?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'v2.9.0-rc1'
[qemu/ar7.git] / ui / vnc.c
blob18aa352768a1a5c21f6e468b13542e7bdd61ac39
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "hw/qdev.h"
32 #include "sysemu/sysemu.h"
33 #include "qemu/error-report.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qmp/qerror.h"
39 #include "qapi/qmp/types.h"
40 #include "qmp-commands.h"
41 #include "ui/input.h"
42 #include "qapi-event.h"
43 #include "crypto/hash.h"
44 #include "crypto/tlscredsanon.h"
45 #include "crypto/tlscredsx509.h"
46 #include "qom/object_interfaces.h"
47 #include "qemu/cutils.h"
48 #include "io/dns-resolver.h"
49
50 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
51 #define VNC_REFRESH_INTERVAL_INC 50
52 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
53 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
54 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
55
56 #include "vnc_keysym.h"
57 #include "crypto/cipher.h"
58
59 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
60 QTAILQ_HEAD_INITIALIZER(vnc_displays);
61
62 static int vnc_cursor_define(VncState *vs);
63 static void vnc_release_modifiers(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_KIND_INET:
117 info->host = g_strdup(addr->u.inet.data->host);
118 info->service = g_strdup(addr->u.inet.data->port);
119 if (addr->u.inet.data->ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_KIND_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.data->path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 default:
133 error_setg(errp, "Unsupported socket kind %d",
134 addr->type);
135 break;
136 }
137
138 return;
139 }
140
141 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
142 VncBasicInfo *info,
143 Error **errp)
144 {
145 SocketAddress *addr = NULL;
146
147 if (!ioc) {
148 error_setg(errp, "No listener socket available");
149 return;
150 }
151
152 addr = qio_channel_socket_get_local_address(ioc, errp);
153 if (!addr) {
154 return;
155 }
156
157 vnc_init_basic_info(addr, info, errp);
158 qapi_free_SocketAddress(addr);
159 }
160
161 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
162 VncBasicInfo *info,
163 Error **errp)
164 {
165 SocketAddress *addr = NULL;
166
167 addr = qio_channel_socket_get_remote_address(ioc, errp);
168 if (!addr) {
169 return;
170 }
171
172 vnc_init_basic_info(addr, info, errp);
173 qapi_free_SocketAddress(addr);
174 }
175
176 static const char *vnc_auth_name(VncDisplay *vd) {
177 switch (vd->auth) {
178 case VNC_AUTH_INVALID:
179 return "invalid";
180 case VNC_AUTH_NONE:
181 return "none";
182 case VNC_AUTH_VNC:
183 return "vnc";
184 case VNC_AUTH_RA2:
185 return "ra2";
186 case VNC_AUTH_RA2NE:
187 return "ra2ne";
188 case VNC_AUTH_TIGHT:
189 return "tight";
190 case VNC_AUTH_ULTRA:
191 return "ultra";
192 case VNC_AUTH_TLS:
193 return "tls";
194 case VNC_AUTH_VENCRYPT:
195 switch (vd->subauth) {
196 case VNC_AUTH_VENCRYPT_PLAIN:
197 return "vencrypt+plain";
198 case VNC_AUTH_VENCRYPT_TLSNONE:
199 return "vencrypt+tls+none";
200 case VNC_AUTH_VENCRYPT_TLSVNC:
201 return "vencrypt+tls+vnc";
202 case VNC_AUTH_VENCRYPT_TLSPLAIN:
203 return "vencrypt+tls+plain";
204 case VNC_AUTH_VENCRYPT_X509NONE:
205 return "vencrypt+x509+none";
206 case VNC_AUTH_VENCRYPT_X509VNC:
207 return "vencrypt+x509+vnc";
208 case VNC_AUTH_VENCRYPT_X509PLAIN:
209 return "vencrypt+x509+plain";
210 case VNC_AUTH_VENCRYPT_TLSSASL:
211 return "vencrypt+tls+sasl";
212 case VNC_AUTH_VENCRYPT_X509SASL:
213 return "vencrypt+x509+sasl";
214 default:
215 return "vencrypt";
216 }
217 case VNC_AUTH_SASL:
218 return "sasl";
219 }
220 return "unknown";
221 }
222
223 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
224 {
225 VncServerInfo *info;
226 Error *err = NULL;
227
228 if (!vd->nlsock) {
229 return NULL;
230 }
231
232 info = g_malloc0(sizeof(*info));
233 vnc_init_basic_info_from_server_addr(vd->lsock[0],
234 qapi_VncServerInfo_base(info), &err);
235 info->has_auth = true;
236 info->auth = g_strdup(vnc_auth_name(vd));
237 if (err) {
238 qapi_free_VncServerInfo(info);
239 info = NULL;
240 error_free(err);
241 }
242 return info;
243 }
244
245 static void vnc_client_cache_auth(VncState *client)
246 {
247 if (!client->info) {
248 return;
249 }
250
251 if (client->tls) {
252 client->info->x509_dname =
253 qcrypto_tls_session_get_peer_name(client->tls);
254 client->info->has_x509_dname =
255 client->info->x509_dname != NULL;
256 }
257 #ifdef CONFIG_VNC_SASL
258 if (client->sasl.conn &&
259 client->sasl.username) {
260 client->info->has_sasl_username = true;
261 client->info->sasl_username = g_strdup(client->sasl.username);
262 }
263 #endif
264 }
265
266 static void vnc_client_cache_addr(VncState *client)
267 {
268 Error *err = NULL;
269
270 client->info = g_malloc0(sizeof(*client->info));
271 vnc_init_basic_info_from_remote_addr(client->sioc,
272 qapi_VncClientInfo_base(client->info),
273 &err);
274 if (err) {
275 qapi_free_VncClientInfo(client->info);
276 client->info = NULL;
277 error_free(err);
278 }
279 }
280
281 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
282 {
283 VncServerInfo *si;
284
285 if (!vs->info) {
286 return;
287 }
288
289 si = vnc_server_info_get(vs->vd);
290 if (!si) {
291 return;
292 }
293
294 switch (event) {
295 case QAPI_EVENT_VNC_CONNECTED:
296 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
297 &error_abort);
298 break;
299 case QAPI_EVENT_VNC_INITIALIZED:
300 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
301 break;
302 case QAPI_EVENT_VNC_DISCONNECTED:
303 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
304 break;
305 default:
306 break;
307 }
308
309 qapi_free_VncServerInfo(si);
310 }
311
312 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
313 {
314 VncClientInfo *info;
315 Error *err = NULL;
316
317 info = g_malloc0(sizeof(*info));
318
319 vnc_init_basic_info_from_remote_addr(client->sioc,
320 qapi_VncClientInfo_base(info),
321 &err);
322 if (err) {
323 error_free(err);
324 qapi_free_VncClientInfo(info);
325 return NULL;
326 }
327
328 info->websocket = client->websocket;
329
330 if (client->tls) {
331 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
332 info->has_x509_dname = info->x509_dname != NULL;
333 }
334 #ifdef CONFIG_VNC_SASL
335 if (client->sasl.conn && client->sasl.username) {
336 info->has_sasl_username = true;
337 info->sasl_username = g_strdup(client->sasl.username);
338 }
339 #endif
340
341 return info;
342 }
343
344 static VncDisplay *vnc_display_find(const char *id)
345 {
346 VncDisplay *vd;
347
348 if (id == NULL) {
349 return QTAILQ_FIRST(&vnc_displays);
350 }
351 QTAILQ_FOREACH(vd, &vnc_displays, next) {
352 if (strcmp(id, vd->id) == 0) {
353 return vd;
354 }
355 }
356 return NULL;
357 }
358
359 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
360 {
361 VncClientInfoList *cinfo, *prev = NULL;
362 VncState *client;
363
364 QTAILQ_FOREACH(client, &vd->clients, next) {
365 cinfo = g_new0(VncClientInfoList, 1);
366 cinfo->value = qmp_query_vnc_client(client);
367 cinfo->next = prev;
368 prev = cinfo;
369 }
370 return prev;
371 }
372
373 VncInfo *qmp_query_vnc(Error **errp)
374 {
375 VncInfo *info = g_malloc0(sizeof(*info));
376 VncDisplay *vd = vnc_display_find(NULL);
377 SocketAddress *addr = NULL;
378
379 if (vd == NULL || !vd->nlsock) {
380 info->enabled = false;
381 } else {
382 info->enabled = true;
383
384 /* for compatibility with the original command */
385 info->has_clients = true;
386 info->clients = qmp_query_client_list(vd);
387
388 if (vd->lsock == NULL) {
389 return info;
390 }
391
392 addr = qio_channel_socket_get_local_address(vd->lsock[0], errp);
393 if (!addr) {
394 goto out_error;
395 }
396
397 switch (addr->type) {
398 case SOCKET_ADDRESS_KIND_INET:
399 info->host = g_strdup(addr->u.inet.data->host);
400 info->service = g_strdup(addr->u.inet.data->port);
401 if (addr->u.inet.data->ipv6) {
402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
408 case SOCKET_ADDRESS_KIND_UNIX:
409 info->host = g_strdup("");
410 info->service = g_strdup(addr->u.q_unix.data->path);
411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
414 default:
415 error_setg(errp, "Unsupported socket kind %d",
416 addr->type);
417 goto out_error;
418 }
419
420 info->has_host = true;
421 info->has_service = true;
422 info->has_family = true;
423
424 info->has_auth = true;
425 info->auth = g_strdup(vnc_auth_name(vd));
426 }
427
428 qapi_free_SocketAddress(addr);
429 return info;
430
431 out_error:
432 qapi_free_SocketAddress(addr);
433 qapi_free_VncInfo(info);
434 return NULL;
435 }
436
437
438 static void qmp_query_auth(int auth, int subauth,
439 VncPrimaryAuth *qmp_auth,
440 VncVencryptSubAuth *qmp_vencrypt,
441 bool *qmp_has_vencrypt);
442
443 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
444 bool websocket,
445 int auth,
446 int subauth,
447 VncServerInfo2List *prev)
448 {
449 VncServerInfo2List *list;
450 VncServerInfo2 *info;
451 Error *err = NULL;
452 SocketAddress *addr;
453
454 addr = qio_channel_socket_get_local_address(ioc, &err);
455 if (!addr) {
456 error_free(err);
457 return prev;
458 }
459
460 info = g_new0(VncServerInfo2, 1);
461 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
462 qapi_free_SocketAddress(addr);
463 if (err) {
464 qapi_free_VncServerInfo2(info);
465 error_free(err);
466 return prev;
467 }
468 info->websocket = websocket;
469
470 qmp_query_auth(auth, subauth, &info->auth,
471 &info->vencrypt, &info->has_vencrypt);
472
473 list = g_new0(VncServerInfo2List, 1);
474 list->value = info;
475 list->next = prev;
476 return list;
477 }
478
479 static void qmp_query_auth(int auth, int subauth,
480 VncPrimaryAuth *qmp_auth,
481 VncVencryptSubAuth *qmp_vencrypt,
482 bool *qmp_has_vencrypt)
483 {
484 switch (auth) {
485 case VNC_AUTH_VNC:
486 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
487 break;
488 case VNC_AUTH_RA2:
489 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
490 break;
491 case VNC_AUTH_RA2NE:
492 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
493 break;
494 case VNC_AUTH_TIGHT:
495 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
496 break;
497 case VNC_AUTH_ULTRA:
498 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
499 break;
500 case VNC_AUTH_TLS:
501 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
502 break;
503 case VNC_AUTH_VENCRYPT:
504 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
505 *qmp_has_vencrypt = true;
506 switch (subauth) {
507 case VNC_AUTH_VENCRYPT_PLAIN:
508 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
509 break;
510 case VNC_AUTH_VENCRYPT_TLSNONE:
511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
512 break;
513 case VNC_AUTH_VENCRYPT_TLSVNC:
514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
515 break;
516 case VNC_AUTH_VENCRYPT_TLSPLAIN:
517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
518 break;
519 case VNC_AUTH_VENCRYPT_X509NONE:
520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
521 break;
522 case VNC_AUTH_VENCRYPT_X509VNC:
523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
524 break;
525 case VNC_AUTH_VENCRYPT_X509PLAIN:
526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
527 break;
528 case VNC_AUTH_VENCRYPT_TLSSASL:
529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
530 break;
531 case VNC_AUTH_VENCRYPT_X509SASL:
532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
533 break;
534 default:
535 *qmp_has_vencrypt = false;
536 break;
537 }
538 break;
539 case VNC_AUTH_SASL:
540 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
541 break;
542 case VNC_AUTH_NONE:
543 default:
544 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
545 break;
546 }
547 }
548
549 VncInfo2List *qmp_query_vnc_servers(Error **errp)
550 {
551 VncInfo2List *item, *prev = NULL;
552 VncInfo2 *info;
553 VncDisplay *vd;
554 DeviceState *dev;
555 size_t i;
556
557 QTAILQ_FOREACH(vd, &vnc_displays, next) {
558 info = g_new0(VncInfo2, 1);
559 info->id = g_strdup(vd->id);
560 info->clients = qmp_query_client_list(vd);
561 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
562 &info->vencrypt, &info->has_vencrypt);
563 if (vd->dcl.con) {
564 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
565 "device", NULL));
566 info->has_display = true;
567 info->display = g_strdup(dev->id);
568 }
569 for (i = 0; i < vd->nlsock; i++) {
570 info->server = qmp_query_server_entry(
571 vd->lsock[i], false, vd->auth, vd->subauth, info->server);
572 }
573 for (i = 0; i < vd->nlwebsock; i++) {
574 info->server = qmp_query_server_entry(
575 vd->lwebsock[i], true, vd->ws_auth,
576 vd->ws_subauth, info->server);
577 }
578
579 item = g_new0(VncInfo2List, 1);
580 item->value = info;
581 item->next = prev;
582 prev = item;
583 }
584 return prev;
585 }
586
587 /* TODO
588 1) Get the queue working for IO.
589 2) there is some weirdness when using the -S option (the screen is grey
590 and not totally invalidated
591 3) resolutions > 1024
592 */
593
594 static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
595 static void vnc_disconnect_start(VncState *vs);
596
597 static void vnc_colordepth(VncState *vs);
598 static void framebuffer_update_request(VncState *vs, int incremental,
599 int x_position, int y_position,
600 int w, int h);
601 static void vnc_refresh(DisplayChangeListener *dcl);
602 static int vnc_refresh_server_surface(VncDisplay *vd);
603
604 static int vnc_width(VncDisplay *vd)
605 {
606 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
607 VNC_DIRTY_PIXELS_PER_BIT));
608 }
609
610 static int vnc_height(VncDisplay *vd)
611 {
612 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
613 }
614
615 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
616 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
617 VncDisplay *vd,
618 int x, int y, int w, int h)
619 {
620 int width = vnc_width(vd);
621 int height = vnc_height(vd);
622
623 /* this is needed this to ensure we updated all affected
624 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
625 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
626 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
627
628 x = MIN(x, width);
629 y = MIN(y, height);
630 w = MIN(x + w, width) - x;
631 h = MIN(y + h, height);
632
633 for (; y < h; y++) {
634 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
635 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
636 }
637 }
638
639 static void vnc_dpy_update(DisplayChangeListener *dcl,
640 int x, int y, int w, int h)
641 {
642 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
643 struct VncSurface *s = &vd->guest;
644
645 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
646 }
647
648 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
649 int32_t encoding)
650 {
651 vnc_write_u16(vs, x);
652 vnc_write_u16(vs, y);
653 vnc_write_u16(vs, w);
654 vnc_write_u16(vs, h);
655
656 vnc_write_s32(vs, encoding);
657 }
658
659
660 static void vnc_desktop_resize(VncState *vs)
661 {
662 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
663 return;
664 }
665 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
666 vs->client_height == pixman_image_get_height(vs->vd->server)) {
667 return;
668 }
669 vs->client_width = pixman_image_get_width(vs->vd->server);
670 vs->client_height = pixman_image_get_height(vs->vd->server);
671 vnc_lock_output(vs);
672 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
673 vnc_write_u8(vs, 0);
674 vnc_write_u16(vs, 1); /* number of rects */
675 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
676 VNC_ENCODING_DESKTOPRESIZE);
677 vnc_unlock_output(vs);
678 vnc_flush(vs);
679 }
680
681 static void vnc_abort_display_jobs(VncDisplay *vd)
682 {
683 VncState *vs;
684
685 QTAILQ_FOREACH(vs, &vd->clients, next) {
686 vnc_lock_output(vs);
687 vs->abort = true;
688 vnc_unlock_output(vs);
689 }
690 QTAILQ_FOREACH(vs, &vd->clients, next) {
691 vnc_jobs_join(vs);
692 }
693 QTAILQ_FOREACH(vs, &vd->clients, next) {
694 vnc_lock_output(vs);
695 vs->abort = false;
696 vnc_unlock_output(vs);
697 }
698 }
699
700 int vnc_server_fb_stride(VncDisplay *vd)
701 {
702 return pixman_image_get_stride(vd->server);
703 }
704
705 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
706 {
707 uint8_t *ptr;
708
709 ptr = (uint8_t *)pixman_image_get_data(vd->server);
710 ptr += y * vnc_server_fb_stride(vd);
711 ptr += x * VNC_SERVER_FB_BYTES;
712 return ptr;
713 }
714
715 static void vnc_update_server_surface(VncDisplay *vd)
716 {
717 int width, height;
718
719 qemu_pixman_image_unref(vd->server);
720 vd->server = NULL;
721
722 if (QTAILQ_EMPTY(&vd->clients)) {
723 return;
724 }
725
726 width = vnc_width(vd);
727 height = vnc_height(vd);
728 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
729 width, height,
730 NULL, 0);
731
732 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
733 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
734 width, height);
735 }
736
737 static void vnc_dpy_switch(DisplayChangeListener *dcl,
738 DisplaySurface *surface)
739 {
740 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
741 VncState *vs;
742
743 vnc_abort_display_jobs(vd);
744 vd->ds = surface;
745
746 /* server surface */
747 vnc_update_server_surface(vd);
748
749 /* guest surface */
750 qemu_pixman_image_unref(vd->guest.fb);
751 vd->guest.fb = pixman_image_ref(surface->image);
752 vd->guest.format = surface->format;
753
754 QTAILQ_FOREACH(vs, &vd->clients, next) {
755 vnc_colordepth(vs);
756 vnc_desktop_resize(vs);
757 if (vs->vd->cursor) {
758 vnc_cursor_define(vs);
759 }
760 memset(vs->dirty, 0x00, sizeof(vs->dirty));
761 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
762 vnc_width(vd),
763 vnc_height(vd));
764 }
765 }
766
767 /* fastest code */
768 static void vnc_write_pixels_copy(VncState *vs,
769 void *pixels, int size)
770 {
771 vnc_write(vs, pixels, size);
772 }
773
774 /* slowest but generic code. */
775 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
776 {
777 uint8_t r, g, b;
778
779 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
780 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
781 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
782 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
783 #else
784 # error need some bits here if you change VNC_SERVER_FB_FORMAT
785 #endif
786 v = (r << vs->client_pf.rshift) |
787 (g << vs->client_pf.gshift) |
788 (b << vs->client_pf.bshift);
789 switch (vs->client_pf.bytes_per_pixel) {
790 case 1:
791 buf[0] = v;
792 break;
793 case 2:
794 if (vs->client_be) {
795 buf[0] = v >> 8;
796 buf[1] = v;
797 } else {
798 buf[1] = v >> 8;
799 buf[0] = v;
800 }
801 break;
802 default:
803 case 4:
804 if (vs->client_be) {
805 buf[0] = v >> 24;
806 buf[1] = v >> 16;
807 buf[2] = v >> 8;
808 buf[3] = v;
809 } else {
810 buf[3] = v >> 24;
811 buf[2] = v >> 16;
812 buf[1] = v >> 8;
813 buf[0] = v;
814 }
815 break;
816 }
817 }
818
819 static void vnc_write_pixels_generic(VncState *vs,
820 void *pixels1, int size)
821 {
822 uint8_t buf[4];
823
824 if (VNC_SERVER_FB_BYTES == 4) {
825 uint32_t *pixels = pixels1;
826 int n, i;
827 n = size >> 2;
828 for (i = 0; i < n; i++) {
829 vnc_convert_pixel(vs, buf, pixels[i]);
830 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
831 }
832 }
833 }
834
835 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
836 {
837 int i;
838 uint8_t *row;
839 VncDisplay *vd = vs->vd;
840
841 row = vnc_server_fb_ptr(vd, x, y);
842 for (i = 0; i < h; i++) {
843 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
844 row += vnc_server_fb_stride(vd);
845 }
846 return 1;
847 }
848
849 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
850 {
851 int n = 0;
852 bool encode_raw = false;
853 size_t saved_offs = vs->output.offset;
854
855 switch(vs->vnc_encoding) {
856 case VNC_ENCODING_ZLIB:
857 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
858 break;
859 case VNC_ENCODING_HEXTILE:
860 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
861 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
862 break;
863 case VNC_ENCODING_TIGHT:
864 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
865 break;
866 case VNC_ENCODING_TIGHT_PNG:
867 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
868 break;
869 case VNC_ENCODING_ZRLE:
870 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
871 break;
872 case VNC_ENCODING_ZYWRLE:
873 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
874 break;
875 default:
876 encode_raw = true;
877 break;
878 }
879
880 /* If the client has the same pixel format as our internal buffer and
881 * a RAW encoding would need less space fall back to RAW encoding to
882 * save bandwidth and processing power in the client. */
883 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
884 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
885 vs->output.offset = saved_offs;
886 encode_raw = true;
887 }
888
889 if (encode_raw) {
890 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
891 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
892 }
893
894 return n;
895 }
896
897 static void vnc_mouse_set(DisplayChangeListener *dcl,
898 int x, int y, int visible)
899 {
900 /* can we ask the client(s) to move the pointer ??? */
901 }
902
903 static int vnc_cursor_define(VncState *vs)
904 {
905 QEMUCursor *c = vs->vd->cursor;
906 int isize;
907
908 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
909 vnc_lock_output(vs);
910 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
911 vnc_write_u8(vs, 0); /* padding */
912 vnc_write_u16(vs, 1); /* # of rects */
913 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
914 VNC_ENCODING_RICH_CURSOR);
915 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
916 vnc_write_pixels_generic(vs, c->data, isize);
917 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
918 vnc_unlock_output(vs);
919 return 0;
920 }
921 return -1;
922 }
923
924 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
925 QEMUCursor *c)
926 {
927 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
928 VncState *vs;
929
930 cursor_put(vd->cursor);
931 g_free(vd->cursor_mask);
932
933 vd->cursor = c;
934 cursor_get(vd->cursor);
935 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
936 vd->cursor_mask = g_malloc0(vd->cursor_msize);
937 cursor_get_mono_mask(c, 0, vd->cursor_mask);
938
939 QTAILQ_FOREACH(vs, &vd->clients, next) {
940 vnc_cursor_define(vs);
941 }
942 }
943
944 static int find_and_clear_dirty_height(VncState *vs,
945 int y, int last_x, int x, int height)
946 {
947 int h;
948
949 for (h = 1; h < (height - y); h++) {
950 if (!test_bit(last_x, vs->dirty[y + h])) {
951 break;
952 }
953 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
954 }
955
956 return h;
957 }
958
959 static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
960 {
961 if (vs->disconnecting) {
962 vnc_disconnect_finish(vs);
963 return 0;
964 }
965
966 vs->has_dirty += has_dirty;
967 if (vs->need_update && !vs->disconnecting) {
968 VncDisplay *vd = vs->vd;
969 VncJob *job;
970 int y;
971 int height, width;
972 int n = 0;
973
974 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
975 /* kernel send buffers are full -> drop frames to throttle */
976 return 0;
977
978 if (!vs->has_dirty && !vs->audio_cap && !vs->force_update)
979 return 0;
980
981 /*
982 * Send screen updates to the vnc client using the server
983 * surface and server dirty map. guest surface updates
984 * happening in parallel don't disturb us, the next pass will
985 * send them to the client.
986 */
987 job = vnc_job_new(vs);
988
989 height = pixman_image_get_height(vd->server);
990 width = pixman_image_get_width(vd->server);
991
992 y = 0;
993 for (;;) {
994 int x, h;
995 unsigned long x2;
996 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
997 height * VNC_DIRTY_BPL(vs),
998 y * VNC_DIRTY_BPL(vs));
999 if (offset == height * VNC_DIRTY_BPL(vs)) {
1000 /* no more dirty bits */
1001 break;
1002 }
1003 y = offset / VNC_DIRTY_BPL(vs);
1004 x = offset % VNC_DIRTY_BPL(vs);
1005 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1006 VNC_DIRTY_BPL(vs), x);
1007 bitmap_clear(vs->dirty[y], x, x2 - x);
1008 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1009 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1010 if (x2 > x) {
1011 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1012 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1013 }
1014 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1015 y += h;
1016 if (y == height) {
1017 break;
1018 }
1019 }
1020 }
1021
1022 vnc_job_push(job);
1023 if (sync) {
1024 vnc_jobs_join(vs);
1025 }
1026 vs->force_update = 0;
1027 vs->has_dirty = 0;
1028 return n;
1029 }
1030
1031 if (vs->disconnecting) {
1032 vnc_disconnect_finish(vs);
1033 } else if (sync) {
1034 vnc_jobs_join(vs);
1035 }
1036
1037 return 0;
1038 }
1039
1040 /* audio */
1041 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1042 {
1043 VncState *vs = opaque;
1044
1045 switch (cmd) {
1046 case AUD_CNOTIFY_DISABLE:
1047 vnc_lock_output(vs);
1048 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1049 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1050 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1051 vnc_unlock_output(vs);
1052 vnc_flush(vs);
1053 break;
1054
1055 case AUD_CNOTIFY_ENABLE:
1056 vnc_lock_output(vs);
1057 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1058 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1059 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1060 vnc_unlock_output(vs);
1061 vnc_flush(vs);
1062 break;
1063 }
1064 }
1065
1066 static void audio_capture_destroy(void *opaque)
1067 {
1068 }
1069
1070 static void audio_capture(void *opaque, void *buf, int size)
1071 {
1072 VncState *vs = opaque;
1073
1074 vnc_lock_output(vs);
1075 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1076 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1077 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1078 vnc_write_u32(vs, size);
1079 vnc_write(vs, buf, size);
1080 vnc_unlock_output(vs);
1081 vnc_flush(vs);
1082 }
1083
1084 static void audio_add(VncState *vs)
1085 {
1086 struct audio_capture_ops ops;
1087
1088 if (vs->audio_cap) {
1089 error_report("audio already running");
1090 return;
1091 }
1092
1093 ops.notify = audio_capture_notify;
1094 ops.destroy = audio_capture_destroy;
1095 ops.capture = audio_capture;
1096
1097 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1098 if (!vs->audio_cap) {
1099 error_report("Failed to add audio capture");
1100 }
1101 }
1102
1103 static void audio_del(VncState *vs)
1104 {
1105 if (vs->audio_cap) {
1106 AUD_del_capture(vs->audio_cap, vs);
1107 vs->audio_cap = NULL;
1108 }
1109 }
1110
1111 static void vnc_disconnect_start(VncState *vs)
1112 {
1113 if (vs->disconnecting) {
1114 return;
1115 }
1116 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1117 if (vs->ioc_tag) {
1118 g_source_remove(vs->ioc_tag);
1119 }
1120 qio_channel_close(vs->ioc, NULL);
1121 vs->disconnecting = TRUE;
1122 }
1123
1124 void vnc_disconnect_finish(VncState *vs)
1125 {
1126 int i;
1127
1128 vnc_jobs_join(vs); /* Wait encoding jobs */
1129
1130 vnc_lock_output(vs);
1131 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1132
1133 buffer_free(&vs->input);
1134 buffer_free(&vs->output);
1135
1136 qapi_free_VncClientInfo(vs->info);
1137
1138 vnc_zlib_clear(vs);
1139 vnc_tight_clear(vs);
1140 vnc_zrle_clear(vs);
1141
1142 #ifdef CONFIG_VNC_SASL
1143 vnc_sasl_client_cleanup(vs);
1144 #endif /* CONFIG_VNC_SASL */
1145 audio_del(vs);
1146 vnc_release_modifiers(vs);
1147
1148 if (vs->mouse_mode_notifier.notify != NULL) {
1149 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1150 }
1151 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1152 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1153 /* last client gone */
1154 vnc_update_server_surface(vs->vd);
1155 }
1156
1157 vnc_unlock_output(vs);
1158
1159 qemu_mutex_destroy(&vs->output_mutex);
1160 if (vs->bh != NULL) {
1161 qemu_bh_delete(vs->bh);
1162 }
1163 buffer_free(&vs->jobs_buffer);
1164
1165 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1166 g_free(vs->lossy_rect[i]);
1167 }
1168 g_free(vs->lossy_rect);
1169
1170 object_unref(OBJECT(vs->ioc));
1171 vs->ioc = NULL;
1172 object_unref(OBJECT(vs->sioc));
1173 vs->sioc = NULL;
1174 g_free(vs);
1175 }
1176
1177 ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1178 {
1179 if (ret <= 0) {
1180 if (ret == 0) {
1181 VNC_DEBUG("Closing down client sock: EOF\n");
1182 vnc_disconnect_start(vs);
1183 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1184 VNC_DEBUG("Closing down client sock: ret %zd (%s)\n",
1185 ret, errp ? error_get_pretty(*errp) : "Unknown");
1186 vnc_disconnect_start(vs);
1187 }
1188
1189 if (errp) {
1190 error_free(*errp);
1191 *errp = NULL;
1192 }
1193 return 0;
1194 }
1195 return ret;
1196 }
1197
1198
1199 void vnc_client_error(VncState *vs)
1200 {
1201 VNC_DEBUG("Closing down client sock: protocol error\n");
1202 vnc_disconnect_start(vs);
1203 }
1204
1205
1206 /*
1207 * Called to write a chunk of data to the client socket. The data may
1208 * be the raw data, or may have already been encoded by SASL.
