# changelog

author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20201118 release for OL8 which includes the following fixed CVEs:
    {CVE-2019-14584} {CVE-2019-14562} {CVE-2019-11098} {CVE-2019-14559} {CVE-2019-14575} {CVE-2019-14559} {CVE-2019-14587} {CVE-2019-14558} {CVE-2019-14586} {CVE-2019-14563}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20210616 release for OL7 which includes the following fixed CVEs:
    {CVE-2021-23840} {CVE-2021-23841}


author: Aaron Young <Aaron.Young@oracle.com> - 1:20210616-3.el8
changelog:
  - Fix typo in spec file (Aaron Young)  
  - Update 0001-SecureBoot-Logging1.patch to latest version (Aaron Young)


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20210616 release for OL8 which includes the following fixed CVEs:
    {CVE-2021-23840} {CVE-2021-23841} {CVE-2021-38575}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20230227.cvm release for OL8 which includes the following fixed CVEs:
    {CVE-2021-38578}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20230821 release for OL8 which includes the following fixed CVEs:
    {CVE-2019-14560}
  - Update to OpenSSL 1.1.1v which includes the following fixed CVEs:
    {CVE-2023-3817} {CVE-2023-3446} {CVE-2023-2650} {CVE-2023-0465} {CVE-2023-0466} {CVE-2023-0464} {CVE-2023-0286} {CVE-2023-0215} {CVE-2022-4450} {CVE-2022-4304} {CVE-2022-2097} {CVE-2022-2068} {CVE-2022-1292} {CVE-2022-0778} {CVE-2021-4160} {CVE-2021-3712} {CVE-2021-3711} {CVE-2021-3450} {CVE-2021-3449} {CVE-2021-23841} {CVE-2021-23840} {CVE-2020-1971} {CVE-2020-1967} {CVE-2019-1551} {CVE-2019-1563} {CVE-2019-1549} {CVE-2019-1547} {CVE-2019-1552} {CVE-2019-1543} {CVE-2018-0734} {CVE-2018-0735}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20240227 release for OL8 which includes the following fixed CVEs:
    {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
  - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
    {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215} {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274} {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20240909 release for OL8 which includes the following fixed CVEs:
  - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access [Orabug: 36990130] {CVE-2024-1298}
  - EDK2: In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. [Orabug: 36990244] {CVE-2024-25742}
  - EDK2: EDK2’s Network Package is susceptible to a predictable TCP Initial Sequence Number. [Orabug: 36990198] {CVE-2023-45236}
  - EDK2: EDK2’s Network Package is susceptible to a predictable TCP Initial Sequence Number. [Orabug: 36990210] {CVE-2023-45237}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 20250102 release for OL8 which includes the following fixed CVEs:
  - EDK2: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network [Orabug: 37414309] {CVE-2024-38796}
  - Update to OpenSSL 3.0.15 which includes the following fixed CVEs:
    {CVE-2023-4807} {CVE-2023-5363} {CVE-2023-5678} {CVE-2023-6129} {CVE-2023-6237} {CVE-2024-0727} {CVE-2024-2511} {CVE-2024-4603} {CVE-2024-4741} {CVE-2024-5535} {CVE-2024-6119}


author: Danilo de Paula <ddepaula@redhat.com> - 1.3.15-7
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1695587
    (Ensure modular RPM upgrade path)


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-23
changelog:
  - Ignore the user.WofCompressedData xattr
    resolves: rhbz#1811539
  - sysprep: new ipa-client and kerberos-hostkeytab operations
    resolves: rhbz#1789592


author: David Sloboda <david.x.sloboda@oracle.com> - 1:1.40.2-25.0.1
changelog:
  - Replace upstream references from description tag
  - Config supermin to use host yum.conf in ol8 [Orabug: 29319324]
  - Set DISTRO_ORACLE_LINUX correspeonding to ol


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-26
changelog:
  - insufficient default memsize to open anaconda default RHEL 8.2 luks device
    resolves: rhbz#1837765


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-27
changelog:
  - selinux-relabel does not work if SELINUXTYPE != targeted
  - tar-in command does not allow restoring file capabilities
    resolves: rhbz#1384241 rhbz#1828952


author: Karl Heubaum <karl.heubaum@oracle.com> - 1.40.2-28.0.2
changelog:
  - Specify backing file format to qemu-img command [Orabug: 33841090]
  - Add btrfs-progs package to appliance image [Orabug: 33835508]


author: Karl Heubaum <karl.heubaum@oracle.com> - 1.40.2-28.0.3
changelog:
  - virt-v2v: Specify backing file format to qemu-img command [Orabug: 33906330]
  - Require "kernel-uek" RPM for installation instead of "kernel" [Orabug: 33986812]


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.44.0-4
changelog:
  - Autodetect backing format for qemu-img create -b
  - Move appliance to separate subpackage
  - Read rpm database through librpm
    resolves: rhbz#2013916, rhbz#1989520, rhbz#1836094


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-1
changelog:
  - Rebase to 2017.3.23.
  - Remove patches which are now upstream.
  - Resynch with Fedora package.
  - Enable all architectures for RHEL 8.


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-3
changelog:
  - Fix for CVE-2019-9755
    (heap-based buffer overflow leads to local root privilege escalation)
    resolves: rhbz#1698503


author: Richard W.M. Jones <rjones@redhat.com> - 8.6-1
changelog:
  - Rebase to ntfs-3g 2021.8.22
  - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,
    CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,
    CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254
    resolves: rhbz#2004490


author: Richard W.M. Jones <rjones@redhat.com> - 8.8-1
changelog:
  - Rebase to ntfs-3g 2022.5.17
  - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,
    CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789
    resolves: rhbz#2127240 rhbz#2127248
    (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)


author: Cole Robinson <crobinso@redhat.com> - 1.18.0-2
changelog:
  - Fix rdma deps and don't restrict archs
  - Add --disable-werror to fix gcc8 build (bz #1556044)
  - Spec file cleanups (bz #1483290)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-5.el8
changelog:
  - libiscsi-iser_rcv_completion-unify-error-handling.patch [bz#1634541]
  - libiscsi-iser-fix-posting-of-receive-descriptors.patch [bz#1634541]
  - libiscsi-sync-remove-unnecessary-checks.patch [bz#1634541]
  - libiscsi-do-not-warn-for-strncpy.patch [bz#1634541]
  - libiscsi-avoid-fallthrough.patch [bz#1634541]
  - libiscsi-avoid-truncation-when-logging-message-that-includes-.patch [bz#1634541]
  - Resolves: bz#1634541
    (Fix important coverity issues (libiscsi))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - libiscsi-fix-connection-to-LUN-with-IPv6-address.patch [bz#1597942]
  - Resolves: bz#1597942
    (Qemu-kvm fails to connect to iscsi LUN by IPV6 address)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-7.el8
changelog:
  - libiscsi-redhat-Remove-disable-werror-from-spec-file.patch [bz#1581025]
  - Resolves: bz#1581025
    (Remove --disable-werror from spec file)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
changelog:
  - New upstream version 1.0.2.
  - Remove patches which are upstream.
  - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
  - Fix previous commit message.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
changelog:
  - New upstream version 1.0.3.
  - Contains fix for remote code execution vulnerability.
  - Add new libnbd-security(3) man page.


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.2-1.20200527git7325acb477
changelog:
  - Update to v0.7.2 stable snapshot, fixes rhbz#1809676
  - exclude i686 build
  - Following stable-0.7.0 branch for TPM 2 related fixes: RSA decryption,
    PSS salt length, symmetric decryption (padding)
  - Under certain circumstances an RSA decryption could cause a buffer overflow causing
    termination of the program (swtpm)
  - Following stable-0.7.0 branch for TPM 2 related fixes; v0.7.1 + gcc related patch
  - elliptic curve fixes
  - MANUFACTURER changed from "IBM " to "IBM"
  - gcc 10 related fix
  - Following stable-0.7.0 branch for TPM 1.2 related bugfix


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.3-1.20200818git1d392d466a
changelog:
  - Update to v0.7.3 stable, fixes rhbz#1868447
  - (includes "tpm2: fix PCRBelongsTCBGroup for PCClient")


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-5.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM
    Fixes: rhbz#1976816


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-6.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets
    Resolves: rhbz#1999307


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-2.20211126git1ff6fe1f43
changelog:
  - Backport "tpm2: Check size of buffer before accessing it" (CVE-2023-1017 & CVE-2023-1018)
    Resolves: rhbz#2173964
    Resolves: rhbz#2173970


author: Menno Lageman <menno.lageman@oracle.com> - 5.7.0-16.el8
changelog:
  - qemu: format 'x-aw-bits' on intel-iommu command line (Menno Lageman)
  - qemu: format address wdith on intel-iommu command line (Menno Lageman)
  - conf: add address width attribute to iommu (Menno Lageman)
  - tests: add tests for host-phys-bits KVM feature (Menno Lageman)  [Orabug: 31354547]
  - qemu: support host-phys-bits KVM feature (Menno Lageman)  [Orabug: 31374547]
  - storage: Fix daemon crash on lookup storagepool by targetpath (Yi Li)  [Orabug: 31439483]  {CVE-2020-10703}


author: Wim ten Have <wim.ten.have@oracle.com> - 5.7.0-17.el8
changelog:
  - qemu: Fix cpu boundary checks when starting or configuring guest domains. (Wim ten Have)  [Orabug: 31469231]
  - libvirt: Allocate max possible CPUs for QEMU to prepare guest memory (Wim ten Have)  [Orabug: 31064560]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-19.el8
changelog:
  - qemu: Verify use of hugepages when releasing its acquired status (Wim ten Have) [Orabug: 31839035]
  - qemu: Autonomous hugepages acquisition and release (Wim ten Have) [Orabug: 31367986]


author: Karl Heubaum <karl.heubaum@oracle.com> - 2.7.0-21.el8
changelog:
  - exadata: Fix the validation when defining domain groups (Wim ten Have)  [Orabug: 32085856]
  - qemu: improve error message when guest vcpu count exceeds domain group limit  (Menno Lageman)  [Orabug: 31985111]
  - qemu: Autonomous hugepage acquisition for 2-MiB and 1-GiB guest memoryBacking  (Wim ten Have)
  - qemu: Fix a qemuMemReleaseHostHugepages state error  (Wim ten Have)  [Orabug: 32069203]
  - qemu: avoid guest CPU process handling if exadataConfig is disabled  (Wim ten Have)  [Orabug: 32053696]
  - domain_conf: Relax SCSI addr used check (Michal Prívozník)  [Orabug: 31386162]
  - domain_conf: Make virDomainDeviceFindSCSIController accept virDomainDeviceDriveAddress struct  (Michal Prívozník)  [Orabug: 31386162]
  - qemu: remove use of qemuDomainObjBeginJobWithAgent() (Jonathon Jongsma)  [Orabug: 31990187]  {CVE-2019-20485}
  - qemu: agent: set ifname to NULL after freeing (Ján Tomko)  [Orabug: 31964426]  {CVE-2020-25637}
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses  (Ján Tomko)  [Orabug: 31964426]  {CVE-2020-25637}
  - rpc: add support for filtering @acls by uint params  (Ján Tomko)  [Orabug: 31964426]  {CVE-2020-25637}
  - rpc: gendispatch: handle empty flags (Ján Tomko)  [Orabug: 31964426]  {CVE-2020-25637}


