On Thu, 22 Oct 2026 15:45:06 +0800, Stanley Jhu wrote:
> + if (u->active_fault_inject_tag == UFS_FAULT_INJECT_TAG_ANY) {
> + uint8_t op = req->req_upiu.sc.cdb[0];
> +
> + if (op == READ_10 || op == WRITE_10) {
Linux sd switches zoned LUs to 16-byte READ/WRITE
(drivers/scsi/sd_zbc.c:607-609, "READ16/WRITE16/SYNC16 is mandatory
for ZBC devices"). On a zoned LU from the series this one is based on,
TAG_ANY therefore never holds anything. Could READ_16/WRITE_16 be
matched as well, with the LBA from ldq_be_p(&cdb[2])?
> + if (!visit_type_uint32(v, name, &val, errp)) {
> + return;
> + }
Task tags are 8 bits, but any value is accepted here.
"-device ufs,x-fault-inject-tag=300" realizes, and after qom-set to
4096, qom-get returns 4096. Such a tag never matches a request. Could
values above 255, other than UFS_FAULT_INJECT_TAG_NONE and
UFS_FAULT_INJECT_TAG_ANY, be rejected here?
> +const PropertyInfo ufs_prop_fault_inject_mode = {
> + .type = "str",
Optional: the mode could be an enum property. A QEnumLookup with
qdev_propinfo_get_enum/set_enum, as qdev_prop_spdm_trans does
(backends/spdm-socket.c:255-262), replaces ufs_fault_inject_parse_mode(),
ufs_fault_inject_realize(), the get/set/release handlers and the
u->fault_inject_mode copy. I tried it on top of the whole series: 31
insertions and 118 deletions over ufs.c, ufs.h, ufs-pci.c and
ufs-sysbus.c. With .realized_set_allowed = true, qom-set still works
after realize, an unknown name is rejected, and the UFS qtests pass
29/29. It needs hw/core/qdev-prop-internal.h, and
trace_ufs_fault_inject_set_mode would need a small wrapper to stay.
Daejun
