If someone removes a node from a list, and then later adds it back to
a list, we can have invalid data in ->next. This can cause all sorts
of issues. One such use case is the IORING_OP_POLL_ADD command, which
will do just that if we race and get woken twice without any pending
events. This is a pretty rare case, but can happen under extreme loads.
Dan reports that he saw the following crash:

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD d283ce067 P4D d283ce067 PUD e5ca04067 PMD 0
Oops: 0002 [#1] SMP
CPU: 17 PID: 10726 Comm: tao:fast-fiber Kdump: loaded Not tainted 5.2.9-02851-gac7bc042d2d1 #116
Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A17 05/03/2019
RIP: 0010:io_wqe_enqueue+0x3e/0xd0
Code: 34 24 74 55 8b 47 58 48 8d 6f 50 85 c0 74 50 48 89 df e8 35 7c 75 00 48 83 7b 08 00 48 8b 14 24 0f 84 84 00 00 00 48 8b 4b 10 <48> 89 11 48 89 53 10 83 63 20 fe 48 89 c6 48 89 df e8 0c 7a 75 00
RSP: 0000:ffffc90006858a08 EFLAGS: 00010082
RAX: 0000000000000002 RBX: ffff889037492fc0 RCX: 0000000000000000
RDX: ffff888e40cc11a8 RSI: ffff888e40cc11a8 RDI: ffff889037492fc0
RBP: ffff889037493010 R08: 00000000000000c3 R09: ffffc90006858ab8
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888e40cc11a8
R13: 0000000000000000 R14: 00000000000000c3 R15: ffff888e40cc1100
FS:  00007fcddc9db700(0000) GS:ffff88903fa40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000e479f5003 CR4: 00000000007606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <IRQ>
 io_poll_wake+0x12f/0x2a0
 __wake_up_common+0x86/0x120
 __wake_up_common_lock+0x7a/0xc0
 sock_def_readable+0x3c/0x70
 tcp_rcv_established+0x557/0x630
 tcp_v6_do_rcv+0x118/0x3c0
 tcp_v6_rcv+0x97e/0x9d0
 ip6_protocol_deliver_rcu+0xe3/0x440
 ip6_input+0x3d/0xc0
 ? ip6_protocol_deliver_rcu+0x440/0x440
 ipv6_rcv+0x56/0xd0
 ? ip6_rcv_finish_core.isra.18+0x80/0x80
 __netif_receive_skb_one_core+0x50/0x70
 netif_receive_skb_internal+0x2f/0xa0
 napi_gro_receive+0x125/0x150
 mlx5e_handle_rx_cqe+0x1d9/0x5a0
 ? mlx5e_poll_tx_cq+0x305/0x560
 mlx5e_poll_rx_cq+0x49f/0x9c5
 mlx5e_napi_poll+0xee/0x640
 ? smp_reschedule_interrupt+0x16/0xd0
 ? reschedule_interrupt+0xf/0x20
 net_rx_action+0x286/0x3d0
 __do_softirq+0xca/0x297
 irq_exit+0x96/0xa0
 do_IRQ+0x54/0xe0
 common_interrupt+0xf/0xf
 </IRQ>
RIP: 0033:0x7fdc627a2e3a
Code: 31 c0 85 d2 0f 88 f6 00 00 00 55 48 89 e5 41 57 41 56 4c 63 f2 41 55 41 54 53 48 83 ec 18 48 85 ff 0f 84 c7 00 00 00 48 8b 07 <41> 89 d4 49 89 f5 48 89 fb 48 85 c0 0f 84 64 01 00 00 48 83 78 10

when running a networked workload with about 5000 sockets being polled
for. Fix this by clearing node->next when the node is being removed from
the list.

Fixes: 6206f0e1 ("io-wq: shrink io_wq_work a bit")
Reported-by: Dan Melnic <dmm@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

If we defer a timeout, we should ensure that we copy the timespec
when we have consumed the sqe. This is similar to commit f67676d1
for read/write requests. We already did this correctly for timeouts
deferred as links, but do it generally and use the infrastructure added
by commit 1a6b74fc instead of having the timeout deferral use its
own.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

There's really no reason why we forbid things like link/drain etc on
regular timeout commands. Enable the usual SQE flags on timeouts.
Reported-by: 李通洲 <carter.li@eoitek.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

If BLK_DEV_ZONED isn't set, 'ret' isn't used. This makes gcc complain,
rightfully. Move ret where it is used.

Fixes: 979d5447 ("null_blk: cleanup null_gendisk_register")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Queue dma alignment limit requires users(fs, target, ...) of block layer
to pass aligned buffer.

So far brd doesn't support un-aligned buffer, even though it is easy
to support it.

However, given brd is often used for debug purpose, and there are other
drivers which can't support un-aligned buffer too.

So add warning so that brd users know what to fix.
Reported-by: Stephen Rust <srust@blockbridge.com>
Cc: Stephen Rust <srust@blockbridge.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Now we depend on blk_queue_split() to respect most of queue limit
(the only one exception could be dma alignment), however
blk_queue_split() isn't used for brd, so this limit isn't respected
since v4.3.

Also max_hw_sectors limit doesn't play a big role for brd, which is
added since brd is added to tree for unknown reason.

So remove it.
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

For each I/O request, blkback first maps the foreign pages for the
request to its local pages.  If an allocation of a local page for the
mapping fails, it should unmap every mapping already made for the
request.

However, blkback's handling mechanism for the allocation failure does
not mark the remaining foreign pages as unmapped.  Therefore, the unmap
function merely tries to unmap every valid grant page for the request,
including the pages not mapped due to the allocation failure.  On a
system that fails the allocation frequently, this problem leads to
following kernel crash.

  [  372.012538] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
  [  372.012546] IP: [<ffffffff814071ac>] gnttab_unmap_refs.part.7+0x1c/0x40
  [  372.012557] PGD 16f3e9067 PUD 16426e067 PMD 0
  [  372.012562] Oops: 0002 [#1] SMP
  [  372.012566] Modules linked in: act_police sch_ingress cls_u32
  ...
  [  372.012746] Call Trace:
  [  372.012752]  [<ffffffff81407204>] gnttab_unmap_refs+0x34/0x40
  [  372.012759]  [<ffffffffa0335ae3>] xen_blkbk_unmap+0x83/0x150 [xen_blkback]
  ...
  [  372.012802]  [<ffffffffa0336c50>] dispatch_rw_block_io+0x970/0x980 [xen_blkback]
  ...
  Decompressing Linux... Parsing ELF... done.
  Booting the kernel.
  [    0.000000] Initializing cgroup subsys cpuset

This commit fixes this problem by marking the grant pages of the given
request that didn't mapped due to the allocation failure as invalid.

Fixes: c6cc142d ("xen-blkback: use balloon pages for all mappings")
Reviewed-by: David Woodhouse <dwmw@amazon.de>
Reviewed-by: Maximilian Heyne <mheyne@amazon.de>
Reviewed-by: Paul Durrant <pdurrant@amazon.co.uk>
Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Right now we return it to userspace, which means the application has
to poll for the socket to be writeable. Let's just treat it like
-EAGAIN and have io_uring handle it internally, this makes it much
easier to use.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

The current zone revalidation code has a major problem in that it
doesn't update the zone size and q->nr_zones atomically, leading
to a short window where an out of bounds access to the zone arrays
is possible.

To fix this move the setting of the zone size into the crticial
sections blk_revalidate_disk_zones so that it gets updated together
with the zone bitmaps and q->nr_zones.  This also slightly simplifies
the caller as it deducts the zone size from the report_zones.

This change also allows to check for a power of two zone size in generic
code.
Reported-by: Hans Holmberg <hans@owltronix.com>
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

bio based drivers only need to update q->nr_zones.  Do that manually
instead of overloading blk_revalidate_disk_zones to keep that function
simpler for the next round of changes that will rely even more on the
request based functionality.
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Allocate the conventional zone bitmap and the sequential zone locking
bitmap only when we find a zone of the respective type.  This avoids
wasting memory on the conventional zone bitmap for devices that only
have sequential zones, and will also prepare for other future changes.
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Invert the meaning of seq_zones_bitmap by keeping a bitmap of
conventional zones.  This allows not having a bitmap for devices
that do not have conventional zones.
Reviewed-by: Javier González <javier@javigon.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Simplify the arguments to blkdev_nr_zones by passing a gendisk instead
of the block_device and capacity.  This also removes the need for
__blkdev_nr_zones as all callers are outside the fast path and can
deal with the additional branch.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Use a saner size calculation, and do a trivial cleanup on the zone
revalidation to prepare to future changes.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

For zoned=1 mode, the zone size must be a power of 2. Check this not
only when the zone size is specified during modprobe, but also when
creating a zoned null_blk device using configfs.
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

bvec_iter_advance() is quite popular, but compilers fail to do proper
alias analysis and optimise it good enough. The assembly is checked
for gcc 9.2, x86-64.

- remove @iter->bi_size from min(...), as it's always less than @bytes.
Modify at the beginning and forget about it.

- the compiler isn't able to collapse memory dependencies and remove
writes in the loop. Help it by explicitely using local vars.
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Since commit b18fdf71 ("io_uring: simplify io_req_link_next()"),
the io_wq_current_is_worker function is no longer needed, clean it
up.
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Parameter ctx we have never used, clean it up.
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

If this flag is set, applications can be certain that any data for
async offload has been consumed when the kernel has consumed the
SQE.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Just like commit f67676d1 for read/write requests, this one ensures
that the sockaddr data has been copied for IORING_OP_CONNECT if we need
to punt the request to async context.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Just like commit f67676d1 for read/write requests, this one ensures
that the msghdr data is fully copied if we need to punt a recvmsg or
sendmsg system call to async context.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Currently we don't copy the iovecs when we punt to async context. This
can be problematic for applications that store the iovec on the stack,
as they often assume that it's safe to let the iovec go out of scope
as soon as IO submission has been called. This isn't always safe, as we
will re-copy the iovec once we're in async context.

Make this 100% safe by copying the iovec just once. With this change,
applications may safely store the iovec on the stack for all cases.
Reported-by: 李通洲 <carter.li@eoitek.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Right now we just copy the sqe for async offload, but we want to store
more context across an async punt. In preparation for doing so, put the
sqe copy inside a structure that we can expand. With this pointer added,
we can get rid of REQ_F_FREE_SQE, as that is now indicated by whether
req->io is NULL or not.

No functional changes in this patch.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Commit 6917d068 ("block: merge invalidate_partitions into
rescan_partitions") caused a regression where systemd-udevd spins
forever using max CPU starting at boot time.

It's caused by a behavior change where a KOBJ_CHANGE uevent is now sent
in a case where previously it wasn't.

Restore the old behavior.

Fixes: 6917d068 ("block: merge invalidate_partitions into rescan_partitions")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

We should never return -ERESTARTSYS to userspace, transform it into
-EINTR.

Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Jens Axboe <axboe@kernel.dk>

syzbot reports:

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9217 Comm: io_uring-sq Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:creds_are_invalid kernel/cred.c:792 [inline]
RIP: 0010:__validate_creds include/linux/cred.h:187 [inline]
RIP: 0010:override_creds+0x9f/0x170 kernel/cred.c:550
Code: ac 25 00 81 fb 64 65 73 43 0f 85 a3 37 00 00 e8 17 ab 25 00 49 8d 7c
24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e 96 00 00 00 41 8b 5c 24 10 bf
RSP: 0018:ffff88809c45fda0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000043736564 RCX: ffffffff814f3318
RDX: 0000000000000002 RSI: ffffffff814f3329 RDI: 0000000000000010
RBP: ffff88809c45fdb8 R08: ffff8880a3aac240 R09: ffffed1014755849
R10: ffffed1014755848 R11: ffff8880a3aac247 R12: 0000000000000000
R13: ffff888098ab1600 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd51c40664 CR3: 0000000092641000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  io_sq_thread+0x1c7/0xa20 fs/io_uring.c:3274
  kthread+0x361/0x430 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
---[ end trace f2e1a4307fbe2245 ]---
RIP: 0010:creds_are_invalid kernel/cred.c:792 [inline]
RIP: 0010:__validate_creds include/linux/cred.h:187 [inline]
RIP: 0010:override_creds+0x9f/0x170 kernel/cred.c:550
Code: ac 25 00 81 fb 64 65 73 43 0f 85 a3 37 00 00 e8 17 ab 25 00 49 8d 7c
24 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e 96 00 00 00 41 8b 5c 24 10 bf
RSP: 0018:ffff88809c45fda0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000043736564 RCX: ffffffff814f3318
RDX: 0000000000000002 RSI: ffffffff814f3329 RDI: 0000000000000010
RBP: ffff88809c45fdb8 R08: ffff8880a3aac240 R09: ffffed1014755849
R10: ffffed1014755848 R11: ffff8880a3aac247 R12: 0000000000000000
R13: ffff888098ab1600 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd51c40664 CR3: 0000000092641000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

which is caused by slab fault injection triggering a failure in
prepare_creds(). We don't actually need to create a copy of the creds
as we're not modifying it, we just need a reference on the current task
creds. This avoids the failure case as well, and propagates the const
throughout the stack.

Fixes: 181e448d ("io_uring: async workers should inherit the user creds")
Reported-by: syzbot+5320383e16029ba057ff@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Pull input updates from Dmitry Torokhov:

 - updates to Ilitech driver to support ILI2117

 - face lift of st1232 driver to support MT-B protocol

 - a new driver for i.MX system controller keys

 - mpr121 driver now supports polling mode

 - various input drivers have been switched away from input_polled_dev
   to use polled mode of regular input devices

 - other assorted cleanups and fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (70 commits)
  Input: synaptics-rmi4 - fix various V4L2 compliance problems in F54
  Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus
  Input: fix Kconfig indentation
  Input: imx_sc_key - correct SCU message structure to avoid stack corruption
  Input: ili210x - optionally show calibrate sysfs attribute
  Input: ili210x - add resolution to chip operations structure
  Input: ili210x - do not retrieve/print chip firmware version
  Input: mms114 - use device_get_match_data
  Input: ili210x - remove unneeded suspend and resume handlers
  Input: ili210x - do not unconditionally mark touchscreen as wakeup source
  Input: ili210x - define and use chip operations structure
  Input: ili210x - do not set parent device explicitly
  Input: ili210x - handle errors from input_mt_init_slots()
  Input: ili210x - switch to using threaded IRQ
  Input: ili210x - add ILI2117 support
  dt-bindings: input: touchscreen: ad7879: generic node names in example
  Input: ar1021 - fix typo in preprocessor macro name
  Input: synaptics-rmi4 - simplify data read in rmi_f54_work
  Input: kxtj9 - switch to using polled mode of input devices
  Input: kxtj9 - switch to using managed resources
  ...

Pull libnvdimm updates from Dan Williams:
 "The highlight this cycle is continuing integration fixes for PowerPC
  and some resulting optimizations.

  Summary:

   - Updates to better support vmalloc space restrictions on PowerPC
     platforms.

   - Cleanups to move common sysfs attributes to core 'struct
     device_type' objects.

   - Export the 'target_node' attribute (the effective numa node if pmem
     is marked online) for regions and namespaces.

   - Miscellaneous fixups and optimizations"

* tag 'libnvdimm-for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (21 commits)
  MAINTAINERS: Remove Keith from NVDIMM maintainers
  libnvdimm: Export the target_node attribute for regions and namespaces
  dax: Add numa_node to the default device-dax attributes
  libnvdimm: Simplify root read-only definition for the 'resource' attribute
  dax: Simplify root read-only definition for the 'resource' attribute
  dax: Create a dax device_type
  libnvdimm: Move nvdimm_bus_attribute_group to device_type
  libnvdimm: Move nvdimm_attribute_group to device_type
  libnvdimm: Move nd_mapping_attribute_group to device_type
  libnvdimm: Move nd_region_attribute_group to device_type
  libnvdimm: Move nd_numa_attribute_group to device_type
  libnvdimm: Move nd_device_attribute_group to device_type
  libnvdimm: Move region attribute group definition
  libnvdimm: Move attribute groups to device type
  libnvdimm: Remove prototypes for nonexistent functions
  libnvdimm/btt: fix variable 'rc' set but not used
  libnvdimm/pmem: Delete include of nd-core.h
  libnvdimm/namespace: Differentiate between probe mapping and runtime mapping
  libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe
  libnvdimm: Trivial comment fix
  ...

Pull mailbox updates from Jassi Brar:

 - omap : misc - catch error returned from pm_runtime_put_sync

 - hisi : misc - drop .owner from platform_driver

 - stm : change how wakeup is handled

 - imx : fix - bailout on error and nuke correct irq

 - imx : add support for imx7ulp platform

* tag 'mailbox-v5.5' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
  mailbox: imx: add support for imx v1 mu
  dt-bindings: mailbox: imx-mu: add imx7ulp MU support
  mailbox: imx: Clear the right interrupts at shutdown
  mailbox: imx: Fix Tx doorbell shutdown path
  mailbox: stm32-ipcc: Update wakeup management
  mailbox: no need to set .owner platform_driver_register
  mailbox/omap: Handle if CONFIG_PM is disabled

Pull hwspinlock updates from Bjorn Andersson:
 "This contains a number of cleanups to the core and several drivers, in
  particular removing the requirement for drivers to implement
  pm_runtime.

  It also udpates the location of the git tree in MAINTAINERS"

* tag 'hwlock-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc:
  hwspinlock: u8500_hsem: Remove redundant PM runtime implementation
  hwspinlock: sprd: Remove redundant PM runtime implementation
  hwspinlock: Let the PM runtime can be optional
  hwspinlock: Remove BUG_ON() from the hwspinlock core
  hwspinlock: sprd: Use devm_hwspin_lock_register() to register hwlock controller
  hwspinlock: sprd: Use devm_add_action_or_reset() for calls to clk_disable_unprepare()
  hwspinlock: sprd: Check the return value of clk_prepare_enable()
  hwspinlock: sprd: Change to use devm_platform_ioremap_resource()
  hwspinlock: u8500_hsem: Use devm_hwspin_lock_register() to register hwlock controller
  hwspinlock: u8500_hsem: Use devm_kzalloc() to allocate memory
  hwspinlock: u8500_hsem: Change to use devm_platform_ioremap_resource()
  MAINTAINERS: hwspinlock: update git tree location

Pull rpmsg updates from Bjorn Andersson:
 "This contains a number of bug fixes to the GLINK transport driver, an
  off-by-one in the GLINK smem driver and a memory leak fix in the rpmsg
  char driver"

* tag 'rpmsg-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc:
  rpmsg: Fix Kconfig indentation
  rpmsg: char: Simplify 'rpmsg_eptdev_release()'
  rpmsg: glink: Free pending deferred work on remove
  rpmsg: glink: Don't send pending rx_done during remove
  rpmsg: glink: Fix rpmsg_register_device err handling
  rpmsg: glink: Put an extra reference during cleanup
  rpmsg: glink: Fix use after free in open_ack TIMEOUT case
  rpmsg: glink: Fix reuse intents memory leak issue
  rpmsg: glink: Set tail pointer to 0 at end of FIFO
  rpmsg: char: release allocated memory

Pull remoteproc updates from Bjorn Andersson:
 "This adds support for booting the modem processor on Qualcomm MSM8998
  and carries some cleanup up and bug fixes to the framework and the
  stm32 driver"

* tag 'rproc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc:
  Revert "dt-bindings: remoteproc: stm32: add wakeup-source"
  remoteproc: stm32: fix probe error case
  remoteproc: stm32: wakeup the system by wdg irq
  dt-bindings: remoteproc: stm32: add wakeup-source
  remoteproc: Fix wrong rvring index computation
  remoteproc: stm32: use workqueue to treat mailbox callback
  remoteproc: fix argument 2 of rproc_mem_entry_init
  remoteproc: qcom_q6v5_mss: Add support for MSM8998
  dt-bindings: remoteproc: qcom: Add Q6v5 Modem PIL binding for MSM8998
  remoteproc: debug: Remove unneeded NULL check
  remoteproc: remove useless typedef

Pull i2c updates from Wolfram Sang:
 "I2C has mostly driver updates this time.

  The few noteworthy changes are: the core has now support for analog
  and digital filters with at91 being the first user, a core addition to
  replace the NULL returning i2c_new_probed_device() with an ERR_PTR
  variant, and the pxa driver has finally being moved to use the generic
  I2C slave interface. We have quite a significant number of reviews per
  patch this time, so thank you to all involved!"

* 'i2c/for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (37 commits)
  video: fbdev: matrox: convert to i2c_new_scanned_device
  i2c: icy: convert to i2c_new_scanned_device
  i2c: replace i2c_new_probed_device with an ERR_PTR variant
  i2c: Fix Kconfig indentation
  i2c: smbus: Don't filter out duplicate alerts
  i2c: i801: Correct Intel Jasper Lake SOC naming
  i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
  i2c: iproc: Add i2c repeated start capability
  i2c: remove helpers for ref-counting clients
  i2c: tegra: Use dma_request_chan() directly for channel request
  i2c: sh_mobile: Use dma_request_chan() directly for channel request
  i2c: qup: Use dma_request_chan() directly for channel request
  i2c: at91: Use dma_request_chan() directly for channel request
  i2c: rcar: Remove superfluous call to clk_get_rate()
  i2c: pxa: remove unused i2c-slave APIs
  i2c: pxa: migrate to new i2c_slave APIs
  i2c: cros-ec-tunnel: Make the device acpi compatible
  i2c: stm32f7: report dma error during probe
  i2c: icy: no need to populate address for scanned device
  i2c: xiic: Fix kerneldoc warnings
  ...

Pull block fixes from Jens Axboe:
 "I wasn't going to send this one off so soon, but unfortunately one of
  the fixes from the previous pull broke the build on some archs. So I'm
  sending this sooner rather than later. This contains:

   - Add highmem.h include for io_uring, because of the kmap() additions
     from last round. For some reason the build bot didn't spot this
     even though it sat for days.

   - Three minor ';' removals

   - Add support for the Beurer CD-on-a-chip device

   - Make io_uring work on MMU-less archs"

* tag 'for-linus-20191129' of git://git.kernel.dk/linux-block:
  io_uring: fix missing kmap() declaration on powerpc
  ataflop: Remove unneeded semicolon
  block: sunvdc: Remove unneeded semicolon
  drbd: Remove unneeded semicolon
  io_uring: add mapping support for NOMMU archs
  sr_vendor: support Beurer GL50 evo CD-on-a-chip devices.
  cdrom: respect device capabilities during opening action

Pull x86 platform driver updates from Andy Shevchenko:

 - New bootctl driver for Mellanox BlueField SoC.

 - New driver to support System76 laptops.

 - Temperature monitoring and fan control on Acer Aspire 7551 is now
   supported.

 - Previously the Huawei driver handled only hotkeys. After the
   conversion to WMI it has been expanded to support newer laptop
   models.

 - Big refactoring of intel-speed-select tools allows to use it on Intel
   CascadeLake-N systems.

 - Touchscreen support for ezpad 6 m4 and Schneider SCT101CTM tablets

 - Miscellaneous clean ups and fixes here and there.

* tag 'platform-drivers-x86-v5.5-1' of git://git.infradead.org/linux-platform-drivers-x86: (59 commits)
  platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
  platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
  platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver
  platform/x86: intel_pmc_core: Fix the SoC naming inconsistency
  platform/mellanox: Fix Kconfig indentation
  tools/power/x86/intel-speed-select: Display TRL buckets for just base config level
  tools/power/x86/intel-speed-select: Ignore missing config level
  platform/x86: touchscreen_dmi: Add info for the ezpad 6 m4 tablet
  tools/power/x86/intel-speed-select: Increment version
  tools/power/x86/intel-speed-select: Use core count for base-freq mask
  tools/power/x86/intel-speed-select: Support platform with limited Intel(R) Speed Select
  tools/power/x86/intel-speed-select: Use Frequency weight for CLOS
  tools/power/x86/intel-speed-select: Make CLOS frequency in MHz
  tools/power/x86/intel-speed-select: Use mailbox for CLOS_PM_QOS_CONFIG
  tools/power/x86/intel-speed-select: Auto mode for CLX
  tools/power/x86/intel-speed-select: Correct CLX-N frequency units
  tools/power/x86/intel-speed-select: Change display of "avx" to "avx2"
  tools/power/x86/intel-speed-select: Extend command set for perf-profile
  Add touchscreen platform data for the Schneider SCT101CTM tablet
  platform/x86: intel_int0002_vgpio: Pass irqchip when adding gpiochip
  ...

Pull HID updates from Jiri Kosina:

 - Support for Logitech G15 (Hans de Goede)

 - HID parser improvements, improving support for some devices; e.g.
   Windows Precision Touchpad, products from Primax, etc. (Blaž
   Hrastnik, Candle Sun)

 - robustification of tablet mode support in google-whiskers driver
   (Dmitry Torokhov)

 - assorted small fixes, device-specific quirks and device ID additions

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (23 commits)
  HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device
  HID: quirks: remove hid-led devices from hid_have_special_driver
  HID: Improve Windows Precision Touchpad detection.
  HID: i2c-hid: Reset ALPS touchpads on resume
  HID: i2c-hid: fix no irq after reset on raydium 3118
  HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
  HID: i2c-hid: remove orphaned member sleep_delay
  HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
  HID: core: check whether Usage Page item is after Usage ID items
  HID: intel-ish-hid: Spelling s/diconnect/disconnect/
  HID: google: Detect base folded usage instead of hard-coding whiskers
  HID: logitech: Add depends on LEDS_CLASS to Logitech Kconfig entry
  HID: lg-g15: Add support for the G510's M1-M3 and MR LEDs
  HID: lg-g15: Add support for controlling the G510's RGB backlight
  HID: lg-g15: Add support for the G510 keyboards' gaming keys
  HID: lg-g15: Add support for the M1-M3 and MR LEDs
  HID: lg-g15: Add keyboard and LCD backlight control
  HID: Add driver for Logitech gaming keyboards (G15, G15 v2)
  Input: Add event-codes for macro keys found on various keyboards
  HID: hidraw: replace printk() with corresponding pr_xx() variant
  ...

Pull watchdog updates from Wim Van Sebroeck:

 - support for NCT6116D

 - several small fixes and improvements

* tag 'linux-watchdog-5.5-rc1' of git://www.linux-watchdog.org/linux-watchdog: (24 commits)
  watchdog: jz4740: Drop dependency on MACH_JZ47xx
  watchdog: jz4740: Use regmap provided by TCU driver
  watchdog: jz4740: Use WDT clock provided by TCU driver
  dt-bindings: watchdog: sama5d4_wdt: add microchip,sam9x60-wdt compatible
  watchdog: sama5d4_wdt: cleanup the bit definitions
  watchdog: sprd: Fix the incorrect pointer getting from driver data
  watchdog: aspeed: Fix clock behaviour for ast2600
  watchdog: imx7ulp: Fix reboot hang
  watchdog: make nowayout sysfs file writable
  watchdog: prevent deferral of watchdogd wakeup on RT
  watchdog: imx7ulp: Use definitions instead of magic values
  watchdog: imx7ulp: Remove inline annotations
  watchdog: imx7ulp: Remove unused structure member
  watchdog: imx7ulp: Pass the wdog instance inimx7ulp_wdt_enable()
  watchdog: wdat_wdt: Spelling s/configrable/configurable/
  watchdog: bd70528: Trivial function documentation fix
  watchdog: cadence: Do not show error in case of deferred probe
  watchdog: Fix the race between the release of watchdog_core_data and cdev
  watchdog: sbc7240_wdt: Fix yet another -Wimplicit-fallthrough warning
  watchdog: intel-mid_wdt: Add WATCHDOG_NOWAYOUT support
  ...

Pull GPIO updates from Linus Walleij:
 "This is the bulk of GPIO changes for the v5.5 kernel cycle

  Core changes:

   - Expose pull up/down flags for the GPIO character device to
     userspace.

     After clear input from the RaspberryPi and Beagle communities, it
     has been established that prototyping, industrial automation and
     make communities strongly need this feature, and as we want people
     to use the character device, we have implemented the simple pull
     up/down interface for GPIO lines.

     This means we can specify that a (chip-specific) pull up/down
     resistor can be enabled, but does not offer fine-grained control
     such as cases where the resistance of the same pull resistor can be
     controlled (yet).

   - Introduce devm_fwnode_gpiod_get_index() and start to phase out the
     old symbol devm_fwnode_get_index_gpiod_from_child().

   - A bit of documentation clean-up work.

   - Introduce a define for GPIO line directions and deploy it in all
     GPIO drivers in the drivers/gpio directory.

   - Add a special callback to populate pin ranges when cooperating with
     the pin control subsystem and registering ranges as part of adding
     a gpiolib driver and a gpio_irq_chip driver at the same time. This
     is also deployed in the Intel Merrifield driver.

  New drivers:

   - RDA Micro GPIO controller.

   - XGS-iproc GPIO driver.

  Driver improvements:

   - Wake event and debounce support on the Tegra 186 driver.

   - Finalize the Aspeed SGPIO driver.

   - MPC8xxx uses a normal IRQ handler rather than a chained handler"

* tag 'gpio-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (64 commits)
  gpio: Add TODO item for regmap helper
  Documentation: gpio: driver.rst: Fix warnings
  gpio: of: Fix bogus reference to gpiod_get_count()
  gpiolib: Grammar s/manager/managed/
  gpio: lynxpoint: Setup correct IRQ handlers
  MAINTAINERS: Replace my email by one @kernel.org
  gpiolib: acpi: Make acpi_gpiochip_alloc_event always return AE_OK
  gpio/mpc8xxx: fix qoriq GPIO reading
  gpio: mpc8xxx: Don't overwrite default irq_set_type callback
  gpiolib: acpi: Print pin number on acpi_gpiochip_alloc_event errors
  gpiolib: fix coding style in gpiod_hog()
  drm/bridge: ti-tfp410: switch to using fwnode_gpiod_get_index()
  gpio: merrifield: Pass irqchip when adding gpiochip
  gpio: merrifield: Add GPIO <-> pin mapping ranges via callback
  gpiolib: Introduce ->add_pin_ranges() callback
  gpio: mmio: remove untrue leftover comment
  gpio: em: Use platform_get_irq() to obtain interrupts
  gpio: tegra186: Add debounce support
  gpio: tegra186: Program interrupt route mapping
  gpio: tegra186: Derive register offsets from bank/port
  ...

Pull MFD updates from Lee Jones:
 "Core Frameworks:
   - Add support for a "resource managed strongly uncachable ioremap"
     call
   - Provide a collection of MFD helper macros
   - Remove mfd_clone_cell() from MFD core
   - Add NULL de-reference protection in MFD core
   - Remove superfluous function fd_platform_add_cell() from MFD core
   - Honour Device Tree's request to disable a device

  New Drivers:
   - Add support for MediaTek MT6323 PMIC

  New Device Support:
   - Add support for Gemini Lake to Intel LPSS PCI
   - Add support for Cherry Trail Crystal Cover PMIC to Intel SoC PMIC
     CRC
   - Add support for PM{I}8950 to Qualcomm SPMI PMIC
   - Add support for U8420 to ST-Ericsson DB8500
   - Add support for Comet Lake PCH-H to Intel LPSS PCI

  New Functionality:
   - Add support for requested supply clocks; madera-core

  Fix-ups:
   - Lower interrupt priority; rk808
   - Use provided helpers (macros, group functions, defines); rk808,
     ipaq-micro, ab8500-core, db8500-prcmu, mt6397-core, cs5535-mfd
   - Only allocate IRQs on request; max77620
   - Use simplified API; arizona-core
   - Remove redundant and/or duplicated code; wm8998-tables, arizona,
     syscon
   - Device Tree binding fix-ups; madera, max77650, max77693
   - Remove mfd_cell->id abuse hack; cs5535-mfd
   - Remove only user of mfd_clone_cell(); cs5535-mfd
   - Make resources static; rohm-bd70528

  Bug Fixes:
   - Fix product ID for RK818; rk808
   - Fix Power Key; rk808
   - Fix booting on the BananaPi; mt6397-core
   - Endian fix-ups; twl.h
   - Fix static error checker warnings; ti_am335x_tscadc"

* tag 'mfd-next-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
  Revert "mfd: syscon: Set name of regmap_config"
  mfd: ti_am335x_tscadc: Fix static checker warning
  mfd: bd70528: Staticize bit value definitions
  mfd: mfd-core: Honour Device Tree's request to disable a child-device
  dt-bindings: mfd: max77693: Fix missing curly brace
  mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
  mfd: db8500-prcmu: Support U8420-sysclk firmware
  dt-bindings: mfd: max77650: Convert the binding document to yaml
  mfd: mfd-core: Move pdev->mfd_cell creation back into mfd_add_device()
  mfd: mfd-core: Remove usage counting for .{en,dis}able() call-backs
  x86: olpc-xo1-sci: Remove invocation of MFD's .enable()/.disable() call-backs
  x86: olpc-xo1-pm: Remove invocation of MFD's .enable()/.disable() call-backs
  mfd: mfd-core: Remove mfd_clone_cell()
  mfd: mfd-core: Protect against NULL call-back function pointer
  mfd: cs5535-mfd: Register clients using their own dedicated MFD cell entries
  mfd: cs5535-mfd: Request shared IO regions centrally
  mfd: cs5535-mfd: Remove mfd_cell->id hack
  mfd: cs5535-mfd: Use PLATFORM_DEVID_* defines and tidy error message
  mfd: intel_soc_pmic_crc: Add "cht_crystal_cove_pmic" cell to CHT cells
  mfd: madera: Add support for requesting the supply clocks
  ...