Index: abi/include/ddi/irq.h =================================================================== --- abi/include/ddi/irq.h (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ abi/include/ddi/irq.h (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -96,9 +96,15 @@ CMD_PIO_WRITE_A_32, - /** - * Perform a bit masking on the source argument - * and store the result into the destination argument. + /** Load value. + * + * value -> scratch[dstarg] */ - CMD_BTEST, + CMD_LOAD, + + /** Perform bitwise conjunction. + * + * scratch[srcarg] & value -> scratch[dstarg] + */ + CMD_AND, /** Predicate the execution of the following commands. Index: kernel/generic/src/ipc/irq.c =================================================================== --- kernel/generic/src/ipc/irq.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ kernel/generic/src/ipc/irq.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -176,4 +176,44 @@ } +/** Statically check the top-half pseudocode + * + * Check the top-half pseudocode for invalid or unsafe + * constructs. + * + */ +static int code_check(irq_cmd_t *cmds, size_t cmdcount) +{ + for (size_t i = 0; i < cmdcount; i++) { + /* + * Check for accepted ranges. + */ + if (cmds[i].cmd >= CMD_LAST) + return EINVAL; + + if (cmds[i].srcarg >= IPC_CALL_LEN) + return EINVAL; + + if (cmds[i].dstarg >= IPC_CALL_LEN) + return EINVAL; + + switch (cmds[i].cmd) { + case CMD_PREDICATE: + /* + * Check for control flow overflow. + * Note that jumping just beyond the last + * command is a correct behaviour. + */ + if (i + cmds[i].value > cmdcount) + return EINVAL; + + break; + default: + break; + } + } + + return EOK; +} + /** Free the top-half pseudocode. * @@ -223,5 +263,9 @@ if (rc != EOK) goto error; - + + rc = code_check(cmds, code->cmdcount); + if (rc != EOK) + goto error; + rc = ranges_map_and_apply(ranges, code->rangecount, cmds, code->cmdcount); @@ -492,30 +536,19 @@ for (size_t i = 0; i < code->cmdcount; i++) { - uint32_t dstval; - uintptr_t srcarg = code->cmds[i].srcarg; uintptr_t dstarg = code->cmds[i].dstarg; - if (srcarg >= IPC_CALL_LEN) - break; - - if (dstarg >= IPC_CALL_LEN) - break; - switch (code->cmds[i].cmd) { case CMD_PIO_READ_8: - dstval = pio_read_8((ioport8_t *) code->cmds[i].addr); - if (dstarg) - scratch[dstarg] = dstval; + scratch[dstarg] = + pio_read_8((ioport8_t *) code->cmds[i].addr); break; case CMD_PIO_READ_16: - dstval = pio_read_16((ioport16_t *) code->cmds[i].addr); - if (dstarg) - scratch[dstarg] = dstval; + scratch[dstarg] = + pio_read_16((ioport16_t *) code->cmds[i].addr); break; case CMD_PIO_READ_32: - dstval = pio_read_32((ioport32_t *) code->cmds[i].addr); - if (dstarg) - scratch[dstarg] = dstval; + scratch[dstarg] = + pio_read_32((ioport32_t *) code->cmds[i].addr); break; case CMD_PIO_WRITE_8: @@ -532,32 +565,26 @@ break; case CMD_PIO_WRITE_A_8: - if (srcarg) { - pio_write_8((ioport8_t *) code->cmds[i].addr, - (uint8_t) scratch[srcarg]); - } + pio_write_8((ioport8_t *) code->cmds[i].addr, + (uint8_t) scratch[srcarg]); break; case CMD_PIO_WRITE_A_16: - if (srcarg) { - pio_write_16((ioport16_t *) code->cmds[i].addr, - (uint16_t) scratch[srcarg]); - } + pio_write_16((ioport16_t *) code->cmds[i].addr, + (uint16_t) scratch[srcarg]); break; case CMD_PIO_WRITE_A_32: - if (srcarg) { - pio_write_32((ioport32_t *) code->cmds[i].addr, - (uint32_t) scratch[srcarg]); - } - break; - case CMD_BTEST: - if ((srcarg) && (dstarg)) { - dstval = scratch[srcarg] & code->cmds[i].value; - scratch[dstarg] = dstval; - } + pio_write_32((ioport32_t *) code->cmds[i].addr, + (uint32_t) scratch[srcarg]); + break; + case CMD_LOAD: + scratch[dstarg] = code->cmds[i].value; + break; + case CMD_AND: + scratch[dstarg] = scratch[srcarg] & + code->cmds[i].value; break; case CMD_PREDICATE: - if ((srcarg) && (!scratch[srcarg])) { + if (scratch[srcarg] == 0) i += code->cmds[i].value; - continue; - } + break; case CMD_ACCEPT: Index: uspace/drv/bus/usb/ohci/hc.c =================================================================== --- uspace/drv/bus/usb/ohci/hc.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/drv/bus/usb/ohci/hc.