Home | History | Annotate | Download | only in ui
      1 /*
      2  * QEMU VNC display driver
      3  *
      4  * Copyright (C) 2006 Anthony Liguori <anthony (at) codemonkey.ws>
      5  * Copyright (C) 2006 Fabrice Bellard
      6  * Copyright (C) 2009 Red Hat, Inc
      7  *
      8  * Permission is hereby granted, free of charge, to any person obtaining a copy
      9  * of this software and associated documentation files (the "Software"), to deal
     10  * in the Software without restriction, including without limitation the rights
     11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     12  * copies of the Software, and to permit persons to whom the Software is
     13  * furnished to do so, subject to the following conditions:
     14  *
     15  * The above copyright notice and this permission notice shall be included in
     16  * all copies or substantial portions of the Software.
     17  *
     18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     24  * THE SOFTWARE.
     25  */
     26 
     27 #include "vnc.h"
     28 #include "sysemu/sysemu.h"
     29 #include "qemu/sockets.h"
     30 #include "qemu/timer.h"
     31 #include "qemu/acl.h"
     32 
     33 #define VNC_REFRESH_INTERVAL (1000 / 30)
     34 
     35 #include "vnc_keysym.h"
     36 #include "d3des.h"
     37 
     38 #define count_bits(c, v) { \
     39     for (c = 0; v; v >>= 1) \
     40     { \
     41         c += v & 1; \
     42     } \
     43 }
     44 
     45 
     46 static VncDisplay *vnc_display; /* needed for info vnc */
     47 static DisplayChangeListener *dcl;
     48 
     49 static char *addr_to_string(const char *format,
     50                             struct sockaddr_storage *sa,
     51                             socklen_t salen) {
     52     char *addr;
     53     char host[NI_MAXHOST];
     54     char serv[NI_MAXSERV];
     55     int err;
     56     size_t addrlen;
     57 
     58     if ((err = getnameinfo((struct sockaddr *)sa, salen,
     59                            host, sizeof(host),
     60                            serv, sizeof(serv),
     61                            NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
     62         VNC_DEBUG("Cannot resolve address %d: %s\n",
     63                   err, gai_strerror(err));
     64         return NULL;
     65     }
     66 
     67     /* Enough for the existing format + the 2 vars we're
     68      * substituting in. */
     69     addrlen = strlen(format) + strlen(host) + strlen(serv);
     70     addr = g_malloc(addrlen + 1);
     71     snprintf(addr, addrlen, format, host, serv);
     72     addr[addrlen] = '\0';
     73 
     74     return addr;
     75 }
     76 
     77 
     78 char *vnc_socket_local_addr(const char *format, int fd) {
     79     struct sockaddr_storage sa;
     80     socklen_t salen;
     81 
     82     salen = sizeof(sa);
     83     if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
     84         return NULL;
     85 
     86     return addr_to_string(format, &sa, salen);
     87 }
     88 
     89 char *vnc_socket_remote_addr(const char *format, int fd) {
     90     struct sockaddr_storage sa;
     91     socklen_t salen;
     92 
     93     salen = sizeof(sa);
     94     if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
     95         return NULL;
     96 
     97     return addr_to_string(format, &sa, salen);
     98 }
     99 
    100 static const char *vnc_auth_name(VncDisplay *vd) {
    101     switch (vd->auth) {
    102     case VNC_AUTH_INVALID:
    103         return "invalid";
    104     case VNC_AUTH_NONE:
    105         return "none";
    106     case VNC_AUTH_VNC:
    107         return "vnc";
    108     case VNC_AUTH_RA2:
    109         return "ra2";
    110     case VNC_AUTH_RA2NE:
    111         return "ra2ne";
    112     case VNC_AUTH_TIGHT:
    113         return "tight";
    114     case VNC_AUTH_ULTRA:
    115         return "ultra";
    116     case VNC_AUTH_TLS:
    117         return "tls";
    118     case VNC_AUTH_VENCRYPT:
    119 #ifdef CONFIG_VNC_TLS
    120         switch (vd->subauth) {
    121         case VNC_AUTH_VENCRYPT_PLAIN:
    122             return "vencrypt+plain";
    123         case VNC_AUTH_VENCRYPT_TLSNONE:
    124             return "vencrypt+tls+none";
    125         case VNC_AUTH_VENCRYPT_TLSVNC:
    126             return "vencrypt+tls+vnc";
    127         case VNC_AUTH_VENCRYPT_TLSPLAIN:
    128             return "vencrypt+tls+plain";
    129         case VNC_AUTH_VENCRYPT_X509NONE:
    130             return "vencrypt+x509+none";
    131         case VNC_AUTH_VENCRYPT_X509VNC:
    132             return "vencrypt+x509+vnc";
    133         case VNC_AUTH_VENCRYPT_X509PLAIN:
    134             return "vencrypt+x509+plain";
    135         case VNC_AUTH_VENCRYPT_TLSSASL:
    136             return "vencrypt+tls+sasl";
    137         case VNC_AUTH_VENCRYPT_X509SASL:
    138             return "vencrypt+x509+sasl";
    139         default:
    140             return "vencrypt";
    141         }
    142 #else
    143         return "vencrypt";
    144 #endif
    145     case VNC_AUTH_SASL:
    146         return "sasl";
    147     }
    148     return "unknown";
    149 }
    150 
    151 static void do_info_vnc_client(Monitor *mon, VncState *client)
    152 {
    153     char *clientAddr =
    154         vnc_socket_remote_addr("     address: %s:%s\n",
    155                                client->csock);
    156     if (!clientAddr)
    157         return;
    158 
    159     monitor_printf(mon, "Client:\n");
    160     monitor_printf(mon, "%s", clientAddr);
    161     free(clientAddr);
    162 
    163 #ifdef CONFIG_VNC_TLS
    164     if (client->tls.session &&
    165         client->tls.dname)
    166         monitor_printf(mon, "  x509 dname: %s\n", client->tls.dname);
    167     else
    168         monitor_printf(mon, "  x509 dname: none\n");
    169 #endif
    170 #ifdef CONFIG_VNC_SASL
    171     if (client->sasl.conn &&
    172         client->sasl.username)
    173         monitor_printf(mon, "    username: %s\n", client->sasl.username);
    174     else
    175         monitor_printf(mon, "    username: none\n");
    176 #endif
    177 }
    178 
    179 void do_info_vnc(Monitor *mon)
    180 {
    181     if (vnc_display == NULL || vnc_display->display == NULL) {
    182         monitor_printf(mon, "Server: disabled\n");
    183     } else {
    184         char *serverAddr = vnc_socket_local_addr("     address: %s:%s\n",
    185                                                  vnc_display->lsock);
    186 
    187         if (!serverAddr)
    188             return;
    189 
    190         monitor_printf(mon, "Server:\n");
    191         monitor_printf(mon, "%s", serverAddr);
    192         free(serverAddr);
    193         monitor_printf(mon, "        auth: %s\n", vnc_auth_name(vnc_display));
    194 
    195         if (vnc_display->clients) {
    196             VncState *client = vnc_display->clients;
    197             while (client) {
    198                 do_info_vnc_client(mon, client);
    199                 client = client->next;
    200             }
    201         } else {
    202             monitor_printf(mon, "Client: none\n");
    203         }
    204     }
    205 }
    206 
    207 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
    208     return (vs->features & (1 << feature));
    209 }
    210 
    211 /* TODO
    212    1) Get the queue working for IO.
