Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

["Wu, Jiaxin" <jiaxin.wu@intel.com>]

Hi Karunakar,

We have identified it's the 3rd part NBP file (wdsmgfw.efi) bug.

I've updated my detailed analysis in the corresponding Bugzilla: 
https://bugzilla.tianocore.org/show_bug.cgi?id=571

Thanks,
Jiaxin


> -----Original Message-----
> From: Karunakar P [mailto:karunakarp@amiindia.co.in]
> Sent: Thursday, May 25, 2017 7:34 PM
> To: Wu, Jiaxin <jiaxin.wu@intel.com>; afish@apple.com; edk2-
> devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>
> Subject: RE: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Hi Jiaxin,
> 
> Please find below details regards Server Configuration
> 
> I have configured DHCP and WDS server on same machine (Windows Server
> 2012 R2)
> Server IP: 192.168.0.1
> 
> 1. Configured Active Directory Domain Services, DHCP , WDS services
> 2. DHCPv4 Configuration
> 	Address Pool :- 192.168.0.2 - 192.168.0.50
> 	Scope Options:-
> 			Option Name		Value
> 			-----------------		--------
> 			006 DNS server 		192.168.0.1
> 			060 PXE Client		PXEClient
> 
> 3. WDS Configuration DHCP Properties
> 	Check both of the following check boxes
> 	1. Do not listen on DHCP ports
> 	2. Configure DHCP options to indicate that this is also a PXE Server
>  In WDS Server, added boot.wim and install.wim images of same server.
> As you know, Once we configure WDS and added boot.wim and install.wim
> images to WDS server, bootmgfw.efi and wdsmgfw.efi files will be added to
> C:\RemoteInstall\Boot\x64
> 
> 
> I also tried with PXE server configured in Windows Server 2008 R2. ASSERT
> happens at the same place
> 
> Following are the debug messages
> // DEBUG message printed before StartImage()
> // StartImage() called
> wdsmgfw.Entry(10001000)
> Press ENTER for network boot service. ConvertPages: Incompatible memory
> types
> bootmgfw.Entry(8510C000)
> Windows Boot Manager (Server IP: 192.168.000.001)
> Choose an operating system to start: (Use the arrow keys to highlight your
> choice, then press ENTER.)
> WinServer2008_boot.wim
> To specify an advanced option for this choice, press F8.
> ENTER=Choose ESC=Exit
> WinServer2008_boot.wim>
> To specify an advanced option for this choice, press F8.
> ASSERT d:\ProjectPath\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has
> Bad Signature
> 
> Yeah you are correct with above debug messages, It seems that issue is
> happening inside bootmgfw
> 
> Thanks,
> karunakar
> 
> -----Original Message-----
> From: Wu, Jiaxin [mailto:jiaxin.wu@intel.com]
> Sent: Thursday, May 25, 2017 4:07 PM
> To: Karunakar P; afish@apple.com; edk2-devel@lists.01.org
> Cc: Ye, Ting; Fu, Siyuan
> Subject: RE: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Karunakar,
> 
> Can you share us the detailed DHCP and WDS configuration? E.g. DHCP
> options / WDS Properties (DHCP).  As you know, the different DHCP/WDS
> configuration may lead to the different PXE download process/behavior. We
> would like to reproduce the issue first.
> 
> From your below debug messages, the issue seems to be triggered by
> bootmgfw.Entry.
> 
> Thanks,
> Jiaxin
> 
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Karunakar P
> > Sent: Thursday, May 25, 2017 2:38 PM
> > To: afish@apple.com; edk2-devel@lists.01.org
> > Cc: Ye, Ting <ting.ye@intel.com>
> > Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager"
> > causes ASSERT
> >
> > Hello All,
> >
> > I've added some traces to narrow down the issue.
> >
> > Once the NBP file downloaded, control will be given to it.
> > I've added some traces before StartImage() and after StartImage() call.
> >
> > Following are the debug messages
> >
> > // DEBUG message printed before StartImage() // StartImage() called
> > wdsmgfw.Entry(100061C0)
> > WDS Boot Manager version 0800
> > Client IP: 192.168.0.6
> > Server IP: 192.168.0.1
> > Server Name: WIN-8PL637590SS
> > Press ENTER for network boot service.
> > Windows Deployment Services (Server IP: 192.168.0.1) Contacting Server
> > (192.168.0.1):
> > ESC=Exit -ConvertPages: Incompatible memory types
> > bootmgfw.Entry(849FE1C0)
> > ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR
> has
> > Bad Signature
> >
> > It might be Boot Loader Issue, As control is NOT coming back.
> >
> > Could you please help on this.
> >
> > Thanks,
> > karunakar
> >
> > -----Original Message-----
> > From: afish@apple.com [mailto:afish@apple.com]
> > Sent: Wednesday, May 24, 2017 8:39 PM
> > To: Karunakar P
> > Cc: Ye, Ting; edk2-devel@lists.01.org
> > Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager"
