diff --git a/SOURCE b/SOURCE
index f35eff0ac7ef3f963f426f8c783382da207e80b4..a8e569b3054b8a32b2191b22796b529126a1ff14 100644
--- a/SOURCE
+++ b/SOURCE
@@ -1 +1 @@
-6.6.0-84.0.0
+6.6.0-85.0.0
diff --git a/kernel.spec b/kernel.spec
index 5b59a436f83780205142ae5d6c0d6ec671e766fc..efbbb1aabc626bd5486f0242801dc3e40d33c11a 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -40,9 +40,9 @@ rm -f test_openEuler_sign.ko test_openEuler_sign.ko.sig
 
 %global upstream_version    6.6
 %global upstream_sublevel   0
-%global devel_release       84
+%global devel_release       85
 %global maintenance_release .0.0
-%global pkg_release         .89
+%global pkg_release         .90
 
 %global openeuler_lts       1
 %global openeuler_major     2403
@@ -1087,6 +1087,440 @@ fi
 %endif
 
 %changelog
+* Tue Apr 01 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-85.0.0.90
+- !15705  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
+- tracing: Fix use-after-free in print_graph_function_flags during tracer switching
+- !15704  perf/core: Add RCU read lock protection to perf_iterate_ctx()
+- perf/core: Add RCU read lock protection to perf_iterate_ctx()
+- !15672  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
+- ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
+- !15621  misc: fastrpc: Fix copy buffer page size
+- misc: fastrpc: Fix copy buffer page size
+- !15620  s390/ism: add release function for struct device
+- s390/ism: add release function for struct device
+- !15622  Fix UAF in acct(2)
+- acct: block access to kernel internal filesystems
+- acct: perform last write from workqueue
+- !15488  CVE-2025-21816
+- hrtimer: Fix kabi broken of struct hrtimer_cpu_base
+- hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
+- !15706 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.78-6.6.79 LTS Patches
+- kbuild: hdrcheck: fix cross build with clang
+- HID: hid-steam: Fix use-after-free when detaching device
+- Revert "vfio/platform: check the bounds of read/write syscalls"
+- x86/i8253: Disable PIT timer 0 when not in use
+- vsock: Orphan socket after transport release
+- vsock: Keep the binding until socket destruction
+- io_uring/kbuf: reallocate buf lists on upgrade
+- HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
+- alpha: replace hardcoded stack offsets with autogenerated ones
+- mm: gup: fix infinite loop within __get_longterm_locked
+- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
+- md/md-bitmap: move bitmap_{start, end}write to md upper layer
+- md: add a new callback pers->bitmap_sector()
+- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
+- md/md-bitmap: factor behind write counters out from bitmap_{start/end}write()
+- selftests: rtnetlink: update netdevsim ipsec output format
+- netdevsim: print human readable IP address
+- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
+- drm/v3d: Stop active perfmon if it is being destroyed
+- drm/rcar-du: dsi: Fix PHY lock bit check
+- drm/tidss: Clear the interrupt status for interrupts being disabled
+- drm/tidss: Fix issue in irq handling causing irq-flood issue
+- ipv6: mcast: add RCU protection to mld_newpack()
+- ipv6: mcast: extend RCU protection in igmp6_send()
+- ndisc: extend RCU protection in ndisc_send_skb()
+- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
+- arp: use RCU protection in arp_xmit()
+- neighbour: use RCU protection in __neigh_notify()
+- neighbour: delete redundant judgment statements
+- ndisc: use RCU protection in ndisc_alloc_skb()
+- HID: hid-steam: Move hidraw input (un)registering to work
+- HID: hid-steam: Make sure rumble work is canceled on removal
+- HID: hid-steam: Add Deck IMU support
+- HID: hid-steam: Fix cleanup in probe()
+- HID: hid-steam: remove pointless error message
+- HID: hid-steam: Add gamepad-only mode switched to by holding options
+- HID: hid-steam: Update list of identifiers from SDL
+- HID: hid-steam: Clean up locking
+- HID: hid-steam: Disable watchdog instead of using a heartbeat
+- HID: hid-steam: Avoid overwriting smoothing parameter
+- ipv6: icmp: convert to dev_net_rcu()
+- ipv6: use RCU protection in ip6_default_advmss()
+- flow_dissector: use RCU protection to fetch dev_net()
+- ipv4: icmp: convert to dev_net_rcu()
+- ipv4: use RCU protection in __ip_rt_update_pmtu()
+- net: ipv4: Cache pmtu for all packet paths if multipath enabled
+- ipv4: use RCU protection in inet_select_addr()
+- ipv4: use RCU protection in rt_is_expired()
+- ipv4: use RCU protection in ipv4_default_advmss()
+- net: add dev_net_rcu() helper
+- net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
+- ipv4: add RCU protection to ip4_dst_hoplimit()
+- btrfs: fix hole expansion when writing at an offset beyond EOF
+- mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
+- igc: Set buffer type for empty frames in igc_init_empty_frame
+- mmc: mtk-sd: Fix register settings for hs400(es) mode
+- arm64: Handle .ARM.attributes section in linker scripts
+- regmap-irq: Add missing kfree()
+- regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
+- partitions: mac: fix handling of bogus partition table
+- gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
+- gpiolib: acpi: Add a quirk for Acer Nitro ANV14
+- alpha: align stack for page fault and user unaligned trap handlers
+- serial: 8250: Fix fifo underflow on flush
+- efi: Avoid cold plugged memory for placing the kernel
+- kbuild: userprogs: fix bitsize and target detection on clang
+- wifi: ath12k: fix handling of 6 GHz rules
+- alpha: make stack 16-byte aligned (most cases)
+- can: etas_es58x: fix potential NULL pointer dereference on udev->serial
+- can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
+- can: c_can: fix unbalanced runtime PM disable in error path
+- can: ctucanfd: handle skb allocation failure
+- USB: serial: option: drop MeiG Smart defines
+- USB: serial: option: fix Telit Cinterion FN990A name
+- USB: serial: option: add Telit Cinterion FN990B compositions
+- USB: serial: option: add MeiG Smart SLM828
+- usb: cdc-acm: Fix handling of oversized fragments
+- USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
+- usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
+- USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
+- USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
+- usb: core: fix pipe creation for get_bMaxPacketSize0
+- USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
+- usb: dwc2: gadget: remove of_node reference upon udc_stop
+- usb: gadget: udc: renesas_usb3: Fix compiler warning
+- usb: roles: set switch registered flag early on
+- usb: dwc3: Fix timeout issue during controller enter/exit from halt state
+- usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind retries
+- perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
+- KVM: nSVM: Enter guest mode before initializing nested NPT MMU
+- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
+- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
+- batman-adv: Drop unmanaged ELP metric worker
+- batman-adv: Ignore neighbor throughput metrics in error case
+- batman-adv: fix panic during interface removal
+- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
+- ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
+- selftests: gpio: gpio-sim: Fix missing chip disablements
+- Grab mm lock before grabbing pt lock
+- vfio/pci: Enable iowrite64 and ioread64 for vfio pci
+- rtla/timerlat_top: Abort event processing on second signal
+- rtla/timerlat_hist: Abort event processing on second signal
+- scsi: ufs: bsg: Set bsg_queue to NULL after removal
+- PCI: switchtec: Add Microchip PCI100X device IDs
+- PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
+- media: uvcvideo: Add Kurokesu C1 PRO camera
+- media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera
+- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
+- media: i2c: ds90ub953: Add error handling for i2c reads/writes
+- media: i2c: ds90ub913: Add error handling to ub913_hw_init()
+- media: cxd2841er: fix 64-bit division on gcc-9
+- soc/tegra: fuse: Update Tegra234 nvmem keepout list
+- fbdev: omap: use threaded IRQ for LCD DMA
+- RDMA/efa: Reset device on probe failure
+- tools: fix annoying "mkdir -p ..." logs when building tools in parallel
+- x86/xen: allow larger contiguous memory regions in PV guests
+- xen/swiotlb: relax alignment requirements
+- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
+- gpio: bcm-kona: Add missing newline to dev_err format string
+- gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
+- gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
+- drm/i915/selftests: avoid using uninitialized context
+- cgroup: Remove steal time from usage_usec
+- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
+- team: better TEAM_OPTION_TYPE_STRING validation
+- LoongArch: Fix idle VS timer enqueue
+- vxlan: check vxlan_vnigroup_init() return value
+- vrf: use RCU protection in l3mdev_l3_out()
+- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
+- ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
+- spi: sn-f-ospi: Fix division by zero
+- HID: multitouch: Add NULL check in mt_input_configured
+- pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
+- !14287 [OLK-6.6] SCSI: Support Linkdata HBA/RAID Controllers
+- SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers
+- !15686 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.76-6.6.78 LTS Patches
+- char: misc: deallocate static minor in error path
+- ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
+- ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15
+- ALSA: hda/realtek: Add quirks for ASUS ROG 2023 models
+- ALSA: hda/realtek: Fix microphone regression on ASUS N705UD
+- Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
+- rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
+- rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
+- Revert "rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads"
+- Revert "rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads"
+- Revert "KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()"
+- Revert "KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock"
+- Revert "KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults"
+- Revert "KVM: e500: always restore irqs"
+- KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)
+- KVM: x86: Make x2APIC ID 100% readonly
+- tty: xilinx_uartps: split sysrq handling
+- x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
+- mptcp: prevent excessive coalescing on receive
+- btrfs: avoid monopolizing a core when activating a swap file
+- Revert "btrfs: avoid monopolizing a core when activating a swap file"
+- ocfs2: check dir i_size in ocfs2_find_entry
+- net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
+- spi: atmel-qspi: Memory barriers after memory-mapped I/O
+- spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
+- MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
+- rtc: zynqmp: Fix optional clock name property
+- pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
+- rtla/timerlat_top: Stop timerlat tracer on signal
+- rtla/timerlat_hist: Stop timerlat tracer on signal
+- rtla: Add trace_instance_stop
+- rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
+- rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
+- rtla/osnoise: Distinguish missing workload option
+- scripts/gdb: fix aarch64 userspace detection in get_current_task
+- maple_tree: simplify split calculation
+- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
+- net/ncsi: wait for the last response to Deselect Package before configuring channel
+- misc: fastrpc: Fix copy buffer page size
+- misc: fastrpc: Fix registered buffer page address
+- misc: fastrpc: Deregister device nodes properly in error scenarios
+- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
+- mtd: onenand: Fix uninitialized retlen in do_otp_read()
+- irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
+- i3c: master: Fix missing 'ret' assignment in set_speed()
+- NFC: nci: Add bounds checking in nci_hci_create_pipe()
+- mailbox: tegra-hsp: Clear mailbox before using message
+- ocfs2: fix incorrect CPU endianness conversion causing mount failure
+- pnfs/flexfiles: retry getting layout segment for reads
+- selftests: mptcp: connect: -f: no reconnect
+- vfio/platform: check the bounds of read/write syscalls
+- io_uring/rw: commit provided buffer state on async
+- io_uring: fix io_req_prep_async with provided buffers
+- io_uring/net: don't retry connect operation on EPOLLERR
+- io_uring: fix multishots with selected buffers
+- nvmem: imx-ocotp-ele: set word length to 1
+- nvmem: imx-ocotp-ele: fix reading from non zero offset
+- nvmem: imx-ocotp-ele: simplify read beyond device check
+- nvmem: core: improve range check for nvmem_cell_write()
+- nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
+- crypto: qce - unregister previously registered algos in error path
+- crypto: qce - fix goto jump in error path
+- media: uvcvideo: Remove redundant NULL assignment
+- media: uvcvideo: Support partial control reads
+- media: uvcvideo: Fix event flags in uvc_ctrl_send_events
+- media: uvcvideo: Fix crash during unbind if gpio unit is in use
+- media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
+- media: i2c: ds90ub960: Fix UB9702 VC map
+- media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
+- media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
+- media: ccs: Fix cleanup order in ccs_probe()
+- media: ccs: Fix CCS static data parsing for large block sizes
+- media: ov5640: fix get_light_freq on auto
+- media: imx296: Add standby delay during probe
+- media: mc: fix endpoint iteration
+- media: mmp: Bring back registration of the device
+- soc: qcom: smem_state: fix missing of_node_put in error path
+- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
+- iio: light: as73211: fix channel handling in only-color triggered buffer
+- media: ccs: Clean up parsed CCS static data on parse failure
+- kfence: skip __GFP_THISNODE allocations on NUMA systems
+- rv: Reset per-task monitors also for idle tasks
+- tpm: Change to kvalloc() in eventlog/acpi.c
+- ACPI: PRM: Remove unnecessary strict handler address checks
+- xfs: Add error handling for xfs_reflink_cancel_cow_range
+- xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end
+- pwm: microchip-core: fix incorrect comparison with max period
+- arm64: tegra: Disable Tegra234 sce-fabric node
+- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
+- crypto: qce - fix priority to be less than ARMv8 CE
+- arm64: dts: qcom: sm8550: correct MDSS interconnects
+- arm64: dts: qcom: sm8550: Fix MPSS memory length
+- arm64: dts: qcom: sm8550: Fix CDSP memory length
+- arm64: dts: qcom: sm8450: Fix MPSS memory length
+- arm64: dts: qcom: sm8450: Fix CDSP memory length
+- arm64: dts: qcom: sm8350: Fix MPSS memory length
+- arm64: dts: qcom: sm8350: Fix CDSP memory base and length
+- arm64: dts: qcom: sm8350: Fix ADSP memory base and length
+- arm64: dts: qcom: sm6375: Fix MPSS memory base and length
+- arm64: dts: qcom: sm6375: Fix CDSP memory base and length
+- arm64: dts: qcom: sm6375: Fix ADSP memory length
+- arm64: dts: qcom: sm6350: Fix uart1 interconnect path
+- arm64: dts: qcom: sm6350: Fix MPSS memory length
+- arm64: dts: qcom: sm6350: Fix ADSP memory length
+- arm64: dts: qcom: sm6115: Fix ADSP memory base and length
+- arm64: dts: qcom: sm6115: Fix CDSP memory length
+- arm64: dts: qcom: sm6115: Fix MPSS memory length
+- ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
+- ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
+- ubi: Add a check for ubi_num
+- x86/boot: Use '-std=gnu11' to fix build with GCC 15
+- rust: init: use explicit ABI to clean warning in future compilers
+- kbuild: Move -Wenum-enum-conversion to W=2
+- scsi: storvsc: Set correct data length for sending SCSI command without payload
+- scsi: ufs: qcom: Fix crypto key eviction
+- scsi: qla2xxx: Move FCE Trace buffer allocation to user control
+- scsi: st: Don't set pos_unknown just after device recognition
+- nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
+- nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
+- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
+- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
+- arm64: tegra: Fix Tegra234 PCIe interrupt-map
+- ALSA: hda: Fix headset detection failure due to unstable sort
+- ALSA: hda/realtek: Enable headset mic on Positivo C6400
+- Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
+- block: don't revert iter for -EIOCBQUEUED
+- mips/math-emu: fix emulation of the prefx instruction
+- dm-crypt: track tag_offset in convert_context
+- dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
+- powerpc/pseries/eeh: Fix get PE state translation
+- LoongArch: Extend the maximum number of watchpoints
+- MIPS: Loongson64: remove ROM Size unit in boardinfo
+- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
+- serial: sh-sci: Drop __initdata macro for port_cfg
+- soc: qcom: socinfo: Avoid out of bounds read of serial number
+- ASoC: acp: Support microphone from Lenovo Go S
+- usbnet: ipheth: document scope of NCM implementation
+- usbnet: ipheth: fix DPE OoB read
+- usbnet: ipheth: break up NCM header size computation
+- usbnet: ipheth: refactor NCM datagram loop
+- usbnet: ipheth: check that DPE points past NCM header
+- usbnet: ipheth: use static NDP16 location in URB
+- usb: gadget: f_tcm: Don't prepare BOT write request twice
+- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
+- usb: gadget: f_tcm: Decrement command ref count on cleanup
+- usb: gadget: f_tcm: Translate error to sense
+- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
+- wifi: rtw88: sdio: Fix disconnection after beacon loss
+- wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
+- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
+- wifi: rtlwifi: rtl8821ae: Fix media status report
+- HID: hid-sensor-hub: don't use stale platform-data on remove
+- of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
+- of: Fix of_find_node_opts_by_path() handling of alias+path+options
+- of: Correct child specifier used as input of the 2nd nexus node
+- scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
+- perf bench: Fix undefined behavior in cmpworker()
+- efi: libstub: Use '-std=gnu11' to fix build with GCC 15
+- clk: mediatek: mt2701-mm: add missing dummy clk
+- clk: mediatek: mt2701-img: add missing dummy clk
+- clk: mediatek: mt2701-bdp: add missing dummy clk
+- clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
+- clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
+- clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
+- clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
+- clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
+- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
+- clk: qcom: clk-alpha-pll: fix alpha mode configuration
+- media: i2c: ds90ub960: Fix UB9702 refclk register access
+- clk: sunxi-ng: a100: enable MMC clock reparenting
+- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
+- Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
+- drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
+- drm/komeda: Add check for komeda_get_layer_fourcc_list()
+- drm/i915: Fix page cleanup on DMA remap failure
+- drm/i915/guc: Debug print LRC state entries only if the context is pinned
+- Revert "drm/amd/display: Use HW lock mgr for PSR1"
+- drm/amdkfd: only flush the validate MES contex
+- drm/amd/pm: Mark MM activity as unsupported
+- ksmbd: fix integer overflows on 32 bit systems
+- KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
+- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
+- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
+- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
+- KVM: arm64: timer: Always evaluate the need for a soft timer
+- fs/proc: do_task_stat: Fix ESP not readable during coredump
+- m68k: vga: Fix I/O defines
+- s390/futex: Fix FUTEX_OP_ANDN implementation
+- smb: client: change lease epoch type from unsigned int to __u16
+- smb: client: fix order of arguments of tracepoints
+- drm/modeset: Handle tiled displays in pan_display_atomic.
+- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
+- leds: lp8860: Write full EEPROM, not only half of it
+- cpufreq: s3c64xx: Fix compilation warning
+- rxrpc: Fix call state set to not include the SERVER_SECURING state
+- net: sched: Fix truncation of offloaded action statistics
+- tun: revert fix group permission check
+- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
+- ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
+- x86/xen: add FRAME_END to xen_hypercall_hvm()
+- x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
+- net: rose: lock the socket in rose_bind()
+- net: atlantic: fix warning during hot unplug
+- gpio: pca953x: Improve interrupt support
+- rxrpc: Fix the rxrpc_connection attend queue handling
+- udp: gso: do not drop small packets when PMTU reduces
+- tg3: Disable tg3 PCIe AER on system reboot
+- vmxnet3: Fix tx queue race condition with XDP
+- ice: Add check for devm_kzalloc()
+- net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
+- nvme-fc: use ctrl state getter
+- ice: put Rx buffers after being done with current frame
+- gpu: drm_dp_cec: fix broken CEC adapter properties check
+- firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
+- net/ncsi: fix locking in Get MAC Address handling
+- net/ncsi: Add NC-SI 1.2 Get MC MAC Address command
+- KVM: e500: always restore irqs
+- KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults
+- KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock
+- KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()
+- platform/x86: acer-wmi: Ignore AC events
+- Input: allocate keycode for phone linking
+- ASoC: amd: Add ACPI dependency to fix build error
+- ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
+- platform/x86: int3472: Check for adev == NULL
+- iommu/arm-smmu-v3: Clean up more on probe failure
+- iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
+- x86/kexec: Allocate PGD for x86_64 transition page tables separately
+- selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
+- tipc: re-order conditions in tipc_crypto_key_rcv()
+- mmc: sdhci-msm: Correctly set the load for the regulator
+- net: wwan: iosm: Fix hibernation by re-binding the driver around it
+- Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
+- APEI: GHES: Have GHES honor the panic= setting
+- i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
+- wifi: iwlwifi: avoid memory leak
+- net/mlx5: use do_aux_work for PHC overflow checks
+- HID: Wacom: Add PCI Wacom device support
+- clk: qcom: Make GCC_8150 depend on QCOM_GDSC
+- mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
+- tomoyo: don't emit warning in tomoyo_write_control()
+- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
+- mmc: core: Respect quirk_max_rate for non-UHS SDIO card
+- tun: fix group permission check
+- wifi: rtw89: add crystal_cap check to avoid setting as overflow value
+- safesetid: check size of policy writes
+- drm/bridge: it6505: fix HDCP CTS KSV list wait timer
+- drm/bridge: it6505: fix HDCP CTS compare V matching
+- drm/bridge: it6505: fix HDCP encryption when R0 ready
+- drm/bridge: it6505: fix HDCP Bstatus check
+- drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
+- drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
+- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
+- drm/virtio: New fence for every plane update
+- x86/amd_nb: Restrict init function to AMD-based systems
+- lockdep: Fix upper limit for LOCKDEP_*_BITS configs
+- sched: Don't try to catch up excess steal time.
+- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
+- btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents()
+- s390/stackleak: Use exrl instead of ex in __stackleak_poison()
+- arm64/mm: Ensure adequate HUGE_MAX_HSTATE
+- btrfs: fix use-after-free when attempting to join an aborted transaction
+- btrfs: fix assertion failure when splitting ordered extent after transaction abort
+- Revert "hostfs: convert hostfs to use the new mount API"
+- Revert "hostfs: fix string handling in __dentry_name()"
+- Revert "hostfs: Add const qualifier to host_root in hostfs_fill_super()"
+- Revert "hostfs: fix the host directory parse when mounting."
+- !15645  nilfs2: do not force clear folio if buffer is referenced
+- nilfs2: do not force clear folio if buffer is referenced
+- !15660 v2  add support DVMBM in HIP12
+- KVM: arm64: Add new HiSi CPU type to support DVMBM
+- kvm: hisi_virt: Update TLBI broadcast feature for hip12
+- kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE
+- !15593  io_uring: prevent opcode speculation
+- io_uring: prevent opcode speculation
+- !15644  ata: libata-sff: Ensure that we cannot write outside the allocated buffer
+- ata: libata-sff: Ensure that we cannot write outside the allocated buffer
+- !15581  smb: client: Add check for next_buffer in receive_encrypted_standard()
+- smb: client: Add check for next_buffer in receive_encrypted_standard()
+
 * Tue Mar 25 2025 ZhangPeng <zhangpeng362@huawei.com> - 6.6.0-84.0.0.89
 - !15625 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.75-6.6.76 LTS Patches
 - HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()