[usb/ucmcx] Fix Code Analysis Warnings

4 files changed, 34 insertions, 4 deletions

diff --git a/usb/UcmCxUcsi/Acpi.cpp b/usb/UcmCxUcsi/Acpi.cpp
index d905a3c7..ed90260d 100644
--- a/usb/UcmCxUcsi/Acpi.cpp
+++ b/usb/UcmCxUcsi/Acpi.cpp
@@ -305,6 +305,13 @@ Acpi_EnumChildren (
             goto Exit;
         }
 
+        //
+        // when IOCTL_ACPI_ENUM_CHILDREN returns STATUS_BUFFER_OVERFLOW, the OutputBuffer->NumberOfChildren is set
+        // to the size, in bytes, to hold the whole ACPI_ENUM_CHILDREN_OUTPUT_BUFFER, including the fixed header
+        // and the variable array for child objects
+        //
+        _Analysis_assume_(outputBuf->NumberOfChildren > sizeof(ACPI_ENUM_CHILDREN_OUTPUT_BUFFER));
+
         outputBufSize = outputBuf->NumberOfChildren;
         WdfObjectDelete(outputMem);
         outputMem = WDF_NO_HANDLE;
diff --git a/usb/UcmTcpciCxClientSample/Alert.cpp b/usb/UcmTcpciCxClientSample/Alert.cpp
index b63692db..54273cfa 100644
--- a/usb/UcmTcpciCxClientSample/Alert.cpp
+++ b/usb/UcmTcpciCxClientSample/Alert.cpp
@@ -19,6 +19,7 @@ Environment:
 
 #ifdef ALLOC_PRAGMA
 #pragma alloc_text (PAGE, OnInterruptPassiveIsr)
+#pragma alloc_text (PAGE, ProcessAndSendAlerts)
 #endif
 
 BOOLEAN
diff --git a/usb/UcmTcpciCxClientSample/Driver.cpp b/usb/UcmTcpciCxClientSample/Driver.cpp
index d533951d..14ec48ad 100644
--- a/usb/UcmTcpciCxClientSample/Driver.cpp
+++ b/usb/UcmTcpciCxClientSample/Driver.cpp
@@ -150,6 +150,11 @@ Arguments:
 
 --*/
 {
+    //
+    // EvtCleanupCallback for WDFDRIVER is always called at PASSIVE_LEVEL
+    //
+    _Analysis_assume_(KeGetCurrentIrql() == PASSIVE_LEVEL);
+
     TRACE_FUNC_ENTRY(TRACE_DRIVER);
 
     PAGED_CODE();
diff --git a/usb/UcmTcpciCxClientSample/I2C.cpp b/usb/UcmTcpciCxClientSample/I2C.cpp
index 5a79fced..dee8069c 100644
--- a/usb/UcmTcpciCxClientSample/I2C.cpp
+++ b/usb/UcmTcpciCxClientSample/I2C.cpp
@@ -28,6 +28,7 @@ Environment:
 #pragma alloc_text (PAGE, I2CReadSynchronously)
 #pragma alloc_text (PAGE, I2CWriteSynchronously)
 #pragma alloc_text (PAGE, I2CPerformDeviceReset)
+#pragma alloc_text (PAGE, I2CReadSynchronouslyMultiple)
 #endif
 
 NTSTATUS
@@ -450,6 +451,10 @@ Return Value:
     NTSTATUS status;
     WDF_REQUEST_REUSE_PARAMS reuseParams;
 
+    // Static analysis cannot figure out the SPB_TRANSFER_LIST_ENTRY
+    // size but using an index variable quiets the warning.
+    ULONG index = 0;
+
     // Store the address.
     DeviceContext->I2CRegisterAddress = RegisterAddress;
 
@@ -484,13 +489,17 @@ Return Value:
     SPB_TRANSFER_LIST_AND_ENTRIES(I2C_TRANSFER_COUNT) transferList;
     SPB_TRANSFER_LIST_INIT(&(transferList.List), I2C_TRANSFER_COUNT);
 
-    transferList.List.Transfers[0] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
+    // Static analysis can't figure out the relationship between the transfer array size
+    // and the transfer count.
+    _Analysis_assume_(ARRAYSIZE(transferList.List.Transfers) == I2C_TRANSFER_COUNT);
+
+    transferList.List.Transfers[index] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
         SpbTransferDirectionToDevice,
         0,
         &DeviceContext->I2CRegisterAddress,
         REGISTER_ADDR_SIZE);
 
-    transferList.List.Transfers[1] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
+    transferList.List.Transfers[index + 1] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
         SpbTransferDirectionFromDevice,
         0,
         DeviceContext->I2CAsyncBuffer,
@@ -582,6 +591,10 @@ Return Value:
     ULONG_PTR bytesTransferred = 0;
     UINT8 transferBuffer[I2C_BUFFER_SIZE];
 
+    // Static analysis cannot figure out the SPB_TRANSFER_LIST_ENTRY
+    // size but using an index variable quiets the warning.
+    ULONG index = 0;
+
     WDFREQUEST request = DeviceContext->OutgoingRequests[RequestSource];
 
     // Reuse the preallocated WDFREQUEST for internal requests.
@@ -613,13 +626,17 @@ Return Value:
     SPB_TRANSFER_LIST_AND_ENTRIES(I2C_TRANSFER_COUNT) transferList;
     SPB_TRANSFER_LIST_INIT(&(transferList.List), I2C_TRANSFER_COUNT);
 
-    transferList.List.Transfers[0] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
+    // Static analysis can't figure out the relationship between the transfer array size
+    // and the transfer count.
+    _Analysis_assume_(ARRAYSIZE(transferList.List.Transfers) == I2C_TRANSFER_COUNT);
+
+    transferList.List.Transfers[index] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
         SpbTransferDirectionToDevice,
         0,
         &RegisterAddress,
         REGISTER_ADDR_SIZE);
 
-    transferList.List.Transfers[1] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
+    transferList.List.Transfers[index + 1] = SPB_TRANSFER_LIST_ENTRY_INIT_SIMPLE(
         SpbTransferDirectionFromDevice,
         0,
         transferBuffer,