Stand-alone SCI/SCIF emulation code, by Magnus Damm.

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3270 c046a42c-6fe2-441c-8c8c-71466251a162

6 files changed, 325 insertions, 585 deletions

diff --git a/Makefile.target b/Makefile.target
index fd44a81..0f190cf 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -476,7 +476,7 @@ CPPFLAGS += -DHAS_AUDIO
 endif
 ifeq ($(TARGET_BASE_ARCH), sh4)
 VL_OBJS+= shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
-VL_OBJS+= sh_timer.o ptimer.o
+VL_OBJS+= sh_timer.o ptimer.o sh_serial.o
 endif
 ifeq ($(TARGET_BASE_ARCH), m68k)
 VL_OBJS+= an5206.o mcf5206.o ptimer.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
diff --git a/hw/sh7750.c b/hw/sh7750.c
index 9002da3..1028c5c 100644
--- a/hw/sh7750.c
+++ b/hw/sh7750.c
@@ -27,13 +27,6 @@
 #include "sh7750_regs.h"
 #include "sh7750_regnames.h"
 
-typedef struct {
-    uint8_t data[16];
-    uint8_t length;		/* Number of characters in the FIFO */
-    uint8_t write_idx;		/* Index of first character to write */
-    uint8_t read_idx;		/* Index of first character to read */
-} fifo;
-
 #define NB_DEVICES 4
 
 typedef struct SH7750State {
@@ -43,27 +36,6 @@ typedef struct SH7750State {
     uint32_t periph_freq;
     /* SDRAM controller */
     uint16_t rfcr;
-    /* First serial port */
-    CharDriverState *serial1;
-    uint8_t scscr1;
-    uint8_t scsmr1;
-    uint8_t scbrr1;
-    uint8_t scssr1;
-    uint8_t scssr1_read;
-    uint8_t sctsr1;
-    uint8_t sctsr1_loaded;
-    uint8_t sctdr1;
-    uint8_t scrdr1;
-    /* Second serial port */
-    CharDriverState *serial2;
-    uint16_t sclsr2;
-    uint16_t scscr2;
-    uint16_t scfcr2;
-    uint16_t scfsr2;
-    uint16_t scsmr2;
-    uint8_t scbrr2;
-    fifo serial2_receive_fifo;
-    fifo serial2_transmit_fifo;
     /* IO ports */
     uint16_t gpioic;
     uint32_t pctra;
@@ -84,263 +56,6 @@ typedef struct SH7750State {
 
 } SH7750State;
 
-/**********************************************************************
- First serial port
-**********************************************************************/
-
-static int serial1_can_receive(void *opaque)
-{
-    SH7750State *s = opaque;
-
-    return s->scscr1 & SH7750_SCSCR_RE;
-}
-
-static void serial1_receive_char(SH7750State * s, uint8_t c)
-{
-    if (s->scssr1 & SH7750_SCSSR1_RDRF) {
-	s->scssr1 |= SH7750_SCSSR1_ORER;
-	return;
-    }
-
-    s->scrdr1 = c;
-    s->scssr1 |= SH7750_SCSSR1_RDRF;
-}
-
-static void serial1_receive(void *opaque, const uint8_t * buf, int size)
-{
-    SH7750State *s = opaque;
-    int i;
-
-    for (i = 0; i < size; i++) {
-	serial1_receive_char(s, buf[i]);
-    }
-}
-
-static void serial1_event(void *opaque, int event)
-{
-    assert(0);
-}
-
-static void serial1_maybe_send(SH7750State * s)
-{
-    uint8_t c;
-
-    if (s->scssr1 & SH7750_SCSSR1_TDRE)
-	return;
-    c = s->sctdr1;
-    s->scssr1 |= SH7750_SCSSR1_TDRE | SH7750_SCSSR1_TEND;
-    if (s->scscr1 & SH7750_SCSCR_TIE) {
-	fprintf(stderr, "interrupts for serial port 1 not implemented\n");
-	assert(0);
-    }
-    /* XXXXX Check for errors in write */
-    qemu_chr_write(s->serial1, &c, 1);
-}
-
-static void serial1_change_scssr1(SH7750State * s, uint8_t mem_value)
-{
-    uint8_t new_flags;
-
-    /* If transmit disable, TDRE and TEND stays up */
-    if ((s->scscr1 & SH7750_SCSCR_TE) == 0) {
-	mem_value |= SH7750_SCSSR1_TDRE | SH7750_SCSSR1_TEND;
-    }
-
-    /* Only clear bits which have been read before and do not set any bit
-       in the flags */
-    new_flags = s->scssr1 & ~s->scssr1_read;	/* Preserve unread flags */
-    new_flags &= mem_value | ~s->scssr1_read;	/* Clear read flags */
-
-    s->scssr1 = (new_flags & 0xf8) | (mem_value & 1);
-    s->scssr1_read &= mem_value;
-
-    /* If TDRE has been cleared, TEND will also be cleared */
-    if ((s->scssr1 & SH7750_SCSSR1_TDRE) == 0) {
-	s->scssr1 &= ~SH7750_SCSSR1_TEND;
-    }
-
-    /* Check for transmission to start */
-    serial1_maybe_send(s);
-}
-
-static void serial1_update_parameters(SH7750State * s)
-{
-    QEMUSerialSetParams ssp;
-
-    if (s->scsmr1 & SH7750_SCSMR_CHR_7)
-	ssp.data_bits = 7;
-    else
-	ssp.data_bits = 8;
-    if (s->scsmr1 & SH7750_SCSMR_PE) {
-	if (s->scsmr1 & SH7750_SCSMR_PM_ODD)
-	    ssp.parity = 'O';
-	else
-	    ssp.parity = 'E';
-    } else
-	ssp.parity = 'N';
-    if (s->scsmr1 & SH7750_SCSMR_STOP_2)
-	ssp.stop_bits = 2;
-    else
-	ssp.stop_bits = 1;
-    fprintf(stderr, "SCSMR1=%04x SCBRR1=%02x\n", s->scsmr1, s->scbrr1);
-    ssp.speed = s->periph_freq /
-	(32 * s->scbrr1 * (1 << (2 * (s->scsmr1 & 3)))) - 1;
-    fprintf(stderr, "data bits=%d, stop bits=%d, parity=%c, speed=%d\n",
-	    ssp.data_bits, ssp.stop_bits, ssp.parity, ssp.speed);
-    qemu_chr_ioctl(s->serial1, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
-}
-
-static void scscr1_changed(SH7750State * s)
-{
-    if (s->scscr1 & (SH7750_SCSCR_TE | SH7750_SCSCR_RE)) {
-	if (!s->serial1) {
-	    fprintf(stderr, "serial port 1 not bound to anything\n");
-	    assert(0);
-	}
-	serial1_update_parameters(s);
-    }
-    if ((s->scscr1 & SH7750_SCSCR_RE) == 0) {
-	s->scssr1 |= SH7750_SCSSR1_TDRE;
-    }
-}
-
-static void init_serial1(SH7750State * s, int serial_nb)
-{
-    CharDriverState *chr;
-
-    s->scssr1 = 0x84;
-    chr = serial_hds[serial_nb];
-    if (!chr) {
-	fprintf(stderr,
-		"no serial port associated to SH7750 first serial port\n");
-	return;
-    }
-
-    s->serial1 = chr;
-    qemu_chr_add_handlers(chr, serial1_can_receive,
-			  serial1_receive, serial1_event, s);
-}
-
-/**********************************************************************
- Second serial port
-**********************************************************************/
-
-static int serial2_can_receive(void *opaque)
-{
-    SH7750State *s = opaque;
-    static uint8_t max_fifo_size[] = { 15, 1, 4, 6, 8, 10, 12, 14 };
-
-    return s->serial2_receive_fifo.length <
-	max_fifo_size[(s->scfcr2 >> 9) & 7];
-}
-
-static void serial2_adjust_receive_flags(SH7750State * s)
-{
-    static uint8_t max_fifo_size[] = { 1, 4, 8, 14 };
-
-    /* XXXXX Add interrupt generation */
-    if (s->serial2_receive_fifo.length >=
-	max_fifo_size[(s->scfcr2 >> 7) & 3]) {
-	s->scfsr2 |= SH7750_SCFSR2_RDF;
-	s->scfsr2 &= ~SH7750_SCFSR2_DR;
-    } else {
-	s->scfsr2 &= ~SH7750_SCFSR2_RDF;
-	if (s->serial2_receive_fifo.length > 0)
-	    s->scfsr2 |= SH7750_SCFSR2_DR;
-	else
-	    s->scfsr2 &= ~SH7750_SCFSR2_DR;
-    }
-}
-
-static void serial2_append_char(SH7750State * s, uint8_t c)
-{
-    if (s->serial2_receive_fifo.length == 16) {
-	/* Overflow */
-	s->sclsr2 |= SH7750_SCLSR2_ORER;
-	return;
-    }
-
-    s->serial2_receive_fifo.data[s->serial2_receive_fifo.write_idx++] = c;
-    s->serial2_receive_fifo.length++;
-    serial2_adjust_receive_flags(s);
-}
-
-static void serial2_receive(void *opaque, const uint8_t * buf, int size)
-{
-    SH7750State *s = opaque;
-    int i;
-
-    for (i = 0; i < size; i++)
-	serial2_append_char(s, buf[i]);
-}
-
-static void serial2_event(void *opaque, int event)
-{
-    /* XXXXX */
-    assert(0);
-}
-
-static void serial2_update_parameters(SH7750State * s)
-{
-    QEMUSerialSetParams ssp;
-
-    if (s->scsmr2 & SH7750_SCSMR_CHR_7)
-	ssp.data_bits = 7;
-    else
-	ssp.data_bits = 8;
-    if (s->scsmr2 & SH7750_SCSMR_PE) {
-	if (s->scsmr2 & SH7750_SCSMR_PM_ODD)
-	    ssp.parity = 'O';
-	else
-	    ssp.parity = 'E';
-    } else
-	ssp.parity = 'N';
-    if (s->scsmr2 & SH7750_SCSMR_STOP_2)
-	ssp.stop_bits = 2;
-    else
-	ssp.stop_bits = 1;
-    fprintf(stderr, "SCSMR2=%04x SCBRR2=%02x\n", s->scsmr2, s->scbrr2);
-    ssp.speed = s->periph_freq /
-	(32 * s->scbrr2 * (1 << (2 * (s->scsmr2 & 3)))) - 1;
-    fprintf(stderr, "data bits=%d, stop bits=%d, parity=%c, speed=%d\n",
-	    ssp.data_bits, ssp.stop_bits, ssp.parity, ssp.speed);
-    qemu_chr_ioctl(s->serial2, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
-}
-
-static void scscr2_changed(SH7750State * s)
-{
-    if (s->scscr2 & (SH7750_SCSCR_TE | SH7750_SCSCR_RE)) {
-	if (!s->serial2) {
-	    fprintf(stderr, "serial port 2 not bound to anything\n");
-	    assert(0);
-	}
-	serial2_update_parameters(s);
-    }
-}
-
-static void init_serial2(SH7750State * s, int serial_nb)
-{
-    CharDriverState *chr;
-
-    s->scfsr2 = 0x0060;
-
-    chr = serial_hds[serial_nb];
-    if (!chr) {
-	fprintf(stderr,
-		"no serial port associated to SH7750 second serial port\n");
-	return;
-    }
-
-    s->serial2 = chr;
-    qemu_chr_add_handlers(chr, serial2_can_receive,
-			  serial2_receive, serial1_event, s);
-}
-
-static void init_serial_ports(SH7750State * s)
-{
-    init_serial1(s, 0);
-    init_serial2(s, 1);
-}
 
 /**********************************************************************
  I/O ports
@@ -472,17 +187,7 @@ static void ignore_access(const char *kind, target_phys_addr_t addr)
 
 static uint32_t sh7750_mem_readb(void *opaque, target_phys_addr_t addr)
 {
-    SH7750State *s = opaque;
-    uint8_t r;
-
     switch (addr) {
-    case SH7750_SCSSR1_A7:
-	r = s->scssr1;
-	s->scssr1_read |= r;
-	return s->scssr1;
-    case SH7750_SCRDR1_A7:
-	s->scssr1 &= ~SH7750_SCSSR1_RDRF;
-	return s->scrdr1;
     default:
 	error_access("byte read", addr);
 	assert(0);
@@ -492,20 +197,12 @@ static uint32_t sh7750_mem_readb(void *opaque, target_phys_addr_t addr)
 static uint32_t sh7750_mem_readw(void *opaque, target_phys_addr_t addr)
 {
     SH7750State *s = opaque;
-    uint16_t r;
 
     switch (addr) {
     case SH7750_RFCR_A7:
 	fprintf(stderr,
 		"Read access to refresh count register, incrementing\n");
 	return s->rfcr++;
-    case SH7750_SCLSR2_A7:
-	/* Read and clear overflow bit */
-	r = s->sclsr2;
-	s->sclsr2 = 0;
-	return r;
-    case SH7750_SCSFR2_A7:
-	return s->scfsr2;
     case SH7750_PDTRA_A7:
 	return porta_lines(s);
     case SH7750_PDTRB_A7:
@@ -554,34 +251,12 @@ static uint32_t sh7750_mem_readl(void *opaque, target_phys_addr_t addr)
 static void sh7750_mem_writeb(void *opaque, target_phys_addr_t addr,
 			      uint32_t mem_value)
 {
-    SH7750State *s = opaque;
-
     switch (addr) {
 	/* PRECHARGE ? XXXXX */
     case SH7750_PRECHARGE0_A7:
     case SH7750_PRECHARGE1_A7:
 	ignore_access("byte write", addr);
 	return;
-    case SH7750_SCBRR2_A7:
-	s->scbrr2 = mem_value;
-	return;
-    case SH7750_SCSCR1_A7:
-	s->scscr1 = mem_value;
-	scscr1_changed(s);
-	return;
-    case SH7750_SCSMR1_A7:
-	s->scsmr1 = mem_value;
-	return;
-    case SH7750_SCBRR1_A7:
-	s->scbrr1 = mem_value;
-	return;
-    case SH7750_SCTDR1_A7:
-	s->scssr1 &= ~SH7750_SCSSR1_TEND;
-	s->sctdr1 = mem_value;
-	return;
-    case SH7750_SCSSR1_A7:
-	serial1_change_scssr1(s, mem_value);
-	return;
     default:
 	error_access("byte write", addr);
 	assert(0);
@@ -596,8 +271,6 @@ static void sh7750_mem_writew(void *opaque, target_phys_addr_t addr,
 
     switch (addr) {
 	/* SDRAM controller */
-    case SH7750_SCBRR1_A7:
-    case SH7750_SCBRR2_A7:
     case SH7750_BCR2_A7:
     case SH7750_BCR3_A7:
     case SH7750_RTCOR_A7:
@@ -620,19 +293,6 @@ static void sh7750_mem_writew(void *opaque, target_phys_addr_t addr,
 	fprintf(stderr, "Write access to refresh count register\n");
 	s->rfcr = mem_value;
 	return;
-    case SH7750_SCLSR2_A7:
-	s->sclsr2 = mem_value;
-	return;
-    case SH7750_SCSCR2_A7:
-	s->scscr2 = mem_value;
-	scscr2_changed(s);
-	return;
-    case SH7750_SCFCR2_A7:
-	s->scfcr2 = mem_value;
-	return;
-    case SH7750_SCSMR2_A7:
-	s->scsmr2 = mem_value;
-	return;
     case SH7750_GPIOIC_A7:
 	s->gpioic = mem_value;
 	if (mem_value != 0) {
@@ -734,7 +394,10 @@ SH7750State *sh7750_init(CPUSH4State * cpu)
 					      sh7750_mem_read,
 					      sh7750_mem_write, s);
     cpu_register_physical_memory(0x1c000000, 0x04000000, sh7750_io_memory);
-    init_serial_ports(s);
+
+    sh_serial_init(0x1fe00000, 0, s->periph_freq, serial_hds[0]);
+    sh_serial_init(0x1fe80000, SH_SERIAL_FEAT_SCIF,
+		   s->periph_freq, serial_hds[1]);
 
     tmu012_init(0x1fd80000,
