Statistics
| Branch: | Revision:

root / ui / vnc.c @ a6ba35b3

History | View | Annotate | Download (89 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
8
 * Permission is hereby granted, free of charge, to any person obtaining a copy
9
 * of this software and associated documentation files (the "Software"), to deal
10
 * in the Software without restriction, including without limitation the rights
11
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12
 * copies of the Software, and to permit persons to whom the Software is
13
 * furnished to do so, subject to the following conditions:
14
 *
15
 * The above copyright notice and this permission notice shall be included in
16
 * all copies or substantial portions of the Software.
17
 *
18
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24
 * THE SOFTWARE.
25
 */
26

    
27
#include "vnc.h"
28
#include "vnc-jobs.h"
29
#include "sysemu.h"
30
#include "qemu_socket.h"
31
#include "qemu-timer.h"
32
#include "acl.h"
33
#include "qemu-objects.h"
34
#include "qmp-commands.h"
35

    
36
#define VNC_REFRESH_INTERVAL_BASE 30
37
#define VNC_REFRESH_INTERVAL_INC  50
38
#define VNC_REFRESH_INTERVAL_MAX  2000
39
static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
40
static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
41

    
42
#include "vnc_keysym.h"
43
#include "d3des.h"
44

    
45
static VncDisplay *vnc_display; /* needed for info vnc */
46
static DisplayChangeListener *dcl;
47

    
48
static int vnc_cursor_define(VncState *vs);
49
static void vnc_release_modifiers(VncState *vs);
50

    
51
static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
52
{
53
#ifdef _VNC_DEBUG
54
    static const char *mn[] = {
55
        [0]                           = "undefined",
56
        [VNC_SHARE_MODE_CONNECTING]   = "connecting",
57
        [VNC_SHARE_MODE_SHARED]       = "shared",
58
        [VNC_SHARE_MODE_EXCLUSIVE]    = "exclusive",
59
        [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
60
    };
61
    fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
62
            vs->csock, mn[vs->share_mode], mn[mode]);
63
#endif
64

    
65
    if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
66
        vs->vd->num_exclusive--;
67
    }
68
    vs->share_mode = mode;
69
    if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
70
        vs->vd->num_exclusive++;
71
    }
72
}
73

    
74
static char *addr_to_string(const char *format,
75
                            struct sockaddr_storage *sa,
76
                            socklen_t salen) {
77
    char *addr;
78
    char host[NI_MAXHOST];
79
    char serv[NI_MAXSERV];
80
    int err;
81
    size_t addrlen;
82

    
83
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
84
                           host, sizeof(host),
85
                           serv, sizeof(serv),
86
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
87
        VNC_DEBUG("Cannot resolve address %d: %s\n",
88
                  err, gai_strerror(err));
89
        return NULL;
90
    }
91

    
92
    /* Enough for the existing format + the 2 vars we're
93
     * substituting in. */
94
    addrlen = strlen(format) + strlen(host) + strlen(serv);
95
    addr = g_malloc(addrlen + 1);
96
    snprintf(addr, addrlen, format, host, serv);
97
    addr[addrlen] = '\0';
98

    
99
    return addr;
100
}
101

    
102

    
103
char *vnc_socket_local_addr(const char *format, int fd) {
104
    struct sockaddr_storage sa;
105
    socklen_t salen;
106

    
107
    salen = sizeof(sa);
108
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
109
        return NULL;
110

    
111
    return addr_to_string(format, &sa, salen);
112
}
113

    
114
char *vnc_socket_remote_addr(const char *format, int fd) {
115
    struct sockaddr_storage sa;
116
    socklen_t salen;
117

    
118
    salen = sizeof(sa);
119
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
120
        return NULL;
121

    
122
    return addr_to_string(format, &sa, salen);
123
}
124

    
125
static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
126
                          socklen_t salen)
127
{
128
    char host[NI_MAXHOST];
129
    char serv[NI_MAXSERV];
130
    int err;
131

    
132
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
133
                           host, sizeof(host),
134
                           serv, sizeof(serv),
135
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
136
        VNC_DEBUG("Cannot resolve address %d: %s\n",
137
                  err, gai_strerror(err));
138
        return -1;
139
    }
140

    
141
    qdict_put(qdict, "host", qstring_from_str(host));
142
    qdict_put(qdict, "service", qstring_from_str(serv));
143
    qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
144

    
145
    return 0;
146
}
147

    
148
static int vnc_server_addr_put(QDict *qdict, int fd)
149
{
150
    struct sockaddr_storage sa;
151
    socklen_t salen;
152

    
153
    salen = sizeof(sa);
154
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
155
        return -1;
156
    }
157

    
158
    return put_addr_qdict(qdict, &sa, salen);
159
}
160

    
161
static int vnc_qdict_remote_addr(QDict *qdict, int fd)
162
{
163
    struct sockaddr_storage sa;
164
    socklen_t salen;
165

    
166
    salen = sizeof(sa);
167
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
168
        return -1;
169
    }
170

    
171
    return put_addr_qdict(qdict, &sa, salen);
172
}
173

    
174
static const char *vnc_auth_name(VncDisplay *vd) {
175
    switch (vd->auth) {
176
    case VNC_AUTH_INVALID:
177
        return "invalid";
178
    case VNC_AUTH_NONE:
179
        return "none";
180
    case VNC_AUTH_VNC:
181
        return "vnc";
182
    case VNC_AUTH_RA2:
183
        return "ra2";
184
    case VNC_AUTH_RA2NE:
185
        return "ra2ne";
186
    case VNC_AUTH_TIGHT:
187
        return "tight";
188
    case VNC_AUTH_ULTRA:
189
        return "ultra";
190
    case VNC_AUTH_TLS:
191
        return "tls";
192
    case VNC_AUTH_VENCRYPT:
193
#ifdef CONFIG_VNC_TLS
194
        switch (vd->subauth) {
195
        case VNC_AUTH_VENCRYPT_PLAIN:
196
            return "vencrypt+plain";
197
        case VNC_AUTH_VENCRYPT_TLSNONE:
198
            return "vencrypt+tls+none";
199
        case VNC_AUTH_VENCRYPT_TLSVNC:
200
            return "vencrypt+tls+vnc";
201
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
202
            return "vencrypt+tls+plain";
203
        case VNC_AUTH_VENCRYPT_X509NONE:
204
            return "vencrypt+x509+none";
205
        case VNC_AUTH_VENCRYPT_X509VNC:
206
            return "vencrypt+x509+vnc";
207
        case VNC_AUTH_VENCRYPT_X509PLAIN:
208
            return "vencrypt+x509+plain";
209
        case VNC_AUTH_VENCRYPT_TLSSASL:
210
            return "vencrypt+tls+sasl";
211
        case VNC_AUTH_VENCRYPT_X509SASL:
212
            return "vencrypt+x509+sasl";
213
        default:
214
            return "vencrypt";
215
        }
216
#else
217
        return "vencrypt";
218
#endif
219
    case VNC_AUTH_SASL:
220
        return "sasl";
221
    }
222
    return "unknown";
223
}
224

    
225
static int vnc_server_info_put(QDict *qdict)
226
{
227
    if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
228
        return -1;
229
    }
230

    
231
    qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
232
    return 0;
233
}
234

    
235
static void vnc_client_cache_auth(VncState *client)
236
{
237
#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
238
    QDict *qdict;
239
#endif
240

    
241
    if (!client->info) {
242
        return;
243
    }
244

    
245
#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
246
    qdict = qobject_to_qdict(client->info);
247
#endif
248

    
249
#ifdef CONFIG_VNC_TLS
250
    if (client->tls.session &&
251
        client->tls.dname) {
252
        qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
253
    }
254
#endif
255
#ifdef CONFIG_VNC_SASL
256
    if (client->sasl.conn &&
257
        client->sasl.username) {
258
        qdict_put(qdict, "sasl_username",
259
                  qstring_from_str(client->sasl.username));
260
    }
261
#endif
262
}
263

    
264
static void vnc_client_cache_addr(VncState *client)
265
{
266
    QDict *qdict;
267

    
268
    qdict = qdict_new();
269
    if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
270
        QDECREF(qdict);
271
        /* XXX: how to report the error? */
272
        return;
273
    }
274

    
275
    client->info = QOBJECT(qdict);
276
}
277

    
278
static void vnc_qmp_event(VncState *vs, MonitorEvent event)
279
{
280
    QDict *server;
281
    QObject *data;
282

    
283
    if (!vs->info) {
284
        return;
285
    }
286

    
287
    server = qdict_new();
288
    if (vnc_server_info_put(server) < 0) {
289
        QDECREF(server);
290
        return;
291
    }
292

    
293
    data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
294
                              vs->info, QOBJECT(server));
295

    
296
    monitor_protocol_event(event, data);
297

    
298
    qobject_incref(vs->info);
299
    qobject_decref(data);
300
}
301

    
302
static VncClientInfo *qmp_query_vnc_client(const VncState *client)
303
{
304
    struct sockaddr_storage sa;
305
    socklen_t salen = sizeof(sa);
306
    char host[NI_MAXHOST];
307
    char serv[NI_MAXSERV];
308
    VncClientInfo *info;
309

    
310
    if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
311
        return NULL;
312
    }
313

    
314
    if (getnameinfo((struct sockaddr *)&sa, salen,
315
                    host, sizeof(host),
316
                    serv, sizeof(serv),
317
                    NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
318
        return NULL;
319
    }
320

    
321
    info = g_malloc0(sizeof(*info));
322
    info->host = g_strdup(host);
323
    info->service = g_strdup(serv);
324
    info->family = g_strdup(inet_strfamily(sa.ss_family));
325

    
326
#ifdef CONFIG_VNC_TLS
327
    if (client->tls.session && client->tls.dname) {
328
        info->has_x509_dname = true;
329
        info->x509_dname = g_strdup(client->tls.dname);
330
    }
331
#endif
332
#ifdef CONFIG_VNC_SASL
333
    if (client->sasl.conn && client->sasl.username) {
334
        info->has_sasl_username = true;
335
        info->sasl_username = g_strdup(client->sasl.username);
336
    }
337
#endif
338

    
339
    return info;
340
}
341

    
342
VncInfo *qmp_query_vnc(Error **errp)
343
{
344
    VncInfo *info = g_malloc0(sizeof(*info));
345

    
346
    if (vnc_display == NULL || vnc_display->display == NULL) {
347
        info->enabled = false;
348
    } else {
349
        VncClientInfoList *cur_item = NULL;
350
        struct sockaddr_storage sa;
351
        socklen_t salen = sizeof(sa);
352
        char host[NI_MAXHOST];
353
        char serv[NI_MAXSERV];
354
        VncState *client;
355

    
356
        info->enabled = true;
357

    
358
        /* for compatibility with the original command */
359
        info->has_clients = true;
360

    
361
        QTAILQ_FOREACH(client, &vnc_display->clients, next) {
362
            VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
363
            cinfo->value = qmp_query_vnc_client(client);
364

    
365
            /* XXX: waiting for the qapi to support GSList */
366
            if (!cur_item) {
367
                info->clients = cur_item = cinfo;
368
            } else {
369
                cur_item->next = cinfo;
370
                cur_item = cinfo;
371
            }
372
        }
373

    
374
        if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
375
                        &salen) == -1) {
376
            error_set(errp, QERR_UNDEFINED_ERROR);
377
            goto out_error;
378
        }
379

    
380
        if (getnameinfo((struct sockaddr *)&sa, salen,
381
                        host, sizeof(host),
382
                        serv, sizeof(serv),
383
                        NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
384
            error_set(errp, QERR_UNDEFINED_ERROR);
385
            goto out_error;
386
        }
387

    
388
        info->has_host = true;
389
        info->host = g_strdup(host);
390

    
391
        info->has_service = true;
392
        info->service = g_strdup(serv);
393

    
394
        info->has_family = true;
395
        info->family = g_strdup(inet_strfamily(sa.ss_family));
396

    
397
        info->has_auth = true;
398
        info->auth = g_strdup(vnc_auth_name(vnc_display));
399
    }
400

    
401
    return info;
402

    
403
out_error:
404
    qapi_free_VncInfo(info);
405
    return NULL;
406
}
407

    
408
/* TODO
409
   1) Get the queue working for IO.
410
   2) there is some weirdness when using the -S option (the screen is grey
411
      and not totally invalidated
412
   3) resolutions > 1024
413
*/
414

