Commit Graph

4754 Commits

Author SHA1 Message Date
Hao Wu 213da0b540 MdeModulePkg/PrintLib: Avoid reading content beyond the format string
https://bugzilla.tianocore.org/show_bug.cgi?id=567

In functions DxePrintLibPrint2ProtocolVaListToBaseList() and
InternalPrintLibSPrintMarker(), when processing ASCII format strings, if
the format string walker pointer 'Format' is pointing at the end of the
format string (i.e. '\0'), the following expression:
*(Format + 1)
will read an undefined value.

Though this value won't affect the functionality, since it will be masked
by variable 'FormatMask':
(*(Format + 1) << 8)) & FormatMask
(FormatMask is 0xff for ASCII format string)

This commit adds additional logic to avoid reading undefined content.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
2017-06-01 08:46:40 +08:00
Paulo Alcantara df642d70e3 MdeModulePkg: Fix potential memory leaks in DxeHttpLib.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Paulo Alcantara <pcacjr@gmail.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
2017-05-27 09:50:10 +08:00
Michael Kinney 0fff7d6740 MdeModulePkg/DebugSupportDxe: Fix XCODE5 build failure
https://bugzilla.tianocore.org/show_bug.cgi?id=572

Update X64 AsmFuncs.S to resolve a build failure using the
XCODE5 tool chain.  This change updates AsmFuncs.S to match
AsmFuncs.asm and AsmFuncs.nasm.

The error generated in XCODE5 build is:

error: invalid instruction mnemonic 'movzxw'
    movzxw 8(%rax), %rax
    ^~~~~~

The correct instruction is

    movzwq 8(%rax), %rax

Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Andrew Fish <afish@apple.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Andrew Fish <afish@apple.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-05-24 16:44:21 -07:00
Michael Kinney c8206f22fd MdeModulePkg/RegularExpressionDxe: Fix XCODE5 build failure
https://bugzilla.tianocore.org/show_bug.cgi?id=572

The ErrorMessage local variable in OnigurumaMatch() should
be type OnigUChar instead of type CHAR8.  This resolves
a build failure with the XCODE5 tool chain.

Cc: Andrew Fish <afish@apple.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Andrew Fish <afish@apple.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-05-24 16:43:46 -07:00
Star Zeng a0284a9a58 MdeModulePkg MemoryProfileInfo: Use PdbStringOffset to get PDB info
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=570
Use PdbStringOffset to get PDB info, it will have no functional impact,
and will just make the code more generic.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-24 15:27:35 +08:00
Star Zeng f248539538 MdeModulePkg SmiHandlerProfile: Use fixed data type in data structure
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=568

Use fixed data type in data structure and make the structure
be natural aligned.
Without this update, the code must assume DXE and SMM are using
same data type (same size of UINTN), but it may be not true at
some case, for example, after standalone SMM feature is enabled.
With this update, the data structure will be phase independent
and convenient for consumer to parse the data.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-24 15:27:34 +08:00
Star Zeng 8ced192d5c MdeModulePkg SmiHandlerProfile: Fix no PDB case handling incorrectly
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=569

The PdbStringOffset should be set to 0 for no PDB case,
then SmiHandlerProfileInfo can use it to know whether
there is PCD info or not.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-24 15:27:34 +08:00
Michael Kinney 1c020add31 MdeModulePkg/LogoDxe: Return error if HII Package not present
https://bugzilla.tianocore.org/show_bug.cgi?id=554

Update LogoDxe module to print a DEBUG() message and exit
with an error instead of ASSERT_EFI_ERROR() if the HII
Image Package with the logo image is not present.

If a tool chain does not support generation of PE/COFF
resource sections, then this module can not produce the logo
from an HII Image Package.  XCODE5 is an example of a tool
chain that does not currently support generation of PE/COFF
resource sections.

Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Andrew Fish <afish@apple.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Michael Kinney <michael.d.kinney@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-05-22 16:30:11 -07:00
Ruiyu Ni 7320b8ed18 MdeModulePkg/BDS: Fix a buffer overflow bug
KeyOption points to a buffer holding the content of Key####.
So its size is smaller than EFI_BOOT_MANAGER_KEY_OPTION.
Old code to assign value to KeyOption->OptionNumber modifies
the memory outside of the KeyOption buffer.

The patch fixes this bug.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Steven Shi <steven.shi@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>
2017-05-22 09:43:47 +08:00
Star Zeng da0df6ca8f MdeModulePkg PCD: Fix TmpTokenSpaceBufferCount not assigned correctly
When DynamicEx PCD is only used in PEI code, but not DXE code,
current implementation of DxePcdGetNextTokenSpace does not assign
TmpTokenSpaceBufferCount correctly, but leaves it as initial value,
then DxePcdGetNextTokenSpace may return incorrect token space guid
and status.

This patch is to fix this issue.

Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
2017-05-19 11:32:11 +08:00
Dandan Bi 7a85e84741 MdeModulePkg/PciHostBridgeDxe: Fix EBC build failure
Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-18 16:44:26 +08:00
Jiewen Yao 11a6cc5bda MdeModulePkg/PciBus: Add IOMMU support.
If IOMMU protocol is installed, PciBus need call IOMMU
to set access attribute for the PCI device in Map/Ummap.

Only after the access attribute is set, the PCI device can
access the DMA memory.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Leo Duran <leo.duran@amd.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Previous patch Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Previous patch Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Leo Duran <leo.duran@amd.com>
2017-05-17 16:05:17 +08:00
Jiewen Yao c15da8eb35 MdeModulePkg/PciHostBridge: Add IOMMU support.
If IOMMU protocol is installed, PciHostBridge just calls
IOMMU AllocateBuffer/FreeBuffer/Map/Unmap.

PciHostBridge does not set IOMMU access attribute,
because it does not know which device request the DMA.
This work is done by PciBus driver.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Leo Duran <leo.duran@amd.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Previous patch Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Previous patch Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Leo Duran <leo.duran@amd.com>
2017-05-17 16:05:15 +08:00
Jiewen Yao d1fddc4533 MdeModulePkg/Include: Add IOMMU protocol definition.
This protocol is to abstract DMA access from IOMMU.
1) Intel "DMAR" ACPI table.
2) AMD "IVRS" ACPI table
3) ARM "IORT" ACPI table.

There might be multiple IOMMU engines on one platform.
For example, one for graphic and one for rest PCI devices
(such as ATA/USB).
All IOMMU engines are reported by one ACPI table.

All IOMMU protocol provider should be based upon ACPI table.
This single IOMMU protocol can handle multiple IOMMU engines on one system.

This IOMMU protocol provider can use UEFI device path to distinguish
if the device is graphic or ATA/USB, and find out corresponding
IOMMU engine.

The IOMMU protocol provides 2 capabilities:
A) Set DMA access attribute - such as write/read control.
B) Remap DMA memory - such as remap above 4GiB system memory address
to below 4GiB device address.
It provides AllocateBuffer/FreeBuffer/Map/Unmap for DMA memory.
The remapping can be static (fixed at build time) or dynamic (allocate
at runtime).

4) AMD "SEV" feature.
We can have an AMD SEV specific IOMMU driver to produce IOMMU protocol,
and manage SEV bit.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Leo Duran <leo.duran@amd.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Previous patch Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Previous patch Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Leo Duran <leo.duran@amd.com>
2017-05-17 16:05:12 +08:00
Hao Wu a8321feebb MdeModulePkg/UfsPassThruDxe: Fix typo in UfsPassThruGetTargetLun()
For function UfsPassThruGetTargetLun(), the length of the input device
node specified by 'DevicePath' should be compared with the size of
'UFS_DEVICE_PATH' rather than the size of 'SCSI_DEVICE_PATH'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-05-17 15:26:24 +08:00
Star Zeng fb1c81a1e5 MdeModulePkg SmiHandlerProfile: Fix memory leak in DumpSmiChildContext
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=530

