Statistics
| Branch: | Revision:

root / vnc.c @ f7b4f61f

History | View | Annotate | Download (72.2 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
8
 * Permission is hereby granted, free of charge, to any person obtaining a copy
9
 * of this software and associated documentation files (the "Software"), to deal
10
 * in the Software without restriction, including without limitation the rights
11
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12
 * copies of the Software, and to permit persons to whom the Software is
13
 * furnished to do so, subject to the following conditions:
14
 *
15
 * The above copyright notice and this permission notice shall be included in
16
 * all copies or substantial portions of the Software.
17
 *
18
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24
 * THE SOFTWARE.
25
 */
26

    
27
#include "vnc.h"
28
#include "sysemu.h"
29
#include "qemu_socket.h"
30
#include "qemu-timer.h"
31
#include "acl.h"
32

    
33
#define VNC_REFRESH_INTERVAL_BASE 30
34
#define VNC_REFRESH_INTERVAL_INC  50
35
#define VNC_REFRESH_INTERVAL_MAX  2000
36

    
37
#include "vnc_keysym.h"
38
#include "d3des.h"
39

    
40
#define count_bits(c, v) { \
41
    for (c = 0; v; v >>= 1) \
42
    { \
43
        c += v & 1; \
44
    } \
45
}
46

    
47

    
48
static VncDisplay *vnc_display; /* needed for info vnc */
49
static DisplayChangeListener *dcl;
50

    
51
static char *addr_to_string(const char *format,
52
                            struct sockaddr_storage *sa,
53
                            socklen_t salen) {
54
    char *addr;
55
    char host[NI_MAXHOST];
56
    char serv[NI_MAXSERV];
57
    int err;
58
    size_t addrlen;
59

    
60
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
61
                           host, sizeof(host),
62
                           serv, sizeof(serv),
63
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
64
        VNC_DEBUG("Cannot resolve address %d: %s\n",
65
                  err, gai_strerror(err));
66
        return NULL;
67
    }
68

    
69
    /* Enough for the existing format + the 2 vars we're
70
     * substituting in. */
71
    addrlen = strlen(format) + strlen(host) + strlen(serv);
72
    addr = qemu_malloc(addrlen + 1);
73
    snprintf(addr, addrlen, format, host, serv);
74
    addr[addrlen] = '\0';
75

    
76
    return addr;
77
}
78

    
79

    
80
char *vnc_socket_local_addr(const char *format, int fd) {
81
    struct sockaddr_storage sa;
82
    socklen_t salen;
83

    
84
    salen = sizeof(sa);
85
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
86
        return NULL;
87

    
88
    return addr_to_string(format, &sa, salen);
89
}
90

    
91
char *vnc_socket_remote_addr(const char *format, int fd) {
92
    struct sockaddr_storage sa;
93
    socklen_t salen;
94

    
95
    salen = sizeof(sa);
96
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
97
        return NULL;
98

    
99
    return addr_to_string(format, &sa, salen);
100
}
101

    
102
static const char *vnc_auth_name(VncDisplay *vd) {
103
    switch (vd->auth) {
104
    case VNC_AUTH_INVALID:
105
        return "invalid";
106
    case VNC_AUTH_NONE:
107
        return "none";
108
    case VNC_AUTH_VNC:
109
        return "vnc";
110
    case VNC_AUTH_RA2:
111
        return "ra2";
112
    case VNC_AUTH_RA2NE:
113
        return "ra2ne";
114
    case VNC_AUTH_TIGHT:
115
        return "tight";
116
    case VNC_AUTH_ULTRA:
117
        return "ultra";
118
    case VNC_AUTH_TLS:
119
        return "tls";
120
    case VNC_AUTH_VENCRYPT:
121
#ifdef CONFIG_VNC_TLS
122
        switch (vd->subauth) {
123
        case VNC_AUTH_VENCRYPT_PLAIN:
124
            return "vencrypt+plain";
125
        case VNC_AUTH_VENCRYPT_TLSNONE:
126
            return "vencrypt+tls+none";
127
        case VNC_AUTH_VENCRYPT_TLSVNC:
128
            return "vencrypt+tls+vnc";
129
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
130
            return "vencrypt+tls+plain";
131
        case VNC_AUTH_VENCRYPT_X509NONE:
132
            return "vencrypt+x509+none";
133
        case VNC_AUTH_VENCRYPT_X509VNC:
134
            return "vencrypt+x509+vnc";
135
        case VNC_AUTH_VENCRYPT_X509PLAIN:
136
            return "vencrypt+x509+plain";
137
        case VNC_AUTH_VENCRYPT_TLSSASL:
138
            return "vencrypt+tls+sasl";
139
        case VNC_AUTH_VENCRYPT_X509SASL:
140
            return "vencrypt+x509+sasl";
141
        default:
142
            return "vencrypt";
143
        }
144
#else
145
        return "vencrypt";
146
#endif
147
    case VNC_AUTH_SASL:
148
        return "sasl";
149
    }
150
    return "unknown";
151
}
152

    
153
static void do_info_vnc_client(Monitor *mon, VncState *client)
154
{
155
    char *clientAddr =
156
        vnc_socket_remote_addr("     address: %s:%s\n",
157
                               client->csock);
158
    if (!clientAddr)
159
        return;
160

    
161
    monitor_printf(mon, "Client:\n");
162
    monitor_printf(mon, "%s", clientAddr);
163
    free(clientAddr);
164

    
165
#ifdef CONFIG_VNC_TLS
166
    if (client->tls.session &&
167
        client->tls.dname)
168
        monitor_printf(mon, "  x509 dname: %s\n", client->tls.dname);
169
    else
170
        monitor_printf(mon, "  x509 dname: none\n");
171
#endif
172
#ifdef CONFIG_VNC_SASL
173
    if (client->sasl.conn &&
174
        client->sasl.username)
175
        monitor_printf(mon, "    username: %s\n", client->sasl.username);
176
    else
177
        monitor_printf(mon, "    username: none\n");
178
#endif
179
}
180

    
181
void do_info_vnc(Monitor *mon)
182
{
183
    if (vnc_display == NULL || vnc_display->display == NULL) {
184
        monitor_printf(mon, "Server: disabled\n");
185
    } else {
186
        char *serverAddr = vnc_socket_local_addr("     address: %s:%s\n",
187
                                                 vnc_display->lsock);
188

    
189
        if (!serverAddr)
190
            return;
191

    
192
        monitor_printf(mon, "Server:\n");
193
        monitor_printf(mon, "%s", serverAddr);
194
        free(serverAddr);
195
        monitor_printf(mon, "        auth: %s\n", vnc_auth_name(vnc_display));
196

    
197
        if (vnc_display->clients) {
198
            VncState *client = vnc_display->clients;
199
            while (client) {
200
                do_info_vnc_client(mon, client);
201
                client = client->next;
202
            }
203
        } else {
204
            monitor_printf(mon, "Client: none\n");
205
        }
206
    }
207
}
208

    
209
static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
210
    return (vs->features & (1 << feature));
211
}
212

    
213
/* TODO
214
   1) Get the queue working for IO.
215
   2) there is some weirdness when using the -S option (the screen is grey
216
      and not totally invalidated
217
   3) resolutions > 1024
218
*/
219

    
220
static int vnc_update_client(VncState *vs, int has_dirty);
221
static void vnc_disconnect_start(VncState *vs);
222
static void vnc_disconnect_finish(VncState *vs);
223
static void vnc_init_timer(VncDisplay *vd);
224
static void vnc_remove_timer(VncDisplay *vd);
225

    
226
static void vnc_colordepth(VncState *vs);
227
static void framebuffer_update_request(VncState *vs, int incremental,
228
                                       int x_position, int y_position,
229
                                       int w, int h);
230
static void vnc_refresh(void *opaque);
231
static int vnc_refresh_server_surface(VncDisplay *vd);
232

    
233
static inline void vnc_set_bit(uint32_t *d, int k)
234
{
235
    d[k >> 5] |= 1 << (k & 0x1f);
236
}
237

    
238
static inline void vnc_clear_bit(uint32_t *d, int k)
239
{
240
    d[k >> 5] &= ~(1 << (k & 0x1f));
241
}
242

    
243
static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
244
{
245
    int j;
246

    
247
    j = 0;
248
    while (n >= 32) {
249
        d[j++] = -1;
250
        n -= 32;
251
    }
252
    if (n > 0)
253
        d[j++] = (1 << n) - 1;
254
    while (j < nb_words)
255
        d[j++] = 0;
256
}
257

    
258
static inline int vnc_get_bit(const uint32_t *d, int k)
259
{
260
    return (d[k >> 5] >> (k & 0x1f)) & 1;
261
}
262

    
263
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
264
                               int nb_words)
265
{
266
    int i;
267
    for(i = 0; i < nb_words; i++) {
268
        if ((d1[i] & d2[i]) != 0)
269
            return 1;
270
    }
271
    return 0;
272
}
273

    
274
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
275
{
276
    int i;
277
    VncDisplay *vd = ds->opaque;
278
    struct VncSurface *s = &vd->guest;
279

    
280
    h += y;
281

    
282
    /* round x down to ensure the loop only spans one 16-pixel block per,
283
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
284
       two 16-pixel blocks but we only mark the first as dirty
285
    */
286
    w += (x % 16);
287
    x -= (x % 16);
288

    
289
    x = MIN(x, s->ds->width);
290
    y = MIN(y, s->ds->height);
291
    w = MIN(x + w, s->ds->width) - x;
292
    h = MIN(h, s->ds->height);
293

    
294
    for (; y < h; y++)
295
        for (i = 0; i < w; i += 16)
296
            vnc_set_bit(s->dirty[y], (x + i) / 16);
297
}
298

    
299
static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
300
                                   int32_t encoding)
301
{
302
    vnc_write_u16(vs, x);
303
    vnc_write_u16(vs, y);
304
    vnc_write_u16(vs, w);
305
    vnc_write_u16(vs, h);
306

