xref: /openbmc/qemu/ui/vnc.c (revision 01c22f2c)
1 /*
2  * QEMU VNC display driver
3  *
4  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5  * Copyright (C) 2006 Fabrice Bellard
6  * Copyright (C) 2009 Red Hat, Inc
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "vnc.h"
28 #include "vnc-jobs.h"
29 #include "sysemu/sysemu.h"
30 #include "qemu/sockets.h"
31 #include "qemu/timer.h"
32 #include "qemu/acl.h"
33 #include "qapi/qmp/types.h"
34 #include "qmp-commands.h"
35 #include "qemu/osdep.h"
36 #include "ui/input.h"
37 
38 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
39 #define VNC_REFRESH_INTERVAL_INC  50
40 #define VNC_REFRESH_INTERVAL_MAX  GUI_REFRESH_INTERVAL_IDLE
41 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
42 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
43 
44 #include "vnc_keysym.h"
45 #include "d3des.h"
46 
47 static VncDisplay *vnc_display; /* needed for info vnc */
48 
49 static int vnc_cursor_define(VncState *vs);
50 static void vnc_release_modifiers(VncState *vs);
51 
52 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
53 {
54 #ifdef _VNC_DEBUG
55     static const char *mn[] = {
56         [0]                           = "undefined",
57         [VNC_SHARE_MODE_CONNECTING]   = "connecting",
58         [VNC_SHARE_MODE_SHARED]       = "shared",
59         [VNC_SHARE_MODE_EXCLUSIVE]    = "exclusive",
60         [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
61     };
62     fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
63             vs->csock, mn[vs->share_mode], mn[mode]);
64 #endif
65 
66     if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
67         vs->vd->num_exclusive--;
68     }
69     vs->share_mode = mode;
70     if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
71         vs->vd->num_exclusive++;
72     }
73 }
74 
75 static char *addr_to_string(const char *format,
76                             struct sockaddr_storage *sa,
77                             socklen_t salen) {
78     char *addr;
79     char host[NI_MAXHOST];
80     char serv[NI_MAXSERV];
81     int err;
82     size_t addrlen;
83 
84     if ((err = getnameinfo((struct sockaddr *)sa, salen,
85                            host, sizeof(host),
86                            serv, sizeof(serv),
87                            NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
88         VNC_DEBUG("Cannot resolve address %d: %s\n",
89                   err, gai_strerror(err));
90         return NULL;
91     }
92 
93     /* Enough for the existing format + the 2 vars we're
94      * substituting in. */
95     addrlen = strlen(format) + strlen(host) + strlen(serv);
96     addr = g_malloc(addrlen + 1);
97     snprintf(addr, addrlen, format, host, serv);
98     addr[addrlen] = '\0';
99 
100     return addr;
101 }
102 
103 
104 char *vnc_socket_local_addr(const char *format, int fd) {
105     struct sockaddr_storage sa;
106     socklen_t salen;
107 
108     salen = sizeof(sa);
109     if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
110         return NULL;
111 
112     return addr_to_string(format, &sa, salen);
113 }
114 
115 char *vnc_socket_remote_addr(const char *format, int fd) {
116     struct sockaddr_storage sa;
117     socklen_t salen;
118 
119     salen = sizeof(sa);
120     if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
121         return NULL;
122 
123     return addr_to_string(format, &sa, salen);
124 }
125 
126 static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
127                           socklen_t salen)
128 {
129     char host[NI_MAXHOST];
130     char serv[NI_MAXSERV];
131     int err;
132 
133     if ((err = getnameinfo((struct sockaddr *)sa, salen,
134                            host, sizeof(host),
135                            serv, sizeof(serv),
136                            NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
137         VNC_DEBUG("Cannot resolve address %d: %s\n",
138                   err, gai_strerror(err));
139         return -1;
140     }
141 
142     qdict_put(qdict, "host", qstring_from_str(host));
143     qdict_put(qdict, "service", qstring_from_str(serv));
144     qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
145 
146     return 0;
147 }
148 
149 static int vnc_server_addr_put(QDict *qdict, int fd)
150 {
151     struct sockaddr_storage sa;
152     socklen_t salen;
153 
154     salen = sizeof(sa);
155     if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
156         return -1;
157     }
158 
159     return put_addr_qdict(qdict, &sa, salen);
160 }
161 
162 static int vnc_qdict_remote_addr(QDict *qdict, int fd)
163 {
164     struct sockaddr_storage sa;
165     socklen_t salen;
166 
167     salen = sizeof(sa);
168     if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
169         return -1;
170     }
171 
172     return put_addr_qdict(qdict, &sa, salen);
173 }
174 
175 static const char *vnc_auth_name(VncDisplay *vd) {
176     switch (vd->auth) {
177     case VNC_AUTH_INVALID:
178         return "invalid";
179     case VNC_AUTH_NONE:
180         return "none";
181     case VNC_AUTH_VNC:
182         return "vnc";
183     case VNC_AUTH_RA2:
184         return "ra2";
185     case VNC_AUTH_RA2NE:
186         return "ra2ne";
187     case VNC_AUTH_TIGHT:
188         return "tight";
189     case VNC_AUTH_ULTRA:
190         return "ultra";
191     case VNC_AUTH_TLS:
192         return "tls";
193     case VNC_AUTH_VENCRYPT:
194 #ifdef CONFIG_VNC_TLS
195         switch (vd->subauth) {
196         case VNC_AUTH_VENCRYPT_PLAIN:
197             return "vencrypt+plain";
198         case VNC_AUTH_VENCRYPT_TLSNONE:
199             return "vencrypt+tls+none";
200         case VNC_AUTH_VENCRYPT_TLSVNC:
201             return "vencrypt+tls+vnc";
202         case VNC_AUTH_VENCRYPT_TLSPLAIN:
203             return "vencrypt+tls+plain";
204         case VNC_AUTH_VENCRYPT_X509NONE:
205             return "vencrypt+x509+none";
206         case VNC_AUTH_VENCRYPT_X509VNC:
207             return "vencrypt+x509+vnc";
208         case VNC_AUTH_VENCRYPT_X509PLAIN:
209             return "vencrypt+x509+plain";
210         case VNC_AUTH_VENCRYPT_TLSSASL:
211             return "vencrypt+tls+sasl";
212         case VNC_AUTH_VENCRYPT_X509SASL:
213             return "vencrypt+x509+sasl";
214         default:
215             return "vencrypt";
216         }
217 #else
218         return "vencrypt";
219 #endif
220     case VNC_AUTH_SASL:
221         return "sasl";
222     }
223     return "unknown";
224 }
225 
226 static int vnc_server_info_put(QDict *qdict)
227 {
228     if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
229         return -1;
230     }
231 
232     qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
233     return 0;
234 }
235 
236 static void vnc_client_cache_auth(VncState *client)
237 {
238 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
239     QDict *qdict;
240 #endif
241 
242     if (!client->info) {
243         return;
244     }
245 
246 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
247     qdict = qobject_to_qdict(client->info);
248 #endif
249 
250 #ifdef CONFIG_VNC_TLS
251     if (client->tls.session &&
252         client->tls.dname) {
253         qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
254     }
255 #endif
256 #ifdef CONFIG_VNC_SASL
257     if (client->sasl.conn &&
258         client->sasl.username) {
259         qdict_put(qdict, "sasl_username",
260                   qstring_from_str(client->sasl.username));
261     }
262 #endif
263 }
264 
265 static void vnc_client_cache_addr(VncState *client)
266 {
267     QDict *qdict;
268 
269     qdict = qdict_new();
270     if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
271         QDECREF(qdict);
272         /* XXX: how to report the error? */
273         return;
274     }
275 
276     client->info = QOBJECT(qdict);
277 }
278 
279 static void vnc_qmp_event(VncState *vs, MonitorEvent event)
280 {
281     QDict *server;
282     QObject *data;
283 
284     if (!vs->info) {
285         return;
286     }
287 
288     server = qdict_new();
289     if (vnc_server_info_put(server) < 0) {
290         QDECREF(server);
291         return;
292     }
293 
294     data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
295                               vs->info, QOBJECT(server));
296 
297     monitor_protocol_event(event, data);
298 
299     qobject_incref(vs->info);
300     qobject_decref(data);
301 }
302 
303 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
304 {
305     struct sockaddr_storage sa;
306     socklen_t salen = sizeof(sa);
307     char host[NI_MAXHOST];
308     char serv[NI_MAXSERV];
309     VncClientInfo *info;
310 
311     if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
312         return NULL;
313     }
314 
315     if (getnameinfo((struct sockaddr *)&sa, salen,
316                     host, sizeof(host),
317                     serv, sizeof(serv),
318                     NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
319         return NULL;
320     }
321 
322     info = g_malloc0(sizeof(*info));
323     info->host = g_strdup(host);
324     info->service = g_strdup(serv);
325     info->family = g_strdup(inet_strfamily(sa.ss_family));
326 
327 #ifdef CONFIG_VNC_TLS
328     if (client->tls.session && client->tls.dname) {
329         info->has_x509_dname = true;
330         info->x509_dname = g_strdup(client->tls.dname);
331     }
332 #endif
333 #ifdef CONFIG_VNC_SASL
334     if (client->sasl.conn && client->sasl.username) {
335         info->has_sasl_username = true;
336         info->sasl_username = g_strdup(client->sasl.username);
337     }
338 #endif
339 
340     return info;
341 }
342 
343 VncInfo *qmp_query_vnc(Error **errp)
344 {
345     VncInfo *info = g_malloc0(sizeof(*info));
346 
347     if (vnc_display == NULL || vnc_display->display == NULL) {
348         info->enabled = false;
349     } else {
350         VncClientInfoList *cur_item = NULL;
351         struct sockaddr_storage sa;
352         socklen_t salen = sizeof(sa);
353         char host[NI_MAXHOST];
354         char serv[NI_MAXSERV];
355         VncState *client;
356 
357         info->enabled = true;
358 
359         /* for compatibility with the original command */
360         info->has_clients = true;
361 
362         QTAILQ_FOREACH(client, &vnc_display->clients, next) {
363             VncClientInfoList *cinfo = g_malloc0(sizeof(*info));
364             cinfo->value = qmp_query_vnc_client(client);
365 
366             /* XXX: waiting for the qapi to support GSList */
367             if (!cur_item) {
368                 info->clients = cur_item = cinfo;
369             } else {
370                 cur_item->next = cinfo;
371                 cur_item = cinfo;
372             }
373         }
374 
375         if (vnc_display->lsock == -1) {
376             return info;
377         }
378 
379         if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
380                         &salen) == -1) {
381             error_set(errp, QERR_UNDEFINED_ERROR);
382             goto out_error;
383         }
384 
385         if (getnameinfo((struct sockaddr *)&sa, salen,
386                         host, sizeof(host),
387                         serv, sizeof(serv),
388                         NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
389             error_set(errp, QERR_UNDEFINED_ERROR);
390             goto out_error;
391         }
392 
393         info->has_host = true;
394         info->host = g_strdup(host);
395 
396         info->has_service = true;
397         info->service = g_strdup(serv);
398 
399         info->has_family = true;
400         info->family = g_strdup(inet_strfamily(sa.ss_family));
401 
402         info->has_auth = true;
403         info->auth = g_strdup(vnc_auth_name(vnc_display));
404     }
405 
406     return info;
407 
408 out_error:
409     qapi_free_VncInfo(info);
410     return NULL;
411 }
412 
413 /* TODO
414    1) Get the queue working for IO.
