Statistics
| Branch: | Revision:

root / vl.c @ bb551faa

History | View | Annotate | Download (102.8 kB)

1
/*
2
 * QEMU PC System Emulator
3
 * 
4
 * Copyright (c) 2003 Fabrice Bellard
5
 * 
6
 * Permission is hereby granted, free of charge, to any person obtaining a copy
7
 * of this software and associated documentation files (the "Software"), to deal
8
 * in the Software without restriction, including without limitation the rights
9
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10
 * copies of the Software, and to permit persons to whom the Software is
11
 * furnished to do so, subject to the following conditions:
12
 *
13
 * The above copyright notice and this permission notice shall be included in
14
 * all copies or substantial portions of the Software.
15
 *
16
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22
 * THE SOFTWARE.
23
 */
24
#include <stdlib.h>
25
#include <stdio.h>
26
#include <stdarg.h>
27
#include <string.h>
28
#include <ctype.h>
29
#include <getopt.h>
30
#include <inttypes.h>
31
#include <unistd.h>
32
#include <sys/mman.h>
33
#include <fcntl.h>
34
#include <signal.h>
35
#include <time.h>
36
#include <sys/time.h>
37
#include <malloc.h>
38
#include <termios.h>
39
#include <sys/poll.h>
40
#include <errno.h>
41
#include <sys/wait.h>
42

    
43
#include <sys/ioctl.h>
44
#include <sys/socket.h>
45
#include <linux/if.h>
46
#include <linux/if_tun.h>
47

    
48
#include "cpu.h"
49
#include "disas.h"
50
#include "thunk.h"
51

    
52
#include "vl.h"
53

    
54
#define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
55
#define BIOS_FILENAME "bios.bin"
56
#define VGABIOS_FILENAME "vgabios.bin"
57

    
58
//#define DEBUG_UNUSED_IOPORT
59

    
60
//#define DEBUG_IRQ_LATENCY
61

    
62
/* output Bochs bios info messages */
63
//#define DEBUG_BIOS
64

    
65
//#define DEBUG_CMOS
66

    
67
/* debug PIC */
68
//#define DEBUG_PIC
69

    
70
/* debug NE2000 card */
71
//#define DEBUG_NE2000
72

    
73
/* debug PC keyboard */
74
//#define DEBUG_KBD
75

    
76
/* debug PC keyboard : only mouse */
77
//#define DEBUG_MOUSE
78

    
79
//#define DEBUG_SERIAL
80

    
81
#define PHYS_RAM_BASE     0xac000000
82
#if !defined(CONFIG_SOFTMMU)
83
#define PHYS_RAM_MAX_SIZE (256 * 1024 * 1024)
84
#else
85
#define PHYS_RAM_MAX_SIZE (2047 * 1024 * 1024)
86
#endif
87

    
88
#if defined (TARGET_I386)
89
#define KERNEL_LOAD_ADDR   0x00100000
90
#elif defined (TARGET_PPC)
91
//#define USE_OPEN_FIRMWARE
92
#if !defined (USE_OPEN_FIRMWARE)
93
#define KERNEL_LOAD_ADDR    0x01000000
94
#define KERNEL_STACK_ADDR   0x01200000
95
#else
96
#define KERNEL_LOAD_ADDR    0x00000000
97
#define KERNEL_STACK_ADDR   0x00400000
98
#endif
99
#endif
100
#define INITRD_LOAD_ADDR   0x00400000
101
#define KERNEL_PARAMS_ADDR 0x00090000
102

    
103
#define GUI_REFRESH_INTERVAL 30 
104

    
105
/* from plex86 (BSD license) */
106
struct  __attribute__ ((packed)) linux_params {
107
  // For 0x00..0x3f, see 'struct screen_info' in linux/include/linux/tty.h.
108
  // I just padded out the VESA parts, rather than define them.
109

    
110
  /* 0x000 */ uint8_t   orig_x;
111
  /* 0x001 */ uint8_t   orig_y;
112
  /* 0x002 */ uint16_t  ext_mem_k;
113
  /* 0x004 */ uint16_t  orig_video_page;
114
  /* 0x006 */ uint8_t   orig_video_mode;
115
  /* 0x007 */ uint8_t   orig_video_cols;
116
  /* 0x008 */ uint16_t  unused1;
117
  /* 0x00a */ uint16_t  orig_video_ega_bx;
118
  /* 0x00c */ uint16_t  unused2;
119
  /* 0x00e */ uint8_t   orig_video_lines;
120
  /* 0x00f */ uint8_t   orig_video_isVGA;
121
  /* 0x010 */ uint16_t  orig_video_points;
122
  /* 0x012 */ uint8_t   pad0[0x20 - 0x12]; // VESA info.
123
  /* 0x020 */ uint16_t  cl_magic;  // Commandline magic number (0xA33F)
124
  /* 0x022 */ uint16_t  cl_offset; // Commandline offset.  Address of commandline
125
                                 // is calculated as 0x90000 + cl_offset, bu
126
                                 // only if cl_magic == 0xA33F.
127
  /* 0x024 */ uint8_t   pad1[0x40 - 0x24]; // VESA info.
128

    
129
  /* 0x040 */ uint8_t   apm_bios_info[20]; // struct apm_bios_info
130
  /* 0x054 */ uint8_t   pad2[0x80 - 0x54];
131

    
132
  // Following 2 from 'struct drive_info_struct' in drivers/block/cciss.h.
133
  // Might be truncated?
134
  /* 0x080 */ uint8_t   hd0_info[16]; // hd0-disk-parameter from intvector 0x41
135
  /* 0x090 */ uint8_t   hd1_info[16]; // hd1-disk-parameter from intvector 0x46
136

    
137
  // System description table truncated to 16 bytes
138
  // From 'struct sys_desc_table_struct' in linux/arch/i386/kernel/setup.c.
139
  /* 0x0a0 */ uint16_t  sys_description_len;
140
  /* 0x0a2 */ uint8_t   sys_description_table[14];
141
                        // [0] machine id
142
                        // [1] machine submodel id
143
                        // [2] BIOS revision
144
                        // [3] bit1: MCA bus
145

    
146
  /* 0x0b0 */ uint8_t   pad3[0x1e0 - 0xb0];
147
  /* 0x1e0 */ uint32_t  alt_mem_k;
148
  /* 0x1e4 */ uint8_t   pad4[4];
149
  /* 0x1e8 */ uint8_t   e820map_entries;
150
  /* 0x1e9 */ uint8_t   eddbuf_entries; // EDD_NR
151
  /* 0x1ea */ uint8_t   pad5[0x1f1 - 0x1ea];
152
  /* 0x1f1 */ uint8_t   setup_sects; // size of setup.S, number of sectors
153
  /* 0x1f2 */ uint16_t  mount_root_rdonly; // MOUNT_ROOT_RDONLY (if !=0)
154
  /* 0x1f4 */ uint16_t  sys_size; // size of compressed kernel-part in the
155
                                // (b)zImage-file (in 16 byte units, rounded up)
156
  /* 0x1f6 */ uint16_t  swap_dev; // (unused AFAIK)
157
  /* 0x1f8 */ uint16_t  ramdisk_flags;
158
  /* 0x1fa */ uint16_t  vga_mode; // (old one)
159
  /* 0x1fc */ uint16_t  orig_root_dev; // (high=Major, low=minor)
160
  /* 0x1fe */ uint8_t   pad6[1];
161
  /* 0x1ff */ uint8_t   aux_device_info;
162
  /* 0x200 */ uint16_t  jump_setup; // Jump to start of setup code,
163
                                  // aka "reserved" field.
164
  /* 0x202 */ uint8_t   setup_signature[4]; // Signature for SETUP-header, ="HdrS"
165
  /* 0x206 */ uint16_t  header_format_version; // Version number of header format;
166
  /* 0x208 */ uint8_t   setup_S_temp0[8]; // Used by setup.S for communication with
167
                                        // boot loaders, look there.
168
  /* 0x210 */ uint8_t   loader_type;
169
                        // 0 for old one.
170
                        // else 0xTV:
171
                        //   T=0: LILO
172
                        //   T=1: Loadlin
173
                        //   T=2: bootsect-loader
174
                        //   T=3: SYSLINUX
175
                        //   T=4: ETHERBOOT
176
                        //   V=version
177
  /* 0x211 */ uint8_t   loadflags;
178
                        // bit0 = 1: kernel is loaded high (bzImage)
179
                        // bit7 = 1: Heap and pointer (see below) set by boot
180
                        //   loader.
181
  /* 0x212 */ uint16_t  setup_S_temp1;
182
  /* 0x214 */ uint32_t  kernel_start;
183
  /* 0x218 */ uint32_t  initrd_start;
184
  /* 0x21c */ uint32_t  initrd_size;
185
  /* 0x220 */ uint8_t   setup_S_temp2[4];
186
  /* 0x224 */ uint16_t  setup_S_heap_end_pointer;
187
  /* 0x226 */ uint8_t   pad7[0x2d0 - 0x226];
188

    
189
  /* 0x2d0 : Int 15, ax=e820 memory map. */
190
  // (linux/include/asm-i386/e820.h, 'struct e820entry')
191
#define E820MAX  32
192
#define E820_RAM  1
193
#define E820_RESERVED 2
194
#define E820_ACPI 3 /* usable as RAM once ACPI tables have been read */
195
#define E820_NVS  4
196
  struct {
197
    uint64_t addr;
198
    uint64_t size;
199
    uint32_t type;
200
    } e820map[E820MAX];
201

    
202
  /* 0x550 */ uint8_t   pad8[0x600 - 0x550];
203

    
204
  // BIOS Enhanced Disk Drive Services.
205
  // (From linux/include/asm-i386/edd.h, 'struct edd_info')
206
  // Each 'struct edd_info is 78 bytes, times a max of 6 structs in array.
207
  /* 0x600 */ uint8_t   eddbuf[0x7d4 - 0x600];
208

    
209
  /* 0x7d4 */ uint8_t   pad9[0x800 - 0x7d4];
210
  /* 0x800 */ uint8_t   commandline[0x800];
211

    
212
  /* 0x1000 */
213
  uint64_t gdt_table[256];
214
  uint64_t idt_table[48];
215
};
216

    
217
#define KERNEL_CS     0x10
218
#define KERNEL_DS     0x18
219

    
220
/* XXX: use a two level table to limit memory usage */
221
#define MAX_IOPORTS 65536
222

    
223
static const char *bios_dir = CONFIG_QEMU_SHAREDIR;
224
char phys_ram_file[1024];
225
CPUState *global_env;
226
CPUState *cpu_single_env;
227
IOPortReadFunc *ioport_read_table[3][MAX_IOPORTS];
228
IOPortWriteFunc *ioport_write_table[3][MAX_IOPORTS];
229
BlockDriverState *bs_table[MAX_DISKS], *fd_table[MAX_FD];
230
int vga_ram_size;
231
static DisplayState display_state;
232
int nographic;
233
int term_inited;
234
int64_t ticks_per_sec;
235
int boot_device = 'c';
236

    
237
/***********************************************************/
238
/* x86 io ports */
239

    
240
uint32_t default_ioport_readb(CPUState *env, uint32_t address)
241
{
242
#ifdef DEBUG_UNUSED_IOPORT
243
    fprintf(stderr, "inb: port=0x%04x\n", address);
244
#endif
245
    return 0xff;
246
}
247

    
248
void default_ioport_writeb(CPUState *env, uint32_t address, uint32_t data)
249
{
250
#ifdef DEBUG_UNUSED_IOPORT
251
    fprintf(stderr, "outb: port=0x%04x data=0x%02x\n", address, data);
252
#endif
253
}
254

    
255
/* default is to make two byte accesses */
256
uint32_t default_ioport_readw(CPUState *env, uint32_t address)
257
{
258
    uint32_t data;
259
    data = ioport_read_table[0][address & (MAX_IOPORTS - 1)](env, address);
260
    data |= ioport_read_table[0][(address + 1) & (MAX_IOPORTS - 1)](env, address + 1) << 8;
261
    return data;
262
}
263

    
264
void default_ioport_writew(CPUState *env, uint32_t address, uint32_t data)
265
{
266
    ioport_write_table[0][address & (MAX_IOPORTS - 1)](env, address, data & 0xff);
267
    ioport_write_table[0][(address + 1) & (MAX_IOPORTS - 1)](env, address + 1, (data >> 8) & 0xff);
268
}
269

    
270
uint32_t default_ioport_readl(CPUState *env, uint32_t address)
271
{
272
#ifdef DEBUG_UNUSED_IOPORT
273
    fprintf(stderr, "inl: port=0x%04x\n", address);
274
#endif
275
    return 0xffffffff;
276
}
277

    
278
void default_ioport_writel(CPUState *env, uint32_t address, uint32_t data)
279
{
280
#ifdef DEBUG_UNUSED_IOPORT
281
    fprintf(stderr, "outl: port=0x%04x data=0x%02x\n", address, data);
282
#endif
283
}
284

    
285
void init_ioports(void)
286
{
287
    int i;
288

    
289
    for(i = 0; i < MAX_IOPORTS; i++) {
290
        ioport_read_table[0][i] = default_ioport_readb;
291
        ioport_write_table[0][i] = default_ioport_writeb;
292
        ioport_read_table[1][i] = default_ioport_readw;
293
        ioport_write_table[1][i] = default_ioport_writew;
294
        ioport_read_table[2][i] = default_ioport_readl;
295
        ioport_write_table[2][i] = default_ioport_writel;
296
    }
297
}
298

    
299
/* size is the word size in byte */
300
int register_ioport_read(int start, int length, IOPortReadFunc *func, int size)
301
{
302
    int i, bsize;
303

    
304
    if (size == 1)
305
        bsize = 0;
306
    else if (size == 2)
307
        bsize = 1;
308
    else if (size == 4)
309
        bsize = 2;
310
    else
311
        return -1;
312
    for(i = start; i < start + length; i += size)
313
        ioport_read_table[bsize][i] = func;
314
    return 0;
315
}
316

    
317
/* size is the word size in byte */
318
int register_ioport_write(int start, int length, IOPortWriteFunc *func, int size)
319
{
320
    int i, bsize;
321

    
322
    if (size == 1)
323
        bsize = 0;
324
    else if (size == 2)
325
        bsize = 1;
326
    else if (size == 4)
327
        bsize = 2;
328
    else
329
        return -1;
330
    for(i = start; i < start + length; i += size)
331
        ioport_write_table[bsize][i] = func;
332
    return 0;
333
}
334

    
335
void pstrcpy(char *buf, int buf_size, const char *str)
336
{
337
    int c;
338
    char *q = buf;
339

    
340
    if (buf_size <= 0)
341
        return;
342

    
343
    for(;;) {
344
        c = *str++;
345
        if (c == 0 || q >= buf + buf_size - 1)
346
            break;
347
        *q++ = c;
348
    }
349
    *q = '\0';
350
}
351

    
352
/* strcat and truncate. */
353
char *pstrcat(char *buf, int buf_size, const char *s)
354
{
355
    int len;
356
    len = strlen(buf);
357
    if (len < buf_size) 
358
        pstrcpy(buf + len, buf_size - len, s);
359
    return buf;
360
}
361

    
362
int load_kernel(const char *filename, uint8_t *addr)
363
{
364
    int fd, size;
365
#if defined (TARGET_I386)
366
    int setup_sects;
367
    uint8_t bootsect[512];
368
#endif
369

    
370
    printf("Load kernel at %p (0x%08x)\n", addr,
371
           (uint32_t)addr - (uint32_t)phys_ram_base);
372
    fd = open(filename, O_RDONLY);
373
    if (fd < 0)
374
        return -1;
375
#if defined (TARGET_I386)
376
    if (read(fd, bootsect, 512) != 512)
377
        goto fail;
378
    setup_sects = bootsect[0x1F1];
379
    if (!setup_sects)
380
        setup_sects = 4;
381
    /* skip 16 bit setup code */
382
    lseek(fd, (setup_sects + 1) * 512, SEEK_SET);
383
#endif
384
    size = read(fd, addr, 16 * 1024 * 1024);
385
    if (size < 0)
386
        goto fail;
387
    close(fd);
388
    return size;
389
 fail:
390
    close(fd);
391
    return -1;
392
}
393

    
394
/* return the size or -1 if error */
395
int load_image(const char *filename, uint8_t *addr)
396
{
397
    int fd, size;
398
    fd = open(filename, O_RDONLY);
399
    if (fd < 0)
400
        return -1;
401
    size = lseek(fd, 0, SEEK_END);
402
    lseek(fd, 0, SEEK_SET);
403
    if (read(fd, addr, size) != size) {
404
        close(fd);
405
        return -1;
406
    }
407
    close(fd);
408
    return size;
409
}
410

    
411
void cpu_outb(CPUState *env, int addr, int val)
412
{
413
    ioport_write_table[0][addr & (MAX_IOPORTS - 1)](env, addr, val);
414
}
415

    
416
void cpu_outw(CPUState *env, int addr, int val)
417
{
418
    ioport_write_table[1][addr & (MAX_IOPORTS - 1)](env, addr, val);
419
}
420

    
421
void cpu_outl(CPUState *env, int addr, int val)
422
{
423
    ioport_write_table[2][addr & (MAX_IOPORTS - 1)](env, addr, val);
424
}
425

    
426
int cpu_inb(CPUState *env, int addr)
427
{
428
    return ioport_read_table[0][addr & (MAX_IOPORTS - 1)](env, addr);
429
}
430

    
431
int cpu_inw(CPUState *env, int addr)
432
{
433
    return ioport_read_table[1][addr & (MAX_IOPORTS - 1)](env, addr);
434
}
435

    
436
int cpu_inl(CPUState *env, int addr)
437
{
438
    return ioport_read_table[2][addr & (MAX_IOPORTS - 1)](env, addr);
439
}
440

    
441
/***********************************************************/
442
void ioport80_write(CPUState *env, uint32_t addr, uint32_t data)
443
{
444
}
445

    
446
void hw_error(const char *fmt, ...)
447
{
448
    va_list ap;
449

    
450
    va_start(ap, fmt);
451
    fprintf(stderr, "qemu: hardware error: ");
452
    vfprintf(stderr, fmt, ap);
453
    fprintf(stderr, "\n");
454
#ifdef TARGET_I386
455
    cpu_x86_dump_state(global_env, stderr, X86_DUMP_FPU | X86_DUMP_CCOP);
456
#else
457
    cpu_dump_state(global_env, stderr, 0);
458
#endif
459
    va_end(ap);
460
    abort();
461
}
462

    
463
/***********************************************************/
464
/* cmos emulation */
465

    
466
#if defined (TARGET_I386)
467
#define RTC_SECONDS             0
468
#define RTC_SECONDS_ALARM       1
469
#define RTC_MINUTES             2
470
#define RTC_MINUTES_ALARM       3
471
#define RTC_HOURS               4
472
#define RTC_HOURS_ALARM         5
473
#define RTC_ALARM_DONT_CARE    0xC0
474

    
475
#define RTC_DAY_OF_WEEK         6
476
#define RTC_DAY_OF_MONTH        7
477
#define RTC_MONTH               8
478
#define RTC_YEAR                9
479

    
480
#define RTC_REG_A               10
481
#define RTC_REG_B               11
482
#define RTC_REG_C               12
483
#define RTC_REG_D               13
484

    
485
/* PC cmos mappings */
486
#define REG_EQUIPMENT_BYTE          0x14
487
#define REG_IBM_CENTURY_BYTE        0x32
488

    
489
uint8_t cmos_data[128];
490
uint8_t cmos_index;
491

    
492
void cmos_ioport_write(CPUState *env, uint32_t addr, uint32_t data)
493
{
494
    if (addr == 0x70) {
495
        cmos_index = data & 0x7f;
496
    } else {
497
#ifdef DEBUG_CMOS
498
        printf("cmos: write index=0x%02x val=0x%02x\n",
499
               cmos_index, data);
500
#endif        
501
        switch(addr) {
502
        case RTC_SECONDS_ALARM:
503
        case RTC_MINUTES_ALARM:
504
        case RTC_HOURS_ALARM:
505
            /* XXX: not supported */
506
            cmos_data[cmos_index] = data;
507
            break;
508
        case RTC_SECONDS:
509
        case RTC_MINUTES:
510
        case RTC_HOURS:
511
        case RTC_DAY_OF_WEEK:
512
        case RTC_DAY_OF_MONTH:
513
        case RTC_MONTH:
514
        case RTC_YEAR:
515
            cmos_data[cmos_index] = data;
516
            break;
517
        case RTC_REG_A:
518
        case RTC_REG_B:
519
            cmos_data[cmos_index] = data;
520
            break;
521
        case RTC_REG_C:
522
        case RTC_REG_D:
523
            /* cannot write to them */
524
            break;
525
        default:
526
            cmos_data[cmos_index] = data;
527
            break;
528
        }
529
    }
530
}
531

    
532
static inline int to_bcd(int a)
533
{
534
    return ((a / 10) << 4) | (a % 10);
535
}
536

    
537
static void cmos_update_time(void)
538
{
539
    struct tm *tm;
540
    time_t ti;
541

    
542
    ti = time(NULL);
543
    tm = gmtime(&ti);
544
    cmos_data[RTC_SECONDS] = to_bcd(tm->tm_sec);
545
    cmos_data[RTC_MINUTES] = to_bcd(tm->tm_min);
546
    cmos_data[RTC_HOURS] = to_bcd(tm->tm_hour);
547
    cmos_data[RTC_DAY_OF_WEEK] = to_bcd(tm->tm_wday);
548
    cmos_data[RTC_DAY_OF_MONTH] = to_bcd(tm->tm_mday);
549
    cmos_data[RTC_MONTH] = to_bcd(tm->tm_mon + 1);
550
    cmos_data[RTC_YEAR] = to_bcd(tm->tm_year % 100);
551
    cmos_data[REG_IBM_CENTURY_BYTE] = to_bcd((tm->tm_year / 100) + 19);
552
}
553

    
554
uint32_t cmos_ioport_read(CPUState *env, uint32_t addr)
555
{
556
    int ret;
557

    
558
    if (addr == 0x70) {
559
        return 0xff;
560
    } else {
561
        switch(cmos_index) {
562
        case RTC_SECONDS:
563
        case RTC_MINUTES:
564
        case RTC_HOURS:
565
        case RTC_DAY_OF_WEEK:
566
        case RTC_DAY_OF_MONTH:
567
        case RTC_MONTH:
568
        case RTC_YEAR:
569
        case REG_IBM_CENTURY_BYTE:
570
            cmos_update_time();
571
            ret = cmos_data[cmos_index];
572
            break;
573
        case RTC_REG_A:
574
            ret = cmos_data[cmos_index];
575
            /* toggle update-in-progress bit for Linux (same hack as
576
               plex86) */
577
            cmos_data[RTC_REG_A] ^= 0x80; 
578
            break;
579
        case RTC_REG_C:
580
            ret = cmos_data[cmos_index];
581
            pic_set_irq(8, 0);
582
            cmos_data[RTC_REG_C] = 0x00; 
583
            break;
584
        default:
585
            ret = cmos_data[cmos_index];
586
            break;
587
        }
588
#ifdef DEBUG_CMOS
589
        printf("cmos: read index=0x%02x val=0x%02x\n",
590
               cmos_index, ret);
591
#endif
592
        return ret;
593
    }
594
}
595

    
596
void cmos_init(void)
597
{
598
    int val;
599

    
600
    cmos_update_time();
601

    
602
    cmos_data[RTC_REG_A] = 0x26;
603
    cmos_data[RTC_REG_B] = 0x02;
604
    cmos_data[RTC_REG_C] = 0x00;
605
    cmos_data[RTC_REG_D] = 0x80;
606

    
607
    /* various important CMOS locations needed by PC/Bochs bios */
608

    
609
    cmos_data[REG_EQUIPMENT_BYTE] = 0x02; /* FPU is there */
610
    cmos_data[REG_EQUIPMENT_BYTE] |= 0x04; /* PS/2 mouse installed */
611

    
612
    /* memory size */
613
    val = (phys_ram_size / 1024) - 1024;
614
    if (val > 65535)
615
        val = 65535;
616
    cmos_data[0x17] = val;
617
    cmos_data[0x18] = val >> 8;
618
    cmos_data[0x30] = val;
619
    cmos_data[0x31] = val >> 8;
620

    
621
    val = (phys_ram_size / 65536) - ((16 * 1024 * 1024) / 65536);
622
    if (val > 65535)
623
        val = 65535;
624
    cmos_data[0x34] = val;
625
    cmos_data[0x35] = val >> 8;
626
    
627
    switch(boot_device) {
628
    case 'a':
629
    case 'b':
630
        cmos_data[0x3d] = 0x01; /* floppy boot */
631
        break;
632
    default:
633
    case 'c':
634
        cmos_data[0x3d] = 0x02; /* hard drive boot */
635
        break;
636
    case 'd':
637
        cmos_data[0x3d] = 0x03; /* CD-ROM boot */
638
        break;
639
    }
640

    
641
    register_ioport_write(0x70, 2, cmos_ioport_write, 1);
642
    register_ioport_read(0x70, 2, cmos_ioport_read, 1);
643
}
644

    
645
void cmos_register_fd (uint8_t fd0, uint8_t fd1)
646
{
647
    int nb = 0;
648

    
649
    cmos_data[0x10] = 0;
650
    switch (fd0) {
651
    case 0:
652
        /* 1.44 Mb 3"5 drive */
653
        cmos_data[0x10] |= 0x40;
654
        break;
655
    case 1:
656
        /* 2.88 Mb 3"5 drive */
657
        cmos_data[0x10] |= 0x60;
658
        break;
659
    case 2:
660
        /* 1.2 Mb 5"5 drive */
661
        cmos_data[0x10] |= 0x20;
662
        break;
663
    }
664
    switch (fd1) {
665
    case 0:
666
        /* 1.44 Mb 3"5 drive */
667
        cmos_data[0x10] |= 0x04;
668
        break;
669
    case 1:
670
        /* 2.88 Mb 3"5 drive */
671
        cmos_data[0x10] |= 0x06;
672
        break;
673
    case 2:
674
        /* 1.2 Mb 5"5 drive */
675
        cmos_data[0x10] |= 0x02;
676
        break;
677
    }
678
    if (fd0 < 3)
679
        nb++;
680
    if (fd1 < 3)
681
        nb++;
682
    switch (nb) {
683
    case 0:
684
        break;
685
    case 1:
686
        cmos_data[REG_EQUIPMENT_BYTE] |= 0x01; /* 1 drive, ready for boot */
687
        break;
688
    case 2:
689
        cmos_data[REG_EQUIPMENT_BYTE] |= 0x41; /* 2 drives, ready for boot */
690
        break;
691
    }
692
}
693
#endif /* TARGET_I386 */
694

    
695
/***********************************************************/
696
/* 8259 pic emulation */
697

    
698
typedef struct PicState {
699
    uint8_t last_irr; /* edge detection */
700
    uint8_t irr; /* interrupt request register */
701
    uint8_t imr; /* interrupt mask register */
702
    uint8_t isr; /* interrupt service register */
703
    uint8_t priority_add; /* highest irq priority */
704
    uint8_t irq_base;
705
    uint8_t read_reg_select;
706
    uint8_t poll;
707
    uint8_t special_mask;
708
    uint8_t init_state;
709
    uint8_t auto_eoi;
710
    uint8_t rotate_on_auto_eoi;
711
    uint8_t special_fully_nested_mode;
712
    uint8_t init4; /* true if 4 byte init */
713
} PicState;
714

    
715
/* 0 is master pic, 1 is slave pic */
716
PicState pics[2];
717
int pic_irq_requested;
718

    
719
/* set irq level. If an edge is detected, then the IRR is set to 1 */
720
static inline void pic_set_irq1(PicState *s, int irq, int level)
721
{
722
    int mask;
723
    mask = 1 << irq;
724
    if (level) {
725
        if ((s->last_irr & mask) == 0)
726
            s->irr |= mask;
727
        s->last_irr |= mask;
728
    } else {
729
        s->last_irr &= ~mask;
730
    }
731
}
732

    
733
/* return the highest priority found in mask (highest = smallest
734
   number). Return 8 if no irq */
735
static inline int get_priority(PicState *s, int mask)
736
{
737
    int priority;
738
    if (mask == 0)
739
        return 8;
740
    priority = 0;
741
    while ((mask & (1 << ((priority + s->priority_add) & 7))) == 0)
742
        priority++;
743
    return priority;
744
}
745

    
746
/* return the pic wanted interrupt. return -1 if none */
747
static int pic_get_irq(PicState *s)
748
{
749
    int mask, cur_priority, priority;
750

    
751
    mask = s->irr & ~s->imr;
752
    priority = get_priority(s, mask);
753
    if (priority == 8)
754
        return -1;
755
    /* compute current priority. If special fully nested mode on the
756
       master, the IRQ coming from the slave is not taken into account
757
       for the priority computation. */
758
    mask = s->isr;
759
    if (s->special_fully_nested_mode && s == &pics[0])
760
        mask &= ~(1 << 2);
761
    cur_priority = get_priority(s, mask);
762
    if (priority < cur_priority) {
763
        /* higher priority found: an irq should be generated */
764
        return (priority + s->priority_add) & 7;
765
    } else {
766
        return -1;
767
    }
768
}
769

    
770
/* raise irq to CPU if necessary. must be called every time the active
771
   irq may change */
772
void pic_update_irq(void)
773
{
774
    int irq2, irq;
775

    
776
    /* first look at slave pic */
777
    irq2 = pic_get_irq(&pics[1]);
778
    if (irq2 >= 0) {
779
        /* if irq request by slave pic, signal master PIC */
780
        pic_set_irq1(&pics[0], 2, 1);
781
        pic_set_irq1(&pics[0], 2, 0);
782
    }
783
    /* look at requested irq */
784
    irq = pic_get_irq(&pics[0]);
785
    if (irq >= 0) {
786
        if (irq == 2) {
787
            /* from slave pic */
788
            pic_irq_requested = 8 + irq2;
789
        } else {
790
            /* from master pic */
791
            pic_irq_requested = irq;
792
        }
793
#if defined(DEBUG_PIC)
794
        {
795
            int i;
796
            for(i = 0; i < 2; i++) {
797
                printf("pic%d: imr=%x irr=%x padd=%d\n", 
798
                       i, pics[i].imr, pics[i].irr, pics[i].priority_add);
799
                
800
            }
801
        }
802
        printf("pic: cpu_interrupt req=%d\n", pic_irq_requested);
803
#endif
804
        cpu_interrupt(global_env, CPU_INTERRUPT_HARD);
805
    }
806
}
807

    
808
#ifdef DEBUG_IRQ_LATENCY
809
int64_t irq_time[16];
810
int64_t cpu_get_ticks(void);
811
#endif
812
#if defined(DEBUG_PIC)
813
int irq_level[16];
814
#endif
815

    
816
void pic_set_irq(int irq, int level)
817
{
818
#if defined(DEBUG_PIC)
819
    if (level != irq_level[irq]) {
820
        printf("pic_set_irq: irq=%d level=%d\n", irq, level);
821
        irq_level[irq] = level;
822
    }
823
#endif
824
#ifdef DEBUG_IRQ_LATENCY
825
    if (level) {
826
        irq_time[irq] = cpu_get_ticks();
827
    }
828
#endif
829
    pic_set_irq1(&pics[irq >> 3], irq & 7, level);
830
    pic_update_irq();
831
}
832

    
833
/* acknowledge interrupt 'irq' */
834
static inline void pic_intack(PicState *s, int irq)
835
{
836
    if (s->auto_eoi) {
837
        if (s->rotate_on_auto_eoi)
838
            s->priority_add = (irq + 1) & 7;
839
    } else {
840
        s->isr |= (1 << irq);
841
    }
842
    s->irr &= ~(1 << irq);
843
}
844

    
845
int cpu_x86_get_pic_interrupt(CPUState *env)
846
{
847
    int irq, irq2, intno;
848

    
849
    /* signal the pic that the irq was acked by the CPU */
850
    irq = pic_irq_requested;
851
#ifdef DEBUG_IRQ_LATENCY
852
    printf("IRQ%d latency=%0.3fus\n", 
853
           irq, 
854
           (double)(cpu_get_ticks() - irq_time[irq]) * 1000000.0 / ticks_per_sec);
855
#endif
856
#if defined(DEBUG_PIC)
857
    printf("pic_interrupt: irq=%d\n", irq);
858
#endif
859

    
860
    if (irq >= 8) {
861
        irq2 = irq & 7;
862
        pic_intack(&pics[1], irq2);
863
        irq = 2;
864
        intno = pics[1].irq_base + irq2;
865
    } else {
866
        intno = pics[0].irq_base + irq;
867
    }
868
    pic_intack(&pics[0], irq);
869
    return intno;
870
}
871

    
872
void pic_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
873
{
874
    PicState *s;
875
    int priority, cmd, irq;
876

    
877
#ifdef DEBUG_PIC
878
    printf("pic_write: addr=0x%02x val=0x%02x\n", addr, val);
879
#endif
880
    s = &pics[addr >> 7];
881
    addr &= 1;
882
    if (addr == 0) {
883
        if (val & 0x10) {
884
            /* init */
885
            memset(s, 0, sizeof(PicState));
886
            s->init_state = 1;
887
            s->init4 = val & 1;
888
            if (val & 0x02)
889
                hw_error("single mode not supported");
890
            if (val & 0x08)
891
                hw_error("level sensitive irq not supported");
892
        } else if (val & 0x08) {
893
            if (val & 0x04)
894
                s->poll = 1;
895
            if (val & 0x02)
896
                s->read_reg_select = val & 1;
897
            if (val & 0x40)
898
                s->special_mask = (val >> 5) & 1;
899
        } else {
900
            cmd = val >> 5;
901
            switch(cmd) {
902
            case 0:
903
            case 4:
904
                s->rotate_on_auto_eoi = cmd >> 2;
905
                break;
906
            case 1: /* end of interrupt */
907
            case 5:
908
                priority = get_priority(s, s->isr);
909
                if (priority != 8) {
910
                    irq = (priority + s->priority_add) & 7;
911
                    s->isr &= ~(1 << irq);
912
                    if (cmd == 5)
913
                        s->priority_add = (irq + 1) & 7;
914
                    pic_update_irq();
915
                }
916
                break;
917
            case 3:
918
                irq = val & 7;
919
                s->isr &= ~(1 << irq);
920
                pic_update_irq();
921
                break;
922
            case 6:
923
                s->priority_add = (val + 1) & 7;
924
                pic_update_irq();
925
                break;
926
            case 7:
927
                irq = val & 7;
928
                s->isr &= ~(1 << irq);
929
                s->priority_add = (irq + 1) & 7;
930
                pic_update_irq();
931
                break;
932
            default:
933
                /* no operation */
934
                break;
935
            }
936
        }
937
    } else {
938
        switch(s->init_state) {
939
        case 0:
940
            /* normal mode */
941
            s->imr = val;
942
            pic_update_irq();
943
            break;
944
        case 1:
945
            s->irq_base = val & 0xf8;
946
            s->init_state = 2;
947
            break;
948
        case 2:
949
            if (s->init4) {
950
                s->init_state = 3;
951
            } else {
952
                s->init_state = 0;
953
            }
954
            break;
955
        case 3:
956
            s->special_fully_nested_mode = (val >> 4) & 1;
957
            s->auto_eoi = (val >> 1) & 1;
958
            s->init_state = 0;
959
            break;
960
        }
961
    }
962
}
963

    
964
static uint32_t pic_poll_read (PicState *s, uint32_t addr1)
965
{
966
    int ret;
967

    
968
    ret = pic_get_irq(s);
969
    if (ret >= 0) {
970
        if (addr1 >> 7) {
971
            pics[0].isr &= ~(1 << 2);
972
            pics[0].irr &= ~(1 << 2);
973
        }
974
        s->irr &= ~(1 << ret);
975
        s->isr &= ~(1 << ret);
976
        if (addr1 >> 7 || ret != 2)
977
            pic_update_irq();
978
    } else {
979
        ret = 0x07;
980
        pic_update_irq();
981
    }
982

    
983
    return ret;
984
}
985

    
986
uint32_t pic_ioport_read(CPUState *env, uint32_t addr1)
987
{
988
    PicState *s;
989
    unsigned int addr;
990
    int ret;
991

