]> git.proxmox.com Git - mirror_qemu.git/blob - ui/vnc.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
vnc: Support for LED state extension
[mirror_qemu.git] / ui / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "vnc-jobs.h"
29 #include "sysemu/sysemu.h"
30 #include "qemu/sockets.h"
31 #include "qemu/timer.h"
32 #include "qemu/acl.h"
33 #include "qapi/qmp/types.h"
34 #include "qmp-commands.h"
35 #include "qemu/osdep.h"
36
37 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
38 #define VNC_REFRESH_INTERVAL_INC 50
39 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
40 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
41 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
42
43 #include "vnc_keysym.h"
44 #include "d3des.h"
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47
48 static int vnc_cursor_define(VncState *vs);
49 static void vnc_release_modifiers(VncState *vs);
50
51 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
52 {
53 #ifdef _VNC_DEBUG
54 static const char *mn[] = {
55 [0] = "undefined",
56 [VNC_SHARE_MODE_CONNECTING] = "connecting",
57 [VNC_SHARE_MODE_SHARED] = "shared",
58 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
59 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
60 };
61 fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
62 vs->csock, mn[vs->share_mode], mn[mode]);
63 #endif
64
65 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
66 vs->vd->num_exclusive--;
67 }
68 vs->share_mode = mode;
69 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
70 vs->vd->num_exclusive++;
71 }
72 }
73
74 static char *addr_to_string(const char *format,
75 struct sockaddr_storage *sa,
76 socklen_t salen) {
77 char *addr;
78 char host[NI_MAXHOST];
79 char serv[NI_MAXSERV];
80 int err;
81 size_t addrlen;
82
83 if ((err = getnameinfo((struct sockaddr *)sa, salen,
84 host, sizeof(host),
85 serv, sizeof(serv),
86 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
87 VNC_DEBUG("Cannot resolve address %d: %s\n",
88 err, gai_strerror(err));
89 return NULL;
90 }
91
92 /* Enough for the existing format + the 2 vars we're
93 * substituting in. */
94 addrlen = strlen(format) + strlen(host) + strlen(serv);
95 addr = g_malloc(addrlen + 1);
96 snprintf(addr, addrlen, format, host, serv);
97 addr[addrlen] = '\0';
98
99 return addr;
100 }
101
102
103 char *vnc_socket_local_addr(const char *format, int fd) {
104 struct sockaddr_storage sa;
105 socklen_t salen;
106
107 salen = sizeof(sa);
108 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
109 return NULL;
110
111 return addr_to_string(format, &sa, salen);
112 }
113
114 char *vnc_socket_remote_addr(const char *format, int fd) {
115 struct sockaddr_storage sa;
116 socklen_t salen;
117
118 salen = sizeof(sa);
119 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
120 return NULL;
121
122 return addr_to_string(format, &sa, salen);
123 }
124
125 static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
126 socklen_t salen)
127 {
128 char host[NI_MAXHOST];
129 char serv[NI_MAXSERV];
130 int err;
131
132 if ((err = getnameinfo((struct sockaddr *)sa, salen,
133 host, sizeof(host),
134 serv, sizeof(serv),
135 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
136 VNC_DEBUG("Cannot resolve address %d: %s\n",
137 err, gai_strerror(err));
138 return -1;
139 }
140
141 qdict_put(qdict, "host", qstring_from_str(host));
142 qdict_put(qdict, "service", qstring_from_str(serv));
143 qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
144
145 return 0;
146 }
147
148 static int vnc_server_addr_put(QDict *qdict, int fd)
149 {
150 struct sockaddr_storage sa;
151 socklen_t salen;
152
153 salen = sizeof(sa);
154 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
155 return -1;
156 }
157
158 return put_addr_qdict(qdict, &sa, salen);
159 }
160
161 static int vnc_qdict_remote_addr(QDict *qdict, int fd)
162 {
163 struct sockaddr_storage sa;
164 socklen_t salen;
165
166 salen = sizeof(sa);
167 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
168 return -1;
169 }
170
171 return put_addr_qdict(qdict, &sa, salen);
172 }
173
174 static const char *vnc_auth_name(VncDisplay *vd) {
175 switch (vd->auth) {
176 case VNC_AUTH_INVALID:
177 return "invalid";
178 case VNC_AUTH_NONE:
179 return "none";
180 case VNC_AUTH_VNC:
181 return "vnc";
182 case VNC_AUTH_RA2:
183 return "ra2";
184 case VNC_AUTH_RA2NE:
185 return "ra2ne";
186 case VNC_AUTH_TIGHT:
187 return "tight";
188 case VNC_AUTH_ULTRA:
189 return "ultra";
190 case VNC_AUTH_TLS:
191 return "tls";
192 case VNC_AUTH_VENCRYPT:
193 #ifdef CONFIG_VNC_TLS
194 switch (vd->subauth) {
195 case VNC_AUTH_VENCRYPT_PLAIN:
196 return "vencrypt+plain";
197 case VNC_AUTH_VENCRYPT_TLSNONE:
198 return "vencrypt+tls+none";
199 case VNC_AUTH_VENCRYPT_TLSVNC:
200 return "vencrypt+tls+vnc";
201 case VNC_AUTH_VENCRYPT_TLSPLAIN:
202 return "vencrypt+tls+plain";
203 case VNC_AUTH_VENCRYPT_X509NONE:
204 return "vencrypt+x509+none";
205 case VNC_AUTH_VENCRYPT_X509VNC:
206 return "vencrypt+x509+vnc";
207 case VNC_AUTH_VENCRYPT_X509PLAIN:
208 return "vencrypt+x509+plain";
209 case VNC_AUTH_VENCRYPT_TLSSASL:
210 return "vencrypt+tls+sasl";
211 case VNC_AUTH_VENCRYPT_X509SASL:
212 return "vencrypt+x509+sasl";
213 default:
214 return "vencrypt";
215 }
216 #else
217 return "vencrypt";
218 #endif
219 case VNC_AUTH_SASL:
220 return "sasl";
221 }
222 return "unknown";
223 }
224
225 static int vnc_server_info_put(QDict *qdict)
226 {
227 if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
228 return -1;
229 }
230
231 qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
232 return 0;
233 }
234
235 static void vnc_client_cache_auth(VncState *client)
236 {
237 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
238 QDict *qdict;
239 #endif
240
241 if (!client->info) {
242 return;
243 }
244
245 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
246 qdict = qobject_to_qdict(client->info);
247 #endif
248
249 #ifdef CONFIG_VNC_TLS
250 if (client->tls.session &&
251 client->tls.dname) {
252 qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
253 }
254 #endif
255 #ifdef CONFIG_VNC_SASL
256 if (client->sasl.conn &&
257 client->sasl.username) {
258 qdict_put(qdict, "sasl_username",
259 qstring_from_str(client->sasl.username));
260 }
261 #endif
262 }
263
264 static void vnc_client_cache_addr(VncState *client)
265 {
266 QDict *qdict;
267
268 qdict = qdict_new();
269 if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
270 QDECREF(qdict);
271 /* XXX: how to report the error? */
272 return;
273 }
274
275 client->info = QOBJECT(qdict);
276 }
277
278 static void vnc_qmp_event(VncState *vs, MonitorEvent event)
279 {
280 QDict *server;
281 QObject *data;
282
283 if (!vs->info) {
284 return;
285 }
286
287 server = qdict_new();
288 if (vnc_server_info_put(server) < 0) {
289 QDECREF(server);
290 return;
291 }
292
293 data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
294 vs->info, QOBJECT(server));
295
296 monitor_protocol_event(event, data);
297
298 qobject_incref(vs->info);
299 qobject_decref(data);
300 }
301
302 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
303 {
304 struct sockaddr_storage sa;
305 socklen_t salen = sizeof(sa);
306 char host[NI_MAXHOST];
307 char serv[NI_MAXSERV];
308 VncClientInfo *info;
309
310 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
311 return NULL;
312 }
313
314 if (getnameinfo((struct sockaddr *)&sa, salen,
315 host, sizeof(host),
316 serv, sizeof(serv),
317 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
318 return NULL;
319 }
320
321 info = g_malloc0(sizeof(*info));
322 info->host = g_strdup(host);
323 info->service = g_strdup(serv);
324 info->family = g_strdup(inet_strfamily(sa.ss_family));
325
326 #ifdef CONFIG_VNC_TLS
327 if (client->tls.session && client->tls.dname) {
328 info->has_x509_dname = true;
329 info->x509_dname = g_strdup(client->tls.dname);
330 }
331 #endif
332 #ifdef CONFIG_VNC_SASL
333 if (client->sasl.conn && client->sasl.username) {
334 info->has_sasl_username = true;
335 info->sasl_username = g_strdup(client->sasl.username);
336 }
337 #endif
338
339 return info;
340 }
341
342 VncInfo *qmp_query_vnc(Error **errp)
343 {
344 VncInfo *info = g_malloc0(sizeof(*info));
345
346 if (vnc_display == NULL || vnc_display->display == NULL) {
347 info->enabled = false;
348 } else {
349 VncClientInfoList *cur_item = NULL;
350 struct sockaddr_storage sa;
351 socklen_t salen = sizeof(sa);
352 char host[NI_MAXHOST];
353 char serv[NI_MAXSERV];
354 VncState *client;
355
356 info->enabled = true;
357
358 /* for compatibility with the original command */
359 info->has_clients = true;
360
361 QTAILQ_FOREACH(client, &vnc_display->clients, next) {
362 VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
363 cinfo->value = qmp_query_vnc_client(client);
364
365 /* XXX: waiting for the qapi to support GSList */
366 if (!cur_item) {
367 info->clients = cur_item = cinfo;
368 } else {
369 cur_item->next = cinfo;
370 cur_item = cinfo;
371 }
372 }
373
374 if (vnc_display->lsock == -1) {
375 return info;
376 }
377
378 if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
379 &salen) == -1) {
380 error_set(errp, QERR_UNDEFINED_ERROR);
381 goto out_error;
382 }
383
384 if (getnameinfo((struct sockaddr *)&sa, salen,
385 host, sizeof(host),
386 serv, sizeof(serv),
387 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
388 error_set(errp, QERR_UNDEFINED_ERROR);
389 goto out_error;
390 }
391
392 info->has_host = true;
393 info->host = g_strdup(host);
394
395 info->has_service = true;
396 info->service = g_strdup(serv);
397
398 info->has_family = true;
399 info->family = g_strdup(inet_strfamily(sa.ss_family));
400
401 info->has_auth = true;
402 info->auth = g_strdup(vnc_auth_name(vnc_display));
403 }
404
405 return info;
406
407 out_error:
408 qapi_free_VncInfo(info);
409 return NULL;
410 }
411
412 /* TODO
413 1) Get the queue working for IO.
