Pressing ESC from "PXE windows Boot manager" causes ASSERT

Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Karunakar P]

Hi All,

We have facing an issue with PXE boot.
[Issue]
When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or IPv6) system Hangs with following ASSERT

ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad Signature

[Reproduction Steps]
1. Perform UEFI PXEv4 or UEFI PXEv6 boot
2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
   Attached the Screenshot for the same(ScreenShot1.jpg)

   It will Displays the info like "Press ENTER for network boot service"
   Attached Screensho(ScreenShot2.jpg)

3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
   It will list the available Operating Systems
   Attached the screenshot(ScreenShot3.png)

4. Press ESC to come back to Setup or next Boot option

[Result]
System hangs with ASSERT

[Expected Result]
On pressing ESC from Windows Boot Manager, it should come back to setup/Next boot option in boot order

Note:
We have PXE server configured in Windows Server 2012 R2.

Please look into it.


Thanks,
karunakar

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Andrew Fish]

Karuakar,

I thought the ASSERT usually contained the line number?

Anyway the CR macro stands for Containment Record. Usually you have a pointer into a structure and you use the CR macro to find the start of the structure. It is common for things CR to include a signature at the start of the structure. 

The ASSERT you are almost reporting is likely some kind of data corruption. Like buffer overflow, use after free, etc. But without line number info it is hard to say which one it is.

Thanks,

Andrew Fish

> On May 23, 2017, at 9:20 PM, Karunakar P <karunakarp@amiindia.co.in> wrote:
> 
> Hi All,
> 
> We have facing an issue with PXE boot.
> [Issue]
> When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or IPv6) system Hangs with following ASSERT
> 
> ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad Signature
> 
> [Reproduction Steps]
> 1. Perform UEFI PXEv4 or UEFI PXEv6 boot
> 2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
>   Attached the Screenshot for the same(ScreenShot1.jpg)
> 
>   It will Displays the info like "Press ENTER for network boot service"
>   Attached Screensho(ScreenShot2.jpg)
> 
> 3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
>   It will list the available Operating Systems
>   Attached the screenshot(ScreenShot3.png)
> 
> 4. Press ESC to come back to Setup or next Boot option
> 
> [Result]
> System hangs with ASSERT
> 
> [Expected Result]
> On pressing ESC from Windows Boot Manager, it should come back to setup/Next boot option in boot order
> 
> Note:
> We have PXE server configured in Windows Server 2012 R2.
> 
> Please look into it.
> 
> 
> Thanks,
> karunakar
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Ye, Ting]

Hi Karunakar,

Sorry I did not find your attached files. Would you please send them again? Besides that, do you mind telling us which code base are you using for PXE boot?  Are you using some revision of EDKII main trunk or UDK release?

Thanks,
Ting

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Karunakar P
Sent: Wednesday, May 24, 2017 12:20 PM
To: edk2-devel@lists.01.org
Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes ASSERT

Hi All,

We have facing an issue with PXE boot.
[Issue]
When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or IPv6) system Hangs with following ASSERT

ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad Signature

[Reproduction Steps]
1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
   Attached the Screenshot for the same(ScreenShot1.jpg)

   It will Displays the info like "Press ENTER for network boot service"
   Attached Screensho(ScreenShot2.jpg)

3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
   It will list the available Operating Systems
   Attached the screenshot(ScreenShot3.png)

4. Press ESC to come back to Setup or next Boot option

[Result]
System hangs with ASSERT

[Expected Result]
On pressing ESC from Windows Boot Manager, it should come back to setup/Next boot option in boot order

Note:
We have PXE server configured in Windows Server 2012 R2.

Please look into it.


Thanks,
karunakar
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Karunakar P]

Hello All,

The ASSERT happens in the following function

/**
  Internal function to free a pool entry.
  Caller must have the memory lock held

  @param  Buffer                 The allocated pool entry to free
  @param  PoolType               Pointer to pool type

  @retval EFI_INVALID_PARAMETER  Buffer not valid
  @retval EFI_SUCCESS            Buffer successfully freed.

**/
EFI_STATUS
CoreFreePoolI (
  IN VOID               *Buffer,
  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
  )
{
.
.
ASSERT(Buffer != NULL);
  //
  // Get the head & tail of the pool entry
  //
  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	// ASSERT happens here
  ASSERT(Head != NULL);
.
.
}

We are using NetworkPkg: SHA- ef810bc807188224a752ffbcf5e7f4b651291cee

I think  here I'm unable attach the files.
You can find the attached screenshots in the following Bug571
https://bugzilla.tianocore.org/show_bug.cgi?id=571

Thanks,
Karunakar


-----Original Message-----
From: Ye, Ting [mailto:ting.ye@intel.com] 
Sent: Wednesday, May 24, 2017 10:29 AM
To: Karunakar P; edk2-devel@lists.01.org
Subject: RE: Pressing ESC from "PXE windows Boot manager" causes ASSERT

Hi Karunakar,

Sorry I did not find your attached files. Would you please send them again? Besides that, do you mind telling us which code base are you using for PXE boot?  Are you using some revision of EDKII main trunk or UDK release?

Thanks,
Ting

-----Original Message-----
From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Karunakar P
Sent: Wednesday, May 24, 2017 12:20 PM
To: edk2-devel@lists.01.org
Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes ASSERT

Hi All,

We have facing an issue with PXE boot.
[Issue]
When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or IPv6) system Hangs with following ASSERT

ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad Signature

[Reproduction Steps]
1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
   Attached the Screenshot for the same(ScreenShot1.jpg)

   It will Displays the info like "Press ENTER for network boot service"
   Attached Screensho(ScreenShot2.jpg)

3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
   It will list the available Operating Systems
   Attached the screenshot(ScreenShot3.png)

4. Press ESC to come back to Setup or next Boot option

[Result]
System hangs with ASSERT

[Expected Result]
On pressing ESC from Windows Boot Manager, it should come back to setup/Next boot option in boot order

Note:
We have PXE server configured in Windows Server 2012 R2.

Please look into it.


Thanks,
karunakar
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Andrew Fish]

Karunakar,

Every Pool allocation has a header and a tail data structure that is outside of the user visible data. Both these structures have signatures. The ASSERT you are seeing is a bad signature in the header so that looks like a buffer underflow. It could also be a use after free bug.

Head:
POOL_HEAD
Buffer:
User Data
Tail:
POOL_TAIL

Given the checks only happen on Free it is possible it could be a buffer overflow on a buffer that has not yet been freed that runs into this buffer. 

If you have a debugger dumping the memory before and after the buffer can some times be useful. The pattern might give you some clues. 

Thanks,

Andrew Fish

> On May 23, 2017, at 10:16 PM, Karunakar P <karunakarp@amiindia.co.in> wrote:
> 
> Hello All,
> 
> The ASSERT happens in the following function
> 
> /**
>  Internal function to free a pool entry.
>  Caller must have the memory lock held
> 
>  @param  Buffer                 The allocated pool entry to free
>  @param  PoolType               Pointer to pool type
> 
>  @retval EFI_INVALID_PARAMETER  Buffer not valid
>  @retval EFI_SUCCESS            Buffer successfully freed.
> 
> **/
> EFI_STATUS
> CoreFreePoolI (
>  IN VOID               *Buffer,
>  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
>  )
> {
> .
> .
> ASSERT(Buffer != NULL);
>  //
>  // Get the head & tail of the pool entry
>  //
>  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	// ASSERT happens here
>  ASSERT(Head != NULL);
> .
> .
> }
> 
> We are using NetworkPkg: SHA- ef810bc807188224a752ffbcf5e7f4b651291cee
> 
> I think  here I'm unable attach the files.
> You can find the attached screenshots in the following Bug571
> https://bugzilla.tianocore.org/show_bug.cgi?id=571
> 
> Thanks,
> Karunakar
> 
> 
> -----Original Message-----
> From: Ye, Ting [mailto:ting.ye@intel.com] 
> Sent: Wednesday, May 24, 2017 10:29 AM
> To: Karunakar P; edk2-devel@lists.01.org
> Subject: RE: Pressing ESC from "PXE windows Boot manager" causes ASSERT
> 
> Hi Karunakar,
> 
> Sorry I did not find your attached files. Would you please send them again? Besides that, do you mind telling us which code base are you using for PXE boot?  Are you using some revision of EDKII main trunk or UDK release?
> 
> Thanks,
> Ting
> 
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of Karunakar P
> Sent: Wednesday, May 24, 2017 12:20 PM
> To: edk2-devel@lists.01.org
> Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes ASSERT
> 
> Hi All,
> 
> We have facing an issue with PXE boot.
> [Issue]
> When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or IPv6) system Hangs with following ASSERT
> 
> ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad Signature
> 
> [Reproduction Steps]
> 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
>   Attached the Screenshot for the same(ScreenShot1.jpg)
> 
>   It will Displays the info like "Press ENTER for network boot service"
>   Attached Screensho(ScreenShot2.jpg)
> 
> 3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
>   It will list the available Operating Systems
>   Attached the screenshot(ScreenShot3.png)
> 
> 4. Press ESC to come back to Setup or next Boot option
> 
> [Result]
> System hangs with ASSERT
> 
> [Expected Result]
> On pressing ESC from Windows Boot Manager, it should come back to setup/Next boot option in boot order
> 
> Note:
> We have PXE server configured in Windows Server 2012 R2.
> 
> Please look into it.
> 
> 
> Thanks,
> karunakar
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Karunakar P]

Hello All,

I've added some traces to narrow down the issue.

Once the NBP file downloaded, control will be given to it.
I've added some traces before StartImage() and after StartImage() call.

Following are the debug messages

// DEBUG message printed before StartImage()
// StartImage() called
wdsmgfw.Entry(100061C0)
WDS Boot Manager version 0800
Client IP: 192.168.0.6
Server IP: 192.168.0.1
Server Name: WIN-8PL637590SS
Press ENTER for network boot service.
Windows Deployment Services (Server IP: 192.168.0.1)
Contacting Server (192.168.0.1):
ESC=Exit -ConvertPages: Incompatible memory types
bootmgfw.Entry(849FE1C0)
ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has Bad Signature

It might be Boot Loader Issue, As control is NOT coming back.

Could you please help on this.

Thanks,
karunakar

-----Original Message-----
From: afish@apple.com [mailto:afish@apple.com] 
Sent: Wednesday, May 24, 2017 8:39 PM
To: Karunakar P
Cc: Ye, Ting; edk2-devel@lists.01.org
Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" causes ASSERT

Karunakar,

Every Pool allocation has a header and a tail data structure that is outside of the user visible data. Both these structures have signatures. The ASSERT you are seeing is a bad signature in the header so that looks like a buffer underflow. It could also be a use after free bug.

Head:
POOL_HEAD
Buffer:
User Data
Tail:
POOL_TAIL

Given the checks only happen on Free it is possible it could be a buffer overflow on a buffer that has not yet been freed that runs into this buffer. 

If you have a debugger dumping the memory before and after the buffer can some times be useful. The pattern might give you some clues. 

Thanks,

Andrew Fish

> On May 23, 2017, at 10:16 PM, Karunakar P <karunakarp@amiindia.co.in> wrote:
> 
> Hello All,
> 
> The ASSERT happens in the following function
> 
> /**
>  Internal function to free a pool entry.
>  Caller must have the memory lock held
> 
>  @param  Buffer                 The allocated pool entry to free
>  @param  PoolType               Pointer to pool type
> 
>  @retval EFI_INVALID_PARAMETER  Buffer not valid
>  @retval EFI_SUCCESS            Buffer successfully freed.
> 
> **/
> EFI_STATUS
> CoreFreePoolI (
>  IN VOID               *Buffer,
>  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
>  )
> {
> .
> .
> ASSERT(Buffer != NULL);
>  //
>  // Get the head & tail of the pool entry  //
>  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	// ASSERT happens here
>  ASSERT(Head != NULL);
> .
> .
> }
> 
> We are using NetworkPkg: SHA- ef810bc807188224a752ffbcf5e7f4b651291cee
> 
> I think  here I'm unable attach the files.
> You can find the attached screenshots in the following Bug571
> https://bugzilla.tianocore.org/show_bug.cgi?id=571
> 
> Thanks,
> Karunakar
> 
> 
> -----Original Message-----
> From: Ye, Ting [mailto:ting.ye@intel.com]
> Sent: Wednesday, May 24, 2017 10:29 AM
> To: Karunakar P; edk2-devel@lists.01.org
> Subject: RE: Pressing ESC from "PXE windows Boot manager" causes 
> ASSERT
> 
> Hi Karunakar,
> 
> Sorry I did not find your attached files. Would you please send them again? Besides that, do you mind telling us which code base are you using for PXE boot?  Are you using some revision of EDKII main trunk or UDK release?
> 
> Thanks,
> Ting
> 
> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of 
> Karunakar P
> Sent: Wednesday, May 24, 2017 12:20 PM
> To: edk2-devel@lists.01.org
> Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes 
> ASSERT
> 
> Hi All,
> 
> We have facing an issue with PXE boot.
> [Issue]
> When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or 
> IPv6) system Hangs with following ASSERT
> 
> ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad 
> Signature
> 
> [Reproduction Steps]
> 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6 and Downloads NBP file successfully.
>   Attached the Screenshot for the same(ScreenShot1.jpg)
> 
>   It will Displays the info like "Press ENTER for network boot service"
>   Attached Screensho(ScreenShot2.jpg)
> 
> 3. Press ENTER and then press ESC immediately to see the Windows Boot Manager Menu
>   It will list the available Operating Systems
>   Attached the screenshot(ScreenShot3.png)
> 
> 4. Press ESC to come back to Setup or next Boot option
> 
> [Result]
> System hangs with ASSERT
> 
> [Expected Result]
> On pressing ESC from Windows Boot Manager, it should come back to 
> setup/Next boot option in boot order
> 
> Note:
> We have PXE server configured in Windows Server 2012 R2.
> 
> Please look into it.
> 
> 
> Thanks,
> karunakar
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Wu, Jiaxin]

Karunakar,

Can you share us the detailed DHCP and WDS configuration? E.g. DHCP options / WDS Properties (DHCP).  As you know, the different DHCP/WDS configuration may lead to the different PXE download process/behavior. We would like to reproduce the issue first.

