hw/input/tsc210x.c

   1 /*
   2  * TI TSC2102 (touchscreen/sensors/audio controller) emulator.
   3  * TI TSC2301 (touchscreen/sensors/keypad).
   4  *
   5  * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
   6  * Copyright (C) 2008 Nokia Corporation
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License as
  10  * published by the Free Software Foundation; either version 2 or
  11  * (at your option) version 3 of the License.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "hw/hw.h"
  24 #include "audio/audio.h"
  25 #include "qemu/timer.h"
  26 #include "qemu/log.h"
  27 #include "sysemu/reset.h"
  28 #include "ui/console.h"
  29 #include "hw/arm/omap.h"            /* For I2SCodec */
  30 #include "hw/input/tsc2xxx.h"
  31 #include "hw/irq.h"
  32 #include "migration/vmstate.h"
  33
  34 #define TSC_DATA_REGISTERS_PAGE         0x0
  35 #define TSC_CONTROL_REGISTERS_PAGE      0x1
  36 #define TSC_AUDIO_REGISTERS_PAGE        0x2
  37
  38 #define TSC_VERBOSE
  39
  40 #define TSC_CUT_RESOLUTION(value, p)    ((value) >> (16 - resolution[p]))
  41
  42 typedef struct {
  43     qemu_irq pint;
  44     qemu_irq kbint;
  45     qemu_irq davint;
  46     QEMUTimer *timer;
  47     QEMUSoundCard card;
  48     uWireSlave chip;
  49     I2SCodec codec;
  50     uint8_t in_fifo[16384];
  51     uint8_t out_fifo[16384];
  52     uint16_t model;
  53
  54     int32_t x, y;
  55     bool pressure;
  56
  57     uint8_t page, offset;
  58     uint16_t dav;
  59
  60     bool state;
  61     bool irq;
  62     bool command;
  63     bool busy;
  64     bool enabled;
  65     bool host_mode;
  66     uint8_t function, nextfunction;
  67     uint8_t precision, nextprecision;
  68     uint8_t filter;
  69     uint8_t pin_func;
  70     uint8_t ref;
  71     uint8_t timing;
  72     uint8_t noise;
  73
  74     uint16_t audio_ctrl1;
  75     uint16_t audio_ctrl2;
  76     uint16_t audio_ctrl3;
  77     uint16_t pll[3];
  78     uint16_t volume;
  79     int64_t volume_change;
  80     bool softstep;
  81     uint16_t dac_power;
  82     int64_t powerdown;
  83     uint16_t filter_data[0x14];
  84
  85     const char *name;
  86     SWVoiceIn *adc_voice[1];
  87     SWVoiceOut *dac_voice[1];
  88     int i2s_rx_rate;
  89     int i2s_tx_rate;
  90
  91     int tr[8];
  92
  93     struct {
  94         uint16_t down;
  95         uint16_t mask;
  96         int scan;
  97         int debounce;
  98         int mode;
  99         int intr;
 100     } kb;
 101     int64_t now; /* Time at migration */
 102 } TSC210xState;
 103
 104 static const int resolution[4] = { 12, 8, 10, 12 };
 105
 106 #define TSC_MODE_NO_SCAN        0x0
 107 #define TSC_MODE_XY_SCAN        0x1
 108 #define TSC_MODE_XYZ_SCAN       0x2
 109 #define TSC_MODE_X              0x3
 110 #define TSC_MODE_Y              0x4
 111 #define TSC_MODE_Z              0x5
 112 #define TSC_MODE_BAT1           0x6
 113 #define TSC_MODE_BAT2           0x7
 114 #define TSC_MODE_AUX            0x8
 115 #define TSC_MODE_AUX_SCAN       0x9
 116 #define TSC_MODE_TEMP1          0xa
 117 #define TSC_MODE_PORT_SCAN      0xb
 118 #define TSC_MODE_TEMP2          0xc
 119 #define TSC_MODE_XX_DRV         0xd
 120 #define TSC_MODE_YY_DRV         0xe
 121 #define TSC_MODE_YX_DRV         0xf
 122
 123 static const uint16_t mode_regs[16] = {
 124     0x0000,     /* No scan */
 125     0x0600,     /* X, Y scan */
 126     0x0780,     /* X, Y, Z scan */
 127     0x0400,     /* X */
 128     0x0200,     /* Y */
 129     0x0180,     /* Z */
 130     0x0040,     /* BAT1 */
 131     0x0030,     /* BAT2 */
 132     0x0010,     /* AUX */
 133     0x0010,     /* AUX scan */
 134     0x0004,     /* TEMP1 */
 135     0x0070,     /* Port scan */
 136     0x0002,     /* TEMP2 */
 137     0x0000,     /* X+, X- drivers */
 138     0x0000,     /* Y+, Y- drivers */
 139     0x0000,     /* Y+, X- drivers */
 140 };
 141
 142 #define X_TRANSFORM(s)                  \
 143     ((s->y * s->tr[0] - s->x * s->tr[1]) / s->tr[2] + s->tr[3])
 144 #define Y_TRANSFORM(s)                  \
 145     ((s->y * s->tr[4] - s->x * s->tr[5]) / s->tr[6] + s->tr[7])
 146 #define Z1_TRANSFORM(s)                 \
 147     ((400 - ((s)->x >> 7) + ((s)->pressure << 10)) << 4)
 148 #define Z2_TRANSFORM(s)                 \
 149     ((4000 + ((s)->y >> 7) - ((s)->pressure << 10)) << 4)
 150
 151 #define BAT1_VAL                        0x8660
 152 #define BAT2_VAL                        0x0000
 153 #define AUX1_VAL                        0x35c0
 154 #define AUX2_VAL                        0xffff
 155 #define TEMP1_VAL                       0x8c70
 156 #define TEMP2_VAL                       0xa5b0
 157
 158 #define TSC_POWEROFF_DELAY              50
 159 #define TSC_SOFTSTEP_DELAY              50
 160
 161 static void tsc210x_reset(TSC210xState *s)
 162 {
 163     s->state = false;
 164     s->pin_func = 2;
 165     s->enabled = false;
 166     s->busy = false;
 167     s->nextfunction = 0;
 168     s->ref = 0;
 169     s->timing = 0;
 170     s->irq = false;
 171     s->dav = 0;
 172
 173     s->audio_ctrl1 = 0x0000;
 174     s->audio_ctrl2 = 0x4410;
 175     s->audio_ctrl3 = 0x0000;