414 2) there is some weirdness when using the -S option (the screen is grey
415 and not totally invalidated
416 3) resolutions > 1024
417 */
418
419 static int vnc_update_client(VncState *vs, int has_dirty);
420 static int vnc_update_client_sync(VncState *vs, int has_dirty);
421 static void vnc_disconnect_start(VncState *vs);
422
423 static void vnc_colordepth(VncState *vs);
424 static void framebuffer_update_request(VncState *vs, int incremental,
425 int x_position, int y_position,
426 int w, int h);
427 static void vnc_refresh(DisplayChangeListener *dcl);
428 static int vnc_refresh_server_surface(VncDisplay *vd);
429
430 static void vnc_dpy_update(DisplayChangeListener *dcl,
431 int x, int y, int w, int h)
432 {
433 int i;
434 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
435 struct VncSurface *s = &vd->guest;
436 int width = surface_width(vd->ds);
437 int height = surface_height(vd->ds);
438
439 h += y;
440
441 /* round x down to ensure the loop only spans one 16-pixel block per,
442 iteration. otherwise, if (x % 16) != 0, the last iteration may span
443 two 16-pixel blocks but we only mark the first as dirty
444 */
445 w += (x % 16);
446 x -= (x % 16);
447
448 x = MIN(x, width);
449 y = MIN(y, height);
450 w = MIN(x + w, width) - x;
451 h = MIN(h, height);
452
453 for (; y < h; y++)
454 for (i = 0; i < w; i += 16)
455 set_bit((x + i) / 16, s->dirty[y]);
456 }
457
458 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
459 int32_t encoding)
460 {
461 vnc_write_u16(vs, x);
462 vnc_write_u16(vs, y);
463 vnc_write_u16(vs, w);
464 vnc_write_u16(vs, h);
465
466 vnc_write_s32(vs, encoding);
467 }
468
469 void buffer_reserve(Buffer *buffer, size_t len)
470 {
471 if ((buffer->capacity - buffer->offset) < len) {
472 buffer->capacity += (len + 1024);
473 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
474 if (buffer->buffer == NULL) {
475 fprintf(stderr, "vnc: out of memory\n");
476 exit(1);
477 }
478 }
479 }
480
481 static int buffer_empty(Buffer *buffer)
482 {
483 return buffer->offset == 0;
484 }
485
486 uint8_t *buffer_end(Buffer *buffer)
487 {
488 return buffer->buffer + buffer->offset;
489 }
490
491 void buffer_reset(Buffer *buffer)
492 {
493 buffer->offset = 0;
494 }
495
496 void buffer_free(Buffer *buffer)
497 {
498 g_free(buffer->buffer);
499 buffer->offset = 0;
500 buffer->capacity = 0;
501 buffer->buffer = NULL;
502 }
503
504 void buffer_append(Buffer *buffer, const void *data, size_t len)
505 {
506 memcpy(buffer->buffer + buffer->offset, data, len);
507 buffer->offset += len;
508 }
509
510 void buffer_advance(Buffer *buf, size_t len)
511 {
512 memmove(buf->buffer, buf->buffer + len,
513 (buf->offset - len));
514 buf->offset -= len;
515 }
516
517 static void vnc_desktop_resize(VncState *vs)
518 {
519 DisplaySurface *ds = vs->vd->ds;
520
521 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
522 return;
523 }
524 if (vs->client_width == surface_width(ds) &&
525 vs->client_height == surface_height(ds)) {
526 return;
527 }
528 vs->client_width = surface_width(ds);
529 vs->client_height = surface_height(ds);
530 vnc_lock_output(vs);
531 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
532 vnc_write_u8(vs, 0);
533 vnc_write_u16(vs, 1); /* number of rects */
534 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
535 VNC_ENCODING_DESKTOPRESIZE);
536 vnc_unlock_output(vs);
537 vnc_flush(vs);
538 }
539
540 static void vnc_abort_display_jobs(VncDisplay *vd)
541 {
542 VncState *vs;
543
544 QTAILQ_FOREACH(vs, &vd->clients, next) {
545 vnc_lock_output(vs);
546 vs->abort = true;
547 vnc_unlock_output(vs);
548 }
549 QTAILQ_FOREACH(vs, &vd->clients, next) {
550 vnc_jobs_join(vs);
551 }
552 QTAILQ_FOREACH(vs, &vd->clients, next) {
553 vnc_lock_output(vs);
554 vs->abort = false;
555 vnc_unlock_output(vs);
556 }
557 }
558
559 int vnc_server_fb_stride(VncDisplay *vd)
560 {
561 return pixman_image_get_stride(vd->server);
562 }
563
564 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
565 {
566 uint8_t *ptr;
567
568 ptr = (uint8_t *)pixman_image_get_data(vd->server);
569 ptr += y * vnc_server_fb_stride(vd);
570 ptr += x * VNC_SERVER_FB_BYTES;
571 return ptr;
572 }
573
574 static void vnc_dpy_switch(DisplayChangeListener *dcl,
575 DisplaySurface *surface)
576 {
577 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
578 VncState *vs;
579
580 vnc_abort_display_jobs(vd);
581
582 /* server surface */
583 qemu_pixman_image_unref(vd->server);
584 vd->ds = surface;
585 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
586 surface_width(vd->ds),
587 surface_height(vd->ds),
588 NULL, 0);
589
590 /* guest surface */
591 #if 0 /* FIXME */
592 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
593 console_color_init(ds);
594 #endif
595 qemu_pixman_image_unref(vd->guest.fb);
596 vd->guest.fb = pixman_image_ref(surface->image);
597 vd->guest.format = surface->format;
598 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
599
600 QTAILQ_FOREACH(vs, &vd->clients, next) {
601 vnc_colordepth(vs);
602 vnc_desktop_resize(vs);
603 if (vs->vd->cursor) {
604 vnc_cursor_define(vs);
605 }
606 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
607 }
608 }
609
610 /* fastest code */
611 static void vnc_write_pixels_copy(VncState *vs,
612 void *pixels, int size)
613 {
614 vnc_write(vs, pixels, size);
615 }
616
617 /* slowest but generic code. */
618 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
619 {
620 uint8_t r, g, b;
621
622 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
623 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
624 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
625 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
626 #else
627 # error need some bits here if you change VNC_SERVER_FB_FORMAT
628 #endif
629 v = (r << vs->client_pf.rshift) |
630 (g << vs->client_pf.gshift) |
631 (b << vs->client_pf.bshift);
632 switch (vs->client_pf.bytes_per_pixel) {
633 case 1:
634 buf[0] = v;
635 break;
636 case 2:
637 if (vs->client_be) {
638 buf[0] = v >> 8;
639 buf[1] = v;
640 } else {
641 buf[1] = v >> 8;
642 buf[0] = v;
643 }
644 break;
645 default:
646 case 4:
647 if (vs->client_be) {
648 buf[0] = v >> 24;
649 buf[1] = v >> 16;
650 buf[2] = v >> 8;
651 buf[3] = v;
652 } else {
653 buf[3] = v >> 24;
654 buf[2] = v >> 16;
655 buf[1] = v >> 8;
656 buf[0] = v;
657 }
658 break;
659 }
660 }
661
662 static void vnc_write_pixels_generic(VncState *vs,
663 void *pixels1, int size)
664 {
665 uint8_t buf[4];
666
667 if (VNC_SERVER_FB_BYTES == 4) {
668 uint32_t *pixels = pixels1;
669 int n, i;
670 n = size >> 2;
671 for (i = 0; i < n; i++) {
672 vnc_convert_pixel(vs, buf, pixels[i]);
673 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
674 }
675 }
676 }
677
678 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
679 {
680 int i;
681 uint8_t *row;
682 VncDisplay *vd = vs->vd;
683
684 row = vnc_server_fb_ptr(vd, x, y);
685 for (i = 0; i < h; i++) {
686 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
687 row += vnc_server_fb_stride(vd);
688 }
689 return 1;
690 }
691
692 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
693 {
694 int n = 0;
695
696 switch(vs->vnc_encoding) {
697 case VNC_ENCODING_ZLIB:
698 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
699 break;
700 case VNC_ENCODING_HEXTILE:
701 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
702 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
703 break;
704 case VNC_ENCODING_TIGHT:
705 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
706 break;
707 case VNC_ENCODING_TIGHT_PNG:
708 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
709 break;
710 case VNC_ENCODING_ZRLE:
711 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
712 break;
713 case VNC_ENCODING_ZYWRLE:
714 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
715 break;
716 default:
717 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
718 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
719 break;
720 }
721 return n;
722 }
723
724 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
725 {
726 /* send bitblit op to the vnc client */
727 vnc_lock_output(vs);
728 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
729 vnc_write_u8(vs, 0);
730 vnc_write_u16(vs, 1); /* number of rects */
731 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
732 vnc_write_u16(vs, src_x);
733 vnc_write_u16(vs, src_y);
734 vnc_unlock_output(vs);
735 vnc_flush(vs);
736 }
737
738 static void vnc_dpy_copy(DisplayChangeListener *dcl,
739 int src_x, int src_y,
740 int dst_x, int dst_y, int w, int h)
741 {
742 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
743 VncState *vs, *vn;
744 uint8_t *src_row;
745 uint8_t *dst_row;
746 int i, x, y, pitch, inc, w_lim, s;
747 int cmp_bytes;
748
749 vnc_refresh_server_surface(vd);
750 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
751 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
752 vs->force_update = 1;
753 vnc_update_client_sync(vs, 1);
754 /* vs might be free()ed here */
755 }
756 }
757
758 /* do bitblit op on the local surface too */
759 pitch = vnc_server_fb_stride(vd);
760 src_row = vnc_server_fb_ptr(vd, src_x, src_y);
761 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
762 y = dst_y;
763 inc = 1;
764 if (dst_y > src_y) {
765 /* copy backwards */
766 src_row += pitch * (h-1);
767 dst_row += pitch * (h-1);
768 pitch = -pitch;
769 y = dst_y + h - 1;
770 inc = -1;
771 }
772 w_lim = w - (16 - (dst_x % 16));
773 if (w_lim < 0)
774 w_lim = w;
775 else
776 w_lim = w - (w_lim % 16);
777 for (i = 0; i < h; i++) {
778 for (x = 0; x <= w_lim;
779 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
780 if (x == w_lim) {
781 if ((s = w - w_lim) == 0)
782 break;
783 } else if (!x) {
784 s = (16 - (dst_x % 16));
785 s = MIN(s, w_lim);
786 } else {
787 s = 16;
788 }
789 cmp_bytes = s * VNC_SERVER_FB_BYTES;
790 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
791 continue;
792 memmove(dst_row, src_row, cmp_bytes);
793 QTAILQ_FOREACH(vs, &vd->clients, next) {
794 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
795 set_bit(((x + dst_x) / 16), vs->dirty[y]);
796 }
797 }
798 }
799 src_row += pitch - w * VNC_SERVER_FB_BYTES;
800 dst_row += pitch - w * VNC_SERVER_FB_BYTES;
801 y += inc;
802 }
803
804 QTAILQ_FOREACH(vs, &vd->clients, next) {
805 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
806 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
807 }
808 }
809 }
810
811 static void vnc_mouse_set(DisplayChangeListener *dcl,
812 int x, int y, int visible)
813 {
814 /* can we ask the client(s) to move the pointer ??? */
815 }
816
817 static int vnc_cursor_define(VncState *vs)
818 {
819 QEMUCursor *c = vs->vd->cursor;
820 int isize;
821
822 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
823 vnc_lock_output(vs);
824 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
825 vnc_write_u8(vs, 0); /* padding */
826 vnc_write_u16(vs, 1); /* # of rects */
827 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
828 VNC_ENCODING_RICH_CURSOR);
829 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
830 vnc_write_pixels_generic(vs, c->data, isize);
831 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
832 vnc_unlock_output(vs);
833 return 0;
834 }
835 return -1;
836 }
837
838 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
839 QEMUCursor *c)
840 {
841 VncDisplay *vd = vnc_display;
842 VncState *vs;
843
844 cursor_put(vd->cursor);
845 g_free(vd->cursor_mask);
846
847 vd->cursor = c;
848 cursor_get(vd->cursor);
849 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
850 vd->cursor_mask = g_malloc0(vd->cursor_msize);
851 cursor_get_mono_mask(c, 0, vd->cursor_mask);
852
853 QTAILQ_FOREACH(vs, &vd->clients, next) {
854 vnc_cursor_define(vs);
855 }
856 }
857
858 static int find_and_clear_dirty_height(struct VncState *vs,
859 int y, int last_x, int x, int height)
860 {
861 int h;
862
863 for (h = 1; h < (height - y); h++) {
864 int tmp_x;
865 if (!test_bit(last_x, vs->dirty[y + h])) {
866 break;
867 }
868 for (tmp_x = last_x; tmp_x < x; tmp_x++) {
869 clear_bit(tmp_x, vs->dirty[y + h]);
870 }
871 }
872
873 return h;
874 }
875
876 static int vnc_update_client_sync(VncState *vs, int has_dirty)
877 {
878 int ret = vnc_update_client(vs, has_dirty);
879 vnc_jobs_join(vs);
880 return ret;
881 }
882
883 static int vnc_update_client(VncState *vs, int has_dirty)
884 {
885 if (vs->need_update && vs->csock != -1) {
886 VncDisplay *vd = vs->vd;
887 VncJob *job;
888 int y;
889 int width, height;
890 int n = 0;
891
892
893 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
894 /* kernel send buffers are full -> drop frames to throttle */
895 return 0;
896
897 if (!has_dirty && !vs->audio_cap && !vs->force_update)
898 return 0;
899
900 /*
901 * Send screen updates to the vnc client using the server
902 * surface and server dirty map. guest surface updates
903 * happening in parallel don't disturb us, the next pass will
904 * send them to the client.
