Changeset 39603 in vbox for trunk/src/VBox/Devices/Graphics

Timestamp:

Dec 14, 2011 11:12:56 AM (13 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

75377

Message:

crHgsmi: cleanup

Location:

trunk/src/VBox/Devices/Graphics

Files:

• DevVGA.h (modified) (1 diff)
• DevVGA_VBVA.cpp (modified) (2 diffs)
• DevVGA_VDMA.cpp (modified) (11 diffs)

trunk/src/VBox/Devices/Graphics/DevVGA.h

@@ -512 +512 @@
 int vboxVDMAConstruct(PVGASTATE pVGAState, uint32_t cPipeElements);
 int vboxVDMADestruct(PVBOXVDMAHOST pVdma);
-void vboxVDMAControl(PVBOXVDMAHOST pVdma, PVBOXVDMA_CTL pCmd);
-void vboxVDMACommand(PVBOXVDMAHOST pVdma, PVBOXVDMACBUF_DR pCmd);
+void vboxVDMAControl(PVBOXVDMAHOST pVdma, PVBOXVDMA_CTL pCmd, uint32_t cbCmd);
+void vboxVDMACommand(PVBOXVDMAHOST pVdma, PVBOXVDMACBUF_DR pCmd, uint32_t cbCmd);
 int vboxVDMASaveStateExecPrep(struct VBOXVDMAHOST *pVdma, PSSMHANDLE pSSM);
 int vboxVDMASaveStateExecDone(struct VBOXVDMAHOST *pVdma, PSSMHANDLE pSSM);

trunk/src/VBox/Devices/Graphics/DevVGA_VBVA.cpp

@@ -1657 +1657 @@
         case VBVA_VDMA_CMD:
         {
+            if (cbBuffer < VBoxSHGSMIBufferHeaderSize() + sizeof (VBOXVDMACBUF_DR))
+            {
+                rc = VERR_INVALID_PARAMETER;
+                break;
+            }
             PVBOXVDMACBUF_DR pCmd = (PVBOXVDMACBUF_DR)VBoxSHGSMIBufferData ((PVBOXSHGSMIHEADER)pvBuffer);
-            vboxVDMACommand(pVGAState->pVdma, pCmd);
+            vboxVDMACommand(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             rc = VINF_SUCCESS;
             break;
@@ -1664 +1669 @@
         case VBVA_VDMA_CTL:
         {
+            if (cbBuffer < VBoxSHGSMIBufferHeaderSize() + sizeof (VBOXVDMA_CTL))
+            {
+                rc = VERR_INVALID_PARAMETER;
+                break;
+            }
             PVBOXVDMA_CTL pCmd = (PVBOXVDMA_CTL)VBoxSHGSMIBufferData ((PVBOXSHGSMIHEADER)pvBuffer);
-            vboxVDMAControl(pVGAState->pVdma, pCmd);
+            vboxVDMAControl(pVGAState->pVdma, pCmd, cbBuffer - VBoxSHGSMIBufferHeaderSize());
             rc = VINF_SUCCESS;
             break;

trunk/src/VBox/Devices/Graphics/DevVGA_VDMA.cpp

@@ -157 +157 @@
 
 
-static int vboxVDMACrCtlPostAsync (PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, PFNVBOXVDMACRCTL_CALLBACK pfnCompletion, void *pvCompletion)
+static int vboxVDMACrCtlPostAsync (PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, uint32_t cbCmd, PFNVBOXVDMACRCTL_CALLBACK pfnCompletion, void *pvCompletion)
 {
     if (pVGAState->pDrv->pfnCrHgsmiControlProcess)
@@ -164 +164 @@
         pHdr->pfnCompletion = pfnCompletion;
         pHdr->pvCompletion = pvCompletion;
-        pVGAState->pDrv->pfnCrHgsmiControlProcess(pVGAState->pDrv, pCmd);
+        pVGAState->pDrv->pfnCrHgsmiControlProcess(pVGAState->pDrv, pCmd, cbCmd);
         return VINF_SUCCESS;
     }
@@ -173 +173 @@
 }
 
-static int vboxVDMACrCtlPost(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd)
+static int vboxVDMACrCtlPost(PVGASTATE pVGAState, PVBOXVDMACMD_CHROMIUM_CTL pCmd, uint32_t cbCmd)
 {
     RTSEMEVENT hComplEvent;
@@ -180 +180 @@
     if(RT_SUCCESS(rc))
     {
-        rc = vboxVDMACrCtlPostAsync (pVGAState, pCmd, vboxVDMACrCtlCbSetEvent, (void*)hComplEvent);
+        rc = vboxVDMACrCtlPostAsync (pVGAState, pCmd, cbCmd, vboxVDMACrCtlCbSetEvent, (void*)hComplEvent);
 #ifdef DEBUG_misha
         AssertRC(rc);
@@ -209 +209 @@
     {
         PVGASTATE pVGAState = pVdma->pVGAState;
-        pCmd->pvRamBase = pVGAState->vram_ptrR3;
-        int rc = vboxVDMACrCtlPost(pVGAState, &pCmd->Hdr);
+        pCmd->pvVRamBase = pVGAState->vram_ptrR3;
+        pCmd->cbVRam = pVGAState->vram_size;
+        int rc = vboxVDMACrCtlPost(pVGAState, &pCmd->Hdr, sizeof (*pCmd));
         AssertRC(rc);
         if (RT_SUCCESS(rc))
@@ -225 +226 @@
 
