1 /*******************************************************************************
2 *
3 * Module Name: utdelete - object deletion and reference count utilities
4 *
5 ******************************************************************************/
6
7 /*
8 * Copyright (C) 2000 - 2015, Intel Corp.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions, and the following disclaimer,
16 * without modification.
17 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
18 * substantially similar to the "NO WARRANTY" disclaimer below
19 * ("Disclaimer") and any redistribution must be conditioned upon
20 * including a substantially similar Disclaimer requirement for further
21 * binary redistribution.
22 * 3. Neither the names of the above-listed copyright holders nor the names
23 * of any contributors may be used to endorse or promote products derived
24 * from this software without specific prior written permission.
25 *
26 * Alternatively, this software may be distributed under the terms of the
27 * GNU General Public License ("GPL") version 2 as published by the Free
28 * Software Foundation.
29 *
30 * NO WARRANTY
31 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
32 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
33 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
34 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
35 * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
37 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
38 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
39 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
40 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
41 * POSSIBILITY OF SUCH DAMAGES.
42 */
43
44 #include <acpi/acpi.h>
45 #include "accommon.h"
46 #include "acinterp.h"
47 #include "acnamesp.h"
48 #include "acevents.h"
49
50 #define _COMPONENT ACPI_UTILITIES
51 ACPI_MODULE_NAME("utdelete")
52
53 /* Local prototypes */
54 static void acpi_ut_delete_internal_obj(union acpi_operand_object *object);
55
56 static void
57 acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action);
58
59 /*******************************************************************************
60 *
61 * FUNCTION: acpi_ut_delete_internal_obj
62 *
63 * PARAMETERS: object - Object to be deleted
64 *
65 * RETURN: None
66 *
67 * DESCRIPTION: Low level object deletion, after reference counts have been
68 * updated (All reference counts, including sub-objects!)
69 *
70 ******************************************************************************/
71
acpi_ut_delete_internal_obj(union acpi_operand_object * object)72 static void acpi_ut_delete_internal_obj(union acpi_operand_object *object)
73 {
74 void *obj_pointer = NULL;
75 union acpi_operand_object *handler_desc;
76 union acpi_operand_object *second_desc;
77 union acpi_operand_object *next_desc;
78 union acpi_operand_object *start_desc;
79 union acpi_operand_object **last_obj_ptr;
80
81 ACPI_FUNCTION_TRACE_PTR(ut_delete_internal_obj, object);
82
83 if (!object) {
84 return_VOID;
85 }
86
87 /*
88 * Must delete or free any pointers within the object that are not
89 * actual ACPI objects (for example, a raw buffer pointer).
90 */
91 switch (object->common.type) {
92 case ACPI_TYPE_STRING:
93
94 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
95 "**** String %p, ptr %p\n", object,
96 object->string.pointer));
97
98 /* Free the actual string buffer */
99
100 if (!(object->common.flags & AOPOBJ_STATIC_POINTER)) {
101
102 /* But only if it is NOT a pointer into an ACPI table */
103
104 obj_pointer = object->string.pointer;
105 }
106 break;
107
108 case ACPI_TYPE_BUFFER:
109
110 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
111 "**** Buffer %p, ptr %p\n", object,
112 object->buffer.pointer));
113
114 /* Free the actual buffer */
115
116 if (!(object->common.flags & AOPOBJ_STATIC_POINTER)) {
117
118 /* But only if it is NOT a pointer into an ACPI table */
119
120 obj_pointer = object->buffer.pointer;
121 }
122 break;
123
124 case ACPI_TYPE_PACKAGE:
125
126 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
127 " **** Package of count %X\n",
128 object->package.count));
129
130 /*
131 * Elements of the package are not handled here, they are deleted
132 * separately
133 */
134
135 /* Free the (variable length) element pointer array */
136
137 obj_pointer = object->package.elements;
138 break;
139
140 /*
141 * These objects have a possible list of notify handlers.
142 * Device object also may have a GPE block.
143 */
144 case ACPI_TYPE_DEVICE:
145
146 if (object->device.gpe_block) {
147 (void)acpi_ev_delete_gpe_block(object->device.
