]> git.proxmox.com Git - qemu.git/blame - ui/vnc.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
cpus: Fix pausing TCG CPUs while in vCPU thread
[qemu.git] / ui / vnc.c
CommitLineData
7d510b8c
FB		 1/*
2 * QEMU VNC display driver
5fafdf24 3 *
7d510b8c
FB		 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
19a490bf 6 * Copyright (C) 2009 Red Hat, Inc
5fafdf24 7 *
7d510b8c
FB		 8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
19a490bf 27#include "vnc.h"
bd023f95 28#include "vnc-jobs.h"
9c17d615 29#include "sysemu/sysemu.h"
1de7afc9
PB		 30#include "qemu/sockets.h"
31#include "qemu/timer.h"
32#include "qemu/acl.h"
7b1b5d19 33#include "qapi/qmp/types.h"
2b54aa87 34#include "qmp-commands.h"
1de7afc9 35#include "qemu/osdep.h"
24236869 36
0f7b2864 37#define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
2430ffe4 38#define VNC_REFRESH_INTERVAL_INC 50
0f7b2864 39#define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
999342a0
CC		 40static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
41static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
24236869
FB		 42
43#include "vnc_keysym.h"
70848515
TS		 44#include "d3des.h"
45
753b4053 46static VncDisplay *vnc_display; /* needed for info vnc */
a9ce8590 47
d467b679 48static int vnc_cursor_define(VncState *vs);
7bc9318b 49static void vnc_release_modifiers(VncState *vs);
d467b679 50
8cf36489
GH		 51static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
52{
53#ifdef _VNC_DEBUG
54 static const char *mn[] = {
55 [0] = "undefined",
56 [VNC_SHARE_MODE_CONNECTING] = "connecting",
57 [VNC_SHARE_MODE_SHARED] = "shared",
58 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
59 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
60 };
61 fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
62 vs->csock, mn[vs->share_mode], mn[mode]);
63#endif
64
65 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
66 vs->vd->num_exclusive--;
67 }
68 vs->share_mode = mode;
69 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
70 vs->vd->num_exclusive++;
71 }
72}
73
1ff7df1a
AL		 74static char *addr_to_string(const char *format,
75 struct sockaddr_storage *sa,
76 socklen_t salen) {
77 char *addr;
78 char host[NI_MAXHOST];
79 char serv[NI_MAXSERV];
80 int err;
457772e6 81 size_t addrlen;
1ff7df1a
AL		 82
83 if ((err = getnameinfo((struct sockaddr *)sa, salen,
84 host, sizeof(host),
85 serv, sizeof(serv),
86 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
87 VNC_DEBUG("Cannot resolve address %d: %s\n",
88 err, gai_strerror(err));
89 return NULL;
90 }
91
457772e6 92 /* Enough for the existing format + the 2 vars we're
f425c278 93 * substituting in. */
457772e6 94 addrlen = strlen(format) + strlen(host) + strlen(serv);
7267c094 95 addr = g_malloc(addrlen + 1);
457772e6
AL		 96 snprintf(addr, addrlen, format, host, serv);
97 addr[addrlen] = '\0';
1ff7df1a
AL		 98
99 return addr;
100}
101
2f9606b3
AL		 102
103char *vnc_socket_local_addr(const char *format, int fd) {
1ff7df1a
AL		 104 struct sockaddr_storage sa;
105 socklen_t salen;
106
107 salen = sizeof(sa);
108 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
109 return NULL;
110
111 return addr_to_string(format, &sa, salen);
112}
113
2f9606b3 114char *vnc_socket_remote_addr(const char *format, int fd) {
1ff7df1a
AL		 115 struct sockaddr_storage sa;
116 socklen_t salen;
117
118 salen = sizeof(sa);
119 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
120 return NULL;
121
122 return addr_to_string(format, &sa, salen);
123}
124
d96fd29c
LC		 125static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
126 socklen_t salen)
127{
128 char host[NI_MAXHOST];
129 char serv[NI_MAXSERV];
130 int err;
131
132 if ((err = getnameinfo((struct sockaddr *)sa, salen,
133 host, sizeof(host),
134 serv, sizeof(serv),
135 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
136 VNC_DEBUG("Cannot resolve address %d: %s\n",
137 err, gai_strerror(err));
138 return -1;
139 }
140
141 qdict_put(qdict, "host", qstring_from_str(host));
142 qdict_put(qdict, "service", qstring_from_str(serv));
dc0d4efc 143 qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
d96fd29c
LC		 144
145 return 0;
146}
147
a7789382 148static int vnc_server_addr_put(QDict *qdict, int fd)
d96fd29c
LC		 149{
150 struct sockaddr_storage sa;
151 socklen_t salen;
152
153 salen = sizeof(sa);
154 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
155 return -1;
156 }
157
158 return put_addr_qdict(qdict, &sa, salen);
159}
160
161static int vnc_qdict_remote_addr(QDict *qdict, int fd)
162{
163 struct sockaddr_storage sa;
164 socklen_t salen;
165
166 salen = sizeof(sa);
167 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
168 return -1;
169 }
170
171 return put_addr_qdict(qdict, &sa, salen);
172}
173
1ff7df1a
AL		 174static const char *vnc_auth_name(VncDisplay *vd) {
175 switch (vd->auth) {
176 case VNC_AUTH_INVALID:
177 return "invalid";
178 case VNC_AUTH_NONE:
179 return "none";
180 case VNC_AUTH_VNC:
181 return "vnc";
182 case VNC_AUTH_RA2:
183 return "ra2";
184 case VNC_AUTH_RA2NE:
185 return "ra2ne";
186 case VNC_AUTH_TIGHT:
187 return "tight";
188 case VNC_AUTH_ULTRA:
189 return "ultra";
190 case VNC_AUTH_TLS:
191 return "tls";
192 case VNC_AUTH_VENCRYPT:
193#ifdef CONFIG_VNC_TLS
194 switch (vd->subauth) {
195 case VNC_AUTH_VENCRYPT_PLAIN:
196 return "vencrypt+plain";
197 case VNC_AUTH_VENCRYPT_TLSNONE:
198 return "vencrypt+tls+none";
199 case VNC_AUTH_VENCRYPT_TLSVNC:
200 return "vencrypt+tls+vnc";
201 case VNC_AUTH_VENCRYPT_TLSPLAIN:
202 return "vencrypt+tls+plain";
203 case VNC_AUTH_VENCRYPT_X509NONE:
204 return "vencrypt+x509+none";
205 case VNC_AUTH_VENCRYPT_X509VNC:
206 return "vencrypt+x509+vnc";
207 case VNC_AUTH_VENCRYPT_X509PLAIN:
208 return "vencrypt+x509+plain";
28a76be8
AL		 209 case VNC_AUTH_VENCRYPT_TLSSASL:
210 return "vencrypt+tls+sasl";
211 case VNC_AUTH_VENCRYPT_X509SASL:
212 return "vencrypt+x509+sasl";
1ff7df1a
AL		 213 default:
214 return "vencrypt";
215 }
216#else
217 return "vencrypt";
218#endif
2f9606b3 219 case VNC_AUTH_SASL:
28a76be8 220 return "sasl";
1ff7df1a
AL		 221 }
222 return "unknown";
223}
224
a7789382
LC		 225static int vnc_server_info_put(QDict *qdict)
226{
227 if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
228 return -1;
229 }
230
231 qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
232 return 0;
233}
234
4a80dba3 235static void vnc_client_cache_auth(VncState *client)
1ff7df1a 236{
2ded6ad7 237#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
d96fd29c 238 QDict *qdict;
2ded6ad7 239#endif
1ff7df1a 240
4a80dba3
LC		 241 if (!client->info) {
242 return;
d96fd29c 243 }
1263b7d6 244
2ded6ad7 245#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
4a80dba3 246 qdict = qobject_to_qdict(client->info);
2ded6ad7 247#endif
4a80dba3 248
1263b7d6
AL		 249#ifdef CONFIG_VNC_TLS
250 if (client->tls.session &&
d96fd29c
LC		 251 client->tls.dname) {
252 qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
253 }
1263b7d6
AL		 254#endif
255#ifdef CONFIG_VNC_SASL
256 if (client->sasl.conn &&
d96fd29c 257 client->sasl.username) {
76825067
LC		 258 qdict_put(qdict, "sasl_username",
259 qstring_from_str(client->sasl.username));
d96fd29c 260 }
1263b7d6 261#endif
4a80dba3 262}
d96fd29c 263
4a80dba3
LC		 264static void vnc_client_cache_addr(VncState *client)
265{
266 QDict *qdict;
267
268 qdict = qdict_new();
269 if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
270 QDECREF(qdict);
271 /* XXX: how to report the error? */
272 return;
273 }
274
275 client->info = QOBJECT(qdict);
1ff7df1a
AL		 276}
277
586153d9
LC		 278static void vnc_qmp_event(VncState *vs, MonitorEvent event)
279{
280 QDict *server;
281 QObject *data;
282
283 if (!vs->info) {
284 return;
285 }
286
287 server = qdict_new();
288 if (vnc_server_info_put(server) < 0) {
289 QDECREF(server);
290 return;
291 }
292
293 data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
294 vs->info, QOBJECT(server));
295
296 monitor_protocol_event(event, data);
297
298 qobject_incref(vs->info);
299 qobject_decref(data);
300}
301
2b54aa87 302static VncClientInfo *qmp_query_vnc_client(const VncState *client)
a9ce8590 303{
2b54aa87
LC		 304 struct sockaddr_storage sa;
305 socklen_t salen = sizeof(sa);
306 char host[NI_MAXHOST];
307 char serv[NI_MAXSERV];
308 VncClientInfo *info;
309
310 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
311 return NULL;
312 }
313
314 if (getnameinfo((struct sockaddr *)&sa, salen,
315 host, sizeof(host),
316 serv, sizeof(serv),
317 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
318 return NULL;
319 }
d96fd29c 320
2b54aa87
LC		 321 info = g_malloc0(sizeof(*info));
322 info->host = g_strdup(host);
323 info->service = g_strdup(serv);
324 info->family = g_strdup(inet_strfamily(sa.ss_family));
d96fd29c
LC		 325
326#ifdef CONFIG_VNC_TLS
2b54aa87
LC		 327 if (client->tls.session && client->tls.dname) {
328 info->has_x509_dname = true;
329 info->x509_dname = g_strdup(client->tls.dname);
330 }
d96fd29c
LC		 331#endif
332#ifdef CONFIG_VNC_SASL
2b54aa87
LC		 333 if (client->sasl.conn && client->sasl.username) {
334 info->has_sasl_username = true;
335 info->sasl_username = g_strdup(client->sasl.username);
d96fd29c 336 }
2b54aa87 337#endif
1ff7df1a 338
2b54aa87 339 return info;
d96fd29c 340}
1ff7df1a 341
2b54aa87 342VncInfo *qmp_query_vnc(Error **errp)
d96fd29c 343{
2b54aa87
LC		 344 VncInfo *info = g_malloc0(sizeof(*info));
345
d96fd29c 346 if (vnc_display == NULL || vnc_display->display == NULL) {
2b54aa87 347 info->enabled = false;
d96fd29c 348 } else {
2b54aa87
LC		 349 VncClientInfoList *cur_item = NULL;
350 struct sockaddr_storage sa;
351 socklen_t salen = sizeof(sa);
352 char host[NI_MAXHOST];
353 char serv[NI_MAXSERV];
41b4bef6 354 VncState *client;
1ff7df1a 355
2b54aa87
LC		 356 info->enabled = true;
357
358 /* for compatibility with the original command */
359 info->has_clients = true;
360
41b4bef6 361 QTAILQ_FOREACH(client, &vnc_display->clients, next) {
2b54aa87
LC		 362 VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
363 cinfo->value = qmp_query_vnc_client(client);
364
365 /* XXX: waiting for the qapi to support GSList */
366 if (!cur_item) {
367 info->clients = cur_item = cinfo;
368 } else {
369 cur_item->next = cinfo;
370 cur_item = cinfo;
1ff7df1a 371 }
d96fd29c
LC		 372 }
373
417b0b88
PB		 374 if (vnc_display->lsock == -1) {
375 return info;
376 }
377
2b54aa87
LC		 378 if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
379 &salen) == -1) {
380 error_set(errp, QERR_UNDEFINED_ERROR);
381 goto out_error;
382 }
d96fd29c 383
2b54aa87
LC		 384 if (getnameinfo((struct sockaddr *)&sa, salen,
385 host, sizeof(host),
386 serv, sizeof(serv),
387 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
388 error_set(errp, QERR_UNDEFINED_ERROR);
389 goto out_error;
1ff7df1a 390 }
2b54aa87
LC		 391
392 info->has_host = true;
393 info->host = g_strdup(host);
394
395 info->has_service = true;
396 info->service = g_strdup(serv);
397
398 info->has_family = true;
399 info->family = g_strdup(inet_strfamily(sa.ss_family));
400
401 info->has_auth = true;
402 info->auth = g_strdup(vnc_auth_name(vnc_display));
a9ce8590 403 }
2b54aa87
LC		 404
405 return info;
406
407out_error:
408 qapi_free_VncInfo(info);
409 return NULL;
a9ce8590
FB		 410}
411
24236869
FB		 412/* TODO
413 1) Get the queue working for IO.
