UFS 5.0 / JEDEC 220H introduces the AGGREGATED READ query opcode (0x9),
which retrieves an aggregated data packet bundling multiple Descriptors,
Attributes and Flags in a single QUERY RESPONSE UPIU. Such a packet can be
far larger than a single descriptor, so the reserved (device management)
tag gets a dedicated UCD with an enlarged response area.

Patch 1 is a preparatory cleanup that switches the BSG query descriptor
length to unsigned types. Patch 2 adds the aggregated read support.

Changes since v2 (Bart Van Assche):
- Split into a series; new patch 1 switches the BSG query length to
  unsigned types and uses min() instead of min_t(int, ...).
- Folded ufs_bsg_get_query_desc_size() into its only caller.
- Shrank the devman UCD PRDT from SG_ALL to two entries.
- Added WARN_ON_ONCE(slot < 0) in ufshcd_init_lrb().
- Made struct ufs_dev_cmd.tag unsigned (u8).
- Reworded the "multiple of 128" BUILD_BUG_ON comment.
Also capped QUERY_AGGREGATED_MAX_SIZE (4096 -> 4064) plus a static_assert
so the UPIU header and data segment fit the response area, fixing the OOB
read flagged by Sashiko AI.

v2: https://lore.kernel.org/linux-scsi/20260722084819epcms2p49c27fce999e821385f7b5d7ea5a02868@epcms2p4/

Hyeoncheol Jeong (2):
  scsi: ufs: Use unsigned types for the BSG query descriptor length
  scsi: ufs: Add support for the aggregated read query opcode

 drivers/ufs/core/ufs-mcq.c | 14 ++++--
 drivers/ufs/core/ufs_bsg.c | 38 +++++++--------
 drivers/ufs/core/ufshcd.c  | 98 ++++++++++++++++++++++++++++----------
 include/ufs/ufs.h          |  8 ++++
 include/ufs/ufshcd.h       | 20 ++++++++
 include/ufs/ufshci.h       | 18 +++++++
 6 files changed, 148 insertions(+), 48 deletions(-)

-- 
2.25.1