cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

vnc-jobs.c (10807B)


      1/*
      2 * QEMU VNC display driver
      3 *
      4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
      5 * Copyright (C) 2006 Fabrice Bellard
      6 * Copyright (C) 2009 Red Hat, Inc
      7 * Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
      8 *
      9 * Permission is hereby granted, free of charge, to any person obtaining a copy
     10 * of this software and associated documentation files (the "Software"), to deal
     11 * in the Software without restriction, including without limitation the rights
     12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     13 * copies of the Software, and to permit persons to whom the Software is
     14 * furnished to do so, subject to the following conditions:
     15 *
     16 * The above copyright notice and this permission notice shall be included in
     17 * all copies or substantial portions of the Software.
     18 *
     19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     25 * THE SOFTWARE.
     26 */
     27
     28
     29#include "qemu/osdep.h"
     30#include "vnc.h"
     31#include "vnc-jobs.h"
     32#include "qemu/sockets.h"
     33#include "qemu/main-loop.h"
     34#include "block/aio.h"
     35#include "trace.h"
     36
     37/*
     38 * Locking:
     39 *
     40 * There are three levels of locking:
     41 * - jobs queue lock: for each operation on the queue (push, pop, isEmpty?)
     42 * - VncDisplay global lock: mainly used for framebuffer updates to avoid
     43 *                      screen corruption if the framebuffer is updated
     44 *                      while the worker is doing something.
     45 * - VncState::output lock: used to make sure the output buffer is not corrupted
     46 *                          if two threads try to write on it at the same time
     47 *
     48 * While the VNC worker thread is working, the VncDisplay global lock is held
     49 * to avoid screen corruption (this does not block vnc_refresh() because it
     50 * uses trylock()) but the output lock is not held because the thread works on
     51 * its own output buffer.
     52 * When the encoding job is done, the worker thread will hold the output lock
     53 * and copy its output buffer in vs->output.
     54 */
     55
     56struct VncJobQueue {
     57    QemuCond cond;
     58    QemuMutex mutex;
     59    QemuThread thread;
     60    bool exit;
     61    QTAILQ_HEAD(, VncJob) jobs;
     62};
     63
     64typedef struct VncJobQueue VncJobQueue;
     65
     66/*
     67 * We use a single global queue, but most of the functions are
     68 * already reentrant, so we can easily add more than one encoding thread
     69 */
     70static VncJobQueue *queue;
     71
     72static void vnc_lock_queue(VncJobQueue *queue)
     73{
     74    qemu_mutex_lock(&queue->mutex);
     75}
     76
     77static void vnc_unlock_queue(VncJobQueue *queue)
     78{
     79    qemu_mutex_unlock(&queue->mutex);
     80}
     81
     82VncJob *vnc_job_new(VncState *vs)
     83{
     84    VncJob *job = g_new0(VncJob, 1);
     85
     86    assert(vs->magic == VNC_MAGIC);
     87    job->vs = vs;
     88    vnc_lock_queue(queue);
     89    QLIST_INIT(&job->rectangles);
     90    vnc_unlock_queue(queue);
     91    return job;
     92}
     93
     94int vnc_job_add_rect(VncJob *job, int x, int y, int w, int h)
     95{
     96    VncRectEntry *entry = g_new0(VncRectEntry, 1);
     97
     98    trace_vnc_job_add_rect(job->vs, job, x, y, w, h);
     99
    100    entry->rect.x = x;
    101    entry->rect.y = y;
    102    entry->rect.w = w;
    103    entry->rect.h = h;
    104
    105    vnc_lock_queue(queue);
    106    QLIST_INSERT_HEAD(&job->rectangles, entry, next);
    107    vnc_unlock_queue(queue);
    108    return 1;
    109}
    110
    111void vnc_job_push(VncJob *job)
    112{
    113    vnc_lock_queue(queue);
    114    if (queue->exit || QLIST_EMPTY(&job->rectangles)) {
    115        g_free(job);
    116    } else {
    117        QTAILQ_INSERT_TAIL(&queue->jobs, job, next);
    118        qemu_cond_broadcast(&queue->cond);
    119    }
    120    vnc_unlock_queue(queue);
    121}
    122
    123static bool vnc_has_job_locked(VncState *vs)
    124{
    125    VncJob *job;
    126
    127    QTAILQ_FOREACH(job, &queue->jobs, next) {