    
415
static int vnc_update_client(VncState *vs, int has_dirty);
416
static int vnc_update_client_sync(VncState *vs, int has_dirty);
417
static void vnc_disconnect_start(VncState *vs);
418
static void vnc_disconnect_finish(VncState *vs);
419
static void vnc_init_timer(VncDisplay *vd);
420
static void vnc_remove_timer(VncDisplay *vd);
421

    
422
static void vnc_colordepth(VncState *vs);
423
static void framebuffer_update_request(VncState *vs, int incremental,
424
                                       int x_position, int y_position,
425
                                       int w, int h);
426
static void vnc_refresh(void *opaque);
427
static int vnc_refresh_server_surface(VncDisplay *vd);
428

    
429
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
430
{
431
    int i;
432
    VncDisplay *vd = ds->opaque;
433
    struct VncSurface *s = &vd->guest;
434

    
435
    h += y;
436

    
437
    /* round x down to ensure the loop only spans one 16-pixel block per,
438
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
439
       two 16-pixel blocks but we only mark the first as dirty
440
    */
441
    w += (x % 16);
442
    x -= (x % 16);
443

    
444
    x = MIN(x, s->ds->width);
445
    y = MIN(y, s->ds->height);
446
    w = MIN(x + w, s->ds->width) - x;
447
    h = MIN(h, s->ds->height);
448

    
449
    for (; y < h; y++)
450
        for (i = 0; i < w; i += 16)
451
            set_bit((x + i) / 16, s->dirty[y]);
452
}
453

    
454
void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
455
                            int32_t encoding)
456
{
457
    vnc_write_u16(vs, x);
458
    vnc_write_u16(vs, y);
459
    vnc_write_u16(vs, w);
460
    vnc_write_u16(vs, h);
461

    
462
    vnc_write_s32(vs, encoding);
463
}
464

    
465
void buffer_reserve(Buffer *buffer, size_t len)
466
{
467
    if ((buffer->capacity - buffer->offset) < len) {
468
        buffer->capacity += (len + 1024);
469
        buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
470
        if (buffer->buffer == NULL) {
471
            fprintf(stderr, "vnc: out of memory\n");
472
            exit(1);
473
        }
474
    }
475
}
476

    
477
int buffer_empty(Buffer *buffer)
478
{
479
    return buffer->offset == 0;
480
}
481

    
482
uint8_t *buffer_end(Buffer *buffer)
483
{
484
    return buffer->buffer + buffer->offset;
485
}
486

    
487
void buffer_reset(Buffer *buffer)
488
{
489
        buffer->offset = 0;
490
}
491

    
492
void buffer_free(Buffer *buffer)
493
{
494
    g_free(buffer->buffer);
495
    buffer->offset = 0;
496
    buffer->capacity = 0;
497
    buffer->buffer = NULL;
498
}
499

    
500
void buffer_append(Buffer *buffer, const void *data, size_t len)
501
{
502
    memcpy(buffer->buffer + buffer->offset, data, len);
503
    buffer->offset += len;
504
}
505

    
506
static void vnc_desktop_resize(VncState *vs)
507
{
508
    DisplayState *ds = vs->ds;
509

    
510
    if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
511
        return;
512
    }
513
    if (vs->client_width == ds_get_width(ds) &&
514
        vs->client_height == ds_get_height(ds)) {
515
        return;
516
    }
517
    vs->client_width = ds_get_width(ds);
518
    vs->client_height = ds_get_height(ds);
519
    vnc_lock_output(vs);
520
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
521
    vnc_write_u8(vs, 0);
522
    vnc_write_u16(vs, 1); /* number of rects */
523
    vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
524
                           VNC_ENCODING_DESKTOPRESIZE);
525
    vnc_unlock_output(vs);
526
    vnc_flush(vs);
527
}
528

    
529
#ifdef CONFIG_VNC_THREAD
530
static void vnc_abort_display_jobs(VncDisplay *vd)
531
{
532
    VncState *vs;
533

    
534
    QTAILQ_FOREACH(vs, &vd->clients, next) {
535
        vnc_lock_output(vs);
536
        vs->abort = true;
537
        vnc_unlock_output(vs);
538
    }
539
    QTAILQ_FOREACH(vs, &vd->clients, next) {
540
        vnc_jobs_join(vs);
541
    }
542
    QTAILQ_FOREACH(vs, &vd->clients, next) {
543
        vnc_lock_output(vs);
544
        vs->abort = false;
545
        vnc_unlock_output(vs);
546
    }
547
}
548
#else
549
static void vnc_abort_display_jobs(VncDisplay *vd)
550
{
551
}
552
#endif
553

    
554
static void vnc_dpy_resize(DisplayState *ds)
555
{
556
    VncDisplay *vd = ds->opaque;
557
    VncState *vs;
558

    
559
    vnc_abort_display_jobs(vd);
560

    
561
    /* server surface */
562
    if (!vd->server)
563
        vd->server = g_malloc0(sizeof(*vd->server));
564
    if (vd->server->data)
565
        g_free(vd->server->data);
566
    *(vd->server) = *(ds->surface);
567
    vd->server->data = g_malloc0(vd->server->linesize *
568
                                    vd->server->height);
569

    
570
    /* guest surface */
571
    if (!vd->guest.ds)
572
        vd->guest.ds = g_malloc0(sizeof(*vd->guest.ds));
573
    if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
574
        console_color_init(ds);
575
    *(vd->guest.ds) = *(ds->surface);
576
    memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
577

    
578
    QTAILQ_FOREACH(vs, &vd->clients, next) {
579
        vnc_colordepth(vs);
580
        vnc_desktop_resize(vs);
581
        if (vs->vd->cursor) {
582
            vnc_cursor_define(vs);
583
        }
584
        memset(vs->dirty, 0xFF, sizeof(vs->dirty));
585
    }
586
}
587

    
588
/* fastest code */
589
static void vnc_write_pixels_copy(VncState *vs, struct PixelFormat *pf,
590
                                  void *pixels, int size)
591
{
592
    vnc_write(vs, pixels, size);
593
}
594

    
595
/* slowest but generic code. */
596
void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
597
{
598
    uint8_t r, g, b;
599
    VncDisplay *vd = vs->vd;
600

    
601
    r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
602
        vd->server->pf.rbits);
603
    g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
604
        vd->server->pf.gbits);
605
    b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
606
        vd->server->pf.bbits);
607
    v = (r << vs->clientds.pf.rshift) |
608
        (g << vs->clientds.pf.gshift) |
609
        (b << vs->clientds.pf.bshift);
610
    switch(vs->clientds.pf.bytes_per_pixel) {
611
    case 1:
612
        buf[0] = v;
613
        break;
614
    case 2:
615
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
616
            buf[0] = v >> 8;
617
            buf[1] = v;
618
        } else {
619
            buf[1] = v >> 8;
620
            buf[0] = v;
621
        }
622
        break;
623
    default:
624
    case 4:
625
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
626
            buf[0] = v >> 24;
627
            buf[1] = v >> 16;
628
            buf[2] = v >> 8;
629
            buf[3] = v;
630
        } else {
631
            buf[3] = v >> 24;
632
            buf[2] = v >> 16;
633
            buf[1] = v >> 8;
634
            buf[0] = v;
635
        }
636
        break;
637
    }
638
}
639

    
640
static void vnc_write_pixels_generic(VncState *vs, struct PixelFormat *pf,
641
                                     void *pixels1, int size)
642
{
643
    uint8_t buf[4];
644

    
645
    if (pf->bytes_per_pixel == 4) {
646
        uint32_t *pixels = pixels1;
647
        int n, i;
648
        n = size >> 2;
649
        for(i = 0; i < n; i++) {
650
            vnc_convert_pixel(vs, buf, pixels[i]);
651
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
652
        }
653
    } else if (pf->bytes_per_pixel == 2) {
654
        uint16_t *pixels = pixels1;
655
        int n, i;
656
        n = size >> 1;
657
        for(i = 0; i < n; i++) {
658
            vnc_convert_pixel(vs, buf, pixels[i]);
659
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
660
        }
661
    } else if (pf->bytes_per_pixel == 1) {
662
        uint8_t *pixels = pixels1;
663
        int n, i;
664
        n = size;
665
        for(i = 0; i < n; i++) {
666
            vnc_convert_pixel(vs, buf, pixels[i]);
667
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
668
        }
669
    } else {
670
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
671
    }
672
}
673

    
674
int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
675
{
676
    int i;
677
    uint8_t *row;
678
    VncDisplay *vd = vs->vd;
679

    
680
    row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
681
    for (i = 0; i < h; i++) {
682
        vs->write_pixels(vs, &vd->server->pf, row, w * ds_get_bytes_per_pixel(vs->ds));
683
        row += ds_get_linesize(vs->ds);
684
    }
685
    return 1;
686
}
687

    
688
int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
689
{
690
    int n = 0;
691

    
692
    switch(vs->vnc_encoding) {
693
        case VNC_ENCODING_ZLIB:
694
            n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
695
            break;
696
        case VNC_ENCODING_HEXTILE:
697
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
698
            n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
699
            break;
700
        case VNC_ENCODING_TIGHT:
701
            n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
702
            break;
703
        case VNC_ENCODING_TIGHT_PNG:
704
            n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
705
            break;
706
        case VNC_ENCODING_ZRLE:
707
            n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
708
            break;
709
        case VNC_ENCODING_ZYWRLE:
710
            n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
711
            break;
712
        default:
713
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
714
            n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
715
            break;
716
    }
717
    return n;
718
}
719

    
720
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
721
{
722
    /* send bitblit op to the vnc client */
723
    vnc_lock_output(vs);
724
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
725
    vnc_write_u8(vs, 0);
726
    vnc_write_u16(vs, 1); /* number of rects */
727
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
728
    vnc_write_u16(vs, src_x);
729
    vnc_write_u16(vs, src_y);
730
    vnc_unlock_output(vs);
731
    vnc_flush(vs);
732
}
733

    
734
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
735
{
736
    VncDisplay *vd = ds->opaque;
737
    VncState *vs, *vn;
738
    uint8_t *src_row;
739
    uint8_t *dst_row;
740
    int i,x,y,pitch,depth,inc,w_lim,s;
741
    int cmp_bytes;
742

    
743
    vnc_refresh_server_surface(vd);
744
    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
745
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
746
            vs->force_update = 1;
747
            vnc_update_client_sync(vs, 1);
748
            /* vs might be free()ed here */
749
        }
750
    }
751

    
752
    /* do bitblit op on the local surface too */
753
    pitch = ds_get_linesize(vd->ds);
754
    depth = ds_get_bytes_per_pixel(vd->ds);
755
    src_row = vd->server->data + pitch * src_y + depth * src_x;
756
    dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
757
    y = dst_y;
758
    inc = 1;
759
    if (dst_y > src_y) {
760
        /* copy backwards */
761
        src_row += pitch * (h-1);
762
        dst_row += pitch * (h-1);
763
        pitch = -pitch;
764
        y = dst_y + h - 1;
765
        inc = -1;
766
    }
767
    w_lim = w - (16 - (dst_x % 16));
768
    if (w_lim < 0)
769
        w_lim = w;
770
    else
771
        w_lim = w - (w_lim % 16);
772
    for (i = 0; i < h; i++) {
773
        for (x = 0; x <= w_lim;
774
                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
775
            if (x == w_lim) {
776
                if ((s = w - w_lim) == 0)
777
                    break;
778
            } else if (!x) {
779
                s = (16 - (dst_x % 16));
780
                s = MIN(s, w_lim);
781
            } else {
782
                s = 16;
783
            }
784
            cmp_bytes = s * depth;
785
            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
786
                continue;
787
            memmove(dst_row, src_row, cmp_bytes);
788
            QTAILQ_FOREACH(vs, &vd->clients, next) {
789
                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
790
                    set_bit(((x + dst_x) / 16), vs->dirty[y]);
791
                }
792
            }
793
        }
794
        src_row += pitch - w * depth;
795
        dst_row += pitch - w * depth;
796
        y += inc;
797
    }
798

    
799
    QTAILQ_FOREACH(vs, &vd->clients, next) {
800
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
801
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
802
        }
803
    }
804
}
805

    
806
static void vnc_mouse_set(int x, int y, int visible)
807
{
808
    /* can we ask the client(s) to move the pointer ??? */
809
}
810

    
811
static int vnc_cursor_define(VncState *vs)
812
{
813
    QEMUCursor *c = vs->vd->cursor;
814
    PixelFormat pf = qemu_default_pixelformat(32);
815
    int isize;
816

    
817
    if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
818
        vnc_lock_output(vs);
819
        vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
820
        vnc_write_u8(vs,  0);  /*  padding     */
821
        vnc_write_u16(vs, 1);  /*  # of rects  */
822
        vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
823
                               VNC_ENCODING_RICH_CURSOR);
824
        isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
825
        vnc_write_pixels_generic(vs, &pf, c->data, isize);
826
        vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
827
        vnc_unlock_output(vs);
828
        return 0;
829
    }
830
    return -1;
831
}
832

    
833
static void vnc_dpy_cursor_define(QEMUCursor *c)
834
{
835
    VncDisplay *vd = vnc_display;
836
    VncState *vs;
837

    
838
    cursor_put(vd->cursor);
839
    g_free(vd->cursor_mask);
840

    
841
    vd->cursor = c;
842
    cursor_get(vd->cursor);
843
    vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
844
    vd->cursor_mask = g_malloc0(vd->cursor_msize);
845
    cursor_get_mono_mask(c, 0, vd->cursor_mask);
846

    
847
    QTAILQ_FOREACH(vs, &vd->clients, next) {
848
        vnc_cursor_define(vs);
849
    }
850
}
851

    
852
static int find_and_clear_dirty_height(struct VncState *vs,
853
                                       int y, int last_x, int x, int height)
854
{
855
    int h;
856

    
857
    for (h = 1; h < (height - y); h++) {
858
        int tmp_x;
859
        if (!test_bit(last_x, vs->dirty[y + h])) {
860
            break;
861
        }
862
        for (tmp_x = last_x; tmp_x < x; tmp_x++) {
863
            clear_bit(tmp_x, vs->dirty[y + h]);
864
        }
865
    }
866

    
867
    return h;
868
}
869

    
870
#ifdef CONFIG_VNC_THREAD
871
static int vnc_update_client_sync(VncState *vs, int has_dirty)
872
{
873
    int ret = vnc_update_client(vs, has_dirty);
874
    vnc_jobs_join(vs);
875
    return ret;
876
}
877
#else
878
static int vnc_update_client_sync(VncState *vs, int has_dirty)
879
{
880
    return vnc_update_client(vs, has_dirty);
881
}
882
#endif
883

    
884
static int vnc_update_client(VncState *vs, int has_dirty)
885
{
886
    if (vs->need_update && vs->csock != -1) {
887
        VncDisplay *vd = vs->vd;
888
        VncJob *job;
889
        int y;
890
        int width, height;
891
        int n = 0;
892

    
893

    
894
        if (vs->output.offset && !vs->audio_cap && !vs->force_update)
895
            /* kernel send buffers are full -> drop frames to throttle */
896
            return 0;
897

    
898
        if (!has_dirty && !vs->audio_cap && !vs->force_update)
899
            return 0;
900

    
901
        /*
902
         * Send screen updates to the vnc client using the server
903
         * surface and server dirty map.  guest surface updates
904
         * happening in parallel don't disturb us, the next pass will
905
         * send them to the client.
906
         */
907
        job = vnc_job_new(vs);
908

    
909
        width = MIN(vd->server->width, vs->client_width);
910
        height = MIN(vd->server->height, vs->client_height);
911

    
912
        for (y = 0; y < height; y++) {
913
            int x;
914
            int last_x = -1;
915
            for (x = 0; x < width / 16; x++) {
916
                if (test_and_clear_bit(x, vs->dirty[y])) {
917
                    if (last_x == -1) {
918
                        last_x = x;
919
                    }
920
                } else {
921
                    if (last_x != -1) {
922
                        int h = find_and_clear_dirty_height(vs, y, last_x, x,
923
                                                            height);
924

    
925
                        n += vnc_job_add_rect(job, last_x * 16, y,
926
                                              (x - last_x) * 16, h);
927
                    }
928
                    last_x = -1;
929
                }
930
            }
931
            if (last_x != -1) {
932
                int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
933
                n += vnc_job_add_rect(job, last_x * 16, y,
934
                                      (x - last_x) * 16, h);
935
            }
936
        }
937

    
938
        vnc_job_push(job);
939
        vs->force_update = 0;
940
        return n;
941
    }
942

    
943
    if (vs->csock == -1)
944
        vnc_disconnect_finish(vs);
945

    
946
    return 0;
947
}
948

    
949
/* audio */
950
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
951
{
952
    VncState *vs = opaque;
953

    
954
    switch (cmd) {
955
    case AUD_CNOTIFY_DISABLE:
956
        vnc_lock_output(vs);
957
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
958
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
959
        vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
960
        vnc_unlock_output(vs);
961
        vnc_flush(vs);
962
        break;
963

    
964
    case AUD_CNOTIFY_ENABLE:
965
        vnc_lock_output(vs);
966
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
967
        vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
968
        vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
969
        vnc_unlock_output(vs);
970
        vnc_flush(vs);
971
        break;
972
    }
973
}
974

    
975
static void audio_capture_destroy(void *opaque)
976
{
977
}
978

    
979
static void audio_capture(void *opaque, void *buf, int size)
980
{
981
    VncState *vs = opaque;
982

    
983
    vnc_lock_output(vs);
984
    vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
985
    vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
986
    vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
987
    vnc_write_u32(vs, size);
988
    vnc_write(vs, buf, size);
989
    vnc_unlock_output(vs);
990
    vnc_flush(vs);
991
}
992

    
993
static void audio_add(VncState *vs)
994
{
995
    struct audio_capture_ops ops;
996

    
997
    if (vs->audio_cap) {
998
        monitor_printf(default_mon, "audio already running\n");
999
        return;
1000
    }
1001

    
1002
    ops.notify = audio_capture_notify;
1003
    ops.destroy = audio_capture_destroy;
1004
    ops.capture = audio_capture;
1005

    
1006
    vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1007
    if (!vs->audio_cap) {
1008
        monitor_printf(default_mon, "Failed to add audio capture\n");
1009
    }
1010
}
1011

    
1012
static void audio_del(VncState *vs)
1013
{
1014
    if (vs->audio_cap) {
1015
        AUD_del_capture(vs->audio_cap, vs);
1016
        vs->audio_cap = NULL;
1017
    }
1018
}
1019

    
1020
static void vnc_disconnect_start(VncState *vs)
1021
{
1022
    if (vs->csock == -1)
1023
        return;
1024
    vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1025
    qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1026
    closesocket(vs->csock);
1027
    vs->csock = -1;
1028
}
1029

    
1030
static void vnc_disconnect_finish(VncState *vs)
1031
{
1032
    int i;
1033

    
1034
    vnc_jobs_join(vs); /* Wait encoding jobs */
1035

    
1036
    vnc_lock_output(vs);
1037
    vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1038

    
1039
    buffer_free(&vs->input);
1040
    buffer_free(&vs->output);
1041

    
1042
    qobject_decref(vs->info);
1043

    
1044
    vnc_zlib_clear(vs);
1045
    vnc_tight_clear(vs);
1046
    vnc_zrle_clear(vs);
1047

    
1048
#ifdef CONFIG_VNC_TLS
1049
    vnc_tls_client_cleanup(vs);
1050
#endif /* CONFIG_VNC_TLS */
1051
#ifdef CONFIG_VNC_SASL
1052
    vnc_sasl_client_cleanup(vs);
1053
#endif /* CONFIG_VNC_SASL */
1054
    audio_del(vs);
1055
    vnc_release_modifiers(vs);
1056

    
1057
    QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1058

    
1059
    if (QTAILQ_EMPTY(&vs->vd->clients)) {
1060
        dcl->idle = 1;
1061
    }
1062

    
1063
    qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1064
    vnc_remove_timer(vs->vd);
1065
    if (vs->vd->lock_key_sync)
1066
        qemu_remove_led_event_handler(vs->led);
1067
    vnc_unlock_output(vs);
1068

    
1069
#ifdef CONFIG_VNC_THREAD
1070
    qemu_mutex_destroy(&vs->output_mutex);
1071
    qemu_bh_delete(vs->bh);
1072
    buffer_free(&vs->jobs_buffer);
1073
#endif
1074

    
1075
    for (i = 0; i < VNC_STAT_ROWS; ++i) {
1076
        g_free(vs->lossy_rect[i]);
1077
    }
1078
    g_free(vs->lossy_rect);
1079
    g_free(vs);
1080
}
1081

    
1082
int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1083
{
1084
    if (ret == 0 || ret == -1) {
1085
        if (ret == -1) {
1086
            switch (last_errno) {
1087
                case EINTR:
1088
                case EAGAIN:
1089
#ifdef _WIN32
1090
                case WSAEWOULDBLOCK:
1091
#endif
1092
                    return 0;
1093
                default:
1094
                    break;
1095
            }
1096
        }
1097

    
1098
        VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1099
                  ret, ret < 0 ? last_errno : 0);
1100
        vnc_disconnect_start(vs);
1101

    
1102
        return 0;
1103
    }
1104
    return ret;
1105
}
1106

    
1107

    
1108
void vnc_client_error(VncState *vs)
1109
{
1110
    VNC_DEBUG("Closing down client sock: protocol error\n");
1111
    vnc_disconnect_start(vs);
1112
}
1113

    
1114

    
1115
/*
1116
 * Called to write a chunk of data to the client socket. The data may
1117
 * be the raw data, or may have already been encoded by SASL.
1118
 * The data will be written either straight onto the socket, or
1119
 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1120
 *
1121
 * NB, it is theoretically possible to have 2 layers of encryption,
1122
 * both SASL, and this TLS layer. It is highly unlikely in practice
1123
 * though, since SASL encryption will typically be a no-op if TLS
1124
 * is active
1125
 *
1126
 * Returns the number of bytes written, which may be less than
1127
 * the requested 'datalen' if the socket would block. Returns
1128
 * -1 on error, and disconnects the client socket.
1129
 */
1130
long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1131
{
1132
    long ret;
1133
#ifdef CONFIG_VNC_TLS
1134
    if (vs->tls.session) {
1135
        ret = gnutls_write(vs->tls.session, data, datalen);
1136
        if (ret < 0) {
1137
            if (ret == GNUTLS_E_AGAIN)
1138
                errno = EAGAIN;
1139
            else
1140
                errno = EIO;
1141
            ret = -1;
1142
        }
1143
    } else
1144
#endif /* CONFIG_VNC_TLS */
1145
        ret = send(vs->csock, (const void *)data, datalen, 0);
1146
    VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1147
    return vnc_client_io_error(vs, ret, socket_error());
1148
}
1149

    
1150

    
1151
/*
1152
 * Called to write buffered data to the client socket, when not
1153
 * using any SASL SSF encryption layers. Will write as much data
1154
 * as possible without blocking. If all buffered data is written,
1155
 * will switch the FD poll() handler back to read monitoring.
1156
 *
1157
 * Returns the number of bytes written, which may be less than
1158
 * the buffered output data if the socket would block. Returns
1159
 * -1 on error, and disconnects the client socket.
1160
 */
1161
static long vnc_client_write_plain(VncState *vs)
1162
{
1163
    long ret;
1164

    
1165
#ifdef CONFIG_VNC_SASL
1166
    VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1167
              vs->output.buffer, vs->output.capacity, vs->output.offset,
1168
              vs->sasl.waitWriteSSF);
1169

    
1170
    if (vs->sasl.conn &&
1171
        vs->sasl.runSSF &&
1172
        vs->sasl.waitWriteSSF) {
1173
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1174
        if (ret)
1175
            vs->sasl.waitWriteSSF -= ret;
1176
    } else
1177
#endif /* CONFIG_VNC_SASL */
1178
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1179
    if (!ret)
1180
        return 0;
1181

    
1182
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1183
    vs->output.offset -= ret;
1184

    
1185
    if (vs->output.offset == 0) {
1186
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1187
    }
1188

    
1189
    return ret;
1190
}
1191

    
1192

    
1193
/*
1194
 * First function called whenever there is data to be written to
1195
 * the client socket. Will delegate actual work according to whether
1196
 * SASL SSF layers are enabled (thus requiring encryption calls)
1197
 */
1198
static void vnc_client_write_locked(void *opaque)
1199
{
1200
    VncState *vs = opaque;
1201

