Commit: 310f892cf84c1effb0eb7a031e56ed19bbe4b3fb - qemu (git)

Commit MetaInfo

• Revision: 310f892cf84c1effb0eb7a031e56ed19bbe4b3fb (tree)
• Time: 2019-01-03 00:17:05
• Author: Yoshinori Sato <ysato@user...>
• Commiter: Yoshinori Sato

Log Message

New SCI emulation

Change Summary

• modified: hw/char/renesas_sci.c
• add: hw/timer/renesas_cmt.c
• modified: include/hw/char/renesas_sci.h
• add: include/hw/timer/renesas_cmt.h

Incremental Difference

--- a/hw/char/renesas_sci.c
+++ b/hw/char/renesas_sci.c
@@ -1,493 +1,265 @@
 /*
- * QEMU SCI/SCIF serial port emulation
+ * Renesas Serial Communication Interface
  *
- * Copyright (c) 2007 Magnus Damm
+ * Copyright (c) 2018 Yoshinori Sato
  *
- * Based on serial.c - QEMU 16450 UART emulation
- * Copyright (c) 2003-2004 Fabrice Bellard
+ * This code is licensed under the GPL version 2 or later.
  *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
  */
+
 #include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "cpu.h"
 #include "hw/hw.h"
+#include "hw/sysbus.h"
 #include "hw/char/renesas_sci.h"
-#include "qapi/error.h"
-#include "qemu/timer.h"
-
-//#define DEBUG_SERIAL
-
-#define SH_SERIAL_FLAG_TEND (1 << 0)
-#define SH_SERIAL_FLAG_TDE  (1 << 1)
-#define SH_SERIAL_FLAG_RDF  (1 << 2)
-#define SH_SERIAL_FLAG_BRK  (1 << 3)
-#define SH_SERIAL_FLAG_DR   (1 << 4)
-
-#define SH_RX_FIFO_LENGTH (16)
-
-typedef struct {
-    MemoryRegion iomem;
-    MemoryRegion iomem_p4;
-    MemoryRegion iomem_a7;
-    uint8_t smr;
-    uint8_t brr;
-    uint8_t scr;
-    uint8_t dr; /* ftdr / tdr */
-    uint8_t sr; /* fsr / ssr */
-    uint16_t fcr;
-    uint8_t sptr;
-
-    uint8_t rx_fifo[SH_RX_FIFO_LENGTH]; /* frdr / rdr */
-    uint8_t rx_cnt;
-    uint8_t rx_tail;
-    uint8_t rx_head;
-
-    int freq;
-    int feat;
-    int flags;
-    int rtrg;
-
-    CharBackend chr;
-    QEMUTimer *fifo_timeout_timer;
-    uint64_t etu; /* Elementary Time Unit (ns) */
+#include "qemu/error-report.h"
 
-    qemu_irq eri;
-    qemu_irq rxi;
-    qemu_irq txi;
-    qemu_irq tei;
-    qemu_irq bri;
-} sh_serial_state;
+#define freq_to_ns(freq) (1000000000LL / freq)
 
-static void sh_serial_clear_fifo(sh_serial_state * s)
+static int can_receive(void *opaque)
 {
-    memset(s->rx_fifo, 0, SCIF_RX_FIFO_LENGTH);
-    s->rx_cnt = 0;
-    s->rx_head = 0;
-    s->rx_tail = 0;
+    RSCIState *sci= RSCI(opaque);
+    if (sci->rx_next > qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL))
+        return 0;
+    else
+        return sci->scr & 0x10;
 }
 
-static void sh_serial_write(void *opaque, hwaddr offs,
-                            uint64_t val, unsigned size)
+static void receive(void *opaque, const uint8_t *buf, int size)
 {
-    RenesasSCIState *s = opaque;
-    unsigned char ch;
-
-    if (s->feat & RENESAS_SCI_FEAT_LONG)
-        offs >>= 2;
-#ifdef DEBUG_SERIAL
-    printf("sh_serial: write offs=0x%02x val=0x%02x\n",
-	   offs, val);
-#endif
-    switch(offs) {
-    case 0x00: /* SMR */
-        s->smr = val & ((s->feat & RENESAS_SCI_FEAT_SCIF) ? 0x7b : 0xff);
-        return;
-    case 0x01: /* BRR */
-        s->brr = val;
-	return;
-    case 0x02: /* SCR */
-        /* TODO : For SH7751, SCIF mask should be 0xfb. */
-        s->scr = val & ((s->feat & RENESAS_SCI_FEAT_SCIF) ? 0xfa : 0xff);
-        if (!(val & (1 << 5)))
-            s->flags |= RENESAS_SCI_FLAG_TEND;
-        if (s->txi && (val & (1 << 7))) {
-	    qemu_set_irq(s->txi, 1);
-	    qemu_set_irq(s->txi, 0);
-        }
-        if (!(val & (1 << 6))) {
-	    qemu_set_irq(s->rxi, 0);
-        }
-        return;
-    case 0x03: /* FTDR / TDR */
-        if (qemu_chr_fe_backend_connected(&s->chr)) {
-            ch = val;
-            /* XXX this blocks entire thread. Rewrite to use
-             * qemu_chr_fe_write and background I/O callbacks */
-            qemu_chr_fe_write_all(&s->chr, &ch, 1);
-	}
-	s->dr = val;
-	s->flags &= ~RENESAS_SCI_FLAG_TDE;
-        return;
-#if 0
-    case 0x14: /* FRDR / RDR */
-        ret = 0;
-        break;
-#endif
-    }
-    if (s->feat & RENESAS_SCI_FEAT_SCIF) {
-        switch(offs) {
-        case 0x4: /* FSR */
-            if (!(val & (1 << 6)))
-                s->flags &= ~RENESAS_SCI_FLAG_TEND;
-            if (!(val & (1 << 5)))
-                s->flags &= ~RENESAS_SCI_FLAG_TDE;
-            if (!(val & (1 << 4)))
-                s->flags &= ~RENESAS_SCI_FLAG_BRK;
-            if (!(val & (1 << 1)))
-                s->flags &= ~RENESAS_SCI_FLAG_RDF;
-            if (!(val & (1 << 0)))
-                s->flags &= ~RENESAS_SCI_FLAG_DR;
-
-            if (!(val & (1 << 1)) || !(val & (1 << 0))) {
-                if (s->rxi) {
-                    qemu_set_irq(s->rxi, 0);
-                }
-            }
-            return;
-        case 0x6: /* FCR */
-            s->fcr = val;
-            switch ((val >> 6) & 3) {
-            case 0:
-                s->rtrg = 1;
-                break;
-            case 1:
-                s->rtrg = 4;
-                break;
-            case 2:
-                s->rtrg = 8;
-                break;
-            case 3:
-                s->rtrg = 14;
-                break;
-            }
-            if (val & (1 << 1)) {
-                sh_serial_clear_fifo(s);
-                s->sr &= ~(1 << 1);
-            }
-
-            return;
-        case 0x08: /* SPTR */
-            s->sptr = val & 0xf3;
-            return;
-        case 0x07: /* LSR */
-            return;
-        }
-    }
-    else {
-        switch(offs) {
-        case 0x4: /* SSR */
-            if (!(val & (1 << 2)))
-                s->flags &= ~RENESAS_SCI_FLAG_TEND;
-            if (!(val & (1 << 7)))
-                s->flags &= ~RENESAS_SCI_FLAG_TDE;
-            if (!(val & (1 << 6)))
-                s->flags &= ~RENESAS_SCI_FLAG_RDF;
-
-            if (!(val & (1 << 6)) && s->rxi)
-                qemu_set_irq(s->rxi, 0);
-            if (!(val & (1 << 5)) && s->txi)
-                qemu_set_irq(s->txi, 0);
-            return;
-        case 0x7:
-            s->sptr = val & 0x8f;
-            return;
+    RSCIState *sci= RSCI(opaque);
+    sci->rdr = buf[0];
+    if (sci->ssr & 0x40 || size > 1) {
+        sci->ssr |= 0x20;
+        if (sci->scr & 0x40)
+            qemu_set_irq(sci->irq[ERI], 1);
+    } else {
+        sci->ssr |= 0x40;
+        sci->rx_next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + sci->trtime;
+        if (sci->scr & 0x40) {
+            qemu_set_irq(sci->irq[RXI], 1);
+            qemu_set_irq(sci->irq[RXI], 0);
         }
     }
-
-    fprintf(stderr, "sh_serial: unsupported write to 0x%02"
-            HWADDR_PRIx "\n", offs);
-    abort();
 }
 
-static uint64_t sh_serial_read(void *opaque, hwaddr offs,
-                               unsigned size)
+static void send_byte(RSCIState *sci)
 {
-    RenesasSCIState *s = opaque;
-    uint32_t ret = ~0;
-
-#if 0
-    switch(offs) {
-    case 0x14:
-        ret = 0;
-        break;
-    }
-#endif
-    if (s->feat & RENESAS_SCI_FEAT_LONG)
-        offs >>= 2;
-    if (s->feat & RENESAS_SCI_FEAT_SCIF) {
-        switch(offs) {
-        case 0x00: /* SMR */
-            ret = s->smr;
-            break;
-        case 0x02: /* SCR */
-            ret = s->scr;
-            break;
-        case 0x04: /* FSR */
-            ret = 0;
-            if (s->flags & RENESAS_SCI_FLAG_TEND)
-                ret |= (1 << 6);
-            if (s->flags & RENESAS_SCI_FLAG_TDE)
-                ret |= (1 << 5);
-            if (s->flags & RENESAS_SCI_FLAG_BRK)
-                ret |= (1 << 4);
-            if (s->flags & RENESAS_SCI_FLAG_RDF)
-                ret |= (1 << 1);
-            if (s->flags & RENESAS_SCI_FLAG_DR)
-                ret |= (1 << 0);
-
-            if (s->scr & (1 << 5))
-                s->flags |= RENESAS_SCI_FLAG_TDE | RENESAS_SCI_FLAG_TEND;
-
-            break;
-        case 0x05:
-            if (s->rx_cnt > 0) {
-                ret = s->rx_fifo[s->rx_tail++];
-                s->rx_cnt--;
-                if (s->rx_tail == SCIF_RX_FIFO_LENGTH)
-                    s->rx_tail = 0;
-                if (s->rx_cnt < s->rtrg)
-                    s->flags &= ~RENESAS_SCI_FLAG_RDF;
-            }
-            break;
-        case 0x06:
-            ret = s->fcr;
-            break;
-        case 0x07:
-            ret = s->rx_cnt;
-            break;
-        case 0x08:
-            ret = s->sptr;
-            break;
-        case 0x09:
-            ret = 0;
-            break;
-        }
+    if (qemu_chr_fe_backend_connected(&sci->chr))
+        qemu_chr_fe_write_all(&sci->chr, &sci->tdr, 1);
+    timer_mod(sci->timer,
+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + sci->trtime);
+    sci->ssr &= ~0x04;
+    sci->ssr |= 0x80;
+    qemu_set_irq(sci->irq[TEI], 0);
+    if (sci->scr & 0x80) {
+        qemu_set_irq(sci->irq[TXI], 1);
+        qemu_set_irq(sci->irq[TXI], 0);
     }
-    else {
-        switch(offs) {
-        case 0x00:
-            ret = s->smr;
-            break;
-        case 0x01:
-            ret = s->brr;
-            break;
-        case 0x02:
-            ret = s->scr;
-            break;
-        case 0x03:
-            ret = s->dr;
-            break;
-        case 0x04:
-            ret = 0;
-            if (s->flags & RENESAS_SCI_FLAG_TDE)
-                ret |= (1 << 7);
-            if (s->flags & RENESAS_SCI_FLAG_RDF)
-                ret |= (1 << 6);
-            if (s->flags & RENESAS_SCI_FLAG_OVF)
-                ret |= (1 << 5);
-            if (s->flags & RENESAS_SCI_FLAG_TEND)
-                ret |= (1 << 2);
-            if (s->scr & (1 << 5)) {
-                s->flags |= RENESAS_SCI_FLAG_TDE | RENESAS_SCI_FLAG_TEND;
-            }
-            break;
-        case 0x05:
-            ret = s->rx_fifo[0];
-            s->flags &= ~RENESAS_SCI_FLAG_RDF;
-            break;
-        case 0x07:
-            ret = s->sptr;
-            break;
-        }
-    }
-#ifdef DEBUG_SERIAL
-    printf("sh_serial: read offs=0x%02x val=0x%x\n",
-	   offs, ret);
-#endif
-
-    if (ret & ~((1 << 16) - 1)) {
-        fprintf(stderr, "sh_serial: unsupported read from 0x%02"
-                HWADDR_PRIx "\n", offs);
-        abort();
-    }
-
-    return ret;
-}
-
-static int sh_serial_can_receive(RenesasSCIState *s)
-{
-    return s->scr & (1 << 4);
 }
 
-static void sh_serial_receive_break(RenesasSCIState *s)
+static void txend(void *opaque)
 {
-    if (s->feat & RENESAS_SCI_FEAT_SCIF)
-        s->sr |= (1 << 4);
+    RSCIState *sci= RSCI(opaque);
+    if (sci->scr & 0x80 && (sci->ssr & 0x80) == 0)
+            send_byte(sci);
+    else {
+        sci->ssr |= 0x04;
+        if (sci->scr & 0x04)
+            qemu_set_irq(sci->irq[TEI], 1);
+    }
 }
 
-static int sh_serial_can_receive1(void *opaque)
+static void update_trtime(RSCIState *sci)
 {
-    RenesasSCIState *s = opaque;
-    return sh_serial_can_receive(s);
+    static const int div[] = {1,4,16,64};
+    int w;
+    
+    w = (sci->smr & 0x40)?7:8; /* CHR */
+    w += (sci->smr >> 5) & 1; /* PE */
+    w += (sci->smr & 0x08)?2:1; /* STOP */
+    sci->trtime = w * freq_to_ns(sci->input_freq) *
+        32 * div[sci->smr & 0x03] * sci->brr; 
 }
 
-static void sh_serial_timeout_int(void *opaque)
+static void sci_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
 {
-    sh_serial_state *s = opaque;
-
-    s->flags |= SH_SERIAL_FLAG_RDF;
-    if (s->scr & (1 << 6) && s->rxi) {
-        qemu_set_irq(s->rxi, 1);
+    hwaddr offset = addr & 0x07;
+    RSCIState *sci = RSCI(opaque);
+    int error = 0;
+
+    switch(offset) {
+    case 0: /* SMR */
+        if ((sci->scr & 0x30) == 0) {
+            sci->smr = val;
+            update_trtime(sci);
+        }
+        break;
+    case 1: /* BRR */
+        if ((sci->scr & 0x30) == 0) {
+            sci->brr = val;
+            update_trtime(sci);
+        }
+        break;
+    case 2: /* SCR */
+        sci->scr = val;
+        if ((sci->scr & 0x20) == 0)
+            sci->ssr |= 0x84;
+        if ((sci->scr & 0x04) == 0)
+            qemu_set_irq(sci->irq[TEI], 0);
+        if ((sci->scr & 0x40) == 0)
+            qemu_set_irq(sci->irq[ERI], 0);
+        break;
+    case 3: /* TDR */
+        sci->tdr = val;
+        if (sci->ssr & 0x04)
+            send_byte(sci);
+        else
+            sci->ssr &= ~0x80;
+        break;
+    case 4: /* SSR */
+        sci->ssr &= ~0x38 | (val & 0x38);
+        if (((sci->read_ssr & 0x38) ^ (sci->ssr & 0x38)) &&
+            (sci->ssr & 0x38) == 0)
+            qemu_set_irq(sci->irq[ERI], 0);
+        break;
+    case 5: /* RDR */
+        error = 1; break;
+    case 6: /* SCMR */
+        sci->scmr = val; break;
+    case 7: /* SEMR */
+        sci->semr = val; break;
     }
+    
+    if (error)
+        error_report("rsci: unsupported write request to %08lx", addr);
 }
 
-static void sh_serial_receive1(void *opaque, const uint8_t *buf, int size)
+static uint64_t sci_read(void *opaque, hwaddr addr, unsigned size)
 {
-    RenesasSCIState *s = opaque;
-
-    if (s->feat & RENESAS_SCI_FEAT_SCIF) {
-        int i;
-        for (i = 0; i < size; i++) {
-            if (s->rx_cnt < SCIF_RX_FIFO_LENGTH) {
-                s->rx_fifo[s->rx_head++] = buf[i];
-                if (s->rx_head == SCIF_RX_FIFO_LENGTH) {
-                    s->rx_head = 0;
-                }
-                s->rx_cnt++;
-                if (s->rx_cnt >= s->rtrg) {
-                    s->flags |= RENESAS_SCI_FLAG_RDF;
-                    if (s->scr & (1 << 6) && s->rxi) {
-                        timer_del(s->fifo_timeout_timer);
-                        qemu_set_irq(s->rxi, 1);
-                    }
-                } else {
-                    timer_mod(s->fifo_timeout_timer,
-                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 15 * s->etu);
-                }
-            }
-        }
-    } else {
-        if (!(s->flags & RENESAS_SCI_FLAG_RDF)) {
-            s->rx_fifo[0] = buf[0];
-            s->flags |= RENESAS_SCI_FLAG_RDF;
-            if (s->scr & (1 << 6) && s->rxi)
-                qemu_set_irq(s->rxi, 1);
-        } else
-            s->flags |= RENESAS_SCI_FLAG_OVF;
+    hwaddr offset = addr & 0x07;
+    RSCIState *sci = RSCI(opaque);
+    int error = 0;
+    switch(offset) {
+    case 0: /* SMR */
+        return sci->smr;
+    case 1: /* BRR */
+        return sci->brr;
+    case 2: /* SCR */
+        return sci->scr;
+    case 3: /* TDR */
+        return sci->tdr;
+    case 4: /* SSR */
+        sci->read_ssr = sci->ssr;
+        return sci->ssr;
+    case 5: /* RDR */
+        sci->ssr &= ~0x40;
+        return sci->rdr;
+    case 6: /* SCMR */
+        return sci->scmr;
+    case 7: /* SEMR */
+        return sci->semr;
     }
+    
+    if (error)
+        error_report("rsci: unsupported write request to %08lx", addr);
+    return -1;
 }
 
-static void sh_serial_event(void *opaque, int event)
+static const MemoryRegionOps sci_ops = {
+    .write = sci_write,
+    .read  = sci_read,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static void rsci_reset(DeviceState *dev)
 {
-    RenesasSCIState *s = opaque;
-    if (event == CHR_EVENT_BREAK)
-        sh_serial_receive_break(s);
+    RSCIState *sci = RSCI(dev);
+    sci->smr = sci->scr = 0x00;
+    sci->brr = 0xff;
+    sci->tdr = 0xff;
+    sci->rdr = 0x00;
+    sci->ssr = 0x84;
+    sci->scmr = 0x00;
+    sci->semr = 0x00;
+    sci->rx_next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 }
 
-static void sci_reset(DeviceState *dev)
+static void sci_event(void *opaque, int event)
 {
-    RenesasSCIState *s = RenesasSCI(dev);
-
-    s->flags = RENESAS_SCI_FLAG_TEND | RENESAS_SCI_FLAG_TDE;
-    s->rtrg = 1;
-
-    s->smr = 0;
-    s->brr = 0xff;
-    s->scr = 1 << 5; /* pretend that TX is enabled so early printk works */
-    s->sptr = 0;
-
-    if (s->feat & RENESAS_SCI_FEAT_SCIF) {
-        s->fcr = 0;
-    } else {
-        s->dr = 0xff;
-    }
-
-    sh_serial_clear_fifo(s);
+    RSCIState *sci = RSCI(opaque);
+    if (event == CHR_EVENT_BREAK) {
+    sci->ssr |= 0x10;
+    if (sci->scr & 0x40)
+        qemu_set_irq(sci->irq[ERI], 1);
+    }        
 }
 
-static const MemoryRegionOps sh_serial_ops = {
-    .read = sh_serial_read,
-    .write = sh_serial_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
-static void sci_realize(DeviceState *dev, Error **errp)
+static void rsci_realize(DeviceState *dev, Error **errp)
 {
-    RenesasSCIState *s = RenesasSCI(dev);
-    SysBusDevice *d = SYS_BUS_DEVICE(dev);
-    uint32_t sz;
+    RSCIState *sci = RSCI(dev);
 
-    sz = 8;
-    if (s->feat & RENESAS_SCI_FEAT_LONG)
-        sz <<= 2;
-    if (s->feat & RENESAS_SCI_FEAT_SCIF)
-        sz += 0x08;
-    
-    memory_region_init_io(&s->iomem, NULL, &sh_serial_ops, s,
-                          "sci", sz);
-    sysbus_init_mmio(d, &s->iomem);
-    if (s->feat & RENESAS_SCI_FEAT_ALIAS) {
-        memory_region_init_alias(&s->iomem_p4, NULL, "sci-p4", &s->iomem,
-                                 0, sz);
-        sysbus_init_mmio(d, &s->iomem_p4);
-        memory_region_init_alias(&s->iomem_a7, NULL, "sci-a7", &s->iomem,
-                                 0, sz);
-        sysbus_init_mmio(d, &s->iomem_a7);
-    }
-
-    qemu_chr_fe_set_handlers(&s->chr, sh_serial_can_receive1,
-                             sh_serial_receive1,
-                             sh_serial_event, NULL, s, NULL, true);
+    qemu_chr_fe_set_handlers(&sci->chr, can_receive, receive,
+                             sci_event, NULL, sci, NULL, true);
 }
 
-static void sci_init(Object *obj)
+static void rsci_init(Object *obj)
 {
     SysBusDevice *d = SYS_BUS_DEVICE(obj);
-    RenesasSCIState *s = RenesasSCI(obj);
+    RSCIState *sci = RSCI(obj);
+    int i;
     
-    sysbus_init_irq(d, &s->eri);
-    sysbus_init_irq(d, &s->rxi);
-    sysbus_init_irq(d, &s->txi);
-    sysbus_init_irq(d, &s->tei);
-    sysbus_init_irq(d, &s->bri);
+    memory_region_init_io(&sci->memory, OBJECT(sci), &sci_ops,
+                          sci, "renesas-sci", 0x8);
+    sysbus_init_mmio(d, &sci->memory);
+
+    for (i = 0; i < 4; i++) {
+        sysbus_init_irq(d, &sci->irq[i]);
+    }
+    sci->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, txend, sci);
 }
 
-static Property sci_properties[] = {
-    DEFINE_PROP_UINT32("feat", RenesasSCIState, feat, 0),
-    DEFINE_PROP_CHR("chardev", RenesasSCIState, chr),
+static const VMStateDescription vmstate_rcmt = {
+    .name = "renesas-sci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property rsci_properties[] = {
+    DEFINE_PROP_UINT64("input-freq", RSCIState, input_freq, 0),
+    DEFINE_PROP_CHR("chardev", RSCIState, chr),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void sci_class_init(ObjectClass *klass, void *data)
+static void rsci_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    s->fifo_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                         sh_serial_timeout_int, s);
-    s->etu = NANOSECONDS_PER_SECOND / 9600;
-    s->eri = eri_source;
-    s->rxi = rxi_source;
-    s->txi = txi_source;
-    s->tei = tei_source;
-    s->bri = bri_source;
+    dc->realize = rsci_realize;
+    dc->props = rsci_properties;
+    dc->vmsd = &vmstate_rcmt;
+    dc->reset = rsci_reset;
 }
 
-static const TypeInfo sci_info = {
-    .name       = TYPE_RENESASSCI,
+static const TypeInfo rsci_info = {
+    .name       = TYPE_RSCI,
     .parent     = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(RenesasSCIState),
-    .instance_init = sci_init,
-    .class_init = sci_class_init,
+    .instance_size = sizeof(RSCIState),
+    .instance_init = rsci_init,
+    .class_init = rsci_class_init,
 };
 
-static void sci_register_types(void)
+static void rsci_register_types(void)
 {
-    type_register_static(&sci_info);
+    type_register_static(&rsci_info);
 }
 
-type_init(sci_register_types)
+type_init(rsci_register_types)

--- /dev/null
+++ b/hw/timer/renesas_cmt.c
@@ -0,0 +1,218 @@
+/*
+ * Renesas Compare-match timer
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL version 2 or later.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/timer.h"
+#include "cpu.h"
+#include "hw/hw.h"
+#include "hw/sysbus.h"
+#include "hw/timer/renesas_cmt.h"
+#include "qemu/error-report.h"
+
+#define freq_to_ns(freq) (1000000000LL / freq)
+static const int clkdiv[] = {8,32,128,512};
+
+static void update_events(RCMTState *cmt, int ch)
+{
+    uint16_t diff;
+
+    if ((cmt->cmstr & (1 << ch))== 0)
+        return ;
+    diff = cmt->cmcor[ch] - cmt->cmcnt[ch];
+    timer_mod(cmt->timer[ch],
+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+              diff * freq_to_ns(cmt->input_freq) *
+              clkdiv[cmt->cmcr[ch] & 3]);
+}
+
+static uint64_t read_cmcnt(RCMTState *cmt, int ch)
+{
+    int64_t delta, now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+    if (cmt->cmstr & (1 << ch)) {
+        delta = (now - cmt->tick[ch]) / freq_to_ns(cmt->input_freq);
+        delta /= clkdiv[cmt->cmcr[ch] & 0x03];
+        return cmt->cmcnt[ch] + delta;
+    } else
+        return cmt->cmcnt[ch];
+}
+
+static uint64_t cmt_read(void *opaque, hwaddr addr, unsigned size)
+{
+    hwaddr offset = addr & 0x0f;
+    RCMTState *cmt = opaque;
+    int ch = offset / 0x08;
+    int error = 1;
+
+    if (offset == 0) {
+        return cmt->cmstr;
+        error = 0;
+    } else {
+        offset &= 0x07;
+        if (ch == 0)
+            offset -= 0x02;
+        error = 0;
+        switch(offset) {
+        case 0:
+            return cmt->cmcr[ch];
+        case 2:
+            return read_cmcnt(cmt, ch);
+        case 4:
+            return cmt->cmcor[ch];
+        default:
+            error = 1;
+        }
+    }
+    if (error)
+        error_report("rcmt: unsupported read request to %08lx", addr);
+    return 0xffffffffffffffffUL;
+}
+
+static void start_stop(RCMTState *cmt, int ch, int st)
+{
+    if (st)
+        update_events(cmt, ch);
+    else
+        timer_del(cmt->timer[ch]);
+}
+
+static void cmt_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    hwaddr offset = addr & 0x0f;
+    RCMTState *cmt = opaque;
+    int ch = offset / 0x08;
+    int error = 1;
+
+    if (offset == 0) {
+        cmt->cmstr = val;
+        start_stop(cmt, 0, cmt->cmstr & 1);
+        start_stop(cmt, 1, (cmt->cmstr >> 1) & 1);
+        error = 0;
+    } else {
+        offset &= 0x07;
+        if (ch == 0)
+            offset -= 0x02;
+        error = 0;
+        switch(offset) {
+        case 0:
+            cmt->cmcr[ch] = val;
+            break;
+        case 2:
+            cmt->cmcnt[ch] = val;
+            break;
+        case 4:
+            cmt->cmcor[ch] = val;
+            break;
+        default:
+            error = 1;
+        }
+        if (error == 0 && cmt->cmstr & (1 << ch))
+            update_events(cmt, ch);
+    }
+    if (error)
+        error_report("rcmt: unsupported write request to %08lx", addr);
+}
+
+static const MemoryRegionOps cmt_ops = {
+    .write = cmt_write,
+    .read  = cmt_read,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 2,
+    },
+};
+
+static void timer_events(RCMTState *cmt, int ch)
+{
+    cmt->cmcnt[ch] = 0;
+    cmt->tick[ch] = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    update_events(cmt, ch);
+    if (cmt->cmcr[ch] & 0x40)
+        qemu_irq_pulse(cmt->cmi[ch]);
+}
+
+static void timer_event0(void *opaque)
+{
+    RCMTState *cmt = opaque;
+    
+    timer_events(cmt, 0);
+}
+
+static void timer_event1(void *opaque)
+{
+    RCMTState *cmt = opaque;
+    
+    timer_events(cmt, 1);
+}
+
+static void rcmt_reset(DeviceState *dev)
+{
+    RCMTState *cmt = RCMT(dev);
+    cmt->cmstr = 0;
+    cmt->cmcr[0] = cmt->cmcr[1] = 0;
+    cmt->cmcnt[0] = cmt->cmcnt[1] = 0;
+    cmt->cmcor[0] = cmt->cmcor[1] = 0xffff;
+}
+
+static void rcmt_init(Object *obj)
+{
+    SysBusDevice *d = SYS_BUS_DEVICE(obj);
+    RCMTState *cmt = RCMT(obj);
+    int i;
+    
+    memory_region_init_io(&cmt->memory, OBJECT(cmt), &cmt_ops,
+                          cmt, "renesas-cmt", 0x10);
+    sysbus_init_mmio(d, &cmt->memory);
+
+    for (i = 0; i < 2; i++) {
+        sysbus_init_irq(d, &cmt->cmi[i]);
+    }
+    cmt->timer[0] = timer_new_ns(QEMU_CLOCK_VIRTUAL, timer_event0, cmt);
+    cmt->timer[1] = timer_new_ns(QEMU_CLOCK_VIRTUAL, timer_event1, cmt);
+}
+
+static const VMStateDescription vmstate_rcmt = {
+    .name = "rx-cmt",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property rcmt_properties[] = {
+    DEFINE_PROP_UINT64("input-freq", RCMTState, input_freq, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void rcmt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->props = rcmt_properties;
+    dc->vmsd = &vmstate_rcmt;
+    dc->reset = rcmt_reset;
+}
+
+static const TypeInfo rcmt_info = {
+    .name       = TYPE_RCMT,
+    .parent     = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(RCMTState),
+    .instance_init = rcmt_init,
+    .class_init = rcmt_class_init,
+};
+
+static void rcmt_register_types(void)
+{
+    type_register_static(&rcmt_info);
+}
+
+type_init(rcmt_register_types)

--- a/include/hw/char/renesas_sci.h
+++ b/include/hw/char/renesas_sci.h
@@ -1,77 +1,42 @@
 /*
- * QEMU SCI/SCIF serial port emulation
+ * Renesas Serial Communication Interface
  *
- * Copyright (c) 2007 Magnus Damm
+ * Copyright (c) 2018 Yoshinori Sato
  *
- * Based on serial.c - QEMU 16450 UART emulation
- * Copyright (c) 2003-2004 Fabrice Bellard
+ * This code is licensed under the GPL version 2 or later.
  *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
  */
 
 #include "chardev/char-fe.h"
+#include "qemu/timer.h"
 #include "hw/sysbus.h"
 
-#define RENESAS_SCI_FLAG_TEND (1 << 0)
-#define RENESAS_SCI_FLAG_TDE  (1 << 1)
-#define RENESAS_SCI_FLAG_RDF  (1 << 2)
-#define RENESAS_SCI_FLAG_BRK  (1 << 3)
-#define RENESAS_SCI_FLAG_DR   (1 << 4)
-#define RENESAS_SCI_FLAG_OVF  (1 << 5)
-
-#define SCIF_RX_FIFO_LENGTH (16)
-
-#define TYPE_RENESASSCI "renesas-sci"
-#define RenesasSCI(obj) OBJECT_CHECK(RenesasSCIState, (obj), TYPE_RENESASSCI)
+#define TYPE_RSCI "renesas-sci"
+#define RSCI(obj) OBJECT_CHECK(RSCIState, (obj), TYPE_RSCI)
 
-#define RENESAS_SCI_FEAT_SCIF (1 << 0)
-#define RENESAS_SCI_FEAT_LONG (1 << 1)
-#define RENESAS_SCI_FEAT_ALIAS (1 << 2)
+#define ERI 0
+#define RXI 1
+#define TXI 2
+#define TEI 3
 
 typedef struct {
     SysBusDevice parent_obj;
+    MemoryRegion memory;
 
-    MemoryRegion iomem;
-    MemoryRegion iomem_p4;
-    MemoryRegion iomem_a7;
     uint8_t smr;
     uint8_t brr;
     uint8_t scr;
-    uint8_t dr; /* ftdr / tdr */
-    uint8_t sr; /* fsr / ssr */
-    uint16_t fcr;
-    uint8_t sptr;
-
-    uint8_t rx_fifo[SCIF_RX_FIFO_LENGTH]; /* frdr / rdr */
-    uint8_t rx_cnt;
-    uint8_t rx_tail;
-    uint8_t rx_head;
-
-    uint32_t feat;
-    int flags;
-    int rtrg;
-
+    uint8_t tdr;
+    uint8_t ssr;
+    uint8_t rdr;
+    uint8_t scmr;
+    uint8_t semr;
+
+    uint8_t read_ssr;
+    long long trtime;
+    long long rx_next;
+    QEMUTimer *timer;
     CharBackend chr;
-
-    qemu_irq eri;
-    qemu_irq rxi;
-    qemu_irq txi;
-    qemu_irq tei;
-    qemu_irq bri;
-} RenesasSCIState;
+    uint64_t input_freq;
+    qemu_irq irq[4];
+} RSCIState;

--- /dev/null
+++ b/include/hw/timer/renesas_cmt.h
@@ -0,0 +1,33 @@
+/*
+ * Renesas Compare-match timer Object
+ *
+ * Copyright (c) 2018 Yoshinori Sato
+ *
+ * This code is licensed under the GPL version 2 or later.
+ *
+ */
+
+#ifndef HW_RENESAS_CMT_H
+#define HW_RENESAS_CMT_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_RCMT "rcmt"
+#define RCMT(obj) OBJECT_CHECK(RCMTState, (obj), TYPE_RCMT)
+
+typedef struct RCMTState {
+    SysBusDevice parent_obj;
+
+    uint64_t input_freq;
+    MemoryRegion memory;
+
+    uint16_t cmstr;
+    uint16_t cmcr[2];
+    uint16_t cmcnt[2];
+    uint16_t cmcor[2];
+    int64_t tick[2];
+    qemu_irq cmi[2];
+    QEMUTimer *timer[2];
+} RCMTState;
+
+#endif