1209 * The data will be written either straight onto the socket, or
1210 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1211 *
1212 * NB, it is theoretically possible to have 2 layers of encryption,
1213 * both SASL, and this TLS layer. It is highly unlikely in practice
1214 * though, since SASL encryption will typically be a no-op if TLS
1215 * is active
1216 *
1217 * Returns the number of bytes written, which may be less than
1218 * the requested 'datalen' if the socket would block. Returns
1219 * -1 on error, and disconnects the client socket.
1220 */
1221 ssize_t vnc_client_write_buf(VncState *vs, const void *data, size_t datalen)
1222 {
1223 Error *err = NULL;
1224 ssize_t ret;
1225 ret = qio_channel_write(
1226 vs->ioc, (const char *)data, datalen, &err);
1227 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1228 return vnc_client_io_error(vs, ret, &err);
1229 }
1230
1231
1232 /*
1233 * Called to write buffered data to the client socket, when not
1234 * using any SASL SSF encryption layers. Will write as much data
1235 * as possible without blocking. If all buffered data is written,
1236 * will switch the FD poll() handler back to read monitoring.
1237 *
1238 * Returns the number of bytes written, which may be less than
1239 * the buffered output data if the socket would block. Returns
1240 * -1 on error, and disconnects the client socket.
1241 */
1242 static ssize_t vnc_client_write_plain(VncState *vs)
1243 {
1244 ssize_t ret;
1245
1246 #ifdef CONFIG_VNC_SASL
1247 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1248 vs->output.buffer, vs->output.capacity, vs->output.offset,
1249 vs->sasl.waitWriteSSF);
1250
1251 if (vs->sasl.conn &&
1252 vs->sasl.runSSF &&
1253 vs->sasl.waitWriteSSF) {
1254 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1255 if (ret)
1256 vs->sasl.waitWriteSSF -= ret;
1257 } else
1258 #endif /* CONFIG_VNC_SASL */
1259 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1260 if (!ret)
1261 return 0;
1262
1263 buffer_advance(&vs->output, ret);
1264
1265 if (vs->output.offset == 0) {
1266 if (vs->ioc_tag) {
1267 g_source_remove(vs->ioc_tag);
1268 }
1269 vs->ioc_tag = qio_channel_add_watch(
1270 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1271 }
1272
1273 return ret;
1274 }
1275
1276
1277 /*
1278 * First function called whenever there is data to be written to
1279 * the client socket. Will delegate actual work according to whether
1280 * SASL SSF layers are enabled (thus requiring encryption calls)
1281 */
1282 static void vnc_client_write_locked(VncState *vs)
1283 {
1284 #ifdef CONFIG_VNC_SASL
1285 if (vs->sasl.conn &&
1286 vs->sasl.runSSF &&
1287 !vs->sasl.waitWriteSSF) {
1288 vnc_client_write_sasl(vs);
1289 } else
1290 #endif /* CONFIG_VNC_SASL */
1291 {
1292 vnc_client_write_plain(vs);
1293 }
1294 }
1295
1296 static void vnc_client_write(VncState *vs)
1297 {
1298
1299 vnc_lock_output(vs);
1300 if (vs->output.offset) {
1301 vnc_client_write_locked(vs);
1302 } else if (vs->ioc != NULL) {
1303 if (vs->ioc_tag) {
1304 g_source_remove(vs->ioc_tag);
1305 }
1306 vs->ioc_tag = qio_channel_add_watch(
1307 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1308 }
1309 vnc_unlock_output(vs);
1310 }
1311
1312 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1313 {
1314 vs->read_handler = func;
1315 vs->read_handler_expect = expecting;
1316 }
1317
1318
1319 /*
1320 * Called to read a chunk of data from the client socket. The data may
1321 * be the raw data, or may need to be further decoded by SASL.
1322 * The data will be read either straight from to the socket, or
1323 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1324 *
1325 * NB, it is theoretically possible to have 2 layers of encryption,
1326 * both SASL, and this TLS layer. It is highly unlikely in practice
1327 * though, since SASL encryption will typically be a no-op if TLS
1328 * is active
1329 *
1330 * Returns the number of bytes read, which may be less than
1331 * the requested 'datalen' if the socket would block. Returns
1332 * -1 on error, and disconnects the client socket.
1333 */
1334 ssize_t vnc_client_read_buf(VncState *vs, void *data, size_t datalen)
1335 {
1336 ssize_t ret;
1337 Error *err = NULL;
1338 ret = qio_channel_read(
1339 vs->ioc, (char *)data, datalen, &err);
1340 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1341 return vnc_client_io_error(vs, ret, &err);
1342 }
1343
1344
1345 /*
1346 * Called to read data from the client socket to the input buffer,
1347 * when not using any SASL SSF encryption layers. Will read as much
1348 * data as possible without blocking.
1349 *
1350 * Returns the number of bytes read. Returns -1 on error, and
1351 * disconnects the client socket.
1352 */
1353 static ssize_t vnc_client_read_plain(VncState *vs)
1354 {
1355 ssize_t ret;
1356 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1357 vs->input.buffer, vs->input.capacity, vs->input.offset);
1358 buffer_reserve(&vs->input, 4096);
1359 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1360 if (!ret)
1361 return 0;
1362 vs->input.offset += ret;
1363 return ret;
1364 }
1365
1366 static void vnc_jobs_bh(void *opaque)
1367 {
1368 VncState *vs = opaque;
1369
1370 vnc_jobs_consume_buffer(vs);
1371 }
1372
1373 /*
1374 * First function called whenever there is more data to be read from
1375 * the client socket. Will delegate actual work according to whether
1376 * SASL SSF layers are enabled (thus requiring decryption calls)
1377 * Returns 0 on success, -1 if client disconnected
1378 */
1379 static int vnc_client_read(VncState *vs)
1380 {
1381 ssize_t ret;
1382
1383 #ifdef CONFIG_VNC_SASL
1384 if (vs->sasl.conn && vs->sasl.runSSF)
1385 ret = vnc_client_read_sasl(vs);
1386 else
1387 #endif /* CONFIG_VNC_SASL */
1388 ret = vnc_client_read_plain(vs);
1389 if (!ret) {
1390 if (vs->disconnecting) {
1391 vnc_disconnect_finish(vs);
1392 return -1;
1393 }
1394 return 0;
1395 }
1396
1397 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1398 size_t len = vs->read_handler_expect;
1399 int ret;
1400
1401 ret = vs->read_handler(vs, vs->input.buffer, len);
1402 if (vs->disconnecting) {
1403 vnc_disconnect_finish(vs);
1404 return -1;
1405 }
1406
1407 if (!ret) {
1408 buffer_advance(&vs->input, len);
1409 } else {
1410 vs->read_handler_expect = ret;
1411 }
1412 }
1413 return 0;
1414 }
1415
1416 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1417 GIOCondition condition, void *opaque)
1418 {
1419 VncState *vs = opaque;
1420 if (condition & G_IO_IN) {
1421 if (vnc_client_read(vs) < 0) {
1422 return TRUE;
1423 }
1424 }
1425 if (condition & G_IO_OUT) {
1426 vnc_client_write(vs);
1427 }
1428 return TRUE;
1429 }
1430
1431
1432 void vnc_write(VncState *vs, const void *data, size_t len)
1433 {
1434 buffer_reserve(&vs->output, len);
1435
1436 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1437 if (vs->ioc_tag) {
1438 g_source_remove(vs->ioc_tag);
1439 }
1440 vs->ioc_tag = qio_channel_add_watch(
1441 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1442 }
1443
1444 buffer_append(&vs->output, data, len);
1445 }
1446
1447 void vnc_write_s32(VncState *vs, int32_t value)
1448 {
1449 vnc_write_u32(vs, *(uint32_t *)&value);
1450 }
1451
1452 void vnc_write_u32(VncState *vs, uint32_t value)
1453 {
1454 uint8_t buf[4];
1455
1456 buf[0] = (value >> 24) & 0xFF;
1457 buf[1] = (value >> 16) & 0xFF;
1458 buf[2] = (value >> 8) & 0xFF;
1459 buf[3] = value & 0xFF;
1460
1461 vnc_write(vs, buf, 4);
1462 }
1463
1464 void vnc_write_u16(VncState *vs, uint16_t value)
1465 {
1466 uint8_t buf[2];
1467
1468 buf[0] = (value >> 8) & 0xFF;
1469 buf[1] = value & 0xFF;
1470
1471 vnc_write(vs, buf, 2);
1472 }
1473
1474 void vnc_write_u8(VncState *vs, uint8_t value)
1475 {
1476 vnc_write(vs, (char *)&value, 1);
1477 }
1478
1479 void vnc_flush(VncState *vs)
1480 {
1481 vnc_lock_output(vs);
1482 if (vs->ioc != NULL && vs->output.offset) {
1483 vnc_client_write_locked(vs);
1484 }
1485 vnc_unlock_output(vs);
1486 }
1487
1488 static uint8_t read_u8(uint8_t *data, size_t offset)
1489 {
1490 return data[offset];
1491 }
1492
1493 static uint16_t read_u16(uint8_t *data, size_t offset)
1494 {
1495 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1496 }
1497
1498 static int32_t read_s32(uint8_t *data, size_t offset)
1499 {
1500 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1501 (data[offset + 2] << 8) | data[offset + 3]);
1502 }
1503
1504 uint32_t read_u32(uint8_t *data, size_t offset)
1505 {
1506 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1507 (data[offset + 2] << 8) | data[offset + 3]);
1508 }
1509
1510 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1511 {
1512 }
1513
1514 static void check_pointer_type_change(Notifier *notifier, void *data)
1515 {
1516 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1517 int absolute = qemu_input_is_absolute();
1518
1519 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1520 vnc_lock_output(vs);
1521 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1522 vnc_write_u8(vs, 0);
1523 vnc_write_u16(vs, 1);
1524 vnc_framebuffer_update(vs, absolute, 0,
1525 pixman_image_get_width(vs->vd->server),
1526 pixman_image_get_height(vs->vd->server),
1527 VNC_ENCODING_POINTER_TYPE_CHANGE);
1528 vnc_unlock_output(vs);
1529 vnc_flush(vs);
1530 }
1531 vs->absolute = absolute;
1532 }
1533
1534 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1535 {
1536 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1537 [INPUT_BUTTON_LEFT] = 0x01,
1538 [INPUT_BUTTON_MIDDLE] = 0x02,
1539 [INPUT_BUTTON_RIGHT] = 0x04,
1540 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1541 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1542 };
1543 QemuConsole *con = vs->vd->dcl.con;
1544 int width = pixman_image_get_width(vs->vd->server);
1545 int height = pixman_image_get_height(vs->vd->server);
1546
1547 if (vs->last_bmask != button_mask) {
1548 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1549 vs->last_bmask = button_mask;
1550 }
1551
1552 if (vs->absolute) {
1553 qemu_input_queue_abs(con, INPUT_AXIS_X, x, width);
1554 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height);
1555 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1556 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1557 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1558 } else {
1559 if (vs->last_x != -1) {
1560 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1561 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1562 }
1563 vs->last_x = x;
1564 vs->last_y = y;
1565 }
1566 qemu_input_event_sync();
1567 }
1568
1569 static void reset_keys(VncState *vs)
1570 {
1571 int i;
1572 for(i = 0; i < 256; i++) {
1573 if (vs->modifiers_state[i]) {
1574 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1575 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1576 vs->modifiers_state[i] = 0;
1577 }
1578 }
1579 }
1580
1581 static void press_key(VncState *vs, int keysym)
1582 {
1583 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1584 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1585 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1586 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1587 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1588 }
1589
1590 static void vnc_led_state_change(VncState *vs)
1591 {
1592 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1593 return;
1594 }
1595
1596 vnc_lock_output(vs);
1597 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1598 vnc_write_u8(vs, 0);
1599 vnc_write_u16(vs, 1);
1600 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1601 vnc_write_u8(vs, vs->vd->ledstate);
1602 vnc_unlock_output(vs);
1603 vnc_flush(vs);
1604 }
1605
1606 static void kbd_leds(void *opaque, int ledstate)
1607 {
1608 VncDisplay *vd = opaque;
1609 VncState *client;
1610
1611 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1612 (ledstate & QEMU_NUM_LOCK_LED),
1613 (ledstate & QEMU_SCROLL_LOCK_LED));
1614
1615 if (ledstate == vd->ledstate) {
1616 return;
1617 }
1618
1619 vd->ledstate = ledstate;
1620
1621 QTAILQ_FOREACH(client, &vd->clients, next) {
1622 vnc_led_state_change(client);
1623 }
1624 }
1625
1626 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1627 {
1628 /* QEMU console switch */
1629 switch(keycode) {
1630 case 0x2a: /* Left Shift */
1631 case 0x36: /* Right Shift */
1632 case 0x1d: /* Left CTRL */
1633 case 0x9d: /* Right CTRL */
1634 case 0x38: /* Left ALT */
1635 case 0xb8: /* Right ALT */
1636 if (down)
1637 vs->modifiers_state[keycode] = 1;
1638 else
1639 vs->modifiers_state[keycode] = 0;
1640 break;
1641 case 0x02 ... 0x0a: /* '1' to '9' keys */
1642 if (vs->vd->dcl.con == NULL &&
1643 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1644 /* Reset the modifiers sent to the current console */
1645 reset_keys(vs);
1646 console_select(keycode - 0x02);
1647 return;
1648 }
1649 break;
1650 case 0x3a: /* CapsLock */
1651 case 0x45: /* NumLock */
1652 if (down)
1653 vs->modifiers_state[keycode] ^= 1;
1654 break;
1655 }
1656
1657 /* Turn off the lock state sync logic if the client support the led
1658 state extension.
