This patch series adds experimental fault injection properties (x-hold-tag
and x-hold-mode) to the QEMU UFS emulator to facilitate end-to-end testing
of host driver error handling, task aborts, and power management recovery.

Based-on: <20260909031146.1646684-1-stanleyjhu@google.com>

Why:
In Linux kernel UFS driver development and regression testing, reproducing
hardware edge cases -- such as task abort timeouts, device abort rejects,
grace-period command completions in transition, and Start Stop Unit (SSU)
power management timeouts -- requires deterministic hardware fault injection.
Standard emulated storage completes requests in microseconds, leaving host
driver error escalation paths unexercised during automated CI/CD testing.

What:
- Patch 1: Implements core fault injection properties x-hold-tag and
  x-hold-mode, supporting task abort testing modes ("abort-success",
  "abort-failed", "in-transition", "timeout") with dynamic QOM setters
  (realized_set_allowed = true) for live QMP control without rebooting.
- Patch 2: Extends x-hold-mode with "ssu-timeout" mode, intercepting
  SCSI START_STOP (0x1B) commands to test host driver power management
  suspend-to-idle and freeze recovery.

Differences from v1:
- Split into a separate series based on the production TMR and MCQ series.
- Split into 2 logical patches: Patch 1 introduces the core fault injection
  framework for task abort testing (matching the upstream companion Linux
  kernel patch); Patch 2 extends the framework with ssu-timeout mode for
  power management recovery testing.

Tested:
- Verified with the companion Linux kernel patch:
  Link: https://lore.kernel.org/r/20260903235308.1240963-1-stanleyjhu@google.com/
- Verified full 5-case fault injection matrix (Abort Success, Abort Reject,
  In-Transition, Abort Timeout, and Normal I/O) in a single running VM
  session without reboot via QMP.
- Verified SSU timeout fault injection under rtcwake freeze with 100% data
  integrity (cmp) on /dev/sda post-recovery.
- Passes ./scripts/checkpatch.pl with 0 errors and 0 warnings.

Stanley Jhu (2):
  hw/ufs: Add experimental fault injection properties for task abort
    testing
  hw/ufs: Add ssu-timeout mode for power management recovery testing

 hw/ufs/trace-events |   3 +
 hw/ufs/ufs-pci.c    |   4 +
 hw/ufs/ufs-sysbus.c |   4 +
 hw/ufs/ufs.c        | 306 ++++++++++++++++++++++++++++++++++++++++++++++++---
 hw/ufs/ufs.h        |  55 ++++++++++
 5 files changed, 357 insertions(+), 15 deletions(-)

-- 
2.55.0.1007.g17ff1f9808-goog