 176     s->pll[0] = 0x1004;
 177     s->pll[1] = 0x0000;
 178     s->pll[2] = 0x1fff;
 179     s->volume = 0xffff;
 180     s->dac_power = 0x8540;
 181     s->softstep = true;
 182     s->volume_change = 0;
 183     s->powerdown = 0;
 184     s->filter_data[0x00] = 0x6be3;
 185     s->filter_data[0x01] = 0x9666;
 186     s->filter_data[0x02] = 0x675d;
 187     s->filter_data[0x03] = 0x6be3;
 188     s->filter_data[0x04] = 0x9666;
 189     s->filter_data[0x05] = 0x675d;
 190     s->filter_data[0x06] = 0x7d83;
 191     s->filter_data[0x07] = 0x84ee;
 192     s->filter_data[0x08] = 0x7d83;
 193     s->filter_data[0x09] = 0x84ee;
 194     s->filter_data[0x0a] = 0x6be3;
 195     s->filter_data[0x0b] = 0x9666;
 196     s->filter_data[0x0c] = 0x675d;
 197     s->filter_data[0x0d] = 0x6be3;
 198     s->filter_data[0x0e] = 0x9666;
 199     s->filter_data[0x0f] = 0x675d;
 200     s->filter_data[0x10] = 0x7d83;
 201     s->filter_data[0x11] = 0x84ee;
 202     s->filter_data[0x12] = 0x7d83;
 203     s->filter_data[0x13] = 0x84ee;
 204
 205     s->i2s_tx_rate = 0;
 206     s->i2s_rx_rate = 0;
 207
 208     s->kb.scan = 1;
 209     s->kb.debounce = 0;
 210     s->kb.mask = 0x0000;
 211     s->kb.mode = 3;
 212     s->kb.intr = 0;
 213
 214     qemu_set_irq(s->pint, !s->irq);
 215     qemu_set_irq(s->davint, !s->dav);
 216     qemu_irq_raise(s->kbint);
 217 }
 218
 219 typedef struct {
 220     int rate;
 221     int dsor;
 222     int fsref;
 223 } TSC210xRateInfo;
 224
 225 /*  { rate,   dsor, fsref }     */
 226 static const TSC210xRateInfo tsc2102_rates[] = {
 227     /* Fsref / 6.0 */
 228     { 7350,     63,     1 },
 229     { 8000,     63,     0 },
 230     /* Fsref / 6.0 */
 231     { 7350,     54,     1 },
 232     { 8000,     54,     0 },
 233     /* Fsref / 5.0 */
 234     { 8820,     45,     1 },
 235     { 9600,     45,     0 },
 236     /* Fsref / 4.0 */
 237     { 11025,    36,     1 },
 238     { 12000,    36,     0 },
 239     /* Fsref / 3.0 */
 240     { 14700,    27,     1 },
 241     { 16000,    27,     0 },
 242     /* Fsref / 2.0 */
 243     { 22050,    18,     1 },
 244     { 24000,    18,     0 },
 245     /* Fsref / 1.5 */
 246     { 29400,    9,      1 },
 247     { 32000,    9,      0 },
 248     /* Fsref */
 249     { 44100,    0,      1 },
 250     { 48000,    0,      0 },
 251
 252     { 0,        0,      0 },
 253 };
 254
 255 static inline void tsc210x_out_flush(TSC210xState *s, int len)
 256 {
 257     uint8_t *data = s->codec.out.fifo + s->codec.out.start;
 258     uint8_t *end = data + len;
 259
 260     while (data < end)
 261         data += AUD_write(s->dac_voice[0], data, end - data) ?: (end - data);
 262
 263     s->codec.out.len -= len;
 264     if (s->codec.out.len)
 265         memmove(s->codec.out.fifo, end, s->codec.out.len);
 266     s->codec.out.start = 0;
 267 }
 268
 269 static void tsc210x_audio_out_cb(TSC210xState *s, int free_b)
 270 {
 271     if (s->codec.out.len >= free_b) {
 272         tsc210x_out_flush(s, free_b);
 273         return;
 274     }
 275
 276     s->codec.out.size = MIN(free_b, 16384);
 277     qemu_irq_raise(s->codec.tx_start);
 278 }
 279
 280 static void tsc2102_audio_rate_update(TSC210xState *s)
 281 {
 282     const TSC210xRateInfo *rate;
 283
 284     s->codec.tx_rate = 0;
 285     s->codec.rx_rate = 0;
 286     if (s->dac_power & (1 << 15))                               /* PWDNC */
 287         return;
 288
 289     for (rate = tsc2102_rates; rate->rate; rate ++)
 290         if (rate->dsor == (s->audio_ctrl1 & 0x3f) &&            /* DACFS */
 291                         rate->fsref == ((s->audio_ctrl3 >> 13) & 1))/* REFFS */
 292             break;
 293     if (!rate->rate) {
 294         printf("%s: unknown sampling rate configured\n", __func__);
 295         return;
 296     }
 297
 298     s->codec.tx_rate = rate->rate;
 299 }
 300
 301 static void tsc2102_audio_output_update(TSC210xState *s)
 302 {
 303     int enable;
 304     struct audsettings fmt;
 305
 306     if (s->dac_voice[0]) {
 307         tsc210x_out_flush(s, s->codec.out.len);
 308         s->codec.out.size = 0;
 309         AUD_set_active_out(s->dac_voice[0], 0);
 310         AUD_close_out(&s->card, s->dac_voice[0]);
 311         s->dac_voice[0] = NULL;
 312     }
 313     s->codec.cts = 0;
 314
 315     enable =
 316             (~s->dac_power & (1 << 15)) &&                      /* PWDNC */
 317             (~s->dac_power & (1 << 10));                        /* DAPWDN */
 318     if (!enable || !s->codec.tx_rate)
 319         return;
 320
 321     /* Force our own sampling rate even in slave DAC mode */
 322     fmt.endianness = 0;
 323     fmt.nchannels = 2;
 324     fmt.freq = s->codec.tx_rate;
 325     fmt.fmt = AUDIO_FORMAT_S16;
 326
 327     s->dac_voice[0] = AUD_open_out(&s->card, s->dac_voice[0],
 328                     "tsc2102.sink", s, (void *) tsc210x_audio_out_cb, &fmt);
 329     if (s->dac_voice[0]) {
 330         s->codec.cts = 1;
 331         AUD_set_active_out(s->dac_voice[0], 1);
 332     }
 333 }
 334
 335 static uint16_t tsc2102_data_register_read(TSC210xState *s, int reg)
 336 {
 337     switch (reg) {
