From: Jorge Ramirez-Ortiz Date: Fri, 17 Jul 2026 09:30:07 +0000 (+0200) Subject: ufs: invalidate the whole descriptor data segment after a query read X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=38bfdf0a770219e2f753023998bc9d0b45254785;p=thirdparty%2Fu-boot.git ufs: invalidate the whole descriptor data segment after a query read ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the DMA'd response, but a READ DESCRIPTOR response's data segment follows the UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window. The tail of a longer descriptor was therefore read from stale cache (the pre-transfer memset had zeroed it), so its last bytes came back as 0. This corrupted the last UTF-16 code unit of longer string descriptors: e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as "THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit within the invalidated cache line (serial numbers, etc.) were unaffected. Invalidate the descriptor region before copying it out. Tested on the Qualcomm IQ-9075-EVK. Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem") Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Neha Malcom Francis Link: https://patch.msgid.link/20260717093013.3253643-1-jorge.ramirez@oss.qualcomm.com Signed-off-by: Neil Armstrong --- diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c index 6a51f337e47..6ef01f8e4aa 100644 --- a/drivers/ufs/ufs-uclass.c +++ b/drivers/ufs/ufs-uclass.c @@ -1008,6 +1008,7 @@ static int ufshcd_copy_query_response(struct ufs_hba *hba) buf_len = be16_to_cpu(hba->dev_cmd.query.request.upiu_req.length); if (likely(buf_len >= resp_len)) { + ufshcd_cache_invalidate(descp, resp_len); memcpy(hba->dev_cmd.query.descriptor, descp, resp_len); } else { dev_warn(hba->dev,