414 2) there is some weirdness when using the -S option (the screen is grey
415 and not totally invalidated
416 3) resolutions > 1024
417*/
418
2430ffe4 419static int vnc_update_client(VncState *vs, int has_dirty);
bd023f95 420static int vnc_update_client_sync(VncState *vs, int has_dirty);
198a0039 421static void vnc_disconnect_start(VncState *vs);
24236869 422
753b4053 423static void vnc_colordepth(VncState *vs);
1fc62412
SS		 424static void framebuffer_update_request(VncState *vs, int incremental,
425 int x_position, int y_position,
426 int w, int h);
0f7b2864 427static void vnc_refresh(DisplayChangeListener *dcl);
1fc62412 428static int vnc_refresh_server_surface(VncDisplay *vd);
7eac3a87 429
7c20b4a3 430static void vnc_dpy_update(DisplayChangeListener *dcl,
7c20b4a3 431 int x, int y, int w, int h)
24236869 432{
24236869 433 int i;
21ef45d7 434 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
1fc62412 435 struct VncSurface *s = &vd->guest;
d39fa6d8
GH		 436 int width = surface_width(vd->ds);
437 int height = surface_height(vd->ds);
24236869
FB		 438
439 h += y;
440
0486e8a7
AZ		 441 /* round x down to ensure the loop only spans one 16-pixel block per,
442 iteration. otherwise, if (x % 16) != 0, the last iteration may span
443 two 16-pixel blocks but we only mark the first as dirty
444 */
445 w += (x % 16);
446 x -= (x % 16);
447
9f64916d
GH		 448 x = MIN(x, width);
449 y = MIN(y, height);
450 w = MIN(x + w, width) - x;
451 h = MIN(h, height);
788abf8e 452
24236869 453 for (; y < h; y++)
28a76be8 454 for (i = 0; i < w; i += 16)
bc2429b9 455 set_bit((x + i) / 16, s->dirty[y]);
24236869
FB		 456}
457
70a4568f
CC		 458void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
459 int32_t encoding)
24236869
FB		 460{
461 vnc_write_u16(vs, x);
462 vnc_write_u16(vs, y);
463 vnc_write_u16(vs, w);
464 vnc_write_u16(vs, h);
465
466 vnc_write_s32(vs, encoding);
467}
468
2f9606b3 469void buffer_reserve(Buffer *buffer, size_t len)
89064286
AL		 470{
471 if ((buffer->capacity - buffer->offset) < len) {
28a76be8 472 buffer->capacity += (len + 1024);
7267c094 473 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
28a76be8
AL		 474 if (buffer->buffer == NULL) {
475 fprintf(stderr, "vnc: out of memory\n");
476 exit(1);
477 }
89064286
AL		 478 }
479}
480
71a8cdec 481static int buffer_empty(Buffer *buffer)
89064286
AL		 482{
483 return buffer->offset == 0;
484}
485
7536ee4b 486uint8_t *buffer_end(Buffer *buffer)
89064286
AL		 487{
488 return buffer->buffer + buffer->offset;
489}
490
2f9606b3 491void buffer_reset(Buffer *buffer)
89064286 492{
28a76be8 493 buffer->offset = 0;
89064286
AL		 494}
495
5d418e3b
CC		 496void buffer_free(Buffer *buffer)
497{
7267c094 498 g_free(buffer->buffer);
5d418e3b
CC		 499 buffer->offset = 0;
500 buffer->capacity = 0;
501 buffer->buffer = NULL;
502}
503
2f9606b3 504void buffer_append(Buffer *buffer, const void *data, size_t len)
89064286
AL		 505{
506 memcpy(buffer->buffer + buffer->offset, data, len);
507 buffer->offset += len;
508}
509
32ed2680
TH		 510void buffer_advance(Buffer *buf, size_t len)
511{
512 memmove(buf->buffer, buf->buffer + len,
513 (buf->offset - len));
514 buf->offset -= len;
515}
516
621aaeb9
GH		 517static void vnc_desktop_resize(VncState *vs)
518{
d39fa6d8 519 DisplaySurface *ds = vs->vd->ds;
621aaeb9
GH		 520
521 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
522 return;
523 }
d39fa6d8
GH		 524 if (vs->client_width == surface_width(ds) &&
525 vs->client_height == surface_height(ds)) {
1d4b638a
GH		 526 return;
527 }
d39fa6d8
GH		 528 vs->client_width = surface_width(ds);
529 vs->client_height = surface_height(ds);
bd023f95 530 vnc_lock_output(vs);
621aaeb9
GH		 531 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
532 vnc_write_u8(vs, 0);
533 vnc_write_u16(vs, 1); /* number of rects */
5862d195 534 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
621aaeb9 535 VNC_ENCODING_DESKTOPRESIZE);
bd023f95 536 vnc_unlock_output(vs);
621aaeb9
GH		 537 vnc_flush(vs);
538}
539
bd023f95
CC		 540static void vnc_abort_display_jobs(VncDisplay *vd)
541{
542 VncState *vs;
543
544 QTAILQ_FOREACH(vs, &vd->clients, next) {
545 vnc_lock_output(vs);
546 vs->abort = true;
547 vnc_unlock_output(vs);
548 }
549 QTAILQ_FOREACH(vs, &vd->clients, next) {
550 vnc_jobs_join(vs);
551 }
552 QTAILQ_FOREACH(vs, &vd->clients, next) {
553 vnc_lock_output(vs);
554 vs->abort = false;
555 vnc_unlock_output(vs);
556 }
557}
bd023f95 558
9f64916d
GH		 559int vnc_server_fb_stride(VncDisplay *vd)
560{
561 return pixman_image_get_stride(vd->server);
562}
563
564void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
565{
566 uint8_t *ptr;
567
568 ptr = (uint8_t *)pixman_image_get_data(vd->server);
569 ptr += y * vnc_server_fb_stride(vd);
570 ptr += x * VNC_SERVER_FB_BYTES;
571 return ptr;
572}
573
c12aeb86 574static void vnc_dpy_switch(DisplayChangeListener *dcl,
c12aeb86 575 DisplaySurface *surface)
24236869 576{
21ef45d7 577 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
41b4bef6 578 VncState *vs;
1fc62412 579
bd023f95
CC		 580 vnc_abort_display_jobs(vd);
581
1fc62412 582 /* server surface */
9f64916d 583 qemu_pixman_image_unref(vd->server);
d39fa6d8 584 vd->ds = surface;
9f64916d 585 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
d39fa6d8
GH		 586 surface_width(vd->ds),
587 surface_height(vd->ds),
9f64916d 588 NULL, 0);
24236869 589
6baebed7 590 /* guest surface */
9f64916d 591#if 0 /* FIXME */
1fc62412 592 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
a528b80c 593 console_color_init(ds);
9f64916d
GH		 594#endif
595 qemu_pixman_image_unref(vd->guest.fb);
d39fa6d8
GH		 596 vd->guest.fb = pixman_image_ref(surface->image);
597 vd->guest.format = surface->format;
1fc62412 598 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
24236869 599
41b4bef6 600 QTAILQ_FOREACH(vs, &vd->clients, next) {
1fc62412 601 vnc_colordepth(vs);
1d4b638a 602 vnc_desktop_resize(vs);
d467b679
GH		 603 if (vs->vd->cursor) {
604 vnc_cursor_define(vs);
605 }
1fc62412 606 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
753b4053
AL		 607 }
608}
609
3512779a 610/* fastest code */
9f64916d 611static void vnc_write_pixels_copy(VncState *vs,
d467b679 612 void *pixels, int size)
3512779a
FB		 613{
614 vnc_write(vs, pixels, size);
615}
616
617/* slowest but generic code. */
70a4568f 618void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
3512779a 619{
7eac3a87 620 uint8_t r, g, b;
1fc62412 621
9f64916d
GH		 622#if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
623 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
624 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
625 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
626#else
627# error need some bits here if you change VNC_SERVER_FB_FORMAT
628#endif
629 v = (r << vs->client_pf.rshift) |
630 (g << vs->client_pf.gshift) |
631 (b << vs->client_pf.bshift);
632 switch (vs->client_pf.bytes_per_pixel) {
3512779a
FB		 633 case 1:
634 buf[0] = v;
635 break;
636 case 2:
9f64916d 637 if (vs->client_be) {
3512779a
FB		 638 buf[0] = v >> 8;
639 buf[1] = v;
640 } else {
641 buf[1] = v >> 8;
642 buf[0] = v;
643 }
644 break;
645 default:
646 case 4:
9f64916d 647 if (vs->client_be) {
3512779a
FB		 648 buf[0] = v >> 24;
649 buf[1] = v >> 16;
650 buf[2] = v >> 8;
651 buf[3] = v;
652 } else {
653 buf[3] = v >> 24;
654 buf[2] = v >> 16;
655 buf[1] = v >> 8;
656 buf[0] = v;
657 }
658 break;
659 }
660}
661
9f64916d 662static void vnc_write_pixels_generic(VncState *vs,
d467b679 663 void *pixels1, int size)
3512779a 664{
3512779a 665 uint8_t buf[4];
3512779a 666
9f64916d 667 if (VNC_SERVER_FB_BYTES == 4) {
7eac3a87
AL		 668 uint32_t *pixels = pixels1;
669 int n, i;
670 n = size >> 2;
9f64916d 671 for (i = 0; i < n; i++) {
7eac3a87 672 vnc_convert_pixel(vs, buf, pixels[i]);
9f64916d 673 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
7eac3a87 674 }
3512779a
FB		 675 }
676}
677
a885211e 678int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869
FB		 679{
680 int i;
60fe76f3 681 uint8_t *row;
1fc62412 682 VncDisplay *vd = vs->vd;
24236869 683
9f64916d 684 row = vnc_server_fb_ptr(vd, x, y);
24236869 685 for (i = 0; i < h; i++) {
9f64916d
GH		 686 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
687 row += vnc_server_fb_stride(vd);
24236869 688 }
a885211e 689 return 1;
24236869
FB		 690}
691
bd023f95 692int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869 693{
a885211e
CC		 694 int n = 0;
695
fb437313 696 switch(vs->vnc_encoding) {
28a76be8 697 case VNC_ENCODING_ZLIB:
a885211e 698 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
28a76be8
AL		 699 break;
700 case VNC_ENCODING_HEXTILE:
701 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
a885211e 702 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
28a76be8 703 break;
380282b0
CC		 704 case VNC_ENCODING_TIGHT:
705 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
706 break;
efe556ad
CC		 707 case VNC_ENCODING_TIGHT_PNG:
708 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
709 break;
148954fa
CC		 710 case VNC_ENCODING_ZRLE:
711 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
712 break;
713 case VNC_ENCODING_ZYWRLE:
714 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
715 break;
28a76be8
AL		 716 default:
717 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
a885211e 718 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
28a76be8 719 break;
fb437313 720 }
a885211e 721 return n;
24236869
FB		 722}
723
753b4053 724static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
24236869 725{
3e28c9ad 726 /* send bitblit op to the vnc client */
bd023f95 727 vnc_lock_output(vs);
46a183da 728 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
24236869
FB		 729 vnc_write_u8(vs, 0);
730 vnc_write_u16(vs, 1); /* number of rects */
29fa4ed9 731 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
24236869
FB		 732 vnc_write_u16(vs, src_x);
733 vnc_write_u16(vs, src_y);
bd023f95 734 vnc_unlock_output(vs);
24236869
FB		 735 vnc_flush(vs);
736}
737
7c20b4a3 738static void vnc_dpy_copy(DisplayChangeListener *dcl,
7c20b4a3
GH		 739 int src_x, int src_y,
740 int dst_x, int dst_y, int w, int h)
753b4053 741{
21ef45d7 742 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
198a0039 743 VncState *vs, *vn;
1fc62412
SS		 744 uint8_t *src_row;
745 uint8_t *dst_row;
9f64916d 746 int i, x, y, pitch, inc, w_lim, s;
1fc62412 747 int cmp_bytes;
198a0039 748
1fc62412 749 vnc_refresh_server_surface(vd);
41b4bef6 750 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
198a0039
GH		 751 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
752 vs->force_update = 1;
bd023f95 753 vnc_update_client_sync(vs, 1);
198a0039
GH		 754 /* vs might be free()ed here */
755 }
756 }
757
1fc62412 758 /* do bitblit op on the local surface too */
9f64916d
GH		 759 pitch = vnc_server_fb_stride(vd);
760 src_row = vnc_server_fb_ptr(vd, src_x, src_y);
761 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
1fc62412
SS		 762 y = dst_y;
763 inc = 1;
764 if (dst_y > src_y) {
765 /* copy backwards */
766 src_row += pitch * (h-1);
767 dst_row += pitch * (h-1);
768 pitch = -pitch;
769 y = dst_y + h - 1;
770 inc = -1;
771 }
772 w_lim = w - (16 - (dst_x % 16));
773 if (w_lim < 0)
774 w_lim = w;
775 else
776 w_lim = w - (w_lim % 16);
777 for (i = 0; i < h; i++) {
778 for (x = 0; x <= w_lim;
779 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
780 if (x == w_lim) {
781 if ((s = w - w_lim) == 0)
782 break;
783 } else if (!x) {
784 s = (16 - (dst_x % 16));
785 s = MIN(s, w_lim);
786 } else {
787 s = 16;
788 }
9f64916d 789 cmp_bytes = s * VNC_SERVER_FB_BYTES;
1fc62412
SS		 790 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
791 continue;
792 memmove(dst_row, src_row, cmp_bytes);
41b4bef6
AS		 793 QTAILQ_FOREACH(vs, &vd->clients, next) {
794 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
bc2429b9 795 set_bit(((x + dst_x) / 16), vs->dirty[y]);
41b4bef6 796 }
1fc62412
SS		 797 }
798 }
9f64916d
GH		 799 src_row += pitch - w * VNC_SERVER_FB_BYTES;
800 dst_row += pitch - w * VNC_SERVER_FB_BYTES;
1fc62412
SS		 801 y += inc;
802 }
803
41b4bef6
AS		 804 QTAILQ_FOREACH(vs, &vd->clients, next) {
805 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
753b4053 806 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
41b4bef6 807 }
753b4053
AL		 808 }
809}
810
7c20b4a3 811static void vnc_mouse_set(DisplayChangeListener *dcl,
7c20b4a3 812 int x, int y, int visible)
d467b679
GH		 813{
814 /* can we ask the client(s) to move the pointer ??? */
815}
816
817static int vnc_cursor_define(VncState *vs)
818{
819 QEMUCursor *c = vs->vd->cursor;
d467b679
GH		 820 int isize;
821
822 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
d01f9595 823 vnc_lock_output(vs);
d467b679
GH		 824 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
825 vnc_write_u8(vs, 0); /* padding */
826 vnc_write_u16(vs, 1); /* # of rects */
827 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
828 VNC_ENCODING_RICH_CURSOR);
9f64916d
GH		 829 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
830 vnc_write_pixels_generic(vs, c->data, isize);
d467b679 831 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
d01f9595 832 vnc_unlock_output(vs);
d467b679
GH		 833 return 0;
834 }
835 return -1;
836}
837
7c20b4a3 838static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
7c20b4a3 839 QEMUCursor *c)
d467b679
GH		 840{
841 VncDisplay *vd = vnc_display;
842 VncState *vs;
843
844 cursor_put(vd->cursor);
7267c094 845 g_free(vd->cursor_mask);
d467b679
GH		 846
847 vd->cursor = c;
848 cursor_get(vd->cursor);
849 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
7267c094 850 vd->cursor_mask = g_malloc0(vd->cursor_msize);
d467b679
GH		 851 cursor_get_mono_mask(c, 0, vd->cursor_mask);
852
853 QTAILQ_FOREACH(vs, &vd->clients, next) {
854 vnc_cursor_define(vs);
855 }
856}
857
1fc62412 858static int find_and_clear_dirty_height(struct VncState *vs,
6c71a539 859 int y, int last_x, int x, int height)
24236869
FB		 860{
861 int h;
862
6c71a539 863 for (h = 1; h < (height - y); h++) {
28a76be8 864 int tmp_x;
bc2429b9 865 if (!test_bit(last_x, vs->dirty[y + h])) {
28a76be8 866 break;
bc2429b9
CC		 867 }
868 for (tmp_x = last_x; tmp_x < x; tmp_x++) {
869 clear_bit(tmp_x, vs->dirty[y + h]);
870 }
24236869
FB		 871 }
872
873 return h;
874}
875
bd023f95
CC		 876static int vnc_update_client_sync(VncState *vs, int has_dirty)
877{
878 int ret = vnc_update_client(vs, has_dirty);
879 vnc_jobs_join(vs);
880 return ret;
881}
bd023f95 882
2430ffe4 883static int vnc_update_client(VncState *vs, int has_dirty)
24236869 884{
24236869 885 if (vs->need_update && vs->csock != -1) {
1fc62412 886 VncDisplay *vd = vs->vd;
bd023f95 887 VncJob *job;
28a76be8 888 int y;
847ce6a1 889 int width, height;
bd023f95
CC		 890 int n = 0;
891
24236869 892
703bc68f 893 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
c522d0e2 894 /* kernel send buffers are full -> drop frames to throttle */
2430ffe4 895 return 0;
a0ecfb73 896
703bc68f 897 if (!has_dirty && !vs->audio_cap && !vs->force_update)
2430ffe4 898 return 0;
28a76be8 899
6baebed7
AL		 900 /*
901 * Send screen updates to the vnc client using the server
902 * surface and server dirty map. guest surface updates
903 * happening in parallel don't disturb us, the next pass will
904 * send them to the client.
