Rebase to qemu 6.0.0

Resolves: rhbz#1872569
2021-04-30 09:28:51 +02:00 · 2021-04-30 09:28:51 +02:00 · 28609d56cc
commit 28609d56cc
parent 3bdeb95dd5
134 changed files with 1189 additions and 30893 deletions
--- a/.gitignore
+++ b/.gitignore
@ -15,3 +15,4 @@
 /qemu-5.2.0-rc1.tar.xz
 /qemu-5.2.0-rc3.tar.xz
 /qemu-5.2.0.tar.xz
 /qemu-6.0.0.tar.xz
--- a/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
+++ b/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
--- a/0004-Initial-redhat-build.patch
+++ b/0004-Initial-redhat-build.patch
@ -0,0 +1,230 @@
 From 431955e872aa010376b1f94665908c2ba8194b44 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
  - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
  - man page is installed using make install so we have to fix it in qemu tree
 We disable make check due to issues with some of the tests.
 This rebase is based on qemu-kvm-5.2.0-16.el9
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Merged patches (6.0.0):
 - 605758c902 Limit build on Power to qemu-img and qemu-ga only
 ---
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 configure                               |    5 -
 hw/remote/memory.c                      |    2 +-
 hw/remote/proxy.c                       |    2 +-
 meson.build                             |    8 +-
 redhat/Makefile                         |   90 +
 redhat/Makefile.common                  |   50 +
 redhat/README.tests                     |   39 +
 redhat/qemu-kvm.spec.template           | 3609 +++++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py     |    5 +-
 redhat/scripts/process-patches.sh       |   20 +-
 redhat/udev-kvm-check.c                 |   19 +-
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 tests/check-block.sh                    |    2 +
 ui/vnc.c                                |    2 +-
 18 files changed, 3860 insertions(+), 44 deletions(-)
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/configure b/configure
 index 4f374b4889..53b2fa583a 100755
 --- a/configure
 +++ b/configure
@@ -6383,10 +6383,6 @@ fi
 mv $cross config-meson.cross
 rm -rf meson-private meson-info meson-logs
 -unset staticpic
 -if ! version_ge "$($meson --version)" 0.56.0; then
 -  staticpic=$(if test "$pie" = yes; then echo true; else echo false; fi)
 -fi
 NINJA=$ninja $meson setup \
         --prefix "$prefix" \
         --libdir "$libdir" \
@@ -6406,7 +6402,6 @@ NINJA=$ninja $meson setup \
         -Dwerror=$(if test "$werror" = yes; then echo true; else echo false; fi) \
         -Dstrip=$(if test "$strip_opt" = yes; then echo true; else echo false; fi) \
         -Db_pie=$(if test "$pie" = yes; then echo true; else echo false; fi) \
 -        ${staticpic:+-Db_staticpic=$staticpic} \
         -Db_coverage=$(if test "$gcov" = yes; then echo true; else echo false; fi) \
         -Db_lto=$lto -Dcfi=$cfi -Dcfi_debug=$cfi_debug \
         -Dmalloc=$malloc -Dmalloc_trim=$malloc_trim -Dsparse=$sparse \
 diff --git a/hw/remote/memory.c b/hw/remote/memory.c
 index 32085b1e05..bf0047a81b 100644
 --- a/hw/remote/memory.c
 +++ b/hw/remote/memory.c
@@ -43,7 +43,7 @@ void remote_sysmem_reconfig(MPQemuMsg *msg, Error **errp)
     remote_sysmem_reset();
     for (region = 0; region < msg->num_fds; region++) {
 -        g_autofree char *name;
 +        g_autofree char *name = NULL;
         subregion = g_new(MemoryRegion, 1);
         name = g_strdup_printf("remote-mem-%u", suffix++);
         memory_region_init_ram_from_fd(subregion, NULL,
 diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
 index 4fa4be079d..253c1aa7ec 100644
 --- a/hw/remote/proxy.c
 +++ b/hw/remote/proxy.c
@@ -347,7 +347,7 @@ static void probe_pci_info(PCIDevice *dev, Error **errp)
                    PCI_BASE_ADDRESS_SPACE_IO : PCI_BASE_ADDRESS_SPACE_MEMORY;
         if (size) {
 -            g_autofree char *name;
 +            g_autofree char *name = NULL;
             pdev->region[i].dev = pdev;
             pdev->region[i].present = true;
             if (type == PCI_BASE_ADDRESS_SPACE_MEMORY) {
 diff --git a/meson.build b/meson.build
 index c6f4b0cf5e..06c15bd6d2 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1,6 +1,6 @@
 project('qemu', ['c'], meson_version: '>=0.55.0',
 -        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto'] +
 -                         (meson.version().version_compare('>=0.56.0') ? [ 'b_staticpic=false' ] : []),
 +        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto',
 +                          'b_staticpic=false' ],
         version: run_command('head', meson.source_root() / 'VERSION').stdout().strip())
 not_found = dependency('', required: false)
@@ -1482,7 +1482,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
 -    '-include', 'capstone-defs.h'
 +    '-include', 'capstone-defs.h',
 +
 +    '-Wp,-D_GLIBCXX_ASSERTIONS',
   ]
   libcapstone = static_library('capstone',
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/tests/check-block.sh b/tests/check-block.sh
 index f86cb863de..6d38340d49 100755
 --- a/tests/check-block.sh
 +++ b/tests/check-block.sh
@@ -69,6 +69,8 @@ else
     fi
 fi
 +exit 0
 +
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
 diff --git a/ui/vnc.c b/ui/vnc.c
 index 456db47d71..97ae92b181 100644
 --- a/ui/vnc.c
 +++ b/ui/vnc.c
@@ -4146,7 +4146,7 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_SASL
     if (sasl) {
 -        int saslErr = sasl_server_init(NULL, "qemu");
 +        int saslErr = sasl_server_init(NULL, "qemu-kvm");
         if (saslErr != SASL_OK) {
             error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.27.0
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0005-Enable-disable-devices-for-RHEL.patch
@ -1,4 +1,4 @@
-From 0ad3e82af785512a5a77373d2ad95c63dfedeaba Mon Sep 17 00:00:00 2001
+From f46ca4c7e719e0a70f8e0ffe3de882c017c216e7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL
@ -6,125 +6,49 @@ Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (qemu 3.1.0)
 - spapr_rng disabled in default_config
 - new hyperv.mak in default configs
 - Move changes from x86_64-softmmu.mak to i386-softmmu.mak
 - Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
 - Removed config_vga_isa.c changes as no longer needed
 - Removed new devices
 Rebase notes (4.0.0):
 - Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
 - Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
 - Switch to KConfig (upstream)
 - Using device whitelist + without-defualt-devices option
 Rebase notes (4.1.0):
 - Added CONFIG_USB_OHCI_PCI for ppc64
 - Added CONFIG_XIVE_KVM for ppc64
 - Added CONFIG_ACPI_PCI for x86_64
 - Added CONFIG_SEMIHOSTING for aarch64
 - Cleanup aarch64 devices
 - Do not build a15mpcore.c
 - Removed ide-isa.c stub file
 - Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
 Rebase notes (4.2.0-rc0):
 - Use conditional build for isa-superio.c (upstream change)
 - Rename PCI_PIIX to PCI_I440FX (upstream change)
 Rebase notes (4.2.0-rc3):
 - Disabled ccid-card-emulated (patch 92566)
 - Disabled vfio-pci-igd-lpc-bridge (patch 92565)
 Rebase notes (5.1.0):
 - added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
 - Added CONFIG_NVDIMM
 - updated cortex-15 disabling to upstream code
 - Add CONFIG_ACPI_APEI for aarch64
 - removed obsolete hw/bt/Makefile.objs chunk
 - removed unnecessary changes in target/i386/cpu.c
 Rebase notes (5.2.0 rc0):
 - Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
 - remove vl.c hack for no hpet
 - Enable CONFIG_PTIMER for aarch64
 - Do not package hw-display-virtio-gpu.so on s390x
 Rebase notes (5.2.0 rc1):
 - Added CONFIG_ARM_GIC for aarch64 (required for build)
 Merged patches (qemu 3.1.0):
 - d51e082 Re-enable CONFIG_HYPERV_TESTDEV
 - 4b889f3 Declare cirrus-vga as deprecated
 - b579d32 Do not build bluetooth support
 - 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
 - 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
 Merged patches (4.1.0):
 - 20a51f6 fdc: Revert downstream disablement of device "floppy"
 - f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
 - 5909721 aarch64: Compile out IOH3420
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - 495a27d x86_64-rh-devices: add missing TPM passthrough
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - f7587dd RHEL: disable hostmem-memfd
 Merged patches (5.1.0):
 - 4543a3c i386: Remove cpu64-rhel6 CPU model
 - 96533 aarch64: Remove tcg cpu types (pjw commit)
 - 559d589 Revert "RHEL: disable hostmem-memfd"
 - 441128e enable ramfb
 Merged patches (5.2.0 rc0):
 - f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
 - 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
 - 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
 - 4a8ccfd Disable TPM passthrough backend on ARM
 ---
- .../devices/aarch64-rh-devices.mak            |  27 +++++
+ .../devices/aarch64-rh-devices.mak            |  28 +++++
 default-configs/devices/aarch64-softmmu.mak   |  10 +-
- default-configs/devices/ppc64-rh-devices.mak  |  38 +++++++
+ default-configs/devices/ppc64-rh-devices.mak  |  36 ++++++
 default-configs/devices/ppc64-softmmu.mak     |  10 +-
 default-configs/devices/rh-virtio.mak         |  10 ++
- default-configs/devices/s390x-rh-devices.mak  |  15 +++
+ default-configs/devices/s390x-rh-devices.mak  |  16 +++
 default-configs/devices/s390x-softmmu.mak     |   4 +-
- default-configs/devices/x86_64-rh-devices.mak | 101 ++++++++++++++++++
+ default-configs/devices/x86_64-rh-devices.mak | 104 ++++++++++++++++++
- default-configs/devices/x86_64-softmmu.mak    |   4 +-
+ default-configs/devices/x86_64-softmmu.mak    |  10 +-
 .../devices/x86_64-upstream-devices.mak       |   4 +
 hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
 hw/char/parallel.c                            |   9 ++
 hw/cpu/meson.build                            |   5 +-
 hw/display/cirrus_vga.c                       |   3 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
 qemu-options.hx                               |   4 -
- redhat/qemu-kvm.spec.template                 |  10 +-
+ redhat/qemu-kvm.spec.template                 |   5 +-
- target/arm/cpu.c                              |   4 +-
+ target/arm/cpu_tcg.c                          |  10 ++
 target/arm/cpu_tcg.c                          |   3 +
 target/ppc/cpu-models.c                       |  10 ++
 target/s390x/cpu_models.c                     |   3 +
 target/s390x/kvm.c                            |   8 ++
- 26 files changed, 273 insertions(+), 25 deletions(-)
+ 28 files changed, 304 insertions(+), 22 deletions(-)
 create mode 100644 default-configs/devices/aarch64-rh-devices.mak
 create mode 100644 default-configs/devices/ppc64-rh-devices.mak
 create mode 100644 default-configs/devices/rh-virtio.mak
 create mode 100644 default-configs/devices/s390x-rh-devices.mak
 create mode 100644 default-configs/devices/x86_64-rh-devices.mak
 create mode 100644 default-configs/devices/x86_64-upstream-devices.mak
 diff --git a/default-configs/devices/aarch64-rh-devices.mak b/default-configs/devices/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..98319407de
+index 0000000000..a4d67274c0
 --- /dev/null
 +++ b/default-configs/devices/aarch64-rh-devices.mak
-@@ -0,0 +1,27 @@
+@@ -0,0 +1,28 @@
 +include rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
@ -152,6 +76,7 @@ index 0000000000..98319407de
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/default-configs/devices/aarch64-softmmu.mak b/default-configs/devices/aarch64-softmmu.mak
 index 958b1e08e4..8f6867d48a 100644
 --- a/default-configs/devices/aarch64-softmmu.mak
@ -173,10 +98,10 @@ index 958b1e08e4..8f6867d48a 100644
 +include aarch64-rh-devices.mak
 diff --git a/default-configs/devices/ppc64-rh-devices.mak b/default-configs/devices/ppc64-rh-devices.mak
 new file mode 100644
-index 0000000000..467a16bdc2
+index 0000000000..5b01b7fac0
 --- /dev/null
 +++ b/default-configs/devices/ppc64-rh-devices.mak
-@@ -0,0 +1,38 @@
+@@ -0,0 +1,36 @@
 +include rh-virtio.mak
 +
 +CONFIG_DIMM=y
@ -195,6 +120,8 @@ index 0000000000..467a16bdc2
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_BOT=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
@ -207,11 +134,7 @@ index 0000000000..467a16bdc2
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XICS_KVM=y
 +CONFIG_XICS_SPAPR=y
 +CONFIG_XIVE=y
 +CONFIG_XIVE_SPAPR=y
 +CONFIG_XIVE_KVM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
@ -255,10 +178,10 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/default-configs/devices/s390x-rh-devices.mak b/default-configs/devices/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..c3c73fe752
+index 0000000000..08a15f3e01
 --- /dev/null
 +++ b/default-configs/devices/s390x-rh-devices.mak
-@@ -0,0 +1,15 @@
+@@ -0,0 +1,16 @@
 +include rh-virtio.mak
 +
 +CONFIG_PCI=y
@ -270,6 +193,7 @@ index 0000000000..c3c73fe752
 +CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
@ -288,10 +212,10 @@ index f2287a133f..3e2e388e91 100644
 +include s390x-rh-devices.mak
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..e80877d4e2
+index 0000000000..9f41400530
 --- /dev/null
 +++ b/default-configs/devices/x86_64-rh-devices.mak
-@@ -0,0 +1,101 @@
+@@ -0,0 +1,104 @@
 +include rh-virtio.mak
 +
 +CONFIG_AC97=y
@ -351,7 +275,7 @@ index 0000000000..e80877d4e2
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PFLASH_CFI01=y
-+CONFIG_PVPANIC=y
+CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_QXL=y
@ -371,6 +295,8 @@ index 0000000000..e80877d4e2
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_BOT=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
@ -381,6 +307,7 @@ index 0000000000..e80877d4e2
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VMMOUSE=y
@ -394,18 +321,34 @@ index 0000000000..e80877d4e2
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/default-configs/devices/x86_64-softmmu.mak b/default-configs/devices/x86_64-softmmu.mak
-index 64b2ee2960..b5de7e5279 100644
+index 64b2ee2960..e57bcff7d9 100644
 --- a/default-configs/devices/x86_64-softmmu.mak
 +++ b/default-configs/devices/x86_64-softmmu.mak
-@@ -1,3 +1,5 @@
+@@ -1,3 +1,11 @@
 # Default configuration for x86_64-softmmu
 -include i386-softmmu.mak
 +#include i386-softmmu.mak
 +
 +include x86_64-rh-devices.mak
 +
 +#
 +# RHEL: this is for the limited upstream machine type support, so to export
 +# some more devices than what RHEL machines have.
 +#
 +include x86_64-upstream-devices.mak
 diff --git a/default-configs/devices/x86_64-upstream-devices.mak b/default-configs/devices/x86_64-upstream-devices.mak
 new file mode 100644
 index 0000000000..2cd20f54d2
 --- /dev/null
 +++ b/default-configs/devices/x86_64-upstream-devices.mak
@@ -0,0 +1,4 @@
 +# We need "isa-parallel"
 +CONFIG_PARALLEL=y
 +# We need "hpet"
 +CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index 5ff4e01c36..ac45ca4acb 100644
+index 853447cf9d..7f01fad64c 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -374,8 +374,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
@ -433,10 +376,10 @@ index be39117b9b..6fcc5ede50 100644
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index 4c2c35e223..e9eb7b8279 100644
+index a825c2acba..c62927bb3a 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
-@@ -48,6 +48,8 @@
+@@ -49,6 +49,8 @@
 #include "trace.h"
 #include "qom/object.h"
@ -445,8 +388,8 @@ index 4c2c35e223..e9eb7b8279 100644
 /********************************************************/
 /* debug Floppy devices */
-@@ -2621,6 +2623,14 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
+@@ -2554,6 +2556,14 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
-     int i, j;
+     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
@ -460,6 +403,33 @@ index 4c2c35e223..e9eb7b8279 100644
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index b45e67bfbb..e5f108211b 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,6 +29,7 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 +#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
@ -525,10 +495,10 @@ index dde85ba6c6..62cf60c9c9 100644
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index d7d05ae30a..aaea06d29c 100644
+index 4f75b44cfc..6f075fe235 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1796,6 +1796,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1797,6 +1797,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -536,7 +506,7 @@ index d7d05ae30a..aaea06d29c 100644
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1808,6 +1809,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1809,6 +1810,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -545,10 +515,10 @@ index d7d05ae30a..aaea06d29c 100644
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 2f7dc3c23d..55d36e0069 100644
+index 4f316a6f9d..64178f0f9a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -376,10 +376,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
@ -561,11 +531,30 @@ index 2f7dc3c23d..55d36e0069 100644
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 9520471be2..202e032524 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index 934e4fa675..e3abba548a 100644
+index fb7a74e73a..674993aa4f 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
-@@ -48,7 +48,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
+@@ -55,7 +55,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
 if config_host.has_key('CONFIG_SMARTCARD')
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
@ -575,10 +564,10 @@ index 934e4fa675..e3abba548a 100644
 endif
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 104632ea34..363a15b4e8 100644
+index fd21002bd6..0d4fb61bf7 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -2251,10 +2251,6 @@ ERST
+@@ -2327,10 +2327,6 @@ ERST
 DEF("no-hpet", 0, QEMU_OPTION_no_hpet,
     "-no-hpet        disable HPET\n", QEMU_ARCH_I386)
@ -589,35 +578,84 @@ index 104632ea34..363a15b4e8 100644
 DEF("acpitable", HAS_ARG, QEMU_OPTION_acpitable,
     "-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]\n"
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index 07492e9f9a..a0487148e8 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -2358,7 +2358,9 @@ static void arm_cpu_register_types(void)
         type_register_static(&idau_interface_type_info);
         for (i = 0; i < cpu_count; ++i) {
 -            arm_cpu_register(&arm_cpus[i]);
 +            /* RHEL specific: Filter out unsupported cpu models */
 +            if (!strcmp(arm_cpus[i].name, "cortex-a15"))
 +                arm_cpu_register(&arm_cpus[i]);
         }
     }
 }
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index 0013e25412..6540046128 100644
+index 046e476f65..c3cd0ca039 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
-@@ -679,6 +679,9 @@ static void arm_tcg_cpu_register_types(void)
+@@ -22,6 +22,7 @@
- {
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
-     size_t i;
+ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
-+    /* Disable TCG cpu types for Red Hat Enterprise Linux */
+#if 0 /* Disabled for Red Hat Enterprise Linux */
-+    return;
+ #ifdef CONFIG_TCG
-+
+ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     for (i = 0; i < ARRAY_SIZE(arm_tcg_cpus); ++i) {
+ {
-         arm_cpu_register(&arm_tcg_cpus[i]);
+@@ -375,6 +376,7 @@ static void cortex_a9_initfn(Object *obj)
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 +#endif /* disabled for RHEL */
 #ifndef CONFIG_USER_ONLY
 static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -400,6 +402,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -445,6 +448,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 +#endif /* disabled for RHEL */
 static void cortex_a15_initfn(Object *obj)
 {
@@ -488,6 +492,7 @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -927,6 +932,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
 /*
@@ -1004,6 +1010,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 static const ARMCPUInfo arm_tcg_cpus[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
@@ -1019,7 +1026,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
 +#endif /* disabled for RHEL */
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
@@ -1050,6 +1059,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 87e4228614..6eaa65efff 100644
 --- a/target/ppc/cpu-models.c
@ -689,10 +727,10 @@ index 87e4228614..6eaa65efff 100644
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index b5abff8bef..abe09d73c2 100644
+index 050dcf2d42..9254ff46bf 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
-@@ -408,6 +408,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
+@@ -430,6 +430,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
@ -703,10 +741,10 @@ index b5abff8bef..abe09d73c2 100644
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
-index b8385e6b95..1839cc6648 100644
+index 4fb3bbfef5..6c69d84b84 100644
 --- a/target/s390x/kvm.c
 +++ b/target/s390x/kvm.c
-@@ -2552,6 +2552,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2516,6 +2516,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
@ -722,5 +760,5 @@ index b8385e6b95..1839cc6648 100644
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
-2.18.4
+2.27.0
--- a/0005-Initial-redhat-build.patch
+++ b/0005-Initial-redhat-build.patch
@ -1,307 +0,0 @@
 From e4cd78dda8017f181fa94bbad1f0f015a99271db Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
  - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
  - man page is installed using make install so we have to fix it in qemu tree
 This rebase includes changes up to qemu-kvm-5.1.0-16.el8
 Rebase notes (3.1.0):
 - added new configure options
 Rebase notes (4.0.0):
 - Added dependency to perl-Test-Harness (upstream)
 - Added dependency to python3-sphinx (upstream)
 - Change location of icons (upstream)
 - Remove .desktop file (added upstream)
 - Added qemu-trace-stap (added upstream)
 - Removed elf2dmp (added upstream)
 - Remove .buildinfo
 - Added pvh.bin rom (added upstream)
 - Added interop documentation files
 - Use python module instead of qemu.py (upstream)
 Rebase notes (4.1.0):
 - Remove edk2 files generated by build
 - Switch to rhel-8.1-candidate build target
 - Remove specs documentation
 - Switched from libssh2 to libssh
 - Add rc0 tarball usage hacks
 - Added BuildRequires for wget, rpm-build and python3-sphinx
 - Removed new unpacked files
 - Update configure line to use new options
 Rebase notes (4.2.0):
 - Disable iotest run during make check
 - README renamed to README.rst (upstream)
 - Removed ui-spice-app.so
 - Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
 - Removed qemu-ga.8 install from spec file - installed by make
 - Removed spapr-rtas.bin (upstream)
 - Require newer SLOF (20191022)
 Rebase notes (5.1.0):
 - Use python3 for virtio_seg_max_adjust.py test
 - Removed qemu-trace-stap shebang from spec file
 - Added virtiofsd.1 (upstream)
 - Use out-of-tree build
 - New documentation structure (upstream)
 - Update local build
 - Removing installed qemu-storage-daemon (added upstream)
 - Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
 - Disable iotests (moved from Enable make check commit)
 - Added missing configure options
 - Reorder configure options
 - qemu-pr-helper moved to /usr/libexec/ (upstream)
 - Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
 - Added setting rc version in Makefile for build
 - removed --disable-vxhs configure option (removed upstream)
 - bumped required libusbx-devel version to 1.0.23
 - bumped libfdt version to 1.6.0
 Rebase notes (5.2.0 rc0):
 - Move libfdt dependency to qemu-kvm-core
 - Move manpage rename from Makefile to spec file
 - rename with-confsuffix configure option to with-suffix (upstream)
 - Bump libusbx Requires version to 1.0.234
 - Manual copy of keymaps in spec file (BZ 1875217)
 - Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
  unpackaged for now.
 - Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
 - Added build dependency for meson and ninja-build
 - hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
 - Removed Chanelog (upstream)
 - Fix in directory used for docs (upstream add %name so we do not pass it in configure)
 - Package various .so as part of qemu-kvm-core package.
 Rebase notes (5.2.0 rc2):
 - Added fix for dtrace build on RHEL 8.4.0
 Rebase notes (5.2.0 rc3):
 - Added man page for qemu-pr-helper
 - Added new configure options
 - Update qemu-kiwi patches to v4
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
 Merged patches (4.0.0):
 - aa4297c Add edk2 Requires to qemu-kvm
 - d124ff5779 Fixing brew build target
 - eb204b5 Introduce the qemu-kvm-tests rpm
 - 223cf0c Load kvm module during boot (partial)
 Merged patches (4.1.0):
 - ebb6e97 redhat: Fix LOCALVERSION creation
 - b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
 - 7cb3c4a Enable libpmem to support nvdimm
 - 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - 69e1fb2 enable virgla
 - d4f6115 enable virgl, for real this time ...
 Merged patches (5.1.0):
 - 5edf6bd Add support for rh-brew-module
 - f77d52d redhat: ship virtiofsd vhost-user device backend
 - 63f12d4 redhat: Always use module build target for rh-brew (modified)
 - 9b1e140 redhat: updating the modular target
 - 44b8bd0 spec: Fix python shenigans for tests
 Merged patches (5.2.0 rc0):
 - 9238ce7 Add support for simpletrace
 - 5797cff Remove explicit glusterfs-api dependency
 - fd62478 disable virgl
 - 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
 - 3645097 redhat: Make all generated so files executable (not only block-*)
 Merged patches (5.2.0 rc2):
 - pjw 99657 redhat: introduces disable_everything macro into the configure call
 - pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
 - pjw 99658 redhat: Fixing rh-local build
 - pjw 99660 redhat: Add qemu-kiwi subpackage
 - d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
 Merged patches (5.2.0 rc3):
 - pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
 - pjw 99885 - redhat: adding rh-rpm target
 ---
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 hw/s390x/s390-pci-vfio.c                |    4 +-
 meson.build                             |    4 +-
 redhat/Makefile                         |   90 +
 redhat/Makefile.common                  |   53 +
 redhat/README.tests                     |   39 +
 redhat/qemu-kvm.spec.template           | 3402 +++++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py     |    5 +-
 redhat/scripts/process-patches.sh       |   17 +-
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 tests/check-block.sh                    |    2 +
 ui/vnc.c                                |    2 +-
 15 files changed, 3653 insertions(+), 16 deletions(-)
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
 index 9296e1bb6e..f70c5a8946 100644
 --- a/hw/s390x/s390-pci-vfio.c
 +++ b/hw/s390x/s390-pci-vfio.c
@@ -28,7 +28,7 @@
  */
 bool s390_pci_update_dma_avail(int fd, unsigned int *avail)
 {
 -    g_autofree struct vfio_iommu_type1_info *info;
 +    g_autofree struct vfio_iommu_type1_info *info = NULL;
     uint32_t argsz;
     assert(avail);
@@ -229,7 +229,7 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
  */
 void s390_pci_get_clp_info(S390PCIBusDevice *pbdev)
 {
 -    g_autofree struct vfio_device_info *info;
 +    g_autofree struct vfio_device_info *info = NULL;
     VFIOPCIDevice *vfio_pci;
     uint32_t argsz;
     int fd;
 diff --git a/meson.build b/meson.build
 index e3386196ba..8c38b2ea36 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1148,7 +1148,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
 -    '-include', 'capstone-defs.h'
 +    '-include', 'capstone-defs.h',
 +
 +    '-Wp,-D_GLIBCXX_ASSERTIONS',
   ]
   libcapstone = static_library('capstone',
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/tests/check-block.sh b/tests/check-block.sh
 index f6b1bda7b9..645b550af8 100755
 --- a/tests/check-block.sh
 +++ b/tests/check-block.sh
@@ -58,6 +58,8 @@ if ! (sed --version | grep 'GNU sed') > /dev/null 2>&1 ; then
     fi
 fi
 +exit 0
 +
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
 diff --git a/ui/vnc.c b/ui/vnc.c
 index 49235056f7..eb5520ed73 100644
 --- a/ui/vnc.c
 +++ b/ui/vnc.c
@@ -3982,7 +3982,7 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_SASL
     if (sasl) {
 -        int saslErr = sasl_server_init(NULL, "qemu");
 +        int saslErr = sasl_server_init(NULL, "qemu-kvm");
         if (saslErr != SASL_OK) {
             error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.18.4
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0006-Machine-type-related-general-changes.patch
@ -1,4 +1,4 @@
-From b97fdd8e425f1c9a156ebdfbdce986d9351c0d19 Mon Sep 17 00:00:00 2001
+From 80e9b92048e6fe7c7aef0e64cbc0f855bd3a6272 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@ -8,68 +8,36 @@ split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - Remove e1000 device duplication changes to reflect upstream solution
 - Rewrite machine compat properties to upstream solution
 Rebase changes (4.1.0):
 - Removed optional flag for machine compat properties (upstream)
 - Remove c3e002cb chunk from hw/net/e1000.c
 - Reorder compat structures
 - Use one format for compat scructures
 - Added compat for virtio-balloon-pci.any_layout for rhel71
 Merged patches (4.0.0):
 - d4c0957 compat: Generic HW_COMPAT_RHEL7_6
 - cbac773 virtio: Make disable-legacy/disable-modern compat properties optional
 Merged patches (4.1.0):
 - 479ad30 redhat: fix cut'n'paste garbage in hw_compat comments
 - f19738e compat: Generic hw_compat_rhel_8_0
 Merged patches (4.2.0):
 - 9f2bfaa machine types: Update hw_compat_rhel_8_0 from hw_compat_4_0
 - ca4a5e8 virtio: Make disable-legacy/disable-modern compat properties optional
 - compat: Generic hw_compat_rhel_8_1 (patch 93040/92956)
 Merged patches (5.1.0):
 - e6c3fbf hw/smbios: set new default SMBIOS fields for Windows driver support (partialy)
 - 8f9f4d8 compat: disable 'edid' for virtio-gpu-ccw
 Merged patches (5.2.0 rc0):
 - 8348642 redhat: define hw_compat_8_2
 - 45b8402 redhat: define hw_compat_8_2
 - 4effa71 redhat: Update hw_compat_8_2
 - 0e84dff virtio: skip legacy support check on machine types less than 5.1 (partialy)
 ---
 hw/acpi/ich9.c               |  15 +++
 hw/acpi/piix4.c              |   5 +-
 hw/arm/virt.c                |   2 +-
 hw/char/serial.c             |  16 +++
- hw/core/machine.c            | 213 +++++++++++++++++++++++++++++++++++
+ hw/core/machine.c            | 251 +++++++++++++++++++++++++++++++++++
 hw/display/vga-isa.c         |   2 +-
 hw/i386/pc_piix.c            |   2 +
 hw/i386/pc_q35.c             |   2 +
- hw/net/e1000e.c              |  21 ++++
+ hw/net/e1000e.c              |  21 +++
 hw/net/rtl8139.c             |   4 +-
 hw/rtc/mc146818rtc.c         |   6 +
- hw/smbios/smbios.c           |  46 +++++++-
+ hw/smbios/smbios.c           |  46 ++++++-
 hw/timer/i8254_common.c      |   2 +-
 hw/usb/hcd-uhci.c            |   4 +-
- hw/usb/hcd-xhci.c            |  20 ++++
+ hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
 hw/usb/hcd-xhci.c            |  20 +++
 hw/usb/hcd-xhci.h            |   2 +
 include/hw/acpi/ich9.h       |   3 +
- include/hw/boards.h          |  27 +++++
+ include/hw/boards.h          |  33 +++++
 include/hw/firmware/smbios.h |   5 +-
 include/hw/i386/pc.h         |   3 +
- include/hw/usb.h             |   4 +
+ include/hw/usb.h             |   3 +
 migration/migration.c        |   2 +
 migration/migration.h        |   5 +
- 23 files changed, 400 insertions(+), 11 deletions(-)
+ 25 files changed, 489 insertions(+), 25 deletions(-)
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index ac45ca4acb..0b35b35b28 100644
+index 7f01fad64c..33b0c6e33c 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -369,6 +369,18 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
@ -102,10 +70,10 @@ index ac45ca4acb..0b35b35b28 100644
                                   &pm->disable_s3, OBJ_PROP_FLAG_READWRITE);
     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S4_DISABLED,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 669be5bbf6..2063131bcc 100644
+index 8f8b0e95e5..9865d1a349 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -277,6 +277,7 @@ static const VMStateDescription vmstate_acpi = {
+@@ -278,6 +278,7 @@ static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
     .minimum_version_id = 3,
@ -113,7 +81,7 @@ index 669be5bbf6..2063131bcc 100644
     .post_load = vmstate_acpi_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
-@@ -633,8 +634,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
+@@ -643,8 +644,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
 static Property piix4_pm_properties[] = {
     DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
@ -125,10 +93,10 @@ index 669be5bbf6..2063131bcc 100644
     DEFINE_PROP_BOOL("acpi-pci-hotplug-with-bridge-support", PIIX4PMState,
                      use_acpi_hotplug_bridge, true),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 27dbeb549e..c908b5fcf4 100644
+index 9f01d9041b..f904d3e98e 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1441,7 +1441,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1522,7 +1522,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
@ -138,18 +106,18 @@ index 27dbeb549e..c908b5fcf4 100644
     smbios_get_tables(MACHINE(vms), NULL, 0, &smbios_tables, &smbios_tables_len,
                       &smbios_anchor, &smbios_anchor_len);
 diff --git a/hw/char/serial.c b/hw/char/serial.c
-index 97f71879ff..aeb207ef73 100644
+index bc2e322970..cc378142a3 100644
 --- a/hw/char/serial.c
 +++ b/hw/char/serial.c
-@@ -35,6 +35,7 @@
+@@ -37,6 +37,7 @@
 #include "qemu/error-report.h"
 #include "trace.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 +#include "migration/migration.h"
 #define UART_LCR_DLAB	0x80	/* Divisor latch access bit */
-@@ -691,6 +692,9 @@ static int serial_post_load(void *opaque, int version_id)
+@@ -689,6 +690,9 @@ static int serial_post_load(void *opaque, int version_id)
 static bool serial_thr_ipending_needed(void *opaque)
 {
     SerialState *s = opaque;
@ -159,7 +127,7 @@ index 97f71879ff..aeb207ef73 100644
     if (s->ier & UART_IER_THRI) {
         bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
-@@ -772,6 +776,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
+@@ -770,6 +774,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
 static bool serial_fifo_timeout_timer_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -170,7 +138,7 @@ index 97f71879ff..aeb207ef73 100644
     return timer_pending(s->fifo_timeout_timer);
 }
-@@ -789,6 +797,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+@@ -787,6 +795,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
 static bool serial_timeout_ipending_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -181,7 +149,7 @@ index 97f71879ff..aeb207ef73 100644
     return s->timeout_ipending != 0;
 }
-@@ -806,6 +818,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
+@@ -804,6 +816,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
 static bool serial_poll_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -193,13 +161,49 @@ index 97f71879ff..aeb207ef73 100644
 }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index d0408049b5..19d50dde45 100644
+index 40def78183..848e7fdff6 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -28,6 +28,219 @@
+@@ -36,6 +36,257 @@
- #include "hw/mem/nvdimm.h"
+ #include "hw/virtio/virtio.h"
- #include "migration/vmstate.h"
+ #include "hw/virtio/virtio-pci.h"
 +/*
 + * Mostly the same as hw_compat_5_2
 + */
 +GlobalProperty hw_compat_rhel_8_4[] = {
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "ICH9-LPC", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "PIIX4_PM", "smm-compat", "on"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
 +/*
 + * Mostly the same as hw_compat_5_1
 + */
 +GlobalProperty hw_compat_rhel_8_3[] = {
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-blk", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-blk-device", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-scsi-device", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-pci", "x-ats-page-aligned", "off"},
 +};
 +const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 +
 +/*
 + * The same as hw_compat_4_2 + hw_compat_5_0
 + */
@ -226,6 +230,8 @@ index d0408049b5..19d50dde45 100644
 +    { "qxl-vga", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "fw_cfg", "acpi-mr-restore", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-device", "use-disabled-flag", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
@ -413,9 +419,9 @@ index d0408049b5..19d50dde45 100644
 +};
 +const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +
- GlobalProperty hw_compat_5_1[] = {
+ GlobalProperty hw_compat_5_2[] = {
-     { "vhost-scsi", "num_queues", "1"},
+     { "ICH9-LPC", "smm-compat", "on"},
-     { "vhost-user-blk", "num-queues", "1"},
+     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
 index 90851e730b..a91c5d7467 100644
 --- a/hw/display/vga-isa.c
@ -430,7 +436,7 @@ index 90851e730b..a91c5d7467 100644
 };
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 13d1628f13..9fcc5aaf69 100644
+index 46cc951073..62433d8022 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -179,6 +179,8 @@ static void pc_init1(MachineState *machine,
@ -443,7 +449,7 @@ index 13d1628f13..9fcc5aaf69 100644
     }
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index a3f4959c43..f6c2ef4e43 100644
+index 53450190f5..fce52ca70b 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -198,6 +198,8 @@ static void pc_q35_init(MachineState *machine)
@ -530,7 +536,7 @@ index a8a77eca95..6d39c1f1c4 100644
                         e1000e_prop_disable_vnet, bool),
     DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index ba5ace1ab7..a2e6e83522 100644
+index 90b4fc63ce..3ffb9dd22c 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
@@ -3179,7 +3179,7 @@ static int rtl8139_pre_save(void *opaque)
@ -553,10 +559,10 @@ index ba5ace1ab7..a2e6e83522 100644
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
-index 7a38540cb9..377d861913 100644
+index 5d0fcacd0c..4a2e52031b 100644
 --- a/hw/rtc/mc146818rtc.c
 +++ b/hw/rtc/mc146818rtc.c
-@@ -43,6 +43,7 @@
+@@ -44,6 +44,7 @@
 #include "qapi/visitor.h"
 #include "exec/address-spaces.h"
 #include "hw/rtc/mc146818rtc_regs.h"
@ -564,7 +570,7 @@ index 7a38540cb9..377d861913 100644
 #ifdef TARGET_I386
 #include "qapi/qapi-commands-misc-target.h"
-@@ -821,6 +822,11 @@ static int rtc_post_load(void *opaque, int version_id)
+@@ -822,6 +823,11 @@ static int rtc_post_load(void *opaque, int version_id)
 static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
 {
     RTCState *s = (RTCState *)opaque;
@ -577,7 +583,7 @@ index 7a38540cb9..377d861913 100644
 }
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 6a3d39793b..232fd61bf8 100644
+index f22c4f5b73..a305a4bcea 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -56,6 +56,9 @@ static bool smbios_legacy = true;
@ -672,10 +678,10 @@ index 050875b497..32935da46c 100644
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
-index 27ca237d71..eb24e39b81 100644
+index 0cb02a6432..962a9622e5 100644
 --- a/hw/usb/hcd-uhci.c
 +++ b/hw/usb/hcd-uhci.c
-@@ -1221,12 +1221,14 @@ static void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
+@@ -1167,12 +1167,14 @@ void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
     UHCIState *s = UHCI(dev);
     uint8_t *pci_conf = s->dev.config;
     int i;
@ -691,11 +697,122 @@ index 27ca237d71..eb24e39b81 100644
     if (s->masterbus) {
         USBPort *ports[NB_PORTS];
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index 9421734d0f..9bfe236a7d 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -101,6 +101,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
 +/* RH bz 1912846 */
 +static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
 +{
 +    int ret;
 +    Error *err = NULL;
 +    XHCIPciState *s = XHCI_PCI(dev);
 +
 +    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 +    /*
 +     * Any error other than -ENOTSUP(board's MSI support is broken)
 +     * is a programming error
 +     */
 +    assert(!ret || ret == -ENOTSUP);
 +    if (ret && s->msi == ON_OFF_AUTO_ON) {
 +        /* Can't satisfy user's explicit msi=on request, fail */
 +        error_append_hint(&err, "You have to use msi=auto (default) or "
 +                "msi=off with this machine type.\n");
 +        error_propagate(errp, err);
 +        return true;
 +    }
 +    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 +    /* With msi=auto, we fall back to MSI off silently */
 +    error_free(err);
 +
 +    return false;
 +}
 +
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
@@ -122,23 +149,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
 -    if (s->msi != ON_OFF_AUTO_OFF) {
 -        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 -        /*
 -         * Any error other than -ENOTSUP(board's MSI support is broken)
 -         * is a programming error
 -         */
 -        assert(!ret || ret == -ENOTSUP);
 -        if (ret && s->msi == ON_OFF_AUTO_ON) {
 -            /* Can't satisfy user's explicit msi=on request, fail */
 -            error_append_hint(&err, "You have to use msi=auto (default) or "
 -                    "msi=off with this machine type.\n");
 +    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
 +        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
             error_propagate(errp, err);
             return;
         }
 -        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 -        /* With msi=auto, we fall back to MSI off silently */
 -        error_free(err);
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -151,6 +167,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
 +    /* RH bz 1912846 */
 +    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
 +        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
@@ -195,11 +219,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
 +static Property xhci_pci_properties[] = {
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 static void xhci_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 +    device_class_set_props(dc, xhci_pci_properties);
     dc->reset   = xhci_pci_reset;
     dc->vmsd    = &vmstate_xhci_pci;
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
 index c193f79443..086a1feb1e 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
@@ -39,6 +39,7 @@ typedef struct XHCIPciState {
     XHCIState xhci;
     OnOffAuto msi;
     OnOffAuto msix;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
 } XHCIPciState;
 #endif
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 9ce7ca706e..0af661ce1d 100644
+index 46212b1e69..6d1f278aad 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
-@@ -3491,9 +3491,27 @@ static const VMStateDescription vmstate_xhci_slot = {
+@@ -3490,9 +3490,27 @@ static const VMStateDescription vmstate_xhci_slot = {
     }
 };
@ -723,7 +840,7 @@ index 9ce7ca706e..0af661ce1d 100644
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(type,   XHCIEvent),
         VMSTATE_UINT32(ccode,  XHCIEvent),
-@@ -3502,6 +3520,8 @@ static const VMStateDescription vmstate_xhci_event = {
+@@ -3501,6 +3519,8 @@ static const VMStateDescription vmstate_xhci_event = {
         VMSTATE_UINT32(flags,  XHCIEvent),
         VMSTATE_UINT8(slotid,  XHCIEvent),
         VMSTATE_UINT8(epid,    XHCIEvent),
@ -733,7 +850,7 @@ index 9ce7ca706e..0af661ce1d 100644
     }
 };
 diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h
-index 02ebd76450..dfda04b125 100644
+index 7bba361f3b..f450ffd13b 100644
 --- a/hw/usb/hcd-xhci.h
 +++ b/hw/usb/hcd-xhci.h
@@ -149,6 +149,8 @@ typedef struct XHCIEvent {
@ -746,11 +863,11 @@ index 02ebd76450..dfda04b125 100644
 typedef struct XHCIInterrupter {
 diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
-index 54571c77e0..b3369dab9e 100644
+index df519e40b5..e1ecfbaf1f 100644
 --- a/include/hw/acpi/ich9.h
 +++ b/include/hw/acpi/ich9.h
-@@ -61,6 +61,9 @@ typedef struct ICH9LPCPMRegs {
+@@ -62,6 +62,9 @@ typedef struct ICH9LPCPMRegs {
-     uint8_t smm_enabled;
+     bool smm_compat;
     bool enable_tco;
     TCOIORegs tco_regs;
 +
@ -760,13 +877,19 @@ index 54571c77e0..b3369dab9e 100644
 #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index a49e3a6b44..dd18c9e94d 100644
+index ad6c8fd537..2d7a65724a 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -367,4 +367,31 @@ extern const size_t hw_compat_2_2_len;
+@@ -413,4 +413,37 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_8_4[];
 +extern const size_t hw_compat_rhel_8_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_3[];
 +extern const size_t hw_compat_rhel_8_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_2[];
 +extern const size_t hw_compat_rhel_8_2_len;
 +
@ -812,10 +935,10 @@ index 02a0ced0a0..67e38a1b13 100644
 void smbios_get_tables(MachineState *ms,
                        const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 911e460097..ae6bf1d209 100644
+index dcf060b791..93c012ac95 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -104,6 +104,9 @@ struct PCMachineClass {
+@@ -107,6 +107,9 @@ struct PCMachineClass {
     bool smbios_defaults;
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
@ -826,25 +949,24 @@ index 911e460097..ae6bf1d209 100644
     /* RAM / address space compat: */
     bool gigabyte_align;
 diff --git a/include/hw/usb.h b/include/hw/usb.h
-index a70a72e917..78b90436c9 100644
+index 436e07b304..edb2cd94b6 100644
 --- a/include/hw/usb.h
 +++ b/include/hw/usb.h
-@@ -570,4 +570,8 @@ int usb_get_quirks(uint16_t vendor_id, uint16_t product_id,
+@@ -577,4 +577,7 @@ void usb_pcap_init(FILE *fp);
-                    uint8_t interface_class, uint8_t interface_subclass,
+ void usb_pcap_ctrl(USBPacket *p, bool setup);
-                    uint8_t interface_protocol);
+ void usb_pcap_data(USBPacket *p, bool setup);
 +
 +/* hcd-xhci.c -- rhel7.0.0 machine type compatibility */
 +extern bool migrate_cve_2014_5263_xhci_fields;
 +
 #endif
 diff --git a/migration/migration.c b/migration/migration.c
-index 87a9b59f83..1bb8d012e6 100644
+index 8ca034136b..4afc6069b6 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -134,6 +134,8 @@ enum mig_rp_message_type {
+@@ -167,6 +167,8 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
-     MIG_RP_MSG_MAX
+     MIGRATION_CAPABILITY_X_COLO,
- };
+     MIGRATION_CAPABILITY_VALIDATE_UUID);
 +bool migrate_pre_2_2;
 +
@ -852,10 +974,10 @@ index 87a9b59f83..1bb8d012e6 100644
    migrations at once.  For now we don't need to add
    dynamic creation of migration */
 diff --git a/migration/migration.h b/migration/migration.h
-index d096b77f74..6134a534b3 100644
+index db6708326b..1b6c69751c 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
-@@ -364,6 +364,11 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
+@@ -368,6 +368,11 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
 void migrate_add_address(SocketAddress *address);
 int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
@ -868,5 +990,5 @@ index d096b77f74..6134a534b3 100644
 #define qemu_ram_foreach_block \
   #warning "Use foreach_not_ignored_block in migration code"
 -- 
-2.18.4
+2.27.0
--- a/0007-Add-aarch64-machine-types.patch
+++ b/0007-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From fcf44f2334a6d82709b9c64d45fa2ab1aec595b9 Mon Sep 17 00:00:00 2001
+From ee8aeb6b79bde21b581090c479faf10e716a7e6d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -6,59 +6,16 @@ Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (4.0.0):
 - Use upstream compat handling
 Rebase notes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 Rebase notes (4.2.0-rc0):
 - Set numa_mem_supported
 Rebase notes (4.2.0-rc3):
 - aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
 - aarch64: virt: Allow more than 1TB of RAM (patch 92249)
 - aarch64: virt: Allow PCDIMM instantiation (patch 92247)
 - aarch64: virt: Enhance the comment related to gic-version (patch 92248)
 Rebase notes (5.0.0):
 - Set default_ram_id in rhel_machine_class_init
 - Added setting acpi properties
 Rebase notes (5.1.0):
 - Added ras property
 - Added to virt_machine_device_unplug_cb to machine type (upstream)
 - added mte property (upstream)
 Merged patches (4.0.0):
 - 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
 - 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
 - 4d20863 aarch64: Use 256MB ECAM region by default
 Merged patches (4.1.0):
 - c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
 - 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
 Merged patches (5.2.0 rc0):
 - 12990ad hw/arm: Changes to rhel820 machine
 - 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
 - 098954a hw/arm: Add rhel830 machine type
 - ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
 - e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
 - 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
 - 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
 ---
- hw/arm/virt.c         | 191 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 211 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 196 insertions(+), 3 deletions(-)
+ 2 files changed, 218 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index c908b5fcf4..21e0485ac5 100644
+index f904d3e98e..080cf54ef1 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -79,6 +79,7 @@
+@@ -80,6 +80,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
@ -66,7 +23,7 @@ index c908b5fcf4..21e0485ac5 100644
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -105,7 +106,49 @@
+@@ -106,7 +107,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@ -88,7 +45,6 @@ index c908b5fcf4..21e0485ac5 100644
 +    static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
 +        .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
 +        .parent = TYPE_RHEL_MACHINE,                                    \
 +        .instance_init = rhel##m##n##s##_virt_instance_init,            \
 +        .class_init = rhel##m##n##s##_virt_class_init,                  \
 +    };                                                                  \
 +    static void rhel##m##n##s##_machvirt_init(void)                     \
@ -117,7 +73,7 @@ index c908b5fcf4..21e0485ac5 100644
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2027,6 +2070,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2113,6 +2155,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -125,15 +81,15 @@ index c908b5fcf4..21e0485ac5 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2055,6 +2099,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2140,6 +2183,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-     VirtMachineState *vms = VIRT_MACHINE(obj);
+@@ -2237,6 +2281,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
@@ -2108,6 +2153,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
@ -141,40 +97,23 @@ index c908b5fcf4..21e0485ac5 100644
 static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2121,13 +2167,14 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
+@@ -2264,6 +2309,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 -
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
     return vms->mte;
 }
 +#endif /* disabled for RHEL */
 static void virt_set_mte(Object *obj, bool value, Error **errp)
 {
@@ -2135,7 +2182,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
-
+#endif /* disabled for RHEL */
-+#endif
+ 
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-     VirtMachineState *vms = VIRT_MACHINE(obj);
+@@ -2584,6 +2630,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
-@@ -2442,6 +2489,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+     return fixed_ipa ? 0 : requested_pa_size;
     return requested_pa_size > 40 ? requested_pa_size : 0;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -2730,3 +2778,140 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -2910,3 +2957,165 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -216,26 +155,24 @@ index c908b5fcf4..21e0485ac5 100644
 +        NULL, NULL);
 +    object_class_property_set_description(oc, "acpi",
 +        "Enable ACPI");
 +}
 +
-+static const TypeInfo rhel_machine_info = {
+    object_class_property_add_str(oc, "x-oem-id",
-+    .name          = TYPE_RHEL_MACHINE,
+                                  virt_get_oem_id,
-+    .parent        = TYPE_MACHINE,
+                                  virt_set_oem_id);
-+    .abstract      = true,
+    object_class_property_set_description(oc, "x-oem-id",
-+    .instance_size = sizeof(VirtMachineState),
+                                          "Override the default value of field OEMID "
-+    .class_size    = sizeof(VirtMachineClass),
+                                          "in ACPI table header."
-+    .class_init    = rhel_machine_class_init,
+                                          "The string may be up to 6 bytes in size");
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
 +};
 +
-+static void rhel_machine_init(void)
+
-+{
+    object_class_property_add_str(oc, "x-oem-table-id",
-+    type_register_static(&rhel_machine_info);
+                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
 +    object_class_property_set_description(oc, "x-oem-table-id",
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +}
 +type_init(rhel_machine_init);
 +
 +static void rhel_virt_instance_init(Object *obj)
 +{
@ -244,22 +181,23 @@ index c908b5fcf4..21e0485ac5 100644
 +
 +    /* EL3 is disabled by default and non-configurable for RHEL */
 +    vms->secure = false;
 +
 +    /* EL2 is disabled by default and non-configurable for RHEL */
 +    vms->virt = false;
-+    /* High memory is enabled by default for RHEL */
+
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    object_property_add_bool(obj, "highmem", virt_get_highmem,
 +                             virt_set_highmem);
 +    object_property_set_description(obj, "highmem",
 +                                    "Set on/off to enable/disable using "
 +                                    "physical address space above 32 bits");
 +
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +    object_property_add_str(obj, "gic-version", virt_get_gic_version,
 +                        virt_set_gic_version);
 +    object_property_set_description(obj, "gic-version",
 +                                    "Set GIC version. "
-+                                    "Valid values are 2, 3 and host");
+                                    "Valid values are 2, 3, host and max");
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +
@ -282,44 +220,70 @@ index c908b5fcf4..21e0485ac5 100644
 +                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3");
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
-+    /* MTE is disabled by default.  */
+
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
-+    vms->irqmap=a15irqmap;
+    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +
 +}
 +
-+static void rhel830_virt_instance_init(Object *obj)
+static const TypeInfo rhel_machine_info = {
 +    .name          = TYPE_RHEL_MACHINE,
 +    .parent        = TYPE_MACHINE,
 +    .abstract      = true,
 +    .instance_size = sizeof(VirtMachineState),
 +    .class_size    = sizeof(VirtMachineClass),
 +    .class_init    = rhel_machine_class_init,
 +    .instance_init = rhel_virt_instance_init,
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
 +};
 +
 +static void rhel_machine_init(void)
 +{
-+    rhel_virt_instance_init(obj);
+    type_register_static(&rhel_machine_info);
 +}
 +type_init(rhel_machine_init);
 +
 +static void rhel840_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(8, 4, 0)
 +
 +static void rhel830_virt_options(MachineClass *mc)
 +{
-+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(8, 3, 0)
 +
-+static void rhel820_virt_instance_init(Object *obj)
+    rhel840_virt_options(mc);
-+{
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
-+    rhel_virt_instance_init(obj);
+    vmc->no_kvm_steal_time = true;
 +}
 +DEFINE_RHEL_MACHINE(8, 3, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
 +    rhel830_virt_options(mc);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_2,
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +                     hw_compat_rhel_8_2_len);
 +    mc->numa_mem_supported = true;
 +    mc->auto_enable_numa_with_memdev = false;
 +}
 +DEFINE_RHEL_MACHINE(8, 2, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index aad6d69841..745b76b186 100644
+index 921416f918..6c34864a0a 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -167,9 +167,17 @@ struct VirtMachineState {
+@@ -170,9 +170,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
@ -338,5 +302,5 @@ index aad6d69841..745b76b186 100644
 bool virt_is_acpi_enabled(VirtMachineState *vms);
 -- 
-2.18.4
+2.27.0
--- a/0008-Add-ppc64-machine-types.patch
+++ b/0008-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From 06a8855e3b36996d4478219c008986877a253674 Mon Sep 17 00:00:00 2001
+From d70214aa1d8bf7aae9ef3a6bbc04f01735722e3c Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -6,56 +6,23 @@ Subject: Add ppc64 machine types
 Adding changes to add RHEL machine types for ppc64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - remove instance options and use upstream solution
 - Use upstream compat handling
 - Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
 - re-add handling of instance_options (removed upstream)
 - Use p8 as default for rhel machine types (p9 default upstream)
 - sPAPRMachineClass renamed to SpaprMachineClass (upstream)
 Rebase changes (4.1.0):
 - Update format for compat structures
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
 Merged patches (4.1.0):
 - f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
 - 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
 - 89f01da redhat: define pseries-rhel8.1.0 machine type
 Merged patches (4.2.0):
 - bcba728 redhat: update pseries-rhel8.1.0 machine type
 - redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
 - redhat: define pseries-rhel8.2.0 machine type (patch 93041)
 Merged patches (5.1.0):
 - eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
 Merged patches (5.2.0 rc0):
 - 311a20f redhat: define pseries-rhel8.3.0 machine type
 - 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
 - 1ab8783 redhat: update pseries-rhel8.2.0 machine type
 - b162af531a target/ppc: Add experimental option for enabling secure guests
 ---
- hw/ppc/spapr.c          | 337 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 368 ++++++++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_cpu_core.c |  13 ++
 include/hw/ppc/spapr.h  |   4 +
 target/ppc/compat.c     |  13 +-
 target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 ++++
+ target/ppc/kvm.c        |  27 +++
 target/ppc/kvm_ppc.h    |  13 ++
- 7 files changed, 407 insertions(+), 1 deletion(-)
+ 7 files changed, 438 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 12a012d9dd..4a838cc955 100644
+index e4be00b732..f9e8dfdfc9 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1585,6 +1585,9 @@ static void spapr_machine_reset(MachineState *machine)
+@@ -1568,6 +1568,9 @@ static void spapr_machine_reset(MachineState *machine)
-     kvmppc_svm_off(&error_fatal);
+     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
 +    if (spapr->svm_allowed) {
 +        kvmppc_svm_allow(&error_fatal);
@ -63,7 +30,7 @@ index 12a012d9dd..4a838cc955 100644
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3266,6 +3269,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3254,6 +3257,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
@ -84,7 +51,7 @@ index 12a012d9dd..4a838cc955 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3321,6 +3338,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3327,6 +3344,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -97,7 +64,7 @@ index 12a012d9dd..4a838cc955 100644
 }
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4459,6 +4482,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4554,6 +4577,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     smc->smp_threads_vsmt = true;
     smc->nr_xirqs = SPAPR_NR_XIRQS;
     xfc->match_nvt = spapr_match_nvt;
@ -105,15 +72,15 @@ index 12a012d9dd..4a838cc955 100644
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4509,6 +4533,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4604,6 +4628,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-5.2
+  * pseries-6.0
  */
-@@ -4588,6 +4613,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4694,6 +4719,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -121,36 +88,63 @@ index 12a012d9dd..4a838cc955 100644
 /*
  * pseries-4.0
-@@ -4604,6 +4630,7 @@ static void phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4713,6 +4739,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
     return true;
 }
- 
+
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4762,6 +4789,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+@@ -4871,6 +4899,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
 +#endif
- static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
-@@ -4816,6 +4844,7 @@ static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+@@ -4926,6 +4955,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
-     *nv2atsd = 0;
+     return true;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4930,6 +4959,314 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -5040,6 +5070,344 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
 +#endif
 +
 +static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 +{
 +    /*
 +     * Defaults for the latest behaviour inherited from the base class
 +     * can be overriden here for all pseries-rhel* machines.
 +     */
 +
 +    /* Maximum supported VCPU count */
 +    mc->max_cpus = 384;
 +}
 +
 +/*
 + * pseries-rhel8.4.0
 + * like pseries-5.2
 + */
 +
 +static void spapr_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", true);
 +
 +/*
 + * pseries-rhel8.3.0
 + * like pseries-5.1
@ -158,13 +152,17 @@ index 12a012d9dd..4a838cc955 100644
 +
 +static void spapr_machine_rhel830_class_options(MachineClass *mc)
 +{
-+    /* Defaults for the latest behaviour inherited from the base class */
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
-+    /* Maximum supported VCPU count for all pseries-rhel* machines */
+    spapr_machine_rhel840_class_options(mc);
-+    mc->max_cpus = 384;
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +
 +    /* from pseries-5.1 */
 +    smc->pre_5_2_numa_associativity = true;
 +}
 +
-+DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", true);
+DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", false);
 +
 +/*
 + * pseries-rhel8.2.0
@ -461,7 +459,7 @@ index 12a012d9dd..4a838cc955 100644
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 55d36e0069..008074bae0 100644
+index 64178f0f9a..2bff13a6ab 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -24,6 +24,7 @@
@ -499,18 +497,18 @@ index 55d36e0069..008074bae0 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index 2e89e36cfb..ba2d81404b 100644
+index bf7cab7a2c..54cdde8980 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -140,6 +140,7 @@ struct SpaprMachineClass {
+@@ -143,6 +143,7 @@ struct SpaprMachineClass {
     bool pre_5_1_assoc_refpoints;
     bool pre_5_2_numa_associativity;
 +    bool has_power9_support;
-     void (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
+     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -220,6 +221,9 @@ struct SpaprMachineState {
+@@ -223,6 +224,9 @@ struct SpaprMachineState {
     int fwnmi_machine_check_interlock;
     QemuCond fwnmi_machine_check_interlock_cond;
@ -546,7 +544,7 @@ index 7949a24f5a..f207a9ba01 100644
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 2609e4082e..21c63b5360 100644
+index e73416da68..4eb427a601 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
@@ -1347,6 +1347,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
@ -558,7 +556,7 @@ index 2609e4082e..21c63b5360 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index daf690a678..9bf3449adb 100644
+index 104a308abb..cb0fb67383 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
@@ -89,6 +89,7 @@ static int cap_ppc_count_cache_flush_assist;
@ -577,7 +575,7 @@ index daf690a678..9bf3449adb 100644
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
-@@ -2538,6 +2540,16 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
+@@ -2551,6 +2553,16 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
     return 0;
 }
@ -594,9 +592,9 @@ index daf690a678..9bf3449adb 100644
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 {
     uint32_t host_pvr = mfpvr();
-@@ -2947,3 +2959,18 @@ void kvmppc_svm_off(Error **errp)
+@@ -2947,3 +2959,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
-         error_setg_errno(errp, -rc, "KVM_PPC_SVM_OFF ioctl failed");
+ {
-     }
+     return true;
 }
 +
 +void kvmppc_svm_allow(Error **errp)
@ -614,18 +612,18 @@ index daf690a678..9bf3449adb 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 73ce2bc951..1239b841fd 100644
+index 989f61ace0..2e7a5d3fc1 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
-@@ -40,6 +40,7 @@ target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
+@@ -39,6 +39,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
 void kvmppc_svm_off(Error **errp);
 +void kvmppc_svm_allow(Error **errp);
 #ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
-@@ -73,6 +74,8 @@ int kvmppc_set_cap_nested_kvm_hv(int enable);
+@@ -72,6 +73,8 @@ int kvmppc_set_cap_nested_kvm_hv(int enable);
 int kvmppc_get_cap_large_decr(void);
 int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_enable_hwrng(void);
@ -634,7 +632,7 @@ index 73ce2bc951..1239b841fd 100644
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -387,6 +390,16 @@ static inline int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
+@@ -381,6 +384,16 @@ static inline int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
     return -1;
 }
@ -652,5 +650,5 @@ index 73ce2bc951..1239b841fd 100644
 {
     return -1;
 -- 
-2.18.4
+2.27.0
--- a/0009-Add-s390x-machine-types.patch
+++ b/0009-Add-s390x-machine-types.patch
@ -1,4 +1,4 @@
-From 36540969ad3b08f1964c71406f1fc14c0e5b47de Mon Sep 17 00:00:00 2001
+From 09eba380295aef0a27d3fbcdda43019ab2898e08 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@ -6,29 +6,15 @@ Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (weekly-4.1.0):
 - Use upstream compat handling
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
 Merged patches (4.1.0):
 - 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
 Merged patches (4.2.0):
 - fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 - hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
 ---
- hw/s390x/s390-virtio-ccw.c | 71 +++++++++++++++++++++++++++++++++++++-
+ hw/s390x/s390-virtio-ccw.c | 87 +++++++++++++++++++++++++++++++++++++-
- 1 file changed, 70 insertions(+), 1 deletion(-)
+ 1 file changed, 86 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 4e140bbead..b8dde7e4e1 100644
+index 2972b607f3..8df6dd1c71 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -765,7 +765,7 @@ bool css_migration_enabled(void)
+@@ -771,7 +771,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
@ -37,29 +23,44 @@ index 4e140bbead..b8dde7e4e1 100644
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = true;                                            \
-@@ -789,6 +789,7 @@ bool css_migration_enabled(void)
+@@ -795,6 +795,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_5_2_instance_options(MachineState *machine)
+ static void ccw_machine_6_0_instance_options(MachineState *machine)
 {
 }
-@@ -1053,6 +1054,74 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1071,6 +1072,90 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", true);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
-+DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", true);
+DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
@ -81,6 +82,7 @@ index 4e140bbead..b8dde7e4e1 100644
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
@ -121,5 +123,5 @@ index 4e140bbead..b8dde7e4e1 100644
 static void ccw_machine_register_types(void)
 {
 -- 
-2.18.4
+2.27.0
--- a/0010-Add-x86_64-machine-types.patch
+++ b/0010-Add-x86_64-machine-types.patch
@ -1,4 +1,4 @@
-From 004d31cf0e8bb83374a85ecab59eb22683a1e361 Mon Sep 17 00:00:00 2001
+From a082c53cc14afcd2ad77262575af50e164e75649 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@ -6,63 +6,23 @@ Subject: Add x86_64 machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (qemu-4.0.0):
 - Use upstream compat handling
 Rebase notes (3.1.0):
 - Removed xsave changes
 Rebase notes (4.1.0):
 - Updated format for compat structures
 Rebase notes (4.2.0-rc2):
 - Use X86MachineClass for save_tsc_khz (upstream change)
 Merged patches (4.1.0):
 - f4dc802 pc: 7.5 compat entries
 - 456ed3e pc: PC_RHEL7_6_COMPAT
 - 04119ee pc: Add compat for pc-i440fx-rhel7.6.0 machine type
 - b3b3687 pc: Add pc-q35-8.0.0 machine type
 - 8d46fc6 pc: Add x-migrate-smi-count=off to PC_RHEL7_6_COMPAT
 - 1de7949 kvm: clear out KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT for older machine types
 - 18cf0d7 target/i386: Disable MPX support on named CPU models (partialy)
 - 2660667 rhel: Set host-phys-bits-limit=48 on rhel machine-types
 Merged patches (4.2.0):
 - 7d5c2ef pc: Don't make die-id mandatory unless necessary
 - e42808c x86 machine types: pc_rhel_8_0_compat
 - 9de83a8 x86 machine types: q35: Fixup units_per_default_bus
 - 6df1559 x86 machine types: Fixup dynamic sysbus entries
 - 0784125 x86 machine types: add pc-q35-rhel8.1.0
 - machines/x86: Add rhel 8.2 machine type (patch 92959)
 Merged patches (5.1.0):
 - 481357e RHEL: hw/i386: disable nested PERF_GLOBAL_CTRL MSR support
 - e6c3fbf hw/smbios: set new default SMBIOS fields for Windows driver support (partialy)
 Merged patches (5.2.0 rc0):
 - b02c9f5 x86: Add 8.3.0 x86_64 machine type
 - f2edc4f q35: Set max_cpus to 512
 - 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
 - 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
 - e2d3209 x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (partialy)
 ---
 hw/i386/acpi-build.c       |   3 +
- hw/i386/pc.c         | 273 ++++++++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc.c               | 277 ++++++++++++++++++++++++++++++++++++-
- hw/i386/pc_piix.c    | 215 +++++++++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c          | 225 +++++++++++++++++++++++++++++-
- hw/i386/pc_q35.c     | 185 ++++++++++++++++++++++++++++-
+ hw/i386/pc_q35.c           | 214 +++++++++++++++++++++++++++-
 include/hw/boards.h        |   2 +
- include/hw/i386/pc.h |  36 ++++++
+ include/hw/i386/pc.h       |  39 ++++++
 target/i386/cpu.c          |   3 +-
- target/i386/kvm.c    |   4 +
+ target/i386/kvm/kvm.c      |   4 +
- 8 files changed, 714 insertions(+), 7 deletions(-)
+ tests/qtest/pvpanic-test.c |   5 +-
 9 files changed, 763 insertions(+), 9 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
-index 1f5c211245..b1082bd412 100644
+index de98750aef..7bd67f7877 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
-@@ -217,6 +217,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
+@@ -231,6 +231,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
         pm->fadt.reset_reg = r;
         pm->fadt.reset_val = 0xf;
         pm->fadt.flags |= 1 << ACPI_FADT_F_RESET_REG_SUP;
@ -73,10 +33,10 @@ index 1f5c211245..b1082bd412 100644
         pm->smi_on_cpuhp =
             !!(smi_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT));
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 17b514d1da..f3fc695fe2 100644
+index 8a84b25a03..edc02a68ca 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -352,6 +352,271 @@ GlobalProperty pc_compat_1_4[] = {
+@@ -355,6 +355,275 @@ GlobalProperty pc_compat_1_4[] = {
 };
 const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
@ -91,11 +51,15 @@ index 17b514d1da..f3fc695fe2 100644
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */ 
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* BZ 1846886 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
 +
 +GlobalProperty pc_rhel_8_2_compat[] = {
 +    /* pc_rhel_8_2_compat from pc_compat_4_2 */
 +    { "mch", "smbase-smram", "off" },
@ -348,7 +312,7 @@ index 17b514d1da..f3fc695fe2 100644
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
-@@ -970,7 +1235,8 @@ void pc_memory_init(PCMachineState *pcms,
+@@ -952,7 +1221,8 @@ void pc_memory_init(PCMachineState *pcms,
     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
                            &error_fatal);
@ -358,7 +322,7 @@ index 17b514d1da..f3fc695fe2 100644
         memory_region_set_readonly(option_rom_mr, true);
     }
     memory_region_add_subregion_overlap(rom_memory,
-@@ -1674,6 +1940,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1702,6 +1972,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->pvh_enabled = true;
     pcmc->kvmclock_create_always = true;
     assert(!mc->get_hotplug_handler);
@ -367,7 +331,7 @@ index 17b514d1da..f3fc695fe2 100644
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1685,7 +1953,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1713,7 +1985,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_boot_order = "cad";
     mc->smp_parse = pc_smp_parse;
     mc->block_default_type = IF_IDE;
@ -378,7 +342,7 @@ index 17b514d1da..f3fc695fe2 100644
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 9fcc5aaf69..815da79108 100644
+index 62433d8022..d9c5df16d8 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -54,6 +54,7 @@
@ -408,7 +372,7 @@ index 9fcc5aaf69..815da79108 100644
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -1007,3 +1009,212 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+@@ -927,3 +929,222 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
@ -421,8 +385,9 @@ index 9fcc5aaf69..815da79108 100644
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    m->family = "pc_piix_Y";
-+    m->default_machine_opts = "firmware=bios-256k.bin";
+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->default_nic_model = "e1000";
 +    pcmc->pci_root_uid = 0;
 +    m->default_display = "std";
 +    m->no_parallel = 1;
 +    m->numa_mem_supported = true;
@ -448,6 +413,15 @@ index 9fcc5aaf69..815da79108 100644
 +    m->smbus_no_migration_support = true;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
@ -622,7 +596,7 @@ index 9fcc5aaf69..815da79108 100644
 +DEFINE_PC_MACHINE(rhel700, "pc-i440fx-rhel7.0.0", pc_init_rhel700,
 +                  pc_machine_rhel700_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index f6c2ef4e43..3340008c00 100644
+index fce52ca70b..44109e4876 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -195,8 +195,8 @@ static void pc_q35_init(MachineState *machine)
@ -644,7 +618,7 @@ index f6c2ef4e43..3340008c00 100644
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -568,3 +569,183 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -581,3 +582,212 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
@ -657,9 +631,10 @@ index f6c2ef4e43..3340008c00 100644
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->default_nic_model = "e1000e";
 +    pcmc->pci_root_uid = 0;
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
-+    m->default_machine_opts = "firmware=bios-256k.bin";
+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
@ -668,10 +643,30 @@ index f6c2ef4e43..3340008c00 100644
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
-+    m->max_cpus = 512;
+    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
 +                  pc_q35_machine_rhel840_options);
 +
 +
 +static void pc_q35_init_rhel830(MachineState *machine)
 +{
 +    pc_q35_init(machine);
@ -680,10 +675,19 @@ index f6c2ef4e43..3340008c00 100644
 +static void pc_q35_machine_rhel830_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
+    pc_q35_machine_rhel840_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
@ -697,9 +701,8 @@ index f6c2ef4e43..3340008c00 100644
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
+    pc_q35_machine_rhel830_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    pcmc->smbios_stream_product = "RHEL-AV";
@ -829,10 +832,10 @@ index f6c2ef4e43..3340008c00 100644
 +DEFINE_PC_MACHINE(q35_rhel730, "pc-q35-rhel7.3.0", pc_q35_init_rhel730,
 +                  pc_q35_machine_rhel730_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index dd18c9e94d..4e4a54b313 100644
+index 2d7a65724a..90ae100bfc 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -202,6 +202,8 @@ struct MachineClass {
+@@ -243,6 +243,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
@ -842,10 +845,10 @@ index dd18c9e94d..4e4a54b313 100644
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index ae6bf1d209..e2ba9a4b58 100644
+index 93c012ac95..79a7803a2f 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -125,6 +125,9 @@ struct PCMachineClass {
+@@ -128,6 +128,9 @@ struct PCMachineClass {
     /* create kvmclock device even when KVM PV features are not exposed */
     bool kvmclock_create_always;
@ -855,13 +858,16 @@ index ae6bf1d209..e2ba9a4b58 100644
 };
 #define TYPE_PC_MACHINE "generic-pc-machine"
-@@ -266,6 +269,39 @@ extern const size_t pc_compat_1_5_len;
+@@ -275,6 +278,42 @@ extern const size_t pc_compat_1_5_len;
 extern GlobalProperty pc_compat_1_4[];
 extern const size_t pc_compat_1_4_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_2_compat[];
 +extern const size_t pc_rhel_8_2_compat_len;
 +
@ -896,10 +902,10 @@ index ae6bf1d209..e2ba9a4b58 100644
  * depending on QEMU versions up to QEMU 2.4.
  */
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 5a8c96072e..dc592e990e 100644
+index ad99cad0e7..c30bb2a6b0 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
-@@ -1803,7 +1803,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
+@@ -1882,7 +1882,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
@ -908,7 +914,7 @@ index 5a8c96072e..dc592e990e 100644
         .stepping = 3,
         .features[FEAT_1_EDX] =
             PPRO_FEATURES |
-@@ -4117,6 +4117,7 @@ static PropValue kvm_default_props[] = {
+@@ -4264,6 +4264,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
@ -916,11 +922,11 @@ index 5a8c96072e..dc592e990e 100644
     { NULL, NULL },
 };
-diff --git a/target/i386/kvm.c b/target/i386/kvm.c
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index a2934dda02..19bc39b9e3 100644
+index 7fe9f52710..4c69c2cb4b 100644
--- a/target/i386/kvm.c
+--- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm.c
+++ b/target/i386/kvm/kvm.c
-@@ -3126,6 +3126,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3181,6 +3181,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
@ -928,7 +934,7 @@ index a2934dda02..19bc39b9e3 100644
     kvm_msr_buf_reset(cpu);
-@@ -3438,6 +3439,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3499,6 +3500,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
@ -938,6 +944,29 @@ index a2934dda02..19bc39b9e3 100644
             break;
         case MSR_KVM_ASYNC_PF_INT:
             env->async_pf_int_msr = msrs[i].data;
-- 
+diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-2.18.4
+index 6dcad2db49..580c2c43d2 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=none");
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
@@ -40,7 +40,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=pause");
 +    /* RHEL: Use q35 */
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
 -- 
 2.27.0
--- a/0011-Enable-make-check.patch
+++ b/0011-Enable-make-check.patch
@ -1,4 +1,4 @@
-From 7b8ca8c1cbd3763900e3e472556116c9832e06f8 Mon Sep 17 00:00:00 2001
+From 5f6a55a218029af944a8d02ab9264647315890d3 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
@ -7,88 +7,87 @@ Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - Remove testing for pseries-2.7 in endianess test
 - Disable device-plug-test on s390x as it use disabled device
 - Do not run cpu-plug-tests on 7.3 and older machine types
 Rebase changes (4.1.0-rc0):
 - removed iotests 068
 Rebase changes (4.1.0-rc1):
 - remove all 205 tests (unstable)
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 Rebase changes (5.1.0-rc1):
 - Disable qtest/q35-test (uses upstream machine types)
 - Do not run iotests on make checka
 - Enabled iotests 071 and 099
 Rebase changes (5.2.0 rc0):
 - Disable cdrom tests (unsupported devices) on x86_64
 - disable fuzz test
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
 Conflicts:
 	redhat/qemu-kvm.spec.template
 ---
- redhat/qemu-kvm.spec.template       |  4 ++--
+ redhat/qemu-kvm.spec.template       |  6 ++----
- tests/qemu-iotests/051              | 12 ++++++------
+ tests/qemu-iotests/051              |  8 ++++----
 tests/qtest/bios-tables-test.c      |  6 +++---
 tests/qtest/boot-serial-test.c      |  6 +++++-
- tests/qtest/cdrom-test.c            |  2 ++
+ tests/qtest/cdrom-test.c            |  4 ++++
 tests/qtest/cpu-plug-test.c         |  4 ++--
 tests/qtest/e1000-test.c            |  2 ++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/hd-geo-test.c           |  4 ++++
- tests/qtest/meson.build             | 10 ++--------
+ tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             | 11 +++--------
 tests/qtest/prom-env-test.c         |  4 ++++
 tests/qtest/test-x86-cpuid-compat.c |  2 ++
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
- 11 files changed, 35 insertions(+), 19 deletions(-)
+ tests/unit/meson.build              |  2 +-
 17 files changed, 44 insertions(+), 27 deletions(-)
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
-index bee26075b2..61d25c4ed7 100755
+index 7bf29343d7..fd63402d78 100755
 --- a/tests/qemu-iotests/051
 +++ b/tests/qemu-iotests/051
-@@ -183,11 +183,11 @@ run_qemu -drive if=virtio
+@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive if=none,id=disk -device ide-drive,drive=disk
         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-disk,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-disk,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
-@@ -236,11 +236,11 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
+@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-drive,drive=disk
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-disk,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-disk,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
 diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
 index 156d4174aa..b4a1074b77 100644
 --- a/tests/qtest/bios-tables-test.c
 +++ b/tests/qtest/bios-tables-test.c
@@ -1299,7 +1299,7 @@ static void test_acpi_virt_tcg_numamem(void)
     free_test_data(&data);
 }
 -
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
 static void test_acpi_virt_tcg_pxb(void)
 {
     test_data data = {
@@ -1331,7 +1331,7 @@ static void test_acpi_virt_tcg_pxb(void)
     free_test_data(&data);
 }
 -
 +#endif
 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
     test_data data;
@@ -1561,7 +1561,7 @@ int main(int argc, char *argv[])
         qtest_add_func("acpi/virt", test_acpi_virt_tcg);
         qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
         qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
 -        qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
 +/*        qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
         qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
     }
     ret = g_test_run();
 diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
-index b6b1c23cd0..cefa1b38b7 100644
+index d74509b1c5..a64c55e384 100644
 --- a/tests/qtest/boot-serial-test.c
 +++ b/tests/qtest/boot-serial-test.c
@@ -120,19 +120,23 @@ static testdef_t tests[] = {
@ -117,7 +116,7 @@ index b6b1c23cd0..cefa1b38b7 100644
     { "sparc", "LX", "", "TMS390S10" },
     { "sparc", "SS-4", "", "MB86904" },
 diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
-index 5af944a5fb..cd5b8e0f16 100644
+index 5af944a5fb..69d9bac38a 100644
 --- a/tests/qtest/cdrom-test.c
 +++ b/tests/qtest/cdrom-test.c
@@ -140,6 +140,7 @@ static void add_x86_tests(void)
@ -136,6 +135,22 @@ index 5af944a5fb..cd5b8e0f16 100644
 }
 static void add_s390x_tests(void)
@@ -220,6 +222,7 @@ int main(int argc, char **argv)
             "magnum", "malta", "pica61", NULL
         };
         add_cdrom_param_tests(mips64machines);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
         const char *armmachines[] = {
             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
@@ -227,6 +230,7 @@ int main(int argc, char **argv)
             "vexpress-a9", "virt", NULL
         };
         add_cdrom_param_tests(armmachines);
 +#endif
     } else {
         const char *nonemachine[] = { "none", NULL };
         add_cdrom_param_tests(nonemachine);
 diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
 index a1c689414b..a8f076711c 100644
 --- a/tests/qtest/cpu-plug-test.c
@ -167,6 +182,32 @@ index ea286d1793..a1847ac8ed 100644
 };
 static void *e1000_get_driver(void *obj, const char *interface)
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 66229e6096..947fba73b7 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index aaf6d10e18..43727d62ac 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
 index f7b7cfbc2d..99cccf8638 100644
 --- a/tests/qtest/hd-geo-test.c
@ -199,20 +240,45 @@ index f7b7cfbc2d..99cccf8638 100644
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 1cddf5bdaa..2f4a564105 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -41,7 +41,7 @@ libqos_srcs = files('../libqtest.c',
         'virtio-serial.c',
         # qgraph machines:
 -        'aarch64-xlnx-zcu102-machine.c',
 +#        'aarch64-xlnx-zcu102-machine.c',
         'arm-imx25-pdk-machine.c',
         'arm-n800-machine.c',
         'arm-raspi2-machine.c',
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index fe0bef9980..7a9d51579b 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index c19f1c8503..15ed460ff0 100644
+index 0c76738921..b9a7426a7b 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -51,16 +51,13 @@ qtests_i386 = \
+@@ -71,7 +71,6 @@ qtests_i386 = \
    'ide-test',
    'hd-geo-test',
    'boot-order-test',
 -   'bios-tables-test',
    'rtc-test',
    'i440fx-test',
 -   'fuzz-test',
    'fw_cfg-test',
-    'device-plug-test',
+@@ -79,7 +78,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
@ -220,7 +286,7 @@ index c19f1c8503..15ed460ff0 100644
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
-@@ -111,17 +108,15 @@ qtests_moxie = [ 'boot-serial-test' ]
+@@ -130,17 +128,15 @@ qtests_moxie = [ 'boot-serial-test' ]
 qtests_ppc = \
   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
@ -240,7 +306,16 @@ index c19f1c8503..15ed460ff0 100644
   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
 qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
-@@ -164,7 +159,6 @@ qtests_s390x = \
+@@ -183,7 +179,7 @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
 -   'xlnx-can-test',
 +#   'xlnx-can-test',
    'migration-test']
 qtests_s390x = \
@@ -192,7 +188,6 @@ qtests_s390x = \
   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
   ['boot-serial-test',
    'drive_del-test',
@ -268,11 +343,11 @@ index f41d80154a..f8dc478ce8 100644
         add_tests(sparc_machines);
     } else if (!strcmp(arch, "sparc64")) {
 diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
-index 7ca1883a29..983aa0719a 100644
+index f28848e06e..6b2fd398a2 100644
 --- a/tests/qtest/test-x86-cpuid-compat.c
 +++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -300,6 +300,7 @@ int main(int argc, char **argv)
-                    "-cpu 486,xlevel2=0xC0000002,+xstore",
+                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
                    "xlevel2", 0xC0000002);
 +#if 0 /* Disabled in Red Hat Enterprise Linux */
@ -281,7 +356,7 @@ index 7ca1883a29..983aa0719a 100644
@@ -350,6 +351,7 @@ int main(int argc, char **argv)
     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
-                    "-machine pc-i440fx-2.4 -cpu SandyBridge,+svm,+npt",
+                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
                    "xlevel", 0x80000008);
 +#endif
@ -317,6 +392,19 @@ index 10ef9d2a91..3855873050 100644
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 diff --git a/tests/unit/meson.build b/tests/unit/meson.build
 index b3bc2109da..244d35f5d4 100644
 --- a/tests/unit/meson.build
 +++ b/tests/unit/meson.build
@@ -65,7 +65,7 @@ if have_block
     'test-blockjob': [testblock],
     'test-blockjob-txn': [testblock],
     'test-block-backend': [testblock],
 -    'test-block-iothread': [testblock],
 +#    'test-block-iothread': [testblock],
     'test-write-threshold': [testblock],
     'test-crypto-hash': [crypto],
     'test-crypto-hmac': [crypto],
 -- 
-2.18.4
+2.27.0
--- a/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From da70823afbdbb904950068fe5f0323ff75b0d4fc Mon Sep 17 00:00:00 2001
+From 22c0f47f02c5db63f3857dabc6cc7cb6bfc78158 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -23,25 +23,16 @@ matches the number of slots on a PCI bus and is also a nice power
 of two.
 Signed-off-by: Bandan Das <bsd@redhat.com>
 Rebase notes (2.8.0):
 - removed return value for vfio_realize (commit 1a22aca)
 Merged patches (2.9.0):
 - 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
 Merged patches (4.1.0-rc3):
 - 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
 hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 51dc373695..06ce2a39aa 100644
+index 5c65aa0a98..327b86703a 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -45,6 +45,9 @@
+@@ -46,6 +46,9 @@
 #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
@ -51,7 +42,7 @@ index 51dc373695..06ce2a39aa 100644
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
-@@ -2768,9 +2771,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2783,9 +2786,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     ssize_t len;
     struct stat st;
     int groupid;
@ -83,7 +74,7 @@ index 51dc373695..06ce2a39aa 100644
     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3207,6 +3231,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3222,6 +3246,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -94,7 +85,7 @@ index 51dc373695..06ce2a39aa 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 1574ef983f..fef907c112 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
@ -106,5 +97,5 @@ index 1574ef983f..fef907c112 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.18.4
+2.27.0
--- a/0013-Add-support-statement-to-help-output.patch
+++ b/0013-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From f69c3b855ec419b4afe240bbd039141a59aad808 Mon Sep 17 00:00:00 2001
+From ffd8eff2ce1d7eda81d425324593924c098f6c39 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index e6e0ad5a92..065d52e8dc 100644
+index aadb526138..6c8498022b 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -1688,9 +1688,17 @@ static void version(void)
+@@ -848,9 +848,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -42,7 +42,7 @@ index e6e0ad5a92..065d52e8dc 100644
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
             error_get_progname());
-@@ -1707,6 +1715,7 @@ static void help(int exitcode)
+@@ -867,6 +875,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
@ -51,5 +51,5 @@ index e6e0ad5a92..065d52e8dc 100644
 }
 -- 
-2.18.4
+2.27.0
--- a/0014-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/0014-globally-limit-the-maximum-number-of-CPUs.patch
@ -1,4 +1,4 @@
-From 9585c8927744d8b07b317063ef788e1f01773f0e Mon Sep 17 00:00:00 2001
+From b5dab6e678d9b53359b3a915421114258e803cad Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
@ -13,35 +13,15 @@ default and minimize the ppc hack in kvm-all.c.
 Signed-off-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 Rebase notes (2.11.0):
 - Removed CONFIG_RHV reference
 - Update commit log
 Merged patches (2.11.0):
 - 92fef14623 redhat: remove manual max_cpus limitations for ppc
 - bb722e9eff redhat: globally limit the maximum number of CPUs
 - fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
 - 0584216921 Match POWER max cpus to x86
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Merged patches (5.1.0):
 - redhat: globally limit the maximum number of CPUs
 - redhat: remove manual max_cpus limitations for ppc
 - use recommended max vcpu count
 Merged patches (5.2.0 rc0):
 - f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
 accel/kvm/kvm-all.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index baaa54249d..a1fbda0945 100644
+index b6d9f92f15..70a94ba76d 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -2108,6 +2108,18 @@ static int kvm_init(MachineState *ms)
+@@ -2095,6 +2095,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
@ -61,5 +41,5 @@ index baaa54249d..a1fbda0945 100644
         if (nc->num > soft_vcpus_limit) {
             warn_report("Number of %s cpus requested (%d) exceeds "
 -- 
-2.18.4
+2.27.0
--- a/0015-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0015-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,4 +1,4 @@
-From 091f9e47dc4609bfded5474cfe2797777cdd56f1 Mon Sep 17 00:00:00 2001
+From 55fde02ee1a9aa0e812af8534a9adf553accc522 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
@ -16,12 +16,6 @@ We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (5.1.0 rc0):
 - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
 Rebase notes (5.2.0 rc0):
 - rewrite patch to new docs structure
 ---
 docs/defs.rst.inc                      |  4 ++--
 docs/interop/live-block-operations.rst |  4 ++--
@ -31,7 +25,7 @@ Rebase notes (5.2.0 rc0):
 5 files changed, 17 insertions(+), 17 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
-index 48d05aaf33..d74dbdeca9 100644
+index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
@ -39,13 +33,13 @@ index 48d05aaf33..d74dbdeca9 100644
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
-.. |qemu_system_x86| replace:: qemu_system-x86_64
+-.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
-index e13f5a21f8..6650b2c975 100644
+index 1073b930dc..881432253f 100644
 --- a/docs/interop/live-block-operations.rst
 +++ b/docs/interop/live-block-operations.rst
@@ -129,7 +129,7 @@ To show some example invocations of command-line, we will use the
@ -125,10 +119,10 @@ index fb70445c75..0d9a783112 100644
 See also
 --------
 diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst
-index 866b7db3ee..5b3be8a6d6 100644
+index 00554c75bd..6e0fc94005 100644
 --- a/docs/tools/virtiofsd.rst
 +++ b/docs/tools/virtiofsd.rst
-@@ -297,7 +297,7 @@ Export ``/var/lib/fs/vm001/`` on vhost-user UNIX domain socket
+@@ -301,7 +301,7 @@ Export ``/var/lib/fs/vm001/`` on vhost-user UNIX domain socket
 ::
   host# virtiofsd --socket-path=/var/run/vm001-vhost-fs.sock -o source=/var/lib/fs/vm001
@ -138,10 +132,10 @@ index 866b7db3ee..5b3be8a6d6 100644
       -device vhost-user-fs-pci,chardev=char0,tag=myfs \
       -object memory-backend-memfd,id=mem,size=4G,share=on \
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 363a15b4e8..5e5e265331 100644
+index 0d4fb61bf7..79ca09feac 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -2935,11 +2935,11 @@ SRST
+@@ -3011,11 +3011,11 @@ SRST
     ::
@ -159,5 +153,5 @@ index 363a15b4e8..5e5e265331 100644
 ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
     Establish a vhost-vdpa netdev.
 -- 
-2.18.4
+2.27.0
--- a/0016-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/0016-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -1,4 +1,4 @@
-From 4d69dc90e66deec6bc6b46074ee44ef8c902266b Mon Sep 17 00:00:00 2001
+From 2ab1a61510036bd409532f24ea14fa693ec0362c Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
@ -42,11 +42,11 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 3db9a8aae9..82c025146d 100644
+index 6d80730287..bba3d75707 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
-@@ -823,6 +823,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-     SCSIDevice *sd = SCSI_DEVICE(dev);
+     AioContext *old_context;
     int ret;
 +    /* XXX: Remove this check once block backend is capable of handling
@ -62,5 +62,5 @@ index 3db9a8aae9..82c025146d 100644
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
 -- 
-2.18.4
+2.27.0
--- a/0017-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/0017-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -1,4 +1,4 @@
-From 18c5a8c24e22b7c2ba9f7e26cac190cefc7ecf26 Mon Sep 17 00:00:00 2001
+From 7b3d9142f3b296b127dce35336765dc16265d155 Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@ -32,10 +32,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index 9341e9782a..f11428eae9 100644
+index 9ea7ddd1e9..1338b677d2 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
-@@ -333,12 +333,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
+@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
@ -56,5 +56,5 @@ index 9341e9782a..f11428eae9 100644
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
-2.18.4
+2.27.0
--- a/0018-block-Versioned-x-blockdev-reopen-API-with-feature-f.patch
+++ b/0018-block-Versioned-x-blockdev-reopen-API-with-feature-f.patch
@ -1,4 +1,4 @@
-From 989cfded8fdd5df3b6b1f1a304ca16c128d7561b Mon Sep 17 00:00:00 2001
+From acdc84c1077be7d347414f781014ea785ce41d7b Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 13 Mar 2020 12:34:32 +0000
 Subject: block: Versioned x-blockdev-reopen API with feature flag
@ -26,13 +26,14 @@ Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 qapi/block-core.json | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
+ scripts/qapi/expr.py | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 04ad80bc1e..2a7dca299f 100644
+index 6d227924d0..15ad8cee05 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4143,10 +4143,17 @@
+@@ -4166,10 +4166,17 @@
 # image does not have a default backing file name as part of its
 # metadata.
 #
@ -51,6 +52,19 @@ index 04ad80bc1e..2a7dca299f 100644
 ##
 # @blockdev-del:
-- 
+diff --git a/scripts/qapi/expr.py b/scripts/qapi/expr.py
-2.18.4
+index 540b3982b1..884874d205 100644
 --- a/scripts/qapi/expr.py
 +++ b/scripts/qapi/expr.py
@@ -215,7 +215,7 @@ def check_features(features, info):
         check_keys(f, info, source, ['name'], ['if'])
         check_name_is_str(f['name'], info, source)
         source = "%s '%s'" % (source, f['name'])
 -        check_name_lower(f['name'], info, source)
 +        check_name_lower(f['name'], info, source, permit_underscore=True)
         check_if(f, info, source)
 -- 
 2.27.0
--- a/0021-redhat-Define-hw_compat_8_3.patch
+++ b/0021-redhat-Define-hw_compat_8_3.patch
@ -1,70 +0,0 @@
 From fa0063ba67071384d8c749cee8f4f4e5bbc8ef91 Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Fri, 20 Nov 2020 14:00:31 -0500
 Subject: redhat: Define hw_compat_8_3
 RH-Author: Greg Kurz <gkurz@redhat.com>
 Message-id: <20201120140033.578472-2-gkurz@redhat.com>
 Patchwork-id: 99790
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 1/3] redhat: Define hw_compat_8_3
 Bugzilla: 1893935
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/machine.c   | 21 +++++++++++++++++++++
 include/hw/boards.h |  3 +++
 2 files changed, 24 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 19d50dde45..aba05ad676 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -28,6 +28,27 @@
 #include "hw/mem/nvdimm.h"
 #include "migration/vmstate.h"
 +/*
 + * The same as hw_compat_5_1
 + */
 +GlobalProperty hw_compat_rhel_8_3[] = {
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-blk", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-blk-device", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-scsi-device", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +};
 +const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 +
 /*
  * The same as hw_compat_4_2 + hw_compat_5_0
  */
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 4e4a54b313..526e5aea04 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -369,6 +369,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_8_3[];
 +extern const size_t hw_compat_rhel_8_3_len;
 +
 extern GlobalProperty hw_compat_rhel_8_2[];
 extern const size_t hw_compat_rhel_8_2_len;
 -- 
 2.18.4
--- a/0022-redhat-Add-spapr_machine_rhel_default_class_options.patch
+++ b/0022-redhat-Add-spapr_machine_rhel_default_class_options.patch
@ -1,66 +0,0 @@
 From 943c936df3b6b5c3197ad727f2105e61778e749a Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Fri, 20 Nov 2020 14:00:32 -0500
 Subject: redhat: Add spapr_machine_rhel_default_class_options()
 RH-Author: Greg Kurz <gkurz@redhat.com>
 Message-id: <20201120140033.578472-3-gkurz@redhat.com>
 Patchwork-id: 99791
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 2/3] redhat: Add spapr_machine_rhel_default_class_options()
 Bugzilla: 1893935
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 RHEL may need to override some default property inherited from upstream.
 This is currently handled in the class_options() function of the latest
 machine type, and thus the defaults need to be carried around each time
 we add a new RHEL machine.
 Override the defaults in a dedicated function to be called by the
 latest RHEL machine type.
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 4a838cc955..1d7482b2fb 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -4961,6 +4961,17 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
 #endif
 +static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 +{
 +    /*
 +     * Defaults for the latest behaviour inherited from the base class
 +     * can be overriden here for all pseries-rhel* machines.
 +     */
 +
 +    /* Maximum supported VCPU count */
 +    mc->max_cpus = 384;
 +}
 +
 /*
  * pseries-rhel8.3.0
  * like pseries-5.1
@@ -4968,10 +4979,8 @@ DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
 static void spapr_machine_rhel830_class_options(MachineClass *mc)
 {
 -    /* Defaults for the latest behaviour inherited from the base class */
 -
 -    /* Maximum supported VCPU count for all pseries-rhel* machines */
 -    mc->max_cpus = 384;
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 }
 DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", true);
 -- 
 2.18.4
--- a/0023-redhat-Define-pseries-rhel8.4.0-machine-type.patch
+++ b/0023-redhat-Define-pseries-rhel8.4.0-machine-type.patch
@ -1,70 +0,0 @@
 From 030b5e6fba510b8b9f8c8690ef6ea63f71628d25 Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Fri, 20 Nov 2020 14:00:33 -0500
 Subject: redhat: Define pseries-rhel8.4.0 machine type
 RH-Author: Greg Kurz <gkurz@redhat.com>
 Message-id: <20201120140033.578472-4-gkurz@redhat.com>
 Patchwork-id: 99792
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 3/3] redhat: Define pseries-rhel8.4.0 machine type
 Bugzilla: 1893935
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 1d7482b2fb..4f61b64a21 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -4972,6 +4972,19 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
     mc->max_cpus = 384;
 }
 +/*
 + * pseries-rhel8.4.0
 + * like pseries-5.2
 + */
 +
 +static void spapr_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", true);
 +
 /*
  * pseries-rhel8.3.0
  * like pseries-5.1
@@ -4979,11 +4992,17 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 static void spapr_machine_rhel830_class_options(MachineClass *mc)
 {
 -    /* The default machine type must apply the RHEL specific defaults */
 -    spapr_machine_rhel_default_class_options(mc);
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel840_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +
 +    /* from pseries-5.1 */
 +    smc->pre_5_2_numa_associativity = true;
 }
 -DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", true);
 +DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", false);
 /*
  * pseries-rhel8.2.0
 -- 
 2.18.4
--- a/0024-redhat-s390x-add-rhel-8.4.0-compat-machine.patch
+++ b/0024-redhat-s390x-add-rhel-8.4.0-compat-machine.patch
@ -1,72 +0,0 @@
 From a6ae745cceee1acc3667f5ba5e007ca6c083f8a8 Mon Sep 17 00:00:00 2001
 From: Cornelia Huck <cohuck@redhat.com>
 Date: Tue, 1 Dec 2020 17:53:41 -0500
 Subject: redhat: s390x: add rhel-8.4.0 compat machine
 RH-Author: Cornelia Huck <cohuck@redhat.com>
 Message-id: <20201201175341.37537-3-cohuck@redhat.com>
 Patchwork-id: 100195
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/2] redhat: s390x: add rhel-8.4.0 compat machine
 Bugzilla: 1836282
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 Note that we did not publish a rhel-8.3.0 machine on s390x, so we
 need to add the respective hw_compat entry in the rhel-8.2.0 machine.
 Also, the hw_compat entry for 8.1 was missing; however, the contents
 there are not relevant for s390x.
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index b8dde7e4e1..c7b5bcb06b 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1056,15 +1056,29 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 #endif
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", true);
 +
 static void ccw_machine_rhel820_instance_options(MachineState *machine)
 {
 +    ccw_machine_rhel840_instance_options(machine);
 }
 static void ccw_machine_rhel820_class_options(MachineClass *mc)
 {
 +    ccw_machine_rhel840_class_options(mc);
     mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 }
 -DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", true);
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 static void ccw_machine_rhel760_instance_options(MachineState *machine)
 {
@@ -1086,6 +1100,7 @@ static void ccw_machine_rhel760_class_options(MachineClass *mc)
 {
     ccw_machine_rhel820_class_options(mc);
     /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 }
 -- 
 2.18.4
--- a/0027-block-vpc-Make-vpc_open-read-the-full-dynamic-header.patch
+++ b/0027-block-vpc-Make-vpc_open-read-the-full-dynamic-header.patch
@ -1,56 +0,0 @@
 From 974af930d4e5cae5611bb2e3a5ac18d3bda15a68 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 17 Dec 2020 17:58:43 +0100
 Subject: block/vpc: Make vpc_open() read the full dynamic header
 The dynamic header's size is 1024 bytes.
 vpc_open() reads only the 512 bytes of the dynamic header into buf[].
 Works, because it doesn't actually access the second half.  However, a
 colleague told me that GCC 11 warns:
    ../block/vpc.c:358:51: error: array subscript 'struct VHDDynDiskHeader[0]' is partly outside array bounds of 'uint8_t[512]' [-Werror=array-bounds]
 Clean up to read the full header.
 Rename buf[] to dyndisk_header_buf[] while there.
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 ---
 block/vpc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/block/vpc.c b/block/vpc.c
 index 1ab55f9287..2fcf3f6283 100644
 --- a/block/vpc.c
 +++ b/block/vpc.c
@@ -220,7 +220,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     QemuOpts *opts = NULL;
     Error *local_err = NULL;
     bool use_chs;
 -    uint8_t buf[HEADER_SIZE];
 +    uint8_t dyndisk_header_buf[1024];
     uint32_t checksum;
     uint64_t computed_size;
     uint64_t pagetable_size;
@@ -340,14 +340,14 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     }
     if (disk_type == VHD_DYNAMIC) {
 -        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
 -                         HEADER_SIZE);
 +        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
 +                         dyndisk_header_buf, 1024);
         if (ret < 0) {
             error_setg(errp, "Error reading dynamic VHD header");
             goto fail;
         }
 -        dyndisk_header = (VHDDynDiskHeader *) buf;
 +        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
         if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
             error_setg(errp, "Invalid header magic");
 -- 
 2.18.4
--- a/0028-GCC-11-warnings-hacks.patch
+++ b/0028-GCC-11-warnings-hacks.patch
@ -1,163 +0,0 @@
 From 6e9564986a00456c6748cf888d9ba9f7f0db01bf Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Mon, 4 Jan 2021 07:47:03 +0100
 Subject: GCC 11 warnings hacks
 ---
 hw/scsi/scsi-disk.c          | 13 +++++++------
 net/eth.c                    |  4 +++-
 target/s390x/kvm.c           |  2 +-
 target/s390x/misc_helper.c   |  2 +-
 tcg/aarch64/tcg-target.c.inc |  3 +--
 tests/test-block-iothread.c  | 12 ++++++------
 6 files changed, 19 insertions(+), 17 deletions(-)
 diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
 index 90841ad791..8ce77777d3 100644
 --- a/hw/scsi/scsi-disk.c
 +++ b/hw/scsi/scsi-disk.c
@@ -2578,14 +2578,15 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
     int len = scsi_cdb_length(buf);
     char *line_buffer, *p;
 -    line_buffer = g_malloc(len * 5 + 1);
 +    if (len > 0) {
 +        line_buffer = g_malloc(len * 5 + 1);
 +        for (i = 0, p = line_buffer; i < len; i++) {
 +            p += sprintf(p, " 0x%02x", buf[i]);
 +        }
 +        trace_scsi_disk_new_request(lun, tag, line_buffer);
 -    for (i = 0, p = line_buffer; i < len; i++) {
 -        p += sprintf(p, " 0x%02x", buf[i]);
 +        g_free(line_buffer);
     }
 -    trace_scsi_disk_new_request(lun, tag, line_buffer);
 -
 -    g_free(line_buffer);
 }
 static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
 diff --git a/net/eth.c b/net/eth.c
 index 1e0821c5f8..041ac4865a 100644
 --- a/net/eth.c
 +++ b/net/eth.c
@@ -405,6 +405,8 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
 +#pragma GCC diagnostic push
 +#pragma GCC diagnostic ignored "-Warray-bounds"
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
     if ((rthdr->rtype == 2) &&
@@ -424,7 +426,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         return bytes_read == sizeof(*dst_addr);
     }
 -
 +#pragma GCC diagnostic pop
     return false;
 }
 diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
 index 1839cc6648..ab1ca6b1bf 100644
 --- a/target/s390x/kvm.c
 +++ b/target/s390x/kvm.c
@@ -1918,7 +1918,7 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
      */
     if (qemu_name) {
         strncpy((char *)sysib.ext_names[0], qemu_name,
 -                sizeof(sysib.ext_names[0]));
 +                sizeof(sysib.ext_names[0])-1);
     } else {
         strcpy((char *)sysib.ext_names[0], "KVMguest");
     }
 diff --git a/target/s390x/misc_helper.c b/target/s390x/misc_helper.c
 index 58dbc023eb..adaf4145e6 100644
 --- a/target/s390x/misc_helper.c
 +++ b/target/s390x/misc_helper.c
@@ -370,7 +370,7 @@ uint32_t HELPER(stsi)(CPUS390XState *env, uint64_t a0, uint64_t r0, uint64_t r1)
                            MIN(sizeof(sysib.sysib_322.vm[0].name),
                                strlen(qemu_name)));
                 strncpy((char *)sysib.sysib_322.ext_names[0], qemu_name,
 -                        sizeof(sysib.sysib_322.ext_names[0]));
 +                        sizeof(sysib.sysib_322.ext_names[0])-1);
             } else {
                 ebcdic_put(sysib.sysib_322.vm[0].name, "TCGguest", 8);
                 strcpy((char *)sysib.sysib_322.ext_names[0], "TCGguest");
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index 26f71cb599..fe6bdbf721 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -1852,8 +1852,7 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 static tcg_insn_unit *tb_ret_addr;
 static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 -                       const TCGArg args[TCG_MAX_OP_ARGS],
 -                       const int const_args[TCG_MAX_OP_ARGS])
 +                       const TCGArg *args, const int *const_args)
 {
     /* 99% of the time, we can signal the use of extension registers
        by looking to see if the opcode handles 64-bit data.  */
 diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
 index 3f866a35c6..bc64b50e66 100644
 --- a/tests/test-block-iothread.c
 +++ b/tests/test-block-iothread.c
@@ -75,7 +75,7 @@ static BlockDriver bdrv_test = {
 static void test_sync_op_pread(BdrvChild *c)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Success */
@@ -89,7 +89,7 @@ static void test_sync_op_pread(BdrvChild *c)
 static void test_sync_op_pwrite(BdrvChild *c)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Success */
@@ -103,7 +103,7 @@ static void test_sync_op_pwrite(BdrvChild *c)
 static void test_sync_op_blk_pread(BlockBackend *blk)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Success */
@@ -117,7 +117,7 @@ static void test_sync_op_blk_pread(BlockBackend *blk)
 static void test_sync_op_blk_pwrite(BlockBackend *blk)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Success */
@@ -131,7 +131,7 @@ static void test_sync_op_blk_pwrite(BlockBackend *blk)
 static void test_sync_op_load_vmstate(BdrvChild *c)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Error: Driver does not support snapshots */
@@ -141,7 +141,7 @@ static void test_sync_op_load_vmstate(BdrvChild *c)
 static void test_sync_op_save_vmstate(BdrvChild *c)
 {
 -    uint8_t buf[512];
 +    uint8_t buf[512] = {0};
     int ret;
     /* Error: Driver does not support snapshots */
 -- 
 2.18.4
--- a/0029-Disable-problematic-tests-for-initial-build.patch
+++ b/0029-Disable-problematic-tests-for-initial-build.patch
@ -1,41 +0,0 @@
 From bb42f8a495aa0da2410109de14aca901b8c4ac4f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Tue, 5 Jan 2021 07:40:08 +0100
 Subject: Disable problematic tests for initial build
 ---
 tests/meson.build       | 2 +-
 tests/qtest/meson.build | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/tests/meson.build b/tests/meson.build
 index afeb6be689..e562a0499e 100644
 --- a/tests/meson.build
 +++ b/tests/meson.build
@@ -136,7 +136,7 @@ if have_block
     'test-blockjob': [testblock],
     'test-blockjob-txn': [testblock],
     'test-block-backend': [testblock],
 -    'test-block-iothread': [testblock],
 +#    'test-block-iothread': [testblock],
     'test-write-threshold': [testblock],
     'test-crypto-hash': [crypto],
     'test-crypto-hmac': [crypto],
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index 15ed460ff0..70ef8c236c 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -150,8 +150,8 @@ qtests_aarch64 = \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
   ['arm-cpu-features',
    'numa-test',
 -   'boot-serial-test',
 -   'migration-test']
 +   'boot-serial-test']
 +#   'migration-test']
 qtests_s390x = \
   (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +                 \
 -- 
 2.18.4
--- a/0030-Revert-GCC-11-warnings-hacks.patch
+++ b/0030-Revert-GCC-11-warnings-hacks.patch
@ -1,166 +0,0 @@
 From f488becdbb12c6001a2524d049371196a05f5256 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 15 Jan 2021 09:27:40 +0100
 Subject: Revert "GCC 11 warnings hacks"
 This reverts commit 6e9564986a00456c6748cf888d9ba9f7f0db01bf.
 Hacks solved upstream. Going to import upstream solutions.
 ---
 hw/scsi/scsi-disk.c          | 13 ++++++-------
 net/eth.c                    |  4 +---
 target/s390x/kvm.c           |  2 +-
 target/s390x/misc_helper.c   |  2 +-
 tcg/aarch64/tcg-target.c.inc |  3 ++-
 tests/test-block-iothread.c  | 12 ++++++------
 6 files changed, 17 insertions(+), 19 deletions(-)
 diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
 index 8ce77777d3..90841ad791 100644
 --- a/hw/scsi/scsi-disk.c
 +++ b/hw/scsi/scsi-disk.c
@@ -2578,15 +2578,14 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
     int len = scsi_cdb_length(buf);
     char *line_buffer, *p;
 -    if (len > 0) {
 -        line_buffer = g_malloc(len * 5 + 1);
 -        for (i = 0, p = line_buffer; i < len; i++) {
 -            p += sprintf(p, " 0x%02x", buf[i]);
 -        }
 -        trace_scsi_disk_new_request(lun, tag, line_buffer);
 +    line_buffer = g_malloc(len * 5 + 1);
 -        g_free(line_buffer);
 +    for (i = 0, p = line_buffer; i < len; i++) {
 +        p += sprintf(p, " 0x%02x", buf[i]);
     }
 +    trace_scsi_disk_new_request(lun, tag, line_buffer);
 +
 +    g_free(line_buffer);
 }
 static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun,
 diff --git a/net/eth.c b/net/eth.c
 index 041ac4865a..1e0821c5f8 100644
 --- a/net/eth.c
 +++ b/net/eth.c
@@ -405,8 +405,6 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
 -#pragma GCC diagnostic push
 -#pragma GCC diagnostic ignored "-Warray-bounds"
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
     if ((rthdr->rtype == 2) &&
@@ -426,7 +424,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         return bytes_read == sizeof(*dst_addr);
     }
 -#pragma GCC diagnostic pop
 +
     return false;
 }
 diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
 index ab1ca6b1bf..1839cc6648 100644
 --- a/target/s390x/kvm.c
 +++ b/target/s390x/kvm.c
@@ -1918,7 +1918,7 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
      */
     if (qemu_name) {
         strncpy((char *)sysib.ext_names[0], qemu_name,
 -                sizeof(sysib.ext_names[0])-1);
 +                sizeof(sysib.ext_names[0]));
     } else {
         strcpy((char *)sysib.ext_names[0], "KVMguest");
     }
 diff --git a/target/s390x/misc_helper.c b/target/s390x/misc_helper.c
 index adaf4145e6..58dbc023eb 100644
 --- a/target/s390x/misc_helper.c
 +++ b/target/s390x/misc_helper.c
@@ -370,7 +370,7 @@ uint32_t HELPER(stsi)(CPUS390XState *env, uint64_t a0, uint64_t r0, uint64_t r1)
                            MIN(sizeof(sysib.sysib_322.vm[0].name),
                                strlen(qemu_name)));
                 strncpy((char *)sysib.sysib_322.ext_names[0], qemu_name,
 -                        sizeof(sysib.sysib_322.ext_names[0])-1);
 +                        sizeof(sysib.sysib_322.ext_names[0]));
             } else {
                 ebcdic_put(sysib.sysib_322.vm[0].name, "TCGguest", 8);
                 strcpy((char *)sysib.sysib_322.ext_names[0], "TCGguest");
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index fe6bdbf721..26f71cb599 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -1852,7 +1852,8 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg data_reg, TCGReg addr_reg,
 static tcg_insn_unit *tb_ret_addr;
 static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 -                       const TCGArg *args, const int *const_args)
 +                       const TCGArg args[TCG_MAX_OP_ARGS],
 +                       const int const_args[TCG_MAX_OP_ARGS])
 {
     /* 99% of the time, we can signal the use of extension registers
        by looking to see if the opcode handles 64-bit data.  */
 diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
 index bc64b50e66..3f866a35c6 100644
 --- a/tests/test-block-iothread.c
 +++ b/tests/test-block-iothread.c
@@ -75,7 +75,7 @@ static BlockDriver bdrv_test = {
 static void test_sync_op_pread(BdrvChild *c)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Success */
@@ -89,7 +89,7 @@ static void test_sync_op_pread(BdrvChild *c)
 static void test_sync_op_pwrite(BdrvChild *c)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Success */
@@ -103,7 +103,7 @@ static void test_sync_op_pwrite(BdrvChild *c)
 static void test_sync_op_blk_pread(BlockBackend *blk)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Success */
@@ -117,7 +117,7 @@ static void test_sync_op_blk_pread(BlockBackend *blk)
 static void test_sync_op_blk_pwrite(BlockBackend *blk)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Success */
@@ -131,7 +131,7 @@ static void test_sync_op_blk_pwrite(BlockBackend *blk)
 static void test_sync_op_load_vmstate(BdrvChild *c)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Error: Driver does not support snapshots */
@@ -141,7 +141,7 @@ static void test_sync_op_load_vmstate(BdrvChild *c)
 static void test_sync_op_save_vmstate(BdrvChild *c)
 {
 -    uint8_t buf[512] = {0};
 +    uint8_t buf[512];
     int ret;
     /* Error: Driver does not support snapshots */
 -- 
 2.18.4
--- a/0031-s390x-Use-strpadcpy-for-copying-vm-name.patch
+++ b/0031-s390x-Use-strpadcpy-for-copying-vm-name.patch
@ -1,84 +0,0 @@
 From adbabd33e81f46c6b29c4b940c053e562e4f55fd Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 15 Jan 2021 09:28:59 +0100
 Subject: s390x: Use strpadcpy for copying vm name
 Using strncpy with length equal to the size of target array, GCC 11
 reports following warning:
  warning: '__builtin_strncpy' specified bound 256 equals destination size [-Wstringop-truncation]
 We can prevent this warning by using strpadcpy that copies string
 up to specified length, zeroes target array after copied string
 and does not raise warning when length is equal to target array
 size (and ending '\0' is discarded).
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 target/s390x/kvm.c         | 12 +++++-------
 target/s390x/misc_helper.c |  7 +++++--
 2 files changed, 10 insertions(+), 9 deletions(-)
 diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
 index 1839cc6648..c08b5bc2de 100644
 --- a/target/s390x/kvm.c
 +++ b/target/s390x/kvm.c
@@ -29,6 +29,7 @@
 #include "internal.h"
 #include "kvm_s390x.h"
 #include "sysemu/kvm_int.h"
 +#include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
@@ -1910,18 +1911,15 @@ static void insert_stsi_3_2_2(S390CPU *cpu, __u64 addr, uint8_t ar)
                                                     strlen(qemu_name)));
     }
     sysib.vm[0].ext_name_encoding = 2; /* 2 = UTF-8 */
 -    memset(sysib.ext_names[0], 0, sizeof(sysib.ext_names[0]));
     /* If hypervisor specifies zero Extended Name in STSI322 SYSIB, it's
      * considered by s390 as not capable of providing any Extended Name.
      * Therefore if no name was specified on qemu invocation, we go with the
      * same "KVMguest" default, which KVM has filled into short name field.
      */
 -    if (qemu_name) {
 -        strncpy((char *)sysib.ext_names[0], qemu_name,
 -                sizeof(sysib.ext_names[0]));
 -    } else {
 -        strcpy((char *)sysib.ext_names[0], "KVMguest");
 -    }
 +    strpadcpy((char *)sysib.ext_names[0],
 +              sizeof(sysib.ext_names[0]),
 +              qemu_name ?: "KVMguest", '\0');
 +
     /* Insert UUID */
     memcpy(sysib.vm[0].uuid, &qemu_uuid, sizeof(sysib.vm[0].uuid));
 diff --git a/target/s390x/misc_helper.c b/target/s390x/misc_helper.c
 index 58dbc023eb..7ea90d414a 100644
 --- a/target/s390x/misc_helper.c
 +++ b/target/s390x/misc_helper.c
@@ -19,6 +19,7 @@
  */
 #include "qemu/osdep.h"
 +#include "qemu/cutils.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "internal.h"
@@ -369,8 +370,10 @@ uint32_t HELPER(stsi)(CPUS390XState *env, uint64_t a0, uint64_t r0, uint64_t r1)
                 ebcdic_put(sysib.sysib_322.vm[0].name, qemu_name,
                            MIN(sizeof(sysib.sysib_322.vm[0].name),
                                strlen(qemu_name)));
 -                strncpy((char *)sysib.sysib_322.ext_names[0], qemu_name,
 -                        sizeof(sysib.sysib_322.ext_names[0]));
 +                strpadcpy((char *)sysib.sysib_322.ext_names[0],
 +                          sizeof(sysib.sysib_322.ext_names[0]),
 +                          qemu_name, '\0');
 +
             } else {
                 ebcdic_put(sysib.sysib_322.vm[0].name, "TCGguest", 8);
                 strcpy((char *)sysib.sysib_322.ext_names[0], "TCGguest");
 -- 
 2.18.4
--- a/0032-tcg-Restrict-tcg_out_op-to-arrays-of-TCG_MAX_OP_ARGS.patch
+++ b/0032-tcg-Restrict-tcg_out_op-to-arrays-of-TCG_MAX_OP_ARGS.patch
@ -1,138 +0,0 @@
 From 8773f3688ca87e5e7da2e1a5170d0bde9a54eae0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 15 Jan 2021 09:38:53 +0100
 Subject: tcg: Restrict tcg_out_op() to arrays of TCG_MAX_OP_ARGS elements
 ---
 tcg/aarch64/tcg-target.c.inc |  3 ++-
 tcg/i386/tcg-target.c.inc    |  6 ++++--
 tcg/ppc/tcg-target.c.inc     |  8 +++++---
 tcg/s390/tcg-target.c.inc    |  3 ++-
 tcg/tcg.c                    | 19 +++++++++++--------
 5 files changed, 24 insertions(+), 15 deletions(-)
 diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
 index 26f71cb599..ce8689e889 100644
 --- a/tcg/aarch64/tcg-target.c.inc
 +++ b/tcg/aarch64/tcg-target.c.inc
@@ -2271,7 +2271,8 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
 -                           const TCGArg *args, const int *const_args)
 +                           const TCGArg args[TCG_MAX_OP_ARGS],
 +                           const int const_args[TCG_MAX_OP_ARGS])
 {
     static const AArch64Insn cmp_insn[16] = {
         [TCG_COND_EQ] = I3616_CMEQ,
 diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
 index d8797ed398..0e557d177a 100644
 --- a/tcg/i386/tcg-target.c.inc
 +++ b/tcg/i386/tcg-target.c.inc
@@ -2242,7 +2242,8 @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is64)
 }
 static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 -                              const TCGArg *args, const int *const_args)
 +                              const TCGArg args[TCG_MAX_OP_ARGS],
 +                              const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
     int c, const_a2, vexop, rexw = 0;
@@ -2679,7 +2680,8 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
 -                           const TCGArg *args, const int *const_args)
 +                           const TCGArg args[TCG_MAX_OP_ARGS],
 +                           const int const_args[TCG_MAX_OP_ARGS])
 {
     static int const add_insn[4] = {
         OPC_PADDB, OPC_PADDW, OPC_PADDD, OPC_PADDQ
 diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
 index 18ee989f95..b2bc1fc0c4 100644
 --- a/tcg/ppc/tcg-target.c.inc
 +++ b/tcg/ppc/tcg-target.c.inc
@@ -2353,8 +2353,9 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     tcg_out32(s, BCLR | BO_ALWAYS);
 }
 -static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 -                       const int *const_args)
 +static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 +                       const TCGArg args[TCG_MAX_OP_ARGS],
 +                       const int const_args[TCG_MAX_OP_ARGS])
 {
     TCGArg a0, a1, a2;
     int c;
@@ -3151,7 +3152,8 @@ static bool tcg_out_dupm_vec(TCGContext *s, TCGType type, unsigned vece,
 static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
                            unsigned vecl, unsigned vece,
 -                           const TCGArg *args, const int *const_args)
 +                           const TCGArg args[TCG_MAX_OP_ARGS],
 +                           const int const_args[TCG_MAX_OP_ARGS])
 {
     static const uint32_t
         add_op[4] = { VADDUBM, VADDUHM, VADDUWM, VADDUDM },
 diff --git a/tcg/s390/tcg-target.c.inc b/tcg/s390/tcg-target.c.inc
 index c5e096449b..79753c8af7 100644
 --- a/tcg/s390/tcg-target.c.inc
 +++ b/tcg/s390/tcg-target.c.inc
@@ -1746,7 +1746,8 @@ static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,
         case glue(glue(INDEX_op_,x),_i64)
 static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 -                const TCGArg *args, const int *const_args)
 +                              const TCGArg args[TCG_MAX_OP_ARGS],
 +                              const int const_args[TCG_MAX_OP_ARGS])
 {
     S390Opcode op, op2;
     TCGArg a0, a1, a2;
 diff --git a/tcg/tcg.c b/tcg/tcg.c
 index 43c6cf8f52..2d0116d29f 100644
 --- a/tcg/tcg.c
 +++ b/tcg/tcg.c
@@ -109,8 +109,9 @@ static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
 static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg);
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg);
 -static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
 -                       const int *const_args);
 +static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 +                       const TCGArg args[TCG_MAX_OP_ARGS],
 +                       const int const_args[TCG_MAX_OP_ARGS]);
 #if TCG_TARGET_MAYBE_vec
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                             TCGReg dst, TCGReg src);
@@ -118,9 +119,10 @@ static bool tcg_out_dupm_vec(TCGContext *s, TCGType type, unsigned vece,
                              TCGReg dst, TCGReg base, intptr_t offset);
 static void tcg_out_dupi_vec(TCGContext *s, TCGType type,
                              TCGReg dst, tcg_target_long arg);
 -static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc, unsigned vecl,
 -                           unsigned vece, const TCGArg *args,
 -                           const int *const_args);
 +static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
 +                           unsigned vecl, unsigned vece,
 +                           const TCGArg args[TCG_MAX_OP_ARGS],
 +                           const int const_args[TCG_MAX_OP_ARGS]);
 #else
 static inline bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
                                    TCGReg dst, TCGReg src)
@@ -137,9 +139,10 @@ static inline void tcg_out_dupi_vec(TCGContext *s, TCGType type,
 {
     g_assert_not_reached();
 }
 -static inline void tcg_out_vec_op(TCGContext *s, TCGOpcode opc, unsigned vecl,
 -                                  unsigned vece, const TCGArg *args,
 -                                  const int *const_args)
 +static inline void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
 +                                  unsigned vecl, unsigned vece,
 +                                  const TCGArg args[TCG_MAX_OP_ARGS],
 +                                  const int const_args[TCG_MAX_OP_ARGS])
 {
     g_assert_not_reached();
 }
 -- 
 2.18.4
--- a/0033-net-eth-Simplify-_eth_get_rss_ex_dst_addr.patch
+++ b/0033-net-eth-Simplify-_eth_get_rss_ex_dst_addr.patch
@ -1,52 +0,0 @@
 From 76ed390a52769c5ca64db5496a2adcb43df72035 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Fri, 15 Jan 2021 09:42:33 +0100
 Subject: net/eth: Simplify _eth_get_rss_ex_dst_addr()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The length field is already contained in the ip6_ext_hdr structure.
 Check it direcly in eth_parse_ipv6_hdr() before calling
 _eth_get_rss_ex_dst_addr(), which gets a bit simplified.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 ---
 net/eth.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
 diff --git a/net/eth.c b/net/eth.c
 index 1e0821c5f8..7d4dd48c1f 100644
 --- a/net/eth.c
 +++ b/net/eth.c
@@ -407,9 +407,7 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 -    if ((rthdr->rtype == 2) &&
 -        (rthdr->len == sizeof(struct in6_address) / 8) &&
 -        (rthdr->segleft == 1)) {
 +    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
@@ -528,10 +526,12 @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
         }
         if (curr_ext_hdr_type == IP6_ROUTING) {
 -            info->rss_ex_dst_valid =
 -                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
 -                                         ip6hdr_off + info->full_hdr_len,
 -                                         &ext_hdr, &info->rss_ex_dst);
 +            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
 +                info->rss_ex_dst_valid =
 +                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
 +                                             ip6hdr_off + info->full_hdr_len,
 +                                             &ext_hdr, &info->rss_ex_dst);
 +            }
         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
             info->rss_ex_src_valid =
                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,
 -- 
 2.18.4
--- a/0034-net-eth-Fix-stack-buffer-overflow-in.patch
+++ b/0034-net-eth-Fix-stack-buffer-overflow-in.patch
@ -1,196 +0,0 @@
 From 9abf30d739cfe5a7808f1e30ec85c0cfd73b67cb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Fri, 15 Jan 2021 09:43:31 +0100
 Subject: net/eth: Fix stack-buffer-overflow in
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 QEMU fuzzer reported a buffer overflow in _eth_get_rss_ex_dst_addr()
 reproducible as:
  $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5
  Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486
    This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING
 Similarly GCC 11 reports:
  net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
 In eth_parse_ipv6_hdr() we called iov_to_buf() to fill the 2 bytes of
 the 'ext_hdr' buffer, then _eth_get_rss_ex_dst_addr() tries to access
 beside the 2 filled bytes.
 Fix by reworking the function, filling the full rt_hdr buffer on the
 stack calling iov_to_buf() again.
 Cc: qemu-stable@nongnu.org
 Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
 Reported-by: Alexander Bulekov <alxndr@bu.edu>
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 net/eth.c               | 25 +++++++++++--------------
 tests/qtest/fuzz-test.c | 29 +++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 14 deletions(-)
 diff --git a/net/eth.c b/net/eth.c
 index 7d4dd48c1f..ae4db37888 100644
 --- a/net/eth.c
 +++ b/net/eth.c
@@ -401,26 +401,23 @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
 static bool
 _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 -                        size_t rthdr_offset,
 +                        size_t ext_hdr_offset,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
 -    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 -
 -    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 -
 -        size_t input_size = iov_size(pkt, pkt_frags);
 -        size_t bytes_read;
 +    struct ip6_ext_hdr_routing rt_hdr;
 +    size_t input_size = iov_size(pkt, pkt_frags);
 +    size_t bytes_read;
 -        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
 -            return false;
 -        }
 +    if (input_size < ext_hdr_offset + sizeof(rt_hdr)) {
 +        return false;
 +    }
 -        bytes_read = iov_to_buf(pkt, pkt_frags,
 -                                rthdr_offset + sizeof(*ext_hdr),
 -                                dst_addr, sizeof(*dst_addr));
 +    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
 +                            &rt_hdr, sizeof(rt_hdr));
 -        return bytes_read == sizeof(*dst_addr);
 +    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
 +        return bytes_read == sizeof(*ext_hdr) + sizeof(*dst_addr);
     }
     return false;
 diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c
 index 9cb4c42bde..2692d556d9 100644
 --- a/tests/qtest/fuzz-test.c
 +++ b/tests/qtest/fuzz-test.c
@@ -47,6 +47,32 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
     qtest_outl(s, 0x5d02, 0xebed205d);
 }
 +/*
 + * https://bugs.launchpad.net/qemu/+bug/1879531
 + */
 +static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 +{
 +    QTestState *s;
 +
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +
 +    qtest_outl(s, 0xcf8 0x80001010);
 +    qtest_outl(s, 0xcfc 0xe1020000);
 +    qtest_outl(s, 0xcf8 0x80001004);
 +    qtest_outw(s, 0xcfc 0x7);
 +    qtest_writeb(s, 0x25 0x1 0x86);
 +    qtest_writeb(s, 0x26 0x1 0xdd);
 +    qtest_writeb(s, 0x4f 0x1 0x2b);
 +    qtest_writel(s, 0xe1020030, 0x190002e1);
 +    qtest_writew(s, 0xe102003a, 0x0807);
 +    qtest_writel(s, 0xe1020048, 0x12077cdd);
 +    qtest_writel(s, 0xe1020400, 0xba077cdd);
 +    qtest_writel(s, 0xe1020420, 0x190002e1);
 +    qtest_writel(s, 0xe1020428, 0x3509d807);
 +    qtest_writeb(s, 0xe1020438, 0xe2);
 +    qtest_quit(s);
 +}
 +
 int main(int argc, char **argv)
 {
     const char *arch = qtest_get_arch();
@@ -58,6 +84,9 @@ int main(int argc, char **argv)
                        test_lp1878263_megasas_zero_iov_cnt);
         qtest_add_func("fuzz/test_lp1878642_pci_bus_get_irq_level_assert",
                        test_lp1878642_pci_bus_get_irq_level_assert);
 +        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
 +                       test_lp1879531_eth_get_rss_ex_dst_addr);
 +
     }
     return g_test_run();
 -- 
 2.18.4
--- a/0035-block-nvme-Implement-fake-truncate-coroutine.patch
+++ b/0035-block-nvme-Implement-fake-truncate-coroutine.patch
@ -1,84 +0,0 @@
 From f4c65e14055e208e331a83b9340998ecbe796b5f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Fri, 1 Jan 2021 17:18:13 -0500
 Subject: block/nvme: Implement fake truncate() coroutine
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: <20210101171813.1734014-2-philmd@redhat.com>
 Patchwork-id: 100503
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] block/nvme: Implement fake truncate() coroutine
 Bugzilla: 1848834
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 NVMe drive cannot be shrunk.
 Since commit c80d8b06cfa we can use the @exact parameter (set
 to false) to return success if the block device is larger than
 the requested offset (even if we can not be shrunk).
 Use this parameter to implement the NVMe truncate() coroutine,
 similarly how it is done for the iscsi and file-posix drivers
 (see commit 82325ae5f2f "Evaluate @exact in protocol drivers").
 Reported-by: Xueqiang Wei <xuwei@redhat.com>
 Suggested-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-Id: <20201210125202.858656-1-philmd@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit c8807c5edcc8bd8917a5b7531d47ef6a99e07bd8)
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/nvme.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 diff --git a/block/nvme.c b/block/nvme.c
 index a06a188d53..5a6fbacf4a 100644
 --- a/block/nvme.c
 +++ b/block/nvme.c
@@ -1389,6 +1389,29 @@ out:
 }
 +static int coroutine_fn nvme_co_truncate(BlockDriverState *bs, int64_t offset,
 +                                         bool exact, PreallocMode prealloc,
 +                                         BdrvRequestFlags flags, Error **errp)
 +{
 +    int64_t cur_length;
 +
 +    if (prealloc != PREALLOC_MODE_OFF) {
 +        error_setg(errp, "Unsupported preallocation mode '%s'",
 +                   PreallocMode_str(prealloc));
 +        return -ENOTSUP;
 +    }
 +
 +    cur_length = nvme_getlength(bs);
 +    if (offset != cur_length && exact) {
 +        error_setg(errp, "Cannot resize NVMe devices");
 +        return -ENOTSUP;
 +    } else if (offset > cur_length) {
 +        error_setg(errp, "Cannot grow NVMe devices");
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 static int nvme_reopen_prepare(BDRVReopenState *reopen_state,
                                BlockReopenQueue *queue, Error **errp)
@@ -1523,6 +1546,7 @@ static BlockDriver bdrv_nvme = {
     .bdrv_close               = nvme_close,
     .bdrv_getlength           = nvme_getlength,
     .bdrv_probe_blocksizes    = nvme_probe_blocksizes,
 +    .bdrv_co_truncate         = nvme_co_truncate,
     .bdrv_co_preadv           = nvme_co_preadv,
     .bdrv_co_pwritev          = nvme_co_pwritev,
 -- 
 2.18.4
--- a/0037-build-system-use-b_staticpic-false.patch
+++ b/0037-build-system-use-b_staticpic-false.patch
@ -1,77 +0,0 @@
 From 50b575b27b9daa331da08d10dbe6524de0580833 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Wed, 16 Dec 2020 17:53:08 -0500
 Subject: build-system: use b_staticpic=false
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 Message-id: <20201216175308.1463822-3-pbonzini@redhat.com>
 Patchwork-id: 100484
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/2] build-system: use b_staticpic=false
 Bugzilla: 1899619
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Meson 0.56.0 correctly builds non-PIC static libraries with -fPIE if
 b_pie=true, while Meson 0.55.3 has a bug that causes the library
 to use non-PIE objects and fail to link.  Therefore, upstream
 QEMU looks at the meson version in order to decide between
 b_staticpic=false and b_staticpic=$pie.
 Unfortunately, b_staticpic=$pie still has a negative effect
 on performance when you QEMU is compiled with --enable-pie
 like RHEL does.  Therefore, we have backported the fix
 to Meson 0.55.3-3.el8.  We can require it and unconditionally
 use b_staticpic=false.
 The patch is RHEL-specific, but a similar change is included
 in the larger patch for "meson: switch minimum meson version to
 0.56.0".
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 configure                     | 5 -----
 meson.build                   | 4 ++--
 redhat/qemu-kvm.spec.template | 2 +-
 3 files changed, 3 insertions(+), 8 deletions(-)
 diff --git a/configure b/configure
 index 18c26e0389..d60097c0d4 100755
 --- a/configure
 +++ b/configure
@@ -6979,10 +6979,6 @@ fi
 mv $cross config-meson.cross
 rm -rf meson-private meson-info meson-logs
 -unset staticpic
 -if ! version_ge "$($meson --version)" 0.56.0; then
 -  staticpic=$(if test "$pie" = yes; then echo true; else echo false; fi)
 -fi
 NINJA=$ninja $meson setup \
         --prefix "$prefix" \
         --libdir "$libdir" \
@@ -7002,7 +6998,6 @@ NINJA=$ninja $meson setup \
         -Dwerror=$(if test "$werror" = yes; then echo true; else echo false; fi) \
         -Dstrip=$(if test "$strip_opt" = yes; then echo true; else echo false; fi) \
         -Db_pie=$(if test "$pie" = yes; then echo true; else echo false; fi) \
 -        ${staticpic:+-Db_staticpic=$staticpic} \
         -Db_coverage=$(if test "$gcov" = yes; then echo true; else echo false; fi) \
         -Dmalloc=$malloc -Dmalloc_trim=$malloc_trim -Dsparse=$sparse \
         -Dkvm=$kvm -Dhax=$hax -Dwhpx=$whpx -Dhvf=$hvf \
 diff --git a/meson.build b/meson.build
 index 8c38b2ea36..c482d075d5 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1,6 +1,6 @@
 project('qemu', ['c'], meson_version: '>=0.55.0',
 -        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto'] +
 -                         (meson.version().version_compare('>=0.56.0') ? [ 'b_staticpic=false' ] : []),
 +        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto',
 +                          'b_staticpic=false' ],
         version: run_command('head', meson.source_root() / 'VERSION').stdout().strip())
 not_found = dependency('', required: false)
--- a/0038-spapr-Fix-buffer-overflow-in-spapr_numa_associativit.patch
+++ b/0038-spapr-Fix-buffer-overflow-in-spapr_numa_associativit.patch
@ -1,131 +0,0 @@
 From d66ae008007853df7d3a24bd2d5e7494f53f007c Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Thu, 7 Jan 2021 10:10:20 -0500
 Subject: spapr: Fix buffer overflow in spapr_numa_associativity_init()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Greg Kurz <gkurz@redhat.com>
 Message-id: <20210107101020.579456-2-gkurz@redhat.com>
 Patchwork-id: 100515
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] spapr: Fix buffer overflow in spapr_numa_associativity_init()
 Bugzilla: 1908693
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 Running a guest with 128 NUMA nodes crashes QEMU:
 ../../util/error.c:59: error_setv: Assertion `*errp == NULL' failed.
 The crash happens when setting the FWNMI migration blocker:
 2861	    if (spapr_get_cap(spapr, SPAPR_CAP_FWNMI) == SPAPR_CAP_ON) {
 2862	        /* Create the error string for live migration blocker */
 2863	        error_setg(&spapr->fwnmi_migration_blocker,
 2864	            "A machine check is being handled during migration. The handler"
 2865	            "may run and log hardware error on the destination");
 2866	    }
 Inspection reveals that papr->fwnmi_migration_blocker isn't NULL:
 (gdb) p spapr->fwnmi_migration_blocker
 $1 = (Error *) 0x8000000004000000
 Since this is the only place where papr->fwnmi_migration_blocker is
 set, this means someone wrote there in our back. Further analysis
 points to spapr_numa_associativity_init(), especially the part
 that initializes the associative arrays for NVLink GPUs:
    max_nodes_with_gpus = nb_numa_nodes + NVGPU_MAX_NUM;
 ie. max_nodes_with_gpus = 128 + 6, but the array isn't sized to
 accommodate the 6 extra nodes:
 struct SpaprMachineState {
    .
    .
    .
    uint32_t numa_assoc_array[MAX_NODES][NUMA_ASSOC_SIZE];
    Error *fwnmi_migration_blocker;
 };
 and the following loops happily overwrite spapr->fwnmi_migration_blocker,
 and probably more:
    for (i = nb_numa_nodes; i < max_nodes_with_gpus; i++) {
        spapr->numa_assoc_array[i][0] = cpu_to_be32(MAX_DISTANCE_REF_POINTS);
        for (j = 1; j < MAX_DISTANCE_REF_POINTS; j++) {
            uint32_t gpu_assoc = smc->pre_5_1_assoc_refpoints ?
                                 SPAPR_GPU_NUMA_ID : cpu_to_be32(i);
            spapr->numa_assoc_array[i][j] = gpu_assoc;
        }
        spapr->numa_assoc_array[i][MAX_DISTANCE_REF_POINTS] = cpu_to_be32(i);
    }
 Fix the size of the array. This requires "hw/ppc/spapr.h" to see
 NVGPU_MAX_NUM. Including "hw/pci-host/spapr.h" introduces a
 circular dependency that breaks the build, so this moves the
 definition of NVGPU_MAX_NUM to "hw/ppc/spapr.h" instead.
 Reported-by: Min Deng <mdeng@redhat.com>
 BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1908693
 Fixes: dd7e1d7ae431 ("spapr_numa: move NVLink2 associativity handling to spapr_numa.c")
 Cc: danielhb413@gmail.com
 Signed-off-by: Greg Kurz <groug@kaod.org>
 Message-Id: <160829960428.734871.12634150161215429514.stgit@bahia.lan>
 Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit 30499fdd9883026e106d74e8199e2f1311fd4011)
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 include/hw/pci-host/spapr.h | 2 --
 include/hw/ppc/spapr.h      | 5 ++++-
 2 files changed, 4 insertions(+), 3 deletions(-)
 diff --git a/include/hw/pci-host/spapr.h b/include/hw/pci-host/spapr.h
 index 4f58f0223b..bd014823a9 100644
 --- a/include/hw/pci-host/spapr.h
 +++ b/include/hw/pci-host/spapr.h
@@ -115,8 +115,6 @@ struct SpaprPhbState {
 #define SPAPR_PCI_NV2RAM64_WIN_BASE  SPAPR_PCI_LIMIT
 #define SPAPR_PCI_NV2RAM64_WIN_SIZE  (2 * TiB) /* For up to 6 GPUs 256GB each */
 -/* Max number of these GPUsper a physical box */
 -#define NVGPU_MAX_NUM                6
 /* Max number of NVLinks per GPU in any physical box */
 #define NVGPU_MAX_LINKS              3
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
 index ba2d81404b..28bbf07f8f 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
@@ -112,6 +112,9 @@ typedef enum {
 #define NUMA_ASSOC_SIZE            (MAX_DISTANCE_REF_POINTS + 1)
 #define VCPU_ASSOC_SIZE            (NUMA_ASSOC_SIZE + 1)
 +/* Max number of these GPUsper a physical box */
 +#define NVGPU_MAX_NUM                6
 +
 typedef struct SpaprCapabilities SpaprCapabilities;
 struct SpaprCapabilities {
     uint8_t caps[SPAPR_CAP_NUM];
@@ -243,7 +246,7 @@ struct SpaprMachineState {
     unsigned gpu_numa_id;
     SpaprTpmProxy *tpm_proxy;
 -    uint32_t numa_assoc_array[MAX_NODES][NUMA_ASSOC_SIZE];
 +    uint32_t numa_assoc_array[MAX_NODES + NVGPU_MAX_NUM][NUMA_ASSOC_SIZE];
     Error *fwnmi_migration_blocker;
 };
 -- 
 2.18.4
--- a/0039-usb-hcd-xhci-pci-Fixup-capabilities-ordering-again.patch
+++ b/0039-usb-hcd-xhci-pci-Fixup-capabilities-ordering-again.patch
@ -1,175 +0,0 @@
 From e85ee5f0196b85ad6f9faa02571325831b612c37 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Thu, 7 Jan 2021 14:12:25 -0500
 Subject: usb/hcd-xhci-pci: Fixup capabilities ordering (again)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20210107141225.19709-2-dgilbert@redhat.com>
 Patchwork-id: 100518
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] usb/hcd-xhci-pci: Fixup capabilities ordering (again)
 Bugzilla: 1912846
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Allow the reordering of the PCIe capabilities for MSI around the PCIe
 capability.
 This changed incompatibly way back in QEMU 2.7 and in RHEL we fixed
 it up in bz 1447874 unconditionally putting it back.
 The xhci code got reorganised between 5.0 and 5.2; and we lost this
 fixup on rebase.
 This time, add it as a property, and enable the property for old
 machine types; this will allow us to drop this patch once the
 old machine types go.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/machine.c     |  4 ++-
 hw/usb/hcd-xhci-pci.c | 59 +++++++++++++++++++++++++++++++++----------
 hw/usb/hcd-xhci-pci.h |  1 +
 3 files changed, 49 insertions(+), 15 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index aba05ad676..68495b9411 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -29,7 +29,7 @@
 #include "migration/vmstate.h"
 /*
 - * The same as hw_compat_5_1
 + * Mostly the same as hw_compat_5_1
  */
 GlobalProperty hw_compat_rhel_8_3[] = {
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
@@ -46,6 +46,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
     { "nvme", "use-intel-id", "on"},
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 };
 const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index bba628d3d2..d045a2a8be 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -101,6 +101,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
 +/* RH bz 1912846 */
 +static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
 +{
 +    int ret;
 +    Error *err = NULL;
 +    XHCIPciState *s = XHCI_PCI(dev);
 +
 +    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 +    /*
 +     * Any error other than -ENOTSUP(board's MSI support is broken)
 +     * is a programming error
 +     */
 +    assert(!ret || ret == -ENOTSUP);
 +    if (ret && s->msi == ON_OFF_AUTO_ON) {
 +        /* Can't satisfy user's explicit msi=on request, fail */
 +        error_append_hint(&err, "You have to use msi=auto (default) or "
 +                "msi=off with this machine type.\n");
 +        error_propagate(errp, err);
 +        return true;
 +    }
 +    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 +    /* With msi=auto, we fall back to MSI off silently */
 +    error_free(err);
 +
 +    return false;
 +}
 +
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
@@ -124,23 +151,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
 -    if (s->msi != ON_OFF_AUTO_OFF) {
 -        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 -        /*
 -         * Any error other than -ENOTSUP(board's MSI support is broken)
 -         * is a programming error
 -         */
 -        assert(!ret || ret == -ENOTSUP);
 -        if (ret && s->msi == ON_OFF_AUTO_ON) {
 -            /* Can't satisfy user's explicit msi=on request, fail */
 -            error_append_hint(&err, "You have to use msi=auto (default) or "
 -                    "msi=off with this machine type.\n");
 +    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
 +        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
             error_propagate(errp, err);
             return;
         }
 -        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 -        /* With msi=auto, we fall back to MSI off silently */
 -        error_free(err);
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -153,6 +169,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
 +    /* RH bz 1912846 */
 +    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
 +        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
@@ -197,11 +221,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
 +static Property xhci_pci_properties[] = {
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 static void xhci_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 +    device_class_set_props(dc, xhci_pci_properties);
     dc->reset   = xhci_pci_reset;
     dc->vmsd    = &vmstate_xhci_pci;
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
 index c193f79443..086a1feb1e 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
@@ -39,6 +39,7 @@ typedef struct XHCIPciState {
     XHCIState xhci;
     OnOffAuto msi;
     OnOffAuto msix;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
 } XHCIPciState;
 #endif
 -- 
 2.18.4
--- a/0040-qga-commands-posix-Send-CCW-address-on-s390x-with-th.patch
+++ b/0040-qga-commands-posix-Send-CCW-address-on-s390x-with-th.patch
@ -1,132 +0,0 @@
 From 0e1bc444240fb2d8d3ee65533baaa72a7267c53a Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 8 Jan 2021 12:27:19 -0500
 Subject: qga/commands-posix: Send CCW address on s390x with the fsinfo data
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 Message-id: <20210108122719.73201-2-thuth@redhat.com>
 Patchwork-id: 100532
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 1/1] qga/commands-posix: Send CCW address on s390x with the fsinfo data
 Bugzilla: 1755075
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 We need the CCW address on the libvirt side to correctly identify
 the disk, so add this information to the GuestDiskAddress on s390x.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 Reviewed-by: Michael Roth <michael.roth@amd.com>
 Message-Id: <20201127082353.448251-1-thuth@redhat.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit 5b723a5d8df44b69b8ba350e643059c8fd889315)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 qga/commands-posix.c | 34 ++++++++++++++++++++++++++++++++++
 qga/qapi-schema.json | 20 +++++++++++++++++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 diff --git a/qga/commands-posix.c b/qga/commands-posix.c
 index c089e38120..5aa5eff84f 100644
 --- a/qga/commands-posix.c
 +++ b/qga/commands-posix.c
@@ -1029,6 +1029,38 @@ static bool build_guest_fsinfo_for_nonpci_virtio(char const *syspath,
     return true;
 }
 +/*
 + * Store disk device info for CCW devices (s390x channel I/O devices).
 + * Returns true if information has been stored, or false for failure.
 + */
 +static bool build_guest_fsinfo_for_ccw_dev(char const *syspath,
 +                                           GuestDiskAddress *disk,
 +                                           Error **errp)
 +{
 +    unsigned int cssid, ssid, subchno, devno;
 +    char *p;
 +
 +    p = strstr(syspath, "/devices/css");
 +    if (!p || sscanf(p + 12, "%*x/%x.%x.%x/%*x.%*x.%x/",
 +                     &cssid, &ssid, &subchno, &devno) < 4) {
 +        g_debug("could not parse ccw device sysfs path: %s", syspath);
 +        return false;
 +    }
 +
 +    disk->has_ccw_address = true;
 +    disk->ccw_address = g_new0(GuestCCWAddress, 1);
 +    disk->ccw_address->cssid = cssid;
 +    disk->ccw_address->ssid = ssid;
 +    disk->ccw_address->subchno = subchno;
 +    disk->ccw_address->devno = devno;
 +
 +    if (strstr(p, "/virtio")) {
 +        build_guest_fsinfo_for_nonpci_virtio(syspath, disk, errp);
 +    }
 +
 +    return true;
 +}
 +
 /* Store disk device info specified by @sysfs into @fs */
 static void build_guest_fsinfo_for_real_device(char const *syspath,
                                                GuestFilesystemInfo *fs,
@@ -1081,6 +1113,8 @@ static void build_guest_fsinfo_for_real_device(char const *syspath,
     if (strstr(syspath, "/devices/pci")) {
         has_hwinf = build_guest_fsinfo_for_pci_dev(syspath, disk, errp);
 +    } else if (strstr(syspath, "/devices/css")) {
 +        has_hwinf = build_guest_fsinfo_for_ccw_dev(syspath, disk, errp);
     } else if (strstr(syspath, "/virtio")) {
         has_hwinf = build_guest_fsinfo_for_nonpci_virtio(syspath, disk, errp);
     } else {
 diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
 index 3b3d1d0bd9..9a82b7e952 100644
 --- a/qga/qapi-schema.json
 +++ b/qga/qapi-schema.json
@@ -846,6 +846,22 @@
   'data': {'domain': 'int', 'bus': 'int',
            'slot': 'int', 'function': 'int'} }
 +##
 +# @GuestCCWAddress:
 +#
 +# @cssid: channel subsystem image id
 +# @ssid: subchannel set id
 +# @subchno: subchannel number
 +# @devno: device number
 +#
 +# Since: 6.0
 +##
 +{ 'struct': 'GuestCCWAddress',
 +  'data': {'cssid': 'int',
 +           'ssid': 'int',
 +           'subchno': 'int',
 +           'devno': 'int'} }
 +
 ##
 # @GuestDiskAddress:
 #
@@ -856,6 +872,7 @@
 # @unit: unit id
 # @serial: serial number (since: 3.1)
 # @dev: device node (POSIX) or device UNC (Windows) (since: 3.1)
 +# @ccw-address: CCW address on s390x (since: 6.0)
 #
 # Since: 2.2
 ##
@@ -863,7 +880,8 @@
   'data': {'pci-controller': 'GuestPCIAddress',
            'bus-type': 'GuestDiskBusType',
            'bus': 'int', 'target': 'int', 'unit': 'int',
 -           '*serial': 'str', '*dev': 'str'} }
 +           '*serial': 'str', '*dev': 'str',
 +           '*ccw-address': 'GuestCCWAddress'} }
 ##
 # @GuestDiskInfo:
 -- 
 2.18.4
--- a/0041-AArch64-machine-types-cleanup.patch
+++ b/0041-AArch64-machine-types-cleanup.patch
@ -1,188 +0,0 @@
 From bfa3dc6e290c7b4f7f8825e4d4320ba062ed445a Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Sat, 9 Jan 2021 22:19:27 -0500
 Subject: AArch64 machine types cleanup
 RH-Author: Andrew Jones <drjones@redhat.com>
 Message-id: <20210109221928.31407-2-drjones@redhat.com>
 Patchwork-id: 100547
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 1/2] AArch64 machine types cleanup
 Bugzilla: 1895276
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 No functional change here, just a reduction of downstream-only
 changes and whitespace differences. Also the removal of a nested
 '#if 0 /* disabled for RHEL */' block.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/arm/virt.c | 69 +++++++++++++++++++++++----------------------------
 1 file changed, 31 insertions(+), 38 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 21e0485ac5..530072fce0 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -123,7 +123,6 @@
     static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
         .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
         .parent = TYPE_RHEL_MACHINE,                                    \
 -        .instance_init = rhel##m##n##s##_virt_instance_init,            \
         .class_init = rhel##m##n##s##_virt_class_init,                  \
     };                                                                  \
     static void rhel##m##n##s##_machvirt_init(void)                     \
@@ -2098,8 +2097,8 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
 -
 #endif /* disabled for RHEL */
 +
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2167,14 +2166,13 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 +
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
     return vms->mte;
 }
 -#endif /* disabled for RHEL */
 static void virt_set_mte(Object *obj, bool value, Error **errp)
 {
@@ -2182,7 +2180,8 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
 -#endif
 +#endif /* disabled for RHEL */
 +
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2818,25 +2817,6 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
         "Enable ACPI");
 }
 -static const TypeInfo rhel_machine_info = {
 -    .name          = TYPE_RHEL_MACHINE,
 -    .parent        = TYPE_MACHINE,
 -    .abstract      = true,
 -    .instance_size = sizeof(VirtMachineState),
 -    .class_size    = sizeof(VirtMachineClass),
 -    .class_init    = rhel_machine_class_init,
 -    .interfaces = (InterfaceInfo[]) {
 -         { TYPE_HOTPLUG_HANDLER },
 -         { }
 -    },
 -};
 -
 -static void rhel_machine_init(void)
 -{
 -    type_register_static(&rhel_machine_info);
 -}
 -type_init(rhel_machine_init);
 -
 static void rhel_virt_instance_init(Object *obj)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2844,22 +2824,23 @@ static void rhel_virt_instance_init(Object *obj)
     /* EL3 is disabled by default and non-configurable for RHEL */
     vms->secure = false;
 +
     /* EL2 is disabled by default and non-configurable for RHEL */
     vms->virt = false;
 -    /* High memory is enabled by default for RHEL */
 +
 +    /* High memory is enabled by default */
     vms->highmem = true;
     object_property_add_bool(obj, "highmem", virt_get_highmem,
                              virt_set_highmem);
     object_property_set_description(obj, "highmem",
                                     "Set on/off to enable/disable using "
                                     "physical address space above 32 bits");
 -
     vms->gic_version = VIRT_GIC_VERSION_NOSEL;
     object_property_add_str(obj, "gic-version", virt_get_gic_version,
                         virt_set_gic_version);
     object_property_set_description(obj, "gic-version",
                                     "Set GIC version. "
 -                                    "Valid values are 2, 3 and host");
 +                                    "Valid values are 2, 3, host and max");
     vms->highmem_ecam = !vmc->no_highmem_ecam;
@@ -2882,18 +2863,36 @@ static void rhel_virt_instance_init(Object *obj)
                                     "Set the IOMMU type. "
                                     "Valid values are none and smmuv3");
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
     vms->ras = false;
 -    /* MTE is disabled by default.  */
 +
 +    /* MTE is disabled by default and non-configurable for RHEL */
     vms->mte = false;
 -    vms->irqmap=a15irqmap;
 +    vms->irqmap = a15irqmap;
 +
     virt_flash_create(vms);
 }
 -static void rhel830_virt_instance_init(Object *obj)
 +static const TypeInfo rhel_machine_info = {
 +    .name          = TYPE_RHEL_MACHINE,
 +    .parent        = TYPE_MACHINE,
 +    .abstract      = true,
 +    .instance_size = sizeof(VirtMachineState),
 +    .class_size    = sizeof(VirtMachineClass),
 +    .class_init    = rhel_machine_class_init,
 +    .instance_init = rhel_virt_instance_init,
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
 +};
 +
 +static void rhel_machine_init(void)
 {
 -    rhel_virt_instance_init(obj);
 +    type_register_static(&rhel_machine_info);
 }
 +type_init(rhel_machine_init);
 static void rhel830_virt_options(MachineClass *mc)
 {
@@ -2901,16 +2900,10 @@ static void rhel830_virt_options(MachineClass *mc)
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(8, 3, 0)
 -static void rhel820_virt_instance_init(Object *obj)
 -{
 -    rhel_virt_instance_init(obj);
 -}
 -
 static void rhel820_virt_options(MachineClass *mc)
 {
     rhel830_virt_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_2,
 -                     hw_compat_rhel_8_2_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
     mc->numa_mem_supported = true;
     mc->auto_enable_numa_with_memdev = false;
 }
 -- 
 2.18.4
--- a/0042-hw-arm-virt-Add-8.4-Machine-type.patch
+++ b/0042-hw-arm-virt-Add-8.4-Machine-type.patch
@ -1,55 +0,0 @@
 From 1bc68127d1531ed519cb839844febaecb2a3f6d0 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Sat, 9 Jan 2021 22:19:28 -0500
 Subject: hw/arm/virt: Add 8.4 Machine type
 RH-Author: Andrew Jones <drjones@redhat.com>
 Message-id: <20210109221928.31407-3-drjones@redhat.com>
 Patchwork-id: 100548
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 2/2] hw/arm/virt: Add 8.4 Machine type
 Bugzilla: 1895276
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 8.4 isn't much different than 8.3, except it adds the steal-time
 feature and enables it by default.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/arm/virt.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 530072fce0..208c360342 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -2894,11 +2894,21 @@ static void rhel_machine_init(void)
 }
 type_init(rhel_machine_init);
 -static void rhel830_virt_options(MachineClass *mc)
 +static void rhel840_virt_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 }
 -DEFINE_RHEL_MACHINE_AS_LATEST(8, 3, 0)
 +DEFINE_RHEL_MACHINE_AS_LATEST(8, 4, 0)
 +
 +static void rhel830_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
 +    rhel840_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    vmc->no_kvm_steal_time = true;
 +}
 +DEFINE_RHEL_MACHINE(8, 3, 0)
 static void rhel820_virt_options(MachineClass *mc)
 {
 -- 
 2.18.4
--- a/0044-memory-Rename-memory_region_notify_one-to-memory_reg.patch
+++ b/0044-memory-Rename-memory_region_notify_one-to-memory_reg.patch
@ -1,146 +0,0 @@
 From 256180b78107813b8e8c292bc799f5d7c7676cd2 Mon Sep 17 00:00:00 2001
 From: eperezma <eperezma@redhat.com>
 Date: Mon, 11 Jan 2021 14:36:11 -0500
 Subject: memory: Rename memory_region_notify_one to
 memory_region_notify_iommu_one
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: eperezma <eperezma@redhat.com>
 Message-id: <20210111143615.303645-2-eperezma@redhat.com>
 Patchwork-id: 100570
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/5] memory: Rename memory_region_notify_one to memory_region_notify_iommu_one
 Bugzilla: 1845758
 RH-Acked-by: Xiao Wang <jasowang@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Previous name didn't reflect the iommu operation.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Message-Id: <20201116165506.31315-2-eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 3b5ebf8532afdc1518bd8b0961ed802bc3f5f07c)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/arm/smmu-common.c  | 2 +-
 hw/arm/smmuv3.c       | 2 +-
 hw/i386/intel_iommu.c | 4 ++--
 include/exec/memory.h | 6 +++---
 softmmu/memory.c      | 6 +++---
 5 files changed, 10 insertions(+), 10 deletions(-)
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index 3838db1395..88d2c454f0 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -472,7 +472,7 @@ static void smmu_unmap_notifier_range(IOMMUNotifier *n)
     entry.perm = IOMMU_NONE;
     entry.addr_mask = n->end - n->start;
 -    memory_region_notify_one(n, &entry);
 +    memory_region_notify_iommu_one(n, &entry);
 }
 /* Unmap all notifiers attached to @mr */
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index 22607c3784..273f5f7dce 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -828,7 +828,7 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
     entry.addr_mask = num_pages * (1 << granule) - 1;
     entry.perm = IOMMU_NONE;
 -    memory_region_notify_one(n, &entry);
 +    memory_region_notify_iommu_one(n, &entry);
 }
 /* invalidate an asid/iova range tuple in all mr's */
 diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
 index 70ac837733..067593b9e4 100644
 --- a/hw/i386/intel_iommu.c
 +++ b/hw/i386/intel_iommu.c
@@ -3497,7 +3497,7 @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
         /* This field is meaningless for unmap */
         entry.translated_addr = 0;
 -        memory_region_notify_one(n, &entry);
 +        memory_region_notify_iommu_one(n, &entry);
         start += mask;
         remain -= mask;
@@ -3535,7 +3535,7 @@ static void vtd_address_space_refresh_all(IntelIOMMUState *s)
 static int vtd_replay_hook(IOMMUTLBEntry *entry, void *private)
 {
 -    memory_region_notify_one((IOMMUNotifier *)private, entry);
 +    memory_region_notify_iommu_one((IOMMUNotifier *)private, entry);
     return 0;
 }
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index 0f3e6bcd5e..d8456ccf52 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -236,7 +236,7 @@ enum IOMMUMemoryRegionAttr {
  * The IOMMU implementation must use the IOMMU notifier infrastructure
  * to report whenever mappings are changed, by calling
  * memory_region_notify_iommu() (or, if necessary, by calling
 - * memory_region_notify_one() for each registered notifier).
 + * memory_region_notify_iommu_one() for each registered notifier).
  *
  * Conceptually an IOMMU provides a mapping from input address
  * to an output TLB entry. If the IOMMU is aware of memory transaction
@@ -1346,7 +1346,7 @@ void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
                                 IOMMUTLBEntry entry);
 /**
 - * memory_region_notify_one: notify a change in an IOMMU translation
 + * memory_region_notify_iommu_one: notify a change in an IOMMU translation
  *                           entry to a single notifier
  *
  * This works just like memory_region_notify_iommu(), but it only
@@ -1357,7 +1357,7 @@ void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
  *         replaces all old entries for the same virtual I/O address range.
  *         Deleted entries have .@perm == 0.
  */
 -void memory_region_notify_one(IOMMUNotifier *notifier,
 +void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
                               IOMMUTLBEntry *entry);
 /**
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index 11ca94d037..44de610c72 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -1942,8 +1942,8 @@ void memory_region_unregister_iommu_notifier(MemoryRegion *mr,
     memory_region_update_iommu_notify_flags(iommu_mr, NULL);
 }
 -void memory_region_notify_one(IOMMUNotifier *notifier,
 -                              IOMMUTLBEntry *entry)
 +void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
 +                                    IOMMUTLBEntry *entry)
 {
     IOMMUNotifierFlag request_flags;
     hwaddr entry_end = entry->iova + entry->addr_mask;
@@ -1979,7 +1979,7 @@ void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
     IOMMU_NOTIFIER_FOREACH(iommu_notifier, iommu_mr) {
         if (iommu_notifier->iommu_idx == iommu_idx) {
 -            memory_region_notify_one(iommu_notifier, &entry);
 +            memory_region_notify_iommu_one(iommu_notifier, &entry);
         }
     }
 }
 -- 
 2.18.4
--- a/0045-memory-Add-IOMMUTLBEvent.patch
+++ b/0045-memory-Add-IOMMUTLBEvent.patch
@ -1,647 +0,0 @@
 From d282fdd88e60aa081365d8e0903ceb18743ccc9d Mon Sep 17 00:00:00 2001
 From: eperezma <eperezma@redhat.com>
 Date: Mon, 11 Jan 2021 14:36:12 -0500
 Subject: memory: Add IOMMUTLBEvent
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: eperezma <eperezma@redhat.com>
 Message-id: <20210111143615.303645-3-eperezma@redhat.com>
 Patchwork-id: 100568
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/5] memory: Add IOMMUTLBEvent
 Bugzilla: 1845758
 RH-Acked-by: Xiao Wang <jasowang@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 This way we can tell between regular IOMMUTLBEntry (entry of IOMMU
 hardware) and notifications.
 In the notifications, we set explicitly if it is a MAPs or an UNMAP,
 instead of trusting in entry permissions to differentiate them.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Message-Id: <20201116165506.31315-3-eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
 Acked-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit 5039caf3c449c49e625d34e134463260cf8e00e0)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/arm/smmu-common.c     | 13 +++---
 hw/arm/smmuv3.c          | 13 +++---
 hw/i386/intel_iommu.c    | 88 ++++++++++++++++++++++------------------
 hw/misc/tz-mpc.c         | 32 ++++++++-------
 hw/ppc/spapr_iommu.c     | 15 +++----
 hw/s390x/s390-pci-inst.c | 27 +++++++-----
 hw/virtio/virtio-iommu.c | 30 +++++++-------
 include/exec/memory.h    | 27 ++++++------
 softmmu/memory.c         | 20 ++++-----
 9 files changed, 143 insertions(+), 122 deletions(-)
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index 88d2c454f0..405d5c5325 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -465,14 +465,15 @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
 /* Unmap the whole notifier's range */
 static void smmu_unmap_notifier_range(IOMMUNotifier *n)
 {
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
 -    entry.target_as = &address_space_memory;
 -    entry.iova = n->start;
 -    entry.perm = IOMMU_NONE;
 -    entry.addr_mask = n->end - n->start;
 +    event.type = IOMMU_NOTIFIER_UNMAP;
 +    event.entry.target_as = &address_space_memory;
 +    event.entry.iova = n->start;
 +    event.entry.perm = IOMMU_NONE;
 +    event.entry.addr_mask = n->end - n->start;
 -    memory_region_notify_iommu_one(n, &entry);
 +    memory_region_notify_iommu_one(n, &event);
 }
 /* Unmap all notifiers attached to @mr */
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index 273f5f7dce..bbca0e9f20 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -800,7 +800,7 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                uint8_t tg, uint64_t num_pages)
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     uint8_t granule = tg;
     if (!tg) {
@@ -823,12 +823,13 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
         granule = tt->granule_sz;
     }
 -    entry.target_as = &address_space_memory;
 -    entry.iova = iova;
 -    entry.addr_mask = num_pages * (1 << granule) - 1;
 -    entry.perm = IOMMU_NONE;
 +    event.type = IOMMU_NOTIFIER_UNMAP;
 +    event.entry.target_as = &address_space_memory;
 +    event.entry.iova = iova;
 +    event.entry.addr_mask = num_pages * (1 << granule) - 1;
 +    event.entry.perm = IOMMU_NONE;
 -    memory_region_notify_iommu_one(n, &entry);
 +    memory_region_notify_iommu_one(n, &event);
 }
 /* invalidate an asid/iova range tuple in all mr's */
 diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
 index 067593b9e4..56180b1c43 100644
 --- a/hw/i386/intel_iommu.c
 +++ b/hw/i386/intel_iommu.c
@@ -1073,7 +1073,7 @@ static int vtd_iova_to_slpte(IntelIOMMUState *s, VTDContextEntry *ce,
     }
 }
 -typedef int (*vtd_page_walk_hook)(IOMMUTLBEntry *entry, void *private);
 +typedef int (*vtd_page_walk_hook)(IOMMUTLBEvent *event, void *private);
 /**
  * Constant information used during page walking
@@ -1094,11 +1094,12 @@ typedef struct {
     uint16_t domain_id;
 } vtd_page_walk_info;
 -static int vtd_page_walk_one(IOMMUTLBEntry *entry, vtd_page_walk_info *info)
 +static int vtd_page_walk_one(IOMMUTLBEvent *event, vtd_page_walk_info *info)
 {
     VTDAddressSpace *as = info->as;
     vtd_page_walk_hook hook_fn = info->hook_fn;
     void *private = info->private;
 +    IOMMUTLBEntry *entry = &event->entry;
     DMAMap target = {
         .iova = entry->iova,
         .size = entry->addr_mask,
@@ -1107,7 +1108,7 @@ static int vtd_page_walk_one(IOMMUTLBEntry *entry, vtd_page_walk_info *info)
     };
     DMAMap *mapped = iova_tree_find(as->iova_tree, &target);
 -    if (entry->perm == IOMMU_NONE && !info->notify_unmap) {
 +    if (event->type == IOMMU_NOTIFIER_UNMAP && !info->notify_unmap) {
         trace_vtd_page_walk_one_skip_unmap(entry->iova, entry->addr_mask);
         return 0;
     }
@@ -1115,7 +1116,7 @@ static int vtd_page_walk_one(IOMMUTLBEntry *entry, vtd_page_walk_info *info)
     assert(hook_fn);
     /* Update local IOVA mapped ranges */
 -    if (entry->perm) {
 +    if (event->type == IOMMU_NOTIFIER_MAP) {
         if (mapped) {
             /* If it's exactly the same translation, skip */
             if (!memcmp(mapped, &target, sizeof(target))) {
@@ -1141,19 +1142,21 @@ static int vtd_page_walk_one(IOMMUTLBEntry *entry, vtd_page_walk_info *info)
                 int ret;
                 /* Emulate an UNMAP */
 +                event->type = IOMMU_NOTIFIER_UNMAP;
                 entry->perm = IOMMU_NONE;
                 trace_vtd_page_walk_one(info->domain_id,
                                         entry->iova,
                                         entry->translated_addr,
                                         entry->addr_mask,
                                         entry->perm);
 -                ret = hook_fn(entry, private);
 +                ret = hook_fn(event, private);
                 if (ret) {
                     return ret;
                 }
                 /* Drop any existing mapping */
                 iova_tree_remove(as->iova_tree, &target);
 -                /* Recover the correct permission */
 +                /* Recover the correct type */
 +                event->type = IOMMU_NOTIFIER_MAP;
                 entry->perm = cache_perm;
             }
         }
@@ -1170,7 +1173,7 @@ static int vtd_page_walk_one(IOMMUTLBEntry *entry, vtd_page_walk_info *info)
     trace_vtd_page_walk_one(info->domain_id, entry->iova,
                             entry->translated_addr, entry->addr_mask,
                             entry->perm);
 -    return hook_fn(entry, private);
 +    return hook_fn(event, private);
 }
 /**
@@ -1191,7 +1194,7 @@ static int vtd_page_walk_level(dma_addr_t addr, uint64_t start,
     uint32_t offset;
     uint64_t slpte;
     uint64_t subpage_size, subpage_mask;
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     uint64_t iova = start;
     uint64_t iova_next;
     int ret = 0;
@@ -1245,13 +1248,15 @@ static int vtd_page_walk_level(dma_addr_t addr, uint64_t start,
              *
              * In either case, we send an IOTLB notification down.
              */
 -            entry.target_as = &address_space_memory;
 -            entry.iova = iova & subpage_mask;
 -            entry.perm = IOMMU_ACCESS_FLAG(read_cur, write_cur);
 -            entry.addr_mask = ~subpage_mask;
 +            event.entry.target_as = &address_space_memory;
 +            event.entry.iova = iova & subpage_mask;
 +            event.entry.perm = IOMMU_ACCESS_FLAG(read_cur, write_cur);
 +            event.entry.addr_mask = ~subpage_mask;
             /* NOTE: this is only meaningful if entry_valid == true */
 -            entry.translated_addr = vtd_get_slpte_addr(slpte, info->aw);
 -            ret = vtd_page_walk_one(&entry, info);
 +            event.entry.translated_addr = vtd_get_slpte_addr(slpte, info->aw);
 +            event.type = event.entry.perm ? IOMMU_NOTIFIER_MAP :
 +                                            IOMMU_NOTIFIER_UNMAP;
 +            ret = vtd_page_walk_one(&event, info);
         }
         if (ret < 0) {
@@ -1430,10 +1435,10 @@ static int vtd_dev_to_context_entry(IntelIOMMUState *s, uint8_t bus_num,
     return 0;
 }
 -static int vtd_sync_shadow_page_hook(IOMMUTLBEntry *entry,
 +static int vtd_sync_shadow_page_hook(IOMMUTLBEvent *event,
                                      void *private)
 {
 -    memory_region_notify_iommu((IOMMUMemoryRegion *)private, 0, *entry);
 +    memory_region_notify_iommu(private, 0, *event);
     return 0;
 }
@@ -1993,14 +1998,17 @@ static void vtd_iotlb_page_invalidate_notify(IntelIOMMUState *s,
                  * page tables.  We just deliver the PSI down to
                  * invalidate caches.
                  */
 -                IOMMUTLBEntry entry = {
 -                    .target_as = &address_space_memory,
 -                    .iova = addr,
 -                    .translated_addr = 0,
 -                    .addr_mask = size - 1,
 -                    .perm = IOMMU_NONE,
 +                IOMMUTLBEvent event = {
 +                    .type = IOMMU_NOTIFIER_UNMAP,
 +                    .entry = {
 +                        .target_as = &address_space_memory,
 +                        .iova = addr,
 +                        .translated_addr = 0,
 +                        .addr_mask = size - 1,
 +                        .perm = IOMMU_NONE,
 +                    },
                 };
 -                memory_region_notify_iommu(&vtd_as->iommu, 0, entry);
 +                memory_region_notify_iommu(&vtd_as->iommu, 0, event);
             }
         }
     }
@@ -2412,7 +2420,7 @@ static bool vtd_process_device_iotlb_desc(IntelIOMMUState *s,
                                           VTDInvDesc *inv_desc)
 {
     VTDAddressSpace *vtd_dev_as;
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     struct VTDBus *vtd_bus;
     hwaddr addr;
     uint64_t sz;
@@ -2460,12 +2468,13 @@ static bool vtd_process_device_iotlb_desc(IntelIOMMUState *s,
         sz = VTD_PAGE_SIZE;
     }
 -    entry.target_as = &vtd_dev_as->as;
 -    entry.addr_mask = sz - 1;
 -    entry.iova = addr;
 -    entry.perm = IOMMU_NONE;
 -    entry.translated_addr = 0;
 -    memory_region_notify_iommu(&vtd_dev_as->iommu, 0, entry);
 +    event.type = IOMMU_NOTIFIER_UNMAP;
 +    event.entry.target_as = &vtd_dev_as->as;
 +    event.entry.addr_mask = sz - 1;
 +    event.entry.iova = addr;
 +    event.entry.perm = IOMMU_NONE;
 +    event.entry.translated_addr = 0;
 +    memory_region_notify_iommu(&vtd_dev_as->iommu, 0, event);
 done:
     return true;
@@ -3485,19 +3494,20 @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
     size = remain = end - start + 1;
     while (remain >= VTD_PAGE_SIZE) {
 -        IOMMUTLBEntry entry;
 +        IOMMUTLBEvent event;
         uint64_t mask = get_naturally_aligned_size(start, remain, s->aw_bits);
         assert(mask);
 -        entry.iova = start;
 -        entry.addr_mask = mask - 1;
 -        entry.target_as = &address_space_memory;
 -        entry.perm = IOMMU_NONE;
 +        event.type = IOMMU_NOTIFIER_UNMAP;
 +        event.entry.iova = start;
 +        event.entry.addr_mask = mask - 1;
 +        event.entry.target_as = &address_space_memory;
 +        event.entry.perm = IOMMU_NONE;
         /* This field is meaningless for unmap */
 -        entry.translated_addr = 0;
 +        event.entry.translated_addr = 0;
 -        memory_region_notify_iommu_one(n, &entry);
 +        memory_region_notify_iommu_one(n, &event);
         start += mask;
         remain -= mask;
@@ -3533,9 +3543,9 @@ static void vtd_address_space_refresh_all(IntelIOMMUState *s)
     vtd_switch_address_space_all(s);
 }
 -static int vtd_replay_hook(IOMMUTLBEntry *entry, void *private)
 +static int vtd_replay_hook(IOMMUTLBEvent *event, void *private)
 {
 -    memory_region_notify_iommu_one((IOMMUNotifier *)private, entry);
 +    memory_region_notify_iommu_one(private, event);
     return 0;
 }
 diff --git a/hw/misc/tz-mpc.c b/hw/misc/tz-mpc.c
 index 98f151237f..30481e1c90 100644
 --- a/hw/misc/tz-mpc.c
 +++ b/hw/misc/tz-mpc.c
@@ -82,8 +82,10 @@ static void tz_mpc_iommu_notify(TZMPC *s, uint32_t lutidx,
     /* Called when the LUT word at lutidx has changed from oldlut to newlut;
      * must call the IOMMU notifiers for the changed blocks.
      */
 -    IOMMUTLBEntry entry = {
 -        .addr_mask = s->blocksize - 1,
 +    IOMMUTLBEvent event = {
 +        .entry = {
 +            .addr_mask = s->blocksize - 1,
 +        }
     };
     hwaddr addr = lutidx * s->blocksize * 32;
     int i;
@@ -100,26 +102,28 @@ static void tz_mpc_iommu_notify(TZMPC *s, uint32_t lutidx,
         block_is_ns = newlut & (1 << i);
         trace_tz_mpc_iommu_notify(addr);
 -        entry.iova = addr;
 -        entry.translated_addr = addr;
 +        event.entry.iova = addr;
 +        event.entry.translated_addr = addr;
 -        entry.perm = IOMMU_NONE;
 -        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, entry);
 -        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, entry);
 +        event.type = IOMMU_NOTIFIER_UNMAP;
 +        event.entry.perm = IOMMU_NONE;
 +        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
 +        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
 -        entry.perm = IOMMU_RW;
 +        event.type = IOMMU_NOTIFIER_MAP;
 +        event.entry.perm = IOMMU_RW;
         if (block_is_ns) {
 -            entry.target_as = &s->blocked_io_as;
 +            event.entry.target_as = &s->blocked_io_as;
         } else {
 -            entry.target_as = &s->downstream_as;
 +            event.entry.target_as = &s->downstream_as;
         }
 -        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, entry);
 +        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_S, event);
         if (block_is_ns) {
 -            entry.target_as = &s->downstream_as;
 +            event.entry.target_as = &s->downstream_as;
         } else {
 -            entry.target_as = &s->blocked_io_as;
 +            event.entry.target_as = &s->blocked_io_as;
         }
 -        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, entry);
 +        memory_region_notify_iommu(&s->upstream, IOMMU_IDX_NS, event);
     }
 }
 diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
 index 0790239ba5..30352df00e 100644
 --- a/hw/ppc/spapr_iommu.c
 +++ b/hw/ppc/spapr_iommu.c
@@ -445,7 +445,7 @@ static void spapr_tce_reset(DeviceState *dev)
 static target_ulong put_tce_emu(SpaprTceTable *tcet, target_ulong ioba,
                                 target_ulong tce)
 {
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     hwaddr page_mask = IOMMU_PAGE_MASK(tcet->page_shift);
     unsigned long index = (ioba - tcet->bus_offset) >> tcet->page_shift;
@@ -457,12 +457,13 @@ static target_ulong put_tce_emu(SpaprTceTable *tcet, target_ulong ioba,
     tcet->table[index] = tce;
 -    entry.target_as = &address_space_memory,
 -    entry.iova = (ioba - tcet->bus_offset) & page_mask;
 -    entry.translated_addr = tce & page_mask;
 -    entry.addr_mask = ~page_mask;
 -    entry.perm = spapr_tce_iommu_access_flags(tce);
 -    memory_region_notify_iommu(&tcet->iommu, 0, entry);
 +    event.entry.target_as = &address_space_memory,
 +    event.entry.iova = (ioba - tcet->bus_offset) & page_mask;
 +    event.entry.translated_addr = tce & page_mask;
 +    event.entry.addr_mask = ~page_mask;
 +    event.entry.perm = spapr_tce_iommu_access_flags(tce);
 +    event.type = event.entry.perm ? IOMMU_NOTIFIER_MAP : IOMMU_NOTIFIER_UNMAP;
 +    memory_region_notify_iommu(&tcet->iommu, 0, event);
     return H_SUCCESS;
 }
 diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
 index 70bfd91bf7..d9e1e29f1e 100644
 --- a/hw/s390x/s390-pci-inst.c
 +++ b/hw/s390x/s390-pci-inst.c
@@ -602,15 +602,18 @@ static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
                                       S390IOTLBEntry *entry)
 {
     S390IOTLBEntry *cache = g_hash_table_lookup(iommu->iotlb, &entry->iova);
 -    IOMMUTLBEntry notify = {
 -        .target_as = &address_space_memory,
 -        .iova = entry->iova,
 -        .translated_addr = entry->translated_addr,
 -        .perm = entry->perm,
 -        .addr_mask = ~PAGE_MASK,
 +    IOMMUTLBEvent event = {
 +        .type = entry->perm ? IOMMU_NOTIFIER_MAP : IOMMU_NOTIFIER_UNMAP,
 +        .entry = {
 +            .target_as = &address_space_memory,
 +            .iova = entry->iova,
 +            .translated_addr = entry->translated_addr,
 +            .perm = entry->perm,
 +            .addr_mask = ~PAGE_MASK,
 +        },
     };
 -    if (entry->perm == IOMMU_NONE) {
 +    if (event.type == IOMMU_NOTIFIER_UNMAP) {
         if (!cache) {
             goto out;
         }
@@ -623,9 +626,11 @@ static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
                 goto out;
             }
 -            notify.perm = IOMMU_NONE;
 -            memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 -            notify.perm = entry->perm;
 +            event.type = IOMMU_NOTIFIER_UNMAP;
 +            event.entry.perm = IOMMU_NONE;
 +            memory_region_notify_iommu(&iommu->iommu_mr, 0, event);
 +            event.type = IOMMU_NOTIFIER_MAP;
 +            event.entry.perm = entry->perm;
         }
         cache = g_new(S390IOTLBEntry, 1);
@@ -637,7 +642,7 @@ static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
         dec_dma_avail(iommu);
     }
 -    memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 +    memory_region_notify_iommu(&iommu->iommu_mr, 0, event);
 out:
     return iommu->dma_limit ? iommu->dma_limit->avail : 1;
 diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
 index fc5c75d693..cea8811295 100644
 --- a/hw/virtio/virtio-iommu.c
 +++ b/hw/virtio/virtio-iommu.c
@@ -129,7 +129,7 @@ static void virtio_iommu_notify_map(IOMMUMemoryRegion *mr, hwaddr virt_start,
                                     hwaddr virt_end, hwaddr paddr,
                                     uint32_t flags)
 {
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     IOMMUAccessFlags perm = IOMMU_ACCESS_FLAG(flags & VIRTIO_IOMMU_MAP_F_READ,
                                               flags & VIRTIO_IOMMU_MAP_F_WRITE);
@@ -141,19 +141,20 @@ static void virtio_iommu_notify_map(IOMMUMemoryRegion *mr, hwaddr virt_start,
     trace_virtio_iommu_notify_map(mr->parent_obj.name, virt_start, virt_end,
                                   paddr, perm);
 -    entry.target_as = &address_space_memory;
 -    entry.addr_mask = virt_end - virt_start;
 -    entry.iova = virt_start;
 -    entry.perm = perm;
 -    entry.translated_addr = paddr;
 +    event.type = IOMMU_NOTIFIER_MAP;
 +    event.entry.target_as = &address_space_memory;
 +    event.entry.addr_mask = virt_end - virt_start;
 +    event.entry.iova = virt_start;
 +    event.entry.perm = perm;
 +    event.entry.translated_addr = paddr;
 -    memory_region_notify_iommu(mr, 0, entry);
 +    memory_region_notify_iommu(mr, 0, event);
 }
 static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
                                       hwaddr virt_end)
 {
 -    IOMMUTLBEntry entry;
 +    IOMMUTLBEvent event;
     if (!(mr->iommu_notify_flags & IOMMU_NOTIFIER_UNMAP)) {
         return;
@@ -161,13 +162,14 @@ static void virtio_iommu_notify_unmap(IOMMUMemoryRegion *mr, hwaddr virt_start,
     trace_virtio_iommu_notify_unmap(mr->parent_obj.name, virt_start, virt_end);
 -    entry.target_as = &address_space_memory;
 -    entry.addr_mask = virt_end - virt_start;
 -    entry.iova = virt_start;
 -    entry.perm = IOMMU_NONE;
 -    entry.translated_addr = 0;
 +    event.type = IOMMU_NOTIFIER_UNMAP;
 +    event.entry.target_as = &address_space_memory;
 +    event.entry.addr_mask = virt_end - virt_start;
 +    event.entry.iova = virt_start;
 +    event.entry.perm = IOMMU_NONE;
 +    event.entry.translated_addr = 0;
 -    memory_region_notify_iommu(mr, 0, entry);
 +    memory_region_notify_iommu(mr, 0, event);
 }
 static gboolean virtio_iommu_notify_unmap_cb(gpointer key, gpointer value,
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index d8456ccf52..e86b5e92da 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -116,6 +116,11 @@ struct IOMMUNotifier {
 };
 typedef struct IOMMUNotifier IOMMUNotifier;
 +typedef struct IOMMUTLBEvent {
 +    IOMMUNotifierFlag type;
 +    IOMMUTLBEntry entry;
 +} IOMMUTLBEvent;
 +
 /* RAM is pre-allocated and passed into qemu_ram_alloc_from_ptr */
 #define RAM_PREALLOC   (1 << 0)
@@ -1326,24 +1331,18 @@ uint64_t memory_region_iommu_get_min_page_size(IOMMUMemoryRegion *iommu_mr);
 /**
  * memory_region_notify_iommu: notify a change in an IOMMU translation entry.
  *
 - * The notification type will be decided by entry.perm bits:
 - *
 - * - For UNMAP (cache invalidation) notifies: set entry.perm to IOMMU_NONE.
 - * - For MAP (newly added entry) notifies: set entry.perm to the
 - *   permission of the page (which is definitely !IOMMU_NONE).
 - *
  * Note: for any IOMMU implementation, an in-place mapping change
  * should be notified with an UNMAP followed by a MAP.
  *
  * @iommu_mr: the memory region that was changed
  * @iommu_idx: the IOMMU index for the translation table which has changed
 - * @entry: the new entry in the IOMMU translation table.  The entry
 - *         replaces all old entries for the same virtual I/O address range.
 - *         Deleted entries have .@perm == 0.
 + * @event: TLB event with the new entry in the IOMMU translation table.
 + *         The entry replaces all old entries for the same virtual I/O address
 + *         range.
  */
 void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
                                 int iommu_idx,
 -                                IOMMUTLBEntry entry);
 +                                IOMMUTLBEvent event);
 /**
  * memory_region_notify_iommu_one: notify a change in an IOMMU translation
@@ -1353,12 +1352,12 @@ void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
  * notifies a specific notifier, not all of them.
  *
  * @notifier: the notifier to be notified
 - * @entry: the new entry in the IOMMU translation table.  The entry
 - *         replaces all old entries for the same virtual I/O address range.
 - *         Deleted entries have .@perm == 0.
 + * @event: TLB event with the new entry in the IOMMU translation table.
 + *         The entry replaces all old entries for the same virtual I/O address
 + *         range.
  */
 void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
 -                              IOMMUTLBEntry *entry);
 +                                    IOMMUTLBEvent *event);
 /**
  * memory_region_register_iommu_notifier: register a notifier for changes to
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index 44de610c72..6ca87e8d73 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -1943,11 +1943,15 @@ void memory_region_unregister_iommu_notifier(MemoryRegion *mr,
 }
 void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
 -                                    IOMMUTLBEntry *entry)
 +                                    IOMMUTLBEvent *event)
 {
 -    IOMMUNotifierFlag request_flags;
 +    IOMMUTLBEntry *entry = &event->entry;
     hwaddr entry_end = entry->iova + entry->addr_mask;
 +    if (event->type == IOMMU_NOTIFIER_UNMAP) {
 +        assert(entry->perm == IOMMU_NONE);
 +    }
 +
     /*
      * Skip the notification if the notification does not overlap
      * with registered range.
@@ -1958,20 +1962,14 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
     assert(entry->iova >= notifier->start && entry_end <= notifier->end);
 -    if (entry->perm & IOMMU_RW) {
 -        request_flags = IOMMU_NOTIFIER_MAP;
 -    } else {
 -        request_flags = IOMMU_NOTIFIER_UNMAP;
 -    }
 -
 -    if (notifier->notifier_flags & request_flags) {
 +    if (event->type & notifier->notifier_flags) {
         notifier->notify(notifier, entry);
     }
 }
 void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
                                 int iommu_idx,
 -                                IOMMUTLBEntry entry)
 +                                IOMMUTLBEvent event)
 {
     IOMMUNotifier *iommu_notifier;
@@ -1979,7 +1977,7 @@ void memory_region_notify_iommu(IOMMUMemoryRegion *iommu_mr,
     IOMMU_NOTIFIER_FOREACH(iommu_notifier, iommu_mr) {
         if (iommu_notifier->iommu_idx == iommu_idx) {
 -            memory_region_notify_iommu_one(iommu_notifier, &entry);
 +            memory_region_notify_iommu_one(iommu_notifier, &event);
         }
     }
 }
 -- 
 2.18.4
--- a/0046-memory-Add-IOMMU_NOTIFIER_DEVIOTLB_UNMAP-IOMMUTLBNot.patch
+++ b/0046-memory-Add-IOMMU_NOTIFIER_DEVIOTLB_UNMAP-IOMMUTLBNot.patch
@ -1,88 +0,0 @@
 From 6eb76ae169aaf695a5fb6ef052859828e3ea91bc Mon Sep 17 00:00:00 2001
 From: eperezma <eperezma@redhat.com>
 Date: Mon, 11 Jan 2021 14:36:13 -0500
 Subject: memory: Add IOMMU_NOTIFIER_DEVIOTLB_UNMAP IOMMUTLBNotificationType
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: eperezma <eperezma@redhat.com>
 Message-id: <20210111143615.303645-4-eperezma@redhat.com>
 Patchwork-id: 100571
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 3/5] memory: Add IOMMU_NOTIFIER_DEVIOTLB_UNMAP IOMMUTLBNotificationType
 Bugzilla: 1845758
 RH-Acked-by: Xiao Wang <jasowang@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 This allows us to differentiate between regular IOMMU map/unmap events
 and DEVIOTLB unmap. Doing so, notifiers that only need device IOTLB
 invalidations will not receive regular IOMMU unmappings.
 Adapt intel and vhost to use it.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Message-Id: <20201116165506.31315-4-eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit b68ba1ca57677acf870d5ab10579e6105c1f5338)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/intel_iommu.c | 2 +-
 hw/virtio/vhost.c     | 2 +-
 include/exec/memory.h | 7 ++++++-
 3 files changed, 8 insertions(+), 3 deletions(-)
 diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
 index 56180b1c43..edc3090f91 100644
 --- a/hw/i386/intel_iommu.c
 +++ b/hw/i386/intel_iommu.c
@@ -2468,7 +2468,7 @@ static bool vtd_process_device_iotlb_desc(IntelIOMMUState *s,
         sz = VTD_PAGE_SIZE;
     }
 -    event.type = IOMMU_NOTIFIER_UNMAP;
 +    event.type = IOMMU_NOTIFIER_DEVIOTLB_UNMAP;
     event.entry.target_as = &vtd_dev_as->as;
     event.entry.addr_mask = sz - 1;
     event.entry.iova = addr;
 diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
 index 614ccc2bcb..28c7d78172 100644
 --- a/hw/virtio/vhost.c
 +++ b/hw/virtio/vhost.c
@@ -718,7 +718,7 @@ static void vhost_iommu_region_add(MemoryListener *listener,
     iommu_idx = memory_region_iommu_attrs_to_index(iommu_mr,
                                                    MEMTXATTRS_UNSPECIFIED);
     iommu_notifier_init(&iommu->n, vhost_iommu_unmap_notify,
 -                        IOMMU_NOTIFIER_UNMAP,
 +                        IOMMU_NOTIFIER_DEVIOTLB_UNMAP,
                         section->offset_within_region,
                         int128_get64(end),
                         iommu_idx);
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index e86b5e92da..521d9901d7 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -97,9 +97,14 @@ typedef enum {
     IOMMU_NOTIFIER_UNMAP = 0x1,
     /* Notify entry changes (newly created entries) */
     IOMMU_NOTIFIER_MAP = 0x2,
 +    /* Notify changes on device IOTLB entries */
 +    IOMMU_NOTIFIER_DEVIOTLB_UNMAP = 0x04,
 } IOMMUNotifierFlag;
 -#define IOMMU_NOTIFIER_ALL (IOMMU_NOTIFIER_MAP | IOMMU_NOTIFIER_UNMAP)
 +#define IOMMU_NOTIFIER_IOTLB_EVENTS (IOMMU_NOTIFIER_MAP | IOMMU_NOTIFIER_UNMAP)
 +#define IOMMU_NOTIFIER_DEVIOTLB_EVENTS IOMMU_NOTIFIER_DEVIOTLB_UNMAP
 +#define IOMMU_NOTIFIER_ALL (IOMMU_NOTIFIER_IOTLB_EVENTS | \
 +                            IOMMU_NOTIFIER_DEVIOTLB_EVENTS)
 struct IOMMUNotifier;
 typedef void (*IOMMUNotify)(struct IOMMUNotifier *notifier,
 -- 
 2.18.4
--- a/0047-intel_iommu-Skip-page-walking-on-device-iotlb-invali.patch
+++ b/0047-intel_iommu-Skip-page-walking-on-device-iotlb-invali.patch
@ -1,57 +0,0 @@
 From add80ba59a85aca4c5e2619dee95557d2ec14169 Mon Sep 17 00:00:00 2001
 From: eperezma <eperezma@redhat.com>
 Date: Mon, 11 Jan 2021 14:36:14 -0500
 Subject: intel_iommu: Skip page walking on device iotlb invalidations
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: eperezma <eperezma@redhat.com>
 Message-id: <20210111143615.303645-5-eperezma@redhat.com>
 Patchwork-id: 100572
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 4/5] intel_iommu: Skip page walking on device iotlb invalidations
 Bugzilla: 1845758
 RH-Acked-by: Xiao Wang <jasowang@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Although they didn't reach the notifier because of the filtering in
 memory_region_notify_iommu_one, the vt-d was still splitting huge
 memory invalidations in chunks. Skipping it.
 This improves performance in case of netperf with vhost-net:
 * TCP_STREAM: From 1923.6Mbit/s to 2175.13Mbit/s (13%)
 * TCP_RR: From 8464.73 trans/s to 8932.703333 trans/s (5.5%)
 * UDP_RR: From 8562.08 trans/s to 9005.62/s (5.1%)
 * UDP_STREAM: No change observed (insignificant 0.1% improvement)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Message-Id: <20201116165506.31315-5-eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit f7701e2c7983b680790af47117577b285b6a1aed)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/intel_iommu.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
 index edc3090f91..0cc71e4057 100644
 --- a/hw/i386/intel_iommu.c
 +++ b/hw/i386/intel_iommu.c
@@ -1478,6 +1478,10 @@ static int vtd_sync_shadow_page_table(VTDAddressSpace *vtd_as)
     VTDContextEntry ce;
     IOMMUNotifier *n;
 +    if (!(vtd_as->iommu.iommu_notify_flags & IOMMU_NOTIFIER_IOTLB_EVENTS)) {
 +        return 0;
 +    }
 +
     ret = vtd_dev_to_context_entry(vtd_as->iommu_state,
                                    pci_bus_num(vtd_as->bus),
                                    vtd_as->devfn, &ce);
 -- 
 2.18.4
--- a/0048-memory-Skip-bad-range-assertion-if-notifier-is-DEVIO.patch
+++ b/0048-memory-Skip-bad-range-assertion-if-notifier-is-DEVIO.patch
@ -1,69 +0,0 @@
 From ce5295813c0f1c94964cbd126f37a3202c360b92 Mon Sep 17 00:00:00 2001
 From: eperezma <eperezma@redhat.com>
 Date: Mon, 11 Jan 2021 14:36:15 -0500
 Subject: memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: eperezma <eperezma@redhat.com>
 Message-id: <20210111143615.303645-6-eperezma@redhat.com>
 Patchwork-id: 100573
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 5/5] memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type
 Bugzilla: 1845758
 RH-Acked-by: Xiao Wang <jasowang@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Device IOTLB invalidations can unmap arbitrary ranges, eiter outside of
 the memory region or even [0, ~0ULL] for all the space. The assertion
 could be hit by a guest, and rhel7 guest effectively hit it.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Message-Id: <20201116165506.31315-6-eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 1804857f19f612f6907832e35599cdb51d4ec764)
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 softmmu/memory.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index 6ca87e8d73..22bacbbc78 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -1947,6 +1947,7 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
 {
     IOMMUTLBEntry *entry = &event->entry;
     hwaddr entry_end = entry->iova + entry->addr_mask;
 +    IOMMUTLBEntry tmp = *entry;
     if (event->type == IOMMU_NOTIFIER_UNMAP) {
         assert(entry->perm == IOMMU_NONE);
@@ -1960,10 +1961,16 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
         return;
     }
 -    assert(entry->iova >= notifier->start && entry_end <= notifier->end);
 +    if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
 +        /* Crop (iova, addr_mask) to range */
 +        tmp.iova = MAX(tmp.iova, notifier->start);
 +        tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
 +    } else {
 +        assert(entry->iova >= notifier->start && entry_end <= notifier->end);
 +    }
     if (event->type & notifier->notifier_flags) {
 -        notifier->notify(notifier, entry);
 +        notifier->notify(notifier, &tmp);
     }
 }
 -- 
 2.18.4
--- a/0049-RHEL-Switch-pvpanic-test-to-q35.patch
+++ b/0049-RHEL-Switch-pvpanic-test-to-q35.patch
@ -1,47 +0,0 @@
 From c489d2cd175e879071a3c5504a17d7f656dd7b06 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 8 Dec 2020 16:27:15 -0500
 Subject: RHEL: Switch pvpanic test to q35
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20201208162716.30836-3-dgilbert@redhat.com>
 Patchwork-id: 100360
 O-Subject: [RHEL-av-8.4.0 qemu-kvm PATCH v2 2/3] RHEL: Switch pvpanic test to q35
 Bugzilla: 1885555
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Since b1b0393c3c5 the pvpanic test checks for a different
 result (3) expecting it to get that on new machine types.