In DumpSmiChildContext() of SmiHandlerProfile.c and
SmiHandlerProfileInfo.c, the return buffer from
ConvertDevicePathToText() should be freed after used.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-05-12 13:07:11 +08:00
Star Zeng 8ecb1e9bef MdeModulePkg CapsuleApp: Fix mixed EOL format issue
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
2017-05-11 12:58:55 +08:00
Dandan Bi df5914993c MdeModulePkg/FormDisplay: Make the LineWidth of option consistent
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=529

LineWidth of option in funcrion UpdateSkipInfoForMenu and DisplayOneMenu
are inconsistent. Now fix this issue to avoid incorrect UI display.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-05-11 10:48:49 +08:00
Fu Siyuan ca12a0c83b MdeModulePkg: Addressing TCP Window Retraction when window scale factor is used.
The RFC1323 which defines the TCP window scale option has been obsoleted by RFC7323.
This patch is to follow the RFC7323 to address the TCP window retraction problem
when a non-zero scale factor is used.
The changes has been test in high packet loss rate network by using HTTP boot and
iSCSI file read/write.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
2017-05-09 08:48:11 +08:00
Fu Siyuan 207b3d2b0b MdeModulePkg: Add wnd scale check before shrinking window.
Moving Right window edge to the left on sender side without additional check
can lead to the TCP deadlock, when receiver ACKs proper segment, while sender
discards it for future ACK. To prevent this add check if usable window (or
shrink amount in this case) is bigger then receiver's window scale factor.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Andrey Tepin <atepin@kraftway.ru>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
2017-05-09 08:45:33 +08:00
Tian, Feng 717ba86de7 MdeModulePkg: Update DEC/DSC version from 0.96 to 0.97
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Feng Tian <feng.tian@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-05-05 15:55:09 +08:00
Zhang, Lubo e3793f9834 MdeModulePkg: Fix issue the iSCSI client can not send reset packet correctly.
if we already established a iSCSI connection from initiator to target
based on IPv4 stack, after using reconnect -r command, we can not rebuild
the session with the windows target, since the server thought the session
is still exist.  This issue is caused by wrong place of acquire ownership of
sock lock which lead the iSCSI can not reset the connection correctly.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Zhang Lubo <lubo.zhang@intel.com>
Cc: Wu Jiaxin <jiaxin.wu@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
2017-05-02 11:09:32 +08:00
Ruiyu Ni 6bbd4a8f5f MdeModulePKg/BDS: Build meaningful description for Wi-Fi boot option
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Fan Wang <fan.wang@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
2017-04-26 09:25:54 +08:00
Jiaxin Wu d7dd4f0a06 MdeModulePkg/Ip4Dxe: Refine the IPv4 configuration help info
Below value indicate whether network address configured successfully
or not:
Network Device List->MAC->IPv4 Network Configuration->Configured.

This patch is to refine its help info.

Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
2017-04-25 18:17:01 +08:00
Liming Gao d5a67b3da1 MdeModulePkg: Update PiSmmCore to set correct ImageAddress into LoadedImage
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-25 09:48:22 +08:00
Liming Gao c2aeb66fff MdeModulePkg PiSmmIpl: Fix the issue in LMFA feature
SmramBase should be got from mLMFAConfigurationTable.

Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-25 09:48:18 +08:00
Hao Wu 1a5ae66175 MdeModulePkg/UfsPciHc: Avoid overriding return value in BindingStart
In function UfsHcDriverBindingStart(), the return value 'Status' may be
overridden during the original PCI attributes restore process.

