cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

escc.c (27872B)


      1/*
      2 * QEMU ESCC (Z8030/Z8530/Z85C30/SCC/ESCC) serial port emulation
      3 *
      4 * Copyright (c) 2003-2005 Fabrice Bellard
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "hw/irq.h"
     27#include "hw/qdev-properties.h"
     28#include "hw/qdev-properties-system.h"
     29#include "hw/sysbus.h"
     30#include "migration/vmstate.h"
     31#include "qemu/module.h"
     32#include "hw/char/escc.h"
     33#include "ui/console.h"
     34#include "trace.h"
     35
     36/*
     37 * Chipset docs:
     38 * "Z80C30/Z85C30/Z80230/Z85230/Z85233 SCC/ESCC User Manual",
     39 * http://www.zilog.com/docs/serial/scc_escc_um.pdf
     40 *
     41 * On Sparc32 this is the serial port, mouse and keyboard part of chip STP2001
     42 * (Slave I/O), also produced as NCR89C105. See
     43 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C105.txt
     44 *
     45 * The serial ports implement full AMD AM8530 or Zilog Z8530 chips,
     46 * mouse and keyboard ports don't implement all functions and they are
     47 * only asynchronous. There is no DMA.
     48 *
     49 * Z85C30 is also used on PowerMacs and m68k Macs.
     50 *
     51 * There are some small differences between Sparc version (sunzilog)
     52 * and PowerMac (pmac):
     53 *  Offset between control and data registers
     54 *  There is some kind of lockup bug, but we can ignore it
     55 *  CTS is inverted
     56 *  DMA on pmac using DBDMA chip
     57 *  pmac can do IRDA and faster rates, sunzilog can only do 38400
     58 *  pmac baud rate generator clock is 3.6864 MHz, sunzilog 4.9152 MHz
     59 *
     60 * Linux driver for m68k Macs is the same as for PowerMac (pmac_zilog),
     61 * but registers are grouped by type and not by channel:
     62 * channel is selected by bit 0 of the address (instead of bit 1)
     63 * and register is selected by bit 1 of the address (instead of bit 0).
     64 */
     65
     66/*
     67 * Modifications:
     68 *  2006-Aug-10  Igor Kovalenko :   Renamed KBDQueue to SERIOQueue, implemented
     69 *                                  serial mouse queue.
     70 *                                  Implemented serial mouse protocol.
     71 *
     72 *  2010-May-23  Artyom Tarasenko:  Reworked IUS logic
     73 */
     74
     75#define CHN_C(s) ((s)->chn == escc_chn_b ? 'b' : 'a')
     76
     77#define SERIAL_CTRL 0
     78#define SERIAL_DATA 1
     79
     80#define W_CMD     0
     81#define CMD_PTR_MASK   0x07
     82#define CMD_CMD_MASK   0x38
     83#define CMD_HI         0x08
     84#define CMD_CLR_TXINT  0x28
     85#define CMD_CLR_IUS    0x38
     86#define W_INTR    1
     87#define INTR_INTALL    0x01
     88#define INTR_TXINT     0x02
     89#define INTR_PAR_SPEC  0x04
     90#define INTR_RXMODEMSK 0x18
     91#define INTR_RXINT1ST  0x08
     92#define INTR_RXINTALL  0x10
     93#define INTR_WTRQ_TXRX 0x20
     94#define W_IVEC    2
     95#define W_RXCTRL  3
     96#define RXCTRL_RXEN    0x01
     97#define RXCTRL_HUNT    0x10
     98#define W_TXCTRL1 4
     99#define TXCTRL1_PAREN  0x01
    100#define TXCTRL1_PAREV  0x02
    101#define TXCTRL1_1STOP  0x04
    102#define TXCTRL1_1HSTOP 0x08
    103#define TXCTRL1_2STOP  0x0c
    104#define TXCTRL1_STPMSK 0x0c
    105#define TXCTRL1_CLK1X  0x00
    106#define TXCTRL1_CLK16X 0x40
    107#define TXCTRL1_CLK32X 0x80
    108#define TXCTRL1_CLK64X 0xc0
    109#define TXCTRL1_CLKMSK 0xc0
    110#define W_TXCTRL2 5
    111#define TXCTRL2_TXCRC  0x01
    112#define TXCTRL2_TXEN   0x08
    113#define TXCTRL2_BITMSK 0x60
    114#define TXCTRL2_5BITS  0x00
    115#define TXCTRL2_7BITS  0x20
    116#define TXCTRL2_6BITS  0x40
    117#define TXCTRL2_8BITS  0x60
    118#define W_SYNC1   6
    119#define W_SYNC2   7
    120#define W_TXBUF   8
    121#define W_MINTR   9
    122#define MINTR_VIS      0x01
    123#define MINTR_NV       0x02
