xref: /openbmc/qemu/ui/vnc.c (revision 83974cf4)
1 /*
2  * QEMU VNC display driver
3  *
4  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5  * Copyright (C) 2006 Fabrice Bellard
6  * Copyright (C) 2009 Red Hat, Inc
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/sockets.h"
34 #include "qemu/timer.h"
35 #include "qemu/acl.h"
36 #include "qemu/config-file.h"
37 #include "qapi/qmp/qerror.h"
38 #include "qapi/qmp/types.h"
39 #include "qmp-commands.h"
40 #include "ui/input.h"
41 #include "qapi-event.h"
42 #include "crypto/hash.h"
43 #include "crypto/tlscredsanon.h"
44 #include "crypto/tlscredsx509.h"
45 #include "qom/object_interfaces.h"
46 #include "qemu/cutils.h"
47 #include "io/dns-resolver.h"
48 
49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
50 #define VNC_REFRESH_INTERVAL_INC  50
51 #define VNC_REFRESH_INTERVAL_MAX  GUI_REFRESH_INTERVAL_IDLE
52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
54 
55 #include "vnc_keysym.h"
56 #include "crypto/cipher.h"
57 
58 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59     QTAILQ_HEAD_INITIALIZER(vnc_displays);
60 
61 static int vnc_cursor_define(VncState *vs);
62 static void vnc_release_modifiers(VncState *vs);
63 
64 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
65 {
66 #ifdef _VNC_DEBUG
67     static const char *mn[] = {
68         [0]                           = "undefined",
69         [VNC_SHARE_MODE_CONNECTING]   = "connecting",
70         [VNC_SHARE_MODE_SHARED]       = "shared",
71         [VNC_SHARE_MODE_EXCLUSIVE]    = "exclusive",
72         [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
73     };
74     fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
75             vs->ioc, mn[vs->share_mode], mn[mode]);
76 #endif
77 
78     switch (vs->share_mode) {
79     case VNC_SHARE_MODE_CONNECTING:
80         vs->vd->num_connecting--;
81         break;
82     case VNC_SHARE_MODE_SHARED:
83         vs->vd->num_shared--;
84         break;
85     case VNC_SHARE_MODE_EXCLUSIVE:
86         vs->vd->num_exclusive--;
87         break;
88     default:
89         break;
90     }
91 
92     vs->share_mode = mode;
93 
94     switch (vs->share_mode) {
95     case VNC_SHARE_MODE_CONNECTING:
96         vs->vd->num_connecting++;
97         break;
98     case VNC_SHARE_MODE_SHARED:
99         vs->vd->num_shared++;
100         break;
101     case VNC_SHARE_MODE_EXCLUSIVE:
102         vs->vd->num_exclusive++;
103         break;
104     default:
105         break;
106     }
107 }
108 
109 
110 static void vnc_init_basic_info(SocketAddress *addr,
111                                 VncBasicInfo *info,
112                                 Error **errp)
113 {
114     switch (addr->type) {
115     case SOCKET_ADDRESS_TYPE_INET:
116         info->host = g_strdup(addr->u.inet.host);
117         info->service = g_strdup(addr->u.inet.port);
118         if (addr->u.inet.ipv6) {
119             info->family = NETWORK_ADDRESS_FAMILY_IPV6;
120         } else {
121             info->family = NETWORK_ADDRESS_FAMILY_IPV4;
122         }
123         break;
124 
125     case SOCKET_ADDRESS_TYPE_UNIX:
126         info->host = g_strdup("");
127         info->service = g_strdup(addr->u.q_unix.path);
128         info->family = NETWORK_ADDRESS_FAMILY_UNIX;
129         break;
130 
131     case SOCKET_ADDRESS_TYPE_VSOCK:
132     case SOCKET_ADDRESS_TYPE_FD:
133         error_setg(errp, "Unsupported socket address type %s",
134                    SocketAddressType_str(addr->type));
135         break;
136     default:
137         abort();
138     }
139 
140     return;
141 }
142 
143 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
144                                                  VncBasicInfo *info,
145                                                  Error **errp)
146 {
147     SocketAddress *addr = NULL;
148 
149     if (!ioc) {
150         error_setg(errp, "No listener socket available");
151         return;
152     }
153 
154     addr = qio_channel_socket_get_local_address(ioc, errp);
155     if (!addr) {
156         return;
157     }
158 
159     vnc_init_basic_info(addr, info, errp);
160     qapi_free_SocketAddress(addr);
161 }
162 
163 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
164                                                  VncBasicInfo *info,
165                                                  Error **errp)
166 {
167     SocketAddress *addr = NULL;
168 
169     addr = qio_channel_socket_get_remote_address(ioc, errp);
170     if (!addr) {
171         return;
172     }
173 
174     vnc_init_basic_info(addr, info, errp);
175     qapi_free_SocketAddress(addr);
176 }
177 
178 static const char *vnc_auth_name(VncDisplay *vd) {
179     switch (vd->auth) {
180     case VNC_AUTH_INVALID:
181         return "invalid";
182     case VNC_AUTH_NONE:
183         return "none";
184     case VNC_AUTH_VNC:
185         return "vnc";
186     case VNC_AUTH_RA2:
187         return "ra2";
188     case VNC_AUTH_RA2NE:
189         return "ra2ne";
190     case VNC_AUTH_TIGHT:
191         return "tight";
192     case VNC_AUTH_ULTRA:
193         return "ultra";
194     case VNC_AUTH_TLS:
195         return "tls";
196     case VNC_AUTH_VENCRYPT:
197         switch (vd->subauth) {
198         case VNC_AUTH_VENCRYPT_PLAIN:
199             return "vencrypt+plain";
200         case VNC_AUTH_VENCRYPT_TLSNONE:
201             return "vencrypt+tls+none";
202         case VNC_AUTH_VENCRYPT_TLSVNC:
203             return "vencrypt+tls+vnc";
204         case VNC_AUTH_VENCRYPT_TLSPLAIN:
205             return "vencrypt+tls+plain";
206         case VNC_AUTH_VENCRYPT_X509NONE:
207             return "vencrypt+x509+none";
208         case VNC_AUTH_VENCRYPT_X509VNC:
209             return "vencrypt+x509+vnc";
210         case VNC_AUTH_VENCRYPT_X509PLAIN:
211             return "vencrypt+x509+plain";
212         case VNC_AUTH_VENCRYPT_TLSSASL:
213             return "vencrypt+tls+sasl";
214         case VNC_AUTH_VENCRYPT_X509SASL:
215             return "vencrypt+x509+sasl";
216         default:
217             return "vencrypt";
218         }
219     case VNC_AUTH_SASL:
220         return "sasl";
221     }
222     return "unknown";
223 }
224 
225 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
226 {
227     VncServerInfo *info;
228     Error *err = NULL;
229 
230     if (!vd->nlsock) {
231         return NULL;
232     }
233 
234     info = g_malloc0(sizeof(*info));
235     vnc_init_basic_info_from_server_addr(vd->lsock[0],
236                                          qapi_VncServerInfo_base(info), &err);
237     info->has_auth = true;
238     info->auth = g_strdup(vnc_auth_name(vd));
239     if (err) {
240         qapi_free_VncServerInfo(info);
241         info = NULL;
242         error_free(err);
243     }
244     return info;
245 }
246 
247 static void vnc_client_cache_auth(VncState *client)
248 {
249     if (!client->info) {
250         return;
251     }
252 
253     if (client->tls) {
254         client->info->x509_dname =
255             qcrypto_tls_session_get_peer_name(client->tls);
256         client->info->has_x509_dname =
257             client->info->x509_dname != NULL;
258     }
259 #ifdef CONFIG_VNC_SASL
260     if (client->sasl.conn &&
261         client->sasl.username) {
262         client->info->has_sasl_username = true;
263         client->info->sasl_username = g_strdup(client->sasl.username);
264     }
265 #endif
266 }
267 
268 static void vnc_client_cache_addr(VncState *client)
269 {
270     Error *err = NULL;
271 
272     client->info = g_malloc0(sizeof(*client->info));
273     vnc_init_basic_info_from_remote_addr(client->sioc,
274                                          qapi_VncClientInfo_base(client->info),
275                                          &err);
276     if (err) {
277         qapi_free_VncClientInfo(client->info);
278         client->info = NULL;
279         error_free(err);
280     }
281 }
282 
283 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
284 {
285     VncServerInfo *si;
286 
287     if (!vs->info) {
288         return;
289     }
290 
291     si = vnc_server_info_get(vs->vd);
292     if (!si) {
293         return;
294     }
295 
296     switch (event) {
297     case QAPI_EVENT_VNC_CONNECTED:
298         qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
299                                       &error_abort);
300         break;
301     case QAPI_EVENT_VNC_INITIALIZED:
302         qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
303         break;
304     case QAPI_EVENT_VNC_DISCONNECTED:
305         qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
306         break;
307     default:
308         break;
309     }
310 
311     qapi_free_VncServerInfo(si);
312 }
313 
314 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
315 {
316     VncClientInfo *info;
317     Error *err = NULL;
318 
319     info = g_malloc0(sizeof(*info));
320 
321     vnc_init_basic_info_from_remote_addr(client->sioc,
322                                          qapi_VncClientInfo_base(info),
323                                          &err);
324     if (err) {
325         error_free(err);
326         qapi_free_VncClientInfo(info);
327         return NULL;
328     }
329 
330     info->websocket = client->websocket;
331 
332     if (client->tls) {
333         info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
334         info->has_x509_dname = info->x509_dname != NULL;
335     }
336 #ifdef CONFIG_VNC_SASL
337     if (client->sasl.conn && client->sasl.username) {
338         info->has_sasl_username = true;
339         info->sasl_username = g_strdup(client->sasl.username);
340     }
341 #endif
342 
343     return info;
344 }
345 
346 static VncDisplay *vnc_display_find(const char *id)
347 {
348     VncDisplay *vd;
349 
350     if (id == NULL) {
351         return QTAILQ_FIRST(&vnc_displays);
352     }
353     QTAILQ_FOREACH(vd, &vnc_displays, next) {
354         if (strcmp(id, vd->id) == 0) {
355             return vd;
356         }
357     }
358     return NULL;
359 }
360 
361 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
362 {
363     VncClientInfoList *cinfo, *prev = NULL;
364     VncState *client;
365 
366     QTAILQ_FOREACH(client, &vd->clients, next) {
367         cinfo = g_new0(VncClientInfoList, 1);
368         cinfo->value = qmp_query_vnc_client(client);
369         cinfo->next = prev;
370         prev = cinfo;
371     }
372     return prev;
373 }
374 
375 VncInfo *qmp_query_vnc(Error **errp)
376 {
377     VncInfo *info = g_malloc0(sizeof(*info));
378     VncDisplay *vd = vnc_display_find(NULL);
379     SocketAddress *addr = NULL;
380 
381     if (vd == NULL || !vd->nlsock) {
382         info->enabled = false;
383     } else {
384         info->enabled = true;
385 
386         /* for compatibility with the original command */
387         info->has_clients = true;
388         info->clients = qmp_query_client_list(vd);
389 
390         if (vd->lsock == NULL) {
391             return info;
392         }
393 
394         addr = qio_channel_socket_get_local_address(vd->lsock[0], errp);
395         if (!addr) {
396             goto out_error;
397         }
398 
399         switch (addr->type) {
400         case SOCKET_ADDRESS_TYPE_INET:
401             info->host = g_strdup(addr->u.inet.host);
402             info->service = g_strdup(addr->u.inet.port);
403             if (addr->u.inet.ipv6) {
404                 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
405             } else {
406                 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
407             }
408             break;
409 
410         case SOCKET_ADDRESS_TYPE_UNIX:
411             info->host = g_strdup("");
412             info->service = g_strdup(addr->u.q_unix.path);
413             info->family = NETWORK_ADDRESS_FAMILY_UNIX;
414             break;
415 
416         case SOCKET_ADDRESS_TYPE_VSOCK:
417         case SOCKET_ADDRESS_TYPE_FD:
418             error_setg(errp, "Unsupported socket address type %s",
419                        SocketAddressType_str(addr->type));
420             goto out_error;
421         default:
422             abort();
423         }
424 
425         info->has_host = true;
426         info->has_service = true;
427         info->has_family = true;
428 
429         info->has_auth = true;
430         info->auth = g_strdup(vnc_auth_name(vd));
431     }
432 
433     qapi_free_SocketAddress(addr);
434     return info;
435 
436 out_error:
437     qapi_free_SocketAddress(addr);
438     qapi_free_VncInfo(info);
439     return NULL;
440 }
441 
442 
443 static void qmp_query_auth(int auth, int subauth,
444                            VncPrimaryAuth *qmp_auth,
445                            VncVencryptSubAuth *qmp_vencrypt,
446                            bool *qmp_has_vencrypt);
447 
448 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
449                                                   bool websocket,
450                                                   int auth,
451                                                   int subauth,
452                                                   VncServerInfo2List *prev)
453 {
454     VncServerInfo2List *list;
455     VncServerInfo2 *info;
456     Error *err = NULL;
457     SocketAddress *addr;
458 
459     addr = qio_channel_socket_get_local_address(ioc, &err);
460     if (!addr) {
461         error_free(err);
462         return prev;
463     }
464 
465     info = g_new0(VncServerInfo2, 1);
466     vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
467     qapi_free_SocketAddress(addr);
468     if (err) {
469         qapi_free_VncServerInfo2(info);
470         error_free(err);
471         return prev;
472     }
473     info->websocket = websocket;
474 
475     qmp_query_auth(auth, subauth, &info->auth,
476                    &info->vencrypt, &info->has_vencrypt);
477 
478     list = g_new0(VncServerInfo2List, 1);
479     list->value = info;
480     list->next = prev;
481     return list;
482 }
483 
484 static void qmp_query_auth(int auth, int subauth,
485                            VncPrimaryAuth *qmp_auth,
486                            VncVencryptSubAuth *qmp_vencrypt,
487                            bool *qmp_has_vencrypt)
488 {
489     switch (auth) {
490     case VNC_AUTH_VNC:
491         *qmp_auth = VNC_PRIMARY_AUTH_VNC;
492         break;
493     case VNC_AUTH_RA2:
494         *qmp_auth = VNC_PRIMARY_AUTH_RA2;
495         break;
496     case VNC_AUTH_RA2NE:
497         *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
498         break;
499     case VNC_AUTH_TIGHT:
500         *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
501         break;
502     case VNC_AUTH_ULTRA:
503         *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
504         break;
505     case VNC_AUTH_TLS:
506         *qmp_auth = VNC_PRIMARY_AUTH_TLS;
507         break;
508     case VNC_AUTH_VENCRYPT:
509         *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
510         *qmp_has_vencrypt = true;
511         switch (subauth) {
512         case VNC_AUTH_VENCRYPT_PLAIN:
513             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
514             break;
515         case VNC_AUTH_VENCRYPT_TLSNONE:
516             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
517             break;
518         case VNC_AUTH_VENCRYPT_TLSVNC:
519             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
520             break;
521         case VNC_AUTH_VENCRYPT_TLSPLAIN:
522             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
523             break;
524         case VNC_AUTH_VENCRYPT_X509NONE:
525             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
526             break;
527         case VNC_AUTH_VENCRYPT_X509VNC:
528             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
529             break;
530         case VNC_AUTH_VENCRYPT_X509PLAIN:
531             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
532             break;
533         case VNC_AUTH_VENCRYPT_TLSSASL:
534             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
535             break;
536         case VNC_AUTH_VENCRYPT_X509SASL:
537             *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
538             break;
539         default:
540             *qmp_has_vencrypt = false;
541             break;
542         }
543         break;
544     case VNC_AUTH_SASL:
545         *qmp_auth = VNC_PRIMARY_AUTH_SASL;
546         break;
547     case VNC_AUTH_NONE:
548     default:
549         *qmp_auth = VNC_PRIMARY_AUTH_NONE;
550         break;
551     }
552 }
553 
554 VncInfo2List *qmp_query_vnc_servers(Error **errp)
555 {
556     VncInfo2List *item, *prev = NULL;
557     VncInfo2 *info;
558     VncDisplay *vd;
559     DeviceState *dev;
560     size_t i;
561 
562     QTAILQ_FOREACH(vd, &vnc_displays, next) {
563         info = g_new0(VncInfo2, 1);
564         info->id = g_strdup(vd->id);
565         info->clients = qmp_query_client_list(vd);
566         qmp_query_auth(vd->auth, vd->subauth, &info->auth,
567                        &info->vencrypt, &info->has_vencrypt);
568         if (vd->dcl.con) {
569             dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
570                                                   "device", NULL));
571             info->has_display = true;
572             info->display = g_strdup(dev->id);
573         }
574         for (i = 0; i < vd->nlsock; i++) {
575             info->server = qmp_query_server_entry(
576                 vd->lsock[i], false, vd->auth, vd->subauth, info->server);
577         }
578         for (i = 0; i < vd->nlwebsock; i++) {
579             info->server = qmp_query_server_entry(
580                 vd->lwebsock[i], true, vd->ws_auth,
581                 vd->ws_subauth, info->server);
582         }
583 
584         item = g_new0(VncInfo2List, 1);
585         item->value = info;
586         item->next = prev;
587         prev = item;
588     }
589     return prev;
590 }
591 
592 /* TODO
593    1) Get the queue working for IO.
594    2) there is some weirdness when using the -S option (the screen is grey
595       and not totally invalidated
596    3) resolutions > 1024
597 */
598 
599 static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
600 static void vnc_disconnect_start(VncState *vs);
601 
602 static void vnc_colordepth(VncState *vs);
603 static void framebuffer_update_request(VncState *vs, int incremental,
604                                        int x_position, int y_position,
605                                        int w, int h);
606 static void vnc_refresh(DisplayChangeListener *dcl);
607 static int vnc_refresh_server_surface(VncDisplay *vd);
608 
609 static int vnc_width(VncDisplay *vd)
610 {
611     return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
612                                        VNC_DIRTY_PIXELS_PER_BIT));
613 }
614 
615 static int vnc_height(VncDisplay *vd)
616 {
617     return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
618 }
619 
620 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
621                                VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
622                                VncDisplay *vd,
623                                int x, int y, int w, int h)
624 {
625     int width = vnc_width(vd);
626     int height = vnc_height(vd);
627 
628     /* this is needed this to ensure we updated all affected
629      * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
630     w += (x % VNC_DIRTY_PIXELS_PER_BIT);
631     x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
632 
633     x = MIN(x, width);
634     y = MIN(y, height);
635     w = MIN(x + w, width) - x;
636     h = MIN(y + h, height);
637 
638     for (; y < h; y++) {
639         bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
640                    DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
641     }
642 }
643 
644 static void vnc_dpy_update(DisplayChangeListener *dcl,
645                            int x, int y, int w, int h)
646 {
647     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
648     struct VncSurface *s = &vd->guest;
649 
650     vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
651 }
652 
653 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
654                             int32_t encoding)
655 {
656     vnc_write_u16(vs, x);
657     vnc_write_u16(vs, y);
658     vnc_write_u16(vs, w);
659     vnc_write_u16(vs, h);
660 
661     vnc_write_s32(vs, encoding);
662 }
663 
664 
665 static void vnc_desktop_resize(VncState *vs)
666 {
667     if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
668         return;
669     }
670     if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
671         vs->client_height == pixman_image_get_height(vs->vd->server)) {
672         return;
673     }
674     vs->client_width = pixman_image_get_width(vs->vd->server);
675     vs->client_height = pixman_image_get_height(vs->vd->server);
676     vnc_lock_output(vs);
677     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
678     vnc_write_u8(vs, 0);
679     vnc_write_u16(vs, 1); /* number of rects */
680     vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
681                            VNC_ENCODING_DESKTOPRESIZE);
682     vnc_unlock_output(vs);
683     vnc_flush(vs);
684 }
685 
686 static void vnc_abort_display_jobs(VncDisplay *vd)
687 {
688     VncState *vs;
689 
690     QTAILQ_FOREACH(vs, &vd->clients, next) {
691         vnc_lock_output(vs);
692         vs->abort = true;
693         vnc_unlock_output(vs);
694     }
695     QTAILQ_FOREACH(vs, &vd->clients, next) {
696         vnc_jobs_join(vs);
697     }
698     QTAILQ_FOREACH(vs, &vd->clients, next) {
699         vnc_lock_output(vs);
700         vs->abort = false;
701         vnc_unlock_output(vs);
702     }
703 }
704 
705 int vnc_server_fb_stride(VncDisplay *vd)
706 {
707     return pixman_image_get_stride(vd->server);
708 }
709 
710 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
711 {
712     uint8_t *ptr;
713 
714     ptr  = (uint8_t *)pixman_image_get_data(vd->server);
715     ptr += y * vnc_server_fb_stride(vd);
716     ptr += x * VNC_SERVER_FB_BYTES;
717     return ptr;
718 }
719 
720 static void vnc_update_server_surface(VncDisplay *vd)
721 {
722     int width, height;
723 
724     qemu_pixman_image_unref(vd->server);
725     vd->server = NULL;
726 
727     if (QTAILQ_EMPTY(&vd->clients)) {
728         return;
729     }
730 
731     width = vnc_width(vd);
732     height = vnc_height(vd);
733     vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
734                                           width, height,
735                                           NULL, 0);
736 
737     memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
738     vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
739                        width, height);
740 }
741 
742 static void vnc_dpy_switch(DisplayChangeListener *dcl,
743                            DisplaySurface *surface)
744 {
745     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
746     VncState *vs;
747 
748     vnc_abort_display_jobs(vd);
749     vd->ds = surface;
750 
751     /* server surface */
752     vnc_update_server_surface(vd);
753 
754     /* guest surface */
755     qemu_pixman_image_unref(vd->guest.fb);
756     vd->guest.fb = pixman_image_ref(surface->image);
757     vd->guest.format = surface->format;
758 
759     QTAILQ_FOREACH(vs, &vd->clients, next) {
760         vnc_colordepth(vs);
761         vnc_desktop_resize(vs);
762         if (vs->vd->cursor) {
763             vnc_cursor_define(vs);
764         }
765         memset(vs->dirty, 0x00, sizeof(vs->dirty));
766         vnc_set_area_dirty(vs->dirty, vd, 0, 0,
767                            vnc_width(vd),
768                            vnc_height(vd));
769     }
770 }
771 
772 /* fastest code */
773 static void vnc_write_pixels_copy(VncState *vs,
774                                   void *pixels, int size)
775 {
776     vnc_write(vs, pixels, size);
777 }
778 
779 /* slowest but generic code. */
780 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
781 {
782     uint8_t r, g, b;
783 
784 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
785     r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
786     g = (((v & 0x0000ff00) >>  8) << vs->client_pf.gbits) >> 8;
787     b = (((v & 0x000000ff) >>  0) << vs->client_pf.bbits) >> 8;
788 #else
789 # error need some bits here if you change VNC_SERVER_FB_FORMAT
790 #endif
791     v = (r << vs->client_pf.rshift) |
792         (g << vs->client_pf.gshift) |
793         (b << vs->client_pf.bshift);
794     switch (vs->client_pf.bytes_per_pixel) {
795     case 1:
796         buf[0] = v;
797         break;
798     case 2:
799         if (vs->client_be) {
800             buf[0] = v >> 8;
801             buf[1] = v;
802         } else {
803             buf[1] = v >> 8;
804             buf[0] = v;
805         }
806         break;
807     default:
808     case 4:
809         if (vs->client_be) {
810             buf[0] = v >> 24;
811             buf[1] = v >> 16;
812             buf[2] = v >> 8;
813             buf[3] = v;
814         } else {
815             buf[3] = v >> 24;
816             buf[2] = v >> 16;
817             buf[1] = v >> 8;
818             buf[0] = v;
819         }
820         break;
821     }
822 }
823 
824 static void vnc_write_pixels_generic(VncState *vs,
825                                      void *pixels1, int size)
826 {
827     uint8_t buf[4];
828 
829     if (VNC_SERVER_FB_BYTES == 4) {
830         uint32_t *pixels = pixels1;
831         int n, i;
832         n = size >> 2;
833         for (i = 0; i < n; i++) {
834             vnc_convert_pixel(vs, buf, pixels[i]);
835             vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
836         }
837     }
838 }
839 
840 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
841 {
842     int i;
843     uint8_t *row;
844     VncDisplay *vd = vs->vd;
845 
846     row = vnc_server_fb_ptr(vd, x, y);
847     for (i = 0; i < h; i++) {
848         vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
849         row += vnc_server_fb_stride(vd);
850     }
851     return 1;
852 }
853 
854 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
855 {
856     int n = 0;
857     bool encode_raw = false;
858     size_t saved_offs = vs->output.offset;
859 
860     switch(vs->vnc_encoding) {
861         case VNC_ENCODING_ZLIB:
862             n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
863             break;
864         case VNC_ENCODING_HEXTILE:
865             vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
866             n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
867             break;
868         case VNC_ENCODING_TIGHT:
869             n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
870             break;
871         case VNC_ENCODING_TIGHT_PNG:
872             n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
873             break;
874         case VNC_ENCODING_ZRLE:
875             n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
876             break;
877         case VNC_ENCODING_ZYWRLE:
878             n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
879             break;
880         default:
881             encode_raw = true;
882             break;
883     }
884 
885     /* If the client has the same pixel format as our internal buffer and
886      * a RAW encoding would need less space fall back to RAW encoding to
887      * save bandwidth and processing power in the client. */
888     if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
889         12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
890         vs->output.offset = saved_offs;
891         encode_raw = true;
892     }
893 
894     if (encode_raw) {
895         vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
896         n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
897     }
898 
899     return n;
900 }
901 
902 static void vnc_mouse_set(DisplayChangeListener *dcl,
903                           int x, int y, int visible)
904 {
905     /* can we ask the client(s) to move the pointer ??? */
906 }
907 
908 static int vnc_cursor_define(VncState *vs)
909 {
910     QEMUCursor *c = vs->vd->cursor;
911     int isize;
912 
913     if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
914         vnc_lock_output(vs);
915         vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
916         vnc_write_u8(vs,  0);  /*  padding     */
917         vnc_write_u16(vs, 1);  /*  # of rects  */
918         vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
919                                VNC_ENCODING_RICH_CURSOR);
920         isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
921         vnc_write_pixels_generic(vs, c->data, isize);
922         vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
923         vnc_unlock_output(vs);
924         return 0;
925     }
926     return -1;
927 }
928 
929 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
930                                   QEMUCursor *c)
931 {
932     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
933     VncState *vs;
934 
935     cursor_put(vd->cursor);
936     g_free(vd->cursor_mask);
937 
938     vd->cursor = c;
939     cursor_get(vd->cursor);
940     vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
941     vd->cursor_mask = g_malloc0(vd->cursor_msize);
942     cursor_get_mono_mask(c, 0, vd->cursor_mask);
943 
944     QTAILQ_FOREACH(vs, &vd->clients, next) {
945         vnc_cursor_define(vs);
946     }
947 }
948 
949 static int find_and_clear_dirty_height(VncState *vs,
950                                        int y, int last_x, int x, int height)
951 {
952     int h;
953 
954     for (h = 1; h < (height - y); h++) {
955         if (!test_bit(last_x, vs->dirty[y + h])) {
956             break;
957         }
958         bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
959     }
960 
961     return h;
962 }
963 
964 static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
965 {
966     if (vs->disconnecting) {
967         vnc_disconnect_finish(vs);
968         return 0;
969     }
970 
971     vs->has_dirty += has_dirty;
972     if (vs->need_update && !vs->disconnecting) {
973         VncDisplay *vd = vs->vd;
974         VncJob *job;
975         int y;
976         int height, width;
977         int n = 0;
978 
979         if (vs->output.offset && !vs->audio_cap && !vs->force_update)
980             /* kernel send buffers are full -> drop frames to throttle */
981             return 0;
982 
983         if (!vs->has_dirty && !vs->audio_cap && !vs->force_update)
984             return 0;
985 
986         /*
987          * Send screen updates to the vnc client using the server
988          * surface and server dirty map.  guest surface updates
989          * happening in parallel don't disturb us, the next pass will
990          * send them to the client.
991          */
992         job = vnc_job_new(vs);
993 
994         height = pixman_image_get_height(vd->server);
995         width = pixman_image_get_width(vd->server);
996 
997         y = 0;
998         for (;;) {
999             int x, h;
1000             unsigned long x2;
1001             unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1002                                                  height * VNC_DIRTY_BPL(vs),
1003                                                  y * VNC_DIRTY_BPL(vs));
1004             if (offset == height * VNC_DIRTY_BPL(vs)) {
1005                 /* no more dirty bits */
1006                 break;
1007             }
1008             y = offset / VNC_DIRTY_BPL(vs);
1009             x = offset % VNC_DIRTY_BPL(vs);
1010             x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1011                                     VNC_DIRTY_BPL(vs), x);
1012             bitmap_clear(vs->dirty[y], x, x2 - x);
1013             h = find_and_clear_dirty_height(vs, y, x, x2, height);
1014             x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1015             if (x2 > x) {
1016                 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1017                                       (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1018             }
1019             if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1020                 y += h;
1021                 if (y == height) {
1022                     break;
1023                 }
1024             }
1025         }
1026 
1027         vnc_job_push(job);
1028         if (sync) {
1029             vnc_jobs_join(vs);
1030         }
1031         vs->force_update = 0;
1032         vs->has_dirty = 0;
1033         return n;
1034     }
1035 
1036     if (vs->disconnecting) {
1037         vnc_disconnect_finish(vs);
1038     } else if (sync) {
1039         vnc_jobs_join(vs);
1040     }
1041 
1042     return 0;
1043 }
1044 
1045 /* audio */
1046 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1047 {
1048     VncState *vs = opaque;
1049 
1050     switch (cmd) {
1051     case AUD_CNOTIFY_DISABLE:
1052         vnc_lock_output(vs);
1053         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1054         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1055         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1056         vnc_unlock_output(vs);
1057         vnc_flush(vs);
1058         break;
1059 
1060     case AUD_CNOTIFY_ENABLE:
1061         vnc_lock_output(vs);
1062         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1063         vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1064         vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1065         vnc_unlock_output(vs);
1066         vnc_flush(vs);
1067         break;
1068     }
1069 }
1070 
1071 static void audio_capture_destroy(void *opaque)
1072 {
1073 }
1074 
1075 static void audio_capture(void *opaque, void *buf, int size)
1076 {
1077     VncState *vs = opaque;
1078 
1079     vnc_lock_output(vs);
1080     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1081     vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1082     vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1083     vnc_write_u32(vs, size);
1084     vnc_write(vs, buf, size);
1085     vnc_unlock_output(vs);
1086     vnc_flush(vs);
1087 }
1088 
1089 static void audio_add(VncState *vs)
1090 {
1091     struct audio_capture_ops ops;
1092 
1093     if (vs->audio_cap) {
1094         error_report("audio already running");
1095         return;
1096     }
1097 
1098     ops.notify = audio_capture_notify;
1099     ops.destroy = audio_capture_destroy;
1100     ops.capture = audio_capture;
1101 
1102     vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1103     if (!vs->audio_cap) {
1104         error_report("Failed to add audio capture");
1105     }
1106 }
1107 
1108 static void audio_del(VncState *vs)
1109 {
1110     if (vs->audio_cap) {
1111         AUD_del_capture(vs->audio_cap, vs);
1112         vs->audio_cap = NULL;
1113     }
1114 }
1115 
1116 static void vnc_disconnect_start(VncState *vs)
1117 {
1118     if (vs->disconnecting) {
1119         return;
1120     }
1121     trace_vnc_client_disconnect_start(vs, vs->ioc);
1122     vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1123     if (vs->ioc_tag) {
1124         g_source_remove(vs->ioc_tag);
1125         vs->ioc_tag = 0;
1126     }
1127     qio_channel_close(vs->ioc, NULL);
1128     vs->disconnecting = TRUE;
1129 }
1130 
1131 void vnc_disconnect_finish(VncState *vs)
1132 {
1133     int i;
1134 
1135     trace_vnc_client_disconnect_finish(vs, vs->ioc);
1136 
1137     vnc_jobs_join(vs); /* Wait encoding jobs */
1138 
1139     vnc_lock_output(vs);
1140     vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1141 
1142     buffer_free(&vs->input);
1143     buffer_free(&vs->output);
1144 
1145     qapi_free_VncClientInfo(vs->info);
1146 
1147     vnc_zlib_clear(vs);
1148     vnc_tight_clear(vs);
1149     vnc_zrle_clear(vs);
1150 
1151 #ifdef CONFIG_VNC_SASL
1152     vnc_sasl_client_cleanup(vs);
1153 #endif /* CONFIG_VNC_SASL */
1154     audio_del(vs);
1155     vnc_release_modifiers(vs);
1156 
1157     if (vs->mouse_mode_notifier.notify != NULL) {
1158         qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1159     }
1160     QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1161     if (QTAILQ_EMPTY(&vs->vd->clients)) {
1162         /* last client gone */
1163         vnc_update_server_surface(vs->vd);
1164     }
1165 
1166     vnc_unlock_output(vs);
1167 
1168     qemu_mutex_destroy(&vs->output_mutex);
1169     if (vs->bh != NULL) {
1170         qemu_bh_delete(vs->bh);
1171     }
1172     buffer_free(&vs->jobs_buffer);
1173 
1174     for (i = 0; i < VNC_STAT_ROWS; ++i) {
1175         g_free(vs->lossy_rect[i]);
1176     }
1177     g_free(vs->lossy_rect);
1178 
1179     object_unref(OBJECT(vs->ioc));
1180     vs->ioc = NULL;
1181     object_unref(OBJECT(vs->sioc));
1182     vs->sioc = NULL;
1183     g_free(vs);
1184 }
1185 
1186 ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1187 {
1188     if (ret <= 0) {
1189         if (ret == 0) {
1190             trace_vnc_client_eof(vs, vs->ioc);
1191             vnc_disconnect_start(vs);
1192         } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1193             trace_vnc_client_io_error(vs, vs->ioc,
1194                                       errp ? error_get_pretty(*errp) :
1195                                       "Unknown");
1196             vnc_disconnect_start(vs);
1197         }
1198 
1199         if (errp) {
1200             error_free(*errp);
1201             *errp = NULL;
1202         }
1203         return 0;
1204     }
1205     return ret;
1206 }
1207 
1208 
1209 void vnc_client_error(VncState *vs)
1210 {
1211     VNC_DEBUG("Closing down client sock: protocol error\n");
1212     vnc_disconnect_start(vs);
1213 }
1214 
1215 
1216 /*
1217  * Called to write a chunk of data to the client socket. The data may
1218  * be the raw data, or may have already been encoded by SASL.
1219  * The data will be written either straight onto the socket, or
1220  * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1221  *
1222  * NB, it is theoretically possible to have 2 layers of encryption,
1223  * both SASL, and this TLS layer. It is highly unlikely in practice
1224  * though, since SASL encryption will typically be a no-op if TLS
1225  * is active
1226  *
1227  * Returns the number of bytes written, which may be less than
1228  * the requested 'datalen' if the socket would block. Returns
1229  * -1 on error, and disconnects the client socket.
1230  */
1231 ssize_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1232 {
1233     Error *err = NULL;
1234     ssize_t ret;
1235     ret = qio_channel_write(
1236         vs->ioc, (const char *)data, datalen, &err);
1237     VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1238     return vnc_client_io_error(vs, ret, &err);
1239 }
1240 
1241 
1242 /*
1243  * Called to write buffered data to the client socket, when not
1244  * using any SASL SSF encryption layers. Will write as much data
1245  * as possible without blocking. If all buffered data is written,
1246  * will switch the FD poll() handler back to read monitoring.
1247  *
1248  * Returns the number of bytes written, which may be less than
1249  * the buffered output data if the socket would block. Returns
1250  * -1 on error, and disconnects the client socket.
1251  */
1252 static ssize_t vnc_client_write_plain(VncState *vs)
1253 {
1254     ssize_t ret;
1255 
1256 #ifdef CONFIG_VNC_SASL
1257     VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1258               vs->output.buffer, vs->output.capacity, vs->output.offset,
1259               vs->sasl.waitWriteSSF);
1260 
1261     if (vs->sasl.conn &&
1262         vs->sasl.runSSF &&
1263         vs->sasl.waitWriteSSF) {
1264         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1265         if (ret)
1266             vs->sasl.waitWriteSSF -= ret;
1267     } else
1268 #endif /* CONFIG_VNC_SASL */
1269         ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1270     if (!ret)
1271         return 0;
1272 
1273     buffer_advance(&vs->output, ret);
1274 
1275     if (vs->output.offset == 0) {
1276         if (vs->ioc_tag) {
1277             g_source_remove(vs->ioc_tag);
1278         }
1279         vs->ioc_tag = qio_channel_add_watch(
1280             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1281     }
1282 
1283     return ret;
1284 }
1285 
1286 
1287 /*
1288  * First function called whenever there is data to be written to
1289  * the client socket. Will delegate actual work according to whether
1290  * SASL SSF layers are enabled (thus requiring encryption calls)
1291  */
1292 static void vnc_client_write_locked(VncState *vs)
1293 {
1294 #ifdef CONFIG_VNC_SASL
1295     if (vs->sasl.conn &&
1296         vs->sasl.runSSF &&
1297         !vs->sasl.waitWriteSSF) {
1298         vnc_client_write_sasl(vs);
1299     } else
1300 #endif /* CONFIG_VNC_SASL */
1301     {
1302         vnc_client_write_plain(vs);
1303     }
1304 }
1305 
1306 static void vnc_client_write(VncState *vs)
1307 {
1308 
1309     vnc_lock_output(vs);
1310     if (vs->output.offset) {
1311         vnc_client_write_locked(vs);
1312     } else if (vs->ioc != NULL) {
1313         if (vs->ioc_tag) {
1314             g_source_remove(vs->ioc_tag);
1315         }
1316         vs->ioc_tag = qio_channel_add_watch(
1317             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1318     }
1319     vnc_unlock_output(vs);
1320 }
1321 
1322 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1323 {
1324     vs->read_handler = func;
1325     vs->read_handler_expect = expecting;
1326 }
1327 
1328 
1329 /*
1330  * Called to read a chunk of data from the client socket. The data may
1331  * be the raw data, or may need to be further decoded by SASL.
1332  * The data will be read either straight from to the socket, or
1333  * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1334  *
1335  * NB, it is theoretically possible to have 2 layers of encryption,
1336  * both SASL, and this TLS layer. It is highly unlikely in practice
1337  * though, since SASL encryption will typically be a no-op if TLS
1338  * is active
1339  *
1340  * Returns the number of bytes read, which may be less than
1341  * the requested 'datalen' if the socket would block. Returns
1342  * -1 on error, and disconnects the client socket.
1343  */
1344 ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1345 {
1346     ssize_t ret;
1347     Error *err = NULL;
1348     ret = qio_channel_read(
1349         vs->ioc, (char *)data, datalen, &err);
1350     VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1351     return vnc_client_io_error(vs, ret, &err);
1352 }
1353 
1354 
1355 /*
1356  * Called to read data from the client socket to the input buffer,
1357  * when not using any SASL SSF encryption layers. Will read as much
1358  * data as possible without blocking.
1359  *
1360  * Returns the number of bytes read. Returns -1 on error, and
1361  * disconnects the client socket.
1362  */
1363 static ssize_t vnc_client_read_plain(VncState *vs)
1364 {
1365     ssize_t ret;
1366     VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1367               vs->input.buffer, vs->input.capacity, vs->input.offset);
1368     buffer_reserve(&vs->input, 4096);
1369     ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1370     if (!ret)
1371         return 0;
1372     vs->input.offset += ret;
1373     return ret;
1374 }
1375 
1376 static void vnc_jobs_bh(void *opaque)
1377 {
1378     VncState *vs = opaque;
1379 
1380     vnc_jobs_consume_buffer(vs);
1381 }
1382 
1383 /*
1384  * First function called whenever there is more data to be read from
1385  * the client socket. Will delegate actual work according to whether
1386  * SASL SSF layers are enabled (thus requiring decryption calls)
1387  * Returns 0 on success, -1 if client disconnected
1388  */
1389 static int vnc_client_read(VncState *vs)
1390 {
1391     ssize_t ret;
1392 
1393 #ifdef CONFIG_VNC_SASL
1394     if (vs->sasl.conn && vs->sasl.runSSF)
1395         ret = vnc_client_read_sasl(vs);
1396     else
1397 #endif /* CONFIG_VNC_SASL */
1398         ret = vnc_client_read_plain(vs);
1399     if (!ret) {
1400         if (vs->disconnecting) {
1401             vnc_disconnect_finish(vs);
1402             return -1;
1403         }
1404         return 0;
1405     }
1406 
1407     while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1408         size_t len = vs->read_handler_expect;
1409         int ret;
1410 
1411         ret = vs->read_handler(vs, vs->input.buffer, len);
1412         if (vs->disconnecting) {
1413             vnc_disconnect_finish(vs);
1414             return -1;
1415         }
1416 
1417         if (!ret) {
1418             buffer_advance(&vs->input, len);
1419         } else {
1420             vs->read_handler_expect = ret;
1421         }
1422     }
1423     return 0;
1424 }
1425 
1426 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1427                        GIOCondition condition, void *opaque)
1428 {
1429     VncState *vs = opaque;
1430     if (condition & G_IO_IN) {
1431         if (vnc_client_read(vs) < 0) {
1432             return TRUE;
1433         }
1434     }
1435     if (condition & G_IO_OUT) {
1436         vnc_client_write(vs);
1437     }
1438     return TRUE;
1439 }
1440 
1441 
1442 void vnc_write(VncState *vs, const void *data, size_t len)
1443 {
1444     buffer_reserve(&vs->output, len);
1445 
1446     if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1447         if (vs->ioc_tag) {
1448             g_source_remove(vs->ioc_tag);
1449         }
1450         vs->ioc_tag = qio_channel_add_watch(
1451             vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1452     }
1453 
1454     buffer_append(&vs->output, data, len);
1455 }
1456 
1457 void vnc_write_s32(VncState *vs, int32_t value)
1458 {
1459     vnc_write_u32(vs, *(uint32_t *)&value);
1460 }
1461 
1462 void vnc_write_u32(VncState *vs, uint32_t value)
1463 {
1464     uint8_t buf[4];
1465 
1466     buf[0] = (value >> 24) & 0xFF;
1467     buf[1] = (value >> 16) & 0xFF;
1468     buf[2] = (value >>  8) & 0xFF;
1469     buf[3] = value & 0xFF;
1470 
1471     vnc_write(vs, buf, 4);
1472 }
1473 
1474 void vnc_write_u16(VncState *vs, uint16_t value)
1475 {
1476     uint8_t buf[2];
1477 
1478     buf[0] = (value >> 8) & 0xFF;
1479     buf[1] = value & 0xFF;
1480 
1481     vnc_write(vs, buf, 2);
1482 }
1483 
1484 void vnc_write_u8(VncState *vs, uint8_t value)
1485 {
1486     vnc_write(vs, (char *)&value, 1);
1487 }
1488 
1489 void vnc_flush(VncState *vs)
1490 {
1491     vnc_lock_output(vs);
1492     if (vs->ioc != NULL && vs->output.offset) {
1493         vnc_client_write_locked(vs);
1494     }
1495     vnc_unlock_output(vs);
1496 }
1497 
1498 static uint8_t read_u8(uint8_t *data, size_t offset)
1499 {
1500     return data[offset];
1501 }
1502 
1503 static uint16_t read_u16(uint8_t *data, size_t offset)
1504 {
1505     return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1506 }
1507 
1508 static int32_t read_s32(uint8_t *data, size_t offset)
1509 {
1510     return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1511                      (data[offset + 2] << 8) | data[offset + 3]);
1512 }
1513 
1514 uint32_t read_u32(uint8_t *data, size_t offset)
1515 {
1516     return ((data[offset] << 24) | (data[offset + 1] << 16) |
1517             (data[offset + 2] << 8) | data[offset + 3]);
1518 }
1519 
1520 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1521 {
1522 }
1523 
1524 static void check_pointer_type_change(Notifier *notifier, void *data)
1525 {
1526     VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1527     int absolute = qemu_input_is_absolute();
1528 
1529     if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1530         vnc_lock_output(vs);
1531         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1532         vnc_write_u8(vs, 0);
1533         vnc_write_u16(vs, 1);
1534         vnc_framebuffer_update(vs, absolute, 0,
1535                                pixman_image_get_width(vs->vd->server),
1536                                pixman_image_get_height(vs->vd->server),
1537                                VNC_ENCODING_POINTER_TYPE_CHANGE);
1538         vnc_unlock_output(vs);
1539         vnc_flush(vs);
1540     }
1541     vs->absolute = absolute;
1542 }
1543 
1544 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1545 {
1546     static uint32_t bmap[INPUT_BUTTON__MAX] = {
1547         [INPUT_BUTTON_LEFT]       = 0x01,
1548         [INPUT_BUTTON_MIDDLE]     = 0x02,
1549         [INPUT_BUTTON_RIGHT]      = 0x04,
1550         [INPUT_BUTTON_WHEEL_UP]   = 0x08,
1551         [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1552     };
1553     QemuConsole *con = vs->vd->dcl.con;
1554     int width = pixman_image_get_width(vs->vd->server);
1555     int height = pixman_image_get_height(vs->vd->server);
1556 
1557     if (vs->last_bmask != button_mask) {
1558         qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1559         vs->last_bmask = button_mask;
1560     }
1561 
1562     if (vs->absolute) {
1563         qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1564         qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1565     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1566         qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1567         qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1568     } else {
1569         if (vs->last_x != -1) {
1570             qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1571             qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1572         }
1573         vs->last_x = x;
1574         vs->last_y = y;
1575     }
1576     qemu_input_event_sync();
1577 }
1578 
1579 static void reset_keys(VncState *vs)
1580 {
1581     int i;
1582     for(i = 0; i < 256; i++) {
1583         if (vs->modifiers_state[i]) {
1584             qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1585             qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1586             vs->modifiers_state[i] = 0;
1587         }
1588     }
1589 }
1590 
1591 static void press_key(VncState *vs, int keysym)
1592 {
1593     int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1594     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1595     qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1596     qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1597     qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1598 }
1599 
1600 static void vnc_led_state_change(VncState *vs)
1601 {
1602     if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1603         return;
1604     }
1605 
1606     vnc_lock_output(vs);
1607     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1608     vnc_write_u8(vs, 0);
1609     vnc_write_u16(vs, 1);
1610     vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1611     vnc_write_u8(vs, vs->vd->ledstate);
1612     vnc_unlock_output(vs);
1613     vnc_flush(vs);
1614 }
1615 
1616 static void kbd_leds(void *opaque, int ledstate)
1617 {
1618     VncDisplay *vd = opaque;
1619     VncState *client;
1620 
1621     trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1622                              (ledstate & QEMU_NUM_LOCK_LED),
1623                              (ledstate & QEMU_SCROLL_LOCK_LED));
1624 
1625     if (ledstate == vd->ledstate) {
1626         return;
1627     }
1628 
1629     vd->ledstate = ledstate;
1630 
1631     QTAILQ_FOREACH(client, &vd->clients, next) {
1632         vnc_led_state_change(client);
1633     }
1634 }
1635 
1636 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1637 {
1638     /* QEMU console switch */
1639     switch(keycode) {
1640     case 0x2a:                          /* Left Shift */
1641     case 0x36:                          /* Right Shift */
1642     case 0x1d:                          /* Left CTRL */
1643     case 0x9d:                          /* Right CTRL */
1644     case 0x38:                          /* Left ALT */
1645     case 0xb8:                          /* Right ALT */
1646         if (down)
1647             vs->modifiers_state[keycode] = 1;
1648         else
1649             vs->modifiers_state[keycode] = 0;
1650         break;
1651     case 0x02 ... 0x0a: /* '1' to '9' keys */
1652         if (vs->vd->dcl.con == NULL &&
1653             down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1654             /* Reset the modifiers sent to the current console */
1655             reset_keys(vs);
1656             console_select(keycode - 0x02);
1657             return;
1658         }
1659         break;
1660     case 0x3a:                        /* CapsLock */
1661     case 0x45:                        /* NumLock */
1662         if (down)
1663             vs->modifiers_state[keycode] ^= 1;
1664         break;
1665     }
1666 
1667     /* Turn off the lock state sync logic if the client support the led
1668        state extension.