    213    2) there is some weirdness when using the -S option (the screen is grey
    214       and not totally invalidated
    215    3) resolutions > 1024
    216 */
    217 
    218 static void vnc_update_client(void *opaque);
    219 static void vnc_disconnect_start(VncState *vs);
    220 static void vnc_disconnect_finish(VncState *vs);
    221 
    222 static void vnc_colordepth(VncState *vs);
    223 
    224 static inline void vnc_set_bit(uint32_t *d, int k)
    225 {
    226     d[k >> 5] |= 1 << (k & 0x1f);
    227 }
    228 
    229 static inline void vnc_clear_bit(uint32_t *d, int k)
    230 {
    231     d[k >> 5] &= ~(1 << (k & 0x1f));
    232 }
    233 
    234 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
    235 {
    236     int j;
    237 
    238     j = 0;
    239     while (n >= 32) {
    240         d[j++] = -1;
    241         n -= 32;
    242     }
    243     if (n > 0)
    244         d[j++] = (1 << n) - 1;
    245     while (j < nb_words)
    246         d[j++] = 0;
    247 }
    248 
    249 static inline int vnc_get_bit(const uint32_t *d, int k)
    250 {
    251     return (d[k >> 5] >> (k & 0x1f)) & 1;
    252 }
    253 
    254 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
    255                                int nb_words)
    256 {
    257     int i;
    258     for(i = 0; i < nb_words; i++) {
    259         if ((d1[i] & d2[i]) != 0)
    260             return 1;
    261     }
    262     return 0;
    263 }
    264 
    265 static void vnc_update(VncState *vs, int x, int y, int w, int h)
    266 {
    267     struct VncSurface *s = &vs->guest;
    268     int i;
    269 
    270     h += y;
    271 
    272     /* round x down to ensure the loop only spans one 16-pixel block per,
    273        iteration.  otherwise, if (x % 16) != 0, the last iteration may span
    274        two 16-pixel blocks but we only mark the first as dirty
    275     */
    276     w += (x % 16);
    277     x -= (x % 16);
    278 
    279     x = MIN(x, s->ds->width);
    280     y = MIN(y, s->ds->height);
    281     w = MIN(x + w, s->ds->width) - x;
    282     h = MIN(h, s->ds->height);
    283 
    284     for (; y < h; y++)
    285         for (i = 0; i < w; i += 16)
    286             vnc_set_bit(s->dirty[y], (x + i) / 16);
    287 }
    288 
    289 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
    290 {
    291     VncDisplay *vd = ds->opaque;
    292     VncState *vs = vd->clients;
    293     while (vs != NULL) {
    294         vnc_update(vs, x, y, w, h);
    295         vs = vs->next;
    296     }
    297 }
    298 
    299 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
    300                                    int32_t encoding)
    301 {
    302     vnc_write_u16(vs, x);
    303     vnc_write_u16(vs, y);
    304     vnc_write_u16(vs, w);
    305     vnc_write_u16(vs, h);
    306 
    307     vnc_write_s32(vs, encoding);
    308 }
    309 
    310 void buffer_reserve(Buffer *buffer, size_t len)
    311 {
    312     if ((buffer->capacity - buffer->offset) < len) {
    313         buffer->capacity += (len + 1024);
    314         buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
    315         if (buffer->buffer == NULL) {
    316             fprintf(stderr, "vnc: out of memory\n");
    317             exit(1);
    318         }
    319     }
    320 }
    321 
    322 int buffer_empty(Buffer *buffer)
    323 {
    324     return buffer->offset == 0;
    325 }
    326 
    327 uint8_t *buffer_end(Buffer *buffer)
    328 {
    329     return buffer->buffer + buffer->offset;
    330 }
    331 
    332 void buffer_reset(Buffer *buffer)
    333 {
    334         buffer->offset = 0;
    335 }
    336 
    337 void buffer_append(Buffer *buffer, const void *data, size_t len)
    338 {
    339     memcpy(buffer->buffer + buffer->offset, data, len);
    340     buffer->offset += len;
    341 }
    342 
    343 static void vnc_resize(VncState *vs)
    344 {
    345     DisplayState *ds = vs->ds;
    346     int size_changed;
    347 
    348     /* guest surface */
    349     if (!vs->guest.ds)
    350         vs->guest.ds = g_malloc0(sizeof(*vs->guest.ds));
    351     if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
    352         console_color_init(ds);
    353     vnc_colordepth(vs);
    354     size_changed = ds_get_width(ds) != vs->guest.ds->width ||
    355                    ds_get_height(ds) != vs->guest.ds->height;
    356     *(vs->guest.ds) = *(ds->surface);
    357     if (size_changed) {
    358         if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
    359             vnc_write_u8(vs, 0);  /* msg id */
    360             vnc_write_u8(vs, 0);
    361             vnc_write_u16(vs, 1); /* number of rects */
    362             vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
    363                                    VNC_ENCODING_DESKTOPRESIZE);
    364             vnc_flush(vs);
    365         }
    366     }
    367     memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
    368 
    369     /* server surface */
    370     if (!vs->server.ds)
    371         vs->server.ds = g_malloc0(sizeof(*vs->server.ds));
    372     if (vs->server.ds->data)
    373         g_free(vs->server.ds->data);
    374     *(vs->server.ds) = *(ds->surface);
    375     vs->server.ds->data = g_malloc0(vs->server.ds->linesize *
    376                                        vs->server.ds->height);
    377     memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
    378 }
    379 
    380 static void vnc_dpy_resize(DisplayState *ds)
    381 {
    382     VncDisplay *vd = ds->opaque;
    383     VncState *vs = vd->clients;
    384     while (vs != NULL) {
    385         vnc_resize(vs);
    386         vs = vs->next;
    387     }
    388 }
    389 
    390 /* fastest code */
    391 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
    392 {
    393     vnc_write(vs, pixels, size);
    394 }
    395 
    396 /* slowest but generic code. */
    397 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
    398 {
    399     uint8_t r, g, b;
    400 
    401     r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
    402         vs->server.ds->pf.rbits);
    403     g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
    404         vs->server.ds->pf.gbits);
    405     b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
    406         vs->server.ds->pf.bbits);
    407     v = (r << vs->clientds.pf.rshift) |
    408         (g << vs->clientds.pf.gshift) |
    409         (b << vs->clientds.pf.bshift);
    410     switch(vs->clientds.pf.bytes_per_pixel) {
    411     case 1:
    412         buf[0] = v;
    413         break;
    414     case 2:
    415         if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
    416             buf[0] = v >> 8;
    417             buf[1] = v;
    418         } else {
    419             buf[1] = v >> 8;
    420             buf[0] = v;
    421         }
    422         break;
    423     default:
    424     case 4:
    425         if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
    426             buf[0] = v >> 24;
    427             buf[1] = v >> 16;
    428             buf[2] = v >> 8;
    429             buf[3] = v;
    430         } else {
    431             buf[3] = v >> 24;
    432             buf[2] = v >> 16;
    433             buf[1] = v >> 8;
    434             buf[0] = v;
    435         }
    436         break;
    437     }
    438 }
    439 
    440 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
    441 {
    442     uint8_t buf[4];
    443 
    444     if (vs->server.ds->pf.bytes_per_pixel == 4) {
    445         uint32_t *pixels = pixels1;
    446         int n, i;
    447         n = size >> 2;
    448         for(i = 0; i < n; i++) {
    449             vnc_convert_pixel(vs, buf, pixels[i]);
    450             vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
    451         }
    452     } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
    453         uint16_t *pixels = pixels1;
    454         int n, i;
    455         n = size >> 1;
    456         for(i = 0; i < n; i++) {
    457             vnc_convert_pixel(vs, buf, pixels[i]);
    458             vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
    459         }
    460     } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
    461         uint8_t *pixels = pixels1;
    462         int n, i;
    463         n = size;
    464         for(i = 0; i < n; i++) {
    465             vnc_convert_pixel(vs, buf, pixels[i]);
    466             vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
    467         }
    468     } else {
    469         fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
    470     }
    471 }
    472 
    473 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
    474 {
    475     int i;
    476     uint8_t *row;
    477 
    478     row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
    479     for (i = 0; i < h; i++) {
    480         vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
    481         row += ds_get_linesize(vs->ds);
    482     }
    483 }
    484 
    485 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
    486 {
    487     ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
    488     ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
    489 }
    490 
    491 #define BPP 8
    492 #include "vnchextile.h"
    493 #undef BPP
    494 
    495 #define BPP 16
    496 #include "vnchextile.h"
    497 #undef BPP
    498 
    499 #define BPP 32
    500 #include "vnchextile.h"
    501 #undef BPP
    502 
    503 #define GENERIC
    504 #define BPP 8
    505 #include "vnchextile.h"
    506 #undef BPP
    507 #undef GENERIC
    508 
    509 #define GENERIC
    510 #define BPP 16
    511 #include "vnchextile.h"
    512 #undef BPP
    513 #undef GENERIC
    514 
    515 #define GENERIC
    516 #define BPP 32
    517 #include "vnchextile.h"
    518 #undef BPP
    519 #undef GENERIC
    520 
    521 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
    522 {
    523     int i, j;
    524     int has_fg, has_bg;
    525     uint8_t *last_fg, *last_bg;
    526 
    527     last_fg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
    528     last_bg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel);
    529     has_fg = has_bg = 0;
    530     for (j = y; j < (y + h); j += 16) {
    531         for (i = x; i < (x + w); i += 16) {
    532             vs->send_hextile_tile(vs, i, j,
    533                                   MIN(16, x + w - i), MIN(16, y + h - j),
    534                                   last_bg, last_fg, &has_bg, &has_fg);
    535         }
    536     }
    537     free(last_fg);
    538     free(last_bg);
    539 
    540 }
    541 
    542 static void vnc_zlib_init(VncState *vs)
    543 {
    544     int i;
    545     for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
    546         vs->zlib_stream[i].opaque = NULL;
    547 }
    548 
    549 static void vnc_zlib_start(VncState *vs)
    550 {
    551     buffer_reset(&vs->zlib);
    552 
    553     // make the output buffer be the zlib buffer, so we can compress it later
    554     vs->zlib_tmp = vs->output;
    555     vs->output = vs->zlib;
    556 }
    557 
    558 static int vnc_zlib_stop(VncState *vs, int stream_id)
    559 {
    560     z_streamp zstream = &vs->zlib_stream[stream_id];
    561     int previous_out;
    562 
    563     // switch back to normal output/zlib buffers
    564     vs->zlib = vs->output;
    565     vs->output = vs->zlib_tmp;
    566 
    567     // compress the zlib buffer
    568 
    569     // initialize the stream
    570     // XXX need one stream per session
    571     if (zstream->opaque != vs) {
    572         int err;
    573 
    574         VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
    575         VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
    576         zstream->zalloc = Z_NULL;
    577         zstream->zfree = Z_NULL;
    578 
    579         err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
    580                            MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
    581 
    582         if (err != Z_OK) {
    583             fprintf(stderr, "VNC: error initializing zlib\n");
    584             return -1;
    585         }
    586 
    587         zstream->opaque = vs;
    588     }
    589 
    590     // XXX what to do if tight_compression changed in between?