 /* check if this is external cmd to be passed to chromium backend */
-static bool vboxVDMACmdCheckCrCmd(struct VBOXVDMAHOST *pVdma, PVBOXVDMACBUF_DR pCmd)
-{
-    PVBOXVDMACMD pDmaCmd;
+static int vboxVDMACmdCheckCrCmd(struct VBOXVDMAHOST *pVdma, PVBOXVDMACBUF_DR pCmdDr, uint32_t cbCmdDr)
+{
+    PVBOXVDMACMD pDmaCmd = NULL;
+    uint32_t cbDmaCmd = 0;
     uint8_t * pvRam = pVdma->pVGAState->vram_ptrR3;
-    bool bCompleted = false;
-
-    if (pCmd->fFlags & VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR)
-        pDmaCmd = VBOXVDMACBUF_DR_TAIL(pCmd, VBOXVDMACMD);
-    else
-        pDmaCmd = NULL;
+    int rc = VINF_NOT_SUPPORTED;
+
+    if (pCmdDr->fFlags & VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR)
+    {
+        if (cbCmdDr < sizeof (*pCmdDr) + VBOXVDMACMD_HEADER_SIZE())
+        {
+            AssertMsgFailed(("invalid buffer data!"));
+            return VERR_INVALID_PARAMETER;
+        }
+
+        cbDmaCmd = pCmdDr->cbBuf;
+        if (cbDmaCmd < cbCmdDr - sizeof (*pCmdDr) - VBOXVDMACMD_HEADER_SIZE())
+        {
+            AssertMsgFailed(("invalid command buffer data!"));
+            return VERR_INVALID_PARAMETER;
+        }
+
+        pDmaCmd = VBOXVDMACBUF_DR_TAIL(pCmdDr, VBOXVDMACMD);
+    }
 
     if (pDmaCmd)
     {
-        uint32_t cbCmd = pCmd->cbBuf;
-        Assert(cbCmd >= VBOXVDMACMD_HEADER_SIZE());
-
-        if (cbCmd >= VBOXVDMACMD_HEADER_SIZE())
-        {
-            switch (pDmaCmd->enmType)
-            {
-                case VBOXVDMACMD_TYPE_CHROMIUM_CMD:
+        Assert(cbDmaCmd >= VBOXVDMACMD_HEADER_SIZE());
+        uint32_t cbBody = VBOXVDMACMD_BODY_SIZE(cbDmaCmd);
+
+        switch (pDmaCmd->enmType)
+        {
+            case VBOXVDMACMD_TYPE_CHROMIUM_CMD:
+            {
+                PVBOXVDMACMD_CHROMIUM_CMD pCrCmd = VBOXVDMACMD_BODY(pDmaCmd, VBOXVDMACMD_CHROMIUM_CMD);
+                if (cbBody < sizeof (*pCrCmd))
                 {
-                    PVBOXVDMACMD_CHROMIUM_CMD pCrCmd = VBOXVDMACMD_BODY(pDmaCmd, VBOXVDMACMD_CHROMIUM_CMD);
-                    PVGASTATE pVGAState = pVdma->pVGAState;
-                    bCompleted = true;
-                    if (pVGAState->pDrv->pfnCrHgsmiCommandProcess)
-                    {
-                        VBoxSHGSMICommandMarkAsynchCompletion(pCmd);
-                        pVGAState->pDrv->pfnCrHgsmiCommandProcess(pVGAState->pDrv, pCrCmd);
-                        break;
-                    }
-                    else
-                    {
-                        Assert(0);
-                    }
-
-                    int tmpRc = VBoxSHGSMICommandComplete (pVdma->pHgsmi, pCmd);
-                    AssertRC(tmpRc);
-//                uint32_t cBufs = pCrCmd->cBuffers;
-//                for (uint32_t i = 0; i < cBufs; ++i)
-//                {
-//                    PVBOXVDMACMD_CHROMIUM_BUFFER pBuf = &pCrCmd->aBuffers[i];
-//                    void *pvBuffer = pvRam + pBuf->offBuffer;
-//                    uint32_t cbBuffer = pBuf->cbBuffer;
-//                }
+                    AssertMsgFailed(("invalid chromium command buffer size!"));
+                    return VERR_INVALID_PARAMETER;
+                }
+                PVGASTATE pVGAState = pVdma->pVGAState;
+                rc = VINF_SUCCESS;
+                if (pVGAState->pDrv->pfnCrHgsmiCommandProcess)
+                {
+                    VBoxSHGSMICommandMarkAsynchCompletion(pCmdDr);
+                    pVGAState->pDrv->pfnCrHgsmiCommandProcess(pVGAState->pDrv, pCrCmd, cbBody);
                     break;
                 }
-                case VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER:
+                else
                 {
-                    PVBOXVDMACMD_DMA_BPB_TRANSFER pTransfer = VBOXVDMACMD_BODY(pDmaCmd, VBOXVDMACMD_DMA_BPB_TRANSFER);
-                    int rc = vboxVDMACmdExecBpbTransfer(pVdma, pTransfer, sizeof (*pTransfer));
+                    Assert(0);
+                }
+
+                int tmpRc = VBoxSHGSMICommandComplete (pVdma->pHgsmi, pCmdDr);
+                AssertRC(tmpRc);
+                break;
+            }
+            case VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER:
+            {
+                PVBOXVDMACMD_DMA_BPB_TRANSFER pTransfer = VBOXVDMACMD_BODY(pDmaCmd, VBOXVDMACMD_DMA_BPB_TRANSFER);
+                if (cbBody < sizeof (*pTransfer))
+                {
+                    AssertMsgFailed(("invalid bpb transfer buffer size!"));
+                    return VERR_INVALID_PARAMETER;
+                }
+
+                rc = vboxVDMACmdExecBpbTransfer(pVdma, pTransfer, sizeof (*pTransfer));
+                AssertRC(rc);
+                if (RT_SUCCESS(rc))
+                {
+                    pCmdDr->rc = VINF_SUCCESS;
+                    rc = VBoxSHGSMICommandComplete (pVdma->pHgsmi, pCmdDr);
                     AssertRC(rc);
-                    if (RT_SUCCESS(rc))
-                    {
-                        pCmd->rc = VINF_SUCCESS;
-                        rc = VBoxSHGSMICommandComplete (pVdma->pHgsmi, pCmd);
-                        AssertRC(rc);
-                        bCompleted = true;
-                    }
-                    break;
+                    rc = VINF_SUCCESS;
                 }
-                default:
-                    break;
-            }
-        }
-    }
-    return bCompleted;
+                break;
+            }
+            default:
+                break;
+        }
+    }
+    return rc;
 }
 
