# changelog

author: hanliyang<hanliyang@hygon.cn> - 202308-25
changelog:
  - Build OVMF.fd using AmdSevX64.dsc to support Full Disk Encryption
  - Add build process that uses OvmfPkg/AmdSev/AmdSevX64.dsc
  - Fix boot failure on OvmfPkg/AmdSev
  - Build OVMF without '-D SECURE_BOOT_ENABLE=TRUE' for X64


author: wangkai <13474090681@163.com> - 128.11.0-1
changelog:
  - Update to 128.11.0
  - Fix MFSA-TMP-2025-0001: Double-free in libvpx encoder
  - Fix CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269


author: wangkai <13474090681@163.com> - 128.13.0-1
changelog:
  - Update to 128.13.0
  - Fix CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032
    CVE-2025-8033 CVE-2025-8034 CVE-2025-8035


author: wangkai <13474090681@163.com> - 140.3.1-1
changelog:
  - Update to 140.3.1
  - Fix CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533
    CVE-2025-10536 CVE-2025-10537 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184
    CVE-2025-8036 CVE-2025-8037 CVE-2025-8038 CVE-2025-8039 CVE-2025-8040


author: Funda Wang <fundawang@yeah.net> - 140.4.0-1
changelog:
  - update to 140.4.0
  - fix CVE-2025-11708, CVE-2025-11709, CVE-2025-11710, CVE-2025-11711,
    CVE-2025-11712, CVE-2025-11713, CVE-2025-11714, CVE-2025-11715


author: liuchao <liuchao173@huawei.com> - 14.1-1
changelog:
  - upgrade GDB version to 14.1:
    - GDB no longer support AiX 4.x, 5.x and 6.x. The minimum version supported is AiX 7.1.
    - GDB/MI version 1 support has been removed
    - Initial built-in support for Debugger Adapter Protocol (DAP)
    - GDB now recognizes the NO_COLOR environment variable
    - Initial support for integer types larger than 64 bits
    - Breakpoints can now be inferior-specific
    - New convenience function "$_shell", to execute a shell command and return its result.
    - Python support
    - Support for enabling or disabling individual remote target features
    - New 'no-history' stop reason
    - Support for inferior-specific breakpoints
    - The bkpt tuple, which appears in breakpoint-created notifications, and in the result of the -break-insert command can now include an optional 'inferior' field for both the main breakpoint, and each location, when the breakpoint is inferior-specific.
    - Trying to create a thread-specific breakpoint using a non-existent thread ID now results in an error
    - New "simple-values-ref-types" -list-feature value indicating how the --simple-values option in various commands take reference types into account.
    - Initial support for Scalable Matrix Extension (SME) and for Scalable Matrix Extension 2 (SME2)
    - The 'org.gnu.gdb.aarch64.pauth' Pointer Authentication feature is now deprecated in favor of the 'org.gnu.gdb.aarch64.pauth_v2' feature string
    - Support for the Ada 2022 target name symbol ('@')
    - Support for the The Ada 2022 'Enum_Rep and 'Enum_Val attributes
    - The 'list' command now accepts '.' as an argument, telling GDB to print the location around the point of execution within the current frame
    - New '%V' output format for printf and dprintf commands.
    - The printf command now limits the size of strings fetched from the inferior to the value of the 'max-value-size' setting.
    - Support for extending at configure time the default value of the 'debug-file-directory' GDB parameter via the new --additional-debug-dirs=PATHs configure option.
    - New command "info main"
    - New command "set tui mouse-events [on|off]" (on by default)
    - New command "set always-read-ctf on|off" (off by default)
    - Various new debug and maitenance commands


author: Li Nan <linan122@huawei.com> - 6.6.0-105.0.0.111
changelog:
  - !17513  sched-ebpf-add-for-exec-init
  - !17487  arm64/mpam: Support partial-core boot for MPAM
  - !16844  LeapIOraid: add device and support fw log
  - sched/bpf: Fix kabi breakage for including sched bpf header file
  - sched/ebpf: Add kfunc to set the preferred NUMA node for the task
  - sched/ebpf: Add bpf_sched_cfs_exec_set_cpumask hook
  - !17512  CVE-2025-21868
  - !17498  sched: Support NUMA parallel scheduling for multiple processes
  - !17508  Huawei iBMA: Added support for Hi1712 Chip
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
  - net: use __GENKSYMS__ to revert the kabi change
  - net: allow small head cache usage with large MAX_SKB_FRAGS values
  - Huawei iBMA: Added support for Hi1712 Chip
  - !17501 net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix the division by zero issue
  - net: hibmcge: fix the np_link_fail error reporting issue
  - !17459 ROH: fix variable type inconsistency issue
  - sched: Support NUMA parallel scheduling for multiple processes
  - !17183  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - !17180  atm: Fix NULL pointer dereference
  - !16807 Support RME feature for CCA host
  - !17488  arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Support partial-core boot for MPAM
  - !17440  sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - VirtCCA: Compatible with virtcca macro definitions
  - CCA: Fix cca kabi conflict
  - VirtCCA: Modify openeuler_defconfig
  - Reapply "VirtCCA: cvm support UEFI boot"
  - VirtCCA: Adapt virtcca operations by cca_base.
  - VirtCCA: Adapt realm operations by cca_base.
  - VirtCCA: Add CCA base operations.
  - [v8-43-43]KVM: arm64: Allow activating realms
  - [v8-42-43]KVM: arm64: Expose KVM_ARM_VCPU_REC to user space
  - [v8-40-43]arm64: RME: Provide accurate register list
  - [v8-39-43]arm64: RME: Provide register list for unfinalized RME RECs
  - [v8-38-43]rm64: RME: Configure max SVE vector length for a Realm
  - [v8-37-43]arm64: RME: Propagate max SVE vector length from RMM
  - [v8-36-43]arm64: RME: Initialize PMCR.N with number counter supported by RMM
  - [v8-35-43]arm64: RME: Set breakpoint parameters through  SET_ONE_REG
  - [v8-34-43]arm64: RME: Propagate number of breakpoints and watchpoints to userspace
  - [v8-33-43]arm64: RME: Hide KVM_CAP_READONLY_MEM for realm guests
  - [v8-32-43]arm64: rme: Enable PMU support with a realm guest
  - [backport]KVM: arm64: PMU: Introduce helpers to set the guest's PMU
  - [backport]KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest
  - !17463  crypto: hisilicon/qm - clear the memory before enabling the device
  - [backport]KVM: arm64: PMU: Set PMCR_EL0.N for vCPU  based  on the  associated PMU
  - [v8-31-43]arm_pmu: Provide a mechanism for disabling the physical  IRQ
  - [v8-30-43]arm64: RME: Prevent Device mappings for Realms
  - [v8-29-43]arm64: RME: Always use 4k pages for realms
  - [v8-28-43]arm64: RME: Allow checking SVE on VM instance
  - [v8-27-43]arm64: RME: support RSI_HOST_CALL
  - [v8-26-43]arm64: RME: allow userspace to inject aborts
  - [v8-25-43]arm64: Don't expose stolen time for realm guests
  - [v8-24-43]KVM: arm64: WARN on injected undef exceptions
  - [v8-23-43]KVM: arm64: Handle Realm PSCI requests
  - [v8-22-43]KVM: arm64: Validate register access for a Realm VM
  - [v8-21-43]KVM: arm64: Handle realm VCPU load
  - [v8-20-43]arm64: RME: Runtime faulting of memory
  - [backport]KVM: arm64: Move pagetable definitions to common header
  - [backport]rme: populate guest memory region without guest_memfd
  - [v8-19-43]arm64: RME: Allow populating initial contents
  - [v8-18-43]KVM: arm64: Handle realm MMIO emulation
  - [v8-17-43]arm64: RME: Handle RMI_EXIT_RIPAS_CHANGE
  - [v8-16-43]arm64: RME: Handle realm enter/exit
  - [v8-15-43]arm64: RME: Allow VMM to set RIPAS
  - [backport]KVM: Add member to struct kvm_gfn_range to indicate private/shared
  - [v8-14-43]KVM: arm64: Support timers in realm RECs
  - [v8-13-43]arm64: RME: Support for the VGIC in realms
  - [backport]KVM: arm64: Force GICv3 trap activation when no irqchip  is configured on VHE
  - [v8-12-43]KVM: arm64: vgic: Provide helper for number of list registers
  - [v8-11-43]arm64: RME: Allocate/free RECs to match vCPUs
  - [backport]KVM: arm64: Add generic check for system-supported vCPU features
  - !17467  arm-smmu-v3: adjust ecmdq log level
  - arm-smmu-v3: adjust ecmdq log level
  - crypto: hisilicon/qm - clear the memory before enabling the device
  - [v8-10-43]arm64: RME: RTT tear down
  - [v8-09-43]KVM: arm64: Allow passing machine type in KVM creation
  - [v8-08-43]kvm: arm64: Don't expose debug capabilities for realm  guests
  - [v8-07-43]arm64: RME: ioctls to create and configure  realms
  - [v8-06-43]arm64: RME: Define the user ABI
  - [v8-05-43]arm64: RME: Check for RME support at KVM init
  - [v8-04-43]arm64: RME: Add wrappers for RMI calls
  - [v8-03-43]arm64: RME: Add SMC definitions for calling the RMM
  - [v8-02-43]arm64: RME: Handle Granule Protection Faults (GPFs)
  - [v8-01-43]kvm: arm64: Include kvm_emulate.h in kvm/arm_psci.h
  - Revert "kvm: add virtcca cvm host feature"
  - Revert "VirtCCA: cvm support UEFI boot"
  - Revert "pmu: enable pmu phys irq inject for cvm"
  - !16720 [OLK-6.6] Not print information of SMMU 0x10 event and add phytium PS24080 SoC platform judgement
  - !17458 v2  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - ROH: fix variable type inconsistency issue
  - !17441 net: hibmcge: support for statistics of reset failures
  - !17435 arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - net: hibmcge: support for statistics of reset failures
  - sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - atm: Fix NULL pointer dereference
  - LeapIOraid: add device and support fw log
  - iommu: smmuv3: Not print information of SMMU 0x10 event


author: Li Nan <linan122@huawei.com> - 6.6.0-106.0.0.112
changelog:
  - !17565  Enhance soft hwpoison handling and injection
  - !17569  drm/vkms: Fix use after free and double free on init error
  - drm/vkms: Fix use after free and double free on init error
  - !17564  bpf: Reject %p% format string in bprintf-like helpers
  - !17510 PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17547  net_sched: drr: Fix double list add in class with netem as child qdisc
  - !17556  filemap: move prefaulting out of hot write path
  - mm/memory-failure: send SIGBUS in the event of thp split fail
  - mm/memory-failure: move hwpoison_filter() higher up
  - mm/memory-failure: improve memory failure action_result messages
  - mm/madvise: add MF_ACTION_REQUIRED to madvise(MADV_HWPOISON)
  - mm/memory-failure: try to send SIGBUS even if unmap failed
  - PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17529 mm: optimize mremap() by PTE batching
  - !17481  HID: core: fix __hid_request when no report ID is used
  - bpf: Reject %p% format string in bprintf-like helpers
  - !17495 v2  mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - !17546  net_sched: qfq: Fix double list add in class with netem as child qdisc
  - !17542  net: sch: Fix CVE-2025-37798
  - !17538  wifi: at76c50x: fix use after free access in at76_disconnect
  - !17537  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17553 RDMA/hns: Fix dip entries leak on devices newer than hip09
  - filemap: move prefaulting out of hot write path
  - RDMA/hns: Fix dip entries leak on devices newer than hip09
  - RDMA/hns: Fix querying wrong SCC context for DIP algorithm
  - !17479 fix some bugs of enfs
  - !17530  sched/psi: change permissions of /proc/pressure/stat
  - net_sched: drr: Fix double list add in class with netem as child qdisc
  - net_sched: qfq: Fix double list add in class with netem as child qdisc
  - mm/mremap: avoid expensive folio lookup on mremap folio pte batch
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_ets: make est_qlen_notify() idempotent
  - wifi: at76c50x: fix use after free access in at76_disconnect
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - sched/psi: change permissions of /proc/pressure/stat
  - mm: optimize mremap() by PTE batching
  - !17526 v7  High Performance Container Resource View Isolation -- Stage 2
  - !17515 gpiolib: Get rid of never false gpio_is_valid() calls
  - mm: call pointers to ptes as ptep
  - !17519  CVE-2025-38473
  - !17524  CVE-2025-38375
  - !17517  CVE-2025-38251
  - !17523  CVE-2025-38211
  - samples/bpf: Add iterator program for meminfo
  - bpf-rvi: Add bpf_x86_direct_pages kfunc
  - bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc
  - bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc
  - bpf-rvi: Add bpf_mem_percpu kfunc
  - bpf-rvi: Add bpf_mem_failure kfunc
  - bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc
  - bpf-rvi: Add bpf_mem_{total,free}cma kfunc
  - bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc
  - samples/bpf: Add iterator program for stat
  - bpf-rvi: stat: Add stat iterator target
  - bpf-rvi: Add kstat_ & kcpustat_ kfuncs
  - bpf-rvi: Add cpu runqueue related kfuncs
  - bpf-rvi: Add stat-related misc kfuncs
  - bpf-rvi: Add bpf_seq_file_append() kfunc
  - samples/bpf: Add iterator program for swaps
  - bpf-rvi: Add bpf_page_counter_read() kfunc
  - bpf-rvi: Add bpf_si_memswinfo() kfunc
  - samples/bpf: Add iterator program for uptime
  - bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc
  - samples/bpf: Add iterator program for loadavg
  - bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs
  - bpf-rvi: pidns: Calculate loadavg for each pid namespace
  - samples/bpf: Add iterator program for partitions
  - bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions
  - bpf-rvi: block: Add partitions iterator target
  - samples/bpf: Add iterator program for diskstats
  - bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc
  - bpf-rvi: block: Add diskstats iterator target
  - samples/bpf: Add iterator program for cpuinfo_arm64
  - bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64
  - bpf-rvi: arm64: Add cpuinfo_arm64 iterator target
  - bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc
  - bpf-rvi: cpuacct: Add task_cpuacct()
  - bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc
  - bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc
  - bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc
  - bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc
  - bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask()
  - virtio-net: ensure the received length does not exceed allocated size
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  - nfs/enfs: make some functions static in enfs_multipath_client.c
  - nfs/enfs: remove enfs_init() and enfs_fini()
  - nfs/enfs: format get_ip_to_str() in shard_route.c
  - nfs/enfs: unlock uniformly at the end of function in shard_route.c
  - nfs/enfs: support debugging ip and dns list
  - nfs/enfs: fix error when showing dns list
  - nfs/enfs: fix alignment between struct rpc_clnt and rpc_clnt_reserve
  - nfs/enfs: set CONFIG_SUNRPC_ENFS=y by default
  - nfs/enfs: fix memory leak of shard_view_ctrl when removing nfs module
  - atm: clip: prevent NULL deref in clip_push()
  - gpiolib: Get rid of never false gpio_is_valid() calls
  - Revert "PM / devfreq: Add HiSilicon uncore frequency scaling driver"
  - mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - HID: core: do not bypass hid_hw_raw_request
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID


author: Li Nan <linan122@huawei.com> - 6.6.0-107.0.0.113
changelog:
  - !17744  trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17737 soc cache: Fix incorrect error path of ioctl
  - !17660  cgroup/cpuset: Support dynamic affinity feature
  - !17293 [OLK-6.6] backport important bugfix for Broadcom BCM57414 nic driver from upstream linux-6.6.y
  - !17747  fix some CVE
  - !17751  iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17730  arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - !16545  KVM: arm64: fix memory leak in TLBI
  - iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17716  hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17669  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !17674  ftrace: Also allocate and copy hash for reading of filter files
  - !17725  perf/core: Don't leak AUX buffer refcount on allocation failure
  - usb: xhci: Fix invalid pointer dereference in Etron workaround
  - thunderbolt: Do not double dequeue a configuration request
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
  - mm: memory-failure: update ttu flag inside unmap_poisoned_folio
  - Bluetooth: btnxpuart: Fix kernel panic during FW release
  - !17592  ice: add NULL check in eswitch lag check
  - trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17720  crypto: lzo - Fix compression buffer overrun
  - !17719  spi: spi-imx: Add check for spi_imx_setupxfer()
  - !17687  ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - soc cache: Fix incorrect error path of ioctl
  - soc cache: Fix incorrect size validation
  - soc cache: Enforce maintain type check
  - !17683 v2  Fix for bpf samples and selftests
  - !17724  mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17438 [OLK-6.6]:update patches for sw64 architecture
  - !17652  wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - !17728  CVE-2025-38006
  - !17677 v2  Fix static check warning reported by coccinelle
  - !17633  dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17455  raid10: cleanup memleak at raid10_make_request
  - !17453  md/raid1: Fix stack memory use after return in raid1_reshape
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - net: mctp: Don't access ifa_index when missing
  - mctp: no longer rely on net->dev_index_head[]
  - perf/core: Don't leak AUX buffer refcount on allocation failure
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17606  drm/sched: Increment job count before swapping tail spsc queue
  - !17671  bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - crypto: lzo - Fix compression buffer overrun
  - spi: spi-imx: Add check for spi_imx_setupxfer()
  - hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17632  perf/core: Exit early on perf_mmap() fail
  - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory
  - selftests/bpf: fix perf_event link info name_len assertion
  - Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests"
  - Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test"
  - Revert "selftests/bpf: fix perf_event link info name_len assertion"
  - !17650 net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17634  HID: pidff: Fix null pointer dereference in pidff_find_fields
  - ACPI / MPAM: Fix wrong IS_ERR() check in _parse_table()
  - hiroce3: Use IS_ERR() to check the return value of kthread_run()
  - ftrace: Also allocate and copy hash for reading of filter files
  - bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - !17642  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - !17641  net: clear the dst when changing skb protocol
  - !17653  wifi: iwlwifi: fix debug actions order
  - !17651  wifi: mt76: disable napi on driver removal
  - !17647  CVE-2025-38052
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - cgroup/cpuset: Support dynamic affinity feature
  - !17646  sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - !17648  CVE-2025-37920
  - !17643  net: Fix TOCTOU issue in sk_is_readable()
  - !17644  bridge: mcast: Fix use-after-free during router port configuration
  - !17645  CVE-2025-38465
  - !17600  two bugfix for arm64 support HVO
  - !17649  Fix CVE-2025-21839
  - !17628  Fix CVE-2025-37780
  - !17629  Fix CVE-2025-37767
  - !17637  netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - !17638  tcp: Correct signedness in skb remaining space calculation
  - !17639  tipc: Fix use-after-free in tipc_conn_close().
  - !17640  seg6: Fix validation of nexthop addresses
  - wifi: iwlwifi: fix debug actions order
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - wifi: mt76: disable napi on driver removal
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17608  mm/util: make memdup_user_nul() similar to memdup_user()
  - net: hns3: change the function return type from int to bool
  - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
  - xsk: Fix kabi broken
  - xsk: Fix race condition in AF_XDP generic RX path
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - netlink: avoid infinite retry looping in netlink_unicast()
  - netlink: make sure we allow at least one dump skb
  - netlink: Fix rmem check in netlink_broadcast_deliver().
  - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  - bridge: mcast: Fix use-after-free during router port configuration
  - net: Fix TOCTOU issue in sk_is_readable()
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - net: clear the dst when changing skb protocol
  - seg6: Fix validation of nexthop addresses
  - tipc: Fix use-after-free in tipc_conn_close().
  - tcp: Correct signedness in skb remaining space calculation
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - HID: pidff: Fix null pointer dereference in pidff_find_fields
  - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17597 Delete PHYTIUM_CPU_PART_FTC862 macro
  - perf/core: Exit early on perf_mmap() fail
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
  - isofs: Prevent the use of too small fid
  - !17307  scsi: megaraid_sas: Fix invalid node index
  - !17309  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - mm/util: make memdup_user_nul() similar to memdup_user()
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17575  net/sched: Fix CVE-2025-37890
  - arm64: mm: HVO: fix deadlock in split vmemmap pmd
  - mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86
  - cputype: phytium: Delete PHYTIUM_CPU_PART_FTC862 macro
  - ice: add NULL check in eswitch lag check
  - !16528 [OLK-6.6] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - !17570  tracing: Add down_write(trace_event_sem) when adding trace event
  - net/sched: ets: use old 'nbands' while purging unused classes
  - net/sched: Always pass notifications when child class becomes empty
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  - tracing: Add down_write(trace_event_sem) when adding trace event
  - sw64: ptrace: return -EIO in invalid PEEKUSR/POKEUSR requests
  - sw64: kvm: fix missing kvm_unregister_perf_callbacks
  - sw64: kvm: fix compile error of kvm.ko
  - sw64: kvm: remove the duplicated Kconfig selection of KVM
  - sw64: cpuidle: add dedicated driver
  - sw64: fix missing characters for sw64_rrk
  - sw64: selftests/net: add sw64 support for io_uring_zerocopy_tx
  - sw64: crypto: implement crc32 assembly optimization
  - sw64: efi: remove meaningless code from asm/efi.h
  - sw64: fix incorrect macro definitions for sw64 in bpf_tracing.h
  - sw64: cpufreq: using PLL0 to provide clock for idle cores
  - sw64: kvm: save the virtual address of irqs_pending in vcpucb
  - sw64: kvm: fix undefined error with ftrace disabled
  - raid10: cleanup memleak at raid10_make_request
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - sw64: kvm: enable dirty log gradually in small chunks for core4
  - sw64: fix guest kdump function
  - sw64: ftrace: add HAVE_DYNAMIC_FTRACE_WITH_ARGS support
  - sw64: use wait/complete for smp boot
  - sw64: fix sw64_rrk_store() wrap handling
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - scsi: megaraid_sas: Fix invalid node index
  - bnxt: properly flush XDP redirect lists
  - dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386
  - dma: Fix kabi breakage due to "dma: pswiotlb: Move platform-identification to cpu errata"
  - dma: pswiotlb: Move platform-identification to cpu errata
  - dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops
  - dma: phyitum: enable CONFIG_PSWIOTLB
  - dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance"
  - dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - KVM: arm64: fix memory leak in TLBI


author: Li Nan <linan122@huawei.com> - 6.6.0-108.0.0.114
changelog:
  - !17835 v2  perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - !17856  sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17635 mm: madvise: use per_vma lock for MADV_FREE
  - sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17841  fs/resctrl: Fix max_threshold_occupancy write operation
  - !17844  CVE-2025-37752
  - !17845  xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - !17733  proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - !17834  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - !17840  arm64/mpam: Fix num_rmids when enable CDP mode
  - fs/resctrl: Fix max_threshold_occupancy write operation
  - arm64/mpam: Fix num_rmids when enable CDP mode
  - !17838  mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - !17587 CVE-2025-38406: wifi: ath6kl: remove WARN on bad firmware input
  - !17585 CVE-2025-38408： genirq/irq_sim: Initialize work context pointers properly
  - !17586 CVE-2025-38409: drm/msm: Fix another leak in the submit error path
  - !17584 CVE-2025-38410: drm/msm: Fix a fence leak in submit error path
  - !17582 NFC: nci: uart: Set tty-&gt;disc_data only in success path
  - !17590 wifi: carl9170: do not ping device which has failed to load firmware
  - !17593 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - !17594 CVE-2025-38425: i2c: tegra: check msg length in SMBUS block read
  - !17595 Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - !17596 usb: gadget: u_serial: Fix race condition in TTY wakeup
  - !17583 CVE-2025-38467：drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - !17789  bpf, sockmap: Fix CVE-2025-38154
  - !17712  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - !17790  page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - !17788  netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - !17786  net: xfrm: Fix CVE-2025-38097
  - !17784  bpf, sockmap: Fix panic when calling skb_linearize
  - !17785  bpf: fix ktls panic with sockmap
  - !17783  net/sched: fix use-after-free in taprio_dev_notifier
  - !17781  mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - !17782  net/mlx5e: Disable MACsec offload for uplink representor profile
  - !17780  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - !17779  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !17778  phy: tegra: xusb: remove a stray unlock
  - !17777  net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - !17776  dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - !17775  espintcp: fix skb leaks
  - !17774  can: bcm: add locking for bcm_op runtime updates
  - !17711  net: lan743x: Fix memleak issue when GSO enabled
  - !17708  net: phy: Fix CVE-2025-37945
  - !17707  bpf: Scrub packet on bpf_redirect_peer
  - !17703  9p/net: fix improper handling of bogus negative read/write replies
  - !17699  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - !17685  gtp: Fix CVE-2025-21678
  - !17816  vmci: Prevent the dispatching of uninitialized payloads
  - !17824  tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17609 cpufreq: Exit governor when failed to start old governor
  - !17823  arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17821  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !17818  fix some CVEs
  - !17798  benet: fix BUG when creating VFs
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
  - mm/vmscan: don't try to reclaim hwpoison folio
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - memblock: Accept allocated memory before use in memblock_double_array()
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails
  - Input: synaptics - use guard notation when pausing serio port
  - vmci: Prevent the dispatching of uninitialized payloads
  - !17804  pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17800  gic: increase the arch_timer
  - !17794  perf/core: Prevent VMA split of buffer mappings
  - !17574 ROH: Add crc_err_cnt and retry_cnt mib statistics
  - pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17337 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Conflicts Patches
  - !17797 v3  HiSock Redirect Framework
  - gic: increase the arch_timer priority to avoid hardlockup
  - benet: fix BUG when creating VFs
  - !17768  net/oenetcls: introduce oenetcls for network optimization
  - ROH: Add crc_err_cnt and retry_cnt mib statistics
  - samples/bpf: Add HiSock Redirect sample
  - openeuler_defconfig: Enable CONFIG_HISOCK
  - bpf: Add bpf_*_change_dev kfunc
  - bpf: Add bpf_xdp_set_ingress_dst kfunc
  - bpf: Add hisock_xdp_buff wrapper for xdp_buff
  - bpf: Add bpf_skops_get_ingress_dst kfunc
  - bpf: Enable generic kfuncs for BPF_CGROUP_* programs
  - bpf: Add HISOCK_EGRESS hook on network egress path
  - bpf: Add BPF_PROG_TYPE_HISOCK prog type
  - bpf: Add XDP_HISOCK_REDIRECT action
  - bpf: Add CONFIG_HISOCK
  - !17470  fix CVE-2025-38351
  - !17766 RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - !17772  two CVE fix
  - perf/core: Prevent VMA split of buffer mappings
  - !17659 v2  sched: More flexible use of CPU quota when CPU is idle
  - !17748  fix bug in hdbss
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - bpf, sockmap: Avoid using sk_socket after free when sending
  - bpf, sockmap: fix duplicated data transmission
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - net: xfrm: Fix kabi breakage of struct xfrm_state
  - espintcp: remove encap socket caching to avoid reference leak
  - !17294 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !17714  can: bcm: add missing rcu read protection for procfs content
  - !17713  net: phy: leds: fix memory leak
  - !17717  ipvs: fix uninit-value for saddr in do_output_route4
  - !17706  RDMA/cma: Fix CVE-2025-37772
  - !17709  bnxt_en: Fix CVE-2025-37911
  - !17705  igc: fix PTM cycle trigger logic
  - !17718  ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - !17701  net: openvswitch: fix nested key length validation in the set() action
  - !17702  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - !17704  page_pool: avoid infinite loop to schedule delayed worker
  - !17700  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - !17697  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - !17715  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - !17696  net: decrease cached dst counters in dst_release
  - !17695  netfilter: nf_tables: don't unregister hook when table is dormant
  - !17694  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - !17693  drm/connector: Fix CVE-2025-22089
  - !17692  vmxnet3: unregister xdp rxq info in the reset path
  - !17690  Bluetooth: Fix error code in chan_alloc_skb_cb()
  - !17689  tcp: Fix CVE-2025-21864
  - !17741  Fix trace may OOB when trace_get_user failed
  - !17742  i2c: qup: jump out of the loop in case of timeout
  - !17678  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - !17679  media: cx231xx: set device_caps for 417
  - bpf: fix ktls panic with sockmap
  - bpf, sockmap: Fix panic when calling skb_linearize
  - net/sched: fix use-after-free in taprio_dev_notifier
  - net/mlx5e: Disable MACsec offload for uplink representor profile
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - phy: tegra: xusb: remove a stray unlock
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - espintcp: fix skb leaks
  - can: bcm: add locking for bcm_op runtime updates
  - net: libwx: fix the using of Rx buffer DMA
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  - !9218 [OLK-6.6] i2c/zhaoxin: I2C controller driver enhancement and optimization
  - !17755  arm64: perf: Add support for HIP12 hw metric
  - !17763  mm/smaps: fix race between smaps_hugetlb_range and migration
  - net/oenetcls: introduce oenetcls for network optimization
  - RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - fs/proc/task_mmu: convert smaps_hugetlb_range() to work on folios
  - i2c: zhaoxin: Add support for Zhaoxin I2C controller
  - arm64: perf: Add support for HIP12 hw metric
  - KVM: arm64: fix memory leak in HDBSS
  - KVM: arm64: do not support hdbss in nvhe
  - i2c: qup: jump out of the loop in case of timeout
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - ipvs: fix uninit-value for saddr in do_output_route4
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - can: bcm: add missing rcu read protection for procfs content
  - net: phy: leds: fix memory leak
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - net: lan743x: Fix memleak issue when GSO enabled
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - bnxt_en: Fix coredump logic to free allocated buffer
  - genirq/irq_sim: Initialize work context pointers properly
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
  - bpf: Scrub packet on bpf_redirect_peer
  - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
  - RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
  - igc: fix PTM cycle trigger logic
  - page_pool: avoid infinite loop to schedule delayed worker
  - 9p/net: fix improper handling of bogus negative read/write replies
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - net: openvswitch: fix nested key length validation in the set() action
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - net: decrease cached dst counters in dst_release
  - netfilter: nf_tables: don't unregister hook when table is dormant
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - drm/connector: fix kabi broken in struct ib_device
  - RDMA/core: Don't expose hw_counters outside of init net namespace
  - vmxnet3: unregister xdp rxq info in the reset path
  - Bluetooth: Fix error code in chan_alloc_skb_cb()
  - net: use __GENKSYMS__ to revert the kabi change
  - tcp: drop secpath at the same time as we currently drop dst
  - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  - gtp: Destroy device along with udp socket's netns dismantle.
  - media: cx231xx: set device_caps for 417
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - sched: More flexible use of CPU quota when CPU is idle
  - mm: fix the race between collapse and PT_RECLAIM under per-vma lock
  - mm: madvise: use per_vma lock for MADV_FREE
  - mm: use per_vma lock for MADV_DONTNEED
  - mm: madvise: use walk_page_range_vma() instead of walk_page_range()
  - cpufreq: Exit governor when failed to start old governor
  - cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq()
  - cpufreq: Init policy->rwsem before it may be possibly used
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost
  - cpufreq: Remove duplicate check in __cpufreq_offline()
  - cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs
  - cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em()
  - cpufreq: CPPC: Do not return a value from populate_efficiency_class()
  - cpufreq: CPPC: Remove cpu_data_list
  - cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in .get() callback
  - i2c: tegra: check msg length in SMBUS block read
  - drm/msm: Fix another leak in the submit error path
  - wifi: ath6kl: remove WARN on bad firmware input
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
  - KVM: x86: model canonical checks more precisely
  - KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks
  - KVM: x86: Route non-canonical checks in emulator through emulate_ops
  - KVM: x86: drop x86.h include from cpuid.h
  - KVM: x86: Bury guest_cpuid_is_amd_or_hygon() in cpuid.c
  - KVM: SVM: Emulate SYSENTER RIP/RSP behavior for all Intel compat vCPUs
  - KVM: x86: Inhibit code #DBs in MOV-SS shadow for all Intel compat vCPUs
  - KVM: x86: Apply Intel's TSC_AUX reserved-bit behavior to Intel compat vCPUs
  - KVM: x86/pmu: Squash period for checkpointed events based on host HLE/RTM
  - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
  - ALSA: hda/conexant: Use the new codec SSID matching
  - ALSA: hda: Use own quirk lookup helper
  - scsi: lpfc: Use memcpy() for BIOS version
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - usb: gadget: u_serial: Fix race condition in TTY wakeup
  - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - wifi: carl9170: do not ping device which has failed to load firmware
  - drm/msm: Fix a fence leak in submit error path
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - NFC: nci: uart: Set tty->disc_data only in success path


author: Li Nan <linan122@huawei.com> - 6.6.0-109.0.0.115
changelog:
  - !17945  Fix CVE-2025-38687
  - !17936  padata: Fix pd UAF once and for all
  - !17879 sched: apply custom cpu range for idle cpu
  - comedi: fix race between polling and detaching
  - !17937  clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  - padata: Fix pd UAF once and for all
  - !17853 v3  arm64: Fix actlr_el1 can not set problem in guest
  - !17882  CVE-2025-38502
  - !17922  x86/sgx: Prevent attempts to reclaim poisoned pages
  - !17923  media: vidtv: Terminating the subsequent process of initialization failure
  - !17924 [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler
  - !17913  Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - !17915  arm64/mpam: Half the number of RMIDs for all resources under CDP mode
  - [backport]KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler
  - media: vidtv: Terminating the subsequent process of initialization failure
  - x86/sgx: Prevent attempts to reclaim poisoned pages
  - !17848 [OLK-6.6]:update patches for sw64 architecture
  - !17731  arm64/mpam: Add mb_only boot option
  - !17911  CVE-2025-38305
  - !17244  Fix netns reference count issue
  - !17914 virtCCA CoDA: Expose I/O hook interfaces.
  - virtCCA CoDA: Expose I/O hook interfaces.
  - arm64/mpam: Half the number of RMIDs for all resources under CDP mode
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  - ptp: fix breakage after ptp_vclock_in_use() rework
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
  - !17868  scsi: Remove scsi device no_start_on_resume flag
  - !17866  md: make rdev_addable usable for rcu mode
  - !17865  scsi: core: ufs: Fix a hang in the error handler
  - !17842 [OLK-6.6] Fix CVE-2025-37924
  - !17836 [OLK-6.6] Fix CVE-2025-38312
  - !17902 [OLK-6.6] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17880 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - perf/zhaoxin/uncore: Enhance uncore support and fix related bugs
  - !17890  LeapIOraid: fix strscpy size argument
  - !17892  pptp: Fix skb length handling and error path in pptp_xmit()
  - !17815 v2  ext4: better scalability for ext4 block allocation
  - pptp: fix pptp_xmit() error path
  - pptp: ensure minimal skb length in pptp_xmit()
  - LeapIOraid: fix strscpy size argument
  - !17883  net/mlx5e: Remove skb secpath if xfrm state is not found
  - net/mlx5e: Remove skb secpath if xfrm state is not found
  - Fix kabi breakage for bpf_map by using KABI_BROKEN_REPLACE and KABI_FILL_HOLE.
  - bpf: Fix oob access in cgroup local storage
  - bpf: Move cgroup iterator helpers to bpf.h
  - bpf: Move bpf map owner out of common struct
  - bpf: Add cookie object to bpf maps
  - sched: apply custom cpu range for idle cpu
  - !17756 [OLK-6.6] Provide host-side administrators/users with real-time access to the usage status of CSV3 CMA memory.
  - !17846  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  - !17442  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  - !17813  net/mlx5: Check device memory pointer before usage
  - scsi: fix kabi broken for no_start_on_resume flag in struct scsi_device
  - scsi: Remove scsi device no_start_on_resume flag
  - md: make rdev_addable usable for rcu mode
  - scsi: core: ufs: Fix a hang in the error handler
  - sw64: fix for userspace asking for syscall(-1)
  - sw64: update junzhang default config file
  - sw64: kvm: introduce pmd_thp_or_huge for PMD hugepage checking
  - sw64: add cross-page check in software unaligned write handling
  - sw64: ptrace: fail system calls on invalid address access in PEEKUSR
  - sw64: ptrace: fix a bug in return value handling in PEEKUSR AND POKEUSR
  - sw64: perf: Add support for get_cpuid_str function
  - sw64: kvm: use read/write spin lock for KVM MMU
  - sw64: rethook: fix a bug in rethook_trampoline
  - sw64: perf unwind: Do not put libunwind-sw_64 in FEATURE_TESTS_BASIC
  - arm64: Fix actlr_el1 can not set problem in guest
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  - ksmbd: fix use-after-free in kerberos authentication
  - ksmbd: Fix dangling pointer in krb_authenticate
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  - ext4: fix potential null deref in ext4_mb_init()
  - ext4: implement linear-like traversal across order xarrays
  - ext4: refactor choose group to scan group
  - ext4: open coding repeated check in next_linear_group
  - ext4: use correct criteria name instead stale integer number in comment
  - ext4: remove unused parameter ngroup in ext4_mb_choose_next_group_*()
  - ext4: convert free groups order lists to xarrays
  - ext4: factor out ext4_mb_scan_group()
  - ext4: factor out ext4_mb_might_prefetch()
  - ext4: keep "prefetch_grp" and "nr" consistent
  - ext4: remove unused ext4_allocation_context::ac_groups_considered
  - ext4: factor out __ext4_mb_scan_group()
  - ext4: convert EXT4_B2C(sbi->s_stripe) users to EXT4_NUM_B2C
  - ext4: fallback to complex scan if aligned scan doesn't work
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch
  - ext4: fix zombie groups in average fragment size lists
  - ext4: merge freed extent with existing extents before insertion
  - ext4: convert sbi->s_mb_free_pending to atomic_t
  - ext4: make running and commit transaction have their own freed_data_list
  - ext4: fix typo in CR_GOAL_LEN_SLOW comment
  - ext4: get rid of some obsolete EXT4_MB_HINT flags
  - ext4: utilize multiple global goals to reduce contention
  - ext4: remove unnecessary s_md_lock on update s_mb_last_group
  - ext4: remove unnecessary s_mb_last_start
  - ext4: separate stream goal hits from s_bal_goals for better tracking
  - Revert "ext4: move mb_last_[group|start] to ext4_inode_info"
  - ext4: add ext4_try_lock_group() to skip busy groups
  - net/mlx5: Check device memory pointer before usage
  - x86/csv: Add function to get free size of CSV3 CMA
  - arm64/mpam: Add mb_only boot option
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
  - smb: client: fix netns refcount leak after net_passive changes
  - Revert "smb: client: fix TCP timers deadlock after rmmod"
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"


author: Li Nan <linan122@huawei.com> - 6.6.0-110.0.0.116
changelog:
  - !18015 arm64: cca_base: On the Adaptation of CCA and virtCCA.
  - arm64: cca_base: On the Adaptation of CCA and virtCCA.
  - !18017  pNFS: Fix uninited ptr deref in block/scsi layout
  - pNFS: Fix uninited ptr deref in block/scsi layout
  - !18000  gfs2: Validate i_depth for exhash directories
  - !17997  hv_netvsc: Fix panic during namespace deletion with VF
  - !17947  migration/hisilicon: some bugfix
  - !17919  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - gfs2: Validate i_depth for exhash directories
  - hv_netvsc: Fix panic during namespace deletion with VF
  - !17985  Updates of HiSilicon Uncore L3C PMU
  - !17977  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - !17987 virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers.
  - virtCCA CoDA: Prevent secure PFs/VFs load or probe native drivers.
  - Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU
  - Documentation: hisi-pmu: Fix of minor format error
  - drivers/perf: hisi: Add support for L3C PMU v3
  - !17974 iommu: Fix the incorrect exception process of the failed memory allocation
  - !17983  fix oenetcls bugs
  - net/oenetcls: clean resource when init ntuple/flow fail
  - net/oenetcls: use workqueue for ntuple cfg
  - net/oenetcls: remove oenetcls trace hook
  - net/oenetcls: use raw_smp_processor_id() instead of smp_processor_id()
  - !17898 enfs: fix some bugs and optimize performance
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  - !17976  LoongArch: BPF: Fix jump offset calculation in tailcall
  - iommu: Fix the incorrect exception process of the failed memory allocation
  - LoongArch: BPF: Fix jump offset calculation in tailcall
  - !17602 [OLK-6.6] drm/phytium: Fix make allmodconfig build fail
  - !17792 virtCCA: Improve cvm performance.
  - !17869 [OLK-6.6]Backport upstream CC Measurement support in the efi libstub
  - !17862 [OLK-6.6]Hygon: Support RTMR and Attestation that includes RTMR for Hygon CSV3 VM
  - !17946 mm/shmem, swap: bugfix and improvement of mTHP swap in
  - !17969  arm64/mpam: Add quirk for cmax and cmin
  - !17967  sched: Fix sched_numa_find_nth_cpu() if mask offline
  - !17955 arm64: RME: handle RIPAS changes before kvm_rec_enter
  - arm64: RME: handle RIPAS changes before kvm_rec_enter
  - arm64: RME: Introduce kvm_rec_pre_enter() called before entering an atomic section
  - !17962  tools/mpam: Add MPAM dynamic adjustment and sampling scripts
  - arm64/mpam: Add quirk for cmax and cmin
  - !17940  net/tls: fix kernel panic when alloc_page failed
  - !17941  OLK-6.6-fix-CVE-2025-38147
  - sched: Fix sched_numa_find_nth_cpu() if mask offline
  - tools/mpam: Add MPAM dynamic adjustment and sampling scripts
  - !17939  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  - hisi_acc_vfio_pci: update device driver status
  - migration: resolve duplicate migration states
  - migration: fix VF reset timeout issue
  - migration: bugfix live migration function without VF device driver
  - mm/shmem, swap: fix major fault counting
  - mm/shmem, swap: rework swap entry and index calculation for large swapin
  - mm/shmem, swap: simplify swapin path and result handling
  - mm/shmem, swap: never use swap cache and readahead for SWP_SYNCHRONOUS_IO
  - mm/shmem, swap: tidy up swap entry splitting
  - mm/shmem, swap: tidy up THP swapin checks
  - mm/shmem, swap: avoid redundant Xarray lookup during swapin
  - mm/shmem, swap: improve cached mTHP handling and fix potential hang
  - mm/shmem, swap: fix softlockup with mTHP swapin
  - Add IPI direct inject method for virtCCA CVM.
  - Improve virtCCA CVM vtimer irq inject method.
  - Add poll method for nfs for virtCCA CVM.
  - calipso: unlock rcu before returning -EAFNOSUPPORT
  - calipso: Don't call calipso functions for AF_INET sk.
  - net/tls: fix kernel panic when alloc_page failed
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - nfs/enfs: remove duplicate definitions
  - nfs/enfs: fix some cleanup issues
  - nfs/enfs: fix finding root uuid issue
  - nfs/enfs: introduce is_enfs_debug()
  - nfs/enfs: get rpc procedure number from rpc_procinfo in get_uuid_from_task()
  - sunrpc: do not set enfs transport in rpc_task_set_client()
  - efi/libstub: Add get_event_log() support for CC platforms
  - efi/libstub: Measure into CC protocol if TCG2 protocol is absent
  - efi/libstub: Add Confidential Computing (CC) measurement typedefs
  - efi/tpm: Use symbolic GUID name from spec for final events table
  - efi/libstub: Use TPM event typedefs from the TCG PC Client spec
  - virt: csv-guest: Add support for extended attestation aware request in the CSV3 guest
  - virt: csv-guest: Implement CSV RTMR ioctl interfaces
  - virt: csv-guest: Introduce CSV RTMR uapi interface
  - x86/csv: Introduce RTMR interfaces
  - Add dynamic wfx trap method for virtCCA CVM.
  - drm/phytium: Fix Phytium DRM build fail


author: Li Nan <linan122@huawei.com> - 6.6.0-111.0.0.117
changelog:
  - !17932 [OLK-6.6] add support for WangXun 10G/25G/40G
  - !17665 cpufreq: intel_pstate: Support Clearwater Forest OOB mode
  - !17663 platform/x86: ISST: Add Clearwater Forest to support list
  - !17668 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - !17681 cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
  - !17468 [Intel-SIG] backporting KVM: x86: Advertise AVX10.1 CPUID to userspace
  - !17571 [OLK-6.6] Intel-SIG: Add new Intel CPU# definition
  - !18024  trace/fgraph: Fix error handling
  - !18061  net: bridge: fix soft lockup in br_multicast_query_expired()
  - !18026  vsock/virtio: Validate length in packet header before skb_put()
  - !18088  net/oenetcls: Fix crash when removing module
  - net/oenetcls: Fix crash when removing module
  - !18071  media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
  - net: bridge: fix soft lockup in br_multicast_query_expired()
  - !18054 arm64 kvm: On the Adaptation of CCA and virtCCA.
  - arm64 kvm: On the Adaptation of CCA and virtCCA.
  - !17972  arm64/mpam: Add quirk for L3 CSU counters
  - !18016  media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  - !16579 Do not shatter hugezeropage on wp-fault
  - !17839 [OLK-6.6] Fix CVE-2025-37838
  - !17887 [OLK-6.6] Fix CVE-2025-38637
  - !17889 [OLK-6.6] Fix CVE-2025-37840
  - !17850 [OLK-6.6] Fix CVE-2025-38173
  - !17854 [OLK-6.6] Fix CVE-2025-38143
  - !17861 [OLK-6.6] Fix CVE-2025-38194
  - vsock/virtio: Validate length in packet header before skb_put()
  - trace/fgraph: Fix error handling
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  - jffs2: check that raw node were preallocated before writing summary
  - net_sched: skbprio: Remove overly strict queue assertions
  - crypto: marvell/cesa - Handle zero-length skcipher requests
  - mtd: rawnand: brcmnand: fix PM resume warning
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
  - backlight: pm8941: Add NULL check in wled_configure()
  - arm64/mpam: Add quirk for L3 CSU counters
  - x86/cpu/vfm: Fix x86_vfm kabi
  - x86/cpu/vfm: Update arch/x86/include/asm/intel-family.h
  - x86/cpu/vfm: Add/initialize x86_vfm field to struct cpuinfo_x86
  - x86/cpu: Add model number for another Intel Arrow Lake mobile processor
  - net: wangxun: txgbe: add support for wangxun 10G/25G/40G
  - net: wangxun: remove wangxun txgbe inbox drivers
  - platform/x86: ISST: Add Clearwater Forest to support list
  - cpufreq: intel_pstate: Support Clearwater Forest OOB mode
  - cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode
  - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
  - cpufreq: intel_pstate: Update Balance-performance EPP for Granite Rapids
  - KVM: x86: Advertise AVX10.1 CPUID to userspace
  - mm: allocate THP on hugezeropage wp-fault
  - mm: abstract THP allocation


author: Li Nan <linan122@huawei.com> - 6.6.0-112.0.0.118
changelog:
  - !18320  workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
  - !18336  soc cache: support L3 cache lock in framework
  - !18352  net/oenetcls: Fix memleak when clean flow table
  - !18306  vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  - !18342  tracing: Silence warning when chunk allocation fails in trace_pid_write
  - net/oenetcls: Fix memleak when clean flow table
  - tracing: Silence warning when chunk allocation fails in trace_pid_write
  - !18331  ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
  - !18330  cpufreq: Initialize cpufreq-based invariance before subsys
  - soc cache: L3 cache lockdown support for HiSilicon SoC
  - soc cache: support L3 cache lock in framework
  - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - !18275 [OLK-6.6] Optimized the kernel driver of HYGON trusted functions
  - !18322  Fix CVE-2025-39715
  - !18293  CVE-2025-39886
  - !18290  vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
  - parisc: Revise gateway LWS calls to probe user read access
  - workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
  - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  - !18286 mm: shmem: fix the strategy for the tmpfs 'huge=' options
  - !18282 v2: shmem cleanup
  - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
  - memcg: skip cgroup_file_notify if spinning is not allowed
  - !18291  CVE-2025-39844
  - !18031 Introduce fwctl subystem framework
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
  - mm: introduce and use {pgd,p4d}_populate_kernel()
  - mm: move page table sync declarations to linux/pgtable.h
  - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
  - !18280  samples/bpf: fix cpuinfo_arm64 prog load issue
  - crypto: ccp: optimize PSP driver code logic to reduce modifications to native code
  - crypto: ccp: add "tdm_guard" as kernel and module parameter
  - crypto: ccp: optimize TDM kernel driver
  - mm: shmem: fix the strategy for the tmpfs 'huge=' options
  - docs: update THP documentation to clarify sysfs "never" setting
  - mm: shmem: drop the unnecessary folio_nr_pages()
  - mm: shmem: use 'folio' for shmem_partial_swap_usage()
  - samples/bpf: fix cpuinfo_arm64 prog load issue
  - !18264  memory tiers: use default_dram_perf_ref_source in log message
  - !18259  cgroup: split cgroup_destroy_wq into 3 workqueues
  - !18231  ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
  - !18230  net: ch9200: fix uninitialised access during mii_nway_restart
  - !18227  i40e: Fix potential invalid access when MAC list is empty
  - memory tiers: use default_dram_perf_ref_source in log message
  - !18250  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18253  samples/bpf: Fix print issue in bpf_rvi_diskstats
  - !18234  samples/bpf: Fix print issue in dump_partitions()
  - cgroup: split cgroup_destroy_wq into 3 workqueues
  - fwctl: Fix repeated device word in log message
  - fwctl: Add documentation
  - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware
  - taint: Add TAINT_FWCTL
  - fwctl: FWCTL_INFO to return basic information about the device
  - fwctl: Basic ioctl dispatch for the character device
  - fwctl: Add basic structure for a class subsystem with a cdev
  - samples/bpf: Fix print issue in bpf_rvi_diskstats
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18173  usb: core: config: Prevent OOB read in SS endpoint companion parsing
  - samples/bpf: Fix print issue in dump_partitions()
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
  - net: ch9200: fix uninitialised access during mii_nway_restart
  - i40e: Fix potential invalid access when MAC list is empty
  - !18179  Implement disable/enable for (delayed) work
  - !18038 v3  arm64: Do not enable hardware xcall/xint in guest temporarily
  - !18195  arm64/mpam: Update MB hardlimit and priority default value forcely
  - !17636 [OLK-6.6] [Intel-SIG] crypto: iaa - Remove potential infinite loop in check_completion()
  - !17858 [OLK-6.6] [Intel-SIG] Enable FLR for IDXD halt
  - !17994 perf: backport community patches
  - !18183  CVE-2025-38725
  - arm64/mpam: Update MB hardlimit and priority default value forcely
  - dmaengine: idxd: Enable Function Level Reset (FLR) for halt
  - dmaengine: idxd: Refactor halt handler
  - dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers
  - dmaengine: idxd: Binding and unbinding IDXD device and driver
  - dmaengine: idxd: Add idxd_pci_probe_alloc() helper
  - bitmap: Define a cleanup function for bitmaps
  - !15977 use refcount+RCU method to implement lockless slab shrink
  - !18166  Updates of HiSilicon Uncore L3C PMU
  - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
  - !18156  ARM: rockchip: fix kernel hang during smp initialization
  - workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask()
  - workqueue: Implement disable/enable for (delayed) work items
  - workqueue: Preserve OFFQ bits in cancel[_sync] paths
  - workqueue: Make @flags handling consistent across set_work_data() and friends
  - workqueue: Remove clear_work_data()
  - workqueue: Factor out work_grab_pending() from __cancel_work_sync()
  - workqueue: Clean up enum work_bits and related constants
  - workqueue: Introduce work_cancel_flags
  - workqueue: Rename __cancel_work_timer() to __cancel_timer_sync()
  - mm: add KABI_* macros to preserve KABI
  - mm: shrinker add a copyright notice
  - mm: shrinker: convert shrinker_rwsem to mutex
  - mm: shrinker: hold write lock to reparent shrinker nr_deferred
  - mm: shrinker: make memcg slab shrink lockless
  - mm: shrinker: make global slab shrink lockless
  - mm: shrinker: rename {prealloc|unregister}_memcg_shrinker() to shrinker_memcg_{alloc|remove}()
  - mm: shrinker: add a secondary array for shrinker_info::{map, nr_deferred}
  - mm: shrinker: remove old APIs
  - mm: shrinker: vmalloc.c: use the new shrinker kAPI
  - fs: super: dynamically allocate the s_shrink
  - zsmalloc: dynamically allocate the mm-zspool shrinker
  - xfs: dynamically allocate the xfs-qm shrinker
  - xfs: dynamically allocate the xfs-inodegc shrinker
  - xfs: dynamically allocate the xfs-buf shrinker
  - nfsd: dynamically allocate the nfsd-reply shrinker
  - nfsd: dynamically allocate the nfsd-client shrinker
  - jbd2,ext4: dynamically allocate the jbd2-journal shrinker
  - ext4: dynamically allocate the ext4-es shrinker
  - mbcache: dynamically allocate the mbcache shrinker
  - virtio_balloon: dynamically allocate the virtio-balloon shrinker
  - vmw_balloon: dynamically allocate the vmw-balloon shrinker
  - bcache: dynamically allocate the md-bcache shrinker
  - md/raid5: dynamically allocate the md-raid5 shrinker
  - dm zoned: dynamically allocate the dm-zoned-meta shrinker
  - dm: dynamically allocate the dm-bufio shrinker
  - drm/panfrost: dynamically allocate the drm-panfrost shrinker
  - drm/msm: dynamically allocate the drm-msm_gem shrinker
  - drm/i915: dynamically allocate the i915_gem_mm shrinker
  - mm: workingset: dynamically allocate the mm-shadow shrinker
  - sunrpc: dynamically allocate the sunrpc_cred shrinker
  - mm: thp: dynamically allocate the thp-related shrinkers
  - rcu: dynamically allocate the rcu-kfree shrinker
  - rcu: dynamically allocate the rcu-lazy shrinker
  - ubifs: dynamically allocate the ubifs-slab shrinker
  - quota: dynamically allocate the dquota-cache shrinker
  - nfsd: dynamically allocate the nfsd-filecache shrinker
  - nfs: dynamically allocate the nfs-acl shrinker
  - NFSv4.2: dynamically allocate the nfs-xattr shrinkers
  - gfs2: dynamically allocate the gfs2-qd shrinker
  - gfs2: dynamically allocate the gfs2-glock shrinker
  - f2fs: dynamically allocate the f2fs-shrinker
  - erofs: dynamically allocate the erofs-shrinker
  - xenbus/backend: dynamically allocate the xen-backend shrinker
  - drm/ttm: dynamically allocate the drm-ttm_pool shrinker
  - binder: dynamically allocate the android-binder shrinker
  - kvm: mmu: dynamically allocate the x86-mmu shrinker
  - mm: shrinker: add infrastructure for dynamically allocating shrinker
  - drm/ttm: introduce pool_shrink_rwsem
  - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations
  - mm: vmscan: move shrinker-related code into a separate file
  - mm: move some shrinker-related function declarations to mm/internal.h
  - x86/boot: Compile boot code with -std=gnu11 too
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing
  - !17949 crypto: hisilicon - some bugfix
  - !18144  Backport fs/pipe performance optimization patches
  - !17961 usb: gadget: configfs: Fix OOB read on empty string write
  - !17960 drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initial…
  - !17958 jfs: Prevent copying of nlink with value 0 from disk inode
  - !17957 fs/ntfs3: Fix a couple integer overflows on 32bit systems
  - !17956 drm/tegra: Fix a possible null pointer dereference
  - !17954 mtd: spinand: fix memory leak of ECC engine conf
  - !17953 regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  - !17952 rose: fix dangling neighbour pointers in rose_rt_device_down()
  - Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU
  - Documentation: hisi-pmu: Fix of minor format error
  - drivers/perf: hisi: Add support for L3C PMU v3
  - Revert "drivers/perf: hisi: Add support for L3C PMU v3"
  - Revert "Documentation: hisi-pmu: Fix of minor format error"
  - Revert "Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU"
  - !17973 enfs: recreate shard info when re-adding enfs module
  - !18114  tee: fix NULL pointer dereference in tee_shm_put
  - ARM: rockchip: fix kernel hang during smp initialization
  - !18133  iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
  - fs/pipe: use spinlock in pipe_read() only if there is a watch_queue
  - fs/pipe: remove unnecessary spinlock from pipe_write()
  - !18129 soc: hisilicon: kunpeng_hccs: Fix incorrect log information
  - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
  - !18073  HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  - !18118  samples/bpf: Fix print issue in dump_swaps()
  - soc: hisilicon: kunpeng_hccs: Fix incorrect log information
  - !18123  arm64/mpam: Add quirk for hisi cpbm_wd field
  - !18041  fs/smb: Fix inconsistent refcnt update
  - arm64/mpam: Add quirk for hisi cpbm_wd field
  - samples/bpf: Fix print issue in dump_swaps()
  - tee: fix NULL pointer dereference in tee_shm_put
  - nfs/enfs: remove duplicate EOPNOTSUPP definition
  - nfs/enfs: remove enfs_tp_common.h
  - nfs/enfs: remove ping_execute_workq_lock
  - nfs/enfs: remove lookupcache_workq_lock
  - nfs/enfs: remove redundant flush_workqueue() before destroy_workqueue()
  - nfs/enfs: return more nuanced error in NfsExtendProcInfoExtendEncode() and NfsExtendProcInfoExtendDecode()
  - nfs/enfs: handle error returned by NfsExtendProcInfoExtendEncode()
  - nfs/enfs: fix possible null-ptr-deref in exten_call.c
  - nfs/enfs: free memory uniformly at the end of function in exten_call.c
  - nfs/enfs: fix possible memory leak in exten_call.c
  - nfs/enfs: reload config when re-adding enfs module
  - nfs/enfs: recreate shard info when re-adding enfs module
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  - usb: gadget: configfs: Fix OOB read on empty string write
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
  - jfs: Prevent copying of nlink with value 0 from disk inode
  - fs/ntfs3: Fix a couple integer overflows on 32bit systems
  - drm/tegra: Fix a possible null pointer dereference
  - mtd: spinand: fix memory leak of ECC engine conf
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  - rose: fix dangling neighbour pointers in rose_rt_device_down()
  - fs/smb: Fix inconsistent refcnt update
  - arm64: Do not enable hardware xcall/xint in guest temporarily
  - perf: Always feature test reallocarray
  - perf comm str: Avoid sort during insert
  - crypto: hisilicon - use kcalloc() instead of kzalloc()
  - crypto: hisilicon/zip - enable literal length in stream mode compression
  - crypto: hisilicon - check the sva module status while enabling or disabling address prefetch
  - crypto: hisilicon - re-enable address prefetch after device resuming
  - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations
  - crypto: hisilicon/sec2 - implement full backlog mode for sec
  - Revert "crypto: hisilicon/sec2 - fix memory use-after-free issue"
  - Revert "crypto: hisilicon/sec2 - fix for gcm spec check"
  - crypto: hisilicon - Use fine grained DMA mapping direction
  - Revert "crypto: hisilicon - implement full backlog support for sec"
  - crypto: hisilicon/qm - replace devm_kzalloc with devm_kcalloc
  - crypto: hisilicon/qm - remove sizeof(char)
  - perf comm: Fix comm_str__put() for reference count checking
  - perf comm: Add reference count checking to 'struct comm_str'
  - crypto: iaa - Remove potential infinite loop in check_completion()


author: Li Nan <linan122@huawei.com> - 6.6.0-113.0.0.119
changelog:
  - !18464  i40e: add max boundary check for VF filters
  - !18433  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  - !18256     Add EDAC basic support and RRL enhancement for CWF/SRF/GNR/GNR-D
  - !18254 Add IFS support for ClearWater Forest
  - !18455  KVM: arm64: vgic-v4: Restore pending state on host userspace write
  - !18289 Expand scope of khugepaged anonymous collapse
  - !18324 arm64: Enable vmalloc-huge with ptdump
  - !18419  sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
  - i40e: add max boundary check for VF filters
  - !18151  ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
  - !18152  fs/buffer: fix use-after-free when call bh_read() helper
  - !18312  ext4: preserve SB_I_VERSION on remount
  - !18313  fs: quota: create dedicated workqueue for quota_release_work
  - !18311  ext4: fix an off-by-one issue during moving extents
  - !17401  fscrypt: Don't use problematic non-inline crypto engines
  - KVM: arm64: vgic-v4: Restore pending state on host userspace write
  - !18237  fuse: support sysfs api for flush and
  - !18422  net/hinic3: Modify driver version
  - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  - !18425  Fix CVE-2025-39989
  - !18427  i40e: fix idx validation in config queues msg
  - i40e: fix idx validation in config queues msg
  - x86/mce: use is_copy_from_user() to determine copy-from-user context
  - x86/extable: Remove unused fixup type EX_TYPE_COPY
  - net/hinic3: Modify driver version
  - !18414 Fix add define COMPAT_ELF_HWCAP3
  - !18406  pcmcia: Add error handling for add_interval() in do_validate_mem()
  - sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
  - !18401  Bluetooth: btrtl: Prevent potential NULL dereference
  - !18241 ras: ACPI: HED: Always initialize before evged
  - Fix add define COMPAT_ELF_HWCAP3
  - !17928 bus: fsl-mc: fix double-free on mc_dev
  - !17908 fix CVE-2025-38630
  - !18224 fix CVE-2025-38624
  - !17871 f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
  - !17877 fs/ntfs3: cancle set bad inode after removing name fails
  - !17909 fix CVE-2025-38555
  - !17872 f2fs: fix to avoid panic in f2fs_evict_inode
  - !17760 Fix CVE-2025-38414
  - !17611 net: ravb: Fix missing rtnl lock in suspend/resume path
  - !17859 f2fs: fix to bail out in get_new_segment()
  - !17354 net/atm/resources: Release atm_dev_mutex after removing procfs in atm_…
  - !18032 [OLK-6.6] Fix CVE-2025-37897
  - !18030 [OLK-6.6] Fix CVE-2025-37914
  - !18037 [OLK-6.6] Fix CVE-2025-37917
  - !18036 [OLK-6.6] Fix CVE-2025-37922
  - !18035 [OLK-6.6] Fix CVE-2025-37935
  - !18034 [OLK-6.6] Fix CVE-2025-37931
  - !18033 [OLK-6.6] Fix CVE-2025-37901
  - !18028 [OLK-6.6] Fix CVE-2025-37987
  - !18027 [OLK-6.6] Fix CVE-2025-37983
  - !17807 Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802
  - pcmcia: Add error handling for add_interval() in do_validate_mem()
  - !18326 [OLK-6.6] Support Hygon TKM (Trusted Key Management) Guest live migration
  - !18199  block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
  - !18131  loop: Avoid updating block size under exclusive owner
  - !18006  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - !18402  kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
  - !18249 enfs: add new path state PM_STATE_UNSTABLE
  - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
  - Bluetooth: btrtl: Prevent potential NULL dereference
  - nfs/enfs: cleanups in pm_set_path_state()
  - nfs/enfs: prefer normal rpc transport over unstable one
  - nfs/enfs: introduce reconnect time KUnit tests
  - nfs/enfs: set PM_STATE_UNSTABLE if path is unstable
  - nfs/enfs: introduce enum PM_STATE_UNSTABLE
  - !18357  *** OLK-6.6-fix-CVE-2025-39787 ***
  - !18374  locking/qspinlock: Fix CNA NUMA node setup before numa_store_cpu_info()
  - !18362  umount performance fix
  - locking/qspinlock: Fix CNA NUMA node setup before numa_store_cpu_info()
  - do_make_slave(): choose new master sanely
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED()
  - change_mnt_propagation() cleanups, step 1
  - soc: qcom: mdt_loader: Deal with zero e_shentsize
  - soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header
  - crypto: ccp: ensure kvm_bind_vtkm is only executed once for csv guest
  - crypto: ccp: support vtkm live migration
  - arm64: Enable vmalloc-huge with ptdump
  - arm64: Restrict pagetable teardown to avoid false warning
  - fs: quota: create dedicated workqueue for quota_release_work
  - ext4: preserve SB_I_VERSION on remount
  - ext4: fix an off-by-one issue during moving extents
  - mm: drop all references of writable and SCAN_PAGE_RO
  - mm: enable khugepaged anonymous collapse on non-writable regions
  - khugepaged: pass folio instead of head page to trace events
  - ras: ACPI: HED: Always initialize before evged
  - fuse: fix issues in fuse_resend_pqueue() implementation
  - fuse: Introduce sysfs API for resend pending requests
  - fuse: Introduce sysfs API for flushing pending requests
  - PCI: pnv_php: Clean up allocated IRQs on unplug
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
  - EDAC/{skx_common,i10nm}: Use scnprintf() for safer buffer handling
  - EDAC/i10nm: Add Intel Granite Rapids-D support
  - EDAC/i10nm: Fix the bitwise operation between variables of different sizes
  - EDAC/{skx_common,i10nm}: Add RRL support for Intel Granite Rapids server
  - EDAC/{skx_common,i10nm}: Refactor show_retry_rd_err_log()
  - EDAC/{skx_common,i10nm}: Refactor enable_retry_rd_err_log()
  - EDAC/{skx_common,i10nm}: Structure the per-channel RRL registers
  - EDAC/i10nm: Explicitly set the modes of the RRL register sets
  - EDAC/{i10nm,skx,skx_common}: Support UV systems
  - EDAC/i10nm: Add Intel Clearwater Forest server support
  - EDAC/{skx_common,i10nm}: Remove the AMAP register for determing DDR5
  - EDAC/{skx_common,skx,i10nm}: Move the common debug code to skx_common
  - EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0
  - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
  - EDAC/i10nm: Add Intel Grand Ridge micro-server support
  - platform/x86/intel/ifs: Add Clearwater Forest to CPU support list
  - fs/buffer: fix use-after-free when call bh_read() helper
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
  - loop: Avoid updating block size under exclusive owner
  - openeuler_defconfig: Add CONFIG_HISILICON_ERRATUM_162100803
  - irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C/HIP12 erratum 162100803/162200807/162400807/165010802
  - net/atm/resources: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE
  - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
  - btrfs: adjust subpage bit start based on sectorsize
  - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
  - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
  - net_sched: ets: Fix double list add in class with netem as child qdisc
  - pds_core: Prevent possible adminq overflow/stuck condition
  - qibfs: fix _another_ leak
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - bus: fsl-mc: fix double-free on mc_dev
  - usb: gadget : fix use-after-free in composite_dev_cleanup()
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
  - fs/ntfs3: cancle set bad inode after removing name fails
  - f2fs: fix to bail out in get_new_segment()
  - net: ravb: Fix missing rtnl lock in suspend/resume path
  - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
  - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
  - f2fs: fix to avoid panic in f2fs_evict_inode
  - fscrypt: Don't use problematic non-inline crypto engines


author: Li Nan <linan122@huawei.com> - 6.6.0-114.0.0.120
changelog:
  - !18640 v3  Errata management for VM Live migration
  - !18638  CVE-2025-39982
  - !18564  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  - !18639 net: hns3: fix null pointer in debugfs issue
  - KVM: arm64: fix kvm kabi conflict
  - smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI
  - smccc: kvm_guest: Fix kernel builds for 32 bit arm
  - smccc/kvm_guest: Enable errata based on implementation CPUs
  - arm64: Make  _midr_in_range_list() an exported function
  - KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2
  - KVM: arm64: Specify hypercall ABI for retrieving target implementations
  - arm64: Modify _midr_range() functions to read MIDR/REVIDR internally
  - KVM: arm64: Allow userspace to change the implementation ID registers
  - KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value
  - KVM: arm64: Maintain per-VM copy of implementation ID regs
  - KVM: arm64: Set HCR_EL2.TID1 unconditionally
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
  - !18624 tools headers arm64: Sync arm64's cputype.h with the kernel sources
  - !18622 support mempool feature
  - net: hns3: fix null pointer in debugfs issue
  - net: hns3: avoid bitwise copy during RX buffer replace leg when page pool enabled
  - net: hns3: fixed vf get max channels bug
  - net: hns3: `req_autoneg` for fiber is initialized to `support_autoneg` instead of OFF.
  - net: hns3: use user configure after hardware reset when using kernel PHY.
  - net: hns3: Return error code when function fails.
  - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx
  - net: hns3: using the num_tqps in the vf driver to apply for resources
  - net: hns3: add support to query tc map info of VF queues
  - net: hns3: merge rss tc configuration
  - net: hns3: add ieee_setmaxrate and ieee_getmaxrate support for pf
  - !18550  cpu/SMT: recover global num_threads after disable smt switch fail
  - !18589 net: hibmcge: support pci_driver.shutdown()
  - !18579  regulator: core: fix NULL dereference on unbind due to stale coupling data
  - !18415  sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
  - !18593  crypto: essiv - Check ssize for decryption and in-place encryption
  - tools headers arm64: Sync arm64's cputype.h with the kernel sources
  - tools headers arm64: Sync arm64's cputype.h with the kernel sources
  - tools/include: Sync arm64 headers with the kernel sources
  - tools/include: Sync arm64 asm/cputype.h with the kernel sources
  - openeuler_defconfig: enable CONFIG_PFN_RANGE_ALLOC by default
  - mm/pfn_range_alloc: check if folio is hwpoisoned in pfn_range_free
  - mm/pfn_range_alloc: add a interface to show borrowable physical range
  - mm/pfn_range_alloc: support update cachable attribue of linear mapping
  - mm/pfn_range_alloc: introduce set_linear_mapping_invalid
  - mm/pfn_range_alloc: introduce hugetlb_pool_alloc_size
  - mm/pfn_range_alloc: add tracepoint for hugetlb_pool_alloc and hugetlb_pool_free
  - mm/pfn_range_alloc: add tracepoint for pfn_range_alloc and pfn_range_free
  - mm/pfn_range_alloc: support allocate and free from hugetlb pool
  - mm/pfn_range_alloc: add interfaces to alloc/free for drivers
  - mm/pfn_range_alloc: reserve memory for each node
  - mm/contig_alloc: fix alloc_contig_range when __GFP_COMP and order < MAX_ORDER
  - mm: page_alloc: speed up fallbacks in rmqueue_bulk()
  - mm/page_alloc: clarify should_claim_block() commentary
  - mm/page_alloc: clarify terminology in migratetype fallback code
  - mm/page_alloc: add some detailed comments in can_steal_fallback
  - mm: page_alloc: remove remnants of unlocked migratetype updates
  - mm: page_alloc: don't steal single pages from biggest buddy
  - mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
  - mm/page_alloc: forward the gfp flags from alloc_contig_range() to post_alloc_hook()
  - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
  - mm/page_alloc: make __alloc_contig_migrate_range() static
  - mm/page_isolation: don't pass gfp flags to isolate_single_pageblock()
  - mm/contig_alloc: support __GFP_COMP
  - mm: remove unused has_isolate_pageblock
  - mm: page_alloc: simpify page del and expand
  - mm: remove migration for HugePage in isolate_single_pageblock()
  - mm/page_alloc: keep track of free highatomic
  - mm: page_alloc: fix highatomic typing in multi-block buddies
  - mm: page_alloc: batch vmstat updates in expand()
  - mm: page_alloc: change move_freepages() to __move_freepages_block()
  - mm: page_alloc: consolidate free page accounting
  - mm: page_isolation: prepare for hygienic freelists
  - mm: page_alloc: set migratetype inside move_freepages()
  - mm: page_alloc: close migratetype race between freeing and stealing
  - mm: page_alloc: fix freelist movement during block conversion
  - mm: page_alloc: fix move_freepages_block() range error
  - mm: page_alloc: move free pages when converting block during isolation
  - mm: page_alloc: fix up block types when merging compatible blocks
  - mm: page_alloc: optimize free_unref_folios()
  - mm: page_alloc: remove pcppage migratetype caching
  - mm: page_alloc: simplify __free_pages_ok()
  - mm/page_alloc: remove unnecessary next_page in break_down_buddy_pages
  - mm/page_alloc: remove unnecessary check in break_down_buddy_pages
  - !18608  mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled
  - !18588 add memory ras feature support
  - mm: add memory reclaim notifier
  - mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled
  - panic: add notifier call before other cpu shutdown
  - !18592  Make ID reg writable
  - crypto: essiv - Check ssize for decryption and in-place encryption
  - KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change
  - KVM: arm64: Make AA64PFR1_EL1.NMI writeable
  - KVM: arm64: Expose S1PIE to guests
  - KVM: arm64: Sanitise ID_AA64MMFR3_EL1
  - KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
  - KVM: arm64: Make ID_AA64MMFR1_EL1.{HCX, TWED} writable from userspace
  - KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX
  - KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace
  - KVM: arm64: rename functions for invariant sys regs
  - KVM: arm64: show writable masks for feature registers
  - KVM: arm64: Treat CTR_EL0 as a VM feature ID register
  - KVM: arm64: Add helper for writing ID regs
  - KVM: arm64: Use read-only helper for reading VM ID registers
  - KVM: arm64: Only reset vCPU-scoped feature ID regs once
  - KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs()
  - KVM: arm64: Rename is_id_reg() to imply VM scope
  - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
  - KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace
  - KVM: arm64: Document vCPU feature selection UAPIs
  - KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1
  - KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1
  - KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1
  - KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1
  - KVM: arm64: Bump up the default KVM sanitised debug version to v8p8
  - KVM: arm64: Reject attempts to set invalid debug arch version
  - KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version
  - KVM: arm64: Use guest ID register values for the sake of emulation
  - KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS
  - KVM: arm64: Allow userspace to get the writable masks for feature ID registers
  - net: hibmcge: support pci_driver.shutdown()
  - net: hibmcge: select FIXED_PHY
  - !18568 support NUMA.remote feature
  - !18498  serial: 8250: fix panic due to PSLVERR
  - regulator: core: fix NULL dereference on unbind due to stale coupling data
  - !18409 crypto: hisilicon - support for new ZIP features
  - !18545  HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
  - !18563  arm64/mpam: Fix L2 MBWU monitor multiplexing issue
  - mm/numa_remote: add kernel doc for numa remote feature
  - mm/numa_remote: extend cmdline numa_remote to limit the max number of remote node
  - mm: memory-failure: use kill_accessing_process() in ghes
  - mm: memory-failure: remove task_struct from kill_accessing_process()
  - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
  - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
  - arm64: configs: enable NUMA_REMOTE by default
  - mm/numa_remote: enable oom_kill_cpuless_numa_allocating_task when numa_remote is enabled
  - mm/oom_kill: kill current in OOM when binding to cpu-less nodes
  - mm/numa_rmeote: add preonline interface for each memory device
  - mm/numa_remote: add pre-online count in meminfo
  - mm/numa_remote: add sysfs to distinguish whether a remote node
  - mm/numa_remote: introduce hugetlb_nowatermark mode for remote node
  - mm/numa_remote: undo isolation of remote memory asynchronously
  - mm/numa_remote: introduce pre-online mode to support hotplug unready memory
  - mm/numa_remote: introduce nofallback mode for remote node
  - mm/numa_remote: support to set node distance
  - mm/numa_remote: support to hotplug/hotremove remote memory
  - mm/numa_remote: prepare numa node for remote memory
  - mm/memory_hotplug: support to hotplug memory on ZONE_EXTMEM
  - mm/hugetlb: fix folio is still mapped when deleted
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  - arm64/mpam: Fix L2 MBWU monitor multiplexing issue
  - !18559  arm64/mpam: Fix MBWU monitor overflow handling
  - !18544  fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups
  - !18536  arm-smmu-v3: add 'HIP10C' for 162100602 errata
  - !18130 Net: nebula_matrix: set nebula_matrix driver to a newer state
  - !16777 RNPGBE: NET: Fix dmesg 'unknow speed' show when 1000M
  - arm64/mpam: Print MPAM register operation for debug
  - arm64/mpam: Fix MBWU monitor overflow handling
  - cpu/SMT: recover global num_threads after disable smt switch fail
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
  - fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups
  - !17676 [OLK-6.6] Backported patches of Transient Scheduler Attacks (TSA)
  - arm-smmu-v3: add 'HIP10C' for 162100602 errata
  - !18533 [OLK-6.6]:update patches for sw64 architecture
  - !18516  arm64: Add support for HIP09 Spectre-BHB mitigation
  - !18457  arm64: add cnp verification on Hisilicon erratum 162100125
  - !18513  Fix CVE-2025-39679
  - !18531  arm/syscalls: mark syscall invocation as likely in
  - !11635  arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
  - !18507 Fix wrong CPU aff3 conversion between  MPIDR and SYS_LSUDVMBM_EL2
  - sw64: add CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y to defconfig
  - sw64: fix the condition for enabling hw_una_enabled
  - sw64: efi: fix compile error when CONFIG_EFI=n
  - sw64: powercap: fix misuse of an uninitialized temporary variable
  - sw64: powercap: increase the interval of polling mode
  - sw64: powercap: fix Kconfig dependency for SW64_POWERCAP
  - sw64: powercap: avoid checking meaningless target freq
  - sw64: smp: fix unaligned access before trap_init()
  - sw64: irqchip: update effective affinity for INTx
  - sw64: msi: fix affinity change of managed irq
  - sw64: use orig_r0 as syscall nr
  - sw64: revert ioremap() to __va() in ioport_map()
  - sw64: fix unresolved reference error when close pci
  - sw64: kvm: add the C4 kvm_regs structure to uapi kvm.h
  - arm/syscalls: mark syscall invocation as likely in invoke_syscall
  - !18517  media: rc: fix races with imon_disconnect()
  - !18327 net: ubl: add CONFIG_UB_UBL definition and UBL interface
  - !18488 RDMA/hns: Fix wrong WQE data when QP wraps around
  - KVM: hisi_virt: tlbi: Fix wrong CPU aff3 conversion between MPIDR and SYS_LSUDVMBM_EL2
  - media: rc: fix races with imon_disconnect()
  - arm64: Add support for HIP09 Spectre-BHB mitigation
  - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
  - !18495  CVE-2025-39967
  - !18258  perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions and Don't use PMCCNTR_EL0 on SMT cores
  - serial: 8250: fix panic due to PSLVERR
  - fbcon: Fix OOB access in font allocation
  - fbcon: fix integer overflow in fbcon_do_set_font
  - !16738 perf vendor events arm64: Add N2, V2, N3, V3 events/metrics
  - !18385  e1000e: fix heap overflow in e1000_set_eeprom
  - !18395  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - config: enable CONFIG_MITIGATION_TSA and CONFIG_KVM_HYPERV by default on x86
  - x86/cpu: Shorten CPU matching macro
  - platform/x86/intel/ifs: Switch to new Intel CPU model defines
  - x86/microcode/AMD: Handle the case of no BIOS microcode
  - KVM: SVM: Advertise TSA CPUID bits to guests
  - tools headers: Sync x86 headers with the kernel source
  - x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
  - x86/microcode/AMD: Add some forgotten models to the SHA check
  - x86/CPU/AMD: Terminate the erratum_1386_microcode array
  - x86/microcode/AMD: Split load_microcode_amd()
  - x86/microcode/AMD: Pay attention to the stepping dynamically
  - KVM: x86: hyper-v: Remove unused inline function kvm_hv_free_pa_page()
  - x86/microcode/intel: Set new revision only after a successful update
  - x86/platform/atom: Switch to new Intel CPU model defines
  - x86/process: Move the buffer clearing before MONITOR
  - x86/microcode/AMD: Add TSA microcode SHAs
  - x86/microcode/AMD: Load only SHA256-checksummed patches
  - x86/microcode/AMD: Add get_patch_level()
  - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite
  - x86/microcode/AMD: Remove unused save_microcode_in_initrd_amd() declarations
  - x86/microcode/AMD: Remove ret local var in early_apply_microcode()
  - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID
  - x86/microcode/AMD: Avoid -Wformat warning with clang-15
  - x86/microcode/AMD: Have __apply_microcode_amd() return bool
  - x86/microcode/AMD: Flush patch buffer mapping after application
  - x86/microcode: Rework early revisions reporting
  - x86/bugs: Add a Transient Scheduler Attacks mitigation
  - x86/bugs: Rename MDS machinery to something more generic
  - x86/idle: Use MONITOR and MWAIT mnemonics in <asm/mwait.h>
  - KVM: x86: Swap incoming guest CPUID into vCPU before massaging in KVM_SET_CPUID2
  - KVM: x86: Explicitly do runtime CPUID updates "after" initial setup
  - KVM: x86: Rename kvm_cpu_cap_mask() to kvm_cpu_cap_init()
  - x86/cpu: Expose only stepping min/max interface
  - x86/cpu: Introduce new microcode matching helper
  - cpufreq: intel_pstate: Switch to new Intel CPU model defines
  - cpufreq: Switch to new Intel CPU model defines
  - EDAC/skx: Switch to new Intel CPU model defines
  - EDAC/i10nm: Switch to new Intel CPU model defines
  - x86/aperfmperf: Switch to new Intel CPU model defines
  - x86/apic: Switch to new Intel CPU model defines
  - x86/bugs: Switch to new Intel CPU model defines
  - x86/CPU/AMD: Improve the erratum 1386 workaround
  - cpufreq: intel_pstate: Update default EPPs for Meteor Lake
  - cpufreq: intel_pstate: Update hybrid scaling factor for Meteor Lake
  - KVM: x86: Make Hyper-V emulation optional
  - KVM: nVMX: Split off helper for emulating VMCLEAR on Hyper-V eVMCS
  - KVM: VMX: Split off hyperv_evmcs.{ch}
  - net: ubl: add CONFIG_UB_UBL definition and UBL interface
  - RDMA/hns: Fix wrong WQE data when QP wraps around
  - arm64: add cnp verification on Hisilicon erratum 162100125
  - net:nebula-matrix:Add S1000 SNIC driver support
  - sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
  - crypto: hisilicon/qm - clear all VF configurations in the hardware
  - Revert "crypto: hisilicon/qm - fix vfs_num error"
  - crypto: hisilicon/qm - invalidate queues in use
  - Revert "crypto: hisilicon/qm - invalidate queues in use"
  - Revert "crypto: hisilicon/qm - clear the memory before enabling the device"
  - crypto: hisilicon/zip - add hashjoin, gather, and UDMA data move features
  - crypto: hisilicon/zip - add lz4 and lz77_only to algorithm sysfs
  - crypto: hisilicon/sec2 - Fix false-positive warning of uninitialised qp_ctx
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - e1000e: fix heap overflow in e1000_set_eeprom
  - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores
  - perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions
  - RNPGBE: NET: Fix dmesg 'unknow speed' show when 1000M
  - perf vendor events arm64: Add V3 events/metrics
  - perf vendor events arm64: Add N3 events/metrics
  - perf vendor events arm64: Add FUJITSU-MONAKA PMU event
  - perf vendor events arm64: Update N2/V2 events from source
  - arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differe
  nces


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-40
changelog:
  - hw/acpi: Fix the memory leak issue
  - virtio-net: Fix num_buffers for version 1
  - hw/net/cadence_gem: fix register mask initialization
  - memory: Export a helper to get intersection of a MemoryRegionSection with a given range
  - memory: Change memory_region_set_ram_discard_manager() to return the result
  - memory: Unify the definiton of ReplayRamPopulate() and ReplayRamDiscard()
  - memory: Introduce generic state change parent class for RamDiscardManager
  - memory: Introduce PrivateSharedManager Interface as child of GenericStateManager
  - memory: Add the support for PrivateSharedManager Interface
  - vfio: Add the support for PrivateSharedManager Interface
  - memory: Change NotifyStateClear() definition to return the result
  - ram-block-attribute: Add priority listener support for PrivateSharedListener
  - linux-headers: Add KVM Arm RME definitions to Linux headers
  - kvm: Use kvm_vm_check_extension() where necessary
  - include/qom/object.h: New OBJECT_DEFINE_SIMPLE_TYPE{, _WITH_INTERFACES} macros
  - target/arm: Add confidential guest support
  - KVM: track whether guest state is encrypted
  - target/arm/kvm: Return immediately on error in kvm_arch_init()
  - target/arm/kvm: Split kvm_arch_get/put_registers
  - target/arm/kvm: Create scratch VM as Realm if necessary
  - hw/core/loader: Add ROM loader notifier
  - target/arm/kvm-rme: Initialize realm
  - target/arm/kvm-rme: Initialize vCPU
  - target/arm/kvm-rme: Initialize Realm memory
  - target/arm/kvm-rme: Add Realm Personalization Value parameter
  - target/arm/kvm-rme: Add measurement algorithm property
  - target/arm/cpu: Set number of breakpoints and watchpoints in KVM
  - target/arm/cpu: Set number of PMU counters in KVM
  - target/arm/cpu: Inform about reading confidential CPU registers
  - target/arm/kvm-rme: Initialize Realm memory
  - target/arm/kvm-rme: Add Realm Personalization Value parameter
  - target/arm/kvm-rme: Add measurement algorithm property
  - hw/arm/virt: Add support for Arm RME
  - hw/arm/virt: Disable DTB randomness for confidential VMs
  - hw/arm/virt: Reserve one bit of guest-physical address for RME
  - hw/arm/virt: Move virt_flash_create() to machvirt_init()
  - hw/arm/virt: Use RAM instead of flash for confidential guest firmware
  - hw/core/loader: Add ROM loader notifier
  - target/arm/kvm-rme: Initialize Realm memory
  - target/arm/kvm-rme: Add measurement algorithm property
  - target/arm/kvm-rme: Add Realm Personalization Value parameter
  - target/arm/kvm-rme: Initialize Realm memory
  - hw/arm/boot: Mark all guest memory as RIPAS_RAM.
  - target/arm/kvm-rme: Add DMA remapping for the shared memory region
  - hw/arm/virt: Move virt_flash_create() to machvirt_init()
  - hw/arm/virt: Use RAM instead of flash for confidential guest firmware
  - hw/core/loader: Add fields to RomLoaderNotify
  - docs/interop/firmware.json: Add arm-rme firmware feature
  - hw/arm/boot: Load DTB as is for confidential VMs
  - hw/arm/boot: Skip bootloader for confidential guests
  - hw/tpm: Add TPM event log
  - hw/core/loader: Add fields to RomLoaderNotify
  - hw/arm/virt: Use RAM instead of flash for confidential guest firmware
  - hw/arm/virt: Reserve one bit of guest-physical address for RME
  - hw/arm/virt: Disable DTB randomness for confidential VMs
  - hw/arm/virt: Add support for Arm RME
  - target/arm/cpu: Inform about reading confidential CPU registers
  - target/arm/cpu: Set number of PMU counters in KVM
  - target/arm/cpu: Set number of breakpoints and watchpoints in KVM
  - target/arm/kvm-rme: Add measurement algorithm property
  - target/arm/kvm-rme: Add Realm Personalization Value parameter
  - target/arm/kvm-rme: Initialize Realm memory
  - hw/core/loader: Add ROM loader notifier
  - target/arm/kvm: Create scratch VM as Realm if necessary
  - target/arm/kvm-rme: Initialize vCPU
  - target/arm/kvm: Split kvm_arch_get/put_registers
  - target/arm/kvm-rme: Initialize realm
  - KVM: track whether guest state is encrypted
  - target/arm/kvm: Return immediately on error in kvm_arch_init()
  - target/arm: Add confidential guest support
  - include/qom/object.h: New OBJECT_DEFINE_SIMPLE_TYPE{, _WITH_INTERFACES} macros
  - kvm: Use kvm_vm_check_extension() where necessary
  - linux-headers: Add KVM Arm RME definitions to Linux headers
  - docs/interop/firmware.json: Add arm-rme firmware feature
  - hw/arm/boot: Load DTB as is for confidential VMs
  - hw/arm/boot: Skip bootloader for confidential guests
  - hw/tpm: Add TPM event log
  - hw/core/loader: Add fields to RomLoaderNotify
  - hw/arm/virt: Use RAM instead of flash for confidential guest firmware
  - hw/arm/virt: Move virt_flash_create() to machvirt_init()
  - target/arm/kvm-rme: Add DMA remapping for the shared memory region
  - hw/arm/boot: Mark all guest memory as RIPAS_RAM.
  - hw/arm/virt: Reserve one bit of guest-physical address for RME
  - hw/arm/virt: Disable DTB randomness for confidential VMs
  - hw/arm/virt: Add support for Arm RME
  - target/arm/cpu: Inform about reading confidential CPU registers
  - target/arm/cpu: Set number of PMU counters in KVM
  - target/arm/cpu: Set number of breakpoints and watchpoints in KVM
  - target/arm/kvm-rme: Add measurement algorithm property
  - target/arm/kvm-rme: Add Realm Personalization Value parameter
  - target/arm/kvm-rme: Initialize Realm memory
  - hw/core/loader: Add ROM loader notifier
  - target/arm/kvm: Create scratch VM as Realm if necessary
  - target/arm/kvm-rme: Initialize vCPU
  - target/arm/kvm: Split kvm_arch_get/put_registers
  - target/arm/kvm-rme: Initialize realm
  - KVM: track whether guest state is encrypted
  - target/arm/kvm: Return immediately on error in kvm_arch_init()
  - target/arm: Add confidential guest support
  - include/qom/object.h: New OBJECT_DEFINE_SIMPLE_TYPE{, _WITH_INTERFACES} macros
  - kvm: Use kvm_vm_check_extension() where necessary
  - linux-headers: Add KVM Arm RME definitions to Linux headers
  - Bugfix: Fix compile error in aarch32.


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-41
changelog:
  - target/i386/kvm: Refine VMX controls setting for backward compatibility
  - Bugfix: Correctly set vms->bootinfo.confidential in virtCCA senarios.
  - hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
  - hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
  - hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
  - hw/riscv: virt: Make few IMSIC macros and functions public
  - hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
  - hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
  - hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
  - hw/pci-host/gpex: Define properties for MMIO ranges
  - hw/riscv/virt: Update GPEX MMIO related properties
  - hw/riscv/virt-acpi-build.c: Add IO controllers and devices
  - hw/riscv/virt-acpi-build.c: Add PLIC in MADT
  - hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
  - hw/riscv/virt-acpi-build.c: Add namespace devices for PLIC and APLIC
  - hw/riscv/virt-acpi-build.c: Update the HID of RISC-V UART
  - hw/riscv/virt-acpi-build.c: Generate SPCR table
  - hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables
  - plugins/loader: fix deadlock when resetting/uninstalling a plugin
  - smbios: Fix buffer overrun when using path= option


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-42
changelog:
  - migration: show error message when postcopy fails
  - docs/about/emulation: Fix broken link
  - update include/hw/xen/arch_hvm.h.
  - hw/display/qxl-render: fix qxl_unpack_chunks() chunk size calculation
  - hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU device
  - amd_iommu: Use correct bitmask to set capability BAR
  - amd_iommu: Use correct DTE field for interrupt passthrough
  - tcg: Reset data_gen_ptr correctly
  - hw/virtio: fix -Werror=maybe-uninitialized


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-43
changelog:
  - util/timer: fix -Werror=maybe-uninitialized false-positive
  - hw/qxl: fix -Werror=maybe-uninitialized false-positives
  - nbd: fix -Werror=maybe-uninitialized false-positive
  - block/mirror: fix -Werror=maybe-uninitialized false-positive
  - hw/ahci: fix -Werror=maybe-uninitialized false-positive
  - hw/sdhci: fix -Werror=maybe-uninitialized false-positive
  - migration: fix -Werror=maybe-uninitialized false-positive
  - qemu-img: improve queue depth validation in img_bench


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-44
changelog:
  - qemu-img: fix division by zero in bench_cb() for zero-sized images
  - target/i386: cpu: set correct supported XCR0 features for TCG
  - target/i386: do not rely on ExtSaveArea for accelerator-supported XCR0 bits
  - target/i386: return bool from x86_cpu_filter_features
  - target/i386: add AVX10 feature and AVX10 version property
  - target/i386: add CPUID.24 features for AVX10
  - target/i386: Add feature dependencies for AVX10
  - target/i386: Add AVX512 state when AVX10 is supported
  - target/i386: Introduce GraniteRapids-v2 model
  - i386/cpu: Mark avx10_version filtered when prefix is NULL
  - target/i386: add avx-vnni-int16 feature
  - block/stream: fix -Werror=maybe-uninitialized false-positives
  - migration: fix -Werror=maybe-uninitialized false-positives
  - hw/ssi/xilinx_spips: Fix flash erase assert in dual parallel configuration
  - hw/nvme: cap MDTS value for internal limitation
  - accel/kvm: Make kvm_has_guest_debug static
  - vtarget/arm/tcg: Including missing 'exec/exec-all.h' header
  - system/qtest: Include missing 'hw/core/cpu.h' header
  - qemu-options: Clarify handling of commas in options parameters


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-45
changelog:
  - tests/unit/test-qmp-event: Drop superfluous mutex
  - configure: use a native non-cross compiler for linux-user
  - target/riscv/kvm: do not use non-portable strerrorname_np()
  - qemu-options: Unify the help entries for cocoa
  - virtio: rng: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - vhost-scsi: fix usage of error_reportf_err()
  - esp: check for NULL result from scsi_device_find()
  - migration: fix coverity migrate_mode finding
  - hw/core/cpu: Remove final vestiges of dynamic state tracing
  - target/riscv: Fix mcycle/minstret increment behavior
  - chardev/char.c: fix "abstract device type" error message
  - hw/net: cadence_gem: Fix MDIO_OP_xxx values


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-47
changelog:
  - vdpa: Allow vDPA to work on big-endian machine
  - vfio/container: Replace basename with g_path_get_basename
  - vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
  - vfio/pci: Clear MSI-X IRQ index always
  - hw/arm boot.c: Enforce CCA and virtCCA isolation.
  - block/qed: fix use-after-free by nullifying timer pointer after free
  - hw/gpio: npcm7xx: fixup out-of-bounds access
  - pci/msix: Fix msix pba read vector poll end calculation
  - physmem: fix qemu_ram_alloc_from_fd size calculation
  - s390x/s390-virtio-ccw: don't crash on weird RAM sizes
  - ssh: Do not switch session to non-blocking mode
  - target/ppc: Fix mtDPDES targeting SMT siblings
  - target/ppc: Fix non-maskable interrupt while halted
  - elfload: Fix alignment when unmapping excess reservation


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-48
changelog:
  - target/s390x: Fix MVC not always invalidating translation blocks
  - target/sparc: Fix gdbstub incorrectly handling registers f32-f62
  - virtio-net: Fix size check in dhclient workaround
  - vdpa: Fix endian bugs in shadow virtqueue
  - x86/loader: only patch linux kernels
  - target/ppc: Fix e200 duplicate SPRs
  - vfio/container: For CSV3 VM, only register listener to shared_memory_listener list in vfio_connect_container()
  - target/riscv/kvm: update the KVM regs to Linux rvck-6.6
  - target/riscv/kvm: Fix exposure of Zkr
  - hw/arm/virt: Introduce a IPIV machine option
  - hw/vfio/migration: Fix vfio migration isn't aborted in a corner case


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-49
changelog:
  - common-user/host/riscv: use tail pseudoinstruction for calling tail
  - meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
  - qga: fix potentially not initialized nr_volumes in qga_vss_fsfreeze()
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint(CVE-2024-8354)
  - hw/usb/hcd-xhci: Unmap canceled packet
  - meson: Use has_header_symbol() to check getcpu()
  - hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
  - migration: fix SEEK_CUR offset calculation in qio_channel_block_seek


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