    124#define MINTR_STATUSHI 0x10
    125#define MINTR_SOFTIACK 0x20
    126#define MINTR_RST_MASK 0xc0
    127#define MINTR_RST_B    0x40
    128#define MINTR_RST_A    0x80
    129#define MINTR_RST_ALL  0xc0
    130#define W_MISC1  10
    131#define MISC1_ENC_MASK 0x60
    132#define W_CLOCK  11
    133#define CLOCK_TRXC     0x08
    134#define W_BRGLO  12
    135#define W_BRGHI  13
    136#define W_MISC2  14
    137#define MISC2_BRG_EN   0x01
    138#define MISC2_BRG_SRC  0x02
    139#define MISC2_LCL_LOOP 0x10
    140#define MISC2_PLLCMD0  0x20
    141#define MISC2_PLLCMD1  0x40
    142#define MISC2_PLLCMD2  0x80
    143#define W_EXTINT 15
    144#define EXTINT_DCD     0x08
    145#define EXTINT_SYNCINT 0x10
    146#define EXTINT_CTSINT  0x20
    147#define EXTINT_TXUNDRN 0x40
    148#define EXTINT_BRKINT  0x80
    149
    150#define R_STATUS  0
    151#define STATUS_RXAV    0x01
    152#define STATUS_ZERO    0x02
    153#define STATUS_TXEMPTY 0x04
    154#define STATUS_DCD     0x08
    155#define STATUS_SYNC    0x10
    156#define STATUS_CTS     0x20
    157#define STATUS_TXUNDRN 0x40
    158#define STATUS_BRK     0x80
    159#define R_SPEC    1
    160#define SPEC_ALLSENT   0x01
    161#define SPEC_BITS8     0x06
    162#define R_IVEC    2
    163#define IVEC_TXINTB    0x00
    164#define IVEC_LONOINT   0x06
    165#define IVEC_LORXINTA  0x0c
    166#define IVEC_LORXINTB  0x04
    167#define IVEC_LOTXINTA  0x08
    168#define IVEC_HINOINT   0x60
    169#define IVEC_HIRXINTA  0x30
    170#define IVEC_HIRXINTB  0x20
    171#define IVEC_HITXINTA  0x10
    172#define R_INTR    3
    173#define INTR_EXTINTB   0x01
    174#define INTR_TXINTB    0x02
    175#define INTR_RXINTB    0x04
    176#define INTR_EXTINTA   0x08
    177#define INTR_TXINTA    0x10
    178#define INTR_RXINTA    0x20
    179#define R_IPEN    4
    180#define R_TXCTRL1 5
    181#define R_TXCTRL2 6
    182#define R_BC      7
    183#define R_RXBUF   8
    184#define R_RXCTRL  9
    185#define R_MISC   10
    186#define MISC_2CLKMISS  0x40
    187#define R_MISC1  11
    188#define R_BRGLO  12
    189#define R_BRGHI  13
    190#define R_MISC1I 14
    191#define R_EXTINT 15
    192
    193static void handle_kbd_command(ESCCChannelState *s, int val);
    194static int serial_can_receive(void *opaque);
    195static void serial_receive_byte(ESCCChannelState *s, int ch);
    196
    197static int reg_shift(ESCCState *s)
    198{
    199    return s->bit_swap ? s->it_shift + 1 : s->it_shift;
    200}
    201
    202static int chn_shift(ESCCState *s)
    203{
    204    return s->bit_swap ? s->it_shift : s->it_shift + 1;
    205}
    206
    207static void clear_queue(void *opaque)
    208{
    209    ESCCChannelState *s = opaque;
    210    ESCCSERIOQueue *q = &s->queue;
    211    q->rptr = q->wptr = q->count = 0;
    212}
    213
    214static void put_queue(void *opaque, int b)
    215{
    216    ESCCChannelState *s = opaque;
    217    ESCCSERIOQueue *q = &s->queue;
    218
    219    trace_escc_put_queue(CHN_C(s), b);
    220    if (q->count >= ESCC_SERIO_QUEUE_SIZE) {
    221        return;
    222    }
    223    q->data[q->wptr] = b;
    224    if (++q->wptr == ESCC_SERIO_QUEUE_SIZE) {
    225        q->wptr = 0;
    226    }
    227    q->count++;
    228    serial_receive_byte(s, 0);
    229}
    230
    231static uint32_t get_queue(void *opaque)
    232{
    233    ESCCChannelState *s = opaque;
    234    ESCCSERIOQueue *q = &s->queue;
    235    int val;
    236
    237    if (q->count == 0) {
    238        return 0;
    239    } else {
    240        val = q->data[q->rptr];
    241        if (++q->rptr == ESCC_SERIO_QUEUE_SIZE) {
    242            q->rptr = 0;
    243        }
    244        q->count--;
    245    }
    246    trace_escc_get_queue(CHN_C(s), val);
    247    if (q->count > 0) {
    248        serial_receive_byte(s, 0);
    249    }
    250    return val;