905 */
906 job = vnc_job_new(vs);
907
908 width = MIN(pixman_image_get_width(vd->server), vs->client_width);
909 height = MIN(pixman_image_get_height(vd->server), vs->client_height);
910
911 for (y = 0; y < height; y++) {
912 int x;
913 int last_x = -1;
914 for (x = 0; x < width / 16; x++) {
915 if (test_and_clear_bit(x, vs->dirty[y])) {
916 if (last_x == -1) {
917 last_x = x;
918 }
919 } else {
920 if (last_x != -1) {
921 int h = find_and_clear_dirty_height(vs, y, last_x, x,
922 height);
923
924 n += vnc_job_add_rect(job, last_x * 16, y,
925 (x - last_x) * 16, h);
926 }
927 last_x = -1;
928 }
929 }
930 if (last_x != -1) {
931 int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
932 n += vnc_job_add_rect(job, last_x * 16, y,
933 (x - last_x) * 16, h);
934 }
935 }
936
937 vnc_job_push(job);
938 vs->force_update = 0;
939 return n;
940 }
941
942 if (vs->csock == -1)
943 vnc_disconnect_finish(vs);
944
945 return 0;
946 }
947
948 /* audio */
949 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
950 {
951 VncState *vs = opaque;
952
953 switch (cmd) {
954 case AUD_CNOTIFY_DISABLE:
955 vnc_lock_output(vs);
956 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
957 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
958 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
959 vnc_unlock_output(vs);
960 vnc_flush(vs);
961 break;
962
963 case AUD_CNOTIFY_ENABLE:
964 vnc_lock_output(vs);
965 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
966 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
967 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
968 vnc_unlock_output(vs);
969 vnc_flush(vs);
970 break;
971 }
972 }
973
974 static void audio_capture_destroy(void *opaque)
975 {
976 }
977
978 static void audio_capture(void *opaque, void *buf, int size)
979 {
980 VncState *vs = opaque;
981
982 vnc_lock_output(vs);
983 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
984 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
985 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
986 vnc_write_u32(vs, size);
987 vnc_write(vs, buf, size);
988 vnc_unlock_output(vs);
989 vnc_flush(vs);
990 }
991
992 static void audio_add(VncState *vs)
993 {
994 struct audio_capture_ops ops;
995
996 if (vs->audio_cap) {
997 monitor_printf(default_mon, "audio already running\n");
998 return;
999 }
1000
1001 ops.notify = audio_capture_notify;
1002 ops.destroy = audio_capture_destroy;
1003 ops.capture = audio_capture;
1004
1005 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1006 if (!vs->audio_cap) {
1007 monitor_printf(default_mon, "Failed to add audio capture\n");
1008 }
1009 }
1010
1011 static void audio_del(VncState *vs)
1012 {
1013 if (vs->audio_cap) {
1014 AUD_del_capture(vs->audio_cap, vs);
1015 vs->audio_cap = NULL;
1016 }
1017 }
1018
1019 static void vnc_disconnect_start(VncState *vs)
1020 {
1021 if (vs->csock == -1)
1022 return;
1023 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1024 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1025 closesocket(vs->csock);
1026 vs->csock = -1;
1027 }
1028
1029 void vnc_disconnect_finish(VncState *vs)
1030 {
1031 int i;
1032
1033 vnc_jobs_join(vs); /* Wait encoding jobs */
1034
1035 vnc_lock_output(vs);
1036 vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1037
1038 buffer_free(&vs->input);
1039 buffer_free(&vs->output);
1040 #ifdef CONFIG_VNC_WS
1041 buffer_free(&vs->ws_input);
1042 buffer_free(&vs->ws_output);
1043 #endif /* CONFIG_VNC_WS */
1044
1045 qobject_decref(vs->info);
1046
1047 vnc_zlib_clear(vs);
1048 vnc_tight_clear(vs);
1049 vnc_zrle_clear(vs);
1050
1051 #ifdef CONFIG_VNC_TLS
1052 vnc_tls_client_cleanup(vs);
1053 #endif /* CONFIG_VNC_TLS */
1054 #ifdef CONFIG_VNC_SASL
1055 vnc_sasl_client_cleanup(vs);
1056 #endif /* CONFIG_VNC_SASL */
1057 audio_del(vs);
1058 vnc_release_modifiers(vs);
1059
1060 if (vs->initialized) {
1061 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1062 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1063 }
1064
1065 if (vs->vd->lock_key_sync)
1066 qemu_remove_led_event_handler(vs->led);
1067 vnc_unlock_output(vs);
1068
1069 qemu_mutex_destroy(&vs->output_mutex);
1070 if (vs->bh != NULL) {
1071 qemu_bh_delete(vs->bh);
1072 }
1073 buffer_free(&vs->jobs_buffer);
1074
1075 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1076 g_free(vs->lossy_rect[i]);
1077 }
1078 g_free(vs->lossy_rect);
1079 g_free(vs);
1080 }
1081
1082 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1083 {
1084 if (ret == 0 || ret == -1) {
1085 if (ret == -1) {
1086 switch (last_errno) {
1087 case EINTR:
1088 case EAGAIN:
1089 #ifdef _WIN32
1090 case WSAEWOULDBLOCK:
1091 #endif
1092 return 0;
1093 default:
1094 break;
1095 }
1096 }
1097
1098 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1099 ret, ret < 0 ? last_errno : 0);
1100 vnc_disconnect_start(vs);
1101
1102 return 0;
1103 }
1104 return ret;
1105 }
1106
1107
1108 void vnc_client_error(VncState *vs)
1109 {
1110 VNC_DEBUG("Closing down client sock: protocol error\n");
1111 vnc_disconnect_start(vs);
1112 }
1113
1114
1115 /*
1116 * Called to write a chunk of data to the client socket. The data may
1117 * be the raw data, or may have already been encoded by SASL.
1118 * The data will be written either straight onto the socket, or
1119 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1120 *
1121 * NB, it is theoretically possible to have 2 layers of encryption,
1122 * both SASL, and this TLS layer. It is highly unlikely in practice
1123 * though, since SASL encryption will typically be a no-op if TLS
1124 * is active
1125 *
1126 * Returns the number of bytes written, which may be less than
1127 * the requested 'datalen' if the socket would block. Returns
1128 * -1 on error, and disconnects the client socket.
1129 */
1130 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1131 {
1132 long ret;
1133 #ifdef CONFIG_VNC_TLS
1134 if (vs->tls.session) {
1135 ret = gnutls_write(vs->tls.session, data, datalen);
1136 if (ret < 0) {
1137 if (ret == GNUTLS_E_AGAIN)
1138 errno = EAGAIN;
1139 else
1140 errno = EIO;
1141 ret = -1;
1142 }
1143 } else
1144 #endif /* CONFIG_VNC_TLS */
1145 ret = send(vs->csock, (const void *)data, datalen, 0);
1146 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1147 return vnc_client_io_error(vs, ret, socket_error());
1148 }
1149
1150
1151 /*
1152 * Called to write buffered data to the client socket, when not
1153 * using any SASL SSF encryption layers. Will write as much data
1154 * as possible without blocking. If all buffered data is written,
1155 * will switch the FD poll() handler back to read monitoring.
1156 *
1157 * Returns the number of bytes written, which may be less than
1158 * the buffered output data if the socket would block. Returns
1159 * -1 on error, and disconnects the client socket.
1160 */
1161 static long vnc_client_write_plain(VncState *vs)
1162 {
1163 long ret;
1164
1165 #ifdef CONFIG_VNC_SASL
1166 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1167 vs->output.buffer, vs->output.capacity, vs->output.offset,
1168 vs->sasl.waitWriteSSF);
1169
1170 if (vs->sasl.conn &&
1171 vs->sasl.runSSF &&
1172 vs->sasl.waitWriteSSF) {
1173 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1174 if (ret)
1175 vs->sasl.waitWriteSSF -= ret;
1176 } else
1177 #endif /* CONFIG_VNC_SASL */
1178 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1179 if (!ret)
1180 return 0;
1181
1182 buffer_advance(&vs->output, ret);
1183
1184 if (vs->output.offset == 0) {
1185 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1186 }
1187
1188 return ret;
1189 }
1190
1191
1192 /*
1193 * First function called whenever there is data to be written to
1194 * the client socket. Will delegate actual work according to whether
1195 * SASL SSF layers are enabled (thus requiring encryption calls)
1196 */
1197 static void vnc_client_write_locked(void *opaque)
1198 {
1199 VncState *vs = opaque;
1200
1201 #ifdef CONFIG_VNC_SASL
1202 if (vs->sasl.conn &&
1203 vs->sasl.runSSF &&
1204 !vs->sasl.waitWriteSSF) {
1205 vnc_client_write_sasl(vs);
1206 } else
1207 #endif /* CONFIG_VNC_SASL */
1208 {
1209 #ifdef CONFIG_VNC_WS
1210 if (vs->encode_ws) {
1211 vnc_client_write_ws(vs);
1212 } else
1213 #endif /* CONFIG_VNC_WS */
1214 {
1215 vnc_client_write_plain(vs);
1216 }
1217 }
1218 }
1219
1220 void vnc_client_write(void *opaque)
1221 {
1222 VncState *vs = opaque;
1223
1224 vnc_lock_output(vs);
1225 if (vs->output.offset
1226 #ifdef CONFIG_VNC_WS
1227 || vs->ws_output.offset
1228 #endif
1229 ) {
1230 vnc_client_write_locked(opaque);
1231 } else if (vs->csock != -1) {
1232 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1233 }
1234 vnc_unlock_output(vs);
1235 }
1236
1237 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1238 {
1239 vs->read_handler = func;
1240 vs->read_handler_expect = expecting;
1241 }
1242
1243
1244 /*
1245 * Called to read a chunk of data from the client socket. The data may
1246 * be the raw data, or may need to be further decoded by SASL.
1247 * The data will be read either straight from to the socket, or
1248 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1249 *
1250 * NB, it is theoretically possible to have 2 layers of encryption,
1251 * both SASL, and this TLS layer. It is highly unlikely in practice
1252 * though, since SASL encryption will typically be a no-op if TLS
1253 * is active
1254 *
1255 * Returns the number of bytes read, which may be less than
1256 * the requested 'datalen' if the socket would block. Returns
1257 * -1 on error, and disconnects the client socket.
1258 */
1259 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1260 {
1261 long ret;
1262 #ifdef CONFIG_VNC_TLS
1263 if (vs->tls.session) {
1264 ret = gnutls_read(vs->tls.session, data, datalen);
1265 if (ret < 0) {
1266 if (ret == GNUTLS_E_AGAIN)
1267 errno = EAGAIN;
1268 else
1269 errno = EIO;
1270 ret = -1;
1271 }
1272 } else
1273 #endif /* CONFIG_VNC_TLS */
1274 ret = qemu_recv(vs->csock, data, datalen, 0);
1275 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1276 return vnc_client_io_error(vs, ret, socket_error());
1277 }
1278
1279
1280 /*
1281 * Called to read data from the client socket to the input buffer,
1282 * when not using any SASL SSF encryption layers. Will read as much
1283 * data as possible without blocking.
1284 *
1285 * Returns the number of bytes read. Returns -1 on error, and
1286 * disconnects the client socket.
