]> git.proxmox.com Git - qemu.git/blob - ui/vnc.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote-tracking branch 'mdroth/qga-pull-3-12-2012' into staging
[qemu.git] / ui / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "vnc-jobs.h"
29 #include "sysemu.h"
30 #include "qemu_socket.h"
31 #include "qemu-timer.h"
32 #include "acl.h"
33 #include "qemu-objects.h"
34 #include "qmp-commands.h"
35
36 #define VNC_REFRESH_INTERVAL_BASE 30
37 #define VNC_REFRESH_INTERVAL_INC 50
38 #define VNC_REFRESH_INTERVAL_MAX 2000
39 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
40 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
41
42 #include "vnc_keysym.h"
43 #include "d3des.h"
44
45 static VncDisplay *vnc_display; /* needed for info vnc */
46 static DisplayChangeListener *dcl;
47
48 static int vnc_cursor_define(VncState *vs);
49 static void vnc_release_modifiers(VncState *vs);
50
51 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
52 {
53 #ifdef _VNC_DEBUG
54 static const char *mn[] = {
55 [0] = "undefined",
56 [VNC_SHARE_MODE_CONNECTING] = "connecting",
57 [VNC_SHARE_MODE_SHARED] = "shared",
58 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
59 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
60 };
61 fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
62 vs->csock, mn[vs->share_mode], mn[mode]);
63 #endif
64
65 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
66 vs->vd->num_exclusive--;
67 }
68 vs->share_mode = mode;
69 if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
70 vs->vd->num_exclusive++;
71 }
72 }
73
74 static char *addr_to_string(const char *format,
75 struct sockaddr_storage *sa,
76 socklen_t salen) {
77 char *addr;
78 char host[NI_MAXHOST];
79 char serv[NI_MAXSERV];
80 int err;
81 size_t addrlen;
82
83 if ((err = getnameinfo((struct sockaddr *)sa, salen,
84 host, sizeof(host),
85 serv, sizeof(serv),
86 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
87 VNC_DEBUG("Cannot resolve address %d: %s\n",
88 err, gai_strerror(err));
89 return NULL;
90 }
91
92 /* Enough for the existing format + the 2 vars we're
93 * substituting in. */
94 addrlen = strlen(format) + strlen(host) + strlen(serv);
95 addr = g_malloc(addrlen + 1);
96 snprintf(addr, addrlen, format, host, serv);
97 addr[addrlen] = '\0';
98
99 return addr;
100 }
101
102
103 char *vnc_socket_local_addr(const char *format, int fd) {
104 struct sockaddr_storage sa;
105 socklen_t salen;
106
107 salen = sizeof(sa);
108 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
109 return NULL;
110
111 return addr_to_string(format, &sa, salen);
112 }
113
114 char *vnc_socket_remote_addr(const char *format, int fd) {
115 struct sockaddr_storage sa;
116 socklen_t salen;
117
118 salen = sizeof(sa);
119 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
120 return NULL;
121
122 return addr_to_string(format, &sa, salen);
123 }
124
125 static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
126 socklen_t salen)
127 {
128 char host[NI_MAXHOST];
129 char serv[NI_MAXSERV];
130 int err;
131
132 if ((err = getnameinfo((struct sockaddr *)sa, salen,
133 host, sizeof(host),
134 serv, sizeof(serv),
135 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
136 VNC_DEBUG("Cannot resolve address %d: %s\n",
137 err, gai_strerror(err));
138 return -1;
139 }
140
141 qdict_put(qdict, "host", qstring_from_str(host));
142 qdict_put(qdict, "service", qstring_from_str(serv));
143 qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
144
145 return 0;
146 }
147
148 static int vnc_server_addr_put(QDict *qdict, int fd)
149 {
150 struct sockaddr_storage sa;
151 socklen_t salen;
152
153 salen = sizeof(sa);
154 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
155 return -1;
156 }
157
158 return put_addr_qdict(qdict, &sa, salen);
159 }
160
161 static int vnc_qdict_remote_addr(QDict *qdict, int fd)
162 {
163 struct sockaddr_storage sa;
164 socklen_t salen;
165
166 salen = sizeof(sa);
167 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
168 return -1;
169 }
170
171 return put_addr_qdict(qdict, &sa, salen);
172 }
173
174 static const char *vnc_auth_name(VncDisplay *vd) {
175 switch (vd->auth) {
176 case VNC_AUTH_INVALID:
177 return "invalid";
178 case VNC_AUTH_NONE:
179 return "none";
180 case VNC_AUTH_VNC:
181 return "vnc";
182 case VNC_AUTH_RA2:
183 return "ra2";
184 case VNC_AUTH_RA2NE:
185 return "ra2ne";
186 case VNC_AUTH_TIGHT:
187 return "tight";
188 case VNC_AUTH_ULTRA:
189 return "ultra";
190 case VNC_AUTH_TLS:
191 return "tls";
192 case VNC_AUTH_VENCRYPT:
193 #ifdef CONFIG_VNC_TLS
194 switch (vd->subauth) {
195 case VNC_AUTH_VENCRYPT_PLAIN:
196 return "vencrypt+plain";
197 case VNC_AUTH_VENCRYPT_TLSNONE:
198 return "vencrypt+tls+none";
199 case VNC_AUTH_VENCRYPT_TLSVNC:
200 return "vencrypt+tls+vnc";
201 case VNC_AUTH_VENCRYPT_TLSPLAIN:
202 return "vencrypt+tls+plain";
203 case VNC_AUTH_VENCRYPT_X509NONE:
204 return "vencrypt+x509+none";
205 case VNC_AUTH_VENCRYPT_X509VNC:
206 return "vencrypt+x509+vnc";
207 case VNC_AUTH_VENCRYPT_X509PLAIN:
208 return "vencrypt+x509+plain";
209 case VNC_AUTH_VENCRYPT_TLSSASL:
210 return "vencrypt+tls+sasl";
211 case VNC_AUTH_VENCRYPT_X509SASL:
212 return "vencrypt+x509+sasl";
213 default:
214 return "vencrypt";
215 }
216 #else
217 return "vencrypt";
218 #endif
219 case VNC_AUTH_SASL:
220 return "sasl";
221 }
222 return "unknown";
223 }
224
225 static int vnc_server_info_put(QDict *qdict)
226 {
227 if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
228 return -1;
229 }
230
231 qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
232 return 0;
233 }
234
235 static void vnc_client_cache_auth(VncState *client)
236 {
237 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
238 QDict *qdict;
239 #endif
240
241 if (!client->info) {
242 return;
243 }
244
245 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
246 qdict = qobject_to_qdict(client->info);
247 #endif
248
249 #ifdef CONFIG_VNC_TLS
250 if (client->tls.session &&
251 client->tls.dname) {
252 qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
253 }
254 #endif
255 #ifdef CONFIG_VNC_SASL
256 if (client->sasl.conn &&
257 client->sasl.username) {
258 qdict_put(qdict, "sasl_username",
259 qstring_from_str(client->sasl.username));
260 }
261 #endif
262 }
263
264 static void vnc_client_cache_addr(VncState *client)
265 {
266 QDict *qdict;
267
268 qdict = qdict_new();
269 if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
270 QDECREF(qdict);
271 /* XXX: how to report the error? */
272 return;
273 }
274
275 client->info = QOBJECT(qdict);
276 }
277
278 static void vnc_qmp_event(VncState *vs, MonitorEvent event)
279 {
280 QDict *server;
281 QObject *data;
282
283 if (!vs->info) {
284 return;
285 }
286
287 server = qdict_new();
288 if (vnc_server_info_put(server) < 0) {
289 QDECREF(server);
290 return;
291 }
292
293 data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
294 vs->info, QOBJECT(server));
295
296 monitor_protocol_event(event, data);
297
298 qobject_incref(vs->info);
299 qobject_decref(data);
300 }
301
302 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
303 {
304 struct sockaddr_storage sa;
305 socklen_t salen = sizeof(sa);
306 char host[NI_MAXHOST];
307 char serv[NI_MAXSERV];
308 VncClientInfo *info;
309
310 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
311 return NULL;
312 }
313
314 if (getnameinfo((struct sockaddr *)&sa, salen,
315 host, sizeof(host),
316 serv, sizeof(serv),
317 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
318 return NULL;
319 }
320
321 info = g_malloc0(sizeof(*info));
322 info->host = g_strdup(host);
323 info->service = g_strdup(serv);
324 info->family = g_strdup(inet_strfamily(sa.ss_family));
325
326 #ifdef CONFIG_VNC_TLS
327 if (client->tls.session && client->tls.dname) {
328 info->has_x509_dname = true;
329 info->x509_dname = g_strdup(client->tls.dname);
330 }
331 #endif
332 #ifdef CONFIG_VNC_SASL
333 if (client->sasl.conn && client->sasl.username) {
334 info->has_sasl_username = true;
335 info->sasl_username = g_strdup(client->sasl.username);
336 }
337 #endif
338
339 return info;
340 }
341
342 VncInfo *qmp_query_vnc(Error **errp)
343 {
344 VncInfo *info = g_malloc0(sizeof(*info));
345
346 if (vnc_display == NULL || vnc_display->display == NULL) {
347 info->enabled = false;
348 } else {
349 VncClientInfoList *cur_item = NULL;
350 struct sockaddr_storage sa;
351 socklen_t salen = sizeof(sa);
352 char host[NI_MAXHOST];
353 char serv[NI_MAXSERV];
354 VncState *client;
355
356 info->enabled = true;
357
358 /* for compatibility with the original command */
359 info->has_clients = true;
360
361 QTAILQ_FOREACH(client, &vnc_display->clients, next) {
362 VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
363 cinfo->value = qmp_query_vnc_client(client);
364
365 /* XXX: waiting for the qapi to support GSList */
366 if (!cur_item) {
367 info->clients = cur_item = cinfo;
368 } else {
369 cur_item->next = cinfo;
370 cur_item = cinfo;
371 }
372 }
373
374 if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
375 &salen) == -1) {
376 error_set(errp, QERR_UNDEFINED_ERROR);
377 goto out_error;
378 }
379
380 if (getnameinfo((struct sockaddr *)&sa, salen,
381 host, sizeof(host),
382 serv, sizeof(serv),
383 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
384 error_set(errp, QERR_UNDEFINED_ERROR);
385 goto out_error;
386 }
387
388 info->has_host = true;
389 info->host = g_strdup(host);
390
391 info->has_service = true;
392 info->service = g_strdup(serv);
393
394 info->has_family = true;
395 info->family = g_strdup(inet_strfamily(sa.ss_family));
396
397 info->has_auth = true;
398 info->auth = g_strdup(vnc_auth_name(vnc_display));
399 }
400
401 return info;
402
403 out_error:
404 qapi_free_VncInfo(info);
405 return NULL;
406 }
407
408 /* TODO
409 1) Get the queue working for IO.