148 gpe_block);
149 }
150
151 /*lint -fallthrough */
152
153 case ACPI_TYPE_PROCESSOR:
154 case ACPI_TYPE_THERMAL:
155
156 /* Walk the address handler list for this object */
157
158 handler_desc = object->common_notify.handler;
159 while (handler_desc) {
160 next_desc = handler_desc->address_space.next;
161 acpi_ut_remove_reference(handler_desc);
162 handler_desc = next_desc;
163 }
164 break;
165
166 case ACPI_TYPE_MUTEX:
167
168 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
169 "***** Mutex %p, OS Mutex %p\n",
170 object, object->mutex.os_mutex));
171
172 if (object == acpi_gbl_global_lock_mutex) {
173
174 /* Global Lock has extra semaphore */
175
176 (void)
177 acpi_os_delete_semaphore
178 (acpi_gbl_global_lock_semaphore);
179 acpi_gbl_global_lock_semaphore = NULL;
180
181 acpi_os_delete_mutex(object->mutex.os_mutex);
182 acpi_gbl_global_lock_mutex = NULL;
183 } else {
184 acpi_ex_unlink_mutex(object);
185 acpi_os_delete_mutex(object->mutex.os_mutex);
186 }
187 break;
188
189 case ACPI_TYPE_EVENT:
190
191 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
192 "***** Event %p, OS Semaphore %p\n",
193 object, object->event.os_semaphore));
194
195 (void)acpi_os_delete_semaphore(object->event.os_semaphore);
196 object->event.os_semaphore = NULL;
197 break;
198
199 case ACPI_TYPE_METHOD:
200
201 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
202 "***** Method %p\n", object));
203
204 /* Delete the method mutex if it exists */
205
206 if (object->method.mutex) {
207 acpi_os_delete_mutex(object->method.mutex->mutex.
208 os_mutex);
209 acpi_ut_delete_object_desc(object->method.mutex);
210 object->method.mutex = NULL;
211 }
212 if (object->method.node) {
213 object->method.node = NULL;
214 }
215 break;
216
217 case ACPI_TYPE_REGION:
218
219 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
220 "***** Region %p\n", object));
221
222 /*
223 * Update address_range list. However, only permanent regions
224 * are installed in this list. (Not created within a method)
225 */
226 if (!(object->region.node->flags & ANOBJ_TEMPORARY)) {
227 acpi_ut_remove_address_range(object->region.space_id,
228 object->region.node);
229 }
230
231 second_desc = acpi_ns_get_secondary_object(object);
232 if (second_desc) {
233 /*
234 * Free the region_context if and only if the handler is one of the
235 * default handlers -- and therefore, we created the context object
236 * locally, it was not created by an external caller.
237 */
238 handler_desc = object->region.handler;
239 if (handler_desc) {
240 next_desc =
241 handler_desc->address_space.region_list;
242 start_desc = next_desc;
243 last_obj_ptr =
244 &handler_desc->address_space.region_list;
245
246 /* Remove the region object from the handler list */
247
248 while (next_desc) {
249 if (next_desc == object) {
250 *last_obj_ptr =
251 next_desc->region.next;
252 break;
253 }
254
255 /* Walk the linked list of handlers */
256
257 last_obj_ptr = &next_desc->region.next;
258 next_desc = next_desc->region.next;
259
260 /* Prevent infinite loop if list is corrupted */
261
262 if (next_desc == start_desc) {
263 ACPI_ERROR((AE_INFO,
264 "Circular region list in address handler object %p",
265 handler_desc));
266 return_VOID;
267 }
268 }
269
270 if (handler_desc->address_space.handler_flags &
271 ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {
272
273 /* Deactivate region and free region context */
274
275 if (handler_desc->address_space.setup) {
276 (void)handler_desc->
277 address_space.setup(object,
278 ACPI_REGION_DEACTIVATE,
279 handler_desc->
280 address_space.
281 context,
282 &second_desc->
283 extra.
284 region_context);
285 }
286 }
287
288 acpi_ut_remove_reference(handler_desc);
289 }
290
291 /* Now we can free the Extra object */
292
293 acpi_ut_delete_object_desc(second_desc);
294 }
295 break;
296
297 case ACPI_TYPE_BUFFER_FIELD:
298
299 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
300 "***** Buffer Field %p\n", object));
301
302 second_desc = acpi_ns_get_secondary_object(object);
303 if (second_desc) {
304 acpi_ut_delete_object_desc(second_desc);
305 }
306 break;
307
308 case ACPI_TYPE_LOCAL_BANK_FIELD:
309
310 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
311 "***** Bank Field %p\n", object));
312
313 second_desc = acpi_ns_get_secondary_object(object);
314 if (second_desc) {
315 acpi_ut_delete_object_desc(second_desc);
316 }
317 break;
318
319 default:
320
321 break;
322 }
323
324 /* Free any allocated memory (pointer within the object) found above */
325
326 if (obj_pointer) {
327 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
328 "Deleting Object Subptr %p\n", obj_pointer));
329 ACPI_FREE(obj_pointer);
330 }
331
332 /* Now the object can be safely deleted */
333
334 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, "Deleting Object %p [%s]\n",
335 object, acpi_ut_get_object_type_name(object)));
336
337 acpi_ut_delete_object_desc(object);
338 return_VOID;
339 }
340
341 /*******************************************************************************
342 *
343 * FUNCTION: acpi_ut_delete_internal_object_list
344 *
345 * PARAMETERS: obj_list - Pointer to the list to be deleted
346 *
347 * RETURN: None
348 *
349 * DESCRIPTION: This function deletes an internal object list, including both
350 * simple objects and package objects
351 *
352 ******************************************************************************/
353
acpi_ut_delete_internal_object_list(union acpi_operand_object ** obj_list)354 void acpi_ut_delete_internal_object_list(union acpi_operand_object **obj_list)
355 {
356 union acpi_operand_object **internal_obj;
357
358 ACPI_FUNCTION_ENTRY();
359
360 /* Walk the null-terminated internal list */
361
362 for (internal_obj = obj_list; *internal_obj; internal_obj++) {
363 acpi_ut_remove_reference(*internal_obj);
364 }
365
366 /* Free the combined parameter pointer list and object array */
367
368 ACPI_FREE(obj_list);
369 return;
370 }
371
372 /*******************************************************************************
373 *
374 * FUNCTION: acpi_ut_update_ref_count
375 *
376 * PARAMETERS: object - Object whose ref count is to be updated
377 * action - What to do (REF_INCREMENT or REF_DECREMENT)
378 *
379 * RETURN: None. Sets new reference count within the object
380 *
381 * DESCRIPTION: Modify the reference count for an internal acpi object
382 *
383 ******************************************************************************/
384
385 static void
acpi_ut_update_ref_count(union acpi_operand_object * object,u32 action)386 acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action)
387 {
388 u16 original_count;
389 u16 new_count = 0;
390 acpi_cpu_flags lock_flags;
391
392 ACPI_FUNCTION_NAME(ut_update_ref_count);
393
394 if (!object) {
395 return;
396 }
397
398 /*
399 * Always get the reference count lock. Note: Interpreter and/or
400 * Namespace is not always locked when this function is called.
401 */
402 lock_flags = acpi_os_acquire_lock(acpi_gbl_reference_count_lock);
403 original_count = object->common.reference_count;
404
405 /* Perform the reference count action (increment, decrement) */
406
407 switch (action) {
408 case REF_INCREMENT:
409
410 new_count = original_count + 1;
411 object->common.reference_count = new_count;
412 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags);
413
414 /* The current reference count should never be zero here */
415
416 if (!original_count) {
417 ACPI_WARNING((AE_INFO,
418 "Obj %p, Reference Count was zero before increment\n",
419 object));
420 }
421
422 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
423 "Obj %p Type %.2X Refs %.2X [Incremented]\n",
424 object, object->common.type, new_count));
425 break;
426
427 case REF_DECREMENT:
428
429 /* The current reference count must be non-zero */
430
431 if (original_count) {
432 new_count = original_count - 1;
433 object->common.reference_count = new_count;
434 }
435
436 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags);
437
438 if (!original_count) {
439 ACPI_WARNING((AE_INFO,
440 "Obj %p, Reference Count is already zero, cannot decrement\n",
441 object));
442 }
443
444 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
445 "Obj %p Type %.2X Refs %.2X [Decremented]\n",
446 object, object->common.type, new_count));
447
448 /* Actually delete the object on a reference count of zero */
449
450 if (new_count == 0) {
451 acpi_ut_delete_internal_obj(object);
452 }
453 break;
454
455 default:
456
457 acpi_os_release_lock(acpi_gbl_reference_count_lock, lock_flags);
458 ACPI_ERROR((AE_INFO, "Unknown Reference Count action (0x%X)",
459 action));
460 return;
461 }
462
463 /*
464 * Sanity check the reference count, for debug purposes only.
