xref: /openbmc/qemu/ui/vnc.c (revision 795c40b8)
1 /*
2  * QEMU VNC display driver
3  *
4  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5  * Copyright (C) 2006 Fabrice Bellard
6  * Copyright (C) 2009 Red Hat, Inc
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "hw/qdev.h"
32 #include "sysemu/sysemu.h"
33 #include "qemu/error-report.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qmp/qerror.h"
39 #include "qapi/qmp/types.h"
40 #include "qmp-commands.h"
41 #include "ui/input.h"
42 #include "qapi-event.h"
43 #include "crypto/hash.h"
44 #include "crypto/tlscredsanon.h"
45 #include "crypto/tlscredsx509.h"
46 #include "qom/object_interfaces.h"
47 #include "qemu/cutils.h"
48 #include "io/dns-resolver.h"
49 
50 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
51 #define VNC_REFRESH_INTERVAL_INC  50
52 #define VNC_REFRESH_INTERVAL_MAX  GUI_REFRESH_INTERVAL_IDLE
53 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
54 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
55 
56 #include "vnc_keysym.h"
57 #include "crypto/cipher.h"
58 
59 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
60     QTAILQ_HEAD_INITIALIZER(vnc_displays);
61 
62 static int vnc_cursor_define(VncState *vs);
63 static void vnc_release_modifiers(VncState *vs);
64 
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68     static const char *mn[] = {
69         [0]                           = "undefined",
70         [VNC_SHARE_MODE_CONNECTING]   = "connecting",
71         [VNC_SHARE_MODE_SHARED]       = "shared",
72         [VNC_SHARE_MODE_EXCLUSIVE]    = "exclusive",
73         [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74     };
75     fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76             vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78 
79     switch (vs->share_mode) {
80     case VNC_SHARE_MODE_CONNECTING:
81         vs->vd->num_connecting--;
82         break;
83     case VNC_SHARE_MODE_SHARED:
84         vs->vd->num_shared--;
85         break;
86     case VNC_SHARE_MODE_EXCLUSIVE:
87         vs->vd->num_exclusive--;
88         break;
89     default:
90         break;
91     }
92 
93     vs->share_mode = mode;
94 
95     switch (vs->share_mode) {
96     case VNC_SHARE_MODE_CONNECTING:
97         vs->vd->num_connecting++;
98         break;
99     case VNC_SHARE_MODE_SHARED:
100         vs->vd->num_shared++;
101         break;
102     case VNC_SHARE_MODE_EXCLUSIVE:
103         vs->vd->num_exclusive++;
104         break;
105     default:
106         break;
107     }
108 }
109 
110 
111 static void vnc_init_basic_info(SocketAddress *addr,
112                                 VncBasicInfo *info,
113                                 Error **errp)
114 {
115     switch (addr->type) {
116     case SOCKET_ADDRESS_TYPE_INET:
117         info->host = g_strdup(addr->u.inet.host);
118         info->service = g_strdup(addr->u.inet.port);
119         if (addr->u.inet.ipv6) {
120             info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121         } else {
122             info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123         }
124         break;
125 
126     case SOCKET_ADDRESS_TYPE_UNIX:
127         info->host = g_strdup("");
128         info->service = g_strdup(addr->u.q_unix.path);
129         info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130         break;
131 
132     case SOCKET_ADDRESS_TYPE_VSOCK:
133     case SOCKET_ADDRESS_TYPE_FD:
134         error_setg(errp, "Unsupported socket address type %s",
135                    SocketAddressType_lookup[addr->type]);
136         break;
137     default:
138         abort();
139     }
140 
141     return;
142 }
143 
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145                                                  VncBasicInfo *info,
146                                                  Error **errp)
147 {
148     SocketAddress *addr = NULL;
149 
150     if (!ioc) {
151         error_setg(errp, "No listener socket available");
152         return;
153     }
154 
155     addr = qio_channel_socket_get_local_address(ioc, errp);
156     if (!addr) {
157         return;
158     }
159 
160     vnc_init_basic_info(addr, info, errp);
161     qapi_free_SocketAddress(addr);
162 }
163 
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165                                                  VncBasicInfo *info,
166                                                  Error **errp)
167 {
168     SocketAddress *addr = NULL;
169 
170     addr = qio_channel_socket_get_remote_address(ioc, errp);
171     if (!addr) {
172         return;
173     }
174 
175     vnc_init_basic_info(addr, info, errp);
176     qapi_free_SocketAddress(addr);
177 }
178 
179 static const char *vnc_auth_name(VncDisplay *vd) {
180     switch (vd->auth) {
181     case VNC_AUTH_INVALID:
182         return "invalid";
183     case VNC_AUTH_NONE:
184         return "none";
185     case VNC_AUTH_VNC:
186         return "vnc";
187     case VNC_AUTH_RA2:
188         return "ra2";
189     case VNC_AUTH_RA2NE:
190         return "ra2ne";
191     case VNC_AUTH_TIGHT:
192         return "tight";
193     case VNC_AUTH_ULTRA:
194         return "ultra";
195     case VNC_AUTH_TLS:
196         return "tls";
197     case VNC_AUTH_VENCRYPT:
198         switch (vd->subauth) {
199         case VNC_AUTH_VENCRYPT_PLAIN:
200             return "vencrypt+plain";
201         case VNC_AUTH_VENCRYPT_TLSNONE:
202             return "vencrypt+tls+none";
203         case VNC_AUTH_VENCRYPT_TLSVNC:
204             return "vencrypt+tls+vnc";
205         case VNC_AUTH_VENCRYPT_TLSPLAIN:
206             return "vencrypt+tls+plain";
207         case VNC_AUTH_VENCRYPT_X509NONE:
208             return "vencrypt+x509+none";
209         case VNC_AUTH_VENCRYPT_X509VNC:
210             return "vencrypt+x509+vnc";
211         case VNC_AUTH_VENCRYPT_X509PLAIN:
212             return "vencrypt+x509+plain";
213         case VNC_AUTH_VENCRYPT_TLSSASL:
214             return "vencrypt+tls+sasl";
215         case VNC_AUTH_VENCRYPT_X509SASL:
216             return "vencrypt+x509+sasl";
217         default:
218             return "vencrypt";
219         }
220     case VNC_AUTH_SASL:
221         return "sasl";
222     }
223     return "unknown";
224 }
225 
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228     VncServerInfo *info;
229     Error *err = NULL;
230 
231     if (!vd->nlsock) {
232         return NULL;
233     }
234 
235     info = g_malloc0(sizeof(*info));
236     vnc_init_basic_info_from_server_addr(vd->lsock[0],
237                                          qapi_VncServerInfo_base(info), &err);
238     info->has_auth = true;
239     info->auth = g_strdup(vnc_auth_name(vd));
240     if (err) {
241         qapi_free_VncServerInfo(info);
242         info = NULL;
243         error_free(err);
244     }
245     return info;
246 }
247 
248 static void vnc_client_cache_auth(VncState *client)
249 {
250     if (!client->info) {
251         return;
252     }
253 
254     if (client->tls) {
255         client->info->x509_dname =
256             qcrypto_tls_session_get_peer_name(client->tls);
257         client->info->has_x509_dname =
258             client->info->x509_dname != NULL;
259     }
260 #ifdef CONFIG_VNC_SASL
261     if (client->sasl.conn &&
262         client->sasl.username) {
263         client->info->has_sasl_username = true;
264         client->info->sasl_username = g_strdup(client->sasl.username);
265     }
266 #endif
267 }
268 
269 static void vnc_client_cache_addr(VncState *client)
270 {
271     Error *err = NULL;
272 
273     client->info = g_malloc0(sizeof(*client->info));
274     vnc_init_basic_info_from_remote_addr(client->sioc,
275                                          qapi_VncClientInfo_base(client->info),
276                                          &err);
277     if (err) {
278         qapi_free_VncClientInfo(client->info);
279         client->info = NULL;
280         error_free(err);
281     }
282 }
283 
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286     VncServerInfo *si;
287 
288     if (!vs->info) {
289         return;
290     }
291 
292     si = vnc_server_info_get(vs->vd);
293     if (!si) {
294         return;
295     }
296 
297     switch (event) {
298     case QAPI_EVENT_VNC_CONNECTED:
299         qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300                                       &error_abort);
301         break;
302     case QAPI_EVENT_VNC_INITIALIZED:
303         qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304         break;
305     case QAPI_EVENT_VNC_DISCONNECTED:
306         qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307         break;
308     default:
309         break;
310     }
311 
312     qapi_free_VncServerInfo(si);
313 }
314 
315 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
316 {
317     VncClientInfo *info;
318     Error *err = NULL;
319 
320     info = g_malloc0(sizeof(*info));
321 
322     vnc_init_basic_info_from_remote_addr(client->sioc,
323                                          qapi_VncClientInfo_base(info),
324                                          &err);
325     if (err) {
326         error_free(err);
327         qapi_free_VncClientInfo(info);
328         return NULL;
329     }
330 
331     info->websocket = client->websocket;
332 
333     if (client->tls) {
334         info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335         info->has_x509_dname = info->x509_dname != NULL;
336     }
337 #ifdef CONFIG_VNC_SASL
338     if (client->sasl.conn && client->sasl.username) {
339         info->has_sasl_username = true;
340         info->sasl_username = g_strdup(client->sasl.username);
341     }
342 #endif
343 
344     return info;
345 }
346 
347 static VncDisplay *vnc_display_find(const char *id)
348 {
349     VncDisplay *vd;
350 
351     if (id == NULL) {
352         return QTAILQ_FIRST(&vnc_displays);
353     }
354     QTAILQ_FOREACH(vd, &vnc_displays, next) {
355         if (strcmp(id, vd->id) == 0) {
356             return vd;
357         }
358     }
359     return NULL;
360 }
361 
362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363 {
364     VncClientInfoList *cinfo, *prev = NULL;
365     VncState *client;
366 
367     QTAILQ_FOREACH(client, &vd->clients, next) {
368         cinfo = g_new0(VncClientInfoList, 1);
369         cinfo->value = qmp_query_vnc_client(client);
370         cinfo->next = prev;
371         prev = cinfo;
372     }
373     return prev;
374 }
375 
376 VncInfo *qmp_query_vnc(Error **errp)
377 {
378     VncInfo *info = g_malloc0(sizeof(*info));
379     VncDisplay *vd = vnc_display_find(NULL);
380     SocketAddress *addr = NULL;
381 
382     if (vd == NULL || !vd->nlsock) {
383         info->enabled = false;
384     } else {
385         info->enabled = true;
386 
387         /* for compatibility with the original command */
388         info->has_clients = true;
389         info->clients = qmp_query_client_list(vd);
390 
391         if (vd->lsock == NULL) {
392             return info;
393         }
394 
395         addr = qio_channel_socket_get_local_address(vd->lsock[0], errp);
396         if (!addr) {
397             goto out_error;
398         }
399 
400         switch (addr->type) {
401         case SOCKET_ADDRESS_TYPE_INET:
402             info->host = g_strdup(addr->u.inet.host);
403             info->service = g_strdup(addr->u.inet.port);
404             if (addr->u.inet.ipv6) {
405                 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
406             } else {
407                 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
408             }
409             break;
410 
411         case SOCKET_ADDRESS_TYPE_UNIX:
412             info->host = g_strdup("");
413             info->service = g_strdup(addr->u.q_unix.path);
414             info->family = NETWORK_ADDRESS_FAMILY_UNIX;
415             break;
416 
417         case SOCKET_ADDRESS_TYPE_VSOCK:
418         case SOCKET_ADDRESS_TYPE_FD:
419             error_setg(errp, "Unsupported socket address type %s",
420                        SocketAddressType_lookup[addr->type]);
421             goto out_error;
422         default:
423             abort();
424         }
425 
426         info->has_host = true;
427         info->has_service = true;
428         info->has_family = true;
429 
430         info->has_auth = true;
431         info->auth = g_strdup(vnc_auth_name(vd));
432     }
433 
434     qapi_free_SocketAddress(addr);
435     return info;
436 
437 out_error:
438     qapi_free_SocketAddress(addr);
439     qapi_free_VncInfo(info);
440     return NULL;
441 }
442 
443 
444 static void qmp_query_auth(int auth, int subauth,
445                            VncPrimaryAuth *qmp_auth,
446                            VncVencryptSubAuth *qmp_vencrypt,
447                            bool *qmp_has_vencrypt);
448 
449 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
450                                                   bool websocket,
451                                                   int auth,
452                                                   int subauth,
453                                                   VncServerInfo2List *prev)
454 {
455     VncServerInfo2List *list;
456     VncServerInfo2 *info;
457     Error *err = NULL;
458     SocketAddress *addr;
459 
460     addr = qio_channel_socket_get_local_address(ioc, &err);
461     if (!addr) {
462         error_free(err);
463         return prev;
464     }
465 
466     info = g_new0(VncServerInfo2, 1);
467     vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
468     qapi_free_SocketAddress(addr);
469     if (err) {
470         qapi_free_VncServerInfo2(info);
471         error_free(err);
472         return prev;
473     }
474     info->websocket = websocket;
475 
476     qmp_query_auth(auth, subauth, &info->auth,
477                    &info->vencrypt, &info->has_vencrypt);
478 
479     list = g_new0(VncServerInfo2List, 1);
480     list->value = info;
481     list->next = prev;
482     return list;
483 }
484 
485 static void qmp_query_auth(int auth, int subauth,
486                            VncPrimaryAuth *qmp_auth,
487                            VncVencryptSubAuth *qmp_vencrypt,
488                            bool *qmp_has_vencrypt)
489 {
490     switch (auth) {
491     case VNC_AUTH_VNC:
492         *qmp_auth = VNC_PRIMARY_AUTH_VNC;
493         break;
494     case VNC_AUTH_RA2:
495         *qmp_auth = VNC_PRIMARY_AUTH_RA2;
496         break;
497     case VNC_AUTH_RA2NE:
498         *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
499         break;
500     case VNC_AUTH_TIGHT:
501         *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
502         break;
503     case VNC_AUTH_ULTRA:
504         *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
505         break;
506     case VNC_AUTH_TLS:
507         *qmp_auth = VNC_PRIMARY_AUTH_TLS;
508         break;
509     case VNC_AUTH_VENCRYPT:
510         *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
511         *qmp_has_vencrypt = true;
512         switch (subauth) {
513         case VNC_AUTH_VENCRYPT_PLAIN:
514             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
515             break;
516         case VNC_AUTH_VENCRYPT_TLSNONE:
517             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
518             break;
519         case VNC_AUTH_VENCRYPT_TLSVNC:
520             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
521             break;
522         case VNC_AUTH_VENCRYPT_TLSPLAIN:
523             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
524             break;
525         case VNC_AUTH_VENCRYPT_X509NONE:
526             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
527             break;
528         case VNC_AUTH_VENCRYPT_X509VNC:
529             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
530             break;
531         case VNC_AUTH_VENCRYPT_X509PLAIN:
532             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
533             break;
534         case VNC_AUTH_VENCRYPT_TLSSASL:
535             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
536             break;
537         case VNC_AUTH_VENCRYPT_X509SASL:
538             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
539             break;
540         default:
541             *qmp_has_vencrypt = false;
542             break;
543         }
544         break;
545     case VNC_AUTH_SASL:
546         *qmp_auth = VNC_PRIMARY_AUTH_SASL;
547         break;
548     case VNC_AUTH_NONE:
549     default:
550         *qmp_auth = VNC_PRIMARY_AUTH_NONE;
551         break;
552     }
553 }
554 
555 VncInfo2List *qmp_query_vnc_servers(Error **errp)
556 {
557     VncInfo2List *item, *prev = NULL;
558     VncInfo2 *info;
559     VncDisplay *vd;
560     DeviceState *dev;
561     size_t i;
562 
563     QTAILQ_FOREACH(vd, &vnc_displays, next) {
564         info = g_new0(VncInfo2, 1);
565         info->id = g_strdup(vd->id);
566         info->clients = qmp_query_client_list(vd);
567         qmp_query_auth(vd->auth, vd->subauth, &info->auth,
568                        &info->vencrypt, &info->has_vencrypt);
569         if (vd->dcl.con) {
570             dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
571                                                   "device", NULL));
572             info->has_display = true;
573             info->display = g_strdup(dev->id);
574         }
575         for (i = 0; i < vd->nlsock; i++) {
576             info->server = qmp_query_server_entry(
577                 vd->lsock[i], false, vd->auth, vd->subauth, info->server);
578         }
579         for (i = 0; i < vd->nlwebsock; i++) {
580             info->server = qmp_query_server_entry(
581                 vd->lwebsock[i], true, vd->ws_auth,
582                 vd->ws_subauth, info->server);
583         }
584 
585         item = g_new0(VncInfo2List, 1);
586         item->value = info;
587         item->next = prev;
588         prev = item;
589     }
590     return prev;
591 }
592 
593 /* TODO
594    1) Get the queue working for IO.
595    2) there is some weirdness when using the -S option (the screen is grey
596       and not totally invalidated
597    3) resolutions > 1024
598 */
599 
600 static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
601 static void vnc_disconnect_start(VncState *vs);
602 
603 static void vnc_colordepth(VncState *vs);
604 static void framebuffer_update_request(VncState *vs, int incremental,
605                                        int x_position, int y_position,
606                                        int w, int h);
607 static void vnc_refresh(DisplayChangeListener *dcl);
608 static int vnc_refresh_server_surface(VncDisplay *vd);
609 
610 static int vnc_width(VncDisplay *vd)
611 {
612     return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
613                                        VNC_DIRTY_PIXELS_PER_BIT));
614 }
615 
616 static int vnc_height(VncDisplay *vd)
617 {
618     return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
619 }
620 
621 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
622                                VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
623                                VncDisplay *vd,
624                                int x, int y, int w, int h)
625 {
626     int width = vnc_width(vd);
627     int height = vnc_height(vd);
628 
629     /* this is needed this to ensure we updated all affected
630      * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
631     w += (x % VNC_DIRTY_PIXELS_PER_BIT);
632     x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
633 
634     x = MIN(x, width);
635     y = MIN(y, height);
636     w = MIN(x + w, width) - x;
637     h = MIN(y + h, height);
638 
639     for (; y < h; y++) {
640         bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
641                    DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
642     }
643 }
644 
645 static void vnc_dpy_update(DisplayChangeListener *dcl,
646                            int x, int y, int w, int h)
647 {
648     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
649     struct VncSurface *s = &vd->guest;
650 
651     vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
652 }
653 
654 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
655                             int32_t encoding)
656 {
657     vnc_write_u16(vs, x);
658     vnc_write_u16(vs, y);
659     vnc_write_u16(vs, w);
660     vnc_write_u16(vs, h);
661 
662     vnc_write_s32(vs, encoding);
663 }
664 
665 
666 static void vnc_desktop_resize(VncState *vs)
667 {
668     if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
669         return;
670     }
671     if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
672         vs->client_height == pixman_image_get_height(vs->vd->server)) {
673         return;
674     }
675     vs->client_width = pixman_image_get_width(vs->vd->server);
676     vs->client_height = pixman_image_get_height(vs->vd->server);
677     vnc_lock_output(vs);
678     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
679     vnc_write_u8(vs, 0);
680     vnc_write_u16(vs, 1); /* number of rects */
681     vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
682                            VNC_ENCODING_DESKTOPRESIZE);
683     vnc_unlock_output(vs);
684     vnc_flush(vs);
685 }
686 
687 static void vnc_abort_display_jobs(VncDisplay *vd)
688 {
689     VncState *vs;
690 
691     QTAILQ_FOREACH(vs, &vd->clients, next) {
692         vnc_lock_output(vs);
693         vs->abort = true;
694         vnc_unlock_output(vs);
695     }
696     QTAILQ_FOREACH(vs, &vd->clients, next) {
697         vnc_jobs_join(vs);
698     }
699     QTAILQ_FOREACH(vs, &vd->clients, next) {
700         vnc_lock_output(vs);
701         vs->abort = false;
702         vnc_unlock_output(vs);
703     }
704 }
705 
706 int vnc_server_fb_stride(VncDisplay *vd)
707 {
708     return pixman_image_get_stride(vd->server);
709 }
710 
711 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
712 {
713     uint8_t *ptr;
714 
715     ptr  = (uint8_t *)pixman_image_get_data(vd->server);
716     ptr += y * vnc_server_fb_stride(vd);
717     ptr += x * VNC_SERVER_FB_BYTES;
718     return ptr;
719 }
720 
721 static void vnc_update_server_surface(VncDisplay *vd)
722 {
723     int width, height;
724 
725     qemu_pixman_image_unref(vd->server);
726     vd->server = NULL;
727 
728     if (QTAILQ_EMPTY(&vd->clients)) {
729         return;
730     }
731 
732     width = vnc_width(vd);
733     height = vnc_height(vd);
734     vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
735                                           width, height,
736                                           NULL, 0);
737 
738     memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
739     vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
740                        width, height);
741 }
742 
743 static void vnc_dpy_switch(DisplayChangeListener *dcl,
744                            DisplaySurface *surface)
745 {
746     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
747     VncState *vs;
748 
749     vnc_abort_display_jobs(vd);
750     vd->ds = surface;
751 
752     /* server surface */
753     vnc_update_server_surface(vd);
754 
755     /* guest surface */
756     qemu_pixman_image_unref(vd->guest.fb);
757     vd->guest.fb = pixman_image_ref(surface->image);
758     vd->guest.format = surface->format;
759 
760     QTAILQ_FOREACH(vs, &vd->clients, next) {
761         vnc_colordepth(vs);
762         vnc_desktop_resize(vs);
763         if (vs->vd->cursor) {
764             vnc_cursor_define(vs);
765         }
766         memset(vs->dirty, 0x00, sizeof(vs->dirty));
767         vnc_set_area_dirty(vs->dirty, vd, 0, 0,
768                            vnc_width(vd),
769                            vnc_height(vd));
770     }
771 }
772 
773 /* fastest code */
774 static void vnc_write_pixels_copy(VncState *vs,
775                                   void *pixels, int size)
776 {
777     vnc_write(vs, pixels, size);
778 }
779 
780 /* slowest but generic code. */
781 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
782 {
783     uint8_t r, g, b;
784 
785 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
786     r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
787     g = (((v & 0x0000ff00) >>  8) << vs->client_pf.gbits) >> 8;
788     b = (((v & 0x000000ff) >>  0) << vs->client_pf.bbits) >> 8;
789 #else
790 # error need some bits here if you change VNC_SERVER_FB_FORMAT
791 #endif
792     v = (r << vs->client_pf.rshift) |
793         (g << vs->client_pf.gshift) |
794         (b << vs->client_pf.bshift);
795     switch (vs->client_pf.bytes_per_pixel) {
796     case 1:
797         buf[0] = v;
798         break;
799     case 2:
800         if (vs->client_be) {
801             buf[0] = v >> 8;
802             buf[1] = v;
803         } else {
804             buf[1] = v >> 8;
805             buf[0] = v;
806         }
807         break;
808     default:
809     case 4:
810         if (vs->client_be) {
811             buf[0] = v >> 24;
812             buf[1] = v >> 16;
813             buf[2] = v >> 8;
814             buf[3] = v;
815         } else {
816             buf[3] = v >> 24;
817             buf[2] = v >> 16;
818             buf[1] = v >> 8;
819             buf[0] = v;
820         }
821         break;
822     }
823 }
824 
825 static void vnc_write_pixels_generic(VncState *vs,
826                                      void *pixels1, int size)
827 {
828     uint8_t buf[4];
829 
830     if (VNC_SERVER_FB_BYTES == 4) {
831         uint32_t *pixels = pixels1;
832         int n, i;
833         n = size >> 2;
834         for (i = 0; i < n; i++) {
835             vnc_convert_pixel(vs, buf, pixels[i]);
836             vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
837         }
838     }
839 }
840 
841 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
842 {
843     int i;
844     uint8_t *row;
845     VncDisplay *vd = vs->vd;
846 
847     row = vnc_server_fb_ptr(vd, x, y);
848     for (i = 0; i < h; i++) {
849         vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
850         row += vnc_server_fb_stride(vd);
851     }
852     return 1;
853 }
854 
855 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
856 {
857     int n = 0;
858     bool encode_raw = false;
859     size_t saved_offs = vs->output.offset;
860 
861     switch(vs->vnc_encoding) {
862         case VNC_ENCODING_ZLIB:
863             n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
864             break;
865         case VNC_ENCODING_HEXTILE:
866             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
867             n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
868             break;
869         case VNC_ENCODING_TIGHT:
870             n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
871             break;
872         case VNC_ENCODING_TIGHT_PNG:
873             n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
874             break;
875         case VNC_ENCODING_ZRLE:
876             n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
877             break;
878         case VNC_ENCODING_ZYWRLE:
879             n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
880             break;
881         default:
882             encode_raw = true;
883             break;
884     }
885 
886     /* If the client has the same pixel format as our internal buffer and
887      * a RAW encoding would need less space fall back to RAW encoding to
888      * save bandwidth and processing power in the client. */
889     if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
890         12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
891         vs->output.offset = saved_offs;
892         encode_raw = true;
893     }
894 
895     if (encode_raw) {
896         vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
897         n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
898     }
899 
900     return n;
901 }
902 
903 static void vnc_mouse_set(DisplayChangeListener *dcl,
904                           int x, int y, int visible)
905 {
906     /* can we ask the client(s) to move the pointer ??? */
907 }
908 
909 static int vnc_cursor_define(VncState *vs)
910 {
911     QEMUCursor *c = vs->vd->cursor;
912     int isize;
913 
914     if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
915         vnc_lock_output(vs);
916         vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
917         vnc_write_u8(vs,  0);  /*  padding     */
918         vnc_write_u16(vs, 1);  /*  # of rects  */
919         vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
920                                VNC_ENCODING_RICH_CURSOR);
921         isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
922         vnc_write_pixels_generic(vs, c->data, isize);
923         vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
924         vnc_unlock_output(vs);
925         return 0;
926     }
927     return -1;
928 }
929 
930 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
931                                   QEMUCursor *c)
932 {
933     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
934     VncState *vs;
935 
936     cursor_put(vd->cursor);
937     g_free(vd->cursor_mask);
938 
939     vd->cursor = c;
940     cursor_get(vd->cursor);
941     vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
942     vd->cursor_mask = g_malloc0(vd->cursor_msize);
943     cursor_get_mono_mask(c, 0, vd->cursor_mask);
944 
945     QTAILQ_FOREACH(vs, &vd->clients, next) {
946         vnc_cursor_define(vs);
947     }
948 }
949 
950 static int find_and_clear_dirty_height(VncState *vs,
951                                        int y, int last_x, int x, int height)
952 {
953     int h;
954 
955     for (h = 1; h < (height - y); h++) {
956         if (!test_bit(last_x, vs->dirty[y + h])) {
957             break;
958         }
959         bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
960     }
961 
962     return h;
963 }
964 
965 static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
966 {
967     if (vs->disconnecting) {
968         vnc_disconnect_finish(vs);
969         return 0;
970     }
971 
972     vs->has_dirty += has_dirty;
973     if (vs->need_update && !vs->disconnecting) {
974         VncDisplay *vd = vs->vd;
975         VncJob *job;
976         int y;
977         int height, width;
978         int n = 0;
979 
980         if (vs->output.offset && !vs->audio_cap && !vs->force_update)
981             /* kernel send buffers are full -> drop frames to throttle */
982             return 0;
983 
984         if (!vs->has_dirty && !vs->audio_cap && !vs->force_update)
985             return 0;
986 
987         /*
988          * Send screen updates to the vnc client using the server
989          * surface and server dirty map.  guest surface updates
990          * happening in parallel don't disturb us, the next pass will
991          * send them to the client.
992          */
993         job = vnc_job_new(vs);
994 
995         height = pixman_image_get_height(vd->server);
996         width = pixman_image_get_width(vd->server);
997 
998         y = 0;
999         for (;;) {
1000             int x, h;
1001             unsigned long x2;
1002             unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1003                                                  height * VNC_DIRTY_BPL(vs),
1004                                                  y * VNC_DIRTY_BPL(vs));
1005             if (offset == height * VNC_DIRTY_BPL(vs)) {
1006                 /* no more dirty bits */
1007                 break;
1008             }
1009             y = offset / VNC_DIRTY_BPL(vs);
1010             x = offset % VNC_DIRTY_BPL(vs);
1011             x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1012                                     VNC_DIRTY_BPL(vs), x);
1013             bitmap_clear(vs->dirty[y], x, x2 - x);
1014             h = find_and_clear_dirty_height(vs, y, x, x2, height);
1015             x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1016             if (x2 > x) {
1017                 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1018                                       (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1019             }
1020             if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1021                 y += h;
1022                 if (y == height) {
1023                     break;
1024                 }
1025             }
1026         }
1027 
1028         vnc_job_push(job);
1029         if (sync) {
1030             vnc_jobs_join(vs);
1031         }
1032         vs->force_update = 0;
1033         vs->has_dirty = 0;
1034         return n;
1035     }
1036 
1037     if (vs->disconnecting) {
1038         vnc_disconnect_finish(vs);
1039     } else if (sync) {
1040         vnc_jobs_join(vs);
1041     }
1042 
1043     return 0;
1044 }
1045 
1046 /* audio */
1047 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1048 {
1049     VncState *vs = opaque;
1050 
1051     switch (cmd) {
1052     case AUD_CNOTIFY_DISABLE:
1053         vnc_lock_output(vs);
1054         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1055         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1056         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1057         vnc_unlock_output(vs);
1058         vnc_flush(vs);
1059         break;
1060 
1061     case AUD_CNOTIFY_ENABLE:
1062         vnc_lock_output(vs);
1063         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1064         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1065         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1066         vnc_unlock_output(vs);
1067         vnc_flush(vs);
1068         break;
1069     }
1070 }
1071 
1072 static void audio_capture_destroy(void *opaque)
1073 {
1074 }
1075 
1076 static void audio_capture(void *opaque, void *buf, int size)
1077 {
1078     VncState *vs = opaque;
1079 
1080     vnc_lock_output(vs);
1081     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1082     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1083     vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1084     vnc_write_u32(vs, size);
1085     vnc_write(vs, buf, size);
1086     vnc_unlock_output(vs);
1087     vnc_flush(vs);
1088 }
1089 
1090 static void audio_add(VncState *vs)
1091 {
1092     struct audio_capture_ops ops;
1093 
1094     if (vs->audio_cap) {
1095         error_report("audio already running");
1096         return;
1097     }
1098 
1099     ops.notify = audio_capture_notify;
1100     ops.destroy = audio_capture_destroy;
1101     ops.capture = audio_capture;
1102 
1103     vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1104     if (!vs->audio_cap) {
1105         error_report("Failed to add audio capture");
1106     }
1107 }
1108 
1109 static void audio_del(VncState *vs)
1110 {
1111     if (vs->audio_cap) {
1112         AUD_del_capture(vs->audio_cap, vs);
1113         vs->audio_cap = NULL;
1114     }
1115 }
1116 
1117 static void vnc_disconnect_start(VncState *vs)
1118 {
1119     if (vs->disconnecting) {
1120         return;
1121     }
1122     vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1123     if (vs->ioc_tag) {
1124         g_source_remove(vs->ioc_tag);
1125     }
1126     qio_channel_close(vs->ioc, NULL);
1127     vs->disconnecting = TRUE;
1128 }
1129 
1130 void vnc_disconnect_finish(VncState *vs)
1131 {
1132     int i;
1133 
1134     vnc_jobs_join(vs); /* Wait encoding jobs */
1135 
1136     vnc_lock_output(vs);
1137     vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1138 
1139     buffer_free(&vs->input);
1140     buffer_free(&vs->output);
1141 
1142     qapi_free_VncClientInfo(vs->info);
1143 
1144     vnc_zlib_clear(vs);
1145     vnc_tight_clear(vs);
1146     vnc_zrle_clear(vs);
1147 
1148 #ifdef CONFIG_VNC_SASL
1149     vnc_sasl_client_cleanup(vs);
1150 #endif /* CONFIG_VNC_SASL */
1151     audio_del(vs);
1152     vnc_release_modifiers(vs);
1153 
1154     if (vs->mouse_mode_notifier.notify != NULL) {
1155         qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1156     }
1157     QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1158     if (QTAILQ_EMPTY(&vs->vd->clients)) {
1159         /* last client gone */
1160         vnc_update_server_surface(vs->vd);
1161     }
1162 
1163     vnc_unlock_output(vs);
1164 
1165     qemu_mutex_destroy(&vs->output_mutex);
1166     if (vs->bh != NULL) {
1167         qemu_bh_delete(vs->bh);
1168     }
1169     buffer_free(&vs->jobs_buffer);
1170 
1171     for (i = 0; i < VNC_STAT_ROWS; ++i) {
1172         g_free(vs->lossy_rect[i]);
1173     }
1174     g_free(vs->lossy_rect);
1175 
1176     object_unref(OBJECT(vs->ioc));
1177     vs->ioc = NULL;
1178     object_unref(OBJECT(vs->sioc));
1179     vs->sioc = NULL;
1180     g_free(vs);
1181 }
1182 
1183 ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1184 {
1185     if (ret <= 0) {
1186         if (ret == 0) {
1187             VNC_DEBUG("Closing down client sock: EOF\n");
1188             vnc_disconnect_start(vs);
1189         } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1190             VNC_DEBUG("Closing down client sock: ret %zd (%s)\n",
1191                       ret, errp ? error_get_pretty(*errp) : "Unknown");
1192             vnc_disconnect_start(vs);
1193         }
1194 
1195         if (errp) {
1196             error_free(*errp);
1197             *errp = NULL;
1198         }
1199         return 0;
1200     }
1201     return ret;
1202 }
1203 
1204 
1205 void vnc_client_error(VncState *vs)
1206 {
1207     VNC_DEBUG("Closing down client sock: protocol error\n");
1208     vnc_disconnect_start(vs);
1209 }
1210 
1211 
1212 /*
1213  * Called to write a chunk of data to the client socket. The data may
1214  * be the raw data, or may have already been encoded by SASL.
1215  * The data will be written either straight onto the socket, or
1216  * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1217  *
1218  * NB, it is theoretically possible to have 2 layers of encryption,
1219  * both SASL, and this TLS layer. It is highly unlikely in practice
1220  * though, since SASL encryption will typically be a no-op if TLS
1221  * is active
1222  *
1223  * Returns the number of bytes written, which may be less than
1224  * the requested 'datalen' if the socket would block. Returns
1225  * -1 on error, and disconnects the client socket.
1226  */
1227 ssize_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1228 {
1229     Error *err = NULL;
1230     ssize_t ret;
1231     ret = qio_channel_write(
1232         vs->ioc, (const char *)data, datalen, &err);
1233     VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1234     return vnc_client_io_error(vs, ret, &err);
1235 }
1236 
1237 
1238 /*
1239  * Called to write buffered data to the client socket, when not
1240  * using any SASL SSF encryption layers. Will write as much data
1241  * as possible without blocking. If all buffered data is written,
1242  * will switch the FD poll() handler back to read monitoring.
1243  *
1244  * Returns the number of bytes written, which may be less than
1245  * the buffered output data if the socket would block. Returns
1246  * -1 on error, and disconnects the client socket.
1247  */
1248 static ssize_t vnc_client_write_plain(VncState *vs)
1249 {
1250     ssize_t ret;
1251 
1252 #ifdef CONFIG_VNC_SASL
1253     VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1254               vs->output.buffer, vs->output.capacity, vs->output.offset,
1255               vs->sasl.waitWriteSSF);
1256 
1257     if (vs->sasl.conn &&
1258         vs->sasl.runSSF &&
1259         vs->sasl.waitWriteSSF) {
1260         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1261         if (ret)
1262             vs->sasl.waitWriteSSF -= ret;
1263     } else
1264 #endif /* CONFIG_VNC_SASL */
1265         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1266     if (!ret)
1267         return 0;
1268 
1269     buffer_advance(&vs->output, ret);
1270 
1271     if (vs->output.offset == 0) {
1272         if (vs->ioc_tag) {
1273             g_source_remove(vs->ioc_tag);
1274         }
1275         vs->ioc_tag = qio_channel_add_watch(
1276             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1277     }
1278 
1279     return ret;
1280 }
1281 
1282 
1283 /*
1284  * First function called whenever there is data to be written to
1285  * the client socket. Will delegate actual work according to whether
1286  * SASL SSF layers are enabled (thus requiring encryption calls)
1287  */
1288 static void vnc_client_write_locked(VncState *vs)
1289 {
1290 #ifdef CONFIG_VNC_SASL
1291     if (vs->sasl.conn &&
1292         vs->sasl.runSSF &&
1293         !vs->sasl.waitWriteSSF) {
1294         vnc_client_write_sasl(vs);
1295     } else
1296 #endif /* CONFIG_VNC_SASL */
1297     {
1298         vnc_client_write_plain(vs);
1299     }
1300 }
1301 
1302 static void vnc_client_write(VncState *vs)
1303 {
1304 
1305     vnc_lock_output(vs);
1306     if (vs->output.offset) {
1307         vnc_client_write_locked(vs);
1308     } else if (vs->ioc != NULL) {
1309         if (vs->ioc_tag) {
1310             g_source_remove(vs->ioc_tag);
1311         }
1312         vs->ioc_tag = qio_channel_add_watch(
1313             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1314     }
1315     vnc_unlock_output(vs);
1316 }
1317 
1318 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1319 {
1320     vs->read_handler = func;
1321     vs->read_handler_expect = expecting;
1322 }
1323 
1324 
1325 /*
1326  * Called to read a chunk of data from the client socket. The data may
1327  * be the raw data, or may need to be further decoded by SASL.
1328  * The data will be read either straight from to the socket, or
1329  * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1330  *
1331  * NB, it is theoretically possible to have 2 layers of encryption,
1332  * both SASL, and this TLS layer. It is highly unlikely in practice
1333  * though, since SASL encryption will typically be a no-op if TLS
1334  * is active
1335  *
1336  * Returns the number of bytes read, which may be less than
1337  * the requested 'datalen' if the socket would block. Returns
1338  * -1 on error, and disconnects the client socket.
1339  */
1340 ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1341 {
1342     ssize_t ret;
1343     Error *err = NULL;
1344     ret = qio_channel_read(
1345         vs->ioc, (char *)data, datalen, &err);
1346     VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1347     return vnc_client_io_error(vs, ret, &err);
1348 }
1349 
1350 
1351 /*
1352  * Called to read data from the client socket to the input buffer,
1353  * when not using any SASL SSF encryption layers. Will read as much
1354  * data as possible without blocking.
1355  *
1356  * Returns the number of bytes read. Returns -1 on error, and
1357  * disconnects the client socket.
1358  */
1359 static ssize_t vnc_client_read_plain(VncState *vs)
1360 {
1361     ssize_t ret;
1362     VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1363               vs->input.buffer, vs->input.capacity, vs->input.offset);
1364     buffer_reserve(&vs->input, 4096);
1365     ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1366     if (!ret)
1367         return 0;
1368     vs->input.offset += ret;
1369     return ret;
1370 }
1371 
1372 static void vnc_jobs_bh(void *opaque)
1373 {
1374     VncState *vs = opaque;
1375 
1376     vnc_jobs_consume_buffer(vs);
1377 }
1378 
1379 /*
1380  * First function called whenever there is more data to be read from
1381  * the client socket. Will delegate actual work according to whether
1382  * SASL SSF layers are enabled (thus requiring decryption calls)
1383  * Returns 0 on success, -1 if client disconnected
1384  */
1385 static int vnc_client_read(VncState *vs)
1386 {
1387     ssize_t ret;
1388 
1389 #ifdef CONFIG_VNC_SASL
1390     if (vs->sasl.conn && vs->sasl.runSSF)
1391         ret = vnc_client_read_sasl(vs);
1392     else
1393 #endif /* CONFIG_VNC_SASL */
1394         ret = vnc_client_read_plain(vs);
1395     if (!ret) {
1396         if (vs->disconnecting) {
1397             vnc_disconnect_finish(vs);
1398             return -1;
1399         }
1400         return 0;
1401     }
1402 
1403     while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1404         size_t len = vs->read_handler_expect;
1405         int ret;
1406 
1407         ret = vs->read_handler(vs, vs->input.buffer, len);
1408         if (vs->disconnecting) {
1409             vnc_disconnect_finish(vs);
1410             return -1;
1411         }
1412 
1413         if (!ret) {
1414             buffer_advance(&vs->input, len);
1415         } else {
1416             vs->read_handler_expect = ret;
1417         }
1418     }
1419     return 0;
1420 }
1421 
1422 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1423                        GIOCondition condition, void *opaque)
1424 {
1425     VncState *vs = opaque;
1426     if (condition & G_IO_IN) {
1427         if (vnc_client_read(vs) < 0) {
1428             return TRUE;
1429         }
1430     }
1431     if (condition & G_IO_OUT) {
1432         vnc_client_write(vs);
1433     }
1434     return TRUE;
1435 }
1436 
1437 
1438 void vnc_write(VncState *vs, const void *data, size_t len)
1439 {
1440     buffer_reserve(&vs->output, len);
1441 
1442     if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1443         if (vs->ioc_tag) {
1444             g_source_remove(vs->ioc_tag);
1445         }
1446         vs->ioc_tag = qio_channel_add_watch(
1447             vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1448     }
1449 
1450     buffer_append(&vs->output, data, len);
1451 }
1452 
1453 void vnc_write_s32(VncState *vs, int32_t value)
1454 {
1455     vnc_write_u32(vs, *(uint32_t *)&value);
1456 }
1457 
1458 void vnc_write_u32(VncState *vs, uint32_t value)
1459 {
1460     uint8_t buf[4];
1461 
1462     buf[0] = (value >> 24) & 0xFF;
1463     buf[1] = (value >> 16) & 0xFF;
1464     buf[2] = (value >>  8) & 0xFF;
1465     buf[3] = value & 0xFF;
1466 
1467     vnc_write(vs, buf, 4);
1468 }
1469 
1470 void vnc_write_u16(VncState *vs, uint16_t value)
1471 {
1472     uint8_t buf[2];
1473 
1474     buf[0] = (value >> 8) & 0xFF;
1475     buf[1] = value & 0xFF;
1476 
1477     vnc_write(vs, buf, 2);
1478 }
1479 
1480 void vnc_write_u8(VncState *vs, uint8_t value)
1481 {
1482     vnc_write(vs, (char *)&value, 1);
1483 }
1484 
1485 void vnc_flush(VncState *vs)
1486 {
1487     vnc_lock_output(vs);
1488     if (vs->ioc != NULL && vs->output.offset) {
1489         vnc_client_write_locked(vs);
1490     }
1491     vnc_unlock_output(vs);
1492 }
1493 
1494 static uint8_t read_u8(uint8_t *data, size_t offset)
1495 {
1496     return data[offset];
1497 }
1498 
1499 static uint16_t read_u16(uint8_t *data, size_t offset)
1500 {
1501     return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1502 }
1503 
1504 static int32_t read_s32(uint8_t *data, size_t offset)
1505 {
1506     return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1507                      (data[offset + 2] << 8) | data[offset + 3]);
1508 }
1509 
1510 uint32_t read_u32(uint8_t *data, size_t offset)
1511 {
1512     return ((data[offset] << 24) | (data[offset + 1] << 16) |
1513             (data[offset + 2] << 8) | data[offset + 3]);
1514 }
1515 
1516 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1517 {
1518 }
1519 
1520 static void check_pointer_type_change(Notifier *notifier, void *data)
1521 {
1522     VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1523     int absolute = qemu_input_is_absolute();
1524 
1525     if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1526         vnc_lock_output(vs);
1527         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1528         vnc_write_u8(vs, 0);
1529         vnc_write_u16(vs, 1);
1530         vnc_framebuffer_update(vs, absolute, 0,
1531                                pixman_image_get_width(vs->vd->server),
1532                                pixman_image_get_height(vs->vd->server),
1533                                VNC_ENCODING_POINTER_TYPE_CHANGE);
1534         vnc_unlock_output(vs);
1535         vnc_flush(vs);
1536     }
1537     vs->absolute = absolute;
1538 }
1539 
1540 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1541 {
1542     static uint32_t bmap[INPUT_BUTTON__MAX] = {
1543         [INPUT_BUTTON_LEFT]       = 0x01,
1544         [INPUT_BUTTON_MIDDLE]     = 0x02,
1545         [INPUT_BUTTON_RIGHT]      = 0x04,
1546         [INPUT_BUTTON_WHEEL_UP]   = 0x08,
1547         [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1548     };
1549     QemuConsole *con = vs->vd->dcl.con;
1550     int width = pixman_image_get_width(vs->vd->server);
1551     int height = pixman_image_get_height(vs->vd->server);
1552 
1553     if (vs->last_bmask != button_mask) {
1554         qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1555         vs->last_bmask = button_mask;
1556     }
1557 
1558     if (vs->absolute) {
1559         qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1560         qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1561     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1562         qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1563         qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1564     } else {
1565         if (vs->last_x != -1) {
1566             qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1567             qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1568         }
1569         vs->last_x = x;
1570         vs->last_y = y;
1571     }
1572     qemu_input_event_sync();
1573 }
1574 
1575 static void reset_keys(VncState *vs)
1576 {
1577     int i;
1578     for(i = 0; i < 256; i++) {
1579         if (vs->modifiers_state[i]) {
1580             qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1581             qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1582             vs->modifiers_state[i] = 0;
1583         }
1584     }
1585 }
1586 
1587 static void press_key(VncState *vs, int keysym)
1588 {
1589     int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1590     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1591     qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1592     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1593     qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1594 }
1595 
1596 static void vnc_led_state_change(VncState *vs)
1597 {
1598     if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1599         return;
1600     }
1601 
1602     vnc_lock_output(vs);
1603     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1604     vnc_write_u8(vs, 0);
1605     vnc_write_u16(vs, 1);
1606     vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1607     vnc_write_u8(vs, vs->vd->ledstate);
1608     vnc_unlock_output(vs);
1609     vnc_flush(vs);
1610 }
1611 
1612 static void kbd_leds(void *opaque, int ledstate)
1613 {
1614     VncDisplay *vd = opaque;
1615     VncState *client;
1616 
1617     trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1618                              (ledstate & QEMU_NUM_LOCK_LED),
1619                              (ledstate & QEMU_SCROLL_LOCK_LED));
1620 
1621     if (ledstate == vd->ledstate) {
1622         return;
1623     }
1624 
1625     vd->ledstate = ledstate;
1626 
1627     QTAILQ_FOREACH(client, &vd->clients, next) {
1628         vnc_led_state_change(client);
1629     }
1630 }
1631 
1632 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1633 {
1634     /* QEMU console switch */
1635     switch(keycode) {
1636     case 0x2a:                          /* Left Shift */
1637     case 0x36:                          /* Right Shift */
1638     case 0x1d:                          /* Left CTRL */
1639     case 0x9d:                          /* Right CTRL */
1640     case 0x38:                          /* Left ALT */
1641     case 0xb8:                          /* Right ALT */
1642         if (down)
1643             vs->modifiers_state[keycode] = 1;
1644         else
1645             vs->modifiers_state[keycode] = 0;
1646         break;
1647     case 0x02 ... 0x0a: /* '1' to '9' keys */
1648         if (vs->vd->dcl.con == NULL &&
1649             down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1650             /* Reset the modifiers sent to the current console */
1651             reset_keys(vs);
1652             console_select(keycode - 0x02);
1653             return;
1654         }
1655         break;
1656     case 0x3a:                        /* CapsLock */
1657     case 0x45:                        /* NumLock */
1658         if (down)
1659             vs->modifiers_state[keycode] ^= 1;
1660         break;
1661     }
1662 
1663     /* Turn off the lock state sync logic if the client support the led
1664        state extension.
