[Qemu-commits] [qemu/qemu] 2e7bcd: vnc: Fix tight_detect_smooth_image() for lossless ...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 2e7bcdb99adbd8fc10ad9ddcf93bd2bf3c0f1f2d
      
https://github.com/qemu/qemu/commit/2e7bcdb99adbd8fc10ad9ddcf93bd2bf3c0f1f2d
  Author: Markus Armbruster <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc-enc-tight.c

  Log Message:
  -----------
  vnc: Fix tight_detect_smooth_image() for lossless case

VncTight member uint8_t quality is either (uint8_t)-1 for lossless or
less than 10 for lossy.

tight_detect_smooth_image() first promotes it to int, then compares
with -1.  Always unequal, so we always execute the lossy code.  Reads
beyond tight_conf[] and returns crap when quality is actually
lossless.

Compare to (uint8_t)-1 instead, like we do elsewhere.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: e3c1adf16e38714ebd761dd02517dd07760ba6d2
      
https://github.com/qemu/qemu/commit/e3c1adf16e38714ebd761dd02517dd07760ba6d2
  Author: Gonglei (Arei) <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc-jobs.c

  Log Message:
  -----------
  vnc: Fix qemu crashed when vnc client disconnect suddenly

Hi,

When I use RealVNC viewer client (http://www.realvnc.com/) to connect vnc 
server,
the client disconnect suddenly, and I click reconnect button immediately, then 
the Qemu crashed.

In the function vnc_worker_thread_loop, will call vnc_async_encoding_start
to set the local vs->output buffer by global queue's buffer. Then send 
rectangles to
the vnc client call function vnc_send_framebuffer_update. Finally, Under normal 
circumstances,
call vnc_async_encoding_end to set the global queue'buffer by the local 
vs->output conversely.

When the vnc client disconnect, the job->vs->csock will be set to -1. And the 
current prcoess
logic will goto disconnected partion without call function 
vnc_async_encoding_end.
But, the function vnc_send_framebuffer_update will call buffer_reserve, which
maybe call g_realloc reset the local vs's buffer, meaning the global queue's 
buffer is modified also.
If anyone use the original global queue's buffer memory will cause corruption 
and then crash qemu.

This patch assure the function vnc_async_encoding_end being called
even though the vnc client disconnect suddenly.

Signed-off-by: Gonglei <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 38ee14f4f33f8836fc0e209ca59c6ae8c6edf380
      
https://github.com/qemu/qemu/commit/38ee14f4f33f8836fc0e209ca59c6ae8c6edf380
  Author: Gerd Hoffmann <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  vnc: fix use-after-free in vnc_update_client_sync

Spotted by Coverity:

876     static int vnc_update_client_sync(VncState *vs, int has_dirty)
877     {

(1) Event freed_arg:    "vnc_update_client(VncState *, int)" frees "vs".  
[details]
Also see events:        [deref_arg]

878         int ret = vnc_update_client(vs, has_dirty);

(2) Event deref_arg:    Calling "vnc_jobs_join(VncState *)" dereferences freed 
pointer "vs". [details]
Also see events:        [freed_arg]

879         vnc_jobs_join(vs);
880         return ret;
881     }

Remove vnc_update_client_sync wrapper, replace it with an additional
argument to vnc_update_client, so we can so the sync properly in
vnc_update_client (i.e. skip it in case of a client disconnect).

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>


  Commit: b4c85ddcec24c60616aad9b3b7fc36ce19ba3ca4
      
https://github.com/qemu/qemu/commit/b4c85ddcec24c60616aad9b3b7fc36ce19ba3ca4
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c
    M ui/vnc.h

  Log Message:
  -----------
  ui/vnc: introduce VNC_DIRTY_PIXELS_PER_BIT macro

Signed-off-by: Peter Lieven <address@hidden>
Reviewed-by: Wenchao Xia <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 6cd859aa8a7fb60fe6edb89e628cddfe25dfe186
      
https://github.com/qemu/qemu/commit/6cd859aa8a7fb60fe6edb89e628cddfe25dfe186
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  ui/vnc: derive cmp_bytes from VNC_DIRTY_PIXELS_PER_BIT

this allows for setting VNC_DIRTY_PIXELS_PER_BIT to different
values than 16 if desired.

