From nobody Mon Aug 10 02:31:31 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hJJfX3S5Dz6pVG0 for ; Mon, 10 Aug 2026 02:31:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hJJfW5n7yz3yv9 for ; Mon, 10 Aug 2026 02:31:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786329091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Jfm/3nYLMSvL69UgXOw7Dz3AsNYRSBCxbKxb4V26Ujg=; b=QDSgtZ7PjGu0CRM6K7XBO7L5dSgOXGUT4bjw5gE2uXJ0FcTDkJFMBcQdPOEXniLXID+3JJ 5gFy0a1CVVl3dOCFJ/RJfj1/a7ON8D/VoZUWYy4JEJpdi9HKvfnPMVSZIeL7dl1+zOPsHE 9OUyYsllrmwkqg+wJpF743+ZwzC7HSD+lFi9ukd765wqiTuDijJLXjeVvAFeJwzsea+OF/ KB5PE97IcmpVppJnjxVlmPx51IhQ7rFwcsDLm/sD8dnlcOCURwnw2RWrPHvRTYTpugCRAe pFc3ayZLQO+w6RGGdA2+9Ds8g1CK5Og5uYlTLwtX8dr/lrErxoBhiVl5Q1Mb0A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786329091; a=rsa-sha256; cv=none; b=mXOFMEZPiNnJINnmSKLEvQkQyqRwa5sgTxOq3QPcmgyCfNNcOTDT8EapbjrlYH9eUFclky /vGHVb5iooNqRPGUDf1jgct2R9lhZkjNAzjG+BSuZ8UhTC2FN6Q9PY+aiVtc1UzaoWBOSV d9CP6l/Kj/F0js+CADTMPh3ui5TSIwDtewULMxqvBCjnEOxuBUbSRoLEG124ryoQ2fvQjC CLnyYCY6GywVb3cC6WrKnZBIuetMF+tuZeYmITZQtBfEAE4x6XVAN1/QbYMO8enLXFjFVs wafXBT5uJf/qasPLktDN8bR3t2maHJ/6gYoRd1DSLRFWi7wscd87C9F3xlfDuQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786329091; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Jfm/3nYLMSvL69UgXOw7Dz3AsNYRSBCxbKxb4V26Ujg=; b=MPJaLaoalpOS2nUH09tndFOJQyA5BbKMd93BRXFjAKl09ro+nEe3gvvxex79CwJ4/3+M5x 5dlKXRFxJYOQVVNkNgvM0J7r2r4zJmZUWlHNAqXFywWMAHFR09rAwCbGlBVJ8K3t6XjybG f3pG8Xq5hkyvkvPADHaiOrtLkOLSYV+cAGmlDKTE1Xx20dOXX7OB5hT+LOcCtw8H90WS17 m6fiRbKlRZElG1fUt4Eh3Cixlvuby0OLixGFjTrXKt7DKmuM14vokdVhTOBAY0Zwrbo22T Y3Xxpw4sOm5b1PH2DC+Kmdv3/hWYU4PLctqLqh1gwS8C+C7Rbajz/9mSRtZJXQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hJJfW3WQfzqjY for ; Mon, 10 Aug 2026 02:31:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f0a2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 10 Aug 2026 02:31:31 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jaeyoon Choi Subject: git: c686e7d3b0d3 - main - ufshci: check completions under the queue lock List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c686e7d3b0d315c358be81b4a1151711213d998d Auto-Submitted: auto-generated Date: Mon, 10 Aug 2026 02:31:31 +0000 Message-Id: <6a793803.1f0a2.1f3ff227@gitrepo.freebsd.org> The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=c686e7d3b0d315c358be81b4a1151711213d998d commit c686e7d3b0d315c358be81b4a1151711213d998d Author: Jaeyoon Choi AuthorDate: 2026-08-10 01:49:31 +0000 Commit: Jaeyoon Choi CommitDate: 2026-08-10 02:28:53 +0000 ufshci: check completions under the queue lock The completion scan held only the recovery lock. The submit path sets a slot to SCHEDULED and then rings the doorbell, both under the queue lock. A scan running between those two steps saw a SCHEDULED slot with a clear doorbell and completed a command the device had not started. The command failed with OCS 0xf, and a reused slot could return wrong read data. Check the slot state and the doorbell under the queue lock. The submit path holds it across both steps, so a half-submitted slot can no longer be seen. Found with fio randrw verify on QEMU. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58668 --- sys/dev/ufshci/ufshci_req_sdb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c index 9f3a2a866ae0..80c4e53230e3 100644 --- a/sys/dev/ufshci/ufshci_req_sdb.c +++ b/sys/dev/ufshci/ufshci_req_sdb.c @@ -584,16 +584,23 @@ ufshci_req_sdb_process_cpl(struct ufshci_req_queue *req_queue) BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE); for (slot = 0; slot < req_queue->num_entries; slot++) { + bool completed; + tr = hwq->act_tr[slot]; KASSERT(tr, ("there is no tracker assigned to the slot")); /* * When the response is delivered from the device, the doorbell - * is cleared. + * is cleared. Check it under qlock so that a slot whose + * doorbell write is still in flight in the submit path is not + * mistaken for a completed one. */ - if (tr->slot_state == UFSHCI_SLOT_STATE_SCHEDULED && + mtx_lock(&hwq->qlock); + completed = tr->slot_state == UFSHCI_SLOT_STATE_SCHEDULED && req_queue->qops.is_doorbell_cleared(req_queue->ctrlr, - slot)) { + slot); + mtx_unlock(&hwq->qlock); + if (completed) { ufshci_req_queue_complete_tracker(tr); done = true; }