    591 
    592     // reserve memory in output buffer
    593     buffer_reserve(&vs->output, vs->zlib.offset + 64);
    594 
    595     // set pointers
    596     zstream->next_in = vs->zlib.buffer;
    597     zstream->avail_in = vs->zlib.offset;
    598     zstream->next_out = vs->output.buffer + vs->output.offset;
    599     zstream->avail_out = vs->output.capacity - vs->output.offset;
    600     zstream->data_type = Z_BINARY;
    601     previous_out = zstream->total_out;
    602 
    603     // start encoding
    604     if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
    605         fprintf(stderr, "VNC: error during zlib compression\n");
    606         return -1;
    607     }
    608 
    609     vs->output.offset = vs->output.capacity - zstream->avail_out;
    610     return zstream->total_out - previous_out;
    611 }
    612 
    613 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
    614 {
    615     int old_offset, new_offset, bytes_written;
    616 
    617     vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
    618 
    619     // remember where we put in the follow-up size
    620     old_offset = vs->output.offset;
    621     vnc_write_s32(vs, 0);
    622 
    623     // compress the stream
    624     vnc_zlib_start(vs);
    625     send_framebuffer_update_raw(vs, x, y, w, h);
    626     bytes_written = vnc_zlib_stop(vs, 0);
    627 
    628     if (bytes_written == -1)
    629         return;
    630 
    631     // hack in the size
    632     new_offset = vs->output.offset;
    633     vs->output.offset = old_offset;
    634     vnc_write_u32(vs, bytes_written);
    635     vs->output.offset = new_offset;
    636 }
    637 
    638 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
    639 {
    640     switch(vs->vnc_encoding) {
    641         case VNC_ENCODING_ZLIB:
    642             send_framebuffer_update_zlib(vs, x, y, w, h);
    643             break;
    644         case VNC_ENCODING_HEXTILE:
    645             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
    646             send_framebuffer_update_hextile(vs, x, y, w, h);
    647             break;
    648         default:
    649             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
    650             send_framebuffer_update_raw(vs, x, y, w, h);
    651             break;
    652     }
    653 }
    654 
    655 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
    656 {
    657     vnc_write_u8(vs, 0);  /* msg id */
    658     vnc_write_u8(vs, 0);
    659     vnc_write_u16(vs, 1); /* number of rects */
    660     vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
    661     vnc_write_u16(vs, src_x);
    662     vnc_write_u16(vs, src_y);
    663     vnc_flush(vs);
    664 }
    665 
    666 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
    667 {
    668     VncDisplay *vd = ds->opaque;
    669     VncState *vs, *vn;
    670 
    671     for (vs = vd->clients; vs != NULL; vs = vn) {
    672         vn = vs->next;
    673         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
    674             vs->force_update = 1;
    675             vnc_update_client(vs);
    676             /* vs might be free()ed here */
    677         }
    678     }
    679 
    680     for (vs = vd->clients; vs != NULL; vs = vs->next) {
    681         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
    682             vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
    683         else /* TODO */
    684             vnc_update(vs, dst_x, dst_y, w, h);
    685     }
    686 }
    687 
    688 static int find_and_clear_dirty_height(struct VncSurface *s,
    689                                        int y, int last_x, int x)
    690 {
    691     int h;
    692 
    693     for (h = 1; h < (s->ds->height - y); h++) {
    694         int tmp_x;
    695         if (!vnc_get_bit(s->dirty[y + h], last_x))
    696             break;
    697         for (tmp_x = last_x; tmp_x < x; tmp_x++)
    698             vnc_clear_bit(s->dirty[y + h], tmp_x);
    699     }
    700 
    701     return h;
    702 }
    703 
    704 static void vnc_update_client(void *opaque)
    705 {
    706     VncState *vs = opaque;
    707     if (vs->need_update && vs->csock != -1) {
    708         int y;
    709         uint8_t *guest_row;
    710         uint8_t *server_row;
    711         int cmp_bytes;
    712         uint32_t width_mask[VNC_DIRTY_WORDS];
    713         int n_rectangles;
    714         int saved_offset;
    715         int has_dirty = 0;
    716 
    717         if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
    718             /* kernel send buffers are full -> drop frames to throttle */
    719             timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL);
    720             return;
    721         }
    722 
    723         vga_hw_update();
    724 
    725         /*
    726          * Walk through the guest dirty map.
    727          * Check and copy modified bits from guest to server surface.
    728          * Update server dirty map.
    729          */
    730         vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
    731         cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
    732         guest_row  = vs->guest.ds->data;
    733         server_row = vs->server.ds->data;
    734         for (y = 0; y < vs->guest.ds->height; y++) {
    735             if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
    736                 int x;
    737                 uint8_t *guest_ptr;
    738                 uint8_t *server_ptr;
    739 
    740                 guest_ptr  = guest_row;
    741                 server_ptr = server_row;
    742 
    743                 for (x = 0; x < vs->guest.ds->width;
    744                      x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
    745                     if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
    746                         continue;
    747                     vnc_clear_bit(vs->guest.dirty[y], (x / 16));
    748                     if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
    749                         continue;
    750                     memcpy(server_ptr, guest_ptr, cmp_bytes);
    751                     vnc_set_bit(vs->server.dirty[y], (x / 16));
    752                     has_dirty++;
    753                 }
    754             }
    755             guest_row  += ds_get_linesize(vs->ds);
    756             server_row += ds_get_linesize(vs->ds);
    757         }
    758 
    759         if (!has_dirty && !vs->audio_cap && !vs->force_update) {
    760             timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL);
    761             return;
    762         }
    763 
    764         /*
    765          * Send screen updates to the vnc client using the server
    766          * surface and server dirty map.  guest surface updates
    767          * happening in parallel don't disturb us, the next pass will
    768          * send them to the client.
    769          */
    770         n_rectangles = 0;
    771         vnc_write_u8(vs, 0);  /* msg id */
    772         vnc_write_u8(vs, 0);
    773         saved_offset = vs->output.offset;
    774         vnc_write_u16(vs, 0);
    775 
    776         for (y = 0; y < vs->server.ds->height; y++) {
    777             int x;
    778             int last_x = -1;
    779             for (x = 0; x < vs->server.ds->width / 16; x++) {
    780                 if (vnc_get_bit(vs->server.dirty[y], x)) {
    781                     if (last_x == -1) {
    782                         last_x = x;
    783                     }
    784                     vnc_clear_bit(vs->server.dirty[y], x);
    785                 } else {
    786                     if (last_x != -1) {
    787                         int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
    788                         send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
    789                         n_rectangles++;
    790                     }
    791                     last_x = -1;
    792                 }
    793             }
    794             if (last_x != -1) {
    795                 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
    796                 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
    797                 n_rectangles++;
    798             }
    799         }
    800         vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
    801         vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
    802         vnc_flush(vs);
    803         vs->force_update = 0;
    804 
    805     }
    806 
    807     if (vs->csock != -1) {
    808         timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL);
    809     } else {
    810         vnc_disconnect_finish(vs);
    811     }
    812 
    813 }
    814 
    815 /* audio */
    816 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
    817 {
    818     VncState *vs = opaque;
    819 
    820     switch (cmd) {
    821     case AUD_CNOTIFY_DISABLE:
    822         vnc_write_u8(vs, 255);
    823         vnc_write_u8(vs, 1);
    824         vnc_write_u16(vs, 0);
    825         vnc_flush(vs);
    826         break;
    827 
    828     case AUD_CNOTIFY_ENABLE:
    829         vnc_write_u8(vs, 255);
    830         vnc_write_u8(vs, 1);
    831         vnc_write_u16(vs, 1);
    832         vnc_flush(vs);
    833         break;
    834     }
    835 }
    836 
    837 static void audio_capture_destroy(void *opaque)
    838 {
    839 }
    840 
    841 static void audio_capture(void *opaque, void *buf, int size)
    842 {
    843     VncState *vs = opaque;
    844 
    845     vnc_write_u8(vs, 255);
    846     vnc_write_u8(vs, 1);
    847     vnc_write_u16(vs, 2);
    848     vnc_write_u32(vs, size);
    849     vnc_write(vs, buf, size);
    850     vnc_flush(vs);
    851 }
    852 
    853 static void audio_add(VncState *vs)
    854 {
    855     Monitor *mon = cur_mon;
    856     struct audio_capture_ops ops;
    857 
    858     if (vs->audio_cap) {
    859         monitor_printf(mon, "audio already running\n");
    860         return;
    861     }
    862 
    863     ops.notify = audio_capture_notify;
    864     ops.destroy = audio_capture_destroy;
    865     ops.capture = audio_capture;
    866 
    867     vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
    868     if (!vs->audio_cap) {
    869         monitor_printf(mon, "Failed to add audio capture\n");
    870     }
    871 }
    872 
    873 static void audio_del(VncState *vs)
    874 {
    875     if (vs->audio_cap) {
    876         AUD_del_capture(vs->audio_cap, vs);
    877         vs->audio_cap = NULL;
    878     }
    879 }
    880 
    881 static void vnc_disconnect_start(VncState *vs)
    882 {
    883     if (vs->csock == -1)
    884         return;
    885     qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
    886     closesocket(vs->csock);
    887     vs->csock = -1;
    888 }
    889 
    890 static void vnc_disconnect_finish(VncState *vs)
    891 {
    892     timer_del(vs->timer);
    893     timer_free(vs->timer);
    894     if (vs->input.buffer) g_free(vs->input.buffer);
    895     if (vs->output.buffer) g_free(vs->output.buffer);
    896 #ifdef CONFIG_VNC_TLS
    897     vnc_tls_client_cleanup(vs);
    898 #endif /* CONFIG_VNC_TLS */
    899 #ifdef CONFIG_VNC_SASL
    900     vnc_sasl_client_cleanup(vs);
    901 #endif /* CONFIG_VNC_SASL */
    902     audio_del(vs);
    903 
    904     VncState *p, *parent = NULL;
    905     for (p = vs->vd->clients; p != NULL; p = p->next) {
    906         if (p == vs) {
    907             if (parent)
    908                 parent->next = p->next;
    909             else
    910                 vs->vd->clients = p->next;
    911             break;
    912         }
    913         parent = p;
    914     }
    915     if (!vs->vd->clients)
    916         dcl->idle = 1;
    917 
    918     g_free(vs->server.ds->data);
    919     g_free(vs->server.ds);
    920     g_free(vs->guest.ds);
    921     g_free(vs);
    922 }
    923 
    924 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
    925 {
    926     if (ret == 0 || ret == -1) {
    927         if (ret == -1) {
    928             switch (last_errno) {
    929                 case EINTR:
    930                 case EAGAIN:
    931 #ifdef _WIN32
    932                 case WSAEWOULDBLOCK:
    933 #endif
    934                     return 0;
    935                 default:
    936                     break;
    937             }
    938         }
    939 
    940         VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
    941                   ret, ret < 0 ? last_errno : 0);
    942         vnc_disconnect_start(vs);
    943 
    944         return 0;
    945     }
    946     return ret;
    947 }
    948 
    949 
    950 void vnc_client_error(VncState *vs)
    951 {
    952     VNC_DEBUG("Closing down client sock: protocol error\n");
    953     vnc_disconnect_start(vs);
    954 }
    955 
    956 
    957 /*
    958  * Called to write a chunk of data to the client socket. The data may
    959  * be the raw data, or may have already been encoded by SASL.
    960  * The data will be written either straight onto the socket, or
    961  * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
    962  *
    963  * NB, it is theoretically possible to have 2 layers of encryption,
    964  * both SASL, and this TLS layer. It is highly unlikely in practice
    965  * though, since SASL encryption will typically be a no-op if TLS
    966  * is active
    967  *
    968  * Returns the number of bytes written, which may be less than
    969  * the requested 'datalen' if the socket would block. Returns
    970  * -1 on error, and disconnects the client socket.
