]> git.proxmox.com Git - qemu.git/blob - ui/vnc.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote-tracking branch 'bonzini/scsi-next' into staging
[qemu.git] / ui / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "vnc-jobs.h"
29 #include "sysemu/sysemu.h"
30 #include "qemu/sockets.h"
31 #include "qemu/timer.h"
32 #include "qemu/acl.h"
33 #include "qapi/qmp/types.h"
34 #include "qmp-commands.h"
35 #include "qemu/osdep.h"
36
37 #define VNC_REFRESH_INTERVAL_BASE 30
38 #define VNC_REFRESH_INTERVAL_INC 50
39 #define VNC_REFRESH_INTERVAL_MAX 2000
40 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
41 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
42
43 #include "vnc_keysym.h"
44 #include "d3des.h"
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static int vnc_cursor_define(VncState *vs);
50 static void vnc_release_modifiers(VncState *vs);
51
52 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
53 {
54 #ifdef _VNC_DEBUG
55 static const char *mn[] = {
56 [0] = "undefined",
57 [VNC_SHARE_MODE_CONNECTING] = "connecting",
58 [VNC_SHARE_MODE_SHARED] = "shared",
59 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
60 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
61 };
62 fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
63 vs->csock, mn[vs->share_mode], mn[mode]);
64 #endif
65
66 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
67 vs->vd->num_exclusive--;
68 }
69 vs->share_mode = mode;
70 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
71 vs->vd->num_exclusive++;
72 }
73 }
74
75 static char *addr_to_string(const char *format,
76 struct sockaddr_storage *sa,
77 socklen_t salen) {
78 char *addr;
79 char host[NI_MAXHOST];
80 char serv[NI_MAXSERV];
81 int err;
82 size_t addrlen;
83
84 if ((err = getnameinfo((struct sockaddr *)sa, salen,
85 host, sizeof(host),
86 serv, sizeof(serv),
87 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
88 VNC_DEBUG("Cannot resolve address %d: %s\n",
89 err, gai_strerror(err));
90 return NULL;
91 }
92
93 /* Enough for the existing format + the 2 vars we're
94 * substituting in. */
95 addrlen = strlen(format) + strlen(host) + strlen(serv);
96 addr = g_malloc(addrlen + 1);
97 snprintf(addr, addrlen, format, host, serv);
98 addr[addrlen] = '\0';
99
100 return addr;
101 }
102
103
104 char *vnc_socket_local_addr(const char *format, int fd) {
105 struct sockaddr_storage sa;
106 socklen_t salen;
107
108 salen = sizeof(sa);
109 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
110 return NULL;
111
112 return addr_to_string(format, &sa, salen);
113 }
114
115 char *vnc_socket_remote_addr(const char *format, int fd) {
116 struct sockaddr_storage sa;
117 socklen_t salen;
118
119 salen = sizeof(sa);
120 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
121 return NULL;
122
123 return addr_to_string(format, &sa, salen);
124 }
125
126 static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
127 socklen_t salen)
128 {
129 char host[NI_MAXHOST];
130 char serv[NI_MAXSERV];
131 int err;
132
133 if ((err = getnameinfo((struct sockaddr *)sa, salen,
134 host, sizeof(host),
135 serv, sizeof(serv),
136 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
137 VNC_DEBUG("Cannot resolve address %d: %s\n",
138 err, gai_strerror(err));
139 return -1;
140 }
141
142 qdict_put(qdict, "host", qstring_from_str(host));
143 qdict_put(qdict, "service", qstring_from_str(serv));
144 qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
145
146 return 0;
147 }
148
149 static int vnc_server_addr_put(QDict *qdict, int fd)
150 {
151 struct sockaddr_storage sa;
152 socklen_t salen;
153
154 salen = sizeof(sa);
155 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
156 return -1;
157 }
158
159 return put_addr_qdict(qdict, &sa, salen);
160 }
161
162 static int vnc_qdict_remote_addr(QDict *qdict, int fd)
163 {
164 struct sockaddr_storage sa;
165 socklen_t salen;
166
167 salen = sizeof(sa);
168 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
169 return -1;
170 }
171
172 return put_addr_qdict(qdict, &sa, salen);
173 }
174
175 static const char *vnc_auth_name(VncDisplay *vd) {
176 switch (vd->auth) {
177 case VNC_AUTH_INVALID:
178 return "invalid";
179 case VNC_AUTH_NONE:
180 return "none";
181 case VNC_AUTH_VNC:
182 return "vnc";
183 case VNC_AUTH_RA2:
184 return "ra2";
185 case VNC_AUTH_RA2NE:
186 return "ra2ne";
187 case VNC_AUTH_TIGHT:
188 return "tight";
189 case VNC_AUTH_ULTRA:
190 return "ultra";
191 case VNC_AUTH_TLS:
192 return "tls";
193 case VNC_AUTH_VENCRYPT:
194 #ifdef CONFIG_VNC_TLS
195 switch (vd->subauth) {
196 case VNC_AUTH_VENCRYPT_PLAIN:
197 return "vencrypt+plain";
198 case VNC_AUTH_VENCRYPT_TLSNONE:
199 return "vencrypt+tls+none";
200 case VNC_AUTH_VENCRYPT_TLSVNC:
201 return "vencrypt+tls+vnc";
202 case VNC_AUTH_VENCRYPT_TLSPLAIN:
203 return "vencrypt+tls+plain";
204 case VNC_AUTH_VENCRYPT_X509NONE:
205 return "vencrypt+x509+none";
206 case VNC_AUTH_VENCRYPT_X509VNC:
207 return "vencrypt+x509+vnc";
208 case VNC_AUTH_VENCRYPT_X509PLAIN:
209 return "vencrypt+x509+plain";
210 case VNC_AUTH_VENCRYPT_TLSSASL:
211 return "vencrypt+tls+sasl";
212 case VNC_AUTH_VENCRYPT_X509SASL:
213 return "vencrypt+x509+sasl";
214 default:
215 return "vencrypt";
216 }
217 #else
218 return "vencrypt";
219 #endif
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static int vnc_server_info_put(QDict *qdict)
227 {
228 if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
229 return -1;
230 }
231
232 qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
233 return 0;
234 }
235
236 static void vnc_client_cache_auth(VncState *client)
237 {
238 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
239 QDict *qdict;
240 #endif
241
242 if (!client->info) {
243 return;
244 }
245
246 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
247 qdict = qobject_to_qdict(client->info);
248 #endif
249
250 #ifdef CONFIG_VNC_TLS
251 if (client->tls.session &&
252 client->tls.dname) {
253 qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
254 }
255 #endif
256 #ifdef CONFIG_VNC_SASL
257 if (client->sasl.conn &&
258 client->sasl.username) {
259 qdict_put(qdict, "sasl_username",
260 qstring_from_str(client->sasl.username));
261 }
262 #endif
263 }
264
265 static void vnc_client_cache_addr(VncState *client)
266 {
267 QDict *qdict;
268
269 qdict = qdict_new();
270 if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
271 QDECREF(qdict);
272 /* XXX: how to report the error? */
273 return;
274 }
275
276 client->info = QOBJECT(qdict);
277 }
278
279 static void vnc_qmp_event(VncState *vs, MonitorEvent event)
280 {
281 QDict *server;
282 QObject *data;
283
284 if (!vs->info) {
285 return;
286 }
287
288 server = qdict_new();
289 if (vnc_server_info_put(server) < 0) {
290 QDECREF(server);
291 return;
292 }
293
294 data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
295 vs->info, QOBJECT(server));
296
297 monitor_protocol_event(event, data);
298
299 qobject_incref(vs->info);
300 qobject_decref(data);
301 }
302
303 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
304 {
305 struct sockaddr_storage sa;
306 socklen_t salen = sizeof(sa);
307 char host[NI_MAXHOST];
308 char serv[NI_MAXSERV];
309 VncClientInfo *info;
310
311 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
312 return NULL;
313 }
314
315 if (getnameinfo((struct sockaddr *)&sa, salen,
316 host, sizeof(host),
317 serv, sizeof(serv),
318 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
319 return NULL;
320 }
321
322 info = g_malloc0(sizeof(*info));
323 info->host = g_strdup(host);
324 info->service = g_strdup(serv);
325 info->family = g_strdup(inet_strfamily(sa.ss_family));
326
327 #ifdef CONFIG_VNC_TLS
328 if (client->tls.session && client->tls.dname) {
329 info->has_x509_dname = true;
330 info->x509_dname = g_strdup(client->tls.dname);
331 }
332 #endif
333 #ifdef CONFIG_VNC_SASL
334 if (client->sasl.conn && client->sasl.username) {
335 info->has_sasl_username = true;
336 info->sasl_username = g_strdup(client->sasl.username);
337 }
338 #endif
339
340 return info;
341 }
342
343 VncInfo *qmp_query_vnc(Error **errp)
344 {
345 VncInfo *info = g_malloc0(sizeof(*info));
346
347 if (vnc_display == NULL || vnc_display->display == NULL) {
348 info->enabled = false;
349 } else {
350 VncClientInfoList *cur_item = NULL;
351 struct sockaddr_storage sa;
352 socklen_t salen = sizeof(sa);
353 char host[NI_MAXHOST];
354 char serv[NI_MAXSERV];
355 VncState *client;
356
357 info->enabled = true;
358
359 /* for compatibility with the original command */
360 info->has_clients = true;
361
362 QTAILQ_FOREACH(client, &vnc_display->clients, next) {
363 VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
364 cinfo->value = qmp_query_vnc_client(client);
365
366 /* XXX: waiting for the qapi to support GSList */
367 if (!cur_item) {
368 info->clients = cur_item = cinfo;
369 } else {
370 cur_item->next = cinfo;
371 cur_item = cinfo;
372 }
373 }
374
375 if (vnc_display->lsock == -1) {
376 return info;
377 }
378
379 if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
380 &salen) == -1) {
381 error_set(errp, QERR_UNDEFINED_ERROR);
382 goto out_error;
383 }
384
385 if (getnameinfo((struct sockaddr *)&sa, salen,
386 host, sizeof(host),
387 serv, sizeof(serv),
388 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
389 error_set(errp, QERR_UNDEFINED_ERROR);
390 goto out_error;
391 }
392
393 info->has_host = true;
394 info->host = g_strdup(host);
395
396 info->has_service = true;
397 info->service = g_strdup(serv);
398
399 info->has_family = true;
400 info->family = g_strdup(inet_strfamily(sa.ss_family));
401
402 info->has_auth = true;
403 info->auth = g_strdup(vnc_auth_name(vnc_display));
404 }
405
406 return info;
407
408 out_error:
409 qapi_free_VncInfo(info);
410 return NULL;
411 }
412
413 /* TODO
414 1) Get the queue working for IO.
