On Wed, 23 Sep 2026 22:48:11 +0800, Stanley Jhu <[email protected]> wrote:
> diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
> index 4d8c641b07..336bdb8718 100644
> --- a/hw/ufs/ufs.c
> +++ b/hw/ufs/ufs.c
> @@ -819,6 +823,119 @@ static void ufs_hce_reset(UfsHc *u)
> [ ... skip 92 lines ... ]
> + UFS_UPIU_TRANSACTION_TASK_RSP;
> + desc.upiu_rsp.rsp_header.flags = 0;
> + desc.upiu_rsp.rsp_header.lun = desc.upiu_req.req_header.lun;
> + desc.upiu_rsp.rsp_header.task_tag =
> + desc.upiu_req.req_header.task_tag;
> + desc.upiu_rsp.rsp_header.response = tm_resp;
tm_resp is a task-management service response for output_param1. Using it
here puts reserved values such as 0x08 in the basic-header Response field.
> + desc.upiu_rsp.output_param1 = cpu_to_be32(tm_resp);
> +
> + if (ufs_addr_write(u, desc_addr, &desc, sizeof(desc))) {
> + continue;
> + }
> +
> + trace_ufs_process_tmr(tm_func, task_tag, tm_resp);
> + u->reg.utmrldbr &= ~(1 << i);
> + completed_mask |= (1 << i);
> + }
> + }
> +
> + if (completed_mask) {
UTMRCS should only be set when a completed UTMRD has its I bit set. As
written, an I=0 polling request can still raise completion status and an IRQ.
--
Jeuk Kim <[email protected]>
