1 /******************************************************************************* 2 * 3 * Module Name: utdelete - object deletion and reference count utilities 4 * 5 ******************************************************************************/ 6 7 /* 8 * Copyright (C) 2000 - 2017, Intel Corp. 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions, and the following disclaimer, 16 * without modification. 17 * 2. Redistributions in binary form must reproduce at minimum a disclaimer 18 * substantially similar to the "NO WARRANTY" disclaimer below 19 * ("Disclaimer") and any redistribution must be conditioned upon 20 * including a substantially similar Disclaimer requirement for further 21 * binary redistribution. 22 * 3. Neither the names of the above-listed copyright holders nor the names 23 * of any contributors may be used to endorse or promote products derived 24 * from this software without specific prior written permission. 25 * 26 * Alternatively, this software may be distributed under the terms of the 27 * GNU General Public License ("GPL") version 2 as published by the Free 28 * Software Foundation. 29 * 30 * NO WARRANTY 31 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 32 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 33 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR 34 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 35 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 36 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 37 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 38 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 39 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 40 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 41 * POSSIBILITY OF SUCH DAMAGES. 42 */ 43 44 #include <acpi/acpi.h> 45 #include "accommon.h" 46 #include "acinterp.h" 47 #include "acnamesp.h" 48 #include "acevents.h" 49 50 #define _COMPONENT ACPI_UTILITIES 51 ACPI_MODULE_NAME("utdelete") 52 53 /* Local prototypes */ 54 static void acpi_ut_delete_internal_obj(union acpi_operand_object *object); 55 56 static void 57 acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action); 58 59 /******************************************************************************* 60 * 61 * FUNCTION: acpi_ut_delete_internal_obj 62 * 63 * PARAMETERS: object - Object to be deleted 64 * 65 * RETURN: None 66 * 67 * DESCRIPTION: Low level object deletion, after reference counts have been 68 * updated (All reference counts, including sub-objects!) 69 * 70 ******************************************************************************/ 71 72 static void acpi_ut_delete_internal_obj(union acpi_operand_object *object) 73 { 74 void *obj_pointer = NULL; 75 union acpi_operand_object *handler_desc; 76 union acpi_operand_object *second_desc; 77 union acpi_operand_object *next_desc; 78 union acpi_operand_object *start_desc; 79 union acpi_operand_object **last_obj_ptr; 80 81 ACPI_FUNCTION_TRACE_PTR(ut_delete_internal_obj, object); 82 83 if (!object) { 84 return_VOID; 85 } 86 87 /* 88 * Must delete or free any pointers within the object that are not 89 * actual ACPI objects (for example, a raw buffer pointer). 90 */ 91 switch (object->common.type) { 92 case ACPI_TYPE_STRING: 93 94 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 95 "**** String %p, ptr %p\n", object, 96 object->string.pointer)); 97 98 /* Free the actual string buffer */ 99 100 if (!(object->common.flags & AOPOBJ_STATIC_POINTER)) { 101 102 /* But only if it is NOT a pointer into an ACPI table */ 103 104 obj_pointer = object->string.pointer; 105 } 106 break; 107 108 case ACPI_TYPE_BUFFER: 109 110 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 111 "**** Buffer %p, ptr %p\n", object, 112 object->buffer.pointer)); 113 114 /* Free the actual buffer */ 115 116 if (!(object->common.flags & AOPOBJ_STATIC_POINTER)) { 117 118 /* But only if it is NOT a pointer into an ACPI table */ 119 120 obj_pointer = object->buffer.pointer; 121 } 122 break; 123 124 case ACPI_TYPE_PACKAGE: 125 126 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 127 " **** Package of count %X\n", 128 object->package.count)); 129 130 /* 131 * Elements of the package are not handled here, they are deleted 132 * separately 133 */ 134 135 /* Free the (variable length) element pointer array */ 136 137 obj_pointer = object->package.elements; 138 break; 139 140 /* 141 * These objects have a possible list of notify handlers. 