]> git.proxmox.com Git - mirror_edk2.git/blobdiff - MdeModulePkg/Core/PiSmmCore/Dispatcher.c
MdeModulePkg: Fix use-after-free error in InstallConfigurationTable()
[mirror_edk2.git] / MdeModulePkg / Core / PiSmmCore / Dispatcher.c
index b2e3d6a1e7415b93ffc8f2c13f11ce18328671d1..f32bbbd1b4b3da6abaadb2c504ef963039ce330e 100644 (file)
@@ -27,7 +27,8 @@
 \r
   Depex - Dependency Expresion.\r
 \r
-  Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2014, Hewlett-Packard Development Company, L.P.\r
+  Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>\r
   This program and the accompanying materials are licensed and made available \r
   under the terms and conditions of the BSD License which accompanies this \r
   distribution.  The full text of the license may be found at        \r
@@ -102,7 +103,8 @@ BOOLEAN  gRequestDispatch = FALSE;
 //\r
 EFI_FV_FILETYPE mSmmFileTypes[] = {\r
   EFI_FV_FILETYPE_SMM,\r
-  EFI_FV_FILETYPE_COMBINED_SMM_DXE\r
+  EFI_FV_FILETYPE_COMBINED_SMM_DXE,\r
+  EFI_FV_FILETYPE_SMM_CORE,\r
   //\r
   // Note: DXE core will process the FV image file, so skip it in SMM core\r
   // EFI_FV_FILETYPE_FIRMWARE_VOLUME_IMAGE\r
@@ -124,17 +126,17 @@ EFI_SECURITY2_ARCH_PROTOCOL *mSecurity2 = NULL;
 \r
 //\r
 // The global variable is defined for Loading modules at fixed address feature to track the SMM code\r
-// memory range usage. It is a bit mapped array in which every bit indicates the correspoding \r
+// memory range usage. It is a bit mapped array in which every bit indicates the corresponding\r
 // memory page available or not. \r
 //\r
 GLOBAL_REMOVE_IF_UNREFERENCED    UINT64                *mSmmCodeMemoryRangeUsageBitMap=NULL;\r
 \r
 /**\r
-  To check memory usage bit map array to figure out if the memory range in which the image will be loaded is available or not. If \r
-  memory range is avaliable, the function will mark the correponding bits to 1 which indicates the memory range is used.\r
+  To check memory usage bit map array to figure out if the memory range in which the image will be loaded is available or not. If\r
+  memory range is available, the function will mark the corresponding bits to 1 which indicates the memory range is used.\r
   The function is only invoked when load modules at fixed address feature is enabled. \r
   \r
-  @param  ImageBase                The base addres the image will be loaded at.\r
+  @param  ImageBase                The base address the image will be loaded at.\r
   @param  ImageSize                The size of the image\r
   \r
   @retval EFI_SUCCESS              The memory range the image will be loaded in is available\r
@@ -181,8 +183,8 @@ CheckAndMarkFixLoadingMemoryUsageBitMap (
    //\r
    // Test if the memory is avalaible or not.\r
    // \r
-   BaseOffsetPageNumber = (UINTN)EFI_SIZE_TO_PAGES((UINT32)(ImageBase - SmmCodeBase));\r
-   TopOffsetPageNumber  = (UINTN)EFI_SIZE_TO_PAGES((UINT32)(ImageBase + ImageSize - SmmCodeBase));\r
+   BaseOffsetPageNumber = EFI_SIZE_TO_PAGES((UINT32)(ImageBase - SmmCodeBase));\r
+   TopOffsetPageNumber  = EFI_SIZE_TO_PAGES((UINT32)(ImageBase + ImageSize - SmmCodeBase));\r
    for (Index = BaseOffsetPageNumber; Index < TopOffsetPageNumber; Index ++) {\r
      if ((mSmmCodeMemoryRangeUsageBitMap[Index / 64] & LShiftU64(1, (Index % 64))) != 0) {\r
        //\r
@@ -201,13 +203,13 @@ CheckAndMarkFixLoadingMemoryUsageBitMap (
    return  EFI_SUCCESS;   \r
 }\r
 /**\r
-  Get the fixed loadding address from image header assigned by build tool. This function only be called \r
+  Get the fixed loading address from image header assigned by build tool. This function only be called\r
