?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
target-ppc: Extend HWCAP2 bits for ISA 3.0
[qemu/ar7.git] / ui / vnc.c
blobccb1335d8634887f94684413900932ef44694014
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/option.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qapi-events.h"
39 #include "qapi/error.h"
40 #include "qapi/qapi-commands-ui.h"
41 #include "ui/input.h"
42 #include "crypto/hash.h"
43 #include "crypto/tlscredsanon.h"
44 #include "crypto/tlscredsx509.h"
45 #include "qom/object_interfaces.h"
46 #include "qemu/cutils.h"
47 #include "io/dns-resolver.h"
48
49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
50 #define VNC_REFRESH_INTERVAL_INC 50
51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
54
55 #include "vnc_keysym.h"
56 #include "crypto/cipher.h"
57
58 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59 QTAILQ_HEAD_INITIALIZER(vnc_displays);
60
61 static int vnc_cursor_define(VncState *vs);
62 static void vnc_release_modifiers(VncState *vs);
63 static void vnc_update_throttle_offset(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_TYPE_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
134 error_setg(errp, "Unsupported socket address type %s",
135 SocketAddressType_str(addr->type));
136 break;
137 default:
138 abort();
139 }
140
141 return;
142 }
143
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
146 Error **errp)
147 {
148 SocketAddress *addr = NULL;
149
150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
157 return;
158 }
159
160 vnc_init_basic_info(addr, info, errp);
161 qapi_free_SocketAddress(addr);
162 }
163
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
166 Error **errp)
167 {
168 SocketAddress *addr = NULL;
169
170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
172 return;
173 }
174
175 vnc_init_basic_info(addr, info, errp);
176 qapi_free_SocketAddress(addr);
177 }
178
179 static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
217 default:
218 return "vencrypt";
219 }
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228 VncServerInfo *info;
229 Error *err = NULL;
230
231 if (!vd->listener || !vd->listener->nsioc) {
232 return NULL;
233 }
234
235 info = g_malloc0(sizeof(*info));
236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
237 qapi_VncServerInfo_base(info), &err);
238 info->has_auth = true;
239 info->auth = g_strdup(vnc_auth_name(vd));
240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
245 return info;
246 }
247
248 static void vnc_client_cache_auth(VncState *client)
249 {
250 if (!client->info) {
251 return;
252 }
253
254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
259 }
260 #ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
262 client->sasl.username) {
263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
265 }
266 #endif
267 }
268
269 static void vnc_client_cache_addr(VncState *client)
270 {
271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
274 vnc_init_basic_info_from_remote_addr(client->sioc,
275 qapi_VncClientInfo_base(client->info),
276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
281 }
282 }
283
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286 VncServerInfo *si;
287
288 if (!vs->info) {
289 return;
290 }
291
292 si = vnc_server_info_get(vs->vd);
293 if (!si) {
294 return;
295 }
296
297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300 &error_abort);
301 break;
302 case QAPI_EVENT_VNC_INITIALIZED:
303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304 break;
305 case QAPI_EVENT_VNC_DISCONNECTED:
306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307 break;
308 default:
309 break;
310 }
311
312 qapi_free_VncServerInfo(si);
313 }
314
315 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
316 {
317 VncClientInfo *info;
318 Error *err = NULL;
319
320 info = g_malloc0(sizeof(*info));
321
322 vnc_init_basic_info_from_remote_addr(client->sioc,
323 qapi_VncClientInfo_base(info),
324 &err);
325 if (err) {
326 error_free(err);
327 qapi_free_VncClientInfo(info);
328 return NULL;
329 }
330
331 info->websocket = client->websocket;
332
333 if (client->tls) {
334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335 info->has_x509_dname = info->x509_dname != NULL;
336 }
337 #ifdef CONFIG_VNC_SASL
338 if (client->sasl.conn && client->sasl.username) {
339 info->has_sasl_username = true;
340 info->sasl_username = g_strdup(client->sasl.username);
341 }
342 #endif
343
344 return info;
345 }
346
347 static VncDisplay *vnc_display_find(const char *id)
348 {
349 VncDisplay *vd;
350
351 if (id == NULL) {
352 return QTAILQ_FIRST(&vnc_displays);
353 }
354 QTAILQ_FOREACH(vd, &vnc_displays, next) {
355 if (strcmp(id, vd->id) == 0) {
356 return vd;
357 }
358 }
359 return NULL;
360 }
361
362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363 {
364 VncClientInfoList *cinfo, *prev = NULL;
365 VncState *client;
366
367 QTAILQ_FOREACH(client, &vd->clients, next) {
368 cinfo = g_new0(VncClientInfoList, 1);
369 cinfo->value = qmp_query_vnc_client(client);
370 cinfo->next = prev;
371 prev = cinfo;
372 }
373 return prev;
374 }
375
376 VncInfo *qmp_query_vnc(Error **errp)
377 {
378 VncInfo *info = g_malloc0(sizeof(*info));
379 VncDisplay *vd = vnc_display_find(NULL);
380 SocketAddress *addr = NULL;
381
382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
383 info->enabled = false;
384 } else {
385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
389 info->clients = qmp_query_client_list(vd);
390
391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
392 errp);
393 if (!addr) {
394 goto out_error;
395 }
396
397 switch (addr->type) {
398 case SOCKET_ADDRESS_TYPE_INET:
399 info->host = g_strdup(addr->u.inet.host);
400 info->service = g_strdup(addr->u.inet.port);
401 if (addr->u.inet.ipv6) {
402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
408 case SOCKET_ADDRESS_TYPE_UNIX:
409 info->host = g_strdup("");
410 info->service = g_strdup(addr->u.q_unix.path);
411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
414 case SOCKET_ADDRESS_TYPE_VSOCK:
415 case SOCKET_ADDRESS_TYPE_FD:
416 error_setg(errp, "Unsupported socket address type %s",
417 SocketAddressType_str(addr->type));
418 goto out_error;
419 default:
420 abort();
421 }
422
423 info->has_host = true;
424 info->has_service = true;
425 info->has_family = true;
426
427 info->has_auth = true;
428 info->auth = g_strdup(vnc_auth_name(vd));
429 }
430
431 qapi_free_SocketAddress(addr);
432 return info;
433
434 out_error:
435 qapi_free_SocketAddress(addr);
436 qapi_free_VncInfo(info);
437 return NULL;
438 }
439
440
441 static void qmp_query_auth(int auth, int subauth,
442 VncPrimaryAuth *qmp_auth,
443 VncVencryptSubAuth *qmp_vencrypt,
444 bool *qmp_has_vencrypt);
445
446 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
447 bool websocket,
448 int auth,
449 int subauth,
450 VncServerInfo2List *prev)
451 {
452 VncServerInfo2List *list;
453 VncServerInfo2 *info;
454 Error *err = NULL;
455 SocketAddress *addr;
456
457 addr = qio_channel_socket_get_local_address(ioc, &err);
458 if (!addr) {
459 error_free(err);
460 return prev;
461 }
462
463 info = g_new0(VncServerInfo2, 1);
464 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
465 qapi_free_SocketAddress(addr);
466 if (err) {
467 qapi_free_VncServerInfo2(info);
468 error_free(err);
469 return prev;
470 }
471 info->websocket = websocket;
472
473 qmp_query_auth(auth, subauth, &info->auth,
474 &info->vencrypt, &info->has_vencrypt);
475
476 list = g_new0(VncServerInfo2List, 1);
477 list->value = info;
478 list->next = prev;
479 return list;
480 }
481
482 static void qmp_query_auth(int auth, int subauth,
483 VncPrimaryAuth *qmp_auth,
484 VncVencryptSubAuth *qmp_vencrypt,
485 bool *qmp_has_vencrypt)
486 {
487 switch (auth) {
488 case VNC_AUTH_VNC:
489 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
490 break;
491 case VNC_AUTH_RA2:
492 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
493 break;
494 case VNC_AUTH_RA2NE:
495 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
496 break;
497 case VNC_AUTH_TIGHT:
498 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
499 break;
500 case VNC_AUTH_ULTRA:
501 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
502 break;
503 case VNC_AUTH_TLS:
504 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
505 break;
506 case VNC_AUTH_VENCRYPT:
507 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
508 *qmp_has_vencrypt = true;
509 switch (subauth) {
510 case VNC_AUTH_VENCRYPT_PLAIN:
511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
512 break;
513 case VNC_AUTH_VENCRYPT_TLSNONE:
514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
515 break;
516 case VNC_AUTH_VENCRYPT_TLSVNC:
517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
518 break;
519 case VNC_AUTH_VENCRYPT_TLSPLAIN:
520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
521 break;
522 case VNC_AUTH_VENCRYPT_X509NONE:
523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
524 break;
525 case VNC_AUTH_VENCRYPT_X509VNC:
526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
527 break;
528 case VNC_AUTH_VENCRYPT_X509PLAIN:
529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
530 break;
531 case VNC_AUTH_VENCRYPT_TLSSASL:
532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
533 break;
534 case VNC_AUTH_VENCRYPT_X509SASL:
535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
536 break;
537 default:
538 *qmp_has_vencrypt = false;
539 break;
540 }
541 break;
542 case VNC_AUTH_SASL:
543 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
544 break;
545 case VNC_AUTH_NONE:
546 default:
547 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
548 break;
549 }
550 }
551
552 VncInfo2List *qmp_query_vnc_servers(Error **errp)
553 {
554 VncInfo2List *item, *prev = NULL;
555 VncInfo2 *info;
556 VncDisplay *vd;
557 DeviceState *dev;
558 size_t i;
559
560 QTAILQ_FOREACH(vd, &vnc_displays, next) {
561 info = g_new0(VncInfo2, 1);
562 info->id = g_strdup(vd->id);
563 info->clients = qmp_query_client_list(vd);
564 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
565 &info->vencrypt, &info->has_vencrypt);
566 if (vd->dcl.con) {
567 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
568 "device", NULL));
569 info->has_display = true;
570 info->display = g_strdup(dev->id);
571 }
572 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
573 info->server = qmp_query_server_entry(
574 vd->listener->sioc[i], false, vd->auth, vd->subauth,
575 info->server);
576 }
577 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
578 info->server = qmp_query_server_entry(
579 vd->wslistener->sioc[i], true, vd->ws_auth,
580 vd->ws_subauth, info->server);
581 }
582
583 item = g_new0(VncInfo2List, 1);
584 item->value = info;
585 item->next = prev;
586 prev = item;
587 }
588 return prev;
589 }
590
591 /* TODO
592 1) Get the queue working for IO.
593 2) there is some weirdness when using the -S option (the screen is grey
594 and not totally invalidated
595 3) resolutions > 1024
596 */
597
598 static int vnc_update_client(VncState *vs, int has_dirty);
599 static void vnc_disconnect_start(VncState *vs);
600
601 static void vnc_colordepth(VncState *vs);
602 static void framebuffer_update_request(VncState *vs, int incremental,
603 int x_position, int y_position,
604 int w, int h);
605 static void vnc_refresh(DisplayChangeListener *dcl);
606 static int vnc_refresh_server_surface(VncDisplay *vd);
607
608 static int vnc_width(VncDisplay *vd)
609 {
610 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
611 VNC_DIRTY_PIXELS_PER_BIT));
612 }
613
614 static int vnc_height(VncDisplay *vd)
615 {
616 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
617 }
618
619 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
620 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
621 VncDisplay *vd,
622 int x, int y, int w, int h)
623 {
624 int width = vnc_width(vd);
625 int height = vnc_height(vd);
626
627 /* this is needed this to ensure we updated all affected
628 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
629 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
630 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
631
632 x = MIN(x, width);
633 y = MIN(y, height);
634 w = MIN(x + w, width) - x;
635 h = MIN(y + h, height);
636
637 for (; y < h; y++) {
638 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
639 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
640 }
641 }
642
643 static void vnc_dpy_update(DisplayChangeListener *dcl,
644 int x, int y, int w, int h)
645 {
646 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
647 struct VncSurface *s = &vd->guest;
648
649 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
650 }
651
652 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
653 int32_t encoding)
654 {
655 vnc_write_u16(vs, x);
656 vnc_write_u16(vs, y);
657 vnc_write_u16(vs, w);
658 vnc_write_u16(vs, h);
659
660 vnc_write_s32(vs, encoding);
661 }
662
663
664 static void vnc_desktop_resize(VncState *vs)
665 {
666 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
667 return;
668 }
669 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
670 vs->client_height == pixman_image_get_height(vs->vd->server)) {
671 return;
672 }
673
674 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
675 pixman_image_get_width(vs->vd->server) >= 0);
676 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
677 pixman_image_get_height(vs->vd->server) >= 0);
678 vs->client_width = pixman_image_get_width(vs->vd->server);
679 vs->client_height = pixman_image_get_height(vs->vd->server);
680 vnc_lock_output(vs);
681 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
682 vnc_write_u8(vs, 0);
683 vnc_write_u16(vs, 1); /* number of rects */
684 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
685 VNC_ENCODING_DESKTOPRESIZE);
686 vnc_unlock_output(vs);
687 vnc_flush(vs);
688 }
689
690 static void vnc_abort_display_jobs(VncDisplay *vd)
691 {
692 VncState *vs;
693
694 QTAILQ_FOREACH(vs, &vd->clients, next) {
695 vnc_lock_output(vs);
696 vs->abort = true;
697 vnc_unlock_output(vs);
698 }
699 QTAILQ_FOREACH(vs, &vd->clients, next) {
700 vnc_jobs_join(vs);
701 }
702 QTAILQ_FOREACH(vs, &vd->clients, next) {
703 vnc_lock_output(vs);
704 vs->abort = false;
705 vnc_unlock_output(vs);
706 }
707 }
708
709 int vnc_server_fb_stride(VncDisplay *vd)
710 {
711 return pixman_image_get_stride(vd->server);
712 }
713
714 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
715 {
716 uint8_t *ptr;
717
718 ptr = (uint8_t *)pixman_image_get_data(vd->server);
719 ptr += y * vnc_server_fb_stride(vd);
720 ptr += x * VNC_SERVER_FB_BYTES;
721 return ptr;
722 }
723
724 static void vnc_update_server_surface(VncDisplay *vd)
725 {
726 int width, height;
727
728 qemu_pixman_image_unref(vd->server);
729 vd->server = NULL;
730
731 if (QTAILQ_EMPTY(&vd->clients)) {
732 return;
733 }
734
735 width = vnc_width(vd);
736 height = vnc_height(vd);
737 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
738 width, height,
739 NULL, 0);
740
741 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
742 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
743 width, height);
744 }
745
746 static void vnc_dpy_switch(DisplayChangeListener *dcl,
747 DisplaySurface *surface)
748 {
749 static const char placeholder_msg[] =
750 "Display output is not active.";
751 static DisplaySurface *placeholder;
752 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
753 VncState *vs;
754
755 if (surface == NULL) {
756 if (placeholder == NULL) {
757 placeholder = qemu_create_message_surface(640, 480, placeholder_msg);
758 }
759 surface = placeholder;
760 }
761
762 vnc_abort_display_jobs(vd);
763 vd->ds = surface;
764
765 /* server surface */
766 vnc_update_server_surface(vd);
767
768 /* guest surface */
769 qemu_pixman_image_unref(vd->guest.fb);
770 vd->guest.fb = pixman_image_ref(surface->image);
771 vd->guest.format = surface->format;
772
773 QTAILQ_FOREACH(vs, &vd->clients, next) {
774 vnc_colordepth(vs);
775 vnc_desktop_resize(vs);
776 if (vs->vd->cursor) {
777 vnc_cursor_define(vs);
778 }
779 memset(vs->dirty, 0x00, sizeof(vs->dirty));
780 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
781 vnc_width(vd),
782 vnc_height(vd));
783 vnc_update_throttle_offset(vs);
784 }
785 }
786
787 /* fastest code */
788 static void vnc_write_pixels_copy(VncState *vs,
789 void *pixels, int size)
790 {
791 vnc_write(vs, pixels, size);
792 }
793
794 /* slowest but generic code. */
795 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
796 {
797 uint8_t r, g, b;
798
799 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
800 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
801 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
802 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
803 #else
804 # error need some bits here if you change VNC_SERVER_FB_FORMAT
805 #endif
806 v = (r << vs->client_pf.rshift) |
807 (g << vs->client_pf.gshift) |
808 (b << vs->client_pf.bshift);
809 switch (vs->client_pf.bytes_per_pixel) {
810 case 1:
811 buf[0] = v;
812 break;
813 case 2:
814 if (vs->client_be) {
815 buf[0] = v >> 8;
816 buf[1] = v;
817 } else {
818 buf[1] = v >> 8;
819 buf[0] = v;
820 }
821 break;
822 default:
823 case 4:
824 if (vs->client_be) {
825 buf[0] = v >> 24;
826 buf[1] = v >> 16;
827 buf[2] = v >> 8;
828 buf[3] = v;
829 } else {
830 buf[3] = v >> 24;
831 buf[2] = v >> 16;
832 buf[1] = v >> 8;
833 buf[0] = v;
834 }
835 break;
836 }
837 }
838
839 static void vnc_write_pixels_generic(VncState *vs,
840 void *pixels1, int size)
841 {
842 uint8_t buf[4];
843
844 if (VNC_SERVER_FB_BYTES == 4) {
845 uint32_t *pixels = pixels1;
846 int n, i;
847 n = size >> 2;
848 for (i = 0; i < n; i++) {
849 vnc_convert_pixel(vs, buf, pixels[i]);
850 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
851 }
852 }
853 }
854
855 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
856 {
857 int i;
858 uint8_t *row;
859 VncDisplay *vd = vs->vd;
860
861 row = vnc_server_fb_ptr(vd, x, y);
862 for (i = 0; i < h; i++) {
863 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
864 row += vnc_server_fb_stride(vd);
865 }
866 return 1;
867 }
868
869 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
870 {
871 int n = 0;
872 bool encode_raw = false;
873 size_t saved_offs = vs->output.offset;
874
875 switch(vs->vnc_encoding) {
876 case VNC_ENCODING_ZLIB:
877 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
878 break;
879 case VNC_ENCODING_HEXTILE:
880 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
881 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
882 break;
883 case VNC_ENCODING_TIGHT:
884 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
885 break;
886 case VNC_ENCODING_TIGHT_PNG:
887 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
888 break;
889 case VNC_ENCODING_ZRLE:
890 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
891 break;
892 case VNC_ENCODING_ZYWRLE:
893 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
894 break;
895 default:
896 encode_raw = true;
897 break;
898 }
899
900 /* If the client has the same pixel format as our internal buffer and
901 * a RAW encoding would need less space fall back to RAW encoding to
902 * save bandwidth and processing power in the client. */
903 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
904 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
905 vs->output.offset = saved_offs;
906 encode_raw = true;
907 }
908
909 if (encode_raw) {
910 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
911 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
912 }
913
914 return n;
915 }
916
917 static void vnc_mouse_set(DisplayChangeListener *dcl,
918 int x, int y, int visible)
919 {
920 /* can we ask the client(s) to move the pointer ??? */
921 }
922
923 static int vnc_cursor_define(VncState *vs)
924 {
925 QEMUCursor *c = vs->vd->cursor;
926 int isize;
927
928 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
929 vnc_lock_output(vs);
930 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
931 vnc_write_u8(vs, 0); /* padding */
932 vnc_write_u16(vs, 1); /* # of rects */
933 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
934 VNC_ENCODING_RICH_CURSOR);
935 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
936 vnc_write_pixels_generic(vs, c->data, isize);
937 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
938 vnc_unlock_output(vs);
939 return 0;
940 }
941 return -1;
942 }
943
944 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
945 QEMUCursor *c)
946 {
947 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
948 VncState *vs;
949
950 cursor_put(vd->cursor);
951 g_free(vd->cursor_mask);
952
953 vd->cursor = c;
954 cursor_get(vd->cursor);
955 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
956 vd->cursor_mask = g_malloc0(vd->cursor_msize);
957 cursor_get_mono_mask(c, 0, vd->cursor_mask);
958
959 QTAILQ_FOREACH(vs, &vd->clients, next) {
960 vnc_cursor_define(vs);
961 }
962 }
963
964 static int find_and_clear_dirty_height(VncState *vs,
965 int y, int last_x, int x, int height)
966 {
967 int h;
968
969 for (h = 1; h < (height - y); h++) {
970 if (!test_bit(last_x, vs->dirty[y + h])) {
971 break;
972 }
973 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
974 }
975
976 return h;
977 }
978
979 /*
980 * Figure out how much pending data we should allow in the output
981 * buffer before we throttle incremental display updates, and/or
982 * drop audio samples.
983 *
984 * We allow for equiv of 1 full display's worth of FB updates,
985 * and 1 second of audio samples. If audio backlog was larger
986 * than that the client would already suffering awful audio
987 * glitches, so dropping samples is no worse really).
988 */
989 static void vnc_update_throttle_offset(VncState *vs)
990 {
991 size_t offset =
992 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
993
994 if (vs->audio_cap) {
995 int bps;
996 switch (vs->as.fmt) {
997 default:
998 case AUD_FMT_U8:
999 case AUD_FMT_S8:
1000 bps = 1;
1001 break;
1002 case AUD_FMT_U16:
1003 case AUD_FMT_S16:
1004 bps = 2;
1005 break;
1006 case AUD_FMT_U32:
1007 case AUD_FMT_S32:
1008 bps = 4;
1009 break;
1010 }
1011 offset += vs->as.freq * bps * vs->as.nchannels;
1012 }
1013
1014 /* Put a floor of 1MB on offset, so that if we have a large pending
1015 * buffer and the display is resized to a small size & back again
1016 * we don't suddenly apply a tiny send limit
1017 */
1018 offset = MAX(offset, 1024 * 1024);
1019
1020 if (vs->throttle_output_offset != offset) {
1021 trace_vnc_client_throttle_threshold(
1022 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1023 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1024 }
1025
1026 vs->throttle_output_offset = offset;
1027 }
1028
1029 static bool vnc_should_update(VncState *vs)
1030 {
1031 switch (vs->update) {
1032 case VNC_STATE_UPDATE_NONE:
1033 break;
1034 case VNC_STATE_UPDATE_INCREMENTAL:
1035 /* Only allow incremental updates if the pending send queue
1036 * is less than the permitted threshold, and the job worker
1037 * is completely idle.
1038 */
1039 if (vs->output.offset < vs->throttle_output_offset &&
1040 vs->job_update == VNC_STATE_UPDATE_NONE) {
1041 return true;
1042 }
1043 trace_vnc_client_throttle_incremental(
1044 vs, vs->ioc, vs->job_update, vs->output.offset);
1045 break;
1046 case VNC_STATE_UPDATE_FORCE:
1047 /* Only allow forced updates if the pending send queue
1048 * does not contain a previous forced update, and the
1049 * job worker is completely idle.
1050 *
1051 * Note this means we'll queue a forced update, even if
1052 * the output buffer size is otherwise over the throttle
1053 * output limit.
1054 */
1055 if (vs->force_update_offset == 0 &&
1056 vs->job_update == VNC_STATE_UPDATE_NONE) {
1057 return true;
1058 }
1059 trace_vnc_client_throttle_forced(
1060 vs, vs->ioc, vs->job_update, vs->force_update_offset);
1061 break;
1062 }
1063 return false;
1064 }
1065
1066 static int vnc_update_client(VncState *vs, int has_dirty)
1067 {
1068 VncDisplay *vd = vs->vd;
1069 VncJob *job;
1070 int y;
1071 int height, width;
1072 int n = 0;
1073
1074 if (vs->disconnecting) {
1075 vnc_disconnect_finish(vs);
1076 return 0;
1077 }
1078
1079 vs->has_dirty += has_dirty;
1080 if (!vnc_should_update(vs)) {
1081 return 0;
1082 }
1083
1084 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1085 return 0;
1086 }
1087
1088 /*
1089 * Send screen updates to the vnc client using the server
1090 * surface and server dirty map. guest surface updates
1091 * happening in parallel don't disturb us, the next pass will
1092 * send them to the client.
1093 */
1094 job = vnc_job_new(vs);
1095
1096 height = pixman_image_get_height(vd->server);
1097 width = pixman_image_get_width(vd->server);
1098
1099 y = 0;
1100 for (;;) {
1101 int x, h;
1102 unsigned long x2;
1103 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1104 height * VNC_DIRTY_BPL(vs),
1105 y * VNC_DIRTY_BPL(vs));
1106 if (offset == height * VNC_DIRTY_BPL(vs)) {
1107 /* no more dirty bits */
1108 break;
1109 }
1110 y = offset / VNC_DIRTY_BPL(vs);
1111 x = offset % VNC_DIRTY_BPL(vs);
1112 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1113 VNC_DIRTY_BPL(vs), x);
1114 bitmap_clear(vs->dirty[y], x, x2 - x);
1115 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1116 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1117 if (x2 > x) {
1118 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1119 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1120 }
1121 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1122 y += h;
1123 if (y == height) {
1124 break;
1125 }
1126 }
1127 }
1128
1129 vs->job_update = vs->update;
1130 vs->update = VNC_STATE_UPDATE_NONE;
1131 vnc_job_push(job);
1132 vs->has_dirty = 0;
1133 return n;
1134 }
1135
1136 /* audio */
1137 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1138 {
1139 VncState *vs = opaque;
1140
1141 assert(vs->magic == VNC_MAGIC);
1142 switch (cmd) {
1143 case AUD_CNOTIFY_DISABLE:
1144 vnc_lock_output(vs);
1145 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1146 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1147 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1148 vnc_unlock_output(vs);
1149 vnc_flush(vs);
1150 break;
1151
1152 case AUD_CNOTIFY_ENABLE:
1153 vnc_lock_output(vs);
1154 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1155 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1156 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1157 vnc_unlock_output(vs);
1158 vnc_flush(vs);
1159 break;
1160 }
1161 }
1162
1163 static void audio_capture_destroy(void *opaque)
1164 {
1165 }
1166
1167 static void audio_capture(void *opaque, void *buf, int size)
1168 {
1169 VncState *vs = opaque;
1170
1171 assert(vs->magic == VNC_MAGIC);
1172 vnc_lock_output(vs);
1173 if (vs->output.offset < vs->throttle_output_offset) {
1174 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1175 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1176 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1177 vnc_write_u32(vs, size);
1178 vnc_write(vs, buf, size);
1179 } else {
1180 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1181 }
1182 vnc_unlock_output(vs);
1183 vnc_flush(vs);
1184 }
1185
1186 static void audio_add(VncState *vs)
1187 {
1188 struct audio_capture_ops ops;
1189
1190 if (vs->audio_cap) {
1191 error_report("audio already running");
1192 return;
1193 }
1194
1195 ops.notify = audio_capture_notify;
1196 ops.destroy = audio_capture_destroy;
1197 ops.capture = audio_capture;
1198
1199 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1200 if (!vs->audio_cap) {
1201 error_report("Failed to add audio capture");
1202 }
1203 }
1204
1205 static void audio_del(VncState *vs)
1206 {
1207 if (vs->audio_cap) {
1208 AUD_del_capture(vs->audio_cap, vs);
1209 vs->audio_cap = NULL;
1210 }
1211 }
1212
1213 static void vnc_disconnect_start(VncState *vs)
1214 {
1215 if (vs->disconnecting) {
1216 return;
1217 }
1218 trace_vnc_client_disconnect_start(vs, vs->ioc);
1219 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1220 if (vs->ioc_tag) {
1221 g_source_remove(vs->ioc_tag);
1222 vs->ioc_tag = 0;
1223 }
1224 qio_channel_close(vs->ioc, NULL);
1225 vs->disconnecting = TRUE;
1226 }
1227
1228 void vnc_disconnect_finish(VncState *vs)
1229 {
1230 int i;
1231
1232 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1233
1234 vnc_jobs_join(vs); /* Wait encoding jobs */
1235
1236 vnc_lock_output(vs);
1237 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1238
1239 buffer_free(&vs->input);
1240 buffer_free(&vs->output);
1241
1242 qapi_free_VncClientInfo(vs->info);
1243
1244 vnc_zlib_clear(vs);
1245 vnc_tight_clear(vs);
1246 vnc_zrle_clear(vs);
1247
1248 #ifdef CONFIG_VNC_SASL
1249 vnc_sasl_client_cleanup(vs);
1250 #endif /* CONFIG_VNC_SASL */
1251 audio_del(vs);
1252 vnc_release_modifiers(vs);
1253
1254 if (vs->mouse_mode_notifier.notify != NULL) {
1255 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1256 }
1257 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1258 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1259 /* last client gone */
1260 vnc_update_server_surface(vs->vd);
1261 }
1262
1263 vnc_unlock_output(vs);
1264
1265 qemu_mutex_destroy(&vs->output_mutex);
1266 if (vs->bh != NULL) {
1267 qemu_bh_delete(vs->bh);
1268 }
1269 buffer_free(&vs->jobs_buffer);
1270
1271 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1272 g_free(vs->lossy_rect[i]);
1273 }
1274 g_free(vs->lossy_rect);
1275
1276 object_unref(OBJECT(vs->ioc));
1277 vs->ioc = NULL;
1278 object_unref(OBJECT(vs->sioc));
1279 vs->sioc = NULL;
1280 vs->magic = 0;
1281 g_free(vs);
1282 }
1283
1284 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1285 {
1286 if (ret <= 0) {
1287 if (ret == 0) {
1288 trace_vnc_client_eof(vs, vs->ioc);
1289 vnc_disconnect_start(vs);
1290 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1291 trace_vnc_client_io_error(vs, vs->ioc,
1292 errp ? error_get_pretty(*errp) :
1293 "Unknown");
1294 vnc_disconnect_start(vs);
1295 }
1296
1297 if (errp) {
1298 error_free(*errp);
1299 *errp = NULL;
1300 }
1301 return 0;
1302 }
1303 return ret;
1304 }
1305
1306
1307 void vnc_client_error(VncState *vs)
1308 {
1309 VNC_DEBUG("Closing down client sock: protocol error\n");
1310 vnc_disconnect_start(vs);
1311 }
1312
1313
1314 /*
1315 * Called to write a chunk of data to the client socket. The data may
1316 * be the raw data, or may have already been encoded by SASL.
1317 * The data will be written either straight onto the socket, or
1318 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1319 *
1320 * NB, it is theoretically possible to have 2 layers of encryption,
1321 * both SASL, and this TLS layer. It is highly unlikely in practice
1322 * though, since SASL encryption will typically be a no-op if TLS
1323 * is active
1324 *
1325 * Returns the number of bytes written, which may be less than
1326 * the requested 'datalen' if the socket would block. Returns
1327 * 0 on I/O error, and disconnects the client socket.
1328 */
1329 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1330 {
1331 Error *err = NULL;
1332 ssize_t ret;
1333 ret = qio_channel_write(
1334 vs->ioc, (const char *)data, datalen, &err);
1335 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1336 return vnc_client_io_error(vs, ret, &err);
1337 }
1338
1339
1340 /*
1341 * Called to write buffered data to the client socket, when not
1342 * using any SASL SSF encryption layers. Will write as much data
1343 * as possible without blocking. If all buffered data is written,
1344 * will switch the FD poll() handler back to read monitoring.
1345 *
1346 * Returns the number of bytes written, which may be less than
1347 * the buffered output data if the socket would block. Returns
1348 * 0 on I/O error, and disconnects the client socket.
1349 */
1350 static size_t vnc_client_write_plain(VncState *vs)
1351 {
1352 size_t offset;
1353 size_t ret;
1354
1355 #ifdef CONFIG_VNC_SASL
1356 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1357 vs->output.buffer, vs->output.capacity, vs->output.offset,
1358 vs->sasl.waitWriteSSF);
1359
1360 if (vs->sasl.conn &&
1361 vs->sasl.runSSF &&
1362 vs->sasl.waitWriteSSF) {
1363 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1364 if (ret)
1365 vs->sasl.waitWriteSSF -= ret;
1366 } else
1367 #endif /* CONFIG_VNC_SASL */
1368 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1369 if (!ret)
1370 return 0;
1371
1372 if (ret >= vs->force_update_offset) {
1373 if (vs->force_update_offset != 0) {
1374 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1375 }
1376 vs->force_update_offset = 0;
1377 } else {
1378 vs->force_update_offset -= ret;
1379 }
1380 offset = vs->output.offset;
1381 buffer_advance(&vs->output, ret);
1382 if (offset >= vs->throttle_output_offset &&
1383 vs->output.offset < vs->throttle_output_offset) {
1384 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1385 }
1386
1387 if (vs->output.offset == 0) {
1388 if (vs->ioc_tag) {
1389 g_source_remove(vs->ioc_tag);
1390 }
1391 vs->ioc_tag = qio_channel_add_watch(
1392 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1393 }
1394
1395 return ret;
1396 }
1397
1398
1399 /*
1400 * First function called whenever there is data to be written to
1401 * the client socket. Will delegate actual work according to whether
1402 * SASL SSF layers are enabled (thus requiring encryption calls)
1403 */
1404 static void vnc_client_write_locked(VncState *vs)
1405 {
1406 #ifdef CONFIG_VNC_SASL
1407 if (vs->sasl.conn &&
1408 vs->sasl.runSSF &&
1409 !vs->sasl.waitWriteSSF) {
1410 vnc_client_write_sasl(vs);
1411 } else
1412 #endif /* CONFIG_VNC_SASL */
1413 {
1414 vnc_client_write_plain(vs);
1415 }
1416 }
1417
1418 static void vnc_client_write(VncState *vs)
1419 {
1420 assert(vs->magic == VNC_MAGIC);
1421 vnc_lock_output(vs);
1422 if (vs->output.offset) {
1423 vnc_client_write_locked(vs);
1424 } else if (vs->ioc != NULL) {
1425 if (vs->ioc_tag) {
1426 g_source_remove(vs->ioc_tag);
1427 }
1428 vs->ioc_tag = qio_channel_add_watch(
1429 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1430 }
1431 vnc_unlock_output(vs);
1432 }
1433
1434 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1435 {
1436 vs->read_handler = func;
1437 vs->read_handler_expect = expecting;
1438 }
1439
1440
1441 /*
1442 * Called to read a chunk of data from the client socket. The data may
1443 * be the raw data, or may need to be further decoded by SASL.
1444 * The data will be read either straight from to the socket, or
1445 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1446 *
1447 * NB, it is theoretically possible to have 2 layers of encryption,
1448 * both SASL, and this TLS layer. It is highly unlikely in practice
1449 * though, since SASL encryption will typically be a no-op if TLS
1450 * is active
1451 *
1452 * Returns the number of bytes read, which may be less than
1453 * the requested 'datalen' if the socket would block. Returns
1454 * 0 on I/O error or EOF, and disconnects the client socket.
1455 */
1456 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1457 {
1458 ssize_t ret;
1459 Error *err = NULL;
1460 ret = qio_channel_read(
1461 vs->ioc, (char *)data, datalen, &err);
1462 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1463 return vnc_client_io_error(vs, ret, &err);
1464 }
1465
1466
1467 /*
1468 * Called to read data from the client socket to the input buffer,
1469 * when not using any SASL SSF encryption layers. Will read as much
1470 * data as possible without blocking.
1471 *
1472 * Returns the number of bytes read, which may be less than
1473 * the requested 'datalen' if the socket would block. Returns
1474 * 0 on I/O error or EOF, and disconnects the client socket.
1475 */
1476 static size_t vnc_client_read_plain(VncState *vs)
1477 {
1478 size_t ret;
1479 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1480 vs->input.buffer, vs->input.capacity, vs->input.offset);
1481 buffer_reserve(&vs->input, 4096);
1482 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1483 if (!ret)
1484 return 0;
1485 vs->input.offset += ret;
1486 return ret;
1487 }
1488
1489 static void vnc_jobs_bh(void *opaque)
1490 {
1491 VncState *vs = opaque;
1492
1493 assert(vs->magic == VNC_MAGIC);
1494 vnc_jobs_consume_buffer(vs);
1495 }
1496
1497 /*
1498 * First function called whenever there is more data to be read from
1499 * the client socket. Will delegate actual work according to whether
1500 * SASL SSF layers are enabled (thus requiring decryption calls)
1501 * Returns 0 on success, -1 if client disconnected
1502 */
1503 static int vnc_client_read(VncState *vs)
1504 {
1505 size_t ret;
1506
1507 #ifdef CONFIG_VNC_SASL
1508 if (vs->sasl.conn && vs->sasl.runSSF)
1509 ret = vnc_client_read_sasl(vs);
1510 else
1511 #endif /* CONFIG_VNC_SASL */
1512 ret = vnc_client_read_plain(vs);
1513 if (!ret) {
1514 if (vs->disconnecting) {
1515 vnc_disconnect_finish(vs);
1516 return -1;
1517 }
1518 return 0;
1519 }
1520
1521 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1522 size_t len = vs->read_handler_expect;
1523 int ret;
1524
1525 ret = vs->read_handler(vs, vs->input.buffer, len);
1526 if (vs->disconnecting) {
1527 vnc_disconnect_finish(vs);
1528 return -1;
1529 }
1530
1531 if (!ret) {
1532 buffer_advance(&vs->input, len);
1533 } else {
1534 vs->read_handler_expect = ret;
1535 }
1536 }
1537 return 0;
1538 }
1539
1540 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1541 GIOCondition condition, void *opaque)
1542 {
1543 VncState *vs = opaque;
1544
1545 assert(vs->magic == VNC_MAGIC);
1546 if (condition & G_IO_IN) {
1547 if (vnc_client_read(vs) < 0) {
1548 /* vs is free()ed here */
1549 return TRUE;
1550 }
1551 }
1552 if (condition & G_IO_OUT) {
1553 vnc_client_write(vs);
1554 }
1555
1556 if (vs->disconnecting) {
1557 if (vs->ioc_tag != 0) {
1558 g_source_remove(vs->ioc_tag);
1559 }
1560 vs->ioc_tag = 0;
1561 }
1562 return TRUE;
1563 }
1564
1565
1566 /*
1567 * Scale factor to apply to vs->throttle_output_offset when checking for
1568 * hard limit. Worst case normal usage could be x2, if we have a complete
1569 * incremental update and complete forced update in the output buffer.
1570 * So x3 should be good enough, but we pick x5 to be conservative and thus
1571 * (hopefully) never trigger incorrectly.
1572 */
1573 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1574
1575 void vnc_write(VncState *vs, const void *data, size_t len)
1576 {
1577 assert(vs->magic == VNC_MAGIC);
1578 if (vs->disconnecting) {
1579 return;
1580 }
1581 /* Protection against malicious client/guest to prevent our output
1582 * buffer growing without bound if client stops reading data. This
1583 * should rarely trigger, because we have earlier throttling code
1584 * which stops issuing framebuffer updates and drops audio data
1585 * if the throttle_output_offset value is exceeded. So we only reach
1586 * this higher level if a huge number of pseudo-encodings get
1587 * triggered while data can't be sent on the socket.
