This series adds support for Task Management Requests (TMR) and Multi-Circular Queue (MCQ) runtime status, interrupt, and queue cleanup operations in the QEMU UFS emulator.
Why: Linux UFS error recovery issues Task Management Requests (TMR) via the UTP Task Management Request List (UTMRL). In MCQ mode, the driver also uses per-queue operational registers (SQnRTC, SQnRTS, SQnCTI, CQnIS) to stop queues and clean up aborted tasks, and nullifies unfetched SQEs by setting Command Type to 0xF. QEMU does not yet model these paths or track per-request SCSIRequest pointers needed to cancel individual in-flight commands. Per-SQ interrupt status/enable bits (SQIS.SSS/SUS, SQIE, and IS.SQES) remain unmodeled. What: - Patch 1: Track SCSIRequest in UfsRequest and cancel it in ufs_clear_req(). - Patch 2: Implement MCQ runtime operational registers and SQnRTC.ICU cleanup. - Patch 3: Implement UTMRL doorbell and TMR handling (QUERY_TASK and ABORT_TASK). - Patch 4: Skip nullified MCQ SQEs (CT = 0xF) and post CQEs with UFS_OCS_ABORTED. Differences from v3: - Report SQRTS.RTC (0..3) and preserve SQRTS.CUS across SQ_START (Jeuk) - Separate TMR rsp_header.response from output_param1 and gate IS.UTMRCS on the UTMRD I-bit (Jeuk) - Drop non-spec MMIO configuration register resets in ufs_hce_reset() - Complete nullified MCQ SQEs (CT = 0xF) with UFS_OCS_ABORTED Tested: Verified on QEMU ARM64 with qos-test and Linux guest MCQ TMR abort, SQ cleanup, and host reset. Stanley Jhu (4): hw/ufs: Track SCSIRequest and cancel pending requests in ufs_clear_req hw/ufs: Support MCQ runtime interrupt and queue status registers hw/ufs: Implement Task Management Request (TMR) handling hw/ufs: Skip nullified MCQ submission queue entries with OCS_ABORTED hw/ufs/lu.c | 8 ++ hw/ufs/trace-events | 2 + hw/ufs/ufs.c | 268 +++++++++++++++++++++++++++++++++++++++++++- hw/ufs/ufs.h | 1 + include/block/ufs.h | 17 +++ 5 files changed, 292 insertions(+), 4 deletions(-) -- 2.56.0.rc1.315.gc6ed9934b7-goog