   when Loading module at Fixed address feature enabled.\r
   \r
   @param  ImageContext              Pointer to the image context structure that describes the PE/COFF\r
                                     image that needs to be examined by this function.\r
   @retval EFI_SUCCESS               An fixed loading address is assigned to this image by build tools .\r
-  @retval EFI_NOT_FOUND             The image has no assigned fixed loadding address.\r
+  @retval EFI_NOT_FOUND             The image has no assigned fixed loading address.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -215,82 +217,80 @@ GetPeCoffImageFixLoadingAssignedAddress(
   IN OUT PE_COFF_LOADER_IMAGE_CONTEXT  *ImageContext\r
   )\r
 {\r
-        UINTN                              SectionHeaderOffset;\r
-        EFI_STATUS                         Status;\r
-        EFI_IMAGE_SECTION_HEADER           SectionHeader;\r
-        EFI_IMAGE_OPTIONAL_HEADER_UNION    *ImgHdr;\r
-        EFI_PHYSICAL_ADDRESS               FixLoaddingAddress;\r
-        UINT16                             Index;\r
-        UINTN                              Size; \r
-        UINT16                             NumberOfSections;\r
-        UINT64                             ValueInSectionHeader;\r
-        \r
-        FixLoaddingAddress = 0;\r
-        Status = EFI_NOT_FOUND;\r
-       \r
-        //\r
-   // Get PeHeader pointer\r
-   //\r
-   ImgHdr = (EFI_IMAGE_OPTIONAL_HEADER_UNION *)((CHAR8* )ImageContext->Handle + ImageContext->PeCoffHeaderOffset);\r
-        SectionHeaderOffset = (UINTN)(\r
-                                 ImageContext->PeCoffHeaderOffset +\r
-                                 sizeof (UINT32) +\r
-                                 sizeof (EFI_IMAGE_FILE_HEADER) +\r
-                                 ImgHdr->Pe32.FileHeader.SizeOfOptionalHeader\r
-                                 );\r
-   NumberOfSections = ImgHdr->Pe32.FileHeader.NumberOfSections;\r
-     \r
-   //\r
-   // Get base address from the first section header that doesn't point to code section.\r
-   //\r
-   for (Index = 0; Index < NumberOfSections; Index++) {\r
-     //\r
-     // Read section header from file\r
-     //\r
-     Size = sizeof (EFI_IMAGE_SECTION_HEADER);\r
-     Status = ImageContext->ImageRead (\r
+  UINTN                              SectionHeaderOffset;\r
+  EFI_STATUS                         Status;\r
+  EFI_IMAGE_SECTION_HEADER           SectionHeader;\r
+  EFI_IMAGE_OPTIONAL_HEADER_UNION    *ImgHdr;\r
+  EFI_PHYSICAL_ADDRESS               FixLoadingAddress;\r
+  UINT16                             Index;\r
+  UINTN                              Size;\r
+  UINT16                             NumberOfSections;\r
+  UINT64                             ValueInSectionHeader;\r
+\r
+  FixLoadingAddress = 0;\r
+  Status = EFI_NOT_FOUND;\r
+\r
+  //\r
+  // Get PeHeader pointer\r
+  //\r
+  ImgHdr = (EFI_IMAGE_OPTIONAL_HEADER_UNION *)((CHAR8* )ImageContext->Handle + ImageContext->PeCoffHeaderOffset);\r
+  SectionHeaderOffset = ImageContext->PeCoffHeaderOffset +\r
+                        sizeof (UINT32) +\r
+                        sizeof (EFI_IMAGE_FILE_HEADER) +\r
+                        ImgHdr->Pe32.FileHeader.SizeOfOptionalHeader;\r
+  NumberOfSections = ImgHdr->Pe32.FileHeader.NumberOfSections;\r
+\r
+  //\r
+  // Get base address from the first section header that doesn't point to code section.\r
+  //\r
+  for (Index = 0; Index < NumberOfSections; Index++) {\r
+    //\r
+    // Read section header from file\r
+    //\r
+    Size = sizeof (EFI_IMAGE_SECTION_HEADER);\r
