xref: /openbmc/qemu/hw/i2c/aspeed_i2c.c (revision ad66b5cb)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/cutils.h"
25 #include "qemu/log.h"
26 #include "qemu/module.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "hw/i2c/aspeed_i2c.h"
30 #include "hw/irq.h"
31 #include "hw/qdev-properties.h"
32 #include "hw/registerfields.h"
33 #include "trace.h"
34 
35 /* Enable SLAVE_ADDR_RX_MATCH always */
36 #define R_I2CD_INTR_STS_ALWAYS_ENABLE  R_I2CD_INTR_STS_SLAVE_ADDR_RX_MATCH_MASK
37 
38 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
39 {
40     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
41     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
42     uint32_t intr_ctrl_reg = aspeed_i2c_bus_intr_ctrl_offset(bus);
43     uint32_t intr_ctrl_mask = bus->regs[intr_ctrl_reg] |
44         R_I2CD_INTR_STS_ALWAYS_ENABLE;
45     bool raise_irq;
46 
47     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_RAISE_INTERRUPT)) {
48         g_autofree char *buf = g_strdup_printf("%s%s%s%s%s%s%s",
49                aspeed_i2c_bus_pkt_mode_en(bus) &&
50                ARRAY_FIELD_EX32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE) ?
51                                                "pktdone|" : "",
52                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_NAK) ?
53                                                "nak|" : "",
54                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_ACK) ?
55                                                "ack|" : "",
56                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE) ?
57                                                "done|" : "",
58                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
59                                                "slave-match|" : "",
60                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
61                                                "stop|" : "",
62                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
63                                                "abnormal"  : "");
64 
65            trace_aspeed_i2c_bus_raise_interrupt(bus->regs[reg_intr_sts], buf);
66     }
67 
68     raise_irq = bus->regs[reg_intr_sts] & intr_ctrl_mask ;
69 
70     /* In packet mode we don't mask off INTR_STS */
71     if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
72         bus->regs[reg_intr_sts] &= intr_ctrl_mask;
73     }
74 
75     if (raise_irq) {
76         bus->controller->intr_status |= 1 << bus->id;
77         qemu_irq_raise(aic->bus_get_irq(bus));
78     }
79 }
80 
81 static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
82 {
83     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
84 
85     if (!bus->regs[R_I2CS_INTR_STS]) {
86         return;
87     }
88 
89     bus->controller->intr_status |= 1 << bus->id;
90     qemu_irq_raise(aic->bus_get_irq(bus));
91 }
92 
93 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
94                                         unsigned size)
95 {
96     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
97     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
98 
99     switch (offset) {
100     case A_I2CD_FUN_CTRL:
101     case A_I2CD_AC_TIMING1:
102     case A_I2CD_AC_TIMING2:
103     case A_I2CD_INTR_CTRL:
104     case A_I2CD_INTR_STS:
105     case A_I2CD_DEV_ADDR:
106     case A_I2CD_POOL_CTRL:
107     case A_I2CD_BYTE_BUF:
108         /* Value is already set, don't do anything. */
109         break;
110     case A_I2CD_CMD:
111         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
112         break;
113     case A_I2CD_DMA_ADDR:
114         if (!aic->has_dma) {
115             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
116             value = -1;
117         }
118         break;
119     case A_I2CD_DMA_LEN:
120         if (!aic->has_dma) {
121             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
122             value = -1;
123         }
124         break;
125 
126     default:
127         qemu_log_mask(LOG_GUEST_ERROR,
128                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
129         value = -1;
130         break;
131     }
132 
133     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
134     return value;
135 }
136 
137 static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
138                                         unsigned size)
139 {
140     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
141 
142     switch (offset) {
143     case A_I2CC_FUN_CTRL:
144     case A_I2CC_AC_TIMING:
145     case A_I2CC_POOL_CTRL:
146     case A_I2CM_INTR_CTRL:
147     case A_I2CM_INTR_STS:
148     case A_I2CC_MS_TXRX_BYTE_BUF:
149     case A_I2CM_DMA_LEN:
150     case A_I2CM_DMA_TX_ADDR:
151     case A_I2CM_DMA_RX_ADDR:
152     case A_I2CM_DMA_LEN_STS:
153     case A_I2CC_DMA_ADDR:
154     case A_I2CC_DMA_LEN:
155 
156     case A_I2CS_DEV_ADDR:
157     case A_I2CS_DMA_RX_ADDR:
158     case A_I2CS_DMA_LEN:
159     case A_I2CS_CMD:
160     case A_I2CS_INTR_CTRL:
161     case A_I2CS_DMA_LEN_STS:
162         /* Value is already set, don't do anything. */
163         break;
164     case A_I2CS_INTR_STS:
165         break;
166     case A_I2CM_CMD:
167         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
168         break;
169     default:
170         qemu_log_mask(LOG_GUEST_ERROR,
171                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
172         value = -1;
173         break;
174     }
175 
176     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
177     return value;
178 }
179 
180 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
181                                     unsigned size)
182 {
183     AspeedI2CBus *bus = opaque;
184     if (aspeed_i2c_is_new_mode(bus->controller)) {
185         return aspeed_i2c_bus_new_read(bus, offset, size);
186     }
187     return aspeed_i2c_bus_old_read(bus, offset, size);
188 }
189 
190 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
191 {
192     if (aspeed_i2c_is_new_mode(bus->controller)) {
193         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_STATE,
194                                 state);
195     } else {
196         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_CMD, TX_STATE, state);
197     }
198 }
199 
200 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
201 {
202     if (aspeed_i2c_is_new_mode(bus->controller)) {
203         return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF,
204                                        TX_STATE);
205     }
206     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
207 }
208 
209 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
210 {
211     MemTxResult result;
212     AspeedI2CState *s = bus->controller;
213     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
214     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
215 
216     result = address_space_read(&s->dram_as, bus->regs[reg_dma_addr],
217                                 MEMTXATTRS_UNSPECIFIED, data, 1);
218     if (result != MEMTX_OK) {
219         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
220                       __func__, bus->regs[reg_dma_addr]);
221         return -1;
222     }
223 
224     bus->regs[reg_dma_addr]++;
225     bus->regs[reg_dma_len]--;
226     return 0;
227 }
228 
229 static int aspeed_i2c_bus_send(AspeedI2CBus *bus, uint8_t pool_start)
230 {
231     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
232     int ret = -1;
233     int i;
234     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
235     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
236     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
237     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
238     int pool_tx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
239                                                 TX_COUNT);
240 
241     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
242         for (i = pool_start; i < pool_tx_count; i++) {
243             uint8_t *pool_base = aic->bus_pool_base(bus);
244 
245             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
246                                       pool_base[i]);
247             ret = i2c_send(bus->bus, pool_base[i]);
248             if (ret) {
249                 break;
250             }
251         }
252         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_BUFF_EN, 0);
253     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
254         /* In new mode, clear how many bytes we TXed */
255         if (aspeed_i2c_is_new_mode(bus->controller)) {
256             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
257         }
258         while (bus->regs[reg_dma_len]) {
259             uint8_t data;
260             aspeed_i2c_dma_read(bus, &data);
261             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
262                                       bus->regs[reg_dma_len], data);
263             ret = i2c_send(bus->bus, data);
264             if (ret) {
265                 break;
266             }
267             /* In new mode, keep track of how many bytes we TXed */
268             if (aspeed_i2c_is_new_mode(bus->controller)) {
269                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN,
270                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
271                                                   TX_LEN) + 1);
272             }
273         }
274         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_DMA_EN, 0);
275     } else {
276         trace_aspeed_i2c_bus_send("BYTE", pool_start, 1,
277                                   bus->regs[reg_byte_buf]);
278         ret = i2c_send(bus->bus, bus->regs[reg_byte_buf]);
279     }
280 
281     return ret;
282 }
283 
284 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
285 {
286     AspeedI2CState *s = bus->controller;
287     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
288     uint8_t data;
289     int i;
290     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
291     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
292     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
293     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
294     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
295     int pool_rx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
296                                                 RX_COUNT);
297 
298     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
299         uint8_t *pool_base = aic->bus_pool_base(bus);
300 
301         for (i = 0; i < pool_rx_count; i++) {
302             pool_base[i] = i2c_recv(bus->bus);
303             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
304                                       pool_base[i]);
305         }
306 
307         /* Update RX count */
308         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_pool_ctrl, RX_COUNT, i & 0xff);
309         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_BUFF_EN, 0);
310     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
311         uint8_t data;
312         /* In new mode, clear how many bytes we RXed */
313         if (aspeed_i2c_is_new_mode(bus->controller)) {
314             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
315         }
316 
317         while (bus->regs[reg_dma_len]) {
318             MemTxResult result;
319 
320             data = i2c_recv(bus->bus);
321             trace_aspeed_i2c_bus_recv("DMA", bus->regs[reg_dma_len],
322                                       bus->regs[reg_dma_len], data);
323             result = address_space_write(&s->dram_as, bus->regs[reg_dma_addr],
324                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
325             if (result != MEMTX_OK) {
326                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
327                               __func__, bus->regs[reg_dma_addr]);
328                 return;
329             }
330             bus->regs[reg_dma_addr]++;
331             bus->regs[reg_dma_len]--;
332             /* In new mode, keep track of how many bytes we RXed */
333             if (aspeed_i2c_is_new_mode(bus->controller)) {
334                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN,
335                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
336                                                   RX_LEN) + 1);
337             }
338         }
339         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_DMA_EN, 0);
340     } else {
341         data = i2c_recv(bus->bus);
342         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[reg_byte_buf]);
343         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
344     }
345 }
346 
347 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
348 {
349     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
350     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
351 
352     aspeed_i2c_set_state(bus, I2CD_MRXD);
353     aspeed_i2c_bus_recv(bus);
354     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
355     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) {
356         i2c_nack(bus->bus);
357     }
358     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_RX_CMD, 0);
359     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_S_RX_CMD_LAST, 0);
360     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
361 }
362 
363 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
364 {
365     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
366     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
367     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
368 
369     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
370         return (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, PKT_DEV_ADDR) << 1) |
371                 SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD);
372     }
373     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
374         uint8_t *pool_base = aic->bus_pool_base(bus);
375 
376         return pool_base[0];
377     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
378         uint8_t data;
379 
380         aspeed_i2c_dma_read(bus, &data);
381         return data;
382     } else {
383         return bus->regs[reg_byte_buf];
384     }
385 }
386 
387 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
388 {
389     AspeedI2CState *s = bus->controller;
390     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
391     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
392     bool dma_en = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)  ||
393                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)  ||
394                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ||
395                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN);
396     if (!aic->check_sram) {
397         return true;
398     }
399 
400     /*
401      * AST2500: SRAM must be enabled before using the Buffer Pool or
402      * DMA mode.
403      */
404     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
405         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
406         return false;
407     }
408 
409     return true;
410 }
411 
412 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
413 {
414     g_autofree char *cmd_flags = NULL;
415     uint32_t count;
416     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
417     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
418     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
419     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
420     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
421         count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT);
422     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
423         count = bus->regs[reg_dma_len];
424     } else { /* BYTE mode */
425         count = 1;
426     }
427 
428     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
429     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD) ? "start|" : "",
430     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN) ? "rxdma|" : "",
431     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN) ? "txdma|" : "",
432     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ? "rxbuf|" : "",
433     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN) ? "txbuf|" : "",
434     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD) ? "tx|" : "",
435     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ? "rx|" : "",
436     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST) ? "last|" : "",
437     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD) ? "stop|" : "");
438 
439     trace_aspeed_i2c_bus_cmd(bus->regs[reg_cmd], cmd_flags, count,
440                              bus->regs[reg_intr_sts]);
441 }
442 
443 /*
444  * The state machine needs some refinement. It is only used to track
445  * invalid STOP commands for the moment.
446  */
447 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
448 {
449     uint8_t pool_start = 0;
450     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
451     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
452     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
453     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
454 
455     if (!aspeed_i2c_check_sram(bus)) {
456         return;
457     }
458 
459     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
460         aspeed_i2c_bus_cmd_dump(bus);
461     }
462 
463     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD)) {
464         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
465             I2CD_MSTARTR : I2CD_MSTART;
466         uint8_t addr;
467 
468         aspeed_i2c_set_state(bus, state);
469 
470         addr = aspeed_i2c_get_addr(bus);
471         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
472                                extract32(addr, 0, 1))) {
473             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
474             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
475                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
476             }
477         } else {
478             /* START doesn't set TX_ACK in packet mode */
479             if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
480                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
481             }
482         }
483 
484         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_START_CMD, 0);
485 
486         /*
487          * The START command is also a TX command, as the slave
488          * address is sent on the bus. Drop the TX flag if nothing
489          * else needs to be sent in this sequence.
490          */
491         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
492             if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT)
493                 == 1) {
494                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
495             } else {
496                 /*
497                  * Increase the start index in the TX pool buffer to
498                  * skip the address byte.
499                  */
500                 pool_start++;
501             }
502         } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
503             if (bus->regs[reg_dma_len] == 0) {
504                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
505             }
506         } else {
507             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
508         }
509 
510         /* No slave found */
511         if (!i2c_bus_busy(bus->bus)) {
512             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
513                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
514                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
515             }
516             return;
517         }
518         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
519     }
520 
521     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD)) {
522         aspeed_i2c_set_state(bus, I2CD_MTXD);
523         if (aspeed_i2c_bus_send(bus, pool_start)) {
524             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
525             i2c_end_transfer(bus->bus);
526         } else {
527             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
528         }
529         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
530         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
531     }
532 
533     if ((SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ||
534          SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) &&
535         !SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE)) {
536         aspeed_i2c_handle_rx_cmd(bus);
537     }
538 
539     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD)) {
540         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
541             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
542             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, ABNORMAL, 1);
543             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
544                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
545             }
546         } else {
547             aspeed_i2c_set_state(bus, I2CD_MSTOP);
548             i2c_end_transfer(bus->bus);
549             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
550         }
551         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
552         aspeed_i2c_set_state(bus, I2CD_IDLE);
553 
554         i2c_schedule_pending_master(bus->bus);
555     }
556 
557     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
558         ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
559     }
560 }
561 
562 static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
563                                      uint64_t value, unsigned size)
564 {
565     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
566     bool handle_rx;
567     bool w1t;
568 
569     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
570 
571     switch (offset) {
572     case A_I2CC_FUN_CTRL:
573         bus->regs[R_I2CC_FUN_CTRL] = value;
574         break;
575     case A_I2CC_AC_TIMING:
576         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
577         break;
578     case A_I2CC_MS_TXRX_BYTE_BUF:
579         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_BUF,
580                                 value);
581         break;
582     case A_I2CC_POOL_CTRL:
583         bus->regs[R_I2CC_POOL_CTRL] &= ~0xffffff;
584         bus->regs[R_I2CC_POOL_CTRL] |= (value & 0xffffff);
585         break;
586     case A_I2CM_INTR_CTRL:
587         bus->regs[R_I2CM_INTR_CTRL] = value & 0x0007f07f;
588         break;
589     case A_I2CM_INTR_STS:
590         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_INTR_STS, RX_DONE)
591                     && SHARED_FIELD_EX32(value, RX_DONE);
592 
593         /* In packet mode, clearing PKT_CMD_DONE clears other interrupts. */
594         if (aspeed_i2c_bus_pkt_mode_en(bus) &&
595            FIELD_EX32(value, I2CM_INTR_STS, PKT_CMD_DONE)) {
596             bus->regs[R_I2CM_INTR_STS] &= 0xf0001000;
597             if (!bus->regs[R_I2CM_INTR_STS]) {
598                 bus->controller->intr_status &= ~(1 << bus->id);
599                 qemu_irq_lower(aic->bus_get_irq(bus));
600             }
601             aspeed_i2c_bus_raise_slave_interrupt(bus);
602             break;
603         }
604         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
605         if (!bus->regs[R_I2CM_INTR_STS]) {
606             bus->controller->intr_status &= ~(1 << bus->id);
607             qemu_irq_lower(aic->bus_get_irq(bus));
608         }
609         if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
610                                                   M_RX_CMD) ||
611                           SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
612                                                   M_S_RX_CMD_LAST))) {
613             aspeed_i2c_handle_rx_cmd(bus);
614             aspeed_i2c_bus_raise_interrupt(bus);
615         }
616         break;
617     case A_I2CM_CMD:
618         if (!aspeed_i2c_bus_is_enabled(bus)) {
619             break;
620         }
621 
622         if (!aspeed_i2c_bus_is_master(bus)) {
623             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
624                           __func__);
625             break;
626         }
627 
628         if (!aic->has_dma &&
629             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
630              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
631             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
632             break;
633         }
634 
635         if (bus->regs[R_I2CM_INTR_STS] & 0xffff0000) {
636             qemu_log_mask(LOG_UNIMP, "%s: Packet mode is not implemented\n",
637                           __func__);
638             break;
639         }
640 
641         value &= 0xff0ffbfb;
642         if (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, W1_CTRL)) {
643             bus->regs[R_I2CM_CMD] |= value;
644         } else {
645             bus->regs[R_I2CM_CMD] = value;
646         }
647 
648         aspeed_i2c_bus_handle_cmd(bus, value);
649         aspeed_i2c_bus_raise_interrupt(bus);
650         break;
651     case A_I2CM_DMA_TX_ADDR:
652         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
653                                                    ADDR);
654         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR);
655         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
656                                                      TX_BUF_LEN) + 1;
657         break;
658     case A_I2CM_DMA_RX_ADDR:
659         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
660                                                    ADDR);
661         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR);
662         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
663                                                      RX_BUF_LEN) + 1;
664         break;
665     case A_I2CM_DMA_LEN:
666         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
667               FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
668         /* If none of the w1t bits are set, just write to the reg as normal. */
669         if (!w1t) {
670             bus->regs[R_I2CM_DMA_LEN] = value;
671             break;
672         }
673         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
674             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
675                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
676         }
677         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
678             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
679                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
680         }
681         break;
682     case A_I2CM_DMA_LEN_STS:
683         /* Writes clear to 0 */
684         bus->regs[R_I2CM_DMA_LEN_STS] = 0;
685         break;
686     case A_I2CC_DMA_ADDR:
687     case A_I2CC_DMA_LEN:
688         /* RO */
689         break;
690     case A_I2CS_DEV_ADDR:
691         bus->regs[R_I2CS_DEV_ADDR] = value;
692         break;
693     case A_I2CS_DMA_RX_ADDR:
694         bus->regs[R_I2CS_DMA_RX_ADDR] = value;
695         break;
696     case A_I2CS_DMA_LEN:
697         assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
698         if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
699             ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
700                              FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
701         } else {
702             bus->regs[R_I2CS_DMA_LEN] = value;
703         }
704         break;
705     case A_I2CS_CMD:
706         if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
707             bus->regs[R_I2CS_CMD] |= value;
708         } else {
709             bus->regs[R_I2CS_CMD] = value;
710         }
711         i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
712         break;
713     case A_I2CS_INTR_CTRL:
714         bus->regs[R_I2CS_INTR_CTRL] = value;
715         break;
716 
717     case A_I2CS_INTR_STS:
718         if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
719             if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
720                 FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
721                 bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
722             }
723         } else {
724             bus->regs[R_I2CS_INTR_STS] &= ~value;
725         }
726         if (!bus->regs[R_I2CS_INTR_STS]) {
727             bus->controller->intr_status &= ~(1 << bus->id);
728             qemu_irq_lower(aic->bus_get_irq(bus));
729         }
730         aspeed_i2c_bus_raise_interrupt(bus);
731         break;
732     case A_I2CS_DMA_LEN_STS:
733         bus->regs[R_I2CS_DMA_LEN_STS] = 0;
734         break;
735     case A_I2CS_DMA_TX_ADDR:
736         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
737                       __func__);
738         break;
739     default:
740         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
741                       __func__, offset);
742     }
743 }
744 
745 static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
746                                      uint64_t value, unsigned size)
747 {
748     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
749     bool handle_rx;
750 
751     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
752 
753     switch (offset) {
754     case A_I2CD_FUN_CTRL:
755         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
756             i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
757         }
758         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
759         break;
760     case A_I2CD_AC_TIMING1:
761         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
762         break;
763     case A_I2CD_AC_TIMING2:
764         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
765         break;
766     case A_I2CD_INTR_CTRL:
767         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
768         break;
769     case A_I2CD_INTR_STS:
770         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_INTR_STS, RX_DONE)
771                     && SHARED_FIELD_EX32(value, RX_DONE);
772         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
773         if (!bus->regs[R_I2CD_INTR_STS]) {
774             bus->controller->intr_status &= ~(1 << bus->id);
775             qemu_irq_lower(aic->bus_get_irq(bus));
776         }
777         if (handle_rx) {
778             if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
779                 SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
780                                         M_S_RX_CMD_LAST)) {
781                 aspeed_i2c_handle_rx_cmd(bus);
782                 aspeed_i2c_bus_raise_interrupt(bus);
783             } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
784                 i2c_ack(bus->bus);
785             }
786         }
787         break;
788     case A_I2CD_DEV_ADDR:
789         bus->regs[R_I2CD_DEV_ADDR] = value;
790         break;
791     case A_I2CD_POOL_CTRL:
792         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
793         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
794         break;
795 
796     case A_I2CD_BYTE_BUF:
797         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_BYTE_BUF, TX_BUF, value);
798         break;
799     case A_I2CD_CMD:
800         if (!aspeed_i2c_bus_is_enabled(bus)) {
801             break;
802         }
803 
804         if (!aspeed_i2c_bus_is_master(bus)) {
805             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
806                           __func__);
807             break;
808         }
809 
810         if (!aic->has_dma &&
811             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
812              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
813             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
814             break;
815         }
816 
817         bus->regs[R_I2CD_CMD] &= ~0xFFFF;
818         bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
819 
820         aspeed_i2c_bus_handle_cmd(bus, value);
821         aspeed_i2c_bus_raise_interrupt(bus);
822         break;
823     case A_I2CD_DMA_ADDR:
824         if (!aic->has_dma) {
825             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
826             break;
827         }
828 
829         bus->regs[R_I2CD_DMA_ADDR] = value & 0x3ffffffc;
830         break;
831 
832     case A_I2CD_DMA_LEN:
833         if (!aic->has_dma) {
834             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
835             break;
836         }
837 
838         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
839         if (!bus->regs[R_I2CD_DMA_LEN]) {
840             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
841         }
842         break;
843 
844     default:
845         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
846                       __func__, offset);
847     }
848 }
849 
850 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
851                                      uint64_t value, unsigned size)
852 {
853     AspeedI2CBus *bus = opaque;
854     if (aspeed_i2c_is_new_mode(bus->controller)) {
855         aspeed_i2c_bus_new_write(bus, offset, value, size);
856     } else {
857         aspeed_i2c_bus_old_write(bus, offset, value, size);
858     }
859 }
860 
861 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
862                                    unsigned size)
863 {
864     AspeedI2CState *s = opaque;
865 
866     switch (offset) {
867     case A_I2C_CTRL_STATUS:
868         return s->intr_status;
869     case A_I2C_CTRL_GLOBAL:
870         return s->ctrl_global;
871     case A_I2C_CTRL_NEW_CLK_DIVIDER:
872         if (aspeed_i2c_is_new_mode(s)) {
873             return s->new_clk_divider;
874         }
875         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
876                       __func__, offset);
877         break;
878     default:
879         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
880                       __func__, offset);
881         break;
882     }
883 
884     return -1;
885 }
886 
887 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
888                                   uint64_t value, unsigned size)
889 {
890     AspeedI2CState *s = opaque;
891 
892     switch (offset) {
893     case A_I2C_CTRL_GLOBAL:
894         s->ctrl_global = value;
895         break;
896     case A_I2C_CTRL_NEW_CLK_DIVIDER:
897         if (aspeed_i2c_is_new_mode(s)) {
898             s->new_clk_divider = value;
899         } else {
900             qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx
901                           "\n", __func__, offset);
902         }
903         break;
904     case A_I2C_CTRL_STATUS:
905     default:
906         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
907                       __func__, offset);
908         break;
909     }
910 }
911 
912 static const MemoryRegionOps aspeed_i2c_bus_ops = {
913     .read = aspeed_i2c_bus_read,
914     .write = aspeed_i2c_bus_write,
915     .endianness = DEVICE_LITTLE_ENDIAN,
916 };
917 
918 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
919     .read = aspeed_i2c_ctrl_read,
920     .write = aspeed_i2c_ctrl_write,
921     .endianness = DEVICE_LITTLE_ENDIAN,
922 };
923 
924 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
925                                      unsigned size)
926 {
927     AspeedI2CState *s = opaque;
928     uint64_t ret = 0;
929     int i;
930 
931     for (i = 0; i < size; i++) {
932         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
933     }
934 
935     return ret;
936 }
937 
938 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
939                                   uint64_t value, unsigned size)
940 {
941     AspeedI2CState *s = opaque;
942     int i;
943 
944     for (i = 0; i < size; i++) {
945         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
946     }
947 }
948 
949 static const MemoryRegionOps aspeed_i2c_pool_ops = {
950     .read = aspeed_i2c_pool_read,
951     .write = aspeed_i2c_pool_write,
952     .endianness = DEVICE_LITTLE_ENDIAN,
953     .valid = {
954         .min_access_size = 1,
955         .max_access_size = 4,
956     },
957 };
958 
959 static const VMStateDescription aspeed_i2c_bus_vmstate = {
960     .name = TYPE_ASPEED_I2C,
961     .version_id = 5,
962     .minimum_version_id = 5,
963     .fields = (VMStateField[]) {
964         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),
965         VMSTATE_END_OF_LIST()
966     }
967 };
968 
969 static const VMStateDescription aspeed_i2c_vmstate = {
970     .name = TYPE_ASPEED_I2C,
971     .version_id = 2,
972     .minimum_version_id = 2,
973     .fields = (VMStateField[]) {
974         VMSTATE_UINT32(intr_status, AspeedI2CState),
975         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
976                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
977                              AspeedI2CBus),
978         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
979         VMSTATE_END_OF_LIST()
980     }
981 };
982 
983 static void aspeed_i2c_reset(DeviceState *dev)
984 {
985     AspeedI2CState *s = ASPEED_I2C(dev);
986 
987     s->intr_status = 0;
988 }
989 
990 static void aspeed_i2c_instance_init(Object *obj)
991 {
992     AspeedI2CState *s = ASPEED_I2C(obj);
993     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
994     int i;
995 
996     for (i = 0; i < aic->num_busses; i++) {
997         object_initialize_child(obj, "bus[*]", &s->busses[i],
998                                 TYPE_ASPEED_I2C_BUS);
999     }
1000 }
1001 
1002 /*
1003  * Address Definitions (AST2400 and AST2500)
1004  *
1005  *   0x000 ... 0x03F: Global Register
1006  *   0x040 ... 0x07F: Device 1
1007  *   0x080 ... 0x0BF: Device 2
1008  *   0x0C0 ... 0x0FF: Device 3
1009  *   0x100 ... 0x13F: Device 4
1010  *   0x140 ... 0x17F: Device 5
1011  *   0x180 ... 0x1BF: Device 6
1012  *   0x1C0 ... 0x1FF: Device 7
1013  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
1014  *   0x300 ... 0x33F: Device 8
1015  *   0x340 ... 0x37F: Device 9
1016  *   0x380 ... 0x3BF: Device 10
1017  *   0x3C0 ... 0x3FF: Device 11
1018  *   0x400 ... 0x43F: Device 12
1019  *   0x440 ... 0x47F: Device 13
1020  *   0x480 ... 0x4BF: Device 14
1021  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
1022  */
1023 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
1024 {
1025     int i;
1026     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1027     AspeedI2CState *s = ASPEED_I2C(dev);
1028     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1029 
1030     sysbus_init_irq(sbd, &s->irq);
1031     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
1032                           "aspeed.i2c", 0x1000);
1033     sysbus_init_mmio(sbd, &s->iomem);
1034 
1035     for (i = 0; i < aic->num_busses; i++) {
1036         Object *bus = OBJECT(&s->busses[i]);
1037         int offset = i < aic->gap ? 1 : 5;
1038 
1039         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
1040             return;
1041         }
1042 
1043         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
1044             return;
1045         }
1046 
1047         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
1048             return;
1049         }
1050 
1051         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
1052                                     &s->busses[i].mr);
1053     }
1054 
1055     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
1056                           "aspeed.i2c-pool", aic->pool_size);
1057     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
1058 
1059     if (aic->has_dma) {
1060         if (!s->dram_mr) {
1061             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
1062             return;
1063         }
1064 
1065         address_space_init(&s->dram_as, s->dram_mr,
1066                            TYPE_ASPEED_I2C "-dma-dram");
1067     }
1068 }
1069 
1070 static Property aspeed_i2c_properties[] = {
1071     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
1072                      TYPE_MEMORY_REGION, MemoryRegion *),
1073     DEFINE_PROP_END_OF_LIST(),
1074 };
1075 
1076 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
1077 {
1078     DeviceClass *dc = DEVICE_CLASS(klass);
1079 
1080     dc->vmsd = &aspeed_i2c_vmstate;
1081     dc->reset = aspeed_i2c_reset;
1082     device_class_set_props(dc, aspeed_i2c_properties);
1083     dc->realize = aspeed_i2c_realize;
1084     dc->desc = "Aspeed I2C Controller";
1085 }
1086 
1087 static const TypeInfo aspeed_i2c_info = {
1088     .name          = TYPE_ASPEED_I2C,
1089     .parent        = TYPE_SYS_BUS_DEVICE,
1090     .instance_init = aspeed_i2c_instance_init,
1091     .instance_size = sizeof(AspeedI2CState),
1092     .class_init    = aspeed_i2c_class_init,
1093     .class_size = sizeof(AspeedI2CClass),
1094     .abstract   = true,
1095 };
1096 
1097 static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
1098                                           enum i2c_event event)
1099 {
1100     switch (event) {
1101     case I2C_START_SEND_ASYNC:
1102         if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
1103             qemu_log_mask(LOG_GUEST_ERROR,
1104                           "%s: Slave mode RX DMA is not enabled\n", __func__);
1105             return -1;
1106         }
1107         ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
1108         bus->regs[R_I2CC_DMA_ADDR] =
1109             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
1110         bus->regs[R_I2CC_DMA_LEN] =
1111             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
1112         i2c_ack(bus->bus);
1113         break;
1114     case I2C_FINISH:
1115         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
1116         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1117         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
1118         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
1119         aspeed_i2c_bus_raise_slave_interrupt(bus);
1120         break;
1121     default:
1122         qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
1123                       __func__, event);
1124         return -1;
1125     }
1126 
1127     return 0;
1128 }
1129 
1130 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
1131 {
1132     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1133     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1134     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1135     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1136     uint32_t reg_dev_addr = aspeed_i2c_bus_dev_addr_offset(bus);
1137     uint32_t dev_addr = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_dev_addr,
1138                                                 SLAVE_DEV_ADDR1);
1139 
1140     if (aspeed_i2c_is_new_mode(bus->controller)) {
1141         return aspeed_i2c_bus_new_slave_event(bus, event);
1142     }
1143 
1144     switch (event) {
1145     case I2C_START_SEND_ASYNC:
1146         /* Bit[0] == 0 indicates "send". */
1147         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, dev_addr << 1);
1148 
1149         ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1150         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1151 
1152         aspeed_i2c_set_state(bus, I2CD_STXD);
1153 
1154         break;
1155 
1156     case I2C_FINISH:
1157         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
1158 
1159         aspeed_i2c_set_state(bus, I2CD_IDLE);
1160 
1161         break;
1162 
1163     default:
1164         return -1;
1165     }
1166 
1167     aspeed_i2c_bus_raise_interrupt(bus);
1168 
1169     return 0;
1170 }
1171 
1172 static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
1173 {
1174     assert(address_space_write(&bus->controller->dram_as,
1175                                bus->regs[R_I2CC_DMA_ADDR],
1176                                MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
1177 
1178     bus->regs[R_I2CC_DMA_ADDR]++;
1179     bus->regs[R_I2CC_DMA_LEN]--;
1180     ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
1181                      ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
1182     i2c_ack(bus->bus);
1183 }
1184 
1185 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
1186 {
1187     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1188     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1189     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1190     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1191 
1192     if (aspeed_i2c_is_new_mode(bus->controller)) {
1193         return aspeed_i2c_bus_new_slave_send_async(bus, data);
1194     }
1195 
1196     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
1197     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1198 
1199     aspeed_i2c_bus_raise_interrupt(bus);
1200 }
1201 
1202 static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
1203 {
1204     DeviceClass *dc = DEVICE_CLASS(klass);
1205     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
1206 
1207     dc->desc = "Aspeed I2C Bus Slave";
1208 
1209     sc->event = aspeed_i2c_bus_slave_event;
1210     sc->send_async = aspeed_i2c_bus_slave_send_async;
1211 }
1212 
1213 static const TypeInfo aspeed_i2c_bus_slave_info = {
1214     .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
1215     .parent         = TYPE_I2C_SLAVE,
1216     .instance_size  = sizeof(AspeedI2CBusSlave),
1217     .class_init     = aspeed_i2c_bus_slave_class_init,
1218 };
1219 
1220 static void aspeed_i2c_bus_reset(DeviceState *dev)
1221 {
1222     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1223 
1224     memset(s->regs, 0, sizeof(s->regs));
1225     i2c_end_transfer(s->bus);
1226 }
1227 
1228 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
1229 {
1230     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1231     AspeedI2CClass *aic;
1232     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
1233 
1234     if (!s->controller) {
1235         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
1236         return;
1237     }
1238 
1239     aic = ASPEED_I2C_GET_CLASS(s->controller);
1240 
1241     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
1242 
1243     s->bus = i2c_init_bus(dev, name);
1244     s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
1245                                        0xff);
1246 
1247     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
1248                           s, name, aic->reg_size);
1249     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
1250 }
1251 
1252 static Property aspeed_i2c_bus_properties[] = {
1253     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
1254     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
1255                      AspeedI2CState *),
1256     DEFINE_PROP_END_OF_LIST(),
1257 };
1258 
1259 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
1260 {
1261     DeviceClass *dc = DEVICE_CLASS(klass);
1262 
1263     dc->desc = "Aspeed I2C Bus";
1264     dc->realize = aspeed_i2c_bus_realize;
1265     dc->reset = aspeed_i2c_bus_reset;
1266     device_class_set_props(dc, aspeed_i2c_bus_properties);
1267 }
1268 
1269 static const TypeInfo aspeed_i2c_bus_info = {
1270     .name           = TYPE_ASPEED_I2C_BUS,
1271     .parent         = TYPE_SYS_BUS_DEVICE,
1272     .instance_size  = sizeof(AspeedI2CBus),
1273     .class_init     = aspeed_i2c_bus_class_init,
1274 };
1275 
1276 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
1277 {
1278     return bus->controller->irq;
1279 }
1280 
1281 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
1282 {
1283     uint8_t *pool_page =
1284         &bus->controller->pool[ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL,
1285                                                 POOL_PAGE_SEL) * 0x100];
1286 
1287     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
1288 }
1289 
1290 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
1291 {
1292     DeviceClass *dc = DEVICE_CLASS(klass);
1293     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1294 
1295     dc->desc = "ASPEED 2400 I2C Controller";
1296 
1297     aic->num_busses = 14;
1298     aic->reg_size = 0x40;
1299     aic->gap = 7;
1300     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
1301     aic->pool_size = 0x800;
1302     aic->pool_base = 0x800;
1303     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
1304 }
1305 
1306 static const TypeInfo aspeed_2400_i2c_info = {
1307     .name = TYPE_ASPEED_2400_I2C,
1308     .parent = TYPE_ASPEED_I2C,
1309     .class_init = aspeed_2400_i2c_class_init,
1310 };
1311 
1312 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
1313 {
1314     return bus->controller->irq;
1315 }
1316 
1317 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
1318 {
1319     return &bus->controller->pool[bus->id * 0x10];
1320 }
1321 
1322 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
1323 {
1324     DeviceClass *dc = DEVICE_CLASS(klass);
1325     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1326 
1327     dc->desc = "ASPEED 2500 I2C Controller";
1328 
1329     aic->num_busses = 14;
1330     aic->reg_size = 0x40;
1331     aic->gap = 7;
1332     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
1333     aic->pool_size = 0x100;
1334     aic->pool_base = 0x200;
1335     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1336     aic->check_sram = true;
1337     aic->has_dma = true;
1338 }
1339 
1340 static const TypeInfo aspeed_2500_i2c_info = {
1341     .name = TYPE_ASPEED_2500_I2C,
1342     .parent = TYPE_ASPEED_I2C,
1343     .class_init = aspeed_2500_i2c_class_init,
1344 };
1345 
1346 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
1347 {
1348     return bus->irq;
1349 }
1350 
1351 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
1352 {
1353    return &bus->controller->pool[bus->id * 0x20];
1354 }
1355 
1356 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
1357 {
1358     DeviceClass *dc = DEVICE_CLASS(klass);
1359     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1360 
1361     dc->desc = "ASPEED 2600 I2C Controller";
1362 
1363     aic->num_busses = 16;
1364     aic->reg_size = 0x80;
1365     aic->gap = -1; /* no gap */
1366     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1367     aic->pool_size = 0x200;
1368     aic->pool_base = 0xC00;
1369     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1370     aic->has_dma = true;
1371 }
1372 
1373 static const TypeInfo aspeed_2600_i2c_info = {
1374     .name = TYPE_ASPEED_2600_I2C,
1375     .parent = TYPE_ASPEED_I2C,
1376     .class_init = aspeed_2600_i2c_class_init,
1377 };
1378 
1379 static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
1380 {
1381     DeviceClass *dc = DEVICE_CLASS(klass);
1382     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1383 
1384     dc->desc = "ASPEED 1030 I2C Controller";
1385 
1386     aic->num_busses = 14;
1387     aic->reg_size = 0x80;
1388     aic->gap = -1; /* no gap */
1389     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1390     aic->pool_size = 0x200;
1391     aic->pool_base = 0xC00;
1392     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1393     aic->has_dma = true;
1394 }
1395 
1396 static const TypeInfo aspeed_1030_i2c_info = {
1397     .name = TYPE_ASPEED_1030_I2C,
1398     .parent = TYPE_ASPEED_I2C,
1399     .class_init = aspeed_1030_i2c_class_init,
1400 };
1401 
1402 static void aspeed_i2c_register_types(void)
1403 {
1404     type_register_static(&aspeed_i2c_bus_info);
1405     type_register_static(&aspeed_i2c_bus_slave_info);
1406     type_register_static(&aspeed_i2c_info);
1407     type_register_static(&aspeed_2400_i2c_info);
1408     type_register_static(&aspeed_2500_i2c_info);
1409     type_register_static(&aspeed_2600_i2c_info);
1410     type_register_static(&aspeed_1030_i2c_info);
1411 }
1412 
1413 type_init(aspeed_i2c_register_types)
1414 
1415 
1416 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1417 {
1418     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1419     I2CBus *bus = NULL;
1420 
1421     if (busnr >= 0 && busnr < aic->num_busses) {
1422         bus = s->busses[busnr].bus;
1423     }
1424 
1425     return bus;
1426 }
1427