Statistics
| Branch: | Revision:

root / vnc.c @ 5fb6c7a8

History | View | Annotate | Download (54.9 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
8
 * Permission is hereby granted, free of charge, to any person obtaining a copy
9
 * of this software and associated documentation files (the "Software"), to deal
10
 * in the Software without restriction, including without limitation the rights
11
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12
 * copies of the Software, and to permit persons to whom the Software is
13
 * furnished to do so, subject to the following conditions:
14
 *
15
 * The above copyright notice and this permission notice shall be included in
16
 * all copies or substantial portions of the Software.
17
 *
18
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24
 * THE SOFTWARE.
25
 */
26

    
27
#include "vnc.h"
28
#include "sysemu.h"
29
#include "qemu_socket.h"
30
#include "qemu-timer.h"
31

    
32
#define VNC_REFRESH_INTERVAL (1000 / 30)
33

    
34
#include "vnc_keysym.h"
35
#include "d3des.h"
36

    
37
#define count_bits(c, v) { \
38
    for (c = 0; v; v >>= 1) \
39
    { \
40
        c += v & 1; \
41
    } \
42
}
43

    
44

    
45
static VncDisplay *vnc_display; /* needed for info vnc */
46
static DisplayChangeListener *dcl;
47

    
48
static char *addr_to_string(const char *format,
49
                            struct sockaddr_storage *sa,
50
                            socklen_t salen) {
51
    char *addr;
52
    char host[NI_MAXHOST];
53
    char serv[NI_MAXSERV];
54
    int err;
55

    
56
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
57
                           host, sizeof(host),
58
                           serv, sizeof(serv),
59
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
60
        VNC_DEBUG("Cannot resolve address %d: %s\n",
61
                  err, gai_strerror(err));
62
        return NULL;
63
    }
64

    
65
    if (asprintf(&addr, format, host, serv) < 0)
66
        return NULL;
67

    
68
    return addr;
69
}
70

    
71
static char *vnc_socket_local_addr(const char *format, int fd) {
72
    struct sockaddr_storage sa;
73
    socklen_t salen;
74

    
75
    salen = sizeof(sa);
76
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
77
        return NULL;
78

    
79
    return addr_to_string(format, &sa, salen);
80
}
81

    
82
static char *vnc_socket_remote_addr(const char *format, int fd) {
83
    struct sockaddr_storage sa;
84
    socklen_t salen;
85

    
86
    salen = sizeof(sa);
87
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
88
        return NULL;
89

    
90
    return addr_to_string(format, &sa, salen);
91
}
92

    
93
static const char *vnc_auth_name(VncDisplay *vd) {
94
    switch (vd->auth) {
95
    case VNC_AUTH_INVALID:
96
        return "invalid";
97
    case VNC_AUTH_NONE:
98
        return "none";
99
    case VNC_AUTH_VNC:
100
        return "vnc";
101
    case VNC_AUTH_RA2:
102
        return "ra2";
103
    case VNC_AUTH_RA2NE:
104
        return "ra2ne";
105
    case VNC_AUTH_TIGHT:
106
        return "tight";
107
    case VNC_AUTH_ULTRA:
108
        return "ultra";
109
    case VNC_AUTH_TLS:
110
        return "tls";
111
    case VNC_AUTH_VENCRYPT:
112
#ifdef CONFIG_VNC_TLS
113
        switch (vd->subauth) {
114
        case VNC_AUTH_VENCRYPT_PLAIN:
115
            return "vencrypt+plain";
116
        case VNC_AUTH_VENCRYPT_TLSNONE:
117
            return "vencrypt+tls+none";
118
        case VNC_AUTH_VENCRYPT_TLSVNC:
119
            return "vencrypt+tls+vnc";
120
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
121
            return "vencrypt+tls+plain";
122
        case VNC_AUTH_VENCRYPT_X509NONE:
123
            return "vencrypt+x509+none";
124
        case VNC_AUTH_VENCRYPT_X509VNC:
125
            return "vencrypt+x509+vnc";
126
        case VNC_AUTH_VENCRYPT_X509PLAIN:
127
            return "vencrypt+x509+plain";
128
        default:
129
            return "vencrypt";
130
        }
131
#else
132
        return "vencrypt";
133
#endif
134
    }
135
    return "unknown";
136
}
137

    
138
#define VNC_SOCKET_FORMAT_PRETTY "local %s:%s"
139

    
140
static void do_info_vnc_client(Monitor *mon, VncState *client)
141
{
142
    char *clientAddr =
143
        vnc_socket_remote_addr("     address: %s:%s\n",
144
                               client->csock);
145
    if (!clientAddr)
146
        return;
147

    
148
    monitor_printf(mon, "Client:\n");
149
    monitor_printf(mon, "%s", clientAddr);
150
    free(clientAddr);
151
}
152

    
153
void do_info_vnc(Monitor *mon)
154
{
155
    if (vnc_display == NULL || vnc_display->display == NULL) {
156
        monitor_printf(mon, "Server: disabled\n");
157
    } else {
158
        char *serverAddr = vnc_socket_local_addr("     address: %s:%s\n",
159
                                                 vnc_display->lsock);
160

    
161
        if (!serverAddr)
162
            return;
163

    
164
        monitor_printf(mon, "Server:\n");
165
        monitor_printf(mon, "%s", serverAddr);
166
        free(serverAddr);
167
        monitor_printf(mon, "        auth: %s\n", vnc_auth_name(vnc_display));
168

    
169
        if (vnc_display->clients) {
170
            VncState *client = vnc_display->clients;
171
            while (client) {
172
                do_info_vnc_client(mon, client);
173
                client = client->next;
174
            }
175
        } else {
176
            monitor_printf(mon, "Client: none\n");
177
        }
178
    }
179
}
180

    
181
static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
182
    return (vs->features & (1 << feature));
183
}
184

    
185
/* TODO
186
   1) Get the queue working for IO.
187
   2) there is some weirdness when using the -S option (the screen is grey
188
      and not totally invalidated
189
   3) resolutions > 1024
190
*/
191

    
192
static void vnc_update_client(void *opaque);
193

    
194
static void vnc_colordepth(VncState *vs);
195

    
196
static inline void vnc_set_bit(uint32_t *d, int k)
197
{
198
    d[k >> 5] |= 1 << (k & 0x1f);
199
}
200

    
201
static inline void vnc_clear_bit(uint32_t *d, int k)
202
{
203
    d[k >> 5] &= ~(1 << (k & 0x1f));
204
}
205

    
206
static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
207
{
208
    int j;
209

    
210
    j = 0;
211
    while (n >= 32) {
212
        d[j++] = -1;
213
        n -= 32;
214
    }
215
    if (n > 0)
216
        d[j++] = (1 << n) - 1;
217
    while (j < nb_words)
218
        d[j++] = 0;
219
}
220

    
221
static inline int vnc_get_bit(const uint32_t *d, int k)
222
{
223
    return (d[k >> 5] >> (k & 0x1f)) & 1;
224
}
225

    
226
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
227
                               int nb_words)
228
{
229
    int i;
230
    for(i = 0; i < nb_words; i++) {
231
        if ((d1[i] & d2[i]) != 0)
232
            return 1;
233
    }
234
    return 0;
235
}
236

    
237
static void vnc_update(VncState *vs, int x, int y, int w, int h)
238
{
239
    int i;
240

    
241
    h += y;
242

    
243
    /* round x down to ensure the loop only spans one 16-pixel block per,
244
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
245
       two 16-pixel blocks but we only mark the first as dirty
246
    */
247
    w += (x % 16);
248
    x -= (x % 16);
249

    
250
    x = MIN(x, vs->serverds.width);
251
    y = MIN(y, vs->serverds.height);
252
    w = MIN(x + w, vs->serverds.width) - x;
253
    h = MIN(h, vs->serverds.height);
254

    
255
    for (; y < h; y++)
256
        for (i = 0; i < w; i += 16)
257
            vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
258
}
259

    
260
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
261
{
262
    VncDisplay *vd = ds->opaque;
263
    VncState *vs = vd->clients;
264
    while (vs != NULL) {
265
        vnc_update(vs, x, y, w, h);
266
        vs = vs->next;
267
    }
268
}
269

    
270
static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
271
                                   int32_t encoding)
272
{
273
    vnc_write_u16(vs, x);
274
    vnc_write_u16(vs, y);
275
    vnc_write_u16(vs, w);
276
    vnc_write_u16(vs, h);
277

    
278
    vnc_write_s32(vs, encoding);
279
}
280

    
281
static void buffer_reserve(Buffer *buffer, size_t len)
282
{
283
    if ((buffer->capacity - buffer->offset) < len) {
284
        buffer->capacity += (len + 1024);
285
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
286
        if (buffer->buffer == NULL) {
287
            fprintf(stderr, "vnc: out of memory\n");
288
            exit(1);
289
        }
290
    }
291
}
292

    
293
static int buffer_empty(Buffer *buffer)
294
{
295
    return buffer->offset == 0;
296
}
297

    
298
static uint8_t *buffer_end(Buffer *buffer)
299
{
300
    return buffer->buffer + buffer->offset;
301
}
302

    
303
static void buffer_reset(Buffer *buffer)
304
{
305
        buffer->offset = 0;
306
}
307

    
308
static void buffer_append(Buffer *buffer, const void *data, size_t len)
309
{
310
    memcpy(buffer->buffer + buffer->offset, data, len);
311
    buffer->offset += len;
312
}
313

    
314
static void vnc_resize(VncState *vs)
315
{
316
    DisplayState *ds = vs->ds;
317

    
318
    int size_changed;
319

    
320
    vs->old_data = qemu_realloc(vs->old_data, ds_get_linesize(ds) * ds_get_height(ds));
321

    
322
    if (vs->old_data == NULL) {
323
        fprintf(stderr, "vnc: memory allocation failed\n");
324
        exit(1);
325
    }
326

    
327
    if (ds_get_bytes_per_pixel(ds) != vs->serverds.pf.bytes_per_pixel)
328
        console_color_init(ds);
329
    vnc_colordepth(vs);
330
    size_changed = ds_get_width(ds) != vs->serverds.width ||
331
                   ds_get_height(ds) != vs->serverds.height;
332
    vs->serverds = *(ds->surface);
333
    if (size_changed) {
334
        if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
335
            vnc_write_u8(vs, 0);  /* msg id */
336
            vnc_write_u8(vs, 0);
337
            vnc_write_u16(vs, 1); /* number of rects */
338
            vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
339
                                   VNC_ENCODING_DESKTOPRESIZE);
340
            vnc_flush(vs);
341
        }
342
    }
343

    
344
    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
345
    memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
346
}
347

    
348
static void vnc_dpy_resize(DisplayState *ds)
349
{
350
    VncDisplay *vd = ds->opaque;
351
    VncState *vs = vd->clients;
352
    while (vs != NULL) {
353
        vnc_resize(vs);
354
        vs = vs->next;
355
    }
356
}
357

    
358
/* fastest code */
359
static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
360
{
361
    vnc_write(vs, pixels, size);
362
}
363

    
364
/* slowest but generic code. */
365
static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
366
{
367
    uint8_t r, g, b;
368

    
369
    r = ((((v & vs->serverds.pf.rmask) >> vs->serverds.pf.rshift) << vs->clientds.pf.rbits) >>
370
        vs->serverds.pf.rbits);
371
    g = ((((v & vs->serverds.pf.gmask) >> vs->serverds.pf.gshift) << vs->clientds.pf.gbits) >>
372
        vs->serverds.pf.gbits);
373
    b = ((((v & vs->serverds.pf.bmask) >> vs->serverds.pf.bshift) << vs->clientds.pf.bbits) >>
374
        vs->serverds.pf.bbits);
375
    v = (r << vs->clientds.pf.rshift) |
376
        (g << vs->clientds.pf.gshift) |
377
        (b << vs->clientds.pf.bshift);
378
    switch(vs->clientds.pf.bytes_per_pixel) {
379
    case 1:
380
        buf[0] = v;
381
        break;
382
    case 2:
383
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
384
            buf[0] = v >> 8;
385
            buf[1] = v;
386
        } else {
387
            buf[1] = v >> 8;
388
            buf[0] = v;
389
        }
390
        break;
391
    default:
392
    case 4:
393
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
394
            buf[0] = v >> 24;
395
            buf[1] = v >> 16;
396
            buf[2] = v >> 8;
397
            buf[3] = v;
398
        } else {
399
            buf[3] = v >> 24;
400
            buf[2] = v >> 16;
401
            buf[1] = v >> 8;
402
            buf[0] = v;
403
        }
404
        break;
405
    }
406
}
407

    
408
static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
409
{
410
    uint8_t buf[4];
411

    
412
    if (vs->serverds.pf.bytes_per_pixel == 4) {
413
        uint32_t *pixels = pixels1;
414
        int n, i;
415
        n = size >> 2;
416
        for(i = 0; i < n; i++) {
417
            vnc_convert_pixel(vs, buf, pixels[i]);
418
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
419
        }
420
    } else if (vs->serverds.pf.bytes_per_pixel == 2) {
421
        uint16_t *pixels = pixels1;
422
        int n, i;
423
        n = size >> 1;
424
        for(i = 0; i < n; i++) {
425
            vnc_convert_pixel(vs, buf, pixels[i]);
426
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
427
        }
428
    } else if (vs->serverds.pf.bytes_per_pixel == 1) {
429
        uint8_t *pixels = pixels1;
430
        int n, i;
431
        n = size;
432
        for(i = 0; i < n; i++) {
433
            vnc_convert_pixel(vs, buf, pixels[i]);
434
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
435
        }
436
    } else {
437
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
438
    }
439
}
440

    
441
static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
442
{
443
    int i;
444
    uint8_t *row;
445

    
446
    row = ds_get_data(vs->ds) + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
447
    for (i = 0; i < h; i++) {
448
        vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
449
        row += ds_get_linesize(vs->ds);
450
    }
451
}
452

    
453
static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
454
{
455
    ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
456
    ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
457
}
458

    
459
#define BPP 8
460
#include "vnchextile.h"
461
#undef BPP
462

    
463
#define BPP 16
464
#include "vnchextile.h"
465
#undef BPP
466

    
467
#define BPP 32
468
#include "vnchextile.h"
469
#undef BPP
470

    
471
#define GENERIC
472
#define BPP 8
473
#include "vnchextile.h"
474
#undef BPP
475
#undef GENERIC
476

    
477
#define GENERIC
478
#define BPP 16
479
#include "vnchextile.h"
480
#undef BPP
481
#undef GENERIC
482

    
483
#define GENERIC
484
#define BPP 32
485
#include "vnchextile.h"
486
#undef BPP
487
#undef GENERIC
488

    
489
static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
490
{
491
    int i, j;
492
    int has_fg, has_bg;
493
    uint8_t *last_fg, *last_bg;
494

    
495
    last_fg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
496
    last_bg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
497
    has_fg = has_bg = 0;
498
    for (j = y; j < (y + h); j += 16) {
499
        for (i = x; i < (x + w); i += 16) {
500
            vs->send_hextile_tile(vs, i, j,
501
                                  MIN(16, x + w - i), MIN(16, y + h - j),
502
                                  last_bg, last_fg, &has_bg, &has_fg);
503
        }
504
    }
505
    free(last_fg);
506
    free(last_bg);
507

    
508
}
509

    
510
static void vnc_zlib_init(VncState *vs)
511
{
512
    int i;
513
    for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
514
        vs->zlib_stream[i].opaque = NULL;
515
}
516

    
517
static void vnc_zlib_start(VncState *vs)
518
{
519
    buffer_reset(&vs->zlib);
520

    
521
    // make the output buffer be the zlib buffer, so we can compress it later
522
    vs->zlib_tmp = vs->output;
523
    vs->output = vs->zlib;
524
}
525

    
526
static int vnc_zlib_stop(VncState *vs, int stream_id)
527
{
528
    z_streamp zstream = &vs->zlib_stream[stream_id];
529
    int previous_out;
530

    
531
    // switch back to normal output/zlib buffers
532
    vs->zlib = vs->output;
533
    vs->output = vs->zlib_tmp;
534

    
535
    // compress the zlib buffer
536

    
537
    // initialize the stream
538
    // XXX need one stream per session
539
    if (zstream->opaque != vs) {
540
        int err;
541

    
542
        VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
543
        VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
544
        zstream->zalloc = Z_NULL;
545
        zstream->zfree = Z_NULL;
546

    
547
        err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
548
                           MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
549

    
550
        if (err != Z_OK) {
551
            fprintf(stderr, "VNC: error initializing zlib\n");
552
            return -1;
553
        }
554

    
555
        zstream->opaque = vs;
556
    }
557

    
558
    // XXX what to do if tight_compression changed in between?
559

    
560
    // reserve memory in output buffer
561
    buffer_reserve(&vs->output, vs->zlib.offset + 64);
562

    
563
    // set pointers
564
    zstream->next_in = vs->zlib.buffer;
565
    zstream->avail_in = vs->zlib.offset;
566
    zstream->next_out = vs->output.buffer + vs->output.offset;
567
    zstream->avail_out = vs->output.capacity - vs->output.offset;
568
    zstream->data_type = Z_BINARY;
569
    previous_out = zstream->total_out;
570

    
571
    // start encoding
572
    if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
573
        fprintf(stderr, "VNC: error during zlib compression\n");
574
        return -1;
575
    }
576

    
577
    vs->output.offset = vs->output.capacity - zstream->avail_out;
578
    return zstream->total_out - previous_out;
579
}
580

    
581
static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
582
{
583
    int old_offset, new_offset, bytes_written;
584

    
585
    vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
586

    
587
    // remember where we put in the follow-up size
588
    old_offset = vs->output.offset;
589
    vnc_write_s32(vs, 0);
590

    
591
    // compress the stream
592
    vnc_zlib_start(vs);
593
    send_framebuffer_update_raw(vs, x, y, w, h);
594
    bytes_written = vnc_zlib_stop(vs, 0);
595

    
596
    if (bytes_written == -1)
597
        return;
598

    
599
    // hack in the size
600
    new_offset = vs->output.offset;
601
    vs->output.offset = old_offset;
602
    vnc_write_u32(vs, bytes_written);
603
    vs->output.offset = new_offset;
604
}
605

    
606
static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
607
{
608
    switch(vs->vnc_encoding) {
609
        case VNC_ENCODING_ZLIB:
610
            send_framebuffer_update_zlib(vs, x, y, w, h);
611
            break;
612
        case VNC_ENCODING_HEXTILE:
613
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
614
            send_framebuffer_update_hextile(vs, x, y, w, h);
615
            break;
616
        default:
617
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
618
            send_framebuffer_update_raw(vs, x, y, w, h);
619
            break;
620
    }
621
}
622

    
623
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
624
{
625
    vnc_update_client(vs);
626

    
627
    vnc_write_u8(vs, 0);  /* msg id */
628
    vnc_write_u8(vs, 0);
629
    vnc_write_u16(vs, 1); /* number of rects */
630
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
631
    vnc_write_u16(vs, src_x);
632
    vnc_write_u16(vs, src_y);
633
    vnc_flush(vs);
634
}
635

    
636
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
637
{
638
    VncDisplay *vd = ds->opaque;
639
    VncState *vs = vd->clients;
640
    while (vs != NULL) {
641
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
642
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
643
        else /* TODO */
644
            vnc_update(vs, dst_x, dst_y, w, h);
645
        vs = vs->next;
646
    }
647
}
648

    
649
static int find_dirty_height(VncState *vs, int y, int last_x, int x)
650
{
651
    int h;
652

    
653
    for (h = 1; h < (vs->serverds.height - y); h++) {
654
        int tmp_x;
655
        if (!vnc_get_bit(vs->dirty_row[y + h], last_x))
656
            break;
657
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
658
            vnc_clear_bit(vs->dirty_row[y + h], tmp_x);
659
    }
660

    
661
    return h;
662
}
663

    
664
static void vnc_update_client(void *opaque)
665
{
666
    VncState *vs = opaque;
667
    if (vs->need_update && vs->csock != -1) {
668
        int y;
669
        uint8_t *row;
670
        char *old_row;
671
        uint32_t width_mask[VNC_DIRTY_WORDS];
672
        int n_rectangles;
673
        int saved_offset;
674
        int has_dirty = 0;
675

    
676
        vga_hw_update();
677

    
678
        vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
679

    
680
        /* Walk through the dirty map and eliminate tiles that
681
           really aren't dirty */
682
        row = ds_get_data(vs->ds);
683
        old_row = vs->old_data;
684

    
685
        for (y = 0; y < ds_get_height(vs->ds); y++) {
686
            if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
687
                int x;
688
                uint8_t *ptr;
689
                char *old_ptr;
690

    
691
                ptr = row;
692
                old_ptr = (char*)old_row;
693

    
694
                for (x = 0; x < ds_get_width(vs->ds); x += 16) {
695
                    if (memcmp(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds)) == 0) {
696
                        vnc_clear_bit(vs->dirty_row[y], (x / 16));
697
                    } else {
698
                        has_dirty = 1;
699
                        memcpy(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds));
700
                    }
701

    
702
                    ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
703
                    old_ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
704
                }
705
            }
706

    
707
            row += ds_get_linesize(vs->ds);
708
            old_row += ds_get_linesize(vs->ds);
709
        }
710

    
711
        if (!has_dirty && !vs->audio_cap) {
712
            qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
713
            return;
714
        }
715

    
716
        /* Count rectangles */
717
        n_rectangles = 0;
718
        vnc_write_u8(vs, 0);  /* msg id */
719
        vnc_write_u8(vs, 0);
720
        saved_offset = vs->output.offset;
721
        vnc_write_u16(vs, 0);
722

    
723
        for (y = 0; y < vs->serverds.height; y++) {
724
            int x;
725
            int last_x = -1;
726
            for (x = 0; x < vs->serverds.width / 16; x++) {
727
                if (vnc_get_bit(vs->dirty_row[y], x)) {
728
                    if (last_x == -1) {
729
                        last_x = x;
730
                    }
731
                    vnc_clear_bit(vs->dirty_row[y], x);
732
                } else {
733
                    if (last_x != -1) {
734
                        int h = find_dirty_height(vs, y, last_x, x);
735
                        send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
736
                        n_rectangles++;
737
                    }
738
                    last_x = -1;
739
                }
740
            }
741
            if (last_x != -1) {
742
                int h = find_dirty_height(vs, y, last_x, x);
743
                send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
744
                n_rectangles++;
745
            }
746
        }
747
        vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
748
        vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
749
        vnc_flush(vs);
750

    
751
    }
752

    
753
    if (vs->csock != -1) {
754
        qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
755
    }
756

    
757
}
758

    
759
/* audio */
760
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
761
{
762
    VncState *vs = opaque;
763

    
764
    switch (cmd) {
765
    case AUD_CNOTIFY_DISABLE:
766
        vnc_write_u8(vs, 255);
767
        vnc_write_u8(vs, 1);
768
        vnc_write_u16(vs, 0);
769
        vnc_flush(vs);
770
        break;
771

    
772
    case AUD_CNOTIFY_ENABLE:
773
        vnc_write_u8(vs, 255);
774
        vnc_write_u8(vs, 1);
775
        vnc_write_u16(vs, 1);
776
        vnc_flush(vs);
777
        break;
778
    }
779
}
780

    
781
static void audio_capture_destroy(void *opaque)
782
{
783
}
784

    
785
static void audio_capture(void *opaque, void *buf, int size)
786
{
787
    VncState *vs = opaque;
788

    
789
    vnc_write_u8(vs, 255);
790
    vnc_write_u8(vs, 1);
791
    vnc_write_u16(vs, 2);
792
    vnc_write_u32(vs, size);
793
    vnc_write(vs, buf, size);
794
    vnc_flush(vs);
795
}
796

    
797
static void audio_add(VncState *vs)
798
{
799
    Monitor *mon = cur_mon;
800
    struct audio_capture_ops ops;
801

    
802
    if (vs->audio_cap) {
803
        monitor_printf(mon, "audio already running\n");
804
        return;
805
    }
806

    
807
    ops.notify = audio_capture_notify;
808
    ops.destroy = audio_capture_destroy;
809
    ops.capture = audio_capture;
810

    
811
    vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
812
    if (!vs->audio_cap) {
813
        monitor_printf(mon, "Failed to add audio capture\n");
814
    }
815
}
816

    
817
static void audio_del(VncState *vs)
818
{
819
    if (vs->audio_cap) {
820
        AUD_del_capture(vs->audio_cap, vs);
821
        vs->audio_cap = NULL;
822
    }
823
}
824

    
825
static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
826
{
827
    if (ret == 0 || ret == -1) {
828
        if (ret == -1) {
829
            switch (last_errno) {
830
                case EINTR:
831
                case EAGAIN:
832
#ifdef _WIN32
833
                case WSAEWOULDBLOCK:
834
#endif
835
                    return 0;
836
                default:
837
                    break;
838
            }
839
        }
840

    
841
        VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
842
        qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
843
        closesocket(vs->csock);
844
        qemu_del_timer(vs->timer);
845
        qemu_free_timer(vs->timer);
846
        if (vs->input.buffer) qemu_free(vs->input.buffer);
847
        if (vs->output.buffer) qemu_free(vs->output.buffer);
848
#ifdef CONFIG_VNC_TLS
849
        vnc_tls_client_cleanup(vs);
850
#endif /* CONFIG_VNC_TLS */
851
        audio_del(vs);
852

    
853
        VncState *p, *parent = NULL;
854
        for (p = vs->vd->clients; p != NULL; p = p->next) {
855
            if (p == vs) {
856
                if (parent)
857
                    parent->next = p->next;
858
                else
859
                    vs->vd->clients = p->next;
860
                break;
861
            }
862
            parent = p;
863
        }
864
        if (!vs->vd->clients)
865
            dcl->idle = 1;
866

    
867
        qemu_free(vs->old_data);
868
        qemu_free(vs);
869
  
870
        return 0;
871
    }
872
    return ret;
873
}
874

    
875

    
876
void vnc_client_error(VncState *vs)
877
{
878
    vnc_client_io_error(vs, -1, EINVAL);
879
}
880

    
881
void vnc_client_write(void *opaque)
882
{
883
    long ret;
884
    VncState *vs = opaque;
885

    
886
#ifdef CONFIG_VNC_TLS
887
    if (vs->tls.session) {
888
        ret = gnutls_write(vs->tls.session, vs->output.buffer, vs->output.offset);
889
        if (ret < 0) {
890
            if (ret == GNUTLS_E_AGAIN)
891
                errno = EAGAIN;
892
            else
893
                errno = EIO;
894
            ret = -1;
895
        }
896
    } else
897
#endif /* CONFIG_VNC_TLS */
898
        ret = send(vs->csock, vs->output.buffer, vs->output.offset, 0);
899
    ret = vnc_client_io_error(vs, ret, socket_error());
900
    if (!ret)
901
        return;
902

    
903
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
904
    vs->output.offset -= ret;
905

    
906
    if (vs->output.offset == 0) {
907
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
908
    }
909
}
910

    
911
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
912
{
913
    vs->read_handler = func;
914
    vs->read_handler_expect = expecting;
915
}
916

    
917
void vnc_client_read(void *opaque)
918
{
919
    VncState *vs = opaque;
920
    long ret;
921

    
922
    buffer_reserve(&vs->input, 4096);
923

    
924
#ifdef CONFIG_VNC_TLS
925
    if (vs->tls.session) {
926
        ret = gnutls_read(vs->tls.session, buffer_end(&vs->input), 4096);
927
        if (ret < 0) {
928
            if (ret == GNUTLS_E_AGAIN)
929
                errno = EAGAIN;
930
            else
931
                errno = EIO;
932
            ret = -1;
933
        }
934
    } else
935
#endif /* CONFIG_VNC_TLS */
936
        ret = recv(vs->csock, buffer_end(&vs->input), 4096, 0);
937
    ret = vnc_client_io_error(vs, ret, socket_error());
938
    if (!ret)
939
        return;
940

    
941
    vs->input.offset += ret;
942

    
943
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
944
        size_t len = vs->read_handler_expect;
945
        int ret;
946

    
947
        ret = vs->read_handler(vs, vs->input.buffer, len);
948
        if (vs->csock == -1)
949
            return;
950

    
951
        if (!ret) {
952
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
953
            vs->input.offset -= len;
954
        } else {
955
            vs->read_handler_expect = ret;
956
        }
957
    }
958
}
959

    
960
void vnc_write(VncState *vs, const void *data, size_t len)
961
{
962
    buffer_reserve(&vs->output, len);
963

    
964
    if (buffer_empty(&vs->output)) {
965
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
966
    }
967

    
968
    buffer_append(&vs->output, data, len);
969
}
970

    
971
void vnc_write_s32(VncState *vs, int32_t value)
972
{
973
    vnc_write_u32(vs, *(uint32_t *)&value);
974
}
975

    
976
void vnc_write_u32(VncState *vs, uint32_t value)
977
{
978
    uint8_t buf[4];
979

    
980
    buf[0] = (value >> 24) & 0xFF;
981
    buf[1] = (value >> 16) & 0xFF;
982
    buf[2] = (value >>  8) & 0xFF;
983
    buf[3] = value & 0xFF;
984

    
985
    vnc_write(vs, buf, 4);
986
}
987

    
988
void vnc_write_u16(VncState *vs, uint16_t value)
989
{
990
    uint8_t buf[2];
991

    
992
    buf[0] = (value >> 8) & 0xFF;
993
    buf[1] = value & 0xFF;
994

    
995
    vnc_write(vs, buf, 2);
996
}
997

    
998
void vnc_write_u8(VncState *vs, uint8_t value)
999
{
1000
    vnc_write(vs, (char *)&value, 1);
1001
}
1002

    
1003
void vnc_flush(VncState *vs)
1004
{
1005
    if (vs->output.offset)
1006
        vnc_client_write(vs);
1007
}
1008

    
1009
uint8_t read_u8(uint8_t *data, size_t offset)
1010
{
1011
    return data[offset];
1012
}
1013

    
1014
uint16_t read_u16(uint8_t *data, size_t offset)
1015
{
1016
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1017
}
1018

    
1019
int32_t read_s32(uint8_t *data, size_t offset)
1020
{
1021
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1022
                     (data[offset + 2] << 8) | data[offset + 3]);
1023
}
1024

    
1025
uint32_t read_u32(uint8_t *data, size_t offset)
1026
{
1027
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1028
            (data[offset + 2] << 8) | data[offset + 3]);
1029
}
1030

    
1031
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1032
{
1033
}
1034

    
1035
static void check_pointer_type_change(VncState *vs, int absolute)
1036
{
1037
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1038
        vnc_write_u8(vs, 0);
1039
        vnc_write_u8(vs, 0);
1040
        vnc_write_u16(vs, 1);
1041
        vnc_framebuffer_update(vs, absolute, 0,
1042
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1043
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
1044
        vnc_flush(vs);
1045
    }
1046
    vs->absolute = absolute;
1047
}
1048

    
1049
static void pointer_event(VncState *vs, int button_mask, int x, int y)
1050
{
1051
    int buttons = 0;
1052
    int dz = 0;
1053

    
1054
    if (button_mask & 0x01)
1055
        buttons |= MOUSE_EVENT_LBUTTON;
1056
    if (button_mask & 0x02)
1057
        buttons |= MOUSE_EVENT_MBUTTON;
1058
    if (button_mask & 0x04)
1059
        buttons |= MOUSE_EVENT_RBUTTON;
1060
    if (button_mask & 0x08)
1061
        dz = -1;
1062
    if (button_mask & 0x10)
1063
        dz = 1;
1064

    
1065
    if (vs->absolute) {
1066
        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1067
                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1068
                        dz, buttons);
1069
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1070
        x -= 0x7FFF;
1071
        y -= 0x7FFF;
1072

    
1073
        kbd_mouse_event(x, y, dz, buttons);
1074
    } else {
1075
        if (vs->last_x != -1)
1076
            kbd_mouse_event(x - vs->last_x,
1077
                            y - vs->last_y,
1078
                            dz, buttons);
1079
        vs->last_x = x;
1080
        vs->last_y = y;
1081
    }
1082

    
1083
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1084
}
1085

    
1086
static void reset_keys(VncState *vs)
1087
{
1088
    int i;
1089
    for(i = 0; i < 256; i++) {
1090
        if (vs->modifiers_state[i]) {
1091
            if (i & 0x80)
1092
                kbd_put_keycode(0xe0);
1093
            kbd_put_keycode(i | 0x80);
1094
            vs->modifiers_state[i] = 0;
1095
        }
1096
    }
1097
}
1098

    
1099
static void press_key(VncState *vs, int keysym)
1100
{
1101
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1102
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1103
}
1104

    
1105
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1106
{
1107
    /* QEMU console switch */
1108
    switch(keycode) {
1109
    case 0x2a:                          /* Left Shift */
1110
    case 0x36:                          /* Right Shift */
1111
    case 0x1d:                          /* Left CTRL */
1112
    case 0x9d:                          /* Right CTRL */
1113
    case 0x38:                          /* Left ALT */
1114
    case 0xb8:                          /* Right ALT */
1115
        if (down)
1116
            vs->modifiers_state[keycode] = 1;
1117
        else
1118
            vs->modifiers_state[keycode] = 0;
1119
        break;
1120
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1121
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1122
            /* Reset the modifiers sent to the current console */
1123
            reset_keys(vs);
1124
            console_select(keycode - 0x02);
1125
            return;
1126
        }
1127
        break;
1128
    case 0x3a:                        /* CapsLock */
1129
    case 0x45:                        /* NumLock */
1130
        if (!down)
1131
            vs->modifiers_state[keycode] ^= 1;
1132
        break;
1133
    }
1134

    
1135
    if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1136
        /* If the numlock state needs to change then simulate an additional
1137
           keypress before sending this one.  This will happen if the user
1138
           toggles numlock away from the VNC window.
1139
        */
1140
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1141
            if (!vs->modifiers_state[0x45]) {
1142
                vs->modifiers_state[0x45] = 1;
1143
                press_key(vs, 0xff7f);
1144
            }
1145
        } else {
1146
            if (vs->modifiers_state[0x45]) {
1147
                vs->modifiers_state[0x45] = 0;
1148
                press_key(vs, 0xff7f);
1149
            }
1150
        }
1151
    }
1152

    
1153
    if (is_graphic_console()) {
1154
        if (keycode & 0x80)
1155
            kbd_put_keycode(0xe0);
1156
        if (down)
1157
            kbd_put_keycode(keycode & 0x7f);
1158
        else
1159
            kbd_put_keycode(keycode | 0x80);
1160
    } else {
1161
        /* QEMU console emulation */
1162
        if (down) {
1163
            switch (keycode) {
1164
            case 0x2a:                          /* Left Shift */
1165
            case 0x36:                          /* Right Shift */
1166
            case 0x1d:                          /* Left CTRL */
1167
            case 0x9d:                          /* Right CTRL */
1168
            case 0x38:                          /* Left ALT */
1169
            case 0xb8:                          /* Right ALT */
1170
                break;
1171
            case 0xc8:
1172
                kbd_put_keysym(QEMU_KEY_UP);
1173
                break;
1174
            case 0xd0:
1175
                kbd_put_keysym(QEMU_KEY_DOWN);
1176
                break;
1177
            case 0xcb:
1178
                kbd_put_keysym(QEMU_KEY_LEFT);
1179
                break;
1180
            case 0xcd:
1181
                kbd_put_keysym(QEMU_KEY_RIGHT);
1182
                break;
1183
            case 0xd3:
1184
                kbd_put_keysym(QEMU_KEY_DELETE);
1185
                break;
1186
            case 0xc7:
1187
                kbd_put_keysym(QEMU_KEY_HOME);
1188
                break;
1189
            case 0xcf:
1190
                kbd_put_keysym(QEMU_KEY_END);
1191
                break;
1192
            case 0xc9:
1193
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1194
                break;
1195
            case 0xd1:
1196
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1197
                break;
1198
            default:
1199
                kbd_put_keysym(sym);
1200
                break;
1201
            }
1202
        }
1203
    }
1204
}
1205

    
1206
static void key_event(VncState *vs, int down, uint32_t sym)
1207
{
1208
    int keycode;
1209

    
1210
    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1211
        sym = sym - 'A' + 'a';
1212

    
1213
    keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1214
    do_key_event(vs, down, keycode, sym);
1215
}
1216

    
1217
static void ext_key_event(VncState *vs, int down,
1218
                          uint32_t sym, uint16_t keycode)
1219
{
1220
    /* if the user specifies a keyboard layout, always use it */
1221
    if (keyboard_layout)
1222
        key_event(vs, down, sym);
1223
    else
1224
        do_key_event(vs, down, keycode, sym);
1225
}
1226

    
1227
static void framebuffer_update_request(VncState *vs, int incremental,
1228
                                       int x_position, int y_position,
1229
                                       int w, int h)
1230
{
1231
    if (x_position > ds_get_width(vs->ds))
1232
        x_position = ds_get_width(vs->ds);
1233
    if (y_position > ds_get_height(vs->ds))
1234
        y_position = ds_get_height(vs->ds);
1235
    if (x_position + w >= ds_get_width(vs->ds))
1236
        w = ds_get_width(vs->ds)  - x_position;
1237
    if (y_position + h >= ds_get_height(vs->ds))
1238
        h = ds_get_height(vs->ds) - y_position;
1239

    
1240
    int i;
1241
    vs->need_update = 1;
1242
    if (!incremental) {
1243
        char *old_row = vs->old_data + y_position * ds_get_linesize(vs->ds);
1244

    
1245
        for (i = 0; i < h; i++) {
1246
            vnc_set_bits(vs->dirty_row[y_position + i],
1247
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1248
            memset(old_row, 42, ds_get_width(vs->ds) * ds_get_bytes_per_pixel(vs->ds));
1249
            old_row += ds_get_linesize(vs->ds);
1250
        }
1251
    }
1252
}
1253

    
1254
static void send_ext_key_event_ack(VncState *vs)
1255
{
1256
    vnc_write_u8(vs, 0);
1257
    vnc_write_u8(vs, 0);
1258
    vnc_write_u16(vs, 1);
1259
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1260
                           VNC_ENCODING_EXT_KEY_EVENT);
1261
    vnc_flush(vs);
1262
}
1263

    
1264
static void send_ext_audio_ack(VncState *vs)
1265
{
1266
    vnc_write_u8(vs, 0);
1267
    vnc_write_u8(vs, 0);
1268
    vnc_write_u16(vs, 1);
1269
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1270
                           VNC_ENCODING_AUDIO);
1271
    vnc_flush(vs);
1272
}
1273

    
1274
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1275
{
1276
    int i;
1277
    unsigned int enc = 0;
1278

    
1279
    vnc_zlib_init(vs);
1280
    vs->features = 0;
1281
    vs->vnc_encoding = 0;
1282
    vs->tight_compression = 9;
1283
    vs->tight_quality = 9;
1284
    vs->absolute = -1;
1285

    
1286
    for (i = n_encodings - 1; i >= 0; i--) {
1287
        enc = encodings[i];
1288
        switch (enc) {
1289
        case VNC_ENCODING_RAW:
1290
            vs->vnc_encoding = enc;
1291
            break;
1292
        case VNC_ENCODING_COPYRECT:
1293
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1294
            break;
1295
        case VNC_ENCODING_HEXTILE:
1296
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1297
            vs->vnc_encoding = enc;
1298
            break;
1299
        case VNC_ENCODING_ZLIB:
1300
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1301
            vs->vnc_encoding = enc;
1302
            break;
1303
        case VNC_ENCODING_DESKTOPRESIZE:
1304
            vs->features |= VNC_FEATURE_RESIZE_MASK;
1305
            break;
1306
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
1307
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1308
            break;
1309
        case VNC_ENCODING_EXT_KEY_EVENT:
1310
            send_ext_key_event_ack(vs);
1311
            break;
1312
        case VNC_ENCODING_AUDIO:
1313
            send_ext_audio_ack(vs);
1314
            break;
1315
        case VNC_ENCODING_WMVi:
1316
            vs->features |= VNC_FEATURE_WMVI_MASK;
1317
            break;
1318
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1319
            vs->tight_compression = (enc & 0x0F);
1320
            break;
1321
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1322
            vs->tight_quality = (enc & 0x0F);
1323
            break;
1324
        default:
1325
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1326
            break;
1327
        }
1328
    }
1329

