# changelog

author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: xingwei <xingwei14@h-partners.com> - 1:5.9.1-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
  	IF-MIB: pass the network interface index to net
  	IF-MIB: fix a memory leak
  	IF-MIB: fix a recently introduced use after free
  	IF-MIB: add a trailing newline to an error message


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix crash in json_parse_set_stmt_list
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: eaglegai <eaglegai@163.com> - 1:1.0.8-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: don't allow nat map with specified protocol
         rule: return error if table does not exist
         json: make sure timeout list is initialised
         evaluate: don't update cache for anonymous chains
         json: return error if table does not exist
         json: don't BUG when asked to list synproxies
         evaluate: compact STMT_F_STATEFUL checks
         evaluate: only allow stateful statements in set and map definitions
         optimize: expand expression list when merging into concatenation
         netlink: fix stack overflow due to erroneous rounding
         netlink: bogus concatenated set ranges with netlink message overrun
         netlink: fix crash when ops doesn't support udata
         netlink: Catch unknown types when deserializing objects
         netlink: Avoid potential NULL-ptr deref parsing set elem expressions
         netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY
         evaluate: don't BUG on unexpected base datatype
         src: BASECHAIN flag no longer implies presence of priority expression
         parser_bison: only reset by name is supported by now


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         segtree: fix string data initialisation
         src: netlink: netlink_delinearize_table() may return NULL
         src: ensure chain policy evaluation when specified
         src: fix memory leak in anon chain error handling
         mnl: silence compiler warning
         datatype: Increase symbolic constant printer robustness
         evaluate: follow prefix expression recursively if needed


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:The python-setup tools causes an error in the nftables packaging path,This macro is added to ensure that path remains unchanged


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: xingwei <xingwei14@h-partners.com> - 2:7.92-4
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:decouple from PCRE because it has been End-of-life, use local libpcre to build instead


author: wangkai <13474090681@163.com> - 1:20.11.1-1
changelog:
  - Update to 20.11.1
  - Fix CVE-2023-46809 CVE-2024-21896 CVE-2024-22019 CVE-2024-21892 CVE-2024-24758 CVE-2024-22025


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: yyjeqhc <jialin.oerv@isrc.iscas.ac.cn> - 0.2.17-3
changelog:
  - Migrated legacy `import pango` and `pangocairo` usage to modern PyGObject (`gi.repository.Pango`, `PangoCairo`)
  - Replaced all legacy constants (`pango.STRETCH_...`) with `Pango.Stretch.XXX` enums


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: renmingshuai<renmingshuai@huawei.com> - 9.3p1-3
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: bitianyuan <bitianyuan@huawei.com> - 9.3p2-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: wangcheng <wangcheng156@huawei.com> - 1:3.0.12-1
changelog:
  - Upgrade to 3.0.12
    Resolves: CVE-2023-0464
    Resolves: CVE-2023-0465
    Resolves: CVE-2023-0466
    Resolves: CVE-2023-1255
    Resolves: CVE-2023-2650
    Resolves: CVE-2023-5363
    Resolves: CVE-2023-6237
    Resolves: CVE-2023-6129
    Resolves: CVE-2023-5678
    Resolves: CVE-2024-0727


author: fly_fzc <2385803914@qq.com> - 1:3.0.12-24
changelog:
  - fix CVE-2025-15467,CVE-2025-69418,
        CVE-2025-69419,CVE-2025-69420,
        CVE-2025-69421,CVE-2026-22795,
        CVE-2026-22796


author: baiguo <baiguo@kylinos.cn> - 0.4.34-2
changelog:
  - Use vasprintf() if available for error messages and otherwise vsnprintf();orccompiler, orcparse: Use secure UCRT printing functions on Windows


author: wangkai <13474090681@163.com> - 6.2.2-4
changelog:
  - Fix CVE-2024-45769,CVE-2024-45770
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57805)
  - Guard against symlink attacks in pmpost program (RHEL-57810)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58306)
  - Updated pmdahacluster for newer crm_mon versions (RHEL-50693)


author: hugel <gengqihu2@h-partners.com> - 10.42-12
changelog:
  - DESC:sync patches from upstream
         backport-Further-ASCII-tests-and-minor-bugfix-plus-ChangeLog-.patch
         backport-avoid-inconsistency-between-d-and-digit-when-using-a.patch
         backport-Fix-the-lookahead-after-d-or-posix-to-skip-whitespac.patch
         backport-Improve-error-offsets-for-character-classes-548.patch
         backport-Non-recursive-scan-prefix-in-JIT-560.patch


author: Xiaoqian Lv <xiaoqian@nj.iscas.ac.cn> - 4.5-5
changelog:
  - Type: enhancement
  - ID: NA
  - SUG: NA
  - DESC: backport upstream 4.5-0.20 patches to support riscv64


author: Guofeng Yue <yueguofeng@h-partners.com> - 4.5-12
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify "--source_ip" to "--bind_source_ip" to fix init connection establishment with specific interface


author: pengjian <pengjian23@mails.ucas.ac.cn> - 1:0.82-3
changelog:
  - Introduced environment variable-controlled polling timeouts 
  for the close and connection-keeping functions in the os_unix.c file.


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-10
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9355、CVE-2019-9514、CVE-2024-24791、CVE-2022-32189、CVE-2022-41715、CVE-2022-2880、CVE-2022-1962、CVE-2023-45290、CVE-2024-24783、CVE-2024-24785
  - SUG:NA
  - DESC: Optimize spec files and fix CVE in batches through rebuild


author: duyiwei <duyiwei@kylinos.cn> - 1:4.9.4-11
changelog:
  - Type:bugfix
  - CVE:CVE-2024-9676,CVE-2024-9675, CVE-2024-9407,CVE-2024-9341
  - SUG:NA
  - DESC: fix CVE-2024-9676,CVE-2024-9675, CVE-2024-9407, and CVE-2024-9341


author: wangyu <wangqingsan@huawei.com> - 123-1
changelog:
  - update to 123
    - duktape:prevent wrongful termination of runway thread
    - harden the security features of the systemd service
    - add packit build tool
    - systemd:set User/Group and don't change uid/gid if already set
    - stop installing /usr/share/polkit-1/rules.d as 700/polkitd
    - moving the 50-default.rules file location


author: dillon chen <dillon.chen@gmail.com> - 13.3-7
changelog:
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat 
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: gaihuiying <eaglegai@163.com> - 2.4.9-2
changelog:
  - Type:bufix
  - ID:NA
  - SUG:NA
  - DESC:pppd: Negotiate IP address when only peer addresses are provided


author: gaihuiying <eaglegai@163.com> - 2.5.0-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:pre-created upstream default lock dir
         Openssl engine API is deprecated for a while thus disable it


author: gaihuiying <eaglegai@163.com> - 2.5.0-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream
         Fixing up parsing in radiusclient.conf
         Add configure check to see if we have struct sockaddr_ll


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 25.1-13
changelog:
  - Type:CVE
  - CVE:CVE-2026-0994
  - SUG:NA
  - DESC:Fix Any recursion depth bypass in Python json_format.ParseDict


author: jiangxinyu <jiangxinyu@kylinos.cn> - 1.0.5-1
changelog:
  - Update package to version 1.0.5
  - fix error handling that might result in null exception
    cleanups of exception handling : errors must now have an exception
    Handling NameError is not working


author: yaoxin <1024769339@qq.com> - 1.0.6-1
changelog:
  - Update to 1.0.6:
    * drop testing and support for Python3.8, add Python 3.13, change document to reflect this.
    * implement safe_getattr and safe_format functions; fix bugs in UNSAFE_ATTRS and UNSAFE_ATTRS_DTYPES usage
    * make all procedure attributes private to curb access to AST nodes, which can be exploited
    * improvements to error messages, including use ast functions to construct better error messages
    * remove import of numpy.linalg, as documented
    * update doc description for security advisory


author: xu_ping <707078654@qq.com> - 7.0.0-1
changelog:
  - Upgrade version to 7.0.0
  - Python 3.12 support and python 3.7 no longer supported
  - Add support bind mount propagation.


author: xuchenchen <xuchenchen@kylinos.cn> - 3.1.3-2
changelog:
  - Type: CVE
  - CVE: CVE-2024-34064
  - SUG: NA
  - DESC: fix disallow invalid characters in keys to xmlattr filter


author: xuhe <xuhe@kylinos.cn> - 2.27.3-1
changelog:
  - Update to 2.27.3
  - Fix test util typings.
  - Use json5 typings.
  - Use updated releaser workflows.
  - Ignore pageconfig file if JSON is zero-length.
  - For v2 extensions parse entrypoint data.
  - Add util to get consolidated page_config from higher levels.
  - Move ENV_CONFIG_PATH import back into _get_config_manager.
  - Load overrides once, rather than in each settings handler.
  - Run docs on ubuntu.
  - Fix handling language packs for pseudo language.


author: Shinwell Hu <micromotive@qq.com> - 1.11.1.1-4
changelog:
  - Python-ninja should never obsolate ninja-build.
  - Rename /usr/bin/ninja shipped in this package to /usr/bin/python-ninja


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-5
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-6
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: Funda Wang <fundawang@yeah.net> - 3.11.6-8
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-18
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: Chenxi Mao <chenxi.mao@suse.com> - 3.10.9-2
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC: Enable link time optimizaitons (LTO) for better performance.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 2.13.0-1
changelog:
  - Update package with version 2.13.0
    Add an option to have authentication enabled for all endpoints by default
    Websockets: add configurations for ping interval and timeout
    Log extension import time at debug level unless it's actually slow
    Add support for async Authorizers
    Support get file(notebook) md5
    Update kernel env to reflect changes in session
    Support external kernels


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.1.2-1
changelog:
  - Upgrade package with version 4.1.2
    Fix highlight sequencing when replacing text in code cells
    Restore notebook scrolling on dragging a cell to the viewport edge
    Fix typing in editable elements inside of open shadow DOM
    Correct Alt + number keyboard shortcuts command map
    Update jupyter-collaboration for the Binder environment
    Add virtual scrollbar component to windowed lists.
    Load custom CSS functionality and documentation
    Add plugin manager and extension locks


author: zhaojingyu <zhaojingyu@kylinos.cn> - 4.1.6-1
changelog:
  - Upgrade package with version 4.1.6
  - Fix outputarea collapse expand
    Disable placeholder for password input


author: muxiaohui <muxiaohui@kylinos.cn> - 4.3.0-1
changelog:
  - Update version to 4.3.0
    Add setting to enable single-click navigation in file browser.
    Adds command to toggle cell outputs.
    Add kernel selection to Galata notebook creation.


author: Dongxing Wang <dongxing.wang_a@thundersoft.com> - 4.3.5-1
changelog:
  - Upgrade package with version 4.3.5
    Fix scrolling and selection restoration on undo/redo
    Fix windowing crash due to out-of-bounds access
    Increase color contrast of operators in code editor
    Fix jupyverse installation instructions
    Use Zulip for instant messaging


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30689 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30689 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.17.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: chenhaixing <chenhaixing@huawei.com> - 1.26.12-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix socket timeout value when HTTPConnect is reused
         remove Exclamation mark character from the unreserved characters
         fix _idna_encode handling of x80


author: chengyechun <chengyechun1@huawei.com> - 1.26.17-2
changelog:
  - Type:CVE
  - ID:CVE-2023-45803
  - SUG:NA
  - DESC:fix CVE-2023-45803 Made body stripped form HTTP requests


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: lixiaoyong <lixiaoyong@kylinos.cn> - 0.14.1-1
changelog:
  - Upgrade package to version 0.14.1
    - Drop support for Python older than 3.6
    - Additional ruff/Pyflakes/codespell fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-6
changelog:
  - coro: support live patch for libcare
  - tests/acpi: Update expected ACPI tables for vcpu hotplug(Update BinDir)
  - arm/virt: Require mc->has_hotpluggable_cpus for cold-plugged vcpu
  - arm/virt: Consider has_ged when set mc->has_hotpluggable_cpus
  - arm/virt-acpi: Require possible_cpu_arch_ids for build_cpus_aml()
  - acpi/ged: Remove cpuhp field of ged
  - acpi/ged: Init cpu hotplug only when machine support it
  - intc/gicv3: Fixes for vcpu hotplug
  - arm/kvm: Set psci smccc filter only with vcpu hotplug
  - accel/kvm: Use correct id for parked vcpu
  - arm/virt: Fix adjudgement of core_id for vcpu hotplugged
  - arm/virt.c: Convey local_err when set psci-conduit
  - system/cpus: Fix resume_all_vcpus() under vCPU hotplug condition
  - system/cpus: Fix pause_all_vcpus() under concurrent environment
  - acpi/cpu: Fix cpu_hotplug_hw_init()
  - arm/cpu: Some fixes for arm_cpu_unrealizefn()
  - system/physmem: Fix possible double free when destroy cpu as
  - hw/arm/virt: Expose cold-booted CPUs as MADT GICC Enabled
  - tcg/mttcg: enable threads to unregister in tcg_ctxs[]
  - hw/arm: Support hotplug capability check using _OSC method
  - target/arm/kvm,tcg: Register/Handle SMCCC hypercall exits to VMM/Qemu
  - target/arm/kvm: Write CPU state back to KVM on reset
  - target/arm: Add support of *unrealize* ARMCPU during vCPU Hot-unplug
  - physmem,gdbstub: Common helping funcs/changes to *unrealize* vCPU
  - hw/arm: Changes required for reset and to support next boot
  - arm/virt: Update the guest(via GED) about CPU hot-(un)plug events
  - hw/intc/arm-gicv3*: Changes required to (re)init the vCPU register info
  - hw/arm,gicv3: Changes to update GIC with vCPU hot-plug notification
  - arm/virt: Changes to (un)wire GICC<->vCPU IRQs during hot-(un)plug
  - arm/virt: Add/update basic hot-(un)plug framework
  - hw/acpi: Update ACPI GED framework to support vCPU Hotplug
  - arm/virt: Release objects for *disabled* possible vCPUs after init
  - hw/acpi: Make _MAT method optional
  - hw/arm: MADT Tbl change to size the guest with possible vCPUs
  - hw/acpi: Update GED _EVT method AML with cpu scan
  - hw/acpi: ACPI/AML Changes to reflect the correct _STA.{PRES,ENA} Bits to Guest
  - arm/virt: Make ARM vCPU *present* status ACPI *persistent*
  - arm/virt/acpi: Build CPUs AML with CPU Hotplug support
  - tests/acpi/bios-tables-test: Allow changes to virt/DSDT file
  - acpi/cpu: Add cpu_cppc building support
  - arm/virt/acpi: Factor out CPPC building from DSDT CPU aml
  - hw/acpi: Update CPUs AML with cpu-(ctrl)dev change
  - arm/virt: Create GED dev before *disabled* CPU Objs are destroyed
  - arm/virt: Add cpu hotplug events to GED during creation
  - hw/acpi: Init GED framework with cpu hotplug events
  - hw/acpi: Use qemu_present_cpu() API in ACPI CPU hotplug init
  - hw/acpi: Add ACPI CPU hotplug init stub
  - arm/acpi: Enable ACPI support for vcpu hotplug
  - hw/acpi: Move CPU ctrl-dev MMIO region len macro to common header file
  - arm/virt: Init PMU at host for all possible vcpus
  - arm/virt,gicv3: Changes to pre-size GIC with possible vcpus @machine init
  - arm/virt,kvm: Pre-create disabled possible vCPUs @machine init
  - accel/kvm: Extract common KVM vCPU {creation,parking} code
  - arm/virt,target/arm: Machine init time change common to vCPU {cold|hot}-plug
  - hw/arm/virt: Move setting of common CPU properties in a function
  - cpus-common: Add common CPU utility for possible vCPUs
  - arm/virt,target/arm: Add new ARMCPU {socket,cluster,core,thread}-id property


author: Keqian Zhu <zhukeqian1@huawei.com> - 11:8.2.0-7
changelog:
  - arm/virt: Use max_cpus to calculate redist1_count
  - arm/virt: Use separate filed to identify cpu-hotplug enable


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-11
changelog:
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
  - hw/nvme: fix -Werror=maybe-uninitialized
  - block/virtio-blk: Fix memory leak from virtio_blk_zone_report
  - hw/net/virtio-net: fix qemu set used ring flag even vhost started
  - hw/scsi/scsi-generic: Fix io_timeout property not applying
  - tests: bios-tables-test: Rename smbios type 4 related test functions


author: zhangxianting <zhangxianting@uniontech.com> - 11:8.2.0-12
changelog:
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately
  - kvm/arm: Fix compatibility of cold-plug CPU with SVE
  - arm/virt/acpi: Extend cpufreq to support max_cpus
  - kvm/arm: Fix SVE related logic for vcpu hotplug feature
  - arm/virt: Don't modify smp.max_cpus when vcpu hotplug disabled
  - acpi/cpu: Fix detection of present cpu


author: Song Gao <gaosong@loongson.cn> - 11:8.2.0-13
changelog:
  - target/loongarch: Fix qemu-system-loongarch64 assert
  - target/loongarch: Fix qemu-loongarch64 hang when executing 'll.d $t0, $t0, 0'
  - target/loongarch: Fix tlb huge page loading issue
  - target/loongarch/kvm: Add software breakpoint support
  - target/loongarch/kvm: sync kernel header files
  - hw/intc/loongarch_extioi: Add virt extension support
  - target/loongarch/kvm: Add pmu support
  - target/loongarch/kvm: Fix vm restore failed
  - target/loongarch/kvm: Add pv steal time support
  - target/loongarch/kvm: fpu save the vreg registers high


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-14
changelog:
  - target/riscv/cpu.c: fix Zvkb extension config
  - target/i386: Add new Hygon 'Dharma' CPU model
  - target/i386: Add Hygon Dhyana-v3 CPU model
  - ui/gtk: Fix mouse/motion event scaling issue with GTK display backend
  - hw/ufs: Fix buffer overflow bug
  - arm/virt: Set vcpus_count of CPU as 1 to compatible with libvirt
  - ppc/pnv: I2C controller is not user creatablei


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-15
changelog:
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - migration/dirtyrate: Fix segmentation fault
  - target/hexagon: idef-parser fix leak of init_list


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-16
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100 
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-17
changelog:
  - cvm : bug fix for undefined reference to 'virtcca_cvm_allowed' while compiling
  - cvm : bug-fix for incorrect device name check for vhost-user-fs
  - target/i386: add control bits support for LAM
  - target/i386: add support for LAM in CPUID enumeration
  - Add support for the virtcca cvm feature.
  - target/sparc: use signed denominator in sdiv helper
  - crypto: Introduce SM4 symmetric cipher algorithm
  - ppc/vof: Fix unaligned FDT property access
  - vl: fix "type is NULL" in -vga help
  - hw/display/bcm2835_fb: fix fb_use_offsets condition
  - aspeed/smc: Fix possible integer overflow
  - hw/nvme: fix number of PIDs for FDP RUH update
  - hw/nvme: fix memory leak in nvme_dsm
  - hvf: arm: Do not advance PC when raising an exception
  - physmem: Bail out qemu_ram_block_from_host() for invalid ram addrs


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-18
changelog:
  - hw/loongarch/virt: Fix FDT memory node address width
  - hw/loongarch: Fix fdt memory node wrong 'reg'
  - load_elf: fix iterator's type for elf file processing
  - migration/colo: Fix bdrv_graph_rdlock_main_loop: Assertion `!qemu_in_…
  - target/i386: no single-step exception after MOV or POP SS
  - char-stdio: Restore blocking mode of stdout on exit
  - backends/cryptodev-builtin: Fix local_error leaks
  - target/loongarch: fix a wrong print in cpu dump
  - virtio-pci: fix use of a released vector
  - target/arm: Disable SVE extensions when SVE is disabled
  - hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - virtio-net: Ensure queue index fits with RSS (CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - update io/trace-events. Parameters should remain consistent.
  - update docs/tools/virtfs-proxy-helper.rst. This place is spelled wrong.
  - kvm: Add support for CSV2 reboot
  - target/i386/kvm: Fix the resettable info when emulate Hygon CSV2 guest
  - target/i386: get/set/migrate GHCB state
  - target/i386: csv: Add support for migrate VMSA for CSV2 guest
  - migration/ram: Accelerate the loading of CSV guest's encrypted pages
  - migration/ram: Accelerate the transmission of CSV guest's encrypted pages
  - target/i386: csv: add support to load incoming encrypted pages queued in the CMD list
  - target/i386: csv: add support to queue the incoming page into a list
  - target/i386: csv: add support to encrypt the outgoing pages in the list queued before.
  - target/i386: csv: add support to queue the outgoing page into a list
  - target/i386: csv: Read cert chain from file when prepared for CSV live migration
  - target/i386: Introduce header file csv.h
  - migration/ram: Fix calculation of gfn correpond to a page in ramblock
  - target/i386: sev: Clear shared_regions_list when reboot CSV Guest
  - migration/ram: Force encrypted status for VGA vram
  - target/i386: sev: Return 0 if sev_send_get_packet_len() fails
  - kvm: Add support for userspace MSR filtering and handling of MSR_KVM_MIGRATION_CONTROL.
  - migration/ram: Force encrypted status for flash0 & flash1 devices.
  - migration/ram: add support to send encrypted pages
  - migration: add support to migrate shared regions list
  - kvm: Add support for SEV shared regions list and KVM_EXIT_HYPERCALL.
  - target/i386: sev: add support to load incoming encrypted page
  - target/i386: sev: add support to encrypt the outgoing page
  - target/i386: sev: do not create launch context for an incoming guest
  - target/i386: sev: provide callback to setup outgoing context
  - confidential guest support: introduce ConfidentialGuestMemoryEncryptionOps for encrypted VMs
  - migration.json: add AMD SEV specific migration parameters
  - doc: update AMD SEV to include Live migration flow
  - crypto/tlscredspsk: Free username on finalize
  - hw/nvme: fix leak of uninitialized memory in io_mgmt_recv
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - cvm : Implement command blacklist for cvm security enhancement
  - crypto: Introduce SM3 hash hmac pbkdf algorithm
  - virtio-net: Use virtual time for RSC timers
  - vvfat: Fix bug in writing to middle of file
  - hw/core/ptimer: fix timer zero period condition for freq > 1GHz
  - hw/misc: support vpsp


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-19
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-20
changelog:
  - Added CoDA feature support in the context of CVM. When virtcca cvm is enabled, the iommu is tagged as secure.
  - hw/block: fix uint32 overflow
  - hw/ufs: add basic info of query response upiu
  - crypto: avoid leak of ctx when bad cipher mode is given Fixes: Coverity CID 1546884


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-21
changelog:
  - tests: bump QOS_PATH_MAX_ELEMENT_SIZE again
  - softmmu/physmem: fix memory leak in dirty_memory_extend()
  - crypto: run qcrypto_pbkdf2_count_iters in a new thread
  - hw/audio/virtio-sound: fix heap buffer overflow
  - hw/intc/arm_gic: fix spurious level triggered interrupts
  - ui/sdl2: set swap interval explicitly when OpenGL is enabled
  - target/riscv/kvm: tolerate KVM disable ext errors
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - block: fix -Werror=maybe-uninitialized false-positive
  - hw/remote/vfio-user: Fix config space access byte order
  - hw/loongarch/virt: Fix memory leak
  - hw/intc/riscv_aplic: APLICs should add child earlier than realize
  - stdvga: fix screen blanking
  - ui/gtk: Draw guest frame at refresh cycle
  - target/i386: fix size of EBP writeback in gen_enter()
  - virtio-net: drop too short packets early
  - target/ppc: Fix lxv/stxv MSR facility check
  - target/ppc: Fix lxvx/stxvx facility check
  - virtio-snd: add max size bounds check in input cb(CVE-2024-7730)


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-26
changelog:
  - vdpa-dev: Fix initialisation order to restore VDUSE compatibility
  - tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
  - migration: fix-possible-int-overflow
  - target/m68k: Map FPU exceptions to FPSR register
  - qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo
  - hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
  - hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
  - qio: Inherit follow_coroutine_ctx across TLS
  - target/riscv: Fix the element agnostic function problem
  - accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
  - tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
  - migration: Fix file migration with fdset
  - ui/vnc: don't return an empty SASL mechlist to the client
  - target/arm: Fix FJCVTZS vs flush-to-zero
  - hw/ppc/e500: Prefer QOM cast
  - sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
  - hw/ppc/e500: Remove unused "irqs" parameter
  - hw/ppc/e500: Add missing device tree properties to i2c controller node
  - hw/i386/amd_iommu: Don't leak memory in amdvi_update_iotlb()
  - hw/arm/mps2-tz.c: fix RX/TX interrupts order
  - target/i386: csv: Add support to migrate the incoming context for CSV3 guest
  - target/i386: csv: Add support to migrate the outgoing context for CSV3 guest
  - target/i386: csv: Add support to migrate the incoming page for CSV3 guest
  - target/i386: csv: Add support to migrate the outgoing page for CSV3 guest
  - linux-headers: update kernel headers to include CSV3 migration cmds
  - vfio: Only map shared region for CSV3 virtual machine
  - vga: Force full update for CSV3 guest
  - target/i386: csv: Load initial image to private memory for CSV3 guest
  - target/i386: csv: Do not register/unregister guest secure memory for CSV3 guest
  - target/i386: cpu: Populate CPUID 0x8000_001F when CSV3 is active
  - target/i386: csv: Add command to load vmcb to CSV3 guest memory
  - target/i386: csv: Add command to load data to CSV3 guest memory
  - target/i386: csv: Add command to initialize CSV3 context
  - target/i386: csv: Add CSV3 context
  - next-kbd: convert to use qemu_input_handler_register()
  - qemu/bswap: Undefine CPU_CONVERT() once done
  - exec/memop: Remove unused memop_big_endian() helper
  - hw/nvme: fix handling of over-committed queues
  - 9pfs: fix crash on 'Treaddir' request
  - hw/misc/psp: Pin the hugepage memory specified by mem2 during use for psp
  - hw/misc: support tkm use mem2 memory
  - hw/i386: add mem2 option for qemu
  - kvm: add support for guest physical bits
  - target/i386: add guest-phys-bits cpu property


author: Xianglai Li <lixianglai@loongson.cn> - 11:8.2.0-27
changelog:
  - fix compile error on loongarch
  - hw/loongarch: fix cpu hotplug reset
  - hw/loongarch/boot: Use warn_report when no kernel filename
  - hw/loongarch: clean code
  - hw/loongarch: Add KVM pch msi device support
  - hw/loongarch: Add KVM pch pic device support
  - hw/loongarch: Add KVM extioi device support
  - hw/loongarch: Add KVM IPI device support
  - hw/loongarch/virt: Update the ACPI table for hotplug cpu
  - hw/loongarch/virt: Add basic CPU plug support
  - hw/loongarch/virt: Add CPU topology support
  - accel/kvm/kvm-all: Fixes the missing break in vCPU unpark logic
  - gdbstub: Add helper function to unregister GDB register space
  - physmem: Add helper function to destroy CPU AddressSpace
  - hw/acpi: Update CPUs AML with cpu-(ctrl)dev change
  - hw/acpi: Update ACPI GED framework to support vCPU Hotplug
  - hw/acpi: Move CPU ctrl-dev MMIO region len macro to common header file
  - accel/kvm: Extract common KVM vCPU {creation,parking} code
  - target/loongarch: Add steal time support on migration
  - linux-headers: loongarch: Add kvm_para.h and unistd_64.h
  - target/loongarch/kvm: Implement LoongArch PMU extension
  - target/loongarch: Implement lbt registers save/restore function
  - target/loongarch: Add loongson binary translation feature
  - sync loongarch linux-headers
  - target/loongarch: Avoid bits shift exceeding width of bool type
  - target/loongarch: Use explicit little-endian LD/ST API
  - target/loongarch: fix -Werror=maybe-uninitialized false-positive
  - target/loongarch: Support QMP dump-guest-memory
  - target/loongarch/kvm: Add vCPU reset function
  - target/loongarch: Add compatible support about VM reboot
  - target/loongarch: Fix cpu_reset set wrong CSR_CRMD
  - target/loongarch: Set CSR_PRCFG1 and CSR_PRCFG2 values
  - target/loongarch: Remove avail_64 in trans_srai_w() and simplify it
  - target/loongarch/kvm: Add software breakpoint support
  - target/loongarch: Add loongarch vector property unconditionally
  - target/loongarch/kvm: Fix VM recovery from disk failures
  - target/loongarch: Put cpucfg operation before CSR register
  - target/loongarch: Add TCG macro in structure CPUArchState
  - hw/arm/virt-acpi-build.c: Migrate SPCR creation to common location
  - hw/loongarch/virt: Add FDT table support with acpi ged pm register
  - hw/loongarch/virt: Add description for virt machine type
  - hw/loongarch: Add acpi SPCR table support
  - hw/loongarch: virt: pass random seed to fdt
  - hw/loongarch: virt: support up to 4 serial ports
  - hw/loongarch: Remove default enable with VIRTIO_VGA device
  - hw/loongarch: Fix length for lowram in ACPI SRAT
  - hw/loongarch/virt: Remove unused assignment
  - hw/loongarch: Change the tpm support by default
  - hw/loongarch/boot.c: fix out-of-bound reading
  - hw/loongarch/virt: Use MemTxAttrs interface for misc ops
  - tests/libqos: Add loongarch virt machine node
  - hw/loongarch: Remove minimum and default memory size
  - hw/loongarch: Refine system dram memory region
  - hw/loongarch: Refine fwcfg memory map
  - hw/loongarch: Refine fadt memory table for numa memory
  - hw/loongarch: Refine acpi srat table for numa memory
  - hw/loongarch: Add VM mode in IOCSR feature register in kvm mode
  - hw/loongarch: Refine default numa id calculation
  - hw/loongarch: Rename LoongArchMachineState with LoongArchVirtMachineState
  - hw/loongarch: Rename LOONGARCH_MACHINE with LOONGARCH_VIRT_MACHINE
  - hw/loongarch: move memory map to boot.c
  - loongarch: switch boards to "default y"
  - hw/loongarch: Add cells missing from rtc node
  - hw/loongarch: Add cells missing from uart node
  - hw/loongarch: fdt remove unused irqchip node
  - hw/loongarch: fdt adds pcie irq_map node
  - hw/loongarch: fdt adds pch_msi Controller
  - hw/loongarch: fdt adds pch_pic Controller
  - hw/loongarch: fdt adds Extend I/O Interrupt Controller
  - hw/loongarch: fdt adds cpu interrupt controller node
  - hw/loongarch: Init efi_fdt table
  - hw/loongarch: Init efi_initrd table
  - hw/loongarch: Init efi_boot_memmap table
  - hw/loongarch: Init efi_system_table
  - hw/loongarch: Add init_cmdline
  - hw/loongarch: Add slave cpu boot_code
  - hw/loongarch: Add load initrd
  - hw/loongarch: Move boot functions to boot.c


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-28
changelog:
  - hw/misc/mos6522: Fix bad class definition of the MOS6522 device
  - target/i386: Fix minor typo in NO_NESTED_DATA_BP feature bit
  - cpu: ensure we don't call start_exclusive from cpu_exec
  - Avoid unaligned fetch in ladr_match()
  - audio/audio.c: remove trailing newline in error_setg
  - acpi/tests/avocado/bits: wait for 200 seconds for SHUTDOWN event from bits VM
  - linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR
  - accel/tcg: Fix user-only probe_access_internal plugin
  - linux-user: Honor elf alignment when placing images
  - Reserve address for MSI mapping in the CVM scenario.


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-29
changelog:
  - target/i386: csv: Support inject secret for CSV3 guest only if the extension is enabled
  - target/i386: csv: Support load kernel hashes for CSV3 guest only if the extension is enabled
  - target/i386: csv: Request to set private memory of CSV3 guest if the extension is enabled
  - target/i386: kvm: Support to get and enable extensions for Hygon CoCo guest
  - qapi/qom,target/i386: csv-guest: Introduce secret-header-file=str and secret-file=str options
  - bakcend: VirtCCA:resolve hugepage memory waste issue in vhost-user scenario
  - parallels: fix ext_off assertion failure due to overflow
  - backends/cryptodev-vhost-user: Fix local_error leaks
  - hw/usb/hcd-ehci: Fix debug printf format string
  - target/riscv/vector_helper.c: fix 'vmvr_v' memcpy endianess
  - target/riscv/vector_helper.c: optimize loops in ldst helpers
  - target/riscv/vector_helper.c: set vstart = 0 in GEN_VEXT_VSLIDEUP_VX()
  - target/hexagon: don't look for static glib
  - virtio-net: Fix network stall at the host side waiting for kick
  - Add if condition to avoid assertion failed error in blockdev_init
  - target/arm: Use float_status copy in sme_fmopa_s
  - target/arm: take HSTR traps of cp15 accesses to EL2, not EL1
  - target/arm: Reinstate "vfp" property on AArch32 CPUs
  - target/i386/cpu: Fix notes for CPU models
  - target/arm: LDAPR should honour SCTLR_ELx.nAA
  - target/riscv: Avoid bad shift in riscv_cpu_do_interrupt()
  - hvf: remove unused but set variable
  - hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT()
  - Avoid taking address of out-of-bounds array index
  - target/arm: Fix VCMLA Dd, Dn, Dm[idx]
  - target/arm: Fix UMOPA/UMOPS of 16-bit values
  - target/arm: Fix SVE/SME gross MTE suppression checks
  - target/arm: Fix nregs computation in do_{ld,st}_zpa
  - crypto: fix error check on gcry_md_open
  - Change vmstate_cpuhp_sts vmstateDescription version_id
  - hw/pci: Remove unused pci_irq_pulse() method
  - hw/intc: Don't clear pending bits on IRQ lowering
  - target/arm: Drop user-only special case in sve_stN_r
  - migration: Ensure vmstate_save() sets errp
  - target/i386: fix hang when using slow path for ptw_setl
  - contrib/plugins: add compat for g_memdup2
  - hw/audio/hda: fix memory leak on audio setup
  - crypto: perform runtime check for hash/hmac support in gcrypt
  - target/arm: Fix incorrect aa64_tidcp1 feature check
  - target/arm: fix exception syndrome for AArch32 bkpt insn
  - target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU
  - linux-user: Print tid not pid with strace
  - target/arm: Fix A64 scalar SQSHRN and SQRSHRN
  - target/arm: Don't assert for 128-bit tile accesses when SVL is 128
  - hw/timer/exynos4210_mct: fix possible int overflow
  - target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()
  - hw/audio/virtio-snd: Always use little endian audio format
  - target/riscv: Fix vcompress with rvv_ta_all_1s
  - usb-hub: Fix handling port power control messages


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-30
changelog:
  - Revert "linux-user: Print tid not pid with strace"
  - gpex-acpi: Remove duplicate DSM #5
  - smmuv3: Use default bus for arm-smmuv3-accel
  - smmuv3: Change arm-smmuv3-nested name to arm-smmuv3-accel
  - smmu-common: Return sysmem address space only for vfio-pci
  - smmuv3: realize get_pasid_cap and set ssidsize with pasid
  - vfio: Synthesize vPASID capability to VM
  - backend/iommufd: Report PASID capability
  - pci: Get pasid capability from vIOMMU
  - smmuv3: Add support for page fault handling
  - kvm: Translate MSI doorbell address only if it is valid
  - hw/arm/smmuv3: Enable sva/stall IDR features
  - iommufd.h: Updated to openeuler olk-6.6 kernel
  - tests/data/acpi/virt: Update IORT acpi table
  - hw/arm/virt-acpi-build: Add IORT RMR regions to handle MSI nested binding
  - tests/qtest: Allow IORT acpi table to change
  - hw/arm/virt-acpi-build: Build IORT with multiple SMMU nodes
  - hw/arm/smmuv3: Associate a pci bus with a SMMUv3 Nested device
  - hw/arm/smmuv3: Add initial support for SMMUv3 Nested device
  - hw/arm/virt: Add an SMMU_IO_LEN macro
  - hw/pci-host/gpex: [needs kernel fix] Allow to generate preserve boot config DSM #5
  - tests/data/acpi: Update DSDT acpi tables
  - acpi/gpex: Fix PCI Express Slot Information function 0 returned value
  - tests/qtest: Allow DSDT acpi tables to change
  - hw/arm/smmuv3: Forward cache invalidate commands via iommufd
  - hw/arm/smmu-common: Replace smmu_iommu_mr with smmu_find_sdev
  - hw/arm/smmuv3: Add missing STE invalidation
  - hw/arm/smmuv3: Add smmu_dev_install_nested_ste() for CFGI_STE
  - hw/arm/smmuv3: Check idr registers for STE_S1CDMAX and STE_S1STALLD
  - hw/arm/smmuv3: Read host SMMU device info
  - hw/arm/smmuv3: Ignore IOMMU_NOTIFIER_MAP for nested-smmuv3
  - hw/arm/smmu-common: Return sysmem if stage-1 is bypassed
  - hw/arm/smmu-common: Add iommufd helpers
  - hw/arm/smmu-common: Add set/unset_iommu_device callback
  - hw/arm/smmu-common: Extract smmu_get_sbus and smmu_get_sdev helpers
  - hw/arm/smmu-common: Bypass emulated IOTLB for a nested SMMU
  - hw/arm/smmu-common: Add a nested flag to SMMUState
  - backends/iommufd: Introduce iommufd_viommu_invalidate_cache
  - backends/iommufd: Introduce iommufd_vdev_alloc
  - backends/iommufd: Introduce iommufd_backend_alloc_viommu
  - vfio/iommufd: Implement [at|de]tach_hwpt handlers
  - vfio/iommufd: Implement HostIOMMUDeviceClass::realize_late() handler
  - HostIOMMUDevice: Introduce realize_late callback
  - vfio/iommufd: Add properties and handlers to TYPE_HOST_IOMMU_DEVICE_IOMMUFD
  - backends/iommufd: Add helpers for invalidating user-managed HWPT
  - Update iommufd.h header for vSVA
  - vfio/common: Allow disabling device dirty page tracking
  - vfio/migration: Don't block migration device dirty tracking is unsupported
  - vfio/iommufd: Implement VFIOIOMMUClass::query_dirty_bitmap support
  - vfio/iommufd: Implement VFIOIOMMUClass::set_dirty_tracking support
  - vfio/iommufd: Probe and request hwpt dirty tracking capability
  - vfio/{iommufd, container}: Invoke HostIOMMUDevice::realize() during attach_device()
  - vfio/iommufd: Add hw_caps field to HostIOMMUDeviceCaps
  - vfio/{iommufd,container}: Remove caps::aw_bits
  - HostIOMMUDevice: Store the VFIO/VDPA agent
  - vfio/iommufd: Introduce auto domain creation
  - vfio/ccw: Don't initialize HOST_IOMMU_DEVICE with mdev
  - vfio/ap: Don't initialize HOST_IOMMU_DEVICE with mdev
  - vfio/iommufd: Return errno in iommufd_cdev_attach_ioas_hwpt()
  - backends/iommufd: Extend iommufd_backend_get_device_info() to fetch HW capabilities
  - vfio/iommufd: Don't initialize nor set a HOST_IOMMU_DEVICE with mdev
  - vfio/pci: Extract mdev check into an helper
  - intel_iommu: Check compatibility with host IOMMU capabilities
  - intel_iommu: Implement [set|unset]_iommu_device() callbacks
  - intel_iommu: Extract out vtd_cap_init() to initialize cap/ecap
  - vfio/pci: Pass HostIOMMUDevice to vIOMMU
  - hw/pci: Introduce pci_device_[set|unset]_iommu_device()
  - hw/pci: Introduce helper function pci_device_get_iommu_bus_devfn()
  - vfio: Create host IOMMU device instance
  - backends/iommufd: Implement HostIOMMUDeviceClass::get_cap() handler
  - vfio/container: Implement HostIOMMUDeviceClass::get_cap() handler
  - vfio/iommufd: Implement HostIOMMUDeviceClass::realize() handler
  - backends/iommufd: Introduce helper function iommufd_backend_get_device_info()
  - vfio/container: Implement HostIOMMUDeviceClass::realize() handler
  - range: Introduce range_get_last_bit()
  - backends/iommufd: Introduce TYPE_HOST_IOMMU_DEVICE_IOMMUFD[_VFIO] devices
  - vfio/container: Introduce TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO device
  - backends/host_iommu_device: Introduce HostIOMMUDeviceCaps
  - backends: Introduce HostIOMMUDevice abstract
  - vfio/iommufd: Remove CONFIG_IOMMUFD usage
  - vfio/spapr: Extend VFIOIOMMUOps with a release handler
  - vfio/spapr: Only compile sPAPR IOMMU support when needed
  - vfio/iommufd: Introduce a VFIOIOMMU iommufd QOM interface
  - vfio/spapr: Introduce a sPAPR VFIOIOMMU QOM interface
  - vfio/container: Intoduce a new VFIOIOMMUClass::setup handler
  - vfio/container: Introduce a VFIOIOMMU legacy QOM interface
  - vfio/container: Introduce a VFIOIOMMU QOM interface
  - vfio/container: Initialize VFIOIOMMUOps under vfio_init_container()
  - vfio/container: Introduce vfio_legacy_setup() for further cleanups
  - docs/devel: Add VFIO iommufd backend documentation
  - vfio: Introduce a helper function to initialize VFIODevice
  - vfio/ccw: Move VFIODevice initializations in vfio_ccw_instance_init
  - vfio/ap: Move VFIODevice initializations in vfio_ap_instance_init
  - vfio/platform: Move VFIODevice initializations in vfio_platform_instance_init
  - vfio/pci: Move VFIODevice initializations in vfio_instance_init
  - hw/i386: Activate IOMMUFD for q35 machines
  - kconfig: Activate IOMMUFD for s390x machines
  - hw/arm: Activate IOMMUFD for virt machines
  - vfio: Make VFIOContainerBase poiner parameter const in VFIOIOMMUOps callbacks
  - vfio/ccw: Make vfio cdev pre-openable by passing a file handle
  - vfio/ccw: Allow the selection of a given iommu backend
  - vfio/ap: Make vfio cdev pre-openable by passing a file handle
  - vfio/ap: Allow the selection of a given iommu backend
  - vfio/platform: Make vfio cdev pre-openable by passing a file handle
  - vfio/platform: Allow the selection of a given iommu backend
  - vfio/pci: Make vfio cdev pre-openable by passing a file handle
  - vfio/pci: Allow the selection of a given iommu backend
  - vfio/iommufd: Enable pci hot reset through iommufd cdev interface
  - vfio/pci: Introduce a vfio pci hot reset interface
  - vfio/pci: Extract out a helper vfio_pci_get_pci_hot_reset_info
  - vfio/iommufd: Add support for iova_ranges and pgsizes
  - vfio/iommufd: Relax assert check for iommufd backend
  - vfio/iommufd: Implement the iommufd backend
  - vfio/common: return early if space isn't empty
  - util/char_dev: Add open_cdev()
  - backends/iommufd: Introduce the iommufd object
  - vfio/spapr: Move hostwin_list into spapr container
  - vfio/spapr: Move prereg_listener into spapr container
  - vfio/spapr: switch to spapr IOMMU BE add/del_section_window
  - vfio/spapr: Introduce spapr backend and target interface
  - vfio/container: Implement attach/detach_device
  - vfio/container: Move iova_ranges to base container
  - vfio/container: Move dirty_pgsizes and max_dirty_bitmap_size to base container
  - vfio/container: Move listener to base container
  - vfio/container: Move vrdl_list to base container
  - vfio/container: Move pgsizes and dma_max_mappings to base container
  - vfio/container: Convert functions to base container
  - vfio/container: Move per container device list in base container
  - vfio/container: Switch to IOMMU BE set_dirty_page_tracking/query_dirty_bitmap API
  - vfio/container: Move space field to base container
  - vfio/common: Move giommu_list in base container
  - vfio/common: Introduce vfio_container_init/destroy helper
  - vfio/container: Switch to dma_map|unmap API
  - vfio/container: Introduce a empty VFIOIOMMUOps
  - vfio: Introduce base object for VFIOContainer and targeted interface
  - cryptodev: Fix error handling in cryptodev_lkcf_execute_task()
  - hw/xen: Fix xen_bus_realize() error handling
  - hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
  - target/s390x: Fix a typo in s390_cpu_class_init()
  - hw/sd/sdhci: free irq on exit
  - hw/ufs: free irq on exit
  - hw/pci-host/designware: Fix ATU_UPPER_TARGET register access
  - target/i386: Make invtsc migratable when user sets tsc-khz explicitly
  - target/i386: Construct CPUID 2 as stateful iff times > 1
  - target/i386: Enable fdp-excptn-only and zero-fcs-fds
  - target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]
  - i386/cpuid: Remove subleaf constraint on CPUID leaf 1F
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word
  - target/i386: Raise the highest index value used for any VMCS encoding
  - target/i386: Add VMX control bits for nested FRED support
  - target/i386: Delete duplicated macro definition CR4_FRED_MASK
  - target/i386: Add get/set/migrate support for FRED MSRs
  - target/i386: enumerate VMX nested-exception support
  - vmxcap: add support for VMX FRED controls
  - target/i386: mark CR4.FRED not reserved
  - target/i386: add support for FRED in CPUID enumeration
  - target/i386: fix feature dependency for WAITPKG
  - target/i386: Add more features enumerated by CPUID.7.2.EDX
  - net: fix build when libbpf is disabled, but libxdp is enabled
  - hw/nvme: fix invalid endian conversion
  - hw/nvme: fix invalid check on mcl
  - backends/cryptodev: Do not ignore throttle/backends Errors
  - backends/cryptodev: Do not abort for invalid session ID
  - virtcca: add kvm isolation when get tmi version.
  - qga: Don't daemonize before channel is initialized
  - qga: Add log to guest-fsfreeze-thaw command
  - backends: VirtCCA: cvm_gpa_start supports both 1GB and 3GB
  - BUGFIX: Enforce isolation for virtcca_shared_hugepage
  - arm: VirtCCA: qemu CoDA support UEFI boot
  - arm: VirtCCA: Compatibility with older versions of TMM and the kernel
  - arm: VirtCCA: qemu uefi boot support kae
  - arm: VirtCCA: CVM support UEFI boot


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-31
changelog:
  - target/arm: Change arm_cpu_mp_affinity when enabled IPIV feature
  - fw_cfg: Don't set callback_opaque NULL in fw_cfg_modify_bytes_read()


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-32
changelog:
  - target/i386: csv: Release CSV3 shared pages after unmapping DMA
  - target/i386: Add new CPU model ClearwaterForest
  - target/i386: add sha512, sm3, sm4 feature bits
  - docs: Add GNR, SRF and CWF CPU models
  - target/i386: Export BHI_NO bit to guests
  - target/i386: Introduce SierraForest-v2 model
  - vdpa/iommufd:Implement DMA mapping through the iommufd interface
  - vdpa/iommufd:Introduce vdpa-iommufd module
  - vdpa/iommufd:support associating iommufd backend for vDPA devices
  - Kconfig/iommufd/VDPA: Update IOMMUFD module configuration dependencies The vDPA module can also use IOMMUFD like the VFIO module. 
  - backends/iommufd: Get rid of qemu_open_old()
  - backends/iommufd: Make iommufd_backend_*() return bool
  - backends/iommufd: Fix missing ERRP_GUARD() for error_prepend()
  - backends/iommufd: Remove mutex
  - backends/iommufd: Remove check on number of backend users
  - hw/intc: Add extioi ability of 256 vcpu interrupt routing
  - hw/rtc: Fixed loongson rtc emulation errors
  - hw/loongarch/boot: Adjust the loading position of the initrd
  - target/loongarch: Fix the cpu unplug resource leak
  - target/loongarch: fix vcpu reset command word issue
  - vdpa:Fix dirty page bitmap synchronization not done after suspend for vdpa devices


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-33
changelog:
  - arm: cvm: fix arm-softmmu build on x86 platform
  - arm: VirtCCA: fix arm-softmmu build on x86 platform
  - hw/arm/virt: HDBSS: fix arm-softmmu build on x86 platform
  - hw/arm/virt: decouple migrate_hdbss_buffer_size() with kvm_update_hdbss_cap()
  - hw/arm/virt: only support the HDBSS feature in aarch64
  - multifd: bugfix for incorrect migration data with qatzip compression
  - multifd: bugfix for incorrect migration data with QPL compression
  - multifd: bugfix for migration using compression methods
  - migration/multifd: Zero p->flags before starting filling a packet
  - migration/multifd: Ensure packet->ramblock is null-terminated
  - migration/multifd: Fix rb->receivedmap cleanup race
  - migration/multifd: Fix loop conditions in multifd_zstd_send_prepare and multifd_zstd_recv
  - tests/migration: Add integration test for 'qatzip' compression method
  - migration: Introduce 'qatzip' compression method
  - migration: Add migration parameters for QATzip
  - meson: Introduce 'qatzip' feature to the build system
  - docs/migration: add qatzip compression feature
  - migration/multifd: Fix p->iov leak in multifd-uadk.c
  - tests/migration-test: add uadk compression test
  - migration/multifd: Switch to no compression when no hardware support
  - migration/multifd: Add UADK based compression and decompression
  - migration/multifd: Add UADK initialization
  - migration/multifd: add uadk compression framework
  - configure: Add uadk option
  - docs/migration: add uadk compression feature
  - configure: add --enable-qpl build option
  - migration/multifd: implement qpl compression and decompression
  - migration/multifd: implement initialization of qpl compression
  - migration/multifd: include ram.h in multifd.h
  - migration/multifd: add qpl compression method
  - migration/multifd: put IOV initialization into compression method
  - docs/migration: add qpl compression feature
  - migration/multifd: solve zero page causing multiple page faults
  - migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page.
  - migration/multifd: Implement zero page transmission on the multifd thread
  - migration/multifd: Add new migration option zero-page-detection
  - migration/multifd: Allow multifd without packets
  - migration/multifd: Rename MultiFDSend|RecvParams::data to compress_data
  - migration/multifd: Cleanup multifd_recv_sync_main
  - tests/migration: Set compression level in migration tests
  - migration: Properly apply migration compression level parameters
  - migration/multifd: Drop unnecessary helper to destroy IOC
  - migration/multifd: Cleanup outgoing_args in state destroy
  - migration/multifd: Make multifd_channel_connect() return void
  - migration/multifd: Drop registered_yank
  - migration/multifd: Cleanup TLS iochannel referencing
  - migration/multifd: Release recv sem_sync earlier
  - migration/multifd: Remove p->quit from recv side
  - migration/multifd: Add a synchronization point for channel creation
  - migration/multifd: Unify multifd and TLS connection paths
  - migration/multifd: Move multifd_send_setup into migration thread
  - migration/multifd: Move multifd_send_setup error handling in to the function
  - migration/multifd: Remove p->running
  - migration/multifd: Join the TLS thread
  - migration: Fix logic of channels and transport compatibility check
  - migration/multifd: Optimize sender side to be lockless
  - migration/multifd: Stick with send/recv on function names
  - migration/multifd: Cleanup multifd_load_cleanup()
  - migration/multifd: Cleanup multifd_save_cleanup()
  - migration/multifd: Rewrite multifd_queue_page()
  - migration/multifd: Change retval of multifd_send_pages()
  - migration/multifd: Change retval of multifd_queue_page()
  - migration/multifd: Split multifd_send_terminate_threads()
  - migration/multifd: Forbid spurious wakeups
  - migration/multifd: Move header prepare/fill into send_prepare()
  - migration/multifd: Move trace_multifd_send|recv()
  - migration/multifd: Move total_normal_pages accounting
  - migration/multifd: Rename p->num_packets and clean it up
  - migration/multifd: Drop pages->num check in sender thread
  - migration/multifd: Simplify locking in sender thread
  - migration/multifd: Separate SYNC request with normal jobs
  - migration/multifd: Drop MultiFDSendParams.normal[] array
  - migration/multifd: Postpone reset of MultiFDPages_t
  - migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths
  - migration/multifd: multifd_send_kick_main()
  - migration/multifd: Drop stale comment for multifd zero copy
  - docs/migration: Further move virtio to be feature of migration
  - docs/migration: Further move vfio to be feature of migration
  - docs/migration: Organize "Postcopy" page
  - docs/migration: Split "dirty limit"
  - docs/migration: Split "Postcopy"
  - docs/migration: Split "Debugging" and "Firmware"
  - docs/migration: Split "Backwards compatibility" separately
  - docs/migration: Convert virtio.txt into rST
  - docs/migration: Create index page
  - docs/migration: Create migration/ directory
  - tests/qtest: Re-enable multifd cancel test
  - tests/qtest/migration: Use the new migration_test_add
  - tests/qtest/migration: Add a wrapper to print test names
  - tests/qtest/migration: Print migration incoming errors
  - migration: Report error in incoming migration
  - migration/multifd: Change multifd_pages_init argument
  - migration/multifd: Remove QEMUFile from where it is not needed
  - migration/multifd: Remove MultiFDPages_t::packet_num
  - migration/multifd: Remove unnecessary usage of local Error
  - migration: Fix migration_channel_read_peek() error path
  - migration/multifd: Remove error_setg() in migration_ioc_process_incoming()
  - migration/multifd: Fix leaking of Error in TLS error flow
  - migration/multifd: Simplify multifd_channel_connect() if else statement
  - migration/multifd: Fix error message in multifd_recv_initial_packet()
  - hw/arm/virt: support the HDBSS feature


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-34
changelog:
  - target/arm: support the IPIV feature
  - Revert "target/arm: Change arm_cpu_mp_affinity when enabled IPIV feature"
  - vdpa/iommufd: All vdpa devices perform only one log_sync each time.
  - memory:Optimize flatview ioeventfd processing
  - memory/eventfd:Introduce ioeventfd batch processing to reduce the time required to update ioeventfd
  - migration/memory:Optimize unnecessary memory region updates during live migration
  - migration:Extand the fdtable in the incoming phase of migration
  - virtio/irqfd: Batch processing of irqfd related operations during virtio device startup
  - kvm/msi: Mark whether there is an IRQ route table update through changes
  - virtio-pci:Batch processing of IRQFD mapping for multi queue Virtio devices


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-35
changelog:
  - Fix error in virtCCA CoDA scenario.
  - Revert "backends/iommufd: Make iommufd_backend_*() return bool"


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-40
changelog:
  - target/i386/kvm: Refine VMX controls setting for backward compatibility
  - Bugfix: Correctly set vms->bootinfo.confidential in virtCCA senarios.
  - hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
  - hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
  - hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
  - hw/riscv: virt: Make few IMSIC macros and functions public
  - hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
  - hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
  - hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
  - hw/pci-host/gpex: Define properties for MMIO ranges
  - hw/riscv/virt: Update GPEX MMIO related properties
  - hw/riscv/virt-acpi-build.c: Add IO controllers and devices
  - hw/riscv/virt-acpi-build.c: Add PLIC in MADT
  - hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
  - hw/riscv/virt-acpi-build.c: Add namespace devices for PLIC and APLIC
  - hw/riscv/virt-acpi-build.c: Update the HID of RISC-V UART
  - hw/riscv/virt-acpi-build.c: Generate SPCR table
  - hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables
  - plugins/loader: fix deadlock when resetting/uninstalling a plugin
  - smbios: Fix buffer overrun when using path= option


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-41
changelog:
  - migration: show error message when postcopy fails
  - docs/about/emulation: Fix broken link
  - update include/hw/xen/arch_hvm.h.
  - hw/display/qxl-render: fix qxl_unpack_chunks() chunk size calculation
  - hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU device
  - amd_iommu: Use correct bitmask to set capability BAR
  - amd_iommu: Use correct DTE field for interrupt passthrough
  - tcg: Reset data_gen_ptr correctly
  - hw/virtio: fix -Werror=maybe-uninitialized


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-42
changelog:
  - util/timer: fix -Werror=maybe-uninitialized false-positive
  - hw/qxl: fix -Werror=maybe-uninitialized false-positives
  - nbd: fix -Werror=maybe-uninitialized false-positive
  - block/mirror: fix -Werror=maybe-uninitialized false-positive
  - hw/ahci: fix -Werror=maybe-uninitialized false-positive
  - hw/sdhci: fix -Werror=maybe-uninitialized false-positive
  - migration: fix -Werror=maybe-uninitialized false-positive
  - qemu-img: improve queue depth validation in img_bench


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-43
changelog:
  - qemu-img: fix division by zero in bench_cb() for zero-sized images
  - target/i386: cpu: set correct supported XCR0 features for TCG
  - target/i386: do not rely on ExtSaveArea for accelerator-supported XCR0 bits
  - target/i386: return bool from x86_cpu_filter_features
  - target/i386: add AVX10 feature and AVX10 version property
  - target/i386: add CPUID.24 features for AVX10
  - target/i386: Add feature dependencies for AVX10
  - target/i386: Add AVX512 state when AVX10 is supported
  - target/i386: Introduce GraniteRapids-v2 model
  - i386/cpu: Mark avx10_version filtered when prefix is NULL
  - target/i386: add avx-vnni-int16 feature
  - block/stream: fix -Werror=maybe-uninitialized false-positives
  - migration: fix -Werror=maybe-uninitialized false-positives
  - hw/ssi/xilinx_spips: Fix flash erase assert in dual parallel configuration
  - hw/nvme: cap MDTS value for internal limitation
  - accel/kvm: Make kvm_has_guest_debug static
  - vtarget/arm/tcg: Including missing 'exec/exec-all.h' header
  - system/qtest: Include missing 'hw/core/cpu.h' header
  - qemu-options: Clarify handling of commas in options parameters


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-44
changelog:
  - tests/unit/test-qmp-event: Drop superfluous mutex
  - configure: use a native non-cross compiler for linux-user
  - target/riscv/kvm: do not use non-portable strerrorname_np()
  - qemu-options: Unify the help entries for cocoa
  - virtio: rng: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - vhost-scsi: fix usage of error_reportf_err()
  - esp: check for NULL result from scsi_device_find()
  - migration: fix coverity migrate_mode finding
  - hw/core/cpu: Remove final vestiges of dynamic state tracing
  - target/riscv: Fix mcycle/minstret increment behavior
  - chardev/char.c: fix "abstract device type" error message
  - hw/net: cadence_gem: Fix MDIO_OP_xxx values


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-46
changelog:
  - vdpa: Allow vDPA to work on big-endian machine
  - vfio/container: Replace basename with g_path_get_basename
  - vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
  - vfio/pci: Clear MSI-X IRQ index always
  - hw/arm boot.c: Enforce CCA and virtCCA isolation.
  - block/qed: fix use-after-free by nullifying timer pointer after free
  - hw/gpio: npcm7xx: fixup out-of-bounds access
  - pci/msix: Fix msix pba read vector poll end calculation
  - physmem: fix qemu_ram_alloc_from_fd size calculation
  - s390x/s390-virtio-ccw: don't crash on weird RAM sizes
  - ssh: Do not switch session to non-blocking mode
  - target/ppc: Fix mtDPDES targeting SMT siblings
  - target/ppc: Fix non-maskable interrupt while halted
  - elfload: Fix alignment when unmapping excess reservation


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-47
changelog:
  - target/s390x: Fix MVC not always invalidating translation blocks
  - target/sparc: Fix gdbstub incorrectly handling registers f32-f62
  - virtio-net: Fix size check in dhclient workaround
  - vdpa: Fix endian bugs in shadow virtqueue
  - x86/loader: only patch linux kernels
  - target/ppc: Fix e200 duplicate SPRs
  - vfio/container: For CSV3 VM, only register listener to shared_memory_listener list in vfio_connect_container()
  - target/riscv/kvm: update the KVM regs to Linux rvck-6.6
  - target/riscv/kvm: Fix exposure of Zkr
  - hw/arm/virt: Introduce a IPIV machine option
  - hw/vfio/migration: Fix vfio migration isn't aborted in a corner case


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-48
changelog:
  - common-user/host/riscv: use tail pseudoinstruction for calling tail
  - meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
  - qga: fix potentially not initialized nr_volumes in qga_vss_fsfreeze()
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint(CVE-2024-8354)
  - hw/usb/hcd-xhci: Unmap canceled packet
  - meson: Use has_header_symbol() to check getcpu()
  - hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
  - migration: fix SEEK_CUR offset calculation in qio_channel_block_seek


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-49
changelog:
  - Revert "hw/arm/virt: Introduce a IPIV machine option"
  - target/arm: add ipiv=on/off option
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64smfr0 into the idregs array
  - arm/cpu: Store id_isar0-7 into the idregs array
  - arm/cpu: Store id_pfr0/1/2 into the idregs array
  - arm/cpu: Store id_dfr0/1 into the idregs array
  - arm/cpu: Store id_mmfr0-5 into the idregs array
  - arm/cpu: Add generated sysreg properties
  - arm/cpu: Add sysreg properties generation
  - arm/cpu: Add infra to handle generated ID register definitions
  - kvm: kvm_get_writable_id_regs
  - arm/kvm: use fd instead of fdarray[2]
  - arm/cpu: switch to a generated cpu-sysregs.h.inc
  - arm/cpu: Add sysreg generation scripts
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: more customization for the kvm host cpu model
  - arm/kvm: write back modified ID regs to KVM
  - arm/kvm: Allow reading all the writable ID registers
  - arm/cpu-features: document ID reg properties
  - arm/qmp-cmds: introspection for ID register props
  - arm/cpu: manually make MIDR/REVIDR/AIDR writable
  - arm/cpu: enable MIDR writable
  - target/arm/kvm: Add SMMC hypercall definitions
  - hw/arm/virt: Initial support to set target_impl CPUs
  - target/arm/kvm: Use PSCI_VERSION for version info
  - target/arm/kvm: Set DISCOVER_IMPL_* hypercalls
  - Fix the compilation of target arm-softmmu


author: huangyan <huangyan@cdjrlc.com> - 11:8.2.0-50
changelog:
  - Add qemu-user package for arm, aarch64, riscv32, riscv64 targets
  - Add user-static, user-binfmt package for statically-linked QEMU user emulator


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-51
changelog:
  - trace: Add trace to measure hot migrate downtime
  - backends: Add support of one guest numa node alloc memory from multi host nodes


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-53
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)


author: lifeifei <lifeifei@kylinos.cn> - 2.19-3
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:Add the socket option IPV6_MULTICAST_LOOP to prevent the interface from autoconfiguring using RA messages sent by itself.


author: yanglongkang <yanglongkang@h-partners.com> - 0.6.8-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:backport libtraceevent patch to adapt to kernel ftrace ring buffer change


author: renhongxun <renhongxun@h-partners.com> - 0.6.8-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:clear the link to rasdaemon.service when uninstalling rasdaemon
         and ensure rasdaemon restart once be upgraded


author: luoshengwei <luoshengwei@huawei.com> - 0.8.0-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cpu isolate errors when some cpus are offline
    before the service started


author: wangjiang <app@cameyan.com> - 0.8.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Add some improvements and add new modules to HiSilicon common section


author: shixuantong <shixuantong1@huawei.com> - 8.2-4
changelog:
  - Add shell command to switch bracketed-paste mode from on to off to keep consistent with realine-8.0


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: zhouyihang <zhouyihang3@h-partners.com> - 0.9.1-4
changelog:
  - Type:requirements
  - Id:NA
  - SUG:NA
  - DESC:use libsoup2 instead of libsoup3 for build when no libsoup3 provided


author: dongyuzhen <dongyuzhen@h-partners.com> - 2.18-5
changelog:
  - revert: remove the require to rpm-build.For consistency with other community-released dependencies


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: pengyi <pengyi37@huawei.com> - 8.2210.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:omprog bugfix: invalid status handling at called program
         core bugfix: template system may generate invalid json


author: linzhuorong <linzhuorong@huawei.com> - 8.2210.0-3
changelog:
  - Type:NA
  - ID:NA
  - SUG:NA
  - DESC: imjournal: add second fallback to _COMM
          bugfix: prevent pot. segfault when switchung to
          core/bugfix: using $uuid msg prop can deadlock rsyslog on shutdown
          GNUTls Driver: Fix memory leaks in gtlsInitCred


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 2:4.14.3-1
changelog:
  - update version to 4.14.3
    -Avoid null pointer dereference
    -Update utmp at an initial login
    -Merge libshadow and libmisc into a single libshadow
    -Adding the userdel and groupdel hooks to release tarball


author: yaqiangchen <chenyaqiang@huawei.com> - 14.4.2.0-29
changelog:
  - Fix CVE-2021-33844,CVE-2023-32627,CVE-2021-23159,CVE-2023-34432
  - CVE-2023-34318,CVE-2021-23172,CVE-2021-3643,CVE-2021-23210
  - CVE-2022-31650,CVE-2023-26590,CVE-2022-31651,CVE-2023-32627
  - CVE-2017-18189


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: xinghe <xingheyd@163.com> - 7:6.6-8
changelog:
  - Type:cves
  - ID:CVE-2026-33526 CVE-2026-33515 CVE-2026-32748
  - SUG:NA
  - DESC:fix CVE-2026-33526 CVE-2026-33515 CVE-2026-32748


author: zhangyao <zhangyao108@huawei.com> - 255-27
changelog:
  - DESC:network networkd address does not set up firewall rules
         add backport-network-networkd-address-don-t-set-up-firewall-rules.patch


author: zhangyao <zhangyao108@huawei.com> - 255-32
changelog:
  - backport upstream patch to solve systemd-shutdown hang all the time caused by fsync blocked by absence of DM mapping table


author: fuanan <fuanan3@h-partners.com> - 255-42
changelog:
  - backport: sync patches from systemd community
    add backport-run-pass-the-pty-slave-fd-to-transient-service.patch
        backport-run-do-not-pass-the-pty-slave-fd-to-transient-servic.patch


author: langfei<langfei@huawei.com> - 4.5-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Resolve stap-exporter.service chenge to disable when upgraded systemtap-stap-exporter package


author: langfei<langfei@huawei.com> - 4.5-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix some test cases fail to be executed, Resolve the sc2168 warning detected by the shellcheck tool.


author: liuchao <liuchao173@huawei.com> - 5.0-1
changelog:
  - Upgrade to 5.0:
    - Performance improvements in uprobe registration and module startup.
    - More probe point process details are printed in "-L" list mode with more "-v".
    - For the case where newer kernels may break systemtap runtime APIs, better pass-4 failure diagnostics are printed.
    - Tapset function print_ubacktrace_fileline() now understands DWARF5.
    - The target(s) of process probes may be specified by path name globs,  as located selected debuginfod servers.
    - The kernel-user message transport system added framing codes, making the transport more reliable, but becoming incompatible across pre-5.0 versions. Use matching versions of stap and staprun.
    - The testsuite Makefile has been simplified to remove concurrency, so "parallel" and "resume" modes are gone.
    - New runtime macro STP_TIMING_NSECS is now supported for reporting probe timing stats in nsecs instead of cycles.  This may become default later.
    - Add new runtime macro STP_FORCE_STDOUT_TTY to override STP_STDOUT_NOT_ATTY.


author: Yu Peng <yupeng@kylinos.cn> - 1:0.17-81
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix telnet crashes on stack overflow due to infinite recursion.


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: liuchao <liuchao173@huawei.com> - 2.21.0-1
changelog:
  - upgrade to 2.21.0:
    - api: fixed stop method not to require any parameter
    - plugin_scheduler: fix perf fd leaks
    - allow skipping rollback when restarting TuneD or switching profile
    - function_calc_isolated_cores: no errors for offline CPUs
    - sap-hana: new profile sap-hana-kvm-guest
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
    - fixed possible traceback on SIGHUP
    - updated manual pages to be consistent
    - tuned-adm: better error message for unauthorized switch_profile
    - plugin_sysctl: report reapplied sysctls only on different values
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - plugin_cpu: added support for intel_pstate scaling driver
    - plugin_scheduler: do not leak FDs from the perf
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - throughput-performance: set net.core.somaxconn to at least 2048
    - API: added support for moving devices between instances
    - added support for the API access through the Unix Domain Socket
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - do not exit on duplicate config lines


author: ZhaoYu Jiang <jiangzhaoyu@kylinos.cn> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)
    - tuned-ppd: fixed controller init to correctly set_on_battery


author: tianmuyang <tianmuyang@huawei.com> - 2.24.1-4
changelog:
  - profiles: add programmable scheduling based on eBPF
  - package:  change package tuned to architecture-dependent


author: langfei<langfei@huawei.com> - 2022g-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: Fix Palestine predictions for 2072 through 2075; Ittoqqortoormiit (America/Scoresbysund) zone change.


author: langfei <langfei@huawei.com> - 2024a-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Aysén Region moves from -04/-03 to -03; new zone;
  -	Improve recent commentary for Chilean decrees;
  -	No need for America/Coyhaique in zonenow.tab.


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-41
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


author: lutong <lutong14@huawei.com> - 1.1-9
changelog:
  - bugfix:fixed display error caused by missing signal_exits & revert change method of getting domain id


author: yanglu <yanglu72@h-partners.com> -1.20.11-31
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix regression caused by the fix for CVE-2024-0229 
         fix use after free related to CVE-2024-21886


author: shuaijiakun <shuaijiakun1288@phytium.com.cn> -1.20.11-32
changelog:
  - Type:feature
  - CVE:NA
  - SUG:NA
  - DESC:fix display error for ps23xx when using ast and pe2201 bmc card.


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: yuanchao <1050706328@qq.com> - 0.13.72-4
changelog:
  - backport:disable zzip_use_file_header_zip64_offset,and fix wrong format in changelog,to support clang build


