Rebase to qemu-kvm 4.2

2019-11-15 14:35:04 +00:00 · 2019-11-15 14:35:04 +00:00 · 48cefcd942
commit 48cefcd942
parent 32a3ac0fa9
75 changed files with 775 additions and 7713 deletions
--- a/.gitignore
+++ b/.gitignore
@ -2,3 +2,4 @@
 /qemu-4.0.0.tar.xz
 /qemu-4.1.0-rc4.tar.xz
 /qemu-4.1.0.tar.xz
 /qemu-4.2.0-rc1.tar.xz
--- a/0005-Initial-redhat-build.patch
+++ b/0005-Initial-redhat-build.patch
@ -1,4 +1,4 @@
-From faeb6cfa3f274d32bcaee546b9fb5f577f895c34 Mon Sep 17 00:00:00 2001
+From 8b38b3cb83404f47ba268958cec8121c674b8153 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
@ -13,7 +13,7 @@ several issues are fixed in QEMU tree:
 - Use "/share/qemu-kvm" as SHARE_SUFFIX
  - We reconfigured our share to qemu-kvm to be consistent with used name
-This rebase includes changes up to qemu-kvm-4.0.0-6.el8
+This rebase includes changes up to qemu-kvm-4.1.0-14.el8
 Rebase notes (3.1.0):
 - added new configure options
@ -30,20 +30,32 @@ Rebase notes (4.0.0):
 - Added interop documentation files
 - Use python module instead of qemu.py (upstream)
-Rebase notes (4.1.0-rc0):
+Rebase notes (4.1.0):
 - Remove edk2 files generated by build
 - Switch to rhel-8.1-candidate build target
 - Remove specs documentation
 - Switched from libssh2 to libssh
 - Add rc0 tarball usage hacks
 Rebase notes (4.1.0-rc1):
 - Added BuildRequires for wget, rpm-build and python3-sphinx
 Rebase notes (4.1.0-rc2):
 - Removed new unpacked files
 - Update configure line to use new options
 Rebase notes (weekly-190823):
 - Disable iotest run during make check
 Rebase notes (weekly-190906):
 - README renamed to README.rst (upstream)
 - Removed ui-spice-app.so
 Rebase notes (weekly-190913):
 - Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
 Rebase notes (weekly-190927):
 - Removed qemu-ga.8 install from spec file - installed by make
 Rebase notes (weekly-191011):
 - Removed spapr-rtas.bin (upstream)
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
@ -54,39 +66,44 @@ Merged patches (4.0.0):
 - eb204b5 Introduce the qemu-kvm-tests rpm
 - 223cf0c Load kvm module during boot (partial)
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - ebb6e97 redhat: Fix LOCALVERSION creation
 - b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
 - 7cb3c4a Enable libpmem to support nvdimm
 - 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 Merged patches (4.1.0-rc3):
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (weekly-190830):
 - 69e1fb2 enable virgla
 Merged patches (weekly-190906):
 - d4f6115 enable virgl, for real this time ...
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 .gitignore                        |    1 +
 Makefile                          |    3 +-
 configure                         |    1 +
 os-posix.c                        |    2 +-
- redhat/Makefile                   |   82 ++
+ redhat/Makefile                   |   82 +
 redhat/Makefile.common            |   51 +
 redhat/README.tests               |   39 +
- redhat/qemu-kvm.spec.template     | 2202 +++++++++++++++++++++++++++++
+ redhat/qemu-kvm.spec.template     | 2369 +++++++++++++++++++++++++++++
 redhat/scripts/process-patches.sh |    7 +-
 tests/Makefile.include            |    2 +-
 ui/vnc.c                          |    2 +-
- 10 files changed, 2382 insertions(+), 8 deletions(-)
+ 11 files changed, 2550 insertions(+), 9 deletions(-)
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 diff --git a/Makefile b/Makefile
-index 85862fb81a..288a5ac28a 100644
+index b437a346d7..086727dbb9 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -493,6 +493,7 @@ CAP_CFLAGS += -DCAPSTONE_HAS_ARM
+@@ -512,6 +512,7 @@ CAP_CFLAGS += -DCAPSTONE_HAS_ARM
 CAP_CFLAGS += -DCAPSTONE_HAS_ARM64
 CAP_CFLAGS += -DCAPSTONE_HAS_POWERPC
 CAP_CFLAGS += -DCAPSTONE_HAS_X86
@ -94,7 +111,7 @@ index 85862fb81a..288a5ac28a 100644
 .PHONY: capstone/all
 capstone/all: .git-submodule-status
-@@ -804,7 +805,7 @@ install-doc: $(DOCS) install-sphinxdocs
+@@ -826,7 +827,7 @@ install-doc: $(DOCS) install-sphinxdocs
 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.txt "$(DESTDIR)$(qemu_docdir)"
 ifdef CONFIG_POSIX
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
@ -104,7 +121,7 @@ index 85862fb81a..288a5ac28a 100644
 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
 	$(INSTALL_DATA) docs/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
 diff --git a/configure b/configure
-index 714e7fb6a1..4ecc861a43 100755
+index 6099be1d84..16564f8ccc 100755
 --- a/configure
 +++ b/configure
@@ -2424,6 +2424,7 @@ if test "$seccomp" != "no" ; then
@ -116,7 +133,7 @@ index 714e7fb6a1..4ecc861a43 100755
 # xen probe
 diff --git a/os-posix.c b/os-posix.c
-index 3ba7df8d75..ff26068d89 100644
+index 86cffd2c7d..1c9f86768d 100644
 --- a/os-posix.c
 +++ b/os-posix.c
@@ -83,7 +83,7 @@ void os_setup_signal_handling(void)
@ -128,11 +145,24 @@ index 3ba7df8d75..ff26068d89 100644
 #define BUILD_SUFFIX "/pc-bios"
 char *os_find_datadir(void)
 {
 diff --git a/tests/Makefile.include b/tests/Makefile.include
 index 8566f5f119..b483790cf3 100644
 --- a/tests/Makefile.include
 +++ b/tests/Makefile.include
@@ -1194,7 +1194,7 @@ check-acceptance: check-venv $(TESTS_RESULTS_DIR)
 check-qapi-schema: check-tests/qapi-schema/frontend check-tests/qapi-schema/doc-good.texi
 check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
 check-block: $(patsubst %,check-%, $(check-block-y))
 -check: check-block check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
 +check: check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
 check-clean:
 	rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
 	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y)) $(check-qtest-generic-y))
 diff --git a/ui/vnc.c b/ui/vnc.c
-index 38f92bfca3..933dc36db5 100644
+index 87b8045afe..ecf6276f5b 100644
 --- a/ui/vnc.c
 +++ b/ui/vnc.c
-@@ -3976,7 +3976,7 @@ void vnc_display_open(const char *id, Error **errp)
+@@ -3987,7 +3987,7 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_SASL
     if (sasl) {
@ -142,5 +172,5 @@ index 38f92bfca3..933dc36db5 100644
         if (saslErr != SASL_OK) {
             error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
-2.20.1
+2.21.0
--- a/0006-Enable-disable-devices-for-RHEL.patch
+++ b/0006-Enable-disable-devices-for-RHEL.patch
@ -1,4 +1,4 @@
-From 36dad4518633c16a975df51d4d3a475c346b8aed Mon Sep 17 00:00:00 2001
+From 067b5ced8f6f2ee7cd44cfe8e17021974f403206 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Mon, 11 Jan 2016 11:53:33 +0100
 Subject: Enable/disable devices for RHEL
@ -21,22 +21,20 @@ Rebase notes (4.0.0):
 - Switch to KConfig (upstream)
 - Using device whitelist + without-defualt-devices option
-Rebase notes (4.1.0-rc0):
+Rebase notes (4.1.0):
 - Added CONFIG_USB_OHCI_PCI for ppc64
 - Added CONFIG_XIVE_KVM for ppc64
 - Added CONFIG_ACPI_PCI for x86_64
 - Added CONFIG_SEMIHOSTING for aarch64
 Rebase notes (4.1.0-rc1):
 - Cleanup aarch64 devices
 - Do not build a15mpcore.c
 Rebase notes (4.1.0-rc2):
 - Removed ide-isa.c stub file
 Rebase notes (4.1.0-rc3):
 - Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
 Rebase notes (4.2.0-rc0):
 - Use conditional build for isa-superio.c (upstream change)
 - Rename PCI_PIIX to PCI_I440FX (upstream change)
 Merged patches (qemu 3.1.0):
 - d51e082 Re-enable CONFIG_HYPERV_TESTDEV
 - 4b889f3 Declare cirrus-vga as deprecated
@ -44,19 +42,27 @@ Merged patches (qemu 3.1.0):
 - 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
 - 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - 20a51f6 fdc: Revert downstream disablement of device "floppy"
 - f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
 - 5909721 aarch64: Compile out IOH3420
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 Merged patches (4.1.0-rc3):
 - 495a27d x86_64-rh-devices: add missing TPM passthrough
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (weekly-190823):
 - f7587dd RHEL: disable hostmem-memfd
 Conflicts:
 	hw/isa/Makefile.objs
 Conflicts:
 	hw/pci-host/i440fx.c
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 Makefile.objs                          |   4 +-
 backends/Makefile.objs                 |   3 +-
 default-configs/aarch64-rh-devices.mak |  20 +++++
 default-configs/aarch64-softmmu.mak    |  10 ++-
 default-configs/ppc64-rh-devices.mak   |  32 ++++++++
@ -70,16 +76,14 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 hw/arm/Makefile.objs                   |   2 +-
 hw/block/fdc.c                         |  10 +++
 hw/bt/Makefile.objs                    |   4 +-
 hw/core/Makefile.objs                  |   9 ++-
 hw/cpu/Makefile.objs                   |   5 +-
 hw/display/Makefile.objs               |   5 +-
 hw/display/cirrus_vga.c                |   3 +
 hw/i386/pc_piix.c                      |   2 +
 hw/ide/piix.c                          |   5 +-
 hw/input/pckbd.c                       |   2 +
 hw/isa/Makefile.objs                   |   2 +-
 hw/misc/Makefile.objs                  |   2 +-
 hw/net/e1000.c                         |   2 +
- hw/pci-host/piix.c                     |   4 +
+ hw/pci-host/i440fx.c                   |   4 +
 hw/ppc/spapr_cpu_core.c                |   2 +
 hw/usb/ccid-card-emulated.c            |   2 +
 hw/vfio/pci-quirks.c                   |   5 ++
@ -91,8 +95,9 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 target/ppc/cpu-models.c                |  10 +++
 target/s390x/cpu_models.c              |   3 +
 target/s390x/kvm.c                     |   8 ++
 util/memfd.c                           |   2 +-
 vl.c                                   |   8 +-
- 36 files changed, 316 insertions(+), 44 deletions(-)
+ 36 files changed, 314 insertions(+), 40 deletions(-)
 create mode 100644 default-configs/aarch64-rh-devices.mak
 create mode 100644 default-configs/ppc64-rh-devices.mak
 create mode 100644 default-configs/rh-virtio.mak
@ -100,7 +105,7 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 create mode 100644 default-configs/x86_64-rh-devices.mak
 diff --git a/Makefile.objs b/Makefile.objs
-index 6a143dcd57..8e96af153d 100644
+index 11ba1a36bd..fcf63e1096 100644
 --- a/Makefile.objs
 +++ b/Makefile.objs
@@ -65,8 +65,8 @@ common-obj-y += replay/
@ -114,6 +119,17 @@ index 6a143dcd57..8e96af153d 100644
 common-obj-y += dma-helpers.o
 common-obj-y += vl.o
 diff --git a/backends/Makefile.objs b/backends/Makefile.objs
 index f0691116e8..f328d404bf 100644
 --- a/backends/Makefile.objs
 +++ b/backends/Makefile.objs
@@ -16,4 +16,5 @@ endif
 common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_VIRTIO)) += vhost-user.o
 -common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
 +# RHEL: disable memfd
 +# common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
 diff --git a/default-configs/aarch64-rh-devices.mak b/default-configs/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..a1ed641174
@ -268,7 +284,7 @@ index f2287a133f..3e2e388e91 100644
 +include s390x-rh-devices.mak
 diff --git a/default-configs/x86_64-rh-devices.mak b/default-configs/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..6b5d68e155
+index 0000000000..d59b6d9bb5
 --- /dev/null
 +++ b/default-configs/x86_64-rh-devices.mak
@@ -0,0 +1,100 @@
@ -324,7 +340,7 @@ index 0000000000..6b5d68e155
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
-+CONFIG_PCI_PIIX=y
+CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
@ -384,10 +400,10 @@ index 64b2ee2960..b5de7e5279 100644
 +
 +include x86_64-rh-devices.mak
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index e53dfe1ee3..168a713eff 100644
+index 2034dd749e..ab203ad448 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
-@@ -446,8 +446,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
+@@ -449,8 +449,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
     pm->acpi_memory_hotplug.is_enabled = true;
     pm->cpu_hotplug_legacy = true;
@ -399,7 +415,7 @@ index e53dfe1ee3..168a713eff 100644
     object_property_add_uint32_ptr(obj, ACPI_PM_PROP_PM_IO_BASE,
 diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
-index 43ce8d5b19..13fc9502ff 100644
+index fe749f65fd..2aa1a9efdd 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
@@ -27,7 +27,7 @@ obj-$(CONFIG_VEXPRESS) += vexpress.o
@ -412,10 +428,10 @@ index 43ce8d5b19..13fc9502ff 100644
 obj-$(CONFIG_PXA2XX) += pxa2xx.o pxa2xx_gpio.o pxa2xx_pic.o
 obj-$(CONFIG_DIGIC) += digic.o
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index 9b24cb9b85..440b53b60c 100644
+index ac5d31e8c1..e925bac002 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
-@@ -43,6 +43,8 @@
+@@ -46,6 +46,8 @@
 #include "qemu/module.h"
 #include "trace.h"
@ -424,7 +440,7 @@ index 9b24cb9b85..440b53b60c 100644
 /********************************************************/
 /* debug Floppy devices */
-@@ -2635,6 +2637,14 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
+@@ -2638,6 +2640,14 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
     int i, j;
     static int command_tables_inited = 0;
@ -449,27 +465,6 @@ index 867a7d2e8a..e678e9ee3c 100644
 +#common-obj-y += core.o l2cap.o sdp.o hci.o hid.o
 +#common-obj-y += hci-csr.o
 diff --git a/hw/core/Makefile.objs b/hw/core/Makefile.objs
 index f8481d959f..bab9c2d443 100644
 --- a/hw/core/Makefile.objs
 +++ b/hw/core/Makefile.objs
@@ -17,11 +17,12 @@ common-obj-$(CONFIG_SOFTMMU) += machine.o
 common-obj-$(CONFIG_SOFTMMU) += loader.o
 common-obj-$(CONFIG_FITLOADER) += loader-fit.o
 common-obj-$(CONFIG_SOFTMMU) += qdev-properties-system.o
 -common-obj-$(CONFIG_SOFTMMU) += register.o
 -common-obj-$(CONFIG_SOFTMMU) += or-irq.o
 -common-obj-$(CONFIG_SOFTMMU) += split-irq.o
 +# Disabled in Red Hat Enterprise Linux
 +#common-obj-$(CONFIG_SOFTMMU) += register.o
 +#common-obj-$(CONFIG_SOFTMMU) += or-irq.o
 +#common-obj-$(CONFIG_SOFTMMU) += split-irq.o
 common-obj-$(CONFIG_PLATFORM_BUS) += platform-bus.o
 -common-obj-$(CONFIG_SOFTMMU) += generic-loader.o
 +#common-obj-$(CONFIG_SOFTMMU) += generic-loader.o
 common-obj-$(CONFIG_SOFTMMU) += null-machine.o
 obj-$(CONFIG_SOFTMMU) += machine-qmp-cmds.o
 diff --git a/hw/cpu/Makefile.objs b/hw/cpu/Makefile.objs
 index 8db9e8a7b3..1601ea93c7 100644
 --- a/hw/cpu/Makefile.objs
@ -484,7 +479,7 @@ index 8db9e8a7b3..1601ea93c7 100644
 +common-obj-y += core.o
 +# cluster.o
 diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
-index a64998fc7b..88a60b36c5 100644
+index f2182e3bef..3d0cda1b52 100644
 --- a/hw/display/Makefile.objs
 +++ b/hw/display/Makefile.objs
@@ -1,8 +1,9 @@
@ -500,10 +495,10 @@ index a64998fc7b..88a60b36c5 100644
 common-obj-$(CONFIG_ADS7846) += ads7846.o
 common-obj-$(CONFIG_VGA_CIRRUS) += cirrus_vga.o
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 2e4911a1e3..49c16c8f8b 100644
+index cd283e53b4..93afa26fda 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
-@@ -2973,6 +2973,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
+@@ -2975,6 +2975,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
@ -513,11 +508,25 @@ index 2e4911a1e3..49c16c8f8b 100644
      /* follow real hardware, cirrus card emulated has 4 MB video memory.
        Also accept 8 MB/16 MB for backward compatibility. */
      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2aefa3b8df..a19f8058ab 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -78,7 +78,9 @@ static void pc_init1(MachineState *machine,
     X86MachineState *x86ms = X86_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *system_io = get_system_io();
 +#ifdef CONFIG_IDE_ISA
     int i;
 +#endif
     PCIBus *pci_bus;
     ISABus *isa_bus;
     PCII440FXState *i440fx_state;
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
-index b97e555072..55b30e65ae 100644
+index db313dd3b1..e14858ca64 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
-@@ -253,7 +253,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
+@@ -251,7 +251,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
@ -527,7 +536,7 @@ index b97e555072..55b30e65ae 100644
 }
 static const TypeInfo piix3_ide_info = {
-@@ -280,6 +281,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
+@@ -279,6 +280,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
@ -537,10 +546,10 @@ index b97e555072..55b30e65ae 100644
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index 47a606f5e3..562a9bc0a6 100644
+index f0acfd86f7..390eb6579c 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -568,6 +568,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -571,6 +571,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->realize = i8042_realizefn;
     dc->vmsd = &vmstate_kbd_isa;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
@ -549,35 +558,11 @@ index 47a606f5e3..562a9bc0a6 100644
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/isa/Makefile.objs b/hw/isa/Makefile.objs
 index 9e106df186..0828964014 100644
 --- a/hw/isa/Makefile.objs
 +++ b/hw/isa/Makefile.objs
@@ -1,5 +1,5 @@
 common-obj-$(CONFIG_ISA_BUS) += isa-bus.o
 -common-obj-$(CONFIG_ISA_BUS) += isa-superio.o
 +#common-obj-$(CONFIG_ISA_BUS) += isa-superio.o
 common-obj-$(CONFIG_APM) += apm.o
 common-obj-$(CONFIG_I82378) += i82378.o
 common-obj-$(CONFIG_PC87312) += pc87312.o
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index e9aab519a1..17f94225a6 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -9,7 +9,7 @@ common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
 common-obj-$(CONFIG_EDU) += edu.o
 common-obj-$(CONFIG_PCA9552) += pca9552.o
 -common-obj-y += unimp.o
 +#common-obj-y += unimp.o
 common-obj-$(CONFIG_FW_CFG_DMA) += vmcoreinfo.o
 # ARM devices
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index a023ceb27c..15d6c7d3be 100644
+index a73f8d404e..fc73fdd6fa 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1794,6 +1794,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1795,6 +1795,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -585,7 +570,7 @@ index a023ceb27c..15d6c7d3be 100644
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1806,6 +1807,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1807,6 +1808,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -593,11 +578,11 @@ index a023ceb27c..15d6c7d3be 100644
 };
 static void e1000_register_types(void)
-diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
+diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
-index d9c70f7ce6..f294fbce6a 100644
+index f27131102d..17f10efae2 100644
--- a/hw/pci-host/piix.c
+--- a/hw/pci-host/i440fx.c
-+++ b/hw/pci-host/piix.c
+++ b/hw/pci-host/i440fx.c
-@@ -801,6 +801,7 @@ static const TypeInfo i440fx_info = {
+@@ -386,6 +386,7 @@ static const TypeInfo i440fx_info = {
     },
 };
@ -605,7 +590,7 @@ index d9c70f7ce6..f294fbce6a 100644
 /* IGD Passthrough Host Bridge. */
 typedef struct {
     uint8_t offset;
-@@ -884,6 +885,7 @@ static const TypeInfo igd_passthrough_i440fx_info = {
+@@ -469,6 +470,7 @@ static const TypeInfo igd_passthrough_i440fx_info = {
     .instance_size = sizeof(PCII440FXState),
     .class_init    = igd_passthrough_i440fx_class_init,
 };
@ -613,21 +598,21 @@ index d9c70f7ce6..f294fbce6a 100644
 static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
                                                 PCIBus *rootbus)
-@@ -929,7 +931,9 @@ static const TypeInfo i440fx_pcihost_info = {
+@@ -514,7 +516,9 @@ static const TypeInfo i440fx_pcihost_info = {
 static void i440fx_register_types(void)
 {
     type_register_static(&i440fx_info);
 +#if 0 /*  Disabled in Red Hat Enterprise Linux */
     type_register_static(&igd_passthrough_i440fx_info);
 +#endif
-     type_register_static(&piix3_pci_type_info);
+     type_register_static(&i440fx_pcihost_info);
-     type_register_static(&piix3_info);
+ }
-     type_register_static(&piix3_xen_info);
+ 
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 5621fb9a3d..b91a106074 100644
+index ef7b27a66d..ef034a1279 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -387,10 +387,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -408,10 +408,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
@ -641,10 +626,10 @@ index 5621fb9a3d..b91a106074 100644
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
-index e20f8ed293..0ddc26cb6c 100644
+index 291e41db8a..1c0f190f1b 100644
 --- a/hw/usb/ccid-card-emulated.c
 +++ b/hw/usb/ccid-card-emulated.c
-@@ -603,6 +603,8 @@ static void emulated_class_initfn(ObjectClass *klass, void *data)
+@@ -604,6 +604,8 @@ static void emulated_class_initfn(ObjectClass *klass, void *data)
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->desc = "emulated smartcard";
     dc->props = emulated_card_properties;
@ -654,10 +639,10 @@ index e20f8ed293..0ddc26cb6c 100644
 static const TypeInfo emulated_card_info = {
 diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
-index b35a640030..e8e7480c51 100644
+index 136f3a9ad6..d761fcaf75 100644
 --- a/hw/vfio/pci-quirks.c
 +++ b/hw/vfio/pci-quirks.c
-@@ -1386,6 +1386,8 @@ static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass, void *data)
+@@ -1391,6 +1391,8 @@ static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass, void *data)
     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
     dc->desc = "VFIO dummy ISA/LPC bridge for IGD assignment";
     dc->hotpluggable = false;
@ -666,7 +651,7 @@ index b35a640030..e8e7480c51 100644
     k->realize = vfio_pci_igd_lpc_bridge_realize;
     k->class_id = PCI_CLASS_BRIDGE_ISA;
 }
-@@ -1579,6 +1581,9 @@ static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
+@@ -1584,6 +1586,9 @@ static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
                                        0, PCI_DEVFN(0x2, 0))) {
         return;
     }
@ -677,10 +662,10 @@ index b35a640030..e8e7480c51 100644
     /*
      * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index d7a4e1875c..7c474a9d4a 100644
+index e6569a7968..5cff163334 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -3180,6 +3180,7 @@ static const TypeInfo vfio_pci_dev_info = {
+@@ -3200,6 +3200,7 @@ static const TypeInfo vfio_pci_dev_info = {
     },
 };
@ -688,7 +673,7 @@ index d7a4e1875c..7c474a9d4a 100644
 static Property vfio_pci_dev_nohotplug_properties[] = {
     DEFINE_PROP_BOOL("ramfb", VFIOPCIDevice, enable_ramfb, false),
     DEFINE_PROP_END_OF_LIST(),
-@@ -3199,11 +3200,15 @@ static const TypeInfo vfio_pci_nohotplug_dev_info = {
+@@ -3219,11 +3220,15 @@ static const TypeInfo vfio_pci_nohotplug_dev_info = {
     .instance_size = sizeof(VFIOPCIDevice),
     .class_init = vfio_pci_nohotplug_dev_class_init,
 };
@ -705,10 +690,10 @@ index d7a4e1875c..7c474a9d4a 100644
 type_init(register_vfio_pci_dev_type)
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 9621e934c0..6873f9e674 100644
+index 65c9473b73..fc17aca631 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -2024,11 +2024,6 @@ ETEXI
+@@ -2111,11 +2111,6 @@ ETEXI
 DEF("no-hpet", 0, QEMU_OPTION_no_hpet,
     "-no-hpet        disable HPET\n", QEMU_ARCH_I386)
@ -720,7 +705,7 @@ index 9621e934c0..6873f9e674 100644
 DEF("acpitable", HAS_ARG, QEMU_OPTION_acpitable,
     "-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]\n"
-@@ -3038,6 +3033,7 @@ STEXI
+@@ -3125,6 +3120,7 @@ STEXI
 ETEXI
 DEFHEADING()
@ -728,7 +713,7 @@ index 9621e934c0..6873f9e674 100644
 DEFHEADING(Bluetooth(R) options:)
 STEXI
 @table @option
-@@ -3116,6 +3112,7 @@ STEXI
+@@ -3203,6 +3199,7 @@ STEXI
 @end table
 ETEXI
 DEFHEADING()
@ -737,10 +722,10 @@ index 9621e934c0..6873f9e674 100644
 #ifdef CONFIG_TPM
 DEFHEADING(TPM device options:)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index ec2ab95dbe..7e7ccee45d 100644
+index 7a4ac9339b..3788fc3c4a 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -2702,7 +2702,9 @@ static void arm_cpu_register_types(void)
+@@ -2744,7 +2744,9 @@ static void arm_cpu_register_types(void)
     type_register_static(&idau_interface_type_info);
     while (info->name) {
@ -752,10 +737,10 @@ index ec2ab95dbe..7e7ccee45d 100644
     }
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 19751e37a7..47a1236e9f 100644
+index a624163ac2..ba5e9faeae 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
-@@ -1554,14 +1554,14 @@ static X86CPUDefinition builtin_x86_defs[] = {
+@@ -1807,14 +1807,14 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .family = 6,
         .model = 6,
         .stepping = 3,
@ -778,7 +763,7 @@ index 19751e37a7..47a1236e9f 100644
         .features[FEAT_8000_0001_ECX] =
             CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM,
         .xlevel = 0x8000000A,
-@@ -1790,6 +1790,25 @@ static X86CPUDefinition builtin_x86_defs[] = {
+@@ -2043,6 +2043,25 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "Intel(R) Atom(TM) CPU N270   @ 1.60GHz",
     },
@ -875,7 +860,7 @@ index 086548e9b9..1bbf378c18 100644
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 1d16d7d5e7..47188eddf4 100644
+index 7e92fb2e15..be718220d7 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -404,6 +404,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
@ -889,10 +874,10 @@ index 1d16d7d5e7..47188eddf4 100644
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
-index 6e814c230b..153d092d62 100644
+index 0c9d14b4b1..a02d569537 100644
 --- a/target/s390x/kvm.c
 +++ b/target/s390x/kvm.c
-@@ -2363,6 +2363,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2387,6 +2387,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
@ -907,11 +892,24 @@ index 6e814c230b..153d092d62 100644
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 diff --git a/util/memfd.c b/util/memfd.c
 index 4a3c07e0be..3303ec9da4 100644
 --- a/util/memfd.c
 +++ b/util/memfd.c
@@ -193,7 +193,7 @@ bool qemu_memfd_alloc_check(void)
  */
 bool qemu_memfd_check(unsigned int flags)
 {
 -#ifdef CONFIG_LINUX
 +#if 0 /* RHEL: memfd support disabled */
     int mfd = memfd_create("test", flags | MFD_CLOEXEC);
     if (mfd >= 0) {
 diff --git a/vl.c b/vl.c
-index b426b32134..f9166f509b 100644
+index 6a65a64bfd..668a34577e 100644
 --- a/vl.c
 +++ b/vl.c
-@@ -164,7 +164,7 @@ Chardev *parallel_hds[MAX_PARALLEL_PORTS];
+@@ -166,7 +166,7 @@ Chardev *parallel_hds[MAX_PARALLEL_PORTS];
 int win2k_install_hack = 0;
 int singlestep = 0;
 int acpi_enabled = 1;
@ -920,7 +918,7 @@ index b426b32134..f9166f509b 100644
 int fd_bootchk = 1;
 static int no_reboot;
 int no_shutdown = 0;
-@@ -912,6 +912,7 @@ static void configure_rtc(QemuOpts *opts)
+@@ -914,6 +914,7 @@ static void configure_rtc(QemuOpts *opts)
     }
 }
@ -928,7 +926,7 @@ index b426b32134..f9166f509b 100644
 /***********************************************************/
 /* Bluetooth support */
 static int nb_hcis;
-@@ -1033,6 +1034,7 @@ static int bt_parse(const char *opt)
+@@ -1035,6 +1036,7 @@ static int bt_parse(const char *opt)
     error_report("bad bluetooth parameter '%s'", opt);
     return 1;
 }
@ -936,7 +934,7 @@ index b426b32134..f9166f509b 100644
 static int parse_name(void *opaque, QemuOpts *opts, Error **errp)
 {
-@@ -3149,6 +3151,7 @@ int main(int argc, char **argv, char **envp)
+@@ -3128,6 +3130,7 @@ int main(int argc, char **argv, char **envp)
                 }
                 break;
 #endif
@ -944,7 +942,7 @@ index b426b32134..f9166f509b 100644
             case QEMU_OPTION_bt:
                 warn_report("The bluetooth subsystem is deprecated and will "
                             "be removed soon. If the bluetooth subsystem is "
-@@ -3156,6 +3159,7 @@ int main(int argc, char **argv, char **envp)
+@@ -3135,6 +3138,7 @@ int main(int argc, char **argv, char **envp)
                             "qemu-devel@nongnu.org with your usecase.");
                 add_device_config(DEV_BT, optarg);
                 break;
@ -952,7 +950,7 @@ index b426b32134..f9166f509b 100644
             case QEMU_OPTION_audio_help:
                 audio_legacy_help();
                 exit (0);
-@@ -4284,9 +4288,11 @@ int main(int argc, char **argv, char **envp)
+@@ -4282,9 +4286,11 @@ int main(int argc, char **argv, char **envp)
     tpm_init();
@ -965,5 +963,5 @@ index b426b32134..f9166f509b 100644
     if (!xen_enabled()) {
         /* On 32-bit hosts, QEMU is limited by virtual address space */
 -- 
-2.20.1
+2.21.0
--- a/0007-Machine-type-related-general-changes.patch
+++ b/0007-Machine-type-related-general-changes.patch
@ -1,4 +1,4 @@
-From 34edf0da6480f60393083de194d1a04cd2cfe5c7 Mon Sep 17 00:00:00 2001
+From 701a0ad0e6220c5cf9d860e3689f79f8154274bd Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@ -13,54 +13,52 @@ Rebase changes (4.0.0):
 - Remove e1000 device duplication changes to reflect upstream solution
 - Rewrite machine compat properties to upstream solution
-Rebase changes (4.1.0-rc0):
+Rebase changes (4.1.0):
 - Removed optional flag for machine compat properties (upstream)
 Rebase changes (4.1.0-rc1):
 - Remove c3e002cb chunk from hw/net/e1000.c
 Rebase changes (4.1.0-rc2):
 - Reorder compat structures
 - Use one format for compat scructures
 Rebase changes (4.1.0-rc4):
 - Added compat for virtio-balloon-pci.any_layout for rhel71
 Merged patches (4.0.0):
 - d4c0957 compat: Generic HW_COMPAT_RHEL7_6
 - cbac773 virtio: Make disable-legacy/disable-modern compat properties optional
-Merged patches (4.0.0-rc0):
+Merged patches (4.1.0):
 - 479ad30 redhat: fix cut'n'paste garbage in hw_compat comments
 - f19738e compat: Generic hw_compat_rhel_8_0
 Merged patches (weekly-190823):
 - 9f2bfaa machine types: Update hw_compat_rhel_8_0 from hw_compat_4_0
 - ca4a5e8 virtio: Make disable-legacy/disable-modern compat properties optional
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- hw/acpi/ich9.c          |  16 +++++
+ hw/acpi/ich9.c          |  16 ++++
- hw/acpi/piix4.c         |   6 +-
+ hw/acpi/piix4.c         |   5 +-
- hw/char/serial.c        |  16 +++++
+ hw/char/serial.c        |  16 ++++
- hw/core/machine.c       | 146 ++++++++++++++++++++++++++++++++++++++++
+ hw/core/machine.c       | 161 ++++++++++++++++++++++++++++++++++++++++
 hw/display/vga-isa.c    |   2 +-
 hw/net/e1000e.c         |  21 ++++++
 hw/net/rtl8139.c        |   4 +-
 hw/rtc/mc146818rtc.c    |   6 ++
 hw/smbios/smbios.c      |   1 +
 hw/timer/i8254_common.c |   2 +-
 hw/timer/mc146818rtc.c  |   6 ++
 hw/usb/hcd-uhci.c       |   4 +-
- hw/usb/hcd-xhci.c       |  20 ++++++
+ hw/usb/hcd-xhci.c       |  20 +++++
 hw/usb/hcd-xhci.h       |   2 +
 include/hw/acpi/ich9.h  |   3 +
 include/hw/boards.h     |  21 ++++++
- include/hw/usb.h        |   4 ++
+ include/hw/usb.h        |   4 +
 migration/migration.c   |   2 +
 migration/migration.h   |   5 ++
- 18 files changed, 274 insertions(+), 7 deletions(-)
+ 18 files changed, 289 insertions(+), 6 deletions(-)
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index 168a713eff..0a6346f1cf 100644
+index ab203ad448..7ec26884e8 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
-@@ -441,6 +441,18 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
+@@ -444,6 +444,18 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
     s->pm.enable_tco = value;
 }
@ -79,7 +77,7 @@ index 168a713eff..0a6346f1cf 100644
 void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
 {
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
-@@ -465,6 +477,10 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
+@@ -468,6 +480,10 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
                              ich9_pm_get_cpu_hotplug_legacy,
                              ich9_pm_set_cpu_hotplug_legacy,
                              NULL);
@ -91,19 +89,18 @@ index 168a713eff..0a6346f1cf 100644
                         ich9_pm_get_disable_s3,
                         ich9_pm_set_disable_s3,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index ec4e186cec..0d2c8e4fe3 100644
+index 93aec2dd2c..3a26193cbe 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -306,7 +306,7 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
+@@ -274,6 +274,7 @@ static const VMStateDescription vmstate_acpi = {
 static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
-    .minimum_version_id = 3,
+     .minimum_version_id = 3,
 +    .minimum_version_id = 2,
     .minimum_version_id_old = 1,
     .load_state_old = acpi_load_old,
     .post_load = vmstate_acpi_post_load,
-@@ -663,8 +663,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
+     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
@@ -627,8 +628,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
 static Property piix4_pm_properties[] = {
     DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
@ -115,18 +112,18 @@ index ec4e186cec..0d2c8e4fe3 100644
     DEFINE_PROP_BOOL("acpi-pci-hotplug-with-bridge-support", PIIX4PMState,
                      use_acpi_pci_hotplug, true),
 diff --git a/hw/char/serial.c b/hw/char/serial.c
-index 7c42a2abfc..ae63cc0104 100644
+index b4aa250950..0012f0e44d 100644
 --- a/hw/char/serial.c
 +++ b/hw/char/serial.c
-@@ -30,6 +30,7 @@
+@@ -34,6 +34,7 @@
- #include "qemu/timer.h"
+ #include "sysemu/runstate.h"
 #include "qemu/error-report.h"
 #include "trace.h"
 +#include "migration/migration.h"
 //#define DEBUG_SERIAL
-@@ -699,6 +700,9 @@ static int serial_post_load(void *opaque, int version_id)
+@@ -703,6 +704,9 @@ static int serial_post_load(void *opaque, int version_id)
 static bool serial_thr_ipending_needed(void *opaque)
 {
     SerialState *s = opaque;
@ -136,7 +133,7 @@ index 7c42a2abfc..ae63cc0104 100644
     if (s->ier & UART_IER_THRI) {
         bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
-@@ -780,6 +784,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
+@@ -784,6 +788,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
 static bool serial_fifo_timeout_timer_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -147,7 +144,7 @@ index 7c42a2abfc..ae63cc0104 100644
     return timer_pending(s->fifo_timeout_timer);
 }
-@@ -797,6 +805,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+@@ -801,6 +809,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
 static bool serial_timeout_ipending_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -158,7 +155,7 @@ index 7c42a2abfc..ae63cc0104 100644
     return s->timeout_ipending != 0;
 }
-@@ -814,6 +826,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
+@@ -818,6 +830,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
 static bool serial_poll_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
@ -170,10 +167,10 @@ index 7c42a2abfc..ae63cc0104 100644
 }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 32d1ca9abc..f30afe0f0b 100644
+index 1689ad3bf8..2b130bb585 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -27,6 +27,152 @@
+@@ -27,6 +27,167 @@
 #include "hw/pci/pci.h"
 #include "hw/mem/nvdimm.h"
@ -204,6 +201,20 @@ index 32d1ca9abc..f30afe0f0b 100644
 +    { "virtio-blk-device", "discard", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "write-zeroes", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "VGA",            "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "secondary-vga",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "bochs-display",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-gpu-pci", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
 +    { "pcie-root-port-base", "disable-acs", "true" },
 +};
 +const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
 +
@ -288,8 +299,9 @@ index 32d1ca9abc..f30afe0f0b 100644
 +        { "fw_cfg_mem", "dma_enabled", "off" },
 +        { "fw_cfg_io", "dma_enabled", "off" },
 +        { "isa-fdc", "fallback", "144" },
-+        { "virtio-pci", "disable-modern", "on" },
+        /* Optional because not all virtio-pci devices support legacy mode */
-+        { "virtio-pci", "disable-legacy", "off" },
+        { "virtio-pci", "disable-modern", "on", .optional = true },
 +        { "virtio-pci", "disable-legacy", "off", .optional = true },
 +        { TYPE_PCI_DEVICE, "x-pcie-lnksta-dllla", "off" },
 +        { "virtio-pci", "page-per-vq", "on" },
 +        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
@ -323,11 +335,11 @@ index 32d1ca9abc..f30afe0f0b 100644
 +};
 +const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +
- GlobalProperty hw_compat_4_0[] = {
+ GlobalProperty hw_compat_4_1[] = {
-     { "VGA",            "edid", "false" },
+     { "virtio-pci", "x-pcie-flr-init", "off" },
-     { "secondary-vga",  "edid", "false" },
+ };
 diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
-index 945952a9b0..db0681e891 100644
+index 873e5e9706..d1a2efe47e 100644
 --- a/hw/display/vga-isa.c
 +++ b/hw/display/vga-isa.c
@@ -82,7 +82,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
@ -340,10 +352,10 @@ index 945952a9b0..db0681e891 100644
 };
 diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
-index 581f7d03d5..9a8b1ed805 100644
+index b69fd7d8ad..d8be50a1ce 100644
 --- a/hw/net/e1000e.c
 +++ b/hw/net/e1000e.c
-@@ -76,6 +76,11 @@ typedef struct E1000EState {
+@@ -79,6 +79,11 @@ typedef struct E1000EState {
     E1000ECore core;
@ -355,7 +367,7 @@ index 581f7d03d5..9a8b1ed805 100644
 } E1000EState;
 #define E1000E_MMIO_IDX     0
-@@ -91,6 +96,10 @@ typedef struct E1000EState {
+@@ -94,6 +99,10 @@ typedef struct E1000EState {
 #define E1000E_MSIX_TABLE   (0x0000)
 #define E1000E_MSIX_PBA     (0x2000)
@ -366,7 +378,7 @@ index 581f7d03d5..9a8b1ed805 100644
 static uint64_t
 e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size)
 {
-@@ -302,6 +311,8 @@ e1000e_init_msix(E1000EState *s)
+@@ -305,6 +314,8 @@ e1000e_init_msix(E1000EState *s)
     } else {
         if (!e1000e_use_msix_vectors(s, E1000E_MSIX_VEC_NUM)) {
             msix_uninit(d, &s->msix, &s->msix);
@ -375,7 +387,7 @@ index 581f7d03d5..9a8b1ed805 100644
         }
     }
 }
-@@ -473,6 +484,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
+@@ -476,6 +487,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
     ret = msi_init(PCI_DEVICE(s), 0xD0, 1, true, false, NULL);
     if (ret) {
         trace_e1000e_msi_init_fail(ret);
@ -384,7 +396,7 @@ index 581f7d03d5..9a8b1ed805 100644
     }
     if (e1000e_add_pm_capability(pci_dev, e1000e_pmrb_offset,
-@@ -596,6 +609,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
+@@ -599,6 +612,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
     VMSTATE_STRUCT_ARRAY(_f, _s, _num, 0,                           \
                          e1000e_vmstate_intr_timer, E1000IntrDelayTimer)
@ -396,7 +408,7 @@ index 581f7d03d5..9a8b1ed805 100644
 static const VMStateDescription e1000e_vmstate = {
     .name = "e1000e",
     .version_id = 1,
-@@ -607,6 +625,7 @@ static const VMStateDescription e1000e_vmstate = {
+@@ -610,6 +628,7 @@ static const VMStateDescription e1000e_vmstate = {
         VMSTATE_MSIX(parent_obj, E1000EState),
         VMSTATE_UINT32(ioaddr, E1000EState),
@ -404,7 +416,7 @@ index 581f7d03d5..9a8b1ed805 100644
         VMSTATE_UINT32(core.rxbuf_min_shift, E1000EState),
         VMSTATE_UINT8(core.rx_desc_len, E1000EState),
         VMSTATE_UINT32_ARRAY(core.rxbuf_sizes, E1000EState,
-@@ -655,6 +674,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
+@@ -658,6 +677,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
 static Property e1000e_properties[] = {
     DEFINE_NIC_PROPERTIES(E1000EState, conf),
@ -414,10 +426,10 @@ index 581f7d03d5..9a8b1ed805 100644
                         e1000e_prop_disable_vnet, bool),
     DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 09273171e5..0cead119ab 100644
+index 88a97d756d..21d80e96cf 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
-@@ -3176,7 +3176,7 @@ static int rtl8139_pre_save(void *opaque)
+@@ -3177,7 +3177,7 @@ static int rtl8139_pre_save(void *opaque)
 static const VMStateDescription vmstate_rtl8139 = {
     .name = "rtl8139",
@ -426,7 +438,7 @@ index 09273171e5..0cead119ab 100644
     .minimum_version_id = 3,
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
-@@ -3257,7 +3257,9 @@ static const VMStateDescription vmstate_rtl8139 = {
+@@ -3258,7 +3258,9 @@ static const VMStateDescription vmstate_rtl8139 = {
         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
@ -436,44 +448,19 @@ index 09273171e5..0cead119ab 100644
         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
+diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
-index 7bcd67b098..dd0bc2b977 100644
+index ee6bf82b40..d704213824 100644
--- a/hw/smbios/smbios.c
+--- a/hw/rtc/mc146818rtc.c
-+++ b/hw/smbios/smbios.c
+++ b/hw/rtc/mc146818rtc.c
-@@ -778,6 +778,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
+@@ -42,6 +42,7 @@
     SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type1.product, product);
     SMBIOS_SET_DEFAULT(type1.version, version);
 +    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type2.product, product);
     SMBIOS_SET_DEFAULT(type2.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index 76ca6ec444..e7c87a9c67 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
@@ -270,7 +270,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/timer/mc146818rtc.c b/hw/timer/mc146818rtc.c
 index ce4550b6f2..777efe9819 100644
 --- a/hw/timer/mc146818rtc.c
 +++ b/hw/timer/mc146818rtc.c
@@ -37,6 +37,7 @@
 #include "qapi/qapi-events-misc-target.h"
 #include "qapi/visitor.h"
 #include "exec/address-spaces.h"
 #include "hw/rtc/mc146818rtc_regs.h"
 +#include "migration/migration.h"
 #ifdef TARGET_I386
- #include "hw/i386/apic.h"
+ #include "qapi/qapi-commands-misc-target.h"
-@@ -843,6 +844,11 @@ static int rtc_post_load(void *opaque, int version_id)
+@@ -819,6 +820,11 @@ static int rtc_post_load(void *opaque, int version_id)
 static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
 {
     RTCState *s = (RTCState *)opaque;
@ -485,11 +472,36 @@ index ce4550b6f2..777efe9819 100644
     return s->irq_reinject_on_ack_count != 0;
 }
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index 11d476c4a2..e6e9355384 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -777,6 +777,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
     SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type1.product, product);
     SMBIOS_SET_DEFAULT(type1.version, version);
 +    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type2.product, product);
     SMBIOS_SET_DEFAULT(type2.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index 050875b497..32935da46c 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
@@ -231,7 +231,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
-index 98bd5cf49d..2fd2a9bbf0 100644
+index 23507ad3b5..9fd87a7ad9 100644
 --- a/hw/usb/hcd-uhci.c
 +++ b/hw/usb/hcd-uhci.c
-@@ -1218,12 +1218,14 @@ static void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
+@@ -1219,12 +1219,14 @@ static void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
     UHCIState *s = UHCI(dev);
     uint8_t *pci_conf = s->dev.config;
     int i;
@ -506,10 +518,10 @@ index 98bd5cf49d..2fd2a9bbf0 100644
     if (s->masterbus) {
         USBPort *ports[NB_PORTS];
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 5894a18663..9854fae583 100644
+index 80988bb305..8fed2eedd6 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
-@@ -3584,9 +3584,27 @@ static const VMStateDescription vmstate_xhci_slot = {
+@@ -3590,9 +3590,27 @@ static const VMStateDescription vmstate_xhci_slot = {
     }
 };
@ -537,7 +549,7 @@ index 5894a18663..9854fae583 100644
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(type,   XHCIEvent),
         VMSTATE_UINT32(ccode,  XHCIEvent),
-@@ -3595,6 +3613,8 @@ static const VMStateDescription vmstate_xhci_event = {
+@@ -3601,6 +3619,8 @@ static const VMStateDescription vmstate_xhci_event = {
         VMSTATE_UINT32(flags,  XHCIEvent),
         VMSTATE_UINT8(slotid,  XHCIEvent),
         VMSTATE_UINT8(epid,    XHCIEvent),
@ -574,10 +586,10 @@ index 41568d1837..1a23ccc412 100644
 #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index a71d1a53a5..521c6252bf 100644
+index de45087f34..cc11116585 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -362,4 +362,25 @@ extern const size_t hw_compat_2_2_len;
+@@ -377,4 +377,25 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
@ -604,10 +616,10 @@ index a71d1a53a5..521c6252bf 100644
 +
 #endif
 diff --git a/include/hw/usb.h b/include/hw/usb.h
-index c21f41c8a9..71502b0bad 100644
+index c24d968a19..b353438ea0 100644
 --- a/include/hw/usb.h
 +++ b/include/hw/usb.h
-@@ -604,4 +604,8 @@ int usb_get_quirks(uint16_t vendor_id, uint16_t product_id,
+@@ -605,4 +605,8 @@ int usb_get_quirks(uint16_t vendor_id, uint16_t product_id,
                    uint8_t interface_class, uint8_t interface_subclass,
                    uint8_t interface_protocol);
@ -617,10 +629,10 @@ index c21f41c8a9..71502b0bad 100644
 +
 #endif
 diff --git a/migration/migration.c b/migration/migration.c
-index 8a607fe1e2..beffbfd6e1 100644
+index 354ad072fa..30c53c623b 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -116,6 +116,8 @@ enum mig_rp_message_type {
+@@ -121,6 +121,8 @@ enum mig_rp_message_type {
     MIG_RP_MSG_MAX
 };
@ -630,10 +642,10 @@ index 8a607fe1e2..beffbfd6e1 100644
    migrations at once.  For now we don't need to add
    dynamic creation of migration */
 diff --git a/migration/migration.h b/migration/migration.h
-index 1fdd7b21fd..b89e90199c 100644
+index 79b3dda146..0b1b0d4df5 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
-@@ -332,6 +332,11 @@ void init_dirty_bitmap_incoming_migration(void);
+@@ -335,6 +335,11 @@ void init_dirty_bitmap_incoming_migration(void);
 void migrate_add_address(SocketAddress *address);
 int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
@ -646,5 +658,5 @@ index 1fdd7b21fd..b89e90199c 100644
 #define qemu_ram_foreach_block \
   #warning "Use foreach_not_ignored_block in migration code"
 -- 
-2.20.1
+2.21.0
--- a/0008-Add-aarch64-machine-types.patch
+++ b/0008-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From cddb8f9ba14dba3bc5d37241924e84340a2b1f6a Mon Sep 17 00:00:00 2001
+From 5d044a17a88f2e6adc72e2b6579052e2a3e98e97 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -14,34 +14,37 @@ Rebase changes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 Rebase changes (weekly-190913):
 - Set numa_mem_supported
 Merged patches (4.0.0):
 - 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
 - 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
 - 4d20863 aarch64: Use 256MB ECAM region by default
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
 - 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- hw/arm/virt.c         | 144 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 145 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/arm/virt.h |  11 ++++
- 2 files changed, 154 insertions(+), 1 deletion(-)
+ 2 files changed, 155 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index d9496c9363..51fb5f82b4 100644
+index d4bedc2607..1892378914 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -65,6 +65,7 @@
+@@ -72,6 +72,7 @@
- #include "hw/acpi/acpi.h"
+ #include "hw/mem/nvdimm.h"
- #include "target/arm/internals.h"
+ #include "hw/acpi/generic_event_device.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -91,7 +92,49 @@
+@@ -98,7 +99,49 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@ -92,7 +95,7 @@ index d9496c9363..51fb5f82b4 100644
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -1722,6 +1765,7 @@ static void machvirt_init(MachineState *machine)
+@@ -1763,6 +1806,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -100,7 +103,7 @@ index d9496c9363..51fb5f82b4 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -1750,6 +1794,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -1791,6 +1835,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -108,15 +111,15 @@ index d9496c9363..51fb5f82b4 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -1871,6 +1916,7 @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
+@@ -1912,6 +1957,7 @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
     return ms->possible_cpus;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+ static void virt_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
-                                         DeviceState *dev, Error **errp)
+                                  Error **errp)
 {
-@@ -2146,3 +2192,99 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -2258,3 +2304,100 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -142,6 +145,7 @@ index d9496c9363..51fb5f82b4 100644
 +    mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
 +    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
 +    mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
 +    mc->numa_mem_supported = true;
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@ -217,10 +221,10 @@ index d9496c9363..51fb5f82b4 100644
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(8, 1, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index a72094204e..1baa48d46e 100644
+index 0b41083e9d..53fdf16563 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -137,6 +137,7 @@ typedef struct {
+@@ -142,6 +142,7 @@ typedef struct {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
@ -228,7 +232,7 @@ index a72094204e..1baa48d46e 100644
 #define TYPE_VIRT_MACHINE   MACHINE_TYPE_NAME("virt")
 #define VIRT_MACHINE(obj) \
     OBJECT_CHECK(VirtMachineState, (obj), TYPE_VIRT_MACHINE)
-@@ -145,6 +146,16 @@ typedef struct {
+@@ -150,6 +151,16 @@ typedef struct {
 #define VIRT_MACHINE_CLASS(klass) \
     OBJECT_CLASS_CHECK(VirtMachineClass, klass, TYPE_VIRT_MACHINE)
@ -246,5 +250,5 @@ index a72094204e..1baa48d46e 100644
 /* Return the number of used redistributor regions  */
 -- 
-2.20.1
+2.21.0
--- a/0009-Add-ppc64-machine-types.patch
+++ b/0009-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From 765586a71ea9b01f414e4662d11ea77288976f31 Mon Sep 17 00:00:00 2001
+From dbf2123f930a53e949cbeea7a272e453f3efe124 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -15,47 +15,66 @@ Rebase changes (4.0.0):
 - Use p8 as default for rhel machine types (p9 default upstream)
 - sPAPRMachineClass renamed to SpaprMachineClass (upstream)
-Rebase changes (4.1.0-rc2):
+Rebase changes (4.1.0):
 - Update format for compat structures
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
 - 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
 - 89f01da redhat: define pseries-rhel8.1.0 machine type
 Merged patches (weekly-190830):
 - bcba728 redhat: update pseries-rhel8.1.0 machine type
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- hw/ppc/spapr.c          | 243 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 251 ++++++++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_cpu_core.c |  13 +++
 include/hw/ppc/spapr.h  |   1 +
 target/ppc/compat.c     |  13 ++-
 target/ppc/cpu.h        |   1 +
- 5 files changed, 270 insertions(+), 1 deletion(-)
+ 5 files changed, 278 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 12ed4b065c..669eae100e 100644
+index 94f9d27096..59ccd182d4 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -4382,6 +4382,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4442,6 +4442,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
-     spapr_caps_add_properties(smc, &error_abort);
+     smc->linux_pci_probe = true;
-     smc->irq = &spapr_irq_dual;
+     smc->smp_threads_vsmt = true;
-     smc->dr_phb_enabled = true;
+     smc->nr_xirqs = SPAPR_NR_XIRQS;
 +    smc->has_power9_support = true;
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4426,6 +4427,7 @@ static const TypeInfo spapr_machine_info = {
+@@ -4486,6 +4487,7 @@ static const TypeInfo spapr_machine_info = {
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-4.1
+  * pseries-4.2
  */
-@@ -4609,6 +4611,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+@@ -4515,6 +4517,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
 +#endif
 /*
  * pseries-4.0
@@ -4531,6 +4534,7 @@ static void phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -4690,6 +4694,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
@ -63,7 +82,7 @@ index 12ed4b065c..669eae100e 100644
 static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
-@@ -4663,6 +4666,7 @@ static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+@@ -4744,6 +4749,7 @@ static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
 }
@ -71,7 +90,7 @@ index 12ed4b065c..669eae100e 100644
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4777,6 +4781,245 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -4858,6 +4864,251 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -90,7 +109,7 @@ index 12ed4b065c..669eae100e 100644
 +
 +/*
 + * pseries-rhel8.0.0
-+ * like spapr_compat_3_1
+ * like pseries-3.1 and pseries-4.0
 + * except SPAPR_CAP_CFPC, SPAPR_CAP_SBBC and SPAPR_CAP_IBS
 + * that have been backported to pseries-rhel8.0.0
 + */
@ -103,6 +122,12 @@ index 12ed4b065c..669eae100e 100644
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0,
 +                     hw_compat_rhel_8_0_len);
 +
 +    /* pseries-4.0 */
 +    smc->phb_placement = phb_placement_4_0;
 +    smc->irq = &spapr_irq_xics;
 +    smc->pre_4_1_migration = true;
 +
 +    /* pseries-3.1 */
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0");
 +    smc->update_dt_enabled = false;
 +    smc->dr_phb_enabled = false;
@ -318,18 +343,18 @@ index 12ed4b065c..669eae100e 100644
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index b91a106074..29a3c7d8ee 100644
+index ef034a1279..05f0a83128 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -21,6 +21,7 @@
+@@ -24,6 +24,7 @@
- #include "sysemu/numa.h"
+ #include "sysemu/reset.h"
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
 +#include "cpu-models.h"
- static void spapr_cpu_reset(void *opaque)
+ static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-@@ -224,6 +225,7 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -247,6 +248,7 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
     Error *local_err = NULL;
@ -337,7 +362,7 @@ index b91a106074..29a3c7d8ee 100644
     object_property_set_bool(OBJECT(cpu), true, "realized", &local_err);
     if (local_err) {
-@@ -236,6 +238,17 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -259,6 +261,17 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
     kvmppc_set_papr(cpu);
@ -352,16 +377,16 @@ index b91a106074..29a3c7d8ee 100644
 +        return;
 +    }
 +
-     qemu_register_reset(spapr_cpu_reset, cpu);
+     if (spapr_irq_cpu_intc_create(spapr, cpu, &local_err) < 0) {
-     spapr_cpu_reset(cpu);
+         goto error_intc_create;
- 
+     }
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index 60553d32c4..b0ba32e6dd 100644
+index d5ab5ea7b2..aa89cc4a95 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -121,6 +121,7 @@ struct SpaprMachineClass {
+@@ -125,6 +125,7 @@ struct SpaprMachineClass {
-     bool broken_host_serial_model; /* present real host info to the guest */
+     bool linux_pci_probe;
-     bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
+     bool smp_threads_vsmt; /* set VSMT to smp_threads by default */
 +    bool has_power9_support;
     void (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
@ -393,10 +418,10 @@ index 7de4bf3122..3e2e35342d 100644
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index c9beba2a5c..76cb7c2e37 100644
+index e3e82327b7..5c53801cfd 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1350,6 +1350,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1367,6 +1367,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -405,5 +430,5 @@ index c9beba2a5c..76cb7c2e37 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 -- 
-2.20.1
+2.21.0
--- a/0010-Add-s390x-machine-types.patch
+++ b/0010-Add-s390x-machine-types.patch
@ -1,4 +1,4 @@
-From 2ae1e5940185a169886f2492f97fc98a625da889 Mon Sep 17 00:00:00 2001
+From 18847aab397e7480af49e3a5cd4f6e3b7deae361 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@ -13,19 +13,23 @@ Rebase changes (weekly-190111):
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
 Merged patches (weekly-190830):
 - fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- hw/s390x/s390-virtio-ccw.c | 67 +++++++++++++++++++++++++++++++++++++-
+ hw/s390x/s390-virtio-ccw.c | 80 +++++++++++++++++++++++++++++++++++++-
- 1 file changed, 66 insertions(+), 1 deletion(-)
+ 1 file changed, 79 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 5b6a9a4e55..4d8c2ec22a 100644
+index d3edeef0ad..7bca634666 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -636,7 +636,7 @@ bool css_migration_enabled(void)
+@@ -615,7 +615,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
@ -34,15 +38,15 @@ index 5b6a9a4e55..4d8c2ec22a 100644
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = 1;                                               \
-@@ -660,6 +660,7 @@ bool css_migration_enabled(void)
+@@ -639,6 +639,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_4_1_instance_options(MachineState *machine)
+ static void ccw_machine_4_2_instance_options(MachineState *machine)
 {
 }
-@@ -873,6 +874,70 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -866,6 +867,83 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
@ -66,23 +70,36 @@ index 5b6a9a4e55..4d8c2ec22a 100644
 +};
 +const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 +
-+static void ccw_machine_rhel800_instance_options(MachineState *machine)
+static void ccw_machine_rhel810_instance_options(MachineState *machine)
 +{
 +}
 +
-+static void ccw_machine_rhel800_class_options(MachineClass *mc)
+static void ccw_machine_rhel810_class_options(MachineClass *mc)
 +{
 +}
-+DEFINE_CCW_MACHINE(rhel800, "rhel8.0.0", true);
+DEFINE_CCW_MACHINE(rhel810, "rhel8.1.0", true);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
-+    ccw_machine_rhel800_instance_options(machine);
+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel810_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
-+    ccw_machine_rhel800_class_options(mc);
+    ccw_machine_rhel810_class_options(mc);
 +    /* We never published the s390x version of RHEL8.0 AV, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_6, ccw_compat_rhel_7_6_len);
 +}
@ -114,5 +131,5 @@ index 5b6a9a4e55..4d8c2ec22a 100644
 static void ccw_machine_register_types(void)
 {
 -- 
-2.20.1
+2.21.0
--- a/0011-Add-x86_64-machine-types.patch
+++ b/0011-Add-x86_64-machine-types.patch
@ -1,4 +1,4 @@
-From 728953bda3fcd8bc06026b59b3b86191fb7787c0 Mon Sep 17 00:00:00 2001
+From 3f0ddfe3f8bc734af3f68884c01c58800ef42d0d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@ -13,10 +13,10 @@ Rebase changes (qemu-4.0.0):
 Rebase notes (3.1.0):
 - Removed xsave changes
-Rebase notes (4.1.0-rc2):
+Rebase notes (4.1.0):
 - Updated format for compat structures
-Merged patches (4.1.0-rc0):
+Merged patches (4.1.0):
 - f4dc802 pc: 7.5 compat entries
 - 456ed3e pc: PC_RHEL7_6_COMPAT
 - 04119ee pc: Add compat for pc-i440fx-rhel7.6.0 machine type
@ -26,23 +26,30 @@ Merged patches (4.1.0-rc0):
 - 18cf0d7 target/i386: Disable MPX support on named CPU models (partialy)
 - 2660667 rhel: Set host-phys-bits-limit=48 on rhel machine-types
 Merged patches (weekly-190823):
 - 7d5c2ef pc: Don't make die-id mandatory unless necessary
 - e42808c x86 machine types: pc_rhel_8_0_compat
 - 9de83a8 x86 machine types: q35: Fixup units_per_default_bus
 - 6df1559 x86 machine types: Fixup dynamic sysbus entries
 - 0784125 x86 machine types: add pc-q35-rhel8.1.0
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/acpi-build.c |   3 +
- hw/i386/pc.c         | 226 ++++++++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc.c         | 259 ++++++++++++++++++++++++++++++++++++++++++-
- hw/i386/pc_piix.c    | 200 +++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c    | 207 +++++++++++++++++++++++++++++++++-
- hw/i386/pc_q35.c     | 114 +++++++++++++++++++++-
+ hw/i386/pc_q35.c     | 139 ++++++++++++++++++++++-
 include/hw/boards.h  |   2 +
- include/hw/i386/pc.h |  27 ++++++
+ include/hw/i386/pc.h |  30 +++++
 target/i386/cpu.c    |   9 +-
 target/i386/kvm.c    |   4 +
- 8 files changed, 578 insertions(+), 7 deletions(-)
+ 8 files changed, 646 insertions(+), 7 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
-index f3fdfefcd5..1d64f0bad2 100644
+index 12ff55fcfb..64001893ab 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
-@@ -203,6 +203,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
+@@ -204,6 +204,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
         pm->fadt.reset_reg = r;
         pm->fadt.reset_val = 0xf;
         pm->fadt.flags |= 1 << ACPI_FADT_F_RESET_REG_SUP;
@ -53,10 +60,10 @@ index f3fdfefcd5..1d64f0bad2 100644
     }
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 549c437050..9ded0db80d 100644
+index 96715f8a3f..677b63a37f 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -354,6 +354,224 @@ GlobalProperty pc_compat_1_4[] = {
+@@ -344,6 +344,257 @@ GlobalProperty pc_compat_1_4[] = {
 };
 const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
@ -72,6 +79,39 @@ index 549c437050..9ded0db80d 100644
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_8_0_compat[] = {
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "intel-iommu", "dma-drain", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
 +};
 +const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
 +
 +/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
 + * all of the 2_12 stuff was already in 7.6 from bz 1481253
 + * x-migrate-smi-count comes from PC_COMPAT_2_11 but
@ -281,7 +321,7 @@ index 549c437050..9ded0db80d 100644
 void gsi_handler(void *opaque, int n, int level)
 {
     GSIState *s = opaque;
-@@ -1901,7 +2119,8 @@ void pc_memory_init(PCMachineState *pcms,
+@@ -1225,7 +1476,8 @@ void pc_memory_init(PCMachineState *pcms,
     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
                            &error_fatal);
@ -291,16 +331,16 @@ index 549c437050..9ded0db80d 100644
         memory_region_set_readonly(option_rom_mr, true);
     }
     memory_region_add_subregion_overlap(rom_memory,
-@@ -2928,6 +3147,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -2199,6 +2451,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->linuxboot_dma_enabled = true;
     pcmc->pvh_enabled = true;
     assert(!mc->get_hotplug_handler);
 +    pcmc->pc_rom_ro = true;
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
-     mc->cpu_index_to_instance_props = pc_cpu_index_to_props;
+     mc->hotplug_allowed = pc_hotplug_allowed;
-     mc->get_default_cpu_node_id = pc_get_default_cpu_node_id;
+     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -2938,7 +3159,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -2210,7 +2464,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->hot_add_cpu = pc_hot_add_cpu;
     mc->smp_parse = pc_smp_parse;
     mc->block_default_type = IF_IDE;
@ -308,13 +348,13 @@ index 549c437050..9ded0db80d 100644
 +    /* 240: max CPU count for RHEL */
 +    mc->max_cpus = 240;
     mc->reset = pc_machine_reset;
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
     hc->plug = pc_machine_device_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index c2280c72ef..c86c48c092 100644
+index a19f8058ab..a66005a0ec 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -51,6 +51,7 @@
+@@ -53,6 +53,7 @@
 #include "cpu.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@ -322,7 +362,7 @@ index c2280c72ef..c86c48c092 100644
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
-@@ -173,8 +174,8 @@ static void pc_init1(MachineState *machine,
+@@ -176,8 +177,8 @@ static void pc_init1(MachineState *machine,
     if (pcmc->smbios_defaults) {
         MachineClass *mc = MACHINE_GET_CLASS(machine);
         /* These values are guest ABI, do not change */
@ -333,15 +373,15 @@ index c2280c72ef..c86c48c092 100644
                             pcmc->smbios_uuid_encoded,
                             SMBIOS_ENTRY_POINT_21);
     }
-@@ -316,6 +317,7 @@ else {
+@@ -309,6 +310,7 @@ else {
-  * HW_COMPAT_*, PC_COMPAT_*, or * pc_*_machine_options().
+  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     PCMachineState *pcms = PC_MACHINE(machine);
-@@ -1022,3 +1024,197 @@ static void xenfv_machine_options(MachineClass *m)
+@@ -1028,3 +1030,204 @@ static void xenfv_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv", pc_xen_hvm_init,
                   xenfv_machine_options);
 #endif
@ -358,6 +398,7 @@ index c2280c72ef..c86c48c092 100644
 +    pcmc->default_nic_model = "e1000";
 +    m->default_display = "std";
 +    m->no_parallel = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    m->alias = "pc";
 +    m->is_default = 1;
@ -371,9 +412,15 @@ index c2280c72ef..c86c48c092 100644
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_machine_rhel7_options(m);
 +    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
 +    m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
@ -540,10 +587,10 @@ index c2280c72ef..c86c48c092 100644
 +DEFINE_PC_MACHINE(rhel700, "pc-i440fx-rhel7.0.0", pc_init_rhel700,
 +                  pc_machine_rhel700_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 397e1fdd2f..4959ed329f 100644
+index d51f524727..542947b032 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -198,8 +198,8 @@ static void pc_q35_init(MachineState *machine)
+@@ -197,8 +197,8 @@ static void pc_q35_init(MachineState *machine)
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
@ -554,7 +601,7 @@ index 397e1fdd2f..4959ed329f 100644
                             pcmc->smbios_uuid_encoded,
                             SMBIOS_ENTRY_POINT_21);
     }
-@@ -347,6 +347,7 @@ static void pc_q35_init(MachineState *machine)
+@@ -330,6 +330,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
@ -562,7 +609,7 @@ index 397e1fdd2f..4959ed329f 100644
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -538,3 +539,112 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -533,3 +534,137 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
@ -576,16 +623,34 @@ index 397e1fdd2f..4959ed329f 100644
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->default_nic_model = "e1000e";
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
 +    m->default_machine_opts = "firmware=bios-256k.bin";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_SYS_BUS_DEVICE);
+    pcmc->default_cpu_version = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
 +    m->max_cpus = 384;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
 +static void pc_q35_init_rhel810(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
 +                  pc_q35_machine_rhel810_options);
 +
 +static void pc_q35_init_rhel800(MachineState *machine)
 +{
 +    pc_q35_init(machine);
@ -593,8 +658,15 @@ index 397e1fdd2f..4959ed329f 100644
 +
 +static void pc_q35_machine_rhel800_options(MachineClass *m)
 +{
-+    pc_q35_machine_rhel_options(m);
+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel810_options(m);
 +    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
@ -676,10 +748,10 @@ index 397e1fdd2f..4959ed329f 100644
 +DEFINE_PC_MACHINE(q35_rhel730, "pc-q35-rhel7.3.0", pc_q35_init_rhel730,
 +                  pc_q35_machine_rhel730_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 521c6252bf..b4a8c4ab10 100644
+index cc11116585..3cc126f0f4 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -214,6 +214,8 @@ struct MachineClass {
+@@ -222,6 +222,8 @@ struct MachineClass {
     const char **valid_cpu_types;
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
@ -689,26 +761,29 @@ index 521c6252bf..b4a8c4ab10 100644
                                  int nb_nodes, ram_addr_t size);
     bool ignore_boot_device_suffixes;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 859b64c51d..605cc714d3 100644
+index e6fa8418ca..379ed968b3 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -142,6 +142,9 @@ typedef struct PCMachineClass {
+@@ -126,6 +126,9 @@ typedef struct PCMachineClass {
-     /* Enables contiguous-apic-ID mode */
+     /* use PVH to load kernels that support this feature */
-     bool compat_apic_id_mode;
+     bool pvh_enabled;
 +   
 +    /* RH only, see bz 1489800 */
 +    bool pc_rom_ro;
 } PCMachineClass;
 #define TYPE_PC_MACHINE "generic-pc-machine"
-@@ -362,6 +365,30 @@ extern const size_t pc_compat_1_5_len;
+@@ -302,6 +305,33 @@ extern const size_t pc_compat_1_5_len;
 extern GlobalProperty pc_compat_1_4[];
 extern const size_t pc_compat_1_4_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_0_compat[];
 +extern const size_t pc_rhel_8_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_6_compat[];
 +extern const size_t pc_rhel_7_6_compat_len;
 +
@ -734,10 +809,10 @@ index 859b64c51d..605cc714d3 100644
  * depending on QEMU versions up to QEMU 2.4.