410 2) there is some weirdness when using the -S option (the screen is grey
411 and not totally invalidated
412 3) resolutions > 1024
413 */
414
415 static int vnc_update_client(VncState *vs, int has_dirty);
416 static int vnc_update_client_sync(VncState *vs, int has_dirty);
417 static void vnc_disconnect_start(VncState *vs);
418 static void vnc_disconnect_finish(VncState *vs);
419 static void vnc_init_timer(VncDisplay *vd);
420 static void vnc_remove_timer(VncDisplay *vd);
421
422 static void vnc_colordepth(VncState *vs);
423 static void framebuffer_update_request(VncState *vs, int incremental,
424 int x_position, int y_position,
425 int w, int h);
426 static void vnc_refresh(void *opaque);
427 static int vnc_refresh_server_surface(VncDisplay *vd);
428
429 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
430 {
431 int i;
432 VncDisplay *vd = ds->opaque;
433 struct VncSurface *s = &vd->guest;
434
435 h += y;
436
437 /* round x down to ensure the loop only spans one 16-pixel block per,
438 iteration. otherwise, if (x % 16) != 0, the last iteration may span
439 two 16-pixel blocks but we only mark the first as dirty
440 */
441 w += (x % 16);
442 x -= (x % 16);
443
444 x = MIN(x, s->ds->width);
445 y = MIN(y, s->ds->height);
446 w = MIN(x + w, s->ds->width) - x;
447 h = MIN(h, s->ds->height);
448
449 for (; y < h; y++)
450 for (i = 0; i < w; i += 16)
451 set_bit((x + i) / 16, s->dirty[y]);
452 }
453
454 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
455 int32_t encoding)
456 {
457 vnc_write_u16(vs, x);
458 vnc_write_u16(vs, y);
459 vnc_write_u16(vs, w);
460 vnc_write_u16(vs, h);
461
462 vnc_write_s32(vs, encoding);
463 }
464
465 void buffer_reserve(Buffer *buffer, size_t len)
466 {
467 if ((buffer->capacity - buffer->offset) < len) {
468 buffer->capacity += (len + 1024);
469 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
470 if (buffer->buffer == NULL) {
471 fprintf(stderr, "vnc: out of memory\n");
472 exit(1);
473 }
474 }
475 }
476
477 int buffer_empty(Buffer *buffer)
478 {
479 return buffer->offset == 0;
480 }
481
482 uint8_t *buffer_end(Buffer *buffer)
483 {
484 return buffer->buffer + buffer->offset;
485 }
486
487 void buffer_reset(Buffer *buffer)
488 {
489 buffer->offset = 0;
490 }
491
492 void buffer_free(Buffer *buffer)
493 {
494 g_free(buffer->buffer);
495 buffer->offset = 0;
496 buffer->capacity = 0;
497 buffer->buffer = NULL;
498 }
499
500 void buffer_append(Buffer *buffer, const void *data, size_t len)
501 {
502 memcpy(buffer->buffer + buffer->offset, data, len);
503 buffer->offset += len;
504 }
505
506 static void vnc_desktop_resize(VncState *vs)
507 {
508 DisplayState *ds = vs->ds;
509
510 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
511 return;
512 }
513 if (vs->client_width == ds_get_width(ds) &&
514 vs->client_height == ds_get_height(ds)) {
515 return;
516 }
517 vs->client_width = ds_get_width(ds);
518 vs->client_height = ds_get_height(ds);
519 vnc_lock_output(vs);
520 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
521 vnc_write_u8(vs, 0);
522 vnc_write_u16(vs, 1); /* number of rects */
523 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
524 VNC_ENCODING_DESKTOPRESIZE);
525 vnc_unlock_output(vs);
526 vnc_flush(vs);
527 }
528
529 #ifdef CONFIG_VNC_THREAD
530 static void vnc_abort_display_jobs(VncDisplay *vd)
531 {
532 VncState *vs;
533
534 QTAILQ_FOREACH(vs, &vd->clients, next) {
535 vnc_lock_output(vs);
536 vs->abort = true;
537 vnc_unlock_output(vs);
538 }
539 QTAILQ_FOREACH(vs, &vd->clients, next) {
540 vnc_jobs_join(vs);
541 }
542 QTAILQ_FOREACH(vs, &vd->clients, next) {
543 vnc_lock_output(vs);
544 vs->abort = false;
545 vnc_unlock_output(vs);
546 }
547 }
548 #else
549 static void vnc_abort_display_jobs(VncDisplay *vd)
550 {
551 }
552 #endif
553
554 static void vnc_dpy_resize(DisplayState *ds)
555 {
556 VncDisplay *vd = ds->opaque;
557 VncState *vs;
558
559 vnc_abort_display_jobs(vd);
560
561 /* server surface */
562 if (!vd->server)
563 vd->server = g_malloc0(sizeof(*vd->server));
564 if (vd->server->data)
565 g_free(vd->server->data);
566 *(vd->server) = *(ds->surface);
567 vd->server->data = g_malloc0(vd->server->linesize *
568 vd->server->height);
569
570 /* guest surface */
571 if (!vd->guest.ds)
572 vd->guest.ds = g_malloc0(sizeof(*vd->guest.ds));
573 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
574 console_color_init(ds);
575 *(vd->guest.ds) = *(ds->surface);
576 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
577
578 QTAILQ_FOREACH(vs, &vd->clients, next) {
579 vnc_colordepth(vs);
580 vnc_desktop_resize(vs);
581 if (vs->vd->cursor) {
582 vnc_cursor_define(vs);
583 }
584 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
585 }
586 }
587
588 /* fastest code */
589 static void vnc_write_pixels_copy(VncState *vs, struct PixelFormat *pf,
590 void *pixels, int size)
591 {
592 vnc_write(vs, pixels, size);
593 }
594
595 /* slowest but generic code. */
596 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
597 {
598 uint8_t r, g, b;
599 VncDisplay *vd = vs->vd;
600
601 r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
602 vd->server->pf.rbits);
603 g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
604 vd->server->pf.gbits);
605 b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
606 vd->server->pf.bbits);
607 v = (r << vs->clientds.pf.rshift) |
608 (g << vs->clientds.pf.gshift) |
609 (b << vs->clientds.pf.bshift);
610 switch(vs->clientds.pf.bytes_per_pixel) {
611 case 1:
612 buf[0] = v;
613 break;
614 case 2:
615 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
616 buf[0] = v >> 8;
617 buf[1] = v;
618 } else {
619 buf[1] = v >> 8;
620 buf[0] = v;
621 }
622 break;
623 default:
624 case 4:
625 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
626 buf[0] = v >> 24;
627 buf[1] = v >> 16;
628 buf[2] = v >> 8;
629 buf[3] = v;
630 } else {
631 buf[3] = v >> 24;
632 buf[2] = v >> 16;
633 buf[1] = v >> 8;
634 buf[0] = v;
635 }
636 break;
637 }
638 }
639
640 static void vnc_write_pixels_generic(VncState *vs, struct PixelFormat *pf,
641 void *pixels1, int size)
642 {
643 uint8_t buf[4];
644
645 if (pf->bytes_per_pixel == 4) {
646 uint32_t *pixels = pixels1;
647 int n, i;
648 n = size >> 2;
649 for(i = 0; i < n; i++) {
650 vnc_convert_pixel(vs, buf, pixels[i]);
651 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
652 }
653 } else if (pf->bytes_per_pixel == 2) {
654 uint16_t *pixels = pixels1;
655 int n, i;
656 n = size >> 1;
657 for(i = 0; i < n; i++) {
658 vnc_convert_pixel(vs, buf, pixels[i]);
659 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
660 }
661 } else if (pf->bytes_per_pixel == 1) {
662 uint8_t *pixels = pixels1;
663 int n, i;
664 n = size;
665 for(i = 0; i < n; i++) {
666 vnc_convert_pixel(vs, buf, pixels[i]);
667 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
668 }
669 } else {
670 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
671 }
672 }
673
674 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
675 {
676 int i;
677 uint8_t *row;
678 VncDisplay *vd = vs->vd;
679
680 row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
681 for (i = 0; i < h; i++) {
682 vs->write_pixels(vs, &vd->server->pf, row, w * ds_get_bytes_per_pixel(vs->ds));
683 row += ds_get_linesize(vs->ds);
684 }
685 return 1;
686 }
687
688 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
689 {
690 int n = 0;
691
692 switch(vs->vnc_encoding) {
693 case VNC_ENCODING_ZLIB:
694 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
695 break;
696 case VNC_ENCODING_HEXTILE:
697 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
698 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
699 break;
700 case VNC_ENCODING_TIGHT:
701 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
702 break;
703 case VNC_ENCODING_TIGHT_PNG:
704 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
705 break;
706 case VNC_ENCODING_ZRLE:
707 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
708 break;
709 case VNC_ENCODING_ZYWRLE:
710 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
711 break;
712 default:
713 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
714 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
715 break;
716 }
717 return n;
718 }
719
720 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
721 {
722 /* send bitblit op to the vnc client */
723 vnc_lock_output(vs);
724 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
725 vnc_write_u8(vs, 0);
726 vnc_write_u16(vs, 1); /* number of rects */
727 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
728 vnc_write_u16(vs, src_x);
729 vnc_write_u16(vs, src_y);
730 vnc_unlock_output(vs);
731 vnc_flush(vs);
732 }
733
734 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
735 {
736 VncDisplay *vd = ds->opaque;
737 VncState *vs, *vn;
738 uint8_t *src_row;
739 uint8_t *dst_row;
740 int i,x,y,pitch,depth,inc,w_lim,s;
741 int cmp_bytes;
742
743 vnc_refresh_server_surface(vd);
744 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
745 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
746 vs->force_update = 1;
747 vnc_update_client_sync(vs, 1);
748 /* vs might be free()ed here */
749 }
750 }
751
752 /* do bitblit op on the local surface too */
753 pitch = ds_get_linesize(vd->ds);
754 depth = ds_get_bytes_per_pixel(vd->ds);
755 src_row = vd->server->data + pitch * src_y + depth * src_x;
756 dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
757 y = dst_y;
758 inc = 1;
759 if (dst_y > src_y) {
760 /* copy backwards */
761 src_row += pitch * (h-1);
762 dst_row += pitch * (h-1);
763 pitch = -pitch;
764 y = dst_y + h - 1;
765 inc = -1;
766 }
767 w_lim = w - (16 - (dst_x % 16));
768 if (w_lim < 0)
769 w_lim = w;
770 else
771 w_lim = w - (w_lim % 16);
772 for (i = 0; i < h; i++) {
773 for (x = 0; x <= w_lim;
774 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
775 if (x == w_lim) {
776 if ((s = w - w_lim) == 0)
777 break;
778 } else if (!x) {
779 s = (16 - (dst_x % 16));
780 s = MIN(s, w_lim);
781 } else {
782 s = 16;
783 }
784 cmp_bytes = s * depth;
785 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
786 continue;
787 memmove(dst_row, src_row, cmp_bytes);
788 QTAILQ_FOREACH(vs, &vd->clients, next) {
789 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
790 set_bit(((x + dst_x) / 16), vs->dirty[y]);
791 }
792 }
793 }
794 src_row += pitch - w * depth;
795 dst_row += pitch - w * depth;
796 y += inc;
797 }
798
799 QTAILQ_FOREACH(vs, &vd->clients, next) {
800 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
801 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
802 }
803 }
804 }
805
806 static void vnc_mouse_set(int x, int y, int visible)
807 {
808 /* can we ask the client(s) to move the pointer ??? */
809 }
810
811 static int vnc_cursor_define(VncState *vs)
812 {
813 QEMUCursor *c = vs->vd->cursor;
814 PixelFormat pf = qemu_default_pixelformat(32);
815 int isize;
816
817 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
818 vnc_lock_output(vs);
819 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
820 vnc_write_u8(vs, 0); /* padding */
821 vnc_write_u16(vs, 1); /* # of rects */
822 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
823 VNC_ENCODING_RICH_CURSOR);
824 isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
825 vnc_write_pixels_generic(vs, &pf, c->data, isize);
826 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
827 vnc_unlock_output(vs);
828 return 0;
829 }
830 return -1;
831 }
832
833 static void vnc_dpy_cursor_define(QEMUCursor *c)
834 {
835 VncDisplay *vd = vnc_display;
836 VncState *vs;
837
838 cursor_put(vd->cursor);
839 g_free(vd->cursor_mask);
840
841 vd->cursor = c;
842 cursor_get(vd->cursor);
843 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
844 vd->cursor_mask = g_malloc0(vd->cursor_msize);
845 cursor_get_mono_mask(c, 0, vd->cursor_mask);
846
847 QTAILQ_FOREACH(vs, &vd->clients, next) {
848 vnc_cursor_define(vs);
849 }
850 }
851
852 static int find_and_clear_dirty_height(struct VncState *vs,
853 int y, int last_x, int x, int height)
854 {
855 int h;
856
857 for (h = 1; h < (height - y); h++) {
858 int tmp_x;
859 if (!test_bit(last_x, vs->dirty[y + h])) {
860 break;
861 }
862 for (tmp_x = last_x; tmp_x < x; tmp_x++) {
863 clear_bit(tmp_x, vs->dirty[y + h]);
864 }
865 }
866
867 return h;
868 }
869
870 #ifdef CONFIG_VNC_THREAD
871 static int vnc_update_client_sync(VncState *vs, int has_dirty)
872 {
873 int ret = vnc_update_client(vs, has_dirty);
874 vnc_jobs_join(vs);
875 return ret;
876 }
877 #else
878 static int vnc_update_client_sync(VncState *vs, int has_dirty)
879 {
880 return vnc_update_client(vs, has_dirty);
881 }
882 #endif
883
884 static int vnc_update_client(VncState *vs, int has_dirty)
885 {
886 if (vs->need_update && vs->csock != -1) {
887 VncDisplay *vd = vs->vd;
888 VncJob *job;
889 int y;
890 int width, height;
891 int n = 0;
892
893
894 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
895 /* kernel send buffers are full -> drop frames to throttle */
896 return 0;
897
898 if (!has_dirty && !vs->audio_cap && !vs->force_update)
899 return 0;
900
901 /*
902 * Send screen updates to the vnc client using the server
903 * surface and server dirty map. guest surface updates
904 * happening in parallel don't disturb us, the next pass will
905 * send them to the client.
