vnc.c 78.4 KB
Newer Older
B
bellard 已提交
1 2
/*
 * QEMU VNC display driver
3
 *
B
bellard 已提交
4 5
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
B
bellard 已提交
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

27
#include "vnc.h"
C
Corentin Chary 已提交
28
#include "vnc-jobs.h"
P
pbrook 已提交
29
#include "sysemu.h"
B
bellard 已提交
30
#include "qemu_socket.h"
P
pbrook 已提交
31
#include "qemu-timer.h"
32
#include "acl.h"
33
#include "qemu-objects.h"
B
bellard 已提交
34

S
Stefano Stabellini 已提交
35 36 37
#define VNC_REFRESH_INTERVAL_BASE 30
#define VNC_REFRESH_INTERVAL_INC  50
#define VNC_REFRESH_INTERVAL_MAX  2000
B
bellard 已提交
38 39

#include "vnc_keysym.h"
40 41
#include "d3des.h"

42 43 44 45 46 47
#define count_bits(c, v) { \
    for (c = 0; v; v >>= 1) \
    { \
        c += v & 1; \
    } \
}
48

49
static VncDisplay *vnc_display; /* needed for info vnc */
50
static DisplayChangeListener *dcl;
B
bellard 已提交
51

G
Gerd Hoffmann 已提交
52 53
static int vnc_cursor_define(VncState *vs);

54 55 56 57 58 59 60
static char *addr_to_string(const char *format,
                            struct sockaddr_storage *sa,
                            socklen_t salen) {
    char *addr;
    char host[NI_MAXHOST];
    char serv[NI_MAXSERV];
    int err;
61
    size_t addrlen;
62 63 64 65 66 67 68 69 70 71

    if ((err = getnameinfo((struct sockaddr *)sa, salen,
                           host, sizeof(host),
                           serv, sizeof(serv),
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
        VNC_DEBUG("Cannot resolve address %d: %s\n",
                  err, gai_strerror(err));
        return NULL;
    }

72
    /* Enough for the existing format + the 2 vars we're
S
Stefan Weil 已提交
73
     * substituting in. */
74 75 76 77
    addrlen = strlen(format) + strlen(host) + strlen(serv);
    addr = qemu_malloc(addrlen + 1);
    snprintf(addr, addrlen, format, host, serv);
    addr[addrlen] = '\0';
78 79 80 81

    return addr;
}

82 83

char *vnc_socket_local_addr(const char *format, int fd) {
84 85 86 87 88 89 90 91 92 93
    struct sockaddr_storage sa;
    socklen_t salen;

    salen = sizeof(sa);
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
        return NULL;

    return addr_to_string(format, &sa, salen);
}

94
char *vnc_socket_remote_addr(const char *format, int fd) {
95 96 97 98 99 100 101 102 103 104
    struct sockaddr_storage sa;
    socklen_t salen;

    salen = sizeof(sa);
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
        return NULL;

    return addr_to_string(format, &sa, salen);
}

105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122
static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
                          socklen_t salen)
{
    char host[NI_MAXHOST];
    char serv[NI_MAXSERV];
    int err;

    if ((err = getnameinfo((struct sockaddr *)sa, salen,
                           host, sizeof(host),
                           serv, sizeof(serv),
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
        VNC_DEBUG("Cannot resolve address %d: %s\n",
                  err, gai_strerror(err));
        return -1;
    }

    qdict_put(qdict, "host", qstring_from_str(host));
    qdict_put(qdict, "service", qstring_from_str(serv));
L
Luiz Capitulino 已提交
123
    qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
124 125 126 127

    return 0;
}

L
Luiz Capitulino 已提交
128
static int vnc_server_addr_put(QDict *qdict, int fd)
129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153
{
    struct sockaddr_storage sa;
    socklen_t salen;

    salen = sizeof(sa);
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
        return -1;
    }

    return put_addr_qdict(qdict, &sa, salen);
}

static int vnc_qdict_remote_addr(QDict *qdict, int fd)
{
    struct sockaddr_storage sa;
    socklen_t salen;

    salen = sizeof(sa);
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
        return -1;
    }

    return put_addr_qdict(qdict, &sa, salen);
}

154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188
static const char *vnc_auth_name(VncDisplay *vd) {
    switch (vd->auth) {
    case VNC_AUTH_INVALID:
        return "invalid";
    case VNC_AUTH_NONE:
        return "none";
    case VNC_AUTH_VNC:
        return "vnc";
    case VNC_AUTH_RA2:
        return "ra2";
    case VNC_AUTH_RA2NE:
        return "ra2ne";
    case VNC_AUTH_TIGHT:
        return "tight";
    case VNC_AUTH_ULTRA:
        return "ultra";
    case VNC_AUTH_TLS:
        return "tls";
    case VNC_AUTH_VENCRYPT:
#ifdef CONFIG_VNC_TLS
        switch (vd->subauth) {
        case VNC_AUTH_VENCRYPT_PLAIN:
            return "vencrypt+plain";
        case VNC_AUTH_VENCRYPT_TLSNONE:
            return "vencrypt+tls+none";
        case VNC_AUTH_VENCRYPT_TLSVNC:
            return "vencrypt+tls+vnc";
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
            return "vencrypt+tls+plain";
        case VNC_AUTH_VENCRYPT_X509NONE:
            return "vencrypt+x509+none";
        case VNC_AUTH_VENCRYPT_X509VNC:
            return "vencrypt+x509+vnc";
        case VNC_AUTH_VENCRYPT_X509PLAIN:
            return "vencrypt+x509+plain";
189 190 191 192
        case VNC_AUTH_VENCRYPT_TLSSASL:
            return "vencrypt+tls+sasl";
        case VNC_AUTH_VENCRYPT_X509SASL:
            return "vencrypt+x509+sasl";
193 194 195 196 197 198
        default:
            return "vencrypt";
        }
#else
        return "vencrypt";
#endif
199
    case VNC_AUTH_SASL:
200
        return "sasl";
201 202 203 204
    }
    return "unknown";
}

L
Luiz Capitulino 已提交
205 206 207 208 209 210 211 212 213 214
static int vnc_server_info_put(QDict *qdict)
{
    if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
        return -1;
    }

    qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
    return 0;
}

215
static void vnc_client_cache_auth(VncState *client)
216
{
217
    QDict *qdict;
218

219 220
    if (!client->info) {
        return;
221
    }
222

223 224
    qdict = qobject_to_qdict(client->info);

225 226
#ifdef CONFIG_VNC_TLS
    if (client->tls.session &&
227 228 229
        client->tls.dname) {
        qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
    }
230 231 232
#endif
#ifdef CONFIG_VNC_SASL
    if (client->sasl.conn &&
233
        client->sasl.username) {
234 235
        qdict_put(qdict, "sasl_username",
                  qstring_from_str(client->sasl.username));
236
    }
237
#endif
238
}
239

240 241 242 243 244 245 246 247 248 249 250 251
static void vnc_client_cache_addr(VncState *client)
{
    QDict *qdict;

    qdict = qdict_new();
    if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
        QDECREF(qdict);
        /* XXX: how to report the error? */
        return;
    }

    client->info = QOBJECT(qdict);
252 253
}

254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277
static void vnc_qmp_event(VncState *vs, MonitorEvent event)
{
    QDict *server;
    QObject *data;

    if (!vs->info) {
        return;
    }

    server = qdict_new();
    if (vnc_server_info_put(server) < 0) {
        QDECREF(server);
        return;
    }

    data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
                              vs->info, QOBJECT(server));

    monitor_protocol_event(event, data);

    qobject_incref(vs->info);
    qobject_decref(data);
}

278
static void info_vnc_iter(QObject *obj, void *opaque)
B
bellard 已提交
279
{
280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295
    QDict *client;
    Monitor *mon = opaque;

    client = qobject_to_qdict(obj);
    monitor_printf(mon, "Client:\n");
    monitor_printf(mon, "     address: %s:%s\n",
                   qdict_get_str(client, "host"),
                   qdict_get_str(client, "service"));

#ifdef CONFIG_VNC_TLS
    monitor_printf(mon, "  x509_dname: %s\n",
        qdict_haskey(client, "x509_dname") ?
        qdict_get_str(client, "x509_dname") : "none");
#endif
#ifdef CONFIG_VNC_SASL
    monitor_printf(mon, "    username: %s\n",
296 297
        qdict_haskey(client, "sasl_username") ?
        qdict_get_str(client, "sasl_username") : "none");
298 299 300 301 302 303 304 305 306
#endif
}

void do_info_vnc_print(Monitor *mon, const QObject *data)
{
    QDict *server;
    QList *clients;

    server = qobject_to_qdict(data);
307
    if (qdict_get_bool(server, "enabled") == 0) {
308
        monitor_printf(mon, "Server: disabled\n");
309 310
        return;
    }
311

312 313 314 315
    monitor_printf(mon, "Server:\n");
    monitor_printf(mon, "     address: %s:%s\n",
                   qdict_get_str(server, "host"),
                   qdict_get_str(server, "service"));
L
Luiz Capitulino 已提交
316
    monitor_printf(mon, "        auth: %s\n", qdict_get_str(server, "auth"));
317 318 319 320 321 322 323 324

    clients = qdict_get_qlist(server, "clients");
    if (qlist_empty(clients)) {
        monitor_printf(mon, "Client: none\n");
    } else {
        qlist_iter(clients, info_vnc_iter, mon);
    }
}
325

326 327 328
void do_info_vnc(Monitor *mon, QObject **ret_data)
{
    if (vnc_display == NULL || vnc_display->display == NULL) {
329
        *ret_data = qobject_from_jsonf("{ 'enabled': false }");
330 331
    } else {
        QList *clist;
332
        VncState *client;
333

334
        clist = qlist_new();
335 336 337 338 339
        QTAILQ_FOREACH(client, &vnc_display->clients, next) {
            if (client->info) {
                /* incref so that it's not freed by upper layers */
                qobject_incref(client->info);
                qlist_append_obj(clist, client->info);
340
            }
341 342
        }

343
        *ret_data = qobject_from_jsonf("{ 'enabled': true, 'clients': %p }",
344 345 346
                                       QOBJECT(clist));
        assert(*ret_data != NULL);

L
Luiz Capitulino 已提交
347
        if (vnc_server_info_put(qobject_to_qdict(*ret_data)) < 0) {
348 349
            qobject_decref(*ret_data);
            *ret_data = NULL;
350
        }
B
bellard 已提交
351 352 353
    }
}

B
bellard 已提交
354 355 356 357 358 359 360
/* TODO
   1) Get the queue working for IO.
   2) there is some weirdness when using the -S option (the screen is grey
      and not totally invalidated
   3) resolutions > 1024
*/

S
Stefano Stabellini 已提交
361
static int vnc_update_client(VncState *vs, int has_dirty);
C
Corentin Chary 已提交
362
static int vnc_update_client_sync(VncState *vs, int has_dirty);
363 364
static void vnc_disconnect_start(VncState *vs);
static void vnc_disconnect_finish(VncState *vs);
365 366
static void vnc_init_timer(VncDisplay *vd);
static void vnc_remove_timer(VncDisplay *vd);
B
bellard 已提交
367

368
static void vnc_colordepth(VncState *vs);
S
Stefano Stabellini 已提交
369 370 371 372 373
static void framebuffer_update_request(VncState *vs, int incremental,
                                       int x_position, int y_position,
                                       int w, int h);
static void vnc_refresh(void *opaque);
static int vnc_refresh_server_surface(VncDisplay *vd);
374

