EmulatorPkg: IoThunk->Close() is called too early, may causing hang

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

To produce a EFI_BLOCK_IO_PROTOCOL instance in Emulator platform,
EmulatorPkg defines the EMU_IO_THUNK_PROTOCOL. OS dependent layer
needs to produce this protocol implementation and a generic OS
independent layer consumes this protocol to produce
EFI_BLOCK_IO_PROTOCOL.

EMU_IO_THUNK_PROTOCOL can also be used to abstract the OS dependent
IO operation for other UEFI protocols, e.g.: GOP, SimpleFileSystem
and etc.

It contains two interfaces Open() and Close(). Open() creates the
specific IO instances, e.g. for Block IO access, File System access,
Screen access, etc. Close() destroys the specific IO instances.

Later on the Emulator generic module (e.g.: EmuBlockIoDxe) calls
Open() to create the IO instance in DriverBindingStart() and calls
Close() in DriverBindingStop().
But today's implementation of DriverBindingStop() contains a bug
that it calls Close() before uninstalling the EFI_BLOCK_IO_PROTOCOL.

It's a mistake in code. Take EFI_BLOCK_IO for example,
the uninstallation may cause the upper layer driver that consumes
EFI_BLOCK_IO call BlockIo.Reset(), which consequently calls
EmuBlockIo.Reset(). But the EmuBlockIo instance is already destroyed
by Close() that happens before uninstallation.

So a proper implementation is to call Close() after uninstallation
succeeds.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Andrew Fish <afish@apple.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>

diff --git a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
index b9ac6ce080eda78d22829e205240349e28d44590..47b50a8e058e8a556f70c3b9dac5fbfb9eb547d1 100644 (file)
--- a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
+++ b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
@@ -1,6 +1,6 @@
 /**@file\r
 \r
-Copyright (c) 2004 - 2009, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -662,7 +662,6 @@ EmuBlockIoDriverBindingStop (
   }\r
 \r
   Private = EMU_BLOCK_IO_PRIVATE_DATA_FROM_THIS (BlockIo);\r
-  Status = Private->IoThunk->Close (Private->IoThunk);\r
 \r
   Status = gBS->UninstallMultipleProtocolInterfaces (\r
                   Private->EfiHandle,\r
@@ -677,14 +676,17 @@ EmuBlockIoDriverBindingStop (
                     This->DriverBindingHandle,\r
                     Handle\r
                     );\r
-  }\r
-\r
-  if (!EFI_ERROR (Status)) {\r
+    ASSERT_EFI_ERROR (Status);\r
+    //\r
+    // Destroy the IO interface.\r
+    //\r
+    Status = Private->IoThunk->Close (Private->IoThunk);\r
+    ASSERT_EFI_ERROR (Status);\r
     //\r
     // Free our instance data\r
     //\r
     FreeUnicodeStringTable (Private->ControllerNameTable);\r
-    gBS->FreePool (Private);\r
+    FreePool (Private);\r
   }\r
 \r
   return Status;\r

diff --git a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
index b5e19bb840a38d9eff1c7fa0cecf7d1b2fe105e3..28abfd6beff74de78b7807a86a200efb0a0a846c 100644 (file)
--- a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
+++ b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
@@ -866,7 +866,6 @@ EmuSimpleFileSystemDriverBindingStop (
   }\r
 \r
   Private = EMU_SIMPLE_FILE_SYSTEM_PRIVATE_DATA_FROM_THIS (SimpleFileSystem);\r
-  Status = Private->IoThunk->Close (Private->IoThunk);\r
 \r
   //\r
   // Uninstall the Simple File System Protocol from ControllerHandle\r
@@ -883,9 +882,12 @@ EmuSimpleFileSystemDriverBindingStop (
                     This->DriverBindingHandle,\r
                     ControllerHandle\r
                     );\r
-  }\r
-\r
-  if (!EFI_ERROR (Status)) {\r
+    ASSERT_EFI_ERROR (Status);\r
+    //\r
+    // Destroy the IO interface.\r
+    //\r
+    Status = Private->IoThunk->Close (Private->IoThunk);\r
+    ASSERT_EFI_ERROR (Status);\r
     //\r
     // Free our instance data\r
     //\r

diff --git a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
index 0031baea52ecb9eabfee2ee23e039f308e6cedfa..967da9900aed357c46d17f7b28c1156c0f7b4afc 100644 (file)
--- a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
+++ b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
@@ -870,6 +870,7 @@ EmuSnpDriverBindingStop (
   EFI_STATUS                  Status;\r
   EMU_SNP_PRIVATE_DATA        *Private = NULL;\r
   EFI_SIMPLE_NETWORK_PROTOCOL *Snp;\r
+  VOID                        *EmuIoThunk;\r
 \r
   //\r
   // Complete all outstanding transactions to Controller.\r
@@ -914,27 +915,42 @@ EmuSnpDriverBindingStop (
   }\r
 \r
   Private = EMU_SNP_PRIVATE_DATA_FROM_SNP_THIS (Snp);\r
-  Status = Private->IoThunk->Close (Private->IoThunk);\r
+  ASSERT (Private->DeviceHandle == ChildHandleBuffer[0]);\r
+  ASSERT (Private->EfiHandle    == ControllerHandle);\r
 \r
   Status = gBS->CloseProtocol(\r
-                  ChildHandleBuffer[0],\r
+                  ControllerHandle,\r
                   &gEmuIoThunkProtocolGuid,\r
                   This->DriverBindingHandle,\r
                   Private->DeviceHandle\r
                   );\r
+  ASSERT_EFI_ERROR (Status);\r
 \r
   Status = gBS->UninstallMultipleProtocolInterfaces(\r
-                  ChildHandleBuffer[0],\r
+                  Private->DeviceHandle,\r
                   &gEfiSimpleNetworkProtocolGuid,   &Private->Snp,\r
                   &gEfiDevicePathProtocolGuid,      Private->DevicePath,\r
                   NULL\r
                   );\r
+  if (EFI_ERROR (Status)) {\r
+    gBS->OpenProtocol (\r
+           ControllerHandle,\r
+           &gEmuIoThunkProtocolGuid,\r
+           &EmuIoThunk,\r
+           This->DriverBindingHandle,\r
+           Private->DeviceHandle,\r
+           EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER\r
+           );\r
+  } else {\r
+    Status = Private->IoThunk->Close (Private->IoThunk);\r
+    ASSERT_EFI_ERROR (Status);\r
+\r
+    FreePool (Private->DevicePath);\r
+    FreeUnicodeStringTable (Private->ControllerNameTable);\r
+    FreePool (Private);\r
+  }\r
 \r
-  FreePool (Private->DevicePath);\r
-  FreeUnicodeStringTable (Private->ControllerNameTable);\r
-  FreePool (Private);\r
-\r
-  return EFI_SUCCESS;\r
+  return Status;\r
 }\r
 \r
 \r