>From your below debug messages, the issue seems to be triggered by bootmgfw.Entry.

Thanks,
Jiaxin

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Karunakar P
> Sent: Thursday, May 25, 2017 2:38 PM
> To: afish@apple.com; edk2-devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Hello All,
> 
> I've added some traces to narrow down the issue.
> 
> Once the NBP file downloaded, control will be given to it.
> I've added some traces before StartImage() and after StartImage() call.
> 
> Following are the debug messages
> 
> // DEBUG message printed before StartImage()
> // StartImage() called
> wdsmgfw.Entry(100061C0)
> WDS Boot Manager version 0800
> Client IP: 192.168.0.6
> Server IP: 192.168.0.1
> Server Name: WIN-8PL637590SS
> Press ENTER for network boot service.
> Windows Deployment Services (Server IP: 192.168.0.1)
> Contacting Server (192.168.0.1):
> ESC=Exit -ConvertPages: Incompatible memory types
> bootmgfw.Entry(849FE1C0)
> ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has
> Bad Signature
> 
> It might be Boot Loader Issue, As control is NOT coming back.
> 
> Could you please help on this.
> 
> Thanks,
> karunakar
> 
> -----Original Message-----
> From: afish@apple.com [mailto:afish@apple.com]
> Sent: Wednesday, May 24, 2017 8:39 PM
> To: Karunakar P
> Cc: Ye, Ting; edk2-devel@lists.01.org
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Karunakar,
> 
> Every Pool allocation has a header and a tail data structure that is outside of
> the user visible data. Both these structures have signatures. The ASSERT you
> are seeing is a bad signature in the header so that looks like a buffer underflow.
> It could also be a use after free bug.
> 
> Head:
> POOL_HEAD
> Buffer:
> User Data
> Tail:
> POOL_TAIL
> 
> Given the checks only happen on Free it is possible it could be a buffer overflow
> on a buffer that has not yet been freed that runs into this buffer.
> 
> If you have a debugger dumping the memory before and after the buffer can
> some times be useful. The pattern might give you some clues.
> 
> Thanks,
> 
> Andrew Fish
> 
> > On May 23, 2017, at 10:16 PM, Karunakar P <karunakarp@amiindia.co.in>
> wrote:
> >
> > Hello All,
> >
> > The ASSERT happens in the following function
> >
> > /**
> >  Internal function to free a pool entry.
> >  Caller must have the memory lock held
> >
> >  @param  Buffer                 The allocated pool entry to free
> >  @param  PoolType               Pointer to pool type
> >
> >  @retval EFI_INVALID_PARAMETER  Buffer not valid
> >  @retval EFI_SUCCESS            Buffer successfully freed.
> >
> > **/
> > EFI_STATUS
> > CoreFreePoolI (
> >  IN VOID               *Buffer,
> >  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
> >  )
> > {
> > .
> > .
> > ASSERT(Buffer != NULL);
> >  //
> >  // Get the head & tail of the pool entry  //
> >  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	//
> ASSERT happens here
> >  ASSERT(Head != NULL);
> > .
> > .
> > }
> >
> > We are using NetworkPkg: SHA-
> ef810bc807188224a752ffbcf5e7f4b651291cee
> >
> > I think  here I'm unable attach the files.
> > You can find the attached screenshots in the following Bug571
> > https://bugzilla.tianocore.org/show_bug.cgi?id=571
> >
> > Thanks,
> > Karunakar
> >
> >
> > -----Original Message-----
> > From: Ye, Ting [mailto:ting.ye@intel.com]
> > Sent: Wednesday, May 24, 2017 10:29 AM
> > To: Karunakar P; edk2-devel@lists.01.org
> > Subject: RE: Pressing ESC from "PXE windows Boot manager" causes
> > ASSERT
> >
> > Hi Karunakar,
> >
> > Sorry I did not find your attached files. Would you please send them again?
> Besides that, do you mind telling us which code base are you using for PXE boot?
> Are you using some revision of EDKII main trunk or UDK release?
> >
> > Thanks,
> > Ting
> >
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Karunakar P
> > Sent: Wednesday, May 24, 2017 12:20 PM
> > To: edk2-devel@lists.01.org
> > Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> > ASSERT
> >
> > Hi All,
> >
> > We have facing an issue with PXE boot.
> > [Issue]
> > When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or
> > IPv6) system Hangs with following ASSERT
> >
> > ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad
> > Signature
> >
> > [Reproduction Steps]
> > 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6
> and Downloads NBP file successfully.
> >   Attached the Screenshot for the same(ScreenShot1.jpg)
> >
> >   It will Displays the info like "Press ENTER for network boot service"
> >   Attached Screensho(ScreenShot2.jpg)
> >
> > 3. Press ENTER and then press ESC immediately to see the Windows Boot
> Manager Menu
> >   It will list the available Operating Systems
> >   Attached the screenshot(ScreenShot3.png)
> >
> > 4. Press ESC to come back to Setup or next Boot option
> >
> > [Result]
> > System hangs with ASSERT
> >
> > [Expected Result]
> > On pressing ESC from Windows Boot Manager, it should come back to
> > setup/Next boot option in boot order
> >
> > Note:
> > We have PXE server configured in Windows Server 2012 R2.
> >
> > Please look into it.
> >
> >
> > Thanks,
> > karunakar
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Karunakar P]