415    2) there is some weirdness when using the -S option (the screen is grey
416       and not totally invalidated
417    3) resolutions > 1024
418 */
419 
420 static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
421 static void vnc_disconnect_start(VncState *vs);
422 
423 static void vnc_colordepth(VncState *vs);
424 static void framebuffer_update_request(VncState *vs, int incremental,
425                                        int x_position, int y_position,
426                                        int w, int h);
427 static void vnc_refresh(DisplayChangeListener *dcl);
428 static int vnc_refresh_server_surface(VncDisplay *vd);
429 
430 static void vnc_dpy_update(DisplayChangeListener *dcl,
431                            int x, int y, int w, int h)
432 {
433     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
434     struct VncSurface *s = &vd->guest;
435     int width = surface_width(vd->ds);
436     int height = surface_height(vd->ds);
437 
438     /* this is needed this to ensure we updated all affected
439      * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
440     w += (x % VNC_DIRTY_PIXELS_PER_BIT);
441     x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
442 
443     x = MIN(x, width);
444     y = MIN(y, height);
445     w = MIN(x + w, width) - x;
446     h = MIN(y + h, height);
447 
448     for (; y < h; y++) {
449         bitmap_set(s->dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
450                    DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
451     }
452 }
453 
454 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
455                             int32_t encoding)
456 {
457     vnc_write_u16(vs, x);
458     vnc_write_u16(vs, y);
459     vnc_write_u16(vs, w);
460     vnc_write_u16(vs, h);
461 
462     vnc_write_s32(vs, encoding);
463 }
464 
465 void buffer_reserve(Buffer *buffer, size_t len)
466 {
467     if ((buffer->capacity - buffer->offset) < len) {
468         buffer->capacity += (len + 1024);
469         buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
470         if (buffer->buffer == NULL) {
471             fprintf(stderr, "vnc: out of memory\n");
472             exit(1);
473         }
474     }
475 }
476 
477 static int buffer_empty(Buffer *buffer)
478 {
479     return buffer->offset == 0;
480 }
481 
482 uint8_t *buffer_end(Buffer *buffer)
483 {
484     return buffer->buffer + buffer->offset;
485 }
486 
487 void buffer_reset(Buffer *buffer)
488 {
489         buffer->offset = 0;
490 }
491 
492 void buffer_free(Buffer *buffer)
493 {
494     g_free(buffer->buffer);
495     buffer->offset = 0;
496     buffer->capacity = 0;
497     buffer->buffer = NULL;
498 }
499 
500 void buffer_append(Buffer *buffer, const void *data, size_t len)
501 {
502     memcpy(buffer->buffer + buffer->offset, data, len);
503     buffer->offset += len;
504 }
505 
506 void buffer_advance(Buffer *buf, size_t len)
507 {
508     memmove(buf->buffer, buf->buffer + len,
509             (buf->offset - len));
510     buf->offset -= len;
511 }
512 
513 static void vnc_desktop_resize(VncState *vs)
514 {
515     DisplaySurface *ds = vs->vd->ds;
516 
517     if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
518         return;
519     }
520     if (vs->client_width == surface_width(ds) &&
521         vs->client_height == surface_height(ds)) {
522         return;
523     }
524     vs->client_width = surface_width(ds);
525     vs->client_height = surface_height(ds);
526     vnc_lock_output(vs);
527     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
528     vnc_write_u8(vs, 0);
529     vnc_write_u16(vs, 1); /* number of rects */
530     vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
531                            VNC_ENCODING_DESKTOPRESIZE);
532     vnc_unlock_output(vs);
533     vnc_flush(vs);
534 }
535 
536 static void vnc_abort_display_jobs(VncDisplay *vd)
537 {
538     VncState *vs;
539 
540     QTAILQ_FOREACH(vs, &vd->clients, next) {
541         vnc_lock_output(vs);
542         vs->abort = true;
543         vnc_unlock_output(vs);
544     }
545     QTAILQ_FOREACH(vs, &vd->clients, next) {
546         vnc_jobs_join(vs);
547     }
548     QTAILQ_FOREACH(vs, &vd->clients, next) {
549         vnc_lock_output(vs);
550         vs->abort = false;
551         vnc_unlock_output(vs);
552     }
553 }
554 
555 int vnc_server_fb_stride(VncDisplay *vd)
556 {
557     return pixman_image_get_stride(vd->server);
558 }
559 
560 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
561 {
562     uint8_t *ptr;
563 
564     ptr  = (uint8_t *)pixman_image_get_data(vd->server);
565     ptr += y * vnc_server_fb_stride(vd);
566     ptr += x * VNC_SERVER_FB_BYTES;
567     return ptr;
568 }
569 /* this sets only the visible pixels of a dirty bitmap */
570 #define VNC_SET_VISIBLE_PIXELS_DIRTY(bitmap, w, h) {\
571         int y;\
572         memset(bitmap, 0x00, sizeof(bitmap));\
573         for (y = 0; y < h; y++) {\
574             bitmap_set(bitmap[y], 0,\
575                        DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));\
576         } \
577     }
578 
579 static void vnc_dpy_switch(DisplayChangeListener *dcl,
580                            DisplaySurface *surface)
581 {
582     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
583     VncState *vs;
584 
585     vnc_abort_display_jobs(vd);
586 
587     /* server surface */
588     qemu_pixman_image_unref(vd->server);
589     vd->ds = surface;
590     vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
591                                           surface_width(vd->ds),
592                                           surface_height(vd->ds),
593                                           NULL, 0);
594 
595     /* guest surface */
596 #if 0 /* FIXME */
597     if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
598         console_color_init(ds);
599 #endif
600     qemu_pixman_image_unref(vd->guest.fb);
601     vd->guest.fb = pixman_image_ref(surface->image);
602     vd->guest.format = surface->format;
603     VNC_SET_VISIBLE_PIXELS_DIRTY(vd->guest.dirty,
604                                  surface_width(vd->ds),
605                                  surface_height(vd->ds));
606 
607     QTAILQ_FOREACH(vs, &vd->clients, next) {
608         vnc_colordepth(vs);
609         vnc_desktop_resize(vs);
610         if (vs->vd->cursor) {
611             vnc_cursor_define(vs);
612         }
613         VNC_SET_VISIBLE_PIXELS_DIRTY(vs->dirty,
614                                      surface_width(vd->ds),
615                                      surface_height(vd->ds));
616     }
617 }
618 
619 /* fastest code */
620 static void vnc_write_pixels_copy(VncState *vs,
621                                   void *pixels, int size)
622 {
623     vnc_write(vs, pixels, size);
624 }
625 
626 /* slowest but generic code. */
627 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
628 {
629     uint8_t r, g, b;
630 
631 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
632     r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
633     g = (((v & 0x0000ff00) >>  8) << vs->client_pf.gbits) >> 8;
634     b = (((v & 0x000000ff) >>  0) << vs->client_pf.bbits) >> 8;
635 #else
636 # error need some bits here if you change VNC_SERVER_FB_FORMAT
637 #endif
638     v = (r << vs->client_pf.rshift) |
639         (g << vs->client_pf.gshift) |
640         (b << vs->client_pf.bshift);
641     switch (vs->client_pf.bytes_per_pixel) {
642     case 1:
643         buf[0] = v;
644         break;
645     case 2:
646         if (vs->client_be) {
647             buf[0] = v >> 8;
648             buf[1] = v;
649         } else {
650             buf[1] = v >> 8;
651             buf[0] = v;
652         }
653         break;
654     default:
655     case 4:
656         if (vs->client_be) {
657             buf[0] = v >> 24;
658             buf[1] = v >> 16;
659             buf[2] = v >> 8;
660             buf[3] = v;
661         } else {
662             buf[3] = v >> 24;
663             buf[2] = v >> 16;
664             buf[1] = v >> 8;
665             buf[0] = v;
666         }
667         break;
668     }
669 }
670 
671 static void vnc_write_pixels_generic(VncState *vs,
672                                      void *pixels1, int size)
673 {
674     uint8_t buf[4];
675 
676     if (VNC_SERVER_FB_BYTES == 4) {
677         uint32_t *pixels = pixels1;
678         int n, i;
679         n = size >> 2;
680         for (i = 0; i < n; i++) {
681             vnc_convert_pixel(vs, buf, pixels[i]);
682             vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
683         }
684     }
685 }
686 
687 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
688 {
689     int i;
690     uint8_t *row;
691     VncDisplay *vd = vs->vd;
692 
693     row = vnc_server_fb_ptr(vd, x, y);
694     for (i = 0; i < h; i++) {
695         vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
696         row += vnc_server_fb_stride(vd);
697     }
698     return 1;
699 }
700 
701 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
702 {
703     int n = 0;
704 
705     switch(vs->vnc_encoding) {
706         case VNC_ENCODING_ZLIB:
707             n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
708             break;
709         case VNC_ENCODING_HEXTILE:
710             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
711             n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
712             break;
713         case VNC_ENCODING_TIGHT:
714             n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
715             break;
716         case VNC_ENCODING_TIGHT_PNG:
717             n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
718             break;
719         case VNC_ENCODING_ZRLE:
720             n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
721             break;
722         case VNC_ENCODING_ZYWRLE:
723             n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
724             break;
725         default:
726             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
727             n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
728             break;
729     }
730     return n;
731 }
732 
733 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
734 {
735     /* send bitblit op to the vnc client */
736     vnc_lock_output(vs);
737     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
738     vnc_write_u8(vs, 0);
739     vnc_write_u16(vs, 1); /* number of rects */
740     vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
741     vnc_write_u16(vs, src_x);
742     vnc_write_u16(vs, src_y);
743     vnc_unlock_output(vs);
744     vnc_flush(vs);
745 }
746 
747 static void vnc_dpy_copy(DisplayChangeListener *dcl,
748                          int src_x, int src_y,
749                          int dst_x, int dst_y, int w, int h)
750 {
751     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
752     VncState *vs, *vn;
753     uint8_t *src_row;
754     uint8_t *dst_row;
755     int i, x, y, pitch, inc, w_lim, s;
756     int cmp_bytes;
757 
758     vnc_refresh_server_surface(vd);
759     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
760         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
761             vs->force_update = 1;
762             vnc_update_client(vs, 1, true);
763             /* vs might be free()ed here */
764         }
765     }
766 
767     /* do bitblit op on the local surface too */
768     pitch = vnc_server_fb_stride(vd);
769     src_row = vnc_server_fb_ptr(vd, src_x, src_y);
770     dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
771     y = dst_y;
772     inc = 1;
773     if (dst_y > src_y) {
774         /* copy backwards */
775         src_row += pitch * (h-1);
776         dst_row += pitch * (h-1);
777         pitch = -pitch;
778         y = dst_y + h - 1;
779         inc = -1;
780     }
781     w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
782     if (w_lim < 0) {
783         w_lim = w;
784     } else {
785         w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);
786     }
787     for (i = 0; i < h; i++) {
788         for (x = 0; x <= w_lim;
789                 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
790             if (x == w_lim) {
791                 if ((s = w - w_lim) == 0)
792                     break;
793             } else if (!x) {
794                 s = (VNC_DIRTY_PIXELS_PER_BIT -
795                     (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
796                 s = MIN(s, w_lim);
797             } else {
798                 s = VNC_DIRTY_PIXELS_PER_BIT;
799             }
800             cmp_bytes = s * VNC_SERVER_FB_BYTES;
801             if (memcmp(src_row, dst_row, cmp_bytes) == 0)
802                 continue;
803             memmove(dst_row, src_row, cmp_bytes);
804             QTAILQ_FOREACH(vs, &vd->clients, next) {
805                 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
806                     set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT),
807                             vs->dirty[y]);
808                 }
809             }
810         }
811         src_row += pitch - w * VNC_SERVER_FB_BYTES;
812         dst_row += pitch - w * VNC_SERVER_FB_BYTES;
813         y += inc;
814     }
815 
816     QTAILQ_FOREACH(vs, &vd->clients, next) {
817         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
818             vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
819         }
820     }
821 }
822 
823 static void vnc_mouse_set(DisplayChangeListener *dcl,
824                           int x, int y, int visible)
825 {
826     /* can we ask the client(s) to move the pointer ??? */
827 }
828 
829 static int vnc_cursor_define(VncState *vs)
830 {
831     QEMUCursor *c = vs->vd->cursor;
832     int isize;
833 
834     if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
835         vnc_lock_output(vs);
836         vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
837         vnc_write_u8(vs,  0);  /*  padding     */
838         vnc_write_u16(vs, 1);  /*  # of rects  */
839         vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
840                                VNC_ENCODING_RICH_CURSOR);
841         isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
842         vnc_write_pixels_generic(vs, c->data, isize);
843         vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
844         vnc_unlock_output(vs);
845         return 0;
846     }
847     return -1;
848 }
849 
850 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
851                                   QEMUCursor *c)
852 {
853     VncDisplay *vd = vnc_display;
854     VncState *vs;
855 
856     cursor_put(vd->cursor);
857     g_free(vd->cursor_mask);
858 
859     vd->cursor = c;
860     cursor_get(vd->cursor);
861     vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
862     vd->cursor_mask = g_malloc0(vd->cursor_msize);
863     cursor_get_mono_mask(c, 0, vd->cursor_mask);
864 
865     QTAILQ_FOREACH(vs, &vd->clients, next) {
866         vnc_cursor_define(vs);
867     }
868 }
869 
870 static int find_and_clear_dirty_height(struct VncState *vs,
871                                        int y, int last_x, int x, int height)
872 {
873     int h;
874 
875     for (h = 1; h < (height - y); h++) {
876         if (!test_bit(last_x, vs->dirty[y + h])) {
877             break;
878         }
879         bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
880     }
881 
882     return h;
883 }
884 
885 static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
886 {
887     if (vs->need_update && vs->csock != -1) {
888         VncDisplay *vd = vs->vd;
889         VncJob *job;
890         int y;
891         int height;
892         int n = 0;
893 
894         if (vs->output.offset && !vs->audio_cap && !vs->force_update)
895             /* kernel send buffers are full -> drop frames to throttle */
896             return 0;
897 
898         if (!has_dirty && !vs->audio_cap && !vs->force_update)
899             return 0;
900 
901         /*
902          * Send screen updates to the vnc client using the server
903          * surface and server dirty map.  guest surface updates
904          * happening in parallel don't disturb us, the next pass will
905          * send them to the client.
906          */
907         job = vnc_job_new(vs);
908 
909         height = MIN(pixman_image_get_height(vd->server), vs->client_height);
910 
911         y = 0;
912         for (;;) {
913             int x, h;
914             unsigned long x2;
915             unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
916                                                  height * VNC_DIRTY_BPL(vs),
917                                                  y * VNC_DIRTY_BPL(vs));
918             if (offset == height * VNC_DIRTY_BPL(vs)) {
919                 /* no more dirty bits */
920                 break;
921             }
922             y = offset / VNC_DIRTY_BPL(vs);
923             x = offset % VNC_DIRTY_BPL(vs);
924             x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
925                                     VNC_DIRTY_BPL(vs), x);
926             bitmap_clear(vs->dirty[y], x, x2 - x);
927             h = find_and_clear_dirty_height(vs, y, x, x2, height);
928             n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
929                                   (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
930         }
931 
932         vnc_job_push(job);
933         vs->force_update = 0;
934         return n;
935     }
936 
937     if (vs->csock == -1) {
938         vnc_disconnect_finish(vs);
939     } else if (sync) {
940         vnc_jobs_join(vs);
941     }
942 
943     return 0;
944 }
945 
946 /* audio */
947 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
948 {
949     VncState *vs = opaque;
950 
951     switch (cmd) {
952     case AUD_CNOTIFY_DISABLE:
953         vnc_lock_output(vs);
954         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
955         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
956         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
957         vnc_unlock_output(vs);
958         vnc_flush(vs);
959         break;
960 
961     case AUD_CNOTIFY_ENABLE:
962         vnc_lock_output(vs);
963         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
964         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
965         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
966         vnc_unlock_output(vs);
967         vnc_flush(vs);
968         break;
969     }
970 }
971 
972 static void audio_capture_destroy(void *opaque)
973 {
974 }
975 
976 static void audio_capture(void *opaque, void *buf, int size)
977 {
978     VncState *vs = opaque;
979 
980     vnc_lock_output(vs);
981     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
982     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
983     vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
984     vnc_write_u32(vs, size);
985     vnc_write(vs, buf, size);
986     vnc_unlock_output(vs);
987     vnc_flush(vs);
988 }
989 
990 static void audio_add(VncState *vs)
991 {
992     struct audio_capture_ops ops;
993 
994     if (vs->audio_cap) {
995         monitor_printf(default_mon, "audio already running\n");
996         return;
997     }
998 
999     ops.notify = audio_capture_notify;
1000     ops.destroy = audio_capture_destroy;
1001     ops.capture = audio_capture;
1002 
1003     vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1004     if (!vs->audio_cap) {
1005         monitor_printf(default_mon, "Failed to add audio capture\n");
1006     }
1007 }
1008 
1009 static void audio_del(VncState *vs)
1010 {
1011     if (vs->audio_cap) {
1012         AUD_del_capture(vs->audio_cap, vs);
1013         vs->audio_cap = NULL;
1014     }
1015 }
1016 
1017 static void vnc_disconnect_start(VncState *vs)
1018 {
1019     if (vs->csock == -1)
1020         return;
1021     vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1022     qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
1023     closesocket(vs->csock);
1024     vs->csock = -1;
1025 }
1026 
1027 void vnc_disconnect_finish(VncState *vs)
1028 {
1029     int i;
1030 
1031     vnc_jobs_join(vs); /* Wait encoding jobs */
1032 
1033     vnc_lock_output(vs);
1034     vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1035 
1036     buffer_free(&vs->input);
1037     buffer_free(&vs->output);
1038 #ifdef CONFIG_VNC_WS
1039     buffer_free(&vs->ws_input);
1040     buffer_free(&vs->ws_output);
1041 #endif /* CONFIG_VNC_WS */
1042 
1043     qobject_decref(vs->info);
1044 
1045     vnc_zlib_clear(vs);
1046     vnc_tight_clear(vs);
1047     vnc_zrle_clear(vs);
1048 
1049 #ifdef CONFIG_VNC_TLS
1050     vnc_tls_client_cleanup(vs);
1051 #endif /* CONFIG_VNC_TLS */
1052 #ifdef CONFIG_VNC_SASL
1053     vnc_sasl_client_cleanup(vs);
1054 #endif /* CONFIG_VNC_SASL */
1055     audio_del(vs);
1056     vnc_release_modifiers(vs);
1057 
1058     if (vs->initialized) {
1059         QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1060         qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1061     }
1062 
1063     if (vs->vd->lock_key_sync)
1064         qemu_remove_led_event_handler(vs->led);
1065     vnc_unlock_output(vs);
1066 
1067     qemu_mutex_destroy(&vs->output_mutex);
1068     if (vs->bh != NULL) {
1069         qemu_bh_delete(vs->bh);
1070     }
1071     buffer_free(&vs->jobs_buffer);
1072 
1073     for (i = 0; i < VNC_STAT_ROWS; ++i) {
1074         g_free(vs->lossy_rect[i]);
1075     }
1076     g_free(vs->lossy_rect);
1077     g_free(vs);
1078 }
1079 
1080 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1081 {
1082     if (ret == 0 || ret == -1) {
1083         if (ret == -1) {
1084             switch (last_errno) {
1085                 case EINTR:
1086                 case EAGAIN:
1087 #ifdef _WIN32
1088                 case WSAEWOULDBLOCK:
1089 #endif
1090                     return 0;
1091                 default:
1092                     break;
1093             }
1094         }
1095 
1096         VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1097                   ret, ret < 0 ? last_errno : 0);
1098         vnc_disconnect_start(vs);
1099 
1100         return 0;
1101     }
1102     return ret;
1103 }
1104 
1105 
1106 void vnc_client_error(VncState *vs)
1107 {
1108     VNC_DEBUG("Closing down client sock: protocol error\n");
1109     vnc_disconnect_start(vs);
1110 }
1111 
1112 #ifdef CONFIG_VNC_TLS
1113 static long vnc_client_write_tls(gnutls_session_t *session,
1114                                  const uint8_t *data,
1115                                  size_t datalen)
1116 {
1117     long ret = gnutls_write(*session, data, datalen);
1118     if (ret < 0) {
1119         if (ret == GNUTLS_E_AGAIN) {
1120             errno = EAGAIN;
1121         } else {
1122             errno = EIO;
1123         }
1124         ret = -1;
1125     }
1126     return ret;
1127 }
1128 #endif /* CONFIG_VNC_TLS */
1129 
1130 /*
1131  * Called to write a chunk of data to the client socket. The data may
1132  * be the raw data, or may have already been encoded by SASL.
1133  * The data will be written either straight onto the socket, or
1134  * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1135  *
1136  * NB, it is theoretically possible to have 2 layers of encryption,
1137  * both SASL, and this TLS layer. It is highly unlikely in practice
1138  * though, since SASL encryption will typically be a no-op if TLS
1139  * is active
1140  *
1141  * Returns the number of bytes written, which may be less than
1142  * the requested 'datalen' if the socket would block. Returns
1143  * -1 on error, and disconnects the client socket.
1144  */
1145 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1146 {
1147     long ret;
1148 #ifdef CONFIG_VNC_TLS
1149     if (vs->tls.session) {
1150         ret = vnc_client_write_tls(&vs->tls.session, data, datalen);
1151     } else {
1152 #ifdef CONFIG_VNC_WS
1153         if (vs->ws_tls.session) {
1154             ret = vnc_client_write_tls(&vs->ws_tls.session, data, datalen);
1155         } else
1156 #endif /* CONFIG_VNC_WS */
1157 #endif /* CONFIG_VNC_TLS */
1158         {
1159             ret = send(vs->csock, (const void *)data, datalen, 0);
1160         }
1161 #ifdef CONFIG_VNC_TLS
1162     }
1163 #endif /* CONFIG_VNC_TLS */
1164     VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1165     return vnc_client_io_error(vs, ret, socket_error());
1166 }
1167 
1168 
1169 /*
1170  * Called to write buffered data to the client socket, when not
1171  * using any SASL SSF encryption layers. Will write as much data
1172  * as possible without blocking. If all buffered data is written,
1173  * will switch the FD poll() handler back to read monitoring.
1174  *
1175  * Returns the number of bytes written, which may be less than
1176  * the buffered output data if the socket would block. Returns
1177  * -1 on error, and disconnects the client socket.
1178  */
1179 static long vnc_client_write_plain(VncState *vs)
1180 {
1181     long ret;
1182 
1183 #ifdef CONFIG_VNC_SASL
1184     VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1185               vs->output.buffer, vs->output.capacity, vs->output.offset,
1186               vs->sasl.waitWriteSSF);
1187 
1188     if (vs->sasl.conn &&
1189         vs->sasl.runSSF &&
1190         vs->sasl.waitWriteSSF) {
1191         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1192         if (ret)
1193             vs->sasl.waitWriteSSF -= ret;
1194     } else
1195 #endif /* CONFIG_VNC_SASL */
1196         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1197     if (!ret)
1198         return 0;
1199 
1200     buffer_advance(&vs->output, ret);
1201 
1202     if (vs->output.offset == 0) {
1203         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1204     }
1205 
1206     return ret;
1207 }
1208 
1209 
1210 /*
1211  * First function called whenever there is data to be written to
1212  * the client socket. Will delegate actual work according to whether
1213  * SASL SSF layers are enabled (thus requiring encryption calls)
1214  */
1215 static void vnc_client_write_locked(void *opaque)
1216 {
1217     VncState *vs = opaque;
1218 
1219 #ifdef CONFIG_VNC_SASL
1220     if (vs->sasl.conn &&
1221         vs->sasl.runSSF &&
1222         !vs->sasl.waitWriteSSF) {
1223         vnc_client_write_sasl(vs);
1224     } else
1225 #endif /* CONFIG_VNC_SASL */
1226     {
1227 #ifdef CONFIG_VNC_WS
1228         if (vs->encode_ws) {
1229             vnc_client_write_ws(vs);
1230         } else
1231 #endif /* CONFIG_VNC_WS */
1232         {
1233             vnc_client_write_plain(vs);
1234         }
1235     }
1236 }
1237 
1238 void vnc_client_write(void *opaque)
1239 {
1240     VncState *vs = opaque;
1241 
1242     vnc_lock_output(vs);
1243     if (vs->output.offset
1244 #ifdef CONFIG_VNC_WS
1245             || vs->ws_output.offset
1246 #endif
1247             ) {
1248         vnc_client_write_locked(opaque);
1249     } else if (vs->csock != -1) {
1250         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1251     }
1252     vnc_unlock_output(vs);
1253 }
1254 
1255 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1256 {
1257     vs->read_handler = func;
1258     vs->read_handler_expect = expecting;
1259 }
1260 
1261 #ifdef CONFIG_VNC_TLS
1262 static long vnc_client_read_tls(gnutls_session_t *session, uint8_t *data,
1263                                 size_t datalen)
1264 {
1265     long ret = gnutls_read(*session, data, datalen);
1266     if (ret < 0) {
1267         if (ret == GNUTLS_E_AGAIN) {
1268             errno = EAGAIN;
1269         } else {
1270             errno = EIO;
1271         }
1272         ret = -1;
1273     }
1274     return ret;
1275 }
1276 #endif /* CONFIG_VNC_TLS */
1277 
1278 /*
1279  * Called to read a chunk of data from the client socket. The data may
1280  * be the raw data, or may need to be further decoded by SASL.
1281  * The data will be read either straight from to the socket, or
1282  * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1283  *
1284  * NB, it is theoretically possible to have 2 layers of encryption,
1285  * both SASL, and this TLS layer. It is highly unlikely in practice
1286  * though, since SASL encryption will typically be a no-op if TLS
1287  * is active
1288  *
1289  * Returns the number of bytes read, which may be less than
1290  * the requested 'datalen' if the socket would block. Returns
1291  * -1 on error, and disconnects the client socket.
1292  */
1293 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1294 {
1295     long ret;
1296 #ifdef CONFIG_VNC_TLS
1297     if (vs->tls.session) {
1298         ret = vnc_client_read_tls(&vs->tls.session, data, datalen);
1299     } else {
1300 #ifdef CONFIG_VNC_WS
1301         if (vs->ws_tls.session) {
1302             ret = vnc_client_read_tls(&vs->ws_tls.session, data, datalen);
1303         } else
1304 #endif /* CONFIG_VNC_WS */
1305 #endif /* CONFIG_VNC_TLS */
1306         {
1307             ret = qemu_recv(vs->csock, data, datalen, 0);
1308         }
1309 #ifdef CONFIG_VNC_TLS
1310     }
1311 #endif /* CONFIG_VNC_TLS */
1312     VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1313     return vnc_client_io_error(vs, ret, socket_error());
1314 }
1315 
1316 
1317 /*
1318  * Called to read data from the client socket to the input buffer,
1319  * when not using any SASL SSF encryption layers. Will read as much
1320  * data as possible without blocking.
1321  *
1322  * Returns the number of bytes read. Returns -1 on error, and
1323  * disconnects the client socket.
1324  */
1325 static long vnc_client_read_plain(VncState *vs)
1326 {
1327     int ret;
1328     VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1329               vs->input.buffer, vs->input.capacity, vs->input.offset);
1330     buffer_reserve(&vs->input, 4096);
1331     ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1332     if (!ret)
1333         return 0;
1334     vs->input.offset += ret;
1335     return ret;
1336 }
1337 
1338 static void vnc_jobs_bh(void *opaque)
1339 {
1340     VncState *vs = opaque;
1341 
1342     vnc_jobs_consume_buffer(vs);
1343 }
1344 
1345 /*
1346  * First function called whenever there is more data to be read from
1347  * the client socket. Will delegate actual work according to whether
1348  * SASL SSF layers are enabled (thus requiring decryption calls)
1349  */
1350 void vnc_client_read(void *opaque)
1351 {
1352     VncState *vs = opaque;
1353     long ret;
1354 
1355 #ifdef CONFIG_VNC_SASL
1356     if (vs->sasl.conn && vs->sasl.runSSF)
1357         ret = vnc_client_read_sasl(vs);
1358     else
1359 #endif /* CONFIG_VNC_SASL */
1360 #ifdef CONFIG_VNC_WS
1361         if (vs->encode_ws) {
1362             ret = vnc_client_read_ws(vs);
1363             if (ret == -1) {
1364                 vnc_disconnect_start(vs);
1365                 return;
1366             } else if (ret == -2) {
1367                 vnc_client_error(vs);
1368                 return;
1369             }
1370         } else
1371 #endif /* CONFIG_VNC_WS */
1372         {
1373         ret = vnc_client_read_plain(vs);
1374         }
1375     if (!ret) {
1376         if (vs->csock == -1)
1377             vnc_disconnect_finish(vs);
1378         return;
1379     }
1380 
1381     while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1382         size_t len = vs->read_handler_expect;
1383         int ret;
1384 
1385         ret = vs->read_handler(vs, vs->input.buffer, len);
1386         if (vs->csock == -1) {
1387             vnc_disconnect_finish(vs);
1388             return;
1389         }
1390 
1391         if (!ret) {
1392             buffer_advance(&vs->input, len);
1393         } else {
1394             vs->read_handler_expect = ret;
1395         }
1396     }
1397 }
1398 
1399 void vnc_write(VncState *vs, const void *data, size_t len)
1400 {
1401     buffer_reserve(&vs->output, len);
1402 
1403     if (vs->csock != -1 && buffer_empty(&vs->output)) {
1404         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1405     }
1406 
1407     buffer_append(&vs->output, data, len);
1408 }
1409 
1410 void vnc_write_s32(VncState *vs, int32_t value)
1411 {
1412     vnc_write_u32(vs, *(uint32_t *)&value);
1413 }
1414 
1415 void vnc_write_u32(VncState *vs, uint32_t value)
1416 {
1417     uint8_t buf[4];
1418 
1419     buf[0] = (value >> 24) & 0xFF;
1420     buf[1] = (value >> 16) & 0xFF;
1421     buf[2] = (value >>  8) & 0xFF;
1422     buf[3] = value & 0xFF;
1423 
1424     vnc_write(vs, buf, 4);
1425 }
1426 
1427 void vnc_write_u16(VncState *vs, uint16_t value)
1428 {
1429     uint8_t buf[2];
1430 
1431     buf[0] = (value >> 8) & 0xFF;
1432     buf[1] = value & 0xFF;
1433 
1434     vnc_write(vs, buf, 2);
1435 }
1436 
1437 void vnc_write_u8(VncState *vs, uint8_t value)
1438 {
1439     vnc_write(vs, (char *)&value, 1);
1440 }
1441 
1442 void vnc_flush(VncState *vs)
1443 {
1444     vnc_lock_output(vs);
1445     if (vs->csock != -1 && (vs->output.offset
1446 #ifdef CONFIG_VNC_WS
1447                 || vs->ws_output.offset
1448 #endif
1449                 )) {
1450         vnc_client_write_locked(vs);
1451     }
1452     vnc_unlock_output(vs);
1453 }
1454 
1455 static uint8_t read_u8(uint8_t *data, size_t offset)
1456 {
1457     return data[offset];
1458 }
1459 
1460 static uint16_t read_u16(uint8_t *data, size_t offset)
1461 {
1462     return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1463 }
1464 
1465 static int32_t read_s32(uint8_t *data, size_t offset)
1466 {
1467     return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1468                      (data[offset + 2] << 8) | data[offset + 3]);
1469 }
1470 
1471 uint32_t read_u32(uint8_t *data, size_t offset)
1472 {
1473     return ((data[offset] << 24) | (data[offset + 1] << 16) |
1474             (data[offset + 2] << 8) | data[offset + 3]);
1475 }
1476 
1477 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1478 {
1479 }
1480 
1481 static void check_pointer_type_change(Notifier *notifier, void *data)
1482 {
1483     VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1484     int absolute = qemu_input_is_absolute();
1485 
1486     if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1487         vnc_lock_output(vs);
1488         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1489         vnc_write_u8(vs, 0);
1490         vnc_write_u16(vs, 1);
1491         vnc_framebuffer_update(vs, absolute, 0,
1492                                surface_width(vs->vd->ds),
1493                                surface_height(vs->vd->ds),
1494                                VNC_ENCODING_POINTER_TYPE_CHANGE);
1495         vnc_unlock_output(vs);
1496         vnc_flush(vs);
1497     }
1498     vs->absolute = absolute;
1499 }
1500 
1501 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1502 {
1503     static uint32_t bmap[INPUT_BUTTON_MAX] = {
1504         [INPUT_BUTTON_LEFT]       = 0x01,
1505         [INPUT_BUTTON_MIDDLE]     = 0x02,
1506         [INPUT_BUTTON_RIGHT]      = 0x04,
1507         [INPUT_BUTTON_WHEEL_UP]   = 0x08,
1508         [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1509     };
1510     QemuConsole *con = vs->vd->dcl.con;
1511     int width = surface_width(vs->vd->ds);
1512     int height = surface_height(vs->vd->ds);
1513 
1514     if (vs->last_bmask != button_mask) {
1515         qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1516         vs->last_bmask = button_mask;
1517     }
1518 
1519     if (vs->absolute) {
1520         qemu_input_queue_abs(con, INPUT_AXIS_X, x, width);
1521         qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height);
1522     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1523         qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1524         qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1525     } else {
1526         if (vs->last_x != -1) {
1527             qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1528             qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1529         }
1530         vs->last_x = x;
1531         vs->last_y = y;
1532     }
1533     qemu_input_event_sync();
1534 }
1535 
1536 static void reset_keys(VncState *vs)
1537 {
1538     int i;
1539     for(i = 0; i < 256; i++) {
1540         if (vs->modifiers_state[i]) {
1541             qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1542             vs->modifiers_state[i] = 0;
1543         }
1544     }
1545 }
1546 
1547 static void press_key(VncState *vs, int keysym)
1548 {
1549     int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1550     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1551     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1552 }
1553 
1554 static int current_led_state(VncState *vs)
1555 {
1556     int ledstate = 0;
1557 
1558     if (vs->modifiers_state[0x46]) {
1559         ledstate |= QEMU_SCROLL_LOCK_LED;
1560     }
1561     if (vs->modifiers_state[0x45]) {
1562         ledstate |= QEMU_NUM_LOCK_LED;
1563     }
1564     if (vs->modifiers_state[0x3a]) {
1565         ledstate |= QEMU_CAPS_LOCK_LED;
1566     }
1567 
1568     return ledstate;
1569 }
1570 
1571 static void vnc_led_state_change(VncState *vs)
1572 {
1573     int ledstate = 0;
1574 
1575     if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1576         return;
1577     }
1578 
1579     ledstate = current_led_state(vs);
1580     vnc_lock_output(vs);
1581     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1582     vnc_write_u8(vs, 0);
1583     vnc_write_u16(vs, 1);
1584     vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1585     vnc_write_u8(vs, ledstate);
1586     vnc_unlock_output(vs);
1587     vnc_flush(vs);
1588 }
1589 
1590 static void kbd_leds(void *opaque, int ledstate)
1591 {
1592     VncState *vs = opaque;
1593     int caps, num, scr;
1594     bool has_changed = (ledstate != current_led_state(vs));
1595 
1596     caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1597     num  = ledstate & QEMU_NUM_LOCK_LED  ? 1 : 0;
1598     scr  = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0;
1599 
1600     if (vs->modifiers_state[0x3a] != caps) {
1601         vs->modifiers_state[0x3a] = caps;
1602     }
1603     if (vs->modifiers_state[0x45] != num) {
1604         vs->modifiers_state[0x45] = num;
1605     }
1606     if (vs->modifiers_state[0x46] != scr) {
1607         vs->modifiers_state[0x46] = scr;
1608     }
1609 
1610     /* Sending the current led state message to the client */
1611     if (has_changed) {
1612         vnc_led_state_change(vs);
1613     }
1614 }
1615 
1616 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1617 {
1618     /* QEMU console switch */
1619     switch(keycode) {
1620     case 0x2a:                          /* Left Shift */
1621     case 0x36:                          /* Right Shift */
1622     case 0x1d:                          /* Left CTRL */
1623     case 0x9d:                          /* Right CTRL */
1624     case 0x38:                          /* Left ALT */
1625     case 0xb8:                          /* Right ALT */
1626         if (down)
1627             vs->modifiers_state[keycode] = 1;
1628         else
1629             vs->modifiers_state[keycode] = 0;
1630         break;
1631     case 0x02 ... 0x0a: /* '1' to '9' keys */
1632         if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1633             /* Reset the modifiers sent to the current console */
1634             reset_keys(vs);
1635             console_select(keycode - 0x02);
1636             return;
1637         }
1638         break;
1639     case 0x3a:                        /* CapsLock */
1640     case 0x45:                        /* NumLock */
1641         if (down)
1642             vs->modifiers_state[keycode] ^= 1;
1643         break;
1644     }
1645 
1646     /* Turn off the lock state sync logic if the client support the led
1647        state extension.
1648     */
1649     if (down && vs->vd->lock_key_sync &&
1650         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1651         keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1652         /* If the numlock state needs to change then simulate an additional
1653            keypress before sending this one.  This will happen if the user
1654            toggles numlock away from the VNC window.
1655         */
1656         if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1657             if (!vs->modifiers_state[0x45]) {
1658                 vs->modifiers_state[0x45] = 1;
1659                 press_key(vs, 0xff7f);
1660             }
1661         } else {
1662             if (vs->modifiers_state[0x45]) {
1663                 vs->modifiers_state[0x45] = 0;
1664                 press_key(vs, 0xff7f);
1665             }
1666         }
1667     }
1668 
1669     if (down && vs->vd->lock_key_sync &&
1670         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1671         ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1672         /* If the capslock state needs to change then simulate an additional
1673            keypress before sending this one.  This will happen if the user
1674            toggles capslock away from the VNC window.