    971  */
    972 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
    973 {
    974     long ret;
    975 #ifdef CONFIG_VNC_TLS
    976     if (vs->tls.session) {
    977         ret = gnutls_write(vs->tls.session, data, datalen);
    978         if (ret < 0) {
    979             if (ret == GNUTLS_E_AGAIN)
    980                 errno = EAGAIN;
    981             else
    982                 errno = EIO;
    983             ret = -1;
    984         }
    985     } else
    986 #endif /* CONFIG_VNC_TLS */
    987         ret = send(vs->csock, (const void *)data, datalen, 0);
    988     VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
    989     return vnc_client_io_error(vs, ret, socket_error());
    990 }
    991 
    992 
    993 /*
    994  * Called to write buffered data to the client socket, when not
    995  * using any SASL SSF encryption layers. Will write as much data
    996  * as possible without blocking. If all buffered data is written,
    997  * will switch the FD poll() handler back to read monitoring.
    998  *
    999  * Returns the number of bytes written, which may be less than
   1000  * the buffered output data if the socket would block. Returns
   1001  * -1 on error, and disconnects the client socket.
   1002  */
   1003 static long vnc_client_write_plain(VncState *vs)
   1004 {
   1005     long ret;
   1006 
   1007 #ifdef CONFIG_VNC_SASL
   1008     VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
   1009               vs->output.buffer, vs->output.capacity, vs->output.offset,
   1010               vs->sasl.waitWriteSSF);
   1011 
   1012     if (vs->sasl.conn &&
   1013         vs->sasl.runSSF &&
   1014         vs->sasl.waitWriteSSF) {
   1015         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
   1016         if (ret)
   1017             vs->sasl.waitWriteSSF -= ret;
   1018     } else
   1019 #endif /* CONFIG_VNC_SASL */
   1020         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
   1021     if (!ret)
   1022         return 0;
   1023 
   1024     memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
   1025     vs->output.offset -= ret;
   1026 
   1027     if (vs->output.offset == 0) {
   1028         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
   1029     }
   1030 
   1031     return ret;
   1032 }
   1033 
   1034 
   1035 /*
   1036  * First function called whenever there is data to be written to
   1037  * the client socket. Will delegate actual work according to whether
   1038  * SASL SSF layers are enabled (thus requiring encryption calls)
   1039  */
   1040 void vnc_client_write(void *opaque)
   1041 {
   1042     long ret;
   1043     VncState *vs = opaque;
   1044 
   1045 #ifdef CONFIG_VNC_SASL
   1046     if (vs->sasl.conn &&
   1047         vs->sasl.runSSF &&
   1048         !vs->sasl.waitWriteSSF)
   1049         ret = vnc_client_write_sasl(vs);
   1050     else
   1051 #endif /* CONFIG_VNC_SASL */
   1052         ret = vnc_client_write_plain(vs);
   1053 }
   1054 
   1055 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
   1056 {
   1057     vs->read_handler = func;
   1058     vs->read_handler_expect = expecting;
   1059 }
   1060 
   1061 
   1062 /*
   1063  * Called to read a chunk of data from the client socket. The data may
   1064  * be the raw data, or may need to be further decoded by SASL.
   1065  * The data will be read either straight from to the socket, or
   1066  * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
   1067  *
   1068  * NB, it is theoretically possible to have 2 layers of encryption,
   1069  * both SASL, and this TLS layer. It is highly unlikely in practice
   1070  * though, since SASL encryption will typically be a no-op if TLS
   1071  * is active
   1072  *
   1073  * Returns the number of bytes read, which may be less than
   1074  * the requested 'datalen' if the socket would block. Returns
   1075  * -1 on error, and disconnects the client socket.
   1076  */
   1077 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
   1078 {
   1079     long ret;
   1080 #ifdef CONFIG_VNC_TLS
   1081     if (vs->tls.session) {
   1082         ret = gnutls_read(vs->tls.session, data, datalen);
   1083         if (ret < 0) {
   1084             if (ret == GNUTLS_E_AGAIN)
   1085                 errno = EAGAIN;
   1086             else
   1087                 errno = EIO;
   1088             ret = -1;
   1089         }
   1090     } else
   1091 #endif /* CONFIG_VNC_TLS */
   1092         ret = recv(vs->csock, (void *)data, datalen, 0);
   1093     VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
   1094     return vnc_client_io_error(vs, ret, socket_error());
   1095 }
   1096 
   1097 
   1098 /*
   1099  * Called to read data from the client socket to the input buffer,
   1100  * when not using any SASL SSF encryption layers. Will read as much
   1101  * data as possible without blocking.
   1102  *
   1103  * Returns the number of bytes read. Returns -1 on error, and
   1104  * disconnects the client socket.
   1105  */
   1106 static long vnc_client_read_plain(VncState *vs)
   1107 {
   1108     int ret;
   1109     VNC_DEBUG("Read plain %p size %zd offset %zd\n",
   1110               vs->input.buffer, vs->input.capacity, vs->input.offset);
   1111     buffer_reserve(&vs->input, 4096);
   1112     ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
   1113     if (!ret)
   1114         return 0;
   1115     vs->input.offset += ret;
   1116     return ret;
   1117 }
   1118 
   1119 
   1120 /*
   1121  * First function called whenever there is more data to be read from
   1122  * the client socket. Will delegate actual work according to whether
   1123  * SASL SSF layers are enabled (thus requiring decryption calls)
   1124  */
   1125 void vnc_client_read(void *opaque)
   1126 {
   1127     VncState *vs = opaque;
   1128     long ret;
   1129 
   1130 #ifdef CONFIG_VNC_SASL
   1131     if (vs->sasl.conn && vs->sasl.runSSF)
   1132         ret = vnc_client_read_sasl(vs);
   1133     else
   1134 #endif /* CONFIG_VNC_SASL */
   1135         ret = vnc_client_read_plain(vs);
   1136     if (!ret) {
   1137         if (vs->csock == -1)
   1138             vnc_disconnect_finish(vs);
   1139         return;
   1140     }
   1141 
   1142     while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
   1143         size_t len = vs->read_handler_expect;
   1144         int ret;
   1145 
   1146         ret = vs->read_handler(vs, vs->input.buffer, len);
   1147         if (vs->csock == -1) {
   1148             vnc_disconnect_finish(vs);
   1149             return;
   1150         }
   1151 
   1152         if (!ret) {
   1153             memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
   1154             vs->input.offset -= len;
   1155         } else {
   1156             vs->read_handler_expect = ret;
   1157         }
   1158     }
   1159 }
   1160 
   1161 void vnc_write(VncState *vs, const void *data, size_t len)
   1162 {
   1163     buffer_reserve(&vs->output, len);
   1164 
   1165     if (vs->csock != -1 && buffer_empty(&vs->output)) {
   1166         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
   1167     }
   1168 
   1169     buffer_append(&vs->output, data, len);
   1170 }
   1171 
   1172 void vnc_write_s32(VncState *vs, int32_t value)
   1173 {
   1174     vnc_write_u32(vs, *(uint32_t *)&value);
   1175 }
   1176 
   1177 void vnc_write_u32(VncState *vs, uint32_t value)
   1178 {
   1179     uint8_t buf[4];
   1180 
   1181     buf[0] = (value >> 24) & 0xFF;
   1182     buf[1] = (value >> 16) & 0xFF;
   1183     buf[2] = (value >>  8) & 0xFF;
   1184     buf[3] = value & 0xFF;
   1185 
   1186     vnc_write(vs, buf, 4);
   1187 }
   1188 
   1189 void vnc_write_u16(VncState *vs, uint16_t value)
   1190 {
   1191     uint8_t buf[2];
   1192 
   1193     buf[0] = (value >> 8) & 0xFF;
   1194     buf[1] = value & 0xFF;
   1195 
   1196     vnc_write(vs, buf, 2);
   1197 }
   1198 
   1199 void vnc_write_u8(VncState *vs, uint8_t value)
   1200 {
   1201     vnc_write(vs, (char *)&value, 1);
   1202 }
   1203 
   1204 void vnc_flush(VncState *vs)
   1205 {
   1206     if (vs->csock != -1 && vs->output.offset)
   1207         vnc_client_write(vs);
   1208 }
   1209 
   1210 uint8_t read_u8(uint8_t *data, size_t offset)
   1211 {
   1212     return data[offset];
   1213 }
   1214 
   1215 uint16_t read_u16(uint8_t *data, size_t offset)
   1216 {
   1217     return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
   1218 }
   1219 
   1220 int32_t read_s32(uint8_t *data, size_t offset)
   1221 {
   1222     return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
   1223                      (data[offset + 2] << 8) | data[offset + 3]);
   1224 }
   1225 
   1226 uint32_t read_u32(uint8_t *data, size_t offset)
   1227 {
   1228     return ((data[offset] << 24) | (data[offset + 1] << 16) |
   1229             (data[offset + 2] << 8) | data[offset + 3]);
   1230 }
   1231 
   1232 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
   1233 {
   1234 }
   1235 
   1236 static void check_pointer_type_change(VncState *vs, int absolute)
   1237 {
   1238     if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
   1239         vnc_write_u8(vs, 0);
   1240         vnc_write_u8(vs, 0);
   1241         vnc_write_u16(vs, 1);
   1242         vnc_framebuffer_update(vs, absolute, 0,
   1243                                ds_get_width(vs->ds), ds_get_height(vs->ds),
   1244                                VNC_ENCODING_POINTER_TYPE_CHANGE);
   1245         vnc_flush(vs);
   1246     }
   1247     vs->absolute = absolute;
   1248 }
   1249 
   1250 static void pointer_event(VncState *vs, int button_mask, int x, int y)
   1251 {
   1252     int buttons = 0;
   1253     int dz = 0;
   1254 
   1255     if (button_mask & 0x01)
   1256         buttons |= MOUSE_EVENT_LBUTTON;
   1257     if (button_mask & 0x02)
   1258         buttons |= MOUSE_EVENT_MBUTTON;
   1259     if (button_mask & 0x04)
   1260         buttons |= MOUSE_EVENT_RBUTTON;
   1261     if (button_mask & 0x08)
   1262         dz = -1;
   1263     if (button_mask & 0x10)
   1264         dz = 1;
   1265 
   1266     if (vs->absolute) {
   1267         kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
   1268                         y * 0x7FFF / (ds_get_height(vs->ds) - 1),
   1269                         dz, buttons);
   1270     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
   1271         x -= 0x7FFF;
   1272         y -= 0x7FFF;
   1273 
   1274         kbd_mouse_event(x, y, dz, buttons);
   1275     } else {
   1276         if (vs->last_x != -1)
   1277             kbd_mouse_event(x - vs->last_x,
   1278                             y - vs->last_y,
   1279                             dz, buttons);
   1280         vs->last_x = x;
   1281         vs->last_y = y;
   1282     }
   1283 
   1284     check_pointer_type_change(vs, kbd_mouse_is_absolute());
   1285 }
   1286 
   1287 static void reset_keys(VncState *vs)
   1288 {
   1289     int i;
   1290     for(i = 0; i < 256; i++) {
   1291         if (vs->modifiers_state[i]) {
   1292             if (i & 0x80)
   1293                 kbd_put_keycode(0xe0);
   1294             kbd_put_keycode(i | 0x80);
   1295             vs->modifiers_state[i] = 0;
   1296         }
   1297     }
   1298 }
   1299 
   1300 static void press_key(VncState *vs, int keysym)
   1301 {
   1302     kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
   1303     kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
   1304 }
   1305 
   1306 static void do_key_event(VncState *vs, int down, int keycode, int sym)
   1307 {
   1308     /* QEMU console switch */
   1309     switch(keycode) {
   1310     case 0x2a:                          /* Left Shift */
   1311     case 0x36:                          /* Right Shift */
   1312     case 0x1d:                          /* Left CTRL */
   1313     case 0x9d:                          /* Right CTRL */
   1314     case 0x38:                          /* Left ALT */
   1315     case 0xb8:                          /* Right ALT */
   1316         if (down)
   1317             vs->modifiers_state[keycode] = 1;
   1318         else
   1319             vs->modifiers_state[keycode] = 0;
   1320         break;
   1321     case 0x02 ... 0x0a: /* '1' to '9' keys */
   1322         if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
   1323             /* Reset the modifiers sent to the current console */
   1324             reset_keys(vs);
   1325             console_select(keycode - 0x02);
   1326             return;
   1327         }
   1328         break;
   1329     case 0x3a:                        /* CapsLock */
   1330     case 0x45:                        /* NumLock */
   1331         if (!down)
   1332             vs->modifiers_state[keycode] ^= 1;
   1333         break;
   1334     }
   1335 
   1336     if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
   1337         /* If the numlock state needs to change then simulate an additional
   1338            keypress before sending this one.  This will happen if the user
   1339            toggles numlock away from the VNC window.
