Changeset 103317 in vbox for trunk

Timestamp:

Feb 12, 2024 4:02:29 PM (12 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

161614

Message:

DevEHCI: Cast bit-fields to RTGCPHYS before left shifting, otherwise some compilers may convert the type to int and sign extend, creating invalid physical addresses.

File:

• trunk/src/VBox/Devices/USB/DevEHCI.cpp (modified) (22 diffs)

trunk/src/VBox/Devices/USB/DevEHCI.cpp

@@ -1624 +1624 @@
             break; /* detect if list item is self-cycled. */
 
-        GCPhys = qtd.Next.Pointer << EHCI_TD_PTR_SHIFT;
+        GCPhys = (RTGCPHYS)qtd.Next.Pointer << EHCI_TD_PTR_SHIFT;
 
         if (GCPhys == GCPhysHead)
@@ -1660 +1660 @@
             break; /* detect if list item is self-cycled. */
 
-        GCPhys = qtd.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
+        GCPhys = (RTGCPHYS)qtd.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
 
         if (GCPhys == GCPhysHead)
@@ -1702 +1702 @@
           ((RTGCPHYS)qhd.Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT), qhd.Overlay.OrgQTD.Next.Terminate,
           ((RTGCPHYS)qhd.Overlay.OrgQTD.AltNext.Pointer << EHCI_TD_PTR_SHIFT), qhd.Overlay.OrgQTD.AltNext.Terminate));
-    ehciR3DumpSingleQTD(qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qhd.Overlay.OrgQTD, "");
-    ehciR3DumpQTD(pDevIns, qhd.Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT, true);
+    ehciR3DumpSingleQTD((RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qhd.Overlay.OrgQTD, "");
+    ehciR3DumpQTD(pDevIns, (RTGCPHYS)qhd.Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT, true);
 
     Assert(qhd.Next.Pointer || qhd.Next.Terminate);
@@ -1728 +1728 @@
             break;  /* Looping on itself. Bad guest! */
 
-        GCPhys = ptr.Pointer << EHCI_TD_PTR_SHIFT;
+        GCPhys = (RTGCPHYS)ptr.Pointer << EHCI_TD_PTR_SHIFT;
         if (GCPhys == GCPhysHead)
             break;  /* break the loop */
@@ -1768 +1768 @@
             {
                 Log2(("T%d Len=%x Offset=%x PG=%d IOC=%d Buffer=%x\n", i, pItd->Transaction[i].Length, pItd->Transaction[i].Offset, pItd->Transaction[i].PG, pItd->Transaction[i].IOC,
-                       pItd->Buffer.Buffer[pItd->Transaction[i].PG].Pointer << EHCI_BUFFER_PTR_SHIFT));
+                       (RTGCPHYS)pItd->Buffer.Buffer[pItd->Transaction[i].PG].Pointer << EHCI_BUFFER_PTR_SHIFT));
             }
         }
@@ -1785 +1785 @@
 
         /* next */
-        GCPhys = pItd->Next.Pointer << EHCI_TD_PTR_SHIFT;
+        GCPhys = (RTGCPHYS)pItd->Next.Pointer << EHCI_TD_PTR_SHIFT;
     }
 }
@@ -2326 +2326 @@
                                LogRelMax(10, ("EHCI: Crossing to undefined page %d in iTD at %RGp on completion.\n", pg + 1, pUrb->paTds[0].TdAddr));
 
-                            GCPhysBuf = pItd->Buffer.Buffer[pg + 1].Pointer << EHCI_BUFFER_PTR_SHIFT;
+                            GCPhysBuf = (RTGCPHYS)pItd->Buffer.Buffer[pg + 1].Pointer << EHCI_BUFFER_PTR_SHIFT;
                             ehciPhysWrite(pDevIns, GCPhysBuf, pb + cb1, cb2);
                         }
@@ -2410 +2410 @@
               ("Out of order completion %RGp != %RGp Endpoint=%#x\n", pUrb->paTds[0].TdAddr,
                ((RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT), pUrb->EndPt));
-    ehciR3ReadQTD(pDevIns, qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qtd);
+    ehciR3ReadQTD(pDevIns, (RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qtd);
 
     /*
@@ -2461 +2461 @@
             unsigned cbCurTransfer;
 
-            GCPhysBuf = qtd.Buffer.Buffer[i].Pointer << EHCI_BUFFER_PTR_SHIFT;
+            GCPhysBuf = (RTGCPHYS)qtd.Buffer.Buffer[i].Pointer << EHCI_BUFFER_PTR_SHIFT;
             if (i == 0)
                 GCPhysBuf += qtd.Buffer.Offset.Offset;
@@ -2601 +2601 @@
     ehciR3ReadQHD(pDevIns, pUrb->pHci->EdAddr, &qhd);
     Assert(pUrb->paTds[0].TdAddr == ((RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT));
-    ehciR3ReadQTD(pDevIns, qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qtd);
+    ehciR3ReadQTD(pDevIns, (RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT, &qtd);
 
     /*
@@ -2738 +2738 @@
             unsigned cbCurTransfer;
 
-            GCPhysBuf = pQtd->Buffer.Buffer[i].Pointer << EHCI_BUFFER_PTR_SHIFT;
+            GCPhysBuf = (RTGCPHYS)pQtd->Buffer.Buffer[i].Pointer << EHCI_BUFFER_PTR_SHIFT;
             if (i == 0)
                 GCPhysBuf += pQtd->Buffer.Offset.Offset;
@@ -2863 +2863 @@
                 const unsigned  pg = pItd->Transaction[i].PG;
 