Reviewed-by: Wenchao Xia <address@hidden>
Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 12b316d4c173bf07f421ef9dc98ba4b53916066e
      
https://github.com/qemu/qemu/commit/12b316d4c173bf07f421ef9dc98ba4b53916066e
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c
    M ui/vnc.h

  Log Message:
  -----------
  ui/vnc: optimize dirty bitmap tracking

vnc_update_client currently scans the dirty bitmap of each client
bitwise which is a very costly operation if only few bits are dirty.
vnc_refresh_server_surface does almost the same.
this patch optimizes both by utilizing the heavily optimized
function find_next_bit to find the offset of the next dirty
bit in the dirty bitmaps.

The following artifical test (just the bitmap operation part) running
vnc_update_client 65536 times on a 2560x2048 surface illustrates the
performance difference:

All bits clean - vnc_update_client_new: 0.07 secs
 vnc_update_client_old: 10.98 secs

All bits dirty - vnc_update_client_new: 11.26 secs
 vnc_update_client_old: 20.19 secs

Few bits dirty - vnc_update_client_new: 0.08 secs
 vnc_update_client_old: 10.98 secs

The case for all bits dirty is still rather slow, this
is due to the implementation of find_and_clear_dirty_height.
This will be addresses in a separate patch.

Signed-off-by: Peter Lieven <address@hidden>
Reviewed-by: Wenchao Xia <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 863d7c91050551def59116f4f3b39fab7f1568f7
      
https://github.com/qemu/qemu/commit/863d7c91050551def59116f4f3b39fab7f1568f7
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  ui/vnc: optimize clearing in find_and_clear_dirty_height()

The following artifical test (just the bitmap operation part) running
vnc_update_client 65536 times on a 2560x2048 surface illustrates the
performance difference:

All bits clean - vnc_update_client_new: 0.07 secs
           vnc_update_client_new2: 0.07 secs
           vnc_update_client_old: 10.98 secs

All bits dirty - vnc_update_client_new: 11.26 secs
         - vnc_update_client_new2: 0.29 secs
           vnc_update_client_old: 20.19 secs

Few bits dirty - vnc_update_client_new: 0.07 secs
         - vnc_update_client_new2: 0.07 secs
           vnc_update_client_old: 10.98 secs

vnc_update_client_new2 shows the performance of vnc_update_client
with this patch added.

Comparing with the test run of the last patch the performance
is at least unchanged while it is significantly improved
for the all bits dirty case.

Signed-off-by: Peter Lieven <address@hidden>
Reviewed-by: Wenchao Xia <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 919372251cbfa9e43b0264fec475dd1eca23784f
      
https://github.com/qemu/qemu/commit/919372251cbfa9e43b0264fec475dd1eca23784f
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  ui/vnc: optimize setting in vnc_dpy_update()

Signed-off-by: Peter Lieven <address@hidden>
Reviewed-by: Wenchao Xia <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: e22492d332c5c80ea8cb1755c29ca9b6240c7716
      
https://github.com/qemu/qemu/commit/e22492d332c5c80ea8cb1755c29ca9b6240c7716
  Author: Peter Lieven <address@hidden>
  Date:   2014-03-10 (Mon, 10 Mar 2014)

  Changed paths:
    M ui/vnc.c

  Log Message:
  -----------
  ui/vnc: disable adaptive update calculations if not needed

Signed-off-by: Peter Lieven <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: fe6c53b4bbd2e83f82087bc5e37daa11ffc65879
      
https://github.com/qemu/qemu/commit/fe6c53b4bbd2e83f82087bc5e37daa11ffc65879
  Author: Peter Maydell <address@hidden>
  Date:   2014-03-11 (Tue, 11 Mar 2014)

  Changed paths:
    M ui/vnc-enc-tight.c
    M ui/vnc-jobs.c
    M ui/vnc.c
    M ui/vnc.h

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-1' into staging

vnc dirty tracking optinizations.
various vnc bugfixes.

# gpg: Signature made Mon 10 Mar 2014 12:39:54 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"

* remotes/kraxel/tags/pull-vnc-1:
  ui/vnc: disable adaptive update calculations if not needed
  ui/vnc: optimize setting in vnc_dpy_update()
  ui/vnc: optimize clearing in find_and_clear_dirty_height()
  ui/vnc: optimize dirty bitmap tracking
  ui/vnc: derive cmp_bytes from VNC_DIRTY_PIXELS_PER_BIT
  ui/vnc: introduce VNC_DIRTY_PIXELS_PER_BIT macro
  vnc: fix use-after-free in vnc_update_client_sync
  vnc: Fix qemu crashed when vnc client disconnect suddenly
  vnc: Fix tight_detect_smooth_image() for lossless case

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/118760dfc9f4...fe6c53b4bbd2