]> git.proxmox.com Git - mirror_qemu.git/blame - ui/vnc.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ui: fix VNC client throttling when audio capture is active
[mirror_qemu.git] / ui / vnc.c
CommitLineData
7d510b8c
FB		 1/*
2 * QEMU VNC display driver
5fafdf24 3 *
7d510b8c
FB		 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
19a490bf 6 * Copyright (C) 2009 Red Hat, Inc
5fafdf24 7 *
7d510b8c
FB		 8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
e16f4c87 27#include "qemu/osdep.h"
19a490bf 28#include "vnc.h"
bd023f95 29#include "vnc-jobs.h"
40066175 30#include "trace.h"
9c17d615 31#include "sysemu/sysemu.h"
d49b6836 32#include "qemu/error-report.h"
1de7afc9
PB		 33#include "qemu/sockets.h"
34#include "qemu/timer.h"
35#include "qemu/acl.h"
4db14629 36#include "qemu/config-file.h"
cc7a8ea7 37#include "qapi/qmp/qerror.h"
7b1b5d19 38#include "qapi/qmp/types.h"
2b54aa87 39#include "qmp-commands.h"
8d447d10 40#include "ui/input.h"
fb6ba0d5 41#include "qapi-event.h"
8e9b0d24 42#include "crypto/hash.h"
3e305e4a
DB		 43#include "crypto/tlscredsanon.h"
44#include "crypto/tlscredsx509.h"
45#include "qom/object_interfaces.h"
f348b6d1 46#include "qemu/cutils.h"
57a6d6d5 47#include "io/dns-resolver.h"
24236869 48
0f7b2864 49#define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
2430ffe4 50#define VNC_REFRESH_INTERVAL_INC 50
0f7b2864 51#define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
999342a0
CC		 52static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
24236869
FB		 54
55#include "vnc_keysym.h"
800567a6 56#include "crypto/cipher.h"
70848515 57
d616ccc5
GH		 58static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59 QTAILQ_HEAD_INITIALIZER(vnc_displays);
a9ce8590 60
d467b679 61static int vnc_cursor_define(VncState *vs);
7bc9318b 62static void vnc_release_modifiers(VncState *vs);
f9c87678 63static void vnc_update_throttle_offset(VncState *vs);
d467b679 64
8cf36489
GH		 65static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66{
67#ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
04d2529d
DB		 75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
8cf36489
GH		 77#endif
78
e5f34cdd
GH		 79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
8cf36489 87 vs->vd->num_exclusive--;
e5f34cdd
GH		 88 break;
89 default:
90 break;
8cf36489 91 }
e5f34cdd 92
8cf36489 93 vs->share_mode = mode;
e5f34cdd
GH		 94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
8cf36489 103 vs->vd->num_exclusive++;
e5f34cdd
GH		 104 break;
105 default:
106 break;
8cf36489
GH		 107 }
108}
109
1ff7df1a 110
bd269ebc 111static void vnc_init_basic_info(SocketAddress *addr,
98481bfc
EB		 112 VncBasicInfo *info,
113 Error **errp)
d96fd29c 114{
04d2529d 115 switch (addr->type) {
bd269ebc
MA		 116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
04d2529d
DB		 120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
d96fd29c 125
bd269ebc 126 case SOCKET_ADDRESS_TYPE_UNIX:
04d2529d 127 info->host = g_strdup("");
bd269ebc 128 info->service = g_strdup(addr->u.q_unix.path);
04d2529d
DB		 129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
bd269ebc
MA		 132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
a6c76285 134 error_setg(errp, "Unsupported socket address type %s",
977c736f 135 SocketAddressType_str(addr->type));
04d2529d 136 break;
a6c76285
MA		 137 default:
138 abort();
d96fd29c
LC		 139 }
140
04d2529d 141 return;
d96fd29c
LC		 142}
143
04d2529d
DB		 144static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
98481bfc 146 Error **errp)
d96fd29c 147{
bd269ebc 148 SocketAddress *addr = NULL;
d96fd29c 149
624cdd46
DB		 150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
04d2529d
DB		 155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
98481bfc 157 return;
d96fd29c
LC		 158 }
159
04d2529d 160 vnc_init_basic_info(addr, info, errp);
bd269ebc 161 qapi_free_SocketAddress(addr);
d96fd29c
LC		 162}
163
04d2529d
DB		 164static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
98481bfc 166 Error **errp)
d96fd29c 167{
bd269ebc 168 SocketAddress *addr = NULL;
d96fd29c 169
04d2529d
DB		 170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
98481bfc 172 return;
d96fd29c
LC		 173 }
174
04d2529d 175 vnc_init_basic_info(addr, info, errp);
bd269ebc 176 qapi_free_SocketAddress(addr);
d96fd29c
LC		 177}
178
1ff7df1a
AL		 179static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
1ff7df1a
AL		 198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
28a76be8
AL		 213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
1ff7df1a
AL		 217 default:
218 return "vencrypt";
219 }
2f9606b3 220 case VNC_AUTH_SASL:
28a76be8 221 return "sasl";
1ff7df1a
AL		 222 }
223 return "unknown";
224}
225
d616ccc5 226static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
a7789382 227{
fb6ba0d5 228 VncServerInfo *info;
98481bfc 229 Error *err = NULL;
a7789382 230
4ee74fa7
DB		 231 if (!vd->nlsock) {
232 return NULL;
233 }
234
3e7f136d 235 info = g_malloc0(sizeof(*info));
4ee74fa7 236 vnc_init_basic_info_from_server_addr(vd->lsock[0],
ddf21908 237 qapi_VncServerInfo_base(info), &err);
fb6ba0d5 238 info->has_auth = true;
d616ccc5 239 info->auth = g_strdup(vnc_auth_name(vd));
98481bfc
EB		 240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
fb6ba0d5 245 return info;
a7789382
LC		 246}
247
4a80dba3 248static void vnc_client_cache_auth(VncState *client)
1ff7df1a 249{
4a80dba3
LC		 250 if (!client->info) {
251 return;
d96fd29c 252 }
1263b7d6 253
3e305e4a
DB		 254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
d96fd29c 259 }
1263b7d6
AL		 260#ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
d96fd29c 262 client->sasl.username) {
fb6ba0d5
WX		 263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
d96fd29c 265 }
1263b7d6 266#endif
4a80dba3 267}
d96fd29c 268
4a80dba3
LC		 269static void vnc_client_cache_addr(VncState *client)
270{
98481bfc
EB		 271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
04d2529d 274 vnc_init_basic_info_from_remote_addr(client->sioc,
ddf21908 275 qapi_VncClientInfo_base(client->info),
98481bfc
EB		 276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
4a80dba3 281 }
1ff7df1a
AL		 282}
283
fb6ba0d5 284static void vnc_qmp_event(VncState *vs, QAPIEvent event)
586153d9 285{
fb6ba0d5 286 VncServerInfo *si;
586153d9
LC		 287
288 if (!vs->info) {
289 return;
290 }
291
d616ccc5 292 si = vnc_server_info_get(vs->vd);
fb6ba0d5 293 if (!si) {
586153d9
LC		 294 return;
295 }
296
fb6ba0d5
WX		 297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
ddf21908
EB		 299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300 &error_abort);
fb6ba0d5
WX		 301 break;
302 case QAPI_EVENT_VNC_INITIALIZED:
303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304 break;
305 case QAPI_EVENT_VNC_DISCONNECTED:
306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307 break;
308 default:
309 break;
310 }
586153d9 311
fb6ba0d5 312 qapi_free_VncServerInfo(si);
586153d9
LC		 313}
314
2b54aa87 315static VncClientInfo *qmp_query_vnc_client(const VncState *client)
a9ce8590 316{
2b54aa87 317 VncClientInfo *info;
04d2529d 318 Error *err = NULL;
2b54aa87 319
04d2529d 320 info = g_malloc0(sizeof(*info));
2b54aa87 321
04d2529d
DB		 322 vnc_init_basic_info_from_remote_addr(client->sioc,
323 qapi_VncClientInfo_base(info),
324 &err);
325 if (err) {
326 error_free(err);
327 qapi_free_VncClientInfo(info);
2b54aa87
LC		 328 return NULL;
329 }
d96fd29c 330
ddf21908 331 info->websocket = client->websocket;
d96fd29c 332
3e305e4a
DB		 333 if (client->tls) {
334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335 info->has_x509_dname = info->x509_dname != NULL;
2b54aa87 336 }
d96fd29c 337#ifdef CONFIG_VNC_SASL
2b54aa87
LC		 338 if (client->sasl.conn && client->sasl.username) {
339 info->has_sasl_username = true;
340 info->sasl_username = g_strdup(client->sasl.username);
d96fd29c 341 }
2b54aa87 342#endif
1ff7df1a 343
2b54aa87 344 return info;
d96fd29c 345}
1ff7df1a 346
d616ccc5
GH		 347static VncDisplay *vnc_display_find(const char *id)
348{
349 VncDisplay *vd;
350
351 if (id == NULL) {
352 return QTAILQ_FIRST(&vnc_displays);
353 }
354 QTAILQ_FOREACH(vd, &vnc_displays, next) {
355 if (strcmp(id, vd->id) == 0) {
356 return vd;
357 }
358 }
359 return NULL;
360}
361
2d29a436
GH		 362static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363{
364 VncClientInfoList *cinfo, *prev = NULL;
365 VncState *client;
366
367 QTAILQ_FOREACH(client, &vd->clients, next) {
368 cinfo = g_new0(VncClientInfoList, 1);
369 cinfo->value = qmp_query_vnc_client(client);
370 cinfo->next = prev;
371 prev = cinfo;
372 }
373 return prev;
374}
375
2b54aa87 376VncInfo *qmp_query_vnc(Error **errp)
d96fd29c 377{
2b54aa87 378 VncInfo *info = g_malloc0(sizeof(*info));
d616ccc5 379 VncDisplay *vd = vnc_display_find(NULL);
bd269ebc 380 SocketAddress *addr = NULL;
2b54aa87 381
4ee74fa7 382 if (vd == NULL || !vd->nlsock) {
2b54aa87 383 info->enabled = false;
d96fd29c 384 } else {
2b54aa87
LC		 385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
2d29a436 389 info->clients = qmp_query_client_list(vd);
d96fd29c 390
04d2529d 391 if (vd->lsock == NULL) {
417b0b88
PB		 392 return info;
393 }
394
4ee74fa7 395 addr = qio_channel_socket_get_local_address(vd->lsock[0], errp);
04d2529d 396 if (!addr) {
2b54aa87
LC		 397 goto out_error;
398 }
d96fd29c 399
04d2529d 400 switch (addr->type) {
bd269ebc
MA		 401 case SOCKET_ADDRESS_TYPE_INET:
402 info->host = g_strdup(addr->u.inet.host);
403 info->service = g_strdup(addr->u.inet.port);
404 if (addr->u.inet.ipv6) {
04d2529d
DB		 405 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
406 } else {
407 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
408 }
409 break;
410
bd269ebc 411 case SOCKET_ADDRESS_TYPE_UNIX:
04d2529d 412 info->host = g_strdup("");
bd269ebc 413 info->service = g_strdup(addr->u.q_unix.path);
04d2529d
DB		 414 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
415 break;
416
bd269ebc
MA		 417 case SOCKET_ADDRESS_TYPE_VSOCK:
418 case SOCKET_ADDRESS_TYPE_FD:
a6c76285 419 error_setg(errp, "Unsupported socket address type %s",
977c736f 420 SocketAddressType_str(addr->type));
2b54aa87 421 goto out_error;
a6c76285
MA		 422 default:
423 abort();
1ff7df1a 424 }
2b54aa87
LC		 425
426 info->has_host = true;
2b54aa87 427 info->has_service = true;
2b54aa87 428 info->has_family = true;
2b54aa87
LC		 429
430 info->has_auth = true;
d616ccc5 431 info->auth = g_strdup(vnc_auth_name(vd));
a9ce8590 432 }
2b54aa87 433
bd269ebc 434 qapi_free_SocketAddress(addr);
2b54aa87
LC		 435 return info;
436
437out_error:
bd269ebc 438 qapi_free_SocketAddress(addr);
2b54aa87
LC		 439 qapi_free_VncInfo(info);
440 return NULL;
a9ce8590
FB		 441}
442
2a7e6857
DB		 443
444static void qmp_query_auth(int auth, int subauth,
445 VncPrimaryAuth *qmp_auth,
446 VncVencryptSubAuth *qmp_vencrypt,
447 bool *qmp_has_vencrypt);
448
449static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
450 bool websocket,
451 int auth,
452 int subauth,
453 VncServerInfo2List *prev)
df887684 454{
2a7e6857
DB		 455 VncServerInfo2List *list;
456 VncServerInfo2 *info;
04d2529d 457 Error *err = NULL;
bd269ebc 458 SocketAddress *addr;
04d2529d
DB		 459
460 addr = qio_channel_socket_get_local_address(ioc, &err);
461 if (!addr) {
462 error_free(err);
df887684
GH		 463 return prev;
464 }
465
2a7e6857
DB		 466 info = g_new0(VncServerInfo2, 1);
467 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
bd269ebc 468 qapi_free_SocketAddress(addr);
04d2529d 469 if (err) {
2a7e6857 470 qapi_free_VncServerInfo2(info);
04d2529d
DB		 471 error_free(err);
472 return prev;
473 }
4478aa76 474 info->websocket = websocket;
df887684 475
2a7e6857
DB		 476 qmp_query_auth(auth, subauth, &info->auth,
477 &info->vencrypt, &info->has_vencrypt);
478
479 list = g_new0(VncServerInfo2List, 1);
df887684
GH		 480 list->value = info;
481 list->next = prev;
482 return list;
483}
484
2a7e6857
DB		 485static void qmp_query_auth(int auth, int subauth,
486 VncPrimaryAuth *qmp_auth,
487 VncVencryptSubAuth *qmp_vencrypt,
488 bool *qmp_has_vencrypt)
df887684 489{
2a7e6857 490 switch (auth) {
df887684 491 case VNC_AUTH_VNC:
2a7e6857 492 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
df887684
GH		 493 break;
494 case VNC_AUTH_RA2:
2a7e6857 495 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
df887684
GH		 496 break;
497 case VNC_AUTH_RA2NE:
2a7e6857 498 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
df887684
GH		 499 break;
500 case VNC_AUTH_TIGHT:
2a7e6857 501 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
df887684
GH		 502 break;
503 case VNC_AUTH_ULTRA:
2a7e6857 504 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
df887684
GH		 505 break;
506 case VNC_AUTH_TLS:
2a7e6857 507 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
df887684
GH		 508 break;
509 case VNC_AUTH_VENCRYPT:
2a7e6857
DB		 510 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
511 *qmp_has_vencrypt = true;
512 switch (subauth) {
df887684 513 case VNC_AUTH_VENCRYPT_PLAIN:
2a7e6857 514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
df887684
GH		 515 break;
516 case VNC_AUTH_VENCRYPT_TLSNONE:
2a7e6857 517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
df887684
GH		 518 break;
519 case VNC_AUTH_VENCRYPT_TLSVNC:
2a7e6857 520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
df887684
GH		 521 break;
522 case VNC_AUTH_VENCRYPT_TLSPLAIN:
2a7e6857 523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
df887684
GH		 524 break;
525 case VNC_AUTH_VENCRYPT_X509NONE:
2a7e6857 526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
df887684
GH		 527 break;
528 case VNC_AUTH_VENCRYPT_X509VNC:
2a7e6857 529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
df887684
GH		 530 break;
531 case VNC_AUTH_VENCRYPT_X509PLAIN:
2a7e6857 532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
df887684
GH		 533 break;
534 case VNC_AUTH_VENCRYPT_TLSSASL:
2a7e6857 535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
df887684
GH		 536 break;
537 case VNC_AUTH_VENCRYPT_X509SASL:
2a7e6857 538 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
df887684
GH		 539 break;
540 default:
2a7e6857 541 *qmp_has_vencrypt = false;
df887684
GH		 542 break;
543 }
df887684
GH		 544 break;
545 case VNC_AUTH_SASL:
2a7e6857 546 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
df887684
GH		 547 break;
548 case VNC_AUTH_NONE:
549 default:
2a7e6857 550 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
df887684
GH		 551 break;
552 }
553}
554
555VncInfo2List *qmp_query_vnc_servers(Error **errp)
556{
557 VncInfo2List *item, *prev = NULL;
558 VncInfo2 *info;
559 VncDisplay *vd;
560 DeviceState *dev;
4ee74fa7 561 size_t i;
df887684
GH		 562
563 QTAILQ_FOREACH(vd, &vnc_displays, next) {
564 info = g_new0(VncInfo2, 1);
565 info->id = g_strdup(vd->id);
566 info->clients = qmp_query_client_list(vd);
2a7e6857
DB		 567 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
568 &info->vencrypt, &info->has_vencrypt);
df887684
GH		 569 if (vd->dcl.con) {
570 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
571 "device", NULL));
572 info->has_display = true;
573 info->display = g_strdup(dev->id);
574 }
4ee74fa7 575 for (i = 0; i < vd->nlsock; i++) {
04d2529d 576 info->server = qmp_query_server_entry(
4ee74fa7 577 vd->lsock[i], false, vd->auth, vd->subauth, info->server);
df887684 578 }
4ee74fa7 579 for (i = 0; i < vd->nlwebsock; i++) {
04d2529d 580 info->server = qmp_query_server_entry(
4ee74fa7
DB		 581 vd->lwebsock[i], true, vd->ws_auth,
582 vd->ws_subauth, info->server);
df887684 583 }
df887684
GH		 584
585 item = g_new0(VncInfo2List, 1);
586 item->value = info;
587 item->next = prev;
588 prev = item;
589 }
590 return prev;
591}
592
24236869
FB		 593/* TODO
594 1) Get the queue working for IO.