    
307
    vnc_write_s32(vs, encoding);
308
}
309

    
310
void buffer_reserve(Buffer *buffer, size_t len)
311
{
312
    if ((buffer->capacity - buffer->offset) < len) {
313
        buffer->capacity += (len + 1024);
314
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
315
        if (buffer->buffer == NULL) {
316
            fprintf(stderr, "vnc: out of memory\n");
317
            exit(1);
318
        }
319
    }
320
}
321

    
322
int buffer_empty(Buffer *buffer)
323
{
324
    return buffer->offset == 0;
325
}
326

    
327
uint8_t *buffer_end(Buffer *buffer)
328
{
329
    return buffer->buffer + buffer->offset;
330
}
331

    
332
void buffer_reset(Buffer *buffer)
333
{
334
        buffer->offset = 0;
335
}
336

    
337
void buffer_append(Buffer *buffer, const void *data, size_t len)
338
{
339
    memcpy(buffer->buffer + buffer->offset, data, len);
340
    buffer->offset += len;
341
}
342

    
343
static void vnc_dpy_resize(DisplayState *ds)
344
{
345
    int size_changed;
346
    VncDisplay *vd = ds->opaque;
347
    VncState *vs = vd->clients;
348

    
349
    /* server surface */
350
    if (!vd->server)
351
        vd->server = qemu_mallocz(sizeof(*vd->server));
352
    if (vd->server->data)
353
        qemu_free(vd->server->data);
354
    *(vd->server) = *(ds->surface);
355
    vd->server->data = qemu_mallocz(vd->server->linesize *
356
                                    vd->server->height);
357

    
358
    /* guest surface */
359
    if (!vd->guest.ds)
360
        vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
361
    if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
362
        console_color_init(ds);
363
    size_changed = ds_get_width(ds) != vd->guest.ds->width ||
364
                   ds_get_height(ds) != vd->guest.ds->height;
365
    *(vd->guest.ds) = *(ds->surface);
366
    memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
367

    
368
    while (vs != NULL) {
369
        vnc_colordepth(vs);
370
        if (size_changed) {
371
            if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
372
                vnc_write_u8(vs, 0);  /* msg id */
373
                vnc_write_u8(vs, 0);
374
                vnc_write_u16(vs, 1); /* number of rects */
375
                vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
376
                        VNC_ENCODING_DESKTOPRESIZE);
377
                vnc_flush(vs);
378
            }
379
        }
380
        memset(vs->dirty, 0xFF, sizeof(vs->dirty));
381
        vs = vs->next;
382
    }
383
}
384

    
385
/* fastest code */
386
static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
387
{
388
    vnc_write(vs, pixels, size);
389
}
390

    
391
/* slowest but generic code. */
392
static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
393
{
394
    uint8_t r, g, b;
395
    VncDisplay *vd = vs->vd;
396

    
397
    r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
398
        vd->server->pf.rbits);
399
    g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
400
        vd->server->pf.gbits);
401
    b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
402
        vd->server->pf.bbits);
403
    v = (r << vs->clientds.pf.rshift) |
404
        (g << vs->clientds.pf.gshift) |
405
        (b << vs->clientds.pf.bshift);
406
    switch(vs->clientds.pf.bytes_per_pixel) {
407
    case 1:
408
        buf[0] = v;
409
        break;
410
    case 2:
411
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
412
            buf[0] = v >> 8;
413
            buf[1] = v;
414
        } else {
415
            buf[1] = v >> 8;
416
            buf[0] = v;
417
        }
418
        break;
419
    default:
420
    case 4:
421
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
422
            buf[0] = v >> 24;
423
            buf[1] = v >> 16;
424
            buf[2] = v >> 8;
425
            buf[3] = v;
426
        } else {
427
            buf[3] = v >> 24;
428
            buf[2] = v >> 16;
429
            buf[1] = v >> 8;
430
            buf[0] = v;
431
        }
432
        break;
433
    }
434
}
435

    
436
static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
437
{
438
    uint8_t buf[4];
439
    VncDisplay *vd = vs->vd;
440

    
441
    if (vd->server->pf.bytes_per_pixel == 4) {
442
        uint32_t *pixels = pixels1;
443
        int n, i;
444
        n = size >> 2;
445
        for(i = 0; i < n; i++) {
446
            vnc_convert_pixel(vs, buf, pixels[i]);
447
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
448
        }
449
    } else if (vd->server->pf.bytes_per_pixel == 2) {
450
        uint16_t *pixels = pixels1;
451
        int n, i;
452
        n = size >> 1;
453
        for(i = 0; i < n; i++) {
454
            vnc_convert_pixel(vs, buf, pixels[i]);
455
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
456
        }
457
    } else if (vd->server->pf.bytes_per_pixel == 1) {
458
        uint8_t *pixels = pixels1;
459
        int n, i;
460
        n = size;
461
        for(i = 0; i < n; i++) {
462
            vnc_convert_pixel(vs, buf, pixels[i]);
463
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
464
        }
465
    } else {
466
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
467
    }
468
}
469

    
470
static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
471
{
472
    int i;
473
    uint8_t *row;
474
    VncDisplay *vd = vs->vd;
475

    
476
    row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
477
    for (i = 0; i < h; i++) {
478
        vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
479
        row += ds_get_linesize(vs->ds);
480
    }
481
}
482

    
483
static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
484
{
485
    ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
486
    ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
487
}
488

    
489
#define BPP 8
490
#include "vnchextile.h"
491
#undef BPP
492

    
493
#define BPP 16
494
#include "vnchextile.h"
495
#undef BPP
496

    
497
#define BPP 32
498
#include "vnchextile.h"
499
#undef BPP
500

    
501
#define GENERIC
502
#define BPP 8
503
#include "vnchextile.h"
504
#undef BPP
505
#undef GENERIC
506

    
507
#define GENERIC
508
#define BPP 16
509
#include "vnchextile.h"
510
#undef BPP
511
#undef GENERIC
512

    
513
#define GENERIC
514
#define BPP 32
515
#include "vnchextile.h"
516
#undef BPP
517
#undef GENERIC
518

    
519
static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
520
{
521
    int i, j;
522
    int has_fg, has_bg;
523
    uint8_t *last_fg, *last_bg;
524
    VncDisplay *vd = vs->vd;
525

    
526
    last_fg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
527
    last_bg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
528
    has_fg = has_bg = 0;
529
    for (j = y; j < (y + h); j += 16) {
530
        for (i = x; i < (x + w); i += 16) {
531
            vs->send_hextile_tile(vs, i, j,
532
                                  MIN(16, x + w - i), MIN(16, y + h - j),
533
                                  last_bg, last_fg, &has_bg, &has_fg);
534
        }
535
    }
536
    free(last_fg);
537
    free(last_bg);
538

    
539
}
540

    
541
static void vnc_zlib_init(VncState *vs)
542
{
543
    int i;
544
    for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
545
        vs->zlib_stream[i].opaque = NULL;
546
}
547

    
548
static void vnc_zlib_start(VncState *vs)
549
{
550
    buffer_reset(&vs->zlib);
551

    
552
    // make the output buffer be the zlib buffer, so we can compress it later
553
    vs->zlib_tmp = vs->output;
554
    vs->output = vs->zlib;
555
}
556

    
557
static int vnc_zlib_stop(VncState *vs, int stream_id)
558
{
559
    z_streamp zstream = &vs->zlib_stream[stream_id];
560
    int previous_out;
561

    
562
    // switch back to normal output/zlib buffers
563
    vs->zlib = vs->output;
564
    vs->output = vs->zlib_tmp;
565

    
566
    // compress the zlib buffer
567

    
568
    // initialize the stream
569
    // XXX need one stream per session
570
    if (zstream->opaque != vs) {
571
        int err;
572

    
573
        VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
574
        VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
575
        zstream->zalloc = Z_NULL;
576
        zstream->zfree = Z_NULL;
577

    
578
        err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
579
                           MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
580

    
581
        if (err != Z_OK) {
582
            fprintf(stderr, "VNC: error initializing zlib\n");
583
            return -1;
584
        }
585

    
586
        zstream->opaque = vs;
587
    }
588

    
589
    // XXX what to do if tight_compression changed in between?
590

    
591
    // reserve memory in output buffer
592
    buffer_reserve(&vs->output, vs->zlib.offset + 64);
593

    
594
    // set pointers
595
    zstream->next_in = vs->zlib.buffer;
596
    zstream->avail_in = vs->zlib.offset;
597
    zstream->next_out = vs->output.buffer + vs->output.offset;
598
    zstream->avail_out = vs->output.capacity - vs->output.offset;
599
    zstream->data_type = Z_BINARY;
600
    previous_out = zstream->total_out;
601

    
602
    // start encoding
603
    if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
604
        fprintf(stderr, "VNC: error during zlib compression\n");
605
        return -1;
606
    }
607

    
608
    vs->output.offset = vs->output.capacity - zstream->avail_out;
609
    return zstream->total_out - previous_out;
610
}
611

    
612
static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
613
{
614
    int old_offset, new_offset, bytes_written;
615

    
616
    vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
617

    
618
    // remember where we put in the follow-up size
619
    old_offset = vs->output.offset;
620
    vnc_write_s32(vs, 0);
621

    
622
    // compress the stream
623
    vnc_zlib_start(vs);
624
    send_framebuffer_update_raw(vs, x, y, w, h);
625
    bytes_written = vnc_zlib_stop(vs, 0);
626

    
627
    if (bytes_written == -1)
628
        return;
629

    
630
    // hack in the size
631
    new_offset = vs->output.offset;
632
    vs->output.offset = old_offset;
633
    vnc_write_u32(vs, bytes_written);
634
    vs->output.offset = new_offset;
635
}
636

    
637
static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
638
{
639
    switch(vs->vnc_encoding) {
640
        case VNC_ENCODING_ZLIB:
641
            send_framebuffer_update_zlib(vs, x, y, w, h);
642
            break;
643
        case VNC_ENCODING_HEXTILE:
644
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
645
            send_framebuffer_update_hextile(vs, x, y, w, h);
646
            break;
647
        default:
648
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
649
            send_framebuffer_update_raw(vs, x, y, w, h);
650
            break;
651
    }
652
}
653

