Adding upstream version 7.0.6-dfsg.upstream/7.0.6-dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1520 insertions, 0 deletions

diff --git a/src/VBox/Devices/Input/DevPS2K.cpp b/src/VBox/Devices/Input/DevPS2K.cpp
new file mode 100644
index 00000000..29c0d96c
--- /dev/null
+++ b/src/VBox/Devices/Input/DevPS2K.cpp
@@ -0,0 +1,1520 @@
+/* $Id: DevPS2K.cpp $ */
+/** @file
+ * PS2K - PS/2 keyboard emulation.
+ */
+
+/*
+ * Copyright (C) 2007-2022 Oracle and/or its affiliates.
+ *
+ * This file is part of VirtualBox base platform packages, as
+ * available from https://www.virtualbox.org.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, in version 3 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+/*
+ * References:
+ *
+ * IBM PS/2 Technical Reference, Keyboards (101- and 102-Key), 1990
+ * Keyboard Scan Code Specification, Microsoft, 2000
+ *
+ * Notes:
+ *  - The keyboard never sends partial scan-code sequences; if there isn't enough
+ *    room left in the buffer for the entire sequence, the keystroke is discarded
+ *    and an overrun code is sent instead.
+ *  - Command responses do not disturb stored keystrokes and always have priority.
+ *  - Caps Lock and Scroll Lock are normal keys from the keyboard's point of view.
+ *    However, Num Lock is not and the keyboard internally tracks its state.
+ *  - The way Print Screen works in scan set 1/2 is totally insane.
+ *  - A PS/2 keyboard can send at most 1,000 to 1,500 bytes per second. There is
+ *    software which relies on that fact and assumes that a scan code can be
+ *    read twice before the next scan code comes in.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#define LOG_GROUP   LOG_GROUP_DEV_KBD
+#include <VBox/vmm/pdmdev.h>
+#include <VBox/err.h>
+#include <iprt/assert.h>
+#include <iprt/uuid.h>
+#include "VBoxDD.h"
+#define IN_PS2K
+#include "DevPS2.h"
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+/** @name Keyboard commands sent by the system.
+ * @{ */
+#define KCMD_LEDS           0xED
+#define KCMD_ECHO           0xEE
+#define KCMD_INVALID_1      0xEF
+#define KCMD_SCANSET        0xF0
+#define KCMD_INVALID_2      0xF1
+#define KCMD_READ_ID        0xF2
+#define KCMD_RATE_DELAY     0xF3
+#define KCMD_ENABLE         0xF4
+#define KCMD_DFLT_DISABLE   0xF5
+#define KCMD_SET_DEFAULT    0xF6
+#define KCMD_ALL_TYPEMATIC  0xF7
+#define KCMD_ALL_MK_BRK     0xF8
+#define KCMD_ALL_MAKE       0xF9
+#define KCMD_ALL_TMB        0xFA
+#define KCMD_TYPE_MATIC     0xFB
+#define KCMD_TYPE_MK_BRK    0xFC
+#define KCMD_TYPE_MAKE      0xFD
+#define KCMD_RESEND         0xFE
+#define KCMD_RESET          0xFF
+/** @} */
+
+/** @name Keyboard responses sent to the system.
+ * @{ */
+#define KRSP_ID1            0xAB
+#define KRSP_ID2            0x83
+#define KRSP_BAT_OK         0xAA
+#define KRSP_BAT_FAIL       0xFC    /* Also a 'release keys' signal. */
+#define KRSP_ECHO           0xEE
+#define KRSP_ACK            0xFA
+#define KRSP_RESEND         0xFE
+/** @} */
+
+/** @name Modifier key states. Sorted in USB HID code order.
+ * @{ */
+#define MOD_LCTRL           0x01
+#define MOD_LSHIFT          0x02
+#define MOD_LALT            0x04
+#define MOD_LGUI            0x08
+#define MOD_RCTRL           0x10
+#define MOD_RSHIFT          0x20
+#define MOD_RALT            0x40
+#define MOD_RGUI            0x80
+/** @} */
+
+/* Default typematic value. */
+#define KBD_DFL_RATE_DELAY  0x2B
+
+/* Input throttling delay in milliseconds. */
+#define KBD_THROTTLE_DELAY  1
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+/* Key type flags. */
+#define KF_E0        0x01    /* E0 prefix. */
+#define KF_NB        0x02    /* No break code. */
+#define KF_GK        0x04    /* Gray navigation key. */
+#define KF_PS        0x08    /* Print Screen key. */
+#define KF_PB        0x10    /* Pause/Break key. */
+#define KF_NL        0x20    /* Num Lock key. */
+#define KF_NS        0x40    /* NumPad '/' key. */
+
+/* Scan Set 3 typematic defaults. */
+#define T_U          0x00    /* Unknown value. */
+#define T_T          0x01    /* Key is typematic. */
+#define T_M          0x02    /* Key is make only. */
+#define T_B          0x04    /* Key is make/break. */
+
+/* Special key values. */
+#define NONE         0x93    /* No PS/2 scan code returned. */
+#define UNAS         0x94    /* No PS/2 scan assigned to key. */
+#define RSVD         0x95    /* Reserved, do not use. */
+#define UNKN         0x96    /* Translation unknown. */
+
+/* Key definition structure. */
+typedef struct {
+    uint8_t makeS1;      /* Set 1 make code. */
+    uint8_t makeS2;      /* Set 2 make code. */
+    uint8_t makeS3;      /* Set 3 make code. */
+    uint8_t keyFlags;    /* Key flags. */
+    uint8_t keyMatic;    /* Set 3 typematic default. */
+} key_def;
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+#ifdef IN_RING3
+/* USB to PS/2 conversion table for regular keys (HID Usage Page 7). */
+static const   key_def   aPS2Keys[] = {
+    /* 00 */ {NONE, NONE, NONE, KF_NB, T_U }, /* Key N/A: No Event */
+    /* 01 */ {0xFF, 0x00, 0x00, KF_NB, T_U }, /* Key N/A: Overrun Error */
+    /* 02 */ {0xFC, 0xFC, 0xFC, KF_NB, T_U }, /* Key N/A: POST Fail */
+    /* 03 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key N/A: ErrorUndefined */
+    /* 04 */ {0x1E, 0x1C, 0x1C,     0, T_T }, /* Key  31: a A */
+    /* 05 */ {0x30, 0x32, 0x32,     0, T_T }, /* Key  50: b B */
+    /* 06 */ {0x2E, 0x21, 0x21,     0, T_T }, /* Key  48: c C */
+    /* 07 */ {0x20, 0x23, 0x23,     0, T_T }, /* Key  33: d D */
+    /* 08 */ {0x12, 0x24, 0x24,     0, T_T }, /* Key  19: e E */
+    /* 09 */ {0x21, 0x2B, 0x2B,     0, T_T }, /* Key  34: f F */
+    /* 0A */ {0x22, 0x34, 0x34,     0, T_T }, /* Key  35: g G */
+    /* 0B */ {0x23, 0x33, 0x33,     0, T_T }, /* Key  36: h H */
+    /* 0C */ {0x17, 0x43, 0x43,     0, T_T }, /* Key  24: i I */
+    /* 0D */ {0x24, 0x3B, 0x3B,     0, T_T }, /* Key  37: j J */
+    /* 0E */ {0x25, 0x42, 0x42,     0, T_T }, /* Key  38: k K */
+    /* 0F */ {0x26, 0x4B, 0x4B,     0, T_T }, /* Key  39: l L */
+    /* 10 */ {0x32, 0x3A, 0x3A,     0, T_T }, /* Key  52: m M */
+    /* 11 */ {0x31, 0x31, 0x31,     0, T_T }, /* Key  51: n N */
+    /* 12 */ {0x18, 0x44, 0x44,     0, T_T }, /* Key  25: o O */
+    /* 13 */ {0x19, 0x4D, 0x4D,     0, T_T }, /* Key  26: p P */
+    /* 14 */ {0x10, 0x15, 0x15,     0, T_T }, /* Key  17: q Q */
+    /* 15 */ {0x13, 0x2D, 0x2D,     0, T_T }, /* Key  20: r R */
+    /* 16 */ {0x1F, 0x1B, 0x1B,     0, T_T }, /* Key  32: s S */
+    /* 17 */ {0x14, 0x2C, 0x2C,     0, T_T }, /* Key  21: t T */
+    /* 18 */ {0x16, 0x3C, 0x3C,     0, T_T }, /* Key  23: u U */
+    /* 19 */ {0x2F, 0x2A, 0x2A,     0, T_T }, /* Key  49: v V */
+    /* 1A */ {0x11, 0x1D, 0x1D,     0, T_T }, /* Key  18: w W */
+    /* 1B */ {0x2D, 0x22, 0x22,     0, T_T }, /* Key  47: x X */
+    /* 1C */ {0x15, 0x35, 0x35,     0, T_T }, /* Key  22: y Y */
+    /* 1D */ {0x2C, 0x1A, 0x1A,     0, T_T }, /* Key  46: z Z */
+    /* 1E */ {0x02, 0x16, 0x16,     0, T_T }, /* Key   2: 1 ! */
+    /* 1F */ {0x03, 0x1E, 0x1E,     0, T_T }, /* Key   3: 2 @ */
+    /* 20 */ {0x04, 0x26, 0x26,     0, T_T }, /* Key   4: 3 # */
+    /* 21 */ {0x05, 0x25, 0x25,     0, T_T }, /* Key   5: 4 $ */
+    /* 22 */ {0x06, 0x2E, 0x2E,     0, T_T }, /* Key   6: 5 % */
+    /* 23 */ {0x07, 0x36, 0x36,     0, T_T }, /* Key   7: 6 ^ */
+    /* 24 */ {0x08, 0x3D, 0x3D,     0, T_T }, /* Key   8: 7 & */
+    /* 25 */ {0x09, 0x3E, 0x3E,     0, T_T }, /* Key   9: 8 * */
+    /* 26 */ {0x0A, 0x46, 0x46,     0, T_T }, /* Key  10: 9 ( */
+    /* 27 */ {0x0B, 0x45, 0x45,     0, T_T }, /* Key  11: 0 ) */
+    /* 28 */ {0x1C, 0x5A, 0x5A,     0, T_T }, /* Key  43: Return */
+    /* 29 */ {0x01, 0x76, 0x08,     0, T_M }, /* Key 110: Escape */
+    /* 2A */ {0x0E, 0x66, 0x66,     0, T_T }, /* Key  15: Backspace */
+    /* 2B */ {0x0F, 0x0D, 0x0D,     0, T_T }, /* Key  16: Tab */
+    /* 2C */ {0x39, 0x29, 0x29,     0, T_T }, /* Key  61: Space */
+    /* 2D */ {0x0C, 0x4E, 0x4E,     0, T_T }, /* Key  12: - _ */
+    /* 2E */ {0x0D, 0x55, 0x55,     0, T_T }, /* Key  13: = + */
+    /* 2F */ {0x1A, 0x54, 0x54,     0, T_T }, /* Key  27: [ { */
+    /* 30 */ {0x1B, 0x5B, 0x5B,     0, T_T }, /* Key  28: ] } */
+    /* 31 */ {0x2B, 0x5D, 0x5C,     0, T_T }, /* Key  29: \ | */
+    /* 32 */ {0x2B, 0x5D, 0x5D,     0, T_T }, /* Key  42: Europe 1 (Note 2) */
+    /* 33 */ {0x27, 0x4C, 0x4C,     0, T_T }, /* Key  40: ; : */
+    /* 34 */ {0x28, 0x52, 0x52,     0, T_T }, /* Key  41: ' " */
+    /* 35 */ {0x29, 0x0E, 0x0E,     0, T_T }, /* Key   1: ` ~ */
+    /* 36 */ {0x33, 0x41, 0x41,     0, T_T }, /* Key  53: , < */
+    /* 37 */ {0x34, 0x49, 0x49,     0, T_T }, /* Key  54: . > */
+    /* 38 */ {0x35, 0x4A, 0x4A,     0, T_T }, /* Key  55: / ? */
+    /* 39 */ {0x3A, 0x58, 0x14,     0, T_B }, /* Key  30: Caps Lock */
+    /* 3A */ {0x3B, 0x05, 0x07,     0, T_M }, /* Key 112: F1 */
+    /* 3B */ {0x3C, 0x06, 0x0F,     0, T_M }, /* Key 113: F2 */
+    /* 3C */ {0x3D, 0x04, 0x17,     0, T_M }, /* Key 114: F3 */
+    /* 3D */ {0x3E, 0x0C, 0x1F,     0, T_M }, /* Key 115: F4 */
+    /* 3E */ {0x3F, 0x03, 0x27,     0, T_M }, /* Key 116: F5 */
+    /* 3F */ {0x40, 0x0B, 0x2F,     0, T_M }, /* Key 117: F6 */
+    /* 40 */ {0x41, 0x83, 0x37,     0, T_M }, /* Key 118: F7 */
+    /* 41 */ {0x42, 0x0A, 0x3F,     0, T_M }, /* Key 119: F8 */
+    /* 42 */ {0x43, 0x01, 0x47,     0, T_M }, /* Key 120: F9 */
+    /* 43 */ {0x44, 0x09, 0x4F,     0, T_M }, /* Key 121: F10 */
+    /* 44 */ {0x57, 0x78, 0x56,     0, T_M }, /* Key 122: F11 */
+    /* 45 */ {0x58, 0x07, 0x5E,     0, T_M }, /* Key 123: F12 */
+    /* 46 */ {0x37, 0x7C, 0x57, KF_PS, T_M }, /* Key 124: Print Screen (Note 1) */
+    /* 47 */ {0x46, 0x7E, 0x5F,     0, T_M }, /* Key 125: Scroll Lock */
+    /* 48 */ {RSVD, RSVD, RSVD, KF_PB, T_M }, /* Key 126: Break (Ctrl-Pause) */
+    /* 49 */ {0x52, 0x70, 0x67, KF_GK, T_M }, /* Key  75: Insert (Note 1) */
+    /* 4A */ {0x47, 0x6C, 0x6E, KF_GK, T_M }, /* Key  80: Home (Note 1) */
+    /* 4B */ {0x49, 0x7D, 0x6F, KF_GK, T_M }, /* Key  85: Page Up (Note 1) */
+    /* 4C */ {0x53, 0x71, 0x64, KF_GK, T_T }, /* Key  76: Delete (Note 1) */
+    /* 4D */ {0x4F, 0x69, 0x65, KF_GK, T_M }, /* Key  81: End (Note 1) */
+    /* 4E */ {0x51, 0x7A, 0x6D, KF_GK, T_M }, /* Key  86: Page Down (Note 1) */
+    /* 4F */ {0x4D, 0x74, 0x6A, KF_GK, T_T }, /* Key  89: Right Arrow (Note 1) */
+    /* 50 */ {0x4B, 0x6B, 0x61, KF_GK, T_T }, /* Key  79: Left Arrow (Note 1) */
+    /* 51 */ {0x50, 0x72, 0x60, KF_GK, T_T }, /* Key  84: Down Arrow (Note 1) */
+    /* 52 */ {0x48, 0x75, 0x63, KF_GK, T_T }, /* Key  83: Up Arrow (Note 1) */
+    /* 53 */ {0x45, 0x77, 0x76, KF_NL, T_M }, /* Key  90: Num Lock */
+    /* 54 */ {0x35, 0x4A, 0x77, KF_NS, T_M }, /* Key  95: Keypad / (Note 1) */
+    /* 55 */ {0x37, 0x7C, 0x7E,     0, T_M }, /* Key 100: Keypad * */
+    /* 56 */ {0x4A, 0x7B, 0x84,     0, T_M }, /* Key 105: Keypad - */
+    /* 57 */ {0x4E, 0x79, 0x7C,     0, T_T }, /* Key 106: Keypad + */
+    /* 58 */ {0x1C, 0x5A, 0x79, KF_E0, T_M }, /* Key 108: Keypad Enter */
+    /* 59 */ {0x4F, 0x69, 0x69,     0, T_M }, /* Key  93: Keypad 1 End */
+    /* 5A */ {0x50, 0x72, 0x72,     0, T_M }, /* Key  98: Keypad 2 Down */
+    /* 5B */ {0x51, 0x7A, 0x7A,     0, T_M }, /* Key 103: Keypad 3 PageDn */
+    /* 5C */ {0x4B, 0x6B, 0x6B,     0, T_M }, /* Key  92: Keypad 4 Left */
+    /* 5D */ {0x4C, 0x73, 0x73,     0, T_M }, /* Key  97: Keypad 5 */
+    /* 5E */ {0x4D, 0x74, 0x74,     0, T_M }, /* Key 102: Keypad 6 Right */
+    /* 5F */ {0x47, 0x6C, 0x6C,     0, T_M }, /* Key  91: Keypad 7 Home */
+    /* 60 */ {0x48, 0x75, 0x75,     0, T_M }, /* Key  96: Keypad 8 Up */
+    /* 61 */ {0x49, 0x7D, 0x7D,     0, T_M }, /* Key 101: Keypad 9 PageUp */
+    /* 62 */ {0x52, 0x70, 0x70,     0, T_M }, /* Key  99: Keypad 0 Insert */
+    /* 63 */ {0x53, 0x71, 0x71,     0, T_M }, /* Key 104: Keypad . Delete */
+    /* 64 */ {0x56, 0x61, 0x13,     0, T_T }, /* Key  45: Europe 2 (Note 2) */
+    /* 65 */ {0x5D, 0x2F, UNKN, KF_E0, T_U }, /* Key 129: App */
+    /* 66 */ {0x5E, 0x37, UNKN, KF_E0, T_U }, /* Key Unk: Keyboard Power */
+    /* 67 */ {0x59, 0x0F, UNKN,     0, T_U }, /* Key Unk: Keypad = */
+    /* 68 */ {0x64, 0x08, UNKN,     0, T_U }, /* Key Unk: F13 */
+    /* 69 */ {0x65, 0x10, UNKN,     0, T_U }, /* Key Unk: F14 */
+    /* 6A */ {0x66, 0x18, UNKN,     0, T_U }, /* Key Unk: F15 */
+    /* 6B */ {0x67, 0x20, UNKN,     0, T_U }, /* Key Unk: F16 */
+    /* 6C */ {0x68, 0x28, UNKN,     0, T_U }, /* Key Unk: F17 */
+    /* 6D */ {0x69, 0x30, UNKN,     0, T_U }, /* Key Unk: F18 */
+    /* 6E */ {0x6A, 0x38, UNKN,     0, T_U }, /* Key Unk: F19 */
+    /* 6F */ {0x6B, 0x40, UNKN,     0, T_U }, /* Key Unk: F20 */
+    /* 70 */ {0x6C, 0x48, UNKN,     0, T_U }, /* Key Unk: F21 */
+    /* 71 */ {0x6D, 0x50, UNKN,     0, T_U }, /* Key Unk: F22 */
+    /* 72 */ {0x6E, 0x57, UNKN,     0, T_U }, /* Key Unk: F23 */
+    /* 73 */ {0x76, 0x5F, UNKN,     0, T_U }, /* Key Unk: F24 */
+    /* 74 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Execute */
+    /* 75 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Help */
+    /* 76 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Menu */
+    /* 77 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Select */
+    /* 78 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Stop */
+    /* 79 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Again */
+    /* 7A */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Undo */
+    /* 7B */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Cut */
+    /* 7C */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Copy */
+    /* 7D */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Paste */
+    /* 7E */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Find */
+    /* 7F */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Mute */
+    /* 80 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Volume Up */
+    /* 81 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Volume Dn */
+    /* 82 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Locking Caps Lock */
+    /* 83 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Locking Num Lock */
+    /* 84 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Locking Scroll Lock */
+    /* 85 */ {0x7E, 0x6D, UNKN,     0, T_U }, /* Key Unk: Keypad , (Brazilian Keypad .) */
+    /* 86 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Equal Sign */
+    /* 87 */ {0x73, 0x51, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl 1 (Ro) */
+    /* 88 */ {0x70, 0x13, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl2 (K'kana/H'gana) */
+    /* 89 */ {0x7D, 0x6A, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl 2 (Yen) */
+    /* 8A */ {0x79, 0x64, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl 4 (Henkan) */
+    /* 8B */ {0x7B, 0x67, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl 5 (Muhenkan) */
+    /* 8C */ {0x5C, 0x27, UNKN,     0, T_U }, /* Key Unk: Keyboard Intl 6 (PC9800 Pad ,) */
+    /* 8D */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Intl 7 */
+    /* 8E */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Intl 8 */
+    /* 8F */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Intl 9 */
+    /* 90 */ {0xF2, 0xF2, UNKN, KF_NB, T_U }, /* Key Unk: Keyboard Lang 1 (Hang'l/Engl) */
+    /* 91 */ {0xF1, 0xF1, UNKN, KF_NB, T_U }, /* Key Unk: Keyboard Lang 2 (Hanja) */
+    /* 92 */ {0x78, 0x63, UNKN,     0, T_U }, /* Key Unk: Keyboard Lang 3 (Katakana) */
+    /* 93 */ {0x77, 0x62, UNKN,     0, T_U }, /* Key Unk: Keyboard Lang 4 (Hiragana) */
+    /* 94 */ {0x76, 0x5F, UNKN,     0, T_U }, /* Key Unk: Keyboard Lang 5 (Zen/Han) */
+    /* 95 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Lang 6 */
+    /* 96 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Lang 7 */
+    /* 97 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Lang 8 */
+    /* 98 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Lang 9 */
+    /* 99 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Alternate Erase */
+    /* 9A */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard SysReq/Attention (Note 3) */
+    /* 9B */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Cancel */
+    /* 9C */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Clear */
+    /* 9D */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Prior */
+    /* 9E */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Return */
+    /* 9F */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Separator */
+    /* A0 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Out */
+    /* A1 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Oper */
+    /* A2 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard Clear/Again */
+    /* A3 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard CrSel/Props */
+    /* A4 */ {UNAS, UNAS, UNAS,     0, T_U }, /* Key Unk: Keyboard ExSel */
+};
+
+/*
+ * Note 1: The behavior of these keys depends on the state of modifier keys
+ * at the time the key was pressed.
+ *
+ * Note 2: The key label depends on the national version of the keyboard.
+ *
+ * Note 3: Certain keys which have their own PS/2 scancodes do not exist on
+ * USB keyboards; the SysReq key is an example. The SysReq key scancode needs
+ * to be translated to the Print Screen HID usage code. The HID usage to PS/2
+ * scancode conversion then generates the correct sequence depending on the
+ * keyboard state.
+ */
+
+/* USB to PS/2 conversion table for modifier keys (HID Usage Page 7). */
+static const   key_def   aPS2ModKeys[] = {
+    /* E0 */ {0x1D, 0x14, 0x11,     0, T_B }, /* Key  58: Left Control */
+    /* E1 */ {0x2A, 0x12, 0x12,     0, T_B }, /* Key  44: Left Shift */
+    /* E2 */ {0x38, 0x11, 0x19,     0, T_B }, /* Key  60: Left Alt */
+    /* E3 */ {0x5B, 0x1F, UNKN, KF_E0, T_U }, /* Key 127: Left GUI */
+    /* E4 */ {0x1D, 0x14, 0x58, KF_E0, T_M }, /* Key  64: Right Control */
+    /* E5 */ {0x36, 0x59, 0x59,     0, T_B }, /* Key  57: Right Shift */
+    /* E6 */ {0x38, 0x11, 0x39, KF_E0, T_M }, /* Key  62: Right Alt */
+    /* E7 */ {0x5C, 0x27, UNKN, KF_E0, T_U }, /* Key 128: Right GUI */
+};
+
+/* Extended key definition for sparse mapping. */
+typedef struct {
+    uint16_t    usageId;
+    key_def     kdef;
+} ext_key_def;
+
+
+/* USB to PS/2 conversion table for consumer control keys (HID Usage Page 12). */
+/* This usage page is very sparse so we'll just search through it. */
+static const   ext_key_def  aPS2CCKeys[] = {
+    {0x00B5, {0x19, 0x4D, UNKN, KF_E0, T_U}},   /* Scan Next Track */
+    {0x00B6, {0x10, 0x15, UNKN, KF_E0, T_U}},   /* Scan Previous Track */
+    {0x00B7, {0x24, 0x3B, UNKN, KF_E0, T_U}},   /* Stop */
+    {0x00CD, {0x22, 0x34, UNKN, KF_E0, T_U}},   /* Play/Pause */
+    {0x00E2, {0x20, 0x23, UNKN, KF_E0, T_U}},   /* Mute */
+    {0x00E5, {UNAS, UNAS, UNAS,     0, T_U}},   /* Bass Boost */
+    {0x00E7, {UNAS, UNAS, UNAS,     0, T_U}},   /* Loudness */
+    {0x00E9, {0x30, 0x32, UNKN, KF_E0, T_U}},   /* Volume Up */
+    {0x00EA, {0x2E, 0x21, UNKN, KF_E0, T_U}},   /* Volume Down */
+    {0x0152, {UNAS, UNAS, UNAS,     0, T_U}},   /* Bass Up */
+    {0x0153, {UNAS, UNAS, UNAS,     0, T_U}},   /* Bass Down */
+    {0x0154, {UNAS, UNAS, UNAS,     0, T_U}},   /* Treble Up */
+    {0x0155, {UNAS, UNAS, UNAS,     0, T_U}},   /* Treble Down */
+    {0x0183, {0x6D, 0x50, UNKN, KF_E0, T_U}},   /* Media Select  */
+    {0x018A, {0x6C, 0x48, UNKN, KF_E0, T_U}},   /* Mail */
+    {0x0192, {0x21, 0x2B, UNKN, KF_E0, T_U}},   /* Calculator */
+    {0x0194, {0x6B, 0x40, UNKN, KF_E0, T_U}},   /* My Computer */
+    {0x0221, {0x65, 0x10, UNKN, KF_E0, T_U}},   /* WWW Search */
+    {0x0223, {0x32, 0x3A, UNKN, KF_E0, T_U}},   /* WWW Home */
+    {0x0224, {0x6A, 0x38, UNKN, KF_E0, T_U}},   /* WWW Back */
+    {0x0225, {0x69, 0x30, UNKN, KF_E0, T_U}},   /* WWW Forward */
+    {0x0226, {0x68, 0x28, UNKN, KF_E0, T_U}},   /* WWW Stop */
+    {0x0227, {0x67, 0x20, UNKN, KF_E0, T_U}},   /* WWW Refresh */
+    {0x022A, {0x66, 0x18, UNKN, KF_E0, T_U}},   /* WWW Favorites */
+};
+
+/* USB to PS/2 conversion table for Generic Desktop Control keys (HID Usage Page 1). */
+/* This usage page is tiny. */
+static const   ext_key_def  aPS2DCKeys[] = {
+    {0x81,   {0x5E, 0x37, UNKN, KF_E0, T_U}},   /* System Power */
+    {0x82,   {0x5F, 0x3F, UNKN, KF_E0, T_U}},   /* System Sleep */
+    {0x83,   {0x63, 0x5E, UNKN, KF_E0, T_U}},   /* System Wake */
+};
+
+/* We somehow need to keep track of depressed keys. To keep the array size
+ * under control, and because the number of defined keys isn't massive, we'd
+ * like to use an 8-bit index into the array.
+ * For the main USB HID usage page 7 (keyboard), we deal with 8-bit HID codes
+ * in the range from 0 to 0xE7, and use the HID codes directly.
+ * There's a convenient gap in the 0xA5-0xDF range. We use that to stuff the
+ * USB HID usage page 12 (consumer control) into the gap starting at 0xC0;
+ * the consumer control codes are from 0xB5 to 0x22A, but very sparse, with
+ * only 24 codes defined. We use the aPS2CCKeys array to generate our own
+ * code in the 0xC0-0xD7 range.
+ * For the tiny USB HID usage page 1 (generic desktop system) we use a similar
+ * approach, translating these to codes 0xB0 to 0xB2.
+ */
+
+#define PS2K_PAGE_DC_START      0xb0
+#define PS2K_PAGE_DC_END        (PS2K_PAGE_DC_START + RT_ELEMENTS(aPS2DCKeys))
+#define PS2K_PAGE_CC_START      0xc0
+#define PS2K_PAGE_CC_END        (PS2K_PAGE_CC_START + RT_ELEMENTS(aPS2CCKeys))
+
+AssertCompile(RT_ELEMENTS(aPS2CCKeys) <= 0x20); /* Must fit between 0xC0-0xDF. */
+AssertCompile(RT_ELEMENTS(aPS2DCKeys) <= 0x10); /* Must fit between 0xB0-0xBF. */
+
+#endif /* IN_RING3 */
+
+#ifdef IN_RING3
+
+/**
+ * Add a null-terminated byte sequence to a queue if there is enough room.
+ *
+ * @param   pQueue      Pointer to the queue.
+ * @param   pStr        Pointer to the bytes to store.
+ * @param   cbReserve   Number of bytes that must still remain available in
+ *                      queue.
+ * @return  VBox status/error code.
+ */
+static int ps2kR3InsertStrQueue(KbdKeyQ *pQueue, const uint8_t *pStr, uint32_t cbReserve)
+{
+    /* Check if queue has enough room. */
+    size_t const cbStr = (uint32_t)strlen((const char *)pStr);
+    uint32_t     cUsed = RT_MIN(pQueue->Hdr.cUsed, RT_ELEMENTS(pQueue->abQueue));
+    if (cUsed + cbReserve + cbStr >= RT_ELEMENTS(pQueue->abQueue))
+    {
+        LogRelFlowFunc(("queue %p (KbdKeyQ) full (%u entries, want room for %u), cannot insert %zu entries\n",
+                        pQueue, cUsed, cbReserve, cbStr));
+        return VERR_BUFFER_OVERFLOW;
+    }
+
+    /* Insert byte sequence and update circular buffer write position. */
+    uint32_t wpos = pQueue->Hdr.wpos % RT_ELEMENTS(pQueue->abQueue);
+    for (size_t i = 0; i < cbStr; i++)
+    {
+        pQueue->abQueue[wpos] = pStr[i];
+        wpos += 1;
+        if (wpos < RT_ELEMENTS(pQueue->abQueue))
+        { /* likely */ }
+        else
+            wpos = 0; /* Roll over. */
+    }
+
+    pQueue->Hdr.wpos  = wpos;
+    pQueue->Hdr.cUsed = cUsed + (uint32_t)cbStr;
+
+    LogRelFlowFunc(("inserted %u bytes into queue %p (KbdKeyQ)\n", cbStr, pQueue));
+    return VINF_SUCCESS;
+}
+
+/**
+ * Notify listener about LEDs state change.
+ *
+ * @param   pThisCC         The PS/2 keyboard instance data for ring-3.
+ * @param   u8State         Bitfield which reflects LEDs state.
+ */
+static void ps2kR3NotifyLedsState(PPS2KR3 pThisCC, uint8_t u8State)
+{
+    PDMKEYBLEDS enmLeds = PDMKEYBLEDS_NONE;
+
+    if (u8State & 0x01)
+        enmLeds = (PDMKEYBLEDS)(enmLeds | PDMKEYBLEDS_SCROLLLOCK);
+    if (u8State & 0x02)
+        enmLeds = (PDMKEYBLEDS)(enmLeds | PDMKEYBLEDS_NUMLOCK);
+    if (u8State & 0x04)
+        enmLeds = (PDMKEYBLEDS)(enmLeds | PDMKEYBLEDS_CAPSLOCK);
+
+    if (pThisCC->Keyboard.pDrv)
+        pThisCC->Keyboard.pDrv->pfnLedStatusChange(pThisCC->Keyboard.pDrv, enmLeds);
+}
+
+#endif /* IN_RING3 */
+
+/** Clears the currently active typematic key, if any. */
+static void ps2kStopTypematicRepeat(PPDMDEVINS pDevIns, PPS2K pThis)
+{
+    if (pThis->u32TypematicKey)
+    {
+        LogFunc(("Typematic key %08X\n", pThis->u32TypematicKey));
+        pThis->enmTypematicState = KBD_TMS_IDLE;
+        pThis->u32TypematicKey = 0;
+        PDMDevHlpTimerStop(pDevIns, pThis->hKbdTypematicTimer);
+    }
+}
+
+/** Convert encoded typematic value to milliseconds. Note that the values are rated
+ * with +/- 20% accuracy, so there's no need for high precision.
+ */
+static void ps2kSetupTypematic(PPS2K pThis, uint8_t val)
+{
+    int         A, B;
+    unsigned    period;
+
+    pThis->u8TypematicCfg = val;
+    /* The delay is easy: (1 + value) * 250 ms */
+    pThis->uTypematicDelay = (1 + ((val >> 5) & 3)) * 250;
+    /* The rate is more complicated: (8 + A) * 2^B * 4.17 ms */
+    A = val & 7;
+    B = (val >> 3) & 3;
+    period = (8 + A) * (1 << B) * 417 / 100;
+    pThis->uTypematicRepeat = period;
+    Log(("Typematic delay %u ms, repeat period %u ms\n",
+         pThis->uTypematicDelay, pThis->uTypematicRepeat));
+}
+
+static void ps2kSetDefaults(PPDMDEVINS pDevIns, PPS2K pThis)
+{
+    LogFlowFunc(("Set keyboard defaults\n"));
+    PS2Q_CLEAR(&pThis->keyQ);
+    /* Set default Scan Set 3 typematic values. */
+    /* Set default typematic rate/delay. */
+    ps2kSetupTypematic(pThis, KBD_DFL_RATE_DELAY);
+    /* Clear last typematic key?? */
+    ps2kStopTypematicRepeat(pDevIns, pThis);
+}
+
+/**
+ * The keyboard controller disabled the keyboard serial line.
+ *
+ * @param   pThis   The keyboard device shared instance data.
+ */
+void PS2KLineDisable(PPS2K pThis)
+{
+    LogFlowFunc(("Disabling keyboard serial line\n"));
+
+    pThis->fLineDisabled = true;
+}
+
+/**
+ * The keyboard controller enabled the keyboard serial line.
+ *
+ * @param   pThis   The keyboard device shared instance data.
+ */
+void PS2KLineEnable(PPS2K pThis)
+{
+    LogFlowFunc(("Enabling keyboard serial line\n"));
+
+    pThis->fLineDisabled = false;
+
+    /* If there was anything in the input queue,
+     * consider it lost and throw it away.
+     */
+    PS2Q_CLEAR(&pThis->keyQ);
+}
+
+/**
+ * Receive and process a byte sent by the keyboard controller.
+ *
+ * @param   pDevIns The device instance.
+ * @param   pThis   The shared PS/2 keyboard instance data.
+ * @param   cmd     The command (or data) byte.
+ */
+int PS2KByteToKbd(PPDMDEVINS pDevIns, PPS2K pThis, uint8_t cmd)
+{
+    bool    fHandled = true;
+
+    LogFlowFunc(("new cmd=0x%02X, active cmd=0x%02X\n", cmd, pThis->u8CurrCmd));
+
+    if (pThis->u8CurrCmd == KCMD_RESET)
+        /* In reset mode, do not respond at all. */
+        return VINF_SUCCESS;
+
+    switch (cmd)
+    {
+        case KCMD_ECHO:
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ECHO);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_READ_ID:
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ID1);
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ID2);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_ENABLE:
+            pThis->fScanning = true;
+            PS2Q_CLEAR(&pThis->keyQ);
+            ps2kStopTypematicRepeat(pDevIns, pThis);
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_DFLT_DISABLE:
+            pThis->fScanning = false;
+            ps2kSetDefaults(pDevIns, pThis); /* Also clears buffer/typematic state. */
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_SET_DEFAULT:
+            ps2kSetDefaults(pDevIns, pThis);
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_ALL_TYPEMATIC:
+        case KCMD_ALL_MK_BRK:
+        case KCMD_ALL_MAKE:
+        case KCMD_ALL_TMB:
+            /// @todo Set the key types here.
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_RESEND:
+            pThis->u8CurrCmd = 0;
+            break;
+        case KCMD_RESET:
+            pThis->u8ScanSet = 2;
+            ps2kSetDefaults(pDevIns, pThis);
+            /// @todo reset more?
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = cmd;
+            /* Delay BAT completion; the test may take hundreds of ms. */
+            PDMDevHlpTimerSetMillies(pDevIns, pThis->hKbdDelayTimer, 2);
+            break;
+        /* The following commands need a parameter. */
+        case KCMD_LEDS:
+        case KCMD_SCANSET:
+        case KCMD_RATE_DELAY:
+        case KCMD_TYPE_MATIC:
+        case KCMD_TYPE_MK_BRK:
+        case KCMD_TYPE_MAKE:
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+            pThis->u8CurrCmd = cmd;
+            break;
+        default:
+            /* Sending a command instead of a parameter starts the new command. */
+            switch (pThis->u8CurrCmd)
+            {
+                case KCMD_LEDS:
+#ifndef IN_RING3
+                    return VINF_IOM_R3_IOPORT_WRITE;
+#else
+                    {
+                        PPS2KR3 pThisCC = &PDMDEVINS_2_DATA_CC(pDevIns, PKBDSTATER3)->Kbd;
+                        ps2kR3NotifyLedsState(pThisCC, cmd);
+                        pThis->fNumLockOn = !!(cmd & 0x02); /* Sync internal Num Lock state. */
+                        PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+                        pThis->u8LEDs = cmd;
+                        pThis->u8CurrCmd = 0;
+                    }
+#endif
+                    break;
+                case KCMD_SCANSET:
+                    PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+                    if (cmd == 0)
+                        PS2Q_INSERT(&pThis->cmdQ, pThis->u8ScanSet);
+                    else if (cmd < 4)
+                    {
+                        pThis->u8ScanSet = cmd;
+                        LogRel(("PS2K: Selected scan set %d\n", cmd));
+                    }
+                    /* Other values are simply ignored. */
+                    pThis->u8CurrCmd = 0;
+                    break;
+                case KCMD_RATE_DELAY:
+                    ps2kSetupTypematic(pThis, cmd);
+                    PS2Q_INSERT(&pThis->cmdQ, KRSP_ACK);
+                    pThis->u8CurrCmd = 0;
+                    break;
+                default:
+                    fHandled = false;
+            }
+            /* Fall through only to handle unrecognized commands. */
+            if (fHandled)
+                break;
+            RT_FALL_THRU();
+
+        case KCMD_INVALID_1:
+        case KCMD_INVALID_2:
+            PS2Q_INSERT(&pThis->cmdQ, KRSP_RESEND);
+            pThis->u8CurrCmd = 0;
+            break;
+    }
+    LogFlowFunc(("Active cmd now 0x%02X; updating interrupts\n", pThis->u8CurrCmd));
+//    KBCUpdateInterrupts(pDevIns);
+    return VINF_SUCCESS;
+}
+
+/**
+ * Send a byte (keystroke or command response) to the keyboard controller.
+ *
+ * @returns VINF_SUCCESS or VINF_TRY_AGAIN.
+ * @param   pDevIns The device instance.
+ * @param   pThis   The shared PS/2 keyboard instance data.
+ * @param   pb      Where to return the byte we've read.
+ * @remarks Caller must have entered the device critical section.
+ */
+int PS2KByteFromKbd(PPDMDEVINS pDevIns, PPS2K pThis, uint8_t *pb)
+{
+    int         rc;
+
+    AssertPtr(pb);
+
+    /* Anything in the command queue has priority over data
+     * in the keystroke queue. Additionally, keystrokes are
+     * blocked if a command is currently in progress, even if
+     * the command queue is empty.
+     */
+    rc = PS2Q_REMOVE(&pThis->cmdQ, pb);
+    if (rc != VINF_SUCCESS && !pThis->u8CurrCmd && pThis->fScanning)
+        if (!pThis->fThrottleActive)
+        {
+            rc = PS2Q_REMOVE(&pThis->keyQ, pb);
+            if (pThis->fThrottleEnabled)
+            {
+                pThis->fThrottleActive = true;
+                PDMDevHlpTimerSetMillies(pDevIns, pThis->hThrottleTimer, KBD_THROTTLE_DELAY);
+            }
+        }
+
+    LogFlowFunc(("keyboard sends 0x%02x (%svalid data)\n", *pb, rc == VINF_SUCCESS ? "" : "not "));
+    return rc;
+}
+
+#ifdef IN_RING3
+
+static int ps2kR3HidToInternalCode(uint32_t u32HidCode, key_def const **ppKeyDef)
+{
+    uint8_t         u8HidPage;
+    uint16_t        u16HidUsage;
+    int             iKeyIndex = -1;
+    key_def const   *pKeyDef = &aPS2Keys[0];    /* Dummy no-event key. */;
+
+    u8HidPage   = RT_LOBYTE(RT_HIWORD(u32HidCode));
+    u16HidUsage = RT_LOWORD(u32HidCode);
+
+    if (u8HidPage == USB_HID_KB_PAGE)
+    {
+        if (u16HidUsage <= VBOX_USB_MAX_USAGE_CODE)
+        {
+            iKeyIndex = u16HidUsage;    /* Direct mapping. */
+            pKeyDef   = iKeyIndex >= HID_MODIFIER_FIRST ? &aPS2ModKeys[iKeyIndex - HID_MODIFIER_FIRST] : &aPS2Keys[iKeyIndex];
+        }
+        else
+            AssertMsgFailed(("u16HidUsage out of range! (%04X)\n", u16HidUsage));
+    }
+    else if (u8HidPage == USB_HID_CC_PAGE)
+    {
+        for (unsigned i = 0; i < RT_ELEMENTS(aPS2CCKeys); ++i)
+            if (aPS2CCKeys[i].usageId == u16HidUsage)
+            {
+                pKeyDef   = &aPS2CCKeys[i].kdef;
+                iKeyIndex = PS2K_PAGE_CC_START + i;
+                break;
+            }
+        AssertMsg(iKeyIndex > -1, ("Unsupported code in USB_HID_CC_PAGE! (%04X)\n", u16HidUsage));
+    }
+    else if (u8HidPage == USB_HID_DC_PAGE)
+    {
+        for (unsigned i = 0; i < RT_ELEMENTS(aPS2DCKeys); ++i)
+            if (aPS2DCKeys[i].usageId == u16HidUsage)
+            {
+                pKeyDef   = &aPS2DCKeys[i].kdef;
+                iKeyIndex = PS2K_PAGE_DC_START + i;
+                break;
+            }
+        AssertMsg(iKeyIndex > -1, ("Unsupported code in USB_HID_DC_PAGE! (%04X)\n", u16HidUsage));
+    }
+    else
+    {
+        AssertMsgFailed(("Unsupported u8HidPage! (%02X)\n", u8HidPage));
+    }
+
+    if (ppKeyDef)
+        *ppKeyDef = pKeyDef;
+
+    return iKeyIndex;
+}
+
+static uint32_t ps2kR3InternalCodeToHid(unsigned uKeyCode)
+{
+    uint16_t    u16HidUsage;
+    uint32_t    u32HidCode = 0;
+
+    if ((uKeyCode >= PS2K_PAGE_DC_START) && (uKeyCode <= PS2K_PAGE_DC_END))
+    {
+        u16HidUsage = aPS2DCKeys[uKeyCode - PS2K_PAGE_DC_START].usageId;
+        u32HidCode  = RT_MAKE_U32(u16HidUsage, USB_HID_DC_PAGE);
+    }
+    else if ((uKeyCode >= PS2K_PAGE_CC_START) && (uKeyCode <= PS2K_PAGE_CC_END))
+    {
+        u16HidUsage = aPS2CCKeys[uKeyCode - PS2K_PAGE_CC_START].usageId;
+        u32HidCode  = RT_MAKE_U32(u16HidUsage, USB_HID_CC_PAGE);
+    }
+    else    /* Must be the keyboard usage page. */
+    {
+        if (uKeyCode <= VBOX_USB_MAX_USAGE_CODE)
+            u32HidCode = RT_MAKE_U32(uKeyCode, USB_HID_KB_PAGE);
+        else
+            AssertMsgFailed(("uKeyCode out of range! (%u)\n", uKeyCode));
+    }
+
+    return u32HidCode;
+}
+
+static int ps2kR3ProcessKeyEvent(PPDMDEVINS pDevIns, PPS2K pThis, uint32_t u32HidCode, bool fKeyDown)
+{
+    key_def const   *pKeyDef;
+    uint8_t         abCodes[16];
+    char            *pCodes;
+    size_t          cbLeft;
+    uint8_t         abScan[2];
+    uint8_t         u8HidPage;
+    uint16_t        u16HidUsage;
+
+    u8HidPage   = RT_LOBYTE(RT_HIWORD(u32HidCode));
+    u16HidUsage = RT_LOWORD(u32HidCode);
+
+    LogFlowFunc(("key %s: page 0x%02x ID 0x%04x (set %d)\n", fKeyDown ? "down" : "up", u8HidPage, u16HidUsage, pThis->u8ScanSet));
+
+    ps2kR3HidToInternalCode(u32HidCode, &pKeyDef);
+
+    /* Some keys are not processed at all; early return. */
+    if (pKeyDef->makeS1 == NONE)
+    {
+        LogFlow(("Skipping key processing.\n"));
+        return VINF_SUCCESS;
+    }
+
+    /* Handle modifier keys (Ctrl/Alt/Shift/GUI). We need to keep track
+     * of their state in addition to sending the scan code.
+     */
+    if ((u8HidPage == USB_HID_KB_PAGE) && (u16HidUsage >= HID_MODIFIER_FIRST))
+    {
+        unsigned    mod_bit = 1 << (u16HidUsage - HID_MODIFIER_FIRST);
+
+        Assert((u16HidUsage <= HID_MODIFIER_LAST));
+        if (fKeyDown)
+            pThis->u8Modifiers |= mod_bit;
+        else
+            pThis->u8Modifiers &= ~mod_bit;
+    }
+
+    /* Toggle NumLock state. */
+    if ((pKeyDef->keyFlags & KF_NL) && fKeyDown)
+        pThis->fNumLockOn ^= true;
+
+    abCodes[0] = 0;
+    pCodes = (char *)abCodes;
+    cbLeft = sizeof(abCodes);
+
+    if (pThis->u8ScanSet == 1 || pThis->u8ScanSet == 2)
+    {
+        /* The basic scan set 1 and 2 logic is the same, only the scan codes differ.
+         * Since scan set 2 is used almost all the time, that case is handled first.
+         */
+        if (fKeyDown)
+        {
+            /* Process key down event. */
+            if (pKeyDef->keyFlags & KF_PB)
+            {
+                /* Pause/Break sends different data if either Ctrl is held. */
+                if (pThis->u8Modifiers & (MOD_LCTRL | MOD_RCTRL))
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE0\x7E\xE0\xF0\x7E" : "\xE0\x46\xE0\xC6");
+                else
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE1\x14\x77\xE1\xF0\x14\xF0\x77" : "\xE1\x1D\x45\xE1\x9D\xC5");
+            }
+            else if (pKeyDef->keyFlags & KF_PS)
+            {
+                /* Print Screen depends on all of Ctrl, Shift, *and* Alt! */
+                if (pThis->u8Modifiers & (MOD_LALT | MOD_RALT))
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\x84" : "\x54");
+                else if (pThis->u8Modifiers & (MOD_LSHIFT | MOD_RSHIFT))
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE0\x7C" : "\xE0\x37");
+                else
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE0\x12\xE0\x7C" : "\xE0\x2A\xE0\x37");
+            }
+            else if (pKeyDef->keyFlags & (KF_GK | KF_NS))
+            {
+                /* The numeric pad keys fake Shift presses or releases
+                 * depending on Num Lock and Shift key state. The '/'
+                 * key behaves in a similar manner but does not depend on
+                 * the Num Lock state.
+                 */
+                if (!pThis->fNumLockOn || (pKeyDef->keyFlags & KF_NS))
+                {
+                    if (pThis->u8Modifiers & MOD_LSHIFT)
+                        RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                  "\xE0\xF0\x12" : "\xE0\xAA");
+                    if (pThis->u8Modifiers & MOD_RSHIFT)
+                        RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                  "\xE0\xF0\x59" : "\xE0\xB6");
+                }
+                else
+                {
+                    Assert(pThis->fNumLockOn);  /* Not for KF_NS! */
+                    if ((pThis->u8Modifiers & (MOD_LSHIFT | MOD_RSHIFT)) == 0)
+                        RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                  "\xE0\x12" : "\xE0\x2A");
+                    /* Else Shift cancels NumLock, so no prefix! */
+                }
+            }
+
+            /* Standard processing for regular keys only. */
+            abScan[0] = pThis->u8ScanSet == 2 ? pKeyDef->makeS2 : pKeyDef->makeS1;
+            abScan[1] = '\0';
+            if (!(pKeyDef->keyFlags & (KF_PB | KF_PS)))
+            {
+                if (pKeyDef->keyFlags & (KF_E0 | KF_GK | KF_NS))
+                    RTStrCatP(&pCodes, &cbLeft, "\xE0");
+                RTStrCatP(&pCodes, &cbLeft, (const char *)abScan);
+            }
+
+            /* Feed the bytes to the queue if there is room. */
+            /// @todo Send overrun code if sequence won't fit?
+            ps2kR3InsertStrQueue(&pThis->keyQ, abCodes, 0);
+        }
+        else if (!(pKeyDef->keyFlags & (KF_NB | KF_PB)))
+        {
+            /* Process key up event except for keys which produce none. */
+
+            /* Handle Print Screen release. */
+            if (pKeyDef->keyFlags & KF_PS)
+            {
+                /* Undo faked Print Screen state as needed. */
+                if (pThis->u8Modifiers & (MOD_LALT | MOD_RALT))
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xF0\x84" : "\xD4");
+                else if (pThis->u8Modifiers & (MOD_LSHIFT | MOD_RSHIFT))
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE0\xF0\x7C" : "\xE0\xB7");
+                else
+                    RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                              "\xE0\xF0\x7C\xE0\xF0\x12" : "\xE0\xB7\xE0\xAA");
+            }
+            else
+            {
+                /* Process base scan code for less unusual keys. */
+                abScan[0] = pThis->u8ScanSet == 2 ? pKeyDef->makeS2 : pKeyDef->makeS1 | 0x80;
+                abScan[1] = '\0';
+                if (pKeyDef->keyFlags & (KF_E0 | KF_GK | KF_NS))
+                    RTStrCatP(&pCodes, &cbLeft, "\xE0");
+                if (pThis->u8ScanSet == 2)
+                    RTStrCatP(&pCodes, &cbLeft, "\xF0");
+                RTStrCatP(&pCodes, &cbLeft, (const char *)abScan);
+
+                /* Restore shift state for gray keys. */
+                if (pKeyDef->keyFlags & (KF_GK | KF_NS))
+                {
+                    if (!pThis->fNumLockOn || (pKeyDef->keyFlags & KF_NS))
+                    {
+                        if (pThis->u8Modifiers & MOD_LSHIFT)
+                            RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                      "\xE0\x12" : "\xE0\x2A");
+                        if (pThis->u8Modifiers & MOD_RSHIFT)
+                            RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                      "\xE0\x59" : "\xE0\x36");
+                    }
+                    else
+                    {
+                        Assert(pThis->fNumLockOn);  /* Not for KF_NS! */
+                        if ((pThis->u8Modifiers & (MOD_LSHIFT | MOD_RSHIFT)) == 0)
+                            RTStrCatP(&pCodes, &cbLeft, pThis->u8ScanSet == 2 ?
+                                      "\xE0\xF0\x12" : "\xE0\xAA");
+                    }
+                }
+            }
+
+            /* Feed the bytes to the queue if there is room. */
+            /// @todo Send overrun code if sequence won't fit?
+            ps2kR3InsertStrQueue(&pThis->keyQ, abCodes, 0);
+        }
+    }
+    else
+    {
+        /* Handle Scan Set 3 - very straightforward. */
+        Assert(pThis->u8ScanSet == 3);
+        abScan[0] = pKeyDef->makeS3;
+        abScan[1] = '\0';
+        if (fKeyDown)
+        {
+            RTStrCatP(&pCodes, &cbLeft, (const char *)abScan);
+        }
+        else
+        {
+            /* Send a key release code unless it's a make only key. */
+            /// @todo Look up the current typematic setting, not the default!
+            if (pKeyDef->keyMatic != T_M)
+            {
+                RTStrCatP(&pCodes, &cbLeft, "\xF0");
+                RTStrCatP(&pCodes, &cbLeft, (const char *)abScan);
+            }
+        }
+        /* Feed the bytes to the queue if there is room. */
+        /// @todo Send overrun code if sequence won't fit?
+        ps2kR3InsertStrQueue(&pThis->keyQ, abCodes, 0);
+    }
+
+    /* Set up or cancel typematic key repeat. For keyboard usage page only. */
+    if (u8HidPage == USB_HID_KB_PAGE)
+    {
+        if (fKeyDown)
+        {
+            if (pThis->u32TypematicKey != u32HidCode)
+            {
+                pThis->enmTypematicState = KBD_TMS_DELAY;
+                pThis->u32TypematicKey   = u32HidCode;
+                PDMDevHlpTimerSetMillies(pDevIns, pThis->hKbdTypematicTimer, pThis->uTypematicDelay);
+                Log(("Typematic delay %u ms, key %08X\n", pThis->uTypematicDelay, u32HidCode));
+            }
+        }
+        else
+        {
+            /* "Typematic operation stops when the last key pressed is released, even
+             * if other keys are still held down." (IBM PS/2 Tech Ref). The last key pressed
+             * is the one that's being repeated.
+             */
+            if (pThis->u32TypematicKey == u32HidCode)
+            {
+                /* This disables the typematic repeat. */
+                pThis->u32TypematicKey   = 0;
+                pThis->enmTypematicState = KBD_TMS_IDLE;
+                /* For good measure, we cancel the timer, too. */
+                PDMDevHlpTimerStop(pDevIns, pThis->hKbdTypematicTimer);
+                Log(("Typematic action cleared for key %08X\n", u32HidCode));
+            }
+        }
+    }
+
+    /* Poke the KBC to update its state. */
+    KBCUpdateInterrupts(pDevIns);
+
+    return VINF_SUCCESS;
+}
+
+/**
+ * @callback_method_impl{FNTMTIMERDEV}
+ *
+ * Throttling timer to emulate the finite keyboard communication speed. A PS/2 keyboard is
+ * limited by the serial link speed and cannot send much more than 1,000 bytes per second.
+ * Some software (notably Borland Pascal and programs built with its run-time) relies on
+ * being able to read an incoming scan-code twice. Throttling the data rate enables such
+ * software to function, while human typists cannot tell any difference.
+ *
+ * Note: The throttling is currently only done for keyboard data, not command responses.
+ * The throttling could and perhaps should be done for any data (including command
+ * responses) coming from PS/2 devices, both keyboard and auxiliary. That is not currently
+ * done because it would needlessly slow things down.
+ */
+static DECLCALLBACK(void) ps2kR3ThrottleTimer(PPDMDEVINS pDevIns, TMTIMERHANDLE hTimer, void *pvUser)
+{
+    PPS2K       pThis = (PS2K *)pvUser;
+    unsigned    uHaveData;
+    RT_NOREF(hTimer);
+
+    /* Grab the lock to avoid races with event delivery or EMTs. */
+    int const rcLock = PDMDevHlpCritSectEnter(pDevIns, pDevIns->pCritSectRoR3, VERR_SEM_BUSY);
+    PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, pDevIns->pCritSectRoR3, rcLock);
+
+    /* If data is available, poke the KBC. Once the data
+     * is actually read, the timer may be re-triggered.
+     */
+    pThis->fThrottleActive = false;
+    uHaveData = PS2Q_COUNT(&pThis->keyQ);
+    LogFlowFunc(("Have%s bytes\n", uHaveData ? "" : " no"));
+    if (uHaveData)
+        KBCUpdateInterrupts(pDevIns);
+
+    PDMDevHlpCritSectLeave(pDevIns, pDevIns->pCritSectRoR3);
+}
+
+/**
+ * @callback_method_impl{FNTMTIMERDEV,
+ * Timer handler for emulating typematic keys.}
+ *
+ * @note    Note that only the last key held down repeats (if typematic).
+ */
+static DECLCALLBACK(void) ps2kR3TypematicTimer(PPDMDEVINS pDevIns, TMTIMERHANDLE hTimer, void *pvUser)
+{
+    PPS2K pThis = (PS2K *)pvUser;
+    Assert(hTimer == pThis->hKbdTypematicTimer);
+    LogFlowFunc(("Typematic state=%d, key %08X\n", pThis->enmTypematicState, pThis->u32TypematicKey));
+
+    /* If the current typematic key is zero, the repeat was canceled just when
+     * the timer was about to run. In that case, do nothing.
+     */
+    if (pThis->u32TypematicKey)
+    {
+        if (pThis->enmTypematicState == KBD_TMS_DELAY)
+            pThis->enmTypematicState = KBD_TMS_REPEAT;
+
+        if (pThis->enmTypematicState == KBD_TMS_REPEAT)
+        {
+            ps2kR3ProcessKeyEvent(pDevIns, pThis, pThis->u32TypematicKey, true /* Key down */ );
+            PDMDevHlpTimerSetMillies(pDevIns, hTimer, pThis->uTypematicRepeat);
+        }
+    }
+}
+
+/**
+ * @callback_method_impl{FNTMTIMERDEV}
+ *
+ * The keyboard BAT is specified to take several hundred milliseconds. We need
+ * to delay sending the result to the host for at least a tiny little while.
+ */
+static DECLCALLBACK(void) ps2kR3DelayTimer(PPDMDEVINS pDevIns, TMTIMERHANDLE hTimer, void *pvUser)
+{
+    PPS2K pThis = (PS2K *)pvUser;
+    RT_NOREF(hTimer);
+
+    LogFlowFunc(("Delay timer: cmd %02X\n", pThis->u8CurrCmd));
+
+    AssertMsg(pThis->u8CurrCmd == KCMD_RESET, ("u8CurrCmd=%02x\n", pThis->u8CurrCmd));
+    PS2Q_INSERT(&pThis->cmdQ, KRSP_BAT_OK);
+    pThis->fScanning = true;    /* BAT completion enables scanning! */
+    pThis->u8CurrCmd = 0;
+
+    /// @todo Might want a PS2KCompleteCommand() to push last response, clear command, and kick the KBC...
+    /* Give the KBC a kick. */
+    KBCUpdateInterrupts(pDevIns);
+}
+
+/* Release any and all currently depressed keys. Used whenever the guest keyboard
+ * is likely to be out of sync with the host, such as when loading a saved state
+ * or resuming a suspended host.
+ */
+static void ps2kR3ReleaseKeys(PPDMDEVINS pDevIns, PPS2K pThis)
+{
+    LogFlowFunc(("Releasing keys...\n"));
+
+    for (unsigned uKey = 0; uKey < RT_ELEMENTS(pThis->abDepressedKeys); ++uKey)
+        if (pThis->abDepressedKeys[uKey])
+        {
+            ps2kR3ProcessKeyEvent(pDevIns, pThis, ps2kR3InternalCodeToHid(uKey), false /* key up */);
+            pThis->abDepressedKeys[uKey] = 0;
+        }
+    LogFlowFunc(("Done releasing keys\n"));
+}
+
+
+/**
+ * Debug device info handler. Prints basic keyboard state.
+ *
+ * @param   pDevIns     Device instance which registered the info.
+ * @param   pHlp        Callback functions for doing output.
+ * @param   pszArgs     Argument string. Optional and specific to the handler.
+ */
+static DECLCALLBACK(void) ps2kR3InfoState(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
+{
+    PKBDSTATE   pParent = PDMDEVINS_2_DATA(pDevIns, PKBDSTATE);
+    PPS2K       pThis   = &pParent->Kbd;
+    NOREF(pszArgs);
+
+    pHlp->pfnPrintf(pHlp, "PS/2 Keyboard: scan set %d, scanning %s, serial line %s\n",
+                    pThis->u8ScanSet, pThis->fScanning ? "enabled" : "disabled",
+                    pThis->fLineDisabled ? "disabled" : "enabled");
+    pHlp->pfnPrintf(pHlp, "Active command %02X\n", pThis->u8CurrCmd);
+    pHlp->pfnPrintf(pHlp, "LED state %02X, Num Lock %s\n", pThis->u8LEDs,
+                    pThis->fNumLockOn ? "on" : "off");
+    pHlp->pfnPrintf(pHlp, "Typematic delay %ums, repeat period %ums\n",
+                    pThis->uTypematicDelay, pThis->uTypematicRepeat);
+    pHlp->pfnPrintf(pHlp, "Command queue: %d items (%d max)\n",
+                    PS2Q_COUNT(&pThis->cmdQ), PS2Q_SIZE(&pThis->cmdQ));
+    pHlp->pfnPrintf(pHlp, "Input queue  : %d items (%d max)\n",
+                    PS2Q_COUNT(&pThis->keyQ), PS2Q_SIZE(&pThis->keyQ));
+    if (pThis->enmTypematicState != KBD_TMS_IDLE)
+        pHlp->pfnPrintf(pHlp, "Active typematic key %08X (%s)\n", pThis->u32TypematicKey,
+                        pThis->enmTypematicState == KBD_TMS_DELAY ? "delay" : "repeat");
+}
+
+
+/* -=-=-=-=-=- Keyboard: IKeyboardPort  -=-=-=-=-=- */
+
+/**
+ * Keyboard event handler.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns     The device instance.
+ * @param   pThis       The PS2 keyboard instance data.
+ * @param   idUsage     USB HID usage code with key press/release flag.
+ */
+static int ps2kR3PutEventWorker(PPDMDEVINS pDevIns, PPS2K pThis, uint32_t idUsage)
+{
+    uint32_t        u32HidCode;
+    bool            fKeyDown;
+    bool            fHaveEvent = true;
+    int             iKeyCode;
+    int             rc = VINF_SUCCESS;
+
+    /* Extract the usage page and ID and ensure it's valid. */
+    fKeyDown   = !(idUsage & PDMIKBDPORT_KEY_UP);
+    u32HidCode = idUsage & 0xFFFFFF;
+
+    iKeyCode = ps2kR3HidToInternalCode(u32HidCode, NULL);
+    AssertMsgReturn(iKeyCode > 0 && iKeyCode <= VBOX_USB_MAX_USAGE_CODE, ("iKeyCode=%#x idUsage=%#x\n", iKeyCode, idUsage),
+                    VERR_INTERNAL_ERROR);
+
+    if (fKeyDown)
+    {
+        /* Due to host key repeat, we can get key events for keys which are
+         * already depressed. We need to ignore those. */
+        if (pThis->abDepressedKeys[iKeyCode])
+            fHaveEvent = false;
+        pThis->abDepressedKeys[iKeyCode] = 1;
+    }
+    else
+    {
+        /* NB: We allow key release events for keys which aren't depressed.
+         * That is unlikely to happen and should not cause trouble.
+         */
+        pThis->abDepressedKeys[iKeyCode] = 0;
+    }
+
+    /* Unless this is a new key press/release, don't even bother. */
+    if (fHaveEvent)
+    {
+        Assert(PDMDevHlpCritSectIsOwner(pDevIns, pDevIns->pCritSectRoR3));
+        rc = ps2kR3ProcessKeyEvent(pDevIns, pThis, u32HidCode, fKeyDown);
+    }
+
+    return rc;
+}
+
+
+/**
+ * @interface_method_impl{PDMIKEYBOARDPORT,pfnPutEventHid}
+ */
+static DECLCALLBACK(int) ps2kR3KeyboardPort_PutEventHid(PPDMIKEYBOARDPORT pInterface, uint32_t idUsage)
+{
+    PPS2KR3     pThisCC = RT_FROM_MEMBER(pInterface, PS2KR3, Keyboard.IPort);
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+    PPS2K       pThis   = &PDMDEVINS_2_DATA(pDevIns, PKBDSTATE)->Kbd;
+
+    LogRelFlowFunc(("key code %08X\n", idUsage));
+
+    int const rcLock = PDMDevHlpCritSectEnter(pDevIns, pDevIns->pCritSectRoR3, VERR_SEM_BUSY);
+    PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, pDevIns->pCritSectRoR3, rcLock);
+
+    /* The 'BAT fail' scancode is reused as a signal to release keys. No actual
+     * key is allowed to use this scancode.
+     */
+    if (RT_LIKELY(!(idUsage & PDMIKBDPORT_RELEASE_KEYS)))
+        ps2kR3PutEventWorker(pDevIns, pThis, idUsage);
+    else
+        ps2kR3ReleaseKeys(pDevIns, pThis);
+
+    PDMDevHlpCritSectLeave(pDevIns, pDevIns->pCritSectRoR3);
+
+    return VINF_SUCCESS;
+}
+
+
+/* -=-=-=-=-=- Keyboard: IBase  -=-=-=-=-=- */
+
+/**
+ * @interface_method_impl{PDMIBASE,pfnQueryInterface}
+ */
+static DECLCALLBACK(void *) ps2kR3QueryInterface(PPDMIBASE pInterface, const char *pszIID)
+{
+    PPS2KR3 pThisCC = RT_FROM_MEMBER(pInterface, PS2KR3, Keyboard.IBase);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->Keyboard.IBase);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIKEYBOARDPORT, &pThisCC->Keyboard.IPort);
+    return NULL;
+}
+
+
+/* -=-=-=-=-=- Device management -=-=-=-=-=- */
+
+/**
+ * Attach command.
+ *
+ * This is called to let the device attach to a driver for a
+ * specified LUN.
+ *
+ * This is like plugging in the keyboard after turning on the
+ * system.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns     The device instance.
+ * @param   pThisCC     The PS/2 keyboard instance data for ring-3.
+ * @param   iLUN        The logical unit which is being detached.
+ * @param   fFlags      Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
+ */
+int PS2KR3Attach(PPDMDEVINS pDevIns, PPS2KR3 pThisCC, unsigned iLUN, uint32_t fFlags)
+{
+    int         rc;
+
+    /* The LUN must be 0, i.e. keyboard. */
+    Assert(iLUN == 0);
+    AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
+                    ("PS/2 keyboard does not support hotplugging\n"),
+                    VERR_INVALID_PARAMETER);
+
+    LogFlowFunc(("iLUN=%d\n", iLUN));
+
+    rc = PDMDevHlpDriverAttach(pDevIns, iLUN, &pThisCC->Keyboard.IBase, &pThisCC->Keyboard.pDrvBase, "Keyboard Port");
+    if (RT_SUCCESS(rc))
+    {
+        pThisCC->Keyboard.pDrv = PDMIBASE_QUERY_INTERFACE(pThisCC->Keyboard.pDrvBase, PDMIKEYBOARDCONNECTOR);
+        if (!pThisCC->Keyboard.pDrv)
+        {
+            AssertLogRelMsgFailed(("LUN #0 doesn't have a keyboard interface! rc=%Rrc\n", rc));
+            rc = VERR_PDM_MISSING_INTERFACE;
+        }
+    }
+    else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
+    {
+        Log(("%s/%d: warning: no driver attached to LUN #0!\n", pDevIns->pReg->szName, pDevIns->iInstance));
+        rc = VINF_SUCCESS;
+    }
+    else
+        AssertLogRelMsgFailed(("Failed to attach LUN #0! rc=%Rrc\n", rc));
+
+    return rc;
+}
+
+void PS2KR3SaveState(PPDMDEVINS pDevIns, PPS2K pThis, PSSMHANDLE pSSM)
+{
+    PCPDMDEVHLPR3   pHlp = pDevIns->pHlpR3;
+    uint32_t        cPressed = 0;
+    uint32_t        cbTMSSize = 0;
+
+    LogFlowFunc(("Saving PS2K state\n"));
+
+    /* Save the basic keyboard state. */
+    pHlp->pfnSSMPutU8(pSSM, pThis->u8CurrCmd);
+    pHlp->pfnSSMPutU8(pSSM, pThis->u8LEDs);
+    pHlp->pfnSSMPutU8(pSSM, pThis->u8TypematicCfg);
+    pHlp->pfnSSMPutU8(pSSM, (uint8_t)pThis->u32TypematicKey);
+    pHlp->pfnSSMPutU8(pSSM, pThis->u8Modifiers);
+    pHlp->pfnSSMPutU8(pSSM, pThis->u8ScanSet);
+    pHlp->pfnSSMPutU8(pSSM, pThis->enmTypematicState);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fNumLockOn);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fScanning);
+
+    /* Save the command and keystroke queues. */
+    PS2Q_SAVE(pHlp, pSSM, &pThis->cmdQ);
+    PS2Q_SAVE(pHlp, pSSM, &pThis->keyQ);
+
+    /* Save the command delay timer. Note that the typematic repeat
+     * timer is *not* saved.
+     */
+    PDMDevHlpTimerSave(pDevIns, pThis->hKbdDelayTimer, pSSM);
+
+    /* Save any pressed keys. This is necessary to avoid "stuck"
+     * keys after a restore. Needs two passes.
+     */
+    for (unsigned i = 0; i < sizeof(pThis->abDepressedKeys); ++i)
+        if (pThis->abDepressedKeys[i])
+            ++cPressed;
+
+    pHlp->pfnSSMPutU32(pSSM, cPressed);
+
+    for (unsigned uKey = 0; uKey < sizeof(pThis->abDepressedKeys); ++uKey)
+        if (pThis->abDepressedKeys[uKey])
+            pHlp->pfnSSMPutU8(pSSM, uKey);
+
+    /* Save the typematic settings for Scan Set 3. */
+    pHlp->pfnSSMPutU32(pSSM, cbTMSSize);
+    /* Currently not implemented. */
+}
+
+int PS2KR3LoadState(PPDMDEVINS pDevIns, PPS2K pThis, PSSMHANDLE pSSM, uint32_t uVersion)
+{
+    PCPDMDEVHLPR3   pHlp = pDevIns->pHlpR3;
+    uint8_t         u8;
+    uint32_t        cPressed;
+    uint32_t        cbTMSSize;
+    int             rc;
+
+    NOREF(uVersion);
+    LogFlowFunc(("Loading PS2K state version %u\n", uVersion));
+
+    /* Load the basic keyboard state. */
+    pHlp->pfnSSMGetU8(pSSM, &pThis->u8CurrCmd);
+    pHlp->pfnSSMGetU8(pSSM, &pThis->u8LEDs);
+    pHlp->pfnSSMGetU8(pSSM, &pThis->u8TypematicCfg);
+    pHlp->pfnSSMGetU8(pSSM, &u8);
+    /* Reconstruct the 32-bit code from the 8-bit value in saved state. */
+    pThis->u32TypematicKey = u8 ? ps2kR3InternalCodeToHid(u8) : 0;
+    pHlp->pfnSSMGetU8(pSSM, &pThis->u8Modifiers);
+    pHlp->pfnSSMGetU8(pSSM, &pThis->u8ScanSet);
+    pHlp->pfnSSMGetU8(pSSM, &u8);
+    pThis->enmTypematicState = (tmatic_state_t)u8;
+    pHlp->pfnSSMGetBool(pSSM, &pThis->fNumLockOn);
+    pHlp->pfnSSMGetBool(pSSM, &pThis->fScanning);
+
+    /* Load the command and keystroke queues. */
+    rc = PS2Q_LOAD(pHlp, pSSM, &pThis->cmdQ);
+    AssertRCReturn(rc, rc);
+    rc = PS2Q_LOAD(pHlp, pSSM, &pThis->keyQ);
+    AssertRCReturn(rc, rc);
+
+    /* Load the command delay timer, just in case. */
+    rc = PDMDevHlpTimerLoad(pDevIns, pThis->hKbdDelayTimer, pSSM);
+    AssertRCReturn(rc, rc);
+
+    /* Recalculate the typematic delay/rate. */
+    ps2kSetupTypematic(pThis, pThis->u8TypematicCfg);
+
+    /* Fake key up events for keys that were held down at the time the state was saved. */
+    rc = pHlp->pfnSSMGetU32(pSSM, &cPressed);
+    AssertRCReturn(rc, rc);
+
+    /* If any keys were down, load and then release them. */
+    if (cPressed)
+    {
+        for (unsigned i = 0; i < cPressed; ++i)
+        {
+            rc = pHlp->pfnSSMGetU8(pSSM, &u8);
+            AssertRCReturn(rc, rc);
+            pThis->abDepressedKeys[u8] = 1;
+        }
+    }
+
+    /* Load typematic settings for Scan Set 3. */
+    rc = pHlp->pfnSSMGetU32(pSSM, &cbTMSSize);
+    AssertRCReturn(rc, rc);
+
+    while (cbTMSSize--)
+    {
+        rc = pHlp->pfnSSMGetU8(pSSM, &u8);
+        AssertRCReturn(rc, rc);
+    }
+
+    return rc;
+}
+
+int PS2KR3LoadDone(PPDMDEVINS pDevIns, PPS2K pThis, PPS2KR3 pThisCC)
+{
+    /* This *must* be done after the inital load because it may trigger
+     * interrupts and change the interrupt controller state.
+     */
+    ps2kR3ReleaseKeys(pDevIns, pThis);
+    ps2kR3NotifyLedsState(pThisCC, pThis->u8LEDs);
+    return VINF_SUCCESS;
+}
+
+void PS2KR3Reset(PPDMDEVINS pDevIns, PPS2K pThis, PPS2KR3 pThisCC)
+{
+    LogFlowFunc(("Resetting PS2K\n"));
+
+    pThis->fScanning         = true;
+    pThis->fThrottleActive   = false;
+    pThis->u8ScanSet         = 2;
+    pThis->u8CurrCmd         = 0;
+    pThis->u8Modifiers       = 0;
+    pThis->u32TypematicKey   = 0;
+    pThis->enmTypematicState = KBD_TMS_IDLE;
+
+    /* Clear queues and any pressed keys. */
+    memset(pThis->abDepressedKeys, 0, sizeof(pThis->abDepressedKeys));
+    PS2Q_CLEAR(&pThis->cmdQ);
+    ps2kSetDefaults(pDevIns, pThis);     /* Also clears keystroke queue. */
+
+    /* Activate the PS/2 keyboard by default. */
+    if (pThisCC->Keyboard.pDrv)
+        pThisCC->Keyboard.pDrv->pfnSetActive(pThisCC->Keyboard.pDrv, true /*fActive*/);
+}
+
+int PS2KR3Construct(PPDMDEVINS pDevIns, PPS2K pThis, PPS2KR3 pThisCC, PCFGMNODE pCfg)
+{
+    LogFlowFunc(("\n"));
+    PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
+
+    /*
+     * Read configuration.
+     */
+    bool fThrottleEnabled;
+    int rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "KbdThrottleEnabled", &fThrottleEnabled, true);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Failed to query \"KbdThrottleEnabled\" from the config"));
+    Log(("KbdThrottleEnabled=%RTbool\n", fThrottleEnabled));
+    pThis->fThrottleEnabled = fThrottleEnabled;
+
+    /*
+     * Initialize state.
+     */
+    pThisCC->pDevIns                          = pDevIns;
+    pThisCC->Keyboard.IBase.pfnQueryInterface = ps2kR3QueryInterface;
+    pThisCC->Keyboard.IPort.pfnPutEventHid    = ps2kR3KeyboardPort_PutEventHid;
+
+    pThis->cmdQ.Hdr.pszDescR3 = "Kbd Cmd";
+    pThis->keyQ.Hdr.pszDescR3 = "Kbd Key";
+
+    /*
+     * Create the input rate throttling timer.
+     */
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ps2kR3ThrottleTimer, pThis,
+                              TMTIMER_FLAGS_DEFAULT_CRIT_SECT | TMTIMER_FLAGS_RING0,
+                              "PS2K Throttle", &pThis->hThrottleTimer);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Create the typematic delay/repeat timer.
+     */
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ps2kR3TypematicTimer, pThis,
+                              TMTIMER_FLAGS_DEFAULT_CRIT_SECT | TMTIMER_FLAGS_RING0,
+                              "PS2K Typematic", &pThis->hKbdTypematicTimer);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Create the command delay timer.
+     */
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ps2kR3DelayTimer, pThis,
+                              TMTIMER_FLAGS_DEFAULT_CRIT_SECT | TMTIMER_FLAGS_RING0,
+                              "PS2K Delay", &pThis->hKbdDelayTimer);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Register debugger info callbacks.
+     */
+    PDMDevHlpDBGFInfoRegister(pDevIns, "ps2k", "Display PS/2 keyboard state.", ps2kR3InfoState);
+
+    return rc;
+}
+
+#endif /* IN _RING3 */
+