From: Jamin Lin <jamin_lin@aspeedtech.com>
To: "Cédric Le Goater" <clg@kaod.org>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Steven Lee" <steven_lee@aspeedtech.com>,
"Troy Lee" <leetroy@gmail.com>,
"Andrew Jeffery" <andrew@codeconstruct.com.au>,
"Joel Stanley" <joel@jms.id.au>,
"open list:ASPEED BMCs" <qemu-arm@nongnu.org>,
"open list:All patches CC here" <qemu-devel@nongnu.org>
Cc: Jamin Lin <jamin_lin@aspeedtech.com>,
Troy Lee <troy_lee@aspeedtech.com>,
Kane Chen <kane_chen@aspeedtech.com>
Subject: [PATCH v2 2/2] hw/i2c/aspeed_i2c: Increase I2C device register size to 0xA0
Date: Tue, 10 Feb 2026 02:43:33 +0000 [thread overview]
Message-ID: <20260210024331.3984696-3-jamin_lin@aspeedtech.com> (raw)
In-Reply-To: <20260210024331.3984696-1-jamin_lin@aspeedtech.com>
According to the AST2700 A1 datasheet, the register space for each I2C
device instance has been expanded from 0x80 bytes to 0xA0 bytes.
Update the AST2700 I2C controller configuration to reflect the new
register layout by increasing the per-device register size to 0xA0
and adjusting the register gap size accordingly.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: 4f53de2f103d6dfb5ad0498995d91a9694f40dd2 ("hw/arm/aspeed_ast27x0: Remove ast2700-a0 SOC")
---
include/hw/i2c/aspeed_i2c.h | 2 +-
hw/i2c/aspeed_i2c.c | 36 ++++++++++++++++++------------------
2 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index 1ba0112cef..53a9dba71b 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -36,7 +36,7 @@ OBJECT_DECLARE_TYPE(AspeedI2CState, AspeedI2CClass, ASPEED_I2C)
#define ASPEED_I2C_NR_BUSSES 16
#define ASPEED_I2C_SHARE_POOL_SIZE 0x800
#define ASPEED_I2C_BUS_POOL_SIZE 0x20
-#define ASPEED_I2C_NEW_NUM_REG (0x80 >> 2)
+#define ASPEED_I2C_NEW_NUM_REG (0xa0 >> 2)
#define A_I2CD_M_STOP_CMD BIT(5)
#define A_I2CD_M_RX_CMD BIT(3)
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index 741c7a7297..122bfdd63d 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -1205,37 +1205,37 @@ static void aspeed_i2c_instance_init(Object *obj)
*
* Address Definitions (AST2700)
* 0x000 ... 0x0FF: Global Register
- * 0x100 ... 0x17F: Device 0
+ * 0x100 ... 0x19F: Device 0
* 0x1A0 ... 0x1BF: Device 0 buffer
- * 0x200 ... 0x27F: Device 1
+ * 0x200 ... 0x29F: Device 1
* 0x2A0 ... 0x2BF: Device 1 buffer
- * 0x300 ... 0x37F: Device 2
+ * 0x300 ... 0x39F: Device 2
* 0x3A0 ... 0x3BF: Device 2 buffer
- * 0x400 ... 0x47F: Device 3
+ * 0x400 ... 0x49F: Device 3
* 0x4A0 ... 0x4BF: Device 3 buffer
- * 0x500 ... 0x57F: Device 4
+ * 0x500 ... 0x59F: Device 4
* 0x5A0 ... 0x5BF: Device 4 buffer
- * 0x600 ... 0x67F: Device 5
+ * 0x600 ... 0x69F: Device 5
* 0x6A0 ... 0x6BF: Device 5 buffer
- * 0x700 ... 0x77F: Device 6
+ * 0x700 ... 0x79F: Device 6
* 0x7A0 ... 0x7BF: Device 6 buffer
- * 0x800 ... 0x87F: Device 7
+ * 0x800 ... 0x89F: Device 7
* 0x8A0 ... 0x8BF: Device 7 buffer
- * 0x900 ... 0x97F: Device 8
+ * 0x900 ... 0x99F: Device 8
* 0x9A0 ... 0x9BF: Device 8 buffer
- * 0xA00 ... 0xA7F: Device 9
+ * 0xA00 ... 0xA9F: Device 9
* 0xAA0 ... 0xABF: Device 9 buffer
- * 0xB00 ... 0xB7F: Device 10
+ * 0xB00 ... 0xB9F: Device 10
* 0xBA0 ... 0xBBF: Device 10 buffer
- * 0xC00 ... 0xC7F: Device 11
+ * 0xC00 ... 0xC9F: Device 11
* 0xCA0 ... 0xCBF: Device 11 buffer
- * 0xD00 ... 0xD7F: Device 12
+ * 0xD00 ... 0xD9F: Device 12
* 0xDA0 ... 0xDBF: Device 12 buffer
- * 0xE00 ... 0xE7F: Device 13
+ * 0xE00 ... 0xE9F: Device 13
* 0xEA0 ... 0xEBF: Device 13 buffer
- * 0xF00 ... 0xF7F: Device 14
+ * 0xF00 ... 0xF9F: Device 14
* 0xFA0 ... 0xFBF: Device 14 buffer
- * 0x1000 ... 0x107F: Device 15
+ * 0x1000 ... 0x109F: Device 15
* 0x10A0 ... 0x10BF: Device 15 buffer
*/
static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
@@ -1658,8 +1658,8 @@ static void aspeed_2700_i2c_class_init(ObjectClass *klass, const void *data)
dc->desc = "ASPEED 2700 I2C Controller";
aic->num_busses = 16;
- aic->reg_size = 0x80;
- aic->reg_gap_size = 0x80;
+ aic->reg_size = 0xa0;
+ aic->reg_gap_size = 0x60;
aic->gap = -1; /* no gap */
aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
aic->pool_size = 0x20;
--
2.43.0
next prev parent reply other threads:[~2026-02-10 2:44 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-10 2:43 [PATCH v2 0/2] hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO Jamin Lin
2026-02-10 2:43 ` [PATCH v2 1/2] hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO handlers Jamin Lin
2026-02-10 14:57 ` Cédric Le Goater
2026-02-10 2:43 ` Jamin Lin [this message]
2026-02-10 8:05 ` [PATCH v2 2/2] hw/i2c/aspeed_i2c: Increase I2C device register size to 0xA0 Cédric Le Goater
2026-02-11 12:10 ` [PATCH v2 0/2] hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO Cédric Le Goater
2026-02-13 12:15 ` Michael Tokarev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260210024331.3984696-3-jamin_lin@aspeedtech.com \
--to=jamin_lin@aspeedtech.com \
--cc=andrew@codeconstruct.com.au \
--cc=clg@kaod.org \
--cc=joel@jms.id.au \
--cc=kane_chen@aspeedtech.com \
--cc=leetroy@gmail.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=steven_lee@aspeedtech.com \
--cc=troy_lee@aspeedtech.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.