1675         */
1676         int uppercase = !!(sym >= 'A' && sym <= 'Z');
1677         int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1678         int capslock = !!(vs->modifiers_state[0x3a]);
1679         if (capslock) {
1680             if (uppercase == shift) {
1681                 vs->modifiers_state[0x3a] = 0;
1682                 press_key(vs, 0xffe5);
1683             }
1684         } else {
1685             if (uppercase != shift) {
1686                 vs->modifiers_state[0x3a] = 1;
1687                 press_key(vs, 0xffe5);
1688             }
1689         }
1690     }
1691 
1692     if (qemu_console_is_graphic(NULL)) {
1693         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1694     } else {
1695         bool numlock = vs->modifiers_state[0x45];
1696         bool control = (vs->modifiers_state[0x1d] ||
1697                         vs->modifiers_state[0x9d]);
1698         /* QEMU console emulation */
1699         if (down) {
1700             switch (keycode) {
1701             case 0x2a:                          /* Left Shift */
1702             case 0x36:                          /* Right Shift */
1703             case 0x1d:                          /* Left CTRL */
1704             case 0x9d:                          /* Right CTRL */
1705             case 0x38:                          /* Left ALT */
1706             case 0xb8:                          /* Right ALT */
1707                 break;
1708             case 0xc8:
1709                 kbd_put_keysym(QEMU_KEY_UP);
1710                 break;
1711             case 0xd0:
1712                 kbd_put_keysym(QEMU_KEY_DOWN);
1713                 break;
1714             case 0xcb:
1715                 kbd_put_keysym(QEMU_KEY_LEFT);
1716                 break;
1717             case 0xcd:
1718                 kbd_put_keysym(QEMU_KEY_RIGHT);
1719                 break;
1720             case 0xd3:
1721                 kbd_put_keysym(QEMU_KEY_DELETE);
1722                 break;
1723             case 0xc7:
1724                 kbd_put_keysym(QEMU_KEY_HOME);
1725                 break;
1726             case 0xcf:
1727                 kbd_put_keysym(QEMU_KEY_END);
1728                 break;
1729             case 0xc9:
1730                 kbd_put_keysym(QEMU_KEY_PAGEUP);
1731                 break;
1732             case 0xd1:
1733                 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1734                 break;
1735 
1736             case 0x47:
1737                 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1738                 break;
1739             case 0x48:
1740                 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1741                 break;
1742             case 0x49:
1743                 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1744                 break;
1745             case 0x4b:
1746                 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1747                 break;
1748             case 0x4c:
1749                 kbd_put_keysym('5');
1750                 break;
1751             case 0x4d:
1752                 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1753                 break;
1754             case 0x4f:
1755                 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1756                 break;
1757             case 0x50:
1758                 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1759                 break;
1760             case 0x51:
1761                 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1762                 break;
1763             case 0x52:
1764                 kbd_put_keysym('0');
1765                 break;
1766             case 0x53:
1767                 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1768                 break;
1769 
1770             case 0xb5:
1771                 kbd_put_keysym('/');
1772                 break;
1773             case 0x37:
1774                 kbd_put_keysym('*');
1775                 break;
1776             case 0x4a:
1777                 kbd_put_keysym('-');
1778                 break;
1779             case 0x4e:
1780                 kbd_put_keysym('+');
1781                 break;
1782             case 0x9c:
1783                 kbd_put_keysym('\n');
1784                 break;
1785 
1786             default:
1787                 if (control) {
1788                     kbd_put_keysym(sym & 0x1f);
1789                 } else {
1790                     kbd_put_keysym(sym);
1791                 }
1792                 break;
1793             }
1794         }
1795     }
1796 }
1797 
1798 static void vnc_release_modifiers(VncState *vs)
1799 {
1800     static const int keycodes[] = {
1801         /* shift, control, alt keys, both left & right */
1802         0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1803     };
1804     int i, keycode;
1805 
1806     if (!qemu_console_is_graphic(NULL)) {
1807         return;
1808     }
1809     for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1810         keycode = keycodes[i];
1811         if (!vs->modifiers_state[keycode]) {
1812             continue;
1813         }
1814         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1815     }
1816 }
1817 
1818 static void key_event(VncState *vs, int down, uint32_t sym)
1819 {
1820     int keycode;
1821     int lsym = sym;
1822 
1823     if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1824         lsym = lsym - 'A' + 'a';
1825     }
1826 
1827     keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1828     do_key_event(vs, down, keycode, sym);
1829 }
1830 
1831 static void ext_key_event(VncState *vs, int down,
1832                           uint32_t sym, uint16_t keycode)
1833 {
1834     /* if the user specifies a keyboard layout, always use it */
1835     if (keyboard_layout)
1836         key_event(vs, down, sym);
1837     else
1838         do_key_event(vs, down, keycode, sym);
1839 }
1840 
1841 static void framebuffer_update_request(VncState *vs, int incremental,
1842                                        int x_position, int y_position,
1843                                        int w, int h)
1844 {
1845     int i;
1846     const size_t width = surface_width(vs->vd->ds) / VNC_DIRTY_PIXELS_PER_BIT;
1847     const size_t height = surface_height(vs->vd->ds);
1848 
1849     if (y_position > height) {
1850         y_position = height;
1851     }
1852     if (y_position + h >= height) {
1853         h = height - y_position;
1854     }
1855 
1856     vs->need_update = 1;
1857     if (!incremental) {
1858         vs->force_update = 1;
1859         for (i = 0; i < h; i++) {
1860             bitmap_set(vs->dirty[y_position + i], 0, width);
1861             bitmap_clear(vs->dirty[y_position + i], width,
1862                          VNC_DIRTY_BITS - width);
1863         }
1864     }
1865 }
1866 
1867 static void send_ext_key_event_ack(VncState *vs)
1868 {
1869     vnc_lock_output(vs);
1870     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1871     vnc_write_u8(vs, 0);
1872     vnc_write_u16(vs, 1);
1873     vnc_framebuffer_update(vs, 0, 0,
1874                            surface_width(vs->vd->ds),
1875                            surface_height(vs->vd->ds),
1876                            VNC_ENCODING_EXT_KEY_EVENT);
1877     vnc_unlock_output(vs);
1878     vnc_flush(vs);
1879 }
1880 
1881 static void send_ext_audio_ack(VncState *vs)
1882 {
1883     vnc_lock_output(vs);
1884     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1885     vnc_write_u8(vs, 0);
1886     vnc_write_u16(vs, 1);
1887     vnc_framebuffer_update(vs, 0, 0,
1888                            surface_width(vs->vd->ds),
1889                            surface_height(vs->vd->ds),
1890                            VNC_ENCODING_AUDIO);
1891     vnc_unlock_output(vs);
1892     vnc_flush(vs);
1893 }
1894 
1895 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1896 {
1897     int i;
1898     unsigned int enc = 0;
1899 
1900     vs->features = 0;
1901     vs->vnc_encoding = 0;
1902     vs->tight.compression = 9;
1903     vs->tight.quality = -1; /* Lossless by default */
1904     vs->absolute = -1;
1905 
1906     /*
1907      * Start from the end because the encodings are sent in order of preference.
1908      * This way the preferred encoding (first encoding defined in the array)
1909      * will be set at the end of the loop.
1910      */
1911     for (i = n_encodings - 1; i >= 0; i--) {
1912         enc = encodings[i];
1913         switch (enc) {
1914         case VNC_ENCODING_RAW:
1915             vs->vnc_encoding = enc;
1916             break;
1917         case VNC_ENCODING_COPYRECT:
1918             vs->features |= VNC_FEATURE_COPYRECT_MASK;
1919             break;
1920         case VNC_ENCODING_HEXTILE:
1921             vs->features |= VNC_FEATURE_HEXTILE_MASK;
1922             vs->vnc_encoding = enc;
1923             break;
1924         case VNC_ENCODING_TIGHT:
1925             vs->features |= VNC_FEATURE_TIGHT_MASK;
1926             vs->vnc_encoding = enc;
1927             break;
1928 #ifdef CONFIG_VNC_PNG
1929         case VNC_ENCODING_TIGHT_PNG:
1930             vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1931             vs->vnc_encoding = enc;
1932             break;
1933 #endif
1934         case VNC_ENCODING_ZLIB:
1935             vs->features |= VNC_FEATURE_ZLIB_MASK;
1936             vs->vnc_encoding = enc;
1937             break;
1938         case VNC_ENCODING_ZRLE:
1939             vs->features |= VNC_FEATURE_ZRLE_MASK;
1940             vs->vnc_encoding = enc;
1941             break;
1942         case VNC_ENCODING_ZYWRLE:
1943             vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1944             vs->vnc_encoding = enc;
1945             break;
1946         case VNC_ENCODING_DESKTOPRESIZE:
1947             vs->features |= VNC_FEATURE_RESIZE_MASK;
1948             break;
1949         case VNC_ENCODING_POINTER_TYPE_CHANGE:
1950             vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1951             break;
1952         case VNC_ENCODING_RICH_CURSOR:
1953             vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1954             break;
1955         case VNC_ENCODING_EXT_KEY_EVENT:
1956             send_ext_key_event_ack(vs);
1957             break;
1958         case VNC_ENCODING_AUDIO:
1959             send_ext_audio_ack(vs);
1960             break;
1961         case VNC_ENCODING_WMVi:
1962             vs->features |= VNC_FEATURE_WMVI_MASK;
1963             break;
1964         case VNC_ENCODING_LED_STATE:
1965             vs->features |= VNC_FEATURE_LED_STATE_MASK;
1966             break;
1967         case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1968             vs->tight.compression = (enc & 0x0F);
1969             break;
1970         case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1971             if (vs->vd->lossy) {
1972                 vs->tight.quality = (enc & 0x0F);
1973             }
1974             break;
1975         default:
1976             VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1977             break;
1978         }
1979     }
1980     vnc_desktop_resize(vs);
1981     check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
1982     vnc_led_state_change(vs);
1983 }
1984 
1985 static void set_pixel_conversion(VncState *vs)
1986 {
1987     pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
1988 
1989     if (fmt == VNC_SERVER_FB_FORMAT) {
1990         vs->write_pixels = vnc_write_pixels_copy;
1991         vnc_hextile_set_pixel_conversion(vs, 0);
1992     } else {
1993         vs->write_pixels = vnc_write_pixels_generic;
1994         vnc_hextile_set_pixel_conversion(vs, 1);
1995     }
1996 }
1997 
1998 static void set_pixel_format(VncState *vs,
1999                              int bits_per_pixel, int depth,
2000                              int big_endian_flag, int true_color_flag,
2001                              int red_max, int green_max, int blue_max,
2002                              int red_shift, int green_shift, int blue_shift)
2003 {
2004     if (!true_color_flag) {
2005         vnc_client_error(vs);
2006         return;
2007     }
2008 
2009     vs->client_pf.rmax = red_max;
2010     vs->client_pf.rbits = hweight_long(red_max);
2011     vs->client_pf.rshift = red_shift;
2012     vs->client_pf.rmask = red_max << red_shift;
2013     vs->client_pf.gmax = green_max;
2014     vs->client_pf.gbits = hweight_long(green_max);
2015     vs->client_pf.gshift = green_shift;
2016     vs->client_pf.gmask = green_max << green_shift;
2017     vs->client_pf.bmax = blue_max;
2018     vs->client_pf.bbits = hweight_long(blue_max);
2019     vs->client_pf.bshift = blue_shift;
2020     vs->client_pf.bmask = blue_max << blue_shift;
2021     vs->client_pf.bits_per_pixel = bits_per_pixel;
2022     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2023     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2024     vs->client_be = big_endian_flag;
2025 
2026     set_pixel_conversion(vs);
2027 
2028     graphic_hw_invalidate(NULL);
2029     graphic_hw_update(NULL);
2030 }
2031 
2032 static void pixel_format_message (VncState *vs) {
2033     char pad[3] = { 0, 0, 0 };
2034 
2035     vs->client_pf = qemu_default_pixelformat(32);
2036 
2037     vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2038     vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2039 
2040 #ifdef HOST_WORDS_BIGENDIAN
2041     vnc_write_u8(vs, 1);             /* big-endian-flag */
2042 #else
2043     vnc_write_u8(vs, 0);             /* big-endian-flag */
2044 #endif
2045     vnc_write_u8(vs, 1);             /* true-color-flag */
2046     vnc_write_u16(vs, vs->client_pf.rmax);     /* red-max */
2047     vnc_write_u16(vs, vs->client_pf.gmax);     /* green-max */
2048     vnc_write_u16(vs, vs->client_pf.bmax);     /* blue-max */
2049     vnc_write_u8(vs, vs->client_pf.rshift);    /* red-shift */
2050     vnc_write_u8(vs, vs->client_pf.gshift);    /* green-shift */
2051     vnc_write_u8(vs, vs->client_pf.bshift);    /* blue-shift */
2052     vnc_write(vs, pad, 3);           /* padding */
2053 
2054     vnc_hextile_set_pixel_conversion(vs, 0);
2055     vs->write_pixels = vnc_write_pixels_copy;
2056 }
2057 
2058 static void vnc_colordepth(VncState *vs)
2059 {
2060     if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2061         /* Sending a WMVi message to notify the client*/
2062         vnc_lock_output(vs);
2063         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2064         vnc_write_u8(vs, 0);
2065         vnc_write_u16(vs, 1); /* number of rects */
2066         vnc_framebuffer_update(vs, 0, 0,
2067                                surface_width(vs->vd->ds),
2068                                surface_height(vs->vd->ds),
2069                                VNC_ENCODING_WMVi);
2070         pixel_format_message(vs);
2071         vnc_unlock_output(vs);
2072         vnc_flush(vs);
2073     } else {
2074         set_pixel_conversion(vs);
2075     }
2076 }
2077 
2078 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2079 {
2080     int i;
2081     uint16_t limit;
2082     VncDisplay *vd = vs->vd;
2083 
2084     if (data[0] > 3) {
2085         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2086     }
2087 
2088     switch (data[0]) {
2089     case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2090         if (len == 1)
2091             return 20;
2092 
2093         set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
2094                          read_u8(data, 6), read_u8(data, 7),
2095                          read_u16(data, 8), read_u16(data, 10),
2096                          read_u16(data, 12), read_u8(data, 14),
2097                          read_u8(data, 15), read_u8(data, 16));
2098         break;
2099     case VNC_MSG_CLIENT_SET_ENCODINGS:
2100         if (len == 1)
2101             return 4;
2102 
2103         if (len == 4) {
2104             limit = read_u16(data, 2);
2105             if (limit > 0)
2106                 return 4 + (limit * 4);
2107         } else
2108             limit = read_u16(data, 2);
2109 
2110         for (i = 0; i < limit; i++) {
2111             int32_t val = read_s32(data, 4 + (i * 4));
2112             memcpy(data + 4 + (i * 4), &val, sizeof(val));
2113         }
2114 
2115         set_encodings(vs, (int32_t *)(data + 4), limit);
2116         break;
2117     case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2118         if (len == 1)
2119             return 10;
2120 
2121         framebuffer_update_request(vs,
2122                                    read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2123                                    read_u16(data, 6), read_u16(data, 8));
2124         break;
2125     case VNC_MSG_CLIENT_KEY_EVENT:
2126         if (len == 1)
2127             return 8;
2128 
2129         key_event(vs, read_u8(data, 1), read_u32(data, 4));
2130         break;
2131     case VNC_MSG_CLIENT_POINTER_EVENT:
2132         if (len == 1)
2133             return 6;
2134 
2135         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2136         break;
2137     case VNC_MSG_CLIENT_CUT_TEXT:
2138         if (len == 1)
2139             return 8;
2140 
2141         if (len == 8) {
2142             uint32_t dlen = read_u32(data, 4);
2143             if (dlen > 0)
2144                 return 8 + dlen;
2145         }
2146 
2147         client_cut_text(vs, read_u32(data, 4), data + 8);
2148         break;
2149     case VNC_MSG_CLIENT_QEMU:
2150         if (len == 1)
2151             return 2;
2152 
2153         switch (read_u8(data, 1)) {
2154         case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2155             if (len == 2)
2156                 return 12;
2157 
2158             ext_key_event(vs, read_u16(data, 2),
2159                           read_u32(data, 4), read_u32(data, 8));
2160             break;
2161         case VNC_MSG_CLIENT_QEMU_AUDIO:
2162             if (len == 2)
2163                 return 4;
2164 
2165             switch (read_u16 (data, 2)) {
2166             case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2167                 audio_add(vs);
2168                 break;
2169             case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2170                 audio_del(vs);
2171                 break;
2172             case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2173                 if (len == 4)
2174                     return 10;
2175                 switch (read_u8(data, 4)) {
2176                 case 0: vs->as.fmt = AUD_FMT_U8; break;
2177                 case 1: vs->as.fmt = AUD_FMT_S8; break;
2178                 case 2: vs->as.fmt = AUD_FMT_U16; break;
2179                 case 3: vs->as.fmt = AUD_FMT_S16; break;
2180                 case 4: vs->as.fmt = AUD_FMT_U32; break;
2181                 case 5: vs->as.fmt = AUD_FMT_S32; break;
2182                 default:
2183                     printf("Invalid audio format %d\n", read_u8(data, 4));
2184                     vnc_client_error(vs);
2185                     break;
2186                 }
2187                 vs->as.nchannels = read_u8(data, 5);
2188                 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2189                     printf("Invalid audio channel coount %d\n",
2190                            read_u8(data, 5));
2191                     vnc_client_error(vs);
2192                     break;
2193                 }
2194                 vs->as.freq = read_u32(data, 6);
2195                 break;
2196             default:
2197                 printf ("Invalid audio message %d\n", read_u8(data, 4));
2198                 vnc_client_error(vs);
2199                 break;
2200             }
2201             break;
2202 
2203         default:
2204             printf("Msg: %d\n", read_u16(data, 0));
2205             vnc_client_error(vs);
2206             break;
2207         }
2208         break;
2209     default:
2210         printf("Msg: %d\n", data[0]);
2211         vnc_client_error(vs);
2212         break;
2213     }
2214 
2215     vnc_read_when(vs, protocol_client_msg, 1);
2216     return 0;
2217 }
2218 
2219 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2220 {
2221     char buf[1024];
2222     VncShareMode mode;
2223     int size;
2224 
2225     mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2226     switch (vs->vd->share_policy) {
2227     case VNC_SHARE_POLICY_IGNORE:
2228         /*
2229          * Ignore the shared flag.  Nothing to do here.
