It's currently possible to setup spice channels using TLS when
no TLS port has been specified (ie TLS is disabled). This cannot
work, so better to error out in such a situation.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Error message reporting during spice startup wasn't consistent, it was done
with fprintf(stderr, "") but sometimes the message didn't have a trailing
\n. Using error_report make the intent of the message clearer and deal
with the final \n for us.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

drop all ifdefs on SPICE_INTERFACE_QXL_MINOR >= 1 as a result,
any check for SPICE_SERVER_VERSION that is now always satisfied,
and SPICE_INTERFACE_CORE_MINOR >= 3 tests, because
0.8.2 has SPICE_INTERFACE_QXL_MINOR == 1 and
SPICE_INTERFACE_CORE_MINOR == 3.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

RHBZ #788444

CC: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NYonit Halperin <yhalperi@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

With the acceptance of some new APIs to libspice-server.so it
is possible to add support for SPICE to the 'add_client'
monitor command, bringing parity with VNC. Since SPICE can
use TLS or plain connections, the command also gains a new
'tls' parameter to specify whether TLS should be attempted
on the injected client sockets.

This new feature is only enabled if building against a
libspice-server >= 0.10.1

* qmp-commands.hx: Add 'tls' parameter & missing doc for
  'skipauth' parameter
* monitor.c: Wire up SPICE for 'add_client' command
* ui/qemu-spice.h, ui/spice-core.c: Add qemu_spice_display_add_client
  API to wire up from monitor

[1] http://cgit.freedesktop.org/spice/spice/commit/server/spice.h?id=d55b68b6b44f2499278fa860fb47ff22f5011faa
    http://cgit.freedesktop.org/spice/spice/commit/server/spice.h?id=bd07dde530d9504e1cfe7ed5837fc00c26f36716

Changes in v3:
 - Added 'optional' flag to new parameters documented
 - Added no-op impl of qemu_spice_display_add_client when
   SPICE is disabled during build
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Replace device_init() with generalized type_init().

While at it, unify naming convention: type_init([$prefix_]register_types)
Also, type_init() is a function, so add preceding blank line where
necessary and don't put a semicolon after the closing brace.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Cc: Anthony Liguori <anthony@codemonkey.ws>
Cc: malc <av1474@comtv.ru>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Setting both read and write handlers to NULL in qemu_set_fd_handler
is not enougth to make qemu purge the file handle from the list.
We must set opaque to NULL too.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Fix segfault if a qxl device is present but no spice command line
argument is given.

RHBZ 743251.
Signed-off-by: NAlon Levy <alevy@redhat.com>

No need to use pthread directly, we have proper abstractions for
identity checking.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

- call spice_server_migrate_(start|end|connect).
- register spice_migrate_connect completion callback
Signed-off-by: NYonit Halperin <yhalperi@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

RHBZ 737921
Spice client is required to connect to the migration target before/as migration
starts. Since after migration starts, the target qemu is blocked and cannot accept new spice client
we trigger the connection to the target upon client_migrate_info command.
client_migrate_info completion cb will be called after spice client has been
connected to the target (or a timeout). See following patches and spice patches.
Signed-off-by: NYonit Halperin <yhalperi@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This will allow us to hide the state values.
Signed-off-by: NJuan Quintela <quintela@redhat.com>

spice server might call the channel_event callback from spice server
thread context.  Detect that and aquire iothread lock if needed,

qemu_malloc/qemu_free no longer exist after this commit.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This allows to pass additional information to the notifier callback
which is useful if sender and receiver do not share any other distinct
data structure.

Will be used first for the clock reset notifier.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Make sure at least one port (port=.. or tls-port=...)
is specified.  Also apply range checks to the port numbers.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When the spice server initialization fails report this and exit instead
of ignoring the error.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch raises the minimum required spice version to 0.6.0 and drops
a few ifdefs.

0.6.0 is the first stable release with the current libspice-server API,
there shouldn't be any 0.5.x development versions deployed any more.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Turn on SASL support by appending "sasl" to the spice arguments, which
requires that the client use SASL to authenticate with the spice.  The
exact choice of authentication method used is controlled from the
system / user's SASL configuration file for the 'qemu' service. This
is typically found in /etc/sasl2/qemu.conf. If running QEMU as an
unprivileged user, an environment variable SASL_CONF_PATH can be used
to make it search alternate locations for the service config.  While
some SASL auth methods can also provide data encryption (eg GSSAPI),
it is recommended that SASL always be combined with the 'tls' and
'x509' settings to enable use of SSL and server certificates. This
ensures a data encryption preventing compromise of authentication
credentials.

It requires support from spice 0.8.1.

[ kraxel: moved spell fix to separate commit ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Some people want to be able disable spice's guest <-> client copy paste support
because of security considerations.

[ kraxel: drop old-version error message ]

This was done with:

    sed -i '/get_clock\>.*rt_clock/s/get_clock\>/get_clock_ms/' \
        $(git grep -l 'get_clock\>.*rt_clock' )
    sed -i '/new_timer\>.*rt_clock/s/new_timer\>/new_timer_ms/' \
        $(git grep -l 'new_timer\>.*rt_clock' )

after checking that get_clock and new_timer never occur twice
on the same line.  There were no missed occurrences; however, even
if there had been, they would have been caught by the compiler.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Handle spice client migration, i.e. inform a spice client connected
about the new host and connection parameters, so it can move over the
connection automatically.

The monitor command has a not-yet used protocol argument simliar to
set_password and expire_password commands.  This allows to add a simliar
feature to vnc in the future.  Daniel Berrange plans to work on this.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds new set_password and expire_password monitor commands
which allows to change and expire the password for spice and vnc
connections.  See the doc update patch chunk for details.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The patch adds a 'query-spice' monitor command which returns
informations about the spice server configuration and also a list of
channel connections.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds support for connection events to spice.  The events are
quite simliar to the vnc events.  Unlike vnc spice uses multiple tcp
channels though.  qemu will report every single tcp connection (aka
spice channel).  If you want track spice sessions only you can filter
for the main channel (channel-type == 1).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

qxl is a paravirtual graphics card.  The qxl device is the bridge
between the guest and the spice server (aka libspice-server).  The
spice server will send the rendering commands to the spice client, which
will actually render them.

The spice server is also able to render locally, which is done in case
the guest wants read something from video memory.  Local rendering is
also used to support display over vnc and sdl.

qxl is activated using "-vga qxl".  qxl supports multihead, additional
cards can be added via '-device qxl".

[ v2: add copyright to files                     ]
[ v2: use qemu-common.h for standard includes    ]
[ v2: create separate qxl-vga device for primary ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add support for the spice audio interface.  With this patch applied
audio can be forwarded over the network from/to the spice client.  Both
recording and playback is supported.

The driver is first in the driver list, but the can_be_default flag is
set only in case spice is active.  So if you have the spice protocol
enabled the spice audio driver is the default one, otherwise whatever
comes first after spice in the list.  Overriding the default using
QEMU_AUDIO_DRV works in any case.

[ v2: audio codestyle: add spaces before open parenthesis ]
[ v2: add const to silence array ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Cc: malc <av1474@comtv.ru>
Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds a few more options to tweak spice server behavior.
The documentation update chunk has the details ;)

Make listening address configurable.  Also add options to
force using IPv4 or IPv6.

This allows to enforce tls or plaintext usage for certain spice
channels.

[ v2: code style fixup ]

This patch adds options to the -spice command line switch to
configure image compression.

[ v2: speling fix in the documentation ]

Add options to the -spice command line switch to setup tls.

Open keyboard channel.  Now you can type into the spice client and the
keyboard events are sent to your guest.  You'll need some other display
like vnc to actually see the guest responding to them though.

Add -spice command line switch.  Has support setting passwd and port for
now.  With this patch applied the spice client can successfully connect
to qemu.  You can't do anything useful yet though.