xref: /openbmc/qemu/hw/i2c/aspeed_i2c.c (revision 7d87775f)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/cutils.h"
25 #include "qemu/log.h"
26 #include "qemu/module.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "hw/i2c/aspeed_i2c.h"
30 #include "hw/irq.h"
31 #include "hw/qdev-properties.h"
32 #include "hw/registerfields.h"
33 #include "trace.h"
34 
35 /* Enable SLAVE_ADDR_RX_MATCH always */
36 #define R_I2CD_INTR_STS_ALWAYS_ENABLE  R_I2CD_INTR_STS_SLAVE_ADDR_RX_MATCH_MASK
37 
38 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
39 {
40     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
41     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
42     uint32_t intr_ctrl_reg = aspeed_i2c_bus_intr_ctrl_offset(bus);
43     uint32_t intr_ctrl_mask = bus->regs[intr_ctrl_reg] |
44         R_I2CD_INTR_STS_ALWAYS_ENABLE;
45     bool raise_irq;
46 
47     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_RAISE_INTERRUPT)) {
48         g_autofree char *buf = g_strdup_printf("%s%s%s%s%s%s%s",
49                aspeed_i2c_bus_pkt_mode_en(bus) &&
50                ARRAY_FIELD_EX32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE) ?
51                                                "pktdone|" : "",
52                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_NAK) ?
53                                                "nak|" : "",
54                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_ACK) ?
55                                                "ack|" : "",
56                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE) ?
57                                                "done|" : "",
58                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
59                                                "slave-match|" : "",
60                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
61                                                "stop|" : "",
62                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
63                                                "abnormal"  : "");
64 
65            trace_aspeed_i2c_bus_raise_interrupt(bus->regs[reg_intr_sts], buf);
66     }
67 
68     raise_irq = bus->regs[reg_intr_sts] & intr_ctrl_mask ;
69 
70     /* In packet mode we don't mask off INTR_STS */
71     if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
72         bus->regs[reg_intr_sts] &= intr_ctrl_mask;
73     }
74 
75     if (raise_irq) {
76         bus->controller->intr_status |= 1 << bus->id;
77         qemu_irq_raise(aic->bus_get_irq(bus));
78     }
79 }
80 
81 static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
82 {
83     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
84 
85     if (!bus->regs[R_I2CS_INTR_STS]) {
86         return;
87     }
88 
89     bus->controller->intr_status |= 1 << bus->id;
90     qemu_irq_raise(aic->bus_get_irq(bus));
91 }
92 
93 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
94                                         unsigned size)
95 {
96     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
97     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
98 
99     switch (offset) {
100     case A_I2CD_FUN_CTRL:
101     case A_I2CD_AC_TIMING1:
102     case A_I2CD_AC_TIMING2:
103     case A_I2CD_INTR_CTRL:
104     case A_I2CD_INTR_STS:
105     case A_I2CD_DEV_ADDR:
106     case A_I2CD_POOL_CTRL:
107     case A_I2CD_BYTE_BUF:
108         /* Value is already set, don't do anything. */
109         break;
110     case A_I2CD_CMD:
111         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
112         break;
113     case A_I2CD_DMA_ADDR:
114         if (!aic->has_dma) {
115             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
116             value = -1;
117             break;
118         }
119 
120         value = extract64(bus->dma_dram_offset, 0, 32);
121         break;
122     case A_I2CD_DMA_LEN:
123         if (!aic->has_dma) {
124             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
125             value = -1;
126         }
127         break;
128 
129     default:
130         qemu_log_mask(LOG_GUEST_ERROR,
131                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
132         value = -1;
133         break;
134     }
135 
136     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
137     return value;
138 }
139 
140 static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
141                                         unsigned size)
142 {
143     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
144     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
145 
146     switch (offset) {
147     case A_I2CC_FUN_CTRL:
148     case A_I2CC_AC_TIMING:
149     case A_I2CC_POOL_CTRL:
150     case A_I2CM_INTR_CTRL:
151     case A_I2CM_INTR_STS:
152     case A_I2CC_MS_TXRX_BYTE_BUF:
153     case A_I2CM_DMA_LEN:
154     case A_I2CM_DMA_TX_ADDR:
155     case A_I2CM_DMA_RX_ADDR:
156     case A_I2CM_DMA_LEN_STS:
157     case A_I2CC_DMA_LEN:
158     case A_I2CS_DEV_ADDR:
159     case A_I2CS_DMA_RX_ADDR:
160     case A_I2CS_DMA_LEN:
161     case A_I2CS_CMD:
162     case A_I2CS_INTR_CTRL:
163     case A_I2CS_DMA_LEN_STS:
164         /* Value is already set, don't do anything. */
165         break;
166     case A_I2CC_DMA_ADDR:
167         value = extract64(bus->dma_dram_offset, 0, 32);
168         break;
169     case A_I2CS_INTR_STS:
170         break;
171     case A_I2CM_CMD:
172         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
173         break;
174     case A_I2CM_DMA_TX_ADDR_HI:
175     case A_I2CM_DMA_RX_ADDR_HI:
176     case A_I2CS_DMA_TX_ADDR_HI:
177     case A_I2CS_DMA_RX_ADDR_HI:
178         if (!aic->has_dma64) {
179             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n",
180             __func__);
181             value = -1;
182         }
183         break;
184     default:
185         qemu_log_mask(LOG_GUEST_ERROR,
186                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
187         value = -1;
188         break;
189     }
190 
191     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
192     return value;
193 }
194 
195 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
196                                     unsigned size)
197 {
198     AspeedI2CBus *bus = opaque;
199     if (aspeed_i2c_is_new_mode(bus->controller)) {
200         return aspeed_i2c_bus_new_read(bus, offset, size);
201     }
202     return aspeed_i2c_bus_old_read(bus, offset, size);
203 }
204 
205 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
206 {
207     if (aspeed_i2c_is_new_mode(bus->controller)) {
208         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_STATE,
209                                 state);
210     } else {
211         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_CMD, TX_STATE, state);
212     }
213 }
214 
215 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
216 {
217     if (aspeed_i2c_is_new_mode(bus->controller)) {
218         return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF,
219                                        TX_STATE);
220     }
221     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
222 }
223 
224 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
225 {
226     MemTxResult result;
227     AspeedI2CState *s = bus->controller;
228     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
229 
230     result = address_space_read(&s->dram_as, bus->dma_dram_offset,
231                                 MEMTXATTRS_UNSPECIFIED, data, 1);
232     if (result != MEMTX_OK) {
233         qemu_log_mask(LOG_GUEST_ERROR,
234                       "%s: DRAM read failed @%" PRIx64 "\n",
235                       __func__, bus->dma_dram_offset);
236         return -1;
237     }
238 
239     bus->dma_dram_offset++;
240     bus->regs[reg_dma_len]--;
241     return 0;
242 }
243 
244 static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
245 {
246     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
247     int ret = -1;
248     int i;
249     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
250     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
251     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
252     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
253     int pool_tx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
254                                                 TX_COUNT) + 1;
255 
256     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
257         for (i = 0; i < pool_tx_count; i++) {
258             uint8_t *pool_base = aic->bus_pool_base(bus);
259 
260             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
261                                       pool_base[i]);
262             ret = i2c_send(bus->bus, pool_base[i]);
263             if (ret) {
264                 break;
265             }
266         }
267         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_BUFF_EN, 0);
268     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
269         /* In new mode, clear how many bytes we TXed */
270         if (aspeed_i2c_is_new_mode(bus->controller)) {
271             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
272         }
273         while (bus->regs[reg_dma_len]) {
274             uint8_t data;
275             aspeed_i2c_dma_read(bus, &data);
276             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
277                                       bus->regs[reg_dma_len], data);
278             ret = i2c_send(bus->bus, data);
279             if (ret) {
280                 break;
281             }
282             /* In new mode, keep track of how many bytes we TXed */
283             if (aspeed_i2c_is_new_mode(bus->controller)) {
284                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN,
285                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
286                                                   TX_LEN) + 1);
287             }
288         }
289         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_DMA_EN, 0);
290     } else {
291         trace_aspeed_i2c_bus_send("BYTE", 0, 1,
292                                   bus->regs[reg_byte_buf]);
293         ret = i2c_send(bus->bus, bus->regs[reg_byte_buf]);
294     }
295 
296     return ret;
297 }
298 
299 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
300 {
301     AspeedI2CState *s = bus->controller;
302     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
303     uint8_t data;
304     int i;
305     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
306     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
307     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
308     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
309     int pool_rx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
310                                                 RX_SIZE) + 1;
311 
312     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
313         uint8_t *pool_base = aic->bus_pool_base(bus);
314         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
315                                     BUF_ORGANIZATION)) {
316             pool_base += 16;
317         }
318 
319         for (i = 0; i < pool_rx_count; i++) {
320             pool_base[i] = i2c_recv(bus->bus);
321             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
322                                       pool_base[i]);
323         }
324 
325         /* Update RX count */
326         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_pool_ctrl, RX_COUNT, i & 0xff);
327         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_BUFF_EN, 0);
328     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
329         /* In new mode, clear how many bytes we RXed */
330         if (aspeed_i2c_is_new_mode(bus->controller)) {
331             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
332         }
333 
334         while (bus->regs[reg_dma_len]) {
335             MemTxResult result;
336 
337             data = i2c_recv(bus->bus);
338             trace_aspeed_i2c_bus_recv("DMA", bus->regs[reg_dma_len],
339                                       bus->regs[reg_dma_len], data);
340 
341             result = address_space_write(&s->dram_as, bus->dma_dram_offset,
342                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
343             if (result != MEMTX_OK) {
344                 qemu_log_mask(LOG_GUEST_ERROR,
345                               "%s: DRAM write failed @%" PRIx64 "\n",
346                               __func__, bus->dma_dram_offset);
347                 return;
348             }
349 
350             bus->dma_dram_offset++;
351             bus->regs[reg_dma_len]--;
352             /* In new mode, keep track of how many bytes we RXed */
353             if (aspeed_i2c_is_new_mode(bus->controller)) {
354                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN,
355                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
356                                                   RX_LEN) + 1);
357             }
358         }
359         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_DMA_EN, 0);
360     } else {
361         data = i2c_recv(bus->bus);
362         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[reg_byte_buf]);
363         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
364     }
365 }
366 
367 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
368 {
369     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
370     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
371 
372     aspeed_i2c_set_state(bus, I2CD_MRXD);
373     aspeed_i2c_bus_recv(bus);
374     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
375     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) {
376         i2c_nack(bus->bus);
377     }
378     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_RX_CMD, 0);
379     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_S_RX_CMD_LAST, 0);
380     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
381 }
382 
383 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
384 {
385     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
386     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
387     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
388 
389     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
390         return (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, PKT_DEV_ADDR) << 1) |
391                 SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD);
392     }
393     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
394         uint8_t *pool_base = aic->bus_pool_base(bus);
395 
396         return pool_base[0];
397     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
398         uint8_t data;
399 
400         aspeed_i2c_dma_read(bus, &data);
401         return data;
402     } else {
403         return bus->regs[reg_byte_buf];
404     }
405 }
406 
407 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
408 {
409     AspeedI2CState *s = bus->controller;
410     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
411     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
412     bool dma_en = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)  ||
413                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)  ||
414                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ||
415                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN);
416     if (!aic->check_sram) {
417         return true;
418     }
419 
420     /*
421      * AST2500: SRAM must be enabled before using the Buffer Pool or
422      * DMA mode.
423      */
424     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
425         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
426         return false;
427     }
428 
429     return true;
430 }
431 
432 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
433 {
434     g_autofree char *cmd_flags = NULL;
435     uint32_t count;
436     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
437     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
438     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
439     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
440     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
441         count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT) + 1;
442     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
443         count = bus->regs[reg_dma_len];
444     } else { /* BYTE mode */
445         count = 1;
446     }
447 
448     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
449     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD) ? "start|" : "",
450     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN) ? "rxdma|" : "",
451     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN) ? "txdma|" : "",
452     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ? "rxbuf|" : "",
453     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN) ? "txbuf|" : "",
454     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD) ? "tx|" : "",
455     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ? "rx|" : "",
456     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST) ? "last|" : "",
457     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD) ? "stop|" : "");
458 
459     trace_aspeed_i2c_bus_cmd(bus->regs[reg_cmd], cmd_flags, count,
460                              bus->regs[reg_intr_sts]);
461 }
462 
463 /*
464  * The state machine needs some refinement. It is only used to track
465  * invalid STOP commands for the moment.
466  */
467 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
468 {
469     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
470     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
471     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
472 
473     if (!aspeed_i2c_check_sram(bus)) {
474         return;
475     }
476 
477     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
478         aspeed_i2c_bus_cmd_dump(bus);
479     }
480 
481     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD)) {
482         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
483             I2CD_MSTARTR : I2CD_MSTART;
484         uint8_t addr;
485 
486         aspeed_i2c_set_state(bus, state);
487 
488         addr = aspeed_i2c_get_addr(bus);
489         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
490                                extract32(addr, 0, 1))) {
491             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
492             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
493                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
494             }
495         } else {
496             /* START doesn't set TX_ACK in packet mode */
497             if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
498                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
499             }
500         }
501 
502         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_START_CMD, 0);
503 
504         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
505             if (bus->regs[reg_dma_len] == 0) {
506                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
507             }
508         } else if (!SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
509             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
510         }
511 
512         /* No slave found */
513         if (!i2c_bus_busy(bus->bus)) {
514             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
515                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
516                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
517             }
518             return;
519         }
520         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
521     }
522 
523     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD)) {
524         aspeed_i2c_set_state(bus, I2CD_MTXD);
525         if (aspeed_i2c_bus_send(bus)) {
526             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
527             i2c_end_transfer(bus->bus);
528         } else {
529             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
530         }
531         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
532         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
533     }
534 
535     if ((SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ||
536          SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) &&
537         !SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE)) {
538         aspeed_i2c_handle_rx_cmd(bus);
539     }
540 
541     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD)) {
542         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
543             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
544             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, ABNORMAL, 1);
545             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
546                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
547             }
548         } else {
549             aspeed_i2c_set_state(bus, I2CD_MSTOP);
550             i2c_end_transfer(bus->bus);
551             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
552         }
553         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
554         aspeed_i2c_set_state(bus, I2CD_IDLE);
555 
556         i2c_schedule_pending_master(bus->bus);
557     }
558 
559     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
560         ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
561     }
562 }
563 
564 static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
565                                      uint64_t value, unsigned size)
566 {
567     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
568     bool handle_rx;
569     bool w1t;
570 
571     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
572 
573     switch (offset) {
574     case A_I2CC_FUN_CTRL:
575         bus->regs[R_I2CC_FUN_CTRL] = value;
576         break;
577     case A_I2CC_AC_TIMING:
578         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
579         break;
580     case A_I2CC_MS_TXRX_BYTE_BUF:
581         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_BUF,
582                                 value);
583         break;
584     case A_I2CC_POOL_CTRL:
585         bus->regs[R_I2CC_POOL_CTRL] &= ~0xffffff;
586         bus->regs[R_I2CC_POOL_CTRL] |= (value & 0xffffff);
587         break;
588     case A_I2CM_INTR_CTRL:
589         bus->regs[R_I2CM_INTR_CTRL] = value & 0x0007f07f;
590         break;
591     case A_I2CM_INTR_STS:
592         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_INTR_STS, RX_DONE)
593                     && SHARED_FIELD_EX32(value, RX_DONE);
594 
595         /* In packet mode, clearing PKT_CMD_DONE clears other interrupts. */
596         if (aspeed_i2c_bus_pkt_mode_en(bus) &&
597            FIELD_EX32(value, I2CM_INTR_STS, PKT_CMD_DONE)) {
598             bus->regs[R_I2CM_INTR_STS] &= 0xf0001000;
599             if (!bus->regs[R_I2CM_INTR_STS]) {
600                 bus->controller->intr_status &= ~(1 << bus->id);
601                 qemu_irq_lower(aic->bus_get_irq(bus));
602             }
603             aspeed_i2c_bus_raise_slave_interrupt(bus);
604             break;
605         }
606         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
607         if (!bus->regs[R_I2CM_INTR_STS]) {
608             bus->controller->intr_status &= ~(1 << bus->id);
609             qemu_irq_lower(aic->bus_get_irq(bus));
610         }
611         if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
612                                                   M_RX_CMD) ||
613                           SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
614                                                   M_S_RX_CMD_LAST))) {
615             aspeed_i2c_handle_rx_cmd(bus);
616             aspeed_i2c_bus_raise_interrupt(bus);
617         }
618         break;
619     case A_I2CM_CMD:
620         if (!aspeed_i2c_bus_is_enabled(bus)) {
621             break;
622         }
623 
624         if (!aspeed_i2c_bus_is_master(bus)) {
625             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
626                           __func__);
627             break;
628         }
629 
630         if (!aic->has_dma &&
631             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
632              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
633             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
634             break;
635         }
636 
637         if (bus->regs[R_I2CM_INTR_STS] & 0xffff0000) {
638             qemu_log_mask(LOG_UNIMP, "%s: Packet mode is not implemented\n",
639                           __func__);
640             break;
641         }
642 
643         value &= 0xff0ffbfb;
644         if (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, W1_CTRL)) {
645             bus->regs[R_I2CM_CMD] |= value;
646         } else {
647             bus->regs[R_I2CM_CMD] = value;
648         }
649 
650         aspeed_i2c_bus_handle_cmd(bus, value);
651         aspeed_i2c_bus_raise_interrupt(bus);
652         break;
653     case A_I2CM_DMA_TX_ADDR:
654         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
655                                                    ADDR);
656         bus->dma_dram_offset =
657             deposit64(bus->dma_dram_offset, 0, 32,
658                       FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR));
659         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
660                                                      TX_BUF_LEN) + 1;
661         break;
662     case A_I2CM_DMA_RX_ADDR:
663         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
664                                                    ADDR);
665         bus->dma_dram_offset =
666             deposit64(bus->dma_dram_offset, 0, 32,
667                       FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR));
668         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
669                                                      RX_BUF_LEN) + 1;
670         break;
671     case A_I2CM_DMA_LEN:
672         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
673               FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
674         /* If none of the w1t bits are set, just write to the reg as normal. */
675         if (!w1t) {
676             bus->regs[R_I2CM_DMA_LEN] = value;
677             break;
678         }
679         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
680             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
681                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
682         }
683         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
684             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
685                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
686         }
687         break;
688     case A_I2CM_DMA_LEN_STS:
689         /* Writes clear to 0 */
690         bus->regs[R_I2CM_DMA_LEN_STS] = 0;
691         break;
692     case A_I2CC_DMA_ADDR:
693     case A_I2CC_DMA_LEN:
694         /* RO */
695         break;
696     case A_I2CS_DEV_ADDR:
697         bus->regs[R_I2CS_DEV_ADDR] = value;
698         break;
699     case A_I2CS_DMA_RX_ADDR:
700         bus->regs[R_I2CS_DMA_RX_ADDR] = value;
701         break;
702     case A_I2CS_DMA_LEN:
703         assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
704         if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
705             ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
706                              FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
707         } else {
708             bus->regs[R_I2CS_DMA_LEN] = value;
709         }
710         break;
711     case A_I2CS_CMD:
712         if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
713             bus->regs[R_I2CS_CMD] |= value;
714         } else {
715             bus->regs[R_I2CS_CMD] = value;
716         }
717         i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
718         break;
719     case A_I2CS_INTR_CTRL:
720         bus->regs[R_I2CS_INTR_CTRL] = value;
721         break;
722 
723     case A_I2CS_INTR_STS:
724         if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
725             if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
726                 FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
727                 bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
728             }
729         } else {
730             bus->regs[R_I2CS_INTR_STS] &= ~value;
731         }
732         if (!bus->regs[R_I2CS_INTR_STS]) {
733             bus->controller->intr_status &= ~(1 << bus->id);
734             qemu_irq_lower(aic->bus_get_irq(bus));
735         }
736         aspeed_i2c_bus_raise_interrupt(bus);
737         break;
738     case A_I2CS_DMA_LEN_STS:
739         bus->regs[R_I2CS_DMA_LEN_STS] = 0;
740         break;
741     case A_I2CS_DMA_TX_ADDR:
742         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
743                       __func__);
744         break;
745 
746     /*
747      * The AST2700 support the maximum DRAM size is 8 GB.
748      * The DRAM offset range is from 0x0_0000_0000 to
749      * 0x1_FFFF_FFFF and it is enough to use bits [33:0]
750      * saving the dram offset.
751      * Therefore, save the high part physical address bit[1:0]
752      * of Tx/Rx buffer address as dma_dram_offset bit[33:32].
753      */
754     case A_I2CM_DMA_TX_ADDR_HI:
755         if (!aic->has_dma64) {
756             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n",
757                           __func__);
758             break;
759         }
760         bus->regs[R_I2CM_DMA_TX_ADDR_HI] = FIELD_EX32(value,
761                                                       I2CM_DMA_TX_ADDR_HI,
762                                                       ADDR_HI);
763         bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
764                                          extract32(value, 0, 2));
765         break;
766     case A_I2CM_DMA_RX_ADDR_HI:
767         if (!aic->has_dma64) {
768             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n",
769                           __func__);
770             break;
771         }
772         bus->regs[R_I2CM_DMA_RX_ADDR_HI] = FIELD_EX32(value,
773                                                       I2CM_DMA_RX_ADDR_HI,
774                                                       ADDR_HI);
775         bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
776                                          extract32(value, 0, 2));
777         break;
778     case A_I2CS_DMA_TX_ADDR_HI:
779         qemu_log_mask(LOG_UNIMP,
780                       "%s: Slave mode DMA TX Addr high is not implemented\n",
781                       __func__);
782         break;
783     case A_I2CS_DMA_RX_ADDR_HI:
784         if (!aic->has_dma64) {
785             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n",
786                           __func__);
787             break;
788         }
789         bus->regs[R_I2CS_DMA_RX_ADDR_HI] = FIELD_EX32(value,
790                                                       I2CS_DMA_RX_ADDR_HI,
791                                                       ADDR_HI);
792         bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
793                                          extract32(value, 0, 2));
794         break;
795     default:
796         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
797                       __func__, offset);
798     }
799 }
800 
801 static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
802                                      uint64_t value, unsigned size)
803 {
804     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
805     bool handle_rx;
806 
807     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
808 
809     switch (offset) {
810     case A_I2CD_FUN_CTRL:
811         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
812             i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
813         }
814         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
815         break;
816     case A_I2CD_AC_TIMING1:
817         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
818         break;
819     case A_I2CD_AC_TIMING2:
820         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
821         break;
822     case A_I2CD_INTR_CTRL:
823         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
824         break;
825     case A_I2CD_INTR_STS:
826         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_INTR_STS, RX_DONE)
827                     && SHARED_FIELD_EX32(value, RX_DONE);
828         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
829         if (!bus->regs[R_I2CD_INTR_STS]) {
830             bus->controller->intr_status &= ~(1 << bus->id);
831             qemu_irq_lower(aic->bus_get_irq(bus));
832         }
833         if (handle_rx) {
834             if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
835                 SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
836                                         M_S_RX_CMD_LAST)) {
837                 aspeed_i2c_handle_rx_cmd(bus);
838                 aspeed_i2c_bus_raise_interrupt(bus);
839             } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
840                 i2c_ack(bus->bus);
841             }
842         }
843         break;
844     case A_I2CD_DEV_ADDR:
845         bus->regs[R_I2CD_DEV_ADDR] = value;
846         break;
847     case A_I2CD_POOL_CTRL:
848         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
849         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
850         break;
851 
852     case A_I2CD_BYTE_BUF:
853         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_BYTE_BUF, TX_BUF, value);
854         break;
855     case A_I2CD_CMD:
856         if (!aspeed_i2c_bus_is_enabled(bus)) {
857             break;
858         }
859 
860         if (!aspeed_i2c_bus_is_master(bus)) {
861             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
862                           __func__);
863             break;
864         }
865 
866         if (!aic->has_dma &&
867             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
868              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
869             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
870             break;
871         }
872 
873         bus->regs[R_I2CD_CMD] &= ~0xFFFF;
874         bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
875 
876         aspeed_i2c_bus_handle_cmd(bus, value);
877         aspeed_i2c_bus_raise_interrupt(bus);
878         break;
879     case A_I2CD_DMA_ADDR:
880         if (!aic->has_dma) {
881             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
882             break;
883         }
884 
885         bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 0, 32,
886                                          value & 0x3ffffffc);
887         break;
888 
889     case A_I2CD_DMA_LEN:
890         if (!aic->has_dma) {
891             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
892             break;
893         }
894 
895         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
896         if (!bus->regs[R_I2CD_DMA_LEN]) {
897             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
898         }
899         break;
900 
901     default:
902         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
903                       __func__, offset);
904     }
905 }
906 
907 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
908                                      uint64_t value, unsigned size)
909 {
910     AspeedI2CBus *bus = opaque;
911     if (aspeed_i2c_is_new_mode(bus->controller)) {
912         aspeed_i2c_bus_new_write(bus, offset, value, size);
913     } else {
914         aspeed_i2c_bus_old_write(bus, offset, value, size);
915     }
916 }
917 
918 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
919                                    unsigned size)
920 {
921     AspeedI2CState *s = opaque;
922 
923     switch (offset) {
924     case A_I2C_CTRL_STATUS:
925         return s->intr_status;
926     case A_I2C_CTRL_GLOBAL:
927         return s->ctrl_global;
928     case A_I2C_CTRL_NEW_CLK_DIVIDER:
929         if (aspeed_i2c_is_new_mode(s)) {
930             return s->new_clk_divider;
931         }
932         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
933                       __func__, offset);
934         break;
935     default:
936         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
937                       __func__, offset);
938         break;
939     }
940 
941     return -1;
942 }
943 
944 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
945                                   uint64_t value, unsigned size)
946 {
947     AspeedI2CState *s = opaque;
948 
949     switch (offset) {
950     case A_I2C_CTRL_GLOBAL:
951         s->ctrl_global = value;
952         break;
953     case A_I2C_CTRL_NEW_CLK_DIVIDER:
954         if (aspeed_i2c_is_new_mode(s)) {
955             s->new_clk_divider = value;
956         } else {
957             qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx
958                           "\n", __func__, offset);
959         }
960         break;
961     case A_I2C_CTRL_STATUS:
962     default:
963         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
964                       __func__, offset);
965         break;
966     }
967 }
968 
969 static const MemoryRegionOps aspeed_i2c_bus_ops = {
970     .read = aspeed_i2c_bus_read,
971     .write = aspeed_i2c_bus_write,
972     .endianness = DEVICE_LITTLE_ENDIAN,
973 };
974 
975 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
976     .read = aspeed_i2c_ctrl_read,
977     .write = aspeed_i2c_ctrl_write,
978     .endianness = DEVICE_LITTLE_ENDIAN,
979 };
980 
981 static uint64_t aspeed_i2c_share_pool_read(void *opaque, hwaddr offset,
982                                      unsigned size)
983 {
984     AspeedI2CState *s = opaque;
985     uint64_t ret = 0;
986     int i;
987 
988     for (i = 0; i < size; i++) {
989         ret |= (uint64_t) s->share_pool[offset + i] << (8 * i);
990     }
991 
992     return ret;
993 }
994 
995 static void aspeed_i2c_share_pool_write(void *opaque, hwaddr offset,
996                                   uint64_t value, unsigned size)
997 {
998     AspeedI2CState *s = opaque;
999     int i;
1000 
1001     for (i = 0; i < size; i++) {
1002         s->share_pool[offset + i] = (value >> (8 * i)) & 0xFF;
1003     }
1004 }
1005 
1006 static const MemoryRegionOps aspeed_i2c_share_pool_ops = {
1007     .read = aspeed_i2c_share_pool_read,
1008     .write = aspeed_i2c_share_pool_write,
1009     .endianness = DEVICE_LITTLE_ENDIAN,
1010     .valid = {
1011         .min_access_size = 1,
1012         .max_access_size = 4,
1013     },
1014 };
1015 
1016 static uint64_t aspeed_i2c_bus_pool_read(void *opaque, hwaddr offset,
1017                                      unsigned size)
1018 {
1019     AspeedI2CBus *s = opaque;
1020     uint64_t ret = 0;
1021     int i;
1022 
1023     for (i = 0; i < size; i++) {
1024         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
1025     }
1026 
1027     return ret;
1028 }
1029 
1030 static void aspeed_i2c_bus_pool_write(void *opaque, hwaddr offset,
1031                                   uint64_t value, unsigned size)
1032 {
1033     AspeedI2CBus *s = opaque;
1034     int i;
1035 
1036     for (i = 0; i < size; i++) {
1037         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
1038     }
1039 }
1040 
1041 static const MemoryRegionOps aspeed_i2c_bus_pool_ops = {
1042     .read = aspeed_i2c_bus_pool_read,
1043     .write = aspeed_i2c_bus_pool_write,
1044     .endianness = DEVICE_LITTLE_ENDIAN,
1045     .valid = {
1046         .min_access_size = 1,
1047         .max_access_size = 4,
1048     },
1049 };
1050 
1051 static const VMStateDescription aspeed_i2c_bus_vmstate = {
1052     .name = TYPE_ASPEED_I2C,
1053     .version_id = 6,
1054     .minimum_version_id = 6,
1055     .fields = (const VMStateField[]) {
1056         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),
1057         VMSTATE_UINT8_ARRAY(pool, AspeedI2CBus, ASPEED_I2C_BUS_POOL_SIZE),
1058         VMSTATE_UINT64(dma_dram_offset, AspeedI2CBus),
1059         VMSTATE_END_OF_LIST()
1060     }
1061 };
1062 
1063 static const VMStateDescription aspeed_i2c_vmstate = {
1064     .name = TYPE_ASPEED_I2C,
1065     .version_id = 3,
1066     .minimum_version_id = 3,
1067     .fields = (const VMStateField[]) {
1068         VMSTATE_UINT32(intr_status, AspeedI2CState),
1069         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
1070                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
1071                              AspeedI2CBus),
1072         VMSTATE_UINT8_ARRAY(share_pool, AspeedI2CState,
1073                             ASPEED_I2C_SHARE_POOL_SIZE),
1074         VMSTATE_END_OF_LIST()
1075     }
1076 };
1077 
1078 static void aspeed_i2c_reset(DeviceState *dev)
1079 {
1080     AspeedI2CState *s = ASPEED_I2C(dev);
1081 
1082     s->intr_status = 0;
1083 }
1084 
1085 static void aspeed_i2c_instance_init(Object *obj)
1086 {
1087     AspeedI2CState *s = ASPEED_I2C(obj);
1088     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1089     int i;
1090 
1091     for (i = 0; i < aic->num_busses; i++) {
1092         object_initialize_child(obj, "bus[*]", &s->busses[i],
1093                                 TYPE_ASPEED_I2C_BUS);
1094     }
1095 }
1096 
1097 /*
1098  * Address Definitions (AST2400 and AST2500)
1099  *
1100  *   0x000 ... 0x03F: Global Register
1101  *   0x040 ... 0x07F: Device 1
1102  *   0x080 ... 0x0BF: Device 2
1103  *   0x0C0 ... 0x0FF: Device 3
1104  *   0x100 ... 0x13F: Device 4
1105  *   0x140 ... 0x17F: Device 5
1106  *   0x180 ... 0x1BF: Device 6
1107  *   0x1C0 ... 0x1FF: Device 7
1108  *   0x200 ... 0x20F: Device 1 buffer (AST2500 unused in linux driver)
1109  *   0x210 ... 0x21F: Device 2 buffer
1110  *   0x220 ... 0x22F: Device 3 buffer
1111  *   0x230 ... 0x23F: Device 4 buffer
1112  *   0x240 ... 0x24F: Device 5 buffer
1113  *   0x250 ... 0x25F: Device 6 buffer
1114  *   0x260 ... 0x26F: Device 7 buffer
1115  *   0x270 ... 0x27F: Device 8 buffer
1116  *   0x280 ... 0x28F: Device 9 buffer
1117  *   0x290 ... 0x29F: Device 10 buffer
1118  *   0x2A0 ... 0x2AF: Device 11 buffer
1119  *   0x2B0 ... 0x2BF: Device 12 buffer
1120  *   0x2C0 ... 0x2CF: Device 13 buffer
1121  *   0x2D0 ... 0x2DF: Device 14 buffer
1122  *   0x2E0 ... 0x2FF: Reserved
1123  *   0x300 ... 0x33F: Device 8
1124  *   0x340 ... 0x37F: Device 9
1125  *   0x380 ... 0x3BF: Device 10
1126  *   0x3C0 ... 0x3FF: Device 11
1127  *   0x400 ... 0x43F: Device 12
1128  *   0x440 ... 0x47F: Device 13
1129  *   0x480 ... 0x4BF: Device 14
1130  *   0x800 ... 0xFFF: Buffer Pool (AST2400 unused in linux driver)
1131  *
1132  * Address Definitions (AST2600 and AST1030)
1133  *   0x000 ... 0x07F: Global Register
1134  *   0x080 ... 0x0FF: Device 1
1135  *   0x100 ... 0x17F: Device 2
1136  *   0x180 ... 0x1FF: Device 3
1137  *   0x200 ... 0x27F: Device 4
1138  *   0x280 ... 0x2FF: Device 5
1139  *   0x300 ... 0x37F: Device 6
1140  *   0x380 ... 0x3FF: Device 7
1141  *   0x400 ... 0x47F: Device 8
1142  *   0x480 ... 0x4FF: Device 9
1143  *   0x500 ... 0x57F: Device 10
1144  *   0x580 ... 0x5FF: Device 11
1145  *   0x600 ... 0x67F: Device 12
1146  *   0x680 ... 0x6FF: Device 13
1147  *   0x700 ... 0x77F: Device 14
1148  *   0x780 ... 0x7FF: Device 15 (15 and 16 unused in AST1030)
1149  *   0x800 ... 0x87F: Device 16
1150  *   0xC00 ... 0xC1F: Device 1 buffer
1151  *   0xC20 ... 0xC3F: Device 2 buffer
1152  *   0xC40 ... 0xC5F: Device 3 buffer
1153  *   0xC60 ... 0xC7F: Device 4 buffer
1154  *   0xC80 ... 0xC9F: Device 5 buffer
1155  *   0xCA0 ... 0xCBF: Device 6 buffer
1156  *   0xCC0 ... 0xCDF: Device 7 buffer
1157  *   0xCE0 ... 0xCFF: Device 8 buffer
1158  *   0xD00 ... 0xD1F: Device 9 buffer
1159  *   0xD20 ... 0xD3F: Device 10 buffer
1160  *   0xD40 ... 0xD5F: Device 11 buffer
1161  *   0xD60 ... 0xD7F: Device 12 buffer
1162  *   0xD80 ... 0xD9F: Device 13 buffer
1163  *   0xDA0 ... 0xDBF: Device 14 buffer
1164  *   0xDC0 ... 0xDDF: Device 15 buffer (15 and 16 unused in AST1030)
1165  *   0xDE0 ... 0xDFF: Device 16 buffer
1166  *
1167  * Address Definitions (AST2700)
1168  *   0x000 ... 0x0FF: Global Register
1169  *   0x100 ... 0x17F: Device 0
1170  *   0x1A0 ... 0x1BF: Device 0 buffer
1171  *   0x200 ... 0x27F: Device 1
1172  *   0x2A0 ... 0x2BF: Device 1 buffer
1173  *   0x300 ... 0x37F: Device 2
1174  *   0x3A0 ... 0x3BF: Device 2 buffer
1175  *   0x400 ... 0x47F: Device 3
1176  *   0x4A0 ... 0x4BF: Device 3 buffer
1177  *   0x500 ... 0x57F: Device 4
1178  *   0x5A0 ... 0x5BF: Device 4 buffer
1179  *   0x600 ... 0x67F: Device 5
1180  *   0x6A0 ... 0x6BF: Device 5 buffer
1181  *   0x700 ... 0x77F: Device 6
1182  *   0x7A0 ... 0x7BF: Device 6 buffer
1183  *   0x800 ... 0x87F: Device 7
1184  *   0x8A0 ... 0x8BF: Device 7 buffer
1185  *   0x900 ... 0x97F: Device 8
1186  *   0x9A0 ... 0x9BF: Device 8 buffer
1187  *   0xA00 ... 0xA7F: Device 9
1188  *   0xAA0 ... 0xABF: Device 9 buffer
1189  *   0xB00 ... 0xB7F: Device 10
1190  *   0xBA0 ... 0xBBF: Device 10 buffer
1191  *   0xC00 ... 0xC7F: Device 11
1192  *   0xCA0 ... 0xCBF: Device 11 buffer
1193  *   0xD00 ... 0xD7F: Device 12
1194  *   0xDA0 ... 0xDBF: Device 12 buffer
1195  *   0xE00 ... 0xE7F: Device 13
1196  *   0xEA0 ... 0xEBF: Device 13 buffer
1197  *   0xF00 ... 0xF7F: Device 14
1198  *   0xFA0 ... 0xFBF: Device 14 buffer
1199  *   0x1000 ... 0x107F: Device 15
1200  *   0x10A0 ... 0x10BF: Device 15 buffer
1201  */
1202 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
1203 {
1204     int i;
1205     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1206     AspeedI2CState *s = ASPEED_I2C(dev);
1207     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1208     uint32_t reg_offset = aic->reg_size + aic->reg_gap_size;
1209     uint32_t pool_offset = aic->pool_size + aic->pool_gap_size;
1210 
1211     sysbus_init_irq(sbd, &s->irq);
1212     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
1213                           "aspeed.i2c", aic->mem_size);
1214     sysbus_init_mmio(sbd, &s->iomem);
1215 
1216     for (i = 0; i < aic->num_busses; i++) {
1217         Object *bus = OBJECT(&s->busses[i]);
1218         int offset = i < aic->gap ? 1 : 5;
1219 
1220         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
1221             return;
1222         }
1223 
1224         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
1225             return;
1226         }
1227 
1228         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
1229             return;
1230         }
1231 
1232         memory_region_add_subregion(&s->iomem, reg_offset * (i + offset),
1233                                     &s->busses[i].mr);
1234     }
1235 
1236     if (aic->has_share_pool) {
1237         memory_region_init_io(&s->pool_iomem, OBJECT(s),
1238                               &aspeed_i2c_share_pool_ops, s,
1239                               "aspeed.i2c-share-pool", aic->pool_size);
1240         memory_region_add_subregion(&s->iomem, aic->pool_base,
1241                                     &s->pool_iomem);
1242     } else {
1243         for (i = 0; i < aic->num_busses; i++) {
1244             memory_region_add_subregion(&s->iomem,
1245                                         aic->pool_base + (pool_offset * i),
1246                                         &s->busses[i].mr_pool);
1247         }
1248     }
1249 
1250     if (aic->has_dma) {
1251         if (!s->dram_mr) {
1252             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
1253             return;
1254         }
1255 
1256         address_space_init(&s->dram_as, s->dram_mr,
1257                            TYPE_ASPEED_I2C "-dma-dram");
1258     }
1259 }
1260 
1261 static Property aspeed_i2c_properties[] = {
1262     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
1263                      TYPE_MEMORY_REGION, MemoryRegion *),
1264     DEFINE_PROP_END_OF_LIST(),
1265 };
1266 
1267 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
1268 {
1269     DeviceClass *dc = DEVICE_CLASS(klass);
1270 
1271     dc->vmsd = &aspeed_i2c_vmstate;
1272     device_class_set_legacy_reset(dc, aspeed_i2c_reset);
1273     device_class_set_props(dc, aspeed_i2c_properties);
1274     dc->realize = aspeed_i2c_realize;
1275     dc->desc = "Aspeed I2C Controller";
1276 }
1277 
1278 static const TypeInfo aspeed_i2c_info = {
1279     .name          = TYPE_ASPEED_I2C,
1280     .parent        = TYPE_SYS_BUS_DEVICE,
1281     .instance_init = aspeed_i2c_instance_init,
1282     .instance_size = sizeof(AspeedI2CState),
1283     .class_init    = aspeed_i2c_class_init,
1284     .class_size = sizeof(AspeedI2CClass),
1285     .abstract   = true,
1286 };
1287 
1288 static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
1289                                           enum i2c_event event)
1290 {
1291     switch (event) {
1292     case I2C_START_SEND_ASYNC:
1293         if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
1294             qemu_log_mask(LOG_GUEST_ERROR,
1295                           "%s: Slave mode RX DMA is not enabled\n", __func__);
1296             return -1;
1297         }
1298         ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
1299         bus->dma_dram_offset =
1300             deposit64(bus->dma_dram_offset, 0, 32,
1301                       ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR));
1302         bus->regs[R_I2CC_DMA_LEN] =
1303             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
1304         i2c_ack(bus->bus);
1305         break;
1306     case I2C_FINISH:
1307         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
1308         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1309         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
1310         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
1311         aspeed_i2c_bus_raise_slave_interrupt(bus);
1312         break;
1313     default:
1314         qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
1315                       __func__, event);
1316         return -1;
1317     }
1318 
1319     return 0;
1320 }
1321 
1322 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
1323 {
1324     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1325     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1326     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1327     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1328     uint32_t reg_dev_addr = aspeed_i2c_bus_dev_addr_offset(bus);
1329     uint32_t dev_addr = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_dev_addr,
1330                                                 SLAVE_DEV_ADDR1);
1331 
1332     if (aspeed_i2c_is_new_mode(bus->controller)) {
1333         return aspeed_i2c_bus_new_slave_event(bus, event);
1334     }
1335 
1336     switch (event) {
1337     case I2C_START_SEND_ASYNC:
1338         /* Bit[0] == 0 indicates "send". */
1339         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, dev_addr << 1);
1340 
1341         ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1342         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1343 
1344         aspeed_i2c_set_state(bus, I2CD_STXD);
1345 
1346         break;
1347 
1348     case I2C_FINISH:
1349         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
1350 
1351         aspeed_i2c_set_state(bus, I2CD_IDLE);
1352 
1353         break;
1354 
1355     default:
1356         return -1;
1357     }
1358 
1359     aspeed_i2c_bus_raise_interrupt(bus);
1360 
1361     return 0;
1362 }
1363 
1364 static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
1365 {
1366     assert(address_space_write(&bus->controller->dram_as,
1367                                bus->dma_dram_offset,
1368                                MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
1369 
1370     bus->dma_dram_offset++;
1371     bus->regs[R_I2CC_DMA_LEN]--;
1372     ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
1373                      ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
1374     i2c_ack(bus->bus);
1375 }
1376 
1377 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
1378 {
1379     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1380     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1381     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1382     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1383 
1384     if (aspeed_i2c_is_new_mode(bus->controller)) {
1385         return aspeed_i2c_bus_new_slave_send_async(bus, data);
1386     }
1387 
1388     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
1389     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1390 
1391     aspeed_i2c_bus_raise_interrupt(bus);
1392 }
1393 
1394 static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
1395 {
1396     DeviceClass *dc = DEVICE_CLASS(klass);
1397     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
1398 
1399     dc->desc = "Aspeed I2C Bus Slave";
1400 
1401     sc->event = aspeed_i2c_bus_slave_event;
1402     sc->send_async = aspeed_i2c_bus_slave_send_async;
1403 }
1404 
1405 static const TypeInfo aspeed_i2c_bus_slave_info = {
1406     .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
1407     .parent         = TYPE_I2C_SLAVE,
1408     .instance_size  = sizeof(AspeedI2CBusSlave),
1409     .class_init     = aspeed_i2c_bus_slave_class_init,
1410 };
1411 
1412 static void aspeed_i2c_bus_reset(DeviceState *dev)
1413 {
1414     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1415 
1416     memset(s->regs, 0, sizeof(s->regs));
1417     i2c_end_transfer(s->bus);
1418 }
1419 
1420 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
1421 {
1422     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1423     AspeedI2CClass *aic;
1424     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
1425     g_autofree char *pool_name = g_strdup_printf("%s.pool", name);
1426 
1427     if (!s->controller) {
1428         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
1429         return;
1430     }
1431 
1432     aic = ASPEED_I2C_GET_CLASS(s->controller);
1433 
1434     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
1435 
1436     s->bus = i2c_init_bus(dev, name);
1437     s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
1438                                        0xff);
1439 
1440     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
1441                           s, name, aic->reg_size);
1442     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
1443 
1444     memory_region_init_io(&s->mr_pool, OBJECT(s), &aspeed_i2c_bus_pool_ops,
1445                           s, pool_name, aic->pool_size);
1446     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr_pool);
1447 }
1448 
1449 static Property aspeed_i2c_bus_properties[] = {
1450     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
1451     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
1452                      AspeedI2CState *),
1453     DEFINE_PROP_END_OF_LIST(),
1454 };
1455 
1456 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
1457 {
1458     DeviceClass *dc = DEVICE_CLASS(klass);
1459 
1460     dc->desc = "Aspeed I2C Bus";
1461     dc->realize = aspeed_i2c_bus_realize;
1462     device_class_set_legacy_reset(dc, aspeed_i2c_bus_reset);
1463     device_class_set_props(dc, aspeed_i2c_bus_properties);
1464 }
1465 
1466 static const TypeInfo aspeed_i2c_bus_info = {
1467     .name           = TYPE_ASPEED_I2C_BUS,
1468     .parent         = TYPE_SYS_BUS_DEVICE,
1469     .instance_size  = sizeof(AspeedI2CBus),
1470     .class_init     = aspeed_i2c_bus_class_init,
1471 };
1472 
1473 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
1474 {
1475     return bus->controller->irq;
1476 }
1477 
1478 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
1479 {
1480     uint8_t *pool_page =
1481         &bus->controller->share_pool[ARRAY_FIELD_EX32(bus->regs,
1482                                                       I2CD_FUN_CTRL,
1483                                                       POOL_PAGE_SEL) * 0x100];
1484 
1485     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
1486 }
1487 
1488 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
1489 {
1490     DeviceClass *dc = DEVICE_CLASS(klass);
1491     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1492 
1493     dc->desc = "ASPEED 2400 I2C Controller";
1494 
1495     aic->num_busses = 14;
1496     aic->reg_size = 0x40;
1497     aic->gap = 7;
1498     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
1499     aic->has_share_pool = true;
1500     aic->pool_size = 0x800;
1501     aic->pool_base = 0x800;
1502     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
1503     aic->mem_size = 0x1000;
1504 }
1505 
1506 static const TypeInfo aspeed_2400_i2c_info = {
1507     .name = TYPE_ASPEED_2400_I2C,
1508     .parent = TYPE_ASPEED_I2C,
1509     .class_init = aspeed_2400_i2c_class_init,
1510 };
1511 
1512 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
1513 {
1514     return bus->controller->irq;
1515 }
1516 
1517 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
1518 {
1519     return bus->pool;
1520 }
1521 
1522 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
1523 {
1524     DeviceClass *dc = DEVICE_CLASS(klass);
1525     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1526 
1527     dc->desc = "ASPEED 2500 I2C Controller";
1528 
1529     aic->num_busses = 14;
1530     aic->reg_size = 0x40;
1531     aic->gap = 7;
1532     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
1533     aic->pool_size = 0x10;
1534     aic->pool_base = 0x200;
1535     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1536     aic->check_sram = true;
1537     aic->has_dma = true;
1538     aic->mem_size = 0x1000;
1539 }
1540 
1541 static const TypeInfo aspeed_2500_i2c_info = {
1542     .name = TYPE_ASPEED_2500_I2C,
1543     .parent = TYPE_ASPEED_I2C,
1544     .class_init = aspeed_2500_i2c_class_init,
1545 };
1546 
1547 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
1548 {
1549     return bus->irq;
1550 }
1551 
1552 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
1553 {
1554     DeviceClass *dc = DEVICE_CLASS(klass);
1555     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1556 
1557     dc->desc = "ASPEED 2600 I2C Controller";
1558 
1559     aic->num_busses = 16;
1560     aic->reg_size = 0x80;
1561     aic->gap = -1; /* no gap */
1562     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1563     aic->pool_size = 0x20;
1564     aic->pool_base = 0xC00;
1565     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1566     aic->has_dma = true;
1567     aic->mem_size = 0x1000;
1568 }
1569 
1570 static const TypeInfo aspeed_2600_i2c_info = {
1571     .name = TYPE_ASPEED_2600_I2C,
1572     .parent = TYPE_ASPEED_I2C,
1573     .class_init = aspeed_2600_i2c_class_init,
1574 };
1575 
1576 static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
1577 {
1578     DeviceClass *dc = DEVICE_CLASS(klass);
1579     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1580 
1581     dc->desc = "ASPEED 1030 I2C Controller";
1582 
1583     aic->num_busses = 14;
1584     aic->reg_size = 0x80;
1585     aic->gap = -1; /* no gap */
1586     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1587     aic->pool_size = 0x20;
1588     aic->pool_base = 0xC00;
1589     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1590     aic->has_dma = true;
1591     aic->mem_size = 0x10000;
1592 }
1593 
1594 static const TypeInfo aspeed_1030_i2c_info = {
1595     .name = TYPE_ASPEED_1030_I2C,
1596     .parent = TYPE_ASPEED_I2C,
1597     .class_init = aspeed_1030_i2c_class_init,
1598 };
1599 
1600 static void aspeed_2700_i2c_class_init(ObjectClass *klass, void *data)
1601 {
1602     DeviceClass *dc = DEVICE_CLASS(klass);
1603     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1604 
1605     dc->desc = "ASPEED 2700 I2C Controller";
1606 
1607     aic->num_busses = 16;
1608     aic->reg_size = 0x80;
1609     aic->reg_gap_size = 0x80;
1610     aic->gap = -1; /* no gap */
1611     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1612     aic->pool_size = 0x20;
1613     aic->pool_gap_size = 0xe0;
1614     aic->pool_base = 0x1a0;
1615     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1616     aic->has_dma = true;
1617     aic->mem_size = 0x2000;
1618     aic->has_dma64 = true;
1619 }
1620 
1621 static const TypeInfo aspeed_2700_i2c_info = {
1622     .name = TYPE_ASPEED_2700_I2C,
1623     .parent = TYPE_ASPEED_I2C,
1624     .class_init = aspeed_2700_i2c_class_init,
1625 };
1626 
1627 static void aspeed_i2c_register_types(void)
1628 {
1629     type_register_static(&aspeed_i2c_bus_info);
1630     type_register_static(&aspeed_i2c_bus_slave_info);
1631     type_register_static(&aspeed_i2c_info);
1632     type_register_static(&aspeed_2400_i2c_info);
1633     type_register_static(&aspeed_2500_i2c_info);
1634     type_register_static(&aspeed_2600_i2c_info);
1635     type_register_static(&aspeed_1030_i2c_info);
1636     type_register_static(&aspeed_2700_i2c_info);
1637 }
1638 
1639 type_init(aspeed_i2c_register_types)
1640 
1641 
1642 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1643 {
1644     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1645     I2CBus *bus = NULL;
1646 
1647     if (busnr >= 0 && busnr < aic->num_busses) {
1648         bus = s->busses[busnr].bus;
1649     }
1650 
1651     return bus;
1652 }
1653