ufshci: read UIC command results while holding the lock

The UIC result registers (UICCMDARG2/3) are only valid between a
command's completion and the next command's submission. They were read
after uic_cmd_lock was dropped, so a concurrent UIC submitter could
overwrite them in between. Read them into locals before releasing the
lock.

Also mask the generic error code to its [7:0] field when checking it,
so unrelated bits in UICCMDARG2 (such as the attribute set type echoed
for DME_SET) cannot be mistaken for an error.

Sponsored by:           Samsung Electronics
Reviewed by:		imp (mentor)
Differential Revision:	https://reviews.freebsd.org/D58667

1 files changed, 9 insertions, 3 deletions

diff --git a/sys/dev/ufshci/ufshci_uic_cmd.c b/sys/dev/ufshci/ufshci_uic_cmd.c
index 03ea8b2ba9f1..45ded2a120c6 100644
--- a/sys/dev/ufshci/ufshci_uic_cmd.c
+++ b/sys/dev/ufshci/ufshci_uic_cmd.c
@@ -170,7 +170,7 @@ ufshci_uic_send_cmd(struct ufshci_controller *ctrlr,
     struct ufshci_uic_cmd *uic_cmd, uint32_t *return_value)
 {
 	int error;
-	uint32_t config_result_code;
+	uint32_t config_result_code, result_value;
 
 	mtx_lock(&ctrlr->uic_cmd_lock);
 
@@ -188,12 +188,18 @@ ufshci_uic_send_cmd(struct ufshci_controller *ctrlr,
 
 	error = ufshci_uic_wait_cmd(ctrlr, uic_cmd);
 
+	/* The result registers stay valid only until the next command. */
+	if (error == 0) {
+		config_result_code = UFSHCIV(UFSHCI_UICCMDARG2_REG_ERROR_CODE,
+		    ufshci_mmio_read_4(ctrlr, ucmdarg2));
+		result_value = ufshci_mmio_read_4(ctrlr, ucmdarg3);
+	}
+
 	mtx_unlock(&ctrlr->uic_cmd_lock);
 
 	if (error)
 		return (ENXIO);
 
-	config_result_code = ufshci_mmio_read_4(ctrlr, ucmdarg2);
 	if (config_result_code) {
 		ufshci_printf(ctrlr,
 		    "Failed to send UIC command (Opcode: 0x%x"
@@ -210,7 +216,7 @@ ufshci_uic_send_cmd(struct ufshci_controller *ctrlr,
 	}
 
 	if (return_value != NULL)
-		*return_value = ufshci_mmio_read_4(ctrlr, ucmdarg3);
+		*return_value = result_value;
 
 	return (0);
 }