1287 */
1288 static long vnc_client_read_plain(VncState *vs)
1289 {
1290 int ret;
1291 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1292 vs->input.buffer, vs->input.capacity, vs->input.offset);
1293 buffer_reserve(&vs->input, 4096);
1294 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1295 if (!ret)
1296 return 0;
1297 vs->input.offset += ret;
1298 return ret;
1299 }
1300
1301 static void vnc_jobs_bh(void *opaque)
1302 {
1303 VncState *vs = opaque;
1304
1305 vnc_jobs_consume_buffer(vs);
1306 }
1307
1308 /*
1309 * First function called whenever there is more data to be read from
1310 * the client socket. Will delegate actual work according to whether
1311 * SASL SSF layers are enabled (thus requiring decryption calls)
1312 */
1313 void vnc_client_read(void *opaque)
1314 {
1315 VncState *vs = opaque;
1316 long ret;
1317
1318 #ifdef CONFIG_VNC_SASL
1319 if (vs->sasl.conn && vs->sasl.runSSF)
1320 ret = vnc_client_read_sasl(vs);
1321 else
1322 #endif /* CONFIG_VNC_SASL */
1323 #ifdef CONFIG_VNC_WS
1324 if (vs->encode_ws) {
1325 ret = vnc_client_read_ws(vs);
1326 if (ret == -1) {
1327 vnc_disconnect_start(vs);
1328 return;
1329 } else if (ret == -2) {
1330 vnc_client_error(vs);
1331 return;
1332 }
1333 } else
1334 #endif /* CONFIG_VNC_WS */
1335 {
1336 ret = vnc_client_read_plain(vs);
1337 }
1338 if (!ret) {
1339 if (vs->csock == -1)
1340 vnc_disconnect_finish(vs);
1341 return;
1342 }
1343
1344 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1345 size_t len = vs->read_handler_expect;
1346 int ret;
1347
1348 ret = vs->read_handler(vs, vs->input.buffer, len);
1349 if (vs->csock == -1) {
1350 vnc_disconnect_finish(vs);
1351 return;
1352 }
1353
1354 if (!ret) {
1355 buffer_advance(&vs->input, len);
1356 } else {
1357 vs->read_handler_expect = ret;
1358 }
1359 }
1360 }
1361
1362 void vnc_write(VncState *vs, const void *data, size_t len)
1363 {
1364 buffer_reserve(&vs->output, len);
1365
1366 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1367 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1368 }
1369
1370 buffer_append(&vs->output, data, len);
1371 }
1372
1373 void vnc_write_s32(VncState *vs, int32_t value)
1374 {
1375 vnc_write_u32(vs, *(uint32_t *)&value);
1376 }
1377
1378 void vnc_write_u32(VncState *vs, uint32_t value)
1379 {
1380 uint8_t buf[4];
1381
1382 buf[0] = (value >> 24) & 0xFF;
1383 buf[1] = (value >> 16) & 0xFF;
1384 buf[2] = (value >> 8) & 0xFF;
1385 buf[3] = value & 0xFF;
1386
1387 vnc_write(vs, buf, 4);
1388 }
1389
1390 void vnc_write_u16(VncState *vs, uint16_t value)
1391 {
1392 uint8_t buf[2];
1393
1394 buf[0] = (value >> 8) & 0xFF;
1395 buf[1] = value & 0xFF;
1396
1397 vnc_write(vs, buf, 2);
1398 }
1399
1400 void vnc_write_u8(VncState *vs, uint8_t value)
1401 {
1402 vnc_write(vs, (char *)&value, 1);
1403 }
1404
1405 void vnc_flush(VncState *vs)
1406 {
1407 vnc_lock_output(vs);
1408 if (vs->csock != -1 && (vs->output.offset
1409 #ifdef CONFIG_VNC_WS
1410 || vs->ws_output.offset
1411 #endif
1412 )) {
1413 vnc_client_write_locked(vs);
1414 }
1415 vnc_unlock_output(vs);
1416 }
1417
1418 static uint8_t read_u8(uint8_t *data, size_t offset)
1419 {
1420 return data[offset];
1421 }
1422
1423 static uint16_t read_u16(uint8_t *data, size_t offset)
1424 {
1425 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1426 }
1427
1428 static int32_t read_s32(uint8_t *data, size_t offset)
1429 {
1430 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1431 (data[offset + 2] << 8) | data[offset + 3]);
1432 }
1433
1434 uint32_t read_u32(uint8_t *data, size_t offset)
1435 {
1436 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1437 (data[offset + 2] << 8) | data[offset + 3]);
1438 }
1439
1440 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1441 {
1442 }
1443
1444 static void check_pointer_type_change(Notifier *notifier, void *data)
1445 {
1446 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1447 int absolute = kbd_mouse_is_absolute();
1448
1449 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1450 vnc_lock_output(vs);
1451 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1452 vnc_write_u8(vs, 0);
1453 vnc_write_u16(vs, 1);
1454 vnc_framebuffer_update(vs, absolute, 0,
1455 surface_width(vs->vd->ds),
1456 surface_height(vs->vd->ds),
1457 VNC_ENCODING_POINTER_TYPE_CHANGE);
1458 vnc_unlock_output(vs);
1459 vnc_flush(vs);
1460 }
1461 vs->absolute = absolute;
1462 }
1463
1464 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1465 {
1466 int buttons = 0;
1467 int dz = 0;
1468 int width = surface_width(vs->vd->ds);
1469 int height = surface_height(vs->vd->ds);
1470
1471 if (button_mask & 0x01)
1472 buttons |= MOUSE_EVENT_LBUTTON;
1473 if (button_mask & 0x02)
1474 buttons |= MOUSE_EVENT_MBUTTON;
1475 if (button_mask & 0x04)
1476 buttons |= MOUSE_EVENT_RBUTTON;
1477 if (button_mask & 0x08)
1478 dz = -1;
1479 if (button_mask & 0x10)
1480 dz = 1;
1481
1482 if (vs->absolute) {
1483 kbd_mouse_event(width > 1 ? x * 0x7FFF / (width - 1) : 0x4000,
1484 height > 1 ? y * 0x7FFF / (height - 1) : 0x4000,
1485 dz, buttons);
1486 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1487 x -= 0x7FFF;
1488 y -= 0x7FFF;
1489
1490 kbd_mouse_event(x, y, dz, buttons);
1491 } else {
1492 if (vs->last_x != -1)
1493 kbd_mouse_event(x - vs->last_x,
1494 y - vs->last_y,
1495 dz, buttons);
1496 vs->last_x = x;
1497 vs->last_y = y;
1498 }
1499 }
1500
1501 static void reset_keys(VncState *vs)
1502 {
1503 int i;
1504 for(i = 0; i < 256; i++) {
1505 if (vs->modifiers_state[i]) {
1506 if (i & SCANCODE_GREY)
1507 kbd_put_keycode(SCANCODE_EMUL0);
1508 kbd_put_keycode(i | SCANCODE_UP);
1509 vs->modifiers_state[i] = 0;
1510 }
1511 }
1512 }
1513
1514 static void press_key(VncState *vs, int keysym)
1515 {
1516 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1517 if (keycode & SCANCODE_GREY)
1518 kbd_put_keycode(SCANCODE_EMUL0);
1519 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1520 if (keycode & SCANCODE_GREY)
1521 kbd_put_keycode(SCANCODE_EMUL0);
1522 kbd_put_keycode(keycode | SCANCODE_UP);
1523 }
1524
1525 static int current_led_state(VncState *vs)
1526 {
1527 int ledstate = 0;
1528
1529 if (vs->modifiers_state[0x46]) {
1530 ledstate |= QEMU_SCROLL_LOCK_LED;
1531 }
1532 if (vs->modifiers_state[0x45]) {
1533 ledstate |= QEMU_NUM_LOCK_LED;
1534 }
1535 if (vs->modifiers_state[0x3a]) {
1536 ledstate |= QEMU_CAPS_LOCK_LED;
1537 }
1538
1539 return ledstate;
1540 }
1541
1542 static void vnc_led_state_change(VncState *vs)
1543 {
1544 int ledstate = 0;
1545
1546 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1547 return;
1548 }
1549
1550 ledstate = current_led_state(vs);
1551 vnc_lock_output(vs);
1552 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1553 vnc_write_u8(vs, 0);
1554 vnc_write_u16(vs, 1);
1555 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1556 vnc_write_u8(vs, ledstate);
1557 vnc_unlock_output(vs);
1558 vnc_flush(vs);
1559 }
1560
1561 static void kbd_leds(void *opaque, int ledstate)
1562 {
1563 VncState *vs = opaque;
1564 int caps, num, scr;
1565
1566 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1567 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
1568 scr = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0;
1569
1570 if (vs->modifiers_state[0x3a] != caps) {
1571 vs->modifiers_state[0x3a] = caps;
1572 }
1573 if (vs->modifiers_state[0x45] != num) {
1574 vs->modifiers_state[0x45] = num;
1575 }
1576 if (vs->modifiers_state[0x46] != scr) {
1577 vs->modifiers_state[0x46] = scr;
1578 }
1579
1580 /* Sending the current led state message to the client */
1581 if (ledstate != current_led_state(vs)) {
1582 vnc_led_state_change(vs);
1583 }
1584 }
1585
1586 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1587 {
1588 /* QEMU console switch */
1589 switch(keycode) {
1590 case 0x2a: /* Left Shift */
1591 case 0x36: /* Right Shift */
1592 case 0x1d: /* Left CTRL */
1593 case 0x9d: /* Right CTRL */
1594 case 0x38: /* Left ALT */
1595 case 0xb8: /* Right ALT */
1596 if (down)
1597 vs->modifiers_state[keycode] = 1;
1598 else
1599 vs->modifiers_state[keycode] = 0;
1600 break;
1601 case 0x02 ... 0x0a: /* '1' to '9' keys */
1602 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1603 /* Reset the modifiers sent to the current console */
1604 reset_keys(vs);
1605 console_select(keycode - 0x02);
1606 return;
1607 }
1608 break;
1609 case 0x3a: /* CapsLock */
1610 case 0x45: /* NumLock */
1611 if (down)
1612 vs->modifiers_state[keycode] ^= 1;
1613 break;
1614 }
1615
1616 if (down && vs->vd->lock_key_sync &&
1617 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1618 /* If the numlock state needs to change then simulate an additional
1619 keypress before sending this one. This will happen if the user
1620 toggles numlock away from the VNC window.
1621 */
1622 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1623 if (!vs->modifiers_state[0x45]) {
1624 vs->modifiers_state[0x45] = 1;
1625 press_key(vs, 0xff7f);
1626 }
1627 } else {
1628 if (vs->modifiers_state[0x45]) {
1629 vs->modifiers_state[0x45] = 0;
1630 press_key(vs, 0xff7f);
1631 }
1632 }
1633 }
1634
1635 if (down && vs->vd->lock_key_sync &&
1636 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1637 /* If the capslock state needs to change then simulate an additional
1638 keypress before sending this one. This will happen if the user
1639 toggles capslock away from the VNC window.
