xref: /openbmc/qemu/hw/i2c/aspeed_i2c.c (revision bad5cfcd)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/cutils.h"
25 #include "qemu/log.h"
26 #include "qemu/module.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "hw/i2c/aspeed_i2c.h"
30 #include "hw/irq.h"
31 #include "hw/qdev-properties.h"
32 #include "hw/registerfields.h"
33 #include "trace.h"
34 
35 /* Enable SLAVE_ADDR_RX_MATCH always */
36 #define R_I2CD_INTR_STS_ALWAYS_ENABLE  R_I2CD_INTR_STS_SLAVE_ADDR_RX_MATCH_MASK
37 
38 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
39 {
40     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
41     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
42     uint32_t intr_ctrl_reg = aspeed_i2c_bus_intr_ctrl_offset(bus);
43     uint32_t intr_ctrl_mask = bus->regs[intr_ctrl_reg] |
44         R_I2CD_INTR_STS_ALWAYS_ENABLE;
45     bool raise_irq;
46 
47     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_RAISE_INTERRUPT)) {
48         g_autofree char *buf = g_strdup_printf("%s%s%s%s%s%s%s",
49                aspeed_i2c_bus_pkt_mode_en(bus) &&
50                ARRAY_FIELD_EX32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE) ?
51                                                "pktdone|" : "",
52                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_NAK) ?
53                                                "nak|" : "",
54                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_ACK) ?
55                                                "ack|" : "",
56                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE) ?
57                                                "done|" : "",
58                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
59                                                "slave-match|" : "",
60                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
61                                                "stop|" : "",
62                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
63                                                "abnormal"  : "");
64 
65            trace_aspeed_i2c_bus_raise_interrupt(bus->regs[reg_intr_sts], buf);
66     }
67 
68     raise_irq = bus->regs[reg_intr_sts] & intr_ctrl_mask ;
69 
70     /* In packet mode we don't mask off INTR_STS */
71     if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
72         bus->regs[reg_intr_sts] &= intr_ctrl_mask;
73     }
74 
75     if (raise_irq) {
76         bus->controller->intr_status |= 1 << bus->id;
77         qemu_irq_raise(aic->bus_get_irq(bus));
78     }
79 }
80 
81 static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
82 {
83     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
84 
85     if (!bus->regs[R_I2CS_INTR_STS]) {
86         return;
87     }
88 
89     bus->controller->intr_status |= 1 << bus->id;
90     qemu_irq_raise(aic->bus_get_irq(bus));
91 }
92 
93 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
94                                         unsigned size)
95 {
96     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
97     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
98 
99     switch (offset) {
100     case A_I2CD_FUN_CTRL:
101     case A_I2CD_AC_TIMING1:
102     case A_I2CD_AC_TIMING2:
103     case A_I2CD_INTR_CTRL:
104     case A_I2CD_INTR_STS:
105     case A_I2CD_DEV_ADDR:
106     case A_I2CD_POOL_CTRL:
107     case A_I2CD_BYTE_BUF:
108         /* Value is already set, don't do anything. */
109         break;
110     case A_I2CD_CMD:
111         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
112         break;
113     case A_I2CD_DMA_ADDR:
114         if (!aic->has_dma) {
115             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
116             value = -1;
117         }
118         break;
119     case A_I2CD_DMA_LEN:
120         if (!aic->has_dma) {
121             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
122             value = -1;
123         }
124         break;
125 
126     default:
127         qemu_log_mask(LOG_GUEST_ERROR,
128                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
129         value = -1;
130         break;
131     }
132 
133     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
134     return value;
135 }
136 
137 static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
138                                         unsigned size)
139 {
140     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
141 
142     switch (offset) {
143     case A_I2CC_FUN_CTRL:
144     case A_I2CC_AC_TIMING:
145     case A_I2CC_POOL_CTRL:
146     case A_I2CM_INTR_CTRL:
147     case A_I2CM_INTR_STS:
148     case A_I2CC_MS_TXRX_BYTE_BUF:
149     case A_I2CM_DMA_LEN:
150     case A_I2CM_DMA_TX_ADDR:
151     case A_I2CM_DMA_RX_ADDR:
152     case A_I2CM_DMA_LEN_STS:
153     case A_I2CC_DMA_ADDR:
154     case A_I2CC_DMA_LEN:
155 
156     case A_I2CS_DEV_ADDR:
157     case A_I2CS_DMA_RX_ADDR:
158     case A_I2CS_DMA_LEN:
159     case A_I2CS_CMD:
160     case A_I2CS_INTR_CTRL:
161     case A_I2CS_DMA_LEN_STS:
162         /* Value is already set, don't do anything. */
163         break;
164     case A_I2CS_INTR_STS:
165         break;
166     case A_I2CM_CMD:
167         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
168         break;
169     default:
170         qemu_log_mask(LOG_GUEST_ERROR,
171                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
172         value = -1;
173         break;
174     }
175 
176     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
177     return value;
178 }
179 
180 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
181                                     unsigned size)
182 {
183     AspeedI2CBus *bus = opaque;
184     if (aspeed_i2c_is_new_mode(bus->controller)) {
185         return aspeed_i2c_bus_new_read(bus, offset, size);
186     }
187     return aspeed_i2c_bus_old_read(bus, offset, size);
188 }
189 
190 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
191 {
192     if (aspeed_i2c_is_new_mode(bus->controller)) {
193         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_STATE,
194                                 state);
195     } else {
196         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_CMD, TX_STATE, state);
197     }
198 }
199 
200 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
201 {
202     if (aspeed_i2c_is_new_mode(bus->controller)) {
203         return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF,
204                                        TX_STATE);
205     }
206     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
207 }
208 
209 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
210 {
211     MemTxResult result;
212     AspeedI2CState *s = bus->controller;
213     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
214     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
215 
216     result = address_space_read(&s->dram_as, bus->regs[reg_dma_addr],
217                                 MEMTXATTRS_UNSPECIFIED, data, 1);
218     if (result != MEMTX_OK) {
219         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
220                       __func__, bus->regs[reg_dma_addr]);
221         return -1;
222     }
223 
224     bus->regs[reg_dma_addr]++;
225     bus->regs[reg_dma_len]--;
226     return 0;
227 }
228 
229 static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
230 {
231     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
232     int ret = -1;
233     int i;
234     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
235     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
236     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
237     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
238     int pool_tx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
239                                                 TX_COUNT) + 1;
240 
241     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
242         for (i = 0; i < pool_tx_count; i++) {
243             uint8_t *pool_base = aic->bus_pool_base(bus);
244 
245             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
246                                       pool_base[i]);
247             ret = i2c_send(bus->bus, pool_base[i]);
248             if (ret) {
249                 break;
250             }
251         }
252         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_BUFF_EN, 0);
253     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
254         /* In new mode, clear how many bytes we TXed */
255         if (aspeed_i2c_is_new_mode(bus->controller)) {
256             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
257         }
258         while (bus->regs[reg_dma_len]) {
259             uint8_t data;
260             aspeed_i2c_dma_read(bus, &data);
261             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
262                                       bus->regs[reg_dma_len], data);
263             ret = i2c_send(bus->bus, data);
264             if (ret) {
265                 break;
266             }
267             /* In new mode, keep track of how many bytes we TXed */
268             if (aspeed_i2c_is_new_mode(bus->controller)) {
269                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN,
270                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
271                                                   TX_LEN) + 1);
272             }
273         }
274         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_DMA_EN, 0);
275     } else {
276         trace_aspeed_i2c_bus_send("BYTE", 0, 1,
277                                   bus->regs[reg_byte_buf]);
278         ret = i2c_send(bus->bus, bus->regs[reg_byte_buf]);
279     }
280 
281     return ret;
282 }
283 
284 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
285 {
286     AspeedI2CState *s = bus->controller;
287     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
288     uint8_t data;
289     int i;
290     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
291     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
292     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
293     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
294     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
295     int pool_rx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
296                                                 RX_SIZE) + 1;
297 
298     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
299         uint8_t *pool_base = aic->bus_pool_base(bus);
300         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
301                                     BUF_ORGANIZATION)) {
302             pool_base += 16;
303         }
304 
305         for (i = 0; i < pool_rx_count; i++) {
306             pool_base[i] = i2c_recv(bus->bus);
307             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
308                                       pool_base[i]);
309         }
310 
311         /* Update RX count */
312         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_pool_ctrl, RX_COUNT, i & 0xff);
313         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_BUFF_EN, 0);
314     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
315         uint8_t data;
316         /* In new mode, clear how many bytes we RXed */
317         if (aspeed_i2c_is_new_mode(bus->controller)) {
318             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
319         }
320 
321         while (bus->regs[reg_dma_len]) {
322             MemTxResult result;
323 
324             data = i2c_recv(bus->bus);
325             trace_aspeed_i2c_bus_recv("DMA", bus->regs[reg_dma_len],
326                                       bus->regs[reg_dma_len], data);
327             result = address_space_write(&s->dram_as, bus->regs[reg_dma_addr],
328                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
329             if (result != MEMTX_OK) {
330                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
331                               __func__, bus->regs[reg_dma_addr]);
332                 return;
333             }
334             bus->regs[reg_dma_addr]++;
335             bus->regs[reg_dma_len]--;
336             /* In new mode, keep track of how many bytes we RXed */
337             if (aspeed_i2c_is_new_mode(bus->controller)) {
338                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN,
339                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
340                                                   RX_LEN) + 1);
341             }
342         }
343         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_DMA_EN, 0);
344     } else {
345         data = i2c_recv(bus->bus);
346         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[reg_byte_buf]);
347         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
348     }
349 }
350 
351 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
352 {
353     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
354     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
355 
356     aspeed_i2c_set_state(bus, I2CD_MRXD);
357     aspeed_i2c_bus_recv(bus);
358     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
359     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) {
360         i2c_nack(bus->bus);
361     }
362     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_RX_CMD, 0);
363     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_S_RX_CMD_LAST, 0);
364     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
365 }
366 
367 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
368 {
369     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
370     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
371     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
372 
373     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
374         return (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, PKT_DEV_ADDR) << 1) |
375                 SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD);
376     }
377     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
378         uint8_t *pool_base = aic->bus_pool_base(bus);
379 
380         return pool_base[0];
381     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
382         uint8_t data;
383 
384         aspeed_i2c_dma_read(bus, &data);
385         return data;
386     } else {
387         return bus->regs[reg_byte_buf];
388     }
389 }
390 
391 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
392 {
393     AspeedI2CState *s = bus->controller;
394     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
395     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
396     bool dma_en = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)  ||
397                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)  ||
398                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ||
399                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN);
400     if (!aic->check_sram) {
401         return true;
402     }
403 
404     /*
405      * AST2500: SRAM must be enabled before using the Buffer Pool or
406      * DMA mode.
407      */
408     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
409         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
410         return false;
411     }
412 
413     return true;
414 }
415 
416 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
417 {
418     g_autofree char *cmd_flags = NULL;
419     uint32_t count;
420     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
421     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
422     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
423     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
424     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
425         count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT) + 1;
426     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
427         count = bus->regs[reg_dma_len];
428     } else { /* BYTE mode */
429         count = 1;
430     }
431 
432     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
433     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD) ? "start|" : "",
434     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN) ? "rxdma|" : "",
435     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN) ? "txdma|" : "",
436     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ? "rxbuf|" : "",
437     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN) ? "txbuf|" : "",
438     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD) ? "tx|" : "",
439     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ? "rx|" : "",
440     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST) ? "last|" : "",
441     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD) ? "stop|" : "");
442 
443     trace_aspeed_i2c_bus_cmd(bus->regs[reg_cmd], cmd_flags, count,
444                              bus->regs[reg_intr_sts]);
445 }
446 
447 /*
448  * The state machine needs some refinement. It is only used to track
449  * invalid STOP commands for the moment.
450  */
451 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
452 {
453     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
454     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
455     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
456 
457     if (!aspeed_i2c_check_sram(bus)) {
458         return;
459     }
460 
461     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
462         aspeed_i2c_bus_cmd_dump(bus);
463     }
464 
465     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD)) {
466         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
467             I2CD_MSTARTR : I2CD_MSTART;
468         uint8_t addr;
469 
470         aspeed_i2c_set_state(bus, state);
471 
472         addr = aspeed_i2c_get_addr(bus);
473         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
474                                extract32(addr, 0, 1))) {
475             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
476             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
477                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
478             }
479         } else {
480             /* START doesn't set TX_ACK in packet mode */
481             if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
482                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
483             }
484         }
485 
486         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_START_CMD, 0);
487 
488         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
489             if (bus->regs[reg_dma_len] == 0) {
490                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
491             }
492         } else if (!SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
493             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
494         }
495 
496         /* No slave found */
497         if (!i2c_bus_busy(bus->bus)) {
498             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
499                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
500                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
501             }
502             return;
503         }
504         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
505     }
506 
507     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD)) {
508         aspeed_i2c_set_state(bus, I2CD_MTXD);
509         if (aspeed_i2c_bus_send(bus)) {
510             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
511             i2c_end_transfer(bus->bus);
512         } else {
513             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
514         }
515         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
516         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
517     }
518 
519     if ((SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ||
520          SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) &&
521         !SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE)) {
522         aspeed_i2c_handle_rx_cmd(bus);
523     }
524 
525     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD)) {
526         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
527             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
528             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, ABNORMAL, 1);
529             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
530                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
531             }
532         } else {
533             aspeed_i2c_set_state(bus, I2CD_MSTOP);
534             i2c_end_transfer(bus->bus);
535             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
536         }
537         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
538         aspeed_i2c_set_state(bus, I2CD_IDLE);
539 
540         i2c_schedule_pending_master(bus->bus);
541     }
542 
543     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
544         ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
545     }
546 }
547 
548 static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
549                                      uint64_t value, unsigned size)
550 {
551     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
552     bool handle_rx;
553     bool w1t;
554 
555     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
556 
557     switch (offset) {
558     case A_I2CC_FUN_CTRL:
559         bus->regs[R_I2CC_FUN_CTRL] = value;
560         break;
561     case A_I2CC_AC_TIMING:
562         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
563         break;
564     case A_I2CC_MS_TXRX_BYTE_BUF:
565         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_BUF,
566                                 value);
567         break;
568     case A_I2CC_POOL_CTRL:
569         bus->regs[R_I2CC_POOL_CTRL] &= ~0xffffff;
570         bus->regs[R_I2CC_POOL_CTRL] |= (value & 0xffffff);
571         break;
572     case A_I2CM_INTR_CTRL:
573         bus->regs[R_I2CM_INTR_CTRL] = value & 0x0007f07f;
574         break;
575     case A_I2CM_INTR_STS:
576         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_INTR_STS, RX_DONE)
577                     && SHARED_FIELD_EX32(value, RX_DONE);
578 
579         /* In packet mode, clearing PKT_CMD_DONE clears other interrupts. */
580         if (aspeed_i2c_bus_pkt_mode_en(bus) &&
581            FIELD_EX32(value, I2CM_INTR_STS, PKT_CMD_DONE)) {
582             bus->regs[R_I2CM_INTR_STS] &= 0xf0001000;
583             if (!bus->regs[R_I2CM_INTR_STS]) {
584                 bus->controller->intr_status &= ~(1 << bus->id);
585                 qemu_irq_lower(aic->bus_get_irq(bus));
586             }
587             aspeed_i2c_bus_raise_slave_interrupt(bus);
588             break;
589         }
590         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
591         if (!bus->regs[R_I2CM_INTR_STS]) {
592             bus->controller->intr_status &= ~(1 << bus->id);
593             qemu_irq_lower(aic->bus_get_irq(bus));
594         }
595         if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
596                                                   M_RX_CMD) ||
597                           SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
598                                                   M_S_RX_CMD_LAST))) {
599             aspeed_i2c_handle_rx_cmd(bus);
600             aspeed_i2c_bus_raise_interrupt(bus);
601         }
602         break;
603     case A_I2CM_CMD:
604         if (!aspeed_i2c_bus_is_enabled(bus)) {
605             break;
606         }
607 
608         if (!aspeed_i2c_bus_is_master(bus)) {
609             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
610                           __func__);
611             break;
612         }
613 
614         if (!aic->has_dma &&
615             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
616              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
617             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
618             break;
619         }
620 
621         if (bus->regs[R_I2CM_INTR_STS] & 0xffff0000) {
622             qemu_log_mask(LOG_UNIMP, "%s: Packet mode is not implemented\n",
623                           __func__);
624             break;
625         }
626 
627         value &= 0xff0ffbfb;
628         if (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, W1_CTRL)) {
629             bus->regs[R_I2CM_CMD] |= value;
630         } else {
631             bus->regs[R_I2CM_CMD] = value;
632         }
633 
634         aspeed_i2c_bus_handle_cmd(bus, value);
635         aspeed_i2c_bus_raise_interrupt(bus);
636         break;
637     case A_I2CM_DMA_TX_ADDR:
638         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
639                                                    ADDR);
640         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR);
641         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
642                                                      TX_BUF_LEN) + 1;
643         break;
644     case A_I2CM_DMA_RX_ADDR:
645         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
646                                                    ADDR);
647         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR);
648         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
649                                                      RX_BUF_LEN) + 1;
650         break;
651     case A_I2CM_DMA_LEN:
652         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
653               FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
654         /* If none of the w1t bits are set, just write to the reg as normal. */
655         if (!w1t) {
656             bus->regs[R_I2CM_DMA_LEN] = value;
657             break;
658         }
659         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
660             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
661                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
662         }
663         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
664             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
665                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
666         }
667         break;
668     case A_I2CM_DMA_LEN_STS:
669         /* Writes clear to 0 */
670         bus->regs[R_I2CM_DMA_LEN_STS] = 0;
671         break;
672     case A_I2CC_DMA_ADDR:
673     case A_I2CC_DMA_LEN:
674         /* RO */
675         break;
676     case A_I2CS_DEV_ADDR:
677         bus->regs[R_I2CS_DEV_ADDR] = value;
678         break;
679     case A_I2CS_DMA_RX_ADDR:
680         bus->regs[R_I2CS_DMA_RX_ADDR] = value;
681         break;
682     case A_I2CS_DMA_LEN:
683         assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
684         if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
685             ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
686                              FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
687         } else {
688             bus->regs[R_I2CS_DMA_LEN] = value;
689         }
690         break;
691     case A_I2CS_CMD:
692         if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
693             bus->regs[R_I2CS_CMD] |= value;
694         } else {
695             bus->regs[R_I2CS_CMD] = value;
696         }
697         i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
698         break;
699     case A_I2CS_INTR_CTRL:
700         bus->regs[R_I2CS_INTR_CTRL] = value;
701         break;
702 
703     case A_I2CS_INTR_STS:
704         if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
705             if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
706                 FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
707                 bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
708             }
709         } else {
710             bus->regs[R_I2CS_INTR_STS] &= ~value;
711         }
712         if (!bus->regs[R_I2CS_INTR_STS]) {
713             bus->controller->intr_status &= ~(1 << bus->id);
714             qemu_irq_lower(aic->bus_get_irq(bus));
715         }
716         aspeed_i2c_bus_raise_interrupt(bus);
717         break;
718     case A_I2CS_DMA_LEN_STS:
719         bus->regs[R_I2CS_DMA_LEN_STS] = 0;
720         break;
721     case A_I2CS_DMA_TX_ADDR:
722         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
723                       __func__);
724         break;
725     default:
726         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
727                       __func__, offset);
728     }
729 }
730 
731 static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
732                                      uint64_t value, unsigned size)
733 {
734     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
735     bool handle_rx;
736 
737     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
738 
739     switch (offset) {
740     case A_I2CD_FUN_CTRL:
741         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
742             i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
743         }
744         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
745         break;
746     case A_I2CD_AC_TIMING1:
747         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
748         break;
749     case A_I2CD_AC_TIMING2:
750         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
751         break;
752     case A_I2CD_INTR_CTRL:
753         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
754         break;
755     case A_I2CD_INTR_STS:
756         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_INTR_STS, RX_DONE)
757                     && SHARED_FIELD_EX32(value, RX_DONE);
758         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
759         if (!bus->regs[R_I2CD_INTR_STS]) {
760             bus->controller->intr_status &= ~(1 << bus->id);
761             qemu_irq_lower(aic->bus_get_irq(bus));
762         }
763         if (handle_rx) {
764             if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
765                 SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
766                                         M_S_RX_CMD_LAST)) {
767                 aspeed_i2c_handle_rx_cmd(bus);
768                 aspeed_i2c_bus_raise_interrupt(bus);
769             } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
770                 i2c_ack(bus->bus);
771             }
772         }
773         break;
774     case A_I2CD_DEV_ADDR:
775         bus->regs[R_I2CD_DEV_ADDR] = value;
776         break;
777     case A_I2CD_POOL_CTRL:
778         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
779         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
780         break;
781 
782     case A_I2CD_BYTE_BUF:
783         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_BYTE_BUF, TX_BUF, value);
784         break;
785     case A_I2CD_CMD:
786         if (!aspeed_i2c_bus_is_enabled(bus)) {
787             break;
788         }
789 
790         if (!aspeed_i2c_bus_is_master(bus)) {
791             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
792                           __func__);
793             break;
794         }
795 
796         if (!aic->has_dma &&
797             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
798              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
799             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
800             break;
801         }
802 
803         bus->regs[R_I2CD_CMD] &= ~0xFFFF;
804         bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
805 
806         aspeed_i2c_bus_handle_cmd(bus, value);
807         aspeed_i2c_bus_raise_interrupt(bus);
808         break;
809     case A_I2CD_DMA_ADDR:
810         if (!aic->has_dma) {
811             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
812             break;
813         }
814 
815         bus->regs[R_I2CD_DMA_ADDR] = value & 0x3ffffffc;
816         break;
817 
818     case A_I2CD_DMA_LEN:
819         if (!aic->has_dma) {
820             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
821             break;
822         }
823 
824         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
825         if (!bus->regs[R_I2CD_DMA_LEN]) {
826             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
827         }
828         break;
829 
830     default:
831         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
832                       __func__, offset);
833     }
834 }
835 
836 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
837                                      uint64_t value, unsigned size)
838 {
839     AspeedI2CBus *bus = opaque;
840     if (aspeed_i2c_is_new_mode(bus->controller)) {
841         aspeed_i2c_bus_new_write(bus, offset, value, size);
842     } else {
843         aspeed_i2c_bus_old_write(bus, offset, value, size);
844     }
845 }
846 
847 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
848                                    unsigned size)
849 {
850     AspeedI2CState *s = opaque;
851 
852     switch (offset) {
853     case A_I2C_CTRL_STATUS:
854         return s->intr_status;
855     case A_I2C_CTRL_GLOBAL:
856         return s->ctrl_global;
857     case A_I2C_CTRL_NEW_CLK_DIVIDER:
858         if (aspeed_i2c_is_new_mode(s)) {
859             return s->new_clk_divider;
860         }
861         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
862                       __func__, offset);
863         break;
864     default:
865         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
866                       __func__, offset);
867         break;
868     }
869 
870     return -1;
871 }
872 
873 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
874                                   uint64_t value, unsigned size)
875 {
876     AspeedI2CState *s = opaque;
877 
878     switch (offset) {
879     case A_I2C_CTRL_GLOBAL:
880         s->ctrl_global = value;
881         break;
882     case A_I2C_CTRL_NEW_CLK_DIVIDER:
883         if (aspeed_i2c_is_new_mode(s)) {
884             s->new_clk_divider = value;
885         } else {
886             qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx
887                           "\n", __func__, offset);
888         }
889         break;
890     case A_I2C_CTRL_STATUS:
891     default:
892         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
893                       __func__, offset);
894         break;
895     }
896 }
897 
898 static const MemoryRegionOps aspeed_i2c_bus_ops = {
899     .read = aspeed_i2c_bus_read,
900     .write = aspeed_i2c_bus_write,
901     .endianness = DEVICE_LITTLE_ENDIAN,
902 };
903 
904 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
905     .read = aspeed_i2c_ctrl_read,
906     .write = aspeed_i2c_ctrl_write,
907     .endianness = DEVICE_LITTLE_ENDIAN,
908 };
909 
910 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
911                                      unsigned size)
912 {
913     AspeedI2CState *s = opaque;
914     uint64_t ret = 0;
915     int i;
916 
917     for (i = 0; i < size; i++) {
918         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
919     }
920 
921     return ret;
922 }
923 
924 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
925                                   uint64_t value, unsigned size)
926 {
927     AspeedI2CState *s = opaque;
928     int i;
929 
930     for (i = 0; i < size; i++) {
931         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
932     }
933 }
934 
935 static const MemoryRegionOps aspeed_i2c_pool_ops = {
936     .read = aspeed_i2c_pool_read,
937     .write = aspeed_i2c_pool_write,
938     .endianness = DEVICE_LITTLE_ENDIAN,
939     .valid = {
940         .min_access_size = 1,
941         .max_access_size = 4,
942     },
943 };
944 
945 static const VMStateDescription aspeed_i2c_bus_vmstate = {
946     .name = TYPE_ASPEED_I2C,
947     .version_id = 5,
948     .minimum_version_id = 5,
949     .fields = (VMStateField[]) {
950         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),
951         VMSTATE_END_OF_LIST()
952     }
953 };
954 
955 static const VMStateDescription aspeed_i2c_vmstate = {
956     .name = TYPE_ASPEED_I2C,
957     .version_id = 2,
958     .minimum_version_id = 2,
959     .fields = (VMStateField[]) {
960         VMSTATE_UINT32(intr_status, AspeedI2CState),
961         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
962                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
963                              AspeedI2CBus),
964         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
965         VMSTATE_END_OF_LIST()
966     }
967 };
968 
969 static void aspeed_i2c_reset(DeviceState *dev)
970 {
971     AspeedI2CState *s = ASPEED_I2C(dev);
972 
973     s->intr_status = 0;
974 }
975 
976 static void aspeed_i2c_instance_init(Object *obj)
977 {
978     AspeedI2CState *s = ASPEED_I2C(obj);
979     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
980     int i;
981 
982     for (i = 0; i < aic->num_busses; i++) {
983         object_initialize_child(obj, "bus[*]", &s->busses[i],
984                                 TYPE_ASPEED_I2C_BUS);
985     }
986 }
987 
988 /*
989  * Address Definitions (AST2400 and AST2500)
990  *
991  *   0x000 ... 0x03F: Global Register
992  *   0x040 ... 0x07F: Device 1
993  *   0x080 ... 0x0BF: Device 2
994  *   0x0C0 ... 0x0FF: Device 3
995  *   0x100 ... 0x13F: Device 4
996  *   0x140 ... 0x17F: Device 5
997  *   0x180 ... 0x1BF: Device 6
998  *   0x1C0 ... 0x1FF: Device 7
999  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
1000  *   0x300 ... 0x33F: Device 8
1001  *   0x340 ... 0x37F: Device 9
1002  *   0x380 ... 0x3BF: Device 10
1003  *   0x3C0 ... 0x3FF: Device 11
1004  *   0x400 ... 0x43F: Device 12
1005  *   0x440 ... 0x47F: Device 13
1006  *   0x480 ... 0x4BF: Device 14
1007  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
1008  */
1009 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
1010 {
1011     int i;
1012     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1013     AspeedI2CState *s = ASPEED_I2C(dev);
1014     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1015 
1016     sysbus_init_irq(sbd, &s->irq);
1017     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
1018                           "aspeed.i2c", 0x1000);
1019     sysbus_init_mmio(sbd, &s->iomem);
1020 
1021     for (i = 0; i < aic->num_busses; i++) {
1022         Object *bus = OBJECT(&s->busses[i]);
1023         int offset = i < aic->gap ? 1 : 5;
1024 
1025         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
1026             return;
1027         }
1028 
1029         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
1030             return;
1031         }
1032 
1033         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
1034             return;
1035         }
1036 
1037         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
1038                                     &s->busses[i].mr);
1039     }
1040 
1041     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
1042                           "aspeed.i2c-pool", aic->pool_size);
1043     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
1044 
1045     if (aic->has_dma) {
1046         if (!s->dram_mr) {
1047             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
1048             return;
1049         }
1050 
1051         address_space_init(&s->dram_as, s->dram_mr,
1052                            TYPE_ASPEED_I2C "-dma-dram");
1053     }
1054 }
1055 
1056 static Property aspeed_i2c_properties[] = {
1057     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
1058                      TYPE_MEMORY_REGION, MemoryRegion *),
1059     DEFINE_PROP_END_OF_LIST(),
1060 };
1061 
1062 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
1063 {
1064     DeviceClass *dc = DEVICE_CLASS(klass);
1065 
1066     dc->vmsd = &aspeed_i2c_vmstate;
1067     dc->reset = aspeed_i2c_reset;
1068     device_class_set_props(dc, aspeed_i2c_properties);
1069     dc->realize = aspeed_i2c_realize;
1070     dc->desc = "Aspeed I2C Controller";
1071 }
1072 
1073 static const TypeInfo aspeed_i2c_info = {
1074     .name          = TYPE_ASPEED_I2C,
1075     .parent        = TYPE_SYS_BUS_DEVICE,
1076     .instance_init = aspeed_i2c_instance_init,
1077     .instance_size = sizeof(AspeedI2CState),
1078     .class_init    = aspeed_i2c_class_init,
1079     .class_size = sizeof(AspeedI2CClass),
1080     .abstract   = true,
1081 };
1082 
1083 static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
1084                                           enum i2c_event event)
1085 {
1086     switch (event) {
1087     case I2C_START_SEND_ASYNC:
1088         if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
1089             qemu_log_mask(LOG_GUEST_ERROR,
1090                           "%s: Slave mode RX DMA is not enabled\n", __func__);
1091             return -1;
1092         }
1093         ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
1094         bus->regs[R_I2CC_DMA_ADDR] =
1095             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
1096         bus->regs[R_I2CC_DMA_LEN] =
1097             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
1098         i2c_ack(bus->bus);
1099         break;
1100     case I2C_FINISH:
1101         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
1102         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1103         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
1104         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
1105         aspeed_i2c_bus_raise_slave_interrupt(bus);
1106         break;
1107     default:
1108         qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
1109                       __func__, event);
1110         return -1;
1111     }
1112 
1113     return 0;
1114 }
1115 
1116 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
1117 {
1118     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1119     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1120     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1121     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1122     uint32_t reg_dev_addr = aspeed_i2c_bus_dev_addr_offset(bus);
1123     uint32_t dev_addr = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_dev_addr,
1124                                                 SLAVE_DEV_ADDR1);
1125 
1126     if (aspeed_i2c_is_new_mode(bus->controller)) {
1127         return aspeed_i2c_bus_new_slave_event(bus, event);
1128     }
1129 
1130     switch (event) {
1131     case I2C_START_SEND_ASYNC:
1132         /* Bit[0] == 0 indicates "send". */
1133         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, dev_addr << 1);
1134 
1135         ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1136         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1137 
1138         aspeed_i2c_set_state(bus, I2CD_STXD);
1139 
1140         break;
1141 
1142     case I2C_FINISH:
1143         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
1144 
1145         aspeed_i2c_set_state(bus, I2CD_IDLE);
1146 
1147         break;
1148 
1149     default:
1150         return -1;
1151     }
1152 
1153     aspeed_i2c_bus_raise_interrupt(bus);
1154 
1155     return 0;
1156 }
1157 
1158 static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
1159 {
1160     assert(address_space_write(&bus->controller->dram_as,
1161                                bus->regs[R_I2CC_DMA_ADDR],
1162                                MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
1163 
1164     bus->regs[R_I2CC_DMA_ADDR]++;
1165     bus->regs[R_I2CC_DMA_LEN]--;
1166     ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
1167                      ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
1168     i2c_ack(bus->bus);
1169 }
1170 
1171 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
1172 {
1173     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1174     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1175     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1176     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1177 
1178     if (aspeed_i2c_is_new_mode(bus->controller)) {
1179         return aspeed_i2c_bus_new_slave_send_async(bus, data);
1180     }
1181 
1182     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
1183     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1184 
1185     aspeed_i2c_bus_raise_interrupt(bus);
1186 }
1187 
1188 static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
1189 {
1190     DeviceClass *dc = DEVICE_CLASS(klass);
1191     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
1192 
1193     dc->desc = "Aspeed I2C Bus Slave";
1194 
1195     sc->event = aspeed_i2c_bus_slave_event;
1196     sc->send_async = aspeed_i2c_bus_slave_send_async;
1197 }
1198 
1199 static const TypeInfo aspeed_i2c_bus_slave_info = {
1200     .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
1201     .parent         = TYPE_I2C_SLAVE,
1202     .instance_size  = sizeof(AspeedI2CBusSlave),
1203     .class_init     = aspeed_i2c_bus_slave_class_init,
1204 };
1205 
1206 static void aspeed_i2c_bus_reset(DeviceState *dev)
1207 {
1208     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1209 
1210     memset(s->regs, 0, sizeof(s->regs));
1211     i2c_end_transfer(s->bus);
1212 }
1213 
1214 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
1215 {
1216     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1217     AspeedI2CClass *aic;
1218     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
1219 
1220     if (!s->controller) {
1221         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
1222         return;
1223     }
1224 
1225     aic = ASPEED_I2C_GET_CLASS(s->controller);
1226 
1227     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
1228 
1229     s->bus = i2c_init_bus(dev, name);
1230     s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
1231                                        0xff);
1232 
1233     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
1234                           s, name, aic->reg_size);
1235     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
1236 }
1237 
1238 static Property aspeed_i2c_bus_properties[] = {
1239     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
1240     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
1241                      AspeedI2CState *),
1242     DEFINE_PROP_END_OF_LIST(),
1243 };
1244 
1245 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
1246 {
1247     DeviceClass *dc = DEVICE_CLASS(klass);
1248 
1249     dc->desc = "Aspeed I2C Bus";
1250     dc->realize = aspeed_i2c_bus_realize;
1251     dc->reset = aspeed_i2c_bus_reset;
1252     device_class_set_props(dc, aspeed_i2c_bus_properties);
1253 }
1254 
1255 static const TypeInfo aspeed_i2c_bus_info = {
1256     .name           = TYPE_ASPEED_I2C_BUS,
1257     .parent         = TYPE_SYS_BUS_DEVICE,
1258     .instance_size  = sizeof(AspeedI2CBus),
1259     .class_init     = aspeed_i2c_bus_class_init,
1260 };
1261 
1262 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
1263 {
1264     return bus->controller->irq;
1265 }
1266 
1267 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
1268 {
1269     uint8_t *pool_page =
1270         &bus->controller->pool[ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL,
1271                                                 POOL_PAGE_SEL) * 0x100];
1272 
1273     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
1274 }
1275 
1276 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
1277 {
1278     DeviceClass *dc = DEVICE_CLASS(klass);
1279     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1280 
1281     dc->desc = "ASPEED 2400 I2C Controller";
1282 
1283     aic->num_busses = 14;
1284     aic->reg_size = 0x40;
1285     aic->gap = 7;
1286     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
1287     aic->pool_size = 0x800;
1288     aic->pool_base = 0x800;
1289     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
1290 }
1291 
1292 static const TypeInfo aspeed_2400_i2c_info = {
1293     .name = TYPE_ASPEED_2400_I2C,
1294     .parent = TYPE_ASPEED_I2C,
1295     .class_init = aspeed_2400_i2c_class_init,
1296 };
1297 
1298 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
1299 {
1300     return bus->controller->irq;
1301 }
1302 
1303 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
1304 {
1305     return &bus->controller->pool[bus->id * 0x10];
1306 }
1307 
1308 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
1309 {
1310     DeviceClass *dc = DEVICE_CLASS(klass);
1311     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1312 
1313     dc->desc = "ASPEED 2500 I2C Controller";
1314 
1315     aic->num_busses = 14;
1316     aic->reg_size = 0x40;
1317     aic->gap = 7;
1318     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
1319     aic->pool_size = 0x100;
1320     aic->pool_base = 0x200;
1321     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1322     aic->check_sram = true;
1323     aic->has_dma = true;
1324 }
1325 
1326 static const TypeInfo aspeed_2500_i2c_info = {
1327     .name = TYPE_ASPEED_2500_I2C,
1328     .parent = TYPE_ASPEED_I2C,
1329     .class_init = aspeed_2500_i2c_class_init,
1330 };
1331 
1332 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
1333 {
1334     return bus->irq;
1335 }
1336 
1337 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
1338 {
1339    return &bus->controller->pool[bus->id * 0x20];
1340 }
1341 
1342 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
1343 {
1344     DeviceClass *dc = DEVICE_CLASS(klass);
1345     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1346 
1347     dc->desc = "ASPEED 2600 I2C Controller";
1348 
1349     aic->num_busses = 16;
1350     aic->reg_size = 0x80;
1351     aic->gap = -1; /* no gap */
1352     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1353     aic->pool_size = 0x200;
1354     aic->pool_base = 0xC00;
1355     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1356     aic->has_dma = true;
1357 }
1358 
1359 static const TypeInfo aspeed_2600_i2c_info = {
1360     .name = TYPE_ASPEED_2600_I2C,
1361     .parent = TYPE_ASPEED_I2C,
1362     .class_init = aspeed_2600_i2c_class_init,
1363 };
1364 
1365 static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
1366 {
1367     DeviceClass *dc = DEVICE_CLASS(klass);
1368     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1369 
1370     dc->desc = "ASPEED 1030 I2C Controller";
1371 
1372     aic->num_busses = 14;
1373     aic->reg_size = 0x80;
1374     aic->gap = -1; /* no gap */
1375     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1376     aic->pool_size = 0x200;
1377     aic->pool_base = 0xC00;
1378     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1379     aic->has_dma = true;
1380 }
1381 
1382 static const TypeInfo aspeed_1030_i2c_info = {
1383     .name = TYPE_ASPEED_1030_I2C,
1384     .parent = TYPE_ASPEED_I2C,
1385     .class_init = aspeed_1030_i2c_class_init,
1386 };
1387 
1388 static void aspeed_i2c_register_types(void)
1389 {
1390     type_register_static(&aspeed_i2c_bus_info);
1391     type_register_static(&aspeed_i2c_bus_slave_info);
1392     type_register_static(&aspeed_i2c_info);
1393     type_register_static(&aspeed_2400_i2c_info);
1394     type_register_static(&aspeed_2500_i2c_info);
1395     type_register_static(&aspeed_2600_i2c_info);
1396     type_register_static(&aspeed_1030_i2c_info);
1397 }
1398 
1399 type_init(aspeed_i2c_register_types)
1400 
1401 
1402 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1403 {
1404     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1405     I2CBus *bus = NULL;
1406 
1407     if (busnr >= 0 && busnr < aic->num_busses) {
1408         bus = s->busses[busnr].bus;
1409     }
1410 
1411     return bus;
1412 }
1413