The ACPI compiler uses the extended format when
used interrupt numbers are greater than 256.
The PCI link code currently only supports simple
interrupt format. The IRQ numbers are represented
using 32 bits when extended IRQ syntax. This patch
changes the interrupt number type to 32 bits and
places an upper limit of 1020 as possible interrupt
id. Additional checks have been placed to prevent
out of bounds writes.
Signed-off-by: Sinan Kaya <[email protected]>
---
drivers/acpi/pci_link.c | 35 ++++++++++++++++++++++-------------
1 file changed, 22 insertions(+), 13 deletions(-)
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 7c8408b..18a9190 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -1,6 +1,7 @@
/*
* pci_link.c - ACPI PCI Interrupt Link Device Driver ($Revision: 34 $)
*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
* Copyright (C) 2001, 2002 Andy Grover <[email protected]>
* Copyright (C) 2001, 2002 Paul Diefenbaugh <[email protected]>
* Copyright (C) 2002 Dominik Brodowski <[email protected]>
@@ -67,12 +68,12 @@ static struct acpi_scan_handler pci_link_handler = {
* later even the link is disable. Instead, we just repick the active irq
*/
struct acpi_pci_link_irq {
- u8 active; /* Current IRQ */
+ u32 active; /* Current IRQ */
u8 triggering; /* All IRQs */
u8 polarity; /* All IRQs */
u8 resource_type;
u8 possible_count;
- u8 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
+ u32 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
u8 initialized:1;
u8 reserved:7;
};
@@ -437,7 +438,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
* enabled system.
*/
-#define ACPI_MAX_IRQS 256
+#define ACPI_MAX_IRQS 1020
#define ACPI_MAX_ISA_IRQ 16
#define PIRQ_PENALTY_PCI_AVAILABLE (0)
@@ -493,7 +494,8 @@ int __init acpi_irq_penalty_init(void)
penalty;
}
- } else if (link->irq.active) {
+ } else if (link->irq.active &&
+ (link->irq.active < ACPI_MAX_IRQS)) {
acpi_irq_penalty[link->irq.active] +=
PIRQ_PENALTY_PCI_POSSIBLE;
}
@@ -542,14 +544,19 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
irq = link->irq.possible[link->irq.possible_count - 1];
if (acpi_irq_balance || !link->irq.active) {
- /*
- * Select the best IRQ. This is done in reverse to promote
- * the use of IRQs 9, 10, 11, and >15.
- */
- for (i = (link->irq.possible_count - 1); i >= 0; i--) {
- if (acpi_irq_penalty[irq] >
- acpi_irq_penalty[link->irq.possible[i]])
- irq = link->irq.possible[i];
+
+ if (irq < ACPI_MAX_IRQS) {
+ /*
+ * Select the best IRQ. This is done in reverse to
+ * promote the use of IRQs 9, 10, 11, and >15.
+ */
+ for (i = (link->irq.possible_count - 1); i >= 0;
+ i--) {
+ if ((link->irq.possible[i] < ACPI_MAX_IRQS) &&
+ (acpi_irq_penalty[irq] >
+ acpi_irq_penalty[link->irq.possible[i]]))
+ irq = link->irq.possible[i];
+ }
}
}
if (acpi_irq_penalty[irq] >= PIRQ_PENALTY_ISA_ALWAYS) {
@@ -568,7 +575,9 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
acpi_device_bid(link->device));
return -ENODEV;
} else {
- acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
+ if (link->irq.active < ACPI_MAX_IRQS)
+ acpi_irq_penalty[link->irq.active] +=
+ PIRQ_PENALTY_PCI_USING;
printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
acpi_device_name(link->device),
acpi_device_bid(link->device), link->irq.active);
--
Qualcomm Technologies, Inc. on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project
Sinan Kaya wrote:
> -#define ACPI_MAX_IRQS 256
> +#define ACPI_MAX_IRQS 1020
Why 1020? Why not 1024?
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the
Code Aurora Forum, hosted by The Linux Foundation.
On Sun, Nov 8, 2015 at 6:07 PM, Sinan Kaya <[email protected]> wrote:
> The ACPI compiler uses the extended format when
> used interrupt numbers are greater than 256.
> The PCI link code currently only supports simple
> interrupt format. The IRQ numbers are represented
> using 32 bits when extended IRQ syntax. This patch
> changes the interrupt number type to 32 bits and
> places an upper limit of 1020 as possible interrupt
> id. Additional checks have been placed to prevent
> out of bounds writes.
In commit messages and in comments I see this narrow lines, any reason
to make them short, except increasing number of lines?