 338     case 0x00:  /* X */
 339         s->dav &= 0xfbff;
 340         return TSC_CUT_RESOLUTION(X_TRANSFORM(s), s->precision) +
 341                 (s->noise & 3);
 342
 343     case 0x01:  /* Y */
 344         s->noise ++;
 345         s->dav &= 0xfdff;
 346         return TSC_CUT_RESOLUTION(Y_TRANSFORM(s), s->precision) ^
 347                 (s->noise & 3);
 348
 349     case 0x02:  /* Z1 */
 350         s->dav &= 0xfeff;
 351         return TSC_CUT_RESOLUTION(Z1_TRANSFORM(s), s->precision) -
 352                 (s->noise & 3);
 353
 354     case 0x03:  /* Z2 */
 355         s->dav &= 0xff7f;
 356         return TSC_CUT_RESOLUTION(Z2_TRANSFORM(s), s->precision) |
 357                 (s->noise & 3);
 358
 359     case 0x04:  /* KPData */
 360         if ((s->model & 0xff00) == 0x2300) {
 361             if (s->kb.intr && (s->kb.mode & 2)) {
 362                 s->kb.intr = 0;
 363                 qemu_irq_raise(s->kbint);
 364             }
 365             return s->kb.down;
 366         }
 367
 368         return 0xffff;
 369
 370     case 0x05:  /* BAT1 */
 371         s->dav &= 0xffbf;
 372         return TSC_CUT_RESOLUTION(BAT1_VAL, s->precision) +
 373                 (s->noise & 6);
 374
 375     case 0x06:  /* BAT2 */
 376         s->dav &= 0xffdf;
 377         return TSC_CUT_RESOLUTION(BAT2_VAL, s->precision);
 378
 379     case 0x07:  /* AUX1 */
 380         s->dav &= 0xffef;
 381         return TSC_CUT_RESOLUTION(AUX1_VAL, s->precision);
 382
 383     case 0x08:  /* AUX2 */
 384         s->dav &= 0xfff7;
 385         return 0xffff;
 386
 387     case 0x09:  /* TEMP1 */
 388         s->dav &= 0xfffb;
 389         return TSC_CUT_RESOLUTION(TEMP1_VAL, s->precision) -
 390                 (s->noise & 5);
 391
 392     case 0x0a:  /* TEMP2 */
 393         s->dav &= 0xfffd;
 394         return TSC_CUT_RESOLUTION(TEMP2_VAL, s->precision) ^
 395                 (s->noise & 3);
 396
 397     case 0x0b:  /* DAC */
 398         s->dav &= 0xfffe;
 399         return 0xffff;
 400
 401     default:
 402 #ifdef TSC_VERBOSE
 403         fprintf(stderr, "tsc2102_data_register_read: "
 404                         "no such register: 0x%02x\n", reg);
 405 #endif
 406         return 0xffff;
 407     }
 408 }
 409
 410 static uint16_t tsc2102_control_register_read(
 411                 TSC210xState *s, int reg)
 412 {
 413     switch (reg) {
 414     case 0x00:  /* TSC ADC */
 415         return (s->pressure << 15) | ((!s->busy) << 14) |
 416                 (s->nextfunction << 10) | (s->nextprecision << 8) | s->filter;
 417
 418     case 0x01:  /* Status / Keypad Control */
 419         if ((s->model & 0xff00) == 0x2100)
 420             return (s->pin_func << 14) | ((!s->enabled) << 13) |
 421                     (s->host_mode << 12) | ((!!s->dav) << 11) | s->dav;
 422         else
 423             return (s->kb.intr << 15) | ((s->kb.scan || !s->kb.down) << 14) |
 424                     (s->kb.debounce << 11);
 425
 426     case 0x02:  /* DAC Control */
 427         if ((s->model & 0xff00) == 0x2300)
 428             return s->dac_power & 0x8000;
 429         else
 430             goto bad_reg;
 431
 432     case 0x03:  /* Reference */
 433         return s->ref;
 434
 435     case 0x04:  /* Reset */
 436         return 0xffff;
 437
 438     case 0x05:  /* Configuration */
 439         return s->timing;
 440
 441     case 0x06:  /* Secondary configuration */
 442         if ((s->model & 0xff00) == 0x2100)
 443             goto bad_reg;
 444         return ((!s->dav) << 15) | ((s->kb.mode & 1) << 14) | s->pll[2];
 445
 446     case 0x10:  /* Keypad Mask */
 447         if ((s->model & 0xff00) == 0x2100)
 448             goto bad_reg;
 449         return s->kb.mask;
 450
 451     default:
 452     bad_reg:
 453 #ifdef TSC_VERBOSE
 454         fprintf(stderr, "tsc2102_control_register_read: "
 455                         "no such register: 0x%02x\n", reg);
 456 #endif
 457         return 0xffff;
 458     }
 459 }
 460
 461 static uint16_t tsc2102_audio_register_read(TSC210xState *s, int reg)
 462 {
 463     int l_ch, r_ch;
 464     uint16_t val;
 465
 466     switch (reg) {
 467     case 0x00:  /* Audio Control 1 */
 468         return s->audio_ctrl1;
 469
 470     case 0x01:
 471         return 0xff00;
 472
 473     case 0x02:  /* DAC Volume Control */
 474         return s->volume;
 475
 476     case 0x03:
 477         return 0x8b00;
 478
 479     case 0x04:  /* Audio Control 2 */
 480         l_ch = 1;
 481         r_ch = 1;
 482         if (s->softstep && !(s->dac_power & (1 << 10))) {
 483             l_ch = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) >
 484                             s->volume_change + TSC_SOFTSTEP_DELAY);
 485             r_ch = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) >
 486                             s->volume_change + TSC_SOFTSTEP_DELAY);
 487         }
 488
 489         return s->audio_ctrl2 | (l_ch << 3) | (r_ch << 2);
 490
 491     case 0x05:  /* Stereo DAC Power Control */
 492         return 0x2aa0 | s->dac_power |
 493                 (((s->dac_power & (1 << 10)) &&