    
654
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
655
{
656
    /* send bitblit op to the vnc client */
657
    vnc_write_u8(vs, 0);  /* msg id */
658
    vnc_write_u8(vs, 0);
659
    vnc_write_u16(vs, 1); /* number of rects */
660
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
661
    vnc_write_u16(vs, src_x);
662
    vnc_write_u16(vs, src_y);
663
    vnc_flush(vs);
664
}
665

    
666
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
667
{
668
    VncDisplay *vd = ds->opaque;
669
    VncState *vs, *vn;
670
    uint8_t *src_row;
671
    uint8_t *dst_row;
672
    int i,x,y,pitch,depth,inc,w_lim,s;
673
    int cmp_bytes;
674

    
675
    vnc_refresh_server_surface(vd);
676
    for (vs = vd->clients; vs != NULL; vs = vn) {
677
        vn = vs->next;
678
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
679
            vs->force_update = 1;
680
            vnc_update_client(vs, 1);
681
            /* vs might be free()ed here */
682
        }
683
    }
684

    
685
    /* do bitblit op on the local surface too */
686
    pitch = ds_get_linesize(vd->ds);
687
    depth = ds_get_bytes_per_pixel(vd->ds);
688
    src_row = vd->server->data + pitch * src_y + depth * src_x;
689
    dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
690
    y = dst_y;
691
    inc = 1;
692
    if (dst_y > src_y) {
693
        /* copy backwards */
694
        src_row += pitch * (h-1);
695
        dst_row += pitch * (h-1);
696
        pitch = -pitch;
697
        y = dst_y + h - 1;
698
        inc = -1;
699
    }
700
    w_lim = w - (16 - (dst_x % 16));
701
    if (w_lim < 0)
702
        w_lim = w;
703
    else
704
        w_lim = w - (w_lim % 16);
705
    for (i = 0; i < h; i++) {
706
        for (x = 0; x <= w_lim;
707
                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
708
            if (x == w_lim) {
709
                if ((s = w - w_lim) == 0)
710
                    break;
711
            } else if (!x) {
712
                s = (16 - (dst_x % 16));
713
                s = MIN(s, w_lim);
714
            } else {
715
                s = 16;
716
            }
717
            cmp_bytes = s * depth;
718
            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
719
                continue;
720
            memmove(dst_row, src_row, cmp_bytes);
721
            vs = vd->clients;
722
            while (vs != NULL) {
723
                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
724
                    vnc_set_bit(vs->dirty[y], ((x + dst_x) / 16));
725
                vs = vs->next;
726
            }
727
        }
728
        src_row += pitch - w * depth;
729
        dst_row += pitch - w * depth;
730
        y += inc;
731
    }
732

    
733
    for (vs = vd->clients; vs != NULL; vs = vs->next) {
734
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
735
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
736
    }
737
}
738

    
739
static int find_and_clear_dirty_height(struct VncState *vs,
740
                                       int y, int last_x, int x)
741
{
742
    int h;
743
    VncDisplay *vd = vs->vd;
744

    
745
    for (h = 1; h < (vd->server->height - y); h++) {
746
        int tmp_x;
747
        if (!vnc_get_bit(vs->dirty[y + h], last_x))
748
            break;
749
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
750
            vnc_clear_bit(vs->dirty[y + h], tmp_x);
751
    }
752

    
753
    return h;
754
}
755

    
756
static int vnc_update_client(VncState *vs, int has_dirty)
757
{
758
    if (vs->need_update && vs->csock != -1) {
759
        VncDisplay *vd = vs->vd;
760
        int y;
761
        int n_rectangles;
762
        int saved_offset;
763

    
764
        if (vs->output.offset && !vs->audio_cap && !vs->force_update)
765
            /* kernel send buffers are full -> drop frames to throttle */
766
            return 0;
767

    
768
        if (!has_dirty && !vs->audio_cap && !vs->force_update)
769
            return 0;
770

    
771
        /*
772
         * Send screen updates to the vnc client using the server
773
         * surface and server dirty map.  guest surface updates
774
         * happening in parallel don't disturb us, the next pass will
775
         * send them to the client.
776
         */
777
        n_rectangles = 0;
778
        vnc_write_u8(vs, 0);  /* msg id */
779
        vnc_write_u8(vs, 0);
780
        saved_offset = vs->output.offset;
781
        vnc_write_u16(vs, 0);
782

    
783
        for (y = 0; y < vd->server->height; y++) {
784
            int x;
785
            int last_x = -1;
786
            for (x = 0; x < vd->server->width / 16; x++) {
787
                if (vnc_get_bit(vs->dirty[y], x)) {
788
                    if (last_x == -1) {
789
                        last_x = x;
790
                    }
791
                    vnc_clear_bit(vs->dirty[y], x);
792
                } else {
793
                    if (last_x != -1) {
794
                        int h = find_and_clear_dirty_height(vs, y, last_x, x);
795
                        send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
796
                        n_rectangles++;
797
                    }
798
                    last_x = -1;
799
                }
800
            }
801
            if (last_x != -1) {
802
                int h = find_and_clear_dirty_height(vs, y, last_x, x);
803
                send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
804
                n_rectangles++;
805
            }
806
        }
807
        vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
808
        vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
809
        vnc_flush(vs);
810
        vs->force_update = 0;
811
        return n_rectangles;
812
    }
813

    
814
    if (vs->csock == -1)
815
        vnc_disconnect_finish(vs);
816

    
817
    return 0;
818
}
819

    
820
/* audio */
821
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
822
{
823
    VncState *vs = opaque;
824

    
825
    switch (cmd) {
826
    case AUD_CNOTIFY_DISABLE:
827
        vnc_write_u8(vs, 255);
828
        vnc_write_u8(vs, 1);
829
        vnc_write_u16(vs, 0);
830
        vnc_flush(vs);
831
        break;
832

    
833
    case AUD_CNOTIFY_ENABLE:
834
        vnc_write_u8(vs, 255);
835
        vnc_write_u8(vs, 1);
836
        vnc_write_u16(vs, 1);
837
        vnc_flush(vs);
838
        break;
839
    }
840
}
841

    
842
static void audio_capture_destroy(void *opaque)
843
{
844
}
845

    
846
static void audio_capture(void *opaque, void *buf, int size)
847
{
848
    VncState *vs = opaque;
849

    
850
    vnc_write_u8(vs, 255);
851
    vnc_write_u8(vs, 1);
852
    vnc_write_u16(vs, 2);
853
    vnc_write_u32(vs, size);
854
    vnc_write(vs, buf, size);
855
    vnc_flush(vs);
856
}
857

    
858
static void audio_add(VncState *vs)
859
{
860
    Monitor *mon = cur_mon;
861
    struct audio_capture_ops ops;
862

    
863
    if (vs->audio_cap) {
864
        monitor_printf(mon, "audio already running\n");
865
        return;
866
    }
867

    
868
    ops.notify = audio_capture_notify;
869
    ops.destroy = audio_capture_destroy;
870
    ops.capture = audio_capture;
871

    
872
    vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
873
    if (!vs->audio_cap) {
874
        monitor_printf(mon, "Failed to add audio capture\n");
875
    }
876
}
877

    
878
static void audio_del(VncState *vs)
879
{
880
    if (vs->audio_cap) {
881
        AUD_del_capture(vs->audio_cap, vs);
882
        vs->audio_cap = NULL;
883
    }
884
}
885

    
886
static void vnc_disconnect_start(VncState *vs)
887
{
888
    if (vs->csock == -1)
889
        return;
890
    qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
891
    closesocket(vs->csock);
892
    vs->csock = -1;
893
}
894

    
895
static void vnc_disconnect_finish(VncState *vs)
896
{
897
    if (vs->input.buffer) qemu_free(vs->input.buffer);
898
    if (vs->output.buffer) qemu_free(vs->output.buffer);
899
#ifdef CONFIG_VNC_TLS
900
    vnc_tls_client_cleanup(vs);
901
#endif /* CONFIG_VNC_TLS */
902
#ifdef CONFIG_VNC_SASL
903
    vnc_sasl_client_cleanup(vs);
904
#endif /* CONFIG_VNC_SASL */
905
    audio_del(vs);
906

    
907
    VncState *p, *parent = NULL;
908
    for (p = vs->vd->clients; p != NULL; p = p->next) {
909
        if (p == vs) {
910
            if (parent)
911
                parent->next = p->next;
912
            else
913
                vs->vd->clients = p->next;
914
            break;
915
        }
916
        parent = p;
917
    }
918
    if (!vs->vd->clients)
919
        dcl->idle = 1;
920

    
921
    qemu_free(vs);
922
    vnc_remove_timer(vs->vd);
923
}
924

    
925
int vnc_client_io_error(VncState *vs, int ret, int last_errno)
926
{
927
    if (ret == 0 || ret == -1) {
928
        if (ret == -1) {
929
            switch (last_errno) {
930
                case EINTR:
931
                case EAGAIN:
932
#ifdef _WIN32
933
                case WSAEWOULDBLOCK:
934
#endif
935
                    return 0;
936
                default:
937
                    break;
938
            }
939
        }
940

    
941
        VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
942
                  ret, ret < 0 ? last_errno : 0);
943
        vnc_disconnect_start(vs);
944

    
945
        return 0;
946
    }
947
    return ret;
948
}
949

    
950

    
951
void vnc_client_error(VncState *vs)
952
{
953
    VNC_DEBUG("Closing down client sock: protocol error\n");
954
    vnc_disconnect_start(vs);
955
}
956

    
957

    
958
/*
959
 * Called to write a chunk of data to the client socket. The data may
960
 * be the raw data, or may have already been encoded by SASL.
961
 * The data will be written either straight onto the socket, or
962
 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
963
 *
964
 * NB, it is theoretically possible to have 2 layers of encryption,
965
 * both SASL, and this TLS layer. It is highly unlikely in practice
966
 * though, since SASL encryption will typically be a no-op if TLS
967
 * is active
968
 *
969
 * Returns the number of bytes written, which may be less than
970
 * the requested 'datalen' if the socket would block. Returns
971
 * -1 on error, and disconnects the client socket.
972
 */
973
long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
974
{
975
    long ret;
976
#ifdef CONFIG_VNC_TLS
977
    if (vs->tls.session) {
978
        ret = gnutls_write(vs->tls.session, data, datalen);
979
        if (ret < 0) {
980
            if (ret == GNUTLS_E_AGAIN)
981
                errno = EAGAIN;
982
            else
983
                errno = EIO;
984
            ret = -1;
985
        }
986
    } else
987
#endif /* CONFIG_VNC_TLS */
988
        ret = send(vs->csock, (const void *)data, datalen, 0);
989
    VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
990
    return vnc_client_io_error(vs, ret, socket_error());
991
}
992