1669     */
1670     if (down && vs->vd->lock_key_sync &&
1671         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1672         keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1673         /* If the numlock state needs to change then simulate an additional
1674            keypress before sending this one.  This will happen if the user
1675            toggles numlock away from the VNC window.
1676         */
1677         if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1678             if (!vs->modifiers_state[0x45]) {
1679                 trace_vnc_key_sync_numlock(true);
1680                 vs->modifiers_state[0x45] = 1;
1681                 press_key(vs, 0xff7f);
1682             }
1683         } else {
1684             if (vs->modifiers_state[0x45]) {
1685                 trace_vnc_key_sync_numlock(false);
1686                 vs->modifiers_state[0x45] = 0;
1687                 press_key(vs, 0xff7f);
1688             }
1689         }
1690     }
1691 
1692     if (down && vs->vd->lock_key_sync &&
1693         !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1694         ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1695         /* If the capslock state needs to change then simulate an additional
1696            keypress before sending this one.  This will happen if the user
1697            toggles capslock away from the VNC window.
1698         */
1699         int uppercase = !!(sym >= 'A' && sym <= 'Z');
1700         int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1701         int capslock = !!(vs->modifiers_state[0x3a]);
1702         if (capslock) {
1703             if (uppercase == shift) {
1704                 trace_vnc_key_sync_capslock(false);
1705                 vs->modifiers_state[0x3a] = 0;
1706                 press_key(vs, 0xffe5);
1707             }
1708         } else {
1709             if (uppercase != shift) {
1710                 trace_vnc_key_sync_capslock(true);
1711                 vs->modifiers_state[0x3a] = 1;
1712                 press_key(vs, 0xffe5);
1713             }
1714         }
1715     }
1716 
1717     if (qemu_console_is_graphic(NULL)) {
1718         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1719         qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1720     } else {
1721         bool numlock = vs->modifiers_state[0x45];
1722         bool control = (vs->modifiers_state[0x1d] ||
1723                         vs->modifiers_state[0x9d]);
1724         /* QEMU console emulation */
1725         if (down) {
1726             switch (keycode) {
1727             case 0x2a:                          /* Left Shift */
1728             case 0x36:                          /* Right Shift */
1729             case 0x1d:                          /* Left CTRL */
1730             case 0x9d:                          /* Right CTRL */
1731             case 0x38:                          /* Left ALT */
1732             case 0xb8:                          /* Right ALT */
1733                 break;
1734             case 0xc8:
1735                 kbd_put_keysym(QEMU_KEY_UP);
1736                 break;
1737             case 0xd0:
1738                 kbd_put_keysym(QEMU_KEY_DOWN);
1739                 break;
1740             case 0xcb:
1741                 kbd_put_keysym(QEMU_KEY_LEFT);
1742                 break;
1743             case 0xcd:
1744                 kbd_put_keysym(QEMU_KEY_RIGHT);
1745                 break;
1746             case 0xd3:
1747                 kbd_put_keysym(QEMU_KEY_DELETE);
1748                 break;
1749             case 0xc7:
1750                 kbd_put_keysym(QEMU_KEY_HOME);
1751                 break;
1752             case 0xcf:
1753                 kbd_put_keysym(QEMU_KEY_END);
1754                 break;
1755             case 0xc9:
1756                 kbd_put_keysym(QEMU_KEY_PAGEUP);
1757                 break;
1758             case 0xd1:
1759                 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1760                 break;
1761 
1762             case 0x47:
1763                 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1764                 break;
1765             case 0x48:
1766                 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1767                 break;
1768             case 0x49:
1769                 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1770                 break;
1771             case 0x4b:
1772                 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1773                 break;
1774             case 0x4c:
1775                 kbd_put_keysym('5');
1776                 break;
1777             case 0x4d:
1778                 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1779                 break;
1780             case 0x4f:
1781                 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1782                 break;
1783             case 0x50:
1784                 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1785                 break;
1786             case 0x51:
1787                 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1788                 break;
1789             case 0x52:
1790                 kbd_put_keysym('0');
1791                 break;
1792             case 0x53:
1793                 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1794                 break;
1795 
1796             case 0xb5:
1797                 kbd_put_keysym('/');
1798                 break;
1799             case 0x37:
1800                 kbd_put_keysym('*');
1801                 break;
1802             case 0x4a:
1803                 kbd_put_keysym('-');
1804                 break;
1805             case 0x4e:
1806                 kbd_put_keysym('+');
1807                 break;
1808             case 0x9c:
1809                 kbd_put_keysym('\n');
1810                 break;
1811 
1812             default:
1813                 if (control) {
1814                     kbd_put_keysym(sym & 0x1f);
1815                 } else {
1816                     kbd_put_keysym(sym);
1817                 }
1818                 break;
1819             }
1820         }
1821     }
1822 }
1823 
1824 static void vnc_release_modifiers(VncState *vs)
1825 {
1826     static const int keycodes[] = {
1827         /* shift, control, alt keys, both left & right */
1828         0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1829     };
1830     int i, keycode;
1831 
1832     if (!qemu_console_is_graphic(NULL)) {
1833         return;
1834     }
1835     for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1836         keycode = keycodes[i];
1837         if (!vs->modifiers_state[keycode]) {
1838             continue;
1839         }
1840         qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1841         qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1842     }
1843 }
1844 
1845 static const char *code2name(int keycode)
1846 {
1847     return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
1848 }
1849 
1850 static void key_event(VncState *vs, int down, uint32_t sym)
1851 {
1852     int keycode;
1853     int lsym = sym;
1854 
1855     if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1856         lsym = lsym - 'A' + 'a';
1857     }
1858 
1859     keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1860     trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
1861     do_key_event(vs, down, keycode, sym);
1862 }
1863 
1864 static void ext_key_event(VncState *vs, int down,
1865                           uint32_t sym, uint16_t keycode)
1866 {
1867     /* if the user specifies a keyboard layout, always use it */
1868     if (keyboard_layout) {
1869         key_event(vs, down, sym);
1870     } else {
1871         trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
1872         do_key_event(vs, down, keycode, sym);
1873     }
1874 }
1875 
1876 static void framebuffer_update_request(VncState *vs, int incremental,
1877                                        int x, int y, int w, int h)
1878 {
1879     vs->need_update = 1;
1880 
1881     if (incremental) {
1882         return;
1883     }
1884 
1885     vs->force_update = 1;
1886     vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
1887 }
1888 
1889 static void send_ext_key_event_ack(VncState *vs)
1890 {
1891     vnc_lock_output(vs);
1892     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1893     vnc_write_u8(vs, 0);
1894     vnc_write_u16(vs, 1);
1895     vnc_framebuffer_update(vs, 0, 0,
1896                            pixman_image_get_width(vs->vd->server),
1897                            pixman_image_get_height(vs->vd->server),
1898                            VNC_ENCODING_EXT_KEY_EVENT);
1899     vnc_unlock_output(vs);
1900     vnc_flush(vs);
1901 }
1902 
1903 static void send_ext_audio_ack(VncState *vs)
1904 {
1905     vnc_lock_output(vs);
1906     vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1907     vnc_write_u8(vs, 0);
1908     vnc_write_u16(vs, 1);
1909     vnc_framebuffer_update(vs, 0, 0,
1910                            pixman_image_get_width(vs->vd->server),
1911                            pixman_image_get_height(vs->vd->server),
1912                            VNC_ENCODING_AUDIO);
1913     vnc_unlock_output(vs);
1914     vnc_flush(vs);
1915 }
1916 
1917 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1918 {
1919     int i;
1920     unsigned int enc = 0;
1921 
1922     vs->features = 0;
1923     vs->vnc_encoding = 0;
1924     vs->tight.compression = 9;
1925     vs->tight.quality = -1; /* Lossless by default */
1926     vs->absolute = -1;
1927 
1928     /*
1929      * Start from the end because the encodings are sent in order of preference.
1930      * This way the preferred encoding (first encoding defined in the array)
1931      * will be set at the end of the loop.
1932      */
1933     for (i = n_encodings - 1; i >= 0; i--) {
1934         enc = encodings[i];
1935         switch (enc) {
1936         case VNC_ENCODING_RAW:
1937             vs->vnc_encoding = enc;
1938             break;
1939         case VNC_ENCODING_COPYRECT:
1940             vs->features |= VNC_FEATURE_COPYRECT_MASK;
1941             break;
1942         case VNC_ENCODING_HEXTILE:
1943             vs->features |= VNC_FEATURE_HEXTILE_MASK;
1944             vs->vnc_encoding = enc;
1945             break;
1946         case VNC_ENCODING_TIGHT:
1947             vs->features |= VNC_FEATURE_TIGHT_MASK;
1948             vs->vnc_encoding = enc;
1949             break;
1950 #ifdef CONFIG_VNC_PNG
1951         case VNC_ENCODING_TIGHT_PNG:
1952             vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
1953             vs->vnc_encoding = enc;
1954             break;
1955 #endif
1956         case VNC_ENCODING_ZLIB:
1957             vs->features |= VNC_FEATURE_ZLIB_MASK;
1958             vs->vnc_encoding = enc;
1959             break;
1960         case VNC_ENCODING_ZRLE:
1961             vs->features |= VNC_FEATURE_ZRLE_MASK;
1962             vs->vnc_encoding = enc;
1963             break;
1964         case VNC_ENCODING_ZYWRLE:
1965             vs->features |= VNC_FEATURE_ZYWRLE_MASK;
1966             vs->vnc_encoding = enc;
1967             break;
1968         case VNC_ENCODING_DESKTOPRESIZE:
1969             vs->features |= VNC_FEATURE_RESIZE_MASK;
1970             break;
1971         case VNC_ENCODING_POINTER_TYPE_CHANGE:
1972             vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1973             break;
1974         case VNC_ENCODING_RICH_CURSOR:
1975             vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1976             if (vs->vd->cursor) {
1977                 vnc_cursor_define(vs);
1978             }
1979             break;
1980         case VNC_ENCODING_EXT_KEY_EVENT:
1981             send_ext_key_event_ack(vs);
1982             break;
1983         case VNC_ENCODING_AUDIO:
1984             send_ext_audio_ack(vs);
1985             break;
1986         case VNC_ENCODING_WMVi:
1987             vs->features |= VNC_FEATURE_WMVI_MASK;
1988             break;
1989         case VNC_ENCODING_LED_STATE:
1990             vs->features |= VNC_FEATURE_LED_STATE_MASK;
1991             break;
1992         case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1993             vs->tight.compression = (enc & 0x0F);
1994             break;
1995         case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1996             if (vs->vd->lossy) {
1997                 vs->tight.quality = (enc & 0x0F);
1998             }
1999             break;
2000         default:
2001             VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2002             break;
2003         }
2004     }
2005     vnc_desktop_resize(vs);
2006     check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2007     vnc_led_state_change(vs);
2008 }
2009 
2010 static void set_pixel_conversion(VncState *vs)
2011 {
2012     pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2013 
2014     if (fmt == VNC_SERVER_FB_FORMAT) {
2015         vs->write_pixels = vnc_write_pixels_copy;
2016         vnc_hextile_set_pixel_conversion(vs, 0);
2017     } else {
2018         vs->write_pixels = vnc_write_pixels_generic;
2019         vnc_hextile_set_pixel_conversion(vs, 1);
2020     }
2021 }
2022 
2023 static void send_color_map(VncState *vs)
2024 {
2025     int i;
2026 
2027     vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2028     vnc_write_u8(vs,  0);    /* padding     */
2029     vnc_write_u16(vs, 0);    /* first color */
2030     vnc_write_u16(vs, 256);  /* # of colors */
2031 
2032     for (i = 0; i < 256; i++) {
2033         PixelFormat *pf = &vs->client_pf;
2034 
2035         vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2036         vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2037         vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2038     }
2039 }
2040 
2041 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2042                              int big_endian_flag, int true_color_flag,
2043                              int red_max, int green_max, int blue_max,
2044                              int red_shift, int green_shift, int blue_shift)
2045 {
2046     if (!true_color_flag) {
2047         /* Expose a reasonable default 256 color map */
2048         bits_per_pixel = 8;
2049         red_max = 7;
2050         green_max = 7;
2051         blue_max = 3;
2052         red_shift = 0;
2053         green_shift = 3;
2054         blue_shift = 6;
2055     }
2056 
2057     switch (bits_per_pixel) {
2058     case 8:
2059     case 16:
2060     case 32:
2061         break;
2062     default:
2063         vnc_client_error(vs);
2064         return;
2065     }
2066 
2067     vs->client_pf.rmax = red_max ? red_max : 0xFF;
2068     vs->client_pf.rbits = ctpopl(red_max);
2069     vs->client_pf.rshift = red_shift;
2070     vs->client_pf.rmask = red_max << red_shift;
2071     vs->client_pf.gmax = green_max ? green_max : 0xFF;
2072     vs->client_pf.gbits = ctpopl(green_max);
2073     vs->client_pf.gshift = green_shift;
2074     vs->client_pf.gmask = green_max << green_shift;
2075     vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2076     vs->client_pf.bbits = ctpopl(blue_max);
2077     vs->client_pf.bshift = blue_shift;
2078     vs->client_pf.bmask = blue_max << blue_shift;
2079     vs->client_pf.bits_per_pixel = bits_per_pixel;
2080     vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2081     vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2082     vs->client_be = big_endian_flag;
2083 
2084     if (!true_color_flag) {
2085         send_color_map(vs);
2086     }
2087 
2088     set_pixel_conversion(vs);
2089 
2090     graphic_hw_invalidate(vs->vd->dcl.con);
2091     graphic_hw_update(vs->vd->dcl.con);
2092 }
2093 
2094 static void pixel_format_message (VncState *vs) {
2095     char pad[3] = { 0, 0, 0 };
2096 
2097     vs->client_pf = qemu_default_pixelformat(32);
2098 
2099     vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2100     vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2101 
2102 #ifdef HOST_WORDS_BIGENDIAN
2103     vnc_write_u8(vs, 1);             /* big-endian-flag */
2104 #else
2105     vnc_write_u8(vs, 0);             /* big-endian-flag */
2106 #endif
2107     vnc_write_u8(vs, 1);             /* true-color-flag */
2108     vnc_write_u16(vs, vs->client_pf.rmax);     /* red-max */
2109     vnc_write_u16(vs, vs->client_pf.gmax);     /* green-max */
2110     vnc_write_u16(vs, vs->client_pf.bmax);     /* blue-max */
2111     vnc_write_u8(vs, vs->client_pf.rshift);    /* red-shift */
2112     vnc_write_u8(vs, vs->client_pf.gshift);    /* green-shift */
2113     vnc_write_u8(vs, vs->client_pf.bshift);    /* blue-shift */
2114     vnc_write(vs, pad, 3);           /* padding */
2115 
2116     vnc_hextile_set_pixel_conversion(vs, 0);
2117     vs->write_pixels = vnc_write_pixels_copy;
2118 }
2119 
2120 static void vnc_colordepth(VncState *vs)
2121 {
2122     if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2123         /* Sending a WMVi message to notify the client*/
2124         vnc_lock_output(vs);