415 2) there is some weirdness when using the -S option (the screen is grey
416 and not totally invalidated
417 3) resolutions > 1024
418 */
419
420 static int vnc_update_client(VncState *vs, int has_dirty);
421 static int vnc_update_client_sync(VncState *vs, int has_dirty);
422 static void vnc_disconnect_start(VncState *vs);
423 static void vnc_init_timer(VncDisplay *vd);
424 static void vnc_remove_timer(VncDisplay *vd);
425
426 static void vnc_colordepth(VncState *vs);
427 static void framebuffer_update_request(VncState *vs, int incremental,
428 int x_position, int y_position,
429 int w, int h);
430 static void vnc_refresh(void *opaque);
431 static int vnc_refresh_server_surface(VncDisplay *vd);
432
433 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
434 {
435 int i;
436 VncDisplay *vd = ds->opaque;
437 struct VncSurface *s = &vd->guest;
438 int width = ds_get_width(ds);
439 int height = ds_get_height(ds);
440
441 h += y;
442
443 /* round x down to ensure the loop only spans one 16-pixel block per,
444 iteration. otherwise, if (x % 16) != 0, the last iteration may span
445 two 16-pixel blocks but we only mark the first as dirty
446 */
447 w += (x % 16);
448 x -= (x % 16);
449
450 x = MIN(x, width);
451 y = MIN(y, height);
452 w = MIN(x + w, width) - x;
453 h = MIN(h, height);
454
455 for (; y < h; y++)
456 for (i = 0; i < w; i += 16)
457 set_bit((x + i) / 16, s->dirty[y]);
458 }
459
460 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
461 int32_t encoding)
462 {
463 vnc_write_u16(vs, x);
464 vnc_write_u16(vs, y);
465 vnc_write_u16(vs, w);
466 vnc_write_u16(vs, h);
467
468 vnc_write_s32(vs, encoding);
469 }
470
471 void buffer_reserve(Buffer *buffer, size_t len)
472 {
473 if ((buffer->capacity - buffer->offset) < len) {
474 buffer->capacity += (len + 1024);
475 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
476 if (buffer->buffer == NULL) {
477 fprintf(stderr, "vnc: out of memory\n");
478 exit(1);
479 }
480 }
481 }
482
483 static int buffer_empty(Buffer *buffer)
484 {
485 return buffer->offset == 0;
486 }
487
488 uint8_t *buffer_end(Buffer *buffer)
489 {
490 return buffer->buffer + buffer->offset;
491 }
492
493 void buffer_reset(Buffer *buffer)
494 {
495 buffer->offset = 0;
496 }
497
498 void buffer_free(Buffer *buffer)
499 {
500 g_free(buffer->buffer);
501 buffer->offset = 0;
502 buffer->capacity = 0;
503 buffer->buffer = NULL;
504 }
505
506 void buffer_append(Buffer *buffer, const void *data, size_t len)
507 {
508 memcpy(buffer->buffer + buffer->offset, data, len);
509 buffer->offset += len;
510 }
511
512 void buffer_advance(Buffer *buf, size_t len)
513 {
514 memmove(buf->buffer, buf->buffer + len,
515 (buf->offset - len));
516 buf->offset -= len;
517 }
518
519 static void vnc_desktop_resize(VncState *vs)
520 {
521 DisplayState *ds = vs->ds;
522
523 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
524 return;
525 }
526 if (vs->client_width == ds_get_width(ds) &&
527 vs->client_height == ds_get_height(ds)) {
528 return;
529 }
530 vs->client_width = ds_get_width(ds);
531 vs->client_height = ds_get_height(ds);
532 vnc_lock_output(vs);
533 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
534 vnc_write_u8(vs, 0);
535 vnc_write_u16(vs, 1); /* number of rects */
536 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
537 VNC_ENCODING_DESKTOPRESIZE);
538 vnc_unlock_output(vs);
539 vnc_flush(vs);
540 }
541
542 static void vnc_abort_display_jobs(VncDisplay *vd)
543 {
544 VncState *vs;
545
546 QTAILQ_FOREACH(vs, &vd->clients, next) {
547 vnc_lock_output(vs);
548 vs->abort = true;
549 vnc_unlock_output(vs);
550 }
551 QTAILQ_FOREACH(vs, &vd->clients, next) {
552 vnc_jobs_join(vs);
553 }
554 QTAILQ_FOREACH(vs, &vd->clients, next) {
555 vnc_lock_output(vs);
556 vs->abort = false;
557 vnc_unlock_output(vs);
558 }
559 }
560
561 int vnc_server_fb_stride(VncDisplay *vd)
562 {
563 return pixman_image_get_stride(vd->server);
564 }
565
566 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
567 {
568 uint8_t *ptr;
569
570 ptr = (uint8_t *)pixman_image_get_data(vd->server);
571 ptr += y * vnc_server_fb_stride(vd);
572 ptr += x * VNC_SERVER_FB_BYTES;
573 return ptr;
574 }
575
576 static void vnc_dpy_resize(DisplayState *ds)
577 {
578 VncDisplay *vd = ds->opaque;
579 VncState *vs;
580
581 vnc_abort_display_jobs(vd);
582
583 /* server surface */
584 qemu_pixman_image_unref(vd->server);
585 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
586 ds_get_width(ds),
587 ds_get_height(ds),
588 NULL, 0);
589
590 /* guest surface */
591 #if 0 /* FIXME */
592 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
593 console_color_init(ds);
594 #endif
595 qemu_pixman_image_unref(vd->guest.fb);
596 vd->guest.fb = pixman_image_ref(ds->surface->image);
597 vd->guest.format = ds->surface->format;
598 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
599
600 QTAILQ_FOREACH(vs, &vd->clients, next) {
601 vnc_colordepth(vs);
602 vnc_desktop_resize(vs);
603 if (vs->vd->cursor) {
604 vnc_cursor_define(vs);
605 }
606 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
607 }
608 }
609
610 /* fastest code */
611 static void vnc_write_pixels_copy(VncState *vs,
612 void *pixels, int size)
613 {
614 vnc_write(vs, pixels, size);
615 }
616
617 /* slowest but generic code. */
618 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
619 {
620 uint8_t r, g, b;
621
622 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
623 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
624 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
625 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
626 #else
627 # error need some bits here if you change VNC_SERVER_FB_FORMAT
628 #endif
629 v = (r << vs->client_pf.rshift) |
630 (g << vs->client_pf.gshift) |
631 (b << vs->client_pf.bshift);
632 switch (vs->client_pf.bytes_per_pixel) {
633 case 1:
634 buf[0] = v;
635 break;
636 case 2:
637 if (vs->client_be) {
638 buf[0] = v >> 8;
639 buf[1] = v;
640 } else {
641 buf[1] = v >> 8;
642 buf[0] = v;
643 }
644 break;
645 default:
646 case 4:
647 if (vs->client_be) {
648 buf[0] = v >> 24;
649 buf[1] = v >> 16;
650 buf[2] = v >> 8;
651 buf[3] = v;
652 } else {
653 buf[3] = v >> 24;
654 buf[2] = v >> 16;
655 buf[1] = v >> 8;
656 buf[0] = v;
657 }
658 break;
659 }
660 }
661
662 static void vnc_write_pixels_generic(VncState *vs,
663 void *pixels1, int size)
664 {
665 uint8_t buf[4];
666
667 if (VNC_SERVER_FB_BYTES == 4) {
668 uint32_t *pixels = pixels1;
669 int n, i;
670 n = size >> 2;
671 for (i = 0; i < n; i++) {
672 vnc_convert_pixel(vs, buf, pixels[i]);
673 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
674 }
675 }
676 }
677
678 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
679 {
680 int i;
681 uint8_t *row;
682 VncDisplay *vd = vs->vd;
683
684 row = vnc_server_fb_ptr(vd, x, y);
685 for (i = 0; i < h; i++) {
686 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
687 row += vnc_server_fb_stride(vd);
688 }
689 return 1;
690 }
691
692 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
693 {
694 int n = 0;
695
696 switch(vs->vnc_encoding) {
697 case VNC_ENCODING_ZLIB:
698 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
699 break;
700 case VNC_ENCODING_HEXTILE:
701 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
702 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
703 break;
704 case VNC_ENCODING_TIGHT:
705 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
706 break;
707 case VNC_ENCODING_TIGHT_PNG:
708 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
709 break;
710 case VNC_ENCODING_ZRLE:
711 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
712 break;
713 case VNC_ENCODING_ZYWRLE:
714 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
715 break;
716 default:
717 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
718 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
719 break;
720 }
721 return n;
722 }
723
724 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
725 {
726 /* send bitblit op to the vnc client */
727 vnc_lock_output(vs);
728 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
729 vnc_write_u8(vs, 0);
730 vnc_write_u16(vs, 1); /* number of rects */
731 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
732 vnc_write_u16(vs, src_x);
733 vnc_write_u16(vs, src_y);
734 vnc_unlock_output(vs);
735 vnc_flush(vs);
736 }
737
738 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
739 {
740 VncDisplay *vd = ds->opaque;
741 VncState *vs, *vn;
742 uint8_t *src_row;
743 uint8_t *dst_row;
744 int i, x, y, pitch, inc, w_lim, s;
745 int cmp_bytes;
746
747 vnc_refresh_server_surface(vd);
748 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
749 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
750 vs->force_update = 1;
751 vnc_update_client_sync(vs, 1);
752 /* vs might be free()ed here */
753 }
754 }
755
756 /* do bitblit op on the local surface too */
757 pitch = vnc_server_fb_stride(vd);
758 src_row = vnc_server_fb_ptr(vd, src_x, src_y);
759 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
760 y = dst_y;
761 inc = 1;
762 if (dst_y > src_y) {
763 /* copy backwards */
764 src_row += pitch * (h-1);
765 dst_row += pitch * (h-1);
766 pitch = -pitch;
767 y = dst_y + h - 1;
768 inc = -1;
769 }
770 w_lim = w - (16 - (dst_x % 16));
771 if (w_lim < 0)
772 w_lim = w;
773 else
774 w_lim = w - (w_lim % 16);
775 for (i = 0; i < h; i++) {
776 for (x = 0; x <= w_lim;
777 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
778 if (x == w_lim) {
779 if ((s = w - w_lim) == 0)
780 break;
781 } else if (!x) {
782 s = (16 - (dst_x % 16));
783 s = MIN(s, w_lim);
784 } else {
785 s = 16;
786 }
787 cmp_bytes = s * VNC_SERVER_FB_BYTES;
788 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
789 continue;
790 memmove(dst_row, src_row, cmp_bytes);
791 QTAILQ_FOREACH(vs, &vd->clients, next) {
792 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
793 set_bit(((x + dst_x) / 16), vs->dirty[y]);
794 }
795 }
796 }
797 src_row += pitch - w * VNC_SERVER_FB_BYTES;
798 dst_row += pitch - w * VNC_SERVER_FB_BYTES;
799 y += inc;
800 }
801
802 QTAILQ_FOREACH(vs, &vd->clients, next) {
803 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
804 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
805 }
806 }
807 }
808
809 static void vnc_mouse_set(DisplayState *ds, int x, int y, int visible)
810 {
811 /* can we ask the client(s) to move the pointer ??? */
812 }
813
814 static int vnc_cursor_define(VncState *vs)
815 {
816 QEMUCursor *c = vs->vd->cursor;
817 int isize;
818
819 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
820 vnc_lock_output(vs);
821 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
822 vnc_write_u8(vs, 0); /* padding */
823 vnc_write_u16(vs, 1); /* # of rects */
824 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
825 VNC_ENCODING_RICH_CURSOR);
826 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
827 vnc_write_pixels_generic(vs, c->data, isize);
828 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
829 vnc_unlock_output(vs);
830 return 0;
831 }
832 return -1;
833 }
834
835 static void vnc_dpy_cursor_define(DisplayState *ds, QEMUCursor *c)
836 {
837 VncDisplay *vd = vnc_display;
838 VncState *vs;
839
840 cursor_put(vd->cursor);
841 g_free(vd->cursor_mask);
842
843 vd->cursor = c;
844 cursor_get(vd->cursor);
845 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
846 vd->cursor_mask = g_malloc0(vd->cursor_msize);
847 cursor_get_mono_mask(c, 0, vd->cursor_mask);
848
849 QTAILQ_FOREACH(vs, &vd->clients, next) {
850 vnc_cursor_define(vs);
851 }
852 }
853
854 static int find_and_clear_dirty_height(struct VncState *vs,
855 int y, int last_x, int x, int height)
856 {
857 int h;
858
859 for (h = 1; h < (height - y); h++) {
860 int tmp_x;
861 if (!test_bit(last_x, vs->dirty[y + h])) {
862 break;
863 }
864 for (tmp_x = last_x; tmp_x < x; tmp_x++) {
865 clear_bit(tmp_x, vs->dirty[y + h]);
866 }
867 }
868
869 return h;
870 }
871
872 static int vnc_update_client_sync(VncState *vs, int has_dirty)
873 {
874 int ret = vnc_update_client(vs, has_dirty);
875 vnc_jobs_join(vs);
876 return ret;
877 }
878
879 static int vnc_update_client(VncState *vs, int has_dirty)
880 {
881 if (vs->need_update && vs->csock != -1) {
882 VncDisplay *vd = vs->vd;
883 VncJob *job;
884 int y;
885 int width, height;
886 int n = 0;
887
888
889 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
890 /* kernel send buffers are full -> drop frames to throttle */
891 return 0;
892
893 if (!has_dirty && !vs->audio_cap && !vs->force_update)
894 return 0;
895
896 /*
897 * Send screen updates to the vnc client using the server
898 * surface and server dirty map. guest surface updates
899 * happening in parallel don't disturb us, the next pass will
900 * send them to the client.
901 */
902 job = vnc_job_new(vs);
903
904 width = MIN(pixman_image_get_width(vd->server), vs->client_width);
905 height = MIN(pixman_image_get_height(vd->server), vs->client_height);
906
907 for (y = 0; y < height; y++) {
908 int x;
909 int last_x = -1;
910 for (x = 0; x < width / 16; x++) {
911 if (test_and_clear_bit(x, vs->dirty[y])) {
912 if (last_x == -1) {
913 last_x = x;
914 }
915 } else {
916 if (last_x != -1) {
917 int h = find_and_clear_dirty_height(vs, y, last_x, x,
918 height);
919
920 n += vnc_job_add_rect(job, last_x * 16, y,
921 (x - last_x) * 16, h);
922 }
923 last_x = -1;
924 }
925 }
926 if (last_x != -1) {
927 int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
928 n += vnc_job_add_rect(job, last_x * 16, y,
929 (x - last_x) * 16, h);
930 }
931 }
932
933 vnc_job_push(job);
934 vs->force_update = 0;
935 return n;
936 }
937
938 if (vs->csock == -1)
939 vnc_disconnect_finish(vs);
940
941 return 0;
942 }
943
944 /* audio */
945 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
946 {
947 VncState *vs = opaque;
948
949 switch (cmd) {
950 case AUD_CNOTIFY_DISABLE:
951 vnc_lock_output(vs);
952 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
953 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
954 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
955 vnc_unlock_output(vs);
956 vnc_flush(vs);
957 break;
958
959 case AUD_CNOTIFY_ENABLE:
960 vnc_lock_output(vs);
961 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
962 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
963 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
964 vnc_unlock_output(vs);
965 vnc_flush(vs);
966 break;
967 }
968 }
969
970 static void audio_capture_destroy(void *opaque)
971 {
972 }
973
974 static void audio_capture(void *opaque, void *buf, int size)
975 {
976 VncState *vs = opaque;
977
978 vnc_lock_output(vs);
979 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
980 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
981 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
982 vnc_write_u32(vs, size);
983 vnc_write(vs, buf, size);
984 vnc_unlock_output(vs);
985 vnc_flush(vs);
986 }
987
988 static void audio_add(VncState *vs)
989 {
990 struct audio_capture_ops ops;
991
992 if (vs->audio_cap) {
993 monitor_printf(default_mon, "audio already running\n");
994 return;
995 }
996
997 ops.notify = audio_capture_notify;
998 ops.destroy = audio_capture_destroy;
999 ops.capture = audio_capture;
1000
1001 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1002 if (!vs->audio_cap) {
1003 monitor_printf(default_mon, "Failed to add audio capture\n");
1004 }
1005 }
1006
1007 static void audio_del(VncState *vs)
1008 {
1009 if (vs->audio_cap) {
1010 AUD_del_capture(vs->audio_cap, vs);
1011 vs->audio_cap = NULL;
1012 }
1013 }
1014
1015 static void vnc_disconnect_start(VncState *vs)
1016 {
1017 if (vs->csock == -1)
1018 return;
1019 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1020 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1021 closesocket(vs->csock);
1022 vs->csock = -1;
1023 }
1024
1025 void vnc_disconnect_finish(VncState *vs)
1026 {
1027 int i;
1028
1029 vnc_jobs_join(vs); /* Wait encoding jobs */
1030
1031 vnc_lock_output(vs);
1032 vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1033
1034 buffer_free(&vs->input);
1035 buffer_free(&vs->output);
1036 #ifdef CONFIG_VNC_WS
1037 buffer_free(&vs->ws_input);
1038 buffer_free(&vs->ws_output);
1039 #endif /* CONFIG_VNC_WS */
1040
1041 qobject_decref(vs->info);
1042
1043 vnc_zlib_clear(vs);
1044 vnc_tight_clear(vs);
1045 vnc_zrle_clear(vs);
1046
1047 #ifdef CONFIG_VNC_TLS
1048 vnc_tls_client_cleanup(vs);
1049 #endif /* CONFIG_VNC_TLS */
1050 #ifdef CONFIG_VNC_SASL
1051 vnc_sasl_client_cleanup(vs);
1052 #endif /* CONFIG_VNC_SASL */
1053 audio_del(vs);
1054 vnc_release_modifiers(vs);
1055
1056 if (vs->initialized) {
1057 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1058 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1059 }
1060
1061 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1062 dcl->idle = 1;
1063 }
1064
1065 vnc_remove_timer(vs->vd);
1066 if (vs->vd->lock_key_sync)
1067 qemu_remove_led_event_handler(vs->led);
1068 vnc_unlock_output(vs);
1069
1070 qemu_mutex_destroy(&vs->output_mutex);
1071 if (vs->bh != NULL) {
1072 qemu_bh_delete(vs->bh);
1073 }
1074 buffer_free(&vs->jobs_buffer);
1075
1076 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1077 g_free(vs->lossy_rect[i]);
1078 }
1079 g_free(vs->lossy_rect);
1080 g_free(vs);
1081 }
1082
1083 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1084 {
1085 if (ret == 0 || ret == -1) {
1086 if (ret == -1) {
1087 switch (last_errno) {
1088 case EINTR:
1089 case EAGAIN:
1090 #ifdef _WIN32
1091 case WSAEWOULDBLOCK:
1092 #endif
1093 return 0;
1094 default:
1095 break;
1096 }
1097 }
1098
1099 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1100 ret, ret < 0 ? last_errno : 0);
1101 vnc_disconnect_start(vs);
1102
1103 return 0;
1104 }
1105 return ret;
1106 }
1107
1108
1109 void vnc_client_error(VncState *vs)
1110 {
1111 VNC_DEBUG("Closing down client sock: protocol error\n");
1112 vnc_disconnect_start(vs);
1113 }
1114
1115
1116 /*
1117 * Called to write a chunk of data to the client socket. The data may
1118 * be the raw data, or may have already been encoded by SASL.
1119 * The data will be written either straight onto the socket, or
1120 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1121 *
1122 * NB, it is theoretically possible to have 2 layers of encryption,
1123 * both SASL, and this TLS layer. It is highly unlikely in practice
1124 * though, since SASL encryption will typically be a no-op if TLS
1125 * is active
1126 *
1127 * Returns the number of bytes written, which may be less than
1128 * the requested 'datalen' if the socket would block. Returns
1129 * -1 on error, and disconnects the client socket.
1130 */
1131 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1132 {
1133 long ret;
1134 #ifdef CONFIG_VNC_TLS
1135 if (vs->tls.session) {
1136 ret = gnutls_write(vs->tls.session, data, datalen);
1137 if (ret < 0) {
1138 if (ret == GNUTLS_E_AGAIN)
1139 errno = EAGAIN;
1140 else
1141 errno = EIO;
1142 ret = -1;
1143 }
1144 } else
1145 #endif /* CONFIG_VNC_TLS */
1146 ret = send(vs->csock, (const void *)data, datalen, 0);
1147 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1148 return vnc_client_io_error(vs, ret, socket_error());
1149 }
1150
1151
1152 /*
1153 * Called to write buffered data to the client socket, when not
1154 * using any SASL SSF encryption layers. Will write as much data
1155 * as possible without blocking. If all buffered data is written,
1156 * will switch the FD poll() handler back to read monitoring.
1157 *
1158 * Returns the number of bytes written, which may be less than
1159 * the buffered output data if the socket would block. Returns
1160 * -1 on error, and disconnects the client socket.
1161 */
1162 static long vnc_client_write_plain(VncState *vs)
1163 {
1164 long ret;
1165
1166 #ifdef CONFIG_VNC_SASL
1167 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1168 vs->output.buffer, vs->output.capacity, vs->output.offset,
1169 vs->sasl.waitWriteSSF);
1170
1171 if (vs->sasl.conn &&
1172 vs->sasl.runSSF &&
1173 vs->sasl.waitWriteSSF) {
1174 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1175 if (ret)
1176 vs->sasl.waitWriteSSF -= ret;
1177 } else
1178 #endif /* CONFIG_VNC_SASL */
1179 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1180 if (!ret)
1181 return 0;
1182
1183 buffer_advance(&vs->output, ret);
1184
1185 if (vs->output.offset == 0) {
1186 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1187 }
1188
1189 return ret;
1190 }
1191
1192
1193 /*
1194 * First function called whenever there is data to be written to
1195 * the client socket. Will delegate actual work according to whether
1196 * SASL SSF layers are enabled (thus requiring encryption calls)
1197 */
1198 static void vnc_client_write_locked(void *opaque)
1199 {
1200 VncState *vs = opaque;
1201
1202 #ifdef CONFIG_VNC_SASL
1203 if (vs->sasl.conn &&
1204 vs->sasl.runSSF &&
1205 !vs->sasl.waitWriteSSF) {
1206 vnc_client_write_sasl(vs);
1207 } else
1208 #endif /* CONFIG_VNC_SASL */
1209 {
1210 #ifdef CONFIG_VNC_WS
1211 if (vs->encode_ws) {
1212 vnc_client_write_ws(vs);
1213 } else
1214 #endif /* CONFIG_VNC_WS */
1215 {
1216 vnc_client_write_plain(vs);
1217 }
1218 }
1219 }
1220
1221 void vnc_client_write(void *opaque)
1222 {
1223 VncState *vs = opaque;
1224
1225 vnc_lock_output(vs);
1226 if (vs->output.offset
1227 #ifdef CONFIG_VNC_WS
1228 || vs->ws_output.offset
1229 #endif
1230 ) {
1231 vnc_client_write_locked(opaque);
1232 } else if (vs->csock != -1) {
1233 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1234 }
1235 vnc_unlock_output(vs);
1236 }
1237
1238 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1239 {
1240 vs->read_handler = func;
1241 vs->read_handler_expect = expecting;
1242 }
1243
1244
1245 /*
1246 * Called to read a chunk of data from the client socket. The data may
1247 * be the raw data, or may need to be further decoded by SASL.
1248 * The data will be read either straight from to the socket, or
1249 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1250 *
1251 * NB, it is theoretically possible to have 2 layers of encryption,
1252 * both SASL, and this TLS layer. It is highly unlikely in practice
1253 * though, since SASL encryption will typically be a no-op if TLS
1254 * is active
1255 *
1256 * Returns the number of bytes read, which may be less than
1257 * the requested 'datalen' if the socket would block. Returns
1258 * -1 on error, and disconnects the client socket.
1259 */
1260 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1261 {
1262 long ret;
1263 #ifdef CONFIG_VNC_TLS
1264 if (vs->tls.session) {
1265 ret = gnutls_read(vs->tls.session, data, datalen);
1266 if (ret < 0) {
1267 if (ret == GNUTLS_E_AGAIN)
1268 errno = EAGAIN;
1269 else
1270 errno = EIO;
1271 ret = -1;
1272 }
1273 } else
1274 #endif /* CONFIG_VNC_TLS */
1275 ret = qemu_recv(vs->csock, data, datalen, 0);
1276 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1277 return vnc_client_io_error(vs, ret, socket_error());
1278 }
1279
1280
1281 /*
1282 * Called to read data from the client socket to the input buffer,
1283 * when not using any SASL SSF encryption layers. Will read as much
1284 * data as possible without blocking.
1285 *
1286 * Returns the number of bytes read. Returns -1 on error, and
1287 * disconnects the client socket.
1288 */
1289 static long vnc_client_read_plain(VncState *vs)
1290 {
1291 int ret;
1292 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1293 vs->input.buffer, vs->input.capacity, vs->input.offset);
1294 buffer_reserve(&vs->input, 4096);
1295 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1296 if (!ret)
1297 return 0;
1298 vs->input.offset += ret;
1299 return ret;
1300 }
1301
1302 static void vnc_jobs_bh(void *opaque)
1303 {
1304 VncState *vs = opaque;
1305
1306 vnc_jobs_consume_buffer(vs);
1307 }
1308
1309 /*
1310 * First function called whenever there is more data to be read from
1311 * the client socket. Will delegate actual work according to whether
1312 * SASL SSF layers are enabled (thus requiring decryption calls)
1313 */
1314 void vnc_client_read(void *opaque)
1315 {
1316 VncState *vs = opaque;
1317 long ret;
1318
1319 #ifdef CONFIG_VNC_SASL
1320 if (vs->sasl.conn && vs->sasl.runSSF)
1321 ret = vnc_client_read_sasl(vs);
1322 else
1323 #endif /* CONFIG_VNC_SASL */
1324 #ifdef CONFIG_VNC_WS
1325 if (vs->encode_ws) {
1326 ret = vnc_client_read_ws(vs);
1327 if (ret == -1) {
1328 vnc_disconnect_start(vs);
1329 return;
1330 } else if (ret == -2) {
1331 vnc_client_error(vs);
1332 return;
1333 }
1334 } else
1335 #endif /* CONFIG_VNC_WS */
1336 {
1337 ret = vnc_client_read_plain(vs);
1338 }
1339 if (!ret) {
1340 if (vs->csock == -1)
1341 vnc_disconnect_finish(vs);
1342 return;
1343 }
1344
1345 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1346 size_t len = vs->read_handler_expect;
1347 int ret;
1348
1349 ret = vs->read_handler(vs, vs->input.buffer, len);
1350 if (vs->csock == -1) {
1351 vnc_disconnect_finish(vs);
1352 return;
1353 }
1354
1355 if (!ret) {
1356 buffer_advance(&vs->input, len);
1357 } else {
1358 vs->read_handler_expect = ret;
1359 }
1360 }
1361 }
1362
1363 void vnc_write(VncState *vs, const void *data, size_t len)
1364 {
1365 buffer_reserve(&vs->output, len);
1366
1367 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1368 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1369 }
1370
1371 buffer_append(&vs->output, data, len);
1372 }
1373
1374 void vnc_write_s32(VncState *vs, int32_t value)
1375 {
1376 vnc_write_u32(vs, *(uint32_t *)&value);
1377 }
1378
1379 void vnc_write_u32(VncState *vs, uint32_t value)
1380 {
1381 uint8_t buf[4];
1382
1383 buf[0] = (value >> 24) & 0xFF;
1384 buf[1] = (value >> 16) & 0xFF;
1385 buf[2] = (value >> 8) & 0xFF;
1386 buf[3] = value & 0xFF;
1387
1388 vnc_write(vs, buf, 4);
1389 }
1390
1391 void vnc_write_u16(VncState *vs, uint16_t value)
1392 {
1393 uint8_t buf[2];
1394
1395 buf[0] = (value >> 8) & 0xFF;
1396 buf[1] = value & 0xFF;
1397
1398 vnc_write(vs, buf, 2);
1399 }
1400
1401 void vnc_write_u8(VncState *vs, uint8_t value)
1402 {
1403 vnc_write(vs, (char *)&value, 1);
1404 }
1405
1406 void vnc_flush(VncState *vs)
1407 {
1408 vnc_lock_output(vs);
1409 if (vs->csock != -1 && (vs->output.offset
1410 #ifdef CONFIG_VNC_WS
1411 || vs->ws_output.offset
1412 #endif
1413 )) {
1414 vnc_client_write_locked(vs);
1415 }
1416 vnc_unlock_output(vs);
1417 }
1418
1419 static uint8_t read_u8(uint8_t *data, size_t offset)
1420 {
1421 return data[offset];
1422 }
1423
1424 static uint16_t read_u16(uint8_t *data, size_t offset)
1425 {
1426 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1427 }
1428
1429 static int32_t read_s32(uint8_t *data, size_t offset)
1430 {
1431 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1432 (data[offset + 2] << 8) | data[offset + 3]);
1433 }
1434
1435 uint32_t read_u32(uint8_t *data, size_t offset)
1436 {
1437 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1438 (data[offset + 2] << 8) | data[offset + 3]);
1439 }
1440
1441 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1442 {
1443 }
1444
1445 static void check_pointer_type_change(Notifier *notifier, void *data)
1446 {
1447 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1448 int absolute = kbd_mouse_is_absolute();
1449
1450 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1451 vnc_lock_output(vs);
1452 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1453 vnc_write_u8(vs, 0);
1454 vnc_write_u16(vs, 1);
1455 vnc_framebuffer_update(vs, absolute, 0,
1456 ds_get_width(vs->ds), ds_get_height(vs->ds),
1457 VNC_ENCODING_POINTER_TYPE_CHANGE);
1458 vnc_unlock_output(vs);
1459 vnc_flush(vs);
1460 }
1461 vs->absolute = absolute;
1462 }
1463
1464 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1465 {
1466 int buttons = 0;
1467 int dz = 0;
1468
1469 if (button_mask & 0x01)
1470 buttons |= MOUSE_EVENT_LBUTTON;
1471 if (button_mask & 0x02)
1472 buttons |= MOUSE_EVENT_MBUTTON;
1473 if (button_mask & 0x04)
1474 buttons |= MOUSE_EVENT_RBUTTON;
1475 if (button_mask & 0x08)
1476 dz = -1;
1477 if (button_mask & 0x10)
1478 dz = 1;
1479
1480 if (vs->absolute) {
1481 kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
1482 x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
1483 ds_get_height(vs->ds) > 1 ?
1484 y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1485 dz, buttons);
1486 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1487 x -= 0x7FFF;
1488 y -= 0x7FFF;
1489
1490 kbd_mouse_event(x, y, dz, buttons);
1491 } else {
1492 if (vs->last_x != -1)
1493 kbd_mouse_event(x - vs->last_x,
1494 y - vs->last_y,
1495 dz, buttons);
1496 vs->last_x = x;
1497 vs->last_y = y;
1498 }
1499 }
1500
1501 static void reset_keys(VncState *vs)
1502 {
1503 int i;
1504 for(i = 0; i < 256; i++) {
1505 if (vs->modifiers_state[i]) {
1506 if (i & SCANCODE_GREY)
1507 kbd_put_keycode(SCANCODE_EMUL0);
1508 kbd_put_keycode(i | SCANCODE_UP);
1509 vs->modifiers_state[i] = 0;
1510 }
1511 }
1512 }
1513
1514 static void press_key(VncState *vs, int keysym)
1515 {
1516 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1517 if (keycode & SCANCODE_GREY)
1518 kbd_put_keycode(SCANCODE_EMUL0);
1519 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1520 if (keycode & SCANCODE_GREY)
1521 kbd_put_keycode(SCANCODE_EMUL0);
1522 kbd_put_keycode(keycode | SCANCODE_UP);
1523 }
1524
1525 static void kbd_leds(void *opaque, int ledstate)
1526 {
1527 VncState *vs = opaque;
1528 int caps, num;
1529
1530 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1531 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
1532
1533 if (vs->modifiers_state[0x3a] != caps) {
1534 vs->modifiers_state[0x3a] = caps;
1535 }
1536 if (vs->modifiers_state[0x45] != num) {
1537 vs->modifiers_state[0x45] = num;
1538 }
1539 }
1540
1541 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1542 {
1543 /* QEMU console switch */
1544 switch(keycode) {
1545 case 0x2a: /* Left Shift */
1546 case 0x36: /* Right Shift */
1547 case 0x1d: /* Left CTRL */
1548 case 0x9d: /* Right CTRL */
1549 case 0x38: /* Left ALT */
1550 case 0xb8: /* Right ALT */
1551 if (down)
1552 vs->modifiers_state[keycode] = 1;
1553 else
1554 vs->modifiers_state[keycode] = 0;
1555 break;
1556 case 0x02 ... 0x0a: /* '1' to '9' keys */
1557 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1558 /* Reset the modifiers sent to the current console */
1559 reset_keys(vs);
1560 console_select(keycode - 0x02);
1561 return;
1562 }
1563 break;
1564 case 0x3a: /* CapsLock */
1565 case 0x45: /* NumLock */
1566 if (down)
1567 vs->modifiers_state[keycode] ^= 1;
1568 break;
1569 }
1570
1571 if (down && vs->vd->lock_key_sync &&
1572 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1573 /* If the numlock state needs to change then simulate an additional
1574 keypress before sending this one. This will happen if the user
1575 toggles numlock away from the VNC window.
1576 */
1577 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1578 if (!vs->modifiers_state[0x45]) {
1579 vs->modifiers_state[0x45] = 1;
1580 press_key(vs, 0xff7f);
1581 }
1582 } else {
1583 if (vs->modifiers_state[0x45]) {
1584 vs->modifiers_state[0x45] = 0;
1585 press_key(vs, 0xff7f);
1586 }
1587 }
1588 }
1589
1590 if (down && vs->vd->lock_key_sync &&
1591 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1592 /* If the capslock state needs to change then simulate an additional
1593 keypress before sending this one. This will happen if the user
1594 toggles capslock away from the VNC window.
1595 */
1596 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1597 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1598 int capslock = !!(vs->modifiers_state[0x3a]);
1599 if (capslock) {
1600 if (uppercase == shift) {
1601 vs->modifiers_state[0x3a] = 0;
1602 press_key(vs, 0xffe5);
1603 }
1604 } else {
1605 if (uppercase != shift) {
1606 vs->modifiers_state[0x3a] = 1;
1607 press_key(vs, 0xffe5);
1608 }
1609 }
1610 }
1611
1612 if (is_graphic_console()) {
1613 if (keycode & SCANCODE_GREY)
1614 kbd_put_keycode(SCANCODE_EMUL0);
1615 if (down)
1616 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1617 else
1618 kbd_put_keycode(keycode | SCANCODE_UP);
1619 } else {
1620 bool numlock = vs->modifiers_state[0x45];
1621 bool control = (vs->modifiers_state[0x1d] ||
1622 vs->modifiers_state[0x9d]);
1623 /* QEMU console emulation */
1624 if (down) {
1625 switch (keycode) {
1626 case 0x2a: /* Left Shift */
1627 case 0x36: /* Right Shift */
1628 case 0x1d: /* Left CTRL */
1629 case 0x9d: /* Right CTRL */
1630 case 0x38: /* Left ALT */
1631 case 0xb8: /* Right ALT */
1632 break;
1633 case 0xc8:
1634 kbd_put_keysym(QEMU_KEY_UP);
1635 break;
1636 case 0xd0:
1637 kbd_put_keysym(QEMU_KEY_DOWN);
1638 break;
1639 case 0xcb:
1640 kbd_put_keysym(QEMU_KEY_LEFT);
1641 break;
1642 case 0xcd:
1643 kbd_put_keysym(QEMU_KEY_RIGHT);
1644 break;
1645 case 0xd3:
1646 kbd_put_keysym(QEMU_KEY_DELETE);
1647 break;
1648 case 0xc7:
1649 kbd_put_keysym(QEMU_KEY_HOME);
1650 break;
1651 case 0xcf:
1652 kbd_put_keysym(QEMU_KEY_END);
1653 break;
1654 case 0xc9:
1655 kbd_put_keysym(QEMU_KEY_PAGEUP);
1656 break;
1657 case 0xd1:
1658 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1659 break;
1660
1661 case 0x47:
1662 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1663 break;
1664 case 0x48:
1665 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1666 break;
1667 case 0x49:
1668 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1669 break;
1670 case 0x4b:
1671 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1672 break;
1673 case 0x4c:
1674 kbd_put_keysym('5');
1675 break;
1676 case 0x4d:
1677 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1678 break;
1679 case 0x4f:
1680 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1681 break;
1682 case 0x50:
1683 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1684 break;
1685 case 0x51:
1686 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1687 break;
1688 case 0x52:
1689 kbd_put_keysym('0');
1690 break;
1691 case 0x53:
1692 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1693 break;
1694
1695 case 0xb5:
1696 kbd_put_keysym('/');
1697 break;
1698 case 0x37:
1699 kbd_put_keysym('*');
1700 break;
1701 case 0x4a:
1702 kbd_put_keysym('-');
1703 break;
1704 case 0x4e:
1705 kbd_put_keysym('+');
1706 break;
1707 case 0x9c:
1708 kbd_put_keysym('\n');
1709 break;
1710
1711 default:
1712 if (control) {
1713 kbd_put_keysym(sym & 0x1f);
1714 } else {
1715 kbd_put_keysym(sym);
1716 }
1717 break;
1718 }
1719 }
1720 }
1721 }
1722
1723 static void vnc_release_modifiers(VncState *vs)
1724 {
1725 static const int keycodes[] = {
1726 /* shift, control, alt keys, both left & right */
1727 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1728 };
1729 int i, keycode;
1730
1731 if (!is_graphic_console()) {
1732 return;
1733 }
1734 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1735 keycode = keycodes[i];
1736 if (!vs->modifiers_state[keycode]) {
1737 continue;
1738 }
1739 if (keycode & SCANCODE_GREY) {
1740 kbd_put_keycode(SCANCODE_EMUL0);
1741 }
1742 kbd_put_keycode(keycode | SCANCODE_UP);
1743 }
1744 }
1745
1746 static void key_event(VncState *vs, int down, uint32_t sym)
1747 {
1748 int keycode;
1749 int lsym = sym;
1750
1751 if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
1752 lsym = lsym - 'A' + 'a';
1753 }
1754
1755 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1756 do_key_event(vs, down, keycode, sym);
1757 }
1758
1759 static void ext_key_event(VncState *vs, int down,
1760 uint32_t sym, uint16_t keycode)
1761 {
1762 /* if the user specifies a keyboard layout, always use it */
1763 if (keyboard_layout)
1764 key_event(vs, down, sym);
1765 else
1766 do_key_event(vs, down, keycode, sym);
1767 }
1768
1769 static void framebuffer_update_request(VncState *vs, int incremental,
1770 int x_position, int y_position,
1771 int w, int h)
1772 {
1773 int i;
1774 const size_t width = ds_get_width(vs->ds) / 16;
1775
1776 if (y_position > ds_get_height(vs->ds))
1777 y_position = ds_get_height(vs->ds);
1778 if (y_position + h >= ds_get_height(vs->ds))
1779 h = ds_get_height(vs->ds) - y_position;
1780
1781 vs->need_update = 1;
1782 if (!incremental) {
1783 vs->force_update = 1;
1784 for (i = 0; i < h; i++) {
1785 bitmap_set(vs->dirty[y_position + i], 0, width);
1786 bitmap_clear(vs->dirty[y_position + i], width,
1787 VNC_DIRTY_BITS - width);
1788 }
1789 }
1790 }
1791
1792 static void send_ext_key_event_ack(VncState *vs)
1793 {
1794 vnc_lock_output(vs);
1795 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1796 vnc_write_u8(vs, 0);
1797 vnc_write_u16(vs, 1);
1798 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1799 VNC_ENCODING_EXT_KEY_EVENT);
1800 vnc_unlock_output(vs);
1801 vnc_flush(vs);
1802 }
1803
1804 static void send_ext_audio_ack(VncState *vs)
1805 {
1806 vnc_lock_output(vs);
1807 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1808 vnc_write_u8(vs, 0);
1809 vnc_write_u16(vs, 1);
1810 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1811 VNC_ENCODING_AUDIO);
1812 vnc_unlock_output(vs);
1813 vnc_flush(vs);
1814 }
1815
1816 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1817 {
1818 int i;
1819 unsigned int enc = 0;
1820
1821 vs->features = 0;
1822 vs->vnc_encoding = 0;
1823 vs->tight.compression = 9;
1824 vs->tight.quality = -1; /* Lossless by default */
1825 vs->absolute = -1;
1826
1827 /*
1828 * Start from the end because the encodings are sent in order of preference.
1829 * This way the preferred encoding (first encoding defined in the array)
1830 * will be set at the end of the loop.
1831 */
1832 for (i = n_encodings - 1; i >= 0; i--) {
1833 enc = encodings[i];
1834 switch (enc) {
1835 case VNC_ENCODING_RAW:
1836 vs->vnc_encoding = enc;
1837 break;
1838 case VNC_ENCODING_COPYRECT:
1839 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1840 break;
1841 case VNC_ENCODING_HEXTILE:
1842 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1843 vs->vnc_encoding = enc;
1844 break;
1845 case VNC_ENCODING_TIGHT:
1846 vs->features |= VNC_FEATURE_TIGHT_MASK;
1847 vs->vnc_encoding = enc;
1848 break;
1849 #ifdef CONFIG_VNC_PNG
1850 case VNC_ENCODING_TIGHT_PNG:
1851 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1852 vs->vnc_encoding = enc;
1853 break;
1854 #endif
1855 case VNC_ENCODING_ZLIB:
1856 vs->features |= VNC_FEATURE_ZLIB_MASK;
1857 vs->vnc_encoding = enc;
1858 break;
1859 case VNC_ENCODING_ZRLE:
1860 vs->features |= VNC_FEATURE_ZRLE_MASK;
1861 vs->vnc_encoding = enc;
1862 break;
1863 case VNC_ENCODING_ZYWRLE:
1864 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1865 vs->vnc_encoding = enc;
1866 break;
1867 case VNC_ENCODING_DESKTOPRESIZE:
1868 vs->features |= VNC_FEATURE_RESIZE_MASK;
1869 break;
1870 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1871 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1872 break;
1873 case VNC_ENCODING_RICH_CURSOR:
1874 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1875 break;
1876 case VNC_ENCODING_EXT_KEY_EVENT:
1877 send_ext_key_event_ack(vs);
1878 break;
1879 case VNC_ENCODING_AUDIO:
1880 send_ext_audio_ack(vs);
1881 break;
1882 case VNC_ENCODING_WMVi:
1883 vs->features |= VNC_FEATURE_WMVI_MASK;
1884 break;
1885 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1886 vs->tight.compression = (enc & 0x0F);
1887 break;
1888 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1889 if (vs->vd->lossy) {
1890 vs->tight.quality = (enc & 0x0F);
1891 }
1892 break;
1893 default:
1894 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1895 break;
1896 }
1897 }
1898 vnc_desktop_resize(vs);
1899 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1900 }
1901
1902 static void set_pixel_conversion(VncState *vs)
1903 {
1904 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
1905
1906 if (fmt == VNC_SERVER_FB_FORMAT) {
1907 vs->write_pixels = vnc_write_pixels_copy;
1908 vnc_hextile_set_pixel_conversion(vs, 0);
1909 } else {
1910 vs->write_pixels = vnc_write_pixels_generic;
1911 vnc_hextile_set_pixel_conversion(vs, 1);
1912 }
1913 }
1914
1915 static void set_pixel_format(VncState *vs,
1916 int bits_per_pixel, int depth,
1917 int big_endian_flag, int true_color_flag,
1918 int red_max, int green_max, int blue_max,
1919 int red_shift, int green_shift, int blue_shift)
1920 {
1921 if (!true_color_flag) {
1922 vnc_client_error(vs);
1923 return;
1924 }
1925
1926 vs->client_pf.rmax = red_max;
1927 vs->client_pf.rbits = hweight_long(red_max);
1928 vs->client_pf.rshift = red_shift;
1929 vs->client_pf.rmask = red_max << red_shift;
1930 vs->client_pf.gmax = green_max;
1931 vs->client_pf.gbits = hweight_long(green_max);
1932 vs->client_pf.gshift = green_shift;
1933 vs->client_pf.gmask = green_max << green_shift;
1934 vs->client_pf.bmax = blue_max;
1935 vs->client_pf.bbits = hweight_long(blue_max);
1936 vs->client_pf.bshift = blue_shift;
1937 vs->client_pf.bmask = blue_max << blue_shift;
1938 vs->client_pf.bits_per_pixel = bits_per_pixel;
1939 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
1940 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1941 vs->client_be = big_endian_flag;
1942
1943 set_pixel_conversion(vs);
1944
1945 vga_hw_invalidate();
1946 vga_hw_update();
1947 }
1948
1949 static void pixel_format_message (VncState *vs) {
1950 char pad[3] = { 0, 0, 0 };
1951
1952 vs->client_pf = qemu_default_pixelformat(32);
1953
1954 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
1955 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
1956
1957 #ifdef HOST_WORDS_BIGENDIAN
1958 vnc_write_u8(vs, 1); /* big-endian-flag */
1959 #else
1960 vnc_write_u8(vs, 0); /* big-endian-flag */
1961 #endif
1962 vnc_write_u8(vs, 1); /* true-color-flag */
1963 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
1964 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
1965 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
1966 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
1967 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
1968 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
1969 vnc_write(vs, pad, 3); /* padding */
1970
1971 vnc_hextile_set_pixel_conversion(vs, 0);
1972 vs->write_pixels = vnc_write_pixels_copy;
1973 }
1974
1975 static void vnc_dpy_setdata(DisplayState *ds)
1976 {
1977 VncDisplay *vd = ds->opaque;
1978
1979 qemu_pixman_image_unref(vd->guest.fb);
1980 vd->guest.fb = pixman_image_ref(ds->surface->image);
1981 vd->guest.format = ds->surface->format;
1982 vnc_dpy_update(ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
1983 }
1984
1985 static void vnc_colordepth(VncState *vs)
1986 {
1987 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1988 /* Sending a WMVi message to notify the client*/
1989 vnc_lock_output(vs);
1990 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1991 vnc_write_u8(vs, 0);
1992 vnc_write_u16(vs, 1); /* number of rects */
1993 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1994 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1995 pixel_format_message(vs);
1996 vnc_unlock_output(vs);
1997 vnc_flush(vs);
1998 } else {
1999 set_pixel_conversion(vs);
2000 }
2001 }
2002
2003 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2004 {
2005 int i;
2006 uint16_t limit;
2007 VncDisplay *vd = vs->vd;
2008
2009 if (data[0] > 3) {
2010 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2011 if (!qemu_timer_expired(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval))
2012 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
2013 }
2014
2015 switch (data[0]) {
2016 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2017 if (len == 1)
2018 return 20;
2019
2020 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
2021 read_u8(data, 6), read_u8(data, 7),
2022 read_u16(data, 8), read_u16(data, 10),
2023 read_u16(data, 12), read_u8(data, 14),
2024 read_u8(data, 15), read_u8(data, 16));
2025 break;
2026 case VNC_MSG_CLIENT_SET_ENCODINGS:
2027 if (len == 1)
2028 return 4;
2029
2030 if (len == 4) {
2031 limit = read_u16(data, 2);
2032 if (limit > 0)
2033 return 4 + (limit * 4);
2034 } else
2035 limit = read_u16(data, 2);
2036
2037 for (i = 0; i < limit; i++) {
2038 int32_t val = read_s32(data, 4 + (i * 4));
2039 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2040 }
2041
2042 set_encodings(vs, (int32_t *)(data + 4), limit);
2043 break;
2044 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2045 if (len == 1)
2046 return 10;
2047
2048 framebuffer_update_request(vs,
2049 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2050 read_u16(data, 6), read_u16(data, 8));
2051 break;
2052 case VNC_MSG_CLIENT_KEY_EVENT:
2053 if (len == 1)
2054 return 8;
2055
2056 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2057 break;
2058 case VNC_MSG_CLIENT_POINTER_EVENT:
2059 if (len == 1)
2060 return 6;
2061
2062 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2063 break;
2064 case VNC_MSG_CLIENT_CUT_TEXT:
2065 if (len == 1)
2066 return 8;
2067
2068 if (len == 8) {
2069 uint32_t dlen = read_u32(data, 4);
2070 if (dlen > 0)
2071 return 8 + dlen;
2072 }
2073
2074 client_cut_text(vs, read_u32(data, 4), data + 8);
2075 break;
2076 case VNC_MSG_CLIENT_QEMU:
2077 if (len == 1)
2078 return 2;
2079
2080 switch (read_u8(data, 1)) {
2081 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2082 if (len == 2)
2083 return 12;
2084
2085 ext_key_event(vs, read_u16(data, 2),
2086 read_u32(data, 4), read_u32(data, 8));
2087 break;
2088 case VNC_MSG_CLIENT_QEMU_AUDIO:
2089 if (len == 2)
2090 return 4;
2091
2092 switch (read_u16 (data, 2)) {
2093 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2094 audio_add(vs);
2095 break;
2096 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2097 audio_del(vs);
2098 break;
2099 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2100 if (len == 4)
2101 return 10;
2102 switch (read_u8(data, 4)) {
2103 case 0: vs->as.fmt = AUD_FMT_U8; break;
2104 case 1: vs->as.fmt = AUD_FMT_S8; break;
2105 case 2: vs->as.fmt = AUD_FMT_U16; break;
2106 case 3: vs->as.fmt = AUD_FMT_S16; break;
2107 case 4: vs->as.fmt = AUD_FMT_U32; break;
2108 case 5: vs->as.fmt = AUD_FMT_S32; break;
2109 default:
2110 printf("Invalid audio format %d\n", read_u8(data, 4));
2111 vnc_client_error(vs);
2112 break;
2113 }
2114 vs->as.nchannels = read_u8(data, 5);
2115 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2116 printf("Invalid audio channel coount %d\n",
2117 read_u8(data, 5));
2118 vnc_client_error(vs);
2119 break;
2120 }
2121 vs->as.freq = read_u32(data, 6);
2122 break;
2123 default:
2124 printf ("Invalid audio message %d\n", read_u8(data, 4));
2125 vnc_client_error(vs);
2126 break;
2127 }
2128 break;
2129
2130 default:
2131 printf("Msg: %d\n", read_u16(data, 0));
2132 vnc_client_error(vs);
2133 break;
2134 }
2135 break;
2136 default:
2137 printf("Msg: %d\n", data[0]);
2138 vnc_client_error(vs);
2139 break;
2140 }
2141
2142 vnc_read_when(vs, protocol_client_msg, 1);
2143 return 0;
2144 }
2145
2146 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2147 {
2148 char buf[1024];
2149 VncShareMode mode;
2150 int size;
2151
2152 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2153 switch (vs->vd->share_policy) {
2154 case VNC_SHARE_POLICY_IGNORE:
2155 /*
2156 * Ignore the shared flag. Nothing to do here.