 494                   (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) >
 495                    s->powerdown + TSC_POWEROFF_DELAY)) << 6);
 496
 497     case 0x06:  /* Audio Control 3 */
 498         val = s->audio_ctrl3 | 0x0001;
 499         s->audio_ctrl3 &= 0xff3f;
 500         return val;
 501
 502     case 0x07:  /* LCH_BASS_BOOST_N0 */
 503     case 0x08:  /* LCH_BASS_BOOST_N1 */
 504     case 0x09:  /* LCH_BASS_BOOST_N2 */
 505     case 0x0a:  /* LCH_BASS_BOOST_N3 */
 506     case 0x0b:  /* LCH_BASS_BOOST_N4 */
 507     case 0x0c:  /* LCH_BASS_BOOST_N5 */
 508     case 0x0d:  /* LCH_BASS_BOOST_D1 */
 509     case 0x0e:  /* LCH_BASS_BOOST_D2 */
 510     case 0x0f:  /* LCH_BASS_BOOST_D4 */
 511     case 0x10:  /* LCH_BASS_BOOST_D5 */
 512     case 0x11:  /* RCH_BASS_BOOST_N0 */
 513     case 0x12:  /* RCH_BASS_BOOST_N1 */
 514     case 0x13:  /* RCH_BASS_BOOST_N2 */
 515     case 0x14:  /* RCH_BASS_BOOST_N3 */
 516     case 0x15:  /* RCH_BASS_BOOST_N4 */
 517     case 0x16:  /* RCH_BASS_BOOST_N5 */
 518     case 0x17:  /* RCH_BASS_BOOST_D1 */
 519     case 0x18:  /* RCH_BASS_BOOST_D2 */
 520     case 0x19:  /* RCH_BASS_BOOST_D4 */
 521     case 0x1a:  /* RCH_BASS_BOOST_D5 */
 522         return s->filter_data[reg - 0x07];
 523
 524     case 0x1b:  /* PLL Programmability 1 */
 525         return s->pll[0];
 526
 527     case 0x1c:  /* PLL Programmability 2 */
 528         return s->pll[1];
 529
 530     case 0x1d:  /* Audio Control 4 */
 531         return (!s->softstep) << 14;
 532
 533     default:
 534 #ifdef TSC_VERBOSE
 535         fprintf(stderr, "tsc2102_audio_register_read: "
 536                         "no such register: 0x%02x\n", reg);
 537 #endif
 538         return 0xffff;
 539     }
 540 }
 541
 542 static void tsc2102_data_register_write(
 543                 TSC210xState *s, int reg, uint16_t value)
 544 {
 545     switch (reg) {
 546     case 0x00:  /* X */
 547     case 0x01:  /* Y */
 548     case 0x02:  /* Z1 */
 549     case 0x03:  /* Z2 */
 550     case 0x05:  /* BAT1 */
 551     case 0x06:  /* BAT2 */
 552     case 0x07:  /* AUX1 */
 553     case 0x08:  /* AUX2 */
 554     case 0x09:  /* TEMP1 */
 555     case 0x0a:  /* TEMP2 */
 556         return;
 557
 558     default:
 559         qemu_log_mask(LOG_GUEST_ERROR, "tsc2102_data_register_write: "
 560                                        "no such register: 0x%02x\n", reg);
 561     }
 562 }
 563
 564 static void tsc2102_control_register_write(
 565                 TSC210xState *s, int reg, uint16_t value)
 566 {
 567     switch (reg) {
 568     case 0x00:  /* TSC ADC */
 569         s->host_mode = value >> 15;
 570         s->enabled = !(value & 0x4000);
 571         if (s->busy && !s->enabled)
 572             timer_del(s->timer);
 573         s->busy = s->busy && s->enabled;
 574         s->nextfunction = (value >> 10) & 0xf;
 575         s->nextprecision = (value >> 8) & 3;
 576         s->filter = value & 0xff;
 577         return;
 578
 579     case 0x01:  /* Status / Keypad Control */
 580         if ((s->model & 0xff00) == 0x2100)
 581             s->pin_func = value >> 14;
 582         else {
 583             s->kb.scan = (value >> 14) & 1;
 584             s->kb.debounce = (value >> 11) & 7;
 585             if (s->kb.intr && s->kb.scan) {
 586                 s->kb.intr = 0;
 587                 qemu_irq_raise(s->kbint);
 588             }
 589         }
 590         return;
 591
 592     case 0x02:  /* DAC Control */
 593         if ((s->model & 0xff00) == 0x2300) {
 594             s->dac_power &= 0x7fff;
 595             s->dac_power |= 0x8000 & value;
 596         } else
 597             goto bad_reg;
 598         break;
 599
 600     case 0x03:  /* Reference */
 601         s->ref = value & 0x1f;
 602         return;
 603
 604     case 0x04:  /* Reset */
 605         if (value == 0xbb00) {
 606             if (s->busy)
 607                 timer_del(s->timer);
 608             tsc210x_reset(s);
 609 #ifdef TSC_VERBOSE
 610         } else {
 611             fprintf(stderr, "tsc2102_control_register_write: "
 612                             "wrong value written into RESET\n");
 613 #endif
 614         }
 615         return;
 616
 617     case 0x05:  /* Configuration */
 618         s->timing = value & 0x3f;
 619 #ifdef TSC_VERBOSE
 620         if (value & ~0x3f)
 621             fprintf(stderr, "tsc2102_control_register_write: "
 622                             "wrong value written into CONFIG\n");
 623 #endif
 624         return;
 625
 626     case 0x06:  /* Secondary configuration */
 627         if ((s->model & 0xff00) == 0x2100)
 628             goto bad_reg;
 629         s->kb.mode = value >> 14;
 630         s->pll[2] = value & 0x3ffff;
 631         return;
 632
 633     case 0x10:  /* Keypad Mask */
 634         if ((s->model & 0xff00) == 0x2100)
 635             goto bad_reg;
 636         s->kb.mask = value;
 637         return;
 638
 639     default:
 640     bad_reg:
 641         qemu_log_mask(LOG_GUEST_ERROR, "tsc2102_control_register_write: "
 642                                        "no such register: 0x%02x\n", reg);
 643     }
 644 }
 645
 646 static void tsc2102_audio_register_write(
 647                 TSC210xState *s, int reg, uint16_t value)
 648 {
 649     switch (reg) {
 650     case 0x00:  /* Audio Control 1 */
 651         s->audio_ctrl1 = value & 0x0f3f;
 652 #ifdef TSC_VERBOSE
 653         if ((value & ~0x0f3f) || ((value & 7) != ((value >> 3) & 7)))
 654             fprintf(stderr, "tsc2102_audio_register_write: "
 655                             "wrong value written into Audio 1\n");
 656 #endif
 657         tsc2102_audio_rate_update(s);
 658         tsc2102_audio_output_update(s);
 659         return;
 660
 661     case 0x01:
 662 #ifdef TSC_VERBOSE
 663         if (value != 0xff00)
 664             fprintf(stderr, "tsc2102_audio_register_write: "
 665                             "wrong value written into reg 0x01\n");
 666 #endif
 667         return;
 668
 669     case 0x02:  /* DAC Volume Control */
 670         s->volume = value;
 671         s->volume_change = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 672         return;
 673
 674     case 0x03:
 675 #ifdef TSC_VERBOSE
 676         if (value != 0x8b00)
 677             fprintf(stderr, "tsc2102_audio_register_write: "
 678                             "wrong value written into reg 0x03\n");
 679 #endif
 680         return;
 681
 682     case 0x04:  /* Audio Control 2 */
 683         s->audio_ctrl2 = value & 0xf7f2;
 684 #ifdef TSC_VERBOSE
 685         if (value & ~0xf7fd)
 686             fprintf(stderr, "tsc2102_audio_register_write: "
 687                             "wrong value written into Audio 2\n");
 688 #endif
 689         return;
 690
 691     case 0x05:  /* Stereo DAC Power Control */
 692         if ((value & ~s->dac_power) & (1 << 10))
 693             s->powerdown = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 694
 695         s->dac_power = value & 0x9543;
 696 #ifdef TSC_VERBOSE
 697         if ((value & ~0x9543) != 0x2aa0)
 698             fprintf(stderr, "tsc2102_audio_register_write: "
 699                             "wrong value written into Power\n");
 700 #endif
 701         tsc2102_audio_rate_update(s);
 702         tsc2102_audio_output_update(s);
 703         return;
 704
 705     case 0x06:  /* Audio Control 3 */
 706         s->audio_ctrl3 &= 0x00c0;
 707         s->audio_ctrl3 |= value & 0xf800;
 708 #ifdef TSC_VERBOSE
 709         if (value & ~0xf8c7)
 710             fprintf(stderr, "tsc2102_audio_register_write: "
 711                             "wrong value written into Audio 3\n");
 712 #endif
 713         tsc2102_audio_output_update(s);
 714         return;
 715
 716     case 0x07:  /* LCH_BASS_BOOST_N0 */
 717     case 0x08:  /* LCH_BASS_BOOST_N1 */
 718     case 0x09:  /* LCH_BASS_BOOST_N2 */
 719     case 0x0a:  /* LCH_BASS_BOOST_N3 */
 720     case 0x0b:  /* LCH_BASS_BOOST_N4 */
 721     case 0x0c:  /* LCH_BASS_BOOST_N5 */
 722     case 0x0d:  /* LCH_BASS_BOOST_D1 */
 723     case 0x0e:  /* LCH_BASS_BOOST_D2 */
 724     case 0x0f:  /* LCH_BASS_BOOST_D4 */
 725     case 0x10:  /* LCH_BASS_BOOST_D5 */
 726     case 0x11:  /* RCH_BASS_BOOST_N0 */
 727     case 0x12:  /* RCH_BASS_BOOST_N1 */
 728     case 0x13:  /* RCH_BASS_BOOST_N2 */
 729     case 0x14:  /* RCH_BASS_BOOST_N3 */
 730     case 0x15:  /* RCH_BASS_BOOST_N4 */
 731     case 0x16:  /* RCH_BASS_BOOST_N5 */
 732     case 0x17:  /* RCH_BASS_BOOST_D1 */
 733     case 0x18:  /* RCH_BASS_BOOST_D2 */
 734     case 0x19:  /* RCH_BASS_BOOST_D4 */
 735     case 0x1a:  /* RCH_BASS_BOOST_D5 */
 736         s->filter_data[reg - 0x07] = value;
 737         return;
 738
 739     case 0x1b:  /* PLL Programmability 1 */
 740         s->pll[0] = value & 0xfffc;
 741 #ifdef TSC_VERBOSE
 742         if (value & ~0xfffc)
 743             fprintf(stderr, "tsc2102_audio_register_write: "
 744                             "wrong value written into PLL 1\n");
 745 #endif
 746         return;
 747
 748     case 0x1c:  /* PLL Programmability 2 */
 749         s->pll[1] = value & 0xfffc;
 750 #ifdef TSC_VERBOSE
 751         if (value & ~0xfffc)
 752             fprintf(stderr, "tsc2102_audio_register_write: "
 753                             "wrong value written into PLL 2\n");
 754 #endif
 755         return;
 756
 757     case 0x1d:  /* Audio Control 4 */
 758         s->softstep = !(value & 0x4000);
 759 #ifdef TSC_VERBOSE
 760         if (value & ~0x4000)
 761             fprintf(stderr, "tsc2102_audio_register_write: "
 762                             "wrong value written into Audio 4\n");
 763 #endif
 764         return;
 765
 766     default:
 767         qemu_log_mask(LOG_GUEST_ERROR, "tsc2102_audio_register_write: "
 768                                        "no such register: 0x%02x\n", reg);
 769     }
 770 }
 771
 772 /* This handles most of the chip logic.  */
 773 static void tsc210x_pin_update(TSC210xState *s)
 774 {
 775     int64_t expires;
 776     bool pin_state;
 777
 778     switch (s->pin_func) {
 779     case 0:
 780         pin_state = s->pressure;
 781         break;
 782     case 1:
 783         pin_state = !!s->dav;
 784         break;
 785     case 2:
 786     default:
 787         pin_state = s->pressure && !s->dav;
 788     }
 789
 790     if (!s->enabled)
 791         pin_state = false;
 792
 793     if (pin_state != s->irq) {
 794         s->irq = pin_state;
 795         qemu_set_irq(s->pint, !s->irq);
 796     }
 797
 798     switch (s->nextfunction) {
 799     case TSC_MODE_XY_SCAN:
 800     case TSC_MODE_XYZ_SCAN:
 801         if (!s->pressure)
 802             return;
 803         break;
 804
 805     case TSC_MODE_X:
 806     case TSC_MODE_Y:
 807     case TSC_MODE_Z:
 808         if (!s->pressure)
 809             return;
 810         /* Fall through */
 811     case TSC_MODE_BAT1:
 812     case TSC_MODE_BAT2:
 813     case TSC_MODE_AUX:
 814     case TSC_MODE_TEMP1:
 815     case TSC_MODE_TEMP2:
 816         if (s->dav)
 817             s->enabled = false;
 818         break;
 819
 820     case TSC_MODE_AUX_SCAN:
 821     case TSC_MODE_PORT_SCAN:
 822         break;
 823
 824     case TSC_MODE_NO_SCAN:
 825     case TSC_MODE_XX_DRV:
 826     case TSC_MODE_YY_DRV:
 827     case TSC_MODE_YX_DRV:
 828     default:
 829         return;
 830     }
 831
 832     if (!s->enabled || s->busy || s->dav)
 833         return;
 834
 835     s->busy = true;
 836     s->precision = s->nextprecision;
 837     s->function = s->nextfunction;
 838     expires = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 839         (NANOSECONDS_PER_SECOND >> 10);
 840     timer_mod(s->timer, expires);
 841 }
 842
 843 static uint16_t tsc210x_read(TSC210xState *s)
 844 {
 845     uint16_t ret = 0x0000;
 846
 847     if (!s->command)
 848         fprintf(stderr, "tsc210x_read: SPI underrun!\n");
 849
 850     switch (s->page) {
 851     case TSC_DATA_REGISTERS_PAGE:
 852         ret = tsc2102_data_register_read(s, s->offset);
 853         if (!s->dav)
 854             qemu_irq_raise(s->davint);
 855         break;
 856     case TSC_CONTROL_REGISTERS_PAGE:
 857         ret = tsc2102_control_register_read(s, s->offset);
 858         break;
 859     case TSC_AUDIO_REGISTERS_PAGE:
 860         ret = tsc2102_audio_register_read(s, s->offset);
 861         break;
 862     default:
 863         hw_error("tsc210x_read: wrong memory page\n");
 864     }
 865
 866     tsc210x_pin_update(s);
 867
 868     /* Allow sequential reads.  */
 869     s->offset ++;
 870     s->state = false;
 871     return ret;
 872 }
 873
 874 static void tsc210x_write(TSC210xState *s, uint16_t value)
 875 {
 876     /*
 877      * This is a two-state state machine for reading
 878      * command and data every second time.
 879      */
 880     if (!s->state) {
 881         s->command = (value >> 15) != 0;
 882         s->page = (value >> 11) & 0x0f;
 883         s->offset = (value >> 5) & 0x3f;
 884         s->state = true;
 885     } else {
 886         if (s->command)
 887             fprintf(stderr, "tsc210x_write: SPI overrun!\n");
 888         else
 889             switch (s->page) {
 890             case TSC_DATA_REGISTERS_PAGE:
 891                 tsc2102_data_register_write(s, s->offset, value);
 892                 break;
 893             case TSC_CONTROL_REGISTERS_PAGE:
 894                 tsc2102_control_register_write(s, s->offset, value);
 895                 break;
 896             case TSC_AUDIO_REGISTERS_PAGE:
 897                 tsc2102_audio_register_write(s, s->offset, value);
 898                 break;
 899             default:
 900                 hw_error("tsc210x_write: wrong memory page\n");
 901             }
 902
 903         tsc210x_pin_update(s);
 904         s->state = false;
 905     }
 906 }
 907
 908 uint32_t tsc210x_txrx(void *opaque, uint32_t value, int len)
 909 {
 910     TSC210xState *s = opaque;
 911     uint32_t ret = 0;
 912
 913     if (len != 16) {
 914         qemu_log_mask(LOG_GUEST_ERROR,
 915                       "%s: bad SPI word width %i\n", __func__, len);
 916         return 0;
 917     }
 918
 919     /* TODO: sequential reads etc - how do we make sure the host doesn't
 920      * unintentionally read out a conversion result from a register while
 921      * transmitting the command word of the next command?  */
 922     if (!value || (s->state && s->command))
 923         ret = tsc210x_read(s);
 924     if (value || (s->state && !s->command))
 925         tsc210x_write(s, value);
 926
 927     return ret;
 928 }
 929
 930 static void tsc210x_timer_tick(void *opaque)
 931 {
 932     TSC210xState *s = opaque;
 933
 934     /* Timer ticked -- a set of conversions has been finished.  */
 935
 936     if (!s->busy)
 937         return;
 938
 939     s->busy = false;
 940     s->dav |= mode_regs[s->function];
 941     tsc210x_pin_update(s);
 942     qemu_irq_lower(s->davint);
 943 }
 944
 945 static void tsc210x_touchscreen_event(void *opaque,
 946                 int x, int y, int z, int buttons_state)
 947 {
 948     TSC210xState *s = opaque;
 949     int p = s->pressure;
 950
 951     if (buttons_state) {
 952         s->x = x;
 953         s->y = y;
 954     }
 955     s->pressure = !!buttons_state;
 956
 957     /*
 958      * Note: We would get better responsiveness in the guest by
 959      * signaling TS events immediately, but for now we simulate
 960      * the first conversion delay for sake of correctness.
