In HPB2.0, if pre_req_min_tr_len < transfer_len < pre_req_max_tr_len the driver is expected to send a HPB-WRITE-BUFFER companion to HPB-READ. The upper bound should fit into a single byte, regardless of bMAX_ DATA_SIZE_FOR_HPB_SINGLE_CMD which being an attribute (u32) can be significantly larger. To further illustrate the issue let us consider the following scenario: - SCSI_DEFAULT_MAX_SECTORS is 1024 limiting the IO chunks to 512KB - The OEM changes scsi_host_template .max_sectors to be 2048, which allows a 1M requests: transfer_len = 256 - pre_req_max_tr_len = HPB_MULTI_CHUNK_HIGH = 256 - ufshpb_is_supported_chunk returns true (256 <= 256) - WARN_ON_ONCE(256 > 256) doesn't warn - ufshpb_set_hpb_read_to_upiu cast transfer_len to u8: transfer_len = 0 - the command is failing with illegal request Fixes: 41d8a9333cc9 (scsi: ufs: ufshpb: Add HPB 2.0 support) Signed-off-by: Avri Altman <avri.altman@xxxxxxx> --- drivers/scsi/ufs/ufshpb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ufs/ufshpb.h b/drivers/scsi/ufs/ufshpb.h index c74a6c35a446..6df317dfe034 100644 --- a/drivers/scsi/ufs/ufshpb.h +++ b/drivers/scsi/ufs/ufshpb.h @@ -32,7 +32,7 @@ /* hpb support chunk size */ #define HPB_LEGACY_CHUNK_HIGH 1 #define HPB_MULTI_CHUNK_LOW 7 -#define HPB_MULTI_CHUNK_HIGH 256 +#define HPB_MULTI_CHUNK_HIGH 255 /* hpb vender defined opcode */ #define UFSHPB_READ 0xF8 -- 2.17.1