    
1202
#ifdef CONFIG_VNC_SASL
1203
    if (vs->sasl.conn &&
1204
        vs->sasl.runSSF &&
1205
        !vs->sasl.waitWriteSSF) {
1206
        vnc_client_write_sasl(vs);
1207
    } else
1208
#endif /* CONFIG_VNC_SASL */
1209
        vnc_client_write_plain(vs);
1210
}
1211

    
1212
void vnc_client_write(void *opaque)
1213
{
1214
    VncState *vs = opaque;
1215

    
1216
    vnc_lock_output(vs);
1217
    if (vs->output.offset) {
1218
        vnc_client_write_locked(opaque);
1219
    } else if (vs->csock != -1) {
1220
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1221
    }
1222
    vnc_unlock_output(vs);
1223
}
1224

    
1225
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1226
{
1227
    vs->read_handler = func;
1228
    vs->read_handler_expect = expecting;
1229
}
1230

    
1231

    
1232
/*
1233
 * Called to read a chunk of data from the client socket. The data may
1234
 * be the raw data, or may need to be further decoded by SASL.
1235
 * The data will be read either straight from to the socket, or
1236
 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1237
 *
1238
 * NB, it is theoretically possible to have 2 layers of encryption,
1239
 * both SASL, and this TLS layer. It is highly unlikely in practice
1240
 * though, since SASL encryption will typically be a no-op if TLS
1241
 * is active
1242
 *
1243
 * Returns the number of bytes read, which may be less than
1244
 * the requested 'datalen' if the socket would block. Returns
1245
 * -1 on error, and disconnects the client socket.
1246
 */
1247
long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1248
{
1249
    long ret;
1250
#ifdef CONFIG_VNC_TLS
1251
    if (vs->tls.session) {
1252
        ret = gnutls_read(vs->tls.session, data, datalen);
1253
        if (ret < 0) {
1254
            if (ret == GNUTLS_E_AGAIN)
1255
                errno = EAGAIN;
1256
            else
1257
                errno = EIO;
1258
            ret = -1;
1259
        }
1260
    } else
1261
#endif /* CONFIG_VNC_TLS */
1262
        ret = qemu_recv(vs->csock, data, datalen, 0);
1263
    VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1264
    return vnc_client_io_error(vs, ret, socket_error());
1265
}
1266

    
1267

    
1268
/*
1269
 * Called to read data from the client socket to the input buffer,
1270
 * when not using any SASL SSF encryption layers. Will read as much
1271
 * data as possible without blocking.
1272
 *
1273
 * Returns the number of bytes read. Returns -1 on error, and
1274
 * disconnects the client socket.
1275
 */
1276
static long vnc_client_read_plain(VncState *vs)
1277
{
1278
    int ret;
1279
    VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1280
              vs->input.buffer, vs->input.capacity, vs->input.offset);
1281
    buffer_reserve(&vs->input, 4096);
1282
    ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1283
    if (!ret)
1284
        return 0;
1285
    vs->input.offset += ret;
1286
    return ret;
1287
}
1288

    
1289
#ifdef CONFIG_VNC_THREAD
1290
static void vnc_jobs_bh(void *opaque)
1291
{
1292
    VncState *vs = opaque;
1293

    
1294
    vnc_jobs_consume_buffer(vs);
1295
}
1296
#endif
1297

    
1298
/*
1299
 * First function called whenever there is more data to be read from
1300
 * the client socket. Will delegate actual work according to whether
1301
 * SASL SSF layers are enabled (thus requiring decryption calls)
1302
 */
1303
void vnc_client_read(void *opaque)
1304
{
1305
    VncState *vs = opaque;
1306
    long ret;
1307

    
1308
#ifdef CONFIG_VNC_SASL
1309
    if (vs->sasl.conn && vs->sasl.runSSF)
1310
        ret = vnc_client_read_sasl(vs);
1311
    else
1312
#endif /* CONFIG_VNC_SASL */
1313
        ret = vnc_client_read_plain(vs);
1314
    if (!ret) {
1315
        if (vs->csock == -1)
1316
            vnc_disconnect_finish(vs);
1317
        return;
1318
    }
1319

    
1320
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1321
        size_t len = vs->read_handler_expect;
1322
        int ret;
1323

    
1324
        ret = vs->read_handler(vs, vs->input.buffer, len);
1325
        if (vs->csock == -1) {
1326
            vnc_disconnect_finish(vs);
1327
            return;
1328
        }
1329

    
1330
        if (!ret) {
1331
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1332
            vs->input.offset -= len;
1333
        } else {
1334
            vs->read_handler_expect = ret;
1335
        }
1336
    }
1337
}
1338

    
1339
void vnc_write(VncState *vs, const void *data, size_t len)
1340
{
1341
    buffer_reserve(&vs->output, len);
1342

    
1343
    if (vs->csock != -1 && buffer_empty(&vs->output)) {
1344
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1345
    }
1346

    
1347
    buffer_append(&vs->output, data, len);
1348
}
1349

    
1350
void vnc_write_s32(VncState *vs, int32_t value)
1351
{
1352
    vnc_write_u32(vs, *(uint32_t *)&value);
1353
}
1354

    
1355
void vnc_write_u32(VncState *vs, uint32_t value)
1356
{
1357
    uint8_t buf[4];
1358

    
1359
    buf[0] = (value >> 24) & 0xFF;
1360
    buf[1] = (value >> 16) & 0xFF;
1361
    buf[2] = (value >>  8) & 0xFF;
1362
    buf[3] = value & 0xFF;
1363

    
1364
    vnc_write(vs, buf, 4);
1365
}
1366

    
1367
void vnc_write_u16(VncState *vs, uint16_t value)
1368
{
1369
    uint8_t buf[2];
1370

    
1371
    buf[0] = (value >> 8) & 0xFF;
1372
    buf[1] = value & 0xFF;
1373

    
1374
    vnc_write(vs, buf, 2);
1375
}
1376

    
1377
void vnc_write_u8(VncState *vs, uint8_t value)
1378
{
1379
    vnc_write(vs, (char *)&value, 1);
1380
}
1381

    
1382
void vnc_flush(VncState *vs)
1383
{
1384
    vnc_lock_output(vs);
1385
    if (vs->csock != -1 && vs->output.offset) {
1386
        vnc_client_write_locked(vs);
1387
    }
1388
    vnc_unlock_output(vs);
1389
}
1390

    
1391
uint8_t read_u8(uint8_t *data, size_t offset)
1392
{
1393
    return data[offset];
1394
}
1395

    
1396
uint16_t read_u16(uint8_t *data, size_t offset)
1397
{
1398
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1399
}
1400

    
1401
int32_t read_s32(uint8_t *data, size_t offset)
1402
{
1403
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1404
                     (data[offset + 2] << 8) | data[offset + 3]);
1405
}
1406

    
1407
uint32_t read_u32(uint8_t *data, size_t offset)
1408
{
1409
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1410
            (data[offset + 2] << 8) | data[offset + 3]);
1411
}
1412

    
1413
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1414
{
1415
}
1416

    
1417
static void check_pointer_type_change(Notifier *notifier, void *data)
1418
{
1419
    VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1420
    int absolute = kbd_mouse_is_absolute();
1421

    
1422
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1423
        vnc_lock_output(vs);
1424
        vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1425
        vnc_write_u8(vs, 0);
1426
        vnc_write_u16(vs, 1);
1427
        vnc_framebuffer_update(vs, absolute, 0,
1428
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1429
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
1430
        vnc_unlock_output(vs);
1431
        vnc_flush(vs);
1432
    }
1433
    vs->absolute = absolute;
1434
}
1435

    
1436
static void pointer_event(VncState *vs, int button_mask, int x, int y)
1437
{
1438
    int buttons = 0;
1439
    int dz = 0;
1440

    
1441
    if (button_mask & 0x01)
1442
        buttons |= MOUSE_EVENT_LBUTTON;
1443
    if (button_mask & 0x02)
1444
        buttons |= MOUSE_EVENT_MBUTTON;
1445
    if (button_mask & 0x04)
1446
        buttons |= MOUSE_EVENT_RBUTTON;
1447
    if (button_mask & 0x08)
1448
        dz = -1;
1449
    if (button_mask & 0x10)
1450
        dz = 1;
1451

    
1452
    if (vs->absolute) {
1453
        kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
1454
                          x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
1455
                        ds_get_height(vs->ds) > 1 ?
1456
                          y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1457
                        dz, buttons);
1458
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1459
        x -= 0x7FFF;
1460
        y -= 0x7FFF;
1461

    
1462
        kbd_mouse_event(x, y, dz, buttons);
1463
    } else {
1464
        if (vs->last_x != -1)
1465
            kbd_mouse_event(x - vs->last_x,
1466
                            y - vs->last_y,
1467
                            dz, buttons);
1468
        vs->last_x = x;
1469
        vs->last_y = y;
1470
    }
1471
}
1472

    
1473
static void reset_keys(VncState *vs)
1474
{
1475
    int i;
1476
    for(i = 0; i < 256; i++) {
1477
        if (vs->modifiers_state[i]) {
1478
            if (i & SCANCODE_GREY)
1479
                kbd_put_keycode(SCANCODE_EMUL0);
1480
            kbd_put_keycode(i | SCANCODE_UP);
1481
            vs->modifiers_state[i] = 0;
1482
        }
1483
    }
1484
}
1485

    
1486
static void press_key(VncState *vs, int keysym)
1487
{
1488
    int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1489
    if (keycode & SCANCODE_GREY)
1490
        kbd_put_keycode(SCANCODE_EMUL0);
1491
    kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1492
    if (keycode & SCANCODE_GREY)
1493
        kbd_put_keycode(SCANCODE_EMUL0);
1494
    kbd_put_keycode(keycode | SCANCODE_UP);
1495
}
1496

    
1497
static void kbd_leds(void *opaque, int ledstate)
1498
{
1499
    VncState *vs = opaque;
1500
    int caps, num;
1501

    
1502
    caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1503
    num  = ledstate & QEMU_NUM_LOCK_LED  ? 1 : 0;
1504

    
1505
    if (vs->modifiers_state[0x3a] != caps) {
1506
        vs->modifiers_state[0x3a] = caps;
1507
    }
1508
    if (vs->modifiers_state[0x45] != num) {
1509
        vs->modifiers_state[0x45] = num;
1510
    }
1511
}
1512

    
1513
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1514
{
1515
    /* QEMU console switch */
1516
    switch(keycode) {
1517
    case 0x2a:                          /* Left Shift */
1518
    case 0x36:                          /* Right Shift */
1519
    case 0x1d:                          /* Left CTRL */
1520
    case 0x9d:                          /* Right CTRL */
1521
    case 0x38:                          /* Left ALT */
1522
    case 0xb8:                          /* Right ALT */
1523
        if (down)
1524
            vs->modifiers_state[keycode] = 1;
1525
        else
1526
            vs->modifiers_state[keycode] = 0;
1527
        break;
1528
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1529
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1530
            /* Reset the modifiers sent to the current console */
1531
            reset_keys(vs);
1532
            console_select(keycode - 0x02);
1533
            return;
1534
        }
1535
        break;
1536
    case 0x3a:                        /* CapsLock */
1537
    case 0x45:                        /* NumLock */
1538
        if (down)
1539
            vs->modifiers_state[keycode] ^= 1;
1540
        break;
1541
    }
1542

    
1543
    if (down && vs->vd->lock_key_sync &&
1544
        keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1545
        /* If the numlock state needs to change then simulate an additional
1546
           keypress before sending this one.  This will happen if the user
1547
           toggles numlock away from the VNC window.
1548
        */
1549
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1550
            if (!vs->modifiers_state[0x45]) {
1551
                vs->modifiers_state[0x45] = 1;
1552
                press_key(vs, 0xff7f);
1553
            }
1554
        } else {
1555
            if (vs->modifiers_state[0x45]) {
1556
                vs->modifiers_state[0x45] = 0;
1557
                press_key(vs, 0xff7f);
1558
            }
1559
        }
1560
    }
1561

    
1562
    if (down && vs->vd->lock_key_sync &&
1563
        ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1564
        /* If the capslock state needs to change then simulate an additional
1565
           keypress before sending this one.  This will happen if the user
1566
           toggles capslock away from the VNC window.
1567
        */
1568
        int uppercase = !!(sym >= 'A' && sym <= 'Z');
1569
        int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1570
        int capslock = !!(vs->modifiers_state[0x3a]);
1571
        if (capslock) {
1572
            if (uppercase == shift) {
1573
                vs->modifiers_state[0x3a] = 0;
1574
                press_key(vs, 0xffe5);
1575
            }
1576
        } else {
1577
            if (uppercase != shift) {
1578
                vs->modifiers_state[0x3a] = 1;
1579
                press_key(vs, 0xffe5);
1580
            }
1581
        }
1582
    }
1583

