2 * QEMU VNC display driver
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
32 #include "qemu-objects.h"
34 #define VNC_REFRESH_INTERVAL_BASE 30
35 #define VNC_REFRESH_INTERVAL_INC 50
36 #define VNC_REFRESH_INTERVAL_MAX 2000
38 #include "vnc_keysym.h"
41 #define count_bits(c, v) { \
42 for (c = 0; v; v >>= 1) \
49 static VncDisplay
*vnc_display
; /* needed for info vnc */
50 static DisplayChangeListener
*dcl
;
52 static int vnc_cursor_define(VncState
*vs
);
54 static char *addr_to_string(const char *format
,
55 struct sockaddr_storage
*sa
,
58 char host
[NI_MAXHOST
];
59 char serv
[NI_MAXSERV
];
63 if ((err
= getnameinfo((struct sockaddr
*)sa
, salen
,
66 NI_NUMERICHOST
| NI_NUMERICSERV
)) != 0) {
67 VNC_DEBUG("Cannot resolve address %d: %s\n",
68 err
, gai_strerror(err
));
72 /* Enough for the existing format + the 2 vars we're
74 addrlen
= strlen(format
) + strlen(host
) + strlen(serv
);
75 addr
= qemu_malloc(addrlen
+ 1);
76 snprintf(addr
, addrlen
, format
, host
, serv
);
83 char *vnc_socket_local_addr(const char *format
, int fd
) {
84 struct sockaddr_storage sa
;
88 if (getsockname(fd
, (struct sockaddr
*)&sa
, &salen
) < 0)
91 return addr_to_string(format
, &sa
, salen
);
94 char *vnc_socket_remote_addr(const char *format
, int fd
) {
95 struct sockaddr_storage sa
;
99 if (getpeername(fd
, (struct sockaddr
*)&sa
, &salen
) < 0)
102 return addr_to_string(format
, &sa
, salen
);
105 static int put_addr_qdict(QDict
*qdict
, struct sockaddr_storage
*sa
,
108 char host
[NI_MAXHOST
];
109 char serv
[NI_MAXSERV
];
112 if ((err
= getnameinfo((struct sockaddr
*)sa
, salen
,
115 NI_NUMERICHOST
| NI_NUMERICSERV
)) != 0) {
116 VNC_DEBUG("Cannot resolve address %d: %s\n",
117 err
, gai_strerror(err
));
121 qdict_put(qdict
, "host", qstring_from_str(host
));
122 qdict_put(qdict
, "service", qstring_from_str(serv
));
123 qdict_put(qdict
, "family",qstring_from_str(inet_strfamily(sa
->ss_family
)));
128 static int vnc_server_addr_put(QDict
*qdict
, int fd
)
130 struct sockaddr_storage sa
;
134 if (getsockname(fd
, (struct sockaddr
*)&sa
, &salen
) < 0) {
138 return put_addr_qdict(qdict
, &sa
, salen
);
141 static int vnc_qdict_remote_addr(QDict
*qdict
, int fd
)
143 struct sockaddr_storage sa
;
147 if (getpeername(fd
, (struct sockaddr
*)&sa
, &salen
) < 0) {
151 return put_addr_qdict(qdict
, &sa
, salen
);
154 static const char *vnc_auth_name(VncDisplay
*vd
) {
156 case VNC_AUTH_INVALID
:
172 case VNC_AUTH_VENCRYPT
:
173 #ifdef CONFIG_VNC_TLS
174 switch (vd
->subauth
) {
175 case VNC_AUTH_VENCRYPT_PLAIN
:
176 return "vencrypt+plain";
177 case VNC_AUTH_VENCRYPT_TLSNONE
:
178 return "vencrypt+tls+none";
179 case VNC_AUTH_VENCRYPT_TLSVNC
:
180 return "vencrypt+tls+vnc";
181 case VNC_AUTH_VENCRYPT_TLSPLAIN
:
182 return "vencrypt+tls+plain";
183 case VNC_AUTH_VENCRYPT_X509NONE
:
184 return "vencrypt+x509+none";
185 case VNC_AUTH_VENCRYPT_X509VNC
:
186 return "vencrypt+x509+vnc";
187 case VNC_AUTH_VENCRYPT_X509PLAIN
:
188 return "vencrypt+x509+plain";
189 case VNC_AUTH_VENCRYPT_TLSSASL
:
190 return "vencrypt+tls+sasl";
191 case VNC_AUTH_VENCRYPT_X509SASL
:
192 return "vencrypt+x509+sasl";
205 static int vnc_server_info_put(QDict
*qdict
)
207 if (vnc_server_addr_put(qdict
, vnc_display
->lsock
) < 0) {
211 qdict_put(qdict
, "auth", qstring_from_str(vnc_auth_name(vnc_display
)));
215 static void vnc_client_cache_auth(VncState
*client
)
223 qdict
= qobject_to_qdict(client
->info
);
225 #ifdef CONFIG_VNC_TLS
226 if (client
->tls
.session
&&
228 qdict_put(qdict
, "x509_dname", qstring_from_str(client
->tls
.dname
));
231 #ifdef CONFIG_VNC_SASL
232 if (client
->sasl
.conn
&&
233 client
->sasl
.username
) {
234 qdict_put(qdict
, "sasl_username",
235 qstring_from_str(client
->sasl
.username
));
240 static void vnc_client_cache_addr(VncState
*client
)
245 if (vnc_qdict_remote_addr(qdict
, client
->csock
) < 0) {
247 /* XXX: how to report the error? */
251 client
->info
= QOBJECT(qdict
);
254 static void vnc_qmp_event(VncState
*vs
, MonitorEvent event
)
263 server
= qdict_new();
264 if (vnc_server_info_put(server
) < 0) {
269 data
= qobject_from_jsonf("{ 'client': %p, 'server': %p }",
270 vs
->info
, QOBJECT(server
));
272 monitor_protocol_event(event
, data
);
274 qobject_incref(vs
->info
);
275 qobject_decref(data
);
278 static void info_vnc_iter(QObject
*obj
, void *opaque
)
281 Monitor
*mon
= opaque
;
283 client
= qobject_to_qdict(obj
);
284 monitor_printf(mon
, "Client:\n");
285 monitor_printf(mon
, " address: %s:%s\n",
286 qdict_get_str(client
, "host"),
287 qdict_get_str(client
, "service"));
289 #ifdef CONFIG_VNC_TLS
290 monitor_printf(mon
, " x509_dname: %s\n",
291 qdict_haskey(client
, "x509_dname") ?
292 qdict_get_str(client
, "x509_dname") : "none");
294 #ifdef CONFIG_VNC_SASL
295 monitor_printf(mon
, " username: %s\n",
296 qdict_haskey(client
, "sasl_username") ?
297 qdict_get_str(client
, "sasl_username") : "none");
301 void do_info_vnc_print(Monitor
*mon
, const QObject
*data
)
306 server
= qobject_to_qdict(data
);
307 if (qdict_get_bool(server
, "enabled") == 0) {
308 monitor_printf(mon
, "Server: disabled\n");
312 monitor_printf(mon
, "Server:\n");
313 monitor_printf(mon
, " address: %s:%s\n",
314 qdict_get_str(server
, "host"),
315 qdict_get_str(server
, "service"));
316 monitor_printf(mon
, " auth: %s\n", qdict_get_str(server
, "auth"));
318 clients
= qdict_get_qlist(server
, "clients");
319 if (qlist_empty(clients
)) {
320 monitor_printf(mon
, "Client: none\n");
322 qlist_iter(clients
, info_vnc_iter
, mon
);
326 void do_info_vnc(Monitor
*mon
, QObject
**ret_data
)
328 if (vnc_display
== NULL
|| vnc_display
->display
== NULL
) {
329 *ret_data
= qobject_from_jsonf("{ 'enabled': false }");
335 QTAILQ_FOREACH(client
, &vnc_display
->clients
, next
) {
337 /* incref so that it's not freed by upper layers */
338 qobject_incref(client
->info
);
339 qlist_append_obj(clist
, client
->info
);
343 *ret_data
= qobject_from_jsonf("{ 'enabled': true, 'clients': %p }",
345 assert(*ret_data
!= NULL
);
347 if (vnc_server_info_put(qobject_to_qdict(*ret_data
)) < 0) {
348 qobject_decref(*ret_data
);
354 static inline uint32_t vnc_has_feature(VncState
*vs
, int feature
) {
355 return (vs
->features
& (1 << feature
));
359 1) Get the queue working for IO.
