]> git.proxmox.com Git - mirror_qemu.git/blame - ui/vnc.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
vnc: avoid underflow when accessing user-provided address
[mirror_qemu.git] / ui / vnc.c
CommitLineData
7d510b8c
FB		 1/*
2 * QEMU VNC display driver
5fafdf24 3 *
7d510b8c
FB		 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
19a490bf 6 * Copyright (C) 2009 Red Hat, Inc
5fafdf24 7 *
7d510b8c
FB		 8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
e16f4c87 27#include "qemu/osdep.h"
19a490bf 28#include "vnc.h"
bd023f95 29#include "vnc-jobs.h"
40066175 30#include "trace.h"
13d4ff07 31#include "hw/qdev-core.h"
9c17d615 32#include "sysemu/sysemu.h"
7b5fa0b5 33#include "sysemu/runstate.h"
d49b6836 34#include "qemu/error-report.h"
db725815 35#include "qemu/main-loop.h"
0b8fa32f 36#include "qemu/module.h"
922a01a0 37#include "qemu/option.h"
1de7afc9
PB		 38#include "qemu/sockets.h"
39#include "qemu/timer.h"
b76806d4 40#include "authz/list.h"
4db14629 41#include "qemu/config-file.h"
5d75648b
MA		 42#include "qapi/qapi-emit-events.h"
43#include "qapi/qapi-events-ui.h"
e688df6b 44#include "qapi/error.h"
9af23989 45#include "qapi/qapi-commands-ui.h"
8d447d10 46#include "ui/input.h"
8e9b0d24 47#include "crypto/hash.h"
3c52bf0c 48#include "crypto/tlscreds.h"
3e305e4a
DB		 49#include "crypto/tlscredsanon.h"
50#include "crypto/tlscredsx509.h"
f7b2502c 51#include "crypto/random.h"
6c6840e9 52#include "crypto/secret_common.h"
3e305e4a 53#include "qom/object_interfaces.h"
f348b6d1 54#include "qemu/cutils.h"
653c9747 55#include "qemu/help_option.h"
57a6d6d5 56#include "io/dns-resolver.h"
756a98dd 57#include "monitor/monitor.h"
24236869 58
0f7b2864 59#define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
2430ffe4 60#define VNC_REFRESH_INTERVAL_INC 50
0f7b2864 61#define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
999342a0
CC		 62static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
63static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
24236869
FB		 64
65#include "vnc_keysym.h"
800567a6 66#include "crypto/cipher.h"
70848515 67
d616ccc5
GH		 68static QTAILQ_HEAD(, VncDisplay) vnc_displays =
69 QTAILQ_HEAD_INITIALIZER(vnc_displays);
a9ce8590 70
d467b679 71static int vnc_cursor_define(VncState *vs);
e2b72cb6 72static void vnc_update_throttle_offset(VncState *vs);
d467b679 73
8cf36489
GH		 74static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
75{
76#ifdef _VNC_DEBUG
77 static const char *mn[] = {
78 [0] = "undefined",
79 [VNC_SHARE_MODE_CONNECTING] = "connecting",
80 [VNC_SHARE_MODE_SHARED] = "shared",
81 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
82 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
83 };
04d2529d
DB		 84 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
85 vs->ioc, mn[vs->share_mode], mn[mode]);
8cf36489
GH		 86#endif
87
e5f34cdd
GH		 88 switch (vs->share_mode) {
89 case VNC_SHARE_MODE_CONNECTING:
90 vs->vd->num_connecting--;
91 break;
92 case VNC_SHARE_MODE_SHARED:
93 vs->vd->num_shared--;
94 break;
95 case VNC_SHARE_MODE_EXCLUSIVE:
8cf36489 96 vs->vd->num_exclusive--;
e5f34cdd
GH		 97 break;
98 default:
99 break;
8cf36489 100 }
e5f34cdd 101
8cf36489 102 vs->share_mode = mode;
e5f34cdd
GH		 103
104 switch (vs->share_mode) {
105 case VNC_SHARE_MODE_CONNECTING:
106 vs->vd->num_connecting++;
107 break;
108 case VNC_SHARE_MODE_SHARED:
109 vs->vd->num_shared++;
110 break;
111 case VNC_SHARE_MODE_EXCLUSIVE:
8cf36489 112 vs->vd->num_exclusive++;
e5f34cdd
GH		 113 break;
114 default:
115 break;
8cf36489
GH		 116 }
117}
118
1ff7df1a 119
bd269ebc 120static void vnc_init_basic_info(SocketAddress *addr,
98481bfc
EB		 121 VncBasicInfo *info,
122 Error **errp)
d96fd29c 123{
04d2529d 124 switch (addr->type) {
bd269ebc
MA		 125 case SOCKET_ADDRESS_TYPE_INET:
126 info->host = g_strdup(addr->u.inet.host);
127 info->service = g_strdup(addr->u.inet.port);
128 if (addr->u.inet.ipv6) {
04d2529d
DB		 129 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
130 } else {
131 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
132 }
133 break;
d96fd29c 134
bd269ebc 135 case SOCKET_ADDRESS_TYPE_UNIX:
04d2529d 136 info->host = g_strdup("");
bd269ebc 137 info->service = g_strdup(addr->u.q_unix.path);
04d2529d
DB		 138 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
139 break;
140
bd269ebc
MA		 141 case SOCKET_ADDRESS_TYPE_VSOCK:
142 case SOCKET_ADDRESS_TYPE_FD:
a6c76285 143 error_setg(errp, "Unsupported socket address type %s",
977c736f 144 SocketAddressType_str(addr->type));
04d2529d 145 break;
a6c76285
MA		 146 default:
147 abort();
d96fd29c
LC		 148 }
149
04d2529d 150 return;
d96fd29c
LC		 151}
152
04d2529d
DB		 153static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
154 VncBasicInfo *info,
98481bfc 155 Error **errp)
d96fd29c 156{
bd269ebc 157 SocketAddress *addr = NULL;
d96fd29c 158
624cdd46
DB		 159 if (!ioc) {
160 error_setg(errp, "No listener socket available");
161 return;
162 }
163
04d2529d
DB		 164 addr = qio_channel_socket_get_local_address(ioc, errp);
165 if (!addr) {
98481bfc 166 return;
d96fd29c
LC		 167 }
168
04d2529d 169 vnc_init_basic_info(addr, info, errp);
bd269ebc 170 qapi_free_SocketAddress(addr);
d96fd29c
LC		 171}
172
04d2529d
DB		 173static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
174 VncBasicInfo *info,
98481bfc 175 Error **errp)
d96fd29c 176{
bd269ebc 177 SocketAddress *addr = NULL;
d96fd29c 178
04d2529d
DB		 179 addr = qio_channel_socket_get_remote_address(ioc, errp);
180 if (!addr) {
98481bfc 181 return;
d96fd29c
LC		 182 }
183
04d2529d 184 vnc_init_basic_info(addr, info, errp);
bd269ebc 185 qapi_free_SocketAddress(addr);
d96fd29c
LC		 186}
187
1ff7df1a
AL		 188static const char *vnc_auth_name(VncDisplay *vd) {
189 switch (vd->auth) {
190 case VNC_AUTH_INVALID:
191 return "invalid";
192 case VNC_AUTH_NONE:
193 return "none";
194 case VNC_AUTH_VNC:
195 return "vnc";
196 case VNC_AUTH_RA2:
197 return "ra2";
198 case VNC_AUTH_RA2NE:
199 return "ra2ne";
200 case VNC_AUTH_TIGHT:
201 return "tight";
202 case VNC_AUTH_ULTRA:
203 return "ultra";
204 case VNC_AUTH_TLS:
205 return "tls";
206 case VNC_AUTH_VENCRYPT:
1ff7df1a
AL		 207 switch (vd->subauth) {
208 case VNC_AUTH_VENCRYPT_PLAIN:
209 return "vencrypt+plain";
210 case VNC_AUTH_VENCRYPT_TLSNONE:
211 return "vencrypt+tls+none";
212 case VNC_AUTH_VENCRYPT_TLSVNC:
213 return "vencrypt+tls+vnc";
214 case VNC_AUTH_VENCRYPT_TLSPLAIN:
215 return "vencrypt+tls+plain";
216 case VNC_AUTH_VENCRYPT_X509NONE:
217 return "vencrypt+x509+none";
218 case VNC_AUTH_VENCRYPT_X509VNC:
219 return "vencrypt+x509+vnc";
220 case VNC_AUTH_VENCRYPT_X509PLAIN:
221 return "vencrypt+x509+plain";
28a76be8
AL		 222 case VNC_AUTH_VENCRYPT_TLSSASL:
223 return "vencrypt+tls+sasl";
224 case VNC_AUTH_VENCRYPT_X509SASL:
225 return "vencrypt+x509+sasl";
1ff7df1a
AL		 226 default:
227 return "vencrypt";
228 }
2f9606b3 229 case VNC_AUTH_SASL:
28a76be8 230 return "sasl";
1ff7df1a
AL		 231 }
232 return "unknown";
233}
234
d616ccc5 235static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
a7789382 236{
fb6ba0d5 237 VncServerInfo *info;
98481bfc 238 Error *err = NULL;
a7789382 239
13e1d0e7 240 if (!vd->listener || !vd->listener->nsioc) {
4ee74fa7
DB		 241 return NULL;
242 }
243
3e7f136d 244 info = g_malloc0(sizeof(*info));
13e1d0e7 245 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
ddf21908 246 qapi_VncServerInfo_base(info), &err);
d616ccc5 247 info->auth = g_strdup(vnc_auth_name(vd));
98481bfc
EB		 248 if (err) {
249 qapi_free_VncServerInfo(info);
250 info = NULL;
251 error_free(err);
252 }
fb6ba0d5 253 return info;
a7789382
LC		 254}
255
4a80dba3 256static void vnc_client_cache_auth(VncState *client)
1ff7df1a 257{
4a80dba3
LC		 258 if (!client->info) {
259 return;
d96fd29c 260 }
1263b7d6 261
3e305e4a
DB		 262 if (client->tls) {
263 client->info->x509_dname =
264 qcrypto_tls_session_get_peer_name(client->tls);
d96fd29c 265 }
1263b7d6
AL		 266#ifdef CONFIG_VNC_SASL
267 if (client->sasl.conn &&
d96fd29c 268 client->sasl.username) {
fb6ba0d5 269 client->info->sasl_username = g_strdup(client->sasl.username);
d96fd29c 270 }
1263b7d6 271#endif
4a80dba3 272}
d96fd29c 273
4a80dba3
LC		 274static void vnc_client_cache_addr(VncState *client)
275{
98481bfc
EB		 276 Error *err = NULL;
277
278 client->info = g_malloc0(sizeof(*client->info));
04d2529d 279 vnc_init_basic_info_from_remote_addr(client->sioc,
ddf21908 280 qapi_VncClientInfo_base(client->info),
98481bfc 281 &err);
e1b3d477 282 client->info->websocket = client->websocket;
98481bfc
EB		 283 if (err) {
284 qapi_free_VncClientInfo(client->info);
285 client->info = NULL;
286 error_free(err);
4a80dba3 287 }
1ff7df1a
AL		 288}
289
fb6ba0d5 290static void vnc_qmp_event(VncState *vs, QAPIEvent event)
586153d9 291{
fb6ba0d5 292 VncServerInfo *si;
586153d9
LC		 293
294 if (!vs->info) {
295 return;
296 }
297
d616ccc5 298 si = vnc_server_info_get(vs->vd);
fb6ba0d5 299 if (!si) {
586153d9
LC		 300 return;
301 }
302
fb6ba0d5
WX		 303 switch (event) {
304 case QAPI_EVENT_VNC_CONNECTED:
3ab72385 305 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info));
fb6ba0d5
WX		 306 break;
307 case QAPI_EVENT_VNC_INITIALIZED:
3ab72385 308 qapi_event_send_vnc_initialized(si, vs->info);
fb6ba0d5
WX		 309 break;
310 case QAPI_EVENT_VNC_DISCONNECTED:
3ab72385 311 qapi_event_send_vnc_disconnected(si, vs->info);
fb6ba0d5
WX		 312 break;
313 default:
314 break;
315 }
586153d9 316
fb6ba0d5 317 qapi_free_VncServerInfo(si);
586153d9
LC		 318}
319
2b54aa87 320static VncClientInfo *qmp_query_vnc_client(const VncState *client)
a9ce8590 321{
2b54aa87 322 VncClientInfo *info;
04d2529d 323 Error *err = NULL;
2b54aa87 324
04d2529d 325 info = g_malloc0(sizeof(*info));
2b54aa87 326
04d2529d
DB		 327 vnc_init_basic_info_from_remote_addr(client->sioc,
328 qapi_VncClientInfo_base(info),
329 &err);
330 if (err) {
331 error_free(err);
332 qapi_free_VncClientInfo(info);
2b54aa87
LC		 333 return NULL;
334 }
d96fd29c 335
ddf21908 336 info->websocket = client->websocket;
d96fd29c 337
3e305e4a
DB		 338 if (client->tls) {
339 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
2b54aa87 340 }
d96fd29c 341#ifdef CONFIG_VNC_SASL
2b54aa87 342 if (client->sasl.conn && client->sasl.username) {
2b54aa87 343 info->sasl_username = g_strdup(client->sasl.username);
d96fd29c 344 }
2b54aa87 345#endif
1ff7df1a 346
2b54aa87 347 return info;
d96fd29c 348}
1ff7df1a 349
d616ccc5
GH		 350static VncDisplay *vnc_display_find(const char *id)
351{
352 VncDisplay *vd;
353
354 if (id == NULL) {
355 return QTAILQ_FIRST(&vnc_displays);
356 }
357 QTAILQ_FOREACH(vd, &vnc_displays, next) {
358 if (strcmp(id, vd->id) == 0) {
359 return vd;
360 }
361 }
362 return NULL;
363}
364
2d29a436
GH		 365static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
366{
54aa3de7 367 VncClientInfoList *prev = NULL;
2d29a436
GH		 368 VncState *client;
369
370 QTAILQ_FOREACH(client, &vd->clients, next) {
54aa3de7 371 QAPI_LIST_PREPEND(prev, qmp_query_vnc_client(client));
2d29a436
GH		 372 }
373 return prev;
374}
375
2b54aa87 376VncInfo *qmp_query_vnc(Error **errp)
d96fd29c 377{
2b54aa87 378 VncInfo *info = g_malloc0(sizeof(*info));
d616ccc5 379 VncDisplay *vd = vnc_display_find(NULL);
bd269ebc 380 SocketAddress *addr = NULL;
2b54aa87 381
13e1d0e7 382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
2b54aa87 383 info->enabled = false;
d96fd29c 384 } else {
2b54aa87
LC		 385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
2d29a436 389 info->clients = qmp_query_client_list(vd);
d96fd29c 390
13e1d0e7
DB		 391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
392 errp);
04d2529d 393 if (!addr) {
2b54aa87
LC		 394 goto out_error;
395 }
d96fd29c 396
04d2529d 397 switch (addr->type) {
bd269ebc
MA		 398 case SOCKET_ADDRESS_TYPE_INET:
399 info->host = g_strdup(addr->u.inet.host);
400 info->service = g_strdup(addr->u.inet.port);
401 if (addr->u.inet.ipv6) {
04d2529d
DB		 402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
bd269ebc 408 case SOCKET_ADDRESS_TYPE_UNIX:
04d2529d 409 info->host = g_strdup("");
bd269ebc 410 info->service = g_strdup(addr->u.q_unix.path);
04d2529d
DB		 411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
bd269ebc
MA		 414 case SOCKET_ADDRESS_TYPE_VSOCK:
415 case SOCKET_ADDRESS_TYPE_FD:
a6c76285 416 error_setg(errp, "Unsupported socket address type %s",
977c736f 417 SocketAddressType_str(addr->type));
2b54aa87 418 goto out_error;
a6c76285
MA		 419 default:
420 abort();
1ff7df1a 421 }
2b54aa87 422
2b54aa87 423 info->has_family = true;
2b54aa87 424
d616ccc5 425 info->auth = g_strdup(vnc_auth_name(vd));
a9ce8590 426 }
2b54aa87 427
bd269ebc 428 qapi_free_SocketAddress(addr);
2b54aa87
LC		 429 return info;
430
431out_error:
bd269ebc 432 qapi_free_SocketAddress(addr);
2b54aa87
LC		 433 qapi_free_VncInfo(info);
434 return NULL;
a9ce8590
FB		 435}
436
2a7e6857
DB		 437
438static void qmp_query_auth(int auth, int subauth,
439 VncPrimaryAuth *qmp_auth,
440 VncVencryptSubAuth *qmp_vencrypt,
441 bool *qmp_has_vencrypt);
442
443static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
444 bool websocket,
445 int auth,
446 int subauth,
447 VncServerInfo2List *prev)
df887684 448{
2a7e6857 449 VncServerInfo2 *info;
04d2529d 450 Error *err = NULL;
bd269ebc 451 SocketAddress *addr;
04d2529d 452
9261ef5e 453 addr = qio_channel_socket_get_local_address(ioc, NULL);
04d2529d 454 if (!addr) {
df887684
GH		 455 return prev;
456 }
457
2a7e6857
DB		 458 info = g_new0(VncServerInfo2, 1);
459 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
bd269ebc 460 qapi_free_SocketAddress(addr);
04d2529d 461 if (err) {
2a7e6857 462 qapi_free_VncServerInfo2(info);
04d2529d
DB		 463 error_free(err);
464 return prev;
465 }
4478aa76 466 info->websocket = websocket;
df887684 467
2a7e6857
DB		 468 qmp_query_auth(auth, subauth, &info->auth,
469 &info->vencrypt, &info->has_vencrypt);
470
54aa3de7
EB		 471 QAPI_LIST_PREPEND(prev, info);
472 return prev;
df887684
GH		 473}
474
2a7e6857
DB		 475static void qmp_query_auth(int auth, int subauth,
476 VncPrimaryAuth *qmp_auth,
477 VncVencryptSubAuth *qmp_vencrypt,
478 bool *qmp_has_vencrypt)
df887684 479{
2a7e6857 480 switch (auth) {
df887684 481 case VNC_AUTH_VNC:
2a7e6857 482 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
df887684
GH		 483 break;
484 case VNC_AUTH_RA2:
2a7e6857 485 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
df887684
GH		 486 break;
487 case VNC_AUTH_RA2NE:
2a7e6857 488 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
df887684
GH		 489 break;
490 case VNC_AUTH_TIGHT:
2a7e6857 491 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
df887684
GH		 492 break;
493 case VNC_AUTH_ULTRA:
2a7e6857 494 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
df887684
GH		 495 break;
496 case VNC_AUTH_TLS:
2a7e6857 497 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
df887684
GH		 498 break;
499 case VNC_AUTH_VENCRYPT:
2a7e6857
DB		 500 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
501 *qmp_has_vencrypt = true;
502 switch (subauth) {
df887684 503 case VNC_AUTH_VENCRYPT_PLAIN:
2a7e6857 504 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
df887684
GH		 505 break;
506 case VNC_AUTH_VENCRYPT_TLSNONE:
2a7e6857 507 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
df887684
GH		 508 break;
509 case VNC_AUTH_VENCRYPT_TLSVNC:
2a7e6857 510 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
df887684
GH		 511 break;
512 case VNC_AUTH_VENCRYPT_TLSPLAIN:
2a7e6857 513 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
df887684
GH		 514 break;
515 case VNC_AUTH_VENCRYPT_X509NONE:
2a7e6857 516 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
df887684
GH		 517 break;
518 case VNC_AUTH_VENCRYPT_X509VNC:
2a7e6857 519 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
df887684
GH		 520 break;
521 case VNC_AUTH_VENCRYPT_X509PLAIN:
2a7e6857 522 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
df887684
GH		 523 break;
524 case VNC_AUTH_VENCRYPT_TLSSASL:
2a7e6857 525 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
df887684
GH		 526 break;
527 case VNC_AUTH_VENCRYPT_X509SASL:
2a7e6857 528 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
df887684
GH		 529 break;
530 default:
2a7e6857 531 *qmp_has_vencrypt = false;
df887684
GH		 532 break;
533 }
df887684
GH		 534 break;
535 case VNC_AUTH_SASL:
2a7e6857 536 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
df887684
GH		 537 break;
538 case VNC_AUTH_NONE:
539 default:
2a7e6857 540 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
df887684
GH		 541 break;
542 }
543}
544
545VncInfo2List *qmp_query_vnc_servers(Error **errp)
546{
54aa3de7 547 VncInfo2List *prev = NULL;
df887684
GH		 548 VncInfo2 *info;
549 VncDisplay *vd;
550 DeviceState *dev;
4ee74fa7 551 size_t i;
df887684
GH		 552
553 QTAILQ_FOREACH(vd, &vnc_displays, next) {
554 info = g_new0(VncInfo2, 1);
555 info->id = g_strdup(vd->id);
556 info->clients = qmp_query_client_list(vd);
2a7e6857
DB		 557 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
558 &info->vencrypt, &info->has_vencrypt);
df887684
GH		 559 if (vd->dcl.con) {
560 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
552d7f49 561 "device", &error_abort));
df887684
GH		 562 info->display = g_strdup(dev->id);
563 }
13e1d0e7 564 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
04d2529d 565 info->server = qmp_query_server_entry(
13e1d0e7
DB		 566 vd->listener->sioc[i], false, vd->auth, vd->subauth,
567 info->server);
df887684 568 }
13e1d0e7 569 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
04d2529d 570 info->server = qmp_query_server_entry(
13e1d0e7 571 vd->wslistener->sioc[i], true, vd->ws_auth,
4ee74fa7 572 vd->ws_subauth, info->server);
df887684 573 }
df887684 574
54aa3de7 575 QAPI_LIST_PREPEND(prev, info);
df887684
GH		 576 }
577 return prev;
578}
579
1f08e341
ZC		 580bool vnc_display_reload_certs(const char *id, Error **errp)
581{
582 VncDisplay *vd = vnc_display_find(id);
583 QCryptoTLSCredsClass *creds = NULL;
584
585 if (!vd) {
586 error_setg(errp, "Can not find vnc display");
587 return false;
588 }
589
590 if (!vd->tlscreds) {
4087ecb8 591 error_setg(errp, "vnc tls is not enabled");
1f08e341
ZC		 592 return false;
593 }
594
595 creds = QCRYPTO_TLS_CREDS_GET_CLASS(OBJECT(vd->tlscreds));
596 if (creds->reload == NULL) {
597 error_setg(errp, "%s doesn't support to reload TLS credential",
598 object_get_typename(OBJECT(vd->tlscreds)));
599 return false;
600 }
601 if (!creds->reload(vd->tlscreds, errp)) {
602 return false;
603 }
604
605 return true;
606}
607
24236869
FB		 608/* TODO
609 1) Get the queue working for IO.
610 2) there is some weirdness when using the -S option (the screen is grey
611 and not totally invalidated
612 3) resolutions > 1024
613*/
614
6af998db 615static int vnc_update_client(VncState *vs, int has_dirty);
198a0039 616static void vnc_disconnect_start(VncState *vs);
24236869 617
753b4053 618static void vnc_colordepth(VncState *vs);
1fc62412
SS		 619static void framebuffer_update_request(VncState *vs, int incremental,
620 int x_position, int y_position,
621 int w, int h);
0f7b2864 622static void vnc_refresh(DisplayChangeListener *dcl);
1fc62412 623static int vnc_refresh_server_surface(VncDisplay *vd);
7eac3a87 624
d05959c2
GH		 625static int vnc_width(VncDisplay *vd)
626{
627 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
628 VNC_DIRTY_PIXELS_PER_BIT));
629}
630
69cc8db4
DB		 631static int vnc_true_width(VncDisplay *vd)
632{
633 return MIN(VNC_MAX_WIDTH, surface_width(vd->ds));
634}
635
d05959c2
GH		 636static int vnc_height(VncDisplay *vd)
637{
638 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
639}
640
bea60dd7
PL		 641static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
642 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
f7b3d68c
GH		 643 VncDisplay *vd,
644 int x, int y, int w, int h)
645{
646 int width = vnc_width(vd);
647 int height = vnc_height(vd);
648
91937225
PL		 649 /* this is needed this to ensure we updated all affected
650 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
b4c85ddc
PL		 651 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
652 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
0486e8a7 653
9f64916d
GH		 654 x = MIN(x, width);
655 y = MIN(y, height);
656 w = MIN(x + w, width) - x;
91937225 657 h = MIN(y + h, height);
788abf8e 658
b4c85ddc 659 for (; y < h; y++) {
bea60dd7 660 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
91937225 661 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
b4c85ddc 662 }
24236869
FB		 663}
664
bea60dd7
PL		 665static void vnc_dpy_update(DisplayChangeListener *dcl,
666 int x, int y, int w, int h)
667{
668 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
669 struct VncSurface *s = &vd->guest;
bea60dd7 670
f7b3d68c 671 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
bea60dd7
PL		 672}
673
70a4568f
CC		 674void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
675 int32_t encoding)
24236869
FB		 676{
677 vnc_write_u16(vs, x);
678 vnc_write_u16(vs, y);
679 vnc_write_u16(vs, w);
680 vnc_write_u16(vs, h);
681
682 vnc_write_s32(vs, encoding);
683}
684
763deea7
GH		 685static void vnc_desktop_resize_ext(VncState *vs, int reject_reason)
686{
adc8fce8
DB		 687 trace_vnc_msg_server_ext_desktop_resize(
688 vs, vs->ioc, vs->client_width, vs->client_height, reject_reason);
689
763deea7
GH		 690 vnc_lock_output(vs);
691 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
692 vnc_write_u8(vs, 0);
693 vnc_write_u16(vs, 1); /* number of rects */
694 vnc_framebuffer_update(vs,
695 reject_reason ? 1 : 0,
696 reject_reason,
697 vs->client_width, vs->client_height,
698 VNC_ENCODING_DESKTOP_RESIZE_EXT);
699 vnc_write_u8(vs, 1); /* number of screens */
700 vnc_write_u8(vs, 0); /* padding */
701 vnc_write_u8(vs, 0); /* padding */
702 vnc_write_u8(vs, 0); /* padding */
703 vnc_write_u32(vs, 0); /* screen id */
704 vnc_write_u16(vs, 0); /* screen x-pos */
705 vnc_write_u16(vs, 0); /* screen y-pos */
706 vnc_write_u16(vs, vs->client_width);
707 vnc_write_u16(vs, vs->client_height);
708 vnc_write_u32(vs, 0); /* screen flags */
709 vnc_unlock_output(vs);
710 vnc_flush(vs);
711}
32ed2680 712
621aaeb9
GH		 713static void vnc_desktop_resize(VncState *vs)
714{
763deea7
GH		 715 if (vs->ioc == NULL || (!vnc_has_feature(vs, VNC_FEATURE_RESIZE) &&
716 !vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT))) {
621aaeb9
GH		 717 return;
718 }
69cc8db4 719 if (vs->client_width == vs->vd->true_width &&
d239726c
GH		 720 vs->client_height == pixman_image_get_height(vs->vd->server)) {
721 return;
722 }
4c956bd8 723
69cc8db4
DB		 724 assert(vs->vd->true_width < 65536 &&
725 vs->vd->true_width >= 0);
4c956bd8
DB		 726 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
727 pixman_image_get_height(vs->vd->server) >= 0);
69cc8db4 728 vs->client_width = vs->vd->true_width;
bea60dd7 729 vs->client_height = pixman_image_get_height(vs->vd->server);
763deea7
GH		 730
731 if (vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT)) {
732 vnc_desktop_resize_ext(vs, 0);
733 return;
734 }
735
adc8fce8
DB		 736 trace_vnc_msg_server_desktop_resize(
737 vs, vs->ioc, vs->client_width, vs->client_height);
738
bd023f95 739 vnc_lock_output(vs);
621aaeb9
GH		 740 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
741 vnc_write_u8(vs, 0);
742 vnc_write_u16(vs, 1); /* number of rects */
5862d195 743 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
621aaeb9 744 VNC_ENCODING_DESKTOPRESIZE);
bd023f95 745 vnc_unlock_output(vs);
621aaeb9
GH		 746 vnc_flush(vs);
747}
748
bd023f95
CC		 749static void vnc_abort_display_jobs(VncDisplay *vd)
750{
751 VncState *vs;
752
753 QTAILQ_FOREACH(vs, &vd->clients, next) {
754 vnc_lock_output(vs);
755 vs->abort = true;
756 vnc_unlock_output(vs);
757 }
758 QTAILQ_FOREACH(vs, &vd->clients, next) {
759 vnc_jobs_join(vs);
760 }
761 QTAILQ_FOREACH(vs, &vd->clients, next) {
762 vnc_lock_output(vs);
bbcdeb62
GH		 763 if (vs->update == VNC_STATE_UPDATE_NONE &&
764 vs->job_update != VNC_STATE_UPDATE_NONE) {
765 /* job aborted before completion */
766 vs->update = vs->job_update;
767 vs->job_update = VNC_STATE_UPDATE_NONE;
768 }
bd023f95
CC		 769 vs->abort = false;
770 vnc_unlock_output(vs);
771 }
772}
bd023f95 773
9f64916d
GH		 774int vnc_server_fb_stride(VncDisplay *vd)
775{
776 return pixman_image_get_stride(vd->server);
777}
778
779void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
780{
781 uint8_t *ptr;
782
783 ptr = (uint8_t *)pixman_image_get_data(vd->server);
784 ptr += y * vnc_server_fb_stride(vd);
785 ptr += x * VNC_SERVER_FB_BYTES;
786 return ptr;
787}
788
453f842b
GH		 789static void vnc_update_server_surface(VncDisplay *vd)
790{
b69a553b
DB		 791 int width, height;
792
453f842b
GH		 793 qemu_pixman_image_unref(vd->server);
794 vd->server = NULL;
795
c7628bff
GH		 796 if (QTAILQ_EMPTY(&vd->clients)) {
797 return;
798 }
799
b69a553b
DB		 800 width = vnc_width(vd);
801 height = vnc_height(vd);
69cc8db4 802 vd->true_width = vnc_true_width(vd);
453f842b 803 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
b69a553b 804 width, height,
453f842b 805 NULL, 0);
b69a553b
DB		 806
807 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
808 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
809 width, height);
453f842b
GH		 810}
811
61e77a5f
GH		 812static bool vnc_check_pageflip(DisplaySurface *s1,
813 DisplaySurface *s2)
814{
815 return (s1 != NULL &&
816 s2 != NULL &&
817 surface_width(s1) == surface_width(s2) &&
818 surface_height(s1) == surface_height(s2) &&
819 surface_format(s1) == surface_format(s2));
820
821}
822
c12aeb86 823static void vnc_dpy_switch(DisplayChangeListener *dcl,
c12aeb86 824 DisplaySurface *surface)
24236869 825{
21ef45d7 826 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
61e77a5f 827 bool pageflip = vnc_check_pageflip(vd->ds, surface);
41b4bef6 828 VncState *vs;
1fc62412 829
bd023f95 830 vnc_abort_display_jobs(vd);
453f842b 831 vd->ds = surface;
bd023f95 832
6baebed7 833 /* guest surface */
9f64916d 834 qemu_pixman_image_unref(vd->guest.fb);
d39fa6d8
GH		 835 vd->guest.fb = pixman_image_ref(surface->image);
836 vd->guest.format = surface->format;
24236869 837
69cc8db4 838
61e77a5f 839 if (pageflip) {
69cc8db4
DB		 840 trace_vnc_server_dpy_pageflip(vd,
841 surface_width(surface),
842 surface_height(surface),
843 surface_format(surface));
61e77a5f
GH		 844 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
845 surface_width(surface),
846 surface_height(surface));
847 return;
848 }
849
69cc8db4
DB		 850 trace_vnc_server_dpy_recreate(vd,
851 surface_width(surface),
852 surface_height(surface),
853 surface_format(surface));
61e77a5f
GH		 854 /* server surface */
855 vnc_update_server_surface(vd);
856
41b4bef6 857 QTAILQ_FOREACH(vs, &vd->clients, next) {
1fc62412 858 vnc_colordepth(vs);
1d4b638a 859 vnc_desktop_resize(vs);
b3c2de9c 860 vnc_cursor_define(vs);
bea60dd7 861 memset(vs->dirty, 0x00, sizeof(vs->dirty));
f7b3d68c 862 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
b69a553b
DB		 863 vnc_width(vd),
864 vnc_height(vd));
e2b72cb6 865 vnc_update_throttle_offset(vs);
753b4053
AL		 866 }
867}
868
3512779a 869/* fastest code */
9f64916d 870static void vnc_write_pixels_copy(VncState *vs,
d467b679 871 void *pixels, int size)
3512779a
FB		 872{
873 vnc_write(vs, pixels, size);
874}
875
876/* slowest but generic code. */
70a4568f 877void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
3512779a 878{
7eac3a87 879 uint8_t r, g, b;
1fc62412 880
9f64916d
GH		 881#if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
882 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
883 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
884 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
885#else
886# error need some bits here if you change VNC_SERVER_FB_FORMAT
887#endif
888 v = (r << vs->client_pf.rshift) |
889 (g << vs->client_pf.gshift) |
890 (b << vs->client_pf.bshift);
891 switch (vs->client_pf.bytes_per_pixel) {
3512779a
FB		 892 case 1:
893 buf[0] = v;
894 break;
895 case 2:
9f64916d 896 if (vs->client_be) {
3512779a
FB		 897 buf[0] = v >> 8;
898 buf[1] = v;
899 } else {
900 buf[1] = v >> 8;
901 buf[0] = v;
902 }
903 break;
904 default:
905 case 4:
9f64916d 906 if (vs->client_be) {
3512779a
FB		 907 buf[0] = v >> 24;
908 buf[1] = v >> 16;
909 buf[2] = v >> 8;
910 buf[3] = v;
911 } else {
912 buf[3] = v >> 24;
913 buf[2] = v >> 16;
914 buf[1] = v >> 8;
915 buf[0] = v;
916 }
917 break;
918 }
919}
920
9f64916d 921static void vnc_write_pixels_generic(VncState *vs,
d467b679 922 void *pixels1, int size)
3512779a 923{
3512779a 924 uint8_t buf[4];
3512779a 925
9f64916d 926 if (VNC_SERVER_FB_BYTES == 4) {
7eac3a87
AL		 927 uint32_t *pixels = pixels1;
928 int n, i;
929 n = size >> 2;
9f64916d 930 for (i = 0; i < n; i++) {
7eac3a87 931 vnc_convert_pixel(vs, buf, pixels[i]);
9f64916d 932 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
7eac3a87 933 }
3512779a
FB		 934 }
935}
936
a885211e 937int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869
FB		 938{
939 int i;
60fe76f3 940 uint8_t *row;
1fc62412 941 VncDisplay *vd = vs->vd;
24236869 942
9f64916d 943 row = vnc_server_fb_ptr(vd, x, y);
24236869 944 for (i = 0; i < h; i++) {
9f64916d
GH		 945 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
946 row += vnc_server_fb_stride(vd);
24236869 947 }
a885211e 948 return 1;
24236869
FB		 949}
950
bd023f95 951int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869 952{
a885211e
CC		 953 int n = 0;
954
fb437313 955 switch(vs->vnc_encoding) {
28a76be8 956 case VNC_ENCODING_ZLIB:
a885211e 957 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
28a76be8
AL		 958 break;
959 case VNC_ENCODING_HEXTILE:
960 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
a885211e 961 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
28a76be8 962 break;
380282b0
CC		 963 case VNC_ENCODING_TIGHT:
964 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
965 break;
efe556ad
CC		 966 case VNC_ENCODING_TIGHT_PNG:
967 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
968 break;
148954fa
CC		 969 case VNC_ENCODING_ZRLE:
970 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
971 break;
972 case VNC_ENCODING_ZYWRLE:
973 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
974 break;
28a76be8 975 default:
0780ec7b
GH		 976 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
977 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
28a76be8 978 break;
fb437313 979 }
a885211e 980 return n;
24236869
FB		 981}
982
7c20b4a3 983static void vnc_mouse_set(DisplayChangeListener *dcl,
7c20b4a3 984 int x, int y, int visible)
d467b679
GH		 985{
986 /* can we ask the client(s) to move the pointer ??? */
987}
988
989static int vnc_cursor_define(VncState *vs)
990{
385ac97f 991 QEMUCursor *c = qemu_console_get_cursor(vs->vd->dcl.con);
d467b679
GH		 992 int isize;
993
385ac97f 994 if (!c) {
b3c2de9c
GH		 995 return -1;
996 }
997
074a86d0
GH		 998 if (vnc_has_feature(vs, VNC_FEATURE_ALPHA_CURSOR)) {
999 vnc_lock_output(vs);
1000 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1001 vnc_write_u8(vs, 0); /* padding */
1002 vnc_write_u16(vs, 1); /* # of rects */
1003 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
1004 VNC_ENCODING_ALPHA_CURSOR);
1005 vnc_write_s32(vs, VNC_ENCODING_RAW);
1006 vnc_write(vs, c->data, c->width * c->height * 4);
1007 vnc_unlock_output(vs);
1008 return 0;
1009 }
d467b679 1010 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
d01f9595 1011 vnc_lock_output(vs);
d467b679
GH		 1012 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1013 vnc_write_u8(vs, 0); /* padding */
1014 vnc_write_u16(vs, 1); /* # of rects */
1015 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
1016 VNC_ENCODING_RICH_CURSOR);
9f64916d
GH		 1017 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
1018 vnc_write_pixels_generic(vs, c->data, isize);
d467b679 1019 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
d01f9595 1020 vnc_unlock_output(vs);
d467b679
GH		 1021 return 0;
1022 }
1023 return -1;
1024}
1025
7c20b4a3 1026static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
7c20b4a3 1027 QEMUCursor *c)
d467b679 1028{
d616ccc5 1029 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
d467b679
GH		 1030 VncState *vs;
1031
7267c094 1032 g_free(vd->cursor_mask);
d467b679 1033 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
7267c094 1034 vd->cursor_mask = g_malloc0(vd->cursor_msize);
d467b679
GH		 1035 cursor_get_mono_mask(c, 0, vd->cursor_mask);
1036
1037 QTAILQ_FOREACH(vs, &vd->clients, next) {
1038 vnc_cursor_define(vs);
1039 }
1040}
1041
4769a881 1042static int find_and_clear_dirty_height(VncState *vs,
6c71a539 1043 int y, int last_x, int x, int height)
24236869
FB		 1044{
1045 int h;
1046
6c71a539 1047 for (h = 1; h < (height - y); h++) {
bc2429b9 1048 if (!test_bit(last_x, vs->dirty[y + h])) {
28a76be8 1049 break;
bc2429b9 1050 }
863d7c91 1051 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
24236869
FB		 1052 }
1053
1054 return h;
1055}
1056
e2b72cb6
DB		 1057/*
1058 * Figure out how much pending data we should allow in the output
1059 * buffer before we throttle incremental display updates, and/or
1060 * drop audio samples.
1061 *
1062 * We allow for equiv of 1 full display's worth of FB updates,
1063 * and 1 second of audio samples. If audio backlog was larger
1064 * than that the client would already suffering awful audio
1065 * glitches, so dropping samples is no worse really).
1066 */
1067static void vnc_update_throttle_offset(VncState *vs)
1068{
1069 size_t offset =
1070 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
1071
1072 if (vs->audio_cap) {
e2b72cb6 1073 int bps;
e2b72cb6
DB		 1074 switch (vs->as.fmt) {
1075 default:
85bc5852
KZ		 1076 case AUDIO_FORMAT_U8:
1077 case AUDIO_FORMAT_S8:
e2b72cb6
DB		 1078 bps = 1;
1079 break;
85bc5852
KZ		 1080 case AUDIO_FORMAT_U16:
1081 case AUDIO_FORMAT_S16:
e2b72cb6
DB		 1082 bps = 2;
1083 break;
85bc5852
KZ		 1084 case AUDIO_FORMAT_U32:
1085 case AUDIO_FORMAT_S32:
e2b72cb6
DB		 1086 bps = 4;
1087 break;
1088 }
cf070658 1089 offset += vs->as.freq * bps * vs->as.nchannels;
e2b72cb6
DB		 1090 }
1091
1092 /* Put a floor of 1MB on offset, so that if we have a large pending
1093 * buffer and the display is resized to a small size & back again
1094 * we don't suddenly apply a tiny send limit
1095 */
1096 offset = MAX(offset, 1024 * 1024);
1097
6aa22a29
DB		 1098 if (vs->throttle_output_offset != offset) {
1099 trace_vnc_client_throttle_threshold(
1100 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1101 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1102 }
1103
e2b72cb6
DB		 1104 vs->throttle_output_offset = offset;
1105}
1106
0bad8342
DB		 1107static bool vnc_should_update(VncState *vs)
1108{
1109 switch (vs->update) {
1110 case VNC_STATE_UPDATE_NONE:
1111 break;
1112 case VNC_STATE_UPDATE_INCREMENTAL:
e2b72cb6 1113 /* Only allow incremental updates if the pending send queue
ada8d2e4
DB		 1114 * is less than the permitted threshold, and the job worker
1115 * is completely idle.
0bad8342 1116 */
ada8d2e4
DB		 1117 if (vs->output.offset < vs->throttle_output_offset &&
1118 vs->job_update == VNC_STATE_UPDATE_NONE) {
0bad8342
DB		 1119 return true;
1120 }
6aa22a29
DB		 1121 trace_vnc_client_throttle_incremental(
1122 vs, vs->ioc, vs->job_update, vs->output.offset);
0bad8342
DB		 1123 break;
1124 case VNC_STATE_UPDATE_FORCE:
ada8d2e4
DB		 1125 /* Only allow forced updates if the pending send queue
1126 * does not contain a previous forced update, and the
1127 * job worker is completely idle.
1128 *
1129 * Note this means we'll queue a forced update, even if
1130 * the output buffer size is otherwise over the throttle
1131 * output limit.
1132 */
1133 if (vs->force_update_offset == 0 &&
1134 vs->job_update == VNC_STATE_UPDATE_NONE) {
1135 return true;
1136 }
6aa22a29
DB		 1137 trace_vnc_client_throttle_forced(
1138 vs, vs->ioc, vs->job_update, vs->force_update_offset);
ada8d2e4 1139 break;
0bad8342
DB		 1140 }
1141 return false;
1142}
1143
6af998db 1144static int vnc_update_client(VncState *vs, int has_dirty)
24236869 1145{
b939eb89
DB		 1146 VncDisplay *vd = vs->vd;
1147 VncJob *job;
1148 int y;
1149 int height, width;
1150 int n = 0;
1151
5a8be0f7
GH		 1152 if (vs->disconnecting) {
1153 vnc_disconnect_finish(vs);
1154 return 0;
1155 }
1156
63658280 1157 vs->has_dirty += has_dirty;
0bad8342 1158 if (!vnc_should_update(vs)) {
b939eb89
DB		 1159 return 0;
1160 }
1161
fef1bbad 1162 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
b939eb89
DB		 1163 return 0;
1164 }
1165
1166 /*
1167 * Send screen updates to the vnc client using the server
1168 * surface and server dirty map. guest surface updates
1169 * happening in parallel don't disturb us, the next pass will
1170 * send them to the client.
1171 */
1172 job = vnc_job_new(vs);
1173
1174 height = pixman_image_get_height(vd->server);
1175 width = pixman_image_get_width(vd->server);
1176
1177 y = 0;
1178 for (;;) {
1179 int x, h;
1180 unsigned long x2;
1181 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1182 height * VNC_DIRTY_BPL(vs),
1183 y * VNC_DIRTY_BPL(vs));
1184 if (offset == height * VNC_DIRTY_BPL(vs)) {
1185 /* no more dirty bits */
1186 break;
1187 }
1188 y = offset / VNC_DIRTY_BPL(vs);
1189 x = offset % VNC_DIRTY_BPL(vs);
1190 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1191 VNC_DIRTY_BPL(vs), x);
1192 bitmap_clear(vs->dirty[y], x, x2 - x);
1193 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1194 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1195 if (x2 > x) {
1196 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1197 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1198 }
1199 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1200 y += h;
1201 if (y == height) {
12b316d4 1202 break;
28a76be8
AL		 1203 }
1204 }
24236869 1205 }
24236869 1206
ada8d2e4 1207 vs->job_update = vs->update;
728a7ac9 1208 vs->update = VNC_STATE_UPDATE_NONE;
ada8d2e4 1209 vnc_job_push(job);
b939eb89
DB		 1210 vs->has_dirty = 0;
1211 return n;
24236869
FB		 1212}
1213
429a8ed3 1214/* audio */
1215static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1216{
1217 VncState *vs = opaque;
1218
f31f9c10 1219 assert(vs->magic == VNC_MAGIC);
429a8ed3 1220 switch (cmd) {
1221 case AUD_CNOTIFY_DISABLE:
adc8fce8 1222 trace_vnc_msg_server_audio_end(vs, vs->ioc);
bd023f95 1223 vnc_lock_output(vs);
46a183da
DB		 1224 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1225 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1226 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
bd023f95 1227 vnc_unlock_output(vs);
429a8ed3 1228 vnc_flush(vs);
1229 break;
1230
1231 case AUD_CNOTIFY_ENABLE:
adc8fce8 1232 trace_vnc_msg_server_audio_begin(vs, vs->ioc);
bd023f95 1233 vnc_lock_output(vs);
46a183da
DB		 1234 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1235 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1236 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
bd023f95 1237 vnc_unlock_output(vs);
429a8ed3 1238 vnc_flush(vs);
1239 break;
1240 }
1241}
1242
1243static void audio_capture_destroy(void *opaque)
1244{
1245}
1246
57a878ed 1247static void audio_capture(void *opaque, const void *buf, int size)
429a8ed3 1248{
1249 VncState *vs = opaque;
1250
f31f9c10 1251 assert(vs->magic == VNC_MAGIC);
adc8fce8 1252 trace_vnc_msg_server_audio_data(vs, vs->ioc, buf, size);
bd023f95 1253 vnc_lock_output(vs);
e2b72cb6
DB		 1254 if (vs->output.offset < vs->throttle_output_offset) {
1255 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1256 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1257 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1258 vnc_write_u32(vs, size);
1259 vnc_write(vs, buf, size);
6aa22a29
DB		 1260 } else {
1261 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
e2b72cb6 1262 }
bd023f95 1263 vnc_unlock_output(vs);
429a8ed3 1264 vnc_flush(vs);
1265}
1266
1267static void audio_add(VncState *vs)
1268{
1269 struct audio_capture_ops ops;
1270
1271 if (vs->audio_cap) {
027a79c3 1272 error_report("audio already running");
429a8ed3 1273 return;
1274 }
1275
1276 ops.notify = audio_capture_notify;
1277 ops.destroy = audio_capture_destroy;
1278 ops.capture = audio_capture;
1279
f0b9f36d 1280 vs->audio_cap = AUD_add_capture(vs->vd->audio_state, &vs->as, &ops, vs);
429a8ed3 1281 if (!vs->audio_cap) {
027a79c3 1282 error_report("Failed to add audio capture");
429a8ed3 1283 }
1284}
1285
1286static void audio_del(VncState *vs)
1287{
1288 if (vs->audio_cap) {
1289 AUD_del_capture(vs->audio_cap, vs);
1290 vs->audio_cap = NULL;
1291 }
1292}
1293
198a0039
GH		 1294static void vnc_disconnect_start(VncState *vs)
1295{
04d2529d 1296 if (vs->disconnecting) {
198a0039 1297 return;
04d2529d 1298 }
ad6374c4 1299 trace_vnc_client_disconnect_start(vs, vs->ioc);
8cf36489 1300 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
04d2529d
DB		 1301 if (vs->ioc_tag) {
1302 g_source_remove(vs->ioc_tag);
a75d6f07 1303 vs->ioc_tag = 0;
04d2529d
DB		 1304 }
1305 qio_channel_close(vs->ioc, NULL);
1306 vs->disconnecting = TRUE;
198a0039
GH		 1307}
1308
7536ee4b 1309void vnc_disconnect_finish(VncState *vs)
198a0039 1310{
7d964c9d
CC		 1311 int i;
1312
ad6374c4
DB		 1313 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1314
bd023f95
CC		 1315 vnc_jobs_join(vs); /* Wait encoding jobs */
1316
1317 vnc_lock_output(vs);
fb6ba0d5 1318 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
0d72f3d3 1319
5d418e3b
CC		 1320 buffer_free(&vs->input);
1321 buffer_free(&vs->output);
4a80dba3 1322
fb6ba0d5 1323 qapi_free_VncClientInfo(vs->info);
4a80dba3 1324
161c4f20 1325 vnc_zlib_clear(vs);
380282b0 1326 vnc_tight_clear(vs);
148954fa 1327 vnc_zrle_clear(vs);
161c4f20 1328
198a0039
GH		 1329#ifdef CONFIG_VNC_SASL
1330 vnc_sasl_client_cleanup(vs);
1331#endif /* CONFIG_VNC_SASL */
1332 audio_del(vs);
c2f2ba49 1333 qkbd_state_lift_all_keys(vs->vd->kbd);
198a0039 1334
90cd03a3 1335 if (vs->mouse_mode_notifier.notify != NULL) {
6fd8e79a 1336 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
90cd03a3
DB		 1337 }
1338 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1339 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1340 /* last client gone */
1341 vnc_update_server_surface(vs->vd);
6fd8e79a 1342 }
1dbbe6f1
RL		 1343 vnc_unlock_output(vs);
1344
1b17f1e9 1345 if (vs->cbpeer.notifier.notify) {
0bf41cab
GH		 1346 qemu_clipboard_peer_unregister(&vs->cbpeer);
1347 }
41b4bef6 1348
bd023f95 1349 qemu_mutex_destroy(&vs->output_mutex);
6fd8e79a
TH		 1350 if (vs->bh != NULL) {
1351 qemu_bh_delete(vs->bh);
1352 }
175b2a6e 1353 buffer_free(&vs->jobs_buffer);
175b2a6e 1354
7d964c9d 1355 for (i = 0; i < VNC_STAT_ROWS; ++i) {
7267c094 1356 g_free(vs->lossy_rect[i]);
7d964c9d 1357 }
7267c094 1358 g_free(vs->lossy_rect);
04d2529d
DB		 1359
1360 object_unref(OBJECT(vs->ioc));
1361 vs->ioc = NULL;
1362 object_unref(OBJECT(vs->sioc));
1363 vs->sioc = NULL;
f31f9c10 1364 vs->magic = 0;
6bf21f3d
LQ		 1365 g_free(vs->zrle);
1366 g_free(vs->tight);
7267c094 1367 g_free(vs);
198a0039 1368}
2f9606b3 1369
34ab29c2 1370size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error *err)
24236869 1371{
04d2529d
DB		 1372 if (ret <= 0) {
1373 if (ret == 0) {
ad6374c4 1374 trace_vnc_client_eof(vs, vs->ioc);
537848ee 1375 vnc_disconnect_start(vs);
04d2529d 1376 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
ad6374c4 1377 trace_vnc_client_io_error(vs, vs->ioc,
34ab29c2 1378 err ? error_get_pretty(err) : "Unknown");
537848ee 1379 vnc_disconnect_start(vs);
ea01e5fd 1380 }
24236869 1381
34ab29c2 1382 error_free(err);
28a76be8 1383 return 0;
24236869
FB		 1384 }
1385 return ret;
1386}
1387
5fb6c7a8
AL		 1388
1389void vnc_client_error(VncState *vs)
24236869 1390{
198a0039
GH		 1391 VNC_DEBUG("Closing down client sock: protocol error\n");
1392 vnc_disconnect_start(vs);
24236869
FB		 1393}
1394
3e305e4a 1395
2f9606b3
AL		 1396/*
1397 * Called to write a chunk of data to the client socket. The data may
1398 * be the raw data, or may have already been encoded by SASL.
1399 * The data will be written either straight onto the socket, or
1400 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1401 *
1402 * NB, it is theoretically possible to have 2 layers of encryption,
1403 * both SASL, and this TLS layer. It is highly unlikely in practice
1404 * though, since SASL encryption will typically be a no-op if TLS
1405 * is active
1406 *
1407 * Returns the number of bytes written, which may be less than
1408 * the requested 'datalen' if the socket would block. Returns
30b80fd5 1409 * 0 on I/O error, and disconnects the client socket.
2f9606b3 1410 */
30b80fd5 1411size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
24236869 1412{
04d2529d 1413 Error *err = NULL;
fdd1ab6a 1414 ssize_t ret;
34ab29c2 1415 ret = qio_channel_write(vs->ioc, (const char *)data, datalen, &err);
23decc87 1416 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
34ab29c2 1417 return vnc_client_io_error(vs, ret, err);
2f9606b3
AL		 1418}
1419
1420
1421/*
1422 * Called to write buffered data to the client socket, when not
1423 * using any SASL SSF encryption layers. Will write as much data
1424 * as possible without blocking. If all buffered data is written,
1425 * will switch the FD poll() handler back to read monitoring.
1426 *
1427 * Returns the number of bytes written, which may be less than
30b80fd5
DB		 1428 * the buffered output data if the socket would block. Returns
1429 * 0 on I/O error, and disconnects the client socket.
2f9606b3 1430 */
30b80fd5 1431static size_t vnc_client_write_plain(VncState *vs)
2f9606b3 1432{
6aa22a29 1433 size_t offset;
30b80fd5 1434 size_t ret;
2f9606b3
AL		 1435
1436#ifdef CONFIG_VNC_SASL
23decc87 1437 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
2f9606b3
AL		 1438 vs->output.buffer, vs->output.capacity, vs->output.offset,
1439 vs->sasl.waitWriteSSF);
1440
1441 if (vs->sasl.conn &&
1442 vs->sasl.runSSF &&
1443 vs->sasl.waitWriteSSF) {
1444 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1445 if (ret)
1446 vs->sasl.waitWriteSSF -= ret;
1447 } else
1448#endif /* CONFIG_VNC_SASL */
1449 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
24236869 1450 if (!ret)
2f9606b3 1451 return 0;
24236869 1452
ada8d2e4 1453 if (ret >= vs->force_update_offset) {
6aa22a29
DB		 1454 if (vs->force_update_offset != 0) {
1455 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1456 }
ada8d2e4
DB		 1457 vs->force_update_offset = 0;
1458 } else {
1459 vs->force_update_offset -= ret;
1460 }
6aa22a29 1461 offset = vs->output.offset;
32ed2680 1462 buffer_advance(&vs->output, ret);
6aa22a29
DB		 1463 if (offset >= vs->throttle_output_offset &&
1464 vs->output.offset < vs->throttle_output_offset) {
1465 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1466 }
24236869
FB		 1467
1468 if (vs->output.offset == 0) {
04d2529d
DB		 1469 if (vs->ioc_tag) {
1470 g_source_remove(vs->ioc_tag);
1471 }
1472 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 1473 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
1474 vnc_client_io, vs, NULL);
24236869 1475 }
2f9606b3
AL		 1476
1477 return ret;
1478}
1479
1480
1481/*
1482 * First function called whenever there is data to be written to
1483 * the client socket. Will delegate actual work according to whether
1484 * SASL SSF layers are enabled (thus requiring encryption calls)
1485 */
04d2529d 1486static void vnc_client_write_locked(VncState *vs)
2f9606b3 1487{
2f9606b3
AL		 1488#ifdef CONFIG_VNC_SASL
1489 if (vs->sasl.conn &&
1490 vs->sasl.runSSF &&
9678d950
BS		 1491 !vs->sasl.waitWriteSSF) {
1492 vnc_client_write_sasl(vs);
1493 } else
2f9606b3 1494#endif /* CONFIG_VNC_SASL */
7536ee4b 1495 {
d5f04223 1496 vnc_client_write_plain(vs);
7536ee4b 1497 }
24236869
FB		 1498}
1499
04d2529d 1500static void vnc_client_write(VncState *vs)
bd023f95 1501{
f31f9c10 1502 assert(vs->magic == VNC_MAGIC);
bd023f95 1503 vnc_lock_output(vs);
d5f04223 1504 if (vs->output.offset) {
04d2529d
DB		 1505 vnc_client_write_locked(vs);
1506 } else if (vs->ioc != NULL) {
1507 if (vs->ioc_tag) {
1508 g_source_remove(vs->ioc_tag);
1509 }
1510 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 1511 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
1512 vnc_client_io, vs, NULL);
bd023f95
CC		 1513 }
1514 vnc_unlock_output(vs);
1515}
1516
5fb6c7a8 1517void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
24236869
FB		 1518{
1519 vs->read_handler = func;
1520 vs->read_handler_expect = expecting;
1521}
1522
2f9606b3
AL		 1523
1524/*
1525 * Called to read a chunk of data from the client socket. The data may
1526 * be the raw data, or may need to be further decoded by SASL.
1527 * The data will be read either straight from to the socket, or
1528 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1529 *
1530 * NB, it is theoretically possible to have 2 layers of encryption,
1531 * both SASL, and this TLS layer. It is highly unlikely in practice
1532 * though, since SASL encryption will typically be a no-op if TLS
1533 * is active
1534 *
1535 * Returns the number of bytes read, which may be less than
1536 * the requested 'datalen' if the socket would block. Returns
30b80fd5 1537 * 0 on I/O error or EOF, and disconnects the client socket.
2f9606b3 1538 */
30b80fd5 1539size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
24236869 1540{
fdd1ab6a 1541 ssize_t ret;
04d2529d 1542 Error *err = NULL;
34ab29c2 1543 ret = qio_channel_read(vs->ioc, (char *)data, datalen, &err);
23decc87 1544 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
34ab29c2 1545 return vnc_client_io_error(vs, ret, err);
2f9606b3 1546}
24236869 1547
2f9606b3
AL		 1548
1549/*
1550 * Called to read data from the client socket to the input buffer,
1551 * when not using any SASL SSF encryption layers. Will read as much
1552 * data as possible without blocking.
1553 *
30b80fd5
DB		 1554 * Returns the number of bytes read, which may be less than
1555 * the requested 'datalen' if the socket would block. Returns
1556 * 0 on I/O error or EOF, and disconnects the client socket.
2f9606b3 1557 */
30b80fd5 1558static size_t vnc_client_read_plain(VncState *vs)
2f9606b3 1559{
30b80fd5 1560 size_t ret;
23decc87 1561 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
2f9606b3
AL		 1562 vs->input.buffer, vs->input.capacity, vs->input.offset);
1563 buffer_reserve(&vs->input, 4096);
1564 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1565 if (!ret)
1566 return 0;
24236869 1567 vs->input.offset += ret;
2f9606b3
AL		 1568 return ret;
1569}
1570
175b2a6e
CC		 1571static void vnc_jobs_bh(void *opaque)
1572{
1573 VncState *vs = opaque;
1574
f31f9c10 1575 assert(vs->magic == VNC_MAGIC);
175b2a6e
CC		 1576 vnc_jobs_consume_buffer(vs);
1577}
2f9606b3
AL		 1578
1579/*
1580 * First function called whenever there is more data to be read from
1581 * the client socket. Will delegate actual work according to whether
1582 * SASL SSF layers are enabled (thus requiring decryption calls)
ea697449 1583 * Returns 0 on success, -1 if client disconnected
2f9606b3 1584 */
ea697449 1585static int vnc_client_read(VncState *vs)
2f9606b3 1586{
30b80fd5 1587 size_t ret;
2f9606b3
AL		 1588
1589#ifdef CONFIG_VNC_SASL
1590 if (vs->sasl.conn && vs->sasl.runSSF)
1591 ret = vnc_client_read_sasl(vs);
1592 else
1593#endif /* CONFIG_VNC_SASL */
d5f04223 1594 ret = vnc_client_read_plain(vs);
198a0039 1595 if (!ret) {
04d2529d 1596 if (vs->disconnecting) {
198a0039 1597 vnc_disconnect_finish(vs);
ea697449 1598 return -1;
04d2529d 1599 }
ea697449 1600 return 0;
198a0039 1601 }
24236869
FB		 1602
1603 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
28a76be8
AL		 1604 size_t len = vs->read_handler_expect;
1605 int ret;
1606
1607 ret = vs->read_handler(vs, vs->input.buffer, len);
04d2529d 1608 if (vs->disconnecting) {
198a0039 1609 vnc_disconnect_finish(vs);
ea697449 1610 return -1;
198a0039 1611 }
28a76be8
AL		 1612
1613 if (!ret) {
32ed2680 1614 buffer_advance(&vs->input, len);
28a76be8
AL		 1615 } else {
1616 vs->read_handler_expect = ret;
1617 }
24236869 1618 }
ea697449 1619 return 0;
24236869
FB		 1620}
1621
04d2529d
DB		 1622gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1623 GIOCondition condition, void *opaque)
1624{
1625 VncState *vs = opaque;
f31f9c10
GH		 1626
1627 assert(vs->magic == VNC_MAGIC);
2ddafce7
DH		 1628
1629 if (condition & (G_IO_HUP | G_IO_ERR)) {
1630 vnc_disconnect_start(vs);
1631 return TRUE;
1632 }
1633
04d2529d 1634 if (condition & G_IO_IN) {
ea697449 1635 if (vnc_client_read(vs) < 0) {
1bc3117a
GH		 1636 /* vs is free()ed here */
1637 return TRUE;
ea697449 1638 }
04d2529d
DB		 1639 }
1640 if (condition & G_IO_OUT) {
1641 vnc_client_write(vs);
1642 }
1bc3117a 1643
d49b87f0
KK		 1644 if (vs->disconnecting) {
1645 if (vs->ioc_tag != 0) {
1646 g_source_remove(vs->ioc_tag);
1647 }
1648 vs->ioc_tag = 0;
1649 }
04d2529d
DB		 1650 return TRUE;
1651}
1652
1653
f887cf16
DB		 1654/*
1655 * Scale factor to apply to vs->throttle_output_offset when checking for
1656 * hard limit. Worst case normal usage could be x2, if we have a complete
1657 * incremental update and complete forced update in the output buffer.
1658 * So x3 should be good enough, but we pick x5 to be conservative and thus
1659 * (hopefully) never trigger incorrectly.
1660 */
1661#define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1662
5fb6c7a8 1663void vnc_write(VncState *vs, const void *data, size_t len)
24236869 1664{
f31f9c10 1665 assert(vs->magic == VNC_MAGIC);
f887cf16
DB		 1666 if (vs->disconnecting) {
1667 return;
1668 }
1669 /* Protection against malicious client/guest to prevent our output
1670 * buffer growing without bound if client stops reading data. This
1671 * should rarely trigger, because we have earlier throttling code
1672 * which stops issuing framebuffer updates and drops audio data
1673 * if the throttle_output_offset value is exceeded. So we only reach
1674 * this higher level if a huge number of pseudo-encodings get
1675 * triggered while data can't be sent on the socket.
1676 *
1677 * NB throttle_output_offset can be zero during early protocol
1678 * handshake, or from the job thread's VncState clone
1679 */
1680 if (vs->throttle_output_offset != 0 &&
dffa1de0
DB		 1681 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1682 vs->throttle_output_offset) {
6aa22a29
DB		 1683 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1684 vs->throttle_output_offset);
f887cf16
DB		 1685 vnc_disconnect_start(vs);
1686 return;
1687 }
24236869
FB		 1688 buffer_reserve(&vs->output, len);
1689
04d2529d
DB		 1690 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1691 if (vs->ioc_tag) {
1692 g_source_remove(vs->ioc_tag);
1693 }
1694 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 1695 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_OUT,
1696 vnc_client_io, vs, NULL);
24236869
FB		 1697 }
1698
1699 buffer_append(&vs->output, data, len);
1700}
1701
5fb6c7a8 1702void vnc_write_s32(VncState *vs, int32_t value)
24236869
FB		 1703{
1704 vnc_write_u32(vs, *(uint32_t *)&value);
1705}
1706
5fb6c7a8 1707void vnc_write_u32(VncState *vs, uint32_t value)
24236869
FB		 1708{
1709 uint8_t buf[4];
1710
1711 buf[0] = (value >> 24) & 0xFF;
1712 buf[1] = (value >> 16) & 0xFF;
1713 buf[2] = (value >> 8) & 0xFF;
1714 buf[3] = value & 0xFF;
1715
1716 vnc_write(vs, buf, 4);
1717}
1718
5fb6c7a8 1719void vnc_write_u16(VncState *vs, uint16_t value)
24236869 1720{
64f5a135 1721 uint8_t buf[2];
24236869
FB		 1722
1723 buf[0] = (value >> 8) & 0xFF;
1724 buf[1] = value & 0xFF;
1725
1726 vnc_write(vs, buf, 2);
1727}
1728
5fb6c7a8 1729void vnc_write_u8(VncState *vs, uint8_t value)
24236869
FB		 1730{
1731 vnc_write(vs, (char *)&value, 1);
1732}
1733
5fb6c7a8 1734void vnc_flush(VncState *vs)
24236869 1735{
bd023f95 1736 vnc_lock_output(vs);
d5f04223 1737 if (vs->ioc != NULL && vs->output.offset) {
bd023f95
CC		 1738 vnc_client_write_locked(vs);
1739 }
d49b87f0
KK		 1740 if (vs->disconnecting) {
1741 if (vs->ioc_tag != 0) {
1742 g_source_remove(vs->ioc_tag);
1743 }
1744 vs->ioc_tag = 0;
1745 }
bd023f95 1746 vnc_unlock_output(vs);
24236869
FB		 1747}
1748
71a8cdec 1749static uint8_t read_u8(uint8_t *data, size_t offset)
24236869
FB		 1750{
1751 return data[offset];
1752}
1753
71a8cdec 1754static uint16_t read_u16(uint8_t *data, size_t offset)
24236869
FB		 1755{
1756 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1757}
1758
71a8cdec 1759static int32_t read_s32(uint8_t *data, size_t offset)
24236869
FB		 1760{
1761 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1762 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1763}
1764
5fb6c7a8 1765uint32_t read_u32(uint8_t *data, size_t offset)
24236869
FB		 1766{
1767 return ((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1768 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1769}
1770
9e8dd451 1771static void check_pointer_type_change(Notifier *notifier, void *data)
564c337e 1772{
37c34d9d 1773 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
14768eba 1774 int absolute = qemu_input_is_absolute();
37c34d9d 1775
29fa4ed9 1776 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
bd023f95 1777 vnc_lock_output(vs);
46a183da 1778 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
28a76be8
AL		 1779 vnc_write_u8(vs, 0);
1780 vnc_write_u16(vs, 1);
1781 vnc_framebuffer_update(vs, absolute, 0,
bea60dd7
PL		 1782 pixman_image_get_width(vs->vd->server),
1783 pixman_image_get_height(vs->vd->server),
29fa4ed9 1784 VNC_ENCODING_POINTER_TYPE_CHANGE);
bd023f95 1785 vnc_unlock_output(vs);
28a76be8 1786 vnc_flush(vs);
564c337e
FB		 1787 }
1788 vs->absolute = absolute;
1789}
1790
24236869
FB		 1791static void pointer_event(VncState *vs, int button_mask, int x, int y)
1792{
7fb1cf16 1793 static uint32_t bmap[INPUT_BUTTON__MAX] = {
14768eba
GH		 1794 [INPUT_BUTTON_LEFT] = 0x01,
1795 [INPUT_BUTTON_MIDDLE] = 0x02,
1796 [INPUT_BUTTON_RIGHT] = 0x04,
f22d0af0
GH		 1797 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1798 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
14768eba
GH		 1799 };
1800 QemuConsole *con = vs->vd->dcl.con;
bea60dd7
PL		 1801 int width = pixman_image_get_width(vs->vd->server);
1802 int height = pixman_image_get_height(vs->vd->server);
24236869 1803
14768eba
GH		 1804 if (vs->last_bmask != button_mask) {
1805 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1806 vs->last_bmask = button_mask;
1807 }
564c337e
FB		 1808
1809 if (vs->absolute) {
9cfa7ab9
PV		 1810 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1811 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
29fa4ed9 1812 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
14768eba
GH		 1813 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1814 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
564c337e 1815 } else {
14768eba
GH		 1816 if (vs->last_x != -1) {
1817 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1818 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1819 }
28a76be8
AL		 1820 vs->last_x = x;
1821 vs->last_y = y;
24236869 1822 }
14768eba 1823 qemu_input_event_sync();
24236869
FB		 1824}
1825
c2f2ba49 1826static void press_key(VncState *vs, QKeyCode qcode)
64f5a135 1827{
c2f2ba49
GH		 1828 qkbd_state_key_event(vs->vd->kbd, qcode, true);
1829 qkbd_state_key_event(vs->vd->kbd, qcode, false);
a528b80c
AZ		 1830}
1831
ab99e5c1
LL		 1832static void vnc_led_state_change(VncState *vs)
1833{
ab99e5c1
LL		 1834 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1835 return;
1836 }
1837
ab99e5c1
LL		 1838 vnc_lock_output(vs);
1839 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1840 vnc_write_u8(vs, 0);
1841 vnc_write_u16(vs, 1);
1842 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
a54f0d2b 1843 vnc_write_u8(vs, vs->vd->ledstate);
ab99e5c1
LL		 1844 vnc_unlock_output(vs);
1845 vnc_flush(vs);
1846}
1847
7ffb82ca
GH		 1848static void kbd_leds(void *opaque, int ledstate)
1849{
a54f0d2b
PO		 1850 VncDisplay *vd = opaque;
1851 VncState *client;
7ffb82ca 1852
40066175
GH		 1853 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1854 (ledstate & QEMU_NUM_LOCK_LED),
1855 (ledstate & QEMU_SCROLL_LOCK_LED));
1856
a54f0d2b
PO		 1857 if (ledstate == vd->ledstate) {
1858 return;
96f3d174 1859 }
ab99e5c1 1860
a54f0d2b
PO		 1861 vd->ledstate = ledstate;
1862
1863 QTAILQ_FOREACH(client, &vd->clients, next) {
1864 vnc_led_state_change(client);
ab99e5c1 1865 }
7ffb82ca
GH		 1866}
1867
9ca313aa 1868static void do_key_event(VncState *vs, int down, int keycode, int sym)
24236869 1869{
c2f2ba49
GH		 1870 QKeyCode qcode = qemu_input_key_number_to_qcode(keycode);
1871
64f5a135 1872 /* QEMU console switch */
c2f2ba49
GH		 1873 switch (qcode) {
1874 case Q_KEY_CODE_1 ... Q_KEY_CODE_9: /* '1' to '9' keys */
1875 if (vs->vd->dcl.con == NULL && down &&
1876 qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL) &&
1877 qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_ALT)) {
64f5a135 1878 /* Reset the modifiers sent to the current console */
c2f2ba49
GH		 1879 qkbd_state_lift_all_keys(vs->vd->kbd);
1880 console_select(qcode - Q_KEY_CODE_1);
64f5a135
FB		 1881 return;
1882 }
c2f2ba49 1883 default:
a528b80c
AZ		 1884 break;
1885 }
1886
e7b2aacc
LL		 1887 /* Turn off the lock state sync logic if the client support the led
1888 state extension.
1889 */
9892088b 1890 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1891 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1892 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
a528b80c
AZ		 1893 /* If the numlock state needs to change then simulate an additional
1894 keypress before sending this one. This will happen if the user
1895 toggles numlock away from the VNC window.
1896 */
753b4053 1897 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
c2f2ba49 1898 if (!qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
40066175 1899 trace_vnc_key_sync_numlock(true);
c2f2ba49 1900 press_key(vs, Q_KEY_CODE_NUM_LOCK);
a528b80c
AZ		 1901 }
1902 } else {
c2f2ba49 1903 if (qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
40066175 1904 trace_vnc_key_sync_numlock(false);
c2f2ba49 1905 press_key(vs, Q_KEY_CODE_NUM_LOCK);
a528b80c
AZ		 1906 }
1907 }
64f5a135 1908 }
24236869 1909
9892088b 1910 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1911 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1912 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
6b132502
GH		 1913 /* If the capslock state needs to change then simulate an additional
1914 keypress before sending this one. This will happen if the user
1915 toggles capslock away from the VNC window.
1916 */
1917 int uppercase = !!(sym >= 'A' && sym <= 'Z');
c2f2ba49
GH		 1918 bool shift = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_SHIFT);
1919 bool capslock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CAPSLOCK);
6b132502
GH		 1920 if (capslock) {
1921 if (uppercase == shift) {
40066175 1922 trace_vnc_key_sync_capslock(false);
c2f2ba49 1923 press_key(vs, Q_KEY_CODE_CAPS_LOCK);
6b132502
GH		 1924 }
1925 } else {
1926 if (uppercase != shift) {
40066175 1927 trace_vnc_key_sync_capslock(true);
c2f2ba49 1928 press_key(vs, Q_KEY_CODE_CAPS_LOCK);
6b132502
GH		 1929 }
1930 }
1931 }
1932
c2f2ba49
GH		 1933 qkbd_state_key_event(vs->vd->kbd, qcode, down);
1934 if (!qemu_console_is_graphic(NULL)) {
1935 bool numlock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK);
1936 bool control = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL);
64f5a135
FB		 1937 /* QEMU console emulation */
1938 if (down) {
1939 switch (keycode) {
1940 case 0x2a: /* Left Shift */
1941 case 0x36: /* Right Shift */
1942 case 0x1d: /* Left CTRL */
1943 case 0x9d: /* Right CTRL */
1944 case 0x38: /* Left ALT */
1945 case 0xb8: /* Right ALT */
1946 break;
1947 case 0xc8:
1948 kbd_put_keysym(QEMU_KEY_UP);
1949 break;
1950 case 0xd0:
1951 kbd_put_keysym(QEMU_KEY_DOWN);
1952 break;
1953 case 0xcb:
1954 kbd_put_keysym(QEMU_KEY_LEFT);
1955 break;
1956 case 0xcd:
1957 kbd_put_keysym(QEMU_KEY_RIGHT);
1958 break;
1959 case 0xd3:
1960 kbd_put_keysym(QEMU_KEY_DELETE);
1961 break;
1962 case 0xc7:
1963 kbd_put_keysym(QEMU_KEY_HOME);
1964 break;
1965 case 0xcf:
1966 kbd_put_keysym(QEMU_KEY_END);
1967 break;
1968 case 0xc9:
1969 kbd_put_keysym(QEMU_KEY_PAGEUP);
1970 break;
1971 case 0xd1:
1972 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1973 break;
bb0a18e1
GH		 1974
1975 case 0x47:
1976 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1977 break;
1978 case 0x48:
1979 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1980 break;
1981 case 0x49:
1982 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1983 break;
1984 case 0x4b:
1985 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1986 break;
1987 case 0x4c:
1988 kbd_put_keysym('5');
1989 break;
1990 case 0x4d:
1991 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1992 break;
1993 case 0x4f:
1994 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1995 break;
1996 case 0x50:
1997 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1998 break;
1999 case 0x51:
2000 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
2001 break;
2002 case 0x52:
2003 kbd_put_keysym('0');
2004 break;
2005 case 0x53:
2006 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
2007 break;
2008
2009 case 0xb5:
2010 kbd_put_keysym('/');
2011 break;
2012 case 0x37:
2013 kbd_put_keysym('*');
2014 break;
2015 case 0x4a:
2016 kbd_put_keysym('-');
2017 break;
2018 case 0x4e:
2019 kbd_put_keysym('+');
2020 break;
2021 case 0x9c:
2022 kbd_put_keysym('\n');
2023 break;
2024
64f5a135 2025 default:
e26437c2
GH		 2026 if (control) {
2027 kbd_put_keysym(sym & 0x1f);
2028 } else {
2029 kbd_put_keysym(sym);
2030 }
64f5a135
FB		 2031 break;
2032 }
2033 }
2034 }
24236869
FB		 2035}
2036
40066175
GH		 2037static const char *code2name(int keycode)
2038{
977c736f 2039 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
40066175
GH		 2040}
2041
bdbd7676
FB		 2042static void key_event(VncState *vs, int down, uint32_t sym)
2043{
9ca313aa 2044 int keycode;
4a93fe17 2045 int lsym = sym;
9ca313aa 2046
81c0d5a6 2047 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
4a93fe17
GH		 2048 lsym = lsym - 'A' + 'a';
2049 }
9ca313aa 2050
abb4f2c9 2051 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
19c1b9fd 2052 vs->vd->kbd, down) & SCANCODE_KEYMASK;
40066175 2053 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
9ca313aa
AL		 2054 do_key_event(vs, down, keycode, sym);
2055}
2056
2057static void ext_key_event(VncState *vs, int down,
2058 uint32_t sym, uint16_t keycode)
2059{
2060 /* if the user specifies a keyboard layout, always use it */
40066175 2061 if (keyboard_layout) {
9ca313aa 2062 key_event(vs, down, sym);
40066175
GH		 2063 } else {
2064 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
9ca313aa 2065 do_key_event(vs, down, keycode, sym);
40066175 2066 }
bdbd7676
FB		 2067}
2068
24236869 2069static void framebuffer_update_request(VncState *vs, int incremental,
bea60dd7 2070 int x, int y, int w, int h)
24236869 2071{
bea60dd7 2072 if (incremental) {
fef1bbad
DB		 2073 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2074 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2075 }
2076 } else {
2077 vs->update = VNC_STATE_UPDATE_FORCE;
2078 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
104b8d19
GH		 2079 if (vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT)) {
2080 vnc_desktop_resize_ext(vs, 0);
2081 }
24236869
FB		 2082 }
2083}
2084
9ca313aa
AL		 2085static void send_ext_key_event_ack(VncState *vs)
2086{
bd023f95 2087 vnc_lock_output(vs);
46a183da 2088 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
9ca313aa
AL		 2089 vnc_write_u8(vs, 0);
2090 vnc_write_u16(vs, 1);
d39fa6d8 2091 vnc_framebuffer_update(vs, 0, 0,
bea60dd7
PL		 2092 pixman_image_get_width(vs->vd->server),
2093 pixman_image_get_height(vs->vd->server),
29fa4ed9 2094 VNC_ENCODING_EXT_KEY_EVENT);
bd023f95 2095 vnc_unlock_output(vs);
9ca313aa
AL		 2096 vnc_flush(vs);
2097}
2098
429a8ed3 2099static void send_ext_audio_ack(VncState *vs)
2100{
bd023f95 2101 vnc_lock_output(vs);
46a183da 2102 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
429a8ed3 2103 vnc_write_u8(vs, 0);
2104 vnc_write_u16(vs, 1);
d39fa6d8 2105 vnc_framebuffer_update(vs, 0, 0,
bea60dd7
PL		 2106 pixman_image_get_width(vs->vd->server),
2107 pixman_image_get_height(vs->vd->server),
29fa4ed9 2108 VNC_ENCODING_AUDIO);
bd023f95 2109 vnc_unlock_output(vs);
429a8ed3 2110 vnc_flush(vs);
2111}
2112
7b5fa0b5
DB		 2113static void send_xvp_message(VncState *vs, int code)
2114{
2115 vnc_lock_output(vs);
2116 vnc_write_u8(vs, VNC_MSG_SERVER_XVP);
2117 vnc_write_u8(vs, 0); /* pad */
2118 vnc_write_u8(vs, 1); /* version */
2119 vnc_write_u8(vs, code);
2120 vnc_unlock_output(vs);
2121 vnc_flush(vs);
2122}
2123
24236869
FB		 2124static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2125{
2126 int i;
29fa4ed9 2127 unsigned int enc = 0;
24236869 2128
29fa4ed9 2129 vs->features = 0;
a9f20d31 2130 vs->vnc_encoding = 0;
6bf21f3d
LQ		 2131 vs->tight->compression = 9;
2132 vs->tight->quality = -1; /* Lossless by default */
564c337e 2133 vs->absolute = -1;
24236869 2134
8a0f0d0c
CC		 2135 /*
2136 * Start from the end because the encodings are sent in order of preference.
e5bed759 2137 * This way the preferred encoding (first encoding defined in the array)
8a0f0d0c
CC		 2138 * will be set at the end of the loop.
2139 */
24236869 2140 for (i = n_encodings - 1; i >= 0; i--) {
29fa4ed9
AL		 2141 enc = encodings[i];
2142 switch (enc) {
2143 case VNC_ENCODING_RAW:
a9f20d31 2144 vs->vnc_encoding = enc;
29fa4ed9 2145 break;
29fa4ed9
AL		 2146 case VNC_ENCODING_HEXTILE:
2147 vs->features |= VNC_FEATURE_HEXTILE_MASK;
a9f20d31 2148 vs->vnc_encoding = enc;
29fa4ed9 2149 break;
380282b0
CC		 2150 case VNC_ENCODING_TIGHT:
2151 vs->features |= VNC_FEATURE_TIGHT_MASK;
2152 vs->vnc_encoding = enc;
2153 break;
95f8510e 2154#ifdef CONFIG_PNG
efe556ad
CC		 2155 case VNC_ENCODING_TIGHT_PNG:
2156 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2157 vs->vnc_encoding = enc;
2158 break;
fe3e7f2d 2159#endif
059cef40 2160 case VNC_ENCODING_ZLIB:
557ba0e5
CE		 2161 /*
2162 * VNC_ENCODING_ZRLE compresses better than VNC_ENCODING_ZLIB.
2163 * So prioritize ZRLE, even if the client hints that it prefers
2164 * ZLIB.
2165 */
2166 if ((vs->features & VNC_FEATURE_ZRLE_MASK) == 0) {
2167 vs->features |= VNC_FEATURE_ZLIB_MASK;
2168 vs->vnc_encoding = enc;
2169 }
059cef40 2170 break;
148954fa
CC		 2171 case VNC_ENCODING_ZRLE:
2172 vs->features |= VNC_FEATURE_ZRLE_MASK;
2173 vs->vnc_encoding = enc;
2174 break;
2175 case VNC_ENCODING_ZYWRLE:
2176 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2177 vs->vnc_encoding = enc;
2178 break;
29fa4ed9
AL		 2179 case VNC_ENCODING_DESKTOPRESIZE:
2180 vs->features |= VNC_FEATURE_RESIZE_MASK;
2181 break;
763deea7
GH		 2182 case VNC_ENCODING_DESKTOP_RESIZE_EXT:
2183 vs->features |= VNC_FEATURE_RESIZE_EXT_MASK;
2184 break;
29fa4ed9
AL		 2185 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2186 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2187 break;
d467b679
GH		 2188 case VNC_ENCODING_RICH_CURSOR:
2189 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
074a86d0
GH		 2190 break;
2191 case VNC_ENCODING_ALPHA_CURSOR:
2192 vs->features |= VNC_FEATURE_ALPHA_CURSOR_MASK;
d467b679 2193 break;
29fa4ed9 2194 case VNC_ENCODING_EXT_KEY_EVENT:
9ca313aa
AL		 2195 send_ext_key_event_ack(vs);
2196 break;
29fa4ed9 2197 case VNC_ENCODING_AUDIO:
429a8ed3 2198 send_ext_audio_ack(vs);
2199 break;
29fa4ed9
AL		 2200 case VNC_ENCODING_WMVi:
2201 vs->features |= VNC_FEATURE_WMVI_MASK;
ca4cca4d 2202 break;
ab99e5c1
LL		 2203 case VNC_ENCODING_LED_STATE:
2204 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2205 break;
7b5fa0b5
DB		 2206 case VNC_ENCODING_XVP:
2207 if (vs->vd->power_control) {
2208 vs->features |= VNC_FEATURE_XVP;
2209 send_xvp_message(vs, VNC_XVP_CODE_INIT);
2210 }
2211 break;
0bf41cab
GH		 2212 case VNC_ENCODING_CLIPBOARD_EXT:
2213 vs->features |= VNC_FEATURE_CLIPBOARD_EXT_MASK;
2214 vnc_server_cut_text_caps(vs);
2215 break;
fb437313 2216 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
6bf21f3d 2217 vs->tight->compression = (enc & 0x0F);
fb437313
AL		 2218 break;
2219 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
b31f519e 2220 if (vs->vd->lossy) {
6bf21f3d 2221 vs->tight->quality = (enc & 0x0F);
b31f519e 2222 }
fb437313 2223 break;
29fa4ed9
AL		 2224 default:
2225 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2226 break;
2227 }
24236869 2228 }
d239726c 2229 vnc_desktop_resize(vs);
9e8dd451 2230 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
d239726c
GH		 2231 vnc_led_state_change(vs);
2232 vnc_cursor_define(vs);
24236869
FB		 2233}
2234
6cec5487
AL		 2235static void set_pixel_conversion(VncState *vs)
2236{
9f64916d
GH		 2237 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2238
2239 if (fmt == VNC_SERVER_FB_FORMAT) {
6cec5487 2240 vs->write_pixels = vnc_write_pixels_copy;
70a4568f 2241 vnc_hextile_set_pixel_conversion(vs, 0);
6cec5487
AL		 2242 } else {
2243 vs->write_pixels = vnc_write_pixels_generic;
70a4568f 2244 vnc_hextile_set_pixel_conversion(vs, 1);
6cec5487
AL		 2245 }
2246}
2247
0c426e45
AG		 2248static void send_color_map(VncState *vs)
2249{
2250 int i;
2251
947191b4 2252 vnc_lock_output(vs);
0c426e45
AG		 2253 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2254 vnc_write_u8(vs, 0); /* padding */
2255 vnc_write_u16(vs, 0); /* first color */
2256 vnc_write_u16(vs, 256); /* # of colors */
2257
2258 for (i = 0; i < 256; i++) {
2259 PixelFormat *pf = &vs->client_pf;
2260
2261 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2262 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2263 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2264 }
947191b4 2265 vnc_unlock_output(vs);
0c426e45
AG		 2266}
2267
ec9fb41a 2268static void set_pixel_format(VncState *vs, int bits_per_pixel,
28a76be8
AL		 2269 int big_endian_flag, int true_color_flag,
2270 int red_max, int green_max, int blue_max,
2271 int red_shift, int green_shift, int blue_shift)
24236869 2272{
3512779a 2273 if (!true_color_flag) {
0c426e45
AG		 2274 /* Expose a reasonable default 256 color map */
2275 bits_per_pixel = 8;
0c426e45
AG		 2276 red_max = 7;
2277 green_max = 7;
2278 blue_max = 3;
2279 red_shift = 0;
2280 green_shift = 3;
2281 blue_shift = 6;
3512779a 2282 }
24236869 2283
e6908bfe
PM		 2284 switch (bits_per_pixel) {
2285 case 8:
2286 case 16:
2287 case 32:
2288 break;
2289 default:
2290 vnc_client_error(vs);
2291 return;
2292 }
2293
4c65fed8 2294 vs->client_pf.rmax = red_max ? red_max : 0xFF;
7c9209e7 2295 vs->client_pf.rbits = ctpopl(red_max);
9f64916d
GH		 2296 vs->client_pf.rshift = red_shift;
2297 vs->client_pf.rmask = red_max << red_shift;
4c65fed8 2298 vs->client_pf.gmax = green_max ? green_max : 0xFF;
7c9209e7 2299 vs->client_pf.gbits = ctpopl(green_max);
9f64916d
GH		 2300 vs->client_pf.gshift = green_shift;
2301 vs->client_pf.gmask = green_max << green_shift;
4c65fed8 2302 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
7c9209e7 2303 vs->client_pf.bbits = ctpopl(blue_max);
9f64916d
GH		 2304 vs->client_pf.bshift = blue_shift;
2305 vs->client_pf.bmask = blue_max << blue_shift;
2306 vs->client_pf.bits_per_pixel = bits_per_pixel;
2307 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2308 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2309 vs->client_be = big_endian_flag;
6cec5487 2310
0c426e45
AG		 2311 if (!true_color_flag) {
2312 send_color_map(vs);
2313 }
2314
6cec5487 2315 set_pixel_conversion(vs);
24236869 2316
1d0d59fe
GH		 2317 graphic_hw_invalidate(vs->vd->dcl.con);
2318 graphic_hw_update(vs->vd->dcl.con);
24236869
FB		 2319}
2320
ca4cca4d
AL		 2321static void pixel_format_message (VncState *vs) {
2322 char pad[3] = { 0, 0, 0 };
2323
9f64916d
GH		 2324 vs->client_pf = qemu_default_pixelformat(32);
2325
2326 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2327 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
ca4cca4d 2328
e03b5686 2329#if HOST_BIG_ENDIAN
ca4cca4d
AL		 2330 vnc_write_u8(vs, 1); /* big-endian-flag */
2331#else
2332 vnc_write_u8(vs, 0); /* big-endian-flag */
2333#endif
2334 vnc_write_u8(vs, 1); /* true-color-flag */
9f64916d
GH		 2335 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2336 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2337 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2338 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2339 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2340 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2341 vnc_write(vs, pad, 3); /* padding */
70a4568f
CC		 2342
2343 vnc_hextile_set_pixel_conversion(vs, 0);
ca4cca4d 2344 vs->write_pixels = vnc_write_pixels_copy;
ca4cca4d
AL		 2345}
2346
753b4053 2347static void vnc_colordepth(VncState *vs)
7eac3a87 2348{
753b4053 2349 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
ca4cca4d 2350 /* Sending a WMVi message to notify the client*/
bd023f95 2351 vnc_lock_output(vs);
46a183da 2352 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
ca4cca4d
AL		 2353 vnc_write_u8(vs, 0);
2354 vnc_write_u16(vs, 1); /* number of rects */
d39fa6d8 2355 vnc_framebuffer_update(vs, 0, 0,
3d3a528d
DB		 2356 vs->client_width,
2357 vs->client_height,
d39fa6d8 2358 VNC_ENCODING_WMVi);
ca4cca4d 2359 pixel_format_message(vs);
bd023f95 2360 vnc_unlock_output(vs);
ca4cca4d 2361 vnc_flush(vs);
7eac3a87 2362 } else {
6cec5487 2363 set_pixel_conversion(vs);
7eac3a87
AL		 2364 }
2365}
2366
60fe76f3 2367static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
24236869
FB		 2368{
2369 int i;
2370 uint16_t limit;
cf070658 2371 uint32_t freq;
2430ffe4
SS		 2372 VncDisplay *vd = vs->vd;
2373
2374 if (data[0] > 3) {
0f7b2864 2375 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2430ffe4 2376 }
24236869
FB		 2377
2378 switch (data[0]) {
46a183da 2379 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
28a76be8
AL		 2380 if (len == 1)
2381 return 20;
2382
ec9fb41a 2383 set_pixel_format(vs, read_u8(data, 4),
28a76be8
AL		 2384 read_u8(data, 6), read_u8(data, 7),
2385 read_u16(data, 8), read_u16(data, 10),
2386 read_u16(data, 12), read_u8(data, 14),
2387 read_u8(data, 15), read_u8(data, 16));
2388 break;
46a183da 2389 case VNC_MSG_CLIENT_SET_ENCODINGS:
28a76be8
AL		 2390 if (len == 1)
2391 return 4;
24236869 2392
28a76be8 2393 if (len == 4) {
69dd5c9f
AL		 2394 limit = read_u16(data, 2);
2395 if (limit > 0)
2396 return 4 + (limit * 4);
2397 } else
2398 limit = read_u16(data, 2);
24236869 2399
28a76be8
AL		 2400 for (i = 0; i < limit; i++) {
2401 int32_t val = read_s32(data, 4 + (i * 4));
2402 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2403 }
24236869 2404
28a76be8
AL		 2405 set_encodings(vs, (int32_t *)(data + 4), limit);
2406 break;
46a183da 2407 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
28a76be8
AL		 2408 if (len == 1)
2409 return 10;
24236869 2410
28a76be8
AL		 2411 framebuffer_update_request(vs,
2412 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2413 read_u16(data, 6), read_u16(data, 8));
2414 break;
46a183da 2415 case VNC_MSG_CLIENT_KEY_EVENT:
28a76be8
AL		 2416 if (len == 1)
2417 return 8;
24236869 2418
28a76be8
AL		 2419 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2420 break;
46a183da 2421 case VNC_MSG_CLIENT_POINTER_EVENT:
28a76be8
AL		 2422 if (len == 1)
2423 return 6;
24236869 2424
28a76be8
AL		 2425 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2426 break;
46a183da 2427 case VNC_MSG_CLIENT_CUT_TEXT:
f9a70e79 2428 if (len == 1) {
28a76be8 2429 return 8;
f9a70e79 2430 }
d307040b 2431 uint32_t dlen = abs(read_s32(data, 4));
28a76be8 2432 if (len == 8) {
f9a70e79
PL		 2433 if (dlen > (1 << 20)) {
2434 error_report("vnc: client_cut_text msg payload has %u bytes"
2435 " which exceeds our limit of 1MB.", dlen);
2436 vnc_client_error(vs);
2437 break;
2438 }
2439 if (dlen > 0) {
baa7666c 2440 return 8 + dlen;
f9a70e79 2441 }
baa7666c 2442 }
24236869 2443
0bf41cab 2444 if (read_s32(data, 4) < 0) {
d307040b
MMC		 2445 if (dlen < 4) {
2446 error_report("vnc: malformed payload (header less than 4 bytes)"
2447 " in extended clipboard pseudo-encoding.");
2448 vnc_client_error(vs);
2449 break;
2450 }
2451 vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12);
0bf41cab
GH		 2452 break;
2453 }
2454 vnc_client_cut_text(vs, read_u32(data, 4), data + 8);
28a76be8 2455 break;
7b5fa0b5
DB		 2456 case VNC_MSG_CLIENT_XVP:
2457 if (!(vs->features & VNC_FEATURE_XVP)) {
2458 error_report("vnc: xvp client message while disabled");
2459 vnc_client_error(vs);
2460 break;
2461 }
2462 if (len == 1) {
2463 return 4;
2464 }
2465 if (len == 4) {
2466 uint8_t version = read_u8(data, 2);
2467 uint8_t action = read_u8(data, 3);
2468
2469 if (version != 1) {
2470 error_report("vnc: xvp client message version %d != 1",
2471 version);
2472 vnc_client_error(vs);
2473 break;
2474 }
2475
2476 switch (action) {
2477 case VNC_XVP_ACTION_SHUTDOWN:
2478 qemu_system_powerdown_request();
2479 break;
2480 case VNC_XVP_ACTION_REBOOT:
2481 send_xvp_message(vs, VNC_XVP_CODE_FAIL);
2482 break;
2483 case VNC_XVP_ACTION_RESET:
2484 qemu_system_reset_request(SHUTDOWN_CAUSE_HOST_QMP_SYSTEM_RESET);
2485 break;
2486 default:
2487 send_xvp_message(vs, VNC_XVP_CODE_FAIL);
2488 break;
2489 }
2490 }
2491 break;
46a183da 2492 case VNC_MSG_CLIENT_QEMU:
9ca313aa
AL		 2493 if (len == 1)
2494 return 2;
2495
2496 switch (read_u8(data, 1)) {
46a183da 2497 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
9ca313aa
AL		 2498 if (len == 2)
2499 return 12;
2500
2501 ext_key_event(vs, read_u16(data, 2),
2502 read_u32(data, 4), read_u32(data, 8));
2503 break;
46a183da 2504 case VNC_MSG_CLIENT_QEMU_AUDIO:
429a8ed3 2505 if (len == 2)
2506 return 4;
2507
2508 switch (read_u16 (data, 2)) {
46a183da 2509 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
adc8fce8 2510 trace_vnc_msg_client_audio_enable(vs, vs->ioc);
429a8ed3 2511 audio_add(vs);
2512 break;
46a183da 2513 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
adc8fce8 2514 trace_vnc_msg_client_audio_disable(vs, vs->ioc);
429a8ed3 2515 audio_del(vs);
2516 break;
46a183da 2517 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
429a8ed3 2518 if (len == 4)
2519 return 10;
2520 switch (read_u8(data, 4)) {
85bc5852
KZ		 2521 case 0: vs->as.fmt = AUDIO_FORMAT_U8; break;
2522 case 1: vs->as.fmt = AUDIO_FORMAT_S8; break;
2523 case 2: vs->as.fmt = AUDIO_FORMAT_U16; break;
2524 case 3: vs->as.fmt = AUDIO_FORMAT_S16; break;
2525 case 4: vs->as.fmt = AUDIO_FORMAT_U32; break;
2526 case 5: vs->as.fmt = AUDIO_FORMAT_S32; break;
429a8ed3 2527 default:
153130cd 2528 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
429a8ed3 2529 vnc_client_error(vs);
2530 break;
2531 }
2532 vs->as.nchannels = read_u8(data, 5);
2533 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
090fdc83 2534 VNC_DEBUG("Invalid audio channel count %d\n",
153130cd 2535 read_u8(data, 5));
429a8ed3 2536 vnc_client_error(vs);
2537 break;
2538 }
cf070658
DB		 2539 freq = read_u32(data, 6);
2540 /* No official limit for protocol, but 48khz is a sensible
2541 * upper bound for trustworthy clients, and this limit
2542 * protects calculations involving 'vs->as.freq' later.
2543 */
2544 if (freq > 48000) {
2545 VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
2546 vnc_client_error(vs);
2547 break;
2548 }
2549 vs->as.freq = freq;
adc8fce8
DB		 2550 trace_vnc_msg_client_audio_format(
2551 vs, vs->ioc, vs->as.fmt, vs->as.nchannels, vs->as.freq);
429a8ed3 2552 break;
2553 default:
153130cd 2554 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
429a8ed3 2555 vnc_client_error(vs);
2556 break;
2557 }
2558 break;
2559
9ca313aa 2560 default:
153130cd 2561 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
9ca313aa
AL		 2562 vnc_client_error(vs);
2563 break;
2564 }
2565 break;
763deea7
GH		 2566 case VNC_MSG_CLIENT_SET_DESKTOP_SIZE:
2567 {
2568 size_t size;
2569 uint8_t screens;
adc8fce8 2570 int w, h;
763deea7
GH		 2571
2572 if (len < 8) {
2573 return 8;
2574 }
2575
2576 screens = read_u8(data, 6);
2577 size = 8 + screens * 16;
2578 if (len < size) {
2579 return size;
2580 }
adc8fce8
DB		 2581 w = read_u16(data, 2);
2582 h = read_u16(data, 4);
763deea7 2583
adc8fce8 2584 trace_vnc_msg_client_set_desktop_size(vs, vs->ioc, w, h, screens);
763deea7
GH		 2585 if (dpy_ui_info_supported(vs->vd->dcl.con)) {
2586 QemuUIInfo info;
2587 memset(&info, 0, sizeof(info));
adc8fce8
DB		 2588 info.width = w;
2589 info.height = h;
ca19ef52 2590 dpy_set_ui_info(vs->vd->dcl.con, &info, false);
763deea7
GH		 2591 vnc_desktop_resize_ext(vs, 4 /* Request forwarded */);
2592 } else {
2593 vnc_desktop_resize_ext(vs, 3 /* Invalid screen layout */);
2594 }
2595
2596 break;
2597 }
24236869 2598 default:
153130cd 2599 VNC_DEBUG("Msg: %d\n", data[0]);
28a76be8
AL		 2600 vnc_client_error(vs);
2601 break;
24236869 2602 }
5fafdf24 2603
e2b72cb6 2604 vnc_update_throttle_offset(vs);
24236869
FB		 2605 vnc_read_when(vs, protocol_client_msg, 1);
2606 return 0;
2607}
2608
60fe76f3 2609static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
24236869 2610{
c35734b2 2611 char buf[1024];
8cf36489 2612 VncShareMode mode;
c35734b2 2613 int size;
24236869 2614
8cf36489
GH		 2615 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2616 switch (vs->vd->share_policy) {
2617 case VNC_SHARE_POLICY_IGNORE:
2618 /*
2619 * Ignore the shared flag. Nothing to do here.
2620 *
2621 * Doesn't conform to the rfb spec but is traditional qemu
2622 * behavior, thus left here as option for compatibility
2623 * reasons.
2624 */
2625 break;
2626 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2627 /*
2628 * Policy: Allow clients ask for exclusive access.
2629 *
2630 * Implementation: When a client asks for exclusive access,
2631 * disconnect all others. Shared connects are allowed as long
2632 * as no exclusive connection exists.
2633 *
2634 * This is how the rfb spec suggests to handle the shared flag.
2635 */
2636 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2637 VncState *client;
2638 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2639 if (vs == client) {
2640 continue;
2641 }
2642 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2643 client->share_mode != VNC_SHARE_MODE_SHARED) {
2644 continue;
2645 }
2646 vnc_disconnect_start(client);
2647 }
2648 }
2649 if (mode == VNC_SHARE_MODE_SHARED) {
2650 if (vs->vd->num_exclusive > 0) {
2651 vnc_disconnect_start(vs);
2652 return 0;
2653 }
2654 }
2655 break;
2656 case VNC_SHARE_POLICY_FORCE_SHARED:
2657 /*
2658 * Policy: Shared connects only.
2659 * Implementation: Disallow clients asking for exclusive access.
2660 *
2661 * Useful for shared desktop sessions where you don't want
2662 * someone forgetting to say -shared when running the vnc
2663 * client disconnect everybody else.
2664 */
2665 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2666 vnc_disconnect_start(vs);
2667 return 0;
2668 }
2669 break;
2670 }
2671 vnc_set_share_mode(vs, mode);
2672
e5f34cdd
GH		 2673 if (vs->vd->num_shared > vs->vd->connections_limit) {
2674 vnc_disconnect_start(vs);
2675 return 0;
2676 }
2677
4c956bd8
DB		 2678 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2679 pixman_image_get_width(vs->vd->server) >= 0);
2680 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2681 pixman_image_get_height(vs->vd->server) >= 0);
bea60dd7
PL		 2682 vs->client_width = pixman_image_get_width(vs->vd->server);
2683 vs->client_height = pixman_image_get_height(vs->vd->server);
5862d195
GH		 2684 vnc_write_u16(vs, vs->client_width);
2685 vnc_write_u16(vs, vs->client_height);
24236869 2686
ca4cca4d 2687 pixel_format_message(vs);
24236869 2688
97efe4f9 2689 if (qemu_name) {
c35734b2 2690 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
97efe4f9
TH		 2691 if (size > sizeof(buf)) {
2692 size = sizeof(buf);
2693 }
2694 } else {
c35734b2 2695 size = snprintf(buf, sizeof(buf), "QEMU");
97efe4f9 2696 }
c35734b2
TS		 2697
2698 vnc_write_u32(vs, size);
2699 vnc_write(vs, buf, size);
24236869
FB		 2700 vnc_flush(vs);
2701
4a80dba3 2702 vnc_client_cache_auth(vs);
fb6ba0d5 2703 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
4a80dba3 2704
24236869
FB		 2705 vnc_read_when(vs, protocol_client_msg, 1);
2706
2707 return 0;
2708}
2709
5fb6c7a8
AL		 2710void start_client_init(VncState *vs)
2711{
2712 vnc_read_when(vs, protocol_client_init, 1);
2713}
2714
4347e638
RH		 2715static void authentication_failed(VncState *vs)
2716{
2717 vnc_write_u32(vs, 1); /* Reject auth */
2718 if (vs->minor >= 8) {
2719 static const char err[] = "Authentication failed";
2720 vnc_write_u32(vs, sizeof(err));
2721 vnc_write(vs, err, sizeof(err));
2722 }
2723 vnc_flush(vs);
2724 vnc_client_error(vs);
2725}
2726
83bee4b5
DB		 2727static void
2728vnc_munge_des_rfb_key(unsigned char *key, size_t nkey)
2729{
2730 size_t i;
2731 for (i = 0; i < nkey; i++) {
2732 uint8_t r = key[i];
2733 r = (r & 0xf0) >> 4 | (r & 0x0f) << 4;
2734 r = (r & 0xcc) >> 2 | (r & 0x33) << 2;
2735 r = (r & 0xaa) >> 1 | (r & 0x55) << 1;
2736 key[i] = r;
2737 }
2738}
2739
60fe76f3 2740static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
70848515 2741{
60fe76f3 2742 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
800567a6 2743 size_t i, pwlen;
60fe76f3 2744 unsigned char key[8];
3c9405a0 2745 time_t now = time(NULL);
60928458 2746 QCryptoCipher *cipher = NULL;
800567a6 2747 Error *err = NULL;
70848515 2748
1cd20f8b 2749 if (!vs->vd->password) {
7364dbda 2750 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
6bffdf0f 2751 goto reject;
70848515 2752 }
3c9405a0 2753 if (vs->vd->expires < now) {
7364dbda 2754 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
3c9405a0
GH		 2755 goto reject;
2756 }
70848515
TS		 2757
2758 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2759
2760 /* Calculate the expected challenge response */
753b4053 2761 pwlen = strlen(vs->vd->password);
70848515 2762 for (i=0; i<sizeof(key); i++)
753b4053 2763 key[i] = i<pwlen ? vs->vd->password[i] : 0;
83bee4b5 2764 vnc_munge_des_rfb_key(key, sizeof(key));
800567a6
DB		 2765
2766 cipher = qcrypto_cipher_new(
83bee4b5 2767 QCRYPTO_CIPHER_ALG_DES,
800567a6
DB		 2768 QCRYPTO_CIPHER_MODE_ECB,
2769 key, G_N_ELEMENTS(key),
2770 &err);
2771 if (!cipher) {
7364dbda
DB		 2772 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2773 error_get_pretty(err));
800567a6
DB		 2774 error_free(err);
2775 goto reject;
2776 }
2777
a1695137 2778 if (qcrypto_cipher_encrypt(cipher,
800567a6
DB		 2779 vs->challenge,
2780 response,
2781 VNC_AUTH_CHALLENGE_SIZE,
2782 &err) < 0) {
7364dbda
DB		 2783 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2784 error_get_pretty(err));
800567a6
DB		 2785 error_free(err);
2786 goto reject;
2787 }
70848515
TS		 2788
2789 /* Compare expected vs actual challenge response */
2790 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
7364dbda 2791 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
6bffdf0f 2792 goto reject;
70848515 2793 } else {
7364dbda 2794 trace_vnc_auth_pass(vs, vs->auth);
28a76be8
AL		 2795 vnc_write_u32(vs, 0); /* Accept auth */
2796 vnc_flush(vs);
70848515 2797
5fb6c7a8 2798 start_client_init(vs);
70848515 2799 }
60928458
GA		 2800
2801 qcrypto_cipher_free(cipher);
70848515 2802 return 0;
6bffdf0f
GH		 2803
2804reject:
4347e638 2805 authentication_failed(vs);
60928458 2806 qcrypto_cipher_free(cipher);
6bffdf0f 2807 return 0;
70848515
TS		 2808}
2809
5fb6c7a8 2810void start_auth_vnc(VncState *vs)
70848515 2811{
f7b2502c
RH		 2812 Error *err = NULL;
2813
2814 if (qcrypto_random_bytes(vs->challenge, sizeof(vs->challenge), &err)) {
2815 trace_vnc_auth_fail(vs, vs->auth, "cannot get random bytes",
2816 error_get_pretty(err));
2817 error_free(err);
2818 authentication_failed(vs);
2819 return;
2820 }
2821
70848515
TS		 2822 /* Send client a 'random' challenge */
2823 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2824 vnc_flush(vs);
2825
2826 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
469b15c6
TS		 2827}
2828
2829
60fe76f3 2830static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
70848515
TS		 2831{
2832 /* We only advertise 1 auth scheme at a time, so client
2833 * must pick the one we sent. Verify this */
7e7e2ebc 2834 if (data[0] != vs->auth) { /* Reject auth */
7364dbda 2835 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
4347e638 2836 authentication_failed(vs);
70848515 2837 } else { /* Accept requested auth */
7364dbda 2838 trace_vnc_auth_start(vs, vs->auth);
7e7e2ebc 2839 switch (vs->auth) {
70848515 2840 case VNC_AUTH_NONE:
a26c97ad
AZ		 2841 if (vs->minor >= 8) {
2842 vnc_write_u32(vs, 0); /* Accept auth completion */
2843 vnc_flush(vs);
2844 }
7364dbda 2845 trace_vnc_auth_pass(vs, vs->auth);
5fb6c7a8 2846 start_client_init(vs);
70848515
TS		 2847 break;
2848
2849 case VNC_AUTH_VNC:
5fb6c7a8
AL		 2850 start_auth_vnc(vs);
2851 break;
70848515 2852
8d5d2d4c 2853 case VNC_AUTH_VENCRYPT:
5fb6c7a8
AL		 2854 start_auth_vencrypt(vs);
2855 break;
8d5d2d4c 2856
2f9606b3
AL		 2857#ifdef CONFIG_VNC_SASL
2858 case VNC_AUTH_SASL:
2f9606b3
AL		 2859 start_auth_sasl(vs);
2860 break;
2861#endif /* CONFIG_VNC_SASL */
2862
70848515 2863 default: /* Should not be possible, but just in case */
7364dbda 2864 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
4347e638 2865 authentication_failed(vs);
70848515
TS		 2866 }
2867 }
2868 return 0;
2869}
2870
60fe76f3 2871static int protocol_version(VncState *vs, uint8_t *version, size_t len)
24236869
FB		 2872{
2873 char local[13];
24236869
FB		 2874
2875 memcpy(local, version, 12);
2876 local[12] = 0;
2877
70848515 2878 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
28a76be8
AL		 2879 VNC_DEBUG("Malformed protocol version %s\n", local);
2880 vnc_client_error(vs);
2881 return 0;
24236869 2882 }
70848515
TS		 2883 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2884 if (vs->major != 3 ||
28a76be8
AL		 2885 (vs->minor != 3 &&
2886 vs->minor != 4 &&
2887 vs->minor != 5 &&
2888 vs->minor != 7 &&
2889 vs->minor != 8)) {
2890 VNC_DEBUG("Unsupported client version\n");
2891 vnc_write_u32(vs, VNC_AUTH_INVALID);
2892 vnc_flush(vs);
2893 vnc_client_error(vs);
2894 return 0;
70848515 2895 }
b0566f4f 2896 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
70848515
TS		 2897 * as equivalent to v3.3 by servers
2898 */
b0566f4f 2899 if (vs->minor == 4 || vs->minor == 5)
28a76be8 2900 vs->minor = 3;
70848515
TS		 2901
2902 if (vs->minor == 3) {
7364dbda 2903 trace_vnc_auth_start(vs, vs->auth);
7e7e2ebc 2904 if (vs->auth == VNC_AUTH_NONE) {
7e7e2ebc 2905 vnc_write_u32(vs, vs->auth);
70848515 2906 vnc_flush(vs);
7364dbda 2907 trace_vnc_auth_pass(vs, vs->auth);
28a76be8 2908 start_client_init(vs);
7e7e2ebc 2909 } else if (vs->auth == VNC_AUTH_VNC) {
70848515 2910 VNC_DEBUG("Tell client VNC auth\n");
7e7e2ebc 2911 vnc_write_u32(vs, vs->auth);
70848515
TS		 2912 vnc_flush(vs);
2913 start_auth_vnc(vs);
2914 } else {
7364dbda
DB		 2915 trace_vnc_auth_fail(vs, vs->auth,
2916 "Unsupported auth method for v3.3", "");
70848515
TS		 2917 vnc_write_u32(vs, VNC_AUTH_INVALID);
2918 vnc_flush(vs);
2919 vnc_client_error(vs);
2920 }
2921 } else {
28a76be8 2922 vnc_write_u8(vs, 1); /* num auth */
7e7e2ebc 2923 vnc_write_u8(vs, vs->auth);
28a76be8
AL		 2924 vnc_read_when(vs, protocol_client_auth, 1);
2925 vnc_flush(vs);
70848515 2926 }
24236869
FB		 2927
2928 return 0;
2929}
2930
999342a0
CC		 2931static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2932{
2933 struct VncSurface *vs = &vd->guest;
2934
2935 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2936}
2937
7d964c9d
CC		 2938void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2939{
2940 int i, j;
2941
2942 w = (x + w) / VNC_STAT_RECT;
2943 h = (y + h) / VNC_STAT_RECT;
2944 x /= VNC_STAT_RECT;
2945 y /= VNC_STAT_RECT;
2946
207f328a
CC		 2947 for (j = y; j <= h; j++) {
2948 for (i = x; i <= w; i++) {
7d964c9d
CC		 2949 vs->lossy_rect[j][i] = 1;
2950 }
2951 }
2952}
2953
2954static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2955{
2956 VncState *vs;
2957 int sty = y / VNC_STAT_RECT;
2958 int stx = x / VNC_STAT_RECT;
2959 int has_dirty = 0;
2960
5a3804db
MAL		 2961 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2962 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
7d964c9d
CC		 2963
2964 QTAILQ_FOREACH(vs, &vd->clients, next) {
bc2429b9 2965 int j;
7d964c9d
CC		 2966
2967 /* kernel send buffers are full -> refresh later */
2968 if (vs->output.offset) {
2969 continue;
2970 }
2971
2972 if (!vs->lossy_rect[sty][stx]) {
2973 continue;
2974 }
207f328a 2975
7d964c9d
CC		 2976 vs->lossy_rect[sty][stx] = 0;
2977 for (j = 0; j < VNC_STAT_RECT; ++j) {
b4c85ddc
PL		 2978 bitmap_set(vs->dirty[y + j],
2979 x / VNC_DIRTY_PIXELS_PER_BIT,
2980 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
7d964c9d
CC		 2981 }
2982 has_dirty++;
2983 }
207f328a 2984
7d964c9d
CC		 2985 return has_dirty;
2986}
2987
2988static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
999342a0 2989{
eebe0b79
GH		 2990 int width = MIN(pixman_image_get_width(vd->guest.fb),
2991 pixman_image_get_width(vd->server));
2992 int height = MIN(pixman_image_get_height(vd->guest.fb),
2993 pixman_image_get_height(vd->server));
999342a0
CC		 2994 int x, y;
2995 struct timeval res;
7d964c9d 2996 int has_dirty = 0;
999342a0 2997
9f64916d
GH		 2998 for (y = 0; y < height; y += VNC_STAT_RECT) {
2999 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 3000 VncRectStat *rect = vnc_stat_rect(vd, x, y);
3001
3002 rect->updated = false;
3003 }
3004 }
3005
ad620c29 3006 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
999342a0
CC		 3007
3008 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
7d964c9d 3009 return has_dirty;
999342a0
CC		 3010 }
3011 vd->guest.last_freq_check = *tv;
3012
9f64916d
GH		 3013 for (y = 0; y < height; y += VNC_STAT_RECT) {
3014 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 3015 VncRectStat *rect= vnc_stat_rect(vd, x, y);
3016 int count = ARRAY_SIZE(rect->times);
3017 struct timeval min, max;
3018
3019 if (!timerisset(&rect->times[count - 1])) {
3020 continue ;
3021 }
3022
3023 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 3024 qemu_timersub(tv, &max, &res);
999342a0
CC		 3025
3026 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
3027 rect->freq = 0;
7d964c9d 3028 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
999342a0
CC		 3029 memset(rect->times, 0, sizeof (rect->times));
3030 continue ;
3031 }
3032
3033 min = rect->times[rect->idx];
3034 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 3035 qemu_timersub(&max, &min, &res);
999342a0
CC		 3036
3037 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
3038 rect->freq /= count;
3039 rect->freq = 1. / rect->freq;
3040 }
3041 }
7d964c9d 3042 return has_dirty;
999342a0
CC		 3043}
3044
3045double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
3046{
3047 int i, j;
3048 double total = 0;
3049 int num = 0;
3050
5a3804db
MAL		 3051 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
3052 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
999342a0
CC		 3053
3054 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
3055 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
3056 total += vnc_stat_rect(vs->vd, i, j)->freq;
3057 num++;
3058 }
3059 }
3060
3061 if (num) {
3062 return total / num;
3063 } else {
3064 return 0;
3065 }
3066}
3067
3068static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
3069{
3070 VncRectStat *rect;
3071
3072 rect = vnc_stat_rect(vd, x, y);
3073 if (rect->updated) {
c1dadb84 3074 return;
999342a0
CC		 3075 }
3076 rect->times[rect->idx] = *tv;
3077 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
3078 rect->updated = true;
3079}
3080
1fc62412
SS		 3081static int vnc_refresh_server_surface(VncDisplay *vd)
3082{
bea60dd7
PL		 3083 int width = MIN(pixman_image_get_width(vd->guest.fb),
3084 pixman_image_get_width(vd->server));
3085 int height = MIN(pixman_image_get_height(vd->guest.fb),
3086 pixman_image_get_height(vd->server));
eb8934b0 3087 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
12b316d4 3088 uint8_t *guest_row0 = NULL, *server_row0;
41b4bef6 3089 VncState *vs;
1fc62412 3090 int has_dirty = 0;
9f64916d 3091 pixman_image_t *tmpbuf = NULL;
6c08964b
WJ		 3092 unsigned long offset;
3093 int x;
3094 uint8_t *guest_ptr, *server_ptr;
1fc62412 3095
80e0c8c3 3096 struct timeval tv = { 0, 0 };
999342a0 3097
80e0c8c3
CC		 3098 if (!vd->non_adaptive) {
3099 gettimeofday(&tv, NULL);
3100 has_dirty = vnc_update_stats(vd, &tv);
3101 }
999342a0 3102
6c08964b
WJ		 3103 offset = find_next_bit((unsigned long *) &vd->guest.dirty,
3104 height * VNC_DIRTY_BPL(&vd->guest), 0);
3105 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
3106 /* no dirty bits in guest surface */
3107 return has_dirty;
3108 }
3109
1fc62412
SS		 3110 /*
3111 * Walk through the guest dirty map.
3112 * Check and copy modified bits from guest to server surface.
3113 * Update server dirty map.
3114 */
bea60dd7 3115 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
eb8934b0
GH		 3116 server_stride = guest_stride = guest_ll =
3117 pixman_image_get_stride(vd->server);
bea60dd7
PL		 3118 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
3119 server_stride);
9f64916d
GH		 3120 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
3121 int width = pixman_image_get_width(vd->server);
3122 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
12b316d4 3123 } else {
eb8934b0
GH		 3124 int guest_bpp =
3125 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
12b316d4
PL		 3126 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
3127 guest_stride = pixman_image_get_stride(vd->guest.fb);
949ed4c2
PMD		 3128 guest_ll = pixman_image_get_width(vd->guest.fb)
3129 * DIV_ROUND_UP(guest_bpp, 8);
12b316d4 3130 }
eb8934b0 3131 line_bytes = MIN(server_stride, guest_ll);
12b316d4 3132
12b316d4 3133 for (;;) {
12b316d4
PL		 3134 y = offset / VNC_DIRTY_BPL(&vd->guest);
3135 x = offset % VNC_DIRTY_BPL(&vd->guest);
1fc62412 3136
12b316d4
PL		 3137 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
3138
3139 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
3140 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
3141 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
3142 } else {
3143 guest_ptr = guest_row0 + y * guest_stride;
3144 }
3145 guest_ptr += x * cmp_bytes;
3146
3147 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
3148 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
bea60dd7 3149 int _cmp_bytes = cmp_bytes;
12b316d4
PL		 3150 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
3151 continue;
3152 }
eb8934b0
GH		 3153 if ((x + 1) * cmp_bytes > line_bytes) {
3154 _cmp_bytes = line_bytes - x * cmp_bytes;
bea60dd7 3155 }
eb8934b0 3156 assert(_cmp_bytes >= 0);
bea60dd7 3157 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
12b316d4
PL		 3158 continue;
3159 }
bea60dd7 3160 memcpy(server_ptr, guest_ptr, _cmp_bytes);
12b316d4
PL		 3161 if (!vd->non_adaptive) {
3162 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
3163 y, &tv);
1fc62412 3164 }
12b316d4
PL		 3165 QTAILQ_FOREACH(vs, &vd->clients, next) {
3166 set_bit(x, vs->dirty[y]);
3167 }
3168 has_dirty++;
1fc62412 3169 }
12b316d4
PL		 3170
3171 y++;
6c08964b
WJ		 3172 offset = find_next_bit((unsigned long *) &vd->guest.dirty,
3173 height * VNC_DIRTY_BPL(&vd->guest),
3174 y * VNC_DIRTY_BPL(&vd->guest));
3175 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
3176 /* no more dirty bits */
3177 break;
3178 }
1fc62412 3179 }
9f64916d 3180 qemu_pixman_image_unref(tmpbuf);
1fc62412
SS		 3181 return has_dirty;
3182}
3183
0f7b2864 3184static void vnc_refresh(DisplayChangeListener *dcl)
703bc68f 3185{
0f7b2864 3186 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
41b4bef6
AS		 3187 VncState *vs, *vn;
3188 int has_dirty, rects = 0;
703bc68f 3189
9d6b2070
C		 3190 if (QTAILQ_EMPTY(&vd->clients)) {
3191 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3192 return;
3193 }
3194
1d0d59fe 3195 graphic_hw_update(vd->dcl.con);
703bc68f 3196
bd023f95 3197 if (vnc_trylock_display(vd)) {
0f7b2864 3198 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
bd023f95
CC		 3199 return;
3200 }
3201
1fc62412 3202 has_dirty = vnc_refresh_server_surface(vd);
bd023f95 3203 vnc_unlock_display(vd);
1fc62412 3204
41b4bef6 3205 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
6af998db 3206 rects += vnc_update_client(vs, has_dirty);
6185c578 3207 /* vs might be free()ed here */
703bc68f 3208 }
bd023f95 3209
2430ffe4 3210 if (has_dirty && rects) {
0f7b2864
GH		 3211 vd->dcl.update_interval /= 2;
3212 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3213 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3214 }
2430ffe4 3215 } else {
0f7b2864
GH		 3216 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3217 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3218 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3219 }
703bc68f
SS		 3220 }
3221}
3222
04d2529d 3223static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
2c8cf549 3224 bool skipauth, bool websocket)
3aa3eea3 3225{
fedf0d35 3226 VncState *vs = g_new0(VncState, 1);
90cd03a3 3227 bool first_client = QTAILQ_EMPTY(&vd->clients);
7d964c9d
CC		 3228 int i;
3229
ad6374c4 3230 trace_vnc_client_connect(vs, sioc);
6bf21f3d
LQ		 3231 vs->zrle = g_new0(VncZrle, 1);
3232 vs->tight = g_new0(VncTight, 1);
f31f9c10 3233 vs->magic = VNC_MAGIC;
04d2529d
DB		 3234 vs->sioc = sioc;
3235 object_ref(OBJECT(vs->sioc));
3236 vs->ioc = QIO_CHANNEL(sioc);
3237 object_ref(OBJECT(vs->ioc));
d616ccc5 3238 vs->vd = vd;
7e7e2ebc 3239
04d2529d
DB		 3240 buffer_init(&vs->input, "vnc-input/%p", sioc);
3241 buffer_init(&vs->output, "vnc-output/%p", sioc);
04d2529d 3242 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
543b9580 3243
6bf21f3d
LQ		 3244 buffer_init(&vs->tight->tight, "vnc-tight/%p", sioc);
3245 buffer_init(&vs->tight->zlib, "vnc-tight-zlib/%p", sioc);
3246 buffer_init(&vs->tight->gradient, "vnc-tight-gradient/%p", sioc);
543b9580 3247#ifdef CONFIG_VNC_JPEG
6bf21f3d 3248 buffer_init(&vs->tight->jpeg, "vnc-tight-jpeg/%p", sioc);
543b9580 3249#endif
95f8510e 3250#ifdef CONFIG_PNG
6bf21f3d 3251 buffer_init(&vs->tight->png, "vnc-tight-png/%p", sioc);
543b9580 3252#endif
04d2529d 3253 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
6bf21f3d
LQ		 3254 buffer_init(&vs->zrle->zrle, "vnc-zrle/%p", sioc);
3255 buffer_init(&vs->zrle->fb, "vnc-zrle-fb/%p", sioc);
3256 buffer_init(&vs->zrle->zlib, "vnc-zrle-zlib/%p", sioc);
543b9580 3257
7e7e2ebc 3258 if (skipauth) {
7d37435b
PB		 3259 vs->auth = VNC_AUTH_NONE;
3260 vs->subauth = VNC_AUTH_INVALID;
7e7e2ebc 3261 } else {
f9148c8a
DB		 3262 if (websocket) {
3263 vs->auth = vd->ws_auth;
3264 vs->subauth = VNC_AUTH_INVALID;
3265 } else {
3266 vs->auth = vd->auth;
3267 vs->subauth = vd->subauth;
3268 }
7e7e2ebc 3269 }
04d2529d
DB		 3270 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3271 sioc, websocket, vs->auth, vs->subauth);
7e7e2ebc 3272
7267c094 3273 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
7d964c9d 3274 for (i = 0; i < VNC_STAT_ROWS; ++i) {
fedf0d35 3275 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
7d964c9d 3276 }
753b4053 3277
04d2529d 3278 VNC_DEBUG("New client on socket %p\n", vs->sioc);
0f7b2864 3279 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
04d2529d 3280 qio_channel_set_blocking(vs->ioc, false, NULL);
a75d6f07
BC		 3281 if (vs->ioc_tag) {
3282 g_source_remove(vs->ioc_tag);
3283 }
7536ee4b
TH		 3284 if (websocket) {
3285 vs->websocket = 1;
38e5756a 3286 if (vd->tlscreds) {
04d2529d 3287 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 3288 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
3289 vncws_tls_handshake_io, vs, NULL);
3e305e4a 3290 } else {
04d2529d 3291 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 3292 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
3293 vncws_handshake_io, vs, NULL);
0057a0d5 3294 }
04d2529d
DB		 3295 } else {
3296 vs->ioc_tag = qio_channel_add_watch(
2ddafce7
DH		 3297 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
3298 vnc_client_io, vs, NULL);
7536ee4b 3299 }
753b4053 3300
4a80dba3 3301 vnc_client_cache_addr(vs);
fb6ba0d5 3302 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
8cf36489 3303 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
4a80dba3 3304
753b4053
AL		 3305 vs->last_x = -1;
3306 vs->last_y = -1;
3307
3308 vs->as.freq = 44100;
3309 vs->as.nchannels = 2;
85bc5852 3310 vs->as.fmt = AUDIO_FORMAT_S16;
753b4053
AL		 3311 vs->as.endianness = 0;
3312
bd023f95 3313 qemu_mutex_init(&vs->output_mutex);
175b2a6e 3314 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
bd023f95 3315
e5f34cdd 3316 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
c7628bff
GH		 3317 if (first_client) {
3318 vnc_update_server_surface(vd);
3319 }
1fc62412 3320
1d0d59fe 3321 graphic_hw_update(vd->dcl.con);
1fc62412 3322
90cd03a3 3323 if (!vs->websocket) {
dbee9897 3324 vnc_start_protocol(vs);
90cd03a3
DB		 3325 }
3326
3327 if (vd->num_connecting > vd->connections_limit) {
3328 QTAILQ_FOREACH(vs, &vd->clients, next) {
3329 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3330 vnc_disconnect_start(vs);
3331 return;
3332 }
3333 }
3334 }
3335}
3336
dbee9897 3337void vnc_start_protocol(VncState *vs)
90cd03a3 3338{
3aa3eea3
AZ		 3339 vnc_write(vs, "RFB 003.008\n", 12);
3340 vnc_flush(vs);
3341 vnc_read_when(vs, protocol_version, 12);
753b4053 3342
37c34d9d
AL		 3343 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3344 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3aa3eea3
AZ		 3345}
3346
13e1d0e7
DB		 3347static void vnc_listen_io(QIONetListener *listener,
3348 QIOChannelSocket *cioc,
3349 void *opaque)
24236869 3350{
bf01c179 3351 VncDisplay *vd = opaque;
13e1d0e7 3352 bool isWebsock = listener == vd->wslistener;
7536ee4b 3353
13e1d0e7
DB		 3354 qio_channel_set_name(QIO_CHANNEL(cioc),
3355 isWebsock ? "vnc-ws-server" : "vnc-server");
3356 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3357 vnc_connect(vd, cioc, false, isWebsock);
7536ee4b 3358}
7536ee4b 3359
7c20b4a3 3360static const DisplayChangeListenerOps dcl_ops = {
34da30af
BH		 3361 .dpy_name = "vnc",
3362 .dpy_refresh = vnc_refresh,
34da30af
BH		 3363 .dpy_gfx_update = vnc_dpy_update,
3364 .dpy_gfx_switch = vnc_dpy_switch,
3365 .dpy_gfx_check_format = qemu_pixman_check_format,
3366 .dpy_mouse_set = vnc_mouse_set,
3367 .dpy_cursor_define = vnc_dpy_cursor_define,
7c20b4a3
GH		 3368};
3369
ab4f931e 3370void vnc_display_init(const char *id, Error **errp)
24236869 3371{
bf01c179 3372 VncDisplay *vd;
4db14629
GH		 3373
3374 if (vnc_display_find(id) != NULL) {
3375 return;
3376 }
bf01c179 3377 vd = g_malloc0(sizeof(*vd));
24236869 3378
bf01c179
DB		 3379 vd->id = strdup(id);
3380 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
24236869 3381
bf01c179
DB		 3382 QTAILQ_INIT(&vd->clients);
3383 vd->expires = TIME_MAX;
24236869 3384
40066175
GH		 3385 if (keyboard_layout) {
3386 trace_vnc_key_map_init(keyboard_layout);
ab4f931e
FL		 3387 vd->kbd_layout = init_keyboard_layout(name2keysym,
3388 keyboard_layout, errp);
40066175 3389 } else {
ab4f931e 3390 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us", errp);
40066175 3391 }
24236869 3392
bf01c179 3393 if (!vd->kbd_layout) {
ab4f931e 3394 return;
bf01c179 3395 }
24236869 3396
bf01c179
DB		 3397 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3398 vd->connections_limit = 32;
12e29b16 3399
bf01c179 3400 qemu_mutex_init(&vd->mutex);
bd023f95 3401 vnc_start_worker_thread();
bd023f95 3402
bf01c179
DB		 3403 vd->dcl.ops = &dcl_ops;
3404 register_displaychangelistener(&vd->dcl);
c2f2ba49 3405 vd->kbd = qkbd_state_init(vd->dcl.con);
71cab5ca
TS		 3406}
3407
6f43024c 3408
bf01c179 3409static void vnc_display_close(VncDisplay *vd)
71cab5ca 3410{
bf01c179 3411 if (!vd) {
452b4d88 3412 return;
bf01c179
DB		 3413 }
3414 vd->is_unix = false;
13e1d0e7
DB		 3415
3416 if (vd->listener) {
3417 qio_net_listener_disconnect(vd->listener);
3418 object_unref(OBJECT(vd->listener));
71cab5ca 3419 }
13e1d0e7 3420 vd->listener = NULL;
4ee74fa7 3421
13e1d0e7
DB		 3422 if (vd->wslistener) {
3423 qio_net_listener_disconnect(vd->wslistener);
3424 object_unref(OBJECT(vd->wslistener));
7536ee4b 3425 }
13e1d0e7 3426 vd->wslistener = NULL;
4ee74fa7 3427
bf01c179
DB		 3428 vd->auth = VNC_AUTH_INVALID;
3429 vd->subauth = VNC_AUTH_INVALID;
3430 if (vd->tlscreds) {
521534df 3431 object_unref(OBJECT(vd->tlscreds));
bf01c179 3432 vd->tlscreds = NULL;
3e305e4a 3433 }
b76806d4
DB		 3434 if (vd->tlsauthz) {
3435 object_unparent(OBJECT(vd->tlsauthz));
3436 vd->tlsauthz = NULL;
3437 }
3438 g_free(vd->tlsauthzid);
3439 vd->tlsauthzid = NULL;
a54f0d2b
PO		 3440 if (vd->lock_key_sync) {
3441 qemu_remove_led_event_handler(vd->led);
2dc120be 3442 vd->led = NULL;
a54f0d2b 3443 }
b76806d4
DB		 3444#ifdef CONFIG_VNC_SASL
3445 if (vd->sasl.authz) {
3446 object_unparent(OBJECT(vd->sasl.authz));
3447 vd->sasl.authz = NULL;
3448 }
3449 g_free(vd->sasl.authzid);
3450 vd->sasl.authzid = NULL;
3451#endif
70848515
TS		 3452}
3453
14f7143e 3454int vnc_display_password(const char *id, const char *password)
70848515 3455{
bf01c179 3456 VncDisplay *vd = vnc_display_find(id);
70848515 3457
bf01c179 3458 if (!vd) {
a6aa9d3e 3459 return -EINVAL;
7ef92331 3460 }
bf01c179 3461 if (vd->auth == VNC_AUTH_NONE) {
cf864569 3462 error_printf_unless_qmp("If you want use passwords please enable "
7ea7d36e 3463 "password auth using '-vnc ${dpy},password'.\n");
cf864569 3464 return -EINVAL;
1cd20f8b
AL		 3465 }
3466
bf01c179
DB		 3467 g_free(vd->password);
3468 vd->password = g_strdup(password);
a6aa9d3e
LC		 3469
3470 return 0;
71cab5ca
TS		 3471}
3472
14f7143e 3473int vnc_display_pw_expire(const char *id, time_t expires)
3c9405a0 3474{
bf01c179 3475 VncDisplay *vd = vnc_display_find(id);
3c9405a0 3476
bf01c179 3477 if (!vd) {
1643f2b2
GH		 3478 return -EINVAL;
3479 }
3480
bf01c179 3481 vd->expires = expires;
3c9405a0
GH		 3482 return 0;
3483}
3484
bf01c179 3485static void vnc_display_print_local_addr(VncDisplay *vd)
f92f8afe 3486{
bd269ebc 3487 SocketAddress *addr;
d616ccc5 3488
13e1d0e7 3489 if (!vd->listener || !vd->listener->nsioc) {
4ee74fa7
DB		 3490 return;
3491 }
3492
b94b3c02 3493 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], NULL);
04d2529d 3494 if (!addr) {
33df7bf3 3495 return;
04d2529d
DB		 3496 }
3497
bd269ebc
MA		 3498 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3499 qapi_free_SocketAddress(addr);
33df7bf3 3500 return;
04d2529d 3501 }
33df7bf3 3502 error_printf_unless_qmp("VNC server running on %s:%s\n",
bd269ebc
MA		 3503 addr->u.inet.host,
3504 addr->u.inet.port);
3505 qapi_free_SocketAddress(addr);
f92f8afe
AL		 3506}
3507
4db14629
GH		 3508static QemuOptsList qemu_vnc_opts = {
3509 .name = "vnc",
3510 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3511 .implied_opt_name = "vnc",
3512 .desc = {
3513 {
3514 .name = "vnc",
3515 .type = QEMU_OPT_STRING,
3516 },{
3517 .name = "websocket",
3518 .type = QEMU_OPT_STRING,
3519 },{
3e305e4a
DB		 3520 .name = "tls-creds",
3521 .type = QEMU_OPT_STRING,
4db14629
GH		 3522 },{
3523 .name = "share",
3524 .type = QEMU_OPT_STRING,
1d0d59fe
GH		 3525 },{
3526 .name = "display",
3527 .type = QEMU_OPT_STRING,
3528 },{
3529 .name = "head",
3530 .type = QEMU_OPT_NUMBER,
e5f34cdd
GH		 3531 },{
3532 .name = "connections",
3533 .type = QEMU_OPT_NUMBER,
88428b7a
GA		 3534 },{
3535 .name = "to",
3536 .type = QEMU_OPT_NUMBER,
3537 },{
3538 .name = "ipv4",
3539 .type = QEMU_OPT_BOOL,
3540 },{
3541 .name = "ipv6",
3542 .type = QEMU_OPT_BOOL,
4db14629
GH		 3543 },{
3544 .name = "password",
3545 .type = QEMU_OPT_BOOL,
6c6840e9
DB		 3546 },{
3547 .name = "password-secret",
3548 .type = QEMU_OPT_STRING,
4db14629
GH		 3549 },{
3550 .name = "reverse",
3551 .type = QEMU_OPT_BOOL,
3552 },{
3553 .name = "lock-key-sync",
3554 .type = QEMU_OPT_BOOL,
c5ce8333
GH		 3555 },{
3556 .name = "key-delay-ms",
3557 .type = QEMU_OPT_NUMBER,
4db14629
GH		 3558 },{
3559 .name = "sasl",
3560 .type = QEMU_OPT_BOOL,
55cf09a0
DB		 3561 },{
3562 .name = "tls-authz",
3563 .type = QEMU_OPT_STRING,
3564 },{
3565 .name = "sasl-authz",
3566 .type = QEMU_OPT_STRING,
4db14629
GH		 3567 },{
3568 .name = "lossy",
3569 .type = QEMU_OPT_BOOL,
3570 },{
3571 .name = "non-adaptive",
3572 .type = QEMU_OPT_BOOL,
f0b9f36d
KZ		 3573 },{
3574 .name = "audiodev",
3575 .type = QEMU_OPT_STRING,
7b5fa0b5
DB		 3576 },{
3577 .name = "power-control",
3578 .type = QEMU_OPT_BOOL,
4db14629
GH		 3579 },
3580 { /* end of list */ }
3581 },
3582};
3583
0dd72e15 3584
3e305e4a 3585static int
eda24e18
DB		 3586vnc_display_setup_auth(int *auth,
3587 int *subauth,
3588 QCryptoTLSCreds *tlscreds,
0dd72e15
DB		 3589 bool password,
3590 bool sasl,
3e305e4a
DB		 3591 bool websocket,
3592 Error **errp)
0dd72e15
DB		 3593{
3594 /*
3595 * We have a choice of 3 authentication options
3596 *
3597 * 1. none
3598 * 2. vnc
3599 * 3. sasl
3600 *
3601 * The channel can be run in 2 modes
3602 *
3603 * 1. clear
3604 * 2. tls
3605 *
3606 * And TLS can use 2 types of credentials
3607 *
3608 * 1. anon
3609 * 2. x509
3610 *
3611 * We thus have 9 possible logical combinations
3612 *
3613 * 1. clear + none
3614 * 2. clear + vnc
3615 * 3. clear + sasl
3616 * 4. tls + anon + none
3617 * 5. tls + anon + vnc
3618 * 6. tls + anon + sasl
3619 * 7. tls + x509 + none
3620 * 8. tls + x509 + vnc
3621 * 9. tls + x509 + sasl
3622 *
3623 * These need to be mapped into the VNC auth schemes
3624 * in an appropriate manner. In regular VNC, all the
3625 * TLS options get mapped into VNC_AUTH_VENCRYPT
3626 * sub-auth types.
f9148c8a
DB		 3627 *
3628 * In websockets, the https:// protocol already provides
3629 * TLS support, so there is no need to make use of the
3630 * VeNCrypt extension. Furthermore, websockets browser
3631 * clients could not use VeNCrypt even if they wanted to,
3632 * as they cannot control when the TLS handshake takes
3633 * place. Thus there is no option but to rely on https://,
3634 * meaning combinations 4->6 and 7->9 will be mapped to
3635 * VNC auth schemes in the same way as combos 1->3.
3636 *
3637 * Regardless of fact that we have a different mapping to
3638 * VNC auth mechs for plain VNC vs websockets VNC, the end
3639 * result has the same security characteristics.
0dd72e15 3640 */
eda24e18
DB		 3641 if (websocket || !tlscreds) {
3642 if (password) {
0dd72e15 3643 VNC_DEBUG("Initializing VNC server with password auth\n");
eda24e18
DB		 3644 *auth = VNC_AUTH_VNC;
3645 } else if (sasl) {
3646 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3647 *auth = VNC_AUTH_SASL;
f9148c8a 3648 } else {
eda24e18
DB		 3649 VNC_DEBUG("Initializing VNC server with no auth\n");
3650 *auth = VNC_AUTH_NONE;
f9148c8a 3651 }
eda24e18
DB		 3652 *subauth = VNC_AUTH_INVALID;
3653 } else {
3654 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3655 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3656 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3657 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3658
3659 if (!is_x509 && !is_anon) {
3660 error_setg(errp,
3661 "Unsupported TLS cred type %s",
3662 object_get_typename(OBJECT(tlscreds)));
3663 return -1;
3664 }
3665 *auth = VNC_AUTH_VENCRYPT;
3666 if (password) {
3667 if (is_x509) {
3668 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3669 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3670 } else {
3671 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3672 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3673 }
3674
3675 } else if (sasl) {
3676 if (is_x509) {
0dd72e15 3677 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
eda24e18 3678 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3e305e4a 3679 } else {
eda24e18
DB		 3680 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3681 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
0dd72e15
DB		 3682 }
3683 } else {
eda24e18 3684 if (is_x509) {
0dd72e15 3685 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
eda24e18 3686 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3e305e4a 3687 } else {
eda24e18
DB		 3688 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3689 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
0dd72e15 3690 }
f9148c8a 3691 }
0dd72e15 3692 }
3e305e4a
DB		 3693 return 0;
3694}
3695
3696
275e0d61
DB		 3697static int vnc_display_get_address(const char *addrstr,
3698 bool websocket,
e5766eb4 3699 bool reverse,
275e0d61
DB		 3700 int displaynum,
3701 int to,
3702 bool has_ipv4,
3703 bool has_ipv6,
3704 bool ipv4,
3705 bool ipv6,
bd269ebc 3706 SocketAddress **retaddr,
275e0d61
DB		 3707 Error **errp)
3708{
3709 int ret = -1;
bd269ebc 3710 SocketAddress *addr = NULL;
275e0d61 3711
bd269ebc 3712 addr = g_new0(SocketAddress, 1);
275e0d61
DB		 3713
3714 if (strncmp(addrstr, "unix:", 5) == 0) {
bd269ebc
MA		 3715 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3716 addr->u.q_unix.path = g_strdup(addrstr + 5);
275e0d61
DB		 3717
3718 if (websocket) {
3719 error_setg(errp, "UNIX sockets not supported with websock");
3720 goto cleanup;
3721 }
3722
3723 if (to) {
3724 error_setg(errp, "Port range not support with UNIX socket");
3725 goto cleanup;
3726 }
3727 ret = 0;
3728 } else {
3729 const char *port;
3730 size_t hostlen;
3731 unsigned long long baseport = 0;
3732 InetSocketAddress *inet;
3733
3734 port = strrchr(addrstr, ':');
3735 if (!port) {
3736 if (websocket) {
3737 hostlen = 0;
3738 port = addrstr;
3739 } else {
3740 error_setg(errp, "no vnc port specified");
3741 goto cleanup;
3742 }
3743 } else {
3744 hostlen = port - addrstr;
3745 port++;
3746 if (*port == '\0') {
3747 error_setg(errp, "vnc port cannot be empty");
3748 goto cleanup;
3749 }
3750 }
3751
bd269ebc
MA		 3752 addr->type = SOCKET_ADDRESS_TYPE_INET;
3753 inet = &addr->u.inet;
3f9c41c5 3754 if (hostlen && addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
275e0d61
DB		 3755 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3756 } else {
3757 inet->host = g_strndup(addrstr, hostlen);
3758 }
3759 /* plain VNC port is just an offset, for websocket
3760 * port is absolute */
3761 if (websocket) {
3762 if (g_str_equal(addrstr, "") ||
3763 g_str_equal(addrstr, "on")) {
396f935a
DB		 3764 if (displaynum == -1) {
3765 error_setg(errp, "explicit websocket port is required");
3766 goto cleanup;
3767 }
275e0d61
DB		 3768 inet->port = g_strdup_printf(
3769 "%d", displaynum + 5700);
3770 if (to) {
3771 inet->has_to = true;
3772 inet->to = to + 5700;
3773 }
3774 } else {
3775 inet->port = g_strdup(port);
3776 }
3777 } else {
e5766eb4 3778 int offset = reverse ? 0 : 5900;
275e0d61
DB		 3779 if (parse_uint_full(port, &baseport, 10) < 0) {
3780 error_setg(errp, "can't convert to a number: %s", port);
3781 goto cleanup;
3782 }
3783 if (baseport > 65535 ||
e5766eb4 3784 baseport + offset > 65535) {
275e0d61
DB		 3785 error_setg(errp, "port %s out of range", port);
3786 goto cleanup;
3787 }
3788 inet->port = g_strdup_printf(
e5766eb4 3789 "%d", (int)baseport + offset);
275e0d61
DB		 3790
3791 if (to) {
3792 inet->has_to = true;
e5766eb4 3793 inet->to = to + offset;
275e0d61
DB		 3794 }
3795 }
3796
3797 inet->ipv4 = ipv4;
3798 inet->has_ipv4 = has_ipv4;
3799 inet->ipv6 = ipv6;
3800 inet->has_ipv6 = has_ipv6;
3801
3802 ret = baseport;
3803 }
3804
3805 *retaddr = addr;
3806
3807 cleanup:
3808 if (ret < 0) {
bd269ebc 3809 qapi_free_SocketAddress(addr);
275e0d61
DB		 3810 }
3811 return ret;
3812}
3813
3814static int vnc_display_get_addresses(QemuOpts *opts,
e5766eb4 3815 bool reverse,
d708f99d
VSO		 3816 SocketAddressList **saddr_list_ret,
3817 SocketAddressList **wsaddr_list_ret,
275e0d61
DB		 3818 Error **errp)
3819{
bd269ebc
MA		 3820 SocketAddress *saddr = NULL;
3821 SocketAddress *wsaddr = NULL;
d708f99d
VSO		 3822 g_autoptr(SocketAddressList) saddr_list = NULL;
3823 SocketAddressList **saddr_tail = &saddr_list;
3824 SocketAddress *single_saddr = NULL;
3825 g_autoptr(SocketAddressList) wsaddr_list = NULL;
3826 SocketAddressList **wsaddr_tail = &wsaddr_list;
396f935a
DB		 3827 QemuOptsIter addriter;
3828 const char *addr;
275e0d61
DB		 3829 int to = qemu_opt_get_number(opts, "to", 0);
3830 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3831 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3832 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3833 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
396f935a 3834 int displaynum = -1;
275e0d61 3835
396f935a
DB		 3836 addr = qemu_opt_get(opts, "vnc");
3837 if (addr == NULL || g_str_equal(addr, "none")) {
d708f99d 3838 return 0;
396f935a
DB		 3839 }
3840 if (qemu_opt_get(opts, "websocket") &&
275e0d61
DB		 3841 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3842 error_setg(errp,
3843 "SHA1 hash support is required for websockets");
d708f99d 3844 return -1;
396f935a
DB		 3845 }
3846
3847 qemu_opt_iter_init(&addriter, opts, "vnc");
3848 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3849 int rv;
e5766eb4 3850 rv = vnc_display_get_address(addr, false, reverse, 0, to,
396f935a
DB		 3851 has_ipv4, has_ipv6,
3852 ipv4, ipv6,
3853 &saddr, errp);
3854 if (rv < 0) {
d708f99d 3855 return -1;
396f935a
DB		 3856 }
3857 /* Historical compat - first listen address can be used
3858 * to set the default websocket port
3859 */
3860 if (displaynum == -1) {
3861 displaynum = rv;
3862 }
d708f99d 3863 QAPI_LIST_APPEND(saddr_tail, saddr);
275e0d61
DB		 3864 }
3865
d708f99d
VSO		 3866 if (saddr_list && !saddr_list->next) {
3867 single_saddr = saddr_list->value;
3868 } else {
3869 /*
3870 * If we had multiple primary displays, we don't do defaults
3871 * for websocket, and require explicit config instead.
3872 */
396f935a 3873 displaynum = -1;
275e0d61 3874 }
396f935a
DB		 3875
3876 qemu_opt_iter_init(&addriter, opts, "websocket");
3877 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
e5766eb4 3878 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
275e0d61
DB		 3879 has_ipv4, has_ipv6,
3880 ipv4, ipv6,
3881 &wsaddr, errp) < 0) {
d708f99d 3882 return -1;
275e0d61 3883 }
396f935a
DB		 3884
3885 /* Historical compat - if only a single listen address was
3886 * provided, then this is used to set the default listen
3887 * address for websocket too
3888 */
d708f99d
VSO		 3889 if (single_saddr &&
3890 single_saddr->type == SOCKET_ADDRESS_TYPE_INET &&
bd269ebc
MA		 3891 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3892 g_str_equal(wsaddr->u.inet.host, "") &&
d708f99d 3893 !g_str_equal(single_saddr->u.inet.host, "")) {
bd269ebc 3894 g_free(wsaddr->u.inet.host);
d708f99d 3895 wsaddr->u.inet.host = g_strdup(single_saddr->u.inet.host);
275e0d61 3896 }
396f935a 3897
d708f99d 3898 QAPI_LIST_APPEND(wsaddr_tail, wsaddr);
275e0d61 3899 }
275e0d61 3900
d708f99d
VSO		 3901 *saddr_list_ret = g_steal_pointer(&saddr_list);
3902 *wsaddr_list_ret = g_steal_pointer(&wsaddr_list);
3903 return 0;
275e0d61
DB		 3904}
3905
8bd22f47 3906static int vnc_display_connect(VncDisplay *vd,
d708f99d
VSO		 3907 SocketAddressList *saddr_list,
3908 SocketAddressList *wsaddr_list,
8bd22f47
DB		 3909 Error **errp)
3910{
3911 /* connect to viewer */
3912 QIOChannelSocket *sioc = NULL;
d708f99d 3913 if (wsaddr_list) {
8bd22f47
DB		 3914 error_setg(errp, "Cannot use websockets in reverse mode");
3915 return -1;
3916 }
d708f99d 3917 if (!saddr_list || saddr_list->next) {
396f935a
DB		 3918 error_setg(errp, "Expected a single address in reverse mode");
3919 return -1;
3920 }
bd269ebc 3921 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
d708f99d 3922 vd->is_unix = saddr_list->value->type == SOCKET_ADDRESS_TYPE_UNIX;
8bd22f47
DB		 3923 sioc = qio_channel_socket_new();
3924 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
d708f99d 3925 if (qio_channel_socket_connect_sync(sioc, saddr_list->value, errp) < 0) {
5f8679fe 3926 object_unref(OBJECT(sioc));
8bd22f47
DB		 3927 return -1;
3928 }
3929 vnc_connect(vd, sioc, false, false);
3930 object_unref(OBJECT(sioc));
3931 return 0;
3932}
3933
3934
8bd22f47 3935static int vnc_display_listen(VncDisplay *vd,
d708f99d
VSO		 3936 SocketAddressList *saddr_list,
3937 SocketAddressList *wsaddr_list,
8bd22f47
DB		 3938 Error **errp)
3939{
d708f99d 3940 SocketAddressList *el;
8bd22f47 3941
d708f99d 3942 if (saddr_list) {
13e1d0e7
DB		 3943 vd->listener = qio_net_listener_new();
3944 qio_net_listener_set_name(vd->listener, "vnc-listen");
d708f99d 3945 for (el = saddr_list; el; el = el->next) {
13e1d0e7 3946 if (qio_net_listener_open_sync(vd->listener,
d708f99d 3947 el->value, 1,
13e1d0e7
DB		 3948 errp) < 0) {
3949 return -1;
3950 }
396f935a 3951 }
13e1d0e7
DB		 3952
3953 qio_net_listener_set_client_func(vd->listener,
3954 vnc_listen_io, vd, NULL);
8bd22f47 3955 }
13e1d0e7 3956
d708f99d 3957 if (wsaddr_list) {
13e1d0e7
DB		 3958 vd->wslistener = qio_net_listener_new();
3959 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
d708f99d 3960 for (el = wsaddr_list; el; el = el->next) {
13e1d0e7 3961 if (qio_net_listener_open_sync(vd->wslistener,
d708f99d 3962 el->value, 1,
13e1d0e7
DB		 3963 errp) < 0) {
3964 return -1;
3965 }
396f935a 3966 }
13e1d0e7
DB		 3967
3968 qio_net_listener_set_client_func(vd->wslistener,
3969 vnc_listen_io, vd, NULL);
8bd22f47
DB		 3970 }
3971
3972 return 0;
3973}
3974
abea1946
VSO		 3975bool vnc_display_update(DisplayUpdateOptionsVNC *arg, Error **errp)
3976{
3977 VncDisplay *vd = vnc_display_find(NULL);
3978
3979 if (!vd) {
3980 error_setg(errp, "Can not find vnc display");
3981 return false;
3982 }
3983
3984 if (arg->has_addresses) {
3985 if (vd->listener) {
3986 qio_net_listener_disconnect(vd->listener);
3987 object_unref(OBJECT(vd->listener));
3988 vd->listener = NULL;
3989 }
3990
3991 if (vnc_display_listen(vd, arg->addresses, NULL, errp) < 0) {
3992 return false;
3993 }
3994 }
3995
3996 return true;
3997}
8bd22f47 3998
4db14629 3999void vnc_display_open(const char *id, Error **errp)
71cab5ca 4000{
bf01c179 4001 VncDisplay *vd = vnc_display_find(id);
4db14629 4002 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
d708f99d
VSO		 4003 g_autoptr(SocketAddressList) saddr_list = NULL;
4004 g_autoptr(SocketAddressList) wsaddr_list = NULL;
e2a11d9d 4005 const char *share, *device_id;
1d0d59fe 4006 QemuConsole *con;
a2c72de0
GA		 4007 bool password = false;
4008 bool reverse = false;
3e305e4a 4009 const char *credid;
a2c72de0 4010 bool sasl = false;
55cf09a0
DB		 4011 const char *tlsauthz;
4012 const char *saslauthz;
3a0558b5 4013 int lock_key_sync = 1;
c5ce8333 4014 int key_delay_ms;
f0b9f36d 4015 const char *audiodev;
6c6840e9 4016 const char *passwordSecret;
71cab5ca 4017
bf01c179 4018 if (!vd) {
2d55f0e8
PB		 4019 error_setg(errp, "VNC display not active");
4020 return;
4021 }
bf01c179 4022 vnc_display_close(vd);
24236869 4023
4db14629
GH		 4024 if (!opts) {
4025 return;
4026 }
274c3b52 4027
e5766eb4 4028 reverse = qemu_opt_get_bool(opts, "reverse", false);
d708f99d
VSO		 4029 if (vnc_display_get_addresses(opts, reverse, &saddr_list, &wsaddr_list,
4030 errp) < 0) {
e5560329 4031 goto fail;
e2a11d9d 4032 }
e5560329 4033
6c6840e9
DB		 4034
4035 passwordSecret = qemu_opt_get(opts, "password-secret");
4036 if (passwordSecret) {
4037 if (qemu_opt_get(opts, "password")) {
4038 error_setg(errp,
4039 "'password' flag is redundant with 'password-secret'");
4040 goto fail;
4041 }
4042 vd->password = qcrypto_secret_lookup_as_utf8(passwordSecret,
4043 errp);
4044 if (!vd->password) {
4045 goto fail;
4046 }
4047 password = true;
4048 } else {
4049 password = qemu_opt_get_bool(opts, "password", false);
4050 }
800567a6 4051 if (password) {
800567a6 4052 if (!qcrypto_cipher_supports(
83bee4b5 4053 QCRYPTO_CIPHER_ALG_DES, QCRYPTO_CIPHER_MODE_ECB)) {
800567a6 4054 error_setg(errp,
83bee4b5 4055 "Cipher backend does not support DES algorithm");
800567a6
DB		 4056 goto fail;
4057 }
4db14629
GH		 4058 }
4059
4db14629 4060 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
d3b0db6d 4061 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
4db14629 4062 sasl = qemu_opt_get_bool(opts, "sasl", false);
d169f04b
DB		 4063#ifndef CONFIG_VNC_SASL
4064 if (sasl) {
4065 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
4066 goto fail;
4067 }
4068#endif /* CONFIG_VNC_SASL */
3e305e4a
DB		 4069 credid = qemu_opt_get(opts, "tls-creds");
4070 if (credid) {
4071 Object *creds;
3e305e4a
DB		 4072 creds = object_resolve_path_component(
4073 object_get_objects_root(), credid);
4074 if (!creds) {
4075 error_setg(errp, "No TLS credentials with id '%s'",
4076 credid);
4077 goto fail;
4078 }
bf01c179 4079 vd->tlscreds = (QCryptoTLSCreds *)
3e305e4a
DB		 4080 object_dynamic_cast(creds,
4081 TYPE_QCRYPTO_TLS_CREDS);
bf01c179 4082 if (!vd->tlscreds) {
3e305e4a
DB		 4083 error_setg(errp, "Object with id '%s' is not TLS credentials",
4084 credid);
4085 goto fail;
4086 }
bf01c179 4087 object_ref(OBJECT(vd->tlscreds));
3e305e4a 4088
3c52bf0c
PMD		 4089 if (!qcrypto_tls_creds_check_endpoint(vd->tlscreds,
4090 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
4091 errp)) {
3e305e4a
DB		 4092 goto fail;
4093 }
4db14629 4094 }
55cf09a0 4095 tlsauthz = qemu_opt_get(opts, "tls-authz");
55cf09a0
DB		 4096 if (tlsauthz && !vd->tlscreds) {
4097 error_setg(errp, "'tls-authz' provided but TLS is not enabled");
4098 goto fail;
4099 }
4100
4101 saslauthz = qemu_opt_get(opts, "sasl-authz");
55cf09a0
DB		 4102 if (saslauthz && !sasl) {
4103 error_setg(errp, "'sasl-authz' provided but SASL auth is not enabled");
4104 goto fail;
4105 }
4db14629
GH		 4106
4107 share = qemu_opt_get(opts, "share");
4108 if (share) {
4109 if (strcmp(share, "ignore") == 0) {
bf01c179 4110 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
4db14629 4111 } else if (strcmp(share, "allow-exclusive") == 0) {
bf01c179 4112 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4db14629 4113 } else if (strcmp(share, "force-shared") == 0) {
bf01c179 4114 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
4db14629
GH		 4115 } else {
4116 error_setg(errp, "unknown vnc share= option");
4117 goto fail;
4118 }
4119 } else {
bf01c179 4120 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4db14629 4121 }
bf01c179 4122 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
4db14629 4123
4db14629 4124#ifdef CONFIG_VNC_JPEG
bf01c179 4125 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
4db14629 4126#endif
bf01c179 4127 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
e22492d3
PL		 4128 /* adaptive updates are only used with tight encoding and
4129 * if lossy updates are enabled so we can disable all the
4130 * calculations otherwise */
bf01c179
DB		 4131 if (!vd->lossy) {
4132 vd->non_adaptive = true;
e22492d3
PL		 4133 }
4134
7b5fa0b5
DB		 4135 vd->power_control = qemu_opt_get_bool(opts, "power-control", false);
4136
55cf09a0
DB		 4137 if (tlsauthz) {
4138 vd->tlsauthzid = g_strdup(tlsauthz);
2cc45228 4139 }
76655d6d 4140#ifdef CONFIG_VNC_SASL
55cf09a0
DB		 4141 if (sasl) {
4142 if (saslauthz) {
4143 vd->sasl.authzid = g_strdup(saslauthz);
c8496408 4144 }
76655d6d
AL		 4145 }
4146#endif
4147
eda24e18
DB		 4148 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
4149 vd->tlscreds, password,
4150 sasl, false, errp) < 0) {
4151 goto fail;
4152 }
7364dbda 4153 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
eda24e18
DB		 4154
4155 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
4156 vd->tlscreds, password,
4157 sasl, true, errp) < 0) {
3e305e4a
DB		 4158 goto fail;
4159 }
7364dbda 4160 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
24236869 4161
2f9606b3 4162#ifdef CONFIG_VNC_SASL
b65310ab
PB		 4163 if (sasl && !vnc_sasl_server_init(errp)) {
4164 goto fail;
2f9606b3
AL		 4165 }
4166#endif
bf01c179 4167 vd->lock_key_sync = lock_key_sync;
a54f0d2b
PO		 4168 if (lock_key_sync) {
4169 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
4170 }
4171 vd->ledstate = 0;
2f9606b3 4172
f0b9f36d
KZ		 4173 audiodev = qemu_opt_get(opts, "audiodev");
4174 if (audiodev) {
4175 vd->audio_state = audio_state_by_name(audiodev);
4176 if (!vd->audio_state) {
4177 error_setg(errp, "Audiodev '%s' not found", audiodev);
4178 goto fail;
4179 }
4180 }
4181
1d0d59fe
GH		 4182 device_id = qemu_opt_get(opts, "display");
4183 if (device_id) {
1d0d59fe 4184 int head = qemu_opt_get_number(opts, "head", 0);
f2c1d54c 4185 Error *err = NULL;
1d0d59fe 4186
f2c1d54c
GH		 4187 con = qemu_console_lookup_by_device_name(device_id, head, &err);
4188 if (err) {
4189 error_propagate(errp, err);
1d0d59fe
GH		 4190 goto fail;
4191 }
4192 } else {
4193 con = NULL;
4194 }
4195
bf01c179 4196 if (con != vd->dcl.con) {
c2f2ba49 4197 qkbd_state_free(vd->kbd);
bf01c179
DB		 4198 unregister_displaychangelistener(&vd->dcl);
4199 vd->dcl.con = con;
4200 register_displaychangelistener(&vd->dcl);
c2f2ba49 4201 vd->kbd = qkbd_state_init(vd->dcl.con);
1d0d59fe 4202 }
c2f2ba49 4203 qkbd_state_set_delay(vd->kbd, key_delay_ms);
1d0d59fe 4204
d708f99d
VSO		 4205 if (saddr_list == NULL) {
4206 return;
fa03cb7f
MAL		 4207 }
4208
3aa3eea3 4209 if (reverse) {
d708f99d 4210 if (vnc_display_connect(vd, saddr_list, wsaddr_list, errp) < 0) {
007fcd3e
PB		 4211 goto fail;
4212 }
9712ecaf 4213 } else {
d708f99d 4214 if (vnc_display_listen(vd, saddr_list, wsaddr_list, errp) < 0) {
e0d03b8c
DB		 4215 goto fail;
4216 }
24236869 4217 }
e0d03b8c 4218
275e0d61 4219 if (qemu_opt_get(opts, "to")) {
bf01c179 4220 vnc_display_print_local_addr(vd);
33df7bf3
PB		 4221 }
4222
d708f99d 4223 /* Success */
2d55f0e8 4224 return;
1ce52c78
PB		 4225
4226fail:
4ee74fa7 4227 vnc_display_close(vd);
24236869 4228}
13661089 4229
14f7143e 4230void vnc_display_add_client(const char *id, int csock, bool skipauth)
13661089 4231{
bf01c179 4232 VncDisplay *vd = vnc_display_find(id);
04d2529d 4233 QIOChannelSocket *sioc;
13661089 4234
bf01c179 4235 if (!vd) {
d616ccc5
GH		 4236 return;
4237 }
04d2529d
DB		 4238
4239 sioc = qio_channel_socket_new_fd(csock, NULL);
4240 if (sioc) {
10bcfe58 4241 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
bf01c179 4242 vnc_connect(vd, sioc, skipauth, false);
04d2529d
DB		 4243 object_unref(OBJECT(sioc));
4244 }
13661089 4245}
4db14629 4246
9634f4e3 4247static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
2779672f
GA		 4248{
4249 int i = 2;
4250 char *id;
4251
4252 id = g_strdup("default");
4253 while (qemu_opts_find(olist, id)) {
4254 g_free(id);
4255 id = g_strdup_printf("vnc%d", i++);
4256 }
4257 qemu_opts_set_id(opts, id);
4258}
4259
653c9747 4260void vnc_parse(const char *str)
4db14629 4261{
4db14629 4262 QemuOptsList *olist = qemu_find_opts("vnc");
653c9747 4263 QemuOpts *opts = qemu_opts_parse_noisily(olist, str, !is_help_option(str));
81607cbf 4264 const char *id;
4db14629 4265
81607cbf 4266 if (!opts) {
653c9747 4267 exit(1);
81607cbf
GA		 4268 }
4269
4270 id = qemu_opts_id(opts);
4db14629
GH		 4271 if (!id) {
4272 /* auto-assign id if not present */
2779672f 4273 vnc_auto_assign_id(olist, opts);
4db14629 4274 }
9634f4e3
GH		 4275}
4276
28d0de7a 4277int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
9634f4e3
GH		 4278{
4279 Error *local_err = NULL;
4280 char *id = (char *)qemu_opts_id(opts);
4db14629 4281
9634f4e3 4282 assert(id);
ab4f931e
FL		 4283 vnc_display_init(id, &local_err);
4284 if (local_err) {
612aea20
MA		 4285 error_propagate(errp, local_err);
4286 return -1;
ab4f931e 4287 }
4db14629
GH		 4288 vnc_display_open(id, &local_err);
4289 if (local_err != NULL) {
612aea20
MA		 4290 error_propagate(errp, local_err);
4291 return -1;
4db14629
GH		 4292 }
4293 return 0;
4294}
4295
4296static void vnc_register_config(void)
4297{
4298 qemu_add_opts(&qemu_vnc_opts);
4299}
34294e2f 4300opts_init(vnc_register_config);
QEMU mirror