 961      */
 962     if (p != s->pressure)
 963         tsc210x_pin_update(s);
 964 }
 965
 966 static void tsc210x_i2s_swallow(TSC210xState *s)
 967 {
 968     if (s->dac_voice[0])
 969         tsc210x_out_flush(s, s->codec.out.len);
 970     else
 971         s->codec.out.len = 0;
 972 }
 973
 974 static void tsc210x_i2s_set_rate(TSC210xState *s, int in, int out)
 975 {
 976     s->i2s_tx_rate = out;
 977     s->i2s_rx_rate = in;
 978 }
 979
 980 static int tsc210x_pre_save(void *opaque)
 981 {
 982     TSC210xState *s = (TSC210xState *) opaque;
 983     s->now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 984
 985     return 0;
 986 }
 987
 988 static int tsc210x_post_load(void *opaque, int version_id)
 989 {
 990     TSC210xState *s = (TSC210xState *) opaque;
 991     int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 992
 993     if (s->function >= ARRAY_SIZE(mode_regs)) {
 994         return -EINVAL;
 995     }
 996     if (s->nextfunction >= ARRAY_SIZE(mode_regs)) {
 997         return -EINVAL;
 998     }
 999     if (s->precision >= ARRAY_SIZE(resolution)) {
1000         return -EINVAL;
1001     }
1002     if (s->nextprecision >= ARRAY_SIZE(resolution)) {
1003         return -EINVAL;
1004     }
1005
1006     s->volume_change -= s->now;
1007     s->volume_change += now;
1008     s->powerdown -= s->now;
1009     s->powerdown += now;
1010
1011     s->busy = timer_pending(s->timer);
1012     qemu_set_irq(s->pint, !s->irq);
1013     qemu_set_irq(s->davint, !s->dav);
1014
1015     return 0;
1016 }
1017
1018 static VMStateField vmstatefields_tsc210x[] = {
1019     VMSTATE_BOOL(enabled, TSC210xState),
1020     VMSTATE_BOOL(host_mode, TSC210xState),
1021     VMSTATE_BOOL(irq, TSC210xState),
1022     VMSTATE_BOOL(command, TSC210xState),
1023     VMSTATE_BOOL(pressure, TSC210xState),
1024     VMSTATE_BOOL(softstep, TSC210xState),
1025     VMSTATE_BOOL(state, TSC210xState),
1026     VMSTATE_UINT16(dav, TSC210xState),
1027     VMSTATE_INT32(x, TSC210xState),
1028     VMSTATE_INT32(y, TSC210xState),
1029     VMSTATE_UINT8(offset, TSC210xState),
1030     VMSTATE_UINT8(page, TSC210xState),
1031     VMSTATE_UINT8(filter, TSC210xState),
1032     VMSTATE_UINT8(pin_func, TSC210xState),
1033     VMSTATE_UINT8(ref, TSC210xState),
1034     VMSTATE_UINT8(timing, TSC210xState),
1035     VMSTATE_UINT8(noise, TSC210xState),
1036     VMSTATE_UINT8(function, TSC210xState),
1037     VMSTATE_UINT8(nextfunction, TSC210xState),
1038     VMSTATE_UINT8(precision, TSC210xState),
1039     VMSTATE_UINT8(nextprecision, TSC210xState),
1040     VMSTATE_UINT16(audio_ctrl1, TSC210xState),
1041     VMSTATE_UINT16(audio_ctrl2, TSC210xState),
1042     VMSTATE_UINT16(audio_ctrl3, TSC210xState),
1043     VMSTATE_UINT16_ARRAY(pll, TSC210xState, 3),
1044     VMSTATE_UINT16(volume, TSC210xState),
1045     VMSTATE_UINT16(dac_power, TSC210xState),
1046     VMSTATE_INT64(volume_change, TSC210xState),
1047     VMSTATE_INT64(powerdown, TSC210xState),
1048     VMSTATE_INT64(now, TSC210xState),
1049     VMSTATE_UINT16_ARRAY(filter_data, TSC210xState, 0x14),
1050     VMSTATE_TIMER_PTR(timer, TSC210xState),
1051     VMSTATE_END_OF_LIST()
1052 };
1053
1054 static const VMStateDescription vmstate_tsc2102 = {
1055     .name = "tsc2102",
1056     .version_id = 1,
1057     .minimum_version_id = 1,
1058     .pre_save = tsc210x_pre_save,
1059     .post_load = tsc210x_post_load,
1060     .fields = vmstatefields_tsc210x,
1061 };
1062
1063 static const VMStateDescription vmstate_tsc2301 = {
1064     .name = "tsc2301",
1065     .version_id = 1,
1066     .minimum_version_id = 1,
1067     .pre_save = tsc210x_pre_save,
1068     .post_load = tsc210x_post_load,
1069     .fields = vmstatefields_tsc210x,
1070 };
1071
1072 uWireSlave *tsc2102_init(qemu_irq pint)
1073 {
1074     TSC210xState *s;
1075
1076     s = g_new0(TSC210xState, 1);
1077     s->x = 160;
1078     s->y = 160;
1079     s->pressure = 0;
1080     s->precision = s->nextprecision = 0;
1081     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, tsc210x_timer_tick, s);
1082     s->pint = pint;
1083     s->model = 0x2102;
1084     s->name = "tsc2102";
1085
1086     s->tr[0] = 0;
1087     s->tr[1] = 1;
1088     s->tr[2] = 1;
1089     s->tr[3] = 0;
1090     s->tr[4] = 1;
1091     s->tr[5] = 0;
1092     s->tr[6] = 1;
1093     s->tr[7] = 0;
1094
1095     s->chip.opaque = s;
1096     s->chip.send = (void *) tsc210x_write;
1097     s->chip.receive = (void *) tsc210x_read;
1098
1099     s->codec.opaque = s;
1100     s->codec.tx_swallow = (void *) tsc210x_i2s_swallow;
1101     s->codec.set_rate = (void *) tsc210x_i2s_set_rate;
1102     s->codec.in.fifo = s->in_fifo;
1103     s->codec.out.fifo = s->out_fifo;
1104
1105     tsc210x_reset(s);
1106
1107     qemu_add_mouse_event_handler(tsc210x_touchscreen_event, s, 1,
1108                     "QEMU TSC2102-driven Touchscreen");