    
993

    
994
/*
995
 * Called to write buffered data to the client socket, when not
996
 * using any SASL SSF encryption layers. Will write as much data
997
 * as possible without blocking. If all buffered data is written,
998
 * will switch the FD poll() handler back to read monitoring.
999
 *
1000
 * Returns the number of bytes written, which may be less than
1001
 * the buffered output data if the socket would block. Returns
1002
 * -1 on error, and disconnects the client socket.
1003
 */
1004
static long vnc_client_write_plain(VncState *vs)
1005
{
1006
    long ret;
1007

    
1008
#ifdef CONFIG_VNC_SASL
1009
    VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1010
              vs->output.buffer, vs->output.capacity, vs->output.offset,
1011
              vs->sasl.waitWriteSSF);
1012

    
1013
    if (vs->sasl.conn &&
1014
        vs->sasl.runSSF &&
1015
        vs->sasl.waitWriteSSF) {
1016
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1017
        if (ret)
1018
            vs->sasl.waitWriteSSF -= ret;
1019
    } else
1020
#endif /* CONFIG_VNC_SASL */
1021
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1022
    if (!ret)
1023
        return 0;
1024

    
1025
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1026
    vs->output.offset -= ret;
1027

    
1028
    if (vs->output.offset == 0) {
1029
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1030
    }
1031

    
1032
    return ret;
1033
}
1034

    
1035

    
1036
/*
1037
 * First function called whenever there is data to be written to
1038
 * the client socket. Will delegate actual work according to whether
1039
 * SASL SSF layers are enabled (thus requiring encryption calls)
1040
 */
1041
void vnc_client_write(void *opaque)
1042
{
1043
    long ret;
1044
    VncState *vs = opaque;
1045

    
1046
#ifdef CONFIG_VNC_SASL
1047
    if (vs->sasl.conn &&
1048
        vs->sasl.runSSF &&
1049
        !vs->sasl.waitWriteSSF)
1050
        ret = vnc_client_write_sasl(vs);
1051
    else
1052
#endif /* CONFIG_VNC_SASL */
1053
        ret = vnc_client_write_plain(vs);
1054
}
1055

    
1056
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1057
{
1058
    vs->read_handler = func;
1059
    vs->read_handler_expect = expecting;
1060
}
1061

    
1062

    
1063
/*
1064
 * Called to read a chunk of data from the client socket. The data may
1065
 * be the raw data, or may need to be further decoded by SASL.
1066
 * The data will be read either straight from to the socket, or
1067
 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1068
 *
1069
 * NB, it is theoretically possible to have 2 layers of encryption,
1070
 * both SASL, and this TLS layer. It is highly unlikely in practice
1071
 * though, since SASL encryption will typically be a no-op if TLS
1072
 * is active
1073
 *
1074
 * Returns the number of bytes read, which may be less than
1075
 * the requested 'datalen' if the socket would block. Returns
1076
 * -1 on error, and disconnects the client socket.
1077
 */
1078
long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1079
{
1080
    long ret;
1081
#ifdef CONFIG_VNC_TLS
1082
    if (vs->tls.session) {
1083
        ret = gnutls_read(vs->tls.session, data, datalen);
1084
        if (ret < 0) {
1085
            if (ret == GNUTLS_E_AGAIN)
1086
                errno = EAGAIN;
1087
            else
1088
                errno = EIO;
1089
            ret = -1;
1090
        }
1091
    } else
1092
#endif /* CONFIG_VNC_TLS */
1093
        ret = recv(vs->csock, (void *)data, datalen, 0);
1094
    VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1095
    return vnc_client_io_error(vs, ret, socket_error());
1096
}
1097

    
1098

    
1099
/*
1100
 * Called to read data from the client socket to the input buffer,
1101
 * when not using any SASL SSF encryption layers. Will read as much
1102
 * data as possible without blocking.
1103
 *
1104
 * Returns the number of bytes read. Returns -1 on error, and
1105
 * disconnects the client socket.
1106
 */
1107
static long vnc_client_read_plain(VncState *vs)
1108
{
1109
    int ret;
1110
    VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1111
              vs->input.buffer, vs->input.capacity, vs->input.offset);
1112
    buffer_reserve(&vs->input, 4096);
1113
    ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1114
    if (!ret)
1115
        return 0;
1116
    vs->input.offset += ret;
1117
    return ret;
1118
}
1119

    
1120

    
1121
/*
1122
 * First function called whenever there is more data to be read from
1123
 * the client socket. Will delegate actual work according to whether
1124
 * SASL SSF layers are enabled (thus requiring decryption calls)
1125
 */
1126
void vnc_client_read(void *opaque)
1127
{
1128
    VncState *vs = opaque;
1129
    long ret;
1130

    
1131
#ifdef CONFIG_VNC_SASL
1132
    if (vs->sasl.conn && vs->sasl.runSSF)
1133
        ret = vnc_client_read_sasl(vs);
1134
    else
1135
#endif /* CONFIG_VNC_SASL */
1136
        ret = vnc_client_read_plain(vs);
1137
    if (!ret) {
1138
        if (vs->csock == -1)
1139
            vnc_disconnect_finish(vs);
1140
        return;
1141
    }
1142

    
1143
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1144
        size_t len = vs->read_handler_expect;
1145
        int ret;
1146

    
1147
        ret = vs->read_handler(vs, vs->input.buffer, len);
1148
        if (vs->csock == -1) {
1149
            vnc_disconnect_finish(vs);
1150
            return;
1151
        }
1152

    
1153
        if (!ret) {
1154
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1155
            vs->input.offset -= len;
1156
        } else {
1157
            vs->read_handler_expect = ret;
1158
        }
1159
    }
1160
}
1161

    
1162
void vnc_write(VncState *vs, const void *data, size_t len)
1163
{
1164
    buffer_reserve(&vs->output, len);
1165

    
1166
    if (vs->csock != -1 && buffer_empty(&vs->output)) {
1167
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1168
    }
1169

    
1170
    buffer_append(&vs->output, data, len);
1171
}
1172

    
1173
void vnc_write_s32(VncState *vs, int32_t value)
1174
{
1175
    vnc_write_u32(vs, *(uint32_t *)&value);
1176
}
1177

    
1178
void vnc_write_u32(VncState *vs, uint32_t value)
1179
{
1180
    uint8_t buf[4];
1181

    
1182
    buf[0] = (value >> 24) & 0xFF;
1183
    buf[1] = (value >> 16) & 0xFF;
1184
    buf[2] = (value >>  8) & 0xFF;
1185
    buf[3] = value & 0xFF;
1186

    
1187
    vnc_write(vs, buf, 4);
1188
}
1189

    
1190
void vnc_write_u16(VncState *vs, uint16_t value)
1191
{
1192
    uint8_t buf[2];
1193

    
1194
    buf[0] = (value >> 8) & 0xFF;
1195
    buf[1] = value & 0xFF;
1196

    
1197
    vnc_write(vs, buf, 2);
1198
}
1199

    
1200
void vnc_write_u8(VncState *vs, uint8_t value)
1201
{
1202
    vnc_write(vs, (char *)&value, 1);
1203
}
1204

    
1205
void vnc_flush(VncState *vs)
1206
{
1207
    if (vs->csock != -1 && vs->output.offset)
1208
        vnc_client_write(vs);
1209
}
1210

    
1211
uint8_t read_u8(uint8_t *data, size_t offset)
1212
{
1213
    return data[offset];
1214
}
1215

    
1216
uint16_t read_u16(uint8_t *data, size_t offset)
1217
{
1218
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1219
}
1220

    
1221
int32_t read_s32(uint8_t *data, size_t offset)
1222
{
1223
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1224
                     (data[offset + 2] << 8) | data[offset + 3]);
1225
}
1226

    
1227
uint32_t read_u32(uint8_t *data, size_t offset)
1228
{
1229
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1230
            (data[offset + 2] << 8) | data[offset + 3]);
1231
}
1232

    
1233
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1234
{
1235
}
1236

    
1237
static void check_pointer_type_change(VncState *vs, int absolute)
1238
{
1239
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1240
        vnc_write_u8(vs, 0);
1241
        vnc_write_u8(vs, 0);
1242
        vnc_write_u16(vs, 1);
1243
        vnc_framebuffer_update(vs, absolute, 0,
1244
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1245
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
1246
        vnc_flush(vs);
1247
    }
1248
    vs->absolute = absolute;
1249
}
1250

    
1251
static void pointer_event(VncState *vs, int button_mask, int x, int y)
1252
{
1253
    int buttons = 0;
1254
    int dz = 0;
1255

    
1256
    if (button_mask & 0x01)
1257
        buttons |= MOUSE_EVENT_LBUTTON;
1258
    if (button_mask & 0x02)
1259
        buttons |= MOUSE_EVENT_MBUTTON;
1260
    if (button_mask & 0x04)
1261
        buttons |= MOUSE_EVENT_RBUTTON;
1262
    if (button_mask & 0x08)
1263
        dz = -1;
1264
    if (button_mask & 0x10)
1265
        dz = 1;
1266

    
1267
    if (vs->absolute) {
1268
        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1269
                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1270
                        dz, buttons);
1271
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1272
        x -= 0x7FFF;
1273
        y -= 0x7FFF;
1274

    
1275
        kbd_mouse_event(x, y, dz, buttons);
1276
    } else {
1277
        if (vs->last_x != -1)
1278
            kbd_mouse_event(x - vs->last_x,
1279
                            y - vs->last_y,
1280
                            dz, buttons);
1281
        vs->last_x = x;
1282
        vs->last_y = y;
1283
    }
1284