  */
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 47a1236e9f..cd71a09b33 100644
+index ba5e9faeae..a4ae730ca5 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
-@@ -1548,11 +1548,17 @@ static CPUCaches epyc_cache_info = {
+@@ -1801,11 +1801,17 @@ static CPUCaches epyc_cache_info = {
 static X86CPUDefinition builtin_x86_defs[] = {
     {
@ -756,7 +831,7 @@ index 47a1236e9f..cd71a09b33 100644
         .stepping = 3,
         .features[FEAT_1_EDX] = CPUID_SSE2 | CPUID_SSE | CPUID_FXSR |
             CPUID_MMX | CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV |
-@@ -2861,6 +2867,7 @@ static PropValue kvm_default_props[] = {
+@@ -3173,6 +3179,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
@ -765,10 +840,10 @@ index 47a1236e9f..cd71a09b33 100644
 };
 diff --git a/target/i386/kvm.c b/target/i386/kvm.c
-index dbbb13772a..da5a5ef5f3 100644
+index bfd09bd441..da312a4801 100644
 --- a/target/i386/kvm.c
 +++ b/target/i386/kvm.c
-@@ -2805,6 +2805,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3064,6 +3064,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
@ -776,7 +851,7 @@ index dbbb13772a..da5a5ef5f3 100644
     kvm_msr_buf_reset(cpu);
-@@ -3102,6 +3103,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3370,6 +3371,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
@ -787,5 +862,5 @@ index dbbb13772a..da5a5ef5f3 100644
         case MSR_KVM_PV_EOI_EN:
             env->pv_eoi_en_msr = msrs[i].data;
 -- 
-2.20.1
+2.21.0
--- a/0012-Enable-make-check.patch
+++ b/0012-Enable-make-check.patch
@ -1,4 +1,4 @@
-From 70e14e50ec8652a4243111dc293fe09ebcef8de1 Mon Sep 17 00:00:00 2001
+From e8c1a5f4768a41cabdcb54cfdbc1a5a4146ff1ad Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:48:41 +0200
 Subject: Enable make check
@ -19,34 +19,35 @@ Rebase changes (4.1.0-rc0):
 Rebase changes (4.1.0-rc1):
 - remove all 205 tests (unstable)
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
 Conflicts:
 	tests/qemu-iotests/group
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- redhat/qemu-kvm.spec.template |  8 +++++++-
+ redhat/qemu-kvm.spec.template |  2 +-
 tests/Makefile.include        | 10 +++++-----
 tests/boot-serial-test.c      |  6 +++++-
 tests/cpu-plug-test.c         |  4 ++--
 tests/e1000-test.c            |  2 ++
 tests/hd-geo-test.c           |  4 ++++
 tests/prom-env-test.c         |  4 ++++
 tests/qemu-iotests/051        | 12 ++++++------
 tests/qemu-iotests/group      |  4 ++--
 tests/test-x86-cpuid-compat.c |  2 ++
 tests/usb-hcd-xhci-test.c     |  4 ++++
- 10 files changed, 39 insertions(+), 17 deletions(-)
+ 11 files changed, 37 insertions(+), 17 deletions(-)
 diff --git a/tests/Makefile.include b/tests/Makefile.include
-index fd7fdb8658..d3da940f8c 100644
+index b483790cf3..53bdbdfee0 100644
 --- a/tests/Makefile.include
 +++ b/tests/Makefile.include
-@@ -164,7 +164,7 @@ check-qtest-i386-y += tests/ide-test$(EXESUF)
+@@ -172,7 +172,7 @@ check-qtest-i386-y += tests/ide-test$(EXESUF)
 check-qtest-i386-y += tests/ahci-test$(EXESUF)
 check-qtest-i386-y += tests/hd-geo-test$(EXESUF)
 check-qtest-i386-y += tests/boot-order-test$(EXESUF)
@ -55,7 +56,7 @@ index fd7fdb8658..d3da940f8c 100644
 check-qtest-i386-$(CONFIG_SGA) += tests/boot-serial-test$(EXESUF)
 check-qtest-i386-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
 check-qtest-i386-y += tests/rtc-test$(EXESUF)
-@@ -223,7 +223,7 @@ check-qtest-mips64el-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
+@@ -230,7 +230,7 @@ check-qtest-mips64el-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
 check-qtest-moxie-y += tests/boot-serial-test$(EXESUF)
 check-qtest-ppc-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
@ -64,7 +65,7 @@ index fd7fdb8658..d3da940f8c 100644
 check-qtest-ppc-y += tests/prom-env-test$(EXESUF)
 check-qtest-ppc-y += tests/drive_del-test$(EXESUF)
 check-qtest-ppc-y += tests/boot-serial-test$(EXESUF)
-@@ -237,8 +237,8 @@ check-qtest-ppc64-$(CONFIG_PSERIES) += tests/rtas-test$(EXESUF)
+@@ -244,8 +244,8 @@ check-qtest-ppc64-$(CONFIG_PSERIES) += tests/rtas-test$(EXESUF)
 check-qtest-ppc64-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
 check-qtest-ppc64-$(CONFIG_USB_UHCI) += tests/usb-hcd-uhci-test$(EXESUF)
 check-qtest-ppc64-$(CONFIG_USB_XHCI_NEC) += tests/usb-hcd-xhci-test$(EXESUF)
@ -75,7 +76,7 @@ index fd7fdb8658..d3da940f8c 100644
 check-qtest-ppc64-$(CONFIG_RTL8139_PCI) += tests/test-filter-redirector$(EXESUF)
 check-qtest-ppc64-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
 check-qtest-ppc64-y += tests/numa-test$(EXESUF)
-@@ -282,7 +282,7 @@ check-qtest-s390x-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
+@@ -291,7 +291,7 @@ check-qtest-s390x-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
 check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
 check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-redirector$(EXESUF)
 check-qtest-s390x-y += tests/drive_del-test$(EXESUF)
@ -85,10 +86,10 @@ index fd7fdb8658..d3da940f8c 100644
 check-qtest-s390x-y += tests/cpu-plug-test$(EXESUF)
 check-qtest-s390x-y += tests/migration-test$(EXESUF)
 diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
-index 24852d4c7d..dce5860d99 100644
+index d3a54a0ba5..33ce72b89c 100644
 --- a/tests/boot-serial-test.c
 +++ b/tests/boot-serial-test.c
-@@ -97,18 +97,22 @@ static testdef_t tests[] = {
+@@ -108,19 +108,23 @@ static testdef_t tests[] = {
     { "ppc", "g3beige", "", "PowerPC,750" },
     { "ppc", "mac99", "", "PowerPC,G4" },
     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
@ -101,7 +102,8 @@ index 24852d4c7d..dce5860d99 100644
       "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken",
       "Open Firmware" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { "ppc64", "powernv", "-cpu POWER8", "OPAL" },
+     { "ppc64", "powernv8", "", "OPAL" },
     { "ppc64", "powernv9", "", "OPAL" },
     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
 +#endif
     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
@ -113,10 +115,10 @@ index 24852d4c7d..dce5860d99 100644
     { "sparc", "LX", "", "TMS390S10" },
     { "sparc", "SS-4", "", "MB86904" },
 diff --git a/tests/cpu-plug-test.c b/tests/cpu-plug-test.c
-index 668f00144e..453ca8e583 100644
+index 30e514bbfb..a04beae1c6 100644
 --- a/tests/cpu-plug-test.c
 +++ b/tests/cpu-plug-test.c
-@@ -190,8 +190,8 @@ static void add_pseries_test_case(const char *mname)
+@@ -185,8 +185,8 @@ static void add_pseries_test_case(const char *mname)
     char *path;
     PlugTestData *data;
@ -143,6 +145,38 @@ index c387984ef6..c89112d6f8 100644
 };
 static void *e1000_get_driver(void *obj, const char *interface)
 diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c
 index 7e86c5416c..cc068bad87 100644
 --- a/tests/hd-geo-test.c
 +++ b/tests/hd-geo-test.c
@@ -732,6 +732,7 @@ static void test_override_ide(void)
     test_override(args, expected);
 }
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
 static void test_override_scsi(void)
 {
     TestArgs *args = create_args();
@@ -776,6 +777,7 @@ static void test_override_scsi_2_controllers(void)
     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
     test_override(args, expected);
 }
 +#endif
 static void test_override_virtio_blk(void)
 {
@@ -951,9 +953,11 @@ int main(int argc, char **argv)
     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
     if (have_qemu_img()) {
         qtest_add_func("hd-geo/override/ide", test_override_ide);
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
         qtest_add_func("hd-geo/override/scsi_2_controllers",
                        test_override_scsi_2_controllers);
 +#endif
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/prom-env-test.c b/tests/prom-env-test.c
 index 61bc1d1e7b..028d45c7d7 100644
 --- a/tests/prom-env-test.c
@ -163,7 +197,7 @@ index 61bc1d1e7b..028d45c7d7 100644
         add_tests(sparc_machines);
     } else if (!strcmp(arch, "sparc64")) {
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
-index ce942a5444..f64429e21f 100755
+index 53bcdbc911..b387e0c233 100755
 --- a/tests/qemu-iotests/051
 +++ b/tests/qemu-iotests/051
@@ -181,11 +181,11 @@ run_qemu -drive if=virtio
@ -197,7 +231,7 @@ index ce942a5444..f64429e21f 100755
      *)
         ;;
 diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
-index f13e5f2e23..813db2565b 100644
+index 065040398d..959fb52824 100644
 --- a/tests/qemu-iotests/group
 +++ b/tests/qemu-iotests/group
@@ -92,7 +92,7 @@
@ -219,7 +253,7 @@ index f13e5f2e23..813db2565b 100644
 101 rw quick
 102 rw quick
 diff --git a/tests/test-x86-cpuid-compat.c b/tests/test-x86-cpuid-compat.c
-index e75b959950..6b46b73dd0 100644
+index 772287bdb4..e7c075ed98 100644
 --- a/tests/test-x86-cpuid-compat.c
 +++ b/tests/test-x86-cpuid-compat.c
@@ -300,6 +300,7 @@ int main(int argc, char **argv)
@ -239,26 +273,26 @@ index e75b959950..6b46b73dd0 100644
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
 diff --git a/tests/usb-hcd-xhci-test.c b/tests/usb-hcd-xhci-test.c
-index 9eb24b00e4..465ed26dfc 100644
+index 10ef9d2a91..3855873050 100644
 --- a/tests/usb-hcd-xhci-test.c
 +++ b/tests/usb-hcd-xhci-test.c
@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
-     usb_test_hotplug("xhci", "1", NULL);
+     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_usb_uas_hotplug(void)
 {
-     qtest_qmp_device_add("usb-uas", "uas", "{}");
+     QTestState *qts = global_qtest;
-@@ -34,6 +35,7 @@ static void test_usb_uas_hotplug(void)
+@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
-     qtest_qmp_device_del("scsihd");
+     qtest_qmp_device_del(qts, "scsihd");
-     qtest_qmp_device_del("uas");
+     qtest_qmp_device_del(qts, "uas");
 }
 +#endif
 static void test_usb_ccid_hotplug(void)
 {
-@@ -52,7 +54,9 @@ int main(int argc, char **argv)
+@@ -56,7 +58,9 @@ int main(int argc, char **argv)
     qtest_add_func("/xhci/pci/init", test_xhci_init);
     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
@ -269,5 +303,5 @@ index 9eb24b00e4..465ed26dfc 100644
     qtest_start("-device nec-usb-xhci,id=xhci"
 -- 
-2.20.1
+2.21.0
--- a/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From 59f231a2ac7d8915f905cec514de580bbbf039c0 Mon Sep 17 00:00:00 2001
+From 5ff7edc72cce5a04a816fd71b0198f2d530d6630 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -42,12 +42,12 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 7c474a9d4a..bb9f28ed95 100644
+index 5cff163334..5184011217 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -41,6 +41,9 @@
+@@ -47,6 +47,9 @@
- #define TYPE_VIFO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
+ #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 +/* RHEL only: Set once for the first assigned dev */
 +static uint16_t device_limit;
@ -55,7 +55,7 @@ index 7c474a9d4a..bb9f28ed95 100644
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
-@@ -2703,9 +2706,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2710,9 +2713,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     ssize_t len;
     struct stat st;
     int groupid;
@ -87,7 +87,7 @@ index 7c474a9d4a..bb9f28ed95 100644
     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3121,6 +3145,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3147,6 +3171,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -98,7 +98,7 @@ index 7c474a9d4a..bb9f28ed95 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 834a90d646..205954e9f8 100644
+index b329d50338..b37c81d882 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
@@ -135,6 +135,7 @@ typedef struct VFIOPCIDevice {
@ -110,5 +110,5 @@ index 834a90d646..205954e9f8 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.20.1
+2.21.0
--- a/0014-Add-support-statement-to-help-output.patch
+++ b/0014-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From 9176ac2bc13e273deab798ec95fc2a01f35db43d Mon Sep 17 00:00:00 2001
+From 339380067c7f385a9a6c368204e24193b630e78b Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -24,10 +24,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/vl.c b/vl.c
-index f9166f509b..dd1fadfe08 100644
+index 668a34577e..9f3e7e7733 100644
 --- a/vl.c
 +++ b/vl.c
-@@ -1803,9 +1803,17 @@ static void version(void)
+@@ -1822,9 +1822,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -45,7 +45,7 @@ index f9166f509b..dd1fadfe08 100644
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
             error_get_progname());
-@@ -1822,6 +1830,7 @@ static void help(int exitcode)
+@@ -1841,6 +1849,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
@ -54,5 +54,5 @@ index f9166f509b..dd1fadfe08 100644
 }
 -- 
-2.20.1
+2.21.0
--- a/0015-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/0015-globally-limit-the-maximum-number-of-CPUs.patch
@ -1,4 +1,4 @@
-From 11b7001f3eb0c4de20695821eaee5589c4c3ac32 Mon Sep 17 00:00:00 2001
+From 25283fab966a911cbeb4d0d3524cb1e0f1f8f448 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
@ -82,10 +82,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 2 files changed, 30 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index f450f25295..2d850df9e0 100644
+index 140b0bd8f6..7a4399c3ef 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -1869,6 +1869,18 @@ static int kvm_init(MachineState *ms)
+@@ -1925,6 +1925,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
@ -105,10 +105,10 @@ index f450f25295..2d850df9e0 100644
         if (nc->num > soft_vcpus_limit) {
             warn_report("Number of %s cpus requested (%d) exceeds "
 diff --git a/vl.c b/vl.c
-index dd1fadfe08..7c52255141 100644
+index 9f3e7e7733..1550aa2aaa 100644
 --- a/vl.c
 +++ b/vl.c
-@@ -132,6 +132,8 @@ int main(int argc, char **argv)
+@@ -134,6 +134,8 @@ int main(int argc, char **argv)
 #define MAX_VIRTIO_CONSOLES 1
@ -117,7 +117,7 @@ index dd1fadfe08..7c52255141 100644
 static const char *data_dir[16];
 static int data_dir_idx;
 const char *bios_name = NULL;
-@@ -1337,6 +1339,20 @@ static MachineClass *find_default_machine(GSList *machines)
+@@ -1339,6 +1341,20 @@ static MachineClass *find_default_machine(GSList *machines)
     return NULL;
 }
@ -138,7 +138,7 @@ index dd1fadfe08..7c52255141 100644
 static int machine_help_func(QemuOpts *opts, MachineState *machine)
 {
     ObjectProperty *prop;
-@@ -3864,6 +3880,8 @@ int main(int argc, char **argv, char **envp)
+@@ -3857,6 +3873,8 @@ int main(int argc, char **argv, char **envp)
                      "mutually exclusive");
         exit(EXIT_FAILURE);
     }
@ -148,5 +148,5 @@ index dd1fadfe08..7c52255141 100644
     configure_rtc(qemu_find_opts_singleton("rtc"));
 -- 
-2.20.1
+2.21.0
--- a/0016-Add-support-for-simpletrace.patch
+++ b/0016-Add-support-for-simpletrace.patch
@ -1,4 +1,4 @@
-From c32f0e6a6369ce5bc5c337b1fa158c43c067ca6f Mon Sep 17 00:00:00 2001
+From 850e66fc482eb897babd9e1f3d1216fd0f7c6382 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 8 Oct 2015 09:50:17 +0200
 Subject: Add support for simpletrace
@ -36,10 +36,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/Makefile b/Makefile
-index 288a5ac28a..8caca6cfc0 100644
+index 086727dbb9..4254950f7f 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -910,6 +910,10 @@ endif
+@@ -939,6 +939,10 @@ endif
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/keymaps/$$x "$(DESTDIR)$(qemu_datadir)/keymaps"; \
 	done
 	$(INSTALL_DATA) $(BUILD_DIR)/trace-events-all "$(DESTDIR)$(qemu_datadir)/trace-events-all"
@ -117,5 +117,5 @@ index 0000000000..c04abf9449
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 -- 
-2.20.1
+2.21.0
--- a/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,958 +0,0 @@
 From 70a20c03876ba38ba94a5e8e6e1d848e60ef42eb Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 30 Nov 2018 09:11:03 +0100
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 docs/qemu-block-drivers.texi |  70 +++++++++---------
 docs/qemu-cpu-models.texi    |   8 +-
 qemu-doc.texi                |  70 +++++++++---------
 qemu-options.hx              | 140 ++++++++++++++++++-----------------
 4 files changed, 146 insertions(+), 142 deletions(-)
 diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
 index 91ab0eceae..35cc3d838c 100644
 --- a/docs/qemu-block-drivers.texi
 +++ b/docs/qemu-block-drivers.texi
@@ -405,7 +405,7 @@ QEMU can automatically create a virtual FAT disk image from a
 directory tree. In order to use it, just type:
 @example
 -qemu-system-i386 linux.img -hdb fat:/my_directory
 +qemu-kvm linux.img -hdb fat:/my_directory
 @end example
 Then you access access to all the files in the @file{/my_directory}
@@ -415,14 +415,14 @@ them via SAMBA or NFS. The default access is @emph{read-only}.
 Floppies can be emulated with the @code{:floppy:} option:
 @example
 -qemu-system-i386 linux.img -fda fat:floppy:/my_directory
 +qemu-kvm linux.img -fda fat:floppy:/my_directory
 @end example
 A read/write support is available for testing (beta stage) with the
 @code{:rw:} option:
 @example
 -qemu-system-i386 linux.img -fda fat:floppy:rw:/my_directory
 +qemu-kvm linux.img -fda fat:floppy:rw:/my_directory
 @end example
 What you should @emph{never} do:
@@ -440,14 +440,14 @@ QEMU can access directly to block device exported using the Network Block Device
 protocol.
 @example
 -qemu-system-i386 linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
 +qemu-kvm linux.img -hdb nbd://my_nbd_server.mydomain.org:1024/
 @end example
 If the NBD server is located on the same host, you can use an unix socket instead
 of an inet socket:
 @example
 -qemu-system-i386 linux.img -hdb nbd+unix://?socket=/tmp/my_socket
 +qemu-kvm linux.img -hdb nbd+unix://?socket=/tmp/my_socket
 @end example
 In this case, the block device must be exported using qemu-nbd:
@@ -464,23 +464,23 @@ qemu-nbd --socket=/tmp/my_socket --share=2 my_disk.qcow2
 @noindent
 and then you can use it with two guests:
 @example
 -qemu-system-i386 linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
 -qemu-system-i386 linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
 +qemu-kvm linux1.img -hdb nbd+unix://?socket=/tmp/my_socket
 +qemu-kvm linux2.img -hdb nbd+unix://?socket=/tmp/my_socket
 @end example
 If the nbd-server uses named exports (supported since NBD 2.9.18, or with QEMU's
 own embedded NBD server), you must specify an export name in the URI:
 @example
 -qemu-system-i386 -cdrom nbd://localhost/debian-500-ppc-netinst
 -qemu-system-i386 -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
 +qemu-kvm -cdrom nbd://localhost/debian-500-ppc-netinst
 +qemu-kvm -cdrom nbd://localhost/openSUSE-11.1-ppc-netinst
 @end example
 The URI syntax for NBD is supported since QEMU 1.3.  An alternative syntax is
 also available.  Here are some example of the older syntax:
 @example
 -qemu-system-i386 linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
 -qemu-system-i386 linux2.img -hdb nbd:unix:/tmp/my_socket
 -qemu-system-i386 -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
 +qemu-kvm linux.img -hdb nbd:my_nbd_server.mydomain.org:1024
 +qemu-kvm linux2.img -hdb nbd:unix:/tmp/my_socket
 +qemu-kvm -cdrom nbd:localhost:10809:exportname=debian-500-ppc-netinst
 @end example
 @node disk_images_sheepdog
@@ -505,7 +505,7 @@ qemu-img convert @var{filename} sheepdog:///@var{image}
 You can boot from the Sheepdog disk image with the command:
 @example
 -qemu-system-i386 sheepdog:///@var{image}
 +qemu-kvm sheepdog:///@var{image}
 @end example
 You can also create a snapshot of the Sheepdog image like qcow2.
@@ -517,7 +517,7 @@ where @var{tag} is a tag name of the newly created snapshot.
 To boot from the Sheepdog snapshot, specify the tag name of the
 snapshot.
 @example
 -qemu-system-i386 sheepdog:///@var{image}#@var{tag}
 +qemu-kvm sheepdog:///@var{image}#@var{tag}
 @end example
 You can create a cloned image from the existing snapshot.
@@ -530,14 +530,14 @@ is its tag name.
 You can use an unix socket instead of an inet socket:
 @example
 -qemu-system-i386 sheepdog+unix:///@var{image}?socket=@var{path}
 +qemu-kvm sheepdog+unix:///@var{image}?socket=@var{path}
 @end example
 If the Sheepdog daemon doesn't run on the local host, you need to
 specify one of the Sheepdog servers to connect to.
 @example
 qemu-img create sheepdog://@var{hostname}:@var{port}/@var{image} @var{size}
 -qemu-system-i386 sheepdog://@var{hostname}:@var{port}/@var{image}
 +qemu-kvm sheepdog://@var{hostname}:@var{port}/@var{image}
 @end example
 @node disk_images_iscsi
@@ -627,7 +627,7 @@ cat >iscsi.conf <<EOF
   header-digest = "CRC32C"
 EOF
 -qemu-system-i386 -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
 +qemu-kvm -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
     -readconfig iscsi.conf
 @end example
@@ -646,7 +646,7 @@ tgtadm --lld iscsi --mode logicalunit --op new --tid 1 --lun 2 \
     -b /IMAGES/cd.iso --device-type=cd
 tgtadm --lld iscsi --op bind --mode target --tid 1 -I ALL
 -qemu-system-i386 -iscsi initiator-name=iqn.qemu.test:my-initiator \
 +qemu-kvm -iscsi initiator-name=iqn.qemu.test:my-initiator \
     -boot d -drive file=iscsi://127.0.0.1/iqn.qemu.test/1 \
     -cdrom iscsi://127.0.0.1/iqn.qemu.test/2
 @end example
@@ -659,11 +659,11 @@ GlusterFS is a user space distributed file system.
 You can boot from the GlusterFS disk image with the command:
 @example
 URI:
 -qemu-system-x86_64 -drive file=gluster[+@var{type}]://[@var{host}[:@var{port}]]/@var{volume}/@var{path}
 +qemu-kvm -drive file=gluster[+@var{type}]://[@var{host}[:@var{port}]]/@var{volume}/@var{path}
                                [?socket=...][,file.debug=9][,file.logfile=...]
 JSON:
 -qemu-system-x86_64 'json:@{"driver":"qcow2",
 +qemu-kvm 'json:@{"driver":"qcow2",
                            "file":@{"driver":"gluster",
                                     "volume":"testvol","path":"a.img","debug":9,"logfile":"...",
                                     "server":[@{"type":"tcp","host":"...","port":"..."@},
@@ -711,22 +711,22 @@ qemu-img create gluster://@var{host}/@var{volume}/@var{path} @var{size}
 Examples
 @example
 -qemu-system-x86_64 -drive file=gluster://1.2.3.4/testvol/a.img
 -qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4/testvol/a.img
 -qemu-system-x86_64 -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
 -qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
 -qemu-system-x86_64 -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
 -qemu-system-x86_64 -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
 -qemu-system-x86_64 -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
 -qemu-system-x86_64 -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
 -qemu-system-x86_64 -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
 -qemu-system-x86_64 'json:@{"driver":"qcow2",
 +qemu-kvm -drive file=gluster://1.2.3.4/testvol/a.img
 +qemu-kvm -drive file=gluster+tcp://1.2.3.4/testvol/a.img
 +qemu-kvm -drive file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
 +qemu-kvm -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
 +qemu-kvm -drive file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
 +qemu-kvm -drive file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
 +qemu-kvm -drive file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
 +qemu-kvm -drive file=gluster+rdma://1.2.3.4:24007/testvol/a.img
 +qemu-kvm -drive file=gluster://1.2.3.4/testvol/a.img,file.debug=9,file.logfile=/var/log/qemu-gluster.log
 +qemu-kvm 'json:@{"driver":"qcow2",
                            "file":@{"driver":"gluster",
                                     "volume":"testvol","path":"a.img",
                                     "debug":9,"logfile":"/var/log/qemu-gluster.log",
                                     "server":[@{"type":"tcp","host":"1.2.3.4","port":24007@},
                                               @{"type":"unix","socket":"/var/run/glusterd.socket"@}]@}@}'
 -qemu-system-x86_64 -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
 +qemu-kvm -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
                                        file.debug=9,file.logfile=/var/log/qemu-gluster.log,
                                        file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
                                        file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
@@ -739,13 +739,13 @@ You can access disk images located on a remote ssh server
 by using the ssh protocol:
 @example
 -qemu-system-x86_64 -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
 +qemu-kvm -drive file=ssh://[@var{user}@@]@var{server}[:@var{port}]/@var{path}[?host_key_check=@var{host_key_check}]
 @end example
 Alternative syntax using properties:
 @example
 -qemu-system-x86_64 -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
 +qemu-kvm -drive file.driver=ssh[,file.user=@var{user}],file.host=@var{server}[,file.port=@var{port}],file.path=@var{path}[,file.host_key_check=@var{host_key_check}]
 @end example
 @var{ssh} is the protocol.
@@ -808,13 +808,13 @@ driver.  For example:
 # echo 0000:06:0d.0 > /sys/bus/pci/devices/0000:06:0d.0/driver/unbind
 # echo 1102 0002 > /sys/bus/pci/drivers/vfio-pci/new_id
 -# qemu-system-x86_64 -drive file=nvme://@var{host}:@var{bus}:@var{slot}.@var{func}/@var{namespace}
 +# qemu-kvm -drive file=nvme://@var{host}:@var{bus}:@var{slot}.@var{func}/@var{namespace}
 @end example
 Alternative syntax using properties:
 @example
 -qemu-system-x86_64 -drive file.driver=nvme,file.device=@var{host}:@var{bus}:@var{slot}.@var{func},file.namespace=@var{namespace}
 +qemu-kvm -drive file.driver=nvme,file.device=@var{host}:@var{bus}:@var{slot}.@var{func},file.namespace=@var{namespace}
 @end example
 @var{host}:@var{bus}:@var{slot}.@var{func} is the NVMe controller's PCI device
 diff --git a/docs/qemu-cpu-models.texi b/docs/qemu-cpu-models.texi
 index ad040cfc98..0de3229e43 100644
 --- a/docs/qemu-cpu-models.texi
 +++ b/docs/qemu-cpu-models.texi
@@ -578,25 +578,25 @@ CPU models / features in QEMU and libvirt
 @item Host passthrough
 @example
 -   $ qemu-system-x86_64 -cpu host
 +   $ qemu-kvm -cpu host
 @end example
 With feature customization:
 @example
 -   $ qemu-system-x86_64 -cpu host,-vmx,...
 +   $ qemu-kvm -cpu host,-vmx,...
 @end example
 @item Named CPU models
 @example
 -   $ qemu-system-x86_64 -cpu Westmere
 +   $ qemu-kvm -cpu Westmere
 @end example
 With feature customization:
 @example
 -   $ qemu-system-x86_64 -cpu Westmere,+pcid,...
 +   $ qemu-kvm -cpu Westmere,+pcid,...
 @end example
 @end table
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index 577d1e8376..44427bb0e1 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -207,12 +207,12 @@ Note that, by default, GUS shares IRQ(7) with parallel ports and so
 QEMU must be told to not have parallel ports to have working GUS.
 @example
 -qemu-system-i386 dos.img -soundhw gus -parallel none
 +qemu-kvm dos.img -soundhw gus -parallel none
 @end example
 Alternatively:
 @example
 -qemu-system-i386 dos.img -device gus,irq=5
 +qemu-kvm dos.img -device gus,irq=5
 @end example
 Or some other unclaimed IRQ.
@@ -228,7 +228,7 @@ CS4231A is the chip used in Windows Sound System and GUSMAX products
 Download and uncompress the linux image (@file{linux.img}) and type:
 @example
 -qemu-system-i386 linux.img
 +qemu-kvm linux.img
 @end example
 Linux should boot and give you a prompt.
@@ -238,7 +238,7 @@ Linux should boot and give you a prompt.
 @example
 @c man begin SYNOPSIS
 -@command{qemu-system-i386} [@var{options}] [@var{disk_image}]
 +@command{qemu-kvm} [@var{options}] [@var{disk_image}]
 @c man end
 @end example
@@ -278,21 +278,21 @@ is specified in seconds. The default is 0 which means no timeout. Libiscsi
 Example (without authentication):
 @example
 -qemu-system-i386 -iscsi initiator-name=iqn.2001-04.com.example:my-initiator \
 +qemu-kvm -iscsi initiator-name=iqn.2001-04.com.example:my-initiator \
                  -cdrom iscsi://192.0.2.1/iqn.2001-04.com.example/2 \
                  -drive file=iscsi://192.0.2.1/iqn.2001-04.com.example/1
 @end example
 Example (CHAP username/password via URL):
 @example
 -qemu-system-i386 -drive file=iscsi://user%password@@192.0.2.1/iqn.2001-04.com.example/1
 +qemu-kvm -drive file=iscsi://user%password@@192.0.2.1/iqn.2001-04.com.example/1
 @end example
 Example (CHAP username/password via environment variables):
 @example
 LIBISCSI_CHAP_USERNAME="user" \
 LIBISCSI_CHAP_PASSWORD="password" \
 -qemu-system-i386 -drive file=iscsi://192.0.2.1/iqn.2001-04.com.example/1
 +qemu-kvm -drive file=iscsi://192.0.2.1/iqn.2001-04.com.example/1
 @end example
 @item NBD
@@ -307,12 +307,12 @@ Syntax for specifying a NBD device using Unix Domain Sockets
 Example for TCP
 @example
 -qemu-system-i386 --drive file=nbd:192.0.2.1:30000
 +qemu-kvm --drive file=nbd:192.0.2.1:30000
 @end example
 Example for Unix Domain Sockets
 @example
 -qemu-system-i386 --drive file=nbd:unix:/tmp/nbd-socket
 +qemu-kvm --drive file=nbd:unix:/tmp/nbd-socket
 @end example
 @item SSH
@@ -320,8 +320,8 @@ QEMU supports SSH (Secure Shell) access to remote disks.
 Examples:
 @example
 -qemu-system-i386 -drive file=ssh://user@@host/path/to/disk.img
 -qemu-system-i386 -drive file.driver=ssh,file.user=user,file.host=host,file.port=22,file.path=/path/to/disk.img
 +qemu-kvm -drive file=ssh://user@@host/path/to/disk.img
 +qemu-kvm -drive file.driver=ssh,file.user=user,file.host=host,file.port=22,file.path=/path/to/disk.img
 @end example
 Currently authentication must be done using ssh-agent.  Other
@@ -339,7 +339,7 @@ sheepdog[+tcp|+unix]://[host:port]/vdiname[?socket=path][#snapid|#tag]
 Example
 @example
 -qemu-system-i386 --drive file=sheepdog://192.0.2.1:30000/MyVirtualMachine
 +qemu-kvm --drive file=sheepdog://192.0.2.1:30000/MyVirtualMachine
 @end example
 See also @url{https://sheepdog.github.io/sheepdog/}.
@@ -365,17 +365,17 @@ JSON:
 Example
 @example
 URI:
 -qemu-system-x86_64 --drive file=gluster://192.0.2.1/testvol/a.img,
 +qemu-kvm --drive file=gluster://192.0.2.1/testvol/a.img,
 @                               file.debug=9,file.logfile=/var/log/qemu-gluster.log
 JSON:
 -qemu-system-x86_64 'json:@{"driver":"qcow2",
 +qemu-kvm 'json:@{"driver":"qcow2",
 @                          "file":@{"driver":"gluster",
 @                                   "volume":"testvol","path":"a.img",
 @                                   "debug":9,"logfile":"/var/log/qemu-gluster.log",
 @                                   "server":[@{"type":"tcp","host":"1.2.3.4","port":24007@},
 @                                             @{"type":"unix","socket":"/var/run/glusterd.socket"@}]@}@}'
 -qemu-system-x86_64 -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
 +qemu-kvm -drive driver=qcow2,file.driver=gluster,file.volume=testvol,file.path=/path/a.img,
 @                                      file.debug=9,file.logfile=/var/log/qemu-gluster.log,
 @                                      file.server.0.type=tcp,file.server.0.host=1.2.3.4,file.server.0.port=24007,
 @                                      file.server.1.type=unix,file.server.1.socket=/var/run/glusterd.socket
@@ -440,9 +440,9 @@ of <protocol>.
 Example: boot from a remote Fedora 20 live ISO image
 @example
 -qemu-system-x86_64 --drive media=cdrom,file=http://dl.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso,readonly
 +qemu-kvm --drive media=cdrom,file=http://dl.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso,readonly
 -qemu-system-x86_64 --drive media=cdrom,file.driver=http,file.url=http://dl.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso,readonly
 +qemu-kvm --drive media=cdrom,file.driver=http,file.url=http://dl.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso,readonly
 @end example
 Example: boot from a remote Fedora 20 cloud image using a local overlay for
@@ -450,7 +450,7 @@ writes, copy-on-read, and a readahead of 64k
 @example
 qemu-img create -f qcow2 -o backing_file='json:@{"file.driver":"http",, "file.url":"https://dl.fedoraproject.org/pub/fedora/linux/releases/20/Images/x86_64/Fedora-x86_64-20-20131211.1-sda.qcow2",, "file.readahead":"64k"@}' /tmp/Fedora-x86_64-20-20131211.1-sda.qcow2
 -qemu-system-x86_64 -drive file=/tmp/Fedora-x86_64-20-20131211.1-sda.qcow2,copy-on-read=on
 +qemu-kvm -drive file=/tmp/Fedora-x86_64-20-20131211.1-sda.qcow2,copy-on-read=on
 @end example
 Example: boot from an image stored on a VMware vSphere server with a self-signed
@@ -459,7 +459,7 @@ of 10 seconds.
 @example
 qemu-img create -f qcow2 -o backing_file='json:@{"file.driver":"https",, "file.url":"https://user:password@@vsphere.example.com/folder/test/test-flat.vmdk?dcPath=Datacenter&dsName=datastore1",, "file.sslverify":"off",, "file.readahead":"64k",, "file.timeout":10@}' /tmp/test.qcow2
 -qemu-system-x86_64 -drive file=/tmp/test.qcow2
 +qemu-kvm -drive file=/tmp/test.qcow2
 @end example
 @end table
@@ -826,7 +826,7 @@ On Linux hosts, a shared memory device is available.  The basic syntax
 is:
 @example
 -qemu-system-x86_64 -device ivshmem-plain,memdev=@var{hostmem}
 +qemu-kvm -device ivshmem-plain,memdev=@var{hostmem}
 @end example
 where @var{hostmem} names a host memory backend.  For a POSIX shared
@@ -847,7 +847,7 @@ memory server is:
 ivshmem-server -p @var{pidfile} -S @var{path} -m @var{shm-name} -l @var{shm-size} -n @var{vectors}
 # Then start your qemu instances with matching arguments
 -qemu-system-x86_64 -device ivshmem-doorbell,vectors=@var{vectors},chardev=@var{id}
 +qemu-kvm -device ivshmem-doorbell,vectors=@var{vectors},chardev=@var{id}
                  -chardev socket,path=@var{path},id=@var{id}
 @end example
@@ -872,7 +872,7 @@ Instead of specifying the <shm size> using POSIX shm, you may specify
 a memory backend that has hugepage support:
 @example
 -qemu-system-x86_64 -object memory-backend-file,size=1G,mem-path=/dev/hugepages/my-shmem-file,share,id=mb1
 +qemu-kvm -object memory-backend-file,size=1G,mem-path=/dev/hugepages/my-shmem-file,share,id=mb1
                  -device ivshmem-plain,memdev=mb1
 @end example
@@ -888,7 +888,7 @@ kernel testing.
 The syntax is:
 @example
 -qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
 +qemu-kvm -kernel arch/i386/boot/bzImage -hda root-2.4.20.img -append "root=/dev/hda"
 @end example
 Use @option{-kernel} to provide the Linux kernel image and
@@ -903,7 +903,7 @@ If you do not need graphical output, you can disable it and redirect
 the virtual serial port and the QEMU monitor to the console with the
 @option{-nographic} option. The typical command line is:
 @example
 -qemu-system-i386 -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
 +qemu-kvm -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
                  -append "root=/dev/hda console=ttyS0" -nographic
 @end example
@@ -969,7 +969,7 @@ Network adapter that supports CDC ethernet and RNDIS protocols.  @var{id}
 specifies a netdev defined with @code{-netdev @dots{},id=@var{id}}.
 For instance, user-mode networking can be used with
 @example
 -qemu-system-i386 [...] -netdev user,id=net0 -device usb-net,netdev=net0
 +qemu-kvm [...] -netdev user,id=net0 -device usb-net,netdev=net0
 @end example
 @item usb-ccid
 Smartcard reader device
@@ -988,7 +988,7 @@ no type is given, the HCI logic corresponds to @code{-bt hci,vlan=0}.
 This USB device implements the USB Transport Layer of HCI.  Example
 usage:
 @example
 -@command{qemu-system-i386} [...@var{OPTIONS}...] @option{-usbdevice} bt:hci,vlan=3 @option{-bt} device:keyboard,vlan=3
 +@command{qemu-kvm} [...@var{OPTIONS}...] @option{-usbdevice} bt:hci,vlan=3 @option{-bt} device:keyboard,vlan=3
 @end example
 @end table
@@ -1065,7 +1065,7 @@ For this setup it is recommended to restrict it to listen on a UNIX domain
 socket only. For example
 @example
 -qemu-system-i386 [...OPTIONS...] -vnc unix:/home/joebloggs/.qemu-myvm-vnc
 +qemu-kvm [...OPTIONS...] -vnc unix:/home/joebloggs/.qemu-myvm-vnc
 @end example
 This ensures that only users on local box with read/write access to that
@@ -1088,7 +1088,7 @@ is running the password is set with the monitor. Until the monitor is used to
 set the password all clients will be rejected.
 @example
 -qemu-system-i386 [...OPTIONS...] -vnc :1,password -monitor stdio
 +qemu-kvm [...OPTIONS...] -vnc :1,password -monitor stdio
 (qemu) change vnc password
 Password: ********
 (qemu)
@@ -1105,7 +1105,7 @@ support provides a secure session, but no authentication. This allows any
 client to connect, and provides an encrypted session.
 @example
 -qemu-system-i386 [...OPTIONS...] \
 +qemu-kvm [...OPTIONS...] \
   -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=no \
   -vnc :1,tls-creds=tls0 -monitor stdio
 @end example
@@ -1127,7 +1127,7 @@ same syntax as previously, but with @code{verify-peer} set to @code{yes}
 instead.
 @example
 -qemu-system-i386 [...OPTIONS...] \
 +qemu-kvm [...OPTIONS...] \
   -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
   -vnc :1,tls-creds=tls0 -monitor stdio
 @end example
@@ -1140,7 +1140,7 @@ Finally, the previous method can be combined with VNC password authentication
 to provide two layers of authentication for clients.
 @example
 -qemu-system-i386 [...OPTIONS...] \
 +qemu-kvm [...OPTIONS...] \
   -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
   -vnc :1,tls-creds=tls0,password -monitor stdio
 (qemu) change vnc password
@@ -1165,7 +1165,7 @@ used for authentication, but assuming use of one supporting SSF,
 then QEMU can be launched with:
 @example
 -qemu-system-i386 [...OPTIONS...] -vnc :1,sasl -monitor stdio
 +qemu-kvm [...OPTIONS...] -vnc :1,sasl -monitor stdio
 @end example
 @node vnc_sec_certificate_sasl
@@ -1179,7 +1179,7 @@ credentials. This can be enabled, by combining the 'sasl' option
 with the aforementioned TLS + x509 options:
 @example
 -qemu-system-i386 [...OPTIONS...] \
 +qemu-kvm [...OPTIONS...] \
   -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \
   -vnc :1,tls-creds=tls0,sasl -monitor stdio
 @end example
@@ -1574,7 +1574,7 @@ QEMU has a primitive support to work with gdb, so that you can do
 In order to use gdb, launch QEMU with the '-s' option. It will wait for a
 gdb connection:
 @example
 -qemu-system-i386 -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
 +qemu-kvm -s -kernel arch/i386/boot/bzImage -hda root-2.4.20.img \
                     -append "root=/dev/hda"
 Connected to host network interface: tun0
 Waiting gdb connection on port 1234
@@ -1820,7 +1820,7 @@ Set the initial VGA graphic mode. The default is 800x600x32.
 Set OpenBIOS variables in NVRAM, for example:
 @example
 -qemu-system-ppc -prom-env 'auto-boot?=false' \
 +qemu-kvm -prom-env 'auto-boot?=false' \
  -prom-env 'boot-device=hd:2,\yaboot' \
  -prom-env 'boot-args=conf=hd:2,\yaboot.conf'
 @end example
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 6873f9e674..9f323ec2a2 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -254,7 +254,7 @@ This option defines a free-form string that can be used to describe @var{fd}.
 You can open an image using pre-opened file descriptors from an fd set:
 @example
 -qemu-system-i386
 +qemu-kvm
 -add-fd fd=3,set=2,opaque="rdwr:/path/to/file"
 -add-fd fd=4,set=2,opaque="rdonly:/path/to/file"
 -drive file=/dev/fdset/2,index=0,media=disk
@@ -283,7 +283,7 @@ STEXI
 Set default value of @var{driver}'s property @var{prop} to @var{value}, e.g.:
 @example
 -qemu-system-i386 -global ide-hd.physical_block_size=4096 disk-image.img
 +qemu-kvm -global ide-hd.physical_block_size=4096 disk-image.img
 @end example
 In particular, you can use this to set driver properties for devices which are
@@ -337,11 +337,11 @@ bootindex options. The default is non-strict boot.
 @example
 # try to boot from network first, then from hard disk
 -qemu-system-i386 -boot order=nc
 +qemu-kvm -boot order=nc
 # boot from CD-ROM first, switch back to default order after reboot
 -qemu-system-i386 -boot once=d
 +qemu-kvm -boot once=d
 # boot with a splash picture for 5 seconds.
 -qemu-system-i386 -boot menu=on,splash=/root/boot.bmp,splash-time=5000
 +qemu-kvm -boot menu=on,splash=/root/boot.bmp,splash-time=5000
 @end example
 Note: The legacy format '-boot @var{drives}' is still supported but its
@@ -370,7 +370,7 @@ For example, the following command-line sets the guest startup RAM size to
 memory the guest can reach to 4GB:
 @example
 -qemu-system-x86_64 -m 1G,slots=3,maxmem=4G
 +qemu-kvm -m 1G,slots=3,maxmem=4G
 @end example
 If @var{slots} and @var{maxmem} are not specified, memory hotplug won't
@@ -669,12 +669,12 @@ Enable audio and selected sound hardware. Use 'help' to print all
 available sound hardware.
 @example
 -qemu-system-i386 -soundhw sb16,adlib disk.img
 -qemu-system-i386 -soundhw es1370 disk.img
 -qemu-system-i386 -soundhw ac97 disk.img
 -qemu-system-i386 -soundhw hda disk.img
 -qemu-system-i386 -soundhw all disk.img
 -qemu-system-i386 -soundhw help
 +qemu-kvm -soundhw sb16,adlib disk.img
 +qemu-kvm -soundhw es1370 disk.img
 +qemu-kvm -soundhw ac97 disk.img
 +qemu-kvm -soundhw hda disk.img
 +qemu-kvm -soundhw all disk.img
 +qemu-kvm -soundhw help
 @end example
 Note that Linux's i810_audio OSS kernel (for AC97) module might
@@ -1149,21 +1149,21 @@ is off.
 Instead of @option{-cdrom} you can use:
 @example
 -qemu-system-i386 -drive file=file,index=2,media=cdrom
 +qemu-kvm -drive file=file,index=2,media=cdrom
 @end example
 Instead of @option{-hda}, @option{-hdb}, @option{-hdc}, @option{-hdd}, you can
 use:
 @example
 -qemu-system-i386 -drive file=file,index=0,media=disk
 -qemu-system-i386 -drive file=file,index=1,media=disk
 -qemu-system-i386 -drive file=file,index=2,media=disk
 -qemu-system-i386 -drive file=file,index=3,media=disk
 +qemu-kvm -drive file=file,index=0,media=disk
 +qemu-kvm -drive file=file,index=1,media=disk
 +qemu-kvm -drive file=file,index=2,media=disk
 +qemu-kvm -drive file=file,index=3,media=disk
 @end example
 You can open an image using pre-opened file descriptors from an fd set:
 @example
 -qemu-system-i386
 +qemu-kvm
 -add-fd fd=3,set=2,opaque="rdwr:/path/to/file"
 -add-fd fd=4,set=2,opaque="rdonly:/path/to/file"
 -drive file=/dev/fdset/2,index=0,media=disk
@@ -1171,28 +1171,28 @@ qemu-system-i386
 You can connect a CDROM to the slave of ide0:
 @example
 -qemu-system-i386 -drive file=file,if=ide,index=1,media=cdrom
 +qemu-kvm -drive file=file,if=ide,index=1,media=cdrom
 @end example
 If you don't specify the "file=" argument, you define an empty drive:
 @example
 -qemu-system-i386 -drive if=ide,index=1,media=cdrom
 +qemu-kvm -drive if=ide,index=1,media=cdrom
 @end example
 Instead of @option{-fda}, @option{-fdb}, you can use:
 @example
 -qemu-system-i386 -drive file=file,index=0,if=floppy
 -qemu-system-i386 -drive file=file,index=1,if=floppy
 +qemu-kvm -drive file=file,index=0,if=floppy
 +qemu-kvm -drive file=file,index=1,if=floppy
 @end example
 By default, @var{interface} is "ide" and @var{index} is automatically
 incremented:
 @example
 -qemu-system-i386 -drive file=a -drive file=b"
 +qemu-kvm -drive file=a -drive file=b"
 @end example
 is interpreted like:
 @example
 -qemu-system-i386 -hda a -hdb b
 +qemu-kvm -hda a -hdb b
 @end example
 ETEXI
@@ -2258,8 +2258,8 @@ The following two example do exactly the same, to show how @option{-nic} can
 be used to shorten the command line length (note that the e1000 is the default
 on i386, so the @option{model=e1000} parameter could even be omitted here, too):
 @example
 -qemu-system-i386 -netdev user,id=n1,ipv6=off -device e1000,netdev=n1,mac=52:54:98:76:54:32
 -qemu-system-i386 -nic user,ipv6=off,model=e1000,mac=52:54:98:76:54:32
 +qemu-kvm -netdev user,id=n1,ipv6=off -device e1000,netdev=n1,mac=52:54:98:76:54:32
 +qemu-kvm -nic user,ipv6=off,model=e1000,mac=52:54:98:76:54:32
 @end example
 @item -nic none
@@ -2330,7 +2330,7 @@ can not be resolved.
 Example:
 @example
 -qemu-system-i386 -nic user,dnssearch=mgmt.example.org,dnssearch=example.org
 +qemu-kvm -nic user,dnssearch=mgmt.example.org,dnssearch=example.org
 @end example
 @item domainname=@var{domain}
@@ -2354,7 +2354,7 @@ a guest from a local directory.
 Example (using pxelinux):
 @example
 -qemu-system-i386 -hda linux.img -boot n -device e1000,netdev=n1 \
 +qemu-kvm -hda linux.img -boot n -device e1000,netdev=n1 \
     -netdev user,id=n1,tftp=/path/to/tftp/files,bootfile=/pxelinux.0
 @end example
@@ -2388,7 +2388,7 @@ screen 0, use the following:
 @example
 # on the host
 -qemu-system-i386 -nic user,hostfwd=tcp:127.0.0.1:6001-:6000
 +qemu-kvm -nic user,hostfwd=tcp:127.0.0.1:6001-:6000
 # this host xterm should open in the guest X11 server
 xterm -display :1
 @end example
@@ -2398,7 +2398,7 @@ the guest, use the following:
 @example
 # on the host
 -qemu-system-i386 -nic user,hostfwd=tcp::5555-:23
 +qemu-kvm -nic user,hostfwd=tcp::5555-:23
 telnet localhost 5555
 @end example
@@ -2417,7 +2417,7 @@ lifetime, like in the following example:
 @example
 # open 10.10.1.1:4321 on bootup, connect 10.0.2.100:1234 to it whenever
 # the guest accesses it
 -qemu-system-i386 -nic user,guestfwd=tcp:10.0.2.100:1234-tcp:10.10.1.1:4321
 +qemu-kvm -nic user,guestfwd=tcp:10.0.2.100:1234-tcp:10.10.1.1:4321
 @end example
 Or you can execute a command on every TCP connection established by the guest,
@@ -2426,7 +2426,7 @@ so that QEMU behaves similar to an inetd process for that virtual server:
 @example
 # call "netcat 10.10.1.1 4321" on every TCP connection to 10.0.2.100:1234
 # and connect the TCP stream to its stdin/stdout
 -qemu-system-i386 -nic  'user,id=n1,guestfwd=tcp:10.0.2.100:1234-cmd:netcat 10.10.1.1 4321'
 +qemu-kvm -nic  'user,id=n1,guestfwd=tcp:10.0.2.100:1234-cmd:netcat 10.10.1.1 4321'
 @end example
 @end table
@@ -2453,21 +2453,22 @@ Examples:
 @example
 #launch a QEMU instance with the default network script
 -qemu-system-i386 linux.img -nic tap
 +qemu-kvm linux.img -nic tap
 @end example
 @example
 #launch a QEMU instance with two NICs, each one connected
 #to a TAP device
 -qemu-system-i386 linux.img \
 +qemu-kvm linux.img \
         -netdev tap,id=nd0,ifname=tap0 -device e1000,netdev=nd0 \
         -netdev tap,id=nd1,ifname=tap1 -device rtl8139,netdev=nd1
 +                 -net nic,vlan=1 -net tap,vlan=1,ifname=tap1
 @end example
 @example
 #launch a QEMU instance with the default network helper to
 #connect a TAP device to bridge br0
 -qemu-system-i386 linux.img -device virtio-net-pci,netdev=n1 \
 +qemu-kvm linux.img -device virtio-net-pci,netdev=n1 \
         -netdev tap,id=n1,"helper=/path/to/qemu-bridge-helper"
 @end example
@@ -2484,13 +2485,13 @@ Examples:
 @example
 #launch a QEMU instance with the default network helper to
 #connect a TAP device to bridge br0
 -qemu-system-i386 linux.img -netdev bridge,id=n1 -device virtio-net,netdev=n1
 +qemu-kvm linux.img -netdev bridge,id=n1 -device virtio-net,netdev=n1
 @end example
 @example
 #launch a QEMU instance with the default network helper to
 #connect a TAP device to bridge qemubr0
 -qemu-system-i386 linux.img -netdev bridge,br=qemubr0,id=n1 -device virtio-net,netdev=n1
 +qemu-kvm linux.img -netdev bridge,br=qemubr0,id=n1 -device virtio-net,netdev=n1
 @end example
 @item -netdev socket,id=@var{id}[,fd=@var{h}][,listen=[@var{host}]:@var{port}][,connect=@var{host}:@var{port}]
@@ -2505,13 +2506,13 @@ specifies an already opened TCP socket.
 Example:
 @example
 # launch a first QEMU instance
 -qemu-system-i386 linux.img \
 -                 -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 -                 -netdev socket,id=n1,listen=:1234
 +qemu-kvm linux.img \
 +         -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 +         -netdev socket,id=n1,listen=:1234
 # connect the network of this instance to the network of the first instance
 -qemu-system-i386 linux.img \
 -                 -device e1000,netdev=n2,mac=52:54:00:12:34:57 \
 -                 -netdev socket,id=n2,connect=127.0.0.1:1234
 +qemu-kvm linux.img \
 +         -device e1000,netdev=n2,mac=52:54:00:12:34:57 \
 +         -netdev socket,id=n2,connect=127.0.0.1:1234
 @end example
 @item -netdev socket,id=@var{id}[,fd=@var{h}][,mcast=@var{maddr}:@var{port}[,localaddr=@var{addr}]]
@@ -2534,15 +2535,15 @@ Use @option{fd=h} to specify an already opened UDP multicast socket.
 Example:
 @example
 # launch one QEMU instance
 -qemu-system-i386 linux.img \
 -                 -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 -                 -netdev socket,id=n1,mcast=230.0.0.1:1234
 +qemu-kvm linux.img \
 +         -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 +         -netdev socket,id=n1,mcast=230.0.0.1:1234
 # launch another QEMU instance on same "bus"
 -qemu-system-i386 linux.img \
 -                 -device e1000,netdev=n2,mac=52:54:00:12:34:57 \
 -                 -netdev socket,id=n2,mcast=230.0.0.1:1234
 +qemu-kvm linux.img \
 +         -device e1000,netdev=n2,mac=52:54:00:12:34:57 \
 +         -netdev socket,id=n2,mcast=230.0.0.1:1234
 # launch yet another QEMU instance on same "bus"
 -qemu-system-i386 linux.img \
 +qemu-kvm linux.img \
                  -device e1000,netdev=n3,mac=52:54:00:12:34:58 \
                  -netdev socket,id=n3,mcast=230.0.0.1:1234
 @end example
@@ -2550,7 +2551,7 @@ qemu-system-i386 linux.img \
 Example (User Mode Linux compat.):
 @example
 # launch QEMU instance (note mcast address selected is UML's default)
 -qemu-system-i386 linux.img \
 +qemu-kvm linux.img \
                  -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
                  -netdev socket,id=n1,mcast=239.192.168.1:1102
 # launch UML
@@ -2559,9 +2560,12 @@ qemu-system-i386 linux.img \
 Example (send packets from host's 1.2.3.4):
 @example
 -qemu-system-i386 linux.img \
 -                 -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 -                 -netdev socket,id=n1,mcast=239.192.168.1:1102,localaddr=1.2.3.4
 +qemu-kvm linux.img \
 +         -device e1000,netdev=n1,mac=52:54:00:12:34:56 \
 +         -netdev socket,id=n1,mcast=239.192.168.1:1102,localaddr=1.2.3.4
 +qemu-kvm linux.img \
 +         -net nic,macaddr=52:54:00:12:34:56 \
 +         -net socket,mcast=239.192.168.1:1102,localaddr=1.2.3.4
 @end example
 @item -netdev l2tpv3,id=@var{id},src=@var{srcaddr},dst=@var{dstaddr}[,srcport=@var{srcport}][,dstport=@var{dstport}],txsession=@var{txsession}[,rxsession=@var{rxsession}][,ipv6][,udp][,cookie64][,counter][,pincounter][,txcookie=@var{txcookie}][,rxcookie=@var{rxcookie}][,offset=@var{offset}]
@@ -2619,7 +2623,7 @@ brctl addif br-lan vmtunnel0
 # on 4.3.2.1
 # launch QEMU instance - if your network has reorder or is very lossy add ,pincounter
 -qemu-system-i386 linux.img -device e1000,netdev=n1 \
 +qemu-kvm linux.img -device e1000,netdev=n1 \
     -netdev l2tpv3,id=n1,src=4.2.3.1,dst=1.2.3.4,udp,srcport=16384,dstport=16384,rxsession=0xffffffff,txsession=0xffffffff,counter
 @end example
@@ -2636,7 +2640,7 @@ Example:
 # launch vde switch
 vde_switch -F -sock /tmp/myswitch
 # launch QEMU instance
 -qemu-system-i386 linux.img -nic vde,sock=/tmp/myswitch
 +qemu-kvm linux.img -nic vde,sock=/tmp/myswitch
 @end example
 @item -netdev vhost-user,chardev=@var{id}[,vhostforce=on|off][,queues=n]
@@ -2650,11 +2654,11 @@ be created for multiqueue vhost-user.
 Example:
 @example
 -qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -     -numa node,memdev=mem \
 -     -chardev socket,id=chr0,path=/path/to/socket \
 -     -netdev type=vhost-user,id=net0,chardev=chr0 \
 -     -device virtio-net-pci,netdev=net0
 +qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +         -numa node,memdev=mem \
 +         -chardev socket,id=chr0,path=/path/to/socket \
 +         -netdev type=vhost-user,id=net0,chardev=chr0 \
 +         -device virtio-net-pci,netdev=net0
 @end example
 @item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
@@ -3094,7 +3098,7 @@ and communicate.  Requires the Linux @code{vhci} driver installed.  Can
 be used as following:
 @example
 -qemu-system-i386 [...OPTIONS...] -bt hci,vlan=5 -bt vhci,vlan=5
 +qemu-kvm [...OPTIONS...] -bt hci,vlan=5 -bt vhci,vlan=5
 @end example
 @item -bt device:@var{dev}[,vlan=@var{n}]
@@ -3544,14 +3548,14 @@ ETEXI
 DEF("realtime", HAS_ARG, QEMU_OPTION_realtime,
     "-realtime [mlock=on|off]\n"
 -    "                run qemu with realtime features\n"
 +    "                run qemu-kvm with realtime features\n"
     "                mlock=on|off controls mlock support (default: on)\n",
     QEMU_ARCH_ALL)
 STEXI
 @item -realtime mlock=on|off
 @findex -realtime
 -Run qemu with realtime features.
 -mlocking qemu and guest memory can be enabled via @option{mlock=on}
 +Run qemu-kvm with realtime features.
 +mlocking qemu-kvm and guest memory can be enabled via @option{mlock=on}
 (enabled by default).
 ETEXI
@@ -3589,7 +3593,7 @@ connections will likely be TCP-based, but also UDP, pseudo TTY, or even
 stdio are reasonable use case. The latter is allowing to start QEMU from
 within gdb and establish the connection via a pipe:
 @example
 -(gdb) target remote | exec qemu-system-i386 -gdb stdio ...
 +(gdb) target remote | exec qemu-kvm -gdb stdio ...
 @end example
 ETEXI
@@ -4559,7 +4563,7 @@ which specify the queue number of cryptodev backend, the default of
 @example
 - # qemu-system-x86_64 \
 + # qemu-kvm \
    [...] \
        -object cryptodev-backend-builtin,id=cryptodev0 \
        -device virtio-crypto-pci,id=crypto0,cryptodev=cryptodev0 \
@@ -4579,7 +4583,7 @@ of cryptodev backend for multiqueue vhost-user, the default of @var{queues} is 1
 @example
 - # qemu-system-x86_64 \
 + # qemu-kvm \
    [...] \
        -chardev socket,id=chardev0,path=/path/to/socket \
        -object cryptodev-vhost-user,id=cryptodev0,chardev=chardev0 \
 -- 
 2.20.1
--- a/0017-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0017-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -0,0 +1,118 @@
 From dce5c0db33a1f7420254944c78962ca1887d3c08 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 30 Nov 2018 09:11:03 +0100
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 docs/qemu-block-drivers.texi |  2 +-
 docs/qemu-cpu-models.texi    |  2 +-
 qemu-doc.texi                |  6 +++---
 qemu-options.hx              | 16 ++++++++--------
 4 files changed, 13 insertions(+), 13 deletions(-)
 diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
 index 2c7ea49c32..5d0afb3dee 100644
 --- a/docs/qemu-block-drivers.texi
 +++ b/docs/qemu-block-drivers.texi
@@ -2,7 +2,7 @@
 QEMU block driver reference manual
 @c man end
 -@set qemu_system qemu-system-x86_64
 +@set qemu_system qemu-kvm
 @c man begin DESCRIPTION
 diff --git a/docs/qemu-cpu-models.texi b/docs/qemu-cpu-models.texi
 index f88a1def0d..c82cf8fab7 100644
 --- a/docs/qemu-cpu-models.texi
 +++ b/docs/qemu-cpu-models.texi
@@ -2,7 +2,7 @@
 QEMU / KVM CPU model configuration
 @c man end
 -@set qemu_system_x86 qemu-system-x86_64
 +@set qemu_system_x86 qemu-kvm
 @c man begin DESCRIPTION
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index 3c5022050f..f770e86a90 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -11,8 +11,8 @@
 @paragraphindent 0
 @c %**end of header
 -@set qemu_system qemu-system-x86_64
 -@set qemu_system_x86 qemu-system-x86_64
 +@set qemu_system qemu-kvm
 +@set qemu_system_x86 qemu-kvm
 @ifinfo
 @direntry
@@ -1826,7 +1826,7 @@ Set the initial VGA graphic mode. The default is 800x600x32.
 Set OpenBIOS variables in NVRAM, for example:
 @example
 -qemu-system-ppc -prom-env 'auto-boot?=false' \
 +qemu-kvm -prom-env 'auto-boot?=false' \
  -prom-env 'boot-device=hd:2,\yaboot' \
  -prom-env 'boot-args=conf=hd:2,\yaboot.conf'
 @end example
 diff --git a/qemu-options.hx b/qemu-options.hx
 index fc17aca631..df1d27b6f2 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -2737,11 +2737,11 @@ be created for multiqueue vhost-user.
 Example:
 @example
 -qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -     -numa node,memdev=mem \
 -     -chardev socket,id=chr0,path=/path/to/socket \
 -     -netdev type=vhost-user,id=net0,chardev=chr0 \
 -     -device virtio-net-pci,netdev=net0
 +qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +         -numa node,memdev=mem \
 +         -chardev socket,id=chr0,path=/path/to/socket \
 +         -netdev type=vhost-user,id=net0,chardev=chr0 \
 +         -device virtio-net-pci,netdev=net0
 @end example
 @item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
@@ -3631,14 +3631,14 @@ ETEXI
 DEF("realtime", HAS_ARG, QEMU_OPTION_realtime,
     "-realtime [mlock=on|off]\n"
 -    "                run qemu with realtime features\n"
 +    "                run qemu-kvm with realtime features\n"
     "                mlock=on|off controls mlock support (default: on)\n",
     QEMU_ARCH_ALL)
 STEXI
 @item -realtime mlock=on|off
 @findex -realtime
 -Run qemu with realtime features.
 -mlocking qemu and guest memory can be enabled via @option{mlock=on}
 +Run qemu-kvm with realtime features.
 +mlocking qemu-kvm and guest memory can be enabled via @option{mlock=on}
 (enabled by default).
 ETEXI
 -- 
 2.21.0
--- a/0018-usb-xhci-Fix-PCI-capability-order.patch
+++ b/0018-usb-xhci-Fix-PCI-capability-order.patch
@ -1,4 +1,4 @@
-From 4ebea24b67b02abb2fbbd67c3334496315d75b6f Mon Sep 17 00:00:00 2001
+From 9fe2902d4c8f5cd5ad72af06c6bc54813e642e27 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Fri, 5 May 2017 19:06:14 +0200
 Subject: usb-xhci: Fix PCI capability order
@ -62,10 +62,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 9854fae583..adfacace65 100644
+index 8fed2eedd6..d2b9744030 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
-@@ -3397,6 +3397,12 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
+@@ -3403,6 +3403,12 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
         xhci->max_pstreams_mask = 0;
     }
@ -78,7 +78,7 @@ index 9854fae583..adfacace65 100644
     if (xhci->msi != ON_OFF_AUTO_OFF) {
         ret = msi_init(dev, 0x70, xhci->numintrs, true, false, &err);
         /* Any error other than -ENOTSUP(board's MSI support is broken)
-@@ -3445,12 +3451,6 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
+@@ -3451,12 +3457,6 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
                      PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
                      &xhci->mem);
@ -92,5 +92,5 @@ index 9854fae583..adfacace65 100644
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, xhci->numintrs,
 -- 
-2.20.1
+2.21.0
--- a/0019-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/0019-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -1,4 +1,4 @@
-From 1a030226ff750613c7f567150f6bf97b902b0151 Mon Sep 17 00:00:00 2001
+From e6fd66897236f8a3348235447ed32b8e5de109bb Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
@ -45,10 +45,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 8b9e5e2b49..9df5494398 100644
+index e8b2b64d09..54108c0056 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
-@@ -805,6 +805,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+@@ -808,6 +808,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     SCSIDevice *sd = SCSI_DEVICE(dev);
     int ret;
@ -65,5 +65,5 @@ index 8b9e5e2b49..9df5494398 100644
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
 -- 
-2.20.1
+2.21.0
--- a/0020-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/0020-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -1,4 +1,4 @@
-From e0daf3e497f1f82a0d8c45a9d26e9982a6f866ac Mon Sep 17 00:00:00 2001
+From 8b3c1edc606bea84b5e52369ed8d211889a44b6c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@ -32,10 +32,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index bbb001f84a..40cd9dcde6 100644
+index 481dfd2a27..805f38533e 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
-@@ -343,12 +343,19 @@ void spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
+@@ -351,12 +351,19 @@ void spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
@ -56,5 +56,5 @@ index bbb001f84a..40cd9dcde6 100644
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
-2.20.1
+2.21.0
--- a/0020-pc-Don-t-make-die-id-mandatory-unless-necessary.patch
+++ b/0020-pc-Don-t-make-die-id-mandatory-unless-necessary.patch
@ -1,115 +0,0 @@
 From 7d5c2ef35d0bd7eb90fac2f40225bcfb4a46421d Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Fri, 16 Aug 2019 17:16:33 +0100
 Subject: pc: Don't make die-id mandatory unless necessary
 RH-Author: Eduardo Habkost <ehabkost@redhat.com>
 Message-id: <20190816171633.26797-2-ehabkost@redhat.com>
 Patchwork-id: 90038
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/1] pc: Don't make die-id mandatory unless necessary
 Bugzilla: 1741451
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Erik Skultety <eskultet@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 We have this issue reported when using libvirt to hotplug CPUs:
 https://bugzilla.redhat.com/show_bug.cgi?id=1741451
 Basically, libvirt is not copying die-id from
 query-hotpluggable-cpus, but die-id is now mandatory.
 We could blame libvirt and say it is not following the documented
 interface, because we have this buried in the QAPI schema
 documentation:
 > Note: currently there are 5 properties that could be present
 > but management should be prepared to pass through other
 > properties with device_add command to allow for future
 > interface extension. This also requires the filed names to be kept in
 > sync with the properties passed to -device/device_add.
 But I don't think this would be reasonable from us.  We can just
 make QEMU more flexible and let die-id to be omitted when there's
 no ambiguity.  This will allow us to keep compatibility with
 existing libvirt versions.
 Test case included to ensure we don't break this again.
 Fixes: commit 176d2cda0dee ("i386/cpu: Consolidate die-id validity in smp context")
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 ---
 Changes v1 -> v2:
 * v1 was "pc: Don't make CPU properties mandatory unless necessary"
 * Make only die-id optional (Igor Mammedov)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc.c                             |  8 ++++++
 tests/acceptance/pc_cpu_hotplug_props.py | 35 ++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 tests/acceptance/pc_cpu_hotplug_props.py
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 9ded0db80d..b3d2d1e88a 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -2622,6 +2622,14 @@ static void pc_cpu_pre_plug(HotplugHandler *hotplug_dev,
         int max_socket = (ms->smp.max_cpus - 1) /
                                 smp_threads / smp_cores / pcms->smp_dies;
 +        /*
 +         * die-id was optional in QEMU 4.0 and older, so keep it optional
 +         * if there's only one die per socket.
 +         */
 +        if (cpu->die_id < 0 && pcms->smp_dies == 1) {
 +            cpu->die_id = 0;
 +        }
 +
         if (cpu->socket_id < 0) {
             error_setg(errp, "CPU socket-id is not set");
             return;
 diff --git a/tests/acceptance/pc_cpu_hotplug_props.py b/tests/acceptance/pc_cpu_hotplug_props.py
 new file mode 100644
 index 0000000000..08b7e632c6
 --- /dev/null
 +++ b/tests/acceptance/pc_cpu_hotplug_props.py
@@ -0,0 +1,35 @@
 +#
 +# Ensure CPU die-id can be omitted on -device
 +#
 +#  Copyright (c) 2019 Red Hat Inc
 +#
 +# Author:
 +#  Eduardo Habkost <ehabkost@redhat.com>
 +#
 +# This library is free software; you can redistribute it and/or
 +# modify it under the terms of the GNU Lesser General Public
 +# License as published by the Free Software Foundation; either
 +# version 2 of the License, or (at your option) any later version.
 +#
 +# This library is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# Lesser General Public License for more details.
 +#
 +# You should have received a copy of the GNU Lesser General Public
 +# License along with this library; if not, see <http://www.gnu.org/licenses/>.
 +#
 +
 +from avocado_qemu import Test
 +
 +class OmittedCPUProps(Test):
 +    """
 +    :avocado: tags=arch:x86_64
 +    """
 +    def test_no_die_id(self):
 +        self.vm.add_args('-nodefaults', '-S')
 +        self.vm.add_args('-smp', '1,sockets=2,cores=2,threads=2,maxcpus=8')
 +        self.vm.add_args('-cpu', 'qemu64')
 +        self.vm.add_args('-device', 'qemu64-x86_64-cpu,socket-id=1,core-id=0,thread-id=0')
 +        self.vm.launch()
 +        self.assertEquals(len(self.vm.command('query-cpus')), 2)
 -- 
 2.20.1
--- a/0021-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch
+++ b/0021-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch
@ -1,8 +1,8 @@
-From 01e95b17878444859b15e79f7690d32a3532907e Mon Sep 17 00:00:00 2001
+From 9c91fc25dd4edd7447a342dd37b2fd8d3e2301f6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Mon, 16 Sep 2019 17:07:00 +0100
-Subject: [PATCH 4/4] Using ip_deq after m_free might read pointers from an
+Subject: Using ip_deq after m_free might read pointers from an allocation
- allocation reuse.
+ reuse.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -31,7 +31,7 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
-index 8c75d91..df1c846 100644
+index 8c75d91495..df1c846ade 100644
 --- a/slirp/src/ip_input.c
 +++ b/slirp/src/ip_input.c
@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
@ -57,5 +57,5 @@ index 8c75d91..df1c846 100644
 insert:
 -- 
-1.8.3.1
+2.21.0
--- a/kvm-RHEL-disable-hostmem-memfd.patch
+++ b/kvm-RHEL-disable-hostmem-memfd.patch
@ -1,56 +0,0 @@
 From f7587ddb9a2731bf678a24156b6285dda79a4b2b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Mon, 19 Aug 2019 21:18:27 -0300
 Subject: [PATCH] RHEL: disable hostmem-memfd
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
 Message-id: <20190814085210.18462-1-marcandre.lureau@redhat.com>
 Patchwork-id: 89974
 O-Subject: [RHEL-8.1.0 qemu-kvm PATCH] RHEL: disable hostmem-memfd
 Bugzilla: 1738626 1740797
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: John Snow <jsnow@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1740797
 BRANCH: rhel8/rhel-8.1.0
 UPSTREAM: n/a (downstream only)
 BREW: 23060214
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 backends/Makefile.objs | 3 ++-
 util/memfd.c           | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)
 diff --git a/backends/Makefile.objs b/backends/Makefile.objs
 index 981e8e1..ad54cd6 100644
 --- a/backends/Makefile.objs
 +++ b/backends/Makefile.objs
@@ -16,4 +16,5 @@ endif
 common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_VIRTIO)) += vhost-user.o
 -common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
 +# RHEL: disable memfd
 +# common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
 diff --git a/util/memfd.c b/util/memfd.c
 index 00334e5..e2320af 100644
 --- a/util/memfd.c
 +++ b/util/memfd.c
@@ -193,7 +193,7 @@ bool qemu_memfd_alloc_check(void)
  */
 bool qemu_memfd_check(unsigned int flags)
 {
 -#ifdef CONFIG_LINUX
 +#if 0 /* RHEL: memfd support disabled */
     int mfd = memfd_create("test", flags | MFD_CLOEXEC);
     if (mfd >= 0) {
 -- 
 1.8.3.1
--- a/kvm-block-Use-QEMU_IS_ALIGNED.patch
+++ b/kvm-block-Use-QEMU_IS_ALIGNED.patch
@ -1,192 +0,0 @@
 From 1eb1c45037b1e1084ab601ac8461fabca162b479 Mon Sep 17 00:00:00 2001
 From: Maxim Levitsky <mlevitsk@redhat.com>
 Date: Tue, 24 Sep 2019 21:11:49 +0100
 Subject: [PATCH 1/4] block: Use QEMU_IS_ALIGNED
 RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
 Message-id: <20190924211152.13461-2-mlevitsk@redhat.com>
 Patchwork-id: 90874
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/4] block: Use QEMU_IS_ALIGNED
 Bugzilla: 1745922
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Nir Soffer <nirsof@gmail.com>
 Replace instances of:
    (n & (BDRV_SECTOR_SIZE - 1)) == 0
 And:
   (n & ~BDRV_SECTOR_MASK) == 0
 With:
    QEMU_IS_ALIGNED(n, BDRV_SECTOR_SIZE)
 Which reveals the intent of the code better, and makes it easier to
 locate the code checking alignment.
 Signed-off-by: Nir Soffer <nsoffer@redhat.com>
 Message-id: 20190827185913.27427-2-nsoffer@redhat.com
 Reviewed-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 1bbbf32d5fffe334531c315d7bd865fdfb67b6c5)
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/bochs.c         | 4 ++--
 block/cloop.c         | 4 ++--
 block/dmg.c           | 4 ++--
 block/io.c            | 8 ++++----
 block/qcow2-cluster.c | 4 ++--
 block/qcow2.c         | 4 ++--
 block/vvfat.c         | 8 ++++----
 qemu-img.c            | 2 +-
 8 files changed, 19 insertions(+), 19 deletions(-)
 diff --git a/block/bochs.c b/block/bochs.c
 index 962f185..32bb83b 100644
 --- a/block/bochs.c
 +++ b/block/bochs.c
@@ -248,8 +248,8 @@ bochs_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     QEMUIOVector local_qiov;
     int ret;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     qemu_iovec_init(&local_qiov, qiov->niov);
     qemu_co_mutex_lock(&s->lock);
 diff --git a/block/cloop.c b/block/cloop.c
 index 384c973..4de9487 100644
 --- a/block/cloop.c
 +++ b/block/cloop.c
@@ -253,8 +253,8 @@ cloop_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
     int ret, i;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     qemu_co_mutex_lock(&s->lock);
 diff --git a/block/dmg.c b/block/dmg.c
 index 45f6b28..4a045f2 100644
 --- a/block/dmg.c
 +++ b/block/dmg.c
@@ -697,8 +697,8 @@ dmg_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
     int ret, i;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     qemu_co_mutex_lock(&s->lock);
 diff --git a/block/io.c b/block/io.c
 index 06305c6..54093fc 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1079,8 +1079,8 @@ static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
     sector_num = offset >> BDRV_SECTOR_BITS;
     nb_sectors = bytes >> BDRV_SECTOR_BITS;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
     assert(drv->bdrv_co_readv);
@@ -1132,8 +1132,8 @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
     sector_num = offset >> BDRV_SECTOR_BITS;
     nb_sectors = bytes >> BDRV_SECTOR_BITS;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
     assert(drv->bdrv_co_writev);
 diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
 index cc5609e..f2de746 100644
 --- a/block/qcow2-cluster.c
 +++ b/block/qcow2-cluster.c
@@ -470,8 +470,8 @@ static bool coroutine_fn do_perform_cow_encrypt(BlockDriverState *bs,
 {
     if (bytes && bs->encrypted) {
         BDRVQcow2State *s = bs->opaque;
 -        assert((offset_in_cluster & ~BDRV_SECTOR_MASK) == 0);
 -        assert((bytes & ~BDRV_SECTOR_MASK) == 0);
 +        assert(QEMU_IS_ALIGNED(offset_in_cluster, BDRV_SECTOR_SIZE));
 +        assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
         assert(s->crypto);
         if (qcow2_co_encrypt(bs, cluster_offset,
                              src_cluster_offset + offset_in_cluster,
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 039bdc2..dc4302f 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -2071,8 +2071,8 @@ static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
             }
             if (bs->encrypted) {
                 assert(s->crypto);
 -                assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -                assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +                assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +                assert(QEMU_IS_ALIGNED(cur_bytes, BDRV_SECTOR_SIZE));
                 if (qcow2_co_decrypt(bs, cluster_offset, offset,
                                      cluster_data, cur_bytes) < 0) {
                     ret = -EIO;
 diff --git a/block/vvfat.c b/block/vvfat.c
 index f6c2880..019b8f1 100644
 --- a/block/vvfat.c
 +++ b/block/vvfat.c
@@ -1547,8 +1547,8 @@ vvfat_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
     void *buf;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     buf = g_try_malloc(bytes);
     if (bytes && buf == NULL) {
@@ -3082,8 +3082,8 @@ vvfat_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
     void *buf;
 -    assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
 -    assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
 +    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
     buf = g_try_malloc(bytes);
     if (bytes && buf == NULL) {
 diff --git a/qemu-img.c b/qemu-img.c
 index 7998377..940ae94 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -2138,7 +2138,7 @@ static int img_convert(int argc, char **argv)
             int64_t sval;
             sval = cvtnum(optarg);
 -            if (sval < 0 || sval & (BDRV_SECTOR_SIZE - 1) ||
 +            if (sval < 0 || !QEMU_IS_ALIGNED(sval, BDRV_SECTOR_SIZE) ||
                 sval / BDRV_SECTOR_SIZE > MAX_BUF_SECTORS) {
                 error_report("Invalid buffer size for sparse output specified. "
                     "Valid sizes are multiples of %llu up to %llu. Select "
 -- 
 1.8.3.1
--- a/kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch
+++ b/kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch
@ -1,107 +0,0 @@
 From df8fadfd9450c8709864db44c2f676d40f323f95 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Fri, 13 Sep 2019 14:12:25 +0100
 Subject: [PATCH 2/4] block/create: Do not abort if a block driver is not
 available
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: <20190913141225.12022-2-philmd@redhat.com>
 Patchwork-id: 90451
 O-Subject: [RHEL-7.7 qemu-kvm-rhev + RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/1] block/create: Do not abort if a block driver is not available
 Bugzilla: 1746267
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 The 'blockdev-create' QMP command was introduced as experimental
 feature in commit b0292b851b8, using the assert() debug call.
 It got promoted to 'stable' command in 3fb588a0f2c, but the
 assert call was not removed.
 Some block drivers are optional, and bdrv_find_format() might
 return a NULL value, triggering the assertion.
 Stable code is not expected to abort, so return an error instead.
 This is easily reproducible when libnfs is not installed:
  ./configure
  [...]
  module support    no
  Block whitelist (rw)
  Block whitelist (ro)
  libiscsi support  yes
  libnfs support    no
  [...]
 Start QEMU:
  $ qemu-system-x86_64 -S -qmp unix:/tmp/qemu.qmp,server,nowait
 Send the 'blockdev-create' with the 'nfs' driver:
  $ ( cat << 'EOF'
  {'execute': 'qmp_capabilities'}
  {'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
  EOF
  ) | socat STDIO UNIX:/tmp/qemu.qmp
  {"QMP": {"version": {"qemu": {"micro": 50, "minor": 1, "major": 4}, "package": "v4.1.0-733-g89ea03a7dc"}, "capabilities": ["oob"]}}
  {"return": {}}
 QEMU crashes:
  $ gdb qemu-system-x86_64 core
  Program received signal SIGSEGV, Segmentation fault.
  (gdb) bt
  #0  0x00007ffff510957f in raise () at /lib64/libc.so.6
  #1  0x00007ffff50f3895 in abort () at /lib64/libc.so.6
  #2  0x00007ffff50f3769 in _nl_load_domain.cold.0 () at /lib64/libc.so.6
  #3  0x00007ffff5101a26 in .annobin_assert.c_end () at /lib64/libc.so.6
  #4  0x0000555555d7e1f1 in qmp_blockdev_create (job_id=0x555556baee40 "x", options=0x555557666610, errp=0x7fffffffc770) at block/create.c:69
  #5  0x0000555555c96b52 in qmp_marshal_blockdev_create (args=0x7fffdc003830, ret=0x7fffffffc7f8, errp=0x7fffffffc7f0) at qapi/qapi-commands-block-core.c:1314
  #6  0x0000555555deb0a0 in do_qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false, errp=0x7fffffffc898) at qapi/qmp-dispatch.c:131
  #7  0x0000555555deb2a1 in qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false) at qapi/qmp-dispatch.c:174
 With this patch applied, QEMU returns a QMP error:
  {'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
  {"id": "x", "error": {"class": "GenericError", "desc": "Block driver 'nfs' not found or not supported"}}
 Cc: qemu-stable@nongnu.org
 Reported-by: Xu Tian <xutian@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit d90d5cae2b10efc0e8d0b3cc91ff16201853d3ba)
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/create.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/block/create.c b/block/create.c
 index 9534121..de5e97b 100644
 --- a/block/create.c
 +++ b/block/create.c
@@ -63,9 +63,13 @@ void qmp_blockdev_create(const char *job_id, BlockdevCreateOptions *options,
     const char *fmt = BlockdevDriver_str(options->driver);
     BlockDriver *drv = bdrv_find_format(fmt);
 +    if (!drv) {
 +        error_setg(errp, "Block driver '%s' not found or not supported", fmt);
 +        return;
 +    }
 +
     /* If the driver is in the schema, we know that it exists. But it may not
      * be whitelisted. */
 -    assert(drv);
     if (bdrv_uses_whitelist() && !bdrv_is_whitelisted(drv, false)) {
         error_setg(errp, "Driver is not whitelisted");
         return;
 -- 
 1.8.3.1
--- a/kvm-block-posix-Always-allocate-the-first-block.patch
+++ b/kvm-block-posix-Always-allocate-the-first-block.patch
@ -1,386 +0,0 @@
 From 58dc8ae23325384b0d9494d203254dc2f6a99255 Mon Sep 17 00:00:00 2001
 From: Max Reitz <mreitz@redhat.com>
 Date: Mon, 9 Sep 2019 07:38:21 +0100
 Subject: [PATCH 5/6] block: posix: Always allocate the first block
 RH-Author: Max Reitz <mreitz@redhat.com>
 Message-id: <20190909073822.26191-3-mreitz@redhat.com>
 Patchwork-id: 90333
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 2/3] block: posix: Always allocate the first block
 Bugzilla: 1749134
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 From: Nir Soffer <nirsof@gmail.com>
 When creating an image with preallocation "off" or "falloc", the first
 block of the image is typically not allocated. When using Gluster
 storage backed by XFS filesystem, reading this block using direct I/O
 succeeds regardless of request length, fooling alignment detection.
 In this case we fallback to a safe value (4096) instead of the optimal
 value (512), which may lead to unneeded data copying when aligning
 requests.  Allocating the first block avoids the fallback.
 Since we allocate the first block even with preallocation=off, we no
 longer create images with zero disk size:
    $ ./qemu-img create -f raw test.raw 1g
    Formatting 'test.raw', fmt=raw size=1073741824
    $ ls -lhs test.raw
    4.0K -rw-r--r--. 1 nsoffer nsoffer 1.0G Aug 16 23:48 test.raw
 And converting the image requires additional cluster:
    $ ./qemu-img measure -f raw -O qcow2 test.raw
    required size: 458752
    fully allocated size: 1074135040
 When using format like vmdk with multiple files per image, we allocate
 one block per file:
    $ ./qemu-img create -f vmdk -o subformat=twoGbMaxExtentFlat test.vmdk 4g
    Formatting 'test.vmdk', fmt=vmdk size=4294967296 compat6=off hwversion=undefined subformat=twoGbMaxExtentFlat
    $ ls -lhs test*.vmdk
    4.0K -rw-r--r--. 1 nsoffer nsoffer 2.0G Aug 27 03:23 test-f001.vmdk
    4.0K -rw-r--r--. 1 nsoffer nsoffer 2.0G Aug 27 03:23 test-f002.vmdk
    4.0K -rw-r--r--. 1 nsoffer nsoffer  353 Aug 27 03:23 test.vmdk
 I did quick performance test for copying disks with qemu-img convert to
 new raw target image to Gluster storage with sector size of 512 bytes:
    for i in $(seq 10); do
        rm -f dst.raw
        sleep 10
        time ./qemu-img convert -f raw -O raw -t none -T none src.raw dst.raw
    done
 Here is a table comparing the total time spent:
 Type    Before(s)   After(s)    Diff(%)
 ---------------------------------------
 real      530.028    469.123      -11.4
 user       17.204     10.768      -37.4
 sys        17.881      7.011      -60.7
 We can see very clear improvement in CPU usage.
 Signed-off-by: Nir Soffer <nsoffer@redhat.com>
 Message-id: 20190827010528.8818-2-nsoffer@redhat.com
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 3a20013fbb26d2a1bd11ef148eefdb1508783787)
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/file-posix.c               | 51 ++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/059.out       |  2 +-
 tests/qemu-iotests/150.out       | 11 ---------
 tests/qemu-iotests/150.out.qcow2 | 11 +++++++++
 tests/qemu-iotests/150.out.raw   | 12 ++++++++++
 tests/qemu-iotests/175           | 19 ++++++++++-----
 tests/qemu-iotests/175.out       |  8 +++----
 tests/qemu-iotests/178.out.qcow2 |  4 ++--
 tests/qemu-iotests/221.out       | 12 ++++++----
 tests/qemu-iotests/253.out       | 12 ++++++----
 10 files changed, 110 insertions(+), 32 deletions(-)
 delete mode 100644 tests/qemu-iotests/150.out
 create mode 100644 tests/qemu-iotests/150.out.qcow2
 create mode 100644 tests/qemu-iotests/150.out.raw
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b8b4dad..8ea9889 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1749,6 +1749,43 @@ static int handle_aiocb_discard(void *opaque)
     return ret;
 }
 +/*
 + * Help alignment probing by allocating the first block.
 + *
 + * When reading with direct I/O from unallocated area on Gluster backed by XFS,
 + * reading succeeds regardless of request length. In this case we fallback to
 + * safe alignment which is not optimal. Allocating the first block avoids this
 + * fallback.
 + *
 + * fd may be opened with O_DIRECT, but we don't know the buffer alignment or
 + * request alignment, so we use safe values.
 + *
 + * Returns: 0 on success, -errno on failure. Since this is an optimization,
 + * caller may ignore failures.
 + */
 +static int allocate_first_block(int fd, size_t max_size)
 +{
 +    size_t write_size = (max_size < MAX_BLOCKSIZE)
 +        ? BDRV_SECTOR_SIZE
 +        : MAX_BLOCKSIZE;
 +    size_t max_align = MAX(MAX_BLOCKSIZE, getpagesize());
 +    void *buf;
 +    ssize_t n;
 +    int ret;
 +
 +    buf = qemu_memalign(max_align, write_size);
 +    memset(buf, 0, write_size);
 +
 +    do {
 +        n = pwrite(fd, buf, write_size, 0);
 +    } while (n == -1 && errno == EINTR);
 +
 +    ret = (n == -1) ? -errno : 0;
 +
 +    qemu_vfree(buf);
 +    return ret;
 +}
 +
 static int handle_aiocb_truncate(void *opaque)
 {
     RawPosixAIOData *aiocb = opaque;
@@ -1788,6 +1825,17 @@ static int handle_aiocb_truncate(void *opaque)
                 /* posix_fallocate() doesn't set errno. */
                 error_setg_errno(errp, -result,
                                  "Could not preallocate new data");
 +            } else if (current_length == 0) {
 +                /*
 +                 * posix_fallocate() uses fallocate() if the filesystem
 +                 * supports it, or fallback to manually writing zeroes. If
 +                 * fallocate() was used, unaligned reads from the fallocated
 +                 * area in raw_probe_alignment() will succeed, hence we need to
 +                 * allocate the first block.
 +                 *
 +                 * Optimize future alignment probing; ignore failures.
 +                 */
 +                allocate_first_block(fd, offset);
             }
         } else {
             result = 0;
@@ -1849,6 +1897,9 @@ static int handle_aiocb_truncate(void *opaque)
         if (ftruncate(fd, offset) != 0) {
             result = -errno;
             error_setg_errno(errp, -result, "Could not resize file");
 +        } else if (current_length == 0 && offset > current_length) {
 +            /* Optimize future alignment probing; ignore failures. */
 +            allocate_first_block(fd, offset);
         }
         return result;
     default:
 diff --git a/tests/qemu-iotests/059.out b/tests/qemu-iotests/059.out
 index 4fab42a..fe3f861 100644
 --- a/tests/qemu-iotests/059.out
 +++ b/tests/qemu-iotests/059.out
@@ -27,7 +27,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824000 subformat=twoGbMax
 image: TEST_DIR/t.vmdk
 file format: vmdk
 virtual size: 0.977 TiB (1073741824000 bytes)
 -disk size: 16 KiB
 +disk size: 1.97 MiB
 Format specific information:
     cid: XXXXXXXX
     parent cid: XXXXXXXX
 diff --git a/tests/qemu-iotests/150.out b/tests/qemu-iotests/150.out
 deleted file mode 100644
 index 2a54e8d..0000000
 --- a/tests/qemu-iotests/150.out
 +++ /dev/null
@@ -1,11 +0,0 @@
 -QA output created by 150
 -
 -=== Mapping sparse conversion ===
 -
 -Offset          Length          File
 -
 -=== Mapping non-sparse conversion ===
 -
 -Offset          Length          File
 -0               0x100000        TEST_DIR/t.IMGFMT
 -*** done
 diff --git a/tests/qemu-iotests/150.out.qcow2 b/tests/qemu-iotests/150.out.qcow2
 new file mode 100644
 index 0000000..2a54e8d
 --- /dev/null
 +++ b/tests/qemu-iotests/150.out.qcow2
@@ -0,0 +1,11 @@
 +QA output created by 150
 +
 +=== Mapping sparse conversion ===
 +
 +Offset          Length          File
 +
 +=== Mapping non-sparse conversion ===
 +
 +Offset          Length          File
 +0               0x100000        TEST_DIR/t.IMGFMT
 +*** done
 diff --git a/tests/qemu-iotests/150.out.raw b/tests/qemu-iotests/150.out.raw
 new file mode 100644
 index 0000000..3cdc772
 --- /dev/null
 +++ b/tests/qemu-iotests/150.out.raw
@@ -0,0 +1,12 @@
 +QA output created by 150
 +
 +=== Mapping sparse conversion ===
 +
 +Offset          Length          File
 +0               0x1000          TEST_DIR/t.IMGFMT
 +
 +=== Mapping non-sparse conversion ===
 +
 +Offset          Length          File
 +0               0x100000        TEST_DIR/t.IMGFMT
 +*** done
 diff --git a/tests/qemu-iotests/175 b/tests/qemu-iotests/175
 index 51e62c8..7ba28b3 100755
 --- a/tests/qemu-iotests/175
 +++ b/tests/qemu-iotests/175
@@ -37,14 +37,16 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 # the file size.  This function hides the resulting difference in the
 # stat -c '%b' output.
 # Parameter 1: Number of blocks an empty file occupies
 -# Parameter 2: Image size in bytes
 +# Parameter 2: Minimal number of blocks in an image
 +# Parameter 3: Image size in bytes
 _filter_blocks()
 {
     extra_blocks=$1
 -    img_size=$2
 +    min_blocks=$2
 +    img_size=$3
 -    sed -e "s/blocks=$extra_blocks\\(\$\\|[^0-9]\\)/nothing allocated/" \
 -        -e "s/blocks=$((extra_blocks + img_size / 512))\\(\$\\|[^0-9]\\)/everything allocated/"
 +    sed -e "s/blocks=$min_blocks\\(\$\\|[^0-9]\\)/min allocation/" \
 +        -e "s/blocks=$((extra_blocks + img_size / 512))\\(\$\\|[^0-9]\\)/max allocation/"
 }
 # get standard environment, filters and checks
@@ -60,16 +62,21 @@ size=$((1 * 1024 * 1024))
 touch "$TEST_DIR/empty"
 extra_blocks=$(stat -c '%b' "$TEST_DIR/empty")
 +# We always write the first byte; check how many blocks this filesystem
 +# allocates to match empty image alloation.
 +printf "\0" > "$TEST_DIR/empty"
 +min_blocks=$(stat -c '%b' "$TEST_DIR/empty")
 +
 echo
 echo "== creating image with default preallocation =="
 _make_test_img $size | _filter_imgfmt
 -stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $size
 +stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_blocks $size
 for mode in off full falloc; do
     echo
     echo "== creating image with preallocation $mode =="
     IMGOPTS=preallocation=$mode _make_test_img $size | _filter_imgfmt
 -    stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $size
 +    stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_blocks $size
 done
 # success, all done
 diff --git a/tests/qemu-iotests/175.out b/tests/qemu-iotests/175.out
 index 6d9a5ed..263e521 100644
 --- a/tests/qemu-iotests/175.out
 +++ b/tests/qemu-iotests/175.out
@@ -2,17 +2,17 @@ QA output created by 175
 == creating image with default preallocation ==
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576
 -size=1048576, nothing allocated
 +size=1048576, min allocation
 == creating image with preallocation off ==
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 preallocation=off
 -size=1048576, nothing allocated
 +size=1048576, min allocation
 == creating image with preallocation full ==
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 preallocation=full
 -size=1048576, everything allocated
 +size=1048576, max allocation
 == creating image with preallocation falloc ==
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 preallocation=falloc
 -size=1048576, everything allocated
 +size=1048576, max allocation
  *** done
 diff --git a/tests/qemu-iotests/178.out.qcow2 b/tests/qemu-iotests/178.out.qcow2
 index 55a8dc9..9e7d8c4 100644
 --- a/tests/qemu-iotests/178.out.qcow2
 +++ b/tests/qemu-iotests/178.out.qcow2
@@ -101,7 +101,7 @@ converted image file size in bytes: 196608
 == raw input image with data (human) ==
 Formatting 'TEST_DIR/t.qcow2', fmt=IMGFMT size=1073741824
 -required size: 393216
 +required size: 458752
 fully allocated size: 1074135040
 wrote 512/512 bytes at offset 512
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
@@ -257,7 +257,7 @@ converted image file size in bytes: 196608
 Formatting 'TEST_DIR/t.qcow2', fmt=IMGFMT size=1073741824
 {
 -    "required": 393216,
 +    "required": 458752,
     "fully-allocated": 1074135040
 }
 wrote 512/512 bytes at offset 512
 diff --git a/tests/qemu-iotests/221.out b/tests/qemu-iotests/221.out
 index 9f9dd52..dca024a 100644
 --- a/tests/qemu-iotests/221.out
 +++ b/tests/qemu-iotests/221.out
@@ -3,14 +3,18 @@ QA output created by 221
 === Check mapping of unaligned raw image ===
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65537
 -[{ "start": 0, "length": 66048, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 -[{ "start": 0, "length": 66048, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 61952, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 61952, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 wrote 1/1 bytes at offset 65536
 1 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 -[{ "start": 0, "length": 65536, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 61440, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 { "start": 65536, "length": 1, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 { "start": 65537, "length": 511, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 -[{ "start": 0, "length": 65536, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 61440, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 { "start": 65536, "length": 1, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 { "start": 65537, "length": 511, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 *** done
 diff --git a/tests/qemu-iotests/253.out b/tests/qemu-iotests/253.out
 index 607c0ba..3d08b30 100644
 --- a/tests/qemu-iotests/253.out
 +++ b/tests/qemu-iotests/253.out
@@ -3,12 +3,16 @@ QA output created by 253
 === Check mapping of unaligned raw image ===
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048575
 -[{ "start": 0, "length": 1048576, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 -[{ "start": 0, "length": 1048576, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 1044480, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 1044480, "depth": 0, "zero": true, "data": false, "offset": OFFSET}]
 wrote 65535/65535 bytes at offset 983040
 63.999 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 -[{ "start": 0, "length": 983040, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 978944, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 { "start": 983040, "length": 65536, "depth": 0, "zero": false, "data": true, "offset": OFFSET}]
 -[{ "start": 0, "length": 983040, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 +[{ "start": 0, "length": 4096, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 +{ "start": 4096, "length": 978944, "depth": 0, "zero": true, "data": false, "offset": OFFSET},
 { "start": 983040, "length": 65536, "depth": 0, "zero": false, "data": true, "offset": OFFSET}]
 *** done
 -- 
 1.8.3.1
--- a/kvm-block-qcow2-Fix-corruption-introduced-by-commit-8ac0.patch
+++ b/kvm-block-qcow2-Fix-corruption-introduced-by-commit-8ac0.patch
@ -1,78 +0,0 @@
 From 554884a1fe9a271ad78771c37e4be5a8f84258fc Mon Sep 17 00:00:00 2001
 From: Maxim Levitsky <mlevitsk@redhat.com>
 Date: Tue, 24 Sep 2019 21:11:50 +0100
 Subject: [PATCH 2/4] block/qcow2: Fix corruption introduced by commit
 8ac0f15f335
 RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
 Message-id: <20190924211152.13461-3-mlevitsk@redhat.com>
 Patchwork-id: 90878
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2 2/4] block/qcow2: Fix corruption introduced by commit 8ac0f15f335
 Bugzilla: 1745922
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 This fixes subtle corruption introduced by luks threaded encryption
 in commit 8ac0f15f335
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1745922
 The corruption happens when we do a write that
   * writes to two or more unallocated clusters at once
   * doesn't fully cover the first sector
   * doesn't fully cover the last sector
   * uses luks encryption
 In this case, when allocating the new clusters we COW both areas
 prior to the write and after the write, and we encrypt them.
 The above mentioned commit accidentally made it so we encrypt the
 second COW area using the physical cluster offset of the first area.
 The problem is that offset_in_cluster in do_perform_cow_encrypt
 can be larger that the cluster size, thus cluster_offset
 will no longer point to the start of the cluster at which encrypted
 area starts.
 Next patch in this series will refactor the code to avoid all these
 assumptions.
 In the bugreport that was triggered by rebasing a luks image to new,
 zero filled base, which lot of such writes, and causes some files
 with zero areas to contain garbage there instead.
 But as described above it can happen elsewhere as well
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-id: 20190915203655.21638-2-mlevitsk@redhat.com
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 38e7d54bdc518b5a05a922467304bcace2396945)
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/qcow2-cluster.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
 diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
 index f2de746..11e5a92 100644
 --- a/block/qcow2-cluster.c
 +++ b/block/qcow2-cluster.c
@@ -473,9 +473,10 @@ static bool coroutine_fn do_perform_cow_encrypt(BlockDriverState *bs,
         assert(QEMU_IS_ALIGNED(offset_in_cluster, BDRV_SECTOR_SIZE));
         assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
         assert(s->crypto);
 -        if (qcow2_co_encrypt(bs, cluster_offset,
 -                             src_cluster_offset + offset_in_cluster,
 -                             buffer, bytes) < 0) {
 +        if (qcow2_co_encrypt(bs,
 +                start_of_cluster(s, cluster_offset + offset_in_cluster),
 +                src_cluster_offset + offset_in_cluster,
 +                buffer, bytes) < 0) {
             return false;
         }
     }
 -- 
 1.8.3.1
--- a/kvm-block-qcow2-refactor-encryption-code.patch
+++ b/kvm-block-qcow2-refactor-encryption-code.patch
@ -1,234 +0,0 @@
 From 780fbdf04884188eca3d5891faa2b2417a88ef14 Mon Sep 17 00:00:00 2001
 From: Maxim Levitsky <mlevitsk@redhat.com>
 Date: Tue, 24 Sep 2019 21:11:51 +0100
 Subject: [PATCH 3/4] block/qcow2: refactor encryption code
 RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
 Message-id: <20190924211152.13461-4-mlevitsk@redhat.com>
 Patchwork-id: 90876
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2 3/4] block/qcow2: refactor encryption code
 Bugzilla: 1745922
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 * Change the qcow2_co_{encrypt|decrypt} to just receive full host and
  guest offsets and use this function directly instead of calling
  do_perform_cow_encrypt (which is removed by that patch).
 * Adjust qcow2_co_encdec to take full host and guest offsets as well.
 * Document the qcow2_co_{encrypt|decrypt} arguments
  to prevent the bug fixed in former commit from hopefully
  happening again.
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Message-id: 20190915203655.21638-3-mlevitsk@redhat.com
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 [mreitz: Let perform_cow() return the error value returned by
         qcow2_co_encrypt(), as proposed by Vladimir]
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 603fbd076c76438b15ec842f0e2d1ba4867dfd00)
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/qcow2-cluster.c | 41 +++++++++++----------------------
 block/qcow2-threads.c | 63 +++++++++++++++++++++++++++++++++++++++------------
 block/qcow2.c         |  5 ++--
 block/qcow2.h         |  8 +++----
 4 files changed, 69 insertions(+), 48 deletions(-)
 diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
 index 11e5a92..b30fd12 100644
 --- a/block/qcow2-cluster.c
 +++ b/block/qcow2-cluster.c
@@ -461,28 +461,6 @@ static int coroutine_fn do_perform_cow_read(BlockDriverState *bs,
     return 0;
 }
 -static bool coroutine_fn do_perform_cow_encrypt(BlockDriverState *bs,
 -                                                uint64_t src_cluster_offset,
 -                                                uint64_t cluster_offset,
 -                                                unsigned offset_in_cluster,
 -                                                uint8_t *buffer,
 -                                                unsigned bytes)
 -{
 -    if (bytes && bs->encrypted) {
 -        BDRVQcow2State *s = bs->opaque;
 -        assert(QEMU_IS_ALIGNED(offset_in_cluster, BDRV_SECTOR_SIZE));
 -        assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
 -        assert(s->crypto);
 -        if (qcow2_co_encrypt(bs,
 -                start_of_cluster(s, cluster_offset + offset_in_cluster),
 -                src_cluster_offset + offset_in_cluster,
 -                buffer, bytes) < 0) {
 -            return false;
 -        }
 -    }
 -    return true;
 -}
 -
 static int coroutine_fn do_perform_cow_write(BlockDriverState *bs,
                                              uint64_t cluster_offset,
                                              unsigned offset_in_cluster,
@@ -887,12 +865,19 @@ static int perform_cow(BlockDriverState *bs, QCowL2Meta *m)
     /* Encrypt the data if necessary before writing it */
     if (bs->encrypted) {
 -        if (!do_perform_cow_encrypt(bs, m->offset, m->alloc_offset,
 -                                    start->offset, start_buffer,
 -                                    start->nb_bytes) ||
 -            !do_perform_cow_encrypt(bs, m->offset, m->alloc_offset,
 -                                    end->offset, end_buffer, end->nb_bytes)) {
 -            ret = -EIO;
 +        ret = qcow2_co_encrypt(bs,
 +                               m->alloc_offset + start->offset,
 +                               m->offset + start->offset,
 +                               start_buffer, start->nb_bytes);
 +        if (ret < 0) {
 +            goto fail;
 +        }
 +
 +        ret = qcow2_co_encrypt(bs,
 +                               m->alloc_offset + end->offset,
 +                               m->offset + end->offset,
 +                               end_buffer, end->nb_bytes);
 +        if (ret < 0) {
             goto fail;
         }
     }
 diff --git a/block/qcow2-threads.c b/block/qcow2-threads.c
 index 3b1e63f..8f5a0d1 100644
 --- a/block/qcow2-threads.c
 +++ b/block/qcow2-threads.c
@@ -234,35 +234,70 @@ static int qcow2_encdec_pool_func(void *opaque)
 }
 static int coroutine_fn
 -qcow2_co_encdec(BlockDriverState *bs, uint64_t file_cluster_offset,
 -                  uint64_t offset, void *buf, size_t len, Qcow2EncDecFunc func)
 +qcow2_co_encdec(BlockDriverState *bs, uint64_t host_offset,
 +                uint64_t guest_offset, void *buf, size_t len,
 +                Qcow2EncDecFunc func)
 {
     BDRVQcow2State *s = bs->opaque;
     Qcow2EncDecData arg = {
         .block = s->crypto,
 -        .offset = s->crypt_physical_offset ?
 -                      file_cluster_offset + offset_into_cluster(s, offset) :
 -                      offset,
 +        .offset = s->crypt_physical_offset ? host_offset : guest_offset,
         .buf = buf,
         .len = len,
         .func = func,
     };
 -    return qcow2_co_process(bs, qcow2_encdec_pool_func, &arg);
 +    assert(QEMU_IS_ALIGNED(guest_offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(host_offset, BDRV_SECTOR_SIZE));
 +    assert(QEMU_IS_ALIGNED(len, BDRV_SECTOR_SIZE));
 +    assert(s->crypto);
 +
 +    return len == 0 ? 0 : qcow2_co_process(bs, qcow2_encdec_pool_func, &arg);
 }
 +/*
 + * qcow2_co_encrypt()
 + *
 + * Encrypts one or more contiguous aligned sectors
 + *
 + * @host_offset - underlying storage offset of the first sector of the
 + * data to be encrypted
 + *
 + * @guest_offset - guest (virtual) offset of the first sector of the
 + * data to be encrypted
 + *
 + * @buf - buffer with the data to encrypt, that after encryption
 + *        will be written to the underlying storage device at
 + *        @host_offset
 + *
 + * @len - length of the buffer (must be a BDRV_SECTOR_SIZE multiple)
 + *
 + * Depending on the encryption method, @host_offset and/or @guest_offset
 + * may be used for generating the initialization vector for
 + * encryption.
 + *
 + * Note that while the whole range must be aligned on sectors, it
 + * does not have to be aligned on clusters and can also cross cluster
 + * boundaries
 + */
 int coroutine_fn
 -qcow2_co_encrypt(BlockDriverState *bs, uint64_t file_cluster_offset,
 -                 uint64_t offset, void *buf, size_t len)
 +qcow2_co_encrypt(BlockDriverState *bs, uint64_t host_offset,
 +                 uint64_t guest_offset, void *buf, size_t len)
 {
 -    return qcow2_co_encdec(bs, file_cluster_offset, offset, buf, len,
 -                             qcrypto_block_encrypt);
 +    return qcow2_co_encdec(bs, host_offset, guest_offset, buf, len,
 +                           qcrypto_block_encrypt);
 }
 +/*
 + * qcow2_co_decrypt()
 + *
 + * Decrypts one or more contiguous aligned sectors
 + * Similar to qcow2_co_encrypt
 + */
 int coroutine_fn
 -qcow2_co_decrypt(BlockDriverState *bs, uint64_t file_cluster_offset,
 -                 uint64_t offset, void *buf, size_t len)
 +qcow2_co_decrypt(BlockDriverState *bs, uint64_t host_offset,
 +                 uint64_t guest_offset, void *buf, size_t len)
 {
 -    return qcow2_co_encdec(bs, file_cluster_offset, offset, buf, len,
 -                             qcrypto_block_decrypt);
 +    return qcow2_co_encdec(bs, host_offset, guest_offset, buf, len,
 +                           qcrypto_block_decrypt);
 }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index dc4302f..d4c4f24 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -2073,7 +2073,8 @@ static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
                 assert(s->crypto);
                 assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
                 assert(QEMU_IS_ALIGNED(cur_bytes, BDRV_SECTOR_SIZE));
 -                if (qcow2_co_decrypt(bs, cluster_offset, offset,
 +                if (qcow2_co_decrypt(bs, cluster_offset + offset_in_cluster,
 +                                     offset,
                                      cluster_data, cur_bytes) < 0) {
                     ret = -EIO;
                     goto fail;
@@ -2288,7 +2289,7 @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
 -            if (qcow2_co_encrypt(bs, cluster_offset, offset,
 +            if (qcow2_co_encrypt(bs, cluster_offset + offset_in_cluster, offset,
                                  cluster_data, cur_bytes) < 0) {
                 ret = -EIO;
                 goto out_unlocked;
 diff --git a/block/qcow2.h b/block/qcow2.h
 index fc1b0d3..b54e734 100644
 --- a/block/qcow2.h
 +++ b/block/qcow2.h
@@ -757,10 +757,10 @@ ssize_t coroutine_fn
 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
                     const void *src, size_t src_size);
 int coroutine_fn
 -qcow2_co_encrypt(BlockDriverState *bs, uint64_t file_cluster_offset,
 -                 uint64_t offset, void *buf, size_t len);
 +qcow2_co_encrypt(BlockDriverState *bs, uint64_t host_offset,
 +                 uint64_t guest_offset, void *buf, size_t len);
 int coroutine_fn
 -qcow2_co_decrypt(BlockDriverState *bs, uint64_t file_cluster_offset,
 -                 uint64_t offset, void *buf, size_t len);
 +qcow2_co_decrypt(BlockDriverState *bs, uint64_t host_offset,
 +                 uint64_t guest_offset, void *buf, size_t len);
 #endif
 -- 
 1.8.3.1
--- a/kvm-blockdev-reduce-aio_context-locked-sections-in-bitma.patch
+++ b/kvm-blockdev-reduce-aio_context-locked-sections-in-bitma.patch
@ -1,122 +0,0 @@
 From 107ad619739795199df98c56d0ad4db14fec3722 Mon Sep 17 00:00:00 2001
 From: John Snow <jsnow@redhat.com>
 Date: Fri, 27 Sep 2019 20:18:44 +0100
 Subject: [PATCH 1/6] blockdev: reduce aio_context locked sections in bitmap
 add/remove
 RH-Author: John Snow <jsnow@redhat.com>
 Message-id: <20190927201846.6823-2-jsnow@redhat.com>
 Patchwork-id: 90908
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/3] blockdev: reduce aio_context locked sections in bitmap add/remove
 Bugzilla: 1756413
 RH-Acked-by: Maxim Levitsky <mlevitsk@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Commit 0a6c86d024c52 returned these locks back to add/remove
 functionality, to protect from intersection of persistent bitmap
 related IO with other IO. But other bitmap-related functions called
 here are unrelated to the problem, and there are no needs to keep these
 calls inside critical sections.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: John Snow <jsnow@redhat.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20190708220502.12977-2-jsnow@redhat.com
 Signed-off-by: John Snow <jsnow@redhat.com>
 (cherry picked from commit 2899f41eef2806cf8eb119811c9d6fcf15ce80f6)
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 blockdev.c | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)
 diff --git a/blockdev.c b/blockdev.c
 index 4d141e9..0124825 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -2811,7 +2811,6 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
 {
     BlockDriverState *bs;
     BdrvDirtyBitmap *bitmap;
 -    AioContext *aio_context = NULL;
     if (!name || name[0] == '\0') {
         error_setg(errp, "Bitmap name cannot be empty");
@@ -2847,16 +2846,20 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
     }
     if (persistent) {
 -        aio_context = bdrv_get_aio_context(bs);
 +        AioContext *aio_context = bdrv_get_aio_context(bs);
 +        bool ok;
 +
         aio_context_acquire(aio_context);
 -        if (!bdrv_can_store_new_dirty_bitmap(bs, name, granularity, errp)) {
 -            goto out;
 +        ok = bdrv_can_store_new_dirty_bitmap(bs, name, granularity, errp);
 +        aio_context_release(aio_context);
 +        if (!ok) {
 +            return;
         }
     }
     bitmap = bdrv_create_dirty_bitmap(bs, granularity, name, errp);
     if (bitmap == NULL) {
 -        goto out;
 +        return;
     }
     if (disabled) {
@@ -2864,10 +2867,6 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
     }
     bdrv_dirty_bitmap_set_persistence(bitmap, persistent);
 - out:
 -    if (aio_context) {
 -        aio_context_release(aio_context);
 -    }
 }
 void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
@@ -2875,8 +2874,6 @@ void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
 {
     BlockDriverState *bs;
     BdrvDirtyBitmap *bitmap;
 -    Error *local_err = NULL;
 -    AioContext *aio_context = NULL;
     bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
     if (!bitmap || !bs) {
@@ -2889,20 +2886,19 @@ void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
     }
     if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
 -        aio_context = bdrv_get_aio_context(bs);
 +        AioContext *aio_context = bdrv_get_aio_context(bs);
 +        Error *local_err = NULL;
 +
         aio_context_acquire(aio_context);
         bdrv_remove_persistent_dirty_bitmap(bs, name, &local_err);
 +        aio_context_release(aio_context);
         if (local_err != NULL) {
             error_propagate(errp, local_err);
 -            goto out;
 +            return;
         }
     }
     bdrv_release_dirty_bitmap(bs, bitmap);
 - out:
 -    if (aio_context) {
 -        aio_context_release(aio_context);
 -    }
 }
 /**
 -- 
 1.8.3.1
--- a/kvm-blockjob-update-nodes-head-while-removing-all-bdrv.patch
+++ b/kvm-blockjob-update-nodes-head-while-removing-all-bdrv.patch
@ -1,72 +0,0 @@
 From 49dd008d58d7527a98981d96106949b2913fb4d9 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Wed, 18 Sep 2019 11:34:14 +0100
 Subject: [PATCH 1/4] blockjob: update nodes head while removing all bdrv
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20190918113414.24522-2-slp@redhat.com>
 Patchwork-id: 90748
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/1] blockjob: update nodes head while removing all bdrv
 Bugzilla: 1746631
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 block_job_remove_all_bdrv() iterates through job->nodes, calling
 bdrv_root_unref_child() for each entry. The call to the latter may
 reach child_job_[can_]set_aio_ctx(), which will also attempt to
 traverse job->nodes, potentially finding entries that where freed
 on previous iterations.
 To avoid this situation, update job->nodes head on each iteration to
 ensure that already freed entries are no longer linked to the list.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1746631
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20190911100316.32282-1-mreitz@redhat.com
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit d876bf676f5e7c6aa9ac64555e48cba8734ecb2f)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 blockjob.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)
 diff --git a/blockjob.c b/blockjob.c
 index 20b7f55..74abb97 100644
 --- a/blockjob.c
 +++ b/blockjob.c
@@ -186,14 +186,23 @@ static const BdrvChildRole child_job = {
 void block_job_remove_all_bdrv(BlockJob *job)
 {
 -    GSList *l;
 -    for (l = job->nodes; l; l = l->next) {
 +    /*
 +     * bdrv_root_unref_child() may reach child_job_[can_]set_aio_ctx(),
 +     * which will also traverse job->nodes, so consume the list one by
 +     * one to make sure that such a concurrent access does not attempt
 +     * to process an already freed BdrvChild.
 +     */
 +    while (job->nodes) {
 +        GSList *l = job->nodes;
         BdrvChild *c = l->data;
 +
 +        job->nodes = l->next;
 +
         bdrv_op_unblock_all(c->bs, job->blocker);
         bdrv_root_unref_child(c);
 +
 +        g_slist_free_1(l);
     }
 -    g_slist_free(job->nodes);
 -    job->nodes = NULL;
 }
 bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs)
 -- 
 1.8.3.1
--- a/kvm-ehci-fix-queue-dev-null-ptr-dereference.patch
+++ b/kvm-ehci-fix-queue-dev-null-ptr-dereference.patch
@ -1,50 +0,0 @@
 From 0b38614471dbc44b87a1d2449e602df50c3ff535 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Thu, 5 Sep 2019 08:50:37 +0100
 Subject: [PATCH 2/6] ehci: fix queue->dev null ptr dereference
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190905085037.5648-2-dgilbert@redhat.com>
 Patchwork-id: 90288
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 1/1] ehci: fix queue->dev null ptr dereference
 Bugzilla: 1746790
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Juan Quintela <quintela@redhat.com>
 From: Gerd Hoffmann <kraxel@redhat.com>
 In case we don't have a device for an active queue, just skip
 processing the queue (same we do for inactive queues) and log
 a guest bug.
 Reported-by: Guenter Roeck <linux@roeck-us.net>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Tested-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 20190821085319.13711-1-kraxel@redhat.com
 (cherry picked from commit 1be344b7ad25d572dadeee46d80f0103354352b2)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/usb/hcd-ehci.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
 index 62dab05..5f089f3 100644
 --- a/hw/usb/hcd-ehci.c
 +++ b/hw/usb/hcd-ehci.c
@@ -1834,6 +1834,9 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
             ehci_set_state(q->ehci, q->async, EST_EXECUTING);
             break;
         }
 +    } else if (q->dev == NULL) {
 +        ehci_trace_guest_bug(q->ehci, "no device attached to queue");
 +        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
     } else {
         p = ehci_alloc_packet(q);
         p->qtdaddr = q->qtdaddr;
 -- 
 1.8.3.1
--- a/kvm-file-posix-Handle-undetectable-alignment.patch
+++ b/kvm-file-posix-Handle-undetectable-alignment.patch
@ -1,129 +0,0 @@
 From 790cebc2a1d8de8d93b2a2a0ef19e31c767f4f1c Mon Sep 17 00:00:00 2001
 From: Max Reitz <mreitz@redhat.com>
 Date: Mon, 9 Sep 2019 07:38:20 +0100
 Subject: [PATCH 4/6] file-posix: Handle undetectable alignment
 RH-Author: Max Reitz <mreitz@redhat.com>
 Message-id: <20190909073822.26191-2-mreitz@redhat.com>
 Patchwork-id: 90332
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/3] file-posix: Handle undetectable alignment
 Bugzilla: 1749134
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 From: Nir Soffer <nirsof@gmail.com>
 In some cases buf_align or request_alignment cannot be detected:
 1. With Gluster, buf_align cannot be detected since the actual I/O is
   done on Gluster server, and qemu buffer alignment does not matter.
   Since we don't have alignment requirement, buf_align=1 is the best
   value.
 2. With local XFS filesystem, buf_align cannot be detected if reading
   from unallocated area. In this we must align the buffer, but we don't
   know what is the correct size. Using the wrong alignment results in
   I/O error.
 3. With Gluster backed by XFS, request_alignment cannot be detected if
   reading from unallocated area. In this case we need to use the
   correct alignment, and failing to do so results in I/O errors.
 4. With NFS, the server does not use direct I/O, so both buf_align cannot
   be detected. In this case we don't need any alignment so we can use
   buf_align=1 and request_alignment=1.
 These cases seems to work when storage sector size is 512 bytes, because
 the current code starts checking align=512. If the check succeeds
 because alignment cannot be detected we use 512. But this does not work
 for storage with 4k sector size.
 To determine if we can detect the alignment, we probe first with
 align=1. If probing succeeds, maybe there are no alignment requirement
 (cases 1, 4) or we are probing unallocated area (cases 2, 3). Since we
 don't have any way to tell, we treat this as undetectable alignment. If
 probing with align=1 fails with EINVAL, but probing with one of the
 expected alignments succeeds, we know that we found a working alignment.
 Practically the alignment requirements are the same for buffer
 alignment, buffer length, and offset in file. So in case we cannot
 detect buf_align, we can use request alignment. If we cannot detect
 request alignment, we can fallback to a safe value. To use this logic,
 we probe first request alignment instead of buf_align.
 Here is a table showing the behaviour with current code (the value in
 parenthesis is the optimal value).
 Case    Sector    buf_align (opt)   request_alignment (opt)     result
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block/file-posix.c | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 4479cc7..b8b4dad 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -323,6 +323,7 @@ static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
     BDRVRawState *s = bs->opaque;
     char *buf;
     size_t max_align = MAX(MAX_BLOCKSIZE, getpagesize());
 +    size_t alignments[] = {1, 512, 1024, 2048, 4096};
     /* For SCSI generic devices the alignment is not really used.
        With buffered I/O, we don't have any restrictions. */
@@ -349,25 +350,38 @@ static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
     }
 #endif
 -    /* If we could not get the sizes so far, we can only guess them */
 -    if (!s->buf_align) {
 +    /*
 +     * If we could not get the sizes so far, we can only guess them. First try
 +     * to detect request alignment, since it is more likely to succeed. Then
 +     * try to detect buf_align, which cannot be detected in some cases (e.g.
 +     * Gluster). If buf_align cannot be detected, we fallback to the value of
 +     * request_alignment.
 +     */
 +
 +    if (!bs->bl.request_alignment) {
 +        int i;
         size_t align;
 -        buf = qemu_memalign(max_align, 2 * max_align);
 -        for (align = 512; align <= max_align; align <<= 1) {
 -            if (raw_is_io_aligned(fd, buf + align, max_align)) {
 -                s->buf_align = align;
 +        buf = qemu_memalign(max_align, max_align);
 +        for (i = 0; i < ARRAY_SIZE(alignments); i++) {
 +            align = alignments[i];
 +            if (raw_is_io_aligned(fd, buf, align)) {
 +                /* Fallback to safe value. */
 +                bs->bl.request_alignment = (align != 1) ? align : max_align;
                 break;
             }
         }
         qemu_vfree(buf);
     }
 -    if (!bs->bl.request_alignment) {
 +    if (!s->buf_align) {
 +        int i;
         size_t align;
 -        buf = qemu_memalign(s->buf_align, max_align);
 -        for (align = 512; align <= max_align; align <<= 1) {
 -            if (raw_is_io_aligned(fd, buf, align)) {
 -                bs->bl.request_alignment = align;
 +        buf = qemu_memalign(max_align, 2 * max_align);
 +        for (i = 0; i < ARRAY_SIZE(alignments); i++) {
 +            align = alignments[i];
 +            if (raw_is_io_aligned(fd, buf + align, max_align)) {
 +                /* Fallback to request_aligment. */
 +                s->buf_align = (align != 1) ? align : bs->bl.request_alignment;
                 break;
             }
         }
 -- 
 1.8.3.1
--- a/kvm-hostmem-file-fix-pmem-file-size-check.patch
+++ b/kvm-hostmem-file-fix-pmem-file-size-check.patch
@ -1,70 +0,0 @@
 From c7c95a2f14d94eb8213ce7cab03acdef40fed093 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Wed, 18 Sep 2019 15:10:06 +0100
 Subject: [PATCH 2/4] hostmem-file: fix pmem file size check
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20190918151007.27973-2-stefanha@redhat.com>
 Patchwork-id: 90763
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/2] hostmem-file: fix pmem file size check
 Bugzilla: 1724008 1736788
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
 Commit 314aec4a6e06844937f1677f6cba21981005f389 ("hostmem-file: reject
 invalid pmem file sizes") added a file size check that verifies the
 hostmem object's size parameter against the actual devdax pmem file.
 This is useful because getting the size wrong results in confusing
 errors inside the guest.
 However, the code doesn't work properly for files where struct
 stat::st_size is zero.  Hostmem-file's ->alloc() function returns early
 without setting an Error, causing the following assertion failure:
  qemu/memory.c:2215: memory_region_get_ram_ptr: Assertion `mr->ram_block' failed.
 This patch handles the case where qemu_get_pmem_size() returns 0 but
 there is no error.
 Fixes: 314aec4a6e06844937f1677f6cba21981005f389
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20190823135632.25010-1-stefanha@redhat.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit 7faae95ebc966c2981b78cf7c25009dfa32d4b72)
 Note that this commit will be effectively reverted by the next one but I
 backported it to avoid conflicts.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 backends/hostmem-file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
 index 29e55c9..ecc15e3 100644
 --- a/backends/hostmem-file.c
 +++ b/backends/hostmem-file.c
@@ -67,12 +67,12 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
         uint64_t size;
         size = qemu_get_pmem_size(fb->mem_path, &local_err);
 -        if (!size) {
 +        if (local_err) {
             error_propagate(errp, local_err);
             return;
         }
 -        if (backend->size > size) {
 +        if (size && backend->size > size) {
             error_setg(errp, "size property %" PRIu64 " is larger than "
                        "pmem file \"%s\" size %" PRIu64, backend->size,
                        fb->mem_path, size);
 -- 
 1.8.3.1
--- a/kvm-iotests-Test-allocate_first_block-with-O_DIRECT.patch
+++ b/kvm-iotests-Test-allocate_first_block-with-O_DIRECT.patch
@ -1,109 +0,0 @@
 From b261b31812a3e89a9104fb33bb2339b1742ac494 Mon Sep 17 00:00:00 2001
 From: Max Reitz <mreitz@redhat.com>
 Date: Mon, 9 Sep 2019 07:38:22 +0100
 Subject: [PATCH 6/6] iotests: Test allocate_first_block() with O_DIRECT
 RH-Author: Max Reitz <mreitz@redhat.com>
 Message-id: <20190909073822.26191-4-mreitz@redhat.com>
 Patchwork-id: 90334
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 3/3] iotests: Test allocate_first_block() with O_DIRECT
 Bugzilla: 1749134
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 From: Nir Soffer <nirsof@gmail.com>
 Using block_resize we can test allocate_first_block() with file
 descriptor opened with O_DIRECT, ensuring that it works for any size
 larger than 4096 bytes.