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-22.el8
changelog:
  - build: add dependency to help patch tooling (Menno Lageman) [Orabug: 32284540]
  - Exadata: fix active guest dgroup-delete requests (Wim ten Have) [Orabug: 32095306]
  - Exadata: fix a rogue Domain Groups dgroup-undefine flaw (Wim ten Have) [Orabug: 31945084]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-23.el8
changelog:
  - util: remove unneeded cleanup labels (Wim ten Have) [Orabug: 32399255]
  - virnuma: Don't work around numa_node_to_cpus() for non-existent nodes (Wim ten Have) [Orabug: 32379098]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-24.el8
changelog:
  - exadata: Add configurable libvirtd mlockall support (Wim ten Have) [Orabug: 32479237]
  - exadata: hint a configurable number of memory init threads to qemu (Wim ten Have) [Orabug: 32460334]
  - Exadata: domain group should allow for asymmetric creation (Wim ten Have) [Orabug: 32060622]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-26.el8
changelog:
  - exadata: Fix autonomous hugepage acquisition barrier hang (Wim ten Have) [Orabug: 32537538]
  - exadata: Fix CPU Packing when out of pCPUs (Wim ten Have) [Orabug: 32527311]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-27.el8
changelog:
  - Exadata: protect libvirt hugepage acquisition from QEMU async init (Wim ten Have) [Orabug: 32561685]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-28.el8
changelog:
  - qemu_capabilities: Rework domain caps cache (Michal Prívozník) [Orabug: 32664432]
  - tests: fix virArchFromHost() redefine error (Joe Jin) [Orabug: 32664432]
  - qemu: cache host arch separately from virCapsPtr (Daniel P. Berrangé) [Orabug: 32664432]
  - cpu.c: Check properly for virCapabilitiesGetNodeInfo() retval (Michal Prívozník) [Orabug: 32664432]
  - virStorageSourceParseBackingJSONRaw: Parse 'offset' and 'size' attributes (Peter Krempa) [Orabug: 32164351]
  - tests: qemu: Add test data for the new <slice> element (Peter Krempa) [Orabug: 32164351]
  - qemu: Add support for slices of type 'storage' (Peter Krempa) [Orabug: 32164351]
  - tests: qemublock: Add cases for creating image overlays on top of disks with <slice> (Peter Krempa) [Orabug: 32164351]
  - qemu: block: Properly format storage slice into backing store strings (Peter Krempa) [Orabug: 32164351]
  - qemu: domain: Store nodenames of slice in status XML (Peter Krempa) [Orabug: 32164351]
  - conf: Implement support for <slices> of disk source (Peter Krempa) [Orabug: 32164351]
  - docs: Document the new <slices> sub-element of disk's <source> (Peter Krempa) [Orabug: 32164351]
  - qemu: block: forbid creation of storage sources with <slice> (Peter Krempa) [Orabug: 32164351]
  - qemuDomainValidateStorageSource: Reject unsupported slices (Peter Krempa) [Orabug: 32164351]
  - qemuBlockStorageSourceGetFormatRawProps: format 'offset' and 'size' for slice (Peter Krempa) [Orabug: 32164351]
  - util: virstoragefile: Add data structure for storing storage source slices (Peter Krempa) [Orabug: 32164351]
  - tests: virstorage: Add test data for json specified raw image with offset/size (Peter Krempa) [Orabug: 32164351]
  - docs: formatdomain: Close <source> on one of disk examples (Peter Krempa) [Orabug: 32164351]
  - qemu: domain: Refactor formatting of node names into status XML (Peter Krempa) [Orabug: 32164351]
  - tests: virstorage: Add test cases for "json:" pseudo-URI without 'file' wrapper (Peter Krempa) [Orabug: 32164351]
  - virStorageSourceParseBackingJSON: Prevent arbitrary nesting with format drivers (Peter Krempa) [Orabug: 32164351]
  - virStorageSourceParseBackingJSON: Allow 'json:' pseudo URIs without 'file' wrapper (Peter Krempa) [Orabug: 32164351]
  - virStorageSourceJSONDriverParser: annotate 'format' drivers (Peter Krempa) [Orabug: 32164351]
  - virStorageSourceParseBackingJSON: Move deflattening of json: URIs out of recursion (Peter Krempa) [Orabug: 32164351]
  - virStorageSourceParseBackingJSON: Pass around original backing file string (Peter Krempa) [Orabug: 32164351]
  - qemu: enable blockdev support (Peter Krempa) [Orabug: 32164351]
  - qemu: Instantiate pflash via -machine when using blockdev (Peter Krempa) [Orabug: 32164351]
  - qemu: command: Build the 'pflash' drives via -machine (Peter Krempa) [Orabug: 32164351]
  - qemu: command: Build -blockdev-s for backing of pflash (Peter Krempa) [Orabug: 32164351]
  - qemu: domain: Introduce helper to convert <loader> into virStorageSource (Peter Krempa) [Orabug: 32164351]
  - qemu: domain: Store virStorageSources representing pflash backing (Peter Krempa) [Orabug: 32164351]
  - qemu: command: Extract formatting of -drive for pflash (Peter Krempa) [Orabug: 32164351]
  - qemu: capabilities: Add detection of the 'savevm' fix for -blockdev (Peter Krempa) [Orabug: 32164351]
  - qemu: qapi: Add support for command features (Peter Krempa) [Orabug: 32164351]
  - qemu: caps: Add capability for dynamic 'auto-read-only' support for files (Peter Krempa) [Orabug: 32164351]
  - tests: qemucapabilities: Refresh data for unreleased qemu-4.2 on x86_64 (Peter Krempa) [Orabug: 32164351]
  - qemu: caps: Base support of 'backingStoreInput' domain feature on QEMU_CAPS_BLOCKDEV (Peter Krempa) [Orabug: 32164351]
  - docs: Document support for obeying <backingStore> of <disk> on input (Peter Krempa) [Orabug: 32164351]
  - conf: domcaps: Add 'backingStoreInput' domain capability (Peter Krempa) [Orabug: 32164351]
  - qemu: domcaps: Simplify adding new domaincaps based on qemu caps (Peter Krempa) [Orabug: 32164351]
  - domaincaps: Store domain capability features in an array (Peter Krempa) [Orabug: 32164351]
  - qemu: domcaps: Initialize all features (Peter Krempa) [Orabug: 32164351]
  - domcaps: Add function for initializing domain caps as unsupported (Peter Krempa) [Orabug: 32164351]
  - conf: domaincaps: Use virXMLFormatElement in virDomainCapsFormatFeatures (Peter Krempa) [Orabug: 32164351]
  - conf: domaincaps: Extract formatting of the <features> subelement (Peter Krempa) [Orabug: 32164351]
  - conf: domaincaps: Replace FORMAT_SINGLE macro by a function (Peter Krempa) [Orabug: 32164351]
  - conf: capabilities: Modernize virCapabilitiesFormatMemoryBandwidth (Peter Krempa) [Orabug: 32164351]
  - conf: caps: Modernize virCapabilitiesFormatCaches (Peter Krempa) [Orabug: 32164351]
  - conf: turn virDomainMemtuneFormat void (Peter Krempa) [Orabug: 32164351]
  - conf: domain: Split up formatting of <memtune> and <memoryBacking> (Peter Krempa) [Orabug: 32164351]
  - conf: Rename virDomainCapsFeature to virDomainProcessCapsFeature (Peter Krempa) [Orabug: 32164351]
  - conf: storagecaps: Fix broken attempt at being const-correct (Peter Krempa) [Orabug: 32164351]
  - conf: domaincaps: Fix broken attempt at being const-correct (Peter Krempa) [Orabug: 32164351]
  - qemu: caps: Make capability filler functions void (Peter Krempa) [Orabug: 32164351]
  - util: buffer: Add init macro for automatically setting child XML indent (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Fix inactive external snapshots when backing chain is present (Peter Krempa) [Orabug: 32164351]
  - qemu: blockjob: Transfer 'readonly' state of images after active layer block commit (Peter Krempa) [Orabug: 32164351]
  - qemu: command: Use XML based disk bus convertor in error message (Peter Krempa) [Orabug: 32164351]
  - storagefile: Fill in meta->externalDataStore (Cole Robinson) [Orabug: 32164351]
  - storagefile: Add externalDataStore member (Cole Robinson) [Orabug: 32164351]
  - storagefile: Split out virStorageSourceNewFromChild (Cole Robinson) [Orabug: 32164351]
  - storagefile: Don't access backingStoreRaw directly in FromBackingRelative (Cole Robinson) [Orabug: 32164351]
  - storagefile: Fill in meta->externalDataStoreRaw (Cole Robinson) [Orabug: 32164351]
  - storagefile: Add externalDataStoreRaw member (Cole Robinson) [Orabug: 32164351]
  - storagefile: Fix backing format \0 check (Cole Robinson) [Orabug: 32164351]
  - storagefile: Rename qcow2GetExtensions 'format' argument (Cole Robinson) [Orabug: 32164351]
  - storagefile: Rename qcow2GetBackingStoreFormat (Cole Robinson) [Orabug: 32164351]
  - storagefile: Push extension_end calc to qcow2GetBackingStoreFormat (Cole Robinson) [Orabug: 32164351]
  - storagefile: Push 'start' into qcow2GetBackingStoreFormat (Cole Robinson) [Orabug: 32164351]
  - storagefile: Use qcowXGetBackingStore directly (Cole Robinson) [Orabug: 32164351]
  - storagefile: Drop now unused isQCow2 argument (Cole Robinson) [Orabug: 32164351]
  - storagefile: Check version to determine if qcow2 or not (Cole Robinson) [Orabug: 32164351]
  - storagefile: qcow1: Let qcowXGetBackingStore fill in format (Cole Robinson) [Orabug: 32164351]
  - storagefile: qcow1: Fix check for empty backing file (Cole Robinson) [Orabug: 32164351]
  - storagefile: qcow1: Check for BACKING_STORE_OK (Cole Robinson) [Orabug: 32164351]
  - qemu: snapshot: Don't update current snapshot until we're done (Peter Krempa) [Orabug: 32164351]
  - qemu: block: Replace snapshot transaction action generator (Peter Krempa) [Orabug: 32164351]
  - tests: qemumonitor: Add testing for the 'transaction' command and generators (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Add transaction generators for snapshot APIs (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Add transaction generators for dirty bitmap APIs (Peter Krempa) [Orabug: 32164351]
  - tests: qemucapabilities: fix 4.2.0 qemucapabilities (Joe Jin) [Orabug: 32164351]
  - qemu: checkpoint: Do ACL check prior to snapshot interlocking (Peter Krempa) [Orabug: 32164351]
  - qemu: driver: Remove misplaced qemuDomainObjEndJob in qemuDomainCheckpointGetXMLDesc (Peter Krempa) [Orabug: 32164351]
  - conf: Drop pointless 'domain' argument from virDomainSnapshotRedefinePrep (Peter Krempa) [Orabug: 32164351]
  - conf: Drop pointless 'domain' argument from virDomainCheckpointRedefinePrep (Peter Krempa) [Orabug: 32164351]
  - tests: qemucapabilities: Update caps of qemu-4.1 to released version (Peter Krempa) [Orabug: 32164351]
  - tests: add qemu capabilities data for qemu 4.2 (Peter Krempa) [Orabug: 32164351]
  - lxc: fix compile error (Joe Jin) [Orabug: 32164351]
  - qemu: driver: Remove QEMU_ADD_BLOCK_PARAM_LL macro (Peter Krempa) [Orabug: 32164351]
  - qemu: driver: Don't return anything from qemuDomainBlockStatsGatherTotals (Peter Krempa) [Orabug: 32164351]
  - qemu: driver: Remove pointless macro QEMU_BLOCK_STAT_TOTAL (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Change fields in qemuBlockStats to 'unsigned' (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Refactor cleanup in qemuMonitorJSONGetAllBlockStatsInfo (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Refactor cleanup in qemuMonitorJSONGetOneBlockStatsInfo (Peter Krempa) [Orabug: 32164351]
  - qemu: monitor: Refactor cleanup in qemuMonitorJSONBlockStatsCollectData (Peter Krempa) [Orabug: 32164351]
  - qemu: Remove stale comment for qemuDomainBlockStats (Peter Krempa) [Orabug: 32164351]
  - qemu_blockjob: Remove secdriver metadata for whole backing chain on job completion (Michal Prívozník) [Orabug: 32164351]
  - qemu: hotplug: Use VIR_AUTOFREE() instead VIR_FREE for strings (Daniel Henrique Barboza) [Orabug: 32164351]
  - qemu: snapshot: Do ACL check prior to checkpoint interlocking (Peter Krempa) [Orabug: 32164351]
  - qemuCheckDiskConfigAgainstDomain: Validate disk's SCSI address iff disk is SCSI (Xu Yandong) [Orabug: 32164351]
  - qemuSharedDeviceEntryRemove: Free domain name before VIR_DELETE_ELEMENT (Xu Yandong) [Orabug: 32164351]
  - qemu_capabilities: Temporarily disable dbus-vmstate capability (Michal Prívozník) [Orabug: 32164351]
  - Revert "qemu: add socket datagram capability" (Michal Prívozník) [Orabug: 32164351]
  - tests: qemustatusxml2xml: Fix disk target mess (Peter Krempa) [Orabug: 32164351]
  - snapshot: Store both config and live XML in the snapshot domain (Maxiwell S. Garcia) [Orabug: 32164351]
  - qemu: formatting XML from domain def choosing the root name (Maxiwell S. Garcia) [Orabug: 32164351]
  - qemu: Don't leak domain def when RevertToSnapshot fails (Jiri Denemark) [Orabug: 32164351]
  - qemu: Fix regression in snapshot-revert (Eric Blake) [Orabug: 32164351]
  - lib: Define and use autofree for virConfPtr (Michal Prívozník) [Orabug: 32164351]
  - qemu_conf: Use more of VIR_AUTOUNREF() (Michal Prívozník) [Orabug: 32164351]
  - qemu_conf: Use more of VIR_AUTOFREE() (Michal Prívozník) [Orabug: 32164351]
  - qemu_conf: Drop a pair of needless 'cleanup' labels (Michal Prívozník) [Orabug: 32164351]
  - virhostdev: Don't unref @pcidevs twice (Michal Prívozník) [Orabug: 32164351]
  - qemu_conf.c: introduce qemuAddRemoveSharedDeviceInternal (Daniel Henrique Barboza) [Orabug: 32164351]
  - qemu_conf.c: introduce qemuAddRemoveSharedDiskInternal (Daniel Henrique Barboza) [Orabug: 32164351]
  - qemu_conf.c: introduce qemuAddRemoveSharedHostdevInternal (Daniel Henrique Barboza) [Orabug: 32164351]
  - remote: fix UNIX socket path being incorrectly built for libvirtd (eater) [Orabug: 32164351]
  - lib: Grab write lock when modifying list of domains (Michal Prívozník) [Orabug: 32164351]
  - qemu: reset VM id after external devices stop (Marc-André Lureau) [Orabug: 32164351]
  - qemu: add dbus-vmstate capability (Marc-André Lureau) [Orabug: 32164351]
  - qemu: add socket datagram capability (Marc-André Lureau) [Orabug: 32164351]
  - tests: fix xml2xml tpm-emulator.xml test (Marc-André Lureau) [Orabug: 32164351]
  - qemu: migration: Switch to blockdev mode for non-shared storage migration (Peter Krempa) [Orabug: 32164351]
  - qemu: migration: Refactor cleanup in qemuMigrationSrcNBDStorageCopy (Peter Krempa) [Orabug: 32164351]
  - qemu: migration: Refactor cleanup in qemuMigrationSrcNBDStorageCopyBlockdev (Peter Krempa) [Orabug: 32164351]
  - qemu: Defer support checks for external active snapshots to blockdev code or qemu (Peter Krempa) [Orabug: 32164351]
  - qemu: Add -blockdev support for external snapshots (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Skip overlay file creation/interogation if unsupported (Peter Krempa) [Orabug: 32164351]
  - qemu: Merge use of 'reuse' flag in qemuDomainSnapshotDiskPrepareOne (Peter Krempa) [Orabug: 32164351]
  - qemu: Disband qemuDomainSnapshotCreateSingleDiskActive (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Rename external disk snapshot handling functions (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Move error preservation to qemuDomainSnapshotDiskDataCleanup (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Save status and config XMLs only on success (Peter Krempa) [Orabug: 32164351]
  - qemu: snapshot: Fix image lock handling when taking a snapshot (Peter Krempa) [Orabug: 32164351]
  - qemu: driver: Fix shallow non-reuse block copy (Peter Krempa) [Orabug: 32164351]
  - qemu: Explicitly pass backing store to qemuBuildStorageSourceChainAttachPrepareBlockdevTop (Peter Krempa) [Orabug: 32164351]
  - qemu: block: explicitly pass backing store to qemuBlockStorageSourceAttachPrepareBlockdev (Peter Krempa) [Orabug: 32164351]
  - qemu: command: Refactor qemuBuildStorageSourceChainAttachPrepareBlockdevInternal (Peter Krempa) [Orabug: 32164351]
  - qemu: block: Explicitly specify backingStore when creating format layer props (Peter Krempa) [Orabug: 32164351]
  - qemu: block: Unify conditions to format backing store of format node definition (Peter Krempa) [Orabug: 32164351]
  - qemu: Prevent storage causing too much nested XML (Peter Krempa) [Orabug: 32164351]
  - qemu: domain: Refactor cleanup in qemuDomainDetermineDiskChain (Peter Krempa) [Orabug: 32164351]
  - qemu: hotplug: Setup disk throttling with blockdev (Peter Krempa) [Orabug: 32164351]
  - qemu: hotplug: Use VIR_AUTOFREE in qemuDomainAttachDiskGeneric (Peter Krempa) [Orabug: 32164351]
  - qemu: hotplug: Simplify cleanup in qemuDomainChangeMediaLegacy (Peter Krempa) [Orabug: 32164351]
  - qemu: Fix qemuDomainObjTaint with virtlogd (Jiri Denemark) [Orabug: 32164351]
  - qemu: monitor: Fix formatting of 'offset' in qemuMonitorJSONSaveMemory (Peter Krempa) [Orabug: 32164351]
  - tests: qemublock: Use bigger numbers as dummy capacity/physical (Peter Krempa) [Orabug: 32164351]
  - qemu: block: Use correct type when creating image size JSON entries (Peter Krempa) [Orabug: 32164351]
  - Exadata: protect vNUMA/SMT from artificially injected faults (Wim ten Have) [Orabug: 32708041]
  - virnetserver: fix some memory leaks in virNetTLSContextReloadForServer (Jin Yan)
  - virt-admin: Introduce command srv-update-tls (Zhang Bo) [Orabug: 32768102]
  - admin: Introduce virAdmServerUpdateTlsFiles (Zhang Bo) [Orabug: 32768102]
  - tls: Add a mutex lock on 'tlsCtxt' (Zhang Bo) [Orabug: 32768102]
  - virnetserver: Introduce virNetServerUpdateTlsFiles (Zhang Bo) [Orabug: 32768102]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-29.el8
changelog:
  - qemu: vCORE distribution under vNUMA host partitioning should balance guests vCPU:pCPU pinning (Wim ten Have) [Orabug: 32355455]
  - qemuDomainSnapshotDiskPrepareOne: Don't load the relative path with blockdev (Peter Krempa) [Orabug: 33151464]
  - qemu: block: Support VIR_DOMAIN_BLOCK_COMMIT/PULL/REBASE_RELATIVE with blockdev (Peter Krempa) [Orabug: 33151464]
  - qemu: Tell secdrivers which images are top parent (Michal Prívozník) [Orabug: 33086913]
  - security: Introduce VIR_SECURITY_DOMAIN_IMAGE_PARENT_CHAIN_TOP flag (Michal Prívozník) [Orabug: 33086913]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-30.el8
changelog:
  - qemuDomainSnapshotDiskPrepareOne: Fix logic of relative backing store update (Peter Krempa) [Orabug: 33086913]
  - qemu: Don't set NVRAM label when creating it (Michal Privoznik) [Orabug: 33319048]
  - qemu: protect guestCPUs from drift under vcpu guest timeouts (Wim ten Have) [Orabug: 33368490]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-31.el8
changelog:
  - qemu: Do not latch guestCPUs when guests hotplug with active domain groups (Wim ten Have) [Orabug: 33440015]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-32.el8
changelog:
  - qemu: Validate config->exadata before reaping guests (Wim ten Have) [Orabug: 33763967]
  - qemu: Make vNUMA/SMT pCPU packing L3-cache aware on AMD/E4 (Wim ten Have) [Orabug: 33268059]
  - qemu: work exadataConfig flags directly from the QEMUdriver structure (Wim ten Have) [Orabug: 33268059]
  - qemu: Label restore path outside of secdriver transactions (Michal Privoznik) [Orabug: 33351242]
  - security: Introduce virSecurityManagerDomainSetPathLabelRO (Michal Privoznik) [Orabug: 33351242]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-33.el8
changelog:
  - qemu: refresh vNUMA/SMT pinning (Wim ten Have) [Orabug: 34083505]
  - qemu driver: Check exadataConfig and packCPUs whenever vNUMA/SMT applies (Wim ten Have) [Orabug: 34023508]
  - nwfilter: fix crash when counting number of network filters (Daniel P. Berrangé) [Orabug: 33973639] {CVE-2022-0897}


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-34.el8
changelog:
  - qemu: blockcopy: Allow late opening of the backing chain of a shallow copy (Peter Krempa) [Orabug: 33091019]
  - qemu: capabilities: Introduce QEMU_CAPS_BLOCKDEV_SNAPSHOT_ALLOW_WRITE_ONLY (Peter Krempa) [Orabug: 33091019]
  - qemuDomainBlockCopyCommon: Record updated flags to block job (Peter Krempa) [Orabug: 33091019]
  - qemuDomainBlockPivot: Move check prior to executing the pivot steps (Peter Krempa) [Orabug: 33091019]
  - qemu: Tell secdrivers which images are top parent (Michal Privoznik) [Orabug: 33091019]
  - qemuDomainBlockPivot: Copy bitmaps backing checkpoints for virDomainBlockCopy (Peter Krempa) [Orabug: 33091019]
  - qemu: block: Introduce function to calculate bitmap handling for block-copy (Peter Krempa) [Orabug: 33091019]
  - qemu: block: Add validator for bitmap chains accross backing chains (Peter Krempa) [Orabug: 33091019]
  - qemu: blockjob: Store 'flags' for all the block job types (Peter Krempa) [Orabug: 33091019]
  - qemu: blockjob: Store 'jobflags' with block job data (Peter Krempa) [Orabug: 33091019]
  - util: json: Introduce virJSONValueArrayConcat (Peter Krempa) [Orabug: 33091019]
  - qemu: block: Extract calls of qemuBlockGetNamedNodeData into a helper function (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Track and relabel images for bitmap merging (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Introduce support for deleting checkpoints accross snapshots (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Extract calculation of bitmap merging for checkpoint deletion (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Introduce helper to find checkpoint disk definition in parents (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: tolerate missing disks on checkpoint deletion (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Use disk definition directly when creating checkpoint (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: rename disk->chkdisk in qemuCheckpointAddActions (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: rename disk->chkdisk in qemuCheckpointDiscardBitmaps (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: split out checkpoint deletion bitmaps (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Store whether deleted checkpoint is current in a variable (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Extract and export rollback of checkpoint metadata storing (Peter Krempa) [Orabug: 33091019]
  - qemu: block: Introduce qemuBlockNamedNodeDataGetBitmapByName (Peter Krempa) [Orabug: 33091019]
  - qemu: snapshot: Propagate active bitmaps through external snapshots (Peter Krempa) [Orabug: 33091019]
  - qemu: monitor: Add 'granularity' parameter for block-dirty-bitmap-add (Peter Krempa) [Orabug: 33091019]
  - qemu: snapshot: Fold formatting of snapshot transaction into prepare func (Peter Krempa) [Orabug: 33091019]
  - qemu: Check for explicit failure of qemuBlockSnapshotAddBlockdev (Peter Krempa) [Orabug: 33091019]
  - qemu: monitor: Extract internals of qemuMonitorJSONBlockGetNamedNodeData (Peter Krempa) [Orabug: 33091019]
  - qemu: monitor: Extract data about dirty-bimaps in qemuMonitorBlockGetNamedNodeData (Peter Krempa) [Orabug: 33091019]
  - qemu: block: enable the snapshot image deletion feature (Pavel Mores) [Orabug: 33091019]
  - qemu: block: propagate the delete flag to where it can actually be used (Pavel Mores) [Orabug: 33091019]
  - qemu: checkpoint: fix NULL dereference at create time (Cole Robinson) [Orabug: 33091019]
  - qemu: snapshot: Mark file becoming backingStore as read-only (Peter Krempa) [Orabug: 33091019]
  - util: consolidate on one free callback for hash data (Daniel P. Berrangé) [Orabug: 33091019]
  - conf: stop using hash key when free'ing hash entries (Daniel P. Berrangé) [Orabug: 33091019]
  - qemu: checkpoint: Use qemuMonitorTransactionBitmapMergeSourceAddBitmap (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Fix rollback and access to unlocked 'vm' when deleting checkpoints (Peter Krempa) [Orabug: 33091019]
  - qemu: snapshot: split out preparation of a snapshot with blockdev (Peter Krempa) [Orabug: 33091019]
  - qemu: monitor: Add helper for generating data for block bitmap merging (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Extract finalizing steps of checkpoint creation (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Split out checkpoint creation code (Peter Krempa) [Orabug: 33091019]
  - qemu: block: Don't query monitor in qemuBlockStorageSourceCreateDetectSize (Peter Krempa) [Orabug: 33091019]
  - qemu: monitor: Introduce new interface to query-named-block-nodes (Peter Krempa) [Orabug: 33091019]
  - util: hash: Introduce virHashHasEntry (Peter Krempa) [Orabug: 33091019]
  - util: hash: Add new constructor 'virHashNew' (Peter Krempa) [Orabug: 33091019]
  - util: hash: Add possibility to use simpler data free function in virHash (Peter Krempa) [Orabug: 33091019]
  - conf: Introduce virDomainDiskByTarget (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Don't update current checkpoint until we are done (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Replace open-coded transaction action generators (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Refactor cleanup in qemuCheckpointCreateXML (Peter Krempa) [Orabug: 33091019]
  - qemu: domain: Move checkpoint related code to qemu_checkpoint.c (Peter Krempa) [Orabug: 33091019]
  - qemu: driver: Move checkpoint-related code to qemu_checkpoint.c (Peter Krempa) [Orabug: 33091019]
  - qemu: Move, rename and export qemuDomObjFromDomain (Peter Krempa) [Orabug: 33091019]
  - qemu: checkpoint: Don't forbid checkpoint when VM is marked for autodestroy (Peter Krempa) [Orabug: 33091019]
  - Prepare to hotplug vNUMA targets for non-X86_64 guests (Wim ten Have) [Orabug: 34256070]
  - qemu: Add missing lock in qemuProcessHandleMonitorEOF (Peng Liang) [Orabug: 34210159] {CVE-2021-3975}


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-35.el8
changelog:
  - util: add virNetDevGetPhysPortName (Moshe Levi) [Orabug: 34329649]
  - util: Add phys_port_name support on virPCIGetNetName (Dmytro Linkin) [Orabug: 34329649]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-36.el8
changelog:
  - util: Netdev fixes for phys_port_id to get the ifname of a VF (Wim ten Have) [Orabug: 34417160]
  - qemuProcessStop: Don't try to remove QoS on already removed TAP (Michal Privoznik) [Orabug: 34206752]
  - virnetdevopenvswitch: Fix 'burst' value passed to ovs-vsctl (Michal Privoznik) [Orabug: 34206752]
  - util: Avoid null pointer dereference when setting QoS on OVS (Jiri Denemark) [Orabug: 34206752]
  - virnetdevopenvswitch: unify calculation of ovs and tc (Jinsheng Zhang) [Orabug: 34206752]
  - virnetdevopenvswitch: Fix qos cleaning residual on multi interfaces (Jinsheng Zhang) [Orabug: 34206752]
  - virnetdevopenvswitch: Introduce virNetDevOpenvswitchInterfaceClearTxQos and virNetDevOpenvswitchInterfaceClearRxQos (Jinsheng Zhang) [Orabug: 34206752]
  - virnetdevopenvswitch: Extract common code block to a single function (Jinsheng Zhang) [Orabug: 34206752]
  - virnetdevopenvswitch: Extract conversion parameters between virNetDevBandwidth and ovs (Jinsheng Zhang) [Orabug: 34206752]
  - virnetdevopenvswitch: Add vmuuid notes on virNetDevOpenvswitchInterfaceSetQos (Jinsheng Zhang) [Orabug: 34206752]
  - qemu: interface: check and use ovs command to set qos of ovs managed port (Jinsheng Zhang) [Orabug: 34206752]
  - qemu: interface: remove setting noqueue for ovs port (Jinsheng Zhang) [Orabug: 34206752]
  - virDomain: interface: add virNetDevOpenvswitchInterfaceSetQos and virNetDevOpenvswitchInterfaceClearQos (Jinsheng Zhang) [Orabug: 34206752]
  - virDomain: interface: add virDomainNetDefIsOvsport (Jinsheng Zhang) [Orabug: 34206752]
  - openvswitch: don't delete existing OVS port prior to recreating same port (Laine Stump) [Orabug: 34206752]
  - virnetdev: move virNetDevSetRootQDisc to virnetdevbandwidth (Pavel Hrdina) [Orabug: 34206752]
  - virnetdevbandwidth: Don't generate burst outside of boundaries (Michal Privoznik) [Orabug: 34206752]
  - qemu_hotplug: Don't dereference NULL pointer @newb in qemuDomainChangeNet() (Michal Privoznik) [Orabug: 34206752]
  - qemu: Restore default root qdisc when QoS is cleared out (Michal Privoznik) [Orabug: 34206752]
  - virnetdevopenvswitch: Simplify OVS_VSCTL cmd creation (Michal Privoznik) [Orabug: 34206752]
  - qemu: Set noqueue qdisc for TAP devices (Michal Privoznik) [Orabug: 34206752]
  - virnetdev: Introduce virNetDevSetRootQDisc() (Michal Privoznik) [Orabug: 34206752]
  - syntax-check: Don't forbid curly braces around single line condition body (Peter Krempa) [Orabug: 34206752]
  - src: util: rename some program macros (Pavel Hrdina) [Orabug: 34206752]
  - conf: rename virNetDevSupportBandwidth to virNetDevSupportsBandwidth (Ján Tomko) [Orabug: 34206752]
  - qemu: do not revert to NULL bandwidth (Ján Tomko) [Orabug: 34206752]
  - conf: return a const from virDomainNetGetActualVirtPortProfile (Laine Stump) [Orabug: 34206752]
  - qemu: move runtime netdev validation into a separate function (Laine Stump) [Orabug: 34206752]
  - conf: make arg to virDomainNetGetActualVirtPortProfile() a const (Laine Stump) [Orabug: 34206752]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-37.el8
changelog:
  - vNUMA: Auto adjust 'maxvcpus' for vCORE placement (Wim ten Have) [Orabug: 34670399]
  - qemu: support kvm-poll-control performance hint (Tim Wiederhake) [Orabug: 34695476]
  - qemu: fix EFI nvram removal on domain undefine (Pavel Mores) [Orabug: 34543837]
  - util: keep the pidfile locked (Marc-André Lureau) [Orabug: 34500172]
  - qemuProcessStartManagedPRDaemon: Don't pass -f pidfile to the daemon (Michal Privoznik) [Orbug: 34500172]
  - virCommand: Actually acquire pidfile instead of just writing it (Michal Privoznik) [Orbug: 34500172]
  - qemu: Don't explicitly remove pidfile after virPidFileForceCleanupPath() (Michal Privoznik) [Orbug: 34500172]
  - virPipeImpl: Don't overwrite error (Peter Krempa) [Orbug: 34500172]
  - src: introduce a wrapper for the pipe2() system call (Daniel P. Berrangé) [Orbug: 34500172]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-38.el8
changelog:
  - qemu: Don't report spurious errors from vCPU tid validation on hotunplug timeout (Shaleen Bathla) [Orabug: 34826758]
  - security: fix SELinux label generation logic (Daniel P. Berrangé) [Orabug: 34773029] {CVE-2021-3631}
  - qemu: Set default qdisc before setting bandwidth (Michal Privoznik) [Orabug: 34724925]
  - qemu: Taint cpu host-passthrough only after migration (Cole Robinson) [Orabug: 34724925]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-40.el8
changelog:
  - build: change dependency to allow post install erasing of /usr/bin/nc (Wim ten Have) [Orabug: 35289777]
  - util: Make virFileClose() quiet on success (Andrea Bolognani) [Orabug: 35090886]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-41.el8
changelog:
  - qemu_monitor: Add defensive protection on mon->msg (Wim ten Have) [Orabug: 35699260]
  - vircpi: Add PCIe 5.0 and 6.0 link speeds (Michal Privoznik) [Orabug: 35496776]
  - qemuProcessSetupVcpusVnuma: add NULL check for def->cpu (Shaleen Bathla) [Orabug: 35332038]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-42.el8
changelog:
  - Document CVEs as fixed (Karl Heubaum) {CVE-2023-2700}
  - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364474] {CVE-2024-1441}
  - libvirt-<module>: Check caller-provided buffers to be NULL with size > 0 (Erik Skultety) [Orabug: 36364474]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-43.el8
changelog:
  - qemu_firmware: don't error out for unknown firmware features (Pavel Hrdina) [Orabug: 36931914]
  - qemu_process: Postpone vcpu re-pinning after vcpuinfo refresh from qemu (Shaleen Bathla) [Orabug: 36588995]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.10.0-3.el8
changelog:
  - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469] {CVE-2023-2700}


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.10.0-4.el8
changelog:
  - rpc: ensure temporary GSource is removed from client event loop (Daniel P. Berrangé) [Orabug: 36821476] {CVE-2024-4418}
  - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364471] {CVE-2024-1441}


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-2.el8
changelog:
  - qemu_migration: don't block migration for network hostdev (Joao Martins)
  - util: basic support for VFIO variant drivers (Laine Stump)


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-3.el8
changelog:
  - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (Peter Krempa) [Orabug: 35644221] {CVE-2023-3750}
  - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469] {CVE-2023-2700}
  - qemuProcessRefreshDisks: Don't skip filling of disk information if tray state didn't change (Peter Krempa) [Orabug: 35636469]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-4.el8
changelog:
  - qemuProcessRefreshDisks: Extract update of a single disk (Peter Krempa) [Orabug: 35885348]
  - qemuProcessRefreshDisks: Properly compare tray status (Peter Krempa) [Orabug: 35885348]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-5.el8
changelog:
  - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364464] {CVE-2024-1441}


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-6.el8
changelog:
  - rpc: ensure temporary GSource is removed from client event loop (Daniel P. Berrangé) [Orabug: 36821472] {CVE-2024-4418}
  - rpc: Don't warn about "max_client_requests" in single-threaded daemons (Peter Krempa) [Orabug: 36422853]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-7.el8
changelog:
  - qemu: conf: Add configuration to tune vcpu unplug timeout (Partha Satapathy) [Orabug: 37098750]
  - conf: Fix migration in some firmware autoselection scenarios (Andrea Bolognani) [Orabug: 37024703]
  - cpu_map: Add SapphireRapids CPU model (Lin Yang)
  - cpu_map: Add missing feature "fsrc" (Tim Wiederhake)
  - cpu_map: Add missing feature "fsrs" (Tim Wiederhake)
  - cpu_map: Add missing feature "fzrm" (Tim Wiederhake)


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-10.el8
changelog:
  - cpu_map: Fix SierraForest CPU model (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Install SierraForest description file (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add SierraForest CPU model (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x491 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x490 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48F (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48E (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48D (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48C (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x48B (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x485 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing vmx features from MSR 0x480 (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "pbrsb-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "psdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "fbsdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "sbdr-ssdp-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "mcdt-no" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "cmpccxadd" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-vnni-int8" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-ne-convert" (Tim Wiederhake) [Orabug: 37296073]
  - cpu_map: Add missing feature "avx-ifma" (Tim Wiederhake) [Orabug: 37296073]


author: Karl Heubaum <karl.heubaum@oracle.com> - 9.0.0-11.el8
changelog:
  - cpu_map: Remove rtm, hle and taa-no from the Sapphire Rapids CPU model (Mark Kanda) [Orabug: 37845537]


author: Mark Kanda <mark.kanda@oracle.com> - 9.0.0-13.el8
changelog:
  - qemu: fix switchover-ack regression for old qemu (Jon Kohler) [Orabug: 38408711]
  - qemu: add support for qemu switchover-ack (Jon Kohler) [Orabug: 38408711]
  - qemu: Add support for optional migration capabilities (Jiri Denemark) [Orabug: 38408711]
  - qemu: Document qemuMigrationParamsFlagMapItem fields (Jiri Denemark) [Orabug: 38408711]
  - qemu: Rename remoteCaps parameter in qemuMigrationParamsCheck (Jiri Denemark) [Orabug: 38408711]
  - qemu: Use C99 initializers for qemuMigrationParamsFlagMap (Jiri Denemark) [Orabug: 38408711]


author: Karl Heubaum <karl.heubaum@oracle.com> - 5.7.0-34.el8
changelog:
  - libvirt-python.spec: Bump "Obsoletes" version number for libvirt-python (Karl Heubaum) [Orabug: 34185868]


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.2-4
changelog:
  - Remove misguided LDFLAGS hack which removed server hardening.
    https://bugzilla.redhat.com/show_bug.cgi?id=1624149#c6
    resolves: rhbz#1624149


author: Laine Stump <laine@redhat.com>
changelog:
  - Improve performance with large number of interfaces
     (Bug 1268384, Bug 1271341)
   - recognize bond devices with no slaves


