On Wed, 09 Sep 2026 11:11:46 +0800, Stanley Jhu <[email protected]> wrote: > diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c > index 4e22c31f89..ca5f6f2e96 100644 > --- a/hw/ufs/ufs.c > +++ b/hw/ufs/ufs.c > @@ -818,6 +822,111 @@ static void ufs_hce_reset(UfsHc *u) > [ ... skip 63 lines ... ] > + > + if (req) { > + ufs_clear_req(req); > + req->state = UFS_REQUEST_IDLE; > + if (ufs_mcq_req(req)) { > + QTAILQ_INSERT_TAIL(&req->sq->req_list, req, entry);
A successful UFS_ABORT_TASK does not complete MCQ host-side cleanup. The host driver will next issue SQRTCy.ICU, which must post an OCS = ABORTED CQE. Please do not clear and recycle the request before that cleanup completes. > @@ -880,10 +989,16 @@ static void ufs_write_reg(UfsHc *u, hwaddr offset, > uint32_t data, unsigned size) > case A_MCQCONFIG: > u->reg.mcqconfig = data; > break; > - case A_UTRLCLR: > case A_UTMRLDBR: > + ufs_process_tmr(u, data); > + break; > case A_UTMRLCLR: > + u->reg.utmrldbr &= ~data; UTMRLCLR is clear-on-zero, so this has the polarity backwards: zero clears the corresponding UTMRLDBR bit and one leaves it unchanged. This should be `u->reg.utmrldbr &= data`. -- Jeuk Kim <[email protected]>