B
bellard 已提交
375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393
static inline void vnc_set_bit(uint32_t *d, int k)
{
    d[k >> 5] |= 1 << (k & 0x1f);
}

static inline void vnc_clear_bit(uint32_t *d, int k)
{
    d[k >> 5] &= ~(1 << (k & 0x1f));
}

static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
{
    int j;

    j = 0;
    while (n >= 32) {
        d[j++] = -1;
        n -= 32;
    }
394
    if (n > 0)
B
bellard 已提交
395 396 397 398 399 400 401 402 403 404
        d[j++] = (1 << n) - 1;
    while (j < nb_words)
        d[j++] = 0;
}

static inline int vnc_get_bit(const uint32_t *d, int k)
{
    return (d[k >> 5] >> (k & 0x1f)) & 1;
}

405
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
B
bellard 已提交
406 407 408 409 410 411 412 413 414 415
                               int nb_words)
{
    int i;
    for(i = 0; i < nb_words; i++) {
        if ((d1[i] & d2[i]) != 0)
            return 1;
    }
    return 0;
}

S
Stefano Stabellini 已提交
416
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
B
bellard 已提交
417 418
{
    int i;
S
Stefano Stabellini 已提交
419 420
    VncDisplay *vd = ds->opaque;
    struct VncSurface *s = &vd->guest;
B
bellard 已提交
421 422 423

    h += y;

424 425 426 427 428 429 430
    /* round x down to ensure the loop only spans one 16-pixel block per,
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
       two 16-pixel blocks but we only mark the first as dirty
    */
    w += (x % 16);
    x -= (x % 16);

431 432 433 434
    x = MIN(x, s->ds->width);
    y = MIN(y, s->ds->height);
    w = MIN(x + w, s->ds->width) - x;
    h = MIN(h, s->ds->height);
435

B
bellard 已提交
436
    for (; y < h; y++)
437
        for (i = 0; i < w; i += 16)
438
            vnc_set_bit(s->dirty[y], (x + i) / 16);
B
bellard 已提交
439 440
}

441 442
void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
                            int32_t encoding)
B
bellard 已提交
443 444 445 446 447 448 449 450 451
{
    vnc_write_u16(vs, x);
    vnc_write_u16(vs, y);
    vnc_write_u16(vs, w);
    vnc_write_u16(vs, h);

    vnc_write_s32(vs, encoding);
}

452
void buffer_reserve(Buffer *buffer, size_t len)
453 454
{
    if ((buffer->capacity - buffer->offset) < len) {
455 456 457 458 459 460
        buffer->capacity += (len + 1024);
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
        if (buffer->buffer == NULL) {
            fprintf(stderr, "vnc: out of memory\n");
            exit(1);
        }
461 462 463
    }
}

464
int buffer_empty(Buffer *buffer)
465 466 467 468
{
    return buffer->offset == 0;
}

469
uint8_t *buffer_end(Buffer *buffer)
470 471 472 473
{
    return buffer->buffer + buffer->offset;
}

474
void buffer_reset(Buffer *buffer)
475
{
476
        buffer->offset = 0;
477 478
}

C
Corentin Chary 已提交
479 480 481 482 483 484 485 486
void buffer_free(Buffer *buffer)
{
    qemu_free(buffer->buffer);
    buffer->offset = 0;
    buffer->capacity = 0;
    buffer->buffer = NULL;
}

487
void buffer_append(Buffer *buffer, const void *data, size_t len)
488 489 490 491 492
{
    memcpy(buffer->buffer + buffer->offset, data, len);
    buffer->offset += len;
}

493 494 495 496 497 498 499
static void vnc_desktop_resize(VncState *vs)
{
    DisplayState *ds = vs->ds;

    if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
        return;
    }
500 501 502 503
    if (vs->client_width == ds_get_width(ds) &&
        vs->client_height == ds_get_height(ds)) {
        return;
    }
504 505
    vs->client_width = ds_get_width(ds);
    vs->client_height = ds_get_height(ds);
C
Corentin Chary 已提交
506
    vnc_lock_output(vs);
507 508 509
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
    vnc_write_u8(vs, 0);
    vnc_write_u16(vs, 1); /* number of rects */
510
    vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
511
                           VNC_ENCODING_DESKTOPRESIZE);
C
Corentin Chary 已提交
512
    vnc_unlock_output(vs);
513 514 515
    vnc_flush(vs);
}

C
Corentin Chary 已提交
516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540
#ifdef CONFIG_VNC_THREAD
static void vnc_abort_display_jobs(VncDisplay *vd)
{
    VncState *vs;

    QTAILQ_FOREACH(vs, &vd->clients, next) {
        vnc_lock_output(vs);
        vs->abort = true;
        vnc_unlock_output(vs);
    }
    QTAILQ_FOREACH(vs, &vd->clients, next) {
        vnc_jobs_join(vs);
    }
    QTAILQ_FOREACH(vs, &vd->clients, next) {
        vnc_lock_output(vs);
        vs->abort = false;
        vnc_unlock_output(vs);
    }
}
#else
static void vnc_abort_display_jobs(VncDisplay *vd)
{
}
#endif

S
Stefano Stabellini 已提交
541
static void vnc_dpy_resize(DisplayState *ds)
B
bellard 已提交
542
{
S
Stefano Stabellini 已提交
543
    VncDisplay *vd = ds->opaque;
544
    VncState *vs;
S
Stefano Stabellini 已提交
545

C
Corentin Chary 已提交
546 547
    vnc_abort_display_jobs(vd);

S
Stefano Stabellini 已提交
548 549 550 551 552 553 554 555
    /* server surface */
    if (!vd->server)
        vd->server = qemu_mallocz(sizeof(*vd->server));
    if (vd->server->data)
        qemu_free(vd->server->data);
    *(vd->server) = *(ds->surface);
    vd->server->data = qemu_mallocz(vd->server->linesize *
                                    vd->server->height);
B
bellard 已提交
556

557
    /* guest surface */
S
Stefano Stabellini 已提交
558 559 560
    if (!vd->guest.ds)
        vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
    if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
561
        console_color_init(ds);
S
Stefano Stabellini 已提交
562 563
    *(vd->guest.ds) = *(ds->surface);
    memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
B
bellard 已提交
564

565
    QTAILQ_FOREACH(vs, &vd->clients, next) {
S
Stefano Stabellini 已提交
566
        vnc_colordepth(vs);
567
        vnc_desktop_resize(vs);
G
Gerd Hoffmann 已提交
568 569 570
        if (vs->vd->cursor) {
            vnc_cursor_define(vs);
        }
S
Stefano Stabellini 已提交
571
        memset(vs->dirty, 0xFF, sizeof(vs->dirty));
572 573 574
    }
}

B
bellard 已提交
575
/* fastest code */
G
Gerd Hoffmann 已提交
576 577
static void vnc_write_pixels_copy(VncState *vs, struct PixelFormat *pf,
                                  void *pixels, int size)
B
bellard 已提交
578 579 580 581 582
{
    vnc_write(vs, pixels, size);
}

/* slowest but generic code. */
583
void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
B
bellard 已提交
584
{
585
    uint8_t r, g, b;
S
Stefano Stabellini 已提交
586 587 588 589 590 591 592 593
    VncDisplay *vd = vs->vd;

    r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
        vd->server->pf.rbits);
    g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
        vd->server->pf.gbits);
    b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
        vd->server->pf.bbits);
594 595 596 597
    v = (r << vs->clientds.pf.rshift) |
        (g << vs->clientds.pf.gshift) |
        (b << vs->clientds.pf.bshift);
    switch(vs->clientds.pf.bytes_per_pixel) {
B
bellard 已提交
598 599 600 601
    case 1:
        buf[0] = v;
        break;
    case 2:
602
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
B
bellard 已提交
603 604 605 606 607 608 609 610 611
            buf[0] = v >> 8;
            buf[1] = v;
        } else {
            buf[1] = v >> 8;
            buf[0] = v;
        }
        break;
    default:
    case 4:
612
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
B
bellard 已提交
613 614 615 616 617 618 619 620 621 622 623 624 625 626
            buf[0] = v >> 24;
            buf[1] = v >> 16;
            buf[2] = v >> 8;
            buf[3] = v;
        } else {
            buf[3] = v >> 24;
            buf[2] = v >> 16;
            buf[1] = v >> 8;
            buf[0] = v;
        }
        break;
    }
}

G
Gerd Hoffmann 已提交
627 628
static void vnc_write_pixels_generic(VncState *vs, struct PixelFormat *pf,
                                     void *pixels1, int size)
B
bellard 已提交
629 630 631
{
    uint8_t buf[4];

G
Gerd Hoffmann 已提交
632
    if (pf->bytes_per_pixel == 4) {
633 634 635 636 637
        uint32_t *pixels = pixels1;
        int n, i;
        n = size >> 2;
        for(i = 0; i < n; i++) {
            vnc_convert_pixel(vs, buf, pixels[i]);
638
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
639
        }
G
Gerd Hoffmann 已提交
640
    } else if (pf->bytes_per_pixel == 2) {
641 642 643 644 645
        uint16_t *pixels = pixels1;
        int n, i;
        n = size >> 1;
        for(i = 0; i < n; i++) {
            vnc_convert_pixel(vs, buf, pixels[i]);
646
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
647
        }
G
Gerd Hoffmann 已提交
648
    } else if (pf->bytes_per_pixel == 1) {
649 650 651 652 653
        uint8_t *pixels = pixels1;
        int n, i;
        n = size;
        for(i = 0; i < n; i++) {
            vnc_convert_pixel(vs, buf, pixels[i]);
654
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
655 656 657
        }
    } else {
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
B
bellard 已提交
658 659 660
    }
}

661
int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
B
bellard 已提交
662 663
{
    int i;
T
ths 已提交
664
    uint8_t *row;
S
Stefano Stabellini 已提交
665
    VncDisplay *vd = vs->vd;
B
bellard 已提交
666

S
Stefano Stabellini 已提交
667
    row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
B
bellard 已提交
668
    for (i = 0; i < h; i++) {
G
Gerd Hoffmann 已提交
669
        vs->write_pixels(vs, &vd->server->pf, row, w * ds_get_bytes_per_pixel(vs->ds));
670
        row += ds_get_linesize(vs->ds);
B
bellard 已提交
671
    }
672
    return 1;
B
bellard 已提交
673 674
}

C
Corentin Chary 已提交
675
int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
B
bellard 已提交
676
{
677 678
    int n = 0;

679
    switch(vs->vnc_encoding) {
680
        case VNC_ENCODING_ZLIB:
681
            n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
682 683 684
            break;
        case VNC_ENCODING_HEXTILE:
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
685
            n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
686
            break;
C
Corentin Chary 已提交
687 688 689
        case VNC_ENCODING_TIGHT:
            n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
            break;
C
Corentin Chary 已提交
690 691 692
        case VNC_ENCODING_TIGHT_PNG:
            n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
            break;
693 694
        default:
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
695
            n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
696
            break;
697
    }
698
    return n;
B
bellard 已提交
699 700
}

701
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
B
bellard 已提交
702
{
703
    /* send bitblit op to the vnc client */
C
Corentin Chary 已提交
704
    vnc_lock_output(vs);
705
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
B
bellard 已提交
706 707
    vnc_write_u8(vs, 0);
    vnc_write_u16(vs, 1); /* number of rects */
708
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
B
bellard 已提交
709 710
    vnc_write_u16(vs, src_x);
    vnc_write_u16(vs, src_y);
C
Corentin Chary 已提交
711
    vnc_unlock_output(vs);
B
bellard 已提交
712 713 714
    vnc_flush(vs);
}

