vnc.c · samitouri/QOSamiQemu · siGit Code & Deploy

Code Commits Issues Pulls Sessions CI/CD

master

c 4,361 lines 131 KB

Raw

1	/*
2	* QEMU VNC display driver
3	*
4	* Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5	* Copyright (C) 2006 Fabrice Bellard
6	* Copyright (C) 2009 Red Hat, Inc
7	*
8	* Permission is hereby granted, free of charge, to any person obtaining a copy
9	* of this software and associated documentation files (the "Software"), to deal
10	* in the Software without restriction, including without limitation the rights
11	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12	* copies of the Software, and to permit persons to whom the Software is
13	* furnished to do so, subject to the following conditions:
14	*
15	* The above copyright notice and this permission notice shall be included in
16	* all copies or substantial portions of the Software.
17	*
18	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24	* THE SOFTWARE.
25	*/
26
27	#include "qemu/osdep.h"
28	#include "vnc.h"
29	#include "vnc-jobs.h"
30	#include "trace.h"
31	#include "hw/core/qdev.h"
32	#include "system/system.h"
33	#include "system/runstate.h"
34	#include "qemu/error-report.h"
35	#include "qemu/main-loop.h"
36	#include "qemu/module.h"
37	#include "qemu/option.h"
38	#include "qemu/sockets.h"
39	#include "qemu/timer.h"
40	#include "authz/list.h"
41	#include "qemu/config-file.h"
42	#include "qapi/qapi-emit-events.h"
43	#include "qapi/qapi-events-ui.h"
44	#include "qapi/error.h"
45	#include "qapi/qapi-commands-ui.h"
46	#include "standard-headers/linux/input-event-codes.h"
47	#include "ui/console.h"
48	#include "ui/input.h"
49	#include "crypto/hash.h"
50	#include "crypto/tlscreds.h"
51	#include "crypto/tlscredsanon.h"
52	#include "crypto/tlscredsx509.h"
53	#include "crypto/random.h"
54	#include "crypto/secret_common.h"
55	#include "qom/object_interfaces.h"
56	#include "qemu/cutils.h"
57	#include "qemu/help_option.h"
58	#include "io/dns-resolver.h"
59	#include "monitor/monitor.h"
60
61	#define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
62	#define VNC_REFRESH_INTERVAL_INC 50
63	#define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
64	static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
65	static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
66
67	#include "vnc_keysym.h"
68	#include "crypto/cipher.h"
69
70	static QTAILQ_HEAD(, VncDisplay) vnc_displays =
71	QTAILQ_HEAD_INITIALIZER(vnc_displays);
72
73	static int vnc_cursor_define(VncState *vs);
74	static void vnc_update_throttle_offset(VncState *vs);
75	static void vnc_disconnect_finish(VncState *vs);
76
77	static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
78	{
79	trace_vnc_set_share_mode(vs, vs->ioc, vs->share_mode, mode);
80
81	switch (vs->share_mode) {
82	case VNC_SHARE_MODE_CONNECTING:
83	vs->vd->num_connecting--;
84	break;
85	case VNC_SHARE_MODE_SHARED:
86	vs->vd->num_shared--;
87	break;
88	case VNC_SHARE_MODE_EXCLUSIVE:
89	vs->vd->num_exclusive--;
90	break;
91	default:
92	break;
93	}
94
95	vs->share_mode = mode;
96
97	switch (vs->share_mode) {
98	case VNC_SHARE_MODE_CONNECTING:
99	vs->vd->num_connecting++;
100	break;
101	case VNC_SHARE_MODE_SHARED:
102	vs->vd->num_shared++;
103	break;
104	case VNC_SHARE_MODE_EXCLUSIVE:
105	vs->vd->num_exclusive++;
106	break;
107	default:
108	break;
109	}
110	}
111
112
113	static void vnc_init_basic_info(SocketAddress *addr,
114	VncBasicInfo *info,
115	Error **errp)
116	{
117	switch (addr->type) {
118	case SOCKET_ADDRESS_TYPE_INET:
119	info->host = g_strdup(addr->u.inet.host);
120	info->service = g_strdup(addr->u.inet.port);
121	if (addr->u.inet.ipv6) {
122	info->family = NETWORK_ADDRESS_FAMILY_IPV6;
123	} else {
124	info->family = NETWORK_ADDRESS_FAMILY_IPV4;
125	}
126	break;
127
128	case SOCKET_ADDRESS_TYPE_UNIX:
129	info->host = g_strdup("");
130	info->service = g_strdup(addr->u.q_unix.path);
131	info->family = NETWORK_ADDRESS_FAMILY_UNIX;
132	break;
133
134	case SOCKET_ADDRESS_TYPE_VSOCK:
135	case SOCKET_ADDRESS_TYPE_FD:
136	error_setg(errp, "Unsupported socket address type %s",
137	SocketAddressType_str(addr->type));
138	break;
139	default:
140	abort();
141	}
142	}
143
144	static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145	VncBasicInfo *info,
146	Error **errp)
147	{
148	SocketAddress *addr = NULL;
149
150	if (!ioc) {
151	error_setg(errp, "No listener socket available");
152	return;
153	}
154
155	addr = qio_channel_socket_get_local_address(ioc, errp);
156	if (!addr) {
157	return;
158	}
159
160	vnc_init_basic_info(addr, info, errp);
161	qapi_free_SocketAddress(addr);
162	}
163
164	static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165	VncBasicInfo *info,
166	Error **errp)
167	{
168	SocketAddress *addr = NULL;
169
170	addr = qio_channel_socket_get_remote_address(ioc, errp);
171	if (!addr) {
172	return;
173	}
174
175	vnc_init_basic_info(addr, info, errp);
176	qapi_free_SocketAddress(addr);
177	}
178
179	static const char *vnc_auth_name(int auth, int subauth)
180	{
181	switch (auth) {
182	case VNC_AUTH_INVALID:
183	return "invalid";
184	case VNC_AUTH_NONE:
185	return "none";
186	case VNC_AUTH_VNC:
187	return "vnc";
188	case VNC_AUTH_RA2:
189	return "ra2";
190	case VNC_AUTH_RA2NE:
191	return "ra2ne";
192	case VNC_AUTH_TIGHT:
193	return "tight";
194	case VNC_AUTH_ULTRA:
195	return "ultra";
196	case VNC_AUTH_TLS:
197	return "tls";
198	case VNC_AUTH_VENCRYPT:
199	switch (subauth) {
200	case VNC_AUTH_VENCRYPT_PLAIN:
201	return "vencrypt+plain";
202	case VNC_AUTH_VENCRYPT_TLSNONE:
203	return "vencrypt+tls+none";
204	case VNC_AUTH_VENCRYPT_TLSVNC:
205	return "vencrypt+tls+vnc";
206	case VNC_AUTH_VENCRYPT_TLSPLAIN:
207	return "vencrypt+tls+plain";
208	case VNC_AUTH_VENCRYPT_X509NONE:
209	return "vencrypt+x509+none";
210	case VNC_AUTH_VENCRYPT_X509VNC:
211	return "vencrypt+x509+vnc";
212	case VNC_AUTH_VENCRYPT_X509PLAIN:
213	return "vencrypt+x509+plain";
214	case VNC_AUTH_VENCRYPT_TLSSASL:
215	return "vencrypt+tls+sasl";
216	case VNC_AUTH_VENCRYPT_X509SASL:
217	return "vencrypt+x509+sasl";
218	default:
219	return "vencrypt";
220	}
221	case VNC_AUTH_SASL:
222	return "sasl";
223	}
224	return "unknown";
225	}
226
227	static VncServerInfo vnc_server_info_get(VncDisplay vd)
228	{
229	VncServerInfo *info;
230	Error *err = NULL;
231
232	if (!vd->listener \|\| !qio_net_listener_nsioc(vd->listener)) {
233	return NULL;
234	}
235
236	info = g_malloc0(sizeof(*info));
237	vnc_init_basic_info_from_server_addr(qio_net_listener_sioc(vd->listener, 0),
238	qapi_VncServerInfo_base(info), &err);
239	info->auth = g_strdup(vnc_auth_name(vd->auth, vd->subauth));
240	if (err) {
241	qapi_free_VncServerInfo(info);
242	info = NULL;
243	error_free(err);
244	}
245	return info;
246	}
247
248	static void vnc_client_cache_auth(VncState *client)
249	{
250	if (!client->info) {
251	return;
252	}
253
254	if (client->tls) {
255	client->info->x509_dname =
256	qcrypto_tls_session_get_peer_name(client->tls);
257	}
258	#ifdef CONFIG_VNC_SASL
259	if (client->sasl.conn &&
260	client->sasl.username) {
261	client->info->sasl_username = g_strdup(client->sasl.username);
262	}
263	#endif
264	}
265
266	static void vnc_client_cache_addr(VncState *client)
267	{
268	Error *err = NULL;
269
270	client->info = g_malloc0(sizeof(*client->info));
271	vnc_init_basic_info_from_remote_addr(client->sioc,
272	qapi_VncClientInfo_base(client->info),
273	&err);
274	client->info->websocket = client->websocket;
275	if (err) {
276	qapi_free_VncClientInfo(client->info);
277	client->info = NULL;
278	error_free(err);
279	}
280	}
281
282	static void vnc_qmp_event(VncState *vs, QAPIEvent event)
283	{
284	VncServerInfo *si;
285
286	if (!vs->info) {
287	return;
288	}
289
290	si = vnc_server_info_get(vs->vd);
291	if (!si) {
292	return;
293	}
294
295	switch (event) {
296	case QAPI_EVENT_VNC_CONNECTED:
297	qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info));
298	break;
299	case QAPI_EVENT_VNC_INITIALIZED:
300	qapi_event_send_vnc_initialized(si, vs->info);
301	break;
302	case QAPI_EVENT_VNC_DISCONNECTED:
303	qapi_event_send_vnc_disconnected(si, vs->info);
304	break;
305	default:
306	break;
307	}
308
309	qapi_free_VncServerInfo(si);
310	}
311
312	static VncClientInfo qmp_query_vnc_client(const VncState client)
313	{
314	VncClientInfo *info;
315	Error *err = NULL;
316
317	info = g_malloc0(sizeof(*info));
318
319	vnc_init_basic_info_from_remote_addr(client->sioc,
320	qapi_VncClientInfo_base(info),
321	&err);
322	if (err) {
323	error_free(err);
324	qapi_free_VncClientInfo(info);
325	return NULL;
326	}
327
328	info->websocket = client->websocket;
329
330	if (client->tls) {
331	info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
332	}
333	#ifdef CONFIG_VNC_SASL
334	if (client->sasl.conn && client->sasl.username) {
335	info->sasl_username = g_strdup(client->sasl.username);
336	}
337	#endif
338
339	return info;
340	}
341
342	static VncDisplay vnc_display_find(const char id)
343	{
344	VncDisplay *vd;
345
346	if (id == NULL) {
347	return QTAILQ_FIRST(&vnc_displays);
348	}
349	QTAILQ_FOREACH(vd, &vnc_displays, next) {
350	if (strcmp(id, vd->id) == 0) {
351	return vd;
352	}
353	}
354	return NULL;
355	}
356
357	static VncClientInfoList qmp_query_client_list(VncDisplay vd)
358	{
359	VncClientInfoList *prev = NULL;
360	VncState *client;
361
362	QTAILQ_FOREACH(client, &vd->clients, next) {
363	QAPI_LIST_PREPEND(prev, qmp_query_vnc_client(client));
364	}
365	return prev;
366	}
367
368	VncInfo qmp_query_vnc(Error *errp)
369	{
370	VncInfo info = g_malloc0(sizeof(info));
371	VncDisplay *vd = vnc_display_find(NULL);
372	SocketAddress *addr = NULL;
373
374	if (vd == NULL \|\| !vd->listener \|\| !qio_net_listener_nsioc(vd->listener)) {
375	info->enabled = false;
376	} else {
377	info->enabled = true;
378
379	/* for compatibility with the original command */
380	info->has_clients = true;
381	info->clients = qmp_query_client_list(vd);
382
383	addr = qio_net_listener_get_local_address(vd->listener, 0, errp);
384	if (!addr) {
385	goto out_error;
386	}
387
388	switch (addr->type) {
389	case SOCKET_ADDRESS_TYPE_INET:
390	info->host = g_strdup(addr->u.inet.host);
391	info->service = g_strdup(addr->u.inet.port);
392	if (addr->u.inet.ipv6) {
393	info->family = NETWORK_ADDRESS_FAMILY_IPV6;
394	} else {
395	info->family = NETWORK_ADDRESS_FAMILY_IPV4;
396	}
397	break;
398
399	case SOCKET_ADDRESS_TYPE_UNIX:
400	info->host = g_strdup("");
401	info->service = g_strdup(addr->u.q_unix.path);
402	info->family = NETWORK_ADDRESS_FAMILY_UNIX;
403	break;
404
405	case SOCKET_ADDRESS_TYPE_VSOCK:
406	case SOCKET_ADDRESS_TYPE_FD:
407	error_setg(errp, "Unsupported socket address type %s",
408	SocketAddressType_str(addr->type));
409	goto out_error;
410	default:
411	abort();
412	}
413
414	info->has_family = true;
415
416	info->auth = g_strdup(vnc_auth_name(vd->auth, vd->subauth));
417	}
418
419	qapi_free_SocketAddress(addr);
420	return info;
421
422	out_error:
423	qapi_free_SocketAddress(addr);
424	qapi_free_VncInfo(info);
425	return NULL;
426	}
427
428
429	static void qmp_query_auth(int auth, int subauth,
430	VncPrimaryAuth *qmp_auth,
431	VncVencryptSubAuth *qmp_vencrypt,
432	bool *qmp_has_vencrypt);
433
434	static VncServerInfo2List qmp_query_server_entry(QIOChannelSocket ioc,
435	bool websocket,
436	int auth,
437	int subauth,
438	VncServerInfo2List *prev)
439	{
440	VncServerInfo2 *info;
441	Error *err = NULL;
442	SocketAddress *addr;
443
444	addr = qio_channel_socket_get_local_address(ioc, NULL);
445	if (!addr) {
446	return prev;
447	}
448
449	info = g_new0(VncServerInfo2, 1);
450	vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
451	qapi_free_SocketAddress(addr);
452	if (err) {
453	qapi_free_VncServerInfo2(info);
454	error_free(err);
455	return prev;
456	}
457	info->websocket = websocket;
458
459	qmp_query_auth(auth, subauth, &info->auth,
460	&info->vencrypt, &info->has_vencrypt);
461
462	QAPI_LIST_PREPEND(prev, info);
463	return prev;
464	}
465
466	static void qmp_query_auth(int auth, int subauth,
467	VncPrimaryAuth *qmp_auth,
468	VncVencryptSubAuth *qmp_vencrypt,
469	bool *qmp_has_vencrypt)
470	{
471	switch (auth) {
472	case VNC_AUTH_VNC:
473	*qmp_auth = VNC_PRIMARY_AUTH_VNC;
474	break;
475	case VNC_AUTH_RA2:
476	*qmp_auth = VNC_PRIMARY_AUTH_RA2;
477	break;
478	case VNC_AUTH_RA2NE:
479	*qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
480	break;
481	case VNC_AUTH_TIGHT:
482	*qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
483	break;
484	case VNC_AUTH_ULTRA:
485	*qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
486	break;
487	case VNC_AUTH_TLS:
488	*qmp_auth = VNC_PRIMARY_AUTH_TLS;
489	break;
490	case VNC_AUTH_VENCRYPT:
491	*qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
492	*qmp_has_vencrypt = true;
493	switch (subauth) {
494	case VNC_AUTH_VENCRYPT_PLAIN:
495	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
496	break;
497	case VNC_AUTH_VENCRYPT_TLSNONE:
498	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
499	break;
500	case VNC_AUTH_VENCRYPT_TLSVNC:
501	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
502	break;
503	case VNC_AUTH_VENCRYPT_TLSPLAIN:
504	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
505	break;
506	case VNC_AUTH_VENCRYPT_X509NONE:
507	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
508	break;
509	case VNC_AUTH_VENCRYPT_X509VNC:
510	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
511	break;
512	case VNC_AUTH_VENCRYPT_X509PLAIN:
513	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
514	break;
515	case VNC_AUTH_VENCRYPT_TLSSASL:
516	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
517	break;
518	case VNC_AUTH_VENCRYPT_X509SASL:
519	*qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
520	break;
521	default:
522	*qmp_has_vencrypt = false;
523	break;
524	}
525	break;
526	case VNC_AUTH_SASL:
527	*qmp_auth = VNC_PRIMARY_AUTH_SASL;
528	break;
529	case VNC_AUTH_NONE:
530	default:
531	*qmp_auth = VNC_PRIMARY_AUTH_NONE;
532	break;
533	}
534	}
535
536	VncInfo2List qmp_query_vnc_servers(Error *errp)
537	{
538	VncInfo2List *prev = NULL;
539	VncInfo2 *info;
540	VncDisplay *vd;
541	DeviceState *dev;
542	size_t i;
543
544	QTAILQ_FOREACH(vd, &vnc_displays, next) {
545	size_t nsioc = 0;
546
547	info = g_new0(VncInfo2, 1);
548	info->id = g_strdup(vd->id);
549	info->clients = qmp_query_client_list(vd);
550	qmp_query_auth(vd->auth, vd->subauth, &info->auth,
551	&info->vencrypt, &info->has_vencrypt);
552	if (vd->dcl.con) {
553	Object *obj = object_property_get_link(OBJECT(vd->dcl.con),
554	"device", NULL);
555	if (obj) {
556	dev = DEVICE(obj);
557	info->display = g_strdup(dev->id);
558	}
559	}
560	if (vd->listener != NULL) {
561	nsioc = qio_net_listener_nsioc(vd->listener);
562	}
563	for (i = 0; i < nsioc; i++) {
564	info->server = qmp_query_server_entry(
565	qio_net_listener_sioc(vd->listener, i), false, vd->auth,
566	vd->subauth, info->server);
567	}
568	nsioc = 0;
569	if (vd->wslistener) {
570	nsioc = qio_net_listener_nsioc(vd->wslistener);
571	}
572	for (i = 0; i < nsioc; i++) {
573	info->server = qmp_query_server_entry(
574	qio_net_listener_sioc(vd->wslistener, i), true, vd->ws_auth,
575	vd->ws_subauth, info->server);
576	}
577
578	QAPI_LIST_PREPEND(prev, info);
579	}
580	return prev;
581	}
582
583	bool vnc_display_reload_certs(const char id, Error *errp)
584	{
585	VncDisplay *vd = vnc_display_find(id);
586
587	if (!vd) {
588	error_setg(errp, "Can not find vnc display");
589	return false;
590	}
591
592	if (!vd->tlscreds) {
593	error_setg(errp, "vnc tls is not enabled");
594	return false;
595	}
596
597	if (!qcrypto_tls_creds_reload(vd->tlscreds, errp)) {
598	return false;
599	}
600
601	return true;
602	}
603
604	/* TODO
605	1) Get the queue working for IO.
606	2) there is some weirdness when using the -S option (the screen is grey
607	and not totally invalidated
608	3) resolutions > 1024
609	*/
610
611	static void vnc_colordepth(VncState *vs);
612
613	static int vnc_width(VncDisplay *vd)
614	{
615	return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
616	VNC_DIRTY_PIXELS_PER_BIT));
617	}
618
619	static int vnc_true_width(VncDisplay *vd)
620	{
621	return MIN(VNC_MAX_WIDTH, surface_width(vd->ds));
622	}
623
624	static int vnc_height(VncDisplay *vd)
625	{
626	return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
627	}
628
629	static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
630	VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
631	VncDisplay *vd,
632	int x, int y, int w, int h)
633	{
634	int width = vnc_width(vd);
635	int height = vnc_height(vd);
636
637	/* this is needed this to ensure we updated all affected
638	* blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
639	w += (x % VNC_DIRTY_PIXELS_PER_BIT);
640	x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
641
642	x = MIN(x, width);
643	y = MIN(y, height);
644	w = MIN(x + w, width) - x;
645	h = MIN(y + h, height);
646
647	for (; y < h; y++) {
648	bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
649	DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
650	}
651	}
652
653	static void vnc_dpy_update(DisplayChangeListener *dcl,
654	int x, int y, int w, int h)
655	{
656	VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
657	struct VncSurface *s = &vd->guest;
658
659	vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
660	}
661
662	void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
663	int32_t encoding)
664	{
665	vnc_write_u16(vs, x);
666	vnc_write_u16(vs, y);
667	vnc_write_u16(vs, w);
668	vnc_write_u16(vs, h);
669
670	vnc_write_s32(vs, encoding);
671	}
672
673	static void vnc_desktop_resize_ext(VncState *vs, int reject_reason)
674	{
675	trace_vnc_msg_server_ext_desktop_resize(
676	vs, vs->ioc, vs->client_width, vs->client_height, reject_reason);
677
678	vnc_lock_output(vs);
679	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
680	vnc_write_u8(vs, 0);
681	vnc_write_u16(vs, 1); /* number of rects */
682	vnc_framebuffer_update(vs,
683	reject_reason ? 1 : 0,
684	reject_reason,
685	vs->client_width, vs->client_height,
686	VNC_ENCODING_DESKTOP_RESIZE_EXT);
687	vnc_write_u8(vs, 1); /* number of screens */
688	vnc_write_u8(vs, 0); /* padding */
689	vnc_write_u8(vs, 0); /* padding */
690	vnc_write_u8(vs, 0); /* padding */
691	vnc_write_u32(vs, 0); /* screen id */
692	vnc_write_u16(vs, 0); /* screen x-pos */
693	vnc_write_u16(vs, 0); /* screen y-pos */
694	vnc_write_u16(vs, vs->client_width);
695	vnc_write_u16(vs, vs->client_height);
696	vnc_write_u32(vs, 0); /* screen flags */
697	vnc_unlock_output(vs);
698	vnc_flush(vs);
699	}
700
701	static void vnc_desktop_resize(VncState *vs)
702	{
703	if (vs->ioc == NULL \|\| (!vnc_has_feature(vs, VNC_FEATURE_RESIZE) &&
704	!vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT))) {
705	return;
706	}
707	if (vs->client_width == vs->vd->true_width &&
708	vs->client_height == pixman_image_get_height(vs->vd->server)) {
709	return;
710	}
711
712	assert(vs->vd->true_width < 65536 &&
713	vs->vd->true_width >= 0);
714	assert(pixman_image_get_height(vs->vd->server) < 65536 &&
715	pixman_image_get_height(vs->vd->server) >= 0);
716	vs->client_width = vs->vd->true_width;
717	vs->client_height = pixman_image_get_height(vs->vd->server);
718
719	if (vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT)) {
720	vnc_desktop_resize_ext(vs, 0);
721	return;
722	}
723
724	trace_vnc_msg_server_desktop_resize(
725	vs, vs->ioc, vs->client_width, vs->client_height);
726
727	vnc_lock_output(vs);
728	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
729	vnc_write_u8(vs, 0);
730	vnc_write_u16(vs, 1); /* number of rects */
731	vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
732	VNC_ENCODING_DESKTOPRESIZE);
733	vnc_unlock_output(vs);
734	vnc_flush(vs);
735	}
736
737	static void vnc_abort_display_jobs(VncDisplay *vd)
738	{
739	VncState *vs;
740
741	QTAILQ_FOREACH(vs, &vd->clients, next) {
742	vnc_lock_output(vs);
743	vs->abort = true;
744	vnc_unlock_output(vs);
745	}
746	QTAILQ_FOREACH(vs, &vd->clients, next) {
747	vnc_jobs_join(vs);
748	}
749	QTAILQ_FOREACH(vs, &vd->clients, next) {
750	vnc_lock_output(vs);
751	if (vs->update == VNC_STATE_UPDATE_NONE &&
752	vs->job_update != VNC_STATE_UPDATE_NONE) {
753	/* job aborted before completion */
754	vs->update = vs->job_update;
755	vs->job_update = VNC_STATE_UPDATE_NONE;
756	}
757	vs->abort = false;
758	vnc_unlock_output(vs);
759	}
760	}
761
762	int vnc_server_fb_stride(VncDisplay *vd)
763	{
764	return pixman_image_get_stride(vd->server);
765	}
766
767	void vnc_server_fb_ptr(VncDisplay vd, int x, int y)
768	{
769	uint8_t *ptr;
770
771	ptr = (uint8_t *)pixman_image_get_data(vd->server);
772	ptr += y * vnc_server_fb_stride(vd);
773	ptr += x * VNC_SERVER_FB_BYTES;
774	return ptr;
775	}
776
777	static void vnc_update_server_surface(VncDisplay *vd)
778	{
779	int width, height;
780
781	qemu_pixman_image_unref(vd->server);
782	vd->server = NULL;
783
784	if (QTAILQ_EMPTY(&vd->clients)) {
785	return;
786	}
787
788	width = vnc_width(vd);
789	height = vnc_height(vd);
790	vd->true_width = vnc_true_width(vd);
791	vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
792	width, height,
793	NULL, 0);
794
795	memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
796	vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
797	width, height);
798	}
799
800	static bool vnc_check_pageflip(DisplaySurface *s1,
801	DisplaySurface *s2)
802	{
803	return (s1 != NULL &&
804	s2 != NULL &&
805	surface_width(s1) == surface_width(s2) &&
806	surface_height(s1) == surface_height(s2) &&
807	surface_format(s1) == surface_format(s2));
808
809	}
810
811	static void vnc_dpy_switch(DisplayChangeListener *dcl,
812	DisplaySurface *surface)
813	{
814	VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
815	bool pageflip = vnc_check_pageflip(vd->ds, surface);
816	VncState *vs;
817
818	vnc_abort_display_jobs(vd);
819	vd->ds = surface;
820
821	/* guest surface */
822	qemu_pixman_image_unref(vd->guest.fb);
823	vd->guest.fb = pixman_image_ref(surface->image);
824	vd->guest.format = surface_format(surface);
825
826
827	if (pageflip) {
828	trace_vnc_server_dpy_pageflip(vd,
829	surface_width(surface),
830	surface_height(surface),
831	surface_format(surface));
832	vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
833	surface_width(surface),
834	surface_height(surface));
835	return;
836	}
837
838	trace_vnc_server_dpy_recreate(vd,
839	surface_width(surface),
840	surface_height(surface),
841	surface_format(surface));
842	/* server surface */
843	vnc_update_server_surface(vd);
844
845	QTAILQ_FOREACH(vs, &vd->clients, next) {
846	vnc_colordepth(vs);
847	vnc_desktop_resize(vs);
848	vnc_cursor_define(vs);
849	memset(vs->dirty, 0x00, sizeof(vs->dirty));
850	vnc_set_area_dirty(vs->dirty, vd, 0, 0,
851	vnc_width(vd),
852	vnc_height(vd));
853	vnc_update_throttle_offset(vs);
854	}
855	}
856
857	/* fastest code */
858	static void vnc_write_pixels_copy(VncState *vs,
859	void *pixels, int size)
860	{
861	vnc_write(vs, pixels, size);
862	}
863
864	/* slowest but generic code. */
865	void vnc_convert_pixel(VncState vs, uint8_t buf, uint32_t v)
866	{
867	uint8_t r, g, b;
868
869	#if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
870	r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
871	g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
872	b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
873	#else
874	# error need some bits here if you change VNC_SERVER_FB_FORMAT
875	#endif
876	v = (r << vs->client_pf.rshift) \|
877	(g << vs->client_pf.gshift) \|
878	(b << vs->client_pf.bshift);
879	switch (vs->client_pf.bytes_per_pixel) {
880	case 1:
881	buf[0] = v;
882	break;
883	case 2:
884	if (vs->client_endian == G_BIG_ENDIAN) {
885	buf[0] = v >> 8;
886	buf[1] = v;
887	} else {
888	buf[1] = v >> 8;
889	buf[0] = v;
890	}
891	break;
892	default:
893	case 4:
894	if (vs->client_endian == G_BIG_ENDIAN) {
895	buf[0] = v >> 24;
896	buf[1] = v >> 16;
897	buf[2] = v >> 8;
898	buf[3] = v;
899	} else {
900	buf[3] = v >> 24;
901	buf[2] = v >> 16;
902	buf[1] = v >> 8;
903	buf[0] = v;
904	}
905	break;
906	}
907	}
908
909	static void vnc_write_pixels_generic(VncState *vs,
910	void *pixels1, int size)
911	{
912	uint8_t buf[4];
913
914	if (VNC_SERVER_FB_BYTES == 4) {
915	uint32_t *pixels = pixels1;
916	int n, i;
917	n = size >> 2;
918	for (i = 0; i < n; i++) {
919	vnc_convert_pixel(vs, buf, pixels[i]);
920	vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
921	}
922	}
923	}
924
925	int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
926	{
927	int i;
928	uint8_t *row;
929	VncDisplay *vd = vs->vd;
930
931	row = vnc_server_fb_ptr(vd, x, y);
932	for (i = 0; i < h; i++) {
933	vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
934	row += vnc_server_fb_stride(vd);
935	}
936	return 1;
937	}
938
939	int vnc_send_framebuffer_update(VncState vs, VncWorker worker,
940	int x, int y, int w, int h)
941	{
942	int n = 0;
943
944	switch(vs->vnc_encoding) {
945	case VNC_ENCODING_ZLIB:
946	n = vnc_zlib_send_framebuffer_update(vs, worker, x, y, w, h);
947	break;
948	case VNC_ENCODING_HEXTILE:
949	vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
950	n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
951	break;
952	case VNC_ENCODING_TIGHT:
953	n = vnc_tight_send_framebuffer_update(vs, worker, x, y, w, h);
954	break;
955	case VNC_ENCODING_TIGHT_PNG:
956	n = vnc_tight_png_send_framebuffer_update(vs, worker, x, y, w, h);
957	break;
958	case VNC_ENCODING_ZRLE:
959	n = vnc_zrle_send_framebuffer_update(vs, worker, x, y, w, h);
960	break;
961	case VNC_ENCODING_ZYWRLE:
962	n = vnc_zywrle_send_framebuffer_update(vs, worker, x, y, w, h);
963	break;
964	default:
965	vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
966	n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
967	break;
968	}
969	return n;
970	}
971
972	static void vnc_mouse_set(DisplayChangeListener *dcl,
973	int x, int y, bool visible)
974	{
975	/* can we ask the client(s) to move the pointer ??? */
976	}
977
978	static int vnc_cursor_define(VncState *vs)
979	{
980	QEMUCursor *c = qemu_console_get_cursor(vs->vd->dcl.con);
981	int isize;
982
983	if (!c) {
984	return -1;
985	}
986
987	if (vnc_has_feature(vs, VNC_FEATURE_ALPHA_CURSOR)) {
988	vnc_lock_output(vs);
989	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
990	vnc_write_u8(vs, 0); /* padding */
991	vnc_write_u16(vs, 1); /* # of rects */
992	vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
993	VNC_ENCODING_ALPHA_CURSOR);
994	vnc_write_s32(vs, VNC_ENCODING_RAW);
995	vnc_write(vs, c->data, c->width * c->height * 4);
996	vnc_unlock_output(vs);
997	return 0;
998	}
999	if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
1000	vnc_lock_output(vs);
1001	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1002	vnc_write_u8(vs, 0); /* padding */
1003	vnc_write_u16(vs, 1); /* # of rects */
1004	vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
1005	VNC_ENCODING_RICH_CURSOR);
1006	isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
1007	vnc_write_pixels_generic(vs, c->data, isize);
1008	vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
1009	vnc_unlock_output(vs);
1010	return 0;
1011	}
1012	return -1;
1013	}
1014
1015	static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
1016	QEMUCursor *c)
1017	{
1018	VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
1019	VncState *vs;
1020
1021	g_free(vd->cursor_mask);
1022	vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
1023	vd->cursor_mask = g_malloc0(vd->cursor_msize);
1024	cursor_get_mono_mask(c, 0, vd->cursor_mask);
1025
1026	QTAILQ_FOREACH(vs, &vd->clients, next) {
1027	vnc_cursor_define(vs);
1028	}
1029	}
1030
1031	static int find_and_clear_dirty_height(VncState *vs,
1032	int y, int last_x, int x, int height)
1033	{
1034	int h;
1035
1036	for (h = 1; h < (height - y); h++) {
1037	if (!test_bit(last_x, vs->dirty[y + h])) {
1038	break;
1039	}
1040	bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
1041	}
1042
1043	return h;
1044	}
1045
1046	/*
1047	* Figure out how much pending data we should allow in the output
1048	* buffer before we throttle incremental display updates, and/or
1049	* drop audio samples.
1050	*
1051	* We allow for equiv of 1 full display's worth of FB updates,
1052	* and 1 second of audio samples. If audio backlog was larger
1053	* than that the client would already suffering awful audio
1054	* glitches, so dropping samples is no worse really).
1055	*/
1056	static void vnc_update_throttle_offset(VncState *vs)
1057	{
1058	size_t offset =
1059	vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
1060
1061	if (vs->audio_cap) {
1062	int bps;
1063	switch (vs->as.fmt) {
1064	default:
1065	case AUDIO_FORMAT_U8:
1066	case AUDIO_FORMAT_S8:
1067	bps = 1;
1068	break;
1069	case AUDIO_FORMAT_U16:
1070	case AUDIO_FORMAT_S16:
1071	bps = 2;
1072	break;
1073	case AUDIO_FORMAT_U32:
1074	case AUDIO_FORMAT_S32:
1075	bps = 4;
1076	break;
1077	}
1078	offset += vs->as.freq * bps * vs->as.nchannels;
1079	}
1080
1081	/* Put a floor of 1MB on offset, so that if we have a large pending
1082	* buffer and the display is resized to a small size & back again
1083	* we don't suddenly apply a tiny send limit
1084	*/
1085	offset = MAX(offset, 1024 * 1024);
1086
1087	if (vs->throttle_output_offset != offset) {
1088	trace_vnc_client_throttle_threshold(
1089	vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1090	vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1091	}
1092
1093	vs->throttle_output_offset = offset;
1094	}
1095
1096	static bool vnc_should_update(VncState *vs)
1097	{
1098	switch (vs->update) {
1099	case VNC_STATE_UPDATE_NONE:
1100	break;
1101	case VNC_STATE_UPDATE_INCREMENTAL:
1102	/* Only allow incremental updates if the pending send queue
1103	* is less than the permitted threshold, and the job worker
1104	* is completely idle.
1105	*/
1106	if (vs->output.offset < vs->throttle_output_offset &&
1107	vs->job_update == VNC_STATE_UPDATE_NONE) {
1108	return true;
1109	}
1110	trace_vnc_client_throttle_incremental(
1111	vs, vs->ioc, vs->job_update, vs->output.offset);
1112	break;
1113	case VNC_STATE_UPDATE_FORCE:
1114	/* Only allow forced updates if the pending send queue
1115	* does not contain a previous forced update, and the
1116	* job worker is completely idle.
1117	*
1118	* Note this means we'll queue a forced update, even if
1119	* the output buffer size is otherwise over the throttle
1120	* output limit.
1121	*/
1122	if (vs->force_update_offset == 0 &&
1123	vs->job_update == VNC_STATE_UPDATE_NONE) {
1124	return true;
1125	}
1126	trace_vnc_client_throttle_forced(
1127	vs, vs->ioc, vs->job_update, vs->force_update_offset);
1128	break;
1129	}
1130	return false;
1131	}
1132
1133	static int vnc_update_client(VncState *vs, int has_dirty)
1134	{
1135	VncDisplay *vd = vs->vd;
1136	VncJob *job;
1137	int y;
1138	int height, width;
1139	int n = 0;
1140
1141	if (vs->disconnecting) {
1142	vnc_disconnect_finish(vs);
1143	return 0;
1144	}
1145
1146	vs->has_dirty += has_dirty;
1147	if (!vnc_should_update(vs)) {
1148	return 0;
1149	}
1150
1151	if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1152	return 0;
1153	}
1154
1155	/*
1156	* Send screen updates to the vnc client using the server
1157	* surface and server dirty map. guest surface updates
1158	* happening in parallel don't disturb us, the next pass will
1159	* send them to the client.
1160	*/
1161	job = vnc_job_new(vs);
1162
1163	height = pixman_image_get_height(vd->server);
1164	width = pixman_image_get_width(vd->server);
1165
1166	y = 0;
1167	for (;;) {
1168	int x, h;
1169	unsigned long x2;
1170	unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1171	height * VNC_DIRTY_BPL(vs),
1172	y * VNC_DIRTY_BPL(vs));
1173	if (offset == height * VNC_DIRTY_BPL(vs)) {
1174	/* no more dirty bits */
1175	break;
1176	}
1177	y = offset / VNC_DIRTY_BPL(vs);
1178	x = offset % VNC_DIRTY_BPL(vs);
1179	x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1180	VNC_DIRTY_BPL(vs), x);
1181	bitmap_clear(vs->dirty[y], x, x2 - x);
1182	h = find_and_clear_dirty_height(vs, y, x, x2, height);
1183	x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1184	if (x2 > x) {
1185	n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1186	(x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1187	}
1188	if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1189	y += h;
1190	if (y == height) {
1191	break;
1192	}
1193	}
1194	}
1195
1196	vs->job_update = vs->update;
1197	vs->update = VNC_STATE_UPDATE_NONE;
1198	vnc_job_push(job);
1199	vs->has_dirty = 0;
1200	return n;
1201	}
1202
1203	/* audio */
1204	static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1205	{
1206	VncState *vs = opaque;
1207
1208	assert(vs->magic == VNC_MAGIC);
1209	switch (cmd) {
1210	case AUD_CNOTIFY_DISABLE:
1211	trace_vnc_msg_server_audio_end(vs, vs->ioc);
1212	vnc_lock_output(vs);
1213	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1214	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1215	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1216	vnc_unlock_output(vs);
1217	vnc_flush(vs);
1218	break;
1219
1220	case AUD_CNOTIFY_ENABLE:
1221	trace_vnc_msg_server_audio_begin(vs, vs->ioc);
1222	vnc_lock_output(vs);
1223	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1224	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1225	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1226	vnc_unlock_output(vs);
1227	vnc_flush(vs);
1228	break;
1229	}
1230	}
1231
1232	static void audio_capture_destroy(void *opaque)
1233	{
1234	}
1235
1236	static void audio_capture(void opaque, const void buf, int size)
1237	{
1238	VncState *vs = opaque;
1239
1240	assert(vs->magic == VNC_MAGIC);
1241	trace_vnc_msg_server_audio_data(vs, vs->ioc, buf, size);
1242	vnc_lock_output(vs);
1243	if (vs->output.offset < vs->throttle_output_offset) {
1244	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1245	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1246	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1247	vnc_write_u32(vs, size);
1248	vnc_write(vs, buf, size);
1249	} else {
1250	trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1251	}
1252	vnc_unlock_output(vs);
1253	vnc_flush(vs);
1254	}
1255
1256	static void audio_add(VncState *vs)
1257	{
1258	struct audio_capture_ops ops;
1259
1260	if (vs->audio_cap) {
1261	error_report("audio already running");
1262	return;
1263	}
1264
1265	ops.notify = audio_capture_notify;
1266	ops.destroy = audio_capture_destroy;
1267	ops.capture = audio_capture;
1268
1269	vs->audio_cap = audio_be_add_capture(vs->vd->audio_be, &vs->as, &ops, vs);
1270	if (!vs->audio_cap) {
1271	error_report("Failed to add audio capture");
1272	}
1273	}
1274
1275	static void audio_del(VncState *vs)
1276	{
1277	if (vs->audio_cap) {
1278	audio_be_del_capture(vs->vd->audio_be, vs->audio_cap, vs);
1279	vs->audio_cap = NULL;
1280	}
1281	}
1282
1283	static void vnc_disconnect_start(VncState *vs)
1284	{
1285	if (vs->disconnecting) {
1286	return;
1287	}
1288	trace_vnc_client_disconnect_start(vs, vs->ioc);
1289	vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1290	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1291	qio_channel_close(vs->ioc, NULL);
1292	vs->disconnecting = TRUE;
1293	}
1294
1295	static void vnc_disconnect_finish(VncState *vs)
1296	{
1297	VncConnection *vc = container_of(vs, VncConnection, vs);
1298
1299	trace_vnc_client_disconnect_finish(vs, vs->ioc);
1300
1301	vnc_jobs_join(vs); /* Wait encoding jobs */
1302
1303	vnc_lock_output(vs);
1304	vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1305
1306	buffer_free(&vs->input);
1307	buffer_free(&vs->output);
1308
1309	qapi_free_VncClientInfo(vs->info);
1310
1311	vnc_zlib_clear(&vc->worker);
1312	vnc_tight_clear(&vc->worker);
1313	vnc_zrle_clear(&vc->worker);
1314
1315	#ifdef CONFIG_VNC_SASL
1316	vnc_sasl_client_cleanup(vs);
1317	#endif /* CONFIG_VNC_SASL */
1318	audio_del(vs);
1319	qkbd_state_lift_all_keys(vs->vd->kbd);
1320
1321	if (vs->mouse_mode_notifier.notify != NULL) {
1322	qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1323	}
1324	QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1325	if (QTAILQ_EMPTY(&vs->vd->clients)) {
1326	/* last client gone */
1327	vnc_update_server_surface(vs->vd);
1328	}
1329	vnc_unlock_output(vs);
1330
1331	if (vs->cbpeer.notifier.notify) {
1332	qemu_clipboard_peer_unregister(&vs->cbpeer);
1333	}
1334
1335	qemu_mutex_destroy(&vs->output_mutex);
1336	if (vs->bh != NULL) {
1337	qemu_bh_delete(vs->bh);
1338	}
1339	buffer_free(&vs->jobs_buffer);
1340
1341	object_unref(OBJECT(vs->ioc));
1342	vs->ioc = NULL;
1343	object_unref(OBJECT(vs->sioc));
1344	vs->sioc = NULL;
1345	vs->magic = 0;
1346	g_free(vc);
1347	}
1348
1349	size_t vnc_client_io_error(VncState vs, ssize_t ret, Error err)
1350	{
1351	if (ret <= 0) {
1352	if (ret == 0) {
1353	trace_vnc_client_eof(vs, vs->ioc);
1354	vnc_disconnect_start(vs);
1355	} else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1356	trace_vnc_client_io_error(vs, vs->ioc,
1357	err ? error_get_pretty(err) : "Unknown");
1358	vnc_disconnect_start(vs);
1359	}
1360
1361	error_free(err);
1362	return 0;
1363	}
1364	return ret;
1365	}
1366
1367
1368	void vnc_client_error(VncState *vs)
1369	{
1370	trace_vnc_client_protocol_error(vs);
1371	vnc_disconnect_start(vs);
1372	}
1373
1374
1375	/*
1376	* Called to write a chunk of data to the client socket. The data may
1377	* be the raw data, or may have already been encoded by SASL.
1378	* The data will be written either straight onto the socket, or
1379	* written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1380	*
1381	* NB, it is theoretically possible to have 2 layers of encryption,
1382	* both SASL, and this TLS layer. It is highly unlikely in practice
1383	* though, since SASL encryption will typically be a no-op if TLS
1384	* is active
1385	*
1386	* Returns the number of bytes written, which may be less than
1387	* the requested 'datalen' if the socket would block. Returns
1388	* 0 on I/O error, and disconnects the client socket.
1389	*/
1390	size_t vnc_client_write_buf(VncState vs, const uint8_t data, size_t datalen)
1391	{
1392	Error *err = NULL;
1393	ssize_t ret;
1394	ret = qio_channel_write(vs->ioc, (const char *)data, datalen, &err);
1395	trace_vnc_client_write_wire(vs, data, datalen, ret);
1396	return vnc_client_io_error(vs, ret, err);
1397	}
1398
1399
1400	/*
1401	* Called to write buffered data to the client socket, when not
1402	* using any SASL SSF encryption layers. Will write as much data
1403	* as possible without blocking. If all buffered data is written,
1404	* will switch the FD poll() handler back to read monitoring.
1405	*
1406	* Returns the number of bytes written, which may be less than
1407	* the buffered output data if the socket would block. Returns
1408	* 0 on I/O error, and disconnects the client socket.
1409	*/
1410	static size_t vnc_client_write_plain(VncState *vs)
1411	{
1412	size_t offset;
1413	size_t ret;
1414
1415	#ifdef CONFIG_VNC_SASL
1416	trace_vnc_client_write_plain(vs, vs->output.buffer,
1417	vs->output.capacity, vs->output.offset,
1418	vs->sasl.waitWriteSSF);
1419
1420	if (vs->sasl.conn &&
1421	vs->sasl.runSSF &&
1422	vs->sasl.waitWriteSSF) {
1423	ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1424	if (ret)
1425	vs->sasl.waitWriteSSF -= ret;
1426	} else
1427	#endif /* CONFIG_VNC_SASL */
1428	ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1429	if (!ret)
1430	return 0;
1431
1432	if (ret >= vs->force_update_offset) {
1433	if (vs->force_update_offset != 0) {
1434	trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1435	}
1436	vs->force_update_offset = 0;
1437	} else {
1438	vs->force_update_offset -= ret;
1439	}
1440	offset = vs->output.offset;
1441	buffer_advance(&vs->output, ret);
1442	if (offset >= vs->throttle_output_offset &&
1443	vs->output.offset < vs->throttle_output_offset) {
1444	trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1445	}
1446
1447	if (vs->output.offset == 0) {
1448	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1449	vs->ioc_tag = qio_channel_add_watch(
1450	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR,
1451	vnc_client_io, vs, NULL);
1452	}
1453
1454	return ret;
1455	}
1456
1457
1458	/*
1459	* First function called whenever there is data to be written to
1460	* the client socket. Will delegate actual work according to whether
1461	* SASL SSF layers are enabled (thus requiring encryption calls)
1462	*/
1463	static void vnc_client_write_locked(VncState *vs)
1464	{
1465	#ifdef CONFIG_VNC_SASL
1466	if (vs->sasl.conn &&
1467	vs->sasl.runSSF &&
1468	!vs->sasl.waitWriteSSF) {
1469	vnc_client_write_sasl(vs);
1470	} else
1471	#endif /* CONFIG_VNC_SASL */
1472	{
1473	vnc_client_write_plain(vs);
1474	}
1475	}
1476
1477	static void vnc_client_write(VncState *vs)
1478	{
1479	assert(vs->magic == VNC_MAGIC);
1480	vnc_lock_output(vs);
1481	if (vs->output.offset) {
1482	vnc_client_write_locked(vs);
1483	} else if (vs->ioc != NULL) {
1484	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1485	vs->ioc_tag = qio_channel_add_watch(
1486	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR,
1487	vnc_client_io, vs, NULL);
1488	}
1489	vnc_unlock_output(vs);
1490	}
1491
1492	void vnc_read_when(VncState vs, VncReadEvent func, size_t expecting)
1493	{
1494	vs->read_handler = func;
1495	vs->read_handler_expect = expecting;
1496	}
1497
1498
1499	/*
1500	* Called to read a chunk of data from the client socket. The data may
1501	* be the raw data, or may need to be further decoded by SASL.
1502	* The data will be read either straight from to the socket, or
1503	* read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1504	*
1505	* NB, it is theoretically possible to have 2 layers of encryption,
1506	* both SASL, and this TLS layer. It is highly unlikely in practice
1507	* though, since SASL encryption will typically be a no-op if TLS
1508	* is active
1509	*
1510	* Returns the number of bytes read, which may be less than
1511	* the requested 'datalen' if the socket would block. Returns
1512	* 0 on I/O error or EOF, and disconnects the client socket.
1513	*/
1514	size_t vnc_client_read_buf(VncState vs, uint8_t data, size_t datalen)
1515	{
1516	ssize_t ret;
1517	Error *err = NULL;
1518	ret = qio_channel_read(vs->ioc, (char *)data, datalen, &err);
1519	trace_vnc_client_read_wire(vs, data, datalen, ret);
1520	return vnc_client_io_error(vs, ret, err);
1521	}
1522
1523
1524	/*
1525	* Called to read data from the client socket to the input buffer,
1526	* when not using any SASL SSF encryption layers. Will read as much
1527	* data as possible without blocking.
1528	*
1529	* Returns the number of bytes read, which may be less than
1530	* the requested 'datalen' if the socket would block. Returns
1531	* 0 on I/O error or EOF, and disconnects the client socket.
1532	*/
1533	static size_t vnc_client_read_plain(VncState *vs)
1534	{
1535	size_t ret;
1536	trace_vnc_client_read_plain(vs, vs->input.buffer,
1537	vs->input.capacity, vs->input.offset);
1538	buffer_reserve(&vs->input, 4096);
1539	ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1540	if (!ret)
1541	return 0;
1542	vs->input.offset += ret;
1543	return ret;
1544	}
1545
1546	static void vnc_jobs_bh(void *opaque)
1547	{
1548	VncState *vs = opaque;
1549
1550	assert(vs->magic == VNC_MAGIC);
1551	vnc_jobs_consume_buffer(vs);
1552	}
1553
1554	/*
1555	* First function called whenever there is more data to be read from
1556	* the client socket. Will delegate actual work according to whether
1557	* SASL SSF layers are enabled (thus requiring decryption calls)
1558	* Returns 0 on success, -1 if client disconnected
1559	*/
1560	static int vnc_client_read(VncState *vs)
1561	{
1562	size_t sz;
1563
1564	#ifdef CONFIG_VNC_SASL
1565	if (vs->sasl.conn && vs->sasl.runSSF)
1566	sz = vnc_client_read_sasl(vs);
1567	else
1568	#endif /* CONFIG_VNC_SASL */
1569	sz = vnc_client_read_plain(vs);
1570	if (!sz) {
1571	if (vs->disconnecting) {
1572	vnc_disconnect_finish(vs);
1573	return -1;
1574	}
1575	return 0;
1576	}
1577
1578	while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1579	size_t len = vs->read_handler_expect;
1580	int ret;
1581
1582	ret = vs->read_handler(vs, vs->input.buffer, len);
1583	if (vs->disconnecting) {
1584	vnc_disconnect_finish(vs);
1585	return -1;
1586	}
1587
1588	if (!ret) {
1589	buffer_advance(&vs->input, len);
1590	} else {
1591	vs->read_handler_expect = ret;
1592	}
1593	}
1594	return 0;
1595	}
1596
1597	gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1598	GIOCondition condition, void *opaque)
1599	{
1600	VncState *vs = opaque;
1601
1602	assert(vs->magic == VNC_MAGIC);
1603
1604	if (condition & (G_IO_HUP \| G_IO_ERR)) {
1605	vnc_disconnect_start(vs);
1606	return TRUE;
1607	}
1608
1609	if (condition & G_IO_IN) {
1610	if (vnc_client_read(vs) < 0) {
1611	/* vs is free()ed here */
1612	return TRUE;
1613	}
1614	}
1615	if (condition & G_IO_OUT) {
1616	vnc_client_write(vs);
1617	}
1618
1619	if (vs->disconnecting) {
1620	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1621	}
1622	return TRUE;
1623	}
1624
1625
1626	/*
1627	* Scale factor to apply to vs->throttle_output_offset when checking for
1628	* hard limit. Worst case normal usage could be x2, if we have a complete
1629	* incremental update and complete forced update in the output buffer.
1630	* So x3 should be good enough, but we pick x5 to be conservative and thus
1631	* (hopefully) never trigger incorrectly.
1632	*/
1633	#define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1634
1635	void vnc_write(VncState vs, const void data, size_t len)
1636	{
1637	assert(vs->magic == VNC_MAGIC);
1638	if (vs->disconnecting) {
1639	return;
1640	}
1641	/* Protection against malicious client/guest to prevent our output
1642	* buffer growing without bound if client stops reading data. This
1643	* should rarely trigger, because we have earlier throttling code
1644	* which stops issuing framebuffer updates and drops audio data
1645	* if the throttle_output_offset value is exceeded. So we only reach
1646	* this higher level if a huge number of pseudo-encodings get
1647	* triggered while data can't be sent on the socket.
1648	*
1649	* NB throttle_output_offset can be zero during early protocol
1650	* handshake, or from the job thread's VncState clone
1651	*/
1652	if (vs->throttle_output_offset != 0 &&
1653	(vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1654	vs->throttle_output_offset) {
1655	trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1656	vs->throttle_output_offset);
1657	vnc_disconnect_start(vs);
1658	return;
1659	}
1660	buffer_reserve(&vs->output, len);
1661
1662	if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1663	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1664	vs->ioc_tag = qio_channel_add_watch(
1665	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR \| G_IO_OUT,
1666	vnc_client_io, vs, NULL);
1667	}
1668
1669	buffer_append(&vs->output, data, len);
1670	}
1671
1672	void vnc_write_s32(VncState *vs, int32_t value)
1673	{
1674	vnc_write_u32(vs, (uint32_t )&value);
1675	}
1676
1677	void vnc_write_u32(VncState *vs, uint32_t value)
1678	{
1679	uint8_t buf[4];
1680
1681	buf[0] = (value >> 24) & 0xFF;
1682	buf[1] = (value >> 16) & 0xFF;
1683	buf[2] = (value >> 8) & 0xFF;
1684	buf[3] = value & 0xFF;
1685
1686	vnc_write(vs, buf, 4);
1687	}
1688
1689	void vnc_write_u16(VncState *vs, uint16_t value)
1690	{
1691	uint8_t buf[2];
1692
1693	buf[0] = (value >> 8) & 0xFF;
1694	buf[1] = value & 0xFF;
1695
1696	vnc_write(vs, buf, 2);
1697	}
1698
1699	void vnc_write_u8(VncState *vs, uint8_t value)
1700	{
1701	vnc_write(vs, (char *)&value, 1);
1702	}
1703
1704	void vnc_flush(VncState *vs)
1705	{
1706	vnc_lock_output(vs);
1707	if (vs->ioc != NULL && !buffer_empty(&vs->output)) {
1708	vnc_client_write_locked(vs);
1709	}
1710	if (vs->disconnecting) {
1711	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
1712	}
1713	vnc_unlock_output(vs);
1714	}
1715
1716	static uint8_t read_u8(uint8_t *data, size_t offset)
1717	{
1718	return data[offset];
1719	}
1720
1721	static uint16_t read_u16(uint8_t *data, size_t offset)
1722	{
1723	return ((data[offset] & 0xFF) << 8) \| (data[offset + 1] & 0xFF);
1724	}
1725
1726	static int32_t read_s32(uint8_t *data, size_t offset)
1727	{
1728	return (int32_t)((data[offset] << 24) \| (data[offset + 1] << 16) \|
1729	(data[offset + 2] << 8) \| data[offset + 3]);
1730	}
1731
1732	uint32_t read_u32(uint8_t *data, size_t offset)
1733	{
1734	return ((data[offset] << 24) \| (data[offset + 1] << 16) \|
1735	(data[offset + 2] << 8) \| data[offset + 3]);
1736	}
1737
1738	static void check_pointer_type_change(Notifier notifier, void data)
1739	{
1740	VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1741	int absolute = qemu_input_is_absolute(vs->vd->dcl.con);
1742
1743	if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1744	vnc_lock_output(vs);
1745	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1746	vnc_write_u8(vs, 0);
1747	vnc_write_u16(vs, 1);
1748	vnc_framebuffer_update(vs, absolute, 0,
1749	pixman_image_get_width(vs->vd->server),
1750	pixman_image_get_height(vs->vd->server),
1751	VNC_ENCODING_POINTER_TYPE_CHANGE);
1752	vnc_unlock_output(vs);
1753	vnc_flush(vs);
1754	}
1755	vs->absolute = absolute;
1756	}
1757
1758	static void pointer_event(VncState *vs, uint8_t button_mask,
1759	uint16_t x, uint16_t y)
1760	{
1761	static uint32_t bmap[INPUT_BUTTON__MAX] = {
1762	[INPUT_BUTTON_LEFT] = 0x01,
1763	[INPUT_BUTTON_MIDDLE] = 0x02,
1764	[INPUT_BUTTON_RIGHT] = 0x04,
1765	[INPUT_BUTTON_WHEEL_UP] = 0x08,
1766	[INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1767	};
1768	QemuConsole *con = vs->vd->dcl.con;
1769	int width = pixman_image_get_width(vs->vd->server);
1770	int height = pixman_image_get_height(vs->vd->server);
1771
1772	if (vs->last_bmask != button_mask) {
1773	qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1774	vs->last_bmask = button_mask;
1775	}
1776
1777	if (vs->absolute) {
1778	qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1779	qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1780	} else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1781	qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1782	qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1783	} else {
1784	if (vs->last_x != -1) {
1785	qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1786	qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1787	}
1788	vs->last_x = x;
1789	vs->last_y = y;
1790	}
1791	qemu_input_event_sync();
1792	}
1793
1794	static void press_key(VncState *vs, unsigned int lnx)
1795	{
1796	qkbd_state_key_event(vs->vd->kbd, lnx, true);
1797	qkbd_state_key_event(vs->vd->kbd, lnx, false);
1798	}
1799
1800	static void vnc_led_state_change(VncState *vs)
1801	{
1802	if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1803	return;
1804	}
1805
1806	vnc_lock_output(vs);
1807	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1808	vnc_write_u8(vs, 0);
1809	vnc_write_u16(vs, 1);
1810	vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1811	vnc_write_u8(vs, vs->vd->ledstate);
1812	vnc_unlock_output(vs);
1813	vnc_flush(vs);
1814	}
1815
1816	static void kbd_leds(Notifier notifier, void data)
1817	{
1818	VncDisplay *vd = container_of(notifier, VncDisplay, led_notifier);
1819	int ledstate = qemu_input_get_leds_mask(vd->dcl.con);
1820	VncState *client;
1821
1822	trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1823	(ledstate & QEMU_NUM_LOCK_LED),
1824	(ledstate & QEMU_SCROLL_LOCK_LED));
1825
1826	if (ledstate == vd->ledstate) {
1827	return;
1828	}
1829
1830	vd->ledstate = ledstate;
1831
1832	QTAILQ_FOREACH(client, &vd->clients, next) {
1833	vnc_led_state_change(client);
1834	}
1835	}
1836
1837	static void do_key_event(VncState *vs, int down, int keycode, uint32_t sym)
1838	{
1839	unsigned int lnx = qemu_input_key_number_to_linux(keycode);
1840
1841	/* QEMU console switch */
1842	switch (lnx) {
1843	case KEY_1 ... KEY_9: /* '1' to '9' keys */
1844	if (down &&
1845	qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL) &&
1846	qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_ALT)) {
1847	QemuConsole *con = qemu_console_lookup_by_index(lnx - KEY_1);
1848	if (con) {
1849	qemu_console_unregister_listener(&vs->vd->dcl);
1850	qkbd_state_switch_console(vs->vd->kbd, con);
1851	qemu_console_register_listener(con, &vs->vd->dcl, vs->vd->dcl.ops);
1852	}
1853	return;
1854	}
1855	default:
1856	break;
1857	}
1858
1859	/* Turn off the lock state sync logic if the client support the led
1860	state extension.
1861	*/
1862	if (down && vs->vd->lock_key_sync &&
1863	!vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1864	keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1865	/* If the numlock state needs to change then simulate an additional
1866	keypress before sending this one. This will happen if the user
1867	toggles numlock away from the VNC window.
1868	*/
1869	if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1870	if (!qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
1871	trace_vnc_key_sync_numlock(true);
1872	press_key(vs, KEY_NUMLOCK);
1873	}
1874	} else {
1875	if (qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
1876	trace_vnc_key_sync_numlock(false);
1877	press_key(vs, KEY_NUMLOCK);
1878	}
1879	}
1880	}
1881
1882	if (down && vs->vd->lock_key_sync &&
1883	!vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1884	((sym >= 'A' && sym <= 'Z') \|\| (sym >= 'a' && sym <= 'z'))) {
1885	/* If the capslock state needs to change then simulate an additional
1886	keypress before sending this one. This will happen if the user
1887	toggles capslock away from the VNC window.
1888	*/
1889	int uppercase = !!(sym >= 'A' && sym <= 'Z');
1890	bool shift = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_SHIFT);
1891	bool capslock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CAPSLOCK);
1892	if (capslock) {
1893	if (uppercase == shift) {
1894	trace_vnc_key_sync_capslock(false);
1895	press_key(vs, KEY_CAPSLOCK);
1896	}
1897	} else {
1898	if (uppercase != shift) {
1899	trace_vnc_key_sync_capslock(true);
1900	press_key(vs, KEY_CAPSLOCK);
1901	}
1902	}
1903	}
1904
1905	qkbd_state_key_event(vs->vd->kbd, lnx, down);
1906	if (QEMU_IS_TEXT_CONSOLE(vs->vd->dcl.con)) {
1907	QemuTextConsole *con = QEMU_TEXT_CONSOLE(vs->vd->dcl.con);
1908	bool numlock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK);
1909	bool control = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL);
1910	/* QEMU console emulation */
1911	if (down) {
1912	switch (keycode) {
1913	case 0x2a: /* Left Shift */
1914	case 0x36: /* Right Shift */
1915	case 0x1d: /* Left CTRL */
1916	case 0x9d: /* Right CTRL */
1917	case 0x38: /* Left ALT */
1918	case 0xb8: /* Right ALT */
1919	break;
1920	case 0xc8:
1921	qemu_text_console_put_keysym(con, QEMU_KEY_UP);
1922	break;
1923	case 0xd0:
1924	qemu_text_console_put_keysym(con, QEMU_KEY_DOWN);
1925	break;
1926	case 0xcb:
1927	qemu_text_console_put_keysym(con, QEMU_KEY_LEFT);
1928	break;
1929	case 0xcd:
1930	qemu_text_console_put_keysym(con, QEMU_KEY_RIGHT);
1931	break;
1932	case 0xd3:
1933	qemu_text_console_put_keysym(con, QEMU_KEY_DELETE);
1934	break;
1935	case 0xc7:
1936	qemu_text_console_put_keysym(con, QEMU_KEY_HOME);
1937	break;
1938	case 0xcf:
1939	qemu_text_console_put_keysym(con, QEMU_KEY_END);
1940	break;
1941	case 0xc9:
1942	qemu_text_console_put_keysym(con, QEMU_KEY_PAGEUP);
1943	break;
1944	case 0xd1:
1945	qemu_text_console_put_keysym(con, QEMU_KEY_PAGEDOWN);
1946	break;
1947
1948	case 0x47:
1949	qemu_text_console_put_keysym(con, numlock ? '7' : QEMU_KEY_HOME);
1950	break;
1951	case 0x48:
1952	qemu_text_console_put_keysym(con, numlock ? '8' : QEMU_KEY_UP);
1953	break;
1954	case 0x49:
1955	qemu_text_console_put_keysym(con, numlock ? '9' : QEMU_KEY_PAGEUP);
1956	break;
1957	case 0x4b:
1958	qemu_text_console_put_keysym(con, numlock ? '4' : QEMU_KEY_LEFT);
1959	break;
1960	case 0x4c:
1961	qemu_text_console_put_keysym(con, '5');
1962	break;
1963	case 0x4d:
1964	qemu_text_console_put_keysym(con, numlock ? '6' : QEMU_KEY_RIGHT);
1965	break;
1966	case 0x4f:
1967	qemu_text_console_put_keysym(con, numlock ? '1' : QEMU_KEY_END);
1968	break;
1969	case 0x50:
1970	qemu_text_console_put_keysym(con, numlock ? '2' : QEMU_KEY_DOWN);
1971	break;
1972	case 0x51:
1973	qemu_text_console_put_keysym(con, numlock ? '3' : QEMU_KEY_PAGEDOWN);
1974	break;
1975	case 0x52:
1976	qemu_text_console_put_keysym(con, '0');
1977	break;
1978	case 0x53:
1979	qemu_text_console_put_keysym(con, numlock ? '.' : QEMU_KEY_DELETE);
1980	break;
1981
1982	case 0xb5:
1983	qemu_text_console_put_keysym(con, '/');
1984	break;
1985	case 0x37:
1986	qemu_text_console_put_keysym(con, '*');
1987	break;
1988	case 0x4a:
1989	qemu_text_console_put_keysym(con, '-');
1990	break;
1991	case 0x4e:
1992	qemu_text_console_put_keysym(con, '+');
1993	break;
1994	case 0x9c:
1995	qemu_text_console_put_keysym(con, '\n');
1996	break;
1997
1998	default:
1999	if (control) {
2000	qemu_text_console_put_keysym(con, sym & 0x1f);
2001	} else {
2002	qemu_text_console_put_keysym(con, sym);
2003	}
2004	break;
2005	}
2006	}
2007	}
2008	}
2009
2010	static const char *code2name(int keycode)
2011	{
2012	return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
2013	}
2014
2015	static void key_event(VncState *vs, bool down, uint32_t sym)
2016	{
2017	int keycode;
2018	int lsym = sym;
2019
2020	if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(vs->vd->dcl.con)) {
2021	lsym = lsym - 'A' + 'a';
2022	}
2023
2024	keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
2025	vs->vd->kbd, down) & SCANCODE_KEYMASK;
2026	trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
2027	do_key_event(vs, down, keycode, sym);
2028	}
2029
2030	static void ext_key_event(VncState *vs, bool down,
2031	uint32_t sym, uint32_t keycode)
2032	{
2033	/* if the user specifies a keyboard layout, always use it */
2034	if (keyboard_layout) {
2035	key_event(vs, down, sym);
2036	} else {
2037	trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2038	do_key_event(vs, down, keycode, sym);
2039	}
2040	}
2041
2042	static void framebuffer_update_request(VncState *vs, uint8_t incremental,
2043	uint16_t x, uint16_t y,
2044	uint16_t w, uint16_t h)
2045	{
2046	if (incremental) {
2047	if (vs->update != VNC_STATE_UPDATE_FORCE) {
2048	vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2049	}
2050	} else {
2051	vs->update = VNC_STATE_UPDATE_FORCE;
2052	vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2053	if (vnc_has_feature(vs, VNC_FEATURE_RESIZE_EXT)) {
2054	vnc_desktop_resize_ext(vs, 0);
2055	}
2056	}
2057	}
2058
2059	static void send_ext_key_event_ack(VncState *vs)
2060	{
2061	vnc_lock_output(vs);
2062	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2063	vnc_write_u8(vs, 0);
2064	vnc_write_u16(vs, 1);
2065	vnc_framebuffer_update(vs, 0, 0,
2066	pixman_image_get_width(vs->vd->server),
2067	pixman_image_get_height(vs->vd->server),
2068	VNC_ENCODING_EXT_KEY_EVENT);
2069	vnc_unlock_output(vs);
2070	vnc_flush(vs);
2071	}
2072
2073	static void send_ext_audio_ack(VncState *vs)
2074	{
2075	vnc_lock_output(vs);
2076	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2077	vnc_write_u8(vs, 0);
2078	vnc_write_u16(vs, 1);
2079	vnc_framebuffer_update(vs, 0, 0,
2080	pixman_image_get_width(vs->vd->server),
2081	pixman_image_get_height(vs->vd->server),
2082	VNC_ENCODING_AUDIO);
2083	vnc_unlock_output(vs);
2084	vnc_flush(vs);
2085	}
2086
2087	static void send_xvp_message(VncState *vs, int code)
2088	{
2089	vnc_lock_output(vs);
2090	vnc_write_u8(vs, VNC_MSG_SERVER_XVP);
2091	vnc_write_u8(vs, 0); /* pad */
2092	vnc_write_u8(vs, 1); /* version */
2093	vnc_write_u8(vs, code);
2094	vnc_unlock_output(vs);
2095	vnc_flush(vs);
2096	}
2097
2098	static void set_encodings(VncState vs, int32_t encodings, size_t n_encodings)
2099	{
2100	VncConnection *vc = container_of(vs, VncConnection, vs);
2101	int i;
2102	unsigned int enc = 0;
2103
2104	vs->features = 0;
2105	vs->vnc_encoding = 0;
2106	vc->worker.tight.compression = 9;
2107	vc->worker.tight.quality = -1; /* Lossless by default */
2108	vs->absolute = -1;
2109
2110	/*
2111	* Start from the end because the encodings are sent in order of preference.
2112	* This way the preferred encoding (first encoding defined in the array)
2113	* will be set at the end of the loop.
2114	*/
2115	for (i = n_encodings - 1; i >= 0; i--) {
2116	enc = encodings[i];
2117	switch (enc) {
2118	case VNC_ENCODING_RAW:
2119	vs->vnc_encoding = enc;
2120	break;
2121	case VNC_ENCODING_HEXTILE:
2122	vnc_set_feature(vs, VNC_FEATURE_HEXTILE);
2123	vs->vnc_encoding = enc;
2124	break;
2125	case VNC_ENCODING_TIGHT:
2126	vnc_set_feature(vs, VNC_FEATURE_TIGHT);
2127	vs->vnc_encoding = enc;
2128	break;
2129	#ifdef CONFIG_PNG
2130	case VNC_ENCODING_TIGHT_PNG:
2131	vnc_set_feature(vs, VNC_FEATURE_TIGHT_PNG);
2132	vs->vnc_encoding = enc;
2133	break;
2134	#endif
2135	case VNC_ENCODING_ZLIB:
2136	/*
2137	* VNC_ENCODING_ZRLE compresses better than VNC_ENCODING_ZLIB.
2138	* So prioritize ZRLE, even if the client hints that it prefers
2139	* ZLIB.
2140	*/
2141	if (!vnc_has_feature(vs, VNC_FEATURE_ZRLE)) {
2142	vnc_set_feature(vs, VNC_FEATURE_ZLIB);
2143	vs->vnc_encoding = enc;
2144	}
2145	break;
2146	case VNC_ENCODING_ZRLE:
2147	vnc_set_feature(vs, VNC_FEATURE_ZRLE);
2148	vs->vnc_encoding = enc;
2149	break;
2150	case VNC_ENCODING_ZYWRLE:
2151	vnc_set_feature(vs, VNC_FEATURE_ZYWRLE);
2152	vs->vnc_encoding = enc;
2153	break;
2154	case VNC_ENCODING_DESKTOPRESIZE:
2155	vnc_set_feature(vs, VNC_FEATURE_RESIZE);
2156	break;
2157	case VNC_ENCODING_DESKTOP_RESIZE_EXT:
2158	vnc_set_feature(vs, VNC_FEATURE_RESIZE_EXT);
2159	break;
2160	case VNC_ENCODING_POINTER_TYPE_CHANGE:
2161	vnc_set_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE);
2162	break;
2163	case VNC_ENCODING_RICH_CURSOR:
2164	vnc_set_feature(vs, VNC_FEATURE_RICH_CURSOR);
2165	break;
2166	case VNC_ENCODING_ALPHA_CURSOR:
2167	vnc_set_feature(vs, VNC_FEATURE_ALPHA_CURSOR);
2168	break;
2169	case VNC_ENCODING_EXT_KEY_EVENT:
2170	send_ext_key_event_ack(vs);
2171	break;
2172	case VNC_ENCODING_AUDIO:
2173	if (vs->vd->audio_be) {
2174	vnc_set_feature(vs, VNC_FEATURE_AUDIO);
2175	send_ext_audio_ack(vs);
2176	}
2177	break;
2178	case VNC_ENCODING_WMVi:
2179	vnc_set_feature(vs, VNC_FEATURE_WMVI);
2180	break;
2181	case VNC_ENCODING_LED_STATE:
2182	vnc_set_feature(vs, VNC_FEATURE_LED_STATE);
2183	break;
2184	case VNC_ENCODING_XVP:
2185	if (vs->vd->power_control) {
2186	vnc_set_feature(vs, VNC_FEATURE_XVP);
2187	send_xvp_message(vs, VNC_XVP_CODE_INIT);
2188	}
2189	break;
2190	case VNC_ENCODING_CLIPBOARD_EXT:
2191	vnc_set_feature(vs, VNC_FEATURE_CLIPBOARD_EXT);
2192	vnc_server_cut_text_caps(vs);
2193	break;
2194	case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2195	vc->worker.tight.compression = (enc & 0x0F);
2196	break;
2197	case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2198	if (vs->vd->lossy) {
2199	vc->worker.tight.quality = (enc & 0x0F);
2200	}
2201	break;
2202	default:
2203	trace_vnc_client_unknown_encoding(vs, i, enc);
2204	break;
2205	}
2206	}
2207	vnc_desktop_resize(vs);
2208	check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2209	vnc_led_state_change(vs);
2210	vnc_cursor_define(vs);
2211	}
2212
2213	static void set_pixel_conversion(VncState *vs)
2214	{
2215	pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf,
2216	vs->client_endian);
2217
2218	if (fmt == VNC_SERVER_FB_FORMAT) {
2219	vs->write_pixels = vnc_write_pixels_copy;
2220	vnc_hextile_set_pixel_conversion(vs, 0);
2221	} else {
2222	vs->write_pixels = vnc_write_pixels_generic;
2223	vnc_hextile_set_pixel_conversion(vs, 1);
2224	}
2225	}
2226
2227	static void send_color_map(VncState *vs)
2228	{
2229	int i;
2230
2231	vnc_lock_output(vs);
2232	vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2233	vnc_write_u8(vs, 0); /* padding */
2234	vnc_write_u16(vs, 0); /* first color */
2235	vnc_write_u16(vs, 256); /* # of colors */
2236
2237	for (i = 0; i < 256; i++) {
2238	PixelFormat *pf = &vs->client_pf;
2239
2240	vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2241	vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2242	vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2243	}
2244	vnc_unlock_output(vs);
2245	}
2246
2247	static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel,
2248	uint8_t big_endian_flag, uint8_t true_color_flag,
2249	uint16_t red_max, uint16_t green_max,
2250	uint16_t blue_max, uint8_t red_shift,
2251	uint8_t green_shift, uint8_t blue_shift)
2252	{
2253	if (!true_color_flag) {
2254	/* Expose a reasonable default 256 color map */
2255	bits_per_pixel = 8;
2256	red_max = 7;
2257	green_max = 7;
2258	blue_max = 3;
2259	red_shift = 0;
2260	green_shift = 3;
2261	blue_shift = 6;
2262	}
2263
2264	switch (bits_per_pixel) {
2265	case 8:
2266	case 16:
2267	case 32:
2268	break;
2269	default:
2270	vnc_client_error(vs);
2271	return;
2272	}
2273
2274	if (red_max > UINT8_MAX \|\| green_max > UINT8_MAX \|\| blue_max > UINT8_MAX) {
2275	vnc_client_error(vs);
2276	return;
2277	}
2278
2279	if (red_shift >= bits_per_pixel \|\| red_shift >= 32 \|\|
2280	green_shift >= bits_per_pixel \|\| green_shift >= 32 \|\|
2281	blue_shift >= bits_per_pixel \|\| blue_shift >= 32) {
2282	vnc_client_error(vs);
2283	return;
2284	}
2285
2286	vs->client_pf.rmax = red_max ? red_max : 0xFF;
2287	vs->client_pf.rbits = ctpopl(red_max);
2288	vs->client_pf.rshift = red_shift;
2289	vs->client_pf.rmask = (uint32_t)red_max << red_shift;
2290	vs->client_pf.gmax = green_max ? green_max : 0xFF;
2291	vs->client_pf.gbits = ctpopl(green_max);
2292	vs->client_pf.gshift = green_shift;
2293	vs->client_pf.gmask = (uint32_t)green_max << green_shift;
2294	vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2295	vs->client_pf.bbits = ctpopl(blue_max);
2296	vs->client_pf.bshift = blue_shift;
2297	vs->client_pf.bmask = (uint32_t)blue_max << blue_shift;
2298	vs->client_pf.bits_per_pixel = bits_per_pixel;
2299	vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2300	vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2301	vs->client_endian = big_endian_flag ? G_BIG_ENDIAN : G_LITTLE_ENDIAN;
2302	trace_vnc_client_pixel_format(vs, vs->ioc,
2303	vs->client_pf.bits_per_pixel,
2304	vs->client_pf.depth,
2305	vs->client_endian);
2306	trace_vnc_client_pixel_format_red(vs, vs->ioc,
2307	vs->client_pf.rmax,
2308	vs->client_pf.rbits,
2309	vs->client_pf.rshift,
2310	vs->client_pf.rmask);
2311	trace_vnc_client_pixel_format_green(vs, vs->ioc,
2312	vs->client_pf.gmax,
2313	vs->client_pf.gbits,
2314	vs->client_pf.gshift,
2315	vs->client_pf.gmask);
2316	trace_vnc_client_pixel_format_blue(vs, vs->ioc,
2317	vs->client_pf.bmax,
2318	vs->client_pf.bbits,
2319	vs->client_pf.bshift,
2320	vs->client_pf.bmask);
2321
2322	if (!true_color_flag) {
2323	send_color_map(vs);
2324	}
2325
2326	set_pixel_conversion(vs);
2327
2328	qemu_console_hw_invalidate(vs->vd->dcl.con);
2329	qemu_console_hw_update(vs->vd->dcl.con);
2330	}
2331
2332	static void pixel_format_message (VncState *vs) {
2333	char pad[3] = { 0, 0, 0 };
2334
2335	vs->client_pf = qemu_default_pixelformat(32);
2336	vs->client_endian = G_BYTE_ORDER;
2337
2338	vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2339	vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2340
2341	#if HOST_BIG_ENDIAN
2342	vnc_write_u8(vs, 1); /* big-endian-flag */
2343	#else
2344	vnc_write_u8(vs, 0); /* big-endian-flag */
2345	#endif
2346	vnc_write_u8(vs, 1); /* true-color-flag */
2347	vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2348	vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2349	vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2350	vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2351	vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2352	vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2353	vnc_write(vs, pad, 3); /* padding */
2354
2355	vnc_hextile_set_pixel_conversion(vs, 0);
2356	vs->write_pixels = vnc_write_pixels_copy;
2357	}
2358
2359	static void vnc_colordepth(VncState *vs)
2360	{
2361	if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2362	/* Sending a WMVi message to notify the client*/
2363	vnc_lock_output(vs);
2364	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2365	vnc_write_u8(vs, 0);
2366	vnc_write_u16(vs, 1); /* number of rects */
2367	vnc_framebuffer_update(vs, 0, 0,
2368	vs->client_width,
2369	vs->client_height,
2370	VNC_ENCODING_WMVi);
2371	pixel_format_message(vs);
2372	vnc_unlock_output(vs);
2373	vnc_flush(vs);
2374	} else {
2375	set_pixel_conversion(vs);
2376	}
2377	}
2378
2379	static int protocol_client_msg(VncState vs, uint8_t data, size_t len)
2380	{
2381	int i;
2382	uint16_t limit;
2383	uint32_t freq;
2384	VncDisplay *vd = vs->vd;
2385
2386	if (data[0] > 3) {
2387	qemu_console_listener_set_refresh(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2388	}
2389
2390	switch (data[0]) {
2391	case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2392	if (len == 1)
2393	return 20;
2394
2395	trace_vnc_msg_client_set_pixel_format(vs, vs->ioc,
2396	read_u8(data, 4),
2397	read_u8(data, 6),
2398	read_u8(data, 7));
2399	trace_vnc_msg_client_set_pixel_format_rgb(vs, vs->ioc,
2400	read_u16(data, 8),
2401	read_u16(data, 10),
2402	read_u16(data, 12),
2403	read_u8(data, 14),
2404	read_u8(data, 15),
2405	read_u8(data, 16));
2406	set_pixel_format(vs, read_u8(data, 4),
2407	read_u8(data, 6), read_u8(data, 7),
2408	read_u16(data, 8), read_u16(data, 10),
2409	read_u16(data, 12), read_u8(data, 14),
2410	read_u8(data, 15), read_u8(data, 16));
2411	break;
2412	case VNC_MSG_CLIENT_SET_ENCODINGS:
2413	if (len == 1)
2414	return 4;
2415
2416	if (len == 4) {
2417	limit = read_u16(data, 2);
2418	if (limit > 0)
2419	return 4 + (limit * 4);
2420	} else
2421	limit = read_u16(data, 2);
2422
2423	for (i = 0; i < limit; i++) {
2424	int32_t val = read_s32(data, 4 + (i * 4));
2425	memcpy(data + 4 + (i * 4), &val, sizeof(val));
2426	}
2427
2428	trace_vnc_msg_client_set_encodings(vs, vs->ioc, limit);
2429	set_encodings(vs, (int32_t *)(data + 4), limit);
2430	break;
2431	case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2432	if (len == 1)
2433	return 10;
2434
2435	trace_vnc_msg_client_framebuffer_update_request(vs, vs->ioc,
2436	read_u8(data, 1),
2437	read_u16(data, 2),
2438	read_u16(data, 4),
2439	read_u16(data, 6),
2440	read_u16(data, 8));
2441	framebuffer_update_request(vs,
2442	read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2443	read_u16(data, 6), read_u16(data, 8));
2444	break;
2445	case VNC_MSG_CLIENT_KEY_EVENT:
2446	if (len == 1)
2447	return 8;
2448
2449	trace_vnc_msg_client_key_event(vs, vs->ioc,
2450	read_u8(data, 1),
2451	read_u32(data, 4));
2452	key_event(vs, read_u8(data, 1), read_u32(data, 4));
2453	break;
2454	case VNC_MSG_CLIENT_POINTER_EVENT:
2455	if (len == 1)
2456	return 6;
2457
2458	trace_vnc_msg_client_pointer_event(vs, vs->ioc,
2459	read_u8(data, 1),
2460	read_u16(data, 2),
2461	read_u16(data, 4));
2462	pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2463	break;
2464	case VNC_MSG_CLIENT_CUT_TEXT:
2465	if (len == 1) {
2466	return 8;
2467	}
2468	uint32_t dlen = abs(read_s32(data, 4));
2469	if (len == 8) {
2470	if (dlen > (1 << 20)) {
2471	error_report("vnc: client_cut_text msg payload has %u bytes"
2472	" which exceeds our limit of 1MB.", dlen);
2473	vnc_client_error(vs);
2474	break;
2475	}
2476	if (dlen > 0) {
2477	return 8 + dlen;
2478	}
2479	}
2480
2481	if (read_s32(data, 4) < 0) {
2482	if (!vnc_has_feature(vs, VNC_FEATURE_CLIPBOARD_EXT)) {
2483	error_report("vnc: extended clipboard message while disabled");
2484	vnc_client_error(vs);
2485	break;
2486	}
2487	if (dlen < 4) {
2488	error_report("vnc: malformed payload (header less than 4 bytes)"
2489	" in extended clipboard pseudo-encoding.");
2490	vnc_client_error(vs);
2491	break;
2492	}
2493	trace_vnc_msg_client_cut_text_ext(vs, vs->ioc,
2494	dlen, read_u32(data, 8));
2495	vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12);
2496	break;
2497	}
2498	trace_vnc_msg_client_cut_text(vs, vs->ioc, read_u32(data, 4));
2499	vnc_client_cut_text(vs, read_u32(data, 4), data + 8);
2500	break;
2501	case VNC_MSG_CLIENT_XVP:
2502	if (!vnc_has_feature(vs, VNC_FEATURE_XVP)) {
2503	error_report("vnc: xvp client message while disabled");
2504	vnc_client_error(vs);
2505	break;
2506	}
2507	if (len == 1) {
2508	return 4;
2509	}
2510	if (len == 4) {
2511	uint8_t version = read_u8(data, 2);
2512	uint8_t action = read_u8(data, 3);
2513	trace_vnc_msg_client_xvp(vs, vs->ioc, version, action);
2514
2515	if (version != 1) {
2516	error_report("vnc: xvp client message version %d != 1",
2517	version);
2518	vnc_client_error(vs);
2519	break;
2520	}
2521
2522	switch (action) {
2523	case VNC_XVP_ACTION_SHUTDOWN:
2524	vnc_action_shutdown(vs);
2525	break;
2526	case VNC_XVP_ACTION_REBOOT:
2527	send_xvp_message(vs, VNC_XVP_CODE_FAIL);
2528	break;
2529	case VNC_XVP_ACTION_RESET:
2530	vnc_action_reset(vs);
2531	break;
2532	default:
2533	send_xvp_message(vs, VNC_XVP_CODE_FAIL);
2534	break;
2535	}
2536	}
2537	break;
2538	case VNC_MSG_CLIENT_QEMU:
2539	if (len == 1)
2540	return 2;
2541
2542	switch (read_u8(data, 1)) {
2543	case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2544	if (len == 2)
2545	return 12;
2546
2547	trace_vnc_msg_client_ext_key_event(vs, vs->ioc,
2548	read_u16(data, 2),
2549	read_u32(data, 4),
2550	read_u32(data, 8));
2551	ext_key_event(vs, read_u16(data, 2),
2552	read_u32(data, 4), read_u32(data, 8));
2553	break;
2554	case VNC_MSG_CLIENT_QEMU_AUDIO:
2555	if (!vnc_has_feature(vs, VNC_FEATURE_AUDIO)) {
2556	error_report("Audio message %d with audio disabled", read_u8(data, 2));
2557	vnc_client_error(vs);
2558	break;
2559	}
2560
2561	if (len == 2)
2562	return 4;
2563
2564	switch (read_u16 (data, 2)) {
2565	case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2566	trace_vnc_msg_client_audio_enable(vs, vs->ioc);
2567	audio_add(vs);
2568	break;
2569	case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2570	trace_vnc_msg_client_audio_disable(vs, vs->ioc);
2571	audio_del(vs);
2572	break;
2573	case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2574	if (len == 4)
2575	return 10;
2576	switch (read_u8(data, 4)) {
2577	case 0: vs->as.fmt = AUDIO_FORMAT_U8; break;
2578	case 1: vs->as.fmt = AUDIO_FORMAT_S8; break;
2579	case 2: vs->as.fmt = AUDIO_FORMAT_U16; break;
2580	case 3: vs->as.fmt = AUDIO_FORMAT_S16; break;
2581	case 4: vs->as.fmt = AUDIO_FORMAT_U32; break;
2582	case 5: vs->as.fmt = AUDIO_FORMAT_S32; break;
2583	default:
2584	trace_vnc_client_invalid_audio_format(vs, read_u8(data, 4));
2585	vnc_client_error(vs);
2586	break;
2587	}
2588	vs->as.nchannels = read_u8(data, 5);
2589	if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2590	trace_vnc_client_invalid_audio_channels(vs, read_u8(data, 5));
2591	vnc_client_error(vs);
2592	break;
2593	}
2594	freq = read_u32(data, 6);
2595	/* No official limit for protocol, but 48khz is a sensible
2596	* upper bound for trustworthy clients, and this limit
2597	* protects calculations involving 'vs->as.freq' later.
2598	*/
2599	if (freq > 48000) {
2600	trace_vnc_client_invalid_audio_freq(vs, freq);
2601	vnc_client_error(vs);
2602	break;
2603	}
2604	vs->as.freq = freq;
2605	trace_vnc_msg_client_audio_format(
2606	vs, vs->ioc, vs->as.fmt, vs->as.nchannels, vs->as.freq);
2607	break;
2608	default:
2609	trace_vnc_client_invalid_audio_msg(vs, read_u8(data, 2));
2610	vnc_client_error(vs);
2611	break;
2612	}
2613	break;
2614
2615	default:
2616	trace_vnc_client_unknown_qemu_msg(vs, read_u16(data, 0));
2617	vnc_client_error(vs);
2618	break;
2619	}
2620	break;
2621	case VNC_MSG_CLIENT_SET_DESKTOP_SIZE:
2622	{
2623	size_t size;
2624	uint8_t screens;
2625	int w, h;
2626
2627	if (len < 8) {
2628	return 8;
2629	}
2630
2631	screens = read_u8(data, 6);
2632	size = 8 + screens * 16;
2633	if (len < size) {
2634	return size;
2635	}
2636	w = read_u16(data, 2);
2637	h = read_u16(data, 4);
2638
2639	trace_vnc_msg_client_set_desktop_size(vs, vs->ioc, w, h, screens);
2640	if (qemu_console_ui_info_supported(vs->vd->dcl.con)) {
2641	QemuUIInfo info = { .width = w, .height = h };
2642	qemu_console_set_ui_info(vs->vd->dcl.con, &info, false);
2643	vnc_desktop_resize_ext(vs, 4 /* Request forwarded */);
2644	} else {
2645	vnc_desktop_resize_ext(vs, 3 /* Invalid screen layout */);
2646	}
2647
2648	break;
2649	}
2650	default:
2651	trace_vnc_client_unknown_msg(vs, data[0]);
2652	vnc_client_error(vs);
2653	break;
2654	}
2655
2656	vnc_update_throttle_offset(vs);
2657	vnc_read_when(vs, protocol_client_msg, 1);
2658	return 0;
2659	}
2660
2661	static int protocol_client_init(VncState vs, uint8_t data, size_t len)
2662	{
2663	char buf[1024];
2664	VncShareMode mode;
2665	int size;
2666
2667	mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2668	switch (vs->vd->share_policy) {
2669	case VNC_SHARE_POLICY_IGNORE:
2670	/*
2671	* Ignore the shared flag. Nothing to do here.
2672	*
2673	* Doesn't conform to the rfb spec but is traditional qemu
2674	* behavior, thus left here as option for compatibility
2675	* reasons.
2676	*/
2677	break;
2678	case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2679	/*
2680	* Policy: Allow clients ask for exclusive access.
2681	*
2682	* Implementation: When a client asks for exclusive access,
2683	* disconnect all others. Shared connects are allowed as long
2684	* as no exclusive connection exists.
2685	*
2686	* This is how the rfb spec suggests to handle the shared flag.
2687	*/
2688	if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2689	VncState *client;
2690	QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2691	if (vs == client) {
2692	continue;
2693	}
2694	if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2695	client->share_mode != VNC_SHARE_MODE_SHARED) {
2696	continue;
2697	}
2698	vnc_disconnect_start(client);
2699	}
2700	}
2701	if (mode == VNC_SHARE_MODE_SHARED) {
2702	if (vs->vd->num_exclusive > 0) {
2703	vnc_disconnect_start(vs);
2704	return 0;
2705	}
2706	}
2707	break;
2708	case VNC_SHARE_POLICY_FORCE_SHARED:
2709	/*
2710	* Policy: Shared connects only.
2711	* Implementation: Disallow clients asking for exclusive access.
2712	*
2713	* Useful for shared desktop sessions where you don't want
2714	* someone forgetting to say -shared when running the vnc
2715	* client disconnect everybody else.
2716	*/
2717	if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2718	vnc_disconnect_start(vs);
2719	return 0;
2720	}
2721	break;
2722	}
2723	vnc_set_share_mode(vs, mode);
2724
2725	if (vs->vd->num_shared > vs->vd->connections_limit) {
2726	vnc_disconnect_start(vs);
2727	return 0;
2728	}
2729
2730	assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2731	pixman_image_get_width(vs->vd->server) >= 0);
2732	assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2733	pixman_image_get_height(vs->vd->server) >= 0);
2734	vs->client_width = pixman_image_get_width(vs->vd->server);
2735	vs->client_height = pixman_image_get_height(vs->vd->server);
2736	vnc_write_u16(vs, vs->client_width);
2737	vnc_write_u16(vs, vs->client_height);
2738
2739	pixel_format_message(vs);
2740
2741	if (qemu_name) {
2742	size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2743	if (size > sizeof(buf)) {
2744	size = sizeof(buf);
2745	}
2746	} else {
2747	size = snprintf(buf, sizeof(buf), "QEMU");
2748	}
2749
2750	vnc_write_u32(vs, size);
2751	vnc_write(vs, buf, size);
2752	vnc_flush(vs);
2753
2754	vnc_client_cache_auth(vs);
2755	vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2756
2757	vnc_read_when(vs, protocol_client_msg, 1);
2758
2759	return 0;
2760	}
2761
2762	void start_client_init(VncState *vs)
2763	{
2764	vnc_read_when(vs, protocol_client_init, 1);
2765	}
2766
2767	static void authentication_failed(VncState *vs)
2768	{
2769	vnc_write_u32(vs, 1); /* Reject auth */
2770	if (vs->minor >= 8) {
2771	static const char err[] = "Authentication failed";
2772	vnc_write_u32(vs, sizeof(err));
2773	vnc_write(vs, err, sizeof(err));
2774	}
2775	vnc_flush(vs);
2776	vnc_client_error(vs);
2777	}
2778
2779	static void
2780	vnc_munge_des_rfb_key(unsigned char *key, size_t nkey)
2781	{
2782	size_t i;
2783	for (i = 0; i < nkey; i++) {
2784	uint8_t r = key[i];
2785	r = (r & 0xf0) >> 4 \| (r & 0x0f) << 4;
2786	r = (r & 0xcc) >> 2 \| (r & 0x33) << 2;
2787	r = (r & 0xaa) >> 1 \| (r & 0x55) << 1;
2788	key[i] = r;
2789	}
2790	}
2791
2792	static int protocol_client_auth_vnc(VncState vs, uint8_t data, size_t len)
2793	{
2794	unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2795	size_t i, pwlen;
2796	unsigned char key[8];
2797	time_t now = time(NULL);
2798	QCryptoCipher *cipher = NULL;
2799	Error *err = NULL;
2800
2801	if (!vs->vd->password) {
2802	trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2803	goto reject;
2804	}
2805	if (vs->vd->expires < now) {
2806	trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2807	goto reject;
2808	}
2809
2810	memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2811
2812	/* Calculate the expected challenge response */
2813	pwlen = strlen(vs->vd->password);
2814	for (i=0; i<sizeof(key); i++)
2815	key[i] = i<pwlen ? vs->vd->password[i] : 0;
2816	vnc_munge_des_rfb_key(key, sizeof(key));
2817
2818	cipher = qcrypto_cipher_new(
2819	QCRYPTO_CIPHER_ALGO_DES,
2820	QCRYPTO_CIPHER_MODE_ECB,
2821	key, G_N_ELEMENTS(key),
2822	&err);
2823	if (!cipher) {
2824	trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2825	error_get_pretty(err));
2826	error_free(err);
2827	goto reject;
2828	}
2829
2830	if (qcrypto_cipher_encrypt(cipher,
2831	vs->challenge,
2832	response,
2833	VNC_AUTH_CHALLENGE_SIZE,
2834	&err) < 0) {
2835	trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2836	error_get_pretty(err));
2837	error_free(err);
2838	goto reject;
2839	}
2840
2841	/* Compare expected vs actual challenge response */
2842	if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2843	trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2844	goto reject;
2845	} else {
2846	trace_vnc_auth_pass(vs, vs->auth);
2847	vnc_write_u32(vs, 0); /* Accept auth */
2848	vnc_flush(vs);
2849
2850	start_client_init(vs);
2851	}
2852
2853	qcrypto_cipher_free(cipher);
2854	return 0;
2855
2856	reject:
2857	authentication_failed(vs);
2858	qcrypto_cipher_free(cipher);
2859	return 0;
2860	}
2861
2862	void start_auth_vnc(VncState *vs)
2863	{
2864	Error *err = NULL;
2865
2866	if (qcrypto_random_bytes(vs->challenge, sizeof(vs->challenge), &err)) {
2867	trace_vnc_auth_fail(vs, vs->auth, "cannot get random bytes",
2868	error_get_pretty(err));
2869	error_free(err);
2870	authentication_failed(vs);
2871	return;
2872	}
2873
2874	/* Send client a 'random' challenge */
2875	vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2876	vnc_flush(vs);
2877
2878	vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2879	}
2880
2881
2882	static int protocol_client_auth(VncState vs, uint8_t data, size_t len)
2883	{
2884	/* We only advertise 1 auth scheme at a time, so client
2885	* must pick the one we sent. Verify this */
2886	if (data[0] != vs->auth) { /* Reject auth */
2887	trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2888	authentication_failed(vs);
2889	} else { /* Accept requested auth */
2890	trace_vnc_auth_start(vs, vs->auth);
2891	switch (vs->auth) {
2892	case VNC_AUTH_NONE:
2893	if (vs->minor >= 8) {
2894	vnc_write_u32(vs, 0); /* Accept auth completion */
2895	vnc_flush(vs);
2896	}
2897	trace_vnc_auth_pass(vs, vs->auth);
2898	start_client_init(vs);
2899	break;
2900
2901	case VNC_AUTH_VNC:
2902	start_auth_vnc(vs);
2903	break;
2904
2905	case VNC_AUTH_VENCRYPT:
2906	start_auth_vencrypt(vs);
2907	break;
2908
2909	#ifdef CONFIG_VNC_SASL
2910	case VNC_AUTH_SASL:
2911	start_auth_sasl(vs);
2912	break;
2913	#endif /* CONFIG_VNC_SASL */
2914
2915	default: /* Should not be possible, but just in case */
2916	trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2917	authentication_failed(vs);
2918	}
2919	}
2920	return 0;
2921	}
2922
2923	static int protocol_version(VncState vs, uint8_t version, size_t len)
2924	{
2925	char local[13];
2926
2927	memcpy(local, version, 12);
2928	local[12] = 0;
2929
2930	if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2931	trace_vnc_client_protocol_version_malformed(vs, local);
2932	vnc_client_error(vs);
2933	return 0;
2934	}
2935	trace_vnc_client_protocol_version(vs, vs->major, vs->minor);
2936	if (vs->major != 3 \|\|
2937	(vs->minor != 3 &&
2938	vs->minor != 4 &&
2939	vs->minor != 5 &&
2940	vs->minor != 7 &&
2941	vs->minor != 8)) {
2942	trace_vnc_client_protocol_version_unsupported(vs);
2943	vnc_write_u32(vs, VNC_AUTH_INVALID);
2944	vnc_flush(vs);
2945	vnc_client_error(vs);
2946	return 0;
2947	}
2948	/* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2949	* as equivalent to v3.3 by servers
2950	*/
2951	if (vs->minor == 4 \|\| vs->minor == 5)
2952	vs->minor = 3;
2953
2954	if (vs->minor == 3) {
2955	trace_vnc_auth_start(vs, vs->auth);
2956	if (vs->auth == VNC_AUTH_NONE) {
2957	vnc_write_u32(vs, vs->auth);
2958	vnc_flush(vs);
2959	trace_vnc_auth_pass(vs, vs->auth);
2960	start_client_init(vs);
2961	} else if (vs->auth == VNC_AUTH_VNC) {
2962	trace_vnc_client_auth_method(vs, vs->auth);
2963	vnc_write_u32(vs, vs->auth);
2964	vnc_flush(vs);
2965	start_auth_vnc(vs);
2966	} else {
2967	trace_vnc_auth_fail(vs, vs->auth,
2968	"Unsupported auth method for v3.3", "");
2969	vnc_write_u32(vs, VNC_AUTH_INVALID);
2970	vnc_flush(vs);
2971	vnc_client_error(vs);
2972	}
2973	} else {
2974	vnc_write_u8(vs, 1); /* num auth */
2975	vnc_write_u8(vs, vs->auth);
2976	vnc_read_when(vs, protocol_client_auth, 1);
2977	vnc_flush(vs);
2978	}
2979
2980	return 0;
2981	}
2982
2983	static VncRectStat vnc_stat_rect(VncDisplay vd, int x, int y)
2984	{
2985	struct VncSurface *vs = &vd->guest;
2986
2987	return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2988	}
2989
2990	void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h)
2991	{
2992	int i, j;
2993
2994	w = DIV_ROUND_UP((x + w), VNC_STAT_RECT);
2995	h = DIV_ROUND_UP((y + h), VNC_STAT_RECT);
2996	assert(h <= VNC_STAT_ROWS);
2997	assert(w <= VNC_STAT_COLS);
2998	x /= VNC_STAT_RECT;
2999	y /= VNC_STAT_RECT;
3000
3001	for (j = y; j < h; j++) {
3002	for (i = x; i < w; i++) {
3003	worker->lossy_rect[j][i] = 1;
3004	}
3005	}
3006	}
3007
3008	static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y,
3009	int height)
3010	{
3011	VncState *vs;
3012	int sty = y / VNC_STAT_RECT;
3013	int stx = x / VNC_STAT_RECT;
3014	int has_dirty = 0;
3015	int rows;
3016
3017	y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
3018	x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
3019
3020	rows = MIN(VNC_STAT_RECT, height - y);
3021	if (rows <= 0) {
3022	return 0;
3023	}
3024
3025	QTAILQ_FOREACH(vs, &vd->clients, next) {
3026	VncConnection *vc = container_of(vs, VncConnection, vs);
3027	int j;
3028
3029	/* kernel send buffers are full -> refresh later */
3030	if (vs->output.offset) {
3031	continue;
3032	}
3033
3034	if (!vc->worker.lossy_rect[sty][stx]) {
3035	continue;
3036	}
3037
3038	vc->worker.lossy_rect[sty][stx] = 0;
3039	for (j = 0; j < rows; ++j) {
3040	bitmap_set(vs->dirty[y + j],
3041	x / VNC_DIRTY_PIXELS_PER_BIT,
3042	VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
3043	}
3044	has_dirty++;
3045	}
3046
3047	return has_dirty;
3048	}
3049
3050	static int vnc_update_stats(VncDisplay vd, struct timeval tv)
3051	{
3052	int width = MIN(pixman_image_get_width(vd->guest.fb),
3053	pixman_image_get_width(vd->server));
3054	int height = MIN(pixman_image_get_height(vd->guest.fb),
3055	pixman_image_get_height(vd->server));
3056	int x, y;
3057	struct timeval res;
3058	int has_dirty = 0;
3059
3060	for (y = 0; y < height; y += VNC_STAT_RECT) {
3061	for (x = 0; x < width; x += VNC_STAT_RECT) {
3062	VncRectStat *rect = vnc_stat_rect(vd, x, y);
3063
3064	rect->updated = false;
3065	}
3066	}
3067
3068	qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
3069
3070	if (timercmp(&vd->guest.last_freq_check, &res, >)) {
3071	return has_dirty;
3072	}
3073	vd->guest.last_freq_check = *tv;
3074
3075	for (y = 0; y < height; y += VNC_STAT_RECT) {
3076	for (x = 0; x < width; x += VNC_STAT_RECT) {
3077	VncRectStat *rect= vnc_stat_rect(vd, x, y);
3078	int count = ARRAY_SIZE(rect->times);
3079	struct timeval min, max;
3080
3081	if (!timerisset(&rect->times[count - 1])) {
3082	continue ;
3083	}
3084
3085	max = rect->times[(rect->idx + count - 1) % count];
3086	qemu_timersub(tv, &max, &res);
3087
3088	if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
3089	rect->freq = 0;
3090	has_dirty += vnc_refresh_lossy_rect(vd, x, y, height);
3091	memset(rect->times, 0, sizeof (rect->times));
3092	continue ;
3093	}
3094
3095	min = rect->times[rect->idx];
3096	max = rect->times[(rect->idx + count - 1) % count];
3097	qemu_timersub(&max, &min, &res);
3098
3099	rect->freq = res.tv_sec + res.tv_usec / 1000000.;
3100	rect->freq /= count;
3101	rect->freq = 1. / rect->freq;
3102	}
3103	}
3104	return has_dirty;
3105	}
3106
3107	double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
3108	{
3109	int i, j;
3110	double total = 0;
3111	int num = 0;
3112	int x_end = x + w;
3113	int y_end = y + h;
3114
3115	x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
3116	y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
3117
3118	for (j = y; j < y_end; j += VNC_STAT_RECT) {
3119	for (i = x; i < x_end; i += VNC_STAT_RECT) {
3120	total += vnc_stat_rect(vs->vd, i, j)->freq;
3121	num++;
3122	}
3123	}
3124
3125	if (num) {
3126	return total / num;
3127	} else {
3128	return 0;
3129	}
3130	}
3131
3132	static void vnc_rect_updated(VncDisplay vd, int x, int y, struct timeval tv)
3133	{
3134	VncRectStat *rect;
3135
3136	rect = vnc_stat_rect(vd, x, y);
3137	if (rect->updated) {
3138	return;
3139	}
3140	rect->times[rect->idx] = *tv;
3141	rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
3142	rect->updated = true;
3143	}
3144
3145	static int vnc_refresh_server_surface(VncDisplay *vd)
3146	{
3147	int width = MIN(pixman_image_get_width(vd->guest.fb),
3148	pixman_image_get_width(vd->server));
3149	int height = MIN(pixman_image_get_height(vd->guest.fb),
3150	pixman_image_get_height(vd->server));
3151	int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
3152	uint8_t guest_row0 = NULL, server_row0;
3153	VncState *vs;
3154	int has_dirty = 0;
3155	pixman_image_t *tmpbuf = NULL;
3156	unsigned long offset;
3157	int x;
3158	uint8_t guest_ptr, server_ptr;
3159
3160	struct timeval tv = { 0, 0 };
3161
3162	if (!vd->non_adaptive) {
3163	gettimeofday(&tv, NULL);
3164	has_dirty = vnc_update_stats(vd, &tv);
3165	}
3166
3167	offset = find_next_bit((unsigned long *) &vd->guest.dirty,
3168	height * VNC_DIRTY_BPL(&vd->guest), 0);
3169	if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
3170	/* no dirty bits in guest surface */
3171	return has_dirty;
3172	}
3173
3174	/*
3175	* Walk through the guest dirty map.
3176	* Check and copy modified bits from guest to server surface.
3177	* Update server dirty map.
3178	*/
3179	server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
3180	server_stride = guest_stride = guest_ll =
3181	pixman_image_get_stride(vd->server);
3182	cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
3183	server_stride);
3184	if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
3185	int w = pixman_image_get_width(vd->server);
3186	tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, w);
3187	} else {
3188	int guest_bpp =
3189	PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
3190	guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
3191	guest_stride = pixman_image_get_stride(vd->guest.fb);
3192	guest_ll = pixman_image_get_width(vd->guest.fb)
3193	* DIV_ROUND_UP(guest_bpp, 8);
3194	}
3195	line_bytes = MIN(server_stride, guest_ll);
3196
3197	for (;;) {
3198	y = offset / VNC_DIRTY_BPL(&vd->guest);
3199	x = offset % VNC_DIRTY_BPL(&vd->guest);
3200
3201	server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
3202
3203	if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
3204	qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
3205	guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
3206	} else {
3207	guest_ptr = guest_row0 + y * guest_stride;
3208	}
3209	guest_ptr += x * cmp_bytes;
3210
3211	for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
3212	x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
3213	int _cmp_bytes = cmp_bytes;
3214	if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
3215	continue;
3216	}
3217	if ((x + 1) * cmp_bytes > line_bytes) {
3218	_cmp_bytes = line_bytes - x * cmp_bytes;
3219	}
3220	assert(_cmp_bytes >= 0);
3221	if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
3222	continue;
3223	}
3224	memcpy(server_ptr, guest_ptr, _cmp_bytes);
3225	if (!vd->non_adaptive) {
3226	vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
3227	y, &tv);
3228	}
3229	QTAILQ_FOREACH(vs, &vd->clients, next) {
3230	set_bit(x, vs->dirty[y]);
3231	}
3232	has_dirty++;
3233	}
3234
3235	y++;
3236	offset = find_next_bit((unsigned long *) &vd->guest.dirty,
3237	height * VNC_DIRTY_BPL(&vd->guest),
3238	y * VNC_DIRTY_BPL(&vd->guest));
3239	if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
3240	/* no more dirty bits */
3241	break;
3242	}
3243	}
3244	qemu_pixman_image_unref(tmpbuf);
3245	return has_dirty;
3246	}
3247
3248	static void vnc_refresh(DisplayChangeListener *dcl)
3249	{
3250	VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
3251	VncState vs, vn;
3252	int has_dirty, rects = 0;
3253
3254	if (QTAILQ_EMPTY(&vd->clients)) {
3255	qemu_console_listener_set_refresh(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3256	return;
3257	}
3258
3259	qemu_console_hw_update(vd->dcl.con);
3260
3261	if (vnc_trylock_display(vd)) {
3262	qemu_console_listener_set_refresh(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3263	return;
3264	}
3265
3266	has_dirty = vnc_refresh_server_surface(vd);
3267	vnc_unlock_display(vd);
3268
3269	QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3270	rects += vnc_update_client(vs, has_dirty);
3271	/* vs might be free()ed here */
3272	}
3273
3274	if (has_dirty && rects) {
3275	vd->dcl.update_interval /= 2;
3276	if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3277	vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3278	}
3279	} else {
3280	vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3281	if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3282	vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3283	}
3284	}
3285	}
3286
3287	static void vnc_connect(VncDisplay vd, QIOChannelSocket sioc,
3288	bool skipauth, bool websocket)
3289	{
3290	VncConnection *vc = g_new0(VncConnection, 1);
3291	VncState *vs = &vc->vs;
3292	bool first_client = QTAILQ_EMPTY(&vd->clients);
3293
3294	trace_vnc_client_connect(vs, sioc);
3295	vs->magic = VNC_MAGIC;
3296	vs->sioc = sioc;
3297	object_ref(OBJECT(vs->sioc));
3298	vs->ioc = QIO_CHANNEL(sioc);
3299	object_ref(OBJECT(vs->ioc));
3300	vs->vd = vd;
3301
3302	buffer_init(&vs->input, "vnc-input/%p", sioc);
3303	buffer_init(&vs->output, "vnc-output/%p", sioc);
3304	buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3305
3306	buffer_init(&vc->worker.tight.tight, "vnc-tight/%p", sioc);
3307	buffer_init(&vc->worker.tight.zlib, "vnc-tight-zlib/%p", sioc);
3308	buffer_init(&vc->worker.tight.gradient, "vnc-tight-gradient/%p", sioc);
3309	#ifdef CONFIG_VNC_JPEG
3310	buffer_init(&vc->worker.tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3311	#endif
3312	#ifdef CONFIG_PNG
3313	buffer_init(&vc->worker.tight.png, "vnc-tight-png/%p", sioc);
3314	#endif
3315	buffer_init(&vc->worker.zlib.zlib, "vnc-zlib/%p", sioc);
3316	buffer_init(&vc->worker.zrle.zrle, "vnc-zrle/%p", sioc);
3317	buffer_init(&vc->worker.zrle.fb, "vnc-zrle-fb/%p", sioc);
3318	buffer_init(&vc->worker.zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3319
3320	if (skipauth) {
3321	vs->auth = VNC_AUTH_NONE;
3322	vs->subauth = VNC_AUTH_INVALID;
3323	} else {
3324	if (websocket) {
3325	vs->auth = vd->ws_auth;
3326	vs->subauth = VNC_AUTH_INVALID;
3327	} else {
3328	vs->auth = vd->auth;
3329	vs->subauth = vd->subauth;
3330	}
3331	}
3332	trace_vnc_client_setup(vs, sioc, websocket, vs->auth, vs->subauth);
3333	qemu_console_listener_set_refresh(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3334	qio_channel_set_blocking(vs->ioc, false, &error_abort);
3335	g_clear_handle_id(&vs->ioc_tag, g_source_remove);
3336	if (websocket) {
3337	vs->websocket = 1;
3338	if (vd->tlscreds) {
3339	vs->ioc_tag = qio_channel_add_watch(
3340	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR,
3341	vncws_tls_handshake_io, vs, NULL);
3342	} else {
3343	vs->ioc_tag = qio_channel_add_watch(
3344	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR,
3345	vncws_handshake_io, vs, NULL);
3346	}
3347	} else {
3348	vs->ioc_tag = qio_channel_add_watch(
3349	vs->ioc, G_IO_IN \| G_IO_HUP \| G_IO_ERR,
3350	vnc_client_io, vs, NULL);
3351	}
3352
3353	vnc_client_cache_addr(vs);
3354	vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3355	vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3356
3357	vs->last_x = -1;
3358	vs->last_y = -1;
3359
3360	vs->as.freq = 44100;
3361	vs->as.nchannels = 2;
3362	vs->as.fmt = AUDIO_FORMAT_S16;
3363	vs->as.big_endian = false;
3364
3365	qemu_mutex_init(&vs->output_mutex);
3366	vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3367
3368	QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3369	if (first_client) {
3370	vnc_update_server_surface(vd);
3371	}
3372
3373	qemu_console_hw_update(vd->dcl.con);
3374
3375	if (!vs->websocket) {
3376	vnc_start_protocol(vs);
3377	}
3378
3379	if (vd->num_connecting > vd->connections_limit) {
3380	QTAILQ_FOREACH(vs, &vd->clients, next) {
3381	if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3382	vnc_disconnect_start(vs);
3383	return;
3384	}
3385	}
3386	}
3387	}
3388
3389	void vnc_start_protocol(VncState *vs)
3390	{
3391	vnc_write(vs, "RFB 003.008\n", 12);
3392	vnc_flush(vs);
3393	vnc_read_when(vs, protocol_version, 12);
3394
3395	vs->mouse_mode_notifier.notify = check_pointer_type_change;
3396	qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3397	}
3398
3399	static void vnc_listen_io(QIONetListener *listener,
3400	QIOChannelSocket *cioc,
3401	void *opaque)
3402	{
3403	VncDisplay *vd = opaque;
3404	bool isWebsock = listener == vd->wslistener;
3405
3406	qio_channel_set_name(QIO_CHANNEL(cioc),
3407	isWebsock ? "vnc-ws-server" : "vnc-server");
3408	qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3409	vnc_connect(vd, cioc, false, isWebsock);
3410	}
3411
3412	static const DisplayChangeListenerOps dcl_ops = {
3413	.dpy_name = "vnc",
3414	.dpy_refresh = vnc_refresh,
3415	.dpy_gfx_update = vnc_dpy_update,
3416	.dpy_gfx_switch = vnc_dpy_switch,
3417	.dpy_gfx_check_format = qemu_pixman_check_format,
3418	.dpy_mouse_set = vnc_mouse_set,
3419	.dpy_cursor_define = vnc_dpy_cursor_define,
3420	};
3421
3422	static void vmstate_change_handler(void *opaque, bool running, RunState state)
3423	{
3424	VncDisplay *vd = opaque;
3425
3426	if (state != RUN_STATE_RUNNING) {
3427	return;
3428	}
3429	qemu_console_listener_set_refresh(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3430	}
3431
3432	static bool vnc_display_open(VncDisplay vd, Error *errp);
3433
3434	VncDisplay vnc_display_new(const char id, Error **errp)
3435	{
3436	VncDisplay *vd;
3437
3438	assert(!vnc_display_find(id));
3439
3440	vd = g_new0(VncDisplay, 1);
3441	qemu_mutex_init(&vd->mutex);
3442	vd->id = g_strdup(id);
3443
3444	QTAILQ_INIT(&vd->clients);
3445	vd->expires = TIME_MAX;
3446
3447	if (keyboard_layout) {
3448	trace_vnc_key_map_init(keyboard_layout);
3449	vd->kbd_layout = kbd_layout_new(name2keysym,
3450	keyboard_layout, errp);
3451	} else {
3452	vd->kbd_layout = kbd_layout_new(name2keysym, "en-us", errp);
3453	}
3454
3455	if (!vd->kbd_layout) {
3456	vnc_display_free(vd);
3457	return NULL;
3458	}
3459
3460	vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3461	vd->connections_limit = 32;
3462
3463	vnc_start_worker_thread(vd);
3464
3465	vd->vmstate_handler_entry = qemu_add_vm_change_state_handler(
3466	&vmstate_change_handler, vd);
3467
3468	if (!vnc_display_open(vd, errp)) {
3469	vnc_display_free(vd);
3470	return NULL;
3471	}
3472
3473	QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3474	return vd;
3475	}
3476
3477	static void vnc_display_close(VncDisplay *vd)
3478	{
3479	VncState *vs;
3480
3481	assert(vd);
3482
3483	QTAILQ_FOREACH(vs, &vd->clients, next) {
3484	vnc_disconnect_start(vs);
3485	}
3486	if (vd->listener) {
3487	qio_net_listener_disconnect(vd->listener);
3488	object_unref(OBJECT(vd->listener));
3489	}
3490	vd->listener = NULL;
3491
3492	if (vd->wslistener) {
3493	qio_net_listener_disconnect(vd->wslistener);
3494	object_unref(OBJECT(vd->wslistener));
3495	}
3496	vd->wslistener = NULL;
3497
3498	vd->auth = VNC_AUTH_INVALID;
3499	vd->subauth = VNC_AUTH_INVALID;
3500	if (vd->tlscreds) {
3501	object_unref(OBJECT(vd->tlscreds));
3502	vd->tlscreds = NULL;
3503	}
3504	g_free(vd->tlsauthzid);
3505	vd->tlsauthzid = NULL;
3506	if (vd->lock_key_sync) {
3507	qemu_input_led_notifier_remove(&vd->led_notifier);
3508	}
3509	#ifdef CONFIG_VNC_SASL
3510	if (vd->sasl.authz) {
3511	object_unparent(OBJECT(vd->sasl.authz));
3512	vd->sasl.authz = NULL;
3513	}
3514	g_free(vd->sasl.authzid);
3515	vd->sasl.authzid = NULL;
3516	#endif
3517	}
3518
3519	void vnc_display_free(VncDisplay *vd)
3520	{
3521	if (!vd) {
3522	return;
3523	}
3524
3525	vnc_display_close(vd);
3526	while (!QTAILQ_EMPTY(&vd->clients)) {
3527	main_loop_wait(false);
3528	}
3529
3530	vnc_stop_worker_thread(vd);
3531	qemu_console_unregister_listener(&vd->dcl);
3532	qkbd_state_free(vd->kbd);
3533	qemu_del_vm_change_state_handler(vd->vmstate_handler_entry);
3534	kbd_layout_free(vd->kbd_layout);
3535	qemu_mutex_destroy(&vd->mutex);
3536	if (QTAILQ_IN_USE(vd, next)) {
3537	QTAILQ_REMOVE(&vnc_displays, vd, next);
3538	}
3539	g_free(vd->id);
3540	g_free(vd);
3541	}
3542
3543	int vnc_display_password(const char id, const char password, Error **errp)
3544	{
3545	VncDisplay *vd = vnc_display_find(id);
3546
3547	if (!vd) {
3548	error_setg(errp, "No VNC display is present");
3549	error_append_hint(errp,
3550	"To enable it, use '-vnc ...'");
3551	return -EINVAL;
3552	}
3553	if (vd->auth == VNC_AUTH_NONE) {
3554	error_setg(errp, "VNC password authentication is disabled");
3555	error_append_hint(errp,
3556	"To enable it, use '-vnc ...,password-secret=ID'");
3557	return -EINVAL;
3558	}
3559
3560	g_free(vd->password);
3561	vd->password = g_strdup(password);
3562
3563	return 0;
3564	}
3565
3566	int vnc_display_pw_expire(const char *id, time_t expires)
3567	{
3568	VncDisplay *vd = vnc_display_find(id);
3569
3570	if (!vd) {
3571	return -EINVAL;
3572	}
3573
3574	vd->expires = expires;
3575	return 0;
3576	}
3577
3578	static void vnc_display_print_local_addr(VncDisplay *vd)
3579	{
3580	SocketAddress *addr;
3581
3582	if (!vd->listener \|\| !qio_net_listener_nsioc(vd->listener)) {
3583	return;
3584	}
3585
3586	addr = qio_net_listener_get_local_address(vd->listener, 0, NULL);
3587	if (!addr) {
3588	return;
3589	}
3590
3591	if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3592	qapi_free_SocketAddress(addr);
3593	return;
3594	}
3595	error_printf("VNC server running on %s:%s\n",
3596	addr->u.inet.host,
3597	addr->u.inet.port);
3598	qapi_free_SocketAddress(addr);
3599	}
3600
3601	static QemuOptsList qemu_vnc_opts = {
3602	.name = "vnc",
3603	.head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3604	.implied_opt_name = "vnc",
3605	.desc = {
3606	{
3607	.name = "vnc",
3608	.type = QEMU_OPT_STRING,
3609	},{
3610	.name = "websocket",
3611	.type = QEMU_OPT_STRING,
3612	},{
3613	.name = "tls-creds",
3614	.type = QEMU_OPT_STRING,
3615	},{
3616	.name = "share",
3617	.type = QEMU_OPT_STRING,
3618	},{
3619	.name = "display",
3620	.type = QEMU_OPT_STRING,
3621	},{
3622	.name = "head",
3623	.type = QEMU_OPT_NUMBER,
3624	},{
3625	.name = "connections",
3626	.type = QEMU_OPT_NUMBER,
3627	},{
3628	.name = "to",
3629	.type = QEMU_OPT_NUMBER,
3630	},{
3631	.name = "ipv4",
3632	.type = QEMU_OPT_BOOL,
3633	},{
3634	.name = "ipv6",
3635	.type = QEMU_OPT_BOOL,
3636	},{
3637	.name = "password",
3638	.type = QEMU_OPT_BOOL,
3639	},{
3640	.name = "password-secret",
3641	.type = QEMU_OPT_STRING,
3642	},{
3643	.name = "reverse",
3644	.type = QEMU_OPT_BOOL,
3645	},{
3646	.name = "lock-key-sync",
3647	.type = QEMU_OPT_BOOL,
3648	},{
3649	.name = "key-delay-ms",
3650	.type = QEMU_OPT_NUMBER,
3651	},{
3652	.name = "sasl",
3653	.type = QEMU_OPT_BOOL,
3654	},{
3655	.name = "tls-authz",
3656	.type = QEMU_OPT_STRING,
3657	},{
3658	.name = "sasl-authz",
3659	.type = QEMU_OPT_STRING,
3660	},{
3661	.name = "lossy",
3662	.type = QEMU_OPT_BOOL,
3663	},{
3664	.name = "non-adaptive",
3665	.type = QEMU_OPT_BOOL,
3666	},{
3667	.name = "audiodev",
3668	.type = QEMU_OPT_STRING,
3669	},{
3670	.name = "power-control",
3671	.type = QEMU_OPT_BOOL,
3672	},
3673	{ /* end of list */ }
3674	},
3675	};
3676
3677
3678	static int
3679	vnc_display_setup_auth(int *auth,
3680	int *subauth,
3681	QCryptoTLSCreds *tlscreds,
3682	bool password,
3683	bool sasl,
3684	bool websocket,
3685	Error **errp)
3686	{
3687	/*
3688	* We have a choice of 3 authentication options
3689	*
3690	* 1. none
3691	* 2. vnc
3692	* 3. sasl
3693	*
3694	* The channel can be run in 2 modes
3695	*
3696	* 1. clear
3697	* 2. tls
3698	*
3699	* And TLS can use 2 types of credentials
3700	*
3701	* 1. anon
3702	* 2. x509
3703	*
3704	* We thus have 9 possible logical combinations
3705	*
3706	* 1. clear + none
3707	* 2. clear + vnc
3708	* 3. clear + sasl
3709	* 4. tls + anon + none
3710	* 5. tls + anon + vnc
3711	* 6. tls + anon + sasl
3712	* 7. tls + x509 + none
3713	* 8. tls + x509 + vnc
3714	* 9. tls + x509 + sasl
3715	*
3716	* These need to be mapped into the VNC auth schemes
3717	* in an appropriate manner. In regular VNC, all the
3718	* TLS options get mapped into VNC_AUTH_VENCRYPT
3719	* sub-auth types.
3720	*
3721	* In websockets, the https:// protocol already provides
3722	* TLS support, so there is no need to make use of the
3723	* VeNCrypt extension. Furthermore, websockets browser
3724	* clients could not use VeNCrypt even if they wanted to,
3725	* as they cannot control when the TLS handshake takes
3726	* place. Thus there is no option but to rely on https://,
3727	* meaning combinations 4->6 and 7->9 will be mapped to
3728	* VNC auth schemes in the same way as combos 1->3.
3729	*
3730	* Regardless of fact that we have a different mapping to
3731	* VNC auth mechs for plain VNC vs websockets VNC, the end
3732	* result has the same security characteristics.
3733	*/
3734	if (websocket \|\| !tlscreds) {
3735	if (password) {
3736	*auth = VNC_AUTH_VNC;
3737	} else if (sasl) {
3738	*auth = VNC_AUTH_SASL;
3739	} else {
3740	*auth = VNC_AUTH_NONE;
3741	}
3742	*subauth = VNC_AUTH_INVALID;
3743	} else {
3744	bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3745	TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3746	bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3747	TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3748
3749	if (!is_x509 && !is_anon) {
3750	error_setg(errp,
3751	"Unsupported TLS cred type %s",
3752	object_get_typename(OBJECT(tlscreds)));
3753	return -1;
3754	}
3755	*auth = VNC_AUTH_VENCRYPT;
3756	if (password) {
3757	if (is_x509) {
3758	*subauth = VNC_AUTH_VENCRYPT_X509VNC;
3759	} else {
3760	*subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3761	}
3762	} else if (sasl) {
3763	if (is_x509) {
3764	*subauth = VNC_AUTH_VENCRYPT_X509SASL;
3765	} else {
3766	*subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3767	}
3768	} else {
3769	if (is_x509) {
3770	*subauth = VNC_AUTH_VENCRYPT_X509NONE;
3771	} else {
3772	*subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3773	}
3774	}
3775	}
3776	return 0;
3777	}
3778
3779
3780	static int vnc_display_get_address(const char *addrstr,
3781	bool websocket,
3782	bool reverse,
3783	int displaynum,
3784	int to,
3785	bool has_ipv4,
3786	bool has_ipv6,
3787	bool ipv4,
3788	bool ipv6,
3789	SocketAddress **retaddr,
3790	Error **errp)
3791	{
3792	int ret = -1;
3793	SocketAddress *addr = NULL;
3794
3795	addr = g_new0(SocketAddress, 1);
3796
3797	if (strncmp(addrstr, "unix:", 5) == 0) {
3798	addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3799	addr->u.q_unix.path = g_strdup(addrstr + 5);
3800
3801	if (to) {
3802	error_setg(errp, "Port range not support with UNIX socket");
3803	goto cleanup;
3804	}
3805	ret = 0;
3806	} else {
3807	const char *port;
3808	size_t hostlen;
3809	uint64_t baseport = 0;
3810	InetSocketAddress *inet;
3811
3812	port = strrchr(addrstr, ':');
3813	if (!port) {
3814	if (websocket) {
3815	hostlen = 0;
3816	port = addrstr;
3817	} else {
3818	error_setg(errp, "no vnc port specified");
3819	goto cleanup;
3820	}
3821	} else {
3822	hostlen = port - addrstr;
3823	port++;
3824	if (*port == '\0') {
3825	error_setg(errp, "vnc port cannot be empty");
3826	goto cleanup;
3827	}
3828	}
3829
3830	addr->type = SOCKET_ADDRESS_TYPE_INET;
3831	inet = &addr->u.inet;
3832	if (hostlen && addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3833	inet->host = g_strndup(addrstr + 1, hostlen - 2);
3834	} else {
3835	inet->host = g_strndup(addrstr, hostlen);
3836	}
3837	/* plain VNC port is just an offset, for websocket
3838	* port is absolute */
3839	if (websocket) {
3840	if (g_str_equal(addrstr, "") \|\|
3841	g_str_equal(addrstr, "on")) {
3842	if (displaynum == -1) {
3843	error_setg(errp, "explicit websocket port is required");
3844	goto cleanup;
3845	}
3846	inet->port = g_strdup_printf(
3847	"%d", displaynum + 5700);
3848	if (to) {
3849	inet->has_to = true;
3850	inet->to = to + 5700;
3851	}
3852	} else {
3853	inet->port = g_strdup(port);
3854	}
3855	} else {
3856	int offset = reverse ? 0 : 5900;
3857	if (parse_uint_full(port, 10, &baseport) < 0) {
3858	error_setg(errp, "can't convert to a number: %s", port);
3859	goto cleanup;
3860	}
3861	if (baseport > 65535 \|\|
3862	baseport + offset > 65535) {
3863	error_setg(errp, "port %s out of range", port);
3864	goto cleanup;
3865	}
3866	inet->port = g_strdup_printf(
3867	"%d", (int)baseport + offset);
3868
3869	if (to) {
3870	inet->has_to = true;
3871	inet->to = to + offset;
3872	}
3873	}
3874
3875	inet->ipv4 = ipv4;
3876	inet->has_ipv4 = has_ipv4;
3877	inet->ipv6 = ipv6;
3878	inet->has_ipv6 = has_ipv6;
3879
3880	ret = baseport;
3881	}
3882
3883	*retaddr = addr;
3884
3885	cleanup:
3886	if (ret < 0) {
3887	qapi_free_SocketAddress(addr);
3888	}
3889	return ret;
3890	}
3891
3892	static int vnc_display_get_addresses(QemuOpts *opts,
3893	bool reverse,
3894	SocketAddressList **saddr_list_ret,
3895	SocketAddressList **wsaddr_list_ret,
3896	Error **errp)
3897	{
3898	SocketAddress *saddr = NULL;
3899	SocketAddress *wsaddr = NULL;
3900	g_autoptr(SocketAddressList) saddr_list = NULL;
3901	SocketAddressList **saddr_tail = &saddr_list;
3902	SocketAddress *single_saddr = NULL;
3903	g_autoptr(SocketAddressList) wsaddr_list = NULL;
3904	SocketAddressList **wsaddr_tail = &wsaddr_list;
3905	QemuOptsIter addriter;
3906	const char *addr;
3907	int to = qemu_opt_get_number(opts, "to", 0);
3908	bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3909	bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3910	bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3911	bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3912	int displaynum = -1;
3913
3914	addr = qemu_opt_get(opts, "vnc");
3915	if (addr == NULL \|\| g_str_equal(addr, "none")) {
3916	return 0;
3917	}
3918	if (qemu_opt_get(opts, "websocket") &&
3919	!qcrypto_hash_supports(QCRYPTO_HASH_ALGO_SHA1)) {
3920	error_setg(errp,
3921	"SHA1 hash support is required for websockets");
3922	return -1;
3923	}
3924
3925	qemu_opt_iter_init(&addriter, opts, "vnc");
3926	while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3927	int rv;
3928	rv = vnc_display_get_address(addr, false, reverse, 0, to,
3929	has_ipv4, has_ipv6,
3930	ipv4, ipv6,
3931	&saddr, errp);
3932	if (rv < 0) {
3933	return -1;
3934	}
3935	/* Historical compat - first listen address can be used
3936	* to set the default websocket port
3937	*/
3938	if (displaynum == -1) {
3939	displaynum = rv;
3940	}
3941	QAPI_LIST_APPEND(saddr_tail, saddr);
3942	}
3943
3944	if (saddr_list && !saddr_list->next) {
3945	single_saddr = saddr_list->value;
3946	} else {
3947	/*
3948	* If we had multiple primary displays, we don't do defaults
3949	* for websocket, and require explicit config instead.
3950	*/
3951	displaynum = -1;
3952	}
3953
3954	qemu_opt_iter_init(&addriter, opts, "websocket");
3955	while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3956	if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3957	has_ipv4, has_ipv6,
3958	ipv4, ipv6,
3959	&wsaddr, errp) < 0) {
3960	return -1;
3961	}
3962
3963	/* Historical compat - if only a single listen address was
3964	* provided, then this is used to set the default listen
3965	* address for websocket too
3966	*/
3967	if (single_saddr &&
3968	single_saddr->type == SOCKET_ADDRESS_TYPE_INET &&
3969	wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3970	g_str_equal(wsaddr->u.inet.host, "") &&
3971	!g_str_equal(single_saddr->u.inet.host, "")) {
3972	g_free(wsaddr->u.inet.host);
3973	wsaddr->u.inet.host = g_strdup(single_saddr->u.inet.host);
3974	}
3975
3976	QAPI_LIST_APPEND(wsaddr_tail, wsaddr);
3977	}
3978
3979	*saddr_list_ret = g_steal_pointer(&saddr_list);
3980	*wsaddr_list_ret = g_steal_pointer(&wsaddr_list);
3981	return 0;
3982	}
3983
3984	static int vnc_display_connect(VncDisplay *vd,
3985	SocketAddressList *saddr_list,
3986	SocketAddressList *wsaddr_list,
3987	Error **errp)
3988	{
3989	/* connect to viewer */
3990	QIOChannelSocket *sioc = NULL;
3991	if (wsaddr_list) {
3992	error_setg(errp, "Cannot use websockets in reverse mode");
3993	return -1;
3994	}
3995	if (!saddr_list \|\| saddr_list->next) {
3996	error_setg(errp, "Expected a single address in reverse mode");
3997	return -1;
3998	}
3999	sioc = qio_channel_socket_new();
4000	qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
4001	if (qio_channel_socket_connect_sync(sioc, saddr_list->value, errp) < 0) {
4002	object_unref(OBJECT(sioc));
4003	return -1;
4004	}
4005	vnc_connect(vd, sioc, false, false);
4006	object_unref(OBJECT(sioc));
4007	return 0;
4008	}
4009
4010
4011	static int vnc_display_listen(VncDisplay *vd,
4012	SocketAddressList *saddr_list,
4013	SocketAddressList *wsaddr_list,
4014	Error **errp)
4015	{
4016	SocketAddressList *el;
4017
4018	if (saddr_list) {
4019	vd->listener = qio_net_listener_new();
4020	qio_net_listener_set_name(vd->listener, "vnc-listen");
4021	for (el = saddr_list; el; el = el->next) {
4022	if (qio_net_listener_open_sync(vd->listener,
4023	el->value, 1,
4024	errp) < 0) {
4025	return -1;
4026	}
4027	}
4028
4029	qio_net_listener_set_client_func(vd->listener,
4030	vnc_listen_io, vd, NULL);
4031	}
4032
4033	if (wsaddr_list) {
4034	vd->wslistener = qio_net_listener_new();
4035	qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
4036	for (el = wsaddr_list; el; el = el->next) {
4037	if (qio_net_listener_open_sync(vd->wslistener,
4038	el->value, 1,
4039	errp) < 0) {
4040	return -1;
4041	}
4042	}
4043
4044	qio_net_listener_set_client_func(vd->wslistener,
4045	vnc_listen_io, vd, NULL);
4046	}
4047
4048	return 0;
4049	}
4050
4051	bool vnc_display_update(DisplayUpdateOptionsVNC arg, Error *errp)
4052	{
4053	VncDisplay *vd = vnc_display_find(NULL);
4054
4055	if (!vd) {
4056	error_setg(errp, "Can not find vnc display");
4057	return false;
4058	}
4059
4060	if (arg->has_addresses) {
4061	if (vd->listener) {
4062	qio_net_listener_disconnect(vd->listener);
4063	object_unref(OBJECT(vd->listener));
4064	vd->listener = NULL;
4065	}
4066
4067	if (vnc_display_listen(vd, arg->addresses, NULL, errp) < 0) {
4068	return false;
4069	}
4070	}
4071
4072	return true;
4073	}
4074
4075	static bool vnc_display_open(VncDisplay vd, Error *errp)
4076	{
4077	QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, vd->id);
4078	g_autoptr(SocketAddressList) saddr_list = NULL;
4079	g_autoptr(SocketAddressList) wsaddr_list = NULL;
4080	const char share, device_id;
4081	QemuConsole *con;
4082	bool password = false;
4083	bool reverse = false;
4084	const char *credid;
4085	bool sasl = false;
4086	const char *tlsauthz;
4087	const char *saslauthz;
4088	int lock_key_sync = 1;
4089	int key_delay_ms;
4090	const char *audiodev;
4091	const char *passwordSecret;
4092
4093	assert(vd);
4094	assert(opts);
4095
4096	reverse = qemu_opt_get_bool(opts, "reverse", false);
4097	if (vnc_display_get_addresses(opts, reverse, &saddr_list, &wsaddr_list,
4098	errp) < 0) {
4099	return false;
4100	}
4101
4102	passwordSecret = qemu_opt_get(opts, "password-secret");
4103	if (passwordSecret) {
4104	if (qemu_opt_get(opts, "password")) {
4105	error_setg(errp,
4106	"'password' flag is redundant with 'password-secret'");
4107	return false;
4108	}
4109	vd->password = qcrypto_secret_lookup_as_utf8(passwordSecret,
4110	errp);
4111	if (!vd->password) {
4112	return false;
4113	}
4114	password = true;
4115	} else {
4116	password = qemu_opt_get_bool(opts, "password", false);
4117	}
4118	if (password) {
4119	if (!qcrypto_cipher_supports(
4120	QCRYPTO_CIPHER_ALGO_DES, QCRYPTO_CIPHER_MODE_ECB)) {
4121	error_setg(errp,
4122	"Cipher backend does not support DES algorithm");
4123	return false;
4124	}
4125	}
4126
4127	lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
4128	key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
4129	sasl = qemu_opt_get_bool(opts, "sasl", false);
4130	#ifndef CONFIG_VNC_SASL
4131	if (sasl) {
4132	error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
4133	return false;
4134	}
4135	#endif /* CONFIG_VNC_SASL */
4136	credid = qemu_opt_get(opts, "tls-creds");
4137	if (credid) {
4138	Object *creds;
4139	creds = object_resolve_path_component(
4140	object_get_objects_root(), credid);
4141	if (!creds) {
4142	error_setg(errp, "No TLS credentials with id '%s'",
4143	credid);
4144	return false;
4145	}
4146	vd->tlscreds = (QCryptoTLSCreds *)
4147	object_dynamic_cast(creds,
4148	TYPE_QCRYPTO_TLS_CREDS);
4149	if (!vd->tlscreds) {
4150	error_setg(errp, "Object with id '%s' is not TLS credentials",
4151	credid);
4152	return false;
4153	}
4154	object_ref(OBJECT(vd->tlscreds));
4155
4156	if (!qcrypto_tls_creds_check_endpoint(vd->tlscreds,
4157	QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
4158	errp)) {
4159	return false;
4160	}
4161	}
4162	tlsauthz = qemu_opt_get(opts, "tls-authz");
4163	if (tlsauthz && !vd->tlscreds) {
4164	error_setg(errp, "'tls-authz' provided but TLS is not enabled");
4165	return false;
4166	}
4167
4168	saslauthz = qemu_opt_get(opts, "sasl-authz");
4169	if (saslauthz && !sasl) {
4170	error_setg(errp, "'sasl-authz' provided but SASL auth is not enabled");
4171	return false;
4172	}
4173
4174	share = qemu_opt_get(opts, "share");
4175	if (share) {
4176	if (strcmp(share, "ignore") == 0) {
4177	vd->share_policy = VNC_SHARE_POLICY_IGNORE;
4178	} else if (strcmp(share, "allow-exclusive") == 0) {
4179	vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4180	} else if (strcmp(share, "force-shared") == 0) {
4181	vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
4182	} else {
4183	error_setg(errp, "unknown vnc share= option");
4184	return false;
4185	}
4186	} else {
4187	vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
4188	}
4189	vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
4190
4191	#ifdef CONFIG_VNC_JPEG
4192	vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
4193	#endif
4194	vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
4195	/* adaptive updates are only used with tight encoding and
4196	* if lossy updates are enabled so we can disable all the
4197	* calculations otherwise */
4198	if (!vd->lossy) {
4199	vd->non_adaptive = true;
4200	}
4201
4202	vd->power_control = qemu_opt_get_bool(opts, "power-control", false);
4203
4204	if (tlsauthz) {
4205	vd->tlsauthzid = g_strdup(tlsauthz);
4206	}
4207	#ifdef CONFIG_VNC_SASL
4208	if (sasl) {
4209	if (saslauthz) {
4210	vd->sasl.authzid = g_strdup(saslauthz);
4211	}
4212	}
4213	#endif
4214
4215	if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
4216	vd->tlscreds, password,
4217	sasl, false, errp) < 0) {
4218	return false;
4219	}
4220	trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth,
4221	vnc_auth_name(vd->auth, vd->subauth));
4222
4223	if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
4224	vd->tlscreds, password,
4225	sasl, true, errp) < 0) {
4226	return false;
4227	}
4228	trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth,
4229	vnc_auth_name(vd->ws_auth, vd->ws_subauth));
4230
4231	#ifdef CONFIG_VNC_SASL
4232	if (sasl && !vnc_sasl_server_init(errp)) {
4233	return false;
4234	}
4235	#endif
4236	vd->lock_key_sync = lock_key_sync;
4237	if (lock_key_sync) {
4238	vd->led_notifier.notify = kbd_leds;
4239	qemu_input_led_notifier_add(&vd->led_notifier);
4240	}
4241	vd->ledstate = 0;
4242
4243	audiodev = qemu_opt_get(opts, "audiodev");
4244	if (audiodev) {
4245	vd->audio_be = audio_be_by_name(audiodev, errp);
4246	if (!vd->audio_be) {
4247	return false;
4248	}
4249	} else {
4250	vd->audio_be = audio_get_default_audio_be(NULL);
4251	}
4252
4253	device_id = qemu_opt_get(opts, "display");
4254	if (device_id) {
4255	int head = qemu_opt_get_number(opts, "head", 0);
4256	Error *err = NULL;
4257
4258	con = qemu_console_lookup_by_device_name(device_id, head, &err);
4259	if (err) {
4260	error_propagate(errp, err);
4261	return false;
4262	}
4263	} else {
4264	con = qemu_console_lookup_default();
4265	}
4266
4267	qemu_console_register_listener(con, &vd->dcl, &dcl_ops);
4268	vd->kbd = qkbd_state_init(vd->dcl.con);
4269	qkbd_state_set_delay(vd->kbd, key_delay_ms);
4270
4271	if (saddr_list == NULL) {
4272	return true;
4273	}
4274
4275	if (reverse) {
4276	if (vnc_display_connect(vd, saddr_list, wsaddr_list, errp) < 0) {
4277	return false;
4278	}
4279	} else {
4280	if (vnc_display_listen(vd, saddr_list, wsaddr_list, errp) < 0) {
4281	return false;
4282	}
4283	}
4284
4285	if (qemu_opt_get(opts, "to")) {
4286	vnc_display_print_local_addr(vd);
4287	}
4288
4289	return true;
4290	}
4291
4292	void vnc_display_add_client(const char *id, int csock, bool skipauth)
4293	{
4294	VncDisplay *vd = vnc_display_find(id);
4295	QIOChannelSocket *sioc;
4296
4297	if (!vd) {
4298	return;
4299	}
4300
4301	sioc = qio_channel_socket_new_fd(csock, NULL);
4302	if (sioc) {
4303	qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4304	vnc_connect(vd, sioc, skipauth, false);
4305	object_unref(OBJECT(sioc));
4306	}
4307	}
4308
4309	static char vnc_auto_assign_id(QemuOpts opts)
4310	{
4311	QemuOptsList *olist = qemu_find_opts("vnc");
4312	int i = 2;
4313	char *id;
4314
4315	id = g_strdup("default");
4316	while (qemu_opts_find(olist, id)) {
4317	g_free(id);
4318	id = g_strdup_printf("vnc%d", i++);
4319	}
4320	qemu_opts_set_id(opts, id);
4321
4322	return id;
4323	}
4324
4325	void vnc_parse(const char *str)
4326	{
4327	QemuOptsList *olist = qemu_find_opts("vnc");
4328	QemuOpts *opts = qemu_opts_parse_noisily(olist, str, !is_help_option(str));
4329
4330	if (!opts) {
4331	exit(1);
4332	}
4333	}
4334
4335	int vnc_init_func(void opaque, QemuOpts opts, Error **errp)
4336	{
4337	ERRP_GUARD();
4338	char id = (char )qemu_opts_id(opts);
4339
4340	if (!id) {
4341	/* auto-assign id if not present */
4342	id = vnc_auto_assign_id(opts);
4343	}
4344
4345	return vnc_display_new(id, errp) != NULL ? 0 : -1;
4346	}
4347
4348	void vnc_cleanup(void)
4349	{
4350	VncDisplay vd, vd_next;
4351
4352	QTAILQ_FOREACH_SAFE(vd, &vnc_displays, next, vd_next) {
4353	vnc_display_free(vd);
4354	}
4355	}
4356
4357	static void vnc_register_config(void)
4358	{
4359	qemu_add_opts(&qemu_vnc_opts);
4360	}
4361	opts_init(vnc_register_config);