    251}
    252
    253static int escc_update_irq_chn(ESCCChannelState *s)
    254{
    255    if ((((s->wregs[W_INTR] & INTR_TXINT) && (s->txint == 1)) ||
    256        /* tx ints enabled, pending */
    257        ((((s->wregs[W_INTR] & INTR_RXMODEMSK) == INTR_RXINT1ST) ||
    258        ((s->wregs[W_INTR] & INTR_RXMODEMSK) == INTR_RXINTALL)) &&
    259            s->rxint == 1) ||
    260        /* rx ints enabled, pending */
    261        ((s->wregs[W_EXTINT] & EXTINT_BRKINT) &&
    262            (s->rregs[R_STATUS] & STATUS_BRK)))) {
    263        /* break int e&p */
    264        return 1;
    265    }
    266    return 0;
    267}
    268
    269static void escc_update_irq(ESCCChannelState *s)
    270{
    271    int irq;
    272
    273    irq = escc_update_irq_chn(s);
    274    irq |= escc_update_irq_chn(s->otherchn);
    275
    276    trace_escc_update_irq(irq);
    277    qemu_set_irq(s->irq, irq);
    278}
    279
    280static void escc_reset_chn(ESCCChannelState *s)
    281{
    282    s->reg = 0;
    283    s->rx = s->tx = 0;
    284    s->rxint = s->txint = 0;
    285    s->rxint_under_svc = s->txint_under_svc = 0;
    286    s->e0_mode = s->led_mode = s->caps_lock_mode = s->num_lock_mode = 0;
    287    clear_queue(s);
    288}
    289
    290static void escc_soft_reset_chn(ESCCChannelState *s)
    291{
    292    escc_reset_chn(s);
    293
    294    s->wregs[W_CMD] = 0;
    295    s->wregs[W_INTR] &= INTR_PAR_SPEC | INTR_WTRQ_TXRX;
    296    s->wregs[W_RXCTRL] &= ~RXCTRL_RXEN;
    297    /* 1 stop bit */
    298    s->wregs[W_TXCTRL1] |= TXCTRL1_1STOP;
    299    s->wregs[W_TXCTRL2] &= TXCTRL2_TXCRC | TXCTRL2_8BITS;
    300    s->wregs[W_MINTR] &= ~MINTR_SOFTIACK;
    301    s->wregs[W_MISC1] &= MISC1_ENC_MASK;
    302    /* PLL disabled */
    303    s->wregs[W_MISC2] &= MISC2_BRG_EN | MISC2_BRG_SRC |
    304                         MISC2_PLLCMD1 | MISC2_PLLCMD2;
    305    s->wregs[W_MISC2] |= MISC2_PLLCMD0;
    306    /* Enable most interrupts */
    307    s->wregs[W_EXTINT] = EXTINT_DCD | EXTINT_SYNCINT | EXTINT_CTSINT |
    308                         EXTINT_TXUNDRN | EXTINT_BRKINT;
    309
    310    s->rregs[R_STATUS] &= STATUS_DCD | STATUS_SYNC | STATUS_CTS | STATUS_BRK;
    311    s->rregs[R_STATUS] |= STATUS_TXEMPTY | STATUS_TXUNDRN;
    312    if (s->disabled) {
    313        s->rregs[R_STATUS] |= STATUS_DCD | STATUS_SYNC | STATUS_CTS;
    314    }
    315    s->rregs[R_SPEC] &= SPEC_ALLSENT;
    316    s->rregs[R_SPEC] |= SPEC_BITS8;
    317    s->rregs[R_INTR] = 0;
    318    s->rregs[R_MISC] &= MISC_2CLKMISS;
    319}
    320
    321static void escc_hard_reset_chn(ESCCChannelState *s)
    322{
    323    escc_soft_reset_chn(s);
    324
    325    /*
    326     * Hard reset is almost identical to soft reset above, except that the
    327     * values of WR9 (W_MINTR), WR10 (W_MISC1), WR11 (W_CLOCK) and WR14
    328     * (W_MISC2) have extra bits forced to 0/1
    329     */
    330    s->wregs[W_MINTR] &= MINTR_VIS | MINTR_NV;
    331    s->wregs[W_MINTR] |= MINTR_RST_B | MINTR_RST_A;
    332    s->wregs[W_MISC1] = 0;
    333    s->wregs[W_CLOCK] = CLOCK_TRXC;
    334    s->wregs[W_MISC2] &= MISC2_PLLCMD1 | MISC2_PLLCMD2;
    335    s->wregs[W_MISC2] |= MISC2_LCL_LOOP | MISC2_PLLCMD0;
    336}
    337
    338static void escc_reset(DeviceState *d)
    339{
    340    ESCCState *s = ESCC(d);
    341    int i, j;
    342
    343    for (i = 0; i < 2; i++) {
    344        ESCCChannelState *cs = &s->chn[i];
    345
    346        /*
    347         * According to the ESCC datasheet "Miscellaneous Questions" section
    348         * on page 384, the values of the ESCC registers are not guaranteed on
    349         * power-on until an explicit hardware or software reset has been
    350         * issued. For now we zero the registers so that a device reset always
    351         * returns the emulated device to a fixed state.