360 2) there is some weirdness when using the -S option (the screen is grey
361 and not totally invalidated
362 3) resolutions > 1024
365 static int vnc_update_client(VncState
*vs
, int has_dirty
);
366 static void vnc_disconnect_start(VncState
*vs
);
367 static void vnc_disconnect_finish(VncState
*vs
);
368 static void vnc_init_timer(VncDisplay
*vd
);
369 static void vnc_remove_timer(VncDisplay
*vd
);
371 static void vnc_colordepth(VncState
*vs
);
372 static void framebuffer_update_request(VncState
*vs
, int incremental
,
373 int x_position
, int y_position
,
375 static void vnc_refresh(void *opaque
);
376 static int vnc_refresh_server_surface(VncDisplay
*vd
);
378 static inline void vnc_set_bit(uint32_t *d
, int k
)
380 d
[k
>> 5] |= 1 << (k
& 0x1f);
383 static inline void vnc_clear_bit(uint32_t *d
, int k
)
385 d
[k
>> 5] &= ~(1 << (k
& 0x1f));
388 static inline void vnc_set_bits(uint32_t *d
, int n
, int nb_words
)
398 d
[j
++] = (1 << n
) - 1;
403 static inline int vnc_get_bit(const uint32_t *d
, int k
)
405 return (d
[k
>> 5] >> (k
& 0x1f)) & 1;
408 static inline int vnc_and_bits(const uint32_t *d1
, const uint32_t *d2
,
412 for(i
= 0; i
< nb_words
; i
++) {
413 if ((d1
[i
] & d2
[i
]) != 0)
419 static void vnc_dpy_update(DisplayState
*ds
, int x
, int y
, int w
, int h
)
422 VncDisplay
*vd
= ds
->opaque
;
423 struct VncSurface
*s
= &vd
->guest
;
427 /* round x down to ensure the loop only spans one 16-pixel block per,
428 iteration. otherwise, if (x % 16) != 0, the last iteration may span
429 two 16-pixel blocks but we only mark the first as dirty
434 x
= MIN(x
, s
->ds
->width
);
435 y
= MIN(y
, s
->ds
->height
);
436 w
= MIN(x
+ w
, s
->ds
->width
) - x
;
437 h
= MIN(h
, s
->ds
->height
);
440 for (i
= 0; i
< w
; i
+= 16)
441 vnc_set_bit(s
->dirty
[y
], (x
+ i
) / 16);
444 void vnc_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
,
447 vnc_write_u16(vs
, x
);
448 vnc_write_u16(vs
, y
);
449 vnc_write_u16(vs
, w
);
450 vnc_write_u16(vs
, h
);
452 vnc_write_s32(vs
, encoding
);
455 void buffer_reserve(Buffer
*buffer
, size_t len
)
457 if ((buffer
->capacity
- buffer
->offset
) < len
) {
458 buffer
->capacity
+= (len
+ 1024);
459 buffer
->buffer
= qemu_realloc(buffer
->buffer
, buffer
->capacity
);
460 if (buffer
->buffer
== NULL
) {
461 fprintf(stderr
, "vnc: out of memory\n");
467 int buffer_empty(Buffer
*buffer
)
469 return buffer
->offset
== 0;
472 uint8_t *buffer_end(Buffer
*buffer
)
474 return buffer
->buffer
+ buffer
->offset
;
477 void buffer_reset(Buffer
*buffer
)
482 void buffer_free(Buffer
*buffer
)
484 qemu_free(buffer
->buffer
);
486 buffer
->capacity
= 0;
487 buffer
->buffer
= NULL
;
490 void buffer_append(Buffer
*buffer
, const void *data
, size_t len
)
492 memcpy(buffer
->buffer
+ buffer
->offset
, data
, len
);
493 buffer
->offset
+= len
;
496 static void vnc_desktop_resize(VncState
*vs
)
498 DisplayState
*ds
= vs
->ds
;
500 if (vs
->csock
== -1 || !vnc_has_feature(vs
, VNC_FEATURE_RESIZE
)) {
503 if (vs
->client_width
== ds_get_width(ds
) &&
504 vs
->client_height
== ds_get_height(ds
)) {
507 vs
->client_width
= ds_get_width(ds
);
508 vs
->client_height
= ds_get_height(ds
);
509 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
511 vnc_write_u16(vs
, 1); /* number of rects */
512 vnc_framebuffer_update(vs
, 0, 0, vs
->client_width
, vs
->client_height
,
513 VNC_ENCODING_DESKTOPRESIZE
);
517 static void vnc_dpy_resize(DisplayState
*ds
)
519 VncDisplay
*vd
= ds
->opaque
;
524 vd
->server
= qemu_mallocz(sizeof(*vd
->server
));
525 if (vd
->server
->data
)
526 qemu_free(vd
->server
->data
);
527 *(vd
->server
) = *(ds
->surface
);
528 vd
->server
->data
= qemu_mallocz(vd
->server
->linesize
*
533 vd
->guest
.ds
= qemu_mallocz(sizeof(*vd
->guest
.ds
));
534 if (ds_get_bytes_per_pixel(ds
) != vd
->guest
.ds
->pf
.bytes_per_pixel
)
535 console_color_init(ds
);
536 *(vd
->guest
.ds
) = *(ds
->surface
);
537 memset(vd
->guest
.dirty
, 0xFF, sizeof(vd
->guest
.dirty
));
539 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
541 vnc_desktop_resize(vs
);
542 if (vs
->vd
->cursor
) {
543 vnc_cursor_define(vs
);
545 memset(vs
->dirty
, 0xFF, sizeof(vs
->dirty
));
550 static void vnc_write_pixels_copy(VncState
*vs
, struct PixelFormat
*pf
,
551 void *pixels
, int size
)
553 vnc_write(vs
, pixels
, size
);
556 /* slowest but generic code. */
557 void vnc_convert_pixel(VncState
*vs
, uint8_t *buf
, uint32_t v
)
560 VncDisplay
*vd
= vs
->vd
;
562 r
= ((((v
& vd
->server
->pf
.rmask
) >> vd
->server
->pf
.rshift
) << vs
->clientds
.pf
.rbits
) >>
563 vd
->server
->pf
.rbits
);
564 g
= ((((v
& vd
->server
->pf
.gmask
) >> vd
->server
->pf
.gshift
) << vs
->clientds
.pf
.gbits
) >>
565 vd
->server
->pf
.gbits
);
566 b
= ((((v
& vd
->server
->pf
.bmask
) >> vd
->server
->pf
.bshift
) << vs
->clientds
.pf
.bbits
) >>
567 vd
->server
->pf
.bbits
);
568 v
= (r
<< vs
->clientds
.pf
.rshift
) |
569 (g
<< vs
->clientds
.pf
.gshift
) |
570 (b
<< vs
->clientds
.pf
.bshift
);
571 switch(vs
->clientds
.pf
.bytes_per_pixel
) {
576 if (vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) {
586 if (vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) {
601 static void vnc_write_pixels_generic(VncState
*vs
, struct PixelFormat
*pf
,
602 void *pixels1
, int size
)
606 if (pf
->bytes_per_pixel
== 4) {
607 uint32_t *pixels
= pixels1
;
610 for(i
= 0; i
< n
; i
++) {
611 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
612 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
614 } else if (pf
->bytes_per_pixel
== 2) {
615 uint16_t *pixels
= pixels1
;
618 for(i
= 0; i
< n
; i
++) {
619 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
620 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
622 } else if (pf
->bytes_per_pixel
== 1) {
623 uint8_t *pixels
= pixels1
;
626 for(i
= 0; i
< n
; i
++) {
627 vnc_convert_pixel(vs
, buf
, pixels
[i
]);
628 vnc_write(vs
, buf
, vs
->clientds
.pf
.bytes_per_pixel
);
631 fprintf(stderr
, "vnc_write_pixels_generic: VncState color depth not supported\n");
635 int vnc_raw_send_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
)
639 VncDisplay
*vd
= vs
->vd
;
641 row
= vd
->server
->data
+ y
* ds_get_linesize(vs
->ds
) + x
* ds_get_bytes_per_pixel(vs
->ds
);
642 for (i
= 0; i
< h
; i
++) {
643 vs
->write_pixels(vs
, &vd
->server
->pf
, row
, w
* ds_get_bytes_per_pixel(vs
->ds
));
644 row
+= ds_get_linesize(vs
->ds
);
649 static int send_framebuffer_update(VncState
*vs
, int x
, int y
, int w
, int h
)
653 switch(vs
->vnc_encoding
) {
654 case VNC_ENCODING_ZLIB
:
655 n
= vnc_zlib_send_framebuffer_update(vs
, x
, y
, w
, h
);
657 case VNC_ENCODING_HEXTILE
:
658 vnc_framebuffer_update(vs
, x
, y
, w
, h
, VNC_ENCODING_HEXTILE
);
659 n
= vnc_hextile_send_framebuffer_update(vs
, x
, y
, w
, h
);
661 case VNC_ENCODING_TIGHT
:
662 n
= vnc_tight_send_framebuffer_update(vs
, x
, y
, w
, h
);
665 vnc_framebuffer_update(vs
, x
, y
, w
, h
, VNC_ENCODING_RAW
);
666 n
= vnc_raw_send_framebuffer_update(vs
, x
, y
, w
, h
);
672 static void vnc_copy(VncState
*vs
, int src_x
, int src_y
, int dst_x
, int dst_y
, int w
, int h
)
674 /* send bitblit op to the vnc client */
675 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
677 vnc_write_u16(vs
, 1); /* number of rects */
678 vnc_framebuffer_update(vs
, dst_x
, dst_y
, w
, h
, VNC_ENCODING_COPYRECT
);
679 vnc_write_u16(vs
, src_x
);
680 vnc_write_u16(vs
, src_y
);
684 static void vnc_dpy_copy(DisplayState
*ds
, int src_x
, int src_y
, int dst_x
, int dst_y
, int w
, int h
)
686 VncDisplay
*vd
= ds
->opaque
;
690 int i
,x
,y
,pitch
,depth
,inc
,w_lim
,s
;
693 vnc_refresh_server_surface(vd
);
694 QTAILQ_FOREACH_SAFE(vs
, &vd
->clients
, next
, vn
) {
695 if (vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
696 vs
->force_update
= 1;
697 vnc_update_client(vs
, 1);
698 /* vs might be free()ed here */
702 /* do bitblit op on the local surface too */
703 pitch
= ds_get_linesize(vd
->ds
);
704 depth
= ds_get_bytes_per_pixel(vd
->ds
);
705 src_row
= vd
->server
->data
+ pitch
* src_y
+ depth
* src_x
;
706 dst_row
= vd
->server
->data
+ pitch
* dst_y
+ depth
* dst_x
;
711 src_row
+= pitch
* (h
-1);
712 dst_row
+= pitch
* (h
-1);
717 w_lim
= w
- (16 - (dst_x
% 16));
721 w_lim
= w
- (w_lim
% 16);
722 for (i
= 0; i
< h
; i
++) {
723 for (x
= 0; x
<= w_lim
;
724 x
+= s
, src_row
+= cmp_bytes
, dst_row
+= cmp_bytes
) {
726 if ((s
= w
- w_lim
) == 0)
729 s
= (16 - (dst_x
% 16));
734 cmp_bytes
= s
* depth
;
735 if (memcmp(src_row
, dst_row
, cmp_bytes
) == 0)
737 memmove(dst_row
, src_row
, cmp_bytes
);
738 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
739 if (!vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
740 vnc_set_bit(vs
->dirty
[y
], ((x
+ dst_x
) / 16));
744 src_row
+= pitch
- w
* depth
;
745 dst_row
+= pitch
- w
* depth
;
749 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
750 if (vnc_has_feature(vs
, VNC_FEATURE_COPYRECT
)) {
751 vnc_copy(vs
, src_x
, src_y
, dst_x
, dst_y
, w
, h
);
756 static void vnc_mouse_set(int x
, int y
, int visible
)
758 /* can we ask the client(s) to move the pointer ??? */
761 static int vnc_cursor_define(VncState
*vs
)
763 QEMUCursor
*c
= vs
->vd
->cursor
;
764 PixelFormat pf
= qemu_default_pixelformat(32);
767 if (vnc_has_feature(vs
, VNC_FEATURE_RICH_CURSOR
)) {
768 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
769 vnc_write_u8(vs
, 0); /* padding */
770 vnc_write_u16(vs
, 1); /* # of rects */
771 vnc_framebuffer_update(vs
, c
->hot_x
, c
->hot_y
, c
->width
, c
->height
,
772 VNC_ENCODING_RICH_CURSOR
);
773 isize
= c
->width
* c
->height
* vs
->clientds
.pf
.bytes_per_pixel
;
774 vnc_write_pixels_generic(vs
, &pf
, c
->data
, isize
);
775 vnc_write(vs
, vs
->vd
->cursor_mask
, vs
->vd
->cursor_msize
);
781 static void vnc_dpy_cursor_define(QEMUCursor
*c
)
783 VncDisplay
*vd
= vnc_display
;
786 cursor_put(vd
->cursor
);
787 qemu_free(vd
->cursor_mask
);
790 cursor_get(vd
->cursor
);
791 vd
->cursor_msize
= cursor_get_mono_bpl(c
) * c
->height
;
792 vd
->cursor_mask
= qemu_mallocz(vd
->cursor_msize
);
793 cursor_get_mono_mask(c
, 0, vd
->cursor_mask
);
795 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
796 vnc_cursor_define(vs
);
800 static int find_and_clear_dirty_height(struct VncState
*vs
,
801 int y
, int last_x
, int x
)
804 VncDisplay
*vd
= vs
->vd
;
806 for (h
= 1; h
< (vd
->server
->height
- y
); h
++) {
808 if (!vnc_get_bit(vs
->dirty
[y
+ h
], last_x
))
810 for (tmp_x
= last_x
; tmp_x
< x
; tmp_x
++)
811 vnc_clear_bit(vs
->dirty
[y
+ h
], tmp_x
);
817 static int vnc_update_client(VncState
*vs
, int has_dirty
)
819 if (vs
->need_update
&& vs
->csock
!= -1) {
820 VncDisplay
*vd
= vs
->vd
;
827 if (vs
->output
.offset
&& !vs
->audio_cap
&& !vs
->force_update
)
828 /* kernel send buffers are full -> drop frames to throttle */
831 if (!has_dirty
&& !vs
->audio_cap
&& !vs
->force_update
)
835 * Send screen updates to the vnc client using the server
836 * surface and server dirty map. guest surface updates
837 * happening in parallel don't disturb us, the next pass will
838 * send them to the client.
841 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
843 saved_offset
= vs
->output
.offset
;
844 vnc_write_u16(vs
, 0);
846 width
= MIN(vd
->server
->width
, vs
->client_width
);
847 height
= MIN(vd
->server
->height
, vs
->client_height
);
849 for (y
= 0; y
< height
; y
++) {
852 for (x
= 0; x
< width
/ 16; x
++) {
853 if (vnc_get_bit(vs
->dirty
[y
], x
)) {
857 vnc_clear_bit(vs
->dirty
[y
], x
);
860 int h
= find_and_clear_dirty_height(vs
, y
, last_x
, x
);
861 n
= send_framebuffer_update(vs
, last_x
* 16, y
,
862 (x
- last_x
) * 16, h
);
869 int h
= find_and_clear_dirty_height(vs
, y
, last_x
, x
);
870 n
= send_framebuffer_update(vs
, last_x
* 16, y
,
871 (x
- last_x
) * 16, h
);
875 vs
->output
.buffer
[saved_offset
] = (n_rectangles
>> 8) & 0xFF;
876 vs
->output
.buffer
[saved_offset
+ 1] = n_rectangles
& 0xFF;
878 vs
->force_update
= 0;
883 vnc_disconnect_finish(vs
);
889 static void audio_capture_notify(void *opaque
, audcnotification_e cmd
)
891 VncState
*vs
= opaque
;
894 case AUD_CNOTIFY_DISABLE
:
895 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
896 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
897 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_END
);
901 case AUD_CNOTIFY_ENABLE
:
902 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
903 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
904 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN
);
910 static void audio_capture_destroy(void *opaque
)
914 static void audio_capture(void *opaque
, void *buf
, int size
)
916 VncState
*vs
= opaque
;
918 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU
);
919 vnc_write_u8(vs
, VNC_MSG_SERVER_QEMU_AUDIO
);
920 vnc_write_u16(vs
, VNC_MSG_SERVER_QEMU_AUDIO_DATA
);
921 vnc_write_u32(vs
, size
);
922 vnc_write(vs
, buf
, size
);
926 static void audio_add(VncState
*vs
)
928 struct audio_capture_ops ops
;
931 monitor_printf(default_mon
, "audio already running\n");
935 ops
.notify
= audio_capture_notify
;
936 ops
.destroy
= audio_capture_destroy
;
937 ops
.capture
= audio_capture
;
939 vs
->audio_cap
= AUD_add_capture(&vs
->as
, &ops
, vs
);
940 if (!vs
->audio_cap
) {
941 monitor_printf(default_mon
, "Failed to add audio capture\n");
945 static void audio_del(VncState
*vs
)
948 AUD_del_capture(vs
->audio_cap
, vs
);
949 vs
->audio_cap
= NULL
;
953 static void vnc_disconnect_start(VncState
*vs
)
957 qemu_set_fd_handler2(vs
->csock
, NULL
, NULL
, NULL
, NULL
);
958 closesocket(vs
->csock
);
962 static void vnc_disconnect_finish(VncState
*vs
)
964 vnc_qmp_event(vs
, QEVENT_VNC_DISCONNECTED
);
966 buffer_free(&vs
->input
);
967 buffer_free(&vs
->output
);
969 qobject_decref(vs
->info
);
974 #ifdef CONFIG_VNC_TLS
975 vnc_tls_client_cleanup(vs
);
976 #endif /* CONFIG_VNC_TLS */
977 #ifdef CONFIG_VNC_SASL
978 vnc_sasl_client_cleanup(vs
);
979 #endif /* CONFIG_VNC_SASL */
982 QTAILQ_REMOVE(&vs
->vd
->clients
, vs
, next
);
984 if (QTAILQ_EMPTY(&vs
->vd
->clients
)) {
988 qemu_remove_mouse_mode_change_notifier(&vs
->mouse_mode_notifier
);
989 vnc_remove_timer(vs
->vd
);
990 if (vs
->vd
->lock_key_sync
)
991 qemu_remove_led_event_handler(vs
->led
);
995 int vnc_client_io_error(VncState
*vs
, int ret
, int last_errno
)
997 if (ret
== 0 || ret
== -1) {
999 switch (last_errno
) {
1003 case WSAEWOULDBLOCK
:
1011 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1012 ret
, ret
< 0 ? last_errno
: 0);
1013 vnc_disconnect_start(vs
);
1021 void vnc_client_error(VncState
*vs
)
1023 VNC_DEBUG("Closing down client sock: protocol error\n");
1024 vnc_disconnect_start(vs
);
1029 * Called to write a chunk of data to the client socket. The data may
1030 * be the raw data, or may have already been encoded by SASL.
1031 * The data will be written either straight onto the socket, or
1032 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1034 * NB, it is theoretically possible to have 2 layers of encryption,
1035 * both SASL, and this TLS layer. It is highly unlikely in practice
1036 * though, since SASL encryption will typically be a no-op if TLS
1039 * Returns the number of bytes written, which may be less than
1040 * the requested 'datalen' if the socket would block. Returns
1041 * -1 on error, and disconnects the client socket.
1043 long vnc_client_write_buf(VncState
*vs
, const uint8_t *data
, size_t datalen
)
1046 #ifdef CONFIG_VNC_TLS
1047 if (vs
->tls
.session
) {
1048 ret
= gnutls_write(vs
->tls
.session
, data
, datalen
);
1050 if (ret
== GNUTLS_E_AGAIN
)
1057 #endif /* CONFIG_VNC_TLS */
1058 ret
= send(vs
->csock
, (const void *)data
, datalen
, 0);
1059 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data
, datalen
, ret
);
1060 return vnc_client_io_error(vs
, ret
, socket_error());
1065 * Called to write buffered data to the client socket, when not
1066 * using any SASL SSF encryption layers. Will write as much data
1067 * as possible without blocking. If all buffered data is written,
1068 * will switch the FD poll() handler back to read monitoring.
1070 * Returns the number of bytes written, which may be less than
1071 * the buffered output data if the socket would block. Returns
1072 * -1 on error, and disconnects the client socket.
1074 static long vnc_client_write_plain(VncState
*vs
)
1078 #ifdef CONFIG_VNC_SASL
1079 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1080 vs
->output
.buffer
, vs
->output
.capacity
, vs
->output
.offset
,
1081 vs
->sasl
.waitWriteSSF
);
1083 if (vs
->sasl
.conn
&&
1085 vs
->sasl
.waitWriteSSF
) {
1086 ret
= vnc_client_write_buf(vs
, vs
->output
.buffer
, vs
->sasl
.waitWriteSSF
);
1088 vs
->sasl
.waitWriteSSF
-= ret
;
1090 #endif /* CONFIG_VNC_SASL */
1091 ret
= vnc_client_write_buf(vs
, vs
->output
.buffer
, vs
->output
.offset
);
1095 memmove(vs
->output
.buffer
, vs
->output
.buffer
+ ret
, (vs
->output
.offset
- ret
));
1096 vs
->output
.offset
-= ret
;
1098 if (vs
->output
.offset
== 0) {
1099 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
1107 * First function called whenever there is data to be written to
1108 * the client socket. Will delegate actual work according to whether
1109 * SASL SSF layers are enabled (thus requiring encryption calls)
1111 void vnc_client_write(void *opaque
)
1113 VncState
*vs
= opaque
;
1115 #ifdef CONFIG_VNC_SASL
1116 if (vs
->sasl
.conn
&&
1118 !vs
->sasl
.waitWriteSSF
) {
1119 vnc_client_write_sasl(vs
);
1121 #endif /* CONFIG_VNC_SASL */
1122 vnc_client_write_plain(vs
);
1125 void vnc_read_when(VncState
*vs
, VncReadEvent
*func
, size_t expecting
)
1127 vs
->read_handler
= func
;
1128 vs
->read_handler_expect
= expecting
;
1133 * Called to read a chunk of data from the client socket. The data may
1134 * be the raw data, or may need to be further decoded by SASL.
1135 * The data will be read either straight from to the socket, or
1136 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1138 * NB, it is theoretically possible to have 2 layers of encryption,
1139 * both SASL, and this TLS layer. It is highly unlikely in practice
1140 * though, since SASL encryption will typically be a no-op if TLS
1143 * Returns the number of bytes read, which may be less than
1144 * the requested 'datalen' if the socket would block. Returns
1145 * -1 on error, and disconnects the client socket.
1147 long vnc_client_read_buf(VncState
*vs
, uint8_t *data
, size_t datalen
)
1150 #ifdef CONFIG_VNC_TLS
1151 if (vs
->tls
.session
) {
1152 ret
= gnutls_read(vs
->tls
.session
, data
, datalen
);
1154 if (ret
== GNUTLS_E_AGAIN
)
1161 #endif /* CONFIG_VNC_TLS */
1162 ret
= recv(vs
->csock
, (void *)data
, datalen
, 0);
1163 VNC_DEBUG("Read wire %p %zd -> %ld\n", data
, datalen
, ret
);
1164 return vnc_client_io_error(vs
, ret
, socket_error());
1169 * Called to read data from the client socket to the input buffer,
1170 * when not using any SASL SSF encryption layers. Will read as much
1171 * data as possible without blocking.
1173 * Returns the number of bytes read. Returns -1 on error, and
1174 * disconnects the client socket.
1176 static long vnc_client_read_plain(VncState
*vs
)
1179 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1180 vs
->input
.buffer
, vs
->input
.capacity
, vs
->input
.offset
);
1181 buffer_reserve(&vs
->input
, 4096);
1182 ret
= vnc_client_read_buf(vs
, buffer_end(&vs
->input
), 4096);
1185 vs
->input
.offset
+= ret
;
1191 * First function called whenever there is more data to be read from
1192 * the client socket. Will delegate actual work according to whether
1193 * SASL SSF layers are enabled (thus requiring decryption calls)
1195 void vnc_client_read(void *opaque
)
1197 VncState
*vs
= opaque
;
1200 #ifdef CONFIG_VNC_SASL
1201 if (vs
->sasl
.conn
&& vs
->sasl
.runSSF
)
1202 ret
= vnc_client_read_sasl(vs
);
1204 #endif /* CONFIG_VNC_SASL */
1205 ret
= vnc_client_read_plain(vs
);
1207 if (vs
->csock
== -1)
1208 vnc_disconnect_finish(vs
);
1212 while (vs
->read_handler
&& vs
->input
.offset
>= vs
->read_handler_expect
) {
1213 size_t len
= vs
->read_handler_expect
;
1216 ret
= vs
->read_handler(vs
, vs
->input
.buffer
, len
);
1217 if (vs
->csock
== -1) {
1218 vnc_disconnect_finish(vs
);
1223 memmove(vs
->input
.buffer
, vs
->input
.buffer
+ len
, (vs
->input
.offset
- len
));
1224 vs
->input
.offset
-= len
;
1226 vs
->read_handler_expect
= ret
;
1231 void vnc_write(VncState
*vs
, const void *data
, size_t len
)
1233 buffer_reserve(&vs
->output
, len
);
1235 if (vs
->csock
!= -1 && buffer_empty(&vs
->output
)) {
1236 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, vnc_client_write
, vs
);
1239 buffer_append(&vs
->output
, data
, len
);
1242 void vnc_write_s32(VncState
*vs
, int32_t value
)
1244 vnc_write_u32(vs
, *(uint32_t *)&value
);
1247 void vnc_write_u32(VncState
*vs
, uint32_t value
)
1251 buf
[0] = (value
>> 24) & 0xFF;
1252 buf
[1] = (value
>> 16) & 0xFF;
1253 buf
[2] = (value
>> 8) & 0xFF;
1254 buf
[3] = value
& 0xFF;
1256 vnc_write(vs
, buf
, 4);
1259 void vnc_write_u16(VncState
*vs
, uint16_t value
)
1263 buf
[0] = (value
>> 8) & 0xFF;
1264 buf
[1] = value
& 0xFF;
1266 vnc_write(vs
, buf
, 2);
1269 void vnc_write_u8(VncState
*vs
, uint8_t value
)
1271 vnc_write(vs
, (char *)&value
, 1);
1274 void vnc_flush(VncState
*vs
)
1276 if (vs
->csock
!= -1 && vs
->output
.offset
)
1277 vnc_client_write(vs
);
1280 uint8_t read_u8(uint8_t *data
, size_t offset
)
1282 return data
[offset
];
1285 uint16_t read_u16(uint8_t *data
, size_t offset
)
1287 return ((data
[offset
] & 0xFF) << 8) | (data
[offset
+ 1] & 0xFF);
1290 int32_t read_s32(uint8_t *data
, size_t offset
)
1292 return (int32_t)((data
[offset
] << 24) | (data
[offset
+ 1] << 16) |
1293 (data
[offset
+ 2] << 8) | data
[offset
+ 3]);
1296 uint32_t read_u32(uint8_t *data
, size_t offset
)
1298 return ((data
[offset
] << 24) | (data
[offset
+ 1] << 16) |
1299 (data
[offset
+ 2] << 8) | data
[offset
+ 3]);
1302 static void client_cut_text(VncState
*vs
, size_t len
, uint8_t *text
)
1306 static void check_pointer_type_change(Notifier
*notifier
)
1308 VncState
*vs
= container_of(notifier
, VncState
, mouse_mode_notifier
);
1309 int absolute
= kbd_mouse_is_absolute();
1311 if (vnc_has_feature(vs
, VNC_FEATURE_POINTER_TYPE_CHANGE
) && vs
->absolute
!= absolute
) {
1312 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1313 vnc_write_u8(vs
, 0);
1314 vnc_write_u16(vs
, 1);
1315 vnc_framebuffer_update(vs
, absolute
, 0,
1316 ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1317 VNC_ENCODING_POINTER_TYPE_CHANGE
);
1320 vs
->absolute
= absolute
;
1323 static void pointer_event(VncState
*vs
, int button_mask
, int x
, int y
)
1328 if (button_mask
& 0x01)
1329 buttons
|= MOUSE_EVENT_LBUTTON
;
1330 if (button_mask
& 0x02)
1331 buttons
|= MOUSE_EVENT_MBUTTON
;
1332 if (button_mask
& 0x04)
1333 buttons
|= MOUSE_EVENT_RBUTTON
;
1334 if (button_mask
& 0x08)
1336 if (button_mask
& 0x10)
1340 kbd_mouse_event(ds_get_width(vs
->ds
) > 1 ?
1341 x
* 0x7FFF / (ds_get_width(vs
->ds
) - 1) : 0x4000,
1342 ds_get_height(vs
->ds
) > 1 ?
1343 y
* 0x7FFF / (ds_get_height(vs
->ds
) - 1) : 0x4000,
1345 } else if (vnc_has_feature(vs
, VNC_FEATURE_POINTER_TYPE_CHANGE
)) {
1349 kbd_mouse_event(x
, y
, dz
, buttons
);
1351 if (vs
->last_x
!= -1)
1352 kbd_mouse_event(x
- vs
->last_x
,
1360 static void reset_keys(VncState
*vs
)
1363 for(i
= 0; i
< 256; i
++) {
1364 if (vs
->modifiers_state
[i
]) {
1365 if (i
& SCANCODE_GREY
)
1366 kbd_put_keycode(SCANCODE_EMUL0
);
1367 kbd_put_keycode(i
| SCANCODE_UP
);
1368 vs
->modifiers_state
[i
] = 0;
1373 static void press_key(VncState
*vs
, int keysym
)
1375 int keycode
= keysym2scancode(vs
->vd
->kbd_layout
, keysym
) & SCANCODE_KEYMASK
;
1376 if (keycode
& SCANCODE_GREY
)
1377 kbd_put_keycode(SCANCODE_EMUL0
);
1378 kbd_put_keycode(keycode
& SCANCODE_KEYCODEMASK
);
1379 if (keycode
& SCANCODE_GREY
)
1380 kbd_put_keycode(SCANCODE_EMUL0
);
1381 kbd_put_keycode(keycode
| SCANCODE_UP
);
1384 static void kbd_leds(void *opaque
, int ledstate
)
1386 VncState
*vs
= opaque
;
1389 caps
= ledstate
& QEMU_CAPS_LOCK_LED
? 1 : 0;
1390 num
= ledstate
& QEMU_NUM_LOCK_LED
? 1 : 0;
1392 if (vs
->modifiers_state
[0x3a] != caps
) {
1393 vs
->modifiers_state
[0x3a] = caps
;
1395 if (vs
->modifiers_state
[0x45] != num
) {
1396 vs
->modifiers_state
[0x45] = num
;
1400 static void do_key_event(VncState
*vs
, int down
, int keycode
, int sym
)
1402 /* QEMU console switch */
1404 case 0x2a: /* Left Shift */
1405 case 0x36: /* Right Shift */
1406 case 0x1d: /* Left CTRL */
1407 case 0x9d: /* Right CTRL */
1408 case 0x38: /* Left ALT */
1409 case 0xb8: /* Right ALT */
1411 vs
->modifiers_state
[keycode
] = 1;
1413 vs
->modifiers_state
[keycode
] = 0;
1415 case 0x02 ... 0x0a: /* '1' to '9' keys */
1416 if (down
&& vs
->modifiers_state
[0x1d] && vs
->modifiers_state
[0x38]) {
1417 /* Reset the modifiers sent to the current console */
1419 console_select(keycode
- 0x02);
1423 case 0x3a: /* CapsLock */
1424 case 0x45: /* NumLock */
1426 vs
->modifiers_state
[keycode
] ^= 1;
1430 if (vs
->vd
->lock_key_sync
&&
1431 keycode_is_keypad(vs
->vd
->kbd_layout
, keycode
)) {
1432 /* If the numlock state needs to change then simulate an additional
1433 keypress before sending this one. This will happen if the user
1434 toggles numlock away from the VNC window.
