Curtis Taylor and Jon Maxwell reported and debugged a crash on 3.10
based kernel.

Crash occurs in ctnetlink_conntrack_events because net->nfnl socket is
NULL.  The nfnl socket was set to NULL by netns destruction running on
another cpu.

The exiting network namespace calls the relevant destructors in the
following order:

1. ctnetlink_net_exit_batch

This nulls out the event callback pointer in struct netns.

2. nfnetlink_net_exit_batch

This nulls net->nfnl socket and frees it.

3. nf_conntrack_cleanup_net_list

This removes all remaining conntrack entries.

This is order is correct. The only explanation for the crash so ar is:

cpu1: conntrack is dying, eviction occurs:
 -> nf_ct_delete()
   -> nf_conntrack_event_report \
     -> nf_conntrack_eventmask_report
       -> notify->fcn() (== ctnetlink_conntrack_events).

cpu1: a. fetches rcu protected pointer to obtain ctnetlink event callback.
      b. gets interrupted.
 cpu2: runs netns exit handlers:
     a runs ctnetlink destructor, event cb pointer set to NULL.
     b runs nfnetlink destructor, nfnl socket is closed and set to NULL.
cpu1: c. resumes and trips over NULL net->nfnl.

Problem appears to be that ctnetlink_net_exit_batch only prevents future
callers of nf_conntrack_eventmask_report() from obtaining the callback.
It doesn't wait of other cpus that might have already obtained the
callbacks address.

I don't see anything in upstream kernels that would prevent similar
crash: We need to wait for all cpus to have exited the event callback.

Fixes: 9592a5c0 ("netfilter: ctnetlink: netns support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

This driver forgets to kill tasklet in remove.
Add the call to fix it.

Fixes: 032dc41b ("net: macb: Handle HRESP error")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Jakub Kicinski says:

====================
net: tls: fix scatter-gather list issues

This series kicked of by a syzbot report fixes three issues around
scatter gather handling in the TLS code. First patch fixes a use-
-after-free situation which may occur if record was freed on error.
This could have already happened in BPF paths, and patch 2 now makes
the same condition occur in non-BPF code.

Patch 2 fixes the problem spotted by syzbot. If encryption failed
we have to clean the end markings from scatter gather list. As
suggested by John the patch frees the record entirely and caller
may retry copying data from user space buffer again.

Third patch fixes a bug in the TLS 1.3 code spotted while working
on patch 2. TLS 1.3 may effectively overflow the SG list which
leads to the BUG() in sg_page() being triggered.

Patch 4 adds a test case which triggers this bug reliably.

Next two patches are small cleanups of dead code and code which
makes dangerous assumptions.

Last but not least two minor improvements to the sockmap tests.

Tested:
 - bpf/test_sockmap
 - net/tls
 - syzbot repro (which used error injection, hence no direct
   selftest is added to preserve it).
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

perror(str) is basically equivalent to
print("%s: %s\n", str, strerror(errno)).
New line or colon at the end of str is
a mistake/breaks formatting.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

test_sockmap creates a temporary file to use for sendpage.
this may fail for various reasons. Handle the error rather
than segfault.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Partially sent record cleanup path increments an SG entry
directly instead of using sg_next(). This should not be a
problem today, as encrypted messages should be always
allocated as arrays. But given this is a cleanup path it's
easy to miss was this ever to change. Use sg_next(), and
simplify the code.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Looks like when BPF support was added by commit d3b18ad3
("tls: add bpf support to sk_msg handling") and
commit d829e9c4 ("tls: convert to generic sk_msg interface")
it broke/removed the support for in-place crypto as added by
commit 4e6d4720 ("tls: Add support for inplace records
encryption").

The inplace_crypto member of struct tls_rec is dead, inited
to zero, and sometimes set to zero again. It used to be
set to 1 when record was allocated, but the skmsg code doesn't
seem to have been written with the idea of in-place crypto
in mind.

Since non trivial effort is required to bring the feature back
and we don't really have the HW to measure the benefit just
remove the left over support for now to avoid confusing readers.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add a sendmsg test with very fragmented messages. This should
fill up sk_msg and test the boundary conditions.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

TLS 1.3 started using the entry at the end of the SG array
for chaining-in the single byte content type entry. This mostly
works:

[ E E E E E E . . ]
  ^           ^
   start       end

                 E < content type
               /
[ E E E E E E C . ]
  ^           ^
   start       end

(Where E denotes a populated SG entry; C denotes a chaining entry.)

If the array is full, however, the end will point to the start:

[ E E E E E E E E ]
  ^
   start
   end

And we end up overwriting the start:

    E < content type
   /
[ C E E E E E E E ]
  ^
   start
   end

The sg array is supposed to be a circular buffer with start and
end markers pointing anywhere. In case where start > end
(i.e. the circular buffer has "wrapped") there is an extra entry
reserved at the end to chain the two halves together.

[ E E E E E E . . l ]

(Where l is the reserved entry for "looping" back to front.

As suggested by John, let's reserve another entry for chaining
SG entries after the main circular buffer. Note that this entry
has to be pointed to by the end entry so its position is not fixed.

Examples of full messages:

[ E E E E E E E E . l ]
  ^               ^
   start           end

   <---------------.
[ E E . E E E E E E l ]
      ^ ^
   end   start

Now the end will always point to an unused entry, so TLS 1.3
can always use it.

Fixes: 130b392c ("net: tls: Add tls 1.3 support")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When tls_do_encryption() fails the SG lists are left with the
SG_END and SG_CHAIN marks in place. One could hope that once
encryption fails we will never see the record again, but that
is in fact not true. Commit d3b18ad3 ("tls: add bpf support
to sk_msg handling") added special handling to ENOMEM and ENOSPC
errors which mean we may see the same record re-submitted.

As suggested by John free the record, the BPF code is already
doing just that.

Reported-by: syzbot+df0d4ec12332661dd1f9@syzkaller.appspotmail.com
Fixes: d3b18ad3 ("tls: add bpf support to sk_msg handling")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

bpf_exec_tx_verdict() may free the record if tls_push_record()
fails, or if the entire record got consumed by BPF. Re-check
ctx->open_rec before touching the data.

Fixes: d3b18ad3 ("tls: add bpf support to sk_msg handling")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux; tag 'dma-mapping-5.5' of git://git.infradead.org/users/hch/dma-mapping

Pull dma-mapping updates from Christoph Hellwig:

 - improve dma-debug scalability (Eric Dumazet)

 - tiny dma-debug cleanup (Dan Carpenter)

 - check for vmap memory in dma_map_single (Kees Cook)

 - check for dma_addr_t overflows in dma-direct when using DMA offsets
   (Nicolas Saenz Julienne)

 - switch the x86 sta2x11 SOC to use more generic DMA code (Nicolas
   Saenz Julienne)

 - fix arm-nommu dma-ranges handling (Vladimir Murzin)

 - use __initdata in CMA (Shyam Saini)

 - replace the bus dma mask with a limit (Nicolas Saenz Julienne)

 - merge the remapping helpers into the main dma-direct flow (me)

 - switch xtensa to the generic dma remap handling (me)

 - various cleanups around dma_capable (me)

 - remove unused dev arguments to various dma-noncoherent helpers (me)

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux:

* tag 'dma-mapping-5.5' of git://git.infradead.org/users/hch/dma-mapping: (22 commits)
  dma-mapping: treat dev->bus_dma_mask as a DMA limit
  dma-direct: exclude dma_direct_map_resource from the min_low_pfn check
  dma-direct: don't check swiotlb=force in dma_direct_map_resource
  dma-debug: clean up put_hash_bucket()
  powerpc: remove support for NULL dev in __phys_to_dma / __dma_to_phys
  dma-direct: avoid a forward declaration for phys_to_dma
  dma-direct: unify the dma_capable definitions
  dma-mapping: drop the dev argument to arch_sync_dma_for_*
  x86/PCI: sta2x11: use default DMA address translation
  dma-direct: check for overflows on 32 bit DMA addresses
  dma-debug: increase HASH_SIZE
  dma-debug: reorder struct dma_debug_entry fields
  xtensa: use the generic uncached segment support
  dma-mapping: merge the generic remapping helpers into dma-direct
  dma-direct: provide mmap and get_sgtable method overrides
  dma-direct: remove the dma_handle argument to __dma_direct_alloc_pages
  dma-direct: remove __dma_direct_free_pages
  usb: core: Remove redundant vmap checks
  kernel: dma-contiguous: mark CMA parameters __initdata/__initconst
  dma-debug: add a schedule point in debug_dma_dump_mappings()
  ...

Pull generic ioremap support from Christoph Hellwig:
 "This adds the remaining bits for an entirely generic ioremap and
  iounmap to lib/ioremap.c. To facilitate that, it cleans up the giant
  mess of weird ioremap variants we had with no users outside the arch
  code.

  For now just the three newest ports use the code, but there is more
  than a handful others that can be converted without too much work.

  Summary:

   - clean up various obsolete ioremap and iounmap variants

   - add a new generic ioremap implementation and switch csky, nds32 and
     riscv over to it"

* tag 'ioremap-5.5' of git://git.infradead.org/users/hch/ioremap: (21 commits)
  nds32: use generic ioremap
  csky: use generic ioremap
  csky: remove ioremap_cache
  riscv: use the generic ioremap code
  lib: provide a simple generic ioremap implementation
  sh: remove __iounmap
  nios2: remove __iounmap
  hexagon: remove __iounmap
  m68k: rename __iounmap and mark it static
  arch: rely on asm-generic/io.h for default ioremap_* definitions
  asm-generic: don't provide ioremap for CONFIG_MMU
  asm-generic: ioremap_uc should behave the same with and without MMU
  xtensa: clean up ioremap
  x86: Clean up ioremap()
  parisc: remove __ioremap
  nios2: remove __ioremap
  alpha: remove the unused __ioremap wrapper
  hexagon: clean up ioremap
  ia64: rename ioremap_nocache to ioremap_uc
  unicore32: remove ioremap_cached
  ...

Pull more io_uring updates from Jens Axboe:
 "As mentioned in the first pull request, there was a later batch as
  well. This contains fixes to the stuff that already went in, cleanups,
  and a few later additions. In particular, this contains:

   - Cleanups/fixes/unification of the submission and completion path
     (Pavel,me)

   - Linked timeouts improvements (Pavel,me)

   - Error path fixes (me)

   - Fix lookup window where cancellations wouldn't work (me)

   - Improve DRAIN support (Pavel)

   - Fix backlog flushing -EBUSY on submit (me)

   - Add support for connect(2) (me)

   - Fix for non-iter based fixed IO (Pavel)

   - creds inheritance for async workers (me)

   - Disable cmsg/ancillary data for sendmsg/recvmsg (me)

   - Shrink io_kiocb to 3 cachelines (me)

   - NUMA fix for io-wq (Jann)"

* tag 'for-5.5/io_uring-post-20191128' of git://git.kernel.dk/linux-block: (42 commits)
  io_uring: make poll->wait dynamically allocated
  io-wq: shrink io_wq_work a bit
  io-wq: fix handling of NUMA node IDs
  io_uring: use kzalloc instead of kcalloc for single-element allocations
  io_uring: cleanup io_import_fixed()
  io_uring: inline struct sqe_submit
  io_uring: store timeout's sqe->off in proper place
  net: disallow ancillary data for __sys_{send,recv}msg_file()
  net: separate out the msghdr copy from ___sys_{send,recv}msg()
  io_uring: remove superfluous check for sqe->off in io_accept()
  io_uring: async workers should inherit the user creds
  io-wq: have io_wq_create() take a 'data' argument
  io_uring: fix dead-hung for non-iter fixed rw
  io_uring: add support for IORING_OP_CONNECT
  net: add __sys_connect_file() helper
  io_uring: only return -EBUSY for submit on non-flushed backlog
  io_uring: only !null ptr to io_issue_sqe()
  io_uring: simplify io_req_link_next()
  io_uring: pass only !null to io_req_find_next()
  io_uring: remove io_free_req_find_next()
  ...

Pull drm updates from Dave Airlie:
 "Lots of stuff in here, though it hasn't been too insane this merge
  apart from dealing with the security fun.

  uapi:
   - export different colorspace properties on DP vs HDMI
   - new fourcc for ARM 16x16 block format
   - syncobj: allow querying last submitted timeline value
   - DRM_FORMAT_BIG_ENDIAN defined as unsigned

  core:
   - allow using gem vma manager in ttm
   - connector/encoder/bridge doc fixes
   - allow more than 3 encoders for a connector
   - displayport mst suspend/resume reprobing support
   - vram lazy unmapping, uniform vram mm and gem vram
   - edid cleanups + AVI informframe bar info
   - displayport helpers - dpcd parser added

  dp_cec:
   - Allow a connector to be associated with a cec device

  ttm:
   - pipelining with no_gpu_wait fix
   - always keep BOs on the LRU

  sched:
   - allow free_job routine to sleep

  i915:
   - Block userptr from mappable GTT
   - i915 perf uapi versioning
   - OA stream dynamic reconfiguration
   - make context persistence optional
   - introduce DRM_I915_UNSTABLE Kconfig
   - add fake lmem testing under unstable
   - BT.2020 support for DP MSA
   - struct mutex elimination
   - Tigerlake display/PLL/power management improvements
   - Jasper Lake PCH support
   - refactor PMU for multiple GPUs
   - Icelake firmware update
   - Split out vga + switcheroo code

  amdgpu:
   - implement dma-buf import/export without helpers
   - vega20 RAS enablement
   - DC i2c over aux fixes
   - renoir GPU reset
   - DC HDCP support
   - BACO support for CI/VI asics
   - MSI-X support
   - Arcturus EEPROM support
   - Arcturus VCN encode support
   - VCN dynamic powergating on RV/RV2

  amdkfd:
   - add navi12/14/renoir support to kfd

  radeon:
   - SI dpm fix ported from amdgpu
   - fix bad DMA on ppc platforms

  gma500:
   - memory leak fixes

  qxl:
   - convert to new gem mmap

  exynos:
   - build warning fix

  komeda:
   - add aclk sysfs attribute

  v3d:
   - userspace cleanup uapi change

  i810:
   - fix for underflow in dispatch ioctls

  ast:
   - refactor show_cursor

  mgag200:
   - refactor show_cursor

  arcgpu:
   - encoder finding improvements

  mediatek:
   - mipi_tx, dsi and partial crtc support for MT8183 SoC
   - rotation support

  meson:
   - add suspend/resume support

  omap:
   - misc refactors

  tegra:
   - DisplayPort support for Tegra 210, 186 and 194.
   - IOMMU-backed DMA API fixes

  panfrost:
   - fix lockdep issue
   - simplify devfreq integration

  rcar-du:
   - R8A774B1 SoC support
   - fixes for H2 ES2.0

  sun4i:
   - vcc-dsi regulator support

  virtio-gpu:
   - vmexit vs spinlock fix
   - move to gem shmem helpers
   - handle large command buffers with cma"

* tag 'drm-next-2019-11-27' of git://anongit.freedesktop.org/drm/drm: (1855 commits)
  drm/amdgpu: invalidate mmhub semaphore workaround in gmc9/gmc10
  drm/amdgpu: initialize vm_inv_eng0_sem for gfxhub and mmhub
  drm/amd/amdgpu/sriov skip RLCG s/r list for arcturus VF.
  drm/amd/amdgpu/sriov temporarily skip ras,dtm,hdcp for arcturus VF
  drm/amdgpu/gfx10: re-init clear state buffer after gpu reset
  merge fix for "ftrace: Rework event_create_dir()"
  drm/amdgpu: Update Arcturus golden registers
  drm/amdgpu/gfx10: fix out-of-bound mqd_backup array access
  drm/amdgpu/gfx10: explicitly wait for cp idle after halt/unhalt
  Revert "drm/amd/display: enable S/G for RAVEN chip"
  drm/amdgpu: disable gfxoff on original raven
  drm/amdgpu: remove experimental flag for Navi14
  drm/amdgpu: disable gfxoff when using register read interface
  drm/amdgpu/powerplay: properly set PP_GFXOFF_MASK (v2)
  drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2
  drm/radeon: fix bad DMA from INTERRUPT_CNTL2
  drm/amd/display: Fix debugfs on MST connectors
  drm/amdgpu/nv: add asic func for fetching vbios from rom directly
  drm/amdgpu: put flush_delayed_work at first
  drm/amdgpu/vcn2.5: fix the enc loop with hw fini
  ...

Pull networking fixes from David Miller:
 "This is mostly to fix the iwlwifi regression:

  1) Flush GRO state properly in iwlwifi driver, from Alexander Lobakin.

  2) Validate TIPC link name with properly length macro, from John
     Rutherford.

  3) Fix completion init and device query timeouts in ibmvnic, from
     Thomas Falcon.

  4) Fix SKB size calculation for netlink messages in psample, from
     Nikolay Aleksandrov.

  5) Similar kind of fix for OVS flow dumps, from Paolo Abeni.

  6) Handle queue allocation failure unwind properly in gve driver, we
     could try to release pages we didn't allocate. From Jeroen de
     Borst.

  7) Serialize TX queue SKB list accesses properly in mscc ocelot
     driver. From Yangbo Lu"

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net:
  net: usb: aqc111: Use the correct style for SPDX License Identifier
  net: phy: Use the correct style for SPDX License Identifier
  net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling
  net: mscc: ocelot: use skb queue instead of skbs list
  net: mscc: ocelot: avoid incorrect consuming in skbs list
  gve: Fix the queue page list allocated pages count
  net: inet_is_local_reserved_port() port arg should be unsigned short
  openvswitch: fix flow command message size
  net: phy: dp83869: Fix return paths to return proper values
  net: psample: fix skb_over_panic
  net: usbnet: Fix -Wcast-function-type
  net: hso: Fix -Wcast-function-type
  net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port)
  ibmvnic: Serialize device queries
  ibmvnic: Bound waits for device queries
  ibmvnic: Terminate waiting device threads after loss of service
  ibmvnic: Fix completion structure initialization
  net-sctp: replace some sock_net(sk) with just 'net'
  net: Fix a documentation bug wrt. ip_unprivileged_port_start
  tipc: fix link name length check

Pull tracing updates from Steven Rostedt:
 "New tracing features:

   - New PERMANENT flag to ftrace_ops when attaching a callback to a
     function.

     As /proc/sys/kernel/ftrace_enabled when set to zero will disable
     all attached callbacks in ftrace, this has a detrimental impact on
     live kernel tracing, as it disables all that it patched. If a
     ftrace_ops is registered to ftrace with the PERMANENT flag set, it
     will prevent ftrace_enabled from being disabled, and if
     ftrace_enabled is already disabled, it will prevent a ftrace_ops
     with PREMANENT flag set from being registered.

   - New register_ftrace_direct().

     As eBPF would like to register its own trampolines to be called by
     the ftrace nop locations directly, without going through the ftrace
     trampoline, this function has been added. This allows for eBPF
     trampolines to live along side of ftrace, perf, kprobe and live
     patching. It also utilizes the ftrace enabled_functions file that
     keeps track of functions that have been modified in the kernel, to
     allow for security auditing.

   - Allow for kernel internal use of ftrace instances.

     Subsystems in the kernel can now create and destroy their own
     tracing instances which allows them to have their own tracing
     buffer, and be able to record events without worrying about other
     users from writing over their data.

   - New seq_buf_hex_dump() that lets users use the hex_dump() in their
     seq_buf usage.

   - Notifications now added to tracing_max_latency to allow user space
     to know when a new max latency is hit by one of the latency
     tracers.

   - Wider spread use of generic compare operations for use of bsearch
     and friends.

   - More synthetic event fields may be defined (32 up from 16)

   - Use of xarray for architectures with sparse system calls, for the
     system call trace events.

  This along with small clean ups and fixes"

* tag 'trace-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (51 commits)
  tracing: Enable syscall optimization for MIPS
  tracing: Use xarray for syscall trace events
  tracing: Sample module to demonstrate kernel access to Ftrace instances.
  tracing: Adding new functions for kernel access to Ftrace instances
  tracing: Fix Kconfig indentation
  ring-buffer: Fix typos in function ring_buffer_producer
  ftrace: Use BIT() macro
  ftrace: Return ENOTSUPP when DYNAMIC_FTRACE_WITH_DIRECT_CALLS is not configured
  ftrace: Rename ftrace_graph_stub to ftrace_stub_graph
  ftrace: Add a helper function to modify_ftrace_direct() to allow arch optimization
  ftrace: Add helper find_direct_entry() to consolidate code
  ftrace: Add another check for match in register_ftrace_direct()
  ftrace: Fix accounting bug with direct->count in register_ftrace_direct()
  ftrace/selftests: Fix spelling mistake "wakeing" -> "waking"
  tracing: Increase SYNTH_FIELDS_MAX for synthetic_events
  ftrace/samples: Add a sample module that implements modify_ftrace_direct()
  ftrace: Add modify_ftrace_direct()
  tracing: Add missing "inline" in stub function of latency_fsnotify()
  tracing: Remove stray tab in TRACE_EVAL_MAP_FILE's help text
  tracing: Use seq_buf_hex_dump() to dump buffers
  ...

Pull Microblaze updates from Michal Simek:

 - extend DTB space

 - defconfig update

 - clean up rescheduling logic

 - enable SPARSE_IRQ

* tag 'microblaze-v5.5-rc1' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Increase max dtb size to 64K from 32K
  microblaze: Enable SPARSE_IRQ
  microblaze: defconfig: Enable devtmps and tmpfs
  microblaze: entry: Remove unneeded need_resched() loop

Pull RISC-V updates from Paul Walmsley:
 "New features:
   - SECCOMP support
   - nommu support
   - SBI-less system support
   - M-Mode support
   - TLB flush optimizations

  Other improvements:
   - Pass the complete RISC-V ISA string supported by the CPU cores to
     userspace, rather than redacting parts of it in the kernel
   - Add platform DMA IP block data to the HiFive Unleashed board DT
     file
   - Add Makefile support for BZ2, LZ4, LZMA, LZO kernel image
     compression formats, in line with other architectures

  Cleanups:
   - Remove unnecessary PTE_PARENT_SIZE macro
   - Standardize include guard naming across arch/riscv"

* tag 'riscv/for-v5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (22 commits)
  riscv: provide a flat image loader
  riscv: add nommu support
  riscv: clear the instruction cache and all registers when booting
  riscv: read the hart ID from mhartid on boot
  riscv: provide native clint access for M-mode
  riscv: dts: add support for PDMA device of HiFive Unleashed Rev A00
  riscv: add support for MMIO access to the timer registers
  riscv: implement remote sfence.i using IPIs
  riscv: cleanup the default power off implementation
  riscv: poison SBI calls for M-mode
  riscv: don't allow selecting SBI based drivers for M-mode
  RISC-V: Add multiple compression image format.
  riscv: clean up the macro format in each header file
  riscv: Use PMD_SIZE to replace PTE_PARENT_SIZE
  riscv: abstract out CSR names for supervisor vs machine mode
  riscv: separate MMIO functions into their own header file
  riscv: enter WFI in default_power_off() if SBI does not shutdown
  RISC-V: Issue a tlb page flush if possible
  RISC-V: Issue a local tlbflush if possible.
  RISC-V: Do not invoke SBI call if cpumask is empty
  ...

This patch corrects the SPDX License Identifier style in
header files related to drivers for USB Network devices.
This patch gives an explicit block comment to the
SPDX License Identifier.

Changes made by using a script provided by Joe Perches here:
https://lkml.org/lkml/2019/2/7/46.
Suggested-by: Joe Perches <joe@perches.com>
Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch corrects the SPDX License Identifier style in
header files related to PHY Layer for Ethernet drivers.
For C header files Documentation/process/license-rules.rst
mandates C-like comments (opposed to C source files where
C++ style should be used). This patch also gives an explicit
block comment to the SPDX License Identifier.

Changes made by using a script provided by Joe Perches here:
https://lkml.org/lkml/2019/2/7/46.
Suggested-by: Joe Perches <joe@perches.com>
Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull powerpc Spectre-RSB fixes from Michael Ellerman:
 "We failed to activate the mitigation for Spectre-RSB (Return Stack
  Buffer, aka. ret2spec) on context switch, on CPUs prior to Power9
  DD2.3.

  That allows a process to poison the RSB (called Link Stack on Power
  CPUs) and possibly misdirect speculative execution of another process.
  If the victim process can be induced to execute a leak gadget then it
  may be possible to extract information from the victim via a side
  channel.

  The fix is to correctly activate the link stack flush mitigation on
  all CPUs that have any mitigation of Spectre v2 in userspace enabled.

  There's a second commit which adds a link stack flush in the KVM guest
  exit path. A leak via that path has not been demonstrated, but we
  believe it's at least theoretically possible.

  This is the fix for CVE-2019-18660"

* tag 'powerpc-spectre-rsb' of /home/torvalds/Downloads/powerpc-CVE-2019-18660.bundle:
  KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
  powerpc/book3s64: Fix link stack flush on context switch

Commit 6570bc79 ("net: core: use listified Rx for GRO_NORMAL in
napi_gro_receive()") has applied batched GRO_NORMAL packets processing
to all napi_gro_receive() users, including mac80211-based drivers.

However, this change has led to a regression in iwlwifi driver [1][2] as
it is required for NAPI users to call napi_complete_done() or
napi_complete() and the end of every polling iteration, whilst iwlwifi
doesn't use NAPI scheduling at all and just calls napi_gro_flush().
In that particular case, packets which have not been already flushed
from napi->rx_list stall in it until at least next Rx cycle.

Fix this by adding a manual flushing of the list to iwlwifi driver right
before napi_gro_flush() call to mimic napi_complete() logics.

I prefer to open-code gro_normal_list() rather than exporting it for 2
reasons:
* to prevent from using it and napi_gro_flush() in any new drivers,
  as it is the *really* bad way to use NAPI that should be avoided;
* to keep gro_normal_list() static and don't lose any CC optimizations.

I also don't add the "Fixes:" tag as the mentioned commit was only a
trigger that only exposed an improper usage of NAPI in this particular
driver.

[1] https://lore.kernel.org/netdev/PSXP216MB04388962C411CD0B17A86F47804A0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM
[2] https://bugzilla.kernel.org/show_bug.cgi?id=205647Signed-off-by: Alexander Lobakin <alobakin@dlink.ru>
Acked-by: Luca Coelho <luciano.coelho@intel.com>
Reported-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
Tested-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
Reviewed-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull driver core updates from Greg KH:
 "Here is the "big" set of driver core patches for 5.5-rc1

  There's a few minor cleanups and fixes in here, but the majority of
  the patches in here fall into two buckets:

   - debugfs api cleanups and fixes

   - driver core device link support for boot dependancy issues

  The debugfs api cleanups are working to slowly refactor the debugfs
  apis so that it is even harder to use incorrectly. That work has been
  happening for the past few kernel releases and will continue over
  time, it's a long-term project/goal

  The driver core device link support missed 5.4 by just a bit, so it's
  been sitting and baking for many months now. It's from Saravana Kannan
  to help resolve the problems that DT-based systems have at boot time
  with dependancy graphs and kernel modules. Turns out that no one has
  actually tried to build a generic arm64 kernel with loads of modules
  and have it "just work" for a variety of platforms (like a distro
  kernel). The big problem turned out to be a lack of dependency
  information between different areas of DT entries, and the work here
  resolves that problem and now allows devices to boot properly, and
  quicker than a monolith kernel.

  All of these patches have been in linux-next for a long time with no
  reported issues"

* tag 'driver-core-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (68 commits)
  tracing: Remove unnecessary DEBUG_FS dependency
  of: property: Add device link support for interrupt-parent, dmas and -gpio(s)
  debugfs: Fix !DEBUG_FS debugfs_create_automount
  of: property: Add device link support for "iommu-map"
  of: property: Fix the semantics of of_is_ancestor_of()
  i2c: of: Populate fwnode in of_i2c_get_board_info()
  drivers: base: Fix Kconfig indentation
  firmware_loader: Fix labels with comma for builtin firmware
  driver core: Allow device link operations inside sync_state()
  driver core: platform: Declare ret variable only once
  cpu-topology: declare parse_acpi_topology in <linux/arch_topology.h>
  crypto: hisilicon: no need to check return value of debugfs_create functions
  driver core: platform: use the correct callback type for bus_find_device
  firmware_class: make firmware caching configurable
  driver core: Clarify documentation for fwnode_operations.add_links()
  mailbox: tegra: Fix superfluous IRQ error message
  net: caif: Fix debugfs on 64-bit platforms
  mac80211: Use debugfs_create_xul() helper
  media: c8sectpfe: no need to check return value of debugfs_create functions
  of: property: Add device link support for iommus, mboxes and io-channels
  ...

Pull staging / iio updates from Greg KH:
 "Here is the big staging and iio set of patches for the 5.5-rc1
  release.

  It's the usual huge collection of cleanup patches all over the
  drivers/staging/ area, along with a new staging driver, and a bunch of
  new IIO drivers as well.

  Full details are in the shortlog, but all of these have been in
  linux-next for a long time with no reported issues"

* tag 'staging-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (548 commits)
  staging: vchiq: Have vchiq_dump_* functions return an error code
  staging: vchiq: Refactor indentation in vchiq_dump_* functions
  staging: fwserial: Fix Kconfig indentation (seven spaces)
  staging: vchiq_dump: Replace min with min_t
  staging: vchiq: Fix block comment format in vchiq_dump()
  staging: octeon: indent with tabs instead of spaces
  staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
  staging: most: core: remove sysfs attr remove_link
  staging: vc04: Fix Kconfig indentation
  staging: pi433: Fix Kconfig indentation
  staging: nvec: Fix Kconfig indentation
  staging: most: Fix Kconfig indentation
  staging: fwserial: Fix Kconfig indentation
  staging: fbtft: Fix Kconfig indentation
  fbtft: Drop OF dependency
  fbtft: Make use of device property API
  fbtft: Drop useless #ifdef CONFIG_OF and dead code
  fbtft: Describe function parameters in kernel-doc
  fbtft: Make sure string is NULL terminated
  staging: rtl8723bs: remove set but not used variable 'change', 'pos'
  ...

Pull char/misc driver updates from Greg KH:
 "Here is the big set of char/misc and other driver patches for 5.5-rc1

  Loads of different things in here, this feels like the catch-all of
  driver subsystems these days. Full details are in the shortlog, but
  nothing major overall, just lots of driver updates and additions.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (198 commits)
  char: Fix Kconfig indentation, continued
  habanalabs: add more protection of device during reset
  habanalabs: flush EQ workers in hard reset
  habanalabs: make the reset code more consistent
  habanalabs: expose reset counters via existing INFO IOCTL
  habanalabs: make code more concise
  habanalabs: use defines for F/W files
  habanalabs: remove prints on successful device initialization
  habanalabs: remove unnecessary checks
  habanalabs: invalidate MMU cache only once
  habanalabs: skip VA block list update in reset flow
  habanalabs: optimize MMU unmap
  habanalabs: prevent read/write from/to the device during hard reset
  habanalabs: split MMU properties to PCI/DRAM
  habanalabs: re-factor MMU masks and documentation
  habanalabs: type specific MMU cache invalidation
  habanalabs: re-factor memory module code
  habanalabs: export uapi defines to user-space
  habanalabs: don't print error when queues are full
  habanalabs: increase max jobs number to 512
  ...

Yangbo Lu says:

====================
net: mscc: ocelot: fix potential issues accessing skbs list

Fix two prtential issues accessing skbs list.
- Break the matching loop when find the matching skb to avoid
  consuming more skbs incorrectly. The timestamp ID is only
  from 0 to 3 while the FIFO supports 128 timestamps at most.
- Convert to use skb queue instead of the list of skbs to provide
  protect with lock.

Changes for v2:
	- Split into two patches.
	- Converted to use skb queue.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Convert to use skb queue instead of the list of skbs.
The skb queue could provide protection with lock.
Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Break the matching loop when find the matching skb for TX timestamp.
This is to avoid consuming more skbs incorrectly. The timestamp ID
is from 0 to 3 while the FIFO could support 128 timestamps at most.
Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull USB updates from Greg KH:
 "Here is the big set of USB patches for 5.5-rc1

  Lots of little things in here:
   - typec updates and additions
   - usb-serial drivers cleanups and fixes
   - misc USB drivers cleanups and fixes
   - gadget drivers new features and controllers added
   - usual xhci additions
   - other minor changes

  All of these have been in linux-next with no reported issues"

* tag 'usb-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (223 commits)
  usb: gadget: udc: gr_udc: create debugfs directory under usb root
  usb: gadget: atmel: create debugfs directory under usb root
  usb: musb: create debugfs directory under usb root
  usb: serial: Fix Kconfig indentation
  usb: misc: Fix Kconfig indentation
  usb: gadget: Fix Kconfig indentation
  usb: host: Fix Kconfig indentation
  usb: dwc3: Fix Kconfig indentation
  usb: gadget: configfs: Fix missing spin_lock_init()
  usb-storage: Disable UAS on JMicron SATA enclosure
  USB: documentation: flags on usb-storage versus UAS
  USB: uas: heed CAPACITY_HEURISTICS
  USB: uas: honor flag to avoid CAPACITY16
  usb: host: xhci-tegra: Correct phy enable sequence
  usb-serial: cp201x: support Mark-10 digital force gauge
  usb: chipidea: imx: pinctrl for HSIC is optional
  usb: chipidea: imx: refine the error handling for hsic
  usb: chipidea: imx: change hsic power regulator as optional
  usb: chipidea: imx: check data->usbmisc_data against NULL before access
  usb: chipidea: core: change vbus-regulator as optional
  ...

Pull rdma updates from Jason Gunthorpe:
 "Again another fairly quiet cycle with few notable core code changes
  and the usual variety of driver bug fixes and small improvements.

   - Various driver updates and bug fixes for siw, bnxt_re, hns, qedr,
     iw_cxgb4, vmw_pvrdma, mlx5

   - Improvements in SRPT from working with iWarp

   - SRIOV VF support for bnxt_re

   - Skeleton kernel-doc files for drivers/infiniband

   - User visible counters for events related to ODP

   - Common code for tracking of mmap lifetimes so that drivers can link
     HW object liftime to a VMA

   - ODP bug fixes and rework

   - RDMA READ support for efa

   - Removal of the very old cxgb3 driver"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (168 commits)
  RDMA/hns: Delete unnecessary callback functions for cq
  RDMA/hns: Rename the functions used inside creating cq
  RDMA/hns: Redefine the member of hns_roce_cq struct
  RDMA/hns: Redefine interfaces used in creating cq
  RDMA/efa: Expose RDMA read related attributes
  RDMA/efa: Support remote read access in MR registration
  RDMA/efa: Store network attributes in device attributes
  IB/hfi1: remove redundant assignment to variable ret
  RDMA/bnxt_re: Fix missing le16_to_cpu
  RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices
  RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series
  RDMA/bnxt_re: Fix Kconfig indentation
  IB/mlx5: Implement callbacks for getting VFs GUID attributes
  IB/ipoib: Add ndo operation for getting VFs GUID attributes
  IB/core: Add interfaces to get VF node and port GUIDs
  net/core: Add support for getting VF GUIDs
  RDMA/qedr: Fix null-pointer dereference when calling rdma_user_mmap_get_offset
  RDMA/cm: Use refcount_t type for refcount variable
  IB/mlx5: Support extended number of strides for Striding RQ
  IB/mlx4: Update HW GID table while adding vlan GID
  ...

Pull MMC updates from Ulf Hansson:
 "These are the updates for MMC and MEMSTICK for v5.5.

  Note that this also contains quite some additional changes reaching
  beyond both the MMC and MEMSTICK subsystems. This is primarily because
  of fixing an old regression for a WiFi driver based on the SDIO
  interface on an OMAP openpandora board

  MMC core:
   - Add CMD13 polling for MMC IOCTLS with R1B response.
   - Add common DT properties for clk-phase-delays for various speed
     modes.
   - Fix size overflow for mmc gp-partitions.
   - Re-work HW reset for SDIO cards, which also includes a re-work for
     Marvell's WiFi mwifiex SDIO func driver.

  MMC host:
   - jz4740: Add support for X1000 and JZ4760.
   - jz4740: Add support for 8-bit bus and for low power mode.
   - mmci: Add support for HW busy timeout for the stm32_sdmmc variant.
   - owl-mmc: Add driver for Actions Semi Owl SoCs SD/MMC controller.
   - renesas_sdhi: Add support for r8a774b1.
   - sdhci_am654: Add support for Command Queuing Engine for J721E.
   - sdhci-milbeaut: Add driver for the Milbeaut SD controller.
   - sdhci-of-arasan: Add support for ZynqMP tap-delays.
   - sdhci-of-arasan: Add support for clk-phase-delays for SD cards.
   - sdhci-of-arasan: Add support for Intel LGM SDXC.
   - sdhci-of-aspeed: Allow inversion of the internal card detect
     signal.
   - sdhci-of-esdhc: Fixup workaround for erratum A-008171 for tunings.
   - sdhci-of-at91: Improve support for calibration.
   - sdhci-pci: Add support for Intel JSL.
   - sdhci-pci: Add quirk for AMD SDHC Device 0x7906.
   - tmio: Enable support for erase/discard/trim requests.

  MMC/OMAP/pandora/wl1251:

  The TI wl1251 WiFi driver for SDIO on the OMAP openpandora board has
  been broken since v4.7. To fix the problems, changes have been made
  cross subsystems, but also to OMAP2 machine code and to openpandora
  DTS files, as summarized below. Relevant changes have been tagged for
  stable.

   - mmc/wl1251: Re-introduce lost SDIO quirks and vendor-id for wl1251
   - omap/omap_hsmmc: Remove redundant platform config for openpandora
   - omap_hsmmc: Initialize non-std SDIO card for wl1251 for pandora
   - omap/dts/pandora: Specify wl1251 through a child node of mmc3
   - wl1251: Add devicetree support for TI wl1251 SDIO"

* tag 'mmc-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (73 commits)
  dt-bindings: mmc: Correct the type of the clk phase properties
  Revert "mmc: tmio: remove workaround for NON_REMOVABLE"
  memstick: Fix Kconfig indentation
  mmc: sdhci-of-arasan: Add support for ZynqMP Platform Tap Delays Setup
  dt-bindings: mmc: arasan: Document 'xlnx,zynqmp-8.9a' controller
  firmware: xilinx: Add SDIO Tap Delay nodes
  mmc: sdhci-of-arasan: Add support to set clock phase delays for SD
  dt-bindings: mmc: Add optional generic properties for mmc
  mmc: sdhci-of-arasan: Add sampling clock for a phy to use
  dt-bindings: mmc: arasan: Update Documentation for the input clock
  mmc: sdhci-of-arasan: Separate out clk related data to another structure
  mmc: sdhci: Fix grammar in warning message
  mmc: sdhci-of-aspeed: add inversion signal presence
  mmc: sdhci-of-aspeed: enable CONFIG_MMC_SDHCI_IO_ACCESSORS
  mmc: sdhci_am654: Add Support for Command Queuing Engine to J721E
  mmc: core: Fix size overflow for mmc partitions
  mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
  net: wireless: ti: remove local VENDOR_ID and DEVICE_ID definitions
  net: wireless: ti: wl1251 use new SDIO_VENDOR_ID_TI_WL1251 definition
  mmc: core: fix wl1251 sdio quirks
  ...

Pull pin control updates from Linus Walleij:
 "This is the bulk of pin control changes for v5.5.

  It is pretty much business as usual, the most interesting thing I
  think is the pin controller for a new Intel chip called Lightning
  Mountain, which is according to news reports some kind of embedded
  network processor and what is surprising about it is that Intel have
  decided to use device tree to describe the system rather than ACPI
  that they have traditionally favored.

  Core changes:

   - Avoid taking direct references to device tree-supplied device
     names: these may changed at runtime under certain circumstances to
     kstrdup them.

  GPIO related:

   - Work is ongoing to move to passing the irqchip along as a templated
     struct gpio_irq_chip when adding a standard gpiolib-based irqchip
     to a GPIO controller, a few patches in this cycle switches a few
     pin control drivers over to using this method.

  New hardware support:

   - Intel Lightning Mountain SoC pin controller and GPIO support, a
     first Intel platform to use device tree rather than ACPI to
     configure the system. News reports says that this SoC is a network
     processor.

   - Qualcomm MSM8976 and MSM8956

   - Qualcomm PMIC GPIO now also supports PM6150 and PM6150L

   - Qualcomm SPMI MPP and SPMI GPIO for PM8950 and PMI8950

   - Rockchip RK3308

   - Renesas R8A77961

   - Allwinner Meson-A1

  Driver improvements:

   - get_multiple and set_multiple support for the AT91-PIO4 driver.

   - Convert Qualcomm SSBI GPIO to use the hierarchical IRQ helpers in
     the GPIOlib irqchip"

* tag 'pinctrl-v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (93 commits)
  pinctrl: ingenic: Add OTG VBUS pin for the JZ4770
  pinctrl: ingenic: Handle PIN_CONFIG_OUTPUT config
  pinctrl: Fix Kconfig indentation
  pinctrl: lewisburg: Update pin list according to v1.1v6
  MAINTAINERS: Replace my email by one @kernel.org
  pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type()
  dt-bindings: pinctrl: intel: Add for new SoC
  pinctrl: Add pinmux & GPIO controller driver for a new SoC
  pinctrl: rza1: remove unnecessary static inline function
  pinctrl: meson: add pinctrl driver support for Meson-A1 SoC
  pinctrl: meson: add a new callback for SoCs fixup
  pinctrl: nomadik: db8500: Add mc0_a_2 pin group without direction control
  dt-bindings: pinctrl: Convert generic pin mux and config properties to schema
  pinctrl: cherryview: Missed type change to unsigned int
  pinctrl: intel: Missed type change to unsigned int
  pinctrl: use devm_platform_ioremap_resource() to simplify code
  pinctrl: just return if no valid maps
  dt-bindings: pinctrl: qcom-pmic-mpp: Add support for PM/PMI8950
  pinctrl: qcom: spmi-mpp: Add PM/PMI8950 compatible strings
  dt-bindings: pinctrl: qcom-pmic-gpio: Add support for PM/PMI8950
  ...

Pull hwmon updates from Guenter Roeck:

 - Add support for Texas Instruments TMP512/513

 - Add support for LTC2947

 - Add support for BEL PFE1100 and PFE3000

 - Various minor improvements and fixes

* tag 'hwmon-for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  dell-smm-hwmon: Add documentation
  hwmon: (dell-smm) Add support for disabling automatic BIOS fan control
  hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.
  dt-bindings: hwmon: Add TMP512/513
  docs: hwmon: Document bel-pfe pmbus driver
  hwmon: (pmbus) add driver for BEL PFE1100 and PFE3000
  dt-bindings: hwmon: Add ltc2947 documentation
  hwmon: Add support for ltc2947
  hwmon: (ina3221) Add summation feature support
  hwmon: (tmp421) Allow reading at 2Hz instead of 0.5Hz
  hwmon: (w83793d) remove redundant assignment to variable res
  hwmon: (pmbus/ibm-cffps) Add version detection capability
  dt-bindings: hwmon: Document ibm,cffps compatible string
  hwmon: abituguru: make array probe_order static, makes object smaller
  hwmon: (applesmc) switch to using input device polling mode
  hwmon: (aspeed-pwm-tacho) Use devm_platform_ioremap_resource() in aspeed_pwm_tacho_probe()
  hwmon: (pmbus/ibm-cffps) Fix LED blink behavior
  hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call

Pull power supply and reset updates from Sebastian Reichel:

 - test_power: add support for current and charge_counter

 - cpcap-charger: improve charge calculation and limit default charge
   voltage

 - ab8500: convert to IIO

 - misc small fixes all over drivers

* tag 'for-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (29 commits)
  power: supply: bd70528: Add MODULE_ALIAS to allow module auto loading
  power: supply: ab8500_charger: Fix inconsistent IS_ERR and PTR_ERR
  power: supply: cpcap-charger: cpcap_charger_voltage_to_regval() can be static
  power: supply: cpcap-battery: Add basic coulomb counter calibrate support
  power: supply: cpcap-battery: Read and save integrator register CCI
  power: supply: cpcap-battery: Simplify short term power average calculation
  power: supply: cpcap-battery: Simplify coulomb counter calculation with div_s64
  power: supply: cpcap-battery: Move coulomb counter units per lsb to ddata
  power: supply: cpcap-charger: Allow changing constant charge voltage
  power: supply: cpcap-battery: Fix handling of lowered charger voltage
  power: supply: cpcap-charger: Improve battery detection
  power: supply: cpcap-battery: Check voltage before orderly_poweroff
  power: supply: cpcap-charger: Limit voltage to 4.2V for battery
  power: supply: ab8500: Handle invalid IRQ from platform_get_irq_byname()
  power: supply: ab8500_fg: Do not free non-requested IRQs in probe's error path
  power: supply: ab8500: Cleanup probe in reverse order
  power: reset: at91: fix __le32 cast in reset code
  power: supply: abx500_chargalg: Fix code indentation
  mfd: Switch the AB8500 GPADC to IIO
  iio: adc: New driver for the AB8500 GPADC
  ...

Pull media updates from Mauro Carvalho Chehab:

 - uAPI documentation for stateless decoders

 - Added a new CEC ioctl together with its documentation

 - Improved IPU3 documentation

 - New i2c drivers: hi556 and imx290

 - Added support on Vivid driver for meta streams

 - Added de-interlace support for sunxi subdriver

 - Added a few new remote controler keymaps

 - Added H.265 support for Sunxi Cedrus driver

 - Another round of random driver cleanups, fixes and improvements

* tag 'media/v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (361 commits)
  media: Revert "media: mtk-vcodec: Remove extra area allocation in an input buffer on encoding"
  media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly
  media: hantro: Remove now unused H264 pic_size
  media: hantro: Use output buffer width and height for H264 decoding
  media: hantro: Reduce H264 extra space for motion vectors
  media: hantro: Fix H264 motion vector buffer offset
  media: ti-vpe: vpe: fix compatible to match bindings
  media: dt-bindings: media: ti-vpe: Document VPE driver
  media: zr364xx: remove redundant assigmnent to idx, clean up code
  media: Documentation: media: *_DEFAULT targets for subdevs
  media: hantro: Fix s_fmt for dynamic resolution changes
  media: i2c: Use the correct style for SPDX License Identifier
  media: siano: Use the correct style for SPDX License Identifier
  media: vicodec: media_device_cleanup was called too early
  media: vim2m: media_device_cleanup was called too early
  media: cedrus: Increase maximum supported size
  media: cedrus: Fix H264 4k support
  media: cedrus: Properly signal size in mode register
  media: v4l2-ctrl: Lock main_hdl on operations of requests_queued.
  media: si470x-i2c: add missed operations in remove
  ...

Pull sound updates from Takashi Iwai:
 "There have been some significant changes in the core side, both for
  ALSA and ASoC, while lots of development have been seen in SOF, as
  well as many small fixes/improvements for ASoC codecs and platforms.
  Below is a highlight in this cycle:

  Core:
   - The unification of PCM vmalloc buffer allocation helpers into the
     standard API
   - Clean up of the default PCM mmap handling for vmalloc & SG-buffer
   - Fix potential races at ALSA timer open
   - A few new PCM API extensions; just preliminary core changes, the
     actual changes in drivers will be merged in 5.6
   - Continued ASoC componentization works; now almost everything is a
     common ASoC component object. A lot of refactoring and
     simplification have been done along with it.

  ASoC:
   - Many fixes to the Sound Open Firmware (SOF) code
   - Wake on voice support for Chromebooks
   - SPI support and trigger word detection for RT5677
   - New drivers for Analog Devices ADAU7118, Intel Cannonlake systems
     with RT1011 and RT5682, Texas Instruments TAS2562 and TAS2770

  HD-audio:
   - Improved Intel DSP configuration / probe code for SOF
   - Plumbing the legacy HD-audio driver with Intel SOF HDMI
   - DP-MST support for Nvidia HDMI codecs
   - Realtek quirks cleanups and new additions as usual

  Others:
   - Lots of refactoring and cleanups for FireWire; period-size sharing,
     h/w IRQ interval configuration, clock recovery improvements, etc
   - USB-audio: Scarlett mixer quirks
   - Cleanups of PCM calls in various drivers (including media and USB)
     to adapt the core API changes"

* tag 'sound-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (497 commits)
  ALSA: usb-audio: Fix Focusrite Scarlett 6i6 gen1 - input handling
  ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC
  ALSA: aloop: Fix dependency on timer API
  ASoC: DMI long name - avoid to add board name if matches with product name
  ASoC: improve the DMI long card code in asoc-core
  ASoC: rsnd: fix DALIGN register for SSIU
  ALSA: aloop: Avoid unexpected timer event callback tasklets
  ALSA: aloop: Remove redundant locking in timer open function
  ASoC: component: Add sync_stop PCM ops
  ASoC: pcm: Make ioctl ops optional
  ALSA: hda/hdmi - Clear codec->relaxed_resume flag at unbinding
  ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs
  ALSA: cs4236: fix error return comparison of an unsigned integer
  ALSA: usb-audio: Fix NULL dereference at parsing BADD
  ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data
  ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
  ALSA: hda/realtek - Move some alc236 pintbls to fallback table
  ALSA: hda/realtek - Move some alc256 pintbls to fallback table
  ALSA: docs: Update about the new PCM sync_stop ops
  ALSA: pcm: Add card sync_irq field
  ...

Pull device properties framework updates from Rafael Wysocki:
 "Add support for printing fwnode names using a new conversion specifier
  "%pfw" (Sakari Ailus), clean up the software node and
  efi/apple-properties code in preparation for improved software node
  reference properties handling (Dmitry Torokhov) and fix the struct
  fwnode_operations description (Heikki Krogerus)"

* tag 'devprop-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (22 commits)
  software node: simplify property_entry_read_string_array()
  software node: unify PROPERTY_ENTRY_XXX macros
  software node: remove property_entry_read_uNN_array functions
  software node: get rid of property_set_pointer()
  software node: clean up property_copy_string_array()
  software node: mark internal macros with double underscores
  efi/apple-properties: use PROPERTY_ENTRY_U8_ARRAY_LEN
  software node: introduce PROPERTY_ENTRY_XXX_ARRAY_LEN()
  software node: remove DEV_PROP_MAX
  device property: Fix the description of struct fwnode_operations
  lib/test_printf: Add tests for %pfw printk modifier
  lib/vsprintf: Add %pfw conversion specifier for printing fwnode names
  lib/vsprintf: OF nodes are first and foremost, struct device_nodes
  lib/vsprintf: Make use of fwnode API to obtain node names and separators
  lib/vsprintf: Add a note on re-using %pf or %pF
  lib/vsprintf: Remove support for %pF and %pf in favour of %pS and %ps
  device property: Add a function to obtain a node's prefix
  device property: Add fwnode_get_name for returning the name of a node
  device property: Add functions for accessing node's parents
  device property: Move fwnode_get_parent() up
  ...

Pull ACPI updates from Rafael Wysocki:
 "These update the ACPICA code in the kernel to upstream revision
  20191018, add support for EFI specific purpose memory, update the ACPI
  EC driver to make it work on systems with hardware-reduced ACPI,
  improve ACPI-based device enumeration for some platforms, rework the
  lid blacklist handling in the button driver and add more lid quirks to
  it, unify ACPI _HID/_UID matching, fix assorted issues and clean up
  the code and documentation.

  Specifics:

   - Update the ACPICA code in the kernel to upstream revision 20191018
     including:
      * Fixes for Clang warnings (Bob Moore)
      * Fix for possible overflow in get_tick_count() (Bob Moore)
      * Introduction of acpi_unload_table() (Bob Moore)
      * Debugger and utilities updates (Erik Schmauss)
      * Fix for unloading tables loaded via configfs (Nikolaus Voss)

   - Add support for EFI specific purpose memory to optionally allow
     either application-exclusive or core-kernel-mm managed access to
     differentiated memory (Dan Williams)

   - Fix and clean up processing of the HMAT table (Brice Goglin, Qian
     Cai, Tao Xu)

   - Update the ACPI EC driver to make it work on systems with
     hardware-reduced ACPI (Daniel Drake)

   - Always build in support for the Generic Event Device (GED) to allow
     one kernel binary to work both on systems with full hardware ACPI
     and hardware-reduced ACPI (Arjan van de Ven)

   - Fix the table unload mechanism to unregister platform devices
     created when the given table was loaded (Andy Shevchenko)

   - Rework the lid blacklist handling in the button driver and add more
     lid quirks to it (Hans de Goede)

   - Improve ACPI-based device enumeration for some platforms based on
     Intel BayTrail SoCs (Hans de Goede)

   - Add an OpRegion driver for the Cherry Trail Crystal Cove PMIC and
     prevent handlers from being registered for unhandled PMIC OpRegions
     (Hans de Goede)

   - Unify ACPI _HID/_UID matching (Andy Shevchenko)

   - Clean up documentation and comments (Cao jin, James Pack, Kacper
     Piwiński)"

* tag 'acpi-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (52 commits)
  ACPI: OSI: Shoot duplicate word
  ACPI: HMAT: use %u instead of %d to print u32 values
  ACPI: NUMA: HMAT: fix a section mismatch
  ACPI: HMAT: don't mix pxm and nid when setting memory target processor_pxm
  ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device
  ACPI: NUMA: HMAT: Register HMAT at device_initcall level
  device-dax: Add a driver for "hmem" devices
  dax: Fix alloc_dax_region() compile warning
  lib: Uplevel the pmem "region" ida to a global allocator
  x86/efi: Add efi_fake_mem support for EFI_MEMORY_SP
  arm/efi: EFI soft reservation to memblock
  x86/efi: EFI soft reservation to E820 enumeration
  efi: Common enable/disable infrastructure for EFI soft reservation
  x86/efi: Push EFI_MEMMAP check into leaf routines
  efi: Enumerate EFI_MEMORY_SP
  ACPI: NUMA: Establish a new drivers/acpi/numa/ directory
  ACPICA: Update version to 20191018
  ACPICA: debugger: remove leading whitespaces when converting a string to a buffer
  ACPICA: acpiexec: initialize all simple types and field units from user input
  ACPICA: debugger: add field unit support for acpi_db_get_next_token
  ...

Pull power management updates from Rafael Wysocki:
 "These include cpuidle changes to use nanoseconds (instead of
  microseconds) as the unit of time and to simplify checks for disabled
  idle states in the idle loop, some cpuidle fixes and governor updates,
  assorted cpufreq updates (driver updates mostly and a few core fixes
  and cleanups), devfreq updates (dominated by the tegra30 driver
  changes), new CPU IDs for the RAPL power capping driver, relatively
  minor updates of the generic power domains (genpd) and operation
  performance points (OPP) frameworks, and assorted fixes and cleanups.

  There are also two maintainer information updates: Chanwoo Choi will
  be maintaining the devfreq subsystem going forward and Todd Brandt is
  going to maintain the pm-graph utility (created by him).

  Specifics:

   - Use nanoseconds (instead of microseconds) as the unit of time in
     the cpuidle core and simplify checks for disabled idle states in
     the idle loop (Rafael Wysocki)

   - Fix and clean up the teo cpuidle governor (Rafael Wysocki)

   - Fix the cpuidle registration error code path (Zhenzhong Duan)

   - Avoid excessive vmexits in the ACPI cpuidle driver (Yin Fengwei)

   - Extend the idle injection infrastructure to be able to measure the
     requested duration in nanoseconds and to allow an exit latency
     limit for idle states to be specified (Daniel Lezcano)

   - Fix cpufreq driver registration and clarify a comment in the
     cpufreq core (Viresh Kumar)

   - Add NULL checks to the show() and store() methods of sysfs
     attributes exposed by cpufreq (Kai Shen)

   - Update cpufreq drivers:
      * Fix for a plain int as pointer warning from sparse in
        intel_pstate (Jamal Shareef)
      * Fix for a hardcoded number of CPUs and stack bloat in the
        powernv driver (John Hubbard)
      * Updates to the ti-cpufreq driver and DT files to support new
        platforms and migrate bindings from opp-v1 to opp-v2 (Adam Ford,
        H. Nikolaus Schaller)
      * Merging of the arm_big_little and vexpress-spc drivers and
        related cleanup (Sudeep Holla)
      * Fix for imx's default speed grade value (Anson Huang)
      * Minor cleanup of the s3c64xx driver (Nathan Chancellor)
      * CPU speed bin detection fix for sun50i (Ondrej Jirman)

   - Appoint Chanwoo Choi as the new devfreq maintainer.

   - Update the devfreq core:
      * Check NULL governor in available_governors_show sysfs to prevent
        showing wrong governor information and fix a race condition
        between devfreq_update_status() and trans_stat_show() (Leonard
        Crestez)
      * Add new 'interrupt-driven' flag for devfreq governors to allow
        interrupt-driven governors to prevent the devfreq core from
        polling devices for status (Dmitry Osipenko)
      * Improve an error message in devfreq_add_device() (Matthias
        Kaehlcke)

   - Update devfreq drivers:
      * tegra30 driver fixes and cleanups (Dmitry Osipenko)
      * Removal of unused property from dt-binding documentation for the
        exynos-bus driver (Kamil Konieczny)
      * exynos-ppmu cleanup and DT bindings update (Lukasz Luba, Marek
        Szyprowski)

   - Add new CPU IDs for CometLake Mobile and Desktop to the Intel RAPL
     power capping driver (Zhang Rui)

   - Allow device initialization in the generic power domains (genpd)
     framework to be more straightforward and clean it up (Ulf Hansson)

   - Add support for adjusting OPP voltages at run time to the OPP
     framework (Stephen Boyd)

   - Avoid freeing memory that has never been allocated in the
     hibernation core (Andy Whitcroft)

   - Clean up function headers in a header file and coding style in the
     wakeup IRQs handling code (Ulf Hansson, Xiaofei Tan)

   - Clean up the SmartReflex adaptive voltage scaling (AVS) driver for
     ARM (Ben Dooks, Geert Uytterhoeven)

   - Wrap power management documentation to fit in 80 columns (Bjorn
     Helgaas)

   - Add pm-graph utility entry to MAINTAINERS (Todd Brandt)

   - Update the cpupower utility:
      * Fix the handling of set and info subcommands (Abhishek Goel)
      * Fix build warnings (Nathan Chancellor)
      * Improve mperf_monitor handling (Janakarajan Natarajan)"

* tag 'pm-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (83 commits)
  PM: Wrap documentation to fit in 80 columns
  cpuidle: Pass exit latency limit to cpuidle_use_deepest_state()
  cpuidle: Allow idle injection to apply exit latency limit
  cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks
  cpuidle: teo: Avoid code duplication in conditionals
  cpufreq: Register drivers only after CPU devices have been registered
  cpuidle: teo: Avoid using "early hits" incorrectly
  cpuidle: teo: Exclude cpuidle overhead from computations
  PM / Domains: Convert to dev_to_genpd_safe() in genpd_syscore_switch()
  mmc: tmio: Avoid boilerplate code in ->runtime_suspend()
  PM / Domains: Implement the ->start() callback for genpd
  PM / Domains: Introduce dev_pm_domain_start()
  ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
  PM / wakeirq: remove unnecessary parentheses
  power: avs: smartreflex: Remove superfluous cast in debugfs_create_file() call
  cpuidle: Use nanoseconds as the unit of time
  PM / OPP: Support adjusting OPP voltages at runtime
  PM / core: Clean up some function headers in power.h
  cpufreq: Add NULL checks to show() and store() methods of cpufreq
  cpufreq: intel_pstate: Fix plain int as pointer warning from sparse
  ...