Repository: intel/intel-device-plugins-for-kubernetes

Issue:
Restrict certain devices from being discovered and reported by the plugin
**Is your feature request related to a problem? Please describe.**
I have a desktop with Iris Xe and ARC 770. clinfo reports:
```
  Device Name                                     Intel(R) Arc(TM) A770M Graphics
  Device Name                                     Intel(R) Iris(R) Xe Graphics
```
The device plugin discovers both cards and reports them in k8s as gpu.intel.com/i915
When running a AI training on k8s, I need to run it on an accelerator, in my case an ARC card. With the current solution, my pod gets the Iris Xe device and fails.

**Describe the solution you'd like**
A way to specify in the device plugin deamon set yaml a list of devices not to be discovered and reported in k8s.

Discussion:
@eero-t: I vaguely remember some earlier discussion about possible options for supporting development cases (developer machines with non-server GPU configurations), e.g. to ignore integrated GPUs.  I could not find in which ticket(s) that happened or what the conclusions were though.

(@tkatila is currently on vacation, he can hopefully give better answer when he's back.)

But in general, K8s device plugins are intended to be used with nodes where all the resources of given type have same capacity.

For heterogeneous device support (on same node), you need K8s DRA driver: https://github.com/intel/intel-resource-drivers-for-kubernetes/#readme

K8s DRA API graduated to v1beta1 in K8s v1.32: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/4381-dra-structured-parameters/README.md@mythi: > I could not find in which ticket(s) that happened or what the conclusions were though.

https://github.com/intel/intel-device-plugins-for-kubernetes/issues/1815#issuecomment-2321067037@tkatila: There are a few options that could help here:
* White/black listing with device ids
  * Only allow certain devices to be introduced as resources
  * Could be tuned/modified with re-configuring the plugin
  * Requires knowledge of device ids
* Detection of integrated/discrete GPUs
  * Not possible from sysfs, requires LevelZero
* Resource naming with device type/name
  * Rename the resource type based on the device id or name: i915-arc, i915-flex, i915-max, i915-integrated etc.
  * Requires logic to detect devices via LevelZero or some sort of lookup-table for known devices.

First option is the easiest because it can be tuned based on the scenario and can support new devices also. If we combine it with overlays, we could hide some of the device id complexities.

Solution patch:
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 00c863fb..d824914a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,40 +1,5 @@
 #
 # Syntax and details are here: https://help.github.com/articles/about-codeowners/
 #
-# Global code ownership, fallback
+# Global code ownership
 *                   @kad @mythi @bart0sh @tkatila
-
-# CI and building
-.github/workflows/  @bart0sh @kad @mythi @tkatila
-/scripts/           @bart0sh @kad @mythi
-
-# Binaries
-/cmd/               @mythi @bart0sh @tkatila
-/cmd/fpga_tool/     @bart0sh @kad @mythi
-/cmd/gpu_fakedev/   @tkatila @uniemimu @eero-t
-/cmd/gpu_plugin/    @tkatila @bart0sh @uniemimu
-/cmd/gpu_nfdhook/   @tkatila @bart0sh @uniemimu
-/cmd/gpu_levelzero/ @tkatila @eero-t @uniemimu
-/cmd/qat_plugin/    @hj-johannes-lee @mythi
-/cmd/sgx_plugin/    @hj-johannes-lee @mythi
-/cmd/dsa_plugin/    @hj-johannes-lee @ozhuraki @mythi
-/cmd/iaa_plugin/    @hj-johannes-lee @ozhuraki @mythi
-/cmd/dlb_plugin/    @bart0sh @hj-johannes-lee
-/cmd/xpumanager_sidecar/   @tkatila @uniemimu
-
-# Framework
-/pkg/               @mythi @bart0sh @tkatila
-/pkg/topology/      @bart0sh @kad
-
-# Deployments
-/deployments/       @hj-johannes-lee @bart0sh @mythi @tkatila
-
-# Demos
-/demo/              @tkatila @bart0sh @mythi @kad
-
-# Testing
-/test/              @mythi @bart0sh @ozhuraki @hj-johannes-lee
-
-# New dependencies review
-/go.sum             @kad @mythi @bart0sh @tkatila
-/go.mod             @kad @mythi @bart0sh @tkatila
diff --git a/.github/workflows/lib-build.yaml b/.github/workflows/lib-build.yaml
index 4659bf6c..8a6f3e4b 100644
--- a/.github/workflows/lib-build.yaml
+++ b/.github/workflows/lib-build.yaml
@@ -39,7 +39,7 @@ jobs:
           - intel-npu-demo
         builder: [buildah, docker]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/lib-codeql.yaml b/.github/workflows/lib-codeql.yaml
index 76b86607..2cfad3d3 100644
--- a/.github/workflows/lib-codeql.yaml
+++ b/.github/workflows/lib-codeql.yaml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
       with:
         go-version-file: go.mod
@@ -29,11 +29,11 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y libze1 libze-dev
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3
+      uses: github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2 # v3
       with:
         languages: 'go'
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3
+      uses: github/codeql-action/analyze@df559355d593797519d70b90fc8edd5db049e7a2 # v3
       with:
         category: "/language:go"
diff --git a/.github/workflows/lib-e2e.yaml b/.github/workflows/lib-e2e.yaml
index a7f9abf8..55b22624 100644
--- a/.github/workflows/lib-e2e.yaml
+++ b/.github/workflows/lib-e2e.yaml
@@ -39,7 +39,7 @@ jobs:
       IMAGES: ${{ join(matrix.images, ' ') }}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           fetch-depth: 0
       - name: Describe test environment
diff --git a/.github/workflows/lib-publish.yaml b/.github/workflows/lib-publish.yaml
index f9dd3b86..e2eb8014 100644
--- a/.github/workflows/lib-publish.yaml
+++ b/.github/workflows/lib-publish.yaml
@@ -11,7 +11,7 @@ on:
         required: false
         type: string
 env:
-  no_base_check: "['intel-qat-plugin-kerneldrv', 'intel-idxd-config-initcontainer', 'crypto-perf', 'opae-nlb-demo', 'intel-gpu-levelzero']"
+  no_base_check: "['intel-idxd-config-initcontainer', 'crypto-perf', 'opae-nlb-demo', 'intel-gpu-levelzero']"
 
 permissions:
   contents: read
@@ -57,7 +57,7 @@ jobs:
           - intel-iaa-plugin
           - intel-idxd-config-initcontainer
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/lib-scorecard.yaml b/.github/workflows/lib-scorecard.yaml
index 9b0b5cdf..8465b26f 100644
--- a/.github/workflows/lib-scorecard.yaml
+++ b/.github/workflows/lib-scorecard.yaml
@@ -16,7 +16,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
         with:
           persist-credentials: false
       - name: "Analyze project"
@@ -26,6 +26,6 @@ jobs:
           results_format: sarif
           publish_results: true
       - name: "Upload results to security"
-        uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3
+        uses: github/codeql-action/upload-sarif@df559355d593797519d70b90fc8edd5db049e7a2 # v3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/lib-trivy.yaml b/.github/workflows/lib-trivy.yaml
index 755d70a3..4b044b24 100644
--- a/.github/workflows/lib-trivy.yaml
+++ b/.github/workflows/lib-trivy.yaml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - name: Run Trivy in config mode for deployments
       uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
       with:
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - name: Run Trivy in config mode for dockerfiles
       uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
       with:
@@ -62,7 +62,7 @@ jobs:
     name: Scan licenses
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - name: Run Trivy in fs mode
       uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
       with:
@@ -79,7 +79,7 @@ jobs:
     name: Scan vulnerabilities
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - name: Run Trivy in fs mode
       uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
       with:
diff --git a/.github/workflows/lib-validate.yaml b/.github/workflows/lib-validate.yaml
index 2de40e60..fd767009 100644
--- a/.github/workflows/lib-validate.yaml
+++ b/.github/workflows/lib-validate.yaml
@@ -14,7 +14,7 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install -y python3-venv
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       with:
         fetch-depth: 0
     - name: Set up doc directory
@@ -34,7 +34,7 @@ jobs:
     name: lint
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: go.mod
@@ -46,13 +46,13 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v7
         with:
-          version: v2.1.6
+          version: v2.4.0
           args: -v --timeout 5m
   build:
     name: Build and check device plugins
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: go.mod
@@ -64,8 +64,8 @@ jobs:
       - name: Check Dockerfiles
         run: make check-dockerfiles
       - run: make go-mod-tidy
-      - run: make BUILDTAGS=kerneldrv
-      - run: make test BUILDTAGS=kerneldrv
+      - run: make
+      - run: make test
         env:
           UNITTEST: 1
       - run: make check-github-actions
@@ -77,11 +77,11 @@ jobs:
     strategy:
       matrix:
         version:
-          - 1.30.x
           - 1.31.x
           - 1.32.x
+          - 1.33.x
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d30aee57..63821280 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install -y python3-venv git
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       with:
         fetch-depth: 0
         ref: main
@@ -44,7 +44,7 @@ jobs:
         rm -rf _work/venv
         make vhtml
         mv _build/html/* $HOME/output/
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       with:
         fetch-depth: 0
         ref: release-0.30
@@ -55,7 +55,7 @@ jobs:
         rm -rf _work/venv
         make vhtml
         mv _build/html $HOME/output/0.30
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       with:
         fetch-depth: 0
         ref: release-0.31
@@ -66,7 +66,7 @@ jobs:
         rm -rf _work/venv
         make vhtml
         mv _build/html $HOME/output/0.31
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
       with:
         fetch-depth: 0
         ref: release-0.32
diff --git a/.github/workflows/trivy-periodic.yaml b/.github/workflows/trivy-periodic.yaml
index f016c2e8..5404c53f 100644
--- a/.github/workflows/trivy-periodic.yaml
+++ b/.github/workflows/trivy-periodic.yaml
@@ -18,7 +18,7 @@ jobs:
     name: Scan vulnerabilities
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
     - name: Run Trivy in fs mode
       # Don't fail in case of vulnerabilities, report them in the next step
       continue-on-error: true
@@ -31,6 +31,6 @@ jobs:
         format: sarif
         output: trivy-report.sarif
     - name: Upload sarif report to GitHub Security tab
-      uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3
+      uses: github/codeql-action/upload-sarif@df559355d593797519d70b90fc8edd5db049e7a2 # v3
       with:
         sarif_file: trivy-report.sarif
diff --git a/.golangci.yml b/.golangci.yml
index 7259906a..faab8225 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,7 +1,5 @@
 version: "2"
 run:
-  build-tags:
-    - kerneldrv
   tests: true
 linters:
   default: none
@@ -31,7 +29,6 @@ linters:
     - unconvert
     - unused
     - whitespace
-    - wsl
   settings:
     gocognit:
       min-complexity: 31
@@ -62,16 +59,11 @@ linters:
       - linters:
           - gocognit
           - gocyclo
-          - wsl
         path: _test\.go
       - linters:
           - gocognit
           - gocyclo
-          - wsl
         path: test/e2e/
-      - linters:
-          - wsl
-        path: cmd/gpu_fakedev/
       - linters:
           - goconst
         path: (.+)_test\.go
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index 06c95300..e086a822 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -4,7 +4,6 @@ misconfigurations:
     paths:
       - dlb_plugin/base/intel-dlb-plugin.yaml
       - fpga_plugin/base/intel-fpga-plugin-daemonset.yaml
-      - qat_plugin/base/intel-qat-kernel-plugin.yaml
       - qat_plugin/overlays/qat_initcontainer/qat_initcontainer.yaml
 
   - id: AVD-KSV-0017
@@ -13,7 +12,6 @@ misconfigurations:
       - dlb_plugin/overlays/dlb_initcontainer/dlb_initcontainer.yaml
       - dsa_plugin/overlays/dsa_initcontainer/dsa_initcontainer.yaml
       - iaa_plugin/overlays/iaa_initcontainer/iaa_initcontainer.yaml
-      - qat_plugin/base/intel-qat-kernel-plugin.yaml
       - qat_plugin/overlays/qat_initcontainer/qat_initcontainer.yaml
 
   - id: AVD-KSV-0047
diff --git a/Makefile b/Makefile
index 2978ea44..ccf85ad6 100644
--- a/Makefile
+++ b/Makefile
@@ -9,8 +9,8 @@ BUILDER ?= "docker"
 EXTRA_BUILD_ARGS ?= ""
 
 CERT_MANAGER_VERSION ?= v1.15.2
-CONTROLLER_GEN_VERSION ?= v0.17.0
-GOLANGCI_LINT_VERSION ?= v2.1.6
+CONTROLLER_GEN_VERSION ?= v0.18.0
+GOLANGCI_LINT_VERSION ?= v2.4.0
 KIND_VERSION ?= v0.23.0
 GOLICENSES_VERSION ?= v1.6.0
 # Default bundle image tag
@@ -170,7 +170,7 @@ e2e-spr:
 
 pre-pull:
 ifeq ($(TAG),devel)
-	@$(BUILDER) pull golang:1.24-bookworm
+	@$(BUILDER) pull golang:1.25-trixie
 	@$(BUILDER) pull debian:unstable-slim
 	@$(BUILDER) pull ubuntu:22.04
 endif
diff --git a/README.md b/README.md
index d2fa6049..0aa68cb3 100644
--- a/README.md
+++ b/README.md
@@ -244,7 +244,7 @@ The summary of resources available via plugins in this repository is given in th
    * [iaa-accel-config-demo-pod.yaml](demo/iaa-accel-config-demo-pod.yaml)
  * `npu.intel.com`  : `accel`
    * [intel-npu-workload.yaml](demo/intel-npu-workload.yaml)
- * `qat.intel.com`  : `generic` or `cy`/`dc`/`asym-dc`/`sym-dc`
+ * `qat.intel.com`  : `generic` or `cy`/`dc`/`asym-[dc|decomp]`/`sym-[dc|decomp]`/`asym-[dc|decomp]`/`asym-sym-[dc|decomp]`/`dcc`/`decomp`
    * [compress-perf-dpdk-pod-requesting-qat-dc.yaml](deployments/qat_dpdk_app/compress-perf/compress-perf-dpdk-pod-requesting-qat-dc.yaml)
    * [crypto-perf-dpdk-pod-requesting-qat-cy.yaml](deployments/qat_dpdk_app/crypto-perf/crypto-perf-dpdk-pod-requesting-qat-cy.yaml)
  * `sgx.intel.com`  : `epc`
diff --git a/build/docker/build-image.sh b/build/docker/build-image.sh
index 032603f1..ea2185a2 100755
--- a/build/docker/build-image.sh
+++ b/build/docker/build-image.sh
@@ -31,7 +31,7 @@ fi
 
 BUILD_ARGS="${BUILD_ARGS} \
     --build-arg FINAL_BASE=gcr.io/distroless/static \
-    --build-arg BUILD_BASE=golang:1.24-bookworm \
+    --build-arg BUILD_BASE=golang:1.25-trixie \
     --build-arg FINAL_BASE_DYN=debian:unstable-slim \
     --build-arg ROCKYLINUX=0"
 
diff --git a/build/docker/intel-deviceplugin-operator.Dockerfile b/build/docker/intel-deviceplugin-operator.Dockerfile
index ff06d2f4..f8b9b05f 100644
--- a/build/docker/intel-deviceplugin-operator.Dockerfile
+++ b/build/docker/intel-deviceplugin-operator.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-dlb-initcontainer.Dockerfile b/build/docker/intel-dlb-initcontainer.Dockerfile
index 986efa60..546b6481 100644
--- a/build/docker/intel-dlb-initcontainer.Dockerfile
+++ b/build/docker/intel-dlb-initcontainer.Dockerfile
@@ -33,7 +33,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-dlb-plugin.Dockerfile b/build/docker/intel-dlb-plugin.Dockerfile
index 7e61ae08..f19da4e2 100644
--- a/build/docker/intel-dlb-plugin.Dockerfile
+++ b/build/docker/intel-dlb-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-dsa-plugin.Dockerfile b/build/docker/intel-dsa-plugin.Dockerfile
index a7466696..c8467e1d 100644
--- a/build/docker/intel-dsa-plugin.Dockerfile
+++ b/build/docker/intel-dsa-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-fpga-admissionwebhook.Dockerfile b/build/docker/intel-fpga-admissionwebhook.Dockerfile
index d3b73ecf..d0a4a0cc 100644
--- a/build/docker/intel-fpga-admissionwebhook.Dockerfile
+++ b/build/docker/intel-fpga-admissionwebhook.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-fpga-initcontainer.Dockerfile b/build/docker/intel-fpga-initcontainer.Dockerfile
index d35455f2..4eb4ac42 100644
--- a/build/docker/intel-fpga-initcontainer.Dockerfile
+++ b/build/docker/intel-fpga-initcontainer.Dockerfile
@@ -33,7 +33,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-fpga-plugin.Dockerfile b/build/docker/intel-fpga-plugin.Dockerfile
index 623c3464..9c1d7796 100644
--- a/build/docker/intel-fpga-plugin.Dockerfile
+++ b/build/docker/intel-fpga-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-gpu-fakedev.Dockerfile b/build/docker/intel-gpu-fakedev.Dockerfile
index d8838254..f4a5d773 100644
--- a/build/docker/intel-gpu-fakedev.Dockerfile
+++ b/build/docker/intel-gpu-fakedev.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-gpu-initcontainer.Dockerfile b/build/docker/intel-gpu-initcontainer.Dockerfile
index 4a2c2e6e..7723ade6 100644
--- a/build/docker/intel-gpu-initcontainer.Dockerfile
+++ b/build/docker/intel-gpu-initcontainer.Dockerfile
@@ -33,7 +33,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-gpu-levelzero.Dockerfile b/build/docker/intel-gpu-levelzero.Dockerfile
index b086f200..cf04f45f 100644
--- a/build/docker/intel-gpu-levelzero.Dockerfile
+++ b/build/docker/intel-gpu-levelzero.Dockerfile
@@ -24,7 +24,7 @@ ARG ROCKYLINUX=1
 ARG BUILD_BASE=rockylinux:9
 ARG FINAL_BASE_DYN=registry.access.redhat.com/ubi9/ubi-minimal:9.3
 ###
-## Use the BUILD_BASE when either the a) golang-bookworm is updated to a newer glibc
+## Use the BUILD_BASE when either the a) golang-trixie is updated to a newer glibc
 ## or b) the intel-igc-core libraries are fixed to not to demand a newer glibc
 FROM ${FINAL_BASE_DYN} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
@@ -37,7 +37,7 @@ ENV LDFLAGS="all=-linkmode=external -s -w"
 ARG GOLICENSES_VERSION
 ARG CMD
 ARG ROCKYLINUX
-ARG CGO_VERSION=1.24
+ARG CGO_VERSION=1.25
 RUN mkdir /runtime
 RUN if [ $ROCKYLINUX -eq 0 ]; then \
         apt-get update && apt-get install --no-install-recommends -y wget jq curl libc6-dev ocl-icd-libopencl1 gcc ca-certificates && \
diff --git a/build/docker/intel-gpu-plugin.Dockerfile b/build/docker/intel-gpu-plugin.Dockerfile
index 8ac0a9c8..4730aa2e 100644
--- a/build/docker/intel-gpu-plugin.Dockerfile
+++ b/build/docker/intel-gpu-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-iaa-plugin.Dockerfile b/build/docker/intel-iaa-plugin.Dockerfile
index 68def7fd..401bea2b 100644
--- a/build/docker/intel-iaa-plugin.Dockerfile
+++ b/build/docker/intel-iaa-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-npu-plugin.Dockerfile b/build/docker/intel-npu-plugin.Dockerfile
index bd457d92..77fd829b 100644
--- a/build/docker/intel-npu-plugin.Dockerfile
+++ b/build/docker/intel-npu-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-qat-initcontainer.Dockerfile b/build/docker/intel-qat-initcontainer.Dockerfile
index 5362a60b..48bf182f 100644
--- a/build/docker/intel-qat-initcontainer.Dockerfile
+++ b/build/docker/intel-qat-initcontainer.Dockerfile
@@ -33,7 +33,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-qat-plugin.Dockerfile b/build/docker/intel-qat-plugin.Dockerfile
index 94724f70..21b0c794 100644
--- a/build/docker/intel-qat-plugin.Dockerfile
+++ b/build/docker/intel-qat-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-sgx-admissionwebhook.Dockerfile b/build/docker/intel-sgx-admissionwebhook.Dockerfile
index 35a414b0..cbc2a095 100644
--- a/build/docker/intel-sgx-admissionwebhook.Dockerfile
+++ b/build/docker/intel-sgx-admissionwebhook.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-sgx-initcontainer.Dockerfile b/build/docker/intel-sgx-initcontainer.Dockerfile
index 0f621be2..0a577883 100644
--- a/build/docker/intel-sgx-initcontainer.Dockerfile
+++ b/build/docker/intel-sgx-initcontainer.Dockerfile
@@ -33,7 +33,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-sgx-plugin.Dockerfile b/build/docker/intel-sgx-plugin.Dockerfile
index d5fe0160..8f505377 100644
--- a/build/docker/intel-sgx-plugin.Dockerfile
+++ b/build/docker/intel-sgx-plugin.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/intel-xpumanager-sidecar.Dockerfile b/build/docker/intel-xpumanager-sidecar.Dockerfile
index 3c7fc655..78d6733f 100644
--- a/build/docker/intel-xpumanager-sidecar.Dockerfile
+++ b/build/docker/intel-xpumanager-sidecar.Dockerfile
@@ -34,7 +34,7 @@ ARG FINAL_BASE=registry.access.redhat.com/ubi9-micro:latest
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
 FROM ${GOLANG_BASE} AS builder
 ARG DIR=/intel-device-plugins-for-kubernetes
diff --git a/build/docker/lib/golang_base.docker b/build/docker/lib/golang_base.docker
index 2702d8e6..6fccce31 100644
--- a/build/docker/lib/golang_base.docker
+++ b/build/docker/lib/golang_base.docker
@@ -5,5 +5,5 @@
 ##
 ## This is used on release branches before tagging a stable version.
 ## The main branch defaults to using the latest Golang base image.
-ARG GOLANG_BASE=golang:1.24-bookworm
+ARG GOLANG_BASE=golang:1.25-trixie
 ###
diff --git a/build/docker/templates/intel-gpu-levelzero.Dockerfile.in b/build/docker/templates/intel-gpu-levelzero.Dockerfile.in
index 6a2daed0..d109c619 100644
--- a/build/docker/templates/intel-gpu-levelzero.Dockerfile.in
+++ b/build/docker/templates/intel-gpu-levelzero.Dockerfile.in
@@ -12,7 +12,7 @@ ARG BUILD_BASE=rockylinux:9
 ARG FINAL_BASE_DYN=registry.access.redhat.com/ubi9/ubi-minimal:9.3
 ###
 
-## Use the BUILD_BASE when either the a) golang-bookworm is updated to a newer glibc
+## Use the BUILD_BASE when either the a) golang-trixie is updated to a newer glibc
 ## or b) the intel-igc-core libraries are fixed to not to demand a newer glibc
 FROM ${FINAL_BASE_DYN} AS builder
 
@@ -28,7 +28,7 @@ ENV LDFLAGS="all=-linkmode=external -s -w"
 ARG GOLICENSES_VERSION
 ARG CMD
 ARG ROCKYLINUX
-ARG CGO_VERSION=1.24
+ARG CGO_VERSION=1.25
 
 RUN mkdir /runtime
 
diff --git a/cmd/gpu_levelzero/main.go b/cmd/gpu_levelzero/main.go
index 1280bf01..a877d50d 100644
--- a/cmd/gpu_levelzero/main.go
+++ b/cmd/gpu_levelzero/main.go
@@ -203,7 +203,9 @@ func main() {
 		}
 	})
 
-	lis, err := net.Listen("unix", *socketPath)
+	var lc net.ListenConfig
+
+	lis, err := lc.Listen(context.Background(), "unix", *socketPath)
 	if err != nil {
 		klog.Fatalf("failed to listen: %v", err)
 	}
diff --git a/cmd/gpu_plugin/README.md b/cmd/gpu_plugin/README.md
index e86a9045..923fa766 100644
--- a/cmd/gpu_plugin/README.md
+++ b/cmd/gpu_plugin/README.md
@@ -57,6 +57,8 @@ For workloads on different KMDs, see [KMD and UMD](#kmd-and-umd).
 | -health-management | - | disabled | Enable health management by requesting data from oneAPI/Level-Zero interface. Requires [GPU Level-Zero](../gpu_levelzero/) sidecar. See [health management](#health-management) |
 | -wsl | - | disabled | Adapt plugin to run in the WSL environment. Requires [GPU Level-Zero](../gpu_levelzero/) sidecar. |
 | -shared-dev-num | int | 1 | Number of containers that can share the same GPU device |
+| -allow-ids | string | "" | A list of PCI Device IDs that are allowed to be registered as resources. Default is empty (=all registered). Cannot be used together with `deny-ids`. |
+| -deny-ids | string | "" | A list of PCI Device IDs that are denied to be registered as resources. Default is empty (=all registered). Cannot be used together with `allow-ids`. |
 | -allocation-policy | string | none | 3 possible values: balanced, packed, none. For shared-dev-num > 1: _balanced_ mode spreads workloads among GPU devices, _packed_ mode fills one GPU fully before moving to next, and _none_ selects first available device from kubelet. Default is _none_. |
 
 The plugin also accepts a number of other arguments (common to all plugins) related to logging.
diff --git a/cmd/gpu_plugin/gpu_plugin.go b/cmd/gpu_plugin/gpu_plugin.go
index 3f92da73..b191c483 100644
--- a/cmd/gpu_plugin/gpu_plugin.go
+++ b/cmd/gpu_plugin/gpu_plugin.go
@@ -69,6 +69,8 @@ const (
 
 type cliOptions struct {
 	preferredAllocationPolicy string
+	allowIDs                  string
+	denyIDs                   string
 	sharedDevNum              int
 	temperatureLimit          int
 	enableMonitoring          bool
@@ -204,6 +206,23 @@ func packedPolicy(req *pluginapi.ContainerPreferredAllocationRequest) []string {
 	return deviceIds
 }
 
+func validatePCIDeviceIDs(pciIDList string) error {
+	r := regexp.MustCompile(`^0x[0-9a-f]{4}$`)
+
+	for id := range strings.SplitSeq(pciIDList, ",") {
+		id = strings.TrimSpace(id)
+		if id == "" {
+			return os.ErrNotExist
+		}
+
+		if !r.MatchString(id) {
+			return os.ErrInvalid
+		}
+	}
+
+	return nil
+}
+
 func (dp *devicePlugin) pciAddressForCard(cardPath, cardName string) (string, error) {
 	linkPath, err := os.Readlink(cardPath)
 	if err != nil {
@@ -585,6 +604,31 @@ func (dp *devicePlugin) filterOutInvalidCards(files []fs.DirEntry) []fs.DirEntry
 			continue
 		}
 
+		allowlist := len(dp.options.allowIDs) > 0
+		denylist := len(dp.options.denyIDs) > 0
+
+		// Skip if the device is either not allowed or denied.
+		if allowlist || denylist {
+			pciID, err := pciDeviceIDForCard(path.Join(dp.sysfsDir, f.Name()))
+			if err != nil {
+				klog.Warningf("Failed to get PCI ID for device %s: %+v", f.Name(), err)
+
+				continue
+			}
+
+			if allowlist && !strings.Contains(dp.options.allowIDs, pciID) {
+				klog.V(4).Infof("Skipping device %s (%s), not in allowlist: %s", f.Name(), pciID, dp.options.allowIDs)
+
+				continue
+			}
+
+			if denylist && strings.Contains(dp.options.denyIDs, pciID) {
+				klog.V(4).Infof("Skipping device %s (%s), in denylist: %s", f.Name(), pciID, dp.options.denyIDs)
+
+				continue
+			}
+		}
+
 		filtered = append(filtered, f)
 	}
 
@@ -710,6 +754,25 @@ func (dp *devicePlugin) Allocate(request *pluginapi.AllocateRequest) (*pluginapi
 	return nil, &dpapi.UseDefaultMethodError{}
 }
 
+func checkAllowDenyOptions(opts cliOptions) bool {
+	if len(opts.allowIDs) > 0 && len(opts.denyIDs) > 0 {
+		klog.Error("Cannot use both allow-ids and deny-ids options at the same time. Please use only one of them.")
+		return false
+	}
+
+	if err := validatePCIDeviceIDs(opts.allowIDs); err != nil {
+		klog.Error("Failed to validate allow-ids: ", err)
+		return false
+	}
+
+	if err := validatePCIDeviceIDs(opts.denyIDs); err != nil {
+		klog.Error("Failed to validate deny-ids: ", err)
+		return false
+	}
+
+	return true
+}
+
 func main() {
 	var (
 		prefix string
@@ -723,6 +786,9 @@ func main() {
 	flag.IntVar(&opts.sharedDevNum, "shared-dev-num", 1, "number of containers sharing the same GPU device")
 	flag.IntVar(&opts.temperatureLimit, "temp-limit", 100, "temperature limit at which device is marked unhealthy")
 	flag.StringVar(&opts.preferredAllocationPolicy, "allocation-policy", "none", "modes of allocating GPU devices: balanced, packed and none")
+	flag.StringVar(&opts.allowIDs, "allow-ids", "", "comma-separated list of device IDs to allow (e.g. 0x49c5,0x49c6)")
+	flag.StringVar(&opts.denyIDs, "deny-ids", "", "comma-separated list of device IDs to deny (e.g. 0x49c5,0x49c6)")
+
 	flag.Parse()
 
 	if opts.sharedDevNum < 1 {
@@ -736,6 +802,12 @@ func main() {
 		os.Exit(1)
 	}
 
+	if !checkAllowDenyOptions(opts) {
+		klog.Error("Invalid allow/deny options.")
+
+		os.Exit(1)
+	}
+
 	klog.V(1).Infof("GPU device plugin started with %s preferred allocation policy", opts.preferredAllocationPolicy)
 
 	plugin := newDevicePlugin(prefix+sysfsDrmDirectory, prefix+devfsDriDirectory, opts)
diff --git a/cmd/qat_plugin/README.md b/cmd/qat_plugin/README.md
index 611e9f39..3067aebd 100644
--- a/cmd/qat_plugin/README.md
+++ b/cmd/qat_plugin/README.md
@@ -32,7 +32,7 @@ Supported Devices include, but may not be limited to, the following:
 The QAT device plugin provides access to QAT hardware accelerated cryptographic and compression features
 through the SR-IOV virtual functions (VF). Demonstrations are provided utilising [DPDK](https://doc.dpdk.org/) and [OpenSSL](https://www.openssl.org/).
 
-QAT Kubernetes resources show up as `qat.intel.com/generic` on systems _before_ QAT Gen4 (4th Gen Xeon&reg;) and `qat.intel.com/[cy|dc]` on QAT Gen4.
+QAT Kubernetes resources show up as `qat.intel.com/generic` on systems _before_ QAT Gen4 (4th Gen Xeon&reg;) and `qat.intel.com/[<configured services>]` on QAT Gen4+.
 
 ## Modes and Configuration Options
 
@@ -120,8 +120,10 @@ In addition to the default configuration, you can add device-specific configurat
 
 | Device | Possible Configuration | How To Customize | Options | Notes |
 |:-------|:-----------------------|:-----------------|:--------|:------|
-| 4xxx, 401xx, 402xx, 420xx | [cfg_services](https://github.com/torvalds/linux/blob/v6.6-rc5/Documentation/ABI/testing/sysfs-driver-qat) reports the configured services (crypto services or compression services) of the QAT device. | `ServicesEnabled=<value>` | compress:`dc`, crypto:`sym;asym`, <br>crypto+compress:`asym;dc`,<br>crypto+compress:`sym;dc` | 4xxx/401xx/402xx: Linux 6.0+ kernel. 420xx: Linux 6.8+ kernel. |
-| 4xxx, 401xx, 402xx, 420xx | [auto_reset](https://github.com/torvalds/linux/blob/a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6/Documentation/ABI/testing/sysfs-driver-qat#L145) reports the setting of the QAT device's automatic error recovery functionality. | `AutoresetEnabled=<value>` | `on`, `off`, | Linux 6.8+ kernel. |
+| 4xxx, 401xx, 402xx, 420xx, 6xxx | [cfg_services](https://github.com/torvalds/linux/blob/v6.16/Documentation/ABI/testing/sysfs-driver-qat) reports the configured services (crypto services or compression services) of the QAT device. | `ServicesEnabled=<value>` | Available services: compress:`dc`, de-compress: `decomp`, (`6xxx` only), dc chaining feature: `dcc`, symmetric crypto: `sym`, asymmetric crypto: `asym`,  | 4xxx/401xx/402xx: Linux 6.0+, 420xx: Linux 6.8+, 6xxx Linux 6.16. |
+| 4xxx, 401xx, 402xx, 420xx, 6xxx | [auto_reset](https://github.com/torvalds/linux/blob/v6.16/Documentation/ABI/testing/sysfs-driver-qat#L145) reports the setting of the QAT device's automatic error recovery functionality. | `AutoresetEnabled=<value>` | `on`, `off`, | 4xxx/401xx/402xx/420xx: Linux 6.8+, 6xxx: Linux 6.16+ |
+
+**Note:** Service combinations are permitted for all services except `dcc`. On QAT Gen4 devices (`qat_4xxx` driver) a maximum of two services can be combined and on QAT Gen6 devices (`qat_6xxx` driver) a maximum of three services can be combined. The order of services is not significant. For instance, `sym;asym` is functionally equivalent to `asym;sym`.
 
 To create a provisioning `configMap`, run the following command before deploying initcontainer:
 
@@ -215,7 +217,7 @@ In order to utilise the QAT device plugin, QuickAssist SR-IOV virtual functions
 You can verify this on your nodes by checking for the relevant PCI identifiers:
 
 ```bash
-for i in 0442 0443 18a1 37c9 6f55 19e3 4941 4943 4945 4947; do lspci -d 8086:$i; done
+for i in 0442 0443 18a1 37c9 6f55 19e3 4941 4943 4945 4947 4949; do lspci -d 8086:$i; done
 ```
 
 [1]:https://www-ssl.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/purley/intel-xeon-scalable-processors.html
diff --git a/cmd/qat_plugin/dpdkdrv/dpdkdrv.go b/cmd/qat_plugin/dpdkdrv/dpdkdrv.go
index 1ee5cf75..a482e244 100644
--- a/cmd/qat_plugin/dpdkdrv/dpdkdrv.go
+++ b/cmd/qat_plugin/dpdkdrv/dpdkdrv.go
@@ -66,6 +66,7 @@ var qatDeviceDriver = map[string]string{
 	"4943": "4xxxvf",
 	"4945": "4xxxvf",
 	"4947": "420xxvf",
+	"4949": "6xxxvf",
 	"37c9": "c6xxvf",
 	"6f55": "d15xxvf",
 }
@@ -352,7 +353,7 @@ func readDeviceConfiguration(pfDev string) string {
 		}
 
 		if err2 == nil && len(qatCfgServices) != 0 {
-			return strings.TrimSpace(string(qatCfgServices))
+			return strings.Join(strings.SplitN(strings.TrimSpace(string(qatCfgServices)), ";", 3), "-")
 		}
 	}
 
@@ -392,8 +393,7 @@ func getDeviceHealthiness(device string, lookup map[string]string) string {
 	hbStatusFile := filepath.Join(filepath.Dir(filepath.Join(pfDev, "../../")), "kernel/debug",
 		fmt.Sprintf("qat_%s_%s/heartbeat/status", driver, filepath.Base(pfDev)))
 
-	// If status reads "-1", the device is considered bad:
-	// https://github.com/torvalds/linux/blob/v6.6-rc5/Documentation/ABI/testing/debugfs-driver-qat
+	// If status reads "-1", the device is considered bad.
 	if data, err := os.ReadFile(hbStatusFile); err == nil && strings.Split(string(data), "\n")[0] == "-1" {
 		healthiness = pluginapi.Unhealthy
 	}
@@ -414,6 +414,7 @@ func getDeviceCapabilities(device string) (string, error) {
 		"4943": {}, // QAT Gen4 (401xx) VF PCI ID
 		"4945": {}, // QAT Gen4 (402xx) VF PCI ID
 		"4947": {}, // QAT Gen4 (420xx) VF PCI ID
+		"4949": {}, // QAT Gen6 (6xxx) VF PCI ID
 	}
 
 	if _, ok := devicesWithCapabilities[devID]; !ok {
@@ -426,27 +427,14 @@ func getDeviceCapabilities(device string) (string, error) {
 		return defaultCapabilities, nil
 	}
 
-	switch readDeviceConfiguration(pfDev) {
-	case "sym;asym":
+	services := readDeviceConfiguration(pfDev)
+	switch services {
+	case "sym-asym":
+		fallthrough
+	case "asym-sym":
 		return "cy", nil
-	case "asym;sym":
-		return "cy", nil
-	case "dc":
-		return "dc", nil
-	case "sym":
-		return "sym", nil
-	case "asym":
-		return "asym", nil
-	case "asym;dc":
-		return "asym-dc", nil
-	case "dc;asym":
-		return "asym-dc", nil
-	case "sym;dc":
-		return "sym-dc", nil
-	case "dc;sym":
-		return "sym-dc", nil
 	default:
-		return defaultCapabilities, nil
+		return services, nil
 	}
 }
 
diff --git a/cmd/qat_plugin/qat_plugin.go b/cmd/qat_plugin/qat_plugin.go
index f60f4558..8e407b42 100644
--- a/cmd/qat_plugin/qat_plugin.go
+++ b/cmd/qat_plugin/qat_plugin.go
@@ -35,7 +35,7 @@ func main() {
 	)
 
 	dpdkDriver := flag.String("dpdk-driver", "vfio-pci", "DPDK Device driver for configuring the QAT device")
-	kernelVfDrivers := flag.String("kernel-vf-drivers", "4xxxvf,420xxvf", "Comma separated VF Device Driver of the QuickAssist Devices in the system. Devices supported: DH895xCC, C62x, C3xxx, C4xxx, 4xxx, 420xxx, and D15xx")
+	kernelVfDrivers := flag.String("kernel-vf-drivers", "4xxxvf,420xxvf", "Comma separated VF Device Driver of the QuickAssist Devices in the system. Devices supported: DH895xCC, C62x, C3xxx, C4xxx, 4xxx, 420xxx, 6xxx, and D15xx")
 	preferredAllocationPolicy := flag.String("allocation-policy", "", "Modes of allocating QAT devices: balanced and packed")
 	maxNumDevices := flag.Int("max-num-devices", 64, "maximum number of QAT devices to be provided to the QuickAssist device plugin")
 	flag.Parse()
diff --git a/demo/qat-autoreset.sh b/demo/qat-autoreset.sh
index 49cd36d5..d6843aa1 100755
--- a/demo/qat-autoreset.sh
+++ b/demo/qat-autoreset.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 NODE_NAME="${NODE_NAME:-}"
-ENABLED_QAT_PF_PCIIDS=${ENABLED_QAT_PF_PCIIDS:-37c8 4940 4942 4944 4946}
+ENABLED_QAT_PF_PCIIDS=${ENABLED_QAT_PF_PCIIDS:-37c8 4940 4942 4944 4946 4948}
 
 AUTORESET_ENABLED="NONE"
 AUTORESET_ENABLED_FOUND="FALSE"
diff --git a/demo/qat-init.sh b/demo/qat-init.sh
index a3ad6a84..adc6b80f 100755
--- a/demo/qat-init.sh
+++ b/demo/qat-init.sh
@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 # This script is based on qatlib's qat_init.sh
 NODE_NAME="${NODE_NAME:-}"
-ENABLED_QAT_PF_PCIIDS=${ENABLED_QAT_PF_PCIIDS:-37c8 4940 4942 4944 4946}
-SERVICES_LIST="sym asym sym;asym dc sym;dc asym;dc"
+ENABLED_QAT_PF_PCIIDS=${ENABLED_QAT_PF_PCIIDS:-37c8 4940 4942 4944 4946 4948}
+# TODO: check against qatlib
+SERVICES_LIST="sym asym sym;asym dc sym;dc asym;dc dcc decomp asym;sym;dc asym;sym;decomp"
 QAT_4XXX_DEVICE_PCI_ID="0x4940"
 QAT_401XX_DEVICE_PCI_ID="0x4942"
 QAT_402XX_DEVICE_PCI_ID="0x4944"
 QAT_420XX_DEVICE_PCI_ID="0x4946"
+QAT_6XXX_DEVICE_PCI_ID="0x4948"
 SERVICES_ENABLED="NONE"
 SERVICES_ENABLED_FOUND="FALSE"
 
@@ -39,7 +41,7 @@ sysfs_config() {
   if [ "$SERVICES_ENABLED_FOUND" = "TRUE" ]; then
     for DEVPATH in $DEVS; do
       PCI_DEV=$(cat "$DEVPATH"/device 2> /dev/null)
-      if [ "$PCI_DEV" != "$QAT_4XXX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_401XX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_402XX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_420XX_DEVICE_PCI_ID" ]; then
+      if [ "$PCI_DEV" != "$QAT_4XXX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_401XX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_402XX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_420XX_DEVICE_PCI_ID" ] && [ "$PCI_DEV" != "$QAT_6XXX_DEVICE_PCI_ID" ]; then
         continue
       fi
 
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 0a342d6c..239965a9 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: acceleratorfunctions.fpga.intel.com
 spec:
   group: fpga.intel.com
diff --git a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
index 4ff32500..45d1a9f0 100644
--- a/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/fpga_admissionwebhook/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: fpgaregions.fpga.intel.com
 spec:
   group: fpga.intel.com
diff --git a/deployments/gpu_plugin/overlays/allowlist-arc/add-args.yaml b/deployments/gpu_plugin/overlays/allowlist-arc/add-args.yaml
new file mode 100644
index 00000000..2d3ff4ba
--- /dev/null
+++ b/deployments/gpu_plugin/overlays/allowlist-arc/add-args.yaml
@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: intel-gpu-plugin
+spec:
+  template:
+    spec:
+      containers:
+      - name: intel-gpu-plugin
+        args:
+        - "-v=4"
+        - "-allow-ids=0x56a6,0x56a5,0x56a1,0x56a0,0x5694,0x5693,0x5692,0x5691,0x5690,0x56b3,0x56b2,0x56a4,0x56a3,0x5697,0x5696,0x5695,0x56b1,0x56b0,0x56a2,0x56ba,0x56bc,0x56bd,0x56bb"
diff --git a/deployments/gpu_plugin/overlays/allowlist-arc/kustomization.yaml b/deployments/gpu_plugin/overlays/allowlist-arc/kustomization.yaml
new file mode 100644
index 00000000..b374ebda
--- /dev/null
+++ b/deployments/gpu_plugin/overlays/allowlist-arc/kustomization.yaml
@@ -0,0 +1,4 @@
+resources:
+  - ../../base
+patches:
+  - path: add-args.yaml
diff --git a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
index ed78525f..8686a23e 100644
--- a/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
+++ b/deployments/nfd/overlays/node-feature-rules/node-feature-rules.yaml
@@ -95,7 +95,7 @@ spec:
         - feature: pci.device
           matchExpressions:
             vendor: {op: In, value: ["8086"]}
-            device: {op: In, value: ["37c8", "4940", "4942", "4944", "4946"]}
+            device: {op: In, value: ["37c8", "4940", "4942", "4944", "4946", "4948"]}
             class: {op: In, value: ["0b40"]}
         - feature: kernel.loadedmodule
           matchExpressions:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
index 0af534da..58806c33 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dlbdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: dlbdeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
index 4d27e2ca..8c492a73 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_dsadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: dsadeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
index bdd39c85..0d10efea 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_fpgadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: fpgadeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
index 813abc6f..0446bd40 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_gpudeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: gpudeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
@@ -55,6 +55,20 @@ spec:
           spec:
             description: GpuDevicePluginSpec defines the desired state of GpuDevicePlugin.
             properties:
+              allowIDs:
+                description: |-
+                  AllowIDs is a comma-separated list of PCI IDs of GPU devices that should only be advertised by the plugin.
+                  If not set, all devices are advertised.
+                  The list can contain IDs in the form of '0x1234,0x49a4,0x50b4'.
+                  Cannot be used together with DenyIDs.
+                type: string
+              denyIDs:
+                description: |-
+                  DenyIDs is a comma-separated list of PCI IDs of GPU devices that should only be denied by the plugin.
+                  If not set, all devices are advertised.
+                  The list can contain IDs in the form of '0x1234,0x49a4,0x50b4'.
+                  Cannot be used together with AllowIDs.
+                type: string
               enableMonitoring:
                 description: |-
                   EnableMonitoring enables the monitoring resource ('i915_monitoring')
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
index 263d9bde..e66d42fd 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_iaadeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: iaadeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_npudeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_npudeviceplugins.yaml
index 45d1fc7e..b9d3f5e7 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_npudeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_npudeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: npudeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
index ace89d8f..8c0c1668 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_qatdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: qatdeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
@@ -83,6 +83,7 @@ spec:
                   - 4xxxvf
                   - 420xxvf
                   - c4xxxvf
+                  - 6xxxvf
                   type: string
                 type: array
               logLevel:
diff --git a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
index f883bd21..a50a2354 100644
--- a/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
+++ b/deployments/operator/crd/bases/deviceplugin.intel.com_sgxdeviceplugins.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: sgxdeviceplugins.deviceplugin.intel.com
 spec:
   group: deviceplugin.intel.com
diff --git a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
index 0a342d6c..239965a9 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_acceleratorfunctions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: acceleratorfunctions.fpga.intel.com
 spec:
   group: fpga.intel.com
diff --git a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
index 4ff32500..45d1a9f0 100644
--- a/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
+++ b/deployments/operator/crd/bases/fpga.intel.com_fpgaregions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.18.0
   name: fpgaregions.fpga.intel.com
 spec:
   group: fpga.intel.com
diff --git a/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml b/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml
deleted file mode 100644
index bb7f7a0e..00000000
--- a/deployments/qat_plugin/base/intel-qat-kernel-plugin.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: intel-qat-kernel-plugin
-  labels:
-    app: intel-qat-kernel-plugin
-spec:
-  selector:
-    matchLabels:
-      app: intel-qat-kernel-plugin
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-  template:
-    metadata:
-      labels:
-        app: intel-qat-kernel-plugin
-    spec:
-      containers:
-      - name: intel-qat-kernel-plugin
-        securityContext:
-          readOnlyRootFilesystem: true
-          allowPrivilegeEscalation: false
-          privileged: true
-        image: intel/intel-qat-plugin:devel
-        imagePullPolicy: IfNotPresent
-        args: ["-mode", "kernel"]
-        volumeMounts:
-        - name: devfs
-          mountPath: /dev
-        - name: etcdir
-          mountPath: /etc
-          readOnly: true
-        - name: kubeletsockets
-          mountPath: /var/lib/kubelet/device-plugins
-      volumes:
-      - name: etcdir
-        hostPath:
-          path: /etc
-      - name: kubeletsockets
-        hostPath:
-          path: /var/lib/kubelet/device-plugins
-      - name: devfs
-        hostPath:
-          path: /dev
-      nodeSelector:
-        kubernetes.io/arch: amd64
diff --git a/go.mod b/go.mod
index d8c0cc63..89686243 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/intel/intel-device-plugins-for-kubernetes
 
-go 1.24.0
+go 1.25.0
 
 require (
 	github.com/fsnotify/fsnotify v1.9.0
diff --git a/pkg/apis/deviceplugin/v1/gpudeviceplugin_types.go b/pkg/apis/deviceplugin/v1/gpudeviceplugin_types.go
index 01eb4d27..c97943c9 100644
--- a/pkg/apis/deviceplugin/v1/gpudeviceplugin_types.go
+++ b/pkg/apis/deviceplugin/v1/gpudeviceplugin_types.go
@@ -34,6 +34,18 @@ type GpuDevicePluginSpec struct {
 	// InitImage is a container image with tools (e.g., GPU NFD source hook) installed on each node.
 	InitImage string `json:"initImage,omitempty"`
 
+	// AllowIDs is a comma-separated list of PCI IDs of GPU devices that should only be advertised by the plugin.
+	// If not set, all devices are advertised.
+	// The list can contain IDs in the form of '0x1234,0x49a4,0x50b4'.
+	// Cannot be used together with DenyIDs.
+	AllowIDs string `json:"allowIDs,omitempty"`
+
+	// DenyIDs is a comma-separated list of PCI IDs of GPU devices that should only be denied by the plugin.
+	// If not set, all devices are advertised.
+	// The list can contain IDs in the form of '0x1234,0x49a4,0x50b4'.
+	// Cannot be used together with AllowIDs.
+	DenyIDs string `json:"denyIDs,omitempty"`
+
 	// PreferredAllocationPolicy sets the mode of allocating GPU devices on a node.
 	// See documentation for detailed description of the policies. Only valid when SharedDevNum > 1 is set.
 	// +kubebuilder:validation:Enum=balanced;packed;none
diff --git a/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go b/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
index 64007dc1..34965461 100644
--- a/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
+++ b/pkg/apis/deviceplugin/v1/gpudeviceplugin_webhook.go
@@ -16,14 +16,20 @@ package v1
 
 import (
 	"fmt"
+	"regexp"
+	"strings"
 
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers"
 )
 
+var pciIDRegex regexp.Regexp
+
 // SetupWebhookWithManager sets up a webhook for GpuDevicePlugin custom resources.
 func (r *GpuDevicePlugin) SetupWebhookWithManager(mgr ctrl.Manager) error {
+	pciIDRegex = *regexp.MustCompile(`^0x[0-9a-f]{4}$`)
+
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(r).
 		WithDefaulter(&commonDevicePluginDefaulter{
@@ -44,5 +50,33 @@ func (r *GpuDevicePlugin) validatePlugin(ref *commonDevicePluginValidator) error
 		return fmt.Errorf("%w: PreferredAllocationPolicy is valid only when setting sharedDevNum > 1", errValidation)
 	}
 
+	if r.Spec.AllowIDs != "" {
+		for id := range strings.SplitSeq(r.Spec.AllowIDs, ",") {
+			if id == "" {
+				return fmt.Errorf("%w: Empty PCI Device ID in AllowIDs", errValidation)
+			}
+
+			if !pciIDRegex.MatchString(id) {
+				return fmt.Errorf("%w: Invalid PCI Device ID: %s", errValidation, id)
+			}
+		}
+	}
+
+	if r.Spec.DenyIDs != "" {
+		for id := range strings.SplitSeq(r.Spec.DenyIDs, ",") {
+			if id == "" {
+				return fmt.Errorf("%w: Empty PCI Device ID in DenyIDs", errValidation)
+			}
+
+			if !pciIDRegex.MatchString(id) {
+				return fmt.Errorf("%w: Invalid PCI Device ID: %s", errValidation, id)
+			}
+		}
+	}
+
+	if len(r.Spec.AllowIDs) > 0 && len(r.Spec.DenyIDs) > 0 {
+		return fmt.Errorf("%w: AllowIDs and DenyIDs cannot be used together", errValidation)
+	}
+
 	return validatePluginImage(r.Spec.Image, ref.expectedImage, &ref.expectedVersion)
 }
diff --git a/pkg/apis/deviceplugin/v1/qatdeviceplugin_types.go b/pkg/apis/deviceplugin/v1/qatdeviceplugin_types.go
index 814911ab..2199889b 100644
--- a/pkg/apis/deviceplugin/v1/qatdeviceplugin_types.go
+++ b/pkg/apis/deviceplugin/v1/qatdeviceplugin_types.go
@@ -21,7 +21,7 @@ import (
 
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
-// +kubebuilder:validation:Enum={"dh895xccvf","c6xxvf","c3xxxvf","d15xxvf","4xxxvf", "420xxvf", "c4xxxvf"}
+// +kubebuilder:validation:Enum={"dh895xccvf","c6xxvf","c3xxxvf","d15xxvf","4xxxvf", "420xxvf", "c4xxxvf", "6xxxvf"}
 
 // KernelVfDriver is a VF device driver for QuickAssist devices.
 type KernelVfDriver string
diff --git a/pkg/controllers/gpu/controller.go b/pkg/controllers/gpu/controller.go
index 810299a3..bc7b68b5 100644
--- a/pkg/controllers/gpu/controller.go
+++ b/pkg/controllers/gpu/controller.go
@@ -277,5 +277,13 @@ func getPodArgs(gdp *devicepluginv1.GpuDevicePlugin) []string {
 		args = append(args, "-allocation-policy", "none")
 	}
 
+	if gdp.Spec.AllowIDs != "" {
+		args = append(args, "-allow-ids", gdp.Spec.AllowIDs)
+	}
+
+	if gdp.Spec.DenyIDs != "" {
+		args = append(args, "-deny-ids", gdp.Spec.DenyIDs)
+	}
+
 	return args
 }
diff --git a/pkg/deviceplugin/server.go b/pkg/deviceplugin/server.go
index ed2cb177..4b28139d 100644
--- a/pkg/deviceplugin/server.go
+++ b/pkg/deviceplugin/server.go
@@ -272,7 +272,9 @@ func (srv *server) setupAndServe(namespace string, devicePluginPath string, kube
 		// We don't care if the plugin's socket file doesn't exist.
 		_ = os.Remove(pluginSocket)
 
-		lis, err := net.Listen("unix", pluginSocket)
+		var lc net.ListenConfig
+
+		lis, err := lc.Listen(context.Background(), "unix", pluginSocket)
 		if err != nil {
 			return errors.Wrap(err, "Failed to listen to plugin socket")
 		}



Test patch:
diff --git a/cmd/gpu_plugin/gpu_plugin_test.go b/cmd/gpu_plugin/gpu_plugin_test.go
index b3b30531..19fcb661 100644
--- a/cmd/gpu_plugin/gpu_plugin_test.go
+++ b/cmd/gpu_plugin/gpu_plugin_test.go
@@ -361,6 +361,93 @@ func TestScan(t *testing.T) {
 			expectedI915Devs:     1,
 			expectedI915Monitors: 1,
 		},
+		{
+			name:      "two devices with only one allowed",
+			sysfsdirs: []string{"card0/device/drm/card0", "card0/device/drm/controlD64", "card1/device/drm/card1"},
+			sysfsfiles: map[string][]byte{
+				"card0/device/vendor": []byte("0x8086"),
+				"card0/device/device": []byte("0x1234"),
+				"card1/device/vendor": []byte("0x8086"),
+				"card1/device/device": []byte("0x9876"),
+			},
+			symlinkfiles: map[string]string{
+				"card0/device/driver": "drivers/xe",
+				"card1/device/driver": "drivers/i915",
+			},
+			devfsdirs: []string{
+				"card0",
+				"by-path/pci-0000:00:00.0-card",
+				"by-path/pci-0000:00:00.0-render",
+				"card1",
+				"by-path/pci-0000:00:01.0-card",
+				"by-path/pci-0000:00:01.0-render",
+			},
+			options:              cliOptions{enableMonitoring: true, allowIDs: "0x1234"},
+			expectedXeDevs:       1,
+			expectedXeMonitors:   1,
+			expectedI915Devs:     0,
+			expectedI915Monitors: 0,
+		},
+		{
+			name:      "three devices with two allowed",
+			sysfsdirs: []string{"card0/device/drm/card0", "card0/device/drm/controlD64", "card1/device/drm/card1", "card2/device/drm/card2"},
+			sysfsfiles: map[string][]byte{
+				"card0/device/vendor": []byte("0x8086"),
+				"card0/device/device": []byte("0x1234"),
+				"card1/device/vendor": []byte("0x8086"),
+				"card1/device/device": []byte("0x9876"),
+				"card2/device/vendor": []byte("0x8086"),
+				"card2/device/device": []byte("0x0101"),
+			},
+			symlinkfiles: map[string]string{
+				"card0/device/driver": "drivers/xe",
+				"card1/device/driver": "drivers/i915",
+				"card2/device/driver": "drivers/i915",
+			},
+			devfsdirs: []string{
+				"card0",
+				"by-path/pci-0000:00:00.0-card",
+				"by-path/pci-0000:00:00.0-render",
+				"card1",
+				"by-path/pci-0000:00:01.0-card",
+				"by-path/pci-0000:00:01.0-render",
+				"card2",
+				"by-path/pci-0000:00:02.0-card",
+				"by-path/pci-0000:00:02.0-render",
+			},
+			options:              cliOptions{enableMonitoring: true, allowIDs: "0x1234,0x9876"},
+			expectedXeDevs:       1,
+			expectedXeMonitors:   1,
+			expectedI915Devs:     1,
+			expectedI915Monitors: 1,
+		},
+		{
+			name:      "two devices with one denied",
+			sysfsdirs: []string{"card0/device/drm/card0", "card0/device/drm/controlD64", "card1/device/drm/card1"},
+			sysfsfiles: map[string][]byte{
+				"card0/device/vendor": []byte("0x8086"),
+				"card0/device/device": []byte("0x1234"),
+				"card1/device/vendor": []byte("0x8086"),
+				"card1/device/device": []byte("0x9876"),
+			},
+			symlinkfiles: map[string]string{
+				"card0/device/driver": "drivers/xe",
+				"card1/device/driver": "drivers/i915",
+			},
+			devfsdirs: []string{
+				"card0",
+				"by-path/pci-0000:00:00.0-card",
+				"by-path/pci-0000:00:00.0-render",
+				"card1",
+				"by-path/pci-0000:00:01.0-card",
+				"by-path/pci-0000:00:01.0-render",
+			},
+			options:              cliOptions{enableMonitoring: true, denyIDs: "0x1234"},
+			expectedXeDevs:       0,
+			expectedXeMonitors:   0,
+			expectedI915Devs:     1,
+			expectedI915Monitors: 1,
+		},
 		{
 			name:      "sriov-1-pf-no-vfs + monitoring",
 			sysfsdirs: []string{"card0/device/drm/card0", "card0/device/drm/controlD64"},
@@ -1048,3 +1135,61 @@ func TestCDIDeviceInclusion(t *testing.T) {
 		t.Error("Invalid count for device (xe)")
 	}
 }
+
+func TestParsePCIDeviceIDs(t *testing.T) {
+	tests := []struct {
+		name      string
+		input     string
+		wantError bool
+	}{
+		{
+			name:      "valid single ID",
+			input:     "0x1234",
+			wantError: false,
+		},
+		{
+			name:      "valid multiple IDs",
+			input:     "0x1234,0x5678,0x9abc",
+			wantError: false,
+		},
+		{
+			name:      "valid IDs with spaces",
+			input:     " 0x1234 , 0x5678 ",
+			wantError: false,
+		},
+		{
+			name:      "empty string",
+			input:     "",
+			wantError: true,
+		},
+		{
+			name:      "invalid ID format",
+			input:     "0x1234,abcd",
+			wantError: true,
+		},
+		{
+			name:      "invalid hex length",
+			input:     "0x123,0x5678",
+			wantError: true,
+		},
+		{
+			name:      "extra comma",
+			input:     "0x1234,",
+			wantError: true,
+		},
+		{
+			name:      "capita hex",
+			input:     "0xAA12,",
+			wantError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validatePCIDeviceIDs(tt.input)
+			if (err != nil) != tt.wantError {
+				t.Errorf("parsePCIDeviceIDs() error = %v, wantError %v", err, tt.wantError)
+			}
+		})
+	}
+}
diff --git a/cmd/gpu_plugin/levelzeroservice/levelzero_service_test.go b/cmd/gpu_plugin/levelzeroservice/levelzero_service_test.go
index 471a4c29..de2a148c 100644
--- a/cmd/gpu_plugin/levelzeroservice/levelzero_service_test.go
+++ b/cmd/gpu_plugin/levelzeroservice/levelzero_service_test.go
@@ -43,7 +43,9 @@ type mockServer struct {
 }
 
 func (m *mockServer) serve(socketPath string) {
-	lis, err := net.Listen("unix", socketPath)
+	var lc net.ListenConfig
+
+	lis, err := lc.Listen(context.Background(), "unix", socketPath)
 	if err != nil {
 		log.Fatalf("failed to listen: %v", err)
 	}
diff --git a/cmd/qat_plugin/dpdkdrv/dpdkdrv_test.go b/cmd/qat_plugin/dpdkdrv/dpdkdrv_test.go
index b60424c2..f2eb5bac 100644
--- a/cmd/qat_plugin/dpdkdrv/dpdkdrv_test.go
+++ b/cmd/qat_plugin/dpdkdrv/dpdkdrv_test.go
@@ -484,6 +484,34 @@ func TestScan(t *testing.T) {
 			maxDevNum:      1,
 			expectedDevNum: 1,
 		},
+		{
+			name:            "vfio-pci DPDKdriver with no kernel bound driver and where vfdevID is equal to qatDevId (4949), PF with decomp capabilities from sysfs",
+			dpdkDriver:      "vfio-pci",
+			kernelVfDrivers: []string{"6xxxvf"},
+			dirs: []string{
+				"sys/bus/pci/drivers/6xxx",
+				"sys/bus/pci/drivers/vfio-pci",
+				"sys/devices/pci0000:02/0000:02:00.0",
+				"sys/devices/pci0000:02/0000:02:00.0/qat",
+				"sys/kernel/debug/qat_6xxx_0000:02:00.0",
+				"sys/bus/pci/devices/0000:02:01.0",
+			},
+			files: map[string][]byte{
+				"sys/devices/pci0000:02/0000:02:00.0/device":           []byte("0x4948"),
+				"sys/devices/pci0000:02/0000:02:00.0/qat/state":        []byte("up"),
+				"sys/devices/pci0000:02/0000:02:00.0/qat/cfg_services": []byte("decomp"),
+				"sys/bus/pci/devices/0000:02:01.0/device":              []byte("0x4949"),
+			},
+			symlinks: map[string]string{
+				"sys/bus/pci/devices/0000:02:01.0/iommu_group": "sys/kernel/iommu_groups/vfiotestfile",
+				"sys/bus/pci/devices/0000:02:01.0/physfn":      "sys/devices/pci0000:02/0000:02:00.0",
+				"sys/bus/pci/drivers/6xxx/0000:02:00.0":        "sys/devices/pci0000:02/0000:02:00.0",
+				"sys/bus/pci/devices/0000:02:00.0":             "sys/devices/pci0000:02/0000:02:00.0",
+				"sys/devices/pci0000:02/0000:02:00.0/virtfn0":  "sys/bus/pci/devices/0000:02:01.0",
+			},
+			maxDevNum:      1,
+			expectedDevNum: 1,
+		},
 		{
 			name:            "vfio-pci DPDKdriver with no kernel bound driver and where vfdevID is equal to qatDevId (4941), two PFs with dc and cy capabilities",
 			dpdkDriver:      "vfio-pci",
diff --git a/pkg/deviceplugin/server_test.go b/pkg/deviceplugin/server_test.go
index d22a7869..02628ef0 100644
--- a/pkg/deviceplugin/server_test.go
+++ b/pkg/deviceplugin/server_test.go
@@ -98,7 +98,9 @@ func (k *kubeletStub) Register(ctx context.Context, r *pluginapi.RegisterRequest
 func (k *kubeletStub) start() error {
 	_ = os.Remove(k.socket)
 
-	s, err := net.Listen("unix", k.socket)
+	var lc net.ListenConfig
+
+	s, err := lc.Listen(context.Background(), "unix", k.socket)
 	if err != nil {
 		return errors.Wrap(err, "Can't listen at the socket")
 	}