xref: /openbmc/qemu/hw/i2c/aspeed_i2c.c (revision 2260fc6ff3ff384bf384118a9be7aa6bec43b45b)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/log.h"
25 #include "qemu/module.h"
26 #include "qemu/error-report.h"
27 #include "qapi/error.h"
28 #include "hw/i2c/aspeed_i2c.h"
29 #include "hw/irq.h"
30 #include "hw/qdev-properties.h"
31 #include "hw/registerfields.h"
32 #include "trace.h"
33 
34 /* I2C Global Register */
35 REG32(I2C_CTRL_STATUS, 0x0) /* Device Interrupt Status */
36 REG32(I2C_CTRL_ASSIGN, 0x8) /* Device Interrupt Target Assignment */
37 REG32(I2C_CTRL_GLOBAL, 0xC) /* Global Control Register */
38     FIELD(I2C_CTRL_GLOBAL, SRAM_EN, 0, 1)
39 
40 /* I2C Device (Bus) Register */
41 REG32(I2CD_FUN_CTRL, 0x0) /* I2CD Function Control  */
42     FIELD(I2CD_FUN_CTRL, POOL_PAGE_SEL, 20, 3) /* AST2400 */
43     FIELD(I2CD_FUN_CTRL, M_SDA_LOCK_EN, 16, 1)
44     FIELD(I2CD_FUN_CTRL, MULTI_MASTER_DIS, 15, 1)
45     FIELD(I2CD_FUN_CTRL, M_SCL_DRIVE_EN, 14, 1)
46     FIELD(I2CD_FUN_CTRL, MSB_STS, 9, 1)
47     FIELD(I2CD_FUN_CTRL, SDA_DRIVE_IT_EN, 8, 1)
48     FIELD(I2CD_FUN_CTRL, M_SDA_DRIVE_IT_EN, 7, 1)
49     FIELD(I2CD_FUN_CTRL, M_HIGH_SPEED_EN, 6, 1)
50     FIELD(I2CD_FUN_CTRL, DEF_ADDR_EN, 5, 1)
51     FIELD(I2CD_FUN_CTRL, DEF_ALERT_EN, 4, 1)
52     FIELD(I2CD_FUN_CTRL, DEF_ARP_EN, 3, 1)
53     FIELD(I2CD_FUN_CTRL, DEF_GCALL_EN, 2, 1)
54     FIELD(I2CD_FUN_CTRL, SLAVE_EN, 1, 1)
55     FIELD(I2CD_FUN_CTRL, MASTER_EN, 0, 1)
56 REG32(I2CD_AC_TIMING1, 0x04) /* Clock and AC Timing Control #1 */
57 REG32(I2CD_AC_TIMING2, 0x08) /* Clock and AC Timing Control #2 */
58 REG32(I2CD_INTR_CTRL, 0x0C)  /* I2CD Interrupt Control */
59 REG32(I2CD_INTR_STS, 0x10)   /* I2CD Interrupt Status */
60     FIELD(I2CD_INTR_STS, SLAVE_ADDR_MATCH, 31, 1)    /* 0: addr1 1: addr2 */
61     FIELD(I2CD_INTR_STS, SLAVE_ADDR_RX_PENDING, 29, 1)
62     FIELD(I2CD_INTR_STS, SLAVE_INACTIVE_TIMEOUT, 15, 1)
63     FIELD(I2CD_INTR_STS, SDA_DL_TIMEOUT, 14, 1)
64     FIELD(I2CD_INTR_STS, BUS_RECOVER_DONE, 13, 1)
65     FIELD(I2CD_INTR_STS, SMBUS_ALERT, 12, 1)            /* Bus [0-3] only */
66     FIELD(I2CD_INTR_STS, SMBUS_ARP_ADDR, 11, 1)         /* Removed */
67     FIELD(I2CD_INTR_STS, SMBUS_DEV_ALERT_ADDR, 10, 1)   /* Removed */
68     FIELD(I2CD_INTR_STS, SMBUS_DEF_ADDR, 9, 1)          /* Removed */
69     FIELD(I2CD_INTR_STS, GCALL_ADDR, 8, 1)              /* Removed */
70     FIELD(I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 7, 1)     /* use RX_DONE */
71     FIELD(I2CD_INTR_STS, SCL_TIMEOUT, 6, 1)
72     FIELD(I2CD_INTR_STS, ABNORMAL, 5, 1)
73     FIELD(I2CD_INTR_STS, NORMAL_STOP, 4, 1)
74     FIELD(I2CD_INTR_STS, ARBIT_LOSS, 3, 1)
75     FIELD(I2CD_INTR_STS, RX_DONE, 2, 1)
76     FIELD(I2CD_INTR_STS, TX_NAK, 1, 1)
77     FIELD(I2CD_INTR_STS, TX_ACK, 0, 1)
78 REG32(I2CD_CMD, 0x14) /* I2CD Command/Status */
79     FIELD(I2CD_CMD, SDA_OE, 28, 1)
80     FIELD(I2CD_CMD, SDA_O, 27, 1)
81     FIELD(I2CD_CMD, SCL_OE, 26, 1)
82     FIELD(I2CD_CMD, SCL_O, 25, 1)
83     FIELD(I2CD_CMD, TX_TIMING, 23, 2)
84     FIELD(I2CD_CMD, TX_STATE, 19, 4)
85 /* Tx State Machine */
86 #define   I2CD_TX_STATE_MASK                  0xf
87 #define     I2CD_IDLE                         0x0
88 #define     I2CD_MACTIVE                      0x8
89 #define     I2CD_MSTART                       0x9
90 #define     I2CD_MSTARTR                      0xa
91 #define     I2CD_MSTOP                        0xb
92 #define     I2CD_MTXD                         0xc
93 #define     I2CD_MRXACK                       0xd
94 #define     I2CD_MRXD                         0xe
95 #define     I2CD_MTXACK                       0xf
96 #define     I2CD_SWAIT                        0x1
97 #define     I2CD_SRXD                         0x4
98 #define     I2CD_STXACK                       0x5
99 #define     I2CD_STXD                         0x6
100 #define     I2CD_SRXACK                       0x7
101 #define     I2CD_RECOVER                      0x3
102     FIELD(I2CD_CMD, SCL_LINE_STS, 18, 1)
103     FIELD(I2CD_CMD, SDA_LINE_STS, 17, 1)
104     FIELD(I2CD_CMD, BUS_BUSY_STS, 16, 1)
105     FIELD(I2CD_CMD, SDA_OE_OUT_DIR, 15, 1)
106     FIELD(I2CD_CMD, SDA_O_OUT_DIR, 14, 1)
107     FIELD(I2CD_CMD, SCL_OE_OUT_DIR, 13, 1)
108     FIELD(I2CD_CMD, SCL_O_OUT_DIR, 12, 1)
109     FIELD(I2CD_CMD, BUS_RECOVER_CMD_EN, 11, 1)
110     FIELD(I2CD_CMD, S_ALT_EN, 10, 1)
111     /* Command Bits */
112     FIELD(I2CD_CMD, RX_DMA_EN, 9, 1)
113     FIELD(I2CD_CMD, TX_DMA_EN, 8, 1)
114     FIELD(I2CD_CMD, RX_BUFF_EN, 7, 1)
115     FIELD(I2CD_CMD, TX_BUFF_EN, 6, 1)
116     FIELD(I2CD_CMD, M_STOP_CMD, 5, 1)
117     FIELD(I2CD_CMD, M_S_RX_CMD_LAST, 4, 1)
118     FIELD(I2CD_CMD, M_RX_CMD, 3, 1)
119     FIELD(I2CD_CMD, S_TX_CMD, 2, 1)
120     FIELD(I2CD_CMD, M_TX_CMD, 1, 1)
121     FIELD(I2CD_CMD, M_START_CMD, 0, 1)
122 REG32(I2CD_DEV_ADDR, 0x18) /* Slave Device Address */
123 REG32(I2CD_POOL_CTRL, 0x1C) /* Pool Buffer Control */
124     FIELD(I2CD_POOL_CTRL, RX_COUNT, 24, 5)
125     FIELD(I2CD_POOL_CTRL, RX_SIZE, 16, 5)
126     FIELD(I2CD_POOL_CTRL, TX_COUNT, 9, 5)
127     FIELD(I2CD_POOL_CTRL, OFFSET, 2, 6) /* AST2400 */
128 REG32(I2CD_BYTE_BUF, 0x20) /* Transmit/Receive Byte Buffer */
129     FIELD(I2CD_BYTE_BUF, RX_BUF, 8, 8)
130     FIELD(I2CD_BYTE_BUF, TX_BUF, 0, 8)
131 REG32(I2CD_DMA_ADDR, 0x24) /* DMA Buffer Address */
132 REG32(I2CD_DMA_LEN, 0x28) /* DMA Transfer Length < 4KB */
133 
134 static inline bool aspeed_i2c_bus_is_master(AspeedI2CBus *bus)
135 {
136     return ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL, MASTER_EN);
137 }
138 
139 static inline bool aspeed_i2c_bus_is_enabled(AspeedI2CBus *bus)
140 {
141     return ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL, MASTER_EN) ||
142            ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL, SLAVE_EN);
143 }
144 
145 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
146 {
147     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
148 
149     trace_aspeed_i2c_bus_raise_interrupt(bus->regs[R_I2CD_INTR_STS],
150           ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, TX_NAK) ? "nak|" : "",
151           ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, TX_ACK) ? "ack|" : "",
152           ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, RX_DONE) ? "done|" : "",
153           ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, NORMAL_STOP) ? "normal|"
154                                                                   : "",
155           ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, ABNORMAL) ? "abnormal"
156                                                                : "");
157 
158     bus->regs[R_I2CD_INTR_STS] &= bus->regs[R_I2CD_INTR_CTRL];
159     if (bus->regs[R_I2CD_INTR_STS]) {
160         bus->controller->intr_status |= 1 << bus->id;
161         qemu_irq_raise(aic->bus_get_irq(bus));
162     }
163 }
164 
165 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
166                                     unsigned size)
167 {
168     AspeedI2CBus *bus = opaque;
169     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
170     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
171 
172     switch (offset) {
173     case A_I2CD_FUN_CTRL:
174     case A_I2CD_AC_TIMING1:
175     case A_I2CD_AC_TIMING2:
176     case A_I2CD_INTR_CTRL:
177     case A_I2CD_INTR_STS:
178     case A_I2CD_POOL_CTRL:
179     case A_I2CD_BYTE_BUF:
180         /* Value is already set, don't do anything. */
181         break;
182     case A_I2CD_CMD:
183         value = FIELD_DP32(value, I2CD_CMD, BUS_BUSY_STS,
184                            i2c_bus_busy(bus->bus));
185         break;
186     case A_I2CD_DMA_ADDR:
187         if (!aic->has_dma) {
188             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
189             value = -1;
190         }
191         break;
192     case A_I2CD_DMA_LEN:
193         if (!aic->has_dma) {
194             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
195             value = -1;
196         }
197         break;
198 
199     default:
200         qemu_log_mask(LOG_GUEST_ERROR,
201                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
202         value = -1;
203         break;
204     }
205 
206     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
207     return value;
208 }
209 
210 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
211 {
212     ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, TX_STATE, state);
213 }
214 
215 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
216 {
217     return ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_STATE);
218 }
219 
220 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
221 {
222     MemTxResult result;
223     AspeedI2CState *s = bus->controller;
224 
225     result = address_space_read(&s->dram_as, bus->regs[R_I2CD_DMA_ADDR],
226                                 MEMTXATTRS_UNSPECIFIED, data, 1);
227     if (result != MEMTX_OK) {
228         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
229                       __func__, bus->regs[R_I2CD_DMA_ADDR]);
230         return -1;
231     }
232 
233     bus->regs[R_I2CD_DMA_ADDR]++;
234     bus->regs[R_I2CD_DMA_LEN]--;
235     return 0;
236 }
237 
238 static int aspeed_i2c_bus_send(AspeedI2CBus *bus, uint8_t pool_start)
239 {
240     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
241     int ret = -1;
242     int i;
243     int pool_tx_count = ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, TX_COUNT);
244 
245     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_BUFF_EN)) {
246         for (i = pool_start; i < pool_tx_count; i++) {
247             uint8_t *pool_base = aic->bus_pool_base(bus);
248 
249             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
250                                       pool_base[i]);
251             ret = i2c_send(bus->bus, pool_base[i]);
252             if (ret) {
253                 break;
254             }
255         }
256         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, TX_BUFF_EN, 0);
257     } else if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_DMA_EN)) {
258         while (bus->regs[R_I2CD_DMA_LEN]) {
259             uint8_t data;
260             aspeed_i2c_dma_read(bus, &data);
261             trace_aspeed_i2c_bus_send("DMA", bus->regs[R_I2CD_DMA_LEN],
262                                       bus->regs[R_I2CD_DMA_LEN], data);
263             ret = i2c_send(bus->bus, data);
264             if (ret) {
265                 break;
266             }
267         }
268         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, TX_DMA_EN, 0);
269     } else {
270         trace_aspeed_i2c_bus_send("BYTE", pool_start, 1,
271                                   bus->regs[R_I2CD_BYTE_BUF]);
272         ret = i2c_send(bus->bus, bus->regs[R_I2CD_BYTE_BUF]);
273     }
274 
275     return ret;
276 }
277 
278 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
279 {
280     AspeedI2CState *s = bus->controller;
281     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
282     uint8_t data;
283     int i;
284     int pool_rx_count = ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, RX_COUNT);
285 
286     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_BUFF_EN)) {
287         uint8_t *pool_base = aic->bus_pool_base(bus);
288 
289         for (i = 0; i < pool_rx_count; i++) {
290             pool_base[i] = i2c_recv(bus->bus);
291             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
292                                       pool_base[i]);
293         }
294 
295         /* Update RX count */
296         ARRAY_FIELD_DP32(bus->regs, I2CD_POOL_CTRL, RX_COUNT, i & 0xff);
297         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, RX_BUFF_EN, 0);
298     } else if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_DMA_EN)) {
299         uint8_t data;
300 
301         while (bus->regs[R_I2CD_DMA_LEN]) {
302             MemTxResult result;
303 
304             data = i2c_recv(bus->bus);
305             trace_aspeed_i2c_bus_recv("DMA", bus->regs[R_I2CD_DMA_LEN],
306                                       bus->regs[R_I2CD_DMA_LEN], data);
307             result = address_space_write(&s->dram_as,
308                                          bus->regs[R_I2CD_DMA_ADDR],
309                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
310             if (result != MEMTX_OK) {
311                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
312                               __func__, bus->regs[R_I2CD_DMA_ADDR]);
313                 return;
314             }
315             bus->regs[R_I2CD_DMA_ADDR]++;
316             bus->regs[R_I2CD_DMA_LEN]--;
317         }
318         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, RX_DMA_EN, 0);
319     } else {
320         data = i2c_recv(bus->bus);
321         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[R_I2CD_BYTE_BUF]);
322         ARRAY_FIELD_DP32(bus->regs, I2CD_BYTE_BUF, RX_BUF, data);
323     }
324 }
325 
326 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
327 {
328     aspeed_i2c_set_state(bus, I2CD_MRXD);
329     aspeed_i2c_bus_recv(bus);
330     ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, RX_DONE, 1);
331     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_S_RX_CMD_LAST)) {
332         i2c_nack(bus->bus);
333     }
334     ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_RX_CMD, 0);
335     ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_S_RX_CMD_LAST, 0);
336     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
337 }
338 
339 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
340 {
341     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
342 
343     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_BUFF_EN)) {
344         uint8_t *pool_base = aic->bus_pool_base(bus);
345 
346         return pool_base[0];
347     } else if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_DMA_EN)) {
348         uint8_t data;
349 
350         aspeed_i2c_dma_read(bus, &data);
351         return data;
352     } else {
353         return bus->regs[R_I2CD_BYTE_BUF];
354     }
355 }
356 
357 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
358 {
359     AspeedI2CState *s = bus->controller;
360     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
361     bool dma_en = ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_DMA_EN)  ||
362                   ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_DMA_EN)  ||
363                   ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_BUFF_EN) ||
364                   ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_BUFF_EN);
365     if (!aic->check_sram) {
366         return true;
367     }
368 
369     /*
370      * AST2500: SRAM must be enabled before using the Buffer Pool or
371      * DMA mode.
372      */
373     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
374         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
375         return false;
376     }
377 
378     return true;
379 }
380 
381 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
382 {
383     g_autofree char *cmd_flags = NULL;
384     uint32_t count;
385     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_BUFF_EN)) {
386         count = ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, TX_COUNT);
387     } else if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_DMA_EN)) {
388         count = bus->regs[R_I2CD_DMA_LEN];
389     } else { /* BYTE mode */
390         count = 1;
391     }
392 
393     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
394           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_START_CMD) ? "start|" : "",
395           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_DMA_EN) ? "rxdma|" : "",
396           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_DMA_EN) ? "txdma|" : "",
397           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, RX_BUFF_EN) ? "rxbuf|" : "",
398           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_BUFF_EN) ? "txbuf|" : "",
399           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_TX_CMD) ? "tx|" : "",
400           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_RX_CMD) ? "rx|" : "",
401           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_S_RX_CMD_LAST) ? "last|" : "",
402           ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_STOP_CMD) ? "stop" : "");
403 
404     trace_aspeed_i2c_bus_cmd(bus->regs[R_I2CD_CMD], cmd_flags, count,
405                              bus->regs[R_I2CD_INTR_STS]);
406 }
407 
408 /*
409  * The state machine needs some refinement. It is only used to track
410  * invalid STOP commands for the moment.
411  */
412 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
413 {
414     uint8_t pool_start = 0;
415 
416     bus->regs[R_I2CD_CMD] &= ~0xFFFF;
417     bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
418 
419     if (!aspeed_i2c_check_sram(bus)) {
420         return;
421     }
422 
423     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
424         aspeed_i2c_bus_cmd_dump(bus);
425     }
426 
427     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_START_CMD)) {
428         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
429             I2CD_MSTARTR : I2CD_MSTART;
430         uint8_t addr;
431 
432         aspeed_i2c_set_state(bus, state);
433 
434         addr = aspeed_i2c_get_addr(bus);
435 
436         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
437                                extract32(addr, 0, 1))) {
438             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, TX_NAK, 1);
439         } else {
440             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, TX_ACK, 1);
441         }
442 
443         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_START_CMD, 0);
444 
445         /*
446          * The START command is also a TX command, as the slave
447          * address is sent on the bus. Drop the TX flag if nothing
448          * else needs to be sent in this sequence.
449          */
450         if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_BUFF_EN)) {
451             if (ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, TX_COUNT) == 1) {
452                 ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_TX_CMD, 0);
453             } else {
454                 /*
455                  * Increase the start index in the TX pool buffer to
456                  * skip the address byte.
457                  */
458                 pool_start++;
459             }
460         } else if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, TX_DMA_EN)) {
461             if (bus->regs[R_I2CD_DMA_LEN] == 0) {
462                 ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_TX_CMD, 0);
463             }
464         } else {
465             ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_TX_CMD, 0);
466         }
467 
468         /* No slave found */
469         if (!i2c_bus_busy(bus->bus)) {
470             return;
471         }
472         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
473     }
474 
475     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_TX_CMD)) {
476         aspeed_i2c_set_state(bus, I2CD_MTXD);
477         if (aspeed_i2c_bus_send(bus, pool_start)) {
478             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, TX_NAK, 1);
479             i2c_end_transfer(bus->bus);
480         } else {
481             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, TX_ACK, 1);
482         }
483         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_TX_CMD, 0);
484         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
485     }
486 
487     if ((ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_RX_CMD) ||
488          ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_S_RX_CMD_LAST)) &&
489         !ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, RX_DONE)) {
490         aspeed_i2c_handle_rx_cmd(bus);
491     }
492 
493     if (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_STOP_CMD)) {
494         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
495             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
496             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, ABNORMAL, 1);
497         } else {
498             aspeed_i2c_set_state(bus, I2CD_MSTOP);
499             i2c_end_transfer(bus->bus);
500             ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, NORMAL_STOP, 1);
501         }
502         ARRAY_FIELD_DP32(bus->regs, I2CD_CMD, M_STOP_CMD, 0);
503         aspeed_i2c_set_state(bus, I2CD_IDLE);
504     }
505 }
506 
507 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
508                                  uint64_t value, unsigned size)
509 {
510     AspeedI2CBus *bus = opaque;
511     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
512     bool handle_rx;
513 
514     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
515 
516     switch (offset) {
517     case A_I2CD_FUN_CTRL:
518         if (FIELD_EX32(value, I2CD_FUN_CTRL, SLAVE_EN)) {
519             qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
520                           __func__);
521             break;
522         }
523         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
524         break;
525     case A_I2CD_AC_TIMING1:
526         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
527         break;
528     case A_I2CD_AC_TIMING2:
529         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
530         break;
531     case A_I2CD_INTR_CTRL:
532         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
533         break;
534     case A_I2CD_INTR_STS:
535         handle_rx = ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, RX_DONE) &&
536                     FIELD_EX32(value, I2CD_INTR_STS, RX_DONE);
537         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
538         if (!bus->regs[R_I2CD_INTR_STS]) {
539             bus->controller->intr_status &= ~(1 << bus->id);
540             qemu_irq_lower(aic->bus_get_irq(bus));
541         }
542         if (handle_rx && (ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_RX_CMD) ||
543                       ARRAY_FIELD_EX32(bus->regs, I2CD_CMD, M_S_RX_CMD_LAST))) {
544             aspeed_i2c_handle_rx_cmd(bus);
545             aspeed_i2c_bus_raise_interrupt(bus);
546         }
547         break;
548     case A_I2CD_DEV_ADDR:
549         qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
550                       __func__);
551         break;
552     case A_I2CD_POOL_CTRL:
553         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
554         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
555         break;
556 
557     case A_I2CD_BYTE_BUF:
558         ARRAY_FIELD_DP32(bus->regs, I2CD_BYTE_BUF, TX_BUF, value);
559         break;
560     case A_I2CD_CMD:
561         if (!aspeed_i2c_bus_is_enabled(bus)) {
562             break;
563         }
564 
565         if (!aspeed_i2c_bus_is_master(bus)) {
566             qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
567                           __func__);
568             break;
569         }
570 
571         if (!aic->has_dma &&
572             (FIELD_EX32(value, I2CD_CMD, RX_DMA_EN) ||
573              FIELD_EX32(value, I2CD_CMD, TX_DMA_EN))) {
574             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
575             break;
576         }
577 
578         aspeed_i2c_bus_handle_cmd(bus, value);
579         aspeed_i2c_bus_raise_interrupt(bus);
580         break;
581     case A_I2CD_DMA_ADDR:
582         if (!aic->has_dma) {
583             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
584             break;
585         }
586 
587         bus->regs[R_I2CD_DMA_ADDR] = value & 0x3ffffffc;
588         break;
589 
590     case A_I2CD_DMA_LEN:
591         if (!aic->has_dma) {
592             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
593             break;
594         }
595 
596         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
597         if (!bus->regs[R_I2CD_DMA_LEN]) {
598             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
599         }
600         break;
601 
602     default:
603         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
604                       __func__, offset);
605     }
606 }
607 
608 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
609                                    unsigned size)
610 {
611     AspeedI2CState *s = opaque;
612 
613     switch (offset) {
614     case A_I2C_CTRL_STATUS:
615         return s->intr_status;
616     case A_I2C_CTRL_GLOBAL:
617         return s->ctrl_global;
618     default:
619         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
620                       __func__, offset);
621         break;
622     }
623 
624     return -1;
625 }
626 
627 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
628                                   uint64_t value, unsigned size)
629 {
630     AspeedI2CState *s = opaque;
631 
632     switch (offset) {
633     case A_I2C_CTRL_GLOBAL:
634         s->ctrl_global = value;
635         break;
636     case A_I2C_CTRL_STATUS:
637     default:
638         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
639                       __func__, offset);
640         break;
641     }
642 }
643 
644 static const MemoryRegionOps aspeed_i2c_bus_ops = {
645     .read = aspeed_i2c_bus_read,
646     .write = aspeed_i2c_bus_write,
647     .endianness = DEVICE_LITTLE_ENDIAN,
648 };
649 
650 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
651     .read = aspeed_i2c_ctrl_read,
652     .write = aspeed_i2c_ctrl_write,
653     .endianness = DEVICE_LITTLE_ENDIAN,
654 };
655 
656 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
657                                      unsigned size)
658 {
659     AspeedI2CState *s = opaque;
660     uint64_t ret = 0;
661     int i;
662 
663     for (i = 0; i < size; i++) {
664         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
665     }
666 
667     return ret;
668 }
669 
670 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
671                                   uint64_t value, unsigned size)
672 {
673     AspeedI2CState *s = opaque;
674     int i;
675 
676     for (i = 0; i < size; i++) {
677         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
678     }
679 }
680 
681 static const MemoryRegionOps aspeed_i2c_pool_ops = {
682     .read = aspeed_i2c_pool_read,
683     .write = aspeed_i2c_pool_write,
684     .endianness = DEVICE_LITTLE_ENDIAN,
685     .valid = {
686         .min_access_size = 1,
687         .max_access_size = 4,
688     },
689 };
690 
691 static const VMStateDescription aspeed_i2c_bus_vmstate = {
692     .name = TYPE_ASPEED_I2C,
693     .version_id = 4,
694     .minimum_version_id = 4,
695     .fields = (VMStateField[]) {
696         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_OLD_NUM_REG),
697         VMSTATE_END_OF_LIST()
698     }
699 };
700 
701 static const VMStateDescription aspeed_i2c_vmstate = {
702     .name = TYPE_ASPEED_I2C,
703     .version_id = 2,
704     .minimum_version_id = 2,
705     .fields = (VMStateField[]) {
706         VMSTATE_UINT32(intr_status, AspeedI2CState),
707         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
708                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
709                              AspeedI2CBus),
710         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
711         VMSTATE_END_OF_LIST()
712     }
713 };
714 
715 static void aspeed_i2c_reset(DeviceState *dev)
716 {
717     AspeedI2CState *s = ASPEED_I2C(dev);
718 
719     s->intr_status = 0;
720 }
721 
722 static void aspeed_i2c_instance_init(Object *obj)
723 {
724     AspeedI2CState *s = ASPEED_I2C(obj);
725     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
726     int i;
727 
728     for (i = 0; i < aic->num_busses; i++) {
729         object_initialize_child(obj, "bus[*]", &s->busses[i],
730                                 TYPE_ASPEED_I2C_BUS);
731     }
732 }
733 
734 /*
735  * Address Definitions (AST2400 and AST2500)
736  *
737  *   0x000 ... 0x03F: Global Register
738  *   0x040 ... 0x07F: Device 1
739  *   0x080 ... 0x0BF: Device 2
740  *   0x0C0 ... 0x0FF: Device 3
741  *   0x100 ... 0x13F: Device 4
742  *   0x140 ... 0x17F: Device 5
743  *   0x180 ... 0x1BF: Device 6
744  *   0x1C0 ... 0x1FF: Device 7
745  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
746  *   0x300 ... 0x33F: Device 8
747  *   0x340 ... 0x37F: Device 9
748  *   0x380 ... 0x3BF: Device 10
749  *   0x3C0 ... 0x3FF: Device 11
750  *   0x400 ... 0x43F: Device 12
751  *   0x440 ... 0x47F: Device 13
752  *   0x480 ... 0x4BF: Device 14
753  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
754  */
755 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
756 {
757     int i;
758     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
759     AspeedI2CState *s = ASPEED_I2C(dev);
760     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
761 
762     sysbus_init_irq(sbd, &s->irq);
763     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
764                           "aspeed.i2c", 0x1000);
765     sysbus_init_mmio(sbd, &s->iomem);
766 
767     for (i = 0; i < aic->num_busses; i++) {
768         Object *bus = OBJECT(&s->busses[i]);
769         int offset = i < aic->gap ? 1 : 5;
770 
771         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
772             return;
773         }
774 
775         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
776             return;
777         }
778 
779         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
780             return;
781         }
782 
783         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
784                                     &s->busses[i].mr);
785     }
786 
787     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
788                           "aspeed.i2c-pool", aic->pool_size);
789     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
790 
791     if (aic->has_dma) {
792         if (!s->dram_mr) {
793             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
794             return;
795         }
796 
797         address_space_init(&s->dram_as, s->dram_mr,
798                            TYPE_ASPEED_I2C "-dma-dram");
799     }
800 }
801 
802 static Property aspeed_i2c_properties[] = {
803     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
804                      TYPE_MEMORY_REGION, MemoryRegion *),
805     DEFINE_PROP_END_OF_LIST(),
806 };
807 
808 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
809 {
810     DeviceClass *dc = DEVICE_CLASS(klass);
811 
812     dc->vmsd = &aspeed_i2c_vmstate;
813     dc->reset = aspeed_i2c_reset;
814     device_class_set_props(dc, aspeed_i2c_properties);
815     dc->realize = aspeed_i2c_realize;
816     dc->desc = "Aspeed I2C Controller";
817 }
818 
819 static const TypeInfo aspeed_i2c_info = {
820     .name          = TYPE_ASPEED_I2C,
821     .parent        = TYPE_SYS_BUS_DEVICE,
822     .instance_init = aspeed_i2c_instance_init,
823     .instance_size = sizeof(AspeedI2CState),
824     .class_init    = aspeed_i2c_class_init,
825     .class_size = sizeof(AspeedI2CClass),
826     .abstract   = true,
827 };
828 
829 static void aspeed_i2c_bus_reset(DeviceState *dev)
830 {
831     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
832 
833     memset(s->regs, 0, sizeof(s->regs));
834     i2c_end_transfer(s->bus);
835 }
836 
837 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
838 {
839     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
840     AspeedI2CClass *aic;
841     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
842 
843     if (!s->controller) {
844         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
845         return;
846     }
847 
848     aic = ASPEED_I2C_GET_CLASS(s->controller);
849 
850     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
851 
852     s->bus = i2c_init_bus(dev, name);
853 
854     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
855                           s, name, aic->reg_size);
856     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
857 }
858 
859 static Property aspeed_i2c_bus_properties[] = {
860     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
861     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
862                      AspeedI2CState *),
863     DEFINE_PROP_END_OF_LIST(),
864 };
865 
866 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
867 {
868     DeviceClass *dc = DEVICE_CLASS(klass);
869 
870     dc->desc = "Aspeed I2C Bus";
871     dc->realize = aspeed_i2c_bus_realize;
872     dc->reset = aspeed_i2c_bus_reset;
873     device_class_set_props(dc, aspeed_i2c_bus_properties);
874 }
875 
876 static const TypeInfo aspeed_i2c_bus_info = {
877     .name           = TYPE_ASPEED_I2C_BUS,
878     .parent         = TYPE_SYS_BUS_DEVICE,
879     .instance_size  = sizeof(AspeedI2CBus),
880     .class_init     = aspeed_i2c_bus_class_init,
881 };
882 
883 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
884 {
885     return bus->controller->irq;
886 }
887 
888 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
889 {
890     uint8_t *pool_page =
891         &bus->controller->pool[ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL,
892                                                 POOL_PAGE_SEL) * 0x100];
893 
894     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
895 }
896 
897 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
898 {
899     DeviceClass *dc = DEVICE_CLASS(klass);
900     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
901 
902     dc->desc = "ASPEED 2400 I2C Controller";
903 
904     aic->num_busses = 14;
905     aic->reg_size = 0x40;
906     aic->gap = 7;
907     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
908     aic->pool_size = 0x800;
909     aic->pool_base = 0x800;
910     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
911 }
912 
913 static const TypeInfo aspeed_2400_i2c_info = {
914     .name = TYPE_ASPEED_2400_I2C,
915     .parent = TYPE_ASPEED_I2C,
916     .class_init = aspeed_2400_i2c_class_init,
917 };
918 
919 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
920 {
921     return bus->controller->irq;
922 }
923 
924 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
925 {
926     return &bus->controller->pool[bus->id * 0x10];
927 }
928 
929 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
930 {
931     DeviceClass *dc = DEVICE_CLASS(klass);
932     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
933 
934     dc->desc = "ASPEED 2500 I2C Controller";
935 
936     aic->num_busses = 14;
937     aic->reg_size = 0x40;
938     aic->gap = 7;
939     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
940     aic->pool_size = 0x100;
941     aic->pool_base = 0x200;
942     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
943     aic->check_sram = true;
944     aic->has_dma = true;
945 }
946 
947 static const TypeInfo aspeed_2500_i2c_info = {
948     .name = TYPE_ASPEED_2500_I2C,
949     .parent = TYPE_ASPEED_I2C,
950     .class_init = aspeed_2500_i2c_class_init,
951 };
952 
953 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
954 {
955     return bus->irq;
956 }
957 
958 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
959 {
960    return &bus->controller->pool[bus->id * 0x20];
961 }
962 
963 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
964 {
965     DeviceClass *dc = DEVICE_CLASS(klass);
966     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
967 
968     dc->desc = "ASPEED 2600 I2C Controller";
969 
970     aic->num_busses = 16;
971     aic->reg_size = 0x80;
972     aic->gap = -1; /* no gap */
973     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
974     aic->pool_size = 0x200;
975     aic->pool_base = 0xC00;
976     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
977     aic->has_dma = true;
978 }
979 
980 static const TypeInfo aspeed_2600_i2c_info = {
981     .name = TYPE_ASPEED_2600_I2C,
982     .parent = TYPE_ASPEED_I2C,
983     .class_init = aspeed_2600_i2c_class_init,
984 };
985 
986 static void aspeed_i2c_register_types(void)
987 {
988     type_register_static(&aspeed_i2c_bus_info);
989     type_register_static(&aspeed_i2c_info);
990     type_register_static(&aspeed_2400_i2c_info);
991     type_register_static(&aspeed_2500_i2c_info);
992     type_register_static(&aspeed_2600_i2c_info);
993 }
994 
995 type_init(aspeed_i2c_register_types)
996 
997 
998 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
999 {
1000     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1001     I2CBus *bus = NULL;
1002 
1003     if (busnr >= 0 && busnr < aic->num_busses) {
1004         bus = s->busses[busnr].bus;
1005     }
1006 
1007     return bus;
1008 }
1009