   1340         */
   1341         if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
   1342             if (!vs->modifiers_state[0x45]) {
   1343                 vs->modifiers_state[0x45] = 1;
   1344                 press_key(vs, 0xff7f);
   1345             }
   1346         } else {
   1347             if (vs->modifiers_state[0x45]) {
   1348                 vs->modifiers_state[0x45] = 0;
   1349                 press_key(vs, 0xff7f);
   1350             }
   1351         }
   1352     }
   1353 
   1354     if (is_graphic_console()) {
   1355         if (keycode & 0x80)
   1356             kbd_put_keycode(0xe0);
   1357         if (down)
   1358             kbd_put_keycode(keycode & 0x7f);
   1359         else
   1360             kbd_put_keycode(keycode | 0x80);
   1361     } else {
   1362         /* QEMU console emulation */
   1363         if (down) {
   1364             int numlock = vs->modifiers_state[0x45];
   1365             switch (keycode) {
   1366             case 0x2a:                          /* Left Shift */
   1367             case 0x36:                          /* Right Shift */
   1368             case 0x1d:                          /* Left CTRL */
   1369             case 0x9d:                          /* Right CTRL */
   1370             case 0x38:                          /* Left ALT */
   1371             case 0xb8:                          /* Right ALT */
   1372                 break;
   1373             case 0xc8:
   1374                 kbd_put_keysym(QEMU_KEY_UP);
   1375                 break;
   1376             case 0xd0:
   1377                 kbd_put_keysym(QEMU_KEY_DOWN);
   1378                 break;
   1379             case 0xcb:
   1380                 kbd_put_keysym(QEMU_KEY_LEFT);
   1381                 break;
   1382             case 0xcd:
   1383                 kbd_put_keysym(QEMU_KEY_RIGHT);
   1384                 break;
   1385             case 0xd3:
   1386                 kbd_put_keysym(QEMU_KEY_DELETE);
   1387                 break;
   1388             case 0xc7:
   1389                 kbd_put_keysym(QEMU_KEY_HOME);
   1390                 break;
   1391             case 0xcf:
   1392                 kbd_put_keysym(QEMU_KEY_END);
   1393                 break;
   1394             case 0xc9:
   1395                 kbd_put_keysym(QEMU_KEY_PAGEUP);
   1396                 break;
   1397             case 0xd1:
   1398                 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
   1399                 break;
   1400 
   1401             case 0x47:
   1402                 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
   1403                 break;
   1404             case 0x48:
   1405                 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
   1406                 break;
   1407             case 0x49:
   1408                 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
   1409                 break;
   1410             case 0x4b:
   1411                 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
   1412                 break;
   1413             case 0x4c:
   1414                 kbd_put_keysym('5');
   1415                 break;
   1416             case 0x4d:
   1417                 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
   1418                 break;
   1419             case 0x4f:
   1420                 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
   1421                 break;
   1422             case 0x50:
   1423                 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
   1424                 break;
   1425             case 0x51:
   1426                 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
   1427                 break;
   1428             case 0x52:
   1429                 kbd_put_keysym('0');
   1430                 break;
   1431             case 0x53:
   1432                 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
   1433                 break;
   1434 
   1435             case 0xb5:
   1436                 kbd_put_keysym('/');
   1437                 break;
   1438             case 0x37:
   1439                 kbd_put_keysym('*');
   1440                 break;
   1441             case 0x4a:
   1442                 kbd_put_keysym('-');
   1443                 break;
   1444             case 0x4e:
   1445                 kbd_put_keysym('+');
   1446                 break;
   1447             case 0x9c:
   1448                 kbd_put_keysym('\n');
   1449                 break;
   1450 
   1451             default:
   1452                 kbd_put_keysym(sym);
   1453                 break;
   1454             }
   1455         }
   1456     }
   1457 }
   1458 
   1459 static void key_event(VncState *vs, int down, uint32_t sym)
   1460 {
   1461     int keycode;
   1462 
   1463     if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
   1464         sym = sym - 'A' + 'a';
   1465 
   1466     keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
   1467     do_key_event(vs, down, keycode, sym);
   1468 }
   1469 
   1470 static void ext_key_event(VncState *vs, int down,
   1471                           uint32_t sym, uint16_t keycode)
   1472 {
   1473     /* if the user specifies a keyboard layout, always use it */
   1474     if (keyboard_layout)
   1475         key_event(vs, down, sym);
   1476     else
   1477         do_key_event(vs, down, keycode, sym);
   1478 }
   1479 
   1480 static void framebuffer_update_request(VncState *vs, int incremental,
   1481                                        int x_position, int y_position,
   1482                                        int w, int h)
   1483 {
   1484     if (x_position > ds_get_width(vs->ds))
   1485         x_position = ds_get_width(vs->ds);
   1486     if (y_position > ds_get_height(vs->ds))
   1487         y_position = ds_get_height(vs->ds);
   1488     if (x_position + w >= ds_get_width(vs->ds))
   1489         w = ds_get_width(vs->ds)  - x_position;
   1490     if (y_position + h >= ds_get_height(vs->ds))
   1491         h = ds_get_height(vs->ds) - y_position;
   1492 
   1493     int i;
   1494     vs->need_update = 1;
   1495     if (!incremental) {
   1496         vs->force_update = 1;
   1497         for (i = 0; i < h; i++) {
   1498             vnc_set_bits(vs->guest.dirty[y_position + i],
   1499                          (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
   1500             vnc_set_bits(vs->server.dirty[y_position + i],
   1501                          (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
   1502         }
   1503     }
   1504 }
   1505 
   1506 static void send_ext_key_event_ack(VncState *vs)
   1507 {
   1508     vnc_write_u8(vs, 0);
   1509     vnc_write_u8(vs, 0);
   1510     vnc_write_u16(vs, 1);
   1511     vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
   1512                            VNC_ENCODING_EXT_KEY_EVENT);
   1513     vnc_flush(vs);
   1514 }
   1515 
   1516 static void send_ext_audio_ack(VncState *vs)
   1517 {
   1518     vnc_write_u8(vs, 0);
   1519     vnc_write_u8(vs, 0);
   1520     vnc_write_u16(vs, 1);
   1521     vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
   1522                            VNC_ENCODING_AUDIO);
   1523     vnc_flush(vs);
   1524 }
   1525 
   1526 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
   1527 {
   1528     int i;
   1529     unsigned int enc = 0;
   1530 
   1531     vnc_zlib_init(vs);
   1532     vs->features = 0;
   1533     vs->vnc_encoding = 0;
   1534     vs->tight_compression = 9;
   1535     vs->tight_quality = 9;
   1536     vs->absolute = -1;
   1537 
   1538     for (i = n_encodings - 1; i >= 0; i--) {
   1539         enc = encodings[i];
   1540         switch (enc) {
   1541         case VNC_ENCODING_RAW:
   1542             vs->vnc_encoding = enc;
   1543             break;
   1544         case VNC_ENCODING_COPYRECT:
   1545             vs->features |= VNC_FEATURE_COPYRECT_MASK;
   1546             break;
   1547         case VNC_ENCODING_HEXTILE:
   1548             vs->features |= VNC_FEATURE_HEXTILE_MASK;
   1549             vs->vnc_encoding = enc;
   1550             break;
   1551         case VNC_ENCODING_ZLIB:
   1552             vs->features |= VNC_FEATURE_ZLIB_MASK;
   1553             vs->vnc_encoding = enc;
   1554             break;
   1555         case VNC_ENCODING_DESKTOPRESIZE:
   1556             vs->features |= VNC_FEATURE_RESIZE_MASK;
   1557             break;
   1558         case VNC_ENCODING_POINTER_TYPE_CHANGE:
   1559             vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
   1560             break;
   1561         case VNC_ENCODING_EXT_KEY_EVENT:
   1562             send_ext_key_event_ack(vs);
   1563             break;
   1564         case VNC_ENCODING_AUDIO:
   1565             send_ext_audio_ack(vs);
   1566             break;
   1567         case VNC_ENCODING_WMVi:
   1568             vs->features |= VNC_FEATURE_WMVI_MASK;
   1569             break;
   1570         case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
   1571             vs->tight_compression = (enc & 0x0F);
   1572             break;
   1573         case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
   1574             vs->tight_quality = (enc & 0x0F);
   1575             break;
   1576         default:
   1577             VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
   1578             break;
   1579         }
   1580     }
   1581 
   1582     check_pointer_type_change(vs, kbd_mouse_is_absolute());
   1583 }
   1584 
   1585 static void set_pixel_conversion(VncState *vs)
   1586 {
   1587     if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
   1588         (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
   1589         !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
   1590         vs->write_pixels = vnc_write_pixels_copy;
   1591         switch (vs->ds->surface->pf.bits_per_pixel) {
   1592             case 8:
   1593                 vs->send_hextile_tile = send_hextile_tile_8;
   1594                 break;
   1595             case 16:
   1596                 vs->send_hextile_tile = send_hextile_tile_16;
   1597                 break;
   1598             case 32:
   1599                 vs->send_hextile_tile = send_hextile_tile_32;
   1600                 break;
   1601         }
   1602     } else {
   1603         vs->write_pixels = vnc_write_pixels_generic;
   1604         switch (vs->ds->surface->pf.bits_per_pixel) {
   1605             case 8:
   1606                 vs->send_hextile_tile = send_hextile_tile_generic_8;
   1607                 break;
   1608             case 16:
   1609                 vs->send_hextile_tile = send_hextile_tile_generic_16;
   1610                 break;
   1611             case 32:
   1612                 vs->send_hextile_tile = send_hextile_tile_generic_32;
   1613                 break;
   1614         }
   1615     }
   1616 }
   1617 
   1618 static void set_pixel_format(VncState *vs,
   1619                              int bits_per_pixel, int depth,
   1620                              int big_endian_flag, int true_color_flag,
   1621                              int red_max, int green_max, int blue_max,
   1622                              int red_shift, int green_shift, int blue_shift)
   1623 {
   1624     if (!true_color_flag) {
   1625         vnc_client_error(vs);
   1626         return;
   1627     }
   1628 
   1629     vs->clientds = *(vs->guest.ds);
   1630     vs->clientds.pf.rmax = red_max;
   1631     count_bits(vs->clientds.pf.rbits, red_max);
   1632     vs->clientds.pf.rshift = red_shift;
   1633     vs->clientds.pf.rmask = red_max << red_shift;
   1634     vs->clientds.pf.gmax = green_max;
   1635     count_bits(vs->clientds.pf.gbits, green_max);
   1636     vs->clientds.pf.gshift = green_shift;
   1637     vs->clientds.pf.gmask = green_max << green_shift;
   1638     vs->clientds.pf.bmax = blue_max;
   1639     count_bits(vs->clientds.pf.bbits, blue_max);
   1640     vs->clientds.pf.bshift = blue_shift;
   1641     vs->clientds.pf.bmask = blue_max << blue_shift;
   1642     vs->clientds.pf.bits_per_pixel = bits_per_pixel;
   1643     vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
   1644     vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
   1645     vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
   1646 
   1647     set_pixel_conversion(vs);
   1648 
   1649     vga_hw_invalidate();
   1650     vga_hw_update();
   1651 }
   1652 
   1653 static void pixel_format_message (VncState *vs) {
   1654     char pad[3] = { 0, 0, 0 };
   1655 
   1656     vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
   1657     vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
   1658 
   1659 #ifdef HOST_WORDS_BIGENDIAN
   1660     vnc_write_u8(vs, 1);             /* big-endian-flag */
   1661 #else
   1662     vnc_write_u8(vs, 0);             /* big-endian-flag */
   1663 #endif
   1664     vnc_write_u8(vs, 1);             /* true-color-flag */
   1665     vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
   1666     vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
   1667     vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
   1668     vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
   1669     vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
   1670     vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
   1671     if (vs->ds->surface->pf.bits_per_pixel == 32)
   1672         vs->send_hextile_tile = send_hextile_tile_32;
   1673     else if (vs->ds->surface->pf.bits_per_pixel == 16)
   1674         vs->send_hextile_tile = send_hextile_tile_16;
   1675     else if (vs->ds->surface->pf.bits_per_pixel == 8)
   1676         vs->send_hextile_tile = send_hextile_tile_8;
   1677     vs->clientds = *(vs->ds->surface);
   1678     vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
   1679     vs->write_pixels = vnc_write_pixels_copy;
   1680 
   1681     vnc_write(vs, pad, 3);           /* padding */
   1682 }
   1683 
   1684 static void vnc_dpy_setdata(DisplayState *ds)
   1685 {
   1686     /* We don't have to do anything */
   1687 }
   1688 
   1689 static void vnc_colordepth(VncState *vs)
   1690 {
   1691     if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
   1692         /* Sending a WMVi message to notify the client*/
   1693         vnc_write_u8(vs, 0);  /* msg id */
   1694         vnc_write_u8(vs, 0);
   1695         vnc_write_u16(vs, 1); /* number of rects */
   1696         vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
   1697                                ds_get_height(vs->ds), VNC_ENCODING_WMVi);
   1698         pixel_format_message(vs);
   1699         vnc_flush(vs);
   1700     } else {
   1701         set_pixel_conversion(vs);
   1702     }
   1703 }
   1704 
   1705 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
   1706 {
   1707     int i;
   1708     uint16_t limit;
   1709 
   1710     switch (data[0]) {
   1711     case 0:
   1712         if (len == 1)
   1713             return 20;
   1714 
   1715         set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
   1716                          read_u8(data, 6), read_u8(data, 7),
   1717                          read_u16(data, 8), read_u16(data, 10),
   1718                          read_u16(data, 12), read_u8(data, 14),
   1719                          read_u8(data, 15), read_u8(data, 16));
   1720         break;
   1721     case 2:
   1722         if (len == 1)
   1723             return 4;
   1724 
   1725         if (len == 4) {
   1726             limit = read_u16(data, 2);
   1727             if (limit > 0)
   1728                 return 4 + (limit * 4);
   1729         } else
   1730             limit = read_u16(data, 2);
   1731 
   1732         for (i = 0; i < limit; i++) {
   1733             int32_t val = read_s32(data, 4 + (i * 4));
   1734             memcpy(data + 4 + (i * 4), &val, sizeof(val));
   1735         }
   1736 
   1737         set_encodings(vs, (int32_t *)(data + 4), limit);
   1738         break;
   1739     case 3:
   1740         if (len == 1)
   1741             return 10;
   1742 
   1743         framebuffer_update_request(vs,
   1744                                    read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
   1745                                    read_u16(data, 6), read_u16(data, 8));
   1746         break;
   1747     case 4:
   1748         if (len == 1)
   1749             return 8;
   1750 
   1751         key_event(vs, read_u8(data, 1), read_u32(data, 4));
   1752         break;
   1753     case 5:
   1754         if (len == 1)
   1755             return 6;
   1756 
   1757         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
   1758         break;
   1759     case 6:
   1760         if (len == 1)
   1761             return 8;
   1762 
   1763         if (len == 8) {
   1764             uint32_t dlen = read_u32(data, 4);
   1765             if (dlen > 0)
   1766                 return 8 + dlen;
   1767         }
   1768 
   1769         client_cut_text(vs, read_u32(data, 4), data + 8);
   1770         break;
   1771     case 255:
   1772         if (len == 1)
   1773             return 2;
   1774 
   1775         switch (read_u8(data, 1)) {
   1776         case 0:
   1777             if (len == 2)
   1778                 return 12;
   1779 
   1780             ext_key_event(vs, read_u16(data, 2),
   1781                           read_u32(data, 4), read_u32(data, 8));
   1782             break;
   1783         case 1:
   1784             if (len == 2)
   1785                 return 4;
   1786 
   1787             switch (read_u16 (data, 2)) {
   1788             case 0:
   1789                 audio_add(vs);
   1790                 break;
   1791             case 1:
   1792                 audio_del(vs);
   1793                 break;
   1794             case 2:
   1795                 if (len == 4)
   1796                     return 10;
   1797                 switch (read_u8(data, 4)) {
   1798                 case 0: vs->as.fmt = AUD_FMT_U8; break;
   1799                 case 1: vs->as.fmt = AUD_FMT_S8; break;
   1800                 case 2: vs->as.fmt = AUD_FMT_U16; break;
   1801                 case 3: vs->as.fmt = AUD_FMT_S16; break;
   1802                 case 4: vs->as.fmt = AUD_FMT_U32; break;
   1803                 case 5: vs->as.fmt = AUD_FMT_S32; break;
   1804                 default:
   1805                     printf("Invalid audio format %d\n", read_u8(data, 4));
   1806                     vnc_client_error(vs);
   1807                     break;
   1808                 }
   1809                 vs->as.nchannels = read_u8(data, 5);
   1810                 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
   1811                     printf("Invalid audio channel coount %d\n",
   1812                            read_u8(data, 5));
   1813                     vnc_client_error(vs);
   1814                     break;
   1815                 }
   1816                 vs->as.freq = read_u32(data, 6);
   1817                 break;
   1818             default:
   1819                 printf ("Invalid audio message %d\n", read_u8(data, 4));
   1820                 vnc_client_error(vs);
   1821                 break;
   1822             }
   1823             break;
   1824 
   1825         default:
   1826             printf("Msg: %d\n", read_u16(data, 0));
   1827             vnc_client_error(vs);
   1828             break;
   1829         }
   1830         break;
   1831     default:
   1832         printf("Msg: %d\n", data[0]);
   1833         vnc_client_error(vs);
   1834         break;
   1835     }
   1836 
   1837     vnc_read_when(vs, protocol_client_msg, 1);
   1838     return 0;
   1839 }
   1840 
   1841 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
   1842 {
   1843     char buf[1024];
   1844     int size;
   1845 
   1846     vnc_write_u16(vs, ds_get_width(vs->ds));
   1847     vnc_write_u16(vs, ds_get_height(vs->ds));
   1848 
   1849     pixel_format_message(vs);
   1850 
   1851     if (qemu_name)
   1852         size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