1588 *
1589 * NB throttle_output_offset can be zero during early protocol
1590 * handshake, or from the job thread's VncState clone
1591 */
1592 if (vs->throttle_output_offset != 0 &&
1593 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1594 vs->throttle_output_offset) {
1595 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1596 vs->throttle_output_offset);
1597 vnc_disconnect_start(vs);
1598 return;
1599 }
1600 buffer_reserve(&vs->output, len);
1601
1602 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1603 if (vs->ioc_tag) {
1604 g_source_remove(vs->ioc_tag);
1605 }
1606 vs->ioc_tag = qio_channel_add_watch(
1607 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1608 }
1609
1610 buffer_append(&vs->output, data, len);
1611 }
1612
1613 void vnc_write_s32(VncState *vs, int32_t value)
1614 {
1615 vnc_write_u32(vs, *(uint32_t *)&value);
1616 }
1617
1618 void vnc_write_u32(VncState *vs, uint32_t value)
1619 {
1620 uint8_t buf[4];
1621
1622 buf[0] = (value >> 24) & 0xFF;
1623 buf[1] = (value >> 16) & 0xFF;
1624 buf[2] = (value >> 8) & 0xFF;
1625 buf[3] = value & 0xFF;
1626
1627 vnc_write(vs, buf, 4);
1628 }
1629
1630 void vnc_write_u16(VncState *vs, uint16_t value)
1631 {
1632 uint8_t buf[2];
1633
1634 buf[0] = (value >> 8) & 0xFF;
1635 buf[1] = value & 0xFF;
1636
1637 vnc_write(vs, buf, 2);
1638 }
1639
1640 void vnc_write_u8(VncState *vs, uint8_t value)
1641 {
1642 vnc_write(vs, (char *)&value, 1);
1643 }
1644
1645 void vnc_flush(VncState *vs)
1646 {
1647 vnc_lock_output(vs);
1648 if (vs->ioc != NULL && vs->output.offset) {
1649 vnc_client_write_locked(vs);
1650 }
1651 if (vs->disconnecting) {
1652 if (vs->ioc_tag != 0) {
1653 g_source_remove(vs->ioc_tag);
1654 }
1655 vs->ioc_tag = 0;
1656 }
1657 vnc_unlock_output(vs);
1658 }
1659
1660 static uint8_t read_u8(uint8_t *data, size_t offset)
1661 {
1662 return data[offset];
1663 }
1664
1665 static uint16_t read_u16(uint8_t *data, size_t offset)
1666 {
1667 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1668 }
1669
1670 static int32_t read_s32(uint8_t *data, size_t offset)
1671 {
1672 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1673 (data[offset + 2] << 8) | data[offset + 3]);
1674 }
1675
1676 uint32_t read_u32(uint8_t *data, size_t offset)
1677 {
1678 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1679 (data[offset + 2] << 8) | data[offset + 3]);
1680 }
1681
1682 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1683 {
1684 }
1685
1686 static void check_pointer_type_change(Notifier *notifier, void *data)
1687 {
1688 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1689 int absolute = qemu_input_is_absolute();
1690
1691 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1692 vnc_lock_output(vs);
1693 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1694 vnc_write_u8(vs, 0);
1695 vnc_write_u16(vs, 1);
1696 vnc_framebuffer_update(vs, absolute, 0,
1697 pixman_image_get_width(vs->vd->server),
1698 pixman_image_get_height(vs->vd->server),
1699 VNC_ENCODING_POINTER_TYPE_CHANGE);
1700 vnc_unlock_output(vs);
1701 vnc_flush(vs);
1702 }
1703 vs->absolute = absolute;
1704 }
1705
1706 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1707 {
1708 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1709 [INPUT_BUTTON_LEFT] = 0x01,
1710 [INPUT_BUTTON_MIDDLE] = 0x02,
1711 [INPUT_BUTTON_RIGHT] = 0x04,
1712 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1713 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1714 };
1715 QemuConsole *con = vs->vd->dcl.con;
1716 int width = pixman_image_get_width(vs->vd->server);
1717 int height = pixman_image_get_height(vs->vd->server);
1718
1719 if (vs->last_bmask != button_mask) {
1720 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1721 vs->last_bmask = button_mask;
1722 }
1723
1724 if (vs->absolute) {
1725 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1726 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1727 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1728 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1729 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1730 } else {
1731 if (vs->last_x != -1) {
1732 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1733 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1734 }
1735 vs->last_x = x;
1736 vs->last_y = y;
1737 }
1738 qemu_input_event_sync();
1739 }
1740
1741 static void reset_keys(VncState *vs)
1742 {
1743 int i;
1744 for(i = 0; i < 256; i++) {
1745 if (vs->modifiers_state[i]) {
1746 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1747 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1748 vs->modifiers_state[i] = 0;
1749 }
1750 }
1751 }
1752
1753 static void press_key(VncState *vs, int keysym)
1754 {
1755 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym,
1756 false, false, false) & SCANCODE_KEYMASK;
1757 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1758 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1759 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1760 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1761 }
1762
1763 static void vnc_led_state_change(VncState *vs)
1764 {
1765 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1766 return;
1767 }
1768
1769 vnc_lock_output(vs);
1770 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1771 vnc_write_u8(vs, 0);
1772 vnc_write_u16(vs, 1);
1773 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1774 vnc_write_u8(vs, vs->vd->ledstate);
1775 vnc_unlock_output(vs);
1776 vnc_flush(vs);
1777 }
1778
1779 static void kbd_leds(void *opaque, int ledstate)
1780 {
1781 VncDisplay *vd = opaque;
1782 VncState *client;
1783
1784 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1785 (ledstate & QEMU_NUM_LOCK_LED),
1786 (ledstate & QEMU_SCROLL_LOCK_LED));
1787
1788 if (ledstate == vd->ledstate) {
1789 return;
1790 }
1791
1792 vd->ledstate = ledstate;
1793
1794 QTAILQ_FOREACH(client, &vd->clients, next) {
1795 vnc_led_state_change(client);
1796 }
1797 }
1798
1799 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1800 {
1801 /* QEMU console switch */
1802 switch(keycode) {
1803 case 0x2a: /* Left Shift */
1804 case 0x36: /* Right Shift */
1805 case 0x1d: /* Left CTRL */
1806 case 0x9d: /* Right CTRL */
1807 case 0x38: /* Left ALT */
1808 case 0xb8: /* Right ALT */
1809 if (down)
1810 vs->modifiers_state[keycode] = 1;
1811 else
1812 vs->modifiers_state[keycode] = 0;
1813 break;
1814 case 0x02 ... 0x0a: /* '1' to '9' keys */
1815 if (vs->vd->dcl.con == NULL &&
1816 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1817 /* Reset the modifiers sent to the current console */
1818 reset_keys(vs);
1819 console_select(keycode - 0x02);
1820 return;
1821 }
1822 break;
1823 case 0x3a: /* CapsLock */
1824 case 0x45: /* NumLock */
1825 if (down)
1826 vs->modifiers_state[keycode] ^= 1;
1827 break;
1828 }
1829
1830 /* Turn off the lock state sync logic if the client support the led
1831 state extension.
1832 */
1833 if (down && vs->vd->lock_key_sync &&
1834 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1835 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1836 /* If the numlock state needs to change then simulate an additional
1837 keypress before sending this one. This will happen if the user
1838 toggles numlock away from the VNC window.
1839 */
1840 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1841 if (!vs->modifiers_state[0x45]) {
1842 trace_vnc_key_sync_numlock(true);
1843 vs->modifiers_state[0x45] = 1;
1844 press_key(vs, 0xff7f);
1845 }
1846 } else {
1847 if (vs->modifiers_state[0x45]) {
1848 trace_vnc_key_sync_numlock(false);
1849 vs->modifiers_state[0x45] = 0;
1850 press_key(vs, 0xff7f);
1851 }
1852 }
1853 }
1854
1855 if (down && vs->vd->lock_key_sync &&
1856 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1857 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1858 /* If the capslock state needs to change then simulate an additional
1859 keypress before sending this one. This will happen if the user
1860 toggles capslock away from the VNC window.
1861 */
1862 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1863 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1864 int capslock = !!(vs->modifiers_state[0x3a]);
1865 if (capslock) {
1866 if (uppercase == shift) {
1867 trace_vnc_key_sync_capslock(false);
1868 vs->modifiers_state[0x3a] = 0;
1869 press_key(vs, 0xffe5);
1870 }
1871 } else {
1872 if (uppercase != shift) {
1873 trace_vnc_key_sync_capslock(true);
1874 vs->modifiers_state[0x3a] = 1;
1875 press_key(vs, 0xffe5);
1876 }
1877 }
1878 }
1879
1880 if (qemu_console_is_graphic(NULL)) {
1881 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1882 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1883 } else {
1884 bool numlock = vs->modifiers_state[0x45];
1885 bool control = (vs->modifiers_state[0x1d] ||
1886 vs->modifiers_state[0x9d]);
1887 /* QEMU console emulation */
1888 if (down) {
1889 switch (keycode) {
1890 case 0x2a: /* Left Shift */
1891 case 0x36: /* Right Shift */
1892 case 0x1d: /* Left CTRL */
1893 case 0x9d: /* Right CTRL */
1894 case 0x38: /* Left ALT */
1895 case 0xb8: /* Right ALT */
1896 break;
1897 case 0xc8:
1898 kbd_put_keysym(QEMU_KEY_UP);
1899 break;
1900 case 0xd0:
1901 kbd_put_keysym(QEMU_KEY_DOWN);
1902 break;
1903 case 0xcb:
1904 kbd_put_keysym(QEMU_KEY_LEFT);
1905 break;
1906 case 0xcd:
1907 kbd_put_keysym(QEMU_KEY_RIGHT);
1908 break;
1909 case 0xd3:
1910 kbd_put_keysym(QEMU_KEY_DELETE);
1911 break;
1912 case 0xc7:
1913 kbd_put_keysym(QEMU_KEY_HOME);
1914 break;
1915 case 0xcf:
1916 kbd_put_keysym(QEMU_KEY_END);
1917 break;
1918 case 0xc9:
1919 kbd_put_keysym(QEMU_KEY_PAGEUP);
1920 break;
1921 case 0xd1:
1922 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1923 break;
1924
1925 case 0x47:
1926 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1927 break;
1928 case 0x48:
1929 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1930 break;
1931 case 0x49:
1932 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1933 break;
1934 case 0x4b:
1935 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1936 break;
1937 case 0x4c:
1938 kbd_put_keysym('5');
1939 break;
1940 case 0x4d:
1941 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1942 break;
1943 case 0x4f:
1944 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1945 break;
1946 case 0x50:
1947 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1948 break;
1949 case 0x51:
1950 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1951 break;
1952 case 0x52:
1953 kbd_put_keysym('0');
1954 break;
1955 case 0x53:
1956 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1957 break;
1958
1959 case 0xb5:
1960 kbd_put_keysym('/');
1961 break;
1962 case 0x37:
1963 kbd_put_keysym('*');
1964 break;
1965 case 0x4a:
1966 kbd_put_keysym('-');
1967 break;
1968 case 0x4e:
1969 kbd_put_keysym('+');
1970 break;
1971 case 0x9c:
1972 kbd_put_keysym('\n');
1973 break;
1974
1975 default:
1976 if (control) {
1977 kbd_put_keysym(sym & 0x1f);
1978 } else {
1979 kbd_put_keysym(sym);
1980 }
1981 break;
1982 }
1983 }
1984 }
1985 }
1986
1987 static void vnc_release_modifiers(VncState *vs)
1988 {
1989 static const int keycodes[] = {
1990 /* shift, control, alt keys, both left & right */
1991 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1992 };
1993 int i, keycode;
1994
1995 if (!qemu_console_is_graphic(NULL)) {
1996 return;
1997 }
1998 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1999 keycode = keycodes[i];
2000 if (!vs->modifiers_state[keycode]) {
2001 continue;
2002 }
2003 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
2004 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
2005 }
2006 }
2007
2008 static const char *code2name(int keycode)
2009 {
2010 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
2011 }
2012
2013 static void key_event(VncState *vs, int down, uint32_t sym)
2014 {
2015 bool shift = vs->modifiers_state[0x2a] || vs->modifiers_state[0x36];
2016 bool altgr = vs->modifiers_state[0xb8];
2017 bool ctrl = vs->modifiers_state[0x1d] || vs->modifiers_state[0x9d];
2018 int keycode;
2019 int lsym = sym;
2020
2021 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
2022 lsym = lsym - 'A' + 'a';
2023 }
2024
2025 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
2026 shift, altgr, ctrl) & SCANCODE_KEYMASK;
2027 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
2028 do_key_event(vs, down, keycode, sym);
2029 }
2030
2031 static void ext_key_event(VncState *vs, int down,
2032 uint32_t sym, uint16_t keycode)
2033 {
2034 /* if the user specifies a keyboard layout, always use it */
2035 if (keyboard_layout) {
2036 key_event(vs, down, sym);
2037 } else {
2038 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2039 do_key_event(vs, down, keycode, sym);
2040 }
2041 }
2042
2043 static void framebuffer_update_request(VncState *vs, int incremental,
2044 int x, int y, int w, int h)
2045 {
2046 if (incremental) {
2047 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2048 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2049 }
2050 } else {
2051 vs->update = VNC_STATE_UPDATE_FORCE;
2052 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2053 }
2054 }
2055
2056 static void send_ext_key_event_ack(VncState *vs)
2057 {
2058 vnc_lock_output(vs);
2059 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2060 vnc_write_u8(vs, 0);
2061 vnc_write_u16(vs, 1);
2062 vnc_framebuffer_update(vs, 0, 0,
2063 pixman_image_get_width(vs->vd->server),
2064 pixman_image_get_height(vs->vd->server),
2065 VNC_ENCODING_EXT_KEY_EVENT);
2066 vnc_unlock_output(vs);
2067 vnc_flush(vs);
2068 }
2069
2070 static void send_ext_audio_ack(VncState *vs)
2071 {
2072 vnc_lock_output(vs);
2073 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2074 vnc_write_u8(vs, 0);
2075 vnc_write_u16(vs, 1);
2076 vnc_framebuffer_update(vs, 0, 0,
2077 pixman_image_get_width(vs->vd->server),
2078 pixman_image_get_height(vs->vd->server),
2079 VNC_ENCODING_AUDIO);
2080 vnc_unlock_output(vs);
2081 vnc_flush(vs);
2082 }
2083
2084 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2085 {
2086 int i;
2087 unsigned int enc = 0;
2088
2089 vs->features = 0;
2090 vs->vnc_encoding = 0;
2091 vs->tight.compression = 9;
2092 vs->tight.quality = -1; /* Lossless by default */
2093 vs->absolute = -1;
2094
2095 /*
2096 * Start from the end because the encodings are sent in order of preference.
2097 * This way the preferred encoding (first encoding defined in the array)
2098 * will be set at the end of the loop.