    128        if (job->vs == vs || !vs) {
    129            return true;
    130        }
    131    }
    132    return false;
    133}
    134
    135void vnc_jobs_join(VncState *vs)
    136{
    137    vnc_lock_queue(queue);
    138    while (vnc_has_job_locked(vs)) {
    139        qemu_cond_wait(&queue->cond, &queue->mutex);
    140    }
    141    vnc_unlock_queue(queue);
    142    vnc_jobs_consume_buffer(vs);
    143}
    144
    145void vnc_jobs_consume_buffer(VncState *vs)
    146{
    147    bool flush;
    148
    149    vnc_lock_output(vs);
    150    if (vs->jobs_buffer.offset) {
    151        if (vs->ioc != NULL && buffer_empty(&vs->output)) {
    152            if (vs->ioc_tag) {
    153                g_source_remove(vs->ioc_tag);
    154            }
    155            if (vs->disconnecting == FALSE) {
    156                vs->ioc_tag = qio_channel_add_watch(
    157                    vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_OUT,
    158                    vnc_client_io, vs, NULL);
    159            }
    160        }
    161        buffer_move(&vs->output, &vs->jobs_buffer);
    162
    163        if (vs->job_update == VNC_STATE_UPDATE_FORCE) {
    164            vs->force_update_offset = vs->output.offset;
    165        }
    166        vs->job_update = VNC_STATE_UPDATE_NONE;
    167    }
    168    flush = vs->ioc != NULL && vs->abort != true;
    169    vnc_unlock_output(vs);
    170
    171    if (flush) {
    172      vnc_flush(vs);
    173    }
    174}
    175
    176/*
    177 * Copy data for local use
    178 */
    179static void vnc_async_encoding_start(VncState *orig, VncState *local)
    180{
    181    buffer_init(&local->output, "vnc-worker-output");
    182    local->sioc = NULL; /* Don't do any network work on this thread */
    183    local->ioc = NULL; /* Don't do any network work on this thread */
    184
    185    local->vnc_encoding = orig->vnc_encoding;
    186    local->features = orig->features;
    187    local->vd = orig->vd;
    188    local->lossy_rect = orig->lossy_rect;
    189    local->write_pixels = orig->write_pixels;
    190    local->client_pf = orig->client_pf;
    191    local->client_be = orig->client_be;
    192    local->tight = orig->tight;
    193    local->zlib = orig->zlib;
    194    local->hextile = orig->hextile;
    195    local->zrle = orig->zrle;
    196    local->client_width = orig->client_width;
    197    local->client_height = orig->client_height;
    198}
    199
    200static void vnc_async_encoding_end(VncState *orig, VncState *local)
    201{
    202    buffer_free(&local->output);
    203    orig->tight = local->tight;
    204    orig->zlib = local->zlib;
    205    orig->hextile = local->hextile;
    206    orig->zrle = local->zrle;
    207    orig->lossy_rect = local->lossy_rect;
    208}
    209
    210static bool vnc_worker_clamp_rect(VncState *vs, VncJob *job, VncRect *rect)
    211{
    212    trace_vnc_job_clamp_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
    213
    214    if (rect->x >= vs->client_width) {
    215        goto discard;
    216    }
    217    rect->w = MIN(vs->client_width - rect->x, rect->w);
    218    if (rect->w == 0) {
    219        goto discard;
    220    }
    221
    222    if (rect->y >= vs->client_height) {
    223        goto discard;
    224    }
    225    rect->h = MIN(vs->client_height - rect->y, rect->h);
    226    if (rect->h == 0) {
    227        goto discard;
    228    }
    229
    230    trace_vnc_job_clamped_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
    231    return true;
    232
    233 discard:
    234    trace_vnc_job_discard_rect(vs, job, rect->x, rect->y, rect->w, rect->h);
    235    return false;
    236}
    237
    238static int vnc_worker_thread_loop(VncJobQueue *queue)
    239{
    240    VncJob *job;
    241    VncRectEntry *entry, *tmp;
    242    VncState vs = {};
    243    int n_rectangles;
    244    int saved_offset;
    245
    246    vnc_lock_queue(queue);
    247    while (QTAILQ_EMPTY(&queue->jobs) && !queue->exit) {
    248        qemu_cond_wait(&queue->cond, &queue->mutex);
    249    }
    250    /* Here job can only be NULL if queue->exit is true */
    251    job = QTAILQ_FIRST(&queue->jobs);
    252    vnc_unlock_queue(queue);
    253    assert(job->vs->magic == VNC_MAGIC);
