cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

aspeed_i2c.c (33284B)


      1/*
      2 * ARM Aspeed I2C controller
      3 *
      4 * Copyright (C) 2016 IBM Corp.
      5 *
      6 * This program is free software; you can redistribute it and/or
      7 * modify it under the terms of the GNU General Public License
      8 * as published by the Free Software Foundation; either version 2
      9 * of the License, or (at your option) any later version.
     10 *
     11 * This program is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     14 * GNU General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU General Public License
     17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
     18 *
     19 */
     20
     21#include "qemu/osdep.h"
     22#include "hw/sysbus.h"
     23#include "migration/vmstate.h"
     24#include "qemu/log.h"
     25#include "qemu/module.h"
     26#include "qemu/error-report.h"
     27#include "qapi/error.h"
     28#include "hw/i2c/aspeed_i2c.h"
     29#include "hw/irq.h"
     30#include "hw/qdev-properties.h"
     31#include "trace.h"
     32
     33/* I2C Global Register */
     34
     35#define I2C_CTRL_STATUS         0x00        /* Device Interrupt Status */
     36#define I2C_CTRL_ASSIGN         0x08        /* Device Interrupt Target
     37                                               Assignment */
     38#define I2C_CTRL_GLOBAL         0x0C        /* Global Control Register */
     39#define   I2C_CTRL_SRAM_EN                 BIT(0)
     40
     41/* I2C Device (Bus) Register */
     42
     43#define I2CD_FUN_CTRL_REG       0x00       /* I2CD Function Control  */
     44#define   I2CD_POOL_PAGE_SEL(x)            (((x) >> 20) & 0x7)  /* AST2400 */
     45#define   I2CD_M_SDA_LOCK_EN               (0x1 << 16)
     46#define   I2CD_MULTI_MASTER_DIS            (0x1 << 15)
     47#define   I2CD_M_SCL_DRIVE_EN              (0x1 << 14)
     48#define   I2CD_MSB_STS                     (0x1 << 9)
     49#define   I2CD_SDA_DRIVE_1T_EN             (0x1 << 8)
     50#define   I2CD_M_SDA_DRIVE_1T_EN           (0x1 << 7)
     51#define   I2CD_M_HIGH_SPEED_EN             (0x1 << 6)
     52#define   I2CD_DEF_ADDR_EN                 (0x1 << 5)
     53#define   I2CD_DEF_ALERT_EN                (0x1 << 4)
     54#define   I2CD_DEF_ARP_EN                  (0x1 << 3)
     55#define   I2CD_DEF_GCALL_EN                (0x1 << 2)
     56#define   I2CD_SLAVE_EN                    (0x1 << 1)
     57#define   I2CD_MASTER_EN                   (0x1)
     58
     59#define I2CD_AC_TIMING_REG1     0x04       /* Clock and AC Timing Control #1 */
     60#define I2CD_AC_TIMING_REG2     0x08       /* Clock and AC Timing Control #1 */
     61#define I2CD_INTR_CTRL_REG      0x0c       /* I2CD Interrupt Control */
     62#define I2CD_INTR_STS_REG       0x10       /* I2CD Interrupt Status */
     63
     64#define   I2CD_INTR_SLAVE_ADDR_MATCH       (0x1 << 31) /* 0: addr1 1: addr2 */
     65#define   I2CD_INTR_SLAVE_ADDR_RX_PENDING  (0x1 << 30)
     66/* bits[19-16] Reserved */
     67
     68/* All bits below are cleared by writing 1 */
     69#define   I2CD_INTR_SLAVE_INACTIVE_TIMEOUT (0x1 << 15)
     70#define   I2CD_INTR_SDA_DL_TIMEOUT         (0x1 << 14)
     71#define   I2CD_INTR_BUS_RECOVER_DONE       (0x1 << 13)
     72#define   I2CD_INTR_SMBUS_ALERT            (0x1 << 12) /* Bus [0-3] only */
     73#define   I2CD_INTR_SMBUS_ARP_ADDR         (0x1 << 11) /* Removed */
     74#define   I2CD_INTR_SMBUS_DEV_ALERT_ADDR   (0x1 << 10) /* Removed */
     75#define   I2CD_INTR_SMBUS_DEF_ADDR         (0x1 << 9)  /* Removed */
     76#define   I2CD_INTR_GCALL_ADDR             (0x1 << 8)  /* Removed */
     77#define   I2CD_INTR_SLAVE_ADDR_RX_MATCH    (0x1 << 7)  /* use RX_DONE */
     78#define   I2CD_INTR_SCL_TIMEOUT            (0x1 << 6)
     79#define   I2CD_INTR_ABNORMAL               (0x1 << 5)
     80#define   I2CD_INTR_NORMAL_STOP            (0x1 << 4)
     81#define   I2CD_INTR_ARBIT_LOSS             (0x1 << 3)
     82#define   I2CD_INTR_RX_DONE                (0x1 << 2)
     83#define   I2CD_INTR_TX_NAK                 (0x1 << 1)
     84#define   I2CD_INTR_TX_ACK                 (0x1 << 0)
     85
     86#define I2CD_CMD_REG            0x14       /* I2CD Command/Status */
     87#define   I2CD_SDA_OE                      (0x1 << 28)
     88#define   I2CD_SDA_O                       (0x1 << 27)
     89#define   I2CD_SCL_OE                      (0x1 << 26)
     90#define   I2CD_SCL_O                       (0x1 << 25)
     91#define   I2CD_TX_TIMING                   (0x1 << 24)
     92#define   I2CD_TX_STATUS                   (0x1 << 23)
     93
     94#define   I2CD_TX_STATE_SHIFT              19 /* Tx State Machine */
     95#define   I2CD_TX_STATE_MASK                  0xf
     96#define     I2CD_IDLE                         0x0
     97#define     I2CD_MACTIVE                      0x8
     98#define     I2CD_MSTART                       0x9
