hw/ufs: Support MCQ runtime registers and Task Management Requests

[PATCH v3 0/3] hw/ufs: Support MCQ runtime registers and Task Management Requests
Posted by Stanley Jhu 3 days, 4 hours ago
This patch series implements JEDEC UFSHCI specification compliance for
Task Management Requests (TMR) and Multi-Circular Queue (MCQ) runtime
status and interrupt registers in the QEMU UFS emulator, rebased onto
the latest QEMU master (7074591d7).

Why:
In QEMU UFS emulation, Linux guest error recovery paths (such as SCSI
abort during command timeout) issue Task Management Requests (TMR) via
the UTP Task Management Request List (UTMRL). Furthermore, when MCQ
is enabled, the Linux driver initializes and accesses per-queue runtime
registers (SQnRTC, SQnRTS, SQnCTI, SQnIS, CQnIS, etc.). Currently, QEMU
treats UTMRLDBR and MCQ operational registers as unsupported,
triggering "invalid register offset" warnings and causing SCSI EH aborts
to time out and escalate unnecessarily to full controller resets.
Additionally, aborting an individual in-flight transfer request via TMR
or MCQ queue cleanup requires tracking and cancelling its underlying
SCSIRequest without purging the entire SCSI device.

What:
- Patch 1: Tracks SCSIRequest in UfsRequest and cancels pending
  requests via scsi_req_cancel() in ufs_clear_req() as preparation for
  Task Management Function (TMF) abort and MCQ queue cleanup support.
- Patch 2: Implements MCQ runtime operational registers (queue
  lifecycle control, SQnRTC.ICU cleanup via SQnCTI posting
  UFS_OCS_ABORTED CQE, per-queue interrupt status/enable, and global
  CQES sync).
- Patch 3: Implements Task Management Request handling for UTMRLDBR
  (supporting UFS_QUERY_TASK and UFS_ABORT_TASK for both legacy UTRL
  and MCQ queues, and clear-on-zero UTMRLCLR semantics).

Differences from v2:
- Rebase onto latest QEMU master (7074591d7)
- Frame Patch 1 as TMF preparation and assert(req != NULL) in callbacks
- Drop redundant u->resetting checks and implement SQRTC.ICU cleanup
  using SQnCTI to post UFS_OCS_ABORTED CQEs
- Defer MCQ request recycling in UFS_ABORT_TASK until SQRTC.ICU and fix
  UTMRLCLR clear-on-zero polarity

Tested:
Verified on QEMU ARM64 via qos-test and Linux MCQ EH without UAF.

Stanley Jhu (3):
  hw/ufs: Track SCSIRequest and cancel pending requests in ufs_clear_req
  hw/ufs: Support MCQ runtime interrupt and queue status registers
  hw/ufs: Implement Task Management Request (TMR) handling

 hw/ufs/lu.c         |   8 ++
 hw/ufs/trace-events |   2 +
 hw/ufs/ufs.c        | 246 +++++++++++++++++++++++++++++++++++++++++++-
 hw/ufs/ufs.h        |   1 +
 include/block/ufs.h |  16 +++
 5 files changed, 270 insertions(+), 3 deletions(-)

-- 
2.56.0.rc1.310.g51773c2048-goog