	__le32 type;
	__le32 flags;
	__le32 reserved[2];
	__le32 payload_size;
	u8 payload[] __counted_by(payload_size);
	} __packed;

	/**
	* struct mei_lb_rsp - Late Binding response structure
	* @header: MKHI message header (see struct mkhi_msg_hdr)
	* @type: Type of the Late Binding payload
	* @reserved: Reserved for future use by authentication firmware, must be set to 0
	* @status: Status returned by authentication firmware (see &enum intel_lb_status)
	*/
	struct mei_lb_rsp {
	struct mkhi_msg_hdr header;
	__le32 type;
	__le32 reserved[2];
	__le32 status;
	} __packed;

	/* Late Binding version 2 */

	#define MEI_LB2_CMD 0x01

	#define MEI_LB2_HDR_FLAG_RSP 0x01

	#define MEI_GUID_LB UUID_LE(0x4ed87243, 0x3980, 0x4d8e, \
	0xb1, 0xf9, 0x6f, 0xb7, 0xc0, 0x14, 0x8c, 0x4d)

	/**
	* struct mei_lb2_header - Late Binding2 header
	* @command_id:
	* @flags: Flags for transport layer (e.g. MEI_LB2_HDR_FLAG_RSP)
	* @reserved: Reserved for future use by authentication firmware, must be set to 0
	*/
	struct mei_lb2_header {
	__le32 command_id;
	u8 flags;
	u8 reserved[3];
	};

	/**
	* struct mei_lb2_rsp_header - Late Binding2 response header
	* @header: Common command header
	* @status: Status returned by authentication firmware (see &enum intel_lb_status)
	*/
	struct mei_lb2_rsp_header {
	struct mei_lb2_header header;
	__le32 status;
	};

	#define MEI_LB2_FLAG_FST_CHUNK 0x02
	#define MEI_LB2_FLAG_LST_CHUNK 0x04

	/**
	* struct mei_lb2_req - Late Binding2 request
	* @header: Common command header
	* @type: Type of the Late Binding payload (see &enum intel_lb_type)
	* @flags: Flags to be passed to the authentication firmware (MEI_LB2_FLAG_*)
	* @reserved: Reserved for future use by authentication firmware, must be set to 0
	* @total_payload_size: Size of whole Late Binding package in bytes
	* @payload_size: Size of the payload chunk in bytes
	* @payload: Data chunk to be sent to the authentication firmware
	*/
	struct mei_lb2_req {
	struct mei_lb2_header header;
	__le32 type;
	__le32 flags;
	__le32 reserved;
	__le32 total_payload_size;
	__le32 payload_size;
	u8 payload[] __counted_by(payload_size);
	};

	/**
	* struct mei_lb2_rsp - Late Binding2 response
	* @rheader: Common response header
	* @type: Type of the Late Binding payload (see &enum intel_lb_type)
	* @reserved: Reserved for future use by authentication firmware, must be set to 0
	*/
	struct mei_lb2_rsp {
	struct mei_lb2_rsp_header rheader;
	__le32 type;
	__le32 reserved[2];
	};

	static bool mei_lb_check_response_v1(const struct device *dev, ssize_t bytes,
	struct mei_lb_rsp *rsp)
	{
	/*
	* Received message size may be smaller than the full message size when
	* reply contains only MKHI header with result field set to the error code.
	* Check the header size and content first to output exact error, if needed,
	* and then process to the whole message.
	*/
	if (bytes < sizeof(rsp->header)) {
	dev_err(dev, "Received less than header size from the firmware: %zd < %zu\n",
	bytes, sizeof(rsp->header));
	return false;
	}
	if (rsp->header.group_id != MKHI_GROUP_ID_GFX) {
	dev_err(dev, "Mismatch group id: 0x%x instead of 0x%x\n",
	rsp->header.group_id, MKHI_GROUP_ID_GFX);
	return false;
	}
	if (rsp->header.command != INTEL_LB_RSP) {
	dev_err(dev, "Mismatch command: 0x%x instead of 0x%x\n",
	rsp->header.command, INTEL_LB_RSP);
	return false;
	}
	if (rsp->header.result) {
	dev_err(dev, "Error in result: 0x%x\n", rsp->header.result);
	return false;
	}
	if (bytes < sizeof(*rsp)) {
	dev_err(dev, "Received less than message size from the firmware: %zd < %zu\n",
	bytes, sizeof(*rsp));
	return false;
	}

	return true;
	}

	static int mei_lb_push_payload_v1(struct device dev, struct mei_cl_device cldev,
	u32 type, u32 flags, const void *payload, size_t payload_size)
	{
	struct mei_lb_req *req = NULL;
	struct mei_lb_rsp rsp;
	size_t req_size;
	ssize_t bytes;
	int ret;

	req_size = struct_size(req, payload, payload_size);
	if (req_size > mei_cldev_mtu(cldev)) {
	dev_err(dev, "Payload is too big: %zu\n", payload_size);
	ret = -EMSGSIZE;
	goto end;
	}