905 */
bd023f95 906 job = vnc_job_new(vs);
28a76be8 907
9f64916d
GH		 908 width = MIN(pixman_image_get_width(vd->server), vs->client_width);
909 height = MIN(pixman_image_get_height(vd->server), vs->client_height);
847ce6a1
GH		 910
911 for (y = 0; y < height; y++) {
28a76be8
AL		 912 int x;
913 int last_x = -1;
847ce6a1 914 for (x = 0; x < width / 16; x++) {
bc2429b9 915 if (test_and_clear_bit(x, vs->dirty[y])) {
28a76be8
AL		 916 if (last_x == -1) {
917 last_x = x;
918 }
28a76be8
AL		 919 } else {
920 if (last_x != -1) {
6c71a539
CC		 921 int h = find_and_clear_dirty_height(vs, y, last_x, x,
922 height);
bd023f95
CC		 923
924 n += vnc_job_add_rect(job, last_x * 16, y,
925 (x - last_x) * 16, h);
28a76be8
AL		 926 }
927 last_x = -1;
928 }
929 }
930 if (last_x != -1) {
6c71a539 931 int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
bd023f95
CC		 932 n += vnc_job_add_rect(job, last_x * 16, y,
933 (x - last_x) * 16, h);
28a76be8
AL		 934 }
935 }
bd023f95
CC		 936
937 vnc_job_push(job);
c522d0e2 938 vs->force_update = 0;
bd023f95 939 return n;
24236869 940 }
24236869 941
703bc68f 942 if (vs->csock == -1)
198a0039 943 vnc_disconnect_finish(vs);
2430ffe4
SS		 944
945 return 0;
24236869
FB		 946}
947
429a8ed3 948/* audio */
949static void audio_capture_notify(void *opaque, audcnotification_e cmd)
950{
951 VncState *vs = opaque;
952
953 switch (cmd) {
954 case AUD_CNOTIFY_DISABLE:
bd023f95 955 vnc_lock_output(vs);
46a183da
DB		 956 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
957 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
958 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
bd023f95 959 vnc_unlock_output(vs);
429a8ed3 960 vnc_flush(vs);
961 break;
962
963 case AUD_CNOTIFY_ENABLE:
bd023f95 964 vnc_lock_output(vs);
46a183da
DB		 965 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
966 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
967 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
bd023f95 968 vnc_unlock_output(vs);
429a8ed3 969 vnc_flush(vs);
970 break;
971 }
972}
973
974static void audio_capture_destroy(void *opaque)
975{
976}
977
978static void audio_capture(void *opaque, void *buf, int size)
979{
980 VncState *vs = opaque;
981
bd023f95 982 vnc_lock_output(vs);
46a183da
DB		 983 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
984 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
985 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
429a8ed3 986 vnc_write_u32(vs, size);
987 vnc_write(vs, buf, size);
bd023f95 988 vnc_unlock_output(vs);
429a8ed3 989 vnc_flush(vs);
990}
991
992static void audio_add(VncState *vs)
993{
994 struct audio_capture_ops ops;
995
996 if (vs->audio_cap) {
8631b608 997 monitor_printf(default_mon, "audio already running\n");
429a8ed3 998 return;
999 }
1000
1001 ops.notify = audio_capture_notify;
1002 ops.destroy = audio_capture_destroy;
1003 ops.capture = audio_capture;
1004
1a7dafce 1005 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
429a8ed3 1006 if (!vs->audio_cap) {
8631b608 1007 monitor_printf(default_mon, "Failed to add audio capture\n");
429a8ed3 1008 }
1009}
1010
1011static void audio_del(VncState *vs)
1012{
1013 if (vs->audio_cap) {
1014 AUD_del_capture(vs->audio_cap, vs);
1015 vs->audio_cap = NULL;
1016 }
1017}
1018
198a0039
GH		 1019static void vnc_disconnect_start(VncState *vs)
1020{
1021 if (vs->csock == -1)
1022 return;
8cf36489 1023 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
198a0039
GH		 1024 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1025 closesocket(vs->csock);
1026 vs->csock = -1;
1027}
1028
7536ee4b 1029void vnc_disconnect_finish(VncState *vs)
198a0039 1030{
7d964c9d
CC		 1031 int i;
1032
bd023f95
CC		 1033 vnc_jobs_join(vs); /* Wait encoding jobs */
1034
1035 vnc_lock_output(vs);
0d72f3d3
LC		 1036 vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1037
5d418e3b
CC		 1038 buffer_free(&vs->input);
1039 buffer_free(&vs->output);
7536ee4b
TH		 1040#ifdef CONFIG_VNC_WS
1041 buffer_free(&vs->ws_input);
1042 buffer_free(&vs->ws_output);
1043#endif /* CONFIG_VNC_WS */
4a80dba3
LC		 1044
1045 qobject_decref(vs->info);
1046
161c4f20 1047 vnc_zlib_clear(vs);
380282b0 1048 vnc_tight_clear(vs);
148954fa 1049 vnc_zrle_clear(vs);
161c4f20 1050
198a0039
GH		 1051#ifdef CONFIG_VNC_TLS
1052 vnc_tls_client_cleanup(vs);
1053#endif /* CONFIG_VNC_TLS */
1054#ifdef CONFIG_VNC_SASL
1055 vnc_sasl_client_cleanup(vs);
1056#endif /* CONFIG_VNC_SASL */
1057 audio_del(vs);
7bc9318b 1058 vnc_release_modifiers(vs);
198a0039 1059
6fd8e79a
TH		 1060 if (vs->initialized) {
1061 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1062 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1063 }
41b4bef6 1064
3a0558b5
GH		 1065 if (vs->vd->lock_key_sync)
1066 qemu_remove_led_event_handler(vs->led);
bd023f95
CC		 1067 vnc_unlock_output(vs);
1068
bd023f95 1069 qemu_mutex_destroy(&vs->output_mutex);
6fd8e79a
TH		 1070 if (vs->bh != NULL) {
1071 qemu_bh_delete(vs->bh);
1072 }
175b2a6e 1073 buffer_free(&vs->jobs_buffer);
175b2a6e 1074
7d964c9d 1075 for (i = 0; i < VNC_STAT_ROWS; ++i) {
7267c094 1076 g_free(vs->lossy_rect[i]);
7d964c9d 1077 }
7267c094
AL		 1078 g_free(vs->lossy_rect);
1079 g_free(vs);
198a0039 1080}
2f9606b3
AL		 1081
1082int vnc_client_io_error(VncState *vs, int ret, int last_errno)
24236869
FB		 1083{
1084 if (ret == 0 || ret == -1) {
ea01e5fd
AZ		 1085 if (ret == -1) {
1086 switch (last_errno) {
1087 case EINTR:
1088 case EAGAIN:
1089#ifdef _WIN32
1090 case WSAEWOULDBLOCK:
1091#endif
1092 return 0;
1093 default:
1094 break;
1095 }
1096 }
24236869 1097
198a0039
GH		 1098 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1099 ret, ret < 0 ? last_errno : 0);
1100 vnc_disconnect_start(vs);
6baebed7 1101
28a76be8 1102 return 0;
24236869
FB		 1103 }
1104 return ret;
1105}
1106
5fb6c7a8
AL		 1107
1108void vnc_client_error(VncState *vs)
24236869 1109{
198a0039
GH		 1110 VNC_DEBUG("Closing down client sock: protocol error\n");
1111 vnc_disconnect_start(vs);
24236869
FB		 1112}
1113
2f9606b3
AL		 1114
1115/*
1116 * Called to write a chunk of data to the client socket. The data may
1117 * be the raw data, or may have already been encoded by SASL.
1118 * The data will be written either straight onto the socket, or
1119 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1120 *
1121 * NB, it is theoretically possible to have 2 layers of encryption,
1122 * both SASL, and this TLS layer. It is highly unlikely in practice
1123 * though, since SASL encryption will typically be a no-op if TLS
1124 * is active
1125 *
1126 * Returns the number of bytes written, which may be less than
1127 * the requested 'datalen' if the socket would block. Returns
1128 * -1 on error, and disconnects the client socket.
1129 */
1130long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
24236869 1131{
ceb5caaf 1132 long ret;
eb38c52c 1133#ifdef CONFIG_VNC_TLS
5fb6c7a8 1134 if (vs->tls.session) {
28a76be8
AL		 1135 ret = gnutls_write(vs->tls.session, data, datalen);
1136 if (ret < 0) {
1137 if (ret == GNUTLS_E_AGAIN)
1138 errno = EAGAIN;
1139 else
1140 errno = EIO;
1141 ret = -1;
1142 }
8d5d2d4c
TS		 1143 } else
1144#endif /* CONFIG_VNC_TLS */
70503264 1145 ret = send(vs->csock, (const void *)data, datalen, 0);
23decc87 1146 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
2f9606b3
AL		 1147 return vnc_client_io_error(vs, ret, socket_error());
1148}
1149
1150
1151/*
1152 * Called to write buffered data to the client socket, when not
1153 * using any SASL SSF encryption layers. Will write as much data
1154 * as possible without blocking. If all buffered data is written,
1155 * will switch the FD poll() handler back to read monitoring.
1156 *
1157 * Returns the number of bytes written, which may be less than
1158 * the buffered output data if the socket would block. Returns
1159 * -1 on error, and disconnects the client socket.
1160 */
1161static long vnc_client_write_plain(VncState *vs)
1162{
1163 long ret;
1164
1165#ifdef CONFIG_VNC_SASL
23decc87 1166 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
2f9606b3
AL		 1167 vs->output.buffer, vs->output.capacity, vs->output.offset,
1168 vs->sasl.waitWriteSSF);
1169
1170 if (vs->sasl.conn &&
1171 vs->sasl.runSSF &&
1172 vs->sasl.waitWriteSSF) {
1173 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1174 if (ret)
1175 vs->sasl.waitWriteSSF -= ret;
1176 } else
1177#endif /* CONFIG_VNC_SASL */
1178 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
24236869 1179 if (!ret)
2f9606b3 1180 return 0;
24236869 1181
32ed2680 1182 buffer_advance(&vs->output, ret);
24236869
FB		 1183
1184 if (vs->output.offset == 0) {
28a76be8 1185 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
24236869 1186 }
2f9606b3
AL		 1187
1188 return ret;
1189}
1190
1191
1192/*
1193 * First function called whenever there is data to be written to
1194 * the client socket. Will delegate actual work according to whether
1195 * SASL SSF layers are enabled (thus requiring encryption calls)
1196 */
bd023f95 1197static void vnc_client_write_locked(void *opaque)
2f9606b3 1198{
2f9606b3
AL		 1199 VncState *vs = opaque;
1200
1201#ifdef CONFIG_VNC_SASL
1202 if (vs->sasl.conn &&
1203 vs->sasl.runSSF &&
9678d950
BS		 1204 !vs->sasl.waitWriteSSF) {
1205 vnc_client_write_sasl(vs);
1206 } else
2f9606b3 1207#endif /* CONFIG_VNC_SASL */
7536ee4b
TH		 1208 {
1209#ifdef CONFIG_VNC_WS
1210 if (vs->encode_ws) {
1211 vnc_client_write_ws(vs);
1212 } else
1213#endif /* CONFIG_VNC_WS */
1214 {
1215 vnc_client_write_plain(vs);
1216 }
1217 }
24236869
FB		 1218}
1219
bd023f95
CC		 1220void vnc_client_write(void *opaque)
1221{
1222 VncState *vs = opaque;
1223
1224 vnc_lock_output(vs);
7536ee4b
TH		 1225 if (vs->output.offset
1226#ifdef CONFIG_VNC_WS
1227 || vs->ws_output.offset
1228#endif
1229 ) {
bd023f95 1230 vnc_client_write_locked(opaque);
ac71103d 1231 } else if (vs->csock != -1) {
bd023f95
CC		 1232 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1233 }
1234 vnc_unlock_output(vs);
1235}
1236
5fb6c7a8 1237void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
24236869
FB		 1238{
1239 vs->read_handler = func;
1240 vs->read_handler_expect = expecting;
1241}
1242
2f9606b3
AL		 1243
1244/*
1245 * Called to read a chunk of data from the client socket. The data may
1246 * be the raw data, or may need to be further decoded by SASL.
1247 * The data will be read either straight from to the socket, or
1248 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1249 *
1250 * NB, it is theoretically possible to have 2 layers of encryption,
1251 * both SASL, and this TLS layer. It is highly unlikely in practice
1252 * though, since SASL encryption will typically be a no-op if TLS
1253 * is active
1254 *
1255 * Returns the number of bytes read, which may be less than
1256 * the requested 'datalen' if the socket would block. Returns
1257 * -1 on error, and disconnects the client socket.
1258 */
1259long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
24236869 1260{
ceb5caaf 1261 long ret;
eb38c52c 1262#ifdef CONFIG_VNC_TLS
5fb6c7a8 1263 if (vs->tls.session) {
28a76be8
AL		 1264 ret = gnutls_read(vs->tls.session, data, datalen);
1265 if (ret < 0) {
1266 if (ret == GNUTLS_E_AGAIN)
1267 errno = EAGAIN;
1268 else
1269 errno = EIO;
1270 ret = -1;
1271 }
8d5d2d4c
TS		 1272 } else
1273#endif /* CONFIG_VNC_TLS */
00aa0040 1274 ret = qemu_recv(vs->csock, data, datalen, 0);
23decc87 1275 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
2f9606b3
AL		 1276 return vnc_client_io_error(vs, ret, socket_error());
1277}
24236869 1278
2f9606b3
AL		 1279
1280/*
1281 * Called to read data from the client socket to the input buffer,
1282 * when not using any SASL SSF encryption layers. Will read as much
1283 * data as possible without blocking.
1284 *
1285 * Returns the number of bytes read. Returns -1 on error, and
1286 * disconnects the client socket.
