mirror of
https://github.com/qemu/qemu.git
synced 2024-12-15 15:33:29 +08:00
bdfca8a22f
job may be NULL if queue->exit is true. Check
it before dereference job.
Fixes: f31f9c1080
("vnc: add magic cookie to VncState")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
384 lines
11 KiB
C
384 lines
11 KiB
C
/*
|
|
* QEMU VNC display driver
|
|
*
|
|
* Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
|
|
* Copyright (C) 2006 Fabrice Bellard
|
|
* Copyright (C) 2009 Red Hat, Inc
|
|
* Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*/
|
|
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "vnc.h"
|
|
#include "vnc-jobs.h"
|
|
#include "qemu/sockets.h"
|
|
#include "qemu/main-loop.h"
|
|
#include "block/aio.h"
|
|
#include "trace.h"
|
|
|
|
/*
|
|
* Locking:
|
|
*
|
|
* There are three levels of locking:
|
|
* - jobs queue lock: for each operation on the queue (push, pop, isEmpty?)
|
|
* - VncDisplay global lock: mainly used for framebuffer updates to avoid
|
|
* screen corruption if the framebuffer is updated
|
|
* while the worker is doing something.
|
|
* - VncState::output lock: used to make sure the output buffer is not corrupted
|
|
* if two threads try to write on it at the same time
|
|
*
|
|
* While the VNC worker thread is working, the VncDisplay global lock is held
|
|
* to avoid screen corruption (this does not block vnc_refresh() because it
|
|
* uses trylock()) but the output lock is not held because the thread works on
|
|
* its own output buffer.
|
|
* When the encoding job is done, the worker thread will hold the output lock
|
|
* and copy its output buffer in vs->output.
|
|
*/
|
|
|
|
struct VncJobQueue {
|
|
QemuCond cond;
|
|
QemuMutex mutex;
|
|
QemuThread thread;
|
|
bool exit;
|
|
QTAILQ_HEAD(, VncJob) jobs;
|
|
};
|
|
|
|
typedef struct VncJobQueue VncJobQueue;
|
|
|
|
/*
|
|
* We use a single global queue, but most of the functions are
|
|
* already reentrant, so we can easily add more than one encoding thread
|
|
*/
|
|
static VncJobQueue *queue;
|
|
|
|
static void vnc_lock_queue(VncJobQueue *queue)
|
|
{
|
|
qemu_mutex_lock(&queue->mutex);
|
|
}
|
|
|
|
static void vnc_unlock_queue(VncJobQueue *queue)
|
|
{
|
|
qemu_mutex_unlock(&queue->mutex);
|
|
}
|
|
|
|
VncJob *vnc_job_new(VncState *vs)
|
|
{
|
|
VncJob *job = g_new0(VncJob, 1);
|
|
|
|
assert(vs->magic == VNC_MAGIC);
|
|
job->vs = vs;
|
|
vnc_lock_queue(queue);
|
|
QLIST_INIT(&job->rectangles);
|
|
vnc_unlock_queue(queue);
|
|
return job;
|
|
}
|
|
|
|
int vnc_job_add_rect(VncJob *job, int x, int y, int w, int h)
|
|
{
|
|
VncRectEntry *entry = g_new0(VncRectEntry, 1);
|
|
|
|
trace_vnc_job_add_rect(job->vs, job, x, y, w, h);
|
|
|
|
entry->rect.x = x;
|
|
entry->rect.y = y;
|
|
entry->rect.w = w;
|
|
entry->rect.h = h;
|
|
|
|
vnc_lock_queue(queue);
|
|
QLIST_INSERT_HEAD(&job->rectangles, entry, next);
|
|
vnc_unlock_queue(queue);
|
|
return 1;
|
|
}
|
|
|
|
void vnc_job_push(VncJob *job)
|
|
{
|
|
vnc_lock_queue(queue);
|
|
if (queue->exit || QLIST_EMPTY(&job->rectangles)) {
|
|
g_free(job);
|
|
} else {
|
|
QTAILQ_INSERT_TAIL(&queue->jobs, job, next);
|
|
qemu_cond_broadcast(&queue->cond);
|
|
}
|
|
vnc_unlock_queue(queue);
|
|
}
|
|
|
|
static bool vnc_has_job_locked(VncState *vs)
|
|
{
|
|
VncJob *job;
|
|
|
|
QTAILQ_FOREACH(job, &queue->jobs, next) {
|
|
if (job->vs == vs || !vs) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
