xref: /qemu/hw/i2c/aspeed_i2c.c (revision 2abf0da2)
1 /*
2  * ARM Aspeed I2C controller
3  *
4  * Copyright (C) 2016 IBM Corp.
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
18  *
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "qemu/cutils.h"
25 #include "qemu/log.h"
26 #include "qemu/module.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "hw/i2c/aspeed_i2c.h"
30 #include "hw/irq.h"
31 #include "hw/qdev-properties.h"
32 #include "hw/registerfields.h"
33 #include "trace.h"
34 
35 /* Enable SLAVE_ADDR_RX_MATCH always */
36 #define R_I2CD_INTR_STS_ALWAYS_ENABLE  R_I2CD_INTR_STS_SLAVE_ADDR_RX_MATCH_MASK
37 
38 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
39 {
40     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
41     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
42     uint32_t intr_ctrl_reg = aspeed_i2c_bus_intr_ctrl_offset(bus);
43     uint32_t intr_ctrl_mask = bus->regs[intr_ctrl_reg] |
44         R_I2CD_INTR_STS_ALWAYS_ENABLE;
45     bool raise_irq;
46 
47     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_RAISE_INTERRUPT)) {
48         g_autofree char *buf = g_strdup_printf("%s%s%s%s%s%s%s",
49                aspeed_i2c_bus_pkt_mode_en(bus) &&
50                ARRAY_FIELD_EX32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE) ?
51                                                "pktdone|" : "",
52                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_NAK) ?
53                                                "nak|" : "",
54                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_ACK) ?
55                                                "ack|" : "",
56                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE) ?
57                                                "done|" : "",
58                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
59                                                "slave-match|" : "",
60                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
61                                                "stop|" : "",
62                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
63                                                "abnormal"  : "");
64 
65            trace_aspeed_i2c_bus_raise_interrupt(bus->regs[reg_intr_sts], buf);
66     }
67 
68     raise_irq = bus->regs[reg_intr_sts] & intr_ctrl_mask ;
69 
70     /* In packet mode we don't mask off INTR_STS */
71     if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
72         bus->regs[reg_intr_sts] &= intr_ctrl_mask;
73     }
74 
75     if (raise_irq) {
76         bus->controller->intr_status |= 1 << bus->id;
77         qemu_irq_raise(aic->bus_get_irq(bus));
78     }
79 }
80 
81 static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
82 {
83     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
84 
85     if (!bus->regs[R_I2CS_INTR_STS]) {
86         return;
87     }
88 
89     bus->controller->intr_status |= 1 << bus->id;
90     qemu_irq_raise(aic->bus_get_irq(bus));
91 }
92 
93 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
94                                         unsigned size)
95 {
96     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
97     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
98 
99     switch (offset) {
100     case A_I2CD_FUN_CTRL:
101     case A_I2CD_AC_TIMING1:
102     case A_I2CD_AC_TIMING2:
103     case A_I2CD_INTR_CTRL:
104     case A_I2CD_INTR_STS:
105     case A_I2CD_DEV_ADDR:
106     case A_I2CD_POOL_CTRL:
107     case A_I2CD_BYTE_BUF:
108         /* Value is already set, don't do anything. */
109         break;
110     case A_I2CD_CMD:
111         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
112         break;
113     case A_I2CD_DMA_ADDR:
114         if (!aic->has_dma) {
115             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
116             value = -1;
117         }
118         break;
119     case A_I2CD_DMA_LEN:
120         if (!aic->has_dma) {
121             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
122             value = -1;
123         }
124         break;
125 
126     default:
127         qemu_log_mask(LOG_GUEST_ERROR,
128                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
129         value = -1;
130         break;
131     }
132 
133     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
134     return value;
135 }
136 
137 static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
138                                         unsigned size)
139 {
140     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
141 
142     switch (offset) {
143     case A_I2CC_FUN_CTRL:
144     case A_I2CC_AC_TIMING:
145     case A_I2CC_POOL_CTRL:
146     case A_I2CM_INTR_CTRL:
147     case A_I2CM_INTR_STS:
148     case A_I2CC_MS_TXRX_BYTE_BUF:
149     case A_I2CM_DMA_LEN:
150     case A_I2CM_DMA_TX_ADDR:
151     case A_I2CM_DMA_RX_ADDR:
152     case A_I2CM_DMA_LEN_STS:
153     case A_I2CC_DMA_ADDR:
154     case A_I2CC_DMA_LEN:
155 
156     case A_I2CS_DEV_ADDR:
157     case A_I2CS_DMA_RX_ADDR:
158     case A_I2CS_DMA_LEN:
159     case A_I2CS_CMD:
160     case A_I2CS_INTR_CTRL:
161     case A_I2CS_DMA_LEN_STS:
162         /* Value is already set, don't do anything. */
163         break;
164     case A_I2CS_INTR_STS:
165         break;
166     case A_I2CM_CMD:
167         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
168         break;
169     default:
170         qemu_log_mask(LOG_GUEST_ERROR,
171                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
172         value = -1;
173         break;
174     }
175 
176     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
177     return value;
178 }
179 
180 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
181                                     unsigned size)
182 {
183     AspeedI2CBus *bus = opaque;
184     if (aspeed_i2c_is_new_mode(bus->controller)) {
185         return aspeed_i2c_bus_new_read(bus, offset, size);
186     }
187     return aspeed_i2c_bus_old_read(bus, offset, size);
188 }
189 
190 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
191 {
192     if (aspeed_i2c_is_new_mode(bus->controller)) {
193         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_STATE,
194                                 state);
195     } else {
196         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_CMD, TX_STATE, state);
197     }
198 }
199 
200 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
201 {
202     if (aspeed_i2c_is_new_mode(bus->controller)) {
203         return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF,
204                                        TX_STATE);
205     }
206     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
207 }
208 
209 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
210 {
211     MemTxResult result;
212     AspeedI2CState *s = bus->controller;
213     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
214     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
215 
216     result = address_space_read(&s->dram_as, bus->regs[reg_dma_addr],
217                                 MEMTXATTRS_UNSPECIFIED, data, 1);
218     if (result != MEMTX_OK) {
219         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
220                       __func__, bus->regs[reg_dma_addr]);
221         return -1;
222     }
223 
224     bus->regs[reg_dma_addr]++;
225     bus->regs[reg_dma_len]--;
226     return 0;
227 }
228 
229 static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
230 {
231     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
232     int ret = -1;
233     int i;
234     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
235     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
236     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
237     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
238     int pool_tx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
239                                                 TX_COUNT) + 1;
240 
241     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
242         for (i = 0; i < pool_tx_count; i++) {
243             uint8_t *pool_base = aic->bus_pool_base(bus);
244 
245             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
246                                       pool_base[i]);
247             ret = i2c_send(bus->bus, pool_base[i]);
248             if (ret) {
249                 break;
250             }
251         }
252         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_BUFF_EN, 0);
253     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
254         /* In new mode, clear how many bytes we TXed */
255         if (aspeed_i2c_is_new_mode(bus->controller)) {
256             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
257         }
258         while (bus->regs[reg_dma_len]) {
259             uint8_t data;
260             aspeed_i2c_dma_read(bus, &data);
261             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
262                                       bus->regs[reg_dma_len], data);
263             ret = i2c_send(bus->bus, data);
264             if (ret) {
265                 break;
266             }
267             /* In new mode, keep track of how many bytes we TXed */
268             if (aspeed_i2c_is_new_mode(bus->controller)) {
269                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN,
270                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
271                                                   TX_LEN) + 1);
272             }
273         }
274         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_DMA_EN, 0);
275     } else {
276         trace_aspeed_i2c_bus_send("BYTE", 0, 1,
277                                   bus->regs[reg_byte_buf]);
278         ret = i2c_send(bus->bus, bus->regs[reg_byte_buf]);
279     }
280 
281     return ret;
282 }
283 
284 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
285 {
286     AspeedI2CState *s = bus->controller;
287     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
288     uint8_t data;
289     int i;
290     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
291     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
292     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
293     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
294     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
295     int pool_rx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
296                                                 RX_SIZE) + 1;
297 
298     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
299         uint8_t *pool_base = aic->bus_pool_base(bus);
300         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
301                                     BUF_ORGANIZATION)) {
302             pool_base += 16;
303         }
304 
305         for (i = 0; i < pool_rx_count; i++) {
306             pool_base[i] = i2c_recv(bus->bus);
307             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
308                                       pool_base[i]);
309         }
310 
311         /* Update RX count */
312         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_pool_ctrl, RX_COUNT, i & 0xff);
313         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_BUFF_EN, 0);
314     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
315         /* In new mode, clear how many bytes we RXed */
316         if (aspeed_i2c_is_new_mode(bus->controller)) {
317             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
318         }
319 
320         while (bus->regs[reg_dma_len]) {
321             MemTxResult result;
322 
323             data = i2c_recv(bus->bus);
324             trace_aspeed_i2c_bus_recv("DMA", bus->regs[reg_dma_len],
325                                       bus->regs[reg_dma_len], data);
326             result = address_space_write(&s->dram_as, bus->regs[reg_dma_addr],
327                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
328             if (result != MEMTX_OK) {
329                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
330                               __func__, bus->regs[reg_dma_addr]);
331                 return;
332             }
333             bus->regs[reg_dma_addr]++;
334             bus->regs[reg_dma_len]--;
335             /* In new mode, keep track of how many bytes we RXed */
336             if (aspeed_i2c_is_new_mode(bus->controller)) {
337                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN,
338                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
339                                                   RX_LEN) + 1);
340             }
341         }
342         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_DMA_EN, 0);
343     } else {
344         data = i2c_recv(bus->bus);
345         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[reg_byte_buf]);
346         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
347     }
348 }
349 
350 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
351 {
352     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
353     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
354 
355     aspeed_i2c_set_state(bus, I2CD_MRXD);
356     aspeed_i2c_bus_recv(bus);
357     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
358     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) {
359         i2c_nack(bus->bus);
360     }
361     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_RX_CMD, 0);
362     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_S_RX_CMD_LAST, 0);
363     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
364 }
365 
366 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
367 {
368     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
369     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
370     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
371 
372     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
373         return (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, PKT_DEV_ADDR) << 1) |
374                 SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD);
375     }
376     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
377         uint8_t *pool_base = aic->bus_pool_base(bus);
378 
379         return pool_base[0];
380     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
381         uint8_t data;
382 
383         aspeed_i2c_dma_read(bus, &data);
384         return data;
385     } else {
386         return bus->regs[reg_byte_buf];
387     }
388 }
389 
390 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
391 {
392     AspeedI2CState *s = bus->controller;
393     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
394     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
395     bool dma_en = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)  ||
396                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)  ||
397                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ||
398                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN);
399     if (!aic->check_sram) {
400         return true;
401     }
402 
403     /*
404      * AST2500: SRAM must be enabled before using the Buffer Pool or
405      * DMA mode.
406      */
407     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
408         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
409         return false;
410     }
411 
412     return true;
413 }
414 
415 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
416 {
417     g_autofree char *cmd_flags = NULL;
418     uint32_t count;
419     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
420     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
421     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
422     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
423     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
424         count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT) + 1;
425     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
426         count = bus->regs[reg_dma_len];
427     } else { /* BYTE mode */
428         count = 1;
429     }
430 
431     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
432     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD) ? "start|" : "",
433     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN) ? "rxdma|" : "",
434     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN) ? "txdma|" : "",
435     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ? "rxbuf|" : "",
436     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN) ? "txbuf|" : "",
437     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD) ? "tx|" : "",
438     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ? "rx|" : "",
439     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST) ? "last|" : "",
440     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD) ? "stop|" : "");
441 
442     trace_aspeed_i2c_bus_cmd(bus->regs[reg_cmd], cmd_flags, count,
443                              bus->regs[reg_intr_sts]);
444 }
445 
446 /*
447  * The state machine needs some refinement. It is only used to track
448  * invalid STOP commands for the moment.
449  */
450 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
451 {
452     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
453     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
454     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
455 
456     if (!aspeed_i2c_check_sram(bus)) {
457         return;
458     }
459 
460     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
461         aspeed_i2c_bus_cmd_dump(bus);
462     }
463 
464     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD)) {
465         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
466             I2CD_MSTARTR : I2CD_MSTART;
467         uint8_t addr;
468 
469         aspeed_i2c_set_state(bus, state);
470 
471         addr = aspeed_i2c_get_addr(bus);
472         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
473                                extract32(addr, 0, 1))) {
474             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
475             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
476                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
477             }
478         } else {
479             /* START doesn't set TX_ACK in packet mode */
480             if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
481                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
482             }
483         }
484 
485         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_START_CMD, 0);
486 
487         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
488             if (bus->regs[reg_dma_len] == 0) {
489                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
490             }
491         } else if (!SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
492             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
493         }
494 
495         /* No slave found */
496         if (!i2c_bus_busy(bus->bus)) {
497             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
498                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
499                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
500             }
501             return;
502         }
503         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
504     }
505 
506     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD)) {
507         aspeed_i2c_set_state(bus, I2CD_MTXD);
508         if (aspeed_i2c_bus_send(bus)) {
509             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
510             i2c_end_transfer(bus->bus);
511         } else {
512             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
513         }
514         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
515         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
516     }
517 
518     if ((SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ||
519          SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) &&
520         !SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE)) {
521         aspeed_i2c_handle_rx_cmd(bus);
522     }
523 
524     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD)) {
525         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
526             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
527             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, ABNORMAL, 1);
528             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
529                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
530             }
531         } else {
532             aspeed_i2c_set_state(bus, I2CD_MSTOP);
533             i2c_end_transfer(bus->bus);
534             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
535         }
536         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
537         aspeed_i2c_set_state(bus, I2CD_IDLE);
538 
539         i2c_schedule_pending_master(bus->bus);
540     }
541 
542     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
543         ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
544     }
545 }
546 
547 static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
548                                      uint64_t value, unsigned size)
549 {
550     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
551     bool handle_rx;
552     bool w1t;
553 
554     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
555 
556     switch (offset) {
557     case A_I2CC_FUN_CTRL:
558         bus->regs[R_I2CC_FUN_CTRL] = value;
559         break;
560     case A_I2CC_AC_TIMING:
561         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
562         break;
563     case A_I2CC_MS_TXRX_BYTE_BUF:
564         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_BUF,
565                                 value);
566         break;
567     case A_I2CC_POOL_CTRL:
568         bus->regs[R_I2CC_POOL_CTRL] &= ~0xffffff;
569         bus->regs[R_I2CC_POOL_CTRL] |= (value & 0xffffff);
570         break;
571     case A_I2CM_INTR_CTRL:
572         bus->regs[R_I2CM_INTR_CTRL] = value & 0x0007f07f;
573         break;
574     case A_I2CM_INTR_STS:
575         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_INTR_STS, RX_DONE)
576                     && SHARED_FIELD_EX32(value, RX_DONE);
577 
578         /* In packet mode, clearing PKT_CMD_DONE clears other interrupts. */
579         if (aspeed_i2c_bus_pkt_mode_en(bus) &&
580            FIELD_EX32(value, I2CM_INTR_STS, PKT_CMD_DONE)) {
581             bus->regs[R_I2CM_INTR_STS] &= 0xf0001000;
582             if (!bus->regs[R_I2CM_INTR_STS]) {
583                 bus->controller->intr_status &= ~(1 << bus->id);
584                 qemu_irq_lower(aic->bus_get_irq(bus));
585             }
586             aspeed_i2c_bus_raise_slave_interrupt(bus);
587             break;
588         }
589         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
590         if (!bus->regs[R_I2CM_INTR_STS]) {
591             bus->controller->intr_status &= ~(1 << bus->id);
592             qemu_irq_lower(aic->bus_get_irq(bus));
593         }
594         if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
595                                                   M_RX_CMD) ||
596                           SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
597                                                   M_S_RX_CMD_LAST))) {
598             aspeed_i2c_handle_rx_cmd(bus);
599             aspeed_i2c_bus_raise_interrupt(bus);
600         }
601         break;
602     case A_I2CM_CMD:
603         if (!aspeed_i2c_bus_is_enabled(bus)) {
604             break;
605         }
606 
607         if (!aspeed_i2c_bus_is_master(bus)) {
608             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
609                           __func__);
610             break;
611         }
612 
613         if (!aic->has_dma &&
614             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
615              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
616             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
617             break;
618         }
619 
620         if (bus->regs[R_I2CM_INTR_STS] & 0xffff0000) {
621             qemu_log_mask(LOG_UNIMP, "%s: Packet mode is not implemented\n",
622                           __func__);
623             break;
624         }
625 
626         value &= 0xff0ffbfb;
627         if (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, W1_CTRL)) {
628             bus->regs[R_I2CM_CMD] |= value;
629         } else {
630             bus->regs[R_I2CM_CMD] = value;
631         }
632 
633         aspeed_i2c_bus_handle_cmd(bus, value);
634         aspeed_i2c_bus_raise_interrupt(bus);
635         break;
636     case A_I2CM_DMA_TX_ADDR:
637         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
638                                                    ADDR);
639         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR);
640         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
641                                                      TX_BUF_LEN) + 1;
642         break;
643     case A_I2CM_DMA_RX_ADDR:
644         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
645                                                    ADDR);
646         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR);
647         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
648                                                      RX_BUF_LEN) + 1;
649         break;
650     case A_I2CM_DMA_LEN:
651         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
652               FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
653         /* If none of the w1t bits are set, just write to the reg as normal. */
654         if (!w1t) {
655             bus->regs[R_I2CM_DMA_LEN] = value;
656             break;
657         }
658         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
659             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
660                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
661         }
662         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
663             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
664                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
665         }
666         break;
667     case A_I2CM_DMA_LEN_STS:
668         /* Writes clear to 0 */
669         bus->regs[R_I2CM_DMA_LEN_STS] = 0;
670         break;
671     case A_I2CC_DMA_ADDR:
672     case A_I2CC_DMA_LEN:
673         /* RO */
674         break;
675     case A_I2CS_DEV_ADDR:
676         bus->regs[R_I2CS_DEV_ADDR] = value;
677         break;
678     case A_I2CS_DMA_RX_ADDR:
679         bus->regs[R_I2CS_DMA_RX_ADDR] = value;
680         break;
681     case A_I2CS_DMA_LEN:
682         assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
683         if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
684             ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
685                              FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
686         } else {
687             bus->regs[R_I2CS_DMA_LEN] = value;
688         }
689         break;
690     case A_I2CS_CMD:
691         if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
692             bus->regs[R_I2CS_CMD] |= value;
693         } else {
694             bus->regs[R_I2CS_CMD] = value;
695         }
696         i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
697         break;
698     case A_I2CS_INTR_CTRL:
699         bus->regs[R_I2CS_INTR_CTRL] = value;
700         break;
701 
702     case A_I2CS_INTR_STS:
703         if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
704             if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
705                 FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
706                 bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
707             }
708         } else {
709             bus->regs[R_I2CS_INTR_STS] &= ~value;
710         }
711         if (!bus->regs[R_I2CS_INTR_STS]) {
712             bus->controller->intr_status &= ~(1 << bus->id);
713             qemu_irq_lower(aic->bus_get_irq(bus));
714         }
715         aspeed_i2c_bus_raise_interrupt(bus);
716         break;
717     case A_I2CS_DMA_LEN_STS:
718         bus->regs[R_I2CS_DMA_LEN_STS] = 0;
719         break;
720     case A_I2CS_DMA_TX_ADDR:
721         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
722                       __func__);
723         break;
724     default:
725         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
726                       __func__, offset);
727     }
728 }
729 
730 static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
731                                      uint64_t value, unsigned size)
732 {
733     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
734     bool handle_rx;
735 
736     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
737 
738     switch (offset) {
739     case A_I2CD_FUN_CTRL:
740         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
741             i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
742         }
743         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
744         break;
745     case A_I2CD_AC_TIMING1:
746         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
747         break;
748     case A_I2CD_AC_TIMING2:
749         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
750         break;
751     case A_I2CD_INTR_CTRL:
752         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
753         break;
754     case A_I2CD_INTR_STS:
755         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_INTR_STS, RX_DONE)
756                     && SHARED_FIELD_EX32(value, RX_DONE);
757         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
758         if (!bus->regs[R_I2CD_INTR_STS]) {
759             bus->controller->intr_status &= ~(1 << bus->id);
760             qemu_irq_lower(aic->bus_get_irq(bus));
761         }
762         if (handle_rx) {
763             if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
764                 SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
765                                         M_S_RX_CMD_LAST)) {
766                 aspeed_i2c_handle_rx_cmd(bus);
767                 aspeed_i2c_bus_raise_interrupt(bus);
768             } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
769                 i2c_ack(bus->bus);
770             }
771         }
772         break;
773     case A_I2CD_DEV_ADDR:
774         bus->regs[R_I2CD_DEV_ADDR] = value;
775         break;
776     case A_I2CD_POOL_CTRL:
777         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
778         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
779         break;
780 
781     case A_I2CD_BYTE_BUF:
782         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_BYTE_BUF, TX_BUF, value);
783         break;
784     case A_I2CD_CMD:
785         if (!aspeed_i2c_bus_is_enabled(bus)) {
786             break;
787         }
788 
789         if (!aspeed_i2c_bus_is_master(bus)) {
790             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
791                           __func__);
792             break;
793         }
794 
795         if (!aic->has_dma &&
796             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
797              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
798             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
799             break;
800         }
801 
802         bus->regs[R_I2CD_CMD] &= ~0xFFFF;
803         bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
804 
805         aspeed_i2c_bus_handle_cmd(bus, value);
806         aspeed_i2c_bus_raise_interrupt(bus);
807         break;
808     case A_I2CD_DMA_ADDR:
809         if (!aic->has_dma) {
810             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
811             break;
812         }
813 
814         bus->regs[R_I2CD_DMA_ADDR] = value & 0x3ffffffc;
815         break;
816 
817     case A_I2CD_DMA_LEN:
818         if (!aic->has_dma) {
819             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
820             break;
821         }
822 
823         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
824         if (!bus->regs[R_I2CD_DMA_LEN]) {
825             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
826         }
827         break;
828 
829     default:
830         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
831                       __func__, offset);
832     }
833 }
834 
835 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
836                                      uint64_t value, unsigned size)
837 {
838     AspeedI2CBus *bus = opaque;
839     if (aspeed_i2c_is_new_mode(bus->controller)) {
840         aspeed_i2c_bus_new_write(bus, offset, value, size);
841     } else {
842         aspeed_i2c_bus_old_write(bus, offset, value, size);
843     }
844 }
845 
846 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
847                                    unsigned size)
848 {
849     AspeedI2CState *s = opaque;
850 
851     switch (offset) {
852     case A_I2C_CTRL_STATUS:
853         return s->intr_status;
854     case A_I2C_CTRL_GLOBAL:
855         return s->ctrl_global;
856     case A_I2C_CTRL_NEW_CLK_DIVIDER:
857         if (aspeed_i2c_is_new_mode(s)) {
858             return s->new_clk_divider;
859         }
860         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
861                       __func__, offset);
862         break;
863     default:
864         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
865                       __func__, offset);
866         break;
867     }
868 
869     return -1;
870 }
871 
872 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
873                                   uint64_t value, unsigned size)
874 {
875     AspeedI2CState *s = opaque;
876 
877     switch (offset) {
878     case A_I2C_CTRL_GLOBAL:
879         s->ctrl_global = value;
880         break;
881     case A_I2C_CTRL_NEW_CLK_DIVIDER:
882         if (aspeed_i2c_is_new_mode(s)) {
883             s->new_clk_divider = value;
884         } else {
885             qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx
886                           "\n", __func__, offset);
887         }
888         break;
889     case A_I2C_CTRL_STATUS:
890     default:
891         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
892                       __func__, offset);
893         break;
894     }
895 }
896 
897 static const MemoryRegionOps aspeed_i2c_bus_ops = {
898     .read = aspeed_i2c_bus_read,
899     .write = aspeed_i2c_bus_write,
900     .endianness = DEVICE_LITTLE_ENDIAN,
901 };
902 
903 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
904     .read = aspeed_i2c_ctrl_read,
905     .write = aspeed_i2c_ctrl_write,
906     .endianness = DEVICE_LITTLE_ENDIAN,
907 };
908 
909 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
910                                      unsigned size)
911 {
912     AspeedI2CState *s = opaque;
913     uint64_t ret = 0;
914     int i;
915 
916     for (i = 0; i < size; i++) {
917         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
918     }
919 
920     return ret;
921 }
922 
923 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
924                                   uint64_t value, unsigned size)
925 {
926     AspeedI2CState *s = opaque;
927     int i;
928 
929     for (i = 0; i < size; i++) {
930         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
931     }
932 }
933 
934 static const MemoryRegionOps aspeed_i2c_pool_ops = {
935     .read = aspeed_i2c_pool_read,
936     .write = aspeed_i2c_pool_write,
937     .endianness = DEVICE_LITTLE_ENDIAN,
938     .valid = {
939         .min_access_size = 1,
940         .max_access_size = 4,
941     },
942 };
943 
944 static const VMStateDescription aspeed_i2c_bus_vmstate = {
945     .name = TYPE_ASPEED_I2C,
946     .version_id = 5,
947     .minimum_version_id = 5,
948     .fields = (const VMStateField[]) {
949         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),
950         VMSTATE_END_OF_LIST()
951     }
952 };
953 
954 static const VMStateDescription aspeed_i2c_vmstate = {
955     .name = TYPE_ASPEED_I2C,
956     .version_id = 2,
957     .minimum_version_id = 2,
958     .fields = (const VMStateField[]) {
959         VMSTATE_UINT32(intr_status, AspeedI2CState),
960         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
961                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
962                              AspeedI2CBus),
963         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
964         VMSTATE_END_OF_LIST()
965     }
966 };
967 
968 static void aspeed_i2c_reset(DeviceState *dev)
969 {
970     AspeedI2CState *s = ASPEED_I2C(dev);
971 
972     s->intr_status = 0;
973 }
974 
975 static void aspeed_i2c_instance_init(Object *obj)
976 {
977     AspeedI2CState *s = ASPEED_I2C(obj);
978     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
979     int i;
980 
981     for (i = 0; i < aic->num_busses; i++) {
982         object_initialize_child(obj, "bus[*]", &s->busses[i],
983                                 TYPE_ASPEED_I2C_BUS);
984     }
985 }
986 
987 /*
988  * Address Definitions (AST2400 and AST2500)
989  *
990  *   0x000 ... 0x03F: Global Register
991  *   0x040 ... 0x07F: Device 1
992  *   0x080 ... 0x0BF: Device 2
993  *   0x0C0 ... 0x0FF: Device 3
994  *   0x100 ... 0x13F: Device 4
995  *   0x140 ... 0x17F: Device 5
996  *   0x180 ... 0x1BF: Device 6
997  *   0x1C0 ... 0x1FF: Device 7
998  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
999  *   0x300 ... 0x33F: Device 8
1000  *   0x340 ... 0x37F: Device 9
1001  *   0x380 ... 0x3BF: Device 10
1002  *   0x3C0 ... 0x3FF: Device 11
1003  *   0x400 ... 0x43F: Device 12
1004  *   0x440 ... 0x47F: Device 13
1005  *   0x480 ... 0x4BF: Device 14
1006  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
1007  */
1008 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
1009 {
1010     int i;
1011     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1012     AspeedI2CState *s = ASPEED_I2C(dev);
1013     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1014 
1015     sysbus_init_irq(sbd, &s->irq);
1016     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
1017                           "aspeed.i2c", 0x1000);
1018     sysbus_init_mmio(sbd, &s->iomem);
1019 
1020     for (i = 0; i < aic->num_busses; i++) {
1021         Object *bus = OBJECT(&s->busses[i]);
1022         int offset = i < aic->gap ? 1 : 5;
1023 
1024         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
1025             return;
1026         }
1027 
1028         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
1029             return;
1030         }
1031 
1032         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
1033             return;
1034         }
1035 
1036         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
1037                                     &s->busses[i].mr);
1038     }
1039 
1040     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
1041                           "aspeed.i2c-pool", aic->pool_size);
1042     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
1043 
1044     if (aic->has_dma) {
1045         if (!s->dram_mr) {
1046             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
1047             return;
1048         }
1049 
1050         address_space_init(&s->dram_as, s->dram_mr,
1051                            TYPE_ASPEED_I2C "-dma-dram");
1052     }
1053 }
1054 
1055 static Property aspeed_i2c_properties[] = {
1056     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
1057                      TYPE_MEMORY_REGION, MemoryRegion *),
1058     DEFINE_PROP_END_OF_LIST(),
1059 };
1060 
1061 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
1062 {
1063     DeviceClass *dc = DEVICE_CLASS(klass);
1064 
1065     dc->vmsd = &aspeed_i2c_vmstate;
1066     dc->reset = aspeed_i2c_reset;
1067     device_class_set_props(dc, aspeed_i2c_properties);
1068     dc->realize = aspeed_i2c_realize;
1069     dc->desc = "Aspeed I2C Controller";
1070 }
1071 
1072 static const TypeInfo aspeed_i2c_info = {
1073     .name          = TYPE_ASPEED_I2C,
1074     .parent        = TYPE_SYS_BUS_DEVICE,
1075     .instance_init = aspeed_i2c_instance_init,
1076     .instance_size = sizeof(AspeedI2CState),
1077     .class_init    = aspeed_i2c_class_init,
1078     .class_size = sizeof(AspeedI2CClass),
1079     .abstract   = true,
1080 };
1081 
1082 static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
1083                                           enum i2c_event event)
1084 {
1085     switch (event) {
1086     case I2C_START_SEND_ASYNC:
1087         if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
1088             qemu_log_mask(LOG_GUEST_ERROR,
1089                           "%s: Slave mode RX DMA is not enabled\n", __func__);
1090             return -1;
1091         }
1092         ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
1093         bus->regs[R_I2CC_DMA_ADDR] =
1094             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
1095         bus->regs[R_I2CC_DMA_LEN] =
1096             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
1097         i2c_ack(bus->bus);
1098         break;
1099     case I2C_FINISH:
1100         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
1101         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1102         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
1103         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
1104         aspeed_i2c_bus_raise_slave_interrupt(bus);
1105         break;
1106     default:
1107         qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
1108                       __func__, event);
1109         return -1;
1110     }
1111 
1112     return 0;
1113 }
1114 
1115 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
1116 {
1117     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1118     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1119     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1120     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1121     uint32_t reg_dev_addr = aspeed_i2c_bus_dev_addr_offset(bus);
1122     uint32_t dev_addr = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_dev_addr,
1123                                                 SLAVE_DEV_ADDR1);
1124 
1125     if (aspeed_i2c_is_new_mode(bus->controller)) {
1126         return aspeed_i2c_bus_new_slave_event(bus, event);
1127     }
1128 
1129     switch (event) {
1130     case I2C_START_SEND_ASYNC:
1131         /* Bit[0] == 0 indicates "send". */
1132         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, dev_addr << 1);
1133 
1134         ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1135         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1136 
1137         aspeed_i2c_set_state(bus, I2CD_STXD);
1138 
1139         break;
1140 
1141     case I2C_FINISH:
1142         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
1143 
1144         aspeed_i2c_set_state(bus, I2CD_IDLE);
1145 
1146         break;
1147 
1148     default:
1149         return -1;
1150     }
1151 
1152     aspeed_i2c_bus_raise_interrupt(bus);
1153 
1154     return 0;
1155 }
1156 
1157 static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
1158 {
1159     assert(address_space_write(&bus->controller->dram_as,
1160                                bus->regs[R_I2CC_DMA_ADDR],
1161                                MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
1162 
1163     bus->regs[R_I2CC_DMA_ADDR]++;
1164     bus->regs[R_I2CC_DMA_LEN]--;
1165     ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
1166                      ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
1167     i2c_ack(bus->bus);
1168 }
1169 
1170 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
1171 {
1172     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1173     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1174     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1175     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1176 
1177     if (aspeed_i2c_is_new_mode(bus->controller)) {
1178         return aspeed_i2c_bus_new_slave_send_async(bus, data);
1179     }
1180 
1181     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
1182     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1183 
1184     aspeed_i2c_bus_raise_interrupt(bus);
1185 }
1186 
1187 static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
1188 {
1189     DeviceClass *dc = DEVICE_CLASS(klass);
1190     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
1191 
1192     dc->desc = "Aspeed I2C Bus Slave";
1193 
1194     sc->event = aspeed_i2c_bus_slave_event;
1195     sc->send_async = aspeed_i2c_bus_slave_send_async;
1196 }
1197 
1198 static const TypeInfo aspeed_i2c_bus_slave_info = {
1199     .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
1200     .parent         = TYPE_I2C_SLAVE,
1201     .instance_size  = sizeof(AspeedI2CBusSlave),
1202     .class_init     = aspeed_i2c_bus_slave_class_init,
1203 };
1204 
1205 static void aspeed_i2c_bus_reset(DeviceState *dev)
1206 {
1207     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1208 
1209     memset(s->regs, 0, sizeof(s->regs));
1210     i2c_end_transfer(s->bus);
1211 }
1212 
1213 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
1214 {
1215     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1216     AspeedI2CClass *aic;
1217     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
1218 
1219     if (!s->controller) {
1220         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
1221         return;
1222     }
1223 
1224     aic = ASPEED_I2C_GET_CLASS(s->controller);
1225 
1226     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
1227 
1228     s->bus = i2c_init_bus(dev, name);
1229     s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
1230                                        0xff);
1231 
1232     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
1233                           s, name, aic->reg_size);
1234     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
1235 }
1236 
1237 static Property aspeed_i2c_bus_properties[] = {
1238     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
1239     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
1240                      AspeedI2CState *),
1241     DEFINE_PROP_END_OF_LIST(),
1242 };
1243 
1244 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
1245 {
1246     DeviceClass *dc = DEVICE_CLASS(klass);
1247 
1248     dc->desc = "Aspeed I2C Bus";
1249     dc->realize = aspeed_i2c_bus_realize;
1250     dc->reset = aspeed_i2c_bus_reset;
1251     device_class_set_props(dc, aspeed_i2c_bus_properties);
1252 }
1253 
1254 static const TypeInfo aspeed_i2c_bus_info = {
1255     .name           = TYPE_ASPEED_I2C_BUS,
1256     .parent         = TYPE_SYS_BUS_DEVICE,
1257     .instance_size  = sizeof(AspeedI2CBus),
1258     .class_init     = aspeed_i2c_bus_class_init,
1259 };
1260 
1261 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
1262 {
1263     return bus->controller->irq;
1264 }
1265 
1266 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
1267 {
1268     uint8_t *pool_page =
1269         &bus->controller->pool[ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL,
1270                                                 POOL_PAGE_SEL) * 0x100];
1271 
1272     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
1273 }
1274 
1275 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
1276 {
1277     DeviceClass *dc = DEVICE_CLASS(klass);
1278     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1279 
1280     dc->desc = "ASPEED 2400 I2C Controller";
1281 
1282     aic->num_busses = 14;
1283     aic->reg_size = 0x40;
1284     aic->gap = 7;
1285     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
1286     aic->pool_size = 0x800;
1287     aic->pool_base = 0x800;
1288     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
1289 }
1290 
1291 static const TypeInfo aspeed_2400_i2c_info = {
1292     .name = TYPE_ASPEED_2400_I2C,
1293     .parent = TYPE_ASPEED_I2C,
1294     .class_init = aspeed_2400_i2c_class_init,
1295 };
1296 
1297 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
1298 {
1299     return bus->controller->irq;
1300 }
1301 
1302 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
1303 {
1304     return &bus->controller->pool[bus->id * 0x10];
1305 }
1306 
1307 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
1308 {
1309     DeviceClass *dc = DEVICE_CLASS(klass);
1310     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1311 
1312     dc->desc = "ASPEED 2500 I2C Controller";
1313 
1314     aic->num_busses = 14;
1315     aic->reg_size = 0x40;
1316     aic->gap = 7;
1317     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
1318     aic->pool_size = 0x100;
1319     aic->pool_base = 0x200;
1320     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1321     aic->check_sram = true;
1322     aic->has_dma = true;
1323 }
1324 
1325 static const TypeInfo aspeed_2500_i2c_info = {
1326     .name = TYPE_ASPEED_2500_I2C,
1327     .parent = TYPE_ASPEED_I2C,
1328     .class_init = aspeed_2500_i2c_class_init,
1329 };
1330 
1331 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
1332 {
1333     return bus->irq;
1334 }
1335 
1336 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
1337 {
1338    return &bus->controller->pool[bus->id * 0x20];
1339 }
1340 
1341 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
1342 {
1343     DeviceClass *dc = DEVICE_CLASS(klass);
1344     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1345 
1346     dc->desc = "ASPEED 2600 I2C Controller";
1347 
1348     aic->num_busses = 16;
1349     aic->reg_size = 0x80;
1350     aic->gap = -1; /* no gap */
1351     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1352     aic->pool_size = 0x200;
1353     aic->pool_base = 0xC00;
1354     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1355     aic->has_dma = true;
1356 }
1357 
1358 static const TypeInfo aspeed_2600_i2c_info = {
1359     .name = TYPE_ASPEED_2600_I2C,
1360     .parent = TYPE_ASPEED_I2C,
1361     .class_init = aspeed_2600_i2c_class_init,
1362 };
1363 
1364 static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
1365 {
1366     DeviceClass *dc = DEVICE_CLASS(klass);
1367     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1368 
1369     dc->desc = "ASPEED 1030 I2C Controller";
1370 
1371     aic->num_busses = 14;
1372     aic->reg_size = 0x80;
1373     aic->gap = -1; /* no gap */
1374     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1375     aic->pool_size = 0x200;
1376     aic->pool_base = 0xC00;
1377     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1378     aic->has_dma = true;
1379 }
1380 
1381 static const TypeInfo aspeed_1030_i2c_info = {
1382     .name = TYPE_ASPEED_1030_I2C,
1383     .parent = TYPE_ASPEED_I2C,
1384     .class_init = aspeed_1030_i2c_class_init,
1385 };
1386 
1387 static void aspeed_i2c_register_types(void)
1388 {
1389     type_register_static(&aspeed_i2c_bus_info);
1390     type_register_static(&aspeed_i2c_bus_slave_info);
1391     type_register_static(&aspeed_i2c_info);
1392     type_register_static(&aspeed_2400_i2c_info);
1393     type_register_static(&aspeed_2500_i2c_info);
1394     type_register_static(&aspeed_2600_i2c_info);
1395     type_register_static(&aspeed_1030_i2c_info);
1396 }
1397 
1398 type_init(aspeed_i2c_register_types)
1399 
1400 
1401 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1402 {
1403     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1404     I2CBus *bus = NULL;
1405 
1406     if (busnr >= 0 && busnr < aic->num_busses) {
1407         bus = s->busses[busnr].bus;
1408     }
1409 
1410     return bus;
1411 }
1412