[PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[Sudeep Holla]

ACPI PCC shared memory layouts reserve the first dword for the PCC
signature. ACPI specification defines the signature as 0x50434300 ORed
with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
populated by the platform and verified by OSPM.

This series centralizes PCC shared memory signature validation in the PCC
mailbox controller and stops PCC users from rewriting the signature before
each command. Clients that previously copied complete local PCC headers
now update only the mutable command/status/flags/length/payload fields.

The final patch also fixes the PCC OperationRegion handler. ACPI defines
a PCC OperationRegion as the shared memory fields that follow the PCC
signature, with the OperationRegion length covering only those fields. The
handler is updated to copy to/from the region after the signature and to
reject regions that do not fit there.

All patches can go independently as there is no strict dependency between
them and posted together for the complete context.

Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
---
Sudeep Holla (6):
      mailbox: pcc: Validate shared memory signature on request
      hwmon: xgene: Stop writing PCC shared memory signature
      i2c: xgene-slimpro: Stop writing PCC shared memory signature
      devfreq: hisi_uncore: Preserve PCC shared memory signature
      soc: hisilicon: kunpeng_hccs: Preserve PCC signatures
      ACPI: PCC: Preserve shared memory signature in OpRegion handler

 drivers/acpi/acpi_pcc.c                | 20 ++++++++++++++----
 drivers/devfreq/hisi_uncore_freq.c     | 15 +++++++-------
 drivers/hwmon/xgene-hwmon.c            |  4 ----
 drivers/i2c/busses/i2c-xgene-slimpro.c |  3 ---
 drivers/mailbox/pcc.c                  | 38 +++++++++++++++++++++++++++++-----
 drivers/soc/hisilicon/kunpeng_hccs.c   | 24 ++++++++-------------
 6 files changed, 65 insertions(+), 39 deletions(-)
---
base-commit: 5a66900afbd6b2a063eebad35294038a654de2b0
change-id: 20260627-acpi_pcc_signature-7b70b0633c8f


-- 
Regards,
Sudeep

[PATCH 4/6] devfreq: hisi_uncore: Preserve PCC shared memory signature

[Sudeep Holla]

ACPI specification defines the generic PCC shared memory signature as
the PCC base signature ORed with the subspace ID.

ACPI 6.6 added clarification that the signature is populated by the
platform and verified by OSPM.

The PCC mailbox controller now validates the signature when the channel
is requested. Stop copying a complete local PCC header into shared
memory and write only the command, status and payload fields, leaving
the platform-populated signature intact.

Cc: MyungJoo Ham <myungjoo.ham@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Chanwoo Choi <cw00.choi@samsung.com>
Cc: Huisong Li <lihuisong@huawei.com>
Cc: linux-pm@vger.kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
---
 drivers/devfreq/hisi_uncore_freq.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/devfreq/hisi_uncore_freq.c b/drivers/devfreq/hisi_uncore_freq.c
index 4d00d813c8ac..7976eb359061 100644
--- a/drivers/devfreq/hisi_uncore_freq.c
+++ b/drivers/devfreq/hisi_uncore_freq.c
@@ -187,7 +187,6 @@ static int hisi_uncore_cmd_send(struct hisi_uncore_freq *uncore,
 				u8 cmd, u32 *data)
 {
 	struct hisi_uncore_pcc_shmem __iomem *addr;
-	struct hisi_uncore_pcc_shmem shmem;
 	struct pcc_mbox_chan *pchan;
 	unsigned int mrtt;
 	s64 time_delta;
@@ -210,13 +209,13 @@ static int hisi_uncore_cmd_send(struct hisi_uncore_freq *uncore,
 	if (mrtt > time_delta)
 		udelay(mrtt - time_delta);
 
-	/* Copy data */
-	shmem.head = (struct acpi_pcct_shared_memory) {
-		.signature = PCC_SIGNATURE | uncore->chan_id,
-		.command = cmd,
-	};
-	shmem.pcc_data.data = *data;
-	memcpy_toio(addr, &shmem, sizeof(shmem));
+	/*
+	 * Copy command and data, leaving the platform-populated signature
+	 * intact.
+	 */
+	iowrite16(cmd, &addr->head.command);
+	iowrite16(0, &addr->head.status);
+	iowrite32(*data, &addr->pcc_data.data);
 
 	/* Ring doorbell */
 	rc = mbox_send_message(pchan->mchan, &cmd);

-- 
2.43.0

Re: [PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[lihuisong (C)]

Hi Sudeep,

On 6/28/2026 12:37 AM, Sudeep Holla wrote:
> ACPI PCC shared memory layouts reserve the first dword for the PCC
> signature. ACPI specification defines the signature as 0x50434300 ORed
> with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
> populated by the platform and verified by OSPM.
>
> This series centralizes PCC shared memory signature validation in the PCC
> mailbox controller and stops PCC users from rewriting the signature before
> each command. Clients that previously copied complete local PCC headers
> now update only the mutable command/status/flags/length/payload fields.
I am concerned that this may affect the functionality of drivers on some 
existed platforms.
This largely depends on the implementation of the platform firmware.

I think it's good for the signature to be filled in by the command 
initiator and then verified
by the recipient, as this is how this field can serve its purpose.
Otherwise, I really don't see what use it has.

/Huisong
>
> The final patch also fixes the PCC OperationRegion handler. ACPI defines
> a PCC OperationRegion as the shared memory fields that follow the PCC
> signature, with the OperationRegion length covering only those fields. The
> handler is updated to copy to/from the region after the signature and to
> reject regions that do not fit there.
>
> All patches can go independently as there is no strict dependency between
> them and posted together for the complete context.
>
> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
> ---
> Sudeep Holla (6):
>        mailbox: pcc: Validate shared memory signature on request
>        hwmon: xgene: Stop writing PCC shared memory signature
>        i2c: xgene-slimpro: Stop writing PCC shared memory signature
>        devfreq: hisi_uncore: Preserve PCC shared memory signature
>        soc: hisilicon: kunpeng_hccs: Preserve PCC signatures
>        ACPI: PCC: Preserve shared memory signature in OpRegion handler
>
>   drivers/acpi/acpi_pcc.c                | 20 ++++++++++++++----
>   drivers/devfreq/hisi_uncore_freq.c     | 15 +++++++-------
>   drivers/hwmon/xgene-hwmon.c            |  4 ----
>   drivers/i2c/busses/i2c-xgene-slimpro.c |  3 ---
>   drivers/mailbox/pcc.c                  | 38 +++++++++++++++++++++++++++++-----
>   drivers/soc/hisilicon/kunpeng_hccs.c   | 24 ++++++++-------------
>   6 files changed, 65 insertions(+), 39 deletions(-)
> ---
> base-commit: 5a66900afbd6b2a063eebad35294038a654de2b0
> change-id: 20260627-acpi_pcc_signature-7b70b0633c8f
>
>

Re: [PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[Sudeep Holla]

On Tue, Jun 30, 2026 at 05:25:20PM +0800, lihuisong (C) wrote:
> Hi Sudeep,
> 
> On 6/28/2026 12:37 AM, Sudeep Holla wrote:
> > ACPI PCC shared memory layouts reserve the first dword for the PCC
> > signature. ACPI specification defines the signature as 0x50434300 ORed
> > with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
> > populated by the platform and verified by OSPM.
> > 
> > This series centralizes PCC shared memory signature validation in the PCC
> > mailbox controller and stops PCC users from rewriting the signature before
> > each command. Clients that previously copied complete local PCC headers
> > now update only the mutable command/status/flags/length/payload fields.
> I am concerned that this may affect the functionality of drivers on some
> existed platforms.

One other option I was thinking is to not issue error but just log the error
message and let the client driver add that additional check if required.

> This largely depends on the implementation of the platform firmware.
> 

Sure. However I always expected it to be taken care by the platform, v6.6
just adds that clarification explicitly. It was never clear that the sender
or the OSPM needs to write that signature, so I disagree that it is platform
firmware dependent entirely. The clarification wouldn't have got added if
there was any disagreement on that fact.

> I think it's good for the signature to be filled in by the command initiator
> and then verified by the recipient, as this is how this field can serve its
> purpose.
> Otherwise, I really don't see what use it has.

Please get the spec updated accordingly, we can just change in the kernel
based on what we think is the best way to use it. It needs to be clearly
specified, otherwise it may cause issue for non-Linux OSVs.

-- 
Regards,
Sudeep

Re: [PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[lihuisong (C)]

On 6/30/2026 6:49 PM, Sudeep Holla wrote:
> On Tue, Jun 30, 2026 at 05:25:20PM +0800, lihuisong (C) wrote:
>> Hi Sudeep,
>>
>> On 6/28/2026 12:37 AM, Sudeep Holla wrote:
>>> ACPI PCC shared memory layouts reserve the first dword for the PCC
>>> signature. ACPI specification defines the signature as 0x50434300 ORed
>>> with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
>>> populated by the platform and verified by OSPM.
>>>
>>> This series centralizes PCC shared memory signature validation in the PCC
>>> mailbox controller and stops PCC users from rewriting the signature before
>>> each command. Clients that previously copied complete local PCC headers
>>> now update only the mutable command/status/flags/length/payload fields.
>> I am concerned that this may affect the functionality of drivers on some
>> existed platforms.
> One other option I was thinking is to not issue error but just log the error
> message and let the client driver add that additional check if required.
The patch 1/6 is not good to our platform.
Yeah, suggest to use gentle approach to do this if we have to clarify 
this signature.
After all, all client drivers work well before.
>> This largely depends on the implementation of the platform firmware.
>>
> Sure. However I always expected it to be taken care by the platform, v6.6
> just adds that clarification explicitly. It was never clear that the sender
> or the OSPM needs to write that signature, so I disagree that it is platform
> firmware dependent entirely. The clarification wouldn't have got added if
> there was any disagreement on that fact.
The reasons I say this largely depends on the firmware are as follows:
1> The previous ACPI spec did not clearly require that the platform 
firmware needs to fill in this signature first.
      The client driver working on these platform doesn't work anymore 
if use the way in patch 1/6.
2> We are not sure if some firmware verify this signature or clear this 
signature field in shared memory.
>
>> I think it's good for the signature to be filled in by the command initiator
>> and then verified by the recipient, as this is how this field can serve its
>> purpose.
>> Otherwise, I really don't see what use it has.
> Please get the spec updated accordingly, we can just change in the kernel
> based on what we think is the best way to use it. It needs to be clearly
> specified, otherwise it may cause issue for non-Linux OSVs.
Agree.

Yeah, I found spec v6.5 just said how to compute it and didn't specify 
how to use it for platform and OSPM.
I saw the update of v6.6 for the signature field in "Generic 
Communications Channel Shared Memory Region" and "Extended PCC Subspace 
Shared Memory Region".
like: "The signature is populated by the platform and is verified by OSPM."
But please note v6.6 didn't say above words in "Reduced PCC Subspace 
Shared Memory Region".

I don't know why v6.6 specify like that.
After all. all PCC application parties (client drivers) in Linux have 
already filled this field.

According to my understanding of normal signature in communication,
it is generally filled by the initiator (sender) and verified by the 
responder (receiver).
In this way, the data is valid, and the signature is meaningful.

If it is only initialized by firmware, and OSPM verifies it, its 
lifecycle ends there.
I don't think this signature has much significance.

The signature field is just in shared memory and may be cleared due to 
some other exception.
Some similar case also need to be considered.
How to make it work better and more resilient may also be something we 
need to consider.
>

Re: [PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[Sudeep Holla]

On Wed, Jul 01, 2026 at 03:38:21PM +0800, lihuisong (C) wrote:
> 
> On 6/30/2026 6:49 PM, Sudeep Holla wrote:
> > On Tue, Jun 30, 2026 at 05:25:20PM +0800, lihuisong (C) wrote:
> > > Hi Sudeep,
> > > 
> > > On 6/28/2026 12:37 AM, Sudeep Holla wrote:
> > > > ACPI PCC shared memory layouts reserve the first dword for the PCC
> > > > signature. ACPI specification defines the signature as 0x50434300 ORed
> > > > with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
> > > > populated by the platform and verified by OSPM.
> > > > 
> > > > This series centralizes PCC shared memory signature validation in the PCC
> > > > mailbox controller and stops PCC users from rewriting the signature before
> > > > each command. Clients that previously copied complete local PCC headers
> > > > now update only the mutable command/status/flags/length/payload fields.
> > > I am concerned that this may affect the functionality of drivers on some
> > > existed platforms.
> > One other option I was thinking is to not issue error but just log the error
> > message and let the client driver add that additional check if required.
> The patch 1/6 is not good to our platform.
> Yeah, suggest to use gentle approach to do this if we have to clarify this
> signature.

Fair enough, we can just log the warning for now.

> After all, all client drivers work well before.

Sure, but not doing anything will just make the bug carry on for ever in
the firmware. SO logging warning is minimum we should do IMO.

> > > This largely depends on the implementation of the platform firmware.
> > > 
> > Sure. However I always expected it to be taken care by the platform, v6.6
> > just adds that clarification explicitly. It was never clear that the sender
> > or the OSPM needs to write that signature, so I disagree that it is platform
> > firmware dependent entirely. The clarification wouldn't have got added if
> > there was any disagreement on that fact.
> The reasons I say this largely depends on the firmware are as follows:
> 1> The previous ACPI spec did not clearly require that the platform firmware
> needs to fill in this signature first.
>      The client driver working on these platform doesn't work anymore if use
> the way in patch 1/6.

Fair enough.

> 2> We are not sure if some firmware verify this signature or clear this
> signature field in shared memory.

Anyways, better to check that for current and future platforms if not the
legacy ones.

> > 
> > > I think it's good for the signature to be filled in by the command initiator
> > > and then verified by the recipient, as this is how this field can serve its
> > > purpose.
> > > Otherwise, I really don't see what use it has.
> > Please get the spec updated accordingly, we can just change in the kernel
> > based on what we think is the best way to use it. It needs to be clearly
> > specified, otherwise it may cause issue for non-Linux OSVs.
> Agree.
> 
> Yeah, I found spec v6.5 just said how to compute it and didn't specify how
> to use it for platform and OSPM.
> I saw the update of v6.6 for the signature field in "Generic Communications
> Channel Shared Memory Region" and "Extended PCC Subspace Shared Memory
> Region".
> like: "The signature is populated by the platform and is verified by OSPM."
> But please note v6.6 didn't say above words in "Reduced PCC Subspace Shared
> Memory Region".
> 

Ah, that's just inconsistency I believe. I will raise a defect.

> I don't know why v6.6 specify like that.
> After all. all PCC application parties (client drivers) in Linux have
> already filled this field.
> 

I don't think what Linux drivers should be the reference as there are other
OSVs.

> According to my understanding of normal signature in communication,
> it is generally filled by the initiator (sender) and verified by the
> responder (receiver).
> In this way, the data is valid, and the signature is meaningful.
> 
> If it is only initialized by firmware, and OSPM verifies it, its lifecycle
> ends there.
> I don't think this signature has much significance.
> 
> The signature field is just in shared memory and may be cleared due to some
> other exception.
> Some similar case also need to be considered.
> How to make it work better and more resilient may also be something we need
> to consider.

Not sure if I follow that. The way I expect is platform won't populate the
signature if everything is not initialised and running at it's end which
implies it is not ready to accept the request.

-- 
Regards,
Sudeep

Re: [PATCH 0/6] ACPI/PCC: Preserve platform-populated PCC signatures

[lihuisong (C)]

On 7/2/2026 6:21 PM, Sudeep Holla wrote:
> On Wed, Jul 01, 2026 at 03:38:21PM +0800, lihuisong (C) wrote:
>> On 6/30/2026 6:49 PM, Sudeep Holla wrote:
>>> On Tue, Jun 30, 2026 at 05:25:20PM +0800, lihuisong (C) wrote:
>>>> Hi Sudeep,
>>>>
>>>> On 6/28/2026 12:37 AM, Sudeep Holla wrote:
>>>>> ACPI PCC shared memory layouts reserve the first dword for the PCC
>>>>> signature. ACPI specification defines the signature as 0x50434300 ORed
>>>>> with the PCC subspace ID, and ACPI 6.6 clarify that the signature is
>>>>> populated by the platform and verified by OSPM.
>>>>>
>>>>> This series centralizes PCC shared memory signature validation in the PCC
>>>>> mailbox controller and stops PCC users from rewriting the signature before
>>>>> each command. Clients that previously copied complete local PCC headers
>>>>> now update only the mutable command/status/flags/length/payload fields.
>>>> I am concerned that this may affect the functionality of drivers on some
>>>> existed platforms.
>>> One other option I was thinking is to not issue error but just log the error
>>> message and let the client driver add that additional check if required.
>> The patch 1/6 is not good to our platform.
>> Yeah, suggest to use gentle approach to do this if we have to clarify this
>> signature.
> Fair enough, we can just log the warning for now.
Ack.
>
>> After all, all client drivers work well before.
> Sure, but not doing anything will just make the bug carry on for ever in
> the firmware. SO logging warning is minimum we should do IMO.
Agree. We need to clearify this based on spec.
>
>>>> This largely depends on the implementation of the platform firmware.
>>>>
>>> Sure. However I always expected it to be taken care by the platform, v6.6
>>> just adds that clarification explicitly. It was never clear that the sender
>>> or the OSPM needs to write that signature, so I disagree that it is platform
>>> firmware dependent entirely. The clarification wouldn't have got added if
>>> there was any disagreement on that fact.
>> The reasons I say this largely depends on the firmware are as follows:
>> 1> The previous ACPI spec did not clearly require that the platform firmware
>> needs to fill in this signature first.
>>       The client driver working on these platform doesn't work anymore if use
>> the way in patch 1/6.
> Fair enough.
>
>> 2> We are not sure if some firmware verify this signature or clear this
>> signature field in shared memory.
> Anyways, better to check that for current and future platforms if not the
> legacy ones.
>
>>>> I think it's good for the signature to be filled in by the command initiator
>>>> and then verified by the recipient, as this is how this field can serve its
>>>> purpose.
>>>> Otherwise, I really don't see what use it has.
>>> Please get the spec updated accordingly, we can just change in the kernel
>>> based on what we think is the best way to use it. It needs to be clearly
>>> specified, otherwise it may cause issue for non-Linux OSVs.
>> Agree.
>>
>> Yeah, I found spec v6.5 just said how to compute it and didn't specify how
>> to use it for platform and OSPM.
>> I saw the update of v6.6 for the signature field in "Generic Communications
>> Channel Shared Memory Region" and "Extended PCC Subspace Shared Memory
>> Region".
>> like: "The signature is populated by the platform and is verified by OSPM."
>> But please note v6.6 didn't say above words in "Reduced PCC Subspace Shared
>> Memory Region".
>>
> Ah, that's just inconsistency I believe. I will raise a defect.
Nice.
>
>> I don't know why v6.6 specify like that.
>> After all. all PCC application parties (client drivers) in Linux have
>> already filled this field.
>>
> I don't think what Linux drivers should be the reference as there are other
> OSVs.
Agree.
>> According to my understanding of normal signature in communication,
>> it is generally filled by the initiator (sender) and verified by the
>> responder (receiver).
>> In this way, the data is valid, and the signature is meaningful.
>>
>> If it is only initialized by firmware, and OSPM verifies it, its lifecycle
>> ends there.
>> I don't think this signature has much significance.
>>
>> The signature field is just in shared memory and may be cleared due to some
>> other exception.
>> Some similar case also need to be considered.
>> How to make it work better and more resilient may also be something we need
>> to consider.
> Not sure if I follow that. The way I expect is platform won't populate the
> signature if everything is not initialised and running at it's end which
> implies it is not ready to accept the request.
It can also be defined this way.
But platform firmware is generally ready to accept request when OS is 
running.
If platform isn't ready to accept the request from OSPM, the command 
will execute failed.
So it seems that the signature is a bit redundant if it is only used to 
indicate that the platform is ready to receive data.

Anyway, I follow spec, just does not understand the signature usage spec 
6.6 added.