The driver only exposed a CAM SIM. Reading a descriptor, an attribute
or a flag needs a query request, and a UniPro attribute needs a DME
command. The driver built both only for its own setup, so userland
could reach neither.
Add two ioctls on the control node. UFSHCI_PASSTHROUGH_CMD sends a
UPIU the caller built, sizes the request from its transaction code,
and copies the response UPIU back. UFSHCI_PASSTHROUGH_UIC carries the
four attribute commands and refuses the rest, which can drop the link
or power the device off. It keeps the raw argument2 so the caller can
read the result code the device reported, not just a failure.
Validate the input and bound it by what the controller can map. The
descriptor has no request length, so the controller reads it from the
UPIU header, and a header that declares more than was copied in would
reach past the descriptor. The ioctl layer copies output back only on
a zero return. So a command that reached the device is a success even
when it was refused. The caller reads the reason from the response
header, and an answerless failure comes back as EIO. Clear the
response before use so no stale bytes read as a device answer.
Sponsored by: Samsung Electronics