595 2) there is some weirdness when using the -S option (the screen is grey
596 and not totally invalidated
597 3) resolutions > 1024
598*/
599
0181686a 600static int vnc_update_client(VncState *vs, int has_dirty);
198a0039 601static void vnc_disconnect_start(VncState *vs);
24236869 602
753b4053 603static void vnc_colordepth(VncState *vs);
1fc62412
SS		 604static void framebuffer_update_request(VncState *vs, int incremental,
605 int x_position, int y_position,
606 int w, int h);
0f7b2864 607static void vnc_refresh(DisplayChangeListener *dcl);
1fc62412 608static int vnc_refresh_server_surface(VncDisplay *vd);
7eac3a87 609
d05959c2
GH		 610static int vnc_width(VncDisplay *vd)
611{
612 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
613 VNC_DIRTY_PIXELS_PER_BIT));
614}
615
616static int vnc_height(VncDisplay *vd)
617{
618 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
619}
620
bea60dd7
PL		 621static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
622 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
f7b3d68c
GH		 623 VncDisplay *vd,
624 int x, int y, int w, int h)
625{
626 int width = vnc_width(vd);
627 int height = vnc_height(vd);
628
91937225
PL		 629 /* this is needed this to ensure we updated all affected
630 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
b4c85ddc
PL		 631 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
632 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
0486e8a7 633
9f64916d
GH		 634 x = MIN(x, width);
635 y = MIN(y, height);
636 w = MIN(x + w, width) - x;
91937225 637 h = MIN(y + h, height);
788abf8e 638
b4c85ddc 639 for (; y < h; y++) {
bea60dd7 640 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
91937225 641 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
b4c85ddc 642 }
24236869
FB		 643}
644
bea60dd7
PL		 645static void vnc_dpy_update(DisplayChangeListener *dcl,
646 int x, int y, int w, int h)
647{
648 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
649 struct VncSurface *s = &vd->guest;
bea60dd7 650
f7b3d68c 651 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
bea60dd7
PL		 652}
653
70a4568f
CC		 654void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
655 int32_t encoding)
24236869
FB		 656{
657 vnc_write_u16(vs, x);
658 vnc_write_u16(vs, y);
659 vnc_write_u16(vs, w);
660 vnc_write_u16(vs, h);
661
662 vnc_write_s32(vs, encoding);
663}
664
32ed2680 665
621aaeb9
GH		 666static void vnc_desktop_resize(VncState *vs)
667{
04d2529d 668 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
621aaeb9
GH		 669 return;
670 }
bea60dd7
PL		 671 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
672 vs->client_height == pixman_image_get_height(vs->vd->server)) {
1d4b638a
GH		 673 return;
674 }
bea60dd7
PL		 675 vs->client_width = pixman_image_get_width(vs->vd->server);
676 vs->client_height = pixman_image_get_height(vs->vd->server);
bd023f95 677 vnc_lock_output(vs);
621aaeb9
GH		 678 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
679 vnc_write_u8(vs, 0);
680 vnc_write_u16(vs, 1); /* number of rects */
5862d195 681 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
621aaeb9 682 VNC_ENCODING_DESKTOPRESIZE);
bd023f95 683 vnc_unlock_output(vs);
621aaeb9
GH		 684 vnc_flush(vs);
685}
686
bd023f95
CC		 687static void vnc_abort_display_jobs(VncDisplay *vd)
688{
689 VncState *vs;
690
691 QTAILQ_FOREACH(vs, &vd->clients, next) {
692 vnc_lock_output(vs);
693 vs->abort = true;
694 vnc_unlock_output(vs);
695 }
696 QTAILQ_FOREACH(vs, &vd->clients, next) {
697 vnc_jobs_join(vs);
698 }
699 QTAILQ_FOREACH(vs, &vd->clients, next) {
700 vnc_lock_output(vs);
701 vs->abort = false;
702 vnc_unlock_output(vs);
703 }
704}
bd023f95 705
9f64916d
GH		 706int vnc_server_fb_stride(VncDisplay *vd)
707{
708 return pixman_image_get_stride(vd->server);
709}
710
711void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
712{
713 uint8_t *ptr;
714
715 ptr = (uint8_t *)pixman_image_get_data(vd->server);
716 ptr += y * vnc_server_fb_stride(vd);
717 ptr += x * VNC_SERVER_FB_BYTES;
718 return ptr;
719}
720
453f842b
GH		 721static void vnc_update_server_surface(VncDisplay *vd)
722{
b69a553b
DB		 723 int width, height;
724
453f842b
GH		 725 qemu_pixman_image_unref(vd->server);
726 vd->server = NULL;
727
c7628bff
GH		 728 if (QTAILQ_EMPTY(&vd->clients)) {
729 return;
730 }
731
b69a553b
DB		 732 width = vnc_width(vd);
733 height = vnc_height(vd);
453f842b 734 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
b69a553b 735 width, height,
453f842b 736 NULL, 0);
b69a553b
DB		 737
738 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
739 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
740 width, height);
453f842b
GH		 741}
742
c12aeb86 743static void vnc_dpy_switch(DisplayChangeListener *dcl,
c12aeb86 744 DisplaySurface *surface)
24236869 745{
21ef45d7 746 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
41b4bef6 747 VncState *vs;
1fc62412 748
bd023f95 749 vnc_abort_display_jobs(vd);
453f842b 750 vd->ds = surface;
bd023f95 751
1fc62412 752 /* server surface */
453f842b 753 vnc_update_server_surface(vd);
24236869 754
6baebed7 755 /* guest surface */
9f64916d 756 qemu_pixman_image_unref(vd->guest.fb);
d39fa6d8
GH		 757 vd->guest.fb = pixman_image_ref(surface->image);
758 vd->guest.format = surface->format;
24236869 759
41b4bef6 760 QTAILQ_FOREACH(vs, &vd->clients, next) {
1fc62412 761 vnc_colordepth(vs);
1d4b638a 762 vnc_desktop_resize(vs);
d467b679
GH		 763 if (vs->vd->cursor) {
764 vnc_cursor_define(vs);
765 }
bea60dd7 766 memset(vs->dirty, 0x00, sizeof(vs->dirty));
f7b3d68c 767 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
b69a553b
DB		 768 vnc_width(vd),
769 vnc_height(vd));
f9c87678 770 vnc_update_throttle_offset(vs);
753b4053
AL		 771 }
772}
773
3512779a 774/* fastest code */
9f64916d 775static void vnc_write_pixels_copy(VncState *vs,
d467b679 776 void *pixels, int size)
3512779a
FB		 777{
778 vnc_write(vs, pixels, size);
779}
780
781/* slowest but generic code. */
70a4568f 782void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
3512779a 783{
7eac3a87 784 uint8_t r, g, b;
1fc62412 785
9f64916d
GH		 786#if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
787 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
788 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
789 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
790#else
791# error need some bits here if you change VNC_SERVER_FB_FORMAT
792#endif
793 v = (r << vs->client_pf.rshift) |
794 (g << vs->client_pf.gshift) |
795 (b << vs->client_pf.bshift);
796 switch (vs->client_pf.bytes_per_pixel) {
3512779a
FB		 797 case 1:
798 buf[0] = v;
799 break;
800 case 2:
9f64916d 801 if (vs->client_be) {
3512779a
FB		 802 buf[0] = v >> 8;
803 buf[1] = v;
804 } else {
805 buf[1] = v >> 8;
806 buf[0] = v;
807 }
808 break;
809 default:
810 case 4:
9f64916d 811 if (vs->client_be) {
3512779a
FB		 812 buf[0] = v >> 24;
813 buf[1] = v >> 16;
814 buf[2] = v >> 8;
815 buf[3] = v;
816 } else {
817 buf[3] = v >> 24;
818 buf[2] = v >> 16;
819 buf[1] = v >> 8;
820 buf[0] = v;
821 }
822 break;
823 }
824}
825
9f64916d 826static void vnc_write_pixels_generic(VncState *vs,
d467b679 827 void *pixels1, int size)
3512779a 828{
3512779a 829 uint8_t buf[4];
3512779a 830
9f64916d 831 if (VNC_SERVER_FB_BYTES == 4) {
7eac3a87
AL		 832 uint32_t *pixels = pixels1;
833 int n, i;
834 n = size >> 2;
9f64916d 835 for (i = 0; i < n; i++) {
7eac3a87 836 vnc_convert_pixel(vs, buf, pixels[i]);
9f64916d 837 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
7eac3a87 838 }
3512779a
FB		 839 }
840}
841
a885211e 842int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869
FB		 843{
844 int i;
60fe76f3 845 uint8_t *row;
1fc62412 846 VncDisplay *vd = vs->vd;
24236869 847
9f64916d 848 row = vnc_server_fb_ptr(vd, x, y);
24236869 849 for (i = 0; i < h; i++) {
9f64916d
GH		 850 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
851 row += vnc_server_fb_stride(vd);
24236869 852 }
a885211e 853 return 1;
24236869
FB		 854}
855
bd023f95 856int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
24236869 857{
a885211e 858 int n = 0;
de3f7de7
PL		 859 bool encode_raw = false;
860 size_t saved_offs = vs->output.offset;
a885211e 861
fb437313 862 switch(vs->vnc_encoding) {
28a76be8 863 case VNC_ENCODING_ZLIB:
a885211e 864 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
28a76be8
AL		 865 break;
866 case VNC_ENCODING_HEXTILE:
867 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
a885211e 868 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
28a76be8 869 break;
380282b0
CC		 870 case VNC_ENCODING_TIGHT:
871 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
872 break;
efe556ad
CC		 873 case VNC_ENCODING_TIGHT_PNG:
874 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
875 break;
148954fa
CC		 876 case VNC_ENCODING_ZRLE:
877 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
878 break;
879 case VNC_ENCODING_ZYWRLE:
880 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
881 break;
28a76be8 882 default:
de3f7de7 883 encode_raw = true;
28a76be8 884 break;
fb437313 885 }
de3f7de7
PL		 886
887 /* If the client has the same pixel format as our internal buffer and
888 * a RAW encoding would need less space fall back to RAW encoding to
889 * save bandwidth and processing power in the client. */
890 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
891 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
892 vs->output.offset = saved_offs;
893 encode_raw = true;
894 }
895
896 if (encode_raw) {
897 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
898 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
899 }
900
a885211e 901 return n;
24236869
FB		 902}
903
7c20b4a3 904static void vnc_mouse_set(DisplayChangeListener *dcl,
7c20b4a3 905 int x, int y, int visible)
d467b679
GH		 906{
907 /* can we ask the client(s) to move the pointer ??? */
908}
909
910static int vnc_cursor_define(VncState *vs)
911{
912 QEMUCursor *c = vs->vd->cursor;
d467b679
GH		 913 int isize;
914
915 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
d01f9595 916 vnc_lock_output(vs);
d467b679
GH		 917 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
918 vnc_write_u8(vs, 0); /* padding */
919 vnc_write_u16(vs, 1); /* # of rects */
920 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
921 VNC_ENCODING_RICH_CURSOR);
9f64916d
GH		 922 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
923 vnc_write_pixels_generic(vs, c->data, isize);
d467b679 924 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
d01f9595 925 vnc_unlock_output(vs);
d467b679
GH		 926 return 0;
927 }
928 return -1;
929}
930
7c20b4a3 931static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
7c20b4a3 932 QEMUCursor *c)
d467b679 933{
d616ccc5 934 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
d467b679
GH		 935 VncState *vs;
936
937 cursor_put(vd->cursor);
7267c094 938 g_free(vd->cursor_mask);
d467b679
GH		 939
940 vd->cursor = c;
941 cursor_get(vd->cursor);
942 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
7267c094 943 vd->cursor_mask = g_malloc0(vd->cursor_msize);
d467b679
GH		 944 cursor_get_mono_mask(c, 0, vd->cursor_mask);
945
946 QTAILQ_FOREACH(vs, &vd->clients, next) {
947 vnc_cursor_define(vs);
948 }
949}
950
4769a881 951static int find_and_clear_dirty_height(VncState *vs,
6c71a539 952 int y, int last_x, int x, int height)
24236869
FB		 953{
954 int h;
955
6c71a539 956 for (h = 1; h < (height - y); h++) {
bc2429b9 957 if (!test_bit(last_x, vs->dirty[y + h])) {
28a76be8 958 break;
bc2429b9 959 }
863d7c91 960 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
24236869
FB		 961 }
962
963 return h;
964}
965
f9c87678
DB		 966/*
967 * Figure out how much pending data we should allow in the output
968 * buffer before we throttle incremental display updates, and/or
969 * drop audio samples.
970 *
971 * We allow for equiv of 1 full display's worth of FB updates,
972 * and 1 second of audio samples. If audio backlog was larger
973 * than that the client would already suffering awful audio
974 * glitches, so dropping samples is no worse really).
975 */
976static void vnc_update_throttle_offset(VncState *vs)
977{
978 size_t offset =
979 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
980
981 if (vs->audio_cap) {
982 int freq = vs->as.freq;
983 /* We don't limit freq when reading settings from client, so
984 * it could be upto MAX_INT in size. 48khz is a sensible
985 * upper bound for trustworthy clients */
986 int bps;
987 if (freq > 48000) {
988 freq = 48000;
989 }
990 switch (vs->as.fmt) {
991 default:
992 case AUD_FMT_U8:
993 case AUD_FMT_S8:
994 bps = 1;
995 break;
996 case AUD_FMT_U16:
997 case AUD_FMT_S16:
998 bps = 2;
999 break;
1000 case AUD_FMT_U32:
1001 case AUD_FMT_S32:
1002 bps = 4;
1003 break;
1004 }
1005 offset += freq * bps * vs->as.nchannels;
1006 }
1007
1008 /* Put a floor of 1MB on offset, so that if we have a large pending
1009 * buffer and the display is resized to a small size & back again
1010 * we don't suddenly apply a tiny send limit
1011 */
1012 offset = MAX(offset, 1024 * 1024);
1013
1014 vs->throttle_output_offset = offset;
1015}
1016
5af9f250
DB		 1017static bool vnc_should_update(VncState *vs)
1018{
1019 switch (vs->update) {
1020 case VNC_STATE_UPDATE_NONE:
1021 break;
1022 case VNC_STATE_UPDATE_INCREMENTAL:
f9c87678
DB		 1023 /* Only allow incremental updates if the pending send queue
1024 * is less than the permitted threshold
5af9f250 1025 */
f9c87678 1026 if (vs->output.offset < vs->throttle_output_offset) {
5af9f250
DB		 1027 return true;
1028 }
1029 break;
1030 case VNC_STATE_UPDATE_FORCE:
1031 return true;
1032 }
1033 return false;
1034}
1035
0181686a 1036static int vnc_update_client(VncState *vs, int has_dirty)
24236869 1037{
a7b2537f
DB		 1038 VncDisplay *vd = vs->vd;
1039 VncJob *job;
1040 int y;
1041 int height, width;
1042 int n = 0;
1043
5a8be0f7
GH		 1044 if (vs->disconnecting) {
1045 vnc_disconnect_finish(vs);
1046 return 0;
1047 }
1048
63658280 1049 vs->has_dirty += has_dirty;
5af9f250 1050 if (!vnc_should_update(vs)) {
a7b2537f
DB		 1051 return 0;
1052 }
1053
126617e6 1054 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
a7b2537f
DB		 1055 return 0;
1056 }
1057
1058 /*
1059 * Send screen updates to the vnc client using the server
1060 * surface and server dirty map. guest surface updates
1061 * happening in parallel don't disturb us, the next pass will
1062 * send them to the client.
1063 */
1064 job = vnc_job_new(vs);
1065
1066 height = pixman_image_get_height(vd->server);
1067 width = pixman_image_get_width(vd->server);
1068
1069 y = 0;
1070 for (;;) {
1071 int x, h;
1072 unsigned long x2;
1073 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1074 height * VNC_DIRTY_BPL(vs),
1075 y * VNC_DIRTY_BPL(vs));
1076 if (offset == height * VNC_DIRTY_BPL(vs)) {
1077 /* no more dirty bits */
1078 break;
1079 }
1080 y = offset / VNC_DIRTY_BPL(vs);
1081 x = offset % VNC_DIRTY_BPL(vs);
1082 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1083 VNC_DIRTY_BPL(vs), x);
1084 bitmap_clear(vs->dirty[y], x, x2 - x);
1085 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1086 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1087 if (x2 > x) {
1088 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1089 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1090 }
1091 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1092 y += h;
1093 if (y == height) {
12b316d4 1094 break;
28a76be8
AL		 1095 }
1096 }
24236869 1097 }
24236869 1098
a7b2537f 1099 vnc_job_push(job);
2e6571e6 1100 vs->update = VNC_STATE_UPDATE_NONE;
a7b2537f
DB		 1101 vs->has_dirty = 0;
1102 return n;
24236869
FB		 1103}
1104
429a8ed3 1105/* audio */
1106static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1107{
1108 VncState *vs = opaque;
1109
1110 switch (cmd) {
1111 case AUD_CNOTIFY_DISABLE:
bd023f95 1112 vnc_lock_output(vs);
46a183da
DB		 1113 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1114 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1115 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
bd023f95 1116 vnc_unlock_output(vs);
429a8ed3 1117 vnc_flush(vs);
1118 break;
1119
1120 case AUD_CNOTIFY_ENABLE:
bd023f95 1121 vnc_lock_output(vs);
46a183da
DB		 1122 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1123 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1124 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
bd023f95 1125 vnc_unlock_output(vs);
429a8ed3 1126 vnc_flush(vs);
1127 break;
1128 }
1129}
1130
1131static void audio_capture_destroy(void *opaque)
1132{
1133}
1134
1135static void audio_capture(void *opaque, void *buf, int size)
1136{
1137 VncState *vs = opaque;
1138
bd023f95 1139 vnc_lock_output(vs);
f9c87678
DB		 1140 if (vs->output.offset < vs->throttle_output_offset) {
1141 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1142 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1143 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1144 vnc_write_u32(vs, size);
1145 vnc_write(vs, buf, size);
1146 }
bd023f95 1147 vnc_unlock_output(vs);
429a8ed3 1148 vnc_flush(vs);
1149}
1150
1151static void audio_add(VncState *vs)
1152{
1153 struct audio_capture_ops ops;
1154
1155 if (vs->audio_cap) {
027a79c3 1156 error_report("audio already running");
429a8ed3 1157 return;
1158 }
1159
1160 ops.notify = audio_capture_notify;
1161 ops.destroy = audio_capture_destroy;
1162 ops.capture = audio_capture;
1163
1a7dafce 1164 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
429a8ed3 1165 if (!vs->audio_cap) {
027a79c3 1166 error_report("Failed to add audio capture");
429a8ed3 1167 }
1168}
1169
1170static void audio_del(VncState *vs)
1171{
1172 if (vs->audio_cap) {
1173 AUD_del_capture(vs->audio_cap, vs);
1174 vs->audio_cap = NULL;
1175 }
1176}
1177
198a0039
GH		 1178static void vnc_disconnect_start(VncState *vs)
1179{
04d2529d 1180 if (vs->disconnecting) {
198a0039 1181 return;
04d2529d 1182 }
ad6374c4 1183 trace_vnc_client_disconnect_start(vs, vs->ioc);
8cf36489 1184 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
04d2529d
DB		 1185 if (vs->ioc_tag) {
1186 g_source_remove(vs->ioc_tag);
a75d6f07 1187 vs->ioc_tag = 0;
04d2529d
DB		 1188 }
1189 qio_channel_close(vs->ioc, NULL);
1190 vs->disconnecting = TRUE;
198a0039
GH		 1191}
1192
7536ee4b 1193void vnc_disconnect_finish(VncState *vs)
198a0039 1194{
7d964c9d
CC		 1195 int i;
1196
ad6374c4
DB		 1197 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1198
bd023f95
CC		 1199 vnc_jobs_join(vs); /* Wait encoding jobs */
1200
1201 vnc_lock_output(vs);
fb6ba0d5 1202 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
0d72f3d3 1203
5d418e3b
CC		 1204 buffer_free(&vs->input);
1205 buffer_free(&vs->output);
4a80dba3 1206
fb6ba0d5 1207 qapi_free_VncClientInfo(vs->info);
4a80dba3 1208
161c4f20 1209 vnc_zlib_clear(vs);
380282b0 1210 vnc_tight_clear(vs);
148954fa 1211 vnc_zrle_clear(vs);
161c4f20 1212
198a0039
GH		 1213#ifdef CONFIG_VNC_SASL
1214 vnc_sasl_client_cleanup(vs);
1215#endif /* CONFIG_VNC_SASL */
1216 audio_del(vs);
7bc9318b 1217 vnc_release_modifiers(vs);
198a0039 1218
90cd03a3 1219 if (vs->mouse_mode_notifier.notify != NULL) {
6fd8e79a 1220 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
90cd03a3
DB		 1221 }
1222 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1223 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1224 /* last client gone */
1225 vnc_update_server_surface(vs->vd);
6fd8e79a 1226 }
41b4bef6 1227
bd023f95
CC		 1228 vnc_unlock_output(vs);
1229
bd023f95 1230 qemu_mutex_destroy(&vs->output_mutex);
6fd8e79a
TH		 1231 if (vs->bh != NULL) {
1232 qemu_bh_delete(vs->bh);
1233 }
175b2a6e 1234 buffer_free(&vs->jobs_buffer);
175b2a6e 1235
7d964c9d 1236 for (i = 0; i < VNC_STAT_ROWS; ++i) {
7267c094 1237 g_free(vs->lossy_rect[i]);
7d964c9d 1238 }
7267c094 1239 g_free(vs->lossy_rect);
04d2529d
DB		 1240
1241 object_unref(OBJECT(vs->ioc));
1242 vs->ioc = NULL;
1243 object_unref(OBJECT(vs->sioc));
1244 vs->sioc = NULL;
7267c094 1245 g_free(vs);
198a0039 1246}
2f9606b3 1247
04d2529d 1248ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
24236869 1249{
04d2529d
DB		 1250 if (ret <= 0) {
1251 if (ret == 0) {
ad6374c4 1252 trace_vnc_client_eof(vs, vs->ioc);
537848ee 1253 vnc_disconnect_start(vs);
04d2529d 1254 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
ad6374c4
DB		 1255 trace_vnc_client_io_error(vs, vs->ioc,
1256 errp ? error_get_pretty(*errp) :
1257 "Unknown");
537848ee 1258 vnc_disconnect_start(vs);
ea01e5fd 1259 }
24236869 1260
04d2529d
DB		 1261 if (errp) {
1262 error_free(*errp);
1263 *errp = NULL;
1264 }
28a76be8 1265 return 0;
24236869
FB		 1266 }
1267 return ret;
1268}
1269
5fb6c7a8
AL		 1270
1271void vnc_client_error(VncState *vs)
24236869 1272{
198a0039
GH		 1273 VNC_DEBUG("Closing down client sock: protocol error\n");
1274 vnc_disconnect_start(vs);
24236869
FB		 1275}
1276
3e305e4a 1277
2f9606b3
AL		 1278/*
1279 * Called to write a chunk of data to the client socket. The data may
1280 * be the raw data, or may have already been encoded by SASL.