    
1584
    if (is_graphic_console()) {
1585
        if (keycode & SCANCODE_GREY)
1586
            kbd_put_keycode(SCANCODE_EMUL0);
1587
        if (down)
1588
            kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1589
        else
1590
            kbd_put_keycode(keycode | SCANCODE_UP);
1591
    } else {
1592
        bool numlock = vs->modifiers_state[0x45];
1593
        bool control = (vs->modifiers_state[0x1d] ||
1594
                        vs->modifiers_state[0x9d]);
1595
        /* QEMU console emulation */
1596
        if (down) {
1597
            switch (keycode) {
1598
            case 0x2a:                          /* Left Shift */
1599
            case 0x36:                          /* Right Shift */
1600
            case 0x1d:                          /* Left CTRL */
1601
            case 0x9d:                          /* Right CTRL */
1602
            case 0x38:                          /* Left ALT */
1603
            case 0xb8:                          /* Right ALT */
1604
                break;
1605
            case 0xc8:
1606
                kbd_put_keysym(QEMU_KEY_UP);
1607
                break;
1608
            case 0xd0:
1609
                kbd_put_keysym(QEMU_KEY_DOWN);
1610
                break;
1611
            case 0xcb:
1612
                kbd_put_keysym(QEMU_KEY_LEFT);
1613
                break;
1614
            case 0xcd:
1615
                kbd_put_keysym(QEMU_KEY_RIGHT);
1616
                break;
1617
            case 0xd3:
1618
                kbd_put_keysym(QEMU_KEY_DELETE);
1619
                break;
1620
            case 0xc7:
1621
                kbd_put_keysym(QEMU_KEY_HOME);
1622
                break;
1623
            case 0xcf:
1624
                kbd_put_keysym(QEMU_KEY_END);
1625
                break;
1626
            case 0xc9:
1627
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1628
                break;
1629
            case 0xd1:
1630
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1631
                break;
1632

    
1633
            case 0x47:
1634
                kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1635
                break;
1636
            case 0x48:
1637
                kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1638
                break;
1639
            case 0x49:
1640
                kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1641
                break;
1642
            case 0x4b:
1643
                kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1644
                break;
1645
            case 0x4c:
1646
                kbd_put_keysym('5');
1647
                break;
1648
            case 0x4d:
1649
                kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1650
                break;
1651
            case 0x4f:
1652
                kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1653
                break;
1654
            case 0x50:
1655
                kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1656
                break;
1657
            case 0x51:
1658
                kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1659
                break;
1660
            case 0x52:
1661
                kbd_put_keysym('0');
1662
                break;
1663
            case 0x53:
1664
                kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1665
                break;
1666

    
1667
            case 0xb5:
1668
                kbd_put_keysym('/');
1669
                break;
1670
            case 0x37:
1671
                kbd_put_keysym('*');
1672
                break;
1673
            case 0x4a:
1674
                kbd_put_keysym('-');
1675
                break;
1676
            case 0x4e:
1677
                kbd_put_keysym('+');
1678
                break;
1679
            case 0x9c:
1680
                kbd_put_keysym('\n');
1681
                break;
1682

    
1683
            default:
1684
                if (control) {
1685
                    kbd_put_keysym(sym & 0x1f);
1686
                } else {
1687
                    kbd_put_keysym(sym);
1688
                }
1689
                break;
1690
            }
1691
        }
1692
    }
1693
}
1694

    
1695
static void vnc_release_modifiers(VncState *vs)
1696
{
1697
    static const int keycodes[] = {
1698
        /* shift, control, alt keys, both left & right */
1699
        0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1700
    };
1701
    int i, keycode;
1702

    
1703
    if (!is_graphic_console()) {
1704
        return;
1705
    }
1706
    for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1707
        keycode = keycodes[i];
1708
        if (!vs->modifiers_state[keycode]) {
1709
            continue;
1710
        }
1711
        if (keycode & SCANCODE_GREY) {
1712
            kbd_put_keycode(SCANCODE_EMUL0);
1713
        }
1714
        kbd_put_keycode(keycode | SCANCODE_UP);
1715
    }
1716
}
1717

    
1718
static void key_event(VncState *vs, int down, uint32_t sym)
1719
{
1720
    int keycode;
1721
    int lsym = sym;
1722

    
1723
    if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
1724
        lsym = lsym - 'A' + 'a';
1725
    }
1726

    
1727
    keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1728
    do_key_event(vs, down, keycode, sym);
1729
}
1730

    
1731
static void ext_key_event(VncState *vs, int down,
1732
                          uint32_t sym, uint16_t keycode)
1733
{
1734
    /* if the user specifies a keyboard layout, always use it */
1735
    if (keyboard_layout)
1736
        key_event(vs, down, sym);
1737
    else
1738
        do_key_event(vs, down, keycode, sym);
1739
}
1740

    
1741
static void framebuffer_update_request(VncState *vs, int incremental,
1742
                                       int x_position, int y_position,
1743
                                       int w, int h)
1744
{
1745
    int i;
1746
    const size_t width = ds_get_width(vs->ds) / 16;
1747

    
1748
    if (y_position > ds_get_height(vs->ds))
1749
        y_position = ds_get_height(vs->ds);
1750
    if (y_position + h >= ds_get_height(vs->ds))
1751
        h = ds_get_height(vs->ds) - y_position;
1752

    
1753
    vs->need_update = 1;
1754
    if (!incremental) {
1755
        vs->force_update = 1;
1756
        for (i = 0; i < h; i++) {
1757
            bitmap_set(vs->dirty[y_position + i], 0, width);
1758
            bitmap_clear(vs->dirty[y_position + i], width,
1759
                         VNC_DIRTY_BITS - width);
1760
        }
1761
    }
1762
}
1763

    
1764
static void send_ext_key_event_ack(VncState *vs)
1765
{
1766
    vnc_lock_output(vs);
1767
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1768
    vnc_write_u8(vs, 0);
1769
    vnc_write_u16(vs, 1);
1770
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1771
                           VNC_ENCODING_EXT_KEY_EVENT);
1772
    vnc_unlock_output(vs);
1773
    vnc_flush(vs);
1774
}
1775

    
1776
static void send_ext_audio_ack(VncState *vs)
1777
{
1778
    vnc_lock_output(vs);
1779
    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1780
    vnc_write_u8(vs, 0);
1781
    vnc_write_u16(vs, 1);
1782
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1783
                           VNC_ENCODING_AUDIO);
1784
    vnc_unlock_output(vs);
1785
    vnc_flush(vs);
1786
}
1787

    
1788
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1789
{
1790
    int i;
1791
    unsigned int enc = 0;
1792

    
1793
    vs->features = 0;
1794
    vs->vnc_encoding = 0;
1795
    vs->tight.compression = 9;
1796
    vs->tight.quality = -1; /* Lossless by default */
1797
    vs->absolute = -1;
1798

    
1799
    /*
1800
     * Start from the end because the encodings are sent in order of preference.
1801
     * This way the preferred encoding (first encoding defined in the array)
1802
     * will be set at the end of the loop.
1803
     */
1804
    for (i = n_encodings - 1; i >= 0; i--) {
1805
        enc = encodings[i];
1806
        switch (enc) {
1807
        case VNC_ENCODING_RAW:
1808
            vs->vnc_encoding = enc;
1809
            break;
1810
        case VNC_ENCODING_COPYRECT:
1811
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1812
            break;
1813
        case VNC_ENCODING_HEXTILE:
1814
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1815
            vs->vnc_encoding = enc;
1816
            break;
1817
        case VNC_ENCODING_TIGHT:
1818
            vs->features |= VNC_FEATURE_TIGHT_MASK;
1819
            vs->vnc_encoding = enc;
1820
            break;
1821
        case VNC_ENCODING_TIGHT_PNG:
1822
            vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1823
            vs->vnc_encoding = enc;
1824
            break;
1825
        case VNC_ENCODING_ZLIB:
1826
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1827
            vs->vnc_encoding = enc;
1828
            break;
1829
        case VNC_ENCODING_ZRLE:
1830
            vs->features |= VNC_FEATURE_ZRLE_MASK;
1831
            vs->vnc_encoding = enc;
1832
            break;
1833
        case VNC_ENCODING_ZYWRLE:
1834
            vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1835
            vs->vnc_encoding = enc;
1836
            break;
1837
        case VNC_ENCODING_DESKTOPRESIZE:
1838
            vs->features |= VNC_FEATURE_RESIZE_MASK;
1839
            break;
1840
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
1841
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1842
            break;
1843
        case VNC_ENCODING_RICH_CURSOR:
1844
            vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1845
            break;
1846
        case VNC_ENCODING_EXT_KEY_EVENT:
1847
            send_ext_key_event_ack(vs);
1848
            break;
1849
        case VNC_ENCODING_AUDIO:
1850
            send_ext_audio_ack(vs);
1851
            break;
1852
        case VNC_ENCODING_WMVi:
1853
            vs->features |= VNC_FEATURE_WMVI_MASK;
1854
            break;
1855
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1856
            vs->tight.compression = (enc & 0x0F);
1857
            break;
1858
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1859
            if (vs->vd->lossy) {
1860
                vs->tight.quality = (enc & 0x0F);
1861
            }
1862
            break;
1863
        default:
1864
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1865
            break;
1866
        }
1867
    }
1868
    vnc_desktop_resize(vs);
1869
    check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1870
}
1871

    
1872
static void set_pixel_conversion(VncState *vs)
1873
{
1874
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1875
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
1876
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1877
        vs->write_pixels = vnc_write_pixels_copy;
1878
        vnc_hextile_set_pixel_conversion(vs, 0);
1879
    } else {
1880
        vs->write_pixels = vnc_write_pixels_generic;
1881
        vnc_hextile_set_pixel_conversion(vs, 1);
1882
    }
1883
}
1884

    
1885
static void set_pixel_format(VncState *vs,
1886
                             int bits_per_pixel, int depth,
1887
                             int big_endian_flag, int true_color_flag,
1888
                             int red_max, int green_max, int blue_max,
1889
                             int red_shift, int green_shift, int blue_shift)
1890
{
1891
    if (!true_color_flag) {
1892
        vnc_client_error(vs);
1893
        return;
1894
    }
1895

    
1896
    vs->clientds = *(vs->vd->guest.ds);
1897
    vs->clientds.pf.rmax = red_max;
1898
    vs->clientds.pf.rbits = hweight_long(red_max);
1899
    vs->clientds.pf.rshift = red_shift;
1900
    vs->clientds.pf.rmask = red_max << red_shift;
1901
    vs->clientds.pf.gmax = green_max;
1902
    vs->clientds.pf.gbits = hweight_long(green_max);
1903
    vs->clientds.pf.gshift = green_shift;
1904
    vs->clientds.pf.gmask = green_max << green_shift;
1905
    vs->clientds.pf.bmax = blue_max;
1906
    vs->clientds.pf.bbits = hweight_long(blue_max);
1907
    vs->clientds.pf.bshift = blue_shift;
1908
    vs->clientds.pf.bmask = blue_max << blue_shift;
1909
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1910
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1911
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1912
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1913

    
1914
    set_pixel_conversion(vs);
1915

    
1916
    vga_hw_invalidate();
1917
    vga_hw_update();
1918
}
1919

    
1920
static void pixel_format_message (VncState *vs) {
1921
    char pad[3] = { 0, 0, 0 };
1922

    
1923
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1924
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1925

    
1926
#ifdef HOST_WORDS_BIGENDIAN
1927
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1928
#else
1929
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1930
#endif
1931
    vnc_write_u8(vs, 1);             /* true-color-flag */
1932
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
1933
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
1934
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
1935
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
1936
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
1937
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1938

    
1939
    vnc_hextile_set_pixel_conversion(vs, 0);
1940

    
1941
    vs->clientds = *(vs->ds->surface);
1942
    vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1943
    vs->write_pixels = vnc_write_pixels_copy;
1944

    
1945
    vnc_write(vs, pad, 3);           /* padding */
1946
}
1947

    
1948
static void vnc_dpy_setdata(DisplayState *ds)
1949
{
1950
    VncDisplay *vd = ds->opaque;
1951

