1/*
2 * Copyright (c) 2010, 2015 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions are
16 * met: redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer;
18 * redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution;
21 * neither the name of the copyright holders nor the names of its
22 * contributors may be used to endorse or promote products derived from
23 * this software without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
26 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
27 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
28 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
29 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
30 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
31 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
35 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 *
37 * Authors: Ali Saidi
38 * William Wang
39 */
40
41/** @file
42 * Implementiation of a VNC server
43 */
44
45#include <sys/ioctl.h>
46#include <sys/stat.h>
47
48#if defined(__FreeBSD__)
49#include <termios.h>
50
51#else
52#include <sys/termios.h>
53
54#endif
55#include "base/vnc/vncserver.hh"
56
57#include <fcntl.h>
58#include <poll.h>
59#include <sys/types.h>
60#include <unistd.h>
61
62#include <cerrno>
63#include <cstdio>
64#include <cstddef>
65
66#include "base/atomicio.hh"
67#include "base/bitmap.hh"
68#include "base/misc.hh"
69#include "base/output.hh"
70#include "base/socket.hh"
71#include "base/trace.hh"
72#include "debug/VNC.hh"
73#include "sim/byteswap.hh"
74#include "sim/core.hh"
75
76using namespace std;
77
78const PixelConverter VncServer::pixelConverter(
79 4, // 4 bytes / pixel
80 16, 8, 0, // R in [23, 16], G in [15, 8], B in [7, 0]
81 8, 8, 8, // 8 bits / channel
82 LittleEndianByteOrder);
83
84/** @file
85 * Implementiation of a VNC server
86 */
87
88/**
89 * Poll event for the listen socket
90 */
91VncServer::ListenEvent::ListenEvent(VncServer *vs, int fd, int e)
92 : PollEvent(fd, e), vncserver(vs)
93{
94}
95
96void
97VncServer::ListenEvent::process(int revent)
98{
99 vncserver->accept();
100}
101
102/**
103 * Poll event for the data socket
104 */
105VncServer::DataEvent::DataEvent(VncServer *vs, int fd, int e)
106 : PollEvent(fd, e), vncserver(vs)
107{
108}
109
110void
111VncServer::DataEvent::process(int revent)
112{
113 if (revent & POLLIN)
114 vncserver->data();
115 else if (revent & POLLNVAL)
116 vncserver->detach();
117}
118
119/**
120 * VncServer
121 */
122VncServer::VncServer(const Params *p)
123 : VncInput(p), listenEvent(NULL), dataEvent(NULL), number(p->number),
124 dataFd(-1), sendUpdate(false),
125 supportsRawEnc(false), supportsResizeEnc(false)
126{
127 if (p->port)
128 listen(p->port);
129
130 curState = WaitForProtocolVersion;
131
132 // We currently only support one pixel format. Extract the pixel
133 // representation from our PixelConverter instance and keep it
134 // around for telling the client and making sure it cooperates
135 pixelFormat.bpp = 8 * pixelConverter.length;
136 pixelFormat.depth = pixelConverter.depth;
137 pixelFormat.bigendian = pixelConverter.byte_order == BigEndianByteOrder;
138 pixelFormat.truecolor = 1;
139 pixelFormat.redmax = pixelConverter.ch_r.mask;
140 pixelFormat.greenmax = pixelConverter.ch_g.mask;
141 pixelFormat.bluemax = pixelConverter.ch_b.mask;
142 pixelFormat.redshift = pixelConverter.ch_r.offset;
143 pixelFormat.greenshift = pixelConverter.ch_g.offset;
144 pixelFormat.blueshift = pixelConverter.ch_b.offset;
145
146 DPRINTF(VNC, "Vnc server created at port %d\n", p->port);
147}
148
149VncServer::~VncServer()
150{
151 if (dataFd != -1)
152 ::close(dataFd);
153
154 if (listenEvent)
155 delete listenEvent;
156
157 if (dataEvent)
158 delete dataEvent;
159}
160
161
162//socket creation and vnc client attach
163void
164VncServer::listen(int port)
165{
166 if (ListenSocket::allDisabled()) {
167 warn_once("Sockets disabled, not accepting vnc client connections");
168 return;
169 }
170
171 while (!listener.listen(port, true)) {
172 DPRINTF(VNC,
173 "can't bind address vnc server port %d in use PID %d\n",
174 port, getpid());
175 port++;
176 }
177
178 int p1, p2;
179 p2 = name().rfind('.') - 1;
180 p1 = name().rfind('.', p2);
181 ccprintf(cerr, "Listening for %s connection on port %d\n",
182 name().substr(p1 + 1, p2 - p1), port);
183
184 listenEvent = new ListenEvent(this, listener.getfd(), POLLIN);
185 pollQueue.schedule(listenEvent);
186}
187
188// attach a vnc client
189void
190VncServer::accept()
191{
192 // As a consequence of being called from the PollQueue, we might
193 // have been called from a different thread. Migrate to "our"
194 // thread.
195 EventQueue::ScopedMigration migrate(eventQueue());
196
197 if (!listener.islistening())
198 panic("%s: cannot accept a connection if not listening!", name());
199
200 int fd = listener.accept(true);
201 fatal_if(fd < 0, "%s: failed to accept VNC connection!", name());
202
203 if (dataFd != -1) {
204 char message[] = "vnc server already attached!\n";
205 atomic_write(fd, message, sizeof(message));
206 ::close(fd);
207 return;
208 }
209
210 dataFd = fd;
211
212 // Send our version number to the client
213 write((uint8_t*)vncVersion(), strlen(vncVersion()));
214
215 // read the client response
216 dataEvent = new DataEvent(this, dataFd, POLLIN);
217 pollQueue.schedule(dataEvent);
218
219 inform("VNC client attached\n");
220}
221
222// data called by data event
223void
224VncServer::data()
225{
226 // We have new data, see if we can handle it
227 size_t len;
228 DPRINTF(VNC, "Vnc client message recieved\n");
229
230 switch (curState) {
231 case WaitForProtocolVersion:
232 checkProtocolVersion();
233 break;
234 case WaitForSecurityResponse:
235 checkSecurity();
236 break;
237 case WaitForClientInit:
238 // Don't care about shared, just need to read it out of the socket
239 uint8_t shared;
240 len = read(&shared);
241 assert(len == 1);
242
243 // Send our idea of the frame buffer
244 sendServerInit();
245
246 break;
247 case NormalPhase:
248 uint8_t message_type;
249 len = read(&message_type);
250 if (!len) {
251 detach();
252 return;
253 }
254 assert(len == 1);
255
256 switch (message_type) {
257 case ClientSetPixelFormat:
258 setPixelFormat();
259 break;
260 case ClientSetEncodings:
261 setEncodings();
262 break;
263 case ClientFrameBufferUpdate:
264 requestFbUpdate();
265 break;
266 case ClientKeyEvent:
267 recvKeyboardInput();
268 break;
269 case ClientPointerEvent:
270 recvPointerInput();
271 break;
272 case ClientCutText:
273 recvCutText();
274 break;
275 default:
276 panic("Unimplemented message type recv from client: %d\n",
277 message_type);
278 break;
279 }
280 break;
281 default:
282 panic("Unknown vnc server state\n");
283 }
284}
285
286
287// read from socket
288size_t
289VncServer::read(uint8_t *buf, size_t len)
290{
291 if (dataFd < 0)
292 panic("vnc not properly attached.\n");
293
294 size_t ret;
295 do {
296 ret = ::read(dataFd, buf, len);
297 } while (ret == -1 && errno == EINTR);
298
299
300 if (ret <= 0){
301 DPRINTF(VNC, "Read failed.\n");
302 detach();
303 return 0;
304 }
305
306 return ret;
307}
308
309size_t
310VncServer::read1(uint8_t *buf, size_t len)
311{
312 size_t read_len M5_VAR_USED;
313 read_len = read(buf + 1, len - 1);
314 assert(read_len == len - 1);
315 return read_len;
316}
317
318
319template<typename T>
320size_t
321VncServer::read(T* val)
322{
323 return read((uint8_t*)val, sizeof(T));
324}
325
326// write to socket
327size_t
328VncServer::write(const uint8_t *buf, size_t len)
329{
330 if (dataFd < 0)
331 panic("Vnc client not properly attached.\n");
332
333 ssize_t ret;
334 ret = atomic_write(dataFd, buf, len);
335
336 if (ret < len)
337 detach();
338
339 return ret;
340}
341
342template<typename T>
343size_t
344VncServer::write(T* val)
345{
346 return write((uint8_t*)val, sizeof(T));
347}
348
349size_t
350VncServer::write(const char* str)
351{
352 return write((uint8_t*)str, strlen(str));
353}
354
355// detach a vnc client
356void
357VncServer::detach()
358{
359 if (dataFd != -1) {
360 ::close(dataFd);
361 dataFd = -1;
362 }
363
364 if (!dataEvent || !dataEvent->queued())
365 return;
366
367 pollQueue.remove(dataEvent);
368 delete dataEvent;
369 dataEvent = NULL;
370 curState = WaitForProtocolVersion;
371
372 inform("VNC client detached\n");
373 DPRINTF(VNC, "detach vnc client %d\n", number);
374}
375
376void
377VncServer::sendError(const char* error_msg)
378{
379 uint32_t len = strlen(error_msg);
380 write(&len);
381 write(error_msg);
382}
383
384void
385VncServer::checkProtocolVersion()
386{
387 assert(curState == WaitForProtocolVersion);
388
389 size_t len M5_VAR_USED;
390 char version_string[13];
391
392 // Null terminate the message so it's easier to work with
393 version_string[12] = 0;
394
395 len = read((uint8_t*)version_string, 12);
396 assert(len == 12);
397
398 uint32_t major, minor;
399
400 // Figure out the major/minor numbers
401 if (sscanf(version_string, "RFB %03d.%03d\n", &major, &minor) != 2) {
402 warn(" Malformed protocol version %s\n", version_string);
403 sendError("Malformed protocol version\n");
404 detach();
405 }
406
407 DPRINTF(VNC, "Client request protocol version %d.%d\n", major, minor);
408
409 // If it's not 3.X we don't support it
410 if (major != 3 || minor < 2) {
411 warn("Unsupported VNC client version... disconnecting\n");
412 uint8_t err = AuthInvalid;
413 write(&err);
414 detach();
415 }
416 // Auth is different based on version number
417 if (minor < 7) {
418 uint32_t sec_type = htobe((uint32_t)AuthNone);
419 write(&sec_type);
420 } else {
421 uint8_t sec_cnt = 1;
422 uint8_t sec_type = htobe((uint8_t)AuthNone);
423 write(&sec_cnt);
424 write(&sec_type);
425 }
426
427 // Wait for client to respond
428 curState = WaitForSecurityResponse;
429}
430
431void
432VncServer::checkSecurity()
433{
434 assert(curState == WaitForSecurityResponse);
435
436 uint8_t security_type;
437 size_t len M5_VAR_USED = read(&security_type);
438
439 assert(len == 1);
440
441 if (security_type != AuthNone) {
442 warn("Unknown VNC security type\n");
443 sendError("Unknown security type\n");
444 }
445
446 DPRINTF(VNC, "Sending security auth OK\n");
447
448 uint32_t success = htobe(VncOK);
449 write(&success);
450 curState = WaitForClientInit;
451}
452
453void
454VncServer::sendServerInit()
455{
456 ServerInitMsg msg;
457
458 DPRINTF(VNC, "Sending server init message to client\n");
459
460 msg.fbWidth = htobe(videoWidth());
461 msg.fbHeight = htobe(videoHeight());
462
463 msg.px.bpp = htobe(pixelFormat.bpp);
464 msg.px.depth = htobe(pixelFormat.depth);
465 msg.px.bigendian = htobe(pixelFormat.bigendian);
466 msg.px.truecolor = htobe(pixelFormat.truecolor);
467 msg.px.redmax = htobe(pixelFormat.redmax);
468 msg.px.greenmax = htobe(pixelFormat.greenmax);
469 msg.px.bluemax = htobe(pixelFormat.bluemax);
470 msg.px.redshift = htobe(pixelFormat.redshift);
471 msg.px.greenshift = htobe(pixelFormat.greenshift);
472 msg.px.blueshift = htobe(pixelFormat.blueshift);
473 memset(msg.px.padding, 0, 3);
474 msg.namelen = 2;
475 msg.namelen = htobe(msg.namelen);
476 memcpy(msg.name, "M5", 2);
477
478 write(&msg);
479 curState = NormalPhase;
480}
481
482void
483VncServer::setPixelFormat()
484{
485 DPRINTF(VNC, "Received pixel format from client message\n");
486
487 PixelFormatMessage pfm;
488 read1((uint8_t*)&pfm, sizeof(PixelFormatMessage));
489
490 DPRINTF(VNC, " -- bpp = %d; depth = %d; be = %d\n", pfm.px.bpp,
491 pfm.px.depth, pfm.px.bigendian);
492 DPRINTF(VNC, " -- true color = %d red,green,blue max = %d,%d,%d\n",
493 pfm.px.truecolor, betoh(pfm.px.redmax), betoh(pfm.px.greenmax),
494 betoh(pfm.px.bluemax));
495 DPRINTF(VNC, " -- red,green,blue shift = %d,%d,%d\n", pfm.px.redshift,
496 pfm.px.greenshift, pfm.px.blueshift);
497
498 if (betoh(pfm.px.bpp) != pixelFormat.bpp ||
499 betoh(pfm.px.depth) != pixelFormat.depth ||
500 betoh(pfm.px.bigendian) != pixelFormat.bigendian ||
501 betoh(pfm.px.truecolor) != pixelFormat.truecolor ||
502 betoh(pfm.px.redmax) != pixelFormat.redmax ||
503 betoh(pfm.px.greenmax) != pixelFormat.greenmax ||
504 betoh(pfm.px.bluemax) != pixelFormat.bluemax ||
505 betoh(pfm.px.redshift) != pixelFormat.redshift ||
506 betoh(pfm.px.greenshift) != pixelFormat.greenshift ||
507 betoh(pfm.px.blueshift) != pixelFormat.blueshift)
508 fatal("VNC client doesn't support true color raw encoding\n");
509}
510
511void
512VncServer::setEncodings()
513{
514 DPRINTF(VNC, "Received supported encodings from client\n");
515
516 PixelEncodingsMessage pem;
517 read1((uint8_t*)&pem, sizeof(PixelEncodingsMessage));
518
519 pem.num_encodings = betoh(pem.num_encodings);
520
521 DPRINTF(VNC, " -- %d encoding present\n", pem.num_encodings);
522 supportsRawEnc = supportsResizeEnc = false;
523
524 for (int x = 0; x < pem.num_encodings; x++) {
525 int32_t encoding;
526 size_t len M5_VAR_USED;
527 len = read(&encoding);
528 assert(len == sizeof(encoding));
529 DPRINTF(VNC, " -- supports %d\n", betoh(encoding));
530
531 switch (betoh(encoding)) {
532 case EncodingRaw:
533 supportsRawEnc = true;
534 break;
535 case EncodingDesktopSize:
536 supportsResizeEnc = true;
537 break;
538 }
539 }
540
541 if (!supportsRawEnc)
542 fatal("VNC clients must always support raw encoding\n");
543}
544
545void
546VncServer::requestFbUpdate()
547{
548 DPRINTF(VNC, "Received frame buffer update request from client\n");
549
550 FrameBufferUpdateReq fbr;
551 read1((uint8_t*)&fbr, sizeof(FrameBufferUpdateReq));
552
553 fbr.x = betoh(fbr.x);
554 fbr.y = betoh(fbr.y);
555 fbr.width = betoh(fbr.width);
556 fbr.height = betoh(fbr.height);
557
558 DPRINTF(VNC, " -- x = %d y = %d w = %d h = %d\n", fbr.x, fbr.y, fbr.width,
559 fbr.height);
560
561 sendFrameBufferUpdate();
562}
563
564void
565VncServer::recvKeyboardInput()
566{
567 DPRINTF(VNC, "Received keyboard input from client\n");
568 KeyEventMessage kem;
569 read1((uint8_t*)&kem, sizeof(KeyEventMessage));
570
571 kem.key = betoh(kem.key);
572 DPRINTF(VNC, " -- received key code %d (%s)\n", kem.key, kem.down_flag ?
573 "down" : "up");
574
575 if (keyboard)
576 keyboard->keyPress(kem.key, kem.down_flag);
577}
578
579void
580VncServer::recvPointerInput()
581{
582 DPRINTF(VNC, "Received pointer input from client\n");
583 PointerEventMessage pem;
584
585 read1((uint8_t*)&pem, sizeof(PointerEventMessage));;
586
587 pem.x = betoh(pem.x);
588 pem.y = betoh(pem.y);
589 DPRINTF(VNC, " -- pointer at x = %d y = %d buttons = %#x\n", pem.x, pem.y,
590 pem.button_mask);
591
592 if (mouse)
593 mouse->mouseAt(pem.x, pem.y, pem.button_mask);
594}
595
596void
597VncServer::recvCutText()
598{
599 DPRINTF(VNC, "Received client copy buffer message\n");
600
601 ClientCutTextMessage cct;
602 read1((uint8_t*)&cct, sizeof(ClientCutTextMessage));
603
604 char str[1025];
605 size_t data_len = betoh(cct.length);
606 DPRINTF(VNC, "String length %d\n", data_len);
607 while (data_len > 0) {
608 size_t len;
609 size_t bytes_to_read = data_len > 1024 ? 1024 : data_len;
610 len = read((uint8_t*)&str, bytes_to_read);
611 str[bytes_to_read] = 0;
612 assert(len >= data_len);
613 data_len -= len;
614 DPRINTF(VNC, "Buffer: %s\n", str);
615 }
616
617}
618
619
620void
621VncServer::sendFrameBufferUpdate()
622{
623
624 if (dataFd <= 0 || curState != NormalPhase || !sendUpdate) {
625 DPRINTF(VNC, "NOT sending framebuffer update\n");
626 return;
627 }
628
629 // The client will request data constantly, unless we throttle it
630 sendUpdate = false;
631
632 DPRINTF(VNC, "Sending framebuffer update\n");
633
634 FrameBufferUpdate fbu;
635 FrameBufferRect fbr;
636
637 fbu.type = ServerFrameBufferUpdate;
638 fbu.num_rects = 1;
639 fbr.x = 0;
640 fbr.y = 0;
641 fbr.width = videoWidth();
642 fbr.height = videoHeight();
643 fbr.encoding = EncodingRaw;
644
645 // fix up endian
646 fbu.num_rects = htobe(fbu.num_rects);
647 fbr.x = htobe(fbr.x);
648 fbr.y = htobe(fbr.y);
649 fbr.width = htobe(fbr.width);
650 fbr.height = htobe(fbr.height);
651 fbr.encoding = htobe(fbr.encoding);
652
653 // send headers to client
654 write(&fbu);
655 write(&fbr);
656
657 assert(fb);
658
659 std::vector<uint8_t> line_buffer(pixelConverter.length * fb->width());
660 for (int y = 0; y < fb->height(); ++y) {
661 // Convert and send a line at a time
662 uint8_t *raw_pixel(line_buffer.data());
663 for (unsigned x = 0; x < fb->width(); ++x) {
664 pixelConverter.fromPixel(raw_pixel, fb->pixel(x, y));
665 raw_pixel += pixelConverter.length;
666 }
667
668 write(line_buffer.data(), line_buffer.size());
669 }
670}
671
672void
673VncServer::sendFrameBufferResized()
674{
675 assert(fb && dataFd > 0 && curState == NormalPhase);
676 DPRINTF(VNC, "Sending framebuffer resize\n");
677
678 FrameBufferUpdate fbu;
679 FrameBufferRect fbr;
680
681 fbu.type = ServerFrameBufferUpdate;
682 fbu.num_rects = 1;
683 fbr.x = 0;
684 fbr.y = 0;
685 fbr.width = videoWidth();
686 fbr.height = videoHeight();
687 fbr.encoding = EncodingDesktopSize;
688
689 // fix up endian
690 fbu.num_rects = htobe(fbu.num_rects);
691 fbr.x = htobe(fbr.x);
692 fbr.y = htobe(fbr.y);
693 fbr.width = htobe(fbr.width);
694 fbr.height = htobe(fbr.height);
695 fbr.encoding = htobe(fbr.encoding);
696
697 // send headers to client
698 write(&fbu);
699 write(&fbr);
700
701 // No actual data is sent in this message
702}
703
704void
705VncServer::setDirty()
706{
707 VncInput::setDirty();
708
709 sendUpdate = true;
710 sendFrameBufferUpdate();
711}
712
713void
714VncServer::frameBufferResized()
715{
716 if (dataFd > 0 && curState == NormalPhase) {
717 if (supportsResizeEnc)
718 sendFrameBufferResized();
719 else
720 // The frame buffer changed size and we can't update the client
721 detach();
722 }
723}
724
725// create the VNC server object
726VncServer *
727VncServerParams::create()
728{
729 return new VncServer(this);
730}
731