From owner-freebsd-acpi@FreeBSD.ORG  Sun Oct 17 13:46:41 2010
Return-Path: <owner-freebsd-acpi@FreeBSD.ORG>
Delivered-To: freebsd-acpi@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 8424D1065673;
	Sun, 17 Oct 2010 13:46:41 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
Received: from swip.net (mailfe07.swip.net [212.247.154.193])
	by mx1.freebsd.org (Postfix) with ESMTP id DFC528FC08;
	Sun, 17 Oct 2010 13:46:40 +0000 (UTC)
X-Cloudmark-Score: 0.000000 []
X-Cloudmark-Analysis: v=1.1 cv=sEolSJAlcSxSMaOm1MQ0bvrIu+BNAN+OqG2UAUgC4Ok=
	c=1 sm=1 a=8nJEP1OIZ-IA:10 a=CL8lFSKtTFcA:10
	a=i9M/sDlu2rpZ9XS819oYzg==:17 a=MqtWdLHOA0PUFXxu8IEA:9
	a=kc03ppROO4SYZ7uiqwgA:7 a=HKScSlISXkDKBxWLX4hMk62dePYA:4
	a=wPNLvfGTeEIA:10 a=i9M/sDlu2rpZ9XS819oYzg==:117
Received: from [188.126.198.129] (account mc467741@c2i.net HELO
	laptop002.hselasky.homeunix.org)
	by mailfe07.swip.net (CommuniGate Pro SMTP 5.2.19)
	with ESMTPA id 36248441; Sun, 17 Oct 2010 15:46:38 +0200
From: Hans Petter Selasky <hselasky@c2i.net>
To: freebsd-acpi@freebsd.org
Date: Sun, 17 Oct 2010 15:47:56 +0200
User-Agent: KMail/1.13.5 (FreeBSD/8.1-STABLE; KDE/4.4.5; amd64; ; )
References: <201010121209.06397.hselasky@c2i.net>
	<201010131958.02252.jkim@FreeBSD.org>
	<201010171056.12606.hselasky@c2i.net>
In-Reply-To: <201010171056.12606.hselasky@c2i.net>
X-Face: +~\`s("[*<S!NI[0M*"FaghA8S>|O,="7?X@L.elg*F"OA\I/3%^p8g?ab%RN'(; _IjlA:
	hGE..Ew, XAQ*o#\/M~SC=S1-f9{EzRfT'|Hhll5Q]ha5Bt-s|oTlKMusi:1e[wJl}kd}GR
	Z0adGx-x_0zGbZj'e(Y[(UNle~)8CQWXW@:DX+9)_YlB[tIccCPN$7/L'
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201010171547.56445.hselasky@c2i.net>
Cc: linux-acpi@vger.kernel.org
Subject: Re: MacBookPro 5,1
X-BeenThere: freebsd-acpi@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: ACPI and power management development <freebsd-acpi.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-acpi>,
	<mailto:freebsd-acpi-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-acpi>
List-Post: <mailto:freebsd-acpi@freebsd.org>
List-Help: <mailto:freebsd-acpi-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-acpi>,
	<mailto:freebsd-acpi-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Oct 2010 13:46:41 -0000

Hi,

CC'ing the Linux guys, hence I belive you are using the same ACPI code like in 
FreeBSD.

It appears that when a string is present in the extended interrupt descriptor 
(6.4.3.6, ACPIspec30.pdf), then this is not handled correctly, meaning that 
the precomputed buffer space when encoding to AML, is incorrect and that data 
is written beyond the destination buffer!

The error is catched on a MacBookPro 5,1 and is visible if you zero-pad all 
ACPI allocations to 4096 bytes, and verify that the freed buffer is not 
written beyond the allocation. Also the Extended interrupt descriptor must be 
the last element encoded in the AML.

The quick patch is to disable these elements. I tried to figure out why this 
happens, but this particular handling in the code looks very obfuscated to me.

src/sys/contrib/dev/acpica
%svk diff
=== resources/rsmisc.c
==================================================================
--- resources/rsmisc.c  (revision 213698)
+++ resources/rsmisc.c  (local)
@@ -311,6 +311,8 @@
 
 
         case ACPI_RSC_SOURCEX:
+               break;  /* RSC_SOURCEX is broken */
+
             /*
              * Optional ResourceSource (Index and String). This is the more
              * complicated case used by the Interrupt() macro
@@ -537,6 +539,8 @@
 
 
         case ACPI_RSC_SOURCEX:
+               break;  /* RSC_SOURCEX is broken */
+
             /*
              * Optional ResourceSource (Index and String)
              */


Any comments are welcome!

--HPS

Please keep me CC'ed.