This commit refines the logic to avoid such override.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-25 09:08:33 +08:00
Hao Wu c36ea72ebd MdeModulePkg/UfsPciHc: Remove unused field in UfsHc private struct
The commit removes the unused field 'EFI_HANDLE  Handle' in Ufs host
controller private data structure 'UFS_HOST_CONTROLLER_PRIVATE_DATA'.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-25 09:08:28 +08:00
Fu Siyuan dd29d8b356 MdeModulePkg: Discard received broadcast message in DxeIpIoLib.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
2017-04-24 10:12:09 +08:00
Suman Prakash f6b139bde7 MdeModulePkg/NvmExpressDxe: Handling return of write to sq and cq db
In case of an async command if updating the submission queue tail
doorbell fails then the command will not be picked up by device and
no completion response will be created. This scenario has to be handled.
Also if we create an AsyncRequest element and insert in the async queue,
it will never receive a completion so in the timer routine this element
won't be freed, resulting in memory leak. Also in case of blocking calls
we should capture the status of updating completion queue head doorbell
register and return it to caller of PassThru.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Suman Prakash <suman.p@samsung.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2017-04-24 09:06:44 +08:00
Hao Wu f8f931f632 MdeModulePkg/PiSmmCore: Remove redundant PoolTail pointer assignment
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-24 08:58:07 +08:00
Jiaxin Wu 205a4b0c15 MdeModulePkg/DeviceManagerUiLib: Fix the network device MAC display issue
v3:
* Add NULL string check.

v2:
* Define new STR_FORM_NETWORK_DEVICE_TITLE_HEAD for L" Network Device "
instead of hard code in the code.

Network device tile (STR_FORM_NETWORK_DEVICE_TITLE) is dynamic adjusted
according the different MAC value. So, the string value shouldn't be treated
as a constant string (Network Device). Otherwise, the display will be
incorrect.

Reproduce: Device Manager->Network Device List, select to enter MAC, then to
press ESC back to previous page, then re-enter, found each enter/ESC operation,
the MAC address display +1.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-04-21 13:06:54 +08:00
Jiaxin Wu 17b25f5203 MdeModulePkg/Mtftp4Dxe: Add invalid ServerIp check during MTFTP configuration
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ye Ting <ting.ye@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
2017-04-21 13:06:16 +08:00
Jiaxin Wu ad18ec9543 MdeModulePkg/Ip4Dxe: Fix the incorrect RemoveEntryList
Cc: Subramanian Sriram <sriram-s@hpe.com>
Cc: Ye Ting <ting.ye@intel.com>
Cc: Fu Siyuan <siyuan.fu@intel.com>
Cc: Zhang Lubo <lubo.zhang@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Zhang Lubo <lubo.zhang@intel.com>
Reviewed-by: Sriram Subramanian <sriram-s@hpe.com>
2017-04-21 13:04:24 +08:00
Jeff Fan d3d562b904 MdeModulePkg/FirmwarePerformanceDxe: Error Level is not used correctly
Cc: Feng Tian <feng.tian@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Jeff Fan <jeff.fan@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-21 10:46:49 +08:00
Ruiyu Ni 21e359dcca MdeModulePkg/UefiBootManagerLib: Avoid buggy USB short-form expanding
When a load option points to a physical UsbIo controller, whose
device path contains UsbClass or UsbWwid node, old logic
unconditionally treats it as a short-form device path and expands
it. But the expanding gets the exactly same device path, and the
device path is passed to BmGetNextLoadOptionDevicePath() which
then passes this device path to BmExpandUsbDevicePath() again.
This causes a infinite recursion.

The patch avoids the USB short-form expanding when the device path
points to a physical UsbIo controller.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Reviewed-by: Jeff Fan <jeff.fan@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Michael Turner <Michael.Turner@microsoft.com>
2017-04-20 16:31:05 +08:00
Star Zeng 861c8dff2f MdeModulePkg PiSmmCore: Enhance SMM FreePool to catch buffer overflow
This solution is equivalent to DXE core.

AllocatePool() allocates POOL_TAIL after the buffer.
This POOL_TAIL is checked at FreePool().
If the there is buffer overflow, the issue can be caught at FreePool().