> --- a/drivers/acpi/pci_link.c
> +++ b/drivers/acpi/pci_link.c
> @@ -1,6 +1,7 @@
> /*
> * pci_link.c - ACPI PCI Interrupt Link Device Driver ($Revision: 34 $)
> *
> + * Copyright (c) 2015, The Linux Foundation. All rights reserved.
> * Copyright (C) 2001, 2002 Andy Grover <[email protected]>
> * Copyright (C) 2001, 2002 Paul Diefenbaugh <[email protected]>
> * Copyright (C) 2002 Dominik Brodowski <[email protected]>
> @@ -67,12 +68,12 @@ static struct acpi_scan_handler pci_link_handler = {
> * later even the link is disable. Instead, we just repick the active irq
> */
> struct acpi_pci_link_irq {
> - u8 active; /* Current IRQ */
> + u32 active; /* Current IRQ */
> u8 triggering; /* All IRQs */
> u8 polarity; /* All IRQs */
> u8 resource_type;
> u8 possible_count;
> - u8 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
> + u32 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
> u8 initialized:1;
> u8 reserved:7;
> };
> @@ -437,7 +438,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
> * enabled system.
> */
>
> -#define ACPI_MAX_IRQS 256
> +#define ACPI_MAX_IRQS 1020
> #define ACPI_MAX_ISA_IRQ 16
>
> #define PIRQ_PENALTY_PCI_AVAILABLE (0)
> @@ -493,7 +494,8 @@ int __init acpi_irq_penalty_init(void)
> penalty;
> }
>
> - } else if (link->irq.active) {
> + } else if (link->irq.active &&
> + (link->irq.active < ACPI_MAX_IRQS)) {
> acpi_irq_penalty[link->irq.active] +=
> PIRQ_PENALTY_PCI_POSSIBLE;
> }
> @@ -542,14 +544,19 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
> irq = link->irq.possible[link->irq.possible_count - 1];
>
> if (acpi_irq_balance || !link->irq.active) {
> - /*
> - * Select the best IRQ. This is done in reverse to promote
> - * the use of IRQs 9, 10, 11, and >15.
> - */
> - for (i = (link->irq.possible_count - 1); i >= 0; i--) {
> - if (acpi_irq_penalty[irq] >
> - acpi_irq_penalty[link->irq.possible[i]])
> - irq = link->irq.possible[i];
> +
> + if (irq < ACPI_MAX_IRQS) {
> + /*
> + * Select the best IRQ. This is done in reverse to
> + * promote the use of IRQs 9, 10, 11, and >15.
> + */
> + for (i = (link->irq.possible_count - 1); i >= 0;
> + i--) {
Why not
if ((acpi_irq_balance || !link->irq.active) && irq < ACPI_MAX_IRQS) {
int i = link->irq.possible_count;
while (--i) {
…
}
}
> + if ((link->irq.possible[i] < ACPI_MAX_IRQS) &&
> + (acpi_irq_penalty[irq] >
> + acpi_irq_penalty[link->irq.possible[i]]))
> + irq = link->irq.possible[i];
> + }
> }
> }
> if (acpi_irq_penalty[irq] >= PIRQ_PENALTY_ISA_ALWAYS) {
--
With Best Regards,
Andy Shevchenko
On 11/8/2015 11:11 AM, Timur Tabi wrote:
> Sinan Kaya wrote:
>> -#define ACPI_MAX_IRQS 256
>> +#define ACPI_MAX_IRQS 1020
>
> Why 1020? Why not 1024?
>
1020 is the maximum interrupt ID that can be directed to an ARM SPI
interrupt according to ARM architecture.
--
Sinan Kaya
Qualcomm Technologies, Inc. on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project
Sinan Kaya wrote:
>>
> 1020 is the maximum interrupt ID that can be directed to an ARM SPI
> interrupt according to ARM architecture.
IMHO, that's something that belongs in the patch description.
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the
Code Aurora Forum, hosted by The Linux Foundation.
On 2015/11/9 0:07, Sinan Kaya wrote:
> The ACPI compiler uses the extended format when
> used interrupt numbers are greater than 256.
> The PCI link code currently only supports simple
> interrupt format. The IRQ numbers are represented
> using 32 bits when extended IRQ syntax. This patch
> changes the interrupt number type to 32 bits and
> places an upper limit of 1020 as possible interrupt
> id. Additional checks have been placed to prevent
> out of bounds writes.
>
> Signed-off-by: Sinan Kaya <[email protected]>
> ---
> drivers/acpi/pci_link.c | 35 ++++++++++++++++++++++-------------
> 1 file changed, 22 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
> index 7c8408b..18a9190 100644
> --- a/drivers/acpi/pci_link.c
> +++ b/drivers/acpi/pci_link.c
> @@ -1,6 +1,7 @@
> /*
> * pci_link.c - ACPI PCI Interrupt Link Device Driver ($Revision: 34 $)
> *
> + * Copyright (c) 2015, The Linux Foundation. All rights reserved.
