2 * QEMU VNC display driver
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
30 #include "qemu_socket.h"
31 #include "qemu-timer.h"
33 #include "qemu-objects.h"
34 #include "qmp-commands.h"
36 #define VNC_REFRESH_INTERVAL_BASE 30
37 #define VNC_REFRESH_INTERVAL_INC 50
38 #define VNC_REFRESH_INTERVAL_MAX 2000
39 static const struct timeval VNC_REFRESH_STATS
= { 0, 500000 };
40 static const struct timeval VNC_REFRESH_LOSSY
= { 2, 0 };
42 #include "vnc_keysym.h"
45 static VncDisplay
*vnc_display
; /* needed for info vnc */
46 static DisplayChangeListener
*dcl
;
48 static int vnc_cursor_define(VncState
*vs
);
50 static char *addr_to_string(const char *format
,
51 struct sockaddr_storage
*sa
,
54 char host
[NI_MAXHOST
];
55 char serv
[NI_MAXSERV
];
59 if ((err
= getnameinfo((struct sockaddr
*)sa
, salen
,
62 NI_NUMERICHOST
| NI_NUMERICSERV
)) != 0) {
63 VNC_DEBUG("Cannot resolve address %d: %s\n",
64 err
, gai_strerror(err
));
68 /* Enough for the existing format + the 2 vars we're
70 addrlen
= strlen(format
) + strlen(host
) + strlen(serv
);
71 addr
= g_malloc(addrlen
+ 1);
72 snprintf(addr
, addrlen
, format
, host
, serv
);
79 char *vnc_socket_local_addr(const char *format
, int fd
) {
80 struct sockaddr_storage sa
;
84 if (getsockname(fd
, (struct sockaddr
*)&sa
, &salen
) < 0)
87 return addr_to_string(format
, &sa
, salen
);
90 char *vnc_socket_remote_addr(const char *format
, int fd
) {
91 struct sockaddr_storage sa
;
95 if (getpeername(fd
, (struct sockaddr
*)&sa
, &salen
) < 0)
98 return addr_to_string(format
, &sa
, salen
);
101 static int put_addr_qdict(QDict
*qdict
, struct sockaddr_storage
*sa
,
104 char host
[NI_MAXHOST
];
105 char serv
[NI_MAXSERV
];
108 if ((err
= getnameinfo((struct sockaddr
*)sa
, salen
,
111 NI_NUMERICHOST
| NI_NUMERICSERV
)) != 0) {
112 VNC_DEBUG("Cannot resolve address %d: %s\n",
113 err
, gai_strerror(err
));
117 qdict_put(qdict
, "host", qstring_from_str(host
));
118 qdict_put(qdict
, "service", qstring_from_str(serv
));
119 qdict_put(qdict
, "family",qstring_from_str(inet_strfamily(sa
->ss_family
)));
124 static int vnc_server_addr_put(QDict
*qdict
, int fd
)
126 struct sockaddr_storage sa
;
130 if (getsockname(fd
, (struct sockaddr
*)&sa
, &salen
) < 0) {
134 return put_addr_qdict(qdict
, &sa
, salen
);
137 static int vnc_qdict_remote_addr(QDict
*qdict
, int fd
)
139 struct sockaddr_storage sa
;
143 if (getpeername(fd
, (struct sockaddr
*)&sa
, &salen
) < 0) {
147 return put_addr_qdict(qdict
, &sa
, salen
);
150 static const char *vnc_auth_name(VncDisplay
*vd
) {
152 case VNC_AUTH_INVALID
:
168 case VNC_AUTH_VENCRYPT
:
169 #ifdef CONFIG_VNC_TLS
170 switch (vd
->subauth
) {
171 case VNC_AUTH_VENCRYPT_PLAIN
:
172 return "vencrypt+plain";
173 case VNC_AUTH_VENCRYPT_TLSNONE
:
174 return "vencrypt+tls+none";
175 case VNC_AUTH_VENCRYPT_TLSVNC
:
176 return "vencrypt+tls+vnc";
177 case VNC_AUTH_VENCRYPT_TLSPLAIN
:
178 return "vencrypt+tls+plain";
179 case VNC_AUTH_VENCRYPT_X509NONE
:
180 return "vencrypt+x509+none";
181 case VNC_AUTH_VENCRYPT_X509VNC
:
182 return "vencrypt+x509+vnc";
183 case VNC_AUTH_VENCRYPT_X509PLAIN
:
184 return "vencrypt+x509+plain";
185 case VNC_AUTH_VENCRYPT_TLSSASL
:
186 return "vencrypt+tls+sasl";
187 case VNC_AUTH_VENCRYPT_X509SASL
:
188 return "vencrypt+x509+sasl";
201 static int vnc_server_info_put(QDict
*qdict
)
203 if (vnc_server_addr_put(qdict
, vnc_display
->lsock
) < 0) {
207 qdict_put(qdict
, "auth", qstring_from_str(vnc_auth_name(vnc_display
)));
211 static void vnc_client_cache_auth(VncState
*client
)
213 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
221 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
222 qdict
= qobject_to_qdict(client
->info
);
225 #ifdef CONFIG_VNC_TLS
226 if (client
->tls
.session
&&
228 qdict_put(qdict
, "x509_dname", qstring_from_str(client
->tls
.dname
));
231 #ifdef CONFIG_VNC_SASL
232 if (client
->sasl
.conn
&&
233 client
->sasl
.username
) {
234 qdict_put(qdict
, "sasl_username",
235 qstring_from_str(client
->sasl
.username
));
240 static void vnc_client_cache_addr(VncState
*client
)
245 if (vnc_qdict_remote_addr(qdict
, client
->csock
) < 0) {
247 /* XXX: how to report the error? */
251 client
->info
= QOBJECT(qdict
);
254 static void vnc_qmp_event(VncState
*vs
, MonitorEvent event
)
263 server
= qdict_new();
264 if (vnc_server_info_put(server
) < 0) {
269 data
= qobject_from_jsonf("{ 'client': %p, 'server': %p }",
270 vs
->info
, QOBJECT(server
));
272 monitor_protocol_event(event
, data
);
274 qobject_incref(vs
->info
);
275 qobject_decref(data
);
278 static VncClientInfo
*qmp_query_vnc_client(const VncState
*client
)
280 struct sockaddr_storage sa
;
281 socklen_t salen
= sizeof(sa
);
282 char host
[NI_MAXHOST
];
283 char serv
[NI_MAXSERV
];
286 if (getpeername(client
->csock
, (struct sockaddr
*)&sa
, &salen
) < 0) {
290 if (getnameinfo((struct sockaddr
*)&sa
, salen
,
293 NI_NUMERICHOST
| NI_NUMERICSERV
) < 0) {
297 info
= g_malloc0(sizeof(*info
));
298 info
->host
= g_strdup(host
);
299 info
->service
= g_strdup(serv
);
300 info
->family
= g_strdup(inet_strfamily(sa
.ss_family
));
302 #ifdef CONFIG_VNC_TLS
303 if (client
->tls
.session
&& client
->tls
.dname
) {
304 info
->has_x509_dname
= true;
305 info
->x509_dname
= g_strdup(client
->tls
.dname
);
308 #ifdef CONFIG_VNC_SASL
309 if (client
->sasl
.conn
&& client
->sasl
.username
) {
310 info
->has_sasl_username
= true;
311 info
->sasl_username
= g_strdup(client
->sasl
.username
);
318 VncInfo
*qmp_query_vnc(Error
**errp
)
320 VncInfo
*info
= g_malloc0(sizeof(*info
));
322 if (vnc_display
== NULL
|| vnc_display
->display
== NULL
) {
323 info
->enabled
= false;
325 VncClientInfoList
*cur_item
= NULL
;
326 struct sockaddr_storage sa
;
327 socklen_t salen
= sizeof(sa
);
328 char host
[NI_MAXHOST
];
329 char serv
[NI_MAXSERV
];
332 info
->enabled
= true;
334 /* for compatibility with the original command */
335 info
->has_clients
= true;
337 QTAILQ_FOREACH(client
, &vnc_display
->clients
, next
) {
338 VncClientInfoList
*cinfo
= g_malloc0(sizeof(*info
));
339 cinfo
->value
= qmp_query_vnc_client(client
);
341 /* XXX: waiting for the qapi to support GSList */
343 info
->clients
= cur_item
= cinfo
;
345 cur_item
->next
= cinfo
;
350 if (getsockname(vnc_display
->lsock
, (struct sockaddr
*)&sa
,
352 error_set(errp
, QERR_UNDEFINED_ERROR
);
356 if (getnameinfo((struct sockaddr
*)&sa
, salen
,
359 NI_NUMERICHOST
| NI_NUMERICSERV
) < 0) {
360 error_set(errp
, QERR_UNDEFINED_ERROR
);
364 info
->has_host
= true;
365 info
->host
= g_strdup(host
);
367 info
->has_service
= true;
368 info
->service
= g_strdup(serv
);
370 info
->has_family
= true;
371 info
->family
= g_strdup(inet_strfamily(sa
.ss_family
));
373 info
->has_auth
= true;
374 info
->auth
= g_strdup(vnc_auth_name(vnc_display
));
380 qapi_free_VncInfo(info
);
385 1) Get the queue working for IO.
386 2) there is some weirdness when using the -S option (the screen is grey
387 and not totally invalidated
388 3) resolutions > 1024
391 static int vnc_update_client(VncState
*vs
, int has_dirty
);
392 static int vnc_update_client_sync(VncState
*vs
, int has_dirty
);
393 static void vnc_disconnect_start(VncState
*vs
);
394 static void vnc_disconnect_finish(VncState
*vs
);
395 static void vnc_init_timer(VncDisplay
*vd
);
396 static void vnc_remove_timer(VncDisplay
*vd
);
398 static void vnc_colordepth(VncState
*vs
);
399 static void framebuffer_update_request(VncState
*vs
, int incremental
,
400 int x_position
, int y_position
,
402 static void vnc_refresh(void *opaque
);
403 static int vnc_refresh_server_surface(VncDisplay
*vd
);
405 static void vnc_dpy_update(DisplayState
*ds
, int x
, int y
, int w
, int h
)
408 VncDisplay
*vd
= ds
->opaque
;
409 struct VncSurface
*s
= &vd
->guest
;
413 /* round x down to ensure the loop only spans one 16-pixel block per,
414 iteration. otherwise, if (x % 16) != 0, the last iteration may span
415 two 16-pixel blocks but we only mark the first as dirty
420 x
= MIN(x
, s
->ds
->width
);
421 y
= MIN(y
, s
->ds
->height
);
422 w
= MIN(x
+ w
, s
->ds
->width
) - x
;
423 h
= MIN(h
, s
->ds
->height
);
426 for (i
= 0; i
< w
; i
+= 16)
427 set_bit((x
+ i
) / 16, s
->dirty
[y
]);
430 void vnc_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
,
433 vnc_write_u16(vs
, x
);
434 vnc_write_u16(vs
, y
);
435 vnc_write_u16(vs
, w
);
436 vnc_write_u16(vs
, h
);
438 vnc_write_s32(vs
, encoding
);
441 void buffer_reserve(Buffer
*buffer
, size_t len
)
443 if ((buffer
->capacity
- buffer
->offset
) < len
) {
444 buffer
->capacity
+= (len
+ 1024);
445 buffer
->buffer
= g_realloc(buffer
->buffer
, buffer
->capacity
);
446 if (buffer
->buffer
== NULL
) {
447 fprintf(stderr
, "vnc: out of memory\n");
453 int buffer_empty(Buffer
*buffer
)
455 return buffer
->offset
== 0;
458 uint8_t *buffer_end(Buffer
*buffer
)
460 return buffer
->buffer
+ buffer
->offset
;
463 void buffer_reset(Buffer
*buffer
)
468 void buffer_free(Buffer
*buffer
)
470 g_free(buffer
->buffer
);
472 buffer
->capacity
= 0;
473 buffer
->buffer
= NULL
;
476 void buffer_append(Buffer
*buffer
, const void *data
, size_t len
)
478 memcpy(buffer
->buffer
+ buffer
->offset
, data
, len
);
479 buffer
->offset
+= len
;
482 static void vnc_desktop_resize(VncState
*vs
)
484 DisplayState
*ds
= vs
->ds
;
486 if (vs
->csock
== -1 || !vnc_has_feature(vs
, VNC_FEATURE_RESIZE
)) {
489 if (vs
->client_width
== ds_get_width(ds
) &&
490 vs
->client_height
== ds_get_height(ds
)) {
493 vs
->client_width
= ds_get_width(ds
);
494 vs
->client_height
= ds_get_height(ds
);
496 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
498 vnc_write_u16(vs
, 1); /* number of rects */
499 vnc_framebuffer_update(vs
, 0, 0, vs
->client_width
, vs
->client_height
,
500 VNC_ENCODING_DESKTOPRESIZE
);
501 vnc_unlock_output(vs
);
505 #ifdef CONFIG_VNC_THREAD
506 static void vnc_abort_display_jobs(VncDisplay
*vd
)
510 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
513 vnc_unlock_output(vs
);
515 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
518 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
521 vnc_unlock_output(vs
);
525 static void vnc_abort_display_jobs(VncDisplay
*vd
)
530 static void vnc_dpy_resize(DisplayState
*ds
)
532 VncDisplay
*vd
= ds
->opaque
;
535 vnc_abort_display_jobs(vd
);
539 vd
->server
= g_malloc0(sizeof(*vd
->server
));
540 if (vd
->server
->data
)
541 g_free(vd
->server
->data
);
542 *(vd
->server
) = *(ds
->surface
);
543 vd
->server
->data
= g_malloc0(vd
->server
->linesize
*
548 vd
->guest
.ds
= g_malloc0(sizeof(*vd
->guest
.ds
));
549 if (ds_get_bytes_per_pixel(ds
) != vd
->guest
.ds
->pf
.bytes_per_pixel
)
550 console_color_init(ds
);
551 *(vd
->guest
.ds
) = *(ds
->surface
);
552 memset(vd
->guest
.dirty
, 0xFF, sizeof(vd
->guest
.dirty
));
554 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
556 vnc_desktop_resize(vs
);
557 if (vs
->vd
->cursor
) {
558 vnc_cursor_define(vs
);
560 memset(vs
->dirty
, 0xFF, sizeof(vs
->dirty
));
565 static void vnc_write_pixels_copy(VncState
*vs
, struct PixelFormat
*pf
,
566 void *pixels
, int size
)
568 vnc_write(vs
, pixels
, size
);
571 /* slowest but generic code. */
572 void vnc_convert_pixel(VncState
*vs
, uint8_t *buf
, uint32_t v
)
575 VncDisplay
*vd
= vs
->vd
;
577 r
= ((((v
& vd
->server
->pf
.rmask
) >> vd
->server
->pf
.rshift
) << vs
->clientds
.pf
.rbits
) >>
578 vd
->server
->pf
.rbits
);
579 g
= ((((v
& vd
->server
->pf
.gmask
) >> vd
->server
->pf
.gshift
) << vs
->clientds
.pf
.gbits
) >>
580 vd
->server
->pf
.gbits
);
581 b
= ((((v
& vd
->server
->pf
.bmask
) >> vd
->server
->pf
.bshift
) << vs
->clientds
.pf
.bbits
) >>
582 vd
->server
->pf
.bbits
);
583 v
= (r
<< vs
->clientds
.pf
.rshift
) |
584 (g
<< vs
->clientds
.pf
.gshift
) |
585 (b
<< vs
->clientds
.pf
.bshift
);
586 switch(vs
->clientds
.pf
.bytes_per_pixel
) {
591 if (vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) {
601 if (vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) {
616 static void vnc_write_pixels_generic(VncState
*vs
, struct PixelFormat
*pf
,
617 void *pixels1
, int size
)
621 if (pf
->bytes_per_pixel
== 4) {
622 uint32_t *pixels
= pixels1
;
625 for(i
= 0; i
< n
; i
++) {
626 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
627 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
629 } else if (pf
->bytes_per_pixel
== 2) {
630 uint16_t *pixels
= pixels1
;
633 for(i
= 0; i
< n
; i
++) {
634 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
635 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
637 } else if (pf
->bytes_per_pixel
== 1) {
638 uint8_t *pixels
= pixels1
;
641 for(i
= 0; i
< n
; i
++) {
642 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
643 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
646 fprintf(stderr
, "vnc_write_pixels_generic: VncState color depth not supported\n");
650 int vnc_raw_send_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
)
654 VncDisplay
*vd
= vs
->vd
;
656 row
= vd
->server
->data
+ y
* ds_get_linesize(vs
->ds
) + x
* ds_get_bytes_per_pixel(vs
->ds
);
657 for (i
= 0; i
< h
; i
++) {
658 vs
->write_pixels(vs
, &vd
->server
->pf
, row
, w
* ds_get_bytes_per_pixel(vs
->ds
));
659 row
+= ds_get_linesize(vs
->ds
);
664 int vnc_send_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
)
668 switch(vs
->vnc_encoding
) {
669 case VNC_ENCODING_ZLIB
:
670 n
= vnc_zlib_send_framebuffer_update(vs
, x
, y
, w
, h
);
672 case VNC_ENCODING_HEXTILE
:
673 vnc_framebuffer_update(vs
, x
, y
, w
, h
, VNC_ENCODING_HEXTILE
);
674 n
= vnc_hextile_send_framebuffer_update(vs
, x
, y
, w
, h
);
676 case VNC_ENCODING_TIGHT
:
677 n
= vnc_tight_send_framebuffer_update(vs
, x
, y
, w
, h
);
679 case VNC_ENCODING_TIGHT_PNG
:
680 n
= vnc_tight_png_send_framebuffer_update(vs
, x
, y
, w
, h
);
682 case VNC_ENCODING_ZRLE
:
683 n
= vnc_zrle_send_framebuffer_update(vs
, x
, y
, w
, h
);
685 case VNC_ENCODING_ZYWRLE
:
686 n
= vnc_zywrle_send_framebuffer_update(vs
, x
, y
, w
, h
);
689 vnc_framebuffer_update(vs
, x
, y
, w
, h
, VNC_ENCODING_RAW
);
690 n
= vnc_raw_send_framebuffer_update(vs
, x
, y
, w
, h
);
696 static void vnc_copy(VncState
*vs
, int src_x
, int src_y
, int dst_x
, int dst_y
, int w
, int h
)
698 /* send bitblit op to the vnc client */
700 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
702 vnc_write_u16(vs
, 1); /* number of rects */
703 vnc_framebuffer_update(vs
, dst_x
, dst_y
, w
, h
, VNC_ENCODING_COPYRECT
);
704 vnc_write_u16(vs
, src_x
);
705 vnc_write_u16(vs
, src_y
);
706 vnc_unlock_output(vs
);
710 static void vnc_dpy_copy(DisplayState
*ds
, int src_x
, int src_y
, int dst_x
, int dst_y
, int w
, int h
)
712 VncDisplay
*vd
= ds
->opaque
;
716 int i
,x
,y
,pitch
,depth
,inc
,w_lim
,s
;
719 vnc_refresh_server_surface(vd
);
720 QTAILQ_FOREACH_SAFE(vs
, &vd
->clients
, next
, vn
) {
721 if (vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
722 vs
->force_update
= 1;
723 vnc_update_client_sync(vs
, 1);
724 /* vs might be free()ed here */
728 /* do bitblit op on the local surface too */
729 pitch
= ds_get_linesize(vd
->ds
);
730 depth
= ds_get_bytes_per_pixel(vd
->ds
);
731 src_row
= vd
->server
->data
+ pitch
* src_y
+ depth
* src_x
;
732 dst_row
= vd
->server
->data
+ pitch
* dst_y
+ depth
* dst_x
;
737 src_row
+= pitch
* (h
-1);
738 dst_row
+= pitch
* (h
-1);
743 w_lim
= w
- (16 - (dst_x
% 16));
747 w_lim
= w
- (w_lim
% 16);
748 for (i
= 0; i
< h
; i
++) {
749 for (x
= 0; x
<= w_lim
;
750 x
+= s
, src_row
+= cmp_bytes
, dst_row
+= cmp_bytes
) {
752 if ((s
= w
- w_lim
) == 0)
755 s
= (16 - (dst_x
% 16));
760 cmp_bytes
= s
* depth
;
761 if (memcmp(src_row
, dst_row
, cmp_bytes
) == 0)
763 memmove(dst_row
, src_row
, cmp_bytes
);
764 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
765 if (!vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
766 set_bit(((x
+ dst_x
) / 16), vs
->dirty
[y
]);
770 src_row
+= pitch
- w
* depth
;
771 dst_row
+= pitch
- w
* depth
;
775 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
776 if (vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
777 vnc_copy(vs
, src_x
, src_y
, dst_x
, dst_y
, w
, h
);
782 static void vnc_mouse_set(int x
, int y
, int visible
)
784 /* can we ask the client(s) to move the pointer ??? */
787 static int vnc_cursor_define(VncState
*vs
)
789 QEMUCursor
*c
= vs
->vd
->cursor
;
790 PixelFormat pf
= qemu_default_pixelformat(32);
793 if (vnc_has_feature(vs
, VNC_FEATURE_RICH_CURSOR
)) {
795 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
796 vnc_write_u8(vs
, 0); /* padding */
797 vnc_write_u16(vs
, 1); /* # of rects */
798 vnc_framebuffer_update(vs
, c
->hot_x
, c
->hot_y
, c
->width
, c
->height
,
799 VNC_ENCODING_RICH_CURSOR
);
800 isize
= c
->width
* c
->height
* vs
->clientds
.pf
.bytes_per_pixel
;
801 vnc_write_pixels_generic(vs
, &pf
, c
->data
, isize
);
802 vnc_write(vs
, vs
->vd
->cursor_mask
, vs
->vd
->cursor_msize
);
803 vnc_unlock_output(vs
);
809 static void vnc_dpy_cursor_define(QEMUCursor
*c
)
811 VncDisplay
*vd
= vnc_display
;
814 cursor_put(vd
->cursor
);
815 g_free(vd
->cursor_mask
);
818 cursor_get(vd
->cursor
);
819 vd
->cursor_msize
= cursor_get_mono_bpl(c
) * c
->height
;
820 vd
->cursor_mask
= g_malloc0(vd
->cursor_msize
);
821 cursor_get_mono_mask(c
, 0, vd
->cursor_mask
);
823 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
824 vnc_cursor_define(vs
);
828 static int find_and_clear_dirty_height(struct VncState
*vs
,
829 int y
, int last_x
, int x
, int height
)
833 for (h
= 1; h
< (height
- y
); h
++) {
835 if (!test_bit(last_x
, vs
->dirty
[y
+ h
])) {
838 for (tmp_x
= last_x
; tmp_x
< x
; tmp_x
++) {
839 clear_bit(tmp_x
, vs
->dirty
[y
+ h
]);
846 #ifdef CONFIG_VNC_THREAD
847 static int vnc_update_client_sync(VncState
*vs
, int has_dirty
)
849 int ret
= vnc_update_client(vs
, has_dirty
);
854 static int vnc_update_client_sync(VncState
*vs
, int has_dirty
)
856 return vnc_update_client(vs
, has_dirty
);
860 static int vnc_update_client(VncState
*vs
, int has_dirty
)
862 if (vs
->need_update
&& vs
->csock
!= -1) {
863 VncDisplay
*vd
= vs
->vd
;
870 if (vs
->output
.offset
&& !vs
->audio_cap
&& !vs
->force_update
)
871 /* kernel send buffers are full -> drop frames to throttle */
874 if (!has_dirty
&& !vs
->audio_cap
&& !vs
->force_update
)
878 * Send screen updates to the vnc client using the server
879 * surface and server dirty map. guest surface updates
880 * happening in parallel don't disturb us, the next pass will
881 * send them to the client.
883 job
= vnc_job_new(vs
);
885 width
= MIN(vd
->server
->width
, vs
->client_width
);
886 height
= MIN(vd
->server
->height
, vs
->client_height
);
888 for (y
= 0; y
< height
; y
++) {
891 for (x
= 0; x
< width
/ 16; x
++) {
892 if (test_and_clear_bit(x
, vs
->dirty
[y
])) {
898 int h
= find_and_clear_dirty_height(vs
, y
, last_x
, x
,
901 n
+= vnc_job_add_rect(job
, last_x
* 16, y
,
902 (x
- last_x
) * 16, h
);
908 int h
= find_and_clear_dirty_height(vs
, y
, last_x
, x
, height
);
909 n
+= vnc_job_add_rect(job
, last_x
* 16, y
,
910 (x
- last_x
) * 16, h
);
915 vs
->force_update
= 0;
920 vnc_disconnect_finish(vs
);
926 static void audio_capture_notify(void *opaque
, audcnotification_e cmd
)
928 VncState
*vs
= opaque
;
931 case AUD_CNOTIFY_DISABLE
:
933 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
934 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
935 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_END
);
936 vnc_unlock_output(vs
);
940 case AUD_CNOTIFY_ENABLE
:
942 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
943 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
944 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN
);
945 vnc_unlock_output(vs
);
951 static void audio_capture_destroy(void *opaque
)
955 static void audio_capture(void *opaque
, void *buf
, int size
)
957 VncState
*vs
= opaque
;
960 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
961 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
962 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_DATA
);
963 vnc_write_u32(vs
, size
);
964 vnc_write(vs
, buf
, size
);
965 vnc_unlock_output(vs
);
969 static void audio_add(VncState
*vs
)
971 struct audio_capture_ops ops
;
974 monitor_printf(default_mon
, "audio already running\n");
978 ops
.notify
= audio_capture_notify
;
979 ops
.destroy
= audio_capture_destroy
;
980 ops
.capture
= audio_capture
;
982 vs
->audio_cap
= AUD_add_capture(&vs
->as
, &ops
, vs
);
983 if (!vs
->audio_cap
) {
984 monitor_printf(default_mon
, "Failed to add audio capture\n");
988 static void audio_del(VncState
*vs
)
991 AUD_del_capture(vs
->audio_cap
, vs
);
992 vs
->audio_cap
= NULL
;
996 static void vnc_disconnect_start(VncState
*vs
)
1000 qemu_set_fd_handler2(vs
->csock
, NULL
, NULL
, NULL
, NULL
);
1001 closesocket(vs
->csock
);
1005 static void vnc_disconnect_finish(VncState
*vs
)
1009 vnc_jobs_join(vs
); /* Wait encoding jobs */
1011 vnc_lock_output(vs
);
1012 vnc_qmp_event(vs
, QEVENT_VNC_DISCONNECTED
);
1014 buffer_free(&vs
->input
);
1015 buffer_free(&vs
->output
);
1017 qobject_decref(vs
->info
);
1020 vnc_tight_clear(vs
);
1023 #ifdef CONFIG_VNC_TLS
1024 vnc_tls_client_cleanup(vs
);
1025 #endif /* CONFIG_VNC_TLS */
1026 #ifdef CONFIG_VNC_SASL
1027 vnc_sasl_client_cleanup(vs
);
1028 #endif /* CONFIG_VNC_SASL */
1031 QTAILQ_REMOVE(&vs
->vd
->clients
, vs
, next
);
1033 if (QTAILQ_EMPTY(&vs
->vd
->clients
)) {
1037 qemu_remove_mouse_mode_change_notifier(&vs
->mouse_mode_notifier
);
1038 vnc_remove_timer(vs
->vd
);
1039 if (vs
->vd
->lock_key_sync
)
1040 qemu_remove_led_event_handler(vs
->led
);
1041 vnc_unlock_output(vs
);
1043 #ifdef CONFIG_VNC_THREAD
1044 qemu_mutex_destroy(&vs
->output_mutex
);
1046 for (i
= 0; i
< VNC_STAT_ROWS
; ++i
) {
1047 g_free(vs
->lossy_rect
[i
]);
1049 g_free(vs
->lossy_rect
);
1053 int vnc_client_io_error(VncState
*vs
, int ret
, int last_errno
)
1055 if (ret
== 0 || ret
== -1) {
1057 switch (last_errno
) {
1061 case WSAEWOULDBLOCK
:
1069 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1070 ret
, ret
< 0 ? last_errno
: 0);
1071 vnc_disconnect_start(vs
);
1079 void vnc_client_error(VncState
*vs
)
1081 VNC_DEBUG("Closing down client sock: protocol error\n");
1082 vnc_disconnect_start(vs
);
1087 * Called to write a chunk of data to the client socket. The data may
1088 * be the raw data, or may have already been encoded by SASL.
1089 * The data will be written either straight onto the socket, or
1090 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1092 * NB, it is theoretically possible to have 2 layers of encryption,
1093 * both SASL, and this TLS layer. It is highly unlikely in practice
1094 * though, since SASL encryption will typically be a no-op if TLS
1097 * Returns the number of bytes written, which may be less than
1098 * the requested 'datalen' if the socket would block. Returns
1099 * -1 on error, and disconnects the client socket.
1101 long vnc_client_write_buf(VncState
*vs
, const uint8_t *data
, size_t datalen
)
1104 #ifdef CONFIG_VNC_TLS
1105 if (vs
->tls
.session
) {
1106 ret
= gnutls_write(vs
->tls
.session
, data
, datalen
);
1108 if (ret
== GNUTLS_E_AGAIN
)
1115 #endif /* CONFIG_VNC_TLS */
1116 ret
= send(vs
->csock
, (const void *)data
, datalen
, 0);
1117 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data
, datalen
, ret
);
1118 return vnc_client_io_error(vs
, ret
, socket_error());
1123 * Called to write buffered data to the client socket, when not
1124 * using any SASL SSF encryption layers. Will write as much data
1125 * as possible without blocking. If all buffered data is written,
1126 * will switch the FD poll() handler back to read monitoring.
1128 * Returns the number of bytes written, which may be less than
1129 * the buffered output data if the socket would block. Returns
1130 * -1 on error, and disconnects the client socket.
1132 static long vnc_client_write_plain(VncState
*vs
)
1136 #ifdef CONFIG_VNC_SASL
1137 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1138 vs
->output
.buffer
, vs
->output
.capacity
, vs
->output
.offset
,
1139 vs
->sasl
.waitWriteSSF
);
1141 if (vs
->sasl
.conn
&&
1143 vs
->sasl
.waitWriteSSF
) {
1144 ret
= vnc_client_write_buf(vs
, vs
->output
.buffer
, vs
->sasl
.waitWriteSSF
);
1146 vs
->sasl
.waitWriteSSF
-= ret
;
1148 #endif /* CONFIG_VNC_SASL */
1149 ret
= vnc_client_write_buf(vs
, vs
->output
.buffer
, vs
->output
.offset
);
1153 memmove(vs
->output
.buffer
, vs
->output
.buffer
+ ret
, (vs
->output
.offset
- ret
));
1154 vs
->output
.offset
-= ret
;
1156 if (vs
->output
.offset
== 0) {
1157 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
1165 * First function called whenever there is data to be written to
1166 * the client socket. Will delegate actual work according to whether
1167 * SASL SSF layers are enabled (thus requiring encryption calls)
1169 static void vnc_client_write_locked(void *opaque
)
1171 VncState
*vs
= opaque
;
1173 #ifdef CONFIG_VNC_SASL
1174 if (vs
->sasl
.conn
&&
1176 !vs
->sasl
.waitWriteSSF
) {
1177 vnc_client_write_sasl(vs
);
1179 #endif /* CONFIG_VNC_SASL */
1180 vnc_client_write_plain(vs
);
1183 void vnc_client_write(void *opaque
)
1185 VncState
*vs
= opaque
;
1187 vnc_lock_output(vs
);
1188 if (vs
->output
.offset
) {
1189 vnc_client_write_locked(opaque
);
1190 } else if (vs
->csock
!= -1) {
1191 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
1193 vnc_unlock_output(vs
);
1196 void vnc_read_when(VncState
*vs
, VncReadEvent
*func
, size_t expecting
)
1198 vs
->read_handler
= func
;
1199 vs
->read_handler_expect
= expecting
;
1204 * Called to read a chunk of data from the client socket. The data may
1205 * be the raw data, or may need to be further decoded by SASL.
1206 * The data will be read either straight from to the socket, or
1207 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1209 * NB, it is theoretically possible to have 2 layers of encryption,
1210 * both SASL, and this TLS layer. It is highly unlikely in practice
1211 * though, since SASL encryption will typically be a no-op if TLS
1214 * Returns the number of bytes read, which may be less than
1215 * the requested 'datalen' if the socket would block. Returns
1216 * -1 on error, and disconnects the client socket.
1218 long vnc_client_read_buf(VncState
*vs
, uint8_t *data
, size_t datalen
)
1221 #ifdef CONFIG_VNC_TLS
1222 if (vs
->tls
.session
) {
1223 ret
= gnutls_read(vs
->tls
.session
, data
, datalen
);
1225 if (ret
== GNUTLS_E_AGAIN
)
1232 #endif /* CONFIG_VNC_TLS */
1233 ret
= qemu_recv(vs
->csock
, data
, datalen
, 0);
1234 VNC_DEBUG("Read wire %p %zd -> %ld\n", data
, datalen
, ret
);
1235 return vnc_client_io_error(vs
, ret
, socket_error());
1240 * Called to read data from the client socket to the input buffer,
1241 * when not using any SASL SSF encryption layers. Will read as much
1242 * data as possible without blocking.
1244 * Returns the number of bytes read. Returns -1 on error, and
1245 * disconnects the client socket.
1247 static long vnc_client_read_plain(VncState
*vs
)
1250 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1251 vs
->input
.buffer
, vs
->input
.capacity
, vs
->input
.offset
);
1252 buffer_reserve(&vs
->input
, 4096);
1253 ret
= vnc_client_read_buf(vs
, buffer_end(&vs
->input
), 4096);
1256 vs
->input
.offset
+= ret
;
1262 * First function called whenever there is more data to be read from
1263 * the client socket. Will delegate actual work according to whether
1264 * SASL SSF layers are enabled (thus requiring decryption calls)
1266 void vnc_client_read(void *opaque
)
1268 VncState
*vs
= opaque
;
1271 #ifdef CONFIG_VNC_SASL
1272 if (vs
->sasl
.conn
&& vs
->sasl
.runSSF
)
1273 ret
= vnc_client_read_sasl(vs
);
1275 #endif /* CONFIG_VNC_SASL */
1276 ret
= vnc_client_read_plain(vs
);
1278 if (vs
->csock
== -1)
1279 vnc_disconnect_finish(vs
);
1283 while (vs
->read_handler
&& vs
->input
.offset
>= vs
->read_handler_expect
) {
1284 size_t len
= vs
->read_handler_expect
;
1287 ret
= vs
->read_handler(vs
, vs
->input
.buffer
, len
);
1288 if (vs
->csock
== -1) {
1289 vnc_disconnect_finish(vs
);
1294 memmove(vs
->input
.buffer
, vs
->input
.buffer
+ len
, (vs
->input
.offset
- len
));
1295 vs
->input
.offset
-= len
;
1297 vs
->read_handler_expect
= ret
;
1302 void vnc_write(VncState
*vs
, const void *data
, size_t len
)
1304 buffer_reserve(&vs
->output
, len
);
1306 if (vs
->csock
!= -1 && buffer_empty(&vs
->output
)) {
1307 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, vnc_client_write
, vs
);
1310 buffer_append(&vs
->output
, data
, len
);
1313 void vnc_write_s32(VncState
*vs
, int32_t value
)
1315 vnc_write_u32(vs
, *(uint32_t *)&value
);
1318 void vnc_write_u32(VncState
*vs
, uint32_t value
)
1322 buf
[0] = (value
>> 24) & 0xFF;
1323 buf
[1] = (value
>> 16) & 0xFF;
1324 buf
[2] = (value
>> 8) & 0xFF;
1325 buf
[3] = value
& 0xFF;
1327 vnc_write(vs
, buf
, 4);
1330 void vnc_write_u16(VncState
*vs
, uint16_t value
)
1334 buf
[0] = (value
>> 8) & 0xFF;
1335 buf
[1] = value
& 0xFF;
1337 vnc_write(vs
, buf
, 2);
1340 void vnc_write_u8(VncState
*vs
, uint8_t value
)
1342 vnc_write(vs
, (char *)&value
, 1);
1345 void vnc_flush(VncState
*vs
)
1347 vnc_lock_output(vs
);
1348 if (vs
->csock
!= -1 && vs
->output
.offset
) {
1349 vnc_client_write_locked(vs
);
1351 vnc_unlock_output(vs
);
1354 uint8_t read_u8(uint8_t *data
, size_t offset
)
1356 return data
[offset
];
1359 uint16_t read_u16(uint8_t *data
, size_t offset
)
1361 return ((data
[offset
] & 0xFF) << 8) | (data
[offset
+ 1] & 0xFF);
1364 int32_t read_s32(uint8_t *data
, size_t offset
)
1366 return (int32_t)((data
[offset
] << 24) | (data
[offset
+ 1] << 16) |
1367 (data
[offset
+ 2] << 8) | data
[offset
+ 3]);
1370 uint32_t read_u32(uint8_t *data
, size_t offset
)
1372 return ((data
[offset
] << 24) | (data
[offset
+ 1] << 16) |
1373 (data
[offset
+ 2] << 8) | data
[offset
+ 3]);
1376 static void client_cut_text(VncState
*vs
, size_t len
, uint8_t *text
)
1380 static void check_pointer_type_change(Notifier
*notifier
, void *data
)
1382 VncState
*vs
= container_of(notifier
, VncState
, mouse_mode_notifier
);
1383 int absolute
= kbd_mouse_is_absolute();
1385 if (vnc_has_feature(vs
, VNC_FEATURE_POINTER_TYPE_CHANGE
) && vs
->absolute
!= absolute
) {
1386 vnc_lock_output(vs
);
1387 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1388 vnc_write_u8(vs
, 0);
1389 vnc_write_u16(vs
, 1);
1390 vnc_framebuffer_update(vs
, absolute
, 0,
1391 ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1392 VNC_ENCODING_POINTER_TYPE_CHANGE
);
1393 vnc_unlock_output(vs
);
1396 vs
->absolute
= absolute
;
1399 static void pointer_event(VncState
*vs
, int button_mask
, int x
, int y
)
1404 if (button_mask
& 0x01)
1405 buttons
|= MOUSE_EVENT_LBUTTON
;
1406 if (button_mask
& 0x02)
1407 buttons
|= MOUSE_EVENT_MBUTTON
;
1408 if (button_mask
& 0x04)
1409 buttons
|= MOUSE_EVENT_RBUTTON
;
1410 if (button_mask
& 0x08)
1412 if (button_mask
& 0x10)
1416 kbd_mouse_event(ds_get_width(vs
->ds
) > 1 ?
1417 x
* 0x7FFF / (ds_get_width(vs
->ds
) - 1) : 0x4000,
1418 ds_get_height(vs
->ds
) > 1 ?
1419 y
* 0x7FFF / (ds_get_height(vs
->ds
) - 1) : 0x4000,
1421 } else if (vnc_has_feature(vs
, VNC_FEATURE_POINTER_TYPE_CHANGE
)) {
1425 kbd_mouse_event(x
, y
, dz
, buttons
);
1427 if (vs
->last_x
!= -1)
1428 kbd_mouse_event(x
- vs
->last_x
,
1436 static void reset_keys(VncState
*vs
)
1439 for(i
= 0; i
< 256; i
++) {
1440 if (vs
->modifiers_state
[i
]) {
1441 if (i
& SCANCODE_GREY
)
1442 kbd_put_keycode(SCANCODE_EMUL0
);
1443 kbd_put_keycode(i
| SCANCODE_UP
);
1444 vs
->modifiers_state
[i
] = 0;
1449 static void press_key(VncState
*vs
, int keysym
)
1451 int keycode
= keysym2scancode(vs
->vd
->kbd_layout
, keysym
) & SCANCODE_KEYMASK
;
1452 if (keycode
& SCANCODE_GREY
)
1453 kbd_put_keycode(SCANCODE_EMUL0
);
1454 kbd_put_keycode(keycode
& SCANCODE_KEYCODEMASK
);
1455 if (keycode
& SCANCODE_GREY
)
1456 kbd_put_keycode(SCANCODE_EMUL0
);
1457 kbd_put_keycode(keycode
| SCANCODE_UP
);
1460 static void kbd_leds(void *opaque
, int ledstate
)
1462 VncState
*vs
= opaque
;
1465 caps
= ledstate
& QEMU_CAPS_LOCK_LED
? 1 : 0;
1466 num
= ledstate
& QEMU_NUM_LOCK_LED
? 1 : 0;
1468 if (vs
->modifiers_state
[0x3a] != caps
) {
1469 vs
->modifiers_state
[0x3a] = caps
;
1471 if (vs
->modifiers_state
[0x45] != num
) {
1472 vs
->modifiers_state
[0x45] = num
;
1476 static void do_key_event(VncState
*vs
, int down
, int keycode
, int sym
)
1478 /* QEMU console switch */
1480 case 0x2a: /* Left Shift */
1481 case 0x36: /* Right Shift */
1482 case 0x1d: /* Left CTRL */
1483 case 0x9d: /* Right CTRL */
1484 case 0x38: /* Left ALT */
1485 case 0xb8: /* Right ALT */
1487 vs
->modifiers_state
[keycode
] = 1;
1489 vs
->modifiers_state
[keycode
] = 0;
1491 case 0x02 ... 0x0a: /* '1' to '9' keys */
1492 if (down
&& vs
->modifiers_state
[0x1d] && vs
->modifiers_state
[0x38]) {
1493 /* Reset the modifiers sent to the current console */
1495 console_select(keycode
- 0x02);
1499 case 0x3a: /* CapsLock */
1500 case 0x45: /* NumLock */
1502 vs
->modifiers_state
[keycode
] ^= 1;
1506 if (down
&& vs
->vd
->lock_key_sync
&&
1507 keycode_is_keypad(vs
->vd
->kbd_layout
, keycode
)) {
1508 /* If the numlock state needs to change then simulate an additional
1509 keypress before sending this one. This will happen if the user
1510 toggles numlock away from the VNC window.
1512 if (keysym_is_numlock(vs
->vd
->kbd_layout
, sym
& 0xFFFF)) {
1513 if (!vs
->modifiers_state
[0x45]) {
1514 vs
->modifiers_state
[0x45] = 1;
1515 press_key(vs
, 0xff7f);
1518 if (vs
->modifiers_state
[0x45]) {
1519 vs
->modifiers_state
[0x45] = 0;
1520 press_key(vs
, 0xff7f);
1525 if (down
&& vs
->vd
->lock_key_sync
&&
1526 ((sym
>= 'A' && sym
<= 'Z') || (sym
>= 'a' && sym
<= 'z'))) {
1527 /* If the capslock state needs to change then simulate an additional
1528 keypress before sending this one. This will happen if the user
1529 toggles capslock away from the VNC window.
1531 int uppercase
= !!(sym
>= 'A' && sym
<= 'Z');
1532 int shift
= !!(vs
->modifiers_state
[0x2a] | vs
->modifiers_state
[0x36]);
1533 int capslock
= !!(vs
->modifiers_state
[0x3a]);
1535 if (uppercase
== shift
) {
1536 vs
->modifiers_state
[0x3a] = 0;
1537 press_key(vs
, 0xffe5);
1540 if (uppercase
!= shift
) {
1541 vs
->modifiers_state
[0x3a] = 1;
1542 press_key(vs
, 0xffe5);
1547 if (is_graphic_console()) {
1548 if (keycode
& SCANCODE_GREY
)
1549 kbd_put_keycode(SCANCODE_EMUL0
);
1551 kbd_put_keycode(keycode
& SCANCODE_KEYCODEMASK
);
1553 kbd_put_keycode(keycode
| SCANCODE_UP
);
1555 bool numlock
= vs
->modifiers_state
[0x45];
1556 bool control
= (vs
->modifiers_state
[0x1d] ||
1557 vs
->modifiers_state
[0x9d]);
1558 /* QEMU console emulation */
1561 case 0x2a: /* Left Shift */
1562 case 0x36: /* Right Shift */
1563 case 0x1d: /* Left CTRL */
1564 case 0x9d: /* Right CTRL */
1565 case 0x38: /* Left ALT */
1566 case 0xb8: /* Right ALT */
1569 kbd_put_keysym(QEMU_KEY_UP
);
1572 kbd_put_keysym(QEMU_KEY_DOWN
);
1575 kbd_put_keysym(QEMU_KEY_LEFT
);
1578 kbd_put_keysym(QEMU_KEY_RIGHT
);
1581 kbd_put_keysym(QEMU_KEY_DELETE
);
1584 kbd_put_keysym(QEMU_KEY_HOME
);
1587 kbd_put_keysym(QEMU_KEY_END
);
1590 kbd_put_keysym(QEMU_KEY_PAGEUP
);
1593 kbd_put_keysym(QEMU_KEY_PAGEDOWN
);
1597 kbd_put_keysym(numlock
? '7' : QEMU_KEY_HOME
);
1600 kbd_put_keysym(numlock
? '8' : QEMU_KEY_UP
);
1603 kbd_put_keysym(numlock
? '9' : QEMU_KEY_PAGEUP
);
1606 kbd_put_keysym(numlock
? '4' : QEMU_KEY_LEFT
);
1609 kbd_put_keysym('5');
1612 kbd_put_keysym(numlock
? '6' : QEMU_KEY_RIGHT
);
1615 kbd_put_keysym(numlock
? '1' : QEMU_KEY_END
);
1618 kbd_put_keysym(numlock
? '2' : QEMU_KEY_DOWN
);
1621 kbd_put_keysym(numlock
? '3' : QEMU_KEY_PAGEDOWN
);
1624 kbd_put_keysym('0');
1627 kbd_put_keysym(numlock
? '.' : QEMU_KEY_DELETE
);
1631 kbd_put_keysym('/');
1634 kbd_put_keysym('*');
1637 kbd_put_keysym('-');
1640 kbd_put_keysym('+');
1643 kbd_put_keysym('\n');
1648 kbd_put_keysym(sym
& 0x1f);
1650 kbd_put_keysym(sym
);
1658 static void key_event(VncState
*vs
, int down
, uint32_t sym
)
1663 if (lsym
>= 'A' && lsym
<= 'Z' && is_graphic_console()) {
1664 lsym
= lsym
- 'A' + 'a';
1667 keycode
= keysym2scancode(vs
->vd
->kbd_layout
, lsym
& 0xFFFF) & SCANCODE_KEYMASK
;
1668 do_key_event(vs
, down
, keycode
, sym
);
1671 static void ext_key_event(VncState
*vs
, int down
,
1672 uint32_t sym
, uint16_t keycode
)
1674 /* if the user specifies a keyboard layout, always use it */
1675 if (keyboard_layout
)
1676 key_event(vs
, down
, sym
);
1678 do_key_event(vs
, down
, keycode
, sym
);
1681 static void framebuffer_update_request(VncState
*vs
, int incremental
,
1682 int x_position
, int y_position
,
1686 const size_t width
= ds_get_width(vs
->ds
) / 16;
1688 if (y_position
> ds_get_height(vs
->ds
))
1689 y_position
= ds_get_height(vs
->ds
);
1690 if (y_position
+ h
>= ds_get_height(vs
->ds
))
1691 h
= ds_get_height(vs
->ds
) - y_position
;
1693 vs
->need_update
= 1;
1695 vs
->force_update
= 1;
1696 for (i
= 0; i
< h
; i
++) {
1697 bitmap_set(vs
->dirty
[y_position
+ i
], 0, width
);
1698 bitmap_clear(vs
->dirty
[y_position
+ i
], width
,
1699 VNC_DIRTY_BITS
- width
);
1704 static void send_ext_key_event_ack(VncState
*vs
)
1706 vnc_lock_output(vs
);
1707 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1708 vnc_write_u8(vs
, 0);
1709 vnc_write_u16(vs
, 1);
1710 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1711 VNC_ENCODING_EXT_KEY_EVENT
);
1712 vnc_unlock_output(vs
);
1716 static void send_ext_audio_ack(VncState
*vs
)
1718 vnc_lock_output(vs
);
1719 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1720 vnc_write_u8(vs
, 0);
1721 vnc_write_u16(vs
, 1);
1722 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1723 VNC_ENCODING_AUDIO
);
1724 vnc_unlock_output(vs
);
1728 static void set_encodings(VncState
*vs
, int32_t *encodings
, size_t n_encodings
)
1731 unsigned int enc
= 0;
1734 vs
->vnc_encoding
= 0;
1735 vs
->tight
.compression
= 9;
1736 vs
->tight
.quality
= -1; /* Lossless by default */
1740 * Start from the end because the encodings are sent in order of preference.
1741 * This way the preferred encoding (first encoding defined in the array)
1742 * will be set at the end of the loop.
1744 for (i
= n_encodings
- 1; i
>= 0; i
--) {
1747 case VNC_ENCODING_RAW
:
1748 vs
->vnc_encoding
= enc
;
1750 case VNC_ENCODING_COPYRECT
:
1751 vs
->features
|= VNC_FEATURE_COPYRECT_MASK
;
1753 case VNC_ENCODING_HEXTILE
:
1754 vs
->features
|= VNC_FEATURE_HEXTILE_MASK
;
1755 vs
->vnc_encoding
= enc
;
1757 case VNC_ENCODING_TIGHT
:
1758 vs
->features
|= VNC_FEATURE_TIGHT_MASK
;
1759 vs
->vnc_encoding
= enc
;
1761 case VNC_ENCODING_TIGHT_PNG
:
1762 vs
->features
|= VNC_FEATURE_TIGHT_PNG_MASK
;
1763 vs
->vnc_encoding
= enc
;
1765 case VNC_ENCODING_ZLIB
:
1766 vs
->features
|= VNC_FEATURE_ZLIB_MASK
;
1767 vs
->vnc_encoding
= enc
;
1769 case VNC_ENCODING_ZRLE
:
1770 vs
->features
|= VNC_FEATURE_ZRLE_MASK
;
1771 vs
->vnc_encoding
= enc
;
1773 case VNC_ENCODING_ZYWRLE
:
1774 vs
->features
|= VNC_FEATURE_ZYWRLE_MASK
;
1775 vs
->vnc_encoding
= enc
;
1777 case VNC_ENCODING_DESKTOPRESIZE
:
1778 vs
->features
|= VNC_FEATURE_RESIZE_MASK
;
1780 case VNC_ENCODING_POINTER_TYPE_CHANGE
:
1781 vs
->features
|= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK
;
1783 case VNC_ENCODING_RICH_CURSOR
:
1784 vs
->features
|= VNC_FEATURE_RICH_CURSOR_MASK
;
1786 case VNC_ENCODING_EXT_KEY_EVENT
:
1787 send_ext_key_event_ack(vs
);
1789 case VNC_ENCODING_AUDIO
:
1790 send_ext_audio_ack(vs
);
1792 case VNC_ENCODING_WMVi
:
1793 vs
->features
|= VNC_FEATURE_WMVI_MASK
;
1795 case VNC_ENCODING_COMPRESSLEVEL0
... VNC_ENCODING_COMPRESSLEVEL0
+ 9:
1796 vs
->tight
.compression
= (enc
& 0x0F);
1798 case VNC_ENCODING_QUALITYLEVEL0
... VNC_ENCODING_QUALITYLEVEL0
+ 9:
1799 if (vs
->vd
->lossy
) {
1800 vs
->tight
.quality
= (enc
& 0x0F);
1804 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i
, enc
, enc
);
1808 vnc_desktop_resize(vs
);
1809 check_pointer_type_change(&vs
->mouse_mode_notifier
, NULL
);
1812 static void set_pixel_conversion(VncState
*vs
)
1814 if ((vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) ==
1815 (vs
->ds
->surface
->flags
& QEMU_BIG_ENDIAN_FLAG
) &&
1816 !memcmp(&(vs
->clientds
.pf
), &(vs
->ds
->surface
->pf
), sizeof(PixelFormat
))) {
1817 vs
->write_pixels
= vnc_write_pixels_copy
;
1818 vnc_hextile_set_pixel_conversion(vs
, 0);
1820 vs
->write_pixels
= vnc_write_pixels_generic
;
1821 vnc_hextile_set_pixel_conversion(vs
, 1);
1825 static void set_pixel_format(VncState
*vs
,
1826 int bits_per_pixel
, int depth
,
1827 int big_endian_flag
, int true_color_flag
,
1828 int red_max
, int green_max
, int blue_max
,
1829 int red_shift
, int green_shift
, int blue_shift
)
1831 if (!true_color_flag
) {
1832 vnc_client_error(vs
);
1836 vs
->clientds
= *(vs
->vd
->guest
.ds
);
1837 vs
->clientds
.pf
.rmax
= red_max
;
1838 vs
->clientds
.pf
.rbits
= hweight_long(red_max
);
1839 vs
->clientds
.pf
.rshift
= red_shift
;
1840 vs
->clientds
.pf
.rmask
= red_max
<< red_shift
;
1841 vs
->clientds
.pf
.gmax
= green_max
;
1842 vs
->clientds
.pf
.gbits
= hweight_long(green_max
);
1843 vs
->clientds
.pf
.gshift
= green_shift
;
1844 vs
->clientds
.pf
.gmask
= green_max
<< green_shift
;
1845 vs
->clientds
.pf
.bmax
= blue_max
;
1846 vs
->clientds
.pf
.bbits
= hweight_long(blue_max
);
1847 vs
->clientds
.pf
.bshift
= blue_shift
;
1848 vs
->clientds
.pf
.bmask
= blue_max
<< blue_shift
;
1849 vs
->clientds
.pf
.bits_per_pixel
= bits_per_pixel
;
1850 vs
->clientds
.pf
.bytes_per_pixel
= bits_per_pixel
/ 8;
1851 vs
->clientds
.pf
.depth
= bits_per_pixel
== 32 ? 24 : bits_per_pixel
;
1852 vs
->clientds
.flags
= big_endian_flag
? QEMU_BIG_ENDIAN_FLAG
: 0x00;
1854 set_pixel_conversion(vs
);
1856 vga_hw_invalidate();
1860 static void pixel_format_message (VncState
*vs
) {
1861 char pad
[3] = { 0, 0, 0 };
1863 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.bits_per_pixel
); /* bits-per-pixel */
1864 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.depth
); /* depth */
1866 #ifdef HOST_WORDS_BIGENDIAN
1867 vnc_write_u8(vs
, 1); /* big-endian-flag */
1869 vnc_write_u8(vs
, 0); /* big-endian-flag */
1871 vnc_write_u8(vs
, 1); /* true-color-flag */