1281 * The data will be written either straight onto the socket, or
1282 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1283 *
1284 * NB, it is theoretically possible to have 2 layers of encryption,
1285 * both SASL, and this TLS layer. It is highly unlikely in practice
1286 * though, since SASL encryption will typically be a no-op if TLS
1287 * is active
1288 *
1289 * Returns the number of bytes written, which may be less than
1290 * the requested 'datalen' if the socket would block. Returns
1291 * -1 on error, and disconnects the client socket.
1292 */
fdd1ab6a 1293ssize_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
24236869 1294{
04d2529d 1295 Error *err = NULL;
fdd1ab6a 1296 ssize_t ret;
2cc45228
DB		 1297 ret = qio_channel_write(
1298 vs->ioc, (const char *)data, datalen, &err);
23decc87 1299 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
04d2529d 1300 return vnc_client_io_error(vs, ret, &err);
2f9606b3
AL		 1301}
1302
1303
1304/*
1305 * Called to write buffered data to the client socket, when not
1306 * using any SASL SSF encryption layers. Will write as much data
1307 * as possible without blocking. If all buffered data is written,
1308 * will switch the FD poll() handler back to read monitoring.
1309 *
1310 * Returns the number of bytes written, which may be less than
1311 * the buffered output data if the socket would block. Returns
1312 * -1 on error, and disconnects the client socket.
1313 */
fdd1ab6a 1314static ssize_t vnc_client_write_plain(VncState *vs)
2f9606b3 1315{
fdd1ab6a 1316 ssize_t ret;
2f9606b3
AL		 1317
1318#ifdef CONFIG_VNC_SASL
23decc87 1319 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
2f9606b3
AL		 1320 vs->output.buffer, vs->output.capacity, vs->output.offset,
1321 vs->sasl.waitWriteSSF);
1322
1323 if (vs->sasl.conn &&
1324 vs->sasl.runSSF &&
1325 vs->sasl.waitWriteSSF) {
1326 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1327 if (ret)
1328 vs->sasl.waitWriteSSF -= ret;
1329 } else
1330#endif /* CONFIG_VNC_SASL */
1331 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
24236869 1332 if (!ret)
2f9606b3 1333 return 0;
24236869 1334
32ed2680 1335 buffer_advance(&vs->output, ret);
24236869
FB		 1336
1337 if (vs->output.offset == 0) {
04d2529d
DB		 1338 if (vs->ioc_tag) {
1339 g_source_remove(vs->ioc_tag);
1340 }
1341 vs->ioc_tag = qio_channel_add_watch(
1342 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
24236869 1343 }
2f9606b3
AL		 1344
1345 return ret;
1346}
1347
1348
1349/*
1350 * First function called whenever there is data to be written to
1351 * the client socket. Will delegate actual work according to whether
1352 * SASL SSF layers are enabled (thus requiring encryption calls)
1353 */
04d2529d 1354static void vnc_client_write_locked(VncState *vs)
2f9606b3 1355{
2f9606b3
AL		 1356#ifdef CONFIG_VNC_SASL
1357 if (vs->sasl.conn &&
1358 vs->sasl.runSSF &&
9678d950
BS		 1359 !vs->sasl.waitWriteSSF) {
1360 vnc_client_write_sasl(vs);
1361 } else
2f9606b3 1362#endif /* CONFIG_VNC_SASL */
7536ee4b 1363 {
d5f04223 1364 vnc_client_write_plain(vs);
7536ee4b 1365 }
24236869
FB		 1366}
1367
04d2529d 1368static void vnc_client_write(VncState *vs)
bd023f95 1369{
bd023f95
CC		 1370
1371 vnc_lock_output(vs);
d5f04223 1372 if (vs->output.offset) {
04d2529d
DB		 1373 vnc_client_write_locked(vs);
1374 } else if (vs->ioc != NULL) {
1375 if (vs->ioc_tag) {
1376 g_source_remove(vs->ioc_tag);
1377 }
1378 vs->ioc_tag = qio_channel_add_watch(
1379 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
bd023f95
CC		 1380 }
1381 vnc_unlock_output(vs);
1382}
1383
5fb6c7a8 1384void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
24236869
FB		 1385{
1386 vs->read_handler = func;
1387 vs->read_handler_expect = expecting;
1388}
1389
2f9606b3
AL		 1390
1391/*
1392 * Called to read a chunk of data from the client socket. The data may
1393 * be the raw data, or may need to be further decoded by SASL.
1394 * The data will be read either straight from to the socket, or
1395 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1396 *
1397 * NB, it is theoretically possible to have 2 layers of encryption,
1398 * both SASL, and this TLS layer. It is highly unlikely in practice
1399 * though, since SASL encryption will typically be a no-op if TLS
1400 * is active
1401 *
1402 * Returns the number of bytes read, which may be less than
1403 * the requested 'datalen' if the socket would block. Returns
1404 * -1 on error, and disconnects the client socket.
1405 */
fdd1ab6a 1406ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
24236869 1407{
fdd1ab6a 1408 ssize_t ret;
04d2529d 1409 Error *err = NULL;
2cc45228
DB		 1410 ret = qio_channel_read(
1411 vs->ioc, (char *)data, datalen, &err);
23decc87 1412 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
04d2529d 1413 return vnc_client_io_error(vs, ret, &err);
2f9606b3 1414}
24236869 1415
2f9606b3
AL		 1416
1417/*
1418 * Called to read data from the client socket to the input buffer,
1419 * when not using any SASL SSF encryption layers. Will read as much
1420 * data as possible without blocking.
1421 *
1422 * Returns the number of bytes read. Returns -1 on error, and
1423 * disconnects the client socket.
1424 */
fdd1ab6a 1425static ssize_t vnc_client_read_plain(VncState *vs)
2f9606b3 1426{
fdd1ab6a 1427 ssize_t ret;
23decc87 1428 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
2f9606b3
AL		 1429 vs->input.buffer, vs->input.capacity, vs->input.offset);
1430 buffer_reserve(&vs->input, 4096);
1431 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1432 if (!ret)
1433 return 0;
24236869 1434 vs->input.offset += ret;
2f9606b3
AL		 1435 return ret;
1436}
1437
175b2a6e
CC		 1438static void vnc_jobs_bh(void *opaque)
1439{
1440 VncState *vs = opaque;
1441
1442 vnc_jobs_consume_buffer(vs);
1443}
2f9606b3
AL		 1444
1445/*
1446 * First function called whenever there is more data to be read from
1447 * the client socket. Will delegate actual work according to whether
1448 * SASL SSF layers are enabled (thus requiring decryption calls)
ea697449 1449 * Returns 0 on success, -1 if client disconnected
2f9606b3 1450 */
ea697449 1451static int vnc_client_read(VncState *vs)
2f9606b3 1452{
fdd1ab6a 1453 ssize_t ret;
2f9606b3
AL		 1454
1455#ifdef CONFIG_VNC_SASL
1456 if (vs->sasl.conn && vs->sasl.runSSF)
1457 ret = vnc_client_read_sasl(vs);
1458 else
1459#endif /* CONFIG_VNC_SASL */
d5f04223 1460 ret = vnc_client_read_plain(vs);
198a0039 1461 if (!ret) {
04d2529d 1462 if (vs->disconnecting) {
198a0039 1463 vnc_disconnect_finish(vs);
ea697449 1464 return -1;
04d2529d 1465 }
ea697449 1466 return 0;
198a0039 1467 }
24236869
FB		 1468
1469 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
28a76be8
AL		 1470 size_t len = vs->read_handler_expect;
1471 int ret;
1472
1473 ret = vs->read_handler(vs, vs->input.buffer, len);
04d2529d 1474 if (vs->disconnecting) {
198a0039 1475 vnc_disconnect_finish(vs);
ea697449 1476 return -1;
198a0039 1477 }
28a76be8
AL		 1478
1479 if (!ret) {
32ed2680 1480 buffer_advance(&vs->input, len);
28a76be8
AL		 1481 } else {
1482 vs->read_handler_expect = ret;
1483 }
24236869 1484 }
ea697449 1485 return 0;
24236869
FB		 1486}
1487
04d2529d
DB		 1488gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1489 GIOCondition condition, void *opaque)
1490{
1491 VncState *vs = opaque;
1492 if (condition & G_IO_IN) {
ea697449
DB		 1493 if (vnc_client_read(vs) < 0) {
1494 return TRUE;
1495 }
04d2529d
DB		 1496 }
1497 if (condition & G_IO_OUT) {
1498 vnc_client_write(vs);
1499 }
1500 return TRUE;
1501}
1502
1503
5fb6c7a8 1504void vnc_write(VncState *vs, const void *data, size_t len)
24236869
FB		 1505{
1506 buffer_reserve(&vs->output, len);
1507
04d2529d
DB		 1508 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1509 if (vs->ioc_tag) {
1510 g_source_remove(vs->ioc_tag);
1511 }
1512 vs->ioc_tag = qio_channel_add_watch(
1513 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
24236869
FB		 1514 }
1515
1516 buffer_append(&vs->output, data, len);
1517}
1518
5fb6c7a8 1519void vnc_write_s32(VncState *vs, int32_t value)
24236869
FB		 1520{
1521 vnc_write_u32(vs, *(uint32_t *)&value);
1522}
1523
5fb6c7a8 1524void vnc_write_u32(VncState *vs, uint32_t value)
24236869
FB		 1525{
1526 uint8_t buf[4];
1527
1528 buf[0] = (value >> 24) & 0xFF;
1529 buf[1] = (value >> 16) & 0xFF;
1530 buf[2] = (value >> 8) & 0xFF;
1531 buf[3] = value & 0xFF;
1532
1533 vnc_write(vs, buf, 4);
1534}
1535
5fb6c7a8 1536void vnc_write_u16(VncState *vs, uint16_t value)
24236869 1537{
64f5a135 1538 uint8_t buf[2];
24236869
FB		 1539
1540 buf[0] = (value >> 8) & 0xFF;
1541 buf[1] = value & 0xFF;
1542
1543 vnc_write(vs, buf, 2);
1544}
1545
5fb6c7a8 1546void vnc_write_u8(VncState *vs, uint8_t value)
24236869
FB		 1547{
1548 vnc_write(vs, (char *)&value, 1);
1549}
1550
5fb6c7a8 1551void vnc_flush(VncState *vs)
24236869 1552{
bd023f95 1553 vnc_lock_output(vs);
d5f04223 1554 if (vs->ioc != NULL && vs->output.offset) {
bd023f95
CC		 1555 vnc_client_write_locked(vs);
1556 }
1557 vnc_unlock_output(vs);
24236869
FB		 1558}
1559
71a8cdec 1560static uint8_t read_u8(uint8_t *data, size_t offset)
24236869
FB		 1561{
1562 return data[offset];
1563}
1564
71a8cdec 1565static uint16_t read_u16(uint8_t *data, size_t offset)
24236869
FB		 1566{
1567 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1568}
1569
71a8cdec 1570static int32_t read_s32(uint8_t *data, size_t offset)
24236869
FB		 1571{
1572 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1573 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1574}
1575
5fb6c7a8 1576uint32_t read_u32(uint8_t *data, size_t offset)
24236869
FB		 1577{
1578 return ((data[offset] << 24) | (data[offset + 1] << 16) |
28a76be8 1579 (data[offset + 2] << 8) | data[offset + 3]);
24236869
FB		 1580}
1581
60fe76f3 1582static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
24236869
FB		 1583{
1584}
1585
9e8dd451 1586static void check_pointer_type_change(Notifier *notifier, void *data)
564c337e 1587{
37c34d9d 1588 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
14768eba 1589 int absolute = qemu_input_is_absolute();
37c34d9d 1590
29fa4ed9 1591 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
bd023f95 1592 vnc_lock_output(vs);
46a183da 1593 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
28a76be8
AL		 1594 vnc_write_u8(vs, 0);
1595 vnc_write_u16(vs, 1);
1596 vnc_framebuffer_update(vs, absolute, 0,
bea60dd7
PL		 1597 pixman_image_get_width(vs->vd->server),
1598 pixman_image_get_height(vs->vd->server),
29fa4ed9 1599 VNC_ENCODING_POINTER_TYPE_CHANGE);
bd023f95 1600 vnc_unlock_output(vs);
28a76be8 1601 vnc_flush(vs);
564c337e
FB		 1602 }
1603 vs->absolute = absolute;
1604}
1605
24236869
FB		 1606static void pointer_event(VncState *vs, int button_mask, int x, int y)
1607{
7fb1cf16 1608 static uint32_t bmap[INPUT_BUTTON__MAX] = {
14768eba
GH		 1609 [INPUT_BUTTON_LEFT] = 0x01,
1610 [INPUT_BUTTON_MIDDLE] = 0x02,
1611 [INPUT_BUTTON_RIGHT] = 0x04,
f22d0af0
GH		 1612 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1613 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
14768eba
GH		 1614 };
1615 QemuConsole *con = vs->vd->dcl.con;
bea60dd7
PL		 1616 int width = pixman_image_get_width(vs->vd->server);
1617 int height = pixman_image_get_height(vs->vd->server);
24236869 1618
14768eba
GH		 1619 if (vs->last_bmask != button_mask) {
1620 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1621 vs->last_bmask = button_mask;
1622 }
564c337e
FB		 1623
1624 if (vs->absolute) {
9cfa7ab9
PV		 1625 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1626 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
29fa4ed9 1627 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
14768eba
GH		 1628 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1629 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
564c337e 1630 } else {
14768eba
GH		 1631 if (vs->last_x != -1) {
1632 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1633 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1634 }
28a76be8
AL		 1635 vs->last_x = x;
1636 vs->last_y = y;
24236869 1637 }
14768eba 1638 qemu_input_event_sync();
24236869
FB		 1639}
1640
64f5a135
FB		 1641static void reset_keys(VncState *vs)
1642{
1643 int i;
1644 for(i = 0; i < 256; i++) {
1645 if (vs->modifiers_state[i]) {
8d447d10 1646 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
c5ce8333 1647 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
64f5a135
FB		 1648 vs->modifiers_state[i] = 0;
1649 }
1650 }
1651}
1652
a528b80c
AZ		 1653static void press_key(VncState *vs, int keysym)
1654{
44bb61c8 1655 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
8d447d10 1656 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
c5ce8333 1657 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
8d447d10 1658 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
c5ce8333 1659 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
a528b80c
AZ		 1660}
1661
ab99e5c1
LL		 1662static void vnc_led_state_change(VncState *vs)
1663{
ab99e5c1
LL		 1664 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1665 return;
1666 }
1667
ab99e5c1
LL		 1668 vnc_lock_output(vs);
1669 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1670 vnc_write_u8(vs, 0);
1671 vnc_write_u16(vs, 1);
1672 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
a54f0d2b 1673 vnc_write_u8(vs, vs->vd->ledstate);
ab99e5c1
LL		 1674 vnc_unlock_output(vs);
1675 vnc_flush(vs);
1676}
1677
7ffb82ca
GH		 1678static void kbd_leds(void *opaque, int ledstate)
1679{
a54f0d2b
PO		 1680 VncDisplay *vd = opaque;
1681 VncState *client;
7ffb82ca 1682
40066175
GH		 1683 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1684 (ledstate & QEMU_NUM_LOCK_LED),
1685 (ledstate & QEMU_SCROLL_LOCK_LED));
1686
a54f0d2b
PO		 1687 if (ledstate == vd->ledstate) {
1688 return;
96f3d174 1689 }
ab99e5c1 1690
a54f0d2b
PO		 1691 vd->ledstate = ledstate;
1692
1693 QTAILQ_FOREACH(client, &vd->clients, next) {
1694 vnc_led_state_change(client);
ab99e5c1 1695 }
7ffb82ca
GH		 1696}
1697
9ca313aa 1698static void do_key_event(VncState *vs, int down, int keycode, int sym)
24236869 1699{
64f5a135
FB		 1700 /* QEMU console switch */
1701 switch(keycode) {
1702 case 0x2a: /* Left Shift */
1703 case 0x36: /* Right Shift */
1704 case 0x1d: /* Left CTRL */
1705 case 0x9d: /* Right CTRL */
1706 case 0x38: /* Left ALT */
1707 case 0xb8: /* Right ALT */
1708 if (down)
1709 vs->modifiers_state[keycode] = 1;
1710 else
1711 vs->modifiers_state[keycode] = 0;
1712 break;
5fafdf24 1713 case 0x02 ... 0x0a: /* '1' to '9' keys */
1d0d59fe
GH		 1714 if (vs->vd->dcl.con == NULL &&
1715 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
64f5a135
FB		 1716 /* Reset the modifiers sent to the current console */
1717 reset_keys(vs);
1718 console_select(keycode - 0x02);
1719 return;
1720 }
1721 break;
28a76be8
AL		 1722 case 0x3a: /* CapsLock */
1723 case 0x45: /* NumLock */
7ffb82ca 1724 if (down)
a528b80c
AZ		 1725 vs->modifiers_state[keycode] ^= 1;
1726 break;
1727 }
1728
e7b2aacc
LL		 1729 /* Turn off the lock state sync logic if the client support the led
1730 state extension.