2099 */
2100 for (i = n_encodings - 1; i >= 0; i--) {
2101 enc = encodings[i];
2102 switch (enc) {
2103 case VNC_ENCODING_RAW:
2104 vs->vnc_encoding = enc;
2105 break;
2106 case VNC_ENCODING_COPYRECT:
2107 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2108 break;
2109 case VNC_ENCODING_HEXTILE:
2110 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2111 vs->vnc_encoding = enc;
2112 break;
2113 case VNC_ENCODING_TIGHT:
2114 vs->features |= VNC_FEATURE_TIGHT_MASK;
2115 vs->vnc_encoding = enc;
2116 break;
2117 #ifdef CONFIG_VNC_PNG
2118 case VNC_ENCODING_TIGHT_PNG:
2119 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2120 vs->vnc_encoding = enc;
2121 break;
2122 #endif
2123 case VNC_ENCODING_ZLIB:
2124 vs->features |= VNC_FEATURE_ZLIB_MASK;
2125 vs->vnc_encoding = enc;
2126 break;
2127 case VNC_ENCODING_ZRLE:
2128 vs->features |= VNC_FEATURE_ZRLE_MASK;
2129 vs->vnc_encoding = enc;
2130 break;
2131 case VNC_ENCODING_ZYWRLE:
2132 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2133 vs->vnc_encoding = enc;
2134 break;
2135 case VNC_ENCODING_DESKTOPRESIZE:
2136 vs->features |= VNC_FEATURE_RESIZE_MASK;
2137 break;
2138 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2139 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2140 break;
2141 case VNC_ENCODING_RICH_CURSOR:
2142 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2143 if (vs->vd->cursor) {
2144 vnc_cursor_define(vs);
2145 }
2146 break;
2147 case VNC_ENCODING_EXT_KEY_EVENT:
2148 send_ext_key_event_ack(vs);
2149 break;
2150 case VNC_ENCODING_AUDIO:
2151 send_ext_audio_ack(vs);
2152 break;
2153 case VNC_ENCODING_WMVi:
2154 vs->features |= VNC_FEATURE_WMVI_MASK;
2155 break;
2156 case VNC_ENCODING_LED_STATE:
2157 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2158 break;
2159 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2160 vs->tight.compression = (enc & 0x0F);
2161 break;
2162 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2163 if (vs->vd->lossy) {
2164 vs->tight.quality = (enc & 0x0F);
2165 }
2166 break;
2167 default:
2168 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2169 break;
2170 }
2171 }
2172 vnc_desktop_resize(vs);
2173 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2174 vnc_led_state_change(vs);
2175 }
2176
2177 static void set_pixel_conversion(VncState *vs)
2178 {
2179 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2180
2181 if (fmt == VNC_SERVER_FB_FORMAT) {
2182 vs->write_pixels = vnc_write_pixels_copy;
2183 vnc_hextile_set_pixel_conversion(vs, 0);
2184 } else {
2185 vs->write_pixels = vnc_write_pixels_generic;
2186 vnc_hextile_set_pixel_conversion(vs, 1);
2187 }
2188 }
2189
2190 static void send_color_map(VncState *vs)
2191 {
2192 int i;
2193
2194 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2195 vnc_write_u8(vs, 0); /* padding */
2196 vnc_write_u16(vs, 0); /* first color */
2197 vnc_write_u16(vs, 256); /* # of colors */
2198
2199 for (i = 0; i < 256; i++) {
2200 PixelFormat *pf = &vs->client_pf;
2201
2202 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2203 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2204 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2205 }
2206 }
2207
2208 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2209 int big_endian_flag, int true_color_flag,
2210 int red_max, int green_max, int blue_max,
2211 int red_shift, int green_shift, int blue_shift)
2212 {
2213 if (!true_color_flag) {
2214 /* Expose a reasonable default 256 color map */
2215 bits_per_pixel = 8;
2216 red_max = 7;
2217 green_max = 7;
2218 blue_max = 3;
2219 red_shift = 0;
2220 green_shift = 3;
2221 blue_shift = 6;
2222 }
2223
2224 switch (bits_per_pixel) {
2225 case 8:
2226 case 16:
2227 case 32:
2228 break;
2229 default:
2230 vnc_client_error(vs);
2231 return;
2232 }
2233
2234 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2235 vs->client_pf.rbits = ctpopl(red_max);
2236 vs->client_pf.rshift = red_shift;
2237 vs->client_pf.rmask = red_max << red_shift;
2238 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2239 vs->client_pf.gbits = ctpopl(green_max);
2240 vs->client_pf.gshift = green_shift;
2241 vs->client_pf.gmask = green_max << green_shift;
2242 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2243 vs->client_pf.bbits = ctpopl(blue_max);
2244 vs->client_pf.bshift = blue_shift;
2245 vs->client_pf.bmask = blue_max << blue_shift;
2246 vs->client_pf.bits_per_pixel = bits_per_pixel;
2247 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2248 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2249 vs->client_be = big_endian_flag;
2250
2251 if (!true_color_flag) {
2252 send_color_map(vs);
2253 }
2254
2255 set_pixel_conversion(vs);
2256
2257 graphic_hw_invalidate(vs->vd->dcl.con);
2258 graphic_hw_update(vs->vd->dcl.con);
2259 }
2260
2261 static void pixel_format_message (VncState *vs) {
2262 char pad[3] = { 0, 0, 0 };
2263
2264 vs->client_pf = qemu_default_pixelformat(32);
2265
2266 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2267 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2268
2269 #ifdef HOST_WORDS_BIGENDIAN
2270 vnc_write_u8(vs, 1); /* big-endian-flag */
2271 #else
2272 vnc_write_u8(vs, 0); /* big-endian-flag */
2273 #endif
2274 vnc_write_u8(vs, 1); /* true-color-flag */
2275 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2276 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2277 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2278 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2279 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2280 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2281 vnc_write(vs, pad, 3); /* padding */
2282
2283 vnc_hextile_set_pixel_conversion(vs, 0);
2284 vs->write_pixels = vnc_write_pixels_copy;
2285 }
2286
2287 static void vnc_colordepth(VncState *vs)
2288 {
2289 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2290 /* Sending a WMVi message to notify the client*/
2291 vnc_lock_output(vs);
2292 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2293 vnc_write_u8(vs, 0);
2294 vnc_write_u16(vs, 1); /* number of rects */
2295 vnc_framebuffer_update(vs, 0, 0,
2296 pixman_image_get_width(vs->vd->server),
2297 pixman_image_get_height(vs->vd->server),
2298 VNC_ENCODING_WMVi);
2299 pixel_format_message(vs);
2300 vnc_unlock_output(vs);
2301 vnc_flush(vs);
2302 } else {
2303 set_pixel_conversion(vs);
2304 }
2305 }
2306
2307 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2308 {
2309 int i;
2310 uint16_t limit;
2311 uint32_t freq;
2312 VncDisplay *vd = vs->vd;
2313
2314 if (data[0] > 3) {
2315 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2316 }
2317
2318 switch (data[0]) {
2319 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2320 if (len == 1)
2321 return 20;
2322
2323 set_pixel_format(vs, read_u8(data, 4),
2324 read_u8(data, 6), read_u8(data, 7),
2325 read_u16(data, 8), read_u16(data, 10),
2326 read_u16(data, 12), read_u8(data, 14),
2327 read_u8(data, 15), read_u8(data, 16));
2328 break;
2329 case VNC_MSG_CLIENT_SET_ENCODINGS:
2330 if (len == 1)
2331 return 4;
2332
2333 if (len == 4) {
2334 limit = read_u16(data, 2);
2335 if (limit > 0)
2336 return 4 + (limit * 4);
2337 } else
2338 limit = read_u16(data, 2);
2339
2340 for (i = 0; i < limit; i++) {
2341 int32_t val = read_s32(data, 4 + (i * 4));
2342 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2343 }
2344
2345 set_encodings(vs, (int32_t *)(data + 4), limit);
2346 break;
2347 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2348 if (len == 1)
2349 return 10;
2350
2351 framebuffer_update_request(vs,
2352 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2353 read_u16(data, 6), read_u16(data, 8));
2354 break;
2355 case VNC_MSG_CLIENT_KEY_EVENT:
2356 if (len == 1)
2357 return 8;
2358
2359 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2360 break;
2361 case VNC_MSG_CLIENT_POINTER_EVENT:
2362 if (len == 1)
2363 return 6;
2364
2365 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2366 break;
2367 case VNC_MSG_CLIENT_CUT_TEXT:
2368 if (len == 1) {
2369 return 8;
2370 }
2371 if (len == 8) {
2372 uint32_t dlen = read_u32(data, 4);
2373 if (dlen > (1 << 20)) {
2374 error_report("vnc: client_cut_text msg payload has %u bytes"
2375 " which exceeds our limit of 1MB.", dlen);
2376 vnc_client_error(vs);
2377 break;
2378 }
2379 if (dlen > 0) {
2380 return 8 + dlen;
2381 }
2382 }
2383
2384 client_cut_text(vs, read_u32(data, 4), data + 8);
2385 break;
2386 case VNC_MSG_CLIENT_QEMU:
2387 if (len == 1)
2388 return 2;
2389
2390 switch (read_u8(data, 1)) {
2391 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2392 if (len == 2)
2393 return 12;
2394
2395 ext_key_event(vs, read_u16(data, 2),
2396 read_u32(data, 4), read_u32(data, 8));
2397 break;
2398 case VNC_MSG_CLIENT_QEMU_AUDIO:
2399 if (len == 2)
2400 return 4;
2401
2402 switch (read_u16 (data, 2)) {
2403 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2404 audio_add(vs);
2405 break;
2406 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2407 audio_del(vs);
2408 break;
2409 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2410 if (len == 4)
2411 return 10;
2412 switch (read_u8(data, 4)) {
2413 case 0: vs->as.fmt = AUD_FMT_U8; break;
2414 case 1: vs->as.fmt = AUD_FMT_S8; break;
2415 case 2: vs->as.fmt = AUD_FMT_U16; break;
2416 case 3: vs->as.fmt = AUD_FMT_S16; break;
2417 case 4: vs->as.fmt = AUD_FMT_U32; break;
2418 case 5: vs->as.fmt = AUD_FMT_S32; break;
2419 default:
2420 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2421 vnc_client_error(vs);
2422 break;
2423 }
2424 vs->as.nchannels = read_u8(data, 5);
2425 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2426 VNC_DEBUG("Invalid audio channel count %d\n",
2427 read_u8(data, 5));
2428 vnc_client_error(vs);
2429 break;
2430 }
2431 freq = read_u32(data, 6);
2432 /* No official limit for protocol, but 48khz is a sensible
2433 * upper bound for trustworthy clients, and this limit
2434 * protects calculations involving 'vs->as.freq' later.
2435 */
2436 if (freq > 48000) {
2437 VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
2438 vnc_client_error(vs);
2439 break;
2440 }
2441 vs->as.freq = freq;
2442 break;
2443 default:
2444 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2445 vnc_client_error(vs);
2446 break;
2447 }
2448 break;
2449
2450 default:
2451 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2452 vnc_client_error(vs);
2453 break;
2454 }
2455 break;
2456 default:
2457 VNC_DEBUG("Msg: %d\n", data[0]);
2458 vnc_client_error(vs);
2459 break;
2460 }
2461
2462 vnc_update_throttle_offset(vs);
2463 vnc_read_when(vs, protocol_client_msg, 1);
2464 return 0;
2465 }
2466
2467 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2468 {
2469 char buf[1024];
2470 VncShareMode mode;
2471 int size;
2472
2473 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2474 switch (vs->vd->share_policy) {
2475 case VNC_SHARE_POLICY_IGNORE:
2476 /*
2477 * Ignore the shared flag. Nothing to do here.
2478 *
2479 * Doesn't conform to the rfb spec but is traditional qemu
2480 * behavior, thus left here as option for compatibility
2481 * reasons.
2482 */
2483 break;
2484 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2485 /*
2486 * Policy: Allow clients ask for exclusive access.
2487 *
2488 * Implementation: When a client asks for exclusive access,
2489 * disconnect all others. Shared connects are allowed as long
2490 * as no exclusive connection exists.
2491 *
2492 * This is how the rfb spec suggests to handle the shared flag.
2493 */
2494 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2495 VncState *client;
2496 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2497 if (vs == client) {
2498 continue;
2499 }
2500 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2501 client->share_mode != VNC_SHARE_MODE_SHARED) {
2502 continue;
2503 }
2504 vnc_disconnect_start(client);
2505 }
2506 }
2507 if (mode == VNC_SHARE_MODE_SHARED) {
2508 if (vs->vd->num_exclusive > 0) {
2509 vnc_disconnect_start(vs);
2510 return 0;
2511 }
2512 }
2513 break;
2514 case VNC_SHARE_POLICY_FORCE_SHARED:
2515 /*
2516 * Policy: Shared connects only.
2517 * Implementation: Disallow clients asking for exclusive access.
2518 *
2519 * Useful for shared desktop sessions where you don't want
2520 * someone forgetting to say -shared when running the vnc
2521 * client disconnect everybody else.
2522 */
2523 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2524 vnc_disconnect_start(vs);
2525 return 0;
2526 }
2527 break;
2528 }
2529 vnc_set_share_mode(vs, mode);
2530
2531 if (vs->vd->num_shared > vs->vd->connections_limit) {
2532 vnc_disconnect_start(vs);
2533 return 0;
2534 }
2535
2536 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2537 pixman_image_get_width(vs->vd->server) >= 0);
2538 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2539 pixman_image_get_height(vs->vd->server) >= 0);
2540 vs->client_width = pixman_image_get_width(vs->vd->server);
2541 vs->client_height = pixman_image_get_height(vs->vd->server);
2542 vnc_write_u16(vs, vs->client_width);
2543 vnc_write_u16(vs, vs->client_height);
2544
2545 pixel_format_message(vs);
2546
2547 if (qemu_name) {
2548 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2549 if (size > sizeof(buf)) {
2550 size = sizeof(buf);
2551 }
2552 } else {
2553 size = snprintf(buf, sizeof(buf), "QEMU");
2554 }
2555
2556 vnc_write_u32(vs, size);
2557 vnc_write(vs, buf, size);
2558 vnc_flush(vs);
2559
2560 vnc_client_cache_auth(vs);
2561 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2562
2563 vnc_read_when(vs, protocol_client_msg, 1);
2564
2565 return 0;
2566 }
2567
2568 void start_client_init(VncState *vs)
2569 {
2570 vnc_read_when(vs, protocol_client_init, 1);
2571 }
2572
2573 static void make_challenge(VncState *vs)
2574 {
2575 int i;
2576
2577 srand(time(NULL)+getpid()+getpid()*987654+rand());
2578
2579 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2580 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2581 }
2582
2583 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2584 {
2585 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2586 size_t i, pwlen;
2587 unsigned char key[8];
2588 time_t now = time(NULL);
2589 QCryptoCipher *cipher = NULL;
2590 Error *err = NULL;
2591
2592 if (!vs->vd->password) {
2593 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2594 goto reject;
2595 }
2596 if (vs->vd->expires < now) {
2597 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2598 goto reject;
2599 }
2600
2601 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2602
2603 /* Calculate the expected challenge response */
2604 pwlen = strlen(vs->vd->password);
2605 for (i=0; i<sizeof(key); i++)
2606 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2607
2608 cipher = qcrypto_cipher_new(
2609 QCRYPTO_CIPHER_ALG_DES_RFB,
2610 QCRYPTO_CIPHER_MODE_ECB,
2611 key, G_N_ELEMENTS(key),
2612 &err);
2613 if (!cipher) {
2614 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2615 error_get_pretty(err));
2616 error_free(err);
2617 goto reject;
2618 }
2619
2620 if (qcrypto_cipher_encrypt(cipher,
2621 vs->challenge,
2622 response,
2623 VNC_AUTH_CHALLENGE_SIZE,
2624 &err) < 0) {
2625 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2626 error_get_pretty(err));
2627 error_free(err);
2628 goto reject;
2629 }
2630
2631 /* Compare expected vs actual challenge response */
2632 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2633 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2634 goto reject;
2635 } else {
2636 trace_vnc_auth_pass(vs, vs->auth);
2637 vnc_write_u32(vs, 0); /* Accept auth */
2638 vnc_flush(vs);
2639
2640 start_client_init(vs);
2641 }
2642
2643 qcrypto_cipher_free(cipher);
2644 return 0;
2645
2646 reject:
2647 vnc_write_u32(vs, 1); /* Reject auth */
2648 if (vs->minor >= 8) {
2649 static const char err[] = "Authentication failed";
2650 vnc_write_u32(vs, sizeof(err));
2651 vnc_write(vs, err, sizeof(err));
2652 }
2653 vnc_flush(vs);
2654 vnc_client_error(vs);
2655 qcrypto_cipher_free(cipher);
2656 return 0;
2657 }
2658
2659 void start_auth_vnc(VncState *vs)
2660 {
2661 make_challenge(vs);
2662 /* Send client a 'random' challenge */
2663 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2664 vnc_flush(vs);
2665
2666 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2667 }
2668
2669
2670 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2671 {
2672 /* We only advertise 1 auth scheme at a time, so client
2673 * must pick the one we sent. Verify this */
2674 if (data[0] != vs->auth) { /* Reject auth */
2675 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2676 vnc_write_u32(vs, 1);
2677 if (vs->minor >= 8) {
2678 static const char err[] = "Authentication failed";
2679 vnc_write_u32(vs, sizeof(err));
2680 vnc_write(vs, err, sizeof(err));
2681 }
2682 vnc_client_error(vs);
2683 } else { /* Accept requested auth */
2684 trace_vnc_auth_start(vs, vs->auth);
2685 switch (vs->auth) {
2686 case VNC_AUTH_NONE:
2687 if (vs->minor >= 8) {
2688 vnc_write_u32(vs, 0); /* Accept auth completion */
2689 vnc_flush(vs);
2690 }
2691 trace_vnc_auth_pass(vs, vs->auth);
2692 start_client_init(vs);
2693 break;
2694
2695 case VNC_AUTH_VNC:
2696 start_auth_vnc(vs);
2697 break;
2698
2699 case VNC_AUTH_VENCRYPT:
2700 start_auth_vencrypt(vs);
2701 break;
2702
2703 #ifdef CONFIG_VNC_SASL
2704 case VNC_AUTH_SASL:
2705 start_auth_sasl(vs);
2706 break;
2707 #endif /* CONFIG_VNC_SASL */
2708
2709 default: /* Should not be possible, but just in case */
2710 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2711 vnc_write_u8(vs, 1);
2712 if (vs->minor >= 8) {
2713 static const char err[] = "Authentication failed";
2714 vnc_write_u32(vs, sizeof(err));
2715 vnc_write(vs, err, sizeof(err));
2716 }
2717 vnc_client_error(vs);
2718 }
2719 }
2720 return 0;
2721 }
2722
2723 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2724 {
2725 char local[13];
2726
2727 memcpy(local, version, 12);
2728 local[12] = 0;
2729
2730 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2731 VNC_DEBUG("Malformed protocol version %s\n", local);
2732 vnc_client_error(vs);
2733 return 0;
2734 }
2735 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2736 if (vs->major != 3 ||
2737 (vs->minor != 3 &&
2738 vs->minor != 4 &&
2739 vs->minor != 5 &&
2740 vs->minor != 7 &&
2741 vs->minor != 8)) {
2742 VNC_DEBUG("Unsupported client version\n");
2743 vnc_write_u32(vs, VNC_AUTH_INVALID);
2744 vnc_flush(vs);
2745 vnc_client_error(vs);
2746 return 0;
2747 }
2748 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2749 * as equivalent to v3.3 by servers
2750 */
2751 if (vs->minor == 4 || vs->minor == 5)
2752 vs->minor = 3;
2753
2754 if (vs->minor == 3) {
2755 trace_vnc_auth_start(vs, vs->auth);
2756 if (vs->auth == VNC_AUTH_NONE) {
2757 vnc_write_u32(vs, vs->auth);
2758 vnc_flush(vs);
2759 trace_vnc_auth_pass(vs, vs->auth);
2760 start_client_init(vs);
2761 } else if (vs->auth == VNC_AUTH_VNC) {
2762 VNC_DEBUG("Tell client VNC auth\n");
2763 vnc_write_u32(vs, vs->auth);
2764 vnc_flush(vs);
2765 start_auth_vnc(vs);
2766 } else {
2767 trace_vnc_auth_fail(vs, vs->auth,
2768 "Unsupported auth method for v3.3", "");
2769 vnc_write_u32(vs, VNC_AUTH_INVALID);
2770 vnc_flush(vs);
2771 vnc_client_error(vs);
2772 }
2773 } else {
2774 vnc_write_u8(vs, 1); /* num auth */
2775 vnc_write_u8(vs, vs->auth);
2776 vnc_read_when(vs, protocol_client_auth, 1);
2777 vnc_flush(vs);
2778 }
2779
2780 return 0;
2781 }
2782
2783 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2784 {
2785 struct VncSurface *vs = &vd->guest;
2786
2787 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2788 }
2789
2790 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2791 {
2792 int i, j;
2793
2794 w = (x + w) / VNC_STAT_RECT;
2795 h = (y + h) / VNC_STAT_RECT;
2796 x /= VNC_STAT_RECT;
2797 y /= VNC_STAT_RECT;
2798
2799 for (j = y; j <= h; j++) {
2800 for (i = x; i <= w; i++) {
2801 vs->lossy_rect[j][i] = 1;
2802 }
2803 }
2804 }
2805
2806 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2807 {
2808 VncState *vs;
2809 int sty = y / VNC_STAT_RECT;
2810 int stx = x / VNC_STAT_RECT;
2811 int has_dirty = 0;
2812
2813 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2814 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2815
2816 QTAILQ_FOREACH(vs, &vd->clients, next) {
2817 int j;
2818
2819 /* kernel send buffers are full -> refresh later */
2820 if (vs->output.offset) {
2821 continue;
2822 }
2823
2824 if (!vs->lossy_rect[sty][stx]) {
2825 continue;
2826 }
2827
2828 vs->lossy_rect[sty][stx] = 0;
2829 for (j = 0; j < VNC_STAT_RECT; ++j) {
2830 bitmap_set(vs->dirty[y + j],
2831 x / VNC_DIRTY_PIXELS_PER_BIT,
2832 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2833 }
2834 has_dirty++;
2835 }
2836
2837 return has_dirty;
2838 }
2839
2840 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2841 {
2842 int width = MIN(pixman_image_get_width(vd->guest.fb),
2843 pixman_image_get_width(vd->server));
2844 int height = MIN(pixman_image_get_height(vd->guest.fb),
2845 pixman_image_get_height(vd->server));
2846 int x, y;
2847 struct timeval res;
2848 int has_dirty = 0;
2849
2850 for (y = 0; y < height; y += VNC_STAT_RECT) {
2851 for (x = 0; x < width; x += VNC_STAT_RECT) {
2852 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2853
2854 rect->updated = false;
2855 }
2856 }
2857
2858 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2859
2860 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2861 return has_dirty;
2862 }
2863 vd->guest.last_freq_check = *tv;
2864
2865 for (y = 0; y < height; y += VNC_STAT_RECT) {
2866 for (x = 0; x < width; x += VNC_STAT_RECT) {
2867 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2868 int count = ARRAY_SIZE(rect->times);
2869 struct timeval min, max;
2870
2871 if (!timerisset(&rect->times[count - 1])) {
2872 continue ;
2873 }
2874
2875 max = rect->times[(rect->idx + count - 1) % count];
2876 qemu_timersub(tv, &max, &res);
2877
2878 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2879 rect->freq = 0;
2880 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2881 memset(rect->times, 0, sizeof (rect->times));
2882 continue ;
2883 }
2884
2885 min = rect->times[rect->idx];
2886 max = rect->times[(rect->idx + count - 1) % count];
2887 qemu_timersub(&max, &min, &res);
2888
2889 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2890 rect->freq /= count;
2891 rect->freq = 1. / rect->freq;
2892 }
2893 }
2894 return has_dirty;
2895 }
2896
2897 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2898 {
2899 int i, j;
2900 double total = 0;
2901 int num = 0;
2902
2903 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2904 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2905
2906 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2907 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2908 total += vnc_stat_rect(vs->vd, i, j)->freq;
2909 num++;
2910 }
2911 }
2912
2913 if (num) {
2914 return total / num;
2915 } else {
2916 return 0;
2917 }
2918 }
2919
2920 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2921 {
2922 VncRectStat *rect;
2923
2924 rect = vnc_stat_rect(vd, x, y);
2925 if (rect->updated) {
2926 return ;
2927 }
2928 rect->times[rect->idx] = *tv;
2929 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2930 rect->updated = true;
2931 }
2932
2933 static int vnc_refresh_server_surface(VncDisplay *vd)
2934 {
2935 int width = MIN(pixman_image_get_width(vd->guest.fb),
2936 pixman_image_get_width(vd->server));
2937 int height = MIN(pixman_image_get_height(vd->guest.fb),
2938 pixman_image_get_height(vd->server));
2939 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2940 uint8_t *guest_row0 = NULL, *server_row0;
2941 VncState *vs;
2942 int has_dirty = 0;
2943 pixman_image_t *tmpbuf = NULL;
2944
2945 struct timeval tv = { 0, 0 };
2946
2947 if (!vd->non_adaptive) {
2948 gettimeofday(&tv, NULL);
2949 has_dirty = vnc_update_stats(vd, &tv);
2950 }
2951
2952 /*
2953 * Walk through the guest dirty map.
2954 * Check and copy modified bits from guest to server surface.
2955 * Update server dirty map.
2956 */
2957 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2958 server_stride = guest_stride = guest_ll =
2959 pixman_image_get_stride(vd->server);
2960 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2961 server_stride);
2962 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2963 int width = pixman_image_get_width(vd->server);
2964 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2965 } else {
2966 int guest_bpp =
2967 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2968 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2969 guest_stride = pixman_image_get_stride(vd->guest.fb);
2970 guest_ll = pixman_image_get_width(vd->guest.fb)
2971 * DIV_ROUND_UP(guest_bpp, 8);
2972 }
2973 line_bytes = MIN(server_stride, guest_ll);
2974
2975 for (;;) {
2976 int x;
2977 uint8_t *guest_ptr, *server_ptr;
2978 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2979 height * VNC_DIRTY_BPL(&vd->guest),
2980 y * VNC_DIRTY_BPL(&vd->guest));
2981 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2982 /* no more dirty bits */
2983 break;
2984 }
2985 y = offset / VNC_DIRTY_BPL(&vd->guest);
2986 x = offset % VNC_DIRTY_BPL(&vd->guest);
2987
2988 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2989
2990 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2991 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2992 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2993 } else {
2994 guest_ptr = guest_row0 + y * guest_stride;
2995 }
2996 guest_ptr += x * cmp_bytes;
2997
2998 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2999 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
3000 int _cmp_bytes = cmp_bytes;
3001 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
3002 continue;
3003 }
3004 if ((x + 1) * cmp_bytes > line_bytes) {
3005 _cmp_bytes = line_bytes - x * cmp_bytes;
3006 }
3007 assert(_cmp_bytes >= 0);
3008 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
3009 continue;
3010 }
3011 memcpy(server_ptr, guest_ptr, _cmp_bytes);
3012 if (!vd->non_adaptive) {
3013 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
3014 y, &tv);
3015 }
3016 QTAILQ_FOREACH(vs, &vd->clients, next) {
3017 set_bit(x, vs->dirty[y]);
3018 }
3019 has_dirty++;
3020 }
3021
3022 y++;
3023 }
3024 qemu_pixman_image_unref(tmpbuf);
3025 return has_dirty;
3026 }
3027
3028 static void vnc_refresh(DisplayChangeListener *dcl)
3029 {
3030 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
3031 VncState *vs, *vn;
3032 int has_dirty, rects = 0;
3033
3034 if (QTAILQ_EMPTY(&vd->clients)) {