    352         */
    353        for (j = 0; j < ESCC_SERIAL_REGS; j++) {
    354            cs->rregs[j] = 0;
    355            cs->wregs[j] = 0;
    356        }
    357        escc_reset_chn(cs);
    358    }
    359}
    360
    361static inline void set_rxint(ESCCChannelState *s)
    362{
    363    s->rxint = 1;
    364    /*
    365     * XXX: missing daisy chaining: escc_chn_b rx should have a lower priority
    366     * than chn_a rx/tx/special_condition service
    367     */
    368    s->rxint_under_svc = 1;
    369    if (s->chn == escc_chn_a) {
    370        s->rregs[R_INTR] |= INTR_RXINTA;
    371        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    372            s->otherchn->rregs[R_IVEC] = IVEC_HIRXINTA;
    373        } else {
    374            s->otherchn->rregs[R_IVEC] = IVEC_LORXINTA;
    375        }
    376    } else {
    377        s->otherchn->rregs[R_INTR] |= INTR_RXINTB;
    378        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    379            s->rregs[R_IVEC] = IVEC_HIRXINTB;
    380        } else {
    381            s->rregs[R_IVEC] = IVEC_LORXINTB;
    382        }
    383    }
    384    escc_update_irq(s);
    385}
    386
    387static inline void set_txint(ESCCChannelState *s)
    388{
    389    s->txint = 1;
    390    if (!s->rxint_under_svc) {
    391        s->txint_under_svc = 1;
    392        if (s->chn == escc_chn_a) {
    393            if (s->wregs[W_INTR] & INTR_TXINT) {
    394                s->rregs[R_INTR] |= INTR_TXINTA;
    395            }
    396            if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    397                s->otherchn->rregs[R_IVEC] = IVEC_HITXINTA;
    398            } else {
    399                s->otherchn->rregs[R_IVEC] = IVEC_LOTXINTA;
    400            }
    401        } else {
    402            s->rregs[R_IVEC] = IVEC_TXINTB;
    403            if (s->wregs[W_INTR] & INTR_TXINT) {
    404                s->otherchn->rregs[R_INTR] |= INTR_TXINTB;
    405            }
    406        }
    407        escc_update_irq(s);
    408    }
    409}
    410
    411static inline void clr_rxint(ESCCChannelState *s)
    412{
    413    s->rxint = 0;
    414    s->rxint_under_svc = 0;
    415    if (s->chn == escc_chn_a) {
    416        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    417            s->otherchn->rregs[R_IVEC] = IVEC_HINOINT;
    418        } else {
    419            s->otherchn->rregs[R_IVEC] = IVEC_LONOINT;
    420        }
    421        s->rregs[R_INTR] &= ~INTR_RXINTA;
    422    } else {
    423        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    424            s->rregs[R_IVEC] = IVEC_HINOINT;
    425        } else {
    426            s->rregs[R_IVEC] = IVEC_LONOINT;
    427        }
    428        s->otherchn->rregs[R_INTR] &= ~INTR_RXINTB;
    429    }
    430    if (s->txint) {
    431        set_txint(s);
    432    }
    433    escc_update_irq(s);
    434}
    435
    436static inline void clr_txint(ESCCChannelState *s)
    437{
    438    s->txint = 0;
    439    s->txint_under_svc = 0;
    440    if (s->chn == escc_chn_a) {
    441        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    442            s->otherchn->rregs[R_IVEC] = IVEC_HINOINT;
    443        } else {
    444            s->otherchn->rregs[R_IVEC] = IVEC_LONOINT;
    445        }
    446        s->rregs[R_INTR] &= ~INTR_TXINTA;
    447    } else {
    448        s->otherchn->rregs[R_INTR] &= ~INTR_TXINTB;
    449        if (s->wregs[W_MINTR] & MINTR_STATUSHI) {
    450            s->rregs[R_IVEC] = IVEC_HINOINT;
    451        } else {
    452            s->rregs[R_IVEC] = IVEC_LONOINT;
    453        }
    454        s->otherchn->rregs[R_INTR] &= ~INTR_TXINTB;
    455    }
    456    if (s->rxint) {
    457        set_rxint(s);
    458    }
    459    escc_update_irq(s);
    460}
    461
    462static void escc_update_parameters(ESCCChannelState *s)
    463{
    464    int speed, parity, data_bits, stop_bits;
    465    QEMUSerialSetParams ssp;
    466
    467    if (!qemu_chr_fe_backend_connected(&s->chr) || s->type != escc_serial) {
    468        return;
    469    }
    470
    471    if (s->wregs[W_TXCTRL1] & TXCTRL1_PAREN) {
    472        if (s->wregs[W_TXCTRL1] & TXCTRL1_PAREV) {
    473            parity = 'E';
    474        } else {
    475            parity = 'O';
    476        }
    477    } else {
    478        parity = 'N';
    479    }
    480    if ((s->wregs[W_TXCTRL1] & TXCTRL1_STPMSK) == TXCTRL1_2STOP) {
    481        stop_bits = 2;
    482    } else {
    483        stop_bits = 1;
    484    }
    485    switch (s->wregs[W_TXCTRL2] & TXCTRL2_BITMSK) {
    486    case TXCTRL2_5BITS:
    487        data_bits = 5;
    488        break;
    489    case TXCTRL2_7BITS:
    490        data_bits = 7;
    491        break;
    492    case TXCTRL2_6BITS:
    493        data_bits = 6;
    494        break;
    495    default:
    496    case TXCTRL2_8BITS:
    497        data_bits = 8;
    498        break;
    499    }
    500    speed = s->clock / ((s->wregs[W_BRGLO] | (s->wregs[W_BRGHI] << 8)) + 2);
    501    switch (s->wregs[W_TXCTRL1] & TXCTRL1_CLKMSK) {
    502    case TXCTRL1_CLK1X:
    503        break;
    504    case TXCTRL1_CLK16X:
    505        speed /= 16;
    506        break;
    507    case TXCTRL1_CLK32X:
    508        speed /= 32;
    509        break;
    510    default:
    511    case TXCTRL1_CLK64X:
    512        speed /= 64;
    513        break;
    514    }
    515    ssp.speed = speed;
    516    ssp.parity = parity;
    517    ssp.data_bits = data_bits;
    518    ssp.stop_bits = stop_bits;
    519    trace_escc_update_parameters(CHN_C(s), speed, parity, data_bits, stop_bits);
    520    qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
    521}
    522
    523static void escc_mem_write(void *opaque, hwaddr addr,
    524                           uint64_t val, unsigned size)
    525{
    526    ESCCState *serial = opaque;
    527    ESCCChannelState *s;
    528    uint32_t saddr;
    529    int newreg, channel;
    530
    531    val &= 0xff;
    532    saddr = (addr >> reg_shift(serial)) & 1;
    533    channel = (addr >> chn_shift(serial)) & 1;
    534    s = &serial->chn[channel];
    535    switch (saddr) {
    536    case SERIAL_CTRL:
    537        trace_escc_mem_writeb_ctrl(CHN_C(s), s->reg, val & 0xff);
    538        newreg = 0;
    539        switch (s->reg) {
    540        case W_CMD:
    541            newreg = val & CMD_PTR_MASK;
    542            val &= CMD_CMD_MASK;
    543            switch (val) {
    544            case CMD_HI:
    545                newreg |= CMD_HI;
    546                break;
    547            case CMD_CLR_TXINT:
    548                clr_txint(s);
    549                break;
    550            case CMD_CLR_IUS:
    551                if (s->rxint_under_svc) {
    552                    s->rxint_under_svc = 0;
    553                    if (s->txint) {
    554                        set_txint(s);
    555                    }
    556                } else if (s->txint_under_svc) {
    557                    s->txint_under_svc = 0;
    558                }
    559                escc_update_irq(s);
    560                break;
    561            default:
    562                break;
    563            }
    564            break;
    565        case W_RXCTRL:
    566            s->wregs[s->reg] = val;
    567            if (val & RXCTRL_HUNT) {
    568                s->rregs[R_STATUS] |= STATUS_SYNC;
    569            }
    570            break;
    571        case W_INTR ... W_IVEC:
    572        case W_SYNC1 ... W_TXBUF:
    573        case W_MISC1 ... W_CLOCK:
    574        case W_MISC2 ... W_EXTINT:
    575            s->wregs[s->reg] = val;
    576            break;
    577        case W_TXCTRL1:
    578        case W_TXCTRL2:
    579            s->wregs[s->reg] = val;
    580            escc_update_parameters(s);
    581            break;
    582        case W_BRGLO:
    583        case W_BRGHI:
    584            s->wregs[s->reg] = val;
    585            s->rregs[s->reg] = val;
    586            escc_update_parameters(s);
    587            break;
    588        case W_MINTR:
    589            switch (val & MINTR_RST_MASK) {
    590            case 0:
    591            default:
    592                break;
    593            case MINTR_RST_B:
    594                trace_escc_soft_reset_chn(CHN_C(&serial->chn[0]));
    595                escc_soft_reset_chn(&serial->chn[0]);
    596                return;
    597            case MINTR_RST_A:
    598                trace_escc_soft_reset_chn(CHN_C(&serial->chn[1]));
    599                escc_soft_reset_chn(&serial->chn[1]);
    600                return;
    601            case MINTR_RST_ALL:
    602                trace_escc_hard_reset();
    603                escc_hard_reset_chn(&serial->chn[0]);
    604                escc_hard_reset_chn(&serial->chn[1]);
    605                return;
    606            }
    607            break;
    608        default:
    609            break;
    610        }
    611        if (s->reg == 0) {
    612            s->reg = newreg;
    613        } else {
    614            s->reg = 0;
    615        }
    616        break;
    617    case SERIAL_DATA:
    618        trace_escc_mem_writeb_data(CHN_C(s), val);
    619        /*
    620         * Lower the irq when data is written to the Tx buffer and no other
    621         * interrupts are currently pending. The irq will be raised again once
    622         * the Tx buffer becomes empty below.