Hi Jiaxin,

Please find below details regards Server Configuration

I have configured DHCP and WDS server on same machine (Windows Server 2012 R2)
Server IP: 192.168.0.1

1. Configured Active Directory Domain Services, DHCP , WDS services
2. DHCPv4 Configuration
	Address Pool :- 192.168.0.2 - 192.168.0.50
	Scope Options:-
			Option Name		Value
			-----------------		--------
			006 DNS server 		192.168.0.1
			060 PXE Client		PXEClient

3. WDS Configuration DHCP Properties
	Check both of the following check boxes
	1. Do not listen on DHCP ports
	2. Configure DHCP options to indicate that this is also a PXE Server
 In WDS Server, added boot.wim and install.wim images of same server.
As you know, Once we configure WDS and added boot.wim and install.wim images to WDS server, bootmgfw.efi and wdsmgfw.efi files will be added to C:\RemoteInstall\Boot\x64 


I also tried with PXE server configured in Windows Server 2008 R2. ASSERT happens at the same place

Following are the debug messages
// DEBUG message printed before StartImage()
// StartImage() called
wdsmgfw.Entry(10001000)
Press ENTER for network boot service. ConvertPages: Incompatible memory types
bootmgfw.Entry(8510C000)
Windows Boot Manager (Server IP: 192.168.000.001)
Choose an operating system to start: (Use the arrow keys to highlight your choice, then press ENTER.)
WinServer2008_boot.wim
To specify an advanced option for this choice, press F8.
ENTER=Choose ESC=Exit
WinServer2008_boot.wim>
To specify an advanced option for this choice, press F8.
ASSERT d:\ProjectPath\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has Bad Signature

Yeah you are correct with above debug messages, It seems that issue is happening inside bootmgfw

Thanks,
karunakar

-----Original Message-----
From: Wu, Jiaxin [mailto:jiaxin.wu@intel.com] 
Sent: Thursday, May 25, 2017 4:07 PM
To: Karunakar P; afish@apple.com; edk2-devel@lists.01.org
Cc: Ye, Ting; Fu, Siyuan
Subject: RE: [edk2] Pressing ESC from "PXE windows Boot manager" causes ASSERT

Karunakar,

Can you share us the detailed DHCP and WDS configuration? E.g. DHCP options / WDS Properties (DHCP).  As you know, the different DHCP/WDS configuration may lead to the different PXE download process/behavior. We would like to reproduce the issue first.

>From your below debug messages, the issue seems to be triggered by bootmgfw.Entry.

Thanks,
Jiaxin

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of 
> Karunakar P
> Sent: Thursday, May 25, 2017 2:38 PM
> To: afish@apple.com; edk2-devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" 
> causes ASSERT
> 
> Hello All,
> 
> I've added some traces to narrow down the issue.
> 
> Once the NBP file downloaded, control will be given to it.
> I've added some traces before StartImage() and after StartImage() call.
> 
> Following are the debug messages
> 
> // DEBUG message printed before StartImage() // StartImage() called
> wdsmgfw.Entry(100061C0)
> WDS Boot Manager version 0800
> Client IP: 192.168.0.6
> Server IP: 192.168.0.1
> Server Name: WIN-8PL637590SS
> Press ENTER for network boot service.
> Windows Deployment Services (Server IP: 192.168.0.1) Contacting Server 
> (192.168.0.1):
> ESC=Exit -ConvertPages: Incompatible memory types
> bootmgfw.Entry(849FE1C0)
> ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has 
> Bad Signature
> 
> It might be Boot Loader Issue, As control is NOT coming back.
> 
> Could you please help on this.
> 
> Thanks,
> karunakar
> 
> -----Original Message-----
> From: afish@apple.com [mailto:afish@apple.com]
> Sent: Wednesday, May 24, 2017 8:39 PM
> To: Karunakar P
> Cc: Ye, Ting; edk2-devel@lists.01.org
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" 
> causes ASSERT
> 
> Karunakar,
> 
> Every Pool allocation has a header and a tail data structure that is 
> outside of the user visible data. Both these structures have 
> signatures. The ASSERT you are seeing is a bad signature in the header so that looks like a buffer underflow.
> It could also be a use after free bug.
> 
> Head:
> POOL_HEAD
> Buffer:
> User Data
> Tail:
> POOL_TAIL
> 
> Given the checks only happen on Free it is possible it could be a 
> buffer overflow on a buffer that has not yet been freed that runs into this buffer.
> 
> If you have a debugger dumping the memory before and after the buffer 
> can some times be useful. The pattern might give you some clues.
> 
> Thanks,
> 
> Andrew Fish
> 
> > On May 23, 2017, at 10:16 PM, Karunakar P 
> > <karunakarp@amiindia.co.in>
> wrote:
> >
> > Hello All,
> >
> > The ASSERT happens in the following function
> >
> > /**
> >  Internal function to free a pool entry.
> >  Caller must have the memory lock held
> >
> >  @param  Buffer                 The allocated pool entry to free
> >  @param  PoolType               Pointer to pool type
> >
> >  @retval EFI_INVALID_PARAMETER  Buffer not valid
> >  @retval EFI_SUCCESS            Buffer successfully freed.
> >
> > **/
> > EFI_STATUS
> > CoreFreePoolI (
> >  IN VOID               *Buffer,
> >  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
> >  )
> > {
> > .
> > .
> > ASSERT(Buffer != NULL);
> >  //
> >  // Get the head & tail of the pool entry  //
> >  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	//
> ASSERT happens here
> >  ASSERT(Head != NULL);
> > .
> > .
> > }
> >
> > We are using NetworkPkg: SHA-
> ef810bc807188224a752ffbcf5e7f4b651291cee
> >
> > I think  here I'm unable attach the files.
> > You can find the attached screenshots in the following Bug571
> > https://bugzilla.tianocore.org/show_bug.cgi?id=571
> >
> > Thanks,
> > Karunakar
> >
> >
> > -----Original Message-----
> > From: Ye, Ting [mailto:ting.ye@intel.com]
> > Sent: Wednesday, May 24, 2017 10:29 AM
> > To: Karunakar P; edk2-devel@lists.01.org
> > Subject: RE: Pressing ESC from "PXE windows Boot manager" causes 
> > ASSERT
> >
> > Hi Karunakar,
> >
> > Sorry I did not find your attached files. Would you please send them again?
> Besides that, do you mind telling us which code base are you using for PXE boot?
> Are you using some revision of EDKII main trunk or UDK release?
> >
> > Thanks,
> > Ting
> >
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf 
> > Of Karunakar P
> > Sent: Wednesday, May 24, 2017 12:20 PM
> > To: edk2-devel@lists.01.org
> > Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes 
> > ASSERT
> >
> > Hi All,
> >
> > We have facing an issue with PXE boot.
> > [Issue]
> > When ESC is pressed from Windows Boot manager during PXE boot (IPv4 
> > or
> > IPv6) system Hangs with following ASSERT
> >
> > ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad 
> > Signature
> >
> > [Reproduction Steps]
> > 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot 
> > over IPv4/6
> and Downloads NBP file successfully.
> >   Attached the Screenshot for the same(ScreenShot1.jpg)
> >
> >   It will Displays the info like "Press ENTER for network boot service"
> >   Attached Screensho(ScreenShot2.jpg)
> >
> > 3. Press ENTER and then press ESC immediately to see the Windows 
> > Boot
> Manager Menu
> >   It will list the available Operating Systems
> >   Attached the screenshot(ScreenShot3.png)
> >
> > 4. Press ESC to come back to Setup or next Boot option
> >
> > [Result]
> > System hangs with ASSERT
> >
> > [Expected Result]
> > On pressing ESC from Windows Boot Manager, it should come back to 
> > setup/Next boot option in boot order
> >
> > Note:
> > We have PXE server configured in Windows Server 2012 R2.
> >
> > Please look into it.
> >
> >
> > Thanks,
> > karunakar
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

[Wu, Jiaxin]

Hi Karunakar,

We have identified it's the 3rd part NBP file (wdsmgfw.efi) bug.

I've updated my detailed analysis in the corresponding Bugzilla: 
https://bugzilla.tianocore.org/show_bug.cgi?id=571

Thanks,
Jiaxin


> -----Original Message-----
> From: Karunakar P [mailto:karunakarp@amiindia.co.in]
> Sent: Thursday, May 25, 2017 7:34 PM
> To: Wu, Jiaxin <jiaxin.wu@intel.com>; afish@apple.com; edk2-
> devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>
> Subject: RE: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Hi Jiaxin,
> 
> Please find below details regards Server Configuration
> 
> I have configured DHCP and WDS server on same machine (Windows Server
> 2012 R2)
> Server IP: 192.168.0.1
> 
> 1. Configured Active Directory Domain Services, DHCP , WDS services
> 2. DHCPv4 Configuration
> 	Address Pool :- 192.168.0.2 - 192.168.0.50
> 	Scope Options:-
> 			Option Name		Value
> 			-----------------		--------
> 			006 DNS server 		192.168.0.1
> 			060 PXE Client		PXEClient
> 
> 3. WDS Configuration DHCP Properties
> 	Check both of the following check boxes
> 	1. Do not listen on DHCP ports
> 	2. Configure DHCP options to indicate that this is also a PXE Server
>  In WDS Server, added boot.wim and install.wim images of same server.
> As you know, Once we configure WDS and added boot.wim and install.wim
> images to WDS server, bootmgfw.efi and wdsmgfw.efi files will be added to
> C:\RemoteInstall\Boot\x64
> 
> 
> I also tried with PXE server configured in Windows Server 2008 R2. ASSERT
> happens at the same place
> 
> Following are the debug messages
> // DEBUG message printed before StartImage()
> // StartImage() called
> wdsmgfw.Entry(10001000)
> Press ENTER for network boot service. ConvertPages: Incompatible memory
> types
> bootmgfw.Entry(8510C000)
> Windows Boot Manager (Server IP: 192.168.000.001)
> Choose an operating system to start: (Use the arrow keys to highlight your
> choice, then press ENTER.)
> WinServer2008_boot.wim
> To specify an advanced option for this choice, press F8.
> ENTER=Choose ESC=Exit
> WinServer2008_boot.wim>
> To specify an advanced option for this choice, press F8.
> ASSERT d:\ProjectPath\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has
> Bad Signature
> 
> Yeah you are correct with above debug messages, It seems that issue is
> happening inside bootmgfw
> 
> Thanks,
> karunakar
> 
> -----Original Message-----
> From: Wu, Jiaxin [mailto:jiaxin.wu@intel.com]
> Sent: Thursday, May 25, 2017 4:07 PM
> To: Karunakar P; afish@apple.com; edk2-devel@lists.01.org
> Cc: Ye, Ting; Fu, Siyuan
> Subject: RE: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Karunakar,
> 
> Can you share us the detailed DHCP and WDS configuration? E.g. DHCP
> options / WDS Properties (DHCP).  As you know, the different DHCP/WDS
> configuration may lead to the different PXE download process/behavior. We
> would like to reproduce the issue first.
> 
> From your below debug messages, the issue seems to be triggered by
> bootmgfw.Entry.
> 
> Thanks,
> Jiaxin
> 
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Karunakar P
> > Sent: Thursday, May 25, 2017 2:38 PM
> > To: afish@apple.com; edk2-devel@lists.01.org
> > Cc: Ye, Ting <ting.ye@intel.com>
> > Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager"
> > causes ASSERT
> >
> > Hello All,
> >
> > I've added some traces to narrow down the issue.
> >
> > Once the NBP file downloaded, control will be given to it.
> > I've added some traces before StartImage() and after StartImage() call.
> >
> > Following are the debug messages
> >
> > // DEBUG message printed before StartImage() // StartImage() called
> > wdsmgfw.Entry(100061C0)
> > WDS Boot Manager version 0800
> > Client IP: 192.168.0.6
> > Server IP: 192.168.0.1
> > Server Name: WIN-8PL637590SS
> > Press ENTER for network boot service.
> > Windows Deployment Services (Server IP: 192.168.0.1) Contacting Server
> > (192.168.0.1):
> > ESC=Exit -ConvertPages: Incompatible memory types
> > bootmgfw.Entry(849FE1C0)
> > ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR
> has
> > Bad Signature
> >
> > It might be Boot Loader Issue, As control is NOT coming back.
> >
> > Could you please help on this.
> >
> > Thanks,
> > karunakar
> >
> > -----Original Message-----
> > From: afish@apple.com [mailto:afish@apple.com]
> > Sent: Wednesday, May 24, 2017 8:39 PM
> > To: Karunakar P
> > Cc: Ye, Ting; edk2-devel@lists.01.org
> > Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager"
> > causes ASSERT
> >
> > Karunakar,
> >
