1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24#include "qemu/osdep.h"
25#include "qemu/log.h"
26#include "hw/hw.h"
27#include "hw/isa/isa.h"
28#include "hw/i386/pc.h"
29#include "hw/input/ps2.h"
30#include "hw/input/i8042.h"
31#include "sysemu/sysemu.h"
32
33#include "trace.h"
34
35
36#define KBD_CCMD_READ_MODE 0x20
37#define KBD_CCMD_WRITE_MODE 0x60
38#define KBD_CCMD_GET_VERSION 0xA1
39#define KBD_CCMD_MOUSE_DISABLE 0xA7
40#define KBD_CCMD_MOUSE_ENABLE 0xA8
41#define KBD_CCMD_TEST_MOUSE 0xA9
42#define KBD_CCMD_SELF_TEST 0xAA
43#define KBD_CCMD_KBD_TEST 0xAB
44#define KBD_CCMD_KBD_DISABLE 0xAD
45#define KBD_CCMD_KBD_ENABLE 0xAE
46#define KBD_CCMD_READ_INPORT 0xC0
47#define KBD_CCMD_READ_OUTPORT 0xD0
48#define KBD_CCMD_WRITE_OUTPORT 0xD1
49#define KBD_CCMD_WRITE_OBUF 0xD2
50#define KBD_CCMD_WRITE_AUX_OBUF 0xD3
51
52#define KBD_CCMD_WRITE_MOUSE 0xD4
53#define KBD_CCMD_DISABLE_A20 0xDD
54#define KBD_CCMD_ENABLE_A20 0xDF
55#define KBD_CCMD_PULSE_BITS_3_0 0xF0
56#define KBD_CCMD_RESET 0xFE
57#define KBD_CCMD_NO_OP 0xFF
58
59
60#define KBD_CMD_SET_LEDS 0xED
61#define KBD_CMD_ECHO 0xEE
62#define KBD_CMD_GET_ID 0xF2
63#define KBD_CMD_SET_RATE 0xF3
64#define KBD_CMD_ENABLE 0xF4
65#define KBD_CMD_RESET_DISABLE 0xF5
66#define KBD_CMD_RESET_ENABLE 0xF6
67#define KBD_CMD_RESET 0xFF
68
69
70#define KBD_REPLY_POR 0xAA
71#define KBD_REPLY_ACK 0xFA
72#define KBD_REPLY_RESEND 0xFE
73
74
75#define KBD_STAT_OBF 0x01
76#define KBD_STAT_IBF 0x02
77#define KBD_STAT_SELFTEST 0x04
78#define KBD_STAT_CMD 0x08
79#define KBD_STAT_UNLOCKED 0x10
80#define KBD_STAT_MOUSE_OBF 0x20
81#define KBD_STAT_GTO 0x40
82#define KBD_STAT_PERR 0x80
83
84
85#define KBD_MODE_KBD_INT 0x01
86#define KBD_MODE_MOUSE_INT 0x02
87#define KBD_MODE_SYS 0x04
88#define KBD_MODE_NO_KEYLOCK 0x08
89#define KBD_MODE_DISABLE_KBD 0x10
90#define KBD_MODE_DISABLE_MOUSE 0x20
91#define KBD_MODE_KCC 0x40
92#define KBD_MODE_RFU 0x80
93
94
95#define KBD_OUT_RESET 0x01
96#define KBD_OUT_A20 0x02
97#define KBD_OUT_OBF 0x10
98#define KBD_OUT_MOUSE_OBF 0x20
99
100
101
102
103
104#define KBD_OUT_ONES 0xcc
105
106
107#define AUX_SET_SCALE11 0xE6
108#define AUX_SET_SCALE21 0xE7
109#define AUX_SET_RES 0xE8
110#define AUX_GET_SCALE 0xE9
111#define AUX_SET_STREAM 0xEA
112#define AUX_POLL 0xEB
113#define AUX_RESET_WRAP 0xEC
114#define AUX_SET_WRAP 0xEE
115#define AUX_SET_REMOTE 0xF0
116#define AUX_GET_TYPE 0xF2
117#define AUX_SET_SAMPLE 0xF3
118#define AUX_ENABLE_DEV 0xF4
119#define AUX_DISABLE_DEV 0xF5
120#define AUX_SET_DEFAULT 0xF6
121#define AUX_RESET 0xFF
122#define AUX_ACK 0xFA
123
124#define MOUSE_STATUS_REMOTE 0x40
125#define MOUSE_STATUS_ENABLED 0x20
126#define MOUSE_STATUS_SCALE21 0x10
127
128#define KBD_PENDING_KBD 1
129#define KBD_PENDING_AUX 2
130
131typedef struct KBDState {
132 uint8_t write_cmd;
133 uint8_t status;
134 uint8_t mode;
135 uint8_t outport;
136 bool outport_present;
137
138 uint8_t pending;
139 void *kbd;
140 void *mouse;
141
142 qemu_irq irq_kbd;
143 qemu_irq irq_mouse;
144 qemu_irq a20_out;
145 hwaddr mask;
146} KBDState;
147
148
149
150
151static void kbd_update_irq(KBDState *s)
152{
153 int irq_kbd_level, irq_mouse_level;
154
155 irq_kbd_level = 0;
156 irq_mouse_level = 0;
157 s->status &= ~(KBD_STAT_OBF | KBD_STAT_MOUSE_OBF);
158 s->outport &= ~(KBD_OUT_OBF | KBD_OUT_MOUSE_OBF);
159 if (s->pending) {
160 s->status |= KBD_STAT_OBF;
161 s->outport |= KBD_OUT_OBF;
162
163 if (s->pending == KBD_PENDING_AUX) {
164 s->status |= KBD_STAT_MOUSE_OBF;
165 s->outport |= KBD_OUT_MOUSE_OBF;
166 if (s->mode & KBD_MODE_MOUSE_INT)
167 irq_mouse_level = 1;
168 } else {
169 if ((s->mode & KBD_MODE_KBD_INT) &&
170 !(s->mode & KBD_MODE_DISABLE_KBD))
171 irq_kbd_level = 1;
172 }
173 }
174 qemu_set_irq(s->irq_kbd, irq_kbd_level);
175 qemu_set_irq(s->irq_mouse, irq_mouse_level);
176}
177
178static void kbd_update_kbd_irq(void *opaque, int level)
179{
180 KBDState *s = (KBDState *)opaque;
181
182 if (level)
183 s->pending |= KBD_PENDING_KBD;
184 else
185 s->pending &= ~KBD_PENDING_KBD;
186 kbd_update_irq(s);
187}
188
189static void kbd_update_aux_irq(void *opaque, int level)
190{
191 KBDState *s = (KBDState *)opaque;
192
193 if (level)
194 s->pending |= KBD_PENDING_AUX;
195 else
196 s->pending &= ~KBD_PENDING_AUX;
197 kbd_update_irq(s);
198}
199
200static uint64_t kbd_read_status(void *opaque, hwaddr addr,
201 unsigned size)
202{
203 KBDState *s = opaque;
204 int val;
205 val = s->status;
206 trace_pckbd_kbd_read_status(val);
207 return val;
208}
209
210static void kbd_queue(KBDState *s, int b, int aux)
211{
212 if (aux)
213 ps2_queue(s->mouse, b);
214 else
215 ps2_queue(s->kbd, b);
216}
217
218static void outport_write(KBDState *s, uint32_t val)
219{
220 trace_pckbd_outport_write(val);
221 s->outport = val;
222 qemu_set_irq(s->a20_out, (val >> 1) & 1);
223 if (!(val & 1)) {
224 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
225 }
226}
227
228static void kbd_write_command(void *opaque, hwaddr addr,
229 uint64_t val, unsigned size)
230{
231 KBDState *s = opaque;
232
233 trace_pckbd_kbd_write_command(val);
234
235
236
237
238
239
240
241
242 if((val & KBD_CCMD_PULSE_BITS_3_0) == KBD_CCMD_PULSE_BITS_3_0) {
243 if(!(val & 1))
244 val = KBD_CCMD_RESET;
245 else
246 val = KBD_CCMD_NO_OP;
247 }
248
249 switch(val) {
250 case KBD_CCMD_READ_MODE:
251 kbd_queue(s, s->mode, 0);
252 break;
253 case KBD_CCMD_WRITE_MODE:
254 case KBD_CCMD_WRITE_OBUF:
255 case KBD_CCMD_WRITE_AUX_OBUF:
256 case KBD_CCMD_WRITE_MOUSE:
257 case KBD_CCMD_WRITE_OUTPORT:
258 s->write_cmd = val;
259 break;
260 case KBD_CCMD_MOUSE_DISABLE:
261 s->mode |= KBD_MODE_DISABLE_MOUSE;
262 break;
263 case KBD_CCMD_MOUSE_ENABLE:
264 s->mode &= ~KBD_MODE_DISABLE_MOUSE;
265 break;
266 case KBD_CCMD_TEST_MOUSE:
267 kbd_queue(s, 0x00, 0);
268 break;
269 case KBD_CCMD_SELF_TEST:
270 s->status |= KBD_STAT_SELFTEST;
271 kbd_queue(s, 0x55, 0);
272 break;
273 case KBD_CCMD_KBD_TEST:
274 kbd_queue(s, 0x00, 0);
275 break;
276 case KBD_CCMD_KBD_DISABLE:
277 s->mode |= KBD_MODE_DISABLE_KBD;
278 kbd_update_irq(s);
279 break;
280 case KBD_CCMD_KBD_ENABLE:
281 s->mode &= ~KBD_MODE_DISABLE_KBD;
282 kbd_update_irq(s);
283 break;
284 case KBD_CCMD_READ_INPORT:
285 kbd_queue(s, 0x80, 0);
286 break;
287 case KBD_CCMD_READ_OUTPORT:
288 kbd_queue(s, s->outport, 0);
289 break;
290 case KBD_CCMD_ENABLE_A20:
291 qemu_irq_raise(s->a20_out);
292 s->outport |= KBD_OUT_A20;
293 break;
294 case KBD_CCMD_DISABLE_A20:
295 qemu_irq_lower(s->a20_out);
296 s->outport &= ~KBD_OUT_A20;
297 break;
298 case KBD_CCMD_RESET:
299 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
300 break;
301 case KBD_CCMD_NO_OP:
302
303 break;
304 default:
305 qemu_log_mask(LOG_GUEST_ERROR,
306 "unsupported keyboard cmd=0x%02" PRIx64 "\n", val);
307 break;
308 }
309}
310
311static uint64_t kbd_read_data(void *opaque, hwaddr addr,
312 unsigned size)
313{
314 KBDState *s = opaque;
315 uint32_t val;
316
317 if (s->pending == KBD_PENDING_AUX)
318 val = ps2_read_data(s->mouse);
319 else
320 val = ps2_read_data(s->kbd);
321
322 trace_pckbd_kbd_read_data(val);
323 return val;
324}
325
326static void kbd_write_data(void *opaque, hwaddr addr,
327 uint64_t val, unsigned size)
328{
329 KBDState *s = opaque;
330
331 trace_pckbd_kbd_write_data(val);
332
333 switch(s->write_cmd) {
334 case 0:
335 ps2_write_keyboard(s->kbd, val);
336 break;
337 case KBD_CCMD_WRITE_MODE:
338 s->mode = val;
339 ps2_keyboard_set_translation(s->kbd, (s->mode & KBD_MODE_KCC) != 0);
340
341 kbd_update_irq(s);
342 break;
343 case KBD_CCMD_WRITE_OBUF:
344 kbd_queue(s, val, 0);
345 break;
346 case KBD_CCMD_WRITE_AUX_OBUF:
347 kbd_queue(s, val, 1);
348 break;
349 case KBD_CCMD_WRITE_OUTPORT:
350 outport_write(s, val);
351 break;
352 case KBD_CCMD_WRITE_MOUSE:
353 ps2_write_mouse(s->mouse, val);
354 break;
355 default:
356 break;
357 }
358 s->write_cmd = 0;
359}
360
361static void kbd_reset(void *opaque)
362{
363 KBDState *s = opaque;
364
365 s->mode = KBD_MODE_KBD_INT | KBD_MODE_MOUSE_INT;
366 s->status = KBD_STAT_CMD | KBD_STAT_UNLOCKED;
367 s->outport = KBD_OUT_RESET | KBD_OUT_A20 | KBD_OUT_ONES;
368 s->outport_present = false;
369}
370
371static uint8_t kbd_outport_default(KBDState *s)
372{
373 return KBD_OUT_RESET | KBD_OUT_A20 | KBD_OUT_ONES
