Changeset 87207 in vbox

Timestamp:

Jan 8, 2021 9:42:52 PM (4 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

142160

Message:

VUSBUrb.cpp: Try clean up some old old hack (r25945, ++). bugref:9899

File:

• trunk/src/VBox/Devices/USB/VUSBUrb.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/USB/VUSBUrb.cpp

@@ -944 +944 @@
              */
             uint8_t *pbData = (uint8_t *)(pExtra->pMsg + 1);
-            if (&pExtra->pbCur[pUrb->cbData] > &pbData[pSetup->wLength])
+            if ((uintptr_t)&pExtra->pbCur[pUrb->cbData] > (uintptr_t)&pbData[pSetup->wLength])
             {
-                if (!pSetup->wLength) /* happens during iPhone detection with iTunes (correct?) */
+                /* In the device -> host direction, the device never returns more data than
+                   what was requested (wLength).  So, we can just cap cbData. */
+                ssize_t const cbLeft = &pbData[pSetup->wLength] - pExtra->pbCur;
+                if (pSetup->bmRequestType & VUSB_DIR_TO_HOST)
                 {
-                    Log(("%s: vusbUrbSubmitCtrl: pSetup->wLength == 0!! (iPhone)\n", pUrb->pszDesc));
+                    LogFlow(("%s: vusbUrbSubmitCtrl: Adjusting DATA request: %d -> %d\n", pUrb->pszDesc, pUrb->cbData, cbLeft));
+                    pUrb->cbData = cbLeft >= 0 ? (uint32_t)cbLeft : 0;
+                }
+                /* In the host -> direction it's undefined what happens if the host provides
+                   more data than what wLength inidicated.  However, in 2007, iPhone detection
+                   via iTunes would issue wLength=0 but provide a data URB which we needed to
+                   pass on to the device anyway, so we'll just quietly adjust wLength if it's
+                   zero and get on with the work.
+
+                   What confuses me (bird) here, though, is that we've already sent the SETUP
+                   URB to the device when we received it, and all we end up doing is an
+                   unnecessary memcpy and completing the URB, but never actually sending the
+                   data to the device.  So, I guess this stuff is still a little iffy.
+
+                   Note! We currently won't be doing any resizing, as we've disabled resizing
+                         in general.
+                   P.S.  We used to have a very strange (pUrb->cbData % pSetup->wLength) == 0
+                         thing too that joined the pUrb->cbData adjusting above. */
+                else if (   pSetup->wLength == 0
+                         && pUrb->cbData <= pExtra->cbMax)
+                {
+                    Log(("%s: vusbUrbSubmitCtrl: pAdjusting wLength: %u -> %u (iPhone hack)\n",
+                         pUrb->pszDesc, pSetup->wLength, pUrb->cbData));
                     pSetup->wLength = pUrb->cbData;
-                }
-
-                /* Variable length data transfers */
-                if (    (pSetup->bmRequestType & VUSB_DIR_TO_HOST)
-                    ||  pSetup->wLength == 0
-                    ||  (pUrb->cbData % pSetup->wLength) == 0)  /* magic which need explaining... */
-                {
-                    uint8_t *pbEnd = pbData + pSetup->wLength;
-                    int cbLeft = pbEnd - pExtra->pbCur;
-                    LogFlow(("%s: vusbUrbSubmitCtrl: Var DATA, pUrb->cbData %d -> %d\n", pUrb->pszDesc, pUrb->cbData, cbLeft));
-                    pUrb->cbData = cbLeft;
+                    Assert(cbLeft >= (ssize_t)pUrb->cbData);
                 }
                 else
                 {
-                    Log(("%s: vusbUrbSubmitCtrl: Stall at data stage!!\n", pUrb->pszDesc));
+                    Log(("%s: vusbUrbSubmitCtrl: Stall at data stage!! wLength=%u cbData=%d cbMax=%d cbLeft=%dz\n",
+                         pUrb->pszDesc, pSetup->wLength, pUrb->cbData, pExtra->cbMax, cbLeft));
                     vusbMsgStall(pUrb);
                     break;
@@ -992 +1008 @@
             {
                 /* get data for sending when completed. */
+                AssertStmt((ssize_t)pUrb->cbData <= pExtra->cbMax - (pExtra->pbCur - pbData), /* paranoia: checked above */
+                           pUrb->cbData = pExtra->cbMax - (uint32_t)RT_MIN(pExtra->pbCur - pbData, pExtra->cbMax));
                 memcpy(pExtra->pbCur, pUrb->abData, pUrb->cbData);