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -26,4 +26,5 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + /** @addtogroup drvusbohcihc * @{ @@ -32,4 +33,5 @@ * @brief OHCI Host controller driver routines */ + #include #include @@ -49,5 +51,5 @@ static const irq_pio_range_t ohci_pio_ranges[] = { { - .base = 0, /* filled later */ + .base = 0, .size = sizeof(ohci_regs_t) } @@ -55,9 +57,28 @@ static const irq_cmd_t ohci_irq_commands[] = { - { .cmd = CMD_PIO_READ_32, .dstarg = 1, .addr = NULL /* filled later */ }, - { .cmd = CMD_BTEST, .srcarg = 1, .dstarg = 2, .value = 0 /* filled later */ }, - { .cmd = CMD_PREDICATE, .srcarg = 2, .value = 2 }, - { .cmd = CMD_PIO_WRITE_A_32, .srcarg = 1, .addr = NULL /* filled later */ }, - { .cmd = CMD_ACCEPT }, + { + .cmd = CMD_PIO_READ_32, + .dstarg = 1, + .addr = NULL + }, + { + .cmd = CMD_AND, + .srcarg = 1, + .dstarg = 2, + .value = OHCI_USED_INTERRUPTS + }, + { + .cmd = CMD_PREDICATE, + .srcarg = 2, + .value = 2 + }, + { + .cmd = CMD_PIO_WRITE_A_32, + .srcarg = 1, + .addr = NULL + }, + { + .cmd = CMD_ACCEPT + } }; @@ -76,5 +97,4 @@ return sizeof(ohci_pio_ranges) / sizeof(irq_pio_range_t); } - /** Get number of commands used in IRQ code. @@ -111,5 +131,4 @@ ohci_regs_t *registers = (ohci_regs_t *) regs; cmds[0].addr = (void *) ®isters->interrupt_status; - cmds[1].value = OHCI_USED_INTERRUPTS; cmds[3].addr = (void *) ®isters->interrupt_status; @@ -445,4 +464,5 @@ return; } + const unsigned hc_status = C_HCFS_GET(instance->registers->control); /* Interrupt routing disabled && status != USB_RESET => BIOS active */ Index: uspace/drv/bus/usb/uhci/hc.c =================================================================== --- uspace/drv/bus/usb/uhci/hc.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/drv/bus/usb/uhci/hc.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -50,5 +50,5 @@ static const irq_pio_range_t uhci_irq_pio_ranges[] = { { - .base = 0, /* filled later */ + .base = 0, .size = sizeof(uhci_regs_t) } @@ -56,10 +56,28 @@ static const irq_cmd_t uhci_irq_commands[] = { - { .cmd = CMD_PIO_READ_16, .dstarg = 1, .addr = NULL/*filled later*/}, - { .cmd = CMD_BTEST, .srcarg = 1, .dstarg = 2, - .value = UHCI_STATUS_USED_INTERRUPTS | UHCI_STATUS_NM_INTERRUPTS }, - { .cmd = CMD_PREDICATE, .srcarg = 2, .value = 2 }, - { .cmd = CMD_PIO_WRITE_A_16, .srcarg = 1, .addr = NULL/*filled later*/}, - { .cmd = CMD_ACCEPT }, + { + .cmd = CMD_PIO_READ_16, + .dstarg = 1, + .addr = NULL + }, + { + .cmd = CMD_AND, + .srcarg = 1, + .dstarg = 2, + .value = UHCI_STATUS_USED_INTERRUPTS | UHCI_STATUS_NM_INTERRUPTS + }, + { + .cmd = CMD_PREDICATE, + .srcarg = 2, + .value = 2 + }, + { + .cmd = CMD_PIO_WRITE_A_16, + .srcarg = 1, + .addr = NULL + }, + { + .cmd = CMD_ACCEPT + } }; Index: uspace/drv/char/i8042/i8042.c =================================================================== --- uspace/drv/char/i8042/i8042.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/drv/char/i8042/i8042.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -120,5 +120,5 @@ }, { - .cmd = CMD_BTEST, + .cmd = CMD_AND, .value = i8042_OUTPUT_FULL, .srcarg = 1, Index: uspace/drv/nic/ne2k/ne2k.c =================================================================== --- uspace/drv/nic/ne2k/ne2k.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/drv/nic/ne2k/ne2k.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -83,5 +83,5 @@ { /* Mask supported interrupt causes */ - .cmd = CMD_BTEST, + .cmd = CMD_AND, .value = (ISR_PRX | ISR_PTX | ISR_RXE | ISR_TXE | ISR_OVW | ISR_CNT | ISR_RDC), Index: uspace/srv/hid/input/port/ns16550.c =================================================================== --- uspace/srv/hid/input/port/ns16550.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/srv/hid/input/port/ns16550.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -84,5 +84,5 @@ }, { - .cmd = CMD_BTEST, + .cmd = CMD_AND, .value = LSR_DATA_READY, .srcarg = 1, Index: uspace/srv/hid/input/port/pl050.c =================================================================== --- uspace/srv/hid/input/port/pl050.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/srv/hid/input/port/pl050.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -80,5 +80,5 @@ }, { - .cmd = CMD_BTEST, + .cmd = CMD_AND, .value = PL050_STAT_RXFULL, .srcarg = 1, Index: uspace/srv/hw/bus/cuda_adb/cuda_adb.c =================================================================== --- uspace/srv/hw/bus/cuda_adb/cuda_adb.c (revision 56c167c17d9f374fdab0db27dbc4d039172f1d2a) +++ uspace/srv/hw/bus/cuda_adb/cuda_adb.c (revision 8486c070d3e8193fcd8774597aa3c3438d3ba2c9) @@ -116,9 +116,9 @@ { .cmd = CMD_PIO_READ_8, - .addr = NULL, /* will be patched in run-time */ + .addr = NULL, .dstarg = 1 }, { - .cmd = CMD_BTEST, + .cmd = CMD_AND, .value = SR_INT, .srcarg = 1,