hw/serial.c

   1 /*
   2  * QEMU 16550A UART emulation
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  * Copyright (c) 2008 Citrix Systems, Inc.
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25 #include "hw.h"
  26 #include "qemu-char.h"
  27 #include "isa.h"
  28 #include "pc.h"
  29 #include "qemu-timer.h"
  30
  31 //#define DEBUG_SERIAL
  32
  33 #define UART_LCR_DLAB   0x80    /* Divisor latch access bit */
  34
  35 #define UART_IER_MSI    0x08    /* Enable Modem status interrupt */
  36 #define UART_IER_RLSI   0x04    /* Enable receiver line status interrupt */
  37 #define UART_IER_THRI   0x02    /* Enable Transmitter holding register int. */
  38 #define UART_IER_RDI    0x01    /* Enable receiver data interrupt */
  39
  40 #define UART_IIR_NO_INT 0x01    /* No interrupts pending */
  41 #define UART_IIR_ID     0x06    /* Mask for the interrupt ID */
  42
  43 #define UART_IIR_MSI    0x00    /* Modem status interrupt */
  44 #define UART_IIR_THRI   0x02    /* Transmitter holding register empty */
  45 #define UART_IIR_RDI    0x04    /* Receiver data interrupt */
  46 #define UART_IIR_RLSI   0x06    /* Receiver line status interrupt */
  47 #define UART_IIR_CTI    0x0C    /* Character Timeout Indication */
  48
  49 #define UART_IIR_FENF   0x80    /* Fifo enabled, but not functionning */
  50 #define UART_IIR_FE     0xC0    /* Fifo enabled */
  51
  52 /*
  53  * These are the definitions for the Modem Control Register
  54  */
  55 #define UART_MCR_LOOP   0x10    /* Enable loopback test mode */
  56 #define UART_MCR_OUT2   0x08    /* Out2 complement */
  57 #define UART_MCR_OUT1   0x04    /* Out1 complement */
  58 #define UART_MCR_RTS    0x02    /* RTS complement */
  59 #define UART_MCR_DTR    0x01    /* DTR complement */
  60
  61 /*
  62  * These are the definitions for the Modem Status Register
  63  */
  64 #define UART_MSR_DCD    0x80    /* Data Carrier Detect */
  65 #define UART_MSR_RI     0x40    /* Ring Indicator */
  66 #define UART_MSR_DSR    0x20    /* Data Set Ready */
  67 #define UART_MSR_CTS    0x10    /* Clear to Send */
  68 #define UART_MSR_DDCD   0x08    /* Delta DCD */
  69 #define UART_MSR_TERI   0x04    /* Trailing edge ring indicator */
  70 #define UART_MSR_DDSR   0x02    /* Delta DSR */
  71 #define UART_MSR_DCTS   0x01    /* Delta CTS */
  72 #define UART_MSR_ANY_DELTA 0x0F /* Any of the delta bits! */
  73
  74 #define UART_LSR_TEMT   0x40    /* Transmitter empty */
  75 #define UART_LSR_THRE   0x20    /* Transmit-hold-register empty */
  76 #define UART_LSR_BI     0x10    /* Break interrupt indicator */
  77 #define UART_LSR_FE     0x08    /* Frame error indicator */
  78 #define UART_LSR_PE     0x04    /* Parity error indicator */
  79 #define UART_LSR_OE     0x02    /* Overrun error indicator */
  80 #define UART_LSR_DR     0x01    /* Receiver data ready */
  81 #define UART_LSR_INT_ANY 0x1E   /* Any of the lsr-interrupt-triggering status bits */
  82
  83 /* Interrupt trigger levels. The byte-counts are for 16550A - in newer UARTs the byte-count for each ITL is higher. */
  84
  85 #define UART_FCR_ITL_1      0x00 /* 1 byte ITL */
  86 #define UART_FCR_ITL_2      0x40 /* 4 bytes ITL */
  87 #define UART_FCR_ITL_3      0x80 /* 8 bytes ITL */
  88 #define UART_FCR_ITL_4      0xC0 /* 14 bytes ITL */
  89
  90 #define UART_FCR_DMS        0x08    /* DMA Mode Select */
  91 #define UART_FCR_XFR        0x04    /* XMIT Fifo Reset */
  92 #define UART_FCR_RFR        0x02    /* RCVR Fifo Reset */
  93 #define UART_FCR_FE         0x01    /* FIFO Enable */
  94
  95 #define UART_FIFO_LENGTH    16      /* 16550A Fifo Length */
  96
  97 #define XMIT_FIFO           0
  98 #define RECV_FIFO           1
  99 #define MAX_XMIT_RETRY      4
 100
 101 struct SerialFIFO {
 102     uint8_t data[UART_FIFO_LENGTH];
 103     uint8_t count;
 104     uint8_t itl;                        /* Interrupt Trigger Level */
 105     uint8_t tail;
 106     uint8_t head;
 107 } typedef SerialFIFO;
 108
 109 struct SerialState {
 110     uint16_t divider;
 111     uint8_t rbr; /* receive register */
 112     uint8_t thr; /* transmit holding register */
 113     uint8_t tsr; /* transmit shift register */
 114     uint8_t ier;
 115     uint8_t iir; /* read only */
 116     uint8_t lcr;
 117     uint8_t mcr;
 118     uint8_t lsr; /* read only */
 119     uint8_t msr; /* read only */
 120     uint8_t scr;
 121     uint8_t fcr;
 122     /* NOTE: this hidden state is necessary for tx irq generation as
 123        it can be reset while reading iir */
 124     int thr_ipending;
 125     qemu_irq irq;
 126     CharDriverState *chr;
 127     int last_break_enable;
 128     target_phys_addr_t base;
 129     int it_shift;
 130     int baudbase;
 131     int tsr_retry;
 132
 133     uint64_t last_xmit_ts;              /* Time when the last byte was successfully sent out of the tsr */
 134     SerialFIFO recv_fifo;
 135     SerialFIFO xmit_fifo;
 136
 137     struct QEMUTimer *fifo_timeout_timer;
 138     int timeout_ipending;                   /* timeout interrupt pending state */
 139     struct QEMUTimer *transmit_timer;
 140
 141
 142     uint64_t char_transmit_time;               /* time to transmit a char in ticks*/
 143     int poll_msl;
 144
 145     struct QEMUTimer *modem_status_poll;
 146 };
 147
 148 static void serial_receive1(void *opaque, const uint8_t *buf, int size);
 149
 150 static void fifo_clear(SerialState *s, int fifo)
 151 {
 152     SerialFIFO *f = (fifo) ? &s->recv_fifo : &s->xmit_fifo;
 153     memset(f->data, 0, UART_FIFO_LENGTH);
 154     f->count = 0;
 155     f->head = 0;
 156     f->tail = 0;
 157 }
 158
 159 static int fifo_put(SerialState *s, int fifo, uint8_t chr)
 160 {
 161     SerialFIFO *f = (fifo) ? &s->recv_fifo : &s->xmit_fifo;
 162
 163     f->data[f->head++] = chr;
 164
 165     if (f->head == UART_FIFO_LENGTH)
 166         f->head = 0;
 167     f->count++;
 168
 169     return 1;
 170 }
 171
 172 static uint8_t fifo_get(SerialState *s, int fifo)
 173 {
 174     SerialFIFO *f = (fifo) ? &s->recv_fifo : &s->xmit_fifo;
 175     uint8_t c;
 176
 177     if(f->count == 0)
 178         return 0;
 179
 180     c = f->data[f->tail++];
 181     if (f->tail == UART_FIFO_LENGTH)
 182         f->tail = 0;
 183     f->count--;
 184
 185     return c;
 186 }
 187
 188 static void serial_update_irq(SerialState *s)
 189 {
 190     uint8_t tmp_iir = UART_IIR_NO_INT;
 191
 192     if ((s->ier & UART_IER_RLSI) && (s->lsr & UART_LSR_INT_ANY)) {
 193         tmp_iir = UART_IIR_RLSI;
 194     } else if ((s->ier & UART_IER_RDI) && s->timeout_ipending) {
 195         /* Note that(s->ier & UART_IER_RDI) can mask this interrupt,
 196          * this is not in the specification but is observed on existing
 197          * hardware.  */
 198         tmp_iir = UART_IIR_CTI;
 199     } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR)) {
 200         if (!(s->fcr & UART_FCR_FE)) {
 201            tmp_iir = UART_IIR_RDI;
 202         } else if (s->recv_fifo.count >= s->recv_fifo.itl) {
 203            tmp_iir = UART_IIR_RDI;
 204         }
 205     } else if ((s->ier & UART_IER_THRI) && s->thr_ipending) {
 206         tmp_iir = UART_IIR_THRI;
 207     } else if ((s->ier & UART_IER_MSI) && (s->msr & UART_MSR_ANY_DELTA)) {
 208         tmp_iir = UART_IIR_MSI;
 209     }
 210
 211     s->iir = tmp_iir | (s->iir & 0xF0);
 212
 213     if (tmp_iir != UART_IIR_NO_INT) {
 214         qemu_irq_raise(s->irq);
 215     } else {
 216         qemu_irq_lower(s->irq);
 217     }
 218 }
 219
 220 static void serial_update_parameters(SerialState *s)
 221 {
 222     int speed, parity, data_bits, stop_bits, frame_size;
 223     QEMUSerialSetParams ssp;
 224
 225     if (s->divider == 0)
 226         return;
 227
 228     frame_size = 1;
 229     if (s->lcr & 0x08) {
 230         if (s->lcr & 0x10)
 231             parity = 'E';
 232         else
 233             parity = 'O';
 234     } else {
 235             parity = 'N';
 236             frame_size = 0;
 237     }
 238     if (s->lcr & 0x04)
 239         stop_bits = 2;
 240     else
 241         stop_bits = 1;
 242
 243     data_bits = (s->lcr & 0x03) + 5;
 244     frame_size += data_bits + stop_bits;
 245     speed = s->baudbase / s->divider;
 246     ssp.speed = speed;
 247     ssp.parity = parity;
 248     ssp.data_bits = data_bits;
 249     ssp.stop_bits = stop_bits;
 250     s->char_transmit_time =  (ticks_per_sec / speed) * frame_size;
 251     qemu_chr_ioctl(s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 252 #if 0
 253     printf("speed=%d parity=%c data=%d stop=%d\n",
 254            speed, parity, data_bits, stop_bits);
 255 #endif
 256 }
 257
 258 static void serial_update_msl(SerialState *s)
 259 {
 260     uint8_t omsr;
 261     int flags;
 262
 263     qemu_del_timer(s->modem_status_poll);
 264
 265     if (qemu_chr_ioctl(s->chr,CHR_IOCTL_SERIAL_GET_TIOCM, &flags) == -ENOTSUP) {
 266         s->poll_msl = -1;
 267         return;
 268     }
 269
 270     omsr = s->msr;
 271
 272     s->msr = (flags & CHR_TIOCM_CTS) ? s->msr | UART_MSR_CTS : s->msr & ~UART_MSR_CTS;
 273     s->msr = (flags & CHR_TIOCM_DSR) ? s->msr | UART_MSR_DSR : s->msr & ~UART_MSR_DSR;
 274     s->msr = (flags & CHR_TIOCM_CAR) ? s->msr | UART_MSR_DCD : s->msr & ~UART_MSR_DCD;
 275     s->msr = (flags & CHR_TIOCM_RI) ? s->msr | UART_MSR_RI : s->msr & ~UART_MSR_RI;
 276
 277     if (s->msr != omsr) {
 278          /* Set delta bits */
 279          s->msr = s->msr | ((s->msr >> 4) ^ (omsr >> 4));
 280          /* UART_MSR_TERI only if change was from 1 -> 0 */
 281          if ((s->msr & UART_MSR_TERI) && !(omsr & UART_MSR_RI))
 282              s->msr &= ~UART_MSR_TERI;
 283          serial_update_irq(s);
 284     }
 285
 286     /* The real 16550A apparently has a 250ns response latency to line status changes.
 287        We'll be lazy and poll only every 10ms, and only poll it at all if MSI interrupts are turned on */
 288
 289     if (s->poll_msl)
 290         qemu_mod_timer(s->modem_status_poll, qemu_get_clock(vm_clock) + ticks_per_sec / 100);
 291 }
 292
 293 static void serial_xmit(void *opaque)
 294 {
 295     SerialState *s = opaque;
 296     uint64_t new_xmit_ts = qemu_get_clock(vm_clock);
 297
 298     if (s->tsr_retry <= 0) {
 299         if (s->fcr & UART_FCR_FE) {
 300             s->tsr = fifo_get(s,XMIT_FIFO);
 301             if (!s->xmit_fifo.count)
 302                 s->lsr |= UART_LSR_THRE;
 303         } else {
 304             s->tsr = s->thr;
 305             s->lsr |= UART_LSR_THRE;
 306         }
 307     }
 308
 309     if (s->mcr & UART_MCR_LOOP) {
 310         /* in loopback mode, say that we just received a char */
 311         serial_receive1(s, &s->tsr, 1);
 312     } else if (qemu_chr_write(s->chr, &s->tsr, 1) != 1) {
 313         if ((s->tsr_retry > 0) && (s->tsr_retry <= MAX_XMIT_RETRY)) {
 314             s->tsr_retry++;
 315             qemu_mod_timer(s->transmit_timer,  new_xmit_ts + s->char_transmit_time);
 316             return;
 317         } else if (s->poll_msl < 0) {
 318             /* If we exceed MAX_XMIT_RETRY and the backend is not a real serial port, then
 319             drop any further failed writes instantly, until we get one that goes through.
 320             This is to prevent guests that log to unconnected pipes or pty's from stalling. */
 321             s->tsr_retry = -1;
 322         }
 323     }
 324     else {
 325         s->tsr_retry = 0;
 326     }
 327
 328     s->last_xmit_ts = qemu_get_clock(vm_clock);
 329     if (!(s->lsr & UART_LSR_THRE))
 330         qemu_mod_timer(s->transmit_timer, s->last_xmit_ts + s->char_transmit_time);
 331
 332     if (s->lsr & UART_LSR_THRE) {
 333         s->lsr |= UART_LSR_TEMT;
 334         s->thr_ipending = 1;
 335         serial_update_irq(s);
 336     }
 337 }
 338
 339
 340 static void serial_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 341 {
 342     SerialState *s = opaque;
 343
 344     addr &= 7;
 345 #ifdef DEBUG_SERIAL
 346     printf("serial: write addr=0x%02x val=0x%02x\n", addr, val);
 347 #endif
 348     switch(addr) {
 349     default:
 350     case 0:
 351         if (s->lcr & UART_LCR_DLAB) {
 352             s->divider = (s->divider & 0xff00) | val;
 353             serial_update_parameters(s);
 354         } else {
 355             s->thr = (uint8_t) val;
 356             if(s->fcr & UART_FCR_FE) {
 357                   fifo_put(s, XMIT_FIFO, s->thr);
 358             s->thr_ipending = 0;
 359                   s->lsr &= ~UART_LSR_TEMT;
 360             s->lsr &= ~UART_LSR_THRE;
 361             serial_update_irq(s);
 362             } else {
 363                   s->thr_ipending = 0;
 364                   s->lsr &= ~UART_LSR_THRE;
 365                   serial_update_irq(s);
 366             }
 367             serial_xmit(s);
 368         }
 369         break;
 370     case 1:
 371         if (s->lcr & UART_LCR_DLAB) {
 372             s->divider = (s->divider & 0x00ff) | (val << 8);
 373             serial_update_parameters(s);
 374         } else {
 375             s->ier = val & 0x0f;
 376             /* If the backend device is a real serial port, turn polling of the modem
 377                status lines on physical port on or off depending on UART_IER_MSI state */
 378             if (s->poll_msl >= 0) {
 379                 if (s->ier & UART_IER_MSI) {
 380                      s->poll_msl = 1;
 381                      serial_update_msl(s);
 382                 } else {
 383                      qemu_del_timer(s->modem_status_poll);
 384                      s->poll_msl = 0;
 385                 }
 386             }
 387             if (s->lsr & UART_LSR_THRE) {
 388                 s->thr_ipending = 1;
 389                 serial_update_irq(s);
 390             }
 391         }
 392         break;
 393     case 2:
 394         val = val & 0xFF;
 395
 396         if (s->fcr == val)
 397             break;
 398
 399         /* Did the enable/disable flag change? If so, make sure FIFOs get flushed */
 400         if ((val ^ s->fcr) & UART_FCR_FE)
 401             val |= UART_FCR_XFR | UART_FCR_RFR;
 402
 403         /* FIFO clear */
 404
 405         if (val & UART_FCR_RFR) {
 406             qemu_del_timer(s->fifo_timeout_timer);
 407             s->timeout_ipending=0;
 408             fifo_clear(s,RECV_FIFO);
 409         }
 410
 411         if (val & UART_FCR_XFR) {
 412             fifo_clear(s,XMIT_FIFO);
 413         }
 414
 415         if (val & UART_FCR_FE) {
 416             s->iir |= UART_IIR_FE;
 417             /* Set RECV_FIFO trigger Level */
 418             switch (val & 0xC0) {
 419             case UART_FCR_ITL_1:
 420                 s->recv_fifo.itl = 1;
 421                 break;
 422             case UART_FCR_ITL_2:
 423                 s->recv_fifo.itl = 4;
 424                 break;
 425             case UART_FCR_ITL_3:
 426                 s->recv_fifo.itl = 8;
 427                 break;
 428             case UART_FCR_ITL_4:
 429                 s->recv_fifo.itl = 14;
 430                 break;
 431             }
 432         } else
 433             s->iir &= ~UART_IIR_FE;
 434
 435         /* Set fcr - or at least the bits in it that are supposed to "stick" */
 436         s->fcr = val & 0xC9;
 437         serial_update_irq(s);
 438         break;
 439     case 3:
 440         {
 441             int break_enable;
 442             s->lcr = val;
 443             serial_update_parameters(s);
 444             break_enable = (val >> 6) & 1;
 445             if (break_enable != s->last_break_enable) {
 446                 s->last_break_enable = break_enable;
 447                 qemu_chr_ioctl(s->chr, CHR_IOCTL_SERIAL_SET_BREAK,
 448                                &break_enable);
 449             }
 450         }
 451         break;
 452     case 4:
 453         {
 454             int flags;
 455             int old_mcr = s->mcr;
 456             s->mcr = val & 0x1f;
 457             if (val & UART_MCR_LOOP)
 458                 break;
 459
 460             if (s->poll_msl >= 0 && old_mcr != s->mcr) {
 461
 462                 qemu_chr_ioctl(s->chr,CHR_IOCTL_SERIAL_GET_TIOCM, &flags);
 463
 464                 flags &= ~(CHR_TIOCM_RTS | CHR_TIOCM_DTR);
 465
 466                 if (val & UART_MCR_RTS)
 467                     flags |= CHR_TIOCM_RTS;
 468                 if (val & UART_MCR_DTR)
 469                     flags |= CHR_TIOCM_DTR;
 470
 471                 qemu_chr_ioctl(s->chr,CHR_IOCTL_SERIAL_SET_TIOCM, &flags);
 472                 /* Update the modem status after a one-character-send wait-time, since there may be a response
 473                    from the device/computer at the other end of the serial line */
 474                 qemu_mod_timer(s->modem_status_poll, qemu_get_clock(vm_clock) + s->char_transmit_time);
 475             }
 476         }
 477         break;
 478     case 5:
 479         break;
 480     case 6:
 481         break;
 482     case 7:
 483         s->scr = val;
 484         break;
 485     }
 486 }
 487
 488 static uint32_t serial_ioport_read(void *opaque, uint32_t addr)
 489 {
 490     SerialState *s = opaque;
 491     uint32_t ret;
 492
 493     addr &= 7;
 494     switch(addr) {
 495     default:
 496     case 0:
 497         if (s->lcr & UART_LCR_DLAB) {
 498             ret = s->divider & 0xff;
 499         } else {
 500             if(s->fcr & UART_FCR_FE) {
 501                 ret = fifo_get(s,RECV_FIFO);
 502                 if (s->recv_fifo.count == 0)
 503                     s->lsr &= ~(UART_LSR_DR | UART_LSR_BI);
 504                 else
 505                     qemu_mod_timer(s->fifo_timeout_timer, qemu_get_clock (vm_clock) + s->char_transmit_time * 4);
 506                 s->timeout_ipending = 0;
 507             } else {
 508                 ret = s->rbr;
 509                 s->lsr &= ~(UART_LSR_DR | UART_LSR_BI);
 510             }
 511             serial_update_irq(s);
 512             if (!(s->mcr & UART_MCR_LOOP)) {
 513                 /* in loopback mode, don't receive any data */
 514                 qemu_chr_accept_input(s->chr);
 515             }
 516         }
 517         break;
 518     case 1:
 519         if (s->lcr & UART_LCR_DLAB) {
 520             ret = (s->divider >> 8) & 0xff;
 521         } else {
 522             ret = s->ier;
 523         }
 524         break;
 525     case 2:
 526         ret = s->iir;
 527             s->thr_ipending = 0;
 528         serial_update_irq(s);
 529         break;
 530     case 3:
 531         ret = s->lcr;
 532         break;
 533     case 4:
 534         ret = s->mcr;
 535         break;
 536     case 5:
 537         ret = s->lsr;
 538         /* Clear break interrupt */
 539         if (s->lsr & UART_LSR_BI) {
 540             s->lsr &= ~UART_LSR_BI;
 541             serial_update_irq(s);
 542         }
 543         break;
 544     case 6:
 545         if (s->mcr & UART_MCR_LOOP) {
 546             /* in loopback, the modem output pins are connected to the
 547                inputs */
 548             ret = (s->mcr & 0x0c) << 4;
 549             ret |= (s->mcr & 0x02) << 3;
 550             ret |= (s->mcr & 0x01) << 5;
 551         } else {
 552             if (s->poll_msl >= 0)
 553                 serial_update_msl(s);
 554             ret = s->msr;
 555             /* Clear delta bits & msr int after read, if they were set */
 556             if (s->msr & UART_MSR_ANY_DELTA) {
 557                 s->msr &= 0xF0;
 558                 serial_update_irq(s);
 559             }
 560         }
 561         break;
 562     case 7:
 563         ret = s->scr;
 564         break;
 565     }
 566 #ifdef DEBUG_SERIAL
 567     printf("serial: read addr=0x%02x val=0x%02x\n", addr, ret);
 568 #endif
 569     return ret;
 570 }
 571
 572 static int serial_can_receive(SerialState *s)
 573 {
 574     if(s->fcr & UART_FCR_FE) {
 575         if(s->recv_fifo.count < UART_FIFO_LENGTH)
 576         /* Advertise (fifo.itl - fifo.count) bytes when count < ITL, and 1 if above. If UART_FIFO_LENGTH - fifo.count is
 577         advertised the effect will be to almost always fill the fifo completely before the guest has a chance to respond,
 578         effectively overriding the ITL that the guest has set. */
 579              return (s->recv_fifo.count <= s->recv_fifo.itl) ? s->recv_fifo.itl - s->recv_fifo.count : 1;
 580         else
 581              return 0;
 582     } else {
 583     return !(s->lsr & UART_LSR_DR);
 584     }
 585 }
 586
 587 static void serial_receive_break(SerialState *s)
 588 {
 589     s->rbr = 0;
 590     s->lsr |= UART_LSR_BI | UART_LSR_DR;
 591     serial_update_irq(s);
 592 }
 593
 594 /* There's data in recv_fifo and s->rbr has not been read for 4 char transmit times */
 595 static void fifo_timeout_int (void *opaque) {
 596     SerialState *s = opaque;
 597     if (s->recv_fifo.count) {
 598         s->timeout_ipending = 1;
 599         serial_update_irq(s);
 600     }
 601 }
 602
 603 static int serial_can_receive1(void *opaque)
 604 {
 605     SerialState *s = opaque;
 606     return serial_can_receive(s);
 607 }
 608
 609 static void serial_receive1(void *opaque, const uint8_t *buf, int size)
 610 {
 611     SerialState *s = opaque;
 612     if(s->fcr & UART_FCR_FE) {
 613         int i;
 614         for (i = 0; i < size; i++) {
 615             fifo_put(s, RECV_FIFO, buf[i]);
 616         }
 617         s->lsr |= UART_LSR_DR;
 618         /* call the timeout receive callback in 4 char transmit time */
 619         qemu_mod_timer(s->fifo_timeout_timer, qemu_get_clock (vm_clock) + s->char_transmit_time * 4);
 620     } else {
 621         s->rbr = buf[0];
 622         s->lsr |= UART_LSR_DR;
 623     }
 624     serial_update_irq(s);
 625 }
 626
 627 static void serial_event(void *opaque, int event)
 628 {
 629     SerialState *s = opaque;
 630 #ifdef DEBUG_SERIAL
 631     printf("serial: event %x\n", event);
 632 #endif
 633     if (event == CHR_EVENT_BREAK)
 634         serial_receive_break(s);
 635 }
 636
 637 static void serial_save(QEMUFile *f, void *opaque)
 638 {
 639     SerialState *s = opaque;
 640
 641     qemu_put_be16s(f,&s->divider);
 642     qemu_put_8s(f,&s->rbr);
 643     qemu_put_8s(f,&s->ier);
 644     qemu_put_8s(f,&s->iir);
 645     qemu_put_8s(f,&s->lcr);
 646     qemu_put_8s(f,&s->mcr);
 647     qemu_put_8s(f,&s->lsr);
 648     qemu_put_8s(f,&s->msr);
 649     qemu_put_8s(f,&s->scr);
 650     qemu_put_8s(f,&s->fcr);
 651 }
 652
 653 static int serial_load(QEMUFile *f, void *opaque, int version_id)
 654 {
 655     SerialState *s = opaque;
 656     uint8_t fcr = 0;
 657
 658     if(version_id > 3)
 659         return -EINVAL;
 660
 661     if (version_id >= 2)
 662         qemu_get_be16s(f, &s->divider);
 663     else
 664         s->divider = qemu_get_byte(f);
 665     qemu_get_8s(f,&s->rbr);
 666     qemu_get_8s(f,&s->ier);
 667     qemu_get_8s(f,&s->iir);
 668     qemu_get_8s(f,&s->lcr);
 669     qemu_get_8s(f,&s->mcr);
 670     qemu_get_8s(f,&s->lsr);
 671     qemu_get_8s(f,&s->msr);
 672     qemu_get_8s(f,&s->scr);
 673
 674     if (version_id >= 3)
 675         qemu_get_8s(f,&fcr);
 676
 677     /* Initialize fcr via setter to perform essential side-effects */
 678     serial_ioport_write(s, 0x02, fcr);
 679     return 0;
 680 }
 681
 682 static void serial_reset(void *opaque)
 683 {
 684     SerialState *s = opaque;
 685
 686     s->rbr = 0;
 687     s->ier = 0;
 688     s->iir = UART_IIR_NO_INT;
 689     s->lcr = 0;
 690     s->lsr = UART_LSR_TEMT | UART_LSR_THRE;
 691     s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;
 692     /* Default to 9600 baud, no parity, one stop bit */
 693     s->divider = 0x0C;
 694     s->mcr = UART_MCR_OUT2;
 695     s->scr = 0;
 696     s->tsr_retry = 0;
 697     s->char_transmit_time = (ticks_per_sec / 9600) * 9;
 698     s->poll_msl = 0;
 699
 700     fifo_clear(s,RECV_FIFO);
 701     fifo_clear(s,XMIT_FIFO);
 702
 703     s->last_xmit_ts = qemu_get_clock(vm_clock);
 704
 705     s->thr_ipending = 0;
 706     s->last_break_enable = 0;
 707     qemu_irq_lower(s->irq);
 708 }
 709
 710 static void serial_init_core(SerialState *s, qemu_irq irq, int baudbase,
 711                              CharDriverState *chr)
 712 {
 713     s->irq = irq;
 714     s->baudbase = baudbase;
 715     s->chr = chr;
 716
 717     s->modem_status_poll = qemu_new_timer(vm_clock, (QEMUTimerCB *) serial_update_msl, s);
 718
 719     s->fifo_timeout_timer = qemu_new_timer(vm_clock, (QEMUTimerCB *) fifo_timeout_int, s);
 720     s->transmit_timer = qemu_new_timer(vm_clock, (QEMUTimerCB *) serial_xmit, s);
 721
 722     qemu_register_reset(serial_reset, s);
 723     serial_reset(s);
 724
 725 }
 726
 727 /* If fd is zero, it means that the serial device uses the console */
 728 SerialState *serial_init(int base, qemu_irq irq, int baudbase,
 729                          CharDriverState *chr)
 730 {
 731     SerialState *s;
 732
 733     s = qemu_mallocz(sizeof(SerialState));
 734     if (!s)
 735         return NULL;
 736
 737     serial_init_core(s, irq, baudbase, chr);
 738
 739     register_savevm("serial", base, 3, serial_save, serial_load, s);
 740
 741     register_ioport_write(base, 8, 1, serial_ioport_write, s);
 742     register_ioport_read(base, 8, 1, serial_ioport_read, s);
 743     qemu_chr_add_handlers(chr, serial_can_receive1, serial_receive1,
 744                           serial_event, s);
 745     return s;
 746 }
 747
 748 /* Memory mapped interface */
 749 uint32_t serial_mm_readb (void *opaque, target_phys_addr_t addr)
 750 {
 751     SerialState *s = opaque;
 752
 753     return serial_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFF;
 754 }
 755
 756 void serial_mm_writeb (void *opaque,
 757                        target_phys_addr_t addr, uint32_t value)
 758 {
 759     SerialState *s = opaque;
 760
 761     serial_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFF);
 762 }
 763
 764 uint32_t serial_mm_readw (void *opaque, target_phys_addr_t addr)
 765 {
 766     SerialState *s = opaque;
 767     uint32_t val;
 768
 769     val = serial_ioport_read(s, (addr - s->base) >> s->it_shift) & 0xFFFF;
 770 #ifdef TARGET_WORDS_BIGENDIAN
 771     val = bswap16(val);
 772 #endif
 773     return val;
 774 }
 775
 776 void serial_mm_writew (void *opaque,
 777                        target_phys_addr_t addr, uint32_t value)
 778 {
 779     SerialState *s = opaque;
 780 #ifdef TARGET_WORDS_BIGENDIAN
 781     value = bswap16(value);
 782 #endif
 783     serial_ioport_write(s, (addr - s->base) >> s->it_shift, value & 0xFFFF);
 784 }
 785
 786 uint32_t serial_mm_readl (void *opaque, target_phys_addr_t addr)
 787 {
 788     SerialState *s = opaque;
 789     uint32_t val;
 790
 791     val = serial_ioport_read(s, (addr - s->base) >> s->it_shift);
 792 #ifdef TARGET_WORDS_BIGENDIAN
 793     val = bswap32(val);
 794 #endif
 795     return val;
 796 }
 797
 798 void serial_mm_writel (void *opaque,
 799                        target_phys_addr_t addr, uint32_t value)
 800 {
 801     SerialState *s = opaque;
 802 #ifdef TARGET_WORDS_BIGENDIAN
 803     value = bswap32(value);
 804 #endif
 805     serial_ioport_write(s, (addr - s->base) >> s->it_shift, value);
 806 }
 807
 808 static CPUReadMemoryFunc *serial_mm_read[] = {
 809     &serial_mm_readb,
 810     &serial_mm_readw,
 811     &serial_mm_readl,
 812 };
 813
 814 static CPUWriteMemoryFunc *serial_mm_write[] = {
 815     &serial_mm_writeb,
 816     &serial_mm_writew,
 817     &serial_mm_writel,
 818 };
 819
 820 SerialState *serial_mm_init (target_phys_addr_t base, int it_shift,
 821                              qemu_irq irq, int baudbase,
 822                              CharDriverState *chr, int ioregister)
 823 {
 824     SerialState *s;
 825     int s_io_memory;
 826
 827     s = qemu_mallocz(sizeof(SerialState));
 828     if (!s)
 829         return NULL;
 830
 831     s->base = base;
 832     s->it_shift = it_shift;
 833
 834     serial_init_core(s, irq, baudbase, chr);
 835     register_savevm("serial", base, 3, serial_save, serial_load, s);
 836
 837     if (ioregister) {
 838         s_io_memory = cpu_register_io_memory(0, serial_mm_read,
 839                                              serial_mm_write, s);
 840         cpu_register_physical_memory(base, 8 << it_shift, s_io_memory);
 841     }
 842     qemu_chr_add_handlers(chr, serial_can_receive1, serial_receive1,
 843                           serial_event, s);
 844     serial_update_msl(s);
 845     return s;
 846 }