    
1952
    *(vd->guest.ds) = *(ds->surface);
1953
    vnc_dpy_update(ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
1954
}
1955

    
1956
static void vnc_colordepth(VncState *vs)
1957
{
1958
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1959
        /* Sending a WMVi message to notify the client*/
1960
        vnc_lock_output(vs);
1961
        vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1962
        vnc_write_u8(vs, 0);
1963
        vnc_write_u16(vs, 1); /* number of rects */
1964
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
1965
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1966
        pixel_format_message(vs);
1967
        vnc_unlock_output(vs);
1968
        vnc_flush(vs);
1969
    } else {
1970
        set_pixel_conversion(vs);
1971
    }
1972
}
1973

    
1974
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1975
{
1976
    int i;
1977
    uint16_t limit;
1978
    VncDisplay *vd = vs->vd;
1979

    
1980
    if (data[0] > 3) {
1981
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1982
        if (!qemu_timer_expired(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval))
1983
            qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
1984
    }
1985

    
1986
    switch (data[0]) {
1987
    case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
1988
        if (len == 1)
1989
            return 20;
1990

    
1991
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1992
                         read_u8(data, 6), read_u8(data, 7),
1993
                         read_u16(data, 8), read_u16(data, 10),
1994
                         read_u16(data, 12), read_u8(data, 14),
1995
                         read_u8(data, 15), read_u8(data, 16));
1996
        break;
1997
    case VNC_MSG_CLIENT_SET_ENCODINGS:
1998
        if (len == 1)
1999
            return 4;
2000

    
2001
        if (len == 4) {
2002
            limit = read_u16(data, 2);
2003
            if (limit > 0)
2004
                return 4 + (limit * 4);
2005
        } else
2006
            limit = read_u16(data, 2);
2007

    
2008
        for (i = 0; i < limit; i++) {
2009
            int32_t val = read_s32(data, 4 + (i * 4));
2010
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
2011
        }
2012

    
2013
        set_encodings(vs, (int32_t *)(data + 4), limit);
2014
        break;
2015
    case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2016
        if (len == 1)
2017
            return 10;
2018

    
2019
        framebuffer_update_request(vs,
2020
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2021
                                   read_u16(data, 6), read_u16(data, 8));
2022
        break;
2023
    case VNC_MSG_CLIENT_KEY_EVENT:
2024
        if (len == 1)
2025
            return 8;
2026

    
2027
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
2028
        break;
2029
    case VNC_MSG_CLIENT_POINTER_EVENT:
2030
        if (len == 1)
2031
            return 6;
2032

    
2033
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2034
        break;
2035
    case VNC_MSG_CLIENT_CUT_TEXT:
2036
        if (len == 1)
2037
            return 8;
2038

    
2039
        if (len == 8) {
2040
            uint32_t dlen = read_u32(data, 4);
2041
            if (dlen > 0)
2042
                return 8 + dlen;
2043
        }
2044

    
2045
        client_cut_text(vs, read_u32(data, 4), data + 8);
2046
        break;
2047
    case VNC_MSG_CLIENT_QEMU:
2048
        if (len == 1)
2049
            return 2;
2050

    
2051
        switch (read_u8(data, 1)) {
2052
        case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2053
            if (len == 2)
2054
                return 12;
2055

    
2056
            ext_key_event(vs, read_u16(data, 2),
2057
                          read_u32(data, 4), read_u32(data, 8));
2058
            break;
2059
        case VNC_MSG_CLIENT_QEMU_AUDIO:
2060
            if (len == 2)
2061
                return 4;
2062

    
2063
            switch (read_u16 (data, 2)) {
2064
            case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2065
                audio_add(vs);
2066
                break;
2067
            case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2068
                audio_del(vs);
2069
                break;
2070
            case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2071
                if (len == 4)
2072
                    return 10;
2073
                switch (read_u8(data, 4)) {
2074
                case 0: vs->as.fmt = AUD_FMT_U8; break;
2075
                case 1: vs->as.fmt = AUD_FMT_S8; break;
2076
                case 2: vs->as.fmt = AUD_FMT_U16; break;
2077
                case 3: vs->as.fmt = AUD_FMT_S16; break;
2078
                case 4: vs->as.fmt = AUD_FMT_U32; break;
2079
                case 5: vs->as.fmt = AUD_FMT_S32; break;
2080
                default:
2081
                    printf("Invalid audio format %d\n", read_u8(data, 4));
2082
                    vnc_client_error(vs);
2083
                    break;
2084
                }
2085
                vs->as.nchannels = read_u8(data, 5);
2086
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2087
                    printf("Invalid audio channel coount %d\n",
2088
                           read_u8(data, 5));
2089
                    vnc_client_error(vs);
2090
                    break;
2091
                }
2092
                vs->as.freq = read_u32(data, 6);
2093
                break;
2094
            default:
2095
                printf ("Invalid audio message %d\n", read_u8(data, 4));
2096
                vnc_client_error(vs);
2097
                break;
2098
            }
2099
            break;
2100

    
2101
        default:
2102
            printf("Msg: %d\n", read_u16(data, 0));
2103
            vnc_client_error(vs);
2104
            break;
2105
        }
2106
        break;
2107
    default:
2108
        printf("Msg: %d\n", data[0]);
2109
        vnc_client_error(vs);
2110
        break;
2111
    }
2112

    
2113
    vnc_read_when(vs, protocol_client_msg, 1);
2114
    return 0;
2115
}
2116

    
2117
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2118
{
2119
    char buf[1024];
2120
    VncShareMode mode;
2121
    int size;
2122

    
2123
    mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2124
    switch (vs->vd->share_policy) {
2125
    case VNC_SHARE_POLICY_IGNORE:
2126
        /*
2127
         * Ignore the shared flag.  Nothing to do here.
2128
         *
2129
         * Doesn't conform to the rfb spec but is traditional qemu
2130
         * behavior, thus left here as option for compatibility
2131
         * reasons.
2132
         */
2133
        break;
2134
    case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2135
        /*
2136
         * Policy: Allow clients ask for exclusive access.
2137
         *
2138
         * Implementation: When a client asks for exclusive access,
2139
         * disconnect all others. Shared connects are allowed as long
2140
         * as no exclusive connection exists.
2141
         *
2142
         * This is how the rfb spec suggests to handle the shared flag.
2143
         */
2144
        if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2145
            VncState *client;
2146
            QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2147
                if (vs == client) {
2148
                    continue;
2149
                }
2150
                if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2151
                    client->share_mode != VNC_SHARE_MODE_SHARED) {
2152
                    continue;
2153
                }
2154
                vnc_disconnect_start(client);
2155
            }
2156
        }
2157
        if (mode == VNC_SHARE_MODE_SHARED) {
2158
            if (vs->vd->num_exclusive > 0) {
2159
                vnc_disconnect_start(vs);
2160
                return 0;
2161
            }
2162
        }
2163
        break;
2164
    case VNC_SHARE_POLICY_FORCE_SHARED:
2165
        /*
2166
         * Policy: Shared connects only.
2167
         * Implementation: Disallow clients asking for exclusive access.
2168
         *
2169
         * Useful for shared desktop sessions where you don't want
2170
         * someone forgetting to say -shared when running the vnc
2171
         * client disconnect everybody else.
2172
         */
2173
        if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2174
            vnc_disconnect_start(vs);
2175
            return 0;
2176
        }
2177
        break;
2178
    }
2179
    vnc_set_share_mode(vs, mode);
2180

    
2181
    vs->client_width = ds_get_width(vs->ds);
2182
    vs->client_height = ds_get_height(vs->ds);
2183
    vnc_write_u16(vs, vs->client_width);
2184
    vnc_write_u16(vs, vs->client_height);
2185

    
2186
    pixel_format_message(vs);
2187

    
2188
    if (qemu_name)
2189
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2190
    else
2191
        size = snprintf(buf, sizeof(buf), "QEMU");
2192

    
2193
    vnc_write_u32(vs, size);
2194
    vnc_write(vs, buf, size);
2195
    vnc_flush(vs);
2196

    
2197
    vnc_client_cache_auth(vs);
2198
    vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2199

    
2200
    vnc_read_when(vs, protocol_client_msg, 1);
2201

    
2202
    return 0;
2203
}
2204

    
2205
void start_client_init(VncState *vs)
2206
{
2207
    vnc_read_when(vs, protocol_client_init, 1);
2208
}
2209

    
2210
static void make_challenge(VncState *vs)
2211
{
2212
    int i;
2213

    
2214
    srand(time(NULL)+getpid()+getpid()*987654+rand());
2215

    
2216
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2217
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2218
}
2219

    
2220
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2221
{
2222
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2223
    int i, j, pwlen;
2224
    unsigned char key[8];
2225
    time_t now = time(NULL);
2226

    
2227
    if (!vs->vd->password) {
2228
        VNC_DEBUG("No password configured on server");
2229
        goto reject;
2230
    }
2231
    if (vs->vd->expires < now) {
2232
        VNC_DEBUG("Password is expired");
2233
        goto reject;
2234
    }
2235

    
2236
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2237

    
2238
    /* Calculate the expected challenge response */
2239
    pwlen = strlen(vs->vd->password);
2240
    for (i=0; i<sizeof(key); i++)
2241
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
2242
    deskey(key, EN0);
2243
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2244
        des(response+j, response+j);
2245

    
2246
    /* Compare expected vs actual challenge response */
2247
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2248
        VNC_DEBUG("Client challenge response did not match\n");
2249
        goto reject;
2250
    } else {
2251
        VNC_DEBUG("Accepting VNC challenge response\n");
2252
        vnc_write_u32(vs, 0); /* Accept auth */
2253
        vnc_flush(vs);
2254

    
2255
        start_client_init(vs);
2256
    }
2257
    return 0;
2258

    
2259
reject:
2260
    vnc_write_u32(vs, 1); /* Reject auth */
2261
    if (vs->minor >= 8) {
2262
        static const char err[] = "Authentication failed";
2263
        vnc_write_u32(vs, sizeof(err));
2264
        vnc_write(vs, err, sizeof(err));
2265
    }
2266
    vnc_flush(vs);
2267
    vnc_client_error(vs);
2268
    return 0;
2269
}
2270

    
2271
void start_auth_vnc(VncState *vs)
2272
{
2273
    make_challenge(vs);
2274
    /* Send client a 'random' challenge */
2275
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2276
    vnc_flush(vs);
2277

    
2278
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2279
}
2280

    
2281

    
2282
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2283
{
2284
    /* We only advertise 1 auth scheme at a time, so client
2285
     * must pick the one we sent. Verify this */
2286
    if (data[0] != vs->auth) { /* Reject auth */
2287
       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2288
       vnc_write_u32(vs, 1);
2289
       if (vs->minor >= 8) {
2290
           static const char err[] = "Authentication failed";
2291
           vnc_write_u32(vs, sizeof(err));
2292
           vnc_write(vs, err, sizeof(err));
2293
       }
2294
       vnc_client_error(vs);
2295
    } else { /* Accept requested auth */
2296
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2297
       switch (vs->auth) {
2298
       case VNC_AUTH_NONE:
2299
           VNC_DEBUG("Accept auth none\n");
2300
           if (vs->minor >= 8) {
2301
               vnc_write_u32(vs, 0); /* Accept auth completion */
2302
               vnc_flush(vs);
2303
           }
2304
           start_client_init(vs);
2305
           break;
2306

    
2307
       case VNC_AUTH_VNC:
2308
           VNC_DEBUG("Start VNC auth\n");
2309
           start_auth_vnc(vs);
2310
           break;
2311

    
2312
#ifdef CONFIG_VNC_TLS
2313
       case VNC_AUTH_VENCRYPT:
2314
           VNC_DEBUG("Accept VeNCrypt auth\n");
2315
           start_auth_vencrypt(vs);
2316
           break;
2317
#endif /* CONFIG_VNC_TLS */
2318

    
2319
#ifdef CONFIG_VNC_SASL
2320
       case VNC_AUTH_SASL:
2321
           VNC_DEBUG("Accept SASL auth\n");
2322
           start_auth_sasl(vs);
2323
           break;
2324
#endif /* CONFIG_VNC_SASL */
2325

    
2326
       default: /* Should not be possible, but just in case */
2327
           VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2328
           vnc_write_u8(vs, 1);
2329
           if (vs->minor >= 8) {
2330
               static const char err[] = "Authentication failed";
2331
               vnc_write_u32(vs, sizeof(err));
2332
               vnc_write(vs, err, sizeof(err));
2333
           }
2334
           vnc_client_error(vs);
2335
       }
2336
    }
2337
    return 0;
2338
}
2339