715 716 717
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
{
    VncDisplay *vd = ds->opaque;
718
    VncState *vs, *vn;
S
Stefano Stabellini 已提交
719 720 721 722
    uint8_t *src_row;
    uint8_t *dst_row;
    int i,x,y,pitch,depth,inc,w_lim,s;
    int cmp_bytes;
723

S
Stefano Stabellini 已提交
724
    vnc_refresh_server_surface(vd);
725
    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
726 727
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
            vs->force_update = 1;
C
Corentin Chary 已提交
728
            vnc_update_client_sync(vs, 1);
729 730 731 732
            /* vs might be free()ed here */
        }
    }

S
Stefano Stabellini 已提交
733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768
    /* do bitblit op on the local surface too */
    pitch = ds_get_linesize(vd->ds);
    depth = ds_get_bytes_per_pixel(vd->ds);
    src_row = vd->server->data + pitch * src_y + depth * src_x;
    dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
    y = dst_y;
    inc = 1;
    if (dst_y > src_y) {
        /* copy backwards */
        src_row += pitch * (h-1);
        dst_row += pitch * (h-1);
        pitch = -pitch;
        y = dst_y + h - 1;
        inc = -1;
    }
    w_lim = w - (16 - (dst_x % 16));
    if (w_lim < 0)
        w_lim = w;
    else
        w_lim = w - (w_lim % 16);
    for (i = 0; i < h; i++) {
        for (x = 0; x <= w_lim;
                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
            if (x == w_lim) {
                if ((s = w - w_lim) == 0)
                    break;
            } else if (!x) {
                s = (16 - (dst_x % 16));
                s = MIN(s, w_lim);
            } else {
                s = 16;
            }
            cmp_bytes = s * depth;
            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
                continue;
            memmove(dst_row, src_row, cmp_bytes);
769 770
            QTAILQ_FOREACH(vs, &vd->clients, next) {
                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
S
Stefano Stabellini 已提交
771
                    vnc_set_bit(vs->dirty[y], ((x + dst_x) / 16));
772
                }
S
Stefano Stabellini 已提交
773 774 775 776 777 778 779
            }
        }
        src_row += pitch - w * depth;
        dst_row += pitch - w * depth;
        y += inc;
    }

780 781
    QTAILQ_FOREACH(vs, &vd->clients, next) {
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
782
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
783
        }
784 785 786
    }
}

G
Gerd Hoffmann 已提交
787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830
static void vnc_mouse_set(int x, int y, int visible)
{
    /* can we ask the client(s) to move the pointer ??? */
}

static int vnc_cursor_define(VncState *vs)
{
    QEMUCursor *c = vs->vd->cursor;
    PixelFormat pf = qemu_default_pixelformat(32);
    int isize;

    if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
        vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
        vnc_write_u8(vs,  0);  /*  padding     */
        vnc_write_u16(vs, 1);  /*  # of rects  */
        vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
                               VNC_ENCODING_RICH_CURSOR);
        isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
        vnc_write_pixels_generic(vs, &pf, c->data, isize);
        vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
        return 0;
    }
    return -1;
}

static void vnc_dpy_cursor_define(QEMUCursor *c)
{
    VncDisplay *vd = vnc_display;
    VncState *vs;

    cursor_put(vd->cursor);
    qemu_free(vd->cursor_mask);

    vd->cursor = c;
    cursor_get(vd->cursor);
    vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
    vd->cursor_mask = qemu_mallocz(vd->cursor_msize);
    cursor_get_mono_mask(c, 0, vd->cursor_mask);

    QTAILQ_FOREACH(vs, &vd->clients, next) {
        vnc_cursor_define(vs);
    }
}

S
Stefano Stabellini 已提交
831
static int find_and_clear_dirty_height(struct VncState *vs,
832
                                       int y, int last_x, int x)
B
bellard 已提交
833 834
{
    int h;
S
Stefano Stabellini 已提交
835
    VncDisplay *vd = vs->vd;
B
bellard 已提交
836

S
Stefano Stabellini 已提交
837
    for (h = 1; h < (vd->server->height - y); h++) {
838
        int tmp_x;
S
Stefano Stabellini 已提交
839
        if (!vnc_get_bit(vs->dirty[y + h], last_x))
840 841
            break;
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
S
Stefano Stabellini 已提交
842
            vnc_clear_bit(vs->dirty[y + h], tmp_x);
B
bellard 已提交
843 844 845 846 847
    }

    return h;
}

C
Corentin Chary 已提交
848 849 850 851 852 853 854 855 856 857 858 859 860 861
#ifdef CONFIG_VNC_THREAD
static int vnc_update_client_sync(VncState *vs, int has_dirty)
{
    int ret = vnc_update_client(vs, has_dirty);
    vnc_jobs_join(vs);
    return ret;
}
#else
static int vnc_update_client_sync(VncState *vs, int has_dirty)
{
    return vnc_update_client(vs, has_dirty);
}
#endif

S
Stefano Stabellini 已提交
862
static int vnc_update_client(VncState *vs, int has_dirty)
B
bellard 已提交
863 864
{
    if (vs->need_update && vs->csock != -1) {
S
Stefano Stabellini 已提交
865
        VncDisplay *vd = vs->vd;
C
Corentin Chary 已提交
866
        VncJob *job;
867
        int y;
868
        int width, height;
C
Corentin Chary 已提交
869 870
        int n = 0;

B
bellard 已提交
871

872
        if (vs->output.offset && !vs->audio_cap && !vs->force_update)
873
            /* kernel send buffers are full -> drop frames to throttle */
S
Stefano Stabellini 已提交
874
            return 0;
875

876
        if (!has_dirty && !vs->audio_cap && !vs->force_update)
S
Stefano Stabellini 已提交
877
            return 0;
878

879 880 881 882 883 884
        /*
         * Send screen updates to the vnc client using the server
         * surface and server dirty map.  guest surface updates
         * happening in parallel don't disturb us, the next pass will
         * send them to the client.
         */
C
Corentin Chary 已提交
885
        job = vnc_job_new(vs);
886

887 888 889 890
        width = MIN(vd->server->width, vs->client_width);
        height = MIN(vd->server->height, vs->client_height);

        for (y = 0; y < height; y++) {
891 892
            int x;
            int last_x = -1;
893
            for (x = 0; x < width / 16; x++) {
S
Stefano Stabellini 已提交
894
                if (vnc_get_bit(vs->dirty[y], x)) {
895 896 897
                    if (last_x == -1) {
                        last_x = x;
                    }
S
Stefano Stabellini 已提交
898
                    vnc_clear_bit(vs->dirty[y], x);
899 900
                } else {
                    if (last_x != -1) {
S
Stefano Stabellini 已提交
901
                        int h = find_and_clear_dirty_height(vs, y, last_x, x);
C
Corentin Chary 已提交
902 903 904

                        n += vnc_job_add_rect(job, last_x * 16, y,
                                              (x - last_x) * 16, h);
905 906 907 908 909
                    }
                    last_x = -1;
                }
            }
            if (last_x != -1) {
S
Stefano Stabellini 已提交
910
                int h = find_and_clear_dirty_height(vs, y, last_x, x);
C
Corentin Chary 已提交
911 912
                n += vnc_job_add_rect(job, last_x * 16, y,
                                      (x - last_x) * 16, h);
913 914
            }
        }
C
Corentin Chary 已提交
915 916

        vnc_job_push(job);
917
        vs->force_update = 0;
C
Corentin Chary 已提交
918
        return n;
B
bellard 已提交
919 920
    }

921
    if (vs->csock == -1)
922
        vnc_disconnect_finish(vs);
S
Stefano Stabellini 已提交
923 924

    return 0;
B
bellard 已提交
925 926
}

M
malc 已提交
927 928 929 930 931 932 933
/* audio */
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
{
    VncState *vs = opaque;

    switch (cmd) {
    case AUD_CNOTIFY_DISABLE:
C
Corentin Chary 已提交
934
        vnc_lock_output(vs);
935 936 937
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
        vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
C
Corentin Chary 已提交
938
        vnc_unlock_output(vs);
M
malc 已提交
939 940 941 942
        vnc_flush(vs);
        break;

    case AUD_CNOTIFY_ENABLE:
C
Corentin Chary 已提交
943
        vnc_lock_output(vs);
944 945 946
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
        vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
C
Corentin Chary 已提交
947
        vnc_unlock_output(vs);
M
malc 已提交
948 949 950 951 952 953 954 955 956 957 958 959 960
        vnc_flush(vs);
        break;
    }
}

static void audio_capture_destroy(void *opaque)
{
}

static void audio_capture(void *opaque, void *buf, int size)
{
    VncState *vs = opaque;

C
Corentin Chary 已提交
961
    vnc_lock_output(vs);
962 963 964
    vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
    vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
    vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
M
malc 已提交
965 966
    vnc_write_u32(vs, size);
    vnc_write(vs, buf, size);
C
Corentin Chary 已提交
967
    vnc_unlock_output(vs);
M
malc 已提交
968 969 970 971 972 973 974 975
    vnc_flush(vs);
}

static void audio_add(VncState *vs)
{
    struct audio_capture_ops ops;

    if (vs->audio_cap) {
976
        monitor_printf(default_mon, "audio already running\n");
M
malc 已提交
977 978 979 980 981 982 983
        return;
    }

    ops.notify = audio_capture_notify;
    ops.destroy = audio_capture_destroy;
    ops.capture = audio_capture;

984
    vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
M
malc 已提交
985
    if (!vs->audio_cap) {
986
        monitor_printf(default_mon, "Failed to add audio capture\n");
M
malc 已提交
987 988 989 990 991 992 993 994 995 996 997
    }
}

static void audio_del(VncState *vs)
{
    if (vs->audio_cap) {
        AUD_del_capture(vs->audio_cap, vs);
        vs->audio_cap = NULL;
    }
}

998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008
static void vnc_disconnect_start(VncState *vs)
{
    if (vs->csock == -1)
        return;
    qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
    closesocket(vs->csock);
    vs->csock = -1;
}

static void vnc_disconnect_finish(VncState *vs)
{
C
Corentin Chary 已提交
1009 1010 1011
    vnc_jobs_join(vs); /* Wait encoding jobs */

    vnc_lock_output(vs);
1012 1013
    vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);

C
Corentin Chary 已提交
1014 1015
    buffer_free(&vs->input);
    buffer_free(&vs->output);
1016 1017 1018

    qobject_decref(vs->info);

1019
    vnc_zlib_clear(vs);
C
Corentin Chary 已提交
1020
    vnc_tight_clear(vs);
1021

1022 1023 1024 1025 1026 1027 1028 1029
#ifdef CONFIG_VNC_TLS
    vnc_tls_client_cleanup(vs);
#endif /* CONFIG_VNC_TLS */
#ifdef CONFIG_VNC_SASL
    vnc_sasl_client_cleanup(vs);
#endif /* CONFIG_VNC_SASL */
    audio_del(vs);

1030 1031 1032
    QTAILQ_REMOVE(&vs->vd->clients, vs, next);

    if (QTAILQ_EMPTY(&vs->vd->clients)) {
1033
        dcl->idle = 1;
1034
    }
1035

1036
    qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1037
    vnc_remove_timer(vs->vd);
G
Gerd Hoffmann 已提交
1038 1039
    if (vs->vd->lock_key_sync)
        qemu_remove_led_event_handler(vs->led);
C
Corentin Chary 已提交
1040 1041 1042 1043 1044
    vnc_unlock_output(vs);

#ifdef CONFIG_VNC_THREAD
    qemu_mutex_destroy(&vs->output_mutex);
#endif
G
Glauber Costa 已提交
1045
    qemu_free(vs);
1046
}
1047 1048

int vnc_client_io_error(VncState *vs, int ret, int last_errno)
B
bellard 已提交
1049 1050
{
    if (ret == 0 || ret == -1) {
1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062
        if (ret == -1) {
            switch (last_errno) {
                case EINTR:
                case EAGAIN:
#ifdef _WIN32
                case WSAEWOULDBLOCK:
#endif
                    return 0;
                default:
                    break;
            }
        }
B
bellard 已提交
1063

1064 1065 1066
        VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
                  ret, ret < 0 ? last_errno : 0);
        vnc_disconnect_start(vs);
1067

1068
        return 0;
B
bellard 已提交
1069 1070 1071 1072
    }
    return ret;
}

1073 1074

void vnc_client_error(VncState *vs)
B
bellard 已提交
1075
{
1076 1077
    VNC_DEBUG("Closing down client sock: protocol error\n");
    vnc_disconnect_start(vs);
B
bellard 已提交
1078 1079
}

1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096

/*
 * Called to write a chunk of data to the client socket. The data may
 * be the raw data, or may have already been encoded by SASL.
 * The data will be written either straight onto the socket, or
 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
 *
 * NB, it is theoretically possible to have 2 layers of encryption,
 * both SASL, and this TLS layer. It is highly unlikely in practice
 * though, since SASL encryption will typically be a no-op if TLS
 * is active
 *
 * Returns the number of bytes written, which may be less than
 * the requested 'datalen' if the socket would block. Returns
 * -1 on error, and disconnects the client socket.
 */
long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
B
bellard 已提交
1097
{
1098
    long ret;
1099
#ifdef CONFIG_VNC_TLS
1100
    if (vs->tls.session) {
1101 1102 1103 1104 1105 1106 1107 1108
        ret = gnutls_write(vs->tls.session, data, datalen);
        if (ret < 0) {
            if (ret == GNUTLS_E_AGAIN)
                errno = EAGAIN;
            else
                errno = EIO;
            ret = -1;
        }
1109 1110
    } else
#endif /* CONFIG_VNC_TLS */
1111
        ret = send(vs->csock, (const void *)data, datalen, 0);
1112
    VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131
    return vnc_client_io_error(vs, ret, socket_error());
}


/*
 * Called to write buffered data to the client socket, when not
 * using any SASL SSF encryption layers. Will write as much data
 * as possible without blocking. If all buffered data is written,
 * will switch the FD poll() handler back to read monitoring.
 *
 * Returns the number of bytes written, which may be less than
 * the buffered output data if the socket would block. Returns
 * -1 on error, and disconnects the client socket.
 */
static long vnc_client_write_plain(VncState *vs)
{
    long ret;

#ifdef CONFIG_VNC_SASL
1132
    VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144
              vs->output.buffer, vs->output.capacity, vs->output.offset,
              vs->sasl.waitWriteSSF);

    if (vs->sasl.conn &&
        vs->sasl.runSSF &&
        vs->sasl.waitWriteSSF) {
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
        if (ret)
            vs->sasl.waitWriteSSF -= ret;
    } else
#endif /* CONFIG_VNC_SASL */
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
B
bellard 已提交
1145
    if (!ret)
1146
        return 0;
B
bellard 已提交
1147 1148 1149 1150 1151

    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
    vs->output.offset -= ret;

    if (vs->output.offset == 0) {
1152
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
B
bellard 已提交
1153
    }
1154 1155 1156 1157 1158 1159 1160 1161 1162 1163

    return ret;
}


/*
 * First function called whenever there is data to be written to
 * the client socket. Will delegate actual work according to whether
 * SASL SSF layers are enabled (thus requiring encryption calls)
 */
C
Corentin Chary 已提交
1164
static void vnc_client_write_locked(void *opaque)
1165 1166 1167 1168 1169 1170
{
    VncState *vs = opaque;

#ifdef CONFIG_VNC_SASL
    if (vs->sasl.conn &&
        vs->sasl.runSSF &&
1171 1172 1173
        !vs->sasl.waitWriteSSF) {
        vnc_client_write_sasl(vs);
    } else
1174
#endif /* CONFIG_VNC_SASL */
1175
        vnc_client_write_plain(vs);
B
bellard 已提交
1176 1177
}

C
Corentin Chary 已提交
1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190
void vnc_client_write(void *opaque)
{
    VncState *vs = opaque;

    vnc_lock_output(vs);
    if (vs->output.offset) {
        vnc_client_write_locked(opaque);
    } else {
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
    }
    vnc_unlock_output(vs);
}

1191
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
B
bellard 已提交
1192 1193 1194 1195 1196
{
    vs->read_handler = func;
    vs->read_handler_expect = expecting;
}

1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213

/*
 * Called to read a chunk of data from the client socket. The data may
 * be the raw data, or may need to be further decoded by SASL.
 * The data will be read either straight from to the socket, or
 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
 *
 * NB, it is theoretically possible to have 2 layers of encryption,
 * both SASL, and this TLS layer. It is highly unlikely in practice
 * though, since SASL encryption will typically be a no-op if TLS
 * is active
 *
 * Returns the number of bytes read, which may be less than
 * the requested 'datalen' if the socket would block. Returns
 * -1 on error, and disconnects the client socket.
 */
long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
B
bellard 已提交
1214
{
1215
    long ret;
1216
#ifdef CONFIG_VNC_TLS
1217
    if (vs->tls.session) {
1218 1219 1220 1221 1222 1223 1224 1225
        ret = gnutls_read(vs->tls.session, data, datalen);
        if (ret < 0) {
            if (ret == GNUTLS_E_AGAIN)
                errno = EAGAIN;
            else
                errno = EIO;
            ret = -1;
        }
1226 1227
    } else
#endif /* CONFIG_VNC_TLS */
B
Blue Swirl 已提交
1228
        ret = recv(vs->csock, (void *)data, datalen, 0);
1229
    VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1230 1231
    return vnc_client_io_error(vs, ret, socket_error());
}
B
bellard 已提交
1232

1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244

/*
 * Called to read data from the client socket to the input buffer,
 * when not using any SASL SSF encryption layers. Will read as much
 * data as possible without blocking.
 *
 * Returns the number of bytes read. Returns -1 on error, and
 * disconnects the client socket.
 */
static long vnc_client_read_plain(VncState *vs)
{
    int ret;
1245
    VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1246 1247 1248 1249 1250
              vs->input.buffer, vs->input.capacity, vs->input.offset);
    buffer_reserve(&vs->input, 4096);
    ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
    if (!ret)
        return 0;
B
bellard 已提交
1251
    vs->input.offset += ret;
1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271
    return ret;
}


/*
 * First function called whenever there is more data to be read from
 * the client socket. Will delegate actual work according to whether
 * SASL SSF layers are enabled (thus requiring decryption calls)
 */
void vnc_client_read(void *opaque)
{
    VncState *vs = opaque;
    long ret;

#ifdef CONFIG_VNC_SASL
    if (vs->sasl.conn && vs->sasl.runSSF)
        ret = vnc_client_read_sasl(vs);
    else
#endif /* CONFIG_VNC_SASL */
        ret = vnc_client_read_plain(vs);
1272 1273 1274
    if (!ret) {
        if (vs->csock == -1)
            vnc_disconnect_finish(vs);
1275
        return;
1276
    }
B
bellard 已提交
1277 1278

    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1279 1280 1281 1282
        size_t len = vs->read_handler_expect;
        int ret;

        ret = vs->read_handler(vs, vs->input.buffer, len);
1283 1284
        if (vs->csock == -1) {
            vnc_disconnect_finish(vs);
1285
            return;
1286
        }
1287 1288 1289 1290 1291 1292 1293

        if (!ret) {
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
            vs->input.offset -= len;
        } else {
            vs->read_handler_expect = ret;
        }
B
bellard 已提交
1294 1295 1296
    }
}

1297
void vnc_write(VncState *vs, const void *data, size_t len)
B
bellard 已提交
1298 1299 1300
{
    buffer_reserve(&vs->output, len);

1301
    if (vs->csock != -1 && buffer_empty(&vs->output)) {
1302
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
B
bellard 已提交
1303 1304 1305 1306 1307
    }

    buffer_append(&vs->output, data, len);
}

1308
void vnc_write_s32(VncState *vs, int32_t value)
B
bellard 已提交
1309 1310 1311 1312
{
    vnc_write_u32(vs, *(uint32_t *)&value);
}

1313
void vnc_write_u32(VncState *vs, uint32_t value)
B
bellard 已提交
1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324
{
    uint8_t buf[4];

    buf[0] = (value >> 24) & 0xFF;
    buf[1] = (value >> 16) & 0xFF;
    buf[2] = (value >>  8) & 0xFF;
    buf[3] = value & 0xFF;

    vnc_write(vs, buf, 4);
}

1325
void vnc_write_u16(VncState *vs, uint16_t value)
B
bellard 已提交
1326
{
1327
    uint8_t buf[2];
B
bellard 已提交
1328 1329 1330 1331 1332 1333 1334

    buf[0] = (value >> 8) & 0xFF;
    buf[1] = value & 0xFF;

    vnc_write(vs, buf, 2);
}

1335
void vnc_write_u8(VncState *vs, uint8_t value)
B
bellard 已提交
1336 1337 1338 1339
{
    vnc_write(vs, (char *)&value, 1);
}

1340
void vnc_flush(VncState *vs)
B
bellard 已提交
1341
{
C
Corentin Chary 已提交
1342 1343 1344 1345 1346
    vnc_lock_output(vs);
    if (vs->csock != -1 && vs->output.offset) {
        vnc_client_write_locked(vs);
    }
    vnc_unlock_output(vs);
B
bellard 已提交
1347 1348
}

1349
uint8_t read_u8(uint8_t *data, size_t offset)
B
bellard 已提交
1350 1351 1352 1353
{
    return data[offset];
}

1354
uint16_t read_u16(uint8_t *data, size_t offset)
B
bellard 已提交
1355 1356 1357 1358
{
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
}

1359
int32_t read_s32(uint8_t *data, size_t offset)
B
bellard 已提交
1360 1361
{
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1362
                     (data[offset + 2] << 8) | data[offset + 3]);
B
bellard 已提交
1363 1364
}

1365
uint32_t read_u32(uint8_t *data, size_t offset)
B
bellard 已提交
1366 1367
{
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1368
            (data[offset + 2] << 8) | data[offset + 3]);
B
bellard 已提交
1369 1370
}

T
ths 已提交
1371
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
B
bellard 已提交
1372 1373 1374
{
}

1375
static void check_pointer_type_change(Notifier *notifier)
1376
{
1377 1378 1379
    VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
    int absolute = kbd_mouse_is_absolute();

1380
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
C
Corentin Chary 已提交
1381
        vnc_lock_output(vs);
1382
        vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1383 1384 1385 1386
        vnc_write_u8(vs, 0);
        vnc_write_u16(vs, 1);
        vnc_framebuffer_update(vs, absolute, 0,
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1387
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
C
Corentin Chary 已提交
1388
        vnc_unlock_output(vs);
1389
        vnc_flush(vs);
1390 1391 1392 1393
    }
    vs->absolute = absolute;
}