1659 */
1660 if (down && vs->vd->lock_key_sync &&
1661 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1662 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1663 /* If the numlock state needs to change then simulate an additional
1664 keypress before sending this one. This will happen if the user
1665 toggles numlock away from the VNC window.
1666 */
1667 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1668 if (!vs->modifiers_state[0x45]) {
1669 trace_vnc_key_sync_numlock(true);
1670 vs->modifiers_state[0x45] = 1;
1671 press_key(vs, 0xff7f);
1672 }
1673 } else {
1674 if (vs->modifiers_state[0x45]) {
1675 trace_vnc_key_sync_numlock(false);
1676 vs->modifiers_state[0x45] = 0;
1677 press_key(vs, 0xff7f);
1678 }
1679 }
1680 }
1681
1682 if (down && vs->vd->lock_key_sync &&
1683 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1684 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1685 /* If the capslock state needs to change then simulate an additional
1686 keypress before sending this one. This will happen if the user
1687 toggles capslock away from the VNC window.
1688 */
1689 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1690 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1691 int capslock = !!(vs->modifiers_state[0x3a]);
1692 if (capslock) {
1693 if (uppercase == shift) {
1694 trace_vnc_key_sync_capslock(false);
1695 vs->modifiers_state[0x3a] = 0;
1696 press_key(vs, 0xffe5);
1697 }
1698 } else {
1699 if (uppercase != shift) {
1700 trace_vnc_key_sync_capslock(true);
1701 vs->modifiers_state[0x3a] = 1;
1702 press_key(vs, 0xffe5);
1703 }
1704 }
1705 }
1706
1707 if (qemu_console_is_graphic(NULL)) {
1708 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1709 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1710 } else {
1711 bool numlock = vs->modifiers_state[0x45];
1712 bool control = (vs->modifiers_state[0x1d] ||
1713 vs->modifiers_state[0x9d]);
1714 /* QEMU console emulation */
1715 if (down) {
1716 switch (keycode) {
1717 case 0x2a: /* Left Shift */
1718 case 0x36: /* Right Shift */
1719 case 0x1d: /* Left CTRL */
1720 case 0x9d: /* Right CTRL */
1721 case 0x38: /* Left ALT */
1722 case 0xb8: /* Right ALT */
1723 break;
1724 case 0xc8:
1725 kbd_put_keysym(QEMU_KEY_UP);
1726 break;
1727 case 0xd0:
1728 kbd_put_keysym(QEMU_KEY_DOWN);
1729 break;
1730 case 0xcb:
1731 kbd_put_keysym(QEMU_KEY_LEFT);
1732 break;
1733 case 0xcd:
1734 kbd_put_keysym(QEMU_KEY_RIGHT);
1735 break;
1736 case 0xd3:
1737 kbd_put_keysym(QEMU_KEY_DELETE);
1738 break;
1739 case 0xc7:
1740 kbd_put_keysym(QEMU_KEY_HOME);
1741 break;
1742 case 0xcf:
1743 kbd_put_keysym(QEMU_KEY_END);
1744 break;
1745 case 0xc9:
1746 kbd_put_keysym(QEMU_KEY_PAGEUP);
1747 break;
1748 case 0xd1:
1749 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1750 break;
1751
1752 case 0x47:
1753 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1754 break;
1755 case 0x48:
1756 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1757 break;
1758 case 0x49:
1759 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1760 break;
1761 case 0x4b:
1762 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1763 break;
1764 case 0x4c:
1765 kbd_put_keysym('5');
1766 break;
1767 case 0x4d:
1768 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1769 break;
1770 case 0x4f:
1771 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1772 break;
1773 case 0x50:
1774 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1775 break;
1776 case 0x51:
1777 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1778 break;
1779 case 0x52:
1780 kbd_put_keysym('0');
1781 break;
1782 case 0x53:
1783 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1784 break;
1785
1786 case 0xb5:
1787 kbd_put_keysym('/');
1788 break;
1789 case 0x37:
1790 kbd_put_keysym('*');
1791 break;
1792 case 0x4a:
1793 kbd_put_keysym('-');
1794 break;
1795 case 0x4e:
1796 kbd_put_keysym('+');
1797 break;
1798 case 0x9c:
1799 kbd_put_keysym('\n');
1800 break;
1801
1802 default:
1803 if (control) {
1804 kbd_put_keysym(sym & 0x1f);
1805 } else {
1806 kbd_put_keysym(sym);
1807 }
1808 break;
1809 }
1810 }
1811 }
1812 }
1813
1814 static void vnc_release_modifiers(VncState *vs)
1815 {
1816 static const int keycodes[] = {
1817 /* shift, control, alt keys, both left & right */
1818 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1819 };
1820 int i, keycode;
1821
1822 if (!qemu_console_is_graphic(NULL)) {
1823 return;
1824 }
1825 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1826 keycode = keycodes[i];
1827 if (!vs->modifiers_state[keycode]) {
1828 continue;
1829 }
1830 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1831 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1832 }
1833 }
1834
1835 static const char *code2name(int keycode)
1836 {
1837 return QKeyCode_lookup[qemu_input_key_number_to_qcode(keycode)];
1838 }
1839
1840 static void key_event(VncState *vs, int down, uint32_t sym)
1841 {
1842 int keycode;
1843 int lsym = sym;
1844
1845 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1846 lsym = lsym - 'A' + 'a';
1847 }
1848
1849 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1850 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
1851 do_key_event(vs, down, keycode, sym);
1852 }
1853
1854 static void ext_key_event(VncState *vs, int down,
1855 uint32_t sym, uint16_t keycode)
1856 {
1857 /* if the user specifies a keyboard layout, always use it */
1858 if (keyboard_layout) {
1859 key_event(vs, down, sym);
1860 } else {
1861 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
1862 do_key_event(vs, down, keycode, sym);
1863 }
1864 }
1865
1866 static void framebuffer_update_request(VncState *vs, int incremental,
1867 int x, int y, int w, int h)
1868 {
1869 vs->need_update = 1;
1870
1871 if (incremental) {
1872 return;
1873 }
1874
1875 vs->force_update = 1;
1876 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
1877 }
1878
1879 static void send_ext_key_event_ack(VncState *vs)
1880 {
1881 vnc_lock_output(vs);
1882 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1883 vnc_write_u8(vs, 0);
1884 vnc_write_u16(vs, 1);
1885 vnc_framebuffer_update(vs, 0, 0,
1886 pixman_image_get_width(vs->vd->server),
1887 pixman_image_get_height(vs->vd->server),
1888 VNC_ENCODING_EXT_KEY_EVENT);
1889 vnc_unlock_output(vs);
1890 vnc_flush(vs);
1891 }
1892
1893 static void send_ext_audio_ack(VncState *vs)
1894 {
1895 vnc_lock_output(vs);
1896 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1897 vnc_write_u8(vs, 0);
1898 vnc_write_u16(vs, 1);
1899 vnc_framebuffer_update(vs, 0, 0,
1900 pixman_image_get_width(vs->vd->server),
1901 pixman_image_get_height(vs->vd->server),
1902 VNC_ENCODING_AUDIO);
1903 vnc_unlock_output(vs);
1904 vnc_flush(vs);
1905 }
1906
1907 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1908 {
1909 int i;
1910 unsigned int enc = 0;
1911
1912 vs->features = 0;
1913 vs->vnc_encoding = 0;
1914 vs->tight.compression = 9;
1915 vs->tight.quality = -1; /* Lossless by default */
1916 vs->absolute = -1;
1917
1918 /*
1919 * Start from the end because the encodings are sent in order of preference.
1920 * This way the preferred encoding (first encoding defined in the array)
1921 * will be set at the end of the loop.
1922 */
1923 for (i = n_encodings - 1; i >= 0; i--) {
1924 enc = encodings[i];
1925 switch (enc) {
1926 case VNC_ENCODING_RAW:
1927 vs->vnc_encoding = enc;
1928 break;
1929 case VNC_ENCODING_COPYRECT:
1930 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1931 break;
1932 case VNC_ENCODING_HEXTILE:
1933 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1934 vs->vnc_encoding = enc;
1935 break;
1936 case VNC_ENCODING_TIGHT:
1937 vs->features |= VNC_FEATURE_TIGHT_MASK;
1938 vs->vnc_encoding = enc;
1939 break;
1940 #ifdef CONFIG_VNC_PNG
1941 case VNC_ENCODING_TIGHT_PNG:
1942 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1943 vs->vnc_encoding = enc;
1944 break;
1945 #endif
1946 case VNC_ENCODING_ZLIB:
1947 vs->features |= VNC_FEATURE_ZLIB_MASK;
1948 vs->vnc_encoding = enc;
1949 break;
1950 case VNC_ENCODING_ZRLE:
1951 vs->features |= VNC_FEATURE_ZRLE_MASK;
1952 vs->vnc_encoding = enc;
1953 break;
1954 case VNC_ENCODING_ZYWRLE:
1955 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1956 vs->vnc_encoding = enc;
1957 break;
1958 case VNC_ENCODING_DESKTOPRESIZE:
1959 vs->features |= VNC_FEATURE_RESIZE_MASK;
1960 break;
1961 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1962 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1963 break;
1964 case VNC_ENCODING_RICH_CURSOR:
1965 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1966 if (vs->vd->cursor) {
1967 vnc_cursor_define(vs);
1968 }
1969 break;
1970 case VNC_ENCODING_EXT_KEY_EVENT:
1971 send_ext_key_event_ack(vs);
1972 break;
1973 case VNC_ENCODING_AUDIO:
1974 send_ext_audio_ack(vs);
1975 break;
1976 case VNC_ENCODING_WMVi:
1977 vs->features |= VNC_FEATURE_WMVI_MASK;
1978 break;
1979 case VNC_ENCODING_LED_STATE:
1980 vs->features |= VNC_FEATURE_LED_STATE_MASK;
1981 break;
1982 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1983 vs->tight.compression = (enc & 0x0F);
1984 break;
1985 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1986 if (vs->vd->lossy) {
1987 vs->tight.quality = (enc & 0x0F);
1988 }
1989 break;
1990 default:
1991 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1992 break;
1993 }
1994 }
1995 vnc_desktop_resize(vs);
1996 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1997 vnc_led_state_change(vs);
1998 }
1999
2000 static void set_pixel_conversion(VncState *vs)
2001 {
2002 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2003
2004 if (fmt == VNC_SERVER_FB_FORMAT) {
2005 vs->write_pixels = vnc_write_pixels_copy;
2006 vnc_hextile_set_pixel_conversion(vs, 0);
2007 } else {
2008 vs->write_pixels = vnc_write_pixels_generic;
2009 vnc_hextile_set_pixel_conversion(vs, 1);
2010 }
2011 }
2012
2013 static void send_color_map(VncState *vs)
2014 {
2015 int i;
2016
2017 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2018 vnc_write_u8(vs, 0); /* padding */
2019 vnc_write_u16(vs, 0); /* first color */
2020 vnc_write_u16(vs, 256); /* # of colors */
2021
2022 for (i = 0; i < 256; i++) {
2023 PixelFormat *pf = &vs->client_pf;
2024
2025 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2026 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2027 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2028 }
2029 }
2030
2031 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2032 int big_endian_flag, int true_color_flag,
2033 int red_max, int green_max, int blue_max,
2034 int red_shift, int green_shift, int blue_shift)
2035 {
2036 if (!true_color_flag) {
2037 /* Expose a reasonable default 256 color map */
2038 bits_per_pixel = 8;
2039 red_max = 7;
2040 green_max = 7;
2041 blue_max = 3;
2042 red_shift = 0;
2043 green_shift = 3;
2044 blue_shift = 6;
2045 }
2046
2047 switch (bits_per_pixel) {
2048 case 8:
2049 case 16:
2050 case 32:
2051 break;
2052 default:
2053 vnc_client_error(vs);
2054 return;
2055 }
2056
2057 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2058 vs->client_pf.rbits = hweight_long(red_max);
2059 vs->client_pf.rshift = red_shift;
2060 vs->client_pf.rmask = red_max << red_shift;
2061 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2062 vs->client_pf.gbits = hweight_long(green_max);
2063 vs->client_pf.gshift = green_shift;
2064 vs->client_pf.gmask = green_max << green_shift;
2065 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2066 vs->client_pf.bbits = hweight_long(blue_max);
2067 vs->client_pf.bshift = blue_shift;
2068 vs->client_pf.bmask = blue_max << blue_shift;
2069 vs->client_pf.bits_per_pixel = bits_per_pixel;
2070 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2071 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2072 vs->client_be = big_endian_flag;
2073
2074 if (!true_color_flag) {
2075 send_color_map(vs);
2076 }
2077
2078 set_pixel_conversion(vs);
2079
2080 graphic_hw_invalidate(vs->vd->dcl.con);
2081 graphic_hw_update(vs->vd->dcl.con);
2082 }
2083
2084 static void pixel_format_message (VncState *vs) {
2085 char pad[3] = { 0, 0, 0 };
2086
2087 vs->client_pf = qemu_default_pixelformat(32);
2088
2089 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2090 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2091
2092 #ifdef HOST_WORDS_BIGENDIAN
2093 vnc_write_u8(vs, 1); /* big-endian-flag */
2094 #else
2095 vnc_write_u8(vs, 0); /* big-endian-flag */
2096 #endif
2097 vnc_write_u8(vs, 1); /* true-color-flag */
2098 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2099 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2100 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2101 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2102 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2103 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2104 vnc_write(vs, pad, 3); /* padding */
2105
2106 vnc_hextile_set_pixel_conversion(vs, 0);
2107 vs->write_pixels = vnc_write_pixels_copy;
2108 }
2109
2110 static void vnc_colordepth(VncState *vs)
2111 {
2112 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2113 /* Sending a WMVi message to notify the client*/
2114 vnc_lock_output(vs);
2115 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2116 vnc_write_u8(vs, 0);
2117 vnc_write_u16(vs, 1); /* number of rects */
2118 vnc_framebuffer_update(vs, 0, 0,
2119 pixman_image_get_width(vs->vd->server),
2120 pixman_image_get_height(vs->vd->server),
2121 VNC_ENCODING_WMVi);
2122 pixel_format_message(vs);
2123 vnc_unlock_output(vs);
2124 vnc_flush(vs);
2125 } else {
2126 set_pixel_conversion(vs);
2127 }
2128 }
2129
2130 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2131 {
2132 int i;
2133 uint16_t limit;
2134 VncDisplay *vd = vs->vd;
2135
2136 if (data[0] > 3) {
2137 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2138 }
2139
2140 switch (data[0]) {
2141 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2142 if (len == 1)
2143 return 20;
2144
2145 set_pixel_format(vs, read_u8(data, 4),
2146 read_u8(data, 6), read_u8(data, 7),
2147 read_u16(data, 8), read_u16(data, 10),
2148 read_u16(data, 12), read_u8(data, 14),
2149 read_u8(data, 15), read_u8(data, 16));
2150 break;
2151 case VNC_MSG_CLIENT_SET_ENCODINGS:
2152 if (len == 1)
2153 return 4;
2154
2155 if (len == 4) {
2156 limit = read_u16(data, 2);
2157 if (limit > 0)
2158 return 4 + (limit * 4);
2159 } else
2160 limit = read_u16(data, 2);
2161
2162 for (i = 0; i < limit; i++) {
2163 int32_t val = read_s32(data, 4 + (i * 4));
2164 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2165 }
2166
2167 set_encodings(vs, (int32_t *)(data + 4), limit);
2168 break;
2169 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2170 if (len == 1)
2171 return 10;
2172
2173 framebuffer_update_request(vs,
2174 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2175 read_u16(data, 6), read_u16(data, 8));
2176 break;
2177 case VNC_MSG_CLIENT_KEY_EVENT:
2178 if (len == 1)
2179 return 8;
2180
2181 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2182 break;
2183 case VNC_MSG_CLIENT_POINTER_EVENT:
2184 if (len == 1)
2185 return 6;
2186
2187 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2188 break;
2189 case VNC_MSG_CLIENT_CUT_TEXT:
2190 if (len == 1) {
2191 return 8;
2192 }
2193 if (len == 8) {
2194 uint32_t dlen = read_u32(data, 4);
