audk/MdeModulePkg
Alex Williamson b0bc24aff5 The following call tree exposes a bug in the lifetime (ie. too late
creation) of PciIoDevice->DevicePath. The bug can be triggered when
PciBusDxe is built into OVMF, with qemu/KVM device assignment of
a PCI-express device on the default 440FX machine type.  OVMF
correctly discovers that the device is PCIe and begins probing
extended configuration space for the device.  The root bridge
has no way to access extended config space and correctly errors,
sending us into the error reporting chain seen below.  It's
possible that this error path could also be reproduced on physical
hardware when a PCI-to-PCIe bridge is present.

GatherDeviceInfo() | GatherPpbInfo() | GatherP2CInfo() [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
  CreatePciIoDevice()                                  [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
    AllocateZeroPool()
    LocateCapabilityRegBlock()                         [MdeModulePkg/Bus/Pci/PciBusDxe/PciCommand.c]
    PciIoDevice->IsPciExp = TRUE
    LocatePciExpressCapabilityRegBlock()               [MdeModulePkg/Bus/Pci/PciBusDxe/PciCommand.c]
      PciIoConfigRead() via funcptr                    [MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c]
        RootBridgeIoPciRead() via funcptr              [PcAtChipsetPkg/PciHostBridgeDxe/PciRootBridgeIo.c]
          FAILS
        REPORT_STATUS_CODE_WITH_DEVICE_PATH()          [MdePkg/Include/Library/ReportStatusCodeLib.h]
          ReportStatusCodeWithDevicePath()             [MdeModulePkg/Library/DxeReportStatusCodeLib/ReportStatusCodeLib.c]
            ASSERT (DevicePath != NULL) <--+
  CreatePciDevicePath()                    |           [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
    sets PciIoDevice->DevicePath ----------+

In English:
- CreatePciIoDevice() allocates a zeroed out PCI_IO_DEVICE structure.
- PciIoConfigRead() tries to access the (extended) config space, and
  fails.
- PciIoConfigRead() wants to report a status code (read error) for the
  device path.
- Unfortuantely, PciIoDevice->DevicePath is still NULL at that point.
- The ASSERT() in ReportStatusCodeWithDevicePath() fires.

Fix it by moving CreatePciDevicePath() into CreatePciIoDevice(),
allowing PciIoDevice->DevicePath to be initialized before we
begin probing the device capabilities:

GatherDeviceInfo() | GatherPpbInfo() | GatherP2CInfo() [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
  CreatePciIoDevice()                                  [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
    AllocateZeroPool()
    CreatePciDevicePath()                              [MdeModulePkg/Bus/Pci/PciBusDxe/PciEnumeratorSupport.c]
      sets PciIoDevice->DevicePath -----------+
    LocateCapabilityRegBlock()                |        [MdeModulePkg/Bus/Pci/PciBusDxe/PciCommand.c]
    PciIoDevice->IsPciExp = TRUE              |
    LocatePciExpressCapabilityRegBlock()      |        [MdeModulePkg/Bus/Pci/PciBusDxe/PciCommand.c]
      PciIoConfigRead() via funcptr           |        [MdeModulePkg/Bus/Pci/PciBusDxe/PciIo.c]
        RootBridgeIoPciRead() via funcptr     |        [PcAtChipsetPkg/PciHostBridgeDxe/PciRootBridgeIo.c]
          FAILS                               |
        REPORT_STATUS_CODE_WITH_DEVICE_PATH() |        [MdePkg/Include/Library/ReportStatusCodeLib.h]
          ReportStatusCodeWithDevicePath()    |        [MdeModulePkg/Library/DxeReportStatusCodeLib/ReportStatusCodeLib.c]
            ASSERT (DevicePath != NULL) <-----+

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15567 6f19259b-4bc3-4df7-8a09-765794883524
2014-06-19 01:41:15 +00:00
..
Application Update code to pass packaging tool. 2011-05-30 09:56:57 +00:00
Bus The following call tree exposes a bug in the lifetime (ie. too late 2014-06-19 01:41:15 +00:00
Core Fix comment typos. 2014-05-13 09:14:00 +00:00
Include Based on request, export ResetRequired info used by browser. 2014-05-14 01:52:31 +00:00
Library Add comment for S3BootScriptSaveMemPoll API, since it does not match PI specification. 2014-03-01 12:25:31 +00:00
Logo Update the copyright notice format 2010-04-24 09:49:11 +00:00
Universal Add 'file not found' debug message to MTFTP. 2014-05-21 05:59:47 +00:00
Contributions.txt EDK II Packages: Add Contributions.txt and License.txt files 2012-04-11 23:19:46 +00:00
License.txt Update copyright format 2012-04-24 06:49:39 +00:00
MdeModulePkg.dec Report the setting variable failure to platform through the status code when core cannot handle the error. 2014-03-25 02:38:54 +00:00
MdeModulePkg.dsc Updates MdeModulePkg package version from 0.92 to 0.93 2014-01-10 01:43:02 +00:00