hw/i2c/aspeed_i2c.c

   1 /*
   2  * ARM Aspeed I2C controller
   3  *
   4  * Copyright (C) 2016 IBM Corp.
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "hw/sysbus.h"
  23 #include "migration/vmstate.h"
  24 #include "qemu/cutils.h"
  25 #include "qemu/log.h"
  26 #include "qemu/module.h"
  27 #include "qemu/error-report.h"
  28 #include "qapi/error.h"
  29 #include "hw/i2c/aspeed_i2c.h"
  30 #include "hw/irq.h"
  31 #include "hw/qdev-properties.h"
  32 #include "hw/registerfields.h"
  33 #include "trace.h"
  34
  35 /* Enable SLAVE_ADDR_RX_MATCH always */
  36 #define R_I2CD_INTR_STS_ALWAYS_ENABLE  R_I2CD_INTR_STS_SLAVE_ADDR_RX_MATCH_MASK
  37
  38 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
  39 {
  40     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
  41     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
  42     uint32_t intr_ctrl_reg = aspeed_i2c_bus_intr_ctrl_offset(bus);
  43     uint32_t intr_ctrl_mask = bus->regs[intr_ctrl_reg] |
  44         R_I2CD_INTR_STS_ALWAYS_ENABLE;
  45     bool raise_irq;
  46
  47     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_RAISE_INTERRUPT)) {
  48         g_autofree char *buf = g_strdup_printf("%s%s%s%s%s%s%s",
  49                aspeed_i2c_bus_pkt_mode_en(bus) &&
  50                ARRAY_FIELD_EX32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE) ?
  51                                                "pktdone|" : "",
  52                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_NAK) ?
  53                                                "nak|" : "",
  54                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, TX_ACK) ?
  55                                                "ack|" : "",
  56                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE) ?
  57                                                "done|" : "",
  58                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
  59                                                "slave-match|" : "",
  60                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
  61                                                "stop|" : "",
  62                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
  63                                                "abnormal"  : "");
  64
  65            trace_aspeed_i2c_bus_raise_interrupt(bus->regs[reg_intr_sts], buf);
  66     }
  67
  68     raise_irq = bus->regs[reg_intr_sts] & intr_ctrl_mask ;
  69
  70     /* In packet mode we don't mask off INTR_STS */
  71     if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
  72         bus->regs[reg_intr_sts] &= intr_ctrl_mask;
  73     }
  74
  75     if (raise_irq) {
  76         bus->controller->intr_status |= 1 << bus->id;
  77         qemu_irq_raise(aic->bus_get_irq(bus));
  78     }
  79 }
  80
  81 static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
  82 {
  83     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
  84
  85     if (!bus->regs[R_I2CS_INTR_STS]) {
  86         return;
  87     }
  88
  89     bus->controller->intr_status |= 1 << bus->id;
  90     qemu_irq_raise(aic->bus_get_irq(bus));
  91 }
  92
  93 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
  94                                         unsigned size)
  95 {
  96     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
  97     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
  98
  99     switch (offset) {
 100     case A_I2CD_FUN_CTRL:
 101     case A_I2CD_AC_TIMING1:
 102     case A_I2CD_AC_TIMING2:
 103     case A_I2CD_INTR_CTRL:
 104     case A_I2CD_INTR_STS:
 105     case A_I2CD_DEV_ADDR:
 106     case A_I2CD_POOL_CTRL:
 107     case A_I2CD_BYTE_BUF:
 108         /* Value is already set, don't do anything. */
 109         break;
 110     case A_I2CD_CMD:
 111         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
 112         break;
 113     case A_I2CD_DMA_ADDR:
 114         if (!aic->has_dma) {
 115             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 116             value = -1;
 117         }
 118         break;
 119     case A_I2CD_DMA_LEN:
 120         if (!aic->has_dma) {
 121             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 122             value = -1;
 123         }
 124         break;
 125
 126     default:
 127         qemu_log_mask(LOG_GUEST_ERROR,
 128                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
 129         value = -1;
 130         break;
 131     }
 132
 133     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
 134     return value;
 135 }
 136
 137 static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
 138                                         unsigned size)
 139 {
 140     uint64_t value = bus->regs[offset / sizeof(*bus->regs)];
 141
 142     switch (offset) {
 143     case A_I2CC_FUN_CTRL:
 144     case A_I2CC_AC_TIMING:
 145     case A_I2CC_POOL_CTRL:
 146     case A_I2CM_INTR_CTRL:
 147     case A_I2CM_INTR_STS:
 148     case A_I2CC_MS_TXRX_BYTE_BUF:
 149     case A_I2CM_DMA_LEN:
 150     case A_I2CM_DMA_TX_ADDR:
 151     case A_I2CM_DMA_RX_ADDR:
 152     case A_I2CM_DMA_LEN_STS:
 153     case A_I2CC_DMA_ADDR:
 154     case A_I2CC_DMA_LEN:
 155
 156     case A_I2CS_DEV_ADDR:
 157     case A_I2CS_DMA_RX_ADDR:
 158     case A_I2CS_DMA_LEN:
 159     case A_I2CS_CMD:
 160     case A_I2CS_INTR_CTRL:
 161     case A_I2CS_DMA_LEN_STS:
 162         /* Value is already set, don't do anything. */
 163         break;
 164     case A_I2CS_INTR_STS:
 165         break;
 166     case A_I2CM_CMD:
 167         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
 168         break;
 169     default:
 170         qemu_log_mask(LOG_GUEST_ERROR,
 171                       "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
 172         value = -1;
 173         break;
 174     }
 175
 176     trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
 177     return value;
 178 }
 179
 180 static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
 181                                     unsigned size)
 182 {
 183     AspeedI2CBus *bus = opaque;
 184     if (aspeed_i2c_is_new_mode(bus->controller)) {
 185         return aspeed_i2c_bus_new_read(bus, offset, size);
 186     }
 187     return aspeed_i2c_bus_old_read(bus, offset, size);
 188 }
 189
 190 static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
 191 {
 192     if (aspeed_i2c_is_new_mode(bus->controller)) {
 193         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_STATE,
 194                                 state);
 195     } else {
 196         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_CMD, TX_STATE, state);
 197     }
 198 }
 199
 200 static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
 201 {
 202     if (aspeed_i2c_is_new_mode(bus->controller)) {
 203         return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF,
 204                                        TX_STATE);
 205     }
 206     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
 207 }
 208
 209 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
 210 {
 211     MemTxResult result;
 212     AspeedI2CState *s = bus->controller;
 213     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
 214     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
 215
 216     result = address_space_read(&s->dram_as, bus->regs[reg_dma_addr],
 217                                 MEMTXATTRS_UNSPECIFIED, data, 1);
 218     if (result != MEMTX_OK) {
 219         qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
 220                       __func__, bus->regs[reg_dma_addr]);
 221         return -1;
 222     }
 223
 224     bus->regs[reg_dma_addr]++;
 225     bus->regs[reg_dma_len]--;
 226     return 0;
 227 }
 228
 229 static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
 230 {
 231     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
 232     int ret = -1;
 233     int i;
 234     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 235     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
 236     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
 237     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
 238     int pool_tx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
 239                                                 TX_COUNT) + 1;
 240
 241     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
 242         for (i = 0; i < pool_tx_count; i++) {
 243             uint8_t *pool_base = aic->bus_pool_base(bus);
 244
 245             trace_aspeed_i2c_bus_send("BUF", i + 1, pool_tx_count,
 246                                       pool_base[i]);
 247             ret = i2c_send(bus->bus, pool_base[i]);
 248             if (ret) {
 249                 break;
 250             }
 251         }
 252         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_BUFF_EN, 0);
 253     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
 254         /* In new mode, clear how many bytes we TXed */
 255         if (aspeed_i2c_is_new_mode(bus->controller)) {
 256             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
 257         }
 258         while (bus->regs[reg_dma_len]) {
 259             uint8_t data;
 260             aspeed_i2c_dma_read(bus, &data);
 261             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
 262                                       bus->regs[reg_dma_len], data);
 263             ret = i2c_send(bus->bus, data);
 264             if (ret) {
 265                 break;
 266             }
 267             /* In new mode, keep track of how many bytes we TXed */
 268             if (aspeed_i2c_is_new_mode(bus->controller)) {
 269                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN,
 270                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
 271                                                   TX_LEN) + 1);
 272             }
 273         }
 274         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, TX_DMA_EN, 0);
 275     } else {
 276         trace_aspeed_i2c_bus_send("BYTE", 0, 1,
 277                                   bus->regs[reg_byte_buf]);
 278         ret = i2c_send(bus->bus, bus->regs[reg_byte_buf]);
 279     }
 280
 281     return ret;
 282 }
 283
 284 static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
 285 {
 286     AspeedI2CState *s = bus->controller;
 287     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
 288     uint8_t data;
 289     int i;
 290     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 291     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
 292     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
 293     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
 294     uint32_t reg_dma_addr = aspeed_i2c_bus_dma_addr_offset(bus);
 295     int pool_rx_count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl,
 296                                                 RX_SIZE) + 1;
 297
 298     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
 299         uint8_t *pool_base = aic->bus_pool_base(bus);
 300
 301         for (i = 0; i < pool_rx_count; i++) {
 302             pool_base[i] = i2c_recv(bus->bus);
 303             trace_aspeed_i2c_bus_recv("BUF", i + 1, pool_rx_count,
 304                                       pool_base[i]);
 305         }
 306
 307         /* Update RX count */
 308         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_pool_ctrl, RX_COUNT, i & 0xff);
 309         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_BUFF_EN, 0);
 310     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
 311         uint8_t data;
 312         /* In new mode, clear how many bytes we RXed */
 313         if (aspeed_i2c_is_new_mode(bus->controller)) {
 314             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
 315         }
 316
 317         while (bus->regs[reg_dma_len]) {
 318             MemTxResult result;
 319
 320             data = i2c_recv(bus->bus);
 321             trace_aspeed_i2c_bus_recv("DMA", bus->regs[reg_dma_len],
 322                                       bus->regs[reg_dma_len], data);
 323             result = address_space_write(&s->dram_as, bus->regs[reg_dma_addr],
 324                                          MEMTXATTRS_UNSPECIFIED, &data, 1);
 325             if (result != MEMTX_OK) {
 326                 qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
 327                               __func__, bus->regs[reg_dma_addr]);
 328                 return;
 329             }
 330             bus->regs[reg_dma_addr]++;
 331             bus->regs[reg_dma_len]--;
 332             /* In new mode, keep track of how many bytes we RXed */
 333             if (aspeed_i2c_is_new_mode(bus->controller)) {
 334                 ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN,
 335                                  ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN_STS,
 336                                                   RX_LEN) + 1);
 337             }
 338         }
 339         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, RX_DMA_EN, 0);
 340     } else {
 341         data = i2c_recv(bus->bus);
 342         trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->regs[reg_byte_buf]);
 343         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
 344     }
 345 }
 346
 347 static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
 348 {
 349     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 350     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
 351
 352     aspeed_i2c_set_state(bus, I2CD_MRXD);
 353     aspeed_i2c_bus_recv(bus);
 354     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
 355     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) {
 356         i2c_nack(bus->bus);
 357     }
 358     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_RX_CMD, 0);
 359     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_S_RX_CMD_LAST, 0);
 360     aspeed_i2c_set_state(bus, I2CD_MACTIVE);
 361 }
 362
 363 static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
 364 {
 365     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
 366     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
 367     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 368
 369     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
 370         return (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, PKT_DEV_ADDR) << 1) |
 371                 SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD);
 372     }
 373     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
 374         uint8_t *pool_base = aic->bus_pool_base(bus);
 375
 376         return pool_base[0];
 377     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
 378         uint8_t data;
 379
 380         aspeed_i2c_dma_read(bus, &data);
 381         return data;
 382     } else {
 383         return bus->regs[reg_byte_buf];
 384     }
 385 }
 386
 387 static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
 388 {
 389     AspeedI2CState *s = bus->controller;
 390     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
 391     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 392     bool dma_en = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)  ||
 393                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)  ||
 394                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ||
 395                   SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN);
 396     if (!aic->check_sram) {
 397         return true;
 398     }
 399
 400     /*
 401      * AST2500: SRAM must be enabled before using the Buffer Pool or
 402      * DMA mode.
 403      */
 404     if (!FIELD_EX32(s->ctrl_global, I2C_CTRL_GLOBAL, SRAM_EN) && dma_en) {
 405         qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
 406         return false;
 407     }
 408
 409     return true;
 410 }
 411
 412 static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
 413 {
 414     g_autofree char *cmd_flags = NULL;
 415     uint32_t count;
 416     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 417     uint32_t reg_pool_ctrl = aspeed_i2c_bus_pool_ctrl_offset(bus);
 418     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
 419     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
 420     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN)) {
 421         count = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_pool_ctrl, TX_COUNT) + 1;
 422     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN)) {
 423         count = bus->regs[reg_dma_len];
 424     } else { /* BYTE mode */
 425         count = 1;
 426     }
 427
 428     cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
 429     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD) ? "start|" : "",
 430     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_DMA_EN) ? "rxdma|" : "",
 431     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN) ? "txdma|" : "",
 432     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, RX_BUFF_EN) ? "rxbuf|" : "",
 433     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN) ? "txbuf|" : "",
 434     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD) ? "tx|" : "",
 435     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ? "rx|" : "",
 436     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST) ? "last|" : "",
 437     SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD) ? "stop|" : "");
 438
 439     trace_aspeed_i2c_bus_cmd(bus->regs[reg_cmd], cmd_flags, count,
 440                              bus->regs[reg_intr_sts]);
 441 }
 442
 443 /*
 444  * The state machine needs some refinement. It is only used to track
 445  * invalid STOP commands for the moment.
 446  */
 447 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 448 {
 449     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
 450     uint32_t reg_cmd = aspeed_i2c_bus_cmd_offset(bus);
 451     uint32_t reg_dma_len = aspeed_i2c_bus_dma_len_offset(bus);
 452
 453     if (!aspeed_i2c_check_sram(bus)) {
 454         return;
 455     }
 456
 457     if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
 458         aspeed_i2c_bus_cmd_dump(bus);
 459     }
 460
 461     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_START_CMD)) {
 462         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
 463             I2CD_MSTARTR : I2CD_MSTART;
 464         uint8_t addr;
 465
 466         aspeed_i2c_set_state(bus, state);
 467
 468         addr = aspeed_i2c_get_addr(bus);
 469         if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
 470                                extract32(addr, 0, 1))) {
 471             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
 472             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
 473                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
 474             }
 475         } else {
 476             /* START doesn't set TX_ACK in packet mode */
 477             if (!aspeed_i2c_bus_pkt_mode_en(bus)) {
 478                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
 479             }
 480         }
 481
 482         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_START_CMD, 0);
 483
 484         if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
 485             if (bus->regs[reg_dma_len] == 0) {
 486                 SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
 487             }
 488         } else if (!SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_BUFF_EN)) {
 489             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
 490         }
 491
 492         /* No slave found */
 493         if (!i2c_bus_busy(bus->bus)) {
 494             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
 495                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
 496                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
 497             }
 498             return;
 499         }
 500         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
 501     }
 502
 503     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_TX_CMD)) {
 504         aspeed_i2c_set_state(bus, I2CD_MTXD);
 505         if (aspeed_i2c_bus_send(bus)) {
 506             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_NAK, 1);
 507             i2c_end_transfer(bus->bus);
 508         } else {
 509             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, TX_ACK, 1);
 510         }
 511         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_TX_CMD, 0);
 512         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
 513     }
 514
 515     if ((SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_RX_CMD) ||
 516          SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_S_RX_CMD_LAST)) &&
 517         !SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, RX_DONE)) {
 518         aspeed_i2c_handle_rx_cmd(bus);
 519     }
 520
 521     if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, M_STOP_CMD)) {
 522         if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
 523             qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
 524             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, ABNORMAL, 1);
 525             if (aspeed_i2c_bus_pkt_mode_en(bus)) {
 526                 ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_FAIL, 1);
 527             }
 528         } else {
 529             aspeed_i2c_set_state(bus, I2CD_MSTOP);
 530             i2c_end_transfer(bus->bus);
 531             SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
 532         }
 533         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
 534         aspeed_i2c_set_state(bus, I2CD_IDLE);
 535
 536         i2c_schedule_pending_master(bus->bus);
 537     }
 538
 539     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
 540         ARRAY_FIELD_DP32(bus->regs, I2CM_INTR_STS, PKT_CMD_DONE, 1);
 541     }
 542 }
 543
 544 static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
 545                                      uint64_t value, unsigned size)
 546 {
 547     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
 548     bool handle_rx;
 549     bool w1t;
 550
 551     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
 552
 553     switch (offset) {
 554     case A_I2CC_FUN_CTRL:
 555         bus->regs[R_I2CC_FUN_CTRL] = value;
 556         break;
 557     case A_I2CC_AC_TIMING:
 558         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
 559         break;
 560     case A_I2CC_MS_TXRX_BYTE_BUF:
 561         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CC_MS_TXRX_BYTE_BUF, TX_BUF,
 562                                 value);
 563         break;
 564     case A_I2CC_POOL_CTRL:
 565         bus->regs[R_I2CC_POOL_CTRL] &= ~0xffffff;
 566         bus->regs[R_I2CC_POOL_CTRL] |= (value & 0xffffff);
 567         break;
 568     case A_I2CM_INTR_CTRL:
 569         bus->regs[R_I2CM_INTR_CTRL] = value & 0x0007f07f;
 570         break;
 571     case A_I2CM_INTR_STS:
 572         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_INTR_STS, RX_DONE)
 573                     && SHARED_FIELD_EX32(value, RX_DONE);
 574
 575         /* In packet mode, clearing PKT_CMD_DONE clears other interrupts. */
 576         if (aspeed_i2c_bus_pkt_mode_en(bus) &&
 577            FIELD_EX32(value, I2CM_INTR_STS, PKT_CMD_DONE)) {
 578             bus->regs[R_I2CM_INTR_STS] &= 0xf0001000;
 579             if (!bus->regs[R_I2CM_INTR_STS]) {
 580                 bus->controller->intr_status &= ~(1 << bus->id);
 581                 qemu_irq_lower(aic->bus_get_irq(bus));
 582             }
 583             aspeed_i2c_bus_raise_slave_interrupt(bus);
 584             break;
 585         }
 586         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
 587         if (!bus->regs[R_I2CM_INTR_STS]) {
 588             bus->controller->intr_status &= ~(1 << bus->id);
 589             qemu_irq_lower(aic->bus_get_irq(bus));
 590         }
 591         if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
 592                                                   M_RX_CMD) ||
 593                           SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CM_CMD,
 594                                                   M_S_RX_CMD_LAST))) {
 595             aspeed_i2c_handle_rx_cmd(bus);
 596             aspeed_i2c_bus_raise_interrupt(bus);
 597         }
 598         break;
 599     case A_I2CM_CMD:
 600         if (!aspeed_i2c_bus_is_enabled(bus)) {
 601             break;
 602         }
 603
 604         if (!aspeed_i2c_bus_is_master(bus)) {
 605             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
 606                           __func__);
 607             break;
 608         }
 609
 610         if (!aic->has_dma &&
 611             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
 612              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
 613             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 614             break;
 615         }
 616
 617         if (bus->regs[R_I2CM_INTR_STS] & 0xffff0000) {
 618             qemu_log_mask(LOG_UNIMP, "%s: Packet mode is not implemented\n",
 619                           __func__);
 620             break;
 621         }
 622
 623         value &= 0xff0ffbfb;
 624         if (ARRAY_FIELD_EX32(bus->regs, I2CM_CMD, W1_CTRL)) {
 625             bus->regs[R_I2CM_CMD] |= value;
 626         } else {
 627             bus->regs[R_I2CM_CMD] = value;
 628         }
 629
 630         aspeed_i2c_bus_handle_cmd(bus, value);
 631         aspeed_i2c_bus_raise_interrupt(bus);
 632         break;
 633     case A_I2CM_DMA_TX_ADDR:
 634         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
 635                                                    ADDR);
 636         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR);
 637         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
 638                                                      TX_BUF_LEN) + 1;
 639         break;
 640     case A_I2CM_DMA_RX_ADDR:
 641         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
 642                                                    ADDR);
 643         bus->regs[R_I2CC_DMA_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR);
 644         bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
 645                                                      RX_BUF_LEN) + 1;
 646         break;
 647     case A_I2CM_DMA_LEN:
 648         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
 649               FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
 650         /* If none of the w1t bits are set, just write to the reg as normal. */
 651         if (!w1t) {
 652             bus->regs[R_I2CM_DMA_LEN] = value;
 653             break;
 654         }
 655         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
 656             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
 657                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
 658         }
 659         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
 660             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
 661                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
 662         }
 663         break;
 664     case A_I2CM_DMA_LEN_STS:
 665         /* Writes clear to 0 */
 666         bus->regs[R_I2CM_DMA_LEN_STS] = 0;
 667         break;
 668     case A_I2CC_DMA_ADDR:
 669     case A_I2CC_DMA_LEN:
 670         /* RO */
 671         break;
 672     case A_I2CS_DEV_ADDR:
 673         bus->regs[R_I2CS_DEV_ADDR] = value;
 674         break;
 675     case A_I2CS_DMA_RX_ADDR:
 676         bus->regs[R_I2CS_DMA_RX_ADDR] = value;
 677         break;
 678     case A_I2CS_DMA_LEN:
 679         assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
 680         if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
 681             ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
 682                              FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
 683         } else {
 684             bus->regs[R_I2CS_DMA_LEN] = value;
 685         }
 686         break;
 687     case A_I2CS_CMD:
 688         if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
 689             bus->regs[R_I2CS_CMD] |= value;
 690         } else {
 691             bus->regs[R_I2CS_CMD] = value;
 692         }
 693         i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
 694         break;
 695     case A_I2CS_INTR_CTRL:
 696         bus->regs[R_I2CS_INTR_CTRL] = value;
 697         break;
 698
 699     case A_I2CS_INTR_STS:
 700         if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
 701             if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
 702                 FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
 703                 bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
 704             }
 705         } else {
 706             bus->regs[R_I2CS_INTR_STS] &= ~value;
 707         }
 708         if (!bus->regs[R_I2CS_INTR_STS]) {
 709             bus->controller->intr_status &= ~(1 << bus->id);
 710             qemu_irq_lower(aic->bus_get_irq(bus));
 711         }
 712         aspeed_i2c_bus_raise_interrupt(bus);
 713         break;
 714     case A_I2CS_DMA_LEN_STS:
 715         bus->regs[R_I2CS_DMA_LEN_STS] = 0;
 716         break;
 717     case A_I2CS_DMA_TX_ADDR:
 718         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
 719                       __func__);
 720         break;
 721     default:
 722         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 723                       __func__, offset);
 724     }
 725 }
 726
 727 static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
 728                                      uint64_t value, unsigned size)
 729 {
 730     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
 731     bool handle_rx;
 732
 733     trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
 734
 735     switch (offset) {
 736     case A_I2CD_FUN_CTRL:
 737         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
 738             i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
 739         }
 740         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
 741         break;
 742     case A_I2CD_AC_TIMING1:
 743         bus->regs[R_I2CD_AC_TIMING1] = value & 0xFFFFF0F;
 744         break;
 745     case A_I2CD_AC_TIMING2:
 746         bus->regs[R_I2CD_AC_TIMING2] = value & 0x7;
 747         break;
 748     case A_I2CD_INTR_CTRL:
 749         bus->regs[R_I2CD_INTR_CTRL] = value & 0x7FFF;
 750         break;
 751     case A_I2CD_INTR_STS:
 752         handle_rx = SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_INTR_STS, RX_DONE)
 753                     && SHARED_FIELD_EX32(value, RX_DONE);
 754         bus->regs[R_I2CD_INTR_STS] &= ~(value & 0x7FFF);
 755         if (!bus->regs[R_I2CD_INTR_STS]) {
 756             bus->controller->intr_status &= ~(1 << bus->id);
 757             qemu_irq_lower(aic->bus_get_irq(bus));
 758         }
 759         if (handle_rx) {
 760             if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
 761                 SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
 762                                         M_S_RX_CMD_LAST)) {
 763                 aspeed_i2c_handle_rx_cmd(bus);
 764                 aspeed_i2c_bus_raise_interrupt(bus);
 765             } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
 766                 i2c_ack(bus->bus);
 767             }
 768         }
 769         break;
 770     case A_I2CD_DEV_ADDR:
 771         bus->regs[R_I2CD_DEV_ADDR] = value;
 772         break;
 773     case A_I2CD_POOL_CTRL:
 774         bus->regs[R_I2CD_POOL_CTRL] &= ~0xffffff;
 775         bus->regs[R_I2CD_POOL_CTRL] |= (value & 0xffffff);
 776         break;
 777
 778     case A_I2CD_BYTE_BUF:
 779         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CD_BYTE_BUF, TX_BUF, value);
 780         break;
 781     case A_I2CD_CMD:
 782         if (!aspeed_i2c_bus_is_enabled(bus)) {
 783             break;
 784         }
 785
 786         if (!aspeed_i2c_bus_is_master(bus)) {
 787             qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
 788                           __func__);
 789             break;
 790         }
 791
 792         if (!aic->has_dma &&
 793             (SHARED_FIELD_EX32(value, RX_DMA_EN) ||
 794              SHARED_FIELD_EX32(value, TX_DMA_EN))) {
 795             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 796             break;
 797         }
 798
 799         bus->regs[R_I2CD_CMD] &= ~0xFFFF;
 800         bus->regs[R_I2CD_CMD] |= value & 0xFFFF;
 801
 802         aspeed_i2c_bus_handle_cmd(bus, value);
 803         aspeed_i2c_bus_raise_interrupt(bus);
 804         break;
 805     case A_I2CD_DMA_ADDR:
 806         if (!aic->has_dma) {
 807             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 808             break;
 809         }
 810
 811         bus->regs[R_I2CD_DMA_ADDR] = value & 0x3ffffffc;
 812         break;
 813
 814     case A_I2CD_DMA_LEN:
 815         if (!aic->has_dma) {
 816             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
 817             break;
 818         }
 819
 820         bus->regs[R_I2CD_DMA_LEN] = value & 0xfff;
 821         if (!bus->regs[R_I2CD_DMA_LEN]) {
 822             qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
 823         }
 824         break;
 825
 826     default:
 827         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 828                       __func__, offset);
 829     }
 830 }
 831
 832 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
 833                                      uint64_t value, unsigned size)
 834 {
 835     AspeedI2CBus *bus = opaque;
 836     if (aspeed_i2c_is_new_mode(bus->controller)) {
 837         aspeed_i2c_bus_new_write(bus, offset, value, size);
 838     } else {
 839         aspeed_i2c_bus_old_write(bus, offset, value, size);
 840     }
 841 }
 842
 843 static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
 844                                    unsigned size)
 845 {
 846     AspeedI2CState *s = opaque;
 847
 848     switch (offset) {
 849     case A_I2C_CTRL_STATUS:
 850         return s->intr_status;
 851     case A_I2C_CTRL_GLOBAL:
 852         return s->ctrl_global;
 853     case A_I2C_CTRL_NEW_CLK_DIVIDER:
 854         if (aspeed_i2c_is_new_mode(s)) {
 855             return s->new_clk_divider;
 856         }
 857         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 858                       __func__, offset);
 859         break;
 860     default:
 861         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 862                       __func__, offset);
 863         break;
 864     }
 865
 866     return -1;
 867 }
 868
 869 static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
 870                                   uint64_t value, unsigned size)
 871 {
 872     AspeedI2CState *s = opaque;
 873
 874     switch (offset) {
 875     case A_I2C_CTRL_GLOBAL:
 876         s->ctrl_global = value;
 877         break;
 878     case A_I2C_CTRL_NEW_CLK_DIVIDER:
 879         if (aspeed_i2c_is_new_mode(s)) {
 880             s->new_clk_divider = value;
 881         } else {
 882             qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx
 883                           "\n", __func__, offset);
 884         }
 885         break;
 886     case A_I2C_CTRL_STATUS:
 887     default:
 888         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 889                       __func__, offset);
 890         break;
 891     }
 892 }
 893
 894 static const MemoryRegionOps aspeed_i2c_bus_ops = {
 895     .read = aspeed_i2c_bus_read,
 896     .write = aspeed_i2c_bus_write,
 897     .endianness = DEVICE_LITTLE_ENDIAN,
 898 };
 899
 900 static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
 901     .read = aspeed_i2c_ctrl_read,
 902     .write = aspeed_i2c_ctrl_write,
 903     .endianness = DEVICE_LITTLE_ENDIAN,
 904 };
 905
 906 static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
 907                                      unsigned size)
 908 {
 909     AspeedI2CState *s = opaque;
 910     uint64_t ret = 0;
 911     int i;
 912
 913     for (i = 0; i < size; i++) {
 914         ret |= (uint64_t) s->pool[offset + i] << (8 * i);
 915     }
 916
 917     return ret;
 918 }
 919
 920 static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
 921                                   uint64_t value, unsigned size)
 922 {
 923     AspeedI2CState *s = opaque;
 924     int i;
 925
 926     for (i = 0; i < size; i++) {
 927         s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
 928     }
 929 }
 930
 931 static const MemoryRegionOps aspeed_i2c_pool_ops = {
 932     .read = aspeed_i2c_pool_read,
 933     .write = aspeed_i2c_pool_write,
 934     .endianness = DEVICE_LITTLE_ENDIAN,
 935     .valid = {
 936         .min_access_size = 1,
 937         .max_access_size = 4,
 938     },
 939 };
 940
 941 static const VMStateDescription aspeed_i2c_bus_vmstate = {
 942     .name = TYPE_ASPEED_I2C,
 943     .version_id = 5,
 944     .minimum_version_id = 5,
 945     .fields = (VMStateField[]) {
 946         VMSTATE_UINT32_ARRAY(regs, AspeedI2CBus, ASPEED_I2C_NEW_NUM_REG),
 947         VMSTATE_END_OF_LIST()
 948     }
 949 };
 950
 951 static const VMStateDescription aspeed_i2c_vmstate = {
 952     .name = TYPE_ASPEED_I2C,
 953     .version_id = 2,
 954     .minimum_version_id = 2,
 955     .fields = (VMStateField[]) {
 956         VMSTATE_UINT32(intr_status, AspeedI2CState),
 957         VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
 958                              ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
 959                              AspeedI2CBus),
 960         VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
 961         VMSTATE_END_OF_LIST()
 962     }
 963 };
 964
 965 static void aspeed_i2c_reset(DeviceState *dev)
 966 {
 967     AspeedI2CState *s = ASPEED_I2C(dev);
 968
 969     s->intr_status = 0;
 970 }
 971
 972 static void aspeed_i2c_instance_init(Object *obj)
 973 {
 974     AspeedI2CState *s = ASPEED_I2C(obj);
 975     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
 976     int i;
 977
 978     for (i = 0; i < aic->num_busses; i++) {
 979         object_initialize_child(obj, "bus[*]", &s->busses[i],
 980                                 TYPE_ASPEED_I2C_BUS);
 981     }
 982 }
 983
 984 /*
 985  * Address Definitions (AST2400 and AST2500)
 986  *
 987  *   0x000 ... 0x03F: Global Register
 988  *   0x040 ... 0x07F: Device 1
 989  *   0x080 ... 0x0BF: Device 2
 990  *   0x0C0 ... 0x0FF: Device 3
 991  *   0x100 ... 0x13F: Device 4
 992  *   0x140 ... 0x17F: Device 5
 993  *   0x180 ... 0x1BF: Device 6
 994  *   0x1C0 ... 0x1FF: Device 7
 995  *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
 996  *   0x300 ... 0x33F: Device 8
 997  *   0x340 ... 0x37F: Device 9
 998  *   0x380 ... 0x3BF: Device 10
 999  *   0x3C0 ... 0x3FF: Device 11
1000  *   0x400 ... 0x43F: Device 12
1001  *   0x440 ... 0x47F: Device 13
1002  *   0x480 ... 0x4BF: Device 14
1003  *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
1004  */
1005 static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
1006 {
1007     int i;
1008     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1009     AspeedI2CState *s = ASPEED_I2C(dev);
1010     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1011
1012     sysbus_init_irq(sbd, &s->irq);
1013     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
1014                           "aspeed.i2c", 0x1000);
1015     sysbus_init_mmio(sbd, &s->iomem);
1016
1017     for (i = 0; i < aic->num_busses; i++) {
1018         Object *bus = OBJECT(&s->busses[i]);
1019         int offset = i < aic->gap ? 1 : 5;
1020
1021         if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
1022             return;
1023         }
1024
1025         if (!object_property_set_uint(bus, "bus-id", i, errp)) {
1026             return;
1027         }
1028
1029         if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
1030             return;
1031         }
1032
1033         memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
1034                                     &s->busses[i].mr);
1035     }
1036
1037     memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
1038                           "aspeed.i2c-pool", aic->pool_size);
1039     memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
1040
1041     if (aic->has_dma) {
1042         if (!s->dram_mr) {
1043             error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
1044             return;
1045         }
1046
1047         address_space_init(&s->dram_as, s->dram_mr,
1048                            TYPE_ASPEED_I2C "-dma-dram");
1049     }
1050 }
1051
1052 static Property aspeed_i2c_properties[] = {
1053     DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
1054                      TYPE_MEMORY_REGION, MemoryRegion *),
1055     DEFINE_PROP_END_OF_LIST(),
1056 };
1057
1058 static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
1059 {
1060     DeviceClass *dc = DEVICE_CLASS(klass);
1061
1062     dc->vmsd = &aspeed_i2c_vmstate;
1063     dc->reset = aspeed_i2c_reset;
1064     device_class_set_props(dc, aspeed_i2c_properties);
1065     dc->realize = aspeed_i2c_realize;
1066     dc->desc = "Aspeed I2C Controller";
1067 }
1068
1069 static const TypeInfo aspeed_i2c_info = {
1070     .name          = TYPE_ASPEED_I2C,
1071     .parent        = TYPE_SYS_BUS_DEVICE,
1072     .instance_init = aspeed_i2c_instance_init,
1073     .instance_size = sizeof(AspeedI2CState),
1074     .class_init    = aspeed_i2c_class_init,
1075     .class_size = sizeof(AspeedI2CClass),
1076     .abstract   = true,
1077 };
1078
1079 static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
1080                                           enum i2c_event event)
1081 {
1082     switch (event) {
1083     case I2C_START_SEND_ASYNC:
1084         if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
1085             qemu_log_mask(LOG_GUEST_ERROR,
1086                           "%s: Slave mode RX DMA is not enabled\n", __func__);
1087             return -1;
1088         }
1089         ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
1090         bus->regs[R_I2CC_DMA_ADDR] =
1091             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
1092         bus->regs[R_I2CC_DMA_LEN] =
1093             ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
1094         i2c_ack(bus->bus);
1095         break;
1096     case I2C_FINISH:
1097         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
1098         ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1099         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
1100         SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
1101         aspeed_i2c_bus_raise_slave_interrupt(bus);
1102         break;
1103     default:
1104         qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
1105                       __func__, event);
1106         return -1;
1107     }
1108
1109     return 0;
1110 }
1111
1112 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
1113 {
1114     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1115     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1116     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1117     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1118     uint32_t reg_dev_addr = aspeed_i2c_bus_dev_addr_offset(bus);
1119     uint32_t dev_addr = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_dev_addr,
1120                                                 SLAVE_DEV_ADDR1);
1121
1122     if (aspeed_i2c_is_new_mode(bus->controller)) {
1123         return aspeed_i2c_bus_new_slave_event(bus, event);
1124     }
1125
1126     switch (event) {
1127     case I2C_START_SEND_ASYNC:
1128         /* Bit[0] == 0 indicates "send". */
1129         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, dev_addr << 1);
1130
1131         ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
1132         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1133
1134         aspeed_i2c_set_state(bus, I2CD_STXD);
1135
1136         break;
1137
1138     case I2C_FINISH:
1139         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
1140
1141         aspeed_i2c_set_state(bus, I2CD_IDLE);
1142
1143         break;
1144
1145     default:
1146         return -1;
1147     }
1148
1149     aspeed_i2c_bus_raise_interrupt(bus);
1150
1151     return 0;
1152 }
1153
1154 static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
1155 {
1156     assert(address_space_write(&bus->controller->dram_as,
1157                                bus->regs[R_I2CC_DMA_ADDR],
1158                                MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
1159
1160     bus->regs[R_I2CC_DMA_ADDR]++;
1161     bus->regs[R_I2CC_DMA_LEN]--;
1162     ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
1163                      ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
1164     i2c_ack(bus->bus);
1165 }
1166
1167 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
1168 {
1169     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
1170     AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
1171     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
1172     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
1173
1174     if (aspeed_i2c_is_new_mode(bus->controller)) {
1175         return aspeed_i2c_bus_new_slave_send_async(bus, data);
1176     }
1177
1178     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
1179     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
1180
1181     aspeed_i2c_bus_raise_interrupt(bus);
1182 }
1183
1184 static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
1185 {
1186     DeviceClass *dc = DEVICE_CLASS(klass);
1187     I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
1188
1189     dc->desc = "Aspeed I2C Bus Slave";
1190
1191     sc->event = aspeed_i2c_bus_slave_event;
1192     sc->send_async = aspeed_i2c_bus_slave_send_async;
1193 }
1194
1195 static const TypeInfo aspeed_i2c_bus_slave_info = {
1196     .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
1197     .parent         = TYPE_I2C_SLAVE,
1198     .instance_size  = sizeof(AspeedI2CBusSlave),
1199     .class_init     = aspeed_i2c_bus_slave_class_init,
1200 };
1201
1202 static void aspeed_i2c_bus_reset(DeviceState *dev)
1203 {
1204     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1205
1206     memset(s->regs, 0, sizeof(s->regs));
1207     i2c_end_transfer(s->bus);
1208 }
1209
1210 static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
1211 {
1212     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
1213     AspeedI2CClass *aic;
1214     g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
1215
1216     if (!s->controller) {
1217         error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
1218         return;
1219     }
1220
1221     aic = ASPEED_I2C_GET_CLASS(s->controller);
1222
1223     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
1224
1225     s->bus = i2c_init_bus(dev, name);
1226     s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
1227                                        0xff);
1228
1229     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
1230                           s, name, aic->reg_size);
1231     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
1232 }
1233
1234 static Property aspeed_i2c_bus_properties[] = {
1235     DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
1236     DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
1237                      AspeedI2CState *),
1238     DEFINE_PROP_END_OF_LIST(),
1239 };
1240
1241 static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
1242 {
1243     DeviceClass *dc = DEVICE_CLASS(klass);
1244
1245     dc->desc = "Aspeed I2C Bus";
1246     dc->realize = aspeed_i2c_bus_realize;
1247     dc->reset = aspeed_i2c_bus_reset;
1248     device_class_set_props(dc, aspeed_i2c_bus_properties);
1249 }
1250
1251 static const TypeInfo aspeed_i2c_bus_info = {
1252     .name           = TYPE_ASPEED_I2C_BUS,
1253     .parent         = TYPE_SYS_BUS_DEVICE,
1254     .instance_size  = sizeof(AspeedI2CBus),
1255     .class_init     = aspeed_i2c_bus_class_init,
1256 };
1257
1258 static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
1259 {
1260     return bus->controller->irq;
1261 }
1262
1263 static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
1264 {
1265     uint8_t *pool_page =
1266         &bus->controller->pool[ARRAY_FIELD_EX32(bus->regs, I2CD_FUN_CTRL,
1267                                                 POOL_PAGE_SEL) * 0x100];
1268
1269     return &pool_page[ARRAY_FIELD_EX32(bus->regs, I2CD_POOL_CTRL, OFFSET)];
1270 }
1271
1272 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
1273 {
1274     DeviceClass *dc = DEVICE_CLASS(klass);
1275     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1276
1277     dc->desc = "ASPEED 2400 I2C Controller";
1278
1279     aic->num_busses = 14;
1280     aic->reg_size = 0x40;
1281     aic->gap = 7;
1282     aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
1283     aic->pool_size = 0x800;
1284     aic->pool_base = 0x800;
1285     aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
1286 }
1287
1288 static const TypeInfo aspeed_2400_i2c_info = {
1289     .name = TYPE_ASPEED_2400_I2C,
1290     .parent = TYPE_ASPEED_I2C,
1291     .class_init = aspeed_2400_i2c_class_init,
1292 };
1293
1294 static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
1295 {
1296     return bus->controller->irq;
1297 }
1298
1299 static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
1300 {
1301     return &bus->controller->pool[bus->id * 0x10];
1302 }
1303
1304 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
1305 {
1306     DeviceClass *dc = DEVICE_CLASS(klass);
1307     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1308
1309     dc->desc = "ASPEED 2500 I2C Controller";
1310
1311     aic->num_busses = 14;
1312     aic->reg_size = 0x40;
1313     aic->gap = 7;
1314     aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
1315     aic->pool_size = 0x100;
1316     aic->pool_base = 0x200;
1317     aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
1318     aic->check_sram = true;
1319     aic->has_dma = true;
1320 }
1321
1322 static const TypeInfo aspeed_2500_i2c_info = {
1323     .name = TYPE_ASPEED_2500_I2C,
1324     .parent = TYPE_ASPEED_I2C,
1325     .class_init = aspeed_2500_i2c_class_init,
1326 };
1327
1328 static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
1329 {
1330     return bus->irq;
1331 }
1332
1333 static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
1334 {
1335    return &bus->controller->pool[bus->id * 0x20];
1336 }
1337
1338 static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
1339 {
1340     DeviceClass *dc = DEVICE_CLASS(klass);
1341     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1342
1343     dc->desc = "ASPEED 2600 I2C Controller";
1344
1345     aic->num_busses = 16;
1346     aic->reg_size = 0x80;
1347     aic->gap = -1; /* no gap */
1348     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1349     aic->pool_size = 0x200;
1350     aic->pool_base = 0xC00;
1351     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1352     aic->has_dma = true;
1353 }
1354
1355 static const TypeInfo aspeed_2600_i2c_info = {
1356     .name = TYPE_ASPEED_2600_I2C,
1357     .parent = TYPE_ASPEED_I2C,
1358     .class_init = aspeed_2600_i2c_class_init,
1359 };
1360
1361 static void aspeed_1030_i2c_class_init(ObjectClass *klass, void *data)
1362 {
1363     DeviceClass *dc = DEVICE_CLASS(klass);
1364     AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
1365
1366     dc->desc = "ASPEED 1030 I2C Controller";
1367
1368     aic->num_busses = 14;
1369     aic->reg_size = 0x80;
1370     aic->gap = -1; /* no gap */
1371     aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
1372     aic->pool_size = 0x200;
1373     aic->pool_base = 0xC00;
1374     aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
1375     aic->has_dma = true;
1376 }
1377
1378 static const TypeInfo aspeed_1030_i2c_info = {
1379     .name = TYPE_ASPEED_1030_I2C,
1380     .parent = TYPE_ASPEED_I2C,
1381     .class_init = aspeed_1030_i2c_class_init,
1382 };
1383
1384 static void aspeed_i2c_register_types(void)
1385 {
1386     type_register_static(&aspeed_i2c_bus_info);
1387     type_register_static(&aspeed_i2c_bus_slave_info);
1388     type_register_static(&aspeed_i2c_info);
1389     type_register_static(&aspeed_2400_i2c_info);
1390     type_register_static(&aspeed_2500_i2c_info);
1391     type_register_static(&aspeed_2600_i2c_info);
1392     type_register_static(&aspeed_1030_i2c_info);
1393 }
1394
1395 type_init(aspeed_i2c_register_types)
1396
1397
1398 I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
1399 {
1400     AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
1401     I2CBus *bus = NULL;
1402
1403     if (busnr >= 0 && busnr < aic->num_busses) {
1404         bus = s->busses[busnr].bus;
1405     }
1406
1407     return bus;
1408 }