    623         */
    624        s->txint = 0;
    625        escc_update_irq(s);
    626        s->tx = val;
    627        if (s->wregs[W_TXCTRL2] & TXCTRL2_TXEN) { /* tx enabled */
    628            if (qemu_chr_fe_backend_connected(&s->chr)) {
    629                /*
    630                 * XXX this blocks entire thread. Rewrite to use
    631                 * qemu_chr_fe_write and background I/O callbacks
    632                 */
    633                qemu_chr_fe_write_all(&s->chr, &s->tx, 1);
    634            } else if (s->type == escc_kbd && !s->disabled) {
    635                handle_kbd_command(s, val);
    636            }
    637        }
    638        s->rregs[R_STATUS] |= STATUS_TXEMPTY; /* Tx buffer empty */
    639        s->rregs[R_SPEC] |= SPEC_ALLSENT; /* All sent */
    640        set_txint(s);
    641        break;
    642    default:
    643        break;
    644    }
    645}
    646
    647static uint64_t escc_mem_read(void *opaque, hwaddr addr,
    648                              unsigned size)
    649{
    650    ESCCState *serial = opaque;
    651    ESCCChannelState *s;
    652    uint32_t saddr;
    653    uint32_t ret;
    654    int channel;
    655
    656    saddr = (addr >> reg_shift(serial)) & 1;
    657    channel = (addr >> chn_shift(serial)) & 1;
    658    s = &serial->chn[channel];
    659    switch (saddr) {
    660    case SERIAL_CTRL:
    661        trace_escc_mem_readb_ctrl(CHN_C(s), s->reg, s->rregs[s->reg]);
    662        ret = s->rregs[s->reg];
    663        s->reg = 0;
    664        return ret;
    665    case SERIAL_DATA:
    666        s->rregs[R_STATUS] &= ~STATUS_RXAV;
    667        clr_rxint(s);
    668        if (s->type == escc_kbd || s->type == escc_mouse) {
    669            ret = get_queue(s);
    670        } else {
    671            ret = s->rx;
    672        }
    673        trace_escc_mem_readb_data(CHN_C(s), ret);
    674        qemu_chr_fe_accept_input(&s->chr);
    675        return ret;
    676    default:
    677        break;
    678    }
    679    return 0;
    680}
    681
    682static const MemoryRegionOps escc_mem_ops = {
    683    .read = escc_mem_read,
    684    .write = escc_mem_write,
    685    .endianness = DEVICE_NATIVE_ENDIAN,
    686    .valid = {
    687        .min_access_size = 1,
    688        .max_access_size = 1,
    689    },
    690};
    691
    692static int serial_can_receive(void *opaque)
    693{
    694    ESCCChannelState *s = opaque;
    695    int ret;
    696
    697    if (((s->wregs[W_RXCTRL] & RXCTRL_RXEN) == 0) /* Rx not enabled */
    698        || ((s->rregs[R_STATUS] & STATUS_RXAV) == STATUS_RXAV)) {
    699        /* char already available */
    700        ret = 0;
    701    } else {
    702        ret = 1;
    703    }
    704    return ret;
    705}
    706
    707static void serial_receive_byte(ESCCChannelState *s, int ch)
    708{
    709    trace_escc_serial_receive_byte(CHN_C(s), ch);
    710    s->rregs[R_STATUS] |= STATUS_RXAV;
    711    s->rx = ch;
    712    set_rxint(s);
    713}
    714
    715static void serial_receive_break(ESCCChannelState *s)
    716{
    717    s->rregs[R_STATUS] |= STATUS_BRK;
    718    escc_update_irq(s);
    719}
    720
    721static void serial_receive1(void *opaque, const uint8_t *buf, int size)
    722{
    723    ESCCChannelState *s = opaque;
    724    serial_receive_byte(s, buf[0]);
    725}
    726
    727static void serial_event(void *opaque, QEMUChrEvent event)
    728{
    729    ESCCChannelState *s = opaque;
    730    if (event == CHR_EVENT_BREAK) {
    731        serial_receive_break(s);
    732    }
    733}
    734
    735static const VMStateDescription vmstate_escc_chn = {
    736    .name = "escc_chn",
    737    .version_id = 2,
    738    .minimum_version_id = 1,
    739    .fields = (VMStateField[]) {
    740        VMSTATE_UINT32(vmstate_dummy, ESCCChannelState),
    741        VMSTATE_UINT32(reg, ESCCChannelState),
    742        VMSTATE_UINT32(rxint, ESCCChannelState),
    743        VMSTATE_UINT32(txint, ESCCChannelState),
    744        VMSTATE_UINT32(rxint_under_svc, ESCCChannelState),
    745        VMSTATE_UINT32(txint_under_svc, ESCCChannelState),
    746        VMSTATE_UINT8(rx, ESCCChannelState),
    747        VMSTATE_UINT8(tx, ESCCChannelState),
    748        VMSTATE_BUFFER(wregs, ESCCChannelState),
    749        VMSTATE_BUFFER(rregs, ESCCChannelState),
    750        VMSTATE_END_OF_LIST()
    751    }
    752};
    753
    754static const VMStateDescription vmstate_escc = {
    755    .name = "escc",
    756    .version_id = 2,
    757    .minimum_version_id = 1,
    758    .fields = (VMStateField[]) {
    759        VMSTATE_STRUCT_ARRAY(chn, ESCCState, 2, 2, vmstate_escc_chn,
    760                             ESCCChannelState),
    761        VMSTATE_END_OF_LIST()
    762    }
    763};
    764
    765static void sunkbd_handle_event(DeviceState *dev, QemuConsole *src,
    766                                InputEvent *evt)
    767{
    768    ESCCChannelState *s = (ESCCChannelState *)dev;
    769    int qcode, keycode;
    770    InputKeyEvent *key;
    771
    772    assert(evt->type == INPUT_EVENT_KIND_KEY);
    773    key = evt->u.key.data;
    774    qcode = qemu_input_key_value_to_qcode(key->key);
    775    trace_escc_sunkbd_event_in(qcode, QKeyCode_str(qcode),
    776                               key->down);
    777
    778    if (qcode == Q_KEY_CODE_CAPS_LOCK) {
    779        if (key->down) {
    780            s->caps_lock_mode ^= 1;
    781            if (s->caps_lock_mode == 2) {
    782                return; /* Drop second press */
    783            }
    784        } else {
    785            s->caps_lock_mode ^= 2;
    786            if (s->caps_lock_mode == 3) {
    787                return; /* Drop first release */
    788            }
    789        }
    790    }
    791
    792    if (qcode == Q_KEY_CODE_NUM_LOCK) {
    793        if (key->down) {
    794            s->num_lock_mode ^= 1;
    795            if (s->num_lock_mode == 2) {
    796                return; /* Drop second press */
    797            }
    798        } else {
    799            s->num_lock_mode ^= 2;
    800            if (s->num_lock_mode == 3) {
    801                return; /* Drop first release */
    802            }
    803        }
    804    }
    805
    806    if (qcode > qemu_input_map_qcode_to_sun_len) {
    807        return;
    808    }
    809
    810    keycode = qemu_input_map_qcode_to_sun[qcode];
    811    if (!key->down) {
    812        keycode |= 0x80;
    813    }
    814    trace_escc_sunkbd_event_out(keycode);
    815    put_queue(s, keycode);
    816}
    817
    818static QemuInputHandler sunkbd_handler = {
    819    .name  = "sun keyboard",
    820    .mask  = INPUT_EVENT_MASK_KEY,
    821    .event = sunkbd_handle_event,
    822};
    823
    824static void handle_kbd_command(ESCCChannelState *s, int val)
    825{
    826    trace_escc_kbd_command(val);
    827    if (s->led_mode) { /* Ignore led byte */
    828        s->led_mode = 0;
    829        return;
    830    }
    831    switch (val) {
    832    case 1: /* Reset, return type code */
    833        clear_queue(s);
    834        put_queue(s, 0xff);
    835        put_queue(s, 4); /* Type 4 */
    836        put_queue(s, 0x7f);
    837        break;
    838    case 0xe: /* Set leds */
    839        s->led_mode = 1;
    840        break;
    841    case 7: /* Query layout */
    842    case 0xf:
    843        clear_queue(s);
    844        put_queue(s, 0xfe);
    845        put_queue(s, 0x21); /*  en-us layout */
    846        break;
    847    default:
    848        break;
    849    }
    850}
    851
    852static void sunmouse_event(void *opaque,
    853                               int dx, int dy, int dz, int buttons_state)
    854{
    855    ESCCChannelState *s = opaque;
    856    int ch;
    857
    858    trace_escc_sunmouse_event(dx, dy, buttons_state);
    859    ch = 0x80 | 0x7; /* protocol start byte, no buttons pressed */
    860
    861    if (buttons_state & MOUSE_EVENT_LBUTTON) {
    862        ch ^= 0x4;
    863    }
    864    if (buttons_state & MOUSE_EVENT_MBUTTON) {
    865        ch ^= 0x2;
    866    }
    867    if (buttons_state & MOUSE_EVENT_RBUTTON) {
    868        ch ^= 0x1;
    869    }
    870
    871    put_queue(s, ch);
    872
    873    ch = dx;
    874
    875    if (ch > 127) {
    876        ch = 127;
    877    } else if (ch < -127) {
    878        ch = -127;
    879    }
    880
    881    put_queue(s, ch & 0xff);
    882
    883    ch = -dy;
    884
    885    if (ch > 127) {
    886        ch = 127;
    887    } else if (ch < -127) {
    888        ch = -127;
    889    }
    890
    891    put_queue(s, ch & 0xff);
    892
    893    /* MSC protocol specifies two extra motion bytes */
    894
    895    put_queue(s, 0);
    896    put_queue(s, 0);
    897}
    898
    899static void escc_init1(Object *obj)
    900{
    901    ESCCState *s = ESCC(obj);
    902    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
    903    unsigned int i;
    904
    905    for (i = 0; i < 2; i++) {
    906        sysbus_init_irq(dev, &s->chn[i].irq);
    907        s->chn[i].chn = 1 - i;
    908    }
    909    s->chn[0].otherchn = &s->chn[1];
    910    s->chn[1].otherchn = &s->chn[0];
    911
    912    sysbus_init_mmio(dev, &s->mmio);
    913}
    914
    915static void escc_realize(DeviceState *dev, Error **errp)
    916{
    917    ESCCState *s = ESCC(dev);
    918    unsigned int i;
    919
    920    s->chn[0].disabled = s->disabled;
    921    s->chn[1].disabled = s->disabled;
    922
    923    memory_region_init_io(&s->mmio, OBJECT(dev), &escc_mem_ops, s, "escc",
    924                          ESCC_SIZE << s->it_shift);
    925
    926    for (i = 0; i < 2; i++) {
    927        if (qemu_chr_fe_backend_connected(&s->chn[i].chr)) {
    928            s->chn[i].clock = s->frequency / 2;
    929            qemu_chr_fe_set_handlers(&s->chn[i].chr, serial_can_receive,
    930                                     serial_receive1, serial_event, NULL,
    931                                     &s->chn[i], NULL, true);
    932        }
    933    }
    934
    935    if (s->chn[0].type == escc_mouse) {
    936        qemu_add_mouse_event_handler(sunmouse_event, &s->chn[0], 0,
    937                                     "QEMU Sun Mouse");
    938    }
    939    if (s->chn[1].type == escc_kbd) {
    940        s->chn[1].hs = qemu_input_handler_register((DeviceState *)(&s->chn[1]),
    941                                                   &sunkbd_handler);
    942    }
    943}
    944
    945static Property escc_properties[] = {
    946    DEFINE_PROP_UINT32("frequency", ESCCState, frequency,   0),
    947    DEFINE_PROP_UINT32("it_shift",  ESCCState, it_shift,    0),
    948    DEFINE_PROP_BOOL("bit_swap",    ESCCState, bit_swap,    false),
    949    DEFINE_PROP_UINT32("disabled",  ESCCState, disabled,    0),
    950    DEFINE_PROP_UINT32("chnBtype",  ESCCState, chn[0].type, 0),
    951    DEFINE_PROP_UINT32("chnAtype",  ESCCState, chn[1].type, 0),
    952    DEFINE_PROP_CHR("chrB", ESCCState, chn[0].chr),
    953    DEFINE_PROP_CHR("chrA", ESCCState, chn[1].chr),
    954    DEFINE_PROP_END_OF_LIST(),
    955};
    956
    957static void escc_class_init(ObjectClass *klass, void *data)
    958{
    959    DeviceClass *dc = DEVICE_CLASS(klass);
    960
    961    dc->reset = escc_reset;
    962    dc->realize = escc_realize;
    963    dc->vmsd = &vmstate_escc;
    964    device_class_set_props(dc, escc_properties);
    965    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
    966}
    967
    968static const TypeInfo escc_info = {
    969    .name          = TYPE_ESCC,
    970    .parent        = TYPE_SYS_BUS_DEVICE,
    971    .instance_size = sizeof(ESCCState),
    972    .instance_init = escc_init1,
    973    .class_init    = escc_class_init,
    974};
    975
    976static void escc_register_types(void)
    977{
    978    type_register_static(&escc_info);
    979}
    980
    981type_init(escc_register_types)