    
1285
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1286
}
1287

    
1288
static void reset_keys(VncState *vs)
1289
{
1290
    int i;
1291
    for(i = 0; i < 256; i++) {
1292
        if (vs->modifiers_state[i]) {
1293
            if (i & 0x80)
1294
                kbd_put_keycode(0xe0);
1295
            kbd_put_keycode(i | 0x80);
1296
            vs->modifiers_state[i] = 0;
1297
        }
1298
    }
1299
}
1300

    
1301
static void press_key(VncState *vs, int keysym)
1302
{
1303
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1304
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1305
}
1306

    
1307
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1308
{
1309
    /* QEMU console switch */
1310
    switch(keycode) {
1311
    case 0x2a:                          /* Left Shift */
1312
    case 0x36:                          /* Right Shift */
1313
    case 0x1d:                          /* Left CTRL */
1314
    case 0x9d:                          /* Right CTRL */
1315
    case 0x38:                          /* Left ALT */
1316
    case 0xb8:                          /* Right ALT */
1317
        if (down)
1318
            vs->modifiers_state[keycode] = 1;
1319
        else
1320
            vs->modifiers_state[keycode] = 0;
1321
        break;
1322
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1323
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1324
            /* Reset the modifiers sent to the current console */
1325
            reset_keys(vs);
1326
            console_select(keycode - 0x02);
1327
            return;
1328
        }
1329
        break;
1330
    case 0x3a:                        /* CapsLock */
1331
    case 0x45:                        /* NumLock */
1332
        if (!down)
1333
            vs->modifiers_state[keycode] ^= 1;
1334
        break;
1335
    }
1336

    
1337
    if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1338
        /* If the numlock state needs to change then simulate an additional
1339
           keypress before sending this one.  This will happen if the user
1340
           toggles numlock away from the VNC window.
1341
        */
1342
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1343
            if (!vs->modifiers_state[0x45]) {
1344
                vs->modifiers_state[0x45] = 1;
1345
                press_key(vs, 0xff7f);
1346
            }
1347
        } else {
1348
            if (vs->modifiers_state[0x45]) {
1349
                vs->modifiers_state[0x45] = 0;
1350
                press_key(vs, 0xff7f);
1351
            }
1352
        }
1353
    }
1354

    
1355
    if (is_graphic_console()) {
1356
        if (keycode & 0x80)
1357
            kbd_put_keycode(0xe0);
1358
        if (down)
1359
            kbd_put_keycode(keycode & 0x7f);
1360
        else
1361
            kbd_put_keycode(keycode | 0x80);
1362
    } else {
1363
        /* QEMU console emulation */
1364
        if (down) {
1365
            int numlock = vs->modifiers_state[0x45];
1366
            switch (keycode) {
1367
            case 0x2a:                          /* Left Shift */
1368
            case 0x36:                          /* Right Shift */
1369
            case 0x1d:                          /* Left CTRL */
1370
            case 0x9d:                          /* Right CTRL */
1371
            case 0x38:                          /* Left ALT */
1372
            case 0xb8:                          /* Right ALT */
1373
                break;
1374
            case 0xc8:
1375
                kbd_put_keysym(QEMU_KEY_UP);
1376
                break;
1377
            case 0xd0:
1378
                kbd_put_keysym(QEMU_KEY_DOWN);
1379
                break;
1380
            case 0xcb:
1381
                kbd_put_keysym(QEMU_KEY_LEFT);
1382
                break;
1383
            case 0xcd:
1384
                kbd_put_keysym(QEMU_KEY_RIGHT);
1385
                break;
1386
            case 0xd3:
1387
                kbd_put_keysym(QEMU_KEY_DELETE);
1388
                break;
1389
            case 0xc7:
1390
                kbd_put_keysym(QEMU_KEY_HOME);
1391
                break;
1392
            case 0xcf:
1393
                kbd_put_keysym(QEMU_KEY_END);
1394
                break;
1395
            case 0xc9:
1396
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1397
                break;
1398
            case 0xd1:
1399
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1400
                break;
1401

    
1402
            case 0x47:
1403
                kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1404
                break;
1405
            case 0x48:
1406
                kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1407
                break;
1408
            case 0x49:
1409
                kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1410
                break;
1411
            case 0x4b:
1412
                kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1413
                break;
1414
            case 0x4c:
1415
                kbd_put_keysym('5');
1416
                break;
1417
            case 0x4d:
1418
                kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1419
                break;
1420
            case 0x4f:
1421
                kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1422
                break;
1423
            case 0x50:
1424
                kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1425
                break;
1426
            case 0x51:
1427
                kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1428
                break;
1429
            case 0x52:
1430
                kbd_put_keysym('0');
1431
                break;
1432
            case 0x53:
1433
                kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1434
                break;
1435

    
1436
            case 0xb5:
1437
                kbd_put_keysym('/');
1438
                break;
1439
            case 0x37:
1440
                kbd_put_keysym('*');
1441
                break;
1442
            case 0x4a:
1443
                kbd_put_keysym('-');
1444
                break;
1445
            case 0x4e:
1446
                kbd_put_keysym('+');
1447
                break;
1448
            case 0x9c:
1449
                kbd_put_keysym('\n');
1450
                break;
1451

    
1452
            default:
1453
                kbd_put_keysym(sym);
1454
                break;
1455
            }
1456
        }
1457
    }
1458
}
1459

    
1460
static void key_event(VncState *vs, int down, uint32_t sym)
1461
{
1462
    int keycode;
1463

    
1464
    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1465
        sym = sym - 'A' + 'a';
1466

    
1467
    keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1468
    do_key_event(vs, down, keycode, sym);
1469
}
1470

    
1471
static void ext_key_event(VncState *vs, int down,
1472
                          uint32_t sym, uint16_t keycode)
1473
{
1474
    /* if the user specifies a keyboard layout, always use it */
1475
    if (keyboard_layout)
1476
        key_event(vs, down, sym);
1477
    else
1478
        do_key_event(vs, down, keycode, sym);
1479
}
1480

    
1481
static void framebuffer_update_request(VncState *vs, int incremental,
1482
                                       int x_position, int y_position,
1483
                                       int w, int h)
1484
{
1485
    if (x_position > ds_get_width(vs->ds))
1486
        x_position = ds_get_width(vs->ds);
1487
    if (y_position > ds_get_height(vs->ds))
1488
        y_position = ds_get_height(vs->ds);
1489
    if (x_position + w >= ds_get_width(vs->ds))
1490
        w = ds_get_width(vs->ds)  - x_position;
1491
    if (y_position + h >= ds_get_height(vs->ds))
1492
        h = ds_get_height(vs->ds) - y_position;
1493

    
1494
    int i;
1495
    vs->need_update = 1;
1496
    if (!incremental) {
1497
        vs->force_update = 1;
1498
        for (i = 0; i < h; i++) {
1499
            vnc_set_bits(vs->dirty[y_position + i],
1500
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1501
        }
1502
    }
1503
}
1504

    
1505
static void send_ext_key_event_ack(VncState *vs)
1506
{
1507
    vnc_write_u8(vs, 0);
1508
    vnc_write_u8(vs, 0);
1509
    vnc_write_u16(vs, 1);
1510
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1511
                           VNC_ENCODING_EXT_KEY_EVENT);
1512
    vnc_flush(vs);
1513
}
1514

    
1515
static void send_ext_audio_ack(VncState *vs)
1516
{
1517
    vnc_write_u8(vs, 0);
1518
    vnc_write_u8(vs, 0);
1519
    vnc_write_u16(vs, 1);
1520
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1521
                           VNC_ENCODING_AUDIO);
1522
    vnc_flush(vs);
1523
}
1524

    
1525
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1526
{
1527
    int i;
1528
    unsigned int enc = 0;
1529

    
1530
    vnc_zlib_init(vs);
1531
    vs->features = 0;
1532
    vs->vnc_encoding = 0;
1533
    vs->tight_compression = 9;
1534
    vs->tight_quality = 9;
1535
    vs->absolute = -1;
1536

    
1537
    for (i = n_encodings - 1; i >= 0; i--) {
1538
        enc = encodings[i];
1539
        switch (enc) {
1540
        case VNC_ENCODING_RAW:
1541
            vs->vnc_encoding = enc;
1542
            break;
1543
        case VNC_ENCODING_COPYRECT:
1544
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1545
            break;
1546
        case VNC_ENCODING_HEXTILE:
1547
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1548
            vs->vnc_encoding = enc;
1549
            break;
1550
        case VNC_ENCODING_ZLIB:
1551
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1552
            vs->vnc_encoding = enc;
1553
            break;
1554
        case VNC_ENCODING_DESKTOPRESIZE:
1555
            vs->features |= VNC_FEATURE_RESIZE_MASK;
1556
            break;
1557
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
1558
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1559
            break;
1560
        case VNC_ENCODING_EXT_KEY_EVENT:
1561
            send_ext_key_event_ack(vs);
1562
            break;
1563
        case VNC_ENCODING_AUDIO:
1564
            send_ext_audio_ack(vs);
1565
            break;
1566
        case VNC_ENCODING_WMVi:
1567
            vs->features |= VNC_FEATURE_WMVI_MASK;
1568
            break;
1569
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1570
            vs->tight_compression = (enc & 0x0F);
1571
            break;
1572
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1573
            vs->tight_quality = (enc & 0x0F);
1574
            break;
1575
        default:
1576
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1577
            break;
1578
        }
1579
    }
1580

    
1581
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1582
}
1583

    
1584
static void set_pixel_conversion(VncState *vs)
1585
{
1586
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1587
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
1588
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1589
        vs->write_pixels = vnc_write_pixels_copy;
1590
        switch (vs->ds->surface->pf.bits_per_pixel) {
1591
            case 8:
1592
                vs->send_hextile_tile = send_hextile_tile_8;
1593
                break;
1594
            case 16:
1595
                vs->send_hextile_tile = send_hextile_tile_16;
1596
                break;
1597
            case 32:
1598
                vs->send_hextile_tile = send_hextile_tile_32;
1599
                break;
1600
        }
1601
    } else {
1602
        vs->write_pixels = vnc_write_pixels_generic;
1603
        switch (vs->ds->surface->pf.bits_per_pixel) {
1604
            case 8:
1605
                vs->send_hextile_tile = send_hextile_tile_generic_8;
1606
                break;
1607
            case 16:
1608
                vs->send_hextile_tile = send_hextile_tile_generic_16;
1609
                break;
1610
            case 32:
1611
                vs->send_hextile_tile = send_hextile_tile_generic_32;
1612
                break;
1613
        }
1614
    }
1615
}
1616

