ACPI: CPPC: Validate _CPC entry and control semantics

Writable _CPC controls are Register descriptors encoded as Buffer objects.
Integer entries represent fixed values or legacy placeholders for
unsupported optional registers; Autonomous Selection Integer 1 is the
special immutable form which enables operation without Desired Performance.

The parser accepts arbitrary object types and cpc_write() assumes that its
argument contains a GAS. Malformed firmware can therefore make it interpret
an Integer union member as a register.

Validate the portion of each encoding consumed by the driver: bound Integer
capabilities stored in u32 fields to U32_MAX, and require Buffer entries to
start with a complete Generic Register descriptor with the expected header.
Do not restrict an Integer Counter Wraparound Time. Both AML Integers and
the kernel interface are 64-bit, despite the DWORD annotation in the ACPI
table. Continue tolerating Integer 0 placeholders for absent optional
Buffer registers to avoid breaking legacy platforms. Report their invalid
encoding as a firmware bug. Retain type checks in cpc_write() as defense in
depth. Reject an attempt to disable immutable Autonomous Selection instead
of silently applying only the EPP part of the request.

Capability registers are read into u64 temporaries but exposed through u32
fields. Reject values above U32_MAX instead of allowing them to be
truncated. In particular, a truncated Highest Performance value can become
a zero divisor in the performance-to-frequency conversion. Enforce the
required ordering from Highest through Nominal, Lowest Nonlinear, and
Lowest Performance, and constrain a present Guaranteed Performance to the
inclusive Lowest-to-Nominal range. Also reject reversed frequency anchors
and unequal frequency anchors with identical performance anchors. Those
invalid tuples otherwise make affine-conversion differences wrap or divide
by zero.

Check mandatory object presence separately from the Integer-zero convention
for absent optional fields.

Reject Minimum and Maximum Performance readbacks above U32_MAX before
narrowing them. A truncated minimum could otherwise become an explicit
zero update when cppc-cpufreq writes the initial controls back to the
platform.

Minimum Performance also defines zero as a real no-limit value, but the
exported cppc_set_perf() interface historically used zero to omit a bound.
Add a minimum-valid flag so callers can request zero without changing that
legacy convention. Set it when reading a supported Minimum Performance
register, preserving zero across cppc-cpufreq initialization and exit.
Keep zero-as-omit for Maximum Performance, whose no-limit encoding is all
ones, not zero. Initialize amd-pstate's control structure with the new flag
clear: its shared-memory backend does not record bios_min_perf, so its
zero-valued restore requests must remain omitted.

Performance Limited is listed as a required Buffer, but the interface does
not depend on it to control performance and the specification permits a
platform with no limiting indication to always report zero. Preserve
compatibility with firmware that represents that case using a NULL register
descriptor instead of disabling CPPC entirely.

Emit an error when a present _CPC package fails parsing or initialization
so such firmware and resource failures no longer silently suppress cpufreq.
Initialize malformed-package failures to -EINVAL and preserve specific
allocation, mapping, and unsupported-access errors in that diagnostic.

Fixes: 337aadff8e45 ("ACPI: Introduce CPU performance controls using CPPC")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724134251.1632824-1-christian.loehle%40arm.com
Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Link: https://patch.msgid.link/20260916162805.1039247-3-christian.loehle@arm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h
index 94a6277edab2..edf0f6ffb437 100644
--- a/include/acpi/cppc_acpi.h
+++ b/include/acpi/cppc_acpi.h
@@ -141,6 +141,8 @@ struct cppc_perf_ctrls {
 	u32 desired_perf;
 	u32 energy_perf;
 	bool auto_sel;
+	/* Allow an explicit zero minimum; otherwise zero omits the update. */
+	bool min_perf_valid;
 };
 
 struct cppc_perf_fb_ctrs {