    
2340
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2341
{
2342
    char local[13];
2343

    
2344
    memcpy(local, version, 12);
2345
    local[12] = 0;
2346

    
2347
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2348
        VNC_DEBUG("Malformed protocol version %s\n", local);
2349
        vnc_client_error(vs);
2350
        return 0;
2351
    }
2352
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2353
    if (vs->major != 3 ||
2354
        (vs->minor != 3 &&
2355
         vs->minor != 4 &&
2356
         vs->minor != 5 &&
2357
         vs->minor != 7 &&
2358
         vs->minor != 8)) {
2359
        VNC_DEBUG("Unsupported client version\n");
2360
        vnc_write_u32(vs, VNC_AUTH_INVALID);
2361
        vnc_flush(vs);
2362
        vnc_client_error(vs);
2363
        return 0;
2364
    }
2365
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2366
     * as equivalent to v3.3 by servers
2367
     */
2368
    if (vs->minor == 4 || vs->minor == 5)
2369
        vs->minor = 3;
2370

    
2371
    if (vs->minor == 3) {
2372
        if (vs->auth == VNC_AUTH_NONE) {
2373
            VNC_DEBUG("Tell client auth none\n");
2374
            vnc_write_u32(vs, vs->auth);
2375
            vnc_flush(vs);
2376
            start_client_init(vs);
2377
       } else if (vs->auth == VNC_AUTH_VNC) {
2378
            VNC_DEBUG("Tell client VNC auth\n");
2379
            vnc_write_u32(vs, vs->auth);
2380
            vnc_flush(vs);
2381
            start_auth_vnc(vs);
2382
       } else {
2383
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2384
            vnc_write_u32(vs, VNC_AUTH_INVALID);
2385
            vnc_flush(vs);
2386
            vnc_client_error(vs);
2387
       }
2388
    } else {
2389
        VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2390
        vnc_write_u8(vs, 1); /* num auth */
2391
        vnc_write_u8(vs, vs->auth);
2392
        vnc_read_when(vs, protocol_client_auth, 1);
2393
        vnc_flush(vs);
2394
    }
2395

    
2396
    return 0;
2397
}
2398

    
2399
static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2400
{
2401
    struct VncSurface *vs = &vd->guest;
2402

    
2403
    return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2404
}
2405

    
2406
void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2407
{
2408
    int i, j;
2409

    
2410
    w = (x + w) / VNC_STAT_RECT;
2411
    h = (y + h) / VNC_STAT_RECT;
2412
    x /= VNC_STAT_RECT;
2413
    y /= VNC_STAT_RECT;
2414

    
2415
    for (j = y; j <= h; j++) {
2416
        for (i = x; i <= w; i++) {
2417
            vs->lossy_rect[j][i] = 1;
2418
        }
2419
    }
2420
}
2421

    
2422
static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2423
{
2424
    VncState *vs;
2425
    int sty = y / VNC_STAT_RECT;
2426
    int stx = x / VNC_STAT_RECT;
2427
    int has_dirty = 0;
2428

    
2429
    y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2430
    x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2431

    
2432
    QTAILQ_FOREACH(vs, &vd->clients, next) {
2433
        int j;
2434

    
2435
        /* kernel send buffers are full -> refresh later */
2436
        if (vs->output.offset) {
2437
            continue;
2438
        }
2439

    
2440
        if (!vs->lossy_rect[sty][stx]) {
2441
            continue;
2442
        }
2443

    
2444
        vs->lossy_rect[sty][stx] = 0;
2445
        for (j = 0; j < VNC_STAT_RECT; ++j) {
2446
            bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);
2447
        }
2448
        has_dirty++;
2449
    }
2450

    
2451
    return has_dirty;
2452
}
2453

    
2454
static int vnc_update_stats(VncDisplay *vd,  struct timeval * tv)
2455
{
2456
    int x, y;
2457
    struct timeval res;
2458
    int has_dirty = 0;
2459

    
2460
    for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT) {
2461
        for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT) {
2462
            VncRectStat *rect = vnc_stat_rect(vd, x, y);
2463

    
2464
            rect->updated = false;
2465
        }
2466
    }
2467

    
2468
    qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2469

    
2470
    if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2471
        return has_dirty;
2472
    }
2473
    vd->guest.last_freq_check = *tv;
2474

    
2475
    for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT) {
2476
        for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT) {
2477
            VncRectStat *rect= vnc_stat_rect(vd, x, y);
2478
            int count = ARRAY_SIZE(rect->times);
2479
            struct timeval min, max;
2480

    
2481
            if (!timerisset(&rect->times[count - 1])) {
2482
                continue ;
2483
            }
2484

    
2485
            max = rect->times[(rect->idx + count - 1) % count];
2486
            qemu_timersub(tv, &max, &res);
2487

    
2488
            if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2489
                rect->freq = 0;
2490
                has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2491
                memset(rect->times, 0, sizeof (rect->times));
2492
                continue ;
2493
            }
2494

    
2495
            min = rect->times[rect->idx];
2496
            max = rect->times[(rect->idx + count - 1) % count];
2497
            qemu_timersub(&max, &min, &res);
2498

    
2499
            rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2500
            rect->freq /= count;
2501
            rect->freq = 1. / rect->freq;
2502
        }
2503
    }
2504
    return has_dirty;
2505
}
2506

    
2507
double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2508
{
2509
    int i, j;
2510
    double total = 0;
2511
    int num = 0;
2512

    
2513
    x =  (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2514
    y =  (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2515

    
2516
    for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2517
        for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2518
            total += vnc_stat_rect(vs->vd, i, j)->freq;
2519
            num++;
2520
        }
2521
    }
2522

    
2523
    if (num) {
2524
        return total / num;
2525
    } else {
2526
        return 0;
2527
    }
2528
}
2529

    
2530
static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2531
{
2532
    VncRectStat *rect;
2533

    
2534
    rect = vnc_stat_rect(vd, x, y);
2535
    if (rect->updated) {
2536
        return ;
2537
    }
2538
    rect->times[rect->idx] = *tv;
2539
    rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2540
    rect->updated = true;
2541
}
2542

    
2543
static int vnc_refresh_server_surface(VncDisplay *vd)
2544
{
2545
    int y;
2546
    uint8_t *guest_row;
2547
    uint8_t *server_row;
2548
    int cmp_bytes;
2549
    VncState *vs;
2550
    int has_dirty = 0;
2551

    
2552
    struct timeval tv = { 0, 0 };
2553

    
2554
    if (!vd->non_adaptive) {
2555
        gettimeofday(&tv, NULL);
2556
        has_dirty = vnc_update_stats(vd, &tv);
2557
    }
2558

    
2559
    /*
2560
     * Walk through the guest dirty map.
2561
     * Check and copy modified bits from guest to server surface.
2562
     * Update server dirty map.
2563
     */
2564
    cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2565
    if (cmp_bytes > vd->ds->surface->linesize) {
2566
        cmp_bytes = vd->ds->surface->linesize;
2567
    }
2568
    guest_row  = vd->guest.ds->data;
2569
    server_row = vd->server->data;
2570
    for (y = 0; y < vd->guest.ds->height; y++) {
2571
        if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS)) {
2572
            int x;
2573
            uint8_t *guest_ptr;
2574
            uint8_t *server_ptr;
2575

    
2576
            guest_ptr  = guest_row;
2577
            server_ptr = server_row;
2578

    
2579
            for (x = 0; x + 15 < vd->guest.ds->width;
2580
                    x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2581
                if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
2582
                    continue;
2583
                if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2584
                    continue;
2585
                memcpy(server_ptr, guest_ptr, cmp_bytes);
2586
                if (!vd->non_adaptive)
2587
                    vnc_rect_updated(vd, x, y, &tv);
2588
                QTAILQ_FOREACH(vs, &vd->clients, next) {
2589
                    set_bit((x / 16), vs->dirty[y]);
2590
                }
2591
                has_dirty++;
2592
            }
2593
        }
2594
        guest_row  += ds_get_linesize(vd->ds);
2595
        server_row += ds_get_linesize(vd->ds);
2596
    }
2597
    return has_dirty;
2598
}
2599

    
2600
static void vnc_refresh(void *opaque)
2601
{
2602
    VncDisplay *vd = opaque;
2603
    VncState *vs, *vn;
2604
    int has_dirty, rects = 0;
2605

    
2606
    vga_hw_update();
2607

    
2608
    if (vnc_trylock_display(vd)) {
2609
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2610
        qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) +
2611
                       vd->timer_interval);
2612
        return;
2613
    }
2614

    
2615
    has_dirty = vnc_refresh_server_surface(vd);
2616
    vnc_unlock_display(vd);
2617

    
2618
    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2619
        rects += vnc_update_client(vs, has_dirty);
2620
        /* vs might be free()ed here */
2621
    }
2622

    
2623
    /* vd->timer could be NULL now if the last client disconnected,
2624
     * in this case don't update the timer */
2625
    if (vd->timer == NULL)
2626
        return;
2627

    
2628
    if (has_dirty && rects) {
2629
        vd->timer_interval /= 2;
2630
        if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2631
            vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2632
    } else {
2633
        vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2634
        if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2635
            vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2636
    }
2637
    qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
2638
}
2639

    
2640
static void vnc_init_timer(VncDisplay *vd)
2641
{
2642
    vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2643
    if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
2644
        vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
2645
        vnc_dpy_resize(vd->ds);
2646
        vnc_refresh(vd);
2647
    }
2648
}
2649

    
2650
static void vnc_remove_timer(VncDisplay *vd)
2651
{
2652
    if (vd->timer != NULL && QTAILQ_EMPTY(&vd->clients)) {
2653
        qemu_del_timer(vd->timer);
2654
        qemu_free_timer(vd->timer);
2655
        vd->timer = NULL;
2656
    }
2657
}
2658

    
2659
static void vnc_connect(VncDisplay *vd, int csock, int skipauth)
2660
{
2661
    VncState *vs = g_malloc0(sizeof(VncState));
2662
    int i;
2663

    
2664
    vs->csock = csock;
2665

    
2666
    if (skipauth) {
2667
        vs->auth = VNC_AUTH_NONE;
2668
#ifdef CONFIG_VNC_TLS
2669
        vs->subauth = VNC_AUTH_INVALID;
2670
#endif
2671
    } else {
2672
        vs->auth = vd->auth;
2673
#ifdef CONFIG_VNC_TLS
2674
        vs->subauth = vd->subauth;
2675
#endif
2676
    }
2677

    
2678
    vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2679
    for (i = 0; i < VNC_STAT_ROWS; ++i) {
2680
        vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
2681
    }
2682

    
2683
    VNC_DEBUG("New client on socket %d\n", csock);
2684
    dcl->idle = 0;
2685
    socket_set_nonblock(vs->csock);
2686
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2687

    
2688
    vnc_client_cache_addr(vs);
2689
    vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2690
    vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2691

    
2692
    vs->vd = vd;
2693
    vs->ds = vd->ds;
2694
    vs->last_x = -1;
2695
    vs->last_y = -1;
2696

    
2697
    vs->as.freq = 44100;
2698
    vs->as.nchannels = 2;
2699
    vs->as.fmt = AUD_FMT_S16;
2700
    vs->as.endianness = 0;
2701

    
2702
#ifdef CONFIG_VNC_THREAD
2703
    qemu_mutex_init(&vs->output_mutex);
2704
    vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2705
#endif
2706

    
2707
    QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2708

    
2709
    vga_hw_update();
2710

    
2711
    vnc_write(vs, "RFB 003.008\n", 12);
2712
    vnc_flush(vs);
2713
    vnc_read_when(vs, protocol_version, 12);
2714
    reset_keys(vs);
2715
    if (vs->vd->lock_key_sync)
2716
        vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2717

    
2718
    vs->mouse_mode_notifier.notify = check_pointer_type_change;
2719
    qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2720

    
2721
    vnc_init_timer(vd);
2722

    
2723
    /* vs might be free()ed here */
2724
}
2725

    
2726
static void vnc_listen_read(void *opaque)
2727
{
2728
    VncDisplay *vs = opaque;
2729
    struct sockaddr_in addr;
2730
    socklen_t addrlen = sizeof(addr);
2731

    
2732
    /* Catch-up */
2733
    vga_hw_update();
2734

    
2735
    int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2736
    if (csock != -1) {
2737
        vnc_connect(vs, csock, 0);
2738
    }
2739
}
2740

    
2741
void vnc_display_init(DisplayState *ds)
2742
{
2743
    VncDisplay *vs = g_malloc0(sizeof(*vs));
2744

    
2745
    dcl = g_malloc0(sizeof(DisplayChangeListener));
2746

    
2747
    ds->opaque = vs;
2748
    dcl->idle = 1;
2749
    vnc_display = vs;
2750

    
2751
    vs->lsock = -1;
2752

    
2753
    vs->ds = ds;
2754
    QTAILQ_INIT(&vs->clients);
2755
    vs->expires = TIME_MAX;
2756

    
2757
    if (keyboard_layout)
2758
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2759
    else
2760
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2761

    
2762
    if (!vs->kbd_layout)
2763
        exit(1);
2764

    
2765
#ifdef CONFIG_VNC_THREAD
2766
    qemu_mutex_init(&vs->mutex);
2767
    vnc_start_worker_thread();
2768
#endif
2769

    
2770
    dcl->dpy_copy = vnc_dpy_copy;
2771
    dcl->dpy_update = vnc_dpy_update;
2772
    dcl->dpy_resize = vnc_dpy_resize;
2773
    dcl->dpy_setdata = vnc_dpy_setdata;
2774
    register_displaychangelistener(ds, dcl);
2775
    ds->mouse_set = vnc_mouse_set;
2776
    ds->cursor_define = vnc_dpy_cursor_define;
2777
}
2778

    
2779

    
2780
void vnc_display_close(DisplayState *ds)
2781
{
2782
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2783

    
2784
    if (!vs)
2785
        return;
2786
    if (vs->display) {
2787
        g_free(vs->display);
2788
        vs->display = NULL;
2789
    }
2790
    if (vs->lsock != -1) {
2791
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2792
        close(vs->lsock);
2793
        vs->lsock = -1;
2794
    }
2795
    vs->auth = VNC_AUTH_INVALID;
2796
#ifdef CONFIG_VNC_TLS
2797
    vs->subauth = VNC_AUTH_INVALID;
2798
    vs->tls.x509verify = 0;
2799
#endif
2800
}
2801

    
2802
int vnc_display_disable_login(DisplayState *ds)
2803
{
2804
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2805

    
2806
    if (!vs) {
2807
        return -1;
2808
    }
2809

    
2810
    if (vs->password) {
2811
        g_free(vs->password);
2812
    }
2813

    
2814
    vs->password = NULL;
2815
    if (vs->auth == VNC_AUTH_NONE) {
2816
        vs->auth = VNC_AUTH_VNC;
2817
    }
2818

    
2819
    return 0;
2820
}
2821

    
2822
int vnc_display_password(DisplayState *ds, const char *password)
2823
{
2824
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2825

    
2826
    if (!vs) {
2827
        return -EINVAL;
2828
    }
2829

    
2830
    if (!password) {
2831
        /* This is not the intention of this interface but err on the side
2832
           of being safe */
2833
        return vnc_display_disable_login(ds);
2834
    }
2835

    
2836
    if (vs->password) {
2837
        g_free(vs->password);
2838
        vs->password = NULL;
2839
    }
2840
    vs->password = g_strdup(password);
2841
    if (vs->auth == VNC_AUTH_NONE) {
2842
        vs->auth = VNC_AUTH_VNC;
2843
    }
2844

    
2845
    return 0;
2846
}
2847

    
2848
int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2849
{
2850
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2851

    
2852
    vs->expires = expires;
2853
    return 0;
2854
}
2855

    
2856
char *vnc_display_local_addr(DisplayState *ds)
2857
{
2858
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2859
    
2860
    return vnc_socket_local_addr("%s:%s", vs->lsock);
2861
}
2862

    
2863
int vnc_display_open(DisplayState *ds, const char *display)
2864
{
2865
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2866
    const char *options;
2867
    int password = 0;
2868
    int reverse = 0;
2869
#ifdef CONFIG_VNC_TLS
2870
    int tls = 0, x509 = 0;
2871
#endif
2872
#ifdef CONFIG_VNC_SASL
2873
    int sasl = 0;
2874
    int saslErr;
2875
#endif
2876
#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2877
    int acl = 0;
2878
#endif
2879
    int lock_key_sync = 1;
2880

    
2881
    if (!vnc_display)
2882
        return -1;
2883
    vnc_display_close(ds);
2884
    if (strcmp(display, "none") == 0)
2885
        return 0;
2886

    
2887
    if (!(vs->display = strdup(display)))
2888
        return -1;
2889
    vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2890

    
2891
    options = display;
2892
    while ((options = strchr(options, ','))) {
2893
        options++;
2894
        if (strncmp(options, "password", 8) == 0) {
2895
            password = 1; /* Require password auth */
2896
        } else if (strncmp(options, "reverse", 7) == 0) {
2897
            reverse = 1;
2898
        } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
2899
            lock_key_sync = 0;
2900
#ifdef CONFIG_VNC_SASL
2901
        } else if (strncmp(options, "sasl", 4) == 0) {
2902
            sasl = 1; /* Require SASL auth */
2903
#endif
2904
#ifdef CONFIG_VNC_TLS
2905
        } else if (strncmp(options, "tls", 3) == 0) {
2906
            tls = 1; /* Require TLS */
2907
        } else if (strncmp(options, "x509", 4) == 0) {
2908
            char *start, *end;
2909
            x509 = 1; /* Require x509 certificates */
2910
            if (strncmp(options, "x509verify", 10) == 0)
2911
                vs->tls.x509verify = 1; /* ...and verify client certs */
2912

    
2913
            /* Now check for 'x509=/some/path' postfix
2914
             * and use that to setup x509 certificate/key paths */
2915
            start = strchr(options, '=');
2916
            end = strchr(options, ',');
2917
            if (start && (!end || (start < end))) {
2918
                int len = end ? end-(start+1) : strlen(start+1);
2919
                char *path = g_strndup(start + 1, len);
2920

    
2921
                VNC_DEBUG("Trying certificate path '%s'\n", path);
2922
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2923
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2924
                    g_free(path);
2925
                    g_free(vs->display);
2926
                    vs->display = NULL;
2927
                    return -1;
2928
                }
2929
                g_free(path);
2930
            } else {
2931
                fprintf(stderr, "No certificate path provided\n");
2932
                g_free(vs->display);
2933
                vs->display = NULL;
2934
                return -1;
2935
            }
2936
#endif
2937
#if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
2938
        } else if (strncmp(options, "acl", 3) == 0) {
2939
            acl = 1;
2940
#endif
2941
        } else if (strncmp(options, "lossy", 5) == 0) {
2942
            vs->lossy = true;
2943
        } else if (strncmp(options, "non-adapative", 13) == 0) {
2944
            vs->non_adaptive = true;
2945
        } else if (strncmp(options, "share=", 6) == 0) {
2946
            if (strncmp(options+6, "ignore", 6) == 0) {
2947
                vs->share_policy = VNC_SHARE_POLICY_IGNORE;
2948
            } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
2949
                vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2950
            } else if (strncmp(options+6, "force-shared", 12) == 0) {
2951
                vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
2952
            } else {
2953
                fprintf(stderr, "unknown vnc share= option\n");
2954
                g_free(vs->display);
2955
                vs->display = NULL;
2956
                return -1;
2957
            }
2958
        }
2959
    }
2960

    
2961
#ifdef CONFIG_VNC_TLS
2962
    if (acl && x509 && vs->tls.x509verify) {
2963
        if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2964
            fprintf(stderr, "Failed to create x509 dname ACL\n");
2965
            exit(1);
2966
        }
2967
    }
2968
#endif
2969
#ifdef CONFIG_VNC_SASL
2970
    if (acl && sasl) {
2971
        if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2972
            fprintf(stderr, "Failed to create username ACL\n");
2973
            exit(1);
2974
        }
2975
    }
2976
#endif
2977

    
2978
    /*
2979
     * Combinations we support here:
2980
     *
2981
     *  - no-auth                (clear text, no auth)
2982
     *  - password               (clear text, weak auth)
2983
     *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
2984
     *  - tls                    (encrypt, weak anonymous creds, no auth)
2985
     *  - tls + password         (encrypt, weak anonymous creds, weak auth)
2986
     *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
2987
     *  - tls + x509             (encrypt, good x509 creds, no auth)
2988
     *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
2989
     *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
2990
     *
2991
     * NB1. TLS is a stackable auth scheme.
2992
     * NB2. the x509 schemes have option to validate a client cert dname
2993
     */
2994
    if (password) {
2995
#ifdef CONFIG_VNC_TLS
2996
        if (tls) {
2997
            vs->auth = VNC_AUTH_VENCRYPT;
2998
            if (x509) {
2999
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3000
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3001
            } else {
3002
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3003
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3004
            }
3005
        } else {
3006
#endif /* CONFIG_VNC_TLS */
3007
            VNC_DEBUG("Initializing VNC server with password auth\n");
3008
            vs->auth = VNC_AUTH_VNC;
3009
#ifdef CONFIG_VNC_TLS
3010
            vs->subauth = VNC_AUTH_INVALID;
3011
        }
3012
#endif /* CONFIG_VNC_TLS */
3013
#ifdef CONFIG_VNC_SASL
3014
    } else if (sasl) {
3015
#ifdef CONFIG_VNC_TLS
3016
        if (tls) {
3017
            vs->auth = VNC_AUTH_VENCRYPT;
3018
            if (x509) {
3019
                VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3020
                vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3021
            } else {
3022
                VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3023
                vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3024
            }
3025
        } else {
3026
#endif /* CONFIG_VNC_TLS */
3027
            VNC_DEBUG("Initializing VNC server with SASL auth\n");
3028
            vs->auth = VNC_AUTH_SASL;
3029
#ifdef CONFIG_VNC_TLS
3030
            vs->subauth = VNC_AUTH_INVALID;
3031
        }
3032
#endif /* CONFIG_VNC_TLS */
3033
#endif /* CONFIG_VNC_SASL */
3034
    } else {
3035
#ifdef CONFIG_VNC_TLS
3036
        if (tls) {
3037
            vs->auth = VNC_AUTH_VENCRYPT;
3038
            if (x509) {
3039
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3040
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3041
            } else {
3042
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3043
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3044
            }
3045
        } else {
3046
#endif
3047
            VNC_DEBUG("Initializing VNC server with no auth\n");
3048
            vs->auth = VNC_AUTH_NONE;
3049
#ifdef CONFIG_VNC_TLS
3050
            vs->subauth = VNC_AUTH_INVALID;
3051
        }
3052
#endif
3053
    }
3054

    
3055
#ifdef CONFIG_VNC_SASL
3056
    if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3057
        fprintf(stderr, "Failed to initialize SASL auth %s",
3058
                sasl_errstring(saslErr, NULL, NULL));
3059
        g_free(vs->display);
3060
        vs->display = NULL;
3061
        return -1;
3062
    }
3063
#endif
3064
    vs->lock_key_sync = lock_key_sync;
3065

    
3066
    if (reverse) {
3067
        /* connect to viewer */
3068
        if (strncmp(display, "unix:", 5) == 0)
3069
            vs->lsock = unix_connect(display+5);
3070
        else
3071
            vs->lsock = inet_connect(display, true, NULL);
3072
        if (-1 == vs->lsock) {
3073
            g_free(vs->display);
3074
            vs->display = NULL;
3075
            return -1;
3076
        } else {
3077
            int csock = vs->lsock;
3078
            vs->lsock = -1;
3079
            vnc_connect(vs, csock, 0);
3080
        }
3081
        return 0;
3082

    
3083
    } else {
3084
        /* listen for connects */
3085
        char *dpy;
3086
        dpy = g_malloc(256);
3087
        if (strncmp(display, "unix:", 5) == 0) {
3088
            pstrcpy(dpy, 256, "unix:");
3089
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
3090
        } else {
3091
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
3092
        }
3093
        if (-1 == vs->lsock) {
3094
            g_free(dpy);
3095
            return -1;
3096
        } else {
3097
            g_free(vs->display);
3098
            vs->display = dpy;
3099
        }
3100
    }
3101
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
3102
}
3103

    
3104
void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3105
{
3106
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
3107

    
3108
    return vnc_connect(vs, csock, skipauth);
3109
}