+    Status = ImageContext->ImageRead (\r
                               ImageContext->Handle,\r
                               SectionHeaderOffset,\r
                               &Size,\r
                               &SectionHeader\r
                               );\r
-     if (EFI_ERROR (Status)) {\r
-       return Status;\r
-     }\r
-     \r
-     Status = EFI_NOT_FOUND;\r
-     \r
-     if ((SectionHeader.Characteristics & EFI_IMAGE_SCN_CNT_CODE) == 0) {\r
-       //\r
-       // Build tool will save the address in PointerToRelocations & PointerToLineNumbers fields in the first section header \r
-       // that doesn't point to code section in image header.So there is an assumption that when the feature is enabled,\r
-       // if a module with a loading address assigned by tools, the PointerToRelocations & PointerToLineNumbers fields\r
-       // should not be Zero, or else, these 2 fileds should be set to Zero\r
-       //\r
-       ValueInSectionHeader = ReadUnaligned64((UINT64*)&SectionHeader.PointerToRelocations);\r
-       if (ValueInSectionHeader != 0) {\r
-         //\r
-         // Found first section header that doesn't point to code section in which uild tool saves the\r
-         // offset to SMRAM base as image base in PointerToRelocations & PointerToLineNumbers fields\r
-         //      \r
-         FixLoaddingAddress = (EFI_PHYSICAL_ADDRESS)(gLoadModuleAtFixAddressSmramBase + (INT64)ValueInSectionHeader);\r
-         //\r
-         // Check if the memory range is avaliable.\r
-         //\r
-         Status = CheckAndMarkFixLoadingMemoryUsageBitMap (FixLoaddingAddress, (UINTN)(ImageContext->ImageSize + ImageContext->SectionAlignment));\r
-         if (!EFI_ERROR(Status)) {\r
-           //\r
-           // The assigned address is valid. Return the specified loadding address\r
-           //\r
-           ImageContext->ImageAddress = FixLoaddingAddress;\r
-         }\r
-       }\r
-       break;     \r
-     }\r
-     SectionHeaderOffset += sizeof (EFI_IMAGE_SECTION_HEADER);     \r
-   }\r
-   DEBUG ((EFI_D_INFO|EFI_D_LOAD, "LOADING MODULE FIXED INFO: Loading module at fixed address %x, Status = %r\n", FixLoaddingAddress, Status));\r
-   return Status;\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
+\r
+    Status = EFI_NOT_FOUND;\r
+\r
+    if ((SectionHeader.Characteristics & EFI_IMAGE_SCN_CNT_CODE) == 0) {\r
+      //\r
+      // Build tool will save the address in PointerToRelocations & PointerToLineNumbers fields in the first section header\r
+      // that doesn't point to code section in image header.So there is an assumption that when the feature is enabled,\r
+      // if a module with a loading address assigned by tools, the PointerToRelocations & PointerToLineNumbers fields\r
+      // should not be Zero, or else, these 2 fields should be set to Zero\r
+      //\r
+      ValueInSectionHeader = ReadUnaligned64((UINT64*)&SectionHeader.PointerToRelocations);\r
+      if (ValueInSectionHeader != 0) {\r
+        //\r
+        // Found first section header that doesn't point to code section in which build tool saves the\r
+        // offset to SMRAM base as image base in PointerToRelocations & PointerToLineNumbers fields\r
+        //\r
+        FixLoadingAddress = (EFI_PHYSICAL_ADDRESS)(gLoadModuleAtFixAddressSmramBase + (INT64)ValueInSectionHeader);\r
+        //\r
+        // Check if the memory range is available.\r
+        //\r
+        Status = CheckAndMarkFixLoadingMemoryUsageBitMap (FixLoadingAddress, (UINTN)(ImageContext->ImageSize + ImageContext->SectionAlignment));\r
+        if (!EFI_ERROR(Status)) {\r