2230          *
2231          * Doesn't conform to the rfb spec but is traditional qemu
2232          * behavior, thus left here as option for compatibility
2233          * reasons.
2234          */
2235         break;
2236     case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2237         /*
2238          * Policy: Allow clients ask for exclusive access.
2239          *
2240          * Implementation: When a client asks for exclusive access,
2241          * disconnect all others. Shared connects are allowed as long
2242          * as no exclusive connection exists.
2243          *
2244          * This is how the rfb spec suggests to handle the shared flag.
2245          */
2246         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2247             VncState *client;
2248             QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2249                 if (vs == client) {
2250                     continue;
2251                 }
2252                 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2253                     client->share_mode != VNC_SHARE_MODE_SHARED) {
2254                     continue;
2255                 }
2256                 vnc_disconnect_start(client);
2257             }
2258         }
2259         if (mode == VNC_SHARE_MODE_SHARED) {
2260             if (vs->vd->num_exclusive > 0) {
2261                 vnc_disconnect_start(vs);
2262                 return 0;
2263             }
2264         }
2265         break;
2266     case VNC_SHARE_POLICY_FORCE_SHARED:
2267         /*
2268          * Policy: Shared connects only.
2269          * Implementation: Disallow clients asking for exclusive access.
2270          *
2271          * Useful for shared desktop sessions where you don't want
2272          * someone forgetting to say -shared when running the vnc
2273          * client disconnect everybody else.
2274          */
2275         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2276             vnc_disconnect_start(vs);
2277             return 0;
2278         }
2279         break;
2280     }
2281     vnc_set_share_mode(vs, mode);
2282 
2283     vs->client_width = surface_width(vs->vd->ds);
2284     vs->client_height = surface_height(vs->vd->ds);
2285     vnc_write_u16(vs, vs->client_width);
2286     vnc_write_u16(vs, vs->client_height);
2287 
2288     pixel_format_message(vs);
2289 
2290     if (qemu_name)
2291         size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2292     else
2293         size = snprintf(buf, sizeof(buf), "QEMU");
2294 
2295     vnc_write_u32(vs, size);
2296     vnc_write(vs, buf, size);
2297     vnc_flush(vs);
2298 
2299     vnc_client_cache_auth(vs);
2300     vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2301 
2302     vnc_read_when(vs, protocol_client_msg, 1);
2303 
2304     return 0;
2305 }
2306 
2307 void start_client_init(VncState *vs)
2308 {
2309     vnc_read_when(vs, protocol_client_init, 1);
2310 }
2311 
2312 static void make_challenge(VncState *vs)
2313 {
2314     int i;
2315 
2316     srand(time(NULL)+getpid()+getpid()*987654+rand());
2317 
2318     for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2319         vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2320 }
2321 
2322 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2323 {
2324     unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2325     int i, j, pwlen;
2326     unsigned char key[8];
2327     time_t now = time(NULL);
2328 
2329     if (!vs->vd->password) {
2330         VNC_DEBUG("No password configured on server");
2331         goto reject;
2332     }
2333     if (vs->vd->expires < now) {
2334         VNC_DEBUG("Password is expired");
2335         goto reject;
2336     }
2337 
2338     memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2339 
2340     /* Calculate the expected challenge response */
2341     pwlen = strlen(vs->vd->password);
2342     for (i=0; i<sizeof(key); i++)
2343         key[i] = i<pwlen ? vs->vd->password[i] : 0;
2344     deskey(key, EN0);
2345     for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2346         des(response+j, response+j);
2347 
2348     /* Compare expected vs actual challenge response */
2349     if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2350         VNC_DEBUG("Client challenge response did not match\n");
2351         goto reject;
2352     } else {
2353         VNC_DEBUG("Accepting VNC challenge response\n");
2354         vnc_write_u32(vs, 0); /* Accept auth */
2355         vnc_flush(vs);
2356 
2357         start_client_init(vs);
2358     }
2359     return 0;
2360 
2361 reject:
2362     vnc_write_u32(vs, 1); /* Reject auth */
2363     if (vs->minor >= 8) {
2364         static const char err[] = "Authentication failed";
2365         vnc_write_u32(vs, sizeof(err));
2366         vnc_write(vs, err, sizeof(err));
2367     }
2368     vnc_flush(vs);
2369     vnc_client_error(vs);
2370     return 0;
2371 }
2372 
2373 void start_auth_vnc(VncState *vs)
2374 {
2375     make_challenge(vs);
2376     /* Send client a 'random' challenge */
2377     vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2378     vnc_flush(vs);
2379 
2380     vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2381 }
2382 
2383 
2384 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2385 {
2386     /* We only advertise 1 auth scheme at a time, so client
2387      * must pick the one we sent. Verify this */
2388     if (data[0] != vs->auth) { /* Reject auth */
2389        VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2390        vnc_write_u32(vs, 1);
2391        if (vs->minor >= 8) {
2392            static const char err[] = "Authentication failed";
2393            vnc_write_u32(vs, sizeof(err));
2394            vnc_write(vs, err, sizeof(err));
2395        }
2396        vnc_client_error(vs);
2397     } else { /* Accept requested auth */
2398        VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2399        switch (vs->auth) {
2400        case VNC_AUTH_NONE:
2401            VNC_DEBUG("Accept auth none\n");
2402            if (vs->minor >= 8) {
2403                vnc_write_u32(vs, 0); /* Accept auth completion */
2404                vnc_flush(vs);
2405            }
2406            start_client_init(vs);
2407            break;
2408 
2409        case VNC_AUTH_VNC:
2410            VNC_DEBUG("Start VNC auth\n");
2411            start_auth_vnc(vs);
2412            break;
2413 
2414 #ifdef CONFIG_VNC_TLS
2415        case VNC_AUTH_VENCRYPT:
2416            VNC_DEBUG("Accept VeNCrypt auth\n");
2417            start_auth_vencrypt(vs);
2418            break;
2419 #endif /* CONFIG_VNC_TLS */
2420 
2421 #ifdef CONFIG_VNC_SASL
2422        case VNC_AUTH_SASL:
2423            VNC_DEBUG("Accept SASL auth\n");
2424            start_auth_sasl(vs);
2425            break;
2426 #endif /* CONFIG_VNC_SASL */
2427 
2428        default: /* Should not be possible, but just in case */
2429            VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2430            vnc_write_u8(vs, 1);
2431            if (vs->minor >= 8) {
2432                static const char err[] = "Authentication failed";
2433                vnc_write_u32(vs, sizeof(err));
2434                vnc_write(vs, err, sizeof(err));
2435            }
2436            vnc_client_error(vs);
2437        }
2438     }
2439     return 0;
2440 }
2441 
2442 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2443 {
2444     char local[13];
2445 
2446     memcpy(local, version, 12);
2447     local[12] = 0;
2448 
2449     if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2450         VNC_DEBUG("Malformed protocol version %s\n", local);
2451         vnc_client_error(vs);
2452         return 0;
2453     }
2454     VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2455     if (vs->major != 3 ||
2456         (vs->minor != 3 &&
2457          vs->minor != 4 &&
2458          vs->minor != 5 &&
2459          vs->minor != 7 &&
2460          vs->minor != 8)) {
2461         VNC_DEBUG("Unsupported client version\n");
2462         vnc_write_u32(vs, VNC_AUTH_INVALID);
2463         vnc_flush(vs);
2464         vnc_client_error(vs);
2465         return 0;
2466     }
2467     /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2468      * as equivalent to v3.3 by servers
2469      */
2470     if (vs->minor == 4 || vs->minor == 5)
2471         vs->minor = 3;
2472 
2473     if (vs->minor == 3) {
2474         if (vs->auth == VNC_AUTH_NONE) {
2475             VNC_DEBUG("Tell client auth none\n");
2476             vnc_write_u32(vs, vs->auth);
2477             vnc_flush(vs);
2478             start_client_init(vs);
2479        } else if (vs->auth == VNC_AUTH_VNC) {
2480             VNC_DEBUG("Tell client VNC auth\n");
2481             vnc_write_u32(vs, vs->auth);
2482             vnc_flush(vs);
2483             start_auth_vnc(vs);
2484        } else {
2485             VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2486             vnc_write_u32(vs, VNC_AUTH_INVALID);
2487             vnc_flush(vs);
2488             vnc_client_error(vs);
2489        }
2490     } else {
2491         VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2492         vnc_write_u8(vs, 1); /* num auth */
2493         vnc_write_u8(vs, vs->auth);
2494         vnc_read_when(vs, protocol_client_auth, 1);
2495         vnc_flush(vs);
2496     }
2497 
2498     return 0;
2499 }
2500 
2501 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2502 {
2503     struct VncSurface *vs = &vd->guest;
2504 
2505     return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2506 }
2507 
2508 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2509 {
2510     int i, j;
2511 
2512     w = (x + w) / VNC_STAT_RECT;
2513     h = (y + h) / VNC_STAT_RECT;
2514     x /= VNC_STAT_RECT;
2515     y /= VNC_STAT_RECT;
2516 
2517     for (j = y; j <= h; j++) {
2518         for (i = x; i <= w; i++) {
2519             vs->lossy_rect[j][i] = 1;
2520         }
2521     }
2522 }
2523 
2524 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2525 {
2526     VncState *vs;
2527     int sty = y / VNC_STAT_RECT;
2528     int stx = x / VNC_STAT_RECT;
2529     int has_dirty = 0;
2530 
2531     y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2532     x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2533 
2534     QTAILQ_FOREACH(vs, &vd->clients, next) {
2535         int j;
2536 
2537         /* kernel send buffers are full -> refresh later */
2538         if (vs->output.offset) {
2539             continue;
2540         }
2541 
2542         if (!vs->lossy_rect[sty][stx]) {
2543             continue;
2544         }
2545 
2546         vs->lossy_rect[sty][stx] = 0;
2547         for (j = 0; j < VNC_STAT_RECT; ++j) {
2548             bitmap_set(vs->dirty[y + j],
2549                        x / VNC_DIRTY_PIXELS_PER_BIT,
2550                        VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2551         }
2552         has_dirty++;
2553     }
2554 
2555     return has_dirty;
2556 }
2557 
2558 static int vnc_update_stats(VncDisplay *vd,  struct timeval * tv)
2559 {
2560     int width = pixman_image_get_width(vd->guest.fb);
2561     int height = pixman_image_get_height(vd->guest.fb);
2562     int x, y;
2563     struct timeval res;
2564     int has_dirty = 0;
2565 
2566     for (y = 0; y < height; y += VNC_STAT_RECT) {
2567         for (x = 0; x < width; x += VNC_STAT_RECT) {
2568             VncRectStat *rect = vnc_stat_rect(vd, x, y);
2569 
2570             rect->updated = false;
2571         }
2572     }
2573 
2574     qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2575 
2576     if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2577         return has_dirty;
2578     }
2579     vd->guest.last_freq_check = *tv;
2580 
2581     for (y = 0; y < height; y += VNC_STAT_RECT) {
2582         for (x = 0; x < width; x += VNC_STAT_RECT) {
2583             VncRectStat *rect= vnc_stat_rect(vd, x, y);
2584             int count = ARRAY_SIZE(rect->times);
2585             struct timeval min, max;
2586 
2587             if (!timerisset(&rect->times[count - 1])) {
2588                 continue ;
2589             }
2590 
2591             max = rect->times[(rect->idx + count - 1) % count];
2592             qemu_timersub(tv, &max, &res);
2593 
2594             if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2595                 rect->freq = 0;
2596                 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2597                 memset(rect->times, 0, sizeof (rect->times));
2598                 continue ;
2599             }
2600 
2601             min = rect->times[rect->idx];
2602             max = rect->times[(rect->idx + count - 1) % count];
2603             qemu_timersub(&max, &min, &res);
2604 
2605             rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2606             rect->freq /= count;
2607             rect->freq = 1. / rect->freq;
2608         }
2609     }
2610     return has_dirty;
2611 }
2612 
2613 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2614 {
2615     int i, j;
2616     double total = 0;
2617     int num = 0;
2618 
2619     x =  (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2620     y =  (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2621 
2622     for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2623         for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2624             total += vnc_stat_rect(vs->vd, i, j)->freq;
2625             num++;
2626         }
2627     }
2628 
2629     if (num) {
2630         return total / num;
2631     } else {
2632         return 0;
2633     }
2634 }
2635 
2636 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2637 {
2638     VncRectStat *rect;
2639 
2640     rect = vnc_stat_rect(vd, x, y);
2641     if (rect->updated) {
2642         return ;
2643     }
2644     rect->times[rect->idx] = *tv;
2645     rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2646     rect->updated = true;
2647 }
2648 
2649 static int vnc_refresh_server_surface(VncDisplay *vd)
2650 {
2651     int width = pixman_image_get_width(vd->guest.fb);
2652     int height = pixman_image_get_height(vd->guest.fb);
2653     int y;
2654     uint8_t *guest_row0 = NULL, *server_row0;
2655     int guest_stride = 0, server_stride;
2656     int cmp_bytes;
2657     VncState *vs;
2658     int has_dirty = 0;
2659     pixman_image_t *tmpbuf = NULL;
2660 
2661     struct timeval tv = { 0, 0 };
2662 
2663     if (!vd->non_adaptive) {
2664         gettimeofday(&tv, NULL);
2665         has_dirty = vnc_update_stats(vd, &tv);
2666     }
2667 
2668     /*
2669      * Walk through the guest dirty map.