     99#define     I2CD_MSTARTR                      0xa
    100#define     I2CD_MSTOP                        0xb
    101#define     I2CD_MTXD                         0xc
    102#define     I2CD_MRXACK                       0xd
    103#define     I2CD_MRXD                         0xe
    104#define     I2CD_MTXACK                       0xf
    105#define     I2CD_SWAIT                        0x1
    106#define     I2CD_SRXD                         0x4
    107#define     I2CD_STXACK                       0x5
    108#define     I2CD_STXD                         0x6
    109#define     I2CD_SRXACK                       0x7
    110#define     I2CD_RECOVER                      0x3
    111
    112#define   I2CD_SCL_LINE_STS                (0x1 << 18)
    113#define   I2CD_SDA_LINE_STS                (0x1 << 17)
    114#define   I2CD_BUS_BUSY_STS                (0x1 << 16)
    115#define   I2CD_SDA_OE_OUT_DIR              (0x1 << 15)
    116#define   I2CD_SDA_O_OUT_DIR               (0x1 << 14)
    117#define   I2CD_SCL_OE_OUT_DIR              (0x1 << 13)
    118#define   I2CD_SCL_O_OUT_DIR               (0x1 << 12)
    119#define   I2CD_BUS_RECOVER_CMD_EN          (0x1 << 11)
    120#define   I2CD_S_ALT_EN                    (0x1 << 10)
    121
    122/* Command Bit */
    123#define   I2CD_RX_DMA_ENABLE               (0x1 << 9)
    124#define   I2CD_TX_DMA_ENABLE               (0x1 << 8)
    125#define   I2CD_RX_BUFF_ENABLE              (0x1 << 7)
    126#define   I2CD_TX_BUFF_ENABLE              (0x1 << 6)
    127#define   I2CD_M_STOP_CMD                  (0x1 << 5)
    128#define   I2CD_M_S_RX_CMD_LAST             (0x1 << 4)
    129#define   I2CD_M_RX_CMD                    (0x1 << 3)
    130#define   I2CD_S_TX_CMD                    (0x1 << 2)
    131#define   I2CD_M_TX_CMD                    (0x1 << 1)
    132#define   I2CD_M_START_CMD                 (0x1)
    133
    134#define I2CD_DEV_ADDR_REG       0x18       /* Slave Device Address */
    135#define I2CD_POOL_CTRL_REG      0x1c       /* Pool Buffer Control */
    136#define   I2CD_POOL_RX_COUNT(x)            (((x) >> 24) & 0xff)
    137#define   I2CD_POOL_RX_SIZE(x)             ((((x) >> 16) & 0xff) + 1)
    138#define   I2CD_POOL_TX_COUNT(x)            ((((x) >> 8) & 0xff) + 1)
    139#define   I2CD_POOL_OFFSET(x)              (((x) & 0x3f) << 2)  /* AST2400 */
    140#define I2CD_BYTE_BUF_REG       0x20       /* Transmit/Receive Byte Buffer */
    141#define   I2CD_BYTE_BUF_TX_SHIFT           0
    142#define   I2CD_BYTE_BUF_TX_MASK            0xff
    143#define   I2CD_BYTE_BUF_RX_SHIFT           8
    144#define   I2CD_BYTE_BUF_RX_MASK            0xff
    145#define I2CD_DMA_ADDR           0x24       /* DMA Buffer Address */
    146#define I2CD_DMA_LEN            0x28       /* DMA Transfer Length < 4KB */
    147
    148static inline bool aspeed_i2c_bus_is_master(AspeedI2CBus *bus)
    149{
    150    return bus->ctrl & I2CD_MASTER_EN;
    151}
    152
    153static inline bool aspeed_i2c_bus_is_enabled(AspeedI2CBus *bus)
    154{
    155    return bus->ctrl & (I2CD_MASTER_EN | I2CD_SLAVE_EN);
    156}
    157
    158static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
    159{
    160    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
    161
    162    trace_aspeed_i2c_bus_raise_interrupt(bus->intr_status,
    163          bus->intr_status & I2CD_INTR_TX_NAK ? "nak|" : "",
    164          bus->intr_status & I2CD_INTR_TX_ACK ? "ack|" : "",
    165          bus->intr_status & I2CD_INTR_RX_DONE ? "done|" : "",
    166          bus->intr_status & I2CD_INTR_NORMAL_STOP ? "normal|" : "",
    167          bus->intr_status & I2CD_INTR_ABNORMAL ? "abnormal" : "");
    168
    169    bus->intr_status &= bus->intr_ctrl;
    170    if (bus->intr_status) {
    171        bus->controller->intr_status |= 1 << bus->id;
    172        qemu_irq_raise(aic->bus_get_irq(bus));
    173    }
    174}
    175
    176static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
    177                                    unsigned size)
    178{
    179    AspeedI2CBus *bus = opaque;
    180    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
    181    uint64_t value = -1;
    182
    183    switch (offset) {
    184    case I2CD_FUN_CTRL_REG:
    185        value = bus->ctrl;
    186        break;
    187    case I2CD_AC_TIMING_REG1:
    188        value = bus->timing[0];
    189        break;
    190    case I2CD_AC_TIMING_REG2:
    191        value = bus->timing[1];
    192        break;
    193    case I2CD_INTR_CTRL_REG:
    194        value = bus->intr_ctrl;
    195        break;
    196    case I2CD_INTR_STS_REG:
    197        value = bus->intr_status;
    198        break;
    199    case I2CD_POOL_CTRL_REG:
    200        value = bus->pool_ctrl;
    201        break;
    202    case I2CD_BYTE_BUF_REG:
    203        value = bus->buf;
    204        break;
    205    case I2CD_CMD_REG:
    206        value = bus->cmd | (i2c_bus_busy(bus->bus) << 16);