@@ -920 +936 @@
 #endif
 
-static void vboxVDMACommandProcess(PVBOXVDMAHOST pVdma, PVBOXVDMACBUF_DR pCmd)
+static void vboxVDMACommandProcess(PVBOXVDMAHOST pVdma, PVBOXVDMACBUF_DR pCmd, uint32_t cbCmd)
 {
     PHGSMIINSTANCE pHgsmi = pVdma->pHgsmi;
@@ -1171 +1187 @@
     if (pCmd)
     {
-        int rc = vboxVDMACrCtlPost(pVGAState, pCmd);
+        int rc = vboxVDMACrCtlPost(pVGAState, pCmd, sizeof (*pCmd));
         AssertRC(rc);
         if (RT_SUCCESS(rc))
@@ -1195 +1211 @@
     if (pCmd)
     {
-        int rc = vboxVDMACrCtlPost(pVGAState, pCmd);
+        int rc = vboxVDMACrCtlPost(pVGAState, pCmd, sizeof (*pCmd));
         AssertRC(rc);
         if (RT_SUCCESS(rc))
@@ -1211 +1227 @@
 
 
-void vboxVDMAControl(struct VBOXVDMAHOST *pVdma, PVBOXVDMA_CTL pCmd)
+void vboxVDMAControl(struct VBOXVDMAHOST *pVdma, PVBOXVDMA_CTL pCmd, uint32_t cbCmd)
 {
 #if 1
@@ -1264 +1280 @@
 }
 
-void vboxVDMACommand(struct VBOXVDMAHOST *pVdma, PVBOXVDMACBUF_DR pCmd)
-{
+void vboxVDMACommand(struct VBOXVDMAHOST *pVdma, PVBOXVDMACBUF_DR pCmd, uint32_t cbCmd)
+{
+    int rc = VERR_NOT_IMPLEMENTED;
+
 #ifdef VBOX_WITH_CRHGSMI
     /* chromium commands are processed by crhomium hgcm thread independently from our internal cmd processing pipeline
      * this is why we process them specially */
-    if (vboxVDMACmdCheckCrCmd(pVdma, pCmd))
+    rc = vboxVDMACmdCheckCrCmd(pVdma, pCmd, cbCmd);
+    if (rc == VINF_SUCCESS)
         return;
+
+    if (RT_FAILURE(rc))
+    {
+        pCmd->rc = rc;
+        rc = VBoxSHGSMICommandComplete (pVdma->pHgsmi, pCmd);
+        AssertRC(rc);
+        return;
+    }
 #endif
 
 #ifndef VBOX_VDMA_WITH_WORKERTHREAD
-    vboxVDMACommandProcess(pVdma, pCmd);
+    vboxVDMACommandProcess(pVdma, pCmd, cbCmd);
 #else
-    int rc = VERR_NOT_IMPLEMENTED;
 
 # ifdef DEBUG_misha