# changelog

author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <yao_xin001@hoperun.com> - 8.0-1
changelog:
  - Update to 8.0
    * CVE-2024-5742: Avoid privilege escalations via symlink attacks
      on emergency save file (boo#1226099)
    * By default ^F is bound to starting a forward search, and ^B to
      starting a backward search, while M-F and M-B repeat the search
      in the corresponding direction. (See the documentation if you
      want the old bindings back.)
    * Command-line option --modernbindings (-/) makes ^Q quit, ^X cut,
      ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file,
      ^R replace, ^G find again, ^D find again backwards, ^A set the mark,
      ^T jump to a line, ^P show the position, and ^E execute.
    * For easier access, M-" is bound to placing/removing an anchor,
      and M-' to jumping to the next anchor.


author: xingwei <xingwei14@h-partners.com> - 1:5.9.1-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
  	IF-MIB: pass the network interface index to net
  	IF-MIB: fix a memory leak
  	IF-MIB: fix a recently introduced use after free
  	IF-MIB: add a trailing newline to an error message


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: huangyu <huangyu106@huawei.com> - 1:1.0.0-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:The python-setup tools causes an error in the nftables packaging path,This macro is added to ensure that path remains unchanged


author: xinghe <xinghe2@h-partners.com> - 1:1.0.0-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix cache prepare nft_cache evaluate to return error
         fix cache validate handle string length
         add src support for implicit chain bindings
         fix cache release pending rules
         fix segtree map listing
         parser_json fix device parsing in netdev family
         fix src Don't parse string as verdict in map


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: wangkai <13474090681@163.com> - 1:20.11.1-1
changelog:
  - Update to 20.11.1
  - Fix CVE-2023-46809 CVE-2024-21896 CVE-2024-22019 CVE-2024-21892 CVE-2024-24758 CVE-2024-22025


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: cuixucui <cuixucui1@h-partner.com> - 1.1.3-2
changelog:
  - Fix code issue and update log print in network
  - Cancel deleting the IP that automatically configured on the server
  - Fix cdrom bug


author: liqiang <liqiang332@h-partner.com> - 1.1.3-3
changelog:
  - Fix libswsds.so not stripped
  - Fix the value of kernel.src obtained by the kabi test case is incorrect
  - Add board infomation and fix memory bug
  - Fix the block size fails to be obtained during the NVME test
  - Judge whether to support kabi testing by architecture
  - Update readme and dev_design


author: cuixucui <cuixucui1@h-partner.com> - 1.1.4-0
changelog:
  - Add board information in the test report
  - Add spdk test case
  - Add dpdk test case
  - Update pci.ids file


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-0
changelog:
  - Add support for openEuler 20.03 LTS SP4, openEuler 22.03 LTS SP2, openEuler 22.03 LTS SP3
  - Add modifications to Kylinsec with oec-hardware
  - Add support for Loongson and SW architectures
  - Bugfix


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Add virtual cases
  - Resolve IB startup IB_Read_BW service failure issue
  - Delete redundant references
  - Resolve incorrect type in vgpu result data
  - Resolve the issue of getting the kernel source rpm


author: cuixucui <cuixucui@h-partner.com> - 1.1.5-1
changelog:
  - Resolve kdump\watchdog\cpufreq\kabiwhitelist\network test failure issue 
  - Add fio test cases:read,write,randread,randwrite
  - Solve the nvme line break issue in the command line interface
  - Fix compilation errors in the make command
  - Add Vulkan testcase for nvida GPU
  - Resolve the issue of oech server startup failure on version 24.03