906 */
907 job = vnc_job_new(vs);
908
909 width = MIN(vd->server->width, vs->client_width);
910 height = MIN(vd->server->height, vs->client_height);
911
912 for (y = 0; y < height; y++) {
913 int x;
914 int last_x = -1;
915 for (x = 0; x < width / 16; x++) {
916 if (test_and_clear_bit(x, vs->dirty[y])) {
917 if (last_x == -1) {
918 last_x = x;
919 }
920 } else {
921 if (last_x != -1) {
922 int h = find_and_clear_dirty_height(vs, y, last_x, x,
923 height);
924
925 n += vnc_job_add_rect(job, last_x * 16, y,
926 (x - last_x) * 16, h);
927 }
928 last_x = -1;
929 }
930 }
931 if (last_x != -1) {
932 int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
933 n += vnc_job_add_rect(job, last_x * 16, y,
934 (x - last_x) * 16, h);
935 }
936 }
937
938 vnc_job_push(job);
939 vs->force_update = 0;
940 return n;
941 }
942
943 if (vs->csock == -1)
944 vnc_disconnect_finish(vs);
945
946 return 0;
947 }
948
949 /* audio */
950 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
951 {
952 VncState *vs = opaque;
953
954 switch (cmd) {
955 case AUD_CNOTIFY_DISABLE:
956 vnc_lock_output(vs);
957 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
958 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
959 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
960 vnc_unlock_output(vs);
961 vnc_flush(vs);
962 break;
963
964 case AUD_CNOTIFY_ENABLE:
965 vnc_lock_output(vs);
966 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
967 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
968 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
969 vnc_unlock_output(vs);
970 vnc_flush(vs);
971 break;
972 }
973 }
974
975 static void audio_capture_destroy(void *opaque)
976 {
977 }
978
979 static void audio_capture(void *opaque, void *buf, int size)
980 {
981 VncState *vs = opaque;
982
983 vnc_lock_output(vs);
984 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
985 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
986 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
987 vnc_write_u32(vs, size);
988 vnc_write(vs, buf, size);
989 vnc_unlock_output(vs);
990 vnc_flush(vs);
991 }
992
993 static void audio_add(VncState *vs)
994 {
995 struct audio_capture_ops ops;
996
997 if (vs->audio_cap) {
998 monitor_printf(default_mon, "audio already running\n");
999 return;
1000 }
1001
1002 ops.notify = audio_capture_notify;
1003 ops.destroy = audio_capture_destroy;
1004 ops.capture = audio_capture;
1005
1006 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1007 if (!vs->audio_cap) {
1008 monitor_printf(default_mon, "Failed to add audio capture\n");
1009 }
1010 }
1011
1012 static void audio_del(VncState *vs)
1013 {
1014 if (vs->audio_cap) {
1015 AUD_del_capture(vs->audio_cap, vs);
1016 vs->audio_cap = NULL;
1017 }
1018 }
1019
1020 static void vnc_disconnect_start(VncState *vs)
1021 {
1022 if (vs->csock == -1)
1023 return;
1024 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1025 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1026 closesocket(vs->csock);
1027 vs->csock = -1;
1028 }
1029
1030 static void vnc_disconnect_finish(VncState *vs)
1031 {
1032 int i;
1033
1034 vnc_jobs_join(vs); /* Wait encoding jobs */
1035
1036 vnc_lock_output(vs);
1037 vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1038
1039 buffer_free(&vs->input);
1040 buffer_free(&vs->output);
1041
1042 qobject_decref(vs->info);
1043
1044 vnc_zlib_clear(vs);
1045 vnc_tight_clear(vs);
1046 vnc_zrle_clear(vs);
1047
1048 #ifdef CONFIG_VNC_TLS
1049 vnc_tls_client_cleanup(vs);
1050 #endif /* CONFIG_VNC_TLS */
1051 #ifdef CONFIG_VNC_SASL
1052 vnc_sasl_client_cleanup(vs);
1053 #endif /* CONFIG_VNC_SASL */
1054 audio_del(vs);
1055 vnc_release_modifiers(vs);
1056
1057 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1058
1059 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1060 dcl->idle = 1;
1061 }
1062
1063 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1064 vnc_remove_timer(vs->vd);
1065 if (vs->vd->lock_key_sync)
1066 qemu_remove_led_event_handler(vs->led);
1067 vnc_unlock_output(vs);
1068
1069 #ifdef CONFIG_VNC_THREAD
1070 qemu_mutex_destroy(&vs->output_mutex);
1071 #endif
1072 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1073 g_free(vs->lossy_rect[i]);
1074 }
1075 g_free(vs->lossy_rect);
1076 g_free(vs);
1077 }
1078
1079 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1080 {
1081 if (ret == 0 || ret == -1) {
1082 if (ret == -1) {
1083 switch (last_errno) {
1084 case EINTR:
1085 case EAGAIN:
1086 #ifdef _WIN32
1087 case WSAEWOULDBLOCK:
1088 #endif
1089 return 0;
1090 default:
1091 break;
1092 }
1093 }
1094
1095 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1096 ret, ret < 0 ? last_errno : 0);
1097 vnc_disconnect_start(vs);
1098
1099 return 0;
1100 }
1101 return ret;
1102 }
1103
1104
1105 void vnc_client_error(VncState *vs)
1106 {
1107 VNC_DEBUG("Closing down client sock: protocol error\n");
1108 vnc_disconnect_start(vs);
1109 }
1110
1111
1112 /*
1113 * Called to write a chunk of data to the client socket. The data may
1114 * be the raw data, or may have already been encoded by SASL.
1115 * The data will be written either straight onto the socket, or
1116 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1117 *
1118 * NB, it is theoretically possible to have 2 layers of encryption,
1119 * both SASL, and this TLS layer. It is highly unlikely in practice
1120 * though, since SASL encryption will typically be a no-op if TLS
1121 * is active
1122 *
1123 * Returns the number of bytes written, which may be less than
1124 * the requested 'datalen' if the socket would block. Returns
1125 * -1 on error, and disconnects the client socket.
1126 */
1127 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1128 {
1129 long ret;
1130 #ifdef CONFIG_VNC_TLS
1131 if (vs->tls.session) {
1132 ret = gnutls_write(vs->tls.session, data, datalen);
1133 if (ret < 0) {
1134 if (ret == GNUTLS_E_AGAIN)
1135 errno = EAGAIN;
1136 else
1137 errno = EIO;
1138 ret = -1;
1139 }
1140 } else
1141 #endif /* CONFIG_VNC_TLS */
1142 ret = send(vs->csock, (const void *)data, datalen, 0);
1143 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1144 return vnc_client_io_error(vs, ret, socket_error());
1145 }
1146
1147
1148 /*
1149 * Called to write buffered data to the client socket, when not
1150 * using any SASL SSF encryption layers. Will write as much data
1151 * as possible without blocking. If all buffered data is written,
1152 * will switch the FD poll() handler back to read monitoring.
1153 *
1154 * Returns the number of bytes written, which may be less than
1155 * the buffered output data if the socket would block. Returns
1156 * -1 on error, and disconnects the client socket.
1157 */
1158 static long vnc_client_write_plain(VncState *vs)
1159 {
1160 long ret;
1161
1162 #ifdef CONFIG_VNC_SASL
1163 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1164 vs->output.buffer, vs->output.capacity, vs->output.offset,
1165 vs->sasl.waitWriteSSF);
1166
1167 if (vs->sasl.conn &&
1168 vs->sasl.runSSF &&
1169 vs->sasl.waitWriteSSF) {
1170 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1171 if (ret)
1172 vs->sasl.waitWriteSSF -= ret;
1173 } else
1174 #endif /* CONFIG_VNC_SASL */
1175 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1176 if (!ret)
1177 return 0;
1178
1179 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1180 vs->output.offset -= ret;
1181
1182 if (vs->output.offset == 0) {
1183 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1184 }
1185
1186 return ret;
1187 }
1188
1189
1190 /*
1191 * First function called whenever there is data to be written to
1192 * the client socket. Will delegate actual work according to whether
1193 * SASL SSF layers are enabled (thus requiring encryption calls)
1194 */
1195 static void vnc_client_write_locked(void *opaque)
1196 {
1197 VncState *vs = opaque;
1198
1199 #ifdef CONFIG_VNC_SASL
1200 if (vs->sasl.conn &&
1201 vs->sasl.runSSF &&
1202 !vs->sasl.waitWriteSSF) {
1203 vnc_client_write_sasl(vs);
1204 } else
1205 #endif /* CONFIG_VNC_SASL */
1206 vnc_client_write_plain(vs);
1207 }
1208
1209 void vnc_client_write(void *opaque)
1210 {
1211 VncState *vs = opaque;
1212
1213 vnc_lock_output(vs);
1214 if (vs->output.offset) {
1215 vnc_client_write_locked(opaque);
1216 } else if (vs->csock != -1) {
1217 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1218 }
1219 vnc_unlock_output(vs);
1220 }
1221
1222 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1223 {
1224 vs->read_handler = func;
1225 vs->read_handler_expect = expecting;
1226 }
1227
1228
1229 /*
1230 * Called to read a chunk of data from the client socket. The data may
1231 * be the raw data, or may need to be further decoded by SASL.