3035 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3036 return;
3037 }
3038
3039 graphic_hw_update(vd->dcl.con);
3040
3041 if (vnc_trylock_display(vd)) {
3042 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3043 return;
3044 }
3045
3046 has_dirty = vnc_refresh_server_surface(vd);
3047 vnc_unlock_display(vd);
3048
3049 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3050 rects += vnc_update_client(vs, has_dirty);
3051 /* vs might be free()ed here */
3052 }
3053
3054 if (has_dirty && rects) {
3055 vd->dcl.update_interval /= 2;
3056 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3057 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3058 }
3059 } else {
3060 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3061 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3062 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3063 }
3064 }
3065 }
3066
3067 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
3068 bool skipauth, bool websocket)
3069 {
3070 VncState *vs = g_new0(VncState, 1);
3071 bool first_client = QTAILQ_EMPTY(&vd->clients);
3072 int i;
3073
3074 trace_vnc_client_connect(vs, sioc);
3075 vs->magic = VNC_MAGIC;
3076 vs->sioc = sioc;
3077 object_ref(OBJECT(vs->sioc));
3078 vs->ioc = QIO_CHANNEL(sioc);
3079 object_ref(OBJECT(vs->ioc));
3080 vs->vd = vd;
3081
3082 buffer_init(&vs->input, "vnc-input/%p", sioc);
3083 buffer_init(&vs->output, "vnc-output/%p", sioc);
3084 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3085
3086 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
3087 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
3088 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
3089 #ifdef CONFIG_VNC_JPEG
3090 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3091 #endif
3092 #ifdef CONFIG_VNC_PNG
3093 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
3094 #endif
3095 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
3096 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
3097 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
3098 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3099
3100 if (skipauth) {
3101 vs->auth = VNC_AUTH_NONE;
3102 vs->subauth = VNC_AUTH_INVALID;
3103 } else {
3104 if (websocket) {
3105 vs->auth = vd->ws_auth;
3106 vs->subauth = VNC_AUTH_INVALID;
3107 } else {
3108 vs->auth = vd->auth;
3109 vs->subauth = vd->subauth;
3110 }
3111 }
3112 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3113 sioc, websocket, vs->auth, vs->subauth);
3114
3115 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3116 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3117 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3118 }
3119
3120 VNC_DEBUG("New client on socket %p\n", vs->sioc);
3121 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3122 qio_channel_set_blocking(vs->ioc, false, NULL);
3123 if (vs->ioc_tag) {
3124 g_source_remove(vs->ioc_tag);
3125 }
3126 if (websocket) {
3127 vs->websocket = 1;
3128 if (vd->tlscreds) {
3129 vs->ioc_tag = qio_channel_add_watch(
3130 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3131 } else {
3132 vs->ioc_tag = qio_channel_add_watch(
3133 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
3134 }
3135 } else {
3136 vs->ioc_tag = qio_channel_add_watch(
3137 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
3138 }
3139
3140 vnc_client_cache_addr(vs);
3141 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3142 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3143
3144 vs->last_x = -1;
3145 vs->last_y = -1;
3146
3147 vs->as.freq = 44100;
3148 vs->as.nchannels = 2;
3149 vs->as.fmt = AUD_FMT_S16;
3150 vs->as.endianness = 0;
3151
3152 qemu_mutex_init(&vs->output_mutex);
3153 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3154
3155 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3156 if (first_client) {
3157 vnc_update_server_surface(vd);
3158 }
3159
3160 graphic_hw_update(vd->dcl.con);
3161
3162 if (!vs->websocket) {
3163 vnc_start_protocol(vs);
3164 }
3165
3166 if (vd->num_connecting > vd->connections_limit) {
3167 QTAILQ_FOREACH(vs, &vd->clients, next) {
3168 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3169 vnc_disconnect_start(vs);
3170 return;
3171 }
3172 }
3173 }
3174 }
3175
3176 void vnc_start_protocol(VncState *vs)
3177 {
3178 vnc_write(vs, "RFB 003.008\n", 12);
3179 vnc_flush(vs);
3180 vnc_read_when(vs, protocol_version, 12);
3181
3182 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3183 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3184 }
3185
3186 static void vnc_listen_io(QIONetListener *listener,
3187 QIOChannelSocket *cioc,
3188 void *opaque)
3189 {
3190 VncDisplay *vd = opaque;
3191 bool isWebsock = listener == vd->wslistener;
3192
3193 qio_channel_set_name(QIO_CHANNEL(cioc),
3194 isWebsock ? "vnc-ws-server" : "vnc-server");
3195 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3196 vnc_connect(vd, cioc, false, isWebsock);
3197 }
3198
3199 static const DisplayChangeListenerOps dcl_ops = {
3200 .dpy_name = "vnc",
3201 .dpy_refresh = vnc_refresh,
3202 .dpy_gfx_update = vnc_dpy_update,
3203 .dpy_gfx_switch = vnc_dpy_switch,
3204 .dpy_gfx_check_format = qemu_pixman_check_format,
3205 .dpy_mouse_set = vnc_mouse_set,
3206 .dpy_cursor_define = vnc_dpy_cursor_define,
3207 };
3208
3209 void vnc_display_init(const char *id)
3210 {
3211 VncDisplay *vd;
3212
3213 if (vnc_display_find(id) != NULL) {
3214 return;
3215 }
3216 vd = g_malloc0(sizeof(*vd));
3217
3218 vd->id = strdup(id);
3219 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3220
3221 QTAILQ_INIT(&vd->clients);
3222 vd->expires = TIME_MAX;
3223
3224 if (keyboard_layout) {
3225 trace_vnc_key_map_init(keyboard_layout);
3226 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3227 } else {
3228 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3229 }
3230
3231 if (!vd->kbd_layout) {
3232 exit(1);
3233 }
3234
3235 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3236 vd->connections_limit = 32;
3237
3238 qemu_mutex_init(&vd->mutex);
3239 vnc_start_worker_thread();
3240
3241 vd->dcl.ops = &dcl_ops;
3242 register_displaychangelistener(&vd->dcl);
3243 }
3244
3245
3246 static void vnc_display_close(VncDisplay *vd)
3247 {
3248 if (!vd) {
3249 return;
3250 }
3251 vd->is_unix = false;
3252
3253 if (vd->listener) {
3254 qio_net_listener_disconnect(vd->listener);
3255 object_unref(OBJECT(vd->listener));
3256 }
3257 vd->listener = NULL;
3258
3259 if (vd->wslistener) {
3260 qio_net_listener_disconnect(vd->wslistener);
3261 object_unref(OBJECT(vd->wslistener));
3262 }
3263 vd->wslistener = NULL;
3264
3265 vd->auth = VNC_AUTH_INVALID;
3266 vd->subauth = VNC_AUTH_INVALID;
3267 if (vd->tlscreds) {
3268 object_unparent(OBJECT(vd->tlscreds));
3269 vd->tlscreds = NULL;
3270 }
3271 g_free(vd->tlsaclname);
3272 vd->tlsaclname = NULL;
3273 if (vd->lock_key_sync) {
3274 qemu_remove_led_event_handler(vd->led);
3275 vd->led = NULL;
3276 }
3277 }
3278
3279 int vnc_display_password(const char *id, const char *password)
3280 {
3281 VncDisplay *vd = vnc_display_find(id);
3282
3283 if (!vd) {
3284 return -EINVAL;
3285 }
3286 if (vd->auth == VNC_AUTH_NONE) {
3287 error_printf_unless_qmp("If you want use passwords please enable "
3288 "password auth using '-vnc ${dpy},password'.\n");
3289 return -EINVAL;
3290 }
3291
3292 g_free(vd->password);
3293 vd->password = g_strdup(password);
3294
3295 return 0;
3296 }
3297
3298 int vnc_display_pw_expire(const char *id, time_t expires)
3299 {
3300 VncDisplay *vd = vnc_display_find(id);
3301
3302 if (!vd) {
3303 return -EINVAL;
3304 }
3305
3306 vd->expires = expires;
3307 return 0;
3308 }
3309
3310 static void vnc_display_print_local_addr(VncDisplay *vd)
3311 {
3312 SocketAddress *addr;
3313 Error *err = NULL;
3314
3315 if (!vd->listener || !vd->listener->nsioc) {
3316 return;
3317 }
3318
3319 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err);
3320 if (!addr) {
3321 return;
3322 }
3323
3324 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3325 qapi_free_SocketAddress(addr);
3326 return;
3327 }
3328 error_printf_unless_qmp("VNC server running on %s:%s\n",
3329 addr->u.inet.host,
3330 addr->u.inet.port);
3331 qapi_free_SocketAddress(addr);
3332 }
3333
3334 static QemuOptsList qemu_vnc_opts = {
3335 .name = "vnc",
3336 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3337 .implied_opt_name = "vnc",
3338 .desc = {
3339 {
3340 .name = "vnc",
3341 .type = QEMU_OPT_STRING,
3342 },{
3343 .name = "websocket",
3344 .type = QEMU_OPT_STRING,
3345 },{
3346 .name = "tls-creds",
3347 .type = QEMU_OPT_STRING,
3348 },{
3349 .name = "share",
3350 .type = QEMU_OPT_STRING,
3351 },{
3352 .name = "display",
3353 .type = QEMU_OPT_STRING,
3354 },{
3355 .name = "head",
3356 .type = QEMU_OPT_NUMBER,
3357 },{
3358 .name = "connections",
3359 .type = QEMU_OPT_NUMBER,
3360 },{
3361 .name = "to",
3362 .type = QEMU_OPT_NUMBER,
3363 },{
3364 .name = "ipv4",
3365 .type = QEMU_OPT_BOOL,
3366 },{
3367 .name = "ipv6",
3368 .type = QEMU_OPT_BOOL,
3369 },{
3370 .name = "password",
3371 .type = QEMU_OPT_BOOL,
3372 },{
3373 .name = "reverse",
3374 .type = QEMU_OPT_BOOL,
3375 },{
3376 .name = "lock-key-sync",
3377 .type = QEMU_OPT_BOOL,
3378 },{
3379 .name = "key-delay-ms",
3380 .type = QEMU_OPT_NUMBER,
3381 },{
3382 .name = "sasl",
3383 .type = QEMU_OPT_BOOL,
3384 },{
3385 .name = "acl",
3386 .type = QEMU_OPT_BOOL,
3387 },{
3388 .name = "lossy",
3389 .type = QEMU_OPT_BOOL,
3390 },{
3391 .name = "non-adaptive",
3392 .type = QEMU_OPT_BOOL,
3393 },
3394 { /* end of list */ }
3395 },
3396 };
3397
3398
3399 static int
3400 vnc_display_setup_auth(int *auth,
3401 int *subauth,
3402 QCryptoTLSCreds *tlscreds,
3403 bool password,
3404 bool sasl,
3405 bool websocket,
3406 Error **errp)
3407 {
3408 /*
3409 * We have a choice of 3 authentication options
3410 *
3411 * 1. none
3412 * 2. vnc
3413 * 3. sasl
3414 *
3415 * The channel can be run in 2 modes
3416 *
3417 * 1. clear
3418 * 2. tls
3419 *
3420 * And TLS can use 2 types of credentials
3421 *
3422 * 1. anon
3423 * 2. x509
3424 *
3425 * We thus have 9 possible logical combinations
3426 *
3427 * 1. clear + none
3428 * 2. clear + vnc
3429 * 3. clear + sasl
3430 * 4. tls + anon + none
3431 * 5. tls + anon + vnc
3432 * 6. tls + anon + sasl
3433 * 7. tls + x509 + none
3434 * 8. tls + x509 + vnc
3435 * 9. tls + x509 + sasl
3436 *
3437 * These need to be mapped into the VNC auth schemes
3438 * in an appropriate manner. In regular VNC, all the
3439 * TLS options get mapped into VNC_AUTH_VENCRYPT
3440 * sub-auth types.
3441 *
3442 * In websockets, the https:// protocol already provides
3443 * TLS support, so there is no need to make use of the
3444 * VeNCrypt extension. Furthermore, websockets browser
3445 * clients could not use VeNCrypt even if they wanted to,
3446 * as they cannot control when the TLS handshake takes
3447 * place. Thus there is no option but to rely on https://,
3448 * meaning combinations 4->6 and 7->9 will be mapped to
3449 * VNC auth schemes in the same way as combos 1->3.
3450 *
3451 * Regardless of fact that we have a different mapping to
3452 * VNC auth mechs for plain VNC vs websockets VNC, the end
3453 * result has the same security characteristics.
3454 */
3455 if (websocket || !tlscreds) {
3456 if (password) {
3457 VNC_DEBUG("Initializing VNC server with password auth\n");
3458 *auth = VNC_AUTH_VNC;
3459 } else if (sasl) {
3460 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3461 *auth = VNC_AUTH_SASL;
3462 } else {
3463 VNC_DEBUG("Initializing VNC server with no auth\n");
3464 *auth = VNC_AUTH_NONE;
3465 }
3466 *subauth = VNC_AUTH_INVALID;
3467 } else {
3468 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3469 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3470 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3471 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3472
3473 if (!is_x509 && !is_anon) {
3474 error_setg(errp,
3475 "Unsupported TLS cred type %s",
3476 object_get_typename(OBJECT(tlscreds)));
3477 return -1;
3478 }
3479 *auth = VNC_AUTH_VENCRYPT;
3480 if (password) {
3481 if (is_x509) {
3482 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3483 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3484 } else {
3485 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3486 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3487 }
3488
3489 } else if (sasl) {
3490 if (is_x509) {
3491 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3492 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3493 } else {
3494 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3495 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3496 }
3497 } else {
3498 if (is_x509) {
3499 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3500 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3501 } else {
3502 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3503 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3504 }
3505 }
3506 }
3507 return 0;
3508 }
3509
3510
3511 static int vnc_display_get_address(const char *addrstr,
3512 bool websocket,
3513 bool reverse,
3514 int displaynum,
3515 int to,
3516 bool has_ipv4,
3517 bool has_ipv6,
3518 bool ipv4,
3519 bool ipv6,
3520 SocketAddress **retaddr,
3521 Error **errp)
3522 {
3523 int ret = -1;
3524 SocketAddress *addr = NULL;
3525
3526 addr = g_new0(SocketAddress, 1);
3527
3528 if (strncmp(addrstr, "unix:", 5) == 0) {
3529 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3530 addr->u.q_unix.path = g_strdup(addrstr + 5);
3531
3532 if (websocket) {
3533 error_setg(errp, "UNIX sockets not supported with websock");
3534 goto cleanup;
3535 }
3536
3537 if (to) {
3538 error_setg(errp, "Port range not support with UNIX socket");
3539 goto cleanup;
3540 }
3541 ret = 0;
3542 } else {
3543 const char *port;
3544 size_t hostlen;
3545 unsigned long long baseport = 0;
3546 InetSocketAddress *inet;
3547
3548 port = strrchr(addrstr, ':');
3549 if (!port) {
3550 if (websocket) {
3551 hostlen = 0;
3552 port = addrstr;
3553 } else {
3554 error_setg(errp, "no vnc port specified");
3555 goto cleanup;
3556 }
3557 } else {
3558 hostlen = port - addrstr;
3559 port++;
3560 if (*port == '\0') {
3561 error_setg(errp, "vnc port cannot be empty");
3562 goto cleanup;
3563 }