 Testing smaller sizes is tricky as the result depends on the filesystem
 used for testing. For example on NFS any size will work since O_DIRECT
 does not require any alignment.
 Signed-off-by: Nir Soffer <nsoffer@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20190827010528.8818-3-nsoffer@redhat.com
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 7e3dc2ba9a11862d4e1a08325b9165f27a1b1e7c)
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 tests/qemu-iotests/175     | 28 ++++++++++++++++++++++++++++
 tests/qemu-iotests/175.out |  8 ++++++++
 2 files changed, 36 insertions(+)
 diff --git a/tests/qemu-iotests/175 b/tests/qemu-iotests/175
 index 7ba28b3..55db280 100755
 --- a/tests/qemu-iotests/175
 +++ b/tests/qemu-iotests/175
@@ -49,6 +49,23 @@ _filter_blocks()
         -e "s/blocks=$((extra_blocks + img_size / 512))\\(\$\\|[^0-9]\\)/max allocation/"
 }
 +# Resize image using block_resize.
 +# Parameter 1: image path
 +# Parameter 2: new size
 +_block_resize()
 +{
 +    local path=$1
 +    local size=$2
 +
 +    $QEMU -qmp stdio -nographic -nodefaults \
 +        -blockdev file,node-name=file,filename=$path,cache.direct=on \
 +        <<EOF
 +{'execute': 'qmp_capabilities'}
 +{'execute': 'block_resize', 'arguments': {'node-name': 'file', 'size': $size}}
 +{'execute': 'quit'}
 +EOF
 +}
 +
 # get standard environment, filters and checks
 . ./common.rc
 . ./common.filter
@@ -57,6 +74,9 @@ _supported_fmt raw
 _supported_proto file
 _supported_os Linux
 +_default_cache_mode none
 +_supported_cache_modes none directsync
 +
 size=$((1 * 1024 * 1024))
 touch "$TEST_DIR/empty"
@@ -79,6 +99,14 @@ for mode in off full falloc; do
     stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_blocks $size
 done
 +for new_size in 4096 1048576; do
 +    echo
 +    echo "== resize empty image with block_resize =="
 +    _make_test_img 0 | _filter_imgfmt
 +    _block_resize $TEST_IMG $new_size >/dev/null
 +    stat -c "size=%s, blocks=%b" $TEST_IMG | _filter_blocks $extra_blocks $min_blocks $new_size
 +done
 +
 # success, all done
 echo "*** done"
 rm -f $seq.full
 diff --git a/tests/qemu-iotests/175.out b/tests/qemu-iotests/175.out
 index 263e521..39c2ee0 100644
 --- a/tests/qemu-iotests/175.out
 +++ b/tests/qemu-iotests/175.out
@@ -15,4 +15,12 @@ size=1048576, max allocation
 == creating image with preallocation falloc ==
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 preallocation=falloc
 size=1048576, max allocation
 +
 +== resize empty image with block_resize ==
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=0
 +size=4096, min allocation
 +
 +== resize empty image with block_resize ==
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=0
 +size=1048576, min allocation
  *** done
 -- 
 1.8.3.1
--- a/kvm-iotests-test-bitmap-moving-inside-254.patch
+++ b/kvm-iotests-test-bitmap-moving-inside-254.patch
@ -1,209 +0,0 @@
 From b15fa18e724e356bd889f0566d512daedb9a09dc Mon Sep 17 00:00:00 2001
 From: John Snow <jsnow@redhat.com>
 Date: Fri, 27 Sep 2019 20:18:46 +0100
 Subject: [PATCH 3/6] iotests: test bitmap moving inside 254
 RH-Author: John Snow <jsnow@redhat.com>
 Message-id: <20190927201846.6823-4-jsnow@redhat.com>
 Patchwork-id: 90910
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 3/3] iotests: test bitmap moving inside 254
 Bugzilla: 1756413
 RH-Acked-by: Maxim Levitsky <mlevitsk@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Test persistent bitmap copying with and without removal of original
 bitmap.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20190708220502.12977-4-jsnow@redhat.com
 [Edited comment "bitmap1" --> "bitmap2" as per review. --js]
 Signed-off-by: John Snow <jsnow@redhat.com>
 (cherry picked from commit 3f7b2fa8cd476fe871ce1d996c640317730752a0)
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 tests/qemu-iotests/254     | 30 +++++++++++++++--
 tests/qemu-iotests/254.out | 82 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+), 2 deletions(-)
 diff --git a/tests/qemu-iotests/254 b/tests/qemu-iotests/254
 index 8edba91..09584f3 100755
 --- a/tests/qemu-iotests/254
 +++ b/tests/qemu-iotests/254
@@ -1,6 +1,6 @@
 #!/usr/bin/env python
 #
 -# Test external snapshot with bitmap copying.
 +# Test external snapshot with bitmap copying and moving.
 #
 # Copyright (c) 2019 Virtuozzo International GmbH. All rights reserved.
 #
@@ -32,6 +32,10 @@ vm = iotests.VM().add_drive(disk, opts='node-name=base')
 vm.launch()
 vm.qmp_log('block-dirty-bitmap-add', node='drive0', name='bitmap0')
 +vm.qmp_log('block-dirty-bitmap-add', node='drive0', name='bitmap1',
 +           persistent=True)
 +vm.qmp_log('block-dirty-bitmap-add', node='drive0', name='bitmap2',
 +           persistent=True)
 vm.hmp_qemu_io('drive0', 'write 0 512K')
@@ -39,16 +43,38 @@ vm.qmp_log('transaction', indent=2, actions=[
     {'type': 'blockdev-snapshot-sync',
      'data': {'device': 'drive0', 'snapshot-file': top,
               'snapshot-node-name': 'snap'}},
 +
 +    # copy non-persistent bitmap0
     {'type': 'block-dirty-bitmap-add',
      'data': {'node': 'snap', 'name': 'bitmap0'}},
     {'type': 'block-dirty-bitmap-merge',
      'data': {'node': 'snap', 'target': 'bitmap0',
 -              'bitmaps': [{'node': 'base', 'name': 'bitmap0'}]}}
 +              'bitmaps': [{'node': 'base', 'name': 'bitmap0'}]}},
 +
 +    # copy persistent bitmap1, original will be saved to base image
 +    {'type': 'block-dirty-bitmap-add',
 +     'data': {'node': 'snap', 'name': 'bitmap1', 'persistent': True}},
 +    {'type': 'block-dirty-bitmap-merge',
 +     'data': {'node': 'snap', 'target': 'bitmap1',
 +              'bitmaps': [{'node': 'base', 'name': 'bitmap1'}]}},
 +
 +    # move persistent bitmap2, original will be removed and not saved
 +    # to base image
 +    {'type': 'block-dirty-bitmap-add',
 +     'data': {'node': 'snap', 'name': 'bitmap2', 'persistent': True}},
 +    {'type': 'block-dirty-bitmap-merge',
 +     'data': {'node': 'snap', 'target': 'bitmap2',
 +              'bitmaps': [{'node': 'base', 'name': 'bitmap2'}]}},
 +    {'type': 'block-dirty-bitmap-remove',
 +     'data': {'node': 'base', 'name': 'bitmap2'}}
 ], filters=[iotests.filter_qmp_testfiles])
 result = vm.qmp('query-block')['return'][0]
 log("query-block: device = {}, node-name = {}, dirty-bitmaps:".format(
     result['device'], result['inserted']['node-name']))
 log(result['dirty-bitmaps'], indent=2)
 +log("\nbitmaps in backing image:")
 +log(result['inserted']['image']['backing-image']['format-specific'] \
 +    ['data']['bitmaps'], indent=2)
 vm.shutdown()
 diff --git a/tests/qemu-iotests/254.out b/tests/qemu-iotests/254.out
 index d7394cf..d185c05 100644
 --- a/tests/qemu-iotests/254.out
 +++ b/tests/qemu-iotests/254.out
@@ -1,5 +1,9 @@
 {"execute": "block-dirty-bitmap-add", "arguments": {"name": "bitmap0", "node": "drive0"}}
 {"return": {}}
 +{"execute": "block-dirty-bitmap-add", "arguments": {"name": "bitmap1", "node": "drive0", "persistent": true}}
 +{"return": {}}
 +{"execute": "block-dirty-bitmap-add", "arguments": {"name": "bitmap2", "node": "drive0", "persistent": true}}
 +{"return": {}}
 {
   "execute": "transaction",
   "arguments": {
@@ -31,6 +35,55 @@
           "target": "bitmap0"
         },
         "type": "block-dirty-bitmap-merge"
 +      },
 +      {
 +        "data": {
 +          "name": "bitmap1",
 +          "node": "snap",
 +          "persistent": true
 +        },
 +        "type": "block-dirty-bitmap-add"
 +      },
 +      {
 +        "data": {
 +          "bitmaps": [
 +            {
 +              "name": "bitmap1",
 +              "node": "base"
 +            }
 +          ],
 +          "node": "snap",
 +          "target": "bitmap1"
 +        },
 +        "type": "block-dirty-bitmap-merge"
 +      },
 +      {
 +        "data": {
 +          "name": "bitmap2",
 +          "node": "snap",
 +          "persistent": true
 +        },
 +        "type": "block-dirty-bitmap-add"
 +      },
 +      {
 +        "data": {
 +          "bitmaps": [
 +            {
 +              "name": "bitmap2",
 +              "node": "base"
 +            }
 +          ],
 +          "node": "snap",
 +          "target": "bitmap2"
 +        },
 +        "type": "block-dirty-bitmap-merge"
 +      },
 +      {
 +        "data": {
 +          "name": "bitmap2",
 +          "node": "base"
 +        },
 +        "type": "block-dirty-bitmap-remove"
       }
     ]
   }
@@ -44,9 +97,38 @@ query-block: device = drive0, node-name = snap, dirty-bitmaps:
     "busy": false,
     "count": 524288,
     "granularity": 65536,
 +    "name": "bitmap2",
 +    "persistent": true,
 +    "recording": true,
 +    "status": "active"
 +  },
 +  {
 +    "busy": false,
 +    "count": 524288,
 +    "granularity": 65536,
 +    "name": "bitmap1",
 +    "persistent": true,
 +    "recording": true,
 +    "status": "active"
 +  },
 +  {
 +    "busy": false,
 +    "count": 524288,
 +    "granularity": 65536,
     "name": "bitmap0",
     "persistent": false,
     "recording": true,
     "status": "active"
   }
 ]
 +
 +bitmaps in backing image:
 +[
 +  {
 +    "flags": [
 +      "auto"
 +    ],
 +    "granularity": 65536,
 +    "name": "bitmap1"
 +  }
 +]
 -- 
 1.8.3.1
--- a/kvm-machine-types-Update-hw_compat_rhel_8_0-from-hw_comp.patch
+++ b/kvm-machine-types-Update-hw_compat_rhel_8_0-from-hw_comp.patch
@ -1,59 +0,0 @@
 From 9f2bfaaa73a8fb2790ebc4fb16f5d3a629b39898 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 31 Jul 2019 15:08:14 +0100
 Subject: [PATCH 5/6] machine types: Update hw_compat_rhel_8_0 from
 hw_compat_4_0
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190731150814.29571-6-dgilbert@redhat.com>
 Patchwork-id: 89817
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 5/5] machine types: Update hw_compat_rhel_8_0 from hw_compat_4_0
 Bugzilla: 1719649
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Pull in the 4_0 compat entries into hw_compat_rhel_8_0
 We don't need pl031's migrate-tick-offset because it's an ARM only
 device and we don't have compatible types for Aarch yet.
 We don't have to copy virtio-balloon-device.qemu-4-0-config-size=false from
 hw_compat_3_1[], since it immediately got reverted in hw_compat_4_0[].
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/machine.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index f30afe0..e2f812a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -54,6 +54,20 @@ GlobalProperty hw_compat_rhel_8_0[] = {
     { "virtio-blk-device", "discard", "false" },
     /* hw_compat_rhel_8_0 from hw_compat_3_1 */
     { "virtio-blk-device", "write-zeroes", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "VGA",            "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "secondary-vga",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "bochs-display",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-gpu-pci", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
 +    { "pcie-root-port-base", "disable-acs", "true" },
 };
 const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
 -- 
 1.8.3.1
--- a/kvm-memory-Fix-up-memory_region_-add-del-_coalescing.patch
+++ b/kvm-memory-Fix-up-memory_region_-add-del-_coalescing.patch
@ -1,118 +0,0 @@
 From b9b48ed46d2b0a3dd6e8406946eb0516ec75a004 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Fri, 23 Aug 2019 06:14:31 +0100
 Subject: [PATCH 4/5] memory: Fix up memory_region_{add|del}_coalescing
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20190823061431.31759-5-peterx@redhat.com>
 Patchwork-id: 90136
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 4/4] memory: Fix up memory_region_{add|del}_coalescing
 Bugzilla: 1743142
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 The old memory_region_{add|clear}_coalescing() has some defects
 because they both changed mr->coalesced before updating the regions
 using memory_region_update_coalesced_range_as().  Then when the
 regions were updated in memory_region_update_coalesced_range_as() the
 mr->coalesced will always be either one more or one less.  So:
 - For memory_region_add_coalescing: it'll always trying to remove the
  newly added coalesced region while it shouldn't, and,
 - For memory_region_clear_coalescing: when it calls the update there
  will be no coalesced ranges on mr->coalesced because they were all
  removed before hand so the update will probably do nothing for real.
 Let's fix this.  Now we've got flat_range_coalesced_io_notify() to
 notify a single CoalescedMemoryRange instance change, so use it in the
 existing memory_region_update_coalesced_range() logic by only notify
 either an addition or deletion.  Then we hammer both the
 memory_region_{add|clear}_coalescing() to use it.
 Fixes: 3ac7d43a6fbb5d4a3
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20190820141328.10009-5-peterx@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit b960fc1796fb078c21121abf01499603b66b3f57)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 memory.c | 36 +++++++++++++++++-------------------
 1 file changed, 17 insertions(+), 19 deletions(-)
 diff --git a/memory.c b/memory.c
 index c7cd43f..2f15180 100644
 --- a/memory.c
 +++ b/memory.c
@@ -2238,27 +2238,26 @@ void memory_region_ram_resize(MemoryRegion *mr, ram_addr_t newsize, Error **errp
     qemu_ram_resize(mr->ram_block, newsize, errp);
 }
 -static void memory_region_update_coalesced_range_as(MemoryRegion *mr, AddressSpace *as)
 +/*
 + * Call proper memory listeners about the change on the newly
 + * added/removed CoalescedMemoryRange.
 + */
 +static void memory_region_update_coalesced_range(MemoryRegion *mr,
 +                                                 CoalescedMemoryRange *cmr,
 +                                                 bool add)
 {
 +    AddressSpace *as;
     FlatView *view;
     FlatRange *fr;
 -    view = address_space_get_flatview(as);
 -    FOR_EACH_FLAT_RANGE(fr, view) {
 -        if (fr->mr == mr) {
 -            flat_range_coalesced_io_del(fr, as);
 -            flat_range_coalesced_io_add(fr, as);
 -        }
 -    }
 -    flatview_unref(view);
 -}
 -
 -static void memory_region_update_coalesced_range(MemoryRegion *mr)
 -{
 -    AddressSpace *as;
 -
     QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {
 -        memory_region_update_coalesced_range_as(mr, as);
 +        view = address_space_get_flatview(as);
 +        FOR_EACH_FLAT_RANGE(fr, view) {
 +            if (fr->mr == mr) {
 +                flat_range_coalesced_io_notify(fr, as, cmr, add);
 +            }
 +        }
 +        flatview_unref(view);
     }
 }
@@ -2276,7 +2275,7 @@ void memory_region_add_coalescing(MemoryRegion *mr,
     cmr->addr = addrrange_make(int128_make64(offset), int128_make64(size));
     QTAILQ_INSERT_TAIL(&mr->coalesced, cmr, link);
 -    memory_region_update_coalesced_range(mr);
 +    memory_region_update_coalesced_range(mr, cmr, true);
     memory_region_set_flush_coalesced(mr);
 }
@@ -2294,10 +2293,9 @@ void memory_region_clear_coalescing(MemoryRegion *mr)
     while (!QTAILQ_EMPTY(&mr->coalesced)) {
         cmr = QTAILQ_FIRST(&mr->coalesced);
         QTAILQ_REMOVE(&mr->coalesced, cmr, link);
 +        memory_region_update_coalesced_range(mr, cmr, false);
         g_free(cmr);
     }
 -
 -    memory_region_update_coalesced_range(mr);
 }
 void memory_region_set_flush_coalesced(MemoryRegion *mr)
 -- 
 1.8.3.1
--- a/kvm-memory-Refactor-memory_region_clear_coalescing.patch
+++ b/kvm-memory-Refactor-memory_region_clear_coalescing.patch
@ -1,64 +0,0 @@
 From 134ab69ffdfb7e45a0be385595036d0427928306 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Fri, 23 Aug 2019 06:14:28 +0100
 Subject: [PATCH 1/5] memory: Refactor memory_region_clear_coalescing
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20190823061431.31759-2-peterx@redhat.com>
 Patchwork-id: 90134
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 1/4] memory: Refactor memory_region_clear_coalescing
 Bugzilla: 1743142
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Removing the update variable and quit earlier if the memory region has
 no coalesced range.  This prepares for the next patch.
 Fixes: 3ac7d43a6fbb5d4a3
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20190820141328.10009-4-peterx@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 9c1aa1c235c770d84462d482460a96e957e95b9c)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 memory.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/memory.c b/memory.c
 index 5d8c9a9..9f40742 100644
 --- a/memory.c
 +++ b/memory.c
@@ -2276,7 +2276,10 @@ void memory_region_add_coalescing(MemoryRegion *mr,
 void memory_region_clear_coalescing(MemoryRegion *mr)
 {
     CoalescedMemoryRange *cmr;
 -    bool updated = false;
 +
 +    if (QTAILQ_EMPTY(&mr->coalesced)) {
 +        return;
 +    }
     qemu_flush_coalesced_mmio_buffer();
     mr->flush_coalesced_mmio = false;
@@ -2285,12 +2288,9 @@ void memory_region_clear_coalescing(MemoryRegion *mr)
         cmr = QTAILQ_FIRST(&mr->coalesced);
         QTAILQ_REMOVE(&mr->coalesced, cmr, link);
         g_free(cmr);
 -        updated = true;
     }
 -    if (updated) {
 -        memory_region_update_coalesced_range(mr);
 -    }
 +    memory_region_update_coalesced_range(mr);
 }
 void memory_region_set_flush_coalesced(MemoryRegion *mr)
 -- 
 1.8.3.1
--- a/kvm-memory-Remove-has_coalesced_range-counter.patch
+++ b/kvm-memory-Remove-has_coalesced_range-counter.patch
@ -1,96 +0,0 @@
 From c1db31bce6d2e5f49e34a2e7282e50bea3f92278 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Fri, 23 Aug 2019 06:14:30 +0100
 Subject: [PATCH 3/5] memory: Remove has_coalesced_range counter
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20190823061431.31759-4-peterx@redhat.com>
 Patchwork-id: 90135
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 3/4] memory: Remove has_coalesced_range counter
 Bugzilla: 1743142
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 The has_coalesced_range could potentially be problematic in that it
 only works for additions of coalesced mmio ranges but not deletions.
 The reason is that has_coalesced_range information can be lost when
 the FlatView updates the topology again when the updated region is not
 covering the coalesced regions. When that happens, due to
 flatrange_equal() is not checking against has_coalesced_range, the new
 FlatRange will be seen as the same one as the old and the new
 instance (whose has_coalesced_range will be zero) will replace the old
 instance (whose has_coalesced_range _could_ be non-zero).
 The counter was originally used to make sure every FlatRange will only
 notify once for coalesced_io_{add|del} memory listeners, because each
 FlatRange can be used by multiple address spaces, so logically
 speaking it could be called multiple times.  However we should not
 limit that, because memory listeners should will only be registered
 with specific address space rather than multiple address spaces.
 So let's fix this up by simply removing the whole has_coalesced_range.
 Fixes: 3ac7d43a6fbb5d4a3
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20190820141328.10009-3-peterx@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 264ef5a5c52c249ff51a16d141fc03df71714a13)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 memory.c | 14 --------------
 1 file changed, 14 deletions(-)
 diff --git a/memory.c b/memory.c
 index 7b24cb8..c7cd43f 100644
 --- a/memory.c
 +++ b/memory.c
@@ -217,7 +217,6 @@ struct FlatRange {
     bool romd_mode;
     bool readonly;
     bool nonvolatile;
 -    int has_coalesced_range;
 };
 #define FOR_EACH_FLAT_RANGE(var, view)          \
@@ -654,7 +653,6 @@ static void render_memory_region(FlatView *view,
     fr.romd_mode = mr->romd_mode;
     fr.readonly = readonly;
     fr.nonvolatile = nonvolatile;
 -    fr.has_coalesced_range = 0;
     /* Render the region itself into any gaps left by the current view. */
     for (i = 0; i < view->nr && int128_nz(remain); ++i) {
@@ -888,14 +886,6 @@ static void flat_range_coalesced_io_del(FlatRange *fr, AddressSpace *as)
 {
     CoalescedMemoryRange *cmr;
 -    if (!fr->has_coalesced_range) {
 -        return;
 -    }
 -
 -    if (--fr->has_coalesced_range > 0) {
 -        return;
 -    }
 -
     QTAILQ_FOREACH(cmr, &fr->mr->coalesced, link) {
         flat_range_coalesced_io_notify(fr, as, cmr, false);
     }
@@ -910,10 +900,6 @@ static void flat_range_coalesced_io_add(FlatRange *fr, AddressSpace *as)
         return;
     }
 -    if (fr->has_coalesced_range++) {
 -        return;
 -    }
 -
     QTAILQ_FOREACH(cmr, &mr->coalesced, link) {
         flat_range_coalesced_io_notify(fr, as, cmr, true);
     }
 -- 
 1.8.3.1
--- a/kvm-memory-Split-zones-when-do-coalesced_io_del.patch
+++ b/kvm-memory-Split-zones-when-do-coalesced_io_del.patch
@ -1,123 +0,0 @@
 From bdd5394047f7fbecac82d067b9e67db8a20c49d2 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Fri, 23 Aug 2019 06:14:29 +0100
 Subject: [PATCH 2/5] memory: Split zones when do coalesced_io_del()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 Message-id: <20190823061431.31759-3-peterx@redhat.com>
 Patchwork-id: 90133
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 2/4] memory: Split zones when do coalesced_io_del()
 Bugzilla: 1743142
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Auger Eric <eric.auger@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 It is a workaround of current KVM's KVM_UNREGISTER_COALESCED_MMIO
 interface.  The kernel interface only allows to unregister an mmio
 device with exactly the zone size when registered, or any smaller zone
 that is included in the device mmio zone.  It does not support the
 userspace to specify a very large zone to remove all the small mmio
 devices within the zone covered.
 Logically speaking it would be nicer to fix this from KVM side, though
 in all cases we still need to coop with old kernels so let's do this.
 Fixes: 3ac7d43a6fbb5d4a3
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20190820141328.10009-2-peterx@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 23f1174aac4181f86bb7e13ca8bc2d4a0bdf1e5c)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 memory.c | 49 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 14 deletions(-)
 diff --git a/memory.c b/memory.c
 index 9f40742..7b24cb8 100644
 --- a/memory.c
 +++ b/memory.c
@@ -855,8 +855,39 @@ static void address_space_update_ioeventfds(AddressSpace *as)
     flatview_unref(view);
 }
 +/*
 + * Notify the memory listeners about the coalesced IO change events of
 + * range `cmr'.  Only the part that has intersection of the specified
 + * FlatRange will be sent.
 + */
 +static void flat_range_coalesced_io_notify(FlatRange *fr, AddressSpace *as,
 +                                           CoalescedMemoryRange *cmr, bool add)
 +{
 +    AddrRange tmp;
 +
 +    tmp = addrrange_shift(cmr->addr,
 +                          int128_sub(fr->addr.start,
 +                                     int128_make64(fr->offset_in_region)));
 +    if (!addrrange_intersects(tmp, fr->addr)) {
 +        return;
 +    }
 +    tmp = addrrange_intersection(tmp, fr->addr);
 +
 +    if (add) {
 +        MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, coalesced_io_add,
 +                                      int128_get64(tmp.start),
 +                                      int128_get64(tmp.size));
 +    } else {
 +        MEMORY_LISTENER_UPDATE_REGION(fr, as, Reverse, coalesced_io_del,
 +                                      int128_get64(tmp.start),
 +                                      int128_get64(tmp.size));
 +    }
 +}
 +
 static void flat_range_coalesced_io_del(FlatRange *fr, AddressSpace *as)
 {
 +    CoalescedMemoryRange *cmr;
 +
     if (!fr->has_coalesced_range) {
         return;
     }
@@ -865,16 +896,15 @@ static void flat_range_coalesced_io_del(FlatRange *fr, AddressSpace *as)
         return;
     }
 -    MEMORY_LISTENER_UPDATE_REGION(fr, as, Reverse, coalesced_io_del,
 -                                  int128_get64(fr->addr.start),
 -                                  int128_get64(fr->addr.size));
 +    QTAILQ_FOREACH(cmr, &fr->mr->coalesced, link) {
 +        flat_range_coalesced_io_notify(fr, as, cmr, false);
 +    }
 }
 static void flat_range_coalesced_io_add(FlatRange *fr, AddressSpace *as)
 {
     MemoryRegion *mr = fr->mr;
     CoalescedMemoryRange *cmr;
 -    AddrRange tmp;
     if (QTAILQ_EMPTY(&mr->coalesced)) {
         return;
@@ -885,16 +915,7 @@ static void flat_range_coalesced_io_add(FlatRange *fr, AddressSpace *as)
     }
     QTAILQ_FOREACH(cmr, &mr->coalesced, link) {
 -        tmp = addrrange_shift(cmr->addr,
 -                              int128_sub(fr->addr.start,
 -                                         int128_make64(fr->offset_in_region)));
 -        if (!addrrange_intersects(tmp, fr->addr)) {
 -            continue;
 -        }
 -        tmp = addrrange_intersection(tmp, fr->addr);
 -        MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, coalesced_io_add,
 -                                      int128_get64(tmp.start),
 -                                      int128_get64(tmp.size));
 +        flat_range_coalesced_io_notify(fr, as, cmr, true);
     }
 }
 -- 
 1.8.3.1
--- a/kvm-memory-fetch-pmem-size-in-get_file_size.patch
+++ b/kvm-memory-fetch-pmem-size-in-get_file_size.patch
@ -1,254 +0,0 @@
 From 9d6d365abaea5e068f060b8a70d5b8fab43a9f7f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Wed, 18 Sep 2019 15:10:07 +0100
 Subject: [PATCH 3/4] memory: fetch pmem size in get_file_size()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: <20190918151007.27973-3-stefanha@redhat.com>
 Patchwork-id: 90762
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 2/2] memory: fetch pmem size in get_file_size()
 Bugzilla: 1724008 1736788
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
 Neither stat(2) nor lseek(2) report the size of Linux devdax pmem
 character device nodes.  Commit 314aec4a6e06844937f1677f6cba21981005f389
 ("hostmem-file: reject invalid pmem file sizes") added code to
 hostmem-file.c to fetch the size from sysfs and compare against the
 user-provided size=NUM parameter:
  if (backend->size > size) {
      error_setg(errp, "size property %" PRIu64 " is larger than "
                 "pmem file \"%s\" size %" PRIu64, backend->size,
                 fb->mem_path, size);
      return;
  }
 It turns out that exec.c:qemu_ram_alloc_from_fd() already has an
 equivalent size check but it skips devdax pmem character devices because
 lseek(2) returns 0:
  if (file_size > 0 && file_size < size) {
      error_setg(errp, "backing store %s size 0x%" PRIx64
                 " does not match 'size' option 0x" RAM_ADDR_FMT,
                 mem_path, file_size, size);
      return NULL;
  }
 This patch moves the devdax pmem file size code into get_file_size() so
 that we check the memory size in a single place:
 qemu_ram_alloc_from_fd().  This simplifies the code and makes it more
 general.
 This also fixes the problem that hostmem-file only checks the devdax
 pmem file size when the pmem=on parameter is given.  An unchecked
 size=NUM parameter can lead to SIGBUS in QEMU so we must always fetch
 the file size for Linux devdax pmem character device nodes.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20190830093056.12572-1-stefanha@redhat.com>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 72d41eb4b8f923de91e8f06dc20aa86b0a9155fb)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 backends/hostmem-file.c | 22 --------------------
 exec.c                  | 34 ++++++++++++++++++++++++++++++-
 include/qemu/osdep.h    | 13 ------------
 util/oslib-posix.c      | 54 -------------------------------------------------
 util/oslib-win32.c      |  6 ------
 5 files changed, 33 insertions(+), 96 deletions(-)
 diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
 index ecc15e3..be64020 100644
 --- a/backends/hostmem-file.c
 +++ b/backends/hostmem-file.c
@@ -58,28 +58,6 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
         return;
     }
 -    /*
 -     * Verify pmem file size since starting a guest with an incorrect size
 -     * leads to confusing failures inside the guest.
 -     */
 -    if (fb->is_pmem) {
 -        Error *local_err = NULL;
 -        uint64_t size;
 -
 -        size = qemu_get_pmem_size(fb->mem_path, &local_err);
 -        if (local_err) {
 -            error_propagate(errp, local_err);
 -            return;
 -        }
 -
 -        if (size && backend->size > size) {
 -            error_setg(errp, "size property %" PRIu64 " is larger than "
 -                       "pmem file \"%s\" size %" PRIu64, backend->size,
 -                       fb->mem_path, size);
 -            return;
 -        }
 -    }
 -
     backend->force_prealloc = mem_prealloc;
     name = host_memory_backend_get_name(backend);
     memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
 diff --git a/exec.c b/exec.c
 index 3e78de3..3c03edf 100644
 --- a/exec.c
 +++ b/exec.c
@@ -1813,7 +1813,39 @@ long qemu_maxrampagesize(void)
 #ifdef CONFIG_POSIX
 static int64_t get_file_size(int fd)
 {
 -    int64_t size = lseek(fd, 0, SEEK_END);
 +    int64_t size;
 +#if defined(__linux__)
 +    struct stat st;
 +
 +    if (fstat(fd, &st) < 0) {
 +        return -errno;
 +    }
 +
 +    /* Special handling for devdax character devices */
 +    if (S_ISCHR(st.st_mode)) {
 +        g_autofree char *subsystem_path = NULL;
 +        g_autofree char *subsystem = NULL;
 +
 +        subsystem_path = g_strdup_printf("/sys/dev/char/%d:%d/subsystem",
 +                                         major(st.st_rdev), minor(st.st_rdev));
 +        subsystem = g_file_read_link(subsystem_path, NULL);
 +
 +        if (subsystem && g_str_has_suffix(subsystem, "/dax")) {
 +            g_autofree char *size_path = NULL;
 +            g_autofree char *size_str = NULL;
 +
 +            size_path = g_strdup_printf("/sys/dev/char/%d:%d/size",
 +                                    major(st.st_rdev), minor(st.st_rdev));
 +
 +            if (g_file_get_contents(size_path, &size_str, NULL, NULL)) {
 +                return g_ascii_strtoll(size_str, NULL, 0);
 +            }
 +        }
 +    }
 +#endif /* defined(__linux__) */
 +
 +    /* st.st_size may be zero for special files yet lseek(2) works */
 +    size = lseek(fd, 0, SEEK_END);
     if (size < 0) {
         return -errno;
     }
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index af2b91f..c7d242f 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -571,19 +571,6 @@ void os_mem_prealloc(int fd, char *area, size_t sz, int smp_cpus,
                      Error **errp);
 /**
 - * qemu_get_pmem_size:
 - * @filename: path to a pmem file
 - * @errp: pointer to a NULL-initialized error object
 - *
 - * Determine the size of a persistent memory file.  Besides supporting files on
 - * DAX file systems, this function also supports Linux devdax character
 - * devices.
 - *
 - * Returns: the size or 0 on failure
 - */
 -uint64_t qemu_get_pmem_size(const char *filename, Error **errp);
 -
 -/**
  * qemu_get_pid_name:
  * @pid: pid of a process
  *
 diff --git a/util/oslib-posix.c b/util/oslib-posix.c
 index fe0309c..d772da8 100644
 --- a/util/oslib-posix.c
 +++ b/util/oslib-posix.c
@@ -513,60 +513,6 @@ void os_mem_prealloc(int fd, char *area, size_t memory, int smp_cpus,
     }
 }
 -uint64_t qemu_get_pmem_size(const char *filename, Error **errp)
 -{
 -    struct stat st;
 -
 -    if (stat(filename, &st) < 0) {
 -        error_setg(errp, "unable to stat pmem file \"%s\"", filename);
 -        return 0;
 -    }
 -
 -#if defined(__linux__)
 -    /* Special handling for devdax character devices */
 -    if (S_ISCHR(st.st_mode)) {
 -        char *subsystem_path = NULL;
 -        char *subsystem = NULL;
 -        char *size_path = NULL;
 -        char *size_str = NULL;
 -        uint64_t ret = 0;
 -
 -        subsystem_path = g_strdup_printf("/sys/dev/char/%d:%d/subsystem",
 -                                         major(st.st_rdev), minor(st.st_rdev));
 -        subsystem = g_file_read_link(subsystem_path, NULL);
 -        if (!subsystem) {
 -            error_setg(errp, "unable to read subsystem for pmem file \"%s\"",
 -                       filename);
 -            goto devdax_err;
 -        }
 -
 -        if (!g_str_has_suffix(subsystem, "/dax")) {
 -            error_setg(errp, "pmem file \"%s\" is not a dax device", filename);
 -            goto devdax_err;
 -        }
 -
 -        size_path = g_strdup_printf("/sys/dev/char/%d:%d/size",
 -                                    major(st.st_rdev), minor(st.st_rdev));
 -        if (!g_file_get_contents(size_path, &size_str, NULL, NULL)) {
 -            error_setg(errp, "unable to read size for pmem file \"%s\"",
 -                       size_path);
 -            goto devdax_err;
 -        }
 -
 -        ret = g_ascii_strtoull(size_str, NULL, 0);
 -
 -devdax_err:
 -        g_free(size_str);
 -        g_free(size_path);
 -        g_free(subsystem);
 -        g_free(subsystem_path);
 -        return ret;
 -    }
 -#endif /* defined(__linux__) */
 -
 -    return st.st_size;
 -}
 -
 char *qemu_get_pid_name(pid_t pid)
 {
     char *name = NULL;
 diff --git a/util/oslib-win32.c b/util/oslib-win32.c
 index 9583fb4..c62cd43 100644
 --- a/util/oslib-win32.c
 +++ b/util/oslib-win32.c
@@ -562,12 +562,6 @@ void os_mem_prealloc(int fd, char *area, size_t memory, int smp_cpus,
     }
 }
 -uint64_t qemu_get_pmem_size(const char *filename, Error **errp)
 -{
 -    error_setg(errp, "pmem support not available");
 -    return 0;
 -}
 -
 char *qemu_get_pid_name(pid_t pid)
 {
     /* XXX Implement me */
 -- 
 1.8.3.1
--- a/kvm-migration-Do-not-re-read-the-clock-on-pre_save-in-ca.patch
+++ b/kvm-migration-Do-not-re-read-the-clock-on-pre_save-in-ca.patch
@ -1,101 +0,0 @@
 From 8b0a69f11052d271ef49db0051d79e7f1a6102be Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Mon, 2 Sep 2019 04:20:32 +0100
 Subject: [PATCH 1/6] migration: Do not re-read the clock on pre_save in case
 of paused guest
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190902042032.25987-1-dgibson@redhat.com>
 Patchwork-id: 90226
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH] migration: Do not re-read the clock on pre_save in case of paused guest
 Bugzilla: 1747836
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 From: "Maxiwell S. Garcia" <maxiwell@linux.ibm.com>
 Re-read the timebase before migrate was ported from x86 commit:
   6053a86fe7bd: kvmclock: reduce kvmclock difference on migration
 The clock move makes the guest knows about the paused time between
 the stop and migrate commands. This is an issue in an already-paused
 VM because some side effects, like process stalls, could happen
 after migration.
 So, this patch checks the runstate of guest in the pre_save handler and
 do not re-reads the timebase in case of paused state (cold migration).
 Signed-off-by: Maxiwell S. Garcia <maxiwell@linux.ibm.com>
 Message-Id: <20190711194702.26598-1-maxiwell@linux.ibm.com>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit d14f33976282a8744ca1bf1d64e73996c145aa3f)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1747836
 Branch: rhel8/rhel-av-8.1.0/master-4.1.0
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23282250
 Testing: Booted guest with this qemu
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/ppc.c         | 13 +++++++++----
 target/ppc/cpu-qom.h |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)
 diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
 index a9e508c..8572e45 100644
 --- a/hw/ppc/ppc.c
 +++ b/hw/ppc/ppc.c
@@ -1008,6 +1008,8 @@ static void timebase_save(PPCTimebase *tb)
      * there is no need to update it from KVM here
      */
     tb->guest_timebase = ticks + first_ppc_cpu->env.tb_env->tb_offset;
 +
 +    tb->runstate_paused = runstate_check(RUN_STATE_PAUSED);
 }
 static void timebase_load(PPCTimebase *tb)
@@ -1051,9 +1053,9 @@ void cpu_ppc_clock_vm_state_change(void *opaque, int running,
 }
 /*
 - * When migrating, read the clock just before migration,
 - * so that the guest clock counts during the events
 - * between:
 + * When migrating a running guest, read the clock just
 + * before migration, so that the guest clock counts
 + * during the events between:
  *
  *  * vm_stop()
  *  *
@@ -1068,7 +1070,10 @@ static int timebase_pre_save(void *opaque)
 {
     PPCTimebase *tb = opaque;
 -    timebase_save(tb);
 +    /* guest_timebase won't be overridden in case of paused guest */
 +    if (!tb->runstate_paused) {
 +        timebase_save(tb);
 +    }
     return 0;
 }
 diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
 index be9b4c3..5fbcdee 100644
 --- a/target/ppc/cpu-qom.h
 +++ b/target/ppc/cpu-qom.h
@@ -201,6 +201,7 @@ typedef struct PowerPCCPUClass {
 typedef struct PPCTimebase {
     uint64_t guest_timebase;
     int64_t time_of_the_day_ns;
 +    bool runstate_paused;
 } PPCTimebase;
 extern const struct VMStateDescription vmstate_ppc_timebase;
 -- 
 1.8.3.1
--- a/kvm-migration-add-qemu_file_update_transfer-interface.patch
+++ b/kvm-migration-add-qemu_file_update_transfer-interface.patch
@ -1,63 +0,0 @@
 From 1748253be11cbf12961274d4586671ce3803b006 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 11:23:30 +0100
 Subject: [PATCH 2/6] migration: add qemu_file_update_transfer interface
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904112332.16160-3-quintela@redhat.com>
 Patchwork-id: 90281
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH v2 2/4] migration: add qemu_file_update_transfer interface
 Bugzilla: 1734316
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Ivan Ren <ivanren@tencent.com>
 Add qemu_file_update_transfer for just update bytes_xfer for speed
 limitation. This will be used for further migration feature such as
 multifd migration.