    
992
    addr = addr1;
993
    s = &pics[addr >> 7];
994
    addr &= 1;
995
    if (s->poll) {
996
        ret = pic_poll_read(s, addr1);
997
        s->poll = 0;
998
    } else {
999
        if (addr == 0) {
1000
            if (s->read_reg_select)
1001
                ret = s->isr;
1002
            else
1003
                ret = s->irr;
1004
        } else {
1005
            ret = s->imr;
1006
        }
1007
    }
1008
#ifdef DEBUG_PIC
1009
    printf("pic_read: addr=0x%02x val=0x%02x\n", addr1, ret);
1010
#endif
1011
    return ret;
1012
}
1013

    
1014
/* memory mapped interrupt status */
1015
uint32_t pic_intack_read(CPUState *env)
1016
{
1017
    int ret;
1018

    
1019
    ret = pic_poll_read(&pics[0], 0x00);
1020
    if (ret == 2)
1021
        ret = pic_poll_read(&pics[1], 0x80) + 8;
1022
    /* Prepare for ISR read */
1023
    pics[0].read_reg_select = 1;
1024
    
1025
    return ret;
1026
}
1027

    
1028
void pic_init(void)
1029
{
1030
#if defined (TARGET_I386) || defined (TARGET_PPC)
1031
    register_ioport_write(0x20, 2, pic_ioport_write, 1);
1032
    register_ioport_read(0x20, 2, pic_ioport_read, 1);
1033
    register_ioport_write(0xa0, 2, pic_ioport_write, 1);
1034
    register_ioport_read(0xa0, 2, pic_ioport_read, 1);
1035
#endif
1036
}
1037

    
1038
/***********************************************************/
1039
/* 8253 PIT emulation */
1040

    
1041
#define PIT_FREQ 1193182
1042

    
1043
#define RW_STATE_LSB 0
1044
#define RW_STATE_MSB 1
1045
#define RW_STATE_WORD0 2
1046
#define RW_STATE_WORD1 3
1047
#define RW_STATE_LATCHED_WORD0 4
1048
#define RW_STATE_LATCHED_WORD1 5
1049

    
1050
typedef struct PITChannelState {
1051
    int count; /* can be 65536 */
1052
    uint16_t latched_count;
1053
    uint8_t rw_state;
1054
    uint8_t mode;
1055
    uint8_t bcd; /* not supported */
1056
    uint8_t gate; /* timer start */
1057
    int64_t count_load_time;
1058
    int64_t count_last_edge_check_time;
1059
} PITChannelState;
1060

    
1061
PITChannelState pit_channels[3];
1062
int speaker_data_on;
1063
int dummy_refresh_clock;
1064
int pit_min_timer_count = 0;
1065

    
1066

    
1067
#if defined(__powerpc__)
1068

    
1069
static inline uint32_t get_tbl(void) 
1070
{
1071
    uint32_t tbl;
1072
    asm volatile("mftb %0" : "=r" (tbl));
1073
    return tbl;
1074
}
1075

    
1076
static inline uint32_t get_tbu(void) 
1077
{
1078
        uint32_t tbl;
1079
        asm volatile("mftbu %0" : "=r" (tbl));
1080
        return tbl;
1081
}
1082

    
1083
int64_t cpu_get_real_ticks(void)
1084
{
1085
    uint32_t l, h, h1;
1086
    /* NOTE: we test if wrapping has occurred */
1087
    do {
1088
        h = get_tbu();
1089
        l = get_tbl();
1090
        h1 = get_tbu();
1091
    } while (h != h1);
1092
    return ((int64_t)h << 32) | l;
1093
}
1094

    
1095
#elif defined(__i386__)
1096

    
1097
int64_t cpu_get_real_ticks(void)
1098
{
1099
    int64_t val;
1100
    asm("rdtsc" : "=A" (val));
1101
    return val;
1102
}
1103

    
1104
#else
1105
#error unsupported CPU
1106
#endif
1107

    
1108
static int64_t cpu_ticks_offset;
1109
static int64_t cpu_ticks_last;
1110

    
1111
int64_t cpu_get_ticks(void)
1112
{
1113
    return cpu_get_real_ticks() + cpu_ticks_offset;
1114
}
1115

    
1116
/* enable cpu_get_ticks() */
1117
void cpu_enable_ticks(void)
1118
{
1119
    cpu_ticks_offset = cpu_ticks_last - cpu_get_real_ticks();
1120
}
1121

    
1122
/* disable cpu_get_ticks() : the clock is stopped. You must not call
1123
   cpu_get_ticks() after that.  */
1124
void cpu_disable_ticks(void)
1125
{
1126
    cpu_ticks_last = cpu_get_ticks();
1127
}
1128

    
1129
int64_t get_clock(void)
1130
{
1131
    struct timeval tv;
1132
    gettimeofday(&tv, NULL);
1133
    return tv.tv_sec * 1000000LL + tv.tv_usec;
1134
}
1135

    
1136
void cpu_calibrate_ticks(void)
1137
{
1138
    int64_t usec, ticks;
1139

    
1140
    usec = get_clock();
1141
    ticks = cpu_get_ticks();
1142
    usleep(50 * 1000);
1143
    usec = get_clock() - usec;
1144
    ticks = cpu_get_ticks() - ticks;
1145
    ticks_per_sec = (ticks * 1000000LL + (usec >> 1)) / usec;
1146
}
1147

    
1148
/* compute with 96 bit intermediate result: (a*b)/c */
1149
static uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c)
1150
{
1151
    union {
1152
        uint64_t ll;
1153
        struct {
1154
#ifdef WORDS_BIGENDIAN
1155
            uint32_t high, low;
1156
#else
1157
            uint32_t low, high;
1158
#endif            
1159
        } l;
1160
    } u, res;
1161
    uint64_t rl, rh;
1162

    
1163
    u.ll = a;
1164
    rl = (uint64_t)u.l.low * (uint64_t)b;
1165
    rh = (uint64_t)u.l.high * (uint64_t)b;
1166
    rh += (rl >> 32);
1167
    res.l.high = rh / c;
1168
    res.l.low = (((rh % c) << 32) + (rl & 0xffffffff)) / c;
1169
    return res.ll;
1170
}
1171

    
1172
static int pit_get_count(PITChannelState *s)
1173
{
1174
    uint64_t d;
1175
    int counter;
1176

    
1177
    d = muldiv64(cpu_get_ticks() - s->count_load_time, PIT_FREQ, ticks_per_sec);
1178
    switch(s->mode) {
1179
    case 0:
1180
    case 1:
1181
    case 4:
1182
    case 5:
1183
        counter = (s->count - d) & 0xffff;
1184
        break;
1185
    case 3:
1186
        /* XXX: may be incorrect for odd counts */
1187
        counter = s->count - ((2 * d) % s->count);
1188
        break;
1189
    default:
1190
        counter = s->count - (d % s->count);
1191
        break;
1192
    }
1193
    return counter;
1194
}
1195

    
1196
/* get pit output bit */
1197
static int pit_get_out(PITChannelState *s)
1198
{
1199
    uint64_t d;
1200
    int out;
1201

    
1202
    d = muldiv64(cpu_get_ticks() - s->count_load_time, PIT_FREQ, ticks_per_sec);
1203
    switch(s->mode) {
1204
    default:
1205
    case 0:
1206
        out = (d >= s->count);
1207
        break;
1208
    case 1:
1209
        out = (d < s->count);
1210
        break;
1211
    case 2:
1212
        if ((d % s->count) == 0 && d != 0)
1213
            out = 1;
1214
        else
1215
            out = 0;
1216
        break;
1217
    case 3:
1218
        out = (d % s->count) < ((s->count + 1) >> 1);
1219
        break;
1220
    case 4:
1221
    case 5:
1222
        out = (d == s->count);
1223
        break;
1224
    }
1225
    return out;
1226
}
1227

    
1228
/* get the number of 0 to 1 transitions we had since we call this
1229
   function */
1230
/* XXX: maybe better to use ticks precision to avoid getting edges
1231
   twice if checks are done at very small intervals */
1232
static int pit_get_out_edges(PITChannelState *s)
1233
{
1234
    uint64_t d1, d2;
1235
    int64_t ticks;
1236
    int ret, v;
1237

    
1238
    ticks = cpu_get_ticks();
1239
    d1 = muldiv64(s->count_last_edge_check_time - s->count_load_time, 
1240
                 PIT_FREQ, ticks_per_sec);
1241
    d2 = muldiv64(ticks - s->count_load_time, 
1242
                  PIT_FREQ, ticks_per_sec);
1243
    s->count_last_edge_check_time = ticks;
1244
    switch(s->mode) {
1245
    default:
1246
    case 0:
1247
        if (d1 < s->count && d2 >= s->count)
1248
            ret = 1;
1249
        else
1250
            ret = 0;
1251
        break;
1252
    case 1:
1253
        ret = 0;
1254
        break;
1255
    case 2:
1256
        d1 /= s->count;
1257
        d2 /= s->count;
1258
        ret = d2 - d1;
1259
        break;
1260
    case 3:
1261
        v = s->count - ((s->count + 1) >> 1);
1262
        d1 = (d1 + v) / s->count;
1263
        d2 = (d2 + v) / s->count;
1264
        ret = d2 - d1;
1265
        break;
1266
    case 4:
1267
    case 5:
1268
        if (d1 < s->count && d2 >= s->count)
1269
            ret = 1;
1270
        else
1271
            ret = 0;
1272
        break;
1273
    }
1274
    return ret;
1275
}
1276

    
1277
/* val must be 0 or 1 */
1278
static inline void pit_set_gate(PITChannelState *s, int val)
1279
{
1280
    switch(s->mode) {
1281
    default:
1282
    case 0:
1283
    case 4:
1284
        /* XXX: just disable/enable counting */
1285
        break;
1286
    case 1:
1287
    case 5:
1288
        if (s->gate < val) {
1289
            /* restart counting on rising edge */
1290
            s->count_load_time = cpu_get_ticks();
1291
            s->count_last_edge_check_time = s->count_load_time;
1292
        }
1293
        break;
1294
    case 2:
1295
    case 3:
1296
        if (s->gate < val) {
1297
            /* restart counting on rising edge */
1298
            s->count_load_time = cpu_get_ticks();
1299
            s->count_last_edge_check_time = s->count_load_time;
1300
        }
1301
        /* XXX: disable/enable counting */
1302
        break;
1303
    }
1304
    s->gate = val;
1305
}
1306

    
1307
static inline void pit_load_count(PITChannelState *s, int val)
1308
{
1309
    if (val == 0)
1310
        val = 0x10000;
1311
    s->count_load_time = cpu_get_ticks();
1312
    s->count_last_edge_check_time = s->count_load_time;
1313
    s->count = val;
1314
    if (s == &pit_channels[0] && val <= pit_min_timer_count) {
1315
        fprintf(stderr, 
1316
                "\nWARNING: qemu: on your system, accurate timer emulation is impossible if its frequency is more than %d Hz. If using a 2.6 guest Linux kernel, you must patch asm/param.h to change HZ from 1000 to 100.\n\n", 
1317
                PIT_FREQ / pit_min_timer_count);
1318
    }
1319
}
1320

    
1321
void pit_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
1322
{
1323
    int channel, access;
1324
    PITChannelState *s;
1325

    
1326
    addr &= 3;
1327
    if (addr == 3) {
1328
        channel = val >> 6;
1329
        if (channel == 3)
1330
            return;
1331
        s = &pit_channels[channel];
1332
        access = (val >> 4) & 3;
1333
        switch(access) {
1334
        case 0:
1335
            s->latched_count = pit_get_count(s);
1336
            s->rw_state = RW_STATE_LATCHED_WORD0;
1337
            break;
1338
        default:
1339
            s->mode = (val >> 1) & 7;
1340
            s->bcd = val & 1;
1341
            s->rw_state = access - 1 +  RW_STATE_LSB;
1342
            break;
1343
        }
1344
    } else {
1345
        s = &pit_channels[addr];
1346
        switch(s->rw_state) {
1347
        case RW_STATE_LSB:
1348
            pit_load_count(s, val);
1349
            break;
1350
        case RW_STATE_MSB:
1351
            pit_load_count(s, val << 8);
1352
            break;
1353
        case RW_STATE_WORD0:
1354
        case RW_STATE_WORD1:
1355
            if (s->rw_state & 1) {
1356
                pit_load_count(s, (s->latched_count & 0xff) | (val << 8));
1357
            } else {
1358
                s->latched_count = val;
1359
            }
1360
            s->rw_state ^= 1;
1361
            break;
1362
        }
1363
    }
1364
}
1365

    
1366
uint32_t pit_ioport_read(CPUState *env, uint32_t addr)
1367
{
1368
    int ret, count;
1369
    PITChannelState *s;
1370
    
1371
    addr &= 3;
1372
    s = &pit_channels[addr];
1373
    switch(s->rw_state) {
1374
    case RW_STATE_LSB:
1375
    case RW_STATE_MSB:
1376
    case RW_STATE_WORD0:
1377
    case RW_STATE_WORD1:
1378
        count = pit_get_count(s);
1379
        if (s->rw_state & 1)
1380
            ret = (count >> 8) & 0xff;
1381
        else
1382
            ret = count & 0xff;
1383
        if (s->rw_state & 2)
1384
            s->rw_state ^= 1;
1385
        break;
1386
    default:
1387
    case RW_STATE_LATCHED_WORD0:
1388
    case RW_STATE_LATCHED_WORD1:
1389
        if (s->rw_state & 1)
1390
            ret = s->latched_count >> 8;
1391
        else
1392
            ret = s->latched_count & 0xff;
1393
        s->rw_state ^= 1;
1394
        break;
1395
    }
1396
    return ret;
1397
}
1398

    
1399
#if defined (TARGET_I386)
1400
void speaker_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
1401
{
1402
    speaker_data_on = (val >> 1) & 1;
1403
    pit_set_gate(&pit_channels[2], val & 1);
1404
}
1405

    
1406
uint32_t speaker_ioport_read(CPUState *env, uint32_t addr)
1407
{
1408
    int out;
1409
    out = pit_get_out(&pit_channels[2]);
1410
    dummy_refresh_clock ^= 1;
1411
    return (speaker_data_on << 1) | pit_channels[2].gate | (out << 5) |
1412
      (dummy_refresh_clock << 4);
1413
}
1414
#endif
1415

    
1416
void pit_init(void)
1417
{
1418
    PITChannelState *s;
1419
    int i;
1420

    
1421
    cpu_calibrate_ticks();
1422

    
1423
    for(i = 0;i < 3; i++) {
1424
        s = &pit_channels[i];
1425
        s->mode = 3;
1426
        s->gate = (i != 2);
1427
        pit_load_count(s, 0);
1428
    }
1429

    
1430
    register_ioport_write(0x40, 4, pit_ioport_write, 1);
1431
    register_ioport_read(0x40, 3, pit_ioport_read, 1);
1432

    
1433
#if defined (TARGET_I386)
1434
    register_ioport_read(0x61, 1, speaker_ioport_read, 1);
1435
    register_ioport_write(0x61, 1, speaker_ioport_write, 1);
1436
#endif
1437
}
1438

    
1439
/***********************************************************/
1440
/* serial port emulation */
1441

    
1442
#define UART_IRQ        4
1443

    
1444
#define UART_LCR_DLAB        0x80        /* Divisor latch access bit */
1445

    
1446
#define UART_IER_MSI        0x08        /* Enable Modem status interrupt */
1447
#define UART_IER_RLSI        0x04        /* Enable receiver line status interrupt */
1448
#define UART_IER_THRI        0x02        /* Enable Transmitter holding register int. */
1449
#define UART_IER_RDI        0x01        /* Enable receiver data interrupt */
1450

    
1451
#define UART_IIR_NO_INT        0x01        /* No interrupts pending */
1452
#define UART_IIR_ID        0x06        /* Mask for the interrupt ID */
1453

    
1454
#define UART_IIR_MSI        0x00        /* Modem status interrupt */
1455
#define UART_IIR_THRI        0x02        /* Transmitter holding register empty */
1456
#define UART_IIR_RDI        0x04        /* Receiver data interrupt */
1457
#define UART_IIR_RLSI        0x06        /* Receiver line status interrupt */
1458

    
1459
/*
1460
 * These are the definitions for the Modem Control Register
1461
 */
1462
#define UART_MCR_LOOP        0x10        /* Enable loopback test mode */
1463
#define UART_MCR_OUT2        0x08        /* Out2 complement */
1464
#define UART_MCR_OUT1        0x04        /* Out1 complement */
1465
#define UART_MCR_RTS        0x02        /* RTS complement */
1466
#define UART_MCR_DTR        0x01        /* DTR complement */
1467

    
1468
/*
1469
 * These are the definitions for the Modem Status Register
1470
 */
1471
#define UART_MSR_DCD        0x80        /* Data Carrier Detect */
1472
#define UART_MSR_RI        0x40        /* Ring Indicator */
1473
#define UART_MSR_DSR        0x20        /* Data Set Ready */
1474
#define UART_MSR_CTS        0x10        /* Clear to Send */
1475
#define UART_MSR_DDCD        0x08        /* Delta DCD */
1476
#define UART_MSR_TERI        0x04        /* Trailing edge ring indicator */
1477
#define UART_MSR_DDSR        0x02        /* Delta DSR */
1478
#define UART_MSR_DCTS        0x01        /* Delta CTS */
1479
#define UART_MSR_ANY_DELTA 0x0F        /* Any of the delta bits! */
1480

    
1481
#define UART_LSR_TEMT        0x40        /* Transmitter empty */
1482
#define UART_LSR_THRE        0x20        /* Transmit-hold-register empty */
1483
#define UART_LSR_BI        0x10        /* Break interrupt indicator */
1484
#define UART_LSR_FE        0x08        /* Frame error indicator */
1485
#define UART_LSR_PE        0x04        /* Parity error indicator */
1486
#define UART_LSR_OE        0x02        /* Overrun error indicator */
1487
#define UART_LSR_DR        0x01        /* Receiver data ready */
1488

    
1489
typedef struct SerialState {
1490
    uint8_t divider;
1491
    uint8_t rbr; /* receive register */
1492
    uint8_t ier;
1493
    uint8_t iir; /* read only */
1494
    uint8_t lcr;
1495
    uint8_t mcr;
1496
    uint8_t lsr; /* read only */
1497
    uint8_t msr;
1498
    uint8_t scr;
1499
    /* NOTE: this hidden state is necessary for tx irq generation as
1500
       it can be reset while reading iir */
1501
    int thr_ipending;
1502
} SerialState;
1503

    
1504
SerialState serial_ports[1];
1505

    
1506
void serial_update_irq(void)
1507
{
1508
    SerialState *s = &serial_ports[0];
1509

    
1510
    if ((s->lsr & UART_LSR_DR) && (s->ier & UART_IER_RDI)) {
1511
        s->iir = UART_IIR_RDI;
1512
    } else if (s->thr_ipending && (s->ier & UART_IER_THRI)) {
1513
        s->iir = UART_IIR_THRI;
1514
    } else {
1515
        s->iir = UART_IIR_NO_INT;
1516
    }
1517
    if (s->iir != UART_IIR_NO_INT) {
1518
        pic_set_irq(UART_IRQ, 1);
1519
    } else {
1520
        pic_set_irq(UART_IRQ, 0);
1521
    }
1522
}
1523

    
1524
void serial_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
1525
{
1526
    SerialState *s = &serial_ports[0];
1527
    unsigned char ch;
1528
    int ret;
1529
    
1530
    addr &= 7;
1531
#ifdef DEBUG_SERIAL
1532
    printf("serial: write addr=0x%02x val=0x%02x\n", addr, val);
1533
#endif
1534
    switch(addr) {
1535
    default:
1536
    case 0:
1537
        if (s->lcr & UART_LCR_DLAB) {
1538
            s->divider = (s->divider & 0xff00) | val;
1539
        } else {
1540
            s->thr_ipending = 0;
1541
            s->lsr &= ~UART_LSR_THRE;
1542
            serial_update_irq();
1543

    
1544
            ch = val;
1545
            do {
1546
                ret = write(1, &ch, 1);
1547
            } while (ret != 1);
1548
            s->thr_ipending = 1;
1549
            s->lsr |= UART_LSR_THRE;
1550
            s->lsr |= UART_LSR_TEMT;
1551
            serial_update_irq();
1552
        }
1553
        break;
1554
    case 1:
1555
        if (s->lcr & UART_LCR_DLAB) {
1556
            s->divider = (s->divider & 0x00ff) | (val << 8);
1557
        } else {
1558
            s->ier = val;
1559
            serial_update_irq();
1560
        }
1561
        break;
1562
    case 2:
1563
        break;
1564
    case 3:
1565
        s->lcr = val;
1566
        break;
1567
    case 4:
1568
        s->mcr = val;
1569
        break;
1570
    case 5:
1571
        break;
1572
    case 6:
1573
        s->msr = val;
1574
        break;
1575
    case 7:
1576
        s->scr = val;
1577
        break;
1578
    }
1579
}
1580

    
1581
uint32_t serial_ioport_read(CPUState *env, uint32_t addr)
1582
{
1583
    SerialState *s = &serial_ports[0];
1584
    uint32_t ret;
1585

    
1586
    addr &= 7;
1587
    switch(addr) {
1588
    default:
1589
    case 0:
1590
        if (s->lcr & UART_LCR_DLAB) {
1591
            ret = s->divider & 0xff; 
1592
        } else {
1593
            ret = s->rbr;
1594
            s->lsr &= ~(UART_LSR_DR | UART_LSR_BI);
1595
            serial_update_irq();
1596
        }
1597
        break;
1598
    case 1:
1599
        if (s->lcr & UART_LCR_DLAB) {
1600
            ret = (s->divider >> 8) & 0xff;
1601
        } else {
1602
            ret = s->ier;
1603
        }
1604
        break;
1605
    case 2:
1606
        ret = s->iir;
1607
        /* reset THR pending bit */
1608
        if ((ret & 0x7) == UART_IIR_THRI)
1609
            s->thr_ipending = 0;
1610
        serial_update_irq();
1611
        break;
1612
    case 3:
1613
        ret = s->lcr;
1614
        break;
1615
    case 4:
1616
        ret = s->mcr;
1617
        break;
1618
    case 5:
1619
        ret = s->lsr;
1620
        break;
1621
    case 6:
1622
        if (s->mcr & UART_MCR_LOOP) {
1623
            /* in loopback, the modem output pins are connected to the
1624
               inputs */
1625
            ret = (s->mcr & 0x0c) << 4;
1626
            ret |= (s->mcr & 0x02) << 3;
1627
            ret |= (s->mcr & 0x01) << 5;
1628
        } else {
1629
            ret = s->msr;
1630
        }
1631
        break;
1632
    case 7:
1633
        ret = s->scr;
1634
        break;
1635
    }
1636
#ifdef DEBUG_SERIAL
1637
    printf("serial: read addr=0x%02x val=0x%02x\n", addr, ret);
1638
#endif
1639
    return ret;
1640
}
1641

    
1642
#define TERM_ESCAPE 0x01 /* ctrl-a is used for escape */
1643
static int term_got_escape, term_command;
1644
static unsigned char term_cmd_buf[128];
1645

    
1646
typedef struct term_cmd_t {
1647
    const unsigned char *name;
1648
    void (*handler)(unsigned char *params);
1649
} term_cmd_t;
1650

    
1651
static void do_change_cdrom (unsigned char *params);
1652
static void do_change_fd0 (unsigned char *params);
1653
static void do_change_fd1 (unsigned char *params);
1654

    
1655
static term_cmd_t term_cmds[] = {
1656
    { "changecd", &do_change_cdrom, },
1657
    { "changefd0", &do_change_fd0, },
1658
    { "changefd1", &do_change_fd1, },
1659
    { NULL, NULL, },
1660
};
1661

    
1662
void term_print_help(void)
1663
{
1664
    printf("\n"
1665
           "C-a h    print this help\n"
1666
           "C-a x    exit emulatior\n"
1667
           "C-a d    switch on/off debug log\n"
1668
           "C-a s    save disk data back to file (if -snapshot)\n"
1669
           "C-a b    send break (magic sysrq)\n"
1670
           "C-a c    send qemu internal command\n"
1671
           "C-a C-a  send C-a\n"
1672
           );
1673
}
1674

    
1675
static void do_change_cdrom (unsigned char *params)
1676
{
1677
    /* Dunno how to do it... */
1678
}
1679

    
1680
static void do_change_fd (int fd, unsigned char *params)
1681
{
1682
    unsigned char *name_start, *name_end, *ros;
1683
    int ro;
1684

    
1685
    for (name_start = params;
1686
         isspace(*name_start); name_start++)
1687
        continue;
1688
    if (*name_start == '\0')
1689
        return;
1690
    for (name_end = name_start;
1691
         !isspace(*name_end) && *name_end != '\0'; name_end++)
1692
        continue;
1693
    for (ros = name_end + 1; isspace(*ros); ros++)
1694
        continue;
1695
    if (ros[0] == 'r' && ros[1] == 'o')
1696
        ro = 1;
1697
    else
1698
        ro = 0;
1699
    *name_end = '\0';
1700
    printf("Change fd %d to %s (%s)\n", fd, name_start, params);
1701
    fdctrl_disk_change(fd, name_start, ro);
1702
}
1703

    
1704
static void do_change_fd0 (unsigned char *params)
1705
{
1706
    do_change_fd(0, params);
1707
}
1708

    
1709
static void do_change_fd1 (unsigned char *params)
1710
{
1711
    do_change_fd(1, params);
1712
}
1713

    
1714
static void serial_treat_command ()
1715
{
1716
    unsigned char *cmd_start, *cmd_end;
1717
    int i;
1718

    
1719
    for (cmd_start = term_cmd_buf; isspace(*cmd_start); cmd_start++)
1720
        continue;
1721
    for (cmd_end = cmd_start;
1722
         !isspace(*cmd_end) && *cmd_end != '\0'; cmd_end++)
1723
        continue;
1724
    for (i = 0; term_cmds[i].name != NULL; i++) {
1725
        if (strlen(term_cmds[i].name) == (cmd_end - cmd_start) &&
1726
            memcmp(term_cmds[i].name, cmd_start, cmd_end - cmd_start) == 0) {
1727
            (*term_cmds[i].handler)(cmd_end + 1);
1728
            return;
1729
        }
1730
    }
1731
    *cmd_end = '\0';
1732
    printf("Unknown term command: %s\n", cmd_start);
1733
}
1734

    
1735
extern FILE *logfile;
1736

    
1737
/* called when a char is received */
1738
void serial_received_byte(SerialState *s, int ch)
1739
{
1740
    if (term_command) {
1741
        if (ch == '\n' || ch == '\r' || term_command == 127) {
1742
            printf("\n");
1743
            serial_treat_command();
1744
            term_command = 0;
1745
        } else {
1746
            if (ch == 0x7F || ch == 0x08) {
1747
                if (term_command > 1) {
1748
                    term_cmd_buf[--term_command - 1] = '\0';
1749
                    printf("\r                                               "
1750
                           "                               ");
1751
                    printf("\r> %s", term_cmd_buf);
1752
                }
1753
            } else if (ch > 0x1f) {
1754
                term_cmd_buf[term_command++ - 1] = ch;
1755
                term_cmd_buf[term_command - 1] = '\0';
1756
                printf("\r> %s", term_cmd_buf);
1757
            }
1758
            fflush(stdout);
1759
        }
1760
    } else if (term_got_escape) {
1761
        term_got_escape = 0;
1762
        switch(ch) {
1763
        case 'h':
1764
            term_print_help();
1765
            break;
1766
        case 'x':
1767
            exit(0);
1768
            break;
1769
        case 's': 
1770
            {
1771
                int i;
1772
                for (i = 0; i < MAX_DISKS; i++) {
1773
                    if (bs_table[i])
1774
                        bdrv_commit(bs_table[i]);
1775
                }
1776
            }
1777
            break;
1778
        case 'b':
1779
            /* send break */
1780
            s->rbr = 0;
1781
            s->lsr |= UART_LSR_BI | UART_LSR_DR;
1782
            serial_update_irq();
1783
            break;
1784
        case 'c':
1785
            printf("> ");
1786
            fflush(stdout);
1787
            term_command = 1;
1788
            break;
1789
        case 'd':
1790
            cpu_set_log(CPU_LOG_ALL);
1791
            break;
1792
        case TERM_ESCAPE:
1793
            goto send_char;
1794
        }
1795
    } else if (ch == TERM_ESCAPE) {
1796
        term_got_escape = 1;
1797
    } else {
1798
    send_char:
1799
        s->rbr = ch;
1800
        s->lsr |= UART_LSR_DR;
1801
        serial_update_irq();
1802
    }
1803
}
1804

    
1805
void serial_init(void)
1806
{
1807
    SerialState *s = &serial_ports[0];
1808

    
1809
    s->lsr = UART_LSR_TEMT | UART_LSR_THRE;
1810
    s->iir = UART_IIR_NO_INT;
1811
    
1812
#if defined(TARGET_I386) || defined (TARGET_PPC)
1813
    register_ioport_write(0x3f8, 8, serial_ioport_write, 1);
1814
    register_ioport_read(0x3f8, 8, serial_ioport_read, 1);
1815
#endif
1816
}
1817

    
1818
/***********************************************************/
1819
/* ne2000 emulation */
1820

    
1821
#if defined (TARGET_I386)
1822
#define NE2000_IOPORT   0x300
1823
#define NE2000_IRQ      9
1824

    
1825
#define MAX_ETH_FRAME_SIZE 1514
1826

    
1827
#define E8390_CMD        0x00  /* The command register (for all pages) */
1828
/* Page 0 register offsets. */
1829
#define EN0_CLDALO        0x01        /* Low byte of current local dma addr  RD */
1830
#define EN0_STARTPG        0x01        /* Starting page of ring bfr WR */
1831
#define EN0_CLDAHI        0x02        /* High byte of current local dma addr  RD */
1832
#define EN0_STOPPG        0x02        /* Ending page +1 of ring bfr WR */
1833
#define EN0_BOUNDARY        0x03        /* Boundary page of ring bfr RD WR */
1834
#define EN0_TSR                0x04        /* Transmit status reg RD */
1835
#define EN0_TPSR        0x04        /* Transmit starting page WR */
1836
#define EN0_NCR                0x05        /* Number of collision reg RD */
1837
#define EN0_TCNTLO        0x05        /* Low  byte of tx byte count WR */
1838
#define EN0_FIFO        0x06        /* FIFO RD */
1839
#define EN0_TCNTHI        0x06        /* High byte of tx byte count WR */
1840
#define EN0_ISR                0x07        /* Interrupt status reg RD WR */
1841
#define EN0_CRDALO        0x08        /* low byte of current remote dma address RD */
1842
#define EN0_RSARLO        0x08        /* Remote start address reg 0 */
1843
#define EN0_CRDAHI        0x09        /* high byte, current remote dma address RD */
1844
#define EN0_RSARHI        0x09        /* Remote start address reg 1 */
1845
#define EN0_RCNTLO        0x0a        /* Remote byte count reg WR */
1846
#define EN0_RCNTHI        0x0b        /* Remote byte count reg WR */
1847
#define EN0_RSR                0x0c        /* rx status reg RD */
1848
#define EN0_RXCR        0x0c        /* RX configuration reg WR */
1849
#define EN0_TXCR        0x0d        /* TX configuration reg WR */
1850
#define EN0_COUNTER0        0x0d        /* Rcv alignment error counter RD */
1851
#define EN0_DCFG        0x0e        /* Data configuration reg WR */
1852
#define EN0_COUNTER1        0x0e        /* Rcv CRC error counter RD */
1853
#define EN0_IMR                0x0f        /* Interrupt mask reg WR */
1854
#define EN0_COUNTER2        0x0f        /* Rcv missed frame error counter RD */
1855

    
1856
#define EN1_PHYS        0x11
1857
#define EN1_CURPAG      0x17
1858
#define EN1_MULT        0x18
1859

    
1860
/*  Register accessed at EN_CMD, the 8390 base addr.  */
1861
#define E8390_STOP        0x01        /* Stop and reset the chip */
1862
#define E8390_START        0x02        /* Start the chip, clear reset */
1863
#define E8390_TRANS        0x04        /* Transmit a frame */
1864
#define E8390_RREAD        0x08        /* Remote read */
1865
#define E8390_RWRITE        0x10        /* Remote write  */
1866
#define E8390_NODMA        0x20        /* Remote DMA */
1867
#define E8390_PAGE0        0x00        /* Select page chip registers */
1868
#define E8390_PAGE1        0x40        /* using the two high-order bits */
1869
#define E8390_PAGE2        0x80        /* Page 3 is invalid. */
1870

    
1871
/* Bits in EN0_ISR - Interrupt status register */
1872
#define ENISR_RX        0x01        /* Receiver, no error */
1873
#define ENISR_TX        0x02        /* Transmitter, no error */
1874
#define ENISR_RX_ERR        0x04        /* Receiver, with error */
1875
#define ENISR_TX_ERR        0x08        /* Transmitter, with error */
1876
#define ENISR_OVER        0x10        /* Receiver overwrote the ring */
1877
#define ENISR_COUNTERS        0x20        /* Counters need emptying */
1878
#define ENISR_RDC        0x40        /* remote dma complete */
1879
#define ENISR_RESET        0x80        /* Reset completed */
1880
#define ENISR_ALL        0x3f        /* Interrupts we will enable */
1881

    
1882
/* Bits in received packet status byte and EN0_RSR*/
1883
#define ENRSR_RXOK        0x01        /* Received a good packet */
1884
#define ENRSR_CRC        0x02        /* CRC error */
1885
#define ENRSR_FAE        0x04        /* frame alignment error */
1886
#define ENRSR_FO        0x08        /* FIFO overrun */
1887
#define ENRSR_MPA        0x10        /* missed pkt */
1888
#define ENRSR_PHY        0x20        /* physical/multicast address */
1889
#define ENRSR_DIS        0x40        /* receiver disable. set in monitor mode */
1890
#define ENRSR_DEF        0x80        /* deferring */
1891

    
1892
/* Transmitted packet status, EN0_TSR. */
1893
#define ENTSR_PTX 0x01        /* Packet transmitted without error */
1894
#define ENTSR_ND  0x02        /* The transmit wasn't deferred. */
1895
#define ENTSR_COL 0x04        /* The transmit collided at least once. */
1896
#define ENTSR_ABT 0x08  /* The transmit collided 16 times, and was deferred. */
1897
#define ENTSR_CRS 0x10        /* The carrier sense was lost. */
1898
#define ENTSR_FU  0x20  /* A "FIFO underrun" occurred during transmit. */
1899
#define ENTSR_CDH 0x40        /* The collision detect "heartbeat" signal was lost. */
1900
#define ENTSR_OWC 0x80  /* There was an out-of-window collision. */
1901

    
1902
#define NE2000_MEM_SIZE 32768
1903

    
1904
typedef struct NE2000State {
1905
    uint8_t cmd;
1906
    uint32_t start;
1907
    uint32_t stop;
1908
    uint8_t boundary;
1909
    uint8_t tsr;
1910
    uint8_t tpsr;
1911
    uint16_t tcnt;
1912
    uint16_t rcnt;
1913
    uint32_t rsar;
1914
    uint8_t isr;
1915
    uint8_t dcfg;
1916
    uint8_t imr;
1917
    uint8_t phys[6]; /* mac address */
1918
    uint8_t curpag;
1919
    uint8_t mult[8]; /* multicast mask array */
1920
    uint8_t mem[NE2000_MEM_SIZE];
1921
} NE2000State;
1922

    
1923
NE2000State ne2000_state;
1924
int net_fd = -1;
1925
char network_script[1024];
1926

    
1927
void ne2000_reset(void)
1928
{
1929
    NE2000State *s = &ne2000_state;
1930
    int i;
1931

    
1932
    s->isr = ENISR_RESET;
1933
    s->mem[0] = 0x52;
1934
    s->mem[1] = 0x54;
1935
    s->mem[2] = 0x00;
1936
    s->mem[3] = 0x12;
1937
    s->mem[4] = 0x34;
1938
    s->mem[5] = 0x56;
1939
    s->mem[14] = 0x57;
1940
    s->mem[15] = 0x57;
1941

    
1942
    /* duplicate prom data */
1943
    for(i = 15;i >= 0; i--) {
1944
        s->mem[2 * i] = s->mem[i];
1945
        s->mem[2 * i + 1] = s->mem[i];
1946
    }
1947
}
1948

    
1949
void ne2000_update_irq(NE2000State *s)
1950
{
1951
    int isr;
1952
    isr = s->isr & s->imr;
1953
    if (isr)
1954
        pic_set_irq(NE2000_IRQ, 1);
1955
    else
1956
        pic_set_irq(NE2000_IRQ, 0);
1957
}
1958

    
1959
int net_init(void)
1960
{
1961
    struct ifreq ifr;
1962
    int fd, ret, pid, status;
1963
    
