Shell command "reconnect -r" causes data abort (Bugzilla Bug 211)

[tianocore-issues]

This issue was created automatically with bugzilla2github

Bugzilla Bug 211

Date: 2016-11-04T08:59:39+00:00
From: Alexei <<Alexei.Fedorov>>
To: @niruiyu
CC: shala.arshi, yonghong.zhu

Last updated: 2019-05-17T16:02:17+00:00

[tianocore-issues]

Comment 845

Date: 2016-11-04 08:59:39 +0000
From: Alexei <<Alexei.Fedorov>>

• Industry Specification: ---
• Releases to Fix: EDK II Master
• Target OS: ---
• Bugzilla Assignee(s): @niruiyu

Shell "reconnect -r" command causes data abort as below:

Data Abort Exception PC at 0xAFAFAFB2 CPSR 0xA0000033 NzCveaifT_svc

R0 0xDF406B00 R1 0x0000002F R2 0xFDF406B0 R3 0xAFAFAFAF
R4 0xFDF406B0 R5 0x00000000 R6 0x00000003 R7 0xE0000214
R8 0x80000100 R9 0xF7000000 R10 0xFEFEB000 R11 0x00000000
R12 0x00000000 SP 0xFEFFF900 LR 0xF954087D PC 0xAFAFAFB2
DFSR 0x00000005 DFAR 0x0000002F IFSR 0x00000000 IFAR 0x00000000
Translation fault on Section: read from 0x0000002F

ASSERT [ArmCpuDxe] k:\edk2\ArmPkg\Library\DefaultExceptionHandlerLib\Arm\DefaultExceptionHandler.c(258): ((BOOLEAN)(0==1))

This happens with only one serial console present and no Console Splitter installed:

Multiple Console IO support

INF MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
INF MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
INF MdeModulePkg/Universal/SerialDxe/SerialDxe.inf

The sequence of calls is:

1. ShellCommandRunReconnect() calls ShellCommandRunDisconnect() function, which calls DisconnectAll().

2. DisconnectAll() calls gBS->DisconnectController() on each handle causing TerminalDriverBindingStop() to be called.

3. TerminalDriverBindingStop() destroys Terminal device by calling
   FreePool (TerminalDevice)
   making all its structure members including SimpleTextOutput invalid and filling freed memory with 0xAF pattern for DEBUG builds.

4. ShellCommandRunReconnect() calls ShellCommandRunConnect() calling ConvertAndConnectControllers() which calls ConnectControllers()

5. ConnectControllers() calls
   ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_HANDLE_RESULT), gShellDriver1HiiHandle, L"Connect", ConvertHandleToHandleIndex(*HandleWalker), Status);

6. This results in InternalShellPrintWorker() calling
   gST->ConOut->SetAttribute(gST->ConOut, EFI_TEXT_ATTR(EFI_WHITE, ((OriginalAttribute&(BIT4|BIT5|BIT6))>>4)));
   which is ConsoleLoggerSetAttribute() function calling:
   //
   // Forward the request to the original ConOut
   //
   Status = ConsoleInfo->OldConOut->SetAttribute (ConsoleInfo->OldConOut, Attribute);

7. Because OldConOut was destroyed in step AhciDumpPortStatus doesn't fully populate all the fields of the parameter EFI_ATA_STATUS_BLOCK *AtaStatusBlock #3 this causes the data abort as above.
   Added debug print
   DEBUG ((DEBUG_ERROR, " ConsoleInfo 0x%p OldConOut 0x%p SetAttribute 0x%p\n", ConsoleInfo, ConsoleInfo->OldConOut, ConsoleInfo->OldConOut->SetAttribute));
   shows
   ConsoleInfo 0xFDECD590 OldConOut 0xFDF406B0 SetAttribute 0xAFAFAFAF

[tianocore-issues]

Comment 879

Date: 2016-11-10 19:28:00 +0000
From: Yonghong Zhu <<yonghong.zhu>>

Bug scrub: Assign to module owner, and we need cover this case for no Console Splitter installed.

[tianocore-issues]

Comment 7663

Date: 2019-05-17 13:14:57 +0000
From: shala.arshi

Created attachment 348
data

comment

Attachment: BZ-348-file_211.txt

[tianocore-issues]

Comment 7689

Date: 2019-05-17 16:02:17 +0000
From: Yonghong Zhu <<yonghong.zhu>>

change assignee back to Ray.