374 | (s->status & KBD_STAT_OBF ? KBD_OUT_OBF : 0)
375 | (s->status & KBD_STAT_MOUSE_OBF ? KBD_OUT_MOUSE_OBF : 0);
376}
377
378static int kbd_outport_post_load(void *opaque, int version_id)
379{
380 KBDState *s = opaque;
381 s->outport_present = true;
382 return 0;
383}
384
385static bool kbd_outport_needed(void *opaque)
386{
387 KBDState *s = opaque;
388 return s->outport != kbd_outport_default(s);
389}
390
391static const VMStateDescription vmstate_kbd_outport = {
392 .name = "pckbd_outport",
393 .version_id = 1,
394 .minimum_version_id = 1,
395 .post_load = kbd_outport_post_load,
396 .needed = kbd_outport_needed,
397 .fields = (VMStateField[]) {
398 VMSTATE_UINT8(outport, KBDState),
399 VMSTATE_END_OF_LIST()
400 }
401};
402
403static int kbd_post_load(void *opaque, int version_id)
404{
405 KBDState *s = opaque;
406 if (!s->outport_present) {
407 s->outport = kbd_outport_default(s);
408 }
409 s->outport_present = false;
410 return 0;
411}
412
413static const VMStateDescription vmstate_kbd = {
414 .name = "pckbd",
415 .version_id = 3,
416 .minimum_version_id = 3,
417 .post_load = kbd_post_load,
418 .fields = (VMStateField[]) {
419 VMSTATE_UINT8(write_cmd, KBDState),
420 VMSTATE_UINT8(status, KBDState),
421 VMSTATE_UINT8(mode, KBDState),
422 VMSTATE_UINT8(pending, KBDState),
423 VMSTATE_END_OF_LIST()
424 },
425 .subsections = (const VMStateDescription*[]) {
426 &vmstate_kbd_outport,
427 NULL
428 }
429};
430
431
432static uint64_t kbd_mm_readfn(void *opaque, hwaddr addr, unsigned size)
433{
434 KBDState *s = opaque;
435
436 if (addr & s->mask)
437 return kbd_read_status(s, 0, 1) & 0xff;
438 else
439 return kbd_read_data(s, 0, 1) & 0xff;
440}
441
442static void kbd_mm_writefn(void *opaque, hwaddr addr,
443 uint64_t value, unsigned size)
444{
445 KBDState *s = opaque;
446
447 if (addr & s->mask)
448 kbd_write_command(s, 0, value & 0xff, 1);
449 else
450 kbd_write_data(s, 0, value & 0xff, 1);
451}
452
453
454static const MemoryRegionOps i8042_mmio_ops = {
455 .read = kbd_mm_readfn,
456 .write = kbd_mm_writefn,
457 .valid.min_access_size = 1,
458 .valid.max_access_size = 4,
459 .endianness = DEVICE_NATIVE_ENDIAN,
460};
461
462void i8042_mm_init(qemu_irq kbd_irq, qemu_irq mouse_irq,
463 MemoryRegion *region, ram_addr_t size,
464 hwaddr mask)
465{
466 KBDState *s = g_malloc0(sizeof(KBDState));
467
468 s->irq_kbd = kbd_irq;
469 s->irq_mouse = mouse_irq;
470 s->mask = mask;
471
472 vmstate_register(NULL, 0, &vmstate_kbd, s);
473
474 memory_region_init_io(region, NULL, &i8042_mmio_ops, s, "i8042", size);
475
476 s->kbd = ps2_kbd_init(kbd_update_kbd_irq, s);
477 s->mouse = ps2_mouse_init(kbd_update_aux_irq, s);
478 qemu_register_reset(kbd_reset, s);
479}
480
481#define I8042(obj) OBJECT_CHECK(ISAKBDState, (obj), TYPE_I8042)