1731 */
9892088b 1732 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1733 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1734 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
a528b80c
AZ		 1735 /* If the numlock state needs to change then simulate an additional
1736 keypress before sending this one. This will happen if the user
1737 toggles numlock away from the VNC window.
1738 */
753b4053 1739 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
a528b80c 1740 if (!vs->modifiers_state[0x45]) {
40066175 1741 trace_vnc_key_sync_numlock(true);
a528b80c
AZ		 1742 vs->modifiers_state[0x45] = 1;
1743 press_key(vs, 0xff7f);
1744 }
1745 } else {
1746 if (vs->modifiers_state[0x45]) {
40066175 1747 trace_vnc_key_sync_numlock(false);
a528b80c
AZ		 1748 vs->modifiers_state[0x45] = 0;
1749 press_key(vs, 0xff7f);
1750 }
1751 }
64f5a135 1752 }
24236869 1753
9892088b 1754 if (down && vs->vd->lock_key_sync &&
e7b2aacc 1755 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
3a0558b5 1756 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
6b132502
GH		 1757 /* If the capslock state needs to change then simulate an additional
1758 keypress before sending this one. This will happen if the user
1759 toggles capslock away from the VNC window.
1760 */
1761 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1762 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1763 int capslock = !!(vs->modifiers_state[0x3a]);
1764 if (capslock) {
1765 if (uppercase == shift) {
40066175 1766 trace_vnc_key_sync_capslock(false);
6b132502
GH		 1767 vs->modifiers_state[0x3a] = 0;
1768 press_key(vs, 0xffe5);
1769 }
1770 } else {
1771 if (uppercase != shift) {
40066175 1772 trace_vnc_key_sync_capslock(true);
6b132502
GH		 1773 vs->modifiers_state[0x3a] = 1;
1774 press_key(vs, 0xffe5);
1775 }
1776 }
1777 }
1778
81c0d5a6 1779 if (qemu_console_is_graphic(NULL)) {
8d447d10 1780 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
c5ce8333 1781 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
64f5a135 1782 } else {
e26437c2
GH		 1783 bool numlock = vs->modifiers_state[0x45];
1784 bool control = (vs->modifiers_state[0x1d] ||
1785 vs->modifiers_state[0x9d]);
64f5a135
FB		 1786 /* QEMU console emulation */
1787 if (down) {
1788 switch (keycode) {
1789 case 0x2a: /* Left Shift */
1790 case 0x36: /* Right Shift */
1791 case 0x1d: /* Left CTRL */
1792 case 0x9d: /* Right CTRL */
1793 case 0x38: /* Left ALT */
1794 case 0xb8: /* Right ALT */
1795 break;
1796 case 0xc8:
1797 kbd_put_keysym(QEMU_KEY_UP);
1798 break;
1799 case 0xd0:
1800 kbd_put_keysym(QEMU_KEY_DOWN);
1801 break;
1802 case 0xcb:
1803 kbd_put_keysym(QEMU_KEY_LEFT);
1804 break;
1805 case 0xcd:
1806 kbd_put_keysym(QEMU_KEY_RIGHT);
1807 break;
1808 case 0xd3:
1809 kbd_put_keysym(QEMU_KEY_DELETE);
1810 break;
1811 case 0xc7:
1812 kbd_put_keysym(QEMU_KEY_HOME);
1813 break;
1814 case 0xcf:
1815 kbd_put_keysym(QEMU_KEY_END);
1816 break;
1817 case 0xc9:
1818 kbd_put_keysym(QEMU_KEY_PAGEUP);
1819 break;
1820 case 0xd1:
1821 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1822 break;
bb0a18e1
GH		 1823
1824 case 0x47:
1825 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1826 break;
1827 case 0x48:
1828 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1829 break;
1830 case 0x49:
1831 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1832 break;
1833 case 0x4b:
1834 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1835 break;
1836 case 0x4c:
1837 kbd_put_keysym('5');
1838 break;
1839 case 0x4d:
1840 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1841 break;
1842 case 0x4f:
1843 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1844 break;
1845 case 0x50:
1846 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1847 break;
1848 case 0x51:
1849 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1850 break;
1851 case 0x52:
1852 kbd_put_keysym('0');
1853 break;
1854 case 0x53:
1855 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1856 break;
1857
1858 case 0xb5:
1859 kbd_put_keysym('/');
1860 break;
1861 case 0x37:
1862 kbd_put_keysym('*');
1863 break;
1864 case 0x4a:
1865 kbd_put_keysym('-');
1866 break;
1867 case 0x4e:
1868 kbd_put_keysym('+');
1869 break;
1870 case 0x9c:
1871 kbd_put_keysym('\n');
1872 break;
1873
64f5a135 1874 default:
e26437c2
GH		 1875 if (control) {
1876 kbd_put_keysym(sym & 0x1f);
1877 } else {
1878 kbd_put_keysym(sym);
1879 }
64f5a135
FB		 1880 break;
1881 }
1882 }
1883 }
24236869
FB		 1884}
1885
7bc9318b
GH		 1886static void vnc_release_modifiers(VncState *vs)
1887{
1888 static const int keycodes[] = {
1889 /* shift, control, alt keys, both left & right */
1890 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1891 };
1892 int i, keycode;
1893
81c0d5a6 1894 if (!qemu_console_is_graphic(NULL)) {
7bc9318b
GH		 1895 return;
1896 }
1897 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1898 keycode = keycodes[i];
1899 if (!vs->modifiers_state[keycode]) {
1900 continue;
1901 }
8d447d10 1902 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
c5ce8333 1903 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
7bc9318b
GH		 1904 }
1905}
1906
40066175
GH		 1907static const char *code2name(int keycode)
1908{
977c736f 1909 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
40066175
GH		 1910}
1911
bdbd7676
FB		 1912static void key_event(VncState *vs, int down, uint32_t sym)
1913{
9ca313aa 1914 int keycode;
4a93fe17 1915 int lsym = sym;
9ca313aa 1916
81c0d5a6 1917 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
4a93fe17
GH		 1918 lsym = lsym - 'A' + 'a';
1919 }
9ca313aa 1920
44bb61c8 1921 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
40066175 1922 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
9ca313aa
AL		 1923 do_key_event(vs, down, keycode, sym);
1924}
1925
1926static void ext_key_event(VncState *vs, int down,
1927 uint32_t sym, uint16_t keycode)
1928{
1929 /* if the user specifies a keyboard layout, always use it */
40066175 1930 if (keyboard_layout) {
9ca313aa 1931 key_event(vs, down, sym);
40066175
GH		 1932 } else {
1933 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
9ca313aa 1934 do_key_event(vs, down, keycode, sym);
40066175 1935 }
bdbd7676
FB		 1936}
1937
24236869 1938static void framebuffer_update_request(VncState *vs, int incremental,
bea60dd7 1939 int x, int y, int w, int h)
24236869 1940{
bea60dd7 1941 if (incremental) {
126617e6
DB		 1942 if (vs->update != VNC_STATE_UPDATE_FORCE) {
1943 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
1944 }
1945 } else {
1946 vs->update = VNC_STATE_UPDATE_FORCE;
1947 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
24236869
FB		 1948 }
1949}
1950
9ca313aa
AL		 1951static void send_ext_key_event_ack(VncState *vs)
1952{
bd023f95 1953 vnc_lock_output(vs);
46a183da 1954 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
9ca313aa
AL		 1955 vnc_write_u8(vs, 0);
1956 vnc_write_u16(vs, 1);
d39fa6d8 1957 vnc_framebuffer_update(vs, 0, 0,
bea60dd7
PL		 1958 pixman_image_get_width(vs->vd->server),
1959 pixman_image_get_height(vs->vd->server),
29fa4ed9 1960 VNC_ENCODING_EXT_KEY_EVENT);
bd023f95 1961 vnc_unlock_output(vs);
9ca313aa
AL		 1962 vnc_flush(vs);
1963}
1964
429a8ed3 1965static void send_ext_audio_ack(VncState *vs)
1966{
bd023f95 1967 vnc_lock_output(vs);
46a183da 1968 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
429a8ed3 1969 vnc_write_u8(vs, 0);
1970 vnc_write_u16(vs, 1);
d39fa6d8 1971 vnc_framebuffer_update(vs, 0, 0,
bea60dd7
PL		 1972 pixman_image_get_width(vs->vd->server),
1973 pixman_image_get_height(vs->vd->server),
29fa4ed9 1974 VNC_ENCODING_AUDIO);
bd023f95 1975 vnc_unlock_output(vs);
429a8ed3 1976 vnc_flush(vs);
1977}
1978
24236869
FB		 1979static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1980{
1981 int i;
29fa4ed9 1982 unsigned int enc = 0;
24236869 1983
29fa4ed9 1984 vs->features = 0;
a9f20d31 1985 vs->vnc_encoding = 0;
d1af0e05
CC		 1986 vs->tight.compression = 9;
1987 vs->tight.quality = -1; /* Lossless by default */
564c337e 1988 vs->absolute = -1;
24236869 1989
8a0f0d0c
CC		 1990 /*
1991 * Start from the end because the encodings are sent in order of preference.
e5bed759 1992 * This way the preferred encoding (first encoding defined in the array)
8a0f0d0c
CC		 1993 * will be set at the end of the loop.
1994 */
24236869 1995 for (i = n_encodings - 1; i >= 0; i--) {
29fa4ed9
AL		 1996 enc = encodings[i];
1997 switch (enc) {
1998 case VNC_ENCODING_RAW:
a9f20d31 1999 vs->vnc_encoding = enc;
29fa4ed9
AL		 2000 break;
2001 case VNC_ENCODING_COPYRECT:
753b4053 2002 vs->features |= VNC_FEATURE_COPYRECT_MASK;
29fa4ed9
AL		 2003 break;
2004 case VNC_ENCODING_HEXTILE:
2005 vs->features |= VNC_FEATURE_HEXTILE_MASK;
a9f20d31 2006 vs->vnc_encoding = enc;
29fa4ed9 2007 break;
380282b0
CC		 2008 case VNC_ENCODING_TIGHT:
2009 vs->features |= VNC_FEATURE_TIGHT_MASK;
2010 vs->vnc_encoding = enc;
2011 break;
fe3e7f2d 2012#ifdef CONFIG_VNC_PNG
efe556ad
CC		 2013 case VNC_ENCODING_TIGHT_PNG:
2014 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2015 vs->vnc_encoding = enc;
2016 break;
fe3e7f2d 2017#endif
059cef40
AL		 2018 case VNC_ENCODING_ZLIB:
2019 vs->features |= VNC_FEATURE_ZLIB_MASK;
a9f20d31 2020 vs->vnc_encoding = enc;
059cef40 2021 break;
148954fa
CC		 2022 case VNC_ENCODING_ZRLE:
2023 vs->features |= VNC_FEATURE_ZRLE_MASK;
2024 vs->vnc_encoding = enc;
2025 break;
2026 case VNC_ENCODING_ZYWRLE:
2027 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2028 vs->vnc_encoding = enc;
2029 break;
29fa4ed9
AL		 2030 case VNC_ENCODING_DESKTOPRESIZE:
2031 vs->features |= VNC_FEATURE_RESIZE_MASK;
2032 break;
2033 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2034 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2035 break;
d467b679
GH		 2036 case VNC_ENCODING_RICH_CURSOR:
2037 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
91ec41dc
FZ		 2038 if (vs->vd->cursor) {
2039 vnc_cursor_define(vs);
2040 }
d467b679 2041 break;
29fa4ed9 2042 case VNC_ENCODING_EXT_KEY_EVENT:
9ca313aa
AL		 2043 send_ext_key_event_ack(vs);
2044 break;
29fa4ed9 2045 case VNC_ENCODING_AUDIO:
429a8ed3 2046 send_ext_audio_ack(vs);
2047 break;
29fa4ed9
AL		 2048 case VNC_ENCODING_WMVi:
2049 vs->features |= VNC_FEATURE_WMVI_MASK;
ca4cca4d 2050 break;
ab99e5c1
LL		 2051 case VNC_ENCODING_LED_STATE:
2052 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2053 break;
fb437313 2054 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
d1af0e05 2055 vs->tight.compression = (enc & 0x0F);
fb437313
AL		 2056 break;
2057 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
b31f519e
CC		 2058 if (vs->vd->lossy) {
2059 vs->tight.quality = (enc & 0x0F);
2060 }
fb437313 2061 break;
29fa4ed9
AL		 2062 default:
2063 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2064 break;
2065 }
24236869 2066 }
6356e472 2067 vnc_desktop_resize(vs);
9e8dd451 2068 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
ab99e5c1 2069 vnc_led_state_change(vs);
24236869
FB		 2070}
2071
6cec5487
AL		 2072static void set_pixel_conversion(VncState *vs)
2073{
9f64916d
GH		 2074 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2075
2076 if (fmt == VNC_SERVER_FB_FORMAT) {
6cec5487 2077 vs->write_pixels = vnc_write_pixels_copy;
70a4568f 2078 vnc_hextile_set_pixel_conversion(vs, 0);
6cec5487
AL		 2079 } else {
2080 vs->write_pixels = vnc_write_pixels_generic;
70a4568f 2081 vnc_hextile_set_pixel_conversion(vs, 1);
6cec5487
AL		 2082 }
2083}
2084
0c426e45
AG		 2085static void send_color_map(VncState *vs)
2086{
2087 int i;
2088
2089 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2090 vnc_write_u8(vs, 0); /* padding */
2091 vnc_write_u16(vs, 0); /* first color */
2092 vnc_write_u16(vs, 256); /* # of colors */
2093
2094 for (i = 0; i < 256; i++) {
2095 PixelFormat *pf = &vs->client_pf;
2096
2097 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2098 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2099 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2100 }
2101}
2102
ec9fb41a 2103static void set_pixel_format(VncState *vs, int bits_per_pixel,
28a76be8
AL		 2104 int big_endian_flag, int true_color_flag,
2105 int red_max, int green_max, int blue_max,
2106 int red_shift, int green_shift, int blue_shift)
24236869 2107{
3512779a 2108 if (!true_color_flag) {
0c426e45
AG		 2109 /* Expose a reasonable default 256 color map */
2110 bits_per_pixel = 8;
0c426e45
AG		 2111 red_max = 7;
2112 green_max = 7;
2113 blue_max = 3;
2114 red_shift = 0;
2115 green_shift = 3;
2116 blue_shift = 6;
3512779a 2117 }
24236869 2118
e6908bfe
PM		 2119 switch (bits_per_pixel) {
2120 case 8:
2121 case 16:
2122 case 32:
2123 break;
2124 default:
2125 vnc_client_error(vs);
2126 return;
2127 }
2128
4c65fed8 2129 vs->client_pf.rmax = red_max ? red_max : 0xFF;
7c9209e7 2130 vs->client_pf.rbits = ctpopl(red_max);
9f64916d
GH		 2131 vs->client_pf.rshift = red_shift;
2132 vs->client_pf.rmask = red_max << red_shift;
4c65fed8 2133 vs->client_pf.gmax = green_max ? green_max : 0xFF;
7c9209e7 2134 vs->client_pf.gbits = ctpopl(green_max);
9f64916d
GH		 2135 vs->client_pf.gshift = green_shift;
2136 vs->client_pf.gmask = green_max << green_shift;
4c65fed8 2137 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
7c9209e7 2138 vs->client_pf.bbits = ctpopl(blue_max);
9f64916d
GH		 2139 vs->client_pf.bshift = blue_shift;
2140 vs->client_pf.bmask = blue_max << blue_shift;
2141 vs->client_pf.bits_per_pixel = bits_per_pixel;
2142 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2143 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2144 vs->client_be = big_endian_flag;
6cec5487 2145
0c426e45
AG		 2146 if (!true_color_flag) {
2147 send_color_map(vs);
2148 }
2149
6cec5487 2150 set_pixel_conversion(vs);
24236869 2151
1d0d59fe
GH		 2152 graphic_hw_invalidate(vs->vd->dcl.con);
2153 graphic_hw_update(vs->vd->dcl.con);
24236869
FB		 2154}
2155
ca4cca4d
AL		 2156static void pixel_format_message (VncState *vs) {
2157 char pad[3] = { 0, 0, 0 };
2158
9f64916d
GH		 2159 vs->client_pf = qemu_default_pixelformat(32);
2160
2161 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2162 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
ca4cca4d 2163
e2542fe2 2164#ifdef HOST_WORDS_BIGENDIAN
ca4cca4d
AL		 2165 vnc_write_u8(vs, 1); /* big-endian-flag */
2166#else
2167 vnc_write_u8(vs, 0); /* big-endian-flag */
2168#endif
2169 vnc_write_u8(vs, 1); /* true-color-flag */
9f64916d
GH		 2170 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2171 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2172 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2173 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2174 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2175 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2176 vnc_write(vs, pad, 3); /* padding */
70a4568f
CC		 2177
2178 vnc_hextile_set_pixel_conversion(vs, 0);
ca4cca4d 2179 vs->write_pixels = vnc_write_pixels_copy;
ca4cca4d
AL		 2180}
2181
753b4053 2182static void vnc_colordepth(VncState *vs)
7eac3a87 2183{
753b4053 2184 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
ca4cca4d 2185 /* Sending a WMVi message to notify the client*/
bd023f95 2186 vnc_lock_output(vs);
46a183da 2187 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
ca4cca4d
AL		 2188 vnc_write_u8(vs, 0);
2189 vnc_write_u16(vs, 1); /* number of rects */