B
bellard 已提交
1394 1395 1396 1397 1398 1399
static void pointer_event(VncState *vs, int button_mask, int x, int y)
{
    int buttons = 0;
    int dz = 0;

    if (button_mask & 0x01)
1400
        buttons |= MOUSE_EVENT_LBUTTON;
B
bellard 已提交
1401
    if (button_mask & 0x02)
1402
        buttons |= MOUSE_EVENT_MBUTTON;
B
bellard 已提交
1403
    if (button_mask & 0x04)
1404
        buttons |= MOUSE_EVENT_RBUTTON;
B
bellard 已提交
1405
    if (button_mask & 0x08)
1406
        dz = -1;
B
bellard 已提交
1407
    if (button_mask & 0x10)
1408
        dz = 1;
1409 1410

    if (vs->absolute) {
1411 1412 1413 1414
        kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
                          x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
                        ds_get_height(vs->ds) > 1 ?
                          y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1415
                        dz, buttons);
1416
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1417 1418
        x -= 0x7FFF;
        y -= 0x7FFF;
B
bellard 已提交
1419

1420
        kbd_mouse_event(x, y, dz, buttons);
1421
    } else {
1422 1423 1424 1425 1426 1427
        if (vs->last_x != -1)
            kbd_mouse_event(x - vs->last_x,
                            y - vs->last_y,
                            dz, buttons);
        vs->last_x = x;
        vs->last_y = y;
B
bellard 已提交
1428 1429 1430
    }
}

1431 1432 1433 1434 1435
static void reset_keys(VncState *vs)
{
    int i;
    for(i = 0; i < 256; i++) {
        if (vs->modifiers_state[i]) {
1436 1437 1438
            if (i & SCANCODE_GREY)
                kbd_put_keycode(SCANCODE_EMUL0);
            kbd_put_keycode(i | SCANCODE_UP);
1439 1440 1441 1442 1443
            vs->modifiers_state[i] = 0;
        }
    }
}

1444 1445
static void press_key(VncState *vs, int keysym)
{
1446 1447 1448 1449 1450 1451 1452
    int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
    if (keycode & SCANCODE_GREY)
        kbd_put_keycode(SCANCODE_EMUL0);
    kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
    if (keycode & SCANCODE_GREY)
        kbd_put_keycode(SCANCODE_EMUL0);
    kbd_put_keycode(keycode | SCANCODE_UP);
1453 1454
}

G
Gerd Hoffmann 已提交
1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470
static void kbd_leds(void *opaque, int ledstate)
{
    VncState *vs = opaque;
    int caps, num;

    caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
    num  = ledstate & QEMU_NUM_LOCK_LED  ? 1 : 0;

    if (vs->modifiers_state[0x3a] != caps) {
        vs->modifiers_state[0x3a] = caps;
    }
    if (vs->modifiers_state[0x45] != num) {
        vs->modifiers_state[0x45] = num;
    }
}

1471
static void do_key_event(VncState *vs, int down, int keycode, int sym)
B
bellard 已提交
1472
{
1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485
    /* QEMU console switch */
    switch(keycode) {
    case 0x2a:                          /* Left Shift */
    case 0x36:                          /* Right Shift */
    case 0x1d:                          /* Left CTRL */
    case 0x9d:                          /* Right CTRL */
    case 0x38:                          /* Left ALT */
    case 0xb8:                          /* Right ALT */
        if (down)
            vs->modifiers_state[keycode] = 1;
        else
            vs->modifiers_state[keycode] = 0;
        break;
1486
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1487 1488 1489 1490 1491 1492 1493
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
            /* Reset the modifiers sent to the current console */
            reset_keys(vs);
            console_select(keycode - 0x02);
            return;
        }
        break;
1494 1495
    case 0x3a:                        /* CapsLock */
    case 0x45:                        /* NumLock */
G
Gerd Hoffmann 已提交
1496
        if (down)
1497 1498 1499 1500
            vs->modifiers_state[keycode] ^= 1;
        break;
    }

G
Gerd Hoffmann 已提交
1501 1502
    if (vs->vd->lock_key_sync &&
        keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1503 1504 1505 1506
        /* If the numlock state needs to change then simulate an additional
           keypress before sending this one.  This will happen if the user
           toggles numlock away from the VNC window.
        */
1507
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1508 1509 1510 1511 1512 1513 1514 1515 1516 1517
            if (!vs->modifiers_state[0x45]) {
                vs->modifiers_state[0x45] = 1;
                press_key(vs, 0xff7f);
            }
        } else {
            if (vs->modifiers_state[0x45]) {
                vs->modifiers_state[0x45] = 0;
                press_key(vs, 0xff7f);
            }
        }
1518
    }
B
bellard 已提交
1519

G
Gerd Hoffmann 已提交
1520 1521
    if (vs->vd->lock_key_sync &&
        ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
G
Gerd Hoffmann 已提交
1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541
        /* If the capslock state needs to change then simulate an additional
           keypress before sending this one.  This will happen if the user
           toggles capslock away from the VNC window.
        */
        int uppercase = !!(sym >= 'A' && sym <= 'Z');
        int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
        int capslock = !!(vs->modifiers_state[0x3a]);
        if (capslock) {
            if (uppercase == shift) {
                vs->modifiers_state[0x3a] = 0;
                press_key(vs, 0xffe5);
            }
        } else {
            if (uppercase != shift) {
                vs->modifiers_state[0x3a] = 1;
                press_key(vs, 0xffe5);
            }
        }
    }

1542
    if (is_graphic_console()) {
1543 1544
        if (keycode & SCANCODE_GREY)
            kbd_put_keycode(SCANCODE_EMUL0);
1545
        if (down)
1546
            kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1547
        else
1548
            kbd_put_keycode(keycode | SCANCODE_UP);
1549 1550 1551
    } else {
        /* QEMU console emulation */
        if (down) {
1552
            int numlock = vs->modifiers_state[0x45];
1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587
            switch (keycode) {
            case 0x2a:                          /* Left Shift */
            case 0x36:                          /* Right Shift */
            case 0x1d:                          /* Left CTRL */
            case 0x9d:                          /* Right CTRL */
            case 0x38:                          /* Left ALT */
            case 0xb8:                          /* Right ALT */
                break;
            case 0xc8:
                kbd_put_keysym(QEMU_KEY_UP);
                break;
            case 0xd0:
                kbd_put_keysym(QEMU_KEY_DOWN);
                break;
            case 0xcb:
                kbd_put_keysym(QEMU_KEY_LEFT);
                break;
            case 0xcd:
                kbd_put_keysym(QEMU_KEY_RIGHT);
                break;
            case 0xd3:
                kbd_put_keysym(QEMU_KEY_DELETE);
                break;
            case 0xc7:
                kbd_put_keysym(QEMU_KEY_HOME);
                break;
            case 0xcf:
                kbd_put_keysym(QEMU_KEY_END);
                break;
            case 0xc9:
                kbd_put_keysym(QEMU_KEY_PAGEUP);
                break;
            case 0xd1:
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
                break;
1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638

            case 0x47:
                kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
                break;
            case 0x48:
                kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
                break;
            case 0x49:
                kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
                break;
            case 0x4b:
                kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
                break;
            case 0x4c:
                kbd_put_keysym('5');
                break;
            case 0x4d:
                kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
                break;
            case 0x4f:
                kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
                break;
            case 0x50:
                kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
                break;
            case 0x51:
                kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
                break;
            case 0x52:
                kbd_put_keysym('0');
                break;
            case 0x53:
                kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
                break;

            case 0xb5:
                kbd_put_keysym('/');
                break;
            case 0x37:
                kbd_put_keysym('*');
                break;
            case 0x4a:
                kbd_put_keysym('-');
                break;
            case 0x4e:
                kbd_put_keysym('+');
                break;
            case 0x9c:
                kbd_put_keysym('\n');
                break;

1639 1640 1641 1642 1643 1644
            default:
                kbd_put_keysym(sym);
                break;
            }
        }
    }
B
bellard 已提交
1645 1646
}

B
bellard 已提交
1647 1648
static void key_event(VncState *vs, int down, uint32_t sym)
{
1649
    int keycode;
G
Gerd Hoffmann 已提交
1650
    int lsym = sym;
1651

G
Gerd Hoffmann 已提交
1652 1653 1654
    if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
        lsym = lsym - 'A' + 'a';
    }
1655

1656
    keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667
    do_key_event(vs, down, keycode, sym);
}

static void ext_key_event(VncState *vs, int down,
                          uint32_t sym, uint16_t keycode)
{
    /* if the user specifies a keyboard layout, always use it */
    if (keyboard_layout)
        key_event(vs, down, sym);
    else
        do_key_event(vs, down, keycode, sym);
B
bellard 已提交
1668 1669
}

B
bellard 已提交
1670
static void framebuffer_update_request(VncState *vs, int incremental,
1671 1672
                                       int x_position, int y_position,
                                       int w, int h)
B
bellard 已提交
1673
{
1674 1675 1676 1677
    if (y_position > ds_get_height(vs->ds))
        y_position = ds_get_height(vs->ds);
    if (y_position + h >= ds_get_height(vs->ds))
        h = ds_get_height(vs->ds) - y_position;
1678

B
bellard 已提交
1679 1680 1681
    int i;
    vs->need_update = 1;
    if (!incremental) {
1682
        vs->force_update = 1;
1683
        for (i = 0; i < h; i++) {
S
Stefano Stabellini 已提交
1684
            vnc_set_bits(vs->dirty[y_position + i],
1685
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1686
        }
B
bellard 已提交
1687 1688 1689
    }
}

1690 1691
static void send_ext_key_event_ack(VncState *vs)
{
C
Corentin Chary 已提交
1692
    vnc_lock_output(vs);
1693
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1694 1695
    vnc_write_u8(vs, 0);
    vnc_write_u16(vs, 1);
1696 1697
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
                           VNC_ENCODING_EXT_KEY_EVENT);
C
Corentin Chary 已提交
1698
    vnc_unlock_output(vs);
1699 1700 1701
    vnc_flush(vs);
}

M
malc 已提交
1702 1703
static void send_ext_audio_ack(VncState *vs)
{
C
Corentin Chary 已提交
1704
    vnc_lock_output(vs);
1705
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
M
malc 已提交
1706 1707
    vnc_write_u8(vs, 0);
    vnc_write_u16(vs, 1);
1708 1709
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
                           VNC_ENCODING_AUDIO);
C
Corentin Chary 已提交
1710
    vnc_unlock_output(vs);
M
malc 已提交
1711 1712 1713
    vnc_flush(vs);
}

B
bellard 已提交
1714 1715 1716
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
{
    int i;
1717
    unsigned int enc = 0;
B
bellard 已提交
1718

1719
    vs->features = 0;
1720
    vs->vnc_encoding = 0;
1721 1722
    vs->tight.compression = 9;
    vs->tight.quality = -1; /* Lossless by default */
1723
    vs->absolute = -1;
B
bellard 已提交
1724