2125         vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2126         vnc_write_u8(vs, 0);
2127         vnc_write_u16(vs, 1); /* number of rects */
2128         vnc_framebuffer_update(vs, 0, 0,
2129                                pixman_image_get_width(vs->vd->server),
2130                                pixman_image_get_height(vs->vd->server),
2131                                VNC_ENCODING_WMVi);
2132         pixel_format_message(vs);
2133         vnc_unlock_output(vs);
2134         vnc_flush(vs);
2135     } else {
2136         set_pixel_conversion(vs);
2137     }
2138 }
2139 
2140 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2141 {
2142     int i;
2143     uint16_t limit;
2144     VncDisplay *vd = vs->vd;
2145 
2146     if (data[0] > 3) {
2147         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2148     }
2149 
2150     switch (data[0]) {
2151     case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2152         if (len == 1)
2153             return 20;
2154 
2155         set_pixel_format(vs, read_u8(data, 4),
2156                          read_u8(data, 6), read_u8(data, 7),
2157                          read_u16(data, 8), read_u16(data, 10),
2158                          read_u16(data, 12), read_u8(data, 14),
2159                          read_u8(data, 15), read_u8(data, 16));
2160         break;
2161     case VNC_MSG_CLIENT_SET_ENCODINGS:
2162         if (len == 1)
2163             return 4;
2164 
2165         if (len == 4) {
2166             limit = read_u16(data, 2);
2167             if (limit > 0)
2168                 return 4 + (limit * 4);
2169         } else
2170             limit = read_u16(data, 2);
2171 
2172         for (i = 0; i < limit; i++) {
2173             int32_t val = read_s32(data, 4 + (i * 4));
2174             memcpy(data + 4 + (i * 4), &val, sizeof(val));
2175         }
2176 
2177         set_encodings(vs, (int32_t *)(data + 4), limit);
2178         break;
2179     case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2180         if (len == 1)
2181             return 10;
2182 
2183         framebuffer_update_request(vs,
2184                                    read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2185                                    read_u16(data, 6), read_u16(data, 8));
2186         break;
2187     case VNC_MSG_CLIENT_KEY_EVENT:
2188         if (len == 1)
2189             return 8;
2190 
2191         key_event(vs, read_u8(data, 1), read_u32(data, 4));
2192         break;
2193     case VNC_MSG_CLIENT_POINTER_EVENT:
2194         if (len == 1)
2195             return 6;
2196 
2197         pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2198         break;
2199     case VNC_MSG_CLIENT_CUT_TEXT:
2200         if (len == 1) {
2201             return 8;
2202         }
2203         if (len == 8) {
2204             uint32_t dlen = read_u32(data, 4);
2205             if (dlen > (1 << 20)) {
2206                 error_report("vnc: client_cut_text msg payload has %u bytes"
2207                              " which exceeds our limit of 1MB.", dlen);
2208                 vnc_client_error(vs);
2209                 break;
2210             }
2211             if (dlen > 0) {
2212                 return 8 + dlen;
2213             }
2214         }
2215 
2216         client_cut_text(vs, read_u32(data, 4), data + 8);
2217         break;
2218     case VNC_MSG_CLIENT_QEMU:
2219         if (len == 1)
2220             return 2;
2221 
2222         switch (read_u8(data, 1)) {
2223         case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2224             if (len == 2)
2225                 return 12;
2226 
2227             ext_key_event(vs, read_u16(data, 2),
2228                           read_u32(data, 4), read_u32(data, 8));
2229             break;
2230         case VNC_MSG_CLIENT_QEMU_AUDIO:
2231             if (len == 2)
2232                 return 4;
2233 
2234             switch (read_u16 (data, 2)) {
2235             case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2236                 audio_add(vs);
2237                 break;
2238             case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2239                 audio_del(vs);
2240                 break;
2241             case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2242                 if (len == 4)
2243                     return 10;
2244                 switch (read_u8(data, 4)) {
2245                 case 0: vs->as.fmt = AUD_FMT_U8; break;
2246                 case 1: vs->as.fmt = AUD_FMT_S8; break;
2247                 case 2: vs->as.fmt = AUD_FMT_U16; break;
2248                 case 3: vs->as.fmt = AUD_FMT_S16; break;
2249                 case 4: vs->as.fmt = AUD_FMT_U32; break;
2250                 case 5: vs->as.fmt = AUD_FMT_S32; break;
2251                 default:
2252                     VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2253                     vnc_client_error(vs);
2254                     break;
2255                 }
2256                 vs->as.nchannels = read_u8(data, 5);
2257                 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2258                     VNC_DEBUG("Invalid audio channel coount %d\n",
2259                               read_u8(data, 5));
2260                     vnc_client_error(vs);
2261                     break;
2262                 }
2263                 vs->as.freq = read_u32(data, 6);
2264                 break;
2265             default:
2266                 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2267                 vnc_client_error(vs);
2268                 break;
2269             }
2270             break;
2271 
2272         default:
2273             VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2274             vnc_client_error(vs);
2275             break;
2276         }
2277         break;
2278     default:
2279         VNC_DEBUG("Msg: %d\n", data[0]);
2280         vnc_client_error(vs);
2281         break;
2282     }
2283 
2284     vnc_read_when(vs, protocol_client_msg, 1);
2285     return 0;
2286 }
2287 
2288 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2289 {
2290     char buf[1024];
2291     VncShareMode mode;
2292     int size;
2293 
2294     mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2295     switch (vs->vd->share_policy) {
2296     case VNC_SHARE_POLICY_IGNORE:
2297         /*
2298          * Ignore the shared flag.  Nothing to do here.
2299          *
2300          * Doesn't conform to the rfb spec but is traditional qemu
2301          * behavior, thus left here as option for compatibility
2302          * reasons.
2303          */
2304         break;
2305     case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2306         /*
2307          * Policy: Allow clients ask for exclusive access.
2308          *
2309          * Implementation: When a client asks for exclusive access,
2310          * disconnect all others. Shared connects are allowed as long
2311          * as no exclusive connection exists.
2312          *
2313          * This is how the rfb spec suggests to handle the shared flag.
2314          */
2315         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2316             VncState *client;
2317             QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2318                 if (vs == client) {
2319                     continue;
2320                 }
2321                 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2322                     client->share_mode != VNC_SHARE_MODE_SHARED) {
2323                     continue;
2324                 }
2325                 vnc_disconnect_start(client);
2326             }
2327         }
2328         if (mode == VNC_SHARE_MODE_SHARED) {
2329             if (vs->vd->num_exclusive > 0) {
2330                 vnc_disconnect_start(vs);
2331                 return 0;
2332             }
2333         }
2334         break;
2335     case VNC_SHARE_POLICY_FORCE_SHARED:
2336         /*
2337          * Policy: Shared connects only.
2338          * Implementation: Disallow clients asking for exclusive access.
2339          *
2340          * Useful for shared desktop sessions where you don't want
2341          * someone forgetting to say -shared when running the vnc
2342          * client disconnect everybody else.
2343          */
2344         if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2345             vnc_disconnect_start(vs);
2346             return 0;
2347         }
2348         break;
2349     }
2350     vnc_set_share_mode(vs, mode);
2351 
2352     if (vs->vd->num_shared > vs->vd->connections_limit) {
2353         vnc_disconnect_start(vs);
2354         return 0;
2355     }
2356 
2357     vs->client_width = pixman_image_get_width(vs->vd->server);
2358     vs->client_height = pixman_image_get_height(vs->vd->server);
2359     vnc_write_u16(vs, vs->client_width);
2360     vnc_write_u16(vs, vs->client_height);
2361 
2362     pixel_format_message(vs);
2363 
2364     if (qemu_name) {
2365         size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2366         if (size > sizeof(buf)) {
2367             size = sizeof(buf);
2368         }
2369     } else {
2370         size = snprintf(buf, sizeof(buf), "QEMU");
2371     }
2372 
2373     vnc_write_u32(vs, size);
2374     vnc_write(vs, buf, size);
2375     vnc_flush(vs);
2376 
2377     vnc_client_cache_auth(vs);
2378     vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2379 
2380     vnc_read_when(vs, protocol_client_msg, 1);
2381 
2382     return 0;
2383 }
2384 
2385 void start_client_init(VncState *vs)
2386 {
2387     vnc_read_when(vs, protocol_client_init, 1);
2388 }
2389 
2390 static void make_challenge(VncState *vs)
2391 {
2392     int i;
2393 
2394     srand(time(NULL)+getpid()+getpid()*987654+rand());
2395 
2396     for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2397         vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2398 }
2399 
2400 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2401 {
2402     unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2403     size_t i, pwlen;
2404     unsigned char key[8];
2405     time_t now = time(NULL);
2406     QCryptoCipher *cipher = NULL;
2407     Error *err = NULL;
2408 
2409     if (!vs->vd->password) {
2410         trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2411         goto reject;
2412     }
2413     if (vs->vd->expires < now) {
2414         trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2415         goto reject;
2416     }
2417 
2418     memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2419 
2420     /* Calculate the expected challenge response */
2421     pwlen = strlen(vs->vd->password);
2422     for (i=0; i<sizeof(key); i++)
2423         key[i] = i<pwlen ? vs->vd->password[i] : 0;
2424 
2425     cipher = qcrypto_cipher_new(
2426         QCRYPTO_CIPHER_ALG_DES_RFB,
2427         QCRYPTO_CIPHER_MODE_ECB,
2428         key, G_N_ELEMENTS(key),
2429         &err);
2430     if (!cipher) {
2431         trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2432                             error_get_pretty(err));
2433         error_free(err);
2434         goto reject;
2435     }
2436 
2437     if (qcrypto_cipher_encrypt(cipher,
2438                                vs->challenge,
2439                                response,
2440                                VNC_AUTH_CHALLENGE_SIZE,
2441                                &err) < 0) {
2442         trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2443                             error_get_pretty(err));
2444         error_free(err);
2445         goto reject;
2446     }
2447 
2448     /* Compare expected vs actual challenge response */
2449     if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2450         trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2451         goto reject;
2452     } else {
2453         trace_vnc_auth_pass(vs, vs->auth);
2454         vnc_write_u32(vs, 0); /* Accept auth */
2455         vnc_flush(vs);
2456 
2457         start_client_init(vs);
2458     }
2459 
2460     qcrypto_cipher_free(cipher);
2461     return 0;
2462 
2463 reject:
2464     vnc_write_u32(vs, 1); /* Reject auth */
2465     if (vs->minor >= 8) {
2466         static const char err[] = "Authentication failed";
2467         vnc_write_u32(vs, sizeof(err));
2468         vnc_write(vs, err, sizeof(err));
2469     }
2470     vnc_flush(vs);
2471     vnc_client_error(vs);
2472     qcrypto_cipher_free(cipher);
2473     return 0;
2474 }
2475 
2476 void start_auth_vnc(VncState *vs)
2477 {
2478     make_challenge(vs);
2479     /* Send client a 'random' challenge */
2480     vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2481     vnc_flush(vs);
2482 
2483     vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2484 }
2485 
2486 
2487 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2488 {
2489     /* We only advertise 1 auth scheme at a time, so client
2490      * must pick the one we sent. Verify this */
2491     if (data[0] != vs->auth) { /* Reject auth */
2492        trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2493        vnc_write_u32(vs, 1);
2494        if (vs->minor >= 8) {
2495            static const char err[] = "Authentication failed";
2496            vnc_write_u32(vs, sizeof(err));
2497            vnc_write(vs, err, sizeof(err));
2498        }
2499        vnc_client_error(vs);
2500     } else { /* Accept requested auth */
2501        trace_vnc_auth_start(vs, vs->auth);
2502        switch (vs->auth) {
2503        case VNC_AUTH_NONE:
2504            if (vs->minor >= 8) {
2505                vnc_write_u32(vs, 0); /* Accept auth completion */
2506                vnc_flush(vs);
2507            }
2508            trace_vnc_auth_pass(vs, vs->auth);
2509            start_client_init(vs);
2510            break;
2511 
2512        case VNC_AUTH_VNC:
2513            start_auth_vnc(vs);
2514            break;
2515 
2516        case VNC_AUTH_VENCRYPT:
2517            start_auth_vencrypt(vs);
2518            break;
2519 
2520 #ifdef CONFIG_VNC_SASL
2521        case VNC_AUTH_SASL:
2522            start_auth_sasl(vs);
2523            break;
2524 #endif /* CONFIG_VNC_SASL */
2525 
2526        default: /* Should not be possible, but just in case */
2527            trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2528            vnc_write_u8(vs, 1);
2529            if (vs->minor >= 8) {
2530                static const char err[] = "Authentication failed";
2531                vnc_write_u32(vs, sizeof(err));
2532                vnc_write(vs, err, sizeof(err));
2533            }
2534            vnc_client_error(vs);
2535        }
2536     }
2537     return 0;
2538 }
2539 
2540 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2541 {
2542     char local[13];
2543 
2544     memcpy(local, version, 12);
2545     local[12] = 0;
2546 
2547     if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2548         VNC_DEBUG("Malformed protocol version %s\n", local);
2549         vnc_client_error(vs);
2550         return 0;
2551     }
2552     VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2553     if (vs->major != 3 ||
2554         (vs->minor != 3 &&
2555          vs->minor != 4 &&
2556          vs->minor != 5 &&
2557          vs->minor != 7 &&
2558          vs->minor != 8)) {
2559         VNC_DEBUG("Unsupported client version\n");
2560         vnc_write_u32(vs, VNC_AUTH_INVALID);
2561         vnc_flush(vs);
2562         vnc_client_error(vs);
2563         return 0;
2564     }
2565     /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2566      * as equivalent to v3.3 by servers
2567      */
2568     if (vs->minor == 4 || vs->minor == 5)
2569         vs->minor = 3;
2570 
2571     if (vs->minor == 3) {
2572         trace_vnc_auth_start(vs, vs->auth);
2573         if (vs->auth == VNC_AUTH_NONE) {
2574             vnc_write_u32(vs, vs->auth);
2575             vnc_flush(vs);
2576             trace_vnc_auth_pass(vs, vs->auth);
2577             start_client_init(vs);
2578        } else if (vs->auth == VNC_AUTH_VNC) {
2579             VNC_DEBUG("Tell client VNC auth\n");
2580             vnc_write_u32(vs, vs->auth);
2581             vnc_flush(vs);
2582             start_auth_vnc(vs);
2583        } else {
2584             trace_vnc_auth_fail(vs, vs->auth,
2585                                 "Unsupported auth method for v3.3", "");
2586             vnc_write_u32(vs, VNC_AUTH_INVALID);
2587             vnc_flush(vs);
2588             vnc_client_error(vs);
2589        }
2590     } else {
2591         vnc_write_u8(vs, 1); /* num auth */
2592         vnc_write_u8(vs, vs->auth);
2593         vnc_read_when(vs, protocol_client_auth, 1);
2594         vnc_flush(vs);
2595     }
2596 
2597     return 0;
2598 }
2599 
2600 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2601 {
2602     struct VncSurface *vs = &vd->guest;
2603 
2604     return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2605 }
2606 
2607 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2608 {
2609     int i, j;
2610 
2611     w = (x + w) / VNC_STAT_RECT;
2612     h = (y + h) / VNC_STAT_RECT;
2613     x /= VNC_STAT_RECT;
2614     y /= VNC_STAT_RECT;
2615 
2616     for (j = y; j <= h; j++) {
2617         for (i = x; i <= w; i++) {
2618             vs->lossy_rect[j][i] = 1;
2619         }
2620     }
2621 }
2622 
2623 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2624 {
2625     VncState *vs;
2626     int sty = y / VNC_STAT_RECT;
2627     int stx = x / VNC_STAT_RECT;
2628     int has_dirty = 0;
2629 
2630     y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2631     x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2632 
2633     QTAILQ_FOREACH(vs, &vd->clients, next) {
2634         int j;
2635 
2636         /* kernel send buffers are full -> refresh later */
2637         if (vs->output.offset) {
2638             continue;
2639         }
2640 
2641         if (!vs->lossy_rect[sty][stx]) {
2642             continue;
2643         }
2644 
2645         vs->lossy_rect[sty][stx] = 0;
2646         for (j = 0; j < VNC_STAT_RECT; ++j) {
2647             bitmap_set(vs->dirty[y + j],
2648                        x / VNC_DIRTY_PIXELS_PER_BIT,
2649                        VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2650         }
2651         has_dirty++;
2652     }
2653 
2654     return has_dirty;
2655 }
2656 
2657 static int vnc_update_stats(VncDisplay *vd,  struct timeval * tv)
2658 {
2659     int width = MIN(pixman_image_get_width(vd->guest.fb),
2660                     pixman_image_get_width(vd->server));
2661     int height = MIN(pixman_image_get_height(vd->guest.fb),
2662                      pixman_image_get_height(vd->server));
2663     int x, y;
2664     struct timeval res;
2665     int has_dirty = 0;
2666 
2667     for (y = 0; y < height; y += VNC_STAT_RECT) {
2668         for (x = 0; x < width; x += VNC_STAT_RECT) {
2669             VncRectStat *rect = vnc_stat_rect(vd, x, y);
2670 
2671             rect->updated = false;
2672         }
2673     }
2674 
2675     qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2676 
2677     if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2678         return has_dirty;
2679     }
2680     vd->guest.last_freq_check = *tv;
2681 
2682     for (y = 0; y < height; y += VNC_STAT_RECT) {
2683         for (x = 0; x < width; x += VNC_STAT_RECT) {
2684             VncRectStat *rect= vnc_stat_rect(vd, x, y);
2685             int count = ARRAY_SIZE(rect->times);
2686             struct timeval min, max;
2687 
2688             if (!timerisset(&rect->times[count - 1])) {
2689                 continue ;
2690             }
2691 
2692             max = rect->times[(rect->idx + count - 1) % count];
2693             qemu_timersub(tv, &max, &res);
2694 
2695             if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2696                 rect->freq = 0;
2697                 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2698                 memset(rect->times, 0, sizeof (rect->times));
2699                 continue ;
2700             }
2701 
2702             min = rect->times[rect->idx];
2703             max = rect->times[(rect->idx + count - 1) % count];
2704             qemu_timersub(&max, &min, &res);
2705 
2706             rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2707             rect->freq /= count;
2708             rect->freq = 1. / rect->freq;
2709         }
2710     }
2711     return has_dirty;
2712 }
2713 
2714 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2715 {
2716     int i, j;
2717     double total = 0;
2718     int num = 0;
2719 
2720     x =  QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2721     y =  QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2722 
2723     for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2724         for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2725             total += vnc_stat_rect(vs->vd, i, j)->freq;
2726             num++;
2727         }
2728     }
2729 
2730     if (num) {
2731         return total / num;
2732     } else {
2733         return 0;
2734     }
2735 }
2736 
2737 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2738 {
2739     VncRectStat *rect;
2740 
2741     rect = vnc_stat_rect(vd, x, y);
2742     if (rect->updated) {
2743         return ;
2744     }
2745     rect->times[rect->idx] = *tv;
2746     rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2747     rect->updated = true;
2748 }
2749 
2750 static int vnc_refresh_server_surface(VncDisplay *vd)
2751 {
2752     int width = MIN(pixman_image_get_width(vd->guest.fb),
2753                     pixman_image_get_width(vd->server));
2754     int height = MIN(pixman_image_get_height(vd->guest.fb),
2755                      pixman_image_get_height(vd->server));
2756     int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2757     uint8_t *guest_row0 = NULL, *server_row0;
2758     VncState *vs;
2759     int has_dirty = 0;
2760     pixman_image_t *tmpbuf = NULL;
2761 
2762     struct timeval tv = { 0, 0 };
2763 
2764     if (!vd->non_adaptive) {
2765         gettimeofday(&tv, NULL);
2766         has_dirty = vnc_update_stats(vd, &tv);
2767     }
2768 
2769     /*
2770      * Walk through the guest dirty map.
2771      * Check and copy modified bits from guest to server surface.
2772      * Update server dirty map.
2773      */
2774     server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2775     server_stride = guest_stride = guest_ll =
2776         pixman_image_get_stride(vd->server);
2777     cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2778                     server_stride);
2779     if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2780         int width = pixman_image_get_width(vd->server);
2781         tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2782     } else {
2783         int guest_bpp =
2784             PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2785         guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2786         guest_stride = pixman_image_get_stride(vd->guest.fb);
2787         guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8));
2788     }
2789     line_bytes = MIN(server_stride, guest_ll);
2790 
2791     for (;;) {
2792         int x;
2793         uint8_t *guest_ptr, *server_ptr;
2794         unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2795                                              height * VNC_DIRTY_BPL(&vd->guest),
2796                                              y * VNC_DIRTY_BPL(&vd->guest));
2797         if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2798             /* no more dirty bits */
2799             break;
2800         }
2801         y = offset / VNC_DIRTY_BPL(&vd->guest);
2802         x = offset % VNC_DIRTY_BPL(&vd->guest);
2803 
2804         server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2805 
2806         if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2807             qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2808             guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2809         } else {
2810             guest_ptr = guest_row0 + y * guest_stride;
2811         }
2812         guest_ptr += x * cmp_bytes;
2813 
2814         for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2815              x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2816             int _cmp_bytes = cmp_bytes;
2817             if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2818                 continue;
2819             }
2820             if ((x + 1) * cmp_bytes > line_bytes) {
2821                 _cmp_bytes = line_bytes - x * cmp_bytes;
2822             }
2823             assert(_cmp_bytes >= 0);
2824             if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2825                 continue;
2826             }
2827             memcpy(server_ptr, guest_ptr, _cmp_bytes);
2828             if (!vd->non_adaptive) {
2829                 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2830                                  y, &tv);
2831             }
2832             QTAILQ_FOREACH(vs, &vd->clients, next) {
2833                 set_bit(x, vs->dirty[y]);
2834             }
2835             has_dirty++;
2836         }
2837 
2838         y++;
2839     }
2840     qemu_pixman_image_unref(tmpbuf);
2841     return has_dirty;
2842 }
2843 
2844 static void vnc_refresh(DisplayChangeListener *dcl)
2845 {
2846     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2847     VncState *vs, *vn;
2848     int has_dirty, rects = 0;
2849 
2850     if (QTAILQ_EMPTY(&vd->clients)) {
2851         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2852         return;
2853     }
2854 
2855     graphic_hw_update(vd->dcl.con);
2856 
2857     if (vnc_trylock_display(vd)) {
2858         update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2859         return;
2860     }
2861 
2862     has_dirty = vnc_refresh_server_surface(vd);
2863     vnc_unlock_display(vd);
2864 
2865     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2866         rects += vnc_update_client(vs, has_dirty, false);
2867         /* vs might be free()ed here */
2868     }
2869 
2870     if (has_dirty && rects) {
2871         vd->dcl.update_interval /= 2;
2872         if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2873             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2874         }
2875     } else {
2876         vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2877         if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2878             vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2879         }
2880     }
2881 }
2882 
2883 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
2884                         bool skipauth, bool websocket)
2885 {
2886     VncState *vs = g_new0(VncState, 1);
2887     bool first_client = QTAILQ_EMPTY(&vd->clients);
2888     int i;
2889 
2890     trace_vnc_client_connect(vs, sioc);
2891     vs->sioc = sioc;
2892     object_ref(OBJECT(vs->sioc));
2893     vs->ioc = QIO_CHANNEL(sioc);
2894     object_ref(OBJECT(vs->ioc));
2895     vs->vd = vd;
2896 
2897     buffer_init(&vs->input,          "vnc-input/%p", sioc);
2898     buffer_init(&vs->output,         "vnc-output/%p", sioc);
2899     buffer_init(&vs->jobs_buffer,    "vnc-jobs_buffer/%p", sioc);
2900 
2901     buffer_init(&vs->tight.tight,    "vnc-tight/%p", sioc);
2902     buffer_init(&vs->tight.zlib,     "vnc-tight-zlib/%p", sioc);
2903     buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
2904 #ifdef CONFIG_VNC_JPEG
2905     buffer_init(&vs->tight.jpeg,     "vnc-tight-jpeg/%p", sioc);
2906 #endif
2907 #ifdef CONFIG_VNC_PNG
2908     buffer_init(&vs->tight.png,      "vnc-tight-png/%p", sioc);
2909 #endif
2910     buffer_init(&vs->zlib.zlib,      "vnc-zlib/%p", sioc);
2911     buffer_init(&vs->zrle.zrle,      "vnc-zrle/%p", sioc);
2912     buffer_init(&vs->zrle.fb,        "vnc-zrle-fb/%p", sioc);
2913     buffer_init(&vs->zrle.zlib,      "vnc-zrle-zlib/%p", sioc);
2914 
2915     if (skipauth) {
2916 	vs->auth = VNC_AUTH_NONE;
2917 	vs->subauth = VNC_AUTH_INVALID;
2918     } else {
2919         if (websocket) {
2920             vs->auth = vd->ws_auth;
2921             vs->subauth = VNC_AUTH_INVALID;
2922         } else {
2923             vs->auth = vd->auth;
2924             vs->subauth = vd->subauth;
2925         }
2926     }
2927     VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
2928               sioc, websocket, vs->auth, vs->subauth);
2929 
2930     vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
2931     for (i = 0; i < VNC_STAT_ROWS; ++i) {
2932         vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
2933     }
2934 
2935     VNC_DEBUG("New client on socket %p\n", vs->sioc);
2936     update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2937     qio_channel_set_blocking(vs->ioc, false, NULL);
2938     if (vs->ioc_tag) {
2939         g_source_remove(vs->ioc_tag);
2940     }
2941     if (websocket) {
2942         vs->websocket = 1;
2943         if (vd->tlscreds) {
2944             vs->ioc_tag = qio_channel_add_watch(
2945                 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
2946         } else {
2947             vs->ioc_tag = qio_channel_add_watch(
2948                 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
2949         }
2950     } else {
2951         vs->ioc_tag = qio_channel_add_watch(
2952             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
2953     }
2954 
2955     vnc_client_cache_addr(vs);
2956     vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
2957     vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2958 
2959     vs->last_x = -1;
2960     vs->last_y = -1;
2961 
2962     vs->as.freq = 44100;
2963     vs->as.nchannels = 2;
2964     vs->as.fmt = AUD_FMT_S16;
2965     vs->as.endianness = 0;
2966 
2967     qemu_mutex_init(&vs->output_mutex);
2968     vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2969 
2970     QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
2971     if (first_client) {
2972         vnc_update_server_surface(vd);
2973     }
2974 
2975     graphic_hw_update(vd->dcl.con);
2976 
2977     if (!vs->websocket) {
2978         vnc_start_protocol(vs);
2979     }
2980 
2981     if (vd->num_connecting > vd->connections_limit) {
2982         QTAILQ_FOREACH(vs, &vd->clients, next) {
2983             if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
2984                 vnc_disconnect_start(vs);
2985                 return;
2986             }
2987         }
2988     }
2989 }
2990 
2991 void vnc_start_protocol(VncState *vs)
2992 {
2993     vnc_write(vs, "RFB 003.008\n", 12);
2994     vnc_flush(vs);
2995     vnc_read_when(vs, protocol_version, 12);
2996 
2997     vs->mouse_mode_notifier.notify = check_pointer_type_change;
2998     qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2999 }
3000 
3001 static gboolean vnc_listen_io(QIOChannel *ioc,
3002                               GIOCondition condition,
3003                               void *opaque)
3004 {
3005     VncDisplay *vd = opaque;
3006     QIOChannelSocket *sioc = NULL;
3007     Error *err = NULL;
3008     bool isWebsock = false;
3009     size_t i;
3010 
3011     for (i = 0; i < vd->nlwebsock; i++) {
3012         if (ioc == QIO_CHANNEL(vd->lwebsock[i])) {
3013             isWebsock = true;
3014             break;
3015         }
3016     }
3017 
3018     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc), &err);
3019     if (sioc != NULL) {
3020         qio_channel_set_name(QIO_CHANNEL(sioc),
3021                              isWebsock ? "vnc-ws-server" : "vnc-server");
3022         qio_channel_set_delay(QIO_CHANNEL(sioc), false);
3023         vnc_connect(vd, sioc, false, isWebsock);
3024         object_unref(OBJECT(sioc));
3025     } else {
3026         /* client probably closed connection before we got there */
3027         error_free(err);
3028     }
3029 
3030     return TRUE;
3031 }
3032 
3033 static const DisplayChangeListenerOps dcl_ops = {
3034     .dpy_name             = "vnc",
3035     .dpy_refresh          = vnc_refresh,
3036     .dpy_gfx_update       = vnc_dpy_update,
3037     .dpy_gfx_switch       = vnc_dpy_switch,
3038     .dpy_gfx_check_format = qemu_pixman_check_format,
3039     .dpy_mouse_set        = vnc_mouse_set,
3040     .dpy_cursor_define    = vnc_dpy_cursor_define,
3041 };
3042 
3043 void vnc_display_init(const char *id)
3044 {
3045     VncDisplay *vd;
3046 
3047     if (vnc_display_find(id) != NULL) {
3048         return;
3049     }
3050     vd = g_malloc0(sizeof(*vd));
3051 
3052     vd->id = strdup(id);
3053     QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3054 
3055     QTAILQ_INIT(&vd->clients);
3056     vd->expires = TIME_MAX;
3057 
3058     if (keyboard_layout) {
3059         trace_vnc_key_map_init(keyboard_layout);
3060         vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3061     } else {
3062         vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3063     }
3064 
3065     if (!vd->kbd_layout) {
3066         exit(1);
3067     }
3068 
3069     vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3070     vd->connections_limit = 32;
3071 
3072     qemu_mutex_init(&vd->mutex);
3073     vnc_start_worker_thread();
3074 
3075     vd->dcl.ops = &dcl_ops;
3076     register_displaychangelistener(&vd->dcl);
3077 }
3078 
3079 
3080 static void vnc_display_close(VncDisplay *vd)
3081 {
3082     size_t i;
3083     if (!vd) {
3084         return;
3085     }
3086     vd->is_unix = false;
3087     for (i = 0; i < vd->nlsock; i++) {
3088         if (vd->lsock_tag[i]) {
3089             g_source_remove(vd->lsock_tag[i]);
3090         }
3091         object_unref(OBJECT(vd->lsock[i]));
3092     }
3093     g_free(vd->lsock);
3094     g_free(vd->lsock_tag);
3095     vd->lsock = NULL;
3096     vd->lsock_tag = NULL;
3097     vd->nlsock = 0;
3098 
3099     for (i = 0; i < vd->nlwebsock; i++) {
3100         if (vd->lwebsock_tag[i]) {
3101             g_source_remove(vd->lwebsock_tag[i]);
3102         }
3103         object_unref(OBJECT(vd->lwebsock[i]));
3104     }
3105     g_free(vd->lwebsock);
