This patch series builds directly on top of the recently reviewed patch:
"[PATCH v3] hw/ufs: Reset controller and MCQ state on HCE transition to 0"
(Message-ID: <20260902081610.2290123-1-stanleyjhu@google.com>)
Based-on: <20260902081610.2290123-1-stanleyjhu@google.com>

### Background & Motivation
When running upstream Linux kernel UFS driver error recovery and task aborts
(e.g., ufshcd_abort() or ufshcd_mcq_abort()), Linux interacts with UFS Multi-
Circular Queue (MCQ) runtime registers and issues UTP Task Management Requests
(TMR) via UTMRLDBR. Currently in QEMU:
1. Writing to MCQ operational registers (SQnRTC, SQnCTI, SQnIS, SQnIE, CQnIS,
   CQnIE, CQnIACR) logs "invalid register offset" warnings.
2. TMR registers (UTMRLDBR, UTMRLCLR, UTMRLRSR) are unsupported. Task aborts
   time out and unnecessarily escalate to full device or host resets.
3. When task abort cancels an in-flight command, lack of SCSIRequest tracking
   presents Use-After-Free (UAF) hazards during asynchronous block AIO callbacks.

### Series Overview
- Patch 1 (hw/ufs: Support MCQ runtime interrupt and queue status registers):
  Implements UFSHCI 5.2.1/5.6 per-queue runtime registers using QEMU REG32/FIELD
  macros. Implements SQSTART/SQSTOP queue gating, SQ_ICU queue cleanup reporting,
  and W1C interrupt handling. Dynamically recalculates active CQ interrupts to
  clear global IS.CQES, preventing virtual interrupt storms. Cleans operational
  registers during HCE 1 -> 0 while preserving MCQCONFIG.MAC capability.

- Patch 2 (hw/ufs: Implement Task Management Request (TMR) handling):
  Implements Task Management Request processing via UTMRLDBR. Tracks sreq in
  UfsRequest and safely cancels pending SCSIRequests via scsi_req_cancel() to
  eliminate UAF hazards. Supports dual-queue tag lookups across legacy UTRL and
  MCQ queues. For UFS_QUERY_TASK, returns FUNCTION SUCCEEDED (0x08) if the
  task is pending in the device/controller, and FUNCTION COMPLETE (0x00) if
  the task does not exist, adhering strictly to SAM-5 and JEDEC specifications.
  Latches pending doorbell bits in utmrldbr upon UTMRLDBR write per UFSHCI 5.2.1
  Section 5.3.3. Preserves dword_2 header OCS masks and returns completion
  codes in both response and output_param1 to satisfy both JEDEC specifications
  and Linux kernel driver validation. Clears TMR registers during HCE reset.

- Patch 3 (hw/ufs: Add experimental fault injection properties for task abort testing):
  Adds experimental QOM properties x-hold-tag and x-hold-mode to ufs-pci and
  ufs-sysbus devices. Decouples UFS_HOLD_TAG_NONE (0xffffffff) to preserve Tag 0
  testing and UFS_HOLD_TAG_ANY (0xfffffffe) to automatically sniff target direct
  I/O (READ_10/WRITE_10 with LBA >= 512) while allowing guest boot metadata
  requests to proceed unimpeded. Supports runtime dynamic modification via QOM
  (qom-set / qom-get) on realized devices, enabling continuous multi-case CI
  testing in a single running VM without reboots.

### CI/CD Closed-Loop & Regression Prevention Vision
Together with the companion Linux kernel patch:
  "[PATCH] scsi: ufs: core: Add fault injection for task abort failures"
  Link: https://lore.kernel.org/r/20260903235308.1240963-1-stanleyjhu@google.com/
these QEMU changes establish a deterministic closed-loop verification testbed
for UFS exception cases (abort successes, abort rejections, transitions, and
hardware timeouts). This provides a reliable foundation to set up regular
automated CI/CD regression suites, ensuring long-term health and zero regressions
for future Linux kernel UFS driver development as well as QEMU UFS emulation.

### Testing & Verification
- Style: 0 errors, 0 warnings across all patches via ./scripts/checkpatch.pl.
- Emulation Matrix: Verified in ARM64 QEMU Linux kernel environment across 5
  scenarios (Abort Success, Abort Failed, In-Transition, TMR Timeout, and
  Normal I/O) in a single running VM session without rebooting. All cases
  recovered cleanly according to spec, and subsequent direct I/O read/write data
  comparisons passed with 100% binary integrity (cmp PASS on /dev/sda).

Stanley Jhu (3):
  hw/ufs: Support MCQ runtime interrupt and queue status registers
  hw/ufs: Implement Task Management Request (TMR) handling
  hw/ufs: Add experimental fault injection properties for task abort
    testing

 hw/ufs/lu.c         |   7 +
 hw/ufs/trace-events |   5 +
 hw/ufs/ufs-pci.c    |   4 +
 hw/ufs/ufs-sysbus.c |   4 +
 hw/ufs/ufs.c        | 450 +++++++++++++++++++++++++++++++++++++++++++-
 hw/ufs/ufs.h        |  55 ++++++
 include/block/ufs.h |   9 +
 7 files changed, 531 insertions(+), 3 deletions(-)

-- 
2.55.0.979.g7e5102b832-goog