# changelog

author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20230227.cvm release for OL9 which includes the following fixed CVEs:
    {CVE-2021-38578}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20230821 release for OL9 which includes the following fixed CVEs:
    {CVE-2019-14560}
  - Update to OpenSSL 1.1.1v which includes the following fixed CVEs:
    {CVE-2023-3817} {CVE-2023-3446} {CVE-2023-2650} {CVE-2023-0465} {CVE-2023-0466} {CVE-2023-0464} {CVE-2023-0286} {CVE-2023-0215} {CVE-2022-4450} {CVE-2022-4304} {CVE-2022-2097} {CVE-2022-2068} {CVE-2022-1292} {CVE-2022-0778} {CVE-2021-4160} {CVE-2021-3712} {CVE-2021-3711} {CVE-2021-3450} {CVE-2021-3449} {CVE-2021-23841} {CVE-2021-23840} {CVE-2020-1971} {CVE-2020-1967} {CVE-2019-1551} {CVE-2019-1563} {CVE-2019-1549} {CVE-2019-1547} {CVE-2019-1552} {CVE-2019-1543} {CVE-2018-0734} {CVE-2018-0735}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20240227 release for OL9 which includes the following fixed CVEs:
    {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
  - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
    {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215} {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274} {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20240909 release for OL9 which includes the following fixed CVEs:
  - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access [Orabug: 36990130] {CVE-2024-1298}
  - EDK2: In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. [Orabug: 36990244] {CVE-2024-25742}
  - EDK2: EDK2’s Network Package is susceptible to a predictable TCP Initial Sequence Number. [Orabug: 36990198] {CVE-2023-45236}
  - EDK2: EDK2’s Network Package is susceptible to a predictable TCP Initial Sequence Number. [Orabug: 36990210] {CVE-2023-45237}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20250102 release for OL9 which includes the following fixed CVEs:
  - EDK2: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network [Orabug: 37414309] {CVE-2024-38796}
  - Update to OpenSSL 3.0.15 which includes the following fixed CVEs:
    {CVE-2023-4807} {CVE-2023-5363} {CVE-2023-5678} {CVE-2023-6129} {CVE-2023-6237} {CVE-2024-0727} {CVE-2024-2511} {CVE-2024-4603} {CVE-2024-4741} {CVE-2024-5535} {CVE-2024-6119}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20250905 release for OL9 which includes the following fixed CVEs:
  - EDK2: EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access [Orabug: 38381983] {CVE-2025-3770}
  - EDK2: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means [Orabug: 38382190] {CVE-2024-38805}
  - EDK2: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network [Orabug: 38382286] {CVE-2024-38797}
  - EDK2:  Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. [Orabug: 38413860] {CVE-2024-36331}
  - Update to OpenSSL 3.5.1 which includes the following fixed CVEs:
    {CVE-2025-4575} {CVE-2024-12797} {CVE-2024-13176} {CVE-2024-12797} {CVE-2024-13176} {CVE-2024-9143}


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-11.el9
changelog:
  - cpu_map: Remove rtm, hle and taa-no from the Sapphire Rapids CPU model (Mark Kanda) [Orabug: 37845537]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-13.el9
changelog:
  - qemu: fix switchover-ack regression for old qemu (Jon Kohler) [Orabug: 38408711]
  - qemu: add support for qemu switchover-ack (Jon Kohler) [Orabug: 38408711]
  - qemu: Add support for optional migration capabilities (Jiri Denemark) [Orabug: 38408711]
  - qemu: Document qemuMigrationParamsFlagMapItem fields (Jiri Denemark) [Orabug: 38408711]
  - qemu: Rename remoteCaps parameter in qemuMigrationParamsCheck (Jiri Denemark) [Orabug: 38408711]
  - qemu: Use C99 initializers for qemuMigrationParamsFlagMap (Jiri Denemark) [Orabug: 38408711]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-14.el9
changelog:
  - MASH up various tests that lead to imperfections (Wim ten Have) [Orabug: 38325535]
  - conf: Fix migration in some firmware autoselection scenarios (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Move validation check out of postparse (Andrea Bolognani) [Orabug: 38325535]
  - conf: Move validation check out of postparse (Andrea Bolognani) [Orabug: 38325535]
  - conf: Don't explicitly set the secure-boot feature (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Automatically add firmware type/features information (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Don't drop firmware type/features information (Andrea Bolognani) [Orabug: 38325535]
  - conf: Don't format firmware type/features when migrating (Andrea Bolognani) [Orabug: 38325535]
  - conf: Remove some firmware validation checks (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Always go through firmware autoselection (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Discard requires-smm firmware when loader.secure=no (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Introduce qemuFirmwareMatchesPaths() (Andrea Bolognani) [Orabug: 38325535]
  - tests: Fix firmware descriptor masking test (Andrea Bolognani) [Orabug: 38325535]
  - tests: Add more tests for manual Secure Boot configuration (Andrea Bolognani) [Orabug: 38325535]
  - tests: Add firmware-auto-efi-loader-path (Andrea Bolognani) [Orabug: 38325535]
  - tests: Fix firmware-auto-efi-loader-path-nonstandard (Andrea Bolognani) [Orabug: 38325535]
  - tests: Rename a few firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - news: Document support for QCOW2 format firmware (Andrea Bolognani) [Orabug: 38325535]
  - news: Document changes to firmware autoselection (Andrea Bolognani) [Orabug: 38325535]
  - docs: Document firmware format attribute (Andrea Bolognani) [Orabug: 38325535]
  - tests: Add more firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Add support for QCOW2 format firmware (Andrea Bolognani) [Orabug: 38325535]
  - conf: Accept QCOW2 firmware format (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Propagate firmware format (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Filter firmwares based on format (Andrea Bolognani) [Orabug: 38325535]
  - drivers: Reject unsupported firmware formats (Andrea Bolognani) [Orabug: 38325535]
  - conf: Parse firmware format (Andrea Bolognani) [Orabug: 38325535]
  - conf: Change handling for empty NVRAM path (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Introduce qemuFirmwareEnsureNVRAM() (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Move qemuDomainNVRAMPathFormat() to qemu_firmware (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Move firmware selection from startup to postparse (Andrea Bolognani) [Orabug: 38325535]
  - conf: Export virDomainDefOSValidate() (Andrea Bolognani) [Orabug: 38325535]
  - tests: Add descriptors for QCOW2 format firmware builds (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Don't pick firmware with unsupported format (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Don't pick firmware that requires SMM when smm=off (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Clear os.firmwareFeatures after autoselection (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Only fill nvramTemplate for local sources (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Add convenience local variables (Andrea Bolognani) [Orabug: 38325535]
  - conf: Introduce virDomainLoaderDefNew() (Andrea Bolognani) [Orabug: 38325535]
  - conf: Introduce virDomainLoaderDefParseXMLLoader() (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Introduce qemuDomainDefBootPostParse() (Andrea Bolognani) [Orabug: 38325535]
  - qemu: Introduce qemuDomainDefMachinePostParse() (Andrea Bolognani) [Orabug: 38325535]
  - tests: Add more firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - tests: Enable qemuxml2xml for more firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - tests: Unify input files for firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - tests: Move firmware tests to CAPS_LATEST (Andrea Bolognani) [Orabug: 38325535]
  - tests: Use x86_64 for all x86 firmware tests (Andrea Bolognani) [Orabug: 38325535]
  - tests: Rename firmware-manual-efi-rw* tests (Andrea Bolognani) [Orabug: 38325535]
  - tests: Set nvramDir in qemuxml2xmltest (Andrea Bolognani) [Orabug: 38325535]
  - docs: Fix documentation for loader.stateless attribute (Andrea Bolognani) [Orabug: 38325535]
  - Revert "conf: Fix migration in some firmware autoselection scenarios" (Wim ten Have) [Orabug: 38325535]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-15.el9
changelog:
  - qemu: domain: Fix logic when tainting domain (Peter Krempa) [Orabug: 38669211]
  - resctrl: Account for memory bandwidth of 0 being valid (Martin Kletzander) [Orabug: 38264014]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-2.el9
changelog:
  - qemu_migration: don't block migration for network hostdev (Joao Martins)
  - util: basic support for VFIO variant drivers (Laine Stump)


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-3.el9
changelog:
  - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (Peter Krempa) [Orabug: 35644221] {CVE-2023-3750}
  - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469] {CVE-2023-2700}
  - qemuProcessRefreshDisks: Don't skip filling of disk information if tray state didn't change (Peter Krempa) [Orabug: 35636469]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-4.el9
changelog:
  - qemuProcessRefreshDisks: Extract update of a single disk (Peter Krempa) [Orabug: 35885348]
  - qemuProcessRefreshDisks: Properly compare tray status (Peter Krempa) [Orabug: 35885348]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-5.el9
changelog:
  - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364464] {CVE-2024-1441}


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-6.el9
changelog:
  - rpc: ensure temporary GSource is removed from client event loop (Daniel P. Berrangé) [Orabug: 36821472] {CVE-2024-4418}
  - rpc: Don't warn about "max_client_requests" in single-threaded daemons (Peter Krempa) [Orabug: 36422853]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-7.el9
changelog:
  - qemu: conf: Add configuration to tune vcpu unplug timeout (Partha Satapathy) [Orabug: 37098750]
  - conf: Fix migration in some firmware autoselection scenarios (Andrea Bolognani) [Orabug: 37024703]
  - cpu_map: Add SapphireRapids CPU model (Lin Yang)
  - cpu_map: Add missing feature "fsrc" (Tim Wiederhake)
  - cpu_map: Add missing feature "fsrs" (Tim Wiederhake)
  - cpu_map: Add missing feature "fzrm" (Tim Wiederhake)


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-10.el9
changelog:
  - cpu_map: Fix SierraForest CPU model (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Install SierraForest description file (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add SierraForest CPU model (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x491 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x490 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48F (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48E (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48D (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48C (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48B (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x485 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x480 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "pbrsb-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "psdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "fbsdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "sbdr-ssdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "mcdt-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "cmpccxadd" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-vnni-int8" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-ne-convert" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-ifma" (Tim Wiederhake) [Orabug: 37296073]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-16.el9
changelog:
  - cpu_map: Add cpu model EPYC Genoa (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Ignore all vmx-* features in sync_qemu_features_i386.py (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "vnmi" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "stibp-always-on" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "null-sel-clr-base" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "no-nested-data-bp" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "lfence-always-serializing" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "auto-ibrs" (Tim Wiederhake) [Orabug: 38458531]
  - cpu_map: Add missing feature "amd-psfd" (Tim Wiederhake) [Orabug: 38458531]
  - sync_qemu_features_i386: Ignore xen-vapic (Tim Wiederhake) [Orabug: 38458531]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-26.el9
changelog:
  - accel/kvm: Enable Dirty bit tracking if hash cache is used (Joao Martins) [Orabug: 37699414]
  - migration/page_cache: Add nettle sha256 function (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page_cache: Add libgcrypt sha256 function (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page_cache: Add gnutls sha256 function (Joao Martins) [Orabug: 37699414]
  - migration: Add a parameter to select sha256 library (Joao Martins) [Orabug: 37699414]
  - migration: Export cache statistics to QMP (Joao Martins) [Orabug: 37699414]
  - migration/ram: Adjust estimate/exact to time-to-hash dirty data (Joao Martins) [Orabug: 37699414]
  - migration: Sync dirty bitmap in exact() considering factor (Joao Martins) [Orabug: 37699414]
  - migration: Time cache hit/miss operations (Joao Martins) [Orabug: 37699414]
  - migration/ram: Calculate real dirty pages based on hash cache stats (Elena Ufimtseva) [Orabug: 37699414]
  - migration: Add hash cache for dirty page tracking (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page-cache: Differentiate page size from cache data size (Joao Martins) [Orabug: 37699414]
  - target/i386: do not expose ARCH_CAPABILITIES on AMD CPU (Paolo Bonzini) [Orabug: 38225280]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-28.el9
changelog:
  - hw/i386: Add an exadata machine (Joao Martins) [Orabug: 38408711]
  - arm/kvm: add support for MTE (Cornelia Huck)
  - target/arm: When tag memory is not present, set MTE=1 (Richard Henderson)
  - spec: provide qemu-kvm-device-usb-host package (Mark Kanda) [Orabug: 38355110]
  - kvm.conf: do not automatically enable virt when loading kvm (Mark Kanda) [Orabug: 38320046]


author: Karl Heubaum <karl.heubaum@oracle.com> - 10.1.3-1.el9
changelog:
  - Update version for 10.1.3 release (Michael Tokarev)
  - kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value (Markus Armbruster)
  - docs/devel: Update URL for make-pullreq script (Peter Maydell)
  - target/arm: Fix assert on BRA. (Harald van Dijk)
  - hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN (Cédric Le Goater)
  - hw/core/machine: Provide a description for aux-ram-share property (Peter Xu)
  - hw/pci: Make msix_init take a uint32_t for nentries (Peter Maydell)
  - block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit() (Fiona Ebner)
  - iotests: add Linux loop device image creation test (Stefan Hajnoczi)
  - block: use pwrite_zeroes_alignment when writing first sector (Stefan Hajnoczi)
  - file-posix: populate pwrite_zeroes_alignment (Stefan Hajnoczi)
  - block-backend: Fix race when resuming queued requests (Kevin Wolf)
  - ui/vnc: Fix qemu abort when query vnc info (AlanoSong@163.com)
  - chardev/char-pty: Do not ignore chr_write() failures (Philippe Mathieu-Daudé)
  - ui/vdagent: fix windows agent regression (Marc-André Lureau)
  - hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section() (Peter Maydell)
  - hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs (Peter Maydell)
  - hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure (Jamin Lin)
  - hw/arm/ast27x0: Fix typo in LTPI address (Nabih Estefan)
  - migration: Fix transition to COLO state from precopy (Li Zhijian)
  - qmp: Fix a typo for a USO feature (Jack Wang)
  - target/i386: fix stack size when delivering real mode interrupts (Paolo Bonzini)
  - target/i386: svm: fix sign extension of exit code (Paolo Bonzini)
  - target/i386/tcg: validate segment registers (Paolo Bonzini)
  - target/i386: Mark VPERMILPS as not valid with prefix 0 (Peter Maydell)
  - hw/southbridge/lasi: Correct LasiState parent (Philippe Mathieu-Daudé)
  - hw/dma/zynq-devcfg: Fix register memory (Yannick Voßen)
  - tests/functional: handle URLError when fetching assets (Daniel P. Berrangé)
  - tests/functional: fix formatting of exception args (Daniel P. Berrangé)
  - block/io: Take reqs_lock for tracked_requests (Hanna Czenczek)
  - nvme: Fix coroutine waking (Hanna Czenczek)
  - nvme: Kick and check completions in BDS context (Hanna Czenczek)
  - curl: Fix coroutine waking (Hanna Czenczek)
  - nfs: Run co BH CB in the coroutine’s AioContext (Hanna Czenczek)
  - rbd: Run co BH CB in the coroutine’s AioContext (Hanna Czenczek)
  - tests: move test_virt_gpu to share.linaro.org (Alex Bennée)
  - tests: move test_kvm to share.linaro.org (Alex Bennée)
  - tests: move test_kvm_xen to share.linaro.org (Alex Bennée)
  - tests: move test_netdev_ethtool to share.linaro.org (Alex Bennée)
  - tests: move test_virt assets to share.linaro.org (Alex Bennée)
  - tests: move test_xen assets to share.linaro.org (Alex Bennée)
  - hw/misc/npcm_clk: Don't divide by zero when calculating frequency (Peter Maydell)
  - hw/display/xlnx_dp: Don't abort for unsupported graphics formats (Peter Maydell)
  - hw/display/xlnx_dp.c: Don't abort on AUX FIFO overrun/underrun (Peter Maydell)
  - net: pad packets to minimum length in qemu_receive_packet() (Peter Maydell)
  - hw/net/e1000e_core: Adjust e1000e_write_payload_frag_to_rx_buffers() assert (Peter Maydell)
  - hw/net/e1000e_core: Correct rx oversize packet checks (Peter Maydell)
  - hw/net/e1000e_core: Don't advance desc_offset for NULL buffer RX descriptors (Peter Maydell)
  - qio: Protect NetListener callback with mutex (Eric Blake)
  - qio: Remember context of qio_net_listener_set_client_func_full (Eric Blake)
  - qio: Unwatch before notify in QIONetListener (Eric Blake)
  - qio: Add trace points to net_listener (Eric Blake)
  - tests/qemu-iotest: fix iotest 024 with qed images (Alberto Garcia)
  - qemu-img rebase: don't exceed IO_BUF_SIZE in one operation (Alberto Garcia)
  - qemu-img: Fix amend option parse error handling (Akihiko Odaki)
  - tests/qtest/bios-tables-test: Update DSDT blobs after GPEX _DSM change (Shameer Kolothum)
  - hw/pci-host/gpex-acpi: Fix _DSM function 0 support return value (Eric Auger)
  - tests/qtest/bios-tables-test: Prepare for _DSM change in the DSDT table (Shameer Kolothum)
  - vhost-user: fix shared object lookup handler logic (Albert Esteve)
  - target/x86: Correctly handle invalid 0x0f 0xc7 0xxx insns (Peter Maydell)
  - hostmem/shm: Allow shm memory backend serve as shared memory for coco-VMs (Xiaoyao Li)
  - ram-block-attributes: fix interaction with hugetlb memory backends (Chenyi Qiang)
  - tests/tcg/s390x: Test SET CLOCK COMPARATOR (Ilya Leoshkevich)
  - target/s390x: Use address generation for register branch targets (Ilya Leoshkevich)
  - target/s390x: Fix missing clock-comparator interrupts after reset (Ilya Leoshkevich)
  - target/s390x: Fix missing interrupts for small CKC values (Ilya Leoshkevich)
  - target/microblaze: Handle signed division overflows (Edgar E. Iglesias)
  - target/microblaze: div: Break out raise_divzero() (Edgar E. Iglesias)
  - target/microblaze: Remove unused arg from check_divz() (Edgar E. Iglesias)
  - gdbstub: Fix %s formatting (Sean Anderson)
  - block/curl.c: Fix CURLOPT_VERBOSE parameter type (Richard W.M. Jones)
  - block: fix luks 'amend' when run in coroutine (Daniel P. Berrangé)
  - block: remove 'detached-header' option from opts after use (Daniel P. Berrangé)
  - i386/kvm/cpu: Init SMM cpu address space for hotplugged CPUs (Xiaoyao Li)
  - hw/i386/pc: Avoid overlap between CXL window and PCI 64bit BARs in QEMU (peng guo)
  - target/i386: clear CPU_INTERRUPT_SIPI for all accelerators (Paolo Bonzini)
  - linux-user: permit sendto() with NULL buf and 0 len (Peter Maydell)
  - linux-user: Use correct type for FIBMAP and FIGETBSZ emulation (Bastian Blank)
  - qtest/am53c974-test: add additional test for cmdfifo overflow (Mark Cave-Ayland)
  - esp.c: fix esp_cdb_ready() FIFO wraparound limit calculation (Mark Cave-Ayland)
  - hw/hppa: Fix interrupt of LASI parallel port (Helge Deller)
  - target/hppa: Set FPCR exception flag bits for non-trapped exceptions (Peter Maydell)
  - hw/scsi: avoid deadlock upon TMF request cancelling with VirtIO (Fiona Ebner)
  - crypto: stop requiring "key encipherment" usage in x509 certs (Daniel P. Berrangé)
  - io: fix use after free in websocket handshake code (Daniel P. Berrangé) {CVE-2025-11234}
  - io: move websock resource release to close method (Daniel P. Berrangé)
  - io: release active GSource in TLS channel finalizer (Daniel P. Berrangé)
  - target/riscv: fix riscv_cpu_sirq_pending() mask (Daniel Henrique Barboza)
  - target/riscv/kvm: fix env->priv setting in reset_regs_csr() (Daniel Henrique Barboza)
  - aplic: fix mask for smsiaddrcfgh (Jialong Yang)
  - hw/riscv: Correct mmu-type property of sifive_u harts in device tree (Zejun Zhao)
  - target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode (Peter Maydell)
  - vfio: only check region info cache for initial regions (John Levon)
  - vfio: rename field to "num_initial_regions" (John Levon)
  - hw/ppc/e500: Check for compatible CPU type instead of aborting ungracefully (Thomas Huth)
  - tests/tcg/multiarch/linux/linux-test: Don't try to test atime update (Peter Maydell)
  - tcg/arm: Fix tgen_deposit (Richard Henderson)


author: Karl Heubaum <karl.heubaum@oracle.com> - 10.1.4-1.el9
changelog:
  - Update version for 10.1.4 release (Michael Tokarev)
  - scripts/qemugdb: timers: Fix KeyError in 'qemu timers' command (Andrey Drobyshev)
  - linux-user/syscall.c: Prevent acquiring clone_lock while fork() (Aleksandr Sergeev)
  - hw/cxl: Take into account how many media operations are requested for param check (Jonathan Cameron)
  - hw/cxl: Check for overflow on santize media as both base and offset 64bit. (Jonathan Cameron)
  - virtio-gpu: fix error handling in virgl_cmd_resource_create_blob (Honglei Huang)
  - virtio-pmem: ignore empty queue notifications (Li Chen)
  - virtio-gpu-virgl: correct parent for blob memory region (Joelle van Dyne)
  - cryptodev-builtin: Limit the maximum size (zhenwei pi) [Orabug: 38868251] {CVE-2025-14876}
  - hw/virtio/virtio-crypto: verify asym request size (zhenwei pi) [Orabug: 38868251] {CVE-2025-14876}
  - q35: Fix migration of SMRAM state (Igor Mammedov)
  - pcie_sriov: Fix PCI_SRIOV_* accesses in pcie_sriov_pf_exit() (Kevin Wolf)
  - virtio: Fix crash when sriov-pf is set for non-PCI-Express device (Kevin Wolf)
  - virtio-dmabuf: Ensure UUID persistence for hash table insertion (Dorinda Bassey)
  - vdpa: fix vhost-vdpa suspended state not be shared (Wafer Xie)
  - hw/i2c/aspeed_i2c: Fix DMA moving data into incorrect address (Jamin Lin)
  - hw/i2c/aspeed: Fix wrong I2CC_DMA_LEN when I2CM_DMA_TX/RX_ADDR set first (Jamin Lin)
  - hw/arm/aspeed_ast27x0: Fix EHCI3/4 IRQ routing to GIC (Jamin Lin)
  - hw/i2c/aspeed_i2c.c: Add a check for dma_read (Nabih Estefan)
  - hw/adc: Fix out-of-bounds write in Aspeed ADC model (Cédric Le Goater)
  - hw/uefi: fix size negotiation (Gerd Hoffmann)
  - hw/nvme: Fix bootindex suffix use-after-free (Akihiko Odaki)
  - python: fix msys64 wheel directory specification (John Snow)
  - tests/qtest/ufs-test: Add test for mcq completion queue wraparound (Ilia Levi)
  - hw/ufs: Fix mcq completion queue wraparound (Ilia Levi)
  - hw/ufs: fix CQE endianness and UPIU length (Jeuk Kim)
  - hw/ufs: Ensure DBC of PRDT uses only lower 18 bits (Jeuk Kim)
  - tests/functional: migrate sbsa_ref test images (Alex Bennée)
  - pc-bios/optionrom: Use 32-bit linker emulation for the optionroms (Thomas Huth)
  - target/i386/tcg: fix a few instructions that do not support VEX.L=1 (Paolo Bonzini)
  - linux-user: fixup termios2 related things on PowerPC (Icenowy Zheng)
  - linux-user: Add missing termios baud rates (Vivian Wang)
  - linux-user: Add termios2 support to sparc target (Luca Bonissi)
  - linux-user: Add termios2 support to sh4 target (Luca Bonissi)
  - linux-user: Add termios2 support to mips target (Luca Bonissi)
  - linux-user: Add termios2 support to hppa target (Luca Bonissi)
  - linux-user: Add termios2 support to alpha target (Luca Bonissi)
  - linux-user: Add termios2 support (Luca Bonissi)
  - hw/intc: avoid byte swap fiddling in gicv3 its path (Alex Bennée)
  - bsd-user/syscall_defs.h: define STAT_TIME_T_EXT only for 32 bits (Pierrick Bouvier)
  - bsd-user: Fix __i386__ test for TARGET_HAS_STAT_TIME_T_EXT (Richard Henderson)
  - hw/sd/sdhci: Fix TYPE_IMX_USDHC to implement sd-spec-version 3 by default (Bernhard Beschow)
  - linux-user/aarch64/target_fcntl.h: add missing TARGET_O_LARGEFILE definition (Pierrick Bouvier)
  - tests/functional: Mark another MIPS replay test as flaky (Philippe Mathieu-Daudé)
  - tests/functional: Mark the MIPS replay tests as flaky (Philippe Mathieu-Daudé)
  - accel/nvmm: Fix 'cpu' typo in nvmm_init_vcpu() (Philippe Mathieu-Daudé)
  - target/arm: Correctly trap HCR.TID1 registers in v7A (Peter Maydell)
  - target/arm: Correctly honour HCR.TID3 for v7A cores (Peter Maydell)
  - target/arm: Don't specify ID_PFR1 accessfn twice (Peter Maydell)
  - tests/functional: migrate aspeed_rainier image (Alex Bennée)
  - hw/loongarch/virt: Don't abort on access to unimplemented IOCSR (Yao Zi)
  - target/loongarch: Fix exception ADEF/ADEM missing to update CSR_BADV (Song Gao)
  - target/loongarch: Fix exception BCE missing to update CSR_BADV (Song Gao)
  - target/loongach: Fix some exceptions failure in updating CSR_BADV (Song Gao)
  - hw/loongarch/virt: Fix irq allocation failure with pci device from fdt (Xianglai Li)
  - hw/loongarch/virt: Modify the interrupt trigger type in fdt table (Xianglai Li)
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq() (Vulnerability Report) [Orabug: 38868257] {CVE-2026-0665}
  - target/i386/tcg: allow VEX in 16-bit protected mode (Paolo Bonzini)
  - target/i386/tcg: mask addresses for VSIB (Paolo Bonzini)
  - target/i386/tcg: do not mark all SSE instructions as unaligned (Paolo Bonzini)
  - m68k: fix CAS2 writeback when Dc1==Dc2 (Laurent Vivier)
  - configs: use default prefix for Windows compilation (Paolo Bonzini)
  - target/ppc: Fix env->quiesced migration (Fabiano Rosas)
  - tests: add tcg coverage for fixed mremap bugs (Matthew Lugg)
  - linux-user: fix reserved_va page leak in do_munmap (Matthew Lugg)
  - linux-user: fix mremap errors for invalid ranges (Matthew Lugg)
  - linux-user: fix mremap unmapping adjacent region (Matthew Lugg)
  - linux-user: allow null `pathname` for statx()/fstatat() (Jean-Christian CÎRSTEA)
  - tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i} (Richard Henderson)
  - tcg/optimize: Do use affected bits (Paolo Bonzini)
  - tcg/optimize: Fix a_mask computation for orc (Richard Henderson)
  - tcg/optimize: Save o_mask in fold_masks_zosa_int (Richard Henderson)
  - monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race (Jie Song)
  - tests/functional: Fix URL of gb200nvl-bmc image (Cédric Le Goater)
  - hw/i2c/imx: Fix trace func name error (Alano Song)
  - target/i386/tcg: ignore V3 in 32-bit mode (Paolo Bonzini)
  - target/i386: Fix #GP error code for INT instructions (Andrew Cooper)
  - qdev: fix error handling in set_uint64_checkmask (Zesen Liu)
  - gdbstub: Fix const qualifier build errors with recent glibc (Cédric Le Goater)
  - monitor: Fix const qualifier build errors with recent glibc (Cédric Le Goater)
  - tests/vhost-user-bridge.c: Fix const qualifier build errors with recent glibc (Cédric Le Goater)
  - i386: Fix const qualifier build errors with recent glibc (Cédric Le Goater)
  - Fix const qualifier build errors with recent glibc (Cédric Le Goater)
  - qga: Fix ubsan warning (Thomas Huth)
  - tests/qemu-iotests: Fix check for existing file in _require_disk_usage() (Thomas Huth)
  - Revert "nvme: Fix coroutine waking" (Hanna Czenczek)
  - nvme: Note in which AioContext some functions run (Hanna Czenczek)
  - block: Fix BDS use after free during shutdown (Kevin Wolf)
  - scripts/nsis.py: Tell makensis that WoA is 64 bit (Stefan Weil)
  - vhost: Always initialize cached vring data (Hanna Czenczek)
  - scripts: fix broken error path in modinfo-collect.py (Denis V. Lunev)
  - target/arm: handle unaligned PC during tlb probe (Alex Bennée)
  - gitlab: move custom runners to Ubuntu 24.04 (Alex Bennée)
  - gitlab-ci.d/cirrus: Update the FreeBSD job to v14.3 (Michael Tokarev)
  - tcg: Zero extend 32-bit addresses for TCI (Richard Henderson)
  - file-posix: Handle suspended dm-multipath better for SG_IO (Kevin Wolf)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-12.1.el8
changelog:
  - Update slirp to address various CVEs (Mark Kanda) [Orabug: 32208456] [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420] {CVE-2020-29129} {CVE-2020-29130} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - hw/pflash_cfi01: Allow backing devices to be smaller than memory region (David Edmondson)
  - pcie: expire pending delete (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: fast unplug when slot power is off (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: add power indicator blink check (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann) [Orabug: 33450706]
  - pci: implement power state (Gerd Hoffmann) [Orabug: 33450706]
  - hw/pci/pcie: Move hot plug capability check to pre_plug callback (Julia Suvorova) [Orabug: 33450706]
  - hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable (Julia Suvorova) [Orabug: 33450706]
  - hw/pci/pcie: Forbid hot-plug if it's disabled on the slot (Julia Suvorova) [Orabug: 33450706]
  - pcie_root_port: Add hotplug disabling option (Julia Suvorova) [Orabug: 33450706]
  - qdev-monitor: Forbid repeated device_del (Julia Suvorova) [Orabug: 33450706]
  - i386:acpi: Remove _HID from the SMBus ACPI entry (Corey Minyard)
  - uas: add stream number sanity checks (Gerd Hoffmann) [Orabug: 33280793] {CVE-2021-3713}
  - usbredir: fix free call (Gerd Hoffmann) [Orabug: 33198441] {CVE-2021-3682}
  - hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands (Mauro Matteo Cascella) [Orabug: 33548490] {CVE-2021-3930}
  - e1000: fix tx re-entrancy problem (Jon Maloy) [Orabug: 32560552] {CVE-2021-20257}
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda) [Orabug: 33537594]
  - MAINTAINERS: Add ACPI/HEST/GHES entries (Dongjiu Geng)
  - target-arm: kvm64: handle SIGBUS signal from kernel or KVM (Dongjiu Geng)
  - ACPI: Record Generic Error Status Block(GESB) table (Dongjiu Geng)
  - KVM: Move hwpoison page related functions into kvm-all.c (Dongjiu Geng)
  - ACPI: Record the Generic Error Status Block address (Dongjiu Geng)
  - ACPI: Build Hardware Error Source Table (Dongjiu Geng)
  - ACPI: Build related register address fields via hardware error fw_cfg blob (Dongjiu Geng)
  - docs: APEI GHES generation and CPER record description (Dongjiu Geng)
  - hw/arm/virt: Introduce a RAS machine option (Dongjiu Geng)
  - acpi: nvdimm: change NVDIMM_UUID_LE to a common macro (Dongjiu Geng)
  - block/curl: HTTP header field names are case insensitive (David Edmondson) [Orabug: 33287589]
  - block/curl: HTTP header fields allow whitespace around values (David Edmondson) [Orabug: 33287589]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-14.el8
changelog:
  - scsi: fix sense code for EREMOTEIO (Paolo Bonzini) [Orabug: 33537443]
  - scsi: move host_status handling into SCSI drivers (Hannes Reinecke) [Orabug: 33537443]
  - scsi: inline sg_io_sense_from_errno() into the callers (Hannes Reinecke) [Orabug: 33537443]
  - scsi-generic: do not snoop the output of failed commands (Paolo Bonzini) [Orabug: 33537443]
  - scsi: Add mapping for generic SCSI_HOST status to sense codes (Hannes Reinecke) [Orabug: 33537443]
  - scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST error codes (Hannes Reinecke) [Orabug: 33537443]
  - scsi: drop 'result' argument from command_complete callback (Hannes Reinecke) [Orabug: 33537443]
  - scsi-disk: pass guest recoverable errors through even for rerror=stop (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: pass SCSI status to scsi_handle_rw_error (Paolo Bonzini) [Orabug: 33537443]
  - scsi: introduce scsi_sense_from_errno() (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: do not complete requests early for rerror/werror=ignore (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: move scsi_handle_rw_error earlier (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: convert more errno values back to SCSI statuses (Paolo Bonzini) [Orabug: 33537443]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1.15.el8
changelog:
  - qemu-kvm.spec: Add support for reading vmdk, vhdx, vpc, https, and ssh disk image formats from qemu-kvm (Karl Heubaum) [Orabug: 33741340]
  - Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda) [Orabug: 33719302] [Orabug: 33754145] {CVE-2021-4158} {CVE-2021-3947}
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daudé) [Orabug: 32439466] {CVE-2021-20196}
  - hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daudé) [Orabug: 32439466] {CVE-2021-20196}
  - net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit) [Orabug: 32559476] {CVE-2021-20203}
  - lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - sungem: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - e1000: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - net: introduce qemu_receive_packet() (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (Paolo Bonzini)
  - target/i386: Observe XSAVE state area offsets (Paolo Bonzini)
  - target/i386: Make x86_ext_save_areas visible outside cpu.c (Paolo Bonzini)
  - target/i386: Pass buffer and length to XSAVE helper (Paolo Bonzini)
  - target/i386: Clarify the padding requirements of X86XSaveArea (Paolo Bonzini)
  - target/i386: Consolidate the X86XSaveArea offset checks (Paolo Bonzini)
  - target/i386: Declare constants for XSAVE offsets (Paolo Bonzini)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-1.el9
changelog:
  - ACPI ERST: step 6 of bios-tables-test.c (Eric DeVolder)
  - ACPI ERST: bios-tables-test testcase (Eric DeVolder)
  - ACPI ERST: qtest for ERST (Eric DeVolder)
  - ACPI ERST: create ACPI ERST table for pc/x86 machines (Eric DeVolder)
  - ACPI ERST: build the ACPI ERST table (Eric DeVolder)
  - ACPI ERST: support for ACPI ERST feature (Eric DeVolder)
  - ACPI ERST: header file for ERST (Eric DeVolder)
  - ACPI ERST: PCI device_id for ERST (Eric DeVolder)
  - hw/nvme: fix CVE-2021-3929 (Klaus Jensen) [Orabug: 33866395] {CVE-2021-3929}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
  - oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]
  - tests/plugin/syscall.c: fix compiler warnings (Juro Bystricky)
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
  - virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358) (Vivek Goyal) [Orabug: 33816690] {CVE-2022-0358}
  - acpi: validate hotplug selector on access (Michael S. Tsirkin) [Orabug: 33816625] {CVE-2021-4158}
  - Update to QEMU 6.1.1 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-2.el9
changelog:
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella) [Orabug: 33941752] {CVE-2022-26354}
  - qemu_regdump.py/qmp-regdump: Switch to Python 3 (Karl Heubaum)
  - block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts() (Stefano Garzarella) [Orabug: 33916572] {CVE-2021-4145}


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-3.el9
changelog:
  - acpi: pcihp: pcie: set power on cap on parent slot (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: expire pending delete (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: fast unplug when slot power is off (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: add power indicator blink check (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pci: implement power state (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - tests: bios-tables-test update expected blobs (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
  - hw/i386/acpi-build: Deny control on PCIe Native Hot-plug in _OSC (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
  - bios-tables-test: Allow changes in DSDT ACPI tables (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
  - hw/acpi/ich9: Add compat prop to keep HPC bit set for 6.1 machine type (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-4.el9
changelog:
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella) [Orabug: 34591445] {CVE-2021-4207}
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella) [Orabug: 34591281] {CVE-2021-4206}
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
  - tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
  - virtio-net: fix map leaking on error during receive (Jason Wang) [Orabug: 34538375] {CVE-2022-26353}
  - vfio: defer to commit kvm irq routing when enable msi/msix (Mike Longpeng) [Orabug: 34528963]
  - Revert "vfio: Avoid disabling and enabling vectors repeatedly in VFIO migration" (Mike Longpeng) [Orabug: 34528963]
  - vfio: simplify the failure path in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
  - vfio: move re-enabling INTX out of the common helper (Mike Longpeng) [Orabug: 34528963]
  - vfio: simplify the conditional statements in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
  - kvm/msi: do explicit commit when adding msi routes (Mike Longpeng) [Orabug: 34528963]
  - kvm-irqchip: introduce new API to support route change (Mike Longpeng) [Orabug: 34528963]
  - event_notifier: handle initialization failure better (Maxim Levitsky) [Orabug: 34528963]
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu)
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu)
  - vhost-vdpa: backend feature should set only once (Si-Wei Liu)
  - vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu)
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu)
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu)
  - virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu)
  - virtio: fix the condition for iommu_platform not supported (Halil Pasic)
  - vdpa: Make ncs autofree (Eugenio Perez)
  - vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier)
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier)
  - vhost-vdpa: stick to -errno error return convention (Roman Kagan)
  - vdpa: Add dummy receive callback (Eugenio Perez)
  - vdpa: Check for existence of opts.vhostdev (Eugenio Perez)
  - vdpa: Replace qemu_open_old by qemu_open at (Eugenio Perez)
  - vhost: Fix last vq queue index of devices with no cvq (Eugenio Perez)
  - vhost: Rename last_index to vq_index_end (Eugenio Perez)
  - net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella)
  - vhost-vdpa: Set discarding of RAM broken when initializing the backend (David Hildenbrand)
  - vhost-vdpa: multiqueue support (Jason Wang)
  - virtio-net: vhost control virtqueue support (Jason Wang)
  - vhost: record the last virtqueue index for the virtio device (Jason Wang)
  - virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang)
  - vhost-net: control virtqueue support (Jason Wang)
  - net: introduce control client (Jason Wang)
  - vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang)
  - vhost-vdpa: prepare for the multiqueue support (Jason Wang)
  - vhost-vdpa: classify one time request (Jason Wang)
  - vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang)
  - vdpa: Check for iova range at mappings changes (Eugenio Perez)
  - vdpa: Add vhost_vdpa_section_end (Eugenio Perez)
  - net/vhost-vdpa: Fix device compatibility check (Kevin Wolf)
  - net/vhost-user: Fix device compatibility check (Kevin Wolf)
  - net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf)
  - memory: Name all the memory listeners (Peter Xu)
  - vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang)
  - vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang)
  - vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang)
  - vhost_net: do not assume nvqs is always 2 (Jason Wang)
  - vhost: use unsigned int for nvqs (Jason Wang)
  - vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang)
  - vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang)
  - vhost-vdpa: remove unused variable "acked_features" (Jason Wang)
  - vhost: correctly detect the enabling IOMMU (Jason Wang)
  - virtio-pci: implement iommu_enabled() (Jason Wang)
  - virtio-bus: introduce iommu_enabled() (Jason Wang)
  - hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu)
  - vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Perez)
  - target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero) [Orabug: 33528615]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-5.el9
changelog:
  - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35064352] {CVE-2022-1050}
  - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daudé) [Orabug: 35060182] {CVE-2022-4144}
  - hw/display/qxl: Pass requested buffer size to qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Document qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - ui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext (Mauro Matteo Cascella) [Orabug: 35060115] {CVE-2022-3165}
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)
  - vl: Add an -action option to override MCE handling (Mark Kanda) [Orabug: 34779160]
  - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt) [Orabug: 34779541] {CVE-2022-4172}
  - target/i386: kvm: do not access uninitialized variable on older kernels (Paolo Bonzini) [Orabug: 34492975]
  - x86: Support XFD and AMX xsave data migration (Zeng Guang) [Orabug: 34492975]
  - x86: add support for KVM_CAP_XSAVE2 and AMX state migration (Jing Liu) [Orabug: 34492975]
  - x86: Add AMX CPUIDs enumeration (Jing Liu) [Orabug: 34492975]
  - x86: Add XFD faulting bit for state components (Jing Liu) [Orabug: 34492975]
  - x86: Grant AMX permission for guest (Yang Zhong) [Orabug: 34492975]
  - x86: Add AMX XTILECFG and XTILEDATA components (Jing Liu) [Orabug: 34492975]
  - x86: Fix the 64-byte boundary enumeration for extended state (Jing Liu) [Orabug: 34492975]
  - linux-headers: include missing changes from 5.17 (Paolo Bonzini) [Orabug: 34492975]
  - linux-headers: Update headers to v5.17-rc1 (Vivek Goyal) [Orabug: 34492975]
  - linux-headers: update to 5.16-rc1 (Paolo Bonzini) [Orabug: 34492975]
  - i386/pc: restrict AMD only enforcing of 1Tb hole to new machine type (Joao Martins)
  - i386/pc: relocate 4g start to 1T where applicable (Joao Martins)
  - i386/pc: bounds check phys-bits against max used GPA (Joao Martins)
  - i386/pc: factor out device_memory base/size to helper (Joao Martins)
  - i386/pc: factor out above-4g end to an helper (Joao Martins)
  - i386/pc: pass pci_hole64_size to pc_memory_init() (Joao Martins)
  - i386/pc: create pci-host qdev prior to pc_memory_init() (Joao Martins)
  - hw/i386: add 4g boundary start to X86MachineState (Joao Martins)
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset (Si-Wei Liu)
  - net/vhost-vdpa.c: Fix clang compilation failure (Peter Maydell)
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa (Si-Wei Liu)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-6.el9
changelog:
  - Update changelog (Karl Heubaum) [Orabug: 35343538]
  - ebpf: fix compatibility with libbpf 1.0+ (Shreesh Adiga) [Orabug: 35268538]
  - ebpf: replace deprecated bpf_program__set_socket_filter (Haochen Tong) [Orabug: 35268538]
  - CVE-2023-1544 is not applicable to Oracle QEMU 6.1.1 (Karl Heubaum) [Orabug: 35305727] {CVE-2023-1544}
  - virtio-gpu: do not byteswap padding (Paolo Bonzini) [Orabug: 35304723]
  - KVM: x86: workaround invalid CPUID[0xD,9] info on some AMD processors (Paolo Bonzini) [Orabug: 35241527]
  - qemu-kvm.spec: fix Linux io_uring support (Mark Kanda) [Orabug: 35265200]
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse) [Orabug: 35219290]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-1.el9
changelog:
  - vl: Add an -action option to override MCE handling (Mark Kanda)
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
  - Update to QEMU 7.2.0 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-2.el9
changelog:
  - spec: allow have_tools 0 (Steve Sistare)
  - spec: allow no block device modules (Steve Sistare)
  - qemu-kvm.spec: fix Linux io_uring support (Mark Kanda)
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse) [Orabug: 35219295]
  - oslib-posix: fix uninitialized var in wait_mem_prealloc() (Mark Kanda)
  - vfio/migration: Rename entry points (Alex Williamson)
  - docs/devel: Document VFIO device dirty page tracking (Avihai Horon)
  - vfio/migration: Query device dirty page tracking support (Joao Martins)
  - vfio/migration: Block migration with vIOMMU (Joao Martins)
  - vfio/common: Add device dirty page bitmap sync (Joao Martins)
  - vfio/common: Extract code from vfio_get_dirty_bitmap() to new function (Avihai Horon)
  - vfio/common: Add device dirty page tracking start/stop (Joao Martins)
  - vfio/common: Record DMA mapped IOVA ranges (Joao Martins)
  - vfio/common: Add helper to consolidate iova/end calculation (Joao Martins)
  - vfio/common: Consolidate skip/invalid section into helper (Joao Martins)
  - vfio/common: Use a single tracepoint for skipped sections (Joao Martins)
  - vfio/common: Add helper to validate iova/end against hostwin (Joao Martins)
  - vfio/common: Add VFIOBitmap and alloc function (Avihai Horon)
  - vfio/common: Abort migration if dirty log start/stop/sync fails (Avihai Horon)
  - vfio/common: Fix wrong %m usages (Avihai Horon)
  - vfio/common: Fix error reporting in vfio_get_dirty_bitmap() (Avihai Horon)
  - docs/devel: Align VFIO migration docs to v2 protocol (Avihai Horon)
  - vfio: Alphabetize migration section of VFIO trace-events file (Avihai Horon)
  - vfio/migration: Remove VFIO migration protocol v1 (Avihai Horon)
  - vfio/migration: Implement VFIO migration protocol v2 (Avihai Horon)
  - vfio/migration: Rename functions/structs related to v1 protocol (Avihai Horon)
  - vfio/migration: Move migration v1 logic to vfio_migration_init() (Avihai Horon)
  - vfio/migration: Block multiple devices migration (Avihai Horon)
  - vfio/common: Change vfio_devices_all_running_and_saving() logic to equivalent one (Avihai Horon)
  - vfio/migration: Allow migration without VFIO IOMMU dirty tracking support (Avihai Horon)
  - vfio/migration: Fix NULL pointer dereference bug (Avihai Horon)
  - linux-headers: Update to v6.2-rc8 (Avihai Horon)
  - migration/qemu-file: Add qemu_file_get_to_fd() (Avihai Horon)
  - migration: Rename res_{postcopy,precopy}_only (Juan Quintela)
  - migration: Remove unused res_compatible (Juan Quintela)
  - migration: In case of postcopy, the memory ends in res_postcopy_only (Juan Quintela)
  - migration: I messed state_pending_exact/estimate (Juan Quintela)
  - linux-headers: Update to v6.1 (Peter Xu)
  - migration: simplify migration_iteration_run() (Juan Quintela)
  - migration: Remove unused threshold_size parameter (Juan Quintela)
  - migration: Split save_live_pending() into state_pending_* (Juan Quintela)
  - migration: No save_live_pending() method uses the QEMUFile parameter (Juan Quintela)
  - Revert "virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events" (Karl Heubaum) [Orabug: 35161059]
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
  - oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]
  - qemu-kvm.spec: vhost-user is conditional (Steve Sistare) 
  - qemu-kvm.spec: libseccomp is conditional (Steve Sistare)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-3.el9
changelog:
  - vfio/migration: Skip log_sync during migration SETUP state (Avihai Horon) [Orabug: 35384144]
  - migration: fix ram_state_pending_exact() (Juan Quintela) [Orabug: 35384144]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-4.el9
changelog:
  - vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
  - vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
  - sysemu: Add pre VM state change callback (Avihai Horon)
  - vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
  - vfio/common: Add an option to relax vIOMMU usage (Joao Martins)
  - virtio-rng-pci: fix transitional migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
  - virtio-rng-pci: fix migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
  - vfio: Fix null pointer dereference bug in vfio_bars_finalize() (Avihai Horon)
  - vfio/migration: Return bool type for vfio_migration_realize() (Zhenzhong Duan)
  - vfio/migration: Remove print of "Migration disabled" (Zhenzhong Duan)
  - vfio/migration: Free resources when vfio_migration_realize fails (Zhenzhong Duan)
  - vfio/migration: Change vIOMMU blocker from global to per device (Zhenzhong Duan)
  - vfio/pci: Disable INTx in vfio_realize error path (Zhenzhong Duan)
  - vfio/pci: Free leaked timer in vfio_realize error path (Zhenzhong Duan)
  - vfio/pci: Fix a segfault in vfio_realize (Zhenzhong Duan)
  - vfio/migration: Make VFIO migration non-experimental (Avihai Horon)
  - vfio/migration: Reset bytes_transferred properly (Avihai Horon)
  - vfio/pci: Call vfio_prepare_kvm_msi_virq_batch() in MSI retry path (Shameer Kolothum)
  - vfio/migration: Add support for switchover ack capability (Avihai Horon)
  - vfio/migration: Add VFIO migration pre-copy support (Avihai Horon)
  - vfio/migration: Store VFIO migration flags in VFIOMigration (Avihai Horon)
  - vfio/migration: Refactor vfio_save_block() to return saved data size (Avihai Horon)
  - tests: Add migration switchover ack capability test (Avihai Horon)
  - migration: Enable switchover ack capability (Avihai Horon)
  - migration: Implement switchover ack logic (Avihai Horon)
  - migration: Add switchover ack capability (Avihai Horon)
  - target/i386: Add EPYC-Genoa model to support Zen 4 processor series (Babu Moger) [Orabug: 35555649]
  - target/i386: Add VNMI and automatic IBRS feature bits (Babu Moger) [Orabug: 35555649]
  - target/i386: Add missing feature bits in EPYC-Milan model (Babu Moger) [Orabug: 35555649]
  - target/i386: Add feature bits for CPUID_Fn80000021_EAX (Babu Moger) [Orabug: 35555649]
  - target/i386: Add a couple of feature bits in 8000_0008_EBX (Babu Moger) [Orabug: 35555649]
  - target/i386: Add new EPYC CPU versions with updated cache_info (Michael Roth) [Orabug: 35555649]
  - target/i386: allow versioned CPUs to specify new cache_info (Michael Roth) [Orabug: 35555649]
  - target/i386/kvm: get and put AMD pmu registers (Dongli Zhang) [Orabug: 35562155]
  - Makefile: qemu-bundle is a directory (Juan Quintela)
  - 9pfs: prevent opening special files (CVE-2023-2861) (Christian Schoenebeck) [Orabug: 35570017] {CVE-2023-2861}
  - pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li) [Orabug: 33642532]
  - pcie: Do not set power state for some hot-plugged devices (Annie Li) [Orabug: 33642532]
  - pc: q35: Bump max_cpus to 1024 (Suravee Suthikulpanit) [Orabug: 35425619]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-5.el9
changelog:
  - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35683774] {CVE-2023-3180}
  - io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrangé) [Orabug: 35683826] {CVE-2023-3354}
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug: 35683770] {CVE-2023-3255}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35683817] {CVE-2023-0330}
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35649138] {CVE-2023-3301}
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-6.el9
changelog:
  - hw/smbios: Fix core count in type4 (Zhao Liu) [Orabug: 35869694]
  - hw/smbios: Fix thread count in type4 (Zhao Liu) [Orabug: 35869694]
  - hw/smbios: Fix smbios_smp_sockets caculation (Zhao Liu) [Orabug: 35869694]
  - machine: Add helpers to get cores/threads per socket (Zhao Liu) [Orabug: 35869694]
  - migration/multifd: Move load_cleanup inside incoming_state_destroy (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Join all multifd threads in order to avoid leaks (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Remove unnecessary assignment on multifd_load_cleanup() (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Change multifd_load_cleanup() signature and usage (Leonardo Bras) [Orabug: 35829153]
  - vfio/migration: Block VFIO migration with background snapshot (Avihai Horon)
  - vfio/migration: Block VFIO migration with postcopy migration (Avihai Horon)
  - migration: Add .save_prepare() handler to struct SaveVMHandlers (Avihai Horon)
  - migration: Move more initializations to migrate_init() (Avihai Horon)
  - vfio/migration: Fail adding device with enable-migration=on and existing blocker (Avihai Horon)
  - migration: Add migration prefix to functions in target.c (Avihai Horon)
  - vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
  - vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
  - vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
  - qdev: Add qdev_add_vm_change_state_handler_full() (Avihai Horon)
  - sysemu: Add prepare callback to struct VMChangeStateEntry (Avihai Horon)
  - vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup() (Avihai Horon)
  - hw/vfio: Add number of dirty pages to vfio_get_dirty_bitmap tracepoint (Joao Martins)
  - exec/ram_addr: Return number of dirty pages in cpu_physical_memory_set_dirty_lebitmap() (Joao Martins)
  - migration: fix populate_vfio_info (Steve Sistare)
  - vfio/migration: Revert out of tree P2P support (Joao Martins)
  - async: clarify usage of barriers in the polling case (Paolo Bonzini) [Orabug: 35871058]
  - async: update documentation of the memory barriers (Paolo Bonzini) [Orabug: 35871058]
  - physmem: add missing memory barrier (Paolo Bonzini) [Orabug: 35871058]
  - qemu-coroutine-lock: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - aio-wait: switch to smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - edu: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - qemu-thread-win32: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
  - qemu-thread-posix: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
  - qatomic: add smp_mb__before/after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - dump: kdump-zlib data pages not dumped with pvtime/aarch64 (Dongli Zhang) [Orabug: 35777876]
  - hw/smbios: fix field corruption in type 4 table (Julia Suvorova) [Orabug: 35756216]
  - kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35728782]
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35728782]
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35728782]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-7.el9
changelog:
  - vfio/common: Probe type1 iommu dirty tracking support (Joao Martins) [Orabug: 36024839]
  - vfio/common: Allow disabling device dirty page tracking (Joao Martins) [Orabug: 36024839]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-11.el9
changelog:
  - vfio/migration: Add a note about migration rate limiting (Avihai Horon) [Orabug: 36329758]
  - vfio/migration: Refactor vfio_save_state() return value (Avihai Horon) [Orabug: 36329758]
  - migration: Don't serialize devices in qemu_savevm_state_iterate() (Avihai Horon) [Orabug: 36329758]
  - ui/clipboard: add asserts for update and request (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
  - ui/clipboard: mark type as not available when there is no data (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
  - virtio-net: correctly copy vnet header when flushing TX (Jason Wang) [Orabug: 36154459] {CVE-2023-6693}
  - esp: restrict non-DMA transfer length to that of available data (Mark Cave-Ayland) [Orabug: 36322141] {CVE-2024-24474}
  - vhost: Perform memory section dirty scans once per iteration (Si-Wei Liu)
  - vhost: dirty log should be per backend type (Si-Wei Liu)
  - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
  - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
  - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 33774027] {CVE-2021-3750}
  - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - hw/acpi: propagate vcpu hotplug after switch to modern interface (Aaron Young)
  - migration: Fix use-after-free of migration state object (Fabiano Rosas) [Orabug: 36242218]
  - kvm: Fix crash due to access uninitialized kvm_state (Gavin Shan) [Orabug: 36269244]
  - migration: Avoid usage of static variable inside tracepoint (Joao Martins)
  - migration: Add tracepoints for downtime checkpoints (Peter Xu)
  - migration: migration_stop_vm() helper (Peter Xu)
  - migration: Add per vmstate downtime tracepoints (Peter Xu)
  - migration: Add migration_downtime_start|end() helpers (Peter Xu)
  - migration: Set downtime_start even for postcopy (Peter Xu)
  - hv-balloon: implement pre-Glib 2.68 compatibility (Maciej S. Szmigiero)
  - hw/i386/pc: Support hv-balloon (Maciej S. Szmigiero)
  - qapi: Add HV_BALLOON_STATUS_REPORT event and its QMP query command (Maciej S. Szmigiero)
  - qapi: Add query-memory-devices support to hv-balloon (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) hot-add support (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) base (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol definitions (Maciej S. Szmigiero)
  - memory-device: Drop size alignment check (David Hildenbrand)
  - memory-device: Support empty memory devices (David Hildenbrand)
  - memory,vhost: Allow for marking memory device memory regions unmergeable (David Hildenbrand)
  - memory: Clarify mapping requirements for RamDiscardManager (David Hildenbrand)
  - memory-device,vhost: Support automatic decision on the number of memslots (David Hildenbrand)
  - vhost: Add vhost_get_max_memslots() (David Hildenbrand)
  - kvm: Add stub for kvm_get_max_memslots() (David Hildenbrand)
  - memory-device,vhost: Support memory devices that dynamically consume memslots (David Hildenbrand)
  - memory-device: Track required and actually used memslots in DeviceMemoryState (David Hildenbrand)
  - stubs: Rename qmp_memory_device.c to memory_device.c (David Hildenbrand)
  - memory-device: Support memory devices with multiple memslots (David Hildenbrand)
  - vhost: Return number of free memslots (David Hildenbrand)
  - kvm: Return number of free memslots (David Hildenbrand)
  - vhost: Remove vhost_backend_can_merge() callback (David Hildenbrand)
  - vhost: Rework memslot filtering and fix "used_memslot" tracking (David Hildenbrand)
  - virtio-md-pci: New parent type for virtio-mem-pci and virtio-pmem-pci (David Hildenbrand)
  - migration/ram: Expose ramblock_is_ignored() as migrate_ram_is_ignored() (David Hildenbrand)
  - virtio-mem: Skip most of virtio_mem_unplug_all() without plugged memory (David Hildenbrand)
  - softmmu/physmem: Warn with ram_block_discard_range() on MAP_PRIVATE file mapping (David Hildenbrand)
  - memory-device: Track used region size in DeviceMemoryState (David Hildenbrand)
  - memory-device: Refactor memory_device_pre_plug() (David Hildenbrand)
  - hw/i386/pc: Remove PC_MACHINE_DEVMEM_REGION_SIZE (David Hildenbrand)
  - hw/i386/acpi-build: Rely on machine->device_memory when building SRAT (David Hildenbrand)
  - hw/i386/pc: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/loongarch/virt: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/ppc/spapr: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/arm/virt: Use machine_memory_devices_init() (David Hildenbrand)
  - memory-device: Introduce machine_memory_devices_init() (David Hildenbrand)
  - memory-device: Unify enabled vs. supported error messages (David Hildenbrand)
  - hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] (Thomas Huth) [Orabug: 35808564] {CVE-2023-42467}
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}
  - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-13.el9
changelog:
  - vfio/migration: Enhance VFIO migration state tracing (Avihai Horon)
  - vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon)
  - vfio/migration: Emit VFIO migration QAPI event (Avihai Horon)
  - qapi/vfio: Add VFIO migration QAPI event (Avihai Horon)
  - migration/multifd: solve zero page causing multiple page faults (Yuan Liu) [Orabug: 36727051]
  - multifd: Add the ramblock to MultiFDRecvParams (Lukas Straub) [Orabug: 36727051]
  - migration: Fix qmp_query_migrate mbps value (Fabiano Rosas) [Orabug: 36727104]
  - migration: Allow user to specify available switchover bandwidth (Peter Xu) [Orabug: 35636284]
  - migration/dirtyrate: Fix precision losses and g_usleep overshoot (Andrei Gudkov) [Orabug: 36727091]
  - Use new created qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
  - softmmu: Create qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
  - migration/calc-dirty-rate: replaced CRC32 with xxHash (Andrei Gudkov) [Orabug: 36727063]
  - migration/multifd: Enable multifd zero page checking by default. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Implement zero page transmission on the multifd thread. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Add new migration option zero-page-detection. (Hao Xiang) [Orabug: 34131170]
  - migration: Make ram_save_target_page() a pointer (Juan Quintela) [Orabug: 34131170]
  - migration: Yield bitmap_mutex properly when sending/sleeping (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Add a synchronization point for channel creation (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Unify multifd and TLS connection paths (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Move multifd_send_setup into migration thread (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Move multifd_send_setup error handling in to the function (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Remove p->running (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Optimize sender side to be lockless (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Join the TLS thread (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Fix MultiFDSendParams.packet_num race (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Stick with send/recv on function names (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Cleanup multifd_load_cleanup() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Cleanup multifd_save_cleanup() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Rewrite multifd_queue_page() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Change retval of multifd_send_pages() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Change retval of multifd_queue_page() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Split multifd_send_terminate_threads() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Forbid spurious wakeups (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move header prepare/fill into send_prepare() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: multifd_send_prepare_header() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move trace_multifd_send|recv() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move total_normal_pages accounting (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Rename p->num_packets and clean it up (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Drop pages->num check in sender thread (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Simplify locking in sender thread (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Separate SYNC request with normal jobs (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Drop MultiFDSendParams.normal[] array (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Postpone reset of MultiFDPages_t (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Remove MultiFDPages_t::packet_num (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths (Peter Xu) [Orabug: 34131170]
  - migration/multifd: multifd_send_kick_main() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Fix leaking of Error in TLS error flow (Avihai Horon) [Orabug: 34131170]
  - migration/ram: Merge save_zero_page functions (Fabiano Rosas) [Orabug: 34131170]
  - migration/ram: Move xbzrle zero page handling into save_zero_page (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Stop setting p->ioc before connecting (Fabiano Rosas) [Orabug: 34131170]
  - migration: Centralize BH creation and dispatch (Fabiano Rosas) [Orabug: 34131170]
  - migration: Add a wrapper to qemu_bh_schedule (Fabiano Rosas) [Orabug: 34131170]
  - migration: Remove transferred atomic counter (Juan Quintela) [Orabug: 35636284]
  - migration: Use migration_transferred_bytes() (Juan Quintela) [Orabug: 35636284]
  - migration: migration_rate_limit_reset() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
  - migration: migration_transferred_bytes() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
  - multifd: reset next_packet_len after sending pages (Elena Ufimtseva) [Orabug: 35636284]
  - multifd: fix counters in multifd_send_thread (Elena Ufimtseva) [Orabug: 35636284]
  - migration/multifd: Compute transferred bytes correctly (Juan Quintela) [Orabug: 35636284]
  - migration: check for rate_limit_max for RATE_LIMIT_DISABLED (Elena Ufimtseva) [Orabug: 35636284]
  - migration: Use the number of transferred bytes directly (Juan Quintela) [Orabug: 35636284]
  - qemu_file: Use a stat64 for qemu_file_transferred (Juan Quintela) [Orabug: 35636284]
  - migration: set file error on subsection loading (Marc-André Lureau) [Orabug: 35636284]
  - migration: Receiving a zero page non zero is an error (Juan Quintela) [Orabug: 35636284]
  - migration/multifd: Stop checking p->quit in multifd_send_thread (Fabiano Rosas) [Orabug: 35636284]
  - migration/multifd: Clarify Error usage in multifd_channel_connect (Fabiano Rosas) [Orabug: 35636284]
  - multifd: cleanup the function multifd_channel_connect (Li Zhang) [Orabug: 35636284]
  - migration/multifd: Unify multifd_send_thread error paths (Fabiano Rosas) [Orabug: 35636284]
  - migration: Non multifd migration don't care about multifd flushes (Juan Quintela) [Orabug: 35636284]
  - migration: fix RAMBlock add NULL check (Dmitry Frolov) [Orabug: 35829153]
  - migration: We don't need the field rate_limit_used anymore (Juan Quintela) [Orabug: 35636284]
  - migration: Use migration_transferred_bytes() to calculate rate_limit (Juan Quintela) [Orabug: 35636284]
  - migration: Add a trace for migration_transferred_bytes (Juan Quintela) [Orabug: 35636284]
  - migration: Move migration_total_bytes() to migration-stats.c (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Remove total from qemu_file_total_transferred_*() (Juan Quintela) [Orabug: 35636284]
  - migration: Move rate_limit_max and rate_limit_used to migration_stats (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Account for rate_limit usage on qemu_fflush() (Juan Quintela) [Orabug: 35636284]
  - migration: Don't use INT64_MAX for unlimited rate (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make rate_limit_used an uint64_t (Juan Quintela) [Orabug: 35636284]
  - qemu-file: make qemu_file_[sg]et_rate_limit() use an uint64_t (Juan Quintela) [Orabug: 35636284]
  - migration: We set the rate_limit by a second (Juan Quintela) [Orabug: 35829153]
  - migration: A rate limit value of 0 is valid (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make ram_control_save_page() use accessors for rate_limit (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make total_transferred an uint64_t (Juan Quintela) [Orabug: 35636284]
  - qemu-file: No need to check for shutdown in qemu_file_rate_limit (Juan Quintela) [Orabug: 35636284]
  - migration: Document all migration_stats (Juan Quintela) [Orabug: 35636284]
  - multifd: We already account for this packet on the multifd thread (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_bytes_last_sync atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_pages_rate atomic (Juan Quintela) [Orabug: 35636284]
  - stat64: Add stat64_set() operation (Paolo Bonzini) [Orabug: 35636284]
  - multifd: Only flush once each full round of memory (Juan Quintela) [Orabug: 35636284]
  - migration: Make find_dirty_block() return a single parameter (Juan Quintela) [Orabug: 35636284]
  - migration: Simplify ram_find_and_save_block() (Juan Quintela) [Orabug: 35636284]
  - multifd: Protect multifd_send_sync_main() calls (Juan Quintela) [Orabug: 35636284]
  - multifd: Create property multifd-flush-after-each-section (Juan Quintela) [Orabug: 35636284]
  - multifd: Fix the number of channels ready (Juan Quintela) [Orabug: 35636284]
  - migration: Rename normal to normal_pages (Juan Quintela) [Orabug: 35636284]
  - migration: Rename duplicate to zero_pages (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_sync_count atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make downtime_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make precopy_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_sync_missed_zero_copy atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make multifd_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Update atomic stats out of the mutex (Juan Quintela) [Orabug: 35636284]
  - migration: Merge ram_counters and ram_atomic_counters (Juan Quintela) [Orabug: 35636284]
  - migration/multifd: correct multifd_send_thread to trace the flags (Wei Wang) [Orabug: 35636284]
  - ram: Document migration ram flags (Juan Quintela) [Orabug: 35636284]
  - migration: Calculate ram size once (Juan Quintela) [Orabug: 35636284]
  - multifd: Fix a race on reading MultiFDPages_t.block (Zhenzhong Duan) [Orabug: 35636284]
  - migration: Use atomic ops properly for page accountings (Peter Xu) [Orabug: 35636284]
  - migration: Export ram_release_page() (Juan Quintela) [Orabug: 35636284]
  - migration: Export ram_transferred_ram() (Juan Quintela) [Orabug: 35636284]
  - multifd: Create page_count fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
  - multifd: Create page_size fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
  - migration: Fix migration_channel_read_peek() error path () (Avihai Horon) [Orabug: 36726827]
  - migration/multifd: Remove error_setg() in migration_ioc_process_incoming() (Avihai Horon) [Orabug: 36726827]
  - migration: Refactor migration_incoming_setup() (Avihai Horon) [Orabug: 36726827]
  - migration: check magic value for deciding the mapping of channels (manish.mishra) [Orabug: 36726827]
  - io: Add support for MSG_PEEK for socket channel (manish.mishra) [Orabug: 36726827]
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (hilippe Mathieu-Daudé) [Orabug: 36575206] {CVE-2024-3447}
  - block: lock AioContext in bdrv_replace_child_noperm() when in non-coroutine context (Mark Kanda) [Orabug: 36514180]
  - hw/scsi/scsi-generic: Fix io_timeout property not applying (Lorenz Brun) [Orabug: 36637684]
  - target/i386/monitor: synchronize cpu state for lapic info (Dongli Zhang) [Orabug: 36607747]
  - qemu_init: increase NOFILE soft limit on POSIX (Fiona Ebner) [Orabug: 36416389]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-15.el9
changelog:
  - migration: abort on destination if switchover limit exceeded (Elena Ufimtseva)
  - migration: introduce strict switchover SLA (Elena Ufimtseva)
  - migration: add error to MigrationIncomingState (Elena Ufimtseva)
  - migration: Set migration status early in incoming side (Fabiano Rosas)
  - tests/qtest: migration: Use migrate_incoming_qmp where appropriate (Fabiano Rosas)
  - tests/qtest: migration: Add migrate_incoming_qmp helper (Fabiano Rosas)
  - tests/qtest: migration: Expose migrate_set_capability (Fabiano Rosas)
  - vfio/migration: Multifd device state transfer support - send side (Maciej S. Szmigiero)
  - vfio/migration: Add x-orcl-migration-multifd-transfer VFIO property (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - receive side (Maciej S. Szmigiero)
  - migration/multifd: Add migration_has_device_state_support() (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - send side (Maciej S. Szmigiero)
  - migration/multifd: Convert multifd_send_pages::next_channel to atomic (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - receive side (Maciej S. Szmigiero)
  - migration: Add load_finish handler and associated functions (Maciej S. Szmigiero)
  - migration: Add qemu_loadvm_load_state_buffer() and its handler (Maciej S. Szmigiero)
  - migration: Add save_live_complete_precopy_{begin,end} handlers (Maciej S. Szmigiero)
  - migration/multifd: Zero p->flags before starting filling a packet (Maciej S. Szmigiero)
  - migration/ram: Add load start trace event (Maciej S. Szmigiero)
  - vfio/migration: Add save_{iterate,complete_precopy}_started trace events (Maciej S. Szmigiero)
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/virtio: Introduce virtio_bh_new_guarded() helper (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - pcie_sriov: Validate NumVFs (Akihiko Odaki) [Orabug: 36314082] {CVE-2024-26327}
  - hw/nvme: Use pcie_sriov_num_vfs() (Akihiko Odaki) [Orabug: 36314111] {CVE-2024-26328}
  - pcie: Introduce pcie_sriov_num_vfs (Akihiko Odaki) [Orabug: 36314111] {CVE-2024-26328}
  - qcow2: Don't open data_file with BDRV_O_NO_IO (Kevin Wolf) [Orabug: 36801853] {CVE-2024-4467}
  - target/i386: drop AMD machine check bits from Intel CPUID (Paolo Bonzini) [Orabug: 36785079]
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word (Paolo Bonzini) [Orabug: 36785079]
  - migration: prevent migration when VM has poisoned memory (William Roche) [Orabug: 35533097]
  - i386: Add support for overflow recovery (John Allen) [Orabug: 34691766]
  - i386: Add support for SUCCOR feature (John Allen) [Orabug: 34691766]
  - i386: Fix MCE support for AMD hosts (John Allen) [Orabug: 34691766]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-16.el9
changelog:
  - block: fix failing assert on paused VM migration (Andrey Drobyshev) [Orabug: 37106834]
  - migration/multifd: Fix rb->receivedmap cleanup race (Fabiano Rosas) [Orabug: 36932320]
  - migration/savevm: Remove extra load cleanup calls (Fabiano Rosas) [Orabug: 36932320]
  - migration: fix switchover abort termination paths (Elena Ufimtseva) [Orabug: 36932320]
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100 (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: Plumb in new args to nbd_client_add() (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd: Minor style and typo fixes (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - scsi-disk: Always report RESERVATION_CONFLICT to guest (Kevin Wolf)
  - scsi-disk: Add warning comments that host_status errors take a shortcut (Kevin Wolf)
  - scsi-block: Don't skip callback for sgio error status/driver_status (Kevin Wolf)
  - scsi-disk: Use positive return value for status in dma_readv/writev (Kevin Wolf)
  - target/i386: Add new CPU model SierraForest (Tao Su)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model (Lei Wang)
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES (Tao Su)
  - target/i386: Allow MCDT_NO if host supports (Tao Su)
  - target/i386: Add support for MCDT_NO in CPUID enumeration (Tao Su)
  - target/i386: Adjust feature level according to FEAT_7_1_EDX (Tao Su)
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests (Pawan Gupta)
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-IFMA in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AMX-FP16 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for CMPCCXADD in CPUID enumeration (Jiaxi Chen)
  - i386: Add new CPU model SapphireRapids (Wang, Lei)
  - target/i386: KVM: allow fast string operations if host supports them (Paolo Bonzini)
  - target/i386: add FZRM, FSRS, FSRC (Paolo Bonzini)
  - spec: disable keyutils (Mark Kanda) [Orabug: 36903731]
  - meson.build: Make keyutils independent from keyring (Thomas Huth) [Orabug: 36903731]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-17.el9
changelog:
  - target/i386: add feature bits for Inception/SRSO mitigations (Mark Kanda) [Orabug: 37170148]
  - hw/vfio/pci-quirks: Sanitize capability pointer (Alex Williamson) [Orabug: 37176213]
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques (Alex Williamson) [Orabug: 37176213]
  - migration/dirtyrate: Add new mode to dirty track non KVM device separately (Joao Martins) [Orabug: 37097510]
  - vfio/migration: Allow dirty tracking reports with MIGRATION_STATUS_NONE (Joao Martins) [Orabug: 37097510]
  - migration: Emit event when source starts switchover (Joao Martins) [Orabug: 37097503]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-18.el9
changelog:
  - tests: acpi: update expected blobs (Igor Mammedov) [Orabug: 37274182]
  - cpuhp: make sure that remove events are handled within the same SCI (Igor Mammedov) [Orabug: 37274182]
  - tests: acpi: whitelist expected blobs (Igor Mammedov) [Orabug: 37274182]
  - target/i386: Reset TSCs of parked vCPUs too on VM reset (Maciej S. Szmigiero) [Orabug: 37318424]
  - 9pfs: fix regression regarding CVE-2023-2861 (Christian Schoenebeck) [Orabug: 37409273]
  - virtio-net: Ensure queue index fits with RSS (Akihiko Odaki) [Orabug: 36943011] {CVE-2024-6505}
  - qemu-kvm.spec: pack elf2dmp tool (Annie Li)
  - test: bios-tables-test: add IVRS changed binary (Bui Quang Minh) [Orabug: 35710551]
  - amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds (Sairaj Kodilkar) [Orabug: 35710551]
  - amd_iommu: Check APIC ID > 255 for XTSup (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Send notification when invalidate interrupt entry cache (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Use shared memory region for Interrupt Remapping (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Add support for pass though mode (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Rename variable mmio to mr_mmio (Suravee Suthikulpanit) [Orabug: 35710551]
  - hw/i386/amd_iommu: Don't leak memory in amdvi_update_iotlb() (Peter Maydell) [Orabug: 35710551]
  - amd_iommu: report x2APIC support to the operating system (Bui Quang Minh) [Orabug: 35710551]
  - hw/i386/amd_iommu: Do not use SysBus API to map local MMIO region (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - amd_iommu: Fix APIC address check (Akihiko Odaki) [Orabug: 35710551]
  - hw/i386/amd_iommu: Factor amdvi_pci_realize out of amdvi_sysbus_realize (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Set PCI static/const fields via PCIDeviceClass (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Move capab_offset from AMDVIState to AMDVIPCIState (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Remove intermediate AMDVIState::devid field (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Explicit use of AMDVI_BASE_ADDR in amdvi_init (Philippe Mathieu-Daudé) [Orabug: 35710551]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-20.el9
changelog:
  - Document CVEs as not applicable to QEMU 7.2.0 (Mark Kanda) [Orabug: 36869706] [Orabug: 36620547] [Orabug: 37043479] {CVE-2024-3567} {CVE-2024-4693} {CVE-2024-7730}
  - target/i386: Remove rtm, hle and taa-no from the Sapphire Rapids CPU model (Mark Kanda) [Orabug: 37867203]
  - target/i386: Reset parked vCPUs together with the online ones (Maciej S. Szmigiero)
  - migration: Add capability for our custom switchover event (Maciej S. Szmigiero)
  - iotests: Disable ones that hang (Maciej S. Szmigiero)
  - vfio/migration: Use BE byte order for device state wire packets (Maciej S. Szmigiero)
  - vfio/migration: Make x-migration-multifd-transfer VFIO property mutable (Maciej S. Szmigiero)
  - vfio/migration: Add x-migration-multifd-transfer VFIO property (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - send side (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - config loading support (Maciej S. Szmigiero)
  - migration/qemu-file: Define g_autoptr() cleanup function for QEMUFile (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - load thread (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - received buffers queuing (Maciej S. Szmigiero)
  - vfio/migration: Setup and cleanup multifd transfer in these general methods (Maciej S. Szmigiero)
  - vfio/migration: Multifd setup/cleanup functions and associated VFIOMultifd (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer - add support checking function (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - basic types (Maciej S. Szmigiero)
  - vfio/migration: Move migration channel flags to vfio-common.h header file (Maciej S. Szmigiero)
  - vfio/migration: Add vfio_add_bytes_transferred() (Maciej S. Szmigiero)
  - vfio/migration: Convert bytes_transferred counter to atomic (Maciej S. Szmigiero)
  - vfio/migration: Add load_device_config_state_start trace event (Maciej S. Szmigiero)
  - migration: Add save_live_complete_precopy_thread handler (Maciej S. Szmigiero)
  - migration/multifd: Add multifd_device_state_supported() (Maciej S. Szmigiero)
  - migration/multifd: Make MultiFDSendData a struct (Peter Xu)
  - migration/multifd: Device state transfer support - send side (Maciej S. Szmigiero)
  - migration/multifd: Add an explicit MultiFDSendData destructor (Maciej S. Szmigiero)
  - migration/multifd: Make multifd_send() thread safe (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - receive side (Maciej S. Szmigiero)
  - migration/multifd: Split packet into header and RAM data (Maciej S. Szmigiero)
  - migration: Add thread pool of optional load threads (Maciej S. Szmigiero)
  - error: define g_autoptr() cleanup function for the Error type (Maciej S. Szmigiero)
  - migration: Always take BQL for migration_incoming_state_destroy() (Maciej S. Szmigiero)
  - migration: Add qemu_loadvm_load_state_buffer() and its handler (Maciej S. Szmigiero)
  - migration: Add MIG_CMD_SWITCHOVER_START and its load handler (Maciej S. Szmigiero)
  - thread-pool: Implement generic (non-AIO) pool support (Maciej S. Szmigiero)
  - thread-pool: Rename AIO pool functions to *_aio() and data types to *Aio (Maciej S. Szmigiero)
  - thread-pool: Remove thread_pool_submit() function (Maciej S. Szmigiero)
  - migration: Check migration error after loadvm (Fabiano Rosas)
  - migration/multifd: Add a compat property for TLS termination (Fabiano Rosas)
  - migration/multifd: Terminate the TLS connection (Fabiano Rosas)
  - io: Add a read flag for relaxed EOF (Fabiano Rosas)
  - io: Add flags argument to qio_channel_readv_full_all_eof (Fabiano Rosas)
  - crypto: Remove qcrypto_tls_session_get_handshake_status (Fabiano Rosas)
  - io: tls: Add qio_channel_tls_bye (Fabiano Rosas)
  - crypto: Allow gracefully ending the TLS session (Fabiano Rosas)
  - migration/multifd: Fix compat with QEMU < 9.0 (Fabiano Rosas)
  - vfio/migration: Add vfio_save_block_precopy_empty_hit trace event (Maciej S. Szmigiero)
  - vfio/migration: Add save_{iterate, complete_precopy}_start trace events (Maciej S. Szmigiero)
  - migration/ram: Add load start trace event (Maciej S. Szmigiero)
  - migration/multifd: Stop changing the packet on recv side (Fabiano Rosas)
  - migration/multifd: Replace multifd_send_state->pages with client data (Fabiano Rosas)
  - migration/multifd: Don't send ram data during SYNC (Fabiano Rosas)
  - migration/multifd: Isolate ram pages packet data (Fabiano Rosas)
  - migration/multifd: Remove total pages tracing (Fabiano Rosas)
  - migration/multifd: Move pages accounting into multifd_send_zero_page_detect() (Fabiano Rosas)
  - migration/multifd: Replace p->pages with an union pointer (Fabiano Rosas)
  - migration/multifd: Make MultiFDPages_t:offset a flexible array member (Fabiano Rosas)
  - migration/multifd: Introduce MultiFDSendData (Fabiano Rosas)
  - migration/multifd: Remove pages->allocated (Fabiano Rosas)
  - migration/multifd: Inline page_size and page_count (Fabiano Rosas)
  - migration/multifd: Reduce access to p->pages (Fabiano Rosas)
  - migration/multifd: Decouple recv method from pages (Fabiano Rosas)
  - migration/multifd: Rename MultiFDSend|RecvParams::data to compress_data (Fabiano Rosas)
  - migration/multifd: Change multifd_pages_init argument (Fabiano Rosas)
  - migration: Introduce migrate_has_error() (Peter Xu)
  - test-vmstate: fix bad GTree usage, use-after-free (Eric Auger)
  - Revert "vfio/migration: Add save_{iterate,complete_precopy}_started trace events" (Maciej S. Szmigiero)
  - Revert "migration/ram: Add load start trace event" (Maciej S. Szmigiero)
  - Revert "migration: Add save_live_complete_precopy_{begin,end} handlers" (Maciej S. Szmigiero)
  - Revert "migration: Add qemu_loadvm_load_state_buffer() and its handler" (Maciej S. Szmigiero)
  - Revert "migration: Add load_finish handler and associated functions" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Device state transfer support - receive side" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Convert multifd_send_pages::next_channel to atomic" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Device state transfer support - send side" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Add migration_has_device_state_support()" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Multifd device state transfer support - receive side" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Add x-orcl-migration-multifd-transfer VFIO property" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Multifd device state transfer support - send side" (Maciej S. Szmigiero)
  - target/i386: fix feature dependency for WAITPKG (Paolo Bonzini) [Orabug: 35941551]
  - target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE (Ake Koomsin) [Orabug: 35941551]
  - vhost-scsi: Add support for a worker thread per virtqueue (Mike Christie) [Orabug: 37723795]
  - vhost: Add worker backend callouts (Mike Christie) [Orabug: 37723795]
  - linux-headers: update vhost related headers to v6.5-rc1 (Mark Kanda) [Orabug: 37723795]
  - system/physmem: poisoned memory discard on reboot (William Roche) [Orabug: 34545034]
  - system/physmem: handle hugetlb correctly in qemu_ram_remap() (William Roche) [Orabug: 34545034]
  - qemu-kvm.spec: Ship multiboot_dma.bin (Liam Merwick) [Orabug: 37593199]
  - target/i386: Change unavail from u32 to u64 (Xiong Zhang) [Orabug: 37560962]
  - vfio/pci: Add x-device-dirty-page-tracking param (Joao Martins)


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-22.el9
changelog:
  - migration/multifd: Don't send device state packets with zerocopy flag (Maciej S. Szmigiero) [Orabug: 37372623]
  - migration/dirtyrate: skip kvm_log_start/kvm_log_stop for non-KVM (Dongli Zhang) [Orabug: 37939813]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-24.el9
changelog:
  - Revert "migration: Temporarily re-enable our custom switchover event by default" (Mark Kanda)
  - target/i386: Enumerate verw-clear CPUID feature (Boris Ostrovsky) [Orabug: 38118557] {CVE-2024-36350} {CVE-2024-36357}


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-29.el9
changelog:
  - hw/core/machine.c: Add vhost-scsi-pci num_queues = 1 to hw_compat_7_2_exadata (Greg Jumper) [Orabug: 38544462]
  - target/i386/kvm: account blackout downtime for kvm-clock and guest TSC (Dongli Zhang) [Orabug: 38307402]
  - cpus: resume hotplugged vCPU only when the guest is running (Dongli Zhang) [Orabug: 38307402]
  - system/qdev-monitor: move drain_call_rcu call under if (!dev) in qmp_device_add() (Dmitrii Gavrilov) [Orabug: 38298220]
  - acpi: pcihp: allow repeating hot-unplug requests (Igor Mammedov) [Orabug: 38257990]
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint (Peter Maydell) [Orabug: 37517799] {CVE-2024-8354}
  - target/i386: Introduce GraniteRapids-v2 model (Tao Su) [Orabug: 38330786]
  - target/i386: Add AVX512 state when AVX10 is supported (Tao Su) [Orabug: 38330786]
  - target/i386: Add feature dependencies for AVX10 (Tao Su) [Orabug: 38330786]
  - target/i386: add CPUID.24 features for AVX10 (Tao Su) [Orabug: 38330786]
  - target/i386: add AVX10 feature and AVX10 version property (Tao Su) [Orabug: 38330786]
  - target/i386: return bool from x86_cpu_filter_features (Paolo Bonzini) [Orabug: 38330786]
  - target/i386: do not rely on ExtSaveArea for accelerator-supported XCR0 bits (Paolo Bonzini) [Orabug: 38330786]
  - target/i386: Call accel-agnostic x86_cpu_get_supported_cpuid() (Philippe Mathieu-Daudé) [Orabug: 38330786]
  - target/i386: Add new CPU model GraniteRapids (Tao Su) [Orabug: 38330786]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-30.el9
changelog:
  - live migration: scan and clear contiguous dirty pages regions of ram (Elena Ufimtseva) [Orabug: 38388170]
  - migration: add hash_rate trace point (Elena Ufimtseva) [Orabug: 38388170]
  - migration: add parameter to specify max number of contiguous pages (Elena Ufimtseva) [Orabug: 38388170]
  - multifd: send more pages then IOV_MAX (Elena Ufimtseva) [Orabug: 38388170]
  - io: fix use after free in websocket handshake code (Daniel P. Berrangé) [Orabug: 38687831] {CVE-2025-11234}


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-32.el9
changelog:
  - spec: Provide aarch64 and mips user static packages (Mark Kanda)
    These packages are for Oracle internal use only (not for external customers)
  - cpu: Only compile runstate_is_running() for system mode (Mark Kanda)
  - linux-user: Do not define struct sched_attr if libc headers do (Khem Raj)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-33.el9
changelog:
  - migration: Change default pages to scan to 8192 for Exadata (Elena Ufimtseva) [Orabug: 38732433]
  - meson: check if isa-l installed and enable it (Elena Ufimtseva) [Orabug: 38732433]
  - migration/page_cache: Improve isal-crypto-mb-sha256 cache-miss handling (Joao Martins) [Orabug: 38732433]
  - migration/page_cache: Add isal_crypto multi-buffer sha256 variant (Joao Martins) [Orabug: 38732433]
  - migration/page_cache: Add batching mode support for isa-l_crypto (Joao Martins) [Orabug: 38732433]
  - migration: Use algorithm table to initialize hashing (Elena Ufimtseva) [Orabug: 38732433]
  - migration: Add existing algorithms to description table (Elena Ufimtseva) [Orabug: 38732433]
  - migration: Add a unified description structure for hashing algorithms (Elena Ufimtseva) [Orabug: 38732433]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-34.el9
changelog:
  - migration: bugfix - free migration_ops correctly (Elena Ufimtseva) [Orabug: 38977316]
  - target/i386/kvm: set VM ioctl KVM_SET_TSC_KHZ post loadvm (Dongli Zhang) [Orabug: 38928409]
  - migration: introduce KVM function called post loadvm (Dongli Zhang) [Orabug: 38928409]
  - migration: add extra checks in multifd_ram_fill_packet (Elena Ufimtseva) [Orabug: 38949741]
  - migration: fix the error path semantic in multifd thread (Elena Ufimtseva) [Orabug: 38949741]
  - page_cache: dynamic cache allocation (Elena Ufimtseva) [Orabug: 38854239] [Orabug: 38949741]
  - multifd: return errors on packets filling (Elena Ufimtseva) [Orabug: 38854239]
  - migration: detect errors on hash initialization (Elena Ufimtseva) [Orabug: 38876780]
  - migration: propagate hashing errors (Elena Ufimtseva) [Orabug: 38876780]
  - migration/multifd: Handle allocation failures (Elena Ufimtseva) [Orabug: 38876780]
  - migration: Add Error** argument to ram_state_init() (Cédric Le Goater) [Orabug: 38876780]
  - migration: Add Error** argument to .load_setup() handler (Cédric Le Goater) [Orabug: 38876780]
  - migration: Add Error** argument to .save_setup() handler (Cédric Le Goater) [Orabug: 38876780]
  - migration: Add Error** argument to qemu_savevm_state_setup() (Cédric Le Goater) [Orabug: 38876780]
  - migration: Add Error** argument to vmstate_save() (Cédric Le Goater) [Orabug: 38876780]
  - migration: Always report an error in ram_save_setup() (Cédric Le Goater) [Orabug: 38876780]
  - qemu-file: Make qemu_fflush() return errors (Juan Quintela) [Orabug: 38876780]
  - qemu-file: remove shutdown member (Juan Quintela) [Orabug: 38876780]
  - vfio: Always report an error in vfio_save_setup() (Cédric Le Goater) [Orabug: 38876780]
  - migration/vmstate: Introduce vmstate_save_state_with_err (Tejus GK) [Orabug: 38876780]
  - migration/vfio: Remove x-orcl-device-dirty-page-tracking (Elena Ufimtseva) [Orabug: 38944077]
  - target/i386/kvm: write tsc_offset for parked vCPUs too (Dongli Zhang) [Orabug: 38853905]
  - accel/kvm:: move KVMParkedVcpu definition to header file (Dongli Zhang) [Orabug: 38853905]
  - target/i386/kvm: use vCPU 0 tsc_offset for all vCPUs (Dongli Zhang) [Orabug: 38853905]
  - target/i386/kvm: account downtime only with synchronized TSC (Dongli Zhang) [Orabug: 38853905]
  - target/i386/kvm: implement reset method for kvmclock (Dongli Zhang) [Orabug: 38853905]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-35.el9
changelog:
  - migration: Disable switchover-ack-legacy by default for Exadata (Maciej S. Szmigiero) [Orabug: 37502472]
  - vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during completion (Avihai Horon) [Orabug: 37502472]
  - vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT (Avihai Horon) [Orabug: 37502472]
  - vfio/migration: Implement new switchover-ack mechanism (Avihai Horon) [Orabug: 37502472]
  - vfio/migration: Add Error ** parameter to vfio_migration_init() (Avihai Horon) [Orabug: 37502472]
  - vfio/migration: Re-query precopy size before sending VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (Avihai Horon) [Orabug: 37502472]
  - migration: Check switchover-ack during switchover phase (Avihai Horon) [Orabug: 37502472]
  - migration: Make switchover-ack re-usable (Avihai Horon) [Orabug: 37502472]
  - migration: Refactor switchover-ack code (Avihai Horon) [Orabug: 37502472]
  - linux-headers: Bring initial bytes re-init uAPI (Avihai Horon) [Orabug: 37502472]
  - qemu-img: convert: add cli argument to use IO large buffers for convert (Akash Kulhalli) [Orabug: 37502472]
  - hw/core/machine: Limit x-orcl-vm-tsc-khz-post-loadvm to KVM (Mark Kanda) [Orabug: 39095032]
  - migration: add extra check for block in cache_fini (Elena Ufimtseva) [Orabug: 38885625]
  - migration: do not tear down hash cache in critical path (Elena Ufimtseva) [Orabug: 38885625]
  - migration: free cache->blocks in cache_fini() (Elena Ufimtseva) [Orabug: 39061395]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-36.el9
changelog:
  - migration: Fix missing Error return in .load_setup() handlers (Maciej S. Szmigiero) [Orabug: 39154816]
  - migration: Fix missing Error return in .save_setup() handlers (Maciej S. Szmigiero) [Orabug: 39154816]
  - migration: qemu_savevm_state_setup(): Fix double PRECOPY_NOTIFY_SETUP call (Maciej S. Szmigiero) [Orabug: 39154816]
  - multifd: Fix device state transfer (Maciej S. Szmigiero) [Orabug: 39154816]
  - vfio/migration: Send VFIO_MIGRATION event before PRE_COPY_P2P transition (Avihai Horon) [Orabug: 39122260]
  - vfio/migration: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121536]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-37.el9
changelog:
  - hashing: use mmap/munmap for isal functions (Elena Ufimtseva) [Orabug: 39165991]
  - multifd: replace allocations/free with mmap/munmap (Elena Ufimtseva) [Orabug: 39165991]
  - page_cache: use mmap() based data pool for cache items (Elena Ufimtseva) [Orabug: 39165991]
  - page_cache: change cache allocations to mmap (Elena Ufimtseva) [Orabug: 39165991]
  - migration: add mmap/munmap wrapper (Elena Ufimtseva) [Orabug: 39165991]
  - target/i386/kvm: Use zero if kvm_msr_entry_add() is called by getter (Dongli Zhang) [Orabug: 38965920]
  - target/i386/kvm: Use logical counter index for AMD PMU getter (Dongli Zhang) [Orabug: 38965920]
  - Document CVEs (Mark Kanda) {CVE-2025-54566} {CVE-2025-54567} {CVE-2025-8860} {CVE-2026-0665} {CVE-2026-3886}
  - hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop (Jenny Guanni Qu) [Orabug: 39160764] {CVE-2026-3890}
  - hyperv/syndbg: check length returned by cpu_physical_memory_map() (Paolo Bonzini) [Orabug: 39160749] {CVE-2026-3842}
  - block/vmdk: fix OOB read in vmdk_read_extent() (Halil Oktay) [Orabug: 39160776] {CVE-2026-2243}
  - cryptodev-builtin: Limit the maximum size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
  - hw/virtio/virtio-crypto: verify asym request size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-38.el9
changelog:
  - multifd: Save number of pages for batch context pages (Elena Ufimtseva) [Orabug: 39001115]
  - migration: Introduce MigrateCleanupCtx for cleanup thread (Elena Ufimtseva) [Orabug: 39001115]
  - migration: Move qemu_mmap_node/qemu_munmap_node (Elena Ufimtseva) [Orabug: 39001115]
  - multifd: Allocate a large chunk for pages->cached (Elena Ufimtseva) [Orabug: 39214550]
  - migration: Defer multifd and hash cache cleanup (Elena Ufimtseva) [Orabug: 39215178]
  - multifd: Split multifd_send_shutdown (Elena Ufimtseva) [Orabug: 39215178]
  - migration: Rename background cleanup thread and mutex/cond (Elena Ufimtseva) [Orabug: 39215178]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-41.el9
changelog:
  - hw/virtio/virtio-crypto: validate asym session key size (Miguel Luis) [Orabug: 39480090]
  - virtio-net: validate RSS queue selectors in parser (Miguel Luis) [Orabug: 39480096]
  - ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988] {CVE-2026-8343}
  - ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrangé) [Orabug: 39447326] {CVE-2026-48003}
  - ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrangé) [Orabug: 39447332] {CVE-2026-48002}
  - ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrangé) [Orabug: 39447332] {CVE-2026-48002}
  - tests/unit/test-blockjob: Disable complete_in_standby test (Peter Maydell) [Orabug: 39447937]
  - virtio-scsi: reset SCSI devices from main loop thread (Stefan Hajnoczi) [Orabug: 39296894]
  - dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race (Stefan Hajnoczi) [Orabug: 39296894]
  - scsi: protect req->aiocb with AioContext lock (Stefan Hajnoczi) [Orabug: 39296894]
  - virtio-iommu: add error check before assert (Manos Pitsidianakis) [Orabug: 39447244]
  - hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() (Eric Auger) [Orabug: 39447244]
  - thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work() (Maciej S. Szmigiero) [Orabug: 39429151]
  - lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793] {CVE-2024-6519}
  - hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793] {CVE-2024-6519}
  - hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner) [Orabug: 37517793] {CVE-2024-6519}
  - hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
  - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter (Sven Schnelle) [Orabug: 39429302]
  - hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end (Sairaj Kodilkar) [Orabug: 39422329]
  - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo Bonzini) [Orabug: 39414097] {CVE-2026-5763}
  - softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
  - system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
  - system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
  - hw/pci: Ignore config-space data between 0x804-0x807 (Joao Martins)
  - hostmem-memfd: Documentation for memory-backend-memfd "keep" property (William Roche) [Orabug: 38769121]
  - hostmem-memfd: Wire up MFD_MF_KEEP_UE_MAPPED via "keep" property (William Roche) [Orabug: 38769121]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-42.el9
changelog:
  - migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645]
  - vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615]
  - tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
  - 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419] {CVE-2026-48004}
  - tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
  - libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
  - libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug: 39522394] {CVE-2026-48914}