 		TMU012_FEAT_TOCR | TMU012_FEAT_3CHAN | TMU012_FEAT_EXTCLK,
diff --git a/hw/sh7750_regnames.c b/hw/sh7750_regnames.c
index 6ae4917..84d5c1a 100644
--- a/hw/sh7750_regnames.c
+++ b/hw/sh7750_regnames.c
@@ -70,24 +70,6 @@ static regname_t regnames[] = {
 	REGNAME(SH7750_CHCR2_A7)
 	REGNAME(SH7750_CHCR3_A7)
 	REGNAME(SH7750_DMAOR_A7)
-	REGNAME(SH7750_SCRDR1_A7)
-	REGNAME(SH7750_SCRDR2_A7)
-	REGNAME(SH7750_SCTDR1_A7)
-	REGNAME(SH7750_SCTDR2_A7)
-	REGNAME(SH7750_SCSMR1_A7)
-	REGNAME(SH7750_SCSMR2_A7)
-	REGNAME(SH7750_SCSCR1_A7)
-	REGNAME(SH7750_SCSCR2_A7)
-	REGNAME(SH7750_SCSSR1_A7)
-	REGNAME(SH7750_SCSFR2_A7)
-	REGNAME(SH7750_SCSPTR1_A7)
-	REGNAME(SH7750_SCSPTR2_A7)
-	REGNAME(SH7750_SCBRR1_A7)
-	REGNAME(SH7750_SCBRR2_A7)
-	REGNAME(SH7750_SCFCR2_A7)
-	REGNAME(SH7750_SCFDR2_A7)
-	REGNAME(SH7750_SCLSR2_A7)
-	REGNAME(SH7750_SCSCMR1_A7)
 	REGNAME(SH7750_PCTRA_A7)
 	REGNAME(SH7750_PDTRA_A7)
 	REGNAME(SH7750_PCTRB_A7)
diff --git a/hw/sh7750_regs.h b/hw/sh7750_regs.h
index 85eab43..15b2769 100644
--- a/hw/sh7750_regs.h
+++ b/hw/sh7750_regs.h
@@ -1169,231 +1169,6 @@
 #define SH7750_DMAOR_DME      0x00000001	/* DMAC Master Enable */
 
 /*
- * Serial Communication Interface - SCI
- * Serial Communication Interface with FIFO - SCIF
- */
-/* SCI Receive Data Register (byte, read-only) - SCRDR1, SCFRDR2 */
-#define SH7750_SCRDR_REGOFS(n) ((n) == 1 ? 0xE00014 : 0xE80014)	/* offset */
-#define SH7750_SCRDR(n)       SH7750_P4_REG32(SH7750_SCRDR_REGOFS(n))
-#define SH7750_SCRDR1         SH7750_SCRDR(1)
-#define SH7750_SCRDR2         SH7750_SCRDR(2)
-#define SH7750_SCRDR_A7(n)    SH7750_A7_REG32(SH7750_SCRDR_REGOFS(n))
-#define SH7750_SCRDR1_A7      SH7750_SCRDR_A7(1)
-#define SH7750_SCRDR2_A7      SH7750_SCRDR_A7(2)
-
-/* SCI Transmit Data Register (byte) - SCTDR1, SCFTDR2 */
-#define SH7750_SCTDR_REGOFS(n) ((n) == 1 ? 0xE0000C : 0xE8000C)	/* offset */
-#define SH7750_SCTDR(n)       SH7750_P4_REG32(SH7750_SCTDR_REGOFS(n))
-#define SH7750_SCTDR1         SH7750_SCTDR(1)
-#define SH7750_SCTDR2         SH7750_SCTDR(2)
-#define SH7750_SCTDR_A7(n)    SH7750_A7_REG32(SH7750_SCTDR_REGOFS(n))
-#define SH7750_SCTDR1_A7      SH7750_SCTDR_A7(1)
-#define SH7750_SCTDR2_A7      SH7750_SCTDR_A7(2)
-
-/* SCI Serial Mode Register - SCSMR1(byte), SCSMR2(half) */
-#define SH7750_SCSMR_REGOFS(n) ((n) == 1 ? 0xE00000 : 0xE80000)	/* offset */
-#define SH7750_SCSMR(n)       SH7750_P4_REG32(SH7750_SCSMR_REGOFS(n))
-#define SH7750_SCSMR1         SH7750_SCSMR(1)
-#define SH7750_SCSMR2         SH7750_SCSMR(2)
-#define SH7750_SCSMR_A7(n)    SH7750_A7_REG32(SH7750_SCSMR_REGOFS(n))
-#define SH7750_SCSMR1_A7      SH7750_SCSMR_A7(1)
-#define SH7750_SCSMR2_A7      SH7750_SCSMR_A7(2)
-
-#define SH7750_SCSMR1_CA       0x80	/* Communication Mode (C/A\): */
-#define SH7750_SCSMR1_CA_ASYNC 0x00	/*     Asynchronous Mode */
-#define SH7750_SCSMR1_CA_SYNC  0x80	/*     Synchronous Mode */
-#define SH7750_SCSMR_CHR       0x40	/* Character Length: */
-#define SH7750_SCSMR_CHR_8     0x00	/*     8-bit data */
-#define SH7750_SCSMR_CHR_7     0x40	/*     7-bit data */
-#define SH7750_SCSMR_PE        0x20	/* Parity Enable */
-#define SH7750_SCSMR_PM        0x10	/* Parity Mode: */
-#define SH7750_SCSMR_PM_EVEN   0x00	/*     Even Parity */
-#define SH7750_SCSMR_PM_ODD    0x10	/*     Odd Parity */
-#define SH7750_SCSMR_STOP      0x08	/* Stop Bit Length: */
-#define SH7750_SCSMR_STOP_1    0x00	/*     1 stop bit */
-#define SH7750_SCSMR_STOP_2    0x08	/*     2 stop bit */
-#define SH7750_SCSMR1_MP       0x04	/* Multiprocessor Mode */
-#define SH7750_SCSMR_CKS       0x03	/* Clock Select */
-#define SH7750_SCSMR_CKS_S     0
-#define SH7750_SCSMR_CKS_DIV1  0x00	/*     Periph clock */
-#define SH7750_SCSMR_CKS_DIV4  0x01	/*     Periph clock / 4 */
-#define SH7750_SCSMR_CKS_DIV16 0x02	/*     Periph clock / 16 */
-#define SH7750_SCSMR_CKS_DIV64 0x03	/*     Periph clock / 64 */
-
-/* SCI Serial Control Register - SCSCR1(byte), SCSCR2(half) */
-#define SH7750_SCSCR_REGOFS(n) ((n) == 1 ? 0xE00008 : 0xE80008)	/* offset */
-#define SH7750_SCSCR(n)       SH7750_P4_REG32(SH7750_SCSCR_REGOFS(n))
-#define SH7750_SCSCR1         SH7750_SCSCR(1)
-#define SH7750_SCSCR2         SH7750_SCSCR(2)
-#define SH7750_SCSCR_A7(n)    SH7750_A7_REG32(SH7750_SCSCR_REGOFS(n))
-#define SH7750_SCSCR1_A7      SH7750_SCSCR_A7(1)
-#define SH7750_SCSCR2_A7      SH7750_SCSCR_A7(2)
-
-#define SH7750_SCSCR_TIE      0x80	/* Transmit Interrupt Enable */
-#define SH7750_SCSCR_RIE      0x40	/* Receive Interrupt Enable */
-#define SH7750_SCSCR_TE       0x20	/* Transmit Enable */
-#define SH7750_SCSCR_RE       0x10	/* Receive Enable */
-#define SH7750_SCSCR1_MPIE    0x08	/* Multiprocessor Interrupt Enable */
-#define SH7750_SCSCR2_REIE    0x08	/* Receive Error Interrupt Enable */
-#define SH7750_SCSCR1_TEIE    0x04	/* Transmit End Interrupt Enable */
-#define SH7750_SCSCR1_CKE     0x03	/* Clock Enable: */
-#define SH7750_SCSCR_CKE_INTCLK            0x00	/* Use Internal Clock */
-#define SH7750_SCSCR_CKE_EXTCLK            0x02	/* Use External Clock from SCK */
-#define SH7750_SCSCR1_CKE_ASYNC_SCK_CLKOUT 0x01	/* Use SCK as a clock output
-						   in asynchronous mode */
-
-/* SCI Serial Status Register - SCSSR1(byte), SCSFR2(half) */
-#define SH7750_SCSSR_REGOFS(n) ((n) == 1 ? 0xE00010 : 0xE80010)	/* offset */
-#define SH7750_SCSSR(n)       SH7750_P4_REG32(SH7750_SCSSR_REGOFS(n))
-#define SH7750_SCSSR1         SH7750_SCSSR(1)
-#define SH7750_SCSFR2         SH7750_SCSSR(2)
-#define SH7750_SCSSR_A7(n)    SH7750_A7_REG32(SH7750_SCSSR_REGOFS(n))
-#define SH7750_SCSSR1_A7      SH7750_SCSSR_A7(1)
-#define SH7750_SCSFR2_A7      SH7750_SCSSR_A7(2)
-
-#define SH7750_SCSSR1_TDRE    0x80	/* Transmit Data Register Empty */
-#define SH7750_SCSSR1_RDRF    0x40	/* Receive Data Register Full */
-#define SH7750_SCSSR1_ORER    0x20	/* Overrun Error */
-#define SH7750_SCSSR1_FER     0x10	/* Framing Error */
-#define SH7750_SCSSR1_PER     0x08	/* Parity Error */
-#define SH7750_SCSSR1_TEND    0x04	/* Transmit End */
-#define SH7750_SCSSR1_MPB     0x02	/* Multiprocessor Bit */
-#define SH7750_SCSSR1_MPBT    0x01	/* Multiprocessor Bit Transfer */
-
-#define SH7750_SCFSR2_PERN    0xF000	/* Number of Parity Errors */
-#define SH7750_SCFSR2_PERN_S  12
-#define SH7750_SCFSR2_FERN    0x0F00	/* Number of Framing Errors */
-#define SH7750_SCFSR2_FERN_S  8
-#define SH7750_SCFSR2_ER      0x0080	/* Receive Error */
-#define SH7750_SCFSR2_TEND    0x0040	/* Transmit End */
-#define SH7750_SCFSR2_TDFE    0x0020	/* Transmit FIFO Data Empty */
-#define SH7750_SCFSR2_BRK     0x0010	/* Break Detect */
-#define SH7750_SCFSR2_FER     0x0008	/* Framing Error */
-#define SH7750_SCFSR2_PER     0x0004	/* Parity Error */
-#define SH7750_SCFSR2_RDF     0x0002	/* Receive FIFO Data Full */
-#define SH7750_SCFSR2_DR      0x0001	/* Receive Data Ready */
-
-/* SCI Serial Port Register - SCSPTR1(byte) */
-#define SH7750_SCSPTR1_REGOFS 0xE0001C	/* offset */
-#define SH7750_SCSPTR1        SH7750_P4_REG32(SH7750_SCSPTR1_REGOFS)
-#define SH7750_SCSPTR1_A7     SH7750_A7_REG32(SH7750_SCSPTR1_REGOFS)
-
-#define SH7750_SCSPTR1_EIO    0x80	/* Error Interrupt Only */
-#define SH7750_SCSPTR1_SPB1IO 0x08	/* 1: Output SPB1DT bit to SCK pin */
-#define SH7750_SCSPTR1_SPB1DT 0x04	/* Serial Port Clock Port Data */
-#define SH7750_SCSPTR1_SPB0IO 0x02	/* 1: Output SPB0DT bit to TxD pin */
-#define SH7750_SCSPTR1_SPB0DT 0x01	/* Serial Port Break Data */
-
-/* SCIF Serial Port Register - SCSPTR2(half) */
-#define SH7750_SCSPTR2_REGOFS 0xE80020	/* offset */
-#define SH7750_SCSPTR2        SH7750_P4_REG32(SH7750_SCSPTR2_REGOFS)
-#define SH7750_SCSPTR2_A7     SH7750_A7_REG32(SH7750_SCSPTR2_REGOFS)
-
-#define SH7750_SCSPTR2_RTSIO  0x80	/* 1: Output RTSDT bit to RTS2\ pin */
-#define SH7750_SCSPTR2_RTSDT  0x40	/* RTS Port Data */
-#define SH7750_SCSPTR2_CTSIO  0x20	/* 1: Output CTSDT bit to CTS2\ pin */
-#define SH7750_SCSPTR2_CTSDT  0x10	/* CTS Port Data */
-#define SH7750_SCSPTR2_SPB2IO 0x02	/* 1: Output SPBDT bit to TxD2 pin */
-#define SH7750_SCSPTR2_SPB2DT 0x01	/* Serial Port Break Data */
-
-/* SCI Bit Rate Register - SCBRR1(byte), SCBRR2(byte) */
-#define SH7750_SCBRR_REGOFS(n) ((n) == 1 ? 0xE00004 : 0xE80004)	/* offset */
-#define SH7750_SCBRR(n)       SH7750_P4_REG32(SH7750_SCBRR_REGOFS(n))
-#define SH7750_SCBRR1         SH7750_SCBRR_P4(1)
-#define SH7750_SCBRR2         SH7750_SCBRR_P4(2)
-#define SH7750_SCBRR_A7(n)    SH7750_A7_REG32(SH7750_SCBRR_REGOFS(n))
-#define SH7750_SCBRR1_A7      SH7750_SCBRR_A7(1)
-#define SH7750_SCBRR2_A7      SH7750_SCBRR_A7(2)
-
-/* SCIF FIFO Control Register - SCFCR2(half) */
-#define SH7750_SCFCR2_REGOFS  0xE80018	/* offset */
-#define SH7750_SCFCR2         SH7750_P4_REG32(SH7750_SCFCR2_REGOFS)
-#define SH7750_SCFCR2_A7      SH7750_A7_REG32(SH7750_SCFCR2_REGOFS)
-
-#define SH7750_SCFCR2_RSTRG   0x700	/* RTS2\ Output Active Trigger; RTS2\
-					   signal goes to high level when the
-					   number of received data stored in
-					   FIFO exceeds the trigger number */
-#define SH7750_SCFCR2_RSTRG_15 0x000	/* 15 bytes */
-#define SH7750_SCFCR2_RSTRG_1  0x000	/* 1 byte */
-#define SH7750_SCFCR2_RSTRG_4  0x000	/* 4 bytes */
-#define SH7750_SCFCR2_RSTRG_6  0x000	/* 6 bytes */
-#define SH7750_SCFCR2_RSTRG_8  0x000	/* 8 bytes */
-#define SH7750_SCFCR2_RSTRG_10 0x000	/* 10 bytes */
-#define SH7750_SCFCR2_RSTRG_14 0x000	/* 14 bytes */
-
-#define SH7750_SCFCR2_RTRG    0x0C0	/* Receive FIFO Data Number Trigger,
-					   Receive Data Full (RDF) Flag sets
-					   when number of receive data bytes is
-					   equal or greater than the trigger
-					   number */
-#define SH7750_SCFCR2_RTRG_1  0x000	/* 1 byte */
-#define SH7750_SCFCR2_RTRG_4  0x040	/* 4 bytes */
-#define SH7750_SCFCR2_RTRG_8  0x080	/* 8 bytes */
-#define SH7750_SCFCR2_RTRG_14 0x0C0	/* 14 bytes */
-
-#define SH7750_SCFCR2_TTRG    0x030	/* Transmit FIFO Data Number Trigger,
-					   Transmit FIFO Data Register Empty (TDFE)
-					   flag sets when the number of remaining
-					   transmit data bytes is equal or less
-					   than the trigger number */
-#define SH7750_SCFCR2_TTRG_8  0x000	/* 8 bytes */
-#define SH7750_SCFCR2_TTRG_4  0x010	/* 4 bytes */
-#define SH7750_SCFCR2_TTRG_2  0x020	/* 2 bytes */
-#define SH7750_SCFCR2_TTRG_1  0x030	/* 1 byte */
-
-#define SH7750_SCFCR2_MCE     0x008	/* Modem Control Enable */
-#define SH7750_SCFCR2_TFRST   0x004	/* Transmit FIFO Data Register Reset,
-					   invalidates the transmit data in the
-					   transmit FIFO */
-#define SH7750_SCFCR2_RFRST   0x002	/* Receive FIFO Data Register Reset,
-					   invalidates the receive data in the
-					   receive FIFO data register and resets
-					   it to the empty state */
-#define SH7750_SCFCR2_LOOP    0x001	/* Loopback Test */
-
-/* SCIF FIFO Data Count Register - SCFDR2(half, read-only) */
-#define SH7750_SCFDR2_REGOFS  0xE8001C	/* offset */
-#define SH7750_SCFDR2         SH7750_P4_REG32(SH7750_SCFDR2_REGOFS)
-#define SH7750_SCFDR2_A7      SH7750_A7_REG32(SH7750_SCFDR2_REGOFS)
-
-#define SH7750_SCFDR2_T       0x1F00	/* Number of untransmitted data bytes
-					   in transmit FIFO */
-#define SH7750_SCFDR2_T_S     8
-#define SH7750_SCFDR2_R       0x001F	/* Number of received data bytes in
-					   receive FIFO */
-#define SH7750_SCFDR2_R_S     0
-
-/* SCIF Line Status Register - SCLSR2(half, read-only) */
-#define SH7750_SCLSR2_REGOFS  0xE80024	/* offset */
-#define SH7750_SCLSR2         SH7750_P4_REG32(SH7750_SCLSR2_REGOFS)
-#define SH7750_SCLSR2_A7      SH7750_A7_REG32(SH7750_SCLSR2_REGOFS)
-
-#define SH7750_SCLSR2_ORER    0x0001	/* Overrun Error */
-
-/*
- * SCI-based Smart Card Interface
- */
-/* Smart Card Mode Register - SCSCMR1(byte) */
-#define SH7750_SCSCMR1_REGOFS 0xE00018	/* offset */
-#define SH7750_SCSCMR1        SH7750_P4_REG32(SH7750_SCSCMR1_REGOFS)
-#define SH7750_SCSCMR1_A7     SH7750_A7_REG32(SH7750_SCSCMR1_REGOFS)
-
-#define SH7750_SCSCMR1_SDIR   0x08	/* Smart Card Data Transfer Direction: */
-#define SH7750_SCSCMR1_SDIR_LSBF 0x00	/* LSB-first */
-#define SH7750_SCSCMR1_SDIR_MSBF 0x08	/* MSB-first */
-
-#define SH7750_SCSCMR1_SINV   0x04	/* Smart Card Data Inversion */
-#define SH7750_SCSCMR1_SMIF   0x01	/* Smart Card Interface Mode Select */
-
-/* Smart-card specific bits in other registers */
-/* SCSMR1: */
-#define SH7750_SCSMR1_GSM     0x80	/* GSM mode select */
-
-/* SCSSR1: */
-#define SH7750_SCSSR1_ERS     0x10	/* Error Signal Status */
-
-/*
  * I/O Ports
  */
 /* Port Control Register A - PCTRA */
diff --git a/hw/sh_serial.c b/hw/sh_serial.c
new file mode 100644
index 0000000..03a096c
--- /dev/null
+++ b/hw/sh_serial.c
@@ -0,0 +1,315 @@
+/*
+ * QEMU SCI/SCIF serial port emulation
+ *
+ * Copyright (c) 2007 Magnus Damm
+ *
+ * Based on serial.c - QEMU 16450 UART emulation
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "vl.h"
+#include <assert.h>
+
+//#define DEBUG_SERIAL
+
+#define SH_SERIAL_FLAG_TEND (1 << 0)
+#define SH_SERIAL_FLAG_TDE  (1 << 1)
+#define SH_SERIAL_FLAG_RDF  (1 << 2)
+#define SH_SERIAL_FLAG_BRK  (1 << 3)
+#define SH_SERIAL_FLAG_DR   (1 << 4)
+
+typedef struct {
+    uint8_t smr;
+    uint8_t brr;
+    uint8_t scr;
+    uint8_t dr; /* ftdr / tdr */
+    uint8_t sr; /* fsr / ssr */
+    uint16_t fcr;
+    uint8_t sptr;
+
+    uint8_t rx_fifo[16]; /* frdr / rdr */
+    uint8_t rx_cnt;
+
+    target_phys_addr_t base;
+    int freq;
+    int feat;
+    int flags;
+
+    CharDriverState *chr;
+} sh_serial_state;
+
+static void sh_serial_ioport_write(void *opaque, uint32_t offs, uint32_t val)
+{
+    sh_serial_state *s = opaque;
+    unsigned char ch;
+
+#ifdef DEBUG_SERIAL
+    printf("sh_serial: write base=0x%08lx offs=0x%02x val=0x%02x\n",
+	   (unsigned long) s->base, offs, val);
+#endif
+    switch(offs) {
+    case 0x00: /* SMR */
+        s->smr = val & ((s->feat & SH_SERIAL_FEAT_SCIF) ? 0x7b : 0xff);
+        return;
+    case 0x04: /* BRR */
+        s->brr = val;
+	return;
+    case 0x08: /* SCR */
+        s->scr = val & ((s->feat & SH_SERIAL_FEAT_SCIF) ? 0xfb : 0xff);
+        if (!(val & (1 << 5)))
+            s->flags |= SH_SERIAL_FLAG_TEND;
+        return;
+    case 0x0c: /* FTDR / TDR */
+        if (s->chr) {
+            ch = val;
+            qemu_chr_write(s->chr, &ch, 1);
+	}
+	s->dr = val;
+	s->flags &= ~SH_SERIAL_FLAG_TDE;
+        return;
+#if 0
+    case 0x14: /* FRDR / RDR */
+        ret = 0;
+        break;
+#endif
+    }
+    if (s->feat & SH_SERIAL_FEAT_SCIF) {
+        switch(offs) {
+        case 0x10: /* FSR */
+            if (!(val & (1 << 6)))
+                s->flags &= ~SH_SERIAL_FLAG_TEND;
+            if (!(val & (1 << 5)))
+                s->flags &= ~SH_SERIAL_FLAG_TDE;
+            if (!(val & (1 << 4)))
+                s->flags &= ~SH_SERIAL_FLAG_BRK;
+            if (!(val & (1 << 1)))
+                s->flags &= ~SH_SERIAL_FLAG_RDF;
+            if (!(val & (1 << 0)))
+                s->flags &= ~SH_SERIAL_FLAG_DR;
+            return;
+        case 0x18: /* FCR */
+            s->fcr = val;
+            return;
+        case 0x20: /* SPTR */
+            s->sptr = val;
+            return;
+        case 0x24: /* LSR */
+            return;
+        }
+    }
+    else {
+#if 0
+        switch(offs) {
+        case 0x0c:
+            ret = s->dr;
+            break;
+        case 0x10:
+            ret = 0;
+            break;
+        case 0x1c:
+            ret = s->sptr;
+            break;
+        }
+#endif
+    }
+
+    fprintf(stderr, "sh_serial: unsupported write to 0x%02x\n", offs);
+    assert(0);
+}
+
+static uint32_t sh_serial_ioport_read(void *opaque, uint32_t offs)
+{
+    sh_serial_state *s = opaque;
+    uint32_t ret = ~0;
+
+#if 0
+    switch(offs) {
+    case 0x00:
+        ret = s->smr;
+        break;
+    case 0x04:
+        ret = s->brr;
+	break;
+    case 0x08:
+        ret = s->scr;
+        break;
+    case 0x14:
+        ret = 0;
+        break;
+    }
+#endif
+    if (s->feat & SH_SERIAL_FEAT_SCIF) {
+        switch(offs) {
+        case 0x10: /* FSR */
+            ret = 0;
+            if (s->flags & SH_SERIAL_FLAG_TEND)
+                ret |= (1 << 6);
+            if (s->flags & SH_SERIAL_FLAG_TDE)
+                ret |= (1 << 5);
+            if (s->flags & SH_SERIAL_FLAG_BRK)
+                ret |= (1 << 4);
+            if (s->flags & SH_SERIAL_FLAG_RDF)
+                ret |= (1 << 1);
+            if (s->flags & SH_SERIAL_FLAG_DR)
+                ret |= (1 << 0);
+
+	    if (s->scr & (1 << 5))
+                s->flags |= SH_SERIAL_FLAG_TDE | SH_SERIAL_FLAG_TEND;
+
+            break;
+#if 0
+        case 0x18:
+            ret = s->fcr;
+            break;
+#endif
+        case 0x1c:
+            ret = s->rx_cnt;
+            break;
+        case 0x20:
+            ret = s->sptr;
+            break;
+        case 0x24:
+            ret = 0;
+            break;
+        }
+    }
+    else {
+#if 0
+        switch(offs) {
+        case 0x0c:
+            ret = s->dr;
+            break;
+        case 0x10:
+            ret = 0;
+            break;
+        case 0x1c:
+            ret = s->sptr;
+            break;
+        }
+#endif
+    }
+#ifdef DEBUG_SERIAL
+    printf("sh_serial: read base=0x%08lx offs=0x%02x val=0x%x\n",
+	   (unsigned long) s->base, offs, ret);
+#endif
+
+    if (ret & ~((1 << 16) - 1)) {
+        fprintf(stderr, "sh_serial: unsupported read from 0x%02x\n", offs);
+	assert(0);
+    }
+
+    return ret;
+}
+
+static int sh_serial_can_receive(sh_serial_state *s)
+{
+    return 0;
+}
+
+static void sh_serial_receive_byte(sh_serial_state *s, int ch)
+{
+}
+
+static void sh_serial_receive_break(sh_serial_state *s)
+{
+}
+
+static int sh_serial_can_receive1(void *opaque)
+{
+    sh_serial_state *s = opaque;
+    return sh_serial_can_receive(s);
+}
+
+static void sh_serial_receive1(void *opaque, const uint8_t *buf, int size)
+{
+    sh_serial_state *s = opaque;
+    sh_serial_receive_byte(s, buf[0]);
+}
+
+static void sh_serial_event(void *opaque, int event)
+{
+    sh_serial_state *s = opaque;
+    if (event == CHR_EVENT_BREAK)
+        sh_serial_receive_break(s);
+}
+
+uint32_t sh_serial_read (void *opaque, target_phys_addr_t addr)
+{
+    sh_serial_state *s = opaque;
+    return sh_serial_ioport_read(s, addr - s->base);
+}
+
+void sh_serial_write (void *opaque,
+		      target_phys_addr_t addr, uint32_t value)
+{
+    sh_serial_state *s = opaque;
+    sh_serial_ioport_write(s, addr - s->base, value);
+}
+
+static CPUReadMemoryFunc *sh_serial_readfn[] = {
+    &sh_serial_read,
+    &sh_serial_read,
+    &sh_serial_read,
+};
+
+static CPUWriteMemoryFunc *sh_serial_writefn[] = {
+    &sh_serial_write,
+    &sh_serial_write,
+    &sh_serial_write,
+};
+
+void sh_serial_init (target_phys_addr_t base, int feat,
+		     uint32_t freq, CharDriverState *chr)
+{
+    sh_serial_state *s;
+    int s_io_memory;
+
+    s = qemu_mallocz(sizeof(sh_serial_state));
+    if (!s)
+        return;
+
+    s->base = base;
+    s->feat = feat;
+    s->flags = SH_SERIAL_FLAG_TEND | SH_SERIAL_FLAG_TDE;
+
+    s->smr = 0;
+    s->brr = 0xff;
+    s->scr = 0;
+    s->sptr = 0;
+
+    if (feat & SH_SERIAL_FEAT_SCIF) {
+        s->fcr = 0;
+    }
+    else {
+        s->dr = 0xff;
+    }
+
+    s->rx_cnt = 0;
+
+    s_io_memory = cpu_register_io_memory(0, sh_serial_readfn,
+					 sh_serial_writefn, s);
+    cpu_register_physical_memory(base, 0x28, s_io_memory);
+
+    s->chr = chr;
+
+    if (chr)
+        qemu_chr_add_handlers(chr, sh_serial_can_receive1, sh_serial_receive1,
+			      sh_serial_event, s);
+}
diff --git a/vl.h b/vl.h
index 43adc24..4e06283 100644
--- a/vl.h
+++ b/vl.h
@@ -1523,6 +1523,11 @@ int sh7750_register_io_device(struct SH7750State *s,
 #define TMU012_FEAT_EXTCLK (1 << 2)
 void tmu012_init(uint32_t base, int feat, uint32_t freq);
 
+/* sh_serial.c */
+#define SH_SERIAL_FEAT_SCIF (1 << 0)
+void sh_serial_init (target_phys_addr_t base, int feat,
+		     uint32_t freq, CharDriverState *chr);
+
 /* tc58128.c */
 int tc58128_init(struct SH7750State *s, char *zone1, char *zone2);