From nobody Sun Dec 29 00:53:34 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 1496230805385831.1693509303063; Wed, 31 May 2017 04:40:05 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 8CCC721AF39B8; Wed, 31 May 2017 04:39:00 -0700 (PDT) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9A5B521AF39AB for ; Wed, 31 May 2017 04:38:59 -0700 (PDT) Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 31 May 2017 04:39:59 -0700 Received: from ray-dev.ccr.corp.intel.com ([10.239.9.1]) by fmsmga005.fm.intel.com with ESMTP; 31 May 2017 04:39:58 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.38,423,1491289200"; d="scan'208";a="108662393" From: Ruiyu Ni To: edk2-devel@lists.01.org Date: Wed, 31 May 2017 19:39:54 +0800 Message-Id: <20170531113955.65448-2-ruiyu.ni@intel.com> X-Mailer: git-send-email 2.12.2.windows.2 In-Reply-To: <20170531113955.65448-1-ruiyu.ni@intel.com> References: <20170531113955.65448-1-ruiyu.ni@intel.com> Subject: [edk2] [PATCH 1/2] MdeModulePkg/UsbBus: Fix system hang when failed to uninstall UsbIo X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Hao A Wu , Feng Tian , Star Zeng MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" When "reconnect -r" is typed in shell, UsbFreeInterface() is called to uninstall the UsbIo and DevicePath. But When a UsbIo is opened by a driver and that driver rejects to close the UsbIo in Stop(), the uninstall doesn't succeed. But UsbFreeInterface () frees the DevicePath memory without check whether the uninstall succeeds. It leads to the DXE core database contain a DevicePath instance but that instance's memory is freed. Assertion happens when someone calls InstallProtocol(DevicePath) because the InstallProtocol() checks all DevicePath instance to find whether the same one exits in database. We haven't seen any USB device driver which rejects to close UsbIo in Stop(), but it's very likely. The patch removes IsManaged flag from USB_INTERFACE structure because this flag cannot reflect the managing status of the USB interface. When the USB BUS driver is started first time, it creates all UsbIo instances but only call ConnectController() for those specified by RemainingDevicePath. Later platform BDS may call ConnectController for certain UsbIo instances, though some upper layer drivers are started to mange the UsbIo instances, the IsManaged flag is still FALSE because these drivers are not started by UsbBus driver. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Ruiyu Ni Cc: Feng Tian Cc: Star Zeng Cc: Hao A Wu --- MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.h | 3 +- MdeModulePkg/Bus/Usb/UsbBusDxe/UsbEnumer.c | 87 +++++++------------------= ---- MdeModulePkg/Bus/Usb/UsbBusDxe/UsbUtility.c | 17 +++--- 3 files changed, 27 insertions(+), 80 deletions(-) diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.h b/MdeModulePkg/Bus/Usb= /UsbBusDxe/UsbBus.h index 9ede83ab7e..e8a55c584c 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.h +++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.h @@ -2,7 +2,7 @@ =20 Usb Bus Driver Binding and Bus IO Protocol. =20 -Copyright (c) 2004 - 2012, Intel Corporation. All rights reserved.
+Copyright (c) 2004 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -216,7 +216,6 @@ struct _USB_INTERFACE { EFI_HANDLE Handle; EFI_USB_IO_PROTOCOL UsbIo; EFI_DEVICE_PATH_PROTOCOL *DevicePath; - BOOLEAN IsManaged; =20 // // Hub device special data diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbEnumer.c b/MdeModulePkg/Bus/= Usb/UsbBusDxe/UsbEnumer.c index ea54d37c93..1514b63eb9 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbEnumer.c +++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbEnumer.c @@ -2,7 +2,7 @@ =20 Usb bus enumeration support. =20 -Copyright (c) 2007 - 2014, Intel Corporation. All rights reserved.
+Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -59,21 +59,9 @@ UsbFreeInterface ( IN USB_INTERFACE *UsbIf ) { - UsbCloseHostProtoByChild (UsbIf->Device->Bus, UsbIf->Handle); - - gBS->UninstallMultipleProtocolInterfaces ( - UsbIf->Handle, - &gEfiDevicePathProtocolGuid, - UsbIf->DevicePath, - &gEfiUsbIoProtocolGuid, - &UsbIf->UsbIo, - NULL - ); - if (UsbIf->DevicePath !=3D NULL) { FreePool (UsbIf->DevicePath); } - FreePool (UsbIf); } =20 @@ -279,13 +267,12 @@ UsbConnectDriver ( // Only recursively wanted usb child device // if (UsbBusIsWantedUsbIO (UsbIf->Device->Bus, UsbIf)) { - OldTpl =3D UsbGetCurrentTpl (); + OldTpl =3D UsbGetCurrentTpl (); DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL before connect is %d, %p\= n", (UINT32)OldTpl, UsbIf->Handle)); =20 gBS->RestoreTPL (TPL_CALLBACK); =20 - Status =3D gBS->ConnectController (UsbIf->Handle, NULL, N= ULL, TRUE); - UsbIf->IsManaged =3D (BOOLEAN)!EFI_ERROR (Status); + gBS->ConnectController (UsbIf->Handle, NULL, NULL, TRUE); =20 DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL after connect is %d\n", (= UINT32)UsbGetCurrentTpl())); ASSERT (UsbGetCurrentTpl () =3D=3D TPL_CALLBACK); @@ -444,57 +431,6 @@ UsbSelectConfig ( return EFI_SUCCESS; } =20 - -/** - Disconnect the USB interface with its driver. - - @param UsbIf The interface to disconnect driver from. - -**/ -EFI_STATUS -UsbDisconnectDriver ( - IN USB_INTERFACE *UsbIf - ) -{ - EFI_TPL OldTpl; - EFI_STATUS Status; - - // - // Release the hub if it's a hub controller, otherwise - // disconnect the driver if it is managed by other drivers. - // - Status =3D EFI_SUCCESS; - if (UsbIf->IsHub) { - Status =3D UsbIf->HubApi->Release (UsbIf); - - } else if (UsbIf->IsManaged) { - // - // This function is called in both UsbIoControlTransfer and - // the timer callback in hub enumeration. So, at least it is - // called at TPL_CALLBACK. Some driver sitting on USB has - // twisted TPL used. It should be no problem for us to connect - // or disconnect at CALLBACK. - // - OldTpl =3D UsbGetCurrentTpl (); - DEBUG ((EFI_D_INFO, "UsbDisconnectDriver: old TPL is %d, %p\n", (UINT3= 2)OldTpl, UsbIf->Handle)); - - gBS->RestoreTPL (TPL_CALLBACK); - - Status =3D gBS->DisconnectController (UsbIf->Handle, NULL, NULL); - if (!EFI_ERROR (Status)) { - UsbIf->IsManaged =3D FALSE; - } - =20 - DEBUG (( EFI_D_INFO, "UsbDisconnectDriver: TPL after disconnect is %d,= %d\n", (UINT32)UsbGetCurrentTpl(), Status)); - ASSERT (UsbGetCurrentTpl () =3D=3D TPL_CALLBACK); - - gBS->RaiseTPL (OldTpl); - } - =20 - return Status; -} - - /** Remove the current device configuration. =20 @@ -522,8 +458,23 @@ UsbRemoveConfig ( if (UsbIf =3D=3D NULL) { continue; } + if (UsbIf->IsHub) { + Status =3D UsbIf->HubApi->Release (UsbIf); + } + + ASSERT (UsbIf->Handle !=3D NULL); + Status =3D gBS->UninstallMultipleProtocolInterfaces ( + UsbIf->Handle, + &gEfiDevicePathProtocolGuid, + UsbIf->DevicePath, + &gEfiUsbIoProtocolGuid, + &UsbIf->UsbIo, + NULL + ); + if (!EFI_ERROR (Status)) { + UsbCloseHostProtoByChild (UsbIf->Device->Bus, UsbIf->Handle); + } =20 - Status =3D UsbDisconnectDriver (UsbIf); if (!EFI_ERROR (Status)) { UsbFreeInterface (UsbIf); Device->Interfaces[Index] =3D NULL; diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbUtility.c b/MdeModulePkg/Bus= /Usb/UsbBusDxe/UsbUtility.c index 399b7a3b60..abce63d734 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbUtility.c +++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbUtility.c @@ -2,7 +2,7 @@ =20 Wrapper function for usb host controller interface. =20 -Copyright (c) 2007 - 2010, Intel Corporation. All rights reserved.
+Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -1360,15 +1360,12 @@ UsbBusRecursivelyConnectWantedUsbIo ( UsbIf =3D USB_INTERFACE_FROM_USBIO (UsbIo); =20 if (UsbBusIsWantedUsbIO (Bus, UsbIf)) { - if (!UsbIf->IsManaged) { - // - // Recursively connect the wanted Usb Io handle - // - DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL before connect is %d\n"= , (UINT32)UsbGetCurrentTpl ())); - Status =3D gBS->ConnectController (UsbIf->Handle, NULL,= NULL, TRUE); - UsbIf->IsManaged =3D (BOOLEAN)!EFI_ERROR (Status); - DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL after connect is %d\n",= (UINT32)UsbGetCurrentTpl())); - } + // + // Recursively connect the wanted Usb Io handle + // + DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL before connect is %d\n", = (UINT32)UsbGetCurrentTpl ())); + gBS->ConnectController (UsbIf->Handle, NULL, NULL, TRUE); + DEBUG ((EFI_D_INFO, "UsbConnectDriver: TPL after connect is %d\n", (= UINT32)UsbGetCurrentTpl())); } } =20 --=20 2.12.2.windows.2 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel