?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix overflow in i440fx_init()
[qemu/lumag.git] / vnc.c
blob11ae3e5172b2dcdcac8a6d54d952d7316f5d91b7
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32 #include "qemu-objects.h"
33
34 #define VNC_REFRESH_INTERVAL_BASE 30
35 #define VNC_REFRESH_INTERVAL_INC 50
36 #define VNC_REFRESH_INTERVAL_MAX 2000
37
38 #include "vnc_keysym.h"
39 #include "d3des.h"
40
41 #define count_bits(c, v) { \
42 for (c = 0; v; v >>= 1) \
43 { \
44 c += v & 1; \
45 } \
46 }
47
48
49 static VncDisplay *vnc_display; /* needed for info vnc */
50 static DisplayChangeListener *dcl;
51
52 static int vnc_cursor_define(VncState *vs);
53
54 static char *addr_to_string(const char *format,
55 struct sockaddr_storage *sa,
56 socklen_t salen) {
57 char *addr;
58 char host[NI_MAXHOST];
59 char serv[NI_MAXSERV];
60 int err;
61 size_t addrlen;
62
63 if ((err = getnameinfo((struct sockaddr *)sa, salen,
64 host, sizeof(host),
65 serv, sizeof(serv),
66 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
67 VNC_DEBUG("Cannot resolve address %d: %s\n",
68 err, gai_strerror(err));
69 return NULL;
70 }
71
72 /* Enough for the existing format + the 2 vars we're
73 * substituting in. */
74 addrlen = strlen(format) + strlen(host) + strlen(serv);
75 addr = qemu_malloc(addrlen + 1);
76 snprintf(addr, addrlen, format, host, serv);
77 addr[addrlen] = '\0';
78
79 return addr;
80 }
81
82
83 char *vnc_socket_local_addr(const char *format, int fd) {
84 struct sockaddr_storage sa;
85 socklen_t salen;
86
87 salen = sizeof(sa);
88 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
89 return NULL;
90
91 return addr_to_string(format, &sa, salen);
92 }
93
94 char *vnc_socket_remote_addr(const char *format, int fd) {
95 struct sockaddr_storage sa;
96 socklen_t salen;
97
98 salen = sizeof(sa);
99 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
100 return NULL;
101
102 return addr_to_string(format, &sa, salen);
103 }
104
105 static int put_addr_qdict(QDict *qdict, struct sockaddr_storage *sa,
106 socklen_t salen)
107 {
108 char host[NI_MAXHOST];
109 char serv[NI_MAXSERV];
110 int err;
111
112 if ((err = getnameinfo((struct sockaddr *)sa, salen,
113 host, sizeof(host),
114 serv, sizeof(serv),
115 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
116 VNC_DEBUG("Cannot resolve address %d: %s\n",
117 err, gai_strerror(err));
118 return -1;
119 }
120
121 qdict_put(qdict, "host", qstring_from_str(host));
122 qdict_put(qdict, "service", qstring_from_str(serv));
123 qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)));
124
125 return 0;
126 }
127
128 static int vnc_server_addr_put(QDict *qdict, int fd)
129 {
130 struct sockaddr_storage sa;
131 socklen_t salen;
132
133 salen = sizeof(sa);
134 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
135 return -1;
136 }
137
138 return put_addr_qdict(qdict, &sa, salen);
139 }
140
141 static int vnc_qdict_remote_addr(QDict *qdict, int fd)
142 {
143 struct sockaddr_storage sa;
144 socklen_t salen;
145
146 salen = sizeof(sa);
147 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
148 return -1;
149 }
150
151 return put_addr_qdict(qdict, &sa, salen);
152 }
153
154 static const char *vnc_auth_name(VncDisplay *vd) {
155 switch (vd->auth) {
156 case VNC_AUTH_INVALID:
157 return "invalid";
158 case VNC_AUTH_NONE:
159 return "none";
160 case VNC_AUTH_VNC:
161 return "vnc";
162 case VNC_AUTH_RA2:
163 return "ra2";
164 case VNC_AUTH_RA2NE:
165 return "ra2ne";
166 case VNC_AUTH_TIGHT:
167 return "tight";
168 case VNC_AUTH_ULTRA:
169 return "ultra";
170 case VNC_AUTH_TLS:
171 return "tls";
172 case VNC_AUTH_VENCRYPT:
173 #ifdef CONFIG_VNC_TLS
174 switch (vd->subauth) {
175 case VNC_AUTH_VENCRYPT_PLAIN:
176 return "vencrypt+plain";
177 case VNC_AUTH_VENCRYPT_TLSNONE:
178 return "vencrypt+tls+none";
179 case VNC_AUTH_VENCRYPT_TLSVNC:
180 return "vencrypt+tls+vnc";
181 case VNC_AUTH_VENCRYPT_TLSPLAIN:
182 return "vencrypt+tls+plain";
183 case VNC_AUTH_VENCRYPT_X509NONE:
184 return "vencrypt+x509+none";
185 case VNC_AUTH_VENCRYPT_X509VNC:
186 return "vencrypt+x509+vnc";
187 case VNC_AUTH_VENCRYPT_X509PLAIN:
188 return "vencrypt+x509+plain";
189 case VNC_AUTH_VENCRYPT_TLSSASL:
190 return "vencrypt+tls+sasl";
191 case VNC_AUTH_VENCRYPT_X509SASL:
192 return "vencrypt+x509+sasl";
193 default:
194 return "vencrypt";
195 }
196 #else
197 return "vencrypt";
198 #endif
199 case VNC_AUTH_SASL:
200 return "sasl";
201 }
202 return "unknown";
203 }
204
205 static int vnc_server_info_put(QDict *qdict)
206 {
207 if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
208 return -1;
209 }
210
211 qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)));
212 return 0;
213 }
214
215 static void vnc_client_cache_auth(VncState *client)
216 {
217 QDict *qdict;
218
219 if (!client->info) {
220 return;
221 }
222
223 qdict = qobject_to_qdict(client->info);
224
225 #ifdef CONFIG_VNC_TLS
226 if (client->tls.session &&
227 client->tls.dname) {
228 qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname));
229 }
230 #endif
231 #ifdef CONFIG_VNC_SASL
232 if (client->sasl.conn &&
233 client->sasl.username) {
234 qdict_put(qdict, "sasl_username",
235 qstring_from_str(client->sasl.username));
236 }
237 #endif
238 }
239
240 static void vnc_client_cache_addr(VncState *client)
241 {
242 QDict *qdict;
243
244 qdict = qdict_new();
245 if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
246 QDECREF(qdict);
247 /* XXX: how to report the error? */
248 return;
249 }
250
251 client->info = QOBJECT(qdict);
252 }
253
254 static void vnc_qmp_event(VncState *vs, MonitorEvent event)
255 {
256 QDict *server;
257 QObject *data;
258
259 if (!vs->info) {
260 return;
261 }
262
263 server = qdict_new();
264 if (vnc_server_info_put(server) < 0) {
265 QDECREF(server);
266 return;
267 }
268
269 data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
270 vs->info, QOBJECT(server));
271
272 monitor_protocol_event(event, data);
273
274 qobject_incref(vs->info);
275 qobject_decref(data);
276 }
277
278 static void info_vnc_iter(QObject *obj, void *opaque)
279 {
280 QDict *client;
281 Monitor *mon = opaque;
282
283 client = qobject_to_qdict(obj);
284 monitor_printf(mon, "Client:\n");
285 monitor_printf(mon, " address: %s:%s\n",
286 qdict_get_str(client, "host"),
287 qdict_get_str(client, "service"));
288
289 #ifdef CONFIG_VNC_TLS
290 monitor_printf(mon, " x509_dname: %s\n",
291 qdict_haskey(client, "x509_dname") ?
292 qdict_get_str(client, "x509_dname") : "none");
293 #endif
294 #ifdef CONFIG_VNC_SASL
295 monitor_printf(mon, " username: %s\n",
296 qdict_haskey(client, "sasl_username") ?
297 qdict_get_str(client, "sasl_username") : "none");
298 #endif
299 }
300
301 void do_info_vnc_print(Monitor *mon, const QObject *data)
302 {
303 QDict *server;
304 QList *clients;
305
306 server = qobject_to_qdict(data);
307 if (qdict_get_bool(server, "enabled") == 0) {
308 monitor_printf(mon, "Server: disabled\n");
309 return;
310 }
311
312 monitor_printf(mon, "Server:\n");
313 monitor_printf(mon, " address: %s:%s\n",
314 qdict_get_str(server, "host"),
315 qdict_get_str(server, "service"));
316 monitor_printf(mon, " auth: %s\n", qdict_get_str(server, "auth"));
317
318 clients = qdict_get_qlist(server, "clients");
319 if (qlist_empty(clients)) {
320 monitor_printf(mon, "Client: none\n");
321 } else {
322 qlist_iter(clients, info_vnc_iter, mon);
323 }
324 }
325
326 /**
327 * do_info_vnc(): Show VNC server information
328 *
329 * Return a QDict with server information. Connected clients are returned
330 * as a QList of QDicts.
331 *
332 * The main QDict contains the following:
333 *
334 * - "enabled": true or false
335 * - "host": server's IP address
336 * - "family": address family ("ipv4" or "ipv6")
337 * - "service": server's port number
338 * - "auth": authentication method
339 * - "clients": a QList of all connected clients
340 *
341 * Clients are described by a QDict, with the following information:
342 *
343 * - "host": client's IP address
344 * - "family": address family ("ipv4" or "ipv6")
345 * - "service": client's port number
346 * - "x509_dname": TLS dname (optional)
347 * - "sasl_username": SASL username (optional)
348 *
349 * Example:
350 *
351 * { "enabled": true, "host": "0.0.0.0", "service": "50402", "auth": "vnc",
352 * "family": "ipv4",
353 * "clients": [{ "host": "127.0.0.1", "service": "50401", "family": "ipv4" }]}
354 */
355 void do_info_vnc(Monitor *mon, QObject **ret_data)
356 {
357 if (vnc_display == NULL || vnc_display->display == NULL) {
358 *ret_data = qobject_from_jsonf("{ 'enabled': false }");
359 } else {
360 QList *clist;
361 VncState *client;
362
363 clist = qlist_new();
364 QTAILQ_FOREACH(client, &vnc_display->clients, next) {
365 if (client->info) {
366 /* incref so that it's not freed by upper layers */
367 qobject_incref(client->info);
368 qlist_append_obj(clist, client->info);
369 }
370 }
371
372 *ret_data = qobject_from_jsonf("{ 'enabled': true, 'clients': %p }",
373 QOBJECT(clist));
374 assert(*ret_data != NULL);
375
376 if (vnc_server_info_put(qobject_to_qdict(*ret_data)) < 0) {
377 qobject_decref(*ret_data);
378 *ret_data = NULL;
379 }
380 }
381 }
382
383 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
384 return (vs->features & (1 << feature));
385 }
386
387 /* TODO
388 1) Get the queue working for IO.
389 2) there is some weirdness when using the -S option (the screen is grey
390 and not totally invalidated
391 3) resolutions > 1024
392 */
393
394 static int vnc_update_client(VncState *vs, int has_dirty);
395 static void vnc_disconnect_start(VncState *vs);
396 static void vnc_disconnect_finish(VncState *vs);
397 static void vnc_init_timer(VncDisplay *vd);
398 static void vnc_remove_timer(VncDisplay *vd);
399
400 static void vnc_colordepth(VncState *vs);
401 static void framebuffer_update_request(VncState *vs, int incremental,
402 int x_position, int y_position,
403 int w, int h);
404 static void vnc_refresh(void *opaque);
405 static int vnc_refresh_server_surface(VncDisplay *vd);
406
407 static inline void vnc_set_bit(uint32_t *d, int k)
408 {
409 d[k >> 5] |= 1 << (k & 0x1f);
410 }
411
412 static inline void vnc_clear_bit(uint32_t *d, int k)
413 {
414 d[k >> 5] &= ~(1 << (k & 0x1f));
415 }
416
417 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
418 {
419 int j;
420
421 j = 0;
422 while (n >= 32) {
423 d[j++] = -1;
424 n -= 32;
425 }
426 if (n > 0)
427 d[j++] = (1 << n) - 1;
428 while (j < nb_words)
429 d[j++] = 0;
430 }
431
432 static inline int vnc_get_bit(const uint32_t *d, int k)
433 {
434 return (d[k >> 5] >> (k & 0x1f)) & 1;
435 }
436
437 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
438 int nb_words)
439 {
440 int i;
441 for(i = 0; i < nb_words; i++) {
442 if ((d1[i] & d2[i]) != 0)
443 return 1;
444 }
445 return 0;
446 }
447
448 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
449 {
450 int i;
451 VncDisplay *vd = ds->opaque;
452 struct VncSurface *s = &vd->guest;
453
454 h += y;
455
456 /* round x down to ensure the loop only spans one 16-pixel block per,
457 iteration. otherwise, if (x % 16) != 0, the last iteration may span
458 two 16-pixel blocks but we only mark the first as dirty
459 */
460 w += (x % 16);
461 x -= (x % 16);
462
463 x = MIN(x, s->ds->width);
464 y = MIN(y, s->ds->height);
465 w = MIN(x + w, s->ds->width) - x;
466 h = MIN(h, s->ds->height);
467
468 for (; y < h; y++)
469 for (i = 0; i < w; i += 16)
470 vnc_set_bit(s->dirty[y], (x + i) / 16);
471 }
472
473 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
474 int32_t encoding)
475 {
476 vnc_write_u16(vs, x);
477 vnc_write_u16(vs, y);
478 vnc_write_u16(vs, w);
479 vnc_write_u16(vs, h);
480
481 vnc_write_s32(vs, encoding);
482 }
483
484 void buffer_reserve(Buffer *buffer, size_t len)
485 {
486 if ((buffer->capacity - buffer->offset) < len) {
487 buffer->capacity += (len + 1024);
488 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
489 if (buffer->buffer == NULL) {
490 fprintf(stderr, "vnc: out of memory\n");
491 exit(1);
492 }
493 }
494 }
495
496 int buffer_empty(Buffer *buffer)
497 {
498 return buffer->offset == 0;
499 }
500
501 uint8_t *buffer_end(Buffer *buffer)
502 {
503 return buffer->buffer + buffer->offset;
504 }
505
506 void buffer_reset(Buffer *buffer)
507 {
508 buffer->offset = 0;
509 }
510
511 void buffer_append(Buffer *buffer, const void *data, size_t len)
512 {
513 memcpy(buffer->buffer + buffer->offset, data, len);
514 buffer->offset += len;
515 }
516
517 static void vnc_dpy_resize(DisplayState *ds)
518 {
519 int size_changed;
520 VncDisplay *vd = ds->opaque;
521 VncState *vs;
522
523 /* server surface */
524 if (!vd->server)
525 vd->server = qemu_mallocz(sizeof(*vd->server));
526 if (vd->server->data)
527 qemu_free(vd->server->data);
528 *(vd->server) = *(ds->surface);
529 vd->server->data = qemu_mallocz(vd->server->linesize *
530 vd->server->height);
531
532 /* guest surface */
533 if (!vd->guest.ds)
534 vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
535 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
536 console_color_init(ds);
537 size_changed = ds_get_width(ds) != vd->guest.ds->width ||
538 ds_get_height(ds) != vd->guest.ds->height;
539 *(vd->guest.ds) = *(ds->surface);
540 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
541
542 QTAILQ_FOREACH(vs, &vd->clients, next) {
543 vnc_colordepth(vs);
544 if (size_changed) {
545 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
546 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
547 vnc_write_u8(vs, 0);
548 vnc_write_u16(vs, 1); /* number of rects */
549 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
550 VNC_ENCODING_DESKTOPRESIZE);
551 vnc_flush(vs);
552 }
553 }
554 if (vs->vd->cursor) {
555 vnc_cursor_define(vs);
556 }
557 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
558 }
559 }
560
561 /* fastest code */
562 static void vnc_write_pixels_copy(VncState *vs, struct PixelFormat *pf,
563 void *pixels, int size)
564 {
565 vnc_write(vs, pixels, size);
566 }
567
568 /* slowest but generic code. */
569 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
570 {
571 uint8_t r, g, b;
572 VncDisplay *vd = vs->vd;
573
574 r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
575 vd->server->pf.rbits);
576 g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
577 vd->server->pf.gbits);
578 b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
579 vd->server->pf.bbits);
580 v = (r << vs->clientds.pf.rshift) |
581 (g << vs->clientds.pf.gshift) |
582 (b << vs->clientds.pf.bshift);
583 switch(vs->clientds.pf.bytes_per_pixel) {
584 case 1:
585 buf[0] = v;
586 break;
587 case 2:
588 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
589 buf[0] = v >> 8;
590 buf[1] = v;
591 } else {
592 buf[1] = v >> 8;
593 buf[0] = v;
594 }
595 break;
596 default:
597 case 4:
598 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
599 buf[0] = v >> 24;
600 buf[1] = v >> 16;
601 buf[2] = v >> 8;
602 buf[3] = v;
603 } else {
604 buf[3] = v >> 24;
605 buf[2] = v >> 16;
606 buf[1] = v >> 8;
607 buf[0] = v;
608 }
609 break;
610 }
611 }
612
613 static void vnc_write_pixels_generic(VncState *vs, struct PixelFormat *pf,
614 void *pixels1, int size)
615 {
616 uint8_t buf[4];
617
618 if (pf->bytes_per_pixel == 4) {
619 uint32_t *pixels = pixels1;
620 int n, i;
621 n = size >> 2;
622 for(i = 0; i < n; i++) {
623 vnc_convert_pixel(vs, buf, pixels[i]);
624 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
625 }
626 } else if (pf->bytes_per_pixel == 2) {
627 uint16_t *pixels = pixels1;
628 int n, i;
629 n = size >> 1;
630 for(i = 0; i < n; i++) {
631 vnc_convert_pixel(vs, buf, pixels[i]);
632 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
633 }
634 } else if (pf->bytes_per_pixel == 1) {
635 uint8_t *pixels = pixels1;
636 int n, i;
637 n = size;
638 for(i = 0; i < n; i++) {
639 vnc_convert_pixel(vs, buf, pixels[i]);
640 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
641 }
642 } else {
643 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
644 }
645 }
646
647 void vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
648 {
649 int i;
650 uint8_t *row;
651 VncDisplay *vd = vs->vd;
652
653 row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
654 for (i = 0; i < h; i++) {
655 vs->write_pixels(vs, &vd->server->pf, row, w * ds_get_bytes_per_pixel(vs->ds));
656 row += ds_get_linesize(vs->ds);
657 }
658 }
659
660 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
661 {
662 switch(vs->vnc_encoding) {
663 case VNC_ENCODING_ZLIB:
664 vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
665 break;
666 case VNC_ENCODING_HEXTILE:
667 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
668 vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
669 break;
670 default:
671 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
672 vnc_raw_send_framebuffer_update(vs, x, y, w, h);
673 break;
674 }
675 }
676
677 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
678 {
679 /* send bitblit op to the vnc client */
680 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
681 vnc_write_u8(vs, 0);
682 vnc_write_u16(vs, 1); /* number of rects */
683 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
684 vnc_write_u16(vs, src_x);
685 vnc_write_u16(vs, src_y);
686 vnc_flush(vs);
687 }
688
689 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
690 {
691 VncDisplay *vd = ds->opaque;
692 VncState *vs, *vn;
693 uint8_t *src_row;
694 uint8_t *dst_row;
695 int i,x,y,pitch,depth,inc,w_lim,s;
696 int cmp_bytes;
697
698 vnc_refresh_server_surface(vd);
699 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
700 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
701 vs->force_update = 1;
702 vnc_update_client(vs, 1);
703 /* vs might be free()ed here */
704 }
705 }
706
707 /* do bitblit op on the local surface too */
708 pitch = ds_get_linesize(vd->ds);
709 depth = ds_get_bytes_per_pixel(vd->ds);
710 src_row = vd->server->data + pitch * src_y + depth * src_x;
711 dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
712 y = dst_y;
713 inc = 1;
714 if (dst_y > src_y) {
715 /* copy backwards */
716 src_row += pitch * (h-1);
717 dst_row += pitch * (h-1);
718 pitch = -pitch;
719 y = dst_y + h - 1;
720 inc = -1;
721 }
722 w_lim = w - (16 - (dst_x % 16));
723 if (w_lim < 0)
724 w_lim = w;
725 else
726 w_lim = w - (w_lim % 16);
727 for (i = 0; i < h; i++) {
728 for (x = 0; x <= w_lim;
729 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
730 if (x == w_lim) {
731 if ((s = w - w_lim) == 0)
732 break;
733 } else if (!x) {
734 s = (16 - (dst_x % 16));
735 s = MIN(s, w_lim);
736 } else {
737 s = 16;
738 }
739 cmp_bytes = s * depth;
740 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
741 continue;
742 memmove(dst_row, src_row, cmp_bytes);
743 QTAILQ_FOREACH(vs, &vd->clients, next) {
744 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
745 vnc_set_bit(vs->dirty[y], ((x + dst_x) / 16));
746 }
747 }
748 }
749 src_row += pitch - w * depth;
750 dst_row += pitch - w * depth;
751 y += inc;
752 }
753
754 QTAILQ_FOREACH(vs, &vd->clients, next) {
755 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
756 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
757 }
758 }
759 }
760
761 static void vnc_mouse_set(int x, int y, int visible)
762 {
763 /* can we ask the client(s) to move the pointer ??? */
764 }
765
766 static int vnc_cursor_define(VncState *vs)
767 {
768 QEMUCursor *c = vs->vd->cursor;
769 PixelFormat pf = qemu_default_pixelformat(32);
770 int isize;
771
772 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
773 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
774 vnc_write_u8(vs, 0); /* padding */
775 vnc_write_u16(vs, 1); /* # of rects */
776 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
777 VNC_ENCODING_RICH_CURSOR);
778 isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
779 vnc_write_pixels_generic(vs, &pf, c->data, isize);
780 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
781 return 0;
782 }
783 return -1;
784 }
785
786 static void vnc_dpy_cursor_define(QEMUCursor *c)
787 {
788 VncDisplay *vd = vnc_display;
789 VncState *vs;
790
791 cursor_put(vd->cursor);
792 qemu_free(vd->cursor_mask);
793
794 vd->cursor = c;
795 cursor_get(vd->cursor);
796 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
797 vd->cursor_mask = qemu_mallocz(vd->cursor_msize);
798 cursor_get_mono_mask(c, 0, vd->cursor_mask);
799
800 QTAILQ_FOREACH(vs, &vd->clients, next) {
801 vnc_cursor_define(vs);
802 }
803 }
804
805 static int find_and_clear_dirty_height(struct VncState *vs,
806 int y, int last_x, int x)
807 {
808 int h;
809 VncDisplay *vd = vs->vd;
810
811 for (h = 1; h < (vd->server->height - y); h++) {
812 int tmp_x;
813 if (!vnc_get_bit(vs->dirty[y + h], last_x))
814 break;
815 for (tmp_x = last_x; tmp_x < x; tmp_x++)
816 vnc_clear_bit(vs->dirty[y + h], tmp_x);
817 }
818
819 return h;
820 }
821
822 static int vnc_update_client(VncState *vs, int has_dirty)
823 {
824 if (vs->need_update && vs->csock != -1) {
825 VncDisplay *vd = vs->vd;
826 int y;
827 int n_rectangles;
828 int saved_offset;
829
830 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
831 /* kernel send buffers are full -> drop frames to throttle */
832 return 0;
833
834 if (!has_dirty && !vs->audio_cap && !vs->force_update)
835 return 0;
836
837 /*
838 * Send screen updates to the vnc client using the server
839 * surface and server dirty map. guest surface updates
840 * happening in parallel don't disturb us, the next pass will
841 * send them to the client.
842 */
843 n_rectangles = 0;
844 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
845 vnc_write_u8(vs, 0);
846 saved_offset = vs->output.offset;
847 vnc_write_u16(vs, 0);
848
849 for (y = 0; y < vd->server->height; y++) {
850 int x;
851 int last_x = -1;
852 for (x = 0; x < vd->server->width / 16; x++) {
853 if (vnc_get_bit(vs->dirty[y], x)) {
854 if (last_x == -1) {
855 last_x = x;
856 }
857 vnc_clear_bit(vs->dirty[y], x);
858 } else {
859 if (last_x != -1) {
860 int h = find_and_clear_dirty_height(vs, y, last_x, x);
861 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
862 n_rectangles++;
863 }
864 last_x = -1;
865 }
866 }
867 if (last_x != -1) {
868 int h = find_and_clear_dirty_height(vs, y, last_x, x);
869 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
870 n_rectangles++;
871 }
872 }
873 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
874 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
875 vnc_flush(vs);
876 vs->force_update = 0;
877 return n_rectangles;
878 }
879
880 if (vs->csock == -1)
881 vnc_disconnect_finish(vs);
882
883 return 0;
884 }
885
886 /* audio */
887 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
888 {
889 VncState *vs = opaque;
890
891 switch (cmd) {
892 case AUD_CNOTIFY_DISABLE:
893 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
894 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
895 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
896 vnc_flush(vs);
897 break;
898
899 case AUD_CNOTIFY_ENABLE:
900 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
901 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
902 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
903 vnc_flush(vs);
904 break;
905 }
906 }
907
908 static void audio_capture_destroy(void *opaque)
909 {
910 }
911
912 static void audio_capture(void *opaque, void *buf, int size)
913 {
914 VncState *vs = opaque;
915
916 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
917 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
918 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
919 vnc_write_u32(vs, size);
920 vnc_write(vs, buf, size);
921 vnc_flush(vs);
922 }
923
924 static void audio_add(VncState *vs)
925 {
926 struct audio_capture_ops ops;
927
928 if (vs->audio_cap) {
929 monitor_printf(default_mon, "audio already running\n");
930 return;
931 }
932
933 ops.notify = audio_capture_notify;
934 ops.destroy = audio_capture_destroy;
935 ops.capture = audio_capture;
936
937 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
938 if (!vs->audio_cap) {
939 monitor_printf(default_mon, "Failed to add audio capture\n");
940 }
941 }
942
943 static void audio_del(VncState *vs)
944 {
945 if (vs->audio_cap) {
946 AUD_del_capture(vs->audio_cap, vs);
947 vs->audio_cap = NULL;
948 }
949 }
950
951 static void vnc_disconnect_start(VncState *vs)
952 {
953 if (vs->csock == -1)
954 return;
955 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
956 closesocket(vs->csock);
957 vs->csock = -1;
958 }
959
960 static void vnc_disconnect_finish(VncState *vs)
961 {
962 vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
963
964 if (vs->input.buffer) {
965 qemu_free(vs->input.buffer);
966 vs->input.buffer = NULL;
967 }
968 if (vs->output.buffer) {
969 qemu_free(vs->output.buffer);
970 vs->output.buffer = NULL;
971 }
972
973 qobject_decref(vs->info);
974
975 #ifdef CONFIG_VNC_TLS
976 vnc_tls_client_cleanup(vs);
977 #endif /* CONFIG_VNC_TLS */
978 #ifdef CONFIG_VNC_SASL
979 vnc_sasl_client_cleanup(vs);
980 #endif /* CONFIG_VNC_SASL */
981 audio_del(vs);
982
983 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
984
985 if (QTAILQ_EMPTY(&vs->vd->clients)) {
986 dcl->idle = 1;
987 }
988
989 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
990 vnc_remove_timer(vs->vd);
991 if (vs->vd->lock_key_sync)
992 qemu_remove_led_event_handler(vs->led);
993 qemu_free(vs);
994 }
995
996 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
997 {
998 if (ret == 0 || ret == -1) {
999 if (ret == -1) {
1000 switch (last_errno) {
1001 case EINTR:
1002 case EAGAIN:
1003 #ifdef _WIN32
1004 case WSAEWOULDBLOCK:
1005 #endif
1006 return 0;
1007 default:
1008 break;
1009 }
1010 }
1011
1012 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
1013 ret, ret < 0 ? last_errno : 0);
1014 vnc_disconnect_start(vs);
1015
1016 return 0;
1017 }
1018 return ret;
1019 }
1020
1021
1022 void vnc_client_error(VncState *vs)
1023 {
1024 VNC_DEBUG("Closing down client sock: protocol error\n");
1025 vnc_disconnect_start(vs);
1026 }
1027
1028
1029 /*
1030 * Called to write a chunk of data to the client socket. The data may
1031 * be the raw data, or may have already been encoded by SASL.
1032 * The data will be written either straight onto the socket, or
1033 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1034 *
1035 * NB, it is theoretically possible to have 2 layers of encryption,
1036 * both SASL, and this TLS layer. It is highly unlikely in practice
1037 * though, since SASL encryption will typically be a no-op if TLS
1038 * is active
1039 *
1040 * Returns the number of bytes written, which may be less than
1041 * the requested 'datalen' if the socket would block. Returns
1042 * -1 on error, and disconnects the client socket.
1043 */
1044 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1045 {
1046 long ret;
1047 #ifdef CONFIG_VNC_TLS
1048 if (vs->tls.session) {
1049 ret = gnutls_write(vs->tls.session, data, datalen);
1050 if (ret < 0) {
1051 if (ret == GNUTLS_E_AGAIN)
1052 errno = EAGAIN;
1053 else
1054 errno = EIO;
1055 ret = -1;
1056 }
1057 } else
1058 #endif /* CONFIG_VNC_TLS */
1059 ret = send(vs->csock, (const void *)data, datalen, 0);
1060 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1061 return vnc_client_io_error(vs, ret, socket_error());
1062 }
1063
1064
1065 /*
1066 * Called to write buffered data to the client socket, when not
1067 * using any SASL SSF encryption layers. Will write as much data
1068 * as possible without blocking. If all buffered data is written,
1069 * will switch the FD poll() handler back to read monitoring.
1070 *
1071 * Returns the number of bytes written, which may be less than
1072 * the buffered output data if the socket would block. Returns
1073 * -1 on error, and disconnects the client socket.
1074 */
1075 static long vnc_client_write_plain(VncState *vs)
1076 {
1077 long ret;
1078
1079 #ifdef CONFIG_VNC_SASL
1080 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1081 vs->output.buffer, vs->output.capacity, vs->output.offset,
1082 vs->sasl.waitWriteSSF);
1083
1084 if (vs->sasl.conn &&
1085 vs->sasl.runSSF &&
1086 vs->sasl.waitWriteSSF) {
1087 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1088 if (ret)
1089 vs->sasl.waitWriteSSF -= ret;
1090 } else
1091 #endif /* CONFIG_VNC_SASL */
1092 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1093 if (!ret)
1094 return 0;
1095
1096 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1097 vs->output.offset -= ret;
1098
1099 if (vs->output.offset == 0) {
1100 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1101 }
1102
1103 return ret;
1104 }
1105
1106
1107 /*
1108 * First function called whenever there is data to be written to
1109 * the client socket. Will delegate actual work according to whether
1110 * SASL SSF layers are enabled (thus requiring encryption calls)
1111 */
1112 void vnc_client_write(void *opaque)
1113 {
1114 VncState *vs = opaque;
1115
1116 #ifdef CONFIG_VNC_SASL
1117 if (vs->sasl.conn &&
1118 vs->sasl.runSSF &&
1119 !vs->sasl.waitWriteSSF) {
1120 vnc_client_write_sasl(vs);
1121 } else
1122 #endif /* CONFIG_VNC_SASL */
1123 vnc_client_write_plain(vs);
1124 }
1125
1126 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1127 {
1128 vs->read_handler = func;
1129 vs->read_handler_expect = expecting;
1130 }
1131
1132
1133 /*
1134 * Called to read a chunk of data from the client socket. The data may
1135 * be the raw data, or may need to be further decoded by SASL.
1136 * The data will be read either straight from to the socket, or
1137 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1138 *
1139 * NB, it is theoretically possible to have 2 layers of encryption,
1140 * both SASL, and this TLS layer. It is highly unlikely in practice
1141 * though, since SASL encryption will typically be a no-op if TLS
1142 * is active
1143 *
1144 * Returns the number of bytes read, which may be less than
1145 * the requested 'datalen' if the socket would block. Returns
1146 * -1 on error, and disconnects the client socket.
1147 */
1148 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1149 {
1150 long ret;
1151 #ifdef CONFIG_VNC_TLS
1152 if (vs->tls.session) {
1153 ret = gnutls_read(vs->tls.session, data, datalen);
1154 if (ret < 0) {
1155 if (ret == GNUTLS_E_AGAIN)
1156 errno = EAGAIN;
1157 else
1158 errno = EIO;
1159 ret = -1;
1160 }
1161 } else
1162 #endif /* CONFIG_VNC_TLS */
1163 ret = recv(vs->csock, (void *)data, datalen, 0);
1164 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1165 return vnc_client_io_error(vs, ret, socket_error());
1166 }
1167
1168
1169 /*
1170 * Called to read data from the client socket to the input buffer,
1171 * when not using any SASL SSF encryption layers. Will read as much
1172 * data as possible without blocking.
1173 *
1174 * Returns the number of bytes read. Returns -1 on error, and
1175 * disconnects the client socket.
1176 */
1177 static long vnc_client_read_plain(VncState *vs)
1178 {
1179 int ret;
1180 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1181 vs->input.buffer, vs->input.capacity, vs->input.offset);
1182 buffer_reserve(&vs->input, 4096);
1183 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1184 if (!ret)
1185 return 0;
1186 vs->input.offset += ret;
1187 return ret;
1188 }
1189
1190
1191 /*
1192 * First function called whenever there is more data to be read from
1193 * the client socket. Will delegate actual work according to whether
1194 * SASL SSF layers are enabled (thus requiring decryption calls)
1195 */
1196 void vnc_client_read(void *opaque)
1197 {
1198 VncState *vs = opaque;
1199 long ret;
1200
1201 #ifdef CONFIG_VNC_SASL
1202 if (vs->sasl.conn && vs->sasl.runSSF)
1203 ret = vnc_client_read_sasl(vs);
1204 else
1205 #endif /* CONFIG_VNC_SASL */
1206 ret = vnc_client_read_plain(vs);
1207 if (!ret) {
1208 if (vs->csock == -1)
1209 vnc_disconnect_finish(vs);
1210 return;
1211 }
1212
1213 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1214 size_t len = vs->read_handler_expect;
1215 int ret;
1216
1217 ret = vs->read_handler(vs, vs->input.buffer, len);
1218 if (vs->csock == -1) {
1219 vnc_disconnect_finish(vs);
1220 return;
1221 }
1222
1223 if (!ret) {
1224 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1225 vs->input.offset -= len;
1226 } else {
1227 vs->read_handler_expect = ret;
1228 }
1229 }
1230 }
1231
1232 void vnc_write(VncState *vs, const void *data, size_t len)
1233 {
1234 buffer_reserve(&vs->output, len);
1235
1236 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1237 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1238 }
1239
1240 buffer_append(&vs->output, data, len);
1241 }
1242
1243 void vnc_write_s32(VncState *vs, int32_t value)
1244 {
1245 vnc_write_u32(vs, *(uint32_t *)&value);
1246 }
1247
1248 void vnc_write_u32(VncState *vs, uint32_t value)
1249 {
1250 uint8_t buf[4];
1251
1252 buf[0] = (value >> 24) & 0xFF;
1253 buf[1] = (value >> 16) & 0xFF;
1254 buf[2] = (value >> 8) & 0xFF;
1255 buf[3] = value & 0xFF;
1256
1257 vnc_write(vs, buf, 4);
1258 }
1259
1260 void vnc_write_u16(VncState *vs, uint16_t value)
1261 {
1262 uint8_t buf[2];
1263
1264 buf[0] = (value >> 8) & 0xFF;
1265 buf[1] = value & 0xFF;
1266
1267 vnc_write(vs, buf, 2);
1268 }
1269
1270 void vnc_write_u8(VncState *vs, uint8_t value)
1271 {
1272 vnc_write(vs, (char *)&value, 1);
1273 }
1274
1275 void vnc_flush(VncState *vs)
1276 {
1277 if (vs->csock != -1 && vs->output.offset)
1278 vnc_client_write(vs);
1279 }
1280
1281 uint8_t read_u8(uint8_t *data, size_t offset)
1282 {
1283 return data[offset];
1284 }
1285
1286 uint16_t read_u16(uint8_t *data, size_t offset)
1287 {
1288 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1289 }
1290
1291 int32_t read_s32(uint8_t *data, size_t offset)
1292 {
1293 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1294 (data[offset + 2] << 8) | data[offset + 3]);
1295 }
1296
1297 uint32_t read_u32(uint8_t *data, size_t offset)
1298 {
1299 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1300 (data[offset + 2] << 8) | data[offset + 3]);
1301 }
1302
1303 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1304 {
1305 }
1306
1307 static void check_pointer_type_change(Notifier *notifier)
1308 {
1309 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1310 int absolute = kbd_mouse_is_absolute();
1311
1312 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1313 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1314 vnc_write_u8(vs, 0);
1315 vnc_write_u16(vs, 1);
1316 vnc_framebuffer_update(vs, absolute, 0,
1317 ds_get_width(vs->ds), ds_get_height(vs->ds),
1318 VNC_ENCODING_POINTER_TYPE_CHANGE);
1319 vnc_flush(vs);
1320 }
1321 vs->absolute = absolute;
1322 }
1323
1324 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1325 {
1326 int buttons = 0;
1327 int dz = 0;
1328
1329 if (button_mask & 0x01)
1330 buttons |= MOUSE_EVENT_LBUTTON;
1331 if (button_mask & 0x02)
1332 buttons |= MOUSE_EVENT_MBUTTON;
1333 if (button_mask & 0x04)
1334 buttons |= MOUSE_EVENT_RBUTTON;
1335 if (button_mask & 0x08)
1336 dz = -1;
1337 if (button_mask & 0x10)
1338 dz = 1;
1339
1340 if (vs->absolute) {
1341 kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
1342 x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
1343 ds_get_height(vs->ds) > 1 ?
1344 y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1345 dz, buttons);
1346 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1347 x -= 0x7FFF;
1348 y -= 0x7FFF;
1349
1350 kbd_mouse_event(x, y, dz, buttons);
1351 } else {
1352 if (vs->last_x != -1)
1353 kbd_mouse_event(x - vs->last_x,
1354 y - vs->last_y,
1355 dz, buttons);
1356 vs->last_x = x;
1357 vs->last_y = y;
1358 }
1359 }
1360
1361 static void reset_keys(VncState *vs)
1362 {
1363 int i;
1364 for(i = 0; i < 256; i++) {
1365 if (vs->modifiers_state[i]) {
1366 if (i & SCANCODE_GREY)
1367 kbd_put_keycode(SCANCODE_EMUL0);
1368 kbd_put_keycode(i | SCANCODE_UP);
1369 vs->modifiers_state[i] = 0;
1370 }
1371 }
1372 }
1373
1374 static void press_key(VncState *vs, int keysym)
1375 {
1376 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1377 if (keycode & SCANCODE_GREY)
1378 kbd_put_keycode(SCANCODE_EMUL0);
1379 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1380 if (keycode & SCANCODE_GREY)
1381 kbd_put_keycode(SCANCODE_EMUL0);
1382 kbd_put_keycode(keycode | SCANCODE_UP);
1383 }
1384
1385 static void kbd_leds(void *opaque, int ledstate)
1386 {
1387 VncState *vs = opaque;
1388 int caps, num;
1389
1390 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1391 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
1392
1393 if (vs->modifiers_state[0x3a] != caps) {
1394 vs->modifiers_state[0x3a] = caps;
1395 }
1396 if (vs->modifiers_state[0x45] != num) {
1397 vs->modifiers_state[0x45] = num;
1398 }
1399 }
1400
1401 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1402 {
1403 /* QEMU console switch */
1404 switch(keycode) {
1405 case 0x2a: /* Left Shift */
1406 case 0x36: /* Right Shift */
1407 case 0x1d: /* Left CTRL */
1408 case 0x9d: /* Right CTRL */
1409 case 0x38: /* Left ALT */
1410 case 0xb8: /* Right ALT */
1411 if (down)
1412 vs->modifiers_state[keycode] = 1;
1413 else
1414 vs->modifiers_state[keycode] = 0;
1415 break;
1416 case 0x02 ... 0x0a: /* '1' to '9' keys */
1417 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1418 /* Reset the modifiers sent to the current console */
1419 reset_keys(vs);
1420 console_select(keycode - 0x02);
1421 return;
1422 }
1423 break;
1424 case 0x3a: /* CapsLock */
1425 case 0x45: /* NumLock */
1426 if (down)
1427 vs->modifiers_state[keycode] ^= 1;
1428 break;
1429 }
1430
1431 if (vs->vd->lock_key_sync &&
1432 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1433 /* If the numlock state needs to change then simulate an additional
1434 keypress before sending this one. This will happen if the user
1435 toggles numlock away from the VNC window.
1436 */
1437 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1438 if (!vs->modifiers_state[0x45]) {
1439 vs->modifiers_state[0x45] = 1;
1440 press_key(vs, 0xff7f);
1441 }
1442 } else {
1443 if (vs->modifiers_state[0x45]) {
1444 vs->modifiers_state[0x45] = 0;
1445 press_key(vs, 0xff7f);
1446 }
1447 }
1448 }
1449
1450 if (vs->vd->lock_key_sync &&
1451 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1452 /* If the capslock state needs to change then simulate an additional
1453 keypress before sending this one. This will happen if the user
1454 toggles capslock away from the VNC window.
1455 */
1456 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1457 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1458 int capslock = !!(vs->modifiers_state[0x3a]);
1459 if (capslock) {
1460 if (uppercase == shift) {
1461 vs->modifiers_state[0x3a] = 0;
1462 press_key(vs, 0xffe5);
1463 }
1464 } else {
1465 if (uppercase != shift) {
1466 vs->modifiers_state[0x3a] = 1;
1467 press_key(vs, 0xffe5);
1468 }
1469 }
1470 }
1471
1472 if (is_graphic_console()) {
1473 if (keycode & SCANCODE_GREY)
1474 kbd_put_keycode(SCANCODE_EMUL0);
1475 if (down)
1476 kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK);
1477 else
1478 kbd_put_keycode(keycode | SCANCODE_UP);
1479 } else {
1480 /* QEMU console emulation */
1481 if (down) {
1482 int numlock = vs->modifiers_state[0x45];
1483 switch (keycode) {
1484 case 0x2a: /* Left Shift */
1485 case 0x36: /* Right Shift */
1486 case 0x1d: /* Left CTRL */
1487 case 0x9d: /* Right CTRL */
1488 case 0x38: /* Left ALT */
1489 case 0xb8: /* Right ALT */
1490 break;
1491 case 0xc8:
1492 kbd_put_keysym(QEMU_KEY_UP);
1493 break;
1494 case 0xd0:
1495 kbd_put_keysym(QEMU_KEY_DOWN);
1496 break;
1497 case 0xcb:
1498 kbd_put_keysym(QEMU_KEY_LEFT);
1499 break;
1500 case 0xcd:
1501 kbd_put_keysym(QEMU_KEY_RIGHT);
1502 break;
1503 case 0xd3:
1504 kbd_put_keysym(QEMU_KEY_DELETE);
1505 break;
1506 case 0xc7:
1507 kbd_put_keysym(QEMU_KEY_HOME);
1508 break;
1509 case 0xcf:
1510 kbd_put_keysym(QEMU_KEY_END);
1511 break;
1512 case 0xc9:
1513 kbd_put_keysym(QEMU_KEY_PAGEUP);
1514 break;
1515 case 0xd1:
1516 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1517 break;
1518
1519 case 0x47:
1520 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1521 break;
1522 case 0x48:
1523 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1524 break;
1525 case 0x49:
1526 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1527 break;
1528 case 0x4b:
1529 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1530 break;
1531 case 0x4c:
1532 kbd_put_keysym('5');
1533 break;
1534 case 0x4d:
1535 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1536 break;
1537 case 0x4f:
1538 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1539 break;
1540 case 0x50:
1541 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1542 break;
1543 case 0x51:
1544 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1545 break;
1546 case 0x52:
1547 kbd_put_keysym('0');
1548 break;
1549 case 0x53:
1550 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1551 break;
1552
1553 case 0xb5:
1554 kbd_put_keysym('/');
1555 break;
1556 case 0x37:
1557 kbd_put_keysym('*');
1558 break;
1559 case 0x4a:
1560 kbd_put_keysym('-');
1561 break;
1562 case 0x4e:
1563 kbd_put_keysym('+');
1564 break;
1565 case 0x9c:
1566 kbd_put_keysym('\n');
1567 break;
1568
1569 default:
1570 kbd_put_keysym(sym);
1571 break;
1572 }
1573 }
1574 }
1575 }
1576
1577 static void key_event(VncState *vs, int down, uint32_t sym)
1578 {
1579 int keycode;
1580 int lsym = sym;
1581
1582 if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
1583 lsym = lsym - 'A' + 'a';
1584 }
1585
1586 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1587 do_key_event(vs, down, keycode, sym);
1588 }
1589
1590 static void ext_key_event(VncState *vs, int down,
1591 uint32_t sym, uint16_t keycode)
1592 {
1593 /* if the user specifies a keyboard layout, always use it */
1594 if (keyboard_layout)
1595 key_event(vs, down, sym);
1596 else
1597 do_key_event(vs, down, keycode, sym);
1598 }
1599
1600 static void framebuffer_update_request(VncState *vs, int incremental,
1601 int x_position, int y_position,
1602 int w, int h)
1603 {
1604 if (y_position > ds_get_height(vs->ds))
1605 y_position = ds_get_height(vs->ds);
1606 if (y_position + h >= ds_get_height(vs->ds))
1607 h = ds_get_height(vs->ds) - y_position;
1608
1609 int i;
1610 vs->need_update = 1;
1611 if (!incremental) {
1612 vs->force_update = 1;
1613 for (i = 0; i < h; i++) {
1614 vnc_set_bits(vs->dirty[y_position + i],
1615 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1616 }
1617 }
1618 }
1619
1620 static void send_ext_key_event_ack(VncState *vs)
1621 {
1622 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1623 vnc_write_u8(vs, 0);
1624 vnc_write_u16(vs, 1);
1625 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1626 VNC_ENCODING_EXT_KEY_EVENT);
1627 vnc_flush(vs);
1628 }
1629
1630 static void send_ext_audio_ack(VncState *vs)
1631 {
1632 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1633 vnc_write_u8(vs, 0);
1634 vnc_write_u16(vs, 1);
1635 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1636 VNC_ENCODING_AUDIO);
1637 vnc_flush(vs);
1638 }
1639
1640 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1641 {
1642 int i;
1643 unsigned int enc = 0;
1644
1645 vnc_zlib_init(vs);
1646 vs->features = 0;
1647 vs->vnc_encoding = -1;
1648 vs->tight_compression = 9;
1649 vs->tight_quality = 9;
1650 vs->absolute = -1;
1651
1652 for (i = n_encodings - 1; i >= 0; i--) {
1653 enc = encodings[i];
1654 switch (enc) {
1655 case VNC_ENCODING_RAW:
1656 if (vs->vnc_encoding != -1) {
1657 vs->vnc_encoding = enc;
1658 }
1659 break;
1660 case VNC_ENCODING_COPYRECT:
1661 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1662 break;
1663 case VNC_ENCODING_HEXTILE:
1664 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1665 if (vs->vnc_encoding != -1) {
1666 vs->vnc_encoding = enc;
1667 }
1668 break;
1669 case VNC_ENCODING_ZLIB:
1670 vs->features |= VNC_FEATURE_ZLIB_MASK;
1671 if (vs->vnc_encoding != -1) {
1672 vs->vnc_encoding = enc;
1673 }
1674 break;
1675 case VNC_ENCODING_DESKTOPRESIZE:
1676 vs->features |= VNC_FEATURE_RESIZE_MASK;
1677 break;
1678 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1679 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1680 break;
1681 case VNC_ENCODING_RICH_CURSOR:
1682 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
1683 break;
1684 case VNC_ENCODING_EXT_KEY_EVENT:
1685 send_ext_key_event_ack(vs);
1686 break;
1687 case VNC_ENCODING_AUDIO:
1688 send_ext_audio_ack(vs);
1689 break;
1690 case VNC_ENCODING_WMVi:
1691 vs->features |= VNC_FEATURE_WMVI_MASK;
1692 break;
1693 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1694 vs->tight_compression = (enc & 0x0F);
1695 break;
1696 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1697 vs->tight_quality = (enc & 0x0F);
1698 break;
1699 default:
1700 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1701 break;
1702 }
1703 }
1704 check_pointer_type_change(&vs->mouse_mode_notifier);
1705 }
1706
1707 static void set_pixel_conversion(VncState *vs)
1708 {
1709 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1710 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1711 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1712 vs->write_pixels = vnc_write_pixels_copy;
1713 vnc_hextile_set_pixel_conversion(vs, 0);
1714 } else {
1715 vs->write_pixels = vnc_write_pixels_generic;
1716 vnc_hextile_set_pixel_conversion(vs, 1);
1717 }
1718 }
1719
1720 static void set_pixel_format(VncState *vs,
1721 int bits_per_pixel, int depth,
1722 int big_endian_flag, int true_color_flag,
1723 int red_max, int green_max, int blue_max,
1724 int red_shift, int green_shift, int blue_shift)
1725 {
1726 if (!true_color_flag) {
1727 vnc_client_error(vs);
1728 return;
1729 }
1730
1731 vs->clientds = *(vs->vd->guest.ds);
1732 vs->clientds.pf.rmax = red_max;
1733 count_bits(vs->clientds.pf.rbits, red_max);
1734 vs->clientds.pf.rshift = red_shift;
1735 vs->clientds.pf.rmask = red_max << red_shift;
1736 vs->clientds.pf.gmax = green_max;
1737 count_bits(vs->clientds.pf.gbits, green_max);
1738 vs->clientds.pf.gshift = green_shift;
1739 vs->clientds.pf.gmask = green_max << green_shift;
1740 vs->clientds.pf.bmax = blue_max;
1741 count_bits(vs->clientds.pf.bbits, blue_max);
1742 vs->clientds.pf.bshift = blue_shift;
1743 vs->clientds.pf.bmask = blue_max << blue_shift;
1744 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1745 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1746 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1747 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1748
1749 set_pixel_conversion(vs);
1750
1751 vga_hw_invalidate();
1752 vga_hw_update();
1753 }
1754
1755 static void pixel_format_message (VncState *vs) {
1756 char pad[3] = { 0, 0, 0 };
1757
1758 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1759 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1760
1761 #ifdef HOST_WORDS_BIGENDIAN
1762 vnc_write_u8(vs, 1); /* big-endian-flag */
1763 #else
1764 vnc_write_u8(vs, 0); /* big-endian-flag */
1765 #endif
1766 vnc_write_u8(vs, 1); /* true-color-flag */
1767 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1768 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1769 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1770 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1771 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1772 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1773
1774 vnc_hextile_set_pixel_conversion(vs, 0);
1775
1776 vs->clientds = *(vs->ds->surface);
1777 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1778 vs->write_pixels = vnc_write_pixels_copy;
1779
1780 vnc_write(vs, pad, 3); /* padding */
1781 }
1782
1783 static void vnc_dpy_setdata(DisplayState *ds)
1784 {
1785 /* We don't have to do anything */
1786 }
1787
1788 static void vnc_colordepth(VncState *vs)
1789 {
1790 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1791 /* Sending a WMVi message to notify the client*/
1792 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1793 vnc_write_u8(vs, 0);
1794 vnc_write_u16(vs, 1); /* number of rects */
1795 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1796 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1797 pixel_format_message(vs);
1798 vnc_flush(vs);
1799 } else {
1800 set_pixel_conversion(vs);
1801 }
1802 }
1803
1804 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1805 {
1806 int i;
1807 uint16_t limit;
1808 VncDisplay *vd = vs->vd;
1809
1810 if (data[0] > 3) {
1811 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1812 if (!qemu_timer_expired(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval))
1813 qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
1814 }
1815
1816 switch (data[0]) {
1817 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
1818 if (len == 1)
1819 return 20;
1820
1821 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1822 read_u8(data, 6), read_u8(data, 7),
1823 read_u16(data, 8), read_u16(data, 10),
1824 read_u16(data, 12), read_u8(data, 14),
1825 read_u8(data, 15), read_u8(data, 16));
1826 break;
1827 case VNC_MSG_CLIENT_SET_ENCODINGS:
1828 if (len == 1)
1829 return 4;
1830
1831 if (len == 4) {
1832 limit = read_u16(data, 2);
1833 if (limit > 0)
1834 return 4 + (limit * 4);
1835 } else
1836 limit = read_u16(data, 2);
1837
1838 for (i = 0; i < limit; i++) {
1839 int32_t val = read_s32(data, 4 + (i * 4));
1840 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1841 }
1842
1843 set_encodings(vs, (int32_t *)(data + 4), limit);
1844 break;
1845 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
1846 if (len == 1)
1847 return 10;
1848
1849 framebuffer_update_request(vs,
1850 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1851 read_u16(data, 6), read_u16(data, 8));
1852 break;
1853 case VNC_MSG_CLIENT_KEY_EVENT:
1854 if (len == 1)
1855 return 8;
1856
1857 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1858 break;
1859 case VNC_MSG_CLIENT_POINTER_EVENT:
1860 if (len == 1)
1861 return 6;
1862
1863 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1864 break;
1865 case VNC_MSG_CLIENT_CUT_TEXT:
1866 if (len == 1)
1867 return 8;
1868
1869 if (len == 8) {
1870 uint32_t dlen = read_u32(data, 4);
1871 if (dlen > 0)
1872 return 8 + dlen;
1873 }
1874
1875 client_cut_text(vs, read_u32(data, 4), data + 8);
1876 break;
1877 case VNC_MSG_CLIENT_QEMU:
1878 if (len == 1)
1879 return 2;
1880
1881 switch (read_u8(data, 1)) {
1882 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
1883 if (len == 2)
1884 return 12;
1885
1886 ext_key_event(vs, read_u16(data, 2),
1887 read_u32(data, 4), read_u32(data, 8));
1888 break;
1889 case VNC_MSG_CLIENT_QEMU_AUDIO:
1890 if (len == 2)
1891 return 4;
1892
1893 switch (read_u16 (data, 2)) {
1894 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
1895 audio_add(vs);
1896 break;
1897 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
1898 audio_del(vs);
1899 break;
1900 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
1901 if (len == 4)
1902 return 10;
1903 switch (read_u8(data, 4)) {
1904 case 0: vs->as.fmt = AUD_FMT_U8; break;
1905 case 1: vs->as.fmt = AUD_FMT_S8; break;
1906 case 2: vs->as.fmt = AUD_FMT_U16; break;
1907 case 3: vs->as.fmt = AUD_FMT_S16; break;
1908 case 4: vs->as.fmt = AUD_FMT_U32; break;
1909 case 5: vs->as.fmt = AUD_FMT_S32; break;
1910 default:
1911 printf("Invalid audio format %d\n", read_u8(data, 4));
1912 vnc_client_error(vs);
1913 break;
1914 }
1915 vs->as.nchannels = read_u8(data, 5);
1916 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1917 printf("Invalid audio channel coount %d\n",
1918 read_u8(data, 5));
1919 vnc_client_error(vs);
1920 break;
1921 }
1922 vs->as.freq = read_u32(data, 6);
1923 break;
1924 default:
1925 printf ("Invalid audio message %d\n", read_u8(data, 4));
1926 vnc_client_error(vs);
1927 break;
1928 }
1929 break;
1930
1931 default:
1932 printf("Msg: %d\n", read_u16(data, 0));
1933 vnc_client_error(vs);
1934 break;
1935 }
1936 break;
1937 default:
1938 printf("Msg: %d\n", data[0]);
1939 vnc_client_error(vs);
1940 break;
1941 }
1942
1943 vnc_read_when(vs, protocol_client_msg, 1);
1944 return 0;
1945 }
1946
1947 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1948 {
1949 char buf[1024];
1950 int size;
1951
1952 vnc_write_u16(vs, ds_get_width(vs->ds));
1953 vnc_write_u16(vs, ds_get_height(vs->ds));
1954
1955 pixel_format_message(vs);
1956
1957 if (qemu_name)
1958 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1959 else
1960 size = snprintf(buf, sizeof(buf), "QEMU");
1961
1962 vnc_write_u32(vs, size);
1963 vnc_write(vs, buf, size);
1964 vnc_flush(vs);
1965
1966 vnc_client_cache_auth(vs);
1967 vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
1968
1969 vnc_read_when(vs, protocol_client_msg, 1);
1970
1971 return 0;
1972 }
1973
1974 void start_client_init(VncState *vs)
1975 {
1976 vnc_read_when(vs, protocol_client_init, 1);
1977 }
1978
1979 static void make_challenge(VncState *vs)
1980 {
1981 int i;
1982
1983 srand(time(NULL)+getpid()+getpid()*987654+rand());
1984
1985 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1986 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1987 }
1988
1989 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1990 {
1991 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1992 int i, j, pwlen;
1993 unsigned char key[8];
1994
1995 if (!vs->vd->password || !vs->vd->password[0]) {
1996 VNC_DEBUG("No password configured on server");
1997 vnc_write_u32(vs, 1); /* Reject auth */
1998 if (vs->minor >= 8) {
1999 static const char err[] = "Authentication failed";
2000 vnc_write_u32(vs, sizeof(err));
2001 vnc_write(vs, err, sizeof(err));
2002 }
2003 vnc_flush(vs);
2004 vnc_client_error(vs);
2005 return 0;
2006 }
2007
2008 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2009
2010 /* Calculate the expected challenge response */
2011 pwlen = strlen(vs->vd->password);
2012 for (i=0; i<sizeof(key); i++)
2013 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2014 deskey(key, EN0);
2015 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
2016 des(response+j, response+j);
2017
2018 /* Compare expected vs actual challenge response */
2019 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2020 VNC_DEBUG("Client challenge reponse did not match\n");
2021 vnc_write_u32(vs, 1); /* Reject auth */
2022 if (vs->minor >= 8) {
2023 static const char err[] = "Authentication failed";
2024 vnc_write_u32(vs, sizeof(err));
2025 vnc_write(vs, err, sizeof(err));
2026 }
2027 vnc_flush(vs);
2028 vnc_client_error(vs);
2029 } else {
2030 VNC_DEBUG("Accepting VNC challenge response\n");
2031 vnc_write_u32(vs, 0); /* Accept auth */
2032 vnc_flush(vs);
2033
2034 start_client_init(vs);
2035 }
2036 return 0;
2037 }
2038
2039 void start_auth_vnc(VncState *vs)
2040 {
2041 make_challenge(vs);
2042 /* Send client a 'random' challenge */
2043 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2044 vnc_flush(vs);
2045
2046 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2047 }
2048
2049
2050 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2051 {
2052 /* We only advertise 1 auth scheme at a time, so client
2053 * must pick the one we sent. Verify this */
2054 if (data[0] != vs->vd->auth) { /* Reject auth */
2055 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2056 vnc_write_u32(vs, 1);
2057 if (vs->minor >= 8) {
2058 static const char err[] = "Authentication failed";
2059 vnc_write_u32(vs, sizeof(err));
2060 vnc_write(vs, err, sizeof(err));
2061 }
2062 vnc_client_error(vs);
2063 } else { /* Accept requested auth */
2064 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2065 switch (vs->vd->auth) {
2066 case VNC_AUTH_NONE:
2067 VNC_DEBUG("Accept auth none\n");
2068 if (vs->minor >= 8) {
2069 vnc_write_u32(vs, 0); /* Accept auth completion */
2070 vnc_flush(vs);
2071 }
2072 start_client_init(vs);
2073 break;
2074
2075 case VNC_AUTH_VNC:
2076 VNC_DEBUG("Start VNC auth\n");
2077 start_auth_vnc(vs);
2078 break;
2079
2080 #ifdef CONFIG_VNC_TLS
2081 case VNC_AUTH_VENCRYPT:
2082 VNC_DEBUG("Accept VeNCrypt auth\n");;
2083 start_auth_vencrypt(vs);
2084 break;
2085 #endif /* CONFIG_VNC_TLS */
2086
2087 #ifdef CONFIG_VNC_SASL
2088 case VNC_AUTH_SASL:
2089 VNC_DEBUG("Accept SASL auth\n");
2090 start_auth_sasl(vs);
2091 break;
2092 #endif /* CONFIG_VNC_SASL */
2093
2094 default: /* Should not be possible, but just in case */
2095 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
2096 vnc_write_u8(vs, 1);
2097 if (vs->minor >= 8) {
2098 static const char err[] = "Authentication failed";
2099 vnc_write_u32(vs, sizeof(err));
2100 vnc_write(vs, err, sizeof(err));
2101 }
2102 vnc_client_error(vs);
2103 }
2104 }
2105 return 0;
2106 }
2107
2108 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2109 {
2110 char local[13];
2111
2112 memcpy(local, version, 12);
2113 local[12] = 0;
2114
2115 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2116 VNC_DEBUG("Malformed protocol version %s\n", local);
2117 vnc_client_error(vs);
2118 return 0;
2119 }
2120 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2121 if (vs->major != 3 ||
2122 (vs->minor != 3 &&
2123 vs->minor != 4 &&
2124 vs->minor != 5 &&
2125 vs->minor != 7 &&
2126 vs->minor != 8)) {
2127 VNC_DEBUG("Unsupported client version\n");
2128 vnc_write_u32(vs, VNC_AUTH_INVALID);
2129 vnc_flush(vs);
2130 vnc_client_error(vs);
2131 return 0;
2132 }
2133 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2134 * as equivalent to v3.3 by servers
2135 */
2136 if (vs->minor == 4 || vs->minor == 5)
2137 vs->minor = 3;
2138
2139 if (vs->minor == 3) {
2140 if (vs->vd->auth == VNC_AUTH_NONE) {
2141 VNC_DEBUG("Tell client auth none\n");
2142 vnc_write_u32(vs, vs->vd->auth);
2143 vnc_flush(vs);
2144 start_client_init(vs);
2145 } else if (vs->vd->auth == VNC_AUTH_VNC) {
2146 VNC_DEBUG("Tell client VNC auth\n");
2147 vnc_write_u32(vs, vs->vd->auth);
2148 vnc_flush(vs);
2149 start_auth_vnc(vs);
2150 } else {
2151 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2152 vnc_write_u32(vs, VNC_AUTH_INVALID);
2153 vnc_flush(vs);
2154 vnc_client_error(vs);
2155 }
2156 } else {
2157 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2158 vnc_write_u8(vs, 1); /* num auth */
2159 vnc_write_u8(vs, vs->vd->auth);
2160 vnc_read_when(vs, protocol_client_auth, 1);
2161 vnc_flush(vs);
2162 }
2163
2164 return 0;
2165 }
2166
2167 static int vnc_refresh_server_surface(VncDisplay *vd)
2168 {
2169 int y;
2170 uint8_t *guest_row;
2171 uint8_t *server_row;
2172 int cmp_bytes;
2173 uint32_t width_mask[VNC_DIRTY_WORDS];
2174 VncState *vs;
2175 int has_dirty = 0;
2176
2177 /*
2178 * Walk through the guest dirty map.
2179 * Check and copy modified bits from guest to server surface.
2180 * Update server dirty map.
2181 */
2182 vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
2183 cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2184 guest_row = vd->guest.ds->data;
2185 server_row = vd->server->data;
2186 for (y = 0; y < vd->guest.ds->height; y++) {
2187 if (vnc_and_bits(vd->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
2188 int x;
2189 uint8_t *guest_ptr;
2190 uint8_t *server_ptr;
2191
2192 guest_ptr = guest_row;
2193 server_ptr = server_row;
2194
2195 for (x = 0; x < vd->guest.ds->width;
2196 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2197 if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
2198 continue;
2199 vnc_clear_bit(vd->guest.dirty[y], (x / 16));
2200 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2201 continue;
2202 memcpy(server_ptr, guest_ptr, cmp_bytes);
2203 QTAILQ_FOREACH(vs, &vd->clients, next) {
2204 vnc_set_bit(vs->dirty[y], (x / 16));
2205 }
2206 has_dirty++;
2207 }
2208 }
2209 guest_row += ds_get_linesize(vd->ds);
2210 server_row += ds_get_linesize(vd->ds);
2211 }
2212 return has_dirty;
2213 }
2214
2215 static void vnc_refresh(void *opaque)
2216 {
2217 VncDisplay *vd = opaque;
2218 VncState *vs, *vn;
2219 int has_dirty, rects = 0;
2220
2221 vga_hw_update();
2222
2223 has_dirty = vnc_refresh_server_surface(vd);
2224
2225 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2226 rects += vnc_update_client(vs, has_dirty);
2227 /* vs might be free()ed here */
2228 }
2229 /* vd->timer could be NULL now if the last client disconnected,
2230 * in this case don't update the timer */
2231 if (vd->timer == NULL)
2232 return;
2233
2234 if (has_dirty && rects) {
2235 vd->timer_interval /= 2;
2236 if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2237 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2238 } else {
2239 vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2240 if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2241 vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2242 }
2243 qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
2244 }
2245
2246 static void vnc_init_timer(VncDisplay *vd)
2247 {
2248 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2249 if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
2250 vd->timer = qemu_new_timer(rt_clock, vnc_refresh, vd);
2251 vnc_refresh(vd);
2252 }
2253 }
2254
2255 static void vnc_remove_timer(VncDisplay *vd)
2256 {
2257 if (vd->timer != NULL && QTAILQ_EMPTY(&vd->clients)) {
2258 qemu_del_timer(vd->timer);
2259 qemu_free_timer(vd->timer);
2260 vd->timer = NULL;
2261 }
2262 }
2263
2264 static void vnc_connect(VncDisplay *vd, int csock)
2265 {
2266 VncState *vs = qemu_mallocz(sizeof(VncState));
2267 vs->csock = csock;
2268
2269 VNC_DEBUG("New client on socket %d\n", csock);
2270 dcl->idle = 0;
2271 socket_set_nonblock(vs->csock);
2272 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2273
2274 vnc_client_cache_addr(vs);
2275 vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2276
2277 vs->vd = vd;
2278 vs->ds = vd->ds;
2279 vs->last_x = -1;
2280 vs->last_y = -1;
2281
2282 vs->as.freq = 44100;
2283 vs->as.nchannels = 2;
2284 vs->as.fmt = AUD_FMT_S16;
2285 vs->as.endianness = 0;
2286
2287 QTAILQ_INSERT_HEAD(&vd->clients, vs, next);
2288
2289 vga_hw_update();
2290
2291 vnc_write(vs, "RFB 003.008\n", 12);
2292 vnc_flush(vs);
2293 vnc_read_when(vs, protocol_version, 12);
2294 reset_keys(vs);
2295 if (vs->vd->lock_key_sync)
2296 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2297
2298 vs->mouse_mode_notifier.notify = check_pointer_type_change;
2299 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2300
2301 vnc_init_timer(vd);
2302
2303 /* vs might be free()ed here */
2304 }
2305
2306 static void vnc_listen_read(void *opaque)
2307 {
2308 VncDisplay *vs = opaque;
2309 struct sockaddr_in addr;
2310 socklen_t addrlen = sizeof(addr);
2311
2312 /* Catch-up */
2313 vga_hw_update();
2314
2315 int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2316 if (csock != -1) {
2317 vnc_connect(vs, csock);
2318 }
2319 }
2320
2321 void vnc_display_init(DisplayState *ds)
2322 {
2323 VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2324
2325 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2326
2327 ds->opaque = vs;
2328 dcl->idle = 1;
2329 vnc_display = vs;
2330
2331 vs->lsock = -1;
2332
2333 vs->ds = ds;
2334 QTAILQ_INIT(&vs->clients);
2335
2336 if (keyboard_layout)
2337 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2338 else
2339 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2340
2341 if (!vs->kbd_layout)
2342 exit(1);
2343
2344 dcl->dpy_copy = vnc_dpy_copy;
2345 dcl->dpy_update = vnc_dpy_update;
2346 dcl->dpy_resize = vnc_dpy_resize;
2347 dcl->dpy_setdata = vnc_dpy_setdata;
2348 register_displaychangelistener(ds, dcl);
2349 ds->mouse_set = vnc_mouse_set;
2350 ds->cursor_define = vnc_dpy_cursor_define;
2351 }
2352
2353
2354 void vnc_display_close(DisplayState *ds)
2355 {
2356 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2357
2358 if (!vs)
2359 return;
2360 if (vs->display) {
2361 qemu_free(vs->display);
2362 vs->display = NULL;
2363 }
2364 if (vs->lsock != -1) {
2365 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2366 close(vs->lsock);
2367 vs->lsock = -1;
2368 }
2369 vs->auth = VNC_AUTH_INVALID;
2370 #ifdef CONFIG_VNC_TLS
2371 vs->subauth = VNC_AUTH_INVALID;
2372 vs->tls.x509verify = 0;
2373 #endif
2374 }
2375
2376 int vnc_display_password(DisplayState *ds, const char *password)
2377 {
2378 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2379
2380 if (!vs) {
2381 return -1;
2382 }
2383
2384 if (vs->password) {
2385 qemu_free(vs->password);
2386 vs->password = NULL;
2387 }
2388 if (password && password[0]) {
2389 if (!(vs->password = qemu_strdup(password)))
2390 return -1;
2391 if (vs->auth == VNC_AUTH_NONE) {
2392 vs->auth = VNC_AUTH_VNC;
2393 }
2394 } else {
2395 vs->auth = VNC_AUTH_NONE;
2396 }
2397
2398 return 0;
2399 }
2400
2401 char *vnc_display_local_addr(DisplayState *ds)
2402 {
2403 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2404
2405 return vnc_socket_local_addr("%s:%s", vs->lsock);
2406 }
2407
2408 int vnc_display_open(DisplayState *ds, const char *display)
2409 {
2410 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2411 const char *options;
2412 int password = 0;
2413 int reverse = 0;
2414 #ifdef CONFIG_VNC_TLS
2415 int tls = 0, x509 = 0;
2416 #endif
2417 #ifdef CONFIG_VNC_SASL
2418 int sasl = 0;
2419 int saslErr;
2420 #endif
2421 int acl = 0;
2422 int lock_key_sync = 1;
2423
2424 if (!vnc_display)
2425 return -1;
2426 vnc_display_close(ds);
2427 if (strcmp(display, "none") == 0)
2428 return 0;
2429
2430 if (!(vs->display = strdup(display)))
2431 return -1;
2432
2433 options = display;
2434 while ((options = strchr(options, ','))) {
2435 options++;
2436 if (strncmp(options, "password", 8) == 0) {
2437 password = 1; /* Require password auth */
2438 } else if (strncmp(options, "reverse", 7) == 0) {
2439 reverse = 1;
2440 } else if (strncmp(options, "no-lock-key-sync", 9) == 0) {
2441 lock_key_sync = 0;
2442 #ifdef CONFIG_VNC_SASL
2443 } else if (strncmp(options, "sasl", 4) == 0) {
2444 sasl = 1; /* Require SASL auth */
2445 #endif
2446 #ifdef CONFIG_VNC_TLS
2447 } else if (strncmp(options, "tls", 3) == 0) {
2448 tls = 1; /* Require TLS */
2449 } else if (strncmp(options, "x509", 4) == 0) {
2450 char *start, *end;
2451 x509 = 1; /* Require x509 certificates */
2452 if (strncmp(options, "x509verify", 10) == 0)
2453 vs->tls.x509verify = 1; /* ...and verify client certs */
2454
2455 /* Now check for 'x509=/some/path' postfix
2456 * and use that to setup x509 certificate/key paths */
2457 start = strchr(options, '=');
2458 end = strchr(options, ',');
2459 if (start && (!end || (start < end))) {
2460 int len = end ? end-(start+1) : strlen(start+1);
2461 char *path = qemu_strndup(start + 1, len);
2462
2463 VNC_DEBUG("Trying certificate path '%s'\n", path);
2464 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2465 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2466 qemu_free(path);
2467 qemu_free(vs->display);
2468 vs->display = NULL;
2469 return -1;
2470 }
2471 qemu_free(path);
2472 } else {
2473 fprintf(stderr, "No certificate path provided\n");
2474 qemu_free(vs->display);
2475 vs->display = NULL;
2476 return -1;
2477 }
2478 #endif
2479 } else if (strncmp(options, "acl", 3) == 0) {
2480 acl = 1;
2481 }
2482 }
2483
2484 #ifdef CONFIG_VNC_TLS
2485 if (acl && x509 && vs->tls.x509verify) {
2486 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2487 fprintf(stderr, "Failed to create x509 dname ACL\n");
2488 exit(1);
2489 }
2490 }
2491 #endif
2492 #ifdef CONFIG_VNC_SASL
2493 if (acl && sasl) {
2494 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2495 fprintf(stderr, "Failed to create username ACL\n");
2496 exit(1);
2497 }
2498 }
2499 #endif
2500
2501 /*
2502 * Combinations we support here:
2503 *
2504 * - no-auth (clear text, no auth)
2505 * - password (clear text, weak auth)
2506 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2507 * - tls (encrypt, weak anonymous creds, no auth)
2508 * - tls + password (encrypt, weak anonymous creds, weak auth)
2509 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2510 * - tls + x509 (encrypt, good x509 creds, no auth)
2511 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2512 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2513 *
2514 * NB1. TLS is a stackable auth scheme.
2515 * NB2. the x509 schemes have option to validate a client cert dname
2516 */
2517 if (password) {
2518 #ifdef CONFIG_VNC_TLS
2519 if (tls) {
2520 vs->auth = VNC_AUTH_VENCRYPT;
2521 if (x509) {
2522 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2523 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2524 } else {
2525 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2526 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2527 }
2528 } else {
2529 #endif /* CONFIG_VNC_TLS */
2530 VNC_DEBUG("Initializing VNC server with password auth\n");
2531 vs->auth = VNC_AUTH_VNC;
2532 #ifdef CONFIG_VNC_TLS
2533 vs->subauth = VNC_AUTH_INVALID;
2534 }
2535 #endif /* CONFIG_VNC_TLS */
2536 #ifdef CONFIG_VNC_SASL
2537 } else if (sasl) {
2538 #ifdef CONFIG_VNC_TLS
2539 if (tls) {
2540 vs->auth = VNC_AUTH_VENCRYPT;
2541 if (x509) {
2542 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2543 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2544 } else {
2545 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2546 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2547 }
2548 } else {
2549 #endif /* CONFIG_VNC_TLS */
2550 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2551 vs->auth = VNC_AUTH_SASL;
2552 #ifdef CONFIG_VNC_TLS
2553 vs->subauth = VNC_AUTH_INVALID;
2554 }
2555 #endif /* CONFIG_VNC_TLS */
2556 #endif /* CONFIG_VNC_SASL */
2557 } else {
2558 #ifdef CONFIG_VNC_TLS
2559 if (tls) {
2560 vs->auth = VNC_AUTH_VENCRYPT;
2561 if (x509) {
2562 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2563 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2564 } else {
2565 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2566 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2567 }
2568 } else {
2569 #endif
2570 VNC_DEBUG("Initializing VNC server with no auth\n");
2571 vs->auth = VNC_AUTH_NONE;
2572 #ifdef CONFIG_VNC_TLS
2573 vs->subauth = VNC_AUTH_INVALID;
2574 }
2575 #endif
2576 }
2577
2578 #ifdef CONFIG_VNC_SASL
2579 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2580 fprintf(stderr, "Failed to initialize SASL auth %s",
2581 sasl_errstring(saslErr, NULL, NULL));
2582 free(vs->display);
2583 vs->display = NULL;
2584 return -1;
2585 }
2586 #endif
2587 vs->lock_key_sync = lock_key_sync;
2588
2589 if (reverse) {
2590 /* connect to viewer */
2591 if (strncmp(display, "unix:", 5) == 0)
2592 vs->lsock = unix_connect(display+5);
2593 else
2594 vs->lsock = inet_connect(display, SOCK_STREAM);
2595 if (-1 == vs->lsock) {
2596 free(vs->display);
2597 vs->display = NULL;
2598 return -1;
2599 } else {
2600 int csock = vs->lsock;
2601 vs->lsock = -1;
2602 vnc_connect(vs, csock);
2603 }
2604 return 0;
2605
2606 } else {
2607 /* listen for connects */
2608 char *dpy;
2609 dpy = qemu_malloc(256);
2610 if (strncmp(display, "unix:", 5) == 0) {
2611 pstrcpy(dpy, 256, "unix:");
2612 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2613 } else {
2614 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2615 }
2616 if (-1 == vs->lsock) {
2617 free(dpy);
2618 return -1;
2619 } else {
2620 free(vs->display);
2621 vs->display = dpy;
2622 }
2623 }
2624 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2625 }
various patches