1109
1110     AUD_register_card(s->name, &s->card);
1111
1112     qemu_register_reset((void *) tsc210x_reset, s);
1113     vmstate_register(NULL, 0, &vmstate_tsc2102, s);
1114
1115     return &s->chip;
1116 }
1117
1118 uWireSlave *tsc2301_init(qemu_irq penirq, qemu_irq kbirq, qemu_irq dav)
1119 {
1120     TSC210xState *s;
1121
1122     s = g_new0(TSC210xState, 1);
1123     s->x = 400;
1124     s->y = 240;
1125     s->pressure = 0;
1126     s->precision = s->nextprecision = 0;
1127     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, tsc210x_timer_tick, s);
1128     s->pint = penirq;
1129     s->kbint = kbirq;
1130     s->davint = dav;
1131     s->model = 0x2301;
1132     s->name = "tsc2301";
1133
1134     s->tr[0] = 0;
1135     s->tr[1] = 1;
1136     s->tr[2] = 1;
1137     s->tr[3] = 0;
1138     s->tr[4] = 1;
1139     s->tr[5] = 0;
1140     s->tr[6] = 1;
1141     s->tr[7] = 0;
1142
1143     s->chip.opaque = s;
1144     s->chip.send = (void *) tsc210x_write;
1145     s->chip.receive = (void *) tsc210x_read;
1146
1147     s->codec.opaque = s;
1148     s->codec.tx_swallow = (void *) tsc210x_i2s_swallow;
1149     s->codec.set_rate = (void *) tsc210x_i2s_set_rate;
1150     s->codec.in.fifo = s->in_fifo;
1151     s->codec.out.fifo = s->out_fifo;
1152
1153     tsc210x_reset(s);
1154
1155     qemu_add_mouse_event_handler(tsc210x_touchscreen_event, s, 1,
1156                     "QEMU TSC2301-driven Touchscreen");
1157
1158     AUD_register_card(s->name, &s->card);
1159
1160     qemu_register_reset((void *) tsc210x_reset, s);
1161     vmstate_register(NULL, 0, &vmstate_tsc2301, s);
1162
1163     return &s->chip;
1164 }
1165
1166 I2SCodec *tsc210x_codec(uWireSlave *chip)
1167 {
1168     TSC210xState *s = (TSC210xState *) chip->opaque;
1169
1170     return &s->codec;
1171 }
1172
1173 /*
1174  * Use tslib generated calibration data to generate ADC input values
1175  * from the touchscreen.  Assuming 12-bit precision was used during
1176  * tslib calibration.
1177  */
1178 void tsc210x_set_transform(uWireSlave *chip, const MouseTransformInfo *info)
1179 {
1180     TSC210xState *s = (TSC210xState *) chip->opaque;
1181 #if 0
1182     int64_t ltr[8];
1183
1184     ltr[0] = (int64_t) info->a[1] * info->y;
1185     ltr[1] = (int64_t) info->a[4] * info->x;
1186     ltr[2] = (int64_t) info->a[1] * info->a[3] -
1187             (int64_t) info->a[4] * info->a[0];
1188     ltr[3] = (int64_t) info->a[2] * info->a[4] -
1189             (int64_t) info->a[5] * info->a[1];
1190     ltr[4] = (int64_t) info->a[0] * info->y;
1191     ltr[5] = (int64_t) info->a[3] * info->x;
1192     ltr[6] = (int64_t) info->a[4] * info->a[0] -
1193             (int64_t) info->a[1] * info->a[3];
1194     ltr[7] = (int64_t) info->a[2] * info->a[3] -
1195             (int64_t) info->a[5] * info->a[0];
1196
1197     /* Avoid integer overflow */
1198     s->tr[0] = ltr[0] >> 11;
1199     s->tr[1] = ltr[1] >> 11;
1200     s->tr[2] = muldiv64(ltr[2], 1, info->a[6]);
1201     s->tr[3] = muldiv64(ltr[3], 1 << 4, ltr[2]);
1202     s->tr[4] = ltr[4] >> 11;
1203     s->tr[5] = ltr[5] >> 11;
1204     s->tr[6] = muldiv64(ltr[6], 1, info->a[6]);
1205     s->tr[7] = muldiv64(ltr[7], 1 << 4, ltr[6]);
1206 #else
1207
1208     /* This version assumes touchscreen X & Y axis are parallel or
1209      * perpendicular to LCD's  X & Y axis in some way.  */
1210     if (abs(info->a[0]) > abs(info->a[1])) {
1211         s->tr[0] = 0;
1212         s->tr[1] = -info->a[6] * info->x;
1213         s->tr[2] = info->a[0];
1214         s->tr[3] = -info->a[2] / info->a[0];
1215         s->tr[4] = info->a[6] * info->y;
1216         s->tr[5] = 0;
1217         s->tr[6] = info->a[4];
1218         s->tr[7] = -info->a[5] / info->a[4];
1219     } else {
1220         s->tr[0] = info->a[6] * info->y;
1221         s->tr[1] = 0;
1222         s->tr[2] = info->a[1];
1223         s->tr[3] = -info->a[2] / info->a[1];
1224         s->tr[4] = 0;
1225         s->tr[5] = -info->a[6] * info->x;
1226         s->tr[6] = info->a[3];
1227         s->tr[7] = -info->a[5] / info->a[3];
1228     }
1229
1230     s->tr[0] >>= 11;
1231     s->tr[1] >>= 11;
1232     s->tr[3] <<= 4;
1233     s->tr[4] >>= 11;
1234     s->tr[5] >>= 11;
1235     s->tr[7] <<= 4;
1236 #endif
1237 }
1238
1239 void tsc210x_key_event(uWireSlave *chip, int key, int down)
1240 {
1241     TSC210xState *s = (TSC210xState *) chip->opaque;
1242
1243     if (down)
1244         s->kb.down |= 1 << key;
1245     else
1246         s->kb.down &= ~(1 << key);
1247
1248     if (down && (s->kb.down & ~s->kb.mask) && !s->kb.intr) {
1249         s->kb.intr = 1;
1250         qemu_irq_lower(s->kbint);
1251     } else if (s->kb.intr && !(s->kb.down & ~s->kb.mask) &&
1252                     !(s->kb.mode & 1)) {
1253         s->kb.intr = 0;
1254         qemu_irq_raise(s->kbint);
1255     }
1256 }