github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

i3c: mipi-i3c-hci: Remove invalid transfer size limit

Browse Source 
The driver derives a maximum transfer size from
HC_CAP_MAX_DATA_LENGTH in HC_CAPABILITIES, but no published version of
the I3C HCI specification defines such a field.

HC_CAPABILITIES reserves Bits[31:8] in HCI v1.0 and Bits[27:22] in HCI
v1.1 and v1.2, so the bits used by HC_CAP_MAX_DATA_LENGTH are reserved
in all released HCI versions.  Neither the HCI nor the I3C TCRI
specifications define a maximum data length capability.

On compliant controllers reserved bits read as zero, making the
computed limit 65536 bytes.  Since struct i3c_xfer.len is u16,
transfers can never reach that size and the resulting -EFBIG check can
never trigger.

Remove the unused capability definition and the dead size check.

The driver's effective limit remains unchanged. HCI specifications
define DATA_LENGTH as a 16-bit field and require larger transfers to be
split across multiple Transfer Descriptors.  The driver already relies
on the core's 16-bit length types elsewhere when constructing
descriptors.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260920151248.46936-14-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Adrian Hunter 2026-09-20 18:12:43 +03:00 committed by Alexandre Belloni
parent de243c3dd2
commit f3bd76ecb0
1 changed files with 0 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/i3c/master/mipi-i3c-hci/core.c
View File

@ -51,7 +51,6 @@
#define HC_CAP_SG_DC_EN BIT(30)
#define HC_CAP_SG_IBI_EN BIT(29)
#define HC_CAP_SG_CR_EN BIT(28)
#define HC_CAP_MAX_DATA_LENGTH GENMASK(24, 22)
#define HC_CAP_CMD_SIZE GENMASK(21, 20)
#define HC_CAP_DIRECT_COMMANDS_EN BIT(18)
#define HC_CAP_MULTI_LANE_EN BIT(15)
@ -473,7 +472,6 @@ static int i3c_hci_i3c_xfers(struct i3c_dev_desc *dev,
struct i3c_hci *hci = to_i3c_hci(m);
struct hci_xfer *xfer;
DECLARE_COMPLETION_ONSTACK(done);
unsigned int size_limit;
int i, last, ret = 0;
dev_dbg(&hci->master.dev, "nxfers = %d", nxfers);
@ -482,13 +480,8 @@ static int i3c_hci_i3c_xfers(struct i3c_dev_desc *dev,
if (!xfer)
return -ENOMEM;
size_limit = 1U << (16 + FIELD_GET(HC_CAP_MAX_DATA_LENGTH, hci->caps));
for (i = 0; i < nxfers; i++) {
xfer[i].data_len = i3c_xfers[i].len;
ret = -EFBIG;
if (xfer[i].data_len >= size_limit)
goto out;
xfer[i].rnw = i3c_xfers[i].rnw;
if (i3c_xfers[i].rnw) {
xfer[i].data = i3c_xfers[i].data.in;