1872 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.rmax
); /* red-max */
1873 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.gmax
); /* green-max */
1874 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.bmax
); /* blue-max */
1875 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.rshift
); /* red-shift */
1876 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.gshift
); /* green-shift */
1877 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.bshift
); /* blue-shift */
1879 vnc_hextile_set_pixel_conversion(vs
, 0);
1881 vs
->clientds
= *(vs
->ds
->surface
);
1882 vs
->clientds
.flags
&= ~QEMU_ALLOCATED_FLAG
;
1883 vs
->write_pixels
= vnc_write_pixels_copy
;
1885 vnc_write(vs
, pad
, 3); /* padding */
1888 static void vnc_dpy_setdata(DisplayState
*ds
)
1890 /* We don't have to do anything */
1893 static void vnc_colordepth(VncState
*vs
)
1895 if (vnc_has_feature(vs
, VNC_FEATURE_WMVI
)) {
1896 /* Sending a WMVi message to notify the client*/
1897 vnc_lock_output(vs
);
1898 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1899 vnc_write_u8(vs
, 0);
1900 vnc_write_u16(vs
, 1); /* number of rects */
1901 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
),
1902 ds_get_height(vs
->ds
), VNC_ENCODING_WMVi
);
1903 pixel_format_message(vs
);
1904 vnc_unlock_output(vs
);
1907 set_pixel_conversion(vs
);
1911 static int protocol_client_msg(VncState
*vs
, uint8_t *data
, size_t len
)
1915 VncDisplay
*vd
= vs
->vd
;
1918 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
1919 if (!qemu_timer_expired(vd
->timer
, qemu_get_clock_ms(rt_clock
) + vd
->timer_interval
))
1920 qemu_mod_timer(vd
->timer
, qemu_get_clock_ms(rt_clock
) + vd
->timer_interval
);
1924 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT
:
1928 set_pixel_format(vs
, read_u8(data
, 4), read_u8(data
, 5),
1929 read_u8(data
, 6), read_u8(data
, 7),
1930 read_u16(data
, 8), read_u16(data
, 10),
1931 read_u16(data
, 12), read_u8(data
, 14),
1932 read_u8(data
, 15), read_u8(data
, 16));
1934 case VNC_MSG_CLIENT_SET_ENCODINGS
:
1939 limit
= read_u16(data
, 2);
1941 return 4 + (limit
* 4);
1943 limit
= read_u16(data
, 2);
1945 for (i
= 0; i
< limit
; i
++) {
1946 int32_t val
= read_s32(data
, 4 + (i
* 4));
1947 memcpy(data
+ 4 + (i
* 4), &val
, sizeof(val
));
1950 set_encodings(vs
, (int32_t *)(data
+ 4), limit
);
1952 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST
:
1956 framebuffer_update_request(vs
,
1957 read_u8(data
, 1), read_u16(data
, 2), read_u16(data
, 4),
1958 read_u16(data
, 6), read_u16(data
, 8));
1960 case VNC_MSG_CLIENT_KEY_EVENT
:
1964 key_event(vs
, read_u8(data
, 1), read_u32(data
, 4));
1966 case VNC_MSG_CLIENT_POINTER_EVENT
:
1970 pointer_event(vs
, read_u8(data
, 1), read_u16(data
, 2), read_u16(data
, 4));
1972 case VNC_MSG_CLIENT_CUT_TEXT
:
1977 uint32_t dlen
= read_u32(data
, 4);
1982 client_cut_text(vs
, read_u32(data
, 4), data
+ 8);
1984 case VNC_MSG_CLIENT_QEMU
:
1988 switch (read_u8(data
, 1)) {
1989 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT
:
1993 ext_key_event(vs
, read_u16(data
, 2),
1994 read_u32(data
, 4), read_u32(data
, 8));
1996 case VNC_MSG_CLIENT_QEMU_AUDIO
:
2000 switch (read_u16 (data
, 2)) {
2001 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE
:
2004 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE
:
2007 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT
:
2010 switch (read_u8(data
, 4)) {
2011 case 0: vs
->as
.fmt
= AUD_FMT_U8
; break;
2012 case 1: vs
->as
.fmt
= AUD_FMT_S8
; break;
2013 case 2: vs
->as
.fmt
= AUD_FMT_U16
; break;
2014 case 3: vs
->as
.fmt
= AUD_FMT_S16
; break;
2015 case 4: vs
->as
.fmt
= AUD_FMT_U32
; break;
2016 case 5: vs
->as
.fmt
= AUD_FMT_S32
; break;
2018 printf("Invalid audio format %d\n", read_u8(data
, 4));
2019 vnc_client_error(vs
);
2022 vs
->as
.nchannels
= read_u8(data
, 5);
2023 if (vs
->as
.nchannels
!= 1 && vs
->as
.nchannels
!= 2) {
2024 printf("Invalid audio channel coount %d\n",
2026 vnc_client_error(vs
);
2029 vs
->as
.freq
= read_u32(data
, 6);
2032 printf ("Invalid audio message %d\n", read_u8(data
, 4));
2033 vnc_client_error(vs
);
2039 printf("Msg: %d\n", read_u16(data
, 0));
2040 vnc_client_error(vs
);
2045 printf("Msg: %d\n", data
[0]);
2046 vnc_client_error(vs
);
2050 vnc_read_when(vs
, protocol_client_msg
, 1);
2054 static int protocol_client_init(VncState
*vs
, uint8_t *data
, size_t len
)
2059 vs
->client_width
= ds_get_width(vs
->ds
);
2060 vs
->client_height
= ds_get_height(vs
->ds
);
2061 vnc_write_u16(vs
, vs
->client_width
);
2062 vnc_write_u16(vs
, vs
->client_height
);
2064 pixel_format_message(vs
);
2067 size
= snprintf(buf
, sizeof(buf
), "QEMU (%s)", qemu_name
);
2069 size
= snprintf(buf
, sizeof(buf
), "QEMU");
2071 vnc_write_u32(vs
, size
);
2072 vnc_write(vs
, buf
, size
);
2075 vnc_client_cache_auth(vs
);
2076 vnc_qmp_event(vs
, QEVENT_VNC_INITIALIZED
);
2078 vnc_read_when(vs
, protocol_client_msg
, 1);
2083 void start_client_init(VncState
*vs
)
2085 vnc_read_when(vs
, protocol_client_init
, 1);
2088 static void make_challenge(VncState
*vs
)
2092 srand(time(NULL
)+getpid()+getpid()*987654+rand());
2094 for (i
= 0 ; i
< sizeof(vs
->challenge
) ; i
++)
2095 vs
->challenge
[i
] = (int) (256.0*rand()/(RAND_MAX
+1.0));
2098 static int protocol_client_auth_vnc(VncState
*vs
, uint8_t *data
, size_t len
)
2100 unsigned char response
[VNC_AUTH_CHALLENGE_SIZE
];
2102 unsigned char key
[8];
2103 time_t now
= time(NULL
);
2105 if (!vs
->vd
->password
) {
2106 VNC_DEBUG("No password configured on server");
2109 if (vs
->vd
->expires
< now
) {
2110 VNC_DEBUG("Password is expired");
2114 memcpy(response
, vs
->challenge
, VNC_AUTH_CHALLENGE_SIZE
);
2116 /* Calculate the expected challenge response */
2117 pwlen
= strlen(vs
->vd
->password
);
2118 for (i
=0; i
<sizeof(key
); i
++)
2119 key
[i
] = i
<pwlen
? vs
->vd
->password
[i
] : 0;
2121 for (j
= 0; j
< VNC_AUTH_CHALLENGE_SIZE
; j
+= 8)
2122 des(response
+j
, response
+j
);
2124 /* Compare expected vs actual challenge response */
2125 if (memcmp(response
, data
, VNC_AUTH_CHALLENGE_SIZE
) != 0) {
2126 VNC_DEBUG("Client challenge response did not match\n");
2129 VNC_DEBUG("Accepting VNC challenge response\n");
2130 vnc_write_u32(vs
, 0); /* Accept auth */
2133 start_client_init(vs
);
2138 vnc_write_u32(vs
, 1); /* Reject auth */
2139 if (vs
->minor
>= 8) {
2140 static const char err
[] = "Authentication failed";
2141 vnc_write_u32(vs
, sizeof(err
));
2142 vnc_write(vs
, err
, sizeof(err
));
2145 vnc_client_error(vs
);
2149 void start_auth_vnc(VncState
*vs
)
2152 /* Send client a 'random' challenge */
2153 vnc_write(vs
, vs
->challenge
, sizeof(vs
->challenge
));
2156 vnc_read_when(vs
, protocol_client_auth_vnc
, sizeof(vs
->challenge
));
2160 static int protocol_client_auth(VncState
*vs
, uint8_t *data
, size_t len
)
2162 /* We only advertise 1 auth scheme at a time, so client
2163 * must pick the one we sent. Verify this */
2164 if (data
[0] != vs
->auth
) { /* Reject auth */
2165 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data
[0]);
2166 vnc_write_u32(vs
, 1);
2167 if (vs
->minor
>= 8) {
2168 static const char err
[] = "Authentication failed";
2169 vnc_write_u32(vs
, sizeof(err
));
2170 vnc_write(vs
, err
, sizeof(err
));
2172 vnc_client_error(vs
);
2173 } else { /* Accept requested auth */
2174 VNC_DEBUG("Client requested auth %d\n", (int)data
[0]);
2177 VNC_DEBUG("Accept auth none\n");
2178 if (vs
->minor
>= 8) {
2179 vnc_write_u32(vs
, 0); /* Accept auth completion */
2182 start_client_init(vs
);
2186 VNC_DEBUG("Start VNC auth\n");
2190 #ifdef CONFIG_VNC_TLS
2191 case VNC_AUTH_VENCRYPT
:
2192 VNC_DEBUG("Accept VeNCrypt auth\n");
2193 start_auth_vencrypt(vs
);
2195 #endif /* CONFIG_VNC_TLS */
2197 #ifdef CONFIG_VNC_SASL
2199 VNC_DEBUG("Accept SASL auth\n");
2200 start_auth_sasl(vs
);
2202 #endif /* CONFIG_VNC_SASL */
2204 default: /* Should not be possible, but just in case */
2205 VNC_DEBUG("Reject auth %d server code bug\n", vs
->auth
);
2206 vnc_write_u8(vs
, 1);
2207 if (vs
->minor
>= 8) {
2208 static const char err
[] = "Authentication failed";
2209 vnc_write_u32(vs
, sizeof(err
));
2210 vnc_write(vs
, err
, sizeof(err
));
2212 vnc_client_error(vs
);
2218 static int protocol_version(VncState
*vs
, uint8_t *version
, size_t len
)
2222 memcpy(local
, version
, 12);
2225 if (sscanf(local
, "RFB %03d.%03d\n", &vs
->major
, &vs
->minor
) != 2) {
2226 VNC_DEBUG("Malformed protocol version %s\n", local
);
2227 vnc_client_error(vs
);
2230 VNC_DEBUG("Client request protocol version %d.%d\n", vs
->major
, vs
->minor
);
2231 if (vs
->major
!= 3 ||
2237 VNC_DEBUG("Unsupported client version\n");
2238 vnc_write_u32(vs
, VNC_AUTH_INVALID
);
2240 vnc_client_error(vs
);
2243 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2244 * as equivalent to v3.3 by servers
2246 if (vs
->minor
== 4 || vs
->minor
== 5)
2249 if (vs
->minor
== 3) {
2250 if (vs
->auth
== VNC_AUTH_NONE
) {
2251 VNC_DEBUG("Tell client auth none\n");
2252 vnc_write_u32(vs
, vs
->auth
);
2254 start_client_init(vs
);
2255 } else if (vs
->auth
== VNC_AUTH_VNC
) {
2256 VNC_DEBUG("Tell client VNC auth\n");
2257 vnc_write_u32(vs
, vs
->auth
);
2261 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs
->auth
);
2262 vnc_write_u32(vs
, VNC_AUTH_INVALID
);
2264 vnc_client_error(vs
);
2267 VNC_DEBUG("Telling client we support auth %d\n", vs
->auth
);
2268 vnc_write_u8(vs
, 1); /* num auth */
2269 vnc_write_u8(vs
, vs
->auth
);
2270 vnc_read_when(vs
, protocol_client_auth
, 1);
2277 static VncRectStat
*vnc_stat_rect(VncDisplay
*vd
, int x
, int y
)
2279 struct VncSurface
*vs
= &vd
->guest
;
2281 return &vs
->stats
[y
/ VNC_STAT_RECT
][x
/ VNC_STAT_RECT
];
2284 void vnc_sent_lossy_rect(VncState
*vs
, int x
, int y
, int w
, int h
)
2288 w
= (x
+ w
) / VNC_STAT_RECT
;
2289 h
= (y
+ h
) / VNC_STAT_RECT
;
2293 for (j
= y
; j
<= h
; j
++) {
2294 for (i
= x
; i
<= w
; i
++) {
2295 vs
->lossy_rect
[j
][i
] = 1;
2300 static int vnc_refresh_lossy_rect(VncDisplay
*vd
, int x
, int y
)
2303 int sty
= y
/ VNC_STAT_RECT
;
2304 int stx
= x
/ VNC_STAT_RECT
;
2307 y
= y
/ VNC_STAT_RECT
* VNC_STAT_RECT
;
2308 x
= x
/ VNC_STAT_RECT
* VNC_STAT_RECT
;
2310 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
2313 /* kernel send buffers are full -> refresh later */
2314 if (vs
->output
.offset
) {
2318 if (!vs
->lossy_rect
[sty
][stx
]) {
2322 vs
->lossy_rect
[sty
][stx
] = 0;
2323 for (j
= 0; j
< VNC_STAT_RECT
; ++j
) {
2324 bitmap_set(vs
->dirty
[y
+ j
], x
/ 16, VNC_STAT_RECT
/ 16);
2332 static int vnc_update_stats(VncDisplay
*vd
, struct timeval
* tv
)
2338 for (y
= 0; y
< vd
->guest
.ds
->height
; y
+= VNC_STAT_RECT
) {
2339 for (x
= 0; x
< vd
->guest
.ds
->width
; x
+= VNC_STAT_RECT
) {
2340 VncRectStat
*rect
= vnc_stat_rect(vd
, x
, y
);
2342 rect
->updated
= false;
2346 qemu_timersub(tv
, &VNC_REFRESH_STATS
, &res
);
2348 if (timercmp(&vd
->guest
.last_freq_check
, &res
, >)) {
2351 vd
->guest
.last_freq_check
= *tv
;
2353 for (y
= 0; y
< vd
->guest
.ds
->height
; y
+= VNC_STAT_RECT
) {
2354 for (x
= 0; x
< vd
->guest
.ds
->width
; x
+= VNC_STAT_RECT
) {
2355 VncRectStat
*rect
= vnc_stat_rect(vd
, x
, y
);
2356 int count
= ARRAY_SIZE(rect
->times
);
2357 struct timeval min
, max
;
2359 if (!timerisset(&rect
->times
[count
- 1])) {
2363 max
= rect
->times
[(rect
->idx
+ count
- 1) % count
];
2364 qemu_timersub(tv
, &max
, &res
);
2366 if (timercmp(&res
, &VNC_REFRESH_LOSSY
, >)) {
2368 has_dirty
+= vnc_refresh_lossy_rect(vd
, x
, y
);
2369 memset(rect
->times
, 0, sizeof (rect
->times
));
2373 min
= rect
->times
[rect
->idx
];
2374 max
= rect
->times
[(rect
->idx
+ count
- 1) % count
];
2375 qemu_timersub(&max
, &min
, &res
);
2377 rect
->freq
= res
.tv_sec
+ res
.tv_usec
/ 1000000.;
2378 rect
->freq
/= count
;
2379 rect
->freq
= 1. / rect
->freq
;
2385 double vnc_update_freq(VncState
*vs
, int x
, int y
, int w
, int h
)
2391 x
= (x
/ VNC_STAT_RECT
) * VNC_STAT_RECT
;
2392 y
= (y
/ VNC_STAT_RECT
) * VNC_STAT_RECT
;
2394 for (j
= y
; j
<= y
+ h
; j
+= VNC_STAT_RECT
) {
2395 for (i
= x
; i
<= x
+ w
; i
+= VNC_STAT_RECT
) {
2396 total
+= vnc_stat_rect(vs
->vd
, i
, j
)->freq
;
2408 static void vnc_rect_updated(VncDisplay
*vd
, int x
, int y
, struct timeval
* tv
)
2412 rect
= vnc_stat_rect(vd
, x
, y
);
2413 if (rect
->updated
) {
2416 rect
->times
[rect
->idx
] = *tv
;
2417 rect
->idx
= (rect
->idx
+ 1) % ARRAY_SIZE(rect
->times
);
2418 rect
->updated
= true;
2421 static int vnc_refresh_server_surface(VncDisplay
*vd
)
2425 uint8_t *server_row
;
2430 struct timeval tv
= { 0, 0 };
2432 if (!vd
->non_adaptive
) {
2433 gettimeofday(&tv
, NULL
);
2434 has_dirty
= vnc_update_stats(vd
, &tv
);
2438 * Walk through the guest dirty map.
2439 * Check and copy modified bits from guest to server surface.
2440 * Update server dirty map.
2442 cmp_bytes
= 16 * ds_get_bytes_per_pixel(vd
->ds
);
2443 guest_row
= vd
->guest
.ds
->data
;
2444 server_row
= vd
->server
->data
;
2445 for (y
= 0; y
< vd
->guest
.ds
->height
; y
++) {
2446 if (!bitmap_empty(vd
->guest
.dirty
[y
], VNC_DIRTY_BITS
)) {
2449 uint8_t *server_ptr
;
2451 guest_ptr
= guest_row
;
2452 server_ptr
= server_row
;
2454 for (x
= 0; x
+ 15 < vd
->guest
.ds
->width
;
2455 x
+= 16, guest_ptr
+= cmp_bytes
, server_ptr
+= cmp_bytes
) {
2456 if (!test_and_clear_bit((x
/ 16), vd
->guest
.dirty
[y
]))
2458 if (memcmp(server_ptr
, guest_ptr
, cmp_bytes
) == 0)
2460 memcpy(server_ptr
, guest_ptr
, cmp_bytes
);
2461 if (!vd
->non_adaptive
)
2462 vnc_rect_updated(vd
, x
, y
, &tv
);
2463 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
2464 set_bit((x
/ 16), vs
->dirty
[y
]);
2469 guest_row
+= ds_get_linesize(vd
->ds
);
2470 server_row
+= ds_get_linesize(vd
->ds
);
2475 static void vnc_refresh(void *opaque
)
2477 VncDisplay
*vd
= opaque
;
2479 int has_dirty
, rects
= 0;
2483 if (vnc_trylock_display(vd
)) {
2484 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
2485 qemu_mod_timer(vd
->timer
, qemu_get_clock_ms(rt_clock
) +
2486 vd
->timer_interval
);
2490 has_dirty
= vnc_refresh_server_surface(vd
);
2491 vnc_unlock_display(vd
);
2493 QTAILQ_FOREACH_SAFE(vs
, &vd
->clients
, next
, vn
) {
2494 rects
+= vnc_update_client(vs
, has_dirty
);
2495 /* vs might be free()ed here */
2498 /* vd->timer could be NULL now if the last client disconnected,
2499 * in this case don't update the timer */
2500 if (vd
->timer
== NULL
)
2503 if (has_dirty
&& rects
) {
2504 vd
->timer_interval
/= 2;
2505 if (vd
->timer_interval
< VNC_REFRESH_INTERVAL_BASE
)
2506 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
2508 vd
->timer_interval
+= VNC_REFRESH_INTERVAL_INC
;
2509 if (vd
->timer_interval
> VNC_REFRESH_INTERVAL_MAX
)
2510 vd
->timer_interval
= VNC_REFRESH_INTERVAL_MAX
;
2512 qemu_mod_timer(vd
->timer
, qemu_get_clock_ms(rt_clock
) + vd
->timer_interval
);
2515 static void vnc_init_timer(VncDisplay
*vd
)
2517 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
2518 if (vd
->timer
== NULL
&& !QTAILQ_EMPTY(&vd
->clients
)) {
2519 vd
->timer
= qemu_new_timer_ms(rt_clock
, vnc_refresh
, vd
);
2520 vnc_dpy_resize(vd
->ds
);
2525 static void vnc_remove_timer(VncDisplay
*vd
)
2527 if (vd
->timer
!= NULL
&& QTAILQ_EMPTY(&vd
->clients
)) {
2528 qemu_del_timer(vd
->timer
);
2529 qemu_free_timer(vd
->timer
);
2534 static void vnc_connect(VncDisplay
*vd
, int csock
, int skipauth
)
2536 VncState
*vs
= g_malloc0(sizeof(VncState
));
2542 vs
->auth
= VNC_AUTH_NONE
;
2543 #ifdef CONFIG_VNC_TLS
2544 vs
->subauth
= VNC_AUTH_INVALID
;
2547 vs
->auth
= vd
->auth
;
2548 #ifdef CONFIG_VNC_TLS
2549 vs
->subauth
= vd
->subauth
;
2553 vs
->lossy_rect
= g_malloc0(VNC_STAT_ROWS
* sizeof (*vs
->lossy_rect
));
2554 for (i
= 0; i
< VNC_STAT_ROWS
; ++i
) {
2555 vs
->lossy_rect
[i
] = g_malloc0(VNC_STAT_COLS
* sizeof (uint8_t));
2558 VNC_DEBUG("New client on socket %d\n", csock
);
2560 socket_set_nonblock(vs
->csock
);
2561 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
2563 vnc_client_cache_addr(vs
);
2564 vnc_qmp_event(vs
, QEVENT_VNC_CONNECTED
);
2571 vs
->as
.freq
= 44100;
2572 vs
->as
.nchannels
= 2;
2573 vs
->as
.fmt
= AUD_FMT_S16
;
2574 vs
->as
.endianness
= 0;
2576 #ifdef CONFIG_VNC_THREAD
2577 qemu_mutex_init(&vs
->output_mutex
);
2580 QTAILQ_INSERT_HEAD(&vd
->clients
, vs
, next
);
2584 vnc_write(vs
, "RFB 003.008\n", 12);
2586 vnc_read_when(vs
, protocol_version
, 12);
2588 if (vs
->vd
->lock_key_sync
)
2589 vs
->led
= qemu_add_led_event_handler(kbd_leds
, vs
);
2591 vs
->mouse_mode_notifier
.notify
= check_pointer_type_change
;
2592 qemu_add_mouse_mode_change_notifier(&vs
->mouse_mode_notifier
);
2596 /* vs might be free()ed here */
2599 static void vnc_listen_read(void *opaque
)
2601 VncDisplay
*vs
= opaque
;
2602 struct sockaddr_in addr
;
2603 socklen_t addrlen
= sizeof(addr
);
2608 int csock
= qemu_accept(vs
->lsock
, (struct sockaddr
*)&addr
, &addrlen
);
2610 vnc_connect(vs
, csock
, 0);
2614 void vnc_display_init(DisplayState
*ds
)
2616 VncDisplay
*vs
= g_malloc0(sizeof(*vs
));
2618 dcl
= g_malloc0(sizeof(DisplayChangeListener
));
2627 QTAILQ_INIT(&vs
->clients
);
2628 vs
->expires
= TIME_MAX
;
2630 if (keyboard_layout
)
2631 vs
->kbd_layout
= init_keyboard_layout(name2keysym
, keyboard_layout
);
2633 vs
->kbd_layout
= init_keyboard_layout(name2keysym
, "en-us");
2635 if (!vs
->kbd_layout
)
2638 #ifdef CONFIG_VNC_THREAD
2639 qemu_mutex_init(&vs
->mutex
);
2640 vnc_start_worker_thread();
2643 dcl
->dpy_copy
= vnc_dpy_copy
;
2644 dcl
->dpy_update
= vnc_dpy_update
;
2645 dcl
->dpy_resize
= vnc_dpy_resize
;
2646 dcl
->dpy_setdata
= vnc_dpy_setdata
;
2647 register_displaychangelistener(ds
, dcl
);
2648 ds
->mouse_set
= vnc_mouse_set
;
2649 ds
->cursor_define
= vnc_dpy_cursor_define
;
2653 void vnc_display_close(DisplayState
*ds
)
2655 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2660 g_free(vs
->display
);
2663 if (vs
->lsock
!= -1) {
2664 qemu_set_fd_handler2(vs
->lsock
, NULL
, NULL
, NULL
, NULL
);
2668 vs
->auth
= VNC_AUTH_INVALID
;
2669 #ifdef CONFIG_VNC_TLS
2670 vs
->subauth
= VNC_AUTH_INVALID
;
2671 vs
->tls
.x509verify
= 0;
2675 int vnc_display_disable_login(DisplayState
*ds
)
2677 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2684 g_free(vs
->password
);
2687 vs
->password
= NULL
;
2688 vs
->auth
= VNC_AUTH_VNC
;
2693 int vnc_display_password(DisplayState
*ds
, const char *password
)
2695 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2702 /* This is not the intention of this interface but err on the side
2704 return vnc_display_disable_login(ds
);
2708 g_free(vs
->password
);
2709 vs
->password
= NULL
;
2711 vs
->password
= g_strdup(password
);
2712 vs
->auth
= VNC_AUTH_VNC
;
2717 int vnc_display_pw_expire(DisplayState
*ds
, time_t expires
)
2719 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2721 vs
->expires
= expires
;
2725 char *vnc_display_local_addr(DisplayState
*ds
)
2727 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2729 return vnc_socket_local_addr("%s:%s", vs
->lsock
);
2732 int vnc_display_open(DisplayState
*ds
, const char *display
)
2734 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2735 const char *options
;
2738 #ifdef CONFIG_VNC_TLS
2739 int tls
= 0, x509
= 0;
2741 #ifdef CONFIG_VNC_SASL
2745 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2748 int lock_key_sync
= 1;
2752 vnc_display_close(ds
);
2753 if (strcmp(display
, "none") == 0)
2756 if (!(vs
->display
= strdup(display
)))
2760 while ((options
= strchr(options
, ','))) {
2762 if (strncmp(options
, "password", 8) == 0) {
2763 password
= 1; /* Require password auth */
2764 } else if (strncmp(options
, "reverse", 7) == 0) {
2766 } else if (strncmp(options
, "no-lock-key-sync", 16) == 0) {
2768 #ifdef CONFIG_VNC_SASL
2769 } else if (strncmp(options
, "sasl", 4) == 0) {
2770 sasl
= 1; /* Require SASL auth */
2772 #ifdef CONFIG_VNC_TLS
2773 } else if (strncmp(options
, "tls", 3) == 0) {
2774 tls
= 1; /* Require TLS */
2775 } else if (strncmp(options
, "x509", 4) == 0) {
2777 x509
= 1; /* Require x509 certificates */
2778 if (strncmp(options
, "x509verify", 10) == 0)
2779 vs
->tls
.x509verify
= 1; /* ...and verify client certs */
2781 /* Now check for 'x509=/some/path' postfix
2782 * and use that to setup x509 certificate/key paths */
2783 start
= strchr(options
, '=');
2784 end
= strchr(options
, ',');
2785 if (start
&& (!end
|| (start
< end
))) {
2786 int len
= end
? end
-(start
+1) : strlen(start
+1);
2787 char *path
= g_strndup(start
+ 1, len
);
2789 VNC_DEBUG("Trying certificate path '%s'\n", path
);
2790 if (vnc_tls_set_x509_creds_dir(vs
, path
) < 0) {
2791 fprintf(stderr
, "Failed to find x509 certificates/keys in %s\n", path
);
2793 g_free(vs
->display
);
2799 fprintf(stderr
, "No certificate path provided\n");
2800 g_free(vs
->display
);
2805 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2806 } else if (strncmp(options
, "acl", 3) == 0) {
2809 } else if (strncmp(options
, "lossy", 5) == 0) {
2811 } else if (strncmp(options
, "non-adapative", 13) == 0) {
2812 vs
->non_adaptive
= true;
2816 #ifdef CONFIG_VNC_TLS
2817 if (acl
&& x509
&& vs
->tls
.x509verify
) {
2818 if (!(vs
->tls
.acl
= qemu_acl_init("vnc.x509dname"))) {
2819 fprintf(stderr
, "Failed to create x509 dname ACL\n");
2824 #ifdef CONFIG_VNC_SASL
2826 if (!(vs
->sasl
.acl
= qemu_acl_init("vnc.username"))) {
2827 fprintf(stderr
, "Failed to create username ACL\n");
2834 * Combinations we support here:
2836 * - no-auth (clear text, no auth)
2837 * - password (clear text, weak auth)
2838 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2839 * - tls (encrypt, weak anonymous creds, no auth)
2840 * - tls + password (encrypt, weak anonymous creds, weak auth)
2841 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2842 * - tls + x509 (encrypt, good x509 creds, no auth)
2843 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2844 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2846 * NB1. TLS is a stackable auth scheme.
2847 * NB2. the x509 schemes have option to validate a client cert dname
2850 #ifdef CONFIG_VNC_TLS
2852 vs
->auth
= VNC_AUTH_VENCRYPT
;
2854 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2855 vs
->subauth
= VNC_AUTH_VENCRYPT_X509VNC
;
2857 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2858 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSVNC
;
2861 #endif /* CONFIG_VNC_TLS */
2862 VNC_DEBUG("Initializing VNC server with password auth\n");
2863 vs
->auth
= VNC_AUTH_VNC
;
2864 #ifdef CONFIG_VNC_TLS
2865 vs
->subauth
= VNC_AUTH_INVALID
;
2867 #endif /* CONFIG_VNC_TLS */
2868 #ifdef CONFIG_VNC_SASL
2870 #ifdef CONFIG_VNC_TLS
2872 vs
->auth
= VNC_AUTH_VENCRYPT
;
2874 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2875 vs
->subauth
= VNC_AUTH_VENCRYPT_X509SASL
;
2877 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2878 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSSASL
;
2881 #endif /* CONFIG_VNC_TLS */
2882 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2883 vs
->auth
= VNC_AUTH_SASL
;
2884 #ifdef CONFIG_VNC_TLS
2885 vs
->subauth
= VNC_AUTH_INVALID
;
2887 #endif /* CONFIG_VNC_TLS */
2888 #endif /* CONFIG_VNC_SASL */
2890 #ifdef CONFIG_VNC_TLS
2892 vs
->auth
= VNC_AUTH_VENCRYPT
;
2894 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2895 vs
->subauth
= VNC_AUTH_VENCRYPT_X509NONE
;
2897 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2898 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSNONE
;
2902 VNC_DEBUG("Initializing VNC server with no auth\n");
2903 vs
->auth
= VNC_AUTH_NONE
;
2904 #ifdef CONFIG_VNC_TLS
2905 vs
->subauth
= VNC_AUTH_INVALID
;
2910 #ifdef CONFIG_VNC_SASL
2911 if ((saslErr
= sasl_server_init(NULL
, "qemu")) != SASL_OK
) {
2912 fprintf(stderr
, "Failed to initialize SASL auth %s",
2913 sasl_errstring(saslErr
, NULL
, NULL
));
2914 g_free(vs
->display
);
2919 vs
->lock_key_sync
= lock_key_sync
;
2922 /* connect to viewer */
2923 if (strncmp(display
, "unix:", 5) == 0)
2924 vs
->lsock
= unix_connect(display
+5);
2926 vs
->lsock
= inet_connect(display
, SOCK_STREAM
);
2927 if (-1 == vs
->lsock
) {
2928 g_free(vs
->display
);
2932 int csock
= vs
->lsock
;
2934 vnc_connect(vs
, csock
, 0);
2939 /* listen for connects */
2941 dpy
= g_malloc(256);
2942 if (strncmp(display
, "unix:", 5) == 0) {
2943 pstrcpy(dpy
, 256, "unix:");
2944 vs
->lsock
= unix_listen(display
+5, dpy
+5, 256-5);
2946 vs
->lsock
= inet_listen(display
, dpy
, 256, SOCK_STREAM
, 5900);
2948 if (-1 == vs
->lsock
) {
2952 g_free(vs
->display
);
2956 return qemu_set_fd_handler2(vs
->lsock
, NULL
, vnc_listen_read
, NULL
, vs
);
2959 void vnc_display_add_client(DisplayState
*ds
, int csock
, int skipauth
)
2961 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2963 return vnc_connect(vs
, csock
, skipauth
);