d39fa6d8 2190 vnc_framebuffer_update(vs, 0, 0,
bea60dd7
PL		 2191 pixman_image_get_width(vs->vd->server),
2192 pixman_image_get_height(vs->vd->server),
d39fa6d8 2193 VNC_ENCODING_WMVi);
ca4cca4d 2194 pixel_format_message(vs);
bd023f95 2195 vnc_unlock_output(vs);
ca4cca4d 2196 vnc_flush(vs);
7eac3a87 2197 } else {
6cec5487 2198 set_pixel_conversion(vs);
7eac3a87
AL		 2199 }
2200}
2201
60fe76f3 2202static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
24236869
FB		 2203{
2204 int i;
2205 uint16_t limit;
2430ffe4
SS		 2206 VncDisplay *vd = vs->vd;
2207
2208 if (data[0] > 3) {
0f7b2864 2209 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2430ffe4 2210 }
24236869
FB		 2211
2212 switch (data[0]) {
46a183da 2213 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
28a76be8
AL		 2214 if (len == 1)
2215 return 20;
2216
ec9fb41a 2217 set_pixel_format(vs, read_u8(data, 4),
28a76be8
AL		 2218 read_u8(data, 6), read_u8(data, 7),
2219 read_u16(data, 8), read_u16(data, 10),
2220 read_u16(data, 12), read_u8(data, 14),
2221 read_u8(data, 15), read_u8(data, 16));
2222 break;
46a183da 2223 case VNC_MSG_CLIENT_SET_ENCODINGS:
28a76be8
AL		 2224 if (len == 1)
2225 return 4;
24236869 2226
28a76be8 2227 if (len == 4) {
69dd5c9f
AL		 2228 limit = read_u16(data, 2);
2229 if (limit > 0)
2230 return 4 + (limit * 4);
2231 } else
2232 limit = read_u16(data, 2);
24236869 2233
28a76be8
AL		 2234 for (i = 0; i < limit; i++) {
2235 int32_t val = read_s32(data, 4 + (i * 4));
2236 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2237 }
24236869 2238
28a76be8
AL		 2239 set_encodings(vs, (int32_t *)(data + 4), limit);
2240 break;
46a183da 2241 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
28a76be8
AL		 2242 if (len == 1)
2243 return 10;
24236869 2244
28a76be8
AL		 2245 framebuffer_update_request(vs,
2246 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2247 read_u16(data, 6), read_u16(data, 8));
2248 break;
46a183da 2249 case VNC_MSG_CLIENT_KEY_EVENT:
28a76be8
AL		 2250 if (len == 1)
2251 return 8;
24236869 2252
28a76be8
AL		 2253 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2254 break;
46a183da 2255 case VNC_MSG_CLIENT_POINTER_EVENT:
28a76be8
AL		 2256 if (len == 1)
2257 return 6;
24236869 2258
28a76be8
AL		 2259 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2260 break;
46a183da 2261 case VNC_MSG_CLIENT_CUT_TEXT:
f9a70e79 2262 if (len == 1) {
28a76be8 2263 return 8;
f9a70e79 2264 }
28a76be8 2265 if (len == 8) {
baa7666c 2266 uint32_t dlen = read_u32(data, 4);
f9a70e79
PL		 2267 if (dlen > (1 << 20)) {
2268 error_report("vnc: client_cut_text msg payload has %u bytes"
2269 " which exceeds our limit of 1MB.", dlen);
2270 vnc_client_error(vs);
2271 break;
2272 }
2273 if (dlen > 0) {
baa7666c 2274 return 8 + dlen;
f9a70e79 2275 }
baa7666c 2276 }
24236869 2277
28a76be8
AL		 2278 client_cut_text(vs, read_u32(data, 4), data + 8);
2279 break;
46a183da 2280 case VNC_MSG_CLIENT_QEMU:
9ca313aa
AL		 2281 if (len == 1)
2282 return 2;
2283
2284 switch (read_u8(data, 1)) {
46a183da 2285 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
9ca313aa
AL		 2286 if (len == 2)
2287 return 12;
2288
2289 ext_key_event(vs, read_u16(data, 2),
2290 read_u32(data, 4), read_u32(data, 8));
2291 break;
46a183da 2292 case VNC_MSG_CLIENT_QEMU_AUDIO:
429a8ed3 2293 if (len == 2)
2294 return 4;
2295
2296 switch (read_u16 (data, 2)) {
46a183da 2297 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
429a8ed3 2298 audio_add(vs);
2299 break;
46a183da 2300 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
429a8ed3 2301 audio_del(vs);
2302 break;
46a183da 2303 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
429a8ed3 2304 if (len == 4)
2305 return 10;
2306 switch (read_u8(data, 4)) {
2307 case 0: vs->as.fmt = AUD_FMT_U8; break;
2308 case 1: vs->as.fmt = AUD_FMT_S8; break;
2309 case 2: vs->as.fmt = AUD_FMT_U16; break;
2310 case 3: vs->as.fmt = AUD_FMT_S16; break;
2311 case 4: vs->as.fmt = AUD_FMT_U32; break;
2312 case 5: vs->as.fmt = AUD_FMT_S32; break;
2313 default:
153130cd 2314 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
429a8ed3 2315 vnc_client_error(vs);
2316 break;
2317 }
2318 vs->as.nchannels = read_u8(data, 5);
2319 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
153130cd
DB		 2320 VNC_DEBUG("Invalid audio channel coount %d\n",
2321 read_u8(data, 5));
429a8ed3 2322 vnc_client_error(vs);
2323 break;
2324 }
2325 vs->as.freq = read_u32(data, 6);
2326 break;
2327 default:
153130cd 2328 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
429a8ed3 2329 vnc_client_error(vs);
2330 break;
2331 }
2332 break;
2333
9ca313aa 2334 default:
153130cd 2335 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
9ca313aa
AL		 2336 vnc_client_error(vs);
2337 break;
2338 }
2339 break;
24236869 2340 default:
153130cd 2341 VNC_DEBUG("Msg: %d\n", data[0]);
28a76be8
AL		 2342 vnc_client_error(vs);
2343 break;
24236869 2344 }
5fafdf24 2345
f9c87678 2346 vnc_update_throttle_offset(vs);
24236869
FB		 2347 vnc_read_when(vs, protocol_client_msg, 1);
2348 return 0;
2349}
2350
60fe76f3 2351static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
24236869 2352{
c35734b2 2353 char buf[1024];
8cf36489 2354 VncShareMode mode;
c35734b2 2355 int size;
24236869 2356
8cf36489
GH		 2357 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2358 switch (vs->vd->share_policy) {
2359 case VNC_SHARE_POLICY_IGNORE:
2360 /*
2361 * Ignore the shared flag. Nothing to do here.
2362 *
2363 * Doesn't conform to the rfb spec but is traditional qemu
2364 * behavior, thus left here as option for compatibility
2365 * reasons.
2366 */
2367 break;
2368 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2369 /*
2370 * Policy: Allow clients ask for exclusive access.
2371 *
2372 * Implementation: When a client asks for exclusive access,
2373 * disconnect all others. Shared connects are allowed as long
2374 * as no exclusive connection exists.
2375 *
2376 * This is how the rfb spec suggests to handle the shared flag.
2377 */
2378 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2379 VncState *client;
2380 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2381 if (vs == client) {
2382 continue;
2383 }
2384 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2385 client->share_mode != VNC_SHARE_MODE_SHARED) {
2386 continue;
2387 }
2388 vnc_disconnect_start(client);
2389 }
2390 }
2391 if (mode == VNC_SHARE_MODE_SHARED) {
2392 if (vs->vd->num_exclusive > 0) {
2393 vnc_disconnect_start(vs);
2394 return 0;
2395 }
2396 }
2397 break;
2398 case VNC_SHARE_POLICY_FORCE_SHARED:
2399 /*
2400 * Policy: Shared connects only.
2401 * Implementation: Disallow clients asking for exclusive access.
2402 *
2403 * Useful for shared desktop sessions where you don't want
2404 * someone forgetting to say -shared when running the vnc
2405 * client disconnect everybody else.
2406 */
2407 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2408 vnc_disconnect_start(vs);
2409 return 0;
2410 }
2411 break;
2412 }
2413 vnc_set_share_mode(vs, mode);
2414
e5f34cdd
GH		 2415 if (vs->vd->num_shared > vs->vd->connections_limit) {
2416 vnc_disconnect_start(vs);
2417 return 0;
2418 }
2419
bea60dd7
PL		 2420 vs->client_width = pixman_image_get_width(vs->vd->server);
2421 vs->client_height = pixman_image_get_height(vs->vd->server);
5862d195
GH		 2422 vnc_write_u16(vs, vs->client_width);
2423 vnc_write_u16(vs, vs->client_height);
24236869 2424
ca4cca4d 2425 pixel_format_message(vs);
24236869 2426
97efe4f9 2427 if (qemu_name) {
c35734b2 2428 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
97efe4f9
TH		 2429 if (size > sizeof(buf)) {
2430 size = sizeof(buf);
2431 }
2432 } else {
c35734b2 2433 size = snprintf(buf, sizeof(buf), "QEMU");
97efe4f9 2434 }
c35734b2
TS		 2435
2436 vnc_write_u32(vs, size);
2437 vnc_write(vs, buf, size);
24236869
FB		 2438 vnc_flush(vs);
2439
4a80dba3 2440 vnc_client_cache_auth(vs);
fb6ba0d5 2441 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
4a80dba3 2442
24236869
FB		 2443 vnc_read_when(vs, protocol_client_msg, 1);
2444
2445 return 0;
2446}
2447
5fb6c7a8
AL		 2448void start_client_init(VncState *vs)
2449{
2450 vnc_read_when(vs, protocol_client_init, 1);
2451}
2452
70848515
TS		 2453static void make_challenge(VncState *vs)
2454{
2455 int i;
2456
2457 srand(time(NULL)+getpid()+getpid()*987654+rand());
2458
2459 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2460 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2461}
2462
60fe76f3 2463static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
70848515 2464{
60fe76f3 2465 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
800567a6 2466 size_t i, pwlen;
60fe76f3 2467 unsigned char key[8];
3c9405a0 2468 time_t now = time(NULL);
60928458 2469 QCryptoCipher *cipher = NULL;
800567a6 2470 Error *err = NULL;
70848515 2471
1cd20f8b 2472 if (!vs->vd->password) {
7364dbda 2473 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
6bffdf0f 2474 goto reject;
70848515 2475 }
3c9405a0 2476 if (vs->vd->expires < now) {
7364dbda 2477 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
3c9405a0
GH		 2478 goto reject;
2479 }
70848515
TS		 2480
2481 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2482
2483 /* Calculate the expected challenge response */
753b4053 2484 pwlen = strlen(vs->vd->password);
70848515 2485 for (i=0; i<sizeof(key); i++)
753b4053 2486 key[i] = i<pwlen ? vs->vd->password[i] : 0;
800567a6
DB		 2487
2488 cipher = qcrypto_cipher_new(
2489 QCRYPTO_CIPHER_ALG_DES_RFB,
2490 QCRYPTO_CIPHER_MODE_ECB,
2491 key, G_N_ELEMENTS(key),
2492 &err);
2493 if (!cipher) {
7364dbda
DB		 2494 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2495 error_get_pretty(err));
800567a6
DB		 2496 error_free(err);
2497 goto reject;
2498 }
2499
a1695137 2500 if (qcrypto_cipher_encrypt(cipher,
800567a6
DB		 2501 vs->challenge,
2502 response,
2503 VNC_AUTH_CHALLENGE_SIZE,
2504 &err) < 0) {
7364dbda
DB		 2505 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2506 error_get_pretty(err));
800567a6
DB		 2507 error_free(err);
2508 goto reject;
2509 }
70848515
TS		 2510
2511 /* Compare expected vs actual challenge response */
2512 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
7364dbda 2513 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
6bffdf0f 2514 goto reject;
70848515 2515 } else {
7364dbda 2516 trace_vnc_auth_pass(vs, vs->auth);
28a76be8
AL		 2517 vnc_write_u32(vs, 0); /* Accept auth */
2518 vnc_flush(vs);
70848515 2519
5fb6c7a8 2520 start_client_init(vs);
70848515 2521 }
60928458
GA		 2522
2523 qcrypto_cipher_free(cipher);
70848515 2524 return 0;
6bffdf0f
GH		 2525
2526reject:
2527 vnc_write_u32(vs, 1); /* Reject auth */
2528 if (vs->minor >= 8) {
2529 static const char err[] = "Authentication failed";
2530 vnc_write_u32(vs, sizeof(err));
2531 vnc_write(vs, err, sizeof(err));
2532 }
2533 vnc_flush(vs);
2534 vnc_client_error(vs);
60928458 2535 qcrypto_cipher_free(cipher);
6bffdf0f 2536 return 0;
70848515
TS		 2537}
2538
5fb6c7a8 2539void start_auth_vnc(VncState *vs)
70848515
TS		 2540{
2541 make_challenge(vs);
2542 /* Send client a 'random' challenge */
2543 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2544 vnc_flush(vs);
2545
2546 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
469b15c6
TS		 2547}
2548
2549
60fe76f3 2550static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
70848515
TS		 2551{
2552 /* We only advertise 1 auth scheme at a time, so client
2553 * must pick the one we sent. Verify this */
7e7e2ebc 2554 if (data[0] != vs->auth) { /* Reject auth */
7364dbda 2555 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
70848515
TS		 2556 vnc_write_u32(vs, 1);
2557 if (vs->minor >= 8) {
2558 static const char err[] = "Authentication failed";
2559 vnc_write_u32(vs, sizeof(err));
2560 vnc_write(vs, err, sizeof(err));
2561 }
2562 vnc_client_error(vs);
2563 } else { /* Accept requested auth */
7364dbda 2564 trace_vnc_auth_start(vs, vs->auth);
7e7e2ebc 2565 switch (vs->auth) {
70848515 2566 case VNC_AUTH_NONE:
a26c97ad
AZ		 2567 if (vs->minor >= 8) {
2568 vnc_write_u32(vs, 0); /* Accept auth completion */
2569 vnc_flush(vs);
2570 }
7364dbda 2571 trace_vnc_auth_pass(vs, vs->auth);
5fb6c7a8 2572 start_client_init(vs);
70848515
TS		 2573 break;
2574
2575 case VNC_AUTH_VNC:
5fb6c7a8
AL		 2576 start_auth_vnc(vs);
2577 break;
70848515 2578
8d5d2d4c 2579 case VNC_AUTH_VENCRYPT:
5fb6c7a8
AL		 2580 start_auth_vencrypt(vs);
2581 break;
8d5d2d4c 2582
2f9606b3
AL		 2583#ifdef CONFIG_VNC_SASL
2584 case VNC_AUTH_SASL:
2f9606b3
AL		 2585 start_auth_sasl(vs);
2586 break;
2587#endif /* CONFIG_VNC_SASL */
2588
70848515 2589 default: /* Should not be possible, but just in case */
7364dbda 2590 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
70848515
TS		 2591 vnc_write_u8(vs, 1);
2592 if (vs->minor >= 8) {
2593 static const char err[] = "Authentication failed";
2594 vnc_write_u32(vs, sizeof(err));
2595 vnc_write(vs, err, sizeof(err));
2596 }
2597 vnc_client_error(vs);
2598 }
2599 }
2600 return 0;
2601}
2602
60fe76f3 2603static int protocol_version(VncState *vs, uint8_t *version, size_t len)
24236869
FB		 2604{
2605 char local[13];
24236869
FB		 2606
2607 memcpy(local, version, 12);
2608 local[12] = 0;
2609
70848515 2610 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
28a76be8
AL		 2611 VNC_DEBUG("Malformed protocol version %s\n", local);
2612 vnc_client_error(vs);
2613 return 0;
24236869 2614 }
70848515
TS		 2615 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2616 if (vs->major != 3 ||
28a76be8
AL		 2617 (vs->minor != 3 &&
2618 vs->minor != 4 &&
2619 vs->minor != 5 &&
2620 vs->minor != 7 &&
2621 vs->minor != 8)) {
2622 VNC_DEBUG("Unsupported client version\n");
2623 vnc_write_u32(vs, VNC_AUTH_INVALID);
2624 vnc_flush(vs);
2625 vnc_client_error(vs);
2626 return 0;
70848515 2627 }
b0566f4f 2628 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
70848515
TS		 2629 * as equivalent to v3.3 by servers
2630 */
b0566f4f 2631 if (vs->minor == 4 || vs->minor == 5)
28a76be8 2632 vs->minor = 3;
70848515
TS		 2633
2634 if (vs->minor == 3) {
7364dbda 2635 trace_vnc_auth_start(vs, vs->auth);
7e7e2ebc 2636 if (vs->auth == VNC_AUTH_NONE) {
7e7e2ebc 2637 vnc_write_u32(vs, vs->auth);
70848515 2638 vnc_flush(vs);
7364dbda 2639 trace_vnc_auth_pass(vs, vs->auth);
28a76be8 2640 start_client_init(vs);
7e7e2ebc 2641 } else if (vs->auth == VNC_AUTH_VNC) {
70848515 2642 VNC_DEBUG("Tell client VNC auth\n");
7e7e2ebc 2643 vnc_write_u32(vs, vs->auth);
70848515
TS		 2644 vnc_flush(vs);
2645 start_auth_vnc(vs);
2646 } else {
7364dbda
DB		 2647 trace_vnc_auth_fail(vs, vs->auth,
2648 "Unsupported auth method for v3.3", "");
70848515
TS		 2649 vnc_write_u32(vs, VNC_AUTH_INVALID);
2650 vnc_flush(vs);
2651 vnc_client_error(vs);
2652 }
2653 } else {
28a76be8 2654 vnc_write_u8(vs, 1); /* num auth */
7e7e2ebc 2655 vnc_write_u8(vs, vs->auth);
28a76be8
AL		 2656 vnc_read_when(vs, protocol_client_auth, 1);
2657 vnc_flush(vs);
70848515 2658 }
24236869
FB		 2659
2660 return 0;
2661}
2662
999342a0
CC		 2663static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2664{
2665 struct VncSurface *vs = &vd->guest;
2666
2667 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2668}
2669
7d964c9d
CC		 2670void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2671{
2672 int i, j;
2673
2674 w = (x + w) / VNC_STAT_RECT;
2675 h = (y + h) / VNC_STAT_RECT;
