[PATCH] ufs: invalidate the whole descriptor data segment after a query read

[PATCH] ufs: invalidate the whole descriptor data segment after a query read

[Jorge Ramirez-Ortiz]

ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the
DMA'd response, but a READ DESCRIPTOR response's data segment follows the
UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window.
The tail of a longer descriptor was therefore read from stale cache (the
pre-transfer memset had zeroed it), so its last bytes came back as 0.

This corrupted the last UTF-16 code unit of longer string descriptors:
e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as
"THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit
within the invalidated cache line (serial numbers, etc.) were unaffected.

Invalidate the descriptor region before copying it out.

Tested on the Qualcomm IQ-9075-EVK.

Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem")
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
---
 drivers/ufs/ufs-uclass.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index 6a51f337e47..6ef01f8e4aa 100644
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1008,6 +1008,7 @@ static int ufshcd_copy_query_response(struct ufs_hba *hba)
 		buf_len =
 			be16_to_cpu(hba->dev_cmd.query.request.upiu_req.length);
 		if (likely(buf_len >= resp_len)) {
+			ufshcd_cache_invalidate(descp, resp_len);
 			memcpy(hba->dev_cmd.query.descriptor, descp, resp_len);
 		} else {
 			dev_warn(hba->dev,
-- 
2.54.0

Re: [PATCH] ufs: invalidate the whole descriptor data segment after a query read

[Neha Malcom Francis]

On Fri, 17 Jul 2026 11:30:07 +0200, Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com> wrote:
> ufs: invalidate the whole descriptor data segment after a query read

Reviewed-by: Neha Malcom Francis <n-francis@ti.com>

-- 
Neha Malcom Francis <n-francis@ti.com>

Re: [PATCH] ufs: invalidate the whole descriptor data segment after a query read

[Neil Armstrong via U-Boot]

Hi,

On Fri, 17 Jul 2026 11:30:07 +0200, Jorge Ramirez-Ortiz wrote:
> ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the
> DMA'd response, but a READ DESCRIPTOR response's data segment follows the
> UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window.
> The tail of a longer descriptor was therefore read from stale cache (the
> pre-transfer memset had zeroed it), so its last bytes came back as 0.
> 
> This corrupted the last UTF-16 code unit of longer string descriptors:
> e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as
> "THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit
> within the invalidated cache line (serial numbers, etc.) were unaffected.
> 
> [...]

Thanks, Applied to https://git.u-boot-project.org/u-boot/custodians/neil.armstrong/u-boot-ufs (u-boot-ufs-fixes)

[1/1] ufs: invalidate the whole descriptor data segment after a query read
      https://git.u-boot-project.org/u-boot/custodians/neil.armstrong/u-boot-ufs/-/commit/38bfdf0a770219e2f753023998bc9d0b45254785

-- 
Neil