465 * (A deleted object will have a huge reference count)
466 */
467 if (new_count > ACPI_MAX_REFERENCE_COUNT) {
468 ACPI_WARNING((AE_INFO,
469 "Large Reference Count (0x%X) in object %p, Type=0x%.2X",
470 new_count, object, object->common.type));
471 }
472 }
473
474 /*******************************************************************************
475 *
476 * FUNCTION: acpi_ut_update_object_reference
477 *
478 * PARAMETERS: object - Increment ref count for this object
479 * and all sub-objects
480 * action - Either REF_INCREMENT or REF_DECREMENT
481 *
482 * RETURN: Status
483 *
484 * DESCRIPTION: Increment the object reference count
485 *
486 * Object references are incremented when:
487 * 1) An object is attached to a Node (namespace object)
488 * 2) An object is copied (all subobjects must be incremented)
489 *
490 * Object references are decremented when:
491 * 1) An object is detached from an Node
492 *
493 ******************************************************************************/
494
495 acpi_status
acpi_ut_update_object_reference(union acpi_operand_object * object,u16 action)496 acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
497 {
498 acpi_status status = AE_OK;
499 union acpi_generic_state *state_list = NULL;
500 union acpi_operand_object *next_object = NULL;
501 union acpi_operand_object *prev_object;
502 union acpi_generic_state *state;
503 u32 i;
504
505 ACPI_FUNCTION_NAME(ut_update_object_reference);
506
507 while (object) {
508
509 /* Make sure that this isn't a namespace handle */
510
511 if (ACPI_GET_DESCRIPTOR_TYPE(object) == ACPI_DESC_TYPE_NAMED) {
512 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
513 "Object %p is NS handle\n", object));
514 return (AE_OK);
515 }
516
517 /*
518 * All sub-objects must have their reference count incremented also.
519 * Different object types have different subobjects.
520 */
521 switch (object->common.type) {
522 case ACPI_TYPE_DEVICE:
523 case ACPI_TYPE_PROCESSOR:
524 case ACPI_TYPE_POWER:
525 case ACPI_TYPE_THERMAL:
526 /*
527 * Update the notify objects for these types (if present)
528 * Two lists, system and device notify handlers.
529 */
530 for (i = 0; i < ACPI_NUM_NOTIFY_TYPES; i++) {
531 prev_object =
532 object->common_notify.notify_list[i];
533 while (prev_object) {
534 next_object =
535 prev_object->notify.next[i];
536 acpi_ut_update_ref_count(prev_object,
537 action);
538 prev_object = next_object;
539 }
540 }
541 break;
542
543 case ACPI_TYPE_PACKAGE:
544 /*
545 * We must update all the sub-objects of the package,
546 * each of whom may have their own sub-objects.
547 */
548 for (i = 0; i < object->package.count; i++) {
549 /*
550 * Null package elements are legal and can be simply
551 * ignored.
552 */
553 next_object = object->package.elements[i];
554 if (!next_object) {
555 continue;
556 }
557
558 switch (next_object->common.type) {
559 case ACPI_TYPE_INTEGER:
560 case ACPI_TYPE_STRING:
561 case ACPI_TYPE_BUFFER:
562 /*
563 * For these very simple sub-objects, we can just
564 * update the reference count here and continue.
565 * Greatly increases performance of this operation.
566 */
567 acpi_ut_update_ref_count(next_object,
568 action);
569 break;
570
571 default:
572 /*
573 * For complex sub-objects, push them onto the stack
574 * for later processing (this eliminates recursion.)
575 */
576 status =
577 acpi_ut_create_update_state_and_push
578 (next_object, action, &state_list);
579 if (ACPI_FAILURE(status)) {
580 goto error_exit;
581 }
582 break;
583 }
584 }
585 next_object = NULL;
586 break;
587
588 case ACPI_TYPE_BUFFER_FIELD:
589
590 next_object = object->buffer_field.buffer_obj;
591 break;
592
593 case ACPI_TYPE_LOCAL_REGION_FIELD:
594
595 next_object = object->field.region_obj;
596 break;
597
598 case ACPI_TYPE_LOCAL_BANK_FIELD:
599
600 next_object = object->bank_field.bank_obj;
601 status =
602 acpi_ut_create_update_state_and_push(object->
603 bank_field.
604 region_obj,
605 action,
606 &state_list);
607 if (ACPI_FAILURE(status)) {
608 goto error_exit;
609 }
610 break;
611
612 case ACPI_TYPE_LOCAL_INDEX_FIELD:
613
614 next_object = object->index_field.index_obj;
615 status =
616 acpi_ut_create_update_state_and_push(object->
617 index_field.
618 data_obj,
619 action,
620 &state_list);
621 if (ACPI_FAILURE(status)) {
622 goto error_exit;
623 }
624 break;
625
626 case ACPI_TYPE_LOCAL_REFERENCE:
627 /*
628 * The target of an Index (a package, string, or buffer) or a named
629 * reference must track changes to the ref count of the index or
630 * target object.
631 */
632 if ((object->reference.class == ACPI_REFCLASS_INDEX) ||
633 (object->reference.class == ACPI_REFCLASS_NAME)) {
634 next_object = object->reference.object;
635 }
636 break;
637
638 case ACPI_TYPE_REGION:
639 default:
640
641 break; /* No subobjects for all other types */
642 }
643
644 /*
645 * Now we can update the count in the main object. This can only
646 * happen after we update the sub-objects in case this causes the
647 * main object to be deleted.
648 */
649 acpi_ut_update_ref_count(object, action);
650 object = NULL;
651
652 /* Move on to the next object to be updated */
653
654 if (next_object) {
655 object = next_object;
656 next_object = NULL;
657 } else if (state_list) {
658 state = acpi_ut_pop_generic_state(&state_list);
659 object = state->update.object;
660 acpi_ut_delete_generic_state(state);
661 }
662 }
663
664 return (AE_OK);
665
666 error_exit:
667
668 ACPI_EXCEPTION((AE_INFO, status,
669 "Could not update object reference count"));
670
671 /* Free any stacked Update State objects */
672
673 while (state_list) {
674 state = acpi_ut_pop_generic_state(&state_list);
675 acpi_ut_delete_generic_state(state);
676 }
677
678 return (status);
679 }
680
681 /*******************************************************************************
682 *
683 * FUNCTION: acpi_ut_add_reference
684 *
685 * PARAMETERS: object - Object whose reference count is to be
686 * incremented
687 *
688 * RETURN: None
689 *
690 * DESCRIPTION: Add one reference to an ACPI object
691 *
692 ******************************************************************************/
693
acpi_ut_add_reference(union acpi_operand_object * object)694 void acpi_ut_add_reference(union acpi_operand_object *object)
695 {
696
697 ACPI_FUNCTION_NAME(ut_add_reference);
698
699 /* Ensure that we have a valid object */
700
701 if (!acpi_ut_valid_internal_object(object)) {
702 return;
703 }
704
705 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
706 "Obj %p Current Refs=%X [To Be Incremented]\n",
707 object, object->common.reference_count));
708
709 /* Increment the reference count */
710
711 (void)acpi_ut_update_object_reference(object, REF_INCREMENT);
712 return;
713 }
714
715 /*******************************************************************************
716 *
717 * FUNCTION: acpi_ut_remove_reference
718 *
719 * PARAMETERS: object - Object whose ref count will be decremented
720 *
721 * RETURN: None
722 *
723 * DESCRIPTION: Decrement the reference count of an ACPI internal object
724 *
725 ******************************************************************************/
726
acpi_ut_remove_reference(union acpi_operand_object * object)727 void acpi_ut_remove_reference(union acpi_operand_object *object)
728 {
729
730 ACPI_FUNCTION_NAME(ut_remove_reference);
731
732 /*
733 * Allow a NULL pointer to be passed in, just ignore it. This saves
734 * each caller from having to check. Also, ignore NS nodes.
735 */
736 if (!object ||
737 (ACPI_GET_DESCRIPTOR_TYPE(object) == ACPI_DESC_TYPE_NAMED)) {
738 return;
739 }
740
741 /* Ensure that we have a valid object */
742
743 if (!acpi_ut_valid_internal_object(object)) {
744 return;
745 }
746
747 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
748 "Obj %p Current Refs=%X [To Be Decremented]\n",
749 object, object->common.reference_count));
750
751 /*
752 * Decrement the reference count, and only actually delete the object
753 * if the reference count becomes 0. (Must also decrement the ref count
754 * of all subobjects!)
755 */
756 (void)acpi_ut_update_object_reference(object, REF_DECREMENT);
757 return;
758 }
759