	req = kmalloc(req_size, GFP_KERNEL);
	if (!req) {
	ret = -ENOMEM;
	goto end;
	}

	req->header.group_id = MKHI_GROUP_ID_GFX;
	req->header.command = INTEL_LB_CMD;
	req->type = cpu_to_le32(type);
	req->flags = cpu_to_le32(flags);
	req->reserved[0] = 0;
	req->reserved[1] = 0;
	req->payload_size = cpu_to_le32(payload_size);
	memcpy(req->payload, payload, payload_size);

	bytes = mei_cldev_send_timeout(cldev, (u8 *)req, req_size,
	INTEL_LB_SEND_TIMEOUT_MSEC);
	if (bytes < 0) {
	dev_err(dev, "Failed to send late binding request to firmware. %zd\n", bytes);
	ret = bytes;
	goto end;
	}

	bytes = mei_cldev_recv_timeout(cldev, (u8 *)&rsp, sizeof(rsp),
	INTEL_LB_RECV_TIMEOUT_MSEC);
	if (bytes < 0) {
	dev_err(dev, "Failed to receive late binding reply from MEI firmware. %zd\n",
	bytes);
	ret = bytes;
	goto end;
	}
	if (!mei_lb_check_response_v1(dev, bytes, &rsp)) {
	dev_err(dev, "Bad response from the firmware. header: %02x %02x %02x %02x\n",
	rsp.header.group_id, rsp.header.command,
	rsp.header.reserved, rsp.header.result);
	ret = -EPROTO;
	goto end;
	}

	dev_dbg(dev, "status = %u\n", le32_to_cpu(rsp.status));
	ret = (int)le32_to_cpu(rsp.status);
	end:
	kfree(req);
	return ret;
	}

	static int mei_lb_check_response_v2(const struct device *dev, ssize_t bytes,
	struct mei_lb2_rsp *rsp)
	{
	/*
	* Received message size may be smaller than the full message size when
	* reply contains only header with status field set to the error code.
	* Check the header size and content first to output exact error, if needed,
	* and then process to the whole message.
	*/
	if (bytes < sizeof(rsp->rheader)) {
	dev_err(dev, "Received less than header size from the firmware: %zd < %zu\n",
	bytes, sizeof(rsp->rheader));
	return -ENOMSG;
	}
	if (rsp->rheader.header.command_id != MEI_LB2_CMD) {
	dev_err(dev, "Mismatch command: 0x%x instead of 0x%x\n",
	rsp->rheader.header.command_id, MEI_LB2_CMD);
	return -EPROTO;
	}
	if (!(rsp->rheader.header.flags & MEI_LB2_HDR_FLAG_RSP)) {
	dev_err(dev, "Not a response: 0x%x\n", rsp->rheader.header.flags);
	return -EBADMSG;
	}
	if (rsp->rheader.status) {
	dev_err(dev, "Error in result: 0x%x\n", rsp->rheader.status);
	return (int)le32_to_cpu(rsp->rheader.status);
	}
	if (bytes < sizeof(*rsp)) {
	dev_err(dev, "Received less than message size from the firmware: %zd < %zu\n",
	bytes, sizeof(*rsp));
	return -ENODATA;
	}

	return 0;
	}

	static int mei_lb_push_payload_v2(struct device dev, struct mei_cl_device cldev,
	u32 type, u32 flags, const void *payload, size_t payload_size)
	{
	u32 first_chunk, last_chunk;
	struct mei_lb2_rsp rsp;
	size_t sent_data = 0;
	size_t chunk_size;
	size_t req_size;
	ssize_t bytes;
	int ret;

	struct mei_lb2_req *req __free(kfree) = kzalloc(mei_cldev_mtu(cldev), GFP_KERNEL);
	if (!req)
	return -ENOMEM;

	first_chunk = MEI_LB2_FLAG_FST_CHUNK;
	last_chunk = 0;
	do {
	chunk_size = min(payload_size - sent_data, mei_cldev_mtu(cldev) - sizeof(*req));

	req_size = struct_size(req, payload, chunk_size);
	if (sent_data + chunk_size == payload_size)
	last_chunk = MEI_LB2_FLAG_LST_CHUNK;

	req->header.command_id = MEI_LB2_CMD;
	req->type = cpu_to_le32(type);
	req->flags = cpu_to_le32(flags \| first_chunk \| last_chunk);
	req->reserved = 0;
	req->total_payload_size = cpu_to_le32(payload_size);
	req->payload_size = cpu_to_le32(chunk_size);
	memcpy(req->payload, payload + sent_data, chunk_size);

	dev_dbg(dev, "Sending %zu bytes from offset %zu of %zu%s%s\n",
	chunk_size, sent_data, payload_size,
	first_chunk ? " first" : "", last_chunk ? " last" : "");

	bytes = mei_cldev_send_timeout(cldev, (u8 *)req, req_size,
	INTEL_LB_SEND_TIMEOUT_MSEC);
	if (bytes < 0) {
	dev_err(dev, "Failed to send late binding request to firmware. %zd\n",
	bytes);
	return bytes;
	}

	bytes = mei_cldev_recv_timeout(cldev, (u8 *)&rsp, sizeof(rsp),
	INTEL_LB_RECV_TIMEOUT_MSEC);
	if (bytes < 0) {
	dev_err(dev, "Failed to receive late binding reply from firmware. %zd\n",
	bytes);
	return bytes;
	}
	ret = mei_lb_check_response_v2(dev, bytes, &rsp);
	if (ret)
	return ret;