1640 */
1641 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1642 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1643 int capslock = !!(vs->modifiers_state[0x3a]);
1644 if (capslock) {
1645 if (uppercase == shift) {
1646 vs->modifiers_state[0x3a] = 0;
1647 press_key(vs, 0xffe5);
1648 }
1649 } else {
1650 if (uppercase != shift) {
1651 vs->modifiers_state[0x3a] = 1;
1652 press_key(vs, 0xffe5);
1653 }
1654 }
1655 }
1656
1657 if (qemu_console_is_graphic(NULL)) {
1658 if (keycode & SCANCODE_GREY)
1659 kbd_put_keycode(SCANCODE_EMUL0);
1660 if (down)
1661 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1662 else
1663 kbd_put_keycode(keycode | SCANCODE_UP);
1664 } else {
1665 bool numlock = vs->modifiers_state[0x45];
1666 bool control = (vs->modifiers_state[0x1d] ||
1667 vs->modifiers_state[0x9d]);
1668 /* QEMU console emulation */
1669 if (down) {
1670 switch (keycode) {
1671 case 0x2a: /* Left Shift */
1672 case 0x36: /* Right Shift */
1673 case 0x1d: /* Left CTRL */
1674 case 0x9d: /* Right CTRL */
1675 case 0x38: /* Left ALT */
1676 case 0xb8: /* Right ALT */
1677 break;
1678 case 0xc8:
1679 kbd_put_keysym(QEMU_KEY_UP);
1680 break;
1681 case 0xd0:
1682 kbd_put_keysym(QEMU_KEY_DOWN);
1683 break;
1684 case 0xcb:
1685 kbd_put_keysym(QEMU_KEY_LEFT);
1686 break;
1687 case 0xcd:
1688 kbd_put_keysym(QEMU_KEY_RIGHT);
1689 break;
1690 case 0xd3:
1691 kbd_put_keysym(QEMU_KEY_DELETE);
1692 break;
1693 case 0xc7:
1694 kbd_put_keysym(QEMU_KEY_HOME);
1695 break;
1696 case 0xcf:
1697 kbd_put_keysym(QEMU_KEY_END);
1698 break;
1699 case 0xc9:
1700 kbd_put_keysym(QEMU_KEY_PAGEUP);
1701 break;
1702 case 0xd1:
1703 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1704 break;
1705
1706 case 0x47:
1707 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1708 break;
1709 case 0x48:
1710 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1711 break;
1712 case 0x49:
1713 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1714 break;
1715 case 0x4b:
1716 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1717 break;
1718 case 0x4c:
1719 kbd_put_keysym('5');
1720 break;
1721 case 0x4d:
1722 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1723 break;
1724 case 0x4f:
1725 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1726 break;
1727 case 0x50:
1728 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1729 break;
1730 case 0x51:
1731 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1732 break;
1733 case 0x52:
1734 kbd_put_keysym('0');
1735 break;
1736 case 0x53:
1737 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1738 break;
1739
1740 case 0xb5:
1741 kbd_put_keysym('/');
1742 break;
1743 case 0x37:
1744 kbd_put_keysym('*');
1745 break;
1746 case 0x4a:
1747 kbd_put_keysym('-');
1748 break;
1749 case 0x4e:
1750 kbd_put_keysym('+');
1751 break;
1752 case 0x9c:
1753 kbd_put_keysym('\n');
1754 break;
1755
1756 default:
1757 if (control) {
1758 kbd_put_keysym(sym & 0x1f);
1759 } else {
1760 kbd_put_keysym(sym);
1761 }
1762 break;
1763 }
1764 }
1765 }
1766 }
1767
1768 static void vnc_release_modifiers(VncState *vs)
1769 {
1770 static const int keycodes[] = {
1771 /* shift, control, alt keys, both left & right */
1772 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1773 };
1774 int i, keycode;
1775
1776 if (!qemu_console_is_graphic(NULL)) {
1777 return;
1778 }
1779 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1780 keycode = keycodes[i];
1781 if (!vs->modifiers_state[keycode]) {
1782 continue;
1783 }
1784 if (keycode & SCANCODE_GREY) {
1785 kbd_put_keycode(SCANCODE_EMUL0);
1786 }
1787 kbd_put_keycode(keycode | SCANCODE_UP);
1788 }
1789 }
1790
1791 static void key_event(VncState *vs, int down, uint32_t sym)
1792 {
1793 int keycode;
1794 int lsym = sym;
1795
1796 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1797 lsym = lsym - 'A' + 'a';
1798 }
1799
1800 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1801 do_key_event(vs, down, keycode, sym);
1802 }
1803
1804 static void ext_key_event(VncState *vs, int down,
1805 uint32_t sym, uint16_t keycode)
1806 {
1807 /* if the user specifies a keyboard layout, always use it */
1808 if (keyboard_layout)
1809 key_event(vs, down, sym);
1810 else
1811 do_key_event(vs, down, keycode, sym);
1812 }
1813
1814 static void framebuffer_update_request(VncState *vs, int incremental,
1815 int x_position, int y_position,
1816 int w, int h)
1817 {
1818 int i;
1819 const size_t width = surface_width(vs->vd->ds) / 16;
1820 const size_t height = surface_height(vs->vd->ds);
1821
1822 if (y_position > height) {
1823 y_position = height;
1824 }
1825 if (y_position + h >= height) {
1826 h = height - y_position;
1827 }
1828
1829 vs->need_update = 1;
1830 if (!incremental) {
1831 vs->force_update = 1;
1832 for (i = 0; i < h; i++) {
1833 bitmap_set(vs->dirty[y_position + i], 0, width);
1834 bitmap_clear(vs->dirty[y_position + i], width,
1835 VNC_DIRTY_BITS - width);
1836 }
1837 }
1838 }
1839
1840 static void send_ext_key_event_ack(VncState *vs)
1841 {
1842 vnc_lock_output(vs);
1843 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1844 vnc_write_u8(vs, 0);
1845 vnc_write_u16(vs, 1);
1846 vnc_framebuffer_update(vs, 0, 0,
1847 surface_width(vs->vd->ds),
1848 surface_height(vs->vd->ds),
1849 VNC_ENCODING_EXT_KEY_EVENT);
1850 vnc_unlock_output(vs);
1851 vnc_flush(vs);
1852 }
1853
1854 static void send_ext_audio_ack(VncState *vs)
1855 {
1856 vnc_lock_output(vs);
1857 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1858 vnc_write_u8(vs, 0);
1859 vnc_write_u16(vs, 1);
1860 vnc_framebuffer_update(vs, 0, 0,
1861 surface_width(vs->vd->ds),
1862 surface_height(vs->vd->ds),
1863 VNC_ENCODING_AUDIO);
1864 vnc_unlock_output(vs);
1865 vnc_flush(vs);
1866 }
1867
1868 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1869 {
1870 int i;
1871 unsigned int enc = 0;
1872
1873 vs->features = 0;
1874 vs->vnc_encoding = 0;
1875 vs->tight.compression = 9;
1876 vs->tight.quality = -1; /* Lossless by default */
1877 vs->absolute = -1;
1878
1879 /*
1880 * Start from the end because the encodings are sent in order of preference.
1881 * This way the preferred encoding (first encoding defined in the array)
1882 * will be set at the end of the loop.
1883 */
1884 for (i = n_encodings - 1; i >= 0; i--) {
1885 enc = encodings[i];
1886 switch (enc) {
1887 case VNC_ENCODING_RAW:
1888 vs->vnc_encoding = enc;
1889 break;
1890 case VNC_ENCODING_COPYRECT:
1891 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1892 break;
1893 case VNC_ENCODING_HEXTILE:
1894 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1895 vs->vnc_encoding = enc;
1896 break;
1897 case VNC_ENCODING_TIGHT:
1898 vs->features |= VNC_FEATURE_TIGHT_MASK;
1899 vs->vnc_encoding = enc;
1900 break;
1901 #ifdef CONFIG_VNC_PNG
1902 case VNC_ENCODING_TIGHT_PNG:
1903 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1904 vs->vnc_encoding = enc;
1905 break;
1906 #endif
1907 case VNC_ENCODING_ZLIB:
1908 vs->features |= VNC_FEATURE_ZLIB_MASK;
1909 vs->vnc_encoding = enc;
1910 break;
1911 case VNC_ENCODING_ZRLE:
1912 vs->features |= VNC_FEATURE_ZRLE_MASK;
1913 vs->vnc_encoding = enc;
1914 break;
1915 case VNC_ENCODING_ZYWRLE:
1916 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1917 vs->vnc_encoding = enc;
1918 break;
1919 case VNC_ENCODING_DESKTOPRESIZE:
1920 vs->features |= VNC_FEATURE_RESIZE_MASK;
1921 break;
1922 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1923 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1924 break;
1925 case VNC_ENCODING_RICH_CURSOR:
1926 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1927 break;
1928 case VNC_ENCODING_EXT_KEY_EVENT:
1929 send_ext_key_event_ack(vs);
1930 break;
1931 case VNC_ENCODING_AUDIO:
1932 send_ext_audio_ack(vs);
1933 break;
1934 case VNC_ENCODING_WMVi:
1935 vs->features |= VNC_FEATURE_WMVI_MASK;
1936 break;
1937 case VNC_ENCODING_LED_STATE:
1938 vs->features |= VNC_FEATURE_LED_STATE_MASK;
1939 break;
1940 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1941 vs->tight.compression = (enc & 0x0F);
1942 break;
1943 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1944 if (vs->vd->lossy) {
1945 vs->tight.quality = (enc & 0x0F);
1946 }
1947 break;
1948 default:
1949 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1950 break;
1951 }
1952 }
1953 vnc_desktop_resize(vs);
1954 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1955 vnc_led_state_change(vs);
1956 }
1957
1958 static void set_pixel_conversion(VncState *vs)
1959 {
1960 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
1961
1962 if (fmt == VNC_SERVER_FB_FORMAT) {
1963 vs->write_pixels = vnc_write_pixels_copy;
1964 vnc_hextile_set_pixel_conversion(vs, 0);
1965 } else {
1966 vs->write_pixels = vnc_write_pixels_generic;
1967 vnc_hextile_set_pixel_conversion(vs, 1);
1968 }
1969 }
1970
1971 static void set_pixel_format(VncState *vs,
1972 int bits_per_pixel, int depth,
1973 int big_endian_flag, int true_color_flag,
1974 int red_max, int green_max, int blue_max,
1975 int red_shift, int green_shift, int blue_shift)
1976 {
1977 if (!true_color_flag) {
1978 vnc_client_error(vs);
1979 return;
1980 }
1981
1982 vs->client_pf.rmax = red_max;
1983 vs->client_pf.rbits = hweight_long(red_max);
1984 vs->client_pf.rshift = red_shift;
1985 vs->client_pf.rmask = red_max << red_shift;
1986 vs->client_pf.gmax = green_max;
1987 vs->client_pf.gbits = hweight_long(green_max);
1988 vs->client_pf.gshift = green_shift;
1989 vs->client_pf.gmask = green_max << green_shift;
1990 vs->client_pf.bmax = blue_max;
1991 vs->client_pf.bbits = hweight_long(blue_max);
1992 vs->client_pf.bshift = blue_shift;
1993 vs->client_pf.bmask = blue_max << blue_shift;
1994 vs->client_pf.bits_per_pixel = bits_per_pixel;
1995 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
1996 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1997 vs->client_be = big_endian_flag;
1998
1999 set_pixel_conversion(vs);
2000
2001 graphic_hw_invalidate(NULL);
2002 graphic_hw_update(NULL);
2003 }
2004
2005 static void pixel_format_message (VncState *vs) {
2006 char pad[3] = { 0, 0, 0 };
2007
2008 vs->client_pf = qemu_default_pixelformat(32);
2009
2010 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2011 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2012
2013 #ifdef HOST_WORDS_BIGENDIAN
2014 vnc_write_u8(vs, 1); /* big-endian-flag */
2015 #else
2016 vnc_write_u8(vs, 0); /* big-endian-flag */
2017 #endif
2018 vnc_write_u8(vs, 1); /* true-color-flag */
2019 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2020 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2021 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2022 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2023 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2024 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2025 vnc_write(vs, pad, 3); /* padding */
2026
2027 vnc_hextile_set_pixel_conversion(vs, 0);
2028 vs->write_pixels = vnc_write_pixels_copy;
2029 }
2030
2031 static void vnc_colordepth(VncState *vs)
2032 {
2033 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2034 /* Sending a WMVi message to notify the client*/
2035 vnc_lock_output(vs);
2036 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2037 vnc_write_u8(vs, 0);
2038 vnc_write_u16(vs, 1); /* number of rects */
2039 vnc_framebuffer_update(vs, 0, 0,
2040 surface_width(vs->vd->ds),
2041 surface_height(vs->vd->ds),
2042 VNC_ENCODING_WMVi);
2043 pixel_format_message(vs);
2044 vnc_unlock_output(vs);
2045 vnc_flush(vs);
2046 } else {
2047 set_pixel_conversion(vs);
2048 }
2049 }
2050
2051 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2052 {
2053 int i;
2054 uint16_t limit;
2055 VncDisplay *vd = vs->vd;
2056
2057 if (data[0] > 3) {
2058 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2059 }
2060
2061 switch (data[0]) {
2062 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2063 if (len == 1)
2064 return 20;
2065
2066 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
2067 read_u8(data, 6), read_u8(data, 7),
2068 read_u16(data, 8), read_u16(data, 10),
2069 read_u16(data, 12), read_u8(data, 14),
2070 read_u8(data, 15), read_u8(data, 16));
2071 break;
2072 case VNC_MSG_CLIENT_SET_ENCODINGS:
2073 if (len == 1)
2074 return 4;
2075
2076 if (len == 4) {
2077 limit = read_u16(data, 2);
2078 if (limit > 0)
2079 return 4 + (limit * 4);
2080 } else
2081 limit = read_u16(data, 2);
2082
2083 for (i = 0; i < limit; i++) {
2084 int32_t val = read_s32(data, 4 + (i * 4));
2085 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2086 }
2087
2088 set_encodings(vs, (int32_t *)(data + 4), limit);
2089 break;
2090 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2091 if (len == 1)
2092 return 10;
2093
2094 framebuffer_update_request(vs,
2095 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2096 read_u16(data, 6), read_u16(data, 8));
2097 break;
2098 case VNC_MSG_CLIENT_KEY_EVENT:
2099 if (len == 1)
2100 return 8;
2101
2102 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2103 break;
2104 case VNC_MSG_CLIENT_POINTER_EVENT:
2105 if (len == 1)
2106 return 6;
2107
2108 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2109 break;
2110 case VNC_MSG_CLIENT_CUT_TEXT:
2111 if (len == 1)
2112 return 8;
2113
2114 if (len == 8) {
2115 uint32_t dlen = read_u32(data, 4);
2116 if (dlen > 0)
2117 return 8 + dlen;
2118 }
2119
2120 client_cut_text(vs, read_u32(data, 4), data + 8);
2121 break;
2122 case VNC_MSG_CLIENT_QEMU:
2123 if (len == 1)
2124 return 2;
2125
2126 switch (read_u8(data, 1)) {
2127 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2128 if (len == 2)
2129 return 12;
2130
2131 ext_key_event(vs, read_u16(data, 2),
2132 read_u32(data, 4), read_u32(data, 8));
2133 break;
2134 case VNC_MSG_CLIENT_QEMU_AUDIO:
2135 if (len == 2)
2136 return 4;
2137
2138 switch (read_u16 (data, 2)) {
2139 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2140 audio_add(vs);
2141 break;
2142 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2143 audio_del(vs);
2144 break;
2145 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2146 if (len == 4)
2147 return 10;
2148 switch (read_u8(data, 4)) {
2149 case 0: vs->as.fmt = AUD_FMT_U8; break;
2150 case 1: vs->as.fmt = AUD_FMT_S8; break;
2151 case 2: vs->as.fmt = AUD_FMT_U16; break;
2152 case 3: vs->as.fmt = AUD_FMT_S16; break;
2153 case 4: vs->as.fmt = AUD_FMT_U32; break;
2154 case 5: vs->as.fmt = AUD_FMT_S32; break;
2155 default:
2156 printf("Invalid audio format %d\n", read_u8(data, 4));
2157 vnc_client_error(vs);
2158 break;
2159 }
2160 vs->as.nchannels = read_u8(data, 5);
2161 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2162 printf("Invalid audio channel coount %d\n",
2163 read_u8(data, 5));
2164 vnc_client_error(vs);
2165 break;
2166 }
2167 vs->as.freq = read_u32(data, 6);
2168 break;
2169 default:
2170 printf ("Invalid audio message %d\n", read_u8(data, 4));
2171 vnc_client_error(vs);
2172 break;
2173 }
2174 break;
2175
2176 default:
2177 printf("Msg: %d\n", read_u16(data, 0));
2178 vnc_client_error(vs);
2179 break;
2180 }
2181 break;
2182 default:
2183 printf("Msg: %d\n", data[0]);
2184 vnc_client_error(vs);
2185 break;
2186 }
2187
2188 vnc_read_when(vs, protocol_client_msg, 1);
2189 return 0;
2190 }
2191
2192 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2193 {
2194 char buf[1024];
2195 VncShareMode mode;
2196 int size;
2197
2198 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2199 switch (vs->vd->share_policy) {
2200 case VNC_SHARE_POLICY_IGNORE:
2201 /*
2202 * Ignore the shared flag. Nothing to do here.