2195 if (dlen > (1 << 20)) {
2196 error_report("vnc: client_cut_text msg payload has %u bytes"
2197 " which exceeds our limit of 1MB.", dlen);
2198 vnc_client_error(vs);
2199 break;
2200 }
2201 if (dlen > 0) {
2202 return 8 + dlen;
2203 }
2204 }
2205
2206 client_cut_text(vs, read_u32(data, 4), data + 8);
2207 break;
2208 case VNC_MSG_CLIENT_QEMU:
2209 if (len == 1)
2210 return 2;
2211
2212 switch (read_u8(data, 1)) {
2213 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2214 if (len == 2)
2215 return 12;
2216
2217 ext_key_event(vs, read_u16(data, 2),
2218 read_u32(data, 4), read_u32(data, 8));
2219 break;
2220 case VNC_MSG_CLIENT_QEMU_AUDIO:
2221 if (len == 2)
2222 return 4;
2223
2224 switch (read_u16 (data, 2)) {
2225 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2226 audio_add(vs);
2227 break;
2228 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2229 audio_del(vs);
2230 break;
2231 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2232 if (len == 4)
2233 return 10;
2234 switch (read_u8(data, 4)) {
2235 case 0: vs->as.fmt = AUD_FMT_U8; break;
2236 case 1: vs->as.fmt = AUD_FMT_S8; break;
2237 case 2: vs->as.fmt = AUD_FMT_U16; break;
2238 case 3: vs->as.fmt = AUD_FMT_S16; break;
2239 case 4: vs->as.fmt = AUD_FMT_U32; break;
2240 case 5: vs->as.fmt = AUD_FMT_S32; break;
2241 default:
2242 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2243 vnc_client_error(vs);
2244 return -1;
2245 }
2246 vs->as.nchannels = read_u8(data, 5);
2247 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2248 VNC_DEBUG("Invalid audio channel coount %d\n",
2249 read_u8(data, 5));
2250 vnc_client_error(vs);
2251 return -1;
2252 }
2253 vs->as.freq = read_u32(data, 6);
2254 break;
2255 default:
2256 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2257 vnc_client_error(vs);
2258 return -1;
2259 }
2260 break;
2261
2262 default:
2263 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2264 vnc_client_error(vs);
2265 return -1;
2266 }
2267 break;
2268 default:
2269 VNC_DEBUG("Msg: %d\n", data[0]);
2270 vnc_client_error(vs);
2271 return -1;
2272 }
2273
2274 vnc_read_when(vs, protocol_client_msg, 1);
2275 return 0;
2276 }
2277
2278 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2279 {
2280 char buf[1024];
2281 VncShareMode mode;
2282 int size;
2283
2284 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2285 switch (vs->vd->share_policy) {
2286 case VNC_SHARE_POLICY_IGNORE:
2287 /*
2288 * Ignore the shared flag. Nothing to do here.
2289 *
2290 * Doesn't conform to the rfb spec but is traditional qemu
2291 * behavior, thus left here as option for compatibility
2292 * reasons.
2293 */
2294 break;
2295 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2296 /*
2297 * Policy: Allow clients ask for exclusive access.
2298 *
2299 * Implementation: When a client asks for exclusive access,
2300 * disconnect all others. Shared connects are allowed as long
2301 * as no exclusive connection exists.
2302 *
2303 * This is how the rfb spec suggests to handle the shared flag.
2304 */
2305 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2306 VncState *client;
2307 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2308 if (vs == client) {
2309 continue;
2310 }
2311 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2312 client->share_mode != VNC_SHARE_MODE_SHARED) {
2313 continue;
2314 }
2315 vnc_disconnect_start(client);
2316 }
2317 }
2318 if (mode == VNC_SHARE_MODE_SHARED) {
2319 if (vs->vd->num_exclusive > 0) {
2320 vnc_disconnect_start(vs);
2321 return 0;
2322 }
2323 }
2324 break;
2325 case VNC_SHARE_POLICY_FORCE_SHARED:
2326 /*
2327 * Policy: Shared connects only.
2328 * Implementation: Disallow clients asking for exclusive access.
2329 *
2330 * Useful for shared desktop sessions where you don't want
2331 * someone forgetting to say -shared when running the vnc
2332 * client disconnect everybody else.
2333 */
2334 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2335 vnc_disconnect_start(vs);
2336 return 0;
2337 }
2338 break;
2339 }
2340 vnc_set_share_mode(vs, mode);
2341
2342 if (vs->vd->num_shared > vs->vd->connections_limit) {
2343 vnc_disconnect_start(vs);
2344 return 0;
2345 }
2346
2347 vs->client_width = pixman_image_get_width(vs->vd->server);
2348 vs->client_height = pixman_image_get_height(vs->vd->server);
2349 vnc_write_u16(vs, vs->client_width);
2350 vnc_write_u16(vs, vs->client_height);
2351
2352 pixel_format_message(vs);
2353
2354 if (qemu_name) {
2355 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2356 if (size > sizeof(buf)) {
2357 size = sizeof(buf);
2358 }
2359 } else {
2360 size = snprintf(buf, sizeof(buf), "QEMU");
2361 }
2362
2363 vnc_write_u32(vs, size);
2364 vnc_write(vs, buf, size);
2365 vnc_flush(vs);
2366
2367 vnc_client_cache_auth(vs);
2368 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2369
2370 vnc_read_when(vs, protocol_client_msg, 1);
2371
2372 return 0;
2373 }
2374
2375 void start_client_init(VncState *vs)
2376 {
2377 vnc_read_when(vs, protocol_client_init, 1);
2378 }
2379
2380 static void make_challenge(VncState *vs)
2381 {
2382 int i;
2383
2384 srand(time(NULL)+getpid()+getpid()*987654+rand());
2385
2386 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2387 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2388 }
2389
2390 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2391 {
2392 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2393 size_t i, pwlen;
2394 unsigned char key[8];
2395 time_t now = time(NULL);
2396 QCryptoCipher *cipher = NULL;
2397 Error *err = NULL;
2398
2399 if (!vs->vd->password) {
2400 VNC_DEBUG("No password configured on server");
2401 goto reject;
2402 }
2403 if (vs->vd->expires < now) {
2404 VNC_DEBUG("Password is expired");
2405 goto reject;
2406 }
2407
2408 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2409
2410 /* Calculate the expected challenge response */
2411 pwlen = strlen(vs->vd->password);
2412 for (i=0; i<sizeof(key); i++)
2413 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2414
2415 cipher = qcrypto_cipher_new(
2416 QCRYPTO_CIPHER_ALG_DES_RFB,
2417 QCRYPTO_CIPHER_MODE_ECB,
2418 key, G_N_ELEMENTS(key),
2419 &err);
2420 if (!cipher) {
2421 VNC_DEBUG("Cannot initialize cipher %s",
2422 error_get_pretty(err));
2423 error_free(err);
2424 goto reject;
2425 }
2426
2427 if (qcrypto_cipher_encrypt(cipher,
2428 vs->challenge,
2429 response,
2430 VNC_AUTH_CHALLENGE_SIZE,
2431 &err) < 0) {
2432 VNC_DEBUG("Cannot encrypt challenge %s",
2433 error_get_pretty(err));
2434 error_free(err);
2435 goto reject;
2436 }
2437
2438 /* Compare expected vs actual challenge response */
2439 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2440 VNC_DEBUG("Client challenge response did not match\n");
2441 goto reject;
2442 } else {
2443 VNC_DEBUG("Accepting VNC challenge response\n");
2444 vnc_write_u32(vs, 0); /* Accept auth */
2445 vnc_flush(vs);
2446
2447 start_client_init(vs);
2448 }
2449
2450 qcrypto_cipher_free(cipher);
2451 return 0;
2452
2453 reject:
2454 vnc_write_u32(vs, 1); /* Reject auth */
2455 if (vs->minor >= 8) {
2456 static const char err[] = "Authentication failed";
2457 vnc_write_u32(vs, sizeof(err));
2458 vnc_write(vs, err, sizeof(err));
2459 }
2460 vnc_flush(vs);
2461 vnc_client_error(vs);
2462 qcrypto_cipher_free(cipher);
2463 return 0;
2464 }
2465
2466 void start_auth_vnc(VncState *vs)
2467 {
2468 make_challenge(vs);
2469 /* Send client a 'random' challenge */
2470 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2471 vnc_flush(vs);
2472
2473 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2474 }
2475
2476
2477 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2478 {
2479 /* We only advertise 1 auth scheme at a time, so client
2480 * must pick the one we sent. Verify this */
2481 if (data[0] != vs->auth) { /* Reject auth */
2482 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2483 vnc_write_u32(vs, 1);
2484 if (vs->minor >= 8) {
2485 static const char err[] = "Authentication failed";
2486 vnc_write_u32(vs, sizeof(err));
2487 vnc_write(vs, err, sizeof(err));
2488 }
2489 vnc_client_error(vs);
2490 } else { /* Accept requested auth */
2491 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2492 switch (vs->auth) {
2493 case VNC_AUTH_NONE:
2494 VNC_DEBUG("Accept auth none\n");
2495 if (vs->minor >= 8) {
2496 vnc_write_u32(vs, 0); /* Accept auth completion */
2497 vnc_flush(vs);
2498 }
2499 start_client_init(vs);
2500 break;
2501
2502 case VNC_AUTH_VNC:
2503 VNC_DEBUG("Start VNC auth\n");
2504 start_auth_vnc(vs);
2505 break;
2506
2507 case VNC_AUTH_VENCRYPT:
2508 VNC_DEBUG("Accept VeNCrypt auth\n");
2509 start_auth_vencrypt(vs);
2510 break;
2511
2512 #ifdef CONFIG_VNC_SASL
2513 case VNC_AUTH_SASL:
2514 VNC_DEBUG("Accept SASL auth\n");
2515 start_auth_sasl(vs);
2516 break;
2517 #endif /* CONFIG_VNC_SASL */
2518
2519 default: /* Should not be possible, but just in case */
2520 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2521 vnc_write_u8(vs, 1);
2522 if (vs->minor >= 8) {
2523 static const char err[] = "Authentication failed";
2524 vnc_write_u32(vs, sizeof(err));
2525 vnc_write(vs, err, sizeof(err));
2526 }
2527 vnc_client_error(vs);
2528 }
2529 }
2530 return 0;
2531 }
2532
2533 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2534 {
2535 char local[13];
2536
2537 memcpy(local, version, 12);
2538 local[12] = 0;
2539
2540 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2541 VNC_DEBUG("Malformed protocol version %s\n", local);
2542 vnc_client_error(vs);
2543 return 0;
2544 }
2545 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2546 if (vs->major != 3 ||
2547 (vs->minor != 3 &&
2548 vs->minor != 4 &&
2549 vs->minor != 5 &&
2550 vs->minor != 7 &&
2551 vs->minor != 8)) {
2552 VNC_DEBUG("Unsupported client version\n");
2553 vnc_write_u32(vs, VNC_AUTH_INVALID);
2554 vnc_flush(vs);
2555 vnc_client_error(vs);
2556 return 0;
2557 }
2558 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2559 * as equivalent to v3.3 by servers
2560 */
2561 if (vs->minor == 4 || vs->minor == 5)
2562 vs->minor = 3;
2563
2564 if (vs->minor == 3) {
2565 if (vs->auth == VNC_AUTH_NONE) {
2566 VNC_DEBUG("Tell client auth none\n");
2567 vnc_write_u32(vs, vs->auth);
2568 vnc_flush(vs);
2569 start_client_init(vs);
2570 } else if (vs->auth == VNC_AUTH_VNC) {
2571 VNC_DEBUG("Tell client VNC auth\n");
2572 vnc_write_u32(vs, vs->auth);
2573 vnc_flush(vs);
2574 start_auth_vnc(vs);
2575 } else {
2576 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2577 vnc_write_u32(vs, VNC_AUTH_INVALID);
2578 vnc_flush(vs);
2579 vnc_client_error(vs);
2580 }
2581 } else {
2582 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2583 vnc_write_u8(vs, 1); /* num auth */
2584 vnc_write_u8(vs, vs->auth);
2585 vnc_read_when(vs, protocol_client_auth, 1);
2586 vnc_flush(vs);
2587 }
2588
2589 return 0;
2590 }
2591
2592 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2593 {
2594 struct VncSurface *vs = &vd->guest;
2595
2596 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2597 }
2598
2599 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2600 {
2601 int i, j;
2602
2603 w = (x + w) / VNC_STAT_RECT;
2604 h = (y + h) / VNC_STAT_RECT;
2605 x /= VNC_STAT_RECT;
2606 y /= VNC_STAT_RECT;
2607
2608 for (j = y; j <= h; j++) {
2609 for (i = x; i <= w; i++) {
2610 vs->lossy_rect[j][i] = 1;
2611 }
2612 }
2613 }
2614
2615 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2616 {
2617 VncState *vs;
2618 int sty = y / VNC_STAT_RECT;
2619 int stx = x / VNC_STAT_RECT;
2620 int has_dirty = 0;
2621
2622 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2623 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2624
2625 QTAILQ_FOREACH(vs, &vd->clients, next) {
2626 int j;
2627
2628 /* kernel send buffers are full -> refresh later */
2629 if (vs->output.offset) {
2630 continue;
2631 }
2632
2633 if (!vs->lossy_rect[sty][stx]) {
2634 continue;
2635 }
2636
2637 vs->lossy_rect[sty][stx] = 0;
2638 for (j = 0; j < VNC_STAT_RECT; ++j) {
2639 bitmap_set(vs->dirty[y + j],
2640 x / VNC_DIRTY_PIXELS_PER_BIT,
2641 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2642 }
2643 has_dirty++;
2644 }
2645
2646 return has_dirty;
2647 }
2648
2649 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2650 {
2651 int width = MIN(pixman_image_get_width(vd->guest.fb),
2652 pixman_image_get_width(vd->server));
2653 int height = MIN(pixman_image_get_height(vd->guest.fb),
2654 pixman_image_get_height(vd->server));
2655 int x, y;
2656 struct timeval res;
2657 int has_dirty = 0;
2658
2659 for (y = 0; y < height; y += VNC_STAT_RECT) {
2660 for (x = 0; x < width; x += VNC_STAT_RECT) {
2661 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2662
2663 rect->updated = false;
2664 }
2665 }
2666
2667 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2668
2669 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2670 return has_dirty;
2671 }
2672 vd->guest.last_freq_check = *tv;
2673
2674 for (y = 0; y < height; y += VNC_STAT_RECT) {
2675 for (x = 0; x < width; x += VNC_STAT_RECT) {
2676 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2677 int count = ARRAY_SIZE(rect->times);
2678 struct timeval min, max;
2679
2680 if (!timerisset(&rect->times[count - 1])) {
2681 continue ;
2682 }
2683
2684 max = rect->times[(rect->idx + count - 1) % count];
2685 qemu_timersub(tv, &max, &res);
2686
2687 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2688 rect->freq = 0;
2689 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2690 memset(rect->times, 0, sizeof (rect->times));
2691 continue ;
2692 }
2693
2694 min = rect->times[rect->idx];
2695 max = rect->times[(rect->idx + count - 1) % count];
2696 qemu_timersub(&max, &min, &res);
2697
2698 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2699 rect->freq /= count;
2700 rect->freq = 1. / rect->freq;
2701 }
2702 }
2703 return has_dirty;
2704 }
2705
2706 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2707 {
2708 int i, j;
2709 double total = 0;
2710 int num = 0;
2711
2712 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2713 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2714
2715 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2716 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2717 total += vnc_stat_rect(vs->vd, i, j)->freq;
2718 num++;
2719 }
2720 }
2721
2722 if (num) {
2723 return total / num;
2724 } else {
2725 return 0;
2726 }
2727 }
2728
2729 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2730 {
2731 VncRectStat *rect;
2732
2733 rect = vnc_stat_rect(vd, x, y);
2734 if (rect->updated) {
2735 return ;
2736 }
2737 rect->times[rect->idx] = *tv;
2738 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2739 rect->updated = true;
2740 }
2741
2742 static int vnc_refresh_server_surface(VncDisplay *vd)
2743 {
2744 int width = MIN(pixman_image_get_width(vd->guest.fb),
2745 pixman_image_get_width(vd->server));
2746 int height = MIN(pixman_image_get_height(vd->guest.fb),
2747 pixman_image_get_height(vd->server));
2748 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2749 uint8_t *guest_row0 = NULL, *server_row0;
2750 VncState *vs;
2751 int has_dirty = 0;
2752 pixman_image_t *tmpbuf = NULL;
2753
2754 struct timeval tv = { 0, 0 };
2755
2756 if (!vd->non_adaptive) {
2757 gettimeofday(&tv, NULL);
2758 has_dirty = vnc_update_stats(vd, &tv);
2759 }
2760
2761 /*
2762 * Walk through the guest dirty map.