1287 */
1288static long vnc_client_read_plain(VncState *vs)
1289{
1290 int ret;
23decc87 1291 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
2f9606b3
AL		 1292 vs->input.buffer, vs->input.capacity, vs->input.offset);
1293 buffer_reserve(&vs->input, 4096);
1294 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1295 if (!ret)
1296 return 0;
24236869 1297 vs->input.offset += ret;
2f9606b3
AL		 1298 return ret;
1299}
1300
175b2a6e
CC		 1301static void vnc_jobs_bh(void *opaque)
1302{
1303 VncState *vs = opaque;
1304
1305 vnc_jobs_consume_buffer(vs);
1306}
2f9606b3
AL		 1307
1308/*
1309 * First function called whenever there is more data to be read from
1310 * the client socket. Will delegate actual work according to whether
1311 * SASL SSF layers are enabled (thus requiring decryption calls)
1312 */
1313void vnc_client_read(void *opaque)
1314{
1315 VncState *vs = opaque;
1316 long ret;
1317
1318#ifdef CONFIG_VNC_SASL
1319 if (vs->sasl.conn && vs->sasl.runSSF)
1320 ret = vnc_client_read_sasl(vs);
1321 else
1322#endif /* CONFIG_VNC_SASL */
7536ee4b
TH		 1323#ifdef CONFIG_VNC_WS
1324 if (vs->encode_ws) {
1325 ret = vnc_client_read_ws(vs);
1326 if (ret == -1) {
1327 vnc_disconnect_start(vs);
1328 return;
1329 } else if (ret == -2) {
1330 vnc_client_error(vs);
1331 return;
1332 }
1333 } else
1334#endif /* CONFIG_VNC_WS */
1335 {
2f9606b3 1336 ret = vnc_client_read_plain(vs);
7536ee4b 1337 }
198a0039
GH		 1338 if (!ret) {
1339 if (vs->csock == -1)
1340 vnc_disconnect_finish(vs);
28a76be8 1341 return;
198a0039 1342 }
24236869
FB		 1343
1344 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
28a76be8
AL		 1345 size_t len = vs->read_handler_expect;
1346 int ret;
1347
1348 ret = vs->read_handler(vs, vs->input.buffer, len);
198a0039
GH		 1349 if (vs->csock == -1) {
1350 vnc_disconnect_finish(vs);
28a76be8 1351 return;
198a0039 1352 }
28a76be8
AL		 1353
1354 if (!ret) {
32ed2680 1355 buffer_advance(&vs->input, len);
28a76be8
AL		 1356 } else {
1357 vs->read_handler_expect = ret;
1358 }
24236869
FB		 1359 }
1360}
1361
5fb6c7a8 1362void vnc_write(VncState *vs, const void *data, size_t len)
24236869
FB		 1363{
1364 buffer_reserve(&vs->output, len);
1365
198a0039 1366 if (vs->csock != -1 && buffer_empty(&vs->output)) {
28a76be8 1367 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
24236869
FB		 1368 }
1369
1370 buffer_append(&vs->output, data, len);
1371}
1372
5fb6c7a8 1373void vnc_write_s32(VncState *vs, int32_t value)
24236869
FB		 1374{
1375 vnc_write_u32(vs, *(uint32_t *)&value);
1376}
1377
5fb6c7a8 1378void vnc_write_u32(VncState *vs, uint32_t value)
24236869
FB		 1379{
1380 uint8_t buf[4];
1381
1382 buf[0] = (value >> 24) & 0xFF;
1383 buf[1] = (value >> 16) & 0xFF;
1384 buf[2] = (value >> 8) & 0xFF;
1385 buf[3] = value & 0xFF;
1386
1387 vnc_write(vs, buf, 4);
1388}
1389
5fb6c7a8 1390void vnc_write_u16(VncState *vs, uint16_t value)
24236869 1391{
64f5a135 1392 uint8_t buf[2];
24236869
FB		 1393
1394 buf[0] = (value >> 8) & 0xFF;
1395 buf[1] = value & 0xFF;
1396
1397 vnc_write(vs, buf, 2);
1398}
1399
5fb6c7a8 1400void vnc_write_u8(VncState *vs, uint8_t value)
24236869
FB		 1401{
1402 vnc_write(vs, (char *)&value, 1);
1403}
1404
5fb6c7a8 1405void vnc_flush(VncState *vs)
24236869 1406{
bd023f95 1407 vnc_lock_output(vs);
7536ee4b
TH		 1408 if (vs->csock != -1 && (vs->output.offset
1409#ifdef CONFIG_VNC_WS
1410 || vs->ws_output.offset
1411#endif
1412 )) {
bd023f95
CC		 1413 vnc_client_write_locked(vs);
1414 }
1415 vnc_unlock_output(vs);
24236869
FB		 1416}
1417
71a8cdec 1418static uint8_t read_u8(uint8_t *data, size_t offset)
24236869
FB		 1419{
1420 return data[offset];
1421}
1422
71a8cdec 1423static uint16_t read_u16(uint8_t *data, size_t offset)
24236869
FB		 1424{
1425 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1426}
1427
71a8cdec 1428static int32_t read_s32(uint8_t *data, size_t offset)
24236869
FB		 1429{
1430 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1431 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1432}
1433
5fb6c7a8 1434uint32_t read_u32(uint8_t *data, size_t offset)
24236869
FB		 1435{
1436 return ((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1437 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1438}
1439
60fe76f3 1440static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
24236869
FB		 1441{
1442}
1443
9e8dd451 1444static void check_pointer_type_change(Notifier *notifier, void *data)
564c337e 1445{
37c34d9d
AL		 1446 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1447 int absolute = kbd_mouse_is_absolute();
1448
29fa4ed9 1449 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
bd023f95 1450 vnc_lock_output(vs);
46a183da 1451 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
28a76be8
AL		 1452 vnc_write_u8(vs, 0);
1453 vnc_write_u16(vs, 1);
1454 vnc_framebuffer_update(vs, absolute, 0,
d39fa6d8
GH		 1455 surface_width(vs->vd->ds),
1456 surface_height(vs->vd->ds),
29fa4ed9 1457 VNC_ENCODING_POINTER_TYPE_CHANGE);
bd023f95 1458 vnc_unlock_output(vs);
28a76be8 1459 vnc_flush(vs);
564c337e
FB		 1460 }
1461 vs->absolute = absolute;
1462}
1463
24236869
FB		 1464static void pointer_event(VncState *vs, int button_mask, int x, int y)
1465{
1466 int buttons = 0;
1467 int dz = 0;
d39fa6d8
GH		 1468 int width = surface_width(vs->vd->ds);
1469 int height = surface_height(vs->vd->ds);
24236869
FB		 1470
1471 if (button_mask & 0x01)
28a76be8 1472 buttons |= MOUSE_EVENT_LBUTTON;
24236869 1473 if (button_mask & 0x02)
28a76be8 1474 buttons |= MOUSE_EVENT_MBUTTON;
24236869 1475 if (button_mask & 0x04)
28a76be8 1476 buttons |= MOUSE_EVENT_RBUTTON;
24236869 1477 if (button_mask & 0x08)
28a76be8 1478 dz = -1;
24236869 1479 if (button_mask & 0x10)
28a76be8 1480 dz = 1;
564c337e
FB		 1481
1482 if (vs->absolute) {
d39fa6d8
GH		 1483 kbd_mouse_event(width > 1 ? x * 0x7FFF / (width - 1) : 0x4000,
1484 height > 1 ? y * 0x7FFF / (height - 1) : 0x4000,
28a76be8 1485 dz, buttons);
29fa4ed9 1486 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
28a76be8
AL		 1487 x -= 0x7FFF;
1488 y -= 0x7FFF;
24236869 1489
28a76be8 1490 kbd_mouse_event(x, y, dz, buttons);
564c337e 1491 } else {
28a76be8
AL		 1492 if (vs->last_x != -1)
1493 kbd_mouse_event(x - vs->last_x,
1494 y - vs->last_y,
1495 dz, buttons);
1496 vs->last_x = x;
1497 vs->last_y = y;
24236869
FB		 1498 }
1499}
1500
64f5a135
FB		 1501static void reset_keys(VncState *vs)
1502{
1503 int i;
1504 for(i = 0; i < 256; i++) {
1505 if (vs->modifiers_state[i]) {
44bb61c8
ST		 1506 if (i & SCANCODE_GREY)
1507 kbd_put_keycode(SCANCODE_EMUL0);
1508 kbd_put_keycode(i | SCANCODE_UP);
64f5a135
FB		 1509 vs->modifiers_state[i] = 0;
1510 }
1511 }
1512}
1513
a528b80c
AZ		 1514static void press_key(VncState *vs, int keysym)
1515{
44bb61c8
ST		 1516 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1517 if (keycode & SCANCODE_GREY)
1518 kbd_put_keycode(SCANCODE_EMUL0);
1519 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1520 if (keycode & SCANCODE_GREY)
1521 kbd_put_keycode(SCANCODE_EMUL0);
1522 kbd_put_keycode(keycode | SCANCODE_UP);
a528b80c
AZ		 1523}
1524
ab99e5c1
LL		 1525static int current_led_state(VncState *vs)
1526{
1527 int ledstate = 0;
1528
1529 if (vs->modifiers_state[0x46]) {
1530 ledstate |= QEMU_SCROLL_LOCK_LED;
1531 }
1532 if (vs->modifiers_state[0x45]) {
1533 ledstate |= QEMU_NUM_LOCK_LED;
1534 }
1535 if (vs->modifiers_state[0x3a]) {
1536 ledstate |= QEMU_CAPS_LOCK_LED;
1537 }
1538
1539 return ledstate;
1540}
1541
1542static void vnc_led_state_change(VncState *vs)
1543{
1544 int ledstate = 0;
1545
1546 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1547 return;
1548 }
1549
1550 ledstate = current_led_state(vs);
1551 vnc_lock_output(vs);
1552 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1553 vnc_write_u8(vs, 0);
1554 vnc_write_u16(vs, 1);
1555 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1556 vnc_write_u8(vs, ledstate);
1557 vnc_unlock_output(vs);
1558 vnc_flush(vs);
1559}
1560
7ffb82ca
GH		 1561static void kbd_leds(void *opaque, int ledstate)
1562{
1563 VncState *vs = opaque;
96f3d174 1564 int caps, num, scr;
7ffb82ca
GH		 1565
1566 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1567 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
96f3d174 1568 scr = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0;
7ffb82ca
GH		 1569
1570 if (vs->modifiers_state[0x3a] != caps) {
1571 vs->modifiers_state[0x3a] = caps;
1572 }
1573 if (vs->modifiers_state[0x45] != num) {
1574 vs->modifiers_state[0x45] = num;
1575 }
96f3d174
LL		 1576 if (vs->modifiers_state[0x46] != scr) {
1577 vs->modifiers_state[0x46] = scr;
1578 }
ab99e5c1
LL		 1579
1580 /* Sending the current led state message to the client */
1581 if (ledstate != current_led_state(vs)) {
1582 vnc_led_state_change(vs);
1583 }
7ffb82ca
GH		 1584}
1585
9ca313aa 1586static void do_key_event(VncState *vs, int down, int keycode, int sym)
24236869 1587{
64f5a135
FB		 1588 /* QEMU console switch */
1589 switch(keycode) {
1590 case 0x2a: /* Left Shift */
1591 case 0x36: /* Right Shift */
1592 case 0x1d: /* Left CTRL */
1593 case 0x9d: /* Right CTRL */
1594 case 0x38: /* Left ALT */
1595 case 0xb8: /* Right ALT */
1596 if (down)
1597 vs->modifiers_state[keycode] = 1;
1598 else
1599 vs->modifiers_state[keycode] = 0;
1600 break;
5fafdf24 1601 case 0x02 ... 0x0a: /* '1' to '9' keys */
64f5a135
FB		 1602 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1603 /* Reset the modifiers sent to the current console */
1604 reset_keys(vs);
1605 console_select(keycode - 0x02);
1606 return;
1607 }
1608 break;
28a76be8
AL		 1609 case 0x3a: /* CapsLock */
1610 case 0x45: /* NumLock */
7ffb82ca 1611 if (down)
a528b80c
AZ		 1612 vs->modifiers_state[keycode] ^= 1;
1613 break;
1614 }
1615
e7b2aacc
LL		 1616 /* Turn off the lock state sync logic if the client support the led
1617 state extension.
1618 */
9892088b 1619 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1620 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1621 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
a528b80c
AZ		 1622 /* If the numlock state needs to change then simulate an additional
1623 keypress before sending this one. This will happen if the user
1624 toggles numlock away from the VNC window.
1625 */
753b4053 1626 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
a528b80c
AZ		 1627 if (!vs->modifiers_state[0x45]) {
1628 vs->modifiers_state[0x45] = 1;
1629 press_key(vs, 0xff7f);
1630 }
1631 } else {
1632 if (vs->modifiers_state[0x45]) {
1633 vs->modifiers_state[0x45] = 0;
1634 press_key(vs, 0xff7f);
1635 }
1636 }
64f5a135 1637 }
24236869 1638
9892088b 1639 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1640 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1641 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
6b132502
GH		 1642 /* If the capslock state needs to change then simulate an additional
1643 keypress before sending this one. This will happen if the user
1644 toggles capslock away from the VNC window.