+          //\r
+          // The assigned address is valid. Return the specified loading address\r
+          //\r
+          ImageContext->ImageAddress = FixLoadingAddress;\r
+        }\r
+      }\r
+      break;\r
+    }\r
+    SectionHeaderOffset += sizeof (EFI_IMAGE_SECTION_HEADER);\r
+  }\r
+  DEBUG ((EFI_D_INFO|EFI_D_LOAD, "LOADING MODULE FIXED INFO: Loading module at fixed address %x, Status = %r\n", FixLoadingAddress, Status));\r
+  return Status;\r
 }\r
 /**\r
   Loads an EFI image into SMRAM.\r
@@ -515,10 +515,10 @@ SmmLoadImage (
      ImageContext.ImageAddress = (EFI_PHYSICAL_ADDRESS)DstBuffer;\r
   }\r
   //\r
-  // Align buffer on section boundry\r
+  // Align buffer on section boundary\r
   //\r
   ImageContext.ImageAddress += ImageContext.SectionAlignment - 1;\r
-  ImageContext.ImageAddress &= ~(ImageContext.SectionAlignment - 1);\r
+  ImageContext.ImageAddress &= ~((EFI_PHYSICAL_ADDRESS)ImageContext.SectionAlignment - 1);\r
 \r
   //\r
   // Load the image to our new buffer\r
@@ -568,6 +568,7 @@ SmmLoadImage (
     return Status;\r
   }\r
 \r
+  ZeroMem (DriverEntry->LoadedImage, sizeof (EFI_LOADED_IMAGE_PROTOCOL));\r
   //\r
   // Fill in the remaining fields of the Loaded Image Protocol instance.\r
   // Note: ImageBase is an SMRAM address that can not be accessed outside of SMRAM if SMRAM window is closed.\r
@@ -577,6 +578,11 @@ SmmLoadImage (
   DriverEntry->LoadedImage->SystemTable   = gST;\r
   DriverEntry->LoadedImage->DeviceHandle  = DeviceHandle;\r
 \r
+  DriverEntry->SmmLoadedImage.Revision     = EFI_LOADED_IMAGE_PROTOCOL_REVISION;\r
+  DriverEntry->SmmLoadedImage.ParentHandle = gSmmCorePrivate->SmmIplImageHandle;\r
+  DriverEntry->SmmLoadedImage.SystemTable  = gST;\r
+  DriverEntry->SmmLoadedImage.DeviceHandle = DeviceHandle;\r
+\r
   //\r
   // Make an EfiBootServicesData buffer copy of FilePath\r
   //\r
@@ -590,11 +596,30 @@ SmmLoadImage (
   }\r
   CopyMem (DriverEntry->LoadedImage->FilePath, FilePath, GetDevicePathSize (FilePath));\r
 \r
-  DriverEntry->LoadedImage->ImageBase     = (VOID *)(UINTN)DriverEntry->ImageBuffer;\r
+  DriverEntry->LoadedImage->ImageBase     = (VOID *)(UINTN) ImageContext.ImageAddress;\r
   DriverEntry->LoadedImage->ImageSize     = ImageContext.ImageSize;\r
   DriverEntry->LoadedImage->ImageCodeType = EfiRuntimeServicesCode;\r
   DriverEntry->LoadedImage->ImageDataType = EfiRuntimeServicesData;\r
 \r
+  //\r
+  // Make a buffer copy of FilePath\r
+  //\r
+  Status = SmmAllocatePool (EfiRuntimeServicesData, GetDevicePathSize(FilePath), (VOID **)&DriverEntry->SmmLoadedImage.FilePath);\r
+  if (EFI_ERROR (Status)) {\r
+    if (Buffer != NULL) {\r
+      gBS->FreePool (Buffer);\r
+    }\r
+    gBS->FreePool (DriverEntry->LoadedImage->FilePath);\r
+    SmmFreePages (DstBuffer, PageCount);\r
+    return Status;\r
+  }\r
+  CopyMem (DriverEntry->SmmLoadedImage.FilePath, FilePath, GetDevicePathSize(FilePath));\r
+\r
+  DriverEntry->SmmLoadedImage.ImageBase = (VOID *)(UINTN) ImageContext.ImageAddress;\r
+  DriverEntry->SmmLoadedImage.ImageSize = ImageContext.ImageSize;\r
+  DriverEntry->SmmLoadedImage.ImageCodeType = EfiRuntimeServicesCode;\r
+  DriverEntry->SmmLoadedImage.ImageDataType = EfiRuntimeServicesData;\r
+\r
   //\r
   // Create a new image handle in the UEFI handle database for the SMM Driver\r
   //\r
@@ -605,6 +630,17 @@ SmmLoadImage (
                   NULL\r
                   );\r
 \r
+  //\r
+  // Create a new image handle in the SMM handle database for the SMM Driver\r
+  //\r
+  DriverEntry->SmmImageHandle = NULL;\r
+  Status = SmmInstallProtocolInterface (\r