This patch could also handle the eight-byte aligned allocation
requirement. The discussion related to the eight-byte aligned
allocation requirement is at
https://lists.01.org/pipermail/edk2-devel/2017-April/009995.html.

According to the PI spec (Vol 4, Section 3.2 SmmAllocatePool()):
The SmmAllocatePool() function ... All allocations are eight-byte aligned.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Hao Wu <hao.a.wu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2017-04-20 14:10:04 +08:00
Hao Wu 95ad8f7f6a MdeModulePkg/Ufs: Wait fDeviceInit be cleared by devices during init
In the origin codes, the host sets the fDeviceInit flag to initiate device
initialization, but does not check whether the device resets this flag
to indicate the device initialization is completed.

Details can be referred at UFS 2.0 Spec Section 14.2 - Flags.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Mateusz Albecki <mateusz.albecki@intel.com>
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2017-04-20 13:09:51 +08:00
Hao Wu edd94e74c8 MdeModulePkg/UfsPassThruDxe: Replace 'EFI_D_XXX' with 'DEBUG_XXX'
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2017-04-20 13:09:40 +08:00
Ruiyu Ni b9c04b88a1 MdeModulePkg/TerminalDxe: Avoid always append device path to *Dev
When TerminalDxe Start() is called multiple times, the old logic
unconditionally appended the terminal device path candidates to
*Dev (ConInDev/ConOutDev/ErrOutDev), resulting the volatile storage
is full.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-20 10:24:10 +08:00
Dandan Bi f76bc44362 MdeModulePkg/HiiDB: Avoid incorrect results of multiplication
An example:
The codes in function Output8bitPixel in Image.c:
OffsetY = BITMAP_LEN_8_BIT ((UINT32) Image->Width, Ypos);

Both Image->Width and Ypos are of type UINT16. They will be promoted to
int (signed) first, and then perform the multiplication defined by macro
BITMAP_LEN_8_BIT. If the result of multiplication between Image->Width and
Ypos exceeds the range of type int, a potential incorrect results
will be assigned to OffsetY.

This commit adds explicit UINT32 type cast for 'Image->Width' to avoid
possible overflow in the int range. And also fix similar issues in
HiiDatabase.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Hao Wu <hao.a.wu@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
2017-04-18 15:56:22 +08:00
Dandan Bi d508fe87fe MdeModulePkg/BMMUiLib: Update codes of initializing ConsoleXXXCheck array
When initializing ConsoleOutCheck/ConsoleInCheck/ConsoleErrCheck array in
BMM_FAKE_NV_DATA structure, also need to consider whether the terminal
device is ConOut/ConIn/ConErr or not.

Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
2017-04-18 15:56:21 +08:00
Ruiyu Ni 51a1db9b24 MdeModulePkg/BootManagerMenu: Add assertion to indicate no DIV by 0
BootMenuSelectItem() contains code to DIV BootMenuData->ItemCount.
When BootMenuData->ItemCount can be 0, the DIV operation may
trigger CPU exception.
But in logic, this case won't happen. So add assertion to indicate
it.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
2017-04-14 18:28:50 +08:00
Star Zeng 8b17683a27 MdeModulePkg CapsuleApp: Add directory support
Current CapsuleApp only supports input/output file from rootdirectory.
If the CapsuleApp and related file are put into subdirectory,
below message will be shown when running the CapsuleApp in shell.

"CapsuleApp: capsule image (Capsule image file name) is not found."