1232 * The data will be read either straight from to the socket, or
1233 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1234 *
1235 * NB, it is theoretically possible to have 2 layers of encryption,
1236 * both SASL, and this TLS layer. It is highly unlikely in practice
1237 * though, since SASL encryption will typically be a no-op if TLS
1238 * is active
1239 *
1240 * Returns the number of bytes read, which may be less than
1241 * the requested 'datalen' if the socket would block. Returns
1242 * -1 on error, and disconnects the client socket.
1243 */
1244 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1245 {
1246 long ret;
1247 #ifdef CONFIG_VNC_TLS
1248 if (vs->tls.session) {
1249 ret = gnutls_read(vs->tls.session, data, datalen);
1250 if (ret < 0) {
1251 if (ret == GNUTLS_E_AGAIN)
1252 errno = EAGAIN;
1253 else
1254 errno = EIO;
1255 ret = -1;
1256 }
1257 } else
1258 #endif /* CONFIG_VNC_TLS */
1259 ret = qemu_recv(vs->csock, data, datalen, 0);
1260 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1261 return vnc_client_io_error(vs, ret, socket_error());
1262 }
1263
1264
1265 /*
1266 * Called to read data from the client socket to the input buffer,
1267 * when not using any SASL SSF encryption layers. Will read as much
1268 * data as possible without blocking.
1269 *
1270 * Returns the number of bytes read. Returns -1 on error, and
1271 * disconnects the client socket.
1272 */
1273 static long vnc_client_read_plain(VncState *vs)
1274 {
1275 int ret;
1276 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1277 vs->input.buffer, vs->input.capacity, vs->input.offset);
1278 buffer_reserve(&vs->input, 4096);
1279 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1280 if (!ret)
1281 return 0;
1282 vs->input.offset += ret;
1283 return ret;
1284 }
1285
1286
1287 /*
1288 * First function called whenever there is more data to be read from
1289 * the client socket. Will delegate actual work according to whether
1290 * SASL SSF layers are enabled (thus requiring decryption calls)
1291 */
1292 void vnc_client_read(void *opaque)
1293 {
1294 VncState *vs = opaque;
1295 long ret;
1296
1297 #ifdef CONFIG_VNC_SASL
1298 if (vs->sasl.conn && vs->sasl.runSSF)
1299 ret = vnc_client_read_sasl(vs);
1300 else
1301 #endif /* CONFIG_VNC_SASL */
1302 ret = vnc_client_read_plain(vs);
1303 if (!ret) {
1304 if (vs->csock == -1)
1305 vnc_disconnect_finish(vs);
1306 return;
1307 }
1308
1309 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1310 size_t len = vs->read_handler_expect;
1311 int ret;
1312
1313 ret = vs->read_handler(vs, vs->input.buffer, len);
1314 if (vs->csock == -1) {
1315 vnc_disconnect_finish(vs);
1316 return;
1317 }
1318
1319 if (!ret) {
1320 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1321 vs->input.offset -= len;
1322 } else {
1323 vs->read_handler_expect = ret;
1324 }
1325 }
1326 }
1327
1328 void vnc_write(VncState *vs, const void *data, size_t len)
1329 {
1330 buffer_reserve(&vs->output, len);
1331
1332 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1333 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1334 }
1335
1336 buffer_append(&vs->output, data, len);
1337 }
1338
1339 void vnc_write_s32(VncState *vs, int32_t value)
1340 {
1341 vnc_write_u32(vs, *(uint32_t *)&value);
1342 }
1343
1344 void vnc_write_u32(VncState *vs, uint32_t value)
1345 {
1346 uint8_t buf[4];
1347
1348 buf[0] = (value >> 24) & 0xFF;
1349 buf[1] = (value >> 16) & 0xFF;
1350 buf[2] = (value >> 8) & 0xFF;
1351 buf[3] = value & 0xFF;
1352
1353 vnc_write(vs, buf, 4);
1354 }
1355
1356 void vnc_write_u16(VncState *vs, uint16_t value)
1357 {
1358 uint8_t buf[2];
1359
1360 buf[0] = (value >> 8) & 0xFF;
1361 buf[1] = value & 0xFF;
1362
1363 vnc_write(vs, buf, 2);
1364 }
1365
1366 void vnc_write_u8(VncState *vs, uint8_t value)
1367 {
1368 vnc_write(vs, (char *)&value, 1);
1369 }
1370
1371 void vnc_flush(VncState *vs)
1372 {
1373 vnc_lock_output(vs);
1374 if (vs->csock != -1 && vs->output.offset) {
1375 vnc_client_write_locked(vs);
1376 }
1377 vnc_unlock_output(vs);
1378 }
1379
1380 uint8_t read_u8(uint8_t *data, size_t offset)
1381 {
1382 return data[offset];
1383 }
1384
1385 uint16_t read_u16(uint8_t *data, size_t offset)
1386 {
1387 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1388 }
1389
1390 int32_t read_s32(uint8_t *data, size_t offset)
1391 {
1392 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1393 (data[offset + 2] << 8) | data[offset + 3]);
1394 }
1395
1396 uint32_t read_u32(uint8_t *data, size_t offset)
1397 {
1398 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1399 (data[offset + 2] << 8) | data[offset + 3]);
1400 }
1401
1402 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1403 {
1404 }
1405
1406 static void check_pointer_type_change(Notifier *notifier, void *data)
1407 {
1408 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1409 int absolute = kbd_mouse_is_absolute();
1410
1411 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1412 vnc_lock_output(vs);
1413 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1414 vnc_write_u8(vs, 0);
1415 vnc_write_u16(vs, 1);
1416 vnc_framebuffer_update(vs, absolute, 0,
1417 ds_get_width(vs->ds), ds_get_height(vs->ds),
1418 VNC_ENCODING_POINTER_TYPE_CHANGE);
1419 vnc_unlock_output(vs);
1420 vnc_flush(vs);
1421 }
1422 vs->absolute = absolute;
1423 }
1424
1425 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1426 {
1427 int buttons = 0;
1428 int dz = 0;
1429
1430 if (button_mask & 0x01)
1431 buttons |= MOUSE_EVENT_LBUTTON;
1432 if (button_mask & 0x02)
1433 buttons |= MOUSE_EVENT_MBUTTON;
1434 if (button_mask & 0x04)
1435 buttons |= MOUSE_EVENT_RBUTTON;
1436 if (button_mask & 0x08)
1437 dz = -1;
1438 if (button_mask & 0x10)
1439 dz = 1;
1440
1441 if (vs->absolute) {
1442 kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
1443 x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
1444 ds_get_height(vs->ds) > 1 ?
1445 y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1446 dz, buttons);
1447 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1448 x -= 0x7FFF;
1449 y -= 0x7FFF;
1450
1451 kbd_mouse_event(x, y, dz, buttons);
1452 } else {
1453 if (vs->last_x != -1)
1454 kbd_mouse_event(x - vs->last_x,
1455 y - vs->last_y,
1456 dz, buttons);
1457 vs->last_x = x;
1458 vs->last_y = y;
1459 }
1460 }
1461
1462 static void reset_keys(VncState *vs)
1463 {
1464 int i;
1465 for(i = 0; i < 256; i++) {
1466 if (vs->modifiers_state[i]) {
1467 if (i & SCANCODE_GREY)
1468 kbd_put_keycode(SCANCODE_EMUL0);
1469 kbd_put_keycode(i | SCANCODE_UP);
1470 vs->modifiers_state[i] = 0;
1471 }
1472 }
1473 }
1474
1475 static void press_key(VncState *vs, int keysym)
1476 {
1477 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1478 if (keycode & SCANCODE_GREY)
1479 kbd_put_keycode(SCANCODE_EMUL0);
1480 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1481 if (keycode & SCANCODE_GREY)
1482 kbd_put_keycode(SCANCODE_EMUL0);
1483 kbd_put_keycode(keycode | SCANCODE_UP);
1484 }
1485
1486 static void kbd_leds(void *opaque, int ledstate)
1487 {
1488 VncState *vs = opaque;
1489 int caps, num;
1490
1491 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1492 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
1493
1494 if (vs->modifiers_state[0x3a] != caps) {
1495 vs->modifiers_state[0x3a] = caps;
1496 }
1497 if (vs->modifiers_state[0x45] != num) {
1498 vs->modifiers_state[0x45] = num;
1499 }
1500 }
1501
1502 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1503 {
1504 /* QEMU console switch */
1505 switch(keycode) {
1506 case 0x2a: /* Left Shift */
1507 case 0x36: /* Right Shift */
1508 case 0x1d: /* Left CTRL */
1509 case 0x9d: /* Right CTRL */
1510 case 0x38: /* Left ALT */
1511 case 0xb8: /* Right ALT */
1512 if (down)
1513 vs->modifiers_state[keycode] = 1;
1514 else
1515 vs->modifiers_state[keycode] = 0;
1516 break;
1517 case 0x02 ... 0x0a: /* '1' to '9' keys */
1518 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1519 /* Reset the modifiers sent to the current console */
1520 reset_keys(vs);
1521 console_select(keycode - 0x02);
1522 return;
1523 }
1524 break;
1525 case 0x3a: /* CapsLock */
1526 case 0x45: /* NumLock */
1527 if (down)
1528 vs->modifiers_state[keycode] ^= 1;
1529 break;
1530 }
1531
1532 if (down && vs->vd->lock_key_sync &&
1533 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1534 /* If the numlock state needs to change then simulate an additional
1535 keypress before sending this one. This will happen if the user
1536 toggles numlock away from the VNC window.
1537 */
1538 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1539 if (!vs->modifiers_state[0x45]) {
1540 vs->modifiers_state[0x45] = 1;
1541 press_key(vs, 0xff7f);
1542 }
1543 } else {
1544 if (vs->modifiers_state[0x45]) {
1545 vs->modifiers_state[0x45] = 0;
1546 press_key(vs, 0xff7f);
1547 }
1548 }
1549 }
1550
1551 if (down && vs->vd->lock_key_sync &&
1552 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1553 /* If the capslock state needs to change then simulate an additional
1554 keypress before sending this one. This will happen if the user
1555 toggles capslock away from the VNC window.
