EmulatorPkg: IoThunk->Close() is called too early, may causing hang

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

To produce a EFI_BLOCK_IO_PROTOCOL instance in Emulator platform,
EmulatorPkg defines the EMU_IO_THUNK_PROTOCOL. OS dependent layer
needs to produce this protocol implementation and a generic OS
independent layer consumes this protocol to produce
EFI_BLOCK_IO_PROTOCOL.

EMU_IO_THUNK_PROTOCOL can also be used to abstract the OS dependent
IO operation for other UEFI protocols, e.g.: GOP, SimpleFileSystem
and etc.

It contains two interfaces Open() and Close(). Open() creates the
specific IO instances, e.g. for Block IO access, File System access,
Screen access, etc. Close() destroys the specific IO instances.

Later on the Emulator generic module (e.g.: EmuBlockIoDxe) calls
Open() to create the IO instance in DriverBindingStart() and calls
Close() in DriverBindingStop().
But today's implementation of DriverBindingStop() contains a bug
that it calls Close() before uninstalling the EFI_BLOCK_IO_PROTOCOL.

It's a mistake in code. Take EFI_BLOCK_IO for example,
the uninstallation may cause the upper layer driver that consumes
EFI_BLOCK_IO call BlockIo.Reset(), which consequently calls
EmuBlockIo.Reset(). But the EmuBlockIo instance is already destroyed
by Close() that happens before uninstallation.

So a proper implementation is to call Close() after uninstallation
succeeds.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Andrew Fish <afish@apple.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>

3 files changed, 38 insertions, 18 deletions

diff --git a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
index b9ac6ce080..47b50a8e05 100644
--- a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
+++ b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
@@ -1,6 +1,6 @@
 /**@file

 

-Copyright (c) 2004 - 2009, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

 which accompanies this distribution.  The full text of the license may be found at

@@ -662,7 +662,6 @@ EmuBlockIoDriverBindingStop (
   }

 

   Private = EMU_BLOCK_IO_PRIVATE_DATA_FROM_THIS (BlockIo);

-  Status = Private->IoThunk->Close (Private->IoThunk);

 

   Status = gBS->UninstallMultipleProtocolInterfaces (

                   Private->EfiHandle,

@@ -677,14 +676,17 @@ EmuBlockIoDriverBindingStop (
                     This->DriverBindingHandle,

                     Handle

                     );

-  }

-

-  if (!EFI_ERROR (Status)) {

+    ASSERT_EFI_ERROR (Status);

+    //

+    // Destroy the IO interface.

+    //

+    Status = Private->IoThunk->Close (Private->IoThunk);

+    ASSERT_EFI_ERROR (Status);

     //

     // Free our instance data

     //

     FreeUnicodeStringTable (Private->ControllerNameTable);

-    gBS->FreePool (Private);

+    FreePool (Private);

   }

 

   return Status;

diff --git a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
index b5e19bb840..28abfd6bef 100644
--- a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
+++ b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
@@ -866,7 +866,6 @@ EmuSimpleFileSystemDriverBindingStop (
   }

 

   Private = EMU_SIMPLE_FILE_SYSTEM_PRIVATE_DATA_FROM_THIS (SimpleFileSystem);

-  Status = Private->IoThunk->Close (Private->IoThunk);

 

   //

   // Uninstall the Simple File System Protocol from ControllerHandle

@@ -883,9 +882,12 @@ EmuSimpleFileSystemDriverBindingStop (
                     This->DriverBindingHandle,

                     ControllerHandle

                     );

-  }

-

-  if (!EFI_ERROR (Status)) {

+    ASSERT_EFI_ERROR (Status);

+    //

+    // Destroy the IO interface.

+    //

+    Status = Private->IoThunk->Close (Private->IoThunk);

+    ASSERT_EFI_ERROR (Status);

     //

     // Free our instance data

     //

diff --git a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
index 0031baea52..967da9900a 100644
--- a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
+++ b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
@@ -870,6 +870,7 @@ EmuSnpDriverBindingStop (
   EFI_STATUS                  Status;

   EMU_SNP_PRIVATE_DATA        *Private = NULL;

   EFI_SIMPLE_NETWORK_PROTOCOL *Snp;

+  VOID                        *EmuIoThunk;

 

   //

   // Complete all outstanding transactions to Controller.

@@ -914,27 +915,42 @@ EmuSnpDriverBindingStop (
   }

 

   Private = EMU_SNP_PRIVATE_DATA_FROM_SNP_THIS (Snp);

-  Status = Private->IoThunk->Close (Private->IoThunk);

+  ASSERT (Private->DeviceHandle == ChildHandleBuffer[0]);

+  ASSERT (Private->EfiHandle    == ControllerHandle);

 

   Status = gBS->CloseProtocol(

-                  ChildHandleBuffer[0],

+                  ControllerHandle,

                   &gEmuIoThunkProtocolGuid,

                   This->DriverBindingHandle,

                   Private->DeviceHandle

                   );

+  ASSERT_EFI_ERROR (Status);

 

   Status = gBS->UninstallMultipleProtocolInterfaces(

-                  ChildHandleBuffer[0],

+                  Private->DeviceHandle,

                   &gEfiSimpleNetworkProtocolGuid,   &Private->Snp,

                   &gEfiDevicePathProtocolGuid,      Private->DevicePath,

                   NULL

                   );

+  if (EFI_ERROR (Status)) {

+    gBS->OpenProtocol (

+           ControllerHandle,

+           &gEmuIoThunkProtocolGuid,

+           &EmuIoThunk,

+           This->DriverBindingHandle,

+           Private->DeviceHandle,

+           EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER

+           );

+  } else {

+    Status = Private->IoThunk->Close (Private->IoThunk);

+    ASSERT_EFI_ERROR (Status);

+

+    FreePool (Private->DevicePath);

+    FreeUnicodeStringTable (Private->ControllerNameTable);

+    FreePool (Private);

+  }

 

-  FreePool (Private->DevicePath);

-  FreeUnicodeStringTable (Private->ControllerNameTable);

-  FreePool (Private);

-

-  return EFI_SUCCESS;

+  return Status;

 }