2676 x /= VNC_STAT_RECT;
2677 y /= VNC_STAT_RECT;
2678
207f328a
CC		 2679 for (j = y; j <= h; j++) {
2680 for (i = x; i <= w; i++) {
7d964c9d
CC		 2681 vs->lossy_rect[j][i] = 1;
2682 }
2683 }
2684}
2685
2686static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2687{
2688 VncState *vs;
2689 int sty = y / VNC_STAT_RECT;
2690 int stx = x / VNC_STAT_RECT;
2691 int has_dirty = 0;
2692
5a3804db
MAL		 2693 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2694 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
7d964c9d
CC		 2695
2696 QTAILQ_FOREACH(vs, &vd->clients, next) {
bc2429b9 2697 int j;
7d964c9d
CC		 2698
2699 /* kernel send buffers are full -> refresh later */
2700 if (vs->output.offset) {
2701 continue;
2702 }
2703
2704 if (!vs->lossy_rect[sty][stx]) {
2705 continue;
2706 }
207f328a 2707
7d964c9d
CC		 2708 vs->lossy_rect[sty][stx] = 0;
2709 for (j = 0; j < VNC_STAT_RECT; ++j) {
b4c85ddc
PL		 2710 bitmap_set(vs->dirty[y + j],
2711 x / VNC_DIRTY_PIXELS_PER_BIT,
2712 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
7d964c9d
CC		 2713 }
2714 has_dirty++;
2715 }
207f328a 2716
7d964c9d
CC		 2717 return has_dirty;
2718}
2719
2720static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
999342a0 2721{
eebe0b79
GH		 2722 int width = MIN(pixman_image_get_width(vd->guest.fb),
2723 pixman_image_get_width(vd->server));
2724 int height = MIN(pixman_image_get_height(vd->guest.fb),
2725 pixman_image_get_height(vd->server));
999342a0
CC		 2726 int x, y;
2727 struct timeval res;
7d964c9d 2728 int has_dirty = 0;
999342a0 2729
9f64916d
GH		 2730 for (y = 0; y < height; y += VNC_STAT_RECT) {
2731 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 2732 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2733
2734 rect->updated = false;
2735 }
2736 }
2737
ad620c29 2738 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
999342a0
CC		 2739
2740 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
7d964c9d 2741 return has_dirty;
999342a0
CC		 2742 }
2743 vd->guest.last_freq_check = *tv;
2744
9f64916d
GH		 2745 for (y = 0; y < height; y += VNC_STAT_RECT) {
2746 for (x = 0; x < width; x += VNC_STAT_RECT) {
999342a0
CC		 2747 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2748 int count = ARRAY_SIZE(rect->times);
2749 struct timeval min, max;
2750
2751 if (!timerisset(&rect->times[count - 1])) {
2752 continue ;
2753 }
2754
2755 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 2756 qemu_timersub(tv, &max, &res);
999342a0
CC		 2757
2758 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2759 rect->freq = 0;
7d964c9d 2760 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
999342a0
CC		 2761 memset(rect->times, 0, sizeof (rect->times));
2762 continue ;
2763 }
2764
2765 min = rect->times[rect->idx];
2766 max = rect->times[(rect->idx + count - 1) % count];
ad620c29 2767 qemu_timersub(&max, &min, &res);
999342a0
CC		 2768
2769 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2770 rect->freq /= count;
2771 rect->freq = 1. / rect->freq;
2772 }
2773 }
7d964c9d 2774 return has_dirty;
999342a0
CC		 2775}
2776
2777double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2778{
2779 int i, j;
2780 double total = 0;
2781 int num = 0;
2782
5a3804db
MAL		 2783 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2784 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
999342a0
CC		 2785
2786 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2787 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2788 total += vnc_stat_rect(vs->vd, i, j)->freq;
2789 num++;
2790 }
2791 }
2792
2793 if (num) {
2794 return total / num;
2795 } else {
2796 return 0;
2797 }
2798}
2799
2800static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2801{
2802 VncRectStat *rect;
2803
2804 rect = vnc_stat_rect(vd, x, y);
2805 if (rect->updated) {
2806 return ;
2807 }
2808 rect->times[rect->idx] = *tv;
2809 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2810 rect->updated = true;
2811}
2812
1fc62412
SS		 2813static int vnc_refresh_server_surface(VncDisplay *vd)
2814{
bea60dd7
PL		 2815 int width = MIN(pixman_image_get_width(vd->guest.fb),
2816 pixman_image_get_width(vd->server));
2817 int height = MIN(pixman_image_get_height(vd->guest.fb),
2818 pixman_image_get_height(vd->server));
eb8934b0 2819 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
12b316d4 2820 uint8_t *guest_row0 = NULL, *server_row0;
41b4bef6 2821 VncState *vs;
1fc62412 2822 int has_dirty = 0;
9f64916d 2823 pixman_image_t *tmpbuf = NULL;
1fc62412 2824
80e0c8c3 2825 struct timeval tv = { 0, 0 };
999342a0 2826
80e0c8c3
CC		 2827 if (!vd->non_adaptive) {
2828 gettimeofday(&tv, NULL);
2829 has_dirty = vnc_update_stats(vd, &tv);
2830 }
999342a0 2831
1fc62412
SS		 2832 /*
2833 * Walk through the guest dirty map.
2834 * Check and copy modified bits from guest to server surface.
2835 * Update server dirty map.
2836 */
bea60dd7 2837 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
eb8934b0
GH		 2838 server_stride = guest_stride = guest_ll =
2839 pixman_image_get_stride(vd->server);
bea60dd7
PL		 2840 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2841 server_stride);
9f64916d
GH		 2842 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2843 int width = pixman_image_get_width(vd->server);
2844 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
12b316d4 2845 } else {
eb8934b0
GH		 2846 int guest_bpp =
2847 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
12b316d4
PL		 2848 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2849 guest_stride = pixman_image_get_stride(vd->guest.fb);
659c90ee 2850 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8));
12b316d4 2851 }
eb8934b0 2852 line_bytes = MIN(server_stride, guest_ll);
12b316d4 2853
12b316d4
PL		 2854 for (;;) {
2855 int x;
2856 uint8_t *guest_ptr, *server_ptr;
2857 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2858 height * VNC_DIRTY_BPL(&vd->guest),
2859 y * VNC_DIRTY_BPL(&vd->guest));
2860 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2861 /* no more dirty bits */
2862 break;
2863 }
2864 y = offset / VNC_DIRTY_BPL(&vd->guest);
2865 x = offset % VNC_DIRTY_BPL(&vd->guest);
1fc62412 2866
12b316d4
PL		 2867 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2868
2869 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2870 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2871 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2872 } else {
2873 guest_ptr = guest_row0 + y * guest_stride;
2874 }
2875 guest_ptr += x * cmp_bytes;
2876
2877 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2878 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
bea60dd7 2879 int _cmp_bytes = cmp_bytes;
12b316d4
PL		 2880 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2881 continue;
2882 }
eb8934b0
GH		 2883 if ((x + 1) * cmp_bytes > line_bytes) {
2884 _cmp_bytes = line_bytes - x * cmp_bytes;
bea60dd7 2885 }
eb8934b0 2886 assert(_cmp_bytes >= 0);
bea60dd7 2887 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
12b316d4
PL		 2888 continue;
2889 }
bea60dd7 2890 memcpy(server_ptr, guest_ptr, _cmp_bytes);
12b316d4
PL		 2891 if (!vd->non_adaptive) {
2892 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2893 y, &tv);
1fc62412 2894 }
12b316d4
PL		 2895 QTAILQ_FOREACH(vs, &vd->clients, next) {
2896 set_bit(x, vs->dirty[y]);
2897 }
2898 has_dirty++;
1fc62412 2899 }
12b316d4
PL		 2900
2901 y++;
1fc62412 2902 }
9f64916d 2903 qemu_pixman_image_unref(tmpbuf);
1fc62412
SS		 2904 return has_dirty;
2905}
2906
0f7b2864 2907static void vnc_refresh(DisplayChangeListener *dcl)
703bc68f 2908{
0f7b2864 2909 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
41b4bef6
AS		 2910 VncState *vs, *vn;
2911 int has_dirty, rects = 0;
703bc68f 2912
9d6b2070
C		 2913 if (QTAILQ_EMPTY(&vd->clients)) {
2914 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2915 return;
2916 }
2917
1d0d59fe 2918 graphic_hw_update(vd->dcl.con);
703bc68f 2919
bd023f95 2920 if (vnc_trylock_display(vd)) {
0f7b2864 2921 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
bd023f95
CC		 2922 return;
2923 }
2924
1fc62412 2925 has_dirty = vnc_refresh_server_surface(vd);
bd023f95 2926 vnc_unlock_display(vd);
1fc62412 2927
41b4bef6 2928 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
0181686a 2929 rects += vnc_update_client(vs, has_dirty);
6185c578 2930 /* vs might be free()ed here */
703bc68f 2931 }
bd023f95 2932
2430ffe4 2933 if (has_dirty && rects) {
0f7b2864
GH		 2934 vd->dcl.update_interval /= 2;
2935 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2936 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2937 }
2430ffe4 2938 } else {
0f7b2864
GH		 2939 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2940 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2941 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2942 }
703bc68f
SS		 2943 }
2944}
2945
04d2529d 2946static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
2c8cf549 2947 bool skipauth, bool websocket)
3aa3eea3 2948{
fedf0d35 2949 VncState *vs = g_new0(VncState, 1);
90cd03a3 2950 bool first_client = QTAILQ_EMPTY(&vd->clients);
7d964c9d
CC		 2951 int i;
2952
ad6374c4 2953 trace_vnc_client_connect(vs, sioc);
04d2529d
DB		 2954 vs->sioc = sioc;
2955 object_ref(OBJECT(vs->sioc));
2956 vs->ioc = QIO_CHANNEL(sioc);
2957 object_ref(OBJECT(vs->ioc));
d616ccc5 2958 vs->vd = vd;
7e7e2ebc 2959
04d2529d
DB		 2960 buffer_init(&vs->input, "vnc-input/%p", sioc);
2961 buffer_init(&vs->output, "vnc-output/%p", sioc);
04d2529d 2962 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
543b9580 2963
04d2529d
DB		 2964 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
2965 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
2966 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
543b9580 2967#ifdef CONFIG_VNC_JPEG
04d2529d 2968 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
543b9580
GH		 2969#endif
2970#ifdef CONFIG_VNC_PNG
04d2529d 2971 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
543b9580 2972#endif
04d2529d
DB		 2973 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
2974 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
2975 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
2976 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
543b9580 2977
7e7e2ebc
DB		 2978 if (skipauth) {
2979 vs->auth = VNC_AUTH_NONE;
7e7e2ebc 2980 vs->subauth = VNC_AUTH_INVALID;
7e7e2ebc 2981 } else {
f9148c8a
DB		 2982 if (websocket) {
2983 vs->auth = vd->ws_auth;
2984 vs->subauth = VNC_AUTH_INVALID;
2985 } else {
2986 vs->auth = vd->auth;
2987 vs->subauth = vd->subauth;
2988 }
7e7e2ebc 2989 }
04d2529d
DB		 2990 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
2991 sioc, websocket, vs->auth, vs->subauth);
7e7e2ebc 2992
7267c094 2993 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
7d964c9d 2994 for (i = 0; i < VNC_STAT_ROWS; ++i) {
fedf0d35 2995 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
7d964c9d 2996 }
753b4053 2997
04d2529d 2998 VNC_DEBUG("New client on socket %p\n", vs->sioc);
0f7b2864 2999 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
04d2529d 3000 qio_channel_set_blocking(vs->ioc, false, NULL);
a75d6f07
BC		 3001 if (vs->ioc_tag) {
3002 g_source_remove(vs->ioc_tag);
3003 }
7536ee4b
TH		 3004 if (websocket) {
3005 vs->websocket = 1;
38e5756a 3006 if (vd->tlscreds) {
04d2529d
DB		 3007 vs->ioc_tag = qio_channel_add_watch(
3008 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3e305e4a 3009 } else {
04d2529d
DB		 3010 vs->ioc_tag = qio_channel_add_watch(
3011 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
0057a0d5 3012 }
04d2529d
DB		 3013 } else {
3014 vs->ioc_tag = qio_channel_add_watch(
3015 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
7536ee4b 3016 }
753b4053 3017
4a80dba3 3018 vnc_client_cache_addr(vs);
fb6ba0d5 3019 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
8cf36489 3020 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
4a80dba3 3021
753b4053
AL		 3022 vs->last_x = -1;
3023 vs->last_y = -1;
3024
3025 vs->as.freq = 44100;
3026 vs->as.nchannels = 2;
3027 vs->as.fmt = AUD_FMT_S16;
3028 vs->as.endianness = 0;
3029
bd023f95 3030 qemu_mutex_init(&vs->output_mutex);
175b2a6e 3031 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
bd023f95 3032
e5f34cdd 3033 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
c7628bff
GH		 3034 if (first_client) {
3035 vnc_update_server_surface(vd);
3036 }
1fc62412 3037
1d0d59fe 3038 graphic_hw_update(vd->dcl.con);
1fc62412 3039
90cd03a3 3040 if (!vs->websocket) {
dbee9897 3041 vnc_start_protocol(vs);
90cd03a3
DB		 3042 }
3043
3044 if (vd->num_connecting > vd->connections_limit) {
3045 QTAILQ_FOREACH(vs, &vd->clients, next) {
3046 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3047 vnc_disconnect_start(vs);
3048 return;
3049 }
3050 }
3051 }
3052}
3053
dbee9897 3054void vnc_start_protocol(VncState *vs)
90cd03a3 3055{
3aa3eea3
AZ		 3056 vnc_write(vs, "RFB 003.008\n", 12);
3057 vnc_flush(vs);
3058 vnc_read_when(vs, protocol_version, 12);
753b4053 3059
37c34d9d
AL		 3060 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3061 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3aa3eea3
AZ		 3062}
3063
04d2529d
DB		 3064static gboolean vnc_listen_io(QIOChannel *ioc,
3065 GIOCondition condition,
3066 void *opaque)
24236869 3067{
bf01c179 3068 VncDisplay *vd = opaque;
04d2529d
DB		 3069 QIOChannelSocket *sioc = NULL;
3070 Error *err = NULL;
4ee74fa7
DB		 3071 bool isWebsock = false;
3072 size_t i;
3073
3074 for (i = 0; i < vd->nlwebsock; i++) {
3075 if (ioc == QIO_CHANNEL(vd->lwebsock[i])) {
3076 isWebsock = true;
3077 break;
3078 }
3079 }
24236869 3080
04d2529d
DB		 3081 sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc), &err);
3082 if (sioc != NULL) {
10bcfe58 3083 qio_channel_set_name(QIO_CHANNEL(sioc),
4ee74fa7 3084 isWebsock ? "vnc-ws-server" : "vnc-server");
04d2529d 3085 qio_channel_set_delay(QIO_CHANNEL(sioc), false);
4ee74fa7 3086 vnc_connect(vd, sioc, false, isWebsock);
04d2529d 3087 object_unref(OBJECT(sioc));
8e9b0d24 3088 } else {
04d2529d
DB		 3089 /* client probably closed connection before we got there */
3090 error_free(err);
24236869 3091 }
7536ee4b 3092
04d2529d 3093 return TRUE;
7536ee4b 3094}
7536ee4b 3095
7c20b4a3 3096static const DisplayChangeListenerOps dcl_ops = {
34da30af
BH		 3097 .dpy_name = "vnc",
3098 .dpy_refresh = vnc_refresh,
34da30af
BH		 3099 .dpy_gfx_update = vnc_dpy_update,
3100 .dpy_gfx_switch = vnc_dpy_switch,
3101 .dpy_gfx_check_format = qemu_pixman_check_format,
3102 .dpy_mouse_set = vnc_mouse_set,
3103 .dpy_cursor_define = vnc_dpy_cursor_define,
7c20b4a3
GH		 3104};
3105
14f7143e 3106void vnc_display_init(const char *id)
24236869 3107{
bf01c179 3108 VncDisplay *vd;
4db14629
GH		 3109
3110 if (vnc_display_find(id) != NULL) {
3111 return;
3112 }
bf01c179 3113 vd = g_malloc0(sizeof(*vd));
24236869 3114
bf01c179
DB		 3115 vd->id = strdup(id);
3116 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
24236869 3117
bf01c179
DB		 3118 QTAILQ_INIT(&vd->clients);
3119 vd->expires = TIME_MAX;
24236869 3120
40066175
GH		 3121 if (keyboard_layout) {
3122 trace_vnc_key_map_init(keyboard_layout);
bf01c179 3123 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
40066175 3124 } else {
bf01c179 3125 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
40066175 3126 }
24236869 3127