> * Copyright (C) 2001, 2002 Andy Grover <[email protected]>
> * Copyright (C) 2001, 2002 Paul Diefenbaugh <[email protected]>
> * Copyright (C) 2002 Dominik Brodowski <[email protected]>
> @@ -67,12 +68,12 @@ static struct acpi_scan_handler pci_link_handler = {
> * later even the link is disable. Instead, we just repick the active irq
> */
> struct acpi_pci_link_irq {
> - u8 active; /* Current IRQ */
> + u32 active; /* Current IRQ */
> u8 triggering; /* All IRQs */
> u8 polarity; /* All IRQs */
> u8 resource_type;
> u8 possible_count;
> - u8 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
> + u32 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
> u8 initialized:1;
> u8 reserved:7;
> };
Hi Sinan,
This data structure become some sort of big, any idea to reduce
memory consumption?
Thanks,
Gerry
> @@ -437,7 +438,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
> * enabled system.
> */
>
> -#define ACPI_MAX_IRQS 256
> +#define ACPI_MAX_IRQS 1020
> #define ACPI_MAX_ISA_IRQ 16
>
> #define PIRQ_PENALTY_PCI_AVAILABLE (0)
> @@ -493,7 +494,8 @@ int __init acpi_irq_penalty_init(void)
> penalty;
> }
>
> - } else if (link->irq.active) {
> + } else if (link->irq.active &&
> + (link->irq.active < ACPI_MAX_IRQS)) {
> acpi_irq_penalty[link->irq.active] +=
> PIRQ_PENALTY_PCI_POSSIBLE;
> }
> @@ -542,14 +544,19 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
> irq = link->irq.possible[link->irq.possible_count - 1];
>
> if (acpi_irq_balance || !link->irq.active) {
> - /*
> - * Select the best IRQ. This is done in reverse to promote
> - * the use of IRQs 9, 10, 11, and >15.
> - */
> - for (i = (link->irq.possible_count - 1); i >= 0; i--) {
> - if (acpi_irq_penalty[irq] >
> - acpi_irq_penalty[link->irq.possible[i]])
> - irq = link->irq.possible[i];
> +
> + if (irq < ACPI_MAX_IRQS) {
> + /*
> + * Select the best IRQ. This is done in reverse to
> + * promote the use of IRQs 9, 10, 11, and >15.
> + */
> + for (i = (link->irq.possible_count - 1); i >= 0;
> + i--) {
> + if ((link->irq.possible[i] < ACPI_MAX_IRQS) &&
> + (acpi_irq_penalty[irq] >
> + acpi_irq_penalty[link->irq.possible[i]]))
> + irq = link->irq.possible[i];
> + }
> }
> }
> if (acpi_irq_penalty[irq] >= PIRQ_PENALTY_ISA_ALWAYS) {
> @@ -568,7 +575,9 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
> acpi_device_bid(link->device));
> return -ENODEV;
> } else {
> - acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
> + if (link->irq.active < ACPI_MAX_IRQS)
> + acpi_irq_penalty[link->irq.active] +=
> + PIRQ_PENALTY_PCI_USING;
> printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
> acpi_device_name(link->device),
> acpi_device_bid(link->device), link->irq.active);
>
On 11/9/2015 12:24 AM, Jiang Liu wrote:
>> + u32 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
>> > u8 initialized:1;
>> > u8 reserved:7;
>> > };
> Hi Sinan,
> This data structure become some sort of big, any idea to reduce
> memory consumption?
> Thanks,
> Gerry
>
Hi Gerry,
There are two constants in the code.
#define ACPI_PCI_LINK_MAX_POSSIBLE 16
I changed the data type above. Previously it was consuming 16 bytes now
64 bytes.
The second one is this.
#define ACPI_MAX_IRQS 256
I changed ACPI_MAX_IRQS to 1020 from 256. Let's assume 1024.
I'm concerned about this though since you warned. This used to consume
1024 bytes now 4096 bytes.
static int acpi_irq_penalty[ACPI_MAX_IRQS] = {
PIRQ_PENALTY_ISA_ALWAYS, /* IRQ0 timer */
...
}
Sinan
--
Sinan Kaya
Qualcomm Technologies, Inc. on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project
On 2015/11/9 13:45, Sinan Kaya wrote:
>
>
> On 11/9/2015 12:24 AM, Jiang Liu wrote:
>>> + u32 possible[ACPI_PCI_LINK_MAX_POSSIBLE];
>>> > u8 initialized:1;
>>> > u8 reserved:7;
>>> > };
>> Hi Sinan,
>> This data structure become some sort of big, any idea to reduce
>> memory consumption?