+             &DriverEntry->SmmImageHandle,\r
+             &gEfiLoadedImageProtocolGuid,\r
+             EFI_NATIVE_INTERFACE,\r
+             &DriverEntry->SmmLoadedImage\r
+             );\r
+\r
   PERF_START (DriverEntry->ImageHandle, "LoadImage:", NULL, Tick);\r
   PERF_END (DriverEntry->ImageHandle, "LoadImage:", NULL, 0);\r
 \r
@@ -872,11 +908,37 @@ SmmDispatcher (
       //\r
       // For each SMM driver, pass NULL as ImageHandle\r
       //\r
+      RegisterSmramProfileImage (DriverEntry, TRUE);\r
       PERF_START (DriverEntry->ImageHandle, "StartImage:", NULL, 0);\r
       Status = ((EFI_IMAGE_ENTRY_POINT)(UINTN)DriverEntry->ImageEntryPoint)(DriverEntry->ImageHandle, gST);\r
       PERF_END (DriverEntry->ImageHandle, "StartImage:", NULL, 0);\r
       if (EFI_ERROR(Status)){\r
+        UnregisterSmramProfileImage (DriverEntry, TRUE);\r
         SmmFreePages(DriverEntry->ImageBuffer, DriverEntry->NumberOfPage);\r
+        //\r
+        // Uninstall LoadedImage\r
+        //\r
+        Status = gBS->UninstallProtocolInterface (\r
+                        DriverEntry->ImageHandle,\r
+                        &gEfiLoadedImageProtocolGuid,\r
+                        DriverEntry->LoadedImage\r
+                        );\r
+        if (!EFI_ERROR (Status)) {\r
+          if (DriverEntry->LoadedImage->FilePath != NULL) {\r
+            gBS->FreePool (DriverEntry->LoadedImage->FilePath);\r
+          }\r
+          gBS->FreePool (DriverEntry->LoadedImage);\r
+        }\r
+        Status = SmmUninstallProtocolInterface (\r
+                   DriverEntry->SmmImageHandle,\r
+                   &gEfiLoadedImageProtocolGuid,\r
+                   &DriverEntry->SmmLoadedImage\r
+                   );\r
+        if (!EFI_ERROR(Status)) {\r
+          if (DriverEntry->SmmLoadedImage.FilePath != NULL) {\r
+            SmmFreePool (DriverEntry->SmmLoadedImage.FilePath);\r
+          }\r
+        }\r
       }\r
 \r
       REPORT_STATUS_CODE_WITH_EXTENDED_DATA (\r
@@ -1211,7 +1273,9 @@ SmmDriverDispatchHandler (
   EFI_SMM_DRIVER_ENTRY          *DriverEntry;\r
   EFI_GUID                      *AprioriFile;\r
   UINTN                         AprioriEntryCount;\r
-  UINTN                         Index;\r
+  UINTN                         HandleIndex;\r
+  UINTN                         SmmTypeIndex;\r
+  UINTN                         AprioriIndex;\r
   LIST_ENTRY                    *Link;\r
   UINT32                        AuthenticationStatus;\r
   UINTN                         SizeOfBuffer;\r
@@ -1228,8 +1292,8 @@ SmmDriverDispatchHandler (
     return EFI_NOT_FOUND;\r
   }\r
 \r
-  for (Index = 0; Index < HandleCount; Index++) {\r
-    FvHandle = HandleBuffer[Index];\r
+  for (HandleIndex = 0; HandleIndex < HandleCount; HandleIndex++) {\r
+    FvHandle = HandleBuffer[HandleIndex];\r
 \r
     if (FvHasBeenProcessed (FvHandle)) {\r
       //\r
@@ -1263,14 +1327,15 @@ SmmDriverDispatchHandler (
     //\r
     // Discover Drivers in FV and add them to the Discovered Driver List.\r
     // Process EFI_FV_FILETYPE_SMM type and then EFI_FV_FILETYPE_COMBINED_SMM_DXE\r
+    //  EFI_FV_FILETYPE_SMM_CORE is processed to produce a Loaded Image protocol for the core\r
     //\r
-    for (Index = 0; Index < sizeof (mSmmFileTypes)/sizeof (EFI_FV_FILETYPE); Index++) {\r
+    for (SmmTypeIndex = 0; SmmTypeIndex < sizeof (mSmmFileTypes)/sizeof (EFI_FV_FILETYPE); SmmTypeIndex++) {\r
       //\r
       // Initialize the search key\r
       //\r
       Key = 0;\r
       do {\r
-        Type = mSmmFileTypes[Index];\r
+        Type = mSmmFileTypes[SmmTypeIndex];\r
         GetNextFileStatus = Fv->GetNextFile (\r