author: Daniel P. Berrangé <berrange@redhat.com> - 4.5.0-4
changelog:
  - Fix typed parameter memory handling (rhbz #1602346)
  - Fix missing NWFilterBinding module (rhbz #1615841)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.1.1-3.el8
changelog:
  - buildrpm/spec files: Don't package elf2dmp (Karl Heubaum)  [Orabug: 31657424]
  - qemu-kvm.spec: Enable the block-curl package (Karl Heubaum)  [Orabug: 31657424]
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 31657424]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-1.el8
changelog:
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy (Philippe Mathieu-Daudé)  [Orabug: 31414336]
  - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Simplify realize() a bit (Philippe Mathieu-Daudé)  [Orabug: 31414336]
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards (Philippe Mathieu-Daudé)  [Orabug: 31414336]
  - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
  - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890} {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361} {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
  - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126} {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378} {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
  - qemu-kvm.spec: Add .spec file for OL8 (Karl Heubaum)  [Orabug: 30618035]
  - qemu.spec: Add .spec file for OL7 (Karl Heubaum)  [Orabug: 30618035]
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30618035]
  - vhost.conf: Initial vhost.conf (Karl Heubaum)  [Orabug: 30618035]
  - parfait: Add buildrpm/parfait-qemu.conf (Karl Heubaum)  [Orabug: 30618035]
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)  [Orabug: 30618035]
  - qemu_regdump.py: Initial qemu_regdump.py (Karl Heubaum)  [Orabug: 30618035]
  - qmp-regdump: Initial qmp-regdump (Karl Heubaum)  [Orabug: 30618035]
  - bridge.conf: Initial bridge.conf (Karl Heubaum)  [Orabug: 30618035]
  - kvm.conf: Initial kvm.conf (Karl Heubaum)  [Orabug: 30618035]
  - 80-kvm.rules: Initial 80-kvm.rules (Karl Heubaum)  [Orabug: 30618035]
  - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
  - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]  {CVE-2020-13362}
  - memory: Revert "memory: accept mismatching sizes in memory_region_access_valid" (Michael S. Tsirkin)  [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-2.el8
changelog:
  - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella) [Orabug: 31667649] {CVE-2020-15863}
  - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella) [Orabug: 31737809] {CVE-2020-16092}
  - migration: fix memory leak in qmp_migrate_set_parameters (Zheng Chuan) [Orabug: 31806256]
  - virtio-net: fix removal of failover device (Juan Quintela) [Orabug: 31806255]
  - pvpanic: introduce crashloaded for pvpanic (zhenwei pi) [Orabug: 31677154]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-3.el8
changelog:
  - qemu-kvm.spec: Install block storage module RPMs by default (Karl Heubaum) [Orabug: 31943789]
  - qemu-kvm.spec: Enable block-ssh module RPM (Karl Heubaum) [Orabug: 31943763]
  - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit) [Orabug: 31901690] {CVE-2020-25625}
  - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit) [Orabug: 31901690] {CVE-2020-25625}
  - hw: ehci: check return value of 'usb_packet_map' (Li Qiang) [Orabug: 31901649] {CVE-2020-25084}
  - hw: xhci: check return value of 'usb_packet_map' (Li Qiang) [Orabug: 31901649] {CVE-2020-25084}
  - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann) [Orabug: 31848849] {CVE-2020-14364}
  - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda) [Orabug: 31855502] [Orabug: 31855427] {CVE-2020-12829} {CVE-2020-14415}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-4.el8
changelog:
  - Document CVE-2020-25723 as fixed (Mark Kanda) [Orabug: 32222397] {CVE-2020-25723}
  - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit) [Orabug: 32217517] {CVE-2020-28916}
  - i386: Add 2nd Generation AMD EPYC processors (Babu Moger) [Orabug: 32217570]
  - libslirp: Update version to include CVE fixes (Mark Kanda) [Orabug: 32208456] [Orabug: 32208462] {CVE-2020-29129} {CVE-2020-29130}
  - Document CVE-2020-25624 as fixed (Mark Kanda) [Orabug: 32212527] {CVE-2020-25624}
  - pvpanic: Advertise the PVPANIC_CRASHLOADED event support (Paolo Bonzini) [Orabug: 32102853]
  - ati: check x y display parameter values (Prasad J Pandit) [Orabug: 32108251] {CVE-2020-27616}
  - Add AArch64 support for QMP regdump tool and sosreport plugin (Mark Kanda) [Orabug: 32080658]
  - Add qemu_regdump sosreport plugin support for '-mon' QMP sockets (Mark Kanda)
  - migration/dirtyrate: present dirty rate only when querying the rate has completed (Chuan Zheng)
  - migration/dirtyrate: record start_time and calc_time while at the measuring state (Chuan Zheng)
  - migration/dirtyrate: Add trace_calls to make it easier to debug (Chuan Zheng)
  - migration/dirtyrate: Implement qmp_cal_dirty_rate()/qmp_get_dirty_rate() function (Chuan Zheng)
  - migration/dirtyrate: Implement calculate_dirtyrate() function (Chuan Zheng)
  - migration/dirtyrate: Implement set_sample_page_period() and is_sample_period_valid() (Chuan Zheng)
  - migration/dirtyrate: skip sampling ramblock with size below MIN_RAMBLOCK_SIZE (Chuan Zheng)
  - migration/dirtyrate: Compare page hash results for recorded sampled page (Chuan Zheng)
  - migration/dirtyrate: Record hash results for each sampled page (Chuan Zheng)
  - migration/dirtyrate: move RAMBLOCK_FOREACH_MIGRATABLE into ram.h (Chuan Zheng)
  - migration/dirtyrate: Add dirtyrate statistics series functions (Chuan Zheng)
  - migration/dirtyrate: Add RamblockDirtyInfo to store sampled page info (Chuan Zheng)
  - migration/dirtyrate: add DirtyRateStatus to denote calculation status (Chuan Zheng)
  - migration/dirtyrate: setup up query-dirtyrate framwork (Chuan Zheng)
  - ram_addr: Split RAMBlock definition (Juan Quintela)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-5.el8
changelog:
  - hostmem: fix default "prealloc-threads" count (Mark Kanda)
  - hostmem: introduce "prealloc-threads" property (Igor Mammedov)
  - qom: introduce object_register_sugar_prop (Paolo Bonzini)
  - migration/multifd: Do error_free after migrate_set_error to avoid memleaks (Pan Nengyuan)
  - multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling migration (Chuan Zheng)
  - migration/multifd: fix hangup with TLS-Multifd due to blocking handshake (Chuan Zheng)
  - migration/tls: add trace points for multifd-tls (Chuan Zheng)
  - migration/tls: add support for multifd tls-handshake (Chuan Zheng)
  - migration/tls: extract cleanup function for common-use (Chuan Zheng)
  - migration/multifd: fix memleaks in multifd_new_send_channel_async (Pan Nengyuan)
  - migration/multifd: fix nullptr access in multifd_send_terminate_threads (Zhimin Feng)
  - migration/tls: add tls_hostname into MultiFDSendParams (Chuan Zheng)
  - migration/tls: extract migration_tls_client_create for common-use (Chuan Zheng)
  - migration/tls: save hostname into MigrationState (Chuan Zheng)
  - tests/qtest: add a test case for pvpanic-pci (Mihai Carabas)
  - pvpanic : update pvpanic spec document (Mihai Carabas)
  - hw/misc/pvpanic: add PCI interface support (Mihai Carabas)
  - hw/misc/pvpanic: split-out generic and bus dependent code (Mihai Carabas)
  - qemu-img: Add --target-is-zero to convert (David Edmondson)
  - 9pfs: Fully restart unreclaim loop (CVE-2021-20181) (Greg Kurz) [Orabug: 32441198] {CVE-2021-20181}
  - ide: atapi: check logical block address and read size (CVE-2020-29443) (Prasad J Pandit) [Orabug: 32393835] {CVE-2020-29443}
  - Document CVE-2019-20808 as fixed (Mark Kanda) [Orabug: 32339196] {CVE-2019-20808}
  - block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb (Chen Qun) [Orabug: 32339207] {CVE-2020-11947}
  - net: remove an assert call in eth_get_gso_type (Prasad J Pandit) [Orabug: 32102583] {CVE-2020-27617}
  - nvdimm: honor -object memory-backend-file, readonly=on option (Stefan Hajnoczi) [Orabug: 32265408]
  - hostmem-file: add readonly=on|off option (Stefan Hajnoczi) [Orabug: 32265408]
  - memory: add readonly support to memory_region_init_ram_from_file() (Stefan Hajnoczi) [Orabug: 32265408]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-6.el8
changelog:
  - i386/pc: Keep PCI 64-bit hole within usable IOVA space (Joao Martins)
  - pc/cmos: Adjust CMOS above 4G memory size according to 1Tb boundary (Joao Martins)
  - i386/pc: Round up the hotpluggable memory within valid IOVA ranges (Joao Martins)
  - i386/pc: Account IOVA reserved ranges above 4G boundary (Joao Martins)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-10.el8
changelog:
  - e1000: fail early for evil descriptor (Jason Wang) [Orabug: 32560552] {CVE-2021-20257}
  - Document CVE-2020-27661 as fixed (Mark Kanda) [Orabug: 32960200] {CVE-2020-27661}
  - block: Avoid stale pointer dereference in blk_get_aio_context() (Greg Kurz)
  - block: Fix blk->in_flight during blk_wait_while_drained() (Kevin Wolf)
  - block: Increase BB.in_flight for coroutine and sync interfaces (Kevin Wolf)
  - block-backend: Reorder flush/pdiscard function definitions (Kevin Wolf)
  - i386/pc: let iterator handle regions below 4G (Joao Martins)
  - arm/virt: Add memory hot remove support (Shameer Kolothum) [Orabug: 32643506]
  - i386/pc: consolidate usable iova iteration (Joao Martins)
  - i386/acpi: fix SRAT ranges in accordance to usable IOVA (Joao Martins)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - multifd: Make multifd_save_setup() get an Error parameter (Juan Quintela)
  - multifd: Make multifd_load_setup() get an Error parameter (Juan Quintela)
  - migration: fix maybe-uninitialized warning (Marc-André Lureau)
  - migration: Fix the re-run check of the migrate-incoming command (Yury Kotov)
  - multifd: Initialize local variable (Juan Quintela)
  - multifd: Be consistent about using uint64_t (Juan Quintela)
  - Bug #1829242 correction. (Alexey Romko)
  - migration/multifd: fix destroyed mutex access in terminating multifd threads (Jiahui Cen)
  - migration/multifd: fix nullptr access in terminating multifd threads (Jiahui Cen)
  - migration/multifd: not use multifd during postcopy (Wei Yang)
  - migration/multifd: clean pages after filling packet (Wei Yang)
  - migration: Make sure that we don't call write() in case of error (Juan Quintela)
  - migration: fix multifd_send_pages() next channel (Laurent Vivier)
  - migration/multifd: bypass uuid check for initial packet (Elena Ufimtseva) [Orabug: 32610480]
  - migration/tls: add error handling in multifd_tls_handshake_thread (Hao Wang)
  - migration/tls: fix inverted semantics in multifd_channel_connect (Hao Wang)
  - migration/multifd: do not access uninitialized multifd_recv_state (Elena Ufimtseva) [Orabug: 32795384]
  - io/channel-tls.c: make qio_channel_tls_shutdown thread-safe (Lukas Straub)
  - qemu.spec: Enable qemu-guest-agent RPM for OL7 (Karl Heubaum) [Orabug: 32415543]
  - virtio-net: Set mac address to hardware if the peer is vdpa (Cindy Lu)
  - net: Add vhost-vdpa in show_netdevs() (Cindy Lu)
  - vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup (Cindy Lu)
  - hw/virtio/vhost-vdpa: Fix Coverity CID 1432864 (Philippe Mathieu-Daudé)
  - vhost-vdpa: negotiate VIRTIO_NET_F_STATUS with driver (Si-Wei Liu)
  - configure: Fix build dependencies with vhost-vdpa. (Laurent Vivier)
  - configure: simplify vhost condition with Kconfig (Marc-André Lureau)
  - vhost-vdpa: add trace-events (Laurent Vivier)
  - dma/pl330: Fix qemu_hexdump() usage in pl330.c (Mark Kanda)
  - util/hexdump: introduce qemu_hexdump_line() (Laurent Vivier)
  - util/hexdump: Reorder qemu_hexdump() arguments (Philippe Mathieu-Daudé)
  - util/hexdump: Convert to take a void pointer argument (Philippe Mathieu-Daudé)
  - net/colo-compare.c: Only hexdump packets if tracing is enabled (Lukas Straub)
  - vhost-vdpa: batch updating IOTLB mappings (Jason Wang)
  - vhost: switch to use IOTLB v2 format (Jason Wang)
  - vhost-vdpa: remove useless variable (Laurent Vivier)
  - virtio: vdpa: omit check return of g_malloc (Li Qiang)
  - vhost-vdpa: fix indentation in vdpa_ops (Stefano Garzarella)
  - virtio-net: check the existence of peer before accessing vDPA config (Jason Wang)
  - virtio-pci: fix wrong index in virtio_pci_queue_enabled (Yuri Benditovich)
  - virtio-pci: fix virtio_pci_queue_enabled() (Laurent Vivier)
  - vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 (Cindy Lu)
  - vhost-vdpa: fix the compile issue without kvm (Cindy Lu)
  - vhost-vdpa: introduce vhost-vdpa net client (Cindy Lu)
  - vhost-vdpa: introduce vhost-vdpa backend (Cindy Lu)
  - linux headers: sync to 5.9-rc4 (Jason Wang)
  - Linux headers: update (Cornelia Huck)
  - virtio-net: fix rsc_ext compat handling (Cornelia Huck)
  - linux-headers: update against Linux 5.7-rc3 (Cornelia Huck)
  - linux-headers: update (Cornelia Huck)
  - virtiofsd: Pull in kernel's fuse.h (Dr. David Alan Gilbert)
  - linux-headers: Update (Bharata B Rao)
  - linux-headers: Update (Greg Kurz)
  - vhost_net: introduce set_config & get_config (Cindy Lu)
  - vhost: implement vhost_force_iommu method (Cindy Lu)
  - vhost: introduce new VhostOps vhost_force_iommu (Cindy Lu)
  - vhost: implement vhost_vq_get_addr method (Cindy Lu)
  - vhost: introduce new VhostOps vhost_vq_get_addr (Cindy Lu)
  - vhost: implement vhost_dev_start method (Cindy Lu)
  - vhost: introduce new VhostOps vhost_dev_start (Cindy Lu)
  - vhost: check the existence of vhost_set_iotlb_callback (Jason Wang)
  - virtio-pci: implement queue_enabled method (Jason Wang)
  - virtio-bus: introduce queue_enabled method (Jason Wang)
  - vhost_net: use the function qemu_get_peer (Cindy Lu)
  - net: introduce qemu_get_peer (Cindy Lu)
  - vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM (Jason Wang)
  - imx7-ccm: add digprog mmio write method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - tz-ppc: add dummy read/write methods (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - spapr_pci: add spapr msi read method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - nvram: add nrf51_soc flash read method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - prep: add ppc-parity write method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - vfio: add quirk device write method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - pci-host: designware: add pcie-msi read method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - hw/pci-host: add pci-intack write method (Prasad J Pandit) [Orabug: 31576552] {CVE-2020-15469}
  - oslib-posix: take lock before qemu_cond_broadcast (Bauerchen) [Orabug: 32555402]
  - oslib-posix: initialize mutex and condition variable (Paolo Bonzini) [Orabug: 32555402]
  - mem-prealloc: optimize large guest startup (Bauerchen) [Orabug: 32555402]
  - i386: Add the support for AMD EPYC 3rd generation processors (Babu Moger)
  - acpi: cpuhp: document CPHP_GET_CPU_ID_CMD command (Igor Mammedov)
  - acpi: cpuhp: add CPHP_GET_CPU_ID_CMD command (Igor Mammedov)
  - acpi: cpuhp: spec: add typical usecases (Igor Mammedov)
  - acpi: cpuhp: spec: clarify store into 'Command data' when 'Command field' == 0 (Igor Mammedov)
  - acpi: cpuhp: spec: fix 'Command data' description (Igor Mammedov)
  - acpi: cpuhp: spec: clarify 'CPU selector' register usage and endianness (Igor Mammedov)
  - acpi: cpuhp: introduce 'Command data 2' field (Igor Mammedov)
  - x86: ich9: let firmware negotiate 'CPU hot-unplug with SMI' feature (Igor Mammedov)
  - x86: ich9: factor out "guest_cpu_hotplug_features" (Igor Mammedov)
  - x86: acpi: let the firmware handle pending "CPU remove" events in SMM (Igor Mammedov)
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpu_unplug (Igor Mammedov)
  - acpi: cpuhp: introduce 'firmware performs eject' status/control bits (Igor Mammedov)
  - x68: acpi: trigger SMI before sending hotplug Notify event to OSPM (Igor Mammedov)
  - x86: acpi: introduce the PCI0.SMI0 ACPI device (Igor Mammedov)
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpuhp (Igor Mammedov)
  - x86: ich9: expose "smi_negotiated_features" as a QOM property (Igor Mammedov)
  - tests: acpi: mark to be changed tables in bios-tables-test-allowed-diff (Igor Mammedov)
  - acpi: add aml_land() and aml_break() primitives (Igor Mammedov)
  - x86: cpuhp: refuse cpu hot-unplug request earlier if not supported (Igor Mammedov)
  - x86: cpuhp: prevent guest crash on CPU hotplug when broadcast SMI is in use (Igor Mammedov)
  - x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (Igor Mammedov)
  - q35: implement 128K SMRAM at default SMBASE address (Igor Mammedov)
  - hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register (Philippe Mathieu-Daudé) [Orabug: 32470471] {CVE-2021-20221}
  - memory: clamp cached translation in case it points to an MMIO region (Paolo Bonzini) [Orabug: 32252673] {CVE-2020-27821}
  - hw/sd/sdhci: Fix DMA Transfer Block Size field (Philippe Mathieu-Daudé) [Orabug: 32613470] {CVE-2021-3409}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-11.el8
changelog:
  - pvrdma: Fix the ring init error flow (Marcel Apfelbaum) [Orabug: 33120142] {CVE-2021-3608}
  - pvrdma: Ensure correct input on ring init (Marcel Apfelbaum) [Orabug: 33120146] {CVE-2021-3607}
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (Marcel Apfelbaum) [Orabug: 33120084] {CVE-2021-3582}
  - vhost-user-gpu: reorder free calls (Gerd Hoffmann) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: abstract vg_cleanup_mapping_iov (Li Qiang) [Orabug: 32950716] {CVE-2021-3546}
  - vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (Li Qiang) [Orabug: 32950716] {CVE-2021-3546}
  - vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in vg_resource_attach_backing (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (Li Qiang) [Orabug: 32950701] {CVE-2021-3544}
  - vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (Li Qiang) [Orabug: 32950708] {CVE-2021-3545}
  - usb: limit combined packets to 1 MiB (Gerd Hoffmann) [Orabug: 32842778] {CVE-2021-3527}
  - usb/redir: avoid dynamic stack allocation (Gerd Hoffmann) [Orabug: 32842778] {CVE-2021-3527}
  - mptsas: Remove unused MPTSASState 'pending' field (Michael Tokarev) [Orabug: 32470463] {CVE-2021-3392}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
  - oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-12.1.el8
changelog:
  - Update slirp to address various CVEs (Mark Kanda) [Orabug: 32208456] [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420] {CVE-2020-29129} {CVE-2020-29130} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - hw/pflash_cfi01: Allow backing devices to be smaller than memory region (David Edmondson)
  - pcie: expire pending delete (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: fast unplug when slot power is off (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: add power indicator blink check (Gerd Hoffmann) [Orabug: 33450706]
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann) [Orabug: 33450706]
  - pci: implement power state (Gerd Hoffmann) [Orabug: 33450706]
  - hw/pci/pcie: Move hot plug capability check to pre_plug callback (Julia Suvorova) [Orabug: 33450706]
  - hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable (Julia Suvorova) [Orabug: 33450706]
  - hw/pci/pcie: Forbid hot-plug if it's disabled on the slot (Julia Suvorova) [Orabug: 33450706]
  - pcie_root_port: Add hotplug disabling option (Julia Suvorova) [Orabug: 33450706]
  - qdev-monitor: Forbid repeated device_del (Julia Suvorova) [Orabug: 33450706]
  - i386:acpi: Remove _HID from the SMBus ACPI entry (Corey Minyard)
  - uas: add stream number sanity checks (Gerd Hoffmann) [Orabug: 33280793] {CVE-2021-3713}
  - usbredir: fix free call (Gerd Hoffmann) [Orabug: 33198441] {CVE-2021-3682}
  - hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands (Mauro Matteo Cascella) [Orabug: 33548490] {CVE-2021-3930}
  - e1000: fix tx re-entrancy problem (Jon Maloy) [Orabug: 32560552] {CVE-2021-20257}
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda) [Orabug: 33537594]
  - MAINTAINERS: Add ACPI/HEST/GHES entries (Dongjiu Geng)
  - target-arm: kvm64: handle SIGBUS signal from kernel or KVM (Dongjiu Geng)
  - ACPI: Record Generic Error Status Block(GESB) table (Dongjiu Geng)
  - KVM: Move hwpoison page related functions into kvm-all.c (Dongjiu Geng)
  - ACPI: Record the Generic Error Status Block address (Dongjiu Geng)
  - ACPI: Build Hardware Error Source Table (Dongjiu Geng)
  - ACPI: Build related register address fields via hardware error fw_cfg blob (Dongjiu Geng)
  - docs: APEI GHES generation and CPER record description (Dongjiu Geng)
  - hw/arm/virt: Introduce a RAS machine option (Dongjiu Geng)
  - acpi: nvdimm: change NVDIMM_UUID_LE to a common macro (Dongjiu Geng)
  - block/curl: HTTP header field names are case insensitive (David Edmondson) [Orabug: 33287589]
  - block/curl: HTTP header fields allow whitespace around values (David Edmondson) [Orabug: 33287589]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-14.el8
changelog:
  - scsi: fix sense code for EREMOTEIO (Paolo Bonzini) [Orabug: 33537443]
  - scsi: move host_status handling into SCSI drivers (Hannes Reinecke) [Orabug: 33537443]
  - scsi: inline sg_io_sense_from_errno() into the callers (Hannes Reinecke) [Orabug: 33537443]
  - scsi-generic: do not snoop the output of failed commands (Paolo Bonzini) [Orabug: 33537443]
  - scsi: Add mapping for generic SCSI_HOST status to sense codes (Hannes Reinecke) [Orabug: 33537443]
  - scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST error codes (Hannes Reinecke) [Orabug: 33537443]
  - scsi: drop 'result' argument from command_complete callback (Hannes Reinecke) [Orabug: 33537443]
  - scsi-disk: pass guest recoverable errors through even for rerror=stop (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: pass SCSI status to scsi_handle_rw_error (Paolo Bonzini) [Orabug: 33537443]
  - scsi: introduce scsi_sense_from_errno() (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: do not complete requests early for rerror/werror=ignore (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: move scsi_handle_rw_error earlier (Paolo Bonzini) [Orabug: 33537443]
  - scsi-disk: convert more errno values back to SCSI statuses (Paolo Bonzini) [Orabug: 33537443]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1.15.el8
changelog:
  - qemu-kvm.spec: Add support for reading vmdk, vhdx, vpc, https, and ssh disk image formats from qemu-kvm (Karl Heubaum) [Orabug: 33741340]
  - Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda) [Orabug: 33719302] [Orabug: 33754145] {CVE-2021-4158} {CVE-2021-3947}
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daudé) [Orabug: 32439466] {CVE-2021-20196}
  - hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daudé) [Orabug: 32439466] {CVE-2021-20196}
  - net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit) [Orabug: 32559476] {CVE-2021-20203}
  - lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov) [Orabug: 32560540] {CVE-2021-3416}
  - tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - sungem: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - e1000: switch to use qemu_receive_packet() for loopback (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - net: introduce qemu_receive_packet() (Jason Wang) [Orabug: 32560540] {CVE-2021-3416}
  - target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (Paolo Bonzini)
  - target/i386: Observe XSAVE state area offsets (Paolo Bonzini)
  - target/i386: Make x86_ext_save_areas visible outside cpu.c (Paolo Bonzini)
  - target/i386: Pass buffer and length to XSAVE helper (Paolo Bonzini)
  - target/i386: Clarify the padding requirements of X86XSaveArea (Paolo Bonzini)
  - target/i386: Consolidate the X86XSaveArea offset checks (Paolo Bonzini)
  - target/i386: Declare constants for XSAVE offsets (Paolo Bonzini)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1.16.el8
changelog:
  - Document CVE-2021-4145 as fixed (Mark Kanda) [Orabug: 33791496] {CVE-2021-4145}
  - migration: Tally pre-copy, downtime and post-copy bytes independently (David Edmondson)
  - migration: Introduce ram_transferred_add() (David Edmondson)
  - ACPI ERST: specification for ERST support (Eric DeVolder)
  - ACPI ERST: step 6 of bios-tables-test.c (Eric DeVolder)
  - ACPI ERST: bios-tables-test testcase (Eric DeVolder)
  - ACPI ERST: qtest for ERST (Eric DeVolder)
  - ACPI ERST: create ACPI ERST table for pc/x86 machines (Eric DeVolder)
  - ACPI ERST: build the ACPI ERST table (Eric DeVolder)
  - ACPI ERST: support for ACPI ERST feature (Eric DeVolder)
  - ACPI ERST: header file for ERST (Eric DeVolder)
  - ACPI ERST: PCI device_id for ERST (Eric DeVolder)
  - ACPI ERST: bios-tables-test.c steps 1 and 2 (Eric DeVolder)
  - ACPI: cleanup bios-tables-test state (Eric DeVolder)
  - KVM: x86: believe what KVM says about WAITPKG (Paolo Bonzini) [Orabug: 33832295]
  - cputlb: destroy CPUTLB with tlb_destroy (Emilio G. Cota) [Orabug: 33428107]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-17.el8
changelog:
  - arm/acpi: fix an out of spec _UID for PCI root (Michael S. Tsirkin)
  - arm/acpi: fix duplicated _UID of PCI interrupt link devices (Heyi Guo)
  - arm/acpi: fix PCI _PRT definition (Heyi Guo)
  - docs: fix references to docs/devel/atomics.rst (Stefano Garzarella) [Orabug: 33659123]
  - rcu: do not mention atomic_mb_read/set in documentation (Paolo Bonzini) [Orabug: 33659123]
  - atomics: update documentation (Paolo Bonzini) [Orabug: 33659123]
  - atomics: convert to reStructuredText (Paolo Bonzini) [Orabug: 33659123]
  - async: use explicit memory barriers (Paolo Bonzini) [Orabug: 33659123]
  - aio-wait: delegate polling of main AioContext if BQL not held (Paolo Bonzini) [Orabug: 33659123]
  - qapi: Add '@allow-write-only-overlay' feature for 'blockdev-snapshot' (Peter Krempa) [Orabug: 33888021]
  - iotests: Add iothread cases to 155 (Kevin Wolf) [Orabug: 33888021]
  - block: Fix cross-AioContext blockdev-snapshot (Kevin Wolf) [Orabug: 33888021]
  - iotests: Test mirror with temporarily disabled target backing file (Kevin Wolf) [Orabug: 33888021]
  - iotests: Fix run_job() with use_log=False (Kevin Wolf) [Orabug: 33888021]
  - block: Relax restrictions for blockdev-snapshot (Kevin Wolf) [Orabug: 33888021]
  - block: Make bdrv_get_cumulative_perm() public (Kevin Wolf) [Orabug: 33888021]
  - iotests: Use complete_and_wait() in 155 (Max Reitz) [Orabug: 33888021]
  - iotests: Support job-complete in run_job() (Kevin Wolf) [Orabug: 33888021]
  - linux-headers: update again to 5.8 (Paolo Bonzini) [Orabug: 34022218]
  - virtio-net: fix map leaking on error during receive (Jason Wang) [Orabug: 33941879] {CVE-2022-26353}
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella) [Orabug: 33941844] {CVE-2022-26354}
  - virtio-net: fix use after unmap/free for sg (Jason Wang) [Orabug: 33972912] {CVE-2021-3748}
  - migration: Report the error returned when save_live_iterate fails (David Edmondson)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-18.el8
changelog:
  - block: introduce max_hw_iov for use in scsi-generic (Paolo Bonzini) [Orabug: 33785156]
  - file-posix: try BLKSECTGET on block devices too, do not round to power of 2 (Paolo Bonzini) [Orabug: 33785156]
  - block: add max_hw_transfer to BlockLimits (Paolo Bonzini) [Orabug: 33785156]
  - block-backend: align max_transfer to request alignment (Paolo Bonzini) [Orabug: 33785156]
  - osdep: provide ROUND_DOWN macro (Paolo Bonzini) [Orabug: 33785156]
  - scsi-generic: pass max_segments via max_iov field in BlockLimits (Paolo Bonzini) [Orabug: 33785156]
  - file-posix: fix max_iov for /dev/sg devices (Paolo Bonzini) [Orabug: 33785156]
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella) [Orabug: 34049511] {CVE-2021-4207}
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella) [Orabug: 34049509] {CVE-2021-4206}
  - hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507) (Philippe Mathieu-Daudé) [Orabug: 32860387] {CVE-2021-3507}
  - pc: q35: Bump max_cpus to 512 (Suravee Suthikulpanit) [Orabug: 34314249]
  - tests/qtest: fix pvpanic-pci-test (Mark Kanda) [Orabug: 34284763]
  - libqos: pci-pc: use 32-bit write for EJ register (Paolo Bonzini) [Orabug: 34284758]
  - libqos: usb-hcd-ehci: use 32-bit write for config register (Paolo Bonzini) [Orabug: 34284768]
  - target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero) [Orabug: 33528615]
  - i386: Mask SVM features if nested SVM is disabled (Eduardo Habkost) [Orabug: 33860224]
  - ide: Cap LBA28 capacity announcement to 2^28-1 (Samuel Thibault) [Orabug: 25327652]
  - tests/acpi: update expected arm/virt tables (Mark Kanda) [Orabug: 34132842]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-19.el8
changelog:
  - virtio-net: handle zero mac for a vdpa peer (Cindy Lu) [Orabug: 34137522]
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu) [Orabug: 34137522]
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu) [Orabug: 34137522]
  - vhost-vdpa: backend feature should set only once (Si-Wei Liu) [Orabug: 34137522]
  - vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu) [Orabug: 34137522]
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu) [Orabug: 34137522]
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu) [Orabug: 34137522]
  - virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu) [Orabug: 34137522]
  - virtio: fix the condition for iommu_platform not supported (Halil Pasic) [Orabug: 34137522]
  - vdpa: Make ncs autofree (Eugenio Pérez) [Orabug: 34137522]
  - vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier) [Orabug: 34137522]
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier) [Orabug: 34137522]
  - vhost-vdpa: stick to -errno error return convention (Roman Kagan) [Orabug: 34137522]
  - vdpa: Add dummy receive callback (Eugenio Pérez) [Orabug: 34137522]
  - vdpa: Check for existence of opts.vhostdev (Eugenio Pérez) [Orabug: 34137522]
  - vhost: Fix last vq queue index of devices with no cvq (Eugenio Pérez) [Orabug: 34137522]
  - vhost: Rename last_index to vq_index_end (Eugenio Pérez) [Orabug: 34137522]
  - net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella) [Orabug: 34137522]
  - vhost-vdpa: multiqueue support (Jason Wang) [Orabug: 34137522]
  - virtio-net: vhost control virtqueue support (Jason Wang) [Orabug: 34137522]
  - vhost: record the last virtqueue index for the virtio device (Jason Wang) [Orabug: 34137522]
  - virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang) [Orabug: 34137522]
  - vhost-net: control virtqueue support (Jason Wang) [Orabug: 34137522]
  - net: introduce control client (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: prepare for the multiqueue support (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: classify one time request (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang) [Orabug: 34137522]
  - vdpa: Check for iova range at mappings changes (Eugenio Pérez) [Orabug: 34137522]
  - vdpa: Add vhost_vdpa_section_end (Eugenio Pérez) [Orabug: 34137522]
  - net/vhost-vdpa: Fix device compatibility check (Kevin Wolf) [Orabug: 34137522]
  - net/vhost-user: Fix device compatibility check (Kevin Wolf) [Orabug: 34137522]
  - net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf) [Orabug: 34137522]
  - vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang) [Orabug: 34137522]
  - vhost_net: do not assume nvqs is always 2 (Jason Wang) [Orabug: 34137522]
  - vhost: use unsigned int for nvqs (Jason Wang) [Orabug: 34137522]
  - vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: remove unused variable "acked_features" (Jason Wang) [Orabug: 34137522]
  - vhost: correctly detect the enabling IOMMU (Jason Wang) [Orabug: 34137522]
  - virtio-pci: implement iommu_enabled() (Jason Wang) [Orabug: 34137522]
  - virtio-bus: introduce iommu_enabled() (Jason Wang) [Orabug: 34137522]
  - hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu) [Orabug: 34137522]
  - vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Pérez) [Orabug: 34137522]
  - vhost-vdpa: remove the unused vhost_vdpa_get_acked_features() (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: don't initialize backend_features (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: map virtqueue notification area if possible (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: skip ram device from the IOTLB mapping (Jason Wang) [Orabug: 34137522]
  - vhost-vdpa: Remove redundant declaration of address_space_memory (Xie Yongji) [Orabug: 34137522]
  - virtio: Fail if iommu_platform is requested, but unsupported (Kevin Wolf) [Orabug: 34137522]
  - vhost-vdpa: Make vhost_vdpa_get_device_id() static (Zenghui Yu) [Orabug: 34137522]
  - Update linux headers to 5.11-rc2 (Eric Farman) [Orabug: 34137522]
  - linux-headers: update against 5.10-rc1 (Matthew Rosato) [Orabug: 34137522]
  - linux headers: sync to 5.9-rc7 (Andrew Jones) [Orabug: 34137522]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-20.el8
changelog:
  - vl: Add an -action option to override MCE handling (Mark Kanda) [Orabug: 34538907]
  - vl: Add an -action option specifying response to guest events (Alejandro Jimenez) [Orabug: 34538907]
  - qmp: generalize watchdog-set-action to -no-reboot/-no-shutdown (Alejandro Jimenez) [Orabug: 34538907]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-21.el8
changelog:
  - qemu-kvm.spec: Fix the qemu-regdump sos report plugin path (Mark Kanda) [Orabug: 34680062]
  - qmp-regdump: Require python3 on OL8 (Mark Kanda) [Orabug: 34672256]
  - iotests: Adjust 186.out to account for 'null' node-name (Mark Kanda) [Orabug: 34447388]
  - block: Set the name of BlockBackend if possible (Annie Li) [Orabug: 34447388]
  - acpi: Update _DSM method in expected files (Mark Kanda) [Orabug: 34616322]
  - acpi/gpex: Fix cca attribute check for pxb device (Xingang Wang) [Orabug: 34616322]
  - acpi: Enable pxb unit-test for ARM virt machine (Jiahui Cen) [Orabug: 34616322]
  - Kconfig: Compile PXB for ARM_VIRT (Jiahui Cen) [Orabug: 34616322]
  - acpi/gpex: Exclude pxb's resources from PCI0 (Jiahui Cen) [Orabug: 34616322]
  - acpi/gpex: Inform os to keep firmware resource map (Jiahui Cen) [Orabug: 34616322]
  - acpi: Add addr offset in build_crs (Jiahui Cen) [Orabug: 34616322]
  - unit-test: Add testcase for pxb (Yubo Miao) [Orabug: 34616322]
  - acpi: Align the size to 128k (Yubo Miao) [Orabug: 34616322]
  - acpi/gpex: Build tables for pxb (Yubo Miao) [Orabug: 34616322]
  - acpi: Extract crs build form acpi_build.c (Yubo Miao) [Orabug: 34616322]
  - hw/arm/virt: Write extra pci roots into fw_cfg (Jiahui Cen) [Orabug: 34616322]
  - fw_cfg: Refactor extra pci roots addition (Jiahui Cen) [Orabug: 34616322]
  - acpi/gpex: Extract two APIs from acpi_dsdt_add_pci (Yubo Miao) [Orabug: 34616322]
  - arm: use acpi_dsdt_add_gpex (Gerd Hoffman) [Orabug: 34616322]
  - acpi: add acpi_dsdt_add_gpex (Gerd Hoffman) [Orabug: 34616322]
  - acpi: Allow DSDT acpi table changes (Jiahui Cen) [Orabug: 34616322]
  - move MemMapEntry (Gerd Hoffman) [Orabug: 34616322]
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34353672] {CVE-2022-0216}
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34353672] {CVE-2022-0216}
  - tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daudé) [Orabug: 34353672] {CVE-2022-0216}
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daudé) [Orabug: 34353672] {CVE-2022-0216}
  - vfio: defer to commit kvm irq routing when enable msi/msix (Mike Longpeng) [Orabug: 34419422]
  - vfio: simplify the failure path in vfio_msi_enable (Mike Longpeng) [Orabug: 34419422]
  - vfio: move re-enabling INTX out of the common helper (Mike Longpeng) [Orabug: 34419422]
  - vfio: simplify the conditional statements in vfio_msi_enable (Mike Longpeng) [Orabug: 34419422]
  - kvm/msi: do explicit commit when adding msi routes (Mike Longpeng) [Orabug: 34419422]
  - kvm-irqchip: introduce new API to support route change (Mike Longpeng) [Orabug: 34419422]
  - event_notifier: handle initialization failure better (Maxim Levitsky) [Orabug: 34419422]
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda) [Orabug: 34510460]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-22.el8
changelog:
  - Revert "block: Set the name of BlockBackend if possible" (Joe Jin) [Orabug: 34841102]
  - Revert "iotests: Adjust 186.out to account for 'null' node-name" (Joe Jin) [Orabug: 34841102]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-24.el8
changelog:
  - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daudé) [Orabug: 33930374] {CVE-2021-3638}
  - tests/acpi: virt: update ACPI MADT and FADT binaries (Miguel Luis)
  - acpi: arm/virt: madt: bump to revision 4 accordingly to ACPI 6.0 Errata A (Miguel Luis)
  - acpi: arm/virt: madt: use build_append_int_noprefix() API to compose MADT table (Igor Mammedov)
  - acpi: madt: arm/x86: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov)
  - hw/arm/virt-acpi-build:Remove dead assignment in build_madt() (Chen Qun)
  - acpi: build_fadt: adapt FADT table names (Miguel Luis)
  - acpi: fadt: support revision 6.0 of the ACPI specification (Miguel Luis)
  - tests/acpi: virt: allow acpi MADT and FADT changes (Miguel Luis)
  - Document CVE-2022-3165 as not applicable (Mark Kanda) [Orabug: 34713999] {CVE-2022-3165}
  - Document CVE-2022-1050 as not applicable (Mark Kanda) [Orabug: 34132133] {CVE-2022-1050}
  - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt) [Orabug: 34779472] {CVE-2022-4172}
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset (Si-Wei Liu)
  - net/vhost-vdpa.c: Fix clang compilation failure (Peter Maydell)
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa (Si-Wei Liu)
  - hw/acpi/aml-build: Improve scalability of PPTT generation (Yanan Wang)
  - tests/data/acpi/virt: update empty file for PPTT (Miguel Luis)
  - hw/arm/virt-acpi-build: Generate PPTT table (Yanan Wang)
  - tests/data/acpi/virt: Add an empty expected file for PPTT (Yanan Wang)
  - hw/acpi/aml-build: Add PPTT table (Andrew Jones)
  - hw/acpi/aml-build: Add Processor hierarchy node structure (Yanan Wang)
  - machine: Add SMP Sockets in CpuTopology (Babu Moger)
  - bios-tables-test: generate table for virt/DBG2 (Miguel Luis)
  - hw/arm/virt_acpi_build: Generate DBG2 table (Eric Auger)
  - tests/acpi: Add void table for virt/DBG2 bios-tables-test (Eric Auger)
  - tests/acpi: virt: update ACPI GTDT binaries (Miguel Luis) [Orabug: 34711916]
  - acpi: arm/virt: build_gtdt: fix invalid 64-bit physical addresses (Miguel Luis) [Orabug: 34711916]
  - tests/acpi: virt: allow acpi GTDT changes (Miguel Luis) [Orabug: 34711916]
  - acpi: fix OEM ID/OEM Table ID padding (Igor Mammedov) [Orabug: 34711916]
  - acpi: arm/virt: build_gtdt: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov) [Orabug: 34711916]
  - acpi: add helper routines to initialize ACPI tables (Igor Mammedov) [Orabug: 34711916]
  - acpi: declare the default assignable value for the ACPI table header (Miguel Luis) [Orabug: 34711916]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-25.el8
changelog:
  - target/i386/kvm: get and put AMD pmu registers (Dongli Zhang) [Orabug: 34641255]
  - i386/kvm: fix a use-after-free when vcpu plug/unplug (Pan Nengyuan) [Orabug: 34859902]
  - memory: batch allocate ioeventfds[] in address_space_update_ioeventfds() (Stefan Hajnoczi) [Orabug: 34538900]
  - virtio-blk: Fix clean up of host notifiers for single MR transaction (Mark Mielke) [Orabug: 34538900]
  - virtio-scsi: Configure all host notifiers in a single MR transaction (Greg Kurz) [Orabug: 34538900]
  - virtio-scsi: Set host notifiers and callbacks separately (Greg Kurz) [Orabug: 34538900]
  - virtio-blk: Configure all host notifiers in a single MR transaction (Greg Kurz) [Orabug: 34538900]
  - virtio-blk: Fix rollback path in virtio_blk_data_plane_start() (Greg Kurz) [Orabug: 34538900]
  - event_notifier: Set ->initialized earlier in event_notifier_init() (Greg Kurz) [Orabug: 34538900]
  - virtio-scsi: don't process IO on fenced dataplane (Maxim Levitsky) [Orabug: 34538900]
  - virtio-scsi: don't uninitialize queues that we didn't initialize (Maxim Levitsky) [Orabug: 34538900]
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-26.el8
changelog:
  - migration: check magic value for deciding the mapping of channels (Manish Mishra) [Orabug: 34735462]
  - io: Add support for MSG_PEEK for socket channel (Manish Mishra) [Orabug: 34735462]
  - migration: Move channel setup out of postcopy_try_recover() (Peter Xu) [Orabug: 34735462]
  - vdpa: commit all host notifier MRs in a single MR transaction (Mike Longpeng) [Orabug: 35252234]
  - vhost: configure all host notifiers in a single MR transaction (Mike Longpeng) [Orabug: 35252234]
  - vhost: simplify vhost_dev_enable_notifiers (Mike Longpeng) [Orabug: 35252234]
  - pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li) [Orabug: 35055290]
  - qga/win32: Use rundll for VSS installation (Konstantin Kostiuk) [Orabug: 35206108] {CVE-2023-0664}
  - qga/win32: Remove change action from MSI installer (Konstantin Kostiuk) [Orabug: 35206108] {CVE-2023-0664}
  - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daudé) [Orabug: 34846087]
  - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daudé) [Orabug: 34846087] {CVE-2022-4144}
  - hw/display/qxl: Pass requested buffer size to qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 34846087]
  - hw/display/qxl: Document qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 34846087]
  - hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler (Philippe Mathieu-Daudé) [Orabug: 34846087]
  - virtio-blk: On restart, process queued requests in the proper context (Sergio Lopez) [Orabug: 35060530]
  - virtio-blk: Refactor the code that processes queued requests (Sergio Lopez) [Orabug: 35060530]
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse) [Orabug: 35219223]
  - modules: load modules from /var/run/qemu/ directory firstly (Siddhi Katage) [Orabug: 34867783]
  - qemu.spec: Add post-install script for block storage modules (Siddhi Katage) [Orabug: 34867783]
  - qemu.spec: Enable '-module-upgrades' for OL7 (Siddhi Katage) [Orabug: 34867783]
  - module: increase dirs array size by one (Bruce Rogers) [Orabug: 34867783]
  - modules: load modules from versioned /var/run dir (Christian Ehrhardt) [Orabug: 34867783]
  - blockjob: Fix crash with IOthread when block commit after snapshot (Michael Qiu) [Orabug: 35118668]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-27.el8
changelog:
  - hw/arm/virt: Add nvdimm hotplug support (Shameer Kolothum) [Orabug: 35505663]
  - hw/arm/virt: Add nvdimm hot-plug infrastructure (Kwangwoo Lee) [Orabug: 35505663]
  - nvdimm: Use configurable ACPI IO base and size (Kwangwoo Lee) [Orabug: 35505663]
  - target/i386: define a new MSR based feature word - FEAT_PERF_CAPABILITIES (Like Xu) [Orabug: 35370615]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-28.el8
changelog:
  - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35724113] {CVE-2023-3180}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35724112] {CVE-2023-0330}
  - kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35719844]
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35719844]
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35719844]
  - KVM: Use a big lock to replace per-kml slots_lock (Peter Xu) [Orabug: 35719844]
  - pcie: don't set link state active if the slot is empty (Laurent Vivier) [Orabug: 35707933]
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35662850] {CVE-2023-3301}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-27.1.el8
changelog:
  - kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35719844]
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35719844]
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35719844]
  - KVM: Use a big lock to replace per-kml slots_lock (Peter Xu) [Orabug: 35719844]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-32.el8
changelog:
  - Document CVEs as fixed (Mark Kanda) [Orabug: 36455470] [Orabug: 36455480] [Orabug: 36455529] [Orabug: 36455489] [Orabug: 36455500] [Orabug: 36455512] [Orabug: 36455520] {CVE-2023-4135} {CVE-2023-3255} {CVE-2023-6683} {CVE-2023-40360} {CVE-2023-42467} {CVE-2024-26327} {CVE-2024-24474}
  - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35250119] {CVE-2023-1544}
  - hw/pflash_cfi01: allow smaller backing devices in postload_update_cb() (Mark Kanda) [Orabug: 36378764]
  - hw/block/pflash: Check return value of blk_pwrite() (Mansour Ahmadi) [Orabug: 36378764]
  - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 36421467] {CVE-2023-3019}
  - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 36421467] {CVE-2023-3019}
  - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 36425307] {CVE-2021-3750}
  - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
  - util/async: add a human-readable name to BHs for debugging (Stefan Hajnoczi) [Orabug: 36425307] {CVE-2021-3750}
  - io: remove io watch if TLS channel is closed during handshake (Daniel Berrangé) [Orabug: 35595204] {CVE-2023-3354}
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug: 36327659] {CVE-2023-5088}
  - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 36327659] {CVE-2023-5088}
  - accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025) (Alex Bennée) [Orabug: 36327651] {CVE-2020-24165}
  - physmem: add missing memory barrier (Paolo Bonzini) [Orabug: 35886091]
  - qemu-coroutine-lock: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35886091]
  - aio-wait: switch to smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35886091]
  - edu: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35886091]
  - qemu-thread-win32: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35886091]
  - qemu-thread-posix: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35886091]
  - qatomic: add smp_mb__before/after_rmw() (Paolo Bonzini) [Orabug: 35886091]
  - aio_wait_kick: add missing memory barrier (Emanuele Giuseppe Esposito) [Orabug: 35886091]
  - hw/smbios: Fix core count in type4 (Zhao Liu) [Orabug: 35876036]
  - hw/smbios: Fix thread count in type4 (Zhao Liu) [Orabug: 35876036]
  - hw/smbios: Fix smbios_smp_sockets caculation (Zhao Liu) [Orabug: 35876036]
  - machine: Add helpers to get cores/threads per socket (Zhao Liu) [Orabug: 35876036]
  - machine: move dies from X86MachineState to CpuTopology (Paolo Bonzini) [Orabug: 35876036]
  - machine: move SMP initialization from vl.c (Paolo Bonzini) [Orabug: 35876036]
  - machine: move UP defaults to class_base_init (Paolo Bonzini) [Orabug: 35876036]
  - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35724113] {CVE-2023-3180}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35724112] {CVE-2023-0330}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-34.el8
changelog:
  - multifd: fix the multifd initialization (Elena Ufimtseva) [Orabug: 36598610]
  - hw/scsi/scsi-generic: Fix io_timeout property not applying (Lorenz Brun) [Orabug: 36604206]
  - scsi: make io_timeout configurable (Hannes Reinecke) [Orabug: 36604206]
  - target/i386/monitor: synchronize cpu state for lapic info (Dongli Zhang) [Orabug: 36607762]


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.2.1-35.el8
changelog:
  - hw/vfio/pci-quirks: Sanitize capability pointer (Alex Williamson) [Orabug: 37096901]
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques (Alex Williamson) [Orabug: 37096901]
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (Philippe Mathieu-Daudé) [Orabug: 36659053] {CVE-2024-3447}


author: Karl Heubaum <karl.heubaum@oracle.com> - 4.1.1-2.el8
changelog:
  - Document CVE-2020-13765 as fixed (Karl Heubaum)  [Orabug: 31463250]  {CVE-2020-13765}
  - kvm: Reallocate dirty_bmap when we change a slot (Dr. David Alan Gilbert)  [Orabug: 31076399]
  - kvm: split too big memory section on several memslots (Igor Mammedov)  [Orabug: 31076399]
  - target/i386: do not set unsupported VMX secondary execution controls (Vitaly Kuznetsov)  [Orabug: 31463710]
  - target/i386: add VMX definitions (Paolo Bonzini)  [Orabug: 31463710]
  - ati-vga: check mm_index before recursive call (CVE-2020-13800) (Prasad J Pandit)  [Orabug: 31452206]  {CVE-2020-13800}
  - es1370: check total frame count against current frame (Prasad J Pandit)  [Orabug: 31463235]  {CVE-2020-13361}
  - ati-vga: Fix checks in ati_2d_blt() to avoid crash (BALATON Zoltan)  [Orabug: 31238432]  {CVE-2020-11869}
  - libslirp: Update to stable-4.2 to fix CVE-2020-1983 (Karl Heubaum)  [Orabug: 31241227]  {CVE-2020-1983}
  - Document CVEs as fixed (Karl Heubaum)   {CVE-2019-12068} {CVE-2019-15034}
  - libslirp: Update to version 4.2.0 to fix CVEs (Karl Heubaum)  [Orabug: 30274592] [Orabug: 30869830]  {CVE-2019-15890} {CVE-2020-8608}
  - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini)  [Orabug: 31124041]
  - qemu-img: Add --target-is-zero to convert (David Edmondson)
  - vnc: fix memory leak when vnc disconnect (Li Qiang)  [Orabug: 30996427]  {CVE-2019-20382}
  - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 31124035]  {CVE-2020-1711}
  - qemu.spec: Remove "BuildRequires: kernel" (Karl Heubaum)  [Orabug: 31124047]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-1.el8
changelog:
  - ACPI ERST: step 6 of bios-tables-test.c (Eric DeVolder)
  - ACPI ERST: bios-tables-test testcase (Eric DeVolder)
  - ACPI ERST: qtest for ERST (Eric DeVolder)
  - ACPI ERST: create ACPI ERST table for pc/x86 machines (Eric DeVolder)
  - ACPI ERST: build the ACPI ERST table (Eric DeVolder)
  - ACPI ERST: support for ACPI ERST feature (Eric DeVolder)
  - ACPI ERST: header file for ERST (Eric DeVolder)
  - ACPI ERST: PCI device_id for ERST (Eric DeVolder)
  - hw/nvme: fix CVE-2021-3929 (Klaus Jensen) [Orabug: 33866395] {CVE-2021-3929}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
  - oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]
  - tests/plugin/syscall.c: fix compiler warnings (Juro Bystricky)
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
  - virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358) (Vivek Goyal) [Orabug: 33816690] {CVE-2022-0358}
  - acpi: validate hotplug selector on access (Michael S. Tsirkin) [Orabug: 33816625] {CVE-2021-4158}
  - Update to QEMU 6.1.1 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-2.el8
changelog:
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella) [Orabug: 33941752] {CVE-2022-26354}
  - qemu_regdump.py/qmp-regdump: Switch to Python 3 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-3.el8
changelog:
  - acpi: pcihp: pcie: set power on cap on parent slot (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: expire pending delete (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: fast unplug when slot power is off (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: add power indicator blink check (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - pci: implement power state (Gerd Hoffmann) [Orabug: 33984018] [Orabug: 33995665]
  - tests: bios-tables-test update expected blobs (Igor Mammedov) [Orabug: 33984018] [Orabug: 33995665]
  - hw/i386/acpi-build: Deny control on PCIe Native Hot-plug in _OSC (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
  - bios-tables-test: Allow changes in DSDT ACPI tables (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]
  - hw/acpi/ich9: Add compat prop to keep HPC bit set for 6.1 machine type (Julia Suvorova) [Orabug: 33984018] [Orabug: 33995665]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-2.el8
changelog:
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella) [Orabug: 33941752] {CVE-2022-26354}
  - qemu_regdump.py/qmp-regdump: Switch to Python 3 (Karl Heubaum)
  - block/mirror: fix NULL pointer dereference in mirror_wait_on_conflicts() (Stefano Garzarella) [Orabug: 33916572] {CVE-2021-4145}


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-4-el8
changelog:
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella) [Orabug: 34591445] {CVE-2021-4207}
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella) [Orabug: 34591281] {CVE-2021-4206}
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella) [Orabug: 34590706] {CVE-2022-0216}
  - tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daude) [Orabug: 34590706] {CVE-2022-0216}
  - virtio-net: fix map leaking on error during receive (Jason Wang) [Orabug: 34538375] {CVE-2022-26353}
  - vfio: defer to commit kvm irq routing when enable msi/msix (Mike Longpeng) [Orabug: 34528963]
  - Revert "vfio: Avoid disabling and enabling vectors repeatedly in VFIO migration" (Mike Longpeng) [Orabug: 34528963]
  - vfio: simplify the failure path in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
  - vfio: move re-enabling INTX out of the common helper (Mike Longpeng) [Orabug: 34528963]
  - vfio: simplify the conditional statements in vfio_msi_enable (Mike Longpeng) [Orabug: 34528963]
  - kvm/msi: do explicit commit when adding msi routes (Mike Longpeng) [Orabug: 34528963]
  - kvm-irqchip: introduce new API to support route change (Mike Longpeng) [Orabug: 34528963]
  - event_notifier: handle initialization failure better (Maxim Levitsky) [Orabug: 34528963]
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu)
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu)
  - vhost-vdpa: backend feature should set only once (Si-Wei Liu)
  - vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu)
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu)
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu)
  - virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu)
  - virtio: fix the condition for iommu_platform not supported (Halil Pasic)
  - vdpa: Make ncs autofree (Eugenio Perez)
  - vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier)
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier)
  - vhost-vdpa: stick to -errno error return convention (Roman Kagan)
  - vdpa: Add dummy receive callback (Eugenio Perez)
  - vdpa: Check for existence of opts.vhostdev (Eugenio Perez)
  - vdpa: Replace qemu_open_old by qemu_open at (Eugenio Perez)
  - vhost: Fix last vq queue index of devices with no cvq (Eugenio Perez)
  - vhost: Rename last_index to vq_index_end (Eugenio Perez)
  - net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella)
  - vhost-vdpa: Set discarding of RAM broken when initializing the backend (David Hildenbrand)
  - vhost-vdpa: multiqueue support (Jason Wang)
  - virtio-net: vhost control virtqueue support (Jason Wang)
  - vhost: record the last virtqueue index for the virtio device (Jason Wang)
  - virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang)
  - vhost-net: control virtqueue support (Jason Wang)
  - net: introduce control client (Jason Wang)
  - vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang)
  - vhost-vdpa: prepare for the multiqueue support (Jason Wang)
  - vhost-vdpa: classify one time request (Jason Wang)
  - vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang)
  - vdpa: Check for iova range at mappings changes (Eugenio Perez)
  - vdpa: Add vhost_vdpa_section_end (Eugenio Perez)
  - net/vhost-vdpa: Fix device compatibility check (Kevin Wolf)
  - net/vhost-user: Fix device compatibility check (Kevin Wolf)
  - net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf)
  - memory: Name all the memory listeners (Peter Xu)
  - vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang)
  - vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang)
  - vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang)
  - vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang)
  - vhost_net: do not assume nvqs is always 2 (Jason Wang)
  - vhost: use unsigned int for nvqs (Jason Wang)
  - vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang)
  - vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang)
  - vhost-vdpa: remove unused variable "acked_features" (Jason Wang)
  - vhost: correctly detect the enabling IOMMU (Jason Wang)
  - virtio-pci: implement iommu_enabled() (Jason Wang)
  - virtio-bus: introduce iommu_enabled() (Jason Wang)
  - hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu)
  - vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Perez)
  - target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero) [Orabug: 33528615]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-5-el8
changelog:
  - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35064352] {CVE-2022-1050}
  - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daudé) [Orabug: 35060182] {CVE-2022-4144}
  - hw/display/qxl: Pass requested buffer size to qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Document qxl_phys2virt() (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler (Philippe Mathieu-Daudé) [Orabug: 35060182]
  - ui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext (Mauro Matteo Cascella) [Orabug: 35060115] {CVE-2022-3165}
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)
  - vl: Add an -action option to override MCE handling (Mark Kanda) [Orabug: 34779160]
  - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt) [Orabug: 34779541] {CVE-2022-4172}
  - target/i386: kvm: do not access uninitialized variable on older kernels (Paolo Bonzini) [Orabug: 34492975]
  - x86: Support XFD and AMX xsave data migration (Zeng Guang) [Orabug: 34492975]
  - x86: add support for KVM_CAP_XSAVE2 and AMX state migration (Jing Liu) [Orabug: 34492975]
  - x86: Add AMX CPUIDs enumeration (Jing Liu) [Orabug: 34492975]
  - x86: Add XFD faulting bit for state components (Jing Liu) [Orabug: 34492975]
  - x86: Grant AMX permission for guest (Yang Zhong) [Orabug: 34492975]
  - x86: Add AMX XTILECFG and XTILEDATA components (Jing Liu) [Orabug: 34492975]
  - x86: Fix the 64-byte boundary enumeration for extended state (Jing Liu) [Orabug: 34492975]
  - linux-headers: include missing changes from 5.17 (Paolo Bonzini) [Orabug: 34492975]
  - linux-headers: Update headers to v5.17-rc1 (Vivek Goyal) [Orabug: 34492975]
  - linux-headers: update to 5.16-rc1 (Paolo Bonzini) [Orabug: 34492975]
  - i386/pc: restrict AMD only enforcing of 1Tb hole to new machine type (Joao Martins)
  - i386/pc: relocate 4g start to 1T where applicable (Joao Martins)
  - i386/pc: bounds check phys-bits against max used GPA (Joao Martins)
  - i386/pc: factor out device_memory base/size to helper (Joao Martins)
  - i386/pc: factor out above-4g end to an helper (Joao Martins)
  - i386/pc: pass pci_hole64_size to pc_memory_init() (Joao Martins)
  - i386/pc: create pci-host qdev prior to pc_memory_init() (Joao Martins)
  - hw/i386: add 4g boundary start to X86MachineState (Joao Martins)
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset (Si-Wei Liu)
  - net/vhost-vdpa.c: Fix clang compilation failure (Peter Maydell)
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa (Si-Wei Liu)


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-6-el8
changelog:
  - CVE-2023-1544 is not applicable to Oracle QEMU 6.1.1 (Karl Heubaum) [Orabug: 35305727] {CVE-2023-1544}
  - virtio-gpu: do not byteswap padding (Paolo Bonzini) [Orabug: 35304723]
  - KVM: x86: workaround invalid CPUID[0xD,9] info on some AMD processors (Paolo Bonzini) [Orabug: 35241527]
  - qemu-kvm.spec: fix Linux io_uring support (Mark Kanda) [Orabug: 35265200]
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse) [Orabug: 35219290]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-7.el8
changelog:
  - CVE-2023-4135 is not applicable to Oracle QEMU 6.1.1 (Karl Heubaum) [Orabug: 35752193] {CVE-2023-4135}
  - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35752194] {CVE-2023-3180}
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug: 35752186] {CVE-2023-3255}
  - io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrangé) [Orabug: 35752182] {CVE-2023-3354}
  - 9pfs: prevent opening special files (CVE-2023-2861) (Christian Schoenebeck) [Orabug: 35752178] {CVE-2023-2861}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35752171] {CVE-2023-0330}
  - hw: Add compat machines for 6.2 (Yanan Wang) [Orabug: 35646490]
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35662843] {CVE-2023-3301}
  - dump: fix kdump to work over non-aligned blocks (Marc-André Lureau) [Orabug: 35557771]
  - dump: simplify a bit kdump get_next_page() (Marc-André Lureau) [Orabug: 35557771]
  - dump: Remove is_zero_page() (Juan Quintela) [Orabug: 35557771]
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda) [Orabug: 34510460]
  - i386: do kvm_put_msr_feature_control() first thing when vCPU is reset (Vitaly Kuznetsov) [Orabug: 34319512]
  - i386: reset KVM nested state upon CPU reset (Vitaly Kuznetsov) [Orabug: 34319512]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-8.el8
changelog:
  - kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35822587]
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35822587]
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35822587]
  - dump: kdump-zlib data pages not dumped with pvtime/aarch64 (Dongli Zhang) [Orabug: 35775461]
  - target/i386: properly reset TSC on reset (Paolo Bonzini) [Orabug: 35767315]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-9.el8
changelog:
  - Document CVEs (Mark Kanda) {CVE-2023-4135} {CVE-2023-40360} {CVE-2024-26328} {CVE-2023-42467} {CVE-2024-26327} {CVE-2024-3567}
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (Philippe Mathieu-Daudé) [Orabug: 36858718] {CVE-2024-3447}
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36878301] {CVE-2024-3446}
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36878301] {CVE-2024-3446}
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36878301] {CVE-2024-3446}
  - hw/virtio: Introduce virtio_bh_new_guarded() helper (Philippe Mathieu-Daudé) [Orabug: 36878301] {CVE-2024-3446}
  - ui/clipboard: add asserts for update and request (Fiona Ebner) [Orabug: 36858698] {CVE-2023-6683}
  - ui/clipboard: mark type as not available when there is no data (Fiona Ebner) [Orabug: 36858698] {CVE-2023-6683}
  - virtio-net: correctly copy vnet header when flushing TX (Jason Wang) [Orabug: 36858734] {CVE-2023-6693}
  - esp: restrict non-DMA transfer length to that of available data (Mark Cave-Ayland) [Orabug: 36858704] {CVE-2024-24474}
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug: 36858692] {CVE-2023-5088}
  - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 36858692] {CVE-2023-5088}
  - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 36858836] {CVE-2023-3019}
  - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 36858836] {CVE-2023-3019}
  - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 36858811] {CVE-2021-3750}
  - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 36858811] {CVE-2021-3750}
  - qga/win32: Use rundll for VSS installation (Konstantin Kostiuk) [Orabug: 36858681] {CVE-2023-0664}
  - qga/win32: Remove change action from MSI installer (Konstantin Kostiuk) [Orabug: 36858681] {CVE-2023-0664}
  - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daudé) [Orabug: 36858674] {CVE-2021-3638}
  - async: clarify usage of barriers in the polling case (Paolo Bonzini) [Orabug: 35871051]
  - async: update documentation of the memory barriers (Paolo Bonzini) [Orabug: 35871051]
  - physmem: add missing memory barrier (Paolo Bonzini) [Orabug: 35871051]
  - qemu-coroutine-lock: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871051]
  - aio-wait: switch to smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871051]
  - edu: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871051]
  - qemu-thread-win32: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871051]
  - qemu-thread-posix: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871051]
  - qatomic: add smp_mb__before/after_rmw() (Paolo Bonzini) [Orabug: 35871051]
  - aio_wait_kick: add missing memory barrier (Emanuele Giuseppe Esposito) [Orabug: 35871051]


author: Karl Heubaum <karl.heubaum@oracle.com> - 6.1.1-1.el8
changelog:
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
  - virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358) (Vivek Goyal) [Orabug: 33816690] {CVE-2022-0358}
  - acpi: validate hotplug selector on access (Michael S. Tsirkin) [Orabug: 33816625] {CVE-2021-4158}
  - Update to QEMU 6.1.1 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-1-el8
changelog:
  - vl: Add an -action option to override MCE handling (Mark Kanda)
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)
  - migration: increase listening socket backlog (Elena Ufimtseva)
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)
  - Update to QEMU 7.2.0 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-3.el8
changelog:
  - vfio/migration: Skip log_sync during migration SETUP state (Avihai Horon)
  - migration: fix ram_state_pending_exact() (Juan Quintela)
  - spec: allow have_tools 0 (Steve Sistare)
  - spec: allow no block device modules (Steve Sistare)
  - qemu-kvm.spec: fix Linux io_uring support (Mark Kanda)
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse)
  - oslib-posix: fix uninitialized var in wait_mem_prealloc() (Mark Kanda)
  - vfio/migration: Rename entry points (Alex Williamson)
  - docs/devel: Document VFIO device dirty page tracking (Avihai Horon)
  - vfio/migration: Query device dirty page tracking support (Joao Martins)
  - vfio/migration: Block migration with vIOMMU (Joao Martins)
  - vfio/common: Add device dirty page bitmap sync (Joao Martins)
  - vfio/common: Extract code from vfio_get_dirty_bitmap() to new function (Avihai Horon)
  - vfio/common: Add device dirty page tracking start/stop (Joao Martins)
  - vfio/common: Record DMA mapped IOVA ranges (Joao Martins)
  - vfio/common: Add helper to consolidate iova/end calculation (Joao Martins)
  - vfio/common: Consolidate skip/invalid section into helper (Joao Martins)
  - vfio/common: Use a single tracepoint for skipped sections (Joao Martins)
  - vfio/common: Add helper to validate iova/end against hostwin (Joao Martins)
  - vfio/common: Add VFIOBitmap and alloc function (Avihai Horon)
  - vfio/common: Abort migration if dirty log start/stop/sync fails (Avihai Horon)
  - vfio/common: Fix wrong %m usages (Avihai Horon)
  - vfio/common: Fix error reporting in vfio_get_dirty_bitmap() (Avihai Horon)
  - docs/devel: Align VFIO migration docs to v2 protocol (Avihai Horon)
  - vfio: Alphabetize migration section of VFIO trace-events file (Avihai Horon)
  - vfio/migration: Remove VFIO migration protocol v1 (Avihai Horon)
  - vfio/migration: Implement VFIO migration protocol v2 (Avihai Horon)
  - vfio/migration: Rename functions/structs related to v1 protocol (Avihai Horon)
  - vfio/migration: Move migration v1 logic to vfio_migration_init() (Avihai Horon)
  - vfio/migration: Block multiple devices migration (Avihai Horon)
  - vfio/common: Change vfio_devices_all_running_and_saving() logic to equivalent one (Avihai Horon)
  - vfio/migration: Allow migration without VFIO IOMMU dirty tracking support (Avihai Horon)
  - vfio/migration: Fix NULL pointer dereference bug  (Avihai Horon)
  - linux-headers: Update to v6.2-rc8 (Avihai Horon)
  - migration/qemu-file: Add qemu_file_get_to_fd() (Avihai Horon)
  - migration: Rename res_{postcopy,precopy}_only (Juan Quintela)
  - migration: Remove unused res_compatible (Juan Quintela)
  - migration: In case of postcopy, the memory ends in res_postcopy_only (Juan Quintela)
  - migration: I messed state_pending_exact/estimate (Juan Quintela)
  - linux-headers: Update to v6.1 (Peter Xu)
  - migration: simplify migration_iteration_run() (Juan Quintela)
  - migration: Remove unused threshold_size parameter (Juan Quintela)
  - migration: Split save_live_pending() into state_pending_* (Juan Quintela)
  - migration: No save_live_pending() method uses the QEMUFile parameter (Juan Quintela)
  - Revert "virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events" (Karl Heubaum) [Orabug: 35161059]
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda) [Orabug: 32555402]
  - oslib-posix: refactor memory prealloc threads (Mark Kanda) [Orabug: 32555402]
  - qemu-kvm.spec: vhost-user is conditional (Steve Sistare)
  - qemu-kvm.spec: libseccomp is conditional (Steve Sistare)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-4.el8
changelog:
  - vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
  - vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
  - sysemu: Add pre VM state change callback (Avihai Horon)
  - vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
  - vfio/common: Add an option to relax vIOMMU usage (Joao Martins)
  - virtio-rng-pci: fix transitional migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
  - virtio-rng-pci: fix migration compat for vectors (David Alan Gilbert) [Orabug: 35595177]
  - vfio: Fix null pointer dereference bug in vfio_bars_finalize() (Avihai Horon)
  - vfio/migration: Return bool type for vfio_migration_realize() (Zhenzhong Duan)
  - vfio/migration: Remove print of "Migration disabled" (Zhenzhong Duan)
  - vfio/migration: Free resources when vfio_migration_realize fails (Zhenzhong Duan)
  - vfio/migration: Change vIOMMU blocker from global to per device (Zhenzhong Duan)
  - vfio/pci: Disable INTx in vfio_realize error path (Zhenzhong Duan)
  - vfio/pci: Free leaked timer in vfio_realize error path (Zhenzhong Duan)
  - vfio/pci: Fix a segfault in vfio_realize (Zhenzhong Duan)
  - vfio/migration: Make VFIO migration non-experimental (Avihai Horon)
  - vfio/migration: Reset bytes_transferred properly (Avihai Horon)
  - vfio/pci: Call vfio_prepare_kvm_msi_virq_batch() in MSI retry path (Shameer Kolothum)
  - vfio/migration: Add support for switchover ack capability (Avihai Horon)
  - vfio/migration: Add VFIO migration pre-copy support (Avihai Horon)
  - vfio/migration: Store VFIO migration flags in VFIOMigration (Avihai Horon)
  - vfio/migration: Refactor vfio_save_block() to return saved data size (Avihai Horon)
  - tests: Add migration switchover ack capability test (Avihai Horon)
  - migration: Enable switchover ack capability (Avihai Horon)
  - migration: Implement switchover ack logic (Avihai Horon)
  - migration: Add switchover ack capability (Avihai Horon)
  - target/i386: Add EPYC-Genoa model to support Zen 4 processor series (Babu Moger) [Orabug: 35555649]
  - target/i386: Add VNMI and automatic IBRS feature bits (Babu Moger) [Orabug: 35555649]
  - target/i386: Add missing feature bits in EPYC-Milan model (Babu Moger) [Orabug: 35555649]
  - target/i386: Add feature bits for CPUID_Fn80000021_EAX (Babu Moger) [Orabug: 35555649]
  - target/i386: Add a couple of feature bits in 8000_0008_EBX (Babu Moger) [Orabug: 35555649]
  - target/i386: Add new EPYC CPU versions with updated cache_info (Michael Roth) [Orabug: 35555649]
  - target/i386: allow versioned CPUs to specify new cache_info (Michael Roth) [Orabug: 35555649]
  - target/i386/kvm: get and put AMD pmu registers (Dongli Zhang) [Orabug: 35562155]
  - Makefile: qemu-bundle is a directory (Juan Quintela)
  - 9pfs: prevent opening special files (CVE-2023-2861) (Christian Schoenebeck) [Orabug: 35570017] {CVE-2023-2861}
  - pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li) [Orabug: 33642532]
  - pcie: Do not set power state for some hot-plugged devices (Annie Li) [Orabug: 33642532]
  - pc: q35: Bump max_cpus to 1024 (Suravee Suthikulpanit) [Orabug: 35425619]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-5.el8
changelog:
  - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35683774] {CVE-2023-3180}
  - io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrangé) [Orabug: 35683826] {CVE-2023-3354}
  - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug: 35683770] {CVE-2023-3255}
  - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug: 35683817] {CVE-2023-0330}
  - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug: 35649138] {CVE-2023-3301}
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-6.el8
changelog:
  - hw/smbios: Fix core count in type4 (Zhao Liu) [Orabug: 35869694]
  - hw/smbios: Fix thread count in type4 (Zhao Liu) [Orabug: 35869694]
  - hw/smbios: Fix smbios_smp_sockets caculation (Zhao Liu) [Orabug: 35869694]
  - machine: Add helpers to get cores/threads per socket (Zhao Liu) [Orabug: 35869694]
  - migration/multifd: Move load_cleanup inside incoming_state_destroy (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Join all multifd threads in order to avoid leaks (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Remove unnecessary assignment on multifd_load_cleanup() (Leonardo Bras) [Orabug: 35829153]
  - migration/multifd: Change multifd_load_cleanup() signature and usage (Leonardo Bras) [Orabug: 35829153]
  - vfio/migration: Block VFIO migration with background snapshot (Avihai Horon)
  - vfio/migration: Block VFIO migration with postcopy migration (Avihai Horon)
  - migration: Add .save_prepare() handler to struct SaveVMHandlers (Avihai Horon)
  - migration: Move more initializations to migrate_init() (Avihai Horon)
  - vfio/migration: Fail adding device with enable-migration=on and existing blocker (Avihai Horon)
  - migration: Add migration prefix to functions in target.c (Avihai Horon)
  - vfio/migration: Allow migration of multiple P2P supporting devices (Avihai Horon)
  - vfio/migration: Add P2P support for VFIO migration (Avihai Horon)
  - vfio/migration: Refactor PRE_COPY and RUNNING state checks (Joao Martins)
  - qdev: Add qdev_add_vm_change_state_handler_full() (Avihai Horon)
  - sysemu: Add prepare callback to struct VMChangeStateEntry (Avihai Horon)
  - vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup() (Avihai Horon)
  - hw/vfio: Add number of dirty pages to vfio_get_dirty_bitmap tracepoint (Joao Martins)
  - exec/ram_addr: Return number of dirty pages in cpu_physical_memory_set_dirty_lebitmap() (Joao Martins)
  - migration: fix populate_vfio_info (Steve Sistare)
  - vfio/migration: Revert out of tree P2P support (Joao Martins)
  - async: clarify usage of barriers in the polling case (Paolo Bonzini) [Orabug: 35871058]
  - async: update documentation of the memory barriers (Paolo Bonzini) [Orabug: 35871058]
  - physmem: add missing memory barrier (Paolo Bonzini) [Orabug: 35871058]
  - qemu-coroutine-lock: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - aio-wait: switch to smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - edu: add smp_mb__after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - qemu-thread-win32: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
  - qemu-thread-posix: cleanup, fix, document QemuEvent (Paolo Bonzini) [Orabug: 35871058]
  - qatomic: add smp_mb__before/after_rmw() (Paolo Bonzini) [Orabug: 35871058]
  - dump: kdump-zlib data pages not dumped with pvtime/aarch64 (Dongli Zhang) [Orabug: 35777876]
  - hw/smbios: fix field corruption in type 4 table (Julia Suvorova) [Orabug: 35756216]
  - kvm: Atomic memslot updates (David Hildenbrand) [Orabug: 35728782]
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito) [Orabug: 35728782]
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito) [Orabug: 35728782]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-7.el8
changelog:
  - vfio/common: Probe type1 iommu dirty tracking support (Joao Martins) [Orabug: 36024839]
  - vfio/common: Allow disabling device dirty page tracking (Joao Martins) [Orabug: 36024839]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-11.el8
changelog:
  - vfio/migration: Add a note about migration rate limiting (Avihai Horon) [Orabug: 36329758]
  - vfio/migration: Refactor vfio_save_state() return value (Avihai Horon) [Orabug: 36329758]
  - migration: Don't serialize devices in qemu_savevm_state_iterate() (Avihai Horon) [Orabug: 36329758]
  - ui/clipboard: add asserts for update and request (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
  - ui/clipboard: mark type as not available when there is no data (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
  - virtio-net: correctly copy vnet header when flushing TX (Jason Wang) [Orabug: 36154459] {CVE-2023-6693}
  - esp: restrict non-DMA transfer length to that of available data (Mark Cave-Ayland) [Orabug: 36322141] {CVE-2024-24474}
  - vhost: Perform memory section dirty scans once per iteration (Si-Wei Liu)
  - vhost: dirty log should be per backend type (Si-Wei Liu)
  - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
  - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
  - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 33774027] {CVE-2021-3750}
  - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
  - hw/acpi: propagate vcpu hotplug after switch to modern interface (Aaron Young)
  - migration: Fix use-after-free of migration state object (Fabiano Rosas) [Orabug: 36242218]
  - kvm: Fix crash due to access uninitialized kvm_state (Gavin Shan) [Orabug: 36269244]
  - migration: Avoid usage of static variable inside tracepoint (Joao Martins)
  - migration: Add tracepoints for downtime checkpoints (Peter Xu)
  - migration: migration_stop_vm() helper (Peter Xu)
  - migration: Add per vmstate downtime tracepoints (Peter Xu)
  - migration: Add migration_downtime_start|end() helpers (Peter Xu)
  - migration: Set downtime_start even for postcopy (Peter Xu)
  - hv-balloon: implement pre-Glib 2.68 compatibility (Maciej S. Szmigiero)
  - hw/i386/pc: Support hv-balloon (Maciej S. Szmigiero)
  - qapi: Add HV_BALLOON_STATUS_REPORT event and its QMP query command (Maciej S. Szmigiero)
  - qapi: Add query-memory-devices support to hv-balloon (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) hot-add support (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol driver (hv-balloon) base (Maciej S. Szmigiero)
  - Add Hyper-V Dynamic Memory Protocol definitions (Maciej S. Szmigiero)
  - memory-device: Drop size alignment check (David Hildenbrand)
  - memory-device: Support empty memory devices (David Hildenbrand)
  - memory,vhost: Allow for marking memory device memory regions unmergeable (David Hildenbrand)
  - memory: Clarify mapping requirements for RamDiscardManager (David Hildenbrand)
  - memory-device,vhost: Support automatic decision on the number of memslots (David Hildenbrand)
  - vhost: Add vhost_get_max_memslots() (David Hildenbrand)
  - kvm: Add stub for kvm_get_max_memslots() (David Hildenbrand)
  - memory-device,vhost: Support memory devices that dynamically consume memslots (David Hildenbrand)
  - memory-device: Track required and actually used memslots in DeviceMemoryState (David Hildenbrand)
  - stubs: Rename qmp_memory_device.c to memory_device.c (David Hildenbrand)
  - memory-device: Support memory devices with multiple memslots (David Hildenbrand)
  - vhost: Return number of free memslots (David Hildenbrand)
  - kvm: Return number of free memslots (David Hildenbrand)
  - vhost: Remove vhost_backend_can_merge() callback (David Hildenbrand)
  - vhost: Rework memslot filtering and fix "used_memslot" tracking (David Hildenbrand)
  - virtio-md-pci: New parent type for virtio-mem-pci and virtio-pmem-pci (David Hildenbrand)
  - migration/ram: Expose ramblock_is_ignored() as migrate_ram_is_ignored() (David Hildenbrand)
  - virtio-mem: Skip most of virtio_mem_unplug_all() without plugged memory (David Hildenbrand)
  - softmmu/physmem: Warn with ram_block_discard_range() on MAP_PRIVATE file mapping (David Hildenbrand)
  - memory-device: Track used region size in DeviceMemoryState (David Hildenbrand)
  - memory-device: Refactor memory_device_pre_plug() (David Hildenbrand)
  - hw/i386/pc: Remove PC_MACHINE_DEVMEM_REGION_SIZE (David Hildenbrand)
  - hw/i386/acpi-build: Rely on machine->device_memory when building SRAT (David Hildenbrand)
  - hw/i386/pc: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/loongarch/virt: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/ppc/spapr: Use machine_memory_devices_init() (David Hildenbrand)
  - hw/arm/virt: Use machine_memory_devices_init() (David Hildenbrand)
  - memory-device: Introduce machine_memory_devices_init() (David Hildenbrand)
  - memory-device: Unify enabled vs. supported error messages (David Hildenbrand)
  - hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] (Thomas Huth) [Orabug: 35808564] {CVE-2023-42467}
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}
  - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 35977245] {CVE-2023-5088}


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-13.el8
changelog:
  - vfio/migration: Enhance VFIO migration state tracing (Avihai Horon)
  - vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon)
  - vfio/migration: Emit VFIO migration QAPI event (Avihai Horon)
  - qapi/vfio: Add VFIO migration QAPI event (Avihai Horon)
  - migration/multifd: solve zero page causing multiple page faults (Yuan Liu) [Orabug: 36727051]
  - multifd: Add the ramblock to MultiFDRecvParams (Lukas Straub) [Orabug: 36727051]
  - migration: Fix qmp_query_migrate mbps value (Fabiano Rosas) [Orabug: 36727104]
  - migration: Allow user to specify available switchover bandwidth (Peter Xu) [Orabug: 35636284]
  - migration/dirtyrate: Fix precision losses and g_usleep overshoot (Andrei Gudkov) [Orabug: 36727091]
  - Use new created qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
  - softmmu: Create qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
  - migration/calc-dirty-rate: replaced CRC32 with xxHash (Andrei Gudkov) [Orabug: 36727063]
  - migration/multifd: Enable multifd zero page checking by default. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Implement zero page transmission on the multifd thread. (Hao Xiang) [Orabug: 34131170]
  - migration/multifd: Add new migration option zero-page-detection. (Hao Xiang) [Orabug: 34131170]
  - migration: Make ram_save_target_page() a pointer (Juan Quintela) [Orabug: 34131170]
  - migration: Yield bitmap_mutex properly when sending/sleeping (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Add a synchronization point for channel creation (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Unify multifd and TLS connection paths (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Move multifd_send_setup into migration thread (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Move multifd_send_setup error handling in to the function (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Remove p->running (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Optimize sender side to be lockless (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Join the TLS thread (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Fix MultiFDSendParams.packet_num race (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Stick with send/recv on function names (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Cleanup multifd_load_cleanup() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Cleanup multifd_save_cleanup() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Rewrite multifd_queue_page() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Change retval of multifd_send_pages() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Change retval of multifd_queue_page() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Split multifd_send_terminate_threads() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Forbid spurious wakeups (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move header prepare/fill into send_prepare() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: multifd_send_prepare_header() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move trace_multifd_send|recv() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Move total_normal_pages accounting (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Rename p->num_packets and clean it up (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Drop pages->num check in sender thread (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Simplify locking in sender thread (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Separate SYNC request with normal jobs (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Drop MultiFDSendParams.normal[] array (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Postpone reset of MultiFDPages_t (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Remove MultiFDPages_t::packet_num (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths (Peter Xu) [Orabug: 34131170]
  - migration/multifd: multifd_send_kick_main() (Peter Xu) [Orabug: 34131170]
  - migration/multifd: Fix leaking of Error in TLS error flow (Avihai Horon) [Orabug: 34131170]
  - migration/ram: Merge save_zero_page functions (Fabiano Rosas) [Orabug: 34131170]
  - migration/ram: Move xbzrle zero page handling into save_zero_page (Fabiano Rosas) [Orabug: 34131170]
  - migration/multifd: Stop setting p->ioc before connecting (Fabiano Rosas) [Orabug: 34131170]
  - migration: Centralize BH creation and dispatch (Fabiano Rosas) [Orabug: 34131170]
  - migration: Add a wrapper to qemu_bh_schedule (Fabiano Rosas) [Orabug: 34131170]
  - migration: Remove transferred atomic counter (Juan Quintela) [Orabug: 35636284]
  - migration: Use migration_transferred_bytes() (Juan Quintela) [Orabug: 35636284]
  - migration: migration_rate_limit_reset() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
  - migration: migration_transferred_bytes() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
  - multifd: reset next_packet_len after sending pages (Elena Ufimtseva) [Orabug: 35636284]
  - multifd: fix counters in multifd_send_thread (Elena Ufimtseva) [Orabug: 35636284]
  - migration/multifd: Compute transferred bytes correctly (Juan Quintela) [Orabug: 35636284]
  - migration: check for rate_limit_max for RATE_LIMIT_DISABLED (Elena Ufimtseva) [Orabug: 35636284]
  - migration: Use the number of transferred bytes directly (Juan Quintela) [Orabug: 35636284]
  - qemu_file: Use a stat64 for qemu_file_transferred (Juan Quintela) [Orabug: 35636284]
  - migration: set file error on subsection loading (Marc-André Lureau) [Orabug: 35636284]
  - migration: Receiving a zero page non zero is an error (Juan Quintela) [Orabug: 35636284]
  - migration/multifd: Stop checking p->quit in multifd_send_thread (Fabiano Rosas) [Orabug: 35636284]
  - migration/multifd: Clarify Error usage in multifd_channel_connect (Fabiano Rosas) [Orabug: 35636284]
  - multifd: cleanup the function multifd_channel_connect (Li Zhang) [Orabug: 35636284]
  - migration/multifd: Unify multifd_send_thread error paths (Fabiano Rosas) [Orabug: 35636284]
  - migration: Non multifd migration don't care about multifd flushes (Juan Quintela) [Orabug: 35636284]
  - migration: fix RAMBlock add NULL check (Dmitry Frolov) [Orabug: 35829153]
  - migration: We don't need the field rate_limit_used anymore (Juan Quintela) [Orabug: 35636284]
  - migration: Use migration_transferred_bytes() to calculate rate_limit (Juan Quintela) [Orabug: 35636284]
  - migration: Add a trace for migration_transferred_bytes (Juan Quintela) [Orabug: 35636284]
  - migration: Move migration_total_bytes() to migration-stats.c (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Remove total from qemu_file_total_transferred_*() (Juan Quintela) [Orabug: 35636284]
  - migration: Move rate_limit_max and rate_limit_used to migration_stats (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Account for rate_limit usage on qemu_fflush() (Juan Quintela) [Orabug: 35636284]
  - migration: Don't use INT64_MAX for unlimited rate (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make rate_limit_used an uint64_t (Juan Quintela) [Orabug: 35636284]
  - qemu-file: make qemu_file_[sg]et_rate_limit() use an uint64_t (Juan Quintela) [Orabug: 35636284]
  - migration: We set the rate_limit by a second (Juan Quintela) [Orabug: 35829153]
  - migration: A rate limit value of 0 is valid (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make ram_control_save_page() use accessors for rate_limit (Juan Quintela) [Orabug: 35636284]
  - qemu-file: Make total_transferred an uint64_t (Juan Quintela) [Orabug: 35636284]
  - qemu-file: No need to check for shutdown in qemu_file_rate_limit (Juan Quintela) [Orabug: 35636284]
  - migration: Document all migration_stats (Juan Quintela) [Orabug: 35636284]
  - multifd: We already account for this packet on the multifd thread (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_bytes_last_sync atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_pages_rate atomic (Juan Quintela) [Orabug: 35636284]
  - stat64: Add stat64_set() operation (Paolo Bonzini) [Orabug: 35636284]
  - multifd: Only flush once each full round of memory (Juan Quintela) [Orabug: 35636284]
  - migration: Make find_dirty_block() return a single parameter (Juan Quintela) [Orabug: 35636284]
  - migration: Simplify ram_find_and_save_block() (Juan Quintela) [Orabug: 35636284]
  - multifd: Protect multifd_send_sync_main() calls (Juan Quintela) [Orabug: 35636284]
  - multifd: Create property multifd-flush-after-each-section (Juan Quintela) [Orabug: 35636284]
  - multifd: Fix the number of channels ready (Juan Quintela) [Orabug: 35636284]
  - migration: Rename normal to normal_pages (Juan Quintela) [Orabug: 35636284]
  - migration: Rename duplicate to zero_pages (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_sync_count atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make downtime_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make precopy_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make dirty_sync_missed_zero_copy atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Make multifd_bytes atomic (Juan Quintela) [Orabug: 35636284]
  - migration: Update atomic stats out of the mutex (Juan Quintela) [Orabug: 35636284]
  - migration: Merge ram_counters and ram_atomic_counters (Juan Quintela) [Orabug: 35636284]
  - migration/multifd: correct multifd_send_thread to trace the flags (Wei Wang) [Orabug: 35636284]
  - ram: Document migration ram flags (Juan Quintela) [Orabug: 35636284]
  - migration: Calculate ram size once (Juan Quintela) [Orabug: 35636284]
  - multifd: Fix a race on reading MultiFDPages_t.block (Zhenzhong Duan) [Orabug: 35636284]
  - migration: Use atomic ops properly for page accountings (Peter Xu) [Orabug: 35636284]
  - migration: Export ram_release_page() (Juan Quintela) [Orabug: 35636284]
  - migration: Export ram_transferred_ram() (Juan Quintela) [Orabug: 35636284]
  - multifd: Create page_count fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
  - multifd: Create page_size fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
  - migration: Fix migration_channel_read_peek() error path () (Avihai Horon) [Orabug: 36726827]
  - migration/multifd: Remove error_setg() in migration_ioc_process_incoming() (Avihai Horon) [Orabug: 36726827]
  - migration: Refactor migration_incoming_setup() (Avihai Horon) [Orabug: 36726827]
  - migration: check magic value for deciding the mapping of channels (manish.mishra) [Orabug: 36726827]
  - io: Add support for MSG_PEEK for socket channel (manish.mishra) [Orabug: 36726827]
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (hilippe Mathieu-Daudé) [Orabug: 36575206] {CVE-2024-3447}
  - block: lock AioContext in bdrv_replace_child_noperm() when in non-coroutine context (Mark Kanda) [Orabug: 36514180]
  - hw/scsi/scsi-generic: Fix io_timeout property not applying (Lorenz Brun) [Orabug: 36637684]
  - target/i386/monitor: synchronize cpu state for lapic info (Dongli Zhang) [Orabug: 36607747]
  - qemu_init: increase NOFILE soft limit on POSIX (Fiona Ebner) [Orabug: 36416389]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-15.el8
changelog:
  - migration: abort on destination if switchover limit exceeded (Elena Ufimtseva)
  - migration: introduce strict switchover SLA (Elena Ufimtseva)
  - migration: add error to MigrationIncomingState (Elena Ufimtseva)
  - migration: Set migration status early in incoming side (Fabiano Rosas)
  - tests/qtest: migration: Use migrate_incoming_qmp where appropriate (Fabiano Rosas)
  - tests/qtest: migration: Add migrate_incoming_qmp helper (Fabiano Rosas)
  - tests/qtest: migration: Expose migrate_set_capability (Fabiano Rosas)
  - vfio/migration: Multifd device state transfer support - send side (Maciej S. Szmigiero)
  - vfio/migration: Add x-orcl-migration-multifd-transfer VFIO property (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - receive side (Maciej S. Szmigiero)
  - migration/multifd: Add migration_has_device_state_support() (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - send side (Maciej S. Szmigiero)
  - migration/multifd: Convert multifd_send_pages::next_channel to atomic (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - receive side (Maciej S. Szmigiero)
  - migration: Add load_finish handler and associated functions (Maciej S. Szmigiero)
  - migration: Add qemu_loadvm_load_state_buffer() and its handler (Maciej S. Szmigiero)
  - migration: Add save_live_complete_precopy_{begin,end} handlers (Maciej S. Szmigiero)
  - migration/multifd: Zero p->flags before starting filling a packet (Maciej S. Szmigiero)
  - migration/ram: Add load start trace event (Maciej S. Szmigiero)
  - vfio/migration: Add save_{iterate,complete_precopy}_started trace events (Maciej S. Szmigiero)
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - hw/virtio: Introduce virtio_bh_new_guarded() helper (Philippe Mathieu-Daudé) [Orabug: 36869694] {CVE-2024-3446}
  - pcie_sriov: Validate NumVFs (Akihiko Odaki) [Orabug: 36314082] {CVE-2024-26327}
  - hw/nvme: Use pcie_sriov_num_vfs() (Akihiko Odaki) [Orabug: 36314111] {CVE-2024-26328}
  - pcie: Introduce pcie_sriov_num_vfs (Akihiko Odaki) [Orabug: 36314111] {CVE-2024-26328}
  - qcow2: Don't open data_file with BDRV_O_NO_IO (Kevin Wolf) [Orabug: 36801853] {CVE-2024-4467}
  - target/i386: drop AMD machine check bits from Intel CPUID (Paolo Bonzini) [Orabug: 36785079]
  - target/i386: pass X86CPU to x86_cpu_get_supported_feature_word (Paolo Bonzini) [Orabug: 36785079]
  - migration: prevent migration when VM has poisoned memory (William Roche) [Orabug: 35533097]
  - i386: Add support for overflow recovery (John Allen) [Orabug: 34691766]
  - i386: Add support for SUCCOR feature (John Allen) [Orabug: 34691766]
  - i386: Fix MCE support for AMD hosts (John Allen) [Orabug: 34691766]


author: Karl.Heubaum <karl.heubaum@oracle.com> - 7.2.0-16.el8
changelog:
  - block: fix failing assert on paused VM migration (Andrey Drobyshev) [Orabug: 37106834]
  - migration/multifd: Fix rb->receivedmap cleanup race (Fabiano Rosas) [Orabug: 36932320]
  - migration/savevm: Remove extra load cleanup calls (Fabiano Rosas) [Orabug: 36932320]
  - migration: fix switchover abort termination paths (Elena Ufimtseva) [Orabug: 36932320]
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100 (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd/server: Plumb in new args to nbd_client_add() (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - nbd: Minor style and typo fixes (Eric Blake) [Orabug: 36921582] {CVE-2024-7409}
  - scsi-disk: Always report RESERVATION_CONFLICT to guest (Kevin Wolf)
  - scsi-disk: Add warning comments that host_status errors take a shortcut (Kevin Wolf)
  - scsi-block: Don't skip callback for sgio error status/driver_status (Kevin Wolf)
  - scsi-disk: Use positive return value for status in dma_readv/writev (Kevin Wolf)
  - target/i386: Add new CPU model SierraForest (Tao Su)
  - target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model (Lei Wang)
  - target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES (Tao Su)
  - target/i386: Allow MCDT_NO if host supports (Tao Su)
  - target/i386: Add support for MCDT_NO in CPUID enumeration (Tao Su)
  - target/i386: Adjust feature level according to FEAT_7_1_EDX (Tao Su)
  - target/i386: Export MSR_ARCH_CAPABILITIES bits to guests (Pawan Gupta)
  - target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AVX-IFMA in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for AMX-FP16 in CPUID enumeration (Jiaxi Chen)
  - target/i386: Add support for CMPCCXADD in CPUID enumeration (Jiaxi Chen)
  - i386: Add new CPU model SapphireRapids (Wang, Lei)
  - target/i386: KVM: allow fast string operations if host supports them (Paolo Bonzini)
  - target/i386: add FZRM, FSRS, FSRC (Paolo Bonzini)
  - spec: disable keyutils (Mark Kanda) [Orabug: 36903731]
  - meson.build: Make keyutils independent from keyring (Thomas Huth) [Orabug: 36903731]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-17.el8
changelog:
  - target/i386: add feature bits for Inception/SRSO mitigations (Mark Kanda) [Orabug: 37170148]
  - hw/vfio/pci-quirks: Sanitize capability pointer (Alex Williamson) [Orabug: 37176213]
  - hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques (Alex Williamson) [Orabug: 37176213]
  - migration/dirtyrate: Add new mode to dirty track non KVM device separately (Joao Martins) [Orabug: 37097510]
  - vfio/migration: Allow dirty tracking reports with MIGRATION_STATUS_NONE (Joao Martins) [Orabug: 37097510]
  - migration: Emit event when source starts switchover (Joao Martins) [Orabug: 37097503]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-18.el8
changelog:
  - tests: acpi: update expected blobs (Igor Mammedov) [Orabug: 37274182]
  - cpuhp: make sure that remove events are handled within the same SCI (Igor Mammedov) [Orabug: 37274182]
  - tests: acpi: whitelist expected blobs (Igor Mammedov) [Orabug: 37274182]
  - target/i386: Reset TSCs of parked vCPUs too on VM reset (Maciej S. Szmigiero) [Orabug: 37318424]
  - 9pfs: fix regression regarding CVE-2023-2861 (Christian Schoenebeck) [Orabug: 37409273]
  - virtio-net: Ensure queue index fits with RSS (Akihiko Odaki) [Orabug: 36943011] {CVE-2024-6505}
  - qemu-kvm.spec: pack elf2dmp tool (Annie Li)
  - test: bios-tables-test: add IVRS changed binary (Bui Quang Minh) [Orabug: 35710551]
  - amd_iommu: Fix kvm_enable_x2apic link error with clang in non-KVM builds (Sairaj Kodilkar) [Orabug: 35710551]
  - amd_iommu: Check APIC ID > 255 for XTSup (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Send notification when invalidate interrupt entry cache (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Use shared memory region for Interrupt Remapping (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Add support for pass though mode (Suravee Suthikulpanit) [Orabug: 35710551]
  - amd_iommu: Rename variable mmio to mr_mmio (Suravee Suthikulpanit) [Orabug: 35710551]
  - hw/i386/amd_iommu: Don't leak memory in amdvi_update_iotlb() (Peter Maydell) [Orabug: 35710551]
  - amd_iommu: report x2APIC support to the operating system (Bui Quang Minh) [Orabug: 35710551]
  - hw/i386/amd_iommu: Do not use SysBus API to map local MMIO region (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - amd_iommu: Fix APIC address check (Akihiko Odaki) [Orabug: 35710551]
  - hw/i386/amd_iommu: Factor amdvi_pci_realize out of amdvi_sysbus_realize (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Set PCI static/const fields via PCIDeviceClass (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Move capab_offset from AMDVIState to AMDVIPCIState (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Remove intermediate AMDVIState::devid field (Philippe Mathieu-Daudé) [Orabug: 35710551]
  - hw/i386/amd_iommu: Explicit use of AMDVI_BASE_ADDR in amdvi_init (Philippe Mathieu-Daudé) [Orabug: 35710551]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-20.el8
changelog:
  - Document CVEs as not applicable to QEMU 7.2.0 (Mark Kanda) [Orabug: 36869706] [Orabug: 36620547] [Orabug: 37043479] {CVE-2024-3567} {CVE-2024-4693} {CVE-2024-7730}
  - target/i386: Remove rtm, hle and taa-no from the Sapphire Rapids CPU model (Mark Kanda) [Orabug: 37867203]
  - target/i386: Reset parked vCPUs together with the online ones (Maciej S. Szmigiero)
  - migration: Add capability for our custom switchover event (Maciej S. Szmigiero)
  - iotests: Disable ones that hang (Maciej S. Szmigiero)
  - vfio/migration: Use BE byte order for device state wire packets (Maciej S. Szmigiero)
  - vfio/migration: Make x-migration-multifd-transfer VFIO property mutable (Maciej S. Szmigiero)
  - vfio/migration: Add x-migration-multifd-transfer VFIO property (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - send side (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - config loading support (Maciej S. Szmigiero)
  - migration/qemu-file: Define g_autoptr() cleanup function for QEMUFile (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - load thread (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - received buffers queuing (Maciej S. Szmigiero)
  - vfio/migration: Setup and cleanup multifd transfer in these general methods (Maciej S. Szmigiero)
  - vfio/migration: Multifd setup/cleanup functions and associated VFIOMultifd (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer - add support checking function (Maciej S. Szmigiero)
  - vfio/migration: Multifd device state transfer support - basic types (Maciej S. Szmigiero)
  - vfio/migration: Move migration channel flags to vfio-common.h header file (Maciej S. Szmigiero)
  - vfio/migration: Add vfio_add_bytes_transferred() (Maciej S. Szmigiero)
  - vfio/migration: Convert bytes_transferred counter to atomic (Maciej S. Szmigiero)
  - vfio/migration: Add load_device_config_state_start trace event (Maciej S. Szmigiero)
  - migration: Add save_live_complete_precopy_thread handler (Maciej S. Szmigiero)
  - migration/multifd: Add multifd_device_state_supported() (Maciej S. Szmigiero)
  - migration/multifd: Make MultiFDSendData a struct (Peter Xu)
  - migration/multifd: Device state transfer support - send side (Maciej S. Szmigiero)
  - migration/multifd: Add an explicit MultiFDSendData destructor (Maciej S. Szmigiero)
  - migration/multifd: Make multifd_send() thread safe (Maciej S. Szmigiero)
  - migration/multifd: Device state transfer support - receive side (Maciej S. Szmigiero)
  - migration/multifd: Split packet into header and RAM data (Maciej S. Szmigiero)
  - migration: Add thread pool of optional load threads (Maciej S. Szmigiero)
  - error: define g_autoptr() cleanup function for the Error type (Maciej S. Szmigiero)
  - migration: Always take BQL for migration_incoming_state_destroy() (Maciej S. Szmigiero)
  - migration: Add qemu_loadvm_load_state_buffer() and its handler (Maciej S. Szmigiero)
  - migration: Add MIG_CMD_SWITCHOVER_START and its load handler (Maciej S. Szmigiero)
  - thread-pool: Implement generic (non-AIO) pool support (Maciej S. Szmigiero)
  - thread-pool: Rename AIO pool functions to *_aio() and data types to *Aio (Maciej S. Szmigiero)
  - thread-pool: Remove thread_pool_submit() function (Maciej S. Szmigiero)
  - migration: Check migration error after loadvm (Fabiano Rosas)
  - migration/multifd: Add a compat property for TLS termination (Fabiano Rosas)
  - migration/multifd: Terminate the TLS connection (Fabiano Rosas)
  - io: Add a read flag for relaxed EOF (Fabiano Rosas)
  - io: Add flags argument to qio_channel_readv_full_all_eof (Fabiano Rosas)
  - crypto: Remove qcrypto_tls_session_get_handshake_status (Fabiano Rosas)
  - io: tls: Add qio_channel_tls_bye (Fabiano Rosas)
  - crypto: Allow gracefully ending the TLS session (Fabiano Rosas)
  - migration/multifd: Fix compat with QEMU < 9.0 (Fabiano Rosas)
  - vfio/migration: Add vfio_save_block_precopy_empty_hit trace event (Maciej S. Szmigiero)
  - vfio/migration: Add save_{iterate, complete_precopy}_start trace events (Maciej S. Szmigiero)
  - migration/ram: Add load start trace event (Maciej S. Szmigiero)
  - migration/multifd: Stop changing the packet on recv side (Fabiano Rosas)
  - migration/multifd: Replace multifd_send_state->pages with client data (Fabiano Rosas)
  - migration/multifd: Don't send ram data during SYNC (Fabiano Rosas)
  - migration/multifd: Isolate ram pages packet data (Fabiano Rosas)
  - migration/multifd: Remove total pages tracing (Fabiano Rosas)
  - migration/multifd: Move pages accounting into multifd_send_zero_page_detect() (Fabiano Rosas)
  - migration/multifd: Replace p->pages with an union pointer (Fabiano Rosas)
  - migration/multifd: Make MultiFDPages_t:offset a flexible array member (Fabiano Rosas)
  - migration/multifd: Introduce MultiFDSendData (Fabiano Rosas)
  - migration/multifd: Remove pages->allocated (Fabiano Rosas)
  - migration/multifd: Inline page_size and page_count (Fabiano Rosas)
  - migration/multifd: Reduce access to p->pages (Fabiano Rosas)
  - migration/multifd: Decouple recv method from pages (Fabiano Rosas)
  - migration/multifd: Rename MultiFDSend|RecvParams::data to compress_data (Fabiano Rosas)
  - migration/multifd: Change multifd_pages_init argument (Fabiano Rosas)
  - migration: Introduce migrate_has_error() (Peter Xu)
  - test-vmstate: fix bad GTree usage, use-after-free (Eric Auger)
  - Revert "vfio/migration: Add save_{iterate,complete_precopy}_started trace events" (Maciej S. Szmigiero)
  - Revert "migration/ram: Add load start trace event" (Maciej S. Szmigiero)
  - Revert "migration: Add save_live_complete_precopy_{begin,end} handlers" (Maciej S. Szmigiero)
  - Revert "migration: Add qemu_loadvm_load_state_buffer() and its handler" (Maciej S. Szmigiero)
  - Revert "migration: Add load_finish handler and associated functions" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Device state transfer support - receive side" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Convert multifd_send_pages::next_channel to atomic" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Device state transfer support - send side" (Maciej S. Szmigiero)
  - Revert "migration/multifd: Add migration_has_device_state_support()" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Multifd device state transfer support - receive side" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Add x-orcl-migration-multifd-transfer VFIO property" (Maciej S. Szmigiero)
  - Revert "vfio/migration: Multifd device state transfer support - send side" (Maciej S. Szmigiero)
  - target/i386: fix feature dependency for WAITPKG (Paolo Bonzini) [Orabug: 35941551]
  - target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE (Ake Koomsin) [Orabug: 35941551]
  - vhost-scsi: Add support for a worker thread per virtqueue (Mike Christie) [Orabug: 37723795]
  - vhost: Add worker backend callouts (Mike Christie) [Orabug: 37723795]
  - linux-headers: update vhost related headers to v6.5-rc1 (Mark Kanda) [Orabug: 37723795]
  - system/physmem: poisoned memory discard on reboot (William Roche) [Orabug: 34545034]
  - system/physmem: handle hugetlb correctly in qemu_ram_remap() (William Roche) [Orabug: 34545034]
  - qemu-kvm.spec: Ship multiboot_dma.bin (Liam Merwick) [Orabug: 37593199]
  - target/i386: Change unavail from u32 to u64 (Xiong Zhang) [Orabug: 37560962]
  - vfio/pci: Add x-device-dirty-page-tracking param (Joao Martins)


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-22.el8
changelog:
  - migration/multifd: Don't send device state packets with zerocopy flag (Maciej S. Szmigiero) [Orabug: 37372623]
  - migration/dirtyrate: skip kvm_log_start/kvm_log_stop for non-KVM (Dongli Zhang) [Orabug: 37939813]


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-24.el8
changelog:
  - Revert "migration: Temporarily re-enable our custom switchover event by default" (Mark Kanda)
  - target/i386: Enumerate verw-clear CPUID feature (Boris Ostrovsky) [Orabug: 38118557] {CVE-2024-36350} {CVE-2024-36357}


author: Karl Heubaum <karl.heubaum@oracle.com> - 7.2.0-26.el8
changelog:
  - accel/kvm: Enable Dirty bit tracking if hash cache is used (Joao Martins) [Orabug: 37699414]
  - migration/page_cache: Add nettle sha256 function (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page_cache: Add libgcrypt sha256 function (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page_cache: Add gnutls sha256 function (Joao Martins) [Orabug: 37699414]
  - migration: Add a parameter to select sha256 library (Joao Martins) [Orabug: 37699414]
  - migration: Export cache statistics to QMP (Joao Martins) [Orabug: 37699414]
  - migration/ram: Adjust estimate/exact to time-to-hash dirty data (Joao Martins) [Orabug: 37699414]
  - migration: Sync dirty bitmap in exact() considering factor (Joao Martins) [Orabug: 37699414]
  - migration: Time cache hit/miss operations (Joao Martins) [Orabug: 37699414]
  - migration/ram: Calculate real dirty pages based on hash cache stats (Elena Ufimtseva) [Orabug: 37699414]
  - migration: Add hash cache for dirty page tracking (Elena Ufimtseva) [Orabug: 37699414]
  - migration/page-cache: Differentiate page size from cache data size (Joao Martins) [Orabug: 37699414]
  - target/i386: do not expose ARCH_CAPABILITIES on AMD CPU (Paolo Bonzini) [Orabug: 38225280]


author: Mark Kanda <mark.kanda@oracle.com> - 7.2.0-28.el8
changelog:
  - hw/i386: Add an exadata machine (Joao Martins) [Orabug: 38408711]
  - arm/kvm: add support for MTE (Cornelia Huck)
  - target/arm: When tag memory is not present, set MTE=1 (Richard Henderson)
  - spec: provide qemu-kvm-device-usb-host package (Mark Kanda) [Orabug: 38355110]
  - kvm.conf: do not automatically enable virt when loading kvm (Mark Kanda) [Orabug: 38320046]


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.11.0-1.el8
changelog:
  - Creating RHEL-8.0 initial branch based on 1.11.0
  - Resolves: bz#1515300
  - (Prepare seabios for RHEL-8.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.12.0-1.el8
changelog:
  - Rebase to 1.12.0 [bz#1666134]
  - Resolves: bz#1666134
    (Rebase seabios for RHEL-AV release in virt:8.0.0 stream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.12.0-3.el8
changelog:
  - seabios-rh-add-configs-for-ramfb-and-bochs-display.patch [bz#1724098]
  - Resolves: bz#1724098
    (enable device: bochs-display (seabios))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.12.0-4.el8
changelog:
  - seabios-tpm-Check-for-TPM-related-ACPI-tables-before-attempt.patch [bz#1705212]
  - seabios-usb-ehci-Clear-pipe-token-on-pipe-reallocate.patch [bz#1705212]
  - Resolves: bz#1705212
    (Backport 1.12.1 patches to RHEL-AV 8.1.0)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.12.0-5.el8
changelog:
  - seabios-add-get_keystroke_full-helper.patch [bz#1693031]
  - seabios-bootmenu-add-support-for-more-than-9-entries.patch [bz#1693031]
  - Resolves: bz#1693031
    (On systems with more than 10 available boot devices, keys are uninintuitive)


author: Jon Maloy <jmaloy@redhat.com> - 1.15.0-1.el8
changelog:
  - pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch [bz#2001921]
  - pci: let firmware reserve IO for pcie-pci-bridge.patch [bz#2001921]
  - Resolves: bz#2001921


author: Camilla Conte <cconte@redhat.com> - 1.15.0-2
changelog:
  - seabios-shortcut-skip-unbootable-disks-optimitation.patch [bz#1924972]
  - Resolves: bz#1924972
    (Guest whose os is installed multiple disks but boot partition is installed on single disk can't boot into OS on RHEL 8)


author: Paweł Poławski <ppolawsk@redhat.com> - 1.16.0-1
changelog:
  - Rebase to upstream 1.16 tag [bz#2066828]
  - Resolves: bz#2066828
    (rebase seabios to 1.16 release)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-2
changelog:
  - seabios-shortcut-skip-unbootable-disks-optimitation.patch [bz#2073012]
  - seabios-pci-refactor-the-pci_config_-functions.patch [bz#2083884]
  - seabios-reset-force-standard-PCI-configuration-access.patch [bz#2083884]
  - Resolves: bz#2073012
    (Guest whose os is installed multiple disks but boot partition is installed on single disk can't boot into OS on RHEL 8 [rhel-8.7.0])
  - Resolves: bz#2083884
    (qemu reboot problem with seabios 1.16.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-3
changelog:
  - seabios-virtio-blk-use-larger-default-request-size.patch [bz#2101787]
  - Resolves: bz#2101787
    ([rhel.8.7] Loading a kernel/initrd is sometimes very slow)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-4
changelog:
  - seabios-malloc-use-variable-for-ZoneHigh-size.patch [bz#2227373]
  - seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch [bz#2227373]
  - Resolves: bz#2227373
    ("No bootable device" with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks.)


author: Stefan Berger <stefanb@linux.vnet.ibm.com> - 0.1.0-0.20180918git67d7ea3
changelog:
  - Created initial version of rpm spec files
  - Version is now 0.1.0
  - Bugzilla for this spec: https://bugzilla.redhat.com/show_bug.cgi?id=1611829


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: Karl Heubaum <karl.heubaum@oracle.com> - 3.2.0-2.el8
changelog:
  - virtManager/console: Enable console when graphical is unavailable (Karl Heubaum)  [Orabug: 33530542] 
  - virt-manager.spec: Use gtksourceview3 (Karl Heubaum)  [Orabug: 33513589]


author: Karl Heubaum <karl.heubaum@oracle.com> - 3.2.0-3.el8
changelog:
  - virtManager/addstorage: Handle disks with missing removable property (Karl
    Heubaum)  [Orabug: 33558225]


author: Karl Heubaum <karl.heubaum@oracle.com> - 3.2.0-4.el8
changelog:
  - virtinst/guest.py: Force host-passthrough on Exadata (Karl Heubaum)  [Orabug: 33657820] 
  - ol9/virt-manager.spec: Switch to gtksourceview4 (Karl Heubaum)  
  - ol9/virt-manager.spec: Replace genisoimage with xorriso (Karl Heubaum)  
  - virt-manager.spec: Add version for OL9 (Karl Heubaum)


author: Karl Heubaum <karl.heubaum@oracle.com> - 3.2.0-5.el8
changelog:
  - virtinst/guest.py: Update Exadata-specific guest config (Karl Heubaum)  [Orabug: 34023386] 
  - virtinst/domcapabilities.py: Add pattern to recognize Oracle AAVMF file (Karl Heubaum)  [Orabug: 33993024] 
  - virtinst/devices/video.py: Switch to supported video devices (Karl Heubaum)  [Orabug: 33994128]


author: Karl Heubaum <karl.heubaum@oracle.com> - 3.2.0-7.el8
changelog:
  - virtinst/guest.py: Add aarch64 support to the --exadata switch (Karl Heubaum)  [Orabug: 34133505] 
  - virtinst/domain/vnuma.py: Add nodeset property (Karl Heubaum)  [Orabug: 34133505] 
  - cli: --feature: Support kvm.poll-control.state (Wim ten Have)  [Orabug: 34783574]


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-11
changelog:
  - v2v: windows: Allow qxldod.inf as synonym for qxl.inf
    resolves: rhbz#1926102
  - v2v: Increase required free space in Windows to 100 MB
    resolves: rhbz#1949147
  - docs: Document how to remove "Out of HTTP sessions" limit
  - v2v: Disable readahead for VMware curl sources too
    resolves: rhbz#1848862
  - v2v: Allow output to block devices
    resolves: rhbz#1868690
  - docs: -o openstack: Clarify name of file containing OpenStack auth
    resolves: rhbz#1871754
  - docs: UEFI guest conversion to -o openstack is supported
    resolves: rhbz#1872100
  - v2v: Turn pnp_wait.exe warning into a debug message
    resolves: rhbz#1903960
  - v2v: windows: Fix schtasks /SD parameter
    resolves: rhbz#1895323


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-13
changelog:
  - docs: Fix version of virt-v2v which added UEFI for OpenStack
    related: rhbz#1872100
  - v2v: Increase Linux minimum root filesystem to 100 MB
    resolves: rhbz#1764569


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-17
changelog:
  - Correct regexps used to fix schtasks command
  - Fix backing file specified without backing format
    resolves: rhbz#2023279, rhbz#2025769


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-21
changelog:
  - Fix assertion failure when parsing OVA dir with trailing slash
    resolves: rhbz#2028823
  - For -o rhv-upload wait for VM creation task
    resolves: rhbz#1985827
  - If listing RPM applications fails, rebuild DB and retry (2089623)
  - Fix CVE-2022-2211 Denial of Service in --key parameter
    resolves: rhbz#2102720


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-22
changelog:
  - RHEL 8: If setfiles fails fall back to autorelabel
    resolves: rhbz#XXX
  - Reapply patches since we are using git format-patch --submodule=diff