1725 1726 1727 1728 1729
    /*
     * Start from the end because the encodings are sent in order of preference.
     * This way the prefered encoding (first encoding defined in the array)
     * will be set at the end of the loop.
     */
B
bellard 已提交
1730
    for (i = n_encodings - 1; i >= 0; i--) {
1731 1732 1733
        enc = encodings[i];
        switch (enc) {
        case VNC_ENCODING_RAW:
1734
            vs->vnc_encoding = enc;
1735 1736
            break;
        case VNC_ENCODING_COPYRECT:
1737
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1738 1739 1740
            break;
        case VNC_ENCODING_HEXTILE:
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1741
            vs->vnc_encoding = enc;
1742
            break;
C
Corentin Chary 已提交
1743 1744 1745 1746
        case VNC_ENCODING_TIGHT:
            vs->features |= VNC_FEATURE_TIGHT_MASK;
            vs->vnc_encoding = enc;
            break;
C
Corentin Chary 已提交
1747 1748 1749 1750
        case VNC_ENCODING_TIGHT_PNG:
            vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
            vs->vnc_encoding = enc;
            break;
1751 1752
        case VNC_ENCODING_ZLIB:
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1753
            vs->vnc_encoding = enc;
1754
            break;
1755 1756 1757 1758 1759 1760
        case VNC_ENCODING_DESKTOPRESIZE:
            vs->features |= VNC_FEATURE_RESIZE_MASK;
            break;
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
            break;
G
Gerd Hoffmann 已提交
1761 1762 1763
        case VNC_ENCODING_RICH_CURSOR:
            vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
            break;
1764
        case VNC_ENCODING_EXT_KEY_EVENT:
1765 1766
            send_ext_key_event_ack(vs);
            break;
1767
        case VNC_ENCODING_AUDIO:
M
malc 已提交
1768 1769
            send_ext_audio_ack(vs);
            break;
1770 1771
        case VNC_ENCODING_WMVi:
            vs->features |= VNC_FEATURE_WMVI_MASK;
1772
            break;
1773
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1774
            vs->tight.compression = (enc & 0x0F);
1775 1776
            break;
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1777
            vs->tight.quality = (enc & 0x0F);
1778
            break;
1779 1780 1781 1782
        default:
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
            break;
        }
B
bellard 已提交
1783
    }
1784
    vnc_desktop_resize(vs);
1785
    check_pointer_type_change(&vs->mouse_mode_notifier);
B
bellard 已提交
1786 1787
}

1788 1789 1790 1791 1792 1793
static void set_pixel_conversion(VncState *vs)
{
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
        vs->write_pixels = vnc_write_pixels_copy;
1794
        vnc_hextile_set_pixel_conversion(vs, 0);
1795 1796
    } else {
        vs->write_pixels = vnc_write_pixels_generic;
1797
        vnc_hextile_set_pixel_conversion(vs, 1);
1798 1799 1800
    }
}

B
bellard 已提交
1801
static void set_pixel_format(VncState *vs,
1802 1803 1804 1805
                             int bits_per_pixel, int depth,
                             int big_endian_flag, int true_color_flag,
                             int red_max, int green_max, int blue_max,
                             int red_shift, int green_shift, int blue_shift)
B
bellard 已提交
1806
{
B
bellard 已提交
1807
    if (!true_color_flag) {
1808
        vnc_client_error(vs);
B
bellard 已提交
1809 1810
        return;
    }
B
bellard 已提交
1811

S
Stefano Stabellini 已提交
1812
    vs->clientds = *(vs->vd->guest.ds);
1813
    vs->clientds.pf.rmax = red_max;
1814
    count_bits(vs->clientds.pf.rbits, red_max);
1815 1816 1817
    vs->clientds.pf.rshift = red_shift;
    vs->clientds.pf.rmask = red_max << red_shift;
    vs->clientds.pf.gmax = green_max;
1818
    count_bits(vs->clientds.pf.gbits, green_max);
1819 1820 1821
    vs->clientds.pf.gshift = green_shift;
    vs->clientds.pf.gmask = green_max << green_shift;
    vs->clientds.pf.bmax = blue_max;
1822
    count_bits(vs->clientds.pf.bbits, blue_max);
1823 1824 1825 1826 1827 1828 1829 1830
    vs->clientds.pf.bshift = blue_shift;
    vs->clientds.pf.bmask = blue_max << blue_shift;
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;

    set_pixel_conversion(vs);
B
bellard 已提交
1831 1832 1833 1834 1835

    vga_hw_invalidate();
    vga_hw_update();
}

1836 1837 1838
static void pixel_format_message (VncState *vs) {
    char pad[3] = { 0, 0, 0 };

1839 1840
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1841

1842
#ifdef HOST_WORDS_BIGENDIAN
1843 1844 1845 1846 1847
    vnc_write_u8(vs, 1);             /* big-endian-flag */
#else
    vnc_write_u8(vs, 0);             /* big-endian-flag */
#endif
    vnc_write_u8(vs, 1);             /* true-color-flag */
1848 1849 1850 1851 1852 1853
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1854 1855 1856

    vnc_hextile_set_pixel_conversion(vs, 0);

1857
    vs->clientds = *(vs->ds->surface);
1858
    vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1859 1860 1861 1862 1863
    vs->write_pixels = vnc_write_pixels_copy;

    vnc_write(vs, pad, 3);           /* padding */
}

1864 1865 1866 1867 1868
static void vnc_dpy_setdata(DisplayState *ds)
{
    /* We don't have to do anything */
}

1869
static void vnc_colordepth(VncState *vs)
1870
{
1871
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1872
        /* Sending a WMVi message to notify the client*/
C
Corentin Chary 已提交
1873
        vnc_lock_output(vs);
1874
        vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1875 1876
        vnc_write_u8(vs, 0);
        vnc_write_u16(vs, 1); /* number of rects */
1877 1878
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1879
        pixel_format_message(vs);
C
Corentin Chary 已提交
1880
        vnc_unlock_output(vs);
1881
        vnc_flush(vs);
1882
    } else {
1883
        set_pixel_conversion(vs);
1884 1885 1886
    }
}

T
ths 已提交
1887
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
B
bellard 已提交
1888 1889 1890
{
    int i;
    uint16_t limit;
S
Stefano Stabellini 已提交
1891 1892 1893 1894 1895 1896 1897
    VncDisplay *vd = vs->vd;

    if (data[0] > 3) {
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
        if (!qemu_timer_expired(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval))
            qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
    }
B
bellard 已提交
1898 1899

    switch (data[0]) {
1900
    case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
1901 1902 1903 1904 1905 1906 1907 1908 1909
        if (len == 1)
            return 20;

        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
                         read_u8(data, 6), read_u8(data, 7),
                         read_u16(data, 8), read_u16(data, 10),
                         read_u16(data, 12), read_u8(data, 14),
                         read_u8(data, 15), read_u8(data, 16));
        break;
1910
    case VNC_MSG_CLIENT_SET_ENCODINGS:
1911 1912
        if (len == 1)
            return 4;
B
bellard 已提交
1913

1914
        if (len == 4) {
1915 1916 1917 1918 1919
            limit = read_u16(data, 2);
            if (limit > 0)
                return 4 + (limit * 4);
        } else
            limit = read_u16(data, 2);
B
bellard 已提交
1920

1921 1922 1923 1924
        for (i = 0; i < limit; i++) {
            int32_t val = read_s32(data, 4 + (i * 4));
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
        }
B
bellard 已提交
1925

1926 1927
        set_encodings(vs, (int32_t *)(data + 4), limit);
        break;
1928
    case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
1929 1930
        if (len == 1)
            return 10;
B
bellard 已提交
1931

1932 1933 1934 1935
        framebuffer_update_request(vs,
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
                                   read_u16(data, 6), read_u16(data, 8));
        break;
1936
    case VNC_MSG_CLIENT_KEY_EVENT:
1937 1938
        if (len == 1)
            return 8;
B
bellard 已提交
1939

1940 1941
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
        break;
1942
    case VNC_MSG_CLIENT_POINTER_EVENT:
1943 1944
        if (len == 1)
            return 6;
B
bellard 已提交
1945

1946 1947
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
        break;
1948
    case VNC_MSG_CLIENT_CUT_TEXT:
1949 1950
        if (len == 1)
            return 8;
B
bellard 已提交
1951

1952
        if (len == 8) {
1953 1954 1955 1956
            uint32_t dlen = read_u32(data, 4);
            if (dlen > 0)
                return 8 + dlen;
        }
B
bellard 已提交
1957

1958 1959
        client_cut_text(vs, read_u32(data, 4), data + 8);
        break;
1960
    case VNC_MSG_CLIENT_QEMU:
1961 1962 1963 1964
        if (len == 1)
            return 2;

        switch (read_u8(data, 1)) {
1965
        case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
1966 1967 1968 1969 1970 1971
            if (len == 2)
                return 12;

            ext_key_event(vs, read_u16(data, 2),
                          read_u32(data, 4), read_u32(data, 8));
            break;
1972
        case VNC_MSG_CLIENT_QEMU_AUDIO:
M
malc 已提交
1973 1974 1975 1976
            if (len == 2)
                return 4;

            switch (read_u16 (data, 2)) {
1977
            case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
M
malc 已提交
1978 1979
                audio_add(vs);
                break;
1980
            case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
M
malc 已提交
1981 1982
                audio_del(vs);
                break;
1983
            case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
M
malc 已提交
1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
                if (len == 4)
                    return 10;
                switch (read_u8(data, 4)) {
                case 0: vs->as.fmt = AUD_FMT_U8; break;
                case 1: vs->as.fmt = AUD_FMT_S8; break;
                case 2: vs->as.fmt = AUD_FMT_U16; break;
                case 3: vs->as.fmt = AUD_FMT_S16; break;
                case 4: vs->as.fmt = AUD_FMT_U32; break;
                case 5: vs->as.fmt = AUD_FMT_S32; break;
                default:
                    printf("Invalid audio format %d\n", read_u8(data, 4));
                    vnc_client_error(vs);
                    break;
                }
                vs->as.nchannels = read_u8(data, 5);
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
                    printf("Invalid audio channel coount %d\n",
                           read_u8(data, 5));
                    vnc_client_error(vs);
                    break;
                }
                vs->as.freq = read_u32(data, 6);
                break;
            default:
                printf ("Invalid audio message %d\n", read_u8(data, 4));
                vnc_client_error(vs);
                break;
            }
            break;

2014 2015 2016 2017 2018 2019
        default:
            printf("Msg: %d\n", read_u16(data, 0));
            vnc_client_error(vs);
            break;
        }
        break;
B
bellard 已提交
2020
    default:
2021 2022 2023
        printf("Msg: %d\n", data[0]);
        vnc_client_error(vs);
        break;
B
bellard 已提交
2024
    }
2025

B
bellard 已提交
2026 2027 2028 2029
    vnc_read_when(vs, protocol_client_msg, 1);
    return 0;
}

T
ths 已提交
2030
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
B
bellard 已提交
2031
{
T
ths 已提交
2032 2033
    char buf[1024];
    int size;
B
bellard 已提交
2034

2035 2036 2037 2038
    vs->client_width = ds_get_width(vs->ds);
    vs->client_height = ds_get_height(vs->ds);
    vnc_write_u16(vs, vs->client_width);
    vnc_write_u16(vs, vs->client_height);
B
bellard 已提交
2039

2040
    pixel_format_message(vs);
B
bellard 已提交
2041

T
ths 已提交
2042 2043 2044 2045 2046 2047 2048
    if (qemu_name)
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
    else
        size = snprintf(buf, sizeof(buf), "QEMU");

    vnc_write_u32(vs, size);
    vnc_write(vs, buf, size);
B
bellard 已提交
2049 2050
    vnc_flush(vs);

2051
    vnc_client_cache_auth(vs);
2052
    vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2053

B
bellard 已提交
2054 2055 2056 2057 2058
    vnc_read_when(vs, protocol_client_msg, 1);

    return 0;
}

2059 2060 2061 2062 2063
void start_client_init(VncState *vs)
{
    vnc_read_when(vs, protocol_client_init, 1);
}

2064 2065 2066 2067 2068 2069 2070 2071 2072 2073
static void make_challenge(VncState *vs)
{
    int i;

    srand(time(NULL)+getpid()+getpid()*987654+rand());

    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
}

T
ths 已提交
2074
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2075
{
T
ths 已提交
2076
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2077
    int i, j, pwlen;
T
ths 已提交
2078
    unsigned char key[8];
2079

2080
    if (!vs->vd->password || !vs->vd->password[0]) {
2081 2082 2083 2084 2085 2086 2087 2088 2089 2090
        VNC_DEBUG("No password configured on server");
        vnc_write_u32(vs, 1); /* Reject auth */
        if (vs->minor >= 8) {
            static const char err[] = "Authentication failed";
            vnc_write_u32(vs, sizeof(err));
            vnc_write(vs, err, sizeof(err));
        }
        vnc_flush(vs);
        vnc_client_error(vs);
        return 0;
2091 2092 2093 2094 2095
    }

    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);

    /* Calculate the expected challenge response */
2096
    pwlen = strlen(vs->vd->password);
2097
    for (i=0; i<sizeof(key); i++)
2098
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
2099 2100 2101 2102 2103 2104
    deskey(key, EN0);
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
        des(response+j, response+j);

    /* Compare expected vs actual challenge response */
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2105 2106 2107 2108 2109 2110 2111 2112 2113
        VNC_DEBUG("Client challenge reponse did not match\n");
        vnc_write_u32(vs, 1); /* Reject auth */
        if (vs->minor >= 8) {
            static const char err[] = "Authentication failed";
            vnc_write_u32(vs, sizeof(err));
            vnc_write(vs, err, sizeof(err));
        }
        vnc_flush(vs);
        vnc_client_error(vs);
2114
    } else {
2115 2116 2117
        VNC_DEBUG("Accepting VNC challenge response\n");
        vnc_write_u32(vs, 0); /* Accept auth */
        vnc_flush(vs);
2118

2119
        start_client_init(vs);
2120 2121 2122 2123
    }
    return 0;
}

2124
void start_auth_vnc(VncState *vs)
2125 2126 2127 2128 2129 2130 2131
{
    make_challenge(vs);
    /* Send client a 'random' challenge */
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
    vnc_flush(vs);

    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2132 2133 2134
}


T
ths 已提交
2135
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2136 2137 2138
{
    /* We only advertise 1 auth scheme at a time, so client
     * must pick the one we sent. Verify this */
2139
    if (data[0] != vs->vd->auth) { /* Reject auth */
2140
       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2141 2142 2143 2144 2145 2146 2147 2148 2149
       vnc_write_u32(vs, 1);
       if (vs->minor >= 8) {
           static const char err[] = "Authentication failed";
           vnc_write_u32(vs, sizeof(err));
           vnc_write(vs, err, sizeof(err));
       }
       vnc_client_error(vs);
    } else { /* Accept requested auth */
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2150
       switch (vs->vd->auth) {
2151 2152
       case VNC_AUTH_NONE:
           VNC_DEBUG("Accept auth none\n");
2153 2154 2155 2156
           if (vs->minor >= 8) {
               vnc_write_u32(vs, 0); /* Accept auth completion */
               vnc_flush(vs);
           }
2157
           start_client_init(vs);
2158 2159 2160 2161
           break;

       case VNC_AUTH_VNC:
           VNC_DEBUG("Start VNC auth\n");
2162 2163
           start_auth_vnc(vs);
           break;
2164

2165
#ifdef CONFIG_VNC_TLS
2166 2167
       case VNC_AUTH_VENCRYPT:
           VNC_DEBUG("Accept VeNCrypt auth\n");;
2168 2169
           start_auth_vencrypt(vs);
           break;
2170 2171
#endif /* CONFIG_VNC_TLS */

2172 2173 2174 2175 2176 2177 2178
#ifdef CONFIG_VNC_SASL
       case VNC_AUTH_SASL:
           VNC_DEBUG("Accept SASL auth\n");
           start_auth_sasl(vs);
           break;
#endif /* CONFIG_VNC_SASL */

2179
       default: /* Should not be possible, but just in case */
2180
           VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192
           vnc_write_u8(vs, 1);
           if (vs->minor >= 8) {
               static const char err[] = "Authentication failed";
               vnc_write_u32(vs, sizeof(err));
               vnc_write(vs, err, sizeof(err));
           }
           vnc_client_error(vs);
       }
    }
    return 0;
}

T
ths 已提交
2193
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
B
bellard 已提交
2194 2195 2196 2197 2198 2199
{
    char local[13];

    memcpy(local, version, 12);
    local[12] = 0;

2200
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2201 2202 2203
        VNC_DEBUG("Malformed protocol version %s\n", local);
        vnc_client_error(vs);
        return 0;
B
bellard 已提交
2204
    }
2205 2206
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
    if (vs->major != 3 ||
2207 2208 2209 2210 2211 2212 2213 2214 2215 2216
        (vs->minor != 3 &&
         vs->minor != 4 &&
         vs->minor != 5 &&
         vs->minor != 7 &&
         vs->minor != 8)) {
        VNC_DEBUG("Unsupported client version\n");
        vnc_write_u32(vs, VNC_AUTH_INVALID);
        vnc_flush(vs);
        vnc_client_error(vs);
        return 0;
2217
    }
2218
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2219 2220
     * as equivalent to v3.3 by servers
     */
2221
    if (vs->minor == 4 || vs->minor == 5)
2222
        vs->minor = 3;
2223 2224

    if (vs->minor == 3) {
2225
        if (vs->vd->auth == VNC_AUTH_NONE) {
2226
            VNC_DEBUG("Tell client auth none\n");
2227
            vnc_write_u32(vs, vs->vd->auth);
2228
            vnc_flush(vs);
2229
            start_client_init(vs);
2230
       } else if (vs->vd->auth == VNC_AUTH_VNC) {
2231
            VNC_DEBUG("Tell client VNC auth\n");
2232
            vnc_write_u32(vs, vs->vd->auth);
2233 2234 2235
            vnc_flush(vs);
            start_auth_vnc(vs);
       } else {
2236
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2237 2238 2239 2240 2241
            vnc_write_u32(vs, VNC_AUTH_INVALID);
            vnc_flush(vs);
            vnc_client_error(vs);
       }
    } else {
2242 2243 2244 2245 2246
        VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
        vnc_write_u8(vs, 1); /* num auth */
        vnc_write_u8(vs, vs->vd->auth);
        vnc_read_when(vs, protocol_client_auth, 1);
        vnc_flush(vs);
2247
    }
B
bellard 已提交
2248 2249 2250 2251

    return 0;
}

S
Stefano Stabellini 已提交
2252 2253 2254 2255 2256 2257 2258
static int vnc_refresh_server_surface(VncDisplay *vd)
{
    int y;
    uint8_t *guest_row;
    uint8_t *server_row;
    int cmp_bytes;
    uint32_t width_mask[VNC_DIRTY_WORDS];
2259
    VncState *vs;
S
Stefano Stabellini 已提交
2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287
    int has_dirty = 0;

    /*
     * Walk through the guest dirty map.
     * Check and copy modified bits from guest to server surface.
     * Update server dirty map.
     */
    vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
    cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
    guest_row  = vd->guest.ds->data;
    server_row = vd->server->data;
    for (y = 0; y < vd->guest.ds->height; y++) {
        if (vnc_and_bits(vd->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
            int x;
            uint8_t *guest_ptr;
            uint8_t *server_ptr;

            guest_ptr  = guest_row;
            server_ptr = server_row;

            for (x = 0; x < vd->guest.ds->width;
                    x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
                if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
                    continue;
                vnc_clear_bit(vd->guest.dirty[y], (x / 16));
                if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
                    continue;
                memcpy(server_ptr, guest_ptr, cmp_bytes);
2288
                QTAILQ_FOREACH(vs, &vd->clients, next) {
S
Stefano Stabellini 已提交
2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299
                    vnc_set_bit(vs->dirty[y], (x / 16));
                }
                has_dirty++;
            }
        }
        guest_row  += ds_get_linesize(vd->ds);
        server_row += ds_get_linesize(vd->ds);
    }
    return has_dirty;
}

2300 2301 2302
static void vnc_refresh(void *opaque)
{
    VncDisplay *vd = opaque;
2303 2304
    VncState *vs, *vn;
    int has_dirty, rects = 0;
2305 2306 2307

    vga_hw_update();

C
Corentin Chary 已提交
2308 2309 2310 2311 2312 2313 2314
    if (vnc_trylock_display(vd)) {
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
        qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) +
                       vd->timer_interval);
        return;
    }

S
Stefano Stabellini 已提交
2315
    has_dirty = vnc_refresh_server_surface(vd);
C
Corentin Chary 已提交
2316
    vnc_unlock_display(vd);
S
Stefano Stabellini 已提交
2317

2318
    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
S
Stefano Stabellini 已提交
2319
        rects += vnc_update_client(vs, has_dirty);
2320
        /* vs might be free()ed here */
2321
    }
C
Corentin Chary 已提交
2322

2323 2324 2325 2326
    /* vd->timer could be NULL now if the last client disconnected,
     * in this case don't update the timer */
    if (vd->timer == NULL)
        return;
2327

S
Stefano Stabellini 已提交
2328 2329 2330 2331 2332 2333 2334 2335 2336 2337
    if (has_dirty && rects) {
        vd->timer_interval /= 2;
        if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
            vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
    } else {
        vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
        if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
            vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
    }
    qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
2338 2339 2340 2341
}

static void vnc_init_timer(VncDisplay *vd)
{
S
Stefano Stabellini 已提交
2342
    vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2343
    if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
2344
        vd->timer = qemu_new_timer(rt_clock, vnc_refresh, vd);
S
Stefano Stabellini 已提交
2345
        vnc_refresh(vd);
2346 2347 2348 2349 2350
    }
}

static void vnc_remove_timer(VncDisplay *vd)
{
2351
    if (vd->timer != NULL && QTAILQ_EMPTY(&vd->clients)) {
2352 2353 2354 2355 2356 2357
        qemu_del_timer(vd->timer);
        qemu_free_timer(vd->timer);
        vd->timer = NULL;
    }
}

2358
static void vnc_connect(VncDisplay *vd, int csock)
2359
{
2360 2361 2362 2363
    VncState *vs = qemu_mallocz(sizeof(VncState));
    vs->csock = csock;

    VNC_DEBUG("New client on socket %d\n", csock);
2364
    dcl->idle = 0;
2365 2366
    socket_set_nonblock(vs->csock);
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2367

2368
    vnc_client_cache_addr(vs);
2369
    vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2370

2371 2372 2373 2374 2375 2376 2377 2378 2379 2380
    vs->vd = vd;
    vs->ds = vd->ds;
    vs->last_x = -1;
    vs->last_y = -1;

    vs->as.freq = 44100;
    vs->as.nchannels = 2;
    vs->as.fmt = AUD_FMT_S16;
    vs->as.endianness = 0;

C
Corentin Chary 已提交
2381 2382 2383 2384
#ifdef CONFIG_VNC_THREAD
    qemu_mutex_init(&vs->output_mutex);
#endif

2385
    QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
S
Stefano Stabellini 已提交
2386 2387 2388

    vga_hw_update();

2389 2390 2391
    vnc_write(vs, "RFB 003.008\n", 12);
    vnc_flush(vs);
    vnc_read_when(vs, protocol_version, 12);
M
malc 已提交
2392
    reset_keys(vs);
G
Gerd Hoffmann 已提交
2393 2394
    if (vs->vd->lock_key_sync)
        vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2395

2396 2397 2398
    vs->mouse_mode_notifier.notify = check_pointer_type_change;
    qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);

2399
    vnc_init_timer(vd);
S
Stefano Stabellini 已提交
2400

2401
    /* vs might be free()ed here */
2402 2403
}

B
bellard 已提交
2404 2405
static void vnc_listen_read(void *opaque)
{
2406
    VncDisplay *vs = opaque;
B
bellard 已提交
2407 2408 2409
    struct sockaddr_in addr;
    socklen_t addrlen = sizeof(addr);

2410 2411 2412
    /* Catch-up */
    vga_hw_update();

K
Kevin Wolf 已提交
2413
    int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2414 2415
    if (csock != -1) {
        vnc_connect(vs, csock);
B
bellard 已提交
2416 2417 2418
    }
}

2419
void vnc_display_init(DisplayState *ds)
B
bellard 已提交
2420
{
2421
    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
B
bellard 已提交
2422

2423
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
B
bellard 已提交
2424 2425

    ds->opaque = vs;
2426
    dcl->idle = 1;
2427
    vnc_display = vs;
B
bellard 已提交
2428 2429 2430 2431

    vs->lsock = -1;

    vs->ds = ds;
2432
    QTAILQ_INIT(&vs->clients);
B
bellard 已提交
2433

2434
    if (keyboard_layout)
2435
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2436
    else
2437
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
B
bellard 已提交
2438 2439

    if (!vs->kbd_layout)
2440
        exit(1);
B
bellard 已提交
2441

C
Corentin Chary 已提交
2442 2443 2444 2445 2446
#ifdef CONFIG_VNC_THREAD
    qemu_mutex_init(&vs->mutex);
    vnc_start_worker_thread();
#endif

2447
    dcl->dpy_copy = vnc_dpy_copy;
2448 2449 2450 2451
    dcl->dpy_update = vnc_dpy_update;
    dcl->dpy_resize = vnc_dpy_resize;
    dcl->dpy_setdata = vnc_dpy_setdata;
    register_displaychangelistener(ds, dcl);
G
Gerd Hoffmann 已提交
2452 2453
    ds->mouse_set = vnc_mouse_set;
    ds->cursor_define = vnc_dpy_cursor_define;
2454 2455
}

2456

2457 2458
void vnc_display_close(DisplayState *ds)
{
2459
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2460

2461 2462
    if (!vs)
        return;
2463
    if (vs->display) {
2464 2465
        qemu_free(vs->display);
        vs->display = NULL;
2466 2467
    }
    if (vs->lsock != -1) {
2468 2469 2470
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
        close(vs->lsock);
        vs->lsock = -1;
2471
    }
2472
    vs->auth = VNC_AUTH_INVALID;
2473
#ifdef CONFIG_VNC_TLS
2474
    vs->subauth = VNC_AUTH_INVALID;
2475
    vs->tls.x509verify = 0;
2476
#endif
2477 2478 2479 2480
}

int vnc_display_password(DisplayState *ds, const char *password)
{
2481
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2482

2483 2484 2485 2486
    if (!vs) {
        return -1;
    }

2487
    if (vs->password) {
2488 2489
        qemu_free(vs->password);
        vs->password = NULL;
2490 2491
    }
    if (password && password[0]) {
2492 2493
        if (!(vs->password = qemu_strdup(password)))
            return -1;
2494 2495 2496 2497 2498
        if (vs->auth == VNC_AUTH_NONE) {
            vs->auth = VNC_AUTH_VNC;
        }
    } else {
        vs->auth = VNC_AUTH_NONE;
2499 2500 2501
    }

    return 0;
2502 2503
}

2504 2505 2506 2507 2508 2509 2510
char *vnc_display_local_addr(DisplayState *ds)
{
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
    
    return vnc_socket_local_addr("%s:%s", vs->lsock);
}

2511
int vnc_display_open(DisplayState *ds, const char *display)
2512
{
2513
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2514 2515
    const char *options;
    int password = 0;
2516
    int reverse = 0;
2517
#ifdef CONFIG_VNC_TLS
2518
    int tls = 0, x509 = 0;
2519
#endif
2520 2521 2522 2523
#ifdef CONFIG_VNC_SASL
    int sasl = 0;
    int saslErr;
#endif
2524
    int acl = 0;
G
Gerd Hoffmann 已提交
2525
    int lock_key_sync = 1;
2526

2527
    if (!vnc_display)
2528
        return -1;
2529
    vnc_display_close(ds);
2530
    if (strcmp(display, "none") == 0)
2531
        return 0;
B
bellard 已提交
2532

2533
    if (!(vs->display = strdup(display)))
2534
        return -1;
2535 2536 2537

    options = display;
    while ((options = strchr(options, ','))) {
2538 2539 2540 2541 2542
        options++;
        if (strncmp(options, "password", 8) == 0) {
            password = 1; /* Require password auth */
        } else if (strncmp(options, "reverse", 7) == 0) {
            reverse = 1;
G
Gerd Hoffmann 已提交
2543 2544
        } else if (strncmp(options, "no-lock-key-sync", 9) == 0) {
            lock_key_sync = 0;
2545
#ifdef CONFIG_VNC_SASL
2546 2547
        } else if (strncmp(options, "sasl", 4) == 0) {
            sasl = 1; /* Require SASL auth */
2548
#endif
2549
#ifdef CONFIG_VNC_TLS
2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580
        } else if (strncmp(options, "tls", 3) == 0) {
            tls = 1; /* Require TLS */
        } else if (strncmp(options, "x509", 4) == 0) {
            char *start, *end;
            x509 = 1; /* Require x509 certificates */
            if (strncmp(options, "x509verify", 10) == 0)
                vs->tls.x509verify = 1; /* ...and verify client certs */

            /* Now check for 'x509=/some/path' postfix
             * and use that to setup x509 certificate/key paths */
            start = strchr(options, '=');
            end = strchr(options, ',');
            if (start && (!end || (start < end))) {
                int len = end ? end-(start+1) : strlen(start+1);
                char *path = qemu_strndup(start + 1, len);

                VNC_DEBUG("Trying certificate path '%s'\n", path);
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
                    qemu_free(path);
                    qemu_free(vs->display);
                    vs->display = NULL;
                    return -1;
                }
                qemu_free(path);
            } else {
                fprintf(stderr, "No certificate path provided\n");
                qemu_free(vs->display);
                vs->display = NULL;
                return -1;
            }
2581
#endif
2582 2583
        } else if (strncmp(options, "acl", 3) == 0) {
            acl = 1;
C
Corentin Chary 已提交
2584 2585
        } else if (strncmp(options, "lossy", 5) == 0) {
            vs->lossy = true;
2586
        }
2587 2588
    }

2589 2590
#ifdef CONFIG_VNC_TLS
    if (acl && x509 && vs->tls.x509verify) {
2591 2592 2593 2594
        if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
            fprintf(stderr, "Failed to create x509 dname ACL\n");
            exit(1);
        }
2595 2596 2597 2598
    }
#endif
#ifdef CONFIG_VNC_SASL
    if (acl && sasl) {
2599 2600 2601 2602
        if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
            fprintf(stderr, "Failed to create username ACL\n");
            exit(1);
        }
2603 2604 2605
    }
#endif

2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621
    /*
     * Combinations we support here:
     *
     *  - no-auth                (clear text, no auth)
     *  - password               (clear text, weak auth)
     *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
     *  - tls                    (encrypt, weak anonymous creds, no auth)
     *  - tls + password         (encrypt, weak anonymous creds, weak auth)
     *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
     *  - tls + x509             (encrypt, good x509 creds, no auth)
     *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
     *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
     *
     * NB1. TLS is a stackable auth scheme.
     * NB2. the x509 schemes have option to validate a client cert dname
     */
2622
    if (password) {
2623
#ifdef CONFIG_VNC_TLS
2624 2625 2626 2627 2628 2629 2630 2631 2632 2633
        if (tls) {
            vs->auth = VNC_AUTH_VENCRYPT;
            if (x509) {
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
            } else {
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
            }
        } else {
2634
#endif /* CONFIG_VNC_TLS */
2635 2636
            VNC_DEBUG("Initializing VNC server with password auth\n");
            vs->auth = VNC_AUTH_VNC;
2637
#ifdef CONFIG_VNC_TLS
2638 2639
            vs->subauth = VNC_AUTH_INVALID;
        }
2640 2641 2642 2643 2644 2645 2646
#endif /* CONFIG_VNC_TLS */
#ifdef CONFIG_VNC_SASL
    } else if (sasl) {
#ifdef CONFIG_VNC_TLS
        if (tls) {
            vs->auth = VNC_AUTH_VENCRYPT;
            if (x509) {
2647
                VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2648 2649
                vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
            } else {
2650
                VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2651 2652 2653 2654
                vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
            }
        } else {
#endif /* CONFIG_VNC_TLS */
2655
            VNC_DEBUG("Initializing VNC server with SASL auth\n");
2656 2657 2658 2659 2660 2661
            vs->auth = VNC_AUTH_SASL;
#ifdef CONFIG_VNC_TLS
            vs->subauth = VNC_AUTH_INVALID;
        }
#endif /* CONFIG_VNC_TLS */
#endif /* CONFIG_VNC_SASL */
2662
    } else {
2663
#ifdef CONFIG_VNC_TLS
2664 2665 2666 2667 2668 2669 2670 2671 2672 2673
        if (tls) {
            vs->auth = VNC_AUTH_VENCRYPT;
            if (x509) {
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
            } else {
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
            }
        } else {
2674
#endif
2675 2676
            VNC_DEBUG("Initializing VNC server with no auth\n");
            vs->auth = VNC_AUTH_NONE;
2677
#ifdef CONFIG_VNC_TLS
2678 2679
            vs->subauth = VNC_AUTH_INVALID;
        }
2680
#endif
2681
    }
B
bellard 已提交
2682

2683 2684 2685 2686 2687 2688 2689 2690 2691
#ifdef CONFIG_VNC_SASL
    if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
        fprintf(stderr, "Failed to initialize SASL auth %s",
                sasl_errstring(saslErr, NULL, NULL));
        free(vs->display);
        vs->display = NULL;
        return -1;
    }
#endif
G
Gerd Hoffmann 已提交
2692
    vs->lock_key_sync = lock_key_sync;
2693

2694
    if (reverse) {
2695 2696 2697 2698 2699 2700
        /* connect to viewer */
        if (strncmp(display, "unix:", 5) == 0)
            vs->lsock = unix_connect(display+5);
        else
            vs->lsock = inet_connect(display, SOCK_STREAM);
        if (-1 == vs->lsock) {
2701 2702 2703 2704
            free(vs->display);
            vs->display = NULL;
            return -1;
        } else {
2705
            int csock = vs->lsock;
2706
            vs->lsock = -1;
2707
            vnc_connect(vs, csock);
2708
        }
2709
        return 0;
B
bellard 已提交
2710

2711 2712 2713 2714 2715
    } else {
        /* listen for connects */
        char *dpy;
        dpy = qemu_malloc(256);
        if (strncmp(display, "unix:", 5) == 0) {
B
blueswir1 已提交
2716
            pstrcpy(dpy, 256, "unix:");
2717
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2718 2719 2720 2721 2722
        } else {
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
        }
        if (-1 == vs->lsock) {
            free(dpy);
2723
            return -1;
2724 2725 2726 2727
        } else {
            free(vs->display);
            vs->display = dpy;
        }
B
bellard 已提交
2728
    }
2729
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
B
bellard 已提交
2730
}