2670      * Check and copy modified bits from guest to server surface.
2671      * Update server dirty map.
2672      */
2673     cmp_bytes = VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES;
2674     if (cmp_bytes > vnc_server_fb_stride(vd)) {
2675         cmp_bytes = vnc_server_fb_stride(vd);
2676     }
2677     if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2678         int width = pixman_image_get_width(vd->server);
2679         tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2680     } else {
2681         guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2682         guest_stride = pixman_image_get_stride(vd->guest.fb);
2683     }
2684     server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2685     server_stride = pixman_image_get_stride(vd->server);
2686 
2687     y = 0;
2688     for (;;) {
2689         int x;
2690         uint8_t *guest_ptr, *server_ptr;
2691         unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2692                                              height * VNC_DIRTY_BPL(&vd->guest),
2693                                              y * VNC_DIRTY_BPL(&vd->guest));
2694         if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2695             /* no more dirty bits */
2696             break;
2697         }
2698         y = offset / VNC_DIRTY_BPL(&vd->guest);
2699         x = offset % VNC_DIRTY_BPL(&vd->guest);
2700 
2701         server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2702 
2703         if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2704             qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2705             guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2706         } else {
2707             guest_ptr = guest_row0 + y * guest_stride;
2708         }
2709         guest_ptr += x * cmp_bytes;
2710 
2711         for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2712              x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2713             if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2714                 continue;
2715             }
2716             if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0) {
2717                 continue;
2718             }
2719             memcpy(server_ptr, guest_ptr, cmp_bytes);
2720             if (!vd->non_adaptive) {
2721                 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2722                                  y, &tv);
2723             }
2724             QTAILQ_FOREACH(vs, &vd->clients, next) {
2725                 set_bit(x, vs->dirty[y]);
2726             }
2727             has_dirty++;
2728         }
2729 
2730         y++;
2731     }
2732     qemu_pixman_image_unref(tmpbuf);
2733     return has_dirty;
2734 }
2735 
2736 static void vnc_refresh(DisplayChangeListener *dcl)
2737 {
2738     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2739     VncState *vs, *vn;
2740     int has_dirty, rects = 0;
2741 
2742     graphic_hw_update(NULL);
2743 
2744     if (vnc_trylock_display(vd)) {
2745         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2746         return;
2747     }
2748 
2749     has_dirty = vnc_refresh_server_surface(vd);
2750     vnc_unlock_display(vd);
2751 
2752     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2753         rects += vnc_update_client(vs, has_dirty, false);
2754         /* vs might be free()ed here */
2755     }
2756 
2757     if (QTAILQ_EMPTY(&vd->clients)) {
2758         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2759         return;
2760     }
2761 
2762     if (has_dirty && rects) {
2763         vd->dcl.update_interval /= 2;
2764         if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2765             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2766         }
2767     } else {
2768         vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2769         if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2770             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2771         }
2772     }
2773 }
2774 
2775 static void vnc_connect(VncDisplay *vd, int csock,
2776                         bool skipauth, bool websocket)
2777 {
2778     VncState *vs = g_malloc0(sizeof(VncState));
2779     int i;
2780 
2781     vs->csock = csock;
2782 
2783     if (skipauth) {
2784 	vs->auth = VNC_AUTH_NONE;
2785 #ifdef CONFIG_VNC_TLS
2786 	vs->subauth = VNC_AUTH_INVALID;
2787 #endif
2788     } else {
2789 	vs->auth = vd->auth;
2790 #ifdef CONFIG_VNC_TLS
2791 	vs->subauth = vd->subauth;
2792 #endif
2793     }
2794 
2795     vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2796     for (i = 0; i < VNC_STAT_ROWS; ++i) {
2797         vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t));
2798     }
2799 
2800     VNC_DEBUG("New client on socket %d\n", csock);
2801     update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2802     qemu_set_nonblock(vs->csock);
2803 #ifdef CONFIG_VNC_WS
2804     if (websocket) {
2805         vs->websocket = 1;
2806 #ifdef CONFIG_VNC_TLS
2807         if (vd->tls.x509cert) {
2808             qemu_set_fd_handler2(vs->csock, NULL, vncws_tls_handshake_peek,
2809                                  NULL, vs);
2810         } else
2811 #endif /* CONFIG_VNC_TLS */
2812         {
2813             qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read,
2814                                  NULL, vs);
2815         }
2816     } else
2817 #endif /* CONFIG_VNC_WS */
2818     {
2819         qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2820     }
2821 
2822     vnc_client_cache_addr(vs);
2823     vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2824     vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2825 
2826     vs->vd = vd;
2827 
2828 #ifdef CONFIG_VNC_WS
2829     if (!vs->websocket)
2830 #endif
2831     {
2832         vnc_init_state(vs);
2833     }
2834 }
2835 
2836 void vnc_init_state(VncState *vs)
2837 {
2838     vs->initialized = true;
2839     VncDisplay *vd = vs->vd;
2840 
2841     vs->last_x = -1;
2842     vs->last_y = -1;
2843 
2844     vs->as.freq = 44100;
2845     vs->as.nchannels = 2;
2846     vs->as.fmt = AUD_FMT_S16;
2847     vs->as.endianness = 0;
2848 
2849     qemu_mutex_init(&vs->output_mutex);
2850     vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2851 
2852     QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2853 
2854     graphic_hw_update(NULL);
2855 
2856     vnc_write(vs, "RFB 003.008\n", 12);
2857     vnc_flush(vs);
2858     vnc_read_when(vs, protocol_version, 12);
2859     reset_keys(vs);
2860     if (vs->vd->lock_key_sync)
2861         vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2862 
2863     vs->mouse_mode_notifier.notify = check_pointer_type_change;
2864     qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2865 
2866     /* vs might be free()ed here */
2867 }
2868 
2869 static void vnc_listen_read(void *opaque, bool websocket)
2870 {
2871     VncDisplay *vs = opaque;
2872     struct sockaddr_in addr;
2873     socklen_t addrlen = sizeof(addr);
2874     int csock;
2875 
2876     /* Catch-up */
2877     graphic_hw_update(NULL);
2878 #ifdef CONFIG_VNC_WS
2879     if (websocket) {
2880         csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen);
2881     } else
2882 #endif /* CONFIG_VNC_WS */
2883     {
2884         csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2885     }
2886 
2887     if (csock != -1) {
2888         vnc_connect(vs, csock, false, websocket);
2889     }
2890 }
2891 
2892 static void vnc_listen_regular_read(void *opaque)
2893 {
2894     vnc_listen_read(opaque, false);
2895 }
2896 
2897 #ifdef CONFIG_VNC_WS
2898 static void vnc_listen_websocket_read(void *opaque)
2899 {
2900     vnc_listen_read(opaque, true);
2901 }
2902 #endif /* CONFIG_VNC_WS */
2903 
2904 static const DisplayChangeListenerOps dcl_ops = {
2905     .dpy_name          = "vnc",
2906     .dpy_refresh       = vnc_refresh,
2907     .dpy_gfx_copy      = vnc_dpy_copy,
2908     .dpy_gfx_update    = vnc_dpy_update,
2909     .dpy_gfx_switch    = vnc_dpy_switch,
2910     .dpy_mouse_set     = vnc_mouse_set,
2911     .dpy_cursor_define = vnc_dpy_cursor_define,
2912 };
2913 
2914 void vnc_display_init(DisplayState *ds)
2915 {
2916     VncDisplay *vs = g_malloc0(sizeof(*vs));
2917 
2918     vnc_display = vs;
2919 
2920     vs->lsock = -1;
2921 #ifdef CONFIG_VNC_WS
2922     vs->lwebsock = -1;
2923 #endif
2924 
2925     QTAILQ_INIT(&vs->clients);
2926     vs->expires = TIME_MAX;
2927 
2928     if (keyboard_layout)
2929         vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2930     else
2931         vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2932 
2933     if (!vs->kbd_layout)
2934         exit(1);
2935 
2936     qemu_mutex_init(&vs->mutex);
2937     vnc_start_worker_thread();
2938 
2939     vs->dcl.ops = &dcl_ops;
2940     register_displaychangelistener(&vs->dcl);
2941 }
2942 
2943 
2944 static void vnc_display_close(DisplayState *ds)
2945 {
2946     VncDisplay *vs = vnc_display;
2947 
2948     if (!vs)
2949         return;
2950     if (vs->display) {
2951         g_free(vs->display);
2952         vs->display = NULL;
2953     }
2954     if (vs->lsock != -1) {
2955         qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2956         close(vs->lsock);
2957         vs->lsock = -1;
2958     }
2959 #ifdef CONFIG_VNC_WS
2960     g_free(vs->ws_display);
2961     vs->ws_display = NULL;
2962     if (vs->lwebsock != -1) {
2963         qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);
2964         close(vs->lwebsock);
2965         vs->lwebsock = -1;
2966     }
2967 #endif /* CONFIG_VNC_WS */
2968     vs->auth = VNC_AUTH_INVALID;
2969 #ifdef CONFIG_VNC_TLS
2970     vs->subauth = VNC_AUTH_INVALID;
2971     vs->tls.x509verify = 0;
2972 #endif
2973 }
2974 
2975 static int vnc_display_disable_login(DisplayState *ds)
2976 {
2977     VncDisplay *vs = vnc_display;
2978 
2979     if (!vs) {
2980         return -1;
2981     }
2982 
2983     if (vs->password) {
2984         g_free(vs->password);
2985     }
2986 
2987     vs->password = NULL;
2988     if (vs->auth == VNC_AUTH_NONE) {
2989         vs->auth = VNC_AUTH_VNC;
2990     }
2991 
2992     return 0;
2993 }
2994 
2995 int vnc_display_password(DisplayState *ds, const char *password)
2996 {
2997     VncDisplay *vs = vnc_display;
2998 
2999     if (!vs) {
3000         return -EINVAL;
3001     }
3002 
3003     if (!password) {
3004         /* This is not the intention of this interface but err on the side
3005            of being safe */
3006         return vnc_display_disable_login(ds);
3007     }
3008 
3009     if (vs->password) {
3010         g_free(vs->password);
3011         vs->password = NULL;
3012     }
3013     vs->password = g_strdup(password);
3014     if (vs->auth == VNC_AUTH_NONE) {
3015         vs->auth = VNC_AUTH_VNC;
3016     }
3017 
3018     return 0;
3019 }
3020 
3021 int vnc_display_pw_expire(DisplayState *ds, time_t expires)
3022 {
3023     VncDisplay *vs = vnc_display;
3024 
3025     if (!vs) {
3026         return -EINVAL;
3027     }
3028 
3029     vs->expires = expires;
3030     return 0;
3031 }
3032 
3033 char *vnc_display_local_addr(DisplayState *ds)
3034 {
3035     VncDisplay *vs = vnc_display;
3036 
3037     return vnc_socket_local_addr("%s:%s", vs->lsock);
3038 }
3039 
3040 void vnc_display_open(DisplayState *ds, const char *display, Error **errp)
3041 {
3042     VncDisplay *vs = vnc_display;
3043     const char *options;
3044     int password = 0;
3045     int reverse = 0;
3046 #ifdef CONFIG_VNC_TLS
3047     int tls = 0, x509 = 0;
3048 #endif
3049 #ifdef CONFIG_VNC_SASL
3050     int sasl = 0;
3051     int saslErr;
3052 #endif
3053 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
3054     int acl = 0;
3055 #endif
3056     int lock_key_sync = 1;
3057 
3058     if (!vnc_display) {
3059         error_setg(errp, "VNC display not active");
3060         return;
3061     }
3062     vnc_display_close(ds);
3063     if (strcmp(display, "none") == 0)
3064         return;
3065 
3066     vs->display = g_strdup(display);
3067     vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3068 
3069     options = display;
3070     while ((options = strchr(options, ','))) {
3071         options++;
3072         if (strncmp(options, "password", 8) == 0) {
3073             if (fips_get_state()) {
3074                 error_setg(errp,
3075                            "VNC password auth disabled due to FIPS mode, "
3076                            "consider using the VeNCrypt or SASL authentication "
3077                            "methods as an alternative");
3078                 goto fail;
3079             }
3080             password = 1; /* Require password auth */
3081         } else if (strncmp(options, "reverse", 7) == 0) {
3082             reverse = 1;
3083         } else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
3084             lock_key_sync = 0;
3085 #ifdef CONFIG_VNC_SASL
3086         } else if (strncmp(options, "sasl", 4) == 0) {
3087             sasl = 1; /* Require SASL auth */
3088 #endif
3089 #ifdef CONFIG_VNC_WS
3090         } else if (strncmp(options, "websocket", 9) == 0) {
3091             char *start, *end;
3092             vs->websocket = 1;
3093 
3094             /* Check for 'websocket=<port>' */
3095             start = strchr(options, '=');
3096             end = strchr(options, ',');
3097             if (start && (!end || (start < end))) {
3098                 int len = end ? end-(start+1) : strlen(start+1);
3099                 if (len < 6) {
3100                     /* extract the host specification from display */
3101                     char  *host = NULL, *port = NULL, *host_end = NULL;
3102                     port = g_strndup(start + 1, len);
3103 
3104                     /* ipv6 hosts have colons */
3105                     end = strchr(display, ',');
3106                     host_end = g_strrstr_len(display, end - display, ":");
3107 
3108                     if (host_end) {
3109                         host = g_strndup(display, host_end - display + 1);
3110                     } else {
3111                         host = g_strndup(":", 1);
3112                     }
3113                     vs->ws_display = g_strconcat(host, port, NULL);
3114                     g_free(host);
3115                     g_free(port);
3116                 }
3117             }
3118 #endif /* CONFIG_VNC_WS */
3119 #ifdef CONFIG_VNC_TLS
3120         } else if (strncmp(options, "tls", 3) == 0) {
3121             tls = 1; /* Require TLS */
3122         } else if (strncmp(options, "x509", 4) == 0) {
3123             char *start, *end;
3124             x509 = 1; /* Require x509 certificates */
3125             if (strncmp(options, "x509verify", 10) == 0)
3126                 vs->tls.x509verify = 1; /* ...and verify client certs */
3127 
3128             /* Now check for 'x509=/some/path' postfix
3129              * and use that to setup x509 certificate/key paths */
3130             start = strchr(options, '=');
3131             end = strchr(options, ',');
3132             if (start && (!end || (start < end))) {
3133                 int len = end ? end-(start+1) : strlen(start+1);
3134                 char *path = g_strndup(start + 1, len);
3135 
3136                 VNC_DEBUG("Trying certificate path '%s'\n", path);
3137                 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
3138                     error_setg(errp, "Failed to find x509 certificates/keys in %s", path);
3139                     g_free(path);
3140                     goto fail;
3141                 }
3142                 g_free(path);
3143             } else {
3144                 error_setg(errp, "No certificate path provided");
3145                 goto fail;
3146             }
3147 #endif
3148 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL)
3149         } else if (strncmp(options, "acl", 3) == 0) {
3150             acl = 1;
3151 #endif
3152         } else if (strncmp(options, "lossy", 5) == 0) {
3153 #ifdef CONFIG_VNC_JPEG
3154             vs->lossy = true;
3155 #endif
3156         } else if (strncmp(options, "non-adaptive", 12) == 0) {
3157             vs->non_adaptive = true;
3158         } else if (strncmp(options, "share=", 6) == 0) {
3159             if (strncmp(options+6, "ignore", 6) == 0) {
3160                 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
3161             } else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
3162                 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3163             } else if (strncmp(options+6, "force-shared", 12) == 0) {
3164                 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3165             } else {
3166                 error_setg(errp, "unknown vnc share= option");
3167                 goto fail;
3168             }
3169         }
3170     }
3171 
3172     /* adaptive updates are only used with tight encoding and
3173      * if lossy updates are enabled so we can disable all the
3174      * calculations otherwise */
3175     if (!vs->lossy) {
3176         vs->non_adaptive = true;
3177     }
3178 
3179 #ifdef CONFIG_VNC_TLS
3180     if (acl && x509 && vs->tls.x509verify) {
3181         if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
3182             fprintf(stderr, "Failed to create x509 dname ACL\n");
3183             exit(1);
3184         }
3185     }
3186 #endif
3187 #ifdef CONFIG_VNC_SASL
3188     if (acl && sasl) {
3189         if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
3190             fprintf(stderr, "Failed to create username ACL\n");
3191             exit(1);
3192         }
3193     }
3194 #endif
3195 
3196     /*
3197      * Combinations we support here:
3198      *
3199      *  - no-auth                (clear text, no auth)
3200      *  - password               (clear text, weak auth)
3201      *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
3202      *  - tls                    (encrypt, weak anonymous creds, no auth)
3203      *  - tls + password         (encrypt, weak anonymous creds, weak auth)
3204      *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
3205      *  - tls + x509             (encrypt, good x509 creds, no auth)
3206      *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
3207      *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
3208      *
3209      * NB1. TLS is a stackable auth scheme.
3210      * NB2. the x509 schemes have option to validate a client cert dname
3211      */
3212     if (password) {
3213 #ifdef CONFIG_VNC_TLS
3214         if (tls) {
3215             vs->auth = VNC_AUTH_VENCRYPT;
3216             if (x509) {
3217                 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3218                 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3219             } else {
3220                 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3221                 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3222             }
3223         } else {
3224 #endif /* CONFIG_VNC_TLS */
3225             VNC_DEBUG("Initializing VNC server with password auth\n");
3226             vs->auth = VNC_AUTH_VNC;
3227 #ifdef CONFIG_VNC_TLS
3228             vs->subauth = VNC_AUTH_INVALID;
3229         }
3230 #endif /* CONFIG_VNC_TLS */
3231 #ifdef CONFIG_VNC_SASL
3232     } else if (sasl) {
3233 #ifdef CONFIG_VNC_TLS
3234         if (tls) {
3235             vs->auth = VNC_AUTH_VENCRYPT;
3236             if (x509) {
3237                 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3238                 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3239             } else {
3240                 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3241                 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3242             }
3243         } else {
3244 #endif /* CONFIG_VNC_TLS */
3245             VNC_DEBUG("Initializing VNC server with SASL auth\n");
3246             vs->auth = VNC_AUTH_SASL;
3247 #ifdef CONFIG_VNC_TLS
3248             vs->subauth = VNC_AUTH_INVALID;
3249         }
3250 #endif /* CONFIG_VNC_TLS */
3251 #endif /* CONFIG_VNC_SASL */
3252     } else {
3253 #ifdef CONFIG_VNC_TLS
3254         if (tls) {
3255             vs->auth = VNC_AUTH_VENCRYPT;
3256             if (x509) {
3257                 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3258                 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3259             } else {
3260                 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3261                 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3262             }
3263         } else {
3264 #endif
3265             VNC_DEBUG("Initializing VNC server with no auth\n");
3266             vs->auth = VNC_AUTH_NONE;
3267 #ifdef CONFIG_VNC_TLS
3268             vs->subauth = VNC_AUTH_INVALID;
3269         }
3270 #endif
3271     }
3272 
3273 #ifdef CONFIG_VNC_SASL
3274     if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3275         error_setg(errp, "Failed to initialize SASL auth: %s",
3276                    sasl_errstring(saslErr, NULL, NULL));
3277         goto fail;
3278     }
3279 #endif
3280     vs->lock_key_sync = lock_key_sync;
3281 
3282     if (reverse) {
3283         /* connect to viewer */
3284         int csock;
3285         vs->lsock = -1;
3286 #ifdef CONFIG_VNC_WS
3287         vs->lwebsock = -1;
3288 #endif
3289         if (strncmp(display, "unix:", 5) == 0) {
3290             csock = unix_connect(display+5, errp);
3291         } else {
3292             csock = inet_connect(display, errp);
3293         }
3294         if (csock < 0) {
3295             goto fail;
3296         }
3297         vnc_connect(vs, csock, false, false);
3298     } else {
3299         /* listen for connects */
3300         char *dpy;
3301         dpy = g_malloc(256);
3302         if (strncmp(display, "unix:", 5) == 0) {
3303             pstrcpy(dpy, 256, "unix:");
3304             vs->lsock = unix_listen(display+5, dpy+5, 256-5, errp);
3305         } else {
3306             vs->lsock = inet_listen(display, dpy, 256,
3307                                     SOCK_STREAM, 5900, errp);
3308             if (vs->lsock < 0) {
3309                 g_free(dpy);
3310                 goto fail;
3311             }
3312 #ifdef CONFIG_VNC_WS
3313             if (vs->websocket) {
3314                 if (vs->ws_display) {
3315                     vs->lwebsock = inet_listen(vs->ws_display, NULL, 256,
3316                         SOCK_STREAM, 0, errp);
3317                 } else {
3318                     vs->lwebsock = inet_listen(vs->display, NULL, 256,
3319                         SOCK_STREAM, 5700, errp);
3320                 }
3321 
3322                 if (vs->lwebsock < 0) {
3323                     if (vs->lsock) {
3324                         close(vs->lsock);
3325                         vs->lsock = -1;
3326                     }
3327                     g_free(dpy);
3328                     goto fail;
3329                 }
3330             }
3331 #endif /* CONFIG_VNC_WS */
3332         }
3333         g_free(vs->display);
3334         vs->display = dpy;
3335         qemu_set_fd_handler2(vs->lsock, NULL,
3336                 vnc_listen_regular_read, NULL, vs);
3337 #ifdef CONFIG_VNC_WS
3338         if (vs->websocket) {
3339             qemu_set_fd_handler2(vs->lwebsock, NULL,
3340                     vnc_listen_websocket_read, NULL, vs);
3341         }
3342 #endif /* CONFIG_VNC_WS */
3343     }
3344     return;
3345 
3346 fail:
3347     g_free(vs->display);
3348     vs->display = NULL;
3349 #ifdef CONFIG_VNC_WS
3350     g_free(vs->ws_display);
3351     vs->ws_display = NULL;
3352 #endif /* CONFIG_VNC_WS */
3353 }
3354 
3355 void vnc_display_add_client(DisplayState *ds, int csock, bool skipauth)
3356 {
3357     VncDisplay *vs = vnc_display;
3358 
3359     vnc_connect(vs, csock, skipauth, false);
3360 }
3361