2 * QEMU VNC display driver
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
30 #include "qemu/queue.h"
31 #include "qemu/thread.h"
32 #include "ui/clipboard.h"
33 #include "ui/console.h"
34 #include "audio/audio.h"
35 #include "qemu/bitmap.h"
36 #include "crypto/tlssession.h"
37 #include "qemu/buffer.h"
38 #include "io/channel-socket.h"
39 #include "io/channel-tls.h"
40 #include "io/net-listener.h"
41 #include "authz/base.h"
45 #include "vnc-palette.h"
46 #include "vnc-enc-zrle.h"
47 #include "ui/kbd-state.h"
49 // #define _VNC_DEBUG 1
52 #define VNC_DEBUG(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
54 #define VNC_DEBUG(fmt, ...) do { } while (0)
57 /*****************************************************************************
59 * Core data structures
61 *****************************************************************************/
63 typedef struct VncState VncState;
64 typedef struct VncJob VncJob;
65 typedef struct VncRect VncRect;
66 typedef struct VncRectEntry VncRectEntry;
68 typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
70 typedef void VncWritePixels(VncState *vs, void *data, int size);
72 typedef void VncSendHextileTile(VncState *vs,
73 int x, int y, int w, int h,
76 int *has_bg, int *has_fg);
78 /* VNC_DIRTY_PIXELS_PER_BIT is the number of dirty pixels represented
79 * by one bit in the dirty bitmap, should be a power of 2 */
80 #define VNC_DIRTY_PIXELS_PER_BIT 16
82 /* VNC_MAX_WIDTH must be a multiple of VNC_DIRTY_PIXELS_PER_BIT. */
84 #define VNC_MAX_WIDTH ROUND_UP(2560, VNC_DIRTY_PIXELS_PER_BIT)
85 #define VNC_MAX_HEIGHT 2048
87 /* VNC_DIRTY_BITS is the number of bits in the dirty bitmap. */
88 #define VNC_DIRTY_BITS (VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT)
90 /* VNC_DIRTY_BPL (BPL = bits per line) might be greater than
91 * VNC_DIRTY_BITS due to alignment */
92 #define VNC_DIRTY_BPL(x) (sizeof((x)->dirty) / VNC_MAX_HEIGHT * BITS_PER_BYTE)
94 #define VNC_STAT_RECT 64
95 #define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT)
96 #define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT)
98 #define VNC_AUTH_CHALLENGE_SIZE 16
100 typedef struct VncDisplay VncDisplay;
102 #include "vnc-auth-vencrypt.h"
103 #ifdef CONFIG_VNC_SASL
104 #include "vnc-auth-sasl.h"
110 /* time of last 10 updates, to find update frequency */
111 struct timeval times[10];
114 double freq; /* Update frequency (in Hz) */
115 bool updated; /* Already updated during this refresh */
118 typedef struct VncRectStat VncRectStat;
122 struct timeval last_freq_check;
123 DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
124 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT);
125 VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS];
127 pixman_format_code_t format;
130 typedef enum VncShareMode {
131 VNC_SHARE_MODE_CONNECTING = 1,
132 VNC_SHARE_MODE_SHARED,
133 VNC_SHARE_MODE_EXCLUSIVE,
134 VNC_SHARE_MODE_DISCONNECTED,
137 typedef enum VncSharePolicy {
138 VNC_SHARE_POLICY_IGNORE = 1,
139 VNC_SHARE_POLICY_ALLOW_EXCLUSIVE,
140 VNC_SHARE_POLICY_FORCE_SHARED,
145 QTAILQ_HEAD(, VncState) clients;
149 int connections_limit;
150 VncSharePolicy share_policy;
151 QIONetListener *listener;
152 QIONetListener *wslistener;
154 DisplayChangeListener dcl;
155 kbd_layout_t *kbd_layout;
157 QEMUPutLEDEntry *led;
164 uint8_t *cursor_mask;
166 struct VncSurface guest; /* guest visible surface (aka ds->surface) */
167 pixman_image_t *server; /* vnc server surface */
168 int true_width; /* server surface width before rounding up */
171 QTAILQ_ENTRY(VncDisplay) next;
176 int subauth; /* Used by VeNCrypt */
177 int ws_auth; /* Used by websockets */
178 int ws_subauth; /* Used by websockets */
182 QCryptoTLSCreds *tlscreds;
185 #ifdef CONFIG_VNC_SASL
189 AudioState *audio_state;
192 typedef struct VncTight {
201 #ifdef CONFIG_VNC_JPEG
211 typedef struct VncHextile {
212 VncSendHextileTile *send_tile;
215 typedef struct VncZlib {
222 typedef struct VncZrle {
232 typedef struct VncZywrle {
233 int buf[VNC_ZRLE_TILE_WIDTH * VNC_ZRLE_TILE_HEIGHT];
247 QLIST_ENTRY(VncRectEntry) next;
254 QLIST_HEAD(, VncRectEntry) rectangles;
255 QTAILQ_ENTRY(VncJob) next;
259 VNC_STATE_UPDATE_NONE,
260 VNC_STATE_UPDATE_INCREMENTAL,
261 VNC_STATE_UPDATE_FORCE,
264 #define VNC_MAGIC ((uint64_t)0x05b3f069b3d204bb)
269 QIOChannelSocket *sioc; /* The underlying socket */
270 QIOChannel *ioc; /* The channel currently used for I/O */
272 gboolean disconnecting;
274 DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], VNC_DIRTY_BITS);
275 uint8_t **lossy_rect; /* Not an Array to avoid costly memcpy in
276 * vnc-jobs-async.c */
279 VncStateUpdate update; /* Most recent pending request from client */
280 VncStateUpdate job_update; /* Currently processed by job thread */
287 size_t client_width; /* limited to u16 by RFB proto */
288 size_t client_height; /* limited to u16 by RFB proto */
289 VncShareMode share_mode;
291 uint32_t vnc_encoding;
297 int subauth; /* Used by VeNCrypt */
298 char challenge[VNC_AUTH_CHALLENGE_SIZE];
299 QCryptoTLSSession *tls; /* Borrowed pointer from channel, don't free */
300 #ifdef CONFIG_VNC_SASL
310 /* Job thread bottom half has put data for a forced update
311 * into the output buffer. This offset points to the end of
312 * the update data in the output buffer. This lets us determine
313 * when a force update is fully sent to the client, allowing
314 * us to process further forced updates. */
315 size_t force_update_offset;
316 /* We allow multiple incremental updates or audio capture
317 * samples to be queued in output buffer, provided the
318 * buffer size doesn't exceed this threshold. The value
319 * is calculating dynamically based on framebuffer size
320 * and audio sample settings in vnc_update_throttle_offset() */
321 size_t throttle_output_offset;
324 /* current output mode information */
325 VncWritePixels *write_pixels;
326 PixelFormat client_pf;
327 pixman_format_code_t client_format;
330 CaptureVoiceOut *audio_cap;
331 struct audsettings as;
333 VncReadEvent *read_handler;
334 size_t read_handler_expect;
337 QemuMutex output_mutex;
341 /* Encoding specific, if you add something here, don't forget to
342 * update vnc_async_encoding_start()
350 Notifier mouse_mode_notifier;
352 QemuClipboardPeer cbpeer;
353 QemuClipboardInfo *cbinfo;
356 QTAILQ_ENTRY(VncState) next;
360 /*****************************************************************************
362 * Authentication modes
364 *****************************************************************************/
367 VNC_AUTH_INVALID = 0,
374 VNC_AUTH_TLS = 18, /* Supported in GTK-VNC & VINO */
375 VNC_AUTH_VENCRYPT = 19, /* Supported in GTK-VNC & VeNCrypt */
376 VNC_AUTH_SASL = 20, /* Supported in GTK-VNC & VINO */
380 VNC_AUTH_VENCRYPT_PLAIN = 256,
381 VNC_AUTH_VENCRYPT_TLSNONE = 257,
382 VNC_AUTH_VENCRYPT_TLSVNC = 258,
383 VNC_AUTH_VENCRYPT_TLSPLAIN = 259,
384 VNC_AUTH_VENCRYPT_X509NONE = 260,
385 VNC_AUTH_VENCRYPT_X509VNC = 261,
386 VNC_AUTH_VENCRYPT_X509PLAIN = 262,
387 VNC_AUTH_VENCRYPT_X509SASL = 263,
388 VNC_AUTH_VENCRYPT_TLSSASL = 264,
392 /*****************************************************************************
396 *****************************************************************************/
398 #define VNC_ENCODING_RAW 0x00000000
399 #define VNC_ENCODING_COPYRECT 0x00000001
400 #define VNC_ENCODING_RRE 0x00000002
401 #define VNC_ENCODING_CORRE 0x00000004
402 #define VNC_ENCODING_HEXTILE 0x00000005
403 #define VNC_ENCODING_ZLIB 0x00000006
404 #define VNC_ENCODING_TIGHT 0x00000007
405 #define VNC_ENCODING_ZLIBHEX 0x00000008
406 #define VNC_ENCODING_TRLE 0x0000000f
407 #define VNC_ENCODING_ZRLE 0x00000010
408 #define VNC_ENCODING_ZYWRLE 0x00000011
409 #define VNC_ENCODING_COMPRESSLEVEL0 0xFFFFFF00 /* -256 */
410 #define VNC_ENCODING_QUALITYLEVEL0 0xFFFFFFE0 /* -32 */
411 #define VNC_ENCODING_XCURSOR 0xFFFFFF10 /* -240 */
412 #define VNC_ENCODING_RICH_CURSOR 0xFFFFFF11 /* -239 */
413 #define VNC_ENCODING_POINTER_POS 0xFFFFFF18 /* -232 */
414 #define VNC_ENCODING_LASTRECT 0xFFFFFF20 /* -224 */
415 #define VNC_ENCODING_DESKTOPRESIZE 0xFFFFFF21 /* -223 */
416 #define VNC_ENCODING_POINTER_TYPE_CHANGE 0XFFFFFEFF /* -257 */
417 #define VNC_ENCODING_EXT_KEY_EVENT 0XFFFFFEFE /* -258 */
418 #define VNC_ENCODING_AUDIO 0XFFFFFEFD /* -259 */
419 #define VNC_ENCODING_TIGHT_PNG 0xFFFFFEFC /* -260 */
420 #define VNC_ENCODING_LED_STATE 0XFFFFFEFB /* -261 */
421 #define VNC_ENCODING_DESKTOP_RESIZE_EXT 0XFFFFFECC /* -308 */
422 #define VNC_ENCODING_XVP 0XFFFFFECB /* -309 */
423 #define VNC_ENCODING_ALPHA_CURSOR 0XFFFFFEC6 /* -314 */
424 #define VNC_ENCODING_WMVi 0x574D5669
425 #define VNC_ENCODING_CLIPBOARD_EXT 0xc0a1e5ce
427 /*****************************************************************************
429 * Other tight constants
431 *****************************************************************************/
434 * Vendors known by TightVNC: standard VNC/RealVNC, TridiaVNC, and TightVNC.