    254
    255    if (queue->exit) {
    256        return -1;
    257    }
    258
    259    vnc_lock_output(job->vs);
    260    if (job->vs->ioc == NULL || job->vs->abort == true) {
    261        vnc_unlock_output(job->vs);
    262        goto disconnected;
    263    }
    264    if (buffer_empty(&job->vs->output)) {
    265        /*
    266         * Looks like a NOP as it obviously moves no data.  But it
    267         * moves the empty buffer, so we don't have to malloc a new
    268         * one for vs.output
    269         */
    270        buffer_move_empty(&vs.output, &job->vs->output);
    271    }
    272    vnc_unlock_output(job->vs);
    273
    274    /* Make a local copy of vs and switch output buffers */
    275    vnc_async_encoding_start(job->vs, &vs);
    276    vs.magic = VNC_MAGIC;
    277
    278    /* Start sending rectangles */
    279    n_rectangles = 0;
    280    vnc_write_u8(&vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
    281    vnc_write_u8(&vs, 0);
    282    saved_offset = vs.output.offset;
    283    vnc_write_u16(&vs, 0);
    284
    285    vnc_lock_display(job->vs->vd);
    286    QLIST_FOREACH_SAFE(entry, &job->rectangles, next, tmp) {
    287        int n;
    288
    289        if (job->vs->ioc == NULL) {
    290            vnc_unlock_display(job->vs->vd);
    291            /* Copy persistent encoding data */
    292            vnc_async_encoding_end(job->vs, &vs);
    293            goto disconnected;
    294        }
    295
    296        if (vnc_worker_clamp_rect(&vs, job, &entry->rect)) {
    297            n = vnc_send_framebuffer_update(&vs, entry->rect.x, entry->rect.y,
    298                                            entry->rect.w, entry->rect.h);
    299
    300            if (n >= 0) {
    301                n_rectangles += n;
    302            }
    303        }
    304        g_free(entry);
    305    }
    306    trace_vnc_job_nrects(&vs, job, n_rectangles);
    307    vnc_unlock_display(job->vs->vd);
    308
    309    /* Put n_rectangles at the beginning of the message */
    310    vs.output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
    311    vs.output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
    312
    313    vnc_lock_output(job->vs);
    314    if (job->vs->ioc != NULL) {
    315        buffer_move(&job->vs->jobs_buffer, &vs.output);
    316        /* Copy persistent encoding data */
    317        vnc_async_encoding_end(job->vs, &vs);
    318
    319        qemu_bh_schedule(job->vs->bh);
    320    }  else {
    321        buffer_reset(&vs.output);
    322        /* Copy persistent encoding data */
    323        vnc_async_encoding_end(job->vs, &vs);
    324    }
    325    vnc_unlock_output(job->vs);
    326
    327disconnected:
    328    vnc_lock_queue(queue);
    329    QTAILQ_REMOVE(&queue->jobs, job, next);
    330    vnc_unlock_queue(queue);
    331    qemu_cond_broadcast(&queue->cond);
    332    g_free(job);
    333    vs.magic = 0;
    334    return 0;
    335}
    336
    337static VncJobQueue *vnc_queue_init(void)
    338{
    339    VncJobQueue *queue = g_new0(VncJobQueue, 1);
    340
    341    qemu_cond_init(&queue->cond);
    342    qemu_mutex_init(&queue->mutex);
    343    QTAILQ_INIT(&queue->jobs);
    344    return queue;
    345}
    346
    347static void vnc_queue_clear(VncJobQueue *q)
    348{
    349    qemu_cond_destroy(&queue->cond);
    350    qemu_mutex_destroy(&queue->mutex);
    351    g_free(q);
    352    queue = NULL; /* Unset global queue */
    353}
    354
    355static void *vnc_worker_thread(void *arg)
    356{
    357    VncJobQueue *queue = arg;
    358
    359    qemu_thread_get_self(&queue->thread);
    360
    361    while (!vnc_worker_thread_loop(queue)) ;
    362    vnc_queue_clear(queue);
    363    return NULL;
    364}
    365
    366static bool vnc_worker_thread_running(void)
    367{
    368    return queue; /* Check global queue */
    369}
    370
    371void vnc_start_worker_thread(void)
    372{
    373    VncJobQueue *q;
    374
    375    if (vnc_worker_thread_running())
    376        return ;
    377
    378    q = vnc_queue_init();
    379    qemu_thread_create(&q->thread, "vnc_worker", vnc_worker_thread, q,
    380                       QEMU_THREAD_DETACHED);
    381    queue = q; /* Set global queue */
    382}