2203 *
2204 * Doesn't conform to the rfb spec but is traditional qemu
2205 * behavior, thus left here as option for compatibility
2206 * reasons.
2207 */
2208 break;
2209 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2210 /*
2211 * Policy: Allow clients ask for exclusive access.
2212 *
2213 * Implementation: When a client asks for exclusive access,
2214 * disconnect all others. Shared connects are allowed as long
2215 * as no exclusive connection exists.
2216 *
2217 * This is how the rfb spec suggests to handle the shared flag.
2218 */
2219 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2220 VncState *client;
2221 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2222 if (vs == client) {
2223 continue;
2224 }
2225 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2226 client->share_mode != VNC_SHARE_MODE_SHARED) {
2227 continue;
2228 }
2229 vnc_disconnect_start(client);
2230 }
2231 }
2232 if (mode == VNC_SHARE_MODE_SHARED) {
2233 if (vs->vd->num_exclusive > 0) {
2234 vnc_disconnect_start(vs);
2235 return 0;
2236 }
2237 }
2238 break;
2239 case VNC_SHARE_POLICY_FORCE_SHARED:
2240 /*
2241 * Policy: Shared connects only.
2242 * Implementation: Disallow clients asking for exclusive access.
2243 *
2244 * Useful for shared desktop sessions where you don't want
2245 * someone forgetting to say -shared when running the vnc
2246 * client disconnect everybody else.
2247 */
2248 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2249 vnc_disconnect_start(vs);
2250 return 0;
2251 }
2252 break;
2253 }
2254 vnc_set_share_mode(vs, mode);
2255
2256 vs->client_width = surface_width(vs->vd->ds);
2257 vs->client_height = surface_height(vs->vd->ds);
2258 vnc_write_u16(vs, vs->client_width);
2259 vnc_write_u16(vs, vs->client_height);
2260
2261 pixel_format_message(vs);
2262
2263 if (qemu_name)
2264 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2265 else
2266 size = snprintf(buf, sizeof(buf), "QEMU");
2267
2268 vnc_write_u32(vs, size);
2269 vnc_write(vs, buf, size);
2270 vnc_flush(vs);
2271
2272 vnc_client_cache_auth(vs);
2273 vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2274
2275 vnc_read_when(vs, protocol_client_msg, 1);
2276
2277 return 0;
2278 }
2279
2280 void start_client_init(VncState *vs)
2281 {
2282 vnc_read_when(vs, protocol_client_init, 1);
2283 }
2284
2285 static void make_challenge(VncState *vs)
2286 {
2287 int i;
2288
2289 srand(time(NULL)+getpid()+getpid()*987654+rand());
2290
2291 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2292 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2293 }
2294
2295 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2296 {
2297 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2298 int i, j, pwlen;
2299 unsigned char key[8];
2300 time_t now = time(NULL);
2301
2302 if (!vs->vd->password) {
2303 VNC_DEBUG("No password configured on server");
2304 goto reject;
2305 }
2306 if (vs->vd->expires < now) {
2307 VNC_DEBUG("Password is expired");
2308 goto reject;
2309 }
2310
2311 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2312
2313 /* Calculate the expected challenge response */
2314 pwlen = strlen(vs->vd->password);
2315 for (i=0; i<sizeof(key); i++)
2316 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2317 deskey(key, EN0);
2318 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2319 des(response+j, response+j);
2320
2321 /* Compare expected vs actual challenge response */
2322 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2323 VNC_DEBUG("Client challenge response did not match\n");
2324 goto reject;
2325 } else {
2326 VNC_DEBUG("Accepting VNC challenge response\n");
2327 vnc_write_u32(vs, 0); /* Accept auth */
2328 vnc_flush(vs);
2329
2330 start_client_init(vs);
2331 }
2332 return 0;
2333
2334 reject:
2335 vnc_write_u32(vs, 1); /* Reject auth */
2336 if (vs->minor >= 8) {
2337 static const char err[] = "Authentication failed";
2338 vnc_write_u32(vs, sizeof(err));
2339 vnc_write(vs, err, sizeof(err));
2340 }
2341 vnc_flush(vs);
2342 vnc_client_error(vs);
2343 return 0;
2344 }
2345
2346 void start_auth_vnc(VncState *vs)
2347 {
2348 make_challenge(vs);
2349 /* Send client a 'random' challenge */
2350 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2351 vnc_flush(vs);
2352
2353 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2354 }
2355
2356
2357 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2358 {
2359 /* We only advertise 1 auth scheme at a time, so client
2360 * must pick the one we sent. Verify this */
2361 if (data[0] != vs->auth) { /* Reject auth */
2362 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2363 vnc_write_u32(vs, 1);
2364 if (vs->minor >= 8) {
2365 static const char err[] = "Authentication failed";
2366 vnc_write_u32(vs, sizeof(err));
2367 vnc_write(vs, err, sizeof(err));
2368 }
2369 vnc_client_error(vs);
2370 } else { /* Accept requested auth */
2371 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2372 switch (vs->auth) {
2373 case VNC_AUTH_NONE:
2374 VNC_DEBUG("Accept auth none\n");
2375 if (vs->minor >= 8) {
2376 vnc_write_u32(vs, 0); /* Accept auth completion */
2377 vnc_flush(vs);
2378 }
2379 start_client_init(vs);
2380 break;
2381
2382 case VNC_AUTH_VNC:
2383 VNC_DEBUG("Start VNC auth\n");
2384 start_auth_vnc(vs);
2385 break;
2386
2387 #ifdef CONFIG_VNC_TLS
2388 case VNC_AUTH_VENCRYPT:
2389 VNC_DEBUG("Accept VeNCrypt auth\n");
2390 start_auth_vencrypt(vs);
2391 break;
2392 #endif /* CONFIG_VNC_TLS */
2393
2394 #ifdef CONFIG_VNC_SASL
2395 case VNC_AUTH_SASL:
2396 VNC_DEBUG("Accept SASL auth\n");
2397 start_auth_sasl(vs);
2398 break;
2399 #endif /* CONFIG_VNC_SASL */
2400
2401 default: /* Should not be possible, but just in case */
2402 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2403 vnc_write_u8(vs, 1);
2404 if (vs->minor >= 8) {
2405 static const char err[] = "Authentication failed";
2406 vnc_write_u32(vs, sizeof(err));
2407 vnc_write(vs, err, sizeof(err));
2408 }
2409 vnc_client_error(vs);
2410 }
2411 }
2412 return 0;
2413 }
2414
2415 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2416 {
2417 char local[13];
2418
2419 memcpy(local, version, 12);
2420 local[12] = 0;
2421
2422 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2423 VNC_DEBUG("Malformed protocol version %s\n", local);
2424 vnc_client_error(vs);
2425 return 0;
2426 }
2427 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2428 if (vs->major != 3 ||
2429 (vs->minor != 3 &&
2430 vs->minor != 4 &&
2431 vs->minor != 5 &&
2432 vs->minor != 7 &&
2433 vs->minor != 8)) {
2434 VNC_DEBUG("Unsupported client version\n");
2435 vnc_write_u32(vs, VNC_AUTH_INVALID);
2436 vnc_flush(vs);
2437 vnc_client_error(vs);
2438 return 0;
2439 }
2440 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2441 * as equivalent to v3.3 by servers
2442 */
2443 if (vs->minor == 4 || vs->minor == 5)
2444 vs->minor = 3;
2445
2446 if (vs->minor == 3) {
2447 if (vs->auth == VNC_AUTH_NONE) {
2448 VNC_DEBUG("Tell client auth none\n");
2449 vnc_write_u32(vs, vs->auth);
2450 vnc_flush(vs);
2451 start_client_init(vs);
2452 } else if (vs->auth == VNC_AUTH_VNC) {
2453 VNC_DEBUG("Tell client VNC auth\n");
2454 vnc_write_u32(vs, vs->auth);
2455 vnc_flush(vs);
2456 start_auth_vnc(vs);
2457 } else {
2458 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2459 vnc_write_u32(vs, VNC_AUTH_INVALID);
2460 vnc_flush(vs);
2461 vnc_client_error(vs);
2462 }
2463 } else {
2464 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2465 vnc_write_u8(vs, 1); /* num auth */
2466 vnc_write_u8(vs, vs->auth);
2467 vnc_read_when(vs, protocol_client_auth, 1);
2468 vnc_flush(vs);
2469 }
2470
2471 return 0;
2472 }
2473
2474 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2475 {
2476 struct VncSurface *vs = &vd->guest;
2477
2478 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2479 }
2480
2481 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2482 {
2483 int i, j;
2484
2485 w = (x + w) / VNC_STAT_RECT;
2486 h = (y + h) / VNC_STAT_RECT;
2487 x /= VNC_STAT_RECT;
2488 y /= VNC_STAT_RECT;
2489
2490 for (j = y; j <= h; j++) {
2491 for (i = x; i <= w; i++) {
2492 vs->lossy_rect[j][i] = 1;
2493 }
2494 }
2495 }
2496
2497 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2498 {
2499 VncState *vs;
2500 int sty = y / VNC_STAT_RECT;
2501 int stx = x / VNC_STAT_RECT;
2502 int has_dirty = 0;
2503
2504 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2505 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2506
2507 QTAILQ_FOREACH(vs, &vd->clients, next) {
2508 int j;
2509
2510 /* kernel send buffers are full -> refresh later */
2511 if (vs->output.offset) {
2512 continue;
2513 }
2514
2515 if (!vs->lossy_rect[sty][stx]) {
2516 continue;
2517 }
2518
2519 vs->lossy_rect[sty][stx] = 0;
2520 for (j = 0; j < VNC_STAT_RECT; ++j) {
2521 bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);
2522 }
2523 has_dirty++;
2524 }
2525
2526 return has_dirty;
2527 }
2528
2529 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2530 {
2531 int width = pixman_image_get_width(vd->guest.fb);
2532 int height = pixman_image_get_height(vd->guest.fb);
2533 int x, y;
2534 struct timeval res;
2535 int has_dirty = 0;
2536
2537 for (y = 0; y < height; y += VNC_STAT_RECT) {
2538 for (x = 0; x < width; x += VNC_STAT_RECT) {
2539 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2540
2541 rect->updated = false;
2542 }
2543 }
2544
2545 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2546
2547 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2548 return has_dirty;
2549 }
2550 vd->guest.last_freq_check = *tv;
2551
2552 for (y = 0; y < height; y += VNC_STAT_RECT) {
2553 for (x = 0; x < width; x += VNC_STAT_RECT) {
2554 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2555 int count = ARRAY_SIZE(rect->times);
2556 struct timeval min, max;
2557
2558 if (!timerisset(&rect->times[count - 1])) {
2559 continue ;
2560 }
2561
2562 max = rect->times[(rect->idx + count - 1) % count];
2563 qemu_timersub(tv, &max, &res);
2564
2565 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2566 rect->freq = 0;