1436 if (keysym_is_numlock(vs
->vd
->kbd_layout
, sym
& 0xFFFF)) {
1437 if (!vs
->modifiers_state
[0x45]) {
1438 vs
->modifiers_state
[0x45] = 1;
1439 press_key(vs
, 0xff7f);
1442 if (vs
->modifiers_state
[0x45]) {
1443 vs
->modifiers_state
[0x45] = 0;
1444 press_key(vs
, 0xff7f);
1449 if (vs
->vd
->lock_key_sync
&&
1450 ((sym
>= 'A' && sym
<= 'Z') || (sym
>= 'a' && sym
<= 'z'))) {
1451 /* If the capslock state needs to change then simulate an additional
1452 keypress before sending this one. This will happen if the user
1453 toggles capslock away from the VNC window.
1455 int uppercase
= !!(sym
>= 'A' && sym
<= 'Z');
1456 int shift
= !!(vs
->modifiers_state
[0x2a] | vs
->modifiers_state
[0x36]);
1457 int capslock
= !!(vs
->modifiers_state
[0x3a]);
1459 if (uppercase
== shift
) {
1460 vs
->modifiers_state
[0x3a] = 0;
1461 press_key(vs
, 0xffe5);
1464 if (uppercase
!= shift
) {
1465 vs
->modifiers_state
[0x3a] = 1;
1466 press_key(vs
, 0xffe5);
1471 if (is_graphic_console()) {
1472 if (keycode
& SCANCODE_GREY
)
1473 kbd_put_keycode(SCANCODE_EMUL0
);
1475 kbd_put_keycode(keycode
& SCANCODE_KEYCODEMASK
);
1477 kbd_put_keycode(keycode
| SCANCODE_UP
);
1479 /* QEMU console emulation */
1481 int numlock
= vs
->modifiers_state
[0x45];
1483 case 0x2a: /* Left Shift */
1484 case 0x36: /* Right Shift */
1485 case 0x1d: /* Left CTRL */
1486 case 0x9d: /* Right CTRL */
1487 case 0x38: /* Left ALT */
1488 case 0xb8: /* Right ALT */
1491 kbd_put_keysym(QEMU_KEY_UP
);
1494 kbd_put_keysym(QEMU_KEY_DOWN
);
1497 kbd_put_keysym(QEMU_KEY_LEFT
);
1500 kbd_put_keysym(QEMU_KEY_RIGHT
);
1503 kbd_put_keysym(QEMU_KEY_DELETE
);
1506 kbd_put_keysym(QEMU_KEY_HOME
);
1509 kbd_put_keysym(QEMU_KEY_END
);
1512 kbd_put_keysym(QEMU_KEY_PAGEUP
);
1515 kbd_put_keysym(QEMU_KEY_PAGEDOWN
);
1519 kbd_put_keysym(numlock
? '7' : QEMU_KEY_HOME
);
1522 kbd_put_keysym(numlock
? '8' : QEMU_KEY_UP
);
1525 kbd_put_keysym(numlock
? '9' : QEMU_KEY_PAGEUP
);
1528 kbd_put_keysym(numlock
? '4' : QEMU_KEY_LEFT
);
1531 kbd_put_keysym('5');
1534 kbd_put_keysym(numlock
? '6' : QEMU_KEY_RIGHT
);
1537 kbd_put_keysym(numlock
? '1' : QEMU_KEY_END
);
1540 kbd_put_keysym(numlock
? '2' : QEMU_KEY_DOWN
);
1543 kbd_put_keysym(numlock
? '3' : QEMU_KEY_PAGEDOWN
);
1546 kbd_put_keysym('0');
1549 kbd_put_keysym(numlock
? '.' : QEMU_KEY_DELETE
);
1553 kbd_put_keysym('/');
1556 kbd_put_keysym('*');
1559 kbd_put_keysym('-');
1562 kbd_put_keysym('+');
1565 kbd_put_keysym('\n');
1569 kbd_put_keysym(sym
);
1576 static void key_event(VncState
*vs
, int down
, uint32_t sym
)
1581 if (lsym
>= 'A' && lsym
<= 'Z' && is_graphic_console()) {
1582 lsym
= lsym
- 'A' + 'a';
1585 keycode
= keysym2scancode(vs
->vd
->kbd_layout
, lsym
& 0xFFFF) & SCANCODE_KEYMASK
;
1586 do_key_event(vs
, down
, keycode
, sym
);
1589 static void ext_key_event(VncState
*vs
, int down
,
1590 uint32_t sym
, uint16_t keycode
)
1592 /* if the user specifies a keyboard layout, always use it */
1593 if (keyboard_layout
)
1594 key_event(vs
, down
, sym
);
1596 do_key_event(vs
, down
, keycode
, sym
);
1599 static void framebuffer_update_request(VncState
*vs
, int incremental
,
1600 int x_position
, int y_position
,
1603 if (y_position
> ds_get_height(vs
->ds
))
1604 y_position
= ds_get_height(vs
->ds
);
1605 if (y_position
+ h
>= ds_get_height(vs
->ds
))
1606 h
= ds_get_height(vs
->ds
) - y_position
;
1609 vs
->need_update
= 1;
1611 vs
->force_update
= 1;
1612 for (i
= 0; i
< h
; i
++) {
1613 vnc_set_bits(vs
->dirty
[y_position
+ i
],
1614 (ds_get_width(vs
->ds
) / 16), VNC_DIRTY_WORDS
);
1619 static void send_ext_key_event_ack(VncState
*vs
)
1621 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1622 vnc_write_u8(vs
, 0);
1623 vnc_write_u16(vs
, 1);
1624 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1625 VNC_ENCODING_EXT_KEY_EVENT
);
1629 static void send_ext_audio_ack(VncState
*vs
)
1631 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1632 vnc_write_u8(vs
, 0);
1633 vnc_write_u16(vs
, 1);
1634 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
), ds_get_height(vs
->ds
),
1635 VNC_ENCODING_AUDIO
);
1639 static void set_encodings(VncState
*vs
, int32_t *encodings
, size_t n_encodings
)
1642 unsigned int enc
= 0;
1645 vs
->vnc_encoding
= 0;
1646 vs
->tight_compression
= 9;
1647 vs
->tight_quality
= -1; /* Lossless by default */
1651 * Start from the end because the encodings are sent in order of preference.
1652 * This way the prefered encoding (first encoding defined in the array)
1653 * will be set at the end of the loop.