482
483typedef struct ISAKBDState {
484 ISADevice parent_obj;
485
486 KBDState kbd;
487 MemoryRegion io[2];
488} ISAKBDState;
489
490void i8042_isa_mouse_fake_event(void *opaque)
491{
492 ISADevice *dev = opaque;
493 ISAKBDState *isa = I8042(dev);
494 KBDState *s = &isa->kbd;
495
496 ps2_mouse_fake_event(s->mouse);
497}
498
499void i8042_setup_a20_line(ISADevice *dev, qemu_irq a20_out)
500{
501 qdev_connect_gpio_out_named(DEVICE(dev), I8042_A20_LINE, 0, a20_out);
502}
503
504static const VMStateDescription vmstate_kbd_isa = {
505 .name = "pckbd",
506 .version_id = 3,
507 .minimum_version_id = 3,
508 .fields = (VMStateField[]) {
509 VMSTATE_STRUCT(kbd, ISAKBDState, 0, vmstate_kbd, KBDState),
510 VMSTATE_END_OF_LIST()
511 }
512};
513
514static const MemoryRegionOps i8042_data_ops = {
515 .read = kbd_read_data,
516 .write = kbd_write_data,
517 .impl = {
518 .min_access_size = 1,
519 .max_access_size = 1,
520 },
521 .endianness = DEVICE_LITTLE_ENDIAN,
522};
523
524static const MemoryRegionOps i8042_cmd_ops = {
525 .read = kbd_read_status,
526 .write = kbd_write_command,
527 .impl = {
528 .min_access_size = 1,
529 .max_access_size = 1,
530 },
531 .endianness = DEVICE_LITTLE_ENDIAN,
532};
533
534static void i8042_initfn(Object *obj)
535{
536 ISAKBDState *isa_s = I8042(obj);
537 KBDState *s = &isa_s->kbd;
538
539 memory_region_init_io(isa_s->io + 0, obj, &i8042_data_ops, s,
540 "i8042-data", 1);
541 memory_region_init_io(isa_s->io + 1, obj, &i8042_cmd_ops, s,
542 "i8042-cmd", 1);
543
544 qdev_init_gpio_out_named(DEVICE(obj), &s->a20_out, I8042_A20_LINE, 1);
545}
546
547static void i8042_realizefn(DeviceState *dev, Error **errp)
548{
549 ISADevice *isadev = ISA_DEVICE(dev);
550 ISAKBDState *isa_s = I8042(dev);
551 KBDState *s = &isa_s->kbd;
552
553 isa_init_irq(isadev, &s->irq_kbd, 1);
554 isa_init_irq(isadev, &s->irq_mouse, 12);
555
556 isa_register_ioport(isadev, isa_s->io + 0, 0x60);
557 isa_register_ioport(isadev, isa_s->io + 1, 0x64);
558
559 s->kbd = ps2_kbd_init(kbd_update_kbd_irq, s);
560 s->mouse = ps2_mouse_init(kbd_update_aux_irq, s);
561 qemu_register_reset(kbd_reset, s);
562}
563
564static void i8042_class_initfn(ObjectClass *klass, void *data)
565{
566 DeviceClass *dc = DEVICE_CLASS(klass);
567
568 dc->realize = i8042_realizefn;
569 dc->vmsd = &vmstate_kbd_isa;
570 set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
571}
572
573static const TypeInfo i8042_info = {
574 .name = TYPE_I8042,
575 .parent = TYPE_ISA_DEVICE,
576 .instance_size = sizeof(ISAKBDState),
577 .instance_init = i8042_initfn,
578 .class_init = i8042_class_initfn,
579};
580
581static void i8042_register_types(void)
582{
583 type_register_static(&i8042_info);
584}
585
586type_init(i8042_register_types)
587