2763 * Check and copy modified bits from guest to server surface.
2764 * Update server dirty map.
2765 */
2766 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2767 server_stride = guest_stride = guest_ll =
2768 pixman_image_get_stride(vd->server);
2769 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2770 server_stride);
2771 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2772 int width = pixman_image_get_width(vd->server);
2773 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2774 } else {
2775 int guest_bpp =
2776 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2777 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2778 guest_stride = pixman_image_get_stride(vd->guest.fb);
2779 guest_ll = pixman_image_get_width(vd->guest.fb) * ((guest_bpp + 7) / 8);
2780 }
2781 line_bytes = MIN(server_stride, guest_ll);
2782
2783 for (;;) {
2784 int x;
2785 uint8_t *guest_ptr, *server_ptr;
2786 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2787 height * VNC_DIRTY_BPL(&vd->guest),
2788 y * VNC_DIRTY_BPL(&vd->guest));
2789 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2790 /* no more dirty bits */
2791 break;
2792 }
2793 y = offset / VNC_DIRTY_BPL(&vd->guest);
2794 x = offset % VNC_DIRTY_BPL(&vd->guest);
2795
2796 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2797
2798 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2799 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2800 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2801 } else {
2802 guest_ptr = guest_row0 + y * guest_stride;
2803 }
2804 guest_ptr += x * cmp_bytes;
2805
2806 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2807 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2808 int _cmp_bytes = cmp_bytes;
2809 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2810 continue;
2811 }
2812 if ((x + 1) * cmp_bytes > line_bytes) {
2813 _cmp_bytes = line_bytes - x * cmp_bytes;
2814 }
2815 assert(_cmp_bytes >= 0);
2816 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2817 continue;
2818 }
2819 memcpy(server_ptr, guest_ptr, _cmp_bytes);
2820 if (!vd->non_adaptive) {
2821 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2822 y, &tv);
2823 }
2824 QTAILQ_FOREACH(vs, &vd->clients, next) {
2825 set_bit(x, vs->dirty[y]);
2826 }
2827 has_dirty++;
2828 }
2829
2830 y++;
2831 }
2832 qemu_pixman_image_unref(tmpbuf);
2833 return has_dirty;
2834 }
2835
2836 static void vnc_refresh(DisplayChangeListener *dcl)
2837 {
2838 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2839 VncState *vs, *vn;
2840 int has_dirty, rects = 0;
2841
2842 if (QTAILQ_EMPTY(&vd->clients)) {
2843 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2844 return;
2845 }
2846
2847 graphic_hw_update(vd->dcl.con);
2848
2849 if (vnc_trylock_display(vd)) {
2850 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2851 return;
2852 }
2853
2854 has_dirty = vnc_refresh_server_surface(vd);
2855 vnc_unlock_display(vd);
2856
2857 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2858 rects += vnc_update_client(vs, has_dirty, false);
2859 /* vs might be free()ed here */
2860 }
2861
2862 if (has_dirty && rects) {
2863 vd->dcl.update_interval /= 2;
2864 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2865 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2866 }
2867 } else {
2868 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2869 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2870 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2871 }
2872 }
2873 }
2874
2875 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
2876 bool skipauth, bool websocket)
2877 {
2878 VncState *vs = g_new0(VncState, 1);
2879 bool first_client = QTAILQ_EMPTY(&vd->clients);
2880 int i;
2881
2882 vs->sioc = sioc;
2883 object_ref(OBJECT(vs->sioc));
2884 vs->ioc = QIO_CHANNEL(sioc);
2885 object_ref(OBJECT(vs->ioc));
2886 vs->vd = vd;
2887
2888 buffer_init(&vs->input, "vnc-input/%p", sioc);
2889 buffer_init(&vs->output, "vnc-output/%p", sioc);
2890 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
2891
2892 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
2893 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
2894 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
2895 #ifdef CONFIG_VNC_JPEG
2896 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
2897 #endif
2898 #ifdef CONFIG_VNC_PNG
2899 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
2900 #endif
2901 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
2902 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
2903 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
2904 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
2905
2906 if (skipauth) {
2907 vs->auth = VNC_AUTH_NONE;
2908 vs->subauth = VNC_AUTH_INVALID;
2909 } else {
2910 if (websocket) {
2911 vs->auth = vd->ws_auth;
2912 vs->subauth = VNC_AUTH_INVALID;
2913 } else {
2914 vs->auth = vd->auth;
2915 vs->subauth = vd->subauth;
2916 }
2917 }
2918 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
2919 sioc, websocket, vs->auth, vs->subauth);
2920
2921 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2922 for (i = 0; i < VNC_STAT_ROWS; ++i) {
2923 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
2924 }
2925
2926 VNC_DEBUG("New client on socket %p\n", vs->sioc);
2927 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2928 qio_channel_set_blocking(vs->ioc, false, NULL);
2929 if (websocket) {
2930 vs->websocket = 1;
2931 if (vd->tlscreds) {
2932 vs->ioc_tag = qio_channel_add_watch(
2933 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
2934 } else {
2935 vs->ioc_tag = qio_channel_add_watch(
2936 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
2937 }
2938 } else {
2939 vs->ioc_tag = qio_channel_add_watch(
2940 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
2941 }
2942
2943 vnc_client_cache_addr(vs);
2944 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
2945 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2946
2947 vs->last_x = -1;
2948 vs->last_y = -1;
2949
2950 vs->as.freq = 44100;
2951 vs->as.nchannels = 2;
2952 vs->as.fmt = AUD_FMT_S16;
2953 vs->as.endianness = 0;
2954
2955 qemu_mutex_init(&vs->output_mutex);
2956 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2957
2958 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
2959 if (first_client) {
2960 vnc_update_server_surface(vd);
2961 }
2962
2963 graphic_hw_update(vd->dcl.con);
2964
2965 if (!vs->websocket) {
2966 vnc_start_protocol(vs);
2967 }
2968
2969 if (vd->num_connecting > vd->connections_limit) {
2970 QTAILQ_FOREACH(vs, &vd->clients, next) {
2971 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
2972 vnc_disconnect_start(vs);
2973 return;
2974 }
2975 }
2976 }
2977 }
2978
2979 void vnc_start_protocol(VncState *vs)
2980 {
2981 vnc_write(vs, "RFB 003.008\n", 12);
2982 vnc_flush(vs);
2983 vnc_read_when(vs, protocol_version, 12);
2984
2985 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2986 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2987 }
2988
2989 static gboolean vnc_listen_io(QIOChannel *ioc,
2990 GIOCondition condition,
2991 void *opaque)
2992 {
2993 VncDisplay *vd = opaque;
2994 QIOChannelSocket *sioc = NULL;
2995 Error *err = NULL;
2996 bool isWebsock = false;
2997 size_t i;
2998
2999 for (i = 0; i < vd->nlwebsock; i++) {
3000 if (ioc == QIO_CHANNEL(vd->lwebsock[i])) {
3001 isWebsock = true;
3002 break;
3003 }
3004 }
3005
3006 sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc), &err);
3007 if (sioc != NULL) {
3008 qio_channel_set_name(QIO_CHANNEL(sioc),
3009 isWebsock ? "vnc-ws-server" : "vnc-server");
3010 qio_channel_set_delay(QIO_CHANNEL(sioc), false);
3011 vnc_connect(vd, sioc, false, isWebsock);
3012 object_unref(OBJECT(sioc));
3013 } else {
3014 /* client probably closed connection before we got there */
3015 error_free(err);
3016 }
3017
3018 return TRUE;
3019 }
3020
3021 static const DisplayChangeListenerOps dcl_ops = {
3022 .dpy_name = "vnc",
3023 .dpy_refresh = vnc_refresh,
3024 .dpy_gfx_update = vnc_dpy_update,
3025 .dpy_gfx_switch = vnc_dpy_switch,
3026 .dpy_gfx_check_format = qemu_pixman_check_format,
3027 .dpy_mouse_set = vnc_mouse_set,
3028 .dpy_cursor_define = vnc_dpy_cursor_define,
3029 };
3030
3031 void vnc_display_init(const char *id)
3032 {
3033 VncDisplay *vd;
3034
3035 if (vnc_display_find(id) != NULL) {
3036 return;
3037 }
3038 vd = g_malloc0(sizeof(*vd));
3039
3040 vd->id = strdup(id);
3041 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3042
3043 QTAILQ_INIT(&vd->clients);
3044 vd->expires = TIME_MAX;
3045
3046 if (keyboard_layout) {
3047 trace_vnc_key_map_init(keyboard_layout);
3048 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3049 } else {
3050 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3051 }
3052
3053 if (!vd->kbd_layout) {
3054 exit(1);
3055 }
3056
3057 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3058 vd->connections_limit = 32;
3059
3060 qemu_mutex_init(&vd->mutex);
3061 vnc_start_worker_thread();
3062
3063 vd->dcl.ops = &dcl_ops;
3064 register_displaychangelistener(&vd->dcl);
3065 }
3066
3067
3068 static void vnc_display_close(VncDisplay *vd)
3069 {
3070 size_t i;
3071 if (!vd) {
3072 return;
3073 }
3074 vd->is_unix = false;
3075 for (i = 0; i < vd->nlsock; i++) {
3076 if (vd->lsock_tag[i]) {
3077 g_source_remove(vd->lsock_tag[i]);
3078 }
3079 object_unref(OBJECT(vd->lsock[i]));
3080 }
3081 g_free(vd->lsock);
3082 g_free(vd->lsock_tag);
3083 vd->lsock = NULL;
3084 vd->lsock_tag = NULL;
3085 vd->nlsock = 0;
3086
3087 for (i = 0; i < vd->nlwebsock; i++) {
3088 if (vd->lwebsock_tag[i]) {
3089 g_source_remove(vd->lwebsock_tag[i]);
3090 }
3091 object_unref(OBJECT(vd->lwebsock[i]));
3092 }
3093 g_free(vd->lwebsock);
3094 g_free(vd->lwebsock_tag);
3095 vd->lwebsock = NULL;
3096 vd->lwebsock_tag = NULL;
3097 vd->nlwebsock = 0;
3098
3099 vd->auth = VNC_AUTH_INVALID;
3100 vd->subauth = VNC_AUTH_INVALID;
3101 if (vd->tlscreds) {
3102 object_unparent(OBJECT(vd->tlscreds));
3103 vd->tlscreds = NULL;
3104 }
3105 g_free(vd->tlsaclname);
3106 vd->tlsaclname = NULL;
3107 if (vd->lock_key_sync) {
3108 qemu_remove_led_event_handler(vd->led);
3109 vd->led = NULL;
3110 }
3111 }
3112
3113 int vnc_display_password(const char *id, const char *password)
3114 {
3115 VncDisplay *vd = vnc_display_find(id);
3116
3117 if (!vd) {
3118 return -EINVAL;
3119 }
3120 if (vd->auth == VNC_AUTH_NONE) {
3121 error_printf_unless_qmp("If you want use passwords please enable "
3122 "password auth using '-vnc ${dpy},password'.\n");
3123 return -EINVAL;
3124 }
3125
3126 g_free(vd->password);
3127 vd->password = g_strdup(password);
3128
3129 return 0;
3130 }
3131
3132 int vnc_display_pw_expire(const char *id, time_t expires)
3133 {
3134 VncDisplay *vd = vnc_display_find(id);
3135
3136 if (!vd) {
3137 return -EINVAL;
3138 }
3139
3140 vd->expires = expires;
3141 return 0;
3142 }
3143
3144 static void vnc_display_print_local_addr(VncDisplay *vd)
3145 {
3146 SocketAddress *addr;
3147 Error *err = NULL;
3148
3149 if (!vd->nlsock) {
3150 return;
3151 }
3152
3153 addr = qio_channel_socket_get_local_address(vd->lsock[0], &err);
3154 if (!addr) {
3155 return;
3156 }
3157
3158 if (addr->type != SOCKET_ADDRESS_KIND_INET) {
3159 qapi_free_SocketAddress(addr);
3160 return;
3161 }
3162 error_printf_unless_qmp("VNC server running on %s:%s\n",
3163 addr->u.inet.data->host,
3164 addr->u.inet.data->port);
3165 qapi_free_SocketAddress(addr);
3166 }
3167
3168 static QemuOptsList qemu_vnc_opts = {
3169 .name = "vnc",
3170 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3171 .implied_opt_name = "vnc",
3172 .desc = {
3173 {
3174 .name = "vnc",
3175 .type = QEMU_OPT_STRING,