2567 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2568 memset(rect->times, 0, sizeof (rect->times));
2569 continue ;
2570 }
2571
2572 min = rect->times[rect->idx];
2573 max = rect->times[(rect->idx + count - 1) % count];
2574 qemu_timersub(&max, &min, &res);
2575
2576 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2577 rect->freq /= count;
2578 rect->freq = 1. / rect->freq;
2579 }
2580 }
2581 return has_dirty;
2582 }
2583
2584 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2585 {
2586 int i, j;
2587 double total = 0;
2588 int num = 0;
2589
2590 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2591 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2592
2593 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2594 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2595 total += vnc_stat_rect(vs->vd, i, j)->freq;
2596 num++;
2597 }
2598 }
2599
2600 if (num) {
2601 return total / num;
2602 } else {
2603 return 0;
2604 }
2605 }
2606
2607 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2608 {
2609 VncRectStat *rect;
2610
2611 rect = vnc_stat_rect(vd, x, y);
2612 if (rect->updated) {
2613 return ;
2614 }
2615 rect->times[rect->idx] = *tv;
2616 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2617 rect->updated = true;
2618 }
2619
2620 static int vnc_refresh_server_surface(VncDisplay *vd)
2621 {
2622 int width = pixman_image_get_width(vd->guest.fb);
2623 int height = pixman_image_get_height(vd->guest.fb);
2624 int y;
2625 uint8_t *guest_row;
2626 uint8_t *server_row;
2627 int cmp_bytes;
2628 VncState *vs;
2629 int has_dirty = 0;
2630 pixman_image_t *tmpbuf = NULL;
2631
2632 struct timeval tv = { 0, 0 };
2633
2634 if (!vd->non_adaptive) {
2635 gettimeofday(&tv, NULL);
2636 has_dirty = vnc_update_stats(vd, &tv);
2637 }
2638
2639 /*
2640 * Walk through the guest dirty map.
2641 * Check and copy modified bits from guest to server surface.
2642 * Update server dirty map.
2643 */
2644 cmp_bytes = 64;
2645 if (cmp_bytes > vnc_server_fb_stride(vd)) {
2646 cmp_bytes = vnc_server_fb_stride(vd);
2647 }
2648 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2649 int width = pixman_image_get_width(vd->server);
2650 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2651 }
2652 guest_row = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2653 server_row = (uint8_t *)pixman_image_get_data(vd->server);
2654 for (y = 0; y < height; y++) {
2655 if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) {
2656 int x;
2657 uint8_t *guest_ptr;
2658 uint8_t *server_ptr;
2659
2660 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2661 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2662 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2663 } else {
2664 guest_ptr = guest_row;
2665 }
2666 server_ptr = server_row;
2667
2668 for (x = 0; x + 15 < width;
2669 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2670 if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
2671 continue;
2672 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2673 continue;
2674 memcpy(server_ptr, guest_ptr, cmp_bytes);
2675 if (!vd->non_adaptive)
2676 vnc_rect_updated(vd, x, y, &tv);
2677 QTAILQ_FOREACH(vs, &vd->clients, next) {
2678 set_bit((x / 16), vs->dirty[y]);
2679 }
2680 has_dirty++;
2681 }
2682 }
2683 guest_row += pixman_image_get_stride(vd->guest.fb);
2684 server_row += pixman_image_get_stride(vd->server);
2685 }
2686 qemu_pixman_image_unref(tmpbuf);
2687 return has_dirty;
2688 }
2689
2690 static void vnc_refresh(DisplayChangeListener *dcl)
2691 {
2692 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2693 VncState *vs, *vn;
2694 int has_dirty, rects = 0;
2695
2696 graphic_hw_update(NULL);
2697
2698 if (vnc_trylock_display(vd)) {
2699 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2700 return;
2701 }
2702
2703 has_dirty = vnc_refresh_server_surface(vd);
2704 vnc_unlock_display(vd);
2705
2706 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2707 rects += vnc_update_client(vs, has_dirty);
2708 /* vs might be free()ed here */
2709 }
2710
2711 if (QTAILQ_EMPTY(&vd->clients)) {
2712 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2713 return;
2714 }
2715
2716 if (has_dirty && rects) {
2717 vd->dcl.update_interval /= 2;
2718 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2719 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2720 }
2721 } else {
2722 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2723 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2724 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2725 }
2726 }
2727 }
2728
2729 static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket)
2730 {
2731 VncState *vs = g_malloc0(sizeof(VncState));
2732 int i;
2733
2734 vs->csock = csock;
2735
2736 if (skipauth) {
2737 vs->auth = VNC_AUTH_NONE;
2738 #ifdef CONFIG_VNC_TLS
2739 vs->subauth = VNC_AUTH_INVALID;
2740 #endif
2741 } else {
2742 vs->auth = vd->auth;
2743 #ifdef CONFIG_VNC_TLS
2744 vs->subauth = vd->subauth;
2745 #endif
2746 }
2747
2748 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2749 for (i = 0; i < VNC_STAT_ROWS; ++i) {
2750 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
2751 }
2752
2753 VNC_DEBUG("New client on socket %d\n", csock);
2754 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2755 qemu_set_nonblock(vs->csock);
2756 #ifdef CONFIG_VNC_WS
2757 if (websocket) {
2758 vs->websocket = 1;
2759 qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
2760 } else
2761 #endif /* CONFIG_VNC_WS */
2762 {
2763 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2764 }
2765
2766 vnc_client_cache_addr(vs);
2767 vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2768 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2769
2770 vs->vd = vd;
2771
2772 #ifdef CONFIG_VNC_WS
2773 if (!vs->websocket)
2774 #endif
2775 {
2776 vnc_init_state(vs);
2777 }
2778 }
2779
2780 void vnc_init_state(VncState *vs)
2781 {
2782 vs->initialized = true;
2783 VncDisplay *vd = vs->vd;
2784
2785 vs->last_x = -1;
2786 vs->last_y = -1;
2787
2788 vs->as.freq = 44100;
2789 vs->as.nchannels = 2;
2790 vs->as.fmt = AUD_FMT_S16;
2791 vs->as.endianness = 0;
2792
2793 qemu_mutex_init(&vs->output_mutex);
2794 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2795
2796 QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2797
2798 graphic_hw_update(NULL);
2799
2800 vnc_write(vs, "RFB 003.008\n", 12);
2801 vnc_flush(vs);
2802 vnc_read_when(vs, protocol_version, 12);
2803 reset_keys(vs);
2804 if (vs->vd->lock_key_sync)
2805 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2806
2807 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2808 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2809
2810 /* vs might be free()ed here */
2811 }
2812
2813 static void vnc_listen_read(void *opaque, bool websocket)
2814 {
2815 VncDisplay *vs = opaque;
2816 struct sockaddr_in addr;
2817 socklen_t addrlen = sizeof(addr);
2818 int csock;
2819
2820 /* Catch-up */
2821 graphic_hw_update(NULL);
2822 #ifdef CONFIG_VNC_WS
2823 if (websocket) {
2824 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen);
2825 } else
2826 #endif /* CONFIG_VNC_WS */
2827 {
2828 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2829 }
2830
2831 if (csock != -1) {
2832 vnc_connect(vs, csock, 0, websocket);
2833 }
2834 }
2835
2836 static void vnc_listen_regular_read(void *opaque)
2837 {
2838 vnc_listen_read(opaque, 0);
2839 }
2840
2841 #ifdef CONFIG_VNC_WS
2842 static void vnc_listen_websocket_read(void *opaque)
2843 {
2844 vnc_listen_read(opaque, 1);
2845 }
2846 #endif /* CONFIG_VNC_WS */
2847
2848 static const DisplayChangeListenerOps dcl_ops = {
2849 .dpy_name = "vnc",
2850 .dpy_refresh = vnc_refresh,
2851 .dpy_gfx_copy = vnc_dpy_copy,
2852 .dpy_gfx_update = vnc_dpy_update,
2853 .dpy_gfx_switch = vnc_dpy_switch,
2854 .dpy_mouse_set = vnc_mouse_set,
2855 .dpy_cursor_define = vnc_dpy_cursor_define,
2856 };
2857
2858 void vnc_display_init(DisplayState *ds)
2859 {
2860 VncDisplay *vs = g_malloc0(sizeof(*vs));
2861
2862 vnc_display = vs;
2863
2864 vs->lsock = -1;
2865 #ifdef CONFIG_VNC_WS
2866 vs->lwebsock = -1;
2867 #endif
2868
2869 QTAILQ_INIT(&vs->clients);
2870 vs->expires = TIME_MAX;
2871
2872 if (keyboard_layout)
2873 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2874 else
2875 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2876
2877 if (!vs->kbd_layout)
2878 exit(1);
2879
2880 qemu_mutex_init(&vs->mutex);
2881 vnc_start_worker_thread();
2882
2883 vs->dcl.ops = &dcl_ops;
2884 register_displaychangelistener(&vs->dcl);
2885 }
2886
2887
2888 static void vnc_display_close(DisplayState *ds)
2889 {
2890 VncDisplay *vs = vnc_display;
2891
2892 if (!vs)
2893 return;
2894 if (vs->display) {
2895 g_free(vs->display);
2896 vs->display = NULL;
2897 }
2898 if (vs->lsock != -1) {
2899 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2900 close(vs->lsock);
2901 vs->lsock = -1;
2902 }
2903 #ifdef CONFIG_VNC_WS
2904 g_free(vs->ws_display);
2905 vs->ws_display = NULL;
2906 if (vs->lwebsock != -1) {
2907 qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);
2908 close(vs->lwebsock);
2909 vs->lwebsock = -1;
2910 }
2911 #endif /* CONFIG_VNC_WS */
2912 vs->auth = VNC_AUTH_INVALID;
2913 #ifdef CONFIG_VNC_TLS
2914 vs->subauth = VNC_AUTH_INVALID;
2915 vs->tls.x509verify = 0;
2916 #endif
2917 }
2918
2919 static int vnc_display_disable_login(DisplayState *ds)
2920 {
2921 VncDisplay *vs = vnc_display;
2922
2923 if (!vs) {
2924 return -1;
2925 }
2926
2927 if (vs->password) {
2928 g_free(vs->password);
2929 }
2930
2931 vs->password = NULL;
2932 if (vs->auth == VNC_AUTH_NONE) {
2933 vs->auth = VNC_AUTH_VNC;
2934 }
2935
2936 return 0;
2937 }
2938
2939 int vnc_display_password(DisplayState *ds, const char *password)
2940 {
2941 VncDisplay *vs = vnc_display;
2942
2943 if (!vs) {
2944 return -EINVAL;
2945 }
2946
2947 if (!password) {
2948 /* This is not the intention of this interface but err on the side
2949 of being safe */
2950 return vnc_display_disable_login(ds);
2951 }