This patch is to add directory support for CapsuleApp
by using shell protocol.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Feng Tian <feng.tian@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-04-14 13:47:39 +08:00
Hao Wu 1860cb00c1 MdeModulePkg/DxeCore: Add ASSERT to ensure no subtract underflow
For function SplitRecord() in file PropertiesTable.c, there is a
potential subtract underflow case for line:

  return TotalNewRecordCount - 1;

However, such case will not happen since the logic in function
SplitTable() ensure that when calling SplitRecord(), the variable
'TotalNewRecordCount' will not be zero when performing the subtraction.
It will be handled in the previous if statement:

  if (MaxSplitRecordCount == 0) {
    CopyMem (NewRecord, OldRecord, DescriptorSize);
    return 0;
  }

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-04-14 13:13:51 +08:00
Hao Wu 89558f1653 MdeModulePkg/PiSmmCore: Fix potentially uninitialized local variable
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
2017-04-14 13:13:35 +08:00
Liming Gao e061798895 MdeModulePkg DxeCore: Fix issue to print GUID value %g without pointer
https://bugzilla.tianocore.org/show_bug.cgi?id=474

Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
2017-04-14 10:58:31 +08:00
Liming Gao 2c8d2545f5 MdeModulePkg BrotliLib: Fix the regression logic issue in loop
In V2, change logic to avoid use mtf[-1] style to get value.

Roll back to previous logic, and use point + offset to get byte value.

Cc: Bell Song <binx.song@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Bell Song <binx.song@intel.com>
2017-04-14 10:28:59 +08:00
Hao Wu a2617ed627 MdeModulePkg/UsbBotPei: Fix undefined behavior in signed left shift
In function PeiUsbReadCapacity(), the following expression:
LastBlock = (Data.LastLba3 << 24) |
  (Data.LastLba2 << 16) |
  (Data.LastLba1 << 8) |
  Data.LastLba0;

(There is also a similar case in function PeiUsbReadFormattedCapacity().)

will involve undefined behavior in signed left shift operations.

Since Data.LastLbaX is of type UINT8, they will be promoted to int (32
bits, signed) first, and then perform the left shift operation.

According to the C11 spec, Section 6.5.7:
4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
  bits are filled with zeros. If E1 has an unsigned type, the value
  of the result is E1 * 2^E2 , reduced modulo one more than the
  maximum value representable in the result type. If E1 has a signed
  type and nonnegative value, and E1 * 2^E2 is representable in the
  result type, then that is the resulting value; otherwise, the
  behavior is undefined.

So if bit 7 of Data.LastLba3 is 1, (Data.LastLba3 << 24) will be out of
the range within int type. The undefined behavior of the signed left shift
might incur potential issues.

This commit will add an explicit UINT32 type cast for Data.LastLba3 to
refine the codes.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2017-04-13 08:59:07 +08:00
Hao Wu da117dda23 MdeModulePkg/UfsBlkIoPei: Fix undefined behavior in signed left shift
In function UfsBlockIoPeimGetMediaInfo(), the following expression:
Private->Media[DeviceIndex].LastBlock  = (Capacity16.LastLba3 << 24) |
  (Capacity16.LastLba2 << 16) |
  (Capacity16.LastLba1 << 8) |
  Capacity16.LastLba0;

(There is also a similar case in this function.)

will involve undefined behavior in signed left shift operations.

Since Capacity16.LastLbaX is of type UINT8, and
Private->Media[DeviceIndex].LastBlock is of type UINT64. Therefore,
Capacity16.LastLbaX will be promoted to int (32 bits, signed) first, and
then perform the left shift operation.

According to the C11 spec, Section 6.5.7:
4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated
  bits are filled with zeros. If E1 has an unsigned type, the value
  of the result is E1 * 2^E2 , reduced modulo one more than the
  maximum value representable in the result type. If E1 has a signed
  type and nonnegative value, and E1 * 2^E2 is representable in the
  result type, then that is the resulting value; otherwise, the
  behavior is undefined.

So if bit 7 of Capacity16.LastLba3 is 1, (Capacity16.LastLba3 << 24) will
be out of the range within int type. The undefined behavior of the signed
left shift will lead to a potential of setting the high 32 bits of
Private->Media[DeviceIndex].LastBlock to 1 during the cast from type int
to type UINT64.

This commit will add an explicit UINT32 type cast for Capacity16.LastLba3
to resolve this issue.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
2017-04-13 08:58:56 +08:00