   1853     else
   1854         size = snprintf(buf, sizeof(buf), "QEMU");
   1855 
   1856     vnc_write_u32(vs, size);
   1857     vnc_write(vs, buf, size);
   1858     vnc_flush(vs);
   1859 
   1860     vnc_read_when(vs, protocol_client_msg, 1);
   1861 
   1862     return 0;
   1863 }
   1864 
   1865 void start_client_init(VncState *vs)
   1866 {
   1867     vnc_read_when(vs, protocol_client_init, 1);
   1868 }
   1869 
   1870 static void make_challenge(VncState *vs)
   1871 {
   1872     int i;
   1873 
   1874     srand(time(NULL)+getpid()+getpid()*987654+rand());
   1875 
   1876     for (i = 0 ; i < sizeof(vs->challenge) ; i++)
   1877         vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
   1878 }
   1879 
   1880 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
   1881 {
   1882     unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
   1883     int i, j, pwlen;
   1884     unsigned char key[8];
   1885 
   1886     if (!vs->vd->password || !vs->vd->password[0]) {
   1887         VNC_DEBUG("No password configured on server");
   1888         vnc_write_u32(vs, 1); /* Reject auth */
   1889         if (vs->minor >= 8) {
   1890             static const char err[] = "Authentication failed";
   1891             vnc_write_u32(vs, sizeof(err));
   1892             vnc_write(vs, err, sizeof(err));
   1893         }
   1894         vnc_flush(vs);
   1895         vnc_client_error(vs);
   1896         return 0;
   1897     }
   1898 
   1899     memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
   1900 
   1901     /* Calculate the expected challenge response */
   1902     pwlen = strlen(vs->vd->password);
   1903     for (i=0; i<sizeof(key); i++)
   1904         key[i] = i<pwlen ? vs->vd->password[i] : 0;
   1905     deskey(key, EN0);
   1906     for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
   1907         des(response+j, response+j);
   1908 
   1909     /* Compare expected vs actual challenge response */
   1910     if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
   1911         VNC_DEBUG("Client challenge reponse did not match\n");
   1912         vnc_write_u32(vs, 1); /* Reject auth */
   1913         if (vs->minor >= 8) {
   1914             static const char err[] = "Authentication failed";
   1915             vnc_write_u32(vs, sizeof(err));
   1916             vnc_write(vs, err, sizeof(err));
   1917         }
   1918         vnc_flush(vs);
   1919         vnc_client_error(vs);
   1920     } else {
   1921         VNC_DEBUG("Accepting VNC challenge response\n");
   1922         vnc_write_u32(vs, 0); /* Accept auth */
   1923         vnc_flush(vs);
   1924 
   1925         start_client_init(vs);
   1926     }
   1927     return 0;
   1928 }
   1929 
   1930 void start_auth_vnc(VncState *vs)
   1931 {
   1932     make_challenge(vs);
   1933     /* Send client a 'random' challenge */
   1934     vnc_write(vs, vs->challenge, sizeof(vs->challenge));
   1935     vnc_flush(vs);
   1936 
   1937     vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
   1938 }
   1939 
   1940 
   1941 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
   1942 {
   1943     /* We only advertise 1 auth scheme at a time, so client
   1944      * must pick the one we sent. Verify this */
   1945     if (data[0] != vs->vd->auth) { /* Reject auth */
   1946        VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
   1947        vnc_write_u32(vs, 1);
   1948        if (vs->minor >= 8) {
   1949            static const char err[] = "Authentication failed";
   1950            vnc_write_u32(vs, sizeof(err));
   1951            vnc_write(vs, err, sizeof(err));
   1952        }
   1953        vnc_client_error(vs);
   1954     } else { /* Accept requested auth */
   1955        VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
   1956        switch (vs->vd->auth) {
   1957        case VNC_AUTH_NONE:
   1958            VNC_DEBUG("Accept auth none\n");
   1959            if (vs->minor >= 8) {
   1960                vnc_write_u32(vs, 0); /* Accept auth completion */
   1961                vnc_flush(vs);
   1962            }
   1963            start_client_init(vs);
   1964            break;
   1965 
   1966        case VNC_AUTH_VNC:
   1967            VNC_DEBUG("Start VNC auth\n");
   1968            start_auth_vnc(vs);
   1969            break;
   1970 
   1971 #ifdef CONFIG_VNC_TLS
   1972        case VNC_AUTH_VENCRYPT:
   1973            VNC_DEBUG("Accept VeNCrypt auth\n");;
   1974            start_auth_vencrypt(vs);
   1975            break;
   1976 #endif /* CONFIG_VNC_TLS */
   1977 
   1978 #ifdef CONFIG_VNC_SASL
   1979        case VNC_AUTH_SASL:
   1980            VNC_DEBUG("Accept SASL auth\n");
   1981            start_auth_sasl(vs);
   1982            break;
   1983 #endif /* CONFIG_VNC_SASL */
   1984 
   1985        default: /* Should not be possible, but just in case */
   1986            VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
   1987            vnc_write_u8(vs, 1);
   1988            if (vs->minor >= 8) {
   1989                static const char err[] = "Authentication failed";
   1990                vnc_write_u32(vs, sizeof(err));
   1991                vnc_write(vs, err, sizeof(err));
   1992            }
   1993            vnc_client_error(vs);
   1994        }
   1995     }
   1996     return 0;
   1997 }
   1998 
   1999 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
   2000 {
   2001     char local[13];
   2002 
   2003     memcpy(local, version, 12);
   2004     local[12] = 0;
   2005 
   2006     if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
   2007         VNC_DEBUG("Malformed protocol version %s\n", local);
   2008         vnc_client_error(vs);
   2009         return 0;
   2010     }
   2011     VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
   2012     if (vs->major != 3 ||
   2013         (vs->minor != 3 &&
   2014          vs->minor != 4 &&
   2015          vs->minor != 5 &&
   2016          vs->minor != 7 &&
   2017          vs->minor != 8)) {
   2018         VNC_DEBUG("Unsupported client version\n");
   2019         vnc_write_u32(vs, VNC_AUTH_INVALID);
   2020         vnc_flush(vs);
   2021         vnc_client_error(vs);
   2022         return 0;
   2023     }
   2024     /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
   2025      * as equivalent to v3.3 by servers
   2026      */
   2027     if (vs->minor == 4 || vs->minor == 5)
   2028         vs->minor = 3;
   2029 
   2030     if (vs->minor == 3) {
   2031         if (vs->vd->auth == VNC_AUTH_NONE) {
   2032             VNC_DEBUG("Tell client auth none\n");
   2033             vnc_write_u32(vs, vs->vd->auth);
   2034             vnc_flush(vs);
   2035             start_client_init(vs);
   2036        } else if (vs->vd->auth == VNC_AUTH_VNC) {
   2037             VNC_DEBUG("Tell client VNC auth\n");
   2038             vnc_write_u32(vs, vs->vd->auth);
   2039             vnc_flush(vs);
   2040             start_auth_vnc(vs);
   2041        } else {
   2042             VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
   2043             vnc_write_u32(vs, VNC_AUTH_INVALID);
   2044             vnc_flush(vs);
   2045             vnc_client_error(vs);
   2046        }
   2047     } else {
   2048         VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
   2049         vnc_write_u8(vs, 1); /* num auth */
   2050         vnc_write_u8(vs, vs->vd->auth);
   2051         vnc_read_when(vs, protocol_client_auth, 1);
   2052         vnc_flush(vs);
   2053     }
   2054 
   2055     return 0;
   2056 }
   2057 
   2058 static void vnc_connect(VncDisplay *vd, int csock)
   2059 {
   2060     VncState *vs = g_malloc0(sizeof(VncState));
   2061     vs->csock = csock;
   2062 
   2063     VNC_DEBUG("New client on socket %d\n", csock);
   2064     dcl->idle = 0;
   2065     socket_set_nonblock(vs->csock);
   2066     qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
   2067 
   2068     vs->vd = vd;
   2069     vs->ds = vd->ds;
   2070     vs->timer = timer_new(QEMU_CLOCK_REALTIME, SCALE_MS, vnc_update_client, vs);
   2071     vs->last_x = -1;
   2072     vs->last_y = -1;
   2073 
   2074     vs->as.freq = 44100;
   2075     vs->as.nchannels = 2;
   2076     vs->as.fmt = AUD_FMT_S16;
   2077     vs->as.endianness = 0;
   2078 
   2079     vnc_resize(vs);
   2080     vnc_write(vs, "RFB 003.008\n", 12);
   2081     vnc_flush(vs);
   2082     vnc_read_when(vs, protocol_version, 12);
   2083     reset_keys(vs);
   2084 
   2085     vs->next = vd->clients;
   2086     vd->clients = vs;
   2087 
   2088     vnc_update_client(vs);
   2089     /* vs might be free()ed here */
   2090 }
   2091 
   2092 static void vnc_listen_read(void *opaque)
   2093 {
   2094     VncDisplay *vs = opaque;
   2095     struct sockaddr_in addr;
   2096     socklen_t addrlen = sizeof(addr);
   2097 
   2098     /* Catch-up */
   2099     vga_hw_update();
   2100 
   2101     int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
   2102     if (csock != -1) {
   2103         vnc_connect(vs, csock);
   2104     }
   2105 }
   2106 
   2107 void vnc_display_init(DisplayState *ds)
   2108 {
   2109     VncDisplay *vs = g_malloc0(sizeof(*vs));
   2110 
   2111     dcl = g_malloc0(sizeof(DisplayChangeListener));
   2112 
   2113     ds->opaque = vs;
   2114     dcl->idle = 1;
   2115     vnc_display = vs;
   2116 
   2117     vs->lsock = -1;
   2118 
   2119     vs->ds = ds;
   2120 
   2121     if (keyboard_layout)
   2122         vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
   2123     else
   2124         vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
   2125 
   2126     if (!vs->kbd_layout)
   2127         exit(1);
   2128 
   2129     dcl->dpy_copy = vnc_dpy_copy;
   2130     dcl->dpy_update = vnc_dpy_update;
   2131     dcl->dpy_resize = vnc_dpy_resize;
   2132     dcl->dpy_setdata = vnc_dpy_setdata;
   2133     register_displaychangelistener(ds, dcl);
   2134 }
   2135 
   2136 
   2137 void vnc_display_close(DisplayState *ds)
   2138 {
   2139     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
