/home/stefan/src/qemu/qemu.org/qemu/ui/vnc.c

Bug Summary

File:	ui/vnc.c
Location:	line 132, column 10
Description:	Although the value stored to 'err' is used in the enclosing expression, the value is never actually read from 'err'

Annotated Source Code

1	/*
2	* QEMU VNC display driver
3	*
4	* Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5	* Copyright (C) 2006 Fabrice Bellard
6	* Copyright (C) 2009 Red Hat, Inc
7	*
8	* Permission is hereby granted, free of charge, to any person obtaining a copy
9	* of this software and associated documentation files (the "Software"), to deal
10	* in the Software without restriction, including without limitation the rights
11	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12	* copies of the Software, and to permit persons to whom the Software is
13	* furnished to do so, subject to the following conditions:
14	*
15	* The above copyright notice and this permission notice shall be included in
16	* all copies or substantial portions of the Software.
17	*
18	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24	* THE SOFTWARE.
25	*/
26
27	#include "vnc.h"
28	#include "vnc-jobs.h"
29	#include "sysemu.h"
30	#include "qemu_socket.h"
31	#include "qemu-timer.h"
32	#include "acl.h"
33	#include "qemu-objects.h"
34	#include "qmp-commands.h"
35
36	#define VNC_REFRESH_INTERVAL_BASE30 30
37	#define VNC_REFRESH_INTERVAL_INC50 50
38	#define VNC_REFRESH_INTERVAL_MAX2000 2000
39	static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
40	static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
41
42	#include "vnc_keysym.h"
43	#include "d3des.h"
44
45	static VncDisplay vnc_display; / needed for info vnc */
46	static DisplayChangeListener *dcl;
47
48	static int vnc_cursor_define(VncState *vs);
49	static void vnc_release_modifiers(VncState *vs);
50
51	static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
52	{
53	#ifdef _VNC_DEBUG
54	static const char *mn[] = {
55	[0] = "undefined",
56	[VNC_SHARE_MODE_CONNECTING] = "connecting",
57	[VNC_SHARE_MODE_SHARED] = "shared",
58	[VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
59	[VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
60	};
61	fprintf(stderrstderr, "%s/%d: %s -> %s\n", __func__,
62	vs->csock, mn[vs->share_mode], mn[mode]);
63	#endif
64
65	if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
66	vs->vd->num_exclusive--;
67	}
68	vs->share_mode = mode;
69	if (vs->share_mode == VNC_SHARE_MODE_EXCLUSIVE) {
70	vs->vd->num_exclusive++;
71	}
72	}
73
74	static char addr_to_string(const char format,
75	struct sockaddr_storage *sa,
76	socklen_t salen) {
77	char *addr;
78	char host[NI_MAXHOST1025];
79	char serv[NI_MAXSERV32];
80	int err;
81	size_t addrlen;
82
83	if ((err = getnameinfo((struct sockaddr *)sa, salen,
84	host, sizeof(host),
85	serv, sizeof(serv),
86	NI_NUMERICHOST1 \| NI_NUMERICSERV2)) != 0) {
87	VNC_DEBUG("Cannot resolve address %d: %s\n",do { } while (0)
88	err, gai_strerror(err))do { } while (0);
89	return NULL((void*)0);
90	}
91
92	/* Enough for the existing format + the 2 vars we're
93	* substituting in. */
94	addrlen = strlen(format) + strlen(host) + strlen(serv);
95	addr = g_malloc(addrlen + 1);
96	snprintf(addr, addrlen, format, host, serv);
97	addr[addrlen] = '\0';
98
99	return addr;
100	}
101
102
103	char vnc_socket_local_addr(const char format, int fd) {
104	struct sockaddr_storage sa;
105	socklen_t salen;
106
107	salen = sizeof(sa);
108	if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
109	return NULL((void*)0);
110
111	return addr_to_string(format, &sa, salen);
112	}
113
114	char vnc_socket_remote_addr(const char format, int fd) {
115	struct sockaddr_storage sa;
116	socklen_t salen;
117
118	salen = sizeof(sa);
119	if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
120	return NULL((void*)0);
121
122	return addr_to_string(format, &sa, salen);
123	}
124
125	static int put_addr_qdict(QDict qdict, struct sockaddr_storage sa,
126	socklen_t salen)
127	{
128	char host[NI_MAXHOST1025];
129	char serv[NI_MAXSERV32];
130	int err;
131
132	if ((err = getnameinfo((struct sockaddr *)sa, salen,
	Although the value stored to 'err' is used in the enclosing expression, the value is never actually read from 'err'
133	host, sizeof(host),
134	serv, sizeof(serv),
135	NI_NUMERICHOST1 \| NI_NUMERICSERV2)) != 0) {
136	VNC_DEBUG("Cannot resolve address %d: %s\n",do { } while (0)
137	err, gai_strerror(err))do { } while (0);
138	return -1;
139	}
140
141	qdict_put(qdict, "host", qstring_from_str(host))qdict_put_obj(qdict, "host", (&(qstring_from_str(host))-> base));
142	qdict_put(qdict, "service", qstring_from_str(serv))qdict_put_obj(qdict, "service", (&(qstring_from_str(serv) )->base));
143	qdict_put(qdict, "family",qstring_from_str(inet_strfamily(sa->ss_family)))qdict_put_obj(qdict, "family", (&(qstring_from_str(inet_strfamily (sa->ss_family)))->base));
144
145	return 0;
146	}
147
148	static int vnc_server_addr_put(QDict *qdict, int fd)
149	{
150	struct sockaddr_storage sa;
151	socklen_t salen;
152
153	salen = sizeof(sa);
154	if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
155	return -1;
156	}
157
158	return put_addr_qdict(qdict, &sa, salen);
159	}
160
161	static int vnc_qdict_remote_addr(QDict *qdict, int fd)
162	{
163	struct sockaddr_storage sa;
164	socklen_t salen;
165
166	salen = sizeof(sa);
167	if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
168	return -1;
169	}
170
171	return put_addr_qdict(qdict, &sa, salen);
172	}
173
174	static const char vnc_auth_name(VncDisplay vd) {
175	switch (vd->auth) {
176	case VNC_AUTH_INVALID:
177	return "invalid";
178	case VNC_AUTH_NONE:
179	return "none";
180	case VNC_AUTH_VNC:
181	return "vnc";
182	case VNC_AUTH_RA2:
183	return "ra2";
184	case VNC_AUTH_RA2NE:
185	return "ra2ne";
186	case VNC_AUTH_TIGHT:
187	return "tight";
188	case VNC_AUTH_ULTRA:
189	return "ultra";
190	case VNC_AUTH_TLS:
191	return "tls";
192	case VNC_AUTH_VENCRYPT:
193	#ifdef CONFIG_VNC_TLS1
194	switch (vd->subauth) {
195	case VNC_AUTH_VENCRYPT_PLAIN:
196	return "vencrypt+plain";
197	case VNC_AUTH_VENCRYPT_TLSNONE:
198	return "vencrypt+tls+none";
199	case VNC_AUTH_VENCRYPT_TLSVNC:
200	return "vencrypt+tls+vnc";
201	case VNC_AUTH_VENCRYPT_TLSPLAIN:
202	return "vencrypt+tls+plain";
203	case VNC_AUTH_VENCRYPT_X509NONE:
204	return "vencrypt+x509+none";
205	case VNC_AUTH_VENCRYPT_X509VNC:
206	return "vencrypt+x509+vnc";
207	case VNC_AUTH_VENCRYPT_X509PLAIN:
208	return "vencrypt+x509+plain";
209	case VNC_AUTH_VENCRYPT_TLSSASL:
210	return "vencrypt+tls+sasl";
211	case VNC_AUTH_VENCRYPT_X509SASL:
212	return "vencrypt+x509+sasl";
213	default:
214	return "vencrypt";
215	}
216	#else
217	return "vencrypt";
218	#endif
219	case VNC_AUTH_SASL:
220	return "sasl";
221	}
222	return "unknown";
223	}
224
225	static int vnc_server_info_put(QDict *qdict)
226	{
227	if (vnc_server_addr_put(qdict, vnc_display->lsock) < 0) {
228	return -1;
229	}
230
231	qdict_put(qdict, "auth", qstring_from_str(vnc_auth_name(vnc_display)))qdict_put_obj(qdict, "auth", (&(qstring_from_str(vnc_auth_name (vnc_display)))->base));
232	return 0;
233	}
234
235	static void vnc_client_cache_auth(VncState *client)
236	{
237	#if defined(CONFIG_VNC_TLS1) \|\| defined(CONFIG_VNC_SASL1)
238	QDict *qdict;
239	#endif
240
241	if (!client->info) {
242	return;
243	}
244
245	#if defined(CONFIG_VNC_TLS1) \|\| defined(CONFIG_VNC_SASL1)
246	qdict = qobject_to_qdict(client->info);
247	#endif
248
249	#ifdef CONFIG_VNC_TLS1
250	if (client->tls.session &&
251	client->tls.dname) {
252	qdict_put(qdict, "x509_dname", qstring_from_str(client->tls.dname))qdict_put_obj(qdict, "x509_dname", (&(qstring_from_str(client ->tls.dname))->base));
253	}
254	#endif
255	#ifdef CONFIG_VNC_SASL1
256	if (client->sasl.conn &&
257	client->sasl.username) {
258	qdict_put(qdict, "sasl_username",qdict_put_obj(qdict, "sasl_username", (&(qstring_from_str (client->sasl.username))->base))
259	qstring_from_str(client->sasl.username))qdict_put_obj(qdict, "sasl_username", (&(qstring_from_str (client->sasl.username))->base));
260	}
261	#endif
262	}
263
264	static void vnc_client_cache_addr(VncState *client)
265	{
266	QDict *qdict;
267
268	qdict = qdict_new();
269	if (vnc_qdict_remote_addr(qdict, client->csock) < 0) {
270	QDECREF(qdict)qobject_decref((&(qdict)->base));
271	/* XXX: how to report the error? */
272	return;
273	}
274
275	client->info = QOBJECT(qdict)(&(qdict)->base);
276	}
277
278	static void vnc_qmp_event(VncState *vs, MonitorEvent event)
279	{
280	QDict *server;
281	QObject *data;
282
283	if (!vs->info) {
284	return;
285	}
286
287	server = qdict_new();
288	if (vnc_server_info_put(server) < 0) {
289	QDECREF(server)qobject_decref((&(server)->base));
290	return;
291	}
292
293	data = qobject_from_jsonf("{ 'client': %p, 'server': %p }",
294	vs->info, QOBJECT(server)(&(server)->base));
295
296	monitor_protocol_event(event, data);
297
298	qobject_incref(vs->info);
299	qobject_decref(data);
300	}
301
302	static VncClientInfo qmp_query_vnc_client(const VncState client)
303	{
304	struct sockaddr_storage sa;
305	socklen_t salen = sizeof(sa);
306	char host[NI_MAXHOST1025];
307	char serv[NI_MAXSERV32];
308	VncClientInfo *info;
309
310	if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
311	return NULL((void*)0);
312	}
313
314	if (getnameinfo((struct sockaddr *)&sa, salen,
315	host, sizeof(host),
316	serv, sizeof(serv),
317	NI_NUMERICHOST1 \| NI_NUMERICSERV2) < 0) {
318	return NULL((void*)0);
319	}
320
321	info = g_malloc0(sizeof(*info));
322	info->host = g_strdup(host);
323	info->service = g_strdup(serv);
324	info->family = g_strdup(inet_strfamily(sa.ss_family));
325
326	#ifdef CONFIG_VNC_TLS1
327	if (client->tls.session && client->tls.dname) {
328	info->has_x509_dname = true1;
329	info->x509_dname = g_strdup(client->tls.dname);
330	}
331	#endif
332	#ifdef CONFIG_VNC_SASL1
333	if (client->sasl.conn && client->sasl.username) {
334	info->has_sasl_username = true1;
335	info->sasl_username = g_strdup(client->sasl.username);
336	}
337	#endif
338
339	return info;
340	}
341
342	VncInfo qmp_query_vnc(Error *errp)
343	{
344	VncInfo info = g_malloc0(sizeof(info));
345
346	if (vnc_display == NULL((void)0) \|\| vnc_display->display == NULL((void)0)) {
347	info->enabled = false0;
348	} else {
349	VncClientInfoList cur_item = NULL((void)0);
350	struct sockaddr_storage sa;
351	socklen_t salen = sizeof(sa);
352	char host[NI_MAXHOST1025];
353	char serv[NI_MAXSERV32];
354	VncState *client;
355
356	info->enabled = true1;
357
358	/* for compatibility with the original command */
359	info->has_clients = true1;
360
361	QTAILQ_FOREACH(client, &vnc_display->clients, next)for ((client) = ((&vnc_display->clients)->tqh_first ); (client); (client) = ((client)->next.tqe_next)) {
362	VncClientInfoList cinfo = g_malloc0(sizeof(info));
363	cinfo->value = qmp_query_vnc_client(client);
364
365	/* XXX: waiting for the qapi to support GSList */
366	if (!cur_item) {
367	info->clients = cur_item = cinfo;
368	} else {
369	cur_item->next = cinfo;
370	cur_item = cinfo;
371	}
372	}
373
374	if (getsockname(vnc_display->lsock, (struct sockaddr *)&sa,
375	&salen) == -1) {
376	error_set(errp, QERR_UNDEFINED_ERROR"{ 'class': 'UndefinedError', 'data': {} }");
377	goto out_error;
378	}
379
380	if (getnameinfo((struct sockaddr *)&sa, salen,
381	host, sizeof(host),
382	serv, sizeof(serv),
383	NI_NUMERICHOST1 \| NI_NUMERICSERV2) < 0) {
384	error_set(errp, QERR_UNDEFINED_ERROR"{ 'class': 'UndefinedError', 'data': {} }");
385	goto out_error;
386	}
387
388	info->has_host = true1;
389	info->host = g_strdup(host);
390
391	info->has_service = true1;
392	info->service = g_strdup(serv);
393
394	info->has_family = true1;
395	info->family = g_strdup(inet_strfamily(sa.ss_family));
396
397	info->has_auth = true1;
398	info->auth = g_strdup(vnc_auth_name(vnc_display));
399	}
400
401	return info;
402
403	out_error:
404	qapi_free_VncInfo(info);
405	return NULL((void*)0);
406	}
407
408	/* TODO
409	1) Get the queue working for IO.
410	2) there is some weirdness when using the -S option (the screen is grey
411	and not totally invalidated
412	3) resolutions > 1024
413	*/
414
415	static int vnc_update_client(VncState *vs, int has_dirty);
416	static int vnc_update_client_sync(VncState *vs, int has_dirty);
417	static void vnc_disconnect_start(VncState *vs);
418	static void vnc_disconnect_finish(VncState *vs);
419	static void vnc_init_timer(VncDisplay *vd);
420	static void vnc_remove_timer(VncDisplay *vd);
421
422	static void vnc_colordepth(VncState *vs);
423	static void framebuffer_update_request(VncState *vs, int incremental,
424	int x_position, int y_position,
425	int w, int h);
426	static void vnc_refresh(void *opaque);
427	static int vnc_refresh_server_surface(VncDisplay *vd);
428
429	static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
430	{
431	int i;
432	VncDisplay *vd = ds->opaque;
433	struct VncSurface *s = &vd->guest;
434
435	h += y;
436
437	/* round x down to ensure the loop only spans one 16-pixel block per,
438	iteration. otherwise, if (x % 16) != 0, the last iteration may span
439	two 16-pixel blocks but we only mark the first as dirty
440	*/
441	w += (x % 16);
442	x -= (x % 16);
443
444	x = MIN(x, s->ds->width)(((x) < (s->ds->width)) ? (x) : (s->ds->width) );
445	y = MIN(y, s->ds->height)(((y) < (s->ds->height)) ? (y) : (s->ds->height ));
446	w = MIN(x + w, s->ds->width)(((x + w) < (s->ds->width)) ? (x + w) : (s->ds-> width)) - x;
447	h = MIN(h, s->ds->height)(((h) < (s->ds->height)) ? (h) : (s->ds->height ));
448
449	for (; y < h; y++)
450	for (i = 0; i < w; i += 16)
451	set_bit((x + i) / 16, s->dirty[y]);
452	}
453
454	void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
455	int32_t encoding)
456	{
457	vnc_write_u16(vs, x);
458	vnc_write_u16(vs, y);
459	vnc_write_u16(vs, w);
460	vnc_write_u16(vs, h);
461
462	vnc_write_s32(vs, encoding);
463	}
464
465	void buffer_reserve(Buffer *buffer, size_t len)
466	{
467	if ((buffer->capacity - buffer->offset) < len) {
468	buffer->capacity += (len + 1024);
469	buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
470	if (buffer->buffer == NULL((void*)0)) {
471	fprintf(stderrstderr, "vnc: out of memory\n");
472	exit(1);
473	}
474	}
475	}
476
477	int buffer_empty(Buffer *buffer)
478	{
479	return buffer->offset == 0;
480	}
481
482	uint8_t buffer_end(Buffer buffer)
483	{
484	return buffer->buffer + buffer->offset;
485	}
486
487	void buffer_reset(Buffer *buffer)
488	{
489	buffer->offset = 0;
490	}
491
492	void buffer_free(Buffer *buffer)
493	{
494	g_free(buffer->buffer);
495	buffer->offset = 0;
496	buffer->capacity = 0;
497	buffer->buffer = NULL((void*)0);
498	}
499
500	void buffer_append(Buffer buffer, const void data, size_t len)
501	{
502	memcpy(buffer->buffer + buffer->offset, data, len);
503	buffer->offset += len;
504	}
505
506	static void vnc_desktop_resize(VncState *vs)
507	{
508	DisplayState *ds = vs->ds;
509
510	if (vs->csock == -1 \|\| !vnc_has_feature(vs, VNC_FEATURE_RESIZE0)) {
511	return;
512	}
513	if (vs->client_width == ds_get_width(ds) &&
514	vs->client_height == ds_get_height(ds)) {
515	return;
516	}
517	vs->client_width = ds_get_width(ds);
518	vs->client_height = ds_get_height(ds);
519	vnc_lock_output(vs);
520	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
521	vnc_write_u8(vs, 0);
522	vnc_write_u16(vs, 1); /* number of rects */
523	vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
524	VNC_ENCODING_DESKTOPRESIZE0xFFFFFF21);
525	vnc_unlock_output(vs);
526	vnc_flush(vs);
527	}
528
529	static void vnc_abort_display_jobs(VncDisplay *vd)
530	{
531	VncState *vs;
532
533	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
534	vnc_lock_output(vs);
535	vs->abort = true1;
536	vnc_unlock_output(vs);
537	}
538	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
539	vnc_jobs_join(vs);
540	}
541	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
542	vnc_lock_output(vs);
543	vs->abort = false0;
544	vnc_unlock_output(vs);
545	}
546	}
547
548	static void vnc_dpy_resize(DisplayState *ds)
549	{
550	VncDisplay *vd = ds->opaque;
551	VncState *vs;
552
553	vnc_abort_display_jobs(vd);
554
555	/* server surface */
556	if (!vd->server)
557	vd->server = g_malloc0(sizeof(*vd->server));
558	if (vd->server->data)
559	g_free(vd->server->data);
560	(vd->server) = (ds->surface);
561	vd->server->data = g_malloc0(vd->server->linesize *
562	vd->server->height);
563
564	/* guest surface */
565	if (!vd->guest.ds)
566	vd->guest.ds = g_malloc0(sizeof(*vd->guest.ds));
567	if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
568	console_color_init(ds);
569	(vd->guest.ds) = (ds->surface);
570	memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
571
572	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
573	vnc_colordepth(vs);
574	vnc_desktop_resize(vs);
575	if (vs->vd->cursor) {
576	vnc_cursor_define(vs);
577	}
578	memset(vs->dirty, 0xFF, sizeof(vs->dirty));
579	}
580	}
581
582	/* fastest code */
583	static void vnc_write_pixels_copy(VncState vs, struct PixelFormat pf,
584	void *pixels, int size)
585	{
586	vnc_write(vs, pixels, size);
587	}
588
589	/* slowest but generic code. */
590	void vnc_convert_pixel(VncState vs, uint8_t buf, uint32_t v)
591	{
592	uint8_t r, g, b;
593	VncDisplay *vd = vs->vd;
594
595	r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
596	vd->server->pf.rbits);
597	g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
598	vd->server->pf.gbits);
599	b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
600	vd->server->pf.bbits);
601	v = (r << vs->clientds.pf.rshift) \|
602	(g << vs->clientds.pf.gshift) \|
603	(b << vs->clientds.pf.bshift);
604	switch(vs->clientds.pf.bytes_per_pixel) {
605	case 1:
606	buf[0] = v;
607	break;
608	case 2:
609	if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG0x01) {
610	buf[0] = v >> 8;
611	buf[1] = v;
612	} else {
613	buf[1] = v >> 8;
614	buf[0] = v;
615	}
616	break;
617	default:
618	case 4:
619	if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG0x01) {
620	buf[0] = v >> 24;
621	buf[1] = v >> 16;
622	buf[2] = v >> 8;
623	buf[3] = v;
624	} else {
625	buf[3] = v >> 24;
626	buf[2] = v >> 16;
627	buf[1] = v >> 8;
628	buf[0] = v;
629	}
630	break;
631	}
632	}
633
634	static void vnc_write_pixels_generic(VncState vs, struct PixelFormat pf,
635	void *pixels1, int size)
636	{
637	uint8_t buf[4];
638
639	if (pf->bytes_per_pixel == 4) {
640	uint32_t *pixels = pixels1;
641	int n, i;
642	n = size >> 2;
643	for(i = 0; i < n; i++) {
644	vnc_convert_pixel(vs, buf, pixels[i]);
645	vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
646	}
647	} else if (pf->bytes_per_pixel == 2) {
648	uint16_t *pixels = pixels1;
649	int n, i;
650	n = size >> 1;
651	for(i = 0; i < n; i++) {
652	vnc_convert_pixel(vs, buf, pixels[i]);
653	vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
654	}
655	} else if (pf->bytes_per_pixel == 1) {
656	uint8_t *pixels = pixels1;
657	int n, i;
658	n = size;
659	for(i = 0; i < n; i++) {
660	vnc_convert_pixel(vs, buf, pixels[i]);
661	vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
662	}
663	} else {
664	fprintf(stderrstderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
665	}
666	}
667
668	int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
669	{
670	int i;
671	uint8_t *row;
672	VncDisplay *vd = vs->vd;
673
674	row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
675	for (i = 0; i < h; i++) {
676	vs->write_pixels(vs, &vd->server->pf, row, w * ds_get_bytes_per_pixel(vs->ds));
677	row += ds_get_linesize(vs->ds);
678	}
679	return 1;
680	}
681
682	int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
683	{
684	int n = 0;
685
686	switch(vs->vnc_encoding) {
687	case VNC_ENCODING_ZLIB0x00000006:
688	n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
689	break;
690	case VNC_ENCODING_HEXTILE0x00000005:
691	vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE0x00000005);
692	n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
693	break;
694	case VNC_ENCODING_TIGHT0x00000007:
695	n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
696	break;
697	case VNC_ENCODING_TIGHT_PNG0xFFFFFEFC:
698	n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
699	break;
700	case VNC_ENCODING_ZRLE0x00000010:
701	n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
702	break;
703	case VNC_ENCODING_ZYWRLE0x00000011:
704	n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
705	break;
706	default:
707	vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW0x00000000);
708	n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
709	break;
710	}
711	return n;
712	}
713
714	static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
715	{
716	/* send bitblit op to the vnc client */
717	vnc_lock_output(vs);
718	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
719	vnc_write_u8(vs, 0);
720	vnc_write_u16(vs, 1); /* number of rects */
721	vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT0x00000001);
722	vnc_write_u16(vs, src_x);
723	vnc_write_u16(vs, src_y);
724	vnc_unlock_output(vs);
725	vnc_flush(vs);
726	}
727
728	static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
729	{
730	VncDisplay *vd = ds->opaque;
731	VncState vs, vn;
732	uint8_t *src_row;
733	uint8_t *dst_row;
734	int i,x,y,pitch,depth,inc,w_lim,s;
735	int cmp_bytes;
736
737	vnc_refresh_server_surface(vd);
738	QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn)for ((vs) = ((&vd->clients)->tqh_first); (vs) && ((vn) = ((vs)->next.tqe_next), 1); (vs) = (vn)) {
739	if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT6)) {
740	vs->force_update = 1;
741	vnc_update_client_sync(vs, 1);
742	/* vs might be free()ed here */
743	}
744	}
745
746	/* do bitblit op on the local surface too */
747	pitch = ds_get_linesize(vd->ds);
748	depth = ds_get_bytes_per_pixel(vd->ds);
749	src_row = vd->server->data + pitch * src_y + depth * src_x;
750	dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
751	y = dst_y;
752	inc = 1;
753	if (dst_y > src_y) {
754	/* copy backwards */
755	src_row += pitch * (h-1);
756	dst_row += pitch * (h-1);
757	pitch = -pitch;
758	y = dst_y + h - 1;
759	inc = -1;
760	}
761	w_lim = w - (16 - (dst_x % 16));
762	if (w_lim < 0)
763	w_lim = w;
764	else
765	w_lim = w - (w_lim % 16);
766	for (i = 0; i < h; i++) {
767	for (x = 0; x <= w_lim;
768	x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
769	if (x == w_lim) {
770	if ((s = w - w_lim) == 0)
771	break;
772	} else if (!x) {
773	s = (16 - (dst_x % 16));
774	s = MIN(s, w_lim)(((s) < (w_lim)) ? (s) : (w_lim));
775	} else {
776	s = 16;
777	}
778	cmp_bytes = s * depth;
779	if (memcmp(src_row, dst_row, cmp_bytes) == 0)
780	continue;
781	memmove(dst_row, src_row, cmp_bytes);
782	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
783	if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT6)) {
784	set_bit(((x + dst_x) / 16), vs->dirty[y]);
785	}
786	}
787	}
788	src_row += pitch - w * depth;
789	dst_row += pitch - w * depth;
790	y += inc;
791	}
792
793	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
794	if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT6)) {
795	vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
796	}
797	}
798	}
799
800	static void vnc_mouse_set(int x, int y, int visible)
801	{
802	/* can we ask the client(s) to move the pointer ??? */
803	}
804
805	static int vnc_cursor_define(VncState *vs)
806	{
807	QEMUCursor *c = vs->vd->cursor;
808	PixelFormat pf = qemu_default_pixelformat(32);
809	int isize;
810
811	if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR7)) {
812	vnc_lock_output(vs);
813	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
814	vnc_write_u8(vs, 0); /* padding */
815	vnc_write_u16(vs, 1); /* # of rects */
816	vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
817	VNC_ENCODING_RICH_CURSOR0xFFFFFF11);
818	isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
819	vnc_write_pixels_generic(vs, &pf, c->data, isize);
820	vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
821	vnc_unlock_output(vs);
822	return 0;
823	}
824	return -1;
825	}
826
827	static void vnc_dpy_cursor_define(QEMUCursor *c)
828	{
829	VncDisplay *vd = vnc_display;
830	VncState *vs;
831
832	cursor_put(vd->cursor);
833	g_free(vd->cursor_mask);
834
835	vd->cursor = c;
836	cursor_get(vd->cursor);
837	vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
838	vd->cursor_mask = g_malloc0(vd->cursor_msize);
839	cursor_get_mono_mask(c, 0, vd->cursor_mask);
840
841	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
842	vnc_cursor_define(vs);
843	}
844	}
845
846	static int find_and_clear_dirty_height(struct VncState *vs,
847	int y, int last_x, int x, int height)
848	{
849	int h;
850
851	for (h = 1; h < (height - y); h++) {
852	int tmp_x;
853	if (!test_bit(last_x, vs->dirty[y + h])) {
854	break;
855	}
856	for (tmp_x = last_x; tmp_x < x; tmp_x++) {
857	clear_bit(tmp_x, vs->dirty[y + h]);
858	}
859	}
860
861	return h;
862	}
863
864	static int vnc_update_client_sync(VncState *vs, int has_dirty)
865	{
866	int ret = vnc_update_client(vs, has_dirty);
867	vnc_jobs_join(vs);
868	return ret;
869	}
870
871	static int vnc_update_client(VncState *vs, int has_dirty)
872	{
873	if (vs->need_update && vs->csock != -1) {
874	VncDisplay *vd = vs->vd;
875	VncJob *job;
876	int y;
877	int width, height;
878	int n = 0;
879
880
881	if (vs->output.offset && !vs->audio_cap && !vs->force_update)
882	/* kernel send buffers are full -> drop frames to throttle */
883	return 0;
884
885	if (!has_dirty && !vs->audio_cap && !vs->force_update)
886	return 0;
887
888	/*
889	* Send screen updates to the vnc client using the server
890	* surface and server dirty map. guest surface updates
891	* happening in parallel don't disturb us, the next pass will
892	* send them to the client.
893	*/
894	job = vnc_job_new(vs);
895
896	width = MIN(vd->server->width, vs->client_width)(((vd->server->width) < (vs->client_width)) ? (vd ->server->width) : (vs->client_width));
897	height = MIN(vd->server->height, vs->client_height)(((vd->server->height) < (vs->client_height)) ? ( vd->server->height) : (vs->client_height));
898
899	for (y = 0; y < height; y++) {
900	int x;
901	int last_x = -1;
902	for (x = 0; x < width / 16; x++) {
903	if (test_and_clear_bit(x, vs->dirty[y])) {
904	if (last_x == -1) {
905	last_x = x;
906	}
907	} else {
908	if (last_x != -1) {
909	int h = find_and_clear_dirty_height(vs, y, last_x, x,
910	height);
911
912	n += vnc_job_add_rect(job, last_x * 16, y,
913	(x - last_x) * 16, h);
914	}
915	last_x = -1;
916	}
917	}
918	if (last_x != -1) {
919	int h = find_and_clear_dirty_height(vs, y, last_x, x, height);
920	n += vnc_job_add_rect(job, last_x * 16, y,
921	(x - last_x) * 16, h);
922	}
923	}
924
925	vnc_job_push(job);
926	vs->force_update = 0;
927	return n;
928	}
929
930	if (vs->csock == -1)
931	vnc_disconnect_finish(vs);
932
933	return 0;
934	}
935
936	/* audio */
937	static void audio_capture_notify(void *opaque, audcnotification_e cmd)
938	{
939	VncState *vs = opaque;
940
941	switch (cmd) {
942	case AUD_CNOTIFY_DISABLE:
943	vnc_lock_output(vs);
944	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU255);
945	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO1);
946	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END0);
947	vnc_unlock_output(vs);
948	vnc_flush(vs);
949	break;
950
951	case AUD_CNOTIFY_ENABLE:
952	vnc_lock_output(vs);
953	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU255);
954	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO1);
955	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN1);
956	vnc_unlock_output(vs);
957	vnc_flush(vs);
958	break;
959	}
960	}
961
962	static void audio_capture_destroy(void *opaque)
963	{
964	}
965
966	static void audio_capture(void opaque, void buf, int size)
967	{
968	VncState *vs = opaque;
969
970	vnc_lock_output(vs);
971	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU255);
972	vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO1);
973	vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA2);
974	vnc_write_u32(vs, size);
975	vnc_write(vs, buf, size);
976	vnc_unlock_output(vs);
977	vnc_flush(vs);
978	}
979
980	static void audio_add(VncState *vs)
981	{
982	struct audio_capture_ops ops;
983
984	if (vs->audio_cap) {
985	monitor_printf(default_mon, "audio already running\n");
986	return;
987	}
988
989	ops.notify = audio_capture_notify;
990	ops.destroy = audio_capture_destroy;
991	ops.capture = audio_capture;
992
993	vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
994	if (!vs->audio_cap) {
995	monitor_printf(default_mon, "Failed to add audio capture\n");
996	}
997	}
998
999	static void audio_del(VncState *vs)
1000	{
1001	if (vs->audio_cap) {
1002	AUD_del_capture(vs->audio_cap, vs);
1003	vs->audio_cap = NULL((void*)0);
1004	}
1005	}
1006
1007	static void vnc_disconnect_start(VncState *vs)
1008	{
1009	if (vs->csock == -1)
1010	return;
1011	vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1012	qemu_set_fd_handler2(vs->csock, NULL((void)0), NULL((void)0), NULL((void)0), NULL((void)0));
1013	closesocket(vs->csock)close(vs->csock);
1014	vs->csock = -1;
1015	}
1016
1017	static void vnc_disconnect_finish(VncState *vs)
1018	{
1019	int i;
1020
1021	vnc_jobs_join(vs); /* Wait encoding jobs */
1022
1023	vnc_lock_output(vs);
1024	vnc_qmp_event(vs, QEVENT_VNC_DISCONNECTED);
1025
1026	buffer_free(&vs->input);
1027	buffer_free(&vs->output);
1028
1029	qobject_decref(vs->info);
1030
1031	vnc_zlib_clear(vs);
1032	vnc_tight_clear(vs);
1033	vnc_zrle_clear(vs);
1034
1035	#ifdef CONFIG_VNC_TLS1
1036	vnc_tls_client_cleanup(vs);
1037	#endif /* CONFIG_VNC_TLS */
1038	#ifdef CONFIG_VNC_SASL1
1039	vnc_sasl_client_cleanup(vs);
1040	#endif /* CONFIG_VNC_SASL */
1041	audio_del(vs);
1042	vnc_release_modifiers(vs);
1043
1044	QTAILQ_REMOVE(&vs->vd->clients, vs, next)do { if (((vs)->next.tqe_next) != ((void)0)) (vs)->next .tqe_next->next.tqe_prev = (vs)->next.tqe_prev; else (& vs->vd->clients)->tqh_last = (vs)->next.tqe_prev; (vs)->next.tqe_prev = (vs)->next.tqe_next; } while ( 0 );
1045
1046	if (QTAILQ_EMPTY(&vs->vd->clients)((&vs->vd->clients)->tqh_first == ((void*)0))) {
1047	dcl->idle = 1;
1048	}
1049
1050	qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1051	vnc_remove_timer(vs->vd);
1052	if (vs->vd->lock_key_sync)
1053	qemu_remove_led_event_handler(vs->led);
1054	vnc_unlock_output(vs);
1055
1056	qemu_mutex_destroy(&vs->output_mutex);
1057	qemu_bh_delete(vs->bh);
1058	buffer_free(&vs->jobs_buffer);
1059
1060	for (i = 0; i < VNC_STAT_ROWS(2048 / 64); ++i) {
1061	g_free(vs->lossy_rect[i]);
1062	}
1063	g_free(vs->lossy_rect);
1064	g_free(vs);
1065	}
1066
1067	int vnc_client_io_error(VncState *vs, int ret, int last_errno)
1068	{
1069	if (ret == 0 \|\| ret == -1) {
1070	if (ret == -1) {
1071	switch (last_errno) {
1072	case EINTR4:
1073	case EAGAIN11:
1074	#ifdef _WIN32
1075	case WSAEWOULDBLOCK:
1076	#endif
1077	return 0;
1078	default:
1079	break;
1080	}
1081	}
1082
1083	VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",do { } while (0)
1084	ret, ret < 0 ? last_errno : 0)do { } while (0);
1085	vnc_disconnect_start(vs);
1086
1087	return 0;
1088	}
1089	return ret;
1090	}
1091
1092
1093	void vnc_client_error(VncState *vs)
1094	{
1095	VNC_DEBUG("Closing down client sock: protocol error\n")do { } while (0);
1096	vnc_disconnect_start(vs);
1097	}
1098
1099
1100	/*
1101	* Called to write a chunk of data to the client socket. The data may
1102	* be the raw data, or may have already been encoded by SASL.
1103	* The data will be written either straight onto the socket, or
1104	* written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1105	*
1106	* NB, it is theoretically possible to have 2 layers of encryption,
1107	* both SASL, and this TLS layer. It is highly unlikely in practice
1108	* though, since SASL encryption will typically be a no-op if TLS
1109	* is active
1110	*
1111	* Returns the number of bytes written, which may be less than
1112	* the requested 'datalen' if the socket would block. Returns
1113	* -1 on error, and disconnects the client socket.
1114	*/
1115	long vnc_client_write_buf(VncState vs, const uint8_t data, size_t datalen)
1116	{
1117	long ret;
1118	#ifdef CONFIG_VNC_TLS1
1119	if (vs->tls.session) {
1120	ret = gnutls_writegnutls_record_send(vs->tls.session, data, datalen);
1121	if (ret < 0) {
1122	if (ret == GNUTLS_E_AGAIN-28)
1123	errno(*__errno_location ()) = EAGAIN11;
1124	else
1125	errno(*__errno_location ()) = EIO5;
1126	ret = -1;
1127	}
1128	} else
1129	#endif /* CONFIG_VNC_TLS */
1130	ret = send(vs->csock, (const void *)data, datalen, 0);
1131	VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret)do { } while (0);
1132	return vnc_client_io_error(vs, ret, socket_error()(*__errno_location ()));
1133	}
1134
1135
1136	/*
1137	* Called to write buffered data to the client socket, when not
1138	* using any SASL SSF encryption layers. Will write as much data
1139	* as possible without blocking. If all buffered data is written,
1140	* will switch the FD poll() handler back to read monitoring.
1141	*
1142	* Returns the number of bytes written, which may be less than
1143	* the buffered output data if the socket would block. Returns
1144	* -1 on error, and disconnects the client socket.
1145	*/
1146	static long vnc_client_write_plain(VncState *vs)
1147	{
1148	long ret;
1149
1150	#ifdef CONFIG_VNC_SASL1
1151	VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",do { } while (0)
1152	vs->output.buffer, vs->output.capacity, vs->output.offset,do { } while (0)
1153	vs->sasl.waitWriteSSF)do { } while (0);
1154
1155	if (vs->sasl.conn &&
1156	vs->sasl.runSSF &&
1157	vs->sasl.waitWriteSSF) {
1158	ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1159	if (ret)
1160	vs->sasl.waitWriteSSF -= ret;
1161	} else
1162	#endif /* CONFIG_VNC_SASL */
1163	ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1164	if (!ret)
1165	return 0;
1166
1167	memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1168	vs->output.offset -= ret;
1169
1170	if (vs->output.offset == 0) {
1171	qemu_set_fd_handler2(vs->csock, NULL((void)0), vnc_client_read, NULL((void)0), vs);
1172	}
1173
1174	return ret;
1175	}
1176
1177
1178	/*
1179	* First function called whenever there is data to be written to
1180	* the client socket. Will delegate actual work according to whether
1181	* SASL SSF layers are enabled (thus requiring encryption calls)
1182	*/
1183	static void vnc_client_write_locked(void *opaque)
1184	{
1185	VncState *vs = opaque;
1186
1187	#ifdef CONFIG_VNC_SASL1
1188	if (vs->sasl.conn &&
1189	vs->sasl.runSSF &&
1190	!vs->sasl.waitWriteSSF) {
1191	vnc_client_write_sasl(vs);
1192	} else
1193	#endif /* CONFIG_VNC_SASL */
1194	vnc_client_write_plain(vs);
1195	}
1196
1197	void vnc_client_write(void *opaque)
1198	{
1199	VncState *vs = opaque;
1200
1201	vnc_lock_output(vs);
1202	if (vs->output.offset) {
1203	vnc_client_write_locked(opaque);
1204	} else if (vs->csock != -1) {
1205	qemu_set_fd_handler2(vs->csock, NULL((void)0), vnc_client_read, NULL((void)0), vs);
1206	}
1207	vnc_unlock_output(vs);
1208	}
1209
1210	void vnc_read_when(VncState vs, VncReadEvent func, size_t expecting)
1211	{
1212	vs->read_handler = func;
1213	vs->read_handler_expect = expecting;
1214	}
1215
1216
1217	/*
1218	* Called to read a chunk of data from the client socket. The data may
1219	* be the raw data, or may need to be further decoded by SASL.
1220	* The data will be read either straight from to the socket, or
1221	* read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1222	*
1223	* NB, it is theoretically possible to have 2 layers of encryption,
1224	* both SASL, and this TLS layer. It is highly unlikely in practice
1225	* though, since SASL encryption will typically be a no-op if TLS
1226	* is active
1227	*
1228	* Returns the number of bytes read, which may be less than
1229	* the requested 'datalen' if the socket would block. Returns
1230	* -1 on error, and disconnects the client socket.
1231	*/
1232	long vnc_client_read_buf(VncState vs, uint8_t data, size_t datalen)
1233	{
1234	long ret;
1235	#ifdef CONFIG_VNC_TLS1
1236	if (vs->tls.session) {
1237	ret = gnutls_readgnutls_record_recv(vs->tls.session, data, datalen);
1238	if (ret < 0) {
1239	if (ret == GNUTLS_E_AGAIN-28)
1240	errno(*__errno_location ()) = EAGAIN11;
1241	else
1242	errno(*__errno_location ()) = EIO5;
1243	ret = -1;
1244	}
1245	} else
1246	#endif /* CONFIG_VNC_TLS */
1247	ret = qemu_recv(vs->csock, data, datalen, 0)recv(vs->csock, data, datalen, 0);
1248	VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret)do { } while (0);
1249	return vnc_client_io_error(vs, ret, socket_error()(*__errno_location ()));
1250	}
1251
1252
1253	/*
1254	* Called to read data from the client socket to the input buffer,
1255	* when not using any SASL SSF encryption layers. Will read as much
1256	* data as possible without blocking.
1257	*
1258	* Returns the number of bytes read. Returns -1 on error, and
1259	* disconnects the client socket.
1260	*/
1261	static long vnc_client_read_plain(VncState *vs)
1262	{
1263	int ret;
1264	VNC_DEBUG("Read plain %p size %zd offset %zd\n",do { } while (0)
1265	vs->input.buffer, vs->input.capacity, vs->input.offset)do { } while (0);
1266	buffer_reserve(&vs->input, 4096);
1267	ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1268	if (!ret)
1269	return 0;
1270	vs->input.offset += ret;
1271	return ret;
1272	}
1273
1274	static void vnc_jobs_bh(void *opaque)
1275	{
1276	VncState *vs = opaque;
1277
1278	vnc_jobs_consume_buffer(vs);
1279	}
1280
1281	/*
1282	* First function called whenever there is more data to be read from
1283	* the client socket. Will delegate actual work according to whether
1284	* SASL SSF layers are enabled (thus requiring decryption calls)
1285	*/
1286	void vnc_client_read(void *opaque)
1287	{
1288	VncState *vs = opaque;
1289	long ret;
1290
1291	#ifdef CONFIG_VNC_SASL1
1292	if (vs->sasl.conn && vs->sasl.runSSF)
1293	ret = vnc_client_read_sasl(vs);
1294	else
1295	#endif /* CONFIG_VNC_SASL */
1296	ret = vnc_client_read_plain(vs);
1297	if (!ret) {
1298	if (vs->csock == -1)
1299	vnc_disconnect_finish(vs);
1300	return;
1301	}
1302
1303	while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1304	size_t len = vs->read_handler_expect;
1305	int ret;
1306
1307	ret = vs->read_handler(vs, vs->input.buffer, len);
1308	if (vs->csock == -1) {
1309	vnc_disconnect_finish(vs);
1310	return;
1311	}
1312
1313	if (!ret) {
1314	memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1315	vs->input.offset -= len;
1316	} else {
1317	vs->read_handler_expect = ret;
1318	}
1319	}
1320	}
1321
1322	void vnc_write(VncState vs, const void data, size_t len)
1323	{
1324	buffer_reserve(&vs->output, len);
1325
1326	if (vs->csock != -1 && buffer_empty(&vs->output)) {
1327	qemu_set_fd_handler2(vs->csock, NULL((void*)0), vnc_client_read, vnc_client_write, vs);
1328	}
1329
1330	buffer_append(&vs->output, data, len);
1331	}
1332
1333	void vnc_write_s32(VncState *vs, int32_t value)
1334	{
1335	vnc_write_u32(vs, (uint32_t )&value);
1336	}
1337
1338	void vnc_write_u32(VncState *vs, uint32_t value)
1339	{
1340	uint8_t buf[4];
1341
1342	buf[0] = (value >> 24) & 0xFF;
1343	buf[1] = (value >> 16) & 0xFF;
1344	buf[2] = (value >> 8) & 0xFF;
1345	buf[3] = value & 0xFF;
1346
1347	vnc_write(vs, buf, 4);
1348	}
1349
1350	void vnc_write_u16(VncState *vs, uint16_t value)
1351	{
1352	uint8_t buf[2];
1353
1354	buf[0] = (value >> 8) & 0xFF;
1355	buf[1] = value & 0xFF;
1356
1357	vnc_write(vs, buf, 2);
1358	}
1359
1360	void vnc_write_u8(VncState *vs, uint8_t value)
1361	{
1362	vnc_write(vs, (char *)&value, 1);
1363	}
1364
1365	void vnc_flush(VncState *vs)
1366	{
1367	vnc_lock_output(vs);
1368	if (vs->csock != -1 && vs->output.offset) {
1369	vnc_client_write_locked(vs);
1370	}
1371	vnc_unlock_output(vs);
1372	}
1373
1374	uint8_t read_u8(uint8_t *data, size_t offset)
1375	{
1376	return data[offset];
1377	}
1378
1379	uint16_t read_u16(uint8_t *data, size_t offset)
1380	{
1381	return ((data[offset] & 0xFF) << 8) \| (data[offset + 1] & 0xFF);
1382	}
1383
1384	int32_t read_s32(uint8_t *data, size_t offset)
1385	{
1386	return (int32_t)((data[offset] << 24) \| (data[offset + 1] << 16) \|
1387	(data[offset + 2] << 8) \| data[offset + 3]);
1388	}
1389
1390	uint32_t read_u32(uint8_t *data, size_t offset)
1391	{
1392	return ((data[offset] << 24) \| (data[offset + 1] << 16) \|
1393	(data[offset + 2] << 8) \| data[offset + 3]);
1394	}
1395
1396	static void client_cut_text(VncState vs, size_t len, uint8_t text)
1397	{
1398	}
1399
1400	static void check_pointer_type_change(Notifier notifier, void data)
1401	{
1402	VncState vs = container_of(notifier, VncState, mouse_mode_notifier)({ const typeof(((VncState ) 0)->mouse_mode_notifier) __mptr = (notifier); (VncState ) ((char *) __mptr - __builtin_offsetof (VncState, mouse_mode_notifier));});
1403	int absolute = kbd_mouse_is_absolute();
1404
1405	if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE2) && vs->absolute != absolute) {
1406	vnc_lock_output(vs);
1407	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
1408	vnc_write_u8(vs, 0);
1409	vnc_write_u16(vs, 1);
1410	vnc_framebuffer_update(vs, absolute, 0,
1411	ds_get_width(vs->ds), ds_get_height(vs->ds),
1412	VNC_ENCODING_POINTER_TYPE_CHANGE0XFFFFFEFF);
1413	vnc_unlock_output(vs);
1414	vnc_flush(vs);
1415	}
1416	vs->absolute = absolute;
1417	}
1418
1419	static void pointer_event(VncState *vs, int button_mask, int x, int y)
1420	{
1421	int buttons = 0;
1422	int dz = 0;
1423
1424	if (button_mask & 0x01)
1425	buttons \|= MOUSE_EVENT_LBUTTON0x01;
1426	if (button_mask & 0x02)
1427	buttons \|= MOUSE_EVENT_MBUTTON0x04;
1428	if (button_mask & 0x04)
1429	buttons \|= MOUSE_EVENT_RBUTTON0x02;
1430	if (button_mask & 0x08)
1431	dz = -1;
1432	if (button_mask & 0x10)
1433	dz = 1;
1434
1435	if (vs->absolute) {
1436	kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
1437	x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
1438	ds_get_height(vs->ds) > 1 ?
1439	y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
1440	dz, buttons);
1441	} else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE2)) {
1442	x -= 0x7FFF;
1443	y -= 0x7FFF;
1444
1445	kbd_mouse_event(x, y, dz, buttons);
1446	} else {
1447	if (vs->last_x != -1)
1448	kbd_mouse_event(x - vs->last_x,
1449	y - vs->last_y,
1450	dz, buttons);
1451	vs->last_x = x;
1452	vs->last_y = y;
1453	}
1454	}
1455
1456	static void reset_keys(VncState *vs)
1457	{
1458	int i;
1459	for(i = 0; i < 256; i++) {
1460	if (vs->modifiers_state[i]) {
1461	if (i & SCANCODE_GREY0x80)
1462	kbd_put_keycode(SCANCODE_EMUL00xE0);
1463	kbd_put_keycode(i \| SCANCODE_UP0x80);
1464	vs->modifiers_state[i] = 0;
1465	}
1466	}
1467	}
1468
1469	static void press_key(VncState *vs, int keysym)
1470	{
1471	int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK0xff;
1472	if (keycode & SCANCODE_GREY0x80)
1473	kbd_put_keycode(SCANCODE_EMUL00xE0);
1474	kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK0x7f);
1475	if (keycode & SCANCODE_GREY0x80)
1476	kbd_put_keycode(SCANCODE_EMUL00xE0);
1477	kbd_put_keycode(keycode \| SCANCODE_UP0x80);
1478	}
1479
1480	static void kbd_leds(void *opaque, int ledstate)
1481	{
1482	VncState *vs = opaque;
1483	int caps, num;
1484
1485	caps = ledstate & QEMU_CAPS_LOCK_LED(1 << 2) ? 1 : 0;
1486	num = ledstate & QEMU_NUM_LOCK_LED(1 << 1) ? 1 : 0;
1487
1488	if (vs->modifiers_state[0x3a] != caps) {
1489	vs->modifiers_state[0x3a] = caps;
1490	}
1491	if (vs->modifiers_state[0x45] != num) {
1492	vs->modifiers_state[0x45] = num;
1493	}
1494	}
1495
1496	static void do_key_event(VncState *vs, int down, int keycode, int sym)
1497	{
1498	/* QEMU console switch */
1499	switch(keycode) {
1500	case 0x2a: /* Left Shift */
1501	case 0x36: /* Right Shift */
1502	case 0x1d: /* Left CTRL */
1503	case 0x9d: /* Right CTRL */
1504	case 0x38: /* Left ALT */
1505	case 0xb8: /* Right ALT */
1506	if (down)
1507	vs->modifiers_state[keycode] = 1;
1508	else
1509	vs->modifiers_state[keycode] = 0;
1510	break;
1511	case 0x02 ... 0x0a: /* '1' to '9' keys */
1512	if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1513	/* Reset the modifiers sent to the current console */
1514	reset_keys(vs);
1515	console_select(keycode - 0x02);
1516	return;
1517	}
1518	break;
1519	case 0x3a: /* CapsLock */
1520	case 0x45: /* NumLock */
1521	if (down)
1522	vs->modifiers_state[keycode] ^= 1;
1523	break;
1524	}
1525
1526	if (down && vs->vd->lock_key_sync &&
1527	keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1528	/* If the numlock state needs to change then simulate an additional
1529	keypress before sending this one. This will happen if the user
1530	toggles numlock away from the VNC window.
1531	*/
1532	if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1533	if (!vs->modifiers_state[0x45]) {
1534	vs->modifiers_state[0x45] = 1;
1535	press_key(vs, 0xff7f);
1536	}
1537	} else {
1538	if (vs->modifiers_state[0x45]) {
1539	vs->modifiers_state[0x45] = 0;
1540	press_key(vs, 0xff7f);
1541	}
1542	}
1543	}
1544
1545	if (down && vs->vd->lock_key_sync &&
1546	((sym >= 'A' && sym <= 'Z') \|\| (sym >= 'a' && sym <= 'z'))) {
1547	/* If the capslock state needs to change then simulate an additional
1548	keypress before sending this one. This will happen if the user
1549	toggles capslock away from the VNC window.
1550	*/
1551	int uppercase = !!(sym >= 'A' && sym <= 'Z');
1552	int shift = !!(vs->modifiers_state[0x2a] \| vs->modifiers_state[0x36]);
1553	int capslock = !!(vs->modifiers_state[0x3a]);
1554	if (capslock) {
1555	if (uppercase == shift) {
1556	vs->modifiers_state[0x3a] = 0;
1557	press_key(vs, 0xffe5);
1558	}
1559	} else {
1560	if (uppercase != shift) {
1561	vs->modifiers_state[0x3a] = 1;
1562	press_key(vs, 0xffe5);
1563	}
1564	}
1565	}
1566
1567	if (is_graphic_console()) {
1568	if (keycode & SCANCODE_GREY0x80)
1569	kbd_put_keycode(SCANCODE_EMUL00xE0);
1570	if (down)
1571	kbd_put_keycode(keycode & SCANCODE_KEYCODEMASK0x7f);
1572	else
1573	kbd_put_keycode(keycode \| SCANCODE_UP0x80);
1574	} else {
1575	bool_Bool numlock = vs->modifiers_state[0x45];
1576	bool_Bool control = (vs->modifiers_state[0x1d] \|\|
1577	vs->modifiers_state[0x9d]);
1578	/* QEMU console emulation */
1579	if (down) {
1580	switch (keycode) {
1581	case 0x2a: /* Left Shift */
1582	case 0x36: /* Right Shift */
1583	case 0x1d: /* Left CTRL */
1584	case 0x9d: /* Right CTRL */
1585	case 0x38: /* Left ALT */
1586	case 0xb8: /* Right ALT */
1587	break;
1588	case 0xc8:
1589	kbd_put_keysym(QEMU_KEY_UP(('A') \| 0xe100));
1590	break;
1591	case 0xd0:
1592	kbd_put_keysym(QEMU_KEY_DOWN(('B') \| 0xe100));
1593	break;
1594	case 0xcb:
1595	kbd_put_keysym(QEMU_KEY_LEFT(('D') \| 0xe100));
1596	break;
1597	case 0xcd:
1598	kbd_put_keysym(QEMU_KEY_RIGHT(('C') \| 0xe100));
1599	break;
1600	case 0xd3:
1601	kbd_put_keysym(QEMU_KEY_DELETE((3) \| 0xe100));
1602	break;
1603	case 0xc7:
1604	kbd_put_keysym(QEMU_KEY_HOME((1) \| 0xe100));
1605	break;
1606	case 0xcf:
1607	kbd_put_keysym(QEMU_KEY_END((4) \| 0xe100));
1608	break;
1609	case 0xc9:
1610	kbd_put_keysym(QEMU_KEY_PAGEUP((5) \| 0xe100));
1611	break;
1612	case 0xd1:
1613	kbd_put_keysym(QEMU_KEY_PAGEDOWN((6) \| 0xe100));
1614	break;
1615
1616	case 0x47:
1617	kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME((1) \| 0xe100));
1618	break;
1619	case 0x48:
1620	kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP(('A') \| 0xe100));
1621	break;
1622	case 0x49:
1623	kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP((5) \| 0xe100));
1624	break;
1625	case 0x4b:
1626	kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT(('D') \| 0xe100));
1627	break;
1628	case 0x4c:
1629	kbd_put_keysym('5');
1630	break;
1631	case 0x4d:
1632	kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT(('C') \| 0xe100));
1633	break;
1634	case 0x4f:
1635	kbd_put_keysym(numlock ? '1' : QEMU_KEY_END((4) \| 0xe100));
1636	break;
1637	case 0x50:
1638	kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN(('B') \| 0xe100));
1639	break;
1640	case 0x51:
1641	kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN((6) \| 0xe100));
1642	break;
1643	case 0x52:
1644	kbd_put_keysym('0');
1645	break;
1646	case 0x53:
1647	kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE((3) \| 0xe100));
1648	break;
1649
1650	case 0xb5:
1651	kbd_put_keysym('/');
1652	break;
1653	case 0x37:
1654	kbd_put_keysym('*');
1655	break;
1656	case 0x4a:
1657	kbd_put_keysym('-');
1658	break;
1659	case 0x4e:
1660	kbd_put_keysym('+');
1661	break;
1662	case 0x9c:
1663	kbd_put_keysym('\n');
1664	break;
1665
1666	default:
1667	if (control) {
1668	kbd_put_keysym(sym & 0x1f);
1669	} else {
1670	kbd_put_keysym(sym);
1671	}
1672	break;
1673	}
1674	}
1675	}
1676	}
1677
1678	static void vnc_release_modifiers(VncState *vs)
1679	{
1680	static const int keycodes[] = {
1681	/* shift, control, alt keys, both left & right */
1682	0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1683	};
1684	int i, keycode;
1685
1686	if (!is_graphic_console()) {
1687	return;
1688	}
1689	for (i = 0; i < ARRAY_SIZE(keycodes)(sizeof(keycodes) / sizeof((keycodes)[0])); i++) {
1690	keycode = keycodes[i];
1691	if (!vs->modifiers_state[keycode]) {
1692	continue;
1693	}
1694	if (keycode & SCANCODE_GREY0x80) {
1695	kbd_put_keycode(SCANCODE_EMUL00xE0);
1696	}
1697	kbd_put_keycode(keycode \| SCANCODE_UP0x80);
1698	}
1699	}
1700
1701	static void key_event(VncState *vs, int down, uint32_t sym)
1702	{
1703	int keycode;
1704	int lsym = sym;
1705
1706	if (lsym >= 'A' && lsym <= 'Z' && is_graphic_console()) {
1707	lsym = lsym - 'A' + 'a';
1708	}
1709
1710	keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK0xff;
1711	do_key_event(vs, down, keycode, sym);
1712	}
1713
1714	static void ext_key_event(VncState *vs, int down,
1715	uint32_t sym, uint16_t keycode)
1716	{
1717	/* if the user specifies a keyboard layout, always use it */
1718	if (keyboard_layout)
1719	key_event(vs, down, sym);
1720	else
1721	do_key_event(vs, down, keycode, sym);
1722	}
1723
1724	static void framebuffer_update_request(VncState *vs, int incremental,
1725	int x_position, int y_position,
1726	int w, int h)
1727	{
1728	int i;
1729	const size_t width = ds_get_width(vs->ds) / 16;
1730
1731	if (y_position > ds_get_height(vs->ds))
1732	y_position = ds_get_height(vs->ds);
1733	if (y_position + h >= ds_get_height(vs->ds))
1734	h = ds_get_height(vs->ds) - y_position;
1735
1736	vs->need_update = 1;
1737	if (!incremental) {
1738	vs->force_update = 1;
1739	for (i = 0; i < h; i++) {
1740	bitmap_set(vs->dirty[y_position + i], 0, width);
1741	bitmap_clear(vs->dirty[y_position + i], width,
1742	VNC_DIRTY_BITS(2560 / 16) - width);
1743	}
1744	}
1745	}
1746
1747	static void send_ext_key_event_ack(VncState *vs)
1748	{
1749	vnc_lock_output(vs);
1750	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
1751	vnc_write_u8(vs, 0);
1752	vnc_write_u16(vs, 1);
1753	vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1754	VNC_ENCODING_EXT_KEY_EVENT0XFFFFFEFE);
1755	vnc_unlock_output(vs);
1756	vnc_flush(vs);
1757	}
1758
1759	static void send_ext_audio_ack(VncState *vs)
1760	{
1761	vnc_lock_output(vs);
1762	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
1763	vnc_write_u8(vs, 0);
1764	vnc_write_u16(vs, 1);
1765	vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1766	VNC_ENCODING_AUDIO0XFFFFFEFD);
1767	vnc_unlock_output(vs);
1768	vnc_flush(vs);
1769	}
1770
1771	static void set_encodings(VncState vs, int32_t encodings, size_t n_encodings)
1772	{
1773	int i;
1774	unsigned int enc = 0;
1775
1776	vs->features = 0;
1777	vs->vnc_encoding = 0;
1778	vs->tight.compression = 9;
1779	vs->tight.quality = -1; /* Lossless by default */
1780	vs->absolute = -1;
1781
1782	/*
1783	* Start from the end because the encodings are sent in order of preference.
1784	* This way the preferred encoding (first encoding defined in the array)
1785	* will be set at the end of the loop.
1786	*/
1787	for (i = n_encodings - 1; i >= 0; i--) {
1788	enc = encodings[i];
1789	switch (enc) {
1790	case VNC_ENCODING_RAW0x00000000:
1791	vs->vnc_encoding = enc;
1792	break;
1793	case VNC_ENCODING_COPYRECT0x00000001:
1794	vs->features \|= VNC_FEATURE_COPYRECT_MASK(1 << 6);
1795	break;
1796	case VNC_ENCODING_HEXTILE0x00000005:
1797	vs->features \|= VNC_FEATURE_HEXTILE_MASK(1 << 1);
1798	vs->vnc_encoding = enc;
1799	break;
1800	case VNC_ENCODING_TIGHT0x00000007:
1801	vs->features \|= VNC_FEATURE_TIGHT_MASK(1 << 4);
1802	vs->vnc_encoding = enc;
1803	break;
1804	case VNC_ENCODING_TIGHT_PNG0xFFFFFEFC:
1805	vs->features \|= VNC_FEATURE_TIGHT_PNG_MASK(1 << 8);
1806	vs->vnc_encoding = enc;
1807	break;
1808	case VNC_ENCODING_ZLIB0x00000006:
1809	vs->features \|= VNC_FEATURE_ZLIB_MASK(1 << 5);
1810	vs->vnc_encoding = enc;
1811	break;
1812	case VNC_ENCODING_ZRLE0x00000010:
1813	vs->features \|= VNC_FEATURE_ZRLE_MASK(1 << 9);
1814	vs->vnc_encoding = enc;
1815	break;
1816	case VNC_ENCODING_ZYWRLE0x00000011:
1817	vs->features \|= VNC_FEATURE_ZYWRLE_MASK(1 << 10);
1818	vs->vnc_encoding = enc;
1819	break;
1820	case VNC_ENCODING_DESKTOPRESIZE0xFFFFFF21:
1821	vs->features \|= VNC_FEATURE_RESIZE_MASK(1 << 0);
1822	break;
1823	case VNC_ENCODING_POINTER_TYPE_CHANGE0XFFFFFEFF:
1824	vs->features \|= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK(1 << 2);
1825	break;
1826	case VNC_ENCODING_RICH_CURSOR0xFFFFFF11:
1827	vs->features \|= VNC_FEATURE_RICH_CURSOR_MASK(1 << 7);
1828	break;
1829	case VNC_ENCODING_EXT_KEY_EVENT0XFFFFFEFE:
1830	send_ext_key_event_ack(vs);
1831	break;
1832	case VNC_ENCODING_AUDIO0XFFFFFEFD:
1833	send_ext_audio_ack(vs);
1834	break;
1835	case VNC_ENCODING_WMVi0x574D5669:
1836	vs->features \|= VNC_FEATURE_WMVI_MASK(1 << 3);
1837	break;
1838	case VNC_ENCODING_COMPRESSLEVEL00xFFFFFF00 ... VNC_ENCODING_COMPRESSLEVEL00xFFFFFF00 + 9:
1839	vs->tight.compression = (enc & 0x0F);
1840	break;
1841	case VNC_ENCODING_QUALITYLEVEL00xFFFFFFE0 ... VNC_ENCODING_QUALITYLEVEL00xFFFFFFE0 + 9:
1842	if (vs->vd->lossy) {
1843	vs->tight.quality = (enc & 0x0F);
1844	}
1845	break;
1846	default:
1847	VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc)do { } while (0);
1848	break;
1849	}
1850	}
1851	vnc_desktop_resize(vs);
1852	check_pointer_type_change(&vs->mouse_mode_notifier, NULL((void*)0));
1853	}
1854
1855	static void set_pixel_conversion(VncState *vs)
1856	{
1857	if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG0x01) ==
1858	(vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG0x01) &&
1859	!memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1860	vs->write_pixels = vnc_write_pixels_copy;
1861	vnc_hextile_set_pixel_conversion(vs, 0);
1862	} else {
1863	vs->write_pixels = vnc_write_pixels_generic;
1864	vnc_hextile_set_pixel_conversion(vs, 1);
1865	}
1866	}
1867
1868	static void set_pixel_format(VncState *vs,
1869	int bits_per_pixel, int depth,
1870	int big_endian_flag, int true_color_flag,
1871	int red_max, int green_max, int blue_max,
1872	int red_shift, int green_shift, int blue_shift)
1873	{
1874	if (!true_color_flag) {
1875	vnc_client_error(vs);
1876	return;
1877	}
1878
1879	vs->clientds = *(vs->vd->guest.ds);
1880	vs->clientds.pf.rmax = red_max;
1881	vs->clientds.pf.rbits = hweight_long(red_max);
1882	vs->clientds.pf.rshift = red_shift;
1883	vs->clientds.pf.rmask = red_max << red_shift;
1884	vs->clientds.pf.gmax = green_max;
1885	vs->clientds.pf.gbits = hweight_long(green_max);
1886	vs->clientds.pf.gshift = green_shift;
1887	vs->clientds.pf.gmask = green_max << green_shift;
1888	vs->clientds.pf.bmax = blue_max;
1889	vs->clientds.pf.bbits = hweight_long(blue_max);
1890	vs->clientds.pf.bshift = blue_shift;
1891	vs->clientds.pf.bmask = blue_max << blue_shift;
1892	vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1893	vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1894	vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1895	vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG0x01 : 0x00;
1896
1897	set_pixel_conversion(vs);
1898
1899	vga_hw_invalidate();
1900	vga_hw_update();
1901	}
1902
1903	static void pixel_format_message (VncState *vs) {
1904	char pad[3] = { 0, 0, 0 };
1905
1906	vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1907	vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1908
1909	#ifdef HOST_WORDS_BIGENDIAN
1910	vnc_write_u8(vs, 1); /* big-endian-flag */
1911	#else
1912	vnc_write_u8(vs, 0); /* big-endian-flag */
1913	#endif
1914	vnc_write_u8(vs, 1); /* true-color-flag */
1915	vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1916	vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1917	vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1918	vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1919	vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1920	vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1921
1922	vnc_hextile_set_pixel_conversion(vs, 0);
1923
1924	vs->clientds = *(vs->ds->surface);
1925	vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG0x02;
1926	vs->write_pixels = vnc_write_pixels_copy;
1927
1928	vnc_write(vs, pad, 3); /* padding */
1929	}
1930
1931	static void vnc_dpy_setdata(DisplayState *ds)
1932	{
1933	VncDisplay *vd = ds->opaque;
1934
1935	(vd->guest.ds) = (ds->surface);
1936	vnc_dpy_update(ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
1937	}
1938
1939	static void vnc_colordepth(VncState *vs)
1940	{
1941	if (vnc_has_feature(vs, VNC_FEATURE_WMVI3)) {
1942	/* Sending a WMVi message to notify the client*/
1943	vnc_lock_output(vs);
1944	vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE0);
1945	vnc_write_u8(vs, 0);
1946	vnc_write_u16(vs, 1); /* number of rects */
1947	vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1948	ds_get_height(vs->ds), VNC_ENCODING_WMVi0x574D5669);
1949	pixel_format_message(vs);
1950	vnc_unlock_output(vs);
1951	vnc_flush(vs);
1952	} else {
1953	set_pixel_conversion(vs);
1954	}
1955	}
1956
1957	static int protocol_client_msg(VncState vs, uint8_t data, size_t len)
1958	{
1959	int i;
1960	uint16_t limit;
1961	VncDisplay *vd = vs->vd;
1962
1963	if (data[0] > 3) {
1964	vd->timer_interval = VNC_REFRESH_INTERVAL_BASE30;
1965	if (!qemu_timer_expired(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval))
1966	qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
1967	}
1968
1969	switch (data[0]) {
1970	case VNC_MSG_CLIENT_SET_PIXEL_FORMAT0:
1971	if (len == 1)
1972	return 20;
1973
1974	set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1975	read_u8(data, 6), read_u8(data, 7),
1976	read_u16(data, 8), read_u16(data, 10),
1977	read_u16(data, 12), read_u8(data, 14),
1978	read_u8(data, 15), read_u8(data, 16));
1979	break;
1980	case VNC_MSG_CLIENT_SET_ENCODINGS2:
1981	if (len == 1)
1982	return 4;
1983
1984	if (len == 4) {
1985	limit = read_u16(data, 2);
1986	if (limit > 0)
1987	return 4 + (limit * 4);
1988	} else
1989	limit = read_u16(data, 2);
1990
1991	for (i = 0; i < limit; i++) {
1992	int32_t val = read_s32(data, 4 + (i * 4));
1993	memcpy(data + 4 + (i * 4), &val, sizeof(val));
1994	}
1995
1996	set_encodings(vs, (int32_t *)(data + 4), limit);
1997	break;
1998	case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST3:
1999	if (len == 1)
2000	return 10;
2001
2002	framebuffer_update_request(vs,
2003	read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2004	read_u16(data, 6), read_u16(data, 8));
2005	break;
2006	case VNC_MSG_CLIENT_KEY_EVENT4:
2007	if (len == 1)
2008	return 8;
2009
2010	key_event(vs, read_u8(data, 1), read_u32(data, 4));
2011	break;
2012	case VNC_MSG_CLIENT_POINTER_EVENT5:
2013	if (len == 1)
2014	return 6;
2015
2016	pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2017	break;
2018	case VNC_MSG_CLIENT_CUT_TEXT6:
2019	if (len == 1)
2020	return 8;
2021
2022	if (len == 8) {
2023	uint32_t dlen = read_u32(data, 4);
2024	if (dlen > 0)
2025	return 8 + dlen;
2026	}
2027
2028	client_cut_text(vs, read_u32(data, 4), data + 8);
2029	break;
2030	case VNC_MSG_CLIENT_QEMU255:
2031	if (len == 1)
2032	return 2;
2033
2034	switch (read_u8(data, 1)) {
2035	case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT0:
2036	if (len == 2)
2037	return 12;
2038
2039	ext_key_event(vs, read_u16(data, 2),
2040	read_u32(data, 4), read_u32(data, 8));
2041	break;
2042	case VNC_MSG_CLIENT_QEMU_AUDIO1:
2043	if (len == 2)
2044	return 4;
2045
2046	switch (read_u16 (data, 2)) {
2047	case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE0:
2048	audio_add(vs);
2049	break;
2050	case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE1:
2051	audio_del(vs);
2052	break;
2053	case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT2:
2054	if (len == 4)
2055	return 10;
2056	switch (read_u8(data, 4)) {
2057	case 0: vs->as.fmt = AUD_FMT_U8; break;
2058	case 1: vs->as.fmt = AUD_FMT_S8; break;
2059	case 2: vs->as.fmt = AUD_FMT_U16; break;
2060	case 3: vs->as.fmt = AUD_FMT_S16; break;
2061	case 4: vs->as.fmt = AUD_FMT_U32; break;
2062	case 5: vs->as.fmt = AUD_FMT_S32; break;
2063	default:
2064	printf("Invalid audio format %d\n", read_u8(data, 4));
2065	vnc_client_error(vs);
2066	break;
2067	}
2068	vs->as.nchannels = read_u8(data, 5);
2069	if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2070	printf("Invalid audio channel coount %d\n",
2071	read_u8(data, 5));
2072	vnc_client_error(vs);
2073	break;
2074	}
2075	vs->as.freq = read_u32(data, 6);
2076	break;
2077	default:
2078	printf ("Invalid audio message %d\n", read_u8(data, 4));
2079	vnc_client_error(vs);
2080	break;
2081	}
2082	break;
2083
2084	default:
2085	printf("Msg: %d\n", read_u16(data, 0));
2086	vnc_client_error(vs);
2087	break;
2088	}
2089	break;
2090	default:
2091	printf("Msg: %d\n", data[0]);
2092	vnc_client_error(vs);
2093	break;
2094	}
2095
2096	vnc_read_when(vs, protocol_client_msg, 1);
2097	return 0;
2098	}
2099
2100	static int protocol_client_init(VncState vs, uint8_t data, size_t len)
2101	{
2102	char buf[1024];
2103	VncShareMode mode;
2104	int size;
2105
2106	mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2107	switch (vs->vd->share_policy) {
2108	case VNC_SHARE_POLICY_IGNORE:
2109	/*
2110	* Ignore the shared flag. Nothing to do here.
2111	*
2112	* Doesn't conform to the rfb spec but is traditional qemu
2113	* behavior, thus left here as option for compatibility
2114	* reasons.
2115	*/
2116	break;
2117	case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2118	/*
2119	* Policy: Allow clients ask for exclusive access.
2120	*
2121	* Implementation: When a client asks for exclusive access,
2122	* disconnect all others. Shared connects are allowed as long
2123	* as no exclusive connection exists.
2124	*
2125	* This is how the rfb spec suggests to handle the shared flag.
2126	*/
2127	if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2128	VncState *client;
2129	QTAILQ_FOREACH(client, &vs->vd->clients, next)for ((client) = ((&vs->vd->clients)->tqh_first); (client); (client) = ((client)->next.tqe_next)) {
2130	if (vs == client) {
2131	continue;
2132	}
2133	if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2134	client->share_mode != VNC_SHARE_MODE_SHARED) {
2135	continue;
2136	}
2137	vnc_disconnect_start(client);
2138	}
2139	}
2140	if (mode == VNC_SHARE_MODE_SHARED) {
2141	if (vs->vd->num_exclusive > 0) {
2142	vnc_disconnect_start(vs);
2143	return 0;
2144	}
2145	}
2146	break;
2147	case VNC_SHARE_POLICY_FORCE_SHARED:
2148	/*
2149	* Policy: Shared connects only.
2150	* Implementation: Disallow clients asking for exclusive access.
2151	*
2152	* Useful for shared desktop sessions where you don't want
2153	* someone forgetting to say -shared when running the vnc
2154	* client disconnect everybody else.
2155	*/
2156	if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2157	vnc_disconnect_start(vs);
2158	return 0;
2159	}
2160	break;
2161	}
2162	vnc_set_share_mode(vs, mode);
2163
2164	vs->client_width = ds_get_width(vs->ds);
2165	vs->client_height = ds_get_height(vs->ds);
2166	vnc_write_u16(vs, vs->client_width);
2167	vnc_write_u16(vs, vs->client_height);
2168
2169	pixel_format_message(vs);
2170
2171	if (qemu_name)
2172	size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2173	else
2174	size = snprintf(buf, sizeof(buf), "QEMU");
2175
2176	vnc_write_u32(vs, size);
2177	vnc_write(vs, buf, size);
2178	vnc_flush(vs);
2179
2180	vnc_client_cache_auth(vs);
2181	vnc_qmp_event(vs, QEVENT_VNC_INITIALIZED);
2182
2183	vnc_read_when(vs, protocol_client_msg, 1);
2184
2185	return 0;
2186	}
2187
2188	void start_client_init(VncState *vs)
2189	{
2190	vnc_read_when(vs, protocol_client_init, 1);
2191	}
2192
2193	static void make_challenge(VncState *vs)
2194	{
2195	int i;
2196
2197	srand(time(NULL((void)0))+getpid()+getpid()987654+rand());
2198
2199	for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2200	vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX2147483647+1.0));
2201	}
2202
2203	static int protocol_client_auth_vnc(VncState vs, uint8_t data, size_t len)
2204	{
2205	unsigned char response[VNC_AUTH_CHALLENGE_SIZE16];
2206	int i, j, pwlen;
2207	unsigned char key[8];
2208	time_t now = time(NULL((void*)0));
2209
2210	if (!vs->vd->password) {
2211	VNC_DEBUG("No password configured on server")do { } while (0);
2212	goto reject;
2213	}
2214	if (vs->vd->expires < now) {
2215	VNC_DEBUG("Password is expired")do { } while (0);
2216	goto reject;
2217	}
2218
2219	memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE16);
2220
2221	/* Calculate the expected challenge response */
2222	pwlen = strlen(vs->vd->password);
2223	for (i=0; i<sizeof(key); i++)
2224	key[i] = i<pwlen ? vs->vd->password[i] : 0;
2225	deskey(key, EN00);
2226	for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE16; j += 8)
2227	des(response+j, response+j);
2228
2229	/* Compare expected vs actual challenge response */
2230	if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE16) != 0) {
2231	VNC_DEBUG("Client challenge response did not match\n")do { } while (0);
2232	goto reject;
2233	} else {
2234	VNC_DEBUG("Accepting VNC challenge response\n")do { } while (0);
2235	vnc_write_u32(vs, 0); /* Accept auth */
2236	vnc_flush(vs);
2237
2238	start_client_init(vs);
2239	}
2240	return 0;
2241
2242	reject:
2243	vnc_write_u32(vs, 1); /* Reject auth */
2244	if (vs->minor >= 8) {
2245	static const char err[] = "Authentication failed";
2246	vnc_write_u32(vs, sizeof(err));
2247	vnc_write(vs, err, sizeof(err));
2248	}
2249	vnc_flush(vs);
2250	vnc_client_error(vs);
2251	return 0;
2252	}
2253
2254	void start_auth_vnc(VncState *vs)
2255	{
2256	make_challenge(vs);
2257	/* Send client a 'random' challenge */
2258	vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2259	vnc_flush(vs);
2260
2261	vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2262	}
2263
2264
2265	static int protocol_client_auth(VncState vs, uint8_t data, size_t len)
2266	{
2267	/* We only advertise 1 auth scheme at a time, so client
2268	* must pick the one we sent. Verify this */
2269	if (data[0] != vs->auth) { /* Reject auth */
2270	VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0])do { } while (0);
2271	vnc_write_u32(vs, 1);
2272	if (vs->minor >= 8) {
2273	static const char err[] = "Authentication failed";
2274	vnc_write_u32(vs, sizeof(err));
2275	vnc_write(vs, err, sizeof(err));
2276	}
2277	vnc_client_error(vs);
2278	} else { /* Accept requested auth */
2279	VNC_DEBUG("Client requested auth %d\n", (int)data[0])do { } while (0);
2280	switch (vs->auth) {
2281	case VNC_AUTH_NONE:
2282	VNC_DEBUG("Accept auth none\n")do { } while (0);
2283	if (vs->minor >= 8) {
2284	vnc_write_u32(vs, 0); /* Accept auth completion */
2285	vnc_flush(vs);
2286	}
2287	start_client_init(vs);
2288	break;
2289
2290	case VNC_AUTH_VNC:
2291	VNC_DEBUG("Start VNC auth\n")do { } while (0);
2292	start_auth_vnc(vs);
2293	break;
2294
2295	#ifdef CONFIG_VNC_TLS1
2296	case VNC_AUTH_VENCRYPT:
2297	VNC_DEBUG("Accept VeNCrypt auth\n")do { } while (0);
2298	start_auth_vencrypt(vs);
2299	break;
2300	#endif /* CONFIG_VNC_TLS */
2301
2302	#ifdef CONFIG_VNC_SASL1
2303	case VNC_AUTH_SASL:
2304	VNC_DEBUG("Accept SASL auth\n")do { } while (0);
2305	start_auth_sasl(vs);
2306	break;
2307	#endif /* CONFIG_VNC_SASL */
2308
2309	default: /* Should not be possible, but just in case */
2310	VNC_DEBUG("Reject auth %d server code bug\n", vs->auth)do { } while (0);
2311	vnc_write_u8(vs, 1);
2312	if (vs->minor >= 8) {
2313	static const char err[] = "Authentication failed";
2314	vnc_write_u32(vs, sizeof(err));
2315	vnc_write(vs, err, sizeof(err));
2316	}
2317	vnc_client_error(vs);
2318	}
2319	}
2320	return 0;
2321	}
2322
2323	static int protocol_version(VncState vs, uint8_t version, size_t len)
2324	{
2325	char local[13];
2326
2327	memcpy(local, version, 12);
2328	local[12] = 0;
2329
2330	if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2331	VNC_DEBUG("Malformed protocol version %s\n", local)do { } while (0);
2332	vnc_client_error(vs);
2333	return 0;
2334	}
2335	VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor)do { } while (0);
2336	if (vs->major != 3 \|\|
2337	(vs->minor != 3 &&
2338	vs->minor != 4 &&
2339	vs->minor != 5 &&
2340	vs->minor != 7 &&
2341	vs->minor != 8)) {
2342	VNC_DEBUG("Unsupported client version\n")do { } while (0);
2343	vnc_write_u32(vs, VNC_AUTH_INVALID);
2344	vnc_flush(vs);
2345	vnc_client_error(vs);
2346	return 0;
2347	}
2348	/* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2349	* as equivalent to v3.3 by servers
2350	*/
2351	if (vs->minor == 4 \|\| vs->minor == 5)
2352	vs->minor = 3;
2353
2354	if (vs->minor == 3) {
2355	if (vs->auth == VNC_AUTH_NONE) {
2356	VNC_DEBUG("Tell client auth none\n")do { } while (0);
2357	vnc_write_u32(vs, vs->auth);
2358	vnc_flush(vs);
2359	start_client_init(vs);
2360	} else if (vs->auth == VNC_AUTH_VNC) {
2361	VNC_DEBUG("Tell client VNC auth\n")do { } while (0);
2362	vnc_write_u32(vs, vs->auth);
2363	vnc_flush(vs);
2364	start_auth_vnc(vs);
2365	} else {
2366	VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth)do { } while (0);
2367	vnc_write_u32(vs, VNC_AUTH_INVALID);
2368	vnc_flush(vs);
2369	vnc_client_error(vs);
2370	}
2371	} else {
2372	VNC_DEBUG("Telling client we support auth %d\n", vs->auth)do { } while (0);
2373	vnc_write_u8(vs, 1); /* num auth */
2374	vnc_write_u8(vs, vs->auth);
2375	vnc_read_when(vs, protocol_client_auth, 1);
2376	vnc_flush(vs);
2377	}
2378
2379	return 0;
2380	}
2381
2382	static VncRectStat vnc_stat_rect(VncDisplay vd, int x, int y)
2383	{
2384	struct VncSurface *vs = &vd->guest;
2385
2386	return &vs->stats[y / VNC_STAT_RECT64][x / VNC_STAT_RECT64];
2387	}
2388
2389	void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2390	{
2391	int i, j;
2392
2393	w = (x + w) / VNC_STAT_RECT64;
2394	h = (y + h) / VNC_STAT_RECT64;
2395	x /= VNC_STAT_RECT64;
2396	y /= VNC_STAT_RECT64;
2397
2398	for (j = y; j <= h; j++) {
2399	for (i = x; i <= w; i++) {
2400	vs->lossy_rect[j][i] = 1;
2401	}
2402	}
2403	}
2404
2405	static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2406	{
2407	VncState *vs;
2408	int sty = y / VNC_STAT_RECT64;
2409	int stx = x / VNC_STAT_RECT64;
2410	int has_dirty = 0;
2411
2412	y = y / VNC_STAT_RECT64 * VNC_STAT_RECT64;
2413	x = x / VNC_STAT_RECT64 * VNC_STAT_RECT64;
2414
2415	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
2416	int j;
2417
2418	/* kernel send buffers are full -> refresh later */
2419	if (vs->output.offset) {
2420	continue;
2421	}
2422
2423	if (!vs->lossy_rect[sty][stx]) {
2424	continue;
2425	}
2426
2427	vs->lossy_rect[sty][stx] = 0;
2428	for (j = 0; j < VNC_STAT_RECT64; ++j) {
2429	bitmap_set(vs->dirty[y + j], x / 16, VNC_STAT_RECT64 / 16);
2430	}
2431	has_dirty++;
2432	}
2433
2434	return has_dirty;
2435	}
2436
2437	static int vnc_update_stats(VncDisplay vd, struct timeval tv)
2438	{
2439	int x, y;
2440	struct timeval res;
2441	int has_dirty = 0;
2442
2443	for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT64) {
2444	for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT64) {
2445	VncRectStat *rect = vnc_stat_rect(vd, x, y);
2446
2447	rect->updated = false0;
2448	}
2449	}
2450
2451	qemu_timersub(tv, &VNC_REFRESH_STATS, &res)do { (&res)->tv_sec = (tv)->tv_sec - (&VNC_REFRESH_STATS )->tv_sec; (&res)->tv_usec = (tv)->tv_usec - (& VNC_REFRESH_STATS)->tv_usec; if ((&res)->tv_usec < 0) { --(&res)->tv_sec; (&res)->tv_usec += 1000000 ; } } while (0);
2452
2453	if (timercmp(&vd->guest.last_freq_check, &res, >)(((&vd->guest.last_freq_check)->tv_sec == (&res )->tv_sec) ? ((&vd->guest.last_freq_check)->tv_usec > (&res)->tv_usec) : ((&vd->guest.last_freq_check )->tv_sec > (&res)->tv_sec))) {
2454	return has_dirty;
2455	}
2456	vd->guest.last_freq_check = *tv;
2457
2458	for (y = 0; y < vd->guest.ds->height; y += VNC_STAT_RECT64) {
2459	for (x = 0; x < vd->guest.ds->width; x += VNC_STAT_RECT64) {
2460	VncRectStat *rect= vnc_stat_rect(vd, x, y);
2461	int count = ARRAY_SIZE(rect->times)(sizeof(rect->times) / sizeof((rect->times)[0]));
2462	struct timeval min, max;
2463
2464	if (!timerisset(&rect->times[count - 1])((&rect->times[count - 1])->tv_sec \|\| (&rect-> times[count - 1])->tv_usec)) {
2465	continue ;
2466	}
2467
2468	max = rect->times[(rect->idx + count - 1) % count];
2469	qemu_timersub(tv, &max, &res)do { (&res)->tv_sec = (tv)->tv_sec - (&max)-> tv_sec; (&res)->tv_usec = (tv)->tv_usec - (&max )->tv_usec; if ((&res)->tv_usec < 0) { --(&res )->tv_sec; (&res)->tv_usec += 1000000; } } while (0 );
2470
2471	if (timercmp(&res, &VNC_REFRESH_LOSSY, >)(((&res)->tv_sec == (&VNC_REFRESH_LOSSY)->tv_sec ) ? ((&res)->tv_usec > (&VNC_REFRESH_LOSSY)-> tv_usec) : ((&res)->tv_sec > (&VNC_REFRESH_LOSSY )->tv_sec))) {
2472	rect->freq = 0;
2473	has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2474	memset(rect->times, 0, sizeof (rect->times));
2475	continue ;
2476	}
2477
2478	min = rect->times[rect->idx];
2479	max = rect->times[(rect->idx + count - 1) % count];
2480	qemu_timersub(&max, &min, &res)do { (&res)->tv_sec = (&max)->tv_sec - (&min )->tv_sec; (&res)->tv_usec = (&max)->tv_usec - (&min)->tv_usec; if ((&res)->tv_usec < 0) { --(&res)->tv_sec; (&res)->tv_usec += 1000000 ; } } while (0);
2481
2482	rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2483	rect->freq /= count;
2484	rect->freq = 1. / rect->freq;
2485	}
2486	}
2487	return has_dirty;
2488	}
2489
2490	double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2491	{
2492	int i, j;
2493	double total = 0;
2494	int num = 0;
2495
2496	x = (x / VNC_STAT_RECT64) * VNC_STAT_RECT64;
2497	y = (y / VNC_STAT_RECT64) * VNC_STAT_RECT64;
2498
2499	for (j = y; j <= y + h; j += VNC_STAT_RECT64) {
2500	for (i = x; i <= x + w; i += VNC_STAT_RECT64) {
2501	total += vnc_stat_rect(vs->vd, i, j)->freq;
2502	num++;
2503	}
2504	}
2505
2506	if (num) {
2507	return total / num;
2508	} else {
2509	return 0;
2510	}
2511	}
2512
2513	static void vnc_rect_updated(VncDisplay vd, int x, int y, struct timeval tv)
2514	{
2515	VncRectStat *rect;
2516
2517	rect = vnc_stat_rect(vd, x, y);
2518	if (rect->updated) {
2519	return ;
2520	}
2521	rect->times[rect->idx] = *tv;
2522	rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times)(sizeof(rect->times) / sizeof((rect->times)[0]));
2523	rect->updated = true1;
2524	}
2525
2526	static int vnc_refresh_server_surface(VncDisplay *vd)
2527	{
2528	int y;
2529	uint8_t *guest_row;
2530	uint8_t *server_row;
2531	int cmp_bytes;
2532	VncState *vs;
2533	int has_dirty = 0;
2534
2535	struct timeval tv = { 0, 0 };
2536
2537	if (!vd->non_adaptive) {
2538	gettimeofday(&tv, NULL((void*)0));
2539	has_dirty = vnc_update_stats(vd, &tv);
2540	}
2541
2542	/*
2543	* Walk through the guest dirty map.
2544	* Check and copy modified bits from guest to server surface.
2545	* Update server dirty map.
2546	*/
2547	cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2548	if (cmp_bytes > ds_get_linesize(vd->ds)) {
2549	cmp_bytes = ds_get_linesize(vd->ds);
2550	}
2551	guest_row = vd->guest.ds->data;
2552	server_row = vd->server->data;
2553	for (y = 0; y < vd->guest.ds->height; y++) {
2554	if (!bitmap_empty(vd->guest.dirty[y], VNC_DIRTY_BITS(2560 / 16))) {
2555	int x;
2556	uint8_t *guest_ptr;
2557	uint8_t *server_ptr;
2558
2559	guest_ptr = guest_row;
2560	server_ptr = server_row;
2561
2562	for (x = 0; x + 15 < vd->guest.ds->width;
2563	x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2564	if (!test_and_clear_bit((x / 16), vd->guest.dirty[y]))
2565	continue;
2566	assert(server_ptr - vd->server->data + cmp_bytes <=((server_ptr - vd->server->data + cmp_bytes <= vd-> ds->surface->linesize * vd->ds->surface->height ) ? (void) (0) : __assert_fail ("server_ptr - vd->server->data + cmp_bytes <= vd->ds->surface->linesize * vd->ds->surface->height" , "/home/stefan/src/qemu/qemu.org/qemu/ui/vnc.c", 2567, __PRETTY_FUNCTION__ ))
2567	vd->ds->surface->linesize * vd->ds->surface->height)((server_ptr - vd->server->data + cmp_bytes <= vd-> ds->surface->linesize * vd->ds->surface->height ) ? (void) (0) : __assert_fail ("server_ptr - vd->server->data + cmp_bytes <= vd->ds->surface->linesize * vd->ds->surface->height" , "/home/stefan/src/qemu/qemu.org/qemu/ui/vnc.c", 2567, __PRETTY_FUNCTION__ ));
2568	assert(guest_ptr - vd->guest.ds->data + cmp_bytes <=((guest_ptr - vd->guest.ds->data + cmp_bytes <= vd-> ds->surface->linesize * vd->ds->surface->height ) ? (void) (0) : __assert_fail ("guest_ptr - vd->guest.ds->data + cmp_bytes <= vd->ds->surface->linesize * vd->ds->surface->height" , "/home/stefan/src/qemu/qemu.org/qemu/ui/vnc.c", 2569, __PRETTY_FUNCTION__ ))
2569	vd->ds->surface->linesize * vd->ds->surface->height)((guest_ptr - vd->guest.ds->data + cmp_bytes <= vd-> ds->surface->linesize * vd->ds->surface->height ) ? (void) (0) : __assert_fail ("guest_ptr - vd->guest.ds->data + cmp_bytes <= vd->ds->surface->linesize * vd->ds->surface->height" , "/home/stefan/src/qemu/qemu.org/qemu/ui/vnc.c", 2569, __PRETTY_FUNCTION__ ));
2570	if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2571	continue;
2572	memcpy(server_ptr, guest_ptr, cmp_bytes);
2573	if (!vd->non_adaptive)
2574	vnc_rect_updated(vd, x, y, &tv);
2575	QTAILQ_FOREACH(vs, &vd->clients, next)for ((vs) = ((&vd->clients)->tqh_first); (vs); (vs) = ((vs)->next.tqe_next)) {
2576	set_bit((x / 16), vs->dirty[y]);
2577	}
2578	has_dirty++;
2579	}
2580	}
2581	guest_row += ds_get_linesize(vd->ds);
2582	server_row += ds_get_linesize(vd->ds);
2583	}
2584	return has_dirty;
2585	}
2586
2587	static void vnc_refresh(void *opaque)
2588	{
2589	VncDisplay *vd = opaque;
2590	VncState vs, vn;
2591	int has_dirty, rects = 0;
2592
2593	vga_hw_update();
2594
2595	if (vnc_trylock_display(vd)) {
2596	vd->timer_interval = VNC_REFRESH_INTERVAL_BASE30;
2597	qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) +
2598	vd->timer_interval);
2599	return;
2600	}
2601
2602	has_dirty = vnc_refresh_server_surface(vd);
2603	vnc_unlock_display(vd);
2604
2605	QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn)for ((vs) = ((&vd->clients)->tqh_first); (vs) && ((vn) = ((vs)->next.tqe_next), 1); (vs) = (vn)) {
2606	rects += vnc_update_client(vs, has_dirty);
2607	/* vs might be free()ed here */
2608	}
2609
2610	/* vd->timer could be NULL now if the last client disconnected,
2611	* in this case don't update the timer */
2612	if (vd->timer == NULL((void*)0))
2613	return;
2614
2615	if (has_dirty && rects) {
2616	vd->timer_interval /= 2;
2617	if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE30)
2618	vd->timer_interval = VNC_REFRESH_INTERVAL_BASE30;
2619	} else {
2620	vd->timer_interval += VNC_REFRESH_INTERVAL_INC50;
2621	if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX2000)
2622	vd->timer_interval = VNC_REFRESH_INTERVAL_MAX2000;
2623	}
2624	qemu_mod_timer(vd->timer, qemu_get_clock_ms(rt_clock) + vd->timer_interval);
2625	}
2626
2627	static void vnc_init_timer(VncDisplay *vd)
2628	{
2629	vd->timer_interval = VNC_REFRESH_INTERVAL_BASE30;
2630	if (vd->timer == NULL((void)0) && !QTAILQ_EMPTY(&vd->clients)((&vd->clients)->tqh_first == ((void)0))) {
2631	vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
2632	vnc_dpy_resize(vd->ds);
2633	vnc_refresh(vd);
2634	}
2635	}
2636
2637	static void vnc_remove_timer(VncDisplay *vd)
2638	{
2639	if (vd->timer != NULL((void)0) && QTAILQ_EMPTY(&vd->clients)((&vd->clients)->tqh_first == ((void)0))) {
2640	qemu_del_timer(vd->timer);
2641	qemu_free_timer(vd->timer);
2642	vd->timer = NULL((void*)0);
2643	}
2644	}
2645
2646	static void vnc_connect(VncDisplay *vd, int csock, int skipauth)
2647	{
2648	VncState *vs = g_malloc0(sizeof(VncState));
2649	int i;
2650
2651	vs->csock = csock;
2652
2653	if (skipauth) {
2654	vs->auth = VNC_AUTH_NONE;
2655	#ifdef CONFIG_VNC_TLS1
2656	vs->subauth = VNC_AUTH_INVALID;
2657	#endif
2658	} else {
2659	vs->auth = vd->auth;
2660	#ifdef CONFIG_VNC_TLS1
2661	vs->subauth = vd->subauth;
2662	#endif
2663	}
2664
2665	vs->lossy_rect = g_malloc0(VNC_STAT_ROWS(2048 / 64) * sizeof (*vs->lossy_rect));
2666	for (i = 0; i < VNC_STAT_ROWS(2048 / 64); ++i) {
2667	vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS(2560 / 64) * sizeof (uint8_t));
2668	}
2669
2670	VNC_DEBUG("New client on socket %d\n", csock)do { } while (0);
2671	dcl->idle = 0;
2672	socket_set_nonblock(vs->csock);
2673	qemu_set_fd_handler2(vs->csock, NULL((void)0), vnc_client_read, NULL((void)0), vs);
2674
2675	vnc_client_cache_addr(vs);
2676	vnc_qmp_event(vs, QEVENT_VNC_CONNECTED);
2677	vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
2678
2679	vs->vd = vd;
2680	vs->ds = vd->ds;
2681	vs->last_x = -1;
2682	vs->last_y = -1;
2683
2684	vs->as.freq = 44100;
2685	vs->as.nchannels = 2;
2686	vs->as.fmt = AUD_FMT_S16;
2687	vs->as.endianness = 0;
2688
2689	qemu_mutex_init(&vs->output_mutex);
2690	vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
2691
2692	QTAILQ_INSERT_HEAD(&vd->clients, vs, next)do { if (((vs)->next.tqe_next = (&vd->clients)-> tqh_first) != ((void*)0)) (&vd->clients)->tqh_first ->next.tqe_prev = &(vs)->next.tqe_next; else (& vd->clients)->tqh_last = &(vs)->next.tqe_next; ( &vd->clients)->tqh_first = (vs); (vs)->next.tqe_prev = &(&vd->clients)->tqh_first; } while ( 0);
2693
2694	vga_hw_update();
2695
2696	vnc_write(vs, "RFB 003.008\n", 12);
2697	vnc_flush(vs);
2698	vnc_read_when(vs, protocol_version, 12);
2699	reset_keys(vs);
2700	if (vs->vd->lock_key_sync)
2701	vs->led = qemu_add_led_event_handler(kbd_leds, vs);
2702
2703	vs->mouse_mode_notifier.notify = check_pointer_type_change;
2704	qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
2705
2706	vnc_init_timer(vd);
2707
2708	/* vs might be free()ed here */
2709	}
2710
2711	static void vnc_listen_read(void *opaque)
2712	{
2713	VncDisplay *vs = opaque;
2714	struct sockaddr_in addr;
2715	socklen_t addrlen = sizeof(addr);
2716
2717	/* Catch-up */
2718	vga_hw_update();
2719
2720	int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2721	if (csock != -1) {
2722	vnc_connect(vs, csock, 0);
2723	}
2724	}
2725
2726	void vnc_display_init(DisplayState *ds)
2727	{
2728	VncDisplay vs = g_malloc0(sizeof(vs));
2729
2730	dcl = g_malloc0(sizeof(DisplayChangeListener));
2731
2732	ds->opaque = vs;
2733	dcl->idle = 1;
2734	vnc_display = vs;
2735
2736	vs->lsock = -1;
2737
2738	vs->ds = ds;
2739	QTAILQ_INIT(&vs->clients)do { (&vs->clients)->tqh_first = ((void*)0); (& vs->clients)->tqh_last = &(&vs->clients)-> tqh_first; } while ( 0);
2740	vs->expires = TIME_MAX9223372036854775807L;
2741
2742	if (keyboard_layout)
2743	vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2744	else
2745	vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2746
2747	if (!vs->kbd_layout)
2748	exit(1);
2749
2750	qemu_mutex_init(&vs->mutex);
2751	vnc_start_worker_thread();
2752
2753	dcl->dpy_copy = vnc_dpy_copy;
2754	dcl->dpy_update = vnc_dpy_update;
2755	dcl->dpy_resize = vnc_dpy_resize;
2756	dcl->dpy_setdata = vnc_dpy_setdata;
2757	register_displaychangelistener(ds, dcl);
2758	ds->mouse_set = vnc_mouse_set;
2759	ds->cursor_define = vnc_dpy_cursor_define;
2760	}
2761
2762
2763	void vnc_display_close(DisplayState *ds)
2764	{
2765	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2766
2767	if (!vs)
2768	return;
2769	if (vs->display) {
2770	g_free(vs->display);
2771	vs->display = NULL((void*)0);
2772	}
2773	if (vs->lsock != -1) {
2774	qemu_set_fd_handler2(vs->lsock, NULL((void)0), NULL((void)0), NULL((void)0), NULL((void)0));
2775	close(vs->lsock);
2776	vs->lsock = -1;
2777	}
2778	vs->auth = VNC_AUTH_INVALID;
2779	#ifdef CONFIG_VNC_TLS1
2780	vs->subauth = VNC_AUTH_INVALID;
2781	vs->tls.x509verify = 0;
2782	#endif
2783	}
2784
2785	int vnc_display_disable_login(DisplayState *ds)
2786	{
2787	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2788
2789	if (!vs) {
2790	return -1;
2791	}
2792
2793	if (vs->password) {
2794	g_free(vs->password);
2795	}
2796
2797	vs->password = NULL((void*)0);
2798	if (vs->auth == VNC_AUTH_NONE) {
2799	vs->auth = VNC_AUTH_VNC;
2800	}
2801
2802	return 0;
2803	}
2804
2805	int vnc_display_password(DisplayState ds, const char password)
2806	{
2807	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2808
2809	if (!vs) {
2810	return -EINVAL22;
2811	}
2812
2813	if (!password) {
2814	/* This is not the intention of this interface but err on the side
2815	of being safe */
2816	return vnc_display_disable_login(ds);
2817	}
2818
2819	if (vs->password) {
2820	g_free(vs->password);
2821	vs->password = NULL((void*)0);
2822	}
2823	vs->password = g_strdup(password);
2824	if (vs->auth == VNC_AUTH_NONE) {
2825	vs->auth = VNC_AUTH_VNC;
2826	}
2827
2828	return 0;
2829	}
2830
2831	int vnc_display_pw_expire(DisplayState *ds, time_t expires)
2832	{
2833	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2834
2835	if (!vs) {
2836	return -EINVAL22;
2837	}
2838
2839	vs->expires = expires;
2840	return 0;
2841	}
2842
2843	char vnc_display_local_addr(DisplayState ds)
2844	{
2845	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2846
2847	return vnc_socket_local_addr("%s:%s", vs->lsock);
2848	}
2849
2850	int vnc_display_open(DisplayState ds, const char display)
2851	{
2852	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
2853	const char *options;
2854	int password = 0;
2855	int reverse = 0;
2856	#ifdef CONFIG_VNC_TLS1
2857	int tls = 0, x509 = 0;
2858	#endif
2859	#ifdef CONFIG_VNC_SASL1
2860	int sasl = 0;
2861	int saslErr;
2862	#endif
2863	#if defined(CONFIG_VNC_TLS1) \|\| defined(CONFIG_VNC_SASL1)
2864	int acl = 0;
2865	#endif
2866	int lock_key_sync = 1;
2867
2868	if (!vnc_display)
2869	return -1;
2870	vnc_display_close(ds);
2871	if (strcmp(display, "none") == 0)
2872	return 0;
2873
2874	if (!(vs->display = strdup(display)))
2875	return -1;
2876	vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2877
2878	options = display;
2879	while ((options = strchr(options, ','))) {
2880	options++;
2881	if (strncmp(options, "password", 8) == 0) {
2882	password = 1; /* Require password auth */
2883	} else if (strncmp(options, "reverse", 7) == 0) {
2884	reverse = 1;
2885	} else if (strncmp(options, "no-lock-key-sync", 16) == 0) {
2886	lock_key_sync = 0;
2887	#ifdef CONFIG_VNC_SASL1
2888	} else if (strncmp(options, "sasl", 4) == 0) {
2889	sasl = 1; /* Require SASL auth */
2890	#endif
2891	#ifdef CONFIG_VNC_TLS1
2892	} else if (strncmp(options, "tls", 3) == 0) {
2893	tls = 1; /* Require TLS */
2894	} else if (strncmp(options, "x509", 4) == 0) {
2895	char start, end;
2896	x509 = 1; /* Require x509 certificates */
2897	if (strncmp(options, "x509verify", 10) == 0)
2898	vs->tls.x509verify = 1; /* ...and verify client certs */
2899
2900	/* Now check for 'x509=/some/path' postfix
2901	* and use that to setup x509 certificate/key paths */
2902	start = strchr(options, '=');
2903	end = strchr(options, ',');
2904	if (start && (!end \|\| (start < end))) {
2905	int len = end ? end-(start+1) : strlen(start+1);
2906	char *path = g_strndup(start + 1, len);
2907
2908	VNC_DEBUG("Trying certificate path '%s'\n", path)do { } while (0);
2909	if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2910	fprintf(stderrstderr, "Failed to find x509 certificates/keys in %s\n", path);
2911	g_free(path);
2912	g_free(vs->display);
2913	vs->display = NULL((void*)0);
2914	return -1;
2915	}
2916	g_free(path);
2917	} else {
2918	fprintf(stderrstderr, "No certificate path provided\n");
2919	g_free(vs->display);
2920	vs->display = NULL((void*)0);
2921	return -1;
2922	}
2923	#endif
2924	#if defined(CONFIG_VNC_TLS1) \|\| defined(CONFIG_VNC_SASL1)
2925	} else if (strncmp(options, "acl", 3) == 0) {
2926	acl = 1;
2927	#endif
2928	} else if (strncmp(options, "lossy", 5) == 0) {
2929	vs->lossy = true1;
2930	} else if (strncmp(options, "non-adapative", 13) == 0) {
2931	vs->non_adaptive = true1;
2932	} else if (strncmp(options, "share=", 6) == 0) {
2933	if (strncmp(options+6, "ignore", 6) == 0) {
2934	vs->share_policy = VNC_SHARE_POLICY_IGNORE;
2935	} else if (strncmp(options+6, "allow-exclusive", 15) == 0) {
2936	vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
2937	} else if (strncmp(options+6, "force-shared", 12) == 0) {
2938	vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
2939	} else {
2940	fprintf(stderrstderr, "unknown vnc share= option\n");
2941	g_free(vs->display);
2942	vs->display = NULL((void*)0);
2943	return -1;
2944	}
2945	}
2946	}
2947
2948	#ifdef CONFIG_VNC_TLS1
2949	if (acl && x509 && vs->tls.x509verify) {
2950	if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2951	fprintf(stderrstderr, "Failed to create x509 dname ACL\n");
2952	exit(1);
2953	}
2954	}
2955	#endif
2956	#ifdef CONFIG_VNC_SASL1
2957	if (acl && sasl) {
2958	if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2959	fprintf(stderrstderr, "Failed to create username ACL\n");
2960	exit(1);
2961	}
2962	}
2963	#endif
2964
2965	/*
2966	* Combinations we support here:
2967	*
2968	* - no-auth (clear text, no auth)
2969	* - password (clear text, weak auth)
2970	* - sasl (encrypt, good auth IF using Kerberos via GSSAPI)
2971	* - tls (encrypt, weak anonymous creds, no auth)
2972	* - tls + password (encrypt, weak anonymous creds, weak auth)
2973	* - tls + sasl (encrypt, weak anonymous creds, good auth)
2974	* - tls + x509 (encrypt, good x509 creds, no auth)
2975	* - tls + x509 + password (encrypt, good x509 creds, weak auth)
2976	* - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2977	*
2978	* NB1. TLS is a stackable auth scheme.
2979	* NB2. the x509 schemes have option to validate a client cert dname
2980	*/
2981	if (password) {
2982	#ifdef CONFIG_VNC_TLS1
2983	if (tls) {
2984	vs->auth = VNC_AUTH_VENCRYPT;
2985	if (x509) {
2986	VNC_DEBUG("Initializing VNC server with x509 password auth\n")do { } while (0);
2987	vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2988	} else {
2989	VNC_DEBUG("Initializing VNC server with TLS password auth\n")do { } while (0);
2990	vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2991	}
2992	} else {
2993	#endif /* CONFIG_VNC_TLS */
2994	VNC_DEBUG("Initializing VNC server with password auth\n")do { } while (0);
2995	vs->auth = VNC_AUTH_VNC;
2996	#ifdef CONFIG_VNC_TLS1
2997	vs->subauth = VNC_AUTH_INVALID;
2998	}
2999	#endif /* CONFIG_VNC_TLS */
3000	#ifdef CONFIG_VNC_SASL1
3001	} else if (sasl) {
3002	#ifdef CONFIG_VNC_TLS1
3003	if (tls) {
3004	vs->auth = VNC_AUTH_VENCRYPT;
3005	if (x509) {
3006	VNC_DEBUG("Initializing VNC server with x509 SASL auth\n")do { } while (0);
3007	vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3008	} else {
3009	VNC_DEBUG("Initializing VNC server with TLS SASL auth\n")do { } while (0);
3010	vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3011	}
3012	} else {
3013	#endif /* CONFIG_VNC_TLS */
3014	VNC_DEBUG("Initializing VNC server with SASL auth\n")do { } while (0);
3015	vs->auth = VNC_AUTH_SASL;
3016	#ifdef CONFIG_VNC_TLS1
3017	vs->subauth = VNC_AUTH_INVALID;
3018	}
3019	#endif /* CONFIG_VNC_TLS */
3020	#endif /* CONFIG_VNC_SASL */
3021	} else {
3022	#ifdef CONFIG_VNC_TLS1
3023	if (tls) {
3024	vs->auth = VNC_AUTH_VENCRYPT;
3025	if (x509) {
3026	VNC_DEBUG("Initializing VNC server with x509 no auth\n")do { } while (0);
3027	vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3028	} else {
3029	VNC_DEBUG("Initializing VNC server with TLS no auth\n")do { } while (0);
3030	vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3031	}
3032	} else {
3033	#endif
3034	VNC_DEBUG("Initializing VNC server with no auth\n")do { } while (0);
3035	vs->auth = VNC_AUTH_NONE;
3036	#ifdef CONFIG_VNC_TLS1
3037	vs->subauth = VNC_AUTH_INVALID;
3038	}
3039	#endif
3040	}
3041
3042	#ifdef CONFIG_VNC_SASL1
3043	if ((saslErr = sasl_server_init(NULL((void*)0), "qemu")) != SASL_OK0) {
3044	fprintf(stderrstderr, "Failed to initialize SASL auth %s",
3045	sasl_errstring(saslErr, NULL((void)0), NULL((void)0)));
3046	g_free(vs->display);
3047	vs->display = NULL((void*)0);
3048	return -1;
3049	}
3050	#endif
3051	vs->lock_key_sync = lock_key_sync;
3052
3053	if (reverse) {
3054	/* connect to viewer */
3055	if (strncmp(display, "unix:", 5) == 0)
3056	vs->lsock = unix_connect(display+5);
3057	else
3058	vs->lsock = inet_connect(display, true1, NULL((void*)0));
3059	if (-1 == vs->lsock) {
3060	g_free(vs->display);
3061	vs->display = NULL((void*)0);
3062	return -1;
3063	} else {
3064	int csock = vs->lsock;
3065	vs->lsock = -1;
3066	vnc_connect(vs, csock, 0);
3067	}
3068	return 0;
3069
3070	} else {
3071	/* listen for connects */
3072	char *dpy;
3073	dpy = g_malloc(256);
3074	if (strncmp(display, "unix:", 5) == 0) {
3075	pstrcpy(dpy, 256, "unix:");
3076	vs->lsock = unix_listen(display+5, dpy+5, 256-5);
3077	} else {
3078	vs->lsock = inet_listen(display, dpy, 256,
3079	SOCK_STREAMSOCK_STREAM, 5900, NULL((void*)0));
3080	}
3081	if (-1 == vs->lsock) {
3082	g_free(dpy);
3083	return -1;
3084	} else {
3085	g_free(vs->display);
3086	vs->display = dpy;
3087	}
3088	}
3089	return qemu_set_fd_handler2(vs->lsock, NULL((void)0), vnc_listen_read, NULL((void)0), vs);
3090	}
3091
3092	void vnc_display_add_client(DisplayState *ds, int csock, int skipauth)
3093	{
3094	VncDisplay vs = ds ? (VncDisplay )ds->opaque : vnc_display;
3095
3096	return vnc_connect(vs, csock, skipauth);
3097	}