Re: [PATCH] scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame

[Daniel Fernau]

Follow-up from our earlier note on pinning 6.8.12-4-pve.

We have now been running the HPE MR416i-o Gen11 cluster on Proxmox
kernel 7.0.14-15-pve without the previous megasas_make_prp_nvme
overflow.

Hardware / firmware
- HPE MR416i-o Gen11 (Broadcom PCI 0x1000:0x10e2)
- HPE FW package 52.32.3-6333 / controller FW 5.320.03-4207
- megaraid_sas 07.734.00.00-rc1
- KIOXIA NVMe behind the controller

7.0.14-15-pve includes
"scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame"
(pve-kernel 46a6f4f). That is the driver-side max_hw_sectors cap
Martin suggested and the megaraid equivalent of Damien's
04631f55afc5 ("scsi: mpt3sas: Limit NVMe request size to 2 MiB"),
not Lukasz's original bounds check in megasas_make_prp_nvme().

On this hardware the cap is enough. We no longer need the
max_sectors_kb udev workaround, and we do not see the page-boundary
ptr_sgl fault (RAX=0x200 / 512th PRP slot) under production load.

Thanks,
Daniel
 



On Thursday, September 3rd, 2026 at 5:10 AM, Martin K. Petersen (Oracle) <mkp@xxxxxxxxxx> wrote:

> On Thu, 27 Aug 2026 19:24:24 +0200, Thomas Lamprecht wrote:
> 
> > megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a
> > DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry
> > per NVMe page of the transfer plus one per page of the buffer for the
> > chain pointer. The loop runs until the transfer is described and never
> > checks the buffer bound.
> >
> > max_hw_sectors comes straight from the MDTS the firmware reports for the
> > drive. On drives with a large MDTS the only thing keeping the list inside
> > the buffer was the block layer default of 1280 KiB, which needs 320
> > entries, which fit into a 4 KiB frame as that holds 512. But since commit
> > 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") that default is
> > 4 MiB, and such a transfer needs 1025 entries, so the list runs a full
> > page past the end of the frame:
> >
> > [...]
> 
> Applied to 7.3/scsi-fixes, thanks!
> 
> [1/1] scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
>       https://git.kernel.org/mkp/scsi/c/af8c27375733
> 
> --
> Martin K. Petersen
>