    
1330
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1331
}
1332

    
1333
static void set_pixel_conversion(VncState *vs)
1334
{
1335
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1336
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
1337
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1338
        vs->write_pixels = vnc_write_pixels_copy;
1339
        switch (vs->ds->surface->pf.bits_per_pixel) {
1340
            case 8:
1341
                vs->send_hextile_tile = send_hextile_tile_8;
1342
                break;
1343
            case 16:
1344
                vs->send_hextile_tile = send_hextile_tile_16;
1345
                break;
1346
            case 32:
1347
                vs->send_hextile_tile = send_hextile_tile_32;
1348
                break;
1349
        }
1350
    } else {
1351
        vs->write_pixels = vnc_write_pixels_generic;
1352
        switch (vs->ds->surface->pf.bits_per_pixel) {
1353
            case 8:
1354
                vs->send_hextile_tile = send_hextile_tile_generic_8;
1355
                break;
1356
            case 16:
1357
                vs->send_hextile_tile = send_hextile_tile_generic_16;
1358
                break;
1359
            case 32:
1360
                vs->send_hextile_tile = send_hextile_tile_generic_32;
1361
                break;
1362
        }
1363
    }
1364
}
1365

    
1366
static void set_pixel_format(VncState *vs,
1367
                             int bits_per_pixel, int depth,
1368
                             int big_endian_flag, int true_color_flag,
1369
                             int red_max, int green_max, int blue_max,
1370
                             int red_shift, int green_shift, int blue_shift)
1371
{
1372
    if (!true_color_flag) {
1373
        vnc_client_error(vs);
1374
        return;
1375
    }
1376

    
1377
    vs->clientds = vs->serverds;
1378
    vs->clientds.pf.rmax = red_max;
1379
    count_bits(vs->clientds.pf.rbits, red_max);
1380
    vs->clientds.pf.rshift = red_shift;
1381
    vs->clientds.pf.rmask = red_max << red_shift;
1382
    vs->clientds.pf.gmax = green_max;
1383
    count_bits(vs->clientds.pf.gbits, green_max);
1384
    vs->clientds.pf.gshift = green_shift;
1385
    vs->clientds.pf.gmask = green_max << green_shift;
1386
    vs->clientds.pf.bmax = blue_max;
1387
    count_bits(vs->clientds.pf.bbits, blue_max);
1388
    vs->clientds.pf.bshift = blue_shift;
1389
    vs->clientds.pf.bmask = blue_max << blue_shift;
1390
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1391
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1392
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1393
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1394

    
1395
    set_pixel_conversion(vs);
1396

    
1397
    vga_hw_invalidate();
1398
    vga_hw_update();
1399
}
1400

    
1401
static void pixel_format_message (VncState *vs) {
1402
    char pad[3] = { 0, 0, 0 };
1403

    
1404
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1405
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1406

    
1407
#ifdef WORDS_BIGENDIAN
1408
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1409
#else
1410
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1411
#endif
1412
    vnc_write_u8(vs, 1);             /* true-color-flag */
1413
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
1414
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
1415
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
1416
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
1417
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
1418
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1419
    if (vs->ds->surface->pf.bits_per_pixel == 32)
1420
        vs->send_hextile_tile = send_hextile_tile_32;
1421
    else if (vs->ds->surface->pf.bits_per_pixel == 16)
1422
        vs->send_hextile_tile = send_hextile_tile_16;
1423
    else if (vs->ds->surface->pf.bits_per_pixel == 8)
1424
        vs->send_hextile_tile = send_hextile_tile_8;
1425
    vs->clientds = *(vs->ds->surface);
1426
    vs->clientds.flags |= ~QEMU_ALLOCATED_FLAG;
1427
    vs->write_pixels = vnc_write_pixels_copy;
1428

    
1429
    vnc_write(vs, pad, 3);           /* padding */
1430
}
1431

    
1432
static void vnc_dpy_setdata(DisplayState *ds)
1433
{
1434
    /* We don't have to do anything */
1435
}
1436

    
1437
static void vnc_colordepth(VncState *vs)
1438
{
1439
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1440
        /* Sending a WMVi message to notify the client*/
1441
        vnc_write_u8(vs, 0);  /* msg id */
1442
        vnc_write_u8(vs, 0);
1443
        vnc_write_u16(vs, 1); /* number of rects */
1444
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
1445
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1446
        pixel_format_message(vs);
1447
        vnc_flush(vs);
1448
    } else {
1449
        set_pixel_conversion(vs);
1450
    }
1451
}
1452

    
1453
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1454
{
1455
    int i;
1456
    uint16_t limit;
1457

    
1458
    switch (data[0]) {
1459
    case 0:
1460
        if (len == 1)
1461
            return 20;
1462

    
1463
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1464
                         read_u8(data, 6), read_u8(data, 7),
1465
                         read_u16(data, 8), read_u16(data, 10),
1466
                         read_u16(data, 12), read_u8(data, 14),
1467
                         read_u8(data, 15), read_u8(data, 16));
1468
        break;
1469
    case 2:
1470
        if (len == 1)
1471
            return 4;
1472

    
1473
        if (len == 4) {
1474
            limit = read_u16(data, 2);
1475
            if (limit > 0)
1476
                return 4 + (limit * 4);
1477
        } else
1478
            limit = read_u16(data, 2);
1479

    
1480
        for (i = 0; i < limit; i++) {
1481
            int32_t val = read_s32(data, 4 + (i * 4));
1482
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
1483
        }
1484

    
1485
        set_encodings(vs, (int32_t *)(data + 4), limit);
1486
        break;
1487
    case 3:
1488
        if (len == 1)
1489
            return 10;
1490

    
1491
        framebuffer_update_request(vs,
1492
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1493
                                   read_u16(data, 6), read_u16(data, 8));
1494
        break;
1495
    case 4:
1496
        if (len == 1)
1497
            return 8;
1498

    
1499
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
1500
        break;
1501
    case 5:
1502
        if (len == 1)
1503
            return 6;
1504

    
1505
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1506
        break;
1507
    case 6:
1508
        if (len == 1)
1509
            return 8;
1510

    
1511
        if (len == 8) {
1512
            uint32_t dlen = read_u32(data, 4);
1513
            if (dlen > 0)
1514
                return 8 + dlen;
1515
        }
1516

    
1517
        client_cut_text(vs, read_u32(data, 4), data + 8);
1518
        break;
1519
    case 255:
1520
        if (len == 1)
1521
            return 2;
1522

    
1523
        switch (read_u8(data, 1)) {
1524
        case 0:
1525
            if (len == 2)
1526
                return 12;
1527

    
1528
            ext_key_event(vs, read_u16(data, 2),
1529
                          read_u32(data, 4), read_u32(data, 8));
1530
            break;
1531
        case 1:
1532
            if (len == 2)
1533
                return 4;
1534

    
1535
            switch (read_u16 (data, 2)) {
1536
            case 0:
1537
                audio_add(vs);
1538
                break;
1539
            case 1:
1540
                audio_del(vs);
1541
                break;
1542
            case 2:
1543
                if (len == 4)
1544
                    return 10;
1545
                switch (read_u8(data, 4)) {
1546
                case 0: vs->as.fmt = AUD_FMT_U8; break;
1547
                case 1: vs->as.fmt = AUD_FMT_S8; break;
1548
                case 2: vs->as.fmt = AUD_FMT_U16; break;
1549
                case 3: vs->as.fmt = AUD_FMT_S16; break;
1550
                case 4: vs->as.fmt = AUD_FMT_U32; break;
1551
                case 5: vs->as.fmt = AUD_FMT_S32; break;
1552
                default:
1553
                    printf("Invalid audio format %d\n", read_u8(data, 4));
1554
                    vnc_client_error(vs);
1555
                    break;
1556
                }
1557
                vs->as.nchannels = read_u8(data, 5);
1558
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1559
                    printf("Invalid audio channel coount %d\n",
1560
                           read_u8(data, 5));
1561
                    vnc_client_error(vs);
1562
                    break;
1563
                }
1564
                vs->as.freq = read_u32(data, 6);
1565
                break;
1566
            default:
1567
                printf ("Invalid audio message %d\n", read_u8(data, 4));
1568
                vnc_client_error(vs);
1569
                break;
1570
            }
1571
            break;
1572

    
1573
        default:
1574
            printf("Msg: %d\n", read_u16(data, 0));
1575
            vnc_client_error(vs);
1576
            break;
1577
        }
1578
        break;
1579
    default:
1580
        printf("Msg: %d\n", data[0]);
1581
        vnc_client_error(vs);
1582
        break;
1583
    }
1584

    
1585
    vnc_read_when(vs, protocol_client_msg, 1);
1586
    return 0;
1587
}
1588

    
1589
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1590
{
1591
    char buf[1024];
1592
    int size;
1593

    
1594
    vnc_write_u16(vs, ds_get_width(vs->ds));
1595
    vnc_write_u16(vs, ds_get_height(vs->ds));
1596

    
1597
    pixel_format_message(vs);
1598

    
1599
    if (qemu_name)
1600
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1601
    else
1602
        size = snprintf(buf, sizeof(buf), "QEMU");
1603

    
1604
    vnc_write_u32(vs, size);
1605
    vnc_write(vs, buf, size);
1606
    vnc_flush(vs);
1607

    
1608
    vnc_read_when(vs, protocol_client_msg, 1);
1609

    
1610
    return 0;
1611
}
1612

    
1613
void start_client_init(VncState *vs)
1614
{
1615
    vnc_read_when(vs, protocol_client_init, 1);
1616
}
1617

    
1618
static void make_challenge(VncState *vs)
1619
{
1620
    int i;
1621

    
1622
    srand(time(NULL)+getpid()+getpid()*987654+rand());
1623

    
1624
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1625
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1626
}
1627

    
1628
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1629
{
1630
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1631
    int i, j, pwlen;
1632
    unsigned char key[8];
1633

    
1634
    if (!vs->vd->password || !vs->vd->password[0]) {
1635
        VNC_DEBUG("No password configured on server");
1636
        vnc_write_u32(vs, 1); /* Reject auth */
1637
        if (vs->minor >= 8) {
1638
            static const char err[] = "Authentication failed";
1639
            vnc_write_u32(vs, sizeof(err));
1640
            vnc_write(vs, err, sizeof(err));
1641
        }
1642
        vnc_flush(vs);
1643
        vnc_client_error(vs);
1644
        return 0;
1645
    }
1646

    
1647
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1648

    
1649
    /* Calculate the expected challenge response */
1650
    pwlen = strlen(vs->vd->password);
1651
    for (i=0; i<sizeof(key); i++)
1652
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
1653
    deskey(key, EN0);
1654
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1655
        des(response+j, response+j);
1656

    
1657
    /* Compare expected vs actual challenge response */
1658
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1659
        VNC_DEBUG("Client challenge reponse did not match\n");
1660
        vnc_write_u32(vs, 1); /* Reject auth */
1661
        if (vs->minor >= 8) {
1662
            static const char err[] = "Authentication failed";
1663
            vnc_write_u32(vs, sizeof(err));
1664
            vnc_write(vs, err, sizeof(err));
1665
        }
1666
        vnc_flush(vs);
1667
        vnc_client_error(vs);
1668
    } else {
1669
        VNC_DEBUG("Accepting VNC challenge response\n");
1670
        vnc_write_u32(vs, 0); /* Accept auth */
1671
        vnc_flush(vs);
1672

    
1673
        start_client_init(vs);
1674
    }
1675
    return 0;
1676
}
1677

    
1678
void start_auth_vnc(VncState *vs)
1679
{
1680
    make_challenge(vs);
1681
    /* Send client a 'random' challenge */
1682
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1683
    vnc_flush(vs);
1684

    
1685
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1686
}
1687

    
1688

    
1689
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1690
{
1691
    /* We only advertise 1 auth scheme at a time, so client
1692
     * must pick the one we sent. Verify this */
1693
    if (data[0] != vs->vd->auth) { /* Reject auth */
1694
       VNC_DEBUG("Reject auth %d\n", (int)data[0]);
1695
       vnc_write_u32(vs, 1);
1696
       if (vs->minor >= 8) {
1697
           static const char err[] = "Authentication failed";
1698
           vnc_write_u32(vs, sizeof(err));
1699
           vnc_write(vs, err, sizeof(err));
1700
       }
1701
       vnc_client_error(vs);
1702
    } else { /* Accept requested auth */
1703
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1704
       switch (vs->vd->auth) {
1705
       case VNC_AUTH_NONE:
1706
           VNC_DEBUG("Accept auth none\n");
1707
           if (vs->minor >= 8) {
1708
               vnc_write_u32(vs, 0); /* Accept auth completion */
1709
               vnc_flush(vs);
1710
           }
1711
           start_client_init(vs);
1712
           break;
1713

    
1714
       case VNC_AUTH_VNC:
1715
           VNC_DEBUG("Start VNC auth\n");
1716
           start_auth_vnc(vs);
1717
           break;
1718

    
1719
#ifdef CONFIG_VNC_TLS
1720
       case VNC_AUTH_VENCRYPT:
1721
           VNC_DEBUG("Accept VeNCrypt auth\n");;
1722
           start_auth_vencrypt(vs);
1723
           break;
1724
#endif /* CONFIG_VNC_TLS */
1725

    
1726
       default: /* Should not be possible, but just in case */
1727
           VNC_DEBUG("Reject auth %d\n", vs->vd->auth);
1728
           vnc_write_u8(vs, 1);
1729
           if (vs->minor >= 8) {
1730
               static const char err[] = "Authentication failed";
1731
               vnc_write_u32(vs, sizeof(err));
1732
               vnc_write(vs, err, sizeof(err));
1733
           }
1734
           vnc_client_error(vs);
1735
       }
1736
    }
1737
    return 0;
1738
}
1739

    
1740
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1741
{
1742
    char local[13];
1743

    
1744
    memcpy(local, version, 12);
1745
    local[12] = 0;
1746

    
1747
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1748
        VNC_DEBUG("Malformed protocol version %s\n", local);
1749
        vnc_client_error(vs);
1750
        return 0;
1751
    }
1752
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1753
    if (vs->major != 3 ||
1754
        (vs->minor != 3 &&
1755
         vs->minor != 4 &&
1756
         vs->minor != 5 &&
1757
         vs->minor != 7 &&
1758
         vs->minor != 8)) {
1759
        VNC_DEBUG("Unsupported client version\n");
1760
        vnc_write_u32(vs, VNC_AUTH_INVALID);
1761
        vnc_flush(vs);
1762
        vnc_client_error(vs);
1763
        return 0;
1764
    }
1765
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1766
     * as equivalent to v3.3 by servers
1767
     */
1768
    if (vs->minor == 4 || vs->minor == 5)
1769
        vs->minor = 3;
1770

    
1771
    if (vs->minor == 3) {
1772
        if (vs->vd->auth == VNC_AUTH_NONE) {
1773
            VNC_DEBUG("Tell client auth none\n");
1774
            vnc_write_u32(vs, vs->vd->auth);
1775
            vnc_flush(vs);
1776
            start_client_init(vs);
1777
       } else if (vs->vd->auth == VNC_AUTH_VNC) {
1778
            VNC_DEBUG("Tell client VNC auth\n");
1779
            vnc_write_u32(vs, vs->vd->auth);
1780
            vnc_flush(vs);
1781
            start_auth_vnc(vs);
1782
       } else {
1783
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
1784
            vnc_write_u32(vs, VNC_AUTH_INVALID);
1785
            vnc_flush(vs);
1786
            vnc_client_error(vs);
1787
       }
1788
    } else {
1789
        VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
1790
        vnc_write_u8(vs, 1); /* num auth */
1791
        vnc_write_u8(vs, vs->vd->auth);
1792
        vnc_read_when(vs, protocol_client_auth, 1);
1793
        vnc_flush(vs);
1794
    }
1795

    
1796
    return 0;
1797
}
1798

    
1799
static void vnc_connect(VncDisplay *vd, int csock)
1800
{
1801
    VncState *vs = qemu_mallocz(sizeof(VncState));
1802
    vs->csock = csock;
1803

    
1804
    VNC_DEBUG("New client on socket %d\n", csock);
1805
    dcl->idle = 0;
1806
    socket_set_nonblock(vs->csock);
1807
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1808

    
1809
    vs->vd = vd;
1810
    vs->ds = vd->ds;
1811
    vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
1812
    vs->last_x = -1;
1813
    vs->last_y = -1;
1814

    
1815
    vs->as.freq = 44100;
1816
    vs->as.nchannels = 2;
1817
    vs->as.fmt = AUD_FMT_S16;
1818
    vs->as.endianness = 0;
1819

    
1820
    vnc_resize(vs);
1821
    vnc_write(vs, "RFB 003.008\n", 12);
1822
    vnc_flush(vs);
1823
    vnc_read_when(vs, protocol_version, 12);
1824
    memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
1825
    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
1826
    vnc_update_client(vs);
1827
    reset_keys(vs);
1828

    
1829
    vs->next = vd->clients;
1830
    vd->clients = vs;
1831
}
1832

    
1833
static void vnc_listen_read(void *opaque)
1834
{
1835
    VncDisplay *vs = opaque;
1836
    struct sockaddr_in addr;
1837
    socklen_t addrlen = sizeof(addr);
1838

    
1839
    /* Catch-up */
1840
    vga_hw_update();
1841

    
1842
    int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
1843
    if (csock != -1) {
1844
        vnc_connect(vs, csock);
1845
    }
1846
}
1847

    
1848
void vnc_display_init(DisplayState *ds)
1849
{
1850
    VncDisplay *vs;
1851

    
1852
    vs = qemu_mallocz(sizeof(VncState));
1853
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
1854

    
1855
    ds->opaque = vs;
1856
    dcl->idle = 1;
1857
    vnc_display = vs;
1858

    
1859
    vs->lsock = -1;
1860

    
1861
    vs->ds = ds;
1862

    
1863
    if (keyboard_layout)
1864
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
1865
    else
1866
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
1867

    
1868
    if (!vs->kbd_layout)
1869
        exit(1);
1870

    
1871
    dcl->dpy_copy = vnc_dpy_copy;
1872
    dcl->dpy_update = vnc_dpy_update;
1873
    dcl->dpy_resize = vnc_dpy_resize;
1874
    dcl->dpy_setdata = vnc_dpy_setdata;
1875
    register_displaychangelistener(ds, dcl);
1876
}
1877

    
1878

    
1879
void vnc_display_close(DisplayState *ds)
1880
{
1881
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
1882

    
1883
    if (!vs)
1884
        return;
1885
    if (vs->display) {
1886
        qemu_free(vs->display);
1887
        vs->display = NULL;
1888
    }
1889
    if (vs->lsock != -1) {
1890
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
1891
        close(vs->lsock);
1892
        vs->lsock = -1;
1893
    }
1894
    vs->auth = VNC_AUTH_INVALID;
1895
#ifdef CONFIG_VNC_TLS
1896
    vs->subauth = VNC_AUTH_INVALID;
1897
    vs->tls.x509verify = 0;
1898
#endif
1899
}
1900

    
1901
int vnc_display_password(DisplayState *ds, const char *password)
1902
{
1903
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
1904

    
1905
    if (vs->password) {
1906
        qemu_free(vs->password);
1907
        vs->password = NULL;
1908
    }
1909
    if (password && password[0]) {
1910
        if (!(vs->password = qemu_strdup(password)))
1911
            return -1;
1912
    }
1913

    
1914
    return 0;
1915
}
1916

    
1917
int vnc_display_open(DisplayState *ds, const char *display)
1918
{
1919
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
1920
    const char *options;
1921
    int password = 0;
1922
    int reverse = 0;
1923
    int to_port = 0;
1924
#ifdef CONFIG_VNC_TLS
1925
    int tls = 0, x509 = 0;
1926
#endif
1927

    
1928
    if (!vnc_display)
1929
        return -1;
1930
    vnc_display_close(ds);
1931
    if (strcmp(display, "none") == 0)
1932
        return 0;
1933

    
1934
    if (!(vs->display = strdup(display)))
1935
        return -1;
1936

    
1937
    options = display;
1938
    while ((options = strchr(options, ','))) {
1939
        options++;
1940
        if (strncmp(options, "password", 8) == 0) {
1941
            password = 1; /* Require password auth */
1942
        } else if (strncmp(options, "reverse", 7) == 0) {
1943
            reverse = 1;
1944
        } else if (strncmp(options, "to=", 3) == 0) {
1945
            to_port = atoi(options+3) + 5900;
1946
#ifdef CONFIG_VNC_TLS
1947
        } else if (strncmp(options, "tls", 3) == 0) {
1948
            tls = 1; /* Require TLS */
1949
        } else if (strncmp(options, "x509", 4) == 0) {
1950
            char *start, *end;
1951
            x509 = 1; /* Require x509 certificates */
1952
            if (strncmp(options, "x509verify", 10) == 0)
1953
                vs->tls.x509verify = 1; /* ...and verify client certs */
1954

    
1955
            /* Now check for 'x509=/some/path' postfix
1956
             * and use that to setup x509 certificate/key paths */
1957
            start = strchr(options, '=');
1958
            end = strchr(options, ',');
1959
            if (start && (!end || (start < end))) {
1960
                int len = end ? end-(start+1) : strlen(start+1);
1961
                char *path = qemu_strndup(start + 1, len);
1962

    
1963
                VNC_DEBUG("Trying certificate path '%s'\n", path);
1964
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
1965
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
1966
                    qemu_free(path);
1967
                    qemu_free(vs->display);
1968
                    vs->display = NULL;
1969
                    return -1;
1970
                }
1971
                qemu_free(path);
1972
            } else {
1973
                fprintf(stderr, "No certificate path provided\n");
1974
                qemu_free(vs->display);
1975
                vs->display = NULL;
1976
                return -1;
1977
            }
1978
#endif
1979
        }
1980
    }
1981

    
1982
    if (password) {
1983
#ifdef CONFIG_VNC_TLS
1984
        if (tls) {
1985
            vs->auth = VNC_AUTH_VENCRYPT;
1986
            if (x509) {
1987
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
1988
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
1989
            } else {
1990
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
1991
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
1992
            }
1993
        } else {
1994
#endif
1995
            VNC_DEBUG("Initializing VNC server with password auth\n");
1996
            vs->auth = VNC_AUTH_VNC;
1997
#ifdef CONFIG_VNC_TLS
1998
            vs->subauth = VNC_AUTH_INVALID;
1999
        }
2000
#endif
2001
    } else {
2002
#ifdef CONFIG_VNC_TLS
2003
        if (tls) {
2004
            vs->auth = VNC_AUTH_VENCRYPT;
2005
            if (x509) {
2006
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2007
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2008
            } else {
2009
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2010
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2011
            }
2012
        } else {
2013
#endif
2014
            VNC_DEBUG("Initializing VNC server with no auth\n");
2015
            vs->auth = VNC_AUTH_NONE;
2016
#ifdef CONFIG_VNC_TLS
2017
            vs->subauth = VNC_AUTH_INVALID;
2018
        }
2019
#endif
2020
    }
2021

    
2022
    if (reverse) {
2023
        /* connect to viewer */
2024
        if (strncmp(display, "unix:", 5) == 0)
2025
            vs->lsock = unix_connect(display+5);
2026
        else
2027
            vs->lsock = inet_connect(display, SOCK_STREAM);
2028
        if (-1 == vs->lsock) {
2029
            free(vs->display);
2030
            vs->display = NULL;
2031
            return -1;
2032
        } else {
2033
            int csock = vs->lsock;
2034
            vs->lsock = -1;
2035
            vnc_connect(vs, csock);
2036
        }
2037
        return 0;
2038

    
2039
    } else {
2040
        /* listen for connects */
2041
        char *dpy;
2042
        dpy = qemu_malloc(256);
2043
        if (strncmp(display, "unix:", 5) == 0) {
2044
            pstrcpy(dpy, 256, "unix:");
2045
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2046
        } else {
2047
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2048
        }
2049
        if (-1 == vs->lsock) {
2050
            free(dpy);
2051
            return -1;
2052
        } else {
2053
            free(vs->display);
2054
            vs->display = dpy;
2055
        }
2056
    }
2057
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2058
}