>> Thanks,
>> Gerry
>>
> Hi Gerry,
>
> There are two constants in the code.
>
> #define ACPI_PCI_LINK_MAX_POSSIBLE 16
>
> I changed the data type above. Previously it was consuming 16 bytes now
> 64 bytes.
Aha, I made a mistake. ACPI_PCI_LINK_MAX_POSSIBLE hasn't been changed,
so the space increasing is not so big:)
>
> The second one is this.
>
> #define ACPI_MAX_IRQS 256
>
> I changed ACPI_MAX_IRQS to 1020 from 256. Let's assume 1024.
>
> I'm concerned about this though since you warned. This used to consume
> 1024 bytes now 4096 bytes.
>
> static int acpi_irq_penalty[ACPI_MAX_IRQS] = {
> PIRQ_PENALTY_ISA_ALWAYS, /* IRQ0 timer */
> ...
> }
>
> Sinan
>
Sinan Kaya wrote:
>
> I'm concerned about this though since you warned. This used to consume
> 1024 bytes now 4096 bytes.
>
> static int acpi_irq_penalty[ACPI_MAX_IRQS] = {
> PIRQ_PENALTY_ISA_ALWAYS, /* IRQ0 timer */
> ...
> }
As long as it's not ever put on the stack, it should be fine.
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the
Code Aurora Forum, hosted by The Linux Foundation.
On 11/9/2015 8:50 AM, Timur Tabi wrote:
> Sinan Kaya wrote:
>>
>> I'm concerned about this though since you warned. This used to consume
>> 1024 bytes now 4096 bytes.
>>
>> static int acpi_irq_penalty[ACPI_MAX_IRQS] = {
>> PIRQ_PENALTY_ISA_ALWAYS, /* IRQ0 timer */
>> ...
>> }
>
> As long as it's not ever put on the stack, it should be fine.
>
Alright...
If 1k global is OK, 4k global should be OK too.
--
Sinan Kaya
Qualcomm Technologies, Inc. on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project
On Sunday, November 08, 2015 06:05:48 PM Timur Tabi wrote:
> Sinan Kaya wrote:
> >>
> > 1020 is the maximum interrupt ID that can be directed to an ARM SPI
> > interrupt according to ARM architecture.
>
> IMHO, that's something that belongs in the patch description.
Good point.
Thanks,
Rafael
On 11/8/2015 3:35 PM, Andy Shevchenko wrote:
> On Sun, Nov 8, 2015 at 6:07 PM, Sinan Kaya <[email protected]> wrote:
>> The ACPI compiler uses the extended format when
>> used interrupt numbers are greater than 256.
>> The PCI link code currently only supports simple
>> interrupt format. The IRQ numbers are represented
>> using 32 bits when extended IRQ syntax. This patch
>> changes the interrupt number type to 32 bits and
>> places an upper limit of 1020 as possible interrupt
>> id. Additional checks have been placed to prevent
>> out of bounds writes.
>
> In commit messages and in comments I see this narrow lines, any reason
> to make them short, except increasing number of lines?
>
done
>> if (acpi_irq_balance || !link->irq.active) {
>> - /*
>> - * Select the best IRQ. This is done in reverse to promote
>> - * the use of IRQs 9, 10, 11, and >15.
>> - */
>> - for (i = (link->irq.possible_count - 1); i >= 0; i--) {
>> - if (acpi_irq_penalty[irq] >
>> - acpi_irq_penalty[link->irq.possible[i]])
>> - irq = link->irq.possible[i];
>> +
>> + if (irq < ACPI_MAX_IRQS) {
>> + /*
>> + * Select the best IRQ. This is done in reverse to
>> + * promote the use of IRQs 9, 10, 11, and >15.
>> + */
>> + for (i = (link->irq.possible_count - 1); i >= 0;
>> + i--) {
>
> Why not
>
> if ((acpi_irq_balance || !link->irq.active) && irq < ACPI_MAX_IRQS) {
> int i = link->irq.possible_count;
>
> while (--i) {
> …
> }
> }
done
>
>> + if ((link->irq.possible[i] < ACPI_MAX_IRQS) &&
>> + (acpi_irq_penalty[irq] >
>> + acpi_irq_penalty[link->irq.possible[i]]))
>> + irq = link->irq.possible[i];
>> + }
>> }
>> }
>> if (acpi_irq_penalty[irq] >= PIRQ_PENALTY_ISA_ALWAYS) {
>
--
Sinan Kaya
Qualcomm Technologies, Inc. on behalf of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project