 But, downstream, our 'pc' machine type is old, so switch the
 test to q35, so it gets the new behaviour it's expecting.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 tests/qtest/pvpanic-test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
 index 016b32ebee..f0a7282b47 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -17,7 +17,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic");
 +    /* RHEL: Use q35 */
 +    qts = qtest_init("-M q35 -device pvpanic");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
 -- 
 2.18.4
--- a/0050-8.4-x86-machine-type.patch
+++ b/0050-8.4-x86-machine-type.patch
@ -1,144 +0,0 @@
 From cb95a2dd9f549a4b7fcfac97b9a83c46a232d41e Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 8 Dec 2020 16:27:16 -0500
 Subject: 8.4 x86 machine type
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20201208162716.30836-4-dgilbert@redhat.com>
 Patchwork-id: 100362
 O-Subject: [RHEL-av-8.4.0 qemu-kvm PATCH v2 3/3] 8.4 x86 machine type
 Bugzilla: 1885555
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Add pc-q35-rhel8.4.0 and fix all the compatiiblity glue up.
 Note the moving of x-smi-cpu-hotplug follows bz 1846886 comment 18
 part 2.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc.c         |  8 ++++++--
 hw/i386/pc_piix.c    |  5 +++++
 hw/i386/pc_q35.c     | 30 +++++++++++++++++++++++++++---
 include/hw/i386/pc.h |  3 +++
 4 files changed, 41 insertions(+), 5 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index f3fc695fe2..d5ea5b634c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -363,11 +363,15 @@ GlobalProperty pc_rhel_compat[] = {
     { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
     /* bz 1508330 */ 
     { "vfio-pci", "x-no-geforce-quirks", "on" },
 -    /* BZ 1846886 */
 -    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
 +
 GlobalProperty pc_rhel_8_2_compat[] = {
     /* pc_rhel_8_2_compat from pc_compat_4_2 */
     { "mch", "smbase-smram", "off" },
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 815da79108..1b1cc18ae0 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1045,6 +1045,11 @@ static void pc_machine_rhel760_options(MachineClass *m)
     m->smbus_no_migration_support = true;
     pcmc->pvh_enabled = false;
     pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_2,
                      hw_compat_rhel_8_2_len);
     compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 3340008c00..5acb47afcf 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -593,6 +593,24 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 }
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
 +                  pc_q35_machine_rhel840_options);
 +
 +
 static void pc_q35_init_rhel830(MachineState *machine)
 {
     pc_q35_init(machine);
@@ -601,10 +619,17 @@ static void pc_q35_init_rhel830(MachineState *machine)
 static void pc_q35_machine_rhel830_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_q35_machine_rhel_options(m);
 +    pc_q35_machine_rhel840_options(m);
     m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->kvmclock_create_always = false;
 }
 DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
@@ -618,9 +643,8 @@ static void pc_q35_init_rhel820(MachineState *machine)
 static void pc_q35_machine_rhel820_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_q35_machine_rhel_options(m);
 +    pc_q35_machine_rhel830_options(m);
     m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 -    m->alias = NULL;
     m->numa_mem_supported = true;
     m->auto_enable_numa_with_memdev = false;
     pcmc->smbios_stream_product = "RHEL-AV";
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index e2ba9a4b58..68091bea98 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -272,6 +272,9 @@ extern const size_t pc_compat_1_4_len;
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
 extern GlobalProperty pc_rhel_8_2_compat[];
 extern const size_t pc_rhel_8_2_compat_len;
 -- 
 2.18.4
--- a/0051-memory-clamp-cached-translation-in-case-it-points-to.patch
+++ b/0051-memory-clamp-cached-translation-in-case-it-points-to.patch
@ -1,153 +0,0 @@
 From cf7723d08da5b371ef8b89a6e4edfaa21f88f03f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 12 Jan 2021 21:01:25 -0500
 Subject: memory: clamp cached translation in case it points to an MMIO region
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 Message-id: <20210112210125.851866-2-jmaloy@redhat.com>
 Patchwork-id: 100614
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] memory: clamp cached translation in case it points to an MMIO region
 Bugzilla: 1904392
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 From: Paolo Bonzini <pbonzini@redhat.com>
 In using the address_space_translate_internal API, address_space_cache_init
 forgot one piece of advice that can be found in the code for
 address_space_translate_internal:
    /* MMIO registers can be expected to perform full-width accesses based only
     * on their address, without considering adjacent registers that could
     * decode to completely different MemoryRegions.  When such registers
     * exist (e.g. I/O ports 0xcf8 and 0xcf9 on most PC chipsets), MMIO
     * regions overlap wildly.  For this reason we cannot clamp the accesses
     * here.
     *
     * If the length is small (as is the case for address_space_ldl/stl),
     * everything works fine.  If the incoming length is large, however,
     * the caller really has to do the clamping through memory_access_size.
     */
 address_space_cache_init is exactly one such case where "the incoming length
 is large", therefore we need to clamp the resulting length---not to
 memory_access_size though, since we are not doing an access yet, but to
 the size of the resulting section.  This ensures that subsequent accesses
 to the cached MemoryRegionSection will be in range.
 With this patch, the enclosed testcase notices that the used ring does
 not fit into the MSI-X table and prints a "qemu-system-x86_64: Cannot map used"
 error.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from 4bfb024bc76973d40a359476dc0291f46e435442)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 softmmu/physmem.c       | 10 ++++++++
 tests/qtest/fuzz-test.c | 52 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 61 insertions(+), 1 deletion(-)
 diff --git a/softmmu/physmem.c b/softmmu/physmem.c
 index 3027747c03..fb3f276844 100644
 --- a/softmmu/physmem.c
 +++ b/softmmu/physmem.c
@@ -3255,6 +3255,7 @@ int64_t address_space_cache_init(MemoryRegionCache *cache,
     AddressSpaceDispatch *d;
     hwaddr l;
     MemoryRegion *mr;
 +    Int128 diff;
     assert(len > 0);
@@ -3263,6 +3264,15 @@ int64_t address_space_cache_init(MemoryRegionCache *cache,
     d = flatview_to_dispatch(cache->fv);
     cache->mrs = *address_space_translate_internal(d, addr, &cache->xlat, &l, true);
 +    /*
 +     * cache->xlat is now relative to cache->mrs.mr, not to the section itself.
 +     * Take that into account to compute how many bytes are there between
 +     * cache->xlat and the end of the section.
 +     */
 +    diff = int128_sub(cache->mrs.size,
 +                      int128_make64(cache->xlat - cache->mrs.offset_within_region));
 +    l = int128_get64(int128_min(diff, int128_make64(l)));
 +
     mr = cache->mrs.mr;
     memory_region_ref(mr);
     if (memory_access_is_direct(mr, is_write)) {
 diff --git a/tests/qtest/fuzz-test.c b/tests/qtest/fuzz-test.c
 index 2692d556d9..99d1a3ee12 100644
 --- a/tests/qtest/fuzz-test.c
 +++ b/tests/qtest/fuzz-test.c
@@ -73,6 +73,55 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
     qtest_quit(s);
 }
 + /*
 +  * Here a MemoryRegionCache pointed to an MMIO region but had a
 +  * larger size than the underlying region.
 +  */
 +static void test_mmio_oob_from_memory_region_cache(void)
 +{
 +    QTestState *s;
 +
 +    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
 +                   "-device virtio-scsi,num_queues=8,addr=03.0 ");
 +
 +    qtest_outl(s, 0xcf8, 0x80001811);
 +    qtest_outb(s, 0xcfc, 0x6e);
 +    qtest_outl(s, 0xcf8, 0x80001824);
 +    qtest_outl(s, 0xcf8, 0x80001813);
 +    qtest_outl(s, 0xcfc, 0xa080000);
 +    qtest_outl(s, 0xcf8, 0x80001802);
 +    qtest_outl(s, 0xcfc, 0x5a175a63);
 +    qtest_outb(s, 0x6e08, 0x9e);
 +    qtest_writeb(s, 0x9f003, 0xff);
 +    qtest_writeb(s, 0x9f004, 0x01);
 +    qtest_writeb(s, 0x9e012, 0x0e);
 +    qtest_writeb(s, 0x9e01b, 0x0e);
 +    qtest_writeb(s, 0x9f006, 0x01);
 +    qtest_writeb(s, 0x9f008, 0x01);
 +    qtest_writeb(s, 0x9f00a, 0x01);
 +    qtest_writeb(s, 0x9f00c, 0x01);
 +    qtest_writeb(s, 0x9f00e, 0x01);
 +    qtest_writeb(s, 0x9f010, 0x01);
 +    qtest_writeb(s, 0x9f012, 0x01);
 +    qtest_writeb(s, 0x9f014, 0x01);
 +    qtest_writeb(s, 0x9f016, 0x01);
 +    qtest_writeb(s, 0x9f018, 0x01);
 +    qtest_writeb(s, 0x9f01a, 0x01);
 +    qtest_writeb(s, 0x9f01c, 0x01);
 +    qtest_writeb(s, 0x9f01e, 0x01);
 +    qtest_writeb(s, 0x9f020, 0x01);
 +    qtest_writeb(s, 0x9f022, 0x01);
 +    qtest_writeb(s, 0x9f024, 0x01);
 +    qtest_writeb(s, 0x9f026, 0x01);
 +    qtest_writeb(s, 0x9f028, 0x01);
 +    qtest_writeb(s, 0x9f02a, 0x01);
 +    qtest_writeb(s, 0x9f02c, 0x01);
 +    qtest_writeb(s, 0x9f02e, 0x01);
 +    qtest_writeb(s, 0x9f030, 0x01);
 +    qtest_outb(s, 0x6e10, 0x00);
 +    qtest_quit(s);
 +}
 +
 int main(int argc, char **argv)
 {
     const char *arch = qtest_get_arch();
@@ -86,7 +135,8 @@ int main(int argc, char **argv)
                        test_lp1878642_pci_bus_get_irq_level_assert);
         qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
                        test_lp1879531_eth_get_rss_ex_dst_addr);
 -
 +        qtest_add_func("fuzz/test_mmio_oob_from_memory_region_cache",
 +                       test_mmio_oob_from_memory_region_cache);
     }
     return g_test_run();
 -- 
 2.18.4
--- a/0054-Drop-bogus-IPv6-messages.patch
+++ b/0054-Drop-bogus-IPv6-messages.patch
@ -1,51 +0,0 @@
 From 1b118c53c70d9fa4ba3dcdf172039d29335bed73 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 20 Jan 2021 00:13:11 -0500
 Subject: Drop bogus IPv6 messages
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 Message-id: <20210120001311.1356511-2-jmaloy@redhat.com>
 Patchwork-id: 100699
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] Drop bogus IPv6 messages
 Bugzilla: 1918061
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 From: Ralf Haferkamp <rhafer@suse.com>
 Drop IPv6 message shorter than what's mentioned in the payload
 length header (+ the size of the IPv6 header). They're invalid an could
 lead to data leakage in icmp6_send_echoreply().
 (cherry picked from libslirp commit c7ede54cbd2e2b25385325600958ba0124e31cc0)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 slirp/src/ip6_input.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/slirp/src/ip6_input.c b/slirp/src/ip6_input.c
 index a83e4f8e3d..f7ef354ee4 100644
 --- a/slirp/src/ip6_input.c
 +++ b/slirp/src/ip6_input.c
@@ -56,6 +56,13 @@ void ip6_input(struct mbuf *m)
         goto bad;
     }
 +    // Check if the message size is big enough to hold what's
 +    // set in the payload length header. If not this is an invalid
 +    // packet
 +    if (m->m_len < ntohs(ip6->ip_pl) + sizeof(struct ip6)) {
 +        goto bad;
 +    }
 +
     /* check ip_ttl for a correct ICMP reply */
     if (ip6->ip_hl == 0) {
         icmp6_send_error(m, ICMP6_TIMXCEED, ICMP6_TIMXCEED_INTRANS);
 -- 
 2.18.4
--- a/README.rst
+++ b/README.rst
@ -1,18 +0,0 @@
 ===================
 qemu-kvm development
 ===================
 qemu-kvm is maintained in a `source tree`_ rather than directly in dist-git
 using packit service that provides way to develope using regular source code
 structure and provides way to generate SRPM and build using koji service.
 Developers deliver all changes to source-git using merge request. Only maintainers
 will be pushing changes sent to source-git to dist-git.
 Each release in dist-git is tagged in the source repository so you can easily
 check out the source tree for a build. The tags are in the format
 name-version-release, but note release doesn't contain the dist tag since the
 source can be built in different build roots (Fedora, CentOS, etc.)
 .. _source tree: https://gitlab.com/redhat/centos-stream/src/qemu-kvm
--- a/kvm-block-Avoid-processing-BDS-twice-in-bdrv_set_aio_con.patch
+++ b/kvm-block-Avoid-processing-BDS-twice-in-bdrv_set_aio_con.patch
@ -1,96 +0,0 @@
 From 0db52fa2553ba83454a347e0aca4896e1b0d9b41 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 11 Feb 2021 14:42:06 -0300
 Subject: [PATCH 4/6] block: Avoid processing BDS twice in
 bdrv_set_aio_context_ignore()
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20210211144208.58930-4-slp@redhat.com>
 Patchwork-id: 101050
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 3/5] block: Avoid processing BDS twice in bdrv_set_aio_context_ignore()
 Bugzilla: 1918966 1918968
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 Some graphs may contain an indirect reference to the first BDS in the
 chain that can be reached while walking it bottom->up from one its
 children.
 Doubling-processing of a BDS is especially problematic for the
 aio_notifiers, as they might attempt to work on both the old and the
 new AIO contexts.
 To avoid this problem, add every child and parent to the ignore list
 before actually processing them.
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20210201125032.44713-2-slp@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 722d8e73d65cb54f39d360ecb2147ac58f43c399)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 block.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)
 diff --git a/block.c b/block.c
 index f1cedac362..8bfa446f9c 100644
 --- a/block.c
 +++ b/block.c
@@ -6454,7 +6454,10 @@ void bdrv_set_aio_context_ignore(BlockDriverState *bs,
                                  AioContext *new_context, GSList **ignore)
 {
     AioContext *old_context = bdrv_get_aio_context(bs);
 -    BdrvChild *child;
 +    GSList *children_to_process = NULL;
 +    GSList *parents_to_process = NULL;
 +    GSList *entry;
 +    BdrvChild *child, *parent;
     g_assert(qemu_get_current_aio_context() == qemu_get_aio_context());
@@ -6469,16 +6472,33 @@ void bdrv_set_aio_context_ignore(BlockDriverState *bs,
             continue;
         }
         *ignore = g_slist_prepend(*ignore, child);
 -        bdrv_set_aio_context_ignore(child->bs, new_context, ignore);
 +        children_to_process = g_slist_prepend(children_to_process, child);
     }
 -    QLIST_FOREACH(child, &bs->parents, next_parent) {
 -        if (g_slist_find(*ignore, child)) {
 +
 +    QLIST_FOREACH(parent, &bs->parents, next_parent) {
 +        if (g_slist_find(*ignore, parent)) {
             continue;
         }
 -        assert(child->klass->set_aio_ctx);
 -        *ignore = g_slist_prepend(*ignore, child);
 -        child->klass->set_aio_ctx(child, new_context, ignore);
 +        *ignore = g_slist_prepend(*ignore, parent);
 +        parents_to_process = g_slist_prepend(parents_to_process, parent);
 +    }
 +
 +    for (entry = children_to_process;
 +         entry != NULL;
 +         entry = g_slist_next(entry)) {
 +        child = entry->data;
 +        bdrv_set_aio_context_ignore(child->bs, new_context, ignore);
 +    }
 +    g_slist_free(children_to_process);
 +
 +    for (entry = parents_to_process;
 +         entry != NULL;
 +         entry = g_slist_next(entry)) {
 +        parent = entry->data;
 +        assert(parent->klass->set_aio_ctx);
 +        parent->klass->set_aio_ctx(parent, new_context, ignore);
     }
 +    g_slist_free(parents_to_process);
     bdrv_detach_aio_context(bs);
 -- 
 2.27.0
--- a/kvm-block-Honor-blk_set_aio_context-context-requirements.patch
+++ b/kvm-block-Honor-blk_set_aio_context-context-requirements.patch
@ -1,118 +0,0 @@
 From bc284d49a00a1a716b380c2245aa0b897a259a5d Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 11 Feb 2021 14:42:04 -0300
 Subject: [PATCH 2/6] block: Honor blk_set_aio_context() context requirements
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20210211144208.58930-2-slp@redhat.com>
 Patchwork-id: 101049
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/5] block: Honor blk_set_aio_context() context requirements
 Bugzilla: 1918966 1918968
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 The documentation for bdrv_set_aio_context_ignore() states this:
 * The caller must own the AioContext lock for the old AioContext of bs, but it
 * must not own the AioContext lock for new_context (unless new_context is the
 * same as the current context of bs).
 As blk_set_aio_context() makes use of this function, this rule also
 applies to it.
 Fix all occurrences where this rule wasn't honored.
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20201214170519.223781-2-slp@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit c7040ff64ec93ee925a81d3547db925fe7d1f1c0)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 hw/block/dataplane/virtio-blk.c | 4 ++++
 hw/block/dataplane/xen-block.c  | 7 ++++++-
 hw/scsi/virtio-scsi.c           | 6 ++++--
 3 files changed, 14 insertions(+), 3 deletions(-)
 diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
 index 37499c5564..e9050c8987 100644
 --- a/hw/block/dataplane/virtio-blk.c
 +++ b/hw/block/dataplane/virtio-blk.c
@@ -172,6 +172,7 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
     VirtIOBlockDataPlane *s = vblk->dataplane;
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vblk)));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
 +    AioContext *old_context;
     unsigned i;
     unsigned nvqs = s->conf->num_queues;
     Error *local_err = NULL;
@@ -214,7 +215,10 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
     vblk->dataplane_started = true;
     trace_virtio_blk_data_plane_start(s);
 +    old_context = blk_get_aio_context(s->conf->conf.blk);
 +    aio_context_acquire(old_context);
     r = blk_set_aio_context(s->conf->conf.blk, s->ctx, &local_err);
 +    aio_context_release(old_context);
     if (r < 0) {
         error_report_err(local_err);
         goto fail_guest_notifiers;
 diff --git a/hw/block/dataplane/xen-block.c b/hw/block/dataplane/xen-block.c
 index 71c337c7b7..3675f8deaf 100644
 --- a/hw/block/dataplane/xen-block.c
 +++ b/hw/block/dataplane/xen-block.c
@@ -725,6 +725,7 @@ void xen_block_dataplane_start(XenBlockDataPlane *dataplane,
 {
     ERRP_GUARD();
     XenDevice *xendev = dataplane->xendev;
 +    AioContext *old_context;
     unsigned int ring_size;
     unsigned int i;
@@ -808,10 +809,14 @@ void xen_block_dataplane_start(XenBlockDataPlane *dataplane,
         goto stop;
     }
 -    aio_context_acquire(dataplane->ctx);
 +    old_context = blk_get_aio_context(dataplane->blk);
 +    aio_context_acquire(old_context);
     /* If other users keep the BlockBackend in the iothread, that's ok */
     blk_set_aio_context(dataplane->blk, dataplane->ctx, NULL);
 +    aio_context_release(old_context);
 +
     /* Only reason for failure is a NULL channel */
 +    aio_context_acquire(dataplane->ctx);
     xen_device_set_event_channel_context(xendev, dataplane->event_channel,
                                          dataplane->ctx, &error_abort);
     aio_context_release(dataplane->ctx);
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index 82c025146d..66bdda5473 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
@@ -821,6 +821,7 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
     SCSIDevice *sd = SCSI_DEVICE(dev);
 +    AioContext *old_context;
     int ret;
     /* XXX: Remove this check once block backend is capable of handling
@@ -836,9 +837,10 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
         }
 -        virtio_scsi_acquire(s);
 +        old_context = blk_get_aio_context(sd->conf.blk);
 +        aio_context_acquire(old_context);
         ret = blk_set_aio_context(sd->conf.blk, s->ctx, errp);
 -        virtio_scsi_release(s);
 +        aio_context_release(old_context);
         if (ret < 0) {
             return;
         }
 -- 
 2.27.0
--- a/kvm-block-export-fix-blk_size-double-byteswap.patch
+++ b/kvm-block-export-fix-blk_size-double-byteswap.patch
@ -1,44 +0,0 @@
 From 29c5b94ae259f21b792a611096c60b240e0c0983 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 15 Mar 2021 18:16:25 -0400
 Subject: [PATCH 09/15] block/export: fix blk_size double byteswap
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20210315181629.212884-3-stefanha@redhat.com>
 Patchwork-id: 101340
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/6] block/export: fix blk_size double byteswap
 Bugzilla: 1937004
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 The config->blk_size field is little-endian. Use the native-endian
 blk_size variable to avoid double byteswapping.
 Fixes: 11f60f7eaee2630dd6fa0c3a8c49f792e46c4cf1 ("block/export: make vhost-user-blk config space little-endian")
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210223144653.811468-8-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit a4f1542af58fd6ab061e594d4e161f1c8b4a4372)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/export/vhost-user-blk-server.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index 62672d1cb9..3003cff189 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -354,7 +354,7 @@ vu_blk_initialize_config(BlockDriverState *bs,
     config->num_queues = cpu_to_le16(num_queues);
     config->max_discard_sectors = cpu_to_le32(32768);
     config->max_discard_seg = cpu_to_le32(1);
 -    config->discard_sector_alignment = cpu_to_le32(config->blk_size >> 9);
 +    config->discard_sector_alignment = cpu_to_le32(blk_size >> 9);
     config->max_write_zeroes_sectors = cpu_to_le32(32768);
     config->max_write_zeroes_seg = cpu_to_le32(1);
 }
 -- 
 2.27.0
--- a/kvm-block-export-fix-vhost-user-blk-export-sector-number.patch
+++ b/kvm-block-export-fix-vhost-user-blk-export-sector-number.patch
@ -1,53 +0,0 @@
 From e158a830fa229937fcb2ef755b50695abd64533a Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 15 Mar 2021 18:16:27 -0400
 Subject: [PATCH 11/15] block/export: fix vhost-user-blk export sector number
 calculation
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20210315181629.212884-5-stefanha@redhat.com>
 Patchwork-id: 101341
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 4/6] block/export: fix vhost-user-blk export sector number calculation
 Bugzilla: 1937004
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 The driver is supposed to honor the blk_size field but the protocol
 still uses 512-byte sector numbers. It is incorrect to multiply
 req->sector_num by blk_size.
 VIRTIO 1.1 5.2.5 Device Initialization says:
  blk_size can be read to determine the optimal sector size for the
  driver to use. This does not affect the units used in the protocol
  (always 512 bytes), but awareness of the correct value can affect
  performance.
 Fixes: 3578389bcf76c824a5d82e6586a6f0c71e56f2aa ("block/export: vhost-user block device backend server")
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210223144653.811468-10-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit e44362ce317bcc46d409ed6c4a5ed2b46804bcbf)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/export/vhost-user-blk-server.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index feb139e067..bb07f499c8 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -144,7 +144,7 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
             break;
         }
 -        int64_t offset = req->sector_num * vexp->blk_size;
 +        int64_t offset = req->sector_num << VIRTIO_BLK_SECTOR_BITS;
         QEMUIOVector qiov;
         if (is_write) {
             qemu_iovec_init_external(&qiov, out_iov, out_num);
 -- 
 2.27.0
--- a/kvm-block-export-port-virtio-blk-discard-write-zeroes-in.patch
+++ b/kvm-block-export-port-virtio-blk-discard-write-zeroes-in.patch
@ -1,199 +0,0 @@
 From 400ddccbcd8ddc13c85dbb7796b15fe9d6a01c1f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 15 Mar 2021 18:16:28 -0400
 Subject: [PATCH 12/15] block/export: port virtio-blk discard/write zeroes
 input validation
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20210315181629.212884-6-stefanha@redhat.com>
 Patchwork-id: 101342
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 5/6] block/export: port virtio-blk discard/write zeroes input validation
 Bugzilla: 1937004
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 Validate discard/write zeroes the same way we do for virtio-blk. Some of
 these checks are mandated by the VIRTIO specification, others are
 internal to QEMU.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210223144653.811468-11-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit db4eadf9f10e19f864d70d1df3a90fbda31b8c06)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/export/vhost-user-blk-server.c | 116 +++++++++++++++++++++------
 1 file changed, 93 insertions(+), 23 deletions(-)
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index bb07f499c8..937bb5e9b4 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -29,6 +29,8 @@
 enum {
     VHOST_USER_BLK_NUM_QUEUES_DEFAULT = 1,
 +    VHOST_USER_BLK_MAX_DISCARD_SECTORS = 32768,
 +    VHOST_USER_BLK_MAX_WRITE_ZEROES_SECTORS = 32768,
 };
 struct virtio_blk_inhdr {
     unsigned char status;
@@ -65,30 +67,102 @@ static void vu_blk_req_complete(VuBlkReq *req)
     free(req);
 }
 +static bool vu_blk_sect_range_ok(VuBlkExport *vexp, uint64_t sector,
 +                                 size_t size)
 +{
 +    uint64_t nb_sectors = size >> BDRV_SECTOR_BITS;
 +    uint64_t total_sectors;
 +
 +    if (nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
 +        return false;
 +    }
 +    if ((sector << VIRTIO_BLK_SECTOR_BITS) % vexp->blk_size) {
 +        return false;
 +    }
 +    blk_get_geometry(vexp->export.blk, &total_sectors);
 +    if (sector > total_sectors || nb_sectors > total_sectors - sector) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 static int coroutine_fn
 -vu_blk_discard_write_zeroes(BlockBackend *blk, struct iovec *iov,
 +vu_blk_discard_write_zeroes(VuBlkExport *vexp, struct iovec *iov,
                             uint32_t iovcnt, uint32_t type)
 {
 +    BlockBackend *blk = vexp->export.blk;
     struct virtio_blk_discard_write_zeroes desc;
 -    ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
 +    ssize_t size;
 +    uint64_t sector;
 +    uint32_t num_sectors;
 +    uint32_t max_sectors;
 +    uint32_t flags;
 +    int bytes;
 +
 +    /* Only one desc is currently supported */
 +    if (unlikely(iov_size(iov, iovcnt) > sizeof(desc))) {
 +        return VIRTIO_BLK_S_UNSUPP;
 +    }
 +
 +    size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
     if (unlikely(size != sizeof(desc))) {
 -        error_report("Invalid size %zd, expect %zu", size, sizeof(desc));
 -        return -EINVAL;
 +        error_report("Invalid size %zd, expected %zu", size, sizeof(desc));
 +        return VIRTIO_BLK_S_IOERR;
     }
 -    uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
 -                          le32_to_cpu(desc.num_sectors) << 9 };
 -    if (type == VIRTIO_BLK_T_DISCARD) {
 -        if (blk_co_pdiscard(blk, range[0], range[1]) == 0) {
 -            return 0;
 +    sector = le64_to_cpu(desc.sector);
 +    num_sectors = le32_to_cpu(desc.num_sectors);
 +    flags = le32_to_cpu(desc.flags);
 +    max_sectors = (type == VIRTIO_BLK_T_WRITE_ZEROES) ?
 +                  VHOST_USER_BLK_MAX_WRITE_ZEROES_SECTORS :
 +                  VHOST_USER_BLK_MAX_DISCARD_SECTORS;
 +
 +    /* This check ensures that 'bytes' fits in an int */
 +    if (unlikely(num_sectors > max_sectors)) {
 +        return VIRTIO_BLK_S_IOERR;
 +    }
 +
 +    bytes = num_sectors << VIRTIO_BLK_SECTOR_BITS;
 +
 +    if (unlikely(!vu_blk_sect_range_ok(vexp, sector, bytes))) {
 +        return VIRTIO_BLK_S_IOERR;
 +    }
 +
 +    /*
 +     * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for discard
 +     * and write zeroes commands if any unknown flag is set.
 +     */
 +    if (unlikely(flags & ~VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
 +        return VIRTIO_BLK_S_UNSUPP;
 +    }
 +
 +    if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
 +        int blk_flags = 0;
 +
 +        if (flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP) {
 +            blk_flags |= BDRV_REQ_MAY_UNMAP;
 +        }
 +
 +        if (blk_co_pwrite_zeroes(blk, sector << VIRTIO_BLK_SECTOR_BITS,
 +                                 bytes, blk_flags) == 0) {
 +            return VIRTIO_BLK_S_OK;
         }
 -    } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
 -        if (blk_co_pwrite_zeroes(blk, range[0], range[1], 0) == 0) {
 -            return 0;
 +    } else if (type == VIRTIO_BLK_T_DISCARD) {
 +        /*
 +         * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for
 +         * discard commands if the unmap flag is set.
 +         */
 +        if (unlikely(flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
 +            return VIRTIO_BLK_S_UNSUPP;
 +        }
 +
 +        if (blk_co_pdiscard(blk, sector << VIRTIO_BLK_SECTOR_BITS,
 +                            bytes) == 0) {
 +            return VIRTIO_BLK_S_OK;
         }
     }
 -    return -EINVAL;
 +    return VIRTIO_BLK_S_IOERR;
 }
 static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
@@ -177,19 +251,13 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
     }
     case VIRTIO_BLK_T_DISCARD:
     case VIRTIO_BLK_T_WRITE_ZEROES: {
 -        int rc;
 -
         if (!vexp->writable) {
             req->in->status = VIRTIO_BLK_S_IOERR;
             break;
         }
 -        rc = vu_blk_discard_write_zeroes(blk, &elem->out_sg[1], out_num, type);
 -        if (rc == 0) {
 -            req->in->status = VIRTIO_BLK_S_OK;
 -        } else {
 -            req->in->status = VIRTIO_BLK_S_IOERR;
 -        }
 +        req->in->status = vu_blk_discard_write_zeroes(vexp, out_iov, out_num,
 +                                                      type);
         break;
     }
     default:
@@ -360,11 +428,13 @@ vu_blk_initialize_config(BlockDriverState *bs,
     config->min_io_size = cpu_to_le16(1);
     config->opt_io_size = cpu_to_le32(1);
     config->num_queues = cpu_to_le16(num_queues);
 -    config->max_discard_sectors = cpu_to_le32(32768);
 +    config->max_discard_sectors =
 +        cpu_to_le32(VHOST_USER_BLK_MAX_DISCARD_SECTORS);
     config->max_discard_seg = cpu_to_le32(1);
     config->discard_sector_alignment =
         cpu_to_le32(blk_size >> VIRTIO_BLK_SECTOR_BITS);
 -    config->max_write_zeroes_sectors = cpu_to_le32(32768);
 +    config->max_write_zeroes_sectors
 +        = cpu_to_le32(VHOST_USER_BLK_MAX_WRITE_ZEROES_SECTORS);
     config->max_write_zeroes_seg = cpu_to_le32(1);
 }
 -- 
 2.27.0
--- a/kvm-block-export-port-virtio-blk-read-write-range-check.patch
+++ b/kvm-block-export-port-virtio-blk-read-write-range-check.patch
@ -1,70 +0,0 @@
 From 03aeb30096eb0d48e0b493ed4925b99b0e27979e Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 15 Mar 2021 18:16:29 -0400
 Subject: [PATCH 13/15] block/export: port virtio-blk read/write range check
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20210315181629.212884-7-stefanha@redhat.com>
 Patchwork-id: 101343
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 6/6] block/export: port virtio-blk read/write range check
 Bugzilla: 1937004
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 Check that the sector number and byte count are valid.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210223144653.811468-13-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 05ae4e674e3d47342a7660ae7bc55b393e09f4c7)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/export/vhost-user-blk-server.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index 937bb5e9b4..dbe3cfb9e8 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -209,6 +209,8 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
     switch (type & ~VIRTIO_BLK_T_BARRIER) {
     case VIRTIO_BLK_T_IN:
     case VIRTIO_BLK_T_OUT: {
 +        QEMUIOVector qiov;
 +        int64_t offset;
         ssize_t ret = 0;
         bool is_write = type & VIRTIO_BLK_T_OUT;
         req->sector_num = le64_to_cpu(req->out.sector);
@@ -218,13 +220,24 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
             break;
         }
 -        int64_t offset = req->sector_num << VIRTIO_BLK_SECTOR_BITS;
 -        QEMUIOVector qiov;
         if (is_write) {
             qemu_iovec_init_external(&qiov, out_iov, out_num);
 -            ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
         } else {
             qemu_iovec_init_external(&qiov, in_iov, in_num);
 +        }
 +
 +        if (unlikely(!vu_blk_sect_range_ok(vexp,
 +                                           req->sector_num,
 +                                           qiov.size))) {
 +            req->in->status = VIRTIO_BLK_S_IOERR;
 +            break;
 +        }
 +
 +        offset = req->sector_num << VIRTIO_BLK_SECTOR_BITS;
 +
 +        if (is_write) {
 +            ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
 +        } else {
             ret = blk_co_preadv(blk, offset, qiov.size, &qiov, 0);
         }
         if (ret >= 0) {
 -- 
 2.27.0
--- a/kvm-block-export-use-VIRTIO_BLK_SECTOR_BITS.patch
+++ b/kvm-block-export-use-VIRTIO_BLK_SECTOR_BITS.patch
@ -1,84 +0,0 @@
 From 38097598172fa6b5b66224ee3a17dcc7d8ff6488 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 15 Mar 2021 18:16:26 -0400
 Subject: [PATCH 10/15] block/export: use VIRTIO_BLK_SECTOR_BITS
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20210315181629.212884-4-stefanha@redhat.com>
 Patchwork-id: 101339
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 3/6] block/export: use VIRTIO_BLK_SECTOR_BITS
 Bugzilla: 1937004
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 Use VIRTIO_BLK_SECTOR_BITS and VIRTIO_BLK_SECTOR_SIZE when dealing with
 virtio-blk sector numbers. Although the values happen to be the same as
 BDRV_SECTOR_BITS and BDRV_SECTOR_SIZE, they are conceptually different.
 This makes it clearer when we are dealing with virtio-blk sector units.
 Use VIRTIO_BLK_SECTOR_BITS in vu_blk_initialize_config(). Later patches
 will use it the new constants the virtqueue request processing code
 path.
 Suggested-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210223144653.811468-9-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 524bac0744e5abf95856fb9e31c01fd2ef102188)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/export/vhost-user-blk-server.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index 3003cff189..feb139e067 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -20,6 +20,13 @@
 #include "sysemu/block-backend.h"
 #include "util/block-helpers.h"
 +/*
 + * Sector units are 512 bytes regardless of the
 + * virtio_blk_config->blk_size value.
 + */
 +#define VIRTIO_BLK_SECTOR_BITS 9
 +#define VIRTIO_BLK_SECTOR_SIZE (1ull << VIRTIO_BLK_SECTOR_BITS)
 +
 enum {
     VHOST_USER_BLK_NUM_QUEUES_DEFAULT = 1,
 };
@@ -345,7 +352,8 @@ vu_blk_initialize_config(BlockDriverState *bs,
                          uint32_t blk_size,
                          uint16_t num_queues)
 {
 -    config->capacity = cpu_to_le64(bdrv_getlength(bs) >> BDRV_SECTOR_BITS);
 +    config->capacity =
 +        cpu_to_le64(bdrv_getlength(bs) >> VIRTIO_BLK_SECTOR_BITS);
     config->blk_size = cpu_to_le32(blk_size);
     config->size_max = cpu_to_le32(0);
     config->seg_max = cpu_to_le32(128 - 2);
@@ -354,7 +362,8 @@ vu_blk_initialize_config(BlockDriverState *bs,
     config->num_queues = cpu_to_le16(num_queues);
     config->max_discard_sectors = cpu_to_le32(32768);
     config->max_discard_seg = cpu_to_le32(1);
 -    config->discard_sector_alignment = cpu_to_le32(blk_size >> 9);
 +    config->discard_sector_alignment =
 +        cpu_to_le32(blk_size >> VIRTIO_BLK_SECTOR_BITS);
     config->max_write_zeroes_sectors = cpu_to_le32(32768);
     config->max_write_zeroes_seg = cpu_to_le32(1);
 }
@@ -381,7 +390,7 @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
     if (vu_opts->has_logical_block_size) {
         logical_block_size = vu_opts->logical_block_size;
     } else {
 -        logical_block_size = BDRV_SECTOR_SIZE;
 +        logical_block_size = VIRTIO_BLK_SECTOR_SIZE;
     }
     check_block_size(exp->id, "logical-block-size", logical_block_size,
                      &local_err);
 -- 
 2.27.0
--- a/kvm-block-move-blk_exp_close_all-to-qemu_cleanup.patch
+++ b/kvm-block-move-blk_exp_close_all-to-qemu_cleanup.patch
@ -1,101 +0,0 @@
 From 661245e1baf416570295fad0db1fdd5ad8485e33 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 11 Feb 2021 14:42:08 -0300
 Subject: [PATCH 6/6] block: move blk_exp_close_all() to qemu_cleanup()
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20210211144208.58930-6-slp@redhat.com>
 Patchwork-id: 101052
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 5/5] block: move blk_exp_close_all() to qemu_cleanup()
 Bugzilla: 1918966 1918968
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 Move blk_exp_close_all() from bdrv_close() to qemu_cleanup(), before
 bdrv_drain_all_begin().
 Export drivers may have coroutines yielding at some point in the block
 layer, so we need to shut them down before draining the block layer,
 as otherwise they may get stuck blk_wait_while_drained().
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1900505
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20210201125032.44713-3-slp@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 1895b977f9a69419ae45cfc25805f71efae32eaf)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 block.c                              | 1 -
 qemu-nbd.c                           | 1 +
 softmmu/vl.c                         | 9 +++++++++
 storage-daemon/qemu-storage-daemon.c | 1 +
 4 files changed, 11 insertions(+), 1 deletion(-)
 diff --git a/block.c b/block.c
 index 8bfa446f9c..57c60efc7f 100644
 --- a/block.c
 +++ b/block.c
@@ -4472,7 +4472,6 @@ static void bdrv_close(BlockDriverState *bs)
 void bdrv_close_all(void)
 {
     assert(job_next(NULL) == NULL);
 -    blk_exp_close_all();
     /* Drop references from requests still in flight, such as canceled block
      * jobs whose AIO context has not been polled yet */
 diff --git a/qemu-nbd.c b/qemu-nbd.c
 index a7075c5419..1d337b7504 100644
 --- a/qemu-nbd.c
 +++ b/qemu-nbd.c
@@ -509,6 +509,7 @@ static const char *socket_activation_validate_opts(const char *device,
 static void qemu_nbd_shutdown(void)
 {
     job_cancel_sync_all();
 +    blk_exp_close_all();
     bdrv_close_all();
 }
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index 065d52e8dc..3244ee5e12 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -66,6 +66,7 @@
 #include "qemu/log.h"
 #include "sysemu/blockdev.h"
 #include "hw/block/block.h"
 +#include "block/export.h"
 #include "migration/misc.h"
 #include "migration/snapshot.h"
 #include "migration/global_state.h"
@@ -4526,6 +4527,14 @@ void qemu_cleanup(void)
      */
     migration_shutdown();
 +    /*
 +     * Close the exports before draining the block layer. The export
 +     * drivers may have coroutines yielding on it, so we need to clean
 +     * them up before the drain, as otherwise they may be get stuck in
 +     * blk_wait_while_drained().
 +     */
 +    blk_exp_close_all();
 +
     /*
      * We must cancel all block jobs while the block layer is drained,
      * or cancelling will be affected by throttling and thus may block
 diff --git a/storage-daemon/qemu-storage-daemon.c b/storage-daemon/qemu-storage-daemon.c
 index e0c87edbdd..d8d172cc60 100644
 --- a/storage-daemon/qemu-storage-daemon.c
 +++ b/storage-daemon/qemu-storage-daemon.c
@@ -314,6 +314,7 @@ int main(int argc, char *argv[])
         main_loop_wait(false);
     }
 +    blk_exp_close_all();
     bdrv_drain_all_begin();
     bdrv_close_all();
 -- 
 2.27.0
--- a/kvm-block-nbd-only-detach-existing-iochannel-from-aio_co.patch
+++ b/kvm-block-nbd-only-detach-existing-iochannel-from-aio_co.patch
@ -1,125 +0,0 @@
 From 23d161ad92d783275ad56f3acb663f7a21b809f4 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Mon, 8 Feb 2021 22:56:59 -0300
 Subject: [PATCH 01/54] block/nbd: only detach existing iochannel from
 aio_context
 RH-Author: Eric Blake <eblake@redhat.com>
 Message-id: <20210208225701.110110-2-eblake@redhat.com>
 Patchwork-id: 101005
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v4 1/3] block/nbd: only detach existing iochannel from aio_context
 Bugzilla: 1887883
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Roman Kagan <rvkagan@yandex-team.ru>
 When the reconnect in NBD client is in progress, the iochannel used for
 NBD connection doesn't exist.  Therefore an attempt to detach it from
 the aio_context of the parent BlockDriverState results in a NULL pointer
 dereference.
 The problem is triggerable, in particular, when an outgoing migration is
 about to finish, and stopping the dataplane tries to move the
 BlockDriverState from the iothread aio_context to the main loop.  If the
 NBD connection is lost before this point, and the NBD client has entered
 the reconnect procedure, QEMU crashes:
  #0  qemu_aio_coroutine_enter (ctx=0x5618056c7580, co=0x0)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/qemu-coroutine.c:109
  #1  0x00005618034b1b68 in nbd_client_attach_aio_context_bh (
      opaque=0x561805ed4c00) at /build/qemu-6MF7tq/qemu-5.0.1/block/nbd.c:164
  #2  0x000056180353116b in aio_wait_bh (opaque=0x7f60e1e63700)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/aio-wait.c:55
  #3  0x0000561803530633 in aio_bh_call (bh=0x7f60d40a7e80)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/async.c:136
  #4  aio_bh_poll (ctx=ctx@entry=0x5618056c7580)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/async.c:164
  #5  0x0000561803533e5a in aio_poll (ctx=ctx@entry=0x5618056c7580,
      blocking=blocking@entry=true)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/aio-posix.c:650
  #6  0x000056180353128d in aio_wait_bh_oneshot (ctx=0x5618056c7580,
      cb=<optimized out>, opaque=<optimized out>)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/aio-wait.c:71
  #7  0x000056180345c50a in bdrv_attach_aio_context (new_context=0x5618056c7580,
      bs=0x561805ed4c00) at /build/qemu-6MF7tq/qemu-5.0.1/block.c:6172
  #8  bdrv_set_aio_context_ignore (bs=bs@entry=0x561805ed4c00,
      new_context=new_context@entry=0x5618056c7580,
      ignore=ignore@entry=0x7f60e1e63780)
      at /build/qemu-6MF7tq/qemu-5.0.1/block.c:6237
  #9  0x000056180345c969 in bdrv_child_try_set_aio_context (
      bs=bs@entry=0x561805ed4c00, ctx=0x5618056c7580,
      ignore_child=<optimized out>, errp=<optimized out>)
      at /build/qemu-6MF7tq/qemu-5.0.1/block.c:6332
  #10 0x00005618034957db in blk_do_set_aio_context (blk=0x56180695b3f0,
      new_context=0x5618056c7580, update_root_node=update_root_node@entry=true,
      errp=errp@entry=0x0)
      at /build/qemu-6MF7tq/qemu-5.0.1/block/block-backend.c:1989
  #11 0x00005618034980bd in blk_set_aio_context (blk=<optimized out>,
      new_context=<optimized out>, errp=errp@entry=0x0)
      at /build/qemu-6MF7tq/qemu-5.0.1/block/block-backend.c:2010
  #12 0x0000561803197953 in virtio_blk_data_plane_stop (vdev=<optimized out>)
      at /build/qemu-6MF7tq/qemu-5.0.1/hw/block/dataplane/virtio-blk.c:292
  #13 0x00005618033d67bf in virtio_bus_stop_ioeventfd (bus=0x5618056d9f08)
      at /build/qemu-6MF7tq/qemu-5.0.1/hw/virtio/virtio-bus.c:245
  #14 0x00005618031c9b2e in virtio_vmstate_change (opaque=0x5618056d9f90,
      running=0, state=<optimized out>)
      at /build/qemu-6MF7tq/qemu-5.0.1/hw/virtio/virtio.c:3220
  #15 0x0000561803208bfd in vm_state_notify (running=running@entry=0,
      state=state@entry=RUN_STATE_FINISH_MIGRATE)
      at /build/qemu-6MF7tq/qemu-5.0.1/softmmu/vl.c:1275
  #16 0x0000561803155c02 in do_vm_stop (state=RUN_STATE_FINISH_MIGRATE,
      send_stop=<optimized out>) at /build/qemu-6MF7tq/qemu-5.0.1/cpus.c:1032
  #17 0x00005618033e3765 in migration_completion (s=0x5618056e6960)
      at /build/qemu-6MF7tq/qemu-5.0.1/migration/migration.c:2914
  #18 migration_iteration_run (s=0x5618056e6960)
      at /build/qemu-6MF7tq/qemu-5.0.1/migration/migration.c:3275
  #19 migration_thread (opaque=opaque@entry=0x5618056e6960)
      at /build/qemu-6MF7tq/qemu-5.0.1/migration/migration.c:3439
  #20 0x0000561803536ad6 in qemu_thread_start (args=<optimized out>)
      at /build/qemu-6MF7tq/qemu-5.0.1/util/qemu-thread-posix.c:519
  #21 0x00007f61085d06ba in start_thread ()
     from /lib/x86_64-linux-gnu/libpthread.so.0
  #22 0x00007f610830641d in sysctl () from /lib/x86_64-linux-gnu/libc.so.6
  #23 0x0000000000000000 in ?? ()
 Fix it by checking that the iochannel is non-null before trying to
 detach it from the aio_context.  If it is null, no detaching is needed,
 and it will get reattached in the proper aio_context once the connection
 is reestablished.
 Signed-off-by: Roman Kagan <rvkagan@yandex-team.ru>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210129073859.683063-2-rvkagan@yandex-team.ru>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 3b5e4db6734d30e551101c0941b2a6140862ba40)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 block/nbd.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/block/nbd.c b/block/nbd.c
 index 42536702b6..ed7b6df10b 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -234,7 +234,14 @@ static void nbd_client_detach_aio_context(BlockDriverState *bs)
     /* Timer is deleted in nbd_client_co_drain_begin() */
     assert(!s->reconnect_delay_timer);
 -    qio_channel_detach_aio_context(QIO_CHANNEL(s->ioc));
 +    /*
 +     * If reconnect is in progress we may have no ->ioc.  It will be
 +     * re-instantiated in the proper aio context once the connection is
 +     * reestablished.
 +     */
 +    if (s->ioc) {
 +        qio_channel_detach_aio_context(QIO_CHANNEL(s->ioc));
 +    }
 }
 static void nbd_client_attach_aio_context_bh(void *opaque)
 -- 
 2.27.0
--- a/kvm-block-nbd-only-enter-connection-coroutine-if-it-s-pr.patch
+++ b/kvm-block-nbd-only-enter-connection-coroutine-if-it-s-pr.patch
@ -1,124 +0,0 @@
 From ed5dbeb52152217fc7fe9023327dbacfac8b2322 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Mon, 8 Feb 2021 22:57:00 -0300
 Subject: [PATCH 02/54] block/nbd: only enter connection coroutine if it's
 present
 RH-Author: Eric Blake <eblake@redhat.com>
 Message-id: <20210208225701.110110-3-eblake@redhat.com>
 Patchwork-id: 101008
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v4 2/3] block/nbd: only enter connection coroutine if it's present
 Bugzilla: 1887883
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Roman Kagan <rvkagan@yandex-team.ru>
 When an NBD block driver state is moved from one aio_context to another
 (e.g. when doing a drain in a migration thread),
 nbd_client_attach_aio_context_bh is executed that enters the connection
 coroutine.
 However, the assumption that ->connection_co is always present here
 appears incorrect: the connection may have encountered an error other
 than -EIO in the underlying transport, and thus may have decided to quit
 rather than keep trying to reconnect, and therefore it may have
 terminated the connection coroutine.  As a result an attempt to reassign
 the client in this state (NBD_CLIENT_QUIT) to a different aio_context
 leads to a null pointer dereference:
  #0  qio_channel_detach_aio_context (ioc=0x0)
      at /build/qemu-gYtjVn/qemu-5.0.1/io/channel.c:452
  #1  0x0000562a242824b3 in bdrv_detach_aio_context (bs=0x562a268d6a00)
      at /build/qemu-gYtjVn/qemu-5.0.1/block.c:6151
  #2  bdrv_set_aio_context_ignore (bs=bs@entry=0x562a268d6a00,
      new_context=new_context@entry=0x562a260c9580,
      ignore=ignore@entry=0x7feeadc9b780)
      at /build/qemu-gYtjVn/qemu-5.0.1/block.c:6230
  #3  0x0000562a24282969 in bdrv_child_try_set_aio_context
      (bs=bs@entry=0x562a268d6a00, ctx=0x562a260c9580,
      ignore_child=<optimized out>, errp=<optimized out>)
      at /build/qemu-gYtjVn/qemu-5.0.1/block.c:6332
  #4  0x0000562a242bb7db in blk_do_set_aio_context (blk=0x562a2735d0d0,
      new_context=0x562a260c9580,
      update_root_node=update_root_node@entry=true, errp=errp@entry=0x0)
      at /build/qemu-gYtjVn/qemu-5.0.1/block/block-backend.c:1989
  #5  0x0000562a242be0bd in blk_set_aio_context (blk=<optimized out>,
      new_context=<optimized out>, errp=errp@entry=0x0)
      at /build/qemu-gYtjVn/qemu-5.0.1/block/block-backend.c:2010
  #6  0x0000562a23fbd953 in virtio_blk_data_plane_stop (vdev=<optimized
      out>)
      at /build/qemu-gYtjVn/qemu-5.0.1/hw/block/dataplane/virtio-blk.c:292
  #7  0x0000562a241fc7bf in virtio_bus_stop_ioeventfd (bus=0x562a260dbf08)
      at /build/qemu-gYtjVn/qemu-5.0.1/hw/virtio/virtio-bus.c:245
  #8  0x0000562a23fefb2e in virtio_vmstate_change (opaque=0x562a260dbf90,
      running=0, state=<optimized out>)
      at /build/qemu-gYtjVn/qemu-5.0.1/hw/virtio/virtio.c:3220
  #9  0x0000562a2402ebfd in vm_state_notify (running=running@entry=0,
      state=state@entry=RUN_STATE_FINISH_MIGRATE)
      at /build/qemu-gYtjVn/qemu-5.0.1/softmmu/vl.c:1275
  #10 0x0000562a23f7bc02 in do_vm_stop (state=RUN_STATE_FINISH_MIGRATE,
      send_stop=<optimized out>)
      at /build/qemu-gYtjVn/qemu-5.0.1/cpus.c:1032
  #11 0x0000562a24209765 in migration_completion (s=0x562a260e83a0)
      at /build/qemu-gYtjVn/qemu-5.0.1/migration/migration.c:2914
  #12 migration_iteration_run (s=0x562a260e83a0)
      at /build/qemu-gYtjVn/qemu-5.0.1/migration/migration.c:3275
  #13 migration_thread (opaque=opaque@entry=0x562a260e83a0)
      at /build/qemu-gYtjVn/qemu-5.0.1/migration/migration.c:3439
  #14 0x0000562a2435ca96 in qemu_thread_start (args=<optimized out>)
      at /build/qemu-gYtjVn/qemu-5.0.1/util/qemu-thread-posix.c:519
  #15 0x00007feed31466ba in start_thread (arg=0x7feeadc9c700)
      at pthread_create.c:333
  #16 0x00007feed2e7c41d in __GI___sysctl (name=0x0, nlen=608471908,
      oldval=0x562a2452b138, oldlenp=0x0, newval=0x562a2452c5e0
      <__func__.28102>, newlen=0)
      at ../sysdeps/unix/sysv/linux/sysctl.c:30
  #17 0x0000000000000000 in ?? ()
 Fix it by checking that the connection coroutine is non-null before
 trying to enter it.  If it is null, no entering is needed, as the
 connection is probably going down anyway.
 Signed-off-by: Roman Kagan <rvkagan@yandex-team.ru>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210129073859.683063-3-rvkagan@yandex-team.ru>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit ddde5ee769fcc84b96f879d7b94f35268f69ca3b)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 block/nbd.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)
 diff --git a/block/nbd.c b/block/nbd.c
 index ed7b6df10b..1bdba9fc49 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -249,13 +249,15 @@ static void nbd_client_attach_aio_context_bh(void *opaque)
     BlockDriverState *bs = opaque;
     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
 -    /*
 -     * The node is still drained, so we know the coroutine has yielded in
 -     * nbd_read_eof(), the only place where bs->in_flight can reach 0, or it is
 -     * entered for the first time. Both places are safe for entering the
 -     * coroutine.
 -     */
 -    qemu_aio_coroutine_enter(bs->aio_context, s->connection_co);
 +    if (s->connection_co) {
 +        /*
 +         * The node is still drained, so we know the coroutine has yielded in
 +         * nbd_read_eof(), the only place where bs->in_flight can reach 0, or
 +         * it is entered for the first time. Both places are safe for entering
 +         * the coroutine.
 +         */
 +        qemu_aio_coroutine_enter(bs->aio_context, s->connection_co);
 +    }
     bdrv_dec_in_flight(bs);
 }
 -- 
 2.27.0
--- a/kvm-config-enable-VFIO_CCW.patch
+++ b/kvm-config-enable-VFIO_CCW.patch
@ -1,42 +0,0 @@
 From f6e6416e8267d302ba5ec40c2a26bc25cc0d1d55 Mon Sep 17 00:00:00 2001
 From: Cornelia Huck <cohuck@redhat.com>
 Date: Fri, 29 Jan 2021 14:40:05 -0500
 Subject: [PATCH 5/5] config: enable VFIO_CCW
 RH-Author: Cornelia Huck <cohuck@redhat.com>
 Message-id: <20210129144005.698097-1-cohuck@redhat.com>
 Patchwork-id: 100941
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH] config: enable VFIO_CCW
 Bugzilla: 1922170
 RH-Acked-by: Alex Williamson <alex.williamson@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1922170
 BRANCH: rhel-av-8.4.0
 UPSTREAM: n/a
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=34609010
 Enable vfio-ccw in RHEL AV builds.
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 default-configs/devices/s390x-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/default-configs/devices/s390x-rh-devices.mak b/default-configs/devices/s390x-rh-devices.mak
 index c3c73fe752..08a15f3e01 100644
 --- a/default-configs/devices/s390x-rh-devices.mak
 +++ b/default-configs/devices/s390x-rh-devices.mak
@@ -9,6 +9,7 @@ CONFIG_SCSI=y
 CONFIG_TERMINAL3270=y
 CONFIG_VFIO=y
 CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 CONFIG_VFIO_PCI=y
 CONFIG_VHOST_USER=y
 CONFIG_VIRTIO_CCW=y
 -- 
 2.18.4
--- a/kvm-default-configs-Enable-vhost-user-blk.patch
+++ b/kvm-default-configs-Enable-vhost-user-blk.patch
@ -1,39 +0,0 @@
 From 5aadfd88a3438cee837d2e7e96fa0801d885d119 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 19 Feb 2021 16:14:09 -0500
 Subject: [PATCH 18/54] default-configs: Enable vhost-user-blk
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 Message-id: <20210219161409.53788-2-kwolf@redhat.com>
 Patchwork-id: 101166
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] default-configs: Enable vhost-user-blk
 Bugzilla: 1930033
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 Now that we have qemu-storage-daemon with a vhost-user-blk export,
 we want to be able to use that in guests. So enable vhost-user-blk in
 our build configuration.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 default-configs/devices/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 index e80877d4e2..993e2c1d2f 100644
 --- a/default-configs/devices/x86_64-rh-devices.mak
 +++ b/default-configs/devices/x86_64-rh-devices.mak
@@ -87,6 +87,7 @@ CONFIG_VGA=y
 CONFIG_VGA_CIRRUS=y
 CONFIG_VGA_PCI=y
 CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_VGA=y
 CONFIG_VMMOUSE=y
 -- 
 2.27.0
--- a/kvm-docs-Add-qemu-storage-daemon-1-manpage-to-meson.buil.patch
+++ b/kvm-docs-Add-qemu-storage-daemon-1-manpage-to-meson.buil.patch
@ -1,50 +0,0 @@
 From b3dbe8179b0f73d09bb90cbf92e991a187ef3534 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Tue, 16 Feb 2021 16:19:41 -0500
 Subject: [PATCH 15/54] docs: Add qemu-storage-daemon(1) manpage to meson.build
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 Message-id: <20210216161943.126728-4-kwolf@redhat.com>
 Patchwork-id: 101104
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 3/5] docs: Add qemu-storage-daemon(1) manpage to meson.build
 Bugzilla: 1901323
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Peter Maydell <peter.maydell@linaro.org>
 In commit 1982e1602d15 we added a new qemu-storage-daemon(1) manpage.
 At the moment new manpages have to be listed both in the conf.py for
 Sphinx and also in docs/meson.build for Meson. We forgot the second
 of those -- correct the omission.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20210108161416.21129-2-peter.maydell@linaro.org
 (cherry picked from commit fa56cf7e86f99d5557a4fb730e375777b89d8b50)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 docs/meson.build | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/docs/meson.build b/docs/meson.build
 index 71641b4fe0..fae9849b79 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -62,6 +62,7 @@ if build_docs
         'qemu-img.1': (have_tools ? 'man1' : ''),
         'qemu-nbd.8': (have_tools ? 'man8' : ''),
         'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
 +        'qemu-storage-daemon.1': (have_tools ? 'man1' : ''),
         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
 -- 
 2.27.0
--- a/kvm-docs-add-qemu-storage-daemon-1-man-page.patch
+++ b/kvm-docs-add-qemu-storage-daemon-1-man-page.patch
@ -1,218 +0,0 @@
 From f3831252e618e420ea24e53dbdee8eb51e8cad3e Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Tue, 16 Feb 2021 16:19:40 -0500
 Subject: [PATCH 14/54] docs: add qemu-storage-daemon(1) man page
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 Message-id: <20210216161943.126728-3-kwolf@redhat.com>
 Patchwork-id: 101102
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/5] docs: add qemu-storage-daemon(1) man page
 Bugzilla: 1901323
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Document the qemu-storage-daemon tool. Most of the command-line options
 are identical to their QEMU counterparts. Perhaps Sphinx hxtool
 integration could be extended to extract documentation for individual
 command-line options so they can be shared. For now the
 qemu-storage-daemon simply refers to the qemu(1) man page where the
 command-line options are identical.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20201209103802.350848-3-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 1982e1602d15313cd82f225e821c37733ece3404)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 docs/tools/conf.py                 |   2 +
 docs/tools/index.rst               |   1 +
 docs/tools/qemu-storage-daemon.rst | 148 +++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+)
 create mode 100644 docs/tools/qemu-storage-daemon.rst
 diff --git a/docs/tools/conf.py b/docs/tools/conf.py
 index 4760d36ff2..7072d99324 100644
 --- a/docs/tools/conf.py
 +++ b/docs/tools/conf.py
@@ -20,6 +20,8 @@ html_theme_options['description'] = \
 man_pages = [
     ('qemu-img', 'qemu-img', u'QEMU disk image utility',
      ['Fabrice Bellard'], 1),
 +    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
 +     [], 1),
     ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
      ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
     ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
 diff --git a/docs/tools/index.rst b/docs/tools/index.rst
 index b99f86c7c6..3a5829c17a 100644
 --- a/docs/tools/index.rst
 +++ b/docs/tools/index.rst
@@ -11,6 +11,7 @@ Contents:
    :maxdepth: 2
    qemu-img
 +   qemu-storage-daemon
    qemu-nbd
    qemu-pr-helper
    qemu-trace-stap
 diff --git a/docs/tools/qemu-storage-daemon.rst b/docs/tools/qemu-storage-daemon.rst
 new file mode 100644
 index 0000000000..f63627eaf6
 --- /dev/null
 +++ b/docs/tools/qemu-storage-daemon.rst
@@ -0,0 +1,148 @@
 +QEMU Storage Daemon
 +===================
 +
 +Synopsis
 +--------
 +
 +**qemu-storage-daemon** [options]
 +
 +Description
 +-----------
 +
 +qemu-storage-daemon provides disk image functionality from QEMU, qemu-img, and
 +qemu-nbd in a long-running process controlled via QMP commands without running
 +a virtual machine. It can export disk images, run block job operations, and
 +perform other disk-related operations. The daemon is controlled via a QMP
 +monitor and initial configuration from the command-line.
 +
 +The daemon offers the following subset of QEMU features:
 +
 +* Block nodes
 +* Block jobs
 +* Block exports
 +* Throttle groups
 +* Character devices
 +* Crypto and secrets
 +* QMP
 +* IOThreads
 +
 +Commands can be sent over a QEMU Monitor Protocol (QMP) connection. See the
 +:manpage:`qemu-storage-daemon-qmp-ref(7)` manual page for a description of the
 +commands.
 +
 +The daemon runs until it is stopped using the ``quit`` QMP command or
 +SIGINT/SIGHUP/SIGTERM.
 +
 +**Warning:** Never modify images in use by a running virtual machine or any
 +other process; this may destroy the image. Also, be aware that querying an
 +image that is being modified by another process may encounter inconsistent
 +state.
 +
 +Options
 +-------
 +
 +.. program:: qemu-storage-daemon
 +
 +Standard options:
 +
 +.. option:: -h, --help
 +
 +  Display help and exit
 +
 +.. option:: -V, --version
 +
 +  Display version information and exit
 +
 +.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
 +
 +  .. include:: ../qemu-option-trace.rst.inc
 +
 +.. option:: --blockdev BLOCKDEVDEF
 +
 +  is a block node definition. See the :manpage:`qemu(1)` manual page for a
 +  description of block node properties and the :manpage:`qemu-block-drivers(7)`
 +  manual page for a description of driver-specific parameters.
 +
 +.. option:: --chardev CHARDEVDEF
 +
 +  is a character device definition. See the :manpage:`qemu(1)` manual page for
 +  a description of character device properties. A common character device
 +  definition configures a UNIX domain socket::
 +
 +  --chardev socket,id=char1,path=/tmp/qmp.sock,server,nowait
 +
 +.. option:: --export [type=]nbd,id=<id>,node-name=<node-name>[,name=<export-name>][,writable=on|off][,bitmap=<name>]
 +  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=unix,addr.path=<socket-path>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
 +  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=fd,addr.str=<fd>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
 +
 +  is a block export definition. ``node-name`` is the block node that should be
 +  exported. ``writable`` determines whether or not the export allows write
 +  requests for modifying data (the default is off).
 +
 +  The ``nbd`` export type requires ``--nbd-server`` (see below). ``name`` is
 +  the NBD export name. ``bitmap`` is the name of a dirty bitmap reachable from
 +  the block node, so the NBD client can use NBD_OPT_SET_META_CONTEXT with the
 +  metadata context name "qemu:dirty-bitmap:BITMAP" to inspect the bitmap.
 +
 +  The ``vhost-user-blk`` export type takes a vhost-user socket address on which
 +  it accept incoming connections. Both
 +  ``addr.type=unix,addr.path=<socket-path>`` for UNIX domain sockets and
 +  ``addr.type=fd,addr.str=<fd>`` for file descriptor passing are supported.
 +  ``logical-block-size`` sets the logical block size in bytes (the default is
 +  512). ``num-queues`` sets the number of virtqueues (the default is 1).
 +
 +.. option:: --monitor MONITORDEF
 +
 +  is a QMP monitor definition. See the :manpage:`qemu(1)` manual page for
 +  a description of QMP monitor properties. A common QMP monitor definition
 +  configures a monitor on character device ``char1``::
 +
 +  --monitor chardev=char1
 +
 +.. option:: --nbd-server addr.type=inet,addr.host=<host>,addr.port=<port>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
 +  --nbd-server addr.type=unix,addr.path=<path>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
 +
 +  is a server for NBD exports. Both TCP and UNIX domain sockets are supported.
 +  TLS encryption can be configured using ``--object`` tls-creds-* and authz-*
 +  secrets (see below).
 +
 +  To configure an NBD server on UNIX domain socket path ``/tmp/nbd.sock``::
 +
 +  --nbd-server addr.type=unix,addr.path=/tmp/nbd.sock
 +
 +.. option:: --object help
 +  --object <type>,help
 +  --object <type>[,<property>=<value>...]
 +
 +  is a QEMU user creatable object definition. List object types with ``help``.
 +  List object properties with ``<type>,help``. See the :manpage:`qemu(1)`
 +  manual page for a description of the object properties.
 +
 +Examples
 +--------
 +Launch the daemon with QMP monitor socket ``qmp.sock`` so clients can execute
 +QMP commands::
 +
 +  $ qemu-storage-daemon \
 +      --chardev socket,path=qmp.sock,server,nowait,id=char1 \
 +      --monitor chardev=char1
 +
 +Export raw image file ``disk.img`` over NBD UNIX domain socket ``nbd.sock``::
 +
 +  $ qemu-storage-daemon \
 +      --blockdev driver=file,node-name=disk,filename=disk.img \
 +      --nbd-server addr.type=unix,addr.path=nbd.sock \
 +      --export type=nbd,id=export,node-name=disk,writable=on
 +
 +Export a qcow2 image file ``disk.qcow2`` as a vhosts-user-blk device over UNIX
 +domain socket ``vhost-user-blk.sock``::
 +
 +  $ qemu-storage-daemon \
 +      --blockdev driver=file,node-name=file,filename=disk.qcow2 \
 +      --blockdev driver=qcow2,node-name=qcow2,file=file \
 +      --export type=vhost-user-blk,id=export,addr.type=unix,addr.path=vhost-user-blk.sock,node-name=qcow2
 +
 +See also
 +--------
 +
 +:manpage:`qemu(1)`, :manpage:`qemu-block-drivers(7)`, :manpage:`qemu-storage-daemon-qmp-ref(7)`
 -- 
 2.27.0
--- a/kvm-docs-generate-qemu-storage-daemon-qmp-ref-7-man-page.patch
+++ b/kvm-docs-generate-qemu-storage-daemon-qmp-ref-7-man-page.patch
@ -1,111 +0,0 @@
 From 5425716387734e0a782ac633021cd85eb4d4b914 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Tue, 16 Feb 2021 16:19:39 -0500
 Subject: [PATCH 13/54] docs: generate qemu-storage-daemon-qmp-ref(7) man page
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 Message-id: <20210216161943.126728-2-kwolf@redhat.com>
 Patchwork-id: 101101
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/5] docs: generate qemu-storage-daemon-qmp-ref(7) man page
 Bugzilla: 1901323
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Although individual qemu-storage-daemon QMP commands are identical to
 QEMU QMP commands, qemu-storage-daemon only supports a subset of QEMU's
 QMP commands. Generate a manual page of just the commands supported by
 qemu-storage-daemon so that users know exactly what is available in
 qemu-storage-daemon.
 Add an h1 heading in storage-daemon/qapi/qapi-schema.json so that
 block-core.json is at the h2 heading level.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20201209103802.350848-2-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 23c02ace3508dba5f781ed9ecfde400e462f3a37)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 docs/interop/conf.py                         |  2 ++
 docs/interop/index.rst                       |  1 +
 docs/interop/qemu-storage-daemon-qmp-ref.rst | 13 +++++++++++++
 docs/meson.build                             |  1 +
 storage-daemon/qapi/qapi-schema.json         |  3 +++
 5 files changed, 20 insertions(+)
 create mode 100644 docs/interop/qemu-storage-daemon-qmp-ref.rst
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 index 2634ca3410..f4370aaa13 100644
 --- a/docs/interop/conf.py
 +++ b/docs/interop/conf.py
@@ -23,4 +23,6 @@ man_pages = [
      [], 7),
     ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
      [], 7),
 +    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
 +     'QEMU Storage Daemon QMP Reference Manual', [], 7),
 ]
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index cd78d679d8..95d56495f6 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -20,6 +20,7 @@ Contents:
    qemu-ga
    qemu-ga-ref
    qemu-qmp-ref
 +   qemu-storage-daemon-qmp-ref
    vhost-user
    vhost-user-gpu
    vhost-vdpa
 diff --git a/docs/interop/qemu-storage-daemon-qmp-ref.rst b/docs/interop/qemu-storage-daemon-qmp-ref.rst
 new file mode 100644
 index 0000000000..caf9dad23a
 --- /dev/null
 +++ b/docs/interop/qemu-storage-daemon-qmp-ref.rst
@@ -0,0 +1,13 @@
 +QEMU Storage Daemon QMP Reference Manual
 +========================================
 +
 +..
 +   TODO: the old Texinfo manual used to note that this manual
 +   is GPL-v2-or-later. We should make that reader-visible
 +   both here and in our Sphinx manuals more generally.
 +
 +..
 +   TODO: display the QEMU version, both here and in our Sphinx manuals
 +   more generally.
 +
 +.. qapi-doc:: storage-daemon/qapi/qapi-schema.json
 diff --git a/docs/meson.build b/docs/meson.build
 index bb8fe4c9e4..71641b4fe0 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -56,6 +56,7 @@ if build_docs
         'qemu-ga.8': (have_tools ? 'man8' : ''),
         'qemu-ga-ref.7': 'man7',
         'qemu-qmp-ref.7': 'man7',
 +        'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
     },
     'tools': {
         'qemu-img.1': (have_tools ? 'man1' : ''),
 diff --git a/storage-daemon/qapi/qapi-schema.json b/storage-daemon/qapi/qapi-schema.json
 index c6ad5ae1e3..28117c3aac 100644
 --- a/storage-daemon/qapi/qapi-schema.json
 +++ b/storage-daemon/qapi/qapi-schema.json
@@ -15,6 +15,9 @@
 { 'include': '../../qapi/pragma.json' }
 +##
 +# = Block devices
 +##
 { 'include': '../../qapi/block-core.json' }
 { 'include': '../../qapi/block-export.json' }
 { 'include': '../../qapi/char.json' }
 -- 
 2.27.0
--- a/kvm-docs-set-CONFDIR-when-running-sphinx.patch
+++ b/kvm-docs-set-CONFDIR-when-running-sphinx.patch
@ -1,56 +0,0 @@
 From 16130479cc03434a85111608d9d2b0e179dc8b98 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Mon, 8 Feb 2021 09:37:30 -0500
 Subject: [PATCH 7/7] docs: set CONFDIR when running sphinx
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
 Message-id: <20210208093730.1166952-1-marcandre.lureau@redhat.com>
 Patchwork-id: 101004
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH] docs: set CONFDIR when running sphinx
 Bugzilla: 1902537
 RH-Acked-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 From: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
 The default configuration path /etc/qemu can be overriden with configure
 options, and the generated documentation used to reflect it.
 Fixes regression introduced in commit
 f8aa24ea9a82da38370470c6bc0eaa393999edfe ("meson: sphinx-build").
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1902537
 Signed-off-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
 Message-Id: <20201201183704.299697-1-marcandre.lureau@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1902537
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=34816282
 (cherry picked from commit daf07a6714b111340fe2d0234d1a5287d6ebe0ec)
 Signed-off-by: Marc-AndrÃ© Lureau <marcandre.lureau@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 docs/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/docs/meson.build b/docs/meson.build
 index ebd85d59f9..bb8fe4c9e4 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -9,7 +9,7 @@ endif
 # Check if tools are available to build documentation.
 build_docs = false
 if sphinx_build.found()
 -  SPHINX_ARGS = [sphinx_build]
 +  SPHINX_ARGS = ['env', 'CONFDIR=' + qemu_confdir, sphinx_build]
   # If we're making warnings fatal, apply this to Sphinx runs as well
   if get_option('werror')
     SPHINX_ARGS += [ '-W' ]
 -- 
 2.18.4
--- a/kvm-failover-Caller-of-this-two-functions-already-have-p.patch
+++ b/kvm-failover-Caller-of-this-two-functions-already-have-p.patch
@ -1,121 +0,0 @@
 From 4f94bc7cc479dba60fba841608b3da74b940a26d Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:44 -0500
 Subject: [PATCH 47/54] failover: Caller of this two functions already have
 primary_dev
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-25-lvivier@redhat.com>
 Patchwork-id: 101246
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 24/27] failover: Caller of this two functions already have primary_dev
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Pass it as an argument.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-26-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 0e9a65c5b168b993b845ec2acb2568328c2353da)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 746ed3fb71..b37e9cd1d9 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3093,17 +3093,17 @@ void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
     n->netclient_type = g_strdup(type);
 }
 -static bool failover_unplug_primary(VirtIONet *n)
 +static bool failover_unplug_primary(VirtIONet *n, DeviceState *dev)
 {
     HotplugHandler *hotplug_ctrl;
     PCIDevice *pci_dev;
     Error *err = NULL;
 -    hotplug_ctrl = qdev_get_hotplug_handler(n->primary_dev);
 +    hotplug_ctrl = qdev_get_hotplug_handler(dev);
     if (hotplug_ctrl) {
 -        pci_dev = PCI_DEVICE(n->primary_dev);
 +        pci_dev = PCI_DEVICE(dev);
         pci_dev->partially_hotplugged = true;
 -        hotplug_handler_unplug_request(hotplug_ctrl, n->primary_dev, &err);
 +        hotplug_handler_unplug_request(hotplug_ctrl, dev, &err);
         if (err) {
             error_report_err(err);
             return false;
@@ -3114,30 +3114,31 @@ static bool failover_unplug_primary(VirtIONet *n)
     return true;
 }
 -static bool failover_replug_primary(VirtIONet *n, Error **errp)
 +static bool failover_replug_primary(VirtIONet *n, DeviceState *dev,
 +                                    Error **errp)
 {
     Error *err = NULL;
     HotplugHandler *hotplug_ctrl;
 -    PCIDevice *pdev = PCI_DEVICE(n->primary_dev);
 +    PCIDevice *pdev = PCI_DEVICE(dev);
     BusState *primary_bus;
     if (!pdev->partially_hotplugged) {
         return true;
     }
 -    primary_bus = n->primary_dev->parent_bus;
 +    primary_bus = dev->parent_bus;
     if (!primary_bus) {
         error_setg(errp, "virtio_net: couldn't find primary bus");
         return false;
     }
 -    qdev_set_parent_bus(n->primary_dev, primary_bus, &error_abort);
 +    qdev_set_parent_bus(dev, primary_bus, &error_abort);
     qatomic_set(&n->failover_primary_hidden, false);
 -    hotplug_ctrl = qdev_get_hotplug_handler(n->primary_dev);
 +    hotplug_ctrl = qdev_get_hotplug_handler(dev);
     if (hotplug_ctrl) {
 -        hotplug_handler_pre_plug(hotplug_ctrl, n->primary_dev, &err);
 +        hotplug_handler_pre_plug(hotplug_ctrl, dev, &err);
         if (err) {
             goto out;
         }
 -        hotplug_handler_plug(hotplug_ctrl, n->primary_dev, &err);
 +        hotplug_handler_plug(hotplug_ctrl, dev, &err);
     }
 out:
@@ -3161,7 +3162,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     }
     if (migration_in_setup(s) && !should_be_hidden) {
 -        if (failover_unplug_primary(n)) {
 +        if (failover_unplug_primary(n, n->primary_dev)) {
             vmstate_unregister(VMSTATE_IF(n->primary_dev),
                                qdev_get_vmsd(n->primary_dev),
                                n->primary_dev);
@@ -3172,7 +3173,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
         }
     } else if (migration_has_failed(s)) {
         /* We already unplugged the device let's plug it back */
 -        if (!failover_replug_primary(n, &err)) {
 +        if (!failover_replug_primary(n, n->primary_dev, &err)) {
             if (err) {
                 error_report_err(err);
             }
 -- 
 2.27.0
--- a/kvm-failover-Remove-external-partially_hotplugged-proper.patch
+++ b/kvm-failover-Remove-external-partially_hotplugged-proper.patch
@ -1,52 +0,0 @@
 From 03ad2d1426775c5c993f59512932c4bbf62206c1 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:25 -0500
 Subject: [PATCH 28/54] failover: Remove external partially_hotplugged property
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-6-lvivier@redhat.com>
 Patchwork-id: 101251
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 05/27] failover: Remove external partially_hotplugged property
 Bugzilla: 1819991
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 It was only set "once", and with the wrong value. As far as I can see,
 libvirt still don't use it.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-7-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 594d308b9314b446ed2ccc42de7b4d57ba1b7118)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 4 ----
 1 file changed, 4 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 3f658d6246..6ca85627d8 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3135,10 +3135,6 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
     }
     qdev_set_parent_bus(n->primary_dev, primary_bus, &error_abort);
     qatomic_set(&n->primary_should_be_hidden, false);
 -    if (!qemu_opt_set_bool(n->primary_device_opts,
 -                           "partially_hotplugged", true, errp)) {
 -        return false;
 -    }
     hotplug_ctrl = qdev_get_hotplug_handler(n->primary_dev);
     if (hotplug_ctrl) {
         hotplug_handler_pre_plug(hotplug_ctrl, n->primary_dev, &err);
 -- 
 2.27.0
--- a/kvm-failover-Remove-memory-leak.patch
+++ b/kvm-failover-Remove-memory-leak.patch
@ -1,60 +0,0 @@
 From e9380df03375e871de088ad5aee8fd19d6ad3794 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:32 -0500
 Subject: [PATCH 35/54] failover: Remove memory leak
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-13-lvivier@redhat.com>
 Patchwork-id: 101261
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 12/27] failover: Remove memory leak
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Two things, at this point:
 * n->primary_device_id has to be set, otherwise
  virtio_net_find_primary don't work.  So we have a leak here.
 * it has to be exactly the same that prim_dev->id because what
  qdev_find_recursive() does is just compare this two values.
 So remove the unneeded assignment and leaky bits.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-14-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 7b3dc2f8c0b817bbe78ba347130b3c99fe2c4470)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 6e5a56a230..70fa372c08 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -854,9 +854,7 @@ static DeviceState *virtio_connect_failover_devices(VirtIONet *n, Error **errp)
     Error *err = NULL;
     prim_dev = virtio_net_find_primary(n, &err);
 -    if (prim_dev) {
 -        n->primary_device_id = g_strdup(prim_dev->id);
 -    } else {
 +    if (!prim_dev) {
         error_propagate(errp, err);
     }
 -- 
 2.27.0
--- a/kvm-failover-Remove-primary_dev-member.patch
+++ b/kvm-failover-Remove-primary_dev-member.patch
@ -1,158 +0,0 @@
 From 52dce3568320900c79e34eb2093058e5c3f60aa9 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:46 -0500
 Subject: [PATCH 49/54] failover: Remove primary_dev member
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-27-lvivier@redhat.com>
 Patchwork-id: 101250
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 26/27] failover: Remove primary_dev member
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Only three uses remained, and we can remove them on that case.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-28-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 21e8709b29cd981c74565e75276ed476c954cbbf)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 55 +++++++++++++++-------------------
 include/hw/virtio/virtio-net.h |  1 -
 2 files changed, 24 insertions(+), 32 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 9203d81780..044ac95f6f 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -832,13 +832,31 @@ static char *failover_find_primary_device_id(VirtIONet *n)
     return fid.id;
 }
 +/**
 + * Find the primary device for this failover virtio-net
 + *
 + * @n: VirtIONet device
 + * @errp: returns an error if this function fails
 + */
 +static DeviceState *failover_find_primary_device(VirtIONet *n)
 +{
 +    char *id = failover_find_primary_device_id(n);
 +
 +    if (!id) {
 +        return NULL;
 +    }
 +
 +    return qdev_find_recursive(sysbus_get_default(), id);
 +}
 +
 static void failover_add_primary(VirtIONet *n, Error **errp)
 {
     Error *err = NULL;
     QemuOpts *opts;
     char *id;
 +    DeviceState *dev = failover_find_primary_device(n);
 -    if (n->primary_dev) {
 +    if (dev) {
         return;
     }
@@ -848,7 +866,7 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     }
     opts = qemu_opts_find(qemu_find_opts("device"), id);
     if (opts) {
 -        n->primary_dev = qdev_device_add(opts, &err);
 +        dev = qdev_device_add(opts, &err);
         if (err) {
             qemu_opts_del(opts);
         }
@@ -861,23 +879,6 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     error_propagate(errp, err);
 }
 -/**
 - * Find the primary device for this failover virtio-net
 - *
 - * @n: VirtIONet device
 - * @errp: returns an error if this function fails
 - */
 -static DeviceState *failover_find_primary_device(VirtIONet *n)
 -{
 -    char *id = failover_find_primary_device_id(n);
 -
 -    if (!id) {
 -        return NULL;
 -    }
 -
 -    return qdev_find_recursive(sysbus_get_default(), id);
 -}
 -
 static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
@@ -933,19 +934,9 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
 -            n->primary_dev = failover_find_primary_device(n);
 -            failover_add_primary(n, &err);
 -            if (err) {
 -                goto out_err;
 -            }
 +            warn_report_err(err);
         }
     }
 -    return;
 -
 -out_err:
 -    if (err) {
 -        warn_report_err(err);
 -    }
 }
 static int virtio_net_handle_rx_mode(VirtIONet *n, uint8_t cmd,
@@ -3420,13 +3411,15 @@ static int virtio_net_pre_save(void *opaque)
 static bool primary_unplug_pending(void *opaque)
 {
     DeviceState *dev = opaque;
 +    DeviceState *primary;
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
     VirtIONet *n = VIRTIO_NET(vdev);
     if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_STANDBY)) {
         return false;
     }
 -    return n->primary_dev ? n->primary_dev->pending_deleted_event : false;
 +    primary = failover_find_primary_device(n);
 +    return primary ? primary->pending_deleted_event : false;
 }
 static bool dev_unplug_pending(void *opaque)
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index efef64e02f..7e96d193aa 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -202,7 +202,6 @@ struct VirtIONet {
     AnnounceTimer announce_timer;
     bool needs_vnet_hdr_swap;
     bool mtu_bypass_backend;
 -    DeviceState *primary_dev;
     /* primary failover device is hidden*/
     bool failover_primary_hidden;
     bool failover;
 -- 
 2.27.0
--- a/kvm-failover-Remove-primary_device_dict.patch
+++ b/kvm-failover-Remove-primary_device_dict.patch
@ -1,96 +0,0 @@
 From 277c3c13377cc7f41d4121fdce918df3005fc063 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:31 -0500
 Subject: [PATCH 34/54] failover: Remove primary_device_dict
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-12-lvivier@redhat.com>
 Patchwork-id: 101262
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 11/27] failover: Remove primary_device_dict
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 It was only used once.  And we have there opts->id, so no need for it.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-13-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 9673a88e97d1eb428872bd261dbf56a0f3c2fd71)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 17 ++++-------------
 include/hw/virtio/virtio-net.h |  1 -
 2 files changed, 4 insertions(+), 14 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 953d5c2bc8..6e5a56a230 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3186,28 +3186,21 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
     if (!device_opts) {
         return -1;
     }
 -    n->primary_device_dict = qemu_opts_to_qdict(device_opts,
 -                                                n->primary_device_dict);
     standby_id = qemu_opt_get(device_opts, "failover_pair_id");
     if (g_strcmp0(standby_id, n->netclient_name) == 0) {
         match_found = true;
     } else {
         match_found = false;
         hide = false;
 -        n->primary_device_dict = NULL;
         goto out;
     }
     /* failover_primary_hidden is set during feature negotiation */
     hide = qatomic_read(&n->failover_primary_hidden);
 -
 -    if (n->primary_device_dict) {
 -        g_free(n->primary_device_id);
 -        n->primary_device_id = g_strdup(qdict_get_try_str(
 -                                            n->primary_device_dict, "id"));
 -        if (!n->primary_device_id) {
 -            warn_report("primary_device_id not set");
 -        }
 +    g_free(n->primary_device_id);
 +    n->primary_device_id = g_strdup(device_opts->id);
 +    if (!n->primary_device_id) {
 +        warn_report("primary_device_id not set");
     }
 out:
@@ -3396,8 +3389,6 @@ static void virtio_net_device_unrealize(DeviceState *dev)
     if (n->failover) {
         device_listener_unregister(&n->primary_listener);
         g_free(n->primary_device_id);
 -        qobject_unref(n->primary_device_dict);
 -        n->primary_device_dict = NULL;
     }
     max_queues = n->multiqueue ? n->max_queues : 1;
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index a055f39dd6..fe353d8299 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -202,7 +202,6 @@ struct VirtIONet {
     AnnounceTimer announce_timer;
     bool needs_vnet_hdr_swap;
     bool mtu_bypass_backend;
 -    QDict *primary_device_dict;
     DeviceState *primary_dev;
     char *primary_device_id;
     /* primary failover device is hidden*/
 -- 
 2.27.0
--- a/kvm-failover-Remove-primary_device_opts.patch
+++ b/kvm-failover-Remove-primary_device_opts.patch
@ -1,110 +0,0 @@
 From ec36f213983c0ea89fe8db8b44d1105df0bd3dc2 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:29 -0500
 Subject: [PATCH 32/54] failover: Remove primary_device_opts
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-10-lvivier@redhat.com>
 Patchwork-id: 101259
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 09/27] failover: Remove primary_device_opts
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 It was really only used once, in failover_add_primary().  Just search
 for it on global opts when it is needed.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-11-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 19e49bc2e984bd065719fc3595f35368b3ae87cd)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 21 +++++----------------
 include/hw/virtio/virtio-net.h |  1 -
 2 files changed, 5 insertions(+), 17 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index e334f05352..2a99b0e0f6 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -791,17 +791,17 @@ static inline uint64_t virtio_net_supported_guest_offloads(VirtIONet *n)
 static void failover_add_primary(VirtIONet *n, Error **errp)
 {
     Error *err = NULL;
 +    QemuOpts *opts;
     if (n->primary_dev) {
         return;
     }
 -    n->primary_device_opts = qemu_opts_find(qemu_find_opts("device"),
 -                                            n->primary_device_id);
 -    if (n->primary_device_opts) {
 -        n->primary_dev = qdev_device_add(n->primary_device_opts, &err);
 +    opts = qemu_opts_find(qemu_find_opts("device"), n->primary_device_id);
 +    if (opts) {
 +        n->primary_dev = qdev_device_add(opts, &err);
         if (err) {
 -            qemu_opts_del(n->primary_device_opts);
 +            qemu_opts_del(opts);
         }
     } else {
         error_setg(errp, "Primary device not found");
@@ -856,7 +856,6 @@ static DeviceState *virtio_connect_failover_devices(VirtIONet *n, Error **errp)
     prim_dev = virtio_net_find_primary(n, &err);
     if (prim_dev) {
         n->primary_device_id = g_strdup(prim_dev->id);
 -        n->primary_device_opts = prim_dev->opts;
     } else {
         error_propagate(errp, err);
     }
@@ -3113,14 +3112,6 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
     if (!pdev->partially_hotplugged) {
         return true;
     }
 -    if (!n->primary_device_opts) {
 -        n->primary_device_opts = qemu_opts_from_qdict(qemu_find_opts("device"),
 -                                                      n->primary_device_dict,
 -                                                      errp);
 -        if (!n->primary_device_opts) {
 -            return false;
 -        }
 -    }
     primary_bus = n->primary_dev->parent_bus;
     if (!primary_bus) {
         error_setg(errp, "virtio_net: couldn't find primary bus");
@@ -3211,8 +3202,6 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
         goto out;
     }
 -    n->primary_device_opts = device_opts;
 -
     /* failover_primary_hidden is set during feature negotiation */
     hide = qatomic_read(&n->failover_primary_hidden);
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index ca68be759f..7159e6c0a0 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -202,7 +202,6 @@ struct VirtIONet {
     AnnounceTimer announce_timer;
     bool needs_vnet_hdr_swap;
     bool mtu_bypass_backend;
 -    QemuOpts *primary_device_opts;
     QDict *primary_device_dict;
     DeviceState *primary_dev;
     char *primary_device_id;
 -- 
 2.27.0
--- a/kvm-failover-Remove-unused-parameter.patch
+++ b/kvm-failover-Remove-unused-parameter.patch
@ -1,68 +0,0 @@
 From 69ba4fc743b29e9e3f595c1e96596204abc1aa0e Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:24 -0500
 Subject: [PATCH 27/54] failover: Remove unused parameter
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-5-lvivier@redhat.com>
 Patchwork-id: 101243
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 04/27] failover: Remove unused parameter
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-6-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 82ceb65799855efb0db965a6ef86d81ae1c8bcd7)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 786d313330..3f658d6246 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -855,9 +855,7 @@ static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
     return dev;
 }
 -static DeviceState *virtio_connect_failover_devices(VirtIONet *n,
 -                                                    DeviceState *dev,
 -                                                    Error **errp)
 +static DeviceState *virtio_connect_failover_devices(VirtIONet *n, Error **errp)
 {
     DeviceState *prim_dev = NULL;
     Error *err = NULL;
@@ -928,7 +926,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         qatomic_set(&n->primary_should_be_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
 -            n->primary_dev = virtio_connect_failover_devices(n, n->qdev, &err);
 +            n->primary_dev = virtio_connect_failover_devices(n, &err);
             if (err) {
                 goto out_err;
             }
@@ -3164,7 +3162,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     should_be_hidden = qatomic_read(&n->primary_should_be_hidden);
     if (!n->primary_dev) {
 -        n->primary_dev = virtio_connect_failover_devices(n, n->qdev, &err);
 +        n->primary_dev = virtio_connect_failover_devices(n, &err);
         if (!n->primary_dev) {
             return;
         }
 -- 
 2.27.0
--- a/kvm-failover-Rename-bool-to-failover_primary_hidden.patch
+++ b/kvm-failover-Rename-bool-to-failover_primary_hidden.patch
@ -1,113 +0,0 @@
 From 6d228bc32fa1e6c9619dc99dc10bfa3a9116bbf0 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:27 -0500
 Subject: [PATCH 30/54] failover: Rename bool to failover_primary_hidden
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-8-lvivier@redhat.com>
 Patchwork-id: 101260
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 07/27] failover: Rename bool to failover_primary_hidden
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 You should not use passive naming variables.
 And once there, be able to search for them.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-9-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit e2bde83e23d3cfc1d90911c74500fd2e3b0b04fa)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 14 +++++++-------
 include/hw/virtio/virtio-net.h |  3 ++-
 2 files changed, 9 insertions(+), 8 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 3e82108d42..c221671852 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -916,7 +916,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
     if (virtio_has_feature(features, VIRTIO_NET_F_STANDBY)) {
         qapi_event_send_failover_negotiated(n->netclient_name);
 -        qatomic_set(&n->primary_should_be_hidden, false);
 +        qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
             n->primary_dev = virtio_connect_failover_devices(n, &err);
@@ -3127,7 +3127,7 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
         return false;
     }
     qdev_set_parent_bus(n->primary_dev, primary_bus, &error_abort);
 -    qatomic_set(&n->primary_should_be_hidden, false);
 +    qatomic_set(&n->failover_primary_hidden, false);
     hotplug_ctrl = qdev_get_hotplug_handler(n->primary_dev);
     if (hotplug_ctrl) {
         hotplug_handler_pre_plug(hotplug_ctrl, n->primary_dev, &err);
@@ -3148,7 +3148,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     bool should_be_hidden;
     Error *err = NULL;
 -    should_be_hidden = qatomic_read(&n->primary_should_be_hidden);
 +    should_be_hidden = qatomic_read(&n->failover_primary_hidden);
     if (!n->primary_dev) {
         n->primary_dev = virtio_connect_failover_devices(n, &err);
@@ -3163,7 +3163,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
                                qdev_get_vmsd(n->primary_dev),
                                n->primary_dev);
             qapi_event_send_unplug_primary(n->primary_device_id);
 -            qatomic_set(&n->primary_should_be_hidden, true);
 +            qatomic_set(&n->failover_primary_hidden, true);
         } else {
             warn_report("couldn't unplug primary device");
         }
@@ -3213,8 +3213,8 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
     n->primary_device_opts = device_opts;
 -    /* primary_should_be_hidden is set during feature negotiation */
 -    hide = qatomic_read(&n->primary_should_be_hidden);
 +    /* failover_primary_hidden is set during feature negotiation */
 +    hide = qatomic_read(&n->failover_primary_hidden);
     if (n->primary_device_dict) {
         g_free(n->primary_device_id);
@@ -3271,7 +3271,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     if (n->failover) {
         n->primary_listener.should_be_hidden =
             virtio_net_primary_should_be_hidden;
 -        qatomic_set(&n->primary_should_be_hidden, true);
 +        qatomic_set(&n->failover_primary_hidden, true);
         device_listener_register(&n->primary_listener);
         n->migration_state.notify = virtio_net_migration_state_notifier;
         add_migration_state_change_notifier(&n->migration_state);
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index c8da637d40..ca68be759f 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -207,7 +207,8 @@ struct VirtIONet {
     DeviceState *primary_dev;
     char *primary_device_id;
     char *standby_id;
 -    bool primary_should_be_hidden;
 +    /* primary failover device is hidden*/
 +    bool failover_primary_hidden;
     bool failover;
     DeviceListener primary_listener;
     Notifier migration_state;
 -- 
 2.27.0
--- a/kvm-failover-Rename-function-to-hide_device.patch
+++ b/kvm-failover-Rename-function-to-hide_device.patch
@ -1,127 +0,0 @@
 From 1fbde79ae60990ff0439f3f3bb060f7d723e4910 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:35 -0500
 Subject: [PATCH 38/54] failover: Rename function to hide_device()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-16-lvivier@redhat.com>
 Patchwork-id: 101264
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 15/27] failover: Rename function to hide_device()
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 You should not use pasive.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-17-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit b91ad981b867e15171234efc3f2ab4074d377cef)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/qdev.c         |  4 ++--
 hw/net/virtio-net.c    |  7 +++----
 include/hw/qdev-core.h | 28 +++++++++++++++-------------
 3 files changed, 20 insertions(+), 19 deletions(-)
 diff --git a/hw/core/qdev.c b/hw/core/qdev.c
 index 8f4b8f3cc1..cbdff0b6c6 100644
 --- a/hw/core/qdev.c
 +++ b/hw/core/qdev.c
@@ -217,8 +217,8 @@ bool qdev_should_hide_device(QemuOpts *opts)
     DeviceListener *listener;
     QTAILQ_FOREACH(listener, &device_listeners, link) {
 -        if (listener->should_be_hidden) {
 -            if (listener->should_be_hidden(listener, opts)) {
 +        if (listener->hide_device) {
 +            if (listener->hide_device(listener, opts)) {
                 return true;
             }
         }
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 9f12d33da0..747614ff2a 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3161,8 +3161,8 @@ static void virtio_net_migration_state_notifier(Notifier *notifier, void *data)
     virtio_net_handle_migration_primary(n, s);
 }
 -static bool virtio_net_primary_should_be_hidden(DeviceListener *listener,
 -                                                QemuOpts *device_opts)
 +static bool failover_hide_primary_device(DeviceListener *listener,
 +                                         QemuOpts *device_opts)
 {
     VirtIONet *n = container_of(listener, VirtIONet, primary_listener);
     bool hide;
@@ -3220,8 +3220,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     }
     if (n->failover) {
 -        n->primary_listener.should_be_hidden =
 -            virtio_net_primary_should_be_hidden;
 +        n->primary_listener.hide_device = failover_hide_primary_device;
         qatomic_set(&n->failover_primary_hidden, true);
         device_listener_register(&n->primary_listener);
         n->migration_state.notify = virtio_net_migration_state_notifier;
 diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
 index 250f4edef6..6ac86db44e 100644
 --- a/include/hw/qdev-core.h
 +++ b/include/hw/qdev-core.h
@@ -81,16 +81,17 @@ typedef void (*BusUnrealize)(BusState *bus);
  * </note>
  *
  * # Hiding a device #
 - * To hide a device, a DeviceListener function should_be_hidden() needs to
 + * To hide a device, a DeviceListener function hide_device() needs to
  * be registered.
 - * It can be used to defer adding a device and therefore hide it from the
 - * guest. The handler registering to this DeviceListener can save the QOpts
 - * passed to it for re-using it later and must return that it wants the device
 - * to be/remain hidden or not. When the handler function decides the device
 - * shall not be hidden it will be added in qdev_device_add() and
 - * realized as any other device. Otherwise qdev_device_add() will return early
 - * without adding the device. The guest will not see a "hidden" device
 - * until it was marked don't hide and qdev_device_add called again.
 + * It can be used to defer adding a device and therefore hide it from
 + * the guest. The handler registering to this DeviceListener can save
 + * the QOpts passed to it for re-using it later. It must return if it
 + * wants the device to be hidden or visible. When the handler function
 + * decides the device shall be visible it will be added with
 + * qdev_device_add() and realized as any other device. Otherwise
 + * qdev_device_add() will return early without adding the device. The
 + * guest will not see a "hidden" device until it was marked visible
 + * and qdev_device_add called again.
  *
  */
 struct DeviceClass {
@@ -196,11 +197,12 @@ struct DeviceListener {
     void (*realize)(DeviceListener *listener, DeviceState *dev);
     void (*unrealize)(DeviceListener *listener, DeviceState *dev);
     /*
 -     * This callback is called upon init of the DeviceState and allows to
 -     * inform qdev that a device should be hidden, depending on the device
 -     * opts, for example, to hide a standby device.
 +     * This callback is called upon init of the DeviceState and
 +     * informs qdev if a device should be visible or hidden.  We can
 +     * hide a failover device depending for example on the device
 +     * opts.
      */
 -    bool (*should_be_hidden)(DeviceListener *listener, QemuOpts *device_opts);
 +    bool (*hide_device)(DeviceListener *listener, QemuOpts *device_opts);
     QTAILQ_ENTRY(DeviceListener) link;
 };
 -- 
 2.27.0
--- a/kvm-failover-Rename-to-failover_find_primary_device.patch
+++ b/kvm-failover-Rename-to-failover_find_primary_device.patch
@ -1,77 +0,0 @@
 From e1ea7c178c1762dca02e2c85f57ccfad1063c753 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:37 -0500
 Subject: [PATCH 40/54] failover: Rename to failover_find_primary_device()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-18-lvivier@redhat.com>
 Patchwork-id: 101263
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 17/27] failover: Rename to failover_find_primary_device()
 Bugzilla: 1819991
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 This commit:
 * Rename them to failover_find_primary_devices() so
  - it starts with failover_
  - it don't connect anything, just find the primary device
 * Create documentation for the function
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-19-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 85d3b93196e43c4493c118aa9e3a82fe657636b5)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index c6200b924e..ff82f1017d 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -826,7 +826,13 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
     return ret;
 }
 -static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
 +/**
 + * Find the primary device for this failover virtio-net
 + *
 + * @n: VirtIONet device
 + * @errp: returns an error if this function fails
 + */
 +static DeviceState *failover_find_primary_device(VirtIONet *n, Error **errp)
 {
     Error *err = NULL;
@@ -891,7 +897,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
 -            n->primary_dev = virtio_net_find_primary(n, &err);
 +            n->primary_dev = failover_find_primary_device(n, &err);
             if (err) {
                 goto out_err;
             }
@@ -3115,7 +3121,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     should_be_hidden = qatomic_read(&n->failover_primary_hidden);
     if (!n->primary_dev) {
 -        n->primary_dev = virtio_net_find_primary(n, &err);
 +        n->primary_dev = failover_find_primary_device(n, &err);
         if (!n->primary_dev) {
             return;
         }
 -- 
 2.27.0
--- a/kvm-failover-Use-always-atomics-for-primary_should_be_hi.patch
+++ b/kvm-failover-Use-always-atomics-for-primary_should_be_hi.patch
@ -1,49 +0,0 @@
 From be9147ddedc35a458b976a71fd947634ab71bb44 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:22 -0500
 Subject: [PATCH 25/54] failover: Use always atomics for
 primary_should_be_hidden
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-3-lvivier@redhat.com>
 Patchwork-id: 101247
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 02/27] failover: Use always atomics for primary_should_be_hidden
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-4-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 587f2fcb93eddf69736e00731a2da018a0e0a726)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 1011a524bf..a0fa63e7cb 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3136,7 +3136,7 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
         return false;
     }
     qdev_set_parent_bus(n->primary_dev, n->primary_bus, &error_abort);
 -    n->primary_should_be_hidden = false;
 +    qatomic_set(&n->primary_should_be_hidden, false);
     if (!qemu_opt_set_bool(n->primary_device_opts,
                            "partially_hotplugged", true, errp)) {
         return false;
 -- 
 2.27.0
--- a/kvm-failover-We-don-t-need-to-cache-primary_device_id-an.patch
+++ b/kvm-failover-We-don-t-need-to-cache-primary_device_id-an.patch
@ -1,128 +0,0 @@
 From 845e4811506c58b8f1f4cfcb183994f1d0f4d66b Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:43 -0500
 Subject: [PATCH 46/54] failover: We don't need to cache primary_device_id
 anymore
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-24-lvivier@redhat.com>
 Patchwork-id: 101258
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 23/27] failover: We don't need to cache primary_device_id anymore
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-25-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 3abad4a221e050d43fa8540677b285057642baaf)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 20 ++++++++++----------
 include/hw/virtio/virtio-net.h |  1 -
 2 files changed, 10 insertions(+), 11 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 2c502c13fd..746ed3fb71 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -824,6 +824,7 @@ static char *failover_find_primary_device_id(VirtIONet *n)
     Error *err = NULL;
     FailoverId fid;
 +    fid.n = n;
     if (!qemu_opts_foreach(qemu_find_opts("device"),
                            failover_set_primary, &fid, &err)) {
         return NULL;
@@ -835,12 +836,17 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
 {
     Error *err = NULL;
     QemuOpts *opts;
 +    char *id;
     if (n->primary_dev) {
         return;
     }
 -    opts = qemu_opts_find(qemu_find_opts("device"), n->primary_device_id);
 +    id = failover_find_primary_device_id(n);
 +    if (!id) {
 +        return;
 +    }
 +    opts = qemu_opts_find(qemu_find_opts("device"), id);
     if (opts) {
         n->primary_dev = qdev_device_add(opts, &err);
         if (err) {
@@ -868,9 +874,8 @@ static DeviceState *failover_find_primary_device(VirtIONet *n)
     if (!id) {
         return NULL;
     }
 -    n->primary_device_id = g_strdup(id);
 -    return qdev_find_recursive(sysbus_get_default(), n->primary_device_id);
 +    return qdev_find_recursive(sysbus_get_default(), id);
 }
 static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
@@ -3160,7 +3165,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
             vmstate_unregister(VMSTATE_IF(n->primary_dev),
                                qdev_get_vmsd(n->primary_dev),
                                n->primary_dev);
 -            qapi_event_send_unplug_primary(n->primary_device_id);
 +            qapi_event_send_unplug_primary(n->primary_dev->id);
             qatomic_set(&n->failover_primary_hidden, true);
         } else {
             warn_report("couldn't unplug primary device");
@@ -3186,7 +3191,6 @@ static bool failover_hide_primary_device(DeviceListener *listener,
                                          QemuOpts *device_opts)
 {
     VirtIONet *n = container_of(listener, VirtIONet, primary_listener);
 -    bool hide;
     const char *standby_id;
     if (!device_opts) {
@@ -3198,10 +3202,7 @@ static bool failover_hide_primary_device(DeviceListener *listener,
     }
     /* failover_primary_hidden is set during feature negotiation */
 -    hide = qatomic_read(&n->failover_primary_hidden);
 -    g_free(n->primary_device_id);
 -    n->primary_device_id = g_strdup(device_opts->id);
 -    return hide;
 +    return qatomic_read(&n->failover_primary_hidden);
 }
 static void virtio_net_device_realize(DeviceState *dev, Error **errp)
@@ -3378,7 +3379,6 @@ static void virtio_net_device_unrealize(DeviceState *dev)
     if (n->failover) {
         device_listener_unregister(&n->primary_listener);
 -        g_free(n->primary_device_id);
     }
     max_queues = n->multiqueue ? n->max_queues : 1;
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index fe353d8299..efef64e02f 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -203,7 +203,6 @@ struct VirtIONet {
     bool needs_vnet_hdr_swap;
     bool mtu_bypass_backend;
     DeviceState *primary_dev;
 -    char *primary_device_id;
     /* primary failover device is hidden*/
     bool failover_primary_hidden;
     bool failover;
 -- 
 2.27.0
--- a/kvm-failover-fix-indentantion.patch
+++ b/kvm-failover-fix-indentantion.patch
@ -1,171 +0,0 @@
 From 619e58f19e3e20c4144eb1259ce2f338d09176c1 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:21 -0500
 Subject: [PATCH 24/54] failover: fix indentantion
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-2-lvivier@redhat.com>
 Patchwork-id: 101240
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 01/27] failover: fix indentantion
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Once there, remove not needed cast.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-3-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 1c775d65d4bff3a5a9876e398b2e689bc45aa1f7)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c    | 33 +++++++++++++++------------------
 softmmu/qdev-monitor.c |  4 ++--
 2 files changed, 17 insertions(+), 20 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 9179013ac4..1011a524bf 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -797,7 +797,7 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     }
     n->primary_device_opts = qemu_opts_find(qemu_find_opts("device"),
 -            n->primary_device_id);
 +                                            n->primary_device_id);
     if (n->primary_device_opts) {
         n->primary_dev = qdev_device_add(n->primary_device_opts, &err);
         if (err) {
@@ -814,9 +814,9 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     } else {
         error_setg(errp, "Primary device not found");
         error_append_hint(errp, "Virtio-net failover will not work. Make "
 -            "sure primary device has parameter"
 -            " failover_pair_id=<virtio-net-id>\n");
 -}
 +                          "sure primary device has parameter"
 +                          " failover_pair_id=<virtio-net-id>\n");
 +    }
     error_propagate(errp, err);
 }
@@ -824,7 +824,6 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
 {
     VirtIONet *n = opaque;
     int ret = 0;
 -
     const char *standby_id = qemu_opt_get(opts, "failover_pair_id");
     if (standby_id != NULL && (g_strcmp0(standby_id, n->netclient_name) == 0)) {
@@ -841,14 +840,14 @@ static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
     Error *err = NULL;
     if (qemu_opts_foreach(qemu_find_opts("device"),
 -                         is_my_primary, n, &err)) {
 +                          is_my_primary, n, &err)) {
         if (err) {
             error_propagate(errp, err);
             return NULL;
         }
         if (n->primary_device_id) {
             dev = qdev_find_recursive(sysbus_get_default(),
 -                    n->primary_device_id);
 +                                      n->primary_device_id);
         } else {
             error_setg(errp, "Primary device id not found");
             return NULL;
@@ -857,8 +856,6 @@ static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
     return dev;
 }
 -
 -
 static DeviceState *virtio_connect_failover_devices(VirtIONet *n,
                                                     DeviceState *dev,
                                                     Error **errp)
@@ -3126,9 +3123,9 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
         return true;
     }
     if (!n->primary_device_opts) {
 -        n->primary_device_opts = qemu_opts_from_qdict(
 -                qemu_find_opts("device"),
 -                n->primary_device_dict, errp);
 +        n->primary_device_opts = qemu_opts_from_qdict(qemu_find_opts("device"),
 +                                                      n->primary_device_dict,
 +                                                      errp);
         if (!n->primary_device_opts) {
             return false;
         }
@@ -3176,8 +3173,8 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     if (migration_in_setup(s) && !should_be_hidden) {
         if (failover_unplug_primary(n)) {
             vmstate_unregister(VMSTATE_IF(n->primary_dev),
 -                    qdev_get_vmsd(n->primary_dev),
 -                    n->primary_dev);
 +                               qdev_get_vmsd(n->primary_dev),
 +                               n->primary_dev);
             qapi_event_send_unplug_primary(n->primary_device_id);
             qatomic_set(&n->primary_should_be_hidden, true);
         } else {
@@ -3201,7 +3198,7 @@ static void virtio_net_migration_state_notifier(Notifier *notifier, void *data)
 }
 static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
 -            QemuOpts *device_opts)
 +                                               QemuOpts *device_opts)
 {
     VirtIONet *n = container_of(listener, VirtIONet, primary_listener);
     bool match_found = false;
@@ -3211,11 +3208,11 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
         return -1;
     }
     n->primary_device_dict = qemu_opts_to_qdict(device_opts,
 -            n->primary_device_dict);
 +                                                n->primary_device_dict);
     if (n->primary_device_dict) {
         g_free(n->standby_id);
         n->standby_id = g_strdup(qdict_get_try_str(n->primary_device_dict,
 -                    "failover_pair_id"));
 +                                                   "failover_pair_id"));
     }
     if (g_strcmp0(n->standby_id, n->netclient_name) == 0) {
         match_found = true;
@@ -3235,7 +3232,7 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
     if (n->primary_device_dict) {
         g_free(n->primary_device_id);
         n->primary_device_id = g_strdup(qdict_get_try_str(
 -                    n->primary_device_dict, "id"));
 +                                            n->primary_device_dict, "id"));
         if (!n->primary_device_id) {
             warn_report("primary_device_id not set");
         }
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index bf79d0bbcd..a25f5d612c 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -573,10 +573,10 @@ void qdev_set_id(DeviceState *dev, const char *id)
 }
 static int is_failover_device(void *opaque, const char *name, const char *value,
 -                        Error **errp)
 +                              Error **errp)
 {
     if (strcmp(name, "failover_pair_id") == 0) {
 -        QemuOpts *opts = (QemuOpts *)opaque;
 +        QemuOpts *opts = opaque;
         if (qdev_should_hide_device(opts)) {
             return 1;
 -- 
 2.27.0
--- a/kvm-failover-g_strcmp0-knows-how-to-handle-NULL.patch
+++ b/kvm-failover-g_strcmp0-knows-how-to-handle-NULL.patch
@ -1,48 +0,0 @@
 From 97b7137652441a3d458f3d9f7bc326047de185c3 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:28 -0500
 Subject: [PATCH 31/54] failover: g_strcmp0() knows how to handle NULL
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-9-lvivier@redhat.com>
 Patchwork-id: 101249
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 08/27] failover: g_strcmp0() knows how to handle NULL
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-10-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 518eda9fda49da910d47f5baf66a1c0d1d30cebd)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index c221671852..e334f05352 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -818,7 +818,7 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
     int ret = 0;
     const char *standby_id = qemu_opt_get(opts, "failover_pair_id");
 -    if (standby_id != NULL && (g_strcmp0(standby_id, n->netclient_name) == 0)) {
 +    if (g_strcmp0(standby_id, n->netclient_name) == 0) {
         n->primary_device_id = g_strdup(opts->id);
         ret = 1;
     }
 -- 
 2.27.0
--- a/kvm-failover-make-sure-that-id-always-exist.patch
+++ b/kvm-failover-make-sure-that-id-always-exist.patch
@ -1,68 +0,0 @@
 From 06c77533c61f65886bf0a9236d8f13085b2f3e51 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:40 -0500
 Subject: [PATCH 43/54] failover: make sure that id always exist
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-21-lvivier@redhat.com>
 Patchwork-id: 101257
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 20/27] failover: make sure that id always exist
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 We check that it exist at device creation time, so we don't have to
 check anywhere else.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-22-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit fec037c1e2da0a7ea54eabce65cc14d461fdc5eb)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c    | 3 ---
 softmmu/qdev-monitor.c | 4 ++++
 2 files changed, 4 insertions(+), 3 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index ff82f1017d..c708c03cf6 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3173,9 +3173,6 @@ static bool failover_hide_primary_device(DeviceListener *listener,
     hide = qatomic_read(&n->failover_primary_hidden);
     g_free(n->primary_device_id);
     n->primary_device_id = g_strdup(device_opts->id);
 -    if (!n->primary_device_id) {
 -        warn_report("primary_device_id not set");
 -    }
     return hide;
 }
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index 0e10f0466f..301089eaea 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -613,6 +613,10 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
     }
     if (qemu_opt_get(opts, "failover_pair_id")) {
 +        if (!opts->id) {
 +            error_setg(errp, "Device with failover_pair_id don't have id");
 +            return NULL;
 +        }
         if (qdev_should_hide_device(opts)) {
             if (bus && !qbus_is_hotpluggable(bus)) {
                 error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
 -- 
 2.27.0
--- a/kvm-failover-primary-bus-is-only-used-once-and-where-it-.patch
+++ b/kvm-failover-primary-bus-is-only-used-once-and-where-it-.patch
@ -1,87 +0,0 @@
 From 0c0190ed0d933a6900230427c374e4b93faab73b Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:23 -0500
 Subject: [PATCH 26/54] failover: primary bus is only used once, and where it
 is set
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-4-lvivier@redhat.com>
 Patchwork-id: 101245
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 03/27] failover: primary bus is only used once, and where it is set
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Just remove the struct member.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-5-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 78274682b79d48e8de76c817c67c3cfbb76dc2ee)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 8 ++++----
 include/hw/virtio/virtio-net.h | 1 -
 2 files changed, 4 insertions(+), 5 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index a0fa63e7cb..786d313330 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -804,7 +804,6 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
             qemu_opts_del(n->primary_device_opts);
         }
         if (n->primary_dev) {
 -            n->primary_bus = n->primary_dev->parent_bus;
             if (err) {
                 qdev_unplug(n->primary_dev, &err);
                 qdev_set_id(n->primary_dev, "");
@@ -3118,6 +3117,7 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
     Error *err = NULL;
     HotplugHandler *hotplug_ctrl;
     PCIDevice *pdev = PCI_DEVICE(n->primary_dev);
 +    BusState *primary_bus;
     if (!pdev->partially_hotplugged) {
         return true;
@@ -3130,12 +3130,12 @@ static bool failover_replug_primary(VirtIONet *n, Error **errp)
             return false;
         }
     }
 -    n->primary_bus = n->primary_dev->parent_bus;
 -    if (!n->primary_bus) {
 +    primary_bus = n->primary_dev->parent_bus;
 +    if (!primary_bus) {
         error_setg(errp, "virtio_net: couldn't find primary bus");
         return false;
     }
 -    qdev_set_parent_bus(n->primary_dev, n->primary_bus, &error_abort);
 +    qdev_set_parent_bus(n->primary_dev, primary_bus, &error_abort);
     qatomic_set(&n->primary_should_be_hidden, false);
     if (!qemu_opt_set_bool(n->primary_device_opts,
                            "partially_hotplugged", true, errp)) {
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index f4852ac27b..c8da637d40 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -205,7 +205,6 @@ struct VirtIONet {
     QemuOpts *primary_device_opts;
     QDict *primary_device_dict;
     DeviceState *primary_dev;
 -    BusState *primary_bus;
     char *primary_device_id;
     char *standby_id;
     bool primary_should_be_hidden;
 -- 
 2.27.0
--- a/kvm-failover-qdev_device_add-returns-err-or-dev-set.patch
+++ b/kvm-failover-qdev_device_add-returns-err-or-dev-set.patch
@ -1,55 +0,0 @@
 From 63f2415d2cee7bcf24e7f3dc515c5155731071e6 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:26 -0500
 Subject: [PATCH 29/54] failover: qdev_device_add() returns err or dev set
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-7-lvivier@redhat.com>
 Patchwork-id: 101252
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 06/27] failover: qdev_device_add() returns err or dev set
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Never both.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-8-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 3d1c7a9782d19052505aabc8f2c134ccd6f3f3fb)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 7 -------
 1 file changed, 7 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 6ca85627d8..3e82108d42 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -803,13 +803,6 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
         if (err) {
             qemu_opts_del(n->primary_device_opts);
         }
 -        if (n->primary_dev) {
 -            if (err) {
 -                qdev_unplug(n->primary_dev, &err);
 -                qdev_set_id(n->primary_dev, "");
 -
 -            }
 -        }
     } else {
         error_setg(errp, "Primary device not found");
         error_append_hint(errp, "Virtio-net failover will not work. Make "
 -- 
 2.27.0
--- a/kvm-failover-remove-failover_find_primary_device-error-p.patch
+++ b/kvm-failover-remove-failover_find_primary_device-error-p.patch
@ -1,72 +0,0 @@
 From 96883a1a05766ac6c1a2a064f40aab6c0bd54861 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:41 -0500
 Subject: [PATCH 44/54] failover: remove failover_find_primary_device() error
 parameter
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-22-lvivier@redhat.com>
 Patchwork-id: 101265
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 21/27] failover: remove failover_find_primary_device() error parameter
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 It can never give one error.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-23-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 0a0a27d66bcb275e5b984d8758880a7eff75464e)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index c708c03cf6..b994796734 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -832,7 +832,7 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
  * @n: VirtIONet device
  * @errp: returns an error if this function fails
  */
 -static DeviceState *failover_find_primary_device(VirtIONet *n, Error **errp)
 +static DeviceState *failover_find_primary_device(VirtIONet *n)
 {
     Error *err = NULL;
@@ -897,10 +897,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
 -            n->primary_dev = failover_find_primary_device(n, &err);
 -            if (err) {
 -                goto out_err;
 -            }
 +            n->primary_dev = failover_find_primary_device(n);
             failover_add_primary(n, &err);
             if (err) {
                 goto out_err;
@@ -3121,7 +3118,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     should_be_hidden = qatomic_read(&n->failover_primary_hidden);
     if (!n->primary_dev) {
 -        n->primary_dev = failover_find_primary_device(n, &err);
 +        n->primary_dev = failover_find_primary_device(n);
         if (!n->primary_dev) {
             return;
         }
 -- 
 2.27.0
--- a/kvm-failover-remove-standby_id-variable.patch
+++ b/kvm-failover-remove-standby_id-variable.patch
@ -1,89 +0,0 @@
 From cead8b9c03911360666ac3bb56d7b1db068ade36 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:30 -0500
 Subject: [PATCH 33/54] failover: remove standby_id variable
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-11-lvivier@redhat.com>
 Patchwork-id: 101248
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 10/27] failover: remove standby_id variable
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 We can calculate it, and we only use it once anyways.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-12-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 4f0303aed87f83715055e558176046a8a3d9b987)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c            | 11 +++--------
 include/hw/virtio/virtio-net.h |  1 -
 2 files changed, 3 insertions(+), 9 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 2a99b0e0f6..953d5c2bc8 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3181,23 +3181,19 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
     VirtIONet *n = container_of(listener, VirtIONet, primary_listener);
     bool match_found = false;
     bool hide = false;
 +    const char *standby_id;
     if (!device_opts) {
         return -1;
     }
     n->primary_device_dict = qemu_opts_to_qdict(device_opts,
                                                 n->primary_device_dict);
 -    if (n->primary_device_dict) {
 -        g_free(n->standby_id);
 -        n->standby_id = g_strdup(qdict_get_try_str(n->primary_device_dict,
 -                                                   "failover_pair_id"));
 -    }
 -    if (g_strcmp0(n->standby_id, n->netclient_name) == 0) {
 +    standby_id = qemu_opt_get(device_opts, "failover_pair_id");
 +    if (g_strcmp0(standby_id, n->netclient_name) == 0) {
         match_found = true;
     } else {
         match_found = false;
         hide = false;
 -        g_free(n->standby_id);
         n->primary_device_dict = NULL;
         goto out;
     }
@@ -3400,7 +3396,6 @@ static void virtio_net_device_unrealize(DeviceState *dev)
     if (n->failover) {
         device_listener_unregister(&n->primary_listener);
         g_free(n->primary_device_id);
 -        g_free(n->standby_id);
         qobject_unref(n->primary_device_dict);
         n->primary_device_dict = NULL;
     }
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index 7159e6c0a0..a055f39dd6 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -205,7 +205,6 @@ struct VirtIONet {
     QDict *primary_device_dict;
     DeviceState *primary_dev;
     char *primary_device_id;
 -    char *standby_id;
     /* primary failover device is hidden*/
     bool failover_primary_hidden;
     bool failover;
 -- 
 2.27.0
--- a/kvm-failover-should_be_hidden-should-take-a-bool.patch
+++ b/kvm-failover-should_be_hidden-should-take-a-bool.patch
@ -1,144 +0,0 @@
 From 8dadc3183e8e75e47b5f5e39823b9eaf950cf4fe Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:34 -0500
 Subject: [PATCH 37/54] failover: should_be_hidden() should take a bool
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-15-lvivier@redhat.com>
 Patchwork-id: 101241
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 14/27] failover: should_be_hidden() should take a bool
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 We didn't use at all the -1 value, and we don't really care.  It was
 only used for the cases when this is not the device that we are
 searching for.  And in that case we should not hide the device.
 Once there, simplify virtio-Snet_primary_should_be_hidden.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-16-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 89631fed27bd76b0292d8b2a78291ea96185c87d)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/qdev.c         | 19 +++++--------------
 hw/net/virtio-net.c    | 27 +++++++--------------------
 include/hw/qdev-core.h |  2 +-
 3 files changed, 13 insertions(+), 35 deletions(-)
 diff --git a/hw/core/qdev.c b/hw/core/qdev.c
 index 262bca716f..8f4b8f3cc1 100644
 --- a/hw/core/qdev.c
 +++ b/hw/core/qdev.c
@@ -214,26 +214,17 @@ void device_listener_unregister(DeviceListener *listener)
 bool qdev_should_hide_device(QemuOpts *opts)
 {
 -    int rc = -1;
     DeviceListener *listener;
     QTAILQ_FOREACH(listener, &device_listeners, link) {
 -       if (listener->should_be_hidden) {
 -            /*
 -             * should_be_hidden_will return
 -             *  1 if device matches opts and it should be hidden
 -             *  0 if device matches opts and should not be hidden
 -             *  -1 if device doesn't match ops
 -             */
 -            rc = listener->should_be_hidden(listener, opts);
 -        }
 -
 -        if (rc > 0) {
 -            break;
 +        if (listener->should_be_hidden) {
 +            if (listener->should_be_hidden(listener, opts)) {
 +                return true;
 +            }
         }
     }
 -    return rc > 0;
 +    return false;
 }
 void qdev_set_legacy_instance_id(DeviceState *dev, int alias_id,
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 881907d1bd..9f12d33da0 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3161,24 +3161,19 @@ static void virtio_net_migration_state_notifier(Notifier *notifier, void *data)
     virtio_net_handle_migration_primary(n, s);
 }
 -static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
 -                                               QemuOpts *device_opts)
 +static bool virtio_net_primary_should_be_hidden(DeviceListener *listener,
 +                                                QemuOpts *device_opts)
 {
     VirtIONet *n = container_of(listener, VirtIONet, primary_listener);
 -    bool match_found = false;
 -    bool hide = false;
 +    bool hide;
     const char *standby_id;
     if (!device_opts) {
 -        return -1;
 +        return false;
     }
     standby_id = qemu_opt_get(device_opts, "failover_pair_id");
 -    if (g_strcmp0(standby_id, n->netclient_name) == 0) {
 -        match_found = true;
 -    } else {
 -        match_found = false;
 -        hide = false;
 -        goto out;
 +    if (g_strcmp0(standby_id, n->netclient_name) != 0) {
 +        return false;
     }
     /* failover_primary_hidden is set during feature negotiation */
@@ -3188,15 +3183,7 @@ static int virtio_net_primary_should_be_hidden(DeviceListener *listener,
     if (!n->primary_device_id) {
         warn_report("primary_device_id not set");
     }
 -
 -out:
 -    if (match_found && hide) {
 -        return 1;
 -    } else if (match_found && !hide) {
 -        return 0;
 -    } else {
 -        return -1;
 -    }
 +    return hide;
 }
 static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
 index 5e737195b5..250f4edef6 100644
 --- a/include/hw/qdev-core.h
 +++ b/include/hw/qdev-core.h
@@ -200,7 +200,7 @@ struct DeviceListener {
      * inform qdev that a device should be hidden, depending on the device
      * opts, for example, to hide a standby device.
      */
 -    int (*should_be_hidden)(DeviceListener *listener, QemuOpts *device_opts);
 +    bool (*should_be_hidden)(DeviceListener *listener, QemuOpts *device_opts);
     QTAILQ_ENTRY(DeviceListener) link;
 };
 -- 
 2.27.0
--- a/kvm-failover-simplify-failover_unplug_primary.patch
+++ b/kvm-failover-simplify-failover_unplug_primary.patch
@ -1,86 +0,0 @@
 From cf70ee739171e208243b5b06a57d2517df8c3d91 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:45 -0500
 Subject: [PATCH 48/54] failover: simplify failover_unplug_primary
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-26-lvivier@redhat.com>
 Patchwork-id: 101242
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 25/27] failover: simplify failover_unplug_primary
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 We can calculate device just once.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-27-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 07a5d816d50f5f876d5fcd43724a6ff17cf59a4f)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index b37e9cd1d9..9203d81780 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3146,34 +3146,29 @@ out:
     return !err;
 }
 -static void virtio_net_handle_migration_primary(VirtIONet *n,
 -                                                MigrationState *s)
 +static void virtio_net_handle_migration_primary(VirtIONet *n, MigrationState *s)
 {
     bool should_be_hidden;
     Error *err = NULL;
 +    DeviceState *dev = failover_find_primary_device(n);
 -    should_be_hidden = qatomic_read(&n->failover_primary_hidden);
 -
 -    if (!n->primary_dev) {
 -        n->primary_dev = failover_find_primary_device(n);
 -        if (!n->primary_dev) {
 -            return;
 -        }
 +    if (!dev) {
 +        return;
     }
 +    should_be_hidden = qatomic_read(&n->failover_primary_hidden);
 +
     if (migration_in_setup(s) && !should_be_hidden) {
 -        if (failover_unplug_primary(n, n->primary_dev)) {
 -            vmstate_unregister(VMSTATE_IF(n->primary_dev),
 -                               qdev_get_vmsd(n->primary_dev),
 -                               n->primary_dev);
 -            qapi_event_send_unplug_primary(n->primary_dev->id);
 +        if (failover_unplug_primary(n, dev)) {
 +            vmstate_unregister(VMSTATE_IF(dev), qdev_get_vmsd(dev), dev);
 +            qapi_event_send_unplug_primary(dev->id);
             qatomic_set(&n->failover_primary_hidden, true);
         } else {
             warn_report("couldn't unplug primary device");
         }
     } else if (migration_has_failed(s)) {
         /* We already unplugged the device let's plug it back */
 -        if (!failover_replug_primary(n, n->primary_dev, &err)) {
 +        if (!failover_replug_primary(n, dev, &err)) {
             if (err) {
                 error_report_err(err);
             }
 -- 
 2.27.0
--- a/kvm-failover-simplify-qdev_device_add-failover-case.patch
+++ b/kvm-failover-simplify-qdev_device_add-failover-case.patch
@ -1,70 +0,0 @@
 From 27a1972d1a5961a8218d5a52fba16b67816635fe Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:38 -0500
 Subject: [PATCH 41/54] failover: simplify qdev_device_add() failover case
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-19-lvivier@redhat.com>
 Patchwork-id: 101255
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 18/27] failover: simplify qdev_device_add() failover case
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 Just put allthe logic inside the same if.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-20-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 5f2ef3b0d032797b6bad9449dfece3a8111a8529)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 softmmu/qdev-monitor.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index a25f5d612c..12b7540f17 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -600,7 +600,6 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
     const char *driver, *path;
     DeviceState *dev = NULL;
     BusState *bus = NULL;
 -    bool hide;
     driver = qemu_opt_get(opts, "driver");
     if (!driver) {
@@ -634,14 +633,16 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
             return NULL;
         }
     }
 -    hide = should_hide_device(opts);
 -    if ((hide || qdev_hotplug) && bus && !qbus_is_hotpluggable(bus)) {
 -        error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
 +    if (should_hide_device(opts)) {
 +        if (bus && !qbus_is_hotpluggable(bus)) {
 +            error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
 +        }
         return NULL;
     }
 -    if (hide) {
 +    if (qdev_hotplug && bus && !qbus_is_hotpluggable(bus)) {
 +        error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
         return NULL;
     }
 -- 
 2.27.0
--- a/kvm-failover-simplify-qdev_device_add.patch
+++ b/kvm-failover-simplify-qdev_device_add.patch
@ -1,89 +0,0 @@
 From 7822f8042e26cca6c1307e26c6f08d5f99636d90 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:39 -0500
 Subject: [PATCH 42/54] failover: simplify qdev_device_add()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-20-lvivier@redhat.com>
 Patchwork-id: 101256
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 19/27] failover: simplify qdev_device_add()
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 We don't need to walk the opts by hand.  qmp_opt_get() already does
 that.  And then we can remove the functions that did that walk.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-21-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 2e28095369f4eab516852fd49dde17c3bfd782f9)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 softmmu/qdev-monitor.c | 32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index 12b7540f17..0e10f0466f 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -572,28 +572,6 @@ void qdev_set_id(DeviceState *dev, const char *id)
     }
 }
 -static int is_failover_device(void *opaque, const char *name, const char *value,
 -                              Error **errp)
 -{
 -    if (strcmp(name, "failover_pair_id") == 0) {
 -        QemuOpts *opts = opaque;
 -
 -        if (qdev_should_hide_device(opts)) {
 -            return 1;
 -        }
 -    }
 -
 -    return 0;
 -}
 -
 -static bool should_hide_device(QemuOpts *opts)
 -{
 -    if (qemu_opt_foreach(opts, is_failover_device, opts, NULL) == 0) {
 -        return false;
 -    }
 -    return true;
 -}
 -
 DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
 {
     DeviceClass *dc;
@@ -634,11 +612,13 @@ DeviceState *qdev_device_add(QemuOpts *opts, Error **errp)
         }
     }
 -    if (should_hide_device(opts)) {
 -        if (bus && !qbus_is_hotpluggable(bus)) {
 -            error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
 +    if (qemu_opt_get(opts, "failover_pair_id")) {
 +        if (qdev_should_hide_device(opts)) {
 +            if (bus && !qbus_is_hotpluggable(bus)) {
 +                error_setg(errp, QERR_BUS_NO_HOTPLUG, bus->name);
 +            }
 +            return NULL;
         }
 -        return NULL;
     }
     if (qdev_hotplug && bus && !qbus_is_hotpluggable(bus)) {
 -- 
 2.27.0
--- a/kvm-failover-simplify-virtio_net_find_primary.patch
+++ b/kvm-failover-simplify-virtio_net_find_primary.patch
@ -1,70 +0,0 @@
 From 24bd4b43c3f59c9c28f924da8ef7a9dacc0f2f52 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:33 -0500
 Subject: [PATCH 36/54] failover: simplify virtio_net_find_primary()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-14-lvivier@redhat.com>
 Patchwork-id: 101253
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 13/27] failover: simplify virtio_net_find_primary()
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 a - is_my_primary() never sets one error
 b - If we return 1, primary_device_id is always set
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-15-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 7cf05b7ed8e84e89b873701e3dfcd56aa81b2d13)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 70fa372c08..881907d1bd 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -828,24 +828,12 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
 static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
 {
 -    DeviceState *dev = NULL;
     Error *err = NULL;
 -    if (qemu_opts_foreach(qemu_find_opts("device"),
 -                          is_my_primary, n, &err)) {
 -        if (err) {
 -            error_propagate(errp, err);
 -            return NULL;
 -        }
 -        if (n->primary_device_id) {
 -            dev = qdev_find_recursive(sysbus_get_default(),
 -                                      n->primary_device_id);
 -        } else {
 -            error_setg(errp, "Primary device id not found");
 -            return NULL;
 -        }
 +    if (!qemu_opts_foreach(qemu_find_opts("device"), is_my_primary, n, &err)) {
 +        return NULL;
     }
 -    return dev;
 +    return qdev_find_recursive(sysbus_get_default(), n->primary_device_id);
 }
 static DeviceState *virtio_connect_failover_devices(VirtIONet *n, Error **errp)
 -- 
 2.27.0
--- a/kvm-failover-split-failover_find_primary_device_id.patch
+++ b/kvm-failover-split-failover_find_primary_device_id.patch
@ -1,128 +0,0 @@
 From 2e3e87787776632d521ec5f08758973d42fc208e Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:42 -0500
 Subject: [PATCH 45/54] failover: split failover_find_primary_device_id()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-23-lvivier@redhat.com>
 Patchwork-id: 101244
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 22/27] failover: split failover_find_primary_device_id()
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 So we can calculate the device id when we need it.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-24-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit f5e1847ba50a8d1adf66c0cf312e53c162e52487)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 63 +++++++++++++++++++++++++++++++++------------
 1 file changed, 47 insertions(+), 16 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index b994796734..2c502c13fd 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -788,6 +788,49 @@ static inline uint64_t virtio_net_supported_guest_offloads(VirtIONet *n)
     return virtio_net_guest_offloads_by_features(vdev->guest_features);
 }
 +typedef struct {
 +    VirtIONet *n;
 +    char *id;
 +} FailoverId;
 +
 +/**
 + * Set the id of the failover primary device
 + *
 + * @opaque: FailoverId to setup
 + * @opts: opts for device we are handling
 + * @errp: returns an error if this function fails
 + */
 +static int failover_set_primary(void *opaque, QemuOpts *opts, Error **errp)
 +{
 +    FailoverId *fid = opaque;
 +    const char *standby_id = qemu_opt_get(opts, "failover_pair_id");
 +
 +    if (g_strcmp0(standby_id, fid->n->netclient_name) == 0) {
 +        fid->id = g_strdup(opts->id);
 +        return 1;
 +    }
 +
 +    return 0;
 +}
 +
 +/**
 + * Find the primary device id for this failover virtio-net
 + *
 + * @n: VirtIONet device
 + * @errp: returns an error if this function fails
 + */
 +static char *failover_find_primary_device_id(VirtIONet *n)
 +{
 +    Error *err = NULL;
 +    FailoverId fid;
 +
 +    if (!qemu_opts_foreach(qemu_find_opts("device"),
 +                           failover_set_primary, &fid, &err)) {
 +        return NULL;
 +    }
 +    return fid.id;
 +}
 +
 static void failover_add_primary(VirtIONet *n, Error **errp)
 {
     Error *err = NULL;
@@ -812,20 +855,6 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     error_propagate(errp, err);
 }
 -static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
 -{
 -    VirtIONet *n = opaque;
 -    int ret = 0;
 -    const char *standby_id = qemu_opt_get(opts, "failover_pair_id");
 -
 -    if (g_strcmp0(standby_id, n->netclient_name) == 0) {
 -        n->primary_device_id = g_strdup(opts->id);
 -        ret = 1;
 -    }
 -
 -    return ret;
 -}
 -
 /**
  * Find the primary device for this failover virtio-net
  *
@@ -834,11 +863,13 @@ static int is_my_primary(void *opaque, QemuOpts *opts, Error **errp)
  */
 static DeviceState *failover_find_primary_device(VirtIONet *n)
 {
 -    Error *err = NULL;
 +    char *id = failover_find_primary_device_id(n);
 -    if (!qemu_opts_foreach(qemu_find_opts("device"), is_my_primary, n, &err)) {
 +    if (!id) {
         return NULL;
     }
 +    n->primary_device_id = g_strdup(id);
 +
     return qdev_find_recursive(sysbus_get_default(), n->primary_device_id);
 }
 -- 
 2.27.0
--- a/kvm-failover-virtio_net_connect_failover_devices-does-no.patch
+++ b/kvm-failover-virtio_net_connect_failover_devices-does-no.patch
@ -1,80 +0,0 @@
 From 385df1f898e08c9cf0c90e543978cc68ee0c1097 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 23:14:36 -0500
 Subject: [PATCH 39/54] failover: virtio_net_connect_failover_devices() does
 nothing
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225231447.2187738-17-lvivier@redhat.com>
 Patchwork-id: 101254
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v2 16/27] failover: virtio_net_connect_failover_devices() does nothing
 Bugzilla: 1819991
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 From: Juan Quintela <quintela@redhat.com>
 BZ: https://bugzilla.redhat.com/1819991
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 It just calls virtio_net_find_primary(), so just update the callers.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20201118083748.1328-18-quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 0763db4f2df3a92336d78e8b68a665f7d1a1bc66)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/net/virtio-net.c | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 747614ff2a..c6200b924e 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -836,19 +836,6 @@ static DeviceState *virtio_net_find_primary(VirtIONet *n, Error **errp)
     return qdev_find_recursive(sysbus_get_default(), n->primary_device_id);
 }
 -static DeviceState *virtio_connect_failover_devices(VirtIONet *n, Error **errp)
 -{
 -    DeviceState *prim_dev = NULL;
 -    Error *err = NULL;
 -
 -    prim_dev = virtio_net_find_primary(n, &err);
 -    if (!prim_dev) {
 -        error_propagate(errp, err);
 -    }
 -
 -    return prim_dev;
 -}
 -
 static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
@@ -904,7 +891,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
         if (err) {
 -            n->primary_dev = virtio_connect_failover_devices(n, &err);
 +            n->primary_dev = virtio_net_find_primary(n, &err);
             if (err) {
                 goto out_err;
             }
@@ -3128,7 +3115,7 @@ static void virtio_net_handle_migration_primary(VirtIONet *n,
     should_be_hidden = qatomic_read(&n->failover_primary_hidden);
     if (!n->primary_dev) {
 -        n->primary_dev = virtio_connect_failover_devices(n, &err);
 +        n->primary_dev = virtio_net_find_primary(n, &err);
         if (!n->primary_dev) {
             return;
         }
 -- 
 2.27.0
--- a/kvm-hw-arm-smmuv3-Fix-addr_mask-for-range-based-invalida.patch
+++ b/kvm-hw-arm-smmuv3-Fix-addr_mask-for-range-based-invalida.patch
@ -1,66 +0,0 @@
 From 9768ea83a3f23f112514ad34d4abcd6e9590bb71 Mon Sep 17 00:00:00 2001
 From: Auger Eric <eric.auger@redhat.com>
 Date: Wed, 3 Feb 2021 20:31:27 -0500
 Subject: [PATCH 4/7] hw/arm/smmuv3: Fix addr_mask for range-based invalidation
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Auger Eric <eric.auger@redhat.com>
 Message-id: <20210203203127.3613-1-eric.auger@redhat.com>
 Patchwork-id: 100971
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH] hw/arm/smmuv3: Fix addr_mask for range-based invalidation
 Bugzilla: 1834152
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 From: Zenghui Yu <yuzenghui@huawei.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1834152
 BRANCH: rhel-av-8.4.0
 UPSTREAM: yes
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=34711554
 When handling guest range-based IOTLB invalidation, we should decode the TG
 field into the corresponding translation granule size so that we can pass
 the correct invalidation range to backend. Set @granule to (tg * 2 + 10) to
 properly emulate the architecture.
 Fixes: d52915616c05 ("hw/arm/smmuv3: Get prepared for range invalidation")
 Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20210130043220.1345-1-yuzenghui@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit dcda883cd21125c699419a3fc0fe182ea989d9c4)
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 hw/arm/smmuv3.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index bbca0e9f20..98b99d4fe8 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -801,7 +801,7 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
     IOMMUTLBEvent event;
 -    uint8_t granule = tg;
 +    uint8_t granule;
     if (!tg) {
         SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -821,6 +821,8 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
             return;
         }
         granule = tt->granule_sz;
 +    } else {
 +        granule = tg * 2 + 10;
     }
     event.type = IOMMU_NOTIFIER_UNMAP;
 -- 
 2.18.4
--- a/kvm-hw-intc-arm_gic-Fix-interrupt-ID-in-GICD_SGIR-regist.patch
+++ b/kvm-hw-intc-arm_gic-Fix-interrupt-ID-in-GICD_SGIR-regist.patch
@ -1,80 +0,0 @@
 From efdd1b8911d5ae5c0eacbc63fd4fe85f0cc4614b Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 14 Mar 2021 15:54:19 -0400
 Subject: [PATCH 06/15] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 Message-id: <20210314155419.911760-2-jmaloy@redhat.com>
 Patchwork-id: 101336
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
 Bugzilla: 1936948
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Per the ARM Generic Interrupt Controller Architecture specification
 (document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit,
 not 10:
  - 4.3 Distributor register descriptions
  - 4.3.15 Software Generated Interrupt Register, GICD_SG
    - Table 4-21 GICD_SGIR bit assignments
    The Interrupt ID of the SGI to forward to the specified CPU
    interfaces. The value of this field is the Interrupt ID, in
    the range 0-15, for example a value of 0b0011 specifies
    Interrupt ID 3.
 Correct the irq mask to fix an undefined behavior (which eventually
 lead to a heap-buffer-overflow, see [Buglink]):
   $ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio
   [I 1612088147.116987] OPENED
  [R +0.278293] writel 0x8000f00 0xff4affb0
  ../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]'
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13
 This fixes a security issue when running with KVM on Arm with
 kernel-irqchip=off. (The default is kernel-irqchip=on, which is
 unaffected, and which is also the correct choice for performance.)
 Cc: qemu-stable@nongnu.org
 Fixes: CVE-2021-20221
 Fixes: 9ee6e8bb853 ("ARMv7 support.")
 Buglink: https://bugs.launchpad.net/qemu/+bug/1913916
 Buglink: https://bugs.launchpad.net/qemu/+bug/1913917
 Reported-by: Alexander Bulekov <alxndr@bu.edu>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210131103401.217160-1-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit edfe2eb4360cde4ed5d95bda7777edcb3510f76a)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/intc/arm_gic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
 index c60dc6b5e6..fbde60de05 100644
 --- a/hw/intc/arm_gic.c
 +++ b/hw/intc/arm_gic.c
@@ -1474,7 +1474,7 @@ static void gic_dist_writel(void *opaque, hwaddr offset,
         int target_cpu;
         cpu = gic_get_current_cpu(s);
 -        irq = value & 0x3ff;
 +        irq = value & 0xf;
         switch ((value >> 24) & 3) {
         case 0:
             mask = (value >> 16) & ALL_CPU_MASK;
 -- 
 2.27.0
--- a/kvm-i386-Add-the-support-for-AMD-EPYC-3rd-generation-pro.patch
+++ b/kvm-i386-Add-the-support-for-AMD-EPYC-3rd-generation-pro.patch
@ -1,213 +0,0 @@
 From 78375038a68fee2e7b182b4f191d5ba53fbdcd72 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Feb 2021 15:18:11 -0500
 Subject: [PATCH 52/54] i386: Add the support for AMD EPYC 3rd generation
 processors
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20210223151811.27968-3-dgilbert@redhat.com>
 Patchwork-id: 101198
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/2] i386: Add the support for AMD EPYC 3rd generation processors
 Bugzilla: 1926785
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 From: Babu Moger <babu.moger@amd.com>
 Adds the support for AMD 3rd generation processors. The model
 display for the new processor will be EPYC-Milan.
 Adds the following new feature bits on top of the feature bits from
 the first and second generation EPYC models.
 pcid          : Process context identifiers support
 ibrs          : Indirect Branch Restricted Speculation
 ssbd          : Speculative Store Bypass Disable
 erms          : Enhanced REP MOVSB/STOSB support
 fsrm          : Fast Short REP MOVSB support
 invpcid       : Invalidate processor context ID
 pku           : Protection keys support
 svme-addr-chk : SVM instructions address check for #GP handling
 Depends on the following kernel commits:
 14c2bf81fcd2 ("KVM: SVM: Fix #GP handling for doubly-nested virtualization")
 3b9c723ed7cf ("KVM: SVM: Add support for SVM instruction address check change")
 4aa2691dcbd3 ("8ce1c461188799d863398dd2865d KVM: x86: Factor out x86 instruction emulation with decoding")
 4407a797e941 ("KVM: SVM: Enable INVPCID feature on AMD")
 9715092f8d7e ("KVM: X86: Move handling of INVPCID types to x86")
 3f3393b3ce38 ("KVM: X86: Rename and move the function vmx_handle_memory_failure to x86.c")
 830bd71f2c06 ("KVM: SVM: Remove set_cr_intercept, clr_cr_intercept and is_cr_intercept")
 4c44e8d6c193 ("KVM: SVM: Add new intercept word in vmcb_control_area")
 c62e2e94b9d4 ("KVM: SVM: Modify 64 bit intercept field to two 32 bit vectors")
 9780d51dc2af ("KVM: SVM: Modify intercept_exceptions to generic intercepts")
 30abaa88382c ("KVM: SVM: Change intercept_dr to generic intercepts")
 03bfeeb988a9 ("KVM: SVM: Change intercept_cr to generic intercepts")
 c45ad7229d13 ("KVM: SVM: Introduce vmcb_(set_intercept/clr_intercept/_is_intercept)")
 a90c1ed9f11d ("(pcid) KVM: nSVM: Remove unused field")
 fa44b82eb831 ("KVM: x86: Move MPK feature detection to common code")
 38f3e775e9c2 ("x86/Kconfig: Update config and kernel doc for MPK feature on AMD")
 37486135d3a7 ("KVM: x86: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c")
 Signed-off-by: Babu Moger <babu.moger@amd.com>
 Message-Id: <161290460478.11352.8933244555799318236.stgit@bmoger-ubuntu>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit 623972ceae091b31331ae4a1dc94fe5cbb891937)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 target/i386/cpu.c | 107 +++++++++++++++++++++++++++++++++++++++++++++-
 target/i386/cpu.h |   4 ++
 2 files changed, 110 insertions(+), 1 deletion(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 372cba2942..523a97c0fb 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -1029,7 +1029,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "clzero", NULL, "xsaveerptr", NULL,
             NULL, NULL, NULL, NULL,
             NULL, "wbnoinvd", NULL, NULL,
 -            "ibpb", NULL, NULL, "amd-stibp",
 +            "ibpb", NULL, "ibrs", "amd-stibp",
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             "amd-ssbd", "virt-ssbd", "amd-no-ssb", NULL,
@@ -1769,6 +1769,56 @@ static CPUCaches epyc_rome_cache_info = {
     },
 };
 +static CPUCaches epyc_milan_cache_info = {
 +    .l1d_cache = &(CPUCacheInfo) {
 +        .type = DATA_CACHE,
 +        .level = 1,
 +        .size = 32 * KiB,
 +        .line_size = 64,
 +        .associativity = 8,
 +        .partitions = 1,
 +        .sets = 64,
 +        .lines_per_tag = 1,
 +        .self_init = 1,
 +        .no_invd_sharing = true,
 +    },
 +    .l1i_cache = &(CPUCacheInfo) {
 +        .type = INSTRUCTION_CACHE,
 +        .level = 1,
 +        .size = 32 * KiB,
 +        .line_size = 64,
 +        .associativity = 8,
 +        .partitions = 1,
 +        .sets = 64,
 +        .lines_per_tag = 1,
 +        .self_init = 1,
 +        .no_invd_sharing = true,
 +    },
 +    .l2_cache = &(CPUCacheInfo) {
 +        .type = UNIFIED_CACHE,
 +        .level = 2,
 +        .size = 512 * KiB,
 +        .line_size = 64,
 +        .associativity = 8,
 +        .partitions = 1,
 +        .sets = 1024,
 +        .lines_per_tag = 1,
 +    },
 +    .l3_cache = &(CPUCacheInfo) {
 +        .type = UNIFIED_CACHE,
 +        .level = 3,
 +        .size = 32 * MiB,
 +        .line_size = 64,
 +        .associativity = 16,
 +        .partitions = 1,
 +        .sets = 32768,
 +        .lines_per_tag = 1,
 +        .self_init = true,
 +        .inclusive = true,
 +        .complex_indexing = true,
 +    },
 +};
 +
 /* The following VMX features are not supported by KVM and are left out in the
  * CPU definitions:
  *
@@ -4101,6 +4151,61 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .model_id = "AMD EPYC-Rome Processor",
         .cache_info = &epyc_rome_cache_info,
     },
 +    {
 +        .name = "EPYC-Milan",
 +        .level = 0xd,
 +        .vendor = CPUID_VENDOR_AMD,
 +        .family = 25,
 +        .model = 1,
 +        .stepping = 1,
 +        .features[FEAT_1_EDX] =
 +            CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
 +            CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
 +            CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
 +            CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
 +            CPUID_VME | CPUID_FP87,
 +        .features[FEAT_1_ECX] =
 +            CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
 +            CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
 +            CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
 +            CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 |
 +            CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3 |
 +            CPUID_EXT_PCID,
 +        .features[FEAT_8000_0001_EDX] =
 +            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
 +            CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
 +            CPUID_EXT2_SYSCALL,
 +        .features[FEAT_8000_0001_ECX] =
 +            CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
 +            CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
 +            CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
 +            CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
 +        .features[FEAT_8000_0008_EBX] =
 +            CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
 +            CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
 +            CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP |
 +            CPUID_8000_0008_EBX_AMD_SSBD,
 +        .features[FEAT_7_0_EBX] =
 +            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
 +            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
 +            CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
 +            CPUID_7_0_EBX_SHA_NI | CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_ERMS |
 +            CPUID_7_0_EBX_INVPCID,
 +        .features[FEAT_7_0_ECX] =
 +            CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_PKU,
 +        .features[FEAT_7_0_EDX] =
 +            CPUID_7_0_EDX_FSRM,
 +        .features[FEAT_XSAVE] =
 +            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
 +            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
 +        .features[FEAT_6_EAX] =
 +            CPUID_6_EAX_ARAT,
 +        .features[FEAT_SVM] =
 +            CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE | CPUID_SVM_SVME_ADDR_CHK,
 +        .xlevel = 0x8000001E,
 +        .model_id = "AMD EPYC-Milan Processor",
 +        .cache_info = &epyc_milan_cache_info,
 +    },
 };
 /* KVM-specific features that are automatically added/removed
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
 index 4fdb552f93..92ca64a21b 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
@@ -811,8 +811,12 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 #define CPUID_8000_0008_EBX_WBNOINVD    (1U << 9)
 /* Indirect Branch Prediction Barrier */
 #define CPUID_8000_0008_EBX_IBPB        (1U << 12)
 +/* Indirect Branch Restricted Speculation */
 +#define CPUID_8000_0008_EBX_IBRS        (1U << 14)
 /* Single Thread Indirect Branch Predictors */
 #define CPUID_8000_0008_EBX_STIBP       (1U << 15)
 +/* Speculative Store Bypass Disable */
 +#define CPUID_8000_0008_EBX_AMD_SSBD    (1U << 24)
 #define CPUID_XSAVE_XSAVEOPT   (1U << 0)
 #define CPUID_XSAVE_XSAVEC     (1U << 1)
 -- 
 2.27.0
--- a/kvm-i386-acpi-restore-device-paths-for-pre-5.1-vms.patch
+++ b/kvm-i386-acpi-restore-device-paths-for-pre-5.1-vms.patch
@ -1,177 +0,0 @@
 From 1f6e36fd98ba0610a438c2352117c5b1ed4f01ba Mon Sep 17 00:00:00 2001
 From: Igor Mammedov <imammedo@redhat.com>
 Date: Mon, 8 Mar 2021 18:10:41 -0500
 Subject: [PATCH 07/15] i386/acpi: restore device paths for pre-5.1 vms
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Igor Mammedov <imammedo@redhat.com>
 Message-id: <20210308181041.2427279-1-imammedo@redhat.com>
 Patchwork-id: 101321
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH] i386/acpi: restore device paths for pre-5.1 vms
 Bugzilla: 1934158
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1934158
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=35317870
 Upstream: 0a343a5add75f9f90c65e932863d57ddbcb28f5c
  From: Vitaly Cheptsov <cheptsov@ispras.ru>
  Date:   Mon Mar 1 22:59:18 2021 +0300
  After fixing the _UID value for the primary PCI root bridge in
  af1b80ae it was discovered that this change updates Windows
  configuration in an incompatible way causing network configuration
  failure unless DHCP is used. More details provided on the list:
  https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg08484.html
  This change reverts the _UID update from 1 to 0 for q35 and i440fx
  VMs before version 5.2 to maintain the original behaviour when
  upgrading.
  Cc: qemu-stable@nongnu.org
  Cc: qemu-devel@nongnu.org
  Reported-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  Suggested-by: Michael S. Tsirkin <mst@redhat.com>
  Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
  Message-Id: <20210301195919.9333-1-cheptsov@ispras.ru>
  Tested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  Reviewed-by: Igor Mammedov <imammedo@redhat.com>
  Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
  Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  Fixes: af1b80ae56c9 ("i386/acpi: fix inconsistent QEMU/OVMF device paths")
 (cherry picked from commit 0a343a5add75f9f90c65e932863d57ddbcb28f5c)
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Notes:
 clean cherrypick +
 adding the same quirk to RHEL's pc(7.6)/q35(8.3) machine types
 to preserve old UID. pc-q35-rhel8.4.0 will have new UID as defined
 by spec (but since it's not been released yet there is no risk of
 breaking [non]existing Windows deployments and new installations
 should pickup new PCI device enumeration just fine)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/acpi-build.c | 4 ++--
 hw/i386/pc_piix.c    | 5 +++++
 hw/i386/pc_q35.c     | 5 +++++
 include/hw/i386/pc.h | 1 +
 4 files changed, 13 insertions(+), 2 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index b1082bd412..be6a260b85 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -1516,7 +1516,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         dev = aml_device("PCI0");
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
         aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
 -        aml_append(dev, aml_name_decl("_UID", aml_int(0)));
 +        aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
         aml_append(sb_scope, dev);
         aml_append(dsdt, sb_scope);
@@ -1533,7 +1533,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
         aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
         aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
 -        aml_append(dev, aml_name_decl("_UID", aml_int(0)));
 +        aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
         aml_append(dev, build_q35_osc_method());
         aml_append(sb_scope, dev);
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 6e1f1ba082..819fb5fed9 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -421,6 +421,7 @@ static void pc_i440fx_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     pcmc->default_nic_model = "e1000";
 +    pcmc->pci_root_uid = 0;
     m->family = "pc_piix";
     m->desc = "Standard PC (i440FX + PIIX, 1996)";
@@ -452,6 +453,7 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, hw_compat_5_1, hw_compat_5_1_len);
     compat_props_add(m->compat_props, pc_compat_5_1, pc_compat_5_1_len);
     pcmc->kvmclock_create_always = false;
 +    pcmc->pci_root_uid = 1;
 }
 DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
@@ -1020,6 +1022,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
     m->family = "pc_piix_Y";
     m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
     pcmc->default_nic_model = "e1000";
 +    pcmc->pci_root_uid = 0;
     m->default_display = "std";
     m->no_parallel = 1;
     m->numa_mem_supported = true;
@@ -1046,6 +1049,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->pvh_enabled = false;
     pcmc->default_cpu_version = CPU_VERSION_LEGACY;
     pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
     compat_props_add(m->compat_props, hw_compat_rhel_8_3,
                      hw_compat_rhel_8_3_len);
     compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index a8c0496c9f..f848f1484e 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -332,6 +332,7 @@ static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     pcmc->default_nic_model = "e1000e";
 +    pcmc->pci_root_uid = 0;
     m->family = "pc_q35";
     m->desc = "Standard PC (Q35 + ICH9, 2009)";
@@ -367,6 +368,7 @@ static void pc_q35_5_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, hw_compat_5_1, hw_compat_5_1_len);
     compat_props_add(m->compat_props, pc_compat_5_1, pc_compat_5_1_len);
     pcmc->kvmclock_create_always = false;
 +    pcmc->pci_root_uid = 1;
 }
 DEFINE_Q35_MACHINE(v5_1, "pc-q35-5.1", NULL,
@@ -578,6 +580,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     pcmc->default_nic_model = "e1000e";
 +    pcmc->pci_root_uid = 0;
     m->family = "pc_q35_Z";
     m->units_per_default_bus = 1;
     m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
@@ -630,6 +633,8 @@ static void pc_q35_machine_rhel830_options(MachineClass *m)
                      pc_rhel_8_3_compat_len);
     /* From pc_q35_5_1_machine_options() */
     pcmc->kvmclock_create_always = false;
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 }
 DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 68091bea98..d2efc65cec 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -99,6 +99,7 @@ struct PCMachineClass {
     int legacy_acpi_table_size;
     unsigned acpi_data_size;
     bool do_not_add_smb_acpi;
 +    int pci_root_uid;
     /* SMBIOS compat: */
     bool smbios_defaults;
 -- 
 2.27.0
--- a/kvm-migration-dirty-bitmap-Allow-control-of-bitmap-persi.patch
+++ b/kvm-migration-dirty-bitmap-Allow-control-of-bitmap-persi.patch
@ -1,167 +0,0 @@
 From 039775f93548382ec1b98f5a6004c3eee02fbd28 Mon Sep 17 00:00:00 2001
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 22 Feb 2021 13:35:05 -0500
 Subject: [PATCH 22/54] migration: dirty-bitmap: Allow control of bitmap
 persistence
 RH-Author: Peter Krempa <pkrempa@redhat.com>
 Message-id: <aab968e05bbfb581697573b8e42768af502f46db.1614000630.git.pkrempa@redhat.com>
 Patchwork-id: 101171
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/3] migration: dirty-bitmap: Allow control of bitmap persistence
 Bugzilla: 1930757
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 Bitmap's source persistence is transported over the migration stream and
 the destination mirrors it. In some cases the destination might want to
 persist bitmaps which are not persistent on the source (e.g. the result
 of merging bitmaps from a number of layers on the source when migrating
 into a squashed image) but currently it would need to create another set
 of persistent bitmaps and merge them.
 This patch adds a 'transform' property to the alias map which allows
 overriding the persistence of migrated bitmaps both on the source and
 destination sides.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Message-Id: <b20afb675917b86f6359ac3591166ac6d4233573.1613150869.git.pkrempa@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 [eblake: grammar tweaks, drop dead conditional]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 6e9f21a2aa8a78bc9a512a836a40c79fe50dd2b4)
 https://bugzilla.redhat.com/show_bug.cgi?id=1930757
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/block-dirty-bitmap.c | 29 ++++++++++++++++++++++++++---
 qapi/migration.json            | 19 ++++++++++++++++++-
 2 files changed, 44 insertions(+), 4 deletions(-)
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
 index b39c13ce4e..975093610a 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
@@ -150,6 +150,7 @@ typedef struct DBMLoadState {
     BdrvDirtyBitmap *bitmap;
     bool before_vm_start_handled; /* set in dirty_bitmap_mig_before_vm_start */
 +    BitmapMigrationBitmapAlias *bmap_inner;
     /*
      * cancelled
@@ -529,6 +530,7 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
     }
     FOR_EACH_DIRTY_BITMAP(bs, bitmap) {
 +        BitmapMigrationBitmapAliasTransform *bitmap_transform = NULL;
         bitmap_name = bdrv_dirty_bitmap_name(bitmap);
         if (!bitmap_name) {
             continue;
@@ -549,6 +551,9 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
             }
             bitmap_alias = bmap_inner->alias;
 +            if (bmap_inner->has_transform) {
 +                bitmap_transform = bmap_inner->transform;
 +            }
         } else {
             if (strlen(bitmap_name) > UINT8_MAX) {
                 error_report("Cannot migrate bitmap '%s' on node '%s': "
@@ -574,8 +579,15 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
         if (bdrv_dirty_bitmap_enabled(bitmap)) {
             dbms->flags |= DIRTY_BITMAP_MIG_START_FLAG_ENABLED;
         }
 -        if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
 -            dbms->flags |= DIRTY_BITMAP_MIG_START_FLAG_PERSISTENT;
 +        if (bitmap_transform &&
 +            bitmap_transform->has_persistent) {
 +            if (bitmap_transform->persistent) {
 +                dbms->flags |= DIRTY_BITMAP_MIG_START_FLAG_PERSISTENT;
 +            }
 +        } else {
 +            if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
 +                dbms->flags |= DIRTY_BITMAP_MIG_START_FLAG_PERSISTENT;
 +            }
         }
         QSIMPLEQ_INSERT_TAIL(&s->dbms_list, dbms, entry);
@@ -783,6 +795,7 @@ static int dirty_bitmap_load_start(QEMUFile *f, DBMLoadState *s)
     uint32_t granularity = qemu_get_be32(f);
     uint8_t flags = qemu_get_byte(f);
     LoadBitmapState *b;
 +    bool persistent;
     if (s->cancelled) {
         return 0;
@@ -807,7 +820,15 @@ static int dirty_bitmap_load_start(QEMUFile *f, DBMLoadState *s)
         return -EINVAL;
     }
 -    if (flags & DIRTY_BITMAP_MIG_START_FLAG_PERSISTENT) {
 +    if (s->bmap_inner &&
 +        s->bmap_inner->has_transform &&
 +        s->bmap_inner->transform->has_persistent) {
 +        persistent = s->bmap_inner->transform->persistent;
 +    } else {
 +        persistent = flags & DIRTY_BITMAP_MIG_START_FLAG_PERSISTENT;
 +    }
 +
 +    if (persistent) {
         bdrv_dirty_bitmap_set_persistence(s->bitmap, true);
     }
@@ -1091,6 +1112,8 @@ static int dirty_bitmap_load_header(QEMUFile *f, DBMLoadState *s,
             } else {
                 bitmap_name = bmap_inner->name;
             }
 +
 +            s->bmap_inner = bmap_inner;
         }
         if (!s->cancelled) {
 diff --git a/qapi/migration.json b/qapi/migration.json
 index 3c75820527..19b796ab47 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
@@ -525,6 +525,19 @@
   'data': [ 'none', 'zlib',
             { 'name': 'zstd', 'if': 'defined(CONFIG_ZSTD)' } ] }
 +##
 +# @BitmapMigrationBitmapAliasTransform:
 +#
 +# @persistent: If present, the bitmap will be made persistent
 +#              or transient depending on this parameter.
 +#
 +# Since: 6.0
 +##
 +{ 'struct': 'BitmapMigrationBitmapAliasTransform',
 +  'data': {
 +      '*persistent': 'bool'
 +  } }
 +
 ##
 # @BitmapMigrationBitmapAlias:
 #
@@ -533,12 +546,16 @@
 # @alias: An alias name for migration (for example the bitmap name on
 #         the opposite site).
 #
 +# @transform: Allows the modification of the migrated bitmap.
 +#             (since 6.0)
 +#
 # Since: 5.2
 ##
 { 'struct': 'BitmapMigrationBitmapAlias',
   'data': {
       'name': 'str',
 -      'alias': 'str'
 +      'alias': 'str',
 +      '*transform': 'BitmapMigrationBitmapAliasTransform'
   } }
 ##
 -- 
 2.27.0
--- a/kvm-migration-dirty-bitmap-Use-struct-for-alias-map-inne.patch
+++ b/kvm-migration-dirty-bitmap-Use-struct-for-alias-map-inne.patch
@ -1,143 +0,0 @@
 From e49b317a80df94b769c01c2ae488a369921088d2 Mon Sep 17 00:00:00 2001
 From: Peter Krempa <pkrempa@redhat.com>
 Date: Mon, 22 Feb 2021 13:35:04 -0500
 Subject: [PATCH 21/54] migration: dirty-bitmap: Use struct for alias map inner
 members
 RH-Author: Peter Krempa <pkrempa@redhat.com>
 Message-id: <943503323f3f97d576715d09736376cf07d6efab.1614000630.git.pkrempa@redhat.com>
 Patchwork-id: 101170
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/3] migration: dirty-bitmap: Use struct for alias map inner members
 Bugzilla: 1930757
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 Currently the alias mapping hash stores just strings of the target
 objects internally. In further patches we'll be adding another member
 which will need to be stored in the map so pass a copy of the whole
 BitmapMigrationBitmapAlias QAPI struct into the map.
 Signed-off-by: Peter Krempa <pkrempa@redhat.com>
 Message-Id: <fc5f27e1fe16cb75e08a248c2d938de3997b9bfb.1613150869.git.pkrempa@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 [eblake: adjust long lines]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 0d1e450c7b3117ee635a00c81d9a92666ebc7ffa)
 https://bugzilla.redhat.com/show_bug.cgi?id=1930757
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/block-dirty-bitmap.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
 index c61d382be8..b39c13ce4e 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
@@ -75,6 +75,8 @@
 #include "qemu/id.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-migration.h"
 +#include "qapi/qapi-visit-migration.h"
 +#include "qapi/clone-visitor.h"
 #include "trace.h"
 #define CHUNK_SIZE     (1 << 10)
@@ -224,6 +226,7 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
         AliasMapInnerNode *amin;
         GHashTable *bitmaps_map;
         const char *node_map_from, *node_map_to;
 +        GDestroyNotify gdn;
         if (!id_wellformed(bmna->alias)) {
             error_setg(errp, "The node alias '%s' is not well-formed",
@@ -263,8 +266,9 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
             node_map_to = bmna->node_name;
         }
 -        bitmaps_map = g_hash_table_new_full(g_str_hash, g_str_equal,
 -                                            g_free, g_free);
 +        gdn = (GDestroyNotify) qapi_free_BitmapMigrationBitmapAlias;
 +        bitmaps_map = g_hash_table_new_full(g_str_hash, g_str_equal, g_free,
 +                                            gdn);
         amin = g_new(AliasMapInnerNode, 1);
         *amin = (AliasMapInnerNode){
@@ -276,7 +280,7 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
         for (bmbal = bmna->bitmaps; bmbal; bmbal = bmbal->next) {
             const BitmapMigrationBitmapAlias *bmba = bmbal->value;
 -            const char *bmap_map_from, *bmap_map_to;
 +            const char *bmap_map_from;
             if (strlen(bmba->alias) > UINT8_MAX) {
                 error_setg(errp,
@@ -293,7 +297,6 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
             if (name_to_alias) {
                 bmap_map_from = bmba->name;
 -                bmap_map_to = bmba->alias;
                 if (g_hash_table_contains(bitmaps_map, bmba->name)) {
                     error_setg(errp, "The bitmap '%s'/'%s' is mapped twice",
@@ -302,7 +305,6 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
                 }
             } else {
                 bmap_map_from = bmba->alias;
 -                bmap_map_to = bmba->name;
                 if (g_hash_table_contains(bitmaps_map, bmba->alias)) {
                     error_setg(errp, "The bitmap alias '%s'/'%s' is used twice",
@@ -311,8 +313,8 @@ static GHashTable *construct_alias_map(const BitmapMigrationNodeAliasList *bbm,
                 }
             }
 -            g_hash_table_insert(bitmaps_map,
 -                                g_strdup(bmap_map_from), g_strdup(bmap_map_to));
 +            g_hash_table_insert(bitmaps_map, g_strdup(bmap_map_from),
 +                                QAPI_CLONE(BitmapMigrationBitmapAlias, bmba));
         }
     }
@@ -538,11 +540,15 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
         }
         if (bitmap_aliases) {
 -            bitmap_alias = g_hash_table_lookup(bitmap_aliases, bitmap_name);
 -            if (!bitmap_alias) {
 +            BitmapMigrationBitmapAlias *bmap_inner;
 +
 +            bmap_inner = g_hash_table_lookup(bitmap_aliases, bitmap_name);
 +            if (!bmap_inner) {
                 /* Skip bitmaps with no alias */
                 continue;
             }
 +
 +            bitmap_alias = bmap_inner->alias;
         } else {
             if (strlen(bitmap_name) > UINT8_MAX) {
                 error_report("Cannot migrate bitmap '%s' on node '%s': "
@@ -1074,13 +1080,16 @@ static int dirty_bitmap_load_header(QEMUFile *f, DBMLoadState *s,
         bitmap_name = s->bitmap_alias;
         if (!s->cancelled && bitmap_alias_map) {
 -            bitmap_name = g_hash_table_lookup(bitmap_alias_map,
 -                                              s->bitmap_alias);
 -            if (!bitmap_name) {
 +            BitmapMigrationBitmapAlias *bmap_inner;
 +
 +            bmap_inner = g_hash_table_lookup(bitmap_alias_map, s->bitmap_alias);
 +            if (!bmap_inner) {
                 error_report("Error: Unknown bitmap alias '%s' on node "
                              "'%s' (alias '%s')", s->bitmap_alias,
                              s->bs->node_name, s->node_alias);
                 cancel_incoming_locked(s);
 +            } else {
 +                bitmap_name = bmap_inner->name;
             }
         }
 -- 
 2.27.0
--- a/kvm-nbd-make-nbd_read-return-EIO-on-error.patch
+++ b/kvm-nbd-make-nbd_read-return-EIO-on-error.patch
@ -1,72 +0,0 @@
 From 7b7974468656d2ceba6a7f6dba2b35dfe28a5d1f Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Mon, 8 Feb 2021 22:57:01 -0300
 Subject: [PATCH 03/54] nbd: make nbd_read* return -EIO on error
 RH-Author: Eric Blake <eblake@redhat.com>
 Message-id: <20210208225701.110110-4-eblake@redhat.com>
 Patchwork-id: 101007
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH v4 3/3] nbd: make nbd_read* return -EIO on error
 Bugzilla: 1887883
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 From: Roman Kagan <rvkagan@yandex-team.ru>
 NBD reconnect logic considers the error code from the functions that
 read NBD messages to tell if reconnect should be attempted or not: it is
 attempted on -EIO, otherwise the client transitions to NBD_CLIENT_QUIT
 state (see nbd_channel_error).  This error code is propagated from the
 primitives like nbd_read.
 The problem, however, is that nbd_read itself turns every error into -1
 rather than -EIO.  As a result, if the NBD server happens to die while
 sending the message, the client in QEMU receives less data than it
 expects, considers it as a fatal error, and wouldn't attempt
 reestablishing the connection.
 Fix it by turning every negative return from qio_channel_read_all into
 -EIO returned from nbd_read.  Apparently that was the original behavior,
 but got broken later.  Also adjust nbd_readXX to follow.
 Fixes: e6798f06a6 ("nbd: generalize usage of nbd_read")
 Signed-off-by: Roman Kagan <rvkagan@yandex-team.ru>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210129073859.683063-4-rvkagan@yandex-team.ru>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 5082fc82a6bc3fc06a04be47d39777c7cff61e5b)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 include/block/nbd.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
 diff --git a/include/block/nbd.h b/include/block/nbd.h
 index 4a52a43ef5..5f34d23bb0 100644
 --- a/include/block/nbd.h
 +++ b/include/block/nbd.h
@@ -364,7 +364,7 @@ static inline int nbd_read(QIOChannel *ioc, void *buffer, size_t size,
         if (desc) {
             error_prepend(errp, "Failed to read %s: ", desc);
         }
 -        return -1;
 +        return ret;
     }
     return 0;
@@ -375,8 +375,9 @@ static inline int nbd_read##bits(QIOChannel *ioc,                       \
                                  uint##bits##_t *val,                   \
                                  const char *desc, Error **errp)        \
 {                                                                       \
 -    if (nbd_read(ioc, val, sizeof(*val), desc, errp) < 0) {             \
 -        return -1;                                                      \
 +    int ret = nbd_read(ioc, val, sizeof(*val), desc, errp);             \
 +    if (ret < 0) {                                                      \
 +        return ret;                                                     \
     }                                                                   \
     *val = be##bits##_to_cpu(*val);                                     \
     return 0;                                                           \
 -- 
 2.27.0
--- a/kvm-nbd-server-Quiesce-coroutines-on-context-switch.patch
+++ b/kvm-nbd-server-Quiesce-coroutines-on-context-switch.patch
@ -1,249 +0,0 @@
 From 7cadf68c46abcd097fcbcecb11a4a04f264d0316 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 11 Feb 2021 14:42:05 -0300
 Subject: [PATCH 3/6] nbd/server: Quiesce coroutines on context switch
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20210211144208.58930-3-slp@redhat.com>
 Patchwork-id: 101051
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/5] nbd/server: Quiesce coroutines on context switch
 Bugzilla: 1918966 1918968
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 When switching between AIO contexts we need to me make sure that both
 recv_coroutine and send_coroutine are not scheduled to run. Otherwise,
 QEMU may crash while attaching the new context with an error like
 this one:
 aio_co_schedule: Co-routine was already scheduled in 'aio_co_schedule'
 To achieve this we need a local implementation of
 'qio_channel_readv_all_eof' named 'nbd_read_eof' (a trick already done
 by 'nbd/client.c') that allows us to interrupt the operation and to
 know when recv_coroutine is yielding.
 With this in place, we delegate detaching the AIO context to the
 owning context with a BH ('nbd_aio_detach_bh') scheduled using
 'aio_wait_bh_oneshot'. This BH signals that we need to quiesce the
 channel by setting 'client->quiescing' to 'true', and either waits for
 the coroutine to finish using AIO_WAIT_WHILE or, if it's yielding in
 'nbd_read_eof', actively enters the coroutine to interrupt it.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1900326
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20201214170519.223781-4-slp@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit f148ae7d36cbb924447f4b528a94d7799836c749)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 nbd/server.c | 120 +++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 106 insertions(+), 14 deletions(-)
 diff --git a/nbd/server.c b/nbd/server.c
 index 613ed2634a..7229f487d2 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -132,6 +132,9 @@ struct NBDClient {
     CoMutex send_lock;
     Coroutine *send_coroutine;
 +    bool read_yielding;
 +    bool quiescing;
 +
     QTAILQ_ENTRY(NBDClient) next;
     int nb_requests;
     bool closing;
@@ -1352,14 +1355,60 @@ static coroutine_fn int nbd_negotiate(NBDClient *client, Error **errp)
     return 0;
 }
 -static int nbd_receive_request(QIOChannel *ioc, NBDRequest *request,
 +/* nbd_read_eof
 + * Tries to read @size bytes from @ioc. This is a local implementation of
 + * qio_channel_readv_all_eof. We have it here because we need it to be
 + * interruptible and to know when the coroutine is yielding.
 + * Returns 1 on success
 + *         0 on eof, when no data was read (errp is not set)
 + *         negative errno on failure (errp is set)
 + */
 +static inline int coroutine_fn
 +nbd_read_eof(NBDClient *client, void *buffer, size_t size, Error **errp)
 +{
 +    bool partial = false;
 +
 +    assert(size);
 +    while (size > 0) {
 +        struct iovec iov = { .iov_base = buffer, .iov_len = size };
 +        ssize_t len;
 +
 +        len = qio_channel_readv(client->ioc, &iov, 1, errp);
 +        if (len == QIO_CHANNEL_ERR_BLOCK) {
 +            client->read_yielding = true;
 +            qio_channel_yield(client->ioc, G_IO_IN);
 +            client->read_yielding = false;
 +            if (client->quiescing) {
 +                return -EAGAIN;
 +            }
 +            continue;
 +        } else if (len < 0) {
 +            return -EIO;
 +        } else if (len == 0) {
 +            if (partial) {
 +                error_setg(errp,
 +                           "Unexpected end-of-file before all bytes were read");
 +                return -EIO;
 +            } else {
 +                return 0;
 +            }
 +        }
 +
 +        partial = true;
 +        size -= len;
 +        buffer = (uint8_t *) buffer + len;
 +    }
 +    return 1;
 +}
 +
 +static int nbd_receive_request(NBDClient *client, NBDRequest *request,
                                Error **errp)
 {
     uint8_t buf[NBD_REQUEST_SIZE];
     uint32_t magic;
     int ret;
 -    ret = nbd_read(ioc, buf, sizeof(buf), "request", errp);
 +    ret = nbd_read_eof(client, buf, sizeof(buf), errp);
     if (ret < 0) {
         return ret;
     }
@@ -1480,11 +1529,37 @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
     QTAILQ_FOREACH(client, &exp->clients, next) {
         qio_channel_attach_aio_context(client->ioc, ctx);
 +
 +        assert(client->recv_coroutine == NULL);
 +        assert(client->send_coroutine == NULL);
 +
 +        if (client->quiescing) {
 +            client->quiescing = false;
 +            nbd_client_receive_next_request(client);
 +        }
 +    }
 +}
 +
 +static void nbd_aio_detach_bh(void *opaque)
 +{
 +    NBDExport *exp = opaque;
 +    NBDClient *client;
 +
 +    QTAILQ_FOREACH(client, &exp->clients, next) {
 +        qio_channel_detach_aio_context(client->ioc);
 +        client->quiescing = true;
 +
         if (client->recv_coroutine) {
 -            aio_co_schedule(ctx, client->recv_coroutine);
 +            if (client->read_yielding) {
 +                qemu_aio_coroutine_enter(exp->common.ctx,
 +                                         client->recv_coroutine);
 +            } else {
 +                AIO_WAIT_WHILE(exp->common.ctx, client->recv_coroutine != NULL);
 +            }
         }
 +
         if (client->send_coroutine) {
 -            aio_co_schedule(ctx, client->send_coroutine);
 +            AIO_WAIT_WHILE(exp->common.ctx, client->send_coroutine != NULL);
         }
     }
 }
@@ -1492,13 +1567,10 @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
 static void blk_aio_detach(void *opaque)
 {
     NBDExport *exp = opaque;
 -    NBDClient *client;
     trace_nbd_blk_aio_detach(exp->name, exp->common.ctx);
 -    QTAILQ_FOREACH(client, &exp->clients, next) {
 -        qio_channel_detach_aio_context(client->ioc);
 -    }
 +    aio_wait_bh_oneshot(exp->common.ctx, nbd_aio_detach_bh, exp);
     exp->common.ctx = NULL;
 }
@@ -2151,20 +2223,23 @@ static int nbd_co_send_bitmap(NBDClient *client, uint64_t handle,
 /* nbd_co_receive_request
  * Collect a client request. Return 0 if request looks valid, -EIO to drop
 - * connection right away, and any other negative value to report an error to
 - * the client (although the caller may still need to disconnect after reporting
 - * the error).
 + * connection right away, -EAGAIN to indicate we were interrupted and the
 + * channel should be quiesced, and any other negative value to report an error
 + * to the client (although the caller may still need to disconnect after
 + * reporting the error).
  */
 static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request,
                                   Error **errp)
 {
     NBDClient *client = req->client;
     int valid_flags;
 +    int ret;
     g_assert(qemu_in_coroutine());
     assert(client->recv_coroutine == qemu_coroutine_self());
 -    if (nbd_receive_request(client->ioc, request, errp) < 0) {
 -        return -EIO;
 +    ret = nbd_receive_request(client, request, errp);
 +    if (ret < 0) {
 +        return  ret;
     }
     trace_nbd_co_receive_request_decode_type(request->handle, request->type,
@@ -2507,6 +2582,17 @@ static coroutine_fn void nbd_trip(void *opaque)
         return;
     }
 +    if (client->quiescing) {
 +        /*
 +         * We're switching between AIO contexts. Don't attempt to receive a new
 +         * request and kick the main context which may be waiting for us.
 +         */
 +        nbd_client_put(client);
 +        client->recv_coroutine = NULL;
 +        aio_wait_kick();
 +        return;
 +    }
 +
     req = nbd_request_get(client);
     ret = nbd_co_receive_request(req, &request, &local_err);
     client->recv_coroutine = NULL;
@@ -2519,6 +2605,11 @@ static coroutine_fn void nbd_trip(void *opaque)
         goto done;
     }
 +    if (ret == -EAGAIN) {
 +        assert(client->quiescing);
 +        goto done;
 +    }
 +
     nbd_client_receive_next_request(client);
     if (ret == -EIO) {
         goto disconnect;
@@ -2565,7 +2656,8 @@ disconnect:
 static void nbd_client_receive_next_request(NBDClient *client)
 {
 -    if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS) {
 +    if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS &&
 +        !client->quiescing) {
         nbd_client_get(client);
         client->recv_coroutine = qemu_coroutine_create(nbd_trip, client);
         aio_co_schedule(client->exp->common.ctx, client->recv_coroutine);
 -- 
 2.27.0
--- a/kvm-pci-add-romsize-property.patch
+++ b/kvm-pci-add-romsize-property.patch
@ -1,137 +0,0 @@
 From aee681700e512679981e39928d8709eb226a4a6d Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Wed, 10 Feb 2021 17:04:45 -0300
 Subject: [PATCH 10/54] pci: add romsize property
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20210210170445.128304-3-peterx@redhat.com>
 Patchwork-id: 101041
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 2/2] pci: add romsize property
 Bugzilla: 1917830
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 From: Paolo Bonzini <pbonzini@redhat.com>
 This property can be useful for distros to set up known-good ROM sizes for
 migration purposes.  The VM will fail to start if the ROM is too large,
 and migration compatibility will not be broken if the ROM is too small.
 Note that even though romsize is a uint32_t, it has to be between 1
 (because empty ROM files are not accepted, and romsize must be greater
 than the file) and 2^31 (because values above are not powers of two and
 are rejected).
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20201218182736.1634344-1-pbonzini@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-Id: <20210203131828.156467-3-pbonzini@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: David Edmondson <david.edmondson@oracle.com>
 Acked-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 08b1df8ff463e72b0875538fb991d5393047606c)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 hw/pci/pci.c             | 19 +++++++++++++++++--
 hw/xen/xen_pt_load_rom.c | 14 ++++++++++++--
 include/hw/pci/pci.h     |  1 +
 3 files changed, 30 insertions(+), 4 deletions(-)
 diff --git a/hw/pci/pci.c b/hw/pci/pci.c
 index e4caad33c5..9619b8d068 100644
 --- a/hw/pci/pci.c
 +++ b/hw/pci/pci.c
@@ -67,6 +67,7 @@ static void pcibus_reset(BusState *qbus);
 static Property pci_props[] = {
     DEFINE_PROP_PCI_DEVFN("addr", PCIDevice, devfn, -1),
     DEFINE_PROP_STRING("romfile", PCIDevice, romfile),
 +    DEFINE_PROP_UINT32("romsize", PCIDevice, romsize, -1),
     DEFINE_PROP_UINT32("rombar",  PCIDevice, rom_bar, 1),
     DEFINE_PROP_BIT("multifunction", PCIDevice, cap_present,
                     QEMU_PCI_CAP_MULTIFUNCTION_BITNR, false),
@@ -2106,6 +2107,11 @@ static void pci_qdev_realize(DeviceState *qdev, Error **errp)
     bool is_default_rom;
     uint16_t class_id;
 +    if (pci_dev->romsize != -1 && !is_power_of_2(pci_dev->romsize)) {
 +        error_setg(errp, "ROM size %u is not a power of two", pci_dev->romsize);
 +        return;
 +    }
 +
     /* initialize cap_present for pci_is_express() and pci_config_size(),
      * Note that hybrid PCIs are not set automatically and need to manage
      * QEMU_PCI_CAP_EXPRESS manually */
@@ -2371,7 +2377,16 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
         g_free(path);
         return;
     }
 -    size = pow2ceil(size);
 +    if (pdev->romsize != -1) {
 +        if (size > pdev->romsize) {
 +            error_setg(errp, "romfile \"%s\" (%u bytes) is too large for ROM size %u",
 +                       pdev->romfile, (uint32_t)size, pdev->romsize);
 +            g_free(path);
 +            return;
 +        }
 +    } else {
 +        pdev->romsize = pow2ceil(size);
 +    }
     vmsd = qdev_get_vmsd(DEVICE(pdev));
@@ -2381,7 +2396,7 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
         snprintf(name, sizeof(name), "%s.rom", object_get_typename(OBJECT(pdev)));
     }
     pdev->has_rom = true;
 -    memory_region_init_rom(&pdev->rom, OBJECT(pdev), name, size, &error_fatal);
 +    memory_region_init_rom(&pdev->rom, OBJECT(pdev), name, pdev->romsize, &error_fatal);
     ptr = memory_region_get_ram_ptr(&pdev->rom);
     if (load_image_size(path, ptr, size) < 0) {
         error_setg(errp, "failed to load romfile \"%s\"", pdev->romfile);
 diff --git a/hw/xen/xen_pt_load_rom.c b/hw/xen/xen_pt_load_rom.c
 index a50a80837e..03422a8a71 100644
 --- a/hw/xen/xen_pt_load_rom.c
 +++ b/hw/xen/xen_pt_load_rom.c
@@ -53,10 +53,20 @@ void *pci_assign_dev_load_option_rom(PCIDevice *dev,
     }
     fseek(fp, 0, SEEK_SET);
 +    if (dev->romsize != -1) {
 +        if (st.st_size > dev->romsize) {
 +            error_report("ROM BAR \"%s\" (%ld bytes) is too large for ROM size %u",
 +                         rom_file, (long) st.st_size, dev->romsize);
 +            goto close_rom;
 +        }
 +    } else {
 +        dev->romsize = st.st_size;
 +    }
 +
     snprintf(name, sizeof(name), "%s.rom", object_get_typename(owner));
 -    memory_region_init_ram(&dev->rom, owner, name, st.st_size, &error_abort);
 +    memory_region_init_ram(&dev->rom, owner, name, dev->romsize, &error_abort);
     ptr = memory_region_get_ram_ptr(&dev->rom);
 -    memset(ptr, 0xff, st.st_size);
 +    memset(ptr, 0xff, dev->romsize);
     if (!fread(ptr, 1, st.st_size, fp)) {
         error_report("pci-assign: Cannot read from host %s", rom_file);
 diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
 index 72ce649eee..75a6b15757 100644
 --- a/include/hw/pci/pci.h
 +++ b/include/hw/pci/pci.h
@@ -343,6 +343,7 @@ struct PCIDevice {
     /* Location of option rom */
     char *romfile;
 +    uint32_t romsize;
     bool has_rom;
     MemoryRegion rom;
     uint32_t rom_bar;
 -- 
 2.27.0
--- a/kvm-pci-reject-too-large-ROMs.patch
+++ b/kvm-pci-reject-too-large-ROMs.patch
@ -1,89 +0,0 @@
 From a6e34aa76d86319d15355fd55fa6d12eb49a816f Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Wed, 10 Feb 2021 17:04:44 -0300
 Subject: [PATCH 09/54] pci: reject too large ROMs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20210210170445.128304-2-peterx@redhat.com>
 Patchwork-id: 101039
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/2] pci: reject too large ROMs
 Bugzilla: 1917830
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 From: Paolo Bonzini <pbonzini@redhat.com>
 get_image_size() returns an int64_t, which pci_add_option_rom() assigns
 to an "int" without any range checking.  A 32-bit BAR could be up to
 2 GiB in size, so reject anything above it.  In order to accomodate
 a rounded-up size of 2 GiB, change pci_patch_ids's size argument
 to unsigned.
 Conflicts:
  hw/pci/pci.c: missing 2c65db5e58d ("vl: extract softmmu/datadir.c") so
  there's no "#include <qemu/datadir.h>" yet
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-Id: <20210203131828.156467-2-pbonzini@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: David Edmondson <david.edmondson@oracle.com>
 (cherry picked from commit 7c16b5bbb6c0f797945327d17e4be60f25a4427d)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
 ---
 hw/pci/pci.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/hw/pci/pci.c b/hw/pci/pci.c
 index 0131d9d02c..e4caad33c5 100644
 --- a/hw/pci/pci.c
 +++ b/hw/pci/pci.c
@@ -24,6 +24,7 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 +#include "qemu/units.h"
 #include "hw/irq.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_bridge.h"
@@ -2256,7 +2257,7 @@ static uint8_t pci_find_capability_at_offset(PCIDevice *pdev, uint8_t offset)
 /* Patch the PCI vendor and device ids in a PCI rom image if necessary.
    This is needed for an option rom which is used for more than one device. */
 -static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, int size)
 +static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
 {
     uint16_t vendor_id;
     uint16_t device_id;
@@ -2314,7 +2315,7 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, int size)
 static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
                                Error **errp)
 {
 -    int size;
 +    int64_t size;
     char *path;
     void *ptr;
     char name[32];
@@ -2364,6 +2365,11 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
         error_setg(errp, "romfile \"%s\" is empty", pdev->romfile);
         g_free(path);
         return;
 +    } else if (size > 2 * GiB) {
 +        error_setg(errp, "romfile \"%s\" too large (size cannot exceed 2 GiB)",
 +                   pdev->romfile);
 +        g_free(path);
 +        return;
     }
     size = pow2ceil(size);
 -- 
 2.27.0
--- a/kvm-pcie-don-t-set-link-state-active-if-the-slot-is-empt.patch
+++ b/kvm-pcie-don-t-set-link-state-active-if-the-slot-is-empt.patch
@ -1,146 +0,0 @@
 From 20eb8dc4f6679e3325e1f1f434b17e2dc6a60eee Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 25 Feb 2021 21:42:47 -0500
 Subject: [PATCH 20/54] pcie: don't set link state active if the slot is empty
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20210225214247.1336554-1-lvivier@redhat.com>
 Patchwork-id: 101211
 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH] pcie: don't set link state active if the slot is empty
 Bugzilla: 1917654
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 RH-Acked-by: Alex Williamson <alex.williamson@redhat.com>
 BZ: https://bugzilla.redhat.com/1917654
 BRANCH: rhel-av-8.4.0
 UPSTREAM: Merged
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=35163495
 When the pcie slot is initialized, by default PCI_EXP_LNKSTA_DLLLA
 (Data Link Layer Link Active) is set in PCI_EXP_LNKSTA
 (Link Status) without checking if the slot is empty or not.
 This is confusing for the kernel because as it sees the link is up
 it tries to read the vendor ID and fails:
 (From https://bugzilla.kernel.org/show_bug.cgi?id=211691)
 [    1.661105] pcieport 0000:00:02.2: pciehp: Slot Capabilities      : 0x0002007b
 [    1.661115] pcieport 0000:00:02.2: pciehp: Slot Status            : 0x0010
 [    1.661123] pcieport 0000:00:02.2: pciehp: Slot Control           : 0x07c0
 [    1.661138] pcieport 0000:00:02.2: pciehp: Slot #0 AttnBtn+ PwrCtrl+ MRL- AttnInd+ PwrInd+ HotPlug+ Surprise+ Interlock+ NoCompl- IbPresDis- LLActRep+
 [    1.662581] pcieport 0000:00:02.2: pciehp: pciehp_get_power_status: SLOTCTRL 6c value read 7c0
 [    1.662597] pcieport 0000:00:02.2: pciehp: pciehp_check_link_active: lnk_status = 2204
 [    1.662703] pcieport 0000:00:02.2: pciehp: pending interrupts 0x0010 from Slot Status
 [    1.662706] pcieport 0000:00:02.2: pciehp: pcie_enable_notification: SLOTCTRL 6c write cmd 1031
 [    1.662730] pcieport 0000:00:02.2: pciehp: pciehp_check_link_active: lnk_status = 2204
 [    1.662748] pcieport 0000:00:02.2: pciehp: pciehp_check_link_active: lnk_status = 2204
 [    1.662750] pcieport 0000:00:02.2: pciehp: Slot(0-2): Link Up
 [    2.896132] pcieport 0000:00:02.2: pciehp: pciehp_check_link_status: lnk_status = 2204
 [    2.896135] pcieport 0000:00:02.2: pciehp: Slot(0-2): No device found
 [    2.896900] pcieport 0000:00:02.2: pciehp: pending interrupts 0x0010 from Slot Status
 [    2.896903] pcieport 0000:00:02.2: pciehp: pciehp_power_off_slot: SLOTCTRL 6c write cmd 400
 [    3.656901] pcieport 0000:00:02.2: pciehp: pending interrupts 0x0009 from Slot Status
 This is really a problem with virtio-net failover that hotplugs a VFIO
 card during the boot process. The kernel can shutdown the slot while
 QEMU is hotplugging it, and this likely ends by an automatic unplug of
 the card. At the end of the boot sequence the card has disappeared.
 To fix that, don't set the "Link Active" state in the init function, but
 rely on the plug function to do it, as the mechanism has already been
 introduced by 2f2b18f60bf1.
 Fixes: 2f2b18f60bf1 ("pcie: set link state inactive/active after hot unplug/plug")
 Cc: zhengxiang9@huawei.com
 Fixes: 3d67447fe7c2 ("pcie: Fill PCIESlot link fields to support higher speeds and widths")
 Cc: alex.williamson@redhat.com
 Fixes: b2101eae63ea ("pcie: Set the "link active" in the link status register")
 Cc: benh@kernel.crashing.org
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Message-Id: <20210212135250.2738750-5-lvivier@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit df72184ec15829053b3bb5a0d5801773b6d9ec25)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/pci/pcie.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)
 diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
 index d4010cf8f3..a733e2fb87 100644
 --- a/hw/pci/pcie.c
 +++ b/hw/pci/pcie.c
@@ -75,11 +75,6 @@ pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
                  QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1) |
                  QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT));
 -    if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
 -        pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
 -                                   PCI_EXP_LNKSTA_DLLLA);
 -    }
 -
     /* We changed link status bits over time, and changing them across
      * migrations is generally fine as hardware changes them too.
      * Let's not bother checking.
@@ -125,8 +120,7 @@ static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
          */
         pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKCAP,
                                    PCI_EXP_LNKCAP_DLLLARC);
 -        pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
 -                                   PCI_EXP_LNKSTA_DLLLA);
 +        /* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
         /*
          * Target Link Speed defaults to the highest link speed supported by
@@ -427,6 +421,7 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
     PCIDevice *hotplug_pdev = PCI_DEVICE(hotplug_dev);
     uint8_t *exp_cap = hotplug_pdev->config + hotplug_pdev->exp.exp_cap;
     PCIDevice *pci_dev = PCI_DEVICE(dev);
 +    uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
     /* Don't send event when device is enabled during qemu machine creation:
      * it is present on boot, no hotplug event is necessary. We do send an
@@ -434,7 +429,8 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
     if (!dev->hotplugged) {
         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
                                    PCI_EXP_SLTSTA_PDS);
 -        if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
 +        if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
 +            (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
                                        PCI_EXP_LNKSTA_DLLLA);
         }
@@ -448,7 +444,8 @@ void pcie_cap_slot_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
     if (pci_get_function_0(pci_dev)) {
         pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
                                    PCI_EXP_SLTSTA_PDS);
 -        if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
 +        if (pci_dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
 +            (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
             pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA,
                                        PCI_EXP_LNKSTA_DLLLA);
         }
@@ -640,6 +637,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
     uint32_t pos = dev->exp.exp_cap;
     uint8_t *exp_cap = dev->config + pos;
     uint16_t sltsta = pci_get_word(exp_cap + PCI_EXP_SLTSTA);
 +    uint32_t lnkcap = pci_get_long(exp_cap + PCI_EXP_LNKCAP);
     if (ranges_overlap(addr, len, pos + PCI_EXP_SLTSTA, 2)) {
         /*
@@ -695,7 +693,8 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
         pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
                                      PCI_EXP_SLTSTA_PDS);
 -        if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA) {
 +        if (dev->cap_present & QEMU_PCIE_LNKSTA_DLLLA ||
 +            (lnkcap & PCI_EXP_LNKCAP_DLLLARC)) {
             pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
                                          PCI_EXP_LNKSTA_DLLLA);
         }
 -- 
 2.27.0
--- a/Show More
+++ b/Show More