    207        break;
    208    case I2CD_DMA_ADDR:
    209        if (!aic->has_dma) {
    210            qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
    211            break;
    212        }
    213        value = bus->dma_addr;
    214        break;
    215    case I2CD_DMA_LEN:
    216        if (!aic->has_dma) {
    217            qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
    218            break;
    219        }
    220        value = bus->dma_len;
    221        break;
    222
    223    default:
    224        qemu_log_mask(LOG_GUEST_ERROR,
    225                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, offset);
    226        value = -1;
    227        break;
    228    }
    229
    230    trace_aspeed_i2c_bus_read(bus->id, offset, size, value);
    231    return value;
    232}
    233
    234static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
    235{
    236    bus->cmd &= ~(I2CD_TX_STATE_MASK << I2CD_TX_STATE_SHIFT);
    237    bus->cmd |= (state & I2CD_TX_STATE_MASK) << I2CD_TX_STATE_SHIFT;
    238}
    239
    240static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
    241{
    242    return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
    243}
    244
    245static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
    246{
    247    MemTxResult result;
    248    AspeedI2CState *s = bus->controller;
    249
    250    result = address_space_read(&s->dram_as, bus->dma_addr,
    251                                MEMTXATTRS_UNSPECIFIED, data, 1);
    252    if (result != MEMTX_OK) {
    253        qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
    254                      __func__, bus->dma_addr);
    255        return -1;
    256    }
    257
    258    bus->dma_addr++;
    259    bus->dma_len--;
    260    return 0;
    261}
    262
    263static int aspeed_i2c_bus_send(AspeedI2CBus *bus, uint8_t pool_start)
    264{
    265    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
    266    int ret = -1;
    267    int i;
    268
    269    if (bus->cmd & I2CD_TX_BUFF_ENABLE) {
    270        for (i = pool_start; i < I2CD_POOL_TX_COUNT(bus->pool_ctrl); i++) {
    271            uint8_t *pool_base = aic->bus_pool_base(bus);
    272
    273            trace_aspeed_i2c_bus_send("BUF", i + 1,
    274                                      I2CD_POOL_TX_COUNT(bus->pool_ctrl),
    275                                      pool_base[i]);
    276            ret = i2c_send(bus->bus, pool_base[i]);
    277            if (ret) {
    278                break;
    279            }
    280        }
    281        bus->cmd &= ~I2CD_TX_BUFF_ENABLE;
    282    } else if (bus->cmd & I2CD_TX_DMA_ENABLE) {
    283        while (bus->dma_len) {
    284            uint8_t data;
    285            aspeed_i2c_dma_read(bus, &data);
    286            trace_aspeed_i2c_bus_send("DMA", bus->dma_len, bus->dma_len, data);
    287            ret = i2c_send(bus->bus, data);
    288            if (ret) {
    289                break;
    290            }
    291        }
    292        bus->cmd &= ~I2CD_TX_DMA_ENABLE;
    293    } else {
    294        trace_aspeed_i2c_bus_send("BYTE", pool_start, 1, bus->buf);
    295        ret = i2c_send(bus->bus, bus->buf);
    296    }
    297
    298    return ret;
    299}
    300
    301static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
    302{
    303    AspeedI2CState *s = bus->controller;
    304    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
    305    uint8_t data;
    306    int i;
    307
    308    if (bus->cmd & I2CD_RX_BUFF_ENABLE) {
    309        uint8_t *pool_base = aic->bus_pool_base(bus);
    310
    311        for (i = 0; i < I2CD_POOL_RX_SIZE(bus->pool_ctrl); i++) {
    312            pool_base[i] = i2c_recv(bus->bus);
    313            trace_aspeed_i2c_bus_recv("BUF", i + 1,
    314                                      I2CD_POOL_RX_SIZE(bus->pool_ctrl),
    315                                      pool_base[i]);
    316        }
    317
    318        /* Update RX count */
    319        bus->pool_ctrl &= ~(0xff << 24);
    320        bus->pool_ctrl |= (i & 0xff) << 24;
    321        bus->cmd &= ~I2CD_RX_BUFF_ENABLE;
    322    } else if (bus->cmd & I2CD_RX_DMA_ENABLE) {
    323        uint8_t data;
    324
    325        while (bus->dma_len) {
    326            MemTxResult result;
    327
    328            data = i2c_recv(bus->bus);
    329            trace_aspeed_i2c_bus_recv("DMA", bus->dma_len, bus->dma_len, data);
    330            result = address_space_write(&s->dram_as, bus->dma_addr,
    331                                         MEMTXATTRS_UNSPECIFIED, &data, 1);
    332            if (result != MEMTX_OK) {
    333                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
    334                              __func__, bus->dma_addr);
    335                return;
    336            }
    337            bus->dma_addr++;
    338            bus->dma_len--;