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: Funda Wang <fundawang@yeah.net> - 0.23.0-7
changelog:
  - fix CVE-2024-8443, CVE-2024-45615, CVE-2024-45616,
    CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, CVE-2024-45620


author: renmingshuai<renmingshuai@huawei.com> - 9.3p1-3
changelog:
  - Type:CVE
  - CVE:CVE-2023-48795,CVE-2023-51385
  - SUG:NA
  - DESC:fix CVE-2023-48795 and CVE-2023-51385


author: wangcheng <wangcheng156@huawei.com> - 1:3.0.12-1
changelog:
  - Upgrade to 3.0.12
    Resolves: CVE-2023-0464
    Resolves: CVE-2023-0465
    Resolves: CVE-2023-0466
    Resolves: CVE-2023-1255
    Resolves: CVE-2023-2650
    Resolves: CVE-2023-5363
    Resolves: CVE-2023-6237
    Resolves: CVE-2023-6129
    Resolves: CVE-2023-5678
    Resolves: CVE-2024-0727


author: baiguo <baiguo@kylinos.cn> - 0.4.34-2
changelog:
  - Use vasprintf() if available for error messages and otherwise vsnprintf();orccompiler, orcparse: Use secure UCRT printing functions on Windows


author: dillon chen <dillon.chen@gmail.com> - 13.3-7
changelog:
  - Fix issue: confilct between libpq-devel and postgresql-devel
  - guess init spec from redhat 
  - change redhat spec:rm private package and add files to server-devel
  - so add delete lines to Fix issue
  - Next: write oe libpq and postgresql spec by myself


author: gaihuiying <eaglegai@163.com> - 2.4.9-2
changelog:
  - Type:bufix
  - ID:NA
  - SUG:NA
  - DESC:pppd: Negotiate IP address when only peer addresses are provided


author: gaihuiying <eaglegai@163.com> - 2.5.0-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:pre-created upstream default lock dir
         Openssl engine API is deprecated for a while thus disable it


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: Chenxi Mao <chenxi.mao@suse.com> - 3.10.9-2
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC: Enable link time optimizaitons (LTO) for better performance.


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-5
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-6
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: yanglu <yanglu72@h-partners.com> - 1.13.2-5
changelog:
  - Type:cves
  - CVE:CVE-2022-30689 CVE-2022-30699
  - SUG:NA
  - DESC:fix CVE-2022-30689 and CVE-2022-30699


author: gaihuiying <eaglegai@163.com> - 1.17.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:change run directory from /var/run to /run to fix "/usr/lib/tmpfiles.d/unbound.conf:1: xxxx"


author: chenhaixing <chenhaixing@huawei.com> - 1.26.12-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix socket timeout value when HTTPConnect is reused
         remove Exclamation mark character from the unreserved characters
         fix _idna_encode handling of x80


author: chengyechun <chengyechun1@huawei.com> - 1.26.17-2
changelog:
  - Type:CVE
  - ID:CVE-2023-45803
  - SUG:NA
  - DESC:fix CVE-2023-45803 Made body stripped form HTTP requests


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-6
changelog:
  - coro: support live patch for libcare
  - tests/acpi: Update expected ACPI tables for vcpu hotplug(Update BinDir)
  - arm/virt: Require mc->has_hotpluggable_cpus for cold-plugged vcpu
  - arm/virt: Consider has_ged when set mc->has_hotpluggable_cpus
  - arm/virt-acpi: Require possible_cpu_arch_ids for build_cpus_aml()
  - acpi/ged: Remove cpuhp field of ged
  - acpi/ged: Init cpu hotplug only when machine support it
  - intc/gicv3: Fixes for vcpu hotplug
  - arm/kvm: Set psci smccc filter only with vcpu hotplug
  - accel/kvm: Use correct id for parked vcpu
  - arm/virt: Fix adjudgement of core_id for vcpu hotplugged
  - arm/virt.c: Convey local_err when set psci-conduit
  - system/cpus: Fix resume_all_vcpus() under vCPU hotplug condition
  - system/cpus: Fix pause_all_vcpus() under concurrent environment
  - acpi/cpu: Fix cpu_hotplug_hw_init()
  - arm/cpu: Some fixes for arm_cpu_unrealizefn()
  - system/physmem: Fix possible double free when destroy cpu as
  - hw/arm/virt: Expose cold-booted CPUs as MADT GICC Enabled
  - tcg/mttcg: enable threads to unregister in tcg_ctxs[]
  - hw/arm: Support hotplug capability check using _OSC method
  - target/arm/kvm,tcg: Register/Handle SMCCC hypercall exits to VMM/Qemu
  - target/arm/kvm: Write CPU state back to KVM on reset
  - target/arm: Add support of *unrealize* ARMCPU during vCPU Hot-unplug
  - physmem,gdbstub: Common helping funcs/changes to *unrealize* vCPU
  - hw/arm: Changes required for reset and to support next boot
  - arm/virt: Update the guest(via GED) about CPU hot-(un)plug events
  - hw/intc/arm-gicv3*: Changes required to (re)init the vCPU register info
  - hw/arm,gicv3: Changes to update GIC with vCPU hot-plug notification
  - arm/virt: Changes to (un)wire GICC<->vCPU IRQs during hot-(un)plug
  - arm/virt: Add/update basic hot-(un)plug framework
  - hw/acpi: Update ACPI GED framework to support vCPU Hotplug
  - arm/virt: Release objects for *disabled* possible vCPUs after init
  - hw/acpi: Make _MAT method optional
  - hw/arm: MADT Tbl change to size the guest with possible vCPUs
  - hw/acpi: Update GED _EVT method AML with cpu scan
  - hw/acpi: ACPI/AML Changes to reflect the correct _STA.{PRES,ENA} Bits to Guest
  - arm/virt: Make ARM vCPU *present* status ACPI *persistent*
  - arm/virt/acpi: Build CPUs AML with CPU Hotplug support
  - tests/acpi/bios-tables-test: Allow changes to virt/DSDT file
  - acpi/cpu: Add cpu_cppc building support
  - arm/virt/acpi: Factor out CPPC building from DSDT CPU aml
  - hw/acpi: Update CPUs AML with cpu-(ctrl)dev change
  - arm/virt: Create GED dev before *disabled* CPU Objs are destroyed
  - arm/virt: Add cpu hotplug events to GED during creation
  - hw/acpi: Init GED framework with cpu hotplug events
  - hw/acpi: Use qemu_present_cpu() API in ACPI CPU hotplug init
  - hw/acpi: Add ACPI CPU hotplug init stub
  - arm/acpi: Enable ACPI support for vcpu hotplug
  - hw/acpi: Move CPU ctrl-dev MMIO region len macro to common header file
  - arm/virt: Init PMU at host for all possible vcpus
  - arm/virt,gicv3: Changes to pre-size GIC with possible vcpus @machine init
  - arm/virt,kvm: Pre-create disabled possible vCPUs @machine init
  - accel/kvm: Extract common KVM vCPU {creation,parking} code
  - arm/virt,target/arm: Machine init time change common to vCPU {cold|hot}-plug
  - hw/arm/virt: Move setting of common CPU properties in a function
  - cpus-common: Add common CPU utility for possible vCPUs
  - arm/virt,target/arm: Add new ARMCPU {socket,cluster,core,thread}-id property


author: Keqian Zhu <zhukeqian1@huawei.com> - 11:8.2.0-7
changelog:
  - arm/virt: Use max_cpus to calculate redist1_count
  - arm/virt: Use separate filed to identify cpu-hotplug enable


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-11
changelog:
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
  - hw/nvme: fix -Werror=maybe-uninitialized
  - block/virtio-blk: Fix memory leak from virtio_blk_zone_report
  - hw/net/virtio-net: fix qemu set used ring flag even vhost started
  - hw/scsi/scsi-generic: Fix io_timeout property not applying
  - tests: bios-tables-test: Rename smbios type 4 related test functions


author: zhangxianting <zhangxianting@uniontech.com> - 11:8.2.0-12
changelog:
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately
  - kvm/arm: Fix compatibility of cold-plug CPU with SVE
  - arm/virt/acpi: Extend cpufreq to support max_cpus
  - kvm/arm: Fix SVE related logic for vcpu hotplug feature
  - arm/virt: Don't modify smp.max_cpus when vcpu hotplug disabled
  - acpi/cpu: Fix detection of present cpu


author: Song Gao <gaosong@loongson.cn> - 11:8.2.0-13
changelog:
  - target/loongarch: Fix qemu-system-loongarch64 assert
  - target/loongarch: Fix qemu-loongarch64 hang when executing 'll.d $t0, $t0, 0'
  - target/loongarch: Fix tlb huge page loading issue
  - target/loongarch/kvm: Add software breakpoint support
  - target/loongarch/kvm: sync kernel header files
  - hw/intc/loongarch_extioi: Add virt extension support
  - target/loongarch/kvm: Add pmu support
  - target/loongarch/kvm: Fix vm restore failed
  - target/loongarch/kvm: Add pv steal time support
  - target/loongarch/kvm: fpu save the vreg registers high


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-14
changelog:
  - target/riscv/cpu.c: fix Zvkb extension config
  - target/i386: Add new Hygon 'Dharma' CPU model
  - target/i386: Add Hygon Dhyana-v3 CPU model
  - ui/gtk: Fix mouse/motion event scaling issue with GTK display backend
  - hw/ufs: Fix buffer overflow bug
  - arm/virt: Set vcpus_count of CPU as 1 to compatible with libvirt
  - ppc/pnv: I2C controller is not user creatablei


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-15
changelog:
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - migration/dirtyrate: Fix segmentation fault
  - target/hexagon: idef-parser fix leak of init_list


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-16
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100 
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-17
changelog:
  - cvm : bug fix for undefined reference to 'virtcca_cvm_allowed' while compiling
  - cvm : bug-fix for incorrect device name check for vhost-user-fs
  - target/i386: add control bits support for LAM
  - target/i386: add support for LAM in CPUID enumeration
  - Add support for the virtcca cvm feature.
  - target/sparc: use signed denominator in sdiv helper
  - crypto: Introduce SM4 symmetric cipher algorithm
  - ppc/vof: Fix unaligned FDT property access
  - vl: fix "type is NULL" in -vga help
  - hw/display/bcm2835_fb: fix fb_use_offsets condition
  - aspeed/smc: Fix possible integer overflow
  - hw/nvme: fix number of PIDs for FDP RUH update
  - hw/nvme: fix memory leak in nvme_dsm
  - hvf: arm: Do not advance PC when raising an exception
  - physmem: Bail out qemu_ram_block_from_host() for invalid ram addrs


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-18
changelog:
  - hw/loongarch/virt: Fix FDT memory node address width
  - hw/loongarch: Fix fdt memory node wrong 'reg'
  - load_elf: fix iterator's type for elf file processing
  - migration/colo: Fix bdrv_graph_rdlock_main_loop: Assertion `!qemu_in_…
  - target/i386: no single-step exception after MOV or POP SS
  - char-stdio: Restore blocking mode of stdout on exit
  - backends/cryptodev-builtin: Fix local_error leaks
  - target/loongarch: fix a wrong print in cpu dump
  - virtio-pci: fix use of a released vector
  - target/arm: Disable SVE extensions when SVE is disabled
  - hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - virtio-net: Ensure queue index fits with RSS (CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - update io/trace-events. Parameters should remain consistent.
  - update docs/tools/virtfs-proxy-helper.rst. This place is spelled wrong.
  - kvm: Add support for CSV2 reboot
  - target/i386/kvm: Fix the resettable info when emulate Hygon CSV2 guest
  - target/i386: get/set/migrate GHCB state
  - target/i386: csv: Add support for migrate VMSA for CSV2 guest
  - migration/ram: Accelerate the loading of CSV guest's encrypted pages
  - migration/ram: Accelerate the transmission of CSV guest's encrypted pages
  - target/i386: csv: add support to load incoming encrypted pages queued in the CMD list
  - target/i386: csv: add support to queue the incoming page into a list
  - target/i386: csv: add support to encrypt the outgoing pages in the list queued before.
  - target/i386: csv: add support to queue the outgoing page into a list
  - target/i386: csv: Read cert chain from file when prepared for CSV live migration
  - target/i386: Introduce header file csv.h
  - migration/ram: Fix calculation of gfn correpond to a page in ramblock
  - target/i386: sev: Clear shared_regions_list when reboot CSV Guest
  - migration/ram: Force encrypted status for VGA vram
  - target/i386: sev: Return 0 if sev_send_get_packet_len() fails
  - kvm: Add support for userspace MSR filtering and handling of MSR_KVM_MIGRATION_CONTROL.
  - migration/ram: Force encrypted status for flash0 & flash1 devices.
  - migration/ram: add support to send encrypted pages
  - migration: add support to migrate shared regions list
  - kvm: Add support for SEV shared regions list and KVM_EXIT_HYPERCALL.
  - target/i386: sev: add support to load incoming encrypted page
  - target/i386: sev: add support to encrypt the outgoing page
  - target/i386: sev: do not create launch context for an incoming guest
  - target/i386: sev: provide callback to setup outgoing context
  - confidential guest support: introduce ConfidentialGuestMemoryEncryptionOps for encrypted VMs
  - migration.json: add AMD SEV specific migration parameters
  - doc: update AMD SEV to include Live migration flow
  - crypto/tlscredspsk: Free username on finalize
  - hw/nvme: fix leak of uninitialized memory in io_mgmt_recv
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - cvm : Implement command blacklist for cvm security enhancement
  - crypto: Introduce SM3 hash hmac pbkdf algorithm
  - virtio-net: Use virtual time for RSC timers
  - vvfat: Fix bug in writing to middle of file
  - hw/core/ptimer: fix timer zero period condition for freq > 1GHz
  - hw/misc: support vpsp


author: Jiabo Feng <fengjiabo1@huawei.com> - 11:8.2.0-19
changelog:
  - mac_dbdma: Remove leftover `dma_memory_unmap` calls(CVE-2024-8612)
  - softmmu: Support concurrent bounce buffers(CVE-2024-8612)
  - system/physmem: Per-AddressSpace bounce buffering
  - system/physmem: Propagate AddressSpace to MapClient helpers


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.1.0-12
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: zhouyihang <zhouyihang3@h-partners.com> - 0.9.1-4
changelog:
  - Type:requirements
  - Id:NA
  - SUG:NA
  - DESC:use libsoup2 instead of libsoup3 for build when no libsoup3 provided


author: pengyi <pengyi37@huawei.com> - 8.2210.0-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:omprog bugfix: invalid status handling at called program
         core bugfix: template system may generate invalid json


author: linzhuorong <linzhuorong@huawei.com> - 8.2210.0-3
changelog:
  - Type:NA
  - ID:NA
  - SUG:NA
  - DESC: imjournal: add second fallback to _COMM
          bugfix: prevent pot. segfault when switchung to
          core/bugfix: using $uuid msg prop can deadlock rsyslog on shutdown
          GNUTls Driver: Fix memory leaks in gtlsInitCred


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: lingsheng <lingsheng1@h-partners.com> - 6.04-16
changelog:
  - update libpng 1.6.36 to fix CVE-2011-2501 CVE-2011-2690 CVE-2011-2691
  - CVE-2011-2692 CVE-2011-3045 CVE-2011-3048 CVE-2012-3425 CVE-2015-7981
  - CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-10087 CVE-2017-12652


author: wangjiang <wangjiang37@h-partners.com> - 2:9.0-41
changelog:
  - Type:CVE
  - ID:CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237
  - SUG:NA
  - DESC:fix CVE-2023-48231 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 CVE-2023-48236 CVE-2023-48237