2157 *
2158 * Doesn't conform to the rfb spec but is traditional qemu
2159 * behavior, thus left here as option for compatibility
2160 * reasons.
2161 */
2162 break;
2163 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2164 /*
2165 * Policy: Allow clients ask for exclusive access.
2166 *
2167 * Implementation: When a client asks for exclusive access,
2168 * disconnect all others. Shared connects are allowed as long
2169 * as no exclusive connection exists.
2170 *
2171 * This is how the rfb spec suggests to handle the shared flag.
2172 */
2173 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2174 VncState *client;
2175 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2176 if (vs == client) {
2177 continue;
2178 }
2179 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2180 client->share_mode != VNC_SHARE_MODE_SHARED) {
2181 continue;
2182 }
2183 vnc_disconnect_start(client);
2184 }
2185 }
2186 if (mode == VNC_SHARE_MODE_SHARED) {
2187 if (vs->vd->num_exclusive > 0) {
2188 vnc_disconnect_start(vs);
2189 return 0;
2190 }
2191 }
2192 break;
2193 case VNC_SHARE_POLICY_FORCE_SHARED:
2194 /*
2195 * Policy: Shared connects only.
2196 * Implementation: Disallow clients asking for exclusive access.
2197 *
2198 * Useful for shared desktop sessions where you don't want
2199 * someone forgetting to say -shared when running the vnc
2200 * client disconnect everybody else.
2201 */
2202 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2203 vnc_disconnect_start(vs);
2204 return 0;
2205 }
2206 break;
2207 }
2208 vnc_set_share_mode(vs, mode);
2209
2210 vs->client_width = ds_get_width(vs->ds);
2211 vs->client_height = ds_get_height(vs->ds);
2212 vnc_write_u16(vs, vs->client_width);
2213 vnc_write_u16(vs, vs->client_height);
2214
2215 pixel_format_message(vs);
2216
2217 if (qemu_name)
2218 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2219 else
2220 size = snprintf(buf, sizeof(buf), "QEMU");
2221
2222 vnc_write_u32(vs, size);
2223 vnc_write(vs, buf, size);
2224 vnc_flush(vs);
2225
2226 vnc_client_cache_auth(vs);
2227 vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2228
2229 vnc_read_when(vs, protocol_client_msg, 1);
2230
2231 return 0;
2232 }
2233
2234 void start_client_init(VncState *vs)
2235 {
2236 vnc_read_when(vs, protocol_client_init, 1);
2237 }
2238
2239 static void make_challenge(VncState *vs)
2240 {
2241 int i;
2242
2243 srand(time(NULL)+getpid()+getpid()*987654+rand());
2244
2245 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2246 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2247 }
2248
2249 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2250 {
2251 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2252 int i, j, pwlen;
2253 unsigned char key[8];
2254 time_t now = time(NULL);
2255
2256 if (!vs->vd->password) {
2257 VNC_DEBUG("No password configured on server");
2258 goto reject;
2259 }
2260 if (vs->vd->expires < now) {
2261 VNC_DEBUG("Password is expired");
2262 goto reject;
2263 }
2264
2265 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2266
2267 /* Calculate the expected challenge response */
2268 pwlen = strlen(vs->vd->password);
2269 for (i=0; i<sizeof(key); i++)
2270 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2271 deskey(key, EN0);
2272 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2273 des(response+j, response+j);
2274
2275 /* Compare expected vs actual challenge response */
2276 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2277 VNC_DEBUG("Client challenge response did not match\n");
2278 goto reject;
2279 } else {
2280 VNC_DEBUG("Accepting VNC challenge response\n");
2281 vnc_write_u32(vs, 0); /* Accept auth */
2282 vnc_flush(vs);
2283
2284 start_client_init(vs);
2285 }
2286 return 0;
2287
2288 reject:
2289 vnc_write_u32(vs, 1); /* Reject auth */
2290 if (vs->minor >= 8) {
2291 static const char err[] = "Authentication failed";
2292 vnc_write_u32(vs, sizeof(err));
2293 vnc_write(vs, err, sizeof(err));
2294 }
2295 vnc_flush(vs);
2296 vnc_client_error(vs);
2297 return 0;
2298 }
2299
2300 void start_auth_vnc(VncState *vs)
2301 {
2302 make_challenge(vs);
2303 /* Send client a 'random' challenge */
2304 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2305 vnc_flush(vs);
2306
2307 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2308 }
2309
2310
2311 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2312 {
2313 /* We only advertise 1 auth scheme at a time, so client
2314 * must pick the one we sent. Verify this */
2315 if (data[0] != vs->auth) { /* Reject auth */
2316 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2317 vnc_write_u32(vs, 1);
2318 if (vs->minor >= 8) {
2319 static const char err[] = "Authentication failed";
2320 vnc_write_u32(vs, sizeof(err));
2321 vnc_write(vs, err, sizeof(err));
2322 }
2323 vnc_client_error(vs);
2324 } else { /* Accept requested auth */
2325 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2326 switch (vs->auth) {
2327 case VNC_AUTH_NONE:
2328 VNC_DEBUG("Accept auth none\n");
2329 if (vs->minor >= 8) {
2330 vnc_write_u32(vs, 0); /* Accept auth completion */
2331 vnc_flush(vs);
2332 }
2333 start_client_init(vs);
2334 break;
2335
2336 case VNC_AUTH_VNC:
2337 VNC_DEBUG("Start VNC auth\n");
2338 start_auth_vnc(vs);
2339 break;
2340
2341 #ifdef CONFIG_VNC_TLS
2342 case VNC_AUTH_VENCRYPT:
2343 VNC_DEBUG("Accept VeNCrypt auth\n");
2344 start_auth_vencrypt(vs);
2345 break;
2346 #endif /* CONFIG_VNC_TLS */
2347
2348 #ifdef CONFIG_VNC_SASL
2349 case VNC_AUTH_SASL:
2350 VNC_DEBUG("Accept SASL auth\n");
2351 start_auth_sasl(vs);
2352 break;
2353 #endif /* CONFIG_VNC_SASL */
2354
2355 default: /* Should not be possible, but just in case */
2356 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2357 vnc_write_u8(vs, 1);
2358 if (vs->minor >= 8) {
2359 static const char err[] = "Authentication failed";
2360 vnc_write_u32(vs, sizeof(err));
2361 vnc_write(vs, err, sizeof(err));
2362 }
2363 vnc_client_error(vs);
2364 }
2365 }
2366 return 0;
2367 }
2368
2369 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2370 {
2371 char local[13];
2372
2373 memcpy(local, version, 12);
2374 local[12] = 0;
2375
2376 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2377 VNC_DEBUG("Malformed protocol version %s\n", local);
2378 vnc_client_error(vs);
2379 return 0;
2380 }
2381 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2382 if (vs->major != 3 ||
2383 (vs->minor != 3 &&
2384 vs->minor != 4 &&
2385 vs->minor != 5 &&
2386 vs->minor != 7 &&
2387 vs->minor != 8)) {
2388 VNC_DEBUG("Unsupported client version\n");
2389 vnc_write_u32(vs, VNC_AUTH_INVALID);
2390 vnc_flush(vs);
2391 vnc_client_error(vs);
2392 return 0;
2393 }
2394 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2395 * as equivalent to v3.3 by servers
2396 */
2397 if (vs->minor == 4 || vs->minor == 5)
2398 vs->minor = 3;
2399
2400 if (vs->minor == 3) {
2401 if (vs->auth == VNC_AUTH_NONE) {
2402 VNC_DEBUG("Tell client auth none\n");
2403 vnc_write_u32(vs, vs->auth);
2404 vnc_flush(vs);
2405 start_client_init(vs);
2406 } else if (vs->auth == VNC_AUTH_VNC) {
2407 VNC_DEBUG("Tell client VNC auth\n");
2408 vnc_write_u32(vs, vs->auth);
2409 vnc_flush(vs);
2410 start_auth_vnc(vs);
2411 } else {
2412 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2413 vnc_write_u32(vs, VNC_AUTH_INVALID);
2414 vnc_flush(vs);
2415 vnc_client_error(vs);
2416 }
2417 } else {
2418 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2419 vnc_write_u8(vs, 1); /* num auth */
2420 vnc_write_u8(vs, vs->auth);
2421 vnc_read_when(vs, protocol_client_auth, 1);
2422 vnc_flush(vs);
2423 }
2424
2425 return 0;
2426 }
2427
2428 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2429 {
2430 struct VncSurface *vs = &vd->guest;
2431
2432 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2433 }
2434
2435 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2436 {
2437 int i, j;
2438
2439 w = (x + w) / VNC_STAT_RECT;
2440 h = (y + h) / VNC_STAT_RECT;
2441 x /= VNC_STAT_RECT;
2442 y /= VNC_STAT_RECT;
2443
2444 for (j = y; j <= h; j++) {
2445 for (i = x; i <= w; i++) {
2446 vs->lossy_rect[j][i] = 1;
2447 }
2448 }
2449 }
2450
2451 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2452 {
2453 VncState *vs;
2454 int sty = y / VNC_STAT_RECT;
2455 int stx = x / VNC_STAT_RECT;
2456 int has_dirty = 0;
2457
2458 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2459 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2460
2461 QTAILQ_FOREACH(vs, &vd->clients, next) {
2462 int j;
2463
2464 /* kernel send buffers are full -> refresh later */
2465 if (vs->output.offset) {
2466 continue;
2467 }
2468
2469 if (!vs->lossy_rect[sty][stx]) {
2470 continue;
2471 }
2472
2473 vs->lossy_rect[sty][stx] = 0;
2474 for (j = 0; j < VNC_STAT_RECT; ++j) {
2475 bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);
2476 }
2477 has_dirty++;
2478 }
2479
2480 return has_dirty;
2481 }
2482
2483 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2484 {
2485 int width = pixman_image_get_width(vd->guest.fb);
2486 int height = pixman_image_get_height(vd->guest.fb);
2487 int x, y;
2488 struct timeval res;
2489 int has_dirty = 0;
2490
2491 for (y = 0; y < height; y += VNC_STAT_RECT) {
2492 for (x = 0; x < width; x += VNC_STAT_RECT) {
2493 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2494
2495 rect->updated = false;
2496 }
2497 }
2498
2499 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2500
2501 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2502 return has_dirty;
2503 }
2504 vd->guest.last_freq_check = *tv;
2505
2506 for (y = 0; y < height; y += VNC_STAT_RECT) {
2507 for (x = 0; x < width; x += VNC_STAT_RECT) {
2508 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2509 int count = ARRAY_SIZE(rect->times);
2510 struct timeval min, max;
2511
2512 if (!timerisset(&rect->times[count - 1])) {
2513 continue ;
2514 }
2515
2516 max = rect->times[(rect->idx + count - 1) % count];
2517 qemu_timersub(tv, &max, &res);
2518
2519 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2520 rect->freq = 0;
2521 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2522 memset(rect->times, 0, sizeof (rect->times));
2523 continue ;
2524 }
2525
2526 min = rect->times[rect->idx];
2527 max = rect->times[(rect->idx + count - 1) % count];
2528 qemu_timersub(&max, &min, &res);
2529
2530 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2531 rect->freq /= count;
2532 rect->freq = 1. / rect->freq;
2533 }
2534 }
2535 return has_dirty;
2536 }
2537
2538 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2539 {
2540 int i, j;
2541 double total = 0;
2542 int num = 0;
2543
2544 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2545 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2546
2547 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2548 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2549 total += vnc_stat_rect(vs->vd, i, j)->freq;
2550 num++;
2551 }
2552 }
2553
2554 if (num) {
2555 return total / num;
2556 } else {
2557 return 0;
2558 }
2559 }
2560
2561 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2562 {
2563 VncRectStat *rect;
2564
2565 rect = vnc_stat_rect(vd, x, y);
2566 if (rect->updated) {
2567 return ;
2568 }
2569 rect->times[rect->idx] = *tv;
2570 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2571 rect->updated = true;
2572 }
2573
2574 static int vnc_refresh_server_surface(VncDisplay *vd)
2575 {
2576 int width = pixman_image_get_width(vd->guest.fb);
2577 int height = pixman_image_get_height(vd->guest.fb);
2578 int y;
2579 uint8_t *guest_row;
2580 uint8_t *server_row;
2581 int cmp_bytes;
2582 VncState *vs;
2583 int has_dirty = 0;
2584 pixman_image_t *tmpbuf = NULL;
2585
2586 struct timeval tv = { 0, 0 };
2587
2588 if (!vd->non_adaptive) {
2589 gettimeofday(&tv, NULL);
2590 has_dirty = vnc_update_stats(vd, &tv);
2591 }
2592
2593 /*
2594 * Walk through the guest dirty map.
