Re: [PATCH] scsi: ufs: core: Add fault injection for task abort failures

[Stanley Jhu]

On 9/18/26 6:08 PM, Peter Wang (王信友) wrote:
> The task-abort-fail injection bypasses ufshcd_issue_tm_cmd.
> However, ufshcd_issue_tm_cmd can return different results that
> involve the device and the underlying hardware. Because each result
> may require a different handling flow, a pure injection cannot cover
> all of these error paths?

Agreed. Short-circuiting ufshcd_try_to_abort_task() with -EIO bypasses
ufshcd_issue_tm_cmd() entirely and does not exercise the distinct TMR
response codes or hardware timeout paths.

When re-checking the call graph on an unmodified upstream kernel, there
is an even more fundamental problem with hooking
ufshcd_try_to_abort_task():
- ufs_fail_completion() is only called in ufshcd_transfer_req_compl()
  (the legacy single-doorbell completion path) and never in the MCQ
  completion path (ufshcd_mcq_poll_cqe_lock()), so timeout_inject
  cannot trigger ufshcd_mcq_abort() under MCQ.
- Under single-doorbell mode, the controller has already cleared the
  doorbell bit by the time the block-layer timeout fires, so
  ufshcd_abort() hits !(reg & (1 << tag)), completes the command, and
  returns before ever reaching ufshcd_try_to_abort_task().

Thanks,
Stanley