void vnc_jobs_join(VncState *vs)
|
|
{
|
|
vnc_lock_queue(queue);
|
|
while (vnc_has_job_locked(vs)) {
|
|
qemu_cond_wait(&queue->cond, &queue->mutex);
|
|
}
|
|
vnc_unlock_queue(queue);
|
|
vnc_jobs_consume_buffer(vs);
|
|
}
|
|
|
|
void vnc_jobs_consume_buffer(VncState *vs)
|
|
{
|
|
bool flush;
|
|
|
|
vnc_lock_output(vs);
|
|
if (vs->jobs_buffer.offset) {
|
|
if (vs->ioc != NULL && buffer_empty(&vs->output)) {
|
|
if (vs->ioc_tag) {
|
|
g_source_remove(vs->ioc_tag);
|
|
}
|
|
if (vs->disconnecting == FALSE) {
|
|
vs->ioc_tag = qio_channel_add_watch(
|
|
vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_OUT,
|
|
vnc_client_io, vs, NULL);
|
|
}
|
|
}
|
|
buffer_move(&vs->output, &vs->jobs_buffer);
|
|
|
|
if (vs->job_update == VNC_STATE_UPDATE_FORCE) {
|
|
vs->force_update_offset = vs->output.offset;
|
|
}
|
|
vs->job_update = VNC_STATE_UPDATE_NONE;
|
|
}
|
|
flush = vs->ioc != NULL && vs->abort != true;
|
|
vnc_unlock_output(vs);
|
|
|
|
if (flush) {
|
|
vnc_flush(vs);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Copy data for local use
|
|
*/
|
|
static void vnc_async_encoding_start(VncState *orig, VncState *local)
|
|
{
|
|
buffer_init(&local->output, "vnc-worker-output");
|
|
local->sioc = NULL; /* Don't do any network work on this thread */
|
|
local->ioc = NULL; /* Don't do any network work on this thread */
|
|
|
|
local->vnc_encoding = orig->vnc_encoding;
|
|
local->features = orig->features;
|
|
local->vd = orig->vd;
|
|
local->lossy_rect = orig->lossy_rect;
|
|
local->write_pixels = orig->write_pixels;
|
|
local->client_pf = orig->client_pf;
|
|
local->client_be = orig->client_be;
|
|
local->tight = orig->tight;
|
|
local->zlib = orig->zlib;
|
|
local->hextile = orig->hextile;
|
|
local->zrle = orig->zrle;
|
|
local->client_width = orig->client_width;
|
|
local->client_height = orig->client_height;
|
|
}
|
|
|
|
static void vnc_async_encoding_end(VncState *orig, VncState *local)
|
|
{
|
|
buffer_free(&local->output);
|
|
orig->tight = local->tight;
|
|
orig->zlib = local->zlib;
|
|
orig->hextile = local->hextile;
|
|
orig->zrle = local->zrle;
|
|
orig->lossy_rect = local->lossy_rect;
|
|
}
|
|
|
|
static bool vnc_worker_clamp_rect(VncState *vs, VncJob *job, VncRect *rect)
|
|
{
|
|
trace_vnc_job_clamp_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
|
|
|
|
if (rect->x >= vs->client_width) {
|
|
goto discard;
|
|
}
|
|
rect->w = MIN(vs->client_width - rect->x, rect->w);
|
|
if (rect->w == 0) {
|
|
goto discard;
|
|
}
|
|
|
|
if (rect->y >= vs->client_height) {
|
|
goto discard;
|
|
}
|
|
rect->h = MIN(vs->client_height - rect->y, rect->h);
|
|
if (rect->h == 0) {
|
|
goto discard;
|
|
}
|
|
|
|
trace_vnc_job_clamped_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
|
|
return true;
|
|
|
|
discard:
|
|
trace_vnc_job_discard_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
|
|
return false;
|
|
}
|
|
|
|
static int vnc_worker_thread_loop(VncJobQueue *queue)
|
|
{
|
|
VncJob *job;
|
|
VncRectEntry *entry, *tmp;
|
|
VncState vs = {};
|
|
int n_rectangles;
|
|
int saved_offset;
|
|
|
|
vnc_lock_queue(queue);
|
|
while (QTAILQ_EMPTY(&queue->jobs) && !queue->exit) {
|
|
qemu_cond_wait(&queue->cond, &queue->mutex);
|
|
}
|
|
/* Here job can only be NULL if queue->exit is true */
|
|
job = QTAILQ_FIRST(&queue->jobs);
|
|
vnc_unlock_queue(queue);
|
|
|
|
if (queue->exit) {
|
|