1655 for (i
= n_encodings
- 1; i
>= 0; i
--) {
1658 case VNC_ENCODING_RAW
:
1659 vs
->vnc_encoding
= enc
;
1661 case VNC_ENCODING_COPYRECT
:
1662 vs
->features
|= VNC_FEATURE_COPYRECT_MASK
;
1664 case VNC_ENCODING_HEXTILE
:
1665 vs
->features
|= VNC_FEATURE_HEXTILE_MASK
;
1666 vs
->vnc_encoding
= enc
;
1668 case VNC_ENCODING_TIGHT
:
1669 vs
->features
|= VNC_FEATURE_TIGHT_MASK
;
1670 vs
->vnc_encoding
= enc
;
1672 case VNC_ENCODING_ZLIB
:
1673 vs
->features
|= VNC_FEATURE_ZLIB_MASK
;
1674 vs
->vnc_encoding
= enc
;
1676 case VNC_ENCODING_DESKTOPRESIZE
:
1677 vs
->features
|= VNC_FEATURE_RESIZE_MASK
;
1679 case VNC_ENCODING_POINTER_TYPE_CHANGE
:
1680 vs
->features
|= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK
;
1682 case VNC_ENCODING_RICH_CURSOR
:
1683 vs
->features
|= VNC_FEATURE_RICH_CURSOR_MASK
;
1685 case VNC_ENCODING_EXT_KEY_EVENT
:
1686 send_ext_key_event_ack(vs
);
1688 case VNC_ENCODING_AUDIO
:
1689 send_ext_audio_ack(vs
);
1691 case VNC_ENCODING_WMVi
:
1692 vs
->features
|= VNC_FEATURE_WMVI_MASK
;
1694 case VNC_ENCODING_COMPRESSLEVEL0
... VNC_ENCODING_COMPRESSLEVEL0
+ 9:
1695 vs
->tight_compression
= (enc
& 0x0F);
1697 case VNC_ENCODING_QUALITYLEVEL0
... VNC_ENCODING_QUALITYLEVEL0
+ 9:
1698 vs
->tight_quality
= (enc
& 0x0F);
1701 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i
, enc
, enc
);
1705 vnc_desktop_resize(vs
);
1706 check_pointer_type_change(&vs
->mouse_mode_notifier
);
1709 static void set_pixel_conversion(VncState
*vs
)
1711 if ((vs
->clientds
.flags
& QEMU_BIG_ENDIAN_FLAG
) ==
1712 (vs
->ds
->surface
->flags
& QEMU_BIG_ENDIAN_FLAG
) &&
1713 !memcmp(&(vs
->clientds
.pf
), &(vs
->ds
->surface
->pf
), sizeof(PixelFormat
))) {
1714 vs
->write_pixels
= vnc_write_pixels_copy
;
1715 vnc_hextile_set_pixel_conversion(vs
, 0);
1717 vs
->write_pixels
= vnc_write_pixels_generic
;
1718 vnc_hextile_set_pixel_conversion(vs
, 1);
1722 static void set_pixel_format(VncState
*vs
,
1723 int bits_per_pixel
, int depth
,
1724 int big_endian_flag
, int true_color_flag
,
1725 int red_max
, int green_max
, int blue_max
,
1726 int red_shift
, int green_shift
, int blue_shift
)
1728 if (!true_color_flag
) {
1729 vnc_client_error(vs
);
1733 vs
->clientds
= *(vs
->vd
->guest
.ds
);
1734 vs
->clientds
.pf
.rmax
= red_max
;
1735 count_bits(vs
->clientds
.pf
.rbits
, red_max
);
1736 vs
->clientds
.pf
.rshift
= red_shift
;
1737 vs
->clientds
.pf
.rmask
= red_max
<< red_shift
;
1738 vs
->clientds
.pf
.gmax
= green_max
;
1739 count_bits(vs
->clientds
.pf
.gbits
, green_max
);
1740 vs
->clientds
.pf
.gshift
= green_shift
;
1741 vs
->clientds
.pf
.gmask
= green_max
<< green_shift
;
1742 vs
->clientds
.pf
.bmax
= blue_max
;
1743 count_bits(vs
->clientds
.pf
.bbits
, blue_max
);
1744 vs
->clientds
.pf
.bshift
= blue_shift
;
1745 vs
->clientds
.pf
.bmask
= blue_max
<< blue_shift
;
1746 vs
->clientds
.pf
.bits_per_pixel
= bits_per_pixel
;
1747 vs
->clientds
.pf
.bytes_per_pixel
= bits_per_pixel
/ 8;
1748 vs
->clientds
.pf
.depth
= bits_per_pixel
== 32 ? 24 : bits_per_pixel
;
1749 vs
->clientds
.flags
= big_endian_flag
? QEMU_BIG_ENDIAN_FLAG
: 0x00;
1751 set_pixel_conversion(vs
);
1753 vga_hw_invalidate();
1757 static void pixel_format_message (VncState
*vs
) {
1758 char pad
[3] = { 0, 0, 0 };
1760 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.bits_per_pixel
); /* bits-per-pixel */
1761 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.depth
); /* depth */
1763 #ifdef HOST_WORDS_BIGENDIAN
1764 vnc_write_u8(vs
, 1); /* big-endian-flag */
1766 vnc_write_u8(vs
, 0); /* big-endian-flag */
1768 vnc_write_u8(vs
, 1); /* true-color-flag */
1769 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.rmax
); /* red-max */
1770 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.gmax
); /* green-max */
1771 vnc_write_u16(vs
, vs
->ds
->surface
->pf
.bmax
); /* blue-max */
1772 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.rshift
); /* red-shift */
1773 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.gshift
); /* green-shift */
1774 vnc_write_u8(vs
, vs
->ds
->surface
->pf
.bshift
); /* blue-shift */
1776 vnc_hextile_set_pixel_conversion(vs
, 0);
1778 vs
->clientds
= *(vs
->ds
->surface
);
1779 vs
->clientds
.flags
&= ~QEMU_ALLOCATED_FLAG
;
1780 vs
->write_pixels
= vnc_write_pixels_copy
;
1782 vnc_write(vs
, pad
, 3); /* padding */
1785 static void vnc_dpy_setdata(DisplayState
*ds
)
1787 /* We don't have to do anything */
1790 static void vnc_colordepth(VncState
*vs
)
1792 if (vnc_has_feature(vs
, VNC_FEATURE_WMVI
)) {
1793 /* Sending a WMVi message to notify the client*/
1794 vnc_write_u8(vs
, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE
);
1795 vnc_write_u8(vs
, 0);
1796 vnc_write_u16(vs
, 1); /* number of rects */
1797 vnc_framebuffer_update(vs
, 0, 0, ds_get_width(vs
->ds
),
1798 ds_get_height(vs
->ds
), VNC_ENCODING_WMVi
);
1799 pixel_format_message(vs
);
1802 set_pixel_conversion(vs
);
1806 static int protocol_client_msg(VncState
*vs
, uint8_t *data
, size_t len
)
1810 VncDisplay
*vd
= vs
->vd
;
1813 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
1814 if (!qemu_timer_expired(vd
->timer
, qemu_get_clock(rt_clock
) + vd
->timer_interval
))
1815 qemu_mod_timer(vd
->timer
, qemu_get_clock(rt_clock
) + vd
->timer_interval
);
1819 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT
:
1823 set_pixel_format(vs
, read_u8(data
, 4), read_u8(data
, 5),
1824 read_u8(data
, 6), read_u8(data
, 7),
1825 read_u16(data
, 8), read_u16(data
, 10),
1826 read_u16(data
, 12), read_u8(data
, 14),
1827 read_u8(data
, 15), read_u8(data
, 16));
1829 case VNC_MSG_CLIENT_SET_ENCODINGS
:
1834 limit
= read_u16(data
, 2);
1836 return 4 + (limit
* 4);
1838 limit
= read_u16(data
, 2);
1840 for (i
= 0; i
< limit
; i
++) {
1841 int32_t val
= read_s32(data
, 4 + (i
* 4));
1842 memcpy(data
+ 4 + (i
* 4), &val
, sizeof(val
));
1845 set_encodings(vs
, (int32_t *)(data
+ 4), limit
);
1847 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST
:
1851 framebuffer_update_request(vs
,
1852 read_u8(data
, 1), read_u16(data
, 2), read_u16(data
, 4),
1853 read_u16(data
, 6), read_u16(data
, 8));
1855 case VNC_MSG_CLIENT_KEY_EVENT
:
1859 key_event(vs
, read_u8(data
, 1), read_u32(data
, 4));
1861 case VNC_MSG_CLIENT_POINTER_EVENT
:
1865 pointer_event(vs
, read_u8(data
, 1), read_u16(data
, 2), read_u16(data
, 4));
1867 case VNC_MSG_CLIENT_CUT_TEXT
:
1872 uint32_t dlen
= read_u32(data
, 4);
1877 client_cut_text(vs
, read_u32(data
, 4), data
+ 8);
1879 case VNC_MSG_CLIENT_QEMU
:
1883 switch (read_u8(data
, 1)) {
1884 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT
:
1888 ext_key_event(vs
, read_u16(data
, 2),
1889 read_u32(data
, 4), read_u32(data
, 8));
1891 case VNC_MSG_CLIENT_QEMU_AUDIO
:
1895 switch (read_u16 (data
, 2)) {
1896 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE
:
1899 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE
:
1902 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT
:
1905 switch (read_u8(data
, 4)) {
1906 case 0: vs
->as
.fmt
= AUD_FMT_U8
; break;
1907 case 1: vs
->as
.fmt
= AUD_FMT_S8
; break;
1908 case 2: vs
->as
.fmt
= AUD_FMT_U16
; break;
1909 case 3: vs
->as
.fmt
= AUD_FMT_S16
; break;
1910 case 4: vs
->as
.fmt
= AUD_FMT_U32
; break;
1911 case 5: vs
->as
.fmt
= AUD_FMT_S32
; break;
1913 printf("Invalid audio format %d\n", read_u8(data
, 4));
1914 vnc_client_error(vs
);
1917 vs
->as
.nchannels
= read_u8(data
, 5);
1918 if (vs
->as
.nchannels
!= 1 && vs
->as
.nchannels
!= 2) {
1919 printf("Invalid audio channel coount %d\n",
1921 vnc_client_error(vs
);
1924 vs
->as
.freq
= read_u32(data
, 6);
1927 printf ("Invalid audio message %d\n", read_u8(data
, 4));
1928 vnc_client_error(vs
);
1934 printf("Msg: %d\n", read_u16(data
, 0));
1935 vnc_client_error(vs
);
1940 printf("Msg: %d\n", data
[0]);
1941 vnc_client_error(vs
);
1945 vnc_read_when(vs
, protocol_client_msg
, 1);
1949 static int protocol_client_init(VncState
*vs
, uint8_t *data
, size_t len
)
1954 vs
->client_width
= ds_get_width(vs
->ds
);
1955 vs
->client_height
= ds_get_height(vs
->ds
);
1956 vnc_write_u16(vs
, vs
->client_width
);
1957 vnc_write_u16(vs
, vs
->client_height
);
1959 pixel_format_message(vs
);
1962 size
= snprintf(buf
, sizeof(buf
), "QEMU (%s)", qemu_name
);
1964 size
= snprintf(buf
, sizeof(buf
), "QEMU");
1966 vnc_write_u32(vs
, size
);
1967 vnc_write(vs
, buf
, size
);
1970 vnc_client_cache_auth(vs
);
1971 vnc_qmp_event(vs
, QEVENT_VNC_INITIALIZED
);
1973 vnc_read_when(vs
, protocol_client_msg
, 1);
1978 void start_client_init(VncState
*vs
)
1980 vnc_read_when(vs
, protocol_client_init
, 1);
1983 static void make_challenge(VncState
*vs
)
1987 srand(time(NULL
)+getpid()+getpid()*987654+rand());
1989 for (i
= 0 ; i
< sizeof(vs
->challenge
) ; i
++)
1990 vs
->challenge
[i
] = (int) (256.0*rand()/(RAND_MAX
+1.0));
1993 static int protocol_client_auth_vnc(VncState
*vs
, uint8_t *data
, size_t len
)
1995 unsigned char response
[VNC_AUTH_CHALLENGE_SIZE
];
1997 unsigned char key
[8];
1999 if (!vs
->vd
->password
|| !vs
->vd
->password
[0]) {
2000 VNC_DEBUG("No password configured on server");
2001 vnc_write_u32(vs
, 1); /* Reject auth */
2002 if (vs
->minor
>= 8) {
2003 static const char err
[] = "Authentication failed";
2004 vnc_write_u32(vs
, sizeof(err
));
2005 vnc_write(vs
, err
, sizeof(err
));
2008 vnc_client_error(vs
);
2012 memcpy(response
, vs
->challenge
, VNC_AUTH_CHALLENGE_SIZE
);
2014 /* Calculate the expected challenge response */
2015 pwlen
= strlen(vs
->vd
->password
);
2016 for (i
=0; i
<sizeof(key
); i
++)
2017 key
[i
] = i
<pwlen
? vs
->vd
->password
[i
] : 0;
2019 for (j
= 0; j
< VNC_AUTH_CHALLENGE_SIZE
; j
+= 8)
2020 des(response
+j
, response
+j
);
2022 /* Compare expected vs actual challenge response */
2023 if (memcmp(response
, data
, VNC_AUTH_CHALLENGE_SIZE
) != 0) {
2024 VNC_DEBUG("Client challenge reponse did not match\n");
2025 vnc_write_u32(vs
, 1); /* Reject auth */
2026 if (vs
->minor
>= 8) {
2027 static const char err
[] = "Authentication failed";
2028 vnc_write_u32(vs
, sizeof(err
));
2029 vnc_write(vs
, err
, sizeof(err
));
2032 vnc_client_error(vs
);
2034 VNC_DEBUG("Accepting VNC challenge response\n");
2035 vnc_write_u32(vs
, 0); /* Accept auth */
2038 start_client_init(vs
);
2043 void start_auth_vnc(VncState
*vs
)
2046 /* Send client a 'random' challenge */
2047 vnc_write(vs
, vs
->challenge
, sizeof(vs
->challenge
));
2050 vnc_read_when(vs
, protocol_client_auth_vnc
, sizeof(vs
->challenge
));
2054 static int protocol_client_auth(VncState
*vs
, uint8_t *data
, size_t len
)
2056 /* We only advertise 1 auth scheme at a time, so client
2057 * must pick the one we sent. Verify this */
2058 if (data
[0] != vs
->vd
->auth
) { /* Reject auth */
2059 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data
[0]);
2060 vnc_write_u32(vs
, 1);
2061 if (vs
->minor
>= 8) {
2062 static const char err
[] = "Authentication failed";
2063 vnc_write_u32(vs
, sizeof(err
));
2064 vnc_write(vs
, err
, sizeof(err
));
2066 vnc_client_error(vs
);
2067 } else { /* Accept requested auth */
2068 VNC_DEBUG("Client requested auth %d\n", (int)data
[0]);
2069 switch (vs
->vd
->auth
) {
2071 VNC_DEBUG("Accept auth none\n");
2072 if (vs
->minor
>= 8) {
2073 vnc_write_u32(vs
, 0); /* Accept auth completion */
2076 start_client_init(vs
);
2080 VNC_DEBUG("Start VNC auth\n");
2084 #ifdef CONFIG_VNC_TLS
2085 case VNC_AUTH_VENCRYPT
:
2086 VNC_DEBUG("Accept VeNCrypt auth\n");;
2087 start_auth_vencrypt(vs
);
2089 #endif /* CONFIG_VNC_TLS */
2091 #ifdef CONFIG_VNC_SASL
2093 VNC_DEBUG("Accept SASL auth\n");
2094 start_auth_sasl(vs
);
2096 #endif /* CONFIG_VNC_SASL */
2098 default: /* Should not be possible, but just in case */
2099 VNC_DEBUG("Reject auth %d server code bug\n", vs
->vd
->auth
);
2100 vnc_write_u8(vs
, 1);
2101 if (vs
->minor
>= 8) {
2102 static const char err
[] = "Authentication failed";
2103 vnc_write_u32(vs
, sizeof(err
));
2104 vnc_write(vs
, err
, sizeof(err
));
2106 vnc_client_error(vs
);
2112 static int protocol_version(VncState
*vs
, uint8_t *version
, size_t len
)
2116 memcpy(local
, version
, 12);
2119 if (sscanf(local
, "RFB %03d.%03d\n", &vs
->major
, &vs
->minor
) != 2) {
2120 VNC_DEBUG("Malformed protocol version %s\n", local
);
2121 vnc_client_error(vs
);
2124 VNC_DEBUG("Client request protocol version %d.%d\n", vs
->major
, vs
->minor
);
2125 if (vs
->major
!= 3 ||
2131 VNC_DEBUG("Unsupported client version\n");
2132 vnc_write_u32(vs
, VNC_AUTH_INVALID
);
2134 vnc_client_error(vs
);
2137 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2138 * as equivalent to v3.3 by servers
2140 if (vs
->minor
== 4 || vs
->minor
== 5)
2143 if (vs
->minor
== 3) {
2144 if (vs
->vd
->auth
== VNC_AUTH_NONE
) {
2145 VNC_DEBUG("Tell client auth none\n");
2146 vnc_write_u32(vs
, vs
->vd
->auth
);
2148 start_client_init(vs
);
2149 } else if (vs
->vd
->auth
== VNC_AUTH_VNC
) {
2150 VNC_DEBUG("Tell client VNC auth\n");
2151 vnc_write_u32(vs
, vs
->vd
->auth
);
2155 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs
->vd
->auth
);
2156 vnc_write_u32(vs
, VNC_AUTH_INVALID
);
2158 vnc_client_error(vs
);
2161 VNC_DEBUG("Telling client we support auth %d\n", vs
->vd
->auth
);
2162 vnc_write_u8(vs
, 1); /* num auth */
2163 vnc_write_u8(vs
, vs
->vd
->auth
);
2164 vnc_read_when(vs
, protocol_client_auth
, 1);
2171 static int vnc_refresh_server_surface(VncDisplay
*vd
)
2175 uint8_t *server_row
;
2177 uint32_t width_mask
[VNC_DIRTY_WORDS
];
2182 * Walk through the guest dirty map.
2183 * Check and copy modified bits from guest to server surface.
2184 * Update server dirty map.
2186 vnc_set_bits(width_mask
, (ds_get_width(vd
->ds
) / 16), VNC_DIRTY_WORDS
);
2187 cmp_bytes
= 16 * ds_get_bytes_per_pixel(vd
->ds
);
2188 guest_row
= vd
->guest
.ds
->data
;
2189 server_row
= vd
->server
->data
;
2190 for (y
= 0; y
< vd
->guest
.ds
->height
; y
++) {
2191 if (vnc_and_bits(vd
->guest
.dirty
[y
], width_mask
, VNC_DIRTY_WORDS
)) {
2194 uint8_t *server_ptr
;
2196 guest_ptr
= guest_row
;
2197 server_ptr
= server_row
;
2199 for (x
= 0; x
< vd
->guest
.ds
->width
;
2200 x
+= 16, guest_ptr
+= cmp_bytes
, server_ptr
+= cmp_bytes
) {
2201 if (!vnc_get_bit(vd
->guest
.dirty
[y
], (x
/ 16)))
2203 vnc_clear_bit(vd
->guest
.dirty
[y
], (x
/ 16));
2204 if (memcmp(server_ptr
, guest_ptr
, cmp_bytes
) == 0)
2206 memcpy(server_ptr
, guest_ptr
, cmp_bytes
);
2207 QTAILQ_FOREACH(vs
, &vd
->clients
, next
) {
2208 vnc_set_bit(vs
->dirty
[y
], (x
/ 16));
2213 guest_row
+= ds_get_linesize(vd
->ds
);
2214 server_row
+= ds_get_linesize(vd
->ds
);
2219 static void vnc_refresh(void *opaque
)
2221 VncDisplay
*vd
= opaque
;
2223 int has_dirty
, rects
= 0;
2227 has_dirty
= vnc_refresh_server_surface(vd
);
2229 QTAILQ_FOREACH_SAFE(vs
, &vd
->clients
, next
, vn
) {
2230 rects
+= vnc_update_client(vs
, has_dirty
);
2231 /* vs might be free()ed here */
2233 /* vd->timer could be NULL now if the last client disconnected,
2234 * in this case don't update the timer */
2235 if (vd
->timer
== NULL
)
2238 if (has_dirty
&& rects
) {
2239 vd
->timer_interval
/= 2;
2240 if (vd
->timer_interval
< VNC_REFRESH_INTERVAL_BASE
)
2241 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
2243 vd
->timer_interval
+= VNC_REFRESH_INTERVAL_INC
;
2244 if (vd
->timer_interval
> VNC_REFRESH_INTERVAL_MAX
)
2245 vd
->timer_interval
= VNC_REFRESH_INTERVAL_MAX
;
2247 qemu_mod_timer(vd
->timer
, qemu_get_clock(rt_clock
) + vd
->timer_interval
);
2250 static void vnc_init_timer(VncDisplay
*vd
)
2252 vd
->timer_interval
= VNC_REFRESH_INTERVAL_BASE
;
2253 if (vd
->timer
== NULL
&& !QTAILQ_EMPTY(&vd
->clients
)) {
2254 vd
->timer
= qemu_new_timer(rt_clock
, vnc_refresh
, vd
);
2259 static void vnc_remove_timer(VncDisplay
*vd
)
2261 if (vd
->timer
!= NULL
&& QTAILQ_EMPTY(&vd
->clients
)) {
2262 qemu_del_timer(vd
->timer
);
2263 qemu_free_timer(vd
->timer
);
2268 static void vnc_connect(VncDisplay