3564 }
3565
3566 addr->type = SOCKET_ADDRESS_TYPE_INET;
3567 inet = &addr->u.inet;
3568 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3569 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3570 } else {
3571 inet->host = g_strndup(addrstr, hostlen);
3572 }
3573 /* plain VNC port is just an offset, for websocket
3574 * port is absolute */
3575 if (websocket) {
3576 if (g_str_equal(addrstr, "") ||
3577 g_str_equal(addrstr, "on")) {
3578 if (displaynum == -1) {
3579 error_setg(errp, "explicit websocket port is required");
3580 goto cleanup;
3581 }
3582 inet->port = g_strdup_printf(
3583 "%d", displaynum + 5700);
3584 if (to) {
3585 inet->has_to = true;
3586 inet->to = to + 5700;
3587 }
3588 } else {
3589 inet->port = g_strdup(port);
3590 }
3591 } else {
3592 int offset = reverse ? 0 : 5900;
3593 if (parse_uint_full(port, &baseport, 10) < 0) {
3594 error_setg(errp, "can't convert to a number: %s", port);
3595 goto cleanup;
3596 }
3597 if (baseport > 65535 ||
3598 baseport + offset > 65535) {
3599 error_setg(errp, "port %s out of range", port);
3600 goto cleanup;
3601 }
3602 inet->port = g_strdup_printf(
3603 "%d", (int)baseport + offset);
3604
3605 if (to) {
3606 inet->has_to = true;
3607 inet->to = to + offset;
3608 }
3609 }
3610
3611 inet->ipv4 = ipv4;
3612 inet->has_ipv4 = has_ipv4;
3613 inet->ipv6 = ipv6;
3614 inet->has_ipv6 = has_ipv6;
3615
3616 ret = baseport;
3617 }
3618
3619 *retaddr = addr;
3620
3621 cleanup:
3622 if (ret < 0) {
3623 qapi_free_SocketAddress(addr);
3624 }
3625 return ret;
3626 }
3627
3628 static void vnc_free_addresses(SocketAddress ***retsaddr,
3629 size_t *retnsaddr)
3630 {
3631 size_t i;
3632
3633 for (i = 0; i < *retnsaddr; i++) {
3634 qapi_free_SocketAddress((*retsaddr)[i]);
3635 }
3636 g_free(*retsaddr);
3637
3638 *retsaddr = NULL;
3639 *retnsaddr = 0;
3640 }
3641
3642 static int vnc_display_get_addresses(QemuOpts *opts,
3643 bool reverse,
3644 SocketAddress ***retsaddr,
3645 size_t *retnsaddr,
3646 SocketAddress ***retwsaddr,
3647 size_t *retnwsaddr,
3648 Error **errp)
3649 {
3650 SocketAddress *saddr = NULL;
3651 SocketAddress *wsaddr = NULL;
3652 QemuOptsIter addriter;
3653 const char *addr;
3654 int to = qemu_opt_get_number(opts, "to", 0);
3655 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3656 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3657 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3658 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3659 int displaynum = -1;
3660 int ret = -1;
3661
3662 *retsaddr = NULL;
3663 *retnsaddr = 0;
3664 *retwsaddr = NULL;
3665 *retnwsaddr = 0;
3666
3667 addr = qemu_opt_get(opts, "vnc");
3668 if (addr == NULL || g_str_equal(addr, "none")) {
3669 ret = 0;
3670 goto cleanup;
3671 }
3672 if (qemu_opt_get(opts, "websocket") &&
3673 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3674 error_setg(errp,
3675 "SHA1 hash support is required for websockets");
3676 goto cleanup;
3677 }
3678
3679 qemu_opt_iter_init(&addriter, opts, "vnc");
3680 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3681 int rv;
3682 rv = vnc_display_get_address(addr, false, reverse, 0, to,
3683 has_ipv4, has_ipv6,
3684 ipv4, ipv6,
3685 &saddr, errp);
3686 if (rv < 0) {
3687 goto cleanup;
3688 }
3689 /* Historical compat - first listen address can be used
3690 * to set the default websocket port
3691 */
3692 if (displaynum == -1) {
3693 displaynum = rv;
3694 }
3695 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3696 (*retsaddr)[(*retnsaddr)++] = saddr;
3697 }
3698
3699 /* If we had multiple primary displays, we don't do defaults
3700 * for websocket, and require explicit config instead. */
3701 if (*retnsaddr > 1) {
3702 displaynum = -1;
3703 }
3704
3705 qemu_opt_iter_init(&addriter, opts, "websocket");
3706 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3707 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3708 has_ipv4, has_ipv6,
3709 ipv4, ipv6,
3710 &wsaddr, errp) < 0) {
3711 goto cleanup;
3712 }
3713
3714 /* Historical compat - if only a single listen address was
3715 * provided, then this is used to set the default listen
3716 * address for websocket too
3717 */
3718 if (*retnsaddr == 1 &&
3719 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3720 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3721 g_str_equal(wsaddr->u.inet.host, "") &&
3722 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3723 g_free(wsaddr->u.inet.host);
3724 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3725 }
3726
3727 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3728 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3729 }
3730
3731 ret = 0;
3732 cleanup:
3733 if (ret < 0) {
3734 vnc_free_addresses(retsaddr, retnsaddr);
3735 vnc_free_addresses(retwsaddr, retnwsaddr);
3736 }
3737 return ret;
3738 }
3739
3740 static int vnc_display_connect(VncDisplay *vd,
3741 SocketAddress **saddr,
3742 size_t nsaddr,
3743 SocketAddress **wsaddr,
3744 size_t nwsaddr,
3745 Error **errp)
3746 {
3747 /* connect to viewer */
3748 QIOChannelSocket *sioc = NULL;
3749 if (nwsaddr != 0) {
3750 error_setg(errp, "Cannot use websockets in reverse mode");
3751 return -1;
3752 }
3753 if (nsaddr != 1) {
3754 error_setg(errp, "Expected a single address in reverse mode");
3755 return -1;
3756 }
3757 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3758 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3759 sioc = qio_channel_socket_new();
3760 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3761 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3762 return -1;
3763 }
3764 vnc_connect(vd, sioc, false, false);
3765 object_unref(OBJECT(sioc));
3766 return 0;
3767 }
3768
3769
3770 static int vnc_display_listen(VncDisplay *vd,
3771 SocketAddress **saddr,
3772 size_t nsaddr,
3773 SocketAddress **wsaddr,
3774 size_t nwsaddr,
3775 Error **errp)
3776 {
3777 size_t i;
3778
3779 if (nsaddr) {
3780 vd->listener = qio_net_listener_new();
3781 qio_net_listener_set_name(vd->listener, "vnc-listen");
3782 for (i = 0; i < nsaddr; i++) {
3783 if (qio_net_listener_open_sync(vd->listener,
3784 saddr[i],
3785 errp) < 0) {
3786 return -1;
3787 }
3788 }
3789
3790 qio_net_listener_set_client_func(vd->listener,
3791 vnc_listen_io, vd, NULL);
3792 }
3793
3794 if (nwsaddr) {
3795 vd->wslistener = qio_net_listener_new();
3796 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
3797 for (i = 0; i < nwsaddr; i++) {
3798 if (qio_net_listener_open_sync(vd->wslistener,
3799 wsaddr[i],
3800 errp) < 0) {
3801 return -1;
3802 }
3803 }
3804
3805 qio_net_listener_set_client_func(vd->wslistener,
3806 vnc_listen_io, vd, NULL);
3807 }
3808
3809 return 0;
3810 }
3811
3812
3813 void vnc_display_open(const char *id, Error **errp)
3814 {
3815 VncDisplay *vd = vnc_display_find(id);
3816 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3817 SocketAddress **saddr = NULL, **wsaddr = NULL;
3818 size_t nsaddr, nwsaddr;
3819 const char *share, *device_id;
3820 QemuConsole *con;
3821 bool password = false;
3822 bool reverse = false;
3823 const char *credid;
3824 bool sasl = false;
3825 #ifdef CONFIG_VNC_SASL
3826 int saslErr;
3827 #endif
3828 int acl = 0;
3829 int lock_key_sync = 1;
3830 int key_delay_ms;
3831
3832 if (!vd) {
3833 error_setg(errp, "VNC display not active");
3834 return;
3835 }
3836 vnc_display_close(vd);
3837
3838 if (!opts) {
3839 return;
3840 }
3841
3842 reverse = qemu_opt_get_bool(opts, "reverse", false);
3843 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3844 &wsaddr, &nwsaddr, errp) < 0) {
3845 goto fail;
3846 }
3847
3848 password = qemu_opt_get_bool(opts, "password", false);
3849 if (password) {
3850 if (fips_get_state()) {
3851 error_setg(errp,
3852 "VNC password auth disabled due to FIPS mode, "
3853 "consider using the VeNCrypt or SASL authentication "
3854 "methods as an alternative");
3855 goto fail;
3856 }
3857 if (!qcrypto_cipher_supports(
3858 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3859 error_setg(errp,
3860 "Cipher backend does not support DES RFB algorithm");
3861 goto fail;
3862 }
3863 }
3864
3865 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3866 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3867 sasl = qemu_opt_get_bool(opts, "sasl", false);
3868 #ifndef CONFIG_VNC_SASL
3869 if (sasl) {
3870 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3871 goto fail;
3872 }
3873 #endif /* CONFIG_VNC_SASL */
3874 credid = qemu_opt_get(opts, "tls-creds");
3875 if (credid) {
3876 Object *creds;
3877 creds = object_resolve_path_component(
3878 object_get_objects_root(), credid);
3879 if (!creds) {
3880 error_setg(errp, "No TLS credentials with id '%s'",
3881 credid);
3882 goto fail;
3883 }
3884 vd->tlscreds = (QCryptoTLSCreds *)
3885 object_dynamic_cast(creds,
3886 TYPE_QCRYPTO_TLS_CREDS);
3887 if (!vd->tlscreds) {
3888 error_setg(errp, "Object with id '%s' is not TLS credentials",
3889 credid);
3890 goto fail;
3891 }
3892 object_ref(OBJECT(vd->tlscreds));
3893
3894 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3895 error_setg(errp,
3896 "Expecting TLS credentials with a server endpoint");
3897 goto fail;
3898 }
3899 }
3900 acl = qemu_opt_get_bool(opts, "acl", false);
3901
3902 share = qemu_opt_get(opts, "share");
3903 if (share) {
3904 if (strcmp(share, "ignore") == 0) {
3905 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3906 } else if (strcmp(share, "allow-exclusive") == 0) {
3907 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3908 } else if (strcmp(share, "force-shared") == 0) {
3909 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3910 } else {
3911 error_setg(errp, "unknown vnc share= option");
3912 goto fail;
3913 }
3914 } else {
3915 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3916 }
3917 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3918
3919 #ifdef CONFIG_VNC_JPEG
3920 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3921 #endif
3922 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3923 /* adaptive updates are only used with tight encoding and
3924 * if lossy updates are enabled so we can disable all the
3925 * calculations otherwise */
3926 if (!vd->lossy) {
3927 vd->non_adaptive = true;
3928 }
3929
3930 if (acl) {
3931 if (strcmp(vd->id, "default") == 0) {
3932 vd->tlsaclname = g_strdup("vnc.x509dname");
3933 } else {
3934 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3935 }
3936 qemu_acl_init(vd->tlsaclname);
3937 }
3938 #ifdef CONFIG_VNC_SASL
3939 if (acl && sasl) {
3940 char *aclname;
3941
3942 if (strcmp(vd->id, "default") == 0) {
3943 aclname = g_strdup("vnc.username");
3944 } else {
3945 aclname = g_strdup_printf("vnc.%s.username", vd->id);
3946 }
3947 vd->sasl.acl = qemu_acl_init(aclname);
3948 g_free(aclname);
3949 }
3950 #endif
3951
3952 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3953 vd->tlscreds, password,
3954 sasl, false, errp) < 0) {
3955 goto fail;
3956 }
3957 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
3958
3959 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3960 vd->tlscreds, password,
3961 sasl, true, errp) < 0) {
3962 goto fail;
3963 }
3964 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
3965
3966 #ifdef CONFIG_VNC_SASL
3967 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3968 error_setg(errp, "Failed to initialize SASL auth: %s",
3969 sasl_errstring(saslErr, NULL, NULL));
3970 goto fail;
3971 }
3972 #endif
3973 vd->lock_key_sync = lock_key_sync;
3974 if (lock_key_sync) {
3975 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3976 }
3977 vd->ledstate = 0;
3978 vd->key_delay_ms = key_delay_ms;
3979
3980 device_id = qemu_opt_get(opts, "display");
3981 if (device_id) {
3982 int head = qemu_opt_get_number(opts, "head", 0);
3983 Error *err = NULL;
3984
3985 con = qemu_console_lookup_by_device_name(device_id, head, &err);
3986 if (err) {
3987 error_propagate(errp, err);
3988 goto fail;
3989 }
3990 } else {
3991 con = NULL;
3992 }
3993
3994 if (con != vd->dcl.con) {
3995 unregister_displaychangelistener(&vd->dcl);
3996 vd->dcl.con = con;
3997 register_displaychangelistener(&vd->dcl);
3998 }
3999
4000 if (saddr == NULL) {
4001 goto cleanup;
4002 }
4003
4004 if (reverse) {
4005 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4006 goto fail;
4007 }
4008 } else {
4009 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4010 goto fail;
4011 }
4012 }
4013
4014 if (qemu_opt_get(opts, "to")) {
4015 vnc_display_print_local_addr(vd);
4016 }
4017
4018 cleanup:
4019 vnc_free_addresses(&saddr, &nsaddr);
4020 vnc_free_addresses(&wsaddr, &nwsaddr);
4021 return;
4022
4023 fail:
4024 vnc_display_close(vd);
4025 goto cleanup;
4026 }
4027
4028 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4029 {
4030 VncDisplay *vd = vnc_display_find(id);
4031 QIOChannelSocket *sioc;
4032
4033 if (!vd) {
4034 return;
4035 }
4036
4037 sioc = qio_channel_socket_new_fd(csock, NULL);
4038 if (sioc) {
4039 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4040 vnc_connect(vd, sioc, skipauth, false);
4041 object_unref(OBJECT(sioc));
4042 }
4043 }
4044
4045 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4046 {
4047 int i = 2;
4048 char *id;
4049
4050 id = g_strdup("default");
4051 while (qemu_opts_find(olist, id)) {
4052 g_free(id);
4053 id = g_strdup_printf("vnc%d", i++);
4054 }
4055 qemu_opts_set_id(opts, id);
4056 }
4057
4058 QemuOpts *vnc_parse(const char *str, Error **errp)
4059 {
4060 QemuOptsList *olist = qemu_find_opts("vnc");
4061 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4062 const char *id;
4063
4064 if (!opts) {
4065 return NULL;
4066 }
4067
4068 id = qemu_opts_id(opts);
4069 if (!id) {
4070 /* auto-assign id if not present */
4071 vnc_auto_assign_id(olist, opts);
4072 }
4073 return opts;
4074 }
4075
4076 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4077 {
4078 Error *local_err = NULL;
4079 char *id = (char *)qemu_opts_id(opts);
4080
4081 assert(id);
4082 vnc_display_init(id);
4083 vnc_display_open(id, &local_err);
4084 if (local_err != NULL) {
4085 error_reportf_err(local_err, "Failed to start VNC server: ");
4086 exit(1);
4087 }
4088 return 0;
4089 }
4090
4091 static void vnc_register_config(void)
4092 {
4093 qemu_add_opts(&qemu_vnc_opts);
4094 }
4095 opts_init(vnc_register_config);
AR7 emulation for QEMU