    
1617
static void set_pixel_format(VncState *vs,
1618
                             int bits_per_pixel, int depth,
1619
                             int big_endian_flag, int true_color_flag,
1620
                             int red_max, int green_max, int blue_max,
1621
                             int red_shift, int green_shift, int blue_shift)
1622
{
1623
    if (!true_color_flag) {
1624
        vnc_client_error(vs);
1625
        return;
1626
    }
1627

    
1628
    vs->clientds = *(vs->vd->guest.ds);
1629
    vs->clientds.pf.rmax = red_max;
1630
    count_bits(vs->clientds.pf.rbits, red_max);
1631
    vs->clientds.pf.rshift = red_shift;
1632
    vs->clientds.pf.rmask = red_max << red_shift;
1633
    vs->clientds.pf.gmax = green_max;
1634
    count_bits(vs->clientds.pf.gbits, green_max);
1635
    vs->clientds.pf.gshift = green_shift;
1636
    vs->clientds.pf.gmask = green_max << green_shift;
1637
    vs->clientds.pf.bmax = blue_max;
1638
    count_bits(vs->clientds.pf.bbits, blue_max);
1639
    vs->clientds.pf.bshift = blue_shift;
1640
    vs->clientds.pf.bmask = blue_max << blue_shift;
1641
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1642
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1643
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1644
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1645

    
1646
    set_pixel_conversion(vs);
1647

    
1648
    vga_hw_invalidate();
1649
    vga_hw_update();
1650
}
1651

    
1652
static void pixel_format_message (VncState *vs) {
1653
    char pad[3] = { 0, 0, 0 };
1654

    
1655
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1656
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1657

    
1658
#ifdef HOST_WORDS_BIGENDIAN
1659
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1660
#else
1661
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1662
#endif
1663
    vnc_write_u8(vs, 1);             /* true-color-flag */
1664
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
1665
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
1666
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
1667
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
1668
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
1669
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1670
    if (vs->ds->surface->pf.bits_per_pixel == 32)
1671
        vs->send_hextile_tile = send_hextile_tile_32;
1672
    else if (vs->ds->surface->pf.bits_per_pixel == 16)
1673
        vs->send_hextile_tile = send_hextile_tile_16;
1674
    else if (vs->ds->surface->pf.bits_per_pixel == 8)
1675
        vs->send_hextile_tile = send_hextile_tile_8;
1676
    vs->clientds = *(vs->ds->surface);
1677
    vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1678
    vs->write_pixels = vnc_write_pixels_copy;
1679

    
1680
    vnc_write(vs, pad, 3);           /* padding */
1681
}
1682

    
1683
static void vnc_dpy_setdata(DisplayState *ds)
1684
{
1685
    /* We don't have to do anything */
1686
}
1687

    
1688
static void vnc_colordepth(VncState *vs)
1689
{
1690
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1691
        /* Sending a WMVi message to notify the client*/
1692
        vnc_write_u8(vs, 0);  /* msg id */
1693
        vnc_write_u8(vs, 0);
1694
        vnc_write_u16(vs, 1); /* number of rects */
1695
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
1696
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1697
        pixel_format_message(vs);
1698
        vnc_flush(vs);
1699
    } else {
1700
        set_pixel_conversion(vs);
1701
    }
1702
}
1703

    
1704
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1705
{
1706
    int i;
1707
    uint16_t limit;
1708
    VncDisplay *vd = vs->vd;
1709

    
1710
    if (data[0] > 3) {
1711
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1712
        if (!qemu_timer_expired(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval))
1713
            qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
1714
    }
1715

    
1716
    switch (data[0]) {
1717
    case 0:
1718
        if (len == 1)
1719
            return 20;
1720

    
1721
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1722
                         read_u8(data, 6), read_u8(data, 7),
1723
                         read_u16(data, 8), read_u16(data, 10),
1724
                         read_u16(data, 12), read_u8(data, 14),
1725
                         read_u8(data, 15), read_u8(data, 16));
1726
        break;
1727
    case 2:
1728
        if (len == 1)
1729
            return 4;
1730

    
1731
        if (len == 4) {
1732
            limit = read_u16(data, 2);
1733
            if (limit > 0)
1734
                return 4 + (limit * 4);
1735
        } else
1736
            limit = read_u16(data, 2);
1737

    
1738
        for (i = 0; i < limit; i++) {
1739
            int32_t val = read_s32(data, 4 + (i * 4));
1740
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
1741
        }
1742

    
1743
        set_encodings(vs, (int32_t *)(data + 4), limit);
1744
        break;
1745
    case 3:
1746
        if (len == 1)
1747
            return 10;
1748

    
1749
        framebuffer_update_request(vs,
1750
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1751
                                   read_u16(data, 6), read_u16(data, 8));
1752
        break;
1753
    case 4:
1754
        if (len == 1)
1755
            return 8;
1756

    
1757
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
1758
        break;
1759
    case 5:
1760
        if (len == 1)
1761
            return 6;
1762

    
1763
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1764
        break;
1765
    case 6:
1766
        if (len == 1)
1767
            return 8;
1768

    
1769
        if (len == 8) {
1770
            uint32_t dlen = read_u32(data, 4);
1771
            if (dlen > 0)
1772
                return 8 + dlen;
1773
        }
1774

    
1775
        client_cut_text(vs, read_u32(data, 4), data + 8);
1776
        break;
1777
    case 255:
1778
        if (len == 1)
1779
            return 2;
1780

    
1781
        switch (read_u8(data, 1)) {
1782
        case 0:
1783
            if (len == 2)
1784
                return 12;
1785

    
1786
            ext_key_event(vs, read_u16(data, 2),
1787
                          read_u32(data, 4), read_u32(data, 8));
1788
            break;
1789
        case 1:
1790
            if (len == 2)
1791
                return 4;
1792

    
1793
            switch (read_u16 (data, 2)) {
1794
            case 0:
1795
                audio_add(vs);
1796
                break;
1797
            case 1:
1798
                audio_del(vs);
1799
                break;
1800
            case 2:
1801
                if (len == 4)
1802
                    return 10;
1803
                switch (read_u8(data, 4)) {
1804
                case 0: vs->as.fmt = AUD_FMT_U8; break;
1805
                case 1: vs->as.fmt = AUD_FMT_S8; break;
1806
                case 2: vs->as.fmt = AUD_FMT_U16; break;
1807
                case 3: vs->as.fmt = AUD_FMT_S16; break;
1808
                case 4: vs->as.fmt = AUD_FMT_U32; break;
1809
                case 5: vs->as.fmt = AUD_FMT_S32; break;
1810
                default:
1811
                    printf("Invalid audio format %d\n", read_u8(data, 4));
1812
                    vnc_client_error(vs);
1813
                    break;
1814
                }
1815
                vs->as.nchannels = read_u8(data, 5);
1816
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1817
                    printf("Invalid audio channel coount %d\n",
1818
                           read_u8(data, 5));
1819
                    vnc_client_error(vs);
1820
                    break;
1821
                }
1822
                vs->as.freq = read_u32(data, 6);
1823
                break;
1824
            default:
1825
                printf ("Invalid audio message %d\n", read_u8(data, 4));
1826
                vnc_client_error(vs);
1827
                break;
1828
            }
1829
            break;
1830

    
1831
        default:
1832
            printf("Msg: %d\n", read_u16(data, 0));
1833
            vnc_client_error(vs);
1834
            break;
1835
        }
1836
        break;
1837
    default:
1838
        printf("Msg: %d\n", data[0]);
1839
        vnc_client_error(vs);
1840
        break;
1841
    }
1842

    
1843
    vnc_read_when(vs, protocol_client_msg, 1);
1844
    return 0;
1845
}
1846

    
1847
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1848
{
1849
    char buf[1024];
1850
    int size;
1851

    
1852
    vnc_write_u16(vs, ds_get_width(vs->ds));
1853
    vnc_write_u16(vs, ds_get_height(vs->ds));
1854

    
1855
    pixel_format_message(vs);
1856

    
1857
    if (qemu_name)
1858
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1859
    else
1860
        size = snprintf(buf, sizeof(buf), "QEMU");
1861

    
1862
    vnc_write_u32(vs, size);
1863
    vnc_write(vs, buf, size);
1864
    vnc_flush(vs);
1865

    
1866
    vnc_read_when(vs, protocol_client_msg, 1);
1867

    
1868
    return 0;
1869
}
1870

    
1871
void start_client_init(VncState *vs)
1872
{
1873
    vnc_read_when(vs, protocol_client_init, 1);
1874
}
1875

    
1876
static void make_challenge(VncState *vs)
1877
{
1878
    int i;
1879

    
1880
    srand(time(NULL)+getpid()+getpid()*987654+rand());
1881

    
1882
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1883
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1884
}
1885

    
1886
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1887
{
1888
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1889
    int i, j, pwlen;
1890
    unsigned char key[8];
1891

    
1892
    if (!vs->vd->password || !vs->vd->password[0]) {
1893
        VNC_DEBUG("No password configured on server");
1894
        vnc_write_u32(vs, 1); /* Reject auth */
1895
        if (vs->minor >= 8) {
1896
            static const char err[] = "Authentication failed";
1897
            vnc_write_u32(vs, sizeof(err));
1898
            vnc_write(vs, err, sizeof(err));
1899
        }
1900
        vnc_flush(vs);
1901
        vnc_client_error(vs);
1902
        return 0;
1903
    }
1904

    
1905
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1906

    
1907
    /* Calculate the expected challenge response */
1908
    pwlen = strlen(vs->vd->password);
1909
    for (i=0; i<sizeof(key); i++)
1910
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
1911
    deskey(key, EN0);
1912
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1913
        des(response+j, response+j);
1914

