[PATCH 01/16] hw/sd/sdhci: add i.MX uSDHC SDCLK_AUTO_GATE and NO_SDMA_BOUNDARY quirks

[Kyle Fox <kylefoxaustin.github@gmail.com>]

The i.MX uSDHC issues commands with SDCLK auto-gated (its driver never
sets SDCLK_EN), and its SDMA does not honour the 512 KiB ADMA buffer
boundary the generic core assumes. Add two opt-in quirk bits for this:

  - SDCLK_AUTO_GATE: treat the clock as running once the internal clock
    is enabled and stable, instead of also requiring SDCLK_EN.
  - NO_SDMA_BOUNDARY: skip the buffer-boundary break in multi-block SDMA.

Both default off and are a no-op when the bit is clear, so no existing
user of the SDHCI models changes behaviour; a machine opts in by setting
the bits on its own uSDHC instances (the i.MX 95 SoC does so).

Signed-off-by: Kyle Fox <kylefoxaustin.github@gmail.com>
---
 hw/sd/sdhci.c         | 67 +++++++++++++++++++++++++++++++++++++++----
 include/hw/sd/sdhci.h | 21 ++++++++++++++
 2 files changed, 82 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index e58a6103970..327e9a7cb74 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -611,12 +611,27 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
     }
 
     /*
-     * XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
-     * possible stop at page boundary if initial address is not page aligned,
-     * allow them to work properly
+     * The i.MX/FSL uSDHC silicon does not implement the SDHCI "Host SDMA
+     * Buffer Boundary" mechanism; it transfers all blocks back-to-back
+     * regardless of buffer-boundary address alignment. The blksize-quirk
+     * in esdhc_write() forces bits 14:12 to 0b111 (= 512 KiB) so Linux's
+     * "zero this field out" pattern doesn't trip a 4 KiB boundary break,
+     * but the real hardware never pauses for the boundary at all, so
+     * neither should we. Skipping the page-aligned path makes the SDMA
+     * transfer run to completion (blkcnt -> 0) and fire transfer-complete,
+     * which is what the FSL U-Boot SPL driver expects (it doesn't ack
+     * SDMA-boundary IRQs by re-writing SYSAD). Controllers with this
+     * behaviour set SDHCI_QUIRK_NO_SDMA_BOUNDARY.
      */
-    if ((s->sdmasysad % boundary_chk) == 0) {
-        page_aligned = true;
+    if (!(s->quirks & SDHCI_QUIRK_NO_SDMA_BOUNDARY)) {
+        /*
+         * XXX: Some sd/mmc drivers (for example, u-boot-slp) do not
+         * account for possible stop at page boundary if initial address
+         * is not page aligned, allow them to work properly
+         */
+        if ((s->sdmasysad % boundary_chk) == 0) {
+            page_aligned = true;
+        }
     }
 
     s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE;
@@ -992,9 +1007,26 @@ static void sdhci_data_transfer(void *opaque)
     }
 }
 
+static bool sdhci_clock_is_on(SDHCIState *s)
+{
+    /*
+     * The i.MX (u)SDHC has no software SD-clock-enable bit (the card clock
+     * is auto-gated by hardware), so its driver never sets
+     * SDHC_CLOCK_SDCLK_EN. For such a controller, treat the clock as
+     * running once the internal clock is enabled and stable; otherwise
+     * every command would be silently dropped (no completion/timeout IRQ),
+     * stalling the guest on 10s host-side timeouts.
+     */
+    if (s->quirks & SDHCI_QUIRK_SDCLK_AUTO_GATE) {
+        return (s->clkcon & (SDHC_CLOCK_INT_EN | SDHC_CLOCK_INT_STABLE)) ==
+               (SDHC_CLOCK_INT_EN | SDHC_CLOCK_INT_STABLE);
+    }
+    return SDHC_CLOCK_IS_ON(s->clkcon);
+}
+
 static bool sdhci_can_issue_command(SDHCIState *s)
 {
-    if (!SDHC_CLOCK_IS_ON(s->clkcon) ||
+    if (!sdhci_clock_is_on(s) ||
         (((s->prnsts & SDHC_DATA_INHIBIT) || s->stopped_state) &&
         ((s->cmdreg & SDHC_CMD_DATA_PRESENT) ||
         ((s->cmdreg & SDHC_CMD_RESPONSE) == SDHC_CMD_RSP_WITH_BUSY &&
@@ -1613,6 +1645,9 @@ static void sdhci_bus_class_init(ObjectClass *klass, const void *data)
 
 #define ESDHC_VENDOR_SPEC               0xc0
 #define ESDHC_FRC_SDCLK_ON              (1 << 8)
+#define ESDHC_VENDORSPEC_IPGEN          (1 << 11)
+#define ESDHC_VENDORSPEC_HCKEN          (1 << 12)
+#define ESDHC_VENDORSPEC_CKEN           (1 << 14)
 
 #define ESDHC_DLL_CTRL                  0x60
 
@@ -1707,6 +1742,26 @@ esdhc_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         } else {
             s->prnsts |= ESDHC_PRNSTS_CLOCK_GATE_OFF;
         }
+        /*
+         * An SDCLK_AUTO_GATE i.MX uSDHC drives the SD clock through
+         * VENDORSPEC, not through the SDHCI CLKCON. For those instances
+         * mirror the VENDORSPEC clock-enable bits into clkcon so the
+         * standard SDHCI paths (PRNSTS.SDSTB derived from CLOCK_INT_STABLE;
+         * sdhci_can_issue_command gating on CLOCK_IS_ON) see the clock as
+         * enabled; otherwise the U-Boot fsl_esdhc_imx driver waits forever
+         * for SDSTB. Consumers without the quirk keep the upstream behaviour
+         * (a VENDORSPEC write touches only vendor_spec/prnsts).
+         */
+        if (s->quirks & SDHCI_QUIRK_SDCLK_AUTO_GATE) {
+            if (value & (ESDHC_VENDORSPEC_HCKEN | ESDHC_VENDORSPEC_IPGEN)) {
+                s->clkcon |= SDHC_CLOCK_INT_EN | SDHC_CLOCK_INT_STABLE;
+            }
+            if (value & ESDHC_VENDORSPEC_CKEN) {
+                s->clkcon |= SDHC_CLOCK_SDCLK_EN;
+            } else {
+                s->clkcon &= ~SDHC_CLOCK_SDCLK_EN;
+            }
+        }
         break;
 
     case SDHC_HOSTCTL:
diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index a9da6203fcb..e6940b62562 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -115,6 +115,27 @@ typedef struct SDHCIState SDHCIState;
  */
 #define SDHCI_QUIRK_NO_BUSY_IRQ    BIT(14)
 
+/*
+ * The i.MX (u)SDHC gates the SD card clock automatically and has no
+ * software-visible "SD Clock Enable" bit: its driver programs only the
+ * divider and the internal-clock enable, never SDHC_CLOCK_SDCLK_EN. With
+ * this quirk the controller is considered ready to issue commands once the
+ * internal clock is enabled and stable, instead of also requiring
+ * SDHC_CLOCK_SDCLK_EN (which such a driver never sets). QEMU-internal bit,
+ * taken from the top of the word to avoid the Linux quirk numbering.
+ */
+#define SDHCI_QUIRK_SDCLK_AUTO_GATE    BIT(31)
+
+/*
+ * The i.MX uSDHC silicon does not implement the SDHCI "Host SDMA Buffer
+ * Boundary" mechanism; it streams all blocks back-to-back regardless of the
+ * buffer-boundary alignment, never pausing at the boundary. With this quirk
+ * the SDMA engine skips the page-aligned boundary-break path so the transfer
+ * runs to completion. QEMU-internal bit, taken from the top of the word to
+ * avoid the Linux quirk numbering.
+ */
+#define SDHCI_QUIRK_NO_SDMA_BOUNDARY    BIT(30)
+
 #define TYPE_PCI_SDHCI "sdhci-pci"
 DECLARE_INSTANCE_CHECKER(SDHCIState, PCI_SDHCI,
                          TYPE_PCI_SDHCI)
-- 
2.34.1