2595 * Check and copy modified bits from guest to server surface.
2596 * Update server dirty map.
2597 */
2598 cmp_bytes = 64;
2599 if (cmp_bytes > vnc_server_fb_stride(vd)) {
2600 cmp_bytes = vnc_server_fb_stride(vd);
2601 }
2602 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2603 int width = pixman_image_get_width(vd->server);
2604 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2605 }
2606 guest_row = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2607 server_row = (uint8_t *)pixman_image_get_data(vd->server);
2608 for (y = 0; y < height; y++) {
2609 if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) {
2610 int x;
2611 uint8_t *guest_ptr;
2612 uint8_t *server_ptr;
2613
2614 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2615 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2616 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2617 } else {
2618 guest_ptr = guest_row;
2619 }
2620 server_ptr = server_row;
2621
2622 for (x = 0; x + 15 < width;
2623 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2624 if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
2625 continue;
2626 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2627 continue;
2628 memcpy(server_ptr, guest_ptr, cmp_bytes);
2629 if (!vd->non_adaptive)
2630 vnc_rect_updated(vd, x, y, &tv);
2631 QTAILQ_FOREACH(vs, &vd->clients, next) {
2632 set_bit((x / 16), vs->dirty[y]);
2633 }
2634 has_dirty++;
2635 }
2636 }
2637 guest_row += pixman_image_get_stride(vd->guest.fb);
2638 server_row += pixman_image_get_stride(vd->server);
2639 }
2640 qemu_pixman_image_unref(tmpbuf);
2641 return has_dirty;
2642 }
2643
2644 static void vnc_refresh(void *opaque)
2645 {
2646 VncDisplay *vd = opaque;
2647 VncState *vs, *vn;
2648 int has_dirty, rects = 0;
2649
2650 vga_hw_update();
2651
2652 if (vnc_trylock_display(vd)) {
2653 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2654 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) +
2655 vd->timer_interval);
2656 return;
2657 }
2658
2659 has_dirty = vnc_refresh_server_surface(vd);
2660 vnc_unlock_display(vd);
2661
2662 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2663 rects += vnc_update_client(vs, has_dirty);
2664 /* vs might be free()ed here */
2665 }
2666
2667 /* vd->timer could be NULL now if the last client disconnected,
2668 * in this case don't update the timer */
2669 if (vd->timer == NULL)
2670 return;
2671
2672 if (has_dirty && rects) {
2673 vd->timer_interval /= 2;
2674 if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2675 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2676 } else {
2677 vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2678 if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2679 vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2680 }
2681 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
2682 }
2683
2684 static void vnc_init_timer(VncDisplay *vd)
2685 {
2686 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2687 if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
2688 vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
2689 vnc_dpy_resize(vd->ds);
2690 vnc_refresh(vd);
2691 }
2692 }
2693
2694 static void vnc_remove_timer(VncDisplay *vd)
2695 {
2696 if (vd->timer != NULL && QTAILQ_EMPTY(&vd->clients)) {
2697 qemu_del_timer(vd->timer);
2698 qemu_free_timer(vd->timer);
2699 vd->timer = NULL;
2700 }
2701 }
2702
2703 static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket)
2704 {
2705 VncState *vs = g_malloc0(sizeof(VncState));
2706 int i;
2707
2708 vs->csock = csock;
2709
2710 if (skipauth) {
2711 vs->auth = VNC_AUTH_NONE;
2712 #ifdef CONFIG_VNC_TLS
2713 vs->subauth = VNC_AUTH_INVALID;
2714 #endif
2715 } else {
2716 vs->auth = vd->auth;
2717 #ifdef CONFIG_VNC_TLS
2718 vs->subauth = vd->subauth;
2719 #endif
2720 }
2721
2722 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2723 for (i = 0; i < VNC_STAT_ROWS; ++i) {
2724 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
2725 }
2726
2727 VNC_DEBUG("New client on socket %d\n", csock);
2728 dcl->idle = 0;
2729 socket_set_nonblock(vs->csock);
2730 #ifdef CONFIG_VNC_WS
2731 if (websocket) {
2732 vs->websocket = 1;
2733 qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
2734 } else
2735 #endif /* CONFIG_VNC_WS */
2736 {
2737 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2738 }
2739
2740 vnc_client_cache_addr(vs);
2741 vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2742 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2743
2744 vs->vd = vd;
2745
2746 #ifdef CONFIG_VNC_WS
2747 if (!vs->websocket)
2748 #endif
2749 {
2750 vnc_init_state(vs);
2751 }
2752 }
2753
2754 void vnc_init_state(VncState *vs)
2755 {
2756 vs->initialized = true;
2757 VncDisplay *vd = vs->vd;
2758
2759 vs->ds = vd->ds;
2760 vs->last_x = -1;
2761 vs->last_y = -1;
2762
2763 vs->as.freq = 44100;
2764 vs->as.nchannels = 2;
2765 vs->as.fmt = AUD_FMT_S16;
2766 vs->as.endianness = 0;
2767
2768 qemu_mutex_init(&vs->output_mutex);
2769 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2770
2771 QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2772
2773 vga_hw_update();
2774
2775 vnc_write(vs, "RFB 003.008\n", 12);
2776 vnc_flush(vs);
2777 vnc_read_when(vs, protocol_version, 12);
2778 reset_keys(vs);
2779 if (vs->vd->lock_key_sync)
2780 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2781
2782 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2783 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2784
2785 vnc_init_timer(vd);
2786
2787 /* vs might be free()ed here */
2788 }
2789
2790 static void vnc_listen_read(void *opaque, bool websocket)
2791 {
2792 VncDisplay *vs = opaque;
2793 struct sockaddr_in addr;
2794 socklen_t addrlen = sizeof(addr);
2795 int csock;
2796
2797 /* Catch-up */
2798 vga_hw_update();
2799 #ifdef CONFIG_VNC_WS
2800 if (websocket) {
2801 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen);
2802 } else
2803 #endif /* CONFIG_VNC_WS */
2804 {
2805 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2806 }
2807
2808 if (csock != -1) {
2809 vnc_connect(vs, csock, 0, websocket);
2810 }
2811 }
2812
2813 static void vnc_listen_regular_read(void *opaque)
2814 {
2815 vnc_listen_read(opaque, 0);
2816 }
2817
2818 #ifdef CONFIG_VNC_WS
2819 static void vnc_listen_websocket_read(void *opaque)
2820 {
2821 vnc_listen_read(opaque, 1);
2822 }
2823 #endif /* CONFIG_VNC_WS */
2824
2825 void vnc_display_init(DisplayState *ds)
2826 {
2827 VncDisplay *vs = g_malloc0(sizeof(*vs));
2828
2829 dcl = g_malloc0(sizeof(DisplayChangeListener));
2830
2831 ds->opaque = vs;
2832 dcl->idle = 1;
2833 vnc_display = vs;
2834
2835 vs->lsock = -1;
2836 #ifdef CONFIG_VNC_WS
2837 vs->lwebsock = -1;
2838 #endif
2839
2840 vs->ds = ds;
2841 QTAILQ_INIT(&vs->clients);
2842 vs->expires = TIME_MAX;
2843
2844 if (keyboard_layout)
2845 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2846 else
2847 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2848
2849 if (!vs->kbd_layout)
2850 exit(1);
2851
2852 qemu_mutex_init(&vs->mutex);
2853 vnc_start_worker_thread();
2854
2855 dcl->dpy_gfx_copy = vnc_dpy_copy;
2856 dcl->dpy_gfx_update = vnc_dpy_update;
2857 dcl->dpy_gfx_resize = vnc_dpy_resize;
2858 dcl->dpy_gfx_setdata = vnc_dpy_setdata;
2859 dcl->dpy_mouse_set = vnc_mouse_set;
2860 dcl->dpy_cursor_define = vnc_dpy_cursor_define;
2861 register_displaychangelistener(ds, dcl);
2862 }
2863
2864
2865 static void vnc_display_close(DisplayState *ds)
2866 {
2867 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2868
2869 if (!vs)
2870 return;
2871 if (vs->display) {
2872 g_free(vs->display);
2873 vs->display = NULL;
2874 }
2875 if (vs->lsock != -1) {
2876 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2877 close(vs->lsock);
2878 vs->lsock = -1;
2879 }
2880 #ifdef CONFIG_VNC_WS
2881 g_free(vs->ws_display);
2882 vs->ws_display = NULL;
2883 if (vs->lwebsock != -1) {
2884 qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);
2885 close(vs->lwebsock);
2886 vs->lwebsock = -1;
2887 }
2888 #endif /* CONFIG_VNC_WS */
2889 vs->auth = VNC_AUTH_INVALID;
2890 #ifdef CONFIG_VNC_TLS
2891 vs->subauth = VNC_AUTH_INVALID;
2892 vs->tls.x509verify = 0;
2893 #endif
2894 }
2895
2896 static int vnc_display_disable_login(DisplayState *ds)
2897 {
2898 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2899
2900 if (!vs) {
2901 return -1;
2902 }
2903
2904 if (vs->password) {
2905 g_free(vs->password);
2906 }
2907
2908 vs->password = NULL;
2909 if (vs->auth == VNC_AUTH_NONE) {
2910 vs->auth = VNC_AUTH_VNC;
2911 }
2912
2913 return 0;
2914 }
2915
2916 int vnc_display_password(DisplayState *ds, const char *password)
2917 {
2918 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2919
2920 if (!vs) {
2921 return -EINVAL;
2922 }
2923
2924 if (!password) {
2925 /* This is not the intention of this interface but err on the side
2926 of being safe */
2927 return vnc_display_disable_login(ds);
2928 }
2929
2930 if (vs->password) {
2931 g_free(vs->password);
2932 vs->password = NULL;
2933 }
2934 vs->password = g_strdup(password);
2935 if (vs->auth == VNC_AUTH_NONE) {
2936 vs->auth = VNC_AUTH_VNC;
2937 }
2938
2939 return 0;
2940 }
2941
2942 int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2943 {
2944 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2945
2946 if (!vs) {
2947 return -EINVAL;
2948 }
2949
2950 vs->expires = expires;
2951 return 0;
2952 }
2953
2954 char *vnc_display_local_addr(DisplayState *ds)
2955 {
2956 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2957