> > Every Pool allocation has a header and a tail data structure that is
> > outside of the user visible data. Both these structures have
> > signatures. The ASSERT you are seeing is a bad signature in the header so
> that looks like a buffer underflow.
> > It could also be a use after free bug.
> >
> > Head:
> > POOL_HEAD
> > Buffer:
> > User Data
> > Tail:
> > POOL_TAIL
> >
> > Given the checks only happen on Free it is possible it could be a
> > buffer overflow on a buffer that has not yet been freed that runs into this
> buffer.
> >
> > If you have a debugger dumping the memory before and after the buffer
> > can some times be useful. The pattern might give you some clues.
> >
> > Thanks,
> >
> > Andrew Fish
> >
> > > On May 23, 2017, at 10:16 PM, Karunakar P
> > > <karunakarp@amiindia.co.in>
> > wrote:
> > >
> > > Hello All,
> > >
> > > The ASSERT happens in the following function
> > >
> > > /**
> > >  Internal function to free a pool entry.
> > >  Caller must have the memory lock held
> > >
> > >  @param  Buffer                 The allocated pool entry to free
> > >  @param  PoolType               Pointer to pool type
> > >
> > >  @retval EFI_INVALID_PARAMETER  Buffer not valid
> > >  @retval EFI_SUCCESS            Buffer successfully freed.
> > >
> > > **/
> > > EFI_STATUS
> > > CoreFreePoolI (
> > >  IN VOID               *Buffer,
> > >  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
> > >  )
> > > {
> > > .
> > > .
> > > ASSERT(Buffer != NULL);
> > >  //
> > >  // Get the head & tail of the pool entry  //
> > >  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	//
> > ASSERT happens here
> > >  ASSERT(Head != NULL);
> > > .
> > > .
> > > }
> > >
> > > We are using NetworkPkg: SHA-
> > ef810bc807188224a752ffbcf5e7f4b651291cee
> > >
> > > I think  here I'm unable attach the files.
> > > You can find the attached screenshots in the following Bug571
> > > https://bugzilla.tianocore.org/show_bug.cgi?id=571
> > >
> > > Thanks,
> > > Karunakar
> > >
> > >
> > > -----Original Message-----
> > > From: Ye, Ting [mailto:ting.ye@intel.com]
> > > Sent: Wednesday, May 24, 2017 10:29 AM
> > > To: Karunakar P; edk2-devel@lists.01.org
> > > Subject: RE: Pressing ESC from "PXE windows Boot manager" causes
> > > ASSERT
> > >
> > > Hi Karunakar,
> > >
> > > Sorry I did not find your attached files. Would you please send them again?
> > Besides that, do you mind telling us which code base are you using for PXE
> boot?
> > Are you using some revision of EDKII main trunk or UDK release?
> > >
> > > Thanks,
> > > Ting
> > >
> > > -----Original Message-----
> > > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf
> > > Of Karunakar P
> > > Sent: Wednesday, May 24, 2017 12:20 PM
> > > To: edk2-devel@lists.01.org
> > > Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> > > ASSERT
> > >
> > > Hi All,
> > >
> > > We have facing an issue with PXE boot.
> > > [Issue]
> > > When ESC is pressed from Windows Boot manager during PXE boot (IPv4
> > > or
> > > IPv6) system Hangs with following ASSERT
> > >
> > > ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad
> > > Signature
> > >
> > > [Reproduction Steps]
> > > 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot
> > > over IPv4/6
> > and Downloads NBP file successfully.
> > >   Attached the Screenshot for the same(ScreenShot1.jpg)
> > >
> > >   It will Displays the info like "Press ENTER for network boot service"
> > >   Attached Screensho(ScreenShot2.jpg)
> > >
> > > 3. Press ENTER and then press ESC immediately to see the Windows
> > > Boot
> > Manager Menu
> > >   It will list the available Operating Systems
> > >   Attached the screenshot(ScreenShot3.png)
> > >
> > > 4. Press ESC to come back to Setup or next Boot option
> > >
> > > [Result]
> > > System hangs with ASSERT
> > >
> > > [Expected Result]
> > > On pressing ESC from Windows Boot Manager, it should come back to
> > > setup/Next boot option in boot order
> > >
> > > Note:
> > > We have PXE server configured in Windows Server 2012 R2.
> > >
> > > Please look into it.
> > >
> > >
> > > Thanks,
> > > karunakar
> > > _______________________________________________
> > > edk2-devel mailing list
> > > edk2-devel@lists.01.org
> > > https://lists.01.org/mailman/listinfo/edk2-devel
> > > _______________________________________________
> > > edk2-devel mailing list
> > > edk2-devel@lists.01.org
> > > https://lists.01.org/mailman/listinfo/edk2-devel
> >
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel