Bug #1920784 “qemu-system-ppc64le fails with kvm acceleration” : Bugs : The Ubuntu-power-systems project

Revision history for this message

sadoon albader (sadoonalbader) wrote on 2021-03-22:

#1

CurrentDmesg.txt Edit (107.3 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (8.3 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (11.9 KiB, text/plain; charset="utf-8")
Lspci-vt.txt Edit (774 bytes, text/plain; charset="utf-8")
Lsusb.txt Edit (742 bytes, text/plain; charset="utf-8")
Lsusb-t.txt Edit (1.2 KiB, text/plain; charset="utf-8")
Lsusb-v.txt Edit (44.5 KiB, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.4 KiB, text/plain; charset="utf-8")
ProcCpuinfoMinimal.txt Edit (234 bytes, text/plain; charset="utf-8")
ProcEnviron.txt Edit (126 bytes, text/plain; charset="utf-8")
ProcInterrupts.gz Edit (1.6 KiB, application/x-gzip)
ProcLocks.txt Edit (1.1 KiB, text/plain; charset="utf-8")
ProcMisc.txt Edit (264 bytes, text/plain; charset="utf-8")
ProcModules.txt Edit (5.1 KiB, text/plain; charset="utf-8")
ProcPpc64.tar.gz Edit (502 bytes, application/x-gzip)
RelatedPackageVersions.txt Edit (3.3 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (206.1 KiB, text/plain; charset="utf-8")

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-03-23:

#2

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in qemu (Ubuntu):
status:	New → Confirmed

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#3

Since this seems to be broken on all Distributions as soon as the triggering
combination of kernel/glibc is present I think we'd want to open that up to
upstream qemu for a wider discussion and to also hit the ppc64 architecture
experts.

Furthermore I'm not entirely sure if this needs to be fixed in qemu, it might instead be the case that instead a fix is needed in glibc.

Therefore I'm adding a qemu (upstream) bug task for now to have the bug reported there as well (might be worth for awareness anyway) - but chances are that after some debugging it will turn out to become a glibc issue instead.

If only I could break this test out of kvm ioctl into something simpler, then we could then properly file against glibc ....

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#4

Download full text (3.5 KiB)

Hi Sadoon,
thanks for the report!
There isn't much to find about this issue yet.
One automatic syscaller crash report [1].
On the emulation side there is [2][3].

On the glibc side we have [4][5] adding the use of it with [6] being a fix.
All those seem to be in glibc 2.33 - so I'd expect with [6] it should only
be issued on power9 which in turn should HW-support the instruction.

I was trying to recreate this on power8 and power9 machines.
As expected on power8 just nothing happens (the instruction isn't used due to [6]).
TBH I first wondered if these Sforza chips [7][8][9] you mentioned are
fully identical to a classic IBM p9 box - but I was indeed able to reproduce
the issue just fine on an IBM-sold P9
dmesg:
[ 1516.438442] Facility 'SCV' unavailable (12), exception at 0x76c9f84c49a0, MSR=900000000280f033
[ 1516.438472] qemu-system-ppc[42884]: illegal instruction (4) at 76c9f84c49a0 nip 76c9f84c49a0 lr 1f12839d9f0 code 1 in libc-2.33.so[76c9f8380000+220000]
[ 1516.438489] qemu-system-ppc[42884]: code: e8010010 7c0803a6 4e800020 60420000 7ca42b78 4bffed65 60000000 38210020
[ 1516.438493] qemu-system-ppc[42884]: code: e8010010 7c0803a6 4e800020 60420000 <44000001> 4bffffb8 60000000 60420000

The chip I used for this test is:
Model: 2.2 (pvr 004e 1202)
Model name: POWER9, altivec supported

The syscall this crashes in belongs to the ioctl
(gdb) bt
#0 __GI___ioctl (fd=<optimized out>, request=536915584) at ../sysdeps/unix/sysv/linux/powerpc/ioctl.c:56
#1 0x00000cb63ef7d9f0 in kvm_vcpu_ioctl (cpu=cpu@entry=0x7d0f48010010, type=type@entry=536915584) at ../../accel/kvm/kvm-all.c:2654
#2 0x00000cb63ef7dbdc in kvm_cpu_exec (cpu=0x7d0f48010010) at ../../accel/kvm/kvm-all.c:2491
#3 0x00000cb63ee78344 in kvm_vcpu_thread_fn (arg=0x7d0f48010010) at ../../accel/kvm/kvm-cpus.c:49
#4 0x00000cb63f1d14bc in qemu_thread_start (args=<optimized out>) at ../../util/qemu-thread-posix.c:521
#5 0x00007d0f4ac69114 in start_thread (arg=0x7d0f23dfe720) at pthread_create.c:473
#6 0x00007d0f4ab755c0 in clone () at ../sysdeps/unix/sysv/linux/powerpc/powerpc64/clone.S:103

And jumping into the code of the __GI___ioctl we can clearly see
the scv instruction is indeed there in the executed code path:

   0x7ffff66c4984 <__GI___ioctl+292> bl 0x7ffff66c36e8 <__GI___tcgetattr+8>
   0x7ffff66c4988 <__GI___ioctl+296> nop
   0x7ffff66c498c <__GI___ioctl+300> addi r1,r1,32
   0x7ffff66c4990 <__GI___ioctl+304> ld r0,16(r1)
   0x7ffff66c4994 <__GI___ioctl+308> mtlr r0
   0x7ffff66c4998 <__GI___ioctl+312> blr
   0x7ffff66c499c <__GI___ioctl+316> ori r2,r2,0
  >0x7ffff66c49a0 <__GI___ioctl+320> scv 0

[1]: https://webcache.googleusercontent.com/search?q=cache:uS0jhPekyqMJ:https://syzkaller-ppc64.appspot.com/text%3Ftag%3DCrashReport%26x%3D17d99883000000+&cd=2&hl=de&ct=clnk&gl=uk
[2]: https://git.qemu.org/?p=qemu.git;a=commit;h=3c89b8d6ac5b8728cd7620f9885bd953edd18a11
[3]: https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg05425.html
[4]: https://sourceware.org/git/?p=glibc.git;a=commit;h=68ab82f56690ada86ac1e0c46bad06ba189a10ef
[5]: https://sourceware.o...

Hi Sadoon,
thanks for the report!
There isn't much to find about this issue yet.
One automatic syscaller crash report [1].
On the emulation side there is [2][3].

On the glibc side we have [4][5] adding the use of it with [6] being a fix.
All those seem to be in glibc 2.33 - so I'd expect with [6] it should only
be issued on power9 which in turn should HW-support the instruction.

I was trying to recreate this on power8 and power9 machines.
As expected on power8 just nothing happens (the instruction isn't used due to [6]).
TBH I first wondered if these Sforza chips [7][8][9] you mentioned are
fully identical to a classic IBM p9 box - but I was indeed able to reproduce
the issue just fine on an IBM-sold P9
dmesg:
[ 1516.438442] Facility 'SCV' unavailable (12), exception at 0x76c9f84c49a0, MSR=900000000280f033
[ 1516.438472] qemu-system-ppc[42884]: illegal instruction (4) at 76c9f84c49a0 nip 76c9f84c49a0 lr 1f12839d9f0 code 1 in libc-2.33.so[76c9f8380000+220000]
[ 1516.438489] qemu-system-ppc[42884]: code: e8010010 7c0803a6 4e800020 60420000 7ca42b78 4bffed65 60000000 38210020 
[ 1516.438493] qemu-system-ppc[42884]: code: e8010010 7c0803a6 4e800020 60420000 <44000001> 4bffffb8 60000000 60420000

The chip I used for this test is:
Model:                           2.2 (pvr 004e 1202)
Model name:                      POWER9, altivec supported

The syscall this crashes in belongs to the ioctl
(gdb) bt
#0  __GI___ioctl (fd=<optimized out>, request=536915584) at ../sysdeps/unix/sysv/linux/powerpc/ioctl.c:56
#1  0x00000cb63ef7d9f0 in kvm_vcpu_ioctl (cpu=cpu@entry=0x7d0f48010010, type=type@entry=536915584) at ../../accel/kvm/kvm-all.c:2654
#2  0x00000cb63ef7dbdc in kvm_cpu_exec (cpu=0x7d0f48010010) at ../../accel/kvm/kvm-all.c:2491
#3  0x00000cb63ee78344 in kvm_vcpu_thread_fn (arg=0x7d0f48010010) at ../../accel/kvm/kvm-cpus.c:49
#4  0x00000cb63f1d14bc in qemu_thread_start (args=<optimized out>) at ../../util/qemu-thread-posix.c:521
#5  0x00007d0f4ac69114 in start_thread (arg=0x7d0f23dfe720) at pthread_create.c:473
#6  0x00007d0f4ab755c0 in clone () at ../sysdeps/unix/sysv/linux/powerpc/powerpc64/clone.S:103

And jumping into the code of the  __GI___ioctl we can clearly see
the scv instruction is indeed there in the executed code path:

0x7ffff66c4984 <__GI___ioctl+292>       bl      0x7ffff66c36e8 <__GI___tcgetattr+8>
   0x7ffff66c4988 <__GI___ioctl+296>       nop
   0x7ffff66c498c <__GI___ioctl+300>       addi    r1,r1,32
   0x7ffff66c4990 <__GI___ioctl+304>       ld      r0,16(r1)
   0x7ffff66c4994 <__GI___ioctl+308>       mtlr    r0
   0x7ffff66c4998 <__GI___ioctl+312>       blr
   0x7ffff66c499c <__GI___ioctl+316>       ori     r2,r2,0
  >0x7ffff66c49a0 <__GI___ioctl+320>       scv     0

[1]: https://webcache.googleusercontent.com/search?q=cache:uS0jhPekyqMJ:https://syzkaller-ppc64.appspot.com/text%3Ftag%3DCrashReport%26x%3D17d99883000000+&cd=2&hl=de&ct=clnk&gl=uk
[2]: https://git.qemu.org/?p=qemu.git;a=commit;h=3c89b8d6ac5b8728cd7620f9885bd953edd18a11
[3]: https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg05425.html
[4]: https://sourceware.org/git/?p=glibc.git;a=commit;h=68ab82f56690ada86ac1e0c46bad06ba189a10ef
[5]: https://sourceware.org/git/?p=glibc.git;a=commit;h=41f013cef24884604c303435dd1915be2ea5c0e0
[6]: https://sourceware.org/git/?p=glibc.git;a=commit;h=527c89cd32f8522859f58343be3d3dc8f754b783
[7]: https://wiki.raptorcs.com/wiki/Sforza
[8]: https://wiki.raptorcs.com/wiki/Talos_II
[9]: https://wiki.raptorcs.com/wiki/POWER9
[10]: https://lwn.net/Articles/822867/

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#5

qemu calls this ioctl on ppc64 as:
sysdeps/unix/sysv/linux/powerpc/ioctl.c
result = INLINE_SYSCALL (ioctl, 3, fd, request, arg);

The mapping of macros in sysdeps/unix/sysv/linux/powerpc/sysdep.h seems to be:
INTERNAL_SYSCALL -> INTERNAL_SYSCALL_NCS -> TRY_SYSCALL_SCV -> SYSCALL_SCV

76 #define SYSCALL_SCV(nr) \
77 ({ \
78 __asm__ __volatile__ \
79 (".machine \"push\"\n\t" \
80 ".machine \"power9\"\n\t" \
81 "scv 0\n\t" \
82 ".machine \"pop\"\n\t" \
83 "0:" \
84 : "=&r" (r0), \
85 "=&r" (r3), "=&r" (r4), "=&r" (r5), \
86 "=&r" (r6), "=&r" (r7), "=&r" (r8) \
87 : ASM_INPUT_##nr \
88 : "r9", "r10", "r11", "r12", \
89 "lr", "ctr", "memory"); \
90 r3; \
91 })

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#6

[10] outlined to use PPC_FEATURE2_SCV but [4] does just that.
In addition [6] added power9 machine settings as only on this ISA it
is available - like:
+ .machine "push"
+ .machine "power9"
scv 0
+ .machine "pop"

Maybe there is some generated "scv 0" left that needs the same [6] treatment?

OTOH In a normal test program I can run "scv 0" just fine.
But not other scv levels (expected).

# cat test.c
#include <stdio.h>

int main() {
   printf("Hello scv 0\n");
   __asm__(
   "scv 0\n\t"
   );
   printf("survived\n");
   __asm__(
   "scv 1\n\t"
   );
   printf("survived level 1\n");
   return 0;
}
# gcc -Wall -o test test.c
./test
Hello scv 0
survived
Illegal instruction (core dumped)

IIRC .machine is only a psedo-op for the assembler.
So it is correct that I can't see it in the live disassembly of gdb.

The failing "svc 0" from glibcs __GI___ioctl is
0x00007ffff66c49a0 <+320>: 01 00 00 44 scv 0
And in my test program it is
0x0000000100000848 <+44>: 01 00 00 44 scv 0

Hmm, this is the same opcode but fails in just one of the cases.
This might need someone being more an ppc64/glibc expert than me :-/

@Frank - could you modify this bug to become mirrored to IBM for their arch-expertise please?

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#7

ioctl log of qemu until the crash happens Edit (904.4 KiB, text/plain)

As my other repro-code didn't trigger the issue I looked at qemu again and found that before the failing ioctl->scv call there are plenty other even some very similar (same?) calls that work just fine.

I wonder if on guest setup qemu (or e.g. the rom we load) might set some arch-bits or such which then breaks the next "scv 0" call.

I attached the full ioctl log here.

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-23:

#8

I might be spoiled by the s390x-POP style to define instructions, but in the following doc about the PowerISA unfortunately there is no list of reasons-for-SIGILL. Therefore I'm out of options on this waiting for someone - most likely IBM - to chime in.

https://wiki.raptorcs.com/w/images/f/f5/PowerISA_public.v3.1.pdf

Revision history for this message

Laurent Vivier (laurent-vivier) wrote on 2021-03-23:

#9

You need a kernel with a the following fix for POWER9:

commit 25edcc50d76c834479d11fcc7de46f3da4d95121
Author: Fabiano Rosas <email address hidden>
Date: Thu Feb 4 17:05:17 2021 -0300

KVM: PPC: Book3S HV: Save and restore FSCR in the P9 path

    The Facility Status and Control Register is a privileged SPR that
    defines the availability of some features in problem state. Since it
    can be written by the guest, we must restore it to the previous host
    value after guest exit.

    This restoration is currently done by taking the value from
    current->thread.fscr, which in the P9 path is not enough anymore
    because the guest could context switch the QEMU thread, causing the
    guest-current value to be saved into the thread struct.

    The above situation manifested when running a QEMU linked against a
    libc with System Call Vectored support, which causes scv
    instructions to be run by QEMU early during the guest boot (during
    SLOF), at which point the FSCR is 0 due to guest entry. After a few
    scv calls (1 to a couple hundred), the context switching happens and
    the QEMU thread runs with the guest value, resulting in a Facility
    Unavailable interrupt.

    This patch saves and restores the host value of FSCR in the inner
    guest entry loop in a way independent of current->thread.fscr. The old
    way of doing it is still kept in place because it works for the old
    entry path.

Signed-off-by: Fabiano Rosas <email address hidden>
Signed-off-by: Paul Mackerras <email address hidden>

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2021-03-23: Status changed to Confirmed

#10

This change was made by a bot.

Changed in linux (Ubuntu):
status:	New → Confirmed

Revision history for this message

Frank Heimes (fheimes) wrote on 2021-03-23:

#11

Thx Laurent, I took the hirsute master-next source and cherry-picked the patch and it applied cleanly.
Now I kicked off a kernel build of this patched kernel in the following PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1920784
(however, the builds will take some time to complete)

If it can be proofed that this patched kernel fixes the problem, I can go ahead and work on a patch submission for hirsute/21.04. (kernel freeze is April 8th)

Changed in ubuntu-power-systems:
status:	New → Confirmed
Changed in linux (Ubuntu):
assignee:	nobody → Frank Heimes (fheimes)

Revision history for this message

sadoon albader (sadoonalbader) wrote on 2021-03-23:

#12

The guys on the Fedora side seem to have found the patch to fix this:

https://bugzilla.redhat.com/show_bug.cgi?id=1941652#c6

Apparently it will go upstream in Linux 5.11, but earlier versions also need the fix, specifically 5.9 and 5.10

Thank you!

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-24:

#13

@Sadoon - yes, that is the same fix that Laurent pointed to a few hours before.

@Frank - the kernel I had before was 5.11.0-11-generic (failing). I've tested "5.11.0-13-generic #14~lp1920784" from your PPA and can confirm that this fixes the issue.

Thanks Laurent for identifying the fix and thanks Frank for the kernel.
I'll mark bug tasks accordingly and @Frank you'll let me know if there is anything else you need to drive this to completion.

Changed in qemu:
status:	New → Invalid
Changed in glibc (Ubuntu):
status:	New → Invalid
Changed in qemu (Ubuntu):
status:	Confirmed → Invalid

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2021-03-24:

#14

And gladly this was only added in >=5.9 and we have Groovy (5.8) and Hirsute (5.11) so only the Hirsute kernel is needed to adapt, but further backports are not needed.

Revision history for this message

Frank Heimes (fheimes) wrote on 2021-03-24:

#15

The fix was sent to the kernel teams mailing list:
https://lists.ubuntu.com/archives/kernel-team/2021-March/thread.html#118449

Changed in linux (Ubuntu):
status:	Confirmed → In Progress
Changed in ubuntu-power-systems:
status:	Confirmed → In Progress

Thomas Huth (th-huth) on 2021-03-29

no longer affects:

qemu

Frank Heimes (fheimes) on 2021-03-29

Changed in ubuntu-power-systems:
assignee:	nobody → Ubuntu on IBM Power Systems Bug Triage (ubuntu-power-triage)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-04-13:

#16

Download full text (37.7 KiB)

This bug was fixed in the package linux - 5.11.0-14.15

---------------
linux (5.11.0-14.15) hirsute; urgency=medium

* hirsute/linux: 5.11.0-14.15 -proposed tracker (LP: #1923103)

* Packaging resync (LP: #1786013)
- update dkms package versions

* Include Infiniband Peer Memory interface (LP: #1923104)
- SAUCE: RDMA/core: Introduce peer memory interface

  * Hirsute update: v5.11.12 upstream stable release (LP: #1923069)
    - arm64: mm: correct the inside linear map range during hotplug check
    - virtiofs: Fail dax mount if device does not support it
    - ext4: shrink race window in ext4_should_retry_alloc()
    - ext4: fix bh ref count on error paths
    - fs: nfsd: fix kconfig dependency warning for NFSD_V4
    - rpc: fix NULL dereference on kmalloc failure
    - iomap: Fix negative assignment to unsigned sis->pages in
      iomap_swapfile_activate
    - ASoC: rt1015: fix i2c communication error
    - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
    - ASoC: es8316: Simplify adc_pga_gain_tlv table
    - ASoC: soc-core: Prevent warning if no DMI table is present
    - ASoC: cs42l42: Fix Bitclock polarity inversion
    - ASoC: cs42l42: Fix channel width support
    - ASoC: cs42l42: Fix mixer volume control
    - ASoC: cs42l42: Always wait at least 3ms after reset
    - NFSD: fix error handling in NFSv4.0 callbacks
    - ASoC: mediatek: mt8192: fix tdm out data is valid on rising edge
    - kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing
    - vhost: Fix vhost_vq_reset()
    - io_uring: fix ->flags races by linked timeouts
    - io_uring: halt SQO submission on ctx exit
    - scsi: st: Fix a use after free in st_open()
    - scsi: qla2xxx: Fix broken #endif placement
    - staging: comedi: cb_pcidas: fix request_irq() warn
    - staging: comedi: cb_pcidas64: fix request_irq() warn
    - ASoC: rt5659: Update MCLK rate in set_sysclk()
    - ASoC: rt711: add snd_soc_component remove callback
    - thermal/core: Add NULL pointer check before using cooling device stats
    - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
    - locking/ww_mutex: Fix acquire/release imbalance in
      ww_acquire_init()/ww_acquire_fini()
    - nvmet-tcp: fix kmap leak when data digest in use
    - io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls
    - Revert "PM: ACPI: reboot: Use S5 for reboot"
    - nouveau: Skip unvailable ttm page entries
    - static_call: Align static_call_is_init() patching condition
    - ext4: do not iput inode under running transaction in ext4_rename()
    - io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with
      MSG_WAITALL
    - net: mvpp2: fix interrupt mask/unmask skip condition
    - mptcp: deliver ssk errors to msk
    - mptcp: fix poll after shutdown
    - mptcp: init mptcp request socket earlier
    - mptcp: add a missing retransmission timer scheduling
    - flow_dissector: fix TTL and TOS dissection on IPv4 fragments
    - mptcp: fix DATA_FIN processing f...

This bug was fixed in the package linux - 5.11.0-14.15

---------------
linux (5.11.0-14.15) hirsute; urgency=medium

* hirsute/linux: 5.11.0-14.15 -proposed tracker (LP: #1923103)

* Packaging resync (LP: #1786013)
    - update dkms package versions

* Include Infiniband Peer Memory interface (LP: #1923104)
    - SAUCE: RDMA/core: Introduce peer memory interface

* Hirsute update: v5.11.12 upstream stable release (LP: #1923069)
    - arm64: mm: correct the inside linear map range during hotplug check
    - virtiofs: Fail dax mount if device does not support it
    - ext4: shrink race window in ext4_should_retry_alloc()
    - ext4: fix bh ref count on error paths
    - fs: nfsd: fix kconfig dependency warning for NFSD_V4
    - rpc: fix NULL dereference on kmalloc failure
    - iomap: Fix negative assignment to unsigned sis->pages in
      iomap_swapfile_activate
    - ASoC: rt1015: fix i2c communication error
    - ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
    - ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
    - ASoC: es8316: Simplify adc_pga_gain_tlv table
    - ASoC: soc-core: Prevent warning if no DMI table is present
    - ASoC: cs42l42: Fix Bitclock polarity inversion
    - ASoC: cs42l42: Fix channel width support
    - ASoC: cs42l42: Fix mixer volume control
    - ASoC: cs42l42: Always wait at least 3ms after reset
    - NFSD: fix error handling in NFSv4.0 callbacks
    - ASoC: mediatek: mt8192: fix tdm out data is valid on rising edge
    - kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing
    - vhost: Fix vhost_vq_reset()
    - io_uring: fix ->flags races by linked timeouts
    - io_uring: halt SQO submission on ctx exit
    - scsi: st: Fix a use after free in st_open()
    - scsi: qla2xxx: Fix broken #endif placement
    - staging: comedi: cb_pcidas: fix request_irq() warn
    - staging: comedi: cb_pcidas64: fix request_irq() warn
    - ASoC: rt5659: Update MCLK rate in set_sysclk()
    - ASoC: rt711: add snd_soc_component remove callback
    - thermal/core: Add NULL pointer check before using cooling device stats
    - locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
    - locking/ww_mutex: Fix acquire/release imbalance in
      ww_acquire_init()/ww_acquire_fini()
    - nvmet-tcp: fix kmap leak when data digest in use
    - io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls
    - Revert "PM: ACPI: reboot: Use S5 for reboot"
    - nouveau: Skip unvailable ttm page entries
    - static_call: Align static_call_is_init() patching condition
    - ext4: do not iput inode under running transaction in ext4_rename()
    - io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with
      MSG_WAITALL
    - net: mvpp2: fix interrupt mask/unmask skip condition
    - mptcp: deliver ssk errors to msk
    - mptcp: fix poll after shutdown
    - mptcp: init mptcp request socket earlier
    - mptcp: add a missing retransmission timer scheduling
    - flow_dissector: fix TTL and TOS dissection on IPv4 fragments
    - mptcp: fix DATA_FIN processing for orphaned sockets
    - mptcp: provide subflow aware release function
    - can: dev: move driver related infrastructure into separate subdir
    - net: introduce CAN specific pointer in the struct net_device
    - mptcp: fix race in release_cb
    - net: bonding: fix error return code of bond_neigh_init()
    - mptcp: fix bit MPTCP_PUSH_PENDING tests
    - can: tcan4x5x: fix max register value
    - brcmfmac: clear EAP/association status bits on linkdown events
    - ath11k: add ieee80211_unregister_hw to avoid kernel crash caused by NULL
      pointer
    - netdevsim: dev: Initialize FIB module after debugfs
    - iwlwifi: pcie: don't disable interrupts for reg_lock
    - ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()
    - net: ethernet: aquantia: Handle error cleanup of start on open
    - appletalk: Fix skb allocation size in loopback case
    - net: ipa: remove two unused register definitions
    - net: ipa: use a separate pointer for adjusted GSI memory
    - net: ipa: fix register write command validation
    - net: wan/lmc: unregister device when no matching device is found
    - net: 9p: advance iov on empty read
    - bpf: Remove MTU check in __bpf_skb_max_len
    - ACPI: tables: x86: Reserve memory occupied by ACPI tables
    - ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
    - ACPI: scan: Fix _STA getting called on devices with unmet dependencies
    - ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
    - ALSA: hda: Re-add dropped snd_poewr_change_state() calls
    - ALSA: hda: Add missing sanity checks in PM prepare/complete callbacks
    - ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
    - xtensa: fix uaccess-related livelock in do_page_fault
    - xtensa: move coprocessor_flush to the .text section
    - KVM: SVM: load control fields from VMCB12 before checking them
    - KVM: SVM: ensure that EFER.SVME is set when running nested guest or on
      nested vmexit
    - PM: runtime: Fix race getting/putting suppliers at probe
    - PM: runtime: Fix ordering in pm_runtime_get_suppliers()
    - tracing: Fix stack trace event size
    - s390/vdso: copy tod_steering_delta value to vdso_data page
    - s390/vdso: fix tod_steering_delta type
    - drm/ttm: make ttm_bo_unpin more defensive
    - mm: fix race by making init_zero_pfn() early_initcall
    - drm/amdkfd: dqm fence memory corruption
    - drm/amd/pm: no need to force MCLK to highest when no display connected
    - drm/amdgpu/vangogh: don't check for dpm in is_dpm_running when in suspend
    - drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
    - drm/amdgpu: Set a suitable dev_info.gart_page_size
    - drm/amdgpu: check alignment on CPU page for bo map
    - reiserfs: update reiserfs_xattrs_initialized() condition
    - drm/imx: fix memory leak when fails to init
    - drm/tegra: dc: Restore coupling of display controllers
    - drm/tegra: sor: Grab runtime PM reference across reset
    - vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
    - pinctrl: microchip-sgpio: Fix wrong register offset for IRQ trigger
    - pinctrl: rockchip: fix restore error in resume
    - pinctrl: qcom: sc7280: Fix SDC_QDSD_PINGROUP and UFS_RESET offsets
    - pinctrl: qcom: sc7280: Fix SDC1_RCLK configurations
    - pinctrl: qcom: lpass lpi: use default pullup/strength values
    - pinctrl: qcom: fix unintentional string concatenation
    - extcon: Add stubs for extcon_register_notifier_all() functions
    - extcon: Fix error handling in extcon_dev_register
    - firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
    - powerpc/pseries/mobility: use struct for shared state
    - powerpc/pseries/mobility: handle premature return from H_JOIN
    - usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield
    - video: hyperv_fb: Fix a double free in hvfb_probe
    - powerpc/mm/book3s64: Use the correct storage key value when calling
      H_PROTECT
    - firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
    - usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
    - USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
    - usb: musb: Fix suspend with devices connected for a64
    - usb: xhci-mtk: fix broken streams issue on 0.96 xHCI
    - cdc-acm: fix BREAK rx code path adding necessary calls
    - USB: cdc-acm: untangle a circular dependency between callback and softint
    - USB: cdc-acm: downgrade message to debug
    - USB: cdc-acm: fix double free on probe failure
    - USB: cdc-acm: fix use-after-free after probe failure
    - usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
    - usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board.
    - usb: dwc2: Prevent core suspend when port connection flag is 0
    - usb: dwc3: qcom: skip interconnect init for ACPI probe
    - usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
    - soc: qcom-geni-se: Cleanup the code to remove proxy votes
    - staging: rtl8192e: Fix incorrect source in memcpy()
    - staging: rtl8192e: Change state information from u16 to u8
    - driver core: clear deferred probe reason on probe retry
    - drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
    - riscv: evaluate put_user() arg before enabling user access
    - io_uring: do ctx sqd ejection in a clear context
    - Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for
      freezing"
    - Revert "net: bonding: fix error return code of bond_neigh_init()"
    - Linux 5.11.12
    - [Config] set CONFIG_AD9467=n and CONFIG_ADI_AXI_ADC=n for amd64

* CVE-2021-29154
    - SAUCE: bpf, x86: Validate computation of branch displacements for x86-64
    - SAUCE: bpf, x86: Validate computation of branch displacements for x86-32

* Update - Fix no screen show on display after S3 on CML-R  (LP: #1922768)
    - drm/i915/gen9bc: Handle TGP PCH during suspend/resume

* Hirsute update: v5.11.11 upstream stable release (LP: #1922601)
    - mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
    - mt76: mt7915: only modify tx buffer list after allocating tx token id
    - net: stmmac: fix dma physical address of descriptor when display ring
    - net: fec: ptp: avoid register access when ipg clock is disabled
    - powerpc/4xx: Fix build errors from mfdcr()
    - atm: eni: dont release is never initialized
    - atm: lanai: dont run lanai_dev_close if not open
    - Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
    - ALSA: hda: ignore invalid NHLT table
    - ixgbe: Fix memleak in ixgbe_configure_clsu32
    - scsi: ufs: ufs-qcom: Disable interrupt in reset path
    - blk-cgroup: Fix the recursive blkg rwstat
    - net: tehuti: fix error return code in bdx_probe()
    - net: intel: iavf: fix error return code of iavf_init_get_resources()
    - sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
    - gianfar: fix jumbo packets+napi+rx overrun crash
    - cifs: ask for more credit on async read/write code paths
    - gfs2: fix use-after-free in trans_drain
    - cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
    - gpiolib: acpi: Add missing IRQF_ONESHOT
    - nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
    - NFS: Correct size calculation for create reply length
    - net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch()
    - net: wan: fix error return code of uhdlc_init()
    - net: davicom: Use platform_get_irq_optional()
    - net: enetc: set MAC RX FIFO to recommended value
    - atm: uPD98402: fix incorrect allocation
    - atm: idt77252: fix null-ptr-dereference
    - cifs: change noisy error message to FYI
    - irqchip/ingenic: Add support for the JZ4760
    - kbuild: add image_name to no-sync-config-targets
    - kbuild: dummy-tools: fix inverted tests for gcc
    - umem: fix error return code in mm_pci_probe()
    - sparc64: Fix opcode filtering in handling of no fault loads
    - habanalabs: Call put_pid() when releasing control device
    - habanalabs: Disable file operations after device is removed
    - staging: rtl8192e: fix kconfig dependency on CRYPTO
    - u64_stats,lockdep: Fix u64_stats_init() vs lockdep
    - kselftest: arm64: Fix exit code of sve-ptrace
    - regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck
    - regulator: qcom-rpmh: Use correct buck for S1C regulator
    - block: Fix REQ_OP_ZONE_RESET_ALL handling
    - drm/amd/display: Enable pflip interrupt upon pipe enable
    - drm/amd/display: Revert dram_clock_change_latency for DCN2.1
    - drm/amd/display: Enabled pipe harvesting in dcn30
    - drm/amdgpu/display: Use wm_table.entries for dcn301 calculate_wm
    - drm/amdgpu: fb BO should be ttm_bo_type_device
    - drm/radeon: fix AGP dependency
    - nvme: simplify error logic in nvme_validate_ns()
    - nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
    - nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
    - nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
    - nvme-core: check ctrl css before setting up zns
    - nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
    - nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
    - nfs: we don't support removing system.nfs4_acl
    - block: Suppress uevent for hidden device when removed
    - io_uring: cancel deferred requests in try_cancel
    - mm/fork: clear PASID for new mm
    - ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
    - ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
    - static_call: Pull some static_call declarations to the type headers
    - static_call: Allow module use without exposing static_call_key
    - static_call: Fix the module key fixup
    - static_call: Fix static_call_set_init()
    - KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish
    - btrfs: do not initialize dev stats if we have no dev_root
    - btrfs: do not initialize dev replace for bad dev root
    - btrfs: fix check_data_csum() error message for direct I/O
    - btrfs: initialize device::fs_info always
    - btrfs: fix sleep while in non-sleep context during qgroup removal
    - btrfs: fix subvolume/snapshot deletion not triggered on mount
    - selinux: don't log MAC_POLICY_LOAD record on failed policy load
    - selinux: fix variable scope issue in live sidtab conversion
    - netsec: restore phy power state after controller reset
    - platform/x86: intel-vbtn: Stop reporting SW_DOCK events
    - psample: Fix user API breakage
    - z3fold: prevent reclaim/free race for headless pages
    - squashfs: fix inode lookup sanity checks
    - squashfs: fix xattr id and id lookup sanity checks
    - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
    - kasan: fix per-page tags for non-page_alloc pages
    - gcov: fix clang-11+ support
    - mm/highmem: fix CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP
    - ACPI: video: Add missing callback back for Sony VPCEH3U1E
    - ACPICA: Always create namespace nodes using acpi_ns_create_node()
    - arm64: stacktrace: don't trace arch_stack_walk()
    - arm64: dts: ls1046a: mark crypto engine dma coherent
    - arm64: dts: ls1012a: mark crypto engine dma coherent
    - arm64: dts: ls1043a: mark crypto engine dma coherent
    - ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C
    - ARM: dts: at91: sam9x60: fix mux-mask to match product's datasheet
    - ARM: dts: at91-sama5d27_som1: fix phy address to 7
    - integrity: double check iint_cache was initialized
    - drm/nouveau/kms/nve4-nv108: Limit cursors to 128x128
    - drm/etnaviv: Use FOLL_FORCE for userptr
    - drm/amd/pm: workaround for audio noise issue
    - drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x
    - drm/amdgpu: fix the hibernation suspend with s0ix
    - drm/amdgpu: Add additional Sienna Cichlid PCI ID
    - drm/i915/dsc: fix DSS CTL register usage for ICL DSI transcoders
    - drm/i915: Fix the GT fence revocation runtime PM logic
    - dm verity: fix DM_VERITY_OPTS_MAX value
    - dm: don't report "detected capacity change" on device creation
    - dm ioctl: fix out of bounds array access when no devices
    - bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
    - soc: ti: omap-prm: Fix reboot issue with invalid pcie reset map for dra7
    - ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data
    - soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva
    - veth: Store queue_mapping independently of XDP prog presence
    - bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
    - bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
    - libbpf: Fix INSTALL flag order
    - net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
    - net/mlx5e: Set PTP channel pointer explicitly to NULL
    - net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
    - net/mlx5e: Revert parameters on errors when changing PTP state without reset
    - net/mlx5e: Don't match on Geneve options in case option masks are all zero
    - net/mlx5e: E-switch, Fix rate calculation division
    - ipv6: fix suspecious RCU usage warning
    - drop_monitor: Perform cleanup upon probe registration failure
    - macvlan: macvlan_count_rx() needs to be aware of preemption
    - net: sched: validate stab values
    - net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
    - igc: reinit_locked() should be called with rtnl_lock
    - igc: Fix Pause Frame Advertising
    - igc: Fix Supported Pause Frame Link Setting
    - igc: Fix igc_ptp_rx_pktstamp()
    - e1000e: add rtnl_lock() to e1000_reset_task
    - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
    - kunit: tool: Disable PAGE_POISONING under --alltests
    - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
    - net: phy: broadcom: Add power down exit reset state delay
    - ice: fix napi work done reporting in xsk path
    - ftgmac100: Restart MAC HW once
    - clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk
    - net: ipa: terminate message handler arrays
    - net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
    - flow_dissector: fix byteorder of dissected ICMP ID
    - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed
    - netfilter: ctnetlink: fix dump of the expect mask attribute
    - net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx"
    - net: phylink: Fix phylink_err() function name error in phylink_major_config
    - tipc: better validate user input in tipc_nl_retrieve_key()
    - tcp: relookup sock for RST+ACK packets handled by obsolete req sock
    - mptcp: fix ADD_ADDR HMAC in case port is specified
    - can: isotp: isotp_setsockopt(): only allow to set low level TX flags for
      CAN-FD
    - can: isotp: TX-path: ensure that CAN frame flags are initialized
    - can: peak_usb: add forgotten supported devices
    - can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
    - can: kvaser_pciefd: Always disable bus load reporting
    - can: c_can_pci: c_can_pci_remove(): fix use-after-free
    - can: c_can: move runtime PM enable/disable to c_can_platform
    - can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
    - can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors
    - mac80211: fix rate mask reset
    - mac80211: Allow HE operation to be longer than expected.
    - selftests/net: fix warnings on reuseaddr_ports_exhausted
    - nfp: flower: fix unsupported pre_tunnel flows
    - nfp: flower: add ipv6 bit to pre_tunnel control message
    - nfp: flower: fix pre_tun mask id allocation
    - ftrace: Fix modify_ftrace_direct.
    - drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
    - ionic: linearize tso skb with too many frags
    - net/sched: cls_flower: fix only mask bit check in the validate_ct_state
    - netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
    - netfilter: nftables: allow to update flowtable flags
    - netfilter: flowtable: Make sure GC works periodically in idle system
    - libbpf: Fix error path in bpf_object__elf_init()
    - libbpf: Use SOCK_CLOEXEC when opening the netlink socket
    - ARM: dts: imx6ull: fix ubi filesystem mount failed
    - ipv6: weaken the v4mapped source check
    - octeontx2-af: Formatting debugfs entry rsrc_alloc.
    - octeontx2-af: Remove TOS field from MKEX TX
    - octeontx2-af: Fix irq free in rvu teardown
    - octeontx2-pf: Clear RSS enable flag on interace down
    - octeontx2-af: fix infinite loop in unmapping NPC counter
    - net: check all name nodes in __dev_alloc_name
    - net: cdc-phonet: fix data-interface release on probe failure
    - igb: check timestamp validity
    - sctp: move sk_route_caps check and set into sctp_outq_flush_transports
    - r8152: limit the RX buffer size of RTL8153A for USB 2.0
    - net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
    - selinux: vsock: Set SID for socket returned by accept()
    - selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value
    - libbpf: Fix BTF dump of pointer-to-array-of-struct
    - bpf: Fix umd memory leak in copy_process()
    - can: isotp: tx-path: zero initialize outgoing CAN frames
    - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister
      twice
    - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit
    - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes()
      multiple times
    - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called
      twice on init_bios_attributes() failure
    - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling
    - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the
      interfaces are not found
    - drm/msm: fix shutdown hook in case GPU components failed to bind
    - drm/msm: Fix suspend/resume on i.MX5
    - arm64: kdump: update ppos when reading elfcorehdr
    - PM: runtime: Defer suspending suppliers
    - net/mlx5: Add back multicast stats for uplink representor
    - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
    - net/mlx5e: Offload tuple rewrite for non-CT flows
    - net/mlx5e: Fix error path for ethtool set-priv-flag
    - mfd: intel_quark_i2c_gpio: Revert "Constify static struct resources"
    - PM: EM: postpone creating the debugfs dir till fs_initcall
    - platform/x86: intel_pmt_crashlog: Fix incorrect macros
    - net: bridge: don't notify switchdev for local FDB addresses
    - octeontx2-af: Fix memory leak of object buf
    - xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG
    - RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening
      server
    - mm: memblock: fix section mismatch warning again
    - bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs
    - net: Consolidate common blackhole dst ops
    - net, bpf: Fix ip6ip6 crash with collect_md populated skbs
    - igb: avoid premature Rx buffer reuse
    - net: axienet: Fix probe error cleanup
    - net: phy: introduce phydev->port
    - net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
    - net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S
    - net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
    - Revert "netfilter: x_tables: Switch synchronization to RCU"
    - netfilter: x_tables: Use correct memory barriers.
    - bpf: Fix fexit trampoline.
    - bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for
      BPF_TRAMP_F_CALL_ORIG
    - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files()
    - dm table: Fix zoned model check and zone sectors check
    - mm/mmu_notifiers: ensure range_end() is paired with range_start()
    - Revert "netfilter: x_tables: Update remaining dereference to RCU"
    - ACPI: scan: Rearrange memory allocation in acpi_device_add()
    - ACPI: scan: Use unique number for instance_no
    - perf auxtrace: Fix auxtrace queue conflict
    - perf synthetic events: Avoid write of uninitialized memory when generating
      PERF_RECORD_MMAP* records
    - io_uring: fix provide_buffers sign extension
    - block: recalculate segment count for multi-segment discards correctly
    - scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
    - scsi: qedi: Fix error return code of qedi_alloc_global_queues()
    - scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
    - smb3: fix cached file size problems in duplicate extents (reflink)
    - cifs: Adjust key sizes and key generation routines for AES256 encryption
    - locking/mutex: Fix non debug version of mutex_lock_io_nested()
    - x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
    - fs/cachefiles: Remove wait_bit_key layout dependency
    - ch_ktls: fix enum-conversion warning
    - can: dev: Move device back to init netns on owning netns delete
    - r8169: fix DMA being used after buffer free if WoL is enabled
    - net: dsa: b53: VLAN filtering is global to all users
    - mac80211: fix double free in ibss_leave
    - ext4: add reclaim checks to xattr code
    - fs/ext4: fix integer overflow in s_log_groups_per_flex
    - Revert "xen: fix p2m size in dom0 for disabled memory hotplug case"
    - nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
    - can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
    - selftest/bpf: Add a test to check trampoline freeing logic.
    - xen-blkback: don't leak persistent grants from xen_blkbk_map()
    - Linux 5.11.11
    - [Config] Update configs for rename of XEN_BALLOON_MEMORY_HOTPLUG_LIMIT to
      XEN_MEMORY_HOTPLUG_LIMIT

* Hirsute update: v5.11.10 upstream stable release (LP: #1922600)
    - Revert "drm/ttm: make ttm_bo_unpin more defensive"
    - Revert "drm/ttm: Warn on pinning without holding a reference"
    - Linux 5.11.10

* [FEATURE] Hirsute: support TLS device offload for Bond (LP: #1915717)
    - net: netdevice: Add operation ndo_sk_get_lower_dev
    - net/bonding: Take IP hash logic into a helper
    - net/bonding: Implement ndo_sk_get_lower_dev
    - net/bonding: Take update_features call out of XFRM funciton
    - net/bonding: Implement TLS TX device offload
    - net/bonding: Declare TLS RX device offload support
    - net/tls: Device offload to use lowest netdevice in chain
    - net/tls: Except bond interface from some TLS checks

* i915 doesn't support some high pixel clock 4k * 60Hz monitors (LP: #1922372)
    - drm/i915/vbt: update DP max link rate table

* cold boot panics on unmatched board, soft reboot is fine (LP: #1920916)
    - Revert "RISC-V: sifive_l2_cache: Update L2 cache driver to support SiFive
      FU740"
    - Revert "RISC-V: Update l2 cache DT documentation to add support for SiFive
      FU740"
    - Revert "dt-bindings: riscv: Update DT binding docs to support SiFive FU740
      SoC"
    - dt-bindings: riscv: Update l2 cache DT documentation to add support for
      SiFive FU740
    - RISC-V: sifive_l2_cache: Update L2 cache driver to support SiFive FU740
    - dt-bindings: riscv: Update DT binding docs to support SiFive FU740 SoC
    - dt-bindings: pwm: Update DT binding docs to support SiFive FU740 SoC
    - dt-bindings: gpio: Update DT binding docs to support SiFive FU740 SoC

* Microphone and Mute/Mic-mute LEDs are not work on HP 640 G8 Laptop
    (LP: #1922207)
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 640 G8

* Enable ath11k debugfs/tracing (LP: #1922033)
    - [Config] enable ath11k debugfs/tracing

* Handle Intel Wifi firmware disconnection (LP: #1922171)
    - iwlwifi: mvm: handle CCA-EXT delay firmware notification

* LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
    (LP: #1918134)
    - [Packaging] convert to v4 autogen form -- pull back updated dkms-build
      family

* [21.04 FEAT] Add kernel debug infos for decompressor stage to kernel-debug
    package (LP: #1905020)
    - [Debian] include decompressor binary in dbginfo packages

* qemu-system-ppc64le fails with kvm acceleration (LP: #1920784)
    - KVM: PPC: Book3S HV: Save and restore FSCR in the P9 path

* Fix mic on P620 after S3 resume (LP: #1921757)
    - ALSA: usb-audio: Carve out connector value checking into a helper
    - ALSA: usb-audio: Check connector value on resume

* [Regression] Partition not removed after removing the memory cards from card
    reader since kernel 5.9.0-rc3+ (LP: #1920874)
    - block: clear GD_NEED_PART_SCAN later in bdev_disk_changed

* Tegra "mmc0: Timeout waiting for hardware interrupt" (LP: #1921140)
    - SAUCE: mmc: host: Add required callbacks to set/clear CQE_EN bit

* Bcache bypasse writeback on caching device with fragmentation (LP: #1900438)
    - bcache: consider the fragmentation when update the writeback rate

* alsa/realtek: extend the delay time in the  determine_headset_type for a
    Dell AIO (LP: #1920747)
    - SAUCE: ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO

* Hirsute update: v5.11.9 upstream stable release (LP: #1921712)
    - ASoC: ak4458: Add MODULE_DEVICE_TABLE
    - ASoC: ak5558: Add MODULE_DEVICE_TABLE
    - spi: cadence: set cqspi to the driver_data field of struct device
    - ALSA: dice: fix null pointer dereference when node is disconnected
    - ALSA: hda/realtek: apply pin quirk for XiaomiNotebook Pro
    - ALSA: hda: generic: Fix the micmute led init state
    - ALSA: hda/realtek: Apply headset-mic quirks for Xiaomi Redmibook Air
    - Revert "PM: runtime: Update device status before letting suppliers suspend"
    - s390/vtime: fix increased steal time accounting
    - s390/pci: refactor zpci_create_device()
    - s390/pci: remove superfluous zdev->zbus check
    - s390/pci: fix leak of PCI device structure
    - zonefs: Fix O_APPEND async write handling
    - zonefs: prevent use of seq files as swap file
    - zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone()
    - btrfs: fix race when cloning extent buffer during rewind of an old root
    - btrfs: fix slab cache flags for free space tree bitmap
    - vhost-vdpa: fix use-after-free of v->config_ctx
    - vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails
    - drm/amd/display: Copy over soc values before bounding box creation
    - drm/amd/display: Correct algorithm for reversed gamma
    - drm/amd/display: Remove MPC gamut remap logic for DCN30
    - iommu/amd: Don't call early_amd_iommu_init() when AMD IOMMU is disabled
    - iommu/amd: Keep track of amd_iommu_irq_remap state
    - iommu/amd: Move Stoney Ridge check to detect_ivrs()
    - ASoC: fsl_ssi: Fix TDM slot setup for I2S mode
    - ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 10-p0XX OVCD current threshold
    - ASoC: SOF: Intel: unregister DMIC device on probe error
    - ASoC: SOF: intel: fix wrong poll bits in dsp power down
    - ASoC: qcom: sdm845: Fix array out of bounds access
    - ASoC: qcom: sdm845: Fix array out of range on rx slim channels
    - ASoC: codecs: wcd934x: add a sanity check in set channel map
    - ASoC: qcom: lpass-cpu: Fix lpass dai ids parse
    - ASoC: simple-card-utils: Do not handle device clock
    - afs: Fix accessing YFS xattrs on a non-YFS server
    - afs: Stop listxattr() from listing "afs.*" attributes
    - ALSA: usb-audio: Fix unintentional sign extension issue
    - nvme: fix Write Zeroes limitations
    - nvme-tcp: fix misuse of __smp_processor_id with preemption enabled
    - nvme-tcp: fix possible hang when failing to set io queues
    - nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU
    - nvmet: don't check iosqes,iocqes for discovery controllers
    - nfsd: Don't keep looking up unhashed files in the nfsd file cache
    - nfsd: don't abort copies early
    - NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
    - NFSD: fix dest to src mount in inter-server COPY
    - svcrdma: disable timeouts on rdma backchannel
    - vfio: IOMMU_API should be selected
    - vhost_vdpa: fix the missing irq_bypass_unregister_producer() invocation
    - sunrpc: fix refcount leak for rpc auth modules
    - i915/perf: Start hrtimer only if sampling the OA buffer
    - iommu/tegra-smmu: Make tegra_smmu_probe_device() to handle all IOMMU
      phandles
    - pstore: Fix warning in pstore_kill_sb()
    - io_uring: ensure that SQPOLL thread is started for exit
    - net/qrtr: fix __netdev_alloc_skb call
    - kbuild: Fix <linux/version.h> for empty SUBLEVEL or PATCHLEVEL again
    - cifs: warn and fail if trying to use rootfs without the config option
    - cifs: fix allocation size on newly created files
    - RISC-V: Fix out-of-bounds accesses in init_resources()
    - riscv: Correct SPARSEMEM configuration
    - scsi: lpfc: Fix some error codes in debugfs
    - scsi: myrs: Fix a double free in myrs_cleanup()
    - scsi: ufs: ufs-mediatek: Correct operator & -> &&
    - scsi: mpt3sas: Do not use GFP_KERNEL in atomic context
    - RISC-V: correct enum sbi_ext_rfence_fid
    - counter: stm32-timer-cnt: Report count function when SLAVE_MODE_DISABLED
    - ASoC: codecs: lpass-va-macro: mute/unmute all active decimators
    - ASoC: codecs: lpass-wsa-macro: fix RX MIX input controls
    - powerpc/vdso32: Add missing _restgpr_31_x to fix build failure
    - drm/ttm: Warn on pinning without holding a reference
    - drm/ttm: make ttm_bo_unpin more defensive
    - gpiolib: Assign fwnode to parent's if no primary one provided
    - nvme-rdma: fix possible hang when failing to set io queues
    - powerpc: Force inlining of cpu_has_feature() to avoid build failure
    - usb-storage: Add quirk to defeat Kindle's automatic unload
    - usbip: Fix incorrect double assignment to udc->ud.tcp_rx
    - usb: gadget: configfs: Fix KASAN use-after-free
    - usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct
    - usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-
    - usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
    - usb: dwc3: gadget: Prevent EP queuing while stopping transfers
    - thunderbolt: Initialize HopID IDAs in tb_switch_alloc()
    - thunderbolt: Increase runtime PM reference count on DP tunnel discovery
    - iio:adc:stm32-adc: Add HAS_IOMEM dependency
    - iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel
    - iio: adis16400: Fix an error code in adis16400_initial_setup()
    - iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
    - iio: adc: ab8500-gpadc: Fix off by 10 to 3
    - iio: adc: ad7949: fix wrong ADC result due to incorrect bit mask
    - iio: adc: adi-axi-adc: add proper Kconfig dependencies
    - iio: hid-sensor-humidity: Fix alignment issue of timestamp channel
    - iio: hid-sensor-prox: Fix scale not correct issue
    - iio: hid-sensor-temperature: Fix issues of timestamp channel
    - counter: stm32-timer-cnt: fix ceiling write max value
    - counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register
    - PCI: rpadlpar: Fix potential drc_name corruption in store functions
    - perf/x86/intel: Fix a crash caused by zero PEBS status
    - perf/x86/intel: Fix unchecked MSR access error caused by VLBR_EVENT
    - x86/ioapic: Ignore IRQ2 again
    - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
    - x86: Move TS_COMPAT back to asm/thread_info.h
    - x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
    - efivars: respect EFI_UNSUPPORTED return from firmware
    - ext4: fix error handling in ext4_end_enable_verity()
    - ext4: find old entry again if failed to rename whiteout
    - ext4: stop inode update before return
    - ext4: do not try to set xattr into ea_inode if value is empty
    - ext4: fix potential error in ext4_do_update_inode
    - ext4: fix timer use-after-free on failed mount
    - ext4: fix rename whiteout with fast commit
    - MAINTAINERS: move some real subsystems off of the staging mailing list
    - MAINTAINERS: move the staging subsystem to lists.linux.dev
    - static_call: Fix static_call_update() sanity check
    - efi: use 32-bit alignment for efi_guid_t literals
    - firmware/efi: Fix a use after bug in efi_mem_reserve_persistent
    - genirq: Disable interrupts for force threaded handlers
    - x86/apic/of: Fix CPU devicetree-node lookups
    - cifs: Fix preauth hash corruption
    - Linux 5.11.9

* Hirsute update: v5.11.8 upstream stable release (LP: #1921710)
    - io_uring: don't attempt IO reissue from the ring exit path
    - KVM: x86/mmu: Expand on the comment in kvm_vcpu_ad_need_write_protect()
    - KVM: x86/mmu: Set SPTE_AD_WRPROT_ONLY_MASK if and only if PML is enabled
    - mptcp: send ack for every add_addr
    - mptcp: pm: add lockdep assertions
    - mptcp: dispose initial struct socket when its subflow is closed
    - io_uring: refactor scheduling in io_cqring_wait
    - io_uring: refactor io_cqring_wait
    - io_uring: don't keep looping for more events if we can't flush overflow
    - io_uring: simplify do_read return parsing
    - io_uring: clear IOCB_WAITQ for non -EIOCBQUEUED return
    - regulator: pca9450: Add SD_VSEL GPIO for LDO5
    - regulator: pca9450: Enable system reset on WDOG_B assertion
    - regulator: pca9450: Clear PRESET_EN bit to fix BUCK1/2/3 voltage setting
    - gfs2: Add common helper for holding and releasing the freeze glock
    - gfs2: move freeze glock outside the make_fs_rw and _ro functions
    - gfs2: bypass signal_our_withdraw if no journal
    - bpf: Simplify alu_limit masking for pointer arithmetic
    - bpf: Add sanity check for upper ptr_limit
    - arm64: Unconditionally set virtual cpu id registers
    - RDMA/srp: Fix support for unpopulated and unbalanced NUMA nodes
    - fuse: fix live lock in fuse_iget()
    - Revert "nfsd4: remove check_conflicting_opens warning"
    - Revert "nfsd4: a client's own opens needn't prevent delegations"
    - net: dsa: b53: Support setting learning on port
    - crypto: x86/aes-ni-xts - use direct calls to and 4-way stride
    - Linux 5.11.8

* Hirsute update: v5.11.7 upstream stable release (LP: #1919492)
    - ethernet: alx: fix order of calls on resume

* Mute/Mic-mute LEDs are not work on HP 850/840/440 G8 Laptops (LP: #1920030)
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 840 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 440 G8
    - ALSA: hda/realtek: fix mute/micmute LEDs for HP 850 G8

* power off stress test will hang on the TGL machines (LP: #1919930)
    - [Config] set SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1 to n
    - ASoC: SOF: add .shutdown() callback to snd_sof_dsp_ops
    - ASoC: SOF: add snd_sof_device_shutdown() helper for shutdown
    - ASoC: SOF: sof-pci-dev: add .shutdown() callback
    - ASoC: SOF: Intel: tgl: do thorough remove at .shutdown() callback
    - SAUCE: ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown

* Miscellaneous Ubuntu changes
    - [Config] arm64 -- unify build_image and kernel_file values
    - SAUCE: apparmor: Fix build error, make sk parameter const
    - SAUCE: xr-usb-serial: clean up indentation
    - SAUCE: xr-usb-serial: clean up build warnings

-- Seth Forshee <seth.forshee@canonical.com>  Thu, 08 Apr 2021 15:48:19 -0500

Changed in linux (Ubuntu Hirsute):
status:	In Progress → Fix Released

Frank Heimes (fheimes) on 2021-04-13

Changed in ubuntu-power-systems:
status:	In Progress → Fix Released

Frank Heimes (fheimes) on 2021-04-14

no longer affects:	qemu (Ubuntu Hirsute)
no longer affects:	qemu (Ubuntu)
no longer affects:	glibc (Ubuntu Hirsute)
no longer affects:	glibc (Ubuntu)

The Ubuntu-power-systems project

qemu-system-ppc64le fails with kvm acceleration

Bug Description

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
The Ubuntu-power-systems project	Fix Released	Undecided	Ubuntu on IBM Power Systems Bug Triage
linux (Ubuntu)	Fix Released	Undecided	Frank Heimes
Hirsute	Fix Released	Undecided	Frank Heimes