2958 return vnc_socket_local_addr("%s:%s", vs->lsock);
2959 }
2960
2961 void vnc_display_open(DisplayState *ds, const char *display, Error **errp)
2962 {
2963 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2964 const char *options;
2965 int password = 0;
2966 int reverse = 0;
2967 #ifdef CONFIG_VNC_TLS
2968 int tls = 0, x509 = 0;
2969 #endif
2970 #ifdef CONFIG_VNC_SASL
2971 int sasl = 0;
2972 int saslErr;
2973 #endif
2974 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2975 int acl = 0;
2976 #endif
2977 int lock_key_sync = 1;
2978
2979 if (!vnc_display) {
2980 error_setg(errp, "VNC display not active");
2981 return;
2982 }
2983 vnc_display_close(ds);
2984 if (strcmp(display, "none") == 0)
2985 return;
2986
2987 vs->display = g_strdup(display);
2988 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2989
2990 options = display;
2991 while ((options = strchr(options, ','))) {
2992 options++;
2993 if (strncmp(options, "password", 8) == 0) {
2994 if (fips_get_state()) {
2995 error_setg(errp,
2996 "VNC password auth disabled due to FIPS mode, "
2997 "consider using the VeNCrypt or SASL authentication "
2998 "methods as an alternative");
2999 goto fail;
3000 }
3001 password = 1; /* Require password auth */
3002 } else if (strncmp(options, "reverse", 7) == 0) {
3003 reverse = 1;
3004 } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
3005 lock_key_sync = 0;
3006 #ifdef CONFIG_VNC_SASL
3007 } else if (strncmp(options, "sasl", 4) == 0) {
3008 sasl = 1; /* Require SASL auth */
3009 #endif
3010 #ifdef CONFIG_VNC_WS
3011 } else if (strncmp(options, "websocket", 9) == 0) {
3012 char *start, *end;
3013 vs->websocket = 1;
3014
3015 /* Check for 'websocket=<port>' */
3016 start = strchr(options, '=');
3017 end = strchr(options, ',');
3018 if (start && (!end || (start < end))) {
3019 int len = end ? end-(start+1) : strlen(start+1);
3020 if (len < 6) {
3021 /* extract the host specification from display */
3022 char *host = NULL, *port = NULL, *host_end = NULL;
3023 port = g_strndup(start + 1, len);
3024
3025 /* ipv6 hosts have colons */
3026 end = strchr(display, ',');
3027 host_end = g_strrstr_len(display, end - display, ":");
3028
3029 if (host_end) {
3030 host = g_strndup(display, host_end - display + 1);
3031 } else {
3032 host = g_strndup(":", 1);
3033 }
3034 vs->ws_display = g_strconcat(host, port, NULL);
3035 g_free(host);
3036 g_free(port);
3037 }
3038 }
3039 #endif /* CONFIG_VNC_WS */
3040 #ifdef CONFIG_VNC_TLS
3041 } else if (strncmp(options, "tls", 3) == 0) {
3042 tls = 1; /* Require TLS */
3043 } else if (strncmp(options, "x509", 4) == 0) {
3044 char *start, *end;
3045 x509 = 1; /* Require x509 certificates */
3046 if (strncmp(options, "x509verify", 10) == 0)
3047 vs->tls.x509verify = 1; /* ...and verify client certs */
3048
3049 /* Now check for 'x509=/some/path' postfix
3050 * and use that to setup x509 certificate/key paths */
3051 start = strchr(options, '=');
3052 end = strchr(options, ',');
3053 if (start && (!end || (start < end))) {
3054 int len = end ? end-(start+1) : strlen(start+1);
3055 char *path = g_strndup(start + 1, len);
3056
3057 VNC_DEBUG("Trying certificate path '%s'\n", path);
3058 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
3059 error_setg(errp, "Failed to find x509 certificates/keys in %s", path);
3060 g_free(path);
3061 goto fail;
3062 }
3063 g_free(path);
3064 } else {
3065 error_setg(errp, "No certificate path provided");
3066 goto fail;
3067 }
3068 #endif
3069 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
3070 } else if (strncmp(options, "acl", 3) == 0) {
3071 acl = 1;
3072 #endif
3073 } else if (strncmp(options, "lossy", 5) == 0) {
3074 vs->lossy = true;
3075 } else if (strncmp(options, "non-adaptive", 12) == 0) {
3076 vs->non_adaptive = true;
3077 } else if (strncmp(options, "share=", 6) == 0) {
3078 if (strncmp(options+6, "ignore", 6) == 0) {
3079 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
3080 } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
3081 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3082 } else if (strncmp(options+6, "force-shared", 12) == 0) {
3083 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3084 } else {
3085 error_setg(errp, "unknown vnc share= option");
3086 goto fail;
3087 }
3088 }
3089 }
3090
3091 #ifdef CONFIG_VNC_TLS
3092 if (acl && x509 && vs->tls.x509verify) {
3093 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
3094 fprintf(stderr, "Failed to create x509 dname ACL\n");
3095 exit(1);
3096 }
3097 }
3098 #endif
3099 #ifdef CONFIG_VNC_SASL
3100 if (acl && sasl) {
3101 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
3102 fprintf(stderr, "Failed to create username ACL\n");
3103 exit(1);
3104 }
3105 }
3106 #endif
3107
3108 /*
3109 * Combinations we support here:
3110 *
3111 * - no-auth (clear text, no auth)
3112 * - password (clear text, weak auth)
3113 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
3114 * - tls (encrypt, weak anonymous creds, no auth)
3115 * - tls + password (encrypt, weak anonymous creds, weak auth)
3116 * - tls + sasl (encrypt, weak anonymous creds, good auth)
3117 * - tls + x509 (encrypt, good x509 creds, no auth)
3118 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
3119 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
3120 *
3121 * NB1. TLS is a stackable auth scheme.
3122 * NB2. the x509 schemes have option to validate a client cert dname
3123 */
3124 if (password) {
3125 #ifdef CONFIG_VNC_TLS
3126 if (tls) {
3127 vs->auth = VNC_AUTH_VENCRYPT;
3128 if (x509) {
3129 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3130 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3131 } else {
3132 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3133 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3134 }
3135 } else {
3136 #endif /* CONFIG_VNC_TLS */
3137 VNC_DEBUG("Initializing VNC server with password auth\n");
3138 vs->auth = VNC_AUTH_VNC;
3139 #ifdef CONFIG_VNC_TLS
3140 vs->subauth = VNC_AUTH_INVALID;
3141 }
3142 #endif /* CONFIG_VNC_TLS */
3143 #ifdef CONFIG_VNC_SASL
3144 } else if (sasl) {
3145 #ifdef CONFIG_VNC_TLS
3146 if (tls) {
3147 vs->auth = VNC_AUTH_VENCRYPT;
3148 if (x509) {
3149 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3150 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3151 } else {
3152 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3153 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3154 }
3155 } else {
3156 #endif /* CONFIG_VNC_TLS */
3157 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3158 vs->auth = VNC_AUTH_SASL;
3159 #ifdef CONFIG_VNC_TLS
3160 vs->subauth = VNC_AUTH_INVALID;
3161 }
3162 #endif /* CONFIG_VNC_TLS */
3163 #endif /* CONFIG_VNC_SASL */
3164 } else {
3165 #ifdef CONFIG_VNC_TLS
3166 if (tls) {
3167 vs->auth = VNC_AUTH_VENCRYPT;
3168 if (x509) {
3169 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3170 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3171 } else {
3172 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3173 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3174 }
3175 } else {
3176 #endif
3177 VNC_DEBUG("Initializing VNC server with no auth\n");
3178 vs->auth = VNC_AUTH_NONE;
3179 #ifdef CONFIG_VNC_TLS
3180 vs->subauth = VNC_AUTH_INVALID;
3181 }
3182 #endif
3183 }
3184
3185 #ifdef CONFIG_VNC_SASL
3186 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3187 error_setg(errp, "Failed to initialize SASL auth: %s",
3188 sasl_errstring(saslErr, NULL, NULL));
3189 goto fail;
3190 }
3191 #endif
3192 vs->lock_key_sync = lock_key_sync;
3193
3194 if (reverse) {
3195 /* connect to viewer */
3196 int csock;
3197 vs->lsock = -1;
3198 #ifdef CONFIG_VNC_WS
3199 vs->lwebsock = -1;
3200 #endif
3201 if (strncmp(display, "unix:", 5) == 0) {
3202 csock = unix_connect(display+5, errp);
3203 } else {
3204 csock = inet_connect(display, errp);
3205 }
3206 if (csock < 0) {
3207 goto fail;
3208 }
3209 vnc_connect(vs, csock, 0, 0);
3210 } else {
3211 /* listen for connects */
3212 char *dpy;
3213 dpy = g_malloc(256);
3214 if (strncmp(display, "unix:", 5) == 0) {
3215 pstrcpy(dpy, 256, "unix:");
3216 vs->lsock = unix_listen(display+5, dpy+5, 256-5, errp);
3217 } else {
3218 vs->lsock = inet_listen(display, dpy, 256,
3219 SOCK_STREAM, 5900, errp);
3220 if (vs->lsock < 0) {
3221 g_free(dpy);
3222 goto fail;
3223 }
3224 #ifdef CONFIG_VNC_WS
3225 if (vs->websocket) {
3226 if (vs->ws_display) {
3227 vs->lwebsock = inet_listen(vs->ws_display, NULL, 256,
3228 SOCK_STREAM, 0, errp);
3229 } else {
3230 vs->lwebsock = inet_listen(vs->display, NULL, 256,
3231 SOCK_STREAM, 5700, errp);
3232 }
3233
3234 if (vs->lwebsock < 0) {
3235 if (vs->lsock) {
3236 close(vs->lsock);
3237 vs->lsock = -1;
3238 }
3239 g_free(dpy);
3240 goto fail;
3241 }
3242 }
3243 #endif /* CONFIG_VNC_WS */
3244 }
3245 g_free(vs->display);
3246 vs->display = dpy;
3247 qemu_set_fd_handler2(vs->lsock, NULL,
3248 vnc_listen_regular_read, NULL, vs);
3249 #ifdef CONFIG_VNC_WS
3250 if (vs->websocket) {
3251 qemu_set_fd_handler2(vs->lwebsock, NULL,
3252 vnc_listen_websocket_read, NULL, vs);
3253 }
3254 #endif /* CONFIG_VNC_WS */
3255 }
3256 return;
3257
3258 fail:
3259 g_free(vs->display);
3260 vs->display = NULL;
3261 #ifdef CONFIG_VNC_WS
3262 g_free(vs->ws_display);
3263 vs->ws_display = NULL;
3264 #endif /* CONFIG_VNC_WS */
3265 }
3266
3267 void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3268 {
3269 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
3270
3271 vnc_connect(vs, csock, skipauth, 0);
3272 }
Qemu copy for testing