ui/vnc: fix potential memory corruption issues

[qemu.git] / ui / vnc.h

diff --git a/ui/vnc.h b/ui/vnc.h
index 3b8b91122ae4770741d764e891dd6fbccd5c500c..8f582fdc6cd669d18e3b2dd8b9782d64aa5cf694 100644 (file)
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -28,14 +28,18 @@
 #define __QEMU_VNC_H
 
 #include "qemu-common.h"
 #define __QEMU_VNC_H
 
 #include "qemu-common.h"

-#include "qemu-queue.h"
-#include "console.h"
-#include "monitor.h"
+#include "qemu/queue.h"
+#include "qemu/thread.h"
+#include "ui/console.h"

 #include "audio/audio.h"
 #include "audio/audio.h"

+#include "qemu/bitmap.h"

 #include <zlib.h>
 #include <stdbool.h>
 
 #include "keymaps.h"
 #include <zlib.h>
 #include <stdbool.h>
 
 #include "keymaps.h"

+#include "vnc-palette.h"
+#include "vnc-enc-zrle.h"
+#include "qapi-types.h"

 
 // #define _VNC_DEBUG 1
 
 
 // #define _VNC_DEBUG 1
 


@@ -59,10 +63,13 @@ typedef struct Buffer
 } Buffer;
 
 typedef struct VncState VncState;
 } Buffer;
 
 typedef struct VncState VncState;

+typedef struct VncJob VncJob;
+typedef struct VncRect VncRect;
+typedef struct VncRectEntry VncRectEntry;

 
 typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
 
 
 typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
 

-typedef void VncWritePixels(VncState *vs, struct PixelFormat *pf, void *data, int size);
+typedef void VncWritePixels(VncState *vs, void *data, int size);

 
 typedef void VncSendHextileTile(VncState *vs,
                                 int x, int y, int w, int h,
 
 typedef void VncSendHextileTile(VncState *vs,
                                 int x, int y, int w, int h,


@@ -70,9 +77,25 @@ typedef void VncSendHextileTile(VncState *vs,
                                 void *last_fg,
                                 int *has_bg, int *has_fg);
 
                                 void *last_fg,
                                 int *has_bg, int *has_fg);
 

-#define VNC_MAX_WIDTH 2560
+/* VNC_DIRTY_PIXELS_PER_BIT is the number of dirty pixels represented
+ * by one bit in the dirty bitmap, should be a power of 2 */
+#define VNC_DIRTY_PIXELS_PER_BIT 16
+
+/* VNC_MAX_WIDTH must be a multiple of VNC_DIRTY_PIXELS_PER_BIT. */
+
+#define VNC_MAX_WIDTH ROUND_UP(2560, VNC_DIRTY_PIXELS_PER_BIT)

 #define VNC_MAX_HEIGHT 2048
 #define VNC_MAX_HEIGHT 2048

-#define VNC_DIRTY_WORDS (VNC_MAX_WIDTH / (16 * 32))
+
+/* VNC_DIRTY_BITS is the number of bits in the dirty bitmap. */
+#define VNC_DIRTY_BITS (VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT)
+
+/* VNC_DIRTY_BPL (BPL = bits per line) might be greater than
+ * VNC_DIRTY_BITS due to alignment */
+#define VNC_DIRTY_BPL(x) (sizeof((x)->dirty) / VNC_MAX_HEIGHT * BITS_PER_BYTE)
+
+#define VNC_STAT_RECT  64
+#define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT)
+#define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT)

 
 #define VNC_AUTH_CHALLENGE_SIZE 16
 
 
 #define VNC_AUTH_CHALLENGE_SIZE 16
 


@@ -85,34 +108,75 @@ typedef struct VncDisplay VncDisplay;
 #ifdef CONFIG_VNC_SASL
 #include "vnc-auth-sasl.h"
 #endif
 #ifdef CONFIG_VNC_SASL
 #include "vnc-auth-sasl.h"
 #endif

+#ifdef CONFIG_VNC_WS
+#include "vnc-ws.h"
+#endif
+
+struct VncRectStat
+{
+    /* time of last 10 updates, to find update frequency */
+    struct timeval times[10];
+    int idx;
+
+    double freq;        /* Update frequency (in Hz) */
+    bool updated;       /* Already updated during this refresh */
+};
+
+typedef struct VncRectStat VncRectStat;

 
 struct VncSurface
 {
 
 struct VncSurface
 {

-    uint32_t dirty[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
-    DisplaySurface *ds;
+    struct timeval last_freq_check;
+    DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
+                   VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT);
+    VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS];
+    pixman_image_t *fb;
+    pixman_format_code_t format;

 };
 
 };
 

+typedef enum VncShareMode {
+    VNC_SHARE_MODE_CONNECTING = 1,
+    VNC_SHARE_MODE_SHARED,
+    VNC_SHARE_MODE_EXCLUSIVE,
+    VNC_SHARE_MODE_DISCONNECTED,
+} VncShareMode;
+
+typedef enum VncSharePolicy {
+    VNC_SHARE_POLICY_IGNORE = 1,
+    VNC_SHARE_POLICY_ALLOW_EXCLUSIVE,
+    VNC_SHARE_POLICY_FORCE_SHARED,
+} VncSharePolicy;
+

 struct VncDisplay
 {
     QTAILQ_HEAD(, VncState) clients;
 struct VncDisplay
 {
     QTAILQ_HEAD(, VncState) clients;

-    QEMUTimer *timer;
-    int timer_interval;
+    int num_exclusive;
+    VncSharePolicy share_policy;

     int lsock;
     int lsock;

-    DisplayState *ds;
+#ifdef CONFIG_VNC_WS
+    int lwebsock;
+    bool websocket;
+    char *ws_display;
+#endif
+    DisplaySurface *ds;
+    DisplayChangeListener dcl;

     kbd_layout_t *kbd_layout;
     int lock_key_sync;
     kbd_layout_t *kbd_layout;
     int lock_key_sync;

+    QemuMutex mutex;

 
     QEMUCursor *cursor;
     int cursor_msize;
     uint8_t *cursor_mask;
 
     struct VncSurface guest;   /* guest visible surface (aka ds->surface) */
 
     QEMUCursor *cursor;
     int cursor_msize;
     uint8_t *cursor_mask;
 
     struct VncSurface guest;   /* guest visible surface (aka ds->surface) */

-    DisplaySurface *server;  /* vnc server surface */
+    pixman_image_t *server;    /* vnc server surface */

 
     char *display;
     char *password;
 
     char *display;
     char *password;

+    time_t expires;

     int auth;
     bool lossy;
     int auth;
     bool lossy;

+    bool non_adaptive;

 #ifdef CONFIG_VNC_TLS
     int subauth; /* Used by VeNCrypt */
     VncDisplayTLS tls;
 #ifdef CONFIG_VNC_TLS
     int subauth; /* Used by VeNCrypt */
     VncDisplayTLS tls;


@@ -122,12 +186,79 @@ struct VncDisplay
 #endif
 };
 
 #endif
 };
 

+typedef struct VncTight {
+    int type;
+    uint8_t quality;
+    uint8_t compression;
+    uint8_t pixel24;
+    Buffer tight;
+    Buffer tmp;
+    Buffer zlib;
+    Buffer gradient;
+#ifdef CONFIG_VNC_JPEG
+    Buffer jpeg;
+#endif
+#ifdef CONFIG_VNC_PNG
+    Buffer png;
+#endif
+    int levels[4];
+    z_stream stream[4];
+} VncTight;
+
+typedef struct VncHextile {
+    VncSendHextileTile *send_tile;
+} VncHextile;
+
+typedef struct VncZlib {
+    Buffer zlib;
+    Buffer tmp;
+    z_stream stream;
+    int level;
+} VncZlib;
+
+typedef struct VncZrle {
+    int type;
+    Buffer fb;
+    Buffer zrle;
+    Buffer tmp;
+    Buffer zlib;
+    z_stream stream;
+    VncPalette palette;
+} VncZrle;
+
+typedef struct VncZywrle {
+    int buf[VNC_ZRLE_TILE_WIDTH * VNC_ZRLE_TILE_HEIGHT];
+} VncZywrle;
+
+struct VncRect
+{
+    int x;
+    int y;
+    int w;
+    int h;
+};
+
+struct VncRectEntry
+{
+    struct VncRect rect;
+    QLIST_ENTRY(VncRectEntry) next;
+};
+
+struct VncJob
+{
+    VncState *vs;
+
+    QLIST_HEAD(, VncRectEntry) rectangles;
+    QTAILQ_ENTRY(VncJob) next;
+};
+

 struct VncState
 {
     int csock;
 
 struct VncState
 {
     int csock;
 

-    DisplayState *ds;
-    uint32_t dirty[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
+    DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], VNC_DIRTY_BITS);
+    uint8_t **lossy_rect; /* Not an Array to avoid costly memcpy in
+                           * vnc-jobs-async.c */

 
     VncDisplay *vd;
     int need_update;
 
     VncDisplay *vd;
     int need_update;


@@ -136,29 +267,46 @@ struct VncState
     int absolute;
     int last_x;
     int last_y;
     int absolute;
     int last_x;
     int last_y;

+    uint32_t last_bmask;

     int client_width;
     int client_height;
     int client_width;
     int client_height;

+    VncShareMode share_mode;

 
     uint32_t vnc_encoding;
 
     int major;
     int minor;
 
 
     uint32_t vnc_encoding;
 
     int major;
     int minor;
 

+    int auth;

     char challenge[VNC_AUTH_CHALLENGE_SIZE];
 #ifdef CONFIG_VNC_TLS
     char challenge[VNC_AUTH_CHALLENGE_SIZE];
 #ifdef CONFIG_VNC_TLS

+    int subauth; /* Used by VeNCrypt */

     VncStateTLS tls;
 #endif
 #ifdef CONFIG_VNC_SASL
     VncStateSASL sasl;
 #endif
     VncStateTLS tls;
 #endif
 #ifdef CONFIG_VNC_SASL
     VncStateSASL sasl;
 #endif

+#ifdef CONFIG_VNC_WS
+#ifdef CONFIG_VNC_TLS
+    VncStateTLS ws_tls;
+#endif /* CONFIG_VNC_TLS */
+    bool encode_ws;
+    bool websocket;
+#endif /* CONFIG_VNC_WS */

 
 

-    QObject *info;
+    VncClientInfo *info;

 
     Buffer output;
     Buffer input;
 
     Buffer output;
     Buffer input;

+#ifdef CONFIG_VNC_WS
+    Buffer ws_input;
+    Buffer ws_output;
+#endif

     /* current output mode information */
     VncWritePixels *write_pixels;
     /* current output mode information */
     VncWritePixels *write_pixels;

-    DisplaySurface clientds;
+    PixelFormat client_pf;
+    pixman_format_code_t client_format;
+    bool client_be;

 
     CaptureVoiceOut *audio_cap;
     struct audsettings as;
 
     CaptureVoiceOut *audio_cap;
     struct audsettings as;


@@ -169,34 +317,20 @@ struct VncState
     uint8_t modifiers_state[256];
     QEMUPutLEDEntry *led;
 
     uint8_t modifiers_state[256];
     QEMUPutLEDEntry *led;
 

-    /* Encoding specific */
-
-    /* Tight */
-    int tight_type;
-    uint8_t tight_quality;
-    uint8_t tight_compression;
-    uint8_t tight_pixel24;
-    Buffer tight;
-    Buffer tight_tmp;
-    Buffer tight_zlib;
-    Buffer tight_gradient;
-#ifdef CONFIG_VNC_JPEG
-    Buffer tight_jpeg;
-#endif
-#ifdef CONFIG_VNC_PNG
-    Buffer tight_png;
-#endif
-    int tight_levels[4];
-    z_stream tight_stream[4];
-
-    /* Hextile */
-    VncSendHextileTile *send_hextile_tile;
-
-    /* Zlib */
-    Buffer zlib;
-    Buffer zlib_tmp;
-    z_stream zlib_stream;
-    int zlib_level;
+    bool abort;
+    bool initialized;
+    QemuMutex output_mutex;
+    QEMUBH *bh;
+    Buffer jobs_buffer;
+
+    /* Encoding specific, if you add something here, don't forget to
+     *  update vnc_async_encoding_start()
+     */
+    VncTight tight;
+    VncZlib zlib;
+    VncHextile hextile;
+    VncZrle zrle;
+    VncZywrle zywrle;

 
     Notifier mouse_mode_notifier;
 
 
     Notifier mouse_mode_notifier;
 


@@ -264,6 +398,7 @@ enum {
 #define VNC_ENCODING_EXT_KEY_EVENT        0XFFFFFEFE /* -258 */
 #define VNC_ENCODING_AUDIO                0XFFFFFEFD /* -259 */
 #define VNC_ENCODING_TIGHT_PNG            0xFFFFFEFC /* -260 */
 #define VNC_ENCODING_EXT_KEY_EVENT        0XFFFFFEFE /* -258 */
 #define VNC_ENCODING_AUDIO                0XFFFFFEFD /* -259 */
 #define VNC_ENCODING_TIGHT_PNG            0xFFFFFEFC /* -260 */

+#define VNC_ENCODING_LED_STATE            0XFFFFFEFB /* -261 */

 #define VNC_ENCODING_WMVi                 0x574D5669
 
 /*****************************************************************************
 #define VNC_ENCODING_WMVi                 0x574D5669
 
 /*****************************************************************************


@@ -300,6 +435,9 @@ enum {
 #define VNC_FEATURE_COPYRECT                 6
 #define VNC_FEATURE_RICH_CURSOR              7
 #define VNC_FEATURE_TIGHT_PNG                8
 #define VNC_FEATURE_COPYRECT                 6
 #define VNC_FEATURE_RICH_CURSOR              7
 #define VNC_FEATURE_TIGHT_PNG                8

+#define VNC_FEATURE_ZRLE                     9
+#define VNC_FEATURE_ZYWRLE                  10
+#define VNC_FEATURE_LED_STATE               11

 
 #define VNC_FEATURE_RESIZE_MASK              (1 << VNC_FEATURE_RESIZE)
 #define VNC_FEATURE_HEXTILE_MASK             (1 << VNC_FEATURE_HEXTILE)
 
 #define VNC_FEATURE_RESIZE_MASK              (1 << VNC_FEATURE_RESIZE)
 #define VNC_FEATURE_HEXTILE_MASK             (1 << VNC_FEATURE_HEXTILE)


@@ -310,6 +448,9 @@ enum {
 #define VNC_FEATURE_COPYRECT_MASK            (1 << VNC_FEATURE_COPYRECT)
 #define VNC_FEATURE_RICH_CURSOR_MASK         (1 << VNC_FEATURE_RICH_CURSOR)
 #define VNC_FEATURE_TIGHT_PNG_MASK           (1 << VNC_FEATURE_TIGHT_PNG)
 #define VNC_FEATURE_COPYRECT_MASK            (1 << VNC_FEATURE_COPYRECT)
 #define VNC_FEATURE_RICH_CURSOR_MASK         (1 << VNC_FEATURE_RICH_CURSOR)
 #define VNC_FEATURE_TIGHT_PNG_MASK           (1 << VNC_FEATURE_TIGHT_PNG)

+#define VNC_FEATURE_ZRLE_MASK                (1 << VNC_FEATURE_ZRLE)
+#define VNC_FEATURE_ZYWRLE_MASK              (1 << VNC_FEATURE_ZYWRLE)
+#define VNC_FEATURE_LED_STATE_MASK           (1 << VNC_FEATURE_LED_STATE)

 
 
 /* Client -> Server message IDs */
 
 
 /* Client -> Server message IDs */


@@ -384,12 +525,11 @@ void vnc_write_u16(VncState *vs, uint16_t value);
 void vnc_write_u8(VncState *vs, uint8_t value);
 void vnc_flush(VncState *vs);
 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting);
 void vnc_write_u8(VncState *vs, uint8_t value);
 void vnc_flush(VncState *vs);
 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting);

+void vnc_disconnect_finish(VncState *vs);
+void vnc_init_state(VncState *vs);

 
 
 /* Buffer I/O functions */
 
 
 /* Buffer I/O functions */

-uint8_t read_u8(uint8_t *data, size_t offset);
-uint16_t read_u16(uint8_t *data, size_t offset);
-int32_t read_s32(uint8_t *data, size_t offset);

 uint32_t read_u32(uint8_t *data, size_t offset);
 
 /* Protocol stage functions */
 uint32_t read_u32(uint8_t *data, size_t offset);
 
 /* Protocol stage functions */


@@ -401,11 +541,11 @@ void start_auth_vnc(VncState *vs);
 
 /* Buffer management */
 void buffer_reserve(Buffer *buffer, size_t len);
 
 /* Buffer management */
 void buffer_reserve(Buffer *buffer, size_t len);

-int buffer_empty(Buffer *buffer);
-uint8_t *buffer_end(Buffer *buffer);

 void buffer_reset(Buffer *buffer);
 void buffer_free(Buffer *buffer);
 void buffer_append(Buffer *buffer, const void *data, size_t len);
 void buffer_reset(Buffer *buffer);
 void buffer_free(Buffer *buffer);
 void buffer_append(Buffer *buffer, const void *data, size_t len);

+void buffer_advance(Buffer *buf, size_t len);
+uint8_t *buffer_end(Buffer *buffer);

 
 
 /* Misc helpers */
 
 
 /* Misc helpers */


@@ -421,9 +561,21 @@ static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
                             int32_t encoding);
 
 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
                             int32_t encoding);
 

+/* server fb is in PIXMAN_x8r8g8b8 */
+#define VNC_SERVER_FB_FORMAT PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
+#define VNC_SERVER_FB_BITS   (PIXMAN_FORMAT_BPP(VNC_SERVER_FB_FORMAT))
+#define VNC_SERVER_FB_BYTES  ((VNC_SERVER_FB_BITS+7)/8)
+
+void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y);
+int vnc_server_fb_stride(VncDisplay *vd);
+

 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v);
 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v);

+double vnc_update_freq(VncState *vs, int x, int y, int w, int h);
+void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h);

 
 /* Encodings */
 
 /* Encodings */

+int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
+

 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
 
 int vnc_hextile_send_framebuffer_update(VncState *vs, int x,
 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
 
 int vnc_hextile_send_framebuffer_update(VncState *vs, int x,


@@ -440,4 +592,8 @@ int vnc_tight_png_send_framebuffer_update(VncState *vs, int x, int y,
                                           int w, int h);
 void vnc_tight_clear(VncState *vs);
 
                                           int w, int h);
 void vnc_tight_clear(VncState *vs);
 

+int vnc_zrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
+int vnc_zywrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
+void vnc_zrle_clear(VncState *vs);
+

 #endif /* __QEMU_VNC_H */
 #endif /* __QEMU_VNC_H */