3176 },{
3177 .name = "websocket",
3178 .type = QEMU_OPT_STRING,
3179 },{
3180 .name = "tls-creds",
3181 .type = QEMU_OPT_STRING,
3182 },{
3183 /* Deprecated in favour of tls-creds */
3184 .name = "x509",
3185 .type = QEMU_OPT_STRING,
3186 },{
3187 .name = "share",
3188 .type = QEMU_OPT_STRING,
3189 },{
3190 .name = "display",
3191 .type = QEMU_OPT_STRING,
3192 },{
3193 .name = "head",
3194 .type = QEMU_OPT_NUMBER,
3195 },{
3196 .name = "connections",
3197 .type = QEMU_OPT_NUMBER,
3198 },{
3199 .name = "to",
3200 .type = QEMU_OPT_NUMBER,
3201 },{
3202 .name = "ipv4",
3203 .type = QEMU_OPT_BOOL,
3204 },{
3205 .name = "ipv6",
3206 .type = QEMU_OPT_BOOL,
3207 },{
3208 .name = "password",
3209 .type = QEMU_OPT_BOOL,
3210 },{
3211 .name = "reverse",
3212 .type = QEMU_OPT_BOOL,
3213 },{
3214 .name = "lock-key-sync",
3215 .type = QEMU_OPT_BOOL,
3216 },{
3217 .name = "key-delay-ms",
3218 .type = QEMU_OPT_NUMBER,
3219 },{
3220 .name = "sasl",
3221 .type = QEMU_OPT_BOOL,
3222 },{
3223 /* Deprecated in favour of tls-creds */
3224 .name = "tls",
3225 .type = QEMU_OPT_BOOL,
3226 },{
3227 /* Deprecated in favour of tls-creds */
3228 .name = "x509verify",
3229 .type = QEMU_OPT_STRING,
3230 },{
3231 .name = "acl",
3232 .type = QEMU_OPT_BOOL,
3233 },{
3234 .name = "lossy",
3235 .type = QEMU_OPT_BOOL,
3236 },{
3237 .name = "non-adaptive",
3238 .type = QEMU_OPT_BOOL,
3239 },
3240 { /* end of list */ }
3241 },
3242 };
3243
3244
3245 static int
3246 vnc_display_setup_auth(int *auth,
3247 int *subauth,
3248 QCryptoTLSCreds *tlscreds,
3249 bool password,
3250 bool sasl,
3251 bool websocket,
3252 Error **errp)
3253 {
3254 /*
3255 * We have a choice of 3 authentication options
3256 *
3257 * 1. none
3258 * 2. vnc
3259 * 3. sasl
3260 *
3261 * The channel can be run in 2 modes
3262 *
3263 * 1. clear
3264 * 2. tls
3265 *
3266 * And TLS can use 2 types of credentials
3267 *
3268 * 1. anon
3269 * 2. x509
3270 *
3271 * We thus have 9 possible logical combinations
3272 *
3273 * 1. clear + none
3274 * 2. clear + vnc
3275 * 3. clear + sasl
3276 * 4. tls + anon + none
3277 * 5. tls + anon + vnc
3278 * 6. tls + anon + sasl
3279 * 7. tls + x509 + none
3280 * 8. tls + x509 + vnc
3281 * 9. tls + x509 + sasl
3282 *
3283 * These need to be mapped into the VNC auth schemes
3284 * in an appropriate manner. In regular VNC, all the
3285 * TLS options get mapped into VNC_AUTH_VENCRYPT
3286 * sub-auth types.
3287 *
3288 * In websockets, the https:// protocol already provides
3289 * TLS support, so there is no need to make use of the
3290 * VeNCrypt extension. Furthermore, websockets browser
3291 * clients could not use VeNCrypt even if they wanted to,
3292 * as they cannot control when the TLS handshake takes
3293 * place. Thus there is no option but to rely on https://,
3294 * meaning combinations 4->6 and 7->9 will be mapped to
3295 * VNC auth schemes in the same way as combos 1->3.
3296 *
3297 * Regardless of fact that we have a different mapping to
3298 * VNC auth mechs for plain VNC vs websockets VNC, the end
3299 * result has the same security characteristics.
3300 */
3301 if (websocket || !tlscreds) {
3302 if (password) {
3303 VNC_DEBUG("Initializing VNC server with password auth\n");
3304 *auth = VNC_AUTH_VNC;
3305 } else if (sasl) {
3306 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3307 *auth = VNC_AUTH_SASL;
3308 } else {
3309 VNC_DEBUG("Initializing VNC server with no auth\n");
3310 *auth = VNC_AUTH_NONE;
3311 }
3312 *subauth = VNC_AUTH_INVALID;
3313 } else {
3314 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3315 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3316 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3317 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3318
3319 if (!is_x509 && !is_anon) {
3320 error_setg(errp,
3321 "Unsupported TLS cred type %s",
3322 object_get_typename(OBJECT(tlscreds)));
3323 return -1;
3324 }
3325 *auth = VNC_AUTH_VENCRYPT;
3326 if (password) {
3327 if (is_x509) {
3328 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3329 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3330 } else {
3331 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3332 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3333 }
3334
3335 } else if (sasl) {
3336 if (is_x509) {
3337 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3338 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3339 } else {
3340 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3341 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3342 }
3343 } else {
3344 if (is_x509) {
3345 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3346 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3347 } else {
3348 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3349 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3350 }
3351 }
3352 }
3353 return 0;
3354 }
3355
3356
3357 /*
3358 * Handle back compat with old CLI syntax by creating some
3359 * suitable QCryptoTLSCreds objects
3360 */
3361 static QCryptoTLSCreds *
3362 vnc_display_create_creds(bool x509,
3363 bool x509verify,
3364 const char *dir,
3365 const char *id,
3366 Error **errp)
3367 {
3368 gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3369 Object *parent = object_get_objects_root();
3370 Object *creds;
3371 Error *err = NULL;
3372
3373 if (x509) {
3374 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3375 parent,
3376 credsid,
3377 &err,
3378 "endpoint", "server",
3379 "dir", dir,
3380 "verify-peer", x509verify ? "yes" : "no",
3381 NULL);
3382 } else {
3383 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3384 parent,
3385 credsid,
3386 &err,
3387 "endpoint", "server",
3388 NULL);
3389 }
3390
3391 g_free(credsid);
3392
3393 if (err) {
3394 error_propagate(errp, err);
3395 return NULL;
3396 }
3397
3398 return QCRYPTO_TLS_CREDS(creds);
3399 }
3400
3401
3402 static int vnc_display_get_address(const char *addrstr,
3403 bool websocket,
3404 int displaynum,
3405 int to,
3406 bool has_ipv4,
3407 bool has_ipv6,
3408 bool ipv4,
3409 bool ipv6,
3410 SocketAddress **retaddr,
3411 Error **errp)
3412 {
3413 int ret = -1;
3414 SocketAddress *addr = NULL;
3415
3416 addr = g_new0(SocketAddress, 1);
3417
3418 if (strncmp(addrstr, "unix:", 5) == 0) {
3419 addr->type = SOCKET_ADDRESS_KIND_UNIX;
3420 addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
3421 addr->u.q_unix.data->path = g_strdup(addrstr + 5);
3422
3423 if (websocket) {
3424 error_setg(errp, "UNIX sockets not supported with websock");
3425 goto cleanup;
3426 }
3427
3428 if (to) {
3429 error_setg(errp, "Port range not support with UNIX socket");
3430 goto cleanup;
3431 }
3432 ret = 0;
3433 } else {
3434 const char *port;
3435 size_t hostlen;
3436 unsigned long long baseport = 0;
3437 InetSocketAddress *inet;
3438
3439 port = strrchr(addrstr, ':');
3440 if (!port) {
3441 if (websocket) {
3442 hostlen = 0;
3443 port = addrstr;
3444 } else {
3445 error_setg(errp, "no vnc port specified");
3446 goto cleanup;
3447 }
3448 } else {
3449 hostlen = port - addrstr;
3450 port++;
3451 if (*port == '\0') {
3452 error_setg(errp, "vnc port cannot be empty");
3453 goto cleanup;
3454 }
3455 }
3456
3457 addr->type = SOCKET_ADDRESS_KIND_INET;
3458 inet = addr->u.inet.data = g_new0(InetSocketAddress, 1);
3459 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3460 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3461 } else {
3462 inet->host = g_strndup(addrstr, hostlen);
3463 }
3464 /* plain VNC port is just an offset, for websocket
3465 * port is absolute */
3466 if (websocket) {
3467 if (g_str_equal(addrstr, "") ||
3468 g_str_equal(addrstr, "on")) {
3469 if (displaynum == -1) {
3470 error_setg(errp, "explicit websocket port is required");
3471 goto cleanup;
3472 }
3473 inet->port = g_strdup_printf(
3474 "%d", displaynum + 5700);
3475 if (to) {
3476 inet->has_to = true;
3477 inet->to = to + 5700;
3478 }
3479 } else {
3480 inet->port = g_strdup(port);
3481 }
3482 } else {
3483 if (parse_uint_full(port, &baseport, 10) < 0) {
3484 error_setg(errp, "can't convert to a number: %s", port);
3485 goto cleanup;
3486 }
3487 if (baseport > 65535 ||
3488 baseport + 5900 > 65535) {
3489 error_setg(errp, "port %s out of range", port);
3490 goto cleanup;
3491 }
3492 inet->port = g_strdup_printf(
3493 "%d", (int)baseport + 5900);
3494
3495 if (to) {
3496 inet->has_to = true;
3497 inet->to = to + 5900;
3498 }
3499 }
3500
3501 inet->ipv4 = ipv4;
3502 inet->has_ipv4 = has_ipv4;
3503 inet->ipv6 = ipv6;
3504 inet->has_ipv6 = has_ipv6;
3505
3506 ret = baseport;
3507 }
3508
3509 *retaddr = addr;
3510
3511 cleanup:
3512 if (ret < 0) {
3513 qapi_free_SocketAddress(addr);
3514 }
3515 return ret;
3516 }
3517
3518 static int vnc_display_get_addresses(QemuOpts *opts,
3519 SocketAddress ***retsaddr,
3520 size_t *retnsaddr,
3521 SocketAddress ***retwsaddr,
3522 size_t *retnwsaddr,
3523 Error **errp)
3524 {
3525 SocketAddress *saddr = NULL;
3526 SocketAddress *wsaddr = NULL;
3527 QemuOptsIter addriter;
3528 const char *addr;
3529 int to = qemu_opt_get_number(opts, "to", 0);
3530 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3531 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3532 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3533 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3534 size_t i;
3535 int displaynum = -1;
3536 int ret = -1;
3537
3538 *retsaddr = NULL;
3539 *retnsaddr = 0;
3540 *retwsaddr = NULL;
3541 *retnwsaddr = 0;
3542
3543 addr = qemu_opt_get(opts, "vnc");
3544 if (addr == NULL || g_str_equal(addr, "none")) {
3545 ret = 0;
3546 goto cleanup;
3547 }
3548 if (qemu_opt_get(opts, "websocket") &&
3549 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3550 error_setg(errp,
3551 "SHA1 hash support is required for websockets");
3552 goto cleanup;
3553 }
3554
3555 qemu_opt_iter_init(&addriter, opts, "vnc");
3556 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3557 int rv;
3558 rv = vnc_display_get_address(addr, false, 0, to,
3559 has_ipv4, has_ipv6,
3560 ipv4, ipv6,
3561 &saddr, errp);
3562 if (rv < 0) {
3563 goto cleanup;
3564 }
3565 /* Historical compat - first listen address can be used
3566 * to set the default websocket port
3567 */
3568 if (displaynum == -1) {
3569 displaynum = rv;
3570 }
3571 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3572 (*retsaddr)[(*retnsaddr)++] = saddr;
3573 }
3574
3575 /* If we had multiple primary displays, we don't do defaults
3576 * for websocket, and require explicit config instead. */
3577 if (*retnsaddr > 1) {
3578 displaynum = -1;
3579 }
3580
3581 qemu_opt_iter_init(&addriter, opts, "websocket");
3582 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3583 if (vnc_display_get_address(addr, true, displaynum, to,
3584 has_ipv4, has_ipv6,
3585 ipv4, ipv6,
3586 &wsaddr, errp) < 0) {
3587 goto cleanup;
3588 }
3589
3590 /* Historical compat - if only a single listen address was
3591 * provided, then this is used to set the default listen
3592 * address for websocket too
3593 */
3594 if (*retnsaddr == 1 &&
3595 (*retsaddr)[0]->type == SOCKET_ADDRESS_KIND_INET &&
3596 wsaddr->type == SOCKET_ADDRESS_KIND_INET &&
3597 g_str_equal(wsaddr->u.inet.data->host, "") &&
3598 !g_str_equal((*retsaddr)[0]->u.inet.data->host, "")) {
3599 g_free(wsaddr->u.inet.data->host);
3600 wsaddr->u.inet.data->host =
3601 g_strdup((*retsaddr)[0]->u.inet.data->host);
3602 }
3603
3604 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3605 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3606 }
3607
3608 ret = 0;
3609 cleanup:
3610 if (ret < 0) {
3611 for (i = 0; i < *retnsaddr; i++) {
3612 qapi_free_SocketAddress((*retsaddr)[i]);
3613 }
3614 g_free(*retsaddr);
3615 for (i = 0; i < *retnwsaddr; i++) {
3616 qapi_free_SocketAddress((*retwsaddr)[i]);
3617 }
3618 g_free(*retwsaddr);
3619 *retsaddr = *retwsaddr = NULL;
3620 *retnsaddr = *retnwsaddr = 0;
3621 }
3622 return ret;
3623 }
3624
3625 static int vnc_display_connect(VncDisplay *vd,
3626 SocketAddress **saddr,
3627 size_t nsaddr,
3628 SocketAddress **wsaddr,
3629 size_t nwsaddr,
3630 Error **errp)
3631 {
3632 /* connect to viewer */
3633 QIOChannelSocket *sioc = NULL;
3634 if (nwsaddr != 0) {
3635 error_setg(errp, "Cannot use websockets in reverse mode");
3636 return -1;
3637 }
3638 if (nsaddr != 1) {
3639 error_setg(errp, "Expected a single address in reverse mode");
3640 return -1;
3641 }
3642 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_KIND_UNIX;
3643 sioc = qio_channel_socket_new();
3644 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3645 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3646 return -1;
3647 }
3648 vnc_connect(vd, sioc, false, false);
3649 object_unref(OBJECT(sioc));
3650 return 0;
3651 }
3652
3653
3654 static int vnc_display_listen_addr(VncDisplay *vd,
3655 SocketAddress *addr,
3656 const char *name,
3657 QIOChannelSocket ***lsock,
3658 guint **lsock_tag,
3659 size_t *nlsock,
3660 Error **errp)
3661 {
3662 QIODNSResolver *resolver = qio_dns_resolver_get_instance();
3663 SocketAddress **rawaddrs = NULL;
3664 size_t nrawaddrs = 0;
3665 Error *listenerr = NULL;
3666 bool listening = false;
3667 size_t i;
3668
3669 if (qio_dns_resolver_lookup_sync(resolver, addr, &nrawaddrs,
3670 &rawaddrs, errp) < 0) {
3671 return -1;
3672 }
3673
3674 for (i = 0; i < nrawaddrs; i++) {
3675 QIOChannelSocket *sioc = qio_channel_socket_new();
3676
3677 qio_channel_set_name(QIO_CHANNEL(sioc), name);
3678 if (qio_channel_socket_listen_sync(
3679 sioc, rawaddrs[i], listenerr == NULL ? &listenerr : NULL) < 0) {
3680 object_unref(OBJECT(sioc));
3681 continue;
3682 }
3683 listening = true;
3684 (*nlsock)++;
3685 *lsock = g_renew(QIOChannelSocket *, *lsock, *nlsock);
3686 *lsock_tag = g_renew(guint, *lsock_tag, *nlsock);
3687
3688 (*lsock)[*nlsock - 1] = sioc;
3689 (*lsock_tag)[*nlsock - 1] = 0;
3690 }
3691
3692 for (i = 0; i < nrawaddrs; i++) {
3693 qapi_free_SocketAddress(rawaddrs[i]);
3694 }
3695 g_free(rawaddrs);
3696
3697 if (listenerr) {
3698 if (!listening) {
3699 error_propagate(errp, listenerr);
3700 return -1;
3701 } else {
3702 error_free(listenerr);
3703 }
3704 }
3705
3706 for (i = 0; i < *nlsock; i++) {
3707 (*lsock_tag)[i] = qio_channel_add_watch(
3708 QIO_CHANNEL((*lsock)[i]),
3709 G_IO_IN, vnc_listen_io, vd, NULL);
3710 }
3711
3712 return 0;
3713 }
3714
3715
3716 static int vnc_display_listen(VncDisplay *vd,
3717 SocketAddress **saddr,
3718 size_t nsaddr,
3719 SocketAddress **wsaddr,
3720 size_t nwsaddr,
3721 Error **errp)
3722 {
3723 size_t i;
3724
3725 for (i = 0; i < nsaddr; i++) {
3726 if (vnc_display_listen_addr(vd, saddr[i],
3727 "vnc-listen",
3728 &vd->lsock,
3729 &vd->lsock_tag,
3730 &vd->nlsock,
3731 errp) < 0) {
3732 return -1;
3733 }
3734 }
3735 for (i = 0; i < nwsaddr; i++) {
3736 if (vnc_display_listen_addr(vd, wsaddr[i],
3737 "vnc-ws-listen",
3738 &vd->lwebsock,
3739 &vd->lwebsock_tag,
3740 &vd->nlwebsock,
3741 errp) < 0) {
3742 return -1;
3743 }
3744 }
3745
3746 return 0;
3747 }
3748
3749
3750 void vnc_display_open(const char *id, Error **errp)
3751 {
3752 VncDisplay *vd = vnc_display_find(id);
3753 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3754 SocketAddress **saddr = NULL, **wsaddr = NULL;
3755 size_t nsaddr, nwsaddr;
3756 const char *share, *device_id;
3757 QemuConsole *con;
3758 bool password = false;
3759 bool reverse = false;
3760 const char *credid;
3761 bool sasl = false;
3762 #ifdef CONFIG_VNC_SASL
3763 int saslErr;
3764 #endif
3765 int acl = 0;
3766 int lock_key_sync = 1;
3767 int key_delay_ms;
3768 size_t i;
3769
3770 if (!vd) {
3771 error_setg(errp, "VNC display not active");
3772 return;
3773 }
3774 vnc_display_close(vd);
3775
3776 if (!opts) {
3777 return;
3778 }
3779
3780 if (vnc_display_get_addresses(opts, &saddr, &nsaddr,
3781 &wsaddr, &nwsaddr, errp) < 0) {
3782 goto fail;
3783 }
3784
3785 if (saddr == NULL) {
3786 return;
3787 }
3788
3789 password = qemu_opt_get_bool(opts, "password", false);
3790 if (password) {
3791 if (fips_get_state()) {
3792 error_setg(errp,
3793 "VNC password auth disabled due to FIPS mode, "
3794 "consider using the VeNCrypt or SASL authentication "
3795 "methods as an alternative");
3796 goto fail;
3797 }
3798 if (!qcrypto_cipher_supports(
3799 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3800 error_setg(errp,
3801 "Cipher backend does not support DES RFB algorithm");
3802 goto fail;
3803 }
3804 }
3805
3806 reverse = qemu_opt_get_bool(opts, "reverse", false);
3807 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3808 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 1);
3809 sasl = qemu_opt_get_bool(opts, "sasl", false);
3810 #ifndef CONFIG_VNC_SASL
3811 if (sasl) {
3812 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3813 goto fail;
3814 }
3815 #endif /* CONFIG_VNC_SASL */
3816 credid = qemu_opt_get(opts, "tls-creds");
3817 if (credid) {
3818 Object *creds;
3819 if (qemu_opt_get(opts, "tls") ||
3820 qemu_opt_get(opts, "x509") ||
3821 qemu_opt_get(opts, "x509verify")) {
3822 error_setg(errp,
3823 "'tls-creds' parameter is mutually exclusive with "
3824 "'tls', 'x509' and 'x509verify' parameters");
3825 goto fail;
3826 }
3827
3828 creds = object_resolve_path_component(
3829 object_get_objects_root(), credid);
3830 if (!creds) {
3831 error_setg(errp, "No TLS credentials with id '%s'",
3832 credid);
3833 goto fail;
3834 }
3835 vd->tlscreds = (QCryptoTLSCreds *)
3836 object_dynamic_cast(creds,
3837 TYPE_QCRYPTO_TLS_CREDS);
3838 if (!vd->tlscreds) {
3839 error_setg(errp, "Object with id '%s' is not TLS credentials",
3840 credid);
3841 goto fail;
3842 }
3843 object_ref(OBJECT(vd->tlscreds));
3844
3845 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3846 error_setg(errp,
3847 "Expecting TLS credentials with a server endpoint");
3848 goto fail;
3849 }
3850 } else {
3851 const char *path;
3852 bool tls = false, x509 = false, x509verify = false;
3853 tls = qemu_opt_get_bool(opts, "tls", false);
3854 if (tls) {
3855 path = qemu_opt_get(opts, "x509");
3856
3857 if (path) {
3858 x509 = true;
3859 } else {
3860 path = qemu_opt_get(opts, "x509verify");
3861 if (path) {
3862 x509 = true;
3863 x509verify = true;
3864 }
3865 }
3866 vd->tlscreds = vnc_display_create_creds(x509,
3867 x509verify,
3868 path,
3869 vd->id,
3870 errp);
3871 if (!vd->tlscreds) {
3872 goto fail;
3873 }
3874 }
3875 }
3876 acl = qemu_opt_get_bool(opts, "acl", false);
3877
3878 share = qemu_opt_get(opts, "share");
3879 if (share) {
3880 if (strcmp(share, "ignore") == 0) {
3881 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3882 } else if (strcmp(share, "allow-exclusive") == 0) {
3883 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3884 } else if (strcmp(share, "force-shared") == 0) {
3885 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3886 } else {
3887 error_setg(errp, "unknown vnc share= option");
3888 goto fail;
3889 }
3890 } else {
3891 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3892 }
3893 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3894
3895 #ifdef CONFIG_VNC_JPEG
3896 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3897 #endif
3898 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3899 /* adaptive updates are only used with tight encoding and
3900 * if lossy updates are enabled so we can disable all the
3901 * calculations otherwise */
3902 if (!vd->lossy) {
3903 vd->non_adaptive = true;
3904 }
3905
3906 if (acl) {
3907 if (strcmp(vd->id, "default") == 0) {
3908 vd->tlsaclname = g_strdup("vnc.x509dname");
3909 } else {
3910 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3911 }
3912 qemu_acl_init(vd->tlsaclname);
3913 }
3914 #ifdef CONFIG_VNC_SASL
3915 if (acl && sasl) {
3916 char *aclname;
3917
3918 if (strcmp(vd->id, "default") == 0) {
3919 aclname = g_strdup("vnc.username");
3920 } else {
3921 aclname = g_strdup_printf("vnc.%s.username", vd->id);
3922 }
3923 vd->sasl.acl = qemu_acl_init(aclname);
3924 g_free(aclname);
3925 }
3926 #endif
3927
3928 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3929 vd->tlscreds, password,
3930 sasl, false, errp) < 0) {
3931 goto fail;
3932 }
3933
3934 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3935 vd->tlscreds, password,
3936 sasl, true, errp) < 0) {
3937 goto fail;
3938 }
3939
3940 #ifdef CONFIG_VNC_SASL
3941 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3942 error_setg(errp, "Failed to initialize SASL auth: %s",
3943 sasl_errstring(saslErr, NULL, NULL));
3944 goto fail;
3945 }
3946 #endif
3947 vd->lock_key_sync = lock_key_sync;
3948 if (lock_key_sync) {
3949 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3950 }
3951 vd->ledstate = 0;
3952 vd->key_delay_ms = key_delay_ms;
3953
3954 device_id = qemu_opt_get(opts, "display");
3955 if (device_id) {
3956 int head = qemu_opt_get_number(opts, "head", 0);
3957 Error *err = NULL;
3958
3959 con = qemu_console_lookup_by_device_name(device_id, head, &err);
3960 if (err) {
3961 error_propagate(errp, err);
3962 goto fail;
3963 }
3964 } else {
3965 con = NULL;
3966 }
3967
3968 if (con != vd->dcl.con) {
3969 unregister_displaychangelistener(&vd->dcl);
3970 vd->dcl.con = con;
3971 register_displaychangelistener(&vd->dcl);
3972 }
3973
3974 if (reverse) {
3975 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
3976 goto fail;
3977 }
3978 } else {
3979 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
3980 goto fail;
3981 }
3982 }
3983
3984 if (qemu_opt_get(opts, "to")) {
3985 vnc_display_print_local_addr(vd);
3986 }
3987
3988 cleanup:
3989 for (i = 0; i < nsaddr; i++) {
3990 qapi_free_SocketAddress(saddr[i]);
3991 }
3992 for (i = 0; i < nwsaddr; i++) {
3993 qapi_free_SocketAddress(wsaddr[i]);
3994 }
3995 return;
3996
3997 fail:
3998 vnc_display_close(vd);
3999 goto cleanup;
4000 }
4001
4002 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4003 {
4004 VncDisplay *vd = vnc_display_find(id);
4005 QIOChannelSocket *sioc;
4006
4007 if (!vd) {
4008 return;
4009 }
4010
4011 sioc = qio_channel_socket_new_fd(csock, NULL);
4012 if (sioc) {
4013 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4014 vnc_connect(vd, sioc, skipauth, false);
4015 object_unref(OBJECT(sioc));
4016 }
4017 }
4018
4019 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4020 {
4021 int i = 2;
4022 char *id;
4023
4024 id = g_strdup("default");
4025 while (qemu_opts_find(olist, id)) {
4026 g_free(id);
4027 id = g_strdup_printf("vnc%d", i++);
4028 }
4029 qemu_opts_set_id(opts, id);
4030 }
4031
4032 QemuOpts *vnc_parse(const char *str, Error **errp)
4033 {
4034 QemuOptsList *olist = qemu_find_opts("vnc");
4035 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4036 const char *id;
4037
4038 if (!opts) {
4039 return NULL;
4040 }
4041
4042 id = qemu_opts_id(opts);
4043 if (!id) {
4044 /* auto-assign id if not present */
4045 vnc_auto_assign_id(olist, opts);
4046 }
4047 return opts;
4048 }
4049
4050 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4051 {
4052 Error *local_err = NULL;
4053 char *id = (char *)qemu_opts_id(opts);
4054
4055 assert(id);
4056 vnc_display_init(id);
4057 vnc_display_open(id, &local_err);
4058 if (local_err != NULL) {
4059 error_reportf_err(local_err, "Failed to start VNC server: ");
4060 exit(1);
4061 }
4062 return 0;
4063 }
4064
4065 static void vnc_register_config(void)
4066 {
4067 qemu_add_opts(&qemu_vnc_opts);
4068 }
4069 opts_init(vnc_register_config);
AR7 emulation for QEMU