    
1915
    /* Compare expected vs actual challenge response */
1916
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1917
        VNC_DEBUG("Client challenge reponse did not match\n");
1918
        vnc_write_u32(vs, 1); /* Reject auth */
1919
        if (vs->minor >= 8) {
1920
            static const char err[] = "Authentication failed";
1921
            vnc_write_u32(vs, sizeof(err));
1922
            vnc_write(vs, err, sizeof(err));
1923
        }
1924
        vnc_flush(vs);
1925
        vnc_client_error(vs);
1926
    } else {
1927
        VNC_DEBUG("Accepting VNC challenge response\n");
1928
        vnc_write_u32(vs, 0); /* Accept auth */
1929
        vnc_flush(vs);
1930

    
1931
        start_client_init(vs);
1932
    }
1933
    return 0;
1934
}
1935

    
1936
void start_auth_vnc(VncState *vs)
1937
{
1938
    make_challenge(vs);
1939
    /* Send client a 'random' challenge */
1940
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1941
    vnc_flush(vs);
1942

    
1943
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1944
}
1945

    
1946

    
1947
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1948
{
1949
    /* We only advertise 1 auth scheme at a time, so client
1950
     * must pick the one we sent. Verify this */
1951
    if (data[0] != vs->vd->auth) { /* Reject auth */
1952
       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1953
       vnc_write_u32(vs, 1);
1954
       if (vs->minor >= 8) {
1955
           static const char err[] = "Authentication failed";
1956
           vnc_write_u32(vs, sizeof(err));
1957
           vnc_write(vs, err, sizeof(err));
1958
       }
1959
       vnc_client_error(vs);
1960
    } else { /* Accept requested auth */
1961
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1962
       switch (vs->vd->auth) {
1963
       case VNC_AUTH_NONE:
1964
           VNC_DEBUG("Accept auth none\n");
1965
           if (vs->minor >= 8) {
1966
               vnc_write_u32(vs, 0); /* Accept auth completion */
1967
               vnc_flush(vs);
1968
           }
1969
           start_client_init(vs);
1970
           break;
1971

    
1972
       case VNC_AUTH_VNC:
1973
           VNC_DEBUG("Start VNC auth\n");
1974
           start_auth_vnc(vs);
1975
           break;
1976

    
1977
#ifdef CONFIG_VNC_TLS
1978
       case VNC_AUTH_VENCRYPT:
1979
           VNC_DEBUG("Accept VeNCrypt auth\n");;
1980
           start_auth_vencrypt(vs);
1981
           break;
1982
#endif /* CONFIG_VNC_TLS */
1983

    
1984
#ifdef CONFIG_VNC_SASL
1985
       case VNC_AUTH_SASL:
1986
           VNC_DEBUG("Accept SASL auth\n");
1987
           start_auth_sasl(vs);
1988
           break;
1989
#endif /* CONFIG_VNC_SASL */
1990

    
1991
       default: /* Should not be possible, but just in case */
1992
           VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1993
           vnc_write_u8(vs, 1);
1994
           if (vs->minor >= 8) {
1995
               static const char err[] = "Authentication failed";
1996
               vnc_write_u32(vs, sizeof(err));
1997
               vnc_write(vs, err, sizeof(err));
1998
           }
1999
           vnc_client_error(vs);
2000
       }
2001
    }
2002
    return 0;
2003
}
2004

    
2005
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2006
{
2007
    char local[13];
2008

    
2009
    memcpy(local, version, 12);
2010
    local[12] = 0;
2011

    
2012
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2013
        VNC_DEBUG("Malformed protocol version %s\n", local);
2014
        vnc_client_error(vs);
2015
        return 0;
2016
    }
2017
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2018
    if (vs->major != 3 ||
2019
        (vs->minor != 3 &&
2020
         vs->minor != 4 &&
2021
         vs->minor != 5 &&
2022
         vs->minor != 7 &&
2023
         vs->minor != 8)) {
2024
        VNC_DEBUG("Unsupported client version\n");
2025
        vnc_write_u32(vs, VNC_AUTH_INVALID);
2026
        vnc_flush(vs);
2027
        vnc_client_error(vs);
2028
        return 0;
2029
    }
2030
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2031
     * as equivalent to v3.3 by servers
2032
     */
2033
    if (vs->minor == 4 || vs->minor == 5)
2034
        vs->minor = 3;
2035

    
2036
    if (vs->minor == 3) {
2037
        if (vs->vd->auth == VNC_AUTH_NONE) {
2038
            VNC_DEBUG("Tell client auth none\n");
2039
            vnc_write_u32(vs, vs->vd->auth);
2040
            vnc_flush(vs);
2041
            start_client_init(vs);
2042
       } else if (vs->vd->auth == VNC_AUTH_VNC) {
2043
            VNC_DEBUG("Tell client VNC auth\n");
2044
            vnc_write_u32(vs, vs->vd->auth);
2045
            vnc_flush(vs);
2046
            start_auth_vnc(vs);
2047
       } else {
2048
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2049
            vnc_write_u32(vs, VNC_AUTH_INVALID);
2050
            vnc_flush(vs);
2051
            vnc_client_error(vs);
2052
       }
2053
    } else {
2054
        VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2055
        vnc_write_u8(vs, 1); /* num auth */
2056
        vnc_write_u8(vs, vs->vd->auth);
2057
        vnc_read_when(vs, protocol_client_auth, 1);
2058
        vnc_flush(vs);
2059
    }
2060

    
2061
    return 0;
2062
}
2063

    
2064
static int vnc_refresh_server_surface(VncDisplay *vd)
2065
{
2066
    int y;
2067
    uint8_t *guest_row;
2068
    uint8_t *server_row;
2069
    int cmp_bytes;
2070
    uint32_t width_mask[VNC_DIRTY_WORDS];
2071
    VncState *vs = NULL;
2072
    int has_dirty = 0;
2073

    
2074
    /*
2075
     * Walk through the guest dirty map.
2076
     * Check and copy modified bits from guest to server surface.
2077
     * Update server dirty map.
2078
     */
2079
    vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
2080
    cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2081
    guest_row  = vd->guest.ds->data;
2082
    server_row = vd->server->data;
2083
    for (y = 0; y < vd->guest.ds->height; y++) {
2084
        if (vnc_and_bits(vd->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
2085
            int x;
2086
            uint8_t *guest_ptr;
2087
            uint8_t *server_ptr;
2088

    
2089
            guest_ptr  = guest_row;
2090
            server_ptr = server_row;
2091

    
2092
            for (x = 0; x < vd->guest.ds->width;
2093
                    x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2094
                if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
2095
                    continue;
2096
                vnc_clear_bit(vd->guest.dirty[y], (x / 16));
2097
                if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2098
                    continue;
2099
                memcpy(server_ptr, guest_ptr, cmp_bytes);
2100
                vs = vd->clients;
2101
                while (vs != NULL) {
2102
                    vnc_set_bit(vs->dirty[y], (x / 16));
2103
                    vs = vs->next;
2104
                }
2105
                has_dirty++;
2106
            }
2107
        }
2108
        guest_row  += ds_get_linesize(vd->ds);
2109
        server_row += ds_get_linesize(vd->ds);
2110
    }
2111
    return has_dirty;
2112
}
2113

    
2114
static void vnc_refresh(void *opaque)
2115
{
2116
    VncDisplay *vd = opaque;
2117
    VncState *vs = NULL;
2118
    int has_dirty = 0, rects = 0;
2119

    
2120
    vga_hw_update();
2121

    
2122
    has_dirty = vnc_refresh_server_surface(vd);
2123

    
2124
    vs = vd->clients;
2125
    while (vs != NULL) {
2126
        rects += vnc_update_client(vs, has_dirty);
2127
        vs = vs->next;
2128
    }
2129

    
2130
    if (has_dirty && rects) {
2131
        vd->timer_interval /= 2;
2132
        if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2133
            vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2134
    } else {
2135
        vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2136
        if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2137
            vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2138
    }
2139
    qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
2140
}
2141

    
2142
static void vnc_init_timer(VncDisplay *vd)
2143
{
2144
    vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2145
    if (vd->timer == NULL && vd->clients != NULL) {
2146
        vd->timer = qemu_new_timer(rt_clock, vnc_refresh, vd);
2147
        vnc_refresh(vd);
2148
    }
2149
}
2150

    
2151
static void vnc_remove_timer(VncDisplay *vd)
2152
{
2153
    if (vd->timer != NULL && vd->clients == NULL) {
2154
        qemu_del_timer(vd->timer);
2155
        qemu_free_timer(vd->timer);
2156
        vd->timer = NULL;
2157
    }
2158
}
2159

    
2160
static void vnc_connect(VncDisplay *vd, int csock)
2161
{
2162
    VncState *vs = qemu_mallocz(sizeof(VncState));
2163
    vs->csock = csock;
2164

    
2165
    VNC_DEBUG("New client on socket %d\n", csock);
2166
    dcl->idle = 0;
2167
    socket_set_nonblock(vs->csock);
2168
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2169

    
2170
    vs->vd = vd;
2171
    vs->ds = vd->ds;
2172
    vs->last_x = -1;
2173
    vs->last_y = -1;
2174

    
2175
    vs->as.freq = 44100;
2176
    vs->as.nchannels = 2;
2177
    vs->as.fmt = AUD_FMT_S16;
2178
    vs->as.endianness = 0;
2179

    
2180
    vs->next = vd->clients;
2181
    vd->clients = vs;
2182

    
2183
    vga_hw_update();
2184

    
2185
    vnc_write(vs, "RFB 003.008\n", 12);
2186
    vnc_flush(vs);
2187
    vnc_read_when(vs, protocol_version, 12);
2188
    reset_keys(vs);
2189

    
2190
    vnc_init_timer(vd);
2191

    
2192
    /* vs might be free()ed here */
2193
}
2194

    
2195
static void vnc_listen_read(void *opaque)
2196
{
2197
    VncDisplay *vs = opaque;
2198
    struct sockaddr_in addr;
2199
    socklen_t addrlen = sizeof(addr);
2200

    
2201
    /* Catch-up */
2202
    vga_hw_update();
2203

    
2204
    int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2205
    if (csock != -1) {
2206
        vnc_connect(vs, csock);
2207
    }
2208
}
2209

    
2210
void vnc_display_init(DisplayState *ds)
2211
{
2212
    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2213

    
2214
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2215

    
2216
    ds->opaque = vs;
2217
    dcl->idle = 1;
2218
    vnc_display = vs;
2219

    
2220
    vs->lsock = -1;
2221

    
2222
    vs->ds = ds;
2223

    
2224
    if (keyboard_layout)
2225
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2226
    else
2227
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2228

    
2229
    if (!vs->kbd_layout)
2230
        exit(1);
2231

    
2232
    dcl->dpy_copy = vnc_dpy_copy;
2233
    dcl->dpy_update = vnc_dpy_update;
2234
    dcl->dpy_resize = vnc_dpy_resize;
2235
    dcl->dpy_setdata = vnc_dpy_setdata;
2236
    register_displaychangelistener(ds, dcl);
2237
}
2238

    
2239

    
2240
void vnc_display_close(DisplayState *ds)
2241
{
2242
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2243

    
2244
    if (!vs)
2245
        return;
2246
    if (vs->display) {
2247
        qemu_free(vs->display);
2248
        vs->display = NULL;
2249
    }
2250
    if (vs->lsock != -1) {
2251
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2252
        close(vs->lsock);
2253
        vs->lsock = -1;
2254
    }
2255
    vs->auth = VNC_AUTH_INVALID;
2256
#ifdef CONFIG_VNC_TLS
2257
    vs->subauth = VNC_AUTH_INVALID;
2258
    vs->tls.x509verify = 0;
2259
#endif
2260
}
2261

    
2262
int vnc_display_password(DisplayState *ds, const char *password)
2263
{
2264
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2265

    
2266
    if (!vs) {
2267
        return -1;
2268
    }
2269

    
2270
    if (vs->password) {
2271
        qemu_free(vs->password);
2272
        vs->password = NULL;
2273
    }
2274
    if (password && password[0]) {
2275
        if (!(vs->password = qemu_strdup(password)))
2276
            return -1;
2277
        if (vs->auth == VNC_AUTH_NONE) {
2278
            vs->auth = VNC_AUTH_VNC;
2279
        }
2280
    } else {
2281
        vs->auth = VNC_AUTH_NONE;
2282
    }
2283

    
2284
    return 0;
2285
}
2286

    
2287
char *vnc_display_local_addr(DisplayState *ds)
2288
{
2289
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2290
    
2291
    return vnc_socket_local_addr("%s:%s", vs->lsock);
2292
}
2293

    
2294
int vnc_display_open(DisplayState *ds, const char *display)
2295
{
2296
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2297
    const char *options;
2298
    int password = 0;
2299
    int reverse = 0;
2300
    int to_port = 0;
2301
#ifdef CONFIG_VNC_TLS
2302
    int tls = 0, x509 = 0;
2303
#endif
2304
#ifdef CONFIG_VNC_SASL
2305
    int sasl = 0;
2306
    int saslErr;
2307
#endif
2308
    int acl = 0;
2309

    
2310
    if (!vnc_display)
2311
        return -1;
2312
    vnc_display_close(ds);
2313
    if (strcmp(display, "none") == 0)
2314
        return 0;
2315

    
2316
    if (!(vs->display = strdup(display)))
2317
        return -1;
2318

    
2319
    options = display;
2320
    while ((options = strchr(options, ','))) {
2321
        options++;
2322
        if (strncmp(options, "password", 8) == 0) {
2323
            password = 1; /* Require password auth */
2324
        } else if (strncmp(options, "reverse", 7) == 0) {
2325
            reverse = 1;
2326
        } else if (strncmp(options, "to=", 3) == 0) {
2327
            to_port = atoi(options+3) + 5900;
2328
#ifdef CONFIG_VNC_SASL
2329
        } else if (strncmp(options, "sasl", 4) == 0) {
2330
            sasl = 1; /* Require SASL auth */
2331
#endif
2332
#ifdef CONFIG_VNC_TLS
2333
        } else if (strncmp(options, "tls", 3) == 0) {
2334
            tls = 1; /* Require TLS */
2335
        } else if (strncmp(options, "x509", 4) == 0) {
2336
            char *start, *end;
2337
            x509 = 1; /* Require x509 certificates */
2338
            if (strncmp(options, "x509verify", 10) == 0)
2339
                vs->tls.x509verify = 1; /* ...and verify client certs */
2340

    
2341
            /* Now check for 'x509=/some/path' postfix
2342
             * and use that to setup x509 certificate/key paths */
2343
            start = strchr(options, '=');
2344
            end = strchr(options, ',');
2345
            if (start && (!end || (start < end))) {
2346
                int len = end ? end-(start+1) : strlen(start+1);
2347
                char *path = qemu_strndup(start + 1, len);
2348

    
2349
                VNC_DEBUG("Trying certificate path '%s'\n", path);
2350
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2351
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2352
                    qemu_free(path);
2353
                    qemu_free(vs->display);
2354
                    vs->display = NULL;
2355
                    return -1;
2356
                }
2357
                qemu_free(path);
2358
            } else {
2359
                fprintf(stderr, "No certificate path provided\n");
2360
                qemu_free(vs->display);
2361
                vs->display = NULL;
2362
                return -1;
2363
            }
2364
#endif
2365
        } else if (strncmp(options, "acl", 3) == 0) {
2366
            acl = 1;
2367
        }
2368
    }
2369

    
2370
#ifdef CONFIG_VNC_TLS
2371
    if (acl && x509 && vs->tls.x509verify) {
2372
        if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2373
            fprintf(stderr, "Failed to create x509 dname ACL\n");
2374
            exit(1);
2375
        }
2376
    }
2377
#endif
2378
#ifdef CONFIG_VNC_SASL
2379
    if (acl && sasl) {
2380
        if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2381
            fprintf(stderr, "Failed to create username ACL\n");
2382
            exit(1);
2383
        }
2384
    }
2385
#endif
2386

    
2387
    /*
2388
     * Combinations we support here:
2389
     *
2390
     *  - no-auth                (clear text, no auth)
2391
     *  - password               (clear text, weak auth)
2392
     *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
2393
     *  - tls                    (encrypt, weak anonymous creds, no auth)
2394
     *  - tls + password         (encrypt, weak anonymous creds, weak auth)
2395
     *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
2396
     *  - tls + x509             (encrypt, good x509 creds, no auth)
2397
     *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
2398
     *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
2399
     *
2400
     * NB1. TLS is a stackable auth scheme.
2401
     * NB2. the x509 schemes have option to validate a client cert dname
2402
     */
2403
    if (password) {
2404
#ifdef CONFIG_VNC_TLS
2405
        if (tls) {
2406
            vs->auth = VNC_AUTH_VENCRYPT;
2407
            if (x509) {
2408
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2409
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2410
            } else {
2411
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2412
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2413
            }
2414
        } else {
2415
#endif /* CONFIG_VNC_TLS */
2416
            VNC_DEBUG("Initializing VNC server with password auth\n");
2417
            vs->auth = VNC_AUTH_VNC;
2418
#ifdef CONFIG_VNC_TLS
2419
            vs->subauth = VNC_AUTH_INVALID;
2420
        }
2421
#endif /* CONFIG_VNC_TLS */
2422
#ifdef CONFIG_VNC_SASL
2423
    } else if (sasl) {
2424
#ifdef CONFIG_VNC_TLS
2425
        if (tls) {
2426
            vs->auth = VNC_AUTH_VENCRYPT;
2427
            if (x509) {
2428
                VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2429
                vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2430
            } else {
2431
                VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2432
                vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2433
            }
2434
        } else {
2435
#endif /* CONFIG_VNC_TLS */
2436
            VNC_DEBUG("Initializing VNC server with SASL auth\n");
2437
            vs->auth = VNC_AUTH_SASL;
2438
#ifdef CONFIG_VNC_TLS
2439
            vs->subauth = VNC_AUTH_INVALID;
2440
        }
2441
#endif /* CONFIG_VNC_TLS */
2442
#endif /* CONFIG_VNC_SASL */
2443
    } else {
2444
#ifdef CONFIG_VNC_TLS
2445
        if (tls) {
2446
            vs->auth = VNC_AUTH_VENCRYPT;
2447
            if (x509) {
2448
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2449
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2450
            } else {
2451
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2452
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2453
            }
2454
        } else {
2455
#endif
2456
            VNC_DEBUG("Initializing VNC server with no auth\n");
2457
            vs->auth = VNC_AUTH_NONE;
2458
#ifdef CONFIG_VNC_TLS
2459
            vs->subauth = VNC_AUTH_INVALID;
2460
        }
2461
#endif
2462
    }
2463

    
2464
#ifdef CONFIG_VNC_SASL
2465
    if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2466
        fprintf(stderr, "Failed to initialize SASL auth %s",
2467
                sasl_errstring(saslErr, NULL, NULL));
2468
        free(vs->display);
2469
        vs->display = NULL;
2470
        return -1;
2471
    }
2472
#endif
2473

    
2474
    if (reverse) {
2475
        /* connect to viewer */
2476
        if (strncmp(display, "unix:", 5) == 0)
2477
            vs->lsock = unix_connect(display+5);
2478
        else
2479
            vs->lsock = inet_connect(display, SOCK_STREAM);
2480
        if (-1 == vs->lsock) {
2481
            free(vs->display);
2482
            vs->display = NULL;
2483
            return -1;
2484
        } else {
2485
            int csock = vs->lsock;
2486
            vs->lsock = -1;
2487
            vnc_connect(vs, csock);
2488
        }
2489
        return 0;
2490

    
2491
    } else {
2492
        /* listen for connects */
2493
        char *dpy;
2494
        dpy = qemu_malloc(256);
2495
        if (strncmp(display, "unix:", 5) == 0) {
2496
            pstrcpy(dpy, 256, "unix:");
2497
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2498
        } else {
2499
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2500
        }
2501
        if (-1 == vs->lsock) {
2502
            free(dpy);
2503
            return -1;
2504
        } else {
2505
            free(vs->display);
2506
            vs->display = dpy;
2507
        }
2508
    }
2509
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2510
}