ufs: invalidate the whole descriptor data segment after a query read

ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the
DMA'd response, but a READ DESCRIPTOR response's data segment follows the
UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window.
The tail of a longer descriptor was therefore read from stale cache (the
pre-transfer memset had zeroed it), so its last bytes came back as 0.

This corrupted the last UTF-16 code unit of longer string descriptors:
e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as
"THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit
within the invalidated cache line (serial numbers, etc.) were unaffected.

Invalidate the descriptor region before copying it out.

Tested on the Qualcomm IQ-9075-EVK.

Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem")
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Neha Malcom Francis <n-francis@ti.com>
Link: https://patch.msgid.link/20260717093013.3253643-1-jorge.ramirez@oss.qualcomm.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>

diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index 6a51f337e47eed5158e37f8e42fbe94fcf63206e..6ef01f8e4aa7a5be5ce99f49e823d34a47de6ff1 100644 (file)
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1008,6 +1008,7 @@ static int ufshcd_copy_query_response(struct ufs_hba *hba)
                buf_len =
                        be16_to_cpu(hba->dev_cmd.query.request.upiu_req.length);
                if (likely(buf_len >= resp_len)) {
+                       ufshcd_cache_invalidate(descp, resp_len);
                        memcpy(hba->dev_cmd.query.descriptor, descp, resp_len);
                } else {
                        dev_warn(hba->dev,