linux-toradex.git/drivers/memory, branch master

memory: stm32_omm: fix child clock leak on set_amcr() error path

2026-09-23T17:57:14+00:00

When the mux is enabled, stm32_omm_configure() enables the two OSPI
child clocks via stm32_omm_toggle_child_clock(dev, true); they are meant
to stay enabled for the device's lifetime and are disabled again in
stm32_omm_remove() and on the devm_of_platform_populate() error path.

However, if the subsequent stm32_omm_set_amcr() call fails, the function
jumps to the "error:" label which only calls pm_runtime_put_sync_suspend()
before returning, leaving the two child clocks enabled. As this happens
during probe, the error is propagated and .remove() is never called, so
the clock enable references are leaked. devm_clk_bulk_get() only releases
the clock handles on unwind, it does not undo clk_prepare_enable().

Disable the child clocks on the set_amcr() error path, mirroring the
cleanup already done on the devm_of_platform_populate() failure path.

Fixes: 8181d061dcff ("memory: Add STM32 Octo Memory Manager driver")
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez 
Link: https://patch.msgid.link/20260917235925.44185-1-diegomancera.dev@gmail.com
Signed-off-by: Krzysztof Kozlowski

memory: emif: Remove const from min_tck allocation type

2026-09-20T15:07:55+00:00

In preparation for making the devm_kmalloc family of allocators type
aware, we need to make sure that the returned type from the allocation
matches the type of the variable being assigned. (Before, the allocator
would always return "void *", which can be implicitly cast to any
pointer type.)

The size was taken from "*pd->min_tck", so the converted allocation type
would be "const struct lpddr2_min_tck *", as "pd->min_tck" points to
const. The allocation is a writable copy assigned to a "void *" and then
memcpy()ed into, so name the unqualified type directly, for a converted
allocation type of "struct lpddr2_min_tck *". As there is no general way
to remove const qualifiers, this keeps the allocation type matching how
the memory is used. No change in allocation size results.

Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
drivers/memory/emif.o

Assisted-by: LLM coccinelle
Signed-off-by: Kees Cook 
Link: https://patch.msgid.link/20260917211253.i.532-kees@kernel.org
Signed-off-by: Krzysztof Kozlowski

memory: mtk-smi: Add MT8189 support

2026-09-15T07:09:20+00:00

Add the MT8189 SMI common, sub-common and LARB platform data.

Enable the GALS clock for the MT8189 SMI sub-common.

Signed-off-by: Zhengnan Chen 
Signed-off-by: Congcong Yao 
Reviewed-by: Yong Wu 
Link: https://patch.msgid.link/20260831-8189-smi-support-v4-2-8ae66dd3eeed@mediatek.com
Signed-off-by: Krzysztof Kozlowski

memory: emif: fix device_node reference leak on np_ddr

2026-09-15T07:08:25+00:00

of_get_memory_device_details() takes a reference on the DDR device
node via of_parse_phandle() and stores it in emif->np_ddr for later
use, but drops that reference without calling of_node_put() on two
error paths: the devm_kzalloc() allocation-failure check and the
is_dev_data_valid() check. Both return NULL immediately, leaking the
node reference each time either failure triggers.

The same reference is also never released on the success path: it is
kept for the life of the bound device (compared against a later
instance's np_ddr in the duplicate-DDR-geometry check) but
emif_remove() never calls of_node_put() on it, leaking it every time
an EMIF device unbinds. of_node_put() on a NULL pointer is a no-op, so
this is also safe for the non-DT get_device_details() path, where
np_ddr is left NULL by devm_kzalloc().

Fixes: e6b42eb6a66c ("memory: emif: add device tree support to emif driver")
Signed-off-by: Miles Krause 
Link: https://patch.msgid.link/20260909-master-v1-1-8800f5647ab2@gmail.com
Signed-off-by: Krzysztof Kozlowski

memory: tegra: Refactor Tegra264 mc-err code

2026-09-15T07:06:34+00:00

The MC and HUB error-logging paths on Tegra264 used large switch
statements that interleaved register offsets, bit positions and
decoding parameters for each error type, which made them hard to read
and review.

Turn the error logging into a more structured implementation:

  - Describe each MCF error type with a tegra264_mc_fault descriptor
    filled in by a small per-type get_offsets() callback, and move the
    register access, client lookup and reporting into a common
    tegra264_mc_report_fault() helper.

  - Describe each HUB error type with a static
    tegra264_hub_error_handler table, since the HUB register offsets
    are fixed on Tegra264.

No functional change intended.

Signed-off-by: Ketan Patil 
Link: https://patch.msgid.link/20260903182520.950555-4-ketanp@nvidia.com
Signed-off-by: Krzysztof Kozlowski

memory: tegra: Parameterise Tegra264 MCF slice bound

2026-09-15T07:06:33+00:00

Replace the hard-coded slice bound check in handle_mcf_irq() with a
TEGRA264_MC_NUM_SLICES define, so the number of MCF slices is named
rather than being an unexplained literal.

Note that although the existing logic is correct, the actual number of
MCF slices for Tegra264 is 5 and not 4. So define TEGRA264_MC_NUM_SLICES
as 5 and update the logic accordingly.

No functional change intended.

Signed-off-by: Ketan Patil 
Link: https://patch.msgid.link/20260903182520.950555-3-ketanp@nvidia.com
Signed-off-by: Krzysztof Kozlowski

memory: tegra: Use named defines for Tegra264 MC apertures

2026-09-15T07:06:33+00:00

The Tegra264 memory controller error interrupts are distributed across
several HUB/HUBC apertures, each accessed like a broadcast channel using
a fixed index. These indices were kept in a bare mc_hubc_aperture_number[]
array, and handle_hub_irq() took a parameter of the same name that
shadowed it.

This driver is only applicable to Tegra264 devices and so this
abstraction is not needed. Replace the array with named
TEGRA264_MC_APERTURE_* defines to simplify the code.

No functional change intended.

Signed-off-by: Ketan Patil 
Link: https://patch.msgid.link/20260903182520.950555-2-ketanp@nvidia.com
Signed-off-by: Krzysztof Kozlowski

memory: exynos5422-dmc: handle clock enable failures

2026-09-11T06:54:19+00:00

Check the return values of clk_prepare_enable() for fout_bpll and
mout_bpll.

If enabling fout_bpll fails, propagate the error. If enabling mout_bpll
fails, disable fout_bpll before returning. This keeps the clock enable
count balanced on probe error paths.

Fixes: 6e7674c3c6df ("memory: Add DMC driver for Exynos5422")
Signed-off-by: Jiawen Liu <1298662399@qq.com>
Reviewed-by: Lukasz Luba 
Link: https://patch.msgid.link/tencent_B0189529F550458590E3BA614EAB800FBF08@qq.com
Signed-off-by: Krzysztof Kozlowski

memory: emif: Replace ASSEMBLY with ASSEMBLER in non-uapi headers

2026-09-04T14:09:46+00:00

While the GCC and Clang compilers already define __ASSEMBLER__ auto-
matically when compiling assembly code, __ASSEMBLY__ is a macro that
only gets defined by the Makefiles in the kernel. This can be very
confusing when switching between userspace and kernelspace coding, or
when dealing with uapi headers that rather should use __ASSEMBLER__
instead. Let's standardize now on the __ASSEMBLER__ macro to avoid
this confusion.

Signed-off-by: Thomas Huth 
Link: https://patch.msgid.link/20260821074412.144248-1-thuth@redhat.com
Signed-off-by: Krzysztof Kozlowski

memory: brcmstb_dpfe: validate firmware section sizes

2026-09-04T13:53:16+00:00

The firmware header is read before the image has been shown to contain a
complete header. In addition, the final size check adds two
firmware-provided u32 section lengths before comparing the result with
fw->size, so the addition can wrap.

Reject images shorter than the fixed header and checksum before reading
the header. Then derive the available payload length with subtraction and
require the two declared sections to fill it exactly.

Fixes: 2f330caff577 ("memory: brcmstb: Add driver for DPFE")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou 
Link: https://patch.msgid.link/20260815134559.47888-1-pengpeng@iscas.ac.cn
Signed-off-by: Krzysztof Kozlowski