3106     g_free(vd->lwebsock_tag);
3107     vd->lwebsock = NULL;
3108     vd->lwebsock_tag = NULL;
3109     vd->nlwebsock = 0;
3110 
3111     vd->auth = VNC_AUTH_INVALID;
3112     vd->subauth = VNC_AUTH_INVALID;
3113     if (vd->tlscreds) {
3114         object_unparent(OBJECT(vd->tlscreds));
3115         vd->tlscreds = NULL;
3116     }
3117     g_free(vd->tlsaclname);
3118     vd->tlsaclname = NULL;
3119     if (vd->lock_key_sync) {
3120         qemu_remove_led_event_handler(vd->led);
3121         vd->led = NULL;
3122     }
3123 }
3124 
3125 int vnc_display_password(const char *id, const char *password)
3126 {
3127     VncDisplay *vd = vnc_display_find(id);
3128 
3129     if (!vd) {
3130         return -EINVAL;
3131     }
3132     if (vd->auth == VNC_AUTH_NONE) {
3133         error_printf_unless_qmp("If you want use passwords please enable "
3134                                 "password auth using '-vnc ${dpy},password'.\n");
3135         return -EINVAL;
3136     }
3137 
3138     g_free(vd->password);
3139     vd->password = g_strdup(password);
3140 
3141     return 0;
3142 }
3143 
3144 int vnc_display_pw_expire(const char *id, time_t expires)
3145 {
3146     VncDisplay *vd = vnc_display_find(id);
3147 
3148     if (!vd) {
3149         return -EINVAL;
3150     }
3151 
3152     vd->expires = expires;
3153     return 0;
3154 }
3155 
3156 static void vnc_display_print_local_addr(VncDisplay *vd)
3157 {
3158     SocketAddress *addr;
3159     Error *err = NULL;
3160 
3161     if (!vd->nlsock) {
3162         return;
3163     }
3164 
3165     addr = qio_channel_socket_get_local_address(vd->lsock[0], &err);
3166     if (!addr) {
3167         return;
3168     }
3169 
3170     if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3171         qapi_free_SocketAddress(addr);
3172         return;
3173     }
3174     error_printf_unless_qmp("VNC server running on %s:%s\n",
3175                             addr->u.inet.host,
3176                             addr->u.inet.port);
3177     qapi_free_SocketAddress(addr);
3178 }
3179 
3180 static QemuOptsList qemu_vnc_opts = {
3181     .name = "vnc",
3182     .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3183     .implied_opt_name = "vnc",
3184     .desc = {
3185         {
3186             .name = "vnc",
3187             .type = QEMU_OPT_STRING,
3188         },{
3189             .name = "websocket",
3190             .type = QEMU_OPT_STRING,
3191         },{
3192             .name = "tls-creds",
3193             .type = QEMU_OPT_STRING,
3194         },{
3195             /* Deprecated in favour of tls-creds */
3196             .name = "x509",
3197             .type = QEMU_OPT_STRING,
3198         },{
3199             .name = "share",
3200             .type = QEMU_OPT_STRING,
3201         },{
3202             .name = "display",
3203             .type = QEMU_OPT_STRING,
3204         },{
3205             .name = "head",
3206             .type = QEMU_OPT_NUMBER,
3207         },{
3208             .name = "connections",
3209             .type = QEMU_OPT_NUMBER,
3210         },{
3211             .name = "to",
3212             .type = QEMU_OPT_NUMBER,
3213         },{
3214             .name = "ipv4",
3215             .type = QEMU_OPT_BOOL,
3216         },{
3217             .name = "ipv6",
3218             .type = QEMU_OPT_BOOL,
3219         },{
3220             .name = "password",
3221             .type = QEMU_OPT_BOOL,
3222         },{
3223             .name = "reverse",
3224             .type = QEMU_OPT_BOOL,
3225         },{
3226             .name = "lock-key-sync",
3227             .type = QEMU_OPT_BOOL,
3228         },{
3229             .name = "key-delay-ms",
3230             .type = QEMU_OPT_NUMBER,
3231         },{
3232             .name = "sasl",
3233             .type = QEMU_OPT_BOOL,
3234         },{
3235             /* Deprecated in favour of tls-creds */
3236             .name = "tls",
3237             .type = QEMU_OPT_BOOL,
3238         },{
3239             /* Deprecated in favour of tls-creds */
3240             .name = "x509verify",
3241             .type = QEMU_OPT_STRING,
3242         },{
3243             .name = "acl",
3244             .type = QEMU_OPT_BOOL,
3245         },{
3246             .name = "lossy",
3247             .type = QEMU_OPT_BOOL,
3248         },{
3249             .name = "non-adaptive",
3250             .type = QEMU_OPT_BOOL,
3251         },
3252         { /* end of list */ }
3253     },
3254 };
3255 
3256 
3257 static int
3258 vnc_display_setup_auth(int *auth,
3259                        int *subauth,
3260                        QCryptoTLSCreds *tlscreds,
3261                        bool password,
3262                        bool sasl,
3263                        bool websocket,
3264                        Error **errp)
3265 {
3266     /*
3267      * We have a choice of 3 authentication options
3268      *
3269      *   1. none
3270      *   2. vnc
3271      *   3. sasl
3272      *
3273      * The channel can be run in 2 modes
3274      *
3275      *   1. clear
3276      *   2. tls
3277      *
3278      * And TLS can use 2 types of credentials
3279      *
3280      *   1. anon
3281      *   2. x509
3282      *
3283      * We thus have 9 possible logical combinations
3284      *
3285      *   1. clear + none
3286      *   2. clear + vnc
3287      *   3. clear + sasl
3288      *   4. tls + anon + none
3289      *   5. tls + anon + vnc
3290      *   6. tls + anon + sasl
3291      *   7. tls + x509 + none
3292      *   8. tls + x509 + vnc
3293      *   9. tls + x509 + sasl
3294      *
3295      * These need to be mapped into the VNC auth schemes
3296      * in an appropriate manner. In regular VNC, all the
3297      * TLS options get mapped into VNC_AUTH_VENCRYPT
3298      * sub-auth types.
3299      *
3300      * In websockets, the https:// protocol already provides
3301      * TLS support, so there is no need to make use of the
3302      * VeNCrypt extension. Furthermore, websockets browser
3303      * clients could not use VeNCrypt even if they wanted to,
3304      * as they cannot control when the TLS handshake takes
3305      * place. Thus there is no option but to rely on https://,
3306      * meaning combinations 4->6 and 7->9 will be mapped to
3307      * VNC auth schemes in the same way as combos 1->3.
3308      *
3309      * Regardless of fact that we have a different mapping to
3310      * VNC auth mechs for plain VNC vs websockets VNC, the end
3311      * result has the same security characteristics.
3312      */
3313     if (websocket || !tlscreds) {
3314         if (password) {
3315             VNC_DEBUG("Initializing VNC server with password auth\n");
3316             *auth = VNC_AUTH_VNC;
3317         } else if (sasl) {
3318             VNC_DEBUG("Initializing VNC server with SASL auth\n");
3319             *auth = VNC_AUTH_SASL;
3320         } else {
3321             VNC_DEBUG("Initializing VNC server with no auth\n");
3322             *auth = VNC_AUTH_NONE;
3323         }
3324         *subauth = VNC_AUTH_INVALID;
3325     } else {
3326         bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3327                                            TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3328         bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3329                                            TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3330 
3331         if (!is_x509 && !is_anon) {
3332             error_setg(errp,
3333                        "Unsupported TLS cred type %s",
3334                        object_get_typename(OBJECT(tlscreds)));
3335             return -1;
3336         }
3337         *auth = VNC_AUTH_VENCRYPT;
3338         if (password) {
3339             if (is_x509) {
3340                 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3341                 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3342             } else {
3343                 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3344                 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3345             }
3346 
3347         } else if (sasl) {
3348             if (is_x509) {
3349                 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3350                 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3351             } else {
3352                 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3353                 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3354             }
3355         } else {
3356             if (is_x509) {
3357                 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3358                 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3359             } else {
3360                 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3361                 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3362             }
3363         }
3364     }
3365     return 0;
3366 }
3367 
3368 
3369 /*
3370  * Handle back compat with old CLI syntax by creating some
3371  * suitable QCryptoTLSCreds objects
3372  */
3373 static QCryptoTLSCreds *
3374 vnc_display_create_creds(bool x509,
3375                          bool x509verify,
3376                          const char *dir,
3377                          const char *id,
3378                          Error **errp)
3379 {
3380     gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3381     Object *parent = object_get_objects_root();
3382     Object *creds;
3383     Error *err = NULL;
3384 
3385     if (x509) {
3386         creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3387                                       parent,
3388                                       credsid,
3389                                       &err,
3390                                       "endpoint", "server",
3391                                       "dir", dir,
3392                                       "verify-peer", x509verify ? "yes" : "no",
3393                                       NULL);
3394     } else {
3395         creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3396                                       parent,
3397                                       credsid,
3398                                       &err,
3399                                       "endpoint", "server",
3400                                       NULL);
3401     }
3402 
3403     g_free(credsid);
3404 
3405     if (err) {
3406         error_propagate(errp, err);
3407         return NULL;
3408     }
3409 
3410     return QCRYPTO_TLS_CREDS(creds);
3411 }
3412 
3413 
3414 static int vnc_display_get_address(const char *addrstr,
3415                                    bool websocket,
3416                                    bool reverse,
3417                                    int displaynum,
3418                                    int to,
3419                                    bool has_ipv4,
3420                                    bool has_ipv6,
3421                                    bool ipv4,
3422                                    bool ipv6,
3423                                    SocketAddress **retaddr,
3424                                    Error **errp)
3425 {
3426     int ret = -1;
3427     SocketAddress *addr = NULL;
3428 
3429     addr = g_new0(SocketAddress, 1);
3430 
3431     if (strncmp(addrstr, "unix:", 5) == 0) {
3432         addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3433         addr->u.q_unix.path = g_strdup(addrstr + 5);
3434 
3435         if (websocket) {
3436             error_setg(errp, "UNIX sockets not supported with websock");
3437             goto cleanup;
3438         }
3439 
3440         if (to) {
3441             error_setg(errp, "Port range not support with UNIX socket");
3442             goto cleanup;
3443         }
3444         ret = 0;
3445     } else {
3446         const char *port;
3447         size_t hostlen;
3448         unsigned long long baseport = 0;
3449         InetSocketAddress *inet;
3450 
3451         port = strrchr(addrstr, ':');
3452         if (!port) {
3453             if (websocket) {
3454                 hostlen = 0;
3455                 port = addrstr;
3456             } else {
3457                 error_setg(errp, "no vnc port specified");
3458                 goto cleanup;
3459             }
3460         } else {
3461             hostlen = port - addrstr;
3462             port++;
3463             if (*port == '\0') {
3464                 error_setg(errp, "vnc port cannot be empty");
3465                 goto cleanup;
3466             }
3467         }
3468 
3469         addr->type = SOCKET_ADDRESS_TYPE_INET;
3470         inet = &addr->u.inet;
3471         if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3472             inet->host = g_strndup(addrstr + 1, hostlen - 2);
3473         } else {
3474             inet->host = g_strndup(addrstr, hostlen);
3475         }
3476         /* plain VNC port is just an offset, for websocket
3477          * port is absolute */
3478         if (websocket) {
3479             if (g_str_equal(addrstr, "") ||
3480                 g_str_equal(addrstr, "on")) {
3481                 if (displaynum == -1) {
3482                     error_setg(errp, "explicit websocket port is required");
3483                     goto cleanup;
3484                 }
3485                 inet->port = g_strdup_printf(
3486                     "%d", displaynum + 5700);
3487                 if (to) {
3488                     inet->has_to = true;
3489                     inet->to = to + 5700;
3490                 }
3491             } else {
3492                 inet->port = g_strdup(port);
3493             }
3494         } else {
3495             int offset = reverse ? 0 : 5900;
3496             if (parse_uint_full(port, &baseport, 10) < 0) {
3497                 error_setg(errp, "can't convert to a number: %s", port);
3498                 goto cleanup;
3499             }
3500             if (baseport > 65535 ||
3501                 baseport + offset > 65535) {
3502                 error_setg(errp, "port %s out of range", port);
3503                 goto cleanup;
3504             }
3505             inet->port = g_strdup_printf(
3506                 "%d", (int)baseport + offset);
3507 
3508             if (to) {
3509                 inet->has_to = true;
3510                 inet->to = to + offset;
3511             }
3512         }
3513 
3514         inet->ipv4 = ipv4;
3515         inet->has_ipv4 = has_ipv4;
3516         inet->ipv6 = ipv6;
3517         inet->has_ipv6 = has_ipv6;
3518 
3519         ret = baseport;
3520     }
3521 
3522     *retaddr = addr;
3523 
3524  cleanup:
3525     if (ret < 0) {
3526         qapi_free_SocketAddress(addr);
3527     }
3528     return ret;
3529 }
3530 
3531 static void vnc_free_addresses(SocketAddress ***retsaddr,
3532                                size_t *retnsaddr)
3533 {
3534     size_t i;
3535 
3536     for (i = 0; i < *retnsaddr; i++) {
3537         qapi_free_SocketAddress((*retsaddr)[i]);
3538     }
3539     g_free(*retsaddr);
3540 
3541     *retsaddr = NULL;
3542     *retnsaddr = 0;
3543 }
3544 
3545 static int vnc_display_get_addresses(QemuOpts *opts,
3546                                      bool reverse,
3547                                      SocketAddress ***retsaddr,
3548                                      size_t *retnsaddr,
3549                                      SocketAddress ***retwsaddr,
3550                                      size_t *retnwsaddr,
3551                                      Error **errp)
3552 {
3553     SocketAddress *saddr = NULL;
3554     SocketAddress *wsaddr = NULL;
3555     QemuOptsIter addriter;
3556     const char *addr;
3557     int to = qemu_opt_get_number(opts, "to", 0);
3558     bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3559     bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3560     bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3561     bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3562     int displaynum = -1;
3563     int ret = -1;
3564 
3565     *retsaddr = NULL;
3566     *retnsaddr = 0;
3567     *retwsaddr = NULL;
3568     *retnwsaddr = 0;
3569 
3570     addr = qemu_opt_get(opts, "vnc");
3571     if (addr == NULL || g_str_equal(addr, "none")) {
3572         ret = 0;
3573         goto cleanup;
3574     }
3575     if (qemu_opt_get(opts, "websocket") &&
3576         !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3577         error_setg(errp,
3578                    "SHA1 hash support is required for websockets");
3579         goto cleanup;
3580     }
3581 
3582     qemu_opt_iter_init(&addriter, opts, "vnc");
3583     while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3584         int rv;
3585         rv = vnc_display_get_address(addr, false, reverse, 0, to,
3586                                      has_ipv4, has_ipv6,
3587                                      ipv4, ipv6,
3588                                      &saddr, errp);
3589         if (rv < 0) {
3590             goto cleanup;
3591         }
3592         /* Historical compat - first listen address can be used