1964
    fd = open("/dev/net/tun", O_RDWR);
1965
    if (fd < 0) {
1966
        fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1967
        return -1;
1968
    }
1969
    memset(&ifr, 0, sizeof(ifr));
1970
    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1971
    pstrcpy(ifr.ifr_name, IFNAMSIZ, "tun%d");
1972
    ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1973
    if (ret != 0) {
1974
        fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1975
        close(fd);
1976
        return -1;
1977
    }
1978
    printf("Connected to host network interface: %s\n", ifr.ifr_name);
1979
    fcntl(fd, F_SETFL, O_NONBLOCK);
1980
    net_fd = fd;
1981

    
1982
    /* try to launch network init script */
1983
    pid = fork();
1984
    if (pid >= 0) {
1985
        if (pid == 0) {
1986
            execl(network_script, network_script, ifr.ifr_name, NULL);
1987
            exit(1);
1988
        }
1989
        while (waitpid(pid, &status, 0) != pid);
1990
        if (!WIFEXITED(status) ||
1991
            WEXITSTATUS(status) != 0) {
1992
            fprintf(stderr, "%s: could not launch network script for '%s'\n",
1993
                    network_script, ifr.ifr_name);
1994
        }
1995
    }
1996
    return 0;
1997
}
1998

    
1999
void net_send_packet(NE2000State *s, const uint8_t *buf, int size)
2000
{
2001
#ifdef DEBUG_NE2000
2002
    printf("NE2000: sending packet size=%d\n", size);
2003
#endif
2004
    write(net_fd, buf, size);
2005
}
2006

    
2007
/* return true if the NE2000 can receive more data */
2008
int ne2000_can_receive(NE2000State *s)
2009
{
2010
    int avail, index, boundary;
2011
    
2012
    if (s->cmd & E8390_STOP)
2013
        return 0;
2014
    index = s->curpag << 8;
2015
    boundary = s->boundary << 8;
2016
    if (index < boundary)
2017
        avail = boundary - index;
2018
    else
2019
        avail = (s->stop - s->start) - (index - boundary);
2020
    if (avail < (MAX_ETH_FRAME_SIZE + 4))
2021
        return 0;
2022
    return 1;
2023
}
2024

    
2025
void ne2000_receive(NE2000State *s, uint8_t *buf, int size)
2026
{
2027
    uint8_t *p;
2028
    int total_len, next, avail, len, index;
2029

    
2030
#if defined(DEBUG_NE2000)
2031
    printf("NE2000: received len=%d\n", size);
2032
#endif
2033

    
2034
    index = s->curpag << 8;
2035
    /* 4 bytes for header */
2036
    total_len = size + 4;
2037
    /* address for next packet (4 bytes for CRC) */
2038
    next = index + ((total_len + 4 + 255) & ~0xff);
2039
    if (next >= s->stop)
2040
        next -= (s->stop - s->start);
2041
    /* prepare packet header */
2042
    p = s->mem + index;
2043
    p[0] = ENRSR_RXOK; /* receive status */
2044
    p[1] = next >> 8;
2045
    p[2] = total_len;
2046
    p[3] = total_len >> 8;
2047
    index += 4;
2048

    
2049
    /* write packet data */
2050
    while (size > 0) {
2051
        avail = s->stop - index;
2052
        len = size;
2053
        if (len > avail)
2054
            len = avail;
2055
        memcpy(s->mem + index, buf, len);
2056
        buf += len;
2057
        index += len;
2058
        if (index == s->stop)
2059
            index = s->start;
2060
        size -= len;
2061
    }
2062
    s->curpag = next >> 8;
2063
    
2064
    /* now we can signal we have receive something */
2065
    s->isr |= ENISR_RX;
2066
    ne2000_update_irq(s);
2067
}
2068

    
2069
void ne2000_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
2070
{
2071
    NE2000State *s = &ne2000_state;
2072
    int offset, page;
2073

    
2074
    addr &= 0xf;
2075
#ifdef DEBUG_NE2000
2076
    printf("NE2000: write addr=0x%x val=0x%02x\n", addr, val);
2077
#endif
2078
    if (addr == E8390_CMD) {
2079
        /* control register */
2080
        s->cmd = val;
2081
        if (val & E8390_START) {
2082
            /* test specific case: zero length transfert */
2083
            if ((val & (E8390_RREAD | E8390_RWRITE)) &&
2084
                s->rcnt == 0) {
2085
                s->isr |= ENISR_RDC;
2086
                ne2000_update_irq(s);
2087
            }
2088
            if (val & E8390_TRANS) {
2089
                net_send_packet(s, s->mem + (s->tpsr << 8), s->tcnt);
2090
                /* signal end of transfert */
2091
                s->tsr = ENTSR_PTX;
2092
                s->isr |= ENISR_TX;
2093
                ne2000_update_irq(s);
2094
            }
2095
        }
2096
    } else {
2097
        page = s->cmd >> 6;
2098
        offset = addr | (page << 4);
2099
        switch(offset) {
2100
        case EN0_STARTPG:
2101
            s->start = val << 8;
2102
            break;
2103
        case EN0_STOPPG:
2104
            s->stop = val << 8;
2105
            break;
2106
        case EN0_BOUNDARY:
2107
            s->boundary = val;
2108
            break;
2109
        case EN0_IMR:
2110
            s->imr = val;
2111
            ne2000_update_irq(s);
2112
            break;
2113
        case EN0_TPSR:
2114
            s->tpsr = val;
2115
            break;
2116
        case EN0_TCNTLO:
2117
            s->tcnt = (s->tcnt & 0xff00) | val;
2118
            break;
2119
        case EN0_TCNTHI:
2120
            s->tcnt = (s->tcnt & 0x00ff) | (val << 8);
2121
            break;
2122
        case EN0_RSARLO:
2123
            s->rsar = (s->rsar & 0xff00) | val;
2124
            break;
2125
        case EN0_RSARHI:
2126
            s->rsar = (s->rsar & 0x00ff) | (val << 8);
2127
            break;
2128
        case EN0_RCNTLO:
2129
            s->rcnt = (s->rcnt & 0xff00) | val;
2130
            break;
2131
        case EN0_RCNTHI:
2132
            s->rcnt = (s->rcnt & 0x00ff) | (val << 8);
2133
            break;
2134
        case EN0_DCFG:
2135
            s->dcfg = val;
2136
            break;
2137
        case EN0_ISR:
2138
            s->isr &= ~val;
2139
            ne2000_update_irq(s);
2140
            break;
2141
        case EN1_PHYS ... EN1_PHYS + 5:
2142
            s->phys[offset - EN1_PHYS] = val;
2143
            break;
2144
        case EN1_CURPAG:
2145
            s->curpag = val;
2146
            break;
2147
        case EN1_MULT ... EN1_MULT + 7:
2148
            s->mult[offset - EN1_MULT] = val;
2149
            break;
2150
        }
2151
    }
2152
}
2153

    
2154
uint32_t ne2000_ioport_read(CPUState *env, uint32_t addr)
2155
{
2156
    NE2000State *s = &ne2000_state;
2157
    int offset, page, ret;
2158

    
2159
    addr &= 0xf;
2160
    if (addr == E8390_CMD) {
2161
        ret = s->cmd;
2162
    } else {
2163
        page = s->cmd >> 6;
2164
        offset = addr | (page << 4);
2165
        switch(offset) {
2166
        case EN0_TSR:
2167
            ret = s->tsr;
2168
            break;
2169
        case EN0_BOUNDARY:
2170
            ret = s->boundary;
2171
            break;
2172
        case EN0_ISR:
2173
            ret = s->isr;
2174
            break;
2175
        case EN1_PHYS ... EN1_PHYS + 5:
2176
            ret = s->phys[offset - EN1_PHYS];
2177
            break;
2178
        case EN1_CURPAG:
2179
            ret = s->curpag;
2180
            break;
2181
        case EN1_MULT ... EN1_MULT + 7:
2182
            ret = s->mult[offset - EN1_MULT];
2183
            break;
2184
        default:
2185
            ret = 0x00;
2186
            break;
2187
        }
2188
    }
2189
#ifdef DEBUG_NE2000
2190
    printf("NE2000: read addr=0x%x val=%02x\n", addr, ret);
2191
#endif
2192
    return ret;
2193
}
2194

    
2195
void ne2000_asic_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
2196
{
2197
    NE2000State *s = &ne2000_state;
2198
    uint8_t *p;
2199

    
2200
#ifdef DEBUG_NE2000
2201
    printf("NE2000: asic write val=0x%04x\n", val);
2202
#endif
2203
    p = s->mem + s->rsar;
2204
    if (s->dcfg & 0x01) {
2205
        /* 16 bit access */
2206
        p[0] = val;
2207
        p[1] = val >> 8;
2208
        s->rsar += 2;
2209
        s->rcnt -= 2;
2210
    } else {
2211
        /* 8 bit access */
2212
        p[0] = val;
2213
        s->rsar++;
2214
        s->rcnt--;
2215
    }
2216
    /* wrap */
2217
    if (s->rsar == s->stop)
2218
        s->rsar = s->start;
2219
    if (s->rcnt == 0) {
2220
        /* signal end of transfert */
2221
        s->isr |= ENISR_RDC;
2222
        ne2000_update_irq(s);
2223
    }
2224
}
2225

    
2226
uint32_t ne2000_asic_ioport_read(CPUState *env, uint32_t addr)
2227
{
2228
    NE2000State *s = &ne2000_state;
2229
    uint8_t *p;
2230
    int ret;
2231

    
2232
    p = s->mem + s->rsar;
2233
    if (s->dcfg & 0x01) {
2234
        /* 16 bit access */
2235
        ret = p[0] | (p[1] << 8);
2236
        s->rsar += 2;
2237
        s->rcnt -= 2;
2238
    } else {
2239
        /* 8 bit access */
2240
        ret = p[0];
2241
        s->rsar++;
2242
        s->rcnt--;
2243
    }
2244
    /* wrap */
2245
    if (s->rsar == s->stop)
2246
        s->rsar = s->start;
2247
    if (s->rcnt == 0) {
2248
        /* signal end of transfert */
2249
        s->isr |= ENISR_RDC;
2250
        ne2000_update_irq(s);
2251
    }
2252
#ifdef DEBUG_NE2000
2253
    printf("NE2000: asic read val=0x%04x\n", ret);
2254
#endif
2255
    return ret;
2256
}
2257

    
2258
void ne2000_reset_ioport_write(CPUState *env, uint32_t addr, uint32_t val)
2259
{
2260
    /* nothing to do (end of reset pulse) */
2261
}
2262

    
2263
uint32_t ne2000_reset_ioport_read(CPUState *env, uint32_t addr)
2264
{
2265
    ne2000_reset();
2266
    return 0;
2267
}
2268

    
2269
void ne2000_init(void)
2270
{
2271
    register_ioport_write(NE2000_IOPORT, 16, ne2000_ioport_write, 1);
2272
    register_ioport_read(NE2000_IOPORT, 16, ne2000_ioport_read, 1);
2273

    
2274
    register_ioport_write(NE2000_IOPORT + 0x10, 1, ne2000_asic_ioport_write, 1);
2275
    register_ioport_read(NE2000_IOPORT + 0x10, 1, ne2000_asic_ioport_read, 1);
2276
    register_ioport_write(NE2000_IOPORT + 0x10, 2, ne2000_asic_ioport_write, 2);
2277
    register_ioport_read(NE2000_IOPORT + 0x10, 2, ne2000_asic_ioport_read, 2);
2278

    
2279
    register_ioport_write(NE2000_IOPORT + 0x1f, 1, ne2000_reset_ioport_write, 1);
2280
    register_ioport_read(NE2000_IOPORT + 0x1f, 1, ne2000_reset_ioport_read, 1);
2281
    ne2000_reset();
2282
}
2283
#endif
2284

    
2285
/***********************************************************/
2286
/* PC floppy disk controler emulation glue */
2287
#define PC_FDC_DMA  0x2
2288
#define PC_FDC_IRQ  0x6
2289
#define PC_FDC_BASE 0x3F0
2290

    
2291
static void fdctrl_register (unsigned char **disknames, int ro,
2292
                             char boot_device)
2293
{
2294
    int i;
2295

    
2296
    fdctrl_init(PC_FDC_IRQ, PC_FDC_DMA, 0, PC_FDC_BASE, boot_device);
2297
    for (i = 0; i < MAX_FD; i++) {
2298
        if (disknames[i] != NULL)
2299
            fdctrl_disk_change(i, disknames[i], ro);
2300
    }
2301
}
2302

    
2303
/***********************************************************/
2304
/* keyboard emulation */
2305

    
2306
/*        Keyboard Controller Commands */
2307
#define KBD_CCMD_READ_MODE        0x20        /* Read mode bits */
2308
#define KBD_CCMD_WRITE_MODE        0x60        /* Write mode bits */
2309
#define KBD_CCMD_GET_VERSION        0xA1        /* Get controller version */
2310
#define KBD_CCMD_MOUSE_DISABLE        0xA7        /* Disable mouse interface */
2311
#define KBD_CCMD_MOUSE_ENABLE        0xA8        /* Enable mouse interface */
2312
#define KBD_CCMD_TEST_MOUSE        0xA9        /* Mouse interface test */
2313
#define KBD_CCMD_SELF_TEST        0xAA        /* Controller self test */
2314
#define KBD_CCMD_KBD_TEST        0xAB        /* Keyboard interface test */
2315
#define KBD_CCMD_KBD_DISABLE        0xAD        /* Keyboard interface disable */
2316
#define KBD_CCMD_KBD_ENABLE        0xAE        /* Keyboard interface enable */
2317
#define KBD_CCMD_READ_INPORT    0xC0    /* read input port */
2318
#define KBD_CCMD_READ_OUTPORT        0xD0    /* read output port */
2319
#define KBD_CCMD_WRITE_OUTPORT        0xD1    /* write output port */
2320
#define KBD_CCMD_WRITE_OBUF        0xD2
2321
#define KBD_CCMD_WRITE_AUX_OBUF        0xD3    /* Write to output buffer as if
2322
                                           initiated by the auxiliary device */
2323
#define KBD_CCMD_WRITE_MOUSE        0xD4        /* Write the following byte to the mouse */
2324
#define KBD_CCMD_DISABLE_A20    0xDD    /* HP vectra only ? */
2325
#define KBD_CCMD_ENABLE_A20     0xDF    /* HP vectra only ? */
2326
#define KBD_CCMD_RESET                0xFE
2327

    
2328
/* Keyboard Commands */
2329
#define KBD_CMD_SET_LEDS        0xED        /* Set keyboard leds */
2330
#define KBD_CMD_ECHO             0xEE
2331
#define KBD_CMD_GET_ID                 0xF2        /* get keyboard ID */
2332
#define KBD_CMD_SET_RATE        0xF3        /* Set typematic rate */
2333
#define KBD_CMD_ENABLE                0xF4        /* Enable scanning */
2334
#define KBD_CMD_RESET_DISABLE        0xF5        /* reset and disable scanning */
2335
#define KBD_CMD_RESET_ENABLE           0xF6    /* reset and enable scanning */
2336
#define KBD_CMD_RESET                0xFF        /* Reset */
2337

    
2338
/* Keyboard Replies */
2339
#define KBD_REPLY_POR                0xAA        /* Power on reset */
2340
#define KBD_REPLY_ACK                0xFA        /* Command ACK */
2341
#define KBD_REPLY_RESEND        0xFE        /* Command NACK, send the cmd again */
2342

    
2343
/* Status Register Bits */
2344
#define KBD_STAT_OBF                 0x01        /* Keyboard output buffer full */
2345
#define KBD_STAT_IBF                 0x02        /* Keyboard input buffer full */
2346
#define KBD_STAT_SELFTEST        0x04        /* Self test successful */
2347
#define KBD_STAT_CMD                0x08        /* Last write was a command write (0=data) */
2348
#define KBD_STAT_UNLOCKED        0x10        /* Zero if keyboard locked */
2349
#define KBD_STAT_MOUSE_OBF        0x20        /* Mouse output buffer full */
2350
#define KBD_STAT_GTO                 0x40        /* General receive/xmit timeout */
2351
#define KBD_STAT_PERR                 0x80        /* Parity error */
2352

    
2353
/* Controller Mode Register Bits */
2354
#define KBD_MODE_KBD_INT        0x01        /* Keyboard data generate IRQ1 */
2355
#define KBD_MODE_MOUSE_INT        0x02        /* Mouse data generate IRQ12 */
2356
#define KBD_MODE_SYS                 0x04        /* The system flag (?) */
2357
#define KBD_MODE_NO_KEYLOCK        0x08        /* The keylock doesn't affect the keyboard if set */
2358
#define KBD_MODE_DISABLE_KBD        0x10        /* Disable keyboard interface */
2359
#define KBD_MODE_DISABLE_MOUSE        0x20        /* Disable mouse interface */
2360
#define KBD_MODE_KCC                 0x40        /* Scan code conversion to PC format */
2361
#define KBD_MODE_RFU                0x80
2362

    
2363
/* Mouse Commands */
2364
#define AUX_SET_SCALE11                0xE6        /* Set 1:1 scaling */
2365
#define AUX_SET_SCALE21                0xE7        /* Set 2:1 scaling */
2366
#define AUX_SET_RES                0xE8        /* Set resolution */
2367
#define AUX_GET_SCALE                0xE9        /* Get scaling factor */
2368
#define AUX_SET_STREAM                0xEA        /* Set stream mode */
2369
#define AUX_POLL                0xEB        /* Poll */
2370
#define AUX_RESET_WRAP                0xEC        /* Reset wrap mode */
2371
#define AUX_SET_WRAP                0xEE        /* Set wrap mode */
2372
#define AUX_SET_REMOTE                0xF0        /* Set remote mode */
2373
#define AUX_GET_TYPE                0xF2        /* Get type */
2374
#define AUX_SET_SAMPLE                0xF3        /* Set sample rate */
2375
#define AUX_ENABLE_DEV                0xF4        /* Enable aux device */
2376
#define AUX_DISABLE_DEV                0xF5        /* Disable aux device */
2377
#define AUX_SET_DEFAULT                0xF6
2378
#define AUX_RESET                0xFF        /* Reset aux device */
2379
#define AUX_ACK                        0xFA        /* Command byte ACK. */
2380

    
2381
#define MOUSE_STATUS_REMOTE     0x40
2382
#define MOUSE_STATUS_ENABLED    0x20
2383
#define MOUSE_STATUS_SCALE21    0x10
2384

    
2385
#define KBD_QUEUE_SIZE 256
2386

    
2387
typedef struct {
2388
    uint8_t data[KBD_QUEUE_SIZE];
2389
    int rptr, wptr, count;
2390
} KBDQueue;
2391

    
2392
typedef struct KBDState {
2393
    KBDQueue queues[2];
2394
    uint8_t write_cmd; /* if non zero, write data to port 60 is expected */
2395
    uint8_t status;
2396
    uint8_t mode;
2397
    /* keyboard state */
2398
    int kbd_write_cmd;
2399
    int scan_enabled;
2400
    /* mouse state */
2401
    int mouse_write_cmd;
2402
    uint8_t mouse_status;
2403
    uint8_t mouse_resolution;
2404
    uint8_t mouse_sample_rate;
2405
    uint8_t mouse_wrap;
2406
    uint8_t mouse_type; /* 0 = PS2, 3 = IMPS/2, 4 = IMEX */
2407
    uint8_t mouse_detect_state;
2408
    int mouse_dx; /* current values, needed for 'poll' mode */
2409
    int mouse_dy;
2410
    int mouse_dz;
2411
    uint8_t mouse_buttons;
2412
} KBDState;
2413

    
2414
KBDState kbd_state;
2415
int reset_requested;
2416

    
2417
/* update irq and KBD_STAT_[MOUSE_]OBF */
2418
/* XXX: not generating the irqs if KBD_MODE_DISABLE_KBD is set may be
2419
   incorrect, but it avoids having to simulate exact delays */
2420
static void kbd_update_irq(KBDState *s)
2421
{
2422
    int irq12_level, irq1_level;
2423

    
2424
    irq1_level = 0;    
2425
    irq12_level = 0;    
2426
    s->status &= ~(KBD_STAT_OBF | KBD_STAT_MOUSE_OBF);
2427
    if (s->queues[0].count != 0 ||
2428
        s->queues[1].count != 0) {
2429
        s->status |= KBD_STAT_OBF;
2430
        if (s->queues[1].count != 0) {
2431
            s->status |= KBD_STAT_MOUSE_OBF;
2432
            if (s->mode & KBD_MODE_MOUSE_INT)
2433
                irq12_level = 1;
2434
        } else {
2435
            if ((s->mode & KBD_MODE_KBD_INT) && 
2436
                !(s->mode & KBD_MODE_DISABLE_KBD))
2437
                irq1_level = 1;
2438
        }
2439
    }
2440
    pic_set_irq(1, irq1_level);
2441
    pic_set_irq(12, irq12_level);
2442
}
2443

    
2444
static void kbd_queue(KBDState *s, int b, int aux)
2445
{
2446
    KBDQueue *q = &kbd_state.queues[aux];
2447

    
2448
#if defined(DEBUG_MOUSE) || defined(DEBUG_KBD)
2449
    if (aux)
2450
        printf("mouse event: 0x%02x\n", b);
2451
#ifdef DEBUG_KBD
2452
    else
2453
        printf("kbd event: 0x%02x\n", b);
2454
#endif
2455
#endif
2456
    if (q->count >= KBD_QUEUE_SIZE)
2457
        return;
2458
    q->data[q->wptr] = b;
2459
    if (++q->wptr == KBD_QUEUE_SIZE)
2460
        q->wptr = 0;
2461
    q->count++;
2462
    kbd_update_irq(s);
2463
}
2464

    
2465
void kbd_put_keycode(int keycode)
2466
{
2467
    KBDState *s = &kbd_state;
2468
    kbd_queue(s, keycode, 0);
2469
}
2470

    
2471
uint32_t kbd_read_status(CPUState *env, uint32_t addr)
2472
{
2473
    KBDState *s = &kbd_state;
2474
    int val;
2475
    val = s->status;
2476
#if defined(DEBUG_KBD)
2477
    printf("kbd: read status=0x%02x\n", val);
2478
#endif
2479
    return val;
2480
}
2481

    
2482
void kbd_write_command(CPUState *env, uint32_t addr, uint32_t val)
2483
{
2484
    KBDState *s = &kbd_state;
2485

    
2486
#ifdef DEBUG_KBD
2487
    printf("kbd: write cmd=0x%02x\n", val);
2488
#endif
2489
    switch(val) {
2490
    case KBD_CCMD_READ_MODE:
2491
        kbd_queue(s, s->mode, 0);
2492
        break;
2493
    case KBD_CCMD_WRITE_MODE:
2494
    case KBD_CCMD_WRITE_OBUF:
2495
    case KBD_CCMD_WRITE_AUX_OBUF:
2496
    case KBD_CCMD_WRITE_MOUSE:
2497
    case KBD_CCMD_WRITE_OUTPORT:
2498
        s->write_cmd = val;
2499
        break;
2500
    case KBD_CCMD_MOUSE_DISABLE:
2501
        s->mode |= KBD_MODE_DISABLE_MOUSE;
2502
        break;
2503
    case KBD_CCMD_MOUSE_ENABLE:
2504
        s->mode &= ~KBD_MODE_DISABLE_MOUSE;
2505
        break;
2506
    case KBD_CCMD_TEST_MOUSE:
2507
        kbd_queue(s, 0x00, 0);
2508
        break;
2509
    case KBD_CCMD_SELF_TEST:
2510
        s->status |= KBD_STAT_SELFTEST;
2511
        kbd_queue(s, 0x55, 0);
2512
        break;
2513
    case KBD_CCMD_KBD_TEST:
2514
        kbd_queue(s, 0x00, 0);
2515
        break;
2516
    case KBD_CCMD_KBD_DISABLE:
2517
        s->mode |= KBD_MODE_DISABLE_KBD;
2518
        kbd_update_irq(s);
2519
        break;
2520
    case KBD_CCMD_KBD_ENABLE:
2521
        s->mode &= ~KBD_MODE_DISABLE_KBD;
2522
        kbd_update_irq(s);
2523
        break;
2524
    case KBD_CCMD_READ_INPORT:
2525
        kbd_queue(s, 0x00, 0);
2526
        break;
2527
    case KBD_CCMD_READ_OUTPORT:
2528
        /* XXX: check that */
2529
#ifdef TARGET_I386
2530
        val = 0x01 | (a20_enabled << 1);
2531
#else
2532
        val = 0x01;
2533
#endif
2534
        if (s->status & KBD_STAT_OBF)
2535
            val |= 0x10;
2536
        if (s->status & KBD_STAT_MOUSE_OBF)
2537
            val |= 0x20;
2538
        kbd_queue(s, val, 0);
2539
        break;
2540
#ifdef TARGET_I386
2541
    case KBD_CCMD_ENABLE_A20:
2542
        cpu_x86_set_a20(env, 1);
2543
        break;
2544
    case KBD_CCMD_DISABLE_A20:
2545
        cpu_x86_set_a20(env, 0);
2546
        break;
2547
#endif
2548
    case KBD_CCMD_RESET:
2549
        reset_requested = 1;
2550
        cpu_interrupt(global_env, CPU_INTERRUPT_EXIT);
2551
        break;
2552
    case 0xff:
2553
        /* ignore that - I don't know what is its use */
2554
        break;
2555
    default:
2556
        fprintf(stderr, "qemu: unsupported keyboard cmd=0x%02x\n", val);
2557
        break;
2558
    }
2559
}
2560

    
2561
uint32_t kbd_read_data(CPUState *env, uint32_t addr)
2562
{
2563
    KBDState *s = &kbd_state;
2564
    KBDQueue *q;
2565
    int val, index;
2566
    
2567
    q = &s->queues[0]; /* first check KBD data */
2568
    if (q->count == 0)
2569
        q = &s->queues[1]; /* then check AUX data */
2570
    if (q->count == 0) {
2571
        /* NOTE: if no data left, we return the last keyboard one
2572
           (needed for EMM386) */
2573
        /* XXX: need a timer to do things correctly */
2574
        q = &s->queues[0];
2575
        index = q->rptr - 1;
2576
        if (index < 0)
2577
            index = KBD_QUEUE_SIZE - 1;
2578
        val = q->data[index];
2579
    } else {
2580
        val = q->data[q->rptr];
2581
        if (++q->rptr == KBD_QUEUE_SIZE)
2582
            q->rptr = 0;
2583
        q->count--;
2584
        /* reading deasserts IRQ */
2585
        if (q == &s->queues[0])
2586
            pic_set_irq(1, 0);
2587
        else
2588
            pic_set_irq(12, 0);
2589
    }
2590
    /* reassert IRQs if data left */
2591
    kbd_update_irq(s);
2592
#ifdef DEBUG_KBD
2593
    printf("kbd: read data=0x%02x\n", val);
2594
#endif
2595
    return val;
2596
}
2597

    
2598
static void kbd_reset_keyboard(KBDState *s)
2599
{
2600
    s->scan_enabled = 1;
2601
}
2602

    
2603
static void kbd_write_keyboard(KBDState *s, int val)
2604
{
2605
    switch(s->kbd_write_cmd) {
2606
    default:
2607
    case -1:
2608
        switch(val) {
2609
        case 0x00:
2610
            kbd_queue(s, KBD_REPLY_ACK, 0);
2611
            break;
2612
        case 0x05:
2613
            kbd_queue(s, KBD_REPLY_RESEND, 0);
2614
            break;
2615
        case KBD_CMD_GET_ID:
2616
            kbd_queue(s, KBD_REPLY_ACK, 0);
2617
            kbd_queue(s, 0xab, 0);
2618
            kbd_queue(s, 0x83, 0);
2619
            break;
2620
        case KBD_CMD_ECHO:
2621
            kbd_queue(s, KBD_CMD_ECHO, 0);
2622
            break;
2623
        case KBD_CMD_ENABLE:
2624
            s->scan_enabled = 1;
2625
            kbd_queue(s, KBD_REPLY_ACK, 0);
2626
            break;
2627
        case KBD_CMD_SET_LEDS:
2628
        case KBD_CMD_SET_RATE:
2629
            s->kbd_write_cmd = val;
2630
            kbd_queue(s, KBD_REPLY_ACK, 0);
2631
            break;
2632
        case KBD_CMD_RESET_DISABLE:
2633
            kbd_reset_keyboard(s);
2634
            s->scan_enabled = 0;
2635
            kbd_queue(s, KBD_REPLY_ACK, 0);
2636
            break;
2637
        case KBD_CMD_RESET_ENABLE:
2638
            kbd_reset_keyboard(s);
2639
            s->scan_enabled = 1;
2640
            kbd_queue(s, KBD_REPLY_ACK, 0);
2641
            break;
2642
        case KBD_CMD_RESET:
2643
            kbd_reset_keyboard(s);
2644
            kbd_queue(s, KBD_REPLY_ACK, 0);
2645
            kbd_queue(s, KBD_REPLY_POR, 0);
2646
            break;
2647
        default:
2648
            kbd_queue(s, KBD_REPLY_ACK, 0);
2649
            break;
2650
        }
2651
        break;
2652
    case KBD_CMD_SET_LEDS:
2653
        kbd_queue(s, KBD_REPLY_ACK, 0);
2654
        s->kbd_write_cmd = -1;
2655
        break;
2656
    case KBD_CMD_SET_RATE:
2657
        kbd_queue(s, KBD_REPLY_ACK, 0);
2658
        s->kbd_write_cmd = -1;
2659
        break;
2660
    }
2661
}
2662

    
2663
static void kbd_mouse_send_packet(KBDState *s)
2664
{
2665
    unsigned int b;
2666
    int dx1, dy1, dz1;
2667

    
2668
    dx1 = s->mouse_dx;
2669
    dy1 = s->mouse_dy;
2670
    dz1 = s->mouse_dz;
2671
    /* XXX: increase range to 8 bits ? */
2672
    if (dx1 > 127)
2673
        dx1 = 127;
2674
    else if (dx1 < -127)
2675
        dx1 = -127;
2676
    if (dy1 > 127)
2677
        dy1 = 127;
2678
    else if (dy1 < -127)
2679
        dy1 = -127;
2680
    b = 0x08 | ((dx1 < 0) << 4) | ((dy1 < 0) << 5) | (s->mouse_buttons & 0x07);
2681
    kbd_queue(s, b, 1);
2682
    kbd_queue(s, dx1 & 0xff, 1);
2683
    kbd_queue(s, dy1 & 0xff, 1);
2684
    /* extra byte for IMPS/2 or IMEX */
2685
    switch(s->mouse_type) {
2686
    default:
2687
        break;
2688
    case 3:
2689
        if (dz1 > 127)
2690
            dz1 = 127;
2691
        else if (dz1 < -127)
2692
                dz1 = -127;
2693
        kbd_queue(s, dz1 & 0xff, 1);
2694
        break;
2695
    case 4:
2696
        if (dz1 > 7)
2697
            dz1 = 7;
2698
        else if (dz1 < -7)
2699
            dz1 = -7;
2700
        b = (dz1 & 0x0f) | ((s->mouse_buttons & 0x18) << 1);
2701
        kbd_queue(s, b, 1);
2702
        break;
2703
    }
2704

    
2705
    /* update deltas */
2706
    s->mouse_dx -= dx1;
2707
    s->mouse_dy -= dy1;
2708
    s->mouse_dz -= dz1;
2709
}
2710

    
2711
void kbd_mouse_event(int dx, int dy, int dz, int buttons_state)
2712
{
2713
    KBDState *s = &kbd_state;
2714

    
2715
    /* check if deltas are recorded when disabled */
2716
    if (!(s->mouse_status & MOUSE_STATUS_ENABLED))
2717
        return;
2718

    
2719
    s->mouse_dx += dx;
2720
    s->mouse_dy -= dy;
2721
    s->mouse_dz += dz;
2722
    s->mouse_buttons = buttons_state;
2723
    
2724
    if (!(s->mouse_status & MOUSE_STATUS_REMOTE) &&
2725
        (s->queues[1].count < (KBD_QUEUE_SIZE - 16))) {
2726
        for(;;) {
2727
            /* if not remote, send event. Multiple events are sent if
2728
               too big deltas */
2729
            kbd_mouse_send_packet(s);
2730
            if (s->mouse_dx == 0 && s->mouse_dy == 0 && s->mouse_dz == 0)
2731
                break;
2732
        }
2733
    }
2734
}
2735

    
2736
static void kbd_write_mouse(KBDState *s, int val)
2737
{
2738
#ifdef DEBUG_MOUSE
2739
    printf("kbd: write mouse 0x%02x\n", val);
2740
#endif
2741
    switch(s->mouse_write_cmd) {
2742
    default:
2743
    case -1:
2744
        /* mouse command */
2745
        if (s->mouse_wrap) {
2746
            if (val == AUX_RESET_WRAP) {
2747
                s->mouse_wrap = 0;
2748
                kbd_queue(s, AUX_ACK, 1);
2749
                return;
2750
            } else if (val != AUX_RESET) {
2751
                kbd_queue(s, val, 1);
2752
                return;
2753
            }
2754
        }
2755
        switch(val) {
2756
        case AUX_SET_SCALE11:
2757
            s->mouse_status &= ~MOUSE_STATUS_SCALE21;
2758
            kbd_queue(s, AUX_ACK, 1);
2759
            break;
2760
        case AUX_SET_SCALE21:
2761
            s->mouse_status |= MOUSE_STATUS_SCALE21;
2762
            kbd_queue(s, AUX_ACK, 1);
2763
            break;
2764
        case AUX_SET_STREAM:
2765
            s->mouse_status &= ~MOUSE_STATUS_REMOTE;
2766
            kbd_queue(s, AUX_ACK, 1);
2767
            break;
2768
        case AUX_SET_WRAP:
2769
            s->mouse_wrap = 1;
2770
            kbd_queue(s, AUX_ACK, 1);
2771
            break;
2772
        case AUX_SET_REMOTE:
2773
            s->mouse_status |= MOUSE_STATUS_REMOTE;
2774
            kbd_queue(s, AUX_ACK, 1);
2775
            break;
2776
        case AUX_GET_TYPE:
2777
            kbd_queue(s, AUX_ACK, 1);
2778
            kbd_queue(s, s->mouse_type, 1);
2779
            break;
2780
        case AUX_SET_RES:
2781
        case AUX_SET_SAMPLE:
2782
            s->mouse_write_cmd = val;
2783
            kbd_queue(s, AUX_ACK, 1);
2784
            break;
2785
        case AUX_GET_SCALE:
2786
            kbd_queue(s, AUX_ACK, 1);
2787
            kbd_queue(s, s->mouse_status, 1);
2788
            kbd_queue(s, s->mouse_resolution, 1);
2789
            kbd_queue(s, s->mouse_sample_rate, 1);
2790
            break;
2791
        case AUX_POLL:
2792
            kbd_queue(s, AUX_ACK, 1);
2793
            kbd_mouse_send_packet(s);
2794
            break;
2795
        case AUX_ENABLE_DEV:
2796
            s->mouse_status |= MOUSE_STATUS_ENABLED;
2797
            kbd_queue(s, AUX_ACK, 1);
2798
            break;
2799
        case AUX_DISABLE_DEV:
2800
            s->mouse_status &= ~MOUSE_STATUS_ENABLED;
2801
            kbd_queue(s, AUX_ACK, 1);
2802
            break;
2803
        case AUX_SET_DEFAULT:
2804
            s->mouse_sample_rate = 100;
2805
            s->mouse_resolution = 2;
2806
            s->mouse_status = 0;
2807
            kbd_queue(s, AUX_ACK, 1);
2808
            break;
2809
        case AUX_RESET:
2810
            s->mouse_sample_rate = 100;
2811
            s->mouse_resolution = 2;
2812
            s->mouse_status = 0;
2813
            kbd_queue(s, AUX_ACK, 1);
2814
            kbd_queue(s, 0xaa, 1);
2815
            kbd_queue(s, s->mouse_type, 1);
2816
            break;
2817
        default:
2818
            break;
2819
        }
2820
        break;
2821
    case AUX_SET_SAMPLE:
2822
        s->mouse_sample_rate = val;
2823
#if 0
2824
        /* detect IMPS/2 or IMEX */
2825
        switch(s->mouse_detect_state) {
2826
        default:
2827
        case 0:
2828
            if (val == 200)
2829
                s->mouse_detect_state = 1;
2830
            break;
2831
        case 1:
2832
            if (val == 100)
2833
                s->mouse_detect_state = 2;
2834
            else if (val == 200)
2835
                s->mouse_detect_state = 3;
2836
            else
2837
                s->mouse_detect_state = 0;
2838
            break;
2839
        case 2:
2840
            if (val == 80) 
2841
                s->mouse_type = 3; /* IMPS/2 */
2842
            s->mouse_detect_state = 0;
2843
            break;
2844
        case 3:
2845
            if (val == 80) 
2846
                s->mouse_type = 4; /* IMEX */
2847
            s->mouse_detect_state = 0;
2848
            break;
2849
        }
2850
#endif
2851
        kbd_queue(s, AUX_ACK, 1);
2852
        s->mouse_write_cmd = -1;
2853
        break;
2854
    case AUX_SET_RES:
2855
        s->mouse_resolution = val;
2856
        kbd_queue(s, AUX_ACK, 1);
2857
        s->mouse_write_cmd = -1;
2858
        break;
2859
    }
2860
}
2861

    
2862
void kbd_write_data(CPUState *env, uint32_t addr, uint32_t val)
2863
{
2864
    KBDState *s = &kbd_state;
2865

    
2866
#ifdef DEBUG_KBD
2867
    printf("kbd: write data=0x%02x\n", val);
2868
#endif
2869

    
2870
    switch(s->write_cmd) {
2871
    case 0:
2872
        kbd_write_keyboard(s, val);
2873
        break;
2874
    case KBD_CCMD_WRITE_MODE:
2875
        s->mode = val;
2876
        kbd_update_irq(s);
2877
        break;
2878
    case KBD_CCMD_WRITE_OBUF:
2879
        kbd_queue(s, val, 0);
2880
        break;
2881
    case KBD_CCMD_WRITE_AUX_OBUF:
2882
        kbd_queue(s, val, 1);
2883
        break;
2884
    case KBD_CCMD_WRITE_OUTPORT:
2885
#ifdef TARGET_I386
2886
        cpu_x86_set_a20(env, (val >> 1) & 1);
2887
#endif
2888
        if (!(val & 1)) {
2889
            reset_requested = 1;
2890
            cpu_interrupt(global_env, CPU_INTERRUPT_EXIT);
2891
        }
2892
        break;
2893
    case KBD_CCMD_WRITE_MOUSE:
2894
        kbd_write_mouse(s, val);
2895
        break;
2896
    default:
2897
        break;
2898
    }
2899
    s->write_cmd = 0;
2900
}
2901

    
2902
void kbd_reset(KBDState *s)
2903
{
2904
    KBDQueue *q;
2905
    int i;
2906

    
2907
    s->kbd_write_cmd = -1;
2908
    s->mouse_write_cmd = -1;
2909
    s->mode = KBD_MODE_KBD_INT | KBD_MODE_MOUSE_INT;
2910
    s->status = KBD_STAT_CMD | KBD_STAT_UNLOCKED;
2911
    for(i = 0; i < 2; i++) {
2912
        q = &s->queues[i];
2913
        q->rptr = 0;
2914
        q->wptr = 0;
2915
        q->count = 0;
2916
    }
2917
}
2918

    
2919
void kbd_init(void)
2920
{
2921
    kbd_reset(&kbd_state);
2922
#if defined (TARGET_I386) || defined (TARGET_PPC)
2923
    register_ioport_read(0x60, 1, kbd_read_data, 1);
2924
    register_ioport_write(0x60, 1, kbd_write_data, 1);
2925
    register_ioport_read(0x64, 1, kbd_read_status, 1);
2926
    register_ioport_write(0x64, 1, kbd_write_command, 1);
2927
#endif
2928
}
2929

    
2930
/***********************************************************/
2931
/* Bochs BIOS debug ports */
2932
#ifdef TARGET_I386
2933
void bochs_bios_write(CPUX86State *env, uint32_t addr, uint32_t val)
2934
{
2935
    switch(addr) {
2936
        /* Bochs BIOS messages */
2937
    case 0x400:
2938
    case 0x401:
2939
        fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
2940
        exit(1);
2941
    case 0x402:
2942
    case 0x403:
2943
#ifdef DEBUG_BIOS
2944
        fprintf(stderr, "%c", val);
2945
#endif
2946
        break;
2947

    
2948
        /* LGPL'ed VGA BIOS messages */
2949
    case 0x501:
2950
    case 0x502:
2951
        fprintf(stderr, "VGA BIOS panic, line %d\n", val);
2952
        exit(1);
2953
    case 0x500:
2954
    case 0x503:
2955
#ifdef DEBUG_BIOS
2956
        fprintf(stderr, "%c", val);
2957
#endif
2958
        break;
2959
    }
2960
}
2961

    
2962
void bochs_bios_init(void)
2963
{
2964
    register_ioport_write(0x400, 1, bochs_bios_write, 2);
2965
    register_ioport_write(0x401, 1, bochs_bios_write, 2);
2966
    register_ioport_write(0x402, 1, bochs_bios_write, 1);
2967
    register_ioport_write(0x403, 1, bochs_bios_write, 1);
2968

    
2969
    register_ioport_write(0x501, 1, bochs_bios_write, 2);
2970
    register_ioport_write(0x502, 1, bochs_bios_write, 2);
2971
    register_ioport_write(0x500, 1, bochs_bios_write, 1);
2972
    register_ioport_write(0x503, 1, bochs_bios_write, 1);
2973
}
2974
#endif
2975

    
2976
/***********************************************************/
2977
/* dumb display */
2978

    
2979
/* init terminal so that we can grab keys */
2980
static struct termios oldtty;
2981

    
2982
static void term_exit(void)
2983
{
2984
    tcsetattr (0, TCSANOW, &oldtty);
2985
}
2986

    
2987
static void term_init(void)
2988
{
2989
    struct termios tty;
2990

    
2991
    tcgetattr (0, &tty);
2992
    oldtty = tty;
2993

    
2994
    tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
2995
                          |INLCR|IGNCR|ICRNL|IXON);
2996
    tty.c_oflag |= OPOST;
2997
    tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);
2998
    /* if graphical mode, we allow Ctrl-C handling */
2999
    if (nographic)
3000
        tty.c_lflag &= ~ISIG;
3001
    tty.c_cflag &= ~(CSIZE|PARENB);
3002
    tty.c_cflag |= CS8;
3003
    tty.c_cc[VMIN] = 1;
3004
    tty.c_cc[VTIME] = 0;
3005
    
3006
    tcsetattr (0, TCSANOW, &tty);
3007

    
3008
    atexit(term_exit);
3009

    
3010
    fcntl(0, F_SETFL, O_NONBLOCK);
3011
}
3012

    
3013
static void dumb_update(DisplayState *ds, int x, int y, int w, int h)
3014
{
3015
}
3016

    
3017
static void dumb_resize(DisplayState *ds, int w, int h)
3018
{
3019
}
3020

    
3021
static void dumb_refresh(DisplayState *ds)
3022
{
3023
    vga_update_display();
3024
}
3025

    
3026
void dumb_display_init(DisplayState *ds)
3027
{
3028
    ds->data = NULL;
3029
    ds->linesize = 0;
3030
    ds->depth = 0;
3031
    ds->dpy_update = dumb_update;
3032
    ds->dpy_resize = dumb_resize;
3033
    ds->dpy_refresh = dumb_refresh;
3034
}
3035

    
3036
#if !defined(CONFIG_SOFTMMU)
3037
/***********************************************************/
3038
/* cpu signal handler */
3039
static void host_segv_handler(int host_signum, siginfo_t *info, 
3040
                              void *puc)
3041
{
3042
    if (cpu_signal_handler(host_signum, info, puc))
3043
        return;
3044
    term_exit();
3045
    abort();
3046
}
3047
#endif
3048

    
3049
static int timer_irq_pending;
3050
static int timer_irq_count;
3051

    
3052
static int timer_ms;
3053
static int gui_refresh_pending, gui_refresh_count;
3054

    
3055
static void host_alarm_handler(int host_signum, siginfo_t *info, 
3056
                               void *puc)
3057
{
3058
    /* NOTE: since usually the OS asks a 100 Hz clock, there can be
3059
       some drift between cpu_get_ticks() and the interrupt time. So
3060
       we queue some interrupts to avoid missing some */
3061
    timer_irq_count += pit_get_out_edges(&pit_channels[0]);
3062
    if (timer_irq_count) {
3063
        if (timer_irq_count > 2)
3064
            timer_irq_count = 2;
3065
        timer_irq_count--;
3066
        timer_irq_pending = 1;
3067
    }
3068
    gui_refresh_count += timer_ms;
3069
    if (gui_refresh_count >= GUI_REFRESH_INTERVAL) {
3070
        gui_refresh_count = 0;
3071
        gui_refresh_pending = 1;
3072
    }
3073

    
3074
    /* XXX: seems dangerous to run that here. */
3075
    DMA_run();
3076
    SB16_run();
3077

    
3078
    if (gui_refresh_pending || timer_irq_pending) {
3079
        /* just exit from the cpu to have a chance to handle timers */
3080
        cpu_interrupt(global_env, CPU_INTERRUPT_EXIT);
3081
    }
3082
}
3083

    
3084
#ifdef CONFIG_SOFTMMU
3085
void *get_mmap_addr(unsigned long size)
3086
{
3087
    return NULL;
3088
}
3089
#else
3090
unsigned long mmap_addr = PHYS_RAM_BASE;
3091

    
3092
void *get_mmap_addr(unsigned long size)
3093
{
3094
    unsigned long addr;
3095
    addr = mmap_addr;
3096
    mmap_addr += ((size + 4095) & ~4095) + 4096;
3097
    return (void *)addr;
3098
}
3099
#endif
3100

    
3101
/* main execution loop */
3102

    
3103
CPUState *cpu_gdbstub_get_env(void *opaque)
3104
{
3105
    return global_env;
3106
}
3107

    
3108
int main_loop(void *opaque)
3109
{
3110
    struct pollfd ufds[3], *pf, *serial_ufd, *gdb_ufd;
3111
#if defined (TARGET_I386)
3112
    struct pollfd *net_ufd;
3113
#endif
3114
    int ret, n, timeout, serial_ok;
3115
    uint8_t ch;
3116
    CPUState *env = global_env;
3117

    
3118
    if (!term_inited) {
3119
        /* initialize terminal only there so that the user has a
3120
           chance to stop QEMU with Ctrl-C before the gdb connection
3121
           is launched */
3122
        term_inited = 1;
3123
        term_init();
3124
    }
3125

    
3126
    serial_ok = 1;
3127
    cpu_enable_ticks();
3128
    for(;;) {
3129
#if defined (DO_TB_FLUSH)
3130
        tb_flush();
3131
#endif
3132
        ret = cpu_exec(env);
3133
        if (reset_requested) {
3134
            ret = EXCP_INTERRUPT; 
3135
            break;
3136
        }
3137
        if (ret == EXCP_DEBUG) {
3138
            ret = EXCP_DEBUG;
3139
            break;
3140
        }
3141
        /* if hlt instruction, we wait until the next IRQ */
3142
        if (ret == EXCP_HLT) 
3143
            timeout = 10;
3144
        else
3145
            timeout = 0;
3146
        /* poll any events */
3147
        serial_ufd = NULL;
3148
        pf = ufds;
3149
        if (serial_ok && !(serial_ports[0].lsr & UART_LSR_DR)) {
3150
            serial_ufd = pf;
3151
            pf->fd = 0;
3152
            pf->events = POLLIN;
3153
            pf++;
3154
        }
3155
#if defined (TARGET_I386)
3156
        net_ufd = NULL;
3157
        if (net_fd > 0 && ne2000_can_receive(&ne2000_state)) {
3158
            net_ufd = pf;
3159
            pf->fd = net_fd;
3160
            pf->events = POLLIN;
3161
            pf++;
3162
        }
3163
#endif
3164
        gdb_ufd = NULL;
3165
        if (gdbstub_fd > 0) {
3166
            gdb_ufd = pf;
3167
            pf->fd = gdbstub_fd;
3168
            pf->events = POLLIN;
3169
            pf++;
3170
        }
3171

    
3172
        ret = poll(ufds, pf - ufds, timeout);
3173
        if (ret > 0) {
3174
            if (serial_ufd && (serial_ufd->revents & POLLIN)) {
3175
                n = read(0, &ch, 1);
3176
                if (n == 1) {
3177
                    serial_received_byte(&serial_ports[0], ch);
3178
                } else {
3179
                    /* Closed, stop polling. */
3180
                    serial_ok = 0;
3181
                }
3182
            }
3183
#if defined (TARGET_I386)
3184
            if (net_ufd && (net_ufd->revents & POLLIN)) {
3185
                uint8_t buf[MAX_ETH_FRAME_SIZE];
3186

    
3187
                n = read(net_fd, buf, MAX_ETH_FRAME_SIZE);
3188
                if (n > 0) {
3189
                    if (n < 60) {
3190
                        memset(buf + n, 0, 60 - n);
3191
                        n = 60;
3192
                    }
3193
                    ne2000_receive(&ne2000_state, buf, n);
3194
                }
3195
            }
3196
#endif
3197
            if (gdb_ufd && (gdb_ufd->revents & POLLIN)) {
3198
                uint8_t buf[1];
3199
                /* stop emulation if requested by gdb */
3200
                n = read(gdbstub_fd, buf, 1);
3201
                if (n == 1) {
3202
                    ret = EXCP_INTERRUPT; 
3203
                    break;
3204
                }
3205
            }
3206
        }
3207

    
3208
        /* timer IRQ */
3209
        if (timer_irq_pending) {
3210
#if defined (TARGET_I386)
3211
            pic_set_irq(0, 1);
3212
            pic_set_irq(0, 0);
3213
            timer_irq_pending = 0;
3214
            /* XXX: RTC test */
3215
            if (cmos_data[RTC_REG_B] & 0x50) {
3216
                pic_set_irq(8, 1);
3217
            }
3218
#endif
3219
        }
3220

    
3221
        /* VGA */
3222
        if (gui_refresh_pending) {
3223
            display_state.dpy_refresh(&display_state);
3224
            gui_refresh_pending = 0;
3225
        }
3226
    }
3227
    cpu_disable_ticks();
3228
    return ret;
3229
}
3230

    
3231
void help(void)
3232
{
3233
    printf("QEMU PC emulator version " QEMU_VERSION ", Copyright (c) 2003 Fabrice Bellard\n"
3234
           "usage: %s [options] [disk_image]\n"
3235
           "\n"
3236
           "'disk_image' is a raw hard image image for IDE hard disk 0\n"
3237
           "\n"
3238
           "Standard options:\n"
3239
           "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n"
3240
           "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n"
3241
           "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n"
3242
           "-cdrom file     use 'file' as IDE cdrom 2 image\n"
3243
           "-boot [a|b|c|d] boot on floppy (a, b), hard disk (c) or CD-ROM (d)\n"
3244
           "-snapshot       write to temporary files instead of disk image files\n"
3245
           "-m megs         set virtual RAM size to megs MB\n"
3246
           "-n script       set network init script [default=%s]\n"
3247
           "-tun-fd fd      this fd talks to tap/tun, use it.\n"
3248
           "-nographic      disable graphical output\n"
3249
           "\n"
3250
           "Linux boot specific (does not require PC BIOS):\n"
3251
           "-kernel bzImage use 'bzImage' as kernel image\n"
3252
           "-append cmdline use 'cmdline' as kernel command line\n"
3253
           "-initrd file    use 'file' as initial ram disk\n"
3254
           "\n"
3255
           "Debug/Expert options:\n"
3256
           "-s              wait gdb connection to port %d\n"
3257
           "-p port         change gdb connection port\n"
3258
           "-d              output log to %s\n"
3259
           "-hdachs c,h,s   force hard disk 0 geometry (usually qemu can guess it)\n"
3260
           "-L path         set the directory for the BIOS and VGA BIOS\n"
3261
           "\n"
3262
           "During emulation, use C-a h to get terminal commands:\n",
3263
#ifdef CONFIG_SOFTMMU
3264
           "qemu",
3265
#else
3266
           "qemu-fast",
3267
#endif
3268
           DEFAULT_NETWORK_SCRIPT, 
3269
           DEFAULT_GDBSTUB_PORT,
3270
           "/tmp/qemu.log");
3271
    term_print_help();
3272
#ifndef CONFIG_SOFTMMU
3273
    printf("\n"
3274
           "NOTE: this version of QEMU is faster but it needs slightly patched OSes to\n"
3275
           "work. Please use the 'qemu' executable to have a more accurate (but slower)\n"
3276
           "PC emulation.\n");
3277
#endif
3278
    exit(1);
3279
}
3280

    
3281
struct option long_options[] = {
3282
    { "initrd", 1, NULL, 0, },
3283
    { "hda", 1, NULL, 0, },
3284
    { "hdb", 1, NULL, 0, },
3285
    { "snapshot", 0, NULL, 0, },
3286
    { "hdachs", 1, NULL, 0, },
3287
    { "nographic", 0, NULL, 0, },
3288
    { "kernel", 1, NULL, 0, },
3289
    { "append", 1, NULL, 0, },
3290
    { "tun-fd", 1, NULL, 0, },
3291
    { "hdc", 1, NULL, 0, },
3292
    { "hdd", 1, NULL, 0, },
3293
    { "cdrom", 1, NULL, 0, },
3294
    { "boot", 1, NULL, 0, },
3295
    { "fda", 1, NULL, 0, },
3296
    { "fdb", 1, NULL, 0, },
3297
    { NULL, 0, NULL, 0 },
3298
};
3299

    
3300
#ifdef CONFIG_SDL
3301
/* SDL use the pthreads and they modify sigaction. We don't
3302
   want that. */
3303
#if __GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 2)
3304
extern void __libc_sigaction();
3305
#define sigaction(sig, act, oact) __libc_sigaction(sig, act, oact)
3306
#else
3307
extern void __sigaction();
3308
#define sigaction(sig, act, oact) __sigaction(sig, act, oact)
3309
#endif
3310
#endif /* CONFIG_SDL */
3311

    
3312
int main(int argc, char **argv)
3313
{
3314
    int c, ret, initrd_size, i, use_gdbstub, gdbstub_port, long_index;
3315
    int snapshot, linux_boot, total_ram_size;
3316
#if defined (TARGET_I386)
3317
    struct linux_params *params;
3318
#endif
3319
    struct sigaction act;
3320
    struct itimerval itv;
3321
    CPUState *env;
3322
    const char *initrd_filename;
3323
    const char *hd_filename[MAX_DISKS], *fd_filename[MAX_FD];
3324
    const char *kernel_filename, *kernel_cmdline;
3325
    DisplayState *ds = &display_state;
3326

    
3327
    /* we never want that malloc() uses mmap() */
3328
    mallopt(M_MMAP_THRESHOLD, 4096 * 1024);
3329
    initrd_filename = NULL;
3330
    for(i = 0; i < MAX_FD; i++)
3331
        fd_filename[i] = NULL;
3332
    for(i = 0; i < MAX_DISKS; i++)
3333
        hd_filename[i] = NULL;
3334
    phys_ram_size = 32 * 1024 * 1024;
3335
    vga_ram_size = VGA_RAM_SIZE;
3336
#if defined (TARGET_I386)
3337
    pstrcpy(network_script, sizeof(network_script), DEFAULT_NETWORK_SCRIPT);
3338
#endif
3339
    use_gdbstub = 0;
3340
    gdbstub_port = DEFAULT_GDBSTUB_PORT;
3341
    snapshot = 0;
3342
    nographic = 0;
3343
    kernel_filename = NULL;
3344
    kernel_cmdline = "";
3345
    for(;;) {
3346
        c = getopt_long_only(argc, argv, "hm:dn:sp:L:", long_options, &long_index);
3347
        if (c == -1)
3348
            break;
3349
        switch(c) {
3350
        case 0:
3351
            switch(long_index) {
3352
            case 0:
3353
                initrd_filename = optarg;
3354
                break;
3355
            case 1:
3356
                hd_filename[0] = optarg;
3357
                break;
3358
            case 2:
3359
                hd_filename[1] = optarg;
3360
                break;
3361
            case 3:
3362
                snapshot = 1;
3363
                break;
3364
            case 4:
3365
                {
3366
                    int cyls, heads, secs;
3367
                    const char *p;
3368
                    p = optarg;
3369
                    cyls = strtol(p, (char **)&p, 0);
3370
                    if (*p != ',')
3371
                        goto chs_fail;
3372
                    p++;
3373
                    heads = strtol(p, (char **)&p, 0);
3374
                    if (*p != ',')
3375
                        goto chs_fail;
3376
                    p++;
3377
                    secs = strtol(p, (char **)&p, 0);
3378
                    if (*p != '\0')
3379
                        goto chs_fail;
3380
                    ide_set_geometry(0, cyls, heads, secs);
3381
                chs_fail: ;
3382
                }
3383
                break;
3384
            case 5:
3385
                nographic = 1;
3386
                break;
3387
            case 6:
3388
                kernel_filename = optarg;
3389
                break;
3390
            case 7:
3391
                kernel_cmdline = optarg;
3392
                break;
3393
#if defined (TARGET_I386)
3394
            case 8:
3395
                net_fd = atoi(optarg);
3396
                break;
3397
#endif
3398
            case 9:
3399
                hd_filename[2] = optarg;
3400
                break;
3401
            case 10:
3402
                hd_filename[3] = optarg;
3403
                break;
3404
            case 11:
3405
                hd_filename[2] = optarg;
3406
                ide_set_cdrom(2, 1);
3407
                break;
3408
            case 12:
3409
                boot_device = optarg[0];
3410
                if (boot_device != 'a' && boot_device != 'b' &&
3411
                    boot_device != 'c' && boot_device != 'd') {
3412
                    fprintf(stderr, "qemu: invalid boot device '%c'\n", boot_device);
3413
                    exit(1);
3414
                }
3415
                break;
3416
            case 13:
3417
                fd_filename[0] = optarg;
3418
                break;
3419
            case 14:
3420
                fd_filename[1] = optarg;
3421
                break;
3422
            }
3423
            break;
3424
        case 'h':
3425
            help();
3426
            break;
3427
        case 'm':
3428
            phys_ram_size = atoi(optarg) * 1024 * 1024;
3429
            if (phys_ram_size <= 0)
3430
                help();
3431
            if (phys_ram_size > PHYS_RAM_MAX_SIZE) {
3432
                fprintf(stderr, "qemu: at most %d MB RAM can be simulated\n",
3433
                        PHYS_RAM_MAX_SIZE / (1024 * 1024));
3434
                exit(1);
3435
            }
3436
            break;
3437
        case 'd':
3438
            cpu_set_log(CPU_LOG_ALL);
3439
            break;
3440
#if defined (TARGET_I386)
3441
        case 'n':
3442
            pstrcpy(network_script, sizeof(network_script), optarg);
3443
            break;
3444
#endif
3445
        case 's':
3446
            use_gdbstub = 1;
3447
            break;
3448
        case 'p':
3449
            gdbstub_port = atoi(optarg);
3450
            break;
3451
        case 'L':
3452
            bios_dir = optarg;
3453
            break;
3454
        }
3455
    }
3456

    
3457
    if (optind < argc) {
3458
        hd_filename[0] = argv[optind++];
3459
    }
3460

    
3461
    linux_boot = (kernel_filename != NULL);
3462
        
3463
    if (!linux_boot && hd_filename[0] == '\0' && hd_filename[2] == '\0' &&
3464
        fd_filename[0] == '\0')
3465
        help();
3466
    
3467
    /* boot to cd by default if no hard disk */
3468
    if (hd_filename[0] == '\0' && boot_device == 'c') {
3469
        if (fd_filename[0] != '\0')
3470
            boot_device = 'a';
3471
        else
3472
            boot_device = 'd';
3473
    }
3474

    
3475
#if !defined(CONFIG_SOFTMMU)
3476
    /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
3477
    {
3478
        static uint8_t stdout_buf[4096];
3479
        setvbuf(stdout, stdout_buf, _IOLBF, sizeof(stdout_buf));
3480
    }
3481
#else
3482
    setvbuf(stdout, NULL, _IOLBF, 0);
3483
#endif
3484

    
3485
    /* init network tun interface */
3486
#if defined (TARGET_I386)
3487
    if (net_fd < 0)
3488
        net_init();
3489
#endif
3490

    
3491
    /* init the memory */
3492
    total_ram_size = phys_ram_size + vga_ram_size;
3493

    
3494
#ifdef CONFIG_SOFTMMU
3495
    phys_ram_base = malloc(total_ram_size);
3496
    if (!phys_ram_base) {
3497
        fprintf(stderr, "Could not allocate physical memory\n");
3498
        exit(1);
3499
    }
3500
#else
3501
    /* as we must map the same page at several addresses, we must use
3502
       a fd */
3503
    {
3504
        const char *tmpdir;
3505

    
3506
        tmpdir = getenv("QEMU_TMPDIR");
3507
        if (!tmpdir)
3508
            tmpdir = "/tmp";
3509
        snprintf(phys_ram_file, sizeof(phys_ram_file), "%s/vlXXXXXX", tmpdir);
3510
        if (mkstemp(phys_ram_file) < 0) {
3511
            fprintf(stderr, "Could not create temporary memory file '%s'\n", 
3512
                    phys_ram_file);
3513
            exit(1);
3514
        }
3515
        phys_ram_fd = open(phys_ram_file, O_CREAT | O_TRUNC | O_RDWR, 0600);
3516
        if (phys_ram_fd < 0) {
3517
            fprintf(stderr, "Could not open temporary memory file '%s'\n", 
3518
                    phys_ram_file);
3519
            exit(1);
3520
        }
3521
        ftruncate(phys_ram_fd, total_ram_size);
3522
        unlink(phys_ram_file);
3523
        phys_ram_base = mmap(get_mmap_addr(total_ram_size), 
3524
                             total_ram_size, 
3525
                             PROT_WRITE | PROT_READ, MAP_SHARED | MAP_FIXED, 
3526
                             phys_ram_fd, 0);
3527
        if (phys_ram_base == MAP_FAILED) {
3528
            fprintf(stderr, "Could not map physical memory\n");
3529
            exit(1);
3530
        }
3531
    }
3532
#endif
3533

    
3534
    /* open the virtual block devices */
3535
    for(i = 0; i < MAX_DISKS; i++) {
3536
        if (hd_filename[i]) {
3537
            bs_table[i] = bdrv_open(hd_filename[i], snapshot);
3538
            if (!bs_table[i]) {
3539
                fprintf(stderr, "qemu: could not open hard disk image '%s\n",
3540
                        hd_filename[i]);
3541
                exit(1);
3542
            }
3543
        }
3544
    }
3545

    
3546
    /* init CPU state */
3547
    env = cpu_init();
3548
    global_env = env;
3549
    cpu_single_env = env;
3550

    
3551
    init_ioports();
3552

    
3553
    /* allocate RAM */
3554
    cpu_register_physical_memory(0, phys_ram_size, 0);
3555

    
3556
    if (linux_boot) {
3557
        /* now we can load the kernel */
3558
        ret = load_kernel(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
3559
        if (ret < 0) {
3560
            fprintf(stderr, "qemu: could not load kernel '%s'\n", 
3561
                    kernel_filename);
3562
            exit(1);
3563
        }
3564
        
3565
        /* load initrd */
3566
        initrd_size = 0;
3567
        if (initrd_filename) {
3568
            initrd_size = load_image(initrd_filename, phys_ram_base + INITRD_LOAD_ADDR);
3569
            if (initrd_size < 0) {
3570
                fprintf(stderr, "qemu: could not load initial ram disk '%s'\n", 
3571
                        initrd_filename);
3572
                exit(1);
3573
            }
3574
        }
3575
        
3576
        /* init kernel params */
3577
#ifdef TARGET_I386
3578
        params = (void *)(phys_ram_base + KERNEL_PARAMS_ADDR);
3579
        memset(params, 0, sizeof(struct linux_params));
3580
        params->mount_root_rdonly = 0;
3581
        stw_raw(&params->cl_magic, 0xA33F);
3582
        stw_raw(&params->cl_offset, params->commandline - (uint8_t *)params);
3583
        stl_raw(&params->alt_mem_k, (phys_ram_size / 1024) - 1024);
3584
        pstrcat(params->commandline, sizeof(params->commandline), kernel_cmdline);
3585
        params->loader_type = 0x01;
3586
        if (initrd_size > 0) {
3587
            stl_raw(&params->initrd_start, INITRD_LOAD_ADDR);
3588
            stl_raw(&params->initrd_size, initrd_size);
3589
        }
3590
        params->orig_video_lines = 25;
3591
        params->orig_video_cols = 80;
3592

    
3593
        /* setup basic memory access */
3594
        env->cr[0] = 0x00000033;
3595
        env->hflags |= HF_PE_MASK;
3596
        cpu_x86_init_mmu(env);
3597
        
3598
        memset(params->idt_table, 0, sizeof(params->idt_table));
3599
        
3600
        stq_raw(&params->gdt_table[2], 0x00cf9a000000ffffLL); /* KERNEL_CS */
3601
        stq_raw(&params->gdt_table[3], 0x00cf92000000ffffLL); /* KERNEL_DS */
3602
        /* for newer kernels (2.6.0) CS/DS are at different addresses */
3603
        stq_raw(&params->gdt_table[12], 0x00cf9a000000ffffLL); /* KERNEL_CS */
3604
        stq_raw(&params->gdt_table[13], 0x00cf92000000ffffLL); /* KERNEL_DS */
3605
        
3606
        env->idt.base = (void *)((uint8_t *)params->idt_table - phys_ram_base);
3607
        env->idt.limit = sizeof(params->idt_table) - 1;
3608
        env->gdt.base = (void *)((uint8_t *)params->gdt_table - phys_ram_base);
3609
        env->gdt.limit = sizeof(params->gdt_table) - 1;
3610
        
3611
        cpu_x86_load_seg_cache(env, R_CS, KERNEL_CS, NULL, 0xffffffff, 0x00cf9a00);
3612
        cpu_x86_load_seg_cache(env, R_DS, KERNEL_DS, NULL, 0xffffffff, 0x00cf9200);
3613
        cpu_x86_load_seg_cache(env, R_ES, KERNEL_DS, NULL, 0xffffffff, 0x00cf9200);
3614
        cpu_x86_load_seg_cache(env, R_SS, KERNEL_DS, NULL, 0xffffffff, 0x00cf9200);
3615
        cpu_x86_load_seg_cache(env, R_FS, KERNEL_DS, NULL, 0xffffffff, 0x00cf9200);
3616
        cpu_x86_load_seg_cache(env, R_GS, KERNEL_DS, NULL, 0xffffffff, 0x00cf9200);
3617
        
3618
        env->eip = KERNEL_LOAD_ADDR;
3619
        env->regs[R_ESI] = KERNEL_PARAMS_ADDR;
3620
        env->eflags = 0x2;
3621
#elif defined (TARGET_PPC)
3622
        cpu_x86_init_mmu(env);
3623
        PPC_init_hw(env, phys_ram_size, KERNEL_LOAD_ADDR, ret,
3624
                    KERNEL_STACK_ADDR, boot_device);
3625
#endif
3626
    } else {
3627
        char buf[1024];
3628

    
3629
        /* RAW PC boot */
3630
#if defined(TARGET_I386)
3631
        /* BIOS load */
3632
        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
3633
        ret = load_image(buf, phys_ram_base + 0x000f0000);
3634
        if (ret != 0x10000) {
3635
            fprintf(stderr, "qemu: could not load PC bios '%s'\n", buf);
3636
            exit(1);
3637
        }
3638

    
3639
        /* VGA BIOS load */
3640
        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, VGABIOS_FILENAME);
3641
        ret = load_image(buf, phys_ram_base + 0x000c0000);
3642

    
3643
        /* setup basic memory access */
3644
        env->cr[0] = 0x60000010;
3645
        cpu_x86_init_mmu(env);
3646
        
3647
        cpu_register_physical_memory(0xc0000, 0x10000, 0xc0000 | IO_MEM_ROM);
3648
        cpu_register_physical_memory(0xf0000, 0x10000, 0xf0000 | IO_MEM_ROM);
3649

    
3650
        env->idt.limit = 0xffff;
3651
        env->gdt.limit = 0xffff;
3652
        env->ldt.limit = 0xffff;
3653
        env->ldt.flags = DESC_P_MASK;
3654
        env->tr.limit = 0xffff;
3655
        env->tr.flags = DESC_P_MASK;
3656

    
3657
        /* not correct (CS base=0xffff0000) */
3658
        cpu_x86_load_seg_cache(env, R_CS, 0xf000, (uint8_t *)0x000f0000, 0xffff, 0); 
3659
        cpu_x86_load_seg_cache(env, R_DS, 0, NULL, 0xffff, 0);
3660
        cpu_x86_load_seg_cache(env, R_ES, 0, NULL, 0xffff, 0);
3661
        cpu_x86_load_seg_cache(env, R_SS, 0, NULL, 0xffff, 0);
3662
        cpu_x86_load_seg_cache(env, R_FS, 0, NULL, 0xffff, 0);
3663
        cpu_x86_load_seg_cache(env, R_GS, 0, NULL, 0xffff, 0);
3664

    
3665
        env->eip = 0xfff0;
3666
        env->regs[R_EDX] = 0x600; /* indicate P6 processor */
3667

    
3668
        env->eflags = 0x2;
3669

    
3670
        bochs_bios_init();
3671
#elif defined(TARGET_PPC)
3672
        cpu_x86_init_mmu(env);
3673
        /* allocate ROM */
3674
        //        snprintf(buf, sizeof(buf), "%s/%s", bios_dir, BIOS_FILENAME);
3675
        snprintf(buf, sizeof(buf), "%s", BIOS_FILENAME);
3676
        printf("load BIOS at %p\n", phys_ram_base + 0x000f0000);
3677
        ret = load_image(buf, phys_ram_base + 0x000f0000);
3678
        if (ret != 0x10000) {
3679
            fprintf(stderr, "qemu: could not load PPC bios '%s' (%d)\n%m\n",
3680
                    buf, ret);
3681
            exit(1);
3682
        }
3683
#endif
3684
    }
3685

    
3686
    /* terminal init */
3687
    if (nographic) {
3688
        dumb_display_init(ds);
3689
    } else {
3690
#ifdef CONFIG_SDL
3691
        sdl_display_init(ds);
3692
#else
3693
        dumb_display_init(ds);
3694
#endif
3695
    }
3696
    /* init basic PC hardware */
3697
    register_ioport_write(0x80, 1, ioport80_write, 1);
3698

    
3699
    vga_initialize(ds, phys_ram_base + phys_ram_size, phys_ram_size, 
3700
             vga_ram_size);
3701
#if defined (TARGET_I386)
3702
    cmos_init();
3703
#endif
3704
    pic_init();
3705
    pit_init();
3706
    serial_init();
3707
#if defined (TARGET_I386)
3708
    ne2000_init();
3709
#endif
3710
    ide_init();
3711
    kbd_init();
3712
    AUD_init();
3713
    DMA_init();
3714
#if defined (TARGET_I386)
3715
    SB16_init();
3716
#endif
3717
#if defined (TARGET_PPC)
3718
    PPC_end_init();
3719
#endif
3720
    fdctrl_register((unsigned char **)fd_filename, snapshot, boot_device);
3721
    /* setup cpu signal handlers for MMU / self modifying code handling */
3722
    sigfillset(&act.sa_mask);
3723
    act.sa_flags = SA_SIGINFO;
3724
#if !defined(CONFIG_SOFTMMU)
3725
    act.sa_sigaction = host_segv_handler;
3726
    sigaction(SIGSEGV, &act, NULL);
3727
    sigaction(SIGBUS, &act, NULL);
3728
#endif
3729

    
3730
    act.sa_sigaction = host_alarm_handler;
3731
    sigaction(SIGALRM, &act, NULL);
3732

    
3733
    itv.it_interval.tv_sec = 0;
3734
    itv.it_interval.tv_usec = 1000;
3735
    itv.it_value.tv_sec = 0;
3736
    itv.it_value.tv_usec = 10 * 1000;
3737
    setitimer(ITIMER_REAL, &itv, NULL);
3738
    /* we probe the tick duration of the kernel to inform the user if
3739
       the emulated kernel requested a too high timer frequency */
3740
    getitimer(ITIMER_REAL, &itv);
3741
    timer_ms = itv.it_interval.tv_usec / 1000;
3742
    pit_min_timer_count = ((uint64_t)itv.it_interval.tv_usec * PIT_FREQ) / 
3743
        1000000;
3744

    
3745
    if (use_gdbstub) {
3746
        cpu_gdbstub(NULL, main_loop, gdbstub_port);
3747
    } else {
3748
        main_loop(NULL);
3749
    }
3750
    return 0;
3751
}