> > causes ASSERT
> >
> > Karunakar,
> >
> > Every Pool allocation has a header and a tail data structure that is
> > outside of the user visible data. Both these structures have
> > signatures. The ASSERT you are seeing is a bad signature in the header so
> that looks like a buffer underflow.
> > It could also be a use after free bug.
> >
> > Head:
> > POOL_HEAD
> > Buffer:
> > User Data
> > Tail:
> > POOL_TAIL
> >
> > Given the checks only happen on Free it is possible it could be a
> > buffer overflow on a buffer that has not yet been freed that runs into this
> buffer.
> >
> > If you have a debugger dumping the memory before and after the buffer
> > can some times be useful. The pattern might give you some clues.
> >
> > Thanks,
> >
> > Andrew Fish
> >
> > > On May 23, 2017, at 10:16 PM, Karunakar P
> > > <karunakarp@amiindia.co.in>
> > wrote:
> > >
> > > Hello All,
> > >
> > > The ASSERT happens in the following function
> > >
> > > /**
> > >  Internal function to free a pool entry.
> > >  Caller must have the memory lock held
> > >
> > >  @param  Buffer                 The allocated pool entry to free
> > >  @param  PoolType               Pointer to pool type
> > >
> > >  @retval EFI_INVALID_PARAMETER  Buffer not valid
> > >  @retval EFI_SUCCESS            Buffer successfully freed.
> > >
> > > **/
> > > EFI_STATUS
> > > CoreFreePoolI (
> > >  IN VOID               *Buffer,
> > >  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
> > >  )
> > > {
> > > .
> > > .
> > > ASSERT(Buffer != NULL);
> > >  //
> > >  // Get the head & tail of the pool entry  //
> > >  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	//
> > ASSERT happens here
> > >  ASSERT(Head != NULL);
> > > .
> > > .
> > > }
> > >
> > > We are using NetworkPkg: SHA-
> > ef810bc807188224a752ffbcf5e7f4b651291cee
> > >
> > > I think  here I'm unable attach the files.
> > > You can find the attached screenshots in the following Bug571
> > > https://bugzilla.tianocore.org/show_bug.cgi?id=571
> > >
> > > Thanks,
> > > Karunakar
> > >
> > >
> > > -----Original Message-----
> > > From: Ye, Ting [mailto:ting.ye@intel.com]
> > > Sent: Wednesday, May 24, 2017 10:29 AM
> > > To: Karunakar P; edk2-devel@lists.01.org
> > > Subject: RE: Pressing ESC from "PXE windows Boot manager" causes
> > > ASSERT
> > >
> > > Hi Karunakar,
> > >
> > > Sorry I did not find your attached files. Would you please send them again?
> > Besides that, do you mind telling us which code base are you using for PXE
> boot?
> > Are you using some revision of EDKII main trunk or UDK release?
> > >
> > > Thanks,
> > > Ting
> > >
> > > -----Original Message-----
> > > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf
> > > Of Karunakar P
> > > Sent: Wednesday, May 24, 2017 12:20 PM
> > > To: edk2-devel@lists.01.org
> > > Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> > > ASSERT
> > >
> > > Hi All,
> > >
> > > We have facing an issue with PXE boot.
> > > [Issue]
> > > When ESC is pressed from Windows Boot manager during PXE boot (IPv4
> > > or
> > > IPv6) system Hangs with following ASSERT
> > >
> > > ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad
> > > Signature
> > >
> > > [Reproduction Steps]
> > > 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot
> > > over IPv4/6
> > and Downloads NBP file successfully.
> > >   Attached the Screenshot for the same(ScreenShot1.jpg)
> > >
> > >   It will Displays the info like "Press ENTER for network boot service"
> > >   Attached Screensho(ScreenShot2.jpg)
> > >
> > > 3. Press ENTER and then press ESC immediately to see the Windows
> > > Boot
> > Manager Menu
> > >   It will list the available Operating Systems
> > >   Attached the screenshot(ScreenShot3.png)
> > >
> > > 4. Press ESC to come back to Setup or next Boot option
> > >
> > > [Result]
> > > System hangs with ASSERT
> > >
> > > [Expected Result]
> > > On pressing ESC from Windows Boot Manager, it should come back to
> > > setup/Next boot option in boot order
> > >
> > > Note:
> > > We have PXE server configured in Windows Server 2012 R2.
> > >
> > > Please look into it.
> > >
> > >
> > > Thanks,
> > > karunakar
> > > _______________________________________________
> > > edk2-devel mailing list
> > > edk2-devel@lists.01.org
> > > https://lists.01.org/mailman/listinfo/edk2-devel
> > > _______________________________________________
> > > edk2-devel mailing list
> > > edk2-devel@lists.01.org
> > > https://lists.01.org/mailman/listinfo/edk2-devel
> >
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel