kernel/git/next/linux-next.git/drivers/memory, branch master

memory: emif: Replace ASSEMBLY with ASSEMBLER in non-uapi headers

2026-09-04T14:09:46+00:00

While the GCC and Clang compilers already define __ASSEMBLER__ auto- matically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. Let's standardize now on the __ASSEMBLER__ macro to avoid this confusion. Signed-off-by: Thomas Huth Link: https://patch.msgid.link/20260821074412.144248-1-thuth@redhat.com Signed-off-by: Krzysztof Kozlowski

memory: brcmstb_dpfe: validate firmware section sizes

2026-09-04T13:53:16+00:00

The firmware header is read before the image has been shown to contain a complete header. In addition, the final size check adds two firmware-provided u32 section lengths before comparing the result with fw->size, so the addition can wrap. Reject images shorter than the fixed header and checksum before reading the header. Then derive the available payload length with subtraction and require the two declared sections to fill it exactly. Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE") Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260815134559.47888-1-pengpeng@iscas.ac.cn Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Use runtime PM autosuspend after transfers

2026-09-01T15:38:33+00:00

Replace pm_runtime_put() with pm_runtime_put_autosuspend() after manual transfers and direct memory-mapped read/write operations. Flash page programming may be performed as a sequence of closely spaced transfer operations. Calling pm_runtime_put() after each operation allows the runtime PM core to suspend the controller between successive transfers, introducing unnecessary suspend/resume cycles and potentially interrupting multi-step transfer sequences. Use pm_runtime_put_autosuspend() instead so the controller remains active while transfers continue, allowing it to suspend only after an idle period. Signed-off-by: Lad Prabhakar Tested-by: Wolfram Sang Link: https://patch.msgid.link/20260727103449.3188105-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Consolidate command setup register programming

2026-09-01T15:38:32+00:00

Simplify the command setup sequence in xspi_manual_xfer_impl() by combining updates to XSPI_CDCTL0 and XSPI_CDTBUF0. Clear the TRNUM and TRREQ fields in XSPI_CDCTL0 with a single regmap_update_bits() call. Likewise, program the command, command size and address size fields in XSPI_CDTBUF0 with a single regmap_write(), eliminating the subsequent ADDSIZE update. The intermediate write of zero to XSPI_CDABUF0 is also redundant, as the register is immediately programmed with the transfer address. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260727103449.3188105-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Consolidate XSPI_CDTBUF0 updates in read path

2026-09-01T15:38:32+00:00

Program the XSPI_CDTBUF0 fields used by the RPCIF_DATA_IN transfer path through a single regmap_update_bits() call. The existing code updates TRTYPE, DATASIZE, ADDSIZE and LATE using multiple read-modify-write operations on the same register, even though all field values are known before the transfer starts. Build the register mask and value first, then perform a single register update. This reduces register accesses and simplifies the transfer setup without changing functionality. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260727103449.3188105-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Consolidate XSPI_CDTBUF0 updates in write path

2026-09-01T15:38:32+00:00

Program the XSPI_CDTBUF0 TRTYPE, DATASIZE and ADDSIZE fields with a single regmap_update_bits() call in the RPCIF_DATA_OUT transfer path. The existing code updates these fields through three separate read-modify-write operations even though all values are known before the transfer request is issued. Combine the updates into a single register access to reduce overhead and simplify the configuration sequence. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260727103449.3188105-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Move static bridge configurations out of dirmap hot paths

2026-09-01T15:38:31+00:00

Move the initialization of the xSPI Bridge Control Register 0 (XSPI_BMCTL0) and Bridge Configuration Register (XSPI_BMCFG) from the dirmap read and write implementations into the hardware initialization function. The bridge configuration values remain unchanged across sequential dirmap transfers. Keeping these regmap_update_bits() calls inside the hot paths (xspi_dirmap_read_impl and xspi_dirmap_write) introduces significant software overhead and redundant register locking cycles. Statically setting CS0ACC to 0x3 during xspi_hw_init_impl() permanently enables the memory area for both read and write operations. Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260727103449.3188105-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile

2026-09-01T15:38:31+00:00

Add XSPI_CDD1BUF0 to the xSPI regmap volatile register table. XSPI_CDD1BUF0 is a data buffer register used during manual transfers and, like XSPI_CDD0BUF0, its contents are transient and should not be cached by regmap. Mark it as volatile so reads always access the hardware register. Fixes: 687cac9559d8 ("memory: renesas-rpc-if: Add RZ/G3E xSPI support") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar Link: https://patch.msgid.link/20260727103449.3188105-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski

memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

2026-09-01T15:38:29+00:00

A compromised or buggy DCPU coprocessor can make any user who reads world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel stack out-of-bounds read of arbitrary extent. This bounds checks chksum_idx against MSG_FIELD_MAX after reading the response from DCPU message RAM. Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time") Cc: stable@vger.kernel.org Signed-off-by: Justin Chen Assisted-by: Gemini:gemini-3.1-pro-preview cursor Signed-off-by: Danesh Petigara Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260826201500.3000125-3-danesh.petigara@broadcom.com Signed-off-by: Krzysztof Kozlowski

memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset

2026-09-01T15:38:29+00:00

On API v1/v2 boards, the DCPU coprocessor can steer kernel readl_relaxed() and writel_relaxed() to any address within 256 MB of the ioremapped DPFE dmem or regs base. The DCPU firmware provides a 28-bit offset which the driver adds to the ioremap base without any bounds checking in get_msg_ptr(). This allows a compromised DCPU firmware to trick the host kernel into reading or writing arbitrary memory-mapped I/O registers in vmalloc space. When combined with a root-writable sysfs file like dpfe_refresh, it provides an arbitrary MMIO write primitive. Similarly, world-readable sysfs files can be used to leak other devices' register contents. Fix this by recording the resource_size() of the dmem and regs ioremaps at probe time, and rejecting any offset that, along with the largest field accessed (DRAM_VENDOR_ERROR + sizeof(u32)), exceeds the recorded mapping size. Fixes: fee5f1ef6cf7 ("memory: brcmstb: dpfe: support new way of passing data from the DCPU") Cc: stable@vger.kernel.org Signed-off-by: Justin Chen Assisted-by: Gemini:gemini-3.1-pro-preview cursor Signed-off-by: Danesh Petigara Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260826201500.3000125-2-danesh.petigara@broadcom.com Signed-off-by: Krzysztof Kozlowski

kernel/git/next/linux-next.git/drivers/memory, branch master

memory: emif: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers

memory: brcmstb_dpfe: validate firmware section sizes

memory: renesas-rpc-if: Use runtime PM autosuspend after transfers

memory: renesas-rpc-if: Consolidate command setup register programming

memory: renesas-rpc-if: Consolidate XSPI_CDTBUF0 updates in read path

memory: renesas-rpc-if: Consolidate XSPI_CDTBUF0 updates in write path

memory: renesas-rpc-if: Move static bridge configurations out of dirmap hot paths

memory: renesas-rpc-if: Mark XSPI_CDD1BUF0 as volatile

memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset

memory: emif: Replace ASSEMBLY with ASSEMBLER in non-uapi headers