1665     */
1666     if (down && vs->vd->lock_key_sync &&
1667         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1668         keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1669         /* If the numlock state needs to change then simulate an additional
1670            keypress before sending this one.  This will happen if the user
1671            toggles numlock away from the VNC window.
1672         */
1673         if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1674             if (!vs->modifiers_state[0x45]) {
1675                 trace_vnc_key_sync_numlock(true);
1676                 vs->modifiers_state[0x45] = 1;
1677                 press_key(vs, 0xff7f);
1678             }
1679         } else {
1680             if (vs->modifiers_state[0x45]) {
1681                 trace_vnc_key_sync_numlock(false);
1682                 vs->modifiers_state[0x45] = 0;
1683                 press_key(vs, 0xff7f);
1684             }
1685         }
1686     }
1687 
1688     if (down && vs->vd->lock_key_sync &&
1689         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1690         ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1691         /* If the capslock state needs to change then simulate an additional
1692            keypress before sending this one.  This will happen if the user
1693            toggles capslock away from the VNC window.
1694         */
1695         int uppercase = !!(sym >= 'A' && sym <= 'Z');
1696         int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1697         int capslock = !!(vs->modifiers_state[0x3a]);
1698         if (capslock) {
1699             if (uppercase == shift) {
1700                 trace_vnc_key_sync_capslock(false);
1701                 vs->modifiers_state[0x3a] = 0;
1702                 press_key(vs, 0xffe5);
1703             }
1704         } else {
1705             if (uppercase != shift) {
1706                 trace_vnc_key_sync_capslock(true);
1707                 vs->modifiers_state[0x3a] = 1;
1708                 press_key(vs, 0xffe5);
1709             }
1710         }
1711     }
1712 
1713     if (qemu_console_is_graphic(NULL)) {
1714         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1715         qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1716     } else {
1717         bool numlock = vs->modifiers_state[0x45];
1718         bool control = (vs->modifiers_state[0x1d] ||
1719                         vs->modifiers_state[0x9d]);
1720         /* QEMU console emulation */
1721         if (down) {
1722             switch (keycode) {
1723             case 0x2a:                          /* Left Shift */
1724             case 0x36:                          /* Right Shift */
1725             case 0x1d:                          /* Left CTRL */
1726             case 0x9d:                          /* Right CTRL */
1727             case 0x38:                          /* Left ALT */
1728             case 0xb8:                          /* Right ALT */
1729                 break;
1730             case 0xc8:
1731                 kbd_put_keysym(QEMU_KEY_UP);
1732                 break;
1733             case 0xd0:
1734                 kbd_put_keysym(QEMU_KEY_DOWN);
1735                 break;
1736             case 0xcb:
1737                 kbd_put_keysym(QEMU_KEY_LEFT);
1738                 break;
1739             case 0xcd:
1740                 kbd_put_keysym(QEMU_KEY_RIGHT);
1741                 break;
1742             case 0xd3:
1743                 kbd_put_keysym(QEMU_KEY_DELETE);
1744                 break;
1745             case 0xc7:
1746                 kbd_put_keysym(QEMU_KEY_HOME);
1747                 break;
1748             case 0xcf:
1749                 kbd_put_keysym(QEMU_KEY_END);
1750                 break;
1751             case 0xc9:
1752                 kbd_put_keysym(QEMU_KEY_PAGEUP);
1753                 break;
1754             case 0xd1:
1755                 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1756                 break;
1757 
1758             case 0x47:
1759                 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1760                 break;
1761             case 0x48:
1762                 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1763                 break;
1764             case 0x49:
1765                 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1766                 break;
1767             case 0x4b:
1768                 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1769                 break;
1770             case 0x4c:
1771                 kbd_put_keysym('5');
1772                 break;
1773             case 0x4d:
1774                 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1775                 break;
1776             case 0x4f:
1777                 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1778                 break;
1779             case 0x50:
1780                 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1781                 break;
1782             case 0x51:
1783                 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1784                 break;
1785             case 0x52:
1786                 kbd_put_keysym('0');
1787                 break;
1788             case 0x53:
1789                 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1790                 break;
1791 
1792             case 0xb5:
1793                 kbd_put_keysym('/');
1794                 break;
1795             case 0x37:
1796                 kbd_put_keysym('*');
1797                 break;
1798             case 0x4a:
1799                 kbd_put_keysym('-');
1800                 break;
1801             case 0x4e:
1802                 kbd_put_keysym('+');
1803                 break;
1804             case 0x9c:
1805                 kbd_put_keysym('\n');
1806                 break;
1807 
1808             default:
1809                 if (control) {
1810                     kbd_put_keysym(sym & 0x1f);
1811                 } else {
1812                     kbd_put_keysym(sym);
1813                 }
1814                 break;
1815             }
1816         }
1817     }
1818 }
1819 
1820 static void vnc_release_modifiers(VncState *vs)
1821 {
1822     static const int keycodes[] = {
1823         /* shift, control, alt keys, both left & right */
1824         0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1825     };
1826     int i, keycode;
1827 
1828     if (!qemu_console_is_graphic(NULL)) {
1829         return;
1830     }
1831     for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1832         keycode = keycodes[i];
1833         if (!vs->modifiers_state[keycode]) {
1834             continue;
1835         }
1836         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1837         qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1838     }
1839 }
1840 
1841 static const char *code2name(int keycode)
1842 {
1843     return QKeyCode_lookup[qemu_input_key_number_to_qcode(keycode)];
1844 }
1845 
1846 static void key_event(VncState *vs, int down, uint32_t sym)
1847 {
1848     int keycode;
1849     int lsym = sym;
1850 
1851     if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1852         lsym = lsym - 'A' + 'a';
1853     }
1854 
1855     keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1856     trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
1857     do_key_event(vs, down, keycode, sym);
1858 }
1859 
1860 static void ext_key_event(VncState *vs, int down,
1861                           uint32_t sym, uint16_t keycode)
1862 {
1863     /* if the user specifies a keyboard layout, always use it */
1864     if (keyboard_layout) {
1865         key_event(vs, down, sym);
1866     } else {
1867         trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
1868         do_key_event(vs, down, keycode, sym);
1869     }
1870 }
1871 
1872 static void framebuffer_update_request(VncState *vs, int incremental,
1873                                        int x, int y, int w, int h)
1874 {
1875     vs->need_update = 1;
1876 
1877     if (incremental) {
1878         return;
1879     }
1880 
1881     vs->force_update = 1;
1882     vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
1883 }
1884 
1885 static void send_ext_key_event_ack(VncState *vs)
1886 {
1887     vnc_lock_output(vs);
1888     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1889     vnc_write_u8(vs, 0);
1890     vnc_write_u16(vs, 1);
1891     vnc_framebuffer_update(vs, 0, 0,
1892                            pixman_image_get_width(vs->vd->server),
1893                            pixman_image_get_height(vs->vd->server),
1894                            VNC_ENCODING_EXT_KEY_EVENT);
1895     vnc_unlock_output(vs);
1896     vnc_flush(vs);
1897 }
1898 
1899 static void send_ext_audio_ack(VncState *vs)
1900 {
1901     vnc_lock_output(vs);
1902     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1903     vnc_write_u8(vs, 0);
1904     vnc_write_u16(vs, 1);
1905     vnc_framebuffer_update(vs, 0, 0,
1906                            pixman_image_get_width(vs->vd->server),
1907                            pixman_image_get_height(vs->vd->server),
1908                            VNC_ENCODING_AUDIO);
1909     vnc_unlock_output(vs);
1910     vnc_flush(vs);
1911 }
1912 
1913 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1914 {
1915     int i;
1916     unsigned int enc = 0;
1917 
1918     vs->features = 0;
1919     vs->vnc_encoding = 0;
1920     vs->tight.compression = 9;
1921     vs->tight.quality = -1; /* Lossless by default */
1922     vs->absolute = -1;
1923 
1924     /*
1925      * Start from the end because the encodings are sent in order of preference.
1926      * This way the preferred encoding (first encoding defined in the array)
1927      * will be set at the end of the loop.
1928      */
1929     for (i = n_encodings - 1; i >= 0; i--) {
1930         enc = encodings[i];
1931         switch (enc) {
1932         case VNC_ENCODING_RAW:
1933             vs->vnc_encoding = enc;
1934             break;
1935         case VNC_ENCODING_COPYRECT:
1936             vs->features |= VNC_FEATURE_COPYRECT_MASK;
1937             break;
1938         case VNC_ENCODING_HEXTILE:
1939             vs->features |= VNC_FEATURE_HEXTILE_MASK;
1940             vs->vnc_encoding = enc;
1941             break;
1942         case VNC_ENCODING_TIGHT:
1943             vs->features |= VNC_FEATURE_TIGHT_MASK;
1944             vs->vnc_encoding = enc;
1945             break;
1946 #ifdef CONFIG_VNC_PNG
1947         case VNC_ENCODING_TIGHT_PNG:
1948             vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1949             vs->vnc_encoding = enc;
1950             break;
1951 #endif
1952         case VNC_ENCODING_ZLIB:
1953             vs->features |= VNC_FEATURE_ZLIB_MASK;
1954             vs->vnc_encoding = enc;
1955             break;
1956         case VNC_ENCODING_ZRLE:
1957             vs->features |= VNC_FEATURE_ZRLE_MASK;
1958             vs->vnc_encoding = enc;
1959             break;
1960         case VNC_ENCODING_ZYWRLE:
1961             vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1962             vs->vnc_encoding = enc;
1963             break;
1964         case VNC_ENCODING_DESKTOPRESIZE:
1965             vs->features |= VNC_FEATURE_RESIZE_MASK;
1966             break;
1967         case VNC_ENCODING_POINTER_TYPE_CHANGE:
1968             vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1969             break;
1970         case VNC_ENCODING_RICH_CURSOR:
1971             vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1972             if (vs->vd->cursor) {
1973                 vnc_cursor_define(vs);
1974             }
1975             break;
1976         case VNC_ENCODING_EXT_KEY_EVENT:
1977             send_ext_key_event_ack(vs);
1978             break;
1979         case VNC_ENCODING_AUDIO:
1980             send_ext_audio_ack(vs);
1981             break;
1982         case VNC_ENCODING_WMVi:
1983             vs->features |= VNC_FEATURE_WMVI_MASK;
1984             break;
1985         case VNC_ENCODING_LED_STATE:
1986             vs->features |= VNC_FEATURE_LED_STATE_MASK;
1987             break;
1988         case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1989             vs->tight.compression = (enc & 0x0F);
1990             break;
1991         case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1992             if (vs->vd->lossy) {
1993                 vs->tight.quality = (enc & 0x0F);
1994             }
1995             break;
1996         default:
1997             VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1998             break;
1999         }
2000     }
2001     vnc_desktop_resize(vs);
2002     check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2003     vnc_led_state_change(vs);
2004 }
2005 
2006 static void set_pixel_conversion(VncState *vs)
2007 {
2008     pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2009 
2010     if (fmt == VNC_SERVER_FB_FORMAT) {
2011         vs->write_pixels = vnc_write_pixels_copy;
2012         vnc_hextile_set_pixel_conversion(vs, 0);
2013     } else {
2014         vs->write_pixels = vnc_write_pixels_generic;
2015         vnc_hextile_set_pixel_conversion(vs, 1);
2016     }
2017 }
2018 
2019 static void send_color_map(VncState *vs)
2020 {
2021     int i;
2022 
2023     vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2024     vnc_write_u8(vs,  0);    /* padding     */
2025     vnc_write_u16(vs, 0);    /* first color */
2026     vnc_write_u16(vs, 256);  /* # of colors */
2027 
2028     for (i = 0; i < 256; i++) {
2029         PixelFormat *pf = &vs->client_pf;
2030 
2031         vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2032         vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2033         vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2034     }
2035 }
2036 
2037 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2038                              int big_endian_flag, int true_color_flag,
2039                              int red_max, int green_max, int blue_max,
2040                              int red_shift, int green_shift, int blue_shift)
2041 {
2042     if (!true_color_flag) {
2043         /* Expose a reasonable default 256 color map */
2044         bits_per_pixel = 8;
2045         red_max = 7;
2046         green_max = 7;
2047         blue_max = 3;
2048         red_shift = 0;
2049         green_shift = 3;
2050         blue_shift = 6;
2051     }
2052 
2053     switch (bits_per_pixel) {
2054     case 8:
2055     case 16:
2056     case 32:
2057         break;
2058     default:
2059         vnc_client_error(vs);
2060         return;
2061     }
2062 
2063     vs->client_pf.rmax = red_max ? red_max : 0xFF;
2064     vs->client_pf.rbits = ctpopl(red_max);
2065     vs->client_pf.rshift = red_shift;
2066     vs->client_pf.rmask = red_max << red_shift;
2067     vs->client_pf.gmax = green_max ? green_max : 0xFF;
2068     vs->client_pf.gbits = ctpopl(green_max);
2069     vs->client_pf.gshift = green_shift;
2070     vs->client_pf.gmask = green_max << green_shift;
2071     vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2072     vs->client_pf.bbits = ctpopl(blue_max);
2073     vs->client_pf.bshift = blue_shift;
2074     vs->client_pf.bmask = blue_max << blue_shift;
2075     vs->client_pf.bits_per_pixel = bits_per_pixel;
2076     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2077     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2078     vs->client_be = big_endian_flag;
2079 
2080     if (!true_color_flag) {
2081         send_color_map(vs);
2082     }
2083 
2084     set_pixel_conversion(vs);
2085 
2086     graphic_hw_invalidate(vs->vd->dcl.con);
2087     graphic_hw_update(vs->vd->dcl.con);
2088 }
2089 
2090 static void pixel_format_message (VncState *vs) {
2091     char pad[3] = { 0, 0, 0 };
2092 
2093     vs->client_pf = qemu_default_pixelformat(32);
2094 
2095     vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2096     vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2097 
2098 #ifdef HOST_WORDS_BIGENDIAN
2099     vnc_write_u8(vs, 1);             /* big-endian-flag */
2100 #else
2101     vnc_write_u8(vs, 0);             /* big-endian-flag */
2102 #endif
2103     vnc_write_u8(vs, 1);             /* true-color-flag */
2104     vnc_write_u16(vs, vs->client_pf.rmax);     /* red-max */
2105     vnc_write_u16(vs, vs->client_pf.gmax);     /* green-max */
2106     vnc_write_u16(vs, vs->client_pf.bmax);     /* blue-max */
2107     vnc_write_u8(vs, vs->client_pf.rshift);    /* red-shift */
2108     vnc_write_u8(vs, vs->client_pf.gshift);    /* green-shift */
2109     vnc_write_u8(vs, vs->client_pf.bshift);    /* blue-shift */
2110     vnc_write(vs, pad, 3);           /* padding */
2111 
2112     vnc_hextile_set_pixel_conversion(vs, 0);
2113     vs->write_pixels = vnc_write_pixels_copy;
2114 }
2115 
2116 static void vnc_colordepth(VncState *vs)
2117 {
2118     if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2119         /* Sending a WMVi message to notify the client*/
2120         vnc_lock_output(vs);
2121         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2122         vnc_write_u8(vs, 0);
2123         vnc_write_u16(vs, 1); /* number of rects */
2124         vnc_framebuffer_update(vs, 0, 0,
2125                                pixman_image_get_width(vs->vd->server),
2126                                pixman_image_get_height(vs->vd->server),
2127                                VNC_ENCODING_WMVi);
2128         pixel_format_message(vs);
2129         vnc_unlock_output(vs);
2130         vnc_flush(vs);
2131     } else {
2132         set_pixel_conversion(vs);
2133     }
2134 }
2135 
2136 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2137 {
2138     int i;
2139     uint16_t limit;
2140     VncDisplay *vd = vs->vd;
2141 
2142     if (data[0] > 3) {
2143         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2144     }
2145 
2146     switch (data[0]) {
2147     case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2148         if (len == 1)
2149             return 20;
2150 
2151         set_pixel_format(vs, read_u8(data, 4),
2152                          read_u8(data, 6), read_u8(data, 7),
2153                          read_u16(data, 8), read_u16(data, 10),
2154                          read_u16(data, 12), read_u8(data, 14),
2155                          read_u8(data, 15), read_u8(data, 16));
2156         break;
2157     case VNC_MSG_CLIENT_SET_ENCODINGS:
2158         if (len == 1)
2159             return 4;
2160 
2161         if (len == 4) {
2162             limit = read_u16(data, 2);
2163             if (limit > 0)
2164                 return 4 + (limit * 4);
2165         } else
2166             limit = read_u16(data, 2);
2167 
2168         for (i = 0; i < limit; i++) {
2169             int32_t val = read_s32(data, 4 + (i * 4));
2170             memcpy(data + 4 + (i * 4), &val, sizeof(val));
2171         }
2172 
2173         set_encodings(vs, (int32_t *)(data + 4), limit);
2174         break;
2175     case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2176         if (len == 1)
2177             return 10;
2178 
2179         framebuffer_update_request(vs,
2180                                    read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2181                                    read_u16(data, 6), read_u16(data, 8));
2182         break;
2183     case VNC_MSG_CLIENT_KEY_EVENT:
2184         if (len == 1)
2185             return 8;
2186 
2187         key_event(vs, read_u8(data, 1), read_u32(data, 4));
2188         break;
2189     case VNC_MSG_CLIENT_POINTER_EVENT:
2190         if (len == 1)
2191             return 6;
2192 
2193         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2194         break;
2195     case VNC_MSG_CLIENT_CUT_TEXT:
2196         if (len == 1) {
2197             return 8;
2198         }
2199         if (len == 8) {
2200             uint32_t dlen = read_u32(data, 4);
2201             if (dlen > (1 << 20)) {
2202                 error_report("vnc: client_cut_text msg payload has %u bytes"
2203                              " which exceeds our limit of 1MB.", dlen);
2204                 vnc_client_error(vs);
2205                 break;
2206             }
2207             if (dlen > 0) {
2208                 return 8 + dlen;
2209             }
2210         }
2211 
2212         client_cut_text(vs, read_u32(data, 4), data + 8);
2213         break;
2214     case VNC_MSG_CLIENT_QEMU:
2215         if (len == 1)
2216             return 2;
2217 
2218         switch (read_u8(data, 1)) {
2219         case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2220             if (len == 2)
2221                 return 12;
2222 
2223             ext_key_event(vs, read_u16(data, 2),
2224                           read_u32(data, 4), read_u32(data, 8));
2225             break;
2226         case VNC_MSG_CLIENT_QEMU_AUDIO:
2227             if (len == 2)
2228                 return 4;
2229 
2230             switch (read_u16 (data, 2)) {
2231             case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2232                 audio_add(vs);
2233                 break;
2234             case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2235                 audio_del(vs);
2236                 break;
2237             case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2238                 if (len == 4)
2239                     return 10;
2240                 switch (read_u8(data, 4)) {
2241                 case 0: vs->as.fmt = AUD_FMT_U8; break;
2242                 case 1: vs->as.fmt = AUD_FMT_S8; break;
2243                 case 2: vs->as.fmt = AUD_FMT_U16; break;
2244                 case 3: vs->as.fmt = AUD_FMT_S16; break;
2245                 case 4: vs->as.fmt = AUD_FMT_U32; break;
2246                 case 5: vs->as.fmt = AUD_FMT_S32; break;
2247                 default:
2248                     VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2249                     vnc_client_error(vs);
2250                     break;
2251                 }
2252                 vs->as.nchannels = read_u8(data, 5);
2253                 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2254                     VNC_DEBUG("Invalid audio channel coount %d\n",
2255                               read_u8(data, 5));
2256                     vnc_client_error(vs);
2257                     break;
2258                 }
2259                 vs->as.freq = read_u32(data, 6);
2260                 break;
2261             default:
2262                 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2263                 vnc_client_error(vs);
2264                 break;
2265             }
2266             break;
2267 
2268         default:
2269             VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2270             vnc_client_error(vs);
2271             break;
2272         }
2273         break;
2274     default:
2275         VNC_DEBUG("Msg: %d\n", data[0]);
2276         vnc_client_error(vs);
2277         break;
2278     }
2279 
2280     vnc_read_when(vs, protocol_client_msg, 1);
2281     return 0;
2282 }
2283 
2284 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2285 {
2286     char buf[1024];
2287     VncShareMode mode;
2288     int size;
2289 
2290     mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2291     switch (vs->vd->share_policy) {
2292     case VNC_SHARE_POLICY_IGNORE:
2293         /*
2294          * Ignore the shared flag.  Nothing to do here.
2295          *
2296          * Doesn't conform to the rfb spec but is traditional qemu
2297          * behavior, thus left here as option for compatibility
2298          * reasons.
2299          */
2300         break;
2301     case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2302         /*
2303          * Policy: Allow clients ask for exclusive access.
2304          *
2305          * Implementation: When a client asks for exclusive access,
2306          * disconnect all others. Shared connects are allowed as long
2307          * as no exclusive connection exists.
2308          *
2309          * This is how the rfb spec suggests to handle the shared flag.
2310          */
2311         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2312             VncState *client;
2313             QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2314                 if (vs == client) {
2315                     continue;
2316                 }
2317                 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2318                     client->share_mode != VNC_SHARE_MODE_SHARED) {
2319                     continue;
2320                 }
2321                 vnc_disconnect_start(client);
2322             }
2323         }
2324         if (mode == VNC_SHARE_MODE_SHARED) {
2325             if (vs->vd->num_exclusive > 0) {
2326                 vnc_disconnect_start(vs);
2327                 return 0;
2328             }
2329         }
2330         break;
2331     case VNC_SHARE_POLICY_FORCE_SHARED:
2332         /*
2333          * Policy: Shared connects only.
2334          * Implementation: Disallow clients asking for exclusive access.
2335          *
2336          * Useful for shared desktop sessions where you don't want
2337          * someone forgetting to say -shared when running the vnc
2338          * client disconnect everybody else.
2339          */
2340         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2341             vnc_disconnect_start(vs);
2342             return 0;
2343         }
2344         break;
2345     }
2346     vnc_set_share_mode(vs, mode);
2347 
2348     if (vs->vd->num_shared > vs->vd->connections_limit) {
2349         vnc_disconnect_start(vs);
2350         return 0;
2351     }
2352 
2353     vs->client_width = pixman_image_get_width(vs->vd->server);
2354     vs->client_height = pixman_image_get_height(vs->vd->server);
2355     vnc_write_u16(vs, vs->client_width);
2356     vnc_write_u16(vs, vs->client_height);
2357 
2358     pixel_format_message(vs);
2359 
2360     if (qemu_name) {
2361         size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2362         if (size > sizeof(buf)) {
2363             size = sizeof(buf);
2364         }
2365     } else {
2366         size = snprintf(buf, sizeof(buf), "QEMU");
2367     }
2368 
2369     vnc_write_u32(vs, size);
2370     vnc_write(vs, buf, size);
2371     vnc_flush(vs);
2372 
2373     vnc_client_cache_auth(vs);
2374     vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2375 
2376     vnc_read_when(vs, protocol_client_msg, 1);
2377 
2378     return 0;
2379 }
2380 
2381 void start_client_init(VncState *vs)
2382 {
2383     vnc_read_when(vs, protocol_client_init, 1);
2384 }
2385 
2386 static void make_challenge(VncState *vs)
2387 {
2388     int i;
2389 
2390     srand(time(NULL)+getpid()+getpid()*987654+rand());
2391 
2392     for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2393         vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2394 }
2395 
2396 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2397 {
2398     unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2399     size_t i, pwlen;
2400     unsigned char key[8];
2401     time_t now = time(NULL);
2402     QCryptoCipher *cipher = NULL;
2403     Error *err = NULL;
2404 
2405     if (!vs->vd->password) {
2406         VNC_DEBUG("No password configured on server");
2407         goto reject;
2408     }
2409     if (vs->vd->expires < now) {
2410         VNC_DEBUG("Password is expired");
2411         goto reject;
2412     }
2413 
2414     memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2415 
2416     /* Calculate the expected challenge response */
2417     pwlen = strlen(vs->vd->password);
2418     for (i=0; i<sizeof(key); i++)
2419         key[i] = i<pwlen ? vs->vd->password[i] : 0;
2420 
2421     cipher = qcrypto_cipher_new(
2422         QCRYPTO_CIPHER_ALG_DES_RFB,
2423         QCRYPTO_CIPHER_MODE_ECB,
2424         key, G_N_ELEMENTS(key),
2425         &err);
2426     if (!cipher) {
2427         VNC_DEBUG("Cannot initialize cipher %s",
2428                   error_get_pretty(err));
2429         error_free(err);
2430         goto reject;
2431     }
2432 
2433     if (qcrypto_cipher_encrypt(cipher,
2434                                vs->challenge,
2435                                response,
2436                                VNC_AUTH_CHALLENGE_SIZE,
2437                                &err) < 0) {
2438         VNC_DEBUG("Cannot encrypt challenge %s",
2439                   error_get_pretty(err));
2440         error_free(err);
2441         goto reject;
2442     }
2443 
2444     /* Compare expected vs actual challenge response */
2445     if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2446         VNC_DEBUG("Client challenge response did not match\n");
2447         goto reject;
2448     } else {
2449         VNC_DEBUG("Accepting VNC challenge response\n");
2450         vnc_write_u32(vs, 0); /* Accept auth */
2451         vnc_flush(vs);
2452 
2453         start_client_init(vs);
2454     }
2455 
2456     qcrypto_cipher_free(cipher);
2457     return 0;
2458 
2459 reject:
2460     vnc_write_u32(vs, 1); /* Reject auth */
2461     if (vs->minor >= 8) {
2462         static const char err[] = "Authentication failed";
2463         vnc_write_u32(vs, sizeof(err));
2464         vnc_write(vs, err, sizeof(err));
2465     }
2466     vnc_flush(vs);
2467     vnc_client_error(vs);
2468     qcrypto_cipher_free(cipher);
2469     return 0;
2470 }
2471 
2472 void start_auth_vnc(VncState *vs)
2473 {
2474     make_challenge(vs);
2475     /* Send client a 'random' challenge */
2476     vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2477     vnc_flush(vs);
2478 
2479     vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2480 }
2481 
2482 
2483 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2484 {
2485     /* We only advertise 1 auth scheme at a time, so client
2486      * must pick the one we sent. Verify this */
2487     if (data[0] != vs->auth) { /* Reject auth */
2488        VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2489        vnc_write_u32(vs, 1);
2490        if (vs->minor >= 8) {
2491            static const char err[] = "Authentication failed";
2492            vnc_write_u32(vs, sizeof(err));
2493            vnc_write(vs, err, sizeof(err));
2494        }
2495        vnc_client_error(vs);
2496     } else { /* Accept requested auth */
2497        VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2498        switch (vs->auth) {
2499        case VNC_AUTH_NONE:
2500            VNC_DEBUG("Accept auth none\n");
2501            if (vs->minor >= 8) {
2502                vnc_write_u32(vs, 0); /* Accept auth completion */
2503                vnc_flush(vs);
2504            }
2505            start_client_init(vs);
2506            break;
2507 
2508        case VNC_AUTH_VNC:
2509            VNC_DEBUG("Start VNC auth\n");
2510            start_auth_vnc(vs);
2511            break;
2512 
2513        case VNC_AUTH_VENCRYPT:
2514            VNC_DEBUG("Accept VeNCrypt auth\n");
2515            start_auth_vencrypt(vs);
2516            break;
2517 
2518 #ifdef CONFIG_VNC_SASL
2519        case VNC_AUTH_SASL:
2520            VNC_DEBUG("Accept SASL auth\n");
2521            start_auth_sasl(vs);
2522            break;
2523 #endif /* CONFIG_VNC_SASL */
2524 
2525        default: /* Should not be possible, but just in case */
2526            VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2527            vnc_write_u8(vs, 1);
2528            if (vs->minor >= 8) {
2529                static const char err[] = "Authentication failed";
2530                vnc_write_u32(vs, sizeof(err));
2531                vnc_write(vs, err, sizeof(err));
2532            }
2533            vnc_client_error(vs);
2534        }
2535     }
2536     return 0;
2537 }
2538 
2539 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2540 {
2541     char local[13];
2542 
2543     memcpy(local, version, 12);
2544     local[12] = 0;
2545 
2546     if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2547         VNC_DEBUG("Malformed protocol version %s\n", local);
2548         vnc_client_error(vs);
2549         return 0;
2550     }
2551     VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2552     if (vs->major != 3 ||
2553         (vs->minor != 3 &&
2554          vs->minor != 4 &&
2555          vs->minor != 5 &&
2556          vs->minor != 7 &&
2557          vs->minor != 8)) {
2558         VNC_DEBUG("Unsupported client version\n");
2559         vnc_write_u32(vs, VNC_AUTH_INVALID);
2560         vnc_flush(vs);
2561         vnc_client_error(vs);
2562         return 0;
2563     }
2564     /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2565      * as equivalent to v3.3 by servers
2566      */
2567     if (vs->minor == 4 || vs->minor == 5)
2568         vs->minor = 3;
2569 
2570     if (vs->minor == 3) {
2571         if (vs->auth == VNC_AUTH_NONE) {
2572             VNC_DEBUG("Tell client auth none\n");
2573             vnc_write_u32(vs, vs->auth);
2574             vnc_flush(vs);
2575             start_client_init(vs);
2576        } else if (vs->auth == VNC_AUTH_VNC) {
2577             VNC_DEBUG("Tell client VNC auth\n");
2578             vnc_write_u32(vs, vs->auth);
2579             vnc_flush(vs);
2580             start_auth_vnc(vs);
2581        } else {
2582             VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2583             vnc_write_u32(vs, VNC_AUTH_INVALID);
2584             vnc_flush(vs);
2585             vnc_client_error(vs);
2586        }
2587     } else {
2588         VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2589         vnc_write_u8(vs, 1); /* num auth */
2590         vnc_write_u8(vs, vs->auth);
2591         vnc_read_when(vs, protocol_client_auth, 1);
2592         vnc_flush(vs);
2593     }
2594 
2595     return 0;
2596 }
2597 
2598 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2599 {
2600     struct VncSurface *vs = &vd->guest;
2601 
2602     return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2603 }
2604 
