Pull more ACPI support updates from Rafael Wysocki:
 "These update documentation to reflect recent changes in the upstream
  ACPICA project, fix issues in the core ACPI device enumeration code
  (one of which has been introduced recently), improve the primary
  "physical" device lookup for ACPI device objects in that code, and
  update ACPI device drivers:

   - Update MAINTAINERS, CREDITS and ACPI subsystem documentation to
     reflect recent changes in the upstream ACPICA project (Rafael
     Wysocki)

   - Prevent the core ACPI enumeration code from combining device
     resources that overlap completely in order to avoid resource
     conflicts during platform device registration because there are
     drivers that expect such resources to be present (Rafael Wysocki)

   - Defer device power initialization during ACPI-based device
     enumeration to the point when the given device is known to be
     present and functional and all of its dependencies have been met
     (Peixin Xie)

   - Fix bus ID cleanup on device_add() failures during ACPI device
     object registration (Hongyan Xu)

   - Introduce a new helper function for looking up the primary
     "physical" device for a given ACPI device object and update the
     core ACPI device enumeration code to use that function (Rafael
     Wysocki)

   - Protect all battery properties with a separated mutex in the ACPI
     battery driver to prevent race conditions from occurring and avoid
     evaluating the _BST ACPI control method multiple times in parallel
     for the same battery device (Rong Zhang)

   - Add DMI quirk for the Razer Blade Pro 17 early 2020 lid switch to
     the ACPI button driver (Robin Everaars)

   - Convert fixed clock rates in the ACPI driver for AMD SoCs (APD) to
     use HZ_PER_MHZ and add a clock frequency for the HJMC01 I2C
     controller to it (Hongnan Li and Xiangyang Yu)

   - Fix a stack buffer overflow in query_capability() in the ACPI
     platform firmware runtime update driver (Anirudh Prasad)"

* tag 'acpi-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch
  ACPI: scan: Do not combine resources that overlap completely
  ACPI: Update upstream ACPICA repository URL in documentation
  ACPI: Update MAINTAINERS entry for ACPICA
  ACPI: Add Bob Moore to CREDITS
  ACPI: pfr_update: fix stack buffer overflow in query_capability()
  ACPI: scan: Defer device power initialization
  ACPI: APD: Add clock frequency for HJMC01 I2C controller
  ACPI: APD: Convert fixed clock rates to use HZ_PER_MHZ
  ACPI: scan: Use acpi_bus_get_primary_device()
  ACPI: platform: Use acpi_bus_get_primary_device()
  ACPI: bus: Introduce acpi_bus_get_primary_device()
  ACPI: scan: fix bus ID cleanup on device_add() failures
  ACPI: battery: Protect all properties with a separated mutex

Merge updates of assorted ACPI drivers for 7.3-rc1:

 - Protect all battery properties with a separated mutex in the ACPI
   battery driver to prevent race conditions from occurring and avoid
   evaluating the _BST ACPI control method multiple times in parallel
   for the same battery device (Rong Zhang)

 - Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch to the
   ACPI button driver (Robin Everaars)

 - Convert fixed clock rates in the ACPI driver for AMD SoCs (APD) to
   use HZ_PER_MHZ and add a clock frequency for the HJMC01 I2C
   controller to it (Hongnan Li and Xiangyang Yu)

 - Fix a stack buffer overflow in query_capability() in the ACPI
   platform firmware runtime update driver (Anirudh Prasad)

* acpi-battery:
  ACPI: battery: Protect all properties with a separated mutex

* acpi-button:
  ACPI: button: Add DMI quirk for Razer Blade Pro 17 early 2020 lid switch

* acpi-soc:
  ACPI: APD: Add clock frequency for HJMC01 I2C controller
  ACPI: APD: Convert fixed clock rates to use HZ_PER_MHZ

* acpi-pfrut:
  ACPI: pfr_update: fix stack buffer overflow in query_capability()

Merge changes related to primary "physical" device lookup for a given
ACPI device object that include the introduction of a new lookup helper
function and core ACPI device enumeration code updates putting that new
function to use (Rafael Wysocki)

* acpi-bus:
  ACPI: scan: Use acpi_bus_get_primary_device()
  ACPI: platform: Use acpi_bus_get_primary_device()
  ACPI: bus: Introduce acpi_bus_get_primary_device()

Merge core ACPI device enumeration code changes for 7.3-rc1:

 - Prevent the core ACPI enumeration code from combining device
   resources that overlap completely in order to avoid resource
   conflicts during platform device registration because there are
   drivers that expect such resources to be present (Rafael Wysocki)

 - Defer device power initialization during ACPI-based device
   enumeration to the point when the given device is known to be present
   and functional and all of its dependencies have been met (Peixin Xie)

 - Fix bus ID cleanup on device_add() failures during ACPI device object
   registration (Hongyan Xu)

* acpi-scan:
  ACPI: scan: Do not combine resources that overlap completely
  ACPI: scan: Defer device power initialization
  ACPI: scan: fix bus ID cleanup on device_add() failures

The lid switch reports "close" but can miss the matching "open", leaving
_LID closed after resume. systemd-logind then suspends the system again
roughly every 35 seconds.

Reading the embedded controller's PSTA byte while _LID is stale shows that
bit 0x04 is set, which the DSDT treats as open. The DSDT returns the cached
LIDS byte from _LID. Its wake path aborts in RTEC on an unhandled
SystemCMOS region before copying PSTA to LIDS.

Initialize the lid state to open on resume, matching the existing quirk
for the Razer Blade Stealth 13 late 2019. With
button.lid_init_state=open, a physical close suspended once and resume
reported open without another suspend.

Signed-off-by: Robin Everaars <robineveraars@pm.me>
Link: https://patch.msgid.link/20260817141414.213075-1-robineveraars@pm.me
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Commit f234fdaae1ca ("ACPI: scan: Avoid registering platform devices
with resource overlaps") attempted to avoid platform device registration
errors due to overlaps of resources of the same type returned by the
same _CRS object in the ACPI tables.  It did that by combining two or
more overlapping resources into one, but it went too far and also
caused resources that overlap completely to be combined which broke
the arm-cmn driver that expects two MMIO resources to be present for
each device it binds to and it expects those two resources to overlap
completely.

Address this issue by adding checks for completely overlapping
resources to acpi_platform_adjust_resources() and add a comment
explaining what is done there.

Fixes: f234fdaae1ca ("ACPI: scan: Avoid registering platform devices with resource overlaps")
Reported-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-acpi/20260819003752.GA3063251@ax162/
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://patch.msgid.link/12955564.O9o76ZdvQC@rafael.j.wysocki

Pull CXL updates from Dave Jiang:
 "This includes the remaining patches to complete the basic support for
  CXL type2 (accelerators) drivers by the CXL core. A set of unit
  testing support to catch regressions for the CXL core type2 exported
  functions has also been added. The actual CXL type 2 driver support
  for the AMD Solarflare NIC driver has been picked up by net-dev.

  A set of preparatory patches has been picked up from the CXL port
  error handling series in order to reduce the number of patches in that
  series for review. The rest of that series is getting close to be
  merged but was not ready for the 7.3 merge window.

  There are also a number of misc patches and a large number of bug
  fixes against pre-existing issues flagged by sashiko reviews as
  contributors post new patches on the mailing list. We will continue to
  work through the sashiko raised issues as they show up."

* tag 'cxl-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (35 commits)
  cxl/Documentation: Spell out globbed sysfs attribute names
  cxl: Rename find_cxl_port() to find_cxl_port_by_dport()
  cxl: Tighten CPER kfifo registration API and symbol visibility
  acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
  cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
  cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
  cxl/test: Assign one mock memdev a full-width serial number
  cxl/core: Format the memdev serial number as unsigned in TP_printk
  cxl/pmem: Format the nvdimm serial number as unsigned decimal
  cxl: Use %pe to print error pointers
  cxl/region: Use __free(put_device) in find_pos_and_ways()
  cxl/region: Fix use-after-free in find_pos_and_ways() error path
  cxl: Deny Features commands on the RAW mailbox path
  cxl/features: Clamp Get Feature output size to the remaining buffer
  cxl/features: Reject Set Features output buffer smaller than the header
  cxl/features: Reject Get Feature count larger than the output buffer
  cxl/port: Restart port enumeration when a sibling adds the dport first
  cxl/features: Serialize multi-part Get/Set Feature transfers
  cxl/pci: Honor -EPROBE_DEFER from component register setup
  cxl/mbox: Break poison list loop on an empty payload
  ...

Pull RISC-V updates from Paul Walmsley

 - Add initial definitions and discovery for the Smcsrind, Sscsrind,
   Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse,
   Za64rs, and Ssqosid RISC-V ISA extensions

 - Improve the RISC-V update_mmu_cache_range() implementation by using
   flush-by-ASID, enabling performance improvements on
   microarchitectures that support related optimizations; and by taking
   advantage of the Svinval RISC-V ISA extension on microarchitectures
   that support it

 - Shrink CFI shadow stack allocation further (to 512MB) to save virtual
   address space (and physical memory on systems with strict overcommit
   policies)

 - Add initial CPU context switch support for QoS tagging (Ssqosid)

 - Change our vector misaligned access speed test code to be
   synchronous, avoiding a bunch of bugs related to unnecessary
   asynchronicity

 - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table
   debugging (similar to ARM64 and x86)

 - Extract vDSO section offsets at build time, rather than run time, to
   avoid the boot time overhead

 - Use assembler directives to control the use of instructions from the
   RISC-V ISA extensions Zacas and Zabha, rather than compiler -march
   flags that could affect the whole kernel (similar to ARM64)

 - Add a kselftest for kprobes support for the c.jal instruction on
   RISC-V

 - When UEFI runtime services are available, use them to restart and
   power off

 - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing
   include file to the ACPI code

 - Move contiguous DMA memory reservation later in the boot, to ensure
   that the correct global and per-node pools are allocated when
   CONFIG_CMA_SIZE_PERNUMA is enabled

 - Disallow probes on breakpoint handlers to avoid recursing
   indefinitely into do_trap_break()

 - Patch the compat vDSO during runtime alternatives processing, not
   only the standard vDSO

 - Remove some leftover XIP support elements missed by commit
   9b3a2be84803 ("riscv: Remove support for XIP kernel")

 - Fix broadcast timer switching in ACPI LPI power states by
   implementing a RISC-V version of arch_get_idle_state_flags()

 - Miscellaneous fixes, including: vDSO makefile simplification; marking
   our default_power_off() as __noreturn; error path fixes in the PMU
   SBI perf driver; RISC-V extension capitalization consistency; the use
   of BIT() macros in one of our include files; and some documentation
   fixes

* tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits)
  RISC-V: hwprobe: Use BIT macro to avoid warnings
  riscv: alternative: Also patch the compat vDSO
  riscv: alternative: Use the statically extracted vDSO section offsets
  riscv: vdso: Add symbols for the alternative section boundaries
  riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
  riscv: Add Zicclsm to cpufeature and hwprobe
  riscv: cpufeature: Clarify ISA spec version for canonical order
  riscv: Standardize extension capitalization
  riscv: kprobes: Prevent probes in breakpoint handlers
  riscv: cmpxchg: Use .option arch for Zacas and Zabha
  riscv: acpi: Handle LPI architectural context loss flags
  riscv: further remove XIP
  riscv: Add support for srmcfg CSR from Ssqosid extension
  riscv: Detect the Ssqosid extension
  dt-bindings: riscv: Add Ssqosid extension description
  dt-bindings: riscv: add Counter delegation ISA extensions description
  RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
  RISC-V: Add Ssccfg extension CSR definition
  dt-bindings: riscv: add Smcntrpmf ISA extension description
  RISC-V: Add Smcntrpmf extension parsing
  ...

query_capability() copies four ACPI buffer objects returned by the
firmware _DSM into fixed-size u8[16] fields in struct
pfru_update_cap_info using memcpy with the firmware-supplied length:

  memcpy(&cap_hdr->code_type,
         elements[CAP_CODE_TYPE_IDX].buffer.pointer,
         elements[CAP_CODE_TYPE_IDX].buffer.length);

The same pattern repeats for drv_type, platform_id, and oem_id.
If the firmware returns buffer.length > 16 for any of these fields,
memcpy writes past the destination array.

struct pfru_update_cap_info is stack-allocated in pfru_ioctl().

Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports
are generated when a DSM returns 64-byte buffers, with writes reaching
44 bytes past the end of cap_hdr's [64, 156) frame window into
adjacent stack redzones.

Introduce a helper pointer to out_obj->package.elements and use it
to validate each buffer length against its destination field size
before copying, returning -EINVAL if the firmware supplies an
oversized buffer.

Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Anirudh Prasad <icarus@a0rg.com>
Link: https://patch.msgid.link/1a001e1fee9.637da6dc3533246.238498880682901704@a0rg.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

acpi_bus_get_power_flags() initializes the device power state while the
ACPI device object is being created, before checking whether the device
is ready for enumeration.

If enumeration is deferred, acpi_bus_attach() clears the initialized and
power_manageable flags. When the dependency is later satisfied,
acpi_bus_init_power() is called again and takes additional references to
the power resources used by the device. These references prevent the
resources from being turned off when the device enters D3.

This issue was reproduced on a SpacemiT K3 RISC-V Pico-ITX. The affected
device uses a power resource through _PR0 and has an automatically
derived dependency on its interrupt controller.

The initial power initialization acquires a power resource reference.
The device is then deferred, but that reference is not dropped. When
the dependency becomes available, power initialization acquires another
reference. Consequently, entering D3 only drops the reference count
from 2 to 1 and _OFF is not evaluated:

 [    0.314611] ACPI Debug:  "I2P2 _STA"
 [    0.318260] ACPI: \_SB_.I2P2: ACPI: PM: Power resource is on
 [    0.323998] ACPI: \_SB_.I2P2: New power resource
 [    0.382108] ACPI Debug:  "I2P2 _STA"
 [    0.478964] ACPI Debug:  "I2P2 _ON"
 [    0.482498] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned on
 [    0.488597] ACPI Debug:  "I2C2, PS0"
 [    0.863170] ACPI: \_SB_.I2P2: ACPI: PM: Power resource already on
 [    0.873686] ACPI Debug:  "I2C2, PS0"
 [    2.416055] ACPI Debug:  "I2C2, PS3"
 [    2.423397] ACPI: \_SB_.I2P2: ACPI: PM: Power resource still in use

To address this, remove the early acpi_bus_init_power() call and leave
regular ACPI device objects uninitialized until acpi_bus_attach() runs
after the device is ready for enumeration.

Power resource objects are initialized through acpi_add_power_resource()
and do not require the generic initialization in acpi_bus_attach(), so
mark them as initialized there.

After the change, device power state initialization is deferred until its
dependency is met. Since no reference is acquired before then, the power
resource left on by firmware is turned off as unused after the namespace
scan. Once the dependency is met, the resource is turned on once for the
device and is turned off normally when the device later enters D3:

 [    0.314628] ACPI Debug:  "I2P2 _STA"
 [    0.318277] ACPI: \_SB_.I2P2: ACPI: PM: Power resource is on
 [    0.324016] ACPI: \_SB_.I2P2: New power resource
 [    0.382118] ACPI Debug:  "I2P2 _STA"
 [    0.496116] ACPI: \_SB_.I2P2: ACPI: PM: Turning OFF
 [    0.501081] ACPI Debug:  "I2P2 _OFF"
 [    0.504705] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned off
 [    1.415899] ACPI Debug:  "I2P2 _ON"
 [    1.418866] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned on
 [    1.424947] ACPI Debug:  "I2C2, PS0"
 [    2.647655] ACPI Debug:  "I2C2, PS3"
 [    2.654856] ACPI Debug:  "I2P2 _OFF"
 [    2.654866] ACPI: \_SB_.I2P2: ACPI: PM: Power resource turned off

This also avoids powering up devices before their dependencies are
available.

Signed-off-by: Peixin Xie <peixin.xie@linux.spacemit.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260820-acpi-power-resource-ref-fix-v2-1-29818173ea13@linux.spacemit.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>