3593          * to set the default websocket port
3594          */
3595         if (displaynum == -1) {
3596             displaynum = rv;
3597         }
3598         *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3599         (*retsaddr)[(*retnsaddr)++] = saddr;
3600     }
3601 
3602     /* If we had multiple primary displays, we don't do defaults
3603      * for websocket, and require explicit config instead. */
3604     if (*retnsaddr > 1) {
3605         displaynum = -1;
3606     }
3607 
3608     qemu_opt_iter_init(&addriter, opts, "websocket");
3609     while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3610         if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3611                                     has_ipv4, has_ipv6,
3612                                     ipv4, ipv6,
3613                                     &wsaddr, errp) < 0) {
3614             goto cleanup;
3615         }
3616 
3617         /* Historical compat - if only a single listen address was
3618          * provided, then this is used to set the default listen
3619          * address for websocket too
3620          */
3621         if (*retnsaddr == 1 &&
3622             (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3623             wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3624             g_str_equal(wsaddr->u.inet.host, "") &&
3625             !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3626             g_free(wsaddr->u.inet.host);
3627             wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3628         }
3629 
3630         *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3631         (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3632     }
3633 
3634     ret = 0;
3635  cleanup:
3636     if (ret < 0) {
3637         vnc_free_addresses(retsaddr, retnsaddr);
3638         vnc_free_addresses(retwsaddr, retnwsaddr);
3639     }
3640     return ret;
3641 }
3642 
3643 static int vnc_display_connect(VncDisplay *vd,
3644                                SocketAddress **saddr,
3645                                size_t nsaddr,
3646                                SocketAddress **wsaddr,
3647                                size_t nwsaddr,
3648                                Error **errp)
3649 {
3650     /* connect to viewer */
3651     QIOChannelSocket *sioc = NULL;
3652     if (nwsaddr != 0) {
3653         error_setg(errp, "Cannot use websockets in reverse mode");
3654         return -1;
3655     }
3656     if (nsaddr != 1) {
3657         error_setg(errp, "Expected a single address in reverse mode");
3658         return -1;
3659     }
3660     /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3661     vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3662     sioc = qio_channel_socket_new();
3663     qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3664     if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3665         return -1;
3666     }
3667     vnc_connect(vd, sioc, false, false);
3668     object_unref(OBJECT(sioc));
3669     return 0;
3670 }
3671 
3672 
3673 static int vnc_display_listen_addr(VncDisplay *vd,
3674                                    SocketAddress *addr,
3675                                    const char *name,
3676                                    QIOChannelSocket ***lsock,
3677                                    guint **lsock_tag,
3678                                    size_t *nlsock,
3679                                    Error **errp)
3680 {
3681     QIODNSResolver *resolver = qio_dns_resolver_get_instance();
3682     SocketAddress **rawaddrs = NULL;
3683     size_t nrawaddrs = 0;
3684     Error *listenerr = NULL;
3685     bool listening = false;
3686     size_t i;
3687 
3688     if (qio_dns_resolver_lookup_sync(resolver, addr, &nrawaddrs,
3689                                      &rawaddrs, errp) < 0) {
3690         return -1;
3691     }
3692 
3693     for (i = 0; i < nrawaddrs; i++) {
3694         QIOChannelSocket *sioc = qio_channel_socket_new();
3695 
3696         qio_channel_set_name(QIO_CHANNEL(sioc), name);
3697         if (qio_channel_socket_listen_sync(
3698                 sioc, rawaddrs[i], listenerr == NULL ? &listenerr : NULL) < 0) {
3699             object_unref(OBJECT(sioc));
3700             continue;
3701         }
3702         listening = true;
3703         (*nlsock)++;
3704         *lsock = g_renew(QIOChannelSocket *, *lsock, *nlsock);
3705         *lsock_tag = g_renew(guint, *lsock_tag, *nlsock);
3706 
3707         (*lsock)[*nlsock - 1] = sioc;
3708         (*lsock_tag)[*nlsock - 1] = 0;
3709     }
3710 
3711     for (i = 0; i < nrawaddrs; i++) {
3712         qapi_free_SocketAddress(rawaddrs[i]);
3713     }
3714     g_free(rawaddrs);
3715 
3716     if (listenerr) {
3717         if (!listening) {
3718             error_propagate(errp, listenerr);
3719             return -1;
3720         } else {
3721             error_free(listenerr);
3722         }
3723     }
3724 
3725     for (i = 0; i < *nlsock; i++) {
3726         (*lsock_tag)[i] = qio_channel_add_watch(
3727             QIO_CHANNEL((*lsock)[i]),
3728             G_IO_IN, vnc_listen_io, vd, NULL);
3729     }
3730 
3731     return 0;
3732 }
3733 
3734 
3735 static int vnc_display_listen(VncDisplay *vd,
3736                               SocketAddress **saddr,
3737                               size_t nsaddr,
3738                               SocketAddress **wsaddr,
3739                               size_t nwsaddr,
3740                               Error **errp)
3741 {
3742     size_t i;
3743 
3744     for (i = 0; i < nsaddr; i++) {
3745         if (vnc_display_listen_addr(vd, saddr[i],
3746                                     "vnc-listen",
3747                                     &vd->lsock,
3748                                     &vd->lsock_tag,
3749                                     &vd->nlsock,
3750                                     errp) < 0) {
3751             return -1;
3752         }
3753     }
3754     for (i = 0; i < nwsaddr; i++) {
3755         if (vnc_display_listen_addr(vd, wsaddr[i],
3756                                     "vnc-ws-listen",
3757                                     &vd->lwebsock,
3758                                     &vd->lwebsock_tag,
3759                                     &vd->nlwebsock,
3760                                     errp) < 0) {
3761             return -1;
3762         }
3763     }
3764 
3765     return 0;
3766 }
3767 
3768 
3769 void vnc_display_open(const char *id, Error **errp)
3770 {
3771     VncDisplay *vd = vnc_display_find(id);
3772     QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3773     SocketAddress **saddr = NULL, **wsaddr = NULL;
3774     size_t nsaddr, nwsaddr;
3775     const char *share, *device_id;
3776     QemuConsole *con;
3777     bool password = false;
3778     bool reverse = false;
3779     const char *credid;
3780     bool sasl = false;
3781 #ifdef CONFIG_VNC_SASL
3782     int saslErr;
3783 #endif
3784     int acl = 0;
3785     int lock_key_sync = 1;
3786     int key_delay_ms;
3787 
3788     if (!vd) {
3789         error_setg(errp, "VNC display not active");
3790         return;
3791     }
3792     vnc_display_close(vd);
3793 
3794     if (!opts) {
3795         return;
3796     }
3797 
3798     reverse = qemu_opt_get_bool(opts, "reverse", false);
3799     if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3800                                   &wsaddr, &nwsaddr, errp) < 0) {
3801         goto fail;
3802     }
3803 
3804     password = qemu_opt_get_bool(opts, "password", false);
3805     if (password) {
3806         if (fips_get_state()) {
3807             error_setg(errp,
3808                        "VNC password auth disabled due to FIPS mode, "
3809                        "consider using the VeNCrypt or SASL authentication "
3810                        "methods as an alternative");
3811             goto fail;
3812         }
3813         if (!qcrypto_cipher_supports(
3814                 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3815             error_setg(errp,
3816                        "Cipher backend does not support DES RFB algorithm");
3817             goto fail;
3818         }
3819     }
3820 
3821     lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3822     key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3823     sasl = qemu_opt_get_bool(opts, "sasl", false);
3824 #ifndef CONFIG_VNC_SASL
3825     if (sasl) {
3826         error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3827         goto fail;
3828     }
3829 #endif /* CONFIG_VNC_SASL */
3830     credid = qemu_opt_get(opts, "tls-creds");
3831     if (credid) {
3832         Object *creds;
3833         if (qemu_opt_get(opts, "tls") ||
3834             qemu_opt_get(opts, "x509") ||
3835             qemu_opt_get(opts, "x509verify")) {
3836             error_setg(errp,
3837                        "'tls-creds' parameter is mutually exclusive with "
3838                        "'tls', 'x509' and 'x509verify' parameters");
3839             goto fail;
3840         }
3841 
3842         creds = object_resolve_path_component(
3843             object_get_objects_root(), credid);
3844         if (!creds) {
3845             error_setg(errp, "No TLS credentials with id '%s'",
3846                        credid);
3847             goto fail;
3848         }
3849         vd->tlscreds = (QCryptoTLSCreds *)
3850             object_dynamic_cast(creds,
3851                                 TYPE_QCRYPTO_TLS_CREDS);
3852         if (!vd->tlscreds) {
3853             error_setg(errp, "Object with id '%s' is not TLS credentials",
3854                        credid);
3855             goto fail;
3856         }
3857         object_ref(OBJECT(vd->tlscreds));
3858 
3859         if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3860             error_setg(errp,
3861                        "Expecting TLS credentials with a server endpoint");
3862             goto fail;
3863         }
3864     } else {
3865         const char *path;
3866         bool tls = false, x509 = false, x509verify = false;
3867         tls  = qemu_opt_get_bool(opts, "tls", false);
3868         if (tls) {
3869             path = qemu_opt_get(opts, "x509");
3870 
3871             if (path) {
3872                 x509 = true;
3873             } else {
3874                 path = qemu_opt_get(opts, "x509verify");
3875                 if (path) {
3876                     x509 = true;
3877                     x509verify = true;
3878                 }
3879             }
3880             vd->tlscreds = vnc_display_create_creds(x509,
3881                                                     x509verify,
3882                                                     path,
3883                                                     vd->id,
3884                                                     errp);
3885             if (!vd->tlscreds) {
3886                 goto fail;
3887             }
3888         }
3889     }
3890     acl = qemu_opt_get_bool(opts, "acl", false);
3891 
3892     share = qemu_opt_get(opts, "share");
3893     if (share) {
3894         if (strcmp(share, "ignore") == 0) {
3895             vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3896         } else if (strcmp(share, "allow-exclusive") == 0) {
3897             vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3898         } else if (strcmp(share, "force-shared") == 0) {
3899             vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3900         } else {
3901             error_setg(errp, "unknown vnc share= option");
3902             goto fail;
3903         }
3904     } else {
3905         vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3906     }
3907     vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3908 
3909 #ifdef CONFIG_VNC_JPEG
3910     vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3911 #endif
3912     vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3913     /* adaptive updates are only used with tight encoding and
3914      * if lossy updates are enabled so we can disable all the
3915      * calculations otherwise */
3916     if (!vd->lossy) {
3917         vd->non_adaptive = true;
3918     }
3919 
3920     if (acl) {
3921         if (strcmp(vd->id, "default") == 0) {
3922             vd->tlsaclname = g_strdup("vnc.x509dname");
3923         } else {
3924             vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3925         }
3926         qemu_acl_init(vd->tlsaclname);
3927     }
3928 #ifdef CONFIG_VNC_SASL
3929     if (acl && sasl) {
3930         char *aclname;
3931 
3932         if (strcmp(vd->id, "default") == 0) {
3933             aclname = g_strdup("vnc.username");
3934         } else {
3935             aclname = g_strdup_printf("vnc.%s.username", vd->id);
3936         }
3937         vd->sasl.acl = qemu_acl_init(aclname);
3938         g_free(aclname);
3939     }
3940 #endif
3941 
3942     if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3943                                vd->tlscreds, password,
3944                                sasl, false, errp) < 0) {
3945         goto fail;
3946     }
3947     trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
3948 
3949     if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3950                                vd->tlscreds, password,
3951                                sasl, true, errp) < 0) {
3952         goto fail;
3953     }
3954     trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
3955 
3956 #ifdef CONFIG_VNC_SASL
3957     if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3958         error_setg(errp, "Failed to initialize SASL auth: %s",
3959                    sasl_errstring(saslErr, NULL, NULL));
3960         goto fail;
3961     }
3962 #endif
3963     vd->lock_key_sync = lock_key_sync;
3964     if (lock_key_sync) {
3965         vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3966     }
3967     vd->ledstate = 0;
3968     vd->key_delay_ms = key_delay_ms;
3969 
3970     device_id = qemu_opt_get(opts, "display");
3971     if (device_id) {
3972         int head = qemu_opt_get_number(opts, "head", 0);
3973         Error *err = NULL;
3974 
3975         con = qemu_console_lookup_by_device_name(device_id, head, &err);
3976         if (err) {
3977             error_propagate(errp, err);
3978             goto fail;
3979         }
3980     } else {
3981         con = NULL;
3982     }
3983 
3984     if (con != vd->dcl.con) {
3985         unregister_displaychangelistener(&vd->dcl);
3986         vd->dcl.con = con;
3987         register_displaychangelistener(&vd->dcl);
3988     }
3989 
3990     if (saddr == NULL) {
3991         goto cleanup;
3992     }
3993 
3994     if (reverse) {
3995         if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
3996             goto fail;
3997         }
3998     } else {
3999         if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4000             goto fail;
4001         }
4002     }
4003 
4004     if (qemu_opt_get(opts, "to")) {
4005         vnc_display_print_local_addr(vd);
4006     }
4007 
4008  cleanup:
4009     vnc_free_addresses(&saddr, &nsaddr);
4010     vnc_free_addresses(&wsaddr, &nwsaddr);
4011     return;
4012 
4013 fail:
4014     vnc_display_close(vd);
4015     goto cleanup;
4016 }
4017 
4018 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4019 {
4020     VncDisplay *vd = vnc_display_find(id);
4021     QIOChannelSocket *sioc;
4022 
4023     if (!vd) {
4024         return;
4025     }
4026 
4027     sioc = qio_channel_socket_new_fd(csock, NULL);
4028     if (sioc) {
4029         qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4030         vnc_connect(vd, sioc, skipauth, false);
4031         object_unref(OBJECT(sioc));
4032     }
4033 }
4034 
4035 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4036 {
4037     int i = 2;
4038     char *id;
4039 
4040     id = g_strdup("default");
4041     while (qemu_opts_find(olist, id)) {
4042         g_free(id);
4043         id = g_strdup_printf("vnc%d", i++);
4044     }
4045     qemu_opts_set_id(opts, id);
4046 }
4047 
4048 QemuOpts *vnc_parse(const char *str, Error **errp)
4049 {
4050     QemuOptsList *olist = qemu_find_opts("vnc");
4051     QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4052     const char *id;
4053 
4054     if (!opts) {
4055         return NULL;
4056     }
4057 
4058     id = qemu_opts_id(opts);
4059     if (!id) {
4060         /* auto-assign id if not present */
4061         vnc_auto_assign_id(olist, opts);
4062     }
4063     return opts;
4064 }
4065 
4066 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4067 {
4068     Error *local_err = NULL;
4069     char *id = (char *)qemu_opts_id(opts);
4070 
4071     assert(id);
4072     vnc_display_init(id);
4073     vnc_display_open(id, &local_err);
4074     if (local_err != NULL) {
4075         error_reportf_err(local_err, "Failed to start VNC server: ");
4076         exit(1);
4077     }
4078     return 0;
4079 }
4080 
4081 static void vnc_register_config(void)
4082 {
4083     qemu_add_opts(&qemu_vnc_opts);
4084 }
4085 opts_init(vnc_register_config);
4086