2952
2953 if (vs->password) {
2954 g_free(vs->password);
2955 vs->password = NULL;
2956 }
2957 vs->password = g_strdup(password);
2958 if (vs->auth == VNC_AUTH_NONE) {
2959 vs->auth = VNC_AUTH_VNC;
2960 }
2961
2962 return 0;
2963 }
2964
2965 int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2966 {
2967 VncDisplay *vs = vnc_display;
2968
2969 if (!vs) {
2970 return -EINVAL;
2971 }
2972
2973 vs->expires = expires;
2974 return 0;
2975 }
2976
2977 char *vnc_display_local_addr(DisplayState *ds)
2978 {
2979 VncDisplay *vs = vnc_display;
2980
2981 return vnc_socket_local_addr("%s:%s", vs->lsock);
2982 }
2983
2984 void vnc_display_open(DisplayState *ds, const char *display, Error **errp)
2985 {
2986 VncDisplay *vs = vnc_display;
2987 const char *options;
2988 int password = 0;
2989 int reverse = 0;
2990 #ifdef CONFIG_VNC_TLS
2991 int tls = 0, x509 = 0;
2992 #endif
2993 #ifdef CONFIG_VNC_SASL
2994 int sasl = 0;
2995 int saslErr;
2996 #endif
2997 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2998 int acl = 0;
2999 #endif
3000 int lock_key_sync = 1;
3001
3002 if (!vnc_display) {
3003 error_setg(errp, "VNC display not active");
3004 return;
3005 }
3006 vnc_display_close(ds);
3007 if (strcmp(display, "none") == 0)
3008 return;
3009
3010 vs->display = g_strdup(display);
3011 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3012
3013 options = display;
3014 while ((options = strchr(options, ','))) {
3015 options++;
3016 if (strncmp(options, "password", 8) == 0) {
3017 if (fips_get_state()) {
3018 error_setg(errp,
3019 "VNC password auth disabled due to FIPS mode, "
3020 "consider using the VeNCrypt or SASL authentication "
3021 "methods as an alternative");
3022 goto fail;
3023 }
3024 password = 1; /* Require password auth */
3025 } else if (strncmp(options, "reverse", 7) == 0) {
3026 reverse = 1;
3027 } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
3028 lock_key_sync = 0;
3029 #ifdef CONFIG_VNC_SASL
3030 } else if (strncmp(options, "sasl", 4) == 0) {
3031 sasl = 1; /* Require SASL auth */
3032 #endif
3033 #ifdef CONFIG_VNC_WS
3034 } else if (strncmp(options, "websocket", 9) == 0) {
3035 char *start, *end;
3036 vs->websocket = 1;
3037
3038 /* Check for 'websocket=<port>' */
3039 start = strchr(options, '=');
3040 end = strchr(options, ',');
3041 if (start && (!end || (start < end))) {
3042 int len = end ? end-(start+1) : strlen(start+1);
3043 if (len < 6) {
3044 /* extract the host specification from display */
3045 char *host = NULL, *port = NULL, *host_end = NULL;
3046 port = g_strndup(start + 1, len);
3047
3048 /* ipv6 hosts have colons */
3049 end = strchr(display, ',');
3050 host_end = g_strrstr_len(display, end - display, ":");
3051
3052 if (host_end) {
3053 host = g_strndup(display, host_end - display + 1);
3054 } else {
3055 host = g_strndup(":", 1);
3056 }
3057 vs->ws_display = g_strconcat(host, port, NULL);
3058 g_free(host);
3059 g_free(port);
3060 }
3061 }
3062 #endif /* CONFIG_VNC_WS */
3063 #ifdef CONFIG_VNC_TLS
3064 } else if (strncmp(options, "tls", 3) == 0) {
3065 tls = 1; /* Require TLS */
3066 } else if (strncmp(options, "x509", 4) == 0) {
3067 char *start, *end;
3068 x509 = 1; /* Require x509 certificates */
3069 if (strncmp(options, "x509verify", 10) == 0)
3070 vs->tls.x509verify = 1; /* ...and verify client certs */
3071
3072 /* Now check for 'x509=/some/path' postfix
3073 * and use that to setup x509 certificate/key paths */
3074 start = strchr(options, '=');
3075 end = strchr(options, ',');
3076 if (start && (!end || (start < end))) {
3077 int len = end ? end-(start+1) : strlen(start+1);
3078 char *path = g_strndup(start + 1, len);
3079
3080 VNC_DEBUG("Trying certificate path '%s'\n", path);
3081 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
3082 error_setg(errp, "Failed to find x509 certificates/keys in %s", path);
3083 g_free(path);
3084 goto fail;
3085 }
3086 g_free(path);
3087 } else {
3088 error_setg(errp, "No certificate path provided");
3089 goto fail;
3090 }
3091 #endif
3092 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
3093 } else if (strncmp(options, "acl", 3) == 0) {
3094 acl = 1;
3095 #endif
3096 } else if (strncmp(options, "lossy", 5) == 0) {
3097 vs->lossy = true;
3098 } else if (strncmp(options, "non-adaptive", 12) == 0) {
3099 vs->non_adaptive = true;
3100 } else if (strncmp(options, "share=", 6) == 0) {
3101 if (strncmp(options+6, "ignore", 6) == 0) {
3102 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
3103 } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
3104 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3105 } else if (strncmp(options+6, "force-shared", 12) == 0) {
3106 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3107 } else {
3108 error_setg(errp, "unknown vnc share= option");
3109 goto fail;
3110 }
3111 }
3112 }
3113
3114 #ifdef CONFIG_VNC_TLS
3115 if (acl && x509 && vs->tls.x509verify) {
3116 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
3117 fprintf(stderr, "Failed to create x509 dname ACL\n");
3118 exit(1);
3119 }
3120 }
3121 #endif
3122 #ifdef CONFIG_VNC_SASL
3123 if (acl && sasl) {
3124 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
3125 fprintf(stderr, "Failed to create username ACL\n");
3126 exit(1);
3127 }
3128 }
3129 #endif
3130
3131 /*
3132 * Combinations we support here:
3133 *
3134 * - no-auth (clear text, no auth)
3135 * - password (clear text, weak auth)
3136 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
3137 * - tls (encrypt, weak anonymous creds, no auth)
3138 * - tls + password (encrypt, weak anonymous creds, weak auth)
3139 * - tls + sasl (encrypt, weak anonymous creds, good auth)
3140 * - tls + x509 (encrypt, good x509 creds, no auth)
3141 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
3142 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
3143 *
3144 * NB1. TLS is a stackable auth scheme.
3145 * NB2. the x509 schemes have option to validate a client cert dname
3146 */
3147 if (password) {
3148 #ifdef CONFIG_VNC_TLS
3149 if (tls) {
3150 vs->auth = VNC_AUTH_VENCRYPT;
3151 if (x509) {
3152 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3153 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3154 } else {
3155 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3156 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3157 }
3158 } else {
3159 #endif /* CONFIG_VNC_TLS */
3160 VNC_DEBUG("Initializing VNC server with password auth\n");
3161 vs->auth = VNC_AUTH_VNC;
3162 #ifdef CONFIG_VNC_TLS
3163 vs->subauth = VNC_AUTH_INVALID;
3164 }
3165 #endif /* CONFIG_VNC_TLS */
3166 #ifdef CONFIG_VNC_SASL
3167 } else if (sasl) {
3168 #ifdef CONFIG_VNC_TLS
3169 if (tls) {
3170 vs->auth = VNC_AUTH_VENCRYPT;
3171 if (x509) {
3172 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3173 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3174 } else {
3175 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3176 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3177 }
3178 } else {
3179 #endif /* CONFIG_VNC_TLS */
3180 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3181 vs->auth = VNC_AUTH_SASL;
3182 #ifdef CONFIG_VNC_TLS
3183 vs->subauth = VNC_AUTH_INVALID;
3184 }
3185 #endif /* CONFIG_VNC_TLS */
3186 #endif /* CONFIG_VNC_SASL */
3187 } else {
3188 #ifdef CONFIG_VNC_TLS
3189 if (tls) {
3190 vs->auth = VNC_AUTH_VENCRYPT;
3191 if (x509) {
3192 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3193 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3194 } else {
3195 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3196 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3197 }
3198 } else {
3199 #endif
3200 VNC_DEBUG("Initializing VNC server with no auth\n");
3201 vs->auth = VNC_AUTH_NONE;
3202 #ifdef CONFIG_VNC_TLS
3203 vs->subauth = VNC_AUTH_INVALID;
3204 }
3205 #endif
3206 }
3207
3208 #ifdef CONFIG_VNC_SASL
3209 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3210 error_setg(errp, "Failed to initialize SASL auth: %s",
3211 sasl_errstring(saslErr, NULL, NULL));
3212 goto fail;
3213 }
3214 #endif
3215 vs->lock_key_sync = lock_key_sync;
3216
3217 if (reverse) {
3218 /* connect to viewer */
3219 int csock;
3220 vs->lsock = -1;
3221 #ifdef CONFIG_VNC_WS
3222 vs->lwebsock = -1;
3223 #endif
3224 if (strncmp(display, "unix:", 5) == 0) {
3225 csock = unix_connect(display+5, errp);
3226 } else {
3227 csock = inet_connect(display, errp);
3228 }
3229 if (csock < 0) {
3230 goto fail;
3231 }
3232 vnc_connect(vs, csock, 0, 0);
3233 } else {
3234 /* listen for connects */
3235 char *dpy;
3236 dpy = g_malloc(256);
3237 if (strncmp(display, "unix:", 5) == 0) {
3238 pstrcpy(dpy, 256, "unix:");
3239 vs->lsock = unix_listen(display+5, dpy+5, 256-5, errp);
3240 } else {
3241 vs->lsock = inet_listen(display, dpy, 256,
3242 SOCK_STREAM, 5900, errp);
3243 if (vs->lsock < 0) {
3244 g_free(dpy);
3245 goto fail;
3246 }
3247 #ifdef CONFIG_VNC_WS
3248 if (vs->websocket) {
3249 if (vs->ws_display) {
3250 vs->lwebsock = inet_listen(vs->ws_display, NULL, 256,
3251 SOCK_STREAM, 0, errp);
3252 } else {
3253 vs->lwebsock = inet_listen(vs->display, NULL, 256,
3254 SOCK_STREAM, 5700, errp);
3255 }
3256
3257 if (vs->lwebsock < 0) {
3258 if (vs->lsock) {
3259 close(vs->lsock);
3260 vs->lsock = -1;
3261 }
3262 g_free(dpy);
3263 goto fail;
3264 }
3265 }
3266 #endif /* CONFIG_VNC_WS */
3267 }
3268 g_free(vs->display);
3269 vs->display = dpy;
3270 qemu_set_fd_handler2(vs->lsock, NULL,
3271 vnc_listen_regular_read, NULL, vs);
3272 #ifdef CONFIG_VNC_WS
3273 if (vs->websocket) {
3274 qemu_set_fd_handler2(vs->lwebsock, NULL,
3275 vnc_listen_websocket_read, NULL, vs);
3276 }
3277 #endif /* CONFIG_VNC_WS */
3278 }
3279 return;
3280
3281 fail:
3282 g_free(vs->display);
3283 vs->display = NULL;
3284 #ifdef CONFIG_VNC_WS
3285 g_free(vs->ws_display);
3286 vs->ws_display = NULL;
3287 #endif /* CONFIG_VNC_WS */
3288 }
3289
3290 void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3291 {
3292 VncDisplay *vs = vnc_display;
3293
3294 vnc_connect(vs, csock, skipauth, 0);
3295 }
QEMU mirror