-                GCPhysBuf = pItd->Buffer.Buffer[pg].Pointer << EHCI_BUFFER_PTR_SHIFT;
+                GCPhysBuf = (RTGCPHYS)pItd->Buffer.Buffer[pg].Pointer << EHCI_BUFFER_PTR_SHIFT;
                 GCPhysBuf += pItd->Transaction[i].Offset;
 
@@ -2878 +2878 @@
                        LogRelMax(10, ("EHCI: Crossing to undefined page %d in iTD at %RGp on submit.\n", pg + 1, pUrb->paTds[0].TdAddr));
 
-                    GCPhysBuf = pItd->Buffer.Buffer[pg + 1].Pointer << EHCI_BUFFER_PTR_SHIFT;
+                    GCPhysBuf = (RTGCPHYS)pItd->Buffer.Buffer[pg + 1].Pointer << EHCI_BUFFER_PTR_SHIFT;
                     ehciPhysRead(pDevIns, GCPhysBuf, &pUrb->abData[curOffset + cb1], cb2);
                 }
@@ -3025 +3025 @@
     {
         EHCI_QTD qtdNext;
-        RTGCPHYS GCPhysNextQTD = pQhd->Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT;
+        RTGCPHYS GCPhysNextQTD = (RTGCPHYS)pQhd->Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT;
 
         if (ehciR3IsTdInFlight(pThisCC, GCPhysNextQTD))
@@ -3074 +3074 @@
                 ehciR3QHSetupOverlay(pDevIns, pQhd, GCPhysQHD, &qtd, GCPhysQTD);
             else
-                Log2Func(("transfer %RGp in progress -> don't update the overlay\n", (RTGCPHYS)(pQhd->CurrQTD.Pointer << EHCI_TD_PTR_SHIFT)));
+                Log2Func(("transfer %RGp in progress -> don't update the overlay\n", (RTGCPHYS)pQhd->CurrQTD.Pointer << EHCI_TD_PTR_SHIFT));
 
             ehciR3SubmitQTD(pDevIns, pThis, pThisCC, GCPhysQHD, pQhd, GCPhysQTD, &qtd, iFrame);
@@ -3120 +3120 @@
         Assert(qtd.AltNext.Pointer);
         Log2(("Taking alternate pointer %RGp\n", (RTGCPHYS)(qtd.AltNext.Pointer << EHCI_TD_PTR_SHIFT)));
-        return qtd.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
+        return (RTGCPHYS)qtd.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
     }
     else
@@ -3127 +3127 @@
         if (qtd.Next.Terminate || !qtd.Next.Pointer)
             return 0;
-        return qtd.Next.Pointer << EHCI_TD_PTR_SHIFT;
+        return (RTGCPHYS)qtd.Next.Pointer << EHCI_TD_PTR_SHIFT;
     }
 }
@@ -3207 +3207 @@
     if (qhd.Overlay.OrgQTD.Token.Bits.Active)
     {
-        Assert(ehciR3IsTdInFlight(pThisCC, qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT));
-        GCPhysQTD = qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT;
+        Assert(ehciR3IsTdInFlight(pThisCC, (RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT));
+        GCPhysQTD = (RTGCPHYS)qhd.CurrQTD.Pointer << EHCI_TD_PTR_SHIFT;
     }
     else
@@ -3217 +3217 @@
         {
             Assert(qhd.Overlay.OrgQTD.AltNext.Pointer);
-            Log2(("Taking alternate pointer %RGp\n", (RTGCPHYS)(qhd.Overlay.OrgQTD.AltNext.Pointer << EHCI_TD_PTR_SHIFT)));
-            GCPhysQTD = qhd.Overlay.OrgQTD.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
+            Log2(("Taking alternate pointer %RGp\n", (RTGCPHYS)qhd.Overlay.OrgQTD.AltNext.Pointer << EHCI_TD_PTR_SHIFT));
+            GCPhysQTD = (RTGCPHYS)qhd.Overlay.OrgQTD.AltNext.Pointer << EHCI_TD_PTR_SHIFT;
         }
         else
@@ -3226 +3226 @@
                 GCPhysQTD = 0;
             else
-                GCPhysQTD = qhd.Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT;
+                GCPhysQTD = (RTGCPHYS)qhd.Overlay.OrgQTD.Next.Pointer << EHCI_TD_PTR_SHIFT;
         }
     }
@@ -3309 +3309 @@
 
         /* next */
-        GCPhys = ptr.Pointer << EHCI_TD_PTR_SHIFT;
+        GCPhys = (RTGCPHYS)ptr.Pointer << EHCI_TD_PTR_SHIFT;
         Assert(!(GCPhys & 0x1f));
         if (   GCPhys == GCPhysHead
@@ -3358 +3358 @@
     while (!FramePtr.Terminate && (pThis->cmd & EHCI_CMD_RUN))
     {
-        GCPhys = FramePtr.FrameAddr << EHCI_FRAME_LIST_NEXTPTR_SHIFT;
+        GCPhys = (RTGCPHYS)FramePtr.FrameAddr << EHCI_FRAME_LIST_NEXTPTR_SHIFT;
         /* Process the descriptor based on its type. Note that on the periodic
          * list, HCDs may (and do) mix iTDs and qHDs more or less freely.