d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix for endless recursion in the ACPI GPE handler during boot.

Browse Source 
When handling a GPE ACPI interrupt object the EcSpaceHandler()
function can be called which checks the EC_EVENT_SCI bit and then
recurse on the EcGpeQueryHandler() function. If there are multiple GPE
events pending the EC_EVENT_SCI bit will be set at the next call to
EcSpaceHandler() causing it to recurse again via the
EcGpeQueryHandler() function. This leads to a slow never ending
recursion during boot which prevents proper system startup, because
the EC_EVENT_SCI bit never gets cleared in this scenario.

The behaviour is reproducible with the ALASKA AMI in combination with
a newer Skylake based mainboard in the following way:

Enter BIOS and adjust the clock one hour forward. Save and exit the
BIOS. System fails to boot due to the above mentioned bug in
EcGpeQueryHandler() which was observed recursing multiple times.

This patch adds a simple recursion guard to the EcGpeQueryHandler()
function and also also adds logic to detect if new GPE events occurred
during the execution of EcGpeQueryHandler() and then loop on this
function instead of recursing.

Reviewed by:		jhb
MFC after:		2 weeks
This commit is contained in:
hselasky 2016-12-02 08:21:08 +00:00
parent c25f2a0572
commit fef7ed3790
1 changed files with 31 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
sys/dev/acpica/acpi_ec.c
View File

@ -613,16 +613,14 @@ EcCheckStatus(struct acpi_ec_softc *sc, const char *msg, EC_EVENT event)
}
static void
EcGpeQueryHandler(void *Context)
EcGpeQueryHandlerSub(struct acpi_ec_softc *sc)
{
struct acpi_ec_softc *sc = (struct acpi_ec_softc *)Context;
UINT8 Data;
ACPI_STATUS Status;
int retry;
char qxx[5];
ACPI_FUNCTION_TRACE((char *)(uintptr_t)__func__);
KASSERT(Context != NULL, ("EcGpeQueryHandler called with NULL"));
/* Serialize user access with EcSpaceHandler(). */
Status = EcLock(sc);
@ -647,7 +645,6 @@ EcGpeQueryHandler(void *Context)
EC_EVENT_INPUT_BUFFER_EMPTY)))
break;
}
sc->ec_sci_pend = FALSE;
if (ACPI_FAILURE(Status)) {
EcUnlock(sc);
device_printf(sc->ec_dev, "GPE query failed: %s\n",
@ -678,6 +675,29 @@ EcGpeQueryHandler(void *Context)
}
}
static void
EcGpeQueryHandler(void *Context)
{
struct acpi_ec_softc *sc = (struct acpi_ec_softc *)Context;
int pending;
KASSERT(Context != NULL, ("EcGpeQueryHandler called with NULL"));
do {
/* Read the current pending count */
pending = atomic_load_acq_int(&sc->ec_sci_pend);
/* Call GPE handler function */
EcGpeQueryHandlerSub(sc);
/*
* Try to reset the pending count to zero. If this fails we
* know another GPE event has occurred while handling the
* current GPE event and need to loop.
*/
} while (!atomic_cmpset_int(&sc->ec_sci_pend, pending, 0));
}
/*
* The GPE handler is called when IBE/OBF or SCI events occur. We are
* called from an unknown lock context.
@ -706,13 +726,14 @@ EcGpeHandler(ACPI_HANDLE GpeDevice, UINT32 GpeNumber, void *Context)
* It will run the query and _Qxx method later, under the lock.
*/
EcStatus = EC_GET_CSR(sc);
if ((EcStatus & EC_EVENT_SCI) && !sc->ec_sci_pend) {
if ((EcStatus & EC_EVENT_SCI) &&
atomic_fetchadd_int(&sc->ec_sci_pend, 1) == 0) {
CTR0(KTR_ACPI, "ec gpe queueing query handler");
Status = AcpiOsExecute(OSL_GPE_HANDLER, EcGpeQueryHandler, Context);
if (ACPI_SUCCESS(Status))
sc->ec_sci_pend = TRUE;
else
if (ACPI_FAILURE(Status)) {
printf("EcGpeHandler: queuing GPE query handler failed\n");
atomic_store_rel_int(&sc->ec_sci_pend, 0);
}
}
return (ACPI_REENABLE_GPE);
}
@ -759,7 +780,8 @@ EcSpaceHandler(UINT32 Function, ACPI_PHYSICAL_ADDRESS Address, UINT32 Width,
* we call it directly here since our thread taskq is not active yet.
*/
if (cold || rebooting || sc->ec_suspending) {
if ((EC_GET_CSR(sc) & EC_EVENT_SCI)) {
if ((EC_GET_CSR(sc) & EC_EVENT_SCI) &&
atomic_fetchadd_int(&sc->ec_sci_pend, 1) == 0) {
CTR0(KTR_ACPI, "ec running gpe handler directly");
EcGpeQueryHandler(sc);
}