437 #define VNC_TIGHT_CCB_RESET_MASK (0x0f)
438 #define VNC_TIGHT_CCB_TYPE_MASK (0x0f << 4)
439 #define VNC_TIGHT_CCB_TYPE_FILL (0x08 << 4)
440 #define VNC_TIGHT_CCB_TYPE_JPEG (0x09 << 4)
441 #define VNC_TIGHT_CCB_TYPE_PNG (0x0A << 4)
442 #define VNC_TIGHT_CCB_BASIC_MAX (0x07 << 4)
443 #define VNC_TIGHT_CCB_BASIC_ZLIB (0x03 << 4)
444 #define VNC_TIGHT_CCB_BASIC_FILTER (0x04 << 4)
446 /*****************************************************************************
450 *****************************************************************************/
454 VNC_FEATURE_RESIZE_EXT,
456 VNC_FEATURE_POINTER_TYPE_CHANGE,
460 VNC_FEATURE_RICH_CURSOR,
461 VNC_FEATURE_ALPHA_CURSOR,
462 VNC_FEATURE_TIGHT_PNG,
465 VNC_FEATURE_LED_STATE,
467 VNC_FEATURE_CLIPBOARD_EXT,
470 #define VNC_FEATURE_RESIZE_MASK (1 << VNC_FEATURE_RESIZE)
471 #define VNC_FEATURE_RESIZE_EXT_MASK (1 << VNC_FEATURE_RESIZE_EXT)
472 #define VNC_FEATURE_HEXTILE_MASK (1 << VNC_FEATURE_HEXTILE)
473 #define VNC_FEATURE_POINTER_TYPE_CHANGE_MASK (1 << VNC_FEATURE_POINTER_TYPE_CHANGE)
474 #define VNC_FEATURE_WMVI_MASK (1 << VNC_FEATURE_WMVI)
475 #define VNC_FEATURE_TIGHT_MASK (1 << VNC_FEATURE_TIGHT)
476 #define VNC_FEATURE_ZLIB_MASK (1 << VNC_FEATURE_ZLIB)
477 #define VNC_FEATURE_RICH_CURSOR_MASK (1 << VNC_FEATURE_RICH_CURSOR)
478 #define VNC_FEATURE_ALPHA_CURSOR_MASK (1 << VNC_FEATURE_ALPHA_CURSOR)
479 #define VNC_FEATURE_TIGHT_PNG_MASK (1 << VNC_FEATURE_TIGHT_PNG)
480 #define VNC_FEATURE_ZRLE_MASK (1 << VNC_FEATURE_ZRLE)
481 #define VNC_FEATURE_ZYWRLE_MASK (1 << VNC_FEATURE_ZYWRLE)
482 #define VNC_FEATURE_LED_STATE_MASK (1 << VNC_FEATURE_LED_STATE)
483 #define VNC_FEATURE_XVP_MASK (1 << VNC_FEATURE_XVP)
484 #define VNC_FEATURE_CLIPBOARD_EXT_MASK (1 << VNC_FEATURE_CLIPBOARD_EXT)
487 /* Client -> Server message IDs */
488 #define VNC_MSG_CLIENT_SET_PIXEL_FORMAT 0
489 #define VNC_MSG_CLIENT_SET_ENCODINGS 2
490 #define VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST 3
491 #define VNC_MSG_CLIENT_KEY_EVENT 4
492 #define VNC_MSG_CLIENT_POINTER_EVENT 5
493 #define VNC_MSG_CLIENT_CUT_TEXT 6
494 #define VNC_MSG_CLIENT_VMWARE_0 127
495 #define VNC_MSG_CLIENT_CALL_CONTROL 249
496 #define VNC_MSG_CLIENT_XVP 250
497 #define VNC_MSG_CLIENT_SET_DESKTOP_SIZE 251
498 #define VNC_MSG_CLIENT_TIGHT 252
499 #define VNC_MSG_CLIENT_GII 253
500 #define VNC_MSG_CLIENT_VMWARE_1 254
501 #define VNC_MSG_CLIENT_QEMU 255
503 /* Server -> Client message IDs */
504 #define VNC_MSG_SERVER_FRAMEBUFFER_UPDATE 0
505 #define VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES 1
506 #define VNC_MSG_SERVER_BELL 2
507 #define VNC_MSG_SERVER_CUT_TEXT 3
508 #define VNC_MSG_SERVER_VMWARE_0 127
509 #define VNC_MSG_SERVER_CALL_CONTROL 249
510 #define VNC_MSG_SERVER_XVP 250
511 #define VNC_MSG_SERVER_TIGHT 252
512 #define VNC_MSG_SERVER_GII 253
513 #define VNC_MSG_SERVER_VMWARE_1 254
514 #define VNC_MSG_SERVER_QEMU 255
518 /* QEMU client -> server message IDs */
519 #define VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT 0
520 #define VNC_MSG_CLIENT_QEMU_AUDIO 1
522 /* QEMU server -> client message IDs */
523 #define VNC_MSG_SERVER_QEMU_AUDIO 1
527 /* QEMU client -> server audio message IDs */
528 #define VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE 0
529 #define VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE 1
530 #define VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT 2
532 /* QEMU server -> client audio message IDs */
533 #define VNC_MSG_SERVER_QEMU_AUDIO_END 0
534 #define VNC_MSG_SERVER_QEMU_AUDIO_BEGIN 1
535 #define VNC_MSG_SERVER_QEMU_AUDIO_DATA 2
537 /* XVP server -> client status code */
538 #define VNC_XVP_CODE_FAIL 0
539 #define VNC_XVP_CODE_INIT 1
541 /* XVP client -> server action request */
542 #define VNC_XVP_ACTION_SHUTDOWN 2
543 #define VNC_XVP_ACTION_REBOOT 3
544 #define VNC_XVP_ACTION_RESET 4
546 /* extended clipboard flags */
547 #define VNC_CLIPBOARD_TEXT (1 << 0)
548 #define VNC_CLIPBOARD_RTF (1 << 1)
549 #define VNC_CLIPBOARD_HTML (1 << 2)
550 #define VNC_CLIPBOARD_DIB (1 << 3)
551 #define VNC_CLIPBOARD_FILES (1 << 4)
552 #define VNC_CLIPBOARD_CAPS (1 << 24)
553 #define VNC_CLIPBOARD_REQUEST (1 << 25)
554 #define VNC_CLIPBOARD_PEEK (1 << 26)
555 #define VNC_CLIPBOARD_NOTIFY (1 << 27)
556 #define VNC_CLIPBOARD_PROVIDE (1 << 28)
558 /*****************************************************************************
562 *****************************************************************************/
564 /* Event loop functions */
565 gboolean vnc_client_io(QIOChannel *ioc,
566 GIOCondition condition,
569 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen);
570 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen);
572 /* Protocol I/O functions */
573 void vnc_write(VncState *vs, const void *data, size_t len);
574 void vnc_write_u32(VncState *vs, uint32_t value);
575 void vnc_write_s32(VncState *vs, int32_t value);
576 void vnc_write_u16(VncState *vs, uint16_t value);
577 void vnc_write_u8(VncState *vs, uint8_t value);
578 void vnc_flush(VncState *vs);
579 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting);
580 void vnc_disconnect_finish(VncState *vs);
581 void vnc_start_protocol(VncState *vs);
584 /* Buffer I/O functions */
585 uint32_t read_u32(uint8_t *data, size_t offset);
587 /* Protocol stage functions */
588 void vnc_client_error(VncState *vs);
589 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error *err);
591 void start_client_init(VncState *vs);
592 void start_auth_vnc(VncState *vs);
597 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
598 return (vs->features & (1 << feature));
602 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
605 /* server fb is in PIXMAN_x8r8g8b8 */
606 #define VNC_SERVER_FB_FORMAT PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
607 #define VNC_SERVER_FB_BITS (PIXMAN_FORMAT_BPP(VNC_SERVER_FB_FORMAT))
608 #define VNC_SERVER_FB_BYTES ((VNC_SERVER_FB_BITS+7)/8)
610 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y);
611 int vnc_server_fb_stride(VncDisplay *vd);
613 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v);
614 double vnc_update_freq(VncState *vs, int x, int y, int w, int h);
615 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h);
618 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
620 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
622 int vnc_hextile_send_framebuffer_update(VncState *vs, int x,
623 int y, int w, int h);
624 void vnc_hextile_set_pixel_conversion(VncState *vs, int generic);
626 void *vnc_zlib_zalloc(void *x, unsigned items, unsigned size);
627 void vnc_zlib_zfree(void *x, void *addr);
628 int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
629 void vnc_zlib_clear(VncState *vs);
631 int vnc_tight_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
632 int vnc_tight_png_send_framebuffer_update(VncState *vs, int x, int y,
634 void vnc_tight_clear(VncState *vs);
636 int vnc_zrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
637 int vnc_zywrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
638 void vnc_zrle_clear(VncState *vs);
640 /* vnc-clipboard.c */
641 void vnc_server_cut_text_caps(VncState *vs);
642 void vnc_client_cut_text(VncState *vs, size_t len, uint8_t *text);
643 void vnc_client_cut_text_ext(VncState *vs, int32_t len, uint32_t flags, uint8_t *data);
645 #endif /* QEMU_VNC_H */