bf01c179 3128 if (!vd->kbd_layout) {
28a76be8 3129 exit(1);
bf01c179 3130 }
24236869 3131
bf01c179
DB		 3132 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3133 vd->connections_limit = 32;
12e29b16 3134
bf01c179 3135 qemu_mutex_init(&vd->mutex);
bd023f95 3136 vnc_start_worker_thread();
bd023f95 3137
bf01c179
DB		 3138 vd->dcl.ops = &dcl_ops;
3139 register_displaychangelistener(&vd->dcl);
71cab5ca
TS		 3140}
3141
6f43024c 3142
bf01c179 3143static void vnc_display_close(VncDisplay *vd)
71cab5ca 3144{
4ee74fa7 3145 size_t i;
bf01c179 3146 if (!vd) {
452b4d88 3147 return;
bf01c179
DB		 3148 }
3149 vd->is_unix = false;
4ee74fa7
DB		 3150 for (i = 0; i < vd->nlsock; i++) {
3151 if (vd->lsock_tag[i]) {
3152 g_source_remove(vd->lsock_tag[i]);
04d2529d 3153 }
4ee74fa7 3154 object_unref(OBJECT(vd->lsock[i]));
71cab5ca 3155 }
4ee74fa7
DB		 3156 g_free(vd->lsock);
3157 g_free(vd->lsock_tag);
3158 vd->lsock = NULL;
2dc120be 3159 vd->lsock_tag = NULL;
4ee74fa7
DB		 3160 vd->nlsock = 0;
3161
3162 for (i = 0; i < vd->nlwebsock; i++) {
3163 if (vd->lwebsock_tag[i]) {
3164 g_source_remove(vd->lwebsock_tag[i]);
04d2529d 3165 }
4ee74fa7 3166 object_unref(OBJECT(vd->lwebsock[i]));
7536ee4b 3167 }
4ee74fa7
DB		 3168 g_free(vd->lwebsock);
3169 g_free(vd->lwebsock_tag);
3170 vd->lwebsock = NULL;
2dc120be 3171 vd->lwebsock_tag = NULL;
4ee74fa7
DB		 3172 vd->nlwebsock = 0;
3173
bf01c179
DB		 3174 vd->auth = VNC_AUTH_INVALID;
3175 vd->subauth = VNC_AUTH_INVALID;
3176 if (vd->tlscreds) {
3177 object_unparent(OBJECT(vd->tlscreds));
3178 vd->tlscreds = NULL;
3e305e4a 3179 }
bf01c179
DB		 3180 g_free(vd->tlsaclname);
3181 vd->tlsaclname = NULL;
a54f0d2b
PO		 3182 if (vd->lock_key_sync) {
3183 qemu_remove_led_event_handler(vd->led);
2dc120be 3184 vd->led = NULL;
a54f0d2b 3185 }
70848515
TS		 3186}
3187
14f7143e 3188int vnc_display_password(const char *id, const char *password)
70848515 3189{
bf01c179 3190 VncDisplay *vd = vnc_display_find(id);
70848515 3191
bf01c179 3192 if (!vd) {
a6aa9d3e 3193 return -EINVAL;
7ef92331 3194 }
bf01c179 3195 if (vd->auth == VNC_AUTH_NONE) {
cf864569 3196 error_printf_unless_qmp("If you want use passwords please enable "
7ea7d36e 3197 "password auth using '-vnc ${dpy},password'.\n");
cf864569 3198 return -EINVAL;
1cd20f8b
AL		 3199 }
3200
bf01c179
DB		 3201 g_free(vd->password);
3202 vd->password = g_strdup(password);
a6aa9d3e
LC		 3203
3204 return 0;
71cab5ca
TS		 3205}
3206
14f7143e 3207int vnc_display_pw_expire(const char *id, time_t expires)
3c9405a0 3208{
bf01c179 3209 VncDisplay *vd = vnc_display_find(id);
3c9405a0 3210
bf01c179 3211 if (!vd) {
1643f2b2
GH		 3212 return -EINVAL;
3213 }
3214
bf01c179 3215 vd->expires = expires;
3c9405a0
GH		 3216 return 0;
3217}
3218
bf01c179 3219static void vnc_display_print_local_addr(VncDisplay *vd)
f92f8afe 3220{
bd269ebc 3221 SocketAddress *addr;
04d2529d 3222 Error *err = NULL;
d616ccc5 3223
4ee74fa7
DB		 3224 if (!vd->nlsock) {
3225 return;
3226 }
3227
3228 addr = qio_channel_socket_get_local_address(vd->lsock[0], &err);
04d2529d 3229 if (!addr) {
33df7bf3 3230 return;
04d2529d
DB		 3231 }
3232
bd269ebc
MA		 3233 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3234 qapi_free_SocketAddress(addr);
33df7bf3 3235 return;
04d2529d 3236 }
33df7bf3 3237 error_printf_unless_qmp("VNC server running on %s:%s\n",
bd269ebc
MA		 3238 addr->u.inet.host,
3239 addr->u.inet.port);
3240 qapi_free_SocketAddress(addr);
f92f8afe
AL		 3241}
3242
4db14629
GH		 3243static QemuOptsList qemu_vnc_opts = {
3244 .name = "vnc",
3245 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3246 .implied_opt_name = "vnc",
3247 .desc = {
3248 {
3249 .name = "vnc",
3250 .type = QEMU_OPT_STRING,
3251 },{
3252 .name = "websocket",
3253 .type = QEMU_OPT_STRING,
3254 },{
3e305e4a
DB		 3255 .name = "tls-creds",
3256 .type = QEMU_OPT_STRING,
3257 },{
3258 /* Deprecated in favour of tls-creds */
4db14629
GH		 3259 .name = "x509",
3260 .type = QEMU_OPT_STRING,
3261 },{
3262 .name = "share",
3263 .type = QEMU_OPT_STRING,
1d0d59fe
GH		 3264 },{
3265 .name = "display",
3266 .type = QEMU_OPT_STRING,
3267 },{
3268 .name = "head",
3269 .type = QEMU_OPT_NUMBER,
e5f34cdd
GH		 3270 },{
3271 .name = "connections",
3272 .type = QEMU_OPT_NUMBER,
88428b7a
GA		 3273 },{
3274 .name = "to",
3275 .type = QEMU_OPT_NUMBER,
3276 },{
3277 .name = "ipv4",
3278 .type = QEMU_OPT_BOOL,
3279 },{
3280 .name = "ipv6",
3281 .type = QEMU_OPT_BOOL,
4db14629
GH		 3282 },{
3283 .name = "password",
3284 .type = QEMU_OPT_BOOL,
3285 },{
3286 .name = "reverse",
3287 .type = QEMU_OPT_BOOL,
3288 },{
3289 .name = "lock-key-sync",
3290 .type = QEMU_OPT_BOOL,
c5ce8333
GH		 3291 },{
3292 .name = "key-delay-ms",
3293 .type = QEMU_OPT_NUMBER,
4db14629
GH		 3294 },{
3295 .name = "sasl",
3296 .type = QEMU_OPT_BOOL,
3297 },{
3e305e4a 3298 /* Deprecated in favour of tls-creds */
4db14629
GH		 3299 .name = "tls",
3300 .type = QEMU_OPT_BOOL,
3301 },{
3e305e4a 3302 /* Deprecated in favour of tls-creds */
4db14629 3303 .name = "x509verify",
8c7d0645 3304 .type = QEMU_OPT_STRING,
4db14629
GH		 3305 },{
3306 .name = "acl",
3307 .type = QEMU_OPT_BOOL,
3308 },{
3309 .name = "lossy",
3310 .type = QEMU_OPT_BOOL,
3311 },{
3312 .name = "non-adaptive",
3313 .type = QEMU_OPT_BOOL,
3314 },
3315 { /* end of list */ }
3316 },
3317};
3318
0dd72e15 3319
3e305e4a 3320static int
eda24e18
DB		 3321vnc_display_setup_auth(int *auth,
3322 int *subauth,
3323 QCryptoTLSCreds *tlscreds,
0dd72e15
DB		 3324 bool password,
3325 bool sasl,
3e305e4a
DB		 3326 bool websocket,
3327 Error **errp)
0dd72e15
DB		 3328{
3329 /*
3330 * We have a choice of 3 authentication options
3331 *
3332 * 1. none
3333 * 2. vnc
3334 * 3. sasl
3335 *
3336 * The channel can be run in 2 modes
3337 *
3338 * 1. clear
3339 * 2. tls
3340 *
3341 * And TLS can use 2 types of credentials
3342 *
3343 * 1. anon
3344 * 2. x509
3345 *
3346 * We thus have 9 possible logical combinations
3347 *
3348 * 1. clear + none
3349 * 2. clear + vnc
3350 * 3. clear + sasl
3351 * 4. tls + anon + none
3352 * 5. tls + anon + vnc
3353 * 6. tls + anon + sasl
3354 * 7. tls + x509 + none
3355 * 8. tls + x509 + vnc
3356 * 9. tls + x509 + sasl
3357 *
3358 * These need to be mapped into the VNC auth schemes
3359 * in an appropriate manner. In regular VNC, all the
3360 * TLS options get mapped into VNC_AUTH_VENCRYPT
3361 * sub-auth types.
f9148c8a
DB		 3362 *
3363 * In websockets, the https:// protocol already provides
3364 * TLS support, so there is no need to make use of the
3365 * VeNCrypt extension. Furthermore, websockets browser
3366 * clients could not use VeNCrypt even if they wanted to,
3367 * as they cannot control when the TLS handshake takes
3368 * place. Thus there is no option but to rely on https://,
3369 * meaning combinations 4->6 and 7->9 will be mapped to
3370 * VNC auth schemes in the same way as combos 1->3.
3371 *
3372 * Regardless of fact that we have a different mapping to
3373 * VNC auth mechs for plain VNC vs websockets VNC, the end
3374 * result has the same security characteristics.
0dd72e15 3375 */
eda24e18
DB		 3376 if (websocket || !tlscreds) {
3377 if (password) {
0dd72e15 3378 VNC_DEBUG("Initializing VNC server with password auth\n");
eda24e18
DB		 3379 *auth = VNC_AUTH_VNC;
3380 } else if (sasl) {
3381 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3382 *auth = VNC_AUTH_SASL;
f9148c8a 3383 } else {
eda24e18
DB		 3384 VNC_DEBUG("Initializing VNC server with no auth\n");
3385 *auth = VNC_AUTH_NONE;
f9148c8a 3386 }
eda24e18
DB		 3387 *subauth = VNC_AUTH_INVALID;
3388 } else {
3389 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3390 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3391 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3392 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3393
3394 if (!is_x509 && !is_anon) {
3395 error_setg(errp,
3396 "Unsupported TLS cred type %s",
3397 object_get_typename(OBJECT(tlscreds)));
3398 return -1;
3399 }
3400 *auth = VNC_AUTH_VENCRYPT;
3401 if (password) {
3402 if (is_x509) {
3403 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3404 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3405 } else {
3406 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3407 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3408 }
3409
3410 } else if (sasl) {
3411 if (is_x509) {
0dd72e15 3412 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
eda24e18 3413 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3e305e4a 3414 } else {
eda24e18
DB		 3415 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3416 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
0dd72e15
DB		 3417 }
3418 } else {
eda24e18 3419 if (is_x509) {
0dd72e15 3420 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
eda24e18 3421 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3e305e4a 3422 } else {
eda24e18
DB		 3423 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3424 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
0dd72e15 3425 }
f9148c8a 3426 }
0dd72e15 3427 }
3e305e4a
DB		 3428 return 0;
3429}
3430
3431
3432/*
3433 * Handle back compat with old CLI syntax by creating some
3434 * suitable QCryptoTLSCreds objects
3435 */
3436static QCryptoTLSCreds *
3437vnc_display_create_creds(bool x509,
3438 bool x509verify,
3439 const char *dir,
3440 const char *id,
3441 Error **errp)
3442{
3443 gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3444 Object *parent = object_get_objects_root();
3445 Object *creds;
3446 Error *err = NULL;
3447
3448 if (x509) {
3449 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3450 parent,
3451 credsid,
3452 &err,
3453 "endpoint", "server",
3454 "dir", dir,
3455 "verify-peer", x509verify ? "yes" : "no",
3456 NULL);
3457 } else {
3458 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3459 parent,
3460 credsid,
3461 &err,
3462 "endpoint", "server",
3463 NULL);
3464 }
3465
3466 g_free(credsid);
3467
3468 if (err) {
3469 error_propagate(errp, err);
3470 return NULL;
3471 }
3472
3473 return QCRYPTO_TLS_CREDS(creds);
0dd72e15
DB		 3474}
3475
3e305e4a 3476
275e0d61
DB		 3477static int vnc_display_get_address(const char *addrstr,
3478 bool websocket,
e5766eb4 3479 bool reverse,
275e0d61
DB		 3480 int displaynum,
3481 int to,
3482 bool has_ipv4,
3483 bool has_ipv6,
3484 bool ipv4,
3485 bool ipv6,
bd269ebc 3486 SocketAddress **retaddr,
275e0d61
DB		 3487 Error **errp)
3488{
3489 int ret = -1;
bd269ebc 3490 SocketAddress *addr = NULL;
275e0d61 3491
bd269ebc 3492 addr = g_new0(SocketAddress, 1);
275e0d61
DB		 3493
3494 if (strncmp(addrstr, "unix:", 5) == 0) {
bd269ebc
MA		 3495 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3496 addr->u.q_unix.path = g_strdup(addrstr + 5);
275e0d61
DB		 3497
3498 if (websocket) {
3499 error_setg(errp, "UNIX sockets not supported with websock");
3500 goto cleanup;
3501 }
3502
3503 if (to) {
3504 error_setg(errp, "Port range not support with UNIX socket");
3505 goto cleanup;
3506 }
3507 ret = 0;
3508 } else {
3509 const char *port;
3510 size_t hostlen;
3511 unsigned long long baseport = 0;
3512 InetSocketAddress *inet;
3513
3514 port = strrchr(addrstr, ':');
3515 if (!port) {
3516 if (websocket) {
3517 hostlen = 0;
3518 port = addrstr;
3519 } else {
3520 error_setg(errp, "no vnc port specified");
3521 goto cleanup;
3522 }
3523 } else {
3524 hostlen = port - addrstr;
3525 port++;
3526 if (*port == '\0') {
3527 error_setg(errp, "vnc port cannot be empty");
3528 goto cleanup;
3529 }
3530 }
3531
bd269ebc
MA		 3532 addr->type = SOCKET_ADDRESS_TYPE_INET;
3533 inet = &addr->u.inet;
275e0d61
DB		 3534 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3535 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3536 } else {
3537 inet->host = g_strndup(addrstr, hostlen);
3538 }
3539 /* plain VNC port is just an offset, for websocket
3540 * port is absolute */
3541 if (websocket) {
3542 if (g_str_equal(addrstr, "") ||
3543 g_str_equal(addrstr, "on")) {
396f935a
DB		 3544 if (displaynum == -1) {
3545 error_setg(errp, "explicit websocket port is required");
3546 goto cleanup;
3547 }
275e0d61
DB		 3548 inet->port = g_strdup_printf(
3549 "%d", displaynum + 5700);
3550 if (to) {
3551 inet->has_to = true;
3552 inet->to = to + 5700;
3553 }
3554 } else {
3555 inet->port = g_strdup(port);
3556 }
3557 } else {
e5766eb4 3558 int offset = reverse ? 0 : 5900;
275e0d61
DB		 3559 if (parse_uint_full(port, &baseport, 10) < 0) {
3560 error_setg(errp, "can't convert to a number: %s", port);
3561 goto cleanup;
3562 }
3563 if (baseport > 65535 ||
e5766eb4 3564 baseport + offset > 65535) {
275e0d61
DB		 3565 error_setg(errp, "port %s out of range", port);
3566 goto cleanup;
3567 }
3568 inet->port = g_strdup_printf(
e5766eb4 3569 "%d", (int)baseport + offset);
275e0d61
DB		 3570
3571 if (to) {
3572 inet->has_to = true;
e5766eb4 3573 inet->to = to + offset;
275e0d61
DB		 3574 }
3575 }
3576
3577 inet->ipv4 = ipv4;
3578 inet->has_ipv4 = has_ipv4;
3579 inet->ipv6 = ipv6;
3580 inet->has_ipv6 = has_ipv6;
3581
3582 ret = baseport;
3583 }
3584
3585 *retaddr = addr;
3586
3587 cleanup:
3588 if (ret < 0) {
bd269ebc 3589 qapi_free_SocketAddress(addr);
275e0d61
DB		 3590 }
3591 return ret;
3592}
3593
9f26f325
PMD		 3594static void vnc_free_addresses(SocketAddress ***retsaddr,
3595 size_t *retnsaddr)
3596{
3597 size_t i;
3598
3599 for (i = 0; i < *retnsaddr; i++) {
3600 qapi_free_SocketAddress((*retsaddr)[i]);
3601 }
3602 g_free(*retsaddr);
3603
3604 *retsaddr = NULL;
3605 *retnsaddr = 0;
3606}
3607
275e0d61 3608static int vnc_display_get_addresses(QemuOpts *opts,
e5766eb4 3609 bool reverse,
bd269ebc 3610 SocketAddress ***retsaddr,
396f935a 3611 size_t *retnsaddr,
bd269ebc 3612 SocketAddress ***retwsaddr,
396f935a 3613 size_t *retnwsaddr,
275e0d61
DB		 3614 Error **errp)
3615{
bd269ebc
MA		 3616 SocketAddress *saddr = NULL;
3617 SocketAddress *wsaddr = NULL;
396f935a
DB		 3618 QemuOptsIter addriter;
3619 const char *addr;
275e0d61
DB		 3620 int to = qemu_opt_get_number(opts, "to", 0);
3621 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3622 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3623 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3624 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
396f935a
DB		 3625 int displaynum = -1;
3626 int ret = -1;
275e0d61 3627
396f935a
DB		 3628 *retsaddr = NULL;
3629 *retnsaddr = 0;
3630 *retwsaddr = NULL;
3631 *retnwsaddr = 0;
275e0d61 3632
396f935a
DB		 3633 addr = qemu_opt_get(opts, "vnc");
3634 if (addr == NULL || g_str_equal(addr, "none")) {
3635 ret = 0;
3636 goto cleanup;
3637 }
3638 if (qemu_opt_get(opts, "websocket") &&
275e0d61
DB		 3639 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3640 error_setg(errp,
3641 "SHA1 hash support is required for websockets");
396f935a
DB		 3642 goto cleanup;
3643 }
3644
3645 qemu_opt_iter_init(&addriter, opts, "vnc");
3646 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3647 int rv;
e5766eb4 3648 rv = vnc_display_get_address(addr, false, reverse, 0, to,
396f935a
DB		 3649 has_ipv4, has_ipv6,
3650 ipv4, ipv6,
3651 &saddr, errp);
3652 if (rv < 0) {
3653 goto cleanup;
3654 }
3655 /* Historical compat - first listen address can be used
3656 * to set the default websocket port
3657 */
3658 if (displaynum == -1) {
3659 displaynum = rv;
3660 }
bd269ebc 3661 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
396f935a 3662 (*retsaddr)[(*retnsaddr)++] = saddr;