2605 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2606 {
2607     int i, j;
2608 
2609     w = (x + w) / VNC_STAT_RECT;
2610     h = (y + h) / VNC_STAT_RECT;
2611     x /= VNC_STAT_RECT;
2612     y /= VNC_STAT_RECT;
2613 
2614     for (j = y; j <= h; j++) {
2615         for (i = x; i <= w; i++) {
2616             vs->lossy_rect[j][i] = 1;
2617         }
2618     }
2619 }
2620 
2621 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2622 {
2623     VncState *vs;
2624     int sty = y / VNC_STAT_RECT;
2625     int stx = x / VNC_STAT_RECT;
2626     int has_dirty = 0;
2627 
2628     y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2629     x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2630 
2631     QTAILQ_FOREACH(vs, &vd->clients, next) {
2632         int j;
2633 
2634         /* kernel send buffers are full -> refresh later */
2635         if (vs->output.offset) {
2636             continue;
2637         }
2638 
2639         if (!vs->lossy_rect[sty][stx]) {
2640             continue;
2641         }
2642 
2643         vs->lossy_rect[sty][stx] = 0;
2644         for (j = 0; j < VNC_STAT_RECT; ++j) {
2645             bitmap_set(vs->dirty[y + j],
2646                        x / VNC_DIRTY_PIXELS_PER_BIT,
2647                        VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2648         }
2649         has_dirty++;
2650     }
2651 
2652     return has_dirty;
2653 }
2654 
2655 static int vnc_update_stats(VncDisplay *vd,  struct timeval * tv)
2656 {
2657     int width = MIN(pixman_image_get_width(vd->guest.fb),
2658                     pixman_image_get_width(vd->server));
2659     int height = MIN(pixman_image_get_height(vd->guest.fb),
2660                      pixman_image_get_height(vd->server));
2661     int x, y;
2662     struct timeval res;
2663     int has_dirty = 0;
2664 
2665     for (y = 0; y < height; y += VNC_STAT_RECT) {
2666         for (x = 0; x < width; x += VNC_STAT_RECT) {
2667             VncRectStat *rect = vnc_stat_rect(vd, x, y);
2668 
2669             rect->updated = false;
2670         }
2671     }
2672 
2673     qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2674 
2675     if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2676         return has_dirty;
2677     }
2678     vd->guest.last_freq_check = *tv;
2679 
2680     for (y = 0; y < height; y += VNC_STAT_RECT) {
2681         for (x = 0; x < width; x += VNC_STAT_RECT) {
2682             VncRectStat *rect= vnc_stat_rect(vd, x, y);
2683             int count = ARRAY_SIZE(rect->times);
2684             struct timeval min, max;
2685 
2686             if (!timerisset(&rect->times[count - 1])) {
2687                 continue ;
2688             }
2689 
2690             max = rect->times[(rect->idx + count - 1) % count];
2691             qemu_timersub(tv, &max, &res);
2692 
2693             if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2694                 rect->freq = 0;
2695                 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2696                 memset(rect->times, 0, sizeof (rect->times));
2697                 continue ;
2698             }
2699 
2700             min = rect->times[rect->idx];
2701             max = rect->times[(rect->idx + count - 1) % count];
2702             qemu_timersub(&max, &min, &res);
2703 
2704             rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2705             rect->freq /= count;
2706             rect->freq = 1. / rect->freq;
2707         }
2708     }
2709     return has_dirty;
2710 }
2711 
2712 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2713 {
2714     int i, j;
2715     double total = 0;
2716     int num = 0;
2717 
2718     x =  (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2719     y =  (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2720 
2721     for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2722         for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2723             total += vnc_stat_rect(vs->vd, i, j)->freq;
2724             num++;
2725         }
2726     }
2727 
2728     if (num) {
2729         return total / num;
2730     } else {
2731         return 0;
2732     }
2733 }
2734 
2735 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2736 {
2737     VncRectStat *rect;
2738 
2739     rect = vnc_stat_rect(vd, x, y);
2740     if (rect->updated) {
2741         return ;
2742     }
2743     rect->times[rect->idx] = *tv;
2744     rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2745     rect->updated = true;
2746 }
2747 
2748 static int vnc_refresh_server_surface(VncDisplay *vd)
2749 {
2750     int width = MIN(pixman_image_get_width(vd->guest.fb),
2751                     pixman_image_get_width(vd->server));
2752     int height = MIN(pixman_image_get_height(vd->guest.fb),
2753                      pixman_image_get_height(vd->server));
2754     int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2755     uint8_t *guest_row0 = NULL, *server_row0;
2756     VncState *vs;
2757     int has_dirty = 0;
2758     pixman_image_t *tmpbuf = NULL;
2759 
2760     struct timeval tv = { 0, 0 };
2761 
2762     if (!vd->non_adaptive) {
2763         gettimeofday(&tv, NULL);
2764         has_dirty = vnc_update_stats(vd, &tv);
2765     }
2766 
2767     /*
2768      * Walk through the guest dirty map.
2769      * Check and copy modified bits from guest to server surface.
2770      * Update server dirty map.
2771      */
2772     server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2773     server_stride = guest_stride = guest_ll =
2774         pixman_image_get_stride(vd->server);
2775     cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2776                     server_stride);
2777     if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2778         int width = pixman_image_get_width(vd->server);
2779         tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2780     } else {
2781         int guest_bpp =
2782             PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2783         guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2784         guest_stride = pixman_image_get_stride(vd->guest.fb);
2785         guest_ll = pixman_image_get_width(vd->guest.fb) * ((guest_bpp + 7) / 8);
2786     }
2787     line_bytes = MIN(server_stride, guest_ll);
2788 
2789     for (;;) {
2790         int x;
2791         uint8_t *guest_ptr, *server_ptr;
2792         unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2793                                              height * VNC_DIRTY_BPL(&vd->guest),
2794                                              y * VNC_DIRTY_BPL(&vd->guest));
2795         if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2796             /* no more dirty bits */
2797             break;
2798         }
2799         y = offset / VNC_DIRTY_BPL(&vd->guest);
2800         x = offset % VNC_DIRTY_BPL(&vd->guest);
2801 
2802         server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2803 
2804         if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2805             qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2806             guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2807         } else {
2808             guest_ptr = guest_row0 + y * guest_stride;
2809         }
2810         guest_ptr += x * cmp_bytes;
2811 
2812         for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2813              x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2814             int _cmp_bytes = cmp_bytes;
2815             if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2816                 continue;
2817             }
2818             if ((x + 1) * cmp_bytes > line_bytes) {
2819                 _cmp_bytes = line_bytes - x * cmp_bytes;
2820             }
2821             assert(_cmp_bytes >= 0);
2822             if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2823                 continue;
2824             }
2825             memcpy(server_ptr, guest_ptr, _cmp_bytes);
2826             if (!vd->non_adaptive) {
2827                 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2828                                  y, &tv);
2829             }
2830             QTAILQ_FOREACH(vs, &vd->clients, next) {
2831                 set_bit(x, vs->dirty[y]);
2832             }
2833             has_dirty++;
2834         }
2835 
2836         y++;
2837     }
2838     qemu_pixman_image_unref(tmpbuf);
2839     return has_dirty;
2840 }
2841 
2842 static void vnc_refresh(DisplayChangeListener *dcl)
2843 {
2844     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2845     VncState *vs, *vn;
2846     int has_dirty, rects = 0;
2847 
2848     if (QTAILQ_EMPTY(&vd->clients)) {
2849         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2850         return;
2851     }
2852 
2853     graphic_hw_update(vd->dcl.con);
2854 
2855     if (vnc_trylock_display(vd)) {
2856         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2857         return;
2858     }
2859 
2860     has_dirty = vnc_refresh_server_surface(vd);
2861     vnc_unlock_display(vd);
2862 
2863     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2864         rects += vnc_update_client(vs, has_dirty, false);
2865         /* vs might be free()ed here */
2866     }
2867 
2868     if (has_dirty && rects) {
2869         vd->dcl.update_interval /= 2;
2870         if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2871             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2872         }
2873     } else {
2874         vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2875         if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2876             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2877         }
2878     }
2879 }
2880 
2881 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
2882                         bool skipauth, bool websocket)
2883 {
2884     VncState *vs = g_new0(VncState, 1);
2885     bool first_client = QTAILQ_EMPTY(&vd->clients);
2886     int i;
2887 
2888     vs->sioc = sioc;
2889     object_ref(OBJECT(vs->sioc));
2890     vs->ioc = QIO_CHANNEL(sioc);
2891     object_ref(OBJECT(vs->ioc));
2892     vs->vd = vd;
2893 
2894     buffer_init(&vs->input,          "vnc-input/%p", sioc);
2895     buffer_init(&vs->output,         "vnc-output/%p", sioc);
2896     buffer_init(&vs->jobs_buffer,    "vnc-jobs_buffer/%p", sioc);
2897 
2898     buffer_init(&vs->tight.tight,    "vnc-tight/%p", sioc);
2899     buffer_init(&vs->tight.zlib,     "vnc-tight-zlib/%p", sioc);
2900     buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
2901 #ifdef CONFIG_VNC_JPEG
2902     buffer_init(&vs->tight.jpeg,     "vnc-tight-jpeg/%p", sioc);
2903 #endif
2904 #ifdef CONFIG_VNC_PNG
2905     buffer_init(&vs->tight.png,      "vnc-tight-png/%p", sioc);
2906 #endif
2907     buffer_init(&vs->zlib.zlib,      "vnc-zlib/%p", sioc);
2908     buffer_init(&vs->zrle.zrle,      "vnc-zrle/%p", sioc);
2909     buffer_init(&vs->zrle.fb,        "vnc-zrle-fb/%p", sioc);
2910     buffer_init(&vs->zrle.zlib,      "vnc-zrle-zlib/%p", sioc);
2911 
2912     if (skipauth) {
2913 	vs->auth = VNC_AUTH_NONE;
2914 	vs->subauth = VNC_AUTH_INVALID;
2915     } else {
2916         if (websocket) {
2917             vs->auth = vd->ws_auth;
2918             vs->subauth = VNC_AUTH_INVALID;
2919         } else {
2920             vs->auth = vd->auth;
2921             vs->subauth = vd->subauth;
2922         }
2923     }
2924     VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
2925               sioc, websocket, vs->auth, vs->subauth);
2926 
2927     vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2928     for (i = 0; i < VNC_STAT_ROWS; ++i) {
2929         vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
2930     }
2931 
2932     VNC_DEBUG("New client on socket %p\n", vs->sioc);
2933     update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2934     qio_channel_set_blocking(vs->ioc, false, NULL);
2935     if (websocket) {
2936         vs->websocket = 1;
2937         if (vd->tlscreds) {
2938             vs->ioc_tag = qio_channel_add_watch(
2939                 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
2940         } else {
2941             vs->ioc_tag = qio_channel_add_watch(
2942                 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
2943         }
2944     } else {
2945         vs->ioc_tag = qio_channel_add_watch(
2946             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
2947     }
2948 
2949     vnc_client_cache_addr(vs);
2950     vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
2951     vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2952 
2953     vs->last_x = -1;
2954     vs->last_y = -1;
2955 
2956     vs->as.freq = 44100;
2957     vs->as.nchannels = 2;
2958     vs->as.fmt = AUD_FMT_S16;
2959     vs->as.endianness = 0;
2960 
2961     qemu_mutex_init(&vs->output_mutex);
2962     vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2963 
2964     QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
2965     if (first_client) {
2966         vnc_update_server_surface(vd);
2967     }
2968 
2969     graphic_hw_update(vd->dcl.con);
2970 
2971     if (!vs->websocket) {
2972         vnc_start_protocol(vs);
2973     }
2974 
2975     if (vd->num_connecting > vd->connections_limit) {
2976         QTAILQ_FOREACH(vs, &vd->clients, next) {
2977             if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
2978                 vnc_disconnect_start(vs);
2979                 return;
2980             }
2981         }
2982     }
2983 }
2984 
2985 void vnc_start_protocol(VncState *vs)
2986 {
2987     vnc_write(vs, "RFB 003.008\n", 12);
2988     vnc_flush(vs);
2989     vnc_read_when(vs, protocol_version, 12);
2990 
2991     vs->mouse_mode_notifier.notify = check_pointer_type_change;
2992     qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2993 }
2994 
2995 static gboolean vnc_listen_io(QIOChannel *ioc,
2996                               GIOCondition condition,
2997                               void *opaque)
2998 {
2999     VncDisplay *vd = opaque;
3000     QIOChannelSocket *sioc = NULL;
3001     Error *err = NULL;
3002     bool isWebsock = false;
3003     size_t i;
3004 
3005     for (i = 0; i < vd->nlwebsock; i++) {
3006         if (ioc == QIO_CHANNEL(vd->lwebsock[i])) {
3007             isWebsock = true;
3008             break;
3009         }
3010     }
3011 
3012     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc), &err);
3013     if (sioc != NULL) {
3014         qio_channel_set_name(QIO_CHANNEL(sioc),
3015                              isWebsock ? "vnc-ws-server" : "vnc-server");
3016         qio_channel_set_delay(QIO_CHANNEL(sioc), false);
3017         vnc_connect(vd, sioc, false, isWebsock);
3018         object_unref(OBJECT(sioc));
3019     } else {
3020         /* client probably closed connection before we got there */
3021         error_free(err);
3022     }
3023 
3024     return TRUE;
3025 }
3026 
3027 static const DisplayChangeListenerOps dcl_ops = {
3028     .dpy_name             = "vnc",
3029     .dpy_refresh          = vnc_refresh,
3030     .dpy_gfx_update       = vnc_dpy_update,
3031     .dpy_gfx_switch       = vnc_dpy_switch,
3032     .dpy_gfx_check_format = qemu_pixman_check_format,
3033     .dpy_mouse_set        = vnc_mouse_set,
3034     .dpy_cursor_define    = vnc_dpy_cursor_define,
3035 };
3036 
3037 void vnc_display_init(const char *id)
3038 {
3039     VncDisplay *vd;
3040 
3041     if (vnc_display_find(id) != NULL) {
3042         return;
3043     }
3044     vd = g_malloc0(sizeof(*vd));
3045 
3046     vd->id = strdup(id);
3047     QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3048 
3049     QTAILQ_INIT(&vd->clients);
3050     vd->expires = TIME_MAX;
3051 
3052     if (keyboard_layout) {
3053         trace_vnc_key_map_init(keyboard_layout);
3054         vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3055     } else {
3056         vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3057     }
3058 
3059     if (!vd->kbd_layout) {
3060         exit(1);
3061     }
3062 
3063     vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3064     vd->connections_limit = 32;
3065 
3066     qemu_mutex_init(&vd->mutex);
3067     vnc_start_worker_thread();
3068 
3069     vd->dcl.ops = &dcl_ops;
3070     register_displaychangelistener(&vd->dcl);
3071 }
3072 
3073 
3074 static void vnc_display_close(VncDisplay *vd)
3075 {
3076     size_t i;
3077     if (!vd) {
3078         return;
3079     }
3080     vd->is_unix = false;
3081     for (i = 0; i < vd->nlsock; i++) {
3082         if (vd->lsock_tag[i]) {
3083             g_source_remove(vd->lsock_tag[i]);
3084         }
3085         object_unref(OBJECT(vd->lsock[i]));
3086     }
3087     g_free(vd->lsock);
3088     g_free(vd->lsock_tag);
3089     vd->lsock = NULL;
3090     vd->lsock_tag = NULL;
3091     vd->nlsock = 0;
3092 
3093     for (i = 0; i < vd->nlwebsock; i++) {
3094         if (vd->lwebsock_tag[i]) {
3095             g_source_remove(vd->lwebsock_tag[i]);
3096         }
3097         object_unref(OBJECT(vd->lwebsock[i]));
3098     }