*vd
, int csock
)
2270 VncState
*vs
= qemu_mallocz(sizeof(VncState
));
2273 VNC_DEBUG("New client on socket %d\n", csock
);
2275 socket_set_nonblock(vs
->csock
);
2276 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
2278 vnc_client_cache_addr(vs
);
2279 vnc_qmp_event(vs
, QEVENT_VNC_CONNECTED
);
2286 vs
->as
.freq
= 44100;
2287 vs
->as
.nchannels
= 2;
2288 vs
->as
.fmt
= AUD_FMT_S16
;
2289 vs
->as
.endianness
= 0;
2291 QTAILQ_INSERT_HEAD(&vd
->clients
, vs
, next
);
2295 vnc_write(vs
, "RFB 003.008\n", 12);
2297 vnc_read_when(vs
, protocol_version
, 12);
2299 if (vs
->vd
->lock_key_sync
)
2300 vs
->led
= qemu_add_led_event_handler(kbd_leds
, vs
);
2302 vs
->mouse_mode_notifier
.notify
= check_pointer_type_change
;
2303 qemu_add_mouse_mode_change_notifier(&vs
->mouse_mode_notifier
);
2307 /* vs might be free()ed here */
2310 static void vnc_listen_read(void *opaque
)
2312 VncDisplay
*vs
= opaque
;
2313 struct sockaddr_in addr
;
2314 socklen_t addrlen
= sizeof(addr
);
2319 int csock
= qemu_accept(vs
->lsock
, (struct sockaddr
*)&addr
, &addrlen
);
2321 vnc_connect(vs
, csock
);
2325 void vnc_display_init(DisplayState
*ds
)
2327 VncDisplay
*vs
= qemu_mallocz(sizeof(*vs
));
2329 dcl
= qemu_mallocz(sizeof(DisplayChangeListener
));
2338 QTAILQ_INIT(&vs
->clients
);
2340 if (keyboard_layout
)
2341 vs
->kbd_layout
= init_keyboard_layout(name2keysym
, keyboard_layout
);
2343 vs
->kbd_layout
= init_keyboard_layout(name2keysym
, "en-us");
2345 if (!vs
->kbd_layout
)
2348 dcl
->dpy_copy
= vnc_dpy_copy
;
2349 dcl
->dpy_update
= vnc_dpy_update
;
2350 dcl
->dpy_resize
= vnc_dpy_resize
;
2351 dcl
->dpy_setdata
= vnc_dpy_setdata
;
2352 register_displaychangelistener(ds
, dcl
);
2353 ds
->mouse_set
= vnc_mouse_set
;
2354 ds
->cursor_define
= vnc_dpy_cursor_define
;
2358 void vnc_display_close(DisplayState
*ds
)
2360 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2365 qemu_free(vs
->display
);
2368 if (vs
->lsock
!= -1) {
2369 qemu_set_fd_handler2(vs
->lsock
, NULL
, NULL
, NULL
, NULL
);
2373 vs
->auth
= VNC_AUTH_INVALID
;
2374 #ifdef CONFIG_VNC_TLS
2375 vs
->subauth
= VNC_AUTH_INVALID
;
2376 vs
->tls
.x509verify
= 0;
2380 int vnc_display_password(DisplayState
*ds
, const char *password
)
2382 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2389 qemu_free(vs
->password
);
2390 vs
->password
= NULL
;
2392 if (password
&& password
[0]) {
2393 if (!(vs
->password
= qemu_strdup(password
)))
2395 if (vs
->auth
== VNC_AUTH_NONE
) {
2396 vs
->auth
= VNC_AUTH_VNC
;
2399 vs
->auth
= VNC_AUTH_NONE
;
2405 char *vnc_display_local_addr(DisplayState
*ds
)
2407 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2409 return vnc_socket_local_addr("%s:%s", vs
->lsock
);
2412 int vnc_display_open(DisplayState
*ds
, const char *display
)
2414 VncDisplay
*vs
= ds
? (VncDisplay
*)ds
->opaque
: vnc_display
;
2415 const char *options
;
2418 #ifdef CONFIG_VNC_TLS
2419 int tls
= 0, x509
= 0;
2421 #ifdef CONFIG_VNC_SASL
2426 int lock_key_sync
= 1;
2430 vnc_display_close(ds
);
2431 if (strcmp(display
, "none") == 0)
2434 if (!(vs
->display
= strdup(display
)))
2438 while ((options
= strchr(options
, ','))) {
2440 if (strncmp(options
, "password", 8) == 0) {
2441 password
= 1; /* Require password auth */
2442 } else if (strncmp(options
, "reverse", 7) == 0) {
2444 } else if (strncmp(options
, "no-lock-key-sync", 9) == 0) {
2446 #ifdef CONFIG_VNC_SASL
2447 } else if (strncmp(options
, "sasl", 4) == 0) {
2448 sasl
= 1; /* Require SASL auth */
2450 #ifdef CONFIG_VNC_TLS
2451 } else if (strncmp(options
, "tls", 3) == 0) {
2452 tls
= 1; /* Require TLS */
2453 } else if (strncmp(options
, "x509", 4) == 0) {
2455 x509
= 1; /* Require x509 certificates */
2456 if (strncmp(options
, "x509verify", 10) == 0)
2457 vs
->tls
.x509verify
= 1; /* ...and verify client certs */
2459 /* Now check for 'x509=/some/path' postfix
2460 * and use that to setup x509 certificate/key paths */
2461 start
= strchr(options
, '=');
2462 end
= strchr(options
, ',');
2463 if (start
&& (!end
|| (start
< end
))) {
2464 int len
= end
? end
-(start
+1) : strlen(start
+1);
2465 char *path
= qemu_strndup(start
+ 1, len
);
2467 VNC_DEBUG("Trying certificate path '%s'\n", path
);
2468 if (vnc_tls_set_x509_creds_dir(vs
, path
) < 0) {
2469 fprintf(stderr
, "Failed to find x509 certificates/keys in %s\n", path
);
2471 qemu_free(vs
->display
);
2477 fprintf(stderr
, "No certificate path provided\n");
2478 qemu_free(vs
->display
);
2483 } else if (strncmp(options
, "acl", 3) == 0) {
2488 #ifdef CONFIG_VNC_TLS
2489 if (acl
&& x509
&& vs
->tls
.x509verify
) {
2490 if (!(vs
->tls
.acl
= qemu_acl_init("vnc.x509dname"))) {
2491 fprintf(stderr
, "Failed to create x509 dname ACL\n");
2496 #ifdef CONFIG_VNC_SASL
2498 if (!(vs
->sasl
.acl
= qemu_acl_init("vnc.username"))) {
2499 fprintf(stderr
, "Failed to create username ACL\n");
2506 * Combinations we support here:
2508 * - no-auth (clear text, no auth)
2509 * - password (clear text, weak auth)
2510 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2511 * - tls (encrypt, weak anonymous creds, no auth)
2512 * - tls + password (encrypt, weak anonymous creds, weak auth)
2513 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2514 * - tls + x509 (encrypt, good x509 creds, no auth)
2515 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2516 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2518 * NB1. TLS is a stackable auth scheme.
2519 * NB2. the x509 schemes have option to validate a client cert dname
2522 #ifdef CONFIG_VNC_TLS
2524 vs
->auth
= VNC_AUTH_VENCRYPT
;
2526 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2527 vs
->subauth
= VNC_AUTH_VENCRYPT_X509VNC
;
2529 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2530 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSVNC
;
2533 #endif /* CONFIG_VNC_TLS */
2534 VNC_DEBUG("Initializing VNC server with password auth\n");
2535 vs
->auth
= VNC_AUTH_VNC
;
2536 #ifdef CONFIG_VNC_TLS
2537 vs
->subauth
= VNC_AUTH_INVALID
;
2539 #endif /* CONFIG_VNC_TLS */
2540 #ifdef CONFIG_VNC_SASL
2542 #ifdef CONFIG_VNC_TLS
2544 vs
->auth
= VNC_AUTH_VENCRYPT
;
2546 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2547 vs
->subauth
= VNC_AUTH_VENCRYPT_X509SASL
;
2549 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2550 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSSASL
;
2553 #endif /* CONFIG_VNC_TLS */
2554 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2555 vs
->auth
= VNC_AUTH_SASL
;
2556 #ifdef CONFIG_VNC_TLS
2557 vs
->subauth
= VNC_AUTH_INVALID
;
2559 #endif /* CONFIG_VNC_TLS */
2560 #endif /* CONFIG_VNC_SASL */
2562 #ifdef CONFIG_VNC_TLS
2564 vs
->auth
= VNC_AUTH_VENCRYPT
;
2566 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2567 vs
->subauth
= VNC_AUTH_VENCRYPT_X509NONE
;
2569 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2570 vs
->subauth
= VNC_AUTH_VENCRYPT_TLSNONE
;
2574 VNC_DEBUG("Initializing VNC server with no auth\n");
2575 vs
->auth
= VNC_AUTH_NONE
;
2576 #ifdef CONFIG_VNC_TLS
2577 vs
->subauth
= VNC_AUTH_INVALID
;
2582 #ifdef CONFIG_VNC_SASL
2583 if ((saslErr
= sasl_server_init(NULL
, "qemu")) != SASL_OK
) {
2584 fprintf(stderr
, "Failed to initialize SASL auth %s",
2585 sasl_errstring(saslErr
, NULL
, NULL
));
2591 vs
->lock_key_sync
= lock_key_sync
;
2594 /* connect to viewer */
2595 if (strncmp(display
, "unix:", 5) == 0)
2596 vs
->lsock
= unix_connect(display
+5);
2598 vs
->lsock
= inet_connect(display
, SOCK_STREAM
);
2599 if (-1 == vs
->lsock
) {
2604 int csock
= vs
->lsock
;
2606 vnc_connect(vs
, csock
);
2611 /* listen for connects */
2613 dpy
= qemu_malloc(256);
2614 if (strncmp(display
, "unix:", 5) == 0) {
2615 pstrcpy(dpy
, 256, "unix:");
2616 vs
->lsock
= unix_listen(display
+5, dpy
+5, 256-5);
2618 vs
->lsock
= inet_listen(display
, dpy
, 256, SOCK_STREAM
, 5900);
2620 if (-1 == vs
->lsock
) {
2628 return qemu_set_fd_handler2(vs
->lsock
, NULL
, vnc_listen_read
, NULL
, vs
);