From 38bfdf0a770219e2f753023998bc9d0b45254785 Mon Sep 17 00:00:00 2001 From: Jorge Ramirez-Ortiz Date: Fri, 17 Jul 2026 11:30:07 +0200 Subject: ufs: invalidate the whole descriptor data segment after a query read ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the DMA'd response, but a READ DESCRIPTOR response's data segment follows the UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window. The tail of a longer descriptor was therefore read from stale cache (the pre-transfer memset had zeroed it), so its last bytes came back as 0. This corrupted the last UTF-16 code unit of longer string descriptors: e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as "THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit within the invalidated cache line (serial numbers, etc.) were unaffected. Invalidate the descriptor region before copying it out. Tested on the Qualcomm IQ-9075-EVK. Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem") Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Neha Malcom Francis Link: https://patch.msgid.link/20260717093013.3253643-1-jorge.ramirez@oss.qualcomm.com Signed-off-by: Neil Armstrong --- drivers/ufs/ufs-uclass.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c index 6a51f337e47..6ef01f8e4aa 100644 --- a/drivers/ufs/ufs-uclass.c +++ b/drivers/ufs/ufs-uclass.c @@ -1008,6 +1008,7 @@ static int ufshcd_copy_query_response(struct ufs_hba *hba) buf_len = be16_to_cpu(hba->dev_cmd.query.request.upiu_req.length); if (likely(buf_len >= resp_len)) { + ufshcd_cache_invalidate(descp, resp_len); memcpy(hba->dev_cmd.query.descriptor, descp, resp_len); } else { dev_warn(hba->dev, -- cgit v1.3.1