This patch series builds directly on top of the recently reviewed patch: "[PATCH v3] hw/ufs: Reset controller and MCQ state on HCE transition to 0" (Message-ID: <[email protected]>) Based-on: <[email protected]>
### Background & Motivation When running upstream Linux kernel UFS driver error recovery and task aborts (e.g., ufshcd_abort() or ufshcd_mcq_abort()), Linux interacts with UFS Multi- Circular Queue (MCQ) runtime registers and issues UTP Task Management Requests (TMR) via UTMRLDBR. Currently in QEMU: 1. Writing to MCQ operational registers (SQnRTC, SQnCTI, SQnIS, SQnIE, CQnIS, CQnIE, CQnIACR) logs "invalid register offset" warnings. 2. TMR registers (UTMRLDBR, UTMRLCLR, UTMRLRSR) are unsupported. Task aborts time out and unnecessarily escalate to full device or host resets. 3. When task abort cancels an in-flight command, lack of SCSIRequest tracking presents Use-After-Free (UAF) hazards during asynchronous block AIO callbacks. ### Series Overview - Patch 1 (hw/ufs: Support MCQ runtime interrupt and queue status registers): Implements UFSHCI 5.2.1/5.6 per-queue runtime registers using QEMU REG32/FIELD macros. Implements SQSTART/SQSTOP queue gating, SQ_ICU queue cleanup reporting, and W1C interrupt handling. Dynamically recalculates active CQ interrupts to clear global IS.CQES, preventing virtual interrupt storms. Cleans operational registers during HCE 1 -> 0 while preserving MCQCONFIG.MAC capability. - Patch 2 (hw/ufs: Implement Task Management Request (TMR) handling): Implements Task Management Request processing via UTMRLDBR. Tracks sreq in UfsRequest and safely cancels pending SCSIRequests via scsi_req_cancel() to eliminate UAF hazards. Supports dual-queue tag lookups across legacy UTRL and MCQ queues. For UFS_QUERY_TASK, returns FUNCTION SUCCEEDED (0x08) if the task is pending in the device/controller, and FUNCTION COMPLETE (0x00) if the task does not exist, adhering strictly to SAM-5 and JEDEC specifications. Latches pending doorbell bits in utmrldbr upon UTMRLDBR write per UFSHCI 5.2.1 Section 5.3.3. Preserves dword_2 header OCS masks and returns completion codes in both response and output_param1 to satisfy both JEDEC specifications and Linux kernel driver validation. Clears TMR registers during HCE reset. - Patch 3 (hw/ufs: Add experimental fault injection properties for task abort testing): Adds experimental QOM properties x-hold-tag and x-hold-mode to ufs-pci and ufs-sysbus devices. Decouples UFS_HOLD_TAG_NONE (0xffffffff) to preserve Tag 0 testing and UFS_HOLD_TAG_ANY (0xfffffffe) to automatically sniff target direct I/O (READ_10/WRITE_10 with LBA >= 512) while allowing guest boot metadata requests to proceed unimpeded. Supports runtime dynamic modification via QOM (qom-set / qom-get) on realized devices, enabling continuous multi-case CI testing in a single running VM without reboots. ### CI/CD Closed-Loop & Regression Prevention Vision Together with the companion Linux kernel patch: "[PATCH] scsi: ufs: core: Add fault injection for task abort failures" Link: https://lore.kernel.org/r/[email protected]/ these QEMU changes establish a deterministic closed-loop verification testbed for UFS exception cases (abort successes, abort rejections, transitions, and hardware timeouts). This provides a reliable foundation to set up regular automated CI/CD regression suites, ensuring long-term health and zero regressions for future Linux kernel UFS driver development as well as QEMU UFS emulation. ### Testing & Verification - Style: 0 errors, 0 warnings across all patches via ./scripts/checkpatch.pl. - Emulation Matrix: Verified in ARM64 QEMU Linux kernel environment across 5 scenarios (Abort Success, Abort Failed, In-Transition, TMR Timeout, and Normal I/O) in a single running VM session without rebooting. All cases recovered cleanly according to spec, and subsequent direct I/O read/write data comparisons passed with 100% binary integrity (cmp PASS on /dev/sda). Stanley Jhu (3): hw/ufs: Support MCQ runtime interrupt and queue status registers hw/ufs: Implement Task Management Request (TMR) handling hw/ufs: Add experimental fault injection properties for task abort testing hw/ufs/lu.c | 7 + hw/ufs/trace-events | 5 + hw/ufs/ufs-pci.c | 4 + hw/ufs/ufs-sysbus.c | 4 + hw/ufs/ufs.c | 450 +++++++++++++++++++++++++++++++++++++++++++- hw/ufs/ufs.h | 55 ++++++ include/block/ufs.h | 9 + 7 files changed, 531 insertions(+), 3 deletions(-) -- 2.55.0.979.g7e5102b832-goog
