Adding upstream version 7.0.14-dfsg.upstream/7.0.14-dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 2132 insertions, 0 deletions

diff --git a/src/VBox/Devices/Serial/UartCore.cpp b/src/VBox/Devices/Serial/UartCore.cpp
new file mode 100644
index 00000000..5e7fa536
--- /dev/null
+++ b/src/VBox/Devices/Serial/UartCore.cpp
@@ -0,0 +1,2132 @@
+/* $Id: UartCore.cpp $ */
+/** @file
+ * UartCore - UART  (16550A up to 16950) emulation.
+ *
+ * The documentation for this device was taken from the PC16550D spec from TI.
+ */
+
+/*
+ * Copyright (C) 2018-2023 Oracle and/or its affiliates.
+ *
+ * This file is part of VirtualBox base platform packages, as
+ * available from https://www.virtualbox.org.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, in version 3 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#define LOG_GROUP LOG_GROUP_DEV_SERIAL
+#include <VBox/vmm/tm.h>
+#include <iprt/log.h>
+#include <iprt/uuid.h>
+#include <iprt/assert.h>
+
+#include "VBoxDD.h"
+#include "UartCore.h"
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+
+/** The RBR/DLL register index (from the base of the port range). */
+#define UART_REG_RBR_DLL_INDEX               0
+
+/** The THR/DLL register index (from the base of the port range). */
+#define UART_REG_THR_DLL_INDEX               0
+
+/** The IER/DLM register index (from the base of the port range). */
+#define UART_REG_IER_DLM_INDEX               1
+/** Enable received data available interrupt */
+# define UART_REG_IER_ERBFI                  RT_BIT(0)
+/** Enable transmitter holding register empty interrupt */
+# define UART_REG_IER_ETBEI                  RT_BIT(1)
+/** Enable receiver line status interrupt */
+# define UART_REG_IER_ELSI                   RT_BIT(2)
+/** Enable modem status interrupt. */
+# define UART_REG_IER_EDSSI                  RT_BIT(3)
+/** Sleep mode enable. */
+# define UART_REG_IER_SLEEP_MODE_EN          RT_BIT(4)
+/** Low power mode enable. */
+# define UART_REG_IER_LP_MODE_EN             RT_BIT(5)
+/** Mask of writeable bits. */
+# define UART_REG_IER_MASK_WR                0x0f
+/** Mask of writeable bits for 16750+. */
+# define UART_REG_IER_MASK_WR_16750          0x3f
+
+/** The IIR register index (from the base of the port range). */
+#define UART_REG_IIR_INDEX                   2
+/** Interrupt Pending - high means no interrupt pending. */
+# define UART_REG_IIR_IP_NO_INT              RT_BIT(0)
+/** Interrupt identification mask. */
+# define UART_REG_IIR_ID_MASK                0x0e
+/** Sets the interrupt identification to the given value. */
+# define UART_REG_IIR_ID_SET(a_Val)          (((a_Val) << 1) & UART_REG_IIR_ID_MASK)
+/** Gets the interrupt identification from the given IIR register value. */
+# define UART_REG_IIR_ID_GET(a_Val)          (((a_Val) & UART_REG_IIR_ID_MASK) >> 1)
+/** Receiver Line Status interrupt. */
+#  define UART_REG_IIR_ID_RCL                0x3
+/** Received Data Available interrupt. */
+#  define UART_REG_IIR_ID_RDA                0x2
+/** Character Timeou Indicator interrupt. */
+#  define UART_REG_IIR_ID_CTI                0x6
+/** Transmitter Holding Register Empty interrupt. */
+#  define UART_REG_IIR_ID_THRE               0x1
+/** Modem Status interrupt. */
+#  define UART_REG_IIR_ID_MS                 0x0
+/** 64 byte FIFOs enabled (15750+ only). */
+# define UART_REG_IIR_64BYTE_FIFOS_EN        RT_BIT(5)
+/** FIFOs enabled. */
+# define UART_REG_IIR_FIFOS_EN               0xc0
+/** Bits relevant for checking whether the interrupt status has changed. */
+# define UART_REG_IIR_CHANGED_MASK           0x0f
+
+/** The FCR register index (from the base of the port range). */
+#define UART_REG_FCR_INDEX                   2
+/** Enable the TX/RX FIFOs. */
+# define UART_REG_FCR_FIFO_EN                RT_BIT(0)
+/** Reset the receive FIFO. */
+# define UART_REG_FCR_RCV_FIFO_RST           RT_BIT(1)
+/** Reset the transmit FIFO. */
+# define UART_REG_FCR_XMIT_FIFO_RST          RT_BIT(2)
+/** DMA Mode Select. */
+# define UART_REG_FCR_DMA_MODE_SEL           RT_BIT(3)
+/** 64 Byte FIFO enable (15750+ only). */
+# define UART_REG_FCR_64BYTE_FIFO_EN         RT_BIT(5)
+/** Receiver level interrupt trigger. */
+# define UART_REG_FCR_RCV_LVL_IRQ_MASK       0xc0
+/** Returns the receive level trigger value from the given FCR register. */
+# define UART_REG_FCR_RCV_LVL_IRQ_GET(a_Fcr) (((a_Fcr) & UART_REG_FCR_RCV_LVL_IRQ_MASK) >> 6)
+/** RCV Interrupt trigger level - 1 byte. */
+# define UART_REG_FCR_RCV_LVL_IRQ_1          0x0
+/** RCV Interrupt trigger level - 4 bytes. */
+# define UART_REG_FCR_RCV_LVL_IRQ_4          0x1
+/** RCV Interrupt trigger level - 8 bytes. */
+# define UART_REG_FCR_RCV_LVL_IRQ_8          0x2
+/** RCV Interrupt trigger level - 14 bytes. */
+# define UART_REG_FCR_RCV_LVL_IRQ_14         0x3
+/** Mask of writeable bits. */
+# define UART_REG_FCR_MASK_WR                0xcf
+/** Mask of sticky bits. */
+# define UART_REG_FCR_MASK_STICKY            0xe9
+
+/** The LCR register index (from the base of the port range). */
+#define UART_REG_LCR_INDEX                   3
+/** Word Length Select Mask. */
+# define UART_REG_LCR_WLS_MASK               0x3
+/** Returns the WLS value form the given LCR register value. */
+# define UART_REG_LCR_WLS_GET(a_Lcr)         ((a_Lcr) & UART_REG_LCR_WLS_MASK)
+/** Number of stop bits. */
+# define UART_REG_LCR_STB                    RT_BIT(2)
+/** Parity Enable. */
+# define UART_REG_LCR_PEN                    RT_BIT(3)
+/** Even Parity. */
+# define UART_REG_LCR_EPS                    RT_BIT(4)
+/** Stick parity. */
+# define UART_REG_LCR_PAR_STICK              RT_BIT(5)
+/** Set Break. */
+# define UART_REG_LCR_BRK_SET                RT_BIT(6)
+/** Divisor Latch Access Bit. */
+# define UART_REG_LCR_DLAB                   RT_BIT(7)
+
+/** The MCR register index (from the base of the port range). */
+#define UART_REG_MCR_INDEX                   4
+/** Data Terminal Ready. */
+# define UART_REG_MCR_DTR                    RT_BIT(0)
+/** Request To Send. */
+# define UART_REG_MCR_RTS                    RT_BIT(1)
+/** Out1. */
+# define UART_REG_MCR_OUT1                   RT_BIT(2)
+/** Out2. */
+# define UART_REG_MCR_OUT2                   RT_BIT(3)
+/** Loopback connection. */
+# define UART_REG_MCR_LOOP                   RT_BIT(4)
+/** Flow Control Enable (15750+ only). */
+# define UART_REG_MCR_AFE                    RT_BIT(5)
+/** Mask of writeable bits (15450 and 15550A). */
+# define UART_REG_MCR_MASK_WR                0x1f
+/** Mask of writeable bits (15750+). */
+# define UART_REG_MCR_MASK_WR_15750          0x3f
+
+/** The LSR register index (from the base of the port range). */
+#define UART_REG_LSR_INDEX                   5
+/** Data Ready. */
+# define UART_REG_LSR_DR                     RT_BIT(0)
+/** Overrun Error. */
+# define UART_REG_LSR_OE                     RT_BIT(1)
+/** Parity Error. */
+# define UART_REG_LSR_PE                     RT_BIT(2)
+/** Framing Error. */
+# define UART_REG_LSR_FE                     RT_BIT(3)
+/** Break Interrupt. */
+# define UART_REG_LSR_BI                     RT_BIT(4)
+/** Transmitter Holding Register. */
+# define UART_REG_LSR_THRE                   RT_BIT(5)
+/** Transmitter Empty. */
+# define UART_REG_LSR_TEMT                   RT_BIT(6)
+/** Error in receiver FIFO. */
+# define UART_REG_LSR_RCV_FIFO_ERR           RT_BIT(7)
+/** The bits to check in this register when checking for the RCL interrupt. */
+# define UART_REG_LSR_BITS_IIR_RCL           0x1e
+
+/** The MSR register index (from the base of the port range). */
+#define UART_REG_MSR_INDEX                   6
+/** Delta Clear to Send. */
+# define UART_REG_MSR_DCTS                   RT_BIT(0)
+/** Delta Data Set Ready. */
+# define UART_REG_MSR_DDSR                   RT_BIT(1)
+/** Trailing Edge Ring Indicator. */
+# define UART_REG_MSR_TERI                   RT_BIT(2)
+/** Delta Data Carrier Detect. */
+# define UART_REG_MSR_DDCD                   RT_BIT(3)
+/** Clear to Send. */
+# define UART_REG_MSR_CTS                    RT_BIT(4)
+/** Data Set Ready. */
+# define UART_REG_MSR_DSR                    RT_BIT(5)
+/** Ring Indicator. */
+# define UART_REG_MSR_RI                     RT_BIT(6)
+/** Data Carrier Detect. */
+# define UART_REG_MSR_DCD                    RT_BIT(7)
+/** The bits to check in this register when checking for the MS interrupt. */
+# define UART_REG_MSR_BITS_IIR_MS            0x0f
+
+/** The SCR register index (from the base of the port range). */
+#define UART_REG_SCR_INDEX                   7
+
+/** Set the specified bits in the given register. */
+#define UART_REG_SET(a_Reg, a_Set)           ((a_Reg) |= (a_Set))
+/** Clear the specified bits in the given register. */
+#define UART_REG_CLR(a_Reg, a_Clr)           ((a_Reg) &= ~(a_Clr))
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+
+#ifndef VBOX_DEVICE_STRUCT_TESTCASE
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+
+#ifdef IN_RING3
+/**
+ * FIFO ITL levels.
+ */
+static struct
+{
+    /** ITL level for a 16byte FIFO. */
+    uint8_t                     cbItl16;
+    /** ITL level for a 64byte FIFO. */
+    uint8_t                     cbItl64;
+} s_aFifoItl[] =
+{
+    /* cbItl16     cbItl64 */
+    {     1,          1    },
+    {     4,         16    },
+    {     8,         32    },
+    {    14,         56    }
+};
+
+
+/**
+ * String versions of the parity enum.
+ */
+static const char *s_aszParity[] =
+{
+    "INVALID",
+    "NONE",
+    "EVEN",
+    "ODD",
+    "MARK",
+    "SPACE",
+    "INVALID"
+};
+
+
+/**
+ * String versions of the stop bits enum.
+ */
+static const char *s_aszStopBits[] =
+{
+    "INVALID",
+    "1",
+    "1.5",
+    "2",
+    "INVALID"
+};
+#endif
+
+
+/*********************************************************************************************************************************
+*   Internal Functions                                                                                                           *
+*********************************************************************************************************************************/
+
+
+/**
+ * Updates the IRQ state based on the current device state.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartIrqUpdate(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    LogFlowFunc(("pThis=%#p\n", pThis));
+
+    /*
+     * The interrupt uses a priority scheme, only the interrupt with the
+     * highest priority is indicated in the interrupt identification register.
+     *
+     * The priorities are as follows (high to low):
+     *      * Receiver line status
+     *      * Received data available
+     *      * Character timeout indication (only in FIFO mode).
+     *      * Transmitter holding register empty
+     *      * Modem status change.
+     */
+    uint8_t uRegIirNew = UART_REG_IIR_IP_NO_INT;
+    if (   (pThis->uRegLsr & UART_REG_LSR_BITS_IIR_RCL)
+        && (pThis->uRegIer & UART_REG_IER_ELSI))
+        uRegIirNew = UART_REG_IIR_ID_SET(UART_REG_IIR_ID_RCL);
+    else if (   (pThis->uRegIer & UART_REG_IER_ERBFI)
+             && pThis->fIrqCtiPending)
+        uRegIirNew = UART_REG_IIR_ID_SET(UART_REG_IIR_ID_CTI);
+    else if (   (pThis->uRegLsr & UART_REG_LSR_DR)
+             && (pThis->uRegIer & UART_REG_IER_ERBFI)
+             && (   !(pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+                 || pThis->FifoRecv.cbUsed >= pThis->FifoRecv.cbItl))
+        uRegIirNew = UART_REG_IIR_ID_SET(UART_REG_IIR_ID_RDA);
+    else if (   (pThis->uRegIer & UART_REG_IER_ETBEI)
+             && pThis->fThreEmptyPending)
+        uRegIirNew = UART_REG_IIR_ID_SET(UART_REG_IIR_ID_THRE);
+    else if (   (pThis->uRegMsr & UART_REG_MSR_BITS_IIR_MS)
+             && (pThis->uRegIer & UART_REG_IER_EDSSI))
+        uRegIirNew = UART_REG_IIR_ID_SET(UART_REG_IIR_ID_MS);
+
+    LogFlowFunc(("    uRegIirNew=%#x uRegIir=%#x\n", uRegIirNew, pThis->uRegIir));
+
+    if (uRegIirNew != (pThis->uRegIir & UART_REG_IIR_CHANGED_MASK))
+        LogFlow(("    Interrupt source changed from %#x -> %#x (IRQ %d -> %d)\n",
+                 pThis->uRegIir, uRegIirNew,
+                 pThis->uRegIir == UART_REG_IIR_IP_NO_INT ? 0 : 1,
+                 uRegIirNew == UART_REG_IIR_IP_NO_INT ? 0 : 1));
+    else
+        LogFlow(("    No change in interrupt source\n"));
+
+    /*
+     * Set interrupt value accordingly. As this is an ISA device most guests
+     * configure the IRQ as edge triggered instead of level triggered.
+     * So this needs to be done everytime, even if the internal interrupt state
+     * doesn't change in order to avoid the guest losing interrupts (reading one byte at
+     * a time from the FIFO for instance which doesn't change the interrupt source).
+     */
+    if (uRegIirNew == UART_REG_IIR_IP_NO_INT)
+        pThisCC->pfnUartIrqReq(pDevIns, pThis, pThis->iLUN, 0);
+    else
+        pThisCC->pfnUartIrqReq(pDevIns, pThis, pThis->iLUN, 1);
+
+    if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+        uRegIirNew |= UART_REG_IIR_FIFOS_EN;
+    if (pThis->uRegFcr & UART_REG_FCR_64BYTE_FIFO_EN)
+        uRegIirNew |= UART_REG_IIR_64BYTE_FIFOS_EN;
+
+    pThis->uRegIir = uRegIirNew;
+}
+
+
+/**
+ * Returns the amount of bytes stored in the given FIFO.
+ *
+ * @returns Amount of bytes stored in the FIFO.
+ * @param   pFifo               The FIFO.
+ */
+DECLINLINE(size_t) uartFifoUsedGet(PUARTFIFO pFifo)
+{
+    return pFifo->cbUsed;
+}
+
+
+/**
+ * Puts a new character into the given FIFO.
+ *
+ * @returns Flag whether the FIFO overflowed.
+ * @param   pFifo               The FIFO to put the data into.
+ * @param   fOvrWr              Flag whether to overwrite data if the FIFO is full.
+ * @param   bData               The data to add.
+ */
+DECLINLINE(bool) uartFifoPut(PUARTFIFO pFifo, bool fOvrWr, uint8_t bData)
+{
+    if (fOvrWr || pFifo->cbUsed < pFifo->cbMax)
+    {
+        pFifo->abBuf[pFifo->offWrite] = bData;
+        pFifo->offWrite = (pFifo->offWrite + 1) % pFifo->cbMax;
+    }
+
+    bool fOverFlow = false;
+    if (pFifo->cbUsed < pFifo->cbMax)
+        pFifo->cbUsed++;
+    else
+    {
+        fOverFlow = true;
+        if (fOvrWr) /* Advance the read position to account for the lost character. */
+           pFifo->offRead = (pFifo->offRead + 1) % pFifo->cbMax;
+    }
+
+    return fOverFlow;
+}
+
+
+/**
+ * Returns the next character in the FIFO.
+ *
+ * @return Next byte in the FIFO.
+ * @param   pFifo               The FIFO to get data from.
+ */
+DECLINLINE(uint8_t) uartFifoGet(PUARTFIFO pFifo)
+{
+    uint8_t bRet = 0;
+
+    if (pFifo->cbUsed)
+    {
+        bRet = pFifo->abBuf[pFifo->offRead];
+        pFifo->offRead = (pFifo->offRead + 1) % pFifo->cbMax;
+        pFifo->cbUsed--;
+    }
+
+    return bRet;
+}
+
+#ifdef IN_RING3
+
+/**
+ * Clears the given FIFO.
+ *
+ * @param   pFifo               The FIFO to clear.
+ */
+DECLINLINE(void) uartFifoClear(PUARTFIFO pFifo)
+{
+    memset(&pFifo->abBuf[0], 0, sizeof(pFifo->abBuf));
+    pFifo->cbUsed   = 0;
+    pFifo->offWrite = 0;
+    pFifo->offRead  = 0;
+}
+
+
+/**
+ * Returns the amount of free bytes in the given FIFO.
+ *
+ * @returns The amount of bytes free in the given FIFO.
+ * @param   pFifo               The FIFO.
+ */
+DECLINLINE(size_t) uartFifoFreeGet(PUARTFIFO pFifo)
+{
+    return pFifo->cbMax - pFifo->cbUsed;
+}
+
+
+/**
+ * Tries to copy the requested amount of data from the given FIFO into the provided buffer.
+ *
+ * @returns Amount of bytes actually copied.
+ * @param   pFifo               The FIFO to copy data from.
+ * @param   pvDst               Where to copy the data to.
+ * @param   cbCopy              How much to copy.
+ */
+DECLINLINE(size_t) uartFifoCopyTo(PUARTFIFO pFifo, void *pvDst, size_t cbCopy)
+{
+    size_t cbCopied = 0;
+    uint8_t *pbDst = (uint8_t *)pvDst;
+
+    cbCopy = RT_MIN(cbCopy, pFifo->cbUsed);
+    while (cbCopy)
+    {
+        uint8_t cbThisCopy = (uint8_t)RT_MIN(cbCopy, (uint8_t)(pFifo->cbMax - pFifo->offRead));
+        memcpy(pbDst, &pFifo->abBuf[pFifo->offRead], cbThisCopy);
+
+        pFifo->offRead = (pFifo->offRead + cbThisCopy) % pFifo->cbMax;
+        pFifo->cbUsed -= cbThisCopy;
+        pbDst    += cbThisCopy;
+        cbCopied += cbThisCopy;
+        cbCopy   -= cbThisCopy;
+    }
+
+    return cbCopied;
+}
+
+
+#if 0 /* unused */
+/**
+ * Tries to copy the requested amount of data from the provided buffer into the given FIFO.
+ *
+ * @returns Amount of bytes actually copied.
+ * @param   pFifo               The FIFO to copy data to.
+ * @param   pvSrc               Where to copy the data from.
+ * @param   cbCopy              How much to copy.
+ */
+DECLINLINE(size_t) uartFifoCopyFrom(PUARTFIFO pFifo, void *pvSrc, size_t cbCopy)
+{
+    size_t cbCopied = 0;
+    uint8_t *pbSrc = (uint8_t *)pvSrc;
+
+    cbCopy = RT_MIN(cbCopy, uartFifoFreeGet(pFifo));
+    while (cbCopy)
+    {
+        uint8_t cbThisCopy = (uint8_t)RT_MIN(cbCopy, (uint8_t)(pFifo->cbMax - pFifo->offWrite));
+        memcpy(&pFifo->abBuf[pFifo->offWrite], pbSrc, cbThisCopy);
+
+        pFifo->offWrite = (pFifo->offWrite + cbThisCopy) % pFifo->cbMax;
+        pFifo->cbUsed += cbThisCopy;
+        pbSrc    += cbThisCopy;
+        cbCopied += cbThisCopy;
+        cbCopy   -= cbThisCopy;
+    }
+
+    return cbCopied;
+}
+#endif
+
+
+/**
+ * Updates the delta bits for the given MSR register value which has the status line
+ * bits set.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uMsrSts             MSR value with the appropriate status bits set.
+ */
+static void uartR3MsrUpdate(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uMsrSts)
+{
+    /* Compare current and new states and set remaining bits accordingly. */
+    if ((uMsrSts & UART_REG_MSR_CTS) != (pThis->uRegMsr & UART_REG_MSR_CTS))
+        uMsrSts |= UART_REG_MSR_DCTS;
+    if ((uMsrSts & UART_REG_MSR_DSR) != (pThis->uRegMsr & UART_REG_MSR_DSR))
+        uMsrSts |= UART_REG_MSR_DDSR;
+    if ((uMsrSts & UART_REG_MSR_RI) != 0 && (pThis->uRegMsr & UART_REG_MSR_RI) == 0)
+        uMsrSts |= UART_REG_MSR_TERI;
+    if ((uMsrSts & UART_REG_MSR_DCD) != (pThis->uRegMsr & UART_REG_MSR_DCD))
+        uMsrSts |= UART_REG_MSR_DDCD;
+
+    pThis->uRegMsr = uMsrSts;
+
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+}
+
+
+/**
+ * Updates the serial port parameters of the attached driver with the current configuration.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartR3ParamsUpdate(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    if (   pThis->uRegDivisor != 0
+        && pThisCC->pDrvSerial)
+    {
+        uint32_t uBps = 115200 / pThis->uRegDivisor; /* This is for PC compatible serial port with a 1.8432 MHz crystal. */
+        unsigned cDataBits = UART_REG_LCR_WLS_GET(pThis->uRegLcr) + 5;
+        uint32_t cFrameBits = cDataBits;
+        PDMSERIALSTOPBITS enmStopBits = PDMSERIALSTOPBITS_ONE;
+        PDMSERIALPARITY enmParity = PDMSERIALPARITY_NONE;
+
+        if (pThis->uRegLcr & UART_REG_LCR_STB)
+        {
+            enmStopBits = cDataBits == 5 ? PDMSERIALSTOPBITS_ONEPOINTFIVE : PDMSERIALSTOPBITS_TWO;
+            cFrameBits += 2;
+        }
+        else
+            cFrameBits++;
+
+        if (pThis->uRegLcr & UART_REG_LCR_PEN)
+        {
+            /* Select the correct parity mode based on the even and stick parity bits. */
+            switch (pThis->uRegLcr & (UART_REG_LCR_EPS | UART_REG_LCR_PAR_STICK))
+            {
+                case 0:
+                    enmParity = PDMSERIALPARITY_ODD;
+                    break;
+                case UART_REG_LCR_EPS:
+                    enmParity = PDMSERIALPARITY_EVEN;
+                    break;
+                case UART_REG_LCR_EPS | UART_REG_LCR_PAR_STICK:
+                    enmParity = PDMSERIALPARITY_SPACE;
+                    break;
+                case UART_REG_LCR_PAR_STICK:
+                    enmParity = PDMSERIALPARITY_MARK;
+                    break;
+                default:
+                    /* We should never get here as all cases where caught earlier. */
+                    AssertMsgFailed(("This shouldn't happen at all: %#x\n",
+                                     pThis->uRegLcr & (UART_REG_LCR_EPS | UART_REG_LCR_PAR_STICK)));
+            }
+
+            cFrameBits++;
+        }
+
+        uint64_t uTimerFreq = PDMDevHlpTimerGetFreq(pDevIns, pThis->hTimerRcvFifoTimeout);
+        pThis->cSymbolXferTicks = (uTimerFreq / uBps) * cFrameBits;
+
+        LogFlowFunc(("Changing parameters to: %u,%s,%u,%s\n",
+                     uBps, s_aszParity[enmParity], cDataBits, s_aszStopBits[enmStopBits]));
+
+        int rc = pThisCC->pDrvSerial->pfnChgParams(pThisCC->pDrvSerial, uBps, enmParity, cDataBits, enmStopBits);
+        if (RT_FAILURE(rc))
+            LogRelMax(10, ("Serial#%d: Failed to change parameters to %u,%s,%u,%s -> %Rrc\n",
+                           pDevIns->iInstance, uBps, s_aszParity[enmParity], cDataBits, s_aszStopBits[enmStopBits], rc));
+
+        /* Changed parameters will flush all receive queues, so there won't be any data to read even if indicated. */
+        pThisCC->pDrvSerial->pfnQueuesFlush(pThisCC->pDrvSerial, true /*fQueueRecv*/, false /*fQueueXmit*/);
+        ASMAtomicWriteU32(&pThis->cbAvailRdr, 0);
+        UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_DR);
+    }
+}
+
+
+/**
+ * Updates the internal device state with the given PDM status line states.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   fStsLines           The PDM status line states.
+ */
+static void uartR3StsLinesUpdate(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint32_t fStsLines)
+{
+    uint8_t uRegMsrNew = 0; /* The new MSR value. */
+
+    if (fStsLines & PDMISERIALPORT_STS_LINE_DCD)
+        uRegMsrNew |= UART_REG_MSR_DCD;
+    if (fStsLines & PDMISERIALPORT_STS_LINE_RI)
+        uRegMsrNew |= UART_REG_MSR_RI;
+    if (fStsLines & PDMISERIALPORT_STS_LINE_DSR)
+        uRegMsrNew |= UART_REG_MSR_DSR;
+    if (fStsLines & PDMISERIALPORT_STS_LINE_CTS)
+        uRegMsrNew |= UART_REG_MSR_CTS;
+
+    uartR3MsrUpdate(pDevIns, pThis, pThisCC, uRegMsrNew);
+}
+
+
+/**
+ * Fills up the receive FIFO with as much data as possible.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartR3RecvFifoFill(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    LogFlowFunc(("pThis=%#p\n", pThis));
+
+    PUARTFIFO pFifo = &pThis->FifoRecv;
+    size_t cbFill = RT_MIN(uartFifoFreeGet(pFifo),
+                           ASMAtomicReadU32(&pThis->cbAvailRdr));
+    size_t cbFilled = 0;
+
+    while (cbFilled < cbFill)
+    {
+        size_t cbThisRead = cbFill - cbFilled;
+
+        if (pFifo->offRead <= pFifo->offWrite)
+            cbThisRead = RT_MIN(cbThisRead, (uint8_t)(pFifo->cbMax - pFifo->offWrite));
+        else
+            cbThisRead = RT_MIN(cbThisRead, (uint8_t)(pFifo->offRead - pFifo->offWrite));
+
+        size_t cbRead = 0;
+        int rc = pThisCC->pDrvSerial->pfnReadRdr(pThisCC->pDrvSerial, &pFifo->abBuf[pFifo->offWrite], cbThisRead, &cbRead);
+        AssertRC(rc); Assert(cbRead <= UINT8_MAX); RT_NOREF(rc);
+
+        pFifo->offWrite = (pFifo->offWrite + (uint8_t)cbRead) % pFifo->cbMax;
+        pFifo->cbUsed   += (uint8_t)cbRead;
+        cbFilled        += cbRead;
+
+        if (cbRead < cbThisRead)
+            break;
+    }
+
+    if (cbFilled)
+    {
+        UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_DR);
+        if (pFifo->cbUsed < pFifo->cbItl)
+        {
+            pThis->fIrqCtiPending = false;
+            PDMDevHlpTimerSetRelative(pDevIns, pThis->hTimerRcvFifoTimeout, pThis->cSymbolXferTicks * 4, NULL);
+        }
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+
+    Assert(cbFilled <= (size_t)pThis->cbAvailRdr);
+    ASMAtomicSubU32(&pThis->cbAvailRdr, (uint32_t)cbFilled);
+}
+
+
+/**
+ * Fetches a single byte and writes it to RBR.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartR3ByteFetch(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    if (ASMAtomicReadU32(&pThis->cbAvailRdr))
+    {
+        size_t cbRead = 0;
+        int rc2 = pThisCC->pDrvSerial->pfnReadRdr(pThisCC->pDrvSerial, &pThis->uRegRbr, 1, &cbRead);
+        AssertMsg(RT_SUCCESS(rc2) && cbRead == 1, ("This shouldn't fail and always return one byte!\n")); RT_NOREF(rc2);
+        UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_DR);
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+}
+
+
+/**
+ * Fetches a ready data based on the FIFO setting.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartR3DataFetch(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    AssertPtrReturnVoid(pThisCC->pDrvSerial);
+
+    if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+        uartR3RecvFifoFill(pDevIns, pThis, pThisCC);
+    else
+        uartR3ByteFetch(pDevIns, pThis, pThisCC);
+}
+
+
+/**
+ * Reset the transmit/receive related bits to the standard values
+ * (after a detach/attach/reset event).
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+static void uartR3XferReset(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    PDMDevHlpTimerStop(pDevIns, pThis->hTimerRcvFifoTimeout);
+    PDMDevHlpTimerStop(pDevIns, pThis->hTimerTxUnconnected);
+    pThis->uRegLsr = UART_REG_LSR_THRE | UART_REG_LSR_TEMT;
+    pThis->fThreEmptyPending = false;
+
+    uartFifoClear(&pThis->FifoXmit);
+    uartFifoClear(&pThis->FifoRecv);
+    uartR3ParamsUpdate(pDevIns, pThis, pThisCC);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+
+    if (pThisCC->pDrvSerial)
+    {
+        /* Set the modem lines to reflect the current state. */
+        int rc = pThisCC->pDrvSerial->pfnChgModemLines(pThisCC->pDrvSerial, false /*fRts*/, false /*fDtr*/);
+        if (RT_FAILURE(rc))
+            LogRel(("Serial#%d: Failed to set modem lines with %Rrc during reset\n",
+                    pDevIns->iInstance, rc));
+
+        uint32_t fStsLines = 0;
+        rc = pThisCC->pDrvSerial->pfnQueryStsLines(pThisCC->pDrvSerial, &fStsLines);
+        if (RT_SUCCESS(rc))
+            uartR3StsLinesUpdate(pDevIns, pThis, pThisCC, fStsLines);
+        else
+            LogRel(("Serial#%d: Failed to query status line status with %Rrc during reset\n",
+                    pDevIns->iInstance, rc));
+    }
+
+}
+
+
+/**
+ * Tries to copy the specified amount of data from the active TX queue (register or FIFO).
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   pvBuf               Where to store the data.
+ * @param   cbRead              How much to read from the TX queue.
+ * @param   pcbRead             Where to store the amount of data read.
+ */
+static void uartR3TxQueueCopyFrom(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC,
+                                  void *pvBuf, size_t cbRead, size_t *pcbRead)
+{
+    if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+    {
+        *pcbRead = uartFifoCopyTo(&pThis->FifoXmit, pvBuf, cbRead);
+        if (!pThis->FifoXmit.cbUsed)
+        {
+            UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_THRE);
+            pThis->fThreEmptyPending = true;
+        }
+        if (*pcbRead)
+            UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_TEMT);
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+    else if (!(pThis->uRegLsr & UART_REG_LSR_THRE))
+    {
+        *(uint8_t *)pvBuf = pThis->uRegThr;
+        *pcbRead = 1;
+        UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_THRE);
+        UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_TEMT);
+        pThis->fThreEmptyPending = true;
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+    else
+    {
+        /*
+         * This can happen if there was data in the FIFO when the connection was closed,
+         * indicate this condition to the lower driver by returning 0 bytes.
+         */
+        *pcbRead = 0;
+    }
+}
+
+#endif /* IN_RING3 */
+
+
+/**
+ * Transmits the given byte.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   bVal                Byte to transmit.
+ */
+static VBOXSTRICTRC uartXmit(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t bVal)
+{
+    int rc = VINF_SUCCESS;
+#ifdef IN_RING3
+    bool fNotifyDrv = false;
+#endif
+
+    if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+    {
+#ifndef IN_RING3
+        RT_NOREF(pDevIns, pThisCC);
+        if (!uartFifoUsedGet(&pThis->FifoXmit))
+            rc = VINF_IOM_R3_IOPORT_WRITE;
+        else
+        {
+            uartFifoPut(&pThis->FifoXmit, true /*fOvrWr*/, bVal);
+            UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_THRE | UART_REG_LSR_TEMT);
+        }
+#else
+        uartFifoPut(&pThis->FifoXmit, true /*fOvrWr*/, bVal);
+        UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_THRE | UART_REG_LSR_TEMT);
+        pThis->fThreEmptyPending = false;
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+        if (uartFifoUsedGet(&pThis->FifoXmit) == 1)
+            fNotifyDrv = true;
+#endif
+    }
+    else
+    {
+        /* Notify the lower driver about available data only if the register was empty before. */
+        if (pThis->uRegLsr & UART_REG_LSR_THRE)
+        {
+#ifndef IN_RING3
+            rc = VINF_IOM_R3_IOPORT_WRITE;
+#else
+            pThis->uRegThr = bVal;
+            UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_THRE | UART_REG_LSR_TEMT);
+            pThis->fThreEmptyPending = false;
+            uartIrqUpdate(pDevIns, pThis, pThisCC);
+            fNotifyDrv = true;
+#endif
+        }
+        else
+            pThis->uRegThr = bVal;
+    }
+
+#ifdef IN_RING3
+    if (fNotifyDrv)
+    {
+        /* Leave the device critical section before calling into the lower driver. */
+        PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+
+        if (   pThisCC->pDrvSerial
+            && !(pThis->uRegMcr & UART_REG_MCR_LOOP))
+        {
+            int rc2 = pThisCC->pDrvSerial->pfnDataAvailWrNotify(pThisCC->pDrvSerial);
+            if (RT_FAILURE(rc2))
+                LogRelMax(10, ("Serial#%d: Failed to send data with %Rrc\n", pDevIns->iInstance, rc2));
+        }
+        else
+            PDMDevHlpTimerSetRelative(pDevIns, pThis->hTimerTxUnconnected, pThis->cSymbolXferTicks, NULL);
+
+        rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VINF_SUCCESS);
+    }
+#endif
+
+    return rc;
+}
+
+
+/**
+ * Write handler for the THR/DLL register (depending on the DLAB bit in LCR).
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uVal                The value to write.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegThrDllWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uVal)
+{
+    VBOXSTRICTRC rc = VINF_SUCCESS;
+
+    /* A set DLAB causes a write to the lower 8bits of the divisor latch. */
+    if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+    {
+        if (uVal != (pThis->uRegDivisor & 0xff))
+        {
+#ifndef IN_RING3
+            rc = VINF_IOM_R3_IOPORT_WRITE;
+#else
+            pThis->uRegDivisor = (pThis->uRegDivisor & 0xff00) | uVal;
+            uartR3ParamsUpdate(pDevIns, pThis, pThisCC);
+#endif
+        }
+    }
+    else
+        rc = uartXmit(pDevIns, pThis, pThisCC, uVal);
+
+    return rc;
+}
+
+
+/**
+ * Write handler for the IER/DLM register (depending on the DLAB bit in LCR).
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uVal                The value to write.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegIerDlmWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uVal)
+{
+    /* A set DLAB causes a write to the higher 8bits of the divisor latch. */
+    if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+    {
+        if (uVal != (pThis->uRegDivisor & 0xff00) >> 8)
+        {
+#ifndef IN_RING3
+            return VINF_IOM_R3_IOPORT_WRITE;
+#else
+            pThis->uRegDivisor = (pThis->uRegDivisor & 0xff) | (uVal << 8);
+            uartR3ParamsUpdate(pDevIns, pThis, pThisCC);
+#endif
+        }
+    }
+    else
+    {
+        if (pThis->enmType < UARTTYPE_16750)
+            pThis->uRegIer = uVal & UART_REG_IER_MASK_WR;
+        else
+            pThis->uRegIer = uVal & UART_REG_IER_MASK_WR_16750;
+
+        if (pThis->uRegLsr & UART_REG_LSR_THRE)
+            pThis->fThreEmptyPending = true;
+
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Write handler for the FCR register.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uVal                The value to write.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegFcrWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uVal)
+{
+#ifndef IN_RING3
+    RT_NOREF(pDevIns, pThis, pThisCC, uVal);
+    return VINF_IOM_R3_IOPORT_WRITE;
+#else /* IN_RING3 */
+    if (   pThis->enmType >= UARTTYPE_16550A
+        && uVal != pThis->uRegFcr)
+    {
+        /* A change in the FIFO enable bit clears both FIFOs automatically. */
+        if ((uVal ^ pThis->uRegFcr) & UART_REG_FCR_FIFO_EN)
+        {
+            uartFifoClear(&pThis->FifoXmit);
+            uartFifoClear(&pThis->FifoRecv);
+
+            /*
+             * If the FIFO is about to be enabled and the DR bit is ready we have an unacknowledged
+             * byte in the RBR register which will be lost so we have to adjust the available bytes.
+             */
+            if (   ASMAtomicReadU32(&pThis->cbAvailRdr) > 0
+                && (uVal & UART_REG_FCR_FIFO_EN))
+                ASMAtomicDecU32(&pThis->cbAvailRdr);
+
+            /* Clear the DR bit too. */
+            UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_DR);
+        }
+
+        /** @todo r=bird: Why was this here: if (rc == VINF_SUCCESS) */
+        {
+            if (uVal & UART_REG_FCR_RCV_FIFO_RST)
+            {
+                PDMDevHlpTimerStop(pDevIns, pThis->hTimerRcvFifoTimeout);
+                pThis->fIrqCtiPending = false;
+                uartFifoClear(&pThis->FifoRecv);
+            }
+            if (uVal & UART_REG_FCR_XMIT_FIFO_RST)
+                uartFifoClear(&pThis->FifoXmit);
+
+            /*
+             * The 64byte FIFO enable bit is only changeable for 16750
+             * and if the DLAB bit in LCR is set.
+             */
+            if (   pThis->enmType < UARTTYPE_16750
+                || !(pThis->uRegLcr & UART_REG_LCR_DLAB))
+                uVal &= ~UART_REG_FCR_64BYTE_FIFO_EN;
+            else /* Use previous value. */
+                uVal |= pThis->uRegFcr & UART_REG_FCR_64BYTE_FIFO_EN;
+
+            if (uVal & UART_REG_FCR_64BYTE_FIFO_EN)
+            {
+                pThis->FifoRecv.cbMax = 64;
+                pThis->FifoXmit.cbMax = 64;
+            }
+            else
+            {
+                pThis->FifoRecv.cbMax = 16;
+                pThis->FifoXmit.cbMax = 16;
+            }
+
+            if (uVal & UART_REG_FCR_FIFO_EN)
+            {
+                uint8_t idxItl = UART_REG_FCR_RCV_LVL_IRQ_GET(uVal);
+                if (uVal & UART_REG_FCR_64BYTE_FIFO_EN)
+                    pThis->FifoRecv.cbItl = s_aFifoItl[idxItl].cbItl64;
+                else
+                    pThis->FifoRecv.cbItl = s_aFifoItl[idxItl].cbItl16;
+            }
+
+            /* The FIFO reset bits are self clearing. */
+            pThis->uRegFcr = uVal & UART_REG_FCR_MASK_STICKY;
+            uartIrqUpdate(pDevIns, pThis, pThisCC);
+        }
+
+        /* Fill in the next data. */
+        if (ASMAtomicReadU32(&pThis->cbAvailRdr))
+            uartR3DataFetch(pDevIns, pThis, pThisCC);
+    }
+
+    return VINF_SUCCESS;
+#endif /* IN_RING3 */
+}
+
+
+/**
+ * Write handler for the LCR register.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uVal                The value to write.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegLcrWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uVal)
+{
+    /* Any change except the DLAB bit causes a switch to R3. */
+    if ((pThis->uRegLcr & ~UART_REG_LCR_DLAB) != (uVal & ~UART_REG_LCR_DLAB))
+    {
+#ifndef IN_RING3
+        RT_NOREF(pThisCC, pDevIns);
+        return VINF_IOM_R3_IOPORT_WRITE;
+#else
+        /* Check whether the BREAK bit changed before updating the LCR value. */
+        bool fBrkEn = RT_BOOL(uVal & UART_REG_LCR_BRK_SET);
+        bool fBrkChg = fBrkEn != RT_BOOL(pThis->uRegLcr & UART_REG_LCR_BRK_SET);
+        pThis->uRegLcr = uVal;
+        uartR3ParamsUpdate(pDevIns, pThis, pThisCC);
+
+        if (   fBrkChg
+            && pThisCC->pDrvSerial)
+            pThisCC->pDrvSerial->pfnChgBrk(pThisCC->pDrvSerial, fBrkEn);
+#endif
+    }
+    else
+        pThis->uRegLcr = uVal;
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Write handler for the MCR register.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   uVal                The value to write.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegMcrWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint8_t uVal)
+{
+    if (pThis->enmType < UARTTYPE_16750)
+        uVal &= UART_REG_MCR_MASK_WR;
+    else
+        uVal &= UART_REG_MCR_MASK_WR_15750;
+    if (pThis->uRegMcr != uVal)
+    {
+#ifndef IN_RING3
+        RT_NOREF(pThisCC, pDevIns);
+        return VINF_IOM_R3_IOPORT_WRITE;
+#else
+        /*
+         * When loopback mode is activated the RTS, DTR, OUT1 and OUT2 lines are
+         * disconnected and looped back to MSR.
+         */
+        if (   (uVal & UART_REG_MCR_LOOP)
+            && !(pThis->uRegMcr & UART_REG_MCR_LOOP)
+            && pThisCC->pDrvSerial)
+            pThisCC->pDrvSerial->pfnChgModemLines(pThisCC->pDrvSerial, false /*fRts*/, false /*fDtr*/);
+
+        pThis->uRegMcr = uVal;
+        if (uVal & UART_REG_MCR_LOOP)
+        {
+            uint8_t uRegMsrSts = 0;
+
+            if (uVal & UART_REG_MCR_RTS)
+                uRegMsrSts |= UART_REG_MSR_CTS;
+            if (uVal & UART_REG_MCR_DTR)
+                uRegMsrSts |= UART_REG_MSR_DSR;
+            if (uVal & UART_REG_MCR_OUT1)
+                uRegMsrSts |= UART_REG_MSR_RI;
+            if (uVal & UART_REG_MCR_OUT2)
+                uRegMsrSts |= UART_REG_MSR_DCD;
+            uartR3MsrUpdate(pDevIns, pThis, pThisCC, uRegMsrSts);
+        }
+        else if (pThisCC->pDrvSerial)
+        {
+            pThisCC->pDrvSerial->pfnChgModemLines(pThisCC->pDrvSerial,
+                                                  RT_BOOL(uVal & UART_REG_MCR_RTS),
+                                                  RT_BOOL(uVal & UART_REG_MCR_DTR));
+
+            uint32_t fStsLines = 0;
+            int rc = pThisCC->pDrvSerial->pfnQueryStsLines(pThisCC->pDrvSerial, &fStsLines);
+            if (RT_SUCCESS(rc))
+                uartR3StsLinesUpdate(pDevIns, pThis, pThisCC, fStsLines);
+            else
+                LogRelMax(10, ("Serial#%d: Failed to query status line status with %Rrc during reset\n",
+                               pDevIns->iInstance, rc));
+        }
+        else /* Loopback mode got disabled and no driver attached, fake presence. */
+            uartR3MsrUpdate(pDevIns, pThis, pThisCC, UART_REG_MSR_DCD | UART_REG_MSR_CTS | UART_REG_MSR_DSR);
+#endif
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Read handler for the RBR/DLL register (depending on the DLAB bit in LCR).
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   puVal               Where to store the read value on success.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegRbrDllRead(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint32_t *puVal)
+{
+    VBOXSTRICTRC rc = VINF_SUCCESS;
+
+    /* A set DLAB causes a read from the lower 8bits of the divisor latch. */
+    if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+        *puVal = pThis->uRegDivisor & 0xff;
+    else
+    {
+        if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+        {
+            /*
+             * Only go back to R3 if there is new data available for the FIFO
+             * and we would clear the interrupt to fill it up again.
+             */
+            if (   pThis->FifoRecv.cbUsed <= pThis->FifoRecv.cbItl
+                && ASMAtomicReadU32(&pThis->cbAvailRdr) > 0)
+            {
+#ifndef IN_RING3
+                rc = VINF_IOM_R3_IOPORT_READ;
+#else
+                uartR3RecvFifoFill(pDevIns, pThis, pThisCC);
+#endif
+            }
+
+            if (rc == VINF_SUCCESS)
+            {
+                *puVal = uartFifoGet(&pThis->FifoRecv);
+                pThis->fIrqCtiPending = false;
+                if (!pThis->FifoRecv.cbUsed)
+                {
+                    PDMDevHlpTimerStop(pDevIns, pThis->hTimerRcvFifoTimeout);
+                    UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_DR);
+                }
+                else if (pThis->FifoRecv.cbUsed < pThis->FifoRecv.cbItl)
+                    PDMDevHlpTimerSetRelative(pDevIns, pThis->hTimerRcvFifoTimeout,
+                                              pThis->cSymbolXferTicks * 4, NULL);
+                uartIrqUpdate(pDevIns, pThis, pThisCC);
+            }
+        }
+        else
+        {
+            *puVal = pThis->uRegRbr;
+
+            if (pThis->uRegLsr & UART_REG_LSR_DR)
+            {
+                Assert(pThis->cbAvailRdr);
+                uint32_t cbAvail = ASMAtomicDecU32(&pThis->cbAvailRdr);
+                if (!cbAvail)
+                {
+                    UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_DR);
+                    uartIrqUpdate(pDevIns, pThis, pThisCC);
+                }
+                else
+                {
+#ifndef IN_RING3
+                    /* Restore state and go back to R3. */
+                    ASMAtomicIncU32(&pThis->cbAvailRdr);
+                    rc = VINF_IOM_R3_IOPORT_READ;
+#else
+                    /* Fetch new data and keep the DR bit set. */
+                    uartR3DataFetch(pDevIns, pThis, pThisCC);
+#endif
+                }
+            }
+        }
+    }
+
+    return rc;
+}
+
+
+/**
+ * Read handler for the IER/DLM register (depending on the DLAB bit in LCR).
+ *
+ * @param   pThis               The shared serial port instance data.
+ * @param   puVal               Where to store the read value on success.
+ */
+DECLINLINE(void) uartRegIerDlmRead(PUARTCORE pThis, uint32_t *puVal)
+{
+    /* A set DLAB causes a read from the upper 8bits of the divisor latch. */
+    if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+        *puVal = (pThis->uRegDivisor & 0xff00) >> 8;
+    else
+        *puVal = pThis->uRegIer;
+}
+
+
+/**
+ * Read handler for the IIR register.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   puVal               Where to store the read value on success.
+ */
+DECLINLINE(void) uartRegIirRead(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint32_t *puVal)
+{
+    *puVal = pThis->uRegIir;
+    /* Reset the THRE empty interrupt id when this gets returned to the guest (see table 3 UART Reset configuration). */
+    if (UART_REG_IIR_ID_GET(pThis->uRegIir) == UART_REG_IIR_ID_THRE)
+    {
+        pThis->fThreEmptyPending = false;
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+}
+
+
+/**
+ * Read handler for the LSR register.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   puVal               Where to store the read value on success.
+ */
+DECLINLINE(VBOXSTRICTRC) uartRegLsrRead(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint32_t *puVal)
+{
+    /* Yield if configured and there is no data available. */
+    if (   !(pThis->uRegLsr & UART_REG_LSR_DR)
+        && (pThis->fFlags & UART_CORE_YIELD_ON_LSR_READ))
+    {
+#ifndef IN_RING3
+        return VINF_IOM_R3_IOPORT_READ;
+#else
+        RTThreadYield();
+#endif
+    }
+
+    *puVal = pThis->uRegLsr;
+    /*
+     * Reading this register clears the Overrun (OE), Parity (PE) and Framing (FE) error
+     * as well as the Break Interrupt (BI).
+     */
+    UART_REG_CLR(pThis->uRegLsr, UART_REG_LSR_BITS_IIR_RCL);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Read handler for the MSR register.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   puVal               Where to store the read value on success.
+ */
+DECLINLINE(void) uartRegMsrRead(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, uint32_t *puVal)
+{
+    *puVal = pThis->uRegMsr;
+
+    /* Clear any of the delta bits. */
+    UART_REG_CLR(pThis->uRegMsr, UART_REG_MSR_BITS_IIR_MS);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+}
+
+
+#ifdef LOG_ENABLED
+/**
+ * Converts the register index into a sensible memnonic.
+ *
+ * @returns Register memnonic.
+ * @param   pThis               The shared serial port instance data.
+ * @param   idxReg              Register index.
+ * @param   fWrite              Flag whether the register gets written.
+ */
+DECLINLINE(const char *) uartRegIdx2Str(PUARTCORE pThis, uint8_t idxReg, bool fWrite)
+{
+    const char *psz = "INV";
+
+    switch (idxReg)
+    {
+        /*case UART_REG_THR_DLL_INDEX:*/
+        case UART_REG_RBR_DLL_INDEX:
+            if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+                psz = "DLL";
+            else if (fWrite)
+                psz = "THR";
+            else
+                psz = "RBR";
+            break;
+        case UART_REG_IER_DLM_INDEX:
+            if (pThis->uRegLcr & UART_REG_LCR_DLAB)
+                psz = "DLM";
+            else
+                psz = "IER";
+            break;
+        /*case UART_REG_IIR_INDEX:*/
+        case UART_REG_FCR_INDEX:
+            if (fWrite)
+                psz = "FCR";
+            else
+                psz = "IIR";
+            break;
+        case UART_REG_LCR_INDEX:
+            psz = "LCR";
+            break;
+        case UART_REG_MCR_INDEX:
+            psz = "MCR";
+            break;
+        case UART_REG_LSR_INDEX:
+            psz = "LSR";
+            break;
+        case UART_REG_MSR_INDEX:
+            psz = "MSR";
+            break;
+        case UART_REG_SCR_INDEX:
+            psz = "SCR";
+            break;
+    }
+
+    return psz;
+}
+#endif
+
+
+/**
+ * Performs a register write to the given register offset.
+ *
+ * @returns Strict VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared UART core instance data.
+ * @param   pThisCC             The current context UART core instance data.
+ * @param   uReg                The register offset (byte offset) to start writing to.
+ * @param   u32                 The value to write.
+ * @param   cb                  Number of bytes to write.
+ */
+DECLHIDDEN(VBOXSTRICTRC) uartRegWrite(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC,
+                                      uint32_t uReg, uint32_t u32, size_t cb)
+{
+    AssertMsgReturn(cb == 1, ("uReg=%#x cb=%d u32=%#x\n", uReg, cb, u32), VINF_SUCCESS);
+
+    VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VINF_IOM_R3_IOPORT_WRITE);
+    if (rc == VINF_SUCCESS)
+    {
+        uint8_t idxReg = uReg & 0x7;
+        LogFlowFunc(("pThis=%#p uReg=%u{%s} u32=%#x cb=%u\n",
+                     pThis, uReg, uartRegIdx2Str(pThis, idxReg, true /*fWrite*/), u32, cb));
+
+        uint8_t uVal = (uint8_t)u32;
+        switch (idxReg)
+        {
+            case UART_REG_THR_DLL_INDEX:
+                rc = uartRegThrDllWrite(pDevIns, pThis, pThisCC, uVal);
+                break;
+            case UART_REG_IER_DLM_INDEX:
+                rc = uartRegIerDlmWrite(pDevIns, pThis, pThisCC, uVal);
+                break;
+            case UART_REG_FCR_INDEX:
+                rc = uartRegFcrWrite(pDevIns, pThis, pThisCC, uVal);
+                break;
+            case UART_REG_LCR_INDEX:
+                rc = uartRegLcrWrite(pDevIns, pThis, pThisCC, uVal);
+                break;
+            case UART_REG_MCR_INDEX:
+                rc = uartRegMcrWrite(pDevIns, pThis, pThisCC, uVal);
+                break;
+            case UART_REG_SCR_INDEX:
+                pThis->uRegScr = uVal;
+                break;
+            default:
+                break;
+        }
+
+        PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    }
+    LogFlowFunc(("-> %Rrc\n", VBOXSTRICTRC_VAL(rc)));
+    return rc;
+}
+
+
+/**
+ * Performs a register read from the given register offset.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared UART core instance data.
+ * @param   pThisCC             The current context UART core instance data.
+ * @param   uReg                The register offset (byte offset) to start reading from.
+ * @param   pu32                Where to store the read value.
+ * @param   cb                  Number of bytes to read.
+ */
+DECLHIDDEN(VBOXSTRICTRC) uartRegRead(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC,
+                                     uint32_t uReg, uint32_t *pu32, size_t cb)
+{
+    if (cb != 1)
+        return VERR_IOM_IOPORT_UNUSED;
+
+    VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VINF_IOM_R3_IOPORT_READ);
+    if (rc == VINF_SUCCESS)
+    {
+        uint8_t idxReg = uReg & 0x7;
+        switch (idxReg)
+        {
+            case UART_REG_RBR_DLL_INDEX:
+                rc = uartRegRbrDllRead(pDevIns, pThis, pThisCC, pu32);
+                break;
+            case UART_REG_IER_DLM_INDEX:
+                uartRegIerDlmRead(pThis, pu32);
+                break;
+            case UART_REG_IIR_INDEX:
+                uartRegIirRead(pDevIns, pThis, pThisCC, pu32);
+                break;
+            case UART_REG_LCR_INDEX:
+                *pu32 = pThis->uRegLcr;
+                break;
+            case UART_REG_MCR_INDEX:
+                *pu32 = pThis->uRegMcr;
+                break;
+            case UART_REG_LSR_INDEX:
+                rc = uartRegLsrRead(pDevIns, pThis, pThisCC, pu32);
+                break;
+            case UART_REG_MSR_INDEX:
+                uartRegMsrRead(pDevIns, pThis, pThisCC, pu32);
+                break;
+            case UART_REG_SCR_INDEX:
+                *pu32 = pThis->uRegScr;
+                break;
+            default:
+                rc = VERR_IOM_IOPORT_UNUSED;
+        }
+        PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+        LogFlowFunc(("pThis=%#p uReg=%u{%s} u32=%#x cb=%u -> %Rrc\n",
+                     pThis, uReg, uartRegIdx2Str(pThis, idxReg, false /*fWrite*/), *pu32, cb, VBOXSTRICTRC_VAL(rc)));
+    }
+    else
+        LogFlowFunc(("-> %Rrc\n", VBOXSTRICTRC_VAL(rc)));
+    return rc;
+}
+
+
+#ifdef IN_RING3
+
+/* -=-=-=-=-=-=-=-=- Timer callbacks -=-=-=-=-=-=-=-=- */
+
+/**
+ * @callback_method_impl{FNTMTIMERDEV, Fifo timer function.}
+ */
+static DECLCALLBACK(void) uartR3RcvFifoTimeoutTimer(PPDMDEVINS pDevIns, TMTIMERHANDLE hTimer, void *pvUser)
+{
+    LogFlowFunc(("pDevIns=%#p hTimer=%#p pvUser=%#p\n", pDevIns, hTimer, pvUser));
+    PUARTCORER3 pThisCC = (PUARTCORECC)pvUser;
+    PUARTCORE   pThis   = pThisCC->pShared;
+    RT_NOREF(hTimer);
+
+    if (pThis->FifoRecv.cbUsed < pThis->FifoRecv.cbItl)
+    {
+        pThis->fIrqCtiPending = true;
+        uartIrqUpdate(pDevIns, pThis, pThisCC);
+    }
+}
+
+/**
+ * @callback_method_impl{FNTMTIMERDEV,
+ *      TX timer function when there is no driver connected for
+ *      draining the THR/FIFO.}
+ */
+static DECLCALLBACK(void) uartR3TxUnconnectedTimer(PPDMDEVINS pDevIns, TMTIMERHANDLE hTimer, void *pvUser)
+{
+    LogFlowFunc(("pDevIns=%#p hTimer=%#p pvUser=%#p\n", pDevIns, hTimer, pvUser));
+    PUARTCORER3 pThisCC = (PUARTCORECC)pvUser;
+    PUARTCORE   pThis   = pThisCC->pShared;
+    Assert(hTimer == pThis->hTimerTxUnconnected);
+
+    VBOXSTRICTRC rc1 = PDMDevHlpTimerLockClock2(pDevIns, hTimer, &pThis->CritSect, VINF_SUCCESS /* must get it */);
+    AssertRCReturnVoid(VBOXSTRICTRC_VAL(rc1));
+
+    uint8_t bVal = 0;
+    size_t cbRead = 0;
+    uartR3TxQueueCopyFrom(pDevIns, pThis, pThisCC, &bVal, sizeof(bVal), &cbRead);
+    if (pThis->uRegMcr & UART_REG_MCR_LOOP)
+    {
+        /* Loopback mode is active, feed in the data at the receiving end. */
+        uint32_t cbAvailOld = ASMAtomicAddU32(&pThis->cbAvailRdr, 1);
+        if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+        {
+            PUARTFIFO pFifo = &pThis->FifoRecv;
+            if (uartFifoFreeGet(pFifo) > 0)
+            {
+                pFifo->abBuf[pFifo->offWrite] = bVal;
+                pFifo->offWrite = (pFifo->offWrite + 1) % pFifo->cbMax;
+                pFifo->cbUsed++;
+
+                UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_DR);
+                if (pFifo->cbUsed < pFifo->cbItl)
+                {
+                    pThis->fIrqCtiPending = false;
+                    PDMDevHlpTimerSetRelative(pDevIns, pThis->hTimerRcvFifoTimeout,
+                                              pThis->cSymbolXferTicks * 4, NULL);
+                }
+                uartIrqUpdate(pDevIns, pThis, pThisCC);
+            }
+
+            ASMAtomicSubU32(&pThis->cbAvailRdr, 1);
+        }
+        else if (!cbAvailOld)
+        {
+            pThis->uRegRbr = bVal;
+            UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_DR);
+            uartIrqUpdate(pDevIns, pThis, pThisCC);
+        }
+        else
+            ASMAtomicSubU32(&pThis->cbAvailRdr, 1);
+    }
+
+    if (cbRead == 1)
+        PDMDevHlpTimerSetRelative(pDevIns, hTimer, pThis->cSymbolXferTicks, NULL);
+    else
+    {
+        /* NO data left, set the transmitter holding register as empty. */
+        UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_TEMT);
+    }
+
+    PDMDevHlpTimerUnlockClock2(pDevIns, hTimer, &pThis->CritSect);
+}
+
+
+/* -=-=-=-=-=-=-=-=- PDMISERIALPORT on LUN#0 -=-=-=-=-=-=-=-=- */
+
+
+/**
+ * @interface_method_impl{PDMISERIALPORT,pfnDataAvailRdrNotify}
+ */
+static DECLCALLBACK(int) uartR3DataAvailRdrNotify(PPDMISERIALPORT pInterface, size_t cbAvail)
+{
+    LogFlowFunc(("pInterface=%#p cbAvail=%zu\n", pInterface, cbAvail));
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, ISerialPort);
+    PUARTCORE   pThis   = pThisCC->pShared;
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+
+    AssertMsg((uint32_t)cbAvail == cbAvail, ("Too much data available\n"));
+
+    int rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    AssertRCReturn(rcLock, rcLock);
+
+    uint32_t cbAvailOld = ASMAtomicAddU32(&pThis->cbAvailRdr, (uint32_t)cbAvail);
+    LogFlow(("    cbAvailRdr=%u -> cbAvailRdr=%u\n", cbAvailOld, cbAvail + cbAvailOld));
+    if (pThis->uRegFcr & UART_REG_FCR_FIFO_EN)
+        uartR3RecvFifoFill(pDevIns, pThis, pThisCC);
+    else if (!cbAvailOld)
+    {
+        size_t cbRead = 0;
+        int rc = pThisCC->pDrvSerial->pfnReadRdr(pThisCC->pDrvSerial, &pThis->uRegRbr, 1, &cbRead);
+        AssertRC(rc);
+
+        if (cbRead)
+        {
+            UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_DR);
+            uartIrqUpdate(pDevIns, pThis, pThisCC);
+        }
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * @interface_method_impl{PDMISERIALPORT,pfnDataSentNotify}
+ */
+static DECLCALLBACK(int) uartR3DataSentNotify(PPDMISERIALPORT pInterface)
+{
+    LogFlowFunc(("pInterface=%#p\n", pInterface));
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, ISerialPort);
+    PUARTCORE   pThis   = pThisCC->pShared;
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+
+    /* Set the transmitter empty bit because everything was sent. */
+    int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    AssertRCReturn(rcLock, rcLock);
+
+    UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_TEMT);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * @interface_method_impl{PDMISERIALPORT,pfnReadWr}
+ */
+static DECLCALLBACK(int) uartR3ReadWr(PPDMISERIALPORT pInterface, void *pvBuf, size_t cbRead, size_t *pcbRead)
+{
+    LogFlowFunc(("pInterface=%#p pvBuf=%#p cbRead=%zu pcbRead=%#p\n", pInterface, pvBuf, cbRead, pcbRead));
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, ISerialPort);
+    PUARTCORE   pThis   = pThisCC->pShared;
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+
+    AssertReturn(cbRead > 0, VERR_INVALID_PARAMETER);
+
+    int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    AssertRCReturn(rcLock, rcLock);
+
+    uartR3TxQueueCopyFrom(pDevIns, pThis, pThisCC, pvBuf, cbRead, pcbRead);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    LogFlowFunc(("-> VINF_SUCCESS{*pcbRead=%zu}\n", *pcbRead));
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * @interface_method_impl{PDMISERIALPORT,pfnNotifyStsLinesChanged}
+ */
+static DECLCALLBACK(int) uartR3NotifyStsLinesChanged(PPDMISERIALPORT pInterface, uint32_t fNewStatusLines)
+{
+    LogFlowFunc(("pInterface=%#p fNewStatusLines=%#x\n", pInterface, fNewStatusLines));
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, ISerialPort);
+    PUARTCORE   pThis   = pThisCC->pShared;
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+    int const   rcLock  = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    AssertRCReturn(rcLock, rcLock);
+
+    uartR3StsLinesUpdate(pDevIns, pThis, pThisCC, fNewStatusLines);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * @interface_method_impl{PDMISERIALPORT,pfnNotifyBrk}
+ */
+static DECLCALLBACK(int) uartR3NotifyBrk(PPDMISERIALPORT pInterface)
+{
+    LogFlowFunc(("pInterface=%#p\n", pInterface));
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, ISerialPort);
+    PUARTCORE   pThis   = pThisCC->pShared;
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+    int const   rcLock  = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    AssertRCReturn(rcLock, rcLock);
+
+    UART_REG_SET(pThis->uRegLsr, UART_REG_LSR_BI);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+    return VINF_SUCCESS;
+}
+
+
+/* -=-=-=-=-=-=-=-=- PDMIBASE -=-=-=-=-=-=-=-=- */
+
+/**
+ * @interface_method_impl{PDMIBASE,pfnQueryInterface}
+ */
+static DECLCALLBACK(void *) uartR3QueryInterface(PPDMIBASE pInterface, const char *pszIID)
+{
+    PUARTCORECC pThisCC = RT_FROM_MEMBER(pInterface, UARTCORECC, IBase);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMISERIALPORT, &pThisCC->ISerialPort);
+    return NULL;
+}
+
+
+/**
+ * Saves the UART state to the given SSM handle.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The UART core instance.
+ * @param   pSSM                The SSM handle to save to.
+ */
+DECLHIDDEN(int) uartR3SaveExec(PPDMDEVINS pDevIns, PUARTCORE pThis, PSSMHANDLE pSSM)
+{
+    PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
+
+    pHlp->pfnSSMPutU16(pSSM,  pThis->uRegDivisor);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegRbr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegThr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegIer);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegIir);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegFcr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegLcr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegMcr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegLsr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegMsr);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->uRegScr);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fIrqCtiPending);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fThreEmptyPending);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->FifoXmit.cbMax);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->FifoXmit.cbItl);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->FifoRecv.cbMax);
+    pHlp->pfnSSMPutU8(pSSM,   pThis->FifoRecv.cbItl);
+
+    int rc = PDMDevHlpTimerSave(pDevIns, pThis->hTimerRcvFifoTimeout, pSSM);
+    if (RT_SUCCESS(rc))
+        rc = PDMDevHlpTimerSave(pDevIns, pThis->hTimerTxUnconnected, pSSM);
+
+    return rc;
+}
+
+
+/**
+ * Loads the UART state from the given SSM handle.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The UART core instance.
+ * @param   pSSM                The SSM handle to load from.
+ * @param   uVersion            Saved state version.
+ * @param   uPass               The SSM pass the call is done in.
+ * @param   pbIrq               Where to store the IRQ value for legacy
+ *                              saved states - optional.
+ * @param   pPortBase           Where to store the I/O port base for legacy
+ *                              saved states - optional.
+ */
+DECLHIDDEN(int) uartR3LoadExec(PPDMDEVINS pDevIns, PUARTCORE pThis, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass,
+                               uint8_t *pbIrq, RTIOPORT *pPortBase)
+{
+    PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
+    int rc;
+    RT_NOREF(uPass);
+
+    if (uVersion > UART_SAVED_STATE_VERSION_LEGACY_CODE)
+    {
+        pHlp->pfnSSMGetU16(pSSM,  &pThis->uRegDivisor);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegRbr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegThr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegIer);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegIir);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegFcr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegLcr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegMcr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegLsr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegMsr);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->uRegScr);
+        pHlp->pfnSSMGetBool(pSSM, &pThis->fIrqCtiPending);
+        pHlp->pfnSSMGetBool(pSSM, &pThis->fThreEmptyPending);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->FifoXmit.cbMax);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->FifoXmit.cbItl);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->FifoRecv.cbMax);
+        pHlp->pfnSSMGetU8(pSSM,   &pThis->FifoRecv.cbItl);
+
+        rc = PDMDevHlpTimerLoad(pDevIns, pThis->hTimerRcvFifoTimeout, pSSM);
+        if (uVersion > UART_SAVED_STATE_VERSION_PRE_UNCONNECTED_TX_TIMER)
+            rc = PDMDevHlpTimerLoad(pDevIns, pThis->hTimerTxUnconnected, pSSM);
+    }
+    else
+    {
+        AssertPtr(pbIrq);
+        AssertPtr(pPortBase);
+        if (uVersion == UART_SAVED_STATE_VERSION_16450)
+        {
+            pThis->enmType = UARTTYPE_16450;
+            LogRel(("Serial#%d: falling back to 16450 mode from load state\n", pDevIns->iInstance));
+        }
+
+        pHlp->pfnSSMGetU16(pSSM, &pThis->uRegDivisor);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegRbr);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegIer);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegLcr);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegMcr);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegLsr);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegMsr);
+        pHlp->pfnSSMGetU8(pSSM, &pThis->uRegScr);
+        if (uVersion > UART_SAVED_STATE_VERSION_16450)
+            pHlp->pfnSSMGetU8(pSSM, &pThis->uRegFcr);
+
+        int32_t iTmp = 0;
+        pHlp->pfnSSMGetS32(pSSM, &iTmp);
+        pThis->fThreEmptyPending = RT_BOOL(iTmp);
+
+        rc = pHlp->pfnSSMGetS32(pSSM, &iTmp);
+        AssertRCReturn(rc, rc);
+        *pbIrq = (uint8_t)iTmp;
+
+        pHlp->pfnSSMSkip(pSSM, sizeof(int32_t)); /* was: last_break_enable */
+
+        uint32_t uPortBaseTmp = 0;
+        rc = pHlp->pfnSSMGetU32(pSSM, &uPortBaseTmp);
+        AssertRCReturn(rc, rc);
+        *pPortBase = (RTIOPORT)uPortBaseTmp;
+
+        rc = pHlp->pfnSSMSkip(pSSM, sizeof(bool)); /* was: msr_changed */
+        if (   RT_SUCCESS(rc)
+            && uVersion > UART_SAVED_STATE_VERSION_MISSING_BITS)
+        {
+            pHlp->pfnSSMGetU8(pSSM, &pThis->uRegThr);
+            pHlp->pfnSSMSkip(pSSM, sizeof(uint8_t)); /* The old transmit shift register, not used anymore. */
+            pHlp->pfnSSMGetU8(pSSM, &pThis->uRegIir);
+
+            int32_t iTimeoutPending = 0;
+            pHlp->pfnSSMGetS32(pSSM, &iTimeoutPending);
+            pThis->fIrqCtiPending = RT_BOOL(iTimeoutPending);
+
+            rc = PDMDevHlpTimerLoad(pDevIns, pThis->hTimerRcvFifoTimeout, pSSM);
+            AssertRCReturn(rc, rc);
+
+            bool fWasActiveIgn;
+            rc = pHlp->pfnTimerSkipLoad(pSSM, &fWasActiveIgn);  /* was: transmit_timerR3 */
+            AssertRCReturn(rc, rc);
+
+            pHlp->pfnSSMGetU8(pSSM, &pThis->FifoRecv.cbItl);
+            rc = pHlp->pfnSSMGetU8(pSSM, &pThis->FifoRecv.cbItl);
+        }
+    }
+
+    return rc;
+}
+
+
+/**
+ * Called when loading the state completed, updates the parameters of any driver underneath.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   pSSM                The SSM handle.
+ */
+DECLHIDDEN(int) uartR3LoadDone(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, PSSMHANDLE pSSM)
+{
+    RT_NOREF(pSSM);
+
+    uartR3ParamsUpdate(pDevIns, pThis, pThisCC);
+    uartIrqUpdate(pDevIns, pThis, pThisCC);
+
+    if (pThisCC->pDrvSerial)
+    {
+        /* Set the modem lines to reflect the current state. */
+        int rc = pThisCC->pDrvSerial->pfnChgModemLines(pThisCC->pDrvSerial,
+                                                       RT_BOOL(pThis->uRegMcr & UART_REG_MCR_RTS),
+                                                       RT_BOOL(pThis->uRegMcr & UART_REG_MCR_DTR));
+        if (RT_FAILURE(rc))
+            LogRel(("Serial#%d: Failed to set modem lines with %Rrc during saved state load\n",
+                    pDevIns->iInstance, rc));
+
+        uint32_t fStsLines = 0;
+        rc = pThisCC->pDrvSerial->pfnQueryStsLines(pThisCC->pDrvSerial, &fStsLines);
+        if (RT_SUCCESS(rc))
+            uartR3StsLinesUpdate(pDevIns, pThis, pThisCC, fStsLines);
+        else
+            LogRel(("Serial#%d: Failed to query status line status with %Rrc during reset\n",
+                    pDevIns->iInstance, rc));
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Resets the given UART core instance.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+DECLHIDDEN(void) uartR3Reset(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    pThis->uRegDivisor    = 0x0c; /* Default to 9600 Baud. */
+    pThis->uRegRbr        = 0;
+    pThis->uRegThr        = 0;
+    pThis->uRegIer        = 0;
+    pThis->uRegIir        = UART_REG_IIR_IP_NO_INT;
+    pThis->uRegFcr        = 0;
+    pThis->uRegLcr        = 0; /* 5 data bits, no parity, 1 stop bit. */
+    pThis->uRegMcr        = 0;
+    pThis->uRegLsr        = UART_REG_LSR_THRE | UART_REG_LSR_TEMT;
+    pThis->uRegMsr        = UART_REG_MSR_DCD | UART_REG_MSR_CTS | UART_REG_MSR_DSR | UART_REG_MSR_DCTS | UART_REG_MSR_DDSR | UART_REG_MSR_DDCD;
+    pThis->uRegScr        = 0;
+    pThis->fIrqCtiPending = false;
+    pThis->fThreEmptyPending = true;
+
+    /* Standard FIFO size for 15550A. */
+    pThis->FifoXmit.cbMax = 16;
+    pThis->FifoRecv.cbMax = 16;
+    pThis->FifoRecv.cbItl = 1;
+
+    uartR3XferReset(pDevIns, pThis, pThisCC);
+}
+
+
+/**
+ * Attaches the given UART core instance to the drivers at the given LUN.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   iLUN                The LUN being attached.
+ */
+DECLHIDDEN(int) uartR3Attach(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC, unsigned iLUN)
+{
+    int rc = PDMDevHlpDriverAttach(pDevIns, iLUN, &pThisCC->IBase, &pThisCC->pDrvBase, "Serial Char");
+    if (RT_SUCCESS(rc))
+    {
+        pThisCC->pDrvSerial = PDMIBASE_QUERY_INTERFACE(pThisCC->pDrvBase, PDMISERIALCONNECTOR);
+        if (!pThisCC->pDrvSerial)
+        {
+            AssertLogRelMsgFailed(("Configuration error: instance %d has no serial interface!\n", pDevIns->iInstance));
+            return VERR_PDM_MISSING_INTERFACE;
+        }
+        rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+        if (RT_SUCCESS(rc))
+        {
+            uartR3XferReset(pDevIns, pThis, pThisCC);
+            PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+        }
+    }
+    else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
+    {
+        pThisCC->pDrvBase = NULL;
+        pThisCC->pDrvSerial = NULL;
+        rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+        if (RT_SUCCESS(rc))
+        {
+            uartR3XferReset(pDevIns, pThis, pThisCC);
+            PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+        }
+        LogRel(("Serial#%d: no unit\n", pDevIns->iInstance));
+    }
+    else /* Don't call VMSetError here as we assume that the driver already set an appropriate error */
+        LogRel(("Serial#%d: Failed to attach to serial driver. rc=%Rrc\n", pDevIns->iInstance, rc));
+
+   return rc;
+}
+
+
+/**
+ * Detaches any attached driver from the given UART core instance.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared serial port instance data.
+ * @param   pThisCC             The serial port instance data for the current context.
+ */
+DECLHIDDEN(void) uartR3Detach(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC)
+{
+    /* Zero out important members. */
+    pThisCC->pDrvBase   = NULL;
+    pThisCC->pDrvSerial = NULL;
+    int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+    PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->CritSect, rcLock);
+
+    uartR3XferReset(pDevIns, pThis, pThisCC);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
+}
+
+
+/**
+ * Destroys the given UART core instance freeing all allocated resources.
+ *
+ * @param   pDevIns             The device instance.
+ * @param   pThis               The shared UART core instance data..
+ */
+DECLHIDDEN(void) uartR3Destruct(PPDMDEVINS pDevIns, PUARTCORE pThis)
+{
+    PDMDevHlpCritSectDelete(pDevIns, &pThis->CritSect);
+}
+
+
+/**
+ * Initializes the given UART core instance using the provided configuration.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns             The device instance pointer.
+ * @param   pThis               The shared UART core instance data to
+ *                              initialize.
+ * @param   pThisCC             The ring-3 UART core instance data to
+ *                              initialize.
+ * @param   enmType             The type of UART emulated.
+ * @param   iLUN                The LUN the UART should look for attached drivers.
+ * @param   fFlags              Additional flags controlling device behavior.
+ * @param   pfnUartIrqReq       Pointer to the interrupt request callback.
+ */
+DECLHIDDEN(int) uartR3Init(PPDMDEVINS pDevIns, PUARTCORE pThis, PUARTCORECC pThisCC,
+                           UARTTYPE enmType, unsigned iLUN, uint32_t fFlags, PFNUARTCOREIRQREQ pfnUartIrqReq)
+{
+    /*
+     * Initialize the instance data.
+     * (Do this early or the destructor might choke on something!)
+     */
+    pThis->iLUN                                     = iLUN;
+    pThis->enmType                                  = enmType;
+    pThis->fFlags                                   = fFlags;
+
+    pThisCC->iLUN                                   = iLUN;
+    pThisCC->pDevIns                                = pDevIns;
+    pThisCC->pShared                                = pThis;
+    pThisCC->pfnUartIrqReq                          = pfnUartIrqReq;
+
+    /* IBase */
+    pThisCC->IBase.pfnQueryInterface                = uartR3QueryInterface;
+
+    /* ISerialPort */
+    pThisCC->ISerialPort.pfnDataAvailRdrNotify      = uartR3DataAvailRdrNotify;
+    pThisCC->ISerialPort.pfnDataSentNotify          = uartR3DataSentNotify;
+    pThisCC->ISerialPort.pfnReadWr                  = uartR3ReadWr;
+    pThisCC->ISerialPort.pfnNotifyStsLinesChanged   = uartR3NotifyStsLinesChanged;
+    pThisCC->ISerialPort.pfnNotifyBrk               = uartR3NotifyBrk;
+
+    int rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSect, RT_SRC_POS, "Uart{%s#%d}#%d",
+                                   pDevIns->pReg->szName, pDevIns->iInstance, iLUN);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Attach the char driver and get the interfaces.
+     */
+    rc = PDMDevHlpDriverAttach(pDevIns, iLUN, &pThisCC->IBase, &pThisCC->pDrvBase, "UART");
+    if (RT_SUCCESS(rc))
+    {
+        pThisCC->pDrvSerial = PDMIBASE_QUERY_INTERFACE(pThisCC->pDrvBase, PDMISERIALCONNECTOR);
+        if (!pThisCC->pDrvSerial)
+        {
+            AssertLogRelMsgFailed(("Configuration error: instance %d has no serial interface!\n", iLUN));
+            return VERR_PDM_MISSING_INTERFACE;
+        }
+    }
+    else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
+    {
+        pThisCC->pDrvBase   = NULL;
+        pThisCC->pDrvSerial = NULL;
+        LogRel(("Serial#%d: no unit\n", iLUN));
+    }
+    else
+    {
+        AssertLogRelMsgFailed(("Serial#%d: Failed to attach to char driver. rc=%Rrc\n", iLUN, rc));
+        /* Don't call VMSetError here as we assume that the driver already set an appropriate error */
+        return rc;
+    }
+
+    /*
+     * Create the receive FIFO character timeout indicator timer.
+     */
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL, uartR3RcvFifoTimeoutTimer, pThisCC,
+                              TMTIMER_FLAGS_NO_CRIT_SECT | TMTIMER_FLAGS_RING0, "UART Rcv FIFO",
+                              &pThis->hTimerRcvFifoTimeout);
+    AssertRCReturn(rc, rc);
+
+    rc = PDMDevHlpTimerSetCritSect(pDevIns, pThis->hTimerRcvFifoTimeout, &pThis->CritSect);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Create the transmit timer when no device is connected.
+     */
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL_SYNC, uartR3TxUnconnectedTimer, pThisCC,
+                              TMTIMER_FLAGS_NO_CRIT_SECT | TMTIMER_FLAGS_NO_RING0, "UART TX unconnect",
+                              &pThis->hTimerTxUnconnected);
+    AssertRCReturn(rc, rc);
+
+    uartR3Reset(pDevIns, pThis, pThisCC);
+    return VINF_SUCCESS;
+}
+
+#else  /* !IN_RING3 */
+
+/**
+ * Initializes the ring-0 / raw-mode instance data.
+ *
+ * @returns VBox status code.
+ * @param   pThisCC             The serial port instance data for the current context.
+ * @param   pfnUartIrqReq       Pointer to the interrupt request callback.
+ */
+DECLHIDDEN(int) uartRZInit(PUARTCORECC pThisCC, PFNUARTCOREIRQREQ pfnUartIrqReq)
+{
+    AssertPtrReturn(pfnUartIrqReq, VERR_INVALID_POINTER);
+    AssertPtrReturn(pThisCC, VERR_INVALID_POINTER);
+    pThisCC->pfnUartIrqReq = pfnUartIrqReq;
+    return VINF_SUCCESS;
+}
+
+#endif /* !IN_RING3 */
+
+#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */