xref: /openbmc/qemu/hw/i2c/aspeed_i2c.c (revision 3be3d6ccf2adbc305645d097fb364753e11edb0f)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/log.h"
25 #include "qemu/module.h"
26 #include "qemu/error-report.h"
27 #include "qapi/error.h"
28 #include "hw/i2c/aspeed_i2c.h"
29 #include "hw/irq.h"
30 #include "hw/qdev-properties.h"
31 #include "hw/registerfields.h"
32 #include "trace.h"
33 
34 /* I2C Global Register */
35 REG32(I2C_CTRL_STATUS, 0x0) /* Device Interrupt Status */
36 REG32(I2C_CTRL_ASSIGN, 0x8) /* Device Interrupt Target Assignment */
37 REG32(I2C_CTRL_GLOBAL, 0xC) /* Global Control Register */
38     FIELD(I2C_CTRL_GLOBAL, SRAM_EN, 0, 1)
39 
40 /* I2C Device (Bus) Register */
41 REG32(I2CD_FUN_CTRL, 0x0) /* I2CD Function Control  */
42     FIELD(I2CD_FUN_CTRL, POOL_PAGE_SEL, 20, 3) /* AST2400 */
43     FIELD(I2CD_FUN_CTRL, M_SDA_LOCK_EN, 16, 1)
44     FIELD(I2CD_FUN_CTRL, MULTI_MASTER_DIS, 15, 1)
45     FIELD(I2CD_FUN_CTRL, M_SCL_DRIVE_EN, 14, 1)
46     FIELD(I2CD_FUN_CTRL, MSB_STS, 9, 1)
47     FIELD(I2CD_FUN_CTRL, SDA_DRIVE_IT_EN, 8, 1)
48     FIELD(I2CD_FUN_CTRL, M_SDA_DRIVE_IT_EN, 7, 1)
49     FIELD(I2CD_FUN_CTRL, M_HIGH_SPEED_EN, 6, 1)
50     FIELD(I2CD_FUN_CTRL, DEF_ADDR_EN, 5, 1)
51     FIELD(I2CD_FUN_CTRL, DEF_ALERT_EN, 4, 1)
52     FIELD(I2CD_FUN_CTRL, DEF_ARP_EN, 3, 1)
53     FIELD(I2CD_FUN_CTRL, DEF_GCALL_EN, 2, 1)
54     FIELD(I2CD_FUN_CTRL, SLAVE_EN, 1, 1)
55     FIELD(I2CD_FUN_CTRL, MASTER_EN, 0, 1)
56 REG32(I2CD_AC_TIMING1, 0x04) /* Clock and AC Timing Control #1 */
57 REG32(I2CD_AC_TIMING2, 0x08) /* Clock and AC Timing Control #2 */
58 REG32(I2CD_INTR_CTRL, 0x0C)  /* I2CD Interrupt Control */
59 REG32(I2CD_INTR_STS, 0x10)   /* I2CD Interrupt Status */
60     FIELD(I2CD_INTR_STS, SLAVE_ADDR_MATCH, 31, 1)    /* 0: addr1 1: addr2 */
61     FIELD(I2CD_INTR_STS, SLAVE_ADDR_RX_PENDING, 29, 1)
62     FIELD(I2CD_INTR_STS, SLAVE_INACTIVE_TIMEOUT, 15, 1)
63     FIELD(I2CD_INTR_STS, SDA_DL_TIMEOUT, 14, 1)
64     FIELD(I2CD_INTR_STS, BUS_RECOVER_DONE, 13, 1)
65     FIELD(I2CD_INTR_STS, SMBUS_ALERT, 12, 1)            /* Bus [0-3] only */
66     FIELD(I2CD_INTR_STS, SMBUS_ARP_ADDR, 11, 1)         /* Removed */
67     FIELD(I2CD_INTR_STS, SMBUS_DEV_ALERT_ADDR, 10, 1)   /* Removed */
68     FIELD(I2CD_INTR_STS, SMBUS_DEF_ADDR, 9, 1)          /* Removed */
69     FIELD(I2CD_INTR_STS, GCALL_ADDR, 8, 1)              /* Removed */
70     FIELD(I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 7, 1)     /* use RX_DONE */
71     FIELD(I2CD_INTR_STS, SCL_TIMEOUT, 6, 1)
72     FIELD(I2CD_INTR_STS, ABNORMAL, 5, 1)
73     FIELD(I2CD_INTR_STS, NORMAL_STOP, 4, 1)
74     FIELD(I2CD_INTR_STS, ARBIT_LOSS, 3, 1)
75     FIELD(I2CD_INTR_STS, RX_DONE, 2, 1)
76     FIELD(I2CD_INTR_STS, TX_NAK, 1, 1)
77     FIELD(I2CD_INTR_STS, TX_ACK, 0, 1)
78 REG32(I2CD_CMD, 0x14) /* I2CD Command/Status */
79     FIELD(I2CD_CMD, SDA_OE, 28, 1)
80     FIELD(I2CD_CMD, SDA_O, 27, 1)
81     FIELD(I2CD_CMD, SCL_OE, 26, 1)
82     FIELD(I2CD_CMD, SCL_O, 25, 1)
83     FIELD(I2CD_CMD, TX_TIMING, 23, 2)
84     FIELD(I2CD_CMD, TX_STATE, 19, 4)
85 /* Tx State Machine */
86 #define   I2CD_TX_STATE_MASK                  0xf
87 #define     I2CD_IDLE                         0x0
88 #define     I2CD_MACTIVE                      0x8
89 #define     I2CD_MSTART                       0x9
90 #define     I2CD_MSTARTR                      0xa
91 #define     I2CD_MSTOP                        0xb
92 #define     I2CD_MTXD                         0xc
93 #define     I2CD_MRXACK                       0xd
94 #define     I2CD_MRXD                         0xe
95 #define     I2CD_MTXACK                       0xf
96 #define     I2CD_SWAIT                        0x1
97 #define     I2CD_SRXD                         0x4
98 #define     I2CD_STXACK                       0x5
99 #define     I2CD_STXD                         0x6
100 #define     I2CD_SRXACK                       0x7
101 #define     I2CD_RECOVER                      0x3
102     FIELD(I2CD_CMD, SCL_LINE_STS, 18, 1)
103     FIELD(I2CD_CMD, SDA_LINE_STS, 17, 1)
104     FIELD(I2CD_CMD, BUS_BUSY_STS, 16, 1)
105     FIELD(I2CD_CMD, SDA_OE_OUT_DIR, 15, 1)
106     FIELD(I2CD_CMD, SDA_O_OUT_DIR, 14, 1)
107     FIELD(I2CD_CMD, SCL_OE_OUT_DIR, 13, 1)
108     FIELD(I2CD_CMD, SCL_O_OUT_DIR, 12, 1)
109     FIELD(I2CD_CMD, BUS_RECOVER_CMD_EN, 11, 1)
110     FIELD(I2CD_CMD, S_ALT_EN, 10, 1)
111     /* Command Bits */
112     FIELD(I2CD_CMD, RX_DMA_EN, 9, 1)
113     FIELD(I2CD_CMD, TX_DMA_EN, 8, 1)
114     FIELD(I2CD_CMD, RX_BUFF_EN, 7, 1)
115     FIELD(I2CD_CMD, TX_BUFF_EN, 6, 1)
116     FIELD(I2CD_CMD, M_STOP_CMD, 5, 1)
117     FIELD(I2CD_CMD, M_S_RX_CMD_LAST, 4, 1)
118     FIELD(I2CD_CMD, M_RX_CMD, 3, 1)
119     FIELD(I2CD_CMD, S_TX_CMD, 2, 1)
120     FIELD(I2CD_CMD, M_TX_CMD, 1, 1)
121     FIELD(I2CD_CMD, M_START_CMD, 0, 1)
122 REG32(I2CD_DEV_ADDR, 0x18) /* Slave Device Address */
123 REG32(I2CD_POOL_CTRL, 0x1C) /* Pool Buffer Control */
124     FIELD(I2CD_POOL_CTRL, RX_COUNT, 24, 5)
125     FIELD(I2CD_POOL_CTRL, RX_SIZE, 16, 5)
126     FIELD(I2CD_POOL_CTRL, TX_COUNT, 9, 5)
127     FIELD(I2CD_POOL_CTRL, OFFSET, 2, 6) /* AST2400 */
128 REG32(I2CD_BYTE_BUF, 0x20) /* Transmit/Receive Byte Buffer */
129     FIELD(I2CD_BYTE_BUF, RX_BUF, 8, 8)
130     FIELD(I2CD_BYTE_BUF, TX_BUF, 0, 8)
131 REG32(I2CD_DMA_ADDR, 0x24) /* DMA Buffer Address */
132 REG32(I2CD_DMA_LEN, 0x28) /* DMA Transfer Length < 4KB */
133 
134 static inline bool aspeed_i2c_bus_is_master(AspeedI2CBus *bus)
135 {
136     return FIELD_EX32(bus->ctrl, I2CD_FUN_CTRL, MASTER_EN);
137 }
138 
139 static inline bool aspeed_i2c_bus_is_enabled(AspeedI2CBus *bus)
140 {
141     return FIELD_EX32(bus->ctrl, I2CD_FUN_CTRL, MASTER_EN) ||
142            FIELD_EX32(bus->ctrl, I2CD_FUN_CTRL, SLAVE_EN);
143 }
144 
145 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
146 {
147     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
148 
149     trace_aspeed_i2c_bus_raise_interrupt(bus->intr_status,
150         FIELD_EX32(bus->intr_status, I2CD_INTR_STS, TX_NAK) ? "nak|" : "",
151         FIELD_EX32(bus->intr_status, I2CD_INTR_STS, TX_ACK) ? "ack|" : "",
152         FIELD_EX32(bus->intr_status, I2CD_INTR_STS, RX_DONE) ? "done|" : "",
153         FIELD_EX32(bus->intr_status, I2CD_INTR_STS, NORMAL_STOP) ? "normal|"
154                                                                  : "",
155         FIELD_EX32(bus->intr_status, I2CD_INTR_STS, ABNORMAL) ? "abnormal"
156                                                               : "");
157 
158     bus->intr_status &= bus->intr_ctrl;
159     if (bus->intr_status) {
160         bus->controller->intr_status |= 1 << bus->id;
161         qemu_irq_raise(aic->bus_get_irq(bus));
162     }
163 }
164 
165 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
166                                     unsigned size)
167 {
168     AspeedI2CBus *bus = opaque;
169     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
170     uint64_t value = -1;
171 
172     switch (offset) {
173     case A_I2CD_FUN_CTRL:
174         value = bus->ctrl;
175         break;
176     case A_I2CD_AC_TIMING1:
177         value = bus->timing[0];
178         break;
179     case A_I2CD_AC_TIMING2:
180         value = bus->timing[1];
181         break;
182     case A_I2CD_INTR_CTRL:
183         value = bus->intr_ctrl;
184         break;
185     case A_I2CD_INTR_STS:
186         value = bus->intr_status;
187         break;
188     case A_I2CD_POOL_CTRL:
189         value = bus->pool_ctrl;
190         break;
191     case A_I2CD_BYTE_BUF:
192         value = bus->buf;
193         break;
194     case A_I2CD_CMD:
195         value = bus->cmd | (i2c_bus_busy(bus->bus) << 16);
196         break;
197     case A_I2CD_DMA_ADDR:
198         if (!aic->has_dma) {
199             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
200             break;
201         }
202         value = bus->dma_addr;
203         break;
204     case A_I2CD_DMA_LEN:
205         if (!aic->has_dma) {
206             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
207             break;
208         }
209         value = bus->dma_len;
210         break;
211 
212     default:
213         qemu_log_mask(LOG_GUEST_ERROR,
214                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
215         value = -1;
216         break;
217     }
218 
219     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
220     return value;
221 }
222 
223 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
224 {
225     bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, TX_STATE, state);
226 }
227 
228 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
229 {
230     return FIELD_EX32(bus->cmd, I2CD_CMD, TX_STATE);
231 }
232 
233 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
234 {
235     MemTxResult result;
236     AspeedI2CState *s = bus->controller;
237 
238     result = address_space_read(&s->dram_as, bus->dma_addr,
239                                 MEMTXATTRS_UNSPECIFIED, data, 1);
240     if (result != MEMTX_OK) {
241         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
242                       __func__, bus->dma_addr);
243         return -1;
244     }
245 
246     bus->dma_addr++;
247     bus->dma_len--;
248     return 0;
249 }
250 
251 static int aspeed_i2c_bus_send(AspeedI2CBus *bus, uint8_t pool_start)
252 {
253     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
254     int ret = -1;
255     int i;
256     int pool_tx_count = FIELD_EX32(bus->pool_ctrl, I2CD_POOL_CTRL, TX_COUNT);
257 
258     if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_BUFF_EN)) {
259         for (i = pool_start; i < pool_tx_count; i++) {
260             uint8_t *pool_base = aic->bus_pool_base(bus);
261 
262             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
263                                       pool_base[i]);
264             ret = i2c_send(bus->bus, pool_base[i]);
265             if (ret) {
266                 break;
267             }
268         }
269         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, TX_BUFF_EN, 0);
270     } else if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_DMA_EN)) {
271         while (bus->dma_len) {
272             uint8_t data;
273             aspeed_i2c_dma_read(bus, &data);
274             trace_aspeed_i2c_bus_send("DMA", bus->dma_len, bus->dma_len, data);
275             ret = i2c_send(bus->bus, data);
276             if (ret) {
277                 break;
278             }
279         }
280         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, TX_DMA_EN, 0);
281     } else {
282         trace_aspeed_i2c_bus_send("BYTE", pool_start, 1, bus->buf);
283         ret = i2c_send(bus->bus, bus->buf);
284     }
285 
286     return ret;
287 }
288 
289 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
290 {
291     AspeedI2CState *s = bus->controller;
292     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
293     uint8_t data;
294     int i;
295     int pool_rx_count = FIELD_EX32(bus->pool_ctrl, I2CD_POOL_CTRL, RX_COUNT);
296 
297     if (FIELD_EX32(bus->cmd, I2CD_CMD, RX_BUFF_EN)) {
298         uint8_t *pool_base = aic->bus_pool_base(bus);
299 
300         for (i = 0; i < pool_rx_count; i++) {
301             pool_base[i] = i2c_recv(bus->bus);
302             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
303                                       pool_base[i]);
304         }
305 
306         /* Update RX count */
307         bus->pool_ctrl = FIELD_DP32(bus->pool_ctrl, I2CD_POOL_CTRL, RX_COUNT,
308                                     i & 0xff);
309         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, RX_BUFF_EN, 0);
310     } else if (FIELD_EX32(bus->cmd, I2CD_CMD, RX_DMA_EN)) {
311         uint8_t data;
312 
313         while (bus->dma_len) {
314             MemTxResult result;
315 
316             data = i2c_recv(bus->bus);
317             trace_aspeed_i2c_bus_recv("DMA", bus->dma_len, bus->dma_len, data);
318             result = address_space_write(&s->dram_as, bus->dma_addr,
319                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
320             if (result != MEMTX_OK) {
321                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
322                               __func__, bus->dma_addr);
323                 return;
324             }
325             bus->dma_addr++;
326             bus->dma_len--;
327         }
328         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, RX_DMA_EN, 0);
329     } else {
330         data = i2c_recv(bus->bus);
331         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->buf);
332         bus->buf = FIELD_DP32(bus->buf, I2CD_BYTE_BUF, RX_BUF, data);
333     }
334 }
335 
336 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
337 {
338     aspeed_i2c_set_state(bus, I2CD_MRXD);
339     aspeed_i2c_bus_recv(bus);
340     bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS, RX_DONE, 1);
341     if (FIELD_EX32(bus->cmd, I2CD_CMD, M_S_RX_CMD_LAST)) {
342         i2c_nack(bus->bus);
343     }
344     bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_RX_CMD, 0);
345     bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_S_RX_CMD_LAST, 0);
346     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
347 }
348 
349 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
350 {
351     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
352 
353     if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_BUFF_EN)) {
354         uint8_t *pool_base = aic->bus_pool_base(bus);
355 
356         return pool_base[0];
357     } else if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_DMA_EN)) {
358         uint8_t data;
359 
360         aspeed_i2c_dma_read(bus, &data);
361         return data;
362     } else {
363         return bus->buf;
364     }
365 }
366 
367 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
368 {
369     AspeedI2CState *s = bus->controller;
370     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
371     bool dma_en = FIELD_EX32(bus->cmd, I2CD_CMD, RX_DMA_EN)  ||
372                   FIELD_EX32(bus->cmd, I2CD_CMD, TX_DMA_EN)  ||
373                   FIELD_EX32(bus->cmd, I2CD_CMD, RX_BUFF_EN) ||
374                   FIELD_EX32(bus->cmd, I2CD_CMD, TX_BUFF_EN);
375     if (!aic->check_sram) {
376         return true;
377     }
378 
379     /*
380      * AST2500: SRAM must be enabled before using the Buffer Pool or
381      * DMA mode.
382      */
383     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
384         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
385         return false;
386     }
387 
388     return true;
389 }
390 
391 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
392 {
393     g_autofree char *cmd_flags = NULL;
394     uint32_t count;
395     if (FIELD_EX32(bus->cmd, I2CD_CMD, RX_BUFF_EN)) {
396         count = FIELD_EX32(bus->pool_ctrl, I2CD_POOL_CTRL, TX_COUNT);
397     } else if (FIELD_EX32(bus->cmd, I2CD_CMD, RX_DMA_EN)) {
398         count = bus->dma_len;
399     } else { /* BYTE mode */
400         count = 1;
401     }
402 
403     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
404              FIELD_EX32(bus->cmd, I2CD_CMD, M_START_CMD) ? "start|" : "",
405              FIELD_EX32(bus->cmd, I2CD_CMD, RX_DMA_EN) ? "rxdma|" : "",
406              FIELD_EX32(bus->cmd, I2CD_CMD, TX_DMA_EN) ? "txdma|" : "",
407              FIELD_EX32(bus->cmd, I2CD_CMD, RX_BUFF_EN) ? "rxbuf|" : "",
408              FIELD_EX32(bus->cmd, I2CD_CMD, TX_BUFF_EN) ? "txbuf|" : "",
409              FIELD_EX32(bus->cmd, I2CD_CMD, M_TX_CMD) ? "tx|" : "",
410              FIELD_EX32(bus->cmd, I2CD_CMD, M_RX_CMD) ? "rx|" : "",
411              FIELD_EX32(bus->cmd, I2CD_CMD, M_S_RX_CMD_LAST) ? "last|" : "",
412              FIELD_EX32(bus->cmd, I2CD_CMD, M_STOP_CMD) ? "stop" : "");
413 
414     trace_aspeed_i2c_bus_cmd(bus->cmd, cmd_flags, count, bus->intr_status);
415 }
416 
417 /*
418  * The state machine needs some refinement. It is only used to track
419  * invalid STOP commands for the moment.
420  */
421 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
422 {
423     uint8_t pool_start = 0;
424 
425     bus->cmd &= ~0xFFFF;
426     bus->cmd |= value & 0xFFFF;
427 
428     if (!aspeed_i2c_check_sram(bus)) {
429         return;
430     }
431 
432     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
433         aspeed_i2c_bus_cmd_dump(bus);
434     }
435 
436     if (FIELD_EX32(bus->cmd, I2CD_CMD, M_START_CMD)) {
437         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
438             I2CD_MSTARTR : I2CD_MSTART;
439         uint8_t addr;
440 
441         aspeed_i2c_set_state(bus, state);
442 
443         addr = aspeed_i2c_get_addr(bus);
444 
445         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
446                                extract32(addr, 0, 1))) {
447             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
448                                           TX_NAK, 1);
449         } else {
450             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
451                                           TX_ACK, 1);
452         }
453 
454         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_START_CMD, 0);
455 
456         /*
457          * The START command is also a TX command, as the slave
458          * address is sent on the bus. Drop the TX flag if nothing
459          * else needs to be sent in this sequence.
460          */
461         if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_BUFF_EN)) {
462             if (FIELD_EX32(bus->pool_ctrl, I2CD_POOL_CTRL, TX_COUNT) == 1) {
463                 bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_TX_CMD, 0);
464             } else {
465                 /*
466                  * Increase the start index in the TX pool buffer to
467                  * skip the address byte.
468                  */
469                 pool_start++;
470             }
471         } else if (FIELD_EX32(bus->cmd, I2CD_CMD, TX_DMA_EN)) {
472             if (bus->dma_len == 0) {
473                 bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_TX_CMD, 0);
474             }
475         } else {
476             bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_TX_CMD, 0);
477         }
478 
479         /* No slave found */
480         if (!i2c_bus_busy(bus->bus)) {
481             return;
482         }
483         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
484     }
485 
486     if (FIELD_EX32(bus->cmd, I2CD_CMD, M_TX_CMD)) {
487         aspeed_i2c_set_state(bus, I2CD_MTXD);
488         if (aspeed_i2c_bus_send(bus, pool_start)) {
489             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
490                                           TX_NAK, 1);
491             i2c_end_transfer(bus->bus);
492         } else {
493             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
494                                           TX_ACK, 1);
495         }
496         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_TX_CMD, 0);
497         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
498     }
499 
500     if ((FIELD_EX32(bus->cmd, I2CD_CMD, M_RX_CMD) ||
501          FIELD_EX32(bus->cmd, I2CD_CMD, M_S_RX_CMD_LAST)) &&
502         !FIELD_EX32(bus->intr_status, I2CD_INTR_STS, RX_DONE)) {
503         aspeed_i2c_handle_rx_cmd(bus);
504     }
505 
506     if (FIELD_EX32(bus->cmd, I2CD_CMD, M_STOP_CMD)) {
507         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
508             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
509             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
510                                           ABNORMAL, 1);
511         } else {
512             aspeed_i2c_set_state(bus, I2CD_MSTOP);
513             i2c_end_transfer(bus->bus);
514             bus->intr_status = FIELD_DP32(bus->intr_status, I2CD_INTR_STS,
515                                           NORMAL_STOP, 1);
516         }
517         bus->cmd = FIELD_DP32(bus->cmd, I2CD_CMD, M_STOP_CMD, 0);
518         aspeed_i2c_set_state(bus, I2CD_IDLE);
519     }
520 }
521 
522 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
523                                  uint64_t value, unsigned size)
524 {
525     AspeedI2CBus *bus = opaque;
526     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
527     bool handle_rx;
528 
529     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
530 
531     switch (offset) {
532     case A_I2CD_FUN_CTRL:
533         if (FIELD_EX32(value, I2CD_FUN_CTRL, SLAVE_EN)) {
534             qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
535                           __func__);
536             break;
537         }
538         bus->ctrl = value & 0x0071C3FF;
539         break;
540     case A_I2CD_AC_TIMING1:
541         bus->timing[0] = value & 0xFFFFF0F;
542         break;
543     case A_I2CD_AC_TIMING2:
544         bus->timing[1] = value & 0x7;
545         break;
546     case A_I2CD_INTR_CTRL:
547         bus->intr_ctrl = value & 0x7FFF;
548         break;
549     case A_I2CD_INTR_STS:
550         handle_rx = FIELD_EX32(bus->intr_status, I2CD_INTR_STS, RX_DONE) &&
551                     FIELD_EX32(value, I2CD_INTR_STS, RX_DONE);
552         bus->intr_status &= ~(value & 0x7FFF);
553         if (!bus->intr_status) {
554             bus->controller->intr_status &= ~(1 << bus->id);
555             qemu_irq_lower(aic->bus_get_irq(bus));
556         }
557         if (handle_rx && (FIELD_EX32(bus->cmd, I2CD_CMD, M_RX_CMD) ||
558                          FIELD_EX32(bus->cmd, I2CD_CMD, M_S_RX_CMD_LAST))) {
559             aspeed_i2c_handle_rx_cmd(bus);
560             aspeed_i2c_bus_raise_interrupt(bus);
561         }
562         break;
563     case A_I2CD_DEV_ADDR:
564         qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
565                       __func__);
566         break;
567     case A_I2CD_POOL_CTRL:
568         bus->pool_ctrl &= ~0xffffff;
569         bus->pool_ctrl |= (value & 0xffffff);
570         break;
571 
572     case A_I2CD_BYTE_BUF:
573         bus->buf = FIELD_DP32(bus->buf, I2CD_BYTE_BUF, TX_BUF, value);
574         break;
575     case A_I2CD_CMD:
576         if (!aspeed_i2c_bus_is_enabled(bus)) {
577             break;
578         }
579 
580         if (!aspeed_i2c_bus_is_master(bus)) {
581             qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
582                           __func__);
583             break;
584         }
585 
586         if (!aic->has_dma &&
587             (FIELD_EX32(value, I2CD_CMD, RX_DMA_EN) ||
588              FIELD_EX32(value, I2CD_CMD, TX_DMA_EN))) {
589             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
590             break;
591         }
592 
593         aspeed_i2c_bus_handle_cmd(bus, value);
594         aspeed_i2c_bus_raise_interrupt(bus);
595         break;
596     case A_I2CD_DMA_ADDR:
597         if (!aic->has_dma) {
598             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
599             break;
600         }
601 
602         bus->dma_addr = value & 0x3ffffffc;
603         break;
604 
605     case A_I2CD_DMA_LEN:
606         if (!aic->has_dma) {
607             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
608             break;
609         }
610 
611         bus->dma_len = value & 0xfff;
612         if (!bus->dma_len) {
613             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
614         }
615         break;
616 
617     default:
618         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
619                       __func__, offset);
620     }
621 }
622 
623 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
624                                    unsigned size)
625 {
626     AspeedI2CState *s = opaque;
627 
628     switch (offset) {
629     case A_I2C_CTRL_STATUS:
630         return s->intr_status;
631     case A_I2C_CTRL_GLOBAL:
632         return s->ctrl_global;
633     default:
634         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
635                       __func__, offset);
636         break;
637     }
638 
639     return -1;
640 }
641 
642 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
643                                   uint64_t value, unsigned size)
644 {
645     AspeedI2CState *s = opaque;
646 
647     switch (offset) {
648     case A_I2C_CTRL_GLOBAL:
649         s->ctrl_global = value;
650         break;
651     case A_I2C_CTRL_STATUS:
652     default:
653         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
654                       __func__, offset);
655         break;
656     }
657 }
658 
659 static const MemoryRegionOps aspeed_i2c_bus_ops = {
660     .read = aspeed_i2c_bus_read,
661     .write = aspeed_i2c_bus_write,
662     .endianness = DEVICE_LITTLE_ENDIAN,
663 };
664 
665 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
666     .read = aspeed_i2c_ctrl_read,
667     .write = aspeed_i2c_ctrl_write,
668     .endianness = DEVICE_LITTLE_ENDIAN,
669 };
670 
671 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
672                                      unsigned size)
673 {
674     AspeedI2CState *s = opaque;
675     uint64_t ret = 0;
676     int i;
677 
678     for (i = 0; i < size; i++) {
679         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
680     }
681 
682     return ret;
683 }
684 
685 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
686                                   uint64_t value, unsigned size)
687 {
688     AspeedI2CState *s = opaque;
689     int i;
690 
691     for (i = 0; i < size; i++) {
692         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
693     }
694 }
695 
696 static const MemoryRegionOps aspeed_i2c_pool_ops = {
697     .read = aspeed_i2c_pool_read,
698     .write = aspeed_i2c_pool_write,
699     .endianness = DEVICE_LITTLE_ENDIAN,
700     .valid = {
701         .min_access_size = 1,
702         .max_access_size = 4,
703     },
704 };
705 
706 static const VMStateDescription aspeed_i2c_bus_vmstate = {
707     .name = TYPE_ASPEED_I2C,
708     .version_id = 3,
709     .minimum_version_id = 3,
710     .fields = (VMStateField[]) {
711         VMSTATE_UINT8(id, AspeedI2CBus),
712         VMSTATE_UINT32(ctrl, AspeedI2CBus),
713         VMSTATE_UINT32_ARRAY(timing, AspeedI2CBus, 2),
714         VMSTATE_UINT32(intr_ctrl, AspeedI2CBus),
715         VMSTATE_UINT32(intr_status, AspeedI2CBus),
716         VMSTATE_UINT32(cmd, AspeedI2CBus),
717         VMSTATE_UINT32(buf, AspeedI2CBus),
718         VMSTATE_UINT32(pool_ctrl, AspeedI2CBus),
719         VMSTATE_UINT32(dma_addr, AspeedI2CBus),
720         VMSTATE_UINT32(dma_len, AspeedI2CBus),
721         VMSTATE_END_OF_LIST()
722     }
723 };
724 
725 static const VMStateDescription aspeed_i2c_vmstate = {
726     .name = TYPE_ASPEED_I2C,
727     .version_id = 2,
728     .minimum_version_id = 2,
729     .fields = (VMStateField[]) {
730         VMSTATE_UINT32(intr_status, AspeedI2CState),
731         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
732                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
733                              AspeedI2CBus),
734         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
735         VMSTATE_END_OF_LIST()
736     }
737 };
738 
739 static void aspeed_i2c_reset(DeviceState *dev)
740 {
741     AspeedI2CState *s = ASPEED_I2C(dev);
742 
743     s->intr_status = 0;
744 }
745 
746 static void aspeed_i2c_instance_init(Object *obj)
747 {
748     AspeedI2CState *s = ASPEED_I2C(obj);
749     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
750     int i;
751 
752     for (i = 0; i < aic->num_busses; i++) {
753         object_initialize_child(obj, "bus[*]", &s->busses[i],
754                                 TYPE_ASPEED_I2C_BUS);
755     }
756 }
757 
758 /*
759  * Address Definitions (AST2400 and AST2500)
760  *
761  *   0x000 ... 0x03F: Global Register
762  *   0x040 ... 0x07F: Device 1
763  *   0x080 ... 0x0BF: Device 2
764  *   0x0C0 ... 0x0FF: Device 3
765  *   0x100 ... 0x13F: Device 4
766  *   0x140 ... 0x17F: Device 5
767  *   0x180 ... 0x1BF: Device 6
768  *   0x1C0 ... 0x1FF: Device 7
769  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
770  *   0x300 ... 0x33F: Device 8
771  *   0x340 ... 0x37F: Device 9
772  *   0x380 ... 0x3BF: Device 10
773  *   0x3C0 ... 0x3FF: Device 11
774  *   0x400 ... 0x43F: Device 12
775  *   0x440 ... 0x47F: Device 13
776  *   0x480 ... 0x4BF: Device 14
777  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
778  */
779 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
780 {
781     int i;
782     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
783     AspeedI2CState *s = ASPEED_I2C(dev);
784     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
785 
786     sysbus_init_irq(sbd, &s->irq);
787     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
788                           "aspeed.i2c", 0x1000);
789     sysbus_init_mmio(sbd, &s->iomem);
790 
791     for (i = 0; i < aic->num_busses; i++) {
792         Object *bus = OBJECT(&s->busses[i]);
793         int offset = i < aic->gap ? 1 : 5;
794 
795         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
796             return;
797         }
798 
799         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
800             return;
801         }
802 
803         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
804             return;
805         }
806 
807         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
808                                     &s->busses[i].mr);
809     }
810 
811     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
812                           "aspeed.i2c-pool", aic->pool_size);
813     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
814 
815     if (aic->has_dma) {
816         if (!s->dram_mr) {
817             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
818             return;
819         }
820 
821         address_space_init(&s->dram_as, s->dram_mr,
822                            TYPE_ASPEED_I2C "-dma-dram");
823     }
824 }
825 
826 static Property aspeed_i2c_properties[] = {
827     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
828                      TYPE_MEMORY_REGION, MemoryRegion *),
829     DEFINE_PROP_END_OF_LIST(),
830 };
831 
832 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
833 {
834     DeviceClass *dc = DEVICE_CLASS(klass);
835 
836     dc->vmsd = &aspeed_i2c_vmstate;
837     dc->reset = aspeed_i2c_reset;
838     device_class_set_props(dc, aspeed_i2c_properties);
839     dc->realize = aspeed_i2c_realize;
840     dc->desc = "Aspeed I2C Controller";
841 }
842 
843 static const TypeInfo aspeed_i2c_info = {
844     .name          = TYPE_ASPEED_I2C,
845     .parent        = TYPE_SYS_BUS_DEVICE,
846     .instance_init = aspeed_i2c_instance_init,
847     .instance_size = sizeof(AspeedI2CState),
848     .class_init    = aspeed_i2c_class_init,
849     .class_size = sizeof(AspeedI2CClass),
850     .abstract   = true,
851 };
852 
853 static void aspeed_i2c_bus_reset(DeviceState *dev)
854 {
855     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
856 
857     s->intr_ctrl = 0;
858     s->intr_status = 0;
859     s->cmd = 0;
860     s->buf = 0;
861     s->dma_addr = 0;
862     s->dma_len = 0;
863     i2c_end_transfer(s->bus);
864 }
865 
866 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
867 {
868     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
869     AspeedI2CClass *aic;
870     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
871 
872     if (!s->controller) {
873         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
874         return;
875     }
876 
877     aic = ASPEED_I2C_GET_CLASS(s->controller);
878 
879     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
880 
881     s->bus = i2c_init_bus(dev, name);
882 
883     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
884                           s, name, aic->reg_size);
885     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
886 }
887 
888 static Property aspeed_i2c_bus_properties[] = {
889     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
890     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
891                      AspeedI2CState *),
892     DEFINE_PROP_END_OF_LIST(),
893 };
894 
895 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
896 {
897     DeviceClass *dc = DEVICE_CLASS(klass);
898 
899     dc->desc = "Aspeed I2C Bus";
900     dc->realize = aspeed_i2c_bus_realize;
901     dc->reset = aspeed_i2c_bus_reset;
902     device_class_set_props(dc, aspeed_i2c_bus_properties);
903 }
904 
905 static const TypeInfo aspeed_i2c_bus_info = {
906     .name           = TYPE_ASPEED_I2C_BUS,
907     .parent         = TYPE_SYS_BUS_DEVICE,
908     .instance_size  = sizeof(AspeedI2CBus),
909     .class_init     = aspeed_i2c_bus_class_init,
910 };
911 
912 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
913 {
914     return bus->controller->irq;
915 }
916 
917 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
918 {
919     uint8_t *pool_page =
920         &bus->controller->pool[FIELD_EX32(bus->ctrl, I2CD_FUN_CTRL,
921                                           POOL_PAGE_SEL) * 0x100];
922 
923     return &pool_page[FIELD_EX32(bus->pool_ctrl, I2CD_POOL_CTRL, OFFSET)];
924 }
925 
926 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
927 {
928     DeviceClass *dc = DEVICE_CLASS(klass);
929     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
930 
931     dc->desc = "ASPEED 2400 I2C Controller";
932 
933     aic->num_busses = 14;
934     aic->reg_size = 0x40;
935     aic->gap = 7;
936     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
937     aic->pool_size = 0x800;
938     aic->pool_base = 0x800;
939     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
940 }
941 
942 static const TypeInfo aspeed_2400_i2c_info = {
943     .name = TYPE_ASPEED_2400_I2C,
944     .parent = TYPE_ASPEED_I2C,
945     .class_init = aspeed_2400_i2c_class_init,
946 };
947 
948 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
949 {
950     return bus->controller->irq;
951 }
952 
953 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
954 {
955     return &bus->controller->pool[bus->id * 0x10];
956 }
957 
958 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
959 {
960     DeviceClass *dc = DEVICE_CLASS(klass);
961     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
962 
963     dc->desc = "ASPEED 2500 I2C Controller";
964 
965     aic->num_busses = 14;
966     aic->reg_size = 0x40;
967     aic->gap = 7;
968     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
969     aic->pool_size = 0x100;
970     aic->pool_base = 0x200;
971     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
972     aic->check_sram = true;
973     aic->has_dma = true;
974 }
975 
976 static const TypeInfo aspeed_2500_i2c_info = {
977     .name = TYPE_ASPEED_2500_I2C,
978     .parent = TYPE_ASPEED_I2C,
979     .class_init = aspeed_2500_i2c_class_init,
980 };
981 
982 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
983 {
984     return bus->irq;
985 }
986 
987 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
988 {
989    return &bus->controller->pool[bus->id * 0x20];
990 }
991 
992 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
993 {
994     DeviceClass *dc = DEVICE_CLASS(klass);
995     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
996 
997     dc->desc = "ASPEED 2600 I2C Controller";
998 
999     aic->num_busses = 16;
1000     aic->reg_size = 0x80;
1001     aic->gap = -1; /* no gap */
1002     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1003     aic->pool_size = 0x200;
1004     aic->pool_base = 0xC00;
1005     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1006     aic->has_dma = true;
1007 }
1008 
1009 static const TypeInfo aspeed_2600_i2c_info = {
1010     .name = TYPE_ASPEED_2600_I2C,
1011     .parent = TYPE_ASPEED_I2C,
1012     .class_init = aspeed_2600_i2c_class_init,
1013 };
1014 
1015 static void aspeed_i2c_register_types(void)
1016 {
1017     type_register_static(&aspeed_i2c_bus_info);
1018     type_register_static(&aspeed_i2c_info);
1019     type_register_static(&aspeed_2400_i2c_info);
1020     type_register_static(&aspeed_2500_i2c_info);
1021     type_register_static(&aspeed_2600_i2c_info);
1022 }
1023 
1024 type_init(aspeed_i2c_register_types)
1025 
1026 
1027 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1028 {
1029     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1030     I2CBus *bus = NULL;
1031 
1032     if (busnr >= 0 && busnr < aic->num_busses) {
1033         bus = s->busses[busnr].bus;
1034     }
1035 
1036     return bus;
1037 }
1038