                                   Fv,\r
                                   &Key,\r
@@ -1280,7 +1345,55 @@ SmmDriverDispatchHandler (
                                   &Size\r
                                   );\r
         if (!EFI_ERROR (GetNextFileStatus)) {\r
-          SmmAddToDriverList (Fv, FvHandle, &NameGuid);\r
+          if (Type == EFI_FV_FILETYPE_SMM_CORE) {\r
+            //\r
+            // If this is the SMM core fill in it's DevicePath & DeviceHandle\r
+            //\r
+            if (mSmmCoreLoadedImage->FilePath == NULL) {\r
+              //\r
+              // Maybe one special FV contains only one SMM_CORE module, so its device path must\r
+              // be initialized completely.\r
+              //\r
+              EfiInitializeFwVolDevicepathNode (&mFvDevicePath.File, &NameGuid);\r
+              SetDevicePathEndNode (&mFvDevicePath.End);\r
+\r
+              //\r
+              // Make an EfiBootServicesData buffer copy of FilePath\r
+              //\r
+              Status = gBS->AllocatePool (\r
+                              EfiBootServicesData,\r
+                              GetDevicePathSize ((EFI_DEVICE_PATH_PROTOCOL *)&mFvDevicePath),\r
+                              (VOID **)&mSmmCoreLoadedImage->FilePath\r
+                              );\r
+              ASSERT_EFI_ERROR (Status);\r
+              CopyMem (mSmmCoreLoadedImage->FilePath, &mFvDevicePath, GetDevicePathSize ((EFI_DEVICE_PATH_PROTOCOL *)&mFvDevicePath));\r
+\r
+              mSmmCoreLoadedImage->DeviceHandle = FvHandle;\r
+            }\r
+            if (mSmmCoreDriverEntry->SmmLoadedImage.FilePath == NULL) {\r
+              //\r
+              // Maybe one special FV contains only one SMM_CORE module, so its device path must\r
+              // be initialized completely.\r
+              //\r
+              EfiInitializeFwVolDevicepathNode (&mFvDevicePath.File, &NameGuid);\r
+              SetDevicePathEndNode (&mFvDevicePath.End);\r
+\r
+              //\r
+              // Make a buffer copy FilePath\r
+              //\r
+              Status = SmmAllocatePool (\r
+                         EfiRuntimeServicesData,\r
+                         GetDevicePathSize ((EFI_DEVICE_PATH_PROTOCOL *)&mFvDevicePath),\r
+                         (VOID **)&mSmmCoreDriverEntry->SmmLoadedImage.FilePath\r
+                         );\r
+              ASSERT_EFI_ERROR (Status);\r
+              CopyMem (mSmmCoreDriverEntry->SmmLoadedImage.FilePath, &mFvDevicePath, GetDevicePathSize((EFI_DEVICE_PATH_PROTOCOL *)&mFvDevicePath));\r
+\r
+              mSmmCoreDriverEntry->SmmLoadedImage.DeviceHandle = FvHandle;\r
+            }\r
+          } else {\r
+            SmmAddToDriverList (Fv, FvHandle, &NameGuid);\r
+          }\r
         }\r
       } while (!EFI_ERROR (GetNextFileStatus));\r
     }\r
@@ -1311,10 +1424,10 @@ SmmDriverDispatchHandler (
     // is only valid for the FV that it resided in.\r
     //\r
 \r
-    for (Index = 0; Index < AprioriEntryCount; Index++) {\r
+    for (AprioriIndex = 0; AprioriIndex < AprioriEntryCount; AprioriIndex++) {\r
       for (Link = mDiscoveredList.ForwardLink; Link != &mDiscoveredList; Link = Link->ForwardLink) {\r
         DriverEntry = CR(Link, EFI_SMM_DRIVER_ENTRY, Link, EFI_SMM_DRIVER_ENTRY_SIGNATURE);\r
-        if (CompareGuid (&DriverEntry->FileName, &AprioriFile[Index]) &&\r
+        if (CompareGuid (&DriverEntry->FileName, &AprioriFile[AprioriIndex]) &&\r
             (FvHandle == DriverEntry->FvHandle)) {\r
           DriverEntry->Dependent = FALSE;\r
           DriverEntry->Scheduled = TRUE;\r