return -1;
|
|
}
|
|
|
|
assert(job->vs->magic == VNC_MAGIC);
|
|
|
|
vnc_lock_output(job->vs);
|
|
if (job->vs->ioc == NULL || job->vs->abort == true) {
|
|
vnc_unlock_output(job->vs);
|
|
goto disconnected;
|
|
}
|
|
if (buffer_empty(&job->vs->output)) {
|
|
/*
|
|
* Looks like a NOP as it obviously moves no data. But it
|
|
* moves the empty buffer, so we don't have to malloc a new
|
|
* one for vs.output
|
|
*/
|
|
buffer_move_empty(&vs.output, &job->vs->output);
|
|
}
|
|
vnc_unlock_output(job->vs);
|
|
|
|
/* Make a local copy of vs and switch output buffers */
|
|
vnc_async_encoding_start(job->vs, &vs);
|
|
vs.magic = VNC_MAGIC;
|
|
|
|
/* Start sending rectangles */
|
|
n_rectangles = 0;
|
|
vnc_write_u8(&vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
|
|
vnc_write_u8(&vs, 0);
|
|
saved_offset = vs.output.offset;
|
|
vnc_write_u16(&vs, 0);
|
|
|
|
vnc_lock_display(job->vs->vd);
|
|
QLIST_FOREACH_SAFE(entry, &job->rectangles, next, tmp) {
|
|
int n;
|
|
|
|
if (job->vs->ioc == NULL) {
|
|
vnc_unlock_display(job->vs->vd);
|
|
/* Copy persistent encoding data */
|
|
vnc_async_encoding_end(job->vs, &vs);
|
|
goto disconnected;
|
|
}
|
|
|
|
if (vnc_worker_clamp_rect(&vs, job, &entry->rect)) {
|
|
n = vnc_send_framebuffer_update(&vs, entry->rect.x, entry->rect.y,
|
|
entry->rect.w, entry->rect.h);
|
|
|
|
if (n >= 0) {
|
|
n_rectangles += n;
|
|
}
|
|
}
|
|
g_free(entry);
|
|
}
|
|
trace_vnc_job_nrects(&vs, job, n_rectangles);
|
|
vnc_unlock_display(job->vs->vd);
|
|
|
|
/* Put n_rectangles at the beginning of the message */
|
|
vs.output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
|
|
vs.output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
|
|
|
|
vnc_lock_output(job->vs);
|
|
if (job->vs->ioc != NULL) {
|
|
buffer_move(&job->vs->jobs_buffer, &vs.output);
|
|
/* Copy persistent encoding data */
|
|
vnc_async_encoding_end(job->vs, &vs);
|
|
|
|
qemu_bh_schedule(job->vs->bh);
|
|
} else {
|
|
buffer_reset(&vs.output);
|
|
/* Copy persistent encoding data */
|
|
vnc_async_encoding_end(job->vs, &vs);
|
|
}
|
|
vnc_unlock_output(job->vs);
|
|
|
|
disconnected:
|
|
vnc_lock_queue(queue);
|
|
QTAILQ_REMOVE(&queue->jobs, job, next);
|
|
vnc_unlock_queue(queue);
|
|
qemu_cond_broadcast(&queue->cond);
|
|
g_free(job);
|
|
vs.magic = 0;
|
|
return 0;
|
|
}
|
|
|
|
static VncJobQueue *vnc_queue_init(void)
|
|
{
|
|
VncJobQueue *queue = g_new0(VncJobQueue, 1);
|
|
|
|
qemu_cond_init(&queue->cond);
|
|
qemu_mutex_init(&queue->mutex);
|
|
QTAILQ_INIT(&queue->jobs);
|
|
return queue;
|
|
}
|
|
|
|
static void vnc_queue_clear(VncJobQueue *q)
|
|
{
|
|
qemu_cond_destroy(&queue->cond);
|
|
qemu_mutex_destroy(&queue->mutex);
|
|
g_free(q);
|
|
queue = NULL; /* Unset global queue */
|
|
}
|
|
|
|
static void *vnc_worker_thread(void *arg)
|
|
{
|
|
VncJobQueue *queue = arg;
|
|
|
|
qemu_thread_get_self(&queue->thread);
|
|
|
|
while (!vnc_worker_thread_loop(queue)) ;
|
|
vnc_queue_clear(queue);
|
|
return NULL;
|
|
}
|
|
|
|
static bool vnc_worker_thread_running(void)
|
|
{
|
|
return queue; /* Check global queue */
|
|
}
|
|
|
|
void vnc_start_worker_thread(void)
|
|
{
|
|
VncJobQueue *q;
|
|
|
|
if (vnc_worker_thread_running())
|
|
return;
|
|
|
|
q = vnc_queue_init();
|
|
qemu_thread_create(&q->thread, "vnc_worker", vnc_worker_thread, q,
|
|
QEMU_THREAD_DETACHED);
|
|
queue = q; /* Set global queue */
|
|
}
|