From f133bd4b5daf71bccdde0ad1a4f47fac76a6bfb1 Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Tue, 5 May 2026 13:12:58 +0000 Subject: [PATCH 01/12] firmware: samsung: acpm: Fix cross-thread RX length corruption Sashiko identified a cross-thread RX length corruption bug when reviewing the thermal addition to ACPM [1]. When multiple threads concurrently send IPC requests, the ACPM polling mechanism can encounter responses belonging to other threads. To drain the queue, the driver saves these concurrent responses into an internal cache (`rx_data->cmd`) to be retrieved later by the owning thread. Previously, the driver incorrectly used `xfer->rxcnt` (the expected receive length of the *current* polling thread) when copying data for *other* threads into this cache. If the threads expected responses of different lengths, this resulted in buffer underflows (leading to reads of uninitialized memory) or potential buffer overflows. Fix this by replacing the boolean `response` flag in `struct acpm_rx_data` with `rxcnt`, caching the exact expected receive length for each specific transaction during transfer preparation. Use this cached length when saving concurrent responses. Consequently, ensure that `xfer->rxcnt` is explicitly zeroed in driver helpers (e.g., `acpm_dvfs_set_xfer`) for fire-and-forget messages to prevent uninitialized stack garbage from being interpreted as a massive expected receive length. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Reported-by: Titouan Ameline de Cadeville Closes: https://lore.kernel.org/r/20260426210255.73674-1-titouan.ameline@gmail.com/ Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-1-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm-dvfs.c | 3 +++ drivers/firmware/samsung/exynos-acpm.c | 15 ++++++++------- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm-dvfs.c b/drivers/firmware/samsung/exynos-acpm-dvfs.c index 06bdf62dea1f..fdea7aa24ca0 100644 --- a/drivers/firmware/samsung/exynos-acpm-dvfs.c +++ b/drivers/firmware/samsung/exynos-acpm-dvfs.c @@ -31,6 +31,9 @@ static void acpm_dvfs_set_xfer(struct acpm_xfer *xfer, u32 *cmd, size_t cmdlen, if (response) { xfer->rxcnt = cmdlen; xfer->rxd = cmd; + } else { + xfer->rxcnt = 0; + xfer->rxd = NULL; } } diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 16c46ed60837..e95edc350efa 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -104,12 +104,12 @@ struct acpm_queue { * * @cmd: pointer to where the data shall be saved. * @n_cmd: number of 32-bit commands. - * @response: true if the client expects the RX data. + * @rxcnt: expected length of the response in 32-bit words. */ struct acpm_rx_data { u32 *cmd; size_t n_cmd; - bool response; + size_t rxcnt; }; #define ACPM_SEQNUM_MAX 64 @@ -199,7 +199,7 @@ static void acpm_get_saved_rx(struct acpm_chan *achan, const struct acpm_rx_data *rx_data = &achan->rx_data[tx_seqnum - 1]; u32 rx_seqnum; - if (!rx_data->response) + if (!rx_data->rxcnt) return; rx_seqnum = FIELD_GET(ACPM_PROTOCOL_SEQNUM, rx_data->cmd[0]); @@ -256,7 +256,7 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) seqnum = rx_seqnum - 1; rx_data = &achan->rx_data[seqnum]; - if (rx_data->response) { + if (rx_data->rxcnt) { if (rx_seqnum == tx_seqnum) { __ioread32_copy(xfer->rxd, addr, xfer->rxcnt); rx_set = true; @@ -268,7 +268,8 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) * clear yet the bitmap. It will be cleared * after the response is copied to the request. */ - __ioread32_copy(rx_data->cmd, addr, xfer->rxcnt); + __ioread32_copy(rx_data->cmd, addr, + rx_data->rxcnt); } } else { clear_bit(seqnum, achan->bitmap_seqnum); @@ -380,8 +381,8 @@ static void acpm_prepare_xfer(struct acpm_chan *achan, /* Clear data for upcoming responses */ rx_data = &achan->rx_data[achan->seqnum - 1]; memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd); - if (xfer->rxd) - rx_data->response = true; + /* zero means no response expected */ + rx_data->rxcnt = xfer->rxcnt; /* Flag the index based on seqnum. (seqnum: 1~63, bitmap: 0~62) */ set_bit(achan->seqnum - 1, achan->bitmap_seqnum); From b66829b17f6385cc9ffbcbe2476d532d2e3121ad Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Tue, 5 May 2026 13:12:59 +0000 Subject: [PATCH 02/12] firmware: samsung: acpm: Fix mailbox channel leak on probe error Sashiko identified the leak at [1]. The ACPM driver allocates hardware mailbox channels using `mbox_request_channel()` during `acpm_channels_init()`. However, the driver lacked a `.remove` callback and did not free these channels on subsequent error paths inside `acpm_probe()`. Additionally, if `acpm_achan_alloc_cmds()` failed during the channel initialization loop, the function returned immediately, bypassing the manual cleanup and permanently leaking any channels successfully requested in previous loop iterations. Fix this by modifying `acpm_free_mbox_chans()` to match the `devres` action signature and registering it via `devm_add_action_or_reset()`. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-2-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index e95edc350efa..9766425a44ab 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -527,10 +527,11 @@ static int acpm_achan_alloc_cmds(struct acpm_chan *achan) /** * acpm_free_mbox_chans() - free mailbox channels. - * @acpm: pointer to driver data. + * @data: pointer to driver data. */ -static void acpm_free_mbox_chans(struct acpm_info *acpm) +static void acpm_free_mbox_chans(void *data) { + struct acpm_info *acpm = data; int i; for (i = 0; i < acpm->num_chans; i++) @@ -558,6 +559,10 @@ static int acpm_channels_init(struct acpm_info *acpm) if (!acpm->chans) return -ENOMEM; + ret = devm_add_action_or_reset(dev, acpm_free_mbox_chans, acpm); + if (ret) + return dev_err_probe(dev, ret, "Failed to add mbox free action.\n"); + chans_shmem = acpm->sram_base + readl(&shmem->chans); for (i = 0; i < acpm->num_chans; i++) { @@ -579,10 +584,8 @@ static int acpm_channels_init(struct acpm_info *acpm) cl->dev = dev; achan->chan = mbox_request_channel(cl, 0); - if (IS_ERR(achan->chan)) { - acpm_free_mbox_chans(acpm); + if (IS_ERR(achan->chan)) return PTR_ERR(achan->chan); - } } return 0; From c889b146478885344a220dd468e5a08de088cbc5 Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Tue, 5 May 2026 13:13:02 +0000 Subject: [PATCH 03/12] firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling Sashiko identified severe races in the polling state machine [1]. In the ACPM driver's polling mode, threads waited for responses by monitoring the globally shared 'bitmap_seqnum'. This caused false timeouts because if a thread processed its response and freed the sequence number, a concurrent TX thread could immediately reallocate it before the polling thread woke up. Additionally, the driver suffered from a cross-thread Use-After-Free (UAF) preemption race. Previously, acpm_get_rx() cleared the sequence number of whichever RX message it drained from the hardware queue. This meant Thread A could globally free Thread B's sequence slot while Thread B was asleep. A new Thread C could then steal the slot, overwrite the buffer, and leave Thread B to wake up to corrupted state or a timeout. Fix this by rewriting the polling state machine: 1. Decouple polling from the global allocator by introducing a per-slot 'completed' flag, synchronized via smp_store_release() and smp_load_acquire(). 2. Strip acpm_get_saved_rx() out of acpm_get_rx() to make it a pure queue-draining function. Introduce a 'native_match' boolean argument which evaluates to true only if the thread natively processed its own sequence number during the call. This explicitly informs the polling loop whether it must retrieve its payload from the cross-thread cache. 3. Centralize the cache fallback and sequence number free (clear_bit) inside the polling loop. Crucially, the free operation now strictly targets the thread's own TX sequence number (xfer->txd[0]), rather than the drained RX sequence number. This enforces strict ownership: a thread only ever frees its own allocated sequence slot, and only at the exact moment it completes its poll, eliminating the UAF window. Furthermore, explicitly guard the 'native_match' assignment with an if (rx_seqnum == tx_seqnum) check, even for zero-length (no payload) responses. While an unguarded assignment wouldn't crash (because the cache fallback acpm_get_saved_rx() safely returns early on zero-length transfers) doing so would "lie" to the state machine. If a thread drained the queue and found another thread's zero-length message, setting native_match = true would falsely convince the polling loop that it natively handled its own response. Maintaining a rigorous state machine requires that native_match is only set when a thread explicitly processes its own sequence number. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260429-acpm-fixes-sashiko-reports-v3-0-47cf74ab09ad%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-5-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 68 ++++++++++++++++++-------- 1 file changed, 48 insertions(+), 20 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 9766425a44ab..620880d8820a 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -105,11 +105,14 @@ struct acpm_queue { * @cmd: pointer to where the data shall be saved. * @n_cmd: number of 32-bit commands. * @rxcnt: expected length of the response in 32-bit words. + * @completed: flag indicating if the firmware response has been fully + * processed. */ struct acpm_rx_data { u32 *cmd; size_t n_cmd; size_t rxcnt; + bool completed; }; #define ACPM_SEQNUM_MAX 64 @@ -204,26 +207,28 @@ static void acpm_get_saved_rx(struct acpm_chan *achan, rx_seqnum = FIELD_GET(ACPM_PROTOCOL_SEQNUM, rx_data->cmd[0]); - if (rx_seqnum == tx_seqnum) { + if (rx_seqnum == tx_seqnum) memcpy(xfer->rxd, rx_data->cmd, xfer->rxcnt * sizeof(*xfer->rxd)); - clear_bit(rx_seqnum - 1, achan->bitmap_seqnum); - } } /** * acpm_get_rx() - get response from RX queue. * @achan: ACPM channel info. * @xfer: reference to the transfer to get response for. + * @native_match: pointer to a boolean set to true if the thread natively + * processed its own sequence number during this call. * * Return: 0 on success, -errno otherwise. */ -static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) +static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer, + bool *native_match) { u32 rx_front, rx_seqnum, tx_seqnum, seqnum; const void __iomem *base, *addr; struct acpm_rx_data *rx_data; u32 i, val, mlen; - bool rx_set = false; + + *native_match = false; guard(mutex)(&achan->rx_lock); @@ -232,10 +237,8 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) tx_seqnum = FIELD_GET(ACPM_PROTOCOL_SEQNUM, xfer->txd[0]); - if (i == rx_front) { - acpm_get_saved_rx(achan, xfer, tx_seqnum); + if (i == rx_front) return 0; - } base = achan->rx.base; mlen = achan->mlen; @@ -259,8 +262,13 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) if (rx_data->rxcnt) { if (rx_seqnum == tx_seqnum) { __ioread32_copy(xfer->rxd, addr, xfer->rxcnt); - rx_set = true; - clear_bit(seqnum, achan->bitmap_seqnum); + /* + * Signal completion to the polling thread. + * Pairs with smp_load_acquire() in polling + * loop. + */ + smp_store_release(&rx_data->completed, true); + *native_match = true; } else { /* * The RX data corresponds to another request. @@ -270,9 +278,21 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) */ __ioread32_copy(rx_data->cmd, addr, rx_data->rxcnt); + /* + * Signal completion to the polling thread. + * Pairs with smp_load_acquire() in polling + * loop. + */ + smp_store_release(&rx_data->completed, true); } } else { - clear_bit(seqnum, achan->bitmap_seqnum); + /* + * Signal completion to the polling thread. + * Pairs with smp_load_acquire() in polling loop. + */ + smp_store_release(&rx_data->completed, true); + if (rx_seqnum == tx_seqnum) + *native_match = true; } i = (i + 1) % achan->qlen; @@ -281,13 +301,6 @@ static int acpm_get_rx(struct acpm_chan *achan, const struct acpm_xfer *xfer) /* We saved all responses, mark RX empty. */ writel(rx_front, achan->rx.rear); - /* - * If the response was not in this iteration of the queue, check if the - * RX data was previously saved. - */ - if (!rx_set) - acpm_get_saved_rx(achan, xfer, tx_seqnum); - return 0; } @@ -302,6 +315,7 @@ static int acpm_dequeue_by_polling(struct acpm_chan *achan, const struct acpm_xfer *xfer) { struct device *dev = achan->acpm->dev; + bool native_match; ktime_t timeout; u32 seqnum; int ret; @@ -310,12 +324,25 @@ static int acpm_dequeue_by_polling(struct acpm_chan *achan, timeout = ktime_add_us(ktime_get(), ACPM_POLL_TIMEOUT_US); do { - ret = acpm_get_rx(achan, xfer); + ret = acpm_get_rx(achan, xfer, &native_match); if (ret) return ret; - if (!test_bit(seqnum - 1, achan->bitmap_seqnum)) + /* + * Safely check if our specific transaction has been processed. + * smp_load_acquire prevents the CPU from speculatively + * executing subsequent instructions before the transaction is + * synchronized. + */ + if (smp_load_acquire(&achan->rx_data[seqnum - 1].completed)) { + /* Retrieve payload if another thread cached it for us */ + if (!native_match) + acpm_get_saved_rx(achan, xfer, seqnum); + + /* Relinquish ownership of the sequence slot */ + clear_bit(seqnum - 1, achan->bitmap_seqnum); return 0; + } /* Determined experimentally. */ udelay(20); @@ -380,6 +407,7 @@ static void acpm_prepare_xfer(struct acpm_chan *achan, /* Clear data for upcoming responses */ rx_data = &achan->rx_data[achan->seqnum - 1]; + rx_data->completed = false; memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd); /* zero means no response expected */ rx_data->rxcnt = xfer->rxcnt; From bf296f83a3ddab1ab875edc4e8862cb10553064f Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Tue, 5 May 2026 13:13:03 +0000 Subject: [PATCH 04/12] firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator Sashiko identified memory ordering races in [1]. The ACPM driver uses a globally shared 'bitmap_seqnum' to track available sequence numbers. Even though threads now strictly free their own sequence numbers, the allocation and freeing of these bits across concurrent threads are effectively lockless operations and require explicit LKMM memory barriers. Previously, the driver used plain bitwise operators (test_bit, set_bit, clear_bit), which lack ordering guarantees. This creates two race conditions on weakly ordered architectures like ARM64: 1. Polling Release Violation: The polling thread copies its payload and calls clear_bit(). Without a release barrier, the CPU can reorder the memory operations, making the cleared bit globally visible before the payload reads have fully completed. 2. TX Acquire Violation: The TX thread loops on test_bit(), calls set_bit(), and then wipes the payload buffer via memset(). Without an acquire barrier, the CPU can speculatively execute the memset() before the bit is safely and formally claimed. If these reorderings overlap, a new TX thread can claim the sequence number and overwrite the buffer while the original polling thread is still actively reading from it. Fix this by upgrading the bitwise operators. Wrap the TX allocation in test_and_set_bit_lock() to establish formal LKMM Acquire semantics, and pair it with clear_bit_unlock() in the polling path to enforce Release semantics. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260423-acpm-fixes-sashiko-reports-v1-0-2217b790925e%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-6-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 620880d8820a..3fa9fe283be4 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -7,7 +7,7 @@ #include #include -#include +#include #include #include #include @@ -340,7 +340,7 @@ static int acpm_dequeue_by_polling(struct acpm_chan *achan, acpm_get_saved_rx(achan, xfer, seqnum); /* Relinquish ownership of the sequence slot */ - clear_bit(seqnum - 1, achan->bitmap_seqnum); + clear_bit_unlock(seqnum - 1, achan->bitmap_seqnum); return 0; } @@ -397,11 +397,18 @@ static void acpm_prepare_xfer(struct acpm_chan *achan, struct acpm_rx_data *rx_data; u32 *txd = (u32 *)xfer->txd; - /* Prevent chan->seqnum from being re-used */ + /* + * Prevent chan->seqnum from being re-used. + * test_and_set_bit_lock() provides formal LKMM Acquire semantics. + * It pairs with the RX thread's clear_bit_unlock() to ensure the CPU + * does not speculatively execute the rx_data buffer wipe (memset) + * before the sequence number is safely claimed. + */ do { if (++achan->seqnum == ACPM_SEQNUM_MAX) achan->seqnum = 1; - } while (test_bit(achan->seqnum - 1, achan->bitmap_seqnum)); + /* Flag the index based on seqnum. (seqnum: 1~63, bitmap: 0~62) */ + } while (test_and_set_bit_lock(achan->seqnum - 1, achan->bitmap_seqnum)); txd[0] |= FIELD_PREP(ACPM_PROTOCOL_SEQNUM, achan->seqnum); @@ -411,9 +418,6 @@ static void acpm_prepare_xfer(struct acpm_chan *achan, memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd); /* zero means no response expected */ rx_data->rxcnt = xfer->rxcnt; - - /* Flag the index based on seqnum. (seqnum: 1~63, bitmap: 0~62) */ - set_bit(achan->seqnum - 1, achan->bitmap_seqnum); } /** From 7fe40c32a33905302341797b5d12c541729dd08d Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Tue, 5 May 2026 13:13:04 +0000 Subject: [PATCH 05/12] firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion Sashiko identified a possible infinite loop [1]. ACPM IPC sequence numbers are tracked via a 64-bit bitmap. Previously, acpm_prepare_xfer() used a do...while loop to search for a free sequence number. If all 63 available sequence numbers are leaked due to transient hardware timeouts or mailbox failures, the bitmap becomes full. The next call to acpm_prepare_xfer() would enter an infinite loop. Fix this by utilizing the kernel's optimized bitmap search functions (find_next_zero_bit / find_first_zero_bit). If the pool is completely exhausted, log the failure and return -EBUSY to allow the kernel to fail gracefully instead of hanging. Furthermore, drop the allocation loop entirely. Because acpm_prepare_xfer() is strictly called under the 'tx_lock' mutex, sequence number allocations are perfectly serialized. If find_next_zero_bit() locates a free bit, a single test_and_set_bit_lock() is mathematically guaranteed to succeed. To enforce this locking invariant, wrap the allocation in a WARN_ON_ONCE. If the atomic set fails, it indicates the driver's mutex serialization is fundamentally broken. The warning generates a stack trace for debugging, while returning -EIO immediately aborts the transfer to prevent silent payload corruption. Cc: stable@vger.kernel.org Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1] Signed-off-by: Tudor Ambarus Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-7-43b5ee7f1674@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 45 ++++++++++++++++++-------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 3fa9fe283be4..19db3674a28f 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -390,34 +391,48 @@ static int acpm_wait_for_queue_slots(struct acpm_chan *achan, u32 next_tx_front) * TX queue. * @achan: ACPM channel info. * @xfer: reference to the transfer being prepared. + * + * Return: 0 on success, -errno otherwise. */ -static void acpm_prepare_xfer(struct acpm_chan *achan, - const struct acpm_xfer *xfer) +static int acpm_prepare_xfer(struct acpm_chan *achan, + const struct acpm_xfer *xfer) { struct acpm_rx_data *rx_data; u32 *txd = (u32 *)xfer->txd; + unsigned long size = ACPM_SEQNUM_MAX - 1; + unsigned long bit = achan->seqnum; + + bit = find_next_zero_bit(achan->bitmap_seqnum, size, bit); + if (bit >= size) { + bit = find_first_zero_bit(achan->bitmap_seqnum, size); + if (bit >= size) { + dev_err_ratelimited(achan->acpm->dev, + "ACPM sequence number pool exhausted\n"); + return -EBUSY; + } + } /* - * Prevent chan->seqnum from being re-used. - * test_and_set_bit_lock() provides formal LKMM Acquire semantics. - * It pairs with the RX thread's clear_bit_unlock() to ensure the CPU - * does not speculatively execute the rx_data buffer wipe (memset) - * before the sequence number is safely claimed. + * Execute the atomic set to formally claim the bit and establish + * LKMM Acquire semantics against the RX thread's clear_bit_unlock(). + * A loop is unnecessary because allocations are strictly serialized + * by tx_lock. */ - do { - if (++achan->seqnum == ACPM_SEQNUM_MAX) - achan->seqnum = 1; - /* Flag the index based on seqnum. (seqnum: 1~63, bitmap: 0~62) */ - } while (test_and_set_bit_lock(achan->seqnum - 1, achan->bitmap_seqnum)); + if (WARN_ON_ONCE(test_and_set_bit_lock(bit, achan->bitmap_seqnum))) + return -EIO; + /* Flag the index based on seqnum. (seqnum: 1~63, bitmap: 0~62) */ + achan->seqnum = bit + 1; txd[0] |= FIELD_PREP(ACPM_PROTOCOL_SEQNUM, achan->seqnum); /* Clear data for upcoming responses */ - rx_data = &achan->rx_data[achan->seqnum - 1]; + rx_data = &achan->rx_data[bit]; rx_data->completed = false; memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd); /* zero means no response expected */ rx_data->rxcnt = xfer->rxcnt; + + return 0; } /** @@ -477,7 +492,9 @@ int acpm_do_xfer(struct acpm_handle *handle, const struct acpm_xfer *xfer) if (ret) return ret; - acpm_prepare_xfer(achan, xfer); + ret = acpm_prepare_xfer(achan, xfer); + if (ret) + return ret; /* Write TX command. */ __iowrite32_copy(achan->tx.base + achan->mlen * tx_front, From d5cfe2a96d723b6962c5e38bc81cc9994347d326 Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:25 +0000 Subject: [PATCH 06/12] firmware: samsung: acpm: Consolidate transfer initialization helper Both the DVFS and PMIC ACPM sub-drivers implement similar local helper functions (acpm_dvfs_set_xfer and acpm_pmic_set_xfer) to initialize the acpm_xfer structure before sending an IPC message. Move this logic into a single centralized helper, acpm_set_xfer(), in the core ACPM driver to reduce boilerplate, eliminate code duplication, and prepare for the upcoming ACPM TMU helper sub-driver which will also utilize this method. Note that there is no change in underlying functionality. While the old acpm_pmic_set_xfer() unconditionally assigned the RX buffer parameters (xfer->rxd and xfer->rxcnt), the new unified helper introduces a 'response' boolean. All updated PMIC call sites now explicitly pass 'true' for this argument. This ensures the unified helper takes the 'if (response)' branch, performing the exact same assignments and preserving the original PMIC behavior. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-1-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm-dvfs.c | 20 ++-------------- drivers/firmware/samsung/exynos-acpm-pmic.c | 20 ++++------------ drivers/firmware/samsung/exynos-acpm.c | 26 +++++++++++++++++++++ drivers/firmware/samsung/exynos-acpm.h | 2 ++ 4 files changed, 35 insertions(+), 33 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm-dvfs.c b/drivers/firmware/samsung/exynos-acpm-dvfs.c index fdea7aa24ca0..7266312ef5a6 100644 --- a/drivers/firmware/samsung/exynos-acpm-dvfs.c +++ b/drivers/firmware/samsung/exynos-acpm-dvfs.c @@ -21,22 +21,6 @@ #define ACPM_DVFS_FREQ_REQ 0 #define ACPM_DVFS_FREQ_GET 1 -static void acpm_dvfs_set_xfer(struct acpm_xfer *xfer, u32 *cmd, size_t cmdlen, - unsigned int acpm_chan_id, bool response) -{ - xfer->acpm_chan_id = acpm_chan_id; - xfer->txcnt = cmdlen; - xfer->txd = cmd; - - if (response) { - xfer->rxcnt = cmdlen; - xfer->rxd = cmd; - } else { - xfer->rxcnt = 0; - xfer->rxd = NULL; - } -} - static void acpm_dvfs_init_set_rate_cmd(u32 cmd[4], unsigned int clk_id, unsigned long rate) { @@ -54,7 +38,7 @@ int acpm_dvfs_set_rate(struct acpm_handle *handle, u32 cmd[4]; acpm_dvfs_init_set_rate_cmd(cmd, clk_id, rate); - acpm_dvfs_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, false); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, false); return acpm_do_xfer(handle, &xfer); } @@ -74,7 +58,7 @@ unsigned long acpm_dvfs_get_rate(struct acpm_handle *handle, int ret; acpm_dvfs_init_get_rate_cmd(cmd, clk_id); - acpm_dvfs_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) diff --git a/drivers/firmware/samsung/exynos-acpm-pmic.c b/drivers/firmware/samsung/exynos-acpm-pmic.c index 0c50993cc9a8..f032f2c69685 100644 --- a/drivers/firmware/samsung/exynos-acpm-pmic.c +++ b/drivers/firmware/samsung/exynos-acpm-pmic.c @@ -58,16 +58,6 @@ static inline u32 acpm_pmic_get_bulk(u32 data, unsigned int i) return (data >> (ACPM_PMIC_BULK_SHIFT * i)) & ACPM_PMIC_BULK_MASK; } -static void acpm_pmic_set_xfer(struct acpm_xfer *xfer, u32 *cmd, size_t cmdlen, - unsigned int acpm_chan_id) -{ - xfer->txd = cmd; - xfer->rxd = cmd; - xfer->txcnt = cmdlen; - xfer->rxcnt = cmdlen; - xfer->acpm_chan_id = acpm_chan_id; -} - static void acpm_pmic_init_read_cmd(u32 cmd[4], u8 type, u8 reg, u8 chan) { cmd[0] = FIELD_PREP(ACPM_PMIC_TYPE, type) | @@ -86,7 +76,7 @@ int acpm_pmic_read_reg(struct acpm_handle *handle, int ret; acpm_pmic_init_read_cmd(cmd, type, reg, chan); - acpm_pmic_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) @@ -119,7 +109,7 @@ int acpm_pmic_bulk_read(struct acpm_handle *handle, return -EINVAL; acpm_pmic_init_bulk_read_cmd(cmd, type, reg, chan, count); - acpm_pmic_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) @@ -159,7 +149,7 @@ int acpm_pmic_write_reg(struct acpm_handle *handle, int ret; acpm_pmic_init_write_cmd(cmd, type, reg, chan, value); - acpm_pmic_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) @@ -199,7 +189,7 @@ int acpm_pmic_bulk_write(struct acpm_handle *handle, return -EINVAL; acpm_pmic_init_bulk_write_cmd(cmd, type, reg, chan, count, buf); - acpm_pmic_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) @@ -229,7 +219,7 @@ int acpm_pmic_update_reg(struct acpm_handle *handle, int ret; acpm_pmic_init_update_cmd(cmd, type, reg, chan, value, mask); - acpm_pmic_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id); + acpm_set_xfer(&xfer, cmd, ARRAY_SIZE(cmd), acpm_chan_id, true); ret = acpm_do_xfer(handle, &xfer); if (ret) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 19db3674a28f..ec0929882b74 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -513,6 +513,32 @@ int acpm_do_xfer(struct acpm_handle *handle, const struct acpm_xfer *xfer) return acpm_wait_for_message_response(achan, xfer); } +/** + * acpm_set_xfer() - initialize an ACPM IPC transfer structure. + * @xfer: pointer to the ACPM transfer structure that is being initialized. + * @cmd: pointer to the buffer containing the command to be transmitted + * to the ACPM firmware. + * @cmdcnt: length of the command in 32-bit words. + * @acpm_chan_id: mailbox channel identifier. + * @response: boolean flag indicating whether the kernel expects the ACPM + * firmware to send a reply to this specific command. + */ +void acpm_set_xfer(struct acpm_xfer *xfer, u32 *cmd, size_t cmdcnt, + unsigned int acpm_chan_id, bool response) +{ + xfer->acpm_chan_id = acpm_chan_id; + xfer->txcnt = cmdcnt; + xfer->txd = cmd; + + if (response) { + xfer->rxcnt = cmdcnt; + xfer->rxd = cmd; + } else { + xfer->rxcnt = 0; + xfer->rxd = NULL; + } +} + /** * acpm_chan_shmem_get_params() - get channel parameters and addresses of the * TX/RX queues. diff --git a/drivers/firmware/samsung/exynos-acpm.h b/drivers/firmware/samsung/exynos-acpm.h index 5df8354dc96c..708f6b0102ac 100644 --- a/drivers/firmware/samsung/exynos-acpm.h +++ b/drivers/firmware/samsung/exynos-acpm.h @@ -17,6 +17,8 @@ struct acpm_xfer { struct acpm_handle; +void acpm_set_xfer(struct acpm_xfer *xfer, u32 *cmd, size_t cmdcnt, + unsigned int acpm_chan_id, bool response); int acpm_do_xfer(struct acpm_handle *handle, const struct acpm_xfer *xfer); From 447f406568c153819d6bfce994e422db4e95bb6f Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:26 +0000 Subject: [PATCH 07/12] firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr Rename the `n_cmd` member of `struct acpm_rx_data` to `cmdcnt` to maintain consistent nomenclature across the driver (aligning with `txcnt`, `rxcnt`, and transfer helpers). With the member renamed, annotate the dynamically allocated `cmd` pointer with the `__counted_by_ptr(cmdcnt)` macro to improve runtime bounds checking. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-2-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index ec0929882b74..69bb1008d1c0 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -104,14 +104,14 @@ struct acpm_queue { * struct acpm_rx_data - RX queue data. * * @cmd: pointer to where the data shall be saved. - * @n_cmd: number of 32-bit commands. + * @cmdcnt: allocated capacity of the @cmd buffer in 32-bit words. * @rxcnt: expected length of the response in 32-bit words. * @completed: flag indicating if the firmware response has been fully * processed. */ struct acpm_rx_data { - u32 *cmd; - size_t n_cmd; + u32 *cmd __counted_by_ptr(cmdcnt); + size_t cmdcnt; size_t rxcnt; bool completed; }; @@ -428,7 +428,7 @@ static int acpm_prepare_xfer(struct acpm_chan *achan, /* Clear data for upcoming responses */ rx_data = &achan->rx_data[bit]; rx_data->completed = false; - memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd); + memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->cmdcnt); /* zero means no response expected */ rx_data->rxcnt = xfer->rxcnt; @@ -580,19 +580,19 @@ static int acpm_achan_alloc_cmds(struct acpm_chan *achan) { struct device *dev = achan->acpm->dev; struct acpm_rx_data *rx_data; - size_t cmd_size, n_cmd; + size_t cmd_size, cmdcnt; int i; if (achan->mlen == 0) return 0; cmd_size = sizeof(*(achan->rx_data[0].cmd)); - n_cmd = DIV_ROUND_UP_ULL(achan->mlen, cmd_size); + cmdcnt = DIV_ROUND_UP_ULL(achan->mlen, cmd_size); for (i = 0; i < ACPM_SEQNUM_MAX; i++) { rx_data = &achan->rx_data[i]; - rx_data->n_cmd = n_cmd; - rx_data->cmd = devm_kcalloc(dev, n_cmd, cmd_size, GFP_KERNEL); + rx_data->cmdcnt = cmdcnt; + rx_data->cmd = devm_kcalloc(dev, cmdcnt, cmd_size, GFP_KERNEL); if (!rx_data->cmd) return -ENOMEM; } From 9d7a681915245e0e191abfd4b31d010c7037573c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:27 +0000 Subject: [PATCH 08/12] firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members Rename the `dvfs_ops` and `pmic_ops` members of `struct acpm_ops` to `dvfs` and `pmic` respectively. Since these members are housed within the `acpm_ops` structure and utilize the `acpm_*_ops` types, the `_ops` suffix on the variable names creates unnecessary redundancy (e.g., `handle.ops.dvfs_ops`). This cleanup removes the stuttering, leading to cleaner consumer code. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Acked-by: Lee Jones Link: https://lore.kernel.org/linux-samsung-soc/CADrjBPqzKpcd9vuCmNUptCUPyPpPbHcc19-7kN-1c0RpW1e5DQ@mail.gmail.com/T/#mcce154a7e0c6cd1ca6cd5a1e37541ed7a85a84d4 [1] Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-3-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/clk/samsung/clk-acpm.c | 8 ++++---- drivers/firmware/samsung/exynos-acpm.c | 4 ++-- drivers/mfd/sec-acpm.c | 6 +++--- include/linux/firmware/samsung/exynos-acpm-protocol.h | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/clk/samsung/clk-acpm.c b/drivers/clk/samsung/clk-acpm.c index d8944160793a..93667777094c 100644 --- a/drivers/clk/samsung/clk-acpm.c +++ b/drivers/clk/samsung/clk-acpm.c @@ -68,8 +68,8 @@ static unsigned long acpm_clk_recalc_rate(struct clk_hw *hw, { struct acpm_clk *clk = to_acpm_clk(hw); - return clk->handle->ops.dvfs_ops.get_rate(clk->handle, - clk->mbox_chan_id, clk->id); + return clk->handle->ops.dvfs.get_rate(clk->handle, clk->mbox_chan_id, + clk->id); } static int acpm_clk_determine_rate(struct clk_hw *hw, @@ -89,8 +89,8 @@ static int acpm_clk_set_rate(struct clk_hw *hw, unsigned long rate, { struct acpm_clk *clk = to_acpm_clk(hw); - return clk->handle->ops.dvfs_ops.set_rate(clk->handle, - clk->mbox_chan_id, clk->id, rate); + return clk->handle->ops.dvfs.set_rate(clk->handle, clk->mbox_chan_id, + clk->id, rate); } static const struct clk_ops acpm_clk_ops = { diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 69bb1008d1c0..bd2bfd8d8512 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -672,8 +672,8 @@ static int acpm_channels_init(struct acpm_info *acpm) */ static void acpm_setup_ops(struct acpm_info *acpm) { - struct acpm_dvfs_ops *dvfs_ops = &acpm->handle.ops.dvfs_ops; - struct acpm_pmic_ops *pmic_ops = &acpm->handle.ops.pmic_ops; + struct acpm_dvfs_ops *dvfs_ops = &acpm->handle.ops.dvfs; + struct acpm_pmic_ops *pmic_ops = &acpm->handle.ops.pmic; dvfs_ops->set_rate = acpm_dvfs_set_rate; dvfs_ops->get_rate = acpm_dvfs_get_rate; diff --git a/drivers/mfd/sec-acpm.c b/drivers/mfd/sec-acpm.c index 0e23b9d9f7ee..9e15b260b8df 100644 --- a/drivers/mfd/sec-acpm.c +++ b/drivers/mfd/sec-acpm.c @@ -391,7 +391,7 @@ static int sec_pmic_acpm_bus_write(void *context, const void *data, { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic_ops; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; size_t val_count = count - BITS_TO_BYTES(ACPM_ADDR_BITS); const u8 *d = data; const u8 *vals = &d[BITS_TO_BYTES(ACPM_ADDR_BITS)]; @@ -411,7 +411,7 @@ static int sec_pmic_acpm_bus_read(void *context, const void *reg_buf, size_t reg { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic_ops; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; const u8 *r = reg_buf; u8 reg; @@ -430,7 +430,7 @@ static int sec_pmic_acpm_bus_reg_update_bits(void *context, unsigned int reg, un { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic_ops; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; return pmic_ops->update_reg(acpm, ctx->shared->acpm_chan_id, ctx->type, reg & 0xff, ctx->shared->speedy_channel, val, mask); diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 13f17dc4443b..62a3eb450067 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -35,8 +35,8 @@ struct acpm_pmic_ops { }; struct acpm_ops { - struct acpm_dvfs_ops dvfs_ops; - struct acpm_pmic_ops pmic_ops; + struct acpm_dvfs_ops dvfs; + struct acpm_pmic_ops pmic; }; /** From 50b400214abaec9122558e3f9c6fdd6295914c3c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:28 +0000 Subject: [PATCH 09/12] firmware: samsung: acpm: Make acpm_ops const and access via pointer Replace the embedded `struct acpm_ops` inside `struct acpm_handle` with a pointer to a `const struct acpm_ops`. Previously, the operations structure was embedded directly within the handle and populated dynamically at runtime via `acpm_setup_ops()`. This resulted in mutable function pointers and unnecessary per-instance memory overhead. By defining `exynos_acpm_driver_ops` statically as a `const` structure, the function pointers are now safely housed in the read-only `.rodata` section. This improves security by preventing function pointer overwrites, saves memory, and slightly reduces initialization overhead in `acpm_probe()`. Consequently, update all consumer drivers (clk, mfd) to access the operations via the new pointer indirection (`->ops->`). Finally, fix the previously empty kernel-doc description for the ops member to reflect its new pointer nature. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-4-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/clk/samsung/clk-acpm.c | 8 ++--- drivers/firmware/samsung/exynos-acpm.c | 36 +++++++++---------- drivers/mfd/sec-acpm.c | 6 ++-- .../firmware/samsung/exynos-acpm-protocol.h | 4 +-- 4 files changed, 25 insertions(+), 29 deletions(-) diff --git a/drivers/clk/samsung/clk-acpm.c b/drivers/clk/samsung/clk-acpm.c index 93667777094c..953ca8d5720a 100644 --- a/drivers/clk/samsung/clk-acpm.c +++ b/drivers/clk/samsung/clk-acpm.c @@ -68,8 +68,8 @@ static unsigned long acpm_clk_recalc_rate(struct clk_hw *hw, { struct acpm_clk *clk = to_acpm_clk(hw); - return clk->handle->ops.dvfs.get_rate(clk->handle, clk->mbox_chan_id, - clk->id); + return clk->handle->ops->dvfs.get_rate(clk->handle, clk->mbox_chan_id, + clk->id); } static int acpm_clk_determine_rate(struct clk_hw *hw, @@ -89,8 +89,8 @@ static int acpm_clk_set_rate(struct clk_hw *hw, unsigned long rate, { struct acpm_clk *clk = to_acpm_clk(hw); - return clk->handle->ops.dvfs.set_rate(clk->handle, clk->mbox_chan_id, - clk->id, rate); + return clk->handle->ops->dvfs.set_rate(clk->handle, clk->mbox_chan_id, + clk->id, rate); } static const struct clk_ops acpm_clk_ops = { diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index bd2bfd8d8512..a1f73cc7cc8f 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -666,30 +666,26 @@ static int acpm_channels_init(struct acpm_info *acpm) return 0; } -/** - * acpm_setup_ops() - setup the operations structures. - * @acpm: pointer to the driver data. - */ -static void acpm_setup_ops(struct acpm_info *acpm) -{ - struct acpm_dvfs_ops *dvfs_ops = &acpm->handle.ops.dvfs; - struct acpm_pmic_ops *pmic_ops = &acpm->handle.ops.pmic; - - dvfs_ops->set_rate = acpm_dvfs_set_rate; - dvfs_ops->get_rate = acpm_dvfs_get_rate; - - pmic_ops->read_reg = acpm_pmic_read_reg; - pmic_ops->bulk_read = acpm_pmic_bulk_read; - pmic_ops->write_reg = acpm_pmic_write_reg; - pmic_ops->bulk_write = acpm_pmic_bulk_write; - pmic_ops->update_reg = acpm_pmic_update_reg; -} - static void acpm_clk_pdev_unregister(void *data) { platform_device_unregister(data); } +static const struct acpm_ops exynos_acpm_driver_ops = { + .dvfs = { + .set_rate = acpm_dvfs_set_rate, + .get_rate = acpm_dvfs_get_rate, + }, + + .pmic = { + .read_reg = acpm_pmic_read_reg, + .bulk_read = acpm_pmic_bulk_read, + .write_reg = acpm_pmic_write_reg, + .bulk_write = acpm_pmic_bulk_write, + .update_reg = acpm_pmic_update_reg, + }, +}; + static int acpm_probe(struct platform_device *pdev) { const struct acpm_match_data *match_data; @@ -730,7 +726,7 @@ static int acpm_probe(struct platform_device *pdev) if (ret) return ret; - acpm_setup_ops(acpm); + acpm->handle.ops = &exynos_acpm_driver_ops; platform_set_drvdata(pdev, acpm); diff --git a/drivers/mfd/sec-acpm.c b/drivers/mfd/sec-acpm.c index 9e15b260b8df..3397d13d3b7f 100644 --- a/drivers/mfd/sec-acpm.c +++ b/drivers/mfd/sec-acpm.c @@ -391,7 +391,7 @@ static int sec_pmic_acpm_bus_write(void *context, const void *data, { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops->pmic; size_t val_count = count - BITS_TO_BYTES(ACPM_ADDR_BITS); const u8 *d = data; const u8 *vals = &d[BITS_TO_BYTES(ACPM_ADDR_BITS)]; @@ -411,7 +411,7 @@ static int sec_pmic_acpm_bus_read(void *context, const void *reg_buf, size_t reg { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops->pmic; const u8 *r = reg_buf; u8 reg; @@ -430,7 +430,7 @@ static int sec_pmic_acpm_bus_reg_update_bits(void *context, unsigned int reg, un { struct sec_pmic_acpm_bus_context *ctx = context; struct acpm_handle *acpm = ctx->shared->acpm; - const struct acpm_pmic_ops *pmic_ops = &acpm->ops.pmic; + const struct acpm_pmic_ops *pmic_ops = &acpm->ops->pmic; return pmic_ops->update_reg(acpm, ctx->shared->acpm_chan_id, ctx->type, reg & 0xff, ctx->shared->speedy_channel, val, mask); diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 62a3eb450067..e13d9ac73ff6 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -41,10 +41,10 @@ struct acpm_ops { /** * struct acpm_handle - Reference to an initialized protocol instance - * @ops: + * @ops: pointer to the constant ACPM protocol operations. */ struct acpm_handle { - struct acpm_ops ops; + const struct acpm_ops *ops; }; struct device; From 4ba23dfc49b4a3cefb4fdaa406172dfb8350098d Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:29 +0000 Subject: [PATCH 10/12] firmware: samsung: acpm: Add TMU protocol support The Thermal Management Unit (TMU) on the Google GS101 SoC is managed through a hybrid model shared between the kernel and the Alive Clock and Power Manager (ACPM) firmware. Add the protocol helpers required to communicate with the ACPM for thermal operations, including initialization, threshold configuration, temperature reading, and system suspend/resume handshakes. Signed-off-by: Tudor Ambarus Reviewed-by: Krzysztof Kozlowski Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-5-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/Makefile | 1 + drivers/firmware/samsung/exynos-acpm-tmu.c | 239 ++++++++++++++++++ drivers/firmware/samsung/exynos-acpm-tmu.h | 28 ++ drivers/firmware/samsung/exynos-acpm.c | 12 + .../firmware/samsung/exynos-acpm-protocol.h | 18 ++ 5 files changed, 298 insertions(+) create mode 100644 drivers/firmware/samsung/exynos-acpm-tmu.c create mode 100644 drivers/firmware/samsung/exynos-acpm-tmu.h diff --git a/drivers/firmware/samsung/Makefile b/drivers/firmware/samsung/Makefile index 80d4f89b33a9..5a6f72bececf 100644 --- a/drivers/firmware/samsung/Makefile +++ b/drivers/firmware/samsung/Makefile @@ -3,4 +3,5 @@ acpm-protocol-objs := exynos-acpm.o acpm-protocol-objs += exynos-acpm-pmic.o acpm-protocol-objs += exynos-acpm-dvfs.o +acpm-protocol-objs += exynos-acpm-tmu.o obj-$(CONFIG_EXYNOS_ACPM_PROTOCOL) += acpm-protocol.o diff --git a/drivers/firmware/samsung/exynos-acpm-tmu.c b/drivers/firmware/samsung/exynos-acpm-tmu.c new file mode 100644 index 000000000000..c68d60b4c0b3 --- /dev/null +++ b/drivers/firmware/samsung/exynos-acpm-tmu.c @@ -0,0 +1,239 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright 2020 Samsung Electronics Co., Ltd. + * Copyright 2020 Google LLC. + * Copyright 2026 Linaro Ltd. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "exynos-acpm.h" +#include "exynos-acpm-tmu.h" + +/* IPC Request Types */ +#define ACPM_TMU_INIT 0x01 +#define ACPM_TMU_READ_TEMP 0x02 +#define ACPM_TMU_SUSPEND 0x04 +#define ACPM_TMU_RESUME 0x10 +#define ACPM_TMU_THRESHOLD 0x11 +#define ACPM_TMU_INTEN 0x12 +#define ACPM_TMU_CONTROL 0x13 +#define ACPM_TMU_IRQ_CLEAR 0x14 + +#define ACPM_TMU_TX_DATA_LEN 8 +#define ACPM_TMU_RX_DATA_LEN 7 + +struct acpm_tmu_tx { + u16 ctx; + u16 fw_use; + u8 type; + u8 rsvd0; + u8 tzid; + u8 rsvd1; + u8 data[ACPM_TMU_TX_DATA_LEN]; +} __packed; + +struct acpm_tmu_rx { + u16 ctx; + u16 fw_use; + u8 type; + s8 ret; + u8 tzid; + s8 temp; + u8 rsvd; + u8 data[ACPM_TMU_RX_DATA_LEN]; +} __packed; + +union acpm_tmu_msg { + u32 data[4]; + struct acpm_tmu_tx tx; + struct acpm_tmu_rx rx; +}; + +static int acpm_tmu_to_linux_err(s8 fw_err) +{ + /* + * ACPM_TMU_INIT uses BIT(0) and BIT(1) of msg.rx.ret to flag APM + * capabilities. Treat zero and all positive values as success. + */ + if (fw_err >= 0) + return 0; + + if (fw_err == -1) + return -EACCES; + + return -EIO; +} + +int acpm_tmu_init(struct acpm_handle *handle, unsigned int acpm_chan_id) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_INIT; + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_read_temp(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, int *temp) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_READ_TEMP; + msg.tx.tzid = tz; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + ret = acpm_tmu_to_linux_err(msg.rx.ret); + if (ret) + return ret; + + *temp = msg.rx.temp; + + return 0; +} + +int acpm_tmu_set_threshold(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, + const u8 temperature[8], size_t tlen) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + if (tlen > ACPM_TMU_TX_DATA_LEN) + return -EINVAL; + + msg.tx.type = ACPM_TMU_THRESHOLD; + msg.tx.tzid = tz; + memcpy(msg.tx.data, temperature, tlen); + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_set_interrupt_enable(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, u8 inten) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_INTEN; + msg.tx.tzid = tz; + msg.tx.data[0] = inten; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_tz_control(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, bool enable) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_CONTROL; + msg.tx.tzid = tz; + msg.tx.data[0] = enable ? 1 : 0; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_clear_tz_irq(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_IRQ_CLEAR; + msg.tx.tzid = tz; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_suspend(struct acpm_handle *handle, unsigned int acpm_chan_id) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_SUSPEND; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} + +int acpm_tmu_resume(struct acpm_handle *handle, unsigned int acpm_chan_id) +{ + union acpm_tmu_msg msg = {0}; + struct acpm_xfer xfer; + int ret; + + msg.tx.type = ACPM_TMU_RESUME; + + acpm_set_xfer(&xfer, msg.data, ARRAY_SIZE(msg.data), acpm_chan_id, + true); + + ret = acpm_do_xfer(handle, &xfer); + if (ret) + return ret; + + return acpm_tmu_to_linux_err(msg.rx.ret); +} diff --git a/drivers/firmware/samsung/exynos-acpm-tmu.h b/drivers/firmware/samsung/exynos-acpm-tmu.h new file mode 100644 index 000000000000..8b89f29fda67 --- /dev/null +++ b/drivers/firmware/samsung/exynos-acpm-tmu.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright 2020 Samsung Electronics Co., Ltd. + * Copyright 2020 Google LLC. + * Copyright 2026 Linaro Ltd. + */ +#ifndef __EXYNOS_ACPM_TMU_H__ +#define __EXYNOS_ACPM_TMU_H__ + +#include + +struct acpm_handle; + +int acpm_tmu_init(struct acpm_handle *handle, unsigned int acpm_chan_id); +int acpm_tmu_read_temp(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, int *temp); +int acpm_tmu_set_threshold(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, + const u8 temperature[8], size_t tlen); +int acpm_tmu_set_interrupt_enable(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, u8 inten); +int acpm_tmu_tz_control(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, bool enable); +int acpm_tmu_clear_tz_irq(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz); +int acpm_tmu_suspend(struct acpm_handle *handle, unsigned int acpm_chan_id); +int acpm_tmu_resume(struct acpm_handle *handle, unsigned int acpm_chan_id); +#endif /* __EXYNOS_ACPM_TMU_H__ */ diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index a1f73cc7cc8f..2f3b9a1bd74a 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -32,6 +32,7 @@ #include "exynos-acpm.h" #include "exynos-acpm-dvfs.h" #include "exynos-acpm-pmic.h" +#include "exynos-acpm-tmu.h" #define ACPM_PROTOCOL_SEQNUM GENMASK(21, 16) @@ -684,6 +685,17 @@ static const struct acpm_ops exynos_acpm_driver_ops = { .bulk_write = acpm_pmic_bulk_write, .update_reg = acpm_pmic_update_reg, }, + + .tmu = { + .init = acpm_tmu_init, + .read_temp = acpm_tmu_read_temp, + .set_threshold = acpm_tmu_set_threshold, + .set_interrupt_enable = acpm_tmu_set_interrupt_enable, + .tz_control = acpm_tmu_tz_control, + .clear_tz_irq = acpm_tmu_clear_tz_irq, + .suspend = acpm_tmu_suspend, + .resume = acpm_tmu_resume, + }, }; static int acpm_probe(struct platform_device *pdev) diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index e13d9ac73ff6..8511c3c3983b 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -34,9 +34,27 @@ struct acpm_pmic_ops { u8 type, u8 reg, u8 chan, u8 value, u8 mask); }; +struct acpm_tmu_ops { + int (*init)(struct acpm_handle *handle, unsigned int acpm_chan_id); + int (*read_temp)(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, int *temp); + int (*set_threshold)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, + const u8 temperature[8], size_t tlen); + int (*set_interrupt_enable)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, u8 inten); + int (*tz_control)(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, bool enable); + int (*clear_tz_irq)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz); + int (*suspend)(struct acpm_handle *handle, unsigned int acpm_chan_id); + int (*resume)(struct acpm_handle *handle, unsigned int acpm_chan_id); +}; + struct acpm_ops { struct acpm_dvfs_ops dvfs; struct acpm_pmic_ops pmic; + struct acpm_tmu_ops tmu; }; /** From fc13a4b9b9c8cb0b8e5ba54b21712d00f810496c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:30 +0000 Subject: [PATCH 11/12] firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper Introduce devm_acpm_get_by_phandle() to standardize how consumer drivers acquire a handle to the ACPM IPC interface. Enforce the use of the "samsung,acpm-ipc" property name across the SoC and simplify the boilerplate code in client drivers. The first consumer of this helper is the Exynos ACPM Thermal Management Unit (TMU) driver. The TMU utilizes a hybrid management approach: direct register access from the Application Processor (AP) is restricted to the interrupt pending (INTPEND) registers for event identification. High-level functional tasks, such as sensor initialization, threshold programming, and temperature reads, are delegated to the ACPM firmware via this IPC interface. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-6-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- drivers/firmware/samsung/exynos-acpm.c | 23 +++++++++++++++++++ .../firmware/samsung/exynos-acpm-protocol.h | 6 +++++ 2 files changed, 29 insertions(+) diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c index 2f3b9a1bd74a..942a2e9f02f5 100644 --- a/drivers/firmware/samsung/exynos-acpm.c +++ b/drivers/firmware/samsung/exynos-acpm.c @@ -853,6 +853,29 @@ struct acpm_handle *devm_acpm_get_by_node(struct device *dev, } EXPORT_SYMBOL_GPL(devm_acpm_get_by_node); +/** + * devm_acpm_get_by_phandle - Resource managed lookup of the standardized + * "samsung,acpm-ipc" handle. + * @dev: consumer device + * + * Return: pointer to handle on success, ERR_PTR(-errno) otherwise. + */ +struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev) +{ + struct acpm_handle *handle; + struct device_node *np; + + np = of_parse_phandle(dev->of_node, "samsung,acpm-ipc", 0); + if (!np) + return ERR_PTR(-ENODEV); + + handle = devm_acpm_get_by_node(dev, np); + of_node_put(np); + + return handle; +} +EXPORT_SYMBOL_GPL(devm_acpm_get_by_phandle); + static const struct acpm_match_data acpm_gs101 = { .initdata_base = ACPM_GS101_INITDATA_BASE, .acpm_clk_dev_name = "gs101-acpm-clk", diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 8511c3c3983b..dbf052c4139b 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -70,6 +70,7 @@ struct device; #if IS_ENABLED(CONFIG_EXYNOS_ACPM_PROTOCOL) struct acpm_handle *devm_acpm_get_by_node(struct device *dev, struct device_node *np); +struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev); #else static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, @@ -77,6 +78,11 @@ static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, { return NULL; } + +static inline struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev) +{ + return ERR_PTR(-ENODEV); +} #endif #endif /* __EXYNOS_ACPM_PROTOCOL_H */ From 7b661285aa7507eab79efff0a418445157db4141 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Fri, 29 May 2026 15:43:31 +0200 Subject: [PATCH 12/12] firmware: samsung: acpm: remove compile-testing stubs Sashiko reported an inconsistent use of NULL vs ERR_PTR() returns in the stub helpers in xynos-acpm-protocol.h. Since this only happens on dead code for COMPILE_TEST=y, this is not really a bug though. Having stub functions that return NULL is a common way to define optional interfaces, where callers still work when the feature is disabled, though this clearly does not work for acpm because some callers have a NULL pointer dereference when compile testing. Since CONFIG_EXYNOS_ACPM_PROTOCOL already supports compile-testing itself, and all (both) drivers using it clearly require the support, so this just simplifies the option space without losing any build coverage. Remove the stub functions entirely and adjust the one Kconfig dependency to require EXYNOS_ACPM_PROTOCOL unconditionally. Fixes: 6837c006d4e7 ("firmware: exynos-acpm: add empty method to allow compile test") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org Link: https://lore.kernel.org/all/a7994860-24a3-4f87-84bf-109ed653dda4@linaro.org/ Reviewed-by: Tudor Ambarus Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260529134454.2147446-1-arnd@kernel.org [krzk: Rebase on difference in devm_acpm_get_by_node()] Signed-off-by: Krzysztof Kozlowski --- drivers/clk/samsung/Kconfig | 2 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 14 -------------- 2 files changed, 1 insertion(+), 15 deletions(-) diff --git a/drivers/clk/samsung/Kconfig b/drivers/clk/samsung/Kconfig index 70a8b82a0136..198d8b621289 100644 --- a/drivers/clk/samsung/Kconfig +++ b/drivers/clk/samsung/Kconfig @@ -97,7 +97,7 @@ config EXYNOS_CLKOUT config EXYNOS_ACPM_CLK tristate "Clock driver controlled via ACPM interface" - depends on EXYNOS_ACPM_PROTOCOL || (COMPILE_TEST && !EXYNOS_ACPM_PROTOCOL) + depends on EXYNOS_ACPM_PROTOCOL help This driver provides support for clocks that are controlled by firmware that implements the ACPM interface. diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index dbf052c4139b..c6b35c0ff300 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -67,22 +67,8 @@ struct acpm_handle { struct device; -#if IS_ENABLED(CONFIG_EXYNOS_ACPM_PROTOCOL) struct acpm_handle *devm_acpm_get_by_node(struct device *dev, struct device_node *np); struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev); -#else - -static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, - struct device_node *np) -{ - return NULL; -} - -static inline struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev) -{ - return ERR_PTR(-ENODEV); -} -#endif #endif /* __EXYNOS_ACPM_PROTOCOL_H */