1645 */
1646 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1647 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1648 int capslock = !!(vs->modifiers_state[0x3a]);
1649 if (capslock) {
1650 if (uppercase == shift) {
1651 vs->modifiers_state[0x3a] = 0;
1652 press_key(vs, 0xffe5);
1653 }
1654 } else {
1655 if (uppercase != shift) {
1656 vs->modifiers_state[0x3a] = 1;
1657 press_key(vs, 0xffe5);
1658 }
1659 }
1660 }
1661
81c0d5a6 1662 if (qemu_console_is_graphic(NULL)) {
44bb61c8
ST		 1663 if (keycode & SCANCODE_GREY)
1664 kbd_put_keycode(SCANCODE_EMUL0);
64f5a135 1665 if (down)
44bb61c8 1666 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
64f5a135 1667 else
44bb61c8 1668 kbd_put_keycode(keycode | SCANCODE_UP);
64f5a135 1669 } else {
e26437c2
GH		 1670 bool numlock = vs->modifiers_state[0x45];
1671 bool control = (vs->modifiers_state[0x1d] ||
1672 vs->modifiers_state[0x9d]);
64f5a135
FB		 1673 /* QEMU console emulation */
1674 if (down) {
1675 switch (keycode) {
1676 case 0x2a: /* Left Shift */
1677 case 0x36: /* Right Shift */
1678 case 0x1d: /* Left CTRL */
1679 case 0x9d: /* Right CTRL */
1680 case 0x38: /* Left ALT */
1681 case 0xb8: /* Right ALT */
1682 break;
1683 case 0xc8:
1684 kbd_put_keysym(QEMU_KEY_UP);
1685 break;
1686 case 0xd0:
1687 kbd_put_keysym(QEMU_KEY_DOWN);
1688 break;
1689 case 0xcb:
1690 kbd_put_keysym(QEMU_KEY_LEFT);
1691 break;
1692 case 0xcd:
1693 kbd_put_keysym(QEMU_KEY_RIGHT);
1694 break;
1695 case 0xd3:
1696 kbd_put_keysym(QEMU_KEY_DELETE);
1697 break;
1698 case 0xc7:
1699 kbd_put_keysym(QEMU_KEY_HOME);
1700 break;
1701 case 0xcf:
1702 kbd_put_keysym(QEMU_KEY_END);
1703 break;
1704 case 0xc9:
1705 kbd_put_keysym(QEMU_KEY_PAGEUP);
1706 break;
1707 case 0xd1:
1708 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1709 break;
bb0a18e1
GH		 1710
1711 case 0x47:
1712 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1713 break;
1714 case 0x48:
1715 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1716 break;
1717 case 0x49:
1718 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1719 break;
1720 case 0x4b:
1721 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1722 break;
1723 case 0x4c:
1724 kbd_put_keysym('5');
1725 break;
1726 case 0x4d:
1727 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1728 break;
1729 case 0x4f:
1730 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1731 break;
1732 case 0x50:
1733 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1734 break;
1735 case 0x51:
1736 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1737 break;
1738 case 0x52:
1739 kbd_put_keysym('0');
1740 break;
1741 case 0x53:
1742 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1743 break;
1744
1745 case 0xb5:
1746 kbd_put_keysym('/');
1747 break;
1748 case 0x37:
1749 kbd_put_keysym('*');
1750 break;
1751 case 0x4a:
1752 kbd_put_keysym('-');
1753 break;
1754 case 0x4e:
1755 kbd_put_keysym('+');
1756 break;
1757 case 0x9c:
1758 kbd_put_keysym('\n');
1759 break;
1760
64f5a135 1761 default:
e26437c2
GH		 1762 if (control) {
1763 kbd_put_keysym(sym & 0x1f);
1764 } else {
1765 kbd_put_keysym(sym);
1766 }
64f5a135
FB		 1767 break;
1768 }
1769 }
1770 }
24236869
FB		 1771}
1772
7bc9318b
GH		 1773static void vnc_release_modifiers(VncState *vs)
1774{
1775 static const int keycodes[] = {
1776 /* shift, control, alt keys, both left & right */
1777 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1778 };
1779 int i, keycode;
1780
81c0d5a6 1781 if (!qemu_console_is_graphic(NULL)) {
7bc9318b
GH		 1782 return;
1783 }
1784 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1785 keycode = keycodes[i];
1786 if (!vs->modifiers_state[keycode]) {
1787 continue;
1788 }
1789 if (keycode & SCANCODE_GREY) {
1790 kbd_put_keycode(SCANCODE_EMUL0);
1791 }
1792 kbd_put_keycode(keycode | SCANCODE_UP);
1793 }
1794}
1795
bdbd7676
FB		 1796static void key_event(VncState *vs, int down, uint32_t sym)
1797{
9ca313aa 1798 int keycode;
4a93fe17 1799 int lsym = sym;
9ca313aa 1800
81c0d5a6 1801 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
4a93fe17
GH		 1802 lsym = lsym - 'A' + 'a';
1803 }
9ca313aa 1804
44bb61c8 1805 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
9ca313aa
AL		 1806 do_key_event(vs, down, keycode, sym);
1807}
1808
1809static void ext_key_event(VncState *vs, int down,
1810 uint32_t sym, uint16_t keycode)
1811{
1812 /* if the user specifies a keyboard layout, always use it */
1813 if (keyboard_layout)
1814 key_event(vs, down, sym);
1815 else
1816 do_key_event(vs, down, keycode, sym);
bdbd7676
FB		 1817}
1818
24236869 1819static void framebuffer_update_request(VncState *vs, int incremental,
28a76be8
AL		 1820 int x_position, int y_position,
1821 int w, int h)
24236869 1822{
6ed391bf 1823 int i;
d39fa6d8
GH		 1824 const size_t width = surface_width(vs->vd->ds) / 16;
1825 const size_t height = surface_height(vs->vd->ds);
6ed391bf 1826
d39fa6d8
GH		 1827 if (y_position > height) {
1828 y_position = height;
1829 }
1830 if (y_position + h >= height) {
1831 h = height - y_position;
1832 }
cf2d385c 1833
24236869
FB		 1834 vs->need_update = 1;
1835 if (!incremental) {
24cf0a6e 1836 vs->force_update = 1;
28a76be8 1837 for (i = 0; i < h; i++) {
6ed391bf
WC		 1838 bitmap_set(vs->dirty[y_position + i], 0, width);
1839 bitmap_clear(vs->dirty[y_position + i], width,
a0843a68 1840 VNC_DIRTY_BITS - width);
28a76be8 1841 }
24236869
FB		 1842 }
1843}
1844
9ca313aa
AL		 1845static void send_ext_key_event_ack(VncState *vs)
1846{
bd023f95 1847 vnc_lock_output(vs);
46a183da 1848 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
9ca313aa
AL		 1849 vnc_write_u8(vs, 0);
1850 vnc_write_u16(vs, 1);
d39fa6d8
GH		 1851 vnc_framebuffer_update(vs, 0, 0,
1852 surface_width(vs->vd->ds),
1853 surface_height(vs->vd->ds),
29fa4ed9 1854 VNC_ENCODING_EXT_KEY_EVENT);
bd023f95 1855 vnc_unlock_output(vs);
9ca313aa
AL		 1856 vnc_flush(vs);
1857}
1858
429a8ed3 1859static void send_ext_audio_ack(VncState *vs)
1860{
bd023f95 1861 vnc_lock_output(vs);
46a183da 1862 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
429a8ed3 1863 vnc_write_u8(vs, 0);
1864 vnc_write_u16(vs, 1);
d39fa6d8
GH		 1865 vnc_framebuffer_update(vs, 0, 0,
1866 surface_width(vs->vd->ds),
1867 surface_height(vs->vd->ds),
29fa4ed9 1868 VNC_ENCODING_AUDIO);
bd023f95 1869 vnc_unlock_output(vs);
429a8ed3 1870 vnc_flush(vs);
1871}
1872
24236869
FB		 1873static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1874{
1875 int i;
29fa4ed9 1876 unsigned int enc = 0;
24236869 1877
29fa4ed9 1878 vs->features = 0;
a9f20d31 1879 vs->vnc_encoding = 0;
d1af0e05
CC		 1880 vs->tight.compression = 9;
1881 vs->tight.quality = -1; /* Lossless by default */
564c337e 1882 vs->absolute = -1;
24236869 1883
8a0f0d0c
CC		 1884 /*
1885 * Start from the end because the encodings are sent in order of preference.
e5bed759 1886 * This way the preferred encoding (first encoding defined in the array)
8a0f0d0c
CC		 1887 * will be set at the end of the loop.
1888 */
24236869 1889 for (i = n_encodings - 1; i >= 0; i--) {
29fa4ed9
AL		 1890 enc = encodings[i];
1891 switch (enc) {
1892 case VNC_ENCODING_RAW:
a9f20d31 1893 vs->vnc_encoding = enc;
29fa4ed9
AL		 1894 break;
1895 case VNC_ENCODING_COPYRECT:
753b4053 1896 vs->features |= VNC_FEATURE_COPYRECT_MASK;
29fa4ed9
AL		 1897 break;
1898 case VNC_ENCODING_HEXTILE:
1899 vs->features |= VNC_FEATURE_HEXTILE_MASK;
a9f20d31 1900 vs->vnc_encoding = enc;
29fa4ed9 1901 break;
380282b0
CC		 1902 case VNC_ENCODING_TIGHT:
1903 vs->features |= VNC_FEATURE_TIGHT_MASK;
1904 vs->vnc_encoding = enc;
1905 break;
fe3e7f2d 1906#ifdef CONFIG_VNC_PNG
efe556ad
CC		 1907 case VNC_ENCODING_TIGHT_PNG:
1908 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1909 vs->vnc_encoding = enc;
1910 break;
fe3e7f2d 1911#endif
059cef40
AL		 1912 case VNC_ENCODING_ZLIB:
1913 vs->features |= VNC_FEATURE_ZLIB_MASK;
a9f20d31 1914 vs->vnc_encoding = enc;
059cef40 1915 break;
148954fa
CC		 1916 case VNC_ENCODING_ZRLE:
1917 vs->features |= VNC_FEATURE_ZRLE_MASK;
1918 vs->vnc_encoding = enc;
1919 break;
1920 case VNC_ENCODING_ZYWRLE:
1921 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1922 vs->vnc_encoding = enc;
1923 break;
29fa4ed9
AL		 1924 case VNC_ENCODING_DESKTOPRESIZE:
1925 vs->features |= VNC_FEATURE_RESIZE_MASK;
1926 break;
1927 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1928 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1929 break;
d467b679
GH		 1930 case VNC_ENCODING_RICH_CURSOR:
1931 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1932 break;
29fa4ed9 1933 case VNC_ENCODING_EXT_KEY_EVENT:
9ca313aa
AL		 1934 send_ext_key_event_ack(vs);
1935 break;
29fa4ed9 1936 case VNC_ENCODING_AUDIO:
429a8ed3 1937 send_ext_audio_ack(vs);
1938 break;
29fa4ed9
AL		 1939 case VNC_ENCODING_WMVi:
1940 vs->features |= VNC_FEATURE_WMVI_MASK;
ca4cca4d 1941 break;
ab99e5c1
LL		 1942 case VNC_ENCODING_LED_STATE:
1943 vs->features |= VNC_FEATURE_LED_STATE_MASK;
1944 break;
fb437313 1945 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
d1af0e05 1946 vs->tight.compression = (enc & 0x0F);
fb437313
AL		 1947 break;
1948 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
b31f519e
CC		 1949 if (vs->vd->lossy) {
1950 vs->tight.quality = (enc & 0x0F);
1951 }
fb437313 1952 break;
29fa4ed9
AL		 1953 default:
1954 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1955 break;
1956 }
24236869 1957 }
6356e472 1958 vnc_desktop_resize(vs);
9e8dd451 1959 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
ab99e5c1 1960 vnc_led_state_change(vs);
24236869
FB		 1961}
1962
6cec5487
AL		 1963static void set_pixel_conversion(VncState *vs)
1964{
9f64916d
GH		 1965 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
1966
1967 if (fmt == VNC_SERVER_FB_FORMAT) {
6cec5487 1968 vs->write_pixels = vnc_write_pixels_copy;
70a4568f 1969 vnc_hextile_set_pixel_conversion(vs, 0);
6cec5487
AL		 1970 } else {
1971 vs->write_pixels = vnc_write_pixels_generic;
70a4568f 1972 vnc_hextile_set_pixel_conversion(vs, 1);
6cec5487
AL		 1973 }
1974}
1975
24236869 1976static void set_pixel_format(VncState *vs,
28a76be8
AL		 1977 int bits_per_pixel, int depth,
1978 int big_endian_flag, int true_color_flag,
1979 int red_max, int green_max, int blue_max,
1980 int red_shift, int green_shift, int blue_shift)
24236869 1981{
3512779a 1982 if (!true_color_flag) {
28a76be8 1983 vnc_client_error(vs);
3512779a
FB		 1984 return;
1985 }
24236869 1986
9f64916d
GH		 1987 vs->client_pf.rmax = red_max;
1988 vs->client_pf.rbits = hweight_long(red_max);
1989 vs->client_pf.rshift = red_shift;
1990 vs->client_pf.rmask = red_max << red_shift;
1991 vs->client_pf.gmax = green_max;
1992 vs->client_pf.gbits = hweight_long(green_max);
1993 vs->client_pf.gshift = green_shift;
1994 vs->client_pf.gmask = green_max << green_shift;
1995 vs->client_pf.bmax = blue_max;
1996 vs->client_pf.bbits = hweight_long(blue_max);
1997 vs->client_pf.bshift = blue_shift;
1998 vs->client_pf.bmask = blue_max << blue_shift;
1999 vs->client_pf.bits_per_pixel = bits_per_pixel;
2000 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2001 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2002 vs->client_be = big_endian_flag;
6cec5487
AL		 2003
2004 set_pixel_conversion(vs);
24236869 2005
1dbfa005
GH		 2006 graphic_hw_invalidate(NULL);
2007 graphic_hw_update(NULL);
24236869
FB		 2008}
2009
ca4cca4d
AL		 2010static void pixel_format_message (VncState *vs) {
2011 char pad[3] = { 0, 0, 0 };
2012
9f64916d
GH		 2013 vs->client_pf = qemu_default_pixelformat(32);
2014
2015 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2016 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
ca4cca4d 2017
e2542fe2 2018#ifdef HOST_WORDS_BIGENDIAN
ca4cca4d
AL		 2019 vnc_write_u8(vs, 1); /* big-endian-flag */
2020#else
2021 vnc_write_u8(vs, 0); /* big-endian-flag */
2022#endif
2023 vnc_write_u8(vs, 1); /* true-color-flag */
9f64916d
GH		 2024 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2025 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2026 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2027 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2028 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2029 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2030 vnc_write(vs, pad, 3); /* padding */
70a4568f
CC		 2031
2032 vnc_hextile_set_pixel_conversion(vs, 0);
ca4cca4d 2033 vs->write_pixels = vnc_write_pixels_copy;
ca4cca4d
AL		 2034}
2035
753b4053 2036static void vnc_colordepth(VncState *vs)
7eac3a87 2037{
753b4053 2038 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
ca4cca4d 2039 /* Sending a WMVi message to notify the client*/
bd023f95 2040 vnc_lock_output(vs);
46a183da 2041 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
ca4cca4d
AL		 2042 vnc_write_u8(vs, 0);
2043 vnc_write_u16(vs, 1); /* number of rects */
d39fa6d8
GH		 2044 vnc_framebuffer_update(vs, 0, 0,
2045 surface_width(vs->vd->ds),
2046 surface_height(vs->vd->ds),
2047 VNC_ENCODING_WMVi);
ca4cca4d 2048 pixel_format_message(vs);
bd023f95 2049 vnc_unlock_output(vs);
ca4cca4d 2050 vnc_flush(vs);
7eac3a87 2051 } else {
6cec5487 2052 set_pixel_conversion(vs);
7eac3a87
AL		 2053 }
2054}
2055
60fe76f3 2056static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
24236869
FB		 2057{
2058 int i;
2059 uint16_t limit;
2430ffe4
SS		 2060 VncDisplay *vd = vs->vd;
2061
2062 if (data[0] > 3) {
0f7b2864 2063 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2430ffe4 2064 }
24236869
FB		 2065
2066 switch (data[0]) {
46a183da 2067 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
28a76be8
AL		 2068 if (len == 1)
2069 return 20;
2070
2071 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
2072 read_u8(data, 6), read_u8(data, 7),
2073 read_u16(data, 8), read_u16(data, 10),
2074 read_u16(data, 12), read_u8(data, 14),
2075 read_u8(data, 15), read_u8(data, 16));
2076 break;
46a183da 2077 case VNC_MSG_CLIENT_SET_ENCODINGS:
28a76be8
AL		 2078 if (len == 1)
2079 return 4;
24236869 2080
28a76be8 2081 if (len == 4) {
69dd5c9f
AL		 2082 limit = read_u16(data, 2);
2083 if (limit > 0)
2084 return 4 + (limit * 4);
2085 } else
2086 limit = read_u16(data, 2);
24236869 2087
28a76be8
AL		 2088 for (i = 0; i < limit; i++) {
2089 int32_t val = read_s32(data, 4 + (i * 4));
2090 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2091 }
24236869 2092
28a76be8
AL		 2093 set_encodings(vs, (int32_t *)(data + 4), limit);
2094 break;
46a183da 2095 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
28a76be8
AL		 2096 if (len == 1)
2097 return 10;
24236869 2098
28a76be8
AL		 2099 framebuffer_update_request(vs,
2100 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2101 read_u16(data, 6), read_u16(data, 8));
2102 break;
46a183da 2103 case VNC_MSG_CLIENT_KEY_EVENT:
28a76be8
AL		 2104 if (len == 1)
2105 return 8;
24236869 2106
28a76be8
AL		 2107 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2108 break;
46a183da 2109 case VNC_MSG_CLIENT_POINTER_EVENT:
28a76be8
AL		 2110 if (len == 1)
2111 return 6;
24236869 2112
28a76be8
AL		 2113 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2114 break;
46a183da 2115 case VNC_MSG_CLIENT_CUT_TEXT:
28a76be8
AL		 2116 if (len == 1)
2117 return 8;
24236869 2118
28a76be8 2119 if (len == 8) {
baa7666c
TS		 2120 uint32_t dlen = read_u32(data, 4);
2121 if (dlen > 0)
2122 return 8 + dlen;
2123 }
24236869 2124
28a76be8
AL		 2125 client_cut_text(vs, read_u32(data, 4), data + 8);
2126 break;
46a183da 2127 case VNC_MSG_CLIENT_QEMU:
9ca313aa
AL		 2128 if (len == 1)
2129 return 2;
2130
2131 switch (read_u8(data, 1)) {
46a183da 2132 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
9ca313aa
AL		 2133 if (len == 2)
2134 return 12;
2135
2136 ext_key_event(vs, read_u16(data, 2),
2137 read_u32(data, 4), read_u32(data, 8));
2138 break;
46a183da 2139 case VNC_MSG_CLIENT_QEMU_AUDIO:
429a8ed3 2140 if (len == 2)
2141 return 4;
2142
2143 switch (read_u16 (data, 2)) {
46a183da 2144 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
429a8ed3 2145 audio_add(vs);
2146 break;
46a183da 2147 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
429a8ed3 2148 audio_del(vs);
2149 break;
46a183da 2150 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
429a8ed3 2151 if (len == 4)
2152 return 10;
2153 switch (read_u8(data, 4)) {
2154 case 0: vs->as.fmt = AUD_FMT_U8; break;
2155 case 1: vs->as.fmt = AUD_FMT_S8; break;
2156 case 2: vs->as.fmt = AUD_FMT_U16; break;
2157 case 3: vs->as.fmt = AUD_FMT_S16; break;
2158 case 4: vs->as.fmt = AUD_FMT_U32; break;
2159 case 5: vs->as.fmt = AUD_FMT_S32; break;
2160 default:
2161 printf("Invalid audio format %d\n", read_u8(data, 4));
2162 vnc_client_error(vs);
2163 break;
2164 }
2165 vs->as.nchannels = read_u8(data, 5);
2166 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2167 printf("Invalid audio channel coount %d\n",
2168 read_u8(data, 5));
2169 vnc_client_error(vs);
2170 break;
2171 }
2172 vs->as.freq = read_u32(data, 6);
2173 break;
2174 default:
2175 printf ("Invalid audio message %d\n", read_u8(data, 4));
2176 vnc_client_error(vs);
2177 break;
2178 }
2179 break;
2180
9ca313aa
AL		 2181 default:
2182 printf("Msg: %d\n", read_u16(data, 0));
2183 vnc_client_error(vs);
2184 break;
2185 }
2186 break;
24236869 2187 default:
28a76be8
AL		 2188 printf("Msg: %d\n", data[0]);
2189 vnc_client_error(vs);
2190 break;
24236869 2191 }
5fafdf24 2192
24236869
FB		 2193 vnc_read_when(vs, protocol_client_msg, 1);
2194 return 0;
2195}
2196
60fe76f3 2197static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
24236869 2198{
c35734b2 2199 char buf[1024];
8cf36489 2200 VncShareMode mode;
c35734b2 2201 int size;
24236869 2202
8cf36489
GH		 2203 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2204 switch (vs->vd->share_policy) {
2205 case VNC_SHARE_POLICY_IGNORE:
2206 /*
2207 * Ignore the shared flag. Nothing to do here.
2208 *
2209 * Doesn't conform to the rfb spec but is traditional qemu
2210 * behavior, thus left here as option for compatibility
2211 * reasons.
2212 */
2213 break;
2214 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2215 /*
2216 * Policy: Allow clients ask for exclusive access.
2217 *
2218 * Implementation: When a client asks for exclusive access,
2219 * disconnect all others. Shared connects are allowed as long
2220 * as no exclusive connection exists.
2221 *
2222 * This is how the rfb spec suggests to handle the shared flag.
2223 */
2224 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2225 VncState *client;
2226 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2227 if (vs == client) {
2228 continue;
2229 }
2230 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2231 client->share_mode != VNC_SHARE_MODE_SHARED) {
2232 continue;
2233 }
2234 vnc_disconnect_start(client);
2235 }
2236 }
2237 if (mode == VNC_SHARE_MODE_SHARED) {
2238 if (vs->vd->num_exclusive > 0) {
2239 vnc_disconnect_start(vs);
2240 return 0;
2241 }
2242 }
2243 break;
2244 case VNC_SHARE_POLICY_FORCE_SHARED:
2245 /*
2246 * Policy: Shared connects only.
2247 * Implementation: Disallow clients asking for exclusive access.
2248 *
2249 * Useful for shared desktop sessions where you don't want
2250 * someone forgetting to say -shared when running the vnc
2251 * client disconnect everybody else.
2252 */
2253 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2254 vnc_disconnect_start(vs);
2255 return 0;
2256 }
2257 break;
2258 }
2259 vnc_set_share_mode(vs, mode);
2260
d39fa6d8
GH		 2261 vs->client_width = surface_width(vs->vd->ds);
2262 vs->client_height = surface_height(vs->vd->ds);
5862d195
GH		 2263 vnc_write_u16(vs, vs->client_width);
2264 vnc_write_u16(vs, vs->client_height);
24236869 2265
ca4cca4d 2266 pixel_format_message(vs);
24236869 2267
c35734b2
TS		 2268 if (qemu_name)
2269 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2270 else
2271 size = snprintf(buf, sizeof(buf), "QEMU");
2272
2273 vnc_write_u32(vs, size);
2274 vnc_write(vs, buf, size);
24236869
FB		 2275 vnc_flush(vs);
2276
4a80dba3 2277 vnc_client_cache_auth(vs);
0d2ed46a 2278 vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
4a80dba3 2279
24236869
FB		 2280 vnc_read_when(vs, protocol_client_msg, 1);
2281
2282 return 0;
2283}
2284
5fb6c7a8
AL		 2285void start_client_init(VncState *vs)
2286{
2287 vnc_read_when(vs, protocol_client_init, 1);
2288}
2289
70848515
TS		 2290static void make_challenge(VncState *vs)
2291{
2292 int i;
2293
2294 srand(time(NULL)+getpid()+getpid()*987654+rand());
2295
2296 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2297 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2298}
2299
60fe76f3 2300static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
70848515 2301{
60fe76f3 2302 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
70848515 2303 int i, j, pwlen;
60fe76f3 2304 unsigned char key[8];
3c9405a0 2305 time_t now = time(NULL);
70848515 2306
1cd20f8b 2307 if (!vs->vd->password) {
28a76be8 2308 VNC_DEBUG("No password configured on server");
6bffdf0f 2309 goto reject;
70848515 2310 }
3c9405a0
GH		 2311 if (vs->vd->expires < now) {
2312 VNC_DEBUG("Password is expired");
2313 goto reject;
2314 }
70848515
TS		 2315
2316 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2317
2318 /* Calculate the expected challenge response */
753b4053 2319 pwlen = strlen(vs->vd->password);
70848515 2320 for (i=0; i<sizeof(key); i++)
753b4053 2321 key[i] = i<pwlen ? vs->vd->password[i] : 0;
70848515
TS		 2322 deskey(key, EN0);
2323 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2324 des(response+j, response+j);
2325
2326 /* Compare expected vs actual challenge response */
2327 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
e5bed759 2328 VNC_DEBUG("Client challenge response did not match\n");
6bffdf0f 2329 goto reject;
70848515 2330 } else {
28a76be8
AL		 2331 VNC_DEBUG("Accepting VNC challenge response\n");
2332 vnc_write_u32(vs, 0); /* Accept auth */
2333 vnc_flush(vs);
70848515 2334
5fb6c7a8 2335 start_client_init(vs);
70848515
TS		 2336 }
2337 return 0;
6bffdf0f
GH		 2338
2339reject:
2340 vnc_write_u32(vs, 1); /* Reject auth */
2341 if (vs->minor >= 8) {
2342 static const char err[] = "Authentication failed";
2343 vnc_write_u32(vs, sizeof(err));
2344 vnc_write(vs, err, sizeof(err));
2345 }
2346 vnc_flush(vs);
2347 vnc_client_error(vs);
2348 return 0;
70848515
TS		 2349}
2350
5fb6c7a8 2351void start_auth_vnc(VncState *vs)
70848515
TS		 2352{
2353 make_challenge(vs);
2354 /* Send client a 'random' challenge */
2355 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2356 vnc_flush(vs);
2357
2358 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
469b15c6
TS		 2359}
2360
2361
60fe76f3 2362static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
70848515
TS		 2363{
2364 /* We only advertise 1 auth scheme at a time, so client
2365 * must pick the one we sent. Verify this */
7e7e2ebc 2366 if (data[0] != vs->auth) { /* Reject auth */
1263b7d6 2367 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
70848515
TS		 2368 vnc_write_u32(vs, 1);
2369 if (vs->minor >= 8) {
2370 static const char err[] = "Authentication failed";
2371 vnc_write_u32(vs, sizeof(err));
2372 vnc_write(vs, err, sizeof(err));
2373 }
2374 vnc_client_error(vs);
2375 } else { /* Accept requested auth */
2376 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
7e7e2ebc 2377 switch (vs->auth) {
70848515
TS		 2378 case VNC_AUTH_NONE:
2379 VNC_DEBUG("Accept auth none\n");
a26c97ad
AZ		 2380 if (vs->minor >= 8) {
2381 vnc_write_u32(vs, 0); /* Accept auth completion */
2382 vnc_flush(vs);
2383 }
5fb6c7a8 2384 start_client_init(vs);
70848515
TS		 2385 break;
2386
2387 case VNC_AUTH_VNC:
2388 VNC_DEBUG("Start VNC auth\n");
5fb6c7a8
AL		 2389 start_auth_vnc(vs);
2390 break;
70848515 2391
eb38c52c 2392#ifdef CONFIG_VNC_TLS
8d5d2d4c 2393 case VNC_AUTH_VENCRYPT:
3a93113a 2394 VNC_DEBUG("Accept VeNCrypt auth\n");
5fb6c7a8
AL		 2395 start_auth_vencrypt(vs);
2396 break;
8d5d2d4c
TS		 2397#endif /* CONFIG_VNC_TLS */
2398
2f9606b3
AL		 2399#ifdef CONFIG_VNC_SASL
2400 case VNC_AUTH_SASL:
2401 VNC_DEBUG("Accept SASL auth\n");
2402 start_auth_sasl(vs);
2403 break;
2404#endif /* CONFIG_VNC_SASL */
2405
70848515 2406 default: /* Should not be possible, but just in case */
7e7e2ebc 2407 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
70848515
TS		 2408 vnc_write_u8(vs, 1);
2409 if (vs->minor >= 8) {
2410 static const char err[] = "Authentication failed";
2411 vnc_write_u32(vs, sizeof(err));
2412 vnc_write(vs, err, sizeof(err));
2413 }
2414 vnc_client_error(vs);
2415 }
2416 }
2417 return 0;
2418}
2419
60fe76f3 2420static int protocol_version(VncState *vs, uint8_t *version, size_t len)
24236869
FB		 2421{
2422 char local[13];
24236869
FB		 2423
2424 memcpy(local, version, 12);
2425 local[12] = 0;
2426
70848515 2427 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
28a76be8
AL		 2428 VNC_DEBUG("Malformed protocol version %s\n", local);
2429 vnc_client_error(vs);
2430 return 0;
24236869 2431 }
70848515
TS		 2432 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2433 if (vs->major != 3 ||
28a76be8
AL		 2434 (vs->minor != 3 &&
2435 vs->minor != 4 &&
2436 vs->minor != 5 &&
2437 vs->minor != 7 &&
2438 vs->minor != 8)) {
2439 VNC_DEBUG("Unsupported client version\n");
2440 vnc_write_u32(vs, VNC_AUTH_INVALID);
2441 vnc_flush(vs);
2442 vnc_client_error(vs);
2443 return 0;
70848515 2444 }
b0566f4f 2445 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
70848515
TS		 2446 * as equivalent to v3.3 by servers
2447 */
b0566f4f 2448 if (vs->minor == 4 || vs->minor == 5)
28a76be8 2449 vs->minor = 3;
70848515
TS		 2450
2451 if (vs->minor == 3) {
7e7e2ebc 2452 if (vs->auth == VNC_AUTH_NONE) {
70848515 2453 VNC_DEBUG("Tell client auth none\n");
7e7e2ebc 2454 vnc_write_u32(vs, vs->auth);
70848515 2455 vnc_flush(vs);
28a76be8 2456 start_client_init(vs);
7e7e2ebc 2457 } else if (vs->auth == VNC_AUTH_VNC) {
70848515 2458 VNC_DEBUG("Tell client VNC auth\n");
7e7e2ebc 2459 vnc_write_u32(vs, vs->auth);
70848515
TS		 2460 vnc_flush(vs);
2461 start_auth_vnc(vs);
2462 } else {
7e7e2ebc 2463 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
70848515
TS		 2464 vnc_write_u32(vs, VNC_AUTH_INVALID);
2465 vnc_flush(vs);
2466 vnc_client_error(vs);
2467 }
2468 } else {
7e7e2ebc 2469 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
28a76be8 2470 vnc_write_u8(vs, 1); /* num auth */
7e7e2ebc 2471 vnc_write_u8(vs, vs->auth);
28a76be8
AL		 2472 vnc_read_when(vs, protocol_client_auth, 1);
2473 vnc_flush(vs);
70848515 2474 }
24236869
FB		 2475
2476 return 0;
2477}
2478
999342a0
CC		 2479static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2480{
2481 struct VncSurface *vs = &vd->guest;
2482
2483 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2484}
2485
7d964c9d
CC		 2486void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2487{
2488 int i, j;
2489
2490 w = (x + w) / VNC_STAT_RECT;
2491 h = (y + h) / VNC_STAT_RECT;
2492 x /= VNC_STAT_RECT;
2493 y /= VNC_STAT_RECT;
2494
207f328a
CC		 2495 for (j = y; j <= h; j++) {
2496 for (i = x; i <= w; i++) {
7d964c9d
CC		 2497 vs->lossy_rect[j][i] = 1;
2498 }
2499 }
2500}
2501
2502static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2503{
2504 VncState *vs;
2505 int sty = y / VNC_STAT_RECT;
2506 int stx = x / VNC_STAT_RECT;
2507 int has_dirty = 0;
2508
2509 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2510 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2511
2512 QTAILQ_FOREACH(vs, &vd->clients, next) {
bc2429b9 2513 int j;
7d964c9d
CC		 2514
2515 /* kernel send buffers are full -> refresh later */
2516 if (vs->output.offset) {
2517 continue;
2518 }
2519
2520 if (!vs->lossy_rect[sty][stx]) {
2521 continue;
2522 }
207f328a 2523
7d964c9d
CC		 2524 vs->lossy_rect[sty][stx] = 0;
2525 for (j = 0; j < VNC_STAT_RECT; ++j) {
bc2429b9 2526 bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);
7d964c9d
CC		 2527 }
2528 has_dirty++;
2529 }
207f328a 2530
7d964c9d
CC		 2531 return has_dirty;
2532}
2533
2534static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
999342a0 2535{
9f64916d
GH		 2536 int width = pixman_image_get_width(vd->guest.fb);
2537 int height = pixman_image_get_height(vd->guest.fb);
999342a0
CC		 2538 int x, y;
2539 struct timeval res;
7d964c9d 2540 int has_dirty = 0;
999342a0 2541
9f64916d
GH		 2542 for (y = 0; y < height; y += VNC_STAT_RECT) {
2543 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 2544 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2545
2546 rect->updated = false;
2547 }
2548 }
2549
ad620c29 2550 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
999342a0
CC		 2551
2552 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
7d964c9d 2553 return has_dirty;
999342a0
CC		 2554 }
2555 vd->guest.last_freq_check = *tv;
2556
9f64916d
GH		 2557 for (y = 0; y < height; y += VNC_STAT_RECT) {
2558 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 2559 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2560 int count = ARRAY_SIZE(rect->times);
2561 struct timeval min, max;
2562
2563 if (!timerisset(&rect->times[count - 1])) {
2564 continue ;
2565 }
2566
2567 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 2568 qemu_timersub(tv, &max, &res);
999342a0
CC		 2569
2570 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2571 rect->freq = 0;
7d964c9d 2572 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
999342a0
CC		 2573 memset(rect->times, 0, sizeof (rect->times));
2574 continue ;
2575 }
2576
2577 min = rect->times[rect->idx];
2578 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 2579 qemu_timersub(&max, &min, &res);
999342a0
CC		 2580
2581 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2582 rect->freq /= count;
2583 rect->freq = 1. / rect->freq;
2584 }
2585 }
7d964c9d 2586 return has_dirty;
999342a0
CC		 2587}
2588
2589double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2590{
2591 int i, j;
2592 double total = 0;
2593 int num = 0;
2594
2595 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2596 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2597
2598 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2599 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2600 total += vnc_stat_rect(vs->vd, i, j)->freq;
2601 num++;
2602 }
2603 }
2604
2605 if (num) {
2606 return total / num;
2607 } else {
2608 return 0;
2609 }
2610}
2611
2612static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2613{
2614 VncRectStat *rect;
2615
2616 rect = vnc_stat_rect(vd, x, y);
2617 if (rect->updated) {
2618 return ;
2619 }
2620 rect->times[rect->idx] = *tv;
2621 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2622 rect->updated = true;
2623}
2624
1fc62412
SS		 2625static int vnc_refresh_server_surface(VncDisplay *vd)
2626{
9f64916d
GH		 2627 int width = pixman_image_get_width(vd->guest.fb);
2628 int height = pixman_image_get_height(vd->guest.fb);
1fc62412
SS		 2629 int y;
2630 uint8_t *guest_row;
2631 uint8_t *server_row;
2632 int cmp_bytes;
41b4bef6 2633 VncState *vs;
1fc62412 2634 int has_dirty = 0;
9f64916d 2635 pixman_image_t *tmpbuf = NULL;
1fc62412 2636
80e0c8c3 2637 struct timeval tv = { 0, 0 };
999342a0 2638
80e0c8c3
CC		 2639 if (!vd->non_adaptive) {
2640 gettimeofday(&tv, NULL);
2641 has_dirty = vnc_update_stats(vd, &tv);
2642 }
999342a0 2643
1fc62412
SS		 2644 /*
2645 * Walk through the guest dirty map.
2646 * Check and copy modified bits from guest to server surface.
2647 * Update server dirty map.
2648 */
9f64916d
GH		 2649 cmp_bytes = 64;
2650 if (cmp_bytes > vnc_server_fb_stride(vd)) {
2651 cmp_bytes = vnc_server_fb_stride(vd);
2652 }
2653 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2654 int width = pixman_image_get_width(vd->server);
2655 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
9e4dd565 2656 }
9f64916d
GH		 2657 guest_row = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2658 server_row = (uint8_t *)pixman_image_get_data(vd->server);
2659 for (y = 0; y < height; y++) {
23bfe28f 2660 if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) {
1fc62412
SS		 2661 int x;
2662 uint8_t *guest_ptr;
2663 uint8_t *server_ptr;
2664
9f64916d 2665 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
bc210eb1 2666 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
9f64916d
GH		 2667 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2668 } else {
2669 guest_ptr = guest_row;
2670 }
1fc62412
SS		 2671 server_ptr = server_row;
2672
9f64916d 2673 for (x = 0; x + 15 < width;
1fc62412 2674 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
bc2429b9 2675 if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
1fc62412 2676 continue;
1fc62412
SS		 2677 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2678 continue;
2679 memcpy(server_ptr, guest_ptr, cmp_bytes);
80e0c8c3
CC		 2680 if (!vd->non_adaptive)
2681 vnc_rect_updated(vd, x, y, &tv);
41b4bef6 2682 QTAILQ_FOREACH(vs, &vd->clients, next) {
bc2429b9 2683 set_bit((x / 16), vs->dirty[y]);
1fc62412
SS		 2684 }
2685 has_dirty++;
2686 }
2687 }
9f64916d
GH		 2688 guest_row += pixman_image_get_stride(vd->guest.fb);
2689 server_row += pixman_image_get_stride(vd->server);
1fc62412 2690 }
9f64916d 2691 qemu_pixman_image_unref(tmpbuf);
1fc62412
SS		 2692 return has_dirty;
2693}
2694
0f7b2864 2695static void vnc_refresh(DisplayChangeListener *dcl)
703bc68f 2696{
0f7b2864 2697 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
41b4bef6
AS		 2698 VncState *vs, *vn;
2699 int has_dirty, rects = 0;
703bc68f 2700
1dbfa005 2701 graphic_hw_update(NULL);
703bc68f 2702
bd023f95 2703 if (vnc_trylock_display(vd)) {
0f7b2864 2704 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
bd023f95
CC		 2705 return;
2706 }
2707
1fc62412 2708 has_dirty = vnc_refresh_server_surface(vd);
bd023f95 2709 vnc_unlock_display(vd);
1fc62412 2710
41b4bef6 2711 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2430ffe4 2712 rects += vnc_update_client(vs, has_dirty);
6185c578 2713 /* vs might be free()ed here */
703bc68f 2714 }
bd023f95 2715
0f7b2864
GH		 2716 if (QTAILQ_EMPTY(&vd->clients)) {
2717 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
83755c17 2718 return;
0f7b2864 2719 }
703bc68f 2720
2430ffe4 2721 if (has_dirty && rects) {
0f7b2864
GH		 2722 vd->dcl.update_interval /= 2;
2723 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2724 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2725 }
2430ffe4 2726 } else {
0f7b2864
GH		 2727 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2728 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2729 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2730 }
703bc68f
SS		 2731 }
2732}
2733
7536ee4b 2734static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket)
3aa3eea3 2735{
7267c094 2736 VncState *vs = g_malloc0(sizeof(VncState));
7d964c9d
CC		 2737 int i;
2738
753b4053 2739 vs->csock = csock;
7e7e2ebc
DB		 2740
2741 if (skipauth) {
2742 vs->auth = VNC_AUTH_NONE;
2743#ifdef CONFIG_VNC_TLS
2744 vs->subauth = VNC_AUTH_INVALID;
2745#endif
2746 } else {
2747 vs->auth = vd->auth;
2748#ifdef CONFIG_VNC_TLS
2749 vs->subauth = vd->subauth;
2750#endif
2751 }
2752
7267c094 2753 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
7d964c9d 2754 for (i = 0; i < VNC_STAT_ROWS; ++i) {
7267c094 2755 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
7d964c9d 2756 }
753b4053
AL		 2757
2758 VNC_DEBUG("New client on socket %d\n", csock);
0f7b2864 2759 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
f9e8cacc 2760 qemu_set_nonblock(vs->csock);
7536ee4b
TH		 2761#ifdef CONFIG_VNC_WS
2762 if (websocket) {
2763 vs->websocket = 1;
2764 qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
2765 } else
2766#endif /* CONFIG_VNC_WS */
2767 {
2768 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2769 }
753b4053 2770
4a80dba3 2771 vnc_client_cache_addr(vs);
586153d9 2772 vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
8cf36489 2773 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
4a80dba3 2774
753b4053 2775 vs->vd = vd;
7536ee4b
TH		 2776
2777#ifdef CONFIG_VNC_WS
2778 if (!vs->websocket)
2779#endif
2780 {
2781 vnc_init_state(vs);
2782 }
2783}
2784
2785void vnc_init_state(VncState *vs)
2786{
6fd8e79a 2787 vs->initialized = true;
7536ee4b
TH		 2788 VncDisplay *vd = vs->vd;
2789
753b4053
AL		 2790 vs->last_x = -1;
2791 vs->last_y = -1;
2792
2793 vs->as.freq = 44100;
2794 vs->as.nchannels = 2;
2795 vs->as.fmt = AUD_FMT_S16;
2796 vs->as.endianness = 0;
2797
bd023f95 2798 qemu_mutex_init(&vs->output_mutex);
175b2a6e 2799 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
bd023f95 2800
41b4bef6 2801 QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
1fc62412 2802
1dbfa005 2803 graphic_hw_update(NULL);
1fc62412 2804
3aa3eea3
AZ		 2805 vnc_write(vs, "RFB 003.008\n", 12);
2806 vnc_flush(vs);
2807 vnc_read_when(vs, protocol_version, 12);
53762ddb 2808 reset_keys(vs);
3a0558b5
GH		 2809 if (vs->vd->lock_key_sync)
2810 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
753b4053 2811
37c34d9d
AL		 2812 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2813 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2814
198a0039 2815 /* vs might be free()ed here */
3aa3eea3
AZ		 2816}
2817
7536ee4b 2818static void vnc_listen_read(void *opaque, bool websocket)
24236869 2819{
753b4053 2820 VncDisplay *vs = opaque;
24236869
FB		 2821 struct sockaddr_in addr;
2822 socklen_t addrlen = sizeof(addr);
7536ee4b 2823 int csock;
24236869 2824
9f60ad50 2825 /* Catch-up */
1dbfa005 2826 graphic_hw_update(NULL);
7536ee4b
TH		 2827#ifdef CONFIG_VNC_WS
2828 if (websocket) {
2829 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen);
2830 } else
2831#endif /* CONFIG_VNC_WS */
2832 {
2833 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2834 }
9f60ad50 2835
753b4053 2836 if (csock != -1) {
7536ee4b 2837 vnc_connect(vs, csock, 0, websocket);
24236869
FB		 2838 }
2839}
2840
7536ee4b
TH		 2841static void vnc_listen_regular_read(void *opaque)
2842{
2843 vnc_listen_read(opaque, 0);
2844}
2845
2846#ifdef CONFIG_VNC_WS
2847static void vnc_listen_websocket_read(void *opaque)
2848{
2849 vnc_listen_read(opaque, 1);
2850}
2851#endif /* CONFIG_VNC_WS */
2852
7c20b4a3
GH		 2853static const DisplayChangeListenerOps dcl_ops = {
2854 .dpy_name = "vnc",
0f7b2864 2855 .dpy_refresh = vnc_refresh,
7c20b4a3
GH		 2856 .dpy_gfx_copy = vnc_dpy_copy,
2857 .dpy_gfx_update = vnc_dpy_update,
c12aeb86 2858 .dpy_gfx_switch = vnc_dpy_switch,
7c20b4a3
GH		 2859 .dpy_mouse_set = vnc_mouse_set,
2860 .dpy_cursor_define = vnc_dpy_cursor_define,
2861};
2862
71cab5ca 2863void vnc_display_init(DisplayState *ds)
24236869 2864{
7267c094 2865 VncDisplay *vs = g_malloc0(sizeof(*vs));
24236869 2866
753b4053 2867 vnc_display = vs;
24236869
FB		 2868
2869 vs->lsock = -1;
7536ee4b
TH		 2870#ifdef CONFIG_VNC_WS
2871 vs->lwebsock = -1;
2872#endif
24236869 2873
41b4bef6 2874 QTAILQ_INIT(&vs->clients);
3c9405a0 2875 vs->expires = TIME_MAX;
24236869 2876
9ca313aa 2877 if (keyboard_layout)
0483755a 2878 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
9ca313aa 2879 else
0483755a 2880 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
24236869 2881
24236869 2882 if (!vs->kbd_layout)
28a76be8 2883 exit(1);
24236869 2884
bd023f95
CC		 2885 qemu_mutex_init(&vs->mutex);
2886 vnc_start_worker_thread();
bd023f95 2887
21ef45d7 2888 vs->dcl.ops = &dcl_ops;
5209089f 2889 register_displaychangelistener(&vs->dcl);
71cab5ca
TS		 2890}
2891
6f43024c 2892
71a8cdec 2893static void vnc_display_close(DisplayState *ds)
71cab5ca 2894{
21ef45d7 2895 VncDisplay *vs = vnc_display;
71cab5ca 2896
452b4d88
AL		 2897 if (!vs)
2898 return;
71cab5ca 2899 if (vs->display) {
7267c094 2900 g_free(vs->display);
28a76be8 2901 vs->display = NULL;
71cab5ca
TS		 2902 }
2903 if (vs->lsock != -1) {
28a76be8
AL		 2904 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2905 close(vs->lsock);
2906 vs->lsock = -1;
71cab5ca 2907 }
7536ee4b
TH		 2908#ifdef CONFIG_VNC_WS
2909 g_free(vs->ws_display);
2910 vs->ws_display = NULL;
2911 if (vs->lwebsock != -1) {
2912 qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);
2913 close(vs->lwebsock);
2914 vs->lwebsock = -1;
2915 }
2916#endif /* CONFIG_VNC_WS */
70848515 2917 vs->auth = VNC_AUTH_INVALID;
eb38c52c 2918#ifdef CONFIG_VNC_TLS
8d5d2d4c 2919 vs->subauth = VNC_AUTH_INVALID;
5fb6c7a8 2920 vs->tls.x509verify = 0;
8d5d2d4c 2921#endif
70848515
TS		 2922}
2923
71a8cdec 2924static int vnc_display_disable_login(DisplayState *ds)
1cd20f8b 2925{
21ef45d7 2926 VncDisplay *vs = vnc_display;
1cd20f8b
AL		 2927
2928 if (!vs) {
2929 return -1;
2930 }
2931
2932 if (vs->password) {
7267c094 2933 g_free(vs->password);
1cd20f8b
AL		 2934 }
2935
2936 vs->password = NULL;
7dfbfc79
DB		 2937 if (vs->auth == VNC_AUTH_NONE) {
2938 vs->auth = VNC_AUTH_VNC;
2939 }
1cd20f8b
AL		 2940
2941 return 0;
2942}
2943
70848515
TS		 2944int vnc_display_password(DisplayState *ds, const char *password)
2945{
21ef45d7 2946 VncDisplay *vs = vnc_display;
70848515 2947
7ef92331 2948 if (!vs) {
a6aa9d3e 2949 return -EINVAL;
7ef92331
ZA		 2950 }
2951
1cd20f8b
AL		 2952 if (!password) {
2953 /* This is not the intention of this interface but err on the side
2954 of being safe */
a6aa9d3e 2955 return vnc_display_disable_login(ds);
1cd20f8b
AL		 2956 }
2957
70848515 2958 if (vs->password) {
7267c094 2959 g_free(vs->password);
28a76be8 2960 vs->password = NULL;
70848515 2961 }
7267c094 2962 vs->password = g_strdup(password);
7dfbfc79
DB		 2963 if (vs->auth == VNC_AUTH_NONE) {
2964 vs->auth = VNC_AUTH_VNC;
2965 }
a6aa9d3e
LC		 2966
2967 return 0;
71cab5ca
TS		 2968}
2969
3c9405a0
GH		 2970int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2971{
21ef45d7 2972 VncDisplay *vs = vnc_display;
3c9405a0 2973
1643f2b2
GH		 2974 if (!vs) {
2975 return -EINVAL;
2976 }
2977
3c9405a0
GH		 2978 vs->expires = expires;
2979 return 0;
2980}
2981
f92f8afe
AL		 2982char *vnc_display_local_addr(DisplayState *ds)
2983{
21ef45d7 2984 VncDisplay *vs = vnc_display;
f92f8afe
AL		 2985
2986 return vnc_socket_local_addr("%s:%s", vs->lsock);
2987}
2988
2d55f0e8 2989void vnc_display_open(DisplayState *ds, const char *display, Error **errp)
71cab5ca 2990{
21ef45d7 2991 VncDisplay *vs = vnc_display;
70848515
TS		 2992 const char *options;
2993 int password = 0;
3aa3eea3 2994 int reverse = 0;
eb38c52c 2995#ifdef CONFIG_VNC_TLS
3a702699 2996 int tls = 0, x509 = 0;
8d5d2d4c 2997#endif
2f9606b3
AL		 2998#ifdef CONFIG_VNC_SASL
2999 int sasl = 0;
3000 int saslErr;
3001#endif
2ded6ad7 3002#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
76655d6d 3003 int acl = 0;
2ded6ad7 3004#endif
3a0558b5 3005 int lock_key_sync = 1;
71cab5ca 3006
2d55f0e8
PB		 3007 if (!vnc_display) {
3008 error_setg(errp, "VNC display not active");
3009 return;
3010 }
71cab5ca 3011 vnc_display_close(ds);
70848515 3012 if (strcmp(display, "none") == 0)
2d55f0e8 3013 return;
24236869 3014
1ce52c78 3015 vs->display = g_strdup(display);
8cf36489 3016 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
70848515
TS		 3017
3018 options = display;
3019 while ((options = strchr(options, ','))) {
28a76be8
AL		 3020 options++;
3021 if (strncmp(options, "password", 8) == 0) {
0f66998f 3022 if (fips_get_state()) {
2d55f0e8
PB		 3023 error_setg(errp,
3024 "VNC password auth disabled due to FIPS mode, "
3025 "consider using the VeNCrypt or SASL authentication "
3026 "methods as an alternative");
1ce52c78 3027 goto fail;
0f66998f 3028 }
28a76be8
AL		 3029 password = 1; /* Require password auth */
3030 } else if (strncmp(options, "reverse", 7) == 0) {
3031 reverse = 1;
cee8e6ad 3032 } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
3a0558b5 3033 lock_key_sync = 0;
2f9606b3 3034#ifdef CONFIG_VNC_SASL
28a76be8
AL		 3035 } else if (strncmp(options, "sasl", 4) == 0) {
3036 sasl = 1; /* Require SASL auth */
2f9606b3 3037#endif
7536ee4b
TH		 3038#ifdef CONFIG_VNC_WS
3039 } else if (strncmp(options, "websocket", 9) == 0) {
3040 char *start, *end;
3041 vs->websocket = 1;
3042
3043 /* Check for 'websocket=<port>' */
3044 start = strchr(options, '=');
3045 end = strchr(options, ',');
3046 if (start && (!end || (start < end))) {
3047 int len = end ? end-(start+1) : strlen(start+1);
3048 if (len < 6) {
3049 /* extract the host specification from display */
3050 char *host = NULL, *port = NULL, *host_end = NULL;
3051 port = g_strndup(start + 1, len);
3052
3053 /* ipv6 hosts have colons */
3054 end = strchr(display, ',');
3055 host_end = g_strrstr_len(display, end - display, ":");
3056
3057 if (host_end) {
3058 host = g_strndup(display, host_end - display + 1);
3059 } else {
3060 host = g_strndup(":", 1);
3061 }
3062 vs->ws_display = g_strconcat(host, port, NULL);
3063 g_free(host);
3064 g_free(port);
3065 }
3066 }
3067#endif /* CONFIG_VNC_WS */
eb38c52c 3068#ifdef CONFIG_VNC_TLS
28a76be8
AL		 3069 } else if (strncmp(options, "tls", 3) == 0) {
3070 tls = 1; /* Require TLS */
3071 } else if (strncmp(options, "x509", 4) == 0) {
3072 char *start, *end;
3073 x509 = 1; /* Require x509 certificates */
3074 if (strncmp(options, "x509verify", 10) == 0)
3075 vs->tls.x509verify = 1; /* ...and verify client certs */
3076
3077 /* Now check for 'x509=/some/path' postfix
3078 * and use that to setup x509 certificate/key paths */
3079 start = strchr(options, '=');
3080 end = strchr(options, ',');
3081 if (start && (!end || (start < end))) {
3082 int len = end ? end-(start+1) : strlen(start+1);
7267c094 3083 char *path = g_strndup(start + 1, len);
28a76be8
AL		 3084
3085 VNC_DEBUG("Trying certificate path '%s'\n", path);
3086 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2d55f0e8 3087 error_setg(errp, "Failed to find x509 certificates/keys in %s", path);
7267c094 3088 g_free(path);
1ce52c78 3089 goto fail;
28a76be8 3090 }
7267c094 3091 g_free(path);
28a76be8 3092 } else {
2d55f0e8 3093 error_setg(errp, "No certificate path provided");
1ce52c78 3094 goto fail;
28a76be8 3095 }
8d5d2d4c 3096#endif
2ded6ad7 3097#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
28a76be8
AL		 3098 } else if (strncmp(options, "acl", 3) == 0) {
3099 acl = 1;
2ded6ad7 3100#endif
6f9c78c1
CC		 3101 } else if (strncmp(options, "lossy", 5) == 0) {
3102 vs->lossy = true;
7eff5742 3103 } else if (strncmp(options, "non-adaptive", 12) == 0) {
80e0c8c3 3104 vs->non_adaptive = true;
8cf36489
GH		 3105 } else if (strncmp(options, "share=", 6) == 0) {
3106 if (strncmp(options+6, "ignore", 6) == 0) {
3107 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
3108 } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
3109 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3110 } else if (strncmp(options+6, "force-shared", 12) == 0) {
3111 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3112 } else {
2d55f0e8 3113 error_setg(errp, "unknown vnc share= option");
1ce52c78 3114 goto fail;
8cf36489 3115 }
28a76be8 3116 }
70848515
TS		 3117 }
3118
76655d6d
AL		 3119#ifdef CONFIG_VNC_TLS
3120 if (acl && x509 && vs->tls.x509verify) {
28a76be8
AL		 3121 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
3122 fprintf(stderr, "Failed to create x509 dname ACL\n");
3123 exit(1);
3124 }
76655d6d
AL		 3125 }
3126#endif
3127#ifdef CONFIG_VNC_SASL
3128 if (acl && sasl) {
28a76be8
AL		 3129 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
3130 fprintf(stderr, "Failed to create username ACL\n");
3131 exit(1);
3132 }
76655d6d
AL		 3133 }
3134#endif
3135
2f9606b3
AL		 3136 /*
3137 * Combinations we support here:
3138 *
3139 * - no-auth (clear text, no auth)
3140 * - password (clear text, weak auth)
3141 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
3142 * - tls (encrypt, weak anonymous creds, no auth)
3143 * - tls + password (encrypt, weak anonymous creds, weak auth)
3144 * - tls + sasl (encrypt, weak anonymous creds, good auth)
3145 * - tls + x509 (encrypt, good x509 creds, no auth)
3146 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
3147 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
3148 *
3149 * NB1. TLS is a stackable auth scheme.
3150 * NB2. the x509 schemes have option to validate a client cert dname
3151 */
70848515 3152 if (password) {
eb38c52c 3153#ifdef CONFIG_VNC_TLS
28a76be8
AL		 3154 if (tls) {
3155 vs->auth = VNC_AUTH_VENCRYPT;
3156 if (x509) {
3157 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3158 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3159 } else {
3160 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3161 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3162 }
3163 } else {
2f9606b3 3164#endif /* CONFIG_VNC_TLS */
28a76be8
AL		 3165 VNC_DEBUG("Initializing VNC server with password auth\n");
3166 vs->auth = VNC_AUTH_VNC;
eb38c52c 3167#ifdef CONFIG_VNC_TLS
28a76be8
AL		 3168 vs->subauth = VNC_AUTH_INVALID;
3169 }
2f9606b3
AL		 3170#endif /* CONFIG_VNC_TLS */
3171#ifdef CONFIG_VNC_SASL
3172 } else if (sasl) {
3173#ifdef CONFIG_VNC_TLS
3174 if (tls) {
3175 vs->auth = VNC_AUTH_VENCRYPT;
3176 if (x509) {
28a76be8 3177 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2f9606b3
AL		 3178 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3179 } else {
28a76be8 3180 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2f9606b3
AL		 3181 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3182 }
3183 } else {
3184#endif /* CONFIG_VNC_TLS */
28a76be8 3185 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2f9606b3
AL		 3186 vs->auth = VNC_AUTH_SASL;
3187#ifdef CONFIG_VNC_TLS
3188 vs->subauth = VNC_AUTH_INVALID;
3189 }
3190#endif /* CONFIG_VNC_TLS */
3191#endif /* CONFIG_VNC_SASL */
70848515 3192 } else {
eb38c52c 3193#ifdef CONFIG_VNC_TLS
28a76be8
AL		 3194 if (tls) {
3195 vs->auth = VNC_AUTH_VENCRYPT;
3196 if (x509) {
3197 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3198 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3199 } else {
3200 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3201 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3202 }
3203 } else {
8d5d2d4c 3204#endif
28a76be8
AL		 3205 VNC_DEBUG("Initializing VNC server with no auth\n");
3206 vs->auth = VNC_AUTH_NONE;
eb38c52c 3207#ifdef CONFIG_VNC_TLS
28a76be8
AL		 3208 vs->subauth = VNC_AUTH_INVALID;
3209 }
8d5d2d4c 3210#endif
70848515 3211 }
24236869 3212
2f9606b3
AL		 3213#ifdef CONFIG_VNC_SASL
3214 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2d55f0e8
PB		 3215 error_setg(errp, "Failed to initialize SASL auth: %s",
3216 sasl_errstring(saslErr, NULL, NULL));
1ce52c78 3217 goto fail;
2f9606b3
AL		 3218 }
3219#endif
3a0558b5 3220 vs->lock_key_sync = lock_key_sync;
2f9606b3 3221
3aa3eea3 3222 if (reverse) {
9712ecaf 3223 /* connect to viewer */
007fcd3e
PB		 3224 int csock;
3225 vs->lsock = -1;
7536ee4b
TH		 3226#ifdef CONFIG_VNC_WS
3227 vs->lwebsock = -1;
3228#endif
007fcd3e 3229 if (strncmp(display, "unix:", 5) == 0) {
2d55f0e8 3230 csock = unix_connect(display+5, errp);
3aa3eea3 3231 } else {
2d55f0e8 3232 csock = inet_connect(display, errp);
3aa3eea3 3233 }
007fcd3e
PB		 3234 if (csock < 0) {
3235 goto fail;
3236 }
7536ee4b 3237 vnc_connect(vs, csock, 0, 0);
9712ecaf
AL		 3238 } else {
3239 /* listen for connects */
3240 char *dpy;
7267c094 3241 dpy = g_malloc(256);
9712ecaf 3242 if (strncmp(display, "unix:", 5) == 0) {
bc575e95 3243 pstrcpy(dpy, 256, "unix:");
2d55f0e8 3244 vs->lsock = unix_listen(display+5, dpy+5, 256-5, errp);
9712ecaf 3245 } else {
029409e5 3246 vs->lsock = inet_listen(display, dpy, 256,
2d55f0e8 3247 SOCK_STREAM, 5900, errp);
7536ee4b
TH		 3248 if (vs->lsock < 0) {
3249 g_free(dpy);
3250 goto fail;
3251 }
3252#ifdef CONFIG_VNC_WS
3253 if (vs->websocket) {
3254 if (vs->ws_display) {
3255 vs->lwebsock = inet_listen(vs->ws_display, NULL, 256,
3256 SOCK_STREAM, 0, errp);
3257 } else {
3258 vs->lwebsock = inet_listen(vs->display, NULL, 256,
3259 SOCK_STREAM, 5700, errp);
3260 }
3261
3262 if (vs->lwebsock < 0) {
3263 if (vs->lsock) {
3264 close(vs->lsock);
3265 vs->lsock = -1;
3266 }
3267 g_free(dpy);
3268 goto fail;
3269 }
3270 }
3271#endif /* CONFIG_VNC_WS */
9712ecaf 3272 }
1ce52c78
PB		 3273 g_free(vs->display);
3274 vs->display = dpy;
7536ee4b
TH		 3275 qemu_set_fd_handler2(vs->lsock, NULL,
3276 vnc_listen_regular_read, NULL, vs);
3277#ifdef CONFIG_VNC_WS
3278 if (vs->websocket) {
3279 qemu_set_fd_handler2(vs->lwebsock, NULL,
3280 vnc_listen_websocket_read, NULL, vs);
3281 }
3282#endif /* CONFIG_VNC_WS */
24236869 3283 }
2d55f0e8 3284 return;
1ce52c78
PB		 3285
3286fail:
3287 g_free(vs->display);
3288 vs->display = NULL;
7536ee4b
TH		 3289#ifdef CONFIG_VNC_WS
3290 g_free(vs->ws_display);
3291 vs->ws_display = NULL;
3292#endif /* CONFIG_VNC_WS */
24236869 3293}
13661089
DB		 3294
3295void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3296{
21ef45d7 3297 VncDisplay *vs = vnc_display;
13661089 3298
7536ee4b 3299 vnc_connect(vs, csock, skipauth, 0);
13661089 3300}
Qemu copy for testing