[PATCH 2/6] firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr

[Peter Griffin]

On Wed, 6 May 2026 at 12:39, Tudor Ambarus <tudor.ambarus at linaro.org> wrote:
>
> Rename the `n_cmd` member of `struct acpm_rx_data` to `cmdcnt` to
> maintain consistent nomenclature across the driver (aligning with
> `txcnt`, `rxcnt`, and transfer helpers).
>
> With the member renamed, annotate the dynamically allocated `cmd`
> pointer with the `__counted_by_ptr(cmdcnt)` macro to improve runtime
> bounds checking.
>
> Signed-off-by: Tudor Ambarus <tudor.ambarus at linaro.org>
> ---

Reviewed-by: Peter Griffin <peter.griffin at linaro.org>

>  drivers/firmware/samsung/exynos-acpm.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/firmware/samsung/exynos-acpm.c b/drivers/firmware/samsung/exynos-acpm.c
> index 88a06842753d..fac88c427d2a 100644
> --- a/drivers/firmware/samsung/exynos-acpm.c
> +++ b/drivers/firmware/samsung/exynos-acpm.c
> @@ -105,14 +105,14 @@ struct acpm_queue {
>   * struct acpm_rx_data - RX queue data.
>   *
>   * @cmd:       pointer to where the data shall be saved.
> - * @n_cmd:     number of 32-bit commands.
> + * @cmdcnt:    allocated capacity of the @cmd buffer in 32-bit words.
>   * @rxcnt:     expected length of the response in 32-bit words.
>   * @completed: flag indicating if the firmware response has been fully
>   *             processed.
>   */
>  struct acpm_rx_data {
> -       u32 *cmd;
> -       size_t n_cmd;
> +       u32 *cmd __counted_by_ptr(cmdcnt);
> +       size_t cmdcnt;
>         size_t rxcnt;
>         bool completed;
>  };
> @@ -432,7 +432,7 @@ static int acpm_prepare_xfer(struct acpm_chan *achan,
>         /* Clear data for upcoming responses */
>         rx_data = &achan->rx_data[bit];
>         rx_data->completed = false;
> -       memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->n_cmd);
> +       memset(rx_data->cmd, 0, sizeof(*rx_data->cmd) * rx_data->cmdcnt);
>         /* zero means no response expected */
>         rx_data->rxcnt = xfer->rxcnt;
>
> @@ -584,19 +584,19 @@ static int acpm_achan_alloc_cmds(struct acpm_chan *achan)
>  {
>         struct device *dev = achan->acpm->dev;
>         struct acpm_rx_data *rx_data;
> -       size_t cmd_size, n_cmd;
> +       size_t cmd_size, cmdcnt;
>         int i;
>
>         if (achan->mlen == 0)
>                 return 0;
>
>         cmd_size = sizeof(*(achan->rx_data[0].cmd));
> -       n_cmd = DIV_ROUND_UP_ULL(achan->mlen, cmd_size);
> +       cmdcnt = DIV_ROUND_UP_ULL(achan->mlen, cmd_size);
>
>         for (i = 0; i < ACPM_SEQNUM_MAX; i++) {
>                 rx_data = &achan->rx_data[i];
> -               rx_data->n_cmd = n_cmd;
> -               rx_data->cmd = devm_kcalloc(dev, n_cmd, cmd_size, GFP_KERNEL);
> +               rx_data->cmdcnt = cmdcnt;
> +               rx_data->cmd = devm_kcalloc(dev, cmdcnt, cmd_size, GFP_KERNEL);
>                 if (!rx_data->cmd)
>                         return -ENOMEM;
>         }
>
> --
> 2.54.0.545.g6539524ca2-goog
>