* Mon Aug 03 2026 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-25

- kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch [RHEL-180837] - kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch [RHEL-180837] - kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch [RHEL-180837] - kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch [RHEL-192791] - kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch [RHEL-192791] - kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch [RHEL-192791] - kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch [RHEL-192791] - kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch [RHEL-192791] - kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch [RHEL-192791] - kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch [RHEL-192791] - kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch [RHEL-192791] - kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch [RHEL-192791] - Resolves: RHEL-180837 ([aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds)) - Resolves: RHEL-192791 (RHEL10.0 - qemu s390x: interface harding fixes)
2026-08-03 15:26:40 +02:00 · 2026-08-03 15:26:40 +02:00 · 15aa0bf413
commit 15aa0bf413
parent 420a839a1e
13 changed files with 926 additions and 1 deletions
--- a/kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch
+++ b/kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch
@ -0,0 +1,50 @@
+From dee147a00ef424ebb5882f45b2dcd88eef30e0d1 Mon Sep 17 00:00:00 2001
+From: Mohammadfaiz Bawa <mbawa@redhat.com>
+Date: Tue, 14 Jul 2026 22:01:45 +0530
+Subject: [PATCH 01/12] hw/core/platform-bus: guard
+ platform_bus_get_mmio_addr() against NULL
+
+RH-Author: Mohammadfaiz Bawa <None>
+RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types
+RH-Jira: RHEL-180837
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Commit: [1/3] 622f42e2d1c609def22b2796cf83080248897548 (faizb/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-180837
+
+sysbus_mmio_get_region() returns NULL when a device has fewer MMIO
+regions than the requested slot index.  platform_bus_get_mmio_addr()
+passes the result directly to memory_region_is_mapped() without a
+NULL check, causing a SIGSEGV.
+
+Return -1 early when the region pointer is NULL, consistent with the
+existing "not mapped" path.
+
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-2-mbawa@redhat.com
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+(cherry picked from commit fb7609c4bf74e31ea06c0d8e400dd01badcfa4c3)
+Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
+---
+ hw/core/platform-bus.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
+index 6950063de4..95add361cc 100644
+--- a/hw/core/platform-bus.c
+++ b/hw/core/platform-bus.c
+@@ -59,8 +59,7 @@ hwaddr platform_bus_get_mmio_addr(PlatformBusDevice *pbus, SysBusDevice *sbdev,
+     Object *pbus_mr_obj = OBJECT(pbus_mr);
+     Object *parent_mr;
+ 
+-    if (!memory_region_is_mapped(sbdev_mr)) {
+-        /* Region is not mapped? */
+    if (!sbdev_mr || !memory_region_is_mapped(sbdev_mr)) {
+         return -1;
+     }
+ 
+-- 
+2.52.0
+
--- a/kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch
+++ b/kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch
@ -0,0 +1,46 @@
+From fa2f8fe2dda08627add2104d534c2c375705514f Mon Sep 17 00:00:00 2001
+From: Mohammadfaiz Bawa <mbawa@redhat.com>
+Date: Thu, 16 Jul 2026 14:19:40 +0530
+Subject: [PATCH 03/12] hw/tpm: default tpm-tis-device PPI to disabled
+
+RH-Author: Mohammadfaiz Bawa <None>
+RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types
+RH-Jira: RHEL-180837
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Commit: [3/3] 848b5a32d209187bc7e59e69fde0743d9476d419 (faizb/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-180837
+UPSTREAM: RHEL-only
+
+Migration is currently broken between 10.3 and earlier qemu versions
+that do not implement tpm PPI (including 10.2) with "Unknown ramblock
+tpm-ppi" error.  Upstream 5e33de4f00c2 ("hw/core/machine: disable
+tpm-tis-device PPI for machine type <= 11.0") uses a compat setting
+to turn the PPI feature off for older machine types and change the
+default for 11.1.  However, downstream, we do not have a new machine
+type for 10.3 when the feature was introduced so we cannot
+discriminate between 10.2 and 10.3.  So turn the feature off for now.