142 * Device object also may have a GPE block. 143 */ 144 case ACPI_TYPE_DEVICE: 145 146 if (object->device.gpe_block) { 147 (void)acpi_ev_delete_gpe_block(object->device. 148 gpe_block); 149 } 150 151 /*lint -fallthrough */ 152 153 case ACPI_TYPE_PROCESSOR: 154 case ACPI_TYPE_THERMAL: 155 156 /* Walk the address handler list for this object */ 157 158 handler_desc = object->common_notify.handler; 159 while (handler_desc) { 160 next_desc = handler_desc->address_space.next; 161 acpi_ut_remove_reference(handler_desc); 162 handler_desc = next_desc; 163 } 164 break; 165 166 case ACPI_TYPE_MUTEX: 167 168 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 169 "***** Mutex %p, OS Mutex %p\n", 170 object, object->mutex.os_mutex)); 171 172 if (object == acpi_gbl_global_lock_mutex) { 173 174 /* Global Lock has extra semaphore */ 175 176 (void) 177 acpi_os_delete_semaphore 178 (acpi_gbl_global_lock_semaphore); 179 acpi_gbl_global_lock_semaphore = NULL; 180 181 acpi_os_delete_mutex(object->mutex.os_mutex); 182 acpi_gbl_global_lock_mutex = NULL; 183 } else { 184 acpi_ex_unlink_mutex(object); 185 acpi_os_delete_mutex(object->mutex.os_mutex); 186 } 187 break; 188 189 case ACPI_TYPE_EVENT: 190 191 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 192 "***** Event %p, OS Semaphore %p\n", 193 object, object->event.os_semaphore)); 194 195 (void)acpi_os_delete_semaphore(object->event.os_semaphore); 196 object->event.os_semaphore = NULL; 197 break; 198 199 case ACPI_TYPE_METHOD: 200 201 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 202 "***** Method %p\n", object)); 203 204 /* Delete the method mutex if it exists */ 205 206 if (object->method.mutex) { 207 acpi_os_delete_mutex(object->method.mutex->mutex. 208 os_mutex); 209 acpi_ut_delete_object_desc(object->method.mutex); 210 object->method.mutex = NULL; 211 } 212 213 if (object->method.node) { 214 object->method.node = NULL; 215 } 216 break; 217 218 case ACPI_TYPE_REGION: 219 220 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 221 "***** Region %p\n", object)); 222 223 /* 224 * Update address_range list. However, only permanent regions 225 * are installed in this list. (Not created within a method) 226 */ 227 if (!(object->region.node->flags & ANOBJ_TEMPORARY)) { 228 acpi_ut_remove_address_range(object->region.space_id, 229 object->region.node); 230 } 231 232 second_desc = acpi_ns_get_secondary_object(object); 233 if (second_desc) { 234 /* 235 * Free the region_context if and only if the handler is one of the 236 * default handlers -- and therefore, we created the context object 237 * locally, it was not created by an external caller. 238 */ 239 handler_desc = object->region.handler; 240 if (handler_desc) { 241 next_desc = 242 handler_desc->address_space.region_list; 243 start_desc = next_desc; 244 last_obj_ptr = 245 &handler_desc->address_space.region_list; 246 247 /* Remove the region object from the handler list */ 248 249 while (next_desc) { 250 if (next_desc == object) { 251 *last_obj_ptr = 252 next_desc->region.next; 253 break; 254 } 255 256 /* Walk the linked list of handlers */ 257 258 last_obj_ptr = &next_desc->region.next; 259 next_desc = next_desc->region.next; 260 261 /* Prevent infinite loop if list is corrupted */ 262 263 if (next_desc == start_desc) { 264 ACPI_ERROR((AE_INFO, 265 "Circular region list in address handler object %p", 266 handler_desc)); 267 return_VOID; 268 } 269 } 270 271 if (handler_desc->address_space.handler_flags & 272 ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) { 273 274 /* Deactivate region and free region context */ 275 276 if (handler_desc->address_space.setup) { 277 (void)handler_desc-> 278 address_space.setup(object, 279 ACPI_REGION_DEACTIVATE, 280 handler_desc-> 281 address_space. 282 context, 283 &second_desc-> 284 extra. 285 region_context); 286 } 287 } 288 289 acpi_ut_remove_reference(handler_desc); 290 } 291 292 /* Now we can free the Extra object */ 293 294 acpi_ut_delete_object_desc(second_desc); 295 } 296 break; 297 298 case ACPI_TYPE_BUFFER_FIELD: 299 300 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 301 "***** Buffer Field %p\n", object)); 302 303 second_desc = acpi_ns_get_secondary_object(object); 304 if (second_desc) { 305 acpi_ut_delete_object_desc(second_desc); 306 } 307 break; 308 309 case ACPI_TYPE_LOCAL_BANK_FIELD: 310 311 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 312 "***** Bank Field %p\n", object)); 313 314 second_desc = acpi_ns_get_secondary_object(object); 315 if (second_desc) { 316 acpi_ut_delete_object_desc(second_desc); 317 } 318 break; 319 320 default: 321 322 break; 323 } 324 325 /* Free any allocated memory (pointer within the object) found above */ 326 327 if (obj_pointer) { 328 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 329 "Deleting Object Subptr %p\n", obj_pointer)); 330 ACPI_FREE(obj_pointer); 331 } 332 333 /* Now the object can be safely deleted */ 334 335 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, "Deleting Object %p [%s]\n", 336 object, acpi_ut_get_object_type_name(object))); 337 338 acpi_ut_delete_object_desc(object); 339 return_VOID; 340 } 341 342 /******************************************************************************* 343 * 344 * FUNCTION: acpi_ut_delete_internal_object_list 345 * 346 * PARAMETERS: obj_list - Pointer to the list to be deleted 347 * 348 * RETURN: None 349 * 350 * DESCRIPTION: This function deletes an internal object list, including both 351 * simple objects and package objects 352 * 353 ******************************************************************************/ 354 355 void acpi_ut_delete_internal_object_list(union acpi_operand_object **obj_list) 356 { 357 union acpi_operand_object **internal_obj; 358 359 ACPI_FUNCTION_ENTRY(); 360 361 /* Walk the null-terminated internal list */ 362 363 for (internal_obj = obj_list; *internal_obj; internal_obj++) { 364 acpi_ut_remove_reference(*internal_obj); 365 } 366 367 /* Free the combined parameter pointer list and object array */ 368 369 ACPI_FREE(obj_list); 370 return; 371 } 372 373 /******************************************************************************* 374 * 375 * FUNCTION: acpi_ut_update_ref_count 376 * 377 * PARAMETERS: object - Object whose ref count is to be updated 378 * action - What to do (REF_INCREMENT or REF_DECREMENT) 379 * 380 * RETURN: None. Sets new reference count within the object 381 * 382 * DESCRIPTION: Modify the reference count for an internal acpi object 383 * 384 ******************************************************************************/ 385 386 static void 387 acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action) 388 { 389 u16 original_count; 390 u16 new_count = 0; 391 acpi_cpu_flags lock_flags; 392 393 ACPI_FUNCTION_NAME(ut_update_ref_count); 394 395 if (!object) { 396 return; 397 } 398 399 /* 400 * Always get the reference count lock. Note: Interpreter and/or 401 * Namespace is not always locked when this function is called. 402 */ 403 lock_flags = acpi_os_acquire_lock(acpi_gbl_reference_count_lock); 404 original_count = object->common.reference_count; 405 406 /* Perform the reference count action (increment, decrement) */ 407 408 switch (action) { 409 case REF_INCREMENT: 410 411 new_count = original_count + 1; 412 object->common.reference_count = new_count; 413 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags); 414 415 /* The current reference count should never be zero here */ 416 417 if (!original_count) { 418 ACPI_WARNING((AE_INFO, 419 "Obj %p, Reference Count was zero before increment\n", 420 object)); 421 } 422 423 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 424 "Obj %p Type %.2X [%s] Refs %.2X [Incremented]\n", 425 object, object->common.type, 426 acpi_ut_get_object_type_name(object), 427 new_count)); 428 break; 429 430 case REF_DECREMENT: 431 432 /* The current reference count must be non-zero */ 433 434 if (original_count) { 435 new_count = original_count - 1; 436 object->common.reference_count = new_count; 437 } 438 439 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags); 440 441 if (!original_count) { 442 ACPI_WARNING((AE_INFO, 443 "Obj %p, Reference Count is already zero, cannot decrement\n", 444 object)); 445 } 446 447 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 448 "Obj %p Type %.2X Refs %.2X [Decremented]\n", 449 object, object->common.type, new_count)); 450 451 /* Actually delete the object on a reference count of zero */ 452 453 if (new_count == 0) { 454 acpi_ut_delete_internal_obj(object); 455 } 456 break; 457 458 default: 459 460 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags); 461 ACPI_ERROR((AE_INFO, "Unknown Reference Count action (0x%X)", 462 action)); 463 return; 464 } 465 466 /* 467 * Sanity check the reference count, for debug purposes only. 468 * (A deleted object will have a huge reference count) 469 */ 470 if (new_count > ACPI_MAX_REFERENCE_COUNT) { 471 ACPI_WARNING((AE_INFO, 472 "Large Reference Count (0x%X) in object %p, Type=0x%.2X", 473 new_count, object, object->common.type)); 474 } 475 } 476 477 /******************************************************************************* 478 * 479 * FUNCTION: acpi_ut_update_object_reference 480 * 481 * PARAMETERS: object - Increment ref count for this object 482 * and all sub-objects 483 * action - Either REF_INCREMENT or REF_DECREMENT 484 * 485 * RETURN: Status 486 * 487 * DESCRIPTION: Increment the object reference count 488 * 489 * Object references are incremented when: 490 * 1) An object is attached to a Node (namespace object) 491 * 2) An object is copied (all subobjects must be incremented) 492 * 493 * Object references are decremented when: 494 * 1) An object is detached from an Node 495 * 496 ******************************************************************************/ 497 498 acpi_status 499 acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) 500 { 501 acpi_status status = AE_OK; 502 union acpi_generic_state *state_list = NULL; 503 union acpi_operand_object *next_object = NULL; 504 union acpi_operand_object *prev_object; 505 union acpi_generic_state *state; 506 u32 i; 507 508 ACPI_FUNCTION_NAME(ut_update_object_reference); 509 510 while (object) { 511 512 /* Make sure that this isn't a namespace handle */ 513 514 if (ACPI_GET_DESCRIPTOR_TYPE(object) == ACPI_DESC_TYPE_NAMED) { 515 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 516 "Object %p is NS handle\n", object)); 517 return (AE_OK); 518 } 519 520 /* 521 * All sub-objects must have their reference count incremented 522 * also. Different object types have different subobjects. 523 */ 524 switch (object->common.type) { 525 case ACPI_TYPE_DEVICE: 526 case ACPI_TYPE_PROCESSOR: 527 case ACPI_TYPE_POWER: 528 case ACPI_TYPE_THERMAL: 529 /* 530 * Update the notify objects for these types (if present) 531 * Two lists, system and device notify handlers. 532 */ 533 for (i = 0; i < ACPI_NUM_NOTIFY_TYPES; i++) { 534 prev_object = 535 object->common_notify.notify_list[i]; 536 while (prev_object) { 537 next_object = 538 prev_object->notify.next[i]; 539 acpi_ut_update_ref_count(prev_object, 540 action); 541 prev_object = next_object; 542 } 543 } 544 break; 545 546 case ACPI_TYPE_PACKAGE: 547 /* 548 * We must update all the sub-objects of the package, 549 * each of whom may have their own sub-objects. 550 */ 551 for (i = 0; i < object->package.count; i++) { 552 /* 553 * Null package elements are legal and can be simply 554 * ignored. 555 */ 556 next_object = object->package.elements[i]; 557 if (!next_object) { 558 continue; 559 } 560 561 switch (next_object->common.type) { 562 case ACPI_TYPE_INTEGER: 563 case ACPI_TYPE_STRING: 564 case ACPI_TYPE_BUFFER: 565 /* 566 * For these very simple sub-objects, we can just 567 * update the reference count here and continue. 568 * Greatly increases performance of this operation. 569 */ 570 acpi_ut_update_ref_count(next_object, 571 action); 572 break; 573 574 default: 575 /* 576 * For complex sub-objects, push them onto the stack 577 * for later processing (this eliminates recursion.) 578 */ 579 status = 580 acpi_ut_create_update_state_and_push 581 (next_object, action, &state_list); 582 if (ACPI_FAILURE(status)) { 583 goto error_exit; 584 } 585 break; 586 } 587 } 588 next_object = NULL; 589 break; 590 591 case ACPI_TYPE_BUFFER_FIELD: 592 593 next_object = object->buffer_field.buffer_obj; 594 break; 595 596 case ACPI_TYPE_LOCAL_REGION_FIELD: 597 598 next_object = object->field.region_obj; 599 break; 600 601 case ACPI_TYPE_LOCAL_BANK_FIELD: 602 603 next_object = object->bank_field.bank_obj; 604 status = 605 acpi_ut_create_update_state_and_push(object-> 606 bank_field. 607 region_obj, 608 action, 609 &state_list); 610 if (ACPI_FAILURE(status)) { 611 goto error_exit; 612 } 613 break; 614 615 case ACPI_TYPE_LOCAL_INDEX_FIELD: 616 617 next_object = object->index_field.index_obj; 618 status = 619 acpi_ut_create_update_state_and_push(object-> 620 index_field. 621 data_obj, 622 action, 623 &state_list); 624 if (ACPI_FAILURE(status)) { 625 goto error_exit; 626 } 627 break; 628 629 case ACPI_TYPE_LOCAL_REFERENCE: 630 /* 631 * The target of an Index (a package, string, or buffer) or a named 632 * reference must track changes to the ref count of the index or 633 * target object. 634 */ 635 if ((object->reference.class == ACPI_REFCLASS_INDEX) || 636 (object->reference.class == ACPI_REFCLASS_NAME)) { 637 next_object = object->reference.object; 638 } 639 break; 640 641 case ACPI_TYPE_REGION: 642 default: 643 644 break; /* No subobjects for all other types */ 645 } 646 647 /* 648 * Now we can update the count in the main object. This can only 649 * happen after we update the sub-objects in case this causes the 650 * main object to be deleted. 651 */ 652 acpi_ut_update_ref_count(object, action); 653 object = NULL; 654 655 /* Move on to the next object to be updated */ 656 657 if (next_object) { 658 object = next_object; 659 next_object = NULL; 660 } else if (state_list) { 661 state = acpi_ut_pop_generic_state(&state_list); 662 object = state->update.object; 663 acpi_ut_delete_generic_state(state); 664 } 665 } 666 667 return (AE_OK); 668 669 error_exit: 670 671 ACPI_EXCEPTION((AE_INFO, status, 672 "Could not update object reference count")); 673 674 /* Free any stacked Update State objects */ 675 676 while (state_list) { 677 state = acpi_ut_pop_generic_state(&state_list); 678 acpi_ut_delete_generic_state(state); 679 } 680 681 return (status); 682 } 683 684 /******************************************************************************* 685 * 686 * FUNCTION: acpi_ut_add_reference 687 * 688 * PARAMETERS: object - Object whose reference count is to be 689 * incremented 690 * 691 * RETURN: None 692 * 693 * DESCRIPTION: Add one reference to an ACPI object 694 * 695 ******************************************************************************/ 696 697 void acpi_ut_add_reference(union acpi_operand_object *object) 698 { 699 700 ACPI_FUNCTION_NAME(ut_add_reference); 701 702 /* Ensure that we have a valid object */ 703 704 if (!acpi_ut_valid_internal_object(object)) { 705 return; 706 } 707 708 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 709 "Obj %p Current Refs=%X [To Be Incremented]\n", 710 object, object->common.reference_count)); 711 712 /* Increment the reference count */ 713 714 (void)acpi_ut_update_object_reference(object, REF_INCREMENT); 715 return; 716 } 717 718 /******************************************************************************* 719 * 720 * FUNCTION: acpi_ut_remove_reference 721 * 722 * PARAMETERS: object - Object whose ref count will be decremented 723 * 724 * RETURN: None 725 * 726 * DESCRIPTION: Decrement the reference count of an ACPI internal object 727 * 728 ******************************************************************************/ 729 730 void acpi_ut_remove_reference(union acpi_operand_object *object) 731 { 732 733 ACPI_FUNCTION_NAME(ut_remove_reference); 734 735 /* 736 * Allow a NULL pointer to be passed in, just ignore it. This saves 737 * each caller from having to check. Also, ignore NS nodes. 738 */ 739 if (!object || 740 (ACPI_GET_DESCRIPTOR_TYPE(object) == ACPI_DESC_TYPE_NAMED)) { 741 return; 742 } 743 744 /* Ensure that we have a valid object */ 745 746 if (!acpi_ut_valid_internal_object(object)) { 747 return; 748 } 749 750 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, 751 "Obj %p Current Refs=%X [To Be Decremented]\n", 752 object, object->common.reference_count)); 753 754 /* 755 * Decrement the reference count, and only actually delete the object 756 * if the reference count becomes 0. (Must also decrement the ref count 757 * of all subobjects!) 758 */ 759 (void)acpi_ut_update_object_reference(object, REF_DECREMENT); 760 return; 761 } 762