    339        }
    340        bus->cmd &= ~I2CD_RX_DMA_ENABLE;
    341    } else {
    342        data = i2c_recv(bus->bus);
    343        trace_aspeed_i2c_bus_recv("BYTE", 1, 1, bus->buf);
    344        bus->buf = (data & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
    345    }
    346}
    347
    348static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
    349{
    350    aspeed_i2c_set_state(bus, I2CD_MRXD);
    351    aspeed_i2c_bus_recv(bus);
    352    bus->intr_status |= I2CD_INTR_RX_DONE;
    353    if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
    354        i2c_nack(bus->bus);
    355    }
    356    bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
    357    aspeed_i2c_set_state(bus, I2CD_MACTIVE);
    358}
    359
    360static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
    361{
    362    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
    363
    364    if (bus->cmd & I2CD_TX_BUFF_ENABLE) {
    365        uint8_t *pool_base = aic->bus_pool_base(bus);
    366
    367        return pool_base[0];
    368    } else if (bus->cmd & I2CD_TX_DMA_ENABLE) {
    369        uint8_t data;
    370
    371        aspeed_i2c_dma_read(bus, &data);
    372        return data;
    373    } else {
    374        return bus->buf;
    375    }
    376}
    377
    378static bool aspeed_i2c_check_sram(AspeedI2CBus *bus)
    379{
    380    AspeedI2CState *s = bus->controller;
    381    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
    382
    383    if (!aic->check_sram) {
    384        return true;
    385    }
    386
    387    /*
    388     * AST2500: SRAM must be enabled before using the Buffer Pool or
    389     * DMA mode.
    390     */
    391    if (!(s->ctrl_global & I2C_CTRL_SRAM_EN) &&
    392        (bus->cmd & (I2CD_RX_DMA_ENABLE | I2CD_TX_DMA_ENABLE |
    393                     I2CD_RX_BUFF_ENABLE | I2CD_TX_BUFF_ENABLE))) {
    394        qemu_log_mask(LOG_GUEST_ERROR, "%s: SRAM is not enabled\n", __func__);
    395        return false;
    396    }
    397
    398    return true;
    399}
    400
    401static void aspeed_i2c_bus_cmd_dump(AspeedI2CBus *bus)
    402{
    403    g_autofree char *cmd_flags = NULL;
    404    uint32_t count;
    405
    406    if (bus->cmd & (I2CD_RX_BUFF_ENABLE | I2CD_RX_BUFF_ENABLE)) {
    407        count = I2CD_POOL_TX_COUNT(bus->pool_ctrl);
    408    } else if (bus->cmd & (I2CD_RX_DMA_ENABLE | I2CD_RX_DMA_ENABLE)) {
    409        count = bus->dma_len;
    410    } else { /* BYTE mode */
    411        count = 1;
    412    }
    413
    414    cmd_flags = g_strdup_printf("%s%s%s%s%s%s%s%s%s",
    415                                bus->cmd & I2CD_M_START_CMD ? "start|" : "",
    416                                bus->cmd & I2CD_RX_DMA_ENABLE ? "rxdma|" : "",
    417                                bus->cmd & I2CD_TX_DMA_ENABLE ? "txdma|" : "",
    418                                bus->cmd & I2CD_RX_BUFF_ENABLE ? "rxbuf|" : "",
    419                                bus->cmd & I2CD_TX_BUFF_ENABLE ? "txbuf|" : "",
    420                                bus->cmd & I2CD_M_TX_CMD ? "tx|" : "",
    421                                bus->cmd & I2CD_M_RX_CMD ? "rx|" : "",
    422                                bus->cmd & I2CD_M_S_RX_CMD_LAST ? "last|" : "",
    423                                bus->cmd & I2CD_M_STOP_CMD ? "stop" : "");
    424
    425    trace_aspeed_i2c_bus_cmd(bus->cmd, cmd_flags, count, bus->intr_status);
    426}
    427
    428/*
    429 * The state machine needs some refinement. It is only used to track
    430 * invalid STOP commands for the moment.
    431 */
    432static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
    433{
    434    uint8_t pool_start = 0;
    435
    436    bus->cmd &= ~0xFFFF;
    437    bus->cmd |= value & 0xFFFF;
    438
    439    if (!aspeed_i2c_check_sram(bus)) {
    440        return;
    441    }
    442
    443    if (trace_event_get_state_backends(TRACE_ASPEED_I2C_BUS_CMD)) {
    444        aspeed_i2c_bus_cmd_dump(bus);
    445    }
    446
    447    if (bus->cmd & I2CD_M_START_CMD) {
    448        uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
    449            I2CD_MSTARTR : I2CD_MSTART;
    450        uint8_t addr;
    451
    452        aspeed_i2c_set_state(bus, state);
    453
    454        addr = aspeed_i2c_get_addr(bus);
    455
    456        if (i2c_start_transfer(bus->bus, extract32(addr, 1, 7),
    457                               extract32(addr, 0, 1))) {
    458            bus->intr_status |= I2CD_INTR_TX_NAK;
    459        } else {
    460            bus->intr_status |= I2CD_INTR_TX_ACK;
    461        }
    462
    463        bus->cmd &= ~I2CD_M_START_CMD;
    464
    465        /*
    466         * The START command is also a TX command, as the slave
    467         * address is sent on the bus. Drop the TX flag if nothing
    468         * else needs to be sent in this sequence.