+We will change the default for next machine type.
+
+Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
+---
+ hw/tpm/tpm_tis_sysbus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
+index 253c394087..63e126e360 100644
+--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
+@@ -94,7 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
+ static const Property tpm_tis_sysbus_properties[] = {
+     DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
+     DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
+-    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
+    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, false),
+ };
+ 
+ static void tpm_tis_sysbus_initfn(Object *obj)
+-- 
+2.52.0
+
--- a/kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch
+++ b/kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch
@ -0,0 +1,97 @@
+From 2aa010ee971b6323018033536d8bc192641d253e Mon Sep 17 00:00:00 2001
+From: Mohammadfaiz Bawa <mbawa@redhat.com>
+Date: Tue, 14 Jul 2026 22:01:45 +0530
+Subject: [PATCH 02/12] hw/tpm: gate PPI support on tpm-tis-device behind a
+ device property
+
+RH-Author: Mohammadfaiz Bawa <None>
+RH-MergeRequest: 511: hw/tpm: fix tpm-ppi migration failure for older machine types
+RH-Jira: RHEL-180837
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Commit: [2/3] ab0f19971bae0c49870a92e7e75c4cc0fa96a66d (faizb/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-180837
+
+Add a "ppi" boolean property (default: true) to tpm-tis-device.
+When ppi=off the RAMBlock is never registered and the migration
+stream omits "tpm-ppi", restoring backward compatibility.
+
+Move sysbus_init_mmio() calls from instance_init to realizefn so
+the memory regions are initialized before being registered.  When
+ppi=off, the PPI MMIO region is simply not exposed.
+
+Fixes: 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
+Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-3-mbawa@redhat.com
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+(cherry picked from commit 5f0348bf6ca17707475c5ccb10909b7a4407513b)
+Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
+---
+ hw/tpm/tpm_tis.h        |  1 +
+ hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h
+index 1531620bf9..6ac9804050 100644
+--- a/hw/tpm/tpm_tis.h
+++ b/hw/tpm/tpm_tis.h
+@@ -76,6 +76,7 @@ typedef struct TPMState {
+     size_t be_buffer_size;
+ 
+     TPMPPI ppi;
+    bool ppi_enabled;
+ } TPMState;
+ 
+ extern const VMStateDescription vmstate_locty;
+diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
+index 65ef59edd8..253c394087 100644
+--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
+@@ -94,6 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
+ static const Property tpm_tis_sysbus_properties[] = {
+     DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
+     DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
+    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
+ };
+ 
+ static void tpm_tis_sysbus_initfn(Object *obj)
+@@ -101,9 +102,7 @@ static void tpm_tis_sysbus_initfn(Object *obj)
+     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
+     TPMState *s = &sbdev->state;
+ 
+-    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+-    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
+ }
+ 
+ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
+@@ -122,14 +121,19 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
+         return;
+     }
+ 
+-    s->ppi.buf = qemu_memalign(host_page_size,
+-                               ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+     memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops,
+                           s, "tpm-tis-mmio",
+                           TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
+-    memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
+-                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
+-    vmstate_register_ram(&s->ppi.ram, dev);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
+
+    if (s->ppi_enabled) {
+        s->ppi.buf = qemu_memalign(host_page_size,
+                                   ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+        memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
+                                          TPM_PPI_ADDR_SIZE, s->ppi.buf);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->ppi.ram);
+        vmstate_register_ram(&s->ppi.ram, dev);
+    }
+ }
+ 
+ static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
+-- 
+2.52.0
+
--- a/kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch
+++ b/kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch
@ -0,0 +1,88 @@
+From b02928d3eec7a63f029b3881788f7d8bd0780a17 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Thu, 16 Jul 2026 10:34:43 +0200
+Subject: [PATCH 12/12] s390x/css: firm up handling of chained TIC CCWs
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [9/9] 19745abb6f8cc576ccf6d561c0c8f1341ffe7ed8 (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 33bece0fa121c0a85df4f0372145ca74b967e78e
+Author: Eric Farman <farman@linux.ibm.com>
+Date:   Mon Jul 13 09:47:08 2026 +0200
+
+    s390x/css: firm up handling of chained TIC CCWs
+
+    The logic in css_interpret_ccw() correctly returns -EINVAL if a
+    Transfer-In-Channel (TIC) CCW is command chained to another TIC CCW.
+    The same routine also correctly returns -EINVAL if 256 CCWs do not
+    perform a data transfer as part of the I/O operation [0].
+
+    What is missing, however, is a combination of these two, where a loop
+    can be generated that will continue processing CCWs but without
+    providing an opportunity to catch a breath. Fix this by capping
+    the number of TIC CCWs in a channel program at the same limit as
+    the CCWs without data transfer.
+
+    [0] See "Invalid Sequence" in z/Architecture Principles of Operation
+        (SA22-7832-14), p16-27
+
+    Cc: qemu-stable@nongnu.org
+    Signed-off-by: Eric Farman <farman@linux.ibm.com>
+    Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260713074708.884282-1-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/css.c         | 7 +++++++
+ include/hw/s390x/css.h | 1 +
+ 2 files changed, 8 insertions(+)
+
+diff --git a/hw/s390x/css.c b/hw/s390x/css.c
+index d89c223339..63947eff5a 100644
+--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
+@@ -1075,6 +1075,12 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
+             ret = -EINVAL;
+             break;
+         }
+        /* Limit the number of TICs in a given channel program */
+        if (sch->ccw_tic_cnt == 255) {
+            ret = -EINVAL;
+            break;
+        }
+        sch->ccw_tic_cnt++;
+         sch->channel_prog = ccw.cda;
+         ret = -EAGAIN;
+         break;
+@@ -1126,6 +1132,7 @@ static void sch_handle_start_func_virtual(SubchDev *sch)
+         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
+         schib->scsw.flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
+         sch->ccw_no_data_cnt = 0;
+        sch->ccw_tic_cnt = 0;
+         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
+     } else {
+         /* Start Function resumed via rsch */
+diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h
+index 0b0400a9d4..17385140c3 100644
+--- a/include/hw/s390x/css.h
+++ b/include/hw/s390x/css.h
+@@ -132,6 +132,7 @@ struct SubchDev {
+     bool ccw_fmt_1;
+     bool thinint_active;
+     uint8_t ccw_no_data_cnt;
+    uint8_t ccw_tic_cnt;
+     uint16_t migrated_schid; /* used for mismatch detection */
+     CcwDataStream cds;
+     /* transport-provided data: */
+-- 
+2.52.0
+
--- a/kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch
+++ b/kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch
@ -0,0 +1,82 @@
+From 459bb0c6ebf1b985ba2dce97818f7d5b9e46020c Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:01 +0200
+Subject: [PATCH 04/12] s390x/css: limit number of CHPIDs in description
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [1/9] 254d87004bf31f31ee0cc3e203aaa99e9cbd15e2 (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 22f2da06a8b291c975a7caf05dbd3b180c856741
+Author: Eric Farman <farman@linux.ibm.com>
+Date:   Tue Jul 7 09:07:28 2026 +0200
+
+    s390x/css: limit number of CHPIDs in description
+
+    virtio-ccw uses a single virtual CHPID for all devices and
+    device-types, but vfio-ccw (passthrough) shares real CHPID
+    information with the guest. A sufficiently large passthrough
+    configuration would exceed the defined response payload.
+
+    Fix this by limiting the number of CHPID descriptions that
+    are returned based on the given response format.
+
+    Cc: qemu-stable@nongnu.org
+    Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Signed-off-by: Eric Farman <farman@linux.ibm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260707070728.147203-6-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/css.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/hw/s390x/css.c b/hw/s390x/css.c
+index 53444f6828..d89c223339 100644
+--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
+@@ -1871,6 +1871,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
+     int i, desc_size;
+     uint32_t words[8];
+     uint32_t chpid_type_word;
+    uint32_t max_chpids, chpid_count = 0;
+     CssImage *css;
+ 
+     if (!m && !cssid) {
+@@ -1881,9 +1882,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
+     if (!css) {
+         return 0;
+     }
+
+    if (rfmt == 0) {
+        max_chpids = 256;
+    } else if (rfmt == 1) {
+        max_chpids = 127;
+    } else {
+        /* Should be rejected by caller */
+        return 0;
+    }
+
+     desc_size = 0;
+     for (i = f_chpid; i <= l_chpid; i++) {
+         if (css->chpids[i].in_use) {
+            /* Limit number of CHPIDs sent back */
+            if (chpid_count == max_chpids) {
+                break;
+            }
+
+            chpid_count++;
+             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
+             if (rfmt == 0) {
+                 words[0] = cpu_to_be32(chpid_type_word);
+-- 
+2.52.0
+
--- a/kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch
+++ b/kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch
@ -0,0 +1,87 @@
+From c1dcb5bd9b4f2ed7a057f475861a9ebb72f00f67 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:01 +0200
+Subject: [PATCH 05/12] s390x/ioinst: Require strict length and format for SEI
+ CHSC handler
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [2/9] 6d8c4d614b902223a3e926641aac736cbcb596fc (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 386268daea86e53d90baf99df5c7b8e2727ea783
+Author: Matthew Rosato <mjrosato@linux.ibm.com>
+Date:   Tue Jul 7 09:07:27 2026 +0200
+
+    s390x/ioinst: Require strict length and format for SEI CHSC handler
+
+    Ensure SEI commands that are received are of the appropriate length and
+    format before handling.
+
+    Cc: qemu-stable@nongnu.org
+    Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
+    Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
+    Reviewed-by: Eric Farman <farman@linux.ibm.com>
+    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ target/s390x/ioinst.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
+index 2320dd4c12..94619f9215 100644
+--- a/target/s390x/ioinst.c
+++ b/target/s390x/ioinst.c
+@@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void)
+ 
+ #define CHSC_SEI_NT0    (1ULL << 63)
+ #define CHSC_SEI_NT2    (1ULL << 61)
+#define CHSC_SEI_0_FMT 0x0f000000
+ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
+ {
+     uint64_t selection_mask = ldq_be_p(&req->param1);
+    uint32_t param0 = be32_to_cpu(req->param0);
+     uint8_t *res_flags = (uint8_t *)res->data;
+    uint16_t len = be16_to_cpu(req->len);
+    uint16_t resp_code;
+     int have_event = 0;
+     int have_more = 0;
+ 
+    if (len != 0x0010) {
+        resp_code = 0x0003;
+        goto out_err;
+    }
+
+    if (param0 & CHSC_SEI_0_FMT) {
+        resp_code = 0x0007;
+        goto out_err;
+    }
+
+     /* regarding architecture nt0 can not be masked */
+     have_event = !chsc_sei_nt0_get_event(res);
+     have_more = chsc_sei_nt0_have_event();
+@@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
+         res->code = cpu_to_be16(0x0005);
+         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
+     }
+    return;
+
+ out_err:
+    res->code = cpu_to_be16(resp_code);
+    res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
+    res->param = 0;
+ }
+ 
+ static void ioinst_handle_chsc_unimplemented(ChscResp *res)
+-- 
+2.52.0
+
--- a/kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch
+++ b/kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch
@ -0,0 +1,59 @@
+From 11005598084892e065466adc25a0cf125c03d826 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:15 +0200
+Subject: [PATCH 09/12] s390x/kvm: clamp stsi 3.2.2 size
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [6/9] b2551d15e058714d1ca135308a6f9d5e537cd6fe (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit a57e4612b61da20ddab196502c76b4dc05da1de8
+Author: Christian Borntraeger <borntraeger@linux.ibm.com>
+Date:   Mon Jun 22 11:20:35 2026 +0200
+
+    s390x/kvm: clamp stsi 3.2.2 size
+
+    The stsi 3.2.2 page is being prepared by the kvm module and the size is
+    clamped by the kernel. As the memory is mapped in the guest, another
+    guest VCPU could race and overwrite the count and messing up the move
+    operation. For any out of bound count, fall back to the kernel buffer.
+
+    Cc: qemu-stable@nongnu.org
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Eric Farman <farman@linux.ibm.com>
+    Message-ID: <20260622092035.400959-1-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ target/s390x/kvm/kvm.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
+index 491cc5f975..0cbd254655 100644
+--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
+@@ -1791,6 +1791,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
+     } else if (s390_cpu_virt_mem_read(cpu, addr, ar, &sysib, sizeof(sysib))) {
+         return;
+     }
+
+    /*
+     * The memory was filled by the kernel but mapped into the guest.
+     * If something is fishy, do not touch the buffer.
+     */
+    if (sysib.count == 0 || sysib.count > ARRAY_SIZE(sysib.ext_names)) {
+        return;
+    }
+
+     /* Shift the stack of Extended Names to prepare for our own data */
+     memmove(&sysib.ext_names[1], &sysib.ext_names[0],
+             sizeof(sysib.ext_names[0]) * (sysib.count - 1));
+-- 
+2.52.0
+
--- a/kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch
+++ b/kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch
@ -0,0 +1,75 @@
+From 170dc4d69a492c43d9ed6245abac91ce9ea2a6f1 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:01 +0200
+Subject: [PATCH 06/12] s390x/pci: Shrink RPCIT ranges to registered window
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [3/9] 50b2f5350069c1e213dac06f8b9c2c002df84525 (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit b8c8ec1d752661e1904d089c77d8617c4b6bfb5a
+Author: Matthew Rosato <mjrosato@linux.ibm.com>
+Date:   Tue Jul 7 09:07:26 2026 +0200
+
+    s390x/pci: Shrink RPCIT ranges to registered window
+
+    Today, if a RPCIT instruction is presented from the guest whose range
+    exceeds the previously-registered IOAT, QEMU will process the range
+    so long as 1) the specified range at least partially overlaps with
+    what was previously registered and 2) the guest has valid IOAT entries
+    in its table.  If the entries are not present (invalid), then the
+    RPCIT will unnecessarily spend time reporting the invalid
+    region/segment entries.
+
+    Optimize this path by exiting immediately if the requested range falls
+    completely outside of the previously-registered range or if the
+    requested range ends before it starts (which would only occur if the
+    guest-specified address + length would overflow a u64).  Otherwise,
+    clamp the request to only the portion of the range that overlaps with
+    what was previously registered, effectively ignoring the portion
+    outside of the registered range.
+
+    Cc: qemu-stable@nongnu.org
+    Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking")
+    Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
+    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260707070728.147203-4-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/s390-pci-inst.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
+index a3bb5aa221..5a2aa1c12e 100644
+--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
+@@ -753,10 +753,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
+         goto err;
+     }
+ 
+-    if (end < iommu->pba || start > iommu->pal) {
+    if (end < start || end < iommu->pba || start > iommu->pal) {
+         error = ERR_EVENT_OORANGE;
+         goto err;
+     }
+    /*
+     * If the specified range at least partially overlaps the registered
+     * aperture, clamp the request to the aperture and ignore the rest.
+     */
+    sstart = MAX(start, iommu->pba);
+    end = MIN(end, iommu->pal + 1);
+ 
+  retry:
+     start = sstart;
+-- 
+2.52.0
+
--- a/kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch
+++ b/kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch
@ -0,0 +1,104 @@
+From 624da84e824b854a9cbd64be087627d6991f8358 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:15 +0200
+Subject: [PATCH 07/12] s390x/pci: Tighten region detection for BAR read/write
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [4/9] 187be7e6318f69afd409a43a36ebc9ecfb295dec (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 2d709a70c75724e972126671b2e2c0fca0b6e239
+Author: Matthew Rosato <mjrosato@linux.ibm.com>
+Date:   Tue Jul 7 09:07:25 2026 +0200
+
+    s390x/pci: Tighten region detection for BAR read/write
+
+    For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset
+    and length provided by the guest does not overflow, and only return
+    a memory region when the specified offset+length combination matches
+    an existing subregion or the parent region.
+
+    Cc: qemu-stable@nongnu.org
+    Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs")
+    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260707070728.147203-3-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
+index 5a2aa1c12e..17d74d8542 100644
+--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
+@@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
+ static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
+                                         uint8_t len)
+ {
+    uint64_t last = offset + len;
+     MemoryRegion *subregion;
+     uint64_t subregion_size;
+ 
+    /*
+     * Ensure the region is valid, the calculated address cannot wrap and that
+     * it falls within this region.
+     */
+    if (!mr || offset > last || last > memory_region_size(mr)) {
+        return NULL;
+    }
+
+     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
+         subregion_size = int128_get64(subregion->size);
+         if ((offset >= subregion->addr) &&
+-            (offset + len) <= (subregion->addr + subregion_size)) {
+            (last) <= (subregion->addr + subregion_size)) {
+             mr = subregion;
+             break;
+         }
+@@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
+ 
+     mr = pbdev->pdev->io_regions[pcias].memory;
+     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        return MEMTX_ERROR;
+    }
+
+     offset -= mr->addr;
+     return memory_region_dispatch_read(mr, offset, data,
+                                        size_memop(len) | MO_BE,
+@@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
+ 
+     mr = pbdev->pdev->io_regions[pcias].memory;
+     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        return MEMTX_ERROR;
+    }
+
+     offset -= mr->addr;
+     return memory_region_dispatch_write(mr, offset, data,
+                                         size_memop(len) | MO_BE,
+@@ -906,6 +923,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
+ 
+     mr = pbdev->pdev->io_regions[pcias].memory;
+     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        s390_program_interrupt(env, PGM_OPERAND, ra);
+        return 0;
+    }
+
+     offset -= mr->addr;
+ 
+     for (i = 0; i < len; i += 8) {
+-- 
+2.52.0
+
--- a/kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch
+++ b/kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch
@ -0,0 +1,66 @@
+From e2c3b08190f32460c9046fd71da7ea96fdca4afe Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Thu, 16 Jul 2026 10:34:43 +0200
+Subject: [PATCH 10/12] s390x/sclp: prevent re-reading the sclp header
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [7/9] f84a26f6a6546cc221689dff2a415053462bf4ab (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 20701190e023216d0213a107a491402ce2cc501e
+Author: Christian Borntraeger <borntraeger@linux.ibm.com>
+Date:   Thu Jul 9 16:29:05 2026 +0200
+
+    s390x/sclp: prevent re-reading the sclp header
+
+    We verify the sccb length and then allocate based on that length. The
+    following access re-reads the sccb again. This can race against other
+    vCPUs overwriting the length field.
+
+    sclp_service_call_protected does not need a change as the ultravisor
+    provides a consistent snapshot.
+
+    Fixes: c1db53a5910f ("s390/sclp: read sccb from mem based on provided length")
+    Cc: qemu-stable@nongnu.org
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Reviewed-by: Eric Farman <farman@linux.ibm.com>
+    Reviewed-by: Collin Walling <walling@linux.ibm.com>
+    Message-ID: <20260709142906.197474-2-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Conflicts: target code is still using cpu_physical_memory_read() instead
+           of upsteam having switched to address_space_read() and
+           handling possible errors; sticking to old behavior for now
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/sclp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
+index 16057356b1..27a354029c 100644
+--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
+@@ -328,10 +328,12 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
+     /*
+      * we want to work on a private copy of the sccb, to prevent guests
+      * from playing dirty tricks by modifying the memory content after
+-     * the host has checked the values
+     * the host has checked the values.
+     * Reuse the previously fetched header
+      */
+     work_sccb = g_malloc0(be16_to_cpu(header.length));
+     cpu_physical_memory_read(sccb, work_sccb, be16_to_cpu(header.length));
+    work_sccb->h = header;
+ 
+     if (!sclp_command_code_valid(code)) {
+         work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);
+-- 
+2.52.0
+
--- a/kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch
+++ b/kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch
@ -0,0 +1,71 @@
+From 603081937866d300dc72d26a782168564478a8f4 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Sat, 11 Jul 2026 14:58:15 +0200
+Subject: [PATCH 08/12] s390x/sclp: reject invalid write event data headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [5/9] b38f0d679531edbc7f9f1ebaa8b6b8e5bd385292 (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit d88cd8f5570f4d6e08d62e098a8b7f53cdc75536
+Author: Christian Borntraeger <borntraeger@linux.ibm.com>
+Date:   Tue Jul 7 09:07:24 2026 +0200
+
+    s390x/sclp: reject invalid write event data headers
+
+    If a guest submits an sccb with a tiny header length but a large number
+    of event mask entries, the write_event_mask handler will
+    1. return the wrong RC (ok instead of error)
+    2. write to memory after the allocated sccb in qemu host memory.
+
+    Add the necessary checks.
+
+    Cc: qemu-stable@nongnu.org
+    Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Reviewed-by: Eric Farman <farman@linux.ibm.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/event-facility.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
+index fee286ea63..184c469bd3 100644
+--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
+@@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb)
+ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
+ {
+     WriteEventMask *we_mask = (WriteEventMask *) sccb;
+    uint16_t sccb_length = be16_to_cpu(sccb->h.length);
+     uint16_t mask_length = be16_to_cpu(we_mask->mask_length);
+     sccb_mask_t tmp_mask;
+ 
+@@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
+         return;
+     }
+ 
+    if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) {
+        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
+        return;
+    }
+
+     /*
+      * Note: We currently only support masks up to 8 byte length;
+      *       the remainder is filled up with zeroes. Older Linux
+-- 
+2.52.0
+
--- a/kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch
+++ b/kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch
@ -0,0 +1,58 @@
+From 7b4c4fc735e983f616c42a55022f6900687b4b05 Mon Sep 17 00:00:00 2001
+From: Christoph Schlameuss <cschlame@redhat.com>
+Date: Thu, 16 Jul 2026 10:34:43 +0200
+Subject: [PATCH 11/12] s390x/sclpcpi: check event length field before reading
+ from buffer
+
+RH-Author: Christoph Schlameuss <None>
+RH-MergeRequest: 510: s390x: interface harding fixes
+RH-Jira: RHEL-192791
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: acordeir <None>
+RH-Commit: [8/9] b28bf870b91442a2d450dd0a6afee4d5673cc694 (cschlame/qemu-kvm)
+
+JIRA: https://redhat.atlassian.net/browse/RHEL-192791
+
+commit 8a116a28535c34b001e68b52f85d6be3acb75350
+Author: Christian Borntraeger <borntraeger@linux.ibm.com>
+Date:   Thu Jul 9 16:29:06 2026 +0200
+
+    s390x/sclpcpi: check event length field before reading from buffer
+
+    A guest might send a too short SCCB with SCLP_EVENT_CTRL_PGM_ID. QEMU
+    would fill its data structures with garbage data. Check for the precise
+    length of the CBI data structure and reject otherwise.
+
+    Fixes: f345978f24be ("hw/s390x: add Control-Program Identification to QOM")
+    Cc: qemu-stable@nongnu.org
+    Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+    Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+    Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+    Reviewed-by: Eric Farman <farman@linux.ibm.com>
+    Message-ID: <20260709142906.197474-3-borntraeger@linux.ibm.com>
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+
+Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
+---
+ hw/s390x/sclpcpi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c
+index 68fc1b809b..ec4bdf2350 100644
+--- a/hw/s390x/sclpcpi.c
+++ b/hw/s390x/sclpcpi.c
+@@ -97,6 +97,11 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
+                                              ebh);
+     SCLPEventCPI *e = SCLP_EVENT_CPI(event);
+ 
+    /* Caller checks sccb length, buffer header checking is our duty */
+    if (be16_to_cpu(evt_buf_hdr->length) != sizeof(ControlProgramIdMsg)) {
+        return SCLP_RC_INCONSISTENT_LENGTHS;
+    }
+
+     ascii_put(e->system_type, (char *)cpim->data.system_type,
+               sizeof(cpim->data.system_type));
+     ascii_put(e->system_name, (char *)cpim->data.system_name,
+-- 
+2.52.0
+
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
 Version: 10.1.0
-Release: 24%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 25%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -1648,6 +1648,30 @@ Patch465: kvm-docs-creation-of-x509-certs-compliant-with-post-quan.patch
 Patch466: kvm-iommufd-Introduce-handler-for-device-ATS-support.patch
 # For RHEL-184675 - NVIDIA:Backport vfio/pci: add vfio-pci ATS control property - RHEL 10.3
 Patch467: kvm-vfio-pci-Add-ats-property.patch
+# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds)
+Patch468: kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch
+# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds)
+Patch469: kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch
+# For RHEL-180837 - [aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds)
+Patch470: kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch471: kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch472: kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch473: kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch474: kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch475: kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch476: kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch477: kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch478: kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch
+# For RHEL-192791 - RHEL10.0 - qemu s390x: interface harding fixes
+Patch479: kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch

 %if %{have_clang}
 BuildRequires: clang
@ -2730,6 +2754,24 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif

 %changelog
+* Mon Aug 03 2026 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-25
+- kvm-hw-core-platform-bus-guard-platform_bus_get_mmio_add.patch [RHEL-180837]
+- kvm-hw-tpm-gate-PPI-support-on-tpm-tis-device-behind-a-d.patch [RHEL-180837]
+- kvm-hw-tpm-default-tpm-tis-device-PPI-to-disabled.patch [RHEL-180837]
+- kvm-s390x-css-limit-number-of-CHPIDs-in-description.patch [RHEL-192791]
+- kvm-s390x-ioinst-Require-strict-length-and-format-for-SE.patch [RHEL-192791]
+- kvm-s390x-pci-Shrink-RPCIT-ranges-to-registered-window.patch [RHEL-192791]
+- kvm-s390x-pci-Tighten-region-detection-for-BAR-read-writ.patch [RHEL-192791]
+- kvm-s390x-sclp-reject-invalid-write-event-data-headers.patch [RHEL-192791]
+- kvm-s390x-kvm-clamp-stsi-3.2.2-size.patch [RHEL-192791]
+- kvm-s390x-sclp-prevent-re-reading-the-sclp-header.patch [RHEL-192791]
+- kvm-s390x-sclpcpi-check-event-length-field-before-readin.patch [RHEL-192791]
+- kvm-s390x-css-firm-up-handling-of-chained-TIC-CCWs.patch [RHEL-192791]
+- Resolves: RHEL-180837
+  ([aarch64] Live migration of TPM-equipped guests fails: Unknown ramblock "tpm-ppi" (qemu-kvm-10.1.0-19.el10 → older builds))
+- Resolves: RHEL-192791
+  (RHEL10.0 - qemu s390x: interface harding fixes)
+
 * Fri Jul 10 2026 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-24
 - kvm-net-tap-linux.c-avoid-abort-when-setting-invalid-fd.patch [RHEL-113894]
 - kvm-crypto-only-verify-CA-certs-in-chain-of-trust.patch [RHEL-111934]