3099     g_free(vd->lwebsock);
3100     g_free(vd->lwebsock_tag);
3101     vd->lwebsock = NULL;
3102     vd->lwebsock_tag = NULL;
3103     vd->nlwebsock = 0;
3104 
3105     vd->auth = VNC_AUTH_INVALID;
3106     vd->subauth = VNC_AUTH_INVALID;
3107     if (vd->tlscreds) {
3108         object_unparent(OBJECT(vd->tlscreds));
3109         vd->tlscreds = NULL;
3110     }
3111     g_free(vd->tlsaclname);
3112     vd->tlsaclname = NULL;
3113     if (vd->lock_key_sync) {
3114         qemu_remove_led_event_handler(vd->led);
3115         vd->led = NULL;
3116     }
3117 }
3118 
3119 int vnc_display_password(const char *id, const char *password)
3120 {
3121     VncDisplay *vd = vnc_display_find(id);
3122 
3123     if (!vd) {
3124         return -EINVAL;
3125     }
3126     if (vd->auth == VNC_AUTH_NONE) {
3127         error_printf_unless_qmp("If you want use passwords please enable "
3128                                 "password auth using '-vnc ${dpy},password'.\n");
3129         return -EINVAL;
3130     }
3131 
3132     g_free(vd->password);
3133     vd->password = g_strdup(password);
3134 
3135     return 0;
3136 }
3137 
3138 int vnc_display_pw_expire(const char *id, time_t expires)
3139 {
3140     VncDisplay *vd = vnc_display_find(id);
3141 
3142     if (!vd) {
3143         return -EINVAL;
3144     }
3145 
3146     vd->expires = expires;
3147     return 0;
3148 }
3149 
3150 static void vnc_display_print_local_addr(VncDisplay *vd)
3151 {
3152     SocketAddress *addr;
3153     Error *err = NULL;
3154 
3155     if (!vd->nlsock) {
3156         return;
3157     }
3158 
3159     addr = qio_channel_socket_get_local_address(vd->lsock[0], &err);
3160     if (!addr) {
3161         return;
3162     }
3163 
3164     if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3165         qapi_free_SocketAddress(addr);
3166         return;
3167     }
3168     error_printf_unless_qmp("VNC server running on %s:%s\n",
3169                             addr->u.inet.host,
3170                             addr->u.inet.port);
3171     qapi_free_SocketAddress(addr);
3172 }
3173 
3174 static QemuOptsList qemu_vnc_opts = {
3175     .name = "vnc",
3176     .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3177     .implied_opt_name = "vnc",
3178     .desc = {
3179         {
3180             .name = "vnc",
3181             .type = QEMU_OPT_STRING,
3182         },{
3183             .name = "websocket",
3184             .type = QEMU_OPT_STRING,
3185         },{
3186             .name = "tls-creds",
3187             .type = QEMU_OPT_STRING,
3188         },{
3189             /* Deprecated in favour of tls-creds */
3190             .name = "x509",
3191             .type = QEMU_OPT_STRING,
3192         },{
3193             .name = "share",
3194             .type = QEMU_OPT_STRING,
3195         },{
3196             .name = "display",
3197             .type = QEMU_OPT_STRING,
3198         },{
3199             .name = "head",
3200             .type = QEMU_OPT_NUMBER,
3201         },{
3202             .name = "connections",
3203             .type = QEMU_OPT_NUMBER,
3204         },{
3205             .name = "to",
3206             .type = QEMU_OPT_NUMBER,
3207         },{
3208             .name = "ipv4",
3209             .type = QEMU_OPT_BOOL,
3210         },{
3211             .name = "ipv6",
3212             .type = QEMU_OPT_BOOL,
3213         },{
3214             .name = "password",
3215             .type = QEMU_OPT_BOOL,
3216         },{
3217             .name = "reverse",
3218             .type = QEMU_OPT_BOOL,
3219         },{
3220             .name = "lock-key-sync",
3221             .type = QEMU_OPT_BOOL,
3222         },{
3223             .name = "key-delay-ms",
3224             .type = QEMU_OPT_NUMBER,
3225         },{
3226             .name = "sasl",
3227             .type = QEMU_OPT_BOOL,
3228         },{
3229             /* Deprecated in favour of tls-creds */
3230             .name = "tls",
3231             .type = QEMU_OPT_BOOL,
3232         },{
3233             /* Deprecated in favour of tls-creds */
3234             .name = "x509verify",
3235             .type = QEMU_OPT_STRING,
3236         },{
3237             .name = "acl",
3238             .type = QEMU_OPT_BOOL,
3239         },{
3240             .name = "lossy",
3241             .type = QEMU_OPT_BOOL,
3242         },{
3243             .name = "non-adaptive",
3244             .type = QEMU_OPT_BOOL,
3245         },
3246         { /* end of list */ }
3247     },
3248 };
3249 
3250 
3251 static int
3252 vnc_display_setup_auth(int *auth,
3253                        int *subauth,
3254                        QCryptoTLSCreds *tlscreds,
3255                        bool password,
3256                        bool sasl,
3257                        bool websocket,
3258                        Error **errp)
3259 {
3260     /*
3261      * We have a choice of 3 authentication options
3262      *
3263      *   1. none
3264      *   2. vnc
3265      *   3. sasl
3266      *
3267      * The channel can be run in 2 modes
3268      *
3269      *   1. clear
3270      *   2. tls
3271      *
3272      * And TLS can use 2 types of credentials
3273      *
3274      *   1. anon
3275      *   2. x509
3276      *
3277      * We thus have 9 possible logical combinations
3278      *
3279      *   1. clear + none
3280      *   2. clear + vnc
3281      *   3. clear + sasl
3282      *   4. tls + anon + none
3283      *   5. tls + anon + vnc
3284      *   6. tls + anon + sasl
3285      *   7. tls + x509 + none
3286      *   8. tls + x509 + vnc
3287      *   9. tls + x509 + sasl
3288      *
3289      * These need to be mapped into the VNC auth schemes
3290      * in an appropriate manner. In regular VNC, all the
3291      * TLS options get mapped into VNC_AUTH_VENCRYPT
3292      * sub-auth types.
3293      *
3294      * In websockets, the https:// protocol already provides
3295      * TLS support, so there is no need to make use of the
3296      * VeNCrypt extension. Furthermore, websockets browser
3297      * clients could not use VeNCrypt even if they wanted to,
3298      * as they cannot control when the TLS handshake takes
3299      * place. Thus there is no option but to rely on https://,
3300      * meaning combinations 4->6 and 7->9 will be mapped to
3301      * VNC auth schemes in the same way as combos 1->3.
3302      *
3303      * Regardless of fact that we have a different mapping to
3304      * VNC auth mechs for plain VNC vs websockets VNC, the end
3305      * result has the same security characteristics.
3306      */
3307     if (websocket || !tlscreds) {
3308         if (password) {
3309             VNC_DEBUG("Initializing VNC server with password auth\n");
3310             *auth = VNC_AUTH_VNC;
3311         } else if (sasl) {
3312             VNC_DEBUG("Initializing VNC server with SASL auth\n");
3313             *auth = VNC_AUTH_SASL;
3314         } else {
3315             VNC_DEBUG("Initializing VNC server with no auth\n");
3316             *auth = VNC_AUTH_NONE;
3317         }
3318         *subauth = VNC_AUTH_INVALID;
3319     } else {
3320         bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3321                                            TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3322         bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3323                                            TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3324 
3325         if (!is_x509 && !is_anon) {
3326             error_setg(errp,
3327                        "Unsupported TLS cred type %s",
3328                        object_get_typename(OBJECT(tlscreds)));
3329             return -1;
3330         }
3331         *auth = VNC_AUTH_VENCRYPT;
3332         if (password) {
3333             if (is_x509) {
3334                 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3335                 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3336             } else {
3337                 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3338                 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3339             }
3340 
3341         } else if (sasl) {
3342             if (is_x509) {
3343                 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3344                 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3345             } else {
3346                 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3347                 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3348             }
3349         } else {
3350             if (is_x509) {
3351                 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3352                 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3353             } else {
3354                 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3355                 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3356             }
3357         }
3358     }
3359     return 0;
3360 }
3361 
3362 
3363 /*
3364  * Handle back compat with old CLI syntax by creating some
3365  * suitable QCryptoTLSCreds objects
3366  */
3367 static QCryptoTLSCreds *
3368 vnc_display_create_creds(bool x509,
3369                          bool x509verify,
3370                          const char *dir,
3371                          const char *id,
3372                          Error **errp)
3373 {
3374     gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3375     Object *parent = object_get_objects_root();
3376     Object *creds;
3377     Error *err = NULL;
3378 
3379     if (x509) {
3380         creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3381                                       parent,
3382                                       credsid,
3383                                       &err,
3384                                       "endpoint", "server",
3385                                       "dir", dir,
3386                                       "verify-peer", x509verify ? "yes" : "no",
3387                                       NULL);
3388     } else {
3389         creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3390                                       parent,
3391                                       credsid,
3392                                       &err,
3393                                       "endpoint", "server",
3394                                       NULL);
3395     }
3396 
3397     g_free(credsid);
3398 
3399     if (err) {
3400         error_propagate(errp, err);
3401         return NULL;
3402     }
3403 
3404     return QCRYPTO_TLS_CREDS(creds);
3405 }
3406 
3407 
3408 static int vnc_display_get_address(const char *addrstr,
3409                                    bool websocket,
3410                                    bool reverse,
3411                                    int displaynum,
3412                                    int to,
3413                                    bool has_ipv4,
3414                                    bool has_ipv6,
3415                                    bool ipv4,
3416                                    bool ipv6,
3417                                    SocketAddress **retaddr,
3418                                    Error **errp)
3419 {
3420     int ret = -1;
3421     SocketAddress *addr = NULL;
3422 
3423     addr = g_new0(SocketAddress, 1);
3424 
3425     if (strncmp(addrstr, "unix:", 5) == 0) {
3426         addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3427         addr->u.q_unix.path = g_strdup(addrstr + 5);
3428 
3429         if (websocket) {
3430             error_setg(errp, "UNIX sockets not supported with websock");
3431             goto cleanup;
3432         }
3433 
3434         if (to) {
3435             error_setg(errp, "Port range not support with UNIX socket");
3436             goto cleanup;
3437         }
3438         ret = 0;
3439     } else {
3440         const char *port;
3441         size_t hostlen;
3442         unsigned long long baseport = 0;
3443         InetSocketAddress *inet;
3444 
3445         port = strrchr(addrstr, ':');
3446         if (!port) {
3447             if (websocket) {
3448                 hostlen = 0;
3449                 port = addrstr;
3450             } else {
3451                 error_setg(errp, "no vnc port specified");
3452                 goto cleanup;
3453             }
3454         } else {
3455             hostlen = port - addrstr;
3456             port++;
3457             if (*port == '\0') {
3458                 error_setg(errp, "vnc port cannot be empty");
3459                 goto cleanup;
3460             }
3461         }
3462 
3463         addr->type = SOCKET_ADDRESS_TYPE_INET;
3464         inet = &addr->u.inet;
3465         if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3466             inet->host = g_strndup(addrstr + 1, hostlen - 2);
3467         } else {
3468             inet->host = g_strndup(addrstr, hostlen);
3469         }
3470         /* plain VNC port is just an offset, for websocket
3471          * port is absolute */
3472         if (websocket) {
3473             if (g_str_equal(addrstr, "") ||
3474                 g_str_equal(addrstr, "on")) {
3475                 if (displaynum == -1) {
3476                     error_setg(errp, "explicit websocket port is required");
3477                     goto cleanup;
3478                 }
3479                 inet->port = g_strdup_printf(
3480                     "%d", displaynum + 5700);
3481                 if (to) {
3482                     inet->has_to = true;
3483                     inet->to = to + 5700;
3484                 }
3485             } else {
3486                 inet->port = g_strdup(port);
3487             }
3488         } else {
3489             int offset = reverse ? 0 : 5900;
3490             if (parse_uint_full(port, &baseport, 10) < 0) {
3491                 error_setg(errp, "can't convert to a number: %s", port);
3492                 goto cleanup;
3493             }
3494             if (baseport > 65535 ||
3495                 baseport + offset > 65535) {
3496                 error_setg(errp, "port %s out of range", port);
3497                 goto cleanup;
3498             }
3499             inet->port = g_strdup_printf(
3500                 "%d", (int)baseport + offset);
3501 
3502             if (to) {
3503                 inet->has_to = true;
3504                 inet->to = to + offset;
3505             }
3506         }
3507 
3508         inet->ipv4 = ipv4;
3509         inet->has_ipv4 = has_ipv4;
3510         inet->ipv6 = ipv6;
3511         inet->has_ipv6 = has_ipv6;
3512 
3513         ret = baseport;
3514     }
3515 
3516     *retaddr = addr;
3517 
3518  cleanup:
3519     if (ret < 0) {
3520         qapi_free_SocketAddress(addr);
3521     }
3522     return ret;
3523 }
3524 
3525 static int vnc_display_get_addresses(QemuOpts *opts,
3526                                      bool reverse,
3527                                      SocketAddress ***retsaddr,
3528                                      size_t *retnsaddr,
3529                                      SocketAddress ***retwsaddr,
3530                                      size_t *retnwsaddr,
3531                                      Error **errp)
3532 {
3533     SocketAddress *saddr = NULL;
3534     SocketAddress *wsaddr = NULL;
3535     QemuOptsIter addriter;
3536     const char *addr;
3537     int to = qemu_opt_get_number(opts, "to", 0);
3538     bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3539     bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3540     bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3541     bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3542     size_t i;
3543     int displaynum = -1;
3544     int ret = -1;
3545 
3546     *retsaddr = NULL;
3547     *retnsaddr = 0;
3548     *retwsaddr = NULL;
3549     *retnwsaddr = 0;
3550 
3551     addr = qemu_opt_get(opts, "vnc");
3552     if (addr == NULL || g_str_equal(addr, "none")) {
3553         ret = 0;
3554         goto cleanup;
3555     }
3556     if (qemu_opt_get(opts, "websocket") &&
3557         !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3558         error_setg(errp,
3559                    "SHA1 hash support is required for websockets");
3560         goto cleanup;
3561     }
3562 
3563     qemu_opt_iter_init(&addriter, opts, "vnc");
3564     while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3565         int rv;
3566         rv = vnc_display_get_address(addr, false, reverse, 0, to,
3567                                      has_ipv4, has_ipv6,
3568                                      ipv4, ipv6,
3569                                      &saddr, errp);
3570         if (rv < 0) {
3571             goto cleanup;
3572         }
3573         /* Historical compat - first listen address can be used
3574          * to set the default websocket port
3575          */
3576         if (displaynum == -1) {
3577             displaynum = rv;
3578         }
3579         *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3580         (*retsaddr)[(*retnsaddr)++] = saddr;
3581     }
3582 
3583     /* If we had multiple primary displays, we don't do defaults
3584      * for websocket, and require explicit config instead. */
3585     if (*retnsaddr > 1) {
3586         displaynum = -1;
3587     }
3588 
3589     qemu_opt_iter_init(&addriter, opts, "websocket");
3590     while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3591         if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3592                                     has_ipv4, has_ipv6,
3593                                     ipv4, ipv6,
3594                                     &wsaddr, errp) < 0) {
3595             goto cleanup;
3596         }
3597 
3598         /* Historical compat - if only a single listen address was
3599          * provided, then this is used to set the default listen
3600          * address for websocket too
3601          */
3602         if (*retnsaddr == 1 &&
3603             (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3604             wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3605             g_str_equal(wsaddr->u.inet.host, "") &&
3606             !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3607             g_free(wsaddr->u.inet.host);
3608             wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3609         }
3610 
3611         *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3612         (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3613     }
3614 
3615     ret = 0;
3616  cleanup:
3617     if (ret < 0) {
3618         for (i = 0; i < *retnsaddr; i++) {
3619             qapi_free_SocketAddress((*retsaddr)[i]);
3620         }
3621         g_free(*retsaddr);
3622         for (i = 0; i < *retnwsaddr; i++) {
3623             qapi_free_SocketAddress((*retwsaddr)[i]);
3624         }
3625         g_free(*retwsaddr);
3626         *retsaddr = *retwsaddr = NULL;
3627         *retnsaddr = *retnwsaddr = 0;
3628     }
3629     return ret;
3630 }
3631 
3632 static int vnc_display_connect(VncDisplay *vd,
3633                                SocketAddress **saddr,
3634                                size_t nsaddr,
3635                                SocketAddress **wsaddr,
3636                                size_t nwsaddr,
3637                                Error **errp)
3638 {
3639     /* connect to viewer */
3640     QIOChannelSocket *sioc = NULL;
3641     if (nwsaddr != 0) {
3642         error_setg(errp, "Cannot use websockets in reverse mode");
3643         return -1;
3644     }
3645     if (nsaddr != 1) {
3646         error_setg(errp, "Expected a single address in reverse mode");
3647         return -1;
3648     }
3649     /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3650     vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3651     sioc = qio_channel_socket_new();
3652     qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3653     if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3654         return -1;
3655     }
3656     vnc_connect(vd, sioc, false, false);
3657     object_unref(OBJECT(sioc));
3658     return 0;
3659 }
3660 
3661 
3662 static int vnc_display_listen_addr(VncDisplay *vd,
3663                                    SocketAddress *addr,
3664                                    const char *name,
3665                                    QIOChannelSocket ***lsock,
3666                                    guint **lsock_tag,
3667                                    size_t *nlsock,
3668                                    Error **errp)
3669 {
3670     QIODNSResolver *resolver = qio_dns_resolver_get_instance();
3671     SocketAddress **rawaddrs = NULL;
3672     size_t nrawaddrs = 0;
3673     Error *listenerr = NULL;
3674     bool listening = false;
3675     size_t i;
3676 
3677     if (qio_dns_resolver_lookup_sync(resolver, addr, &nrawaddrs,
3678                                      &rawaddrs, errp) < 0) {
3679         return -1;
3680     }
3681 
3682     for (i = 0; i < nrawaddrs; i++) {
3683         QIOChannelSocket *sioc = qio_channel_socket_new();
3684 
3685         qio_channel_set_name(QIO_CHANNEL(sioc), name);
3686         if (qio_channel_socket_listen_sync(
3687                 sioc, rawaddrs[i], listenerr == NULL ? &listenerr : NULL) < 0) {
3688             object_unref(OBJECT(sioc));
3689             continue;
3690         }
3691         listening = true;
3692         (*nlsock)++;
3693         *lsock = g_renew(QIOChannelSocket *, *lsock, *nlsock);
3694         *lsock_tag = g_renew(guint, *lsock_tag, *nlsock);
3695 
3696         (*lsock)[*nlsock - 1] = sioc;
3697         (*lsock_tag)[*nlsock - 1] = 0;
3698     }
3699 
3700     for (i = 0; i < nrawaddrs; i++) {
3701         qapi_free_SocketAddress(rawaddrs[i]);
3702     }
3703     g_free(rawaddrs);
3704 
3705     if (listenerr) {
3706         if (!listening) {
3707             error_propagate(errp, listenerr);
3708             return -1;
3709         } else {
3710             error_free(listenerr);
3711         }
3712     }
3713 
3714     for (i = 0; i < *nlsock; i++) {
3715         (*lsock_tag)[i] = qio_channel_add_watch(
3716             QIO_CHANNEL((*lsock)[i]),
3717             G_IO_IN, vnc_listen_io, vd, NULL);
3718     }
3719 
3720     return 0;
3721 }
3722 
3723 
3724 static int vnc_display_listen(VncDisplay *vd,
3725                               SocketAddress **saddr,
3726                               size_t nsaddr,
3727                               SocketAddress **wsaddr,
3728                               size_t nwsaddr,
3729                               Error **errp)
3730 {
3731     size_t i;
3732 
3733     for (i = 0; i < nsaddr; i++) {
3734         if (vnc_display_listen_addr(vd, saddr[i],
3735                                     "vnc-listen",
3736                                     &vd->lsock,
3737                                     &vd->lsock_tag,
3738                                     &vd->nlsock,
3739                                     errp) < 0) {
3740             return -1;
3741         }
3742     }
3743     for (i = 0; i < nwsaddr; i++) {
3744         if (vnc_display_listen_addr(vd, wsaddr[i],
3745                                     "vnc-ws-listen",
3746                                     &vd->lwebsock,
3747                                     &vd->lwebsock_tag,
3748                                     &vd->nlwebsock,
3749                                     errp) < 0) {
3750             return -1;
3751         }
3752     }
3753 
3754     return 0;
3755 }
3756 
3757 
3758 void vnc_display_open(const char *id, Error **errp)
3759 {
3760     VncDisplay *vd = vnc_display_find(id);
3761     QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3762     SocketAddress **saddr = NULL, **wsaddr = NULL;
3763     size_t nsaddr, nwsaddr;
3764     const char *share, *device_id;
3765     QemuConsole *con;
3766     bool password = false;
3767     bool reverse = false;
3768     const char *credid;
3769     bool sasl = false;
3770 #ifdef CONFIG_VNC_SASL
3771     int saslErr;
3772 #endif
3773     int acl = 0;
3774     int lock_key_sync = 1;
3775     int key_delay_ms;
3776     size_t i;
3777 
3778     if (!vd) {
3779         error_setg(errp, "VNC display not active");
3780         return;
3781     }
3782     vnc_display_close(vd);
3783 
3784     if (!opts) {
3785         return;
3786     }
3787 
3788     reverse = qemu_opt_get_bool(opts, "reverse", false);
3789     if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3790                                   &wsaddr, &nwsaddr, errp) < 0) {
3791         goto fail;
3792     }
3793 
3794     password = qemu_opt_get_bool(opts, "password", false);
3795     if (password) {
3796         if (fips_get_state()) {
3797             error_setg(errp,
3798                        "VNC password auth disabled due to FIPS mode, "
3799                        "consider using the VeNCrypt or SASL authentication "
3800                        "methods as an alternative");
3801             goto fail;
3802         }
3803         if (!qcrypto_cipher_supports(
3804                 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3805             error_setg(errp,
3806                        "Cipher backend does not support DES RFB algorithm");
3807             goto fail;
3808         }
3809     }
3810 
3811     lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3812     key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 1);
3813     sasl = qemu_opt_get_bool(opts, "sasl", false);
3814 #ifndef CONFIG_VNC_SASL
3815     if (sasl) {
3816         error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3817         goto fail;
3818     }
3819 #endif /* CONFIG_VNC_SASL */
3820     credid = qemu_opt_get(opts, "tls-creds");
3821     if (credid) {
3822         Object *creds;
3823         if (qemu_opt_get(opts, "tls") ||
3824             qemu_opt_get(opts, "x509") ||
3825             qemu_opt_get(opts, "x509verify")) {
3826             error_setg(errp,
3827                        "'tls-creds' parameter is mutually exclusive with "
3828                        "'tls', 'x509' and 'x509verify' parameters");
3829             goto fail;
3830         }
3831 
3832         creds = object_resolve_path_component(
3833             object_get_objects_root(), credid);
3834         if (!creds) {
3835             error_setg(errp, "No TLS credentials with id '%s'",
3836                        credid);
3837             goto fail;
3838         }
3839         vd->tlscreds = (QCryptoTLSCreds *)
3840             object_dynamic_cast(creds,
3841                                 TYPE_QCRYPTO_TLS_CREDS);
3842         if (!vd->tlscreds) {
3843             error_setg(errp, "Object with id '%s' is not TLS credentials",
3844                        credid);
3845             goto fail;
3846         }
3847         object_ref(OBJECT(vd->tlscreds));
3848 
3849         if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3850             error_setg(errp,
3851                        "Expecting TLS credentials with a server endpoint");
3852             goto fail;
3853         }
3854     } else {
3855         const char *path;
3856         bool tls = false, x509 = false, x509verify = false;
3857         tls  = qemu_opt_get_bool(opts, "tls", false);
3858         if (tls) {
3859             path = qemu_opt_get(opts, "x509");
3860 
3861             if (path) {
3862                 x509 = true;
3863             } else {
3864                 path = qemu_opt_get(opts, "x509verify");
3865                 if (path) {
3866                     x509 = true;
3867                     x509verify = true;
3868                 }
3869             }
3870             vd->tlscreds = vnc_display_create_creds(x509,
3871                                                     x509verify,
3872                                                     path,
3873                                                     vd->id,
3874                                                     errp);
3875             if (!vd->tlscreds) {
3876                 goto fail;
3877             }
3878         }
3879     }
3880     acl = qemu_opt_get_bool(opts, "acl", false);
3881 
3882     share = qemu_opt_get(opts, "share");
3883     if (share) {
3884         if (strcmp(share, "ignore") == 0) {
3885             vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3886         } else if (strcmp(share, "allow-exclusive") == 0) {
3887             vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3888         } else if (strcmp(share, "force-shared") == 0) {
3889             vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3890         } else {
3891             error_setg(errp, "unknown vnc share= option");
3892             goto fail;
3893         }
3894     } else {
3895         vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3896     }
3897     vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3898 
3899 #ifdef CONFIG_VNC_JPEG
3900     vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3901 #endif
3902     vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3903     /* adaptive updates are only used with tight encoding and
3904      * if lossy updates are enabled so we can disable all the
3905      * calculations otherwise */
3906     if (!vd->lossy) {
3907         vd->non_adaptive = true;
3908     }
3909 
3910     if (acl) {
3911         if (strcmp(vd->id, "default") == 0) {
3912             vd->tlsaclname = g_strdup("vnc.x509dname");
3913         } else {
3914             vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3915         }
3916         qemu_acl_init(vd->tlsaclname);
3917     }
3918 #ifdef CONFIG_VNC_SASL
3919     if (acl && sasl) {
3920         char *aclname;
3921 
3922         if (strcmp(vd->id, "default") == 0) {
3923             aclname = g_strdup("vnc.username");
3924         } else {
3925             aclname = g_strdup_printf("vnc.%s.username", vd->id);
3926         }
3927         vd->sasl.acl = qemu_acl_init(aclname);
3928         g_free(aclname);
3929     }
3930 #endif
3931 
3932     if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3933                                vd->tlscreds, password,
3934                                sasl, false, errp) < 0) {
3935         goto fail;
3936     }
3937 
3938     if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3939                                vd->tlscreds, password,
3940                                sasl, true, errp) < 0) {
3941         goto fail;
3942     }
3943 
3944 #ifdef CONFIG_VNC_SASL
3945     if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3946         error_setg(errp, "Failed to initialize SASL auth: %s",
3947                    sasl_errstring(saslErr, NULL, NULL));
3948         goto fail;
3949     }
3950 #endif
3951     vd->lock_key_sync = lock_key_sync;
3952     if (lock_key_sync) {
3953         vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3954     }
3955     vd->ledstate = 0;
3956     vd->key_delay_ms = key_delay_ms;
3957 
3958     device_id = qemu_opt_get(opts, "display");
3959     if (device_id) {
3960         int head = qemu_opt_get_number(opts, "head", 0);
3961         Error *err = NULL;
3962 
3963         con = qemu_console_lookup_by_device_name(device_id, head, &err);
3964         if (err) {
3965             error_propagate(errp, err);
3966             goto fail;
3967         }
3968     } else {
3969         con = NULL;
3970     }
3971 
3972     if (con != vd->dcl.con) {
3973         unregister_displaychangelistener(&vd->dcl);
3974         vd->dcl.con = con;
3975         register_displaychangelistener(&vd->dcl);
3976     }
3977 
3978     if (saddr == NULL) {
3979         goto cleanup;
3980     }
3981 
3982     if (reverse) {
3983         if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
3984             goto fail;
3985         }
3986     } else {
3987         if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
3988             goto fail;
3989         }
3990     }
3991 
3992     if (qemu_opt_get(opts, "to")) {
3993         vnc_display_print_local_addr(vd);
3994     }
3995 
3996  cleanup:
3997     for (i = 0; i < nsaddr; i++) {
3998         qapi_free_SocketAddress(saddr[i]);
3999     }
4000     for (i = 0; i < nwsaddr; i++) {
4001         qapi_free_SocketAddress(wsaddr[i]);
4002     }
4003     return;
4004 
4005 fail:
4006     vnc_display_close(vd);
4007     goto cleanup;
4008 }
4009 
4010 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4011 {
4012     VncDisplay *vd = vnc_display_find(id);
4013     QIOChannelSocket *sioc;
4014 
4015     if (!vd) {
4016         return;
4017     }
4018 
4019     sioc = qio_channel_socket_new_fd(csock, NULL);
4020     if (sioc) {
4021         qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4022         vnc_connect(vd, sioc, skipauth, false);
4023         object_unref(OBJECT(sioc));
4024     }
4025 }
4026 
4027 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4028 {
4029     int i = 2;
4030     char *id;
4031 
4032     id = g_strdup("default");
4033     while (qemu_opts_find(olist, id)) {
4034         g_free(id);
4035         id = g_strdup_printf("vnc%d", i++);
4036     }
4037     qemu_opts_set_id(opts, id);
4038 }
4039 
4040 QemuOpts *vnc_parse(const char *str, Error **errp)
4041 {
4042     QemuOptsList *olist = qemu_find_opts("vnc");
4043     QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4044     const char *id;
4045 
4046     if (!opts) {
4047         return NULL;
4048     }
4049 
4050     id = qemu_opts_id(opts);
4051     if (!id) {
4052         /* auto-assign id if not present */
4053         vnc_auto_assign_id(olist, opts);
4054     }
4055     return opts;
4056 }
4057 
4058 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4059 {
4060     Error *local_err = NULL;
4061     char *id = (char *)qemu_opts_id(opts);
4062 
4063     assert(id);
4064     vnc_display_init(id);
4065     vnc_display_open(id, &local_err);
4066     if (local_err != NULL) {
4067         error_reportf_err(local_err, "Failed to start VNC server: ");
4068         exit(1);
4069     }
4070     return 0;
4071 }
4072 
4073 static void vnc_register_config(void)
4074 {
4075     qemu_add_opts(&qemu_vnc_opts);
4076 }
4077 opts_init(vnc_register_config);
4078