1556 */
1557 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1558 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1559 int capslock = !!(vs->modifiers_state[0x3a]);
1560 if (capslock) {
1561 if (uppercase == shift) {
1562 vs->modifiers_state[0x3a] = 0;
1563 press_key(vs, 0xffe5);
1564 }
1565 } else {
1566 if (uppercase != shift) {
1567 vs->modifiers_state[0x3a] = 1;
1568 press_key(vs, 0xffe5);
1569 }
1570 }
1571 }
1572
1573 if (is_graphic_console()) {
1574 if (keycode & SCANCODE_GREY)
1575 kbd_put_keycode(SCANCODE_EMUL0);
1576 if (down)
1577 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1578 else
1579 kbd_put_keycode(keycode | SCANCODE_UP);
1580 } else {
1581 bool numlock = vs->modifiers_state[0x45];
1582 bool control = (vs->modifiers_state[0x1d] ||
1583 vs->modifiers_state[0x9d]);
1584 /* QEMU console emulation */
1585 if (down) {
1586 switch (keycode) {
1587 case 0x2a: /* Left Shift */
1588 case 0x36: /* Right Shift */
1589 case 0x1d: /* Left CTRL */
1590 case 0x9d: /* Right CTRL */
1591 case 0x38: /* Left ALT */
1592 case 0xb8: /* Right ALT */
1593 break;
1594 case 0xc8:
1595 kbd_put_keysym(QEMU_KEY_UP);
1596 break;
1597 case 0xd0:
1598 kbd_put_keysym(QEMU_KEY_DOWN);
1599 break;
1600 case 0xcb:
1601 kbd_put_keysym(QEMU_KEY_LEFT);
1602 break;
1603 case 0xcd:
1604 kbd_put_keysym(QEMU_KEY_RIGHT);
1605 break;
1606 case 0xd3:
1607 kbd_put_keysym(QEMU_KEY_DELETE);
1608 break;
1609 case 0xc7:
1610 kbd_put_keysym(QEMU_KEY_HOME);
1611 break;
1612 case 0xcf:
1613 kbd_put_keysym(QEMU_KEY_END);
1614 break;
1615 case 0xc9:
1616 kbd_put_keysym(QEMU_KEY_PAGEUP);
1617 break;
1618 case 0xd1:
1619 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1620 break;
1621
1622 case 0x47:
1623 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1624 break;
1625 case 0x48:
1626 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1627 break;
1628 case 0x49:
1629 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1630 break;
1631 case 0x4b:
1632 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1633 break;
1634 case 0x4c:
1635 kbd_put_keysym('5');
1636 break;
1637 case 0x4d:
1638 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1639 break;
1640 case 0x4f:
1641 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1642 break;
1643 case 0x50:
1644 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1645 break;
1646 case 0x51:
1647 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1648 break;
1649 case 0x52:
1650 kbd_put_keysym('0');
1651 break;
1652 case 0x53:
1653 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1654 break;
1655
1656 case 0xb5:
1657 kbd_put_keysym('/');
1658 break;
1659 case 0x37:
1660 kbd_put_keysym('*');
1661 break;
1662 case 0x4a:
1663 kbd_put_keysym('-');
1664 break;
1665 case 0x4e:
1666 kbd_put_keysym('+');
1667 break;
1668 case 0x9c:
1669 kbd_put_keysym('\n');
1670 break;
1671
1672 default:
1673 if (control) {
1674 kbd_put_keysym(sym & 0x1f);
1675 } else {
1676 kbd_put_keysym(sym);
1677 }
1678 break;
1679 }
1680 }
1681 }
1682 }
1683
1684 static void vnc_release_modifiers(VncState *vs)
1685 {
1686 static const int keycodes[] = {
1687 /* shift, control, alt keys, both left & right */
1688 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1689 };
1690 int i, keycode;
1691
1692 if (!is_graphic_console()) {
1693 return;
1694 }
1695 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1696 keycode = keycodes[i];
1697 if (!vs->modifiers_state[keycode]) {
1698 continue;
1699 }
1700 if (keycode & SCANCODE_GREY) {
1701 kbd_put_keycode(SCANCODE_EMUL0);
1702 }
1703 kbd_put_keycode(keycode | SCANCODE_UP);
1704 }
1705 }
1706
1707 static void key_event(VncState *vs, int down, uint32_t sym)
1708 {
1709 int keycode;
1710 int lsym = sym;
1711
1712 if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
1713 lsym = lsym - 'A' + 'a';
1714 }
1715
1716 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1717 do_key_event(vs, down, keycode, sym);
1718 }
1719
1720 static void ext_key_event(VncState *vs, int down,
1721 uint32_t sym, uint16_t keycode)
1722 {
1723 /* if the user specifies a keyboard layout, always use it */
1724 if (keyboard_layout)
1725 key_event(vs, down, sym);
1726 else
1727 do_key_event(vs, down, keycode, sym);
1728 }
1729
1730 static void framebuffer_update_request(VncState *vs, int incremental,
1731 int x_position, int y_position,
1732 int w, int h)
1733 {
1734 int i;
1735 const size_t width = ds_get_width(vs->ds) / 16;
1736
1737 if (y_position > ds_get_height(vs->ds))
1738 y_position = ds_get_height(vs->ds);
1739 if (y_position + h >= ds_get_height(vs->ds))
1740 h = ds_get_height(vs->ds) - y_position;
1741
1742 vs->need_update = 1;
1743 if (!incremental) {
1744 vs->force_update = 1;
1745 for (i = 0; i < h; i++) {
1746 bitmap_set(vs->dirty[y_position + i], 0, width);
1747 bitmap_clear(vs->dirty[y_position + i], width,
1748 VNC_DIRTY_BITS - width);
1749 }
1750 }
1751 }
1752
1753 static void send_ext_key_event_ack(VncState *vs)
1754 {
1755 vnc_lock_output(vs);
1756 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1757 vnc_write_u8(vs, 0);
1758 vnc_write_u16(vs, 1);
1759 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1760 VNC_ENCODING_EXT_KEY_EVENT);
1761 vnc_unlock_output(vs);
1762 vnc_flush(vs);
1763 }
1764
1765 static void send_ext_audio_ack(VncState *vs)
1766 {
1767 vnc_lock_output(vs);
1768 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1769 vnc_write_u8(vs, 0);
1770 vnc_write_u16(vs, 1);
1771 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1772 VNC_ENCODING_AUDIO);
1773 vnc_unlock_output(vs);
1774 vnc_flush(vs);
1775 }
1776
1777 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1778 {
1779 int i;
1780 unsigned int enc = 0;
1781
1782 vs->features = 0;
1783 vs->vnc_encoding = 0;
1784 vs->tight.compression = 9;
1785 vs->tight.quality = -1; /* Lossless by default */
1786 vs->absolute = -1;
1787
1788 /*
1789 * Start from the end because the encodings are sent in order of preference.
1790 * This way the preferred encoding (first encoding defined in the array)
1791 * will be set at the end of the loop.
1792 */
1793 for (i = n_encodings - 1; i >= 0; i--) {
1794 enc = encodings[i];
1795 switch (enc) {
1796 case VNC_ENCODING_RAW:
1797 vs->vnc_encoding = enc;
1798 break;
1799 case VNC_ENCODING_COPYRECT:
1800 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1801 break;
1802 case VNC_ENCODING_HEXTILE:
1803 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1804 vs->vnc_encoding = enc;
1805 break;
1806 case VNC_ENCODING_TIGHT:
1807 vs->features |= VNC_FEATURE_TIGHT_MASK;
1808 vs->vnc_encoding = enc;
1809 break;
1810 case VNC_ENCODING_TIGHT_PNG:
1811 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1812 vs->vnc_encoding = enc;
1813 break;
1814 case VNC_ENCODING_ZLIB:
1815 vs->features |= VNC_FEATURE_ZLIB_MASK;
1816 vs->vnc_encoding = enc;
1817 break;
1818 case VNC_ENCODING_ZRLE:
1819 vs->features |= VNC_FEATURE_ZRLE_MASK;
1820 vs->vnc_encoding = enc;
1821 break;
1822 case VNC_ENCODING_ZYWRLE:
1823 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1824 vs->vnc_encoding = enc;
1825 break;
1826 case VNC_ENCODING_DESKTOPRESIZE:
1827 vs->features |= VNC_FEATURE_RESIZE_MASK;
1828 break;
1829 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1830 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1831 break;
1832 case VNC_ENCODING_RICH_CURSOR:
1833 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1834 break;
1835 case VNC_ENCODING_EXT_KEY_EVENT:
1836 send_ext_key_event_ack(vs);
1837 break;
1838 case VNC_ENCODING_AUDIO:
1839 send_ext_audio_ack(vs);
1840 break;
1841 case VNC_ENCODING_WMVi:
1842 vs->features |= VNC_FEATURE_WMVI_MASK;
1843 break;
1844 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1845 vs->tight.compression = (enc & 0x0F);
1846 break;
1847 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1848 if (vs->vd->lossy) {
1849 vs->tight.quality = (enc & 0x0F);
1850 }
1851 break;
1852 default:
1853 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1854 break;
1855 }
1856 }
1857 vnc_desktop_resize(vs);
1858 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1859 }
1860
1861 static void set_pixel_conversion(VncState *vs)
1862 {
1863 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1864 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1865 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1866 vs->write_pixels = vnc_write_pixels_copy;
1867 vnc_hextile_set_pixel_conversion(vs, 0);
1868 } else {
1869 vs->write_pixels = vnc_write_pixels_generic;
1870 vnc_hextile_set_pixel_conversion(vs, 1);
1871 }
1872 }
1873
1874 static void set_pixel_format(VncState *vs,
1875 int bits_per_pixel, int depth,
1876 int big_endian_flag, int true_color_flag,
1877 int red_max, int green_max, int blue_max,
1878 int red_shift, int green_shift, int blue_shift)
1879 {
1880 if (!true_color_flag) {
1881 vnc_client_error(vs);
1882 return;
1883 }
1884
1885 vs->clientds = *(vs->vd->guest.ds);
1886 vs->clientds.pf.rmax = red_max;
1887 vs->clientds.pf.rbits = hweight_long(red_max);
1888 vs->clientds.pf.rshift = red_shift;
1889 vs->clientds.pf.rmask = red_max << red_shift;
1890 vs->clientds.pf.gmax = green_max;
1891 vs->clientds.pf.gbits = hweight_long(green_max);
1892 vs->clientds.pf.gshift = green_shift;
1893 vs->clientds.pf.gmask = green_max << green_shift;
1894 vs->clientds.pf.bmax = blue_max;
1895 vs->clientds.pf.bbits = hweight_long(blue_max);
1896 vs->clientds.pf.bshift = blue_shift;
1897 vs->clientds.pf.bmask = blue_max << blue_shift;
1898 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1899 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1900 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1901 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1902
1903 set_pixel_conversion(vs);
1904
1905 vga_hw_invalidate();
1906 vga_hw_update();
1907 }
1908
1909 static void pixel_format_message (VncState *vs) {
1910 char pad[3] = { 0, 0, 0 };
1911
1912 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1913 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1914
1915 #ifdef HOST_WORDS_BIGENDIAN
1916 vnc_write_u8(vs, 1); /* big-endian-flag */
1917 #else
1918 vnc_write_u8(vs, 0); /* big-endian-flag */
1919 #endif
1920 vnc_write_u8(vs, 1); /* true-color-flag */
1921 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1922 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1923 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1924 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1925 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1926 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1927
1928 vnc_hextile_set_pixel_conversion(vs, 0);
1929
1930 vs->clientds = *(vs->ds->surface);
