[ Upstream commit 7cf28b3797a81b616bb7eb3e90cf131afc452919 ]

The device object rescan in acpi_scan_clear_dep_fn() is scheduled on a
system workqueue which is not guaranteed to be finished before entering
userspace. This may cause some key devices to be missing when userspace
init task tries to find them. Two issues observed on RISCV platforms:

 - Kernel panic due to userspace init cannot have an opened
   console.

   The console device scanning is queued by acpi_scan_clear_dep_queue()
   and not finished by the time userspace init process running, thus by
   the time userspace init runs, no console is present.

 - Entering rescue shell due to the lack of root devices (PCIe nvme in
   our case).

   Same reason as above, the PCIe host bridge scanning is queued on
   a system workqueue and finished after init process runs.

The reason is because both devices (console, PCIe host bridge) depend on
riscv-aplic irqchip to serve their interrupts (console's wired interrupt
and PCI's INTx interrupts). In order to keep the dependency, these
devices are scanned and created after initializing riscv-aplic. The
riscv-aplic is initialized in device_initcall() and a device scan work
is queued via acpi_scan_clear_dep_queue(), which is close to the time
userspace init process is run. Since system_dfl_wq is used in
acpi_scan_clear_dep_queue() with no synchronization, the issues will
happen if userspace init runs before these devices are ready.

The solution is to wait for the queued work to complete before entering
userspace init. One possible way would be to use a dedicated workqueue
instead of system_dfl_wq, and explicitly flush it somewhere in the
initcall stage before entering userspace. Another way is to use
async_schedule_dev_nocall() for scanning these devices. It's designed
for asynchronous initialization and will work in the same way as before
because it's using a dedicated unbound workqueue as well, but the kernel
init code calls async_synchronize_full() right before entering userspace
init which will wait for the work to complete.

Compared to a dedicated workqueue, the second approach is simpler
because the async schedule framework takes care of all of the details.
The ACPI code only needs to focus on its job. A dedicated workqueue for
this could also be redundant because some platforms don't need
acpi_scan_clear_dep_queue() for their device scanning.

Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
[ rjw: Subject adjustment, changelog edits ]
Link: https://patch.msgid.link/20260128132848.93638-1-yang.yicong@picoheart.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Vivian: Adjust system_dfl_wq -> system_unbound_wq in removed lines ]
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 9c0acc169ac71535477caedea8315f7041c5f07c upstream.

After acpi_init_device_object(), the lifetime of struct acpi_device is
managed by the driver core through reference counting.

Both acpi_add_power_resource() and acpi_add_single_object() call
acpi_init_device_object() and then invoke acpi_device_add(). If that
fails, their error paths call the release callback directly instead of
dropping the device reference through acpi_dev_put().

This bypasses the normal device lifetime rules and frees the object
without releasing the reference acquired by device_initialize(), which
may lead to a refcount leak.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fix both error paths by using acpi_dev_put() and let the release
callback handle the final cleanup.

Fixes: 781d737c7466 ("ACPI: Drop power resources driver")
Fixes: 718fb0de8ff88 ("ACPI: fix NULL bug for HID/UID string")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260413135343.2884481-1-lgs201920130244@gmail.com
Signed-off-by: Rafael J. Wysocki <rjw@rjwysocki.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull more RISC-V updates from Paul Walmsley:

 - Support for the RISC-V-standardized RPMI interface.

   RPMI is a platform management communication mechanism between OSes
   running on application processors, and a remote platform management
   processor. Similar to ARM SCMI, TI SCI, etc. This includes irqchip,
   mailbox, and clk changes.

 - Support for the RISC-V-standardized MPXY SBI extension.

   MPXY is a RISC-V-specific standard implementing a shared memory
   mailbox between S-mode operating systems (e.g., Linux) and M-mode
   firmware (e.g., OpenSBI). It is part of this PR since one of its use
   cases is to enable M-mode firmware to act as a single RPMI client for
   all RPMI activity on a core (including S-mode RPMI activity).
   Includes a mailbox driver.

 - Some ACPI-related updates to enable the use of RPMI and MPXY.

 - The addition of Linux-wide memcpy_{from,to}_le32() static inline
   functions, for RPMI use.

 - An ACPI Kconfig change to enable boot logos on any ACPI-using
   architecture (including RISC-V)

 - A RISC-V defconfig change to add GPIO keyboard and event device
   support, for front panel shutdown or reboot buttons

* tag 'riscv-for-linus-6.18-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (26 commits)
  clk: COMMON_CLK_RPMI should depend on RISCV
  ACPI: support BGRT table on RISC-V
  MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers
  RISC-V: Enable GPIO keyboard and event device in RV64 defconfig
  irqchip/riscv-rpmi-sysmsi: Add ACPI support
  mailbox/riscv-sbi-mpxy: Add ACPI support
  irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode()
  ACPI: RISC-V: Add RPMI System MSI to GSI mapping
  ACPI: RISC-V: Add support to update gsi range
  ACPI: RISC-V: Create interrupt controller list in sorted order
  ACPI: scan: Update honor list for RPMI System MSI
  ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args()
  ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop
  irqchip: Add driver for the RPMI system MSI service group
  dt-bindings: Add RPMI system MSI interrupt controller bindings
  dt-bindings: Add RPMI system MSI message proxy bindings
  clk: Add clock driver for the RISC-V RPMI clock service group
  dt-bindings: clock: Add RPMI clock service controller bindings
  dt-bindings: clock: Add RPMI clock service message proxy bindings
  mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver
  ...

Pull iommu updates from Joerg Roedel:

 - Inte VT-d:
    - IOMMU driver updated to the latest VT-d specification
    - Don't enable PRS if PDS isn't supported
    - Replace snprintf with scnprintf
    - Fix legacy mode page table dump through debugfs
    - Miscellaneous cleanups

 - AMD-Vi:
     - Support kdump boot when SNP is enabled

 - Apple-DART:
     - 4-level page-table support

 - RISC-V IOMMU:
     - ACPI support

 - Small number of miscellaneous cleanups and fixes

* tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (22 commits)
  iommu/vt-d: Disallow dirty tracking if incoherent page walk
  iommu/vt-d: debugfs: Avoid dumping context command register
  iommu/vt-d: Removal of Advanced Fault Logging
  iommu/vt-d: PRS isn't usable if PDS isn't supported
  iommu/vt-d: Remove LPIG from page group response descriptor
  iommu/vt-d: Drop unused cap_super_offset()
  iommu/vt-d: debugfs: Fix legacy mode page table dump logic
  iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
  iommu/io-pgtable-dart: Fix off by one error in table index check
  iommu/riscv: Add ACPI support
  ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id()
  ACPI: RISC-V: Add support for RIMT
  iommu/omap: Use int type to store negative error codes
  iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
  iommu/amd: Skip enabling command/event buffers for kdump
  crypto: ccp: Skip SEV and SNP INIT for kdump boot
  iommu/amd: Reuse device table for kdump
  iommu/amd: Add support to remap/unmap IOMMU buffers for kdump
  iommu/apple-dart: Add 4-level page table support
  iommu/io-pgtable-dart: Add 4-level page table support
  ...

Merge updates of the ACPI device properties management code, ACPI
resources management code, ACPI power management, and ACPI data tables
parsing code for 6.18-rc1:

 - Fix ACPI buffer properties extraction for data-only subnodes
   represented as _DSD-equivalent packages (Rafael Wysocki)

 - Fix handling of ACPI data-only subnodes represented as _DSD-equivalent
   packages in the case when they are embedded in larger _DSD-equivalent
   packages and clean up acpi_nondev_subnode_extract() (Rafael Wysocki)

 - Skip ACPI IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen)

 - Add power resource init function and use it for introducing an HP
   EliteBook 855 G7 WWAN modem power resource quirk (Maciej Szmigiero)

 - Add support for DBG2 RISC-V SBI port subtype and Precise Baud Rate
   field to the ACPI SPCR table parser (Chen Pei)

* acpi-property:
  ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract()
  ACPI: property: Do not pass NULL handles to acpi_attach_data()
  ACPI: property: Add code comments explaining what is going on
  ACPI: property: Disregard references in data-only subnode lists
  ACPI: property: Fix buffer properties extraction for subnodes

* acpi-resource:
  ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU

* acpi-pm:
  ACPI: PM: Add HP EliteBook 855 G7 WWAN modem power resource quirk
  ACPI: PM: Add power resource init function

* acpi-tables:
  ACPI: SPCR: Support Precise Baud Rate field
  ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype

The RPMI System MSI interrupt controller (just like PLIC and APLIC)
needs to probed prior to devices like GED which use interrupts provided
by it. Also, it has dependency on the SBI MPXY mailbox device.

Add HIDs of RPMI System MSI and SBI MPXY mailbox devices to the honor
list so that those dependencies are handled.

Reviewed-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
Link: https://lore.kernel.org/r/20250818040920.272664-17-apatel@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>

acpi_iommu_configure_id() currently supports only IORT (ARM) and VIOT.
Add support for RISC-V as well.

Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/20250818045807.763922-3-sunilvl@ventanamicro.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>

Some x86/ACPI laptops with MIPI cameras have a INTC10DE or INTC10E0 ACPI
device in the _DEP dependency list of the ACPI devices for the camera-
sensors (which have flags.honor_deps set).

These devices are for an Intel Vision CVS chip for which an out of tree
driver is available [1].

The camera sensor works fine without a driver being loaded for this
ACPI device on the 2 laptops this was tested on:

ThinkPad X1 Carbon Gen 12 (Meteor Lake)
ThinkPad X1 2-in-1 Gen 10 (Arrow Lake)

For now add these HIDs to acpi_ignore_dep_ids[] so that
acpi_dev_ready_for_enumeration() will return true once the other _DEP
dependencies are met and an i2c_client for the camera sensor will get
instantiated.

Link: https://github.com/intel/vision-drivers/ [1]
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20250829142748.21089-1-hansg@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

This way DMI based quirk matching and quirk flag initialization can be done
just once - in the newly introduced acpi_power_resources_init() function,
which is similar to existing acpi_*_init() functions.

Convert the single already existing DMI match-based quirk in this ACPI
power resource handler ("leave unused power resources on" quirk) to such
one-time initialization in acpi_power_resources_init() function instead of
re-running that DMI match each time acpi_turn_off_unused_power_resources()
gets called.

Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Link: https://patch.msgid.link/b173a6987f0b35597fd82400cb28f289786e03d0.1754243159.git.mail@maciej.szmigiero.name
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

In hindsight, there were some crucial subtleties overlooked when moving
{of,acpi}_dma_configure() to driver probe time to allow waiting for
IOMMU drivers with -EPROBE_DEFER, and these have become an
ever-increasing source of problems. The IOMMU API has some fundamental
assumptions that iommu_probe_device() is called for every device added
to the system, in the order in which they are added. Calling it in a
random order or not at all dependent on driver binding leads to
malformed groups, a potential lack of isolation for devices with no
driver, and all manner of unexpected concurrency and race conditions.
We've attempted to mitigate the latter with point-fix bodges like
iommu_probe_device_lock, but it's a losing battle and the time has come
to bite the bullet and address the true source of the problem instead.

The crux of the matter is that the firmware parsing actually serves two
distinct purposes; one is identifying the IOMMU instance associated with
a device so we can check its availability, the second is actually
telling that instance about the relevant firmware-provided data for the
device. However the latter also depends on the former, and at the time
there was no good place to defer and retry that separately from the
availability check we also wanted for client driver probe.

Nowadays, though, we have a proper notion of multiple IOMMU instances in
the core API itself, and each one gets a chance to probe its own devices
upon registration, so we can finally make that work as intended for
DT/IORT/VIOT platforms too. All we need is for iommu_probe_device() to
be able to run the iommu_fwspec machinery currently buried deep in the
wrong end of {of,acpi}_dma_configure(). Luckily it turns out to be
surprisingly straightforward to bootstrap this transformation by pretty
much just calling the same path twice. At client driver probe time,
dev->driver is obviously set; conversely at device_add(), or a
subsequent bus_iommu_probe(), any device waiting for an IOMMU really
should *not* have a driver already, so we can use that as a condition to
disambiguate the two cases, and avoid recursing back into the IOMMU core
at the wrong times.

Obviously this isn't the nicest thing, but for now it gives us a
functional baseline to then unpick the layers in between without many
more awkward cross-subsystem patches. There are some minor side-effects
like dma_range_map potentially being created earlier, and some debug
prints being repeated, but these aren't significantly detrimental. Let's
make things work first, then deal with making them nice.

With the basic flow finally in the right order again, the next step is
probably turning the bus->dma_configure paths inside-out, since all we
really need from bus code is its notion of which device and input ID(s)
to parse the common firmware properties with...

Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci-driver.c
Acked-by: Rob Herring (Arm) <robh@kernel.org> # of/device.c
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/e3b191e6fd6ca9a1e84c5e5e40044faf97abb874.1740753261.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>