   2140 
   2141     if (!vs)
   2142         return;
   2143     if (vs->display) {
   2144         g_free(vs->display);
   2145         vs->display = NULL;
   2146     }
   2147     if (vs->lsock != -1) {
   2148         qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
   2149         close(vs->lsock);
   2150         vs->lsock = -1;
   2151     }
   2152     vs->auth = VNC_AUTH_INVALID;
   2153 #ifdef CONFIG_VNC_TLS
   2154     vs->subauth = VNC_AUTH_INVALID;
   2155     vs->tls.x509verify = 0;
   2156 #endif
   2157 }
   2158 
   2159 int vnc_display_password(DisplayState *ds, const char *password)
   2160 {
   2161     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
   2162 
   2163     if (vs->password) {
   2164         g_free(vs->password);
   2165         vs->password = NULL;
   2166     }
   2167     if (password && password[0]) {
   2168         if (!(vs->password = g_strdup(password)))
   2169             return -1;
   2170     }
   2171 
   2172     return 0;
   2173 }
   2174 
   2175 char *vnc_display_local_addr(DisplayState *ds)
   2176 {
   2177     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
   2178 
   2179     return vnc_socket_local_addr("%s:%s", vs->lsock);
   2180 }
   2181 
   2182 int vnc_display_open(DisplayState *ds, const char *display)
   2183 {
   2184     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
   2185     const char *options;
   2186     int password = 0;
   2187     int reverse = 0;
   2188     int to_port = 0;
   2189 #ifdef CONFIG_VNC_TLS
   2190     int tls = 0, x509 = 0;
   2191 #endif
   2192 #ifdef CONFIG_VNC_SASL
   2193     int sasl = 0;
   2194     int saslErr;
   2195 #endif
   2196     int acl = 0;
   2197 
   2198     if (!vnc_display)
   2199         return -1;
   2200     vnc_display_close(ds);
   2201     if (strcmp(display, "none") == 0)
   2202         return 0;
   2203 
   2204     if (!(vs->display = strdup(display)))
   2205         return -1;
   2206 
   2207     options = display;
   2208     while ((options = strchr(options, ','))) {
   2209         options++;
   2210         if (strncmp(options, "password", 8) == 0) {
   2211             password = 1; /* Require password auth */
   2212         } else if (strncmp(options, "reverse", 7) == 0) {
   2213             reverse = 1;
   2214         } else if (strncmp(options, "to=", 3) == 0) {
   2215             to_port = atoi(options+3) + 5900;
   2216 #ifdef CONFIG_VNC_SASL
   2217         } else if (strncmp(options, "sasl", 4) == 0) {
   2218             sasl = 1; /* Require SASL auth */
   2219 #endif
   2220 #ifdef CONFIG_VNC_TLS
   2221         } else if (strncmp(options, "tls", 3) == 0) {
   2222             tls = 1; /* Require TLS */
   2223         } else if (strncmp(options, "x509", 4) == 0) {
   2224             char *start, *end;
   2225             x509 = 1; /* Require x509 certificates */
   2226             if (strncmp(options, "x509verify", 10) == 0)
   2227                 vs->tls.x509verify = 1; /* ...and verify client certs */
   2228 
   2229             /* Now check for 'x509=/some/path' postfix
   2230              * and use that to setup x509 certificate/key paths */
   2231             start = strchr(options, '=');
   2232             end = strchr(options, ',');
   2233             if (start && (!end || (start < end))) {
   2234                 int len = end ? end-(start+1) : strlen(start+1);
   2235                 char *path = g_strndup(start + 1, len);
   2236 
   2237                 VNC_DEBUG("Trying certificate path '%s'\n", path);
   2238                 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
   2239                     fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
   2240                     g_free(path);
   2241                     g_free(vs->display);
   2242                     vs->display = NULL;
   2243                     return -1;
   2244                 }
   2245                 g_free(path);
   2246             } else {
   2247                 fprintf(stderr, "No certificate path provided\n");
   2248                 g_free(vs->display);
   2249                 vs->display = NULL;
   2250                 return -1;
   2251             }
   2252 #endif
   2253         } else if (strncmp(options, "acl", 3) == 0) {
   2254             acl = 1;
   2255         }
   2256     }
   2257 
   2258 #ifdef CONFIG_VNC_TLS
   2259     if (acl && x509 && vs->tls.x509verify) {
   2260         if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
   2261             fprintf(stderr, "Failed to create x509 dname ACL\n");
   2262             exit(1);
   2263         }
   2264     }
   2265 #endif
   2266 #ifdef CONFIG_VNC_SASL
   2267     if (acl && sasl) {
   2268         if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
   2269             fprintf(stderr, "Failed to create username ACL\n");
   2270             exit(1);
   2271         }
   2272     }
   2273 #endif
   2274 
   2275     /*
   2276      * Combinations we support here:
   2277      *
   2278      *  - no-auth                (clear text, no auth)
   2279      *  - password               (clear text, weak auth)
   2280      *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
   2281      *  - tls                    (encrypt, weak anonymous creds, no auth)
   2282      *  - tls + password         (encrypt, weak anonymous creds, weak auth)
   2283      *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
   2284      *  - tls + x509             (encrypt, good x509 creds, no auth)
   2285      *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
   2286      *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
   2287      *
   2288      * NB1. TLS is a stackable auth scheme.
   2289      * NB2. the x509 schemes have option to validate a client cert dname
   2290      */
   2291     if (password) {
   2292 #ifdef CONFIG_VNC_TLS
   2293         if (tls) {
   2294             vs->auth = VNC_AUTH_VENCRYPT;
   2295             if (x509) {
   2296                 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
   2297                 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
   2298             } else {
   2299                 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
   2300                 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
   2301             }
   2302         } else {
   2303 #endif /* CONFIG_VNC_TLS */
   2304             VNC_DEBUG("Initializing VNC server with password auth\n");
   2305             vs->auth = VNC_AUTH_VNC;
   2306 #ifdef CONFIG_VNC_TLS
   2307             vs->subauth = VNC_AUTH_INVALID;
   2308         }
   2309 #endif /* CONFIG_VNC_TLS */
   2310 #ifdef CONFIG_VNC_SASL
   2311     } else if (sasl) {
   2312 #ifdef CONFIG_VNC_TLS
   2313         if (tls) {
   2314             vs->auth = VNC_AUTH_VENCRYPT;
   2315             if (x509) {
   2316                 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
   2317                 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
   2318             } else {
   2319                 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
   2320                 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
   2321             }
   2322         } else {
   2323 #endif /* CONFIG_VNC_TLS */
   2324             VNC_DEBUG("Initializing VNC server with SASL auth\n");
   2325             vs->auth = VNC_AUTH_SASL;
   2326 #ifdef CONFIG_VNC_TLS
   2327             vs->subauth = VNC_AUTH_INVALID;
   2328         }
   2329 #endif /* CONFIG_VNC_TLS */
   2330 #endif /* CONFIG_VNC_SASL */
   2331     } else {
   2332 #ifdef CONFIG_VNC_TLS
   2333         if (tls) {
   2334             vs->auth = VNC_AUTH_VENCRYPT;
   2335             if (x509) {
   2336                 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
   2337                 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
   2338             } else {
   2339                 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
   2340                 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
   2341             }
   2342         } else {
   2343 #endif
   2344             VNC_DEBUG("Initializing VNC server with no auth\n");
   2345             vs->auth = VNC_AUTH_NONE;
   2346 #ifdef CONFIG_VNC_TLS
   2347             vs->subauth = VNC_AUTH_INVALID;
   2348         }
   2349 #endif
   2350     }
   2351 
   2352 #ifdef CONFIG_VNC_SASL
   2353     if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
   2354         fprintf(stderr, "Failed to initialize SASL auth %s",
   2355                 sasl_errstring(saslErr, NULL, NULL));
   2356         free(vs->display);
   2357         vs->display = NULL;
   2358         return -1;
   2359     }
   2360 #endif
   2361 
   2362     if (reverse) {
   2363         /* connect to viewer */
   2364         if (strncmp(display, "unix:", 5) == 0)
   2365             vs->lsock = unix_connect(display+5);
   2366         else
   2367             vs->lsock = inet_connect(display, SOCK_STREAM);
   2368         if (-1 == vs->lsock) {
   2369             free(vs->display);
   2370             vs->display = NULL;
   2371             return -1;
   2372         } else {
   2373             int csock = vs->lsock;
   2374             vs->lsock = -1;
   2375             vnc_connect(vs, csock);
   2376         }
   2377         return 0;
   2378 
   2379     } else {
   2380         /* listen for connects */
   2381         char *dpy;
   2382         dpy = g_malloc(256);
   2383         if (strncmp(display, "unix:", 5) == 0) {
   2384             pstrcpy(dpy, 256, "unix:");
   2385             vs->lsock = unix_listen(display+5, dpy+5, 256-5);
   2386         } else {
   2387             vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
   2388         }
   2389         if (-1 == vs->lsock) {
   2390             free(dpy);
   2391             return -1;
   2392         } else {
   2393             free(vs->display);
   2394             vs->display = dpy;
   2395         }
   2396     }
   2397     return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
   2398 }
   2399