1931 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1932 vs->write_pixels = vnc_write_pixels_copy;
1933
1934 vnc_write(vs, pad, 3); /* padding */
1935 }
1936
1937 static void vnc_dpy_setdata(DisplayState *ds)
1938 {
1939 VncDisplay *vd = ds->opaque;
1940
1941 *(vd->guest.ds) = *(ds->surface);
1942 vnc_dpy_update(ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
1943 }
1944
1945 static void vnc_colordepth(VncState *vs)
1946 {
1947 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1948 /* Sending a WMVi message to notify the client*/
1949 vnc_lock_output(vs);
1950 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1951 vnc_write_u8(vs, 0);
1952 vnc_write_u16(vs, 1); /* number of rects */
1953 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1954 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1955 pixel_format_message(vs);
1956 vnc_unlock_output(vs);
1957 vnc_flush(vs);
1958 } else {
1959 set_pixel_conversion(vs);
1960 }
1961 }
1962
1963 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1964 {
1965 int i;
1966 uint16_t limit;
1967 VncDisplay *vd = vs->vd;
1968
1969 if (data[0] > 3) {
1970 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1971 if (!qemu_timer_expired(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval))
1972 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
1973 }
1974
1975 switch (data[0]) {
1976 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
1977 if (len == 1)
1978 return 20;
1979
1980 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1981 read_u8(data, 6), read_u8(data, 7),
1982 read_u16(data, 8), read_u16(data, 10),
1983 read_u16(data, 12), read_u8(data, 14),
1984 read_u8(data, 15), read_u8(data, 16));
1985 break;
1986 case VNC_MSG_CLIENT_SET_ENCODINGS:
1987 if (len == 1)
1988 return 4;
1989
1990 if (len == 4) {
1991 limit = read_u16(data, 2);
1992 if (limit > 0)
1993 return 4 + (limit * 4);
1994 } else
1995 limit = read_u16(data, 2);
1996
1997 for (i = 0; i < limit; i++) {
1998 int32_t val = read_s32(data, 4 + (i * 4));
1999 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2000 }
2001
2002 set_encodings(vs, (int32_t *)(data + 4), limit);
2003 break;
2004 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2005 if (len == 1)
2006 return 10;
2007
2008 framebuffer_update_request(vs,
2009 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2010 read_u16(data, 6), read_u16(data, 8));
2011 break;
2012 case VNC_MSG_CLIENT_KEY_EVENT:
2013 if (len == 1)
2014 return 8;
2015
2016 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2017 break;
2018 case VNC_MSG_CLIENT_POINTER_EVENT:
2019 if (len == 1)
2020 return 6;
2021
2022 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2023 break;
2024 case VNC_MSG_CLIENT_CUT_TEXT:
2025 if (len == 1)
2026 return 8;
2027
2028 if (len == 8) {
2029 uint32_t dlen = read_u32(data, 4);
2030 if (dlen > 0)
2031 return 8 + dlen;
2032 }
2033
2034 client_cut_text(vs, read_u32(data, 4), data + 8);
2035 break;
2036 case VNC_MSG_CLIENT_QEMU:
2037 if (len == 1)
2038 return 2;
2039
2040 switch (read_u8(data, 1)) {
2041 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2042 if (len == 2)
2043 return 12;
2044
2045 ext_key_event(vs, read_u16(data, 2),
2046 read_u32(data, 4), read_u32(data, 8));
2047 break;
2048 case VNC_MSG_CLIENT_QEMU_AUDIO:
2049 if (len == 2)
2050 return 4;
2051
2052 switch (read_u16 (data, 2)) {
2053 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2054 audio_add(vs);
2055 break;
2056 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2057 audio_del(vs);
2058 break;
2059 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2060 if (len == 4)
2061 return 10;
2062 switch (read_u8(data, 4)) {
2063 case 0: vs->as.fmt = AUD_FMT_U8; break;
2064 case 1: vs->as.fmt = AUD_FMT_S8; break;
2065 case 2: vs->as.fmt = AUD_FMT_U16; break;
2066 case 3: vs->as.fmt = AUD_FMT_S16; break;
2067 case 4: vs->as.fmt = AUD_FMT_U32; break;
2068 case 5: vs->as.fmt = AUD_FMT_S32; break;
2069 default:
2070 printf("Invalid audio format %d\n", read_u8(data, 4));
2071 vnc_client_error(vs);
2072 break;
2073 }
2074 vs->as.nchannels = read_u8(data, 5);
2075 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2076 printf("Invalid audio channel coount %d\n",
2077 read_u8(data, 5));
2078 vnc_client_error(vs);
2079 break;
2080 }
2081 vs->as.freq = read_u32(data, 6);
2082 break;
2083 default:
2084 printf ("Invalid audio message %d\n", read_u8(data, 4));
2085 vnc_client_error(vs);
2086 break;
2087 }
2088 break;
2089
2090 default:
2091 printf("Msg: %d\n", read_u16(data, 0));
2092 vnc_client_error(vs);
2093 break;
2094 }
2095 break;
2096 default:
2097 printf("Msg: %d\n", data[0]);
2098 vnc_client_error(vs);
2099 break;
2100 }
2101
2102 vnc_read_when(vs, protocol_client_msg, 1);
2103 return 0;
2104 }
2105
2106 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2107 {
2108 char buf[1024];
2109 VncShareMode mode;
2110 int size;
2111
2112 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2113 switch (vs->vd->share_policy) {
2114 case VNC_SHARE_POLICY_IGNORE:
2115 /*
2116 * Ignore the shared flag. Nothing to do here.
2117 *
2118 * Doesn't conform to the rfb spec but is traditional qemu
2119 * behavior, thus left here as option for compatibility
2120 * reasons.
2121 */
2122 break;
2123 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2124 /*
2125 * Policy: Allow clients ask for exclusive access.
2126 *
2127 * Implementation: When a client asks for exclusive access,
2128 * disconnect all others. Shared connects are allowed as long
2129 * as no exclusive connection exists.
2130 *
2131 * This is how the rfb spec suggests to handle the shared flag.
2132 */
2133 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2134 VncState *client;
2135 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2136 if (vs == client) {
2137 continue;
2138 }
2139 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2140 client->share_mode != VNC_SHARE_MODE_SHARED) {
2141 continue;
2142 }
2143 vnc_disconnect_start(client);
2144 }
2145 }
2146 if (mode == VNC_SHARE_MODE_SHARED) {
2147 if (vs->vd->num_exclusive > 0) {
2148 vnc_disconnect_start(vs);
2149 return 0;
2150 }
2151 }
2152 break;
2153 case VNC_SHARE_POLICY_FORCE_SHARED:
2154 /*
2155 * Policy: Shared connects only.
2156 * Implementation: Disallow clients asking for exclusive access.
2157 *
2158 * Useful for shared desktop sessions where you don't want
2159 * someone forgetting to say -shared when running the vnc
2160 * client disconnect everybody else.
2161 */
2162 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2163 vnc_disconnect_start(vs);
2164 return 0;
2165 }
2166 break;
2167 }
2168 vnc_set_share_mode(vs, mode);
2169
2170 vs->client_width = ds_get_width(vs->ds);
2171 vs->client_height = ds_get_height(vs->ds);
2172 vnc_write_u16(vs, vs->client_width);
2173 vnc_write_u16(vs, vs->client_height);
2174
2175 pixel_format_message(vs);
2176
2177 if (qemu_name)
2178 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2179 else
2180 size = snprintf(buf, sizeof(buf), "QEMU");
2181
2182 vnc_write_u32(vs, size);
2183 vnc_write(vs, buf, size);
2184 vnc_flush(vs);
2185
2186 vnc_client_cache_auth(vs);
2187 vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2188
2189 vnc_read_when(vs, protocol_client_msg, 1);
2190
2191 return 0;
2192 }
2193
2194 void start_client_init(VncState *vs)
2195 {
2196 vnc_read_when(vs, protocol_client_init, 1);
2197 }
2198
2199 static void make_challenge(VncState *vs)
2200 {
2201 int i;
2202
2203 srand(time(NULL)+getpid()+getpid()*987654+rand());
2204
2205 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2206 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2207 }
2208
2209 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2210 {
2211 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2212 int i, j, pwlen;
2213 unsigned char key[8];
2214 time_t now = time(NULL);
2215
2216 if (!vs->vd->password) {
2217 VNC_DEBUG("No password configured on server");
2218 goto reject;
2219 }
2220 if (vs->vd->expires < now) {
2221 VNC_DEBUG("Password is expired");
2222 goto reject;
2223 }
2224
2225 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2226
2227 /* Calculate the expected challenge response */
2228 pwlen = strlen(vs->vd->password);
2229 for (i=0; i<sizeof(key); i++)
2230 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2231 deskey(key, EN0);
2232 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2233 des(response+j, response+j);
2234
2235 /* Compare expected vs actual challenge response */
2236 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2237 VNC_DEBUG("Client challenge response did not match\n");
2238 goto reject;
2239 } else {
2240 VNC_DEBUG("Accepting VNC challenge response\n");
2241 vnc_write_u32(vs, 0); /* Accept auth */
2242 vnc_flush(vs);
2243
2244 start_client_init(vs);
2245 }
2246 return 0;
2247
2248 reject:
2249 vnc_write_u32(vs, 1); /* Reject auth */
2250 if (vs->minor >= 8) {
2251 static const char err[] = "Authentication failed";
2252 vnc_write_u32(vs, sizeof(err));
2253 vnc_write(vs, err, sizeof(err));
2254 }
2255 vnc_flush(vs);
2256 vnc_client_error(vs);
2257 return 0;
2258 }
2259
2260 void start_auth_vnc(VncState *vs)
2261 {
2262 make_challenge(vs);
2263 /* Send client a 'random' challenge */
2264 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2265 vnc_flush(vs);
2266
2267 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2268 }
2269
2270
2271 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2272 {
2273 /* We only advertise 1 auth scheme at a time, so client
2274 * must pick the one we sent. Verify this */
2275 if (data[0] != vs->auth) { /* Reject auth */
2276 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2277 vnc_write_u32(vs, 1);
2278 if (vs->minor >= 8) {
2279 static const char err[] = "Authentication failed";
2280 vnc_write_u32(vs, sizeof(err));
2281 vnc_write(vs, err, sizeof(err));
2282 }
2283 vnc_client_error(vs);
2284 } else { /* Accept requested auth */
2285 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2286 switch (vs->auth) {
2287 case VNC_AUTH_NONE:
2288 VNC_DEBUG("Accept auth none\n");
2289 if (vs->minor >= 8) {
2290 vnc_write_u32(vs, 0); /* Accept auth completion */
2291 vnc_flush(vs);
2292 }
2293 start_client_init(vs);
2294 break;
2295
2296 case VNC_AUTH_VNC:
2297 VNC_DEBUG("Start VNC auth\n");
2298 start_auth_vnc(vs);
2299 break;
2300
2301 #ifdef CONFIG_VNC_TLS
2302 case VNC_AUTH_VENCRYPT:
2303 VNC_DEBUG("Accept VeNCrypt auth\n");
2304 start_auth_vencrypt(vs);
2305 break;
2306 #endif /* CONFIG_VNC_TLS */
2307
2308 #ifdef CONFIG_VNC_SASL
2309 case VNC_AUTH_SASL:
2310 VNC_DEBUG("Accept SASL auth\n");
2311 start_auth_sasl(vs);
2312 break;
2313 #endif /* CONFIG_VNC_SASL */
2314
2315 default: /* Should not be possible, but just in case */
2316 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2317 vnc_write_u8(vs, 1);
2318 if (vs->minor >= 8) {
2319 static const char err[] = "Authentication failed";
2320 vnc_write_u32(vs, sizeof(err));
2321 vnc_write(vs, err, sizeof(err));
2322 }
2323 vnc_client_error(vs);
2324 }
2325 }
2326 return 0;
2327 }
2328
2329 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2330 {
2331 char local[13];
2332
2333 memcpy(local, version, 12);
2334 local[12] = 0;
2335
2336 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2337 VNC_DEBUG("Malformed protocol version %s\n", local);
2338 vnc_client_error(vs);
2339 return 0;
2340 }
2341 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2342 if (vs->major != 3 ||
2343 (vs->minor != 3 &&
2344 vs->minor != 4 &&
2345 vs->minor != 5 &&
2346 vs->minor != 7 &&
2347 vs->minor != 8)) {
2348 VNC_DEBUG("Unsupported client version\n");
2349 vnc_write_u32(vs, VNC_AUTH_INVALID);
2350 vnc_flush(vs);
2351 vnc_client_error(vs);
2352 return 0;
2353 }
2354 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2355 * as equivalent to v3.3 by servers
2356 */
2357 if (vs->minor == 4 || vs->minor == 5)
2358 vs->minor = 3;
2359
2360 if (vs->minor == 3) {
2361 if (vs->auth == VNC_AUTH_NONE) {
2362 VNC_DEBUG("Tell client auth none\n");
2363 vnc_write_u32(vs, vs->auth);
2364 vnc_flush(vs);
2365 start_client_init(vs);
2366 } else if (vs->auth == VNC_AUTH_VNC) {
2367 VNC_DEBUG("Tell client VNC auth\n");
2368 vnc_write_u32(vs, vs->auth);
2369 vnc_flush(vs);
2370 start_auth_vnc(vs);
2371 } else {
2372 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2373 vnc_write_u32(vs, VNC_AUTH_INVALID);
2374 vnc_flush(vs);
2375 vnc_client_error(vs);
2376 }
2377 } else {
2378 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2379 vnc_write_u8(vs, 1); /* num auth */
2380 vnc_write_u8(vs, vs->auth);
2381 vnc_read_when(vs, protocol_client_auth, 1);
2382 vnc_flush(vs);
2383 }
2384
2385 return 0;
2386 }
2387
2388 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2389 {
2390 struct VncSurface *vs = &vd->guest;
2391
2392 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2393 }
2394
2395 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2396 {
2397 int i, j;
2398
2399 w = (x + w) / VNC_STAT_RECT;
2400 h = (y + h) / VNC_STAT_RECT;
2401 x /= VNC_STAT_RECT;
2402 y /= VNC_STAT_RECT;
2403
2404 for (j = y; j <= h; j++) {
2405 for (i = x; i <= w; i++) {
2406 vs->lossy_rect[j][i] = 1;
2407 }
2408 }
2409 }
2410
2411 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2412 {
2413 VncState *vs;
2414 int sty = y / VNC_STAT_RECT;
2415 int stx = x / VNC_STAT_RECT;
2416 int has_dirty = 0;
2417
2418 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2419 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2420
2421 QTAILQ_FOREACH(vs, &vd->clients, next) {
2422 int j;
2423
2424 /* kernel send buffers are full -> refresh later */
2425 if (vs->output.offset) {
2426 continue;
2427 }
2428
2429 if (!vs->lossy_rect[sty][stx]) {
2430 continue;
2431 }
2432
2433 vs->lossy_rect[sty][stx] = 0;
2434 for (j = 0; j < VNC_STAT_RECT; ++j) {
2435 bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);
2436 }
2437 has_dirty++;
2438 }
2439
2440 return has_dirty;
2441 }
2442
2443 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2444 {
2445 int x, y;
2446 struct timeval res;
2447 int has_dirty = 0;
2448
2449 for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT) {
2450 for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT) {
2451 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2452
2453 rect->updated = false;
2454 }
2455 }
2456
2457 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2458
2459 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2460 return has_dirty;
2461 }
2462 vd->guest.last_freq_check = *tv;
2463
2464 for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT) {
2465 for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT) {
2466 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2467 int count = ARRAY_SIZE(rect->times);
2468 struct timeval min, max;
2469
2470 if (!timerisset(&rect->times[count - 1])) {
2471 continue ;
2472 }
2473
2474 max = rect->times[(rect->idx + count - 1) % count];
2475 qemu_timersub(tv, &max, &res);
2476
2477 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2478 rect->freq = 0;
2479 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2480 memset(rect->times, 0, sizeof (rect->times));
2481 continue ;
2482 }
2483
2484 min = rect->times[rect->idx];
2485 max = rect->times[(rect->idx + count - 1) % count];
2486 qemu_timersub(&max, &min, &res);
2487
2488 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2489 rect->freq /= count;
2490 rect->freq = 1. / rect->freq;
2491 }
2492 }
2493 return has_dirty;
2494 }
2495
2496 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2497 {
2498 int i, j;
2499 double total = 0;
2500 int num = 0;
2501
2502 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2503 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2504
2505 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2506 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2507 total += vnc_stat_rect(vs->vd, i, j)->freq;
2508 num++;
2509 }
2510 }
2511
2512 if (num) {
2513 return total / num;
2514 } else {
2515 return 0;
2516 }
2517 }
2518
2519 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2520 {
2521 VncRectStat *rect;
2522
2523 rect = vnc_stat_rect(vd, x, y);
2524 if (rect->updated) {
2525 return ;
2526 }
2527 rect->times[rect->idx] = *tv;
2528 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2529 rect->updated = true;
2530 }
2531
2532 static int vnc_refresh_server_surface(VncDisplay *vd)
2533 {
2534 int y;
2535 uint8_t *guest_row;
2536 uint8_t *server_row;
2537 int cmp_bytes;
2538 VncState *vs;
2539 int has_dirty = 0;
2540
2541 struct timeval tv = { 0, 0 };
2542
2543 if (!vd->non_adaptive) {
2544 gettimeofday(&tv, NULL);
2545 has_dirty = vnc_update_stats(vd, &tv);
2546 }
2547
2548 /*
2549 * Walk through the guest dirty map.
2550 * Check and copy modified bits from guest to server surface.
2551 * Update server dirty map.
2552 */
2553 cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2554 guest_row = vd->guest.ds->data;
2555 server_row = vd->server->data;
2556 for (y = 0; y < vd->guest.ds->height; y++) {
2557 if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) {
2558 int x;
2559 uint8_t *guest_ptr;
2560 uint8_t *server_ptr;
2561
2562 guest_ptr = guest_row;
2563 server_ptr = server_row;
2564
2565 for (x = 0; x + 15 < vd->guest.ds->width;
2566 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2567 if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
2568 continue;
2569 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2570 continue;
2571 memcpy(server_ptr, guest_ptr, cmp_bytes);
2572 if (!vd->non_adaptive)
2573 vnc_rect_updated(vd, x, y, &tv);
2574 QTAILQ_FOREACH(vs, &vd->clients, next) {
2575 set_bit((x / 16), vs->dirty[y]);
2576 }
2577 has_dirty++;
2578 }
2579 }
2580 guest_row += ds_get_linesize(vd->ds);
2581 server_row += ds_get_linesize(vd->ds);
2582 }
2583 return has_dirty;
2584 }
2585
2586 static void vnc_refresh(void *opaque)
2587 {
2588 VncDisplay *vd = opaque;
2589 VncState *vs, *vn;
2590 int has_dirty, rects = 0;
2591
2592 vga_hw_update();
2593
2594 if (vnc_trylock_display(vd)) {
2595 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2596 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) +
2597 vd->timer_interval);
2598 return;
2599 }
2600
2601 has_dirty = vnc_refresh_server_surface(vd);
2602 vnc_unlock_display(vd);
2603
2604 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2605 rects += vnc_update_client(vs, has_dirty);
2606 /* vs might be free()ed here */
2607 }
2608
2609 /* vd->timer could be NULL now if the last client disconnected,
2610 * in this case don't update the timer */
2611 if (vd->timer == NULL)
2612 return;
2613
2614 if (has_dirty && rects) {
2615 vd->timer_interval /= 2;
2616 if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2617 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2618 } else {
2619 vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2620 if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2621 vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2622 }
2623 qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
2624 }
2625
2626 static void vnc_init_timer(VncDisplay *vd)
2627 {
2628 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2629 if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
2630 vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
2631 vnc_dpy_resize(vd->ds);
2632 vnc_refresh(vd);
2633 }
2634 }
2635
2636 static void vnc_remove_timer(VncDisplay *vd)
2637 {
2638 if (vd->timer != NULL && QTAILQ_EMPTY(&vd->clients)) {
2639 qemu_del_timer(vd->timer);
2640 qemu_free_timer(vd->timer);
2641 vd->timer = NULL;
2642 }
2643 }
2644
2645 static void vnc_connect(VncDisplay *vd, int csock, int skipauth)
2646 {
2647 VncState *vs = g_malloc0(sizeof(VncState));
2648 int i;
2649
2650 vs->csock = csock;
2651
2652 if (skipauth) {
2653 vs->auth = VNC_AUTH_NONE;
2654 #ifdef CONFIG_VNC_TLS
2655 vs->subauth = VNC_AUTH_INVALID;
2656 #endif
2657 } else {
2658 vs->auth = vd->auth;
2659 #ifdef CONFIG_VNC_TLS
2660 vs->subauth = vd->subauth;
2661 #endif
2662 }
2663
2664 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2665 for (i = 0; i < VNC_STAT_ROWS; ++i) {
2666 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
2667 }
2668
2669 VNC_DEBUG("New client on socket %d\n", csock);
2670 dcl->idle = 0;
2671 socket_set_nonblock(vs->csock);
2672 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2673
2674 vnc_client_cache_addr(vs);
2675 vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2676 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2677
2678 vs->vd = vd;
2679 vs->ds = vd->ds;
2680 vs->last_x = -1;
2681 vs->last_y = -1;
2682
2683 vs->as.freq = 44100;
2684 vs->as.nchannels = 2;
2685 vs->as.fmt = AUD_FMT_S16;
2686 vs->as.endianness = 0;
2687
2688 #ifdef CONFIG_VNC_THREAD
2689 qemu_mutex_init(&vs->output_mutex);
2690 #endif
2691
2692 QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2693
2694 vga_hw_update();
2695
2696 vnc_write(vs, "RFB 003.008\n", 12);
2697 vnc_flush(vs);
2698 vnc_read_when(vs, protocol_version, 12);
2699 reset_keys(vs);
2700 if (vs->vd->lock_key_sync)
2701 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2702
2703 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2704 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2705
2706 vnc_init_timer(vd);
2707
2708 /* vs might be free()ed here */
2709 }
2710
2711 static void vnc_listen_read(void *opaque)
2712 {
