From 2439da853b8b26c082845f26a6285b55f1bdfa22 Mon Sep 17 00:00:00 2001
From: Andrew Lukoshko <andrew.lukoshko@gmail.com>
Date: Thu, 7 Aug 2025 10:58:14 +0000
Subject: [PATCH] import OL libvirt-10.10.0-7.6.0.1.el9_6

---
 ...nf-add-deprecated_features-attribute.patch | 280 ++++++
 ...ent-CA-bundle-for-remote-connections.patch | 119 +++
 ...BILITIES_DISABLE_DEPRECATED_FEATURES.patch |  58 ++
 ...m-query-cpu-model-expansion-response.patch | 243 +++++
 ...Expansion-refactor-parsing-functions.patch | 100 ++
 ...ile-Fix-NVRAM-image-conversion-check.patch |  67 ++
 ...ter-deprecated-features-if-requested.patch |  95 ++
 ...y-deprecated-features-for-host-model.patch | 927 ++++++++++++++++++
 ...ted-features-flag-to-domcapabilities.patch |  79 ++
 SPECS/libvirt.spec                            |  32 +-
 10 files changed, 1998 insertions(+), 2 deletions(-)
 create mode 100644 SOURCES/libvirt-conf-add-deprecated_features-attribute.patch
 create mode 100644 SOURCES/libvirt-esx-Allow-specifying-different-CA-bundle-for-remote-connections.patch
 create mode 100644 SOURCES/libvirt-libvirt-domain-introduce-VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES.patch
 create mode 100644 SOURCES/libvirt-qemu-parse-deprecated-props-from-query-cpu-model-expansion-response.patch
 create mode 100644 SOURCES/libvirt-qemuMonitorJSONGetCPUModelExpansion-refactor-parsing-functions.patch
 create mode 100644 SOURCES/libvirt-qemuPrepareNVRAMFile-Fix-NVRAM-image-conversion-check.patch
 create mode 100644 SOURCES/libvirt-qemu_capabilities-filter-deprecated-features-if-requested.patch
 create mode 100644 SOURCES/libvirt-qemu_capabilities-query-deprecated-features-for-host-model.patch
 create mode 100644 SOURCES/libvirt-virsh-add-disable-deprecated-features-flag-to-domcapabilities.patch

diff --git a/SOURCES/libvirt-conf-add-deprecated_features-attribute.patch b/SOURCES/libvirt-conf-add-deprecated_features-attribute.patch
new file mode 100644
index 0000000..15c8fe1
--- /dev/null
+++ b/SOURCES/libvirt-conf-add-deprecated_features-attribute.patch
@@ -0,0 +1,280 @@
+From 1f2939355139bb56af0db6b4d575bc3aa9831394 Mon Sep 17 00:00:00 2001
+Message-ID: <1f2939355139bb56af0db6b4d575bc3aa9831394.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:58 -0500
+Subject: [PATCH] conf: add deprecated_features attribute
+
+Add a new a attribute, deprecated_features='on|off' to the <cpu>
+element.  This is used to toggle features flagged as deprecated on the
+CPU model on or off.  When this attribute is paired with 'on',
+deprecated features will not be filtered.  When paired with 'off', any
+CPU features that are flagged as deprecated will be listed under the
+CPU model with the 'disable' policy.
+
+Example:
+
+  <cpu mode='host-model' check='partial' deprecated_features='off'/>
+
+The absence of this attribute is equivalent to the 'on' option.
+
+The deprecated features that will populate the domain XML are the same
+features that result in the virsh domcapabilities command with the
+--disable-deprecated-features argument present.
+
+It is recommended to define a domain XML with this attribute set to
+'off' to ensure migration to machines that may outright drop these
+features in the future.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 62658bbf060784c757f96c9de3935f27885834aa)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/conf/cpu_conf.c                           | 11 +++++++
+ src/conf/cpu_conf.h                           |  1 +
+ src/conf/schemas/cputypes.rng                 |  5 +++
+ src/qemu/qemu_process.c                       | 11 +++++++
+ ...el-deprecated-features-off.s390x-8.2.0.err |  1 +
+ ...el-deprecated-features-off.s390x-8.2.0.xml | 25 +++++++++++++++
+ ...-deprecated-features-off.s390x-latest.args | 32 +++++++++++++++++++
+ ...l-deprecated-features-off.s390x-latest.xml | 25 +++++++++++++++
+ .../cpu-model-deprecated-features-off.xml     | 15 +++++++++
+ tests/qemuxmlconftest.c                       |  3 ++
+ 10 files changed, 129 insertions(+)
+ create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.err
+ create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.xml
+ create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args
+ create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.xml
+ create mode 100644 tests/qemuxmlconfdata/cpu-model-deprecated-features-off.xml
+
+diff --git a/src/conf/cpu_conf.c b/src/conf/cpu_conf.c
+index dcc164d165..31425783ba 100644
+--- a/src/conf/cpu_conf.c
++++ b/src/conf/cpu_conf.c
+@@ -238,6 +238,7 @@ virCPUDefCopyWithoutModel(const virCPUDef *cpu)
+     copy->mode = cpu->mode;
+     copy->match = cpu->match;
+     copy->check = cpu->check;
++    copy->deprecated_feats = cpu->deprecated_feats;
+     copy->fallback = cpu->fallback;
+     copy->sockets = cpu->sockets;
+     copy->dies = cpu->dies;
+@@ -450,6 +451,11 @@ virCPUDefParseXML(xmlXPathContextPtr ctxt,
+         if (virXMLPropEnum(ctxt->node, "check", virCPUCheckTypeFromString,
+                            VIR_XML_PROP_NONE, &def->check) < 0)
+             return -1;
++
++        if (virXMLPropTristateSwitch(ctxt->node, "deprecated_features",
++                                     VIR_XML_PROP_NONE,
++                                     &def->deprecated_feats) < 0)
++            return -1;
+     }
+ 
+     if (def->type == VIR_CPU_TYPE_HOST) {
+@@ -748,6 +754,11 @@ virCPUDefFormatBufFull(virBuffer *buf,
+             virBufferAsprintf(&attributeBuf, " migratable='%s'",
+                               virTristateSwitchTypeToString(def->migratable));
+         }
++
++        if (def->deprecated_feats) {
++            virBufferAsprintf(&attributeBuf, " deprecated_features='%s'",
++                              virTristateSwitchTypeToString(def->deprecated_feats));
++        }
+     }
+ 
+     /* Format children */
+diff --git a/src/conf/cpu_conf.h b/src/conf/cpu_conf.h
+index f71d942ce6..28e26303ef 100644
+--- a/src/conf/cpu_conf.h
++++ b/src/conf/cpu_conf.h
+@@ -161,6 +161,7 @@ struct _virCPUDef {
+     virCPUMaxPhysAddrDef *addr;
+     virHostCPUTscInfo *tsc;
+     virTristateSwitch migratable; /* for host-passthrough mode */
++    virTristateSwitch deprecated_feats;
+ };
+ 
+ virCPUDef *virCPUDefNew(void);
+diff --git a/src/conf/schemas/cputypes.rng b/src/conf/schemas/cputypes.rng
+index 3a8910e09f..8edf1d14e3 100644
+--- a/src/conf/schemas/cputypes.rng
++++ b/src/conf/schemas/cputypes.rng
+@@ -439,6 +439,11 @@
+       <optional>
+         <ref name="cpuCheck"/>
+       </optional>
++      <optional>
++        <attribute name="deprecated_features">
++          <ref name="virOnOff"/>
++        </attribute>
++      </optional>
+       <optional>
+         <attribute name="migratable">
+           <ref name="virOnOff"/>
+diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
+index c80d7bb6dc..16b8991c3c 100644
+--- a/src/qemu/qemu_process.c
++++ b/src/qemu/qemu_process.c
+@@ -6483,6 +6483,17 @@ qemuProcessUpdateGuestCPU(virDomainDef *def,
+                                 &def->os.arch) < 0)
+         return -1;
+ 
++    if (def->cpu->deprecated_feats &&
++        !virQEMUCapsGet(qemuCaps, QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS)) {
++        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
++                       _("toggling deprecated features for CPU model is unsupported"));
++        return -1;
++    }
++
++    if (def->cpu->deprecated_feats == VIR_TRISTATE_SWITCH_OFF) {
++        virQEMUCapsUpdateCPUDeprecatedFeatures(qemuCaps, def->virtType, def->cpu);
++    }
++
+     return 0;
+ }
+ 
+diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.err b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.err
+new file mode 100644
+index 0000000000..936d1d5a46
+--- /dev/null
++++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.err
+@@ -0,0 +1 @@
++unsupported configuration: toggling deprecated features for CPU model is unsupported
+diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.xml b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.xml
+new file mode 100644
+index 0000000000..e1f7ba3857
+--- /dev/null
++++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-8.2.0.xml
+@@ -0,0 +1,25 @@
++<domain type='kvm'>
++  <name>guest</name>
++  <uuid>22782664-6b93-46bf-9595-317220dd2d1c</uuid>
++  <memory unit='KiB'>219100</memory>
++  <currentMemory unit='KiB'>219100</currentMemory>
++  <vcpu placement='static'>1</vcpu>
++  <os>
++    <type arch='s390x' machine='s390-ccw-virtio-8.2'>hvm</type>
++    <boot dev='hd'/>
++  </os>
++  <cpu mode='host-model' check='partial' deprecated_features='off'/>
++  <clock offset='utc'/>
++  <on_poweroff>destroy</on_poweroff>
++  <on_reboot>restart</on_reboot>
++  <on_crash>destroy</on_crash>
++  <devices>
++    <emulator>/usr/bin/qemu-system-s390x</emulator>
++    <controller type='pci' index='0' model='pci-root'/>
++    <audio id='1' type='none'/>
++    <memballoon model='virtio'>
++      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
++    </memballoon>
++    <panic model='s390'/>
++  </devices>
++</domain>
+diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args
+new file mode 100644
+index 0000000000..ba6e7c5304
+--- /dev/null
++++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.args
+@@ -0,0 +1,32 @@
++LC_ALL=C \
++PATH=/bin \
++HOME=/var/lib/libvirt/qemu/domain--1-guest \
++USER=test \
++LOGNAME=test \
++XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \
++XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \
++XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
++/usr/bin/qemu-system-s390x \
++-name guest=guest,debug-threads=on \
++-S \
++-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \
++-machine s390-ccw-virtio,usb=off,dump-guest-core=off,memory-backend=s390.ram \
++-accel kvm \
++-cpu gen16a-base,nnpa=on,aen=on,cmmnt=on,vxpdeh=on,aefsi=on,diag318=on,csske=off,mepoch=on,msa9=on,msa8=on,msa7=on,msa6=on,msa5=on,msa4=on,msa3=on,msa2=on,msa1=on,sthyi=on,edat=on,ri=on,deflate=on,edat2=on,etoken=on,vx=on,ipter=on,pai=on,paie=on,mepochptff=on,ap=on,vxeh=on,vxpd=on,esop=on,msa9_pckmo=on,vxeh2=on,esort=on,appv=on,apqi=on,apft=on,els=on,iep=on,appvi=on,apqci=on,cte=off,ais=on,bpb=off,ctop=on,gs=on,ppa15=on,zpci=on,rdp=on,sea_esop2=on,beareh=on,te=off,cmm=on,vxpdeh2=on \
++-m size=219136k \
++-object '{"qom-type":"memory-backend-ram","id":"s390.ram","size":224395264}' \
++-overcommit mem-lock=off \
++-smp 1,sockets=1,cores=1,threads=1 \
++-uuid 22782664-6b93-46bf-9595-317220dd2d1c \
++-display none \
++-no-user-config \
++-nodefaults \
++-chardev socket,id=charmonitor,fd=1729,server=on,wait=off \
++-mon chardev=charmonitor,id=monitor,mode=control \
++-rtc base=utc \
++-no-shutdown \
++-boot strict=on \
++-audiodev '{"id":"audio1","driver":"none"}' \
++-device '{"driver":"virtio-balloon-ccw","id":"balloon0","devno":"fe.0.0000"}' \
++-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
++-msg timestamp=on
+diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.xml b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.xml
+new file mode 100644
+index 0000000000..fdd87acb1d
+--- /dev/null
++++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.s390x-latest.xml
+@@ -0,0 +1,25 @@
++<domain type='kvm'>
++  <name>guest</name>
++  <uuid>22782664-6b93-46bf-9595-317220dd2d1c</uuid>
++  <memory unit='KiB'>219100</memory>
++  <currentMemory unit='KiB'>219100</currentMemory>
++  <vcpu placement='static'>1</vcpu>
++  <os>
++    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
++    <boot dev='hd'/>
++  </os>
++  <cpu mode='host-model' check='partial' deprecated_features='off'/>
++  <clock offset='utc'/>
++  <on_poweroff>destroy</on_poweroff>
++  <on_reboot>restart</on_reboot>
++  <on_crash>destroy</on_crash>
++  <devices>
++    <emulator>/usr/bin/qemu-system-s390x</emulator>
++    <controller type='pci' index='0' model='pci-root'/>
++    <audio id='1' type='none'/>
++    <memballoon model='virtio'>
++      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
++    </memballoon>
++    <panic model='s390'/>
++  </devices>
++</domain>
+diff --git a/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.xml b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.xml
+new file mode 100644
+index 0000000000..67950715ec
+--- /dev/null
++++ b/tests/qemuxmlconfdata/cpu-model-deprecated-features-off.xml
+@@ -0,0 +1,15 @@
++<domain type='kvm'>
++  <name>guest</name>
++  <uuid>22782664-6b93-46bf-9595-317220dd2d1c</uuid>
++  <memory unit='KiB'>219100</memory>
++  <currentMemory unit='KiB'>219100</currentMemory>
++  <vcpu placement='static'>1</vcpu>
++  <os>
++    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
++  </os>
++  <cpu mode='host-model' check='partial' deprecated_features='off'/>
++  <clock offset='utc'/>
++  <devices>
++    <emulator>/usr/bin/qemu-system-s390x</emulator>
++  </devices>
++</domain>
+diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
+index 3947f508a2..049ca630a8 100644
+--- a/tests/qemuxmlconftest.c
++++ b/tests/qemuxmlconftest.c
+@@ -2300,6 +2300,9 @@ mymain(void)
+     DO_TEST_CAPS_ARCH_LATEST("cpu-s390-zEC12", "s390x");
+     DO_TEST_CAPS_ARCH_LATEST("cpu-s390-features", "s390x");
+ 
++    DO_TEST_CAPS_ARCH_VER_FAILURE("cpu-model-deprecated-features-off", "s390x", "8.2.0");
++    DO_TEST_CAPS_ARCH_LATEST("cpu-model-deprecated-features-off", "s390x");
++
+     DO_TEST_CAPS_ARCH_LATEST_FULL("cpu-Haswell", "x86_64", ARG_CAPS_HOST_CPU_MODEL, QEMU_CPU_DEF_HASWELL);
+     DO_TEST_CAPS_ARCH_LATEST_FULL("cpu-Haswell2", "x86_64", ARG_CAPS_HOST_CPU_MODEL, QEMU_CPU_DEF_HASWELL);
+     DO_TEST_CAPS_ARCH_LATEST_FULL("cpu-Haswell3", "x86_64", ARG_CAPS_HOST_CPU_MODEL, QEMU_CPU_DEF_HASWELL);
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-esx-Allow-specifying-different-CA-bundle-for-remote-connections.patch b/SOURCES/libvirt-esx-Allow-specifying-different-CA-bundle-for-remote-connections.patch
new file mode 100644
index 0000000..468f8fd
--- /dev/null
+++ b/SOURCES/libvirt-esx-Allow-specifying-different-CA-bundle-for-remote-connections.patch
@@ -0,0 +1,119 @@
+From 018bb4a28e986278bb9a6e8d9bec93cb8047b7ce Mon Sep 17 00:00:00 2001
+Message-ID: <018bb4a28e986278bb9a6e8d9bec93cb8047b7ce.1752834529.git.jdenemar@redhat.com>
+From: Martin Kletzander <mkletzan@redhat.com>
+Date: Mon, 9 Jun 2025 15:40:12 +0200
+Subject: [PATCH] esx: Allow specifying different CA bundle for remote
+ connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add new URI parameter which allows for using non-system CA certificates
+to verify remote peers.
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+Reviewed-by: Ján Tomko <jtomko@redhat.com>
+(cherry picked from commit 6c9a0beeca1c6a54eda5d15ba27925c734d51279)
+
+Resolves: https://issues.redhat.com/browse/RHEL-98292
+
+Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
+---
+ docs/drvesx.rst    | 16 ++++++++++++++--
+ src/esx/esx_util.c |  4 ++++
+ src/esx/esx_util.h |  1 +
+ src/esx/esx_vi.c   |  3 +++
+ 4 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/docs/drvesx.rst b/docs/drvesx.rst
+index 13c2bc37e5..84416562ba 100644
+--- a/docs/drvesx.rst
++++ b/docs/drvesx.rst
+@@ -91,7 +91,7 @@ Multiple parameters are separated by ``&``.
+ 
+ ::
+ 
+-   ?no_verify=1&auto_answer=1&proxy=socks://example-proxy.com:23456
++   ?no_verify=1&auto_answer=1&proxy=socks://example-proxy.com:23456&cacert=certs/ca-bundle.pem
+ 
+ The driver understands the extra parameters shown below.
+ 
+@@ -146,6 +146,16 @@ The driver understands the extra parameters shown below.
+ |                 |                             | ``port`` allows to override |
+ |                 |                             | the default port 1080.      |
+ +-----------------+-----------------------------+-----------------------------+
++| ``cacert``      | Path to a file with one     | The specified file will be  |
++|                 | or more certificates        | used for verifying the      |
++|                 |                             | remote host certificate     |
++|                 |                             | instead of the default      |
++|                 |                             | system one.                 |
++|                 |                             | :since:`Since 11.5.0`.      |
++|                 |                             | Does nothing if             |
++|                 |                             | ``no_verify`` is set        |
++|                 |                             | to ``1``.                   |
+++-----------------+-----------------------------+-----------------------------+
+ 
+ Authentication
+ ~~~~~~~~~~~~~~
+@@ -181,8 +191,10 @@ error like this one:
+ 
+    error: internal error curl_easy_perform() returned an error: Peer certificate cannot be authenticated with known CA certificates (60)
+ 
+-Where are two ways to solve this problem:
++Where are three ways to solve this problem:
+ 
++-  Use the ``cacert`` `Extra parameters`_ to point to a certificate bundle
++   with the CA that signed the SSL certificate used on the ESX server.
+ -  Use the ``no_verify=1`` `Extra parameters`_ to disable server
+    certificate verification.
+ -  Generate new SSL certificates signed by a CA known to your client computer
+diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c
+index cb9638f360..7ee0e5f7c0 100644
+--- a/src/esx/esx_util.c
++++ b/src/esx/esx_util.c
+@@ -135,6 +135,9 @@ esxUtil_ParseUri(esxUtil_ParsedUri **parsedUri, virURI *uri)
+                     goto cleanup;
+                 }
+             }
++        } else if (STRCASEEQ(queryParam->name, "cacert")) {
++            g_clear_pointer(&(*parsedUri)->cacert, g_free);
++            (*parsedUri)->cacert = g_strdup(queryParam->value);
+         } else {
+             VIR_WARN("Ignoring unexpected query parameter '%s'",
+                      queryParam->name);
+@@ -168,6 +171,7 @@ esxUtil_FreeParsedUri(esxUtil_ParsedUri **parsedUri)
+     g_free((*parsedUri)->vCenter);
+     g_free((*parsedUri)->proxy_hostname);
+     g_free((*parsedUri)->path);
++    g_free((*parsedUri)->cacert);
+ 
+     g_free(*parsedUri);
+ }
+diff --git a/src/esx/esx_util.h b/src/esx/esx_util.h
+index 088c943e64..58bc44e744 100644
+--- a/src/esx/esx_util.h
++++ b/src/esx/esx_util.h
+@@ -44,6 +44,7 @@ struct _esxUtil_ParsedUri {
+     char *proxy_hostname;
+     int proxy_port;
+     char *path;
++    char *cacert;
+ };
+ 
+ int esxUtil_ParseUri(esxUtil_ParsedUri **parsedUri, virURI *uri);
+diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c
+index 3ecd406e1d..d49daa5bc6 100644
+--- a/src/esx/esx_vi.c
++++ b/src/esx/esx_vi.c
+@@ -343,6 +343,9 @@ esxVI_CURL_Connect(esxVI_CURL *curl, esxUtil_ParsedUri *parsedUri)
+                          parsedUri->proxy_port);
+     }
+ 
++    if (parsedUri->cacert)
++        curl_easy_setopt(curl->handle, CURLOPT_CAINFO, parsedUri->cacert);
++
+     if (virMutexInit(&curl->lock) < 0) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                        _("Could not initialize CURL mutex"));
+-- 
+2.50.1
diff --git a/SOURCES/libvirt-libvirt-domain-introduce-VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES.patch b/SOURCES/libvirt-libvirt-domain-introduce-VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES.patch
new file mode 100644
index 0000000..7f21f5b
--- /dev/null
+++ b/SOURCES/libvirt-libvirt-domain-introduce-VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES.patch
@@ -0,0 +1,58 @@
+From ac453665a65559a7fb8b88d3f96cc275606ab51f Mon Sep 17 00:00:00 2001
+Message-ID: <ac453665a65559a7fb8b88d3f96cc275606ab51f.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:55 -0500
+Subject: [PATCH] libvirt-domain: introduce
+ VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES
+
+Introduce domain flag used to filter deprecated features from the
+domain's CPU model.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 4e2c8de2047e21d98443944a2bfe94529b269efa)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ include/libvirt/libvirt-domain.h | 12 ++++++++++++
+ src/libvirt-domain.c             |  2 +-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
+index c04b696f03..df13b72f7b 100644
+--- a/include/libvirt/libvirt-domain.h
++++ b/include/libvirt/libvirt-domain.h
+@@ -1491,6 +1491,18 @@ int virDomainMigrateGetMaxSpeed(virDomainPtr domain,
+ int virDomainMigrateStartPostCopy(virDomainPtr domain,
+                                   unsigned int flags);
+ 
++/**
++ * virConnectGetDomainCapabilitiesFlags:
++ *
++ * Domain capabilities flags.
++ *
++ * Since: 11.0.0
++ */
++typedef enum {
++    /* Report host model with deprecated features disabled. (Since: 11.0.0) */
++    VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES = (1 << 0),
++} virConnectGetDomainCapabilitiesFlags;
++
+ char * virConnectGetDomainCapabilities(virConnectPtr conn,
+                                        const char *emulatorbin,
+                                        const char *arch,
+diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
+index 24752a9888..efc26a41d9 100644
+--- a/src/libvirt-domain.c
++++ b/src/libvirt-domain.c
+@@ -12166,7 +12166,7 @@ virDomainSetUserPassword(virDomainPtr dom,
+  * @arch: domain architecture
+  * @machine: machine type
+  * @virttype: virtualization type
+- * @flags: extra flags; not used yet, so callers should always pass 0
++ * @flags: extra flags; bitwise-OR of virConnectGetDomainCapabilitiesFlags
+  *
+  * Prior creating a domain (for instance via virDomainCreateXML
+  * or virDomainDefineXML) it may be suitable to know what the
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-qemu-parse-deprecated-props-from-query-cpu-model-expansion-response.patch b/SOURCES/libvirt-qemu-parse-deprecated-props-from-query-cpu-model-expansion-response.patch
new file mode 100644
index 0000000..6e53037
--- /dev/null
+++ b/SOURCES/libvirt-qemu-parse-deprecated-props-from-query-cpu-model-expansion-response.patch
@@ -0,0 +1,243 @@
+From 0c3803a034e519ee83837a0b24e475fbb2e2bd38 Mon Sep 17 00:00:00 2001
+Message-ID: <0c3803a034e519ee83837a0b24e475fbb2e2bd38.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:53 -0500
+Subject: [PATCH] qemu: parse deprecated-props from query-cpu-model-expansion
+ response
+
+query-cpu-model-expansion may report an array of deprecated properties.
+This array is optional, and may not be supported for a particular
+architecture or reported for a particular CPU model. If the output is
+present, then capture it and store in a qemuMonitorCPUModelInfo struct
+for later use.
+
+The deprecated features will be retained in qemuCaps->kvm->hostCPU.info
+and will be stored in the capabilities cache file under the <hostCPU>
+element using the following format:
+
+        <deprecatedFeatures>
+                <property name='bpb'/>
+                <property name='csske'/>
+                <property name='cte'/>
+                <property name='te'/>
+        </deprecatedFeatures>
+
+At this time the data is only queried, parsed, and cached.  The data
+will be utilized in a subsequent patch.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 45140d293007c1b29f7563bf6ee9640e27769b96)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/qemu/qemu_capabilities.c                  | 31 +++++++++++++++++++
+ src/qemu/qemu_monitor.c                       |  3 ++
+ src/qemu/qemu_monitor.h                       |  1 +
+ src/qemu/qemu_monitor_json.c                  | 18 +++++++++++
+ .../qemucapabilitiesdata/caps_9.1.0_s390x.xml |  6 ++++
+ .../qemucapabilitiesdata/caps_9.2.0_s390x.xml |  6 ++++
+ 6 files changed, 65 insertions(+)
+
+diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
+index 65e19965dd..50df7aeaf7 100644
+--- a/src/qemu/qemu_capabilities.c
++++ b/src/qemu/qemu_capabilities.c
+@@ -4021,6 +4021,7 @@ virQEMUCapsLoadHostCPUModelInfo(virQEMUCapsAccel *caps,
+                                 const char *typeStr)
+ {
+     xmlNodePtr hostCPUNode;
++    xmlNodePtr deprecated_props;
+     g_autofree xmlNodePtr *nodes = NULL;
+     VIR_XPATH_NODE_AUTORESTORE(ctxt)
+     g_autoptr(qemuMonitorCPUModelInfo) hostCPU = NULL;
+@@ -4113,6 +4114,24 @@ virQEMUCapsLoadHostCPUModelInfo(virQEMUCapsAccel *caps,
+         }
+     }
+ 
++    ctxt->node = hostCPUNode;
++
++    if ((deprecated_props = virXPathNode("./deprecatedFeatures", ctxt))) {
++        g_autoptr(GPtrArray) props = virXMLNodeGetSubelementList(deprecated_props, NULL);
++
++        hostCPU->deprecated_props = g_new0(char *, props->len + 1);
++
++        for (i = 0; i < props->len; i++) {
++            xmlNodePtr prop = g_ptr_array_index(props, i);
++
++            if (!(hostCPU->deprecated_props[i] = virXMLPropString(prop, "name"))) {
++                virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
++                               _("missing 'name' attribute for a host CPU model deprecated property in QEMU capabilities cache"));
++                return -1;
++            }
++        }
++    }
++
+     caps->hostCPU.info = g_steal_pointer(&hostCPU);
+     return 0;
+ }
+@@ -4845,6 +4864,18 @@ virQEMUCapsFormatHostCPUModelInfo(virQEMUCapsAccel *caps,
+         virBufferAddLit(buf, "/>\n");
+     }
+ 
++    if (model->deprecated_props) {
++        virBufferAddLit(buf, "<deprecatedFeatures>\n");
++        virBufferAdjustIndent(buf, 2);
++
++        for (i = 0; i < g_strv_length(model->deprecated_props); i++)
++            virBufferAsprintf(buf, "<property name='%s'/>\n",
++                              model->deprecated_props[i]);
++
++        virBufferAdjustIndent(buf, -2);
++        virBufferAddLit(buf, "</deprecatedFeatures>\n");
++    }
++
+     virBufferAdjustIndent(buf, -2);
+     virBufferAddLit(buf, "</hostCPU>\n");
+ }
+diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
+index ed63b7a29b..3945aa92e5 100644
+--- a/src/qemu/qemu_monitor.c
++++ b/src/qemu/qemu_monitor.c
+@@ -3319,6 +3319,7 @@ qemuMonitorCPUModelInfoFree(qemuMonitorCPUModelInfo *model_info)
+             g_free(model_info->props[i].value.string);
+     }
+ 
++    g_strfreev(model_info->deprecated_props);
+     g_free(model_info->props);
+     g_free(model_info->name);
+     g_free(model_info);
+@@ -3363,6 +3364,8 @@ qemuMonitorCPUModelInfoCopy(const qemuMonitorCPUModelInfo *orig)
+         }
+     }
+ 
++    copy->deprecated_props = g_strdupv(orig->deprecated_props);
++
+     return copy;
+ }
+ 
+diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
+index bcb39409ac..acb3279e45 100644
+--- a/src/qemu/qemu_monitor.h
++++ b/src/qemu/qemu_monitor.h
+@@ -1160,6 +1160,7 @@ struct _qemuMonitorCPUModelInfo {
+     char *name;
+     size_t nprops;
+     qemuMonitorCPUProperty *props;
++    GStrv deprecated_props;
+     bool migratability;
+ };
+ 
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index 5df32922fb..edf6fac76e 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -5130,6 +5130,7 @@ qemuMonitorJSONParseCPUModelExpansionData(virJSONValue *data,
+                                           bool fail_no_props,
+                                           virJSONValue **cpu_model,
+                                           virJSONValue **cpu_props,
++                                          virJSONValue **cpu_deprecated_props,
+                                           const char **cpu_name)
+ {
+     if (qemuMonitorJSONParseCPUModelData(data, "query-cpu-model-expansion",
+@@ -5137,6 +5138,12 @@ qemuMonitorJSONParseCPUModelExpansionData(virJSONValue *data,
+                                          cpu_name) < 0)
+         return -1;
+ 
++    /*
++     * Unconditionally check for the deprecated-props array, as
++     * it is not a guarantee response even if QEMU supports it.
++     */
++    *cpu_deprecated_props = virJSONValueObjectGetArray(data, "deprecated-props");
++
+     return 0;
+ }
+ 
+@@ -5144,6 +5151,7 @@ qemuMonitorJSONParseCPUModelExpansionData(virJSONValue *data,
+ static int
+ qemuMonitorJSONParseCPUModelExpansion(const char *cpu_name,
+                                       virJSONValue *cpu_props,
++                                      virJSONValue *cpu_deprecated_props,
+                                       qemuMonitorCPUModelInfo **model_info)
+ {
+     g_autoptr(qemuMonitorCPUModelInfo) expanded_model = NULL;
+@@ -5151,6 +5159,12 @@ qemuMonitorJSONParseCPUModelExpansion(const char *cpu_name,
+     if (qemuMonitorJSONParseCPUModel(cpu_name, cpu_props, &expanded_model) < 0)
+         return -1;
+ 
++    if (cpu_deprecated_props &&
++        virJSONValueArraySize(cpu_deprecated_props) &&
++        (!(expanded_model->deprecated_props = virJSONValueArrayToStringList(cpu_deprecated_props)))) {
++        return -1;
++    }
++
+     *model_info = g_steal_pointer(&expanded_model);
+     return 0;
+ }
+@@ -5215,6 +5229,7 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitor *mon,
+     g_autoptr(virJSONValue) fullData = NULL;
+     virJSONValue *cpu_model;
+     virJSONValue *cpu_props = NULL;
++    virJSONValue *cpu_deprecated_props = NULL;
+     const char *cpu_name = "";
+     int rc;
+ 
+@@ -5228,6 +5243,7 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitor *mon,
+ 
+     if (qemuMonitorJSONParseCPUModelExpansionData(data, fail_no_props,
+                                                   &cpu_model, &cpu_props,
++                                                  &cpu_deprecated_props,
+                                                   &cpu_name) < 0)
+         return -1;
+ 
+@@ -5246,11 +5262,13 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitor *mon,
+ 
+         if (qemuMonitorJSONParseCPUModelExpansionData(fullData, fail_no_props,
+                                                       &cpu_model, &cpu_props,
++                                                      &cpu_deprecated_props,
+                                                       &cpu_name) < 0)
+             return -1;
+     }
+ 
+     return qemuMonitorJSONParseCPUModelExpansion(cpu_name, cpu_props,
++                                                 cpu_deprecated_props,
+                                                  model_info);
+ }
+ 
+diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
+index 50e9a60a1f..5e8db88e52 100644
+--- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
++++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
+@@ -193,6 +193,12 @@
+     <property name='te' type='boolean' value='true'/>
+     <property name='cmm' type='boolean' value='true'/>
+     <property name='vxpdeh2' type='boolean' value='true'/>
++    <deprecatedFeatures>
++      <property name='bpb'/>
++      <property name='te'/>
++      <property name='cte'/>
++      <property name='csske'/>
++    </deprecatedFeatures>
+   </hostCPU>
+   <cpu type='kvm' name='z13' typename='z13-s390x-cpu' usable='yes'/>
+   <cpu type='kvm' name='z990.3' typename='z990.3-s390x-cpu' usable='yes'/>
+diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
+index 6d4f6726fb..79a149d187 100644
+--- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
++++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
+@@ -196,6 +196,12 @@
+     <property name='te' type='boolean' value='true'/>
+     <property name='cmm' type='boolean' value='true'/>
+     <property name='vxpdeh2' type='boolean' value='true'/>
++    <deprecatedFeatures>
++      <property name='bpb'/>
++      <property name='te'/>
++      <property name='cte'/>
++      <property name='csske'/>
++    </deprecatedFeatures>
+   </hostCPU>
+   <cpu type='kvm' name='z13' typename='z13-s390x-cpu' usable='yes'/>
+   <cpu type='kvm' name='z990.3' typename='z990.3-s390x-cpu' usable='yes'/>
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-qemuMonitorJSONGetCPUModelExpansion-refactor-parsing-functions.patch b/SOURCES/libvirt-qemuMonitorJSONGetCPUModelExpansion-refactor-parsing-functions.patch
new file mode 100644
index 0000000..e704ad1
--- /dev/null
+++ b/SOURCES/libvirt-qemuMonitorJSONGetCPUModelExpansion-refactor-parsing-functions.patch
@@ -0,0 +1,100 @@
+From f8d0bc9f59fbf4f7968e65bbbc7094699a495f84 Mon Sep 17 00:00:00 2001
+Message-ID: <f8d0bc9f59fbf4f7968e65bbbc7094699a495f84.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:52 -0500
+Subject: [PATCH] qemuMonitorJSONGetCPUModelExpansion: refactor parsing
+ functions
+
+Refactor the CPU Model parsing functions within
+qemuMonitorJSONGetCPUModelExpansion.  The new functions,
+qemuMonitorJSONParseCPUModelExpansionData and
+qemuMonitorJSONParseCPUModelExpansion invoke the functions they
+replace and leave room for a subsequent patch to handle parsing the
+(optional) deprecated_props field resulting from the command.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 60e407deb5cd88e5f1564d1c9145e374001cf34f)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/qemu/qemu_monitor_json.c | 46 ++++++++++++++++++++++++++++++------
+ 1 file changed, 39 insertions(+), 7 deletions(-)
+
+diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
+index be5d3be7e6..5df32922fb 100644
+--- a/src/qemu/qemu_monitor_json.c
++++ b/src/qemu/qemu_monitor_json.c
+@@ -5125,6 +5125,37 @@ qemuMonitorJSONParseCPUModel(const char *cpu_name,
+ }
+ 
+ 
++static int
++qemuMonitorJSONParseCPUModelExpansionData(virJSONValue *data,
++                                          bool fail_no_props,
++                                          virJSONValue **cpu_model,
++                                          virJSONValue **cpu_props,
++                                          const char **cpu_name)
++{
++    if (qemuMonitorJSONParseCPUModelData(data, "query-cpu-model-expansion",
++                                         fail_no_props, cpu_model, cpu_props,
++                                         cpu_name) < 0)
++        return -1;
++
++    return 0;
++}
++
++
++static int
++qemuMonitorJSONParseCPUModelExpansion(const char *cpu_name,
++                                      virJSONValue *cpu_props,
++                                      qemuMonitorCPUModelInfo **model_info)
++{
++    g_autoptr(qemuMonitorCPUModelInfo) expanded_model = NULL;
++
++    if (qemuMonitorJSONParseCPUModel(cpu_name, cpu_props, &expanded_model) < 0)
++        return -1;
++
++    *model_info = g_steal_pointer(&expanded_model);
++    return 0;
++}
++
++
+ static int
+ qemuMonitorJSONQueryCPUModelExpansionOne(qemuMonitor *mon,
+                                          qemuMonitorCPUModelExpansionType type,
+@@ -5195,9 +5226,9 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitor *mon,
+     if ((rc = qemuMonitorJSONQueryCPUModelExpansionOne(mon, type, &model, &data)) <= 0)
+         return rc;
+ 
+-    if (qemuMonitorJSONParseCPUModelData(data, "query-cpu-model-expansion",
+-                                         fail_no_props, &cpu_model, &cpu_props,
+-                                         &cpu_name) < 0)
++    if (qemuMonitorJSONParseCPUModelExpansionData(data, fail_no_props,
++                                                  &cpu_model, &cpu_props,
++                                                  &cpu_name) < 0)
+         return -1;
+ 
+     /* QEMU_MONITOR_CPU_MODEL_EXPANSION_STATIC_FULL requests "full" expansion
+@@ -5213,13 +5244,14 @@ qemuMonitorJSONGetCPUModelExpansion(qemuMonitor *mon,
+         if ((rc = qemuMonitorJSONQueryCPUModelExpansionOne(mon, type, &fullModel, &fullData)) <= 0)
+             return rc;
+ 
+-        if (qemuMonitorJSONParseCPUModelData(fullData, "query-cpu-model-expansion",
+-                                             fail_no_props, &cpu_model, &cpu_props,
+-                                             &cpu_name) < 0)
++        if (qemuMonitorJSONParseCPUModelExpansionData(fullData, fail_no_props,
++                                                      &cpu_model, &cpu_props,
++                                                      &cpu_name) < 0)
+             return -1;
+     }
+ 
+-    return qemuMonitorJSONParseCPUModel(cpu_name, cpu_props, model_info);
++    return qemuMonitorJSONParseCPUModelExpansion(cpu_name, cpu_props,
++                                                 model_info);
+ }
+ 
+ 
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-qemuPrepareNVRAMFile-Fix-NVRAM-image-conversion-check.patch b/SOURCES/libvirt-qemuPrepareNVRAMFile-Fix-NVRAM-image-conversion-check.patch
new file mode 100644
index 0000000..b908010
--- /dev/null
+++ b/SOURCES/libvirt-qemuPrepareNVRAMFile-Fix-NVRAM-image-conversion-check.patch
@@ -0,0 +1,67 @@
+From 164d32e435c715b71b0d604d3f4e2d09ceb52bac Mon Sep 17 00:00:00 2001
+Message-ID: <164d32e435c715b71b0d604d3f4e2d09ceb52bac.1750849847.git.jdenemar@redhat.com>
+From: Peter Krempa <pkrempa@redhat.com>
+Date: Fri, 28 Feb 2025 14:00:23 +0100
+Subject: [PATCH] qemuPrepareNVRAMFile: Fix NVRAM image conversion check
+
+In case when user provides custom paths (those not covered by the JSON
+firmware descriptor files or  the default locations) for the
+loader and nvram template no auto-detection will be performed and user's
+config will be taken at face value. Historically when 'templateFormat'
+didn't exist we assumed that the 'format' field covers both.
+
+Thus if 'templateFormat' is VIR_STORAGE_FILE_NONE we need to skip the
+check forbidding image format conversion for 'file' backed to avoid
+breaking legacy configs with manual/non-detected format assuming that
+user picked the correct format.
+
+Add a comment to the declaration of 'nvramTemplateFormat' noting the
+above for future reference.
+
+Resolves: https://issues.redhat.com/browse/RHEL-81731
+Fixes: 2aa644a2fc8
+Signed-off-by: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit e088895a6246ac3b7f160e1895f2940c4b13b0cc)
+https://issues.redhat.com/browse/RHEL-97757
+---
+ src/conf/domain_conf.h  | 7 +++++++
+ src/qemu/qemu_process.c | 5 ++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
+index 2d38e8fa51..10b00e2403 100644
+--- a/src/conf/domain_conf.h
++++ b/src/conf/domain_conf.h
+@@ -2361,6 +2361,13 @@ struct _virDomainLoaderDef {
+     virStorageSource *nvram;
+     bool newStyleNVRAM;
+     char *nvramTemplate;   /* user override of path to master nvram */
++    /* Historically it was assumed that the format of the template and the
++     * actual nvram image are identical, which is no longer true.
++     *
++     * Note: if 'nvramTemplate' comes from the user and is not overriden by
++     * auto-detection nvramTemplateFormat may be VIR_STORAGE_FILE_NONE. Code
++     * shall assume that the template format matches if it isn't provided.
++     */
+     virStorageFileFormat nvramTemplateFormat;
+ };
+ 
+diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
+index 16b8991c3c..8bddb415ac 100644
+--- a/src/qemu/qemu_process.c
++++ b/src/qemu/qemu_process.c
+@@ -4727,7 +4727,10 @@ qemuPrepareNVRAMFile(virQEMUDriver *driver,
+         return -1;
+     }
+ 
+-    if (loader->nvram->format != loader->nvramTemplateFormat) {
++    /* If 'nvramTemplateFormat' is empty it means that it's a user-provided
++     * template which we couldn't verify. Assume the user knows what they're doing */
++    if (loader->nvramTemplateFormat != VIR_STORAGE_FILE_NONE &&
++        loader->nvram->format != loader->nvramTemplateFormat) {
+         virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
+                        _("conversion of the nvram template to another target format is not supported"));
+         return -1;
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-qemu_capabilities-filter-deprecated-features-if-requested.patch b/SOURCES/libvirt-qemu_capabilities-filter-deprecated-features-if-requested.patch
new file mode 100644
index 0000000..2c74dd8
--- /dev/null
+++ b/SOURCES/libvirt-qemu_capabilities-filter-deprecated-features-if-requested.patch
@@ -0,0 +1,95 @@
+From 100a38a10efa35bc78ae4874f10bca79616fac18 Mon Sep 17 00:00:00 2001
+Message-ID: <100a38a10efa35bc78ae4874f10bca79616fac18.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:56 -0500
+Subject: [PATCH] qemu_capabilities: filter deprecated features if requested
+
+If flag VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES
+is passed to qemuConnectGetDomainCapabilities, then the domain's CPU
+model features will be updated to set any deprecated features to the
+'disabled' policy.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit cd1e837c22182dcadfe17b469c931f9fc9745a46)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/qemu/qemu_capabilities.c | 20 ++++++++++++++++++++
+ src/qemu/qemu_capabilities.h |  3 +++
+ src/qemu/qemu_driver.c       |  8 +++++++-
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
+index 30af8721ee..651a4e7e54 100644
+--- a/src/qemu/qemu_capabilities.c
++++ b/src/qemu/qemu_capabilities.c
+@@ -3334,6 +3334,26 @@ virQEMUCapsGetCPUFeatures(virQEMUCaps *qemuCaps,
+ }
+ 
+ 
++void
++virQEMUCapsUpdateCPUDeprecatedFeatures(virQEMUCaps *qemuCaps,
++                                       virDomainVirtType virtType,
++                                       virCPUDef *cpu)
++{
++    qemuMonitorCPUModelInfo *modelInfo;
++    size_t i;
++
++    modelInfo = virQEMUCapsGetCPUModelInfo(qemuCaps, virtType);
++
++    if (!modelInfo || !modelInfo->deprecated_props)
++        return;
++
++    for (i = 0; i < g_strv_length(modelInfo->deprecated_props); i++) {
++        virCPUDefUpdateFeature(cpu, modelInfo->deprecated_props[i],
++                               VIR_CPU_FEATURE_DISABLE);
++    }
++}
++
++
+ struct tpmTypeToCaps {
+     int type;
+     virQEMUCapsFlags caps;
+diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
+index b37f1f0b14..c4b0229f0b 100644
+--- a/src/qemu/qemu_capabilities.h
++++ b/src/qemu/qemu_capabilities.h
+@@ -767,6 +767,9 @@ int virQEMUCapsGetCPUFeatures(virQEMUCaps *qemuCaps,
+                               virDomainVirtType virtType,
+                               bool migratable,
+                               char ***features);
++void virQEMUCapsUpdateCPUDeprecatedFeatures(virQEMUCaps *qemuCaps,
++                                            virDomainVirtType virtType,
++                                            virCPUDef *cpu);
+ 
+ virDomainVirtType virQEMUCapsGetVirtType(virQEMUCaps *qemuCaps);
+ 
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index 3e194999fe..e31c4e613c 100644
+--- a/src/qemu/qemu_driver.c
++++ b/src/qemu/qemu_driver.c
+@@ -16543,7 +16543,8 @@ qemuConnectGetDomainCapabilities(virConnectPtr conn,
+     virDomainVirtType virttype;
+     g_autoptr(virDomainCaps) domCaps = NULL;
+ 
+-    virCheckFlags(0, NULL);
++    virCheckFlags(VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES,
++                  NULL);
+ 
+     if (virConnectGetDomainCapabilitiesEnsureACL(conn) < 0)
+         return NULL;
+@@ -16562,6 +16563,11 @@ qemuConnectGetDomainCapabilities(virConnectPtr conn,
+                                                        arch, virttype)))
+         return NULL;
+ 
++    if (flags & VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES) {
++        virQEMUCapsUpdateCPUDeprecatedFeatures(qemuCaps, virttype,
++                                               domCaps->cpu.hostModel);
++    }
++
+     return virDomainCapsFormat(domCaps);
+ }
+ 
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-qemu_capabilities-query-deprecated-features-for-host-model.patch b/SOURCES/libvirt-qemu_capabilities-query-deprecated-features-for-host-model.patch
new file mode 100644
index 0000000..d09338e
--- /dev/null
+++ b/SOURCES/libvirt-qemu_capabilities-query-deprecated-features-for-host-model.patch
@@ -0,0 +1,927 @@
+From 9da8c1095b227097dc71f48da3caa7e172597c36 Mon Sep 17 00:00:00 2001
+Message-ID: <9da8c1095b227097dc71f48da3caa7e172597c36.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:54 -0500
+Subject: [PATCH] qemu_capabilities: query deprecated features for host-model
+
+Add QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS for detecting
+if query-cpu-model-expansion can report deprecated CPU model properties.
+QEMU introduced this capability in 9.1 release.  Add flag and deprecated
+features to the capabilities test data for QEMU 9.1 and 9.2 replies/XML
+since it can now be accounted for.
+
+When probing for the host CPU, perform a full CPU model expansion to
+retrieve the list of features deprecated across the entire architecture.
+The list and count are stored in the host's CPU model info within the
+QEMU capabilities.  Other info resulting from this query (e.g. model
+name, etc) is ignored.
+
+The new capabilities flag is used to fence off the extra query for
+architectures/QEMU binaries that do not report deprecated CPU model
+features.
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 51c098347d7f2af9b4386ac0adc4431997d06f3d)
+
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Conflicts:
+    src/qemu/qemu_capabilities.*
+    (contextual conflict due to earlier out-of-order backport)
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ src/qemu/qemu_capabilities.c                  |  40 ++
+ src/qemu/qemu_capabilities.h                  |   3 +
+ .../caps_9.1.0_s390x.replies                  | 348 +++++++++++++++++-
+ .../qemucapabilitiesdata/caps_9.1.0_s390x.xml |   7 +
+ .../caps_9.2.0_s390x.replies                  | 348 +++++++++++++++++-
+ .../qemucapabilitiesdata/caps_9.2.0_s390x.xml |   7 +
+ 6 files changed, 749 insertions(+), 4 deletions(-)
+
+diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
+index 50df7aeaf7..30af8721ee 100644
+--- a/src/qemu/qemu_capabilities.c
++++ b/src/qemu/qemu_capabilities.c
+@@ -721,6 +721,9 @@ VIR_ENUM_IMPL(virQEMUCaps,
+               "chardev-reconnect-miliseconds", /* QEMU_CAPS_CHARDEV_RECONNECT_MILISECONDS */
+               "virtio-ccw.loadparm", /* QEMU_CAPS_VIRTIO_CCW_DEVICE_LOADPARM */
+               "netdev-stream-reconnect-miliseconds", /* QEMU_CAPS_NETDEV_STREAM_RECONNECT_MILISECONDS */
++              "query-cpu-model-expansion.deprecated-props", /* QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS */
++
++              /* 470 */
+               "blockdev-set-active", /* QEMU_CAPS_BLOCKDEV_SET_ACTIVE */
+     );
+ 
+@@ -1596,6 +1599,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsQMPSchemaQueries[] = {
+     { "screendump/arg-type/device", QEMU_CAPS_SCREENDUMP_DEVICE },
+     { "screendump/arg-type/format/^png", QEMU_CAPS_SCREENSHOT_FORMAT_PNG },
+     { "set-numa-node/arg-type/+hmat-lb", QEMU_CAPS_NUMA_HMAT },
++    { "query-cpu-model-expansion/ret-type/deprecated-props", QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS },
+ };
+ 
+ typedef struct _virQEMUCapsObjectTypeProps virQEMUCapsObjectTypeProps;
+@@ -3152,6 +3156,38 @@ virQEMUCapsProbeHypervCapabilities(virQEMUCaps *qemuCaps,
+ }
+ 
+ 
++/**
++ * virQEMUCapsProbeFullDeprecatedProperties
++ * @mon: QEMU monitor
++ * @cpu: CPU definition to be expanded
++ * @props: the array to be filled with deprecated features
++ *
++ * Performs a full CPU model expansion to retrieve an array of deprecated
++ * properties. If the expansion succeeds, then data previously stored in
++ * @props is freed.
++ *
++ * Returns: -1 if the expansion failed; otherwise 0.
++ */
++static int
++virQEMUCapsProbeFullDeprecatedProperties(qemuMonitor *mon,
++                                         virCPUDef *cpu,
++                                         GStrv *props)
++{
++    g_autoptr(qemuMonitorCPUModelInfo) propsInfo = NULL;
++
++    if (qemuMonitorGetCPUModelExpansion(mon, QEMU_MONITOR_CPU_MODEL_EXPANSION_FULL,
++                                        cpu, true, false, false, &propsInfo) < 0)
++        return -1;
++
++    if (propsInfo && propsInfo->deprecated_props) {
++        g_free(*props);
++        *props = g_steal_pointer(&propsInfo->deprecated_props);
++    }
++
++    return 0;
++}
++
++
+ static int
+ virQEMUCapsProbeQMPHostCPU(virQEMUCaps *qemuCaps,
+                            virQEMUCapsAccel *accel,
+@@ -3233,6 +3269,10 @@ virQEMUCapsProbeQMPHostCPU(virQEMUCaps *qemuCaps,
+         modelInfo->migratability = true;
+     }
+ 
++    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS) &&
++        virQEMUCapsProbeFullDeprecatedProperties(mon, cpu, &modelInfo->deprecated_props) < 0)
++        return -1;
++
+     if (virQEMUCapsTypeIsAccelerated(virtType) &&
+         (ARCH_IS_X86(qemuCaps->arch) || ARCH_IS_ARM(qemuCaps->arch))) {
+         g_autoptr(qemuMonitorCPUModelInfo) fullQEMU = NULL;
+diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
+index e93e6a01cc..b37f1f0b14 100644
+--- a/src/qemu/qemu_capabilities.h
++++ b/src/qemu/qemu_capabilities.h
+@@ -700,6 +700,9 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
+     QEMU_CAPS_CHARDEV_RECONNECT_MILISECONDS, /* 'reconnect-ms' option for chardevs supported */
+     QEMU_CAPS_VIRTIO_CCW_DEVICE_LOADPARM, /* loadparm available on CCW device for multi device boot */
+     QEMU_CAPS_NETDEV_STREAM_RECONNECT_MILISECONDS, /* 'reconnect-ms' option for netdev stream supported */
++    QEMU_CAPS_QUERY_CPU_MODEL_EXPANSION_DEPRECATED_PROPS, /* query-cpu-model-expansion may report deprecated CPU properties */
++
++    /* 470 */
+     QEMU_CAPS_BLOCKDEV_SET_ACTIVE, /* blockdev-set-active QMP command supported */
+ 
+     QEMU_CAPS_LAST /* this must always be the last item */
+diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies
+index 2d4ab8ed75..0a523ba47e 100644
+--- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies
++++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.replies
+@@ -32252,6 +32252,89 @@
+   "id": "libvirt-40"
+ }
+ 
++{
++  "execute": "query-cpu-model-expansion",
++  "arguments": {
++    "type": "full",
++    "model": {
++      "name": "host"
++    }
++  },
++  "id": "libvirt-41"
++}
++
++{
++  "return": {
++    "deprecated-props": [
++      "bpb",
++      "te",
++      "cte",
++      "csske"
++    ],
++    "model": {
++      "name": "gen16a-base",
++      "props": {
++        "nnpa": true,
++        "aen": true,
++        "cmmnt": true,
++        "vxpdeh": true,
++        "aefsi": true,
++        "diag318": true,
++        "csske": true,
++        "mepoch": true,
++        "msa9": true,
++        "msa8": true,
++        "msa7": true,
++        "msa6": true,
++        "msa5": true,
++        "msa4": true,
++        "msa3": true,
++        "msa2": true,
++        "msa1": true,
++        "sthyi": true,
++        "edat": true,
++        "ri": true,
++        "deflate": true,
++        "edat2": true,
++        "etoken": true,
++        "vx": true,
++        "ipter": true,
++        "pai": true,
++        "paie": true,
++        "mepochptff": true,
++        "ap": true,
++        "vxeh": true,
++        "vxpd": true,
++        "esop": true,
++        "msa9_pckmo": true,
++        "vxeh2": true,
++        "esort": true,
++        "appv": true,
++        "apqi": true,
++        "apft": true,
++        "els": true,
++        "iep": true,
++        "appvi": true,
++        "apqci": true,
++        "cte": true,
++        "ais": true,
++        "bpb": true,
++        "ctop": true,
++        "gs": true,
++        "ppa15": true,
++        "zpci": true,
++        "rdp": true,
++        "sea_esop2": true,
++        "beareh": true,
++        "te": true,
++        "cmm": true,
++        "vxpdeh2": true
++      }
++    }
++  },
++  "id": "libvirt-41"
++}
++
+ {
+   "execute": "qmp_capabilities",
+   "id": "libvirt-1"
+@@ -36262,10 +36345,271 @@
+ }
+ 
+ {
+-  "execute": "query-machines",
++  "execute": "query-cpu-model-expansion",
++  "arguments": {
++    "type": "full",
++    "model": {
++      "name": "max"
++    }
++  },
+   "id": "libvirt-4"
+ }
+ 
++{
++  "return": {
++    "deprecated-props": [
++      "bpb",
++      "te",
++      "cte",
++      "csske"
++    ],
++    "model": {
++      "name": "gen15a-base",
++      "props": {
++        "pfmfi": false,
++        "exrl": true,
++        "stfle45": true,
++        "kmctr-etdea-192": false,
++        "kmctr-etdea-128": false,
++        "nnpa": false,
++        "cmma": false,
++        "dateh2": false,
++        "gen13ptff": false,
++        "aen": true,
++        "kmo-etdea-192": false,
++        "kmf-etdea-192": false,
++        "kmc-etdea-192": false,
++        "kmac-tdea-192": false,
++        "kimd-sha-512": true,
++        "dateh": true,
++        "km-aes-256": false,
++        "km-aes-192": false,
++        "kmctr-aes-256": false,
++        "kma-gcm-eaes-192": false,
++        "kmo-tdea-192": false,
++        "kmf-tdea-192": false,
++        "kmctr-tdea-192": false,
++        "kmctr-tdea-128": false,
++        "km-etdea-192": false,
++        "kmc-tdea-192": false,
++        "cmmnt": false,
++        "iacc2": true,
++        "parseh": false,
++        "klmd-sha-512": true,
++        "kma-gcm-eaes-128": false,
++        "csst": true,
++        "pcc-xts-aes-256": false,
++        "pcc-xts-aes-128": false,
++        "pckmo-aes-128": false,
++        "idter": false,
++        "idtes": true,
++        "prno-trng-qrtcr": false,
++        "pcc-cmac-eaes-128": false,
++        "vxpdeh": false,
++        "aefsi": true,
++        "pckmo-etdea-192": false,
++        "pckmo-etdea-128": false,
++        "diag318": false,
++        "pcc-cmac-eaes-256": false,
++        "msa-base": true,
++        "pcc-cmac-etdea-192": false,
++        "hpma2": false,
++        "kmctr-eaes-256": false,
++        "csske": false,
++        "csst2": true,
++        "mepoch": false,
++        "msa9": false,
++        "msa6": false,
++        "msa1": false,
++        "kmctr-aes-192": false,
++        "pckmo-aes-256": false,
++        "sthyi": false,
++        "stckf": true,
++        "stfle": true,
++        "edat": false,
++        "etf3": true,
++        "etf2": true,
++        "hfpm": false,
++        "ri": false,
++        "pcc-xts-eaes-256": false,
++        "deflate": false,
++        "km-xts-eaes-256": false,
++        "km-xts-eaes-128": false,
++        "edat2": false,
++        "hfpue": false,
++        "kmo-aes-192": false,
++        "kmf-aes-192": false,
++        "km-eaes-192": false,
++        "kmc-aes-192": false,
++        "unpack": false,
++        "dfp": false,
++        "kmo-aes-128": false,
++        "kmf-aes-128": false,
++        "km-eaes-128": false,
++        "kmctr-dea": false,
++        "mvcos": true,
++        "etoken": false,
++        "pcc-cmac-tdea-192": false,
++        "km-dea": false,
++        "sprogp": true,
++        "sigpif": false,
++        "kmac-eaes-128": false,
++        "ldisphp": true,
++        "pckmo-aes-192": false,
++        "ipter": false,
++        "vx": true,
++        "pai": false,
++        "kimd-ghash": false,
++        "emon": false,
++        "kimd-sha-1": false,
++        "cei": false,
++        "cmpsceh": false,
++        "kmctr-eaes-192": false,
++        "kmctr-eaes-128": false,
++        "ginste": true,
++        "km-xts-aes-256": false,
++        "kmac-eaes-256": false,
++        "kmo-eaes-128": false,
++        "kmf-eaes-128": false,
++        "kmc-eaes-128": false,
++        "kmac-aes-128": false,
++        "paie": false,
++        "dfppc": false,
++        "dfpzc": false,
++        "dfphp": false,
++        "kmo-eaes-256": false,
++        "kmf-eaes-256": false,
++        "kmc-eaes-256": false,
++        "kmac-aes-256": false,
++        "kmac-etdea-192": false,
++        "kmac-etdea-128": false,
++        "kmo-dea": false,
++        "kmf-dea": false,
++        "km-edea": false,
++        "kmc-dea": false,
++        "stfle49": true,
++        "klmd-sha-1": false,
++        "mepochptff": false,
++        "opc": false,
++        "ap": false,
++        "asnlxr": false,
++        "gpereh": false,
++        "minste2": true,
++        "pcc-cmac-dea": false,
++        "vxpd": false,
++        "vxeh": true,
++        "esop": true,
++        "ectg": true,
++        "ib": false,
++        "km-tdea-192": false,
++        "km-tdea-128": false,
++        "msa9_pckmo": false,
++        "siif": false,
++        "kma-gcm-aes-256": false,
++        "kma-gcm-aes-192": false,
++        "kma-gcm-aes-128": false,
++        "pcc-cmac-aes-256": false,
++        "tsi": false,
++        "vxeh2": true,
++        "tpei": false,
++        "esort": false,
++        "esan3": true,
++        "fpe": true,
++        "ibs": false,
++        "pcc-xts-eaes-128": false,
++        "kmac-eaes-192": false,
++        "zarch": true,
++        "kmo-edea": false,
++        "kmf-edea": false,
++        "kmc-edea": false,
++        "kmac-dea": false,
++        "appv": false,
++        "apqi": false,
++        "apft": false,
++        "stfle53": true,
++        "ppno-sha-512-drng": false,
++        "pcc-cmac-tdea-128": false,
++        "kmo-aes-256": false,
++        "kmf-aes-256": false,
++        "km-eaes-256": false,
++        "kmc-aes-256": false,
++        "els": false,
++        "sief2": false,
++        "eimm": true,
++        "pcc-cmac-etdea-128": false,
++        "iep": true,
++        "irbm": false,
++        "km-xts-aes-128": false,
++        "srs": true,
++        "appvi": false,
++        "apqci": false,
++        "kmo-tdea-128": false,
++        "kmf-tdea-128": false,
++        "km-etdea-128": false,
++        "kmc-tdea-128": false,
++        "kss": false,
++        "cte": false,
++        "kmac-edea": false,
++        "prno-trng": true,
++        "kma-gcm-eaes-256": false,
++        "ais": true,
++        "fpseh": true,
++        "ltlbc": true,
++        "ldisp": true,
++        "kmo-etdea-128": false,
++        "kmf-etdea-128": false,
++        "kmc-etdea-128": false,
++        "kmac-tdea-128": false,
++        "pcc-cmac-edea": false,
++        "bpb": false,
++        "kmctr-edea": false,
++        "64bscao": false,
++        "ctop": false,
++        "kmo-eaes-192": false,
++        "kmf-eaes-192": false,
++        "kmc-eaes-192": false,
++        "kmac-aes-192": false,
++        "gs": false,
++        "sema": false,
++        "etf3eh": true,
++        "etf2eh": true,
++        "eec": false,
++        "pcc-cmac-eaes-192": false,
++        "ppa15": false,
++        "kmc-prng": false,
++        "zpci": true,
++        "rdp": false,
++        "nonqks": false,
++        "sea_esop2": true,
++        "minste3": true,
++        "beareh": false,
++        "pfpo": false,
++        "te": false,
++        "msa8-base": true,
++        "msa4-base": true,
++        "msa3-base": true,
++        "msa5-base": true,
++        "pcc-cmac-aes-192": false,
++        "cmm": false,
++        "tods": false,
++        "pcc-cmac-aes-128": false,
++        "plo": true,
++        "pckmo-edea": false,
++        "gsls": false,
++        "kmctr-aes-128": false,
++        "skey": false,
++        "vxpdeh2": false
++      }
++    }
++  },
++  "id": "libvirt-4"
++}
++
++{
++  "execute": "query-machines",
++  "id": "libvirt-5"
++}
++
+ {
+   "return": [
+     {
+@@ -36568,5 +36912,5 @@
+       "default-ram-id": "s390.ram"
+     }
+   ],
+-  "id": "libvirt-4"
++  "id": "libvirt-5"
+ }
+diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
+index 5e8db88e52..b3265dcc18 100644
+--- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
++++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml
+@@ -133,6 +133,7 @@
+   <flag name='virtio-sound'/>
+   <flag name='netdev.user'/>
+   <flag name='snapshot-internal-qmp'/>
++  <flag name='query-cpu-model-expansion.deprecated-props'/>
+   <version>9001000</version>
+   <microcodeVersion>39100246</microcodeVersion>
+   <package>v9.1.0</package>
+@@ -356,6 +357,12 @@
+     <property name='msa3-base' type='boolean' value='true'/>
+     <property name='msa5-base' type='boolean' value='true'/>
+     <property name='tods' type='boolean' value='false'/>
++    <deprecatedFeatures>
++      <property name='bpb'/>
++      <property name='te'/>
++      <property name='cte'/>
++      <property name='csske'/>
++    </deprecatedFeatures>
+   </hostCPU>
+   <cpu type='tcg' name='z13' typename='z13-s390x-cpu' usable='no'>
+     <blocker name='ppno-sha-512-drng'/>
+diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies
+index 91c9a049bf..9a58acaf08 100644
+--- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies
++++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.replies
+@@ -32411,6 +32411,89 @@
+   "id": "libvirt-40"
+ }
+ 
++{
++  "execute": "query-cpu-model-expansion",
++  "arguments": {
++    "type": "full",
++    "model": {
++      "name": "host"
++    }
++  },
++  "id": "libvirt-41"
++}
++
++{
++  "return": {
++    "deprecated-props": [
++      "bpb",
++      "te",
++      "cte",
++      "csske"
++    ],
++    "model": {
++      "name": "gen16a-base",
++      "props": {
++        "nnpa": true,
++        "aen": true,
++        "cmmnt": true,
++        "vxpdeh": true,
++        "aefsi": true,
++        "diag318": true,
++        "csske": true,
++        "mepoch": true,
++        "msa9": true,
++        "msa8": true,
++        "msa7": true,
++        "msa6": true,
++        "msa5": true,
++        "msa4": true,
++        "msa3": true,
++        "msa2": true,
++        "msa1": true,
++        "sthyi": true,
++        "edat": true,
++        "ri": true,
++        "deflate": true,
++        "edat2": true,
++        "etoken": true,
++        "vx": true,
++        "ipter": true,
++        "pai": true,
++        "paie": true,
++        "mepochptff": true,
++        "ap": true,
++        "vxeh": true,
++        "vxpd": true,
++        "esop": true,
++        "msa9_pckmo": true,
++        "vxeh2": true,
++        "esort": true,
++        "appv": true,
++        "apqi": true,
++        "apft": true,
++        "els": true,
++        "iep": true,
++        "appvi": true,
++        "apqci": true,
++        "cte": true,
++        "ais": true,
++        "bpb": true,
++        "ctop": true,
++        "gs": true,
++        "ppa15": true,
++        "zpci": true,
++        "rdp": true,
++        "sea_esop2": true,
++        "beareh": true,
++        "te": true,
++        "cmm": true,
++        "vxpdeh2": true
++      }
++    }
++  },
++  "id": "libvirt-41"
++}
++
+ {
+   "execute": "qmp_capabilities",
+   "id": "libvirt-1"
+@@ -36421,10 +36504,271 @@
+ }
+ 
+ {
+-  "execute": "query-machines",
++  "execute": "query-cpu-model-expansion",
++  "arguments": {
++    "type": "full",
++    "model": {
++      "name": "max"
++    }
++  },
+   "id": "libvirt-4"
+ }
+ 
++{
++  "return": {
++    "deprecated-props": [
++      "bpb",
++      "te",
++      "cte",
++      "csske"
++    ],
++    "model": {
++      "name": "gen15a-base",
++      "props": {
++        "pfmfi": false,
++        "exrl": true,
++        "stfle45": true,
++        "kmctr-etdea-192": false,
++        "kmctr-etdea-128": false,
++        "nnpa": false,
++        "cmma": false,
++        "dateh2": false,
++        "gen13ptff": false,
++        "aen": true,
++        "kmo-etdea-192": false,
++        "kmf-etdea-192": false,
++        "kmc-etdea-192": false,
++        "kmac-tdea-192": false,
++        "kimd-sha-512": true,
++        "dateh": true,
++        "km-aes-256": false,
++        "km-aes-192": false,
++        "kmctr-aes-256": false,
++        "kma-gcm-eaes-192": false,
++        "kmo-tdea-192": false,
++        "kmf-tdea-192": false,
++        "kmctr-tdea-192": false,
++        "kmctr-tdea-128": false,
++        "km-etdea-192": false,
++        "kmc-tdea-192": false,
++        "cmmnt": false,
++        "iacc2": true,
++        "parseh": false,
++        "klmd-sha-512": true,
++        "kma-gcm-eaes-128": false,
++        "csst": true,
++        "pcc-xts-aes-256": false,
++        "pcc-xts-aes-128": false,
++        "pckmo-aes-128": false,
++        "idter": false,
++        "idtes": true,
++        "prno-trng-qrtcr": false,
++        "pcc-cmac-eaes-128": false,
++        "vxpdeh": false,
++        "aefsi": true,
++        "pckmo-etdea-192": false,
++        "pckmo-etdea-128": false,
++        "diag318": false,
++        "pcc-cmac-eaes-256": false,
++        "msa-base": true,
++        "pcc-cmac-etdea-192": false,
++        "hpma2": false,
++        "kmctr-eaes-256": false,
++        "csske": false,
++        "csst2": true,
++        "mepoch": false,
++        "msa9": false,
++        "msa6": false,
++        "msa1": false,
++        "kmctr-aes-192": false,
++        "pckmo-aes-256": false,
++        "sthyi": false,
++        "stckf": true,
++        "stfle": true,
++        "edat": false,
++        "etf3": true,
++        "etf2": true,
++        "hfpm": false,
++        "ri": false,
++        "pcc-xts-eaes-256": false,
++        "deflate": false,
++        "km-xts-eaes-256": false,
++        "km-xts-eaes-128": false,
++        "edat2": false,
++        "hfpue": false,
++        "kmo-aes-192": false,
++        "kmf-aes-192": false,
++        "km-eaes-192": false,
++        "kmc-aes-192": false,
++        "unpack": false,
++        "dfp": false,
++        "kmo-aes-128": false,
++        "kmf-aes-128": false,
++        "km-eaes-128": false,
++        "kmctr-dea": false,
++        "mvcos": true,
++        "etoken": false,
++        "pcc-cmac-tdea-192": false,
++        "km-dea": false,
++        "sprogp": true,
++        "sigpif": false,
++        "kmac-eaes-128": false,
++        "ldisphp": true,
++        "pckmo-aes-192": false,
++        "ipter": false,
++        "vx": true,
++        "pai": false,
++        "kimd-ghash": false,
++        "emon": false,
++        "kimd-sha-1": false,
++        "cei": false,
++        "cmpsceh": false,
++        "kmctr-eaes-192": false,
++        "kmctr-eaes-128": false,
++        "ginste": true,
++        "km-xts-aes-256": false,
++        "kmac-eaes-256": false,
++        "kmo-eaes-128": false,
++        "kmf-eaes-128": false,
++        "kmc-eaes-128": false,
++        "kmac-aes-128": false,
++        "paie": false,
++        "dfppc": false,
++        "dfpzc": false,
++        "dfphp": false,
++        "kmo-eaes-256": false,
++        "kmf-eaes-256": false,
++        "kmc-eaes-256": false,
++        "kmac-aes-256": false,
++        "kmac-etdea-192": false,
++        "kmac-etdea-128": false,
++        "kmo-dea": false,
++        "kmf-dea": false,
++        "km-edea": false,
++        "kmc-dea": false,
++        "stfle49": true,
++        "klmd-sha-1": false,
++        "mepochptff": false,
++        "opc": false,
++        "ap": false,
++        "asnlxr": false,
++        "gpereh": false,
++        "minste2": true,
++        "pcc-cmac-dea": false,
++        "vxpd": false,
++        "vxeh": true,
++        "esop": true,
++        "ectg": true,
++        "ib": false,
++        "km-tdea-192": false,
++        "km-tdea-128": false,
++        "msa9_pckmo": false,
++        "siif": false,
++        "kma-gcm-aes-256": false,
++        "kma-gcm-aes-192": false,
++        "kma-gcm-aes-128": false,
++        "pcc-cmac-aes-256": false,
++        "tsi": false,
++        "vxeh2": true,
++        "tpei": false,
++        "esort": false,
++        "esan3": true,
++        "fpe": true,
++        "ibs": false,
++        "pcc-xts-eaes-128": false,
++        "kmac-eaes-192": false,
++        "zarch": true,
++        "kmo-edea": false,
++        "kmf-edea": false,
++        "kmc-edea": false,
++        "kmac-dea": false,
++        "appv": false,
++        "apqi": false,
++        "apft": false,
++        "stfle53": true,
++        "ppno-sha-512-drng": false,
++        "pcc-cmac-tdea-128": false,
++        "kmo-aes-256": false,
++        "kmf-aes-256": false,
++        "km-eaes-256": false,
++        "kmc-aes-256": false,
++        "els": false,
++        "sief2": false,
++        "eimm": true,
++        "pcc-cmac-etdea-128": false,
++        "iep": true,
++        "irbm": false,
++        "km-xts-aes-128": false,
++        "srs": true,
++        "appvi": false,
++        "apqci": false,
++        "kmo-tdea-128": false,
++        "kmf-tdea-128": false,
++        "km-etdea-128": false,
++        "kmc-tdea-128": false,
++        "kss": false,
++        "cte": false,
++        "kmac-edea": false,
++        "prno-trng": true,
++        "kma-gcm-eaes-256": false,
++        "ais": true,
++        "fpseh": true,
++        "ltlbc": true,
++        "ldisp": true,
++        "kmo-etdea-128": false,
++        "kmf-etdea-128": false,
++        "kmc-etdea-128": false,
++        "kmac-tdea-128": false,
++        "pcc-cmac-edea": false,
++        "bpb": false,
++        "kmctr-edea": false,
++        "64bscao": false,
++        "ctop": false,
++        "kmo-eaes-192": false,
++        "kmf-eaes-192": false,
++        "kmc-eaes-192": false,
++        "kmac-aes-192": false,
++        "gs": false,
++        "sema": false,
++        "etf3eh": true,
++        "etf2eh": true,
++        "eec": false,
++        "pcc-cmac-eaes-192": false,
++        "ppa15": false,
++        "kmc-prng": false,
++        "zpci": true,
++        "rdp": false,
++        "nonqks": false,
++        "sea_esop2": true,
++        "minste3": true,
++        "beareh": false,
++        "pfpo": false,
++        "te": false,
++        "msa8-base": true,
++        "msa4-base": true,
++        "msa3-base": true,
++        "msa5-base": true,
++        "pcc-cmac-aes-192": false,
++        "cmm": false,
++        "tods": false,
++        "pcc-cmac-aes-128": false,
++        "plo": true,
++        "pckmo-edea": false,
++        "gsls": false,
++        "kmctr-aes-128": false,
++        "skey": false,
++        "vxpdeh2": false
++      }
++    }
++  },
++  "id": "libvirt-4"
++}
++
++{
++  "execute": "query-machines",
++  "id": "libvirt-5"
++}
++
+ {
+   "return": [
+     {
+@@ -36737,5 +37081,5 @@
+       "default-ram-id": "s390.ram"
+     }
+   ],
+-  "id": "libvirt-4"
++  "id": "libvirt-5"
+ }
+diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
+index 79a149d187..c3a9b62ec0 100644
+--- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
++++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml
+@@ -136,6 +136,7 @@
+   <flag name='chardev-reconnect-miliseconds'/>
+   <flag name='virtio-ccw.loadparm'/>
+   <flag name='netdev-stream-reconnect-miliseconds'/>
++  <flag name='query-cpu-model-expansion.deprecated-props'/>
+   <version>9001050</version>
+   <microcodeVersion>39100247</microcodeVersion>
+   <package>v9.1.0-1348-g11b8920ed2</package>
+@@ -360,6 +361,12 @@
+     <property name='msa3-base' type='boolean' value='true'/>
+     <property name='msa5-base' type='boolean' value='true'/>
+     <property name='tods' type='boolean' value='false'/>
++    <deprecatedFeatures>
++      <property name='bpb'/>
++      <property name='te'/>
++      <property name='cte'/>
++      <property name='csske'/>
++    </deprecatedFeatures>
+   </hostCPU>
+   <cpu type='tcg' name='z13' typename='z13-s390x-cpu' usable='no'>
+     <blocker name='ppno-sha-512-drng'/>
+-- 
+2.49.0
diff --git a/SOURCES/libvirt-virsh-add-disable-deprecated-features-flag-to-domcapabilities.patch b/SOURCES/libvirt-virsh-add-disable-deprecated-features-flag-to-domcapabilities.patch
new file mode 100644
index 0000000..3ced81e
--- /dev/null
+++ b/SOURCES/libvirt-virsh-add-disable-deprecated-features-flag-to-domcapabilities.patch
@@ -0,0 +1,79 @@
+From 4294a300d6284c0678b165596bee433eac1a4da1 Mon Sep 17 00:00:00 2001
+Message-ID: <4294a300d6284c0678b165596bee433eac1a4da1.1749027246.git.jdenemar@redhat.com>
+From: Collin Walling <walling@linux.ibm.com>
+Date: Mon, 16 Dec 2024 18:03:57 -0500
+Subject: [PATCH] virsh: add --disable-deprecated-features flag to
+ domcapabilities
+
+Add a new flag, --disable-deprecated-features, to the domcapabilities
+command.  This will modify the output to show the 'host-model' CPU
+with features flagged as deprecated paired with the 'disable' policy.
+
+virsh domcapabilities --disable-deprecated-features
+
+Signed-off-by: Collin Walling <walling@linux.ibm.com>
+Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
+(cherry picked from commit 15d45964e453e04f1761e527266af45554f58fcc)
+JIRA: https://issues.redhat.com/browse/RHEL-89977
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ docs/manpages/virsh.rst | 6 ++++++
+ tools/virsh-host.c      | 9 ++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst
+index 77798af7d3..d3acec7f01 100644
+--- a/docs/manpages/virsh.rst
++++ b/docs/manpages/virsh.rst
+@@ -568,6 +568,7 @@ domcapabilities
+ 
+    domcapabilities [virttype] [emulatorbin] [arch] [machine]
+                    [--xpath EXPRESSION] [--wrap]
++                   [--disable-deprecated-features]
+ 
+ 
+ Print an XML document describing the domain capabilities for the
+@@ -609,6 +610,11 @@ a standalone document, however, for ease of additional processing,
+ the **--wrap** argument will cause the matching node to be wrapped
+ in a common root node.
+ 
++The **--disable-deprecated-features** argument will modify the contents
++of host-model CPU XML, updating the features list with any features
++flagged as deprecated for the CPU model by the hypervisor. These
++features will be paired with the "disable" policy.
++
+ 
+ pool-capabilities
+ -----------------
+diff --git a/tools/virsh-host.c b/tools/virsh-host.c
+index 2fe64e415f..f4e7324f42 100644
+--- a/tools/virsh-host.c
++++ b/tools/virsh-host.c
+@@ -114,6 +114,10 @@ static const vshCmdOptDef opts_domcapabilities[] = {
+      .type = VSH_OT_BOOL,
+      .help = N_("wrap xpath results in an common root element"),
+     },
++    {.name = "disable-deprecated-features",
++     .type = VSH_OT_BOOL,
++     .help = N_("report host CPU model with deprecated features disabled"),
++    },
+     {.name = NULL}
+ };
+ 
+@@ -126,10 +130,13 @@ cmdDomCapabilities(vshControl *ctl, const vshCmd *cmd)
+     const char *arch = NULL;
+     const char *machine = NULL;
+     const char *xpath = NULL;
+-    const unsigned int flags = 0; /* No flags so far */
++    unsigned int flags = 0;
+     bool wrap = vshCommandOptBool(cmd, "wrap");
+     virshControl *priv = ctl->privData;
+ 
++    if (vshCommandOptBool(cmd, "disable-deprecated-features"))
++        flags |= VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES;
++
+     if (vshCommandOptString(ctl, cmd, "virttype", &virttype) < 0 ||
+         vshCommandOptString(ctl, cmd, "emulatorbin", &emulatorbin) < 0 ||
+         vshCommandOptString(ctl, cmd, "arch", &arch) < 0 ||
+-- 
+2.49.0
diff --git a/SPECS/libvirt.spec b/SPECS/libvirt.spec
index cc3860e..8102a12 100644
--- a/SPECS/libvirt.spec
+++ b/SPECS/libvirt.spec
@@ -289,7 +289,7 @@
 Summary: Library providing a simple virtualization API
 Name: libvirt
 Version: 10.10.0
-Release: 7.3%{?dist}%{?extra_release}
+Release: 7.6.0.1%{?dist}%{?extra_release}
 License: GPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND OFL-1.1
 URL: https://libvirt.org/
 
@@ -397,6 +397,15 @@ Patch97: libvirt-Add-load-average-information-type-into-virDomainGetGuestInfo.pa
 Patch98: libvirt-qemu_agent-Add-qemuAgentGetLoadAvg.patch
 Patch99: libvirt-qemu-Add-support-for-VIR_DOMAIN_GUEST_INFO_LOAD.patch
 Patch100: libvirt-virsh-Add-support-for-VIR_DOMAIN_GUEST_INFO_LOAD.patch
+Patch101: libvirt-qemuMonitorJSONGetCPUModelExpansion-refactor-parsing-functions.patch
+Patch102: libvirt-qemu-parse-deprecated-props-from-query-cpu-model-expansion-response.patch
+Patch103: libvirt-qemu_capabilities-query-deprecated-features-for-host-model.patch
+Patch104: libvirt-libvirt-domain-introduce-VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES.patch
+Patch105: libvirt-qemu_capabilities-filter-deprecated-features-if-requested.patch
+Patch106: libvirt-virsh-add-disable-deprecated-features-flag-to-domcapabilities.patch
+Patch107: libvirt-conf-add-deprecated_features-attribute.patch
+Patch108: libvirt-qemuPrepareNVRAMFile-Fix-NVRAM-image-conversion-check.patch
+Patch109: libvirt-esx-Allow-specifying-different-CA-bundle-for-remote-connections.patch
 
 
 Requires: libvirt-daemon = %{version}-%{release}
@@ -1418,7 +1427,8 @@ exit 1
 %define arg_packager_version -Dpackager_version="%{release}"
 %define arg_selinux_mount -Dselinux_mount="/sys/fs/selinux"
 
-# place macros above and build commands below this comment
+# Set SOURCE_DATE_EPOCH from changelog
+%define source_date_epoch_from_changelog 1
 
 export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/libvirt.spec)
 
@@ -2722,6 +2732,24 @@ exit 0
 %endif
 
 %changelog
+* Tue Aug 05 2025 EL Errata <el-errata_ww@oracle.com> - 10.10.0-7.6.0.1
+- Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554]
+
+* Fri Jul 18 2025 Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.6.el9_6
+- esx: Allow specifying different CA bundle for remote connections (RHEL-98292)
+
+* Wed Jun 25 2025 Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.5.el9_6
+- qemuPrepareNVRAMFile: Fix NVRAM image conversion check (RHEL-97757)
+
+* Wed Jun  4 2025 Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.4.el9_6
+- qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-89977)
+- qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-89977)
+- qemu_capabilities: query deprecated features for host-model (RHEL-89977)
+- libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-89977)
+- qemu_capabilities: filter deprecated features if requested (RHEL-89977)
+- virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-89977)
+- conf: add deprecated_features attribute (RHEL-89977)
+
 * Tue Apr 29 2025 Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.3.el9_6
 - Add load average information type into virDomainGetGuestInfo (RHEL-88449)
 - qemu_agent: Add qemuAgentGetLoadAvg() (RHEL-88449)