275e0d61
DB		 3663 }
3664
396f935a
DB		 3665 /* If we had multiple primary displays, we don't do defaults
3666 * for websocket, and require explicit config instead. */
3667 if (*retnsaddr > 1) {
3668 displaynum = -1;
275e0d61 3669 }
396f935a
DB		 3670
3671 qemu_opt_iter_init(&addriter, opts, "websocket");
3672 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
e5766eb4 3673 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
275e0d61
DB		 3674 has_ipv4, has_ipv6,
3675 ipv4, ipv6,
3676 &wsaddr, errp) < 0) {
396f935a 3677 goto cleanup;
275e0d61 3678 }
396f935a
DB		 3679
3680 /* Historical compat - if only a single listen address was
3681 * provided, then this is used to set the default listen
3682 * address for websocket too
3683 */
3684 if (*retnsaddr == 1 &&
bd269ebc
MA		 3685 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3686 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3687 g_str_equal(wsaddr->u.inet.host, "") &&
3688 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3689 g_free(wsaddr->u.inet.host);
3690 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
275e0d61 3691 }
396f935a 3692
bd269ebc 3693 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
396f935a 3694 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
275e0d61 3695 }
275e0d61 3696
396f935a
DB		 3697 ret = 0;
3698 cleanup:
3699 if (ret < 0) {
9f26f325
PMD		 3700 vnc_free_addresses(retsaddr, retnsaddr);
3701 vnc_free_addresses(retwsaddr, retnwsaddr);
396f935a
DB		 3702 }
3703 return ret;
275e0d61
DB		 3704}
3705
8bd22f47 3706static int vnc_display_connect(VncDisplay *vd,
bd269ebc 3707 SocketAddress **saddr,
396f935a 3708 size_t nsaddr,
bd269ebc 3709 SocketAddress **wsaddr,
396f935a 3710 size_t nwsaddr,
8bd22f47
DB		 3711 Error **errp)
3712{
3713 /* connect to viewer */
3714 QIOChannelSocket *sioc = NULL;
396f935a 3715 if (nwsaddr != 0) {
8bd22f47
DB		 3716 error_setg(errp, "Cannot use websockets in reverse mode");
3717 return -1;
3718 }
396f935a
DB		 3719 if (nsaddr != 1) {
3720 error_setg(errp, "Expected a single address in reverse mode");
3721 return -1;
3722 }
bd269ebc
MA		 3723 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3724 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
8bd22f47
DB		 3725 sioc = qio_channel_socket_new();
3726 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
396f935a 3727 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
8bd22f47
DB		 3728 return -1;
3729 }
3730 vnc_connect(vd, sioc, false, false);
3731 object_unref(OBJECT(sioc));
3732 return 0;
3733}
3734
3735
3736static int vnc_display_listen_addr(VncDisplay *vd,
bd269ebc 3737 SocketAddress *addr,
8bd22f47
DB		 3738 const char *name,
3739 QIOChannelSocket ***lsock,
3740 guint **lsock_tag,
3741 size_t *nlsock,
3742 Error **errp)
3743{
57a6d6d5 3744 QIODNSResolver *resolver = qio_dns_resolver_get_instance();
bd269ebc 3745 SocketAddress **rawaddrs = NULL;
57a6d6d5
DB		 3746 size_t nrawaddrs = 0;
3747 Error *listenerr = NULL;
396f935a 3748 bool listening = false;
57a6d6d5 3749 size_t i;
8bd22f47 3750
57a6d6d5
DB		 3751 if (qio_dns_resolver_lookup_sync(resolver, addr, &nrawaddrs,
3752 &rawaddrs, errp) < 0) {
8bd22f47
DB		 3753 return -1;
3754 }
3755
57a6d6d5
DB		 3756 for (i = 0; i < nrawaddrs; i++) {
3757 QIOChannelSocket *sioc = qio_channel_socket_new();
3758
3759 qio_channel_set_name(QIO_CHANNEL(sioc), name);
3760 if (qio_channel_socket_listen_sync(
3761 sioc, rawaddrs[i], listenerr == NULL ? &listenerr : NULL) < 0) {
7bc4f084 3762 object_unref(OBJECT(sioc));
57a6d6d5
DB		 3763 continue;
3764 }
396f935a 3765 listening = true;
57a6d6d5
DB		 3766 (*nlsock)++;
3767 *lsock = g_renew(QIOChannelSocket *, *lsock, *nlsock);
3768 *lsock_tag = g_renew(guint, *lsock_tag, *nlsock);
3769
3770 (*lsock)[*nlsock - 1] = sioc;
3771 (*lsock_tag)[*nlsock - 1] = 0;
3772 }
3773
3774 for (i = 0; i < nrawaddrs; i++) {
bd269ebc 3775 qapi_free_SocketAddress(rawaddrs[i]);
57a6d6d5
DB		 3776 }
3777 g_free(rawaddrs);
3778
3779 if (listenerr) {
396f935a 3780 if (!listening) {
57a6d6d5
DB		 3781 error_propagate(errp, listenerr);
3782 return -1;
3783 } else {
3784 error_free(listenerr);
3785 }
3786 }
3787
3788 for (i = 0; i < *nlsock; i++) {
3789 (*lsock_tag)[i] = qio_channel_add_watch(
3790 QIO_CHANNEL((*lsock)[i]),
3791 G_IO_IN, vnc_listen_io, vd, NULL);
3792 }
8bd22f47
DB		 3793
3794 return 0;
3795}
3796
3797
3798static int vnc_display_listen(VncDisplay *vd,
bd269ebc 3799 SocketAddress **saddr,
396f935a 3800 size_t nsaddr,
bd269ebc 3801 SocketAddress **wsaddr,
396f935a 3802 size_t nwsaddr,
8bd22f47
DB		 3803 Error **errp)
3804{
396f935a 3805 size_t i;
8bd22f47 3806
396f935a
DB		 3807 for (i = 0; i < nsaddr; i++) {
3808 if (vnc_display_listen_addr(vd, saddr[i],
3809 "vnc-listen",
3810 &vd->lsock,
3811 &vd->lsock_tag,
3812 &vd->nlsock,
3813 errp) < 0) {
3814 return -1;
3815 }
8bd22f47 3816 }
396f935a
DB		 3817 for (i = 0; i < nwsaddr; i++) {
3818 if (vnc_display_listen_addr(vd, wsaddr[i],
3819 "vnc-ws-listen",
3820 &vd->lwebsock,
3821 &vd->lwebsock_tag,
3822 &vd->nlwebsock,
3823 errp) < 0) {
3824 return -1;
3825 }
8bd22f47
DB		 3826 }
3827
3828 return 0;
3829}
3830
3831
4db14629 3832void vnc_display_open(const char *id, Error **errp)
71cab5ca 3833{
bf01c179 3834 VncDisplay *vd = vnc_display_find(id);
4db14629 3835 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
bd269ebc 3836 SocketAddress **saddr = NULL, **wsaddr = NULL;
396f935a 3837 size_t nsaddr, nwsaddr;
e2a11d9d 3838 const char *share, *device_id;
1d0d59fe 3839 QemuConsole *con;
a2c72de0
GA		 3840 bool password = false;
3841 bool reverse = false;
3e305e4a 3842 const char *credid;
a2c72de0 3843 bool sasl = false;
d169f04b 3844#ifdef CONFIG_VNC_SASL
2f9606b3
AL		 3845 int saslErr;
3846#endif
76655d6d 3847 int acl = 0;
3a0558b5 3848 int lock_key_sync = 1;
c5ce8333 3849 int key_delay_ms;
71cab5ca 3850
bf01c179 3851 if (!vd) {
2d55f0e8
PB		 3852 error_setg(errp, "VNC display not active");
3853 return;
3854 }
bf01c179 3855 vnc_display_close(vd);
24236869 3856
4db14629
GH		 3857 if (!opts) {
3858 return;
3859 }
274c3b52 3860
e5766eb4
GH		 3861 reverse = qemu_opt_get_bool(opts, "reverse", false);
3862 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
396f935a 3863 &wsaddr, &nwsaddr, errp) < 0) {
e5560329 3864 goto fail;
e2a11d9d 3865 }
e5560329 3866
4db14629 3867 password = qemu_opt_get_bool(opts, "password", false);
800567a6
DB		 3868 if (password) {
3869 if (fips_get_state()) {
3870 error_setg(errp,
3871 "VNC password auth disabled due to FIPS mode, "
3872 "consider using the VeNCrypt or SASL authentication "
3873 "methods as an alternative");
3874 goto fail;
3875 }
3876 if (!qcrypto_cipher_supports(
f844836d 3877 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
800567a6
DB		 3878 error_setg(errp,
3879 "Cipher backend does not support DES RFB algorithm");
3880 goto fail;
3881 }
4db14629
GH		 3882 }
3883
4db14629 3884 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
d3b0db6d 3885 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
4db14629 3886 sasl = qemu_opt_get_bool(opts, "sasl", false);
d169f04b
DB		 3887#ifndef CONFIG_VNC_SASL
3888 if (sasl) {
3889 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3890 goto fail;
3891 }
3892#endif /* CONFIG_VNC_SASL */
3e305e4a
DB		 3893 credid = qemu_opt_get(opts, "tls-creds");
3894 if (credid) {
3895 Object *creds;
3896 if (qemu_opt_get(opts, "tls") ||
3897 qemu_opt_get(opts, "x509") ||
3898 qemu_opt_get(opts, "x509verify")) {
3899 error_setg(errp,
c62e90af 3900 "'tls-creds' parameter is mutually exclusive with "
3e305e4a 3901 "'tls', 'x509' and 'x509verify' parameters");
4db14629
GH		 3902 goto fail;
3903 }
3e305e4a
DB		 3904
3905 creds = object_resolve_path_component(
3906 object_get_objects_root(), credid);
3907 if (!creds) {
3908 error_setg(errp, "No TLS credentials with id '%s'",
3909 credid);
3910 goto fail;
3911 }
bf01c179 3912 vd->tlscreds = (QCryptoTLSCreds *)
3e305e4a
DB		 3913 object_dynamic_cast(creds,
3914 TYPE_QCRYPTO_TLS_CREDS);
bf01c179 3915 if (!vd->tlscreds) {
3e305e4a
DB		 3916 error_setg(errp, "Object with id '%s' is not TLS credentials",
3917 credid);
3918 goto fail;
3919 }
bf01c179 3920 object_ref(OBJECT(vd->tlscreds));
3e305e4a 3921
bf01c179 3922 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3e305e4a
DB		 3923 error_setg(errp,
3924 "Expecting TLS credentials with a server endpoint");
3925 goto fail;
3926 }
3927 } else {
3928 const char *path;
3929 bool tls = false, x509 = false, x509verify = false;
3930 tls = qemu_opt_get_bool(opts, "tls", false);
3931 if (tls) {
3932 path = qemu_opt_get(opts, "x509");
3933
3934 if (path) {
3935 x509 = true;
3936 } else {
3937 path = qemu_opt_get(opts, "x509verify");
3938 if (path) {
3939 x509 = true;
3940 x509verify = true;
3941 }
3942 }
bf01c179 3943 vd->tlscreds = vnc_display_create_creds(x509,
3e305e4a
DB		 3944 x509verify,
3945 path,
bf01c179 3946 vd->id,
3e305e4a 3947 errp);
bf01c179 3948 if (!vd->tlscreds) {
3e305e4a
DB		 3949 goto fail;
3950 }
3951 }
4db14629 3952 }
4db14629 3953 acl = qemu_opt_get_bool(opts, "acl", false);
4db14629
GH		 3954
3955 share = qemu_opt_get(opts, "share");
3956 if (share) {
3957 if (strcmp(share, "ignore") == 0) {
bf01c179 3958 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
4db14629 3959 } else if (strcmp(share, "allow-exclusive") == 0) {
bf01c179 3960 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4db14629 3961 } else if (strcmp(share, "force-shared") == 0) {
bf01c179 3962 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
4db14629
GH		 3963 } else {
3964 error_setg(errp, "unknown vnc share= option");
3965 goto fail;
3966 }
3967 } else {
bf01c179 3968 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4db14629 3969 }
bf01c179 3970 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
4db14629 3971
4db14629 3972#ifdef CONFIG_VNC_JPEG
bf01c179 3973 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
4db14629 3974#endif
bf01c179 3975 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
e22492d3
PL		 3976 /* adaptive updates are only used with tight encoding and
3977 * if lossy updates are enabled so we can disable all the
3978 * calculations otherwise */
bf01c179
DB		 3979 if (!vd->lossy) {
3980 vd->non_adaptive = true;
e22492d3
PL		 3981 }
3982
3e305e4a 3983 if (acl) {
bf01c179
DB		 3984 if (strcmp(vd->id, "default") == 0) {
3985 vd->tlsaclname = g_strdup("vnc.x509dname");
c8496408 3986 } else {
bf01c179 3987 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
c8496408 3988 }
bf01c179 3989 qemu_acl_init(vd->tlsaclname);
2cc45228 3990 }
76655d6d
AL		 3991#ifdef CONFIG_VNC_SASL
3992 if (acl && sasl) {
c8496408
GH		 3993 char *aclname;
3994
bf01c179 3995 if (strcmp(vd->id, "default") == 0) {
c8496408
GH		 3996 aclname = g_strdup("vnc.username");
3997 } else {
bf01c179 3998 aclname = g_strdup_printf("vnc.%s.username", vd->id);
c8496408 3999 }
bf01c179 4000 vd->sasl.acl = qemu_acl_init(aclname);
c8496408 4001 g_free(aclname);
76655d6d
AL		 4002 }
4003#endif
4004
eda24e18
DB		 4005 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
4006 vd->tlscreds, password,
4007 sasl, false, errp) < 0) {
4008 goto fail;
4009 }
7364dbda 4010 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
eda24e18
DB		 4011
4012 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
4013 vd->tlscreds, password,
4014 sasl, true, errp) < 0) {
3e305e4a
DB		 4015 goto fail;
4016 }
7364dbda 4017 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
24236869 4018
2f9606b3
AL		 4019#ifdef CONFIG_VNC_SASL
4020 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2d55f0e8
PB		 4021 error_setg(errp, "Failed to initialize SASL auth: %s",
4022 sasl_errstring(saslErr, NULL, NULL));
1ce52c78 4023 goto fail;
2f9606b3
AL		 4024 }
4025#endif
bf01c179 4026 vd->lock_key_sync = lock_key_sync;
a54f0d2b
PO		 4027 if (lock_key_sync) {
4028 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
4029 }
4030 vd->ledstate = 0;
bf01c179 4031 vd->key_delay_ms = key_delay_ms;
2f9606b3 4032
1d0d59fe
GH		 4033 device_id = qemu_opt_get(opts, "display");
4034 if (device_id) {
1d0d59fe 4035 int head = qemu_opt_get_number(opts, "head", 0);
f2c1d54c 4036 Error *err = NULL;
1d0d59fe 4037
f2c1d54c
GH		 4038 con = qemu_console_lookup_by_device_name(device_id, head, &err);
4039 if (err) {
4040 error_propagate(errp, err);
1d0d59fe
GH		 4041 goto fail;
4042 }
4043 } else {
4044 con = NULL;
4045 }
4046
bf01c179
DB		 4047 if (con != vd->dcl.con) {
4048 unregister_displaychangelistener(&vd->dcl);
4049 vd->dcl.con = con;
4050 register_displaychangelistener(&vd->dcl);
1d0d59fe
GH		 4051 }
4052
fa03cb7f
MAL		 4053 if (saddr == NULL) {
4054 goto cleanup;
4055 }
4056
3aa3eea3 4057 if (reverse) {
396f935a 4058 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
007fcd3e
PB		 4059 goto fail;
4060 }
9712ecaf 4061 } else {
396f935a 4062 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
e0d03b8c
DB		 4063 goto fail;
4064 }
24236869 4065 }
e0d03b8c 4066
275e0d61 4067 if (qemu_opt_get(opts, "to")) {
bf01c179 4068 vnc_display_print_local_addr(vd);
33df7bf3
PB		 4069 }
4070
396f935a 4071 cleanup:
9f26f325
PMD		 4072 vnc_free_addresses(&saddr, &nsaddr);
4073 vnc_free_addresses(&wsaddr, &nwsaddr);
2d55f0e8 4074 return;
1ce52c78
PB		 4075
4076fail:
4ee74fa7 4077 vnc_display_close(vd);
396f935a 4078 goto cleanup;
24236869 4079}
13661089 4080
14f7143e 4081void vnc_display_add_client(const char *id, int csock, bool skipauth)
13661089 4082{
bf01c179 4083 VncDisplay *vd = vnc_display_find(id);
04d2529d 4084 QIOChannelSocket *sioc;
13661089 4085
bf01c179 4086 if (!vd) {
d616ccc5
GH		 4087 return;
4088 }
04d2529d
DB		 4089
4090 sioc = qio_channel_socket_new_fd(csock, NULL);
4091 if (sioc) {
10bcfe58 4092 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
bf01c179 4093 vnc_connect(vd, sioc, skipauth, false);
04d2529d
DB		 4094 object_unref(OBJECT(sioc));
4095 }
13661089 4096}
4db14629 4097
9634f4e3 4098static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
2779672f
GA		 4099{
4100 int i = 2;
4101 char *id;
4102
4103 id = g_strdup("default");
4104 while (qemu_opts_find(olist, id)) {
4105 g_free(id);
4106 id = g_strdup_printf("vnc%d", i++);
4107 }
4108 qemu_opts_set_id(opts, id);
4109}
4110
70b94331 4111QemuOpts *vnc_parse(const char *str, Error **errp)
4db14629 4112{
4db14629 4113 QemuOptsList *olist = qemu_find_opts("vnc");
70b94331 4114 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
81607cbf 4115 const char *id;
4db14629 4116
81607cbf
GA		 4117 if (!opts) {
4118 return NULL;
4119 }
4120
4121 id = qemu_opts_id(opts);
4db14629
GH		 4122 if (!id) {
4123 /* auto-assign id if not present */
2779672f 4124 vnc_auto_assign_id(olist, opts);
4db14629 4125 }
9634f4e3
GH		 4126 return opts;
4127}
4128
28d0de7a 4129int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
9634f4e3
GH		 4130{
4131 Error *local_err = NULL;
4132 char *id = (char *)qemu_opts_id(opts);
4db14629 4133
9634f4e3 4134 assert(id);
4db14629
GH		 4135 vnc_display_init(id);
4136 vnc_display_open(id, &local_err);
4137 if (local_err != NULL) {
c29b77f9 4138 error_reportf_err(local_err, "Failed to start VNC server: ");
4db14629
GH		 4139 exit(1);
4140 }
4141 return 0;
4142}
4143
4144static void vnc_register_config(void)
4145{
4146 qemu_add_opts(&qemu_vnc_opts);
4147}
34294e2f 4148opts_init(vnc_register_config);
QEMU mirror