2713 VncDisplay *vs = opaque;
2714 struct sockaddr_in addr;
2715 socklen_t addrlen = sizeof(addr);
2716
2717 /* Catch-up */
2718 vga_hw_update();
2719
2720 int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2721 if (csock != -1) {
2722 vnc_connect(vs, csock, 0);
2723 }
2724 }
2725
2726 void vnc_display_init(DisplayState *ds)
2727 {
2728 VncDisplay *vs = g_malloc0(sizeof(*vs));
2729
2730 dcl = g_malloc0(sizeof(DisplayChangeListener));
2731
2732 ds->opaque = vs;
2733 dcl->idle = 1;
2734 vnc_display = vs;
2735
2736 vs->lsock = -1;
2737
2738 vs->ds = ds;
2739 QTAILQ_INIT(&vs->clients);
2740 vs->expires = TIME_MAX;
2741
2742 if (keyboard_layout)
2743 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2744 else
2745 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2746
2747 if (!vs->kbd_layout)
2748 exit(1);
2749
2750 #ifdef CONFIG_VNC_THREAD
2751 qemu_mutex_init(&vs->mutex);
2752 vnc_start_worker_thread();
2753 #endif
2754
2755 dcl->dpy_copy = vnc_dpy_copy;
2756 dcl->dpy_update = vnc_dpy_update;
2757 dcl->dpy_resize = vnc_dpy_resize;
2758 dcl->dpy_setdata = vnc_dpy_setdata;
2759 register_displaychangelistener(ds, dcl);
2760 ds->mouse_set = vnc_mouse_set;
2761 ds->cursor_define = vnc_dpy_cursor_define;
2762 }
2763
2764
2765 void vnc_display_close(DisplayState *ds)
2766 {
2767 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2768
2769 if (!vs)
2770 return;
2771 if (vs->display) {
2772 g_free(vs->display);
2773 vs->display = NULL;
2774 }
2775 if (vs->lsock != -1) {
2776 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2777 close(vs->lsock);
2778 vs->lsock = -1;
2779 }
2780 vs->auth = VNC_AUTH_INVALID;
2781 #ifdef CONFIG_VNC_TLS
2782 vs->subauth = VNC_AUTH_INVALID;
2783 vs->tls.x509verify = 0;
2784 #endif
2785 }
2786
2787 int vnc_display_disable_login(DisplayState *ds)
2788 {
2789 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2790
2791 if (!vs) {
2792 return -1;
2793 }
2794
2795 if (vs->password) {
2796 g_free(vs->password);
2797 }
2798
2799 vs->password = NULL;
2800 if (vs->auth == VNC_AUTH_NONE) {
2801 vs->auth = VNC_AUTH_VNC;
2802 }
2803
2804 return 0;
2805 }
2806
2807 int vnc_display_password(DisplayState *ds, const char *password)
2808 {
2809 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2810
2811 if (!vs) {
2812 return -EINVAL;
2813 }
2814
2815 if (!password) {
2816 /* This is not the intention of this interface but err on the side
2817 of being safe */
2818 return vnc_display_disable_login(ds);
2819 }
2820
2821 if (vs->password) {
2822 g_free(vs->password);
2823 vs->password = NULL;
2824 }
2825 vs->password = g_strdup(password);
2826 if (vs->auth == VNC_AUTH_NONE) {
2827 vs->auth = VNC_AUTH_VNC;
2828 }
2829
2830 return 0;
2831 }
2832
2833 int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2834 {
2835 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2836
2837 vs->expires = expires;
2838 return 0;
2839 }
2840
2841 char *vnc_display_local_addr(DisplayState *ds)
2842 {
2843 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2844
2845 return vnc_socket_local_addr("%s:%s", vs->lsock);
2846 }
2847
2848 int vnc_display_open(DisplayState *ds, const char *display)
2849 {
2850 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2851 const char *options;
2852 int password = 0;
2853 int reverse = 0;
2854 #ifdef CONFIG_VNC_TLS
2855 int tls = 0, x509 = 0;
2856 #endif
2857 #ifdef CONFIG_VNC_SASL
2858 int sasl = 0;
2859 int saslErr;
2860 #endif
2861 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2862 int acl = 0;
2863 #endif
2864 int lock_key_sync = 1;
2865
2866 if (!vnc_display)
2867 return -1;
2868 vnc_display_close(ds);
2869 if (strcmp(display, "none") == 0)
2870 return 0;
2871
2872 if (!(vs->display = strdup(display)))
2873 return -1;
2874 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2875
2876 options = display;
2877 while ((options = strchr(options, ','))) {
2878 options++;
2879 if (strncmp(options, "password", 8) == 0) {
2880 password = 1; /* Require password auth */
2881 } else if (strncmp(options, "reverse", 7) == 0) {
2882 reverse = 1;
2883 } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
2884 lock_key_sync = 0;
2885 #ifdef CONFIG_VNC_SASL
2886 } else if (strncmp(options, "sasl", 4) == 0) {
2887 sasl = 1; /* Require SASL auth */
2888 #endif
2889 #ifdef CONFIG_VNC_TLS
2890 } else if (strncmp(options, "tls", 3) == 0) {
2891 tls = 1; /* Require TLS */
2892 } else if (strncmp(options, "x509", 4) == 0) {
2893 char *start, *end;
2894 x509 = 1; /* Require x509 certificates */
2895 if (strncmp(options, "x509verify", 10) == 0)
2896 vs->tls.x509verify = 1; /* ...and verify client certs */
2897
2898 /* Now check for 'x509=/some/path' postfix
2899 * and use that to setup x509 certificate/key paths */
2900 start = strchr(options, '=');
2901 end = strchr(options, ',');
2902 if (start && (!end || (start < end))) {
2903 int len = end ? end-(start+1) : strlen(start+1);
2904 char *path = g_strndup(start + 1, len);
2905
2906 VNC_DEBUG("Trying certificate path '%s'\n", path);
2907 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2908 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2909 g_free(path);
2910 g_free(vs->display);
2911 vs->display = NULL;
2912 return -1;
2913 }
2914 g_free(path);
2915 } else {
2916 fprintf(stderr, "No certificate path provided\n");
2917 g_free(vs->display);
2918 vs->display = NULL;
2919 return -1;
2920 }
2921 #endif
2922 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2923 } else if (strncmp(options, "acl", 3) == 0) {
2924 acl = 1;
2925 #endif
2926 } else if (strncmp(options, "lossy", 5) == 0) {
2927 vs->lossy = true;
2928 } else if (strncmp(options, "non-adapative", 13) == 0) {
2929 vs->non_adaptive = true;
2930 } else if (strncmp(options, "share=", 6) == 0) {
2931 if (strncmp(options+6, "ignore", 6) == 0) {
2932 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
2933 } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
2934 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2935 } else if (strncmp(options+6, "force-shared", 12) == 0) {
2936 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
2937 } else {
2938 fprintf(stderr, "unknown vnc share= option\n");
2939 g_free(vs->display);
2940 vs->display = NULL;
2941 return -1;
2942 }
2943 }
2944 }
2945
2946 #ifdef CONFIG_VNC_TLS
2947 if (acl && x509 && vs->tls.x509verify) {
2948 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2949 fprintf(stderr, "Failed to create x509 dname ACL\n");
2950 exit(1);
2951 }
2952 }
2953 #endif
2954 #ifdef CONFIG_VNC_SASL
2955 if (acl && sasl) {
2956 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2957 fprintf(stderr, "Failed to create username ACL\n");
2958 exit(1);
2959 }
2960 }
2961 #endif
2962
2963 /*
2964 * Combinations we support here:
2965 *
2966 * - no-auth (clear text, no auth)
2967 * - password (clear text, weak auth)
2968 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2969 * - tls (encrypt, weak anonymous creds, no auth)
2970 * - tls + password (encrypt, weak anonymous creds, weak auth)
2971 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2972 * - tls + x509 (encrypt, good x509 creds, no auth)
2973 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2974 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2975 *
2976 * NB1. TLS is a stackable auth scheme.
2977 * NB2. the x509 schemes have option to validate a client cert dname
2978 */
2979 if (password) {
2980 #ifdef CONFIG_VNC_TLS
2981 if (tls) {
2982 vs->auth = VNC_AUTH_VENCRYPT;
2983 if (x509) {
2984 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2985 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2986 } else {
2987 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2988 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2989 }
2990 } else {
2991 #endif /* CONFIG_VNC_TLS */
2992 VNC_DEBUG("Initializing VNC server with password auth\n");
2993 vs->auth = VNC_AUTH_VNC;
2994 #ifdef CONFIG_VNC_TLS
2995 vs->subauth = VNC_AUTH_INVALID;
2996 }
2997 #endif /* CONFIG_VNC_TLS */
2998 #ifdef CONFIG_VNC_SASL
2999 } else if (sasl) {
3000 #ifdef CONFIG_VNC_TLS
3001 if (tls) {
3002 vs->auth = VNC_AUTH_VENCRYPT;
3003 if (x509) {
3004 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3005 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3006 } else {
3007 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3008 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3009 }
3010 } else {
3011 #endif /* CONFIG_VNC_TLS */
3012 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3013 vs->auth = VNC_AUTH_SASL;
3014 #ifdef CONFIG_VNC_TLS
3015 vs->subauth = VNC_AUTH_INVALID;
3016 }
3017 #endif /* CONFIG_VNC_TLS */
3018 #endif /* CONFIG_VNC_SASL */
3019 } else {
3020 #ifdef CONFIG_VNC_TLS
3021 if (tls) {
3022 vs->auth = VNC_AUTH_VENCRYPT;
3023 if (x509) {
3024 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3025 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3026 } else {
3027 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3028 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3029 }
3030 } else {
3031 #endif
3032 VNC_DEBUG("Initializing VNC server with no auth\n");
3033 vs->auth = VNC_AUTH_NONE;
3034 #ifdef CONFIG_VNC_TLS
3035 vs->subauth = VNC_AUTH_INVALID;
3036 }
3037 #endif
3038 }
3039
3040 #ifdef CONFIG_VNC_SASL
3041 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3042 fprintf(stderr, "Failed to initialize SASL auth %s",
3043 sasl_errstring(saslErr, NULL, NULL));
3044 g_free(vs->display);
3045 vs->display = NULL;
3046 return -1;
3047 }
3048 #endif
3049 vs->lock_key_sync = lock_key_sync;
3050
3051 if (reverse) {
3052 /* connect to viewer */
3053 if (strncmp(display, "unix:", 5) == 0)
3054 vs->lsock = unix_connect(display+5);
3055 else
3056 vs->lsock = inet_connect(display, SOCK_STREAM);
3057 if (-1 == vs->lsock) {
3058 g_free(vs->display);
3059 vs->display = NULL;
3060 return -1;
3061 } else {
3062 int csock = vs->lsock;
3063 vs->lsock = -1;
3064 vnc_connect(vs, csock, 0);
3065 }
3066 return 0;
3067
3068 } else {
3069 /* listen for connects */
3070 char *dpy;
3071 dpy = g_malloc(256);
3072 if (strncmp(display, "unix:", 5) == 0) {
3073 pstrcpy(dpy, 256, "unix:");
3074 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
3075 } else {
3076 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
3077 }
3078 if (-1 == vs->lsock) {
3079 g_free(dpy);
3080 return -1;
3081 } else {
3082 g_free(vs->display);
3083 vs->display = dpy;
3084 }
3085 }
3086 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
3087 }
3088
3089 void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3090 {
3091 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
3092
3093 return vnc_connect(vs, csock, skipauth);
3094 }
Qemu copy for testing