ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the
DMA'd response, but a READ DESCRIPTOR response's data segment follows the
UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window.
The tail of a longer descriptor was therefore read from stale cache (the
pre-transfer memset had zeroed it), so its last bytes came back as 0.
This corrupted the last UTF-16 code unit of longer string descriptors:
e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as
"THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit
within the invalidated cache line (serial numbers, etc.) were unaffected.
Invalidate the descriptor region before copying it out.
Tested on the Qualcomm IQ-9075-EVK.
Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem")
Signed-off-by: Jorge Ramirez-Ortiz <[email protected]>
---
drivers/ufs/ufs-uclass.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index 6a51f337e47..6ef01f8e4aa 100644
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1008,6 +1008,7 @@ static int ufshcd_copy_query_response(struct ufs_hba *hba)
buf_len =
be16_to_cpu(hba->dev_cmd.query.request.upiu_req.length);
if (likely(buf_len >= resp_len)) {
+ ufshcd_cache_invalidate(descp, resp_len);
memcpy(hba->dev_cmd.query.descriptor, descp, resp_len);
} else {
dev_warn(hba->dev,
--
2.54.0
