starred/qemu-qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:46:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

hw/ufs: Populate cqe.task_tag for UFSHCI 4.1 tag decoding

Browse Source 
In UFSHCI 4.1 the MCQ completion queue entry carries the request tag in
the cqe.task_tag field (DW5), whereas 4.0 hosts derive it from the UTP
command descriptor base address. The device reports version 4.1 in the VER
register but left task_tag/lun zero in the completion path, so a
4.1-compliant host reads tag 0 for every completion and cannot match it to
the outstanding request.

Add the task_tag/lun/iid fields to UfsCqEntry per the UFSHCI 4.1 CQE
layout and populate them from the request UPIU header.

For example, the Linux ufshcd_mcq_get_tag() uses cqe.task_tag for
version >= 4.1, so without this SCSI commands hung (e.g. INQUIRY to the
device W-LUN) while device-management commands still completed.

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
This commit is contained in:
Jeuk Kim
2026-06-26 17:04:17 +09:00
parent e7644f123b
commit 20c03709b3
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
hw/ufs/ufs.c
View File

@@ -520,6 +520,12 @@ static void ufs_mcq_process_cq(void *opaque)
req->cqe.prdt_off = cpu_to_le16(prdt_off);
req->cqe.status = status;
req->cqe.error = 0;
/*
* From UFSHCI 4.1 the host derives the request tag from cqe.task_tag
* rather than decoding it from utp_addr.
*/
req->cqe.task_tag = req->req_upiu.header.task_tag;
req->cqe.lun = req->req_upiu.header.lun;
ret = ufs_addr_write(u, cq->addr + tail, &req->cqe, sizeof(req->cqe));
if (ret) {

6
include/block/ufs.h
View File

@@ -1333,7 +1333,11 @@ typedef struct QEMU_PACKED UfsCqEntry {
uint8_t status;
uint8_t error;
uint16_t rsvd1;
uint32_t rsvd2[3];
uint8_t task_tag;
uint8_t lun;
uint8_t iid_ext_iid;
uint8_t rsvd2;
uint32_t rsvd3[2];
} UfsCqEntry;
static inline void _ufs_check_size(void)