    469         */
    470        if (bus->cmd & I2CD_TX_BUFF_ENABLE) {
    471            if (I2CD_POOL_TX_COUNT(bus->pool_ctrl) == 1) {
    472                bus->cmd &= ~I2CD_M_TX_CMD;
    473            } else {
    474                /*
    475                 * Increase the start index in the TX pool buffer to
    476                 * skip the address byte.
    477                 */
    478                pool_start++;
    479            }
    480        } else if (bus->cmd & I2CD_TX_DMA_ENABLE) {
    481            if (bus->dma_len == 0) {
    482                bus->cmd &= ~I2CD_M_TX_CMD;
    483            }
    484        } else {
    485            bus->cmd &= ~I2CD_M_TX_CMD;
    486        }
    487
    488        /* No slave found */
    489        if (!i2c_bus_busy(bus->bus)) {
    490            return;
    491        }
    492        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
    493    }
    494
    495    if (bus->cmd & I2CD_M_TX_CMD) {
    496        aspeed_i2c_set_state(bus, I2CD_MTXD);
    497        if (aspeed_i2c_bus_send(bus, pool_start)) {
    498            bus->intr_status |= (I2CD_INTR_TX_NAK);
    499            i2c_end_transfer(bus->bus);
    500        } else {
    501            bus->intr_status |= I2CD_INTR_TX_ACK;
    502        }
    503        bus->cmd &= ~I2CD_M_TX_CMD;
    504        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
    505    }
    506
    507    if ((bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) &&
    508        !(bus->intr_status & I2CD_INTR_RX_DONE)) {
    509        aspeed_i2c_handle_rx_cmd(bus);
    510    }
    511
    512    if (bus->cmd & I2CD_M_STOP_CMD) {
    513        if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
    514            qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
    515            bus->intr_status |= I2CD_INTR_ABNORMAL;
    516        } else {
    517            aspeed_i2c_set_state(bus, I2CD_MSTOP);
    518            i2c_end_transfer(bus->bus);
    519            bus->intr_status |= I2CD_INTR_NORMAL_STOP;
    520        }
    521        bus->cmd &= ~I2CD_M_STOP_CMD;
    522        aspeed_i2c_set_state(bus, I2CD_IDLE);
    523    }
    524}
    525
    526static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
    527                                 uint64_t value, unsigned size)
    528{
    529    AspeedI2CBus *bus = opaque;
    530    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
    531    bool handle_rx;
    532
    533    trace_aspeed_i2c_bus_write(bus->id, offset, size, value);
    534
    535    switch (offset) {
    536    case I2CD_FUN_CTRL_REG:
    537        if (value & I2CD_SLAVE_EN) {
    538            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
    539                          __func__);
    540            break;
    541        }
    542        bus->ctrl = value & 0x0071C3FF;
    543        break;
    544    case I2CD_AC_TIMING_REG1:
    545        bus->timing[0] = value & 0xFFFFF0F;
    546        break;
    547    case I2CD_AC_TIMING_REG2:
    548        bus->timing[1] = value & 0x7;
    549        break;
    550    case I2CD_INTR_CTRL_REG:
    551        bus->intr_ctrl = value & 0x7FFF;
    552        break;
    553    case I2CD_INTR_STS_REG:
    554        handle_rx = (bus->intr_status & I2CD_INTR_RX_DONE) &&
    555                (value & I2CD_INTR_RX_DONE);
    556        bus->intr_status &= ~(value & 0x7FFF);
    557        if (!bus->intr_status) {
    558            bus->controller->intr_status &= ~(1 << bus->id);
    559            qemu_irq_lower(aic->bus_get_irq(bus));
    560        }
    561        if (handle_rx && (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST))) {
    562            aspeed_i2c_handle_rx_cmd(bus);
    563            aspeed_i2c_bus_raise_interrupt(bus);
    564        }
    565        break;
    566    case I2CD_DEV_ADDR_REG:
    567        qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
    568                      __func__);
    569        break;
    570    case I2CD_POOL_CTRL_REG:
    571        bus->pool_ctrl &= ~0xffffff;
    572        bus->pool_ctrl |= (value & 0xffffff);
    573        break;
    574
    575    case I2CD_BYTE_BUF_REG:
    576        bus->buf = (value & I2CD_BYTE_BUF_TX_MASK) << I2CD_BYTE_BUF_TX_SHIFT;
    577        break;
    578    case I2CD_CMD_REG:
    579        if (!aspeed_i2c_bus_is_enabled(bus)) {
    580            break;
    581        }
    582
    583        if (!aspeed_i2c_bus_is_master(bus)) {
    584            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
    585                          __func__);
    586            break;
    587        }
    588
    589        if (!aic->has_dma &&
    590            value & (I2CD_RX_DMA_ENABLE | I2CD_TX_DMA_ENABLE)) {
    591            qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
    592            break;
    593        }
    594
    595        aspeed_i2c_bus_handle_cmd(bus, value);
    596        aspeed_i2c_bus_raise_interrupt(bus);
    597        break;
    598    case I2CD_DMA_ADDR:
    599        if (!aic->has_dma) {
    600            qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
    601            break;
    602        }
    603
    604        bus->dma_addr = value & 0x3ffffffc;
    605        break;
    606
    607    case I2CD_DMA_LEN:
    608        if (!aic->has_dma) {
    609            qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
    610            break;
    611        }
    612
    613        bus->dma_len = value & 0xfff;
    614        if (!bus->dma_len) {
    615            qemu_log_mask(LOG_UNIMP, "%s: invalid DMA length\n",  __func__);
    616        }
    617        break;
    618
    619    default:
    620        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
    621                      __func__, offset);
    622    }
    623}
    624
    625static uint64_t aspeed_i2c_ctrl_read(void *opaque, hwaddr offset,
    626                                   unsigned size)
    627{
    628    AspeedI2CState *s = opaque;
    629
    630    switch (offset) {
    631    case I2C_CTRL_STATUS:
    632        return s->intr_status;
    633    case I2C_CTRL_GLOBAL:
    634        return s->ctrl_global;
    635    default:
    636        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
    637                      __func__, offset);
    638        break;
    639    }
    640
    641    return -1;
    642}
    643
    644static void aspeed_i2c_ctrl_write(void *opaque, hwaddr offset,
    645                                  uint64_t value, unsigned size)
    646{
    647    AspeedI2CState *s = opaque;
    648
    649    switch (offset) {
    650    case I2C_CTRL_GLOBAL:
    651        s->ctrl_global = value;
    652        break;
    653    case I2C_CTRL_STATUS:
    654    default:
    655        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
    656                      __func__, offset);
    657        break;
    658    }
    659}
    660
    661static const MemoryRegionOps aspeed_i2c_bus_ops = {
    662    .read = aspeed_i2c_bus_read,
    663    .write = aspeed_i2c_bus_write,
    664    .endianness = DEVICE_LITTLE_ENDIAN,
    665};
    666
    667static const MemoryRegionOps aspeed_i2c_ctrl_ops = {
    668    .read = aspeed_i2c_ctrl_read,
    669    .write = aspeed_i2c_ctrl_write,
    670    .endianness = DEVICE_LITTLE_ENDIAN,
    671};
    672
    673static uint64_t aspeed_i2c_pool_read(void *opaque, hwaddr offset,
    674                                     unsigned size)
    675{
    676    AspeedI2CState *s = opaque;
    677    uint64_t ret = 0;
    678    int i;
    679
    680    for (i = 0; i < size; i++) {
    681        ret |= (uint64_t) s->pool[offset + i] << (8 * i);
    682    }
    683
    684    return ret;
    685}
    686
    687static void aspeed_i2c_pool_write(void *opaque, hwaddr offset,
    688                                  uint64_t value, unsigned size)
    689{
    690    AspeedI2CState *s = opaque;
    691    int i;
    692
    693    for (i = 0; i < size; i++) {
    694        s->pool[offset + i] = (value >> (8 * i)) & 0xFF;
    695    }
    696}
    697
    698static const MemoryRegionOps aspeed_i2c_pool_ops = {
    699    .read = aspeed_i2c_pool_read,
    700    .write = aspeed_i2c_pool_write,
    701    .endianness = DEVICE_LITTLE_ENDIAN,
    702    .valid = {
    703        .min_access_size = 1,
    704        .max_access_size = 4,
    705    },
    706};
    707
    708static const VMStateDescription aspeed_i2c_bus_vmstate = {
    709    .name = TYPE_ASPEED_I2C,
    710    .version_id = 3,
    711    .minimum_version_id = 3,
    712    .fields = (VMStateField[]) {
    713        VMSTATE_UINT8(id, AspeedI2CBus),
    714        VMSTATE_UINT32(ctrl, AspeedI2CBus),
    715        VMSTATE_UINT32_ARRAY(timing, AspeedI2CBus, 2),
    716        VMSTATE_UINT32(intr_ctrl, AspeedI2CBus),
    717        VMSTATE_UINT32(intr_status, AspeedI2CBus),
    718        VMSTATE_UINT32(cmd, AspeedI2CBus),
    719        VMSTATE_UINT32(buf, AspeedI2CBus),
    720        VMSTATE_UINT32(pool_ctrl, AspeedI2CBus),
    721        VMSTATE_UINT32(dma_addr, AspeedI2CBus),
    722        VMSTATE_UINT32(dma_len, AspeedI2CBus),
    723        VMSTATE_END_OF_LIST()
    724    }
    725};
    726
    727static const VMStateDescription aspeed_i2c_vmstate = {
    728    .name = TYPE_ASPEED_I2C,
    729    .version_id = 2,
    730    .minimum_version_id = 2,
    731    .fields = (VMStateField[]) {
    732        VMSTATE_UINT32(intr_status, AspeedI2CState),
    733        VMSTATE_STRUCT_ARRAY(busses, AspeedI2CState,
    734                             ASPEED_I2C_NR_BUSSES, 1, aspeed_i2c_bus_vmstate,
    735                             AspeedI2CBus),
    736        VMSTATE_UINT8_ARRAY(pool, AspeedI2CState, ASPEED_I2C_MAX_POOL_SIZE),
    737        VMSTATE_END_OF_LIST()
    738    }
    739};
    740
    741static void aspeed_i2c_reset(DeviceState *dev)
    742{
    743    AspeedI2CState *s = ASPEED_I2C(dev);
    744
    745    s->intr_status = 0;
    746}
    747
    748static void aspeed_i2c_instance_init(Object *obj)
    749{
    750    AspeedI2CState *s = ASPEED_I2C(obj);
    751    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
    752    int i;
    753
    754    for (i = 0; i < aic->num_busses; i++) {
    755        object_initialize_child(obj, "bus[*]", &s->busses[i],
    756                                TYPE_ASPEED_I2C_BUS);
    757    }
    758}
    759
    760/*
    761 * Address Definitions (AST2400 and AST2500)
    762 *
    763 *   0x000 ... 0x03F: Global Register
    764 *   0x040 ... 0x07F: Device 1
    765 *   0x080 ... 0x0BF: Device 2
    766 *   0x0C0 ... 0x0FF: Device 3
    767 *   0x100 ... 0x13F: Device 4
    768 *   0x140 ... 0x17F: Device 5
    769 *   0x180 ... 0x1BF: Device 6
    770 *   0x1C0 ... 0x1FF: Device 7
    771 *   0x200 ... 0x2FF: Buffer Pool  (unused in linux driver)
    772 *   0x300 ... 0x33F: Device 8
    773 *   0x340 ... 0x37F: Device 9
    774 *   0x380 ... 0x3BF: Device 10
    775 *   0x3C0 ... 0x3FF: Device 11
    776 *   0x400 ... 0x43F: Device 12
    777 *   0x440 ... 0x47F: Device 13
    778 *   0x480 ... 0x4BF: Device 14
    779 *   0x800 ... 0xFFF: Buffer Pool  (unused in linux driver)
    780 */
    781static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
    782{
    783    int i;
    784    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    785    AspeedI2CState *s = ASPEED_I2C(dev);
    786    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
    787
    788    sysbus_init_irq(sbd, &s->irq);
    789    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
    790                          "aspeed.i2c", 0x1000);
    791    sysbus_init_mmio(sbd, &s->iomem);
    792
    793    for (i = 0; i < aic->num_busses; i++) {
    794        Object *bus = OBJECT(&s->busses[i]);
    795        int offset = i < aic->gap ? 1 : 5;
    796
    797        if (!object_property_set_link(bus, "controller", OBJECT(s), errp)) {
    798            return;
    799        }
    800
    801        if (!object_property_set_uint(bus, "bus-id", i, errp)) {
    802            return;
    803        }
    804
    805        if (!sysbus_realize(SYS_BUS_DEVICE(bus), errp)) {
    806            return;
    807        }
    808
    809        memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
    810                                    &s->busses[i].mr);
    811    }
    812
    813    memory_region_init_io(&s->pool_iomem, OBJECT(s), &aspeed_i2c_pool_ops, s,
    814                          "aspeed.i2c-pool", aic->pool_size);
    815    memory_region_add_subregion(&s->iomem, aic->pool_base, &s->pool_iomem);
    816
    817    if (aic->has_dma) {
    818        if (!s->dram_mr) {
    819            error_setg(errp, TYPE_ASPEED_I2C ": 'dram' link not set");
    820            return;
    821        }
    822
    823        address_space_init(&s->dram_as, s->dram_mr,
    824                           TYPE_ASPEED_I2C "-dma-dram");
    825    }
    826}
    827
    828static Property aspeed_i2c_properties[] = {
    829    DEFINE_PROP_LINK("dram", AspeedI2CState, dram_mr,
    830                     TYPE_MEMORY_REGION, MemoryRegion *),
    831    DEFINE_PROP_END_OF_LIST(),
    832};
    833
    834static void aspeed_i2c_class_init(ObjectClass *klass, void *data)
    835{
    836    DeviceClass *dc = DEVICE_CLASS(klass);
    837
    838    dc->vmsd = &aspeed_i2c_vmstate;
    839    dc->reset = aspeed_i2c_reset;
    840    device_class_set_props(dc, aspeed_i2c_properties);
    841    dc->realize = aspeed_i2c_realize;
    842    dc->desc = "Aspeed I2C Controller";
    843}
    844
    845static const TypeInfo aspeed_i2c_info = {
    846    .name          = TYPE_ASPEED_I2C,
    847    .parent        = TYPE_SYS_BUS_DEVICE,
    848    .instance_init = aspeed_i2c_instance_init,
    849    .instance_size = sizeof(AspeedI2CState),
    850    .class_init    = aspeed_i2c_class_init,
    851    .class_size = sizeof(AspeedI2CClass),
    852    .abstract   = true,
    853};
    854
    855static void aspeed_i2c_bus_reset(DeviceState *dev)
    856{
    857    AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
    858
    859    s->intr_ctrl = 0;
    860    s->intr_status = 0;
    861    s->cmd = 0;
    862    s->buf = 0;
    863    s->dma_addr = 0;
    864    s->dma_len = 0;
    865    i2c_end_transfer(s->bus);
    866}
    867
    868static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
    869{
    870    AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
    871    AspeedI2CClass *aic;
    872    g_autofree char *name = g_strdup_printf(TYPE_ASPEED_I2C_BUS ".%d", s->id);
    873
    874    if (!s->controller) {
    875        error_setg(errp, TYPE_ASPEED_I2C_BUS ": 'controller' link not set");
    876        return;
    877    }
    878
    879    aic = ASPEED_I2C_GET_CLASS(s->controller);
    880
    881    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
    882
    883    s->bus = i2c_init_bus(dev, name);
    884
    885    memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
    886                          s, name, aic->reg_size);
    887    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mr);
    888}
    889
    890static Property aspeed_i2c_bus_properties[] = {
    891    DEFINE_PROP_UINT8("bus-id", AspeedI2CBus, id, 0),
    892    DEFINE_PROP_LINK("controller", AspeedI2CBus, controller, TYPE_ASPEED_I2C,
    893                     AspeedI2CState *),
    894    DEFINE_PROP_END_OF_LIST(),
    895};
    896
    897static void aspeed_i2c_bus_class_init(ObjectClass *klass, void *data)
    898{
    899    DeviceClass *dc = DEVICE_CLASS(klass);
    900
    901    dc->desc = "Aspeed I2C Bus";
    902    dc->realize = aspeed_i2c_bus_realize;
    903    dc->reset = aspeed_i2c_bus_reset;
    904    device_class_set_props(dc, aspeed_i2c_bus_properties);
    905}
    906
    907static const TypeInfo aspeed_i2c_bus_info = {
    908    .name           = TYPE_ASPEED_I2C_BUS,
    909    .parent         = TYPE_SYS_BUS_DEVICE,
    910    .instance_size  = sizeof(AspeedI2CBus),
    911    .class_init     = aspeed_i2c_bus_class_init,
    912};
    913
    914static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
    915{
    916    return bus->controller->irq;
    917}
    918
    919static uint8_t *aspeed_2400_i2c_bus_pool_base(AspeedI2CBus *bus)
    920{
    921    uint8_t *pool_page =
    922        &bus->controller->pool[I2CD_POOL_PAGE_SEL(bus->ctrl) * 0x100];
    923
    924    return &pool_page[I2CD_POOL_OFFSET(bus->pool_ctrl)];
    925}
    926
    927static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
    928{
    929    DeviceClass *dc = DEVICE_CLASS(klass);
    930    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
    931
    932    dc->desc = "ASPEED 2400 I2C Controller";
    933
    934    aic->num_busses = 14;
    935    aic->reg_size = 0x40;
    936    aic->gap = 7;
    937    aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
    938    aic->pool_size = 0x800;
    939    aic->pool_base = 0x800;
    940    aic->bus_pool_base = aspeed_2400_i2c_bus_pool_base;
    941}
    942
    943static const TypeInfo aspeed_2400_i2c_info = {
    944    .name = TYPE_ASPEED_2400_I2C,
    945    .parent = TYPE_ASPEED_I2C,
    946    .class_init = aspeed_2400_i2c_class_init,
    947};
    948
    949static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
    950{
    951    return bus->controller->irq;
    952}
    953
    954static uint8_t *aspeed_2500_i2c_bus_pool_base(AspeedI2CBus *bus)
    955{
    956    return &bus->controller->pool[bus->id * 0x10];
    957}
    958
    959static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
    960{
    961    DeviceClass *dc = DEVICE_CLASS(klass);
    962    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
    963
    964    dc->desc = "ASPEED 2500 I2C Controller";
    965
    966    aic->num_busses = 14;
    967    aic->reg_size = 0x40;
    968    aic->gap = 7;
    969    aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
    970    aic->pool_size = 0x100;
    971    aic->pool_base = 0x200;
    972    aic->bus_pool_base = aspeed_2500_i2c_bus_pool_base;
    973    aic->check_sram = true;
    974    aic->has_dma = true;
    975}
    976
    977static const TypeInfo aspeed_2500_i2c_info = {
    978    .name = TYPE_ASPEED_2500_I2C,
    979    .parent = TYPE_ASPEED_I2C,
    980    .class_init = aspeed_2500_i2c_class_init,
    981};
    982
    983static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
    984{
    985    return bus->irq;
    986}
    987
    988static uint8_t *aspeed_2600_i2c_bus_pool_base(AspeedI2CBus *bus)
    989{
    990   return &bus->controller->pool[bus->id * 0x20];
    991}
    992
    993static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
    994{
    995    DeviceClass *dc = DEVICE_CLASS(klass);
    996    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
    997
    998    dc->desc = "ASPEED 2600 I2C Controller";
    999
   1000    aic->num_busses = 16;
   1001    aic->reg_size = 0x80;
   1002    aic->gap = -1; /* no gap */
   1003    aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
   1004    aic->pool_size = 0x200;
   1005    aic->pool_base = 0xC00;
   1006    aic->bus_pool_base = aspeed_2600_i2c_bus_pool_base;
   1007    aic->has_dma = true;
   1008}
   1009
   1010static const TypeInfo aspeed_2600_i2c_info = {
   1011    .name = TYPE_ASPEED_2600_I2C,
   1012    .parent = TYPE_ASPEED_I2C,
   1013    .class_init = aspeed_2600_i2c_class_init,
   1014};
   1015
   1016static void aspeed_i2c_register_types(void)
   1017{
   1018    type_register_static(&aspeed_i2c_bus_info);
   1019    type_register_static(&aspeed_i2c_info);
   1020    type_register_static(&aspeed_2400_i2c_info);
   1021    type_register_static(&aspeed_2500_i2c_info);
   1022    type_register_static(&aspeed_2600_i2c_info);
   1023}
   1024
   1025type_init(aspeed_i2c_register_types)
   1026
   1027
   1028I2CBus *aspeed_i2c_get_bus(AspeedI2CState *s, int busnr)
   1029{
   1030    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
   1031    I2CBus *bus = NULL;
   1032
   1033    if (busnr >= 0 && busnr < aic->num_busses) {
   1034        bus = s->busses[busnr].bus;
   1035    }
   1036
   1037    return bus;
   1038}