fix(ufs): correct query response UPIU size

While adding return value checking to the TF-A UFS driver in the BaseV2
TF-A checkout, we found that QUERY_READ_DESC requests allocate an
undersized response UPIU buffer.

TF-A sets the requested descriptor length in the Query UPIU, but leaves
the UTRD response UPIU size at the fixed Query Response header size. For
a read descriptor response, the device returns descriptor data in the
Query Response UPIU Data Segment, so the response UPIU size must include
the descriptor payload length.

See JEDEC JESD220G, Table 10.49, Read Descriptor field d), which defines
LENGTH as the number of bytes returned in response to the Query Request
UPIU, and field e), which defines the Data Segment as containing the
descriptor data.

Change-Id: I4063d94044016c68589d772a9219c178380dc082
Signed-off-by: Nick Wroblewski <Nick.Wroblewski@arm.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/drivers/ufs/ufs.c b/drivers/ufs/ufs.c
index 33ceb2638..3b6ceeefb 100644
--- a/drivers/ufs/ufs.c
+++ b/drivers/ufs/ufs.c
@@ -549,6 +549,7 @@ static int ufs_prepare_query(utp_utrd_t *utrd, uint8_t op, uint8_t idn,
 	case QUERY_READ_DESC:
 		query_upiu->query_func = QUERY_FUNC_STD_READ;
 		query_upiu->ts.desc.length = htobe16(length);
+		utrd->size_resp_upiu = ALIGN_8(sizeof(query_resp_upiu_t) + length);
 		break;
 	case QUERY_WRITE_DESC:
 		query_upiu->query_func = QUERY_FUNC_STD_WRITE;