Re: [PATCH 3/3] scsi: ufs: core: Clear stale UIC result byte before peer DME retries

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: ufs: dme_set retry loop reuses potentially corrupted argument3
--

commit b7bd98803047d25927dcd2349ce8724199680d23
Author: Stanley Jhu <stanleyjhu@google.com>

scsi: ufs: core: Clear stale UIC result byte before peer DME retries

Peer DME get and set retry a failed attempt with the same struct
uic_command. This commit clears the result byte in argument2 before
each attempt to prevent transient failures from becoming hard failures
due to stale error codes.

Fixes: 64238fbd15ea ("scsi: ufs: add retries to dme_peer get and set attribute")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>

> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
> index cc75384c65021..1f254402d3b4b 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -4398,6 +4398,7 @@ int ufshcd_dme_set_attr(struct ufs_hba *hba, u32 attr_sel,
>  	int retries = UFS_UIC_COMMAND_RETRIES;
>  
>  	do {
> +		uic_cmd.argument2 &= ~MASK_UIC_COMMAND_RESULT;

[Severity: Medium]
When ufshcd_send_uic_cmd() fails, does the completion handler overwrite
argument3?

Looking at ufshcd_uic_cmd_compl(), it appears argument3 is unconditionally
updated with the hardware register's contents:

ufshcd_uic_cmd_compl() {
	...
	/* Store the DME attribute value in cmd->argument3. */
	cmd->argument3 = ufshcd_readl(hba, REG_UIC_COMMAND_ARG_3);
	...
}

Since uic_cmd.argument3 is initialized to mib_val only once outside the
retry loop in ufshcd_dme_set_attr(), can this regression cause a subsequent
retry to write whatever value the hardware left in the register during the
failure?

Should uic_cmd.argument3 be restored to mib_val before retrying, similar
to how argument2 is cleared here?

>  		/* for peer attributes we retry upon failure */
>  		ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
>  		if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013102913.948718-1-stanleyjhu@google.com?part=3