	/* prepare for the next chunk */
	sent_data += chunk_size;
	first_chunk = 0;
	} while (!last_chunk);

	return 0;
	}

	static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
	const void *payload, size_t payload_size)
	{
	struct mei_cl_device *cldev = to_mei_cl_device(dev);
	int ret;

	ret = mei_cldev_enable(cldev);
	if (ret) {
	dev_dbg(dev, "Failed to enable firmware client. %d\n", ret);
	return ret;
	}

	if (memcmp(&MEI_GUID_LB, mei_cldev_uuid(cldev), sizeof(uuid_le)) == 0)
	ret = mei_lb_push_payload_v2(dev, cldev, type, flags, payload, payload_size);
	else
	ret = mei_lb_push_payload_v1(dev, cldev, type, flags, payload, payload_size);

	mei_cldev_disable(cldev);
	return ret;
	}

	static const struct intel_lb_component_ops mei_lb_ops = {
	.push_payload = mei_lb_push_payload,
	};

	static int mei_lb_component_master_bind(struct device *dev)
	{
	return component_bind_all(dev, (void *)&mei_lb_ops);
	}

	static void mei_lb_component_master_unbind(struct device *dev)
	{
	component_unbind_all(dev, (void *)&mei_lb_ops);
	}

	static const struct component_master_ops mei_lb_component_master_ops = {
	.bind = mei_lb_component_master_bind,
	.unbind = mei_lb_component_master_unbind,
	};

	static int mei_lb_component_match(struct device *dev, int subcomponent,
	void *data)
	{
	/*
	* This function checks if requester is Intel vendor,
	* determines if MEI is standalone PCI device or the auxiliary one
	* and checks the following:
	* 0) PCI parent: (e.g. /sys/class/mei/mei0/device -> ../../../0000:15:00.0)
	* the requester and MEI device has the same grand parent
	* 1) Auxiliary parent: (e.g. /sys/class/mei/mei1/device -> ../../../xe.mei-gscfi.768)
	* the requester is the parent of MEI device
	*/
	struct device *base = data;
	struct device *basep = dev;
	struct pci_dev *pdev;

	if (!dev)
	return 0;

	if (!dev_is_pci(dev))
	return 0;

	pdev = to_pci_dev(dev);

	if (pdev->vendor != PCI_VENDOR_ID_INTEL)
	return 0;

	if (subcomponent != INTEL_COMPONENT_LB)
	return 0;

	base = base->parent;
	if (!base) /* MEI device */
	return 0;

	if (dev_is_pci(base)) {
	/* case 0) PCI parent */
	base = base->parent; /* bridge 1 */
	if (!base)
	return 0;
	base = base->parent; /* bridge 2 */

	basep = basep->parent; /* bridge 1 */
	if (!basep)
	return 0;
	basep = basep->parent; /* bridge 2 */
	} else {
	/* case 1) Auxiliary parent */
	base = base->parent; /* PCI device */
	}

	return !!base && !!basep && base == basep;
	}

	static int mei_lb_probe(struct mei_cl_device *cldev,
	const struct mei_cl_device_id *id)
	{
	struct component_match *master_match = NULL;
	int ret;

	component_match_add_typed(&cldev->dev, &master_match,
	mei_lb_component_match, &cldev->dev);
	if (IS_ERR_OR_NULL(master_match))
	return -ENOMEM;

	ret = component_master_add_with_match(&cldev->dev,
	&mei_lb_component_master_ops,
	master_match);
	if (ret < 0)
	dev_err(&cldev->dev, "Failed to add late binding master component. %d\n", ret);

	return ret;
	}

	static void mei_lb_remove(struct mei_cl_device *cldev)
	{
	component_master_del(&cldev->dev, &mei_lb_component_master_ops);
	}

	static const struct mei_cl_device_id mei_lb_tbl[] = {
	{ .uuid = MEI_GUID_MKHI, .version = 1 },
	{ .uuid = MEI_GUID_LB, .version = MEI_CL_VERSION_ANY },
	{ }
	};
	MODULE_DEVICE_TABLE(mei, mei_lb_tbl);

	static struct mei_cl_driver mei_lb_driver = {
	.id_table = mei_lb_tbl,
	.name = "mei_lb",
	.probe = mei_lb_probe,
	.remove = mei_lb_remove,
	};

	module_mei_cl_driver(mei_lb_driver);

	MODULE_AUTHOR("Intel Corporation");
	MODULE_LICENSE("GPL");
	MODULE_DESCRIPTION("MEI Late Binding Firmware Update/Upload");