 Signed-off-by: Ivan Ren <ivanren@tencent.com>
 Reviewed-by: Wei Yang <richardw.yang@linux.intel.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <1564464816-21804-2-git-send-email-ivanren@tencent.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 5d7d2558631b4421826c60046c606584c58ab76c)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/qemu-file.c | 5 +++++
 migration/qemu-file.h | 1 +
 2 files changed, 6 insertions(+)
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
 index 0431585..18f4805 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
@@ -615,6 +615,11 @@ void qemu_file_reset_rate_limit(QEMUFile *f)
     f->bytes_xfer = 0;
 }
 +void qemu_file_update_transfer(QEMUFile *f, int64_t len)
 +{
 +    f->bytes_xfer += len;
 +}
 +
 void qemu_put_be16(QEMUFile *f, unsigned int v)
 {
     qemu_put_byte(f, v >> 8);
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
 index 13baf89..5de9fa2 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
@@ -147,6 +147,7 @@ int qemu_peek_byte(QEMUFile *f, int offset);
 void qemu_file_skip(QEMUFile *f, int size);
 void qemu_update_position(QEMUFile *f, size_t size);
 void qemu_file_reset_rate_limit(QEMUFile *f);
 +void qemu_file_update_transfer(QEMUFile *f, int64_t len);
 void qemu_file_set_rate_limit(QEMUFile *f, int64_t new_rate);
 int64_t qemu_file_get_rate_limit(QEMUFile *f);
 void qemu_file_set_error(QEMUFile *f, int ret);
 -- 
 1.8.3.1
--- a/kvm-migration-add-speed-limit-for-multifd-migration.patch
+++ b/kvm-migration-add-speed-limit-for-multifd-migration.patch
@ -1,141 +0,0 @@
 From d2ade4bec79bdfe6f0867b0672c6731bc1664b42 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 11:23:31 +0100
 Subject: [PATCH 3/6] migration: add speed limit for multifd migration
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904112332.16160-4-quintela@redhat.com>
 Patchwork-id: 90279
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH v2 3/4] migration: add speed limit for multifd migration
 Bugzilla: 1734316
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Ivan Ren <ivanren@tencent.com>
 Limit the speed of multifd migration through common speed limitation
 qemu file.
 Signed-off-by: Ivan Ren <ivanren@tencent.com>
 Message-Id: <1564464816-21804-3-git-send-email-ivanren@tencent.com>
 Reviewed-by: Wei Yang <richardw.yang@linux.intel.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 1b81c974ccfd536aceef840e220912b142a7dda0)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/ram.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)
 diff --git a/migration/ram.c b/migration/ram.c
 index 889148d..88ddd2b 100644
 --- a/migration/ram.c
 +++ b/migration/ram.c
@@ -922,7 +922,7 @@ struct {
  * false.
  */
 -static int multifd_send_pages(void)
 +static int multifd_send_pages(RAMState *rs)
 {
     int i;
     static int next_channel;
@@ -954,6 +954,7 @@ static int multifd_send_pages(void)
     multifd_send_state->pages = p->pages;
     p->pages = pages;
     transferred = ((uint64_t) pages->used) * TARGET_PAGE_SIZE + p->packet_len;
 +    qemu_file_update_transfer(rs->f, transferred);
     ram_counters.multifd_bytes += transferred;
     ram_counters.transferred += transferred;;
     qemu_mutex_unlock(&p->mutex);
@@ -962,7 +963,7 @@ static int multifd_send_pages(void)
     return 1;
 }
 -static int multifd_queue_page(RAMBlock *block, ram_addr_t offset)
 +static int multifd_queue_page(RAMState *rs, RAMBlock *block, ram_addr_t offset)
 {
     MultiFDPages_t *pages = multifd_send_state->pages;
@@ -981,12 +982,12 @@ static int multifd_queue_page(RAMBlock *block, ram_addr_t offset)
         }
     }
 -    if (multifd_send_pages() < 0) {
 +    if (multifd_send_pages(rs) < 0) {
         return -1;
     }
     if (pages->block != block) {
 -        return  multifd_queue_page(block, offset);
 +        return  multifd_queue_page(rs, block, offset);
     }
     return 1;
@@ -1054,7 +1055,7 @@ void multifd_save_cleanup(void)
     multifd_send_state = NULL;
 }
 -static void multifd_send_sync_main(void)
 +static void multifd_send_sync_main(RAMState *rs)
 {
     int i;
@@ -1062,7 +1063,7 @@ static void multifd_send_sync_main(void)
         return;
     }
     if (multifd_send_state->pages->used) {
 -        if (multifd_send_pages() < 0) {
 +        if (multifd_send_pages(rs) < 0) {
             error_report("%s: multifd_send_pages fail", __func__);
             return;
         }
@@ -1083,6 +1084,7 @@ static void multifd_send_sync_main(void)
         p->packet_num = multifd_send_state->packet_num++;
         p->flags |= MULTIFD_FLAG_SYNC;
         p->pending_job++;
 +        qemu_file_update_transfer(rs->f, p->packet_len);
         qemu_mutex_unlock(&p->mutex);
         qemu_sem_post(&p->sem);
     }
@@ -2079,7 +2081,7 @@ static int ram_save_page(RAMState *rs, PageSearchStatus *pss, bool last_stage)
 static int ram_save_multifd_page(RAMState *rs, RAMBlock *block,
                                  ram_addr_t offset)
 {
 -    if (multifd_queue_page(block, offset) < 0) {
 +    if (multifd_queue_page(rs, block, offset) < 0) {
         return -1;
     }
     ram_counters.normal++;
@@ -3482,7 +3484,7 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     ram_control_before_iterate(f, RAM_CONTROL_SETUP);
     ram_control_after_iterate(f, RAM_CONTROL_SETUP);
 -    multifd_send_sync_main();
 +    multifd_send_sync_main(*rsp);
     qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
     qemu_fflush(f);
@@ -3570,7 +3572,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
     ram_control_after_iterate(f, RAM_CONTROL_ROUND);
 out:
 -    multifd_send_sync_main();
 +    multifd_send_sync_main(rs);
     qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
     qemu_fflush(f);
     ram_counters.transferred += 8;
@@ -3629,7 +3631,7 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     rcu_read_unlock();
 -    multifd_send_sync_main();
 +    multifd_send_sync_main(rs);
     qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
     qemu_fflush(f);
 -- 
 1.8.3.1
--- a/kvm-migration-always-initialise-ram_counters-for-a-new-m.patch
+++ b/kvm-migration-always-initialise-ram_counters-for-a-new-m.patch
@ -1,139 +0,0 @@
 From 7ec124b3de4e7c7ef093955813a213d7a976d395 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 11:23:29 +0100
 Subject: [PATCH 1/6] migration: always initialise ram_counters for a new
 migration
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904112332.16160-2-quintela@redhat.com>
 Patchwork-id: 90278
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH v2 1/4] migration: always initialise ram_counters for a new migration
 Bugzilla: 1734316
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Ivan Ren <ivanren@tencent.com>
 This patch fix a multifd migration bug in migration speed calculation, this
 problem can be reproduced as follows:
 1. start a vm and give a heavy memory write stress to prevent the vm be
   successfully migrated to destination
 2. begin a migration with multifd
 3. migrate for a long time [actually, this can be measured by transferred bytes]
 4. migrate cancel
 5. begin a new migration with multifd, the migration will directly run into
   migration_completion phase
 Reason as follows:
 Migration update bandwidth and s->threshold_size in function
 migration_update_counters after BUFFER_DELAY time:
    current_bytes = migration_total_bytes(s);
    transferred = current_bytes - s->iteration_initial_bytes;
    time_spent = current_time - s->iteration_start_time;
    bandwidth = (double)transferred / time_spent;
    s->threshold_size = bandwidth * s->parameters.downtime_limit;
 In multifd migration, migration_total_bytes function return
 qemu_ftell(s->to_dst_file) + ram_counters.multifd_bytes.
 s->iteration_initial_bytes will be initialized to 0 at every new migration,
 but ram_counters is a global variable, and history migration data will be
 accumulated. So if the ram_counters.multifd_bytes is big enough, it may lead
 pending_size >= s->threshold_size become false in migration_iteration_run
 after the first migration_update_counters.
 Signed-off-by: Ivan Ren <ivanren@tencent.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Wei Yang <richardw.yang@linux.intel.com>
 Suggested-by: Wei Yang <richardw.yang@linux.intel.com>
 Message-Id: <1564741121-1840-1-git-send-email-ivanren@tencent.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 87f3bd8717cd88932de302e215f1da51bfb8051a)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/migration.c | 25 +++++++++++++++++++------
 migration/savevm.c    |  1 +
 2 files changed, 20 insertions(+), 6 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index beffbfd..5299597 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1910,6 +1910,11 @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
     }
     migrate_init(s);
 +    /*
 +     * set ram_counters memory to zero for a
 +     * new migration
 +     */
 +    memset(&ram_counters, 0, sizeof(ram_counters));
     return true;
 }
@@ -3027,6 +3032,17 @@ static void migration_calculate_complete(MigrationState *s)
     }
 }
 +static void update_iteration_initial_status(MigrationState *s)
 +{
 +    /*
 +     * Update these three fields at the same time to avoid mismatch info lead
 +     * wrong speed calculation.
 +     */
 +    s->iteration_start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 +    s->iteration_initial_bytes = migration_total_bytes(s);
 +    s->iteration_initial_pages = ram_get_total_transferred_pages();
 +}
 +
 static void migration_update_counters(MigrationState *s,
                                       int64_t current_time)
 {
@@ -3062,9 +3078,7 @@ static void migration_update_counters(MigrationState *s,
     qemu_file_reset_rate_limit(s->to_dst_file);
 -    s->iteration_start_time = current_time;
 -    s->iteration_initial_bytes = current_bytes;
 -    s->iteration_initial_pages = ram_get_total_transferred_pages();
 +    update_iteration_initial_status(s);
     trace_migrate_transferred(transferred, time_spent,
                               bandwidth, s->threshold_size);
@@ -3188,7 +3202,7 @@ static void *migration_thread(void *opaque)
     rcu_register_thread();
     object_ref(OBJECT(s));
 -    s->iteration_start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 +    update_iteration_initial_status(s);
     qemu_savevm_state_header(s->to_dst_file);
@@ -3253,8 +3267,7 @@ static void *migration_thread(void *opaque)
              * the local variables. This is important to avoid
              * breaking transferred_bytes and bandwidth calculation
              */
 -            s->iteration_start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 -            s->iteration_initial_bytes = 0;
 +            update_iteration_initial_status(s);
         }
         current_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 diff --git a/migration/savevm.c b/migration/savevm.c
 index 79ed44d..480c511 100644
 --- a/migration/savevm.c
 +++ b/migration/savevm.c
@@ -1424,6 +1424,7 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     }
     migrate_init(ms);
 +    memset(&ram_counters, 0, sizeof(ram_counters));
     ms->to_dst_file = f;
     qemu_mutex_unlock_iothread();
 -- 
 1.8.3.1
--- a/kvm-migration-update-ram_counters-for-multifd-sync-packe.patch
+++ b/kvm-migration-update-ram_counters-for-multifd-sync-packe.patch
@ -1,47 +0,0 @@
 From 0e42e63ddcaddd8837ba5ba1056380d4590754ee Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 11:23:32 +0100
 Subject: [PATCH 4/6] migration: update ram_counters for multifd sync packet
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904112332.16160-5-quintela@redhat.com>
 Patchwork-id: 90280
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH v2 4/4] migration: update ram_counters for multifd sync packet
 Bugzilla: 1734316
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Ivan Ren <ivanren@tencent.com>
 Multifd sync will send MULTIFD_FLAG_SYNC flag info to destination, add
 these bytes to ram_counters record.
 Signed-off-by: Ivan Ren <ivanren@tencent.com>
 Suggested-by: Wei Yang <richardw.yang@linux.intel.com>
 Message-Id: <1564464816-21804-4-git-send-email-ivanren@tencent.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 81507f6b7e87468f24ed5886559feda15fe2db0c)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/ram.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/migration/ram.c b/migration/ram.c
 index 88ddd2b..20b6eeb 100644
 --- a/migration/ram.c
 +++ b/migration/ram.c
@@ -1085,6 +1085,8 @@ static void multifd_send_sync_main(RAMState *rs)
         p->flags |= MULTIFD_FLAG_SYNC;
         p->pending_job++;
         qemu_file_update_transfer(rs->f, p->packet_len);
 +        ram_counters.multifd_bytes += p->packet_len;
 +        ram_counters.transferred += p->packet_len;
         qemu_mutex_unlock(&p->mutex);
         qemu_sem_post(&p->sem);
     }
 -- 
 1.8.3.1
--- a/kvm-multifd-Use-number-of-channels-as-listen-backlog.patch
+++ b/kvm-multifd-Use-number-of-channels-as-listen-backlog.patch
@ -1,50 +0,0 @@
 From 8c93ef106ecf2aa0604ffe7fee3d628b88c2b015 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 10:26:06 +0100
 Subject: [PATCH 6/8] multifd: Use number of channels as listen backlog
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904102606.15744-6-quintela@redhat.com>
 Patchwork-id: 90273
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 5/5] multifd: Use number of channels as listen backlog
 Bugzilla: 1726898
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 (cherry picked from commit 0705e56496d2b155b5796c6b28d4110e5bcbd5d8)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 migration/socket.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/migration/socket.c b/migration/socket.c
 index e63f5e1..97c9efd 100644
 --- a/migration/socket.c
 +++ b/migration/socket.c
@@ -178,10 +178,15 @@ static void socket_start_incoming_migration(SocketAddress *saddr,
 {
     QIONetListener *listener = qio_net_listener_new();
     size_t i;
 +    int num = 1;
     qio_net_listener_set_name(listener, "migration-socket-listener");
 -    if (qio_net_listener_open_sync(listener, saddr, 1, errp) < 0) {
 +    if (migrate_use_multifd()) {
 +        num = migrate_multifd_channels();
 +    }
 +
 +    if (qio_net_listener_open_sync(listener, saddr, num, errp) < 0) {
         object_unref(OBJECT(listener));
         return;
     }
 -- 
 1.8.3.1
--- a/kvm-nbd-Grab-aio-context-lock-in-more-places.patch
+++ b/kvm-nbd-Grab-aio-context-lock-in-more-places.patch
@ -1,200 +0,0 @@
 From 7cf87a669fa0dd580013b0ca5e4510f12aff2319 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 9 Oct 2019 14:10:07 +0100
 Subject: [PATCH 5/6] nbd: Grab aio context lock in more places
 RH-Author: Eric Blake <eblake@redhat.com>
 Message-id: <20191009141008.24439-2-eblake@redhat.com>
 Patchwork-id: 91353
 O-Subject: [RHEL-AV-8.1.1 qemu-kvm PATCH 1/2] nbd: Grab aio context lock in more places
 Bugzilla: 1741094
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 When iothreads are in use, the failure to grab the aio context results
 in an assertion failure when trying to unlock things during blk_unref,
 when trying to unlock a mutex that was not locked.  In short, all
 calls to nbd_export_put need to done while within the correct aio
 context.  But since nbd_export_put can recursively reach itself via
 nbd_export_close, and recursively grabbing the context would deadlock,
 we can't do the context grab directly in those functions, but must do
 so in their callers.
 Hoist the use of the correct aio_context from nbd_export_new() to its
 caller qmp_nbd_server_add().  Then tweak qmp_nbd_server_remove(),
 nbd_eject_notifier(), and nbd_esport_close_all() to grab the right
 context, so that all callers during qemu now own the context before
 nbd_export_put() can call blk_unref().
 Remaining uses in qemu-nbd don't matter (since that use case does not
 support iothreads).
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20190917023917.32226-1-eblake@redhat.com>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 (cherry picked from commit 61bc846d8c58535af6884b637a4005dd6111ea95)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 blockdev-nbd.c      | 14 ++++++++++++--
 include/block/nbd.h |  1 +
 nbd/server.c        | 22 ++++++++++++++++++----
 3 files changed, 31 insertions(+), 6 deletions(-)
 diff --git a/blockdev-nbd.c b/blockdev-nbd.c
 index 06041a2..bed9370 100644
 --- a/blockdev-nbd.c
 +++ b/blockdev-nbd.c
@@ -152,6 +152,7 @@ void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
     BlockBackend *on_eject_blk;
     NBDExport *exp;
     int64_t len;
 +    AioContext *aio_context;
     if (!nbd_server) {
         error_setg(errp, "NBD server not running");
@@ -174,11 +175,13 @@ void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
         return;
     }
 +    aio_context = bdrv_get_aio_context(bs);
 +    aio_context_acquire(aio_context);
     len = bdrv_getlength(bs);
     if (len < 0) {
         error_setg_errno(errp, -len,
                          "Failed to determine the NBD export's length");
 -        return;
 +        goto out;
     }
     if (!has_writable) {
@@ -192,13 +195,16 @@ void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
                          writable ? 0 : NBD_FLAG_READ_ONLY,
                          NULL, false, on_eject_blk, errp);
     if (!exp) {
 -        return;
 +        goto out;
     }
     /* The list of named exports has a strong reference to this export now and
      * our only way of accessing it is through nbd_export_find(), so we can drop
      * the strong reference that is @exp. */
     nbd_export_put(exp);
 +
 + out:
 +    aio_context_release(aio_context);
 }
 void qmp_nbd_server_remove(const char *name,
@@ -206,6 +212,7 @@ void qmp_nbd_server_remove(const char *name,
                            Error **errp)
 {
     NBDExport *exp;
 +    AioContext *aio_context;
     if (!nbd_server) {
         error_setg(errp, "NBD server not running");
@@ -222,7 +229,10 @@ void qmp_nbd_server_remove(const char *name,
         mode = NBD_SERVER_REMOVE_MODE_SAFE;
     }
 +    aio_context = nbd_export_aio_context(exp);
 +    aio_context_acquire(aio_context);
     nbd_export_remove(exp, mode, errp);
 +    aio_context_release(aio_context);
 }
 void qmp_nbd_server_stop(Error **errp)
 diff --git a/include/block/nbd.h b/include/block/nbd.h
 index bb9f5bc..82f9b9e 100644
 --- a/include/block/nbd.h
 +++ b/include/block/nbd.h
@@ -335,6 +335,7 @@ void nbd_export_put(NBDExport *exp);
 BlockBackend *nbd_export_get_blockdev(NBDExport *exp);
 +AioContext *nbd_export_aio_context(NBDExport *exp);
 NBDExport *nbd_export_find(const char *name);
 void nbd_export_close_all(void);
 diff --git a/nbd/server.c b/nbd/server.c
 index ea0353a..81f8217 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -1460,7 +1460,12 @@ static void blk_aio_detach(void *opaque)
 static void nbd_eject_notifier(Notifier *n, void *data)
 {
     NBDExport *exp = container_of(n, NBDExport, eject_notifier);
 +    AioContext *aio_context;
 +
 +    aio_context = exp->ctx;
 +    aio_context_acquire(aio_context);
     nbd_export_close(exp);
 +    aio_context_release(aio_context);
 }
 NBDExport *nbd_export_new(BlockDriverState *bs, uint64_t dev_offset,
@@ -1479,12 +1484,11 @@ NBDExport *nbd_export_new(BlockDriverState *bs, uint64_t dev_offset,
      * NBD exports are used for non-shared storage migration.  Make sure
      * that BDRV_O_INACTIVE is cleared and the image is ready for write
      * access since the export could be available before migration handover.
 +     * ctx was acquired in the caller.
      */
     assert(name);
     ctx = bdrv_get_aio_context(bs);
 -    aio_context_acquire(ctx);
     bdrv_invalidate_cache(bs, NULL);
 -    aio_context_release(ctx);
     /* Don't allow resize while the NBD server is running, otherwise we don't
      * care what happens with the node. */
@@ -1492,7 +1496,7 @@ NBDExport *nbd_export_new(BlockDriverState *bs, uint64_t dev_offset,
     if ((nbdflags & NBD_FLAG_READ_ONLY) == 0) {
         perm |= BLK_PERM_WRITE;
     }
 -    blk = blk_new(bdrv_get_aio_context(bs), perm,
 +    blk = blk_new(ctx, perm,
                   BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED |
                   BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD);
     ret = blk_insert_bs(blk, bs, errp);
@@ -1549,7 +1553,7 @@ NBDExport *nbd_export_new(BlockDriverState *bs, uint64_t dev_offset,
     }
     exp->close = close;
 -    exp->ctx = blk_get_aio_context(blk);
 +    exp->ctx = ctx;
     blk_add_aio_context_notifier(blk, blk_aio_attached, blk_aio_detach, exp);
     if (on_eject_blk) {
@@ -1582,6 +1586,12 @@ NBDExport *nbd_export_find(const char *name)
     return NULL;
 }
 +AioContext *
 +nbd_export_aio_context(NBDExport *exp)
 +{
 +    return exp->ctx;
 +}
 +
 void nbd_export_close(NBDExport *exp)
 {
     NBDClient *client, *next;
@@ -1676,9 +1686,13 @@ BlockBackend *nbd_export_get_blockdev(NBDExport *exp)
 void nbd_export_close_all(void)
 {
     NBDExport *exp, *next;
 +    AioContext *aio_context;
     QTAILQ_FOREACH_SAFE(exp, &exports, next, next) {
 +        aio_context = exp->ctx;
 +        aio_context_acquire(aio_context);
         nbd_export_close(exp);
 +        aio_context_release(aio_context);
     }
 }
 -- 
 1.8.3.1
--- a/kvm-nbd-server-attach-client-channel-to-the-export-s-Aio.patch
+++ b/kvm-nbd-server-attach-client-channel-to-the-export-s-Aio.patch
@ -1,60 +0,0 @@
 From 394dd52ce4dbd69cd5eca9a9928c442650cc3fd2 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Fri, 27 Sep 2019 11:13:24 +0100
 Subject: [PATCH 1/2] nbd/server: attach client channel to the export's
 AioContext
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20190927111324.17949-2-slp@redhat.com>
 Patchwork-id: 90905
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/1] nbd/server: attach client channel to the export's AioContext
 Bugzilla: 1748253
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 On creation, the export's AioContext is set to the same one as the
 BlockBackend, while the AioContext in the client QIOChannel is left
 untouched.
 As a result, when using data-plane, nbd_client_receive_next_request()
 schedules coroutines in the IOThread AioContext, while the client's
 QIOChannel is serviced from the main_loop, potentially triggering the
 assertion at qio_channel_restart_[read|write].
 To fix this, as soon we have the export corresponding to the client,
 we call qio_channel_attach_aio_context() to attach the QIOChannel
 context to the export's AioContext. This matches with the logic at
 blk_aio_attached().
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1748253
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20190912110032.26395-1-slp@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit b4961249af0403fa55aae57c4c8806b24f7a7b33)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 nbd/server.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/nbd/server.c b/nbd/server.c
 index 10faedc..ea0353a 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -1296,6 +1296,11 @@ static coroutine_fn int nbd_negotiate(NBDClient *client, Error **errp)
         return ret;
     }
 +    /* Attach the channel to the same AioContext as the export */
 +    if (client->exp && client->exp->ctx) {
 +        qio_channel_attach_aio_context(client->ioc, client->exp->ctx);
 +    }
 +
     assert(!client->optlen);
     trace_nbd_negotiate_success();
 -- 
 1.8.3.1
--- a/kvm-pr-manager-Fix-invalid-g_free-crash-bug.patch
+++ b/kvm-pr-manager-Fix-invalid-g_free-crash-bug.patch
@ -1,56 +0,0 @@
 From 84728251439a3b73a57a8d72cc4d39307207cc01 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 20 Sep 2019 16:48:41 +0100
 Subject: [PATCH 4/4] pr-manager: Fix invalid g_free() crash bug
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 Message-id: <20190920164841.10424-1-pbonzini@redhat.com>
 Patchwork-id: 90824
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2] pr-manager: Fix invalid g_free() crash bug
 Bugzilla: 1753992
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 From: Markus Armbruster <armbru@redhat.com>
 BZ: 1753992
 BRANCH: rhel-av-8.1.0/master-4.1.0
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23612762
 Upstream: 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3
 pr_manager_worker() passes its @opaque argument to g_free().  Wrong;
 it points to pr_manager_worker()'s automatic @data.  Broken when
 commit 2f3a7ab39be converted @data from heap- to stack-allocated.  Fix
 by deleting the g_free().
 Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 scsi/pr-manager.c | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
 index ee43663..0c866e8 100644
 --- a/scsi/pr-manager.c
 +++ b/scsi/pr-manager.c
@@ -39,7 +39,6 @@ static int pr_manager_worker(void *opaque)
     int fd = data->fd;
     int r;
 -    g_free(data);
     trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]);
     /* The reference was taken in pr_manager_execute.  */
 -- 
 1.8.3.1
--- a/kvm-pseries-Fix-compat_pvr-on-reset.patch
+++ b/kvm-pseries-Fix-compat_pvr-on-reset.patch
@ -1,80 +0,0 @@
 From 88cfbf2cc3e93a276f9d036850265eb8c2f5310c Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 4 Sep 2019 10:31:38 +0100
 Subject: [PATCH 7/8] pseries: Fix compat_pvr on reset
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20190904103139.29870-2-lvivier@redhat.com>
 Patchwork-id: 90274
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/2] pseries: Fix compat_pvr on reset
 Bugzilla: 1744107
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 If we a migrate P8 machine to a P9 machine, the migration fails on
 destination with:
  error while loading state for instance 0x1 of device 'cpu'
  load of migration failed: Operation not permitted
 This is caused because the compat_pvr field is only present for the first
 CPU.
 Originally, spapr_machine_reset() calls ppc_set_compat() to set the value
 max_compat_pvr for the first cpu and this was propagated to all CPUs by
 spapr_cpu_reset().  Now, as spapr_cpu_reset() is called before that, the
 value is not propagated to all CPUs and the migration fails.
 To fix that, propagate the new value to all CPUs in spapr_machine_reset().
 Fixes: 25c9780d38d4 ("spapr: Reset CAS & IRQ subsystem after devices")
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Message-Id: <20190826090812.19080-1-lvivier@redhat.com>
 Reviewed-by: Greg Kurz <groug@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit ce03a193e1172ff7d4b3303ec7472dc29183db8c)
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1744107
 BRANCH: rhel-av-8.1.0/master-4.1.0
 UPSTREAM: Merged
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr.c          | 8 +++++++-
 hw/ppc/spapr_cpu_core.c | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 9b500d2..30bf7bb 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -1746,7 +1746,13 @@ static void spapr_machine_reset(MachineState *machine)
         spapr_ovec_cleanup(spapr->ov5_cas);
         spapr->ov5_cas = spapr_ovec_new();
 -        ppc_set_compat(first_ppc_cpu, spapr->max_compat_pvr, &error_fatal);
 +        /*
 +         * reset compat_pvr for all CPUs
 +         * as qemu_devices_reset() is called before this,
 +         * it can't be propagated by spapr_cpu_reset()
 +         * from the first CPU to all the others
 +         */
 +        ppc_set_compat_all(spapr->max_compat_pvr, &error_fatal);
     }
     if (!SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 29a3c7d..ae43c57 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -41,6 +41,8 @@ static void spapr_cpu_reset(void *opaque)
     /* Set compatibility mode to match the boot CPU, which was either set
      * by the machine reset code or by CAS. This should never fail.
 +     * At startup the value is already set for all the CPUs
 +     * but we need this when we hotplug a new CPU
      */
     ppc_set_compat(cpu, POWERPC_CPU(first_cpu)->compat_pvr, &error_abort);
 -- 
 1.8.3.1
--- a/kvm-qapi-implement-block-dirty-bitmap-remove-transaction.patch
+++ b/kvm-qapi-implement-block-dirty-bitmap-remove-transaction.patch
@ -1,274 +0,0 @@
 From fd8ecebf0c0632e473bcb8bb08dc8311a5530dcf Mon Sep 17 00:00:00 2001
 From: John Snow <jsnow@redhat.com>
 Date: Fri, 27 Sep 2019 20:18:45 +0100
 Subject: [PATCH 2/6] qapi: implement block-dirty-bitmap-remove transaction
 action
 RH-Author: John Snow <jsnow@redhat.com>
 Message-id: <20190927201846.6823-3-jsnow@redhat.com>
 Patchwork-id: 90911
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 2/3] qapi: implement block-dirty-bitmap-remove transaction action
 Bugzilla: 1756413
 RH-Acked-by: Maxim Levitsky <mlevitsk@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 It is used to do transactional movement of the bitmap (which is
 possible in conjunction with merge command). Transactional bitmap
 movement is needed in scenarios with external snapshot, when we don't
 want to leave copy of the bitmap in the base image.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Message-id: 20190708220502.12977-3-jsnow@redhat.com
 [Edited "since" version to 4.2 --js]
 Signed-off-by: John Snow <jsnow@redhat.com>
 (cherry picked from commit c4e4b0fa598ddc9cee6ba7a06899ce0a8dae6c61)
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 block.c                        |  2 +-
 block/dirty-bitmap.c           | 15 ++++----
 blockdev.c                     | 79 ++++++++++++++++++++++++++++++++++++++----
 include/block/dirty-bitmap.h   |  2 +-
 migration/block-dirty-bitmap.c |  2 +-
 qapi/transaction.json          |  2 ++
 6 files changed, 85 insertions(+), 17 deletions(-)
 diff --git a/block.c b/block.c
 index cbd8da5..92a3e9f 100644
 --- a/block.c
 +++ b/block.c
@@ -5334,7 +5334,7 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
     for (bm = bdrv_dirty_bitmap_next(bs, NULL); bm;
          bm = bdrv_dirty_bitmap_next(bs, bm))
     {
 -        bdrv_dirty_bitmap_set_migration(bm, false);
 +        bdrv_dirty_bitmap_skip_store(bm, false);
     }
     ret = refresh_total_sectors(bs, bs->total_sectors);
 diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
 index 95a9c2a..a308e1f 100644
 --- a/block/dirty-bitmap.c
 +++ b/block/dirty-bitmap.c
@@ -48,10 +48,9 @@ struct BdrvDirtyBitmap {
     bool inconsistent;          /* bitmap is persistent, but inconsistent.
                                    It cannot be used at all in any way, except
                                    a QMP user can remove it. */
 -    bool migration;             /* Bitmap is selected for migration, it should
 -                                   not be stored on the next inactivation
 -                                   (persistent flag doesn't matter until next
 -                                   invalidation).*/
 +    bool skip_store;            /* We are either migrating or deleting this
 +                                 * bitmap; it should not be stored on the next
 +                                 * inactivation. */
     QLIST_ENTRY(BdrvDirtyBitmap) list;
 };
@@ -757,16 +756,16 @@ void bdrv_dirty_bitmap_set_inconsistent(BdrvDirtyBitmap *bitmap)
 }
 /* Called with BQL taken. */
 -void bdrv_dirty_bitmap_set_migration(BdrvDirtyBitmap *bitmap, bool migration)
 +void bdrv_dirty_bitmap_skip_store(BdrvDirtyBitmap *bitmap, bool skip)
 {
     qemu_mutex_lock(bitmap->mutex);
 -    bitmap->migration = migration;
 +    bitmap->skip_store = skip;
     qemu_mutex_unlock(bitmap->mutex);
 }
 bool bdrv_dirty_bitmap_get_persistence(BdrvDirtyBitmap *bitmap)
 {
 -    return bitmap->persistent && !bitmap->migration;
 +    return bitmap->persistent && !bitmap->skip_store;
 }
 bool bdrv_dirty_bitmap_inconsistent(const BdrvDirtyBitmap *bitmap)
@@ -778,7 +777,7 @@ bool bdrv_has_changed_persistent_bitmaps(BlockDriverState *bs)
 {
     BdrvDirtyBitmap *bm;
     QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
 -        if (bm->persistent && !bm->readonly && !bm->migration) {
 +        if (bm->persistent && !bm->readonly && !bm->skip_store) {
             return true;
         }
     }
 diff --git a/blockdev.c b/blockdev.c
 index 0124825..800b3dc 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -2134,6 +2134,51 @@ static void block_dirty_bitmap_merge_prepare(BlkActionState *common,
                                                 errp);
 }
 +static BdrvDirtyBitmap *do_block_dirty_bitmap_remove(
 +        const char *node, const char *name, bool release,
 +        BlockDriverState **bitmap_bs, Error **errp);
 +
 +static void block_dirty_bitmap_remove_prepare(BlkActionState *common,
 +                                              Error **errp)
 +{
 +    BlockDirtyBitmap *action;
 +    BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
 +                                             common, common);
 +
 +    if (action_check_completion_mode(common, errp) < 0) {
 +        return;
 +    }
 +
 +    action = common->action->u.block_dirty_bitmap_remove.data;
 +
 +    state->bitmap = do_block_dirty_bitmap_remove(action->node, action->name,
 +                                                 false, &state->bs, errp);
 +    if (state->bitmap) {
 +        bdrv_dirty_bitmap_skip_store(state->bitmap, true);
 +        bdrv_dirty_bitmap_set_busy(state->bitmap, true);
 +    }
 +}
 +
 +static void block_dirty_bitmap_remove_abort(BlkActionState *common)
 +{
 +    BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
 +                                             common, common);
 +
 +    if (state->bitmap) {
 +        bdrv_dirty_bitmap_skip_store(state->bitmap, false);
 +        bdrv_dirty_bitmap_set_busy(state->bitmap, false);
 +    }
 +}
 +
 +static void block_dirty_bitmap_remove_commit(BlkActionState *common)
 +{
 +    BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
 +                                             common, common);
 +
 +    bdrv_dirty_bitmap_set_busy(state->bitmap, false);
 +    bdrv_release_dirty_bitmap(state->bs, state->bitmap);
 +}
 +
 static void abort_prepare(BlkActionState *common, Error **errp)
 {
     error_setg(errp, "Transaction aborted using Abort action");
@@ -2211,6 +2256,12 @@ static const BlkActionOps actions[] = {
         .commit = block_dirty_bitmap_free_backup,
         .abort = block_dirty_bitmap_restore,
     },
 +    [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_REMOVE] = {
 +        .instance_size = sizeof(BlockDirtyBitmapState),
 +        .prepare = block_dirty_bitmap_remove_prepare,
 +        .commit = block_dirty_bitmap_remove_commit,
 +        .abort = block_dirty_bitmap_remove_abort,
 +    },
     /* Where are transactions for MIRROR, COMMIT and STREAM?
      * Although these blockjobs use transaction callbacks like the backup job,
      * these jobs do not necessarily adhere to transaction semantics.
@@ -2869,20 +2920,21 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
     bdrv_dirty_bitmap_set_persistence(bitmap, persistent);
 }
 -void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
 -                                   Error **errp)
 +static BdrvDirtyBitmap *do_block_dirty_bitmap_remove(
 +        const char *node, const char *name, bool release,
 +        BlockDriverState **bitmap_bs, Error **errp)
 {
     BlockDriverState *bs;
     BdrvDirtyBitmap *bitmap;
     bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
     if (!bitmap || !bs) {
 -        return;
 +        return NULL;
     }
     if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_BUSY | BDRV_BITMAP_RO,
                                 errp)) {
 -        return;
 +        return NULL;
     }
     if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
@@ -2892,13 +2944,28 @@ void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
         aio_context_acquire(aio_context);
         bdrv_remove_persistent_dirty_bitmap(bs, name, &local_err);
         aio_context_release(aio_context);
 +
         if (local_err != NULL) {
             error_propagate(errp, local_err);
 -            return;
 +            return NULL;
         }
     }
 -    bdrv_release_dirty_bitmap(bs, bitmap);
 +    if (release) {
 +        bdrv_release_dirty_bitmap(bs, bitmap);
 +    }
 +
 +    if (bitmap_bs) {
 +        *bitmap_bs = bs;
 +    }
 +
 +    return release ? NULL : bitmap;
 +}
 +
 +void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
 +                                   Error **errp)
 +{
 +    do_block_dirty_bitmap_remove(node, name, true, NULL, errp);
 }
 /**
 diff --git a/include/block/dirty-bitmap.h b/include/block/dirty-bitmap.h
 index 62682eb..a21d54a 100644
 --- a/include/block/dirty-bitmap.h
 +++ b/include/block/dirty-bitmap.h
@@ -83,7 +83,7 @@ void bdrv_dirty_bitmap_set_inconsistent(BdrvDirtyBitmap *bitmap);
 void bdrv_dirty_bitmap_set_busy(BdrvDirtyBitmap *bitmap, bool busy);
 void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
                              HBitmap **backup, Error **errp);
 -void bdrv_dirty_bitmap_set_migration(BdrvDirtyBitmap *bitmap, bool migration);
 +void bdrv_dirty_bitmap_skip_store(BdrvDirtyBitmap *bitmap, bool skip);
 /* Functions that require manual locking.  */
 void bdrv_dirty_bitmap_lock(BdrvDirtyBitmap *bitmap);
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
 index 4a896a0..d650ba4 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
@@ -326,7 +326,7 @@ static int init_dirty_bitmap_migration(void)
     /* unset migration flags here, to not roll back it */
     QSIMPLEQ_FOREACH(dbms, &dirty_bitmap_mig_state.dbms_list, entry) {
 -        bdrv_dirty_bitmap_set_migration(dbms->bitmap, true);
 +        bdrv_dirty_bitmap_skip_store(dbms->bitmap, true);
     }
     if (QSIMPLEQ_EMPTY(&dirty_bitmap_mig_state.dbms_list)) {
 diff --git a/qapi/transaction.json b/qapi/transaction.json
 index 95edb78..0590dbc 100644
 --- a/qapi/transaction.json
 +++ b/qapi/transaction.json
@@ -45,6 +45,7 @@
 #
 # - @abort: since 1.6
 # - @block-dirty-bitmap-add: since 2.5
 +# - @block-dirty-bitmap-remove: since 4.2
 # - @block-dirty-bitmap-clear: since 2.5
 # - @block-dirty-bitmap-enable: since 4.0
 # - @block-dirty-bitmap-disable: since 4.0
@@ -61,6 +62,7 @@
   'data': {
        'abort': 'Abort',
        'block-dirty-bitmap-add': 'BlockDirtyBitmapAdd',
 +       'block-dirty-bitmap-remove': 'BlockDirtyBitmap',
        'block-dirty-bitmap-clear': 'BlockDirtyBitmap',
        'block-dirty-bitmap-enable': 'BlockDirtyBitmap',
        'block-dirty-bitmap-disable': 'BlockDirtyBitmap',
 -- 
 1.8.3.1
--- a/kvm-qemu-iotests-Add-test-for-bz-1745922.patch
+++ b/kvm-qemu-iotests-Add-test-for-bz-1745922.patch
@ -1,191 +0,0 @@
 From a888b935e29a08f0ace84906fee84b41a5f8b95d Mon Sep 17 00:00:00 2001
 From: Maxim Levitsky <mlevitsk@redhat.com>
 Date: Tue, 24 Sep 2019 21:11:52 +0100
 Subject: [PATCH 4/4] qemu-iotests: Add test for bz #1745922
 RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
 Message-id: <20190924211152.13461-5-mlevitsk@redhat.com>
 Patchwork-id: 90877
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v2 4/4] qemu-iotests: Add test for bz #1745922
 Bugzilla: 1745922
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-id: 20190915203655.21638-4-mlevitsk@redhat.com
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 1825cc0783ccf0ec5d9f0b225a99b340bdd4c68f)
 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
 Conflicts:
 	tests/qemu-iotests/group
        usual conflicts with missing tests
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 tests/qemu-iotests/263     | 91 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/263.out | 40 ++++++++++++++++++++
 tests/qemu-iotests/group   |  1 +
 3 files changed, 132 insertions(+)
 create mode 100755 tests/qemu-iotests/263
 create mode 100644 tests/qemu-iotests/263.out
 diff --git a/tests/qemu-iotests/263 b/tests/qemu-iotests/263
 new file mode 100755
 index 0000000..d2c030f
 --- /dev/null
 +++ b/tests/qemu-iotests/263
@@ -0,0 +1,91 @@
 +#!/usr/bin/env bash
 +#
 +# Test encrypted write that crosses cluster boundary of two unallocated clusters
 +# Based on 188
 +#
 +# Copyright (C) 2019 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +
 +# creator
 +owner=mlevitsk@redhat.com
 +
 +seq=`basename $0`
 +echo "QA output created by $seq"
 +
 +status=1	# failure is the default!
 +
 +_cleanup()
 +{
 +	_cleanup_test_img
 +}
 +trap "_cleanup; exit \$status" 0 1 2 3 15
 +
 +# get standard environment, filters and checks
 +. ./common.rc
 +. ./common.filter
 +
 +_supported_fmt qcow2
 +_supported_proto generic
 +_supported_os Linux
 +
 +
 +size=1M
 +
 +SECRET="secret,id=sec0,data=astrochicken"
 +QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT
 +
 +
 +_run_test()
 +{
 +	echo "== reading the whole image =="
 +	$QEMU_IO --object $SECRET -c "read -P 0 0 $size" --image-opts "$1" | _filter_qemu_io | _filter_testdir
 +
 +	echo
 +	echo "== write two 512 byte sectors on a cluster boundary =="
 +	$QEMU_IO --object $SECRET -c "write -P 0xAA 0xFE00 0x400" --image-opts "$1" | _filter_qemu_io | _filter_testdir
 +
 +	echo
 +	echo "== verify that the rest of the image is not changed =="
 +	$QEMU_IO --object $SECRET -c "read -P 0x00 0x00000 0xFE00" --image-opts "$1" | _filter_qemu_io | _filter_testdir
 +	$QEMU_IO --object $SECRET -c "read -P 0xAA 0x0FE00 0x400" --image-opts "$1" | _filter_qemu_io | _filter_testdir
 +	$QEMU_IO --object $SECRET -c "read -P 0x00 0x10200 0xEFE00" --image-opts "$1" | _filter_qemu_io | _filter_testdir
 +
 +}
 +
 +
 +echo
 +echo "testing LUKS qcow2 encryption"
 +echo
 +
 +_make_test_img --object $SECRET -o "encrypt.format=luks,encrypt.key-secret=sec0,encrypt.iter-time=10,cluster_size=64K" $size
 +_run_test "driver=$IMGFMT,encrypt.key-secret=sec0,file.filename=$TEST_IMG"
 +_cleanup_test_img
 +
 +echo
 +echo "testing legacy AES qcow2 encryption"
 +echo
 +
 +
 +_make_test_img --object $SECRET -o "encrypt.format=aes,encrypt.key-secret=sec0,cluster_size=64K" $size
 +_run_test "driver=$IMGFMT,encrypt.key-secret=sec0,file.filename=$TEST_IMG"
 +_cleanup_test_img
 +
 +
 +
 +# success, all done
 +echo "*** done"
 +rm -f $seq.full
 +status=0
 diff --git a/tests/qemu-iotests/263.out b/tests/qemu-iotests/263.out
 new file mode 100644
 index 0000000..0c982c5
 --- /dev/null
 +++ b/tests/qemu-iotests/263.out
@@ -0,0 +1,40 @@
 +QA output created by 263
 +
 +testing LUKS qcow2 encryption
 +
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 encrypt.format=luks encrypt.key-secret=sec0 encrypt.iter-time=10
 +== reading the whole image ==
 +read 1048576/1048576 bytes at offset 0
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +== write two 512 byte sectors on a cluster boundary ==
 +wrote 1024/1024 bytes at offset 65024
 +1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +== verify that the rest of the image is not changed ==
 +read 65024/65024 bytes at offset 0
 +63.500 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +read 1024/1024 bytes at offset 65024
 +1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +read 982528/982528 bytes at offset 66048
 +959.500 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +testing legacy AES qcow2 encryption
 +
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 encrypt.format=aes encrypt.key-secret=sec0
 +== reading the whole image ==
 +read 1048576/1048576 bytes at offset 0
 +1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +== write two 512 byte sectors on a cluster boundary ==
 +wrote 1024/1024 bytes at offset 65024
 +1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +
 +== verify that the rest of the image is not changed ==
 +read 65024/65024 bytes at offset 0
 +63.500 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +read 1024/1024 bytes at offset 65024
 +1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +read 982528/982528 bytes at offset 66048
 +959.500 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 +*** done
 diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
 index 813db25..4a7e08f 100644
 --- a/tests/qemu-iotests/group
 +++ b/tests/qemu-iotests/group
@@ -271,3 +271,4 @@
 254 rw backing quick
 255 rw quick
 256 rw quick
 +263 rw quick
 \ No newline at end of file
 -- 
 1.8.3.1
--- a/kvm-redhat-s390x-Add-proper-compatibility-options-for-th.patch
+++ b/kvm-redhat-s390x-Add-proper-compatibility-options-for-th.patch
@ -1,64 +0,0 @@
 From a9b22e8663f190e4a845815864e78ef61b68f2a4 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 20 Aug 2019 09:24:41 +0100
 Subject: [PATCH 2/5] redhat: s390x: Add proper compatibility options for the
 -rhel7.6.0 machine
 RH-Author: Thomas Huth <thuth@redhat.com>
 Message-id: <20190820092441.28201-3-thuth@redhat.com>
 Patchwork-id: 90078
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 2/2] redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 Bugzilla: 1693772
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Bugzilla: 1693772
 Upstream: n/a (downstream only)
 Since we skipped the -rhel8.0.0 machine on s390x, we have to add the
 related compatibility properties now to the -rhel7.6.0 machine type
 instead.
 Also the "multiple epoch" facility was disabled on the z14GA1 CPU
 in 7.6, so we also have to adjust our machine type here accordingly.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 2f4cd14..ebbde05 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -905,12 +905,25 @@ DEFINE_CCW_MACHINE(rhel810, "rhel8.1.0", true);
 static void ccw_machine_rhel760_instance_options(MachineState *machine)
 {
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
     ccw_machine_rhel810_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 }
 static void ccw_machine_rhel760_class_options(MachineClass *mc)
 {
     ccw_machine_rhel810_class_options(mc);
 +    /* We never published the s390x version of RHEL8.0 AV, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
     compat_props_add(mc->compat_props, ccw_compat_rhel_7_6, ccw_compat_rhel_7_6_len);
 }
 -- 
 1.8.3.1
--- a/kvm-redhat-s390x-Rename-s390-ccw-virtio-rhel8.0.0-to-s39.patch
+++ b/kvm-redhat-s390x-Rename-s390-ccw-virtio-rhel8.0.0-to-s39.patch
@ -1,64 +0,0 @@
 From fb192e5feac9ed77672e4acbfaec3bdad4d7684a Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 20 Aug 2019 09:24:40 +0100
 Subject: [PATCH 1/5] redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to
 s390-ccw-virtio-rhel8.1.0
 RH-Author: Thomas Huth <thuth@redhat.com>
 Message-id: <20190820092441.28201-2-thuth@redhat.com>
 Patchwork-id: 90077
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/2] redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 Bugzilla: 1693772
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Bugzilla: 1693772
 Upstream: n/a
 We did not ship RHEL AV 8.0 for s390x to customers, so we do not need
 to maintain the s390-ccw-virtio-rhel8.0.0 machine. Rename it to
 s390-ccw-virtio-rhel8.1.0 instead.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 4d8c2ec..2f4cd14 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -894,23 +894,23 @@ GlobalProperty ccw_compat_rhel_7_5[] = {
 };
 const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 -static void ccw_machine_rhel800_instance_options(MachineState *machine)
 +static void ccw_machine_rhel810_instance_options(MachineState *machine)
 {
 }
 -static void ccw_machine_rhel800_class_options(MachineClass *mc)
 +static void ccw_machine_rhel810_class_options(MachineClass *mc)
 {
 }
 -DEFINE_CCW_MACHINE(rhel800, "rhel8.0.0", true);
 +DEFINE_CCW_MACHINE(rhel810, "rhel8.1.0", true);
 static void ccw_machine_rhel760_instance_options(MachineState *machine)
 {
 -    ccw_machine_rhel800_instance_options(machine);
 +    ccw_machine_rhel810_instance_options(machine);
 }
 static void ccw_machine_rhel760_class_options(MachineClass *mc)
 {
 -    ccw_machine_rhel800_class_options(mc);
 +    ccw_machine_rhel810_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
     compat_props_add(mc->compat_props, ccw_compat_rhel_7_6, ccw_compat_rhel_7_6_len);
 }
 -- 
 1.8.3.1
--- a/kvm-redhat-update-pseries-rhel8.1.0-machine-type.patch
+++ b/kvm-redhat-update-pseries-rhel8.1.0-machine-type.patch
@ -1,73 +0,0 @@
 From bcba7281bbb2351fab69498c54fcda4e6154fa91 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Fri, 23 Aug 2019 09:13:02 +0100
 Subject: [PATCH 4/5] redhat: update pseries-rhel8.1.0 machine type
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20190823091302.8970-1-lvivier@redhat.com>
 Patchwork-id: 90137
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH] redhat: update pseries-rhel8.1.0 machine type
 Bugzilla: 1744170
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1744170
 BRANCH: rhel-av-8.1.0/master-4.1.0
 UPSTREAM: downstream only
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23160686
 pseries-rhel8.1.0 has been created based on pseries-4.0,
 we need to update it now we are based on pseries-4.1
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 669eae1..9b500d2 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -4437,6 +4437,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", true);
 +#endif
 /*
  * pseries-4.0
@@ -4453,6 +4454,7 @@ static void phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -4796,7 +4798,7 @@ DEFINE_SPAPR_MACHINE(rhel810, "rhel8.1.0", true);
 /*
  * pseries-rhel8.0.0
 - * like spapr_compat_3_1
 + * like pseries-3.1 and pseries-4.0
  * except SPAPR_CAP_CFPC, SPAPR_CAP_SBBC and SPAPR_CAP_IBS
  * that have been backported to pseries-rhel8.0.0
  */
@@ -4809,6 +4811,12 @@ static void spapr_machine_rhel800_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_rhel_8_0,
                      hw_compat_rhel_8_0_len);
 +    /* pseries-4.0 */
 +    smc->phb_placement = phb_placement_4_0;
 +    smc->irq = &spapr_irq_xics;
 +    smc->pre_4_1_migration = true;
 +
 +    /* pseries-3.1 */
     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0");
     smc->update_dt_enabled = false;
     smc->dr_phb_enabled = false;
 -- 
 1.8.3.1
--- a/kvm-socket-Add-backlog-parameter-to-socket_listen.patch
+++ b/kvm-socket-Add-backlog-parameter-to-socket_listen.patch
@ -1,295 +0,0 @@
 From fce683618bc605eaedfdcea0db974734c111a2e9 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 10:26:02 +0100
 Subject: [PATCH 2/8] socket: Add backlog parameter to socket_listen
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904102606.15744-2-quintela@redhat.com>
 Patchwork-id: 90270
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 1/5] socket: Add backlog parameter to socket_listen
 Bugzilla: 1726898
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Current parameter was always one.  We continue with that value for now
 in all callers.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 Moved trace to socket_listen
 (cherry picked from commit e5b6353cf25c99c3f08bf51e29933352f7140e8f)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 include/qemu/sockets.h    |  2 +-
 io/channel-socket.c       |  2 +-
 qga/channel-posix.c       |  2 +-
 tests/test-util-sockets.c | 12 ++++++------
 util/qemu-sockets.c       | 33 ++++++++++++++++++++++-----------
 util/trace-events         |  3 +++
 6 files changed, 34 insertions(+), 20 deletions(-)
 diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
 index 8140fea..57cd049 100644
 --- a/include/qemu/sockets.h
 +++ b/include/qemu/sockets.h
@@ -41,7 +41,7 @@ int unix_connect(const char *path, Error **errp);
 SocketAddress *socket_parse(const char *str, Error **errp);
 int socket_connect(SocketAddress *addr, Error **errp);
 -int socket_listen(SocketAddress *addr, Error **errp);
 +int socket_listen(SocketAddress *addr, int num, Error **errp);
 void socket_listen_cleanup(int fd, Error **errp);
 int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp);
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index bec3d93..a533c8b 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -202,7 +202,7 @@ int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
     int fd;
     trace_qio_channel_socket_listen_sync(ioc, addr);
 -    fd = socket_listen(addr, errp);
 +    fd = socket_listen(addr, 1, errp);
     if (fd < 0) {
         trace_qio_channel_socket_listen_fail(ioc);
         return -1;
 diff --git a/qga/channel-posix.c b/qga/channel-posix.c
 index 5a925a9..8fc205a 100644
 --- a/qga/channel-posix.c
 +++ b/qga/channel-posix.c
@@ -215,7 +215,7 @@ static gboolean ga_channel_open(GAChannel *c, const gchar *path,
                 return false;
             }
 -            fd = socket_listen(addr, &local_err);
 +            fd = socket_listen(addr, 1, &local_err);
             qapi_free_SocketAddress(addr);
             if (local_err != NULL) {
                 g_critical("%s", error_get_pretty(local_err));
 diff --git a/tests/test-util-sockets.c b/tests/test-util-sockets.c
 index f1ebffe..c8e1893 100644
 --- a/tests/test-util-sockets.c
 +++ b/tests/test-util-sockets.c
@@ -93,7 +93,7 @@ static void test_socket_fd_pass_name_good(void)
     g_assert_cmpint(fd, !=, mon_fd);
     close(fd);
 -    fd = socket_listen(&addr, &error_abort);
 +    fd = socket_listen(&addr, 1, &error_abort);
     g_assert_cmpint(fd, !=, -1);
     g_assert_cmpint(fd, !=, mon_fd);
     close(fd);
@@ -124,7 +124,7 @@ static void test_socket_fd_pass_name_bad(void)
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
 -    fd = socket_listen(&addr, &err);
 +    fd = socket_listen(&addr, 1, &err);
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
@@ -151,7 +151,7 @@ static void test_socket_fd_pass_name_nomon(void)
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
 -    fd = socket_listen(&addr, &err);
 +    fd = socket_listen(&addr, 1, &err);
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
@@ -174,7 +174,7 @@ static void test_socket_fd_pass_num_good(void)
     fd = socket_connect(&addr, &error_abort);
     g_assert_cmpint(fd, ==, sfd);
 -    fd = socket_listen(&addr, &error_abort);
 +    fd = socket_listen(&addr, 1, &error_abort);
     g_assert_cmpint(fd, ==, sfd);
     g_free(addr.u.fd.str);
@@ -197,7 +197,7 @@ static void test_socket_fd_pass_num_bad(void)
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
 -    fd = socket_listen(&addr, &err);
 +    fd = socket_listen(&addr, 1, &err);
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
@@ -220,7 +220,7 @@ static void test_socket_fd_pass_num_nocli(void)
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
 -    fd = socket_listen(&addr, &err);
 +    fd = socket_listen(&addr, 1, &err);
     g_assert_cmpint(fd, ==, -1);
     error_free_or_abort(&err);
 diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
 index a5092db..a39ada4 100644
 --- a/util/qemu-sockets.c
 +++ b/util/qemu-sockets.c
@@ -31,6 +31,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
 #include "qemu/cutils.h"
 +#include "trace.h"
 #ifndef AI_ADDRCONFIG
 # define AI_ADDRCONFIG 0
@@ -207,6 +208,7 @@ static int try_bind(int socket, InetSocketAddress *saddr, struct addrinfo *e)
 static int inet_listen_saddr(InetSocketAddress *saddr,
                              int port_offset,
 +                             int num,
                              Error **errp)
 {
     struct addrinfo ai,*res,*e;
@@ -303,7 +305,7 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
                     goto listen_failed;
                 }
             } else {
 -                if (!listen(slisten, 1)) {
 +                if (!listen(slisten, num)) {
                     goto listen_ok;
                 }
                 if (errno != EADDRINUSE) {
@@ -746,6 +748,7 @@ static int vsock_connect_saddr(VsockSocketAddress *vaddr, Error **errp)
 }
 static int vsock_listen_saddr(VsockSocketAddress *vaddr,
 +                              int num,
                               Error **errp)
 {
     struct sockaddr_vm svm;
@@ -767,7 +770,7 @@ static int vsock_listen_saddr(VsockSocketAddress *vaddr,
         return -1;
     }
 -    if (listen(slisten, 1) != 0) {
 +    if (listen(slisten, num) != 0) {
         error_setg_errno(errp, errno, "Failed to listen on socket");
         closesocket(slisten);
         return -1;
@@ -808,6 +811,7 @@ static int vsock_connect_saddr(VsockSocketAddress *vaddr, Error **errp)
 }
 static int vsock_listen_saddr(VsockSocketAddress *vaddr,
 +                              int num,
                               Error **errp)
 {
     vsock_unsupported(errp);
@@ -825,6 +829,7 @@ static int vsock_parse(VsockSocketAddress *addr, const char *str,
 #ifndef _WIN32
 static int unix_listen_saddr(UnixSocketAddress *saddr,
 +                             int num,
                              Error **errp)
 {
     struct sockaddr_un un;
@@ -886,7 +891,7 @@ static int unix_listen_saddr(UnixSocketAddress *saddr,
         error_setg_errno(errp, errno, "Failed to bind socket to %s", path);
         goto err;
     }
 -    if (listen(sock, 1) < 0) {
 +    if (listen(sock, num) < 0) {
         error_setg_errno(errp, errno, "Failed to listen on socket");
         goto err;
     }
@@ -953,6 +958,7 @@ static int unix_connect_saddr(UnixSocketAddress *saddr, Error **errp)
 #else
 static int unix_listen_saddr(UnixSocketAddress *saddr,
 +                             int num,
                              Error **errp)
 {
     error_setg(errp, "unix sockets are not available on windows");
@@ -976,7 +982,7 @@ int unix_listen(const char *str, Error **errp)
     saddr = g_new0(UnixSocketAddress, 1);
     saddr->path = g_strdup(str);
 -    sock = unix_listen_saddr(saddr, errp);
 +    sock = unix_listen_saddr(saddr, 1, errp);
     qapi_free_UnixSocketAddress(saddr);
     return sock;
 }
@@ -1033,9 +1039,13 @@ fail:
     return NULL;
 }
 -static int socket_get_fd(const char *fdstr, Error **errp)
 +static int socket_get_fd(const char *fdstr, int num, Error **errp)
 {
     int fd;
 +    if (num != 1) {
 +        error_setg_errno(errp, EINVAL, "socket_get_fd: too many connections");
 +        return -1;
 +    }
     if (cur_mon) {
         fd = monitor_get_fd(cur_mon, fdstr, errp);
         if (fd < 0) {
@@ -1071,7 +1081,7 @@ int socket_connect(SocketAddress *addr, Error **errp)
         break;
     case SOCKET_ADDRESS_TYPE_FD:
 -        fd = socket_get_fd(addr->u.fd.str, errp);
 +        fd = socket_get_fd(addr->u.fd.str, 1, errp);
         break;
     case SOCKET_ADDRESS_TYPE_VSOCK:
@@ -1084,25 +1094,26 @@ int socket_connect(SocketAddress *addr, Error **errp)
     return fd;
 }
 -int socket_listen(SocketAddress *addr, Error **errp)
 +int socket_listen(SocketAddress *addr, int num, Error **errp)
 {
     int fd;
 +    trace_socket_listen(num);
     switch (addr->type) {
     case SOCKET_ADDRESS_TYPE_INET:
 -        fd = inet_listen_saddr(&addr->u.inet, 0, errp);
 +        fd = inet_listen_saddr(&addr->u.inet, 0, num, errp);
         break;
     case SOCKET_ADDRESS_TYPE_UNIX:
 -        fd = unix_listen_saddr(&addr->u.q_unix, errp);
 +        fd = unix_listen_saddr(&addr->u.q_unix, num, errp);
         break;
     case SOCKET_ADDRESS_TYPE_FD:
 -        fd = socket_get_fd(addr->u.fd.str, errp);
 +        fd = socket_get_fd(addr->u.fd.str, num, errp);
         break;
     case SOCKET_ADDRESS_TYPE_VSOCK:
 -        fd = vsock_listen_saddr(&addr->u.vsock, errp);
 +        fd = vsock_listen_saddr(&addr->u.vsock, num, errp);
         break;
     default:
 diff --git a/util/trace-events b/util/trace-events
 index 9dbd237..83b6639 100644
 --- a/util/trace-events
 +++ b/util/trace-events
@@ -64,6 +64,9 @@ lockcnt_futex_wait(const void *lockcnt, int val) "lockcnt %p waiting on %d"
 lockcnt_futex_wait_resume(const void *lockcnt, int new) "lockcnt %p after wait: %d"
 lockcnt_futex_wake(const void *lockcnt) "lockcnt %p waking up one waiter"
 +# qemu-sockets.c
 +socket_listen(int num) "backlog: %d"
 +
 # qemu-thread-common.h
 qemu_mutex_lock(void *mutex, const char *file, const int line) "waiting on mutex %p (%s:%d)"
 qemu_mutex_locked(void *mutex, const char *file, const int line) "taken mutex %p (%s:%d)"
 -- 
 1.8.3.1
--- a/kvm-socket-Add-num-connections-to-qio_channel_socket_asy.patch
+++ b/kvm-socket-Add-num-connections-to-qio_channel_socket_asy.patch
@ -1,144 +0,0 @@
 From d2bb195f057fd21444644d3996551fe8775043e5 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 10:26:04 +0100
 Subject: [PATCH 4/8] socket: Add num connections to qio_channel_socket_async()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904102606.15744-4-quintela@redhat.com>
 Patchwork-id: 90271
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 3/5] socket: Add num connections to qio_channel_socket_async()
 Bugzilla: 1726898
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 (cherry picked from commit 7959e29ea0d6100038367beff9a0da0c83b322a2)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 include/io/channel-socket.h    |  2 ++
 io/channel-socket.c            | 30 +++++++++++++++++++++++-------
 io/trace-events                |  2 +-
 tests/test-io-channel-socket.c |  2 +-
 4 files changed, 27 insertions(+), 9 deletions(-)
 diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
 index ed88e5b..777ff59 100644
 --- a/include/io/channel-socket.h
 +++ b/include/io/channel-socket.h
@@ -140,6 +140,7 @@ int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
  * qio_channel_socket_listen_async:
  * @ioc: the socket channel object
  * @addr: the address to listen to
 + * @num: the expected ammount of connections
  * @callback: the function to invoke on completion
  * @opaque: user data to pass to @callback
  * @destroy: the function to free @opaque
@@ -155,6 +156,7 @@ int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
  */
 void qio_channel_socket_listen_async(QIOChannelSocket *ioc,
                                      SocketAddress *addr,
 +                                     int num,
                                      QIOTaskFunc callback,
                                      gpointer opaque,
                                      GDestroyNotify destroy,
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 6258c25..b74f5b9 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -220,14 +220,27 @@ int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
 }
 +struct QIOChannelListenWorkerData {
 +    SocketAddress *addr;
 +    int num; /* amount of expected connections */
 +};
 +
 +static void qio_channel_listen_worker_free(gpointer opaque)
 +{
 +    struct QIOChannelListenWorkerData *data = opaque;
 +
 +    qapi_free_SocketAddress(data->addr);
 +    g_free(data);
 +}
 +
 static void qio_channel_socket_listen_worker(QIOTask *task,
                                              gpointer opaque)
 {
     QIOChannelSocket *ioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));
 -    SocketAddress *addr = opaque;
 +    struct QIOChannelListenWorkerData *data = opaque;
     Error *err = NULL;
 -    qio_channel_socket_listen_sync(ioc, addr, 1, &err);
 +    qio_channel_socket_listen_sync(ioc, data->addr, data->num, &err);
     qio_task_set_error(task, err);
 }
@@ -235,6 +248,7 @@ static void qio_channel_socket_listen_worker(QIOTask *task,
 void qio_channel_socket_listen_async(QIOChannelSocket *ioc,
                                      SocketAddress *addr,
 +                                     int num,
                                      QIOTaskFunc callback,
                                      gpointer opaque,
                                      GDestroyNotify destroy,
@@ -242,16 +256,18 @@ void qio_channel_socket_listen_async(QIOChannelSocket *ioc,
 {
     QIOTask *task = qio_task_new(
         OBJECT(ioc), callback, opaque, destroy);
 -    SocketAddress *addrCopy;
 +    struct QIOChannelListenWorkerData *data;
 -    addrCopy = QAPI_CLONE(SocketAddress, addr);
 +    data = g_new0(struct QIOChannelListenWorkerData, 1);
 +    data->addr = QAPI_CLONE(SocketAddress, addr);
 +    data->num = num;
     /* socket_listen() blocks in DNS lookups, so we must use a thread */
 -    trace_qio_channel_socket_listen_async(ioc, addr);
 +    trace_qio_channel_socket_listen_async(ioc, addr, num);
     qio_task_run_in_thread(task,
                            qio_channel_socket_listen_worker,
 -                           addrCopy,
 -                           (GDestroyNotify)qapi_free_SocketAddress,
 +                           data,
 +                           qio_channel_listen_worker_free,
                            context);
 }
 diff --git a/io/trace-events b/io/trace-events
 index 2e6aa1d..d7bc70b 100644
 --- a/io/trace-events
 +++ b/io/trace-events
@@ -18,7 +18,7 @@ qio_channel_socket_connect_async(void *ioc, void *addr) "Socket connect async io
 qio_channel_socket_connect_fail(void *ioc) "Socket connect fail ioc=%p"
 qio_channel_socket_connect_complete(void *ioc, int fd) "Socket connect complete ioc=%p fd=%d"
 qio_channel_socket_listen_sync(void *ioc, void *addr, int num) "Socket listen sync ioc=%p addr=%p num=%d"
 -qio_channel_socket_listen_async(void *ioc, void *addr) "Socket listen async ioc=%p addr=%p"
 +qio_channel_socket_listen_async(void *ioc, void *addr, int num) "Socket listen async ioc=%p addr=%p num=%d"
 qio_channel_socket_listen_fail(void *ioc) "Socket listen fail ioc=%p"
 qio_channel_socket_listen_complete(void *ioc, int fd) "Socket listen complete ioc=%p fd=%d"
 qio_channel_socket_dgram_sync(void *ioc, void *localAddr, void *remoteAddr) "Socket dgram sync ioc=%p localAddr=%p remoteAddr=%p"
 diff --git a/tests/test-io-channel-socket.c b/tests/test-io-channel-socket.c
 index 6eebcee..50235c1 100644
 --- a/tests/test-io-channel-socket.c
 +++ b/tests/test-io-channel-socket.c
@@ -113,7 +113,7 @@ static void test_io_channel_setup_async(SocketAddress *listen_addr,
     lioc = qio_channel_socket_new();
     qio_channel_socket_listen_async(
 -        lioc, listen_addr,
 +        lioc, listen_addr, 1,
         test_io_channel_complete, &data, NULL, NULL);
     g_main_loop_run(data.loop);
 -- 
 1.8.3.1
--- a/kvm-socket-Add-num-connections-to-qio_channel_socket_syn.patch
+++ b/kvm-socket-Add-num-connections-to-qio_channel_socket_syn.patch
@ -1,173 +0,0 @@
 From 307f4596dc70dcabac9da3ec680d377e1df21397 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 10:26:03 +0100
 Subject: [PATCH 3/8] socket: Add num connections to qio_channel_socket_sync()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904102606.15744-3-quintela@redhat.com>
 Patchwork-id: 90272
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 2/5] socket: Add num connections to qio_channel_socket_sync()
 Bugzilla: 1726898
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 (cherry picked from commit 4e2d8bf6f143138ad121545a7cf4525e36040039)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 include/io/channel-socket.h    | 2 ++
 io/channel-socket.c            | 7 ++++---
 io/net-listener.c              | 2 +-
 io/trace-events                | 2 +-
 scsi/qemu-pr-helper.c          | 3 ++-
 tests/test-char.c              | 4 ++--
 tests/test-io-channel-socket.c | 2 +-
 tests/tpm-emu.c                | 2 +-
 8 files changed, 14 insertions(+), 10 deletions(-)
 diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
 index d7134d2..ed88e5b 100644
 --- a/include/io/channel-socket.h
 +++ b/include/io/channel-socket.h
@@ -123,6 +123,7 @@ void qio_channel_socket_connect_async(QIOChannelSocket *ioc,
  * qio_channel_socket_listen_sync:
  * @ioc: the socket channel object
  * @addr: the address to listen to
 + * @num: the expected ammount of connections
  * @errp: pointer to a NULL-initialized error object
  *
  * Attempt to listen to the address @addr. This method
@@ -132,6 +133,7 @@ void qio_channel_socket_connect_async(QIOChannelSocket *ioc,
  */
 int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
                                    SocketAddress *addr,
 +                                   int num,
                                    Error **errp);
 /**
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index a533c8b..6258c25 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -197,12 +197,13 @@ void qio_channel_socket_connect_async(QIOChannelSocket *ioc,
 int qio_channel_socket_listen_sync(QIOChannelSocket *ioc,
                                    SocketAddress *addr,
 +                                   int num,
                                    Error **errp)
 {
     int fd;
 -    trace_qio_channel_socket_listen_sync(ioc, addr);
 -    fd = socket_listen(addr, 1, errp);
 +    trace_qio_channel_socket_listen_sync(ioc, addr, num);
 +    fd = socket_listen(addr, num, errp);
     if (fd < 0) {
         trace_qio_channel_socket_listen_fail(ioc);
         return -1;
@@ -226,7 +227,7 @@ static void qio_channel_socket_listen_worker(QIOTask *task,
     SocketAddress *addr = opaque;
     Error *err = NULL;
 -    qio_channel_socket_listen_sync(ioc, addr, &err);
 +    qio_channel_socket_listen_sync(ioc, addr, 1, &err);
     qio_task_set_error(task, err);
 }
 diff --git a/io/net-listener.c b/io/net-listener.c
 index d8cfe52..dc81150 100644
 --- a/io/net-listener.c
 +++ b/io/net-listener.c
@@ -82,7 +82,7 @@ int qio_net_listener_open_sync(QIONetListener *listener,
     for (i = 0; i < nresaddrs; i++) {
         QIOChannelSocket *sioc = qio_channel_socket_new();
 -        if (qio_channel_socket_listen_sync(sioc, resaddrs[i],
 +        if (qio_channel_socket_listen_sync(sioc, resaddrs[i], 1,
                                            err ? NULL : &err) == 0) {
             success = true;
 diff --git a/io/trace-events b/io/trace-events
 index 3783905..2e6aa1d 100644
 --- a/io/trace-events
 +++ b/io/trace-events
@@ -17,7 +17,7 @@ qio_channel_socket_connect_sync(void *ioc, void *addr) "Socket connect sync ioc=
 qio_channel_socket_connect_async(void *ioc, void *addr) "Socket connect async ioc=%p addr=%p"
 qio_channel_socket_connect_fail(void *ioc) "Socket connect fail ioc=%p"
 qio_channel_socket_connect_complete(void *ioc, int fd) "Socket connect complete ioc=%p fd=%d"
 -qio_channel_socket_listen_sync(void *ioc, void *addr) "Socket listen sync ioc=%p addr=%p"
 +qio_channel_socket_listen_sync(void *ioc, void *addr, int num) "Socket listen sync ioc=%p addr=%p num=%d"
 qio_channel_socket_listen_async(void *ioc, void *addr) "Socket listen async ioc=%p addr=%p"
 qio_channel_socket_listen_fail(void *ioc) "Socket listen fail ioc=%p"
 qio_channel_socket_listen_complete(void *ioc, int fd) "Socket listen complete ioc=%p fd=%d"
 diff --git a/scsi/qemu-pr-helper.c b/scsi/qemu-pr-helper.c
 index a256ce4..a8a74d1 100644
 --- a/scsi/qemu-pr-helper.c
 +++ b/scsi/qemu-pr-helper.c
@@ -1005,7 +1005,8 @@ int main(int argc, char **argv)
             .u.q_unix.path = socket_path,
         };
         server_ioc = qio_channel_socket_new();
 -        if (qio_channel_socket_listen_sync(server_ioc, &saddr, &local_err) < 0) {
 +        if (qio_channel_socket_listen_sync(server_ioc, &saddr,
 +                                           1, &local_err) < 0) {
             object_unref(OBJECT(server_ioc));
             error_report_err(local_err);
             return 1;
 diff --git a/tests/test-char.c b/tests/test-char.c
 index f9440cd..af131fc 100644
 --- a/tests/test-char.c
 +++ b/tests/test-char.c
@@ -666,7 +666,7 @@ char_socket_addr_to_opt_str(SocketAddress *addr, bool fd_pass,
         char *optstr;
         g_assert(!reconnect);
         if (is_listen) {
 -            qio_channel_socket_listen_sync(ioc, addr, &error_abort);
 +            qio_channel_socket_listen_sync(ioc, addr, 1, &error_abort);
         } else {
             qio_channel_socket_connect_sync(ioc, addr, &error_abort);
         }
@@ -891,7 +891,7 @@ static void char_socket_client_test(gconstpointer opaque)
      */
     ioc = qio_channel_socket_new();
     g_assert_nonnull(ioc);
 -    qio_channel_socket_listen_sync(ioc, config->addr, &error_abort);
 +    qio_channel_socket_listen_sync(ioc, config->addr, 1, &error_abort);
     addr = qio_channel_socket_get_local_address(ioc, &error_abort);
     g_assert_nonnull(addr);
 diff --git a/tests/test-io-channel-socket.c b/tests/test-io-channel-socket.c
 index d2053c4..6eebcee 100644
 --- a/tests/test-io-channel-socket.c
 +++ b/tests/test-io-channel-socket.c
@@ -57,7 +57,7 @@ static void test_io_channel_setup_sync(SocketAddress *listen_addr,
     QIOChannelSocket *lioc;
     lioc = qio_channel_socket_new();
 -    qio_channel_socket_listen_sync(lioc, listen_addr, &error_abort);
 +    qio_channel_socket_listen_sync(lioc, listen_addr, 1, &error_abort);
     if (listen_addr->type == SOCKET_ADDRESS_TYPE_INET) {
         SocketAddress *laddr = qio_channel_socket_get_local_address(
 diff --git a/tests/tpm-emu.c b/tests/tpm-emu.c
 index 125e697..c43ac4a 100644
 --- a/tests/tpm-emu.c
 +++ b/tests/tpm-emu.c
@@ -76,7 +76,7 @@ void *tpm_emu_ctrl_thread(void *data)
     QIOChannelSocket *lioc = qio_channel_socket_new();
     QIOChannel *ioc;
 -    qio_channel_socket_listen_sync(lioc, s->addr, &error_abort);
 +    qio_channel_socket_listen_sync(lioc, s->addr, 1, &error_abort);
     g_mutex_lock(&s->data_mutex);
     s->data_cond_signal = true;
 -- 
 1.8.3.1
--- a/kvm-socket-Add-num-connections-to-qio_net_listener_open_.patch
+++ b/kvm-socket-Add-num-connections-to-qio_net_listener_open_.patch
@ -1,151 +0,0 @@
 From c7029ffd110bdd4bab6847cd485898dbc5acf5f3 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Wed, 4 Sep 2019 10:26:05 +0100
 Subject: [PATCH 5/8] socket: Add num connections to
 qio_net_listener_open_sync()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Juan Quintela <quintela@redhat.com>
 Message-id: <20190904102606.15744-5-quintela@redhat.com>
 Patchwork-id: 90269
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 4/5] socket: Add num connections to qio_net_listener_open_sync()
 Bugzilla: 1726898
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 (cherry picked from commit fc8135c63021e8e442a7a894e5434f210614a73c)
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 blockdev-nbd.c            | 2 +-
 chardev/char-socket.c     | 2 +-
 include/io/net-listener.h | 2 ++
 io/net-listener.c         | 3 ++-
 migration/socket.c        | 2 +-
 qemu-nbd.c                | 2 +-
 ui/vnc.c                  | 4 ++--
 7 files changed, 10 insertions(+), 7 deletions(-)
 diff --git a/blockdev-nbd.c b/blockdev-nbd.c
 index 66eebab..06041a2 100644
 --- a/blockdev-nbd.c
 +++ b/blockdev-nbd.c
@@ -102,7 +102,7 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds,
     qio_net_listener_set_name(nbd_server->listener,
                               "nbd-listener");
 -    if (qio_net_listener_open_sync(nbd_server->listener, addr, errp) < 0) {
 +    if (qio_net_listener_open_sync(nbd_server->listener, addr, 1, errp) < 0) {
         goto error;
     }
 diff --git a/chardev/char-socket.c b/chardev/char-socket.c
 index 7ca5d97..8c7c9da 100644
 --- a/chardev/char-socket.c
 +++ b/chardev/char-socket.c
@@ -1160,7 +1160,7 @@ static int qmp_chardev_open_socket_server(Chardev *chr,
     qio_net_listener_set_name(s->listener, name);
     g_free(name);
 -    if (qio_net_listener_open_sync(s->listener, s->addr, errp) < 0) {
 +    if (qio_net_listener_open_sync(s->listener, s->addr, 1, errp) < 0) {
         object_unref(OBJECT(s->listener));
         s->listener = NULL;
         return -1;
 diff --git a/include/io/net-listener.h b/include/io/net-listener.h
 index 8081ac5..fb10170 100644
 --- a/include/io/net-listener.h
 +++ b/include/io/net-listener.h
@@ -95,6 +95,7 @@ void qio_net_listener_set_name(QIONetListener *listener,
  * qio_net_listener_open_sync:
  * @listener: the network listener object
  * @addr: the address to listen on
 + * @num: the amount of expected connections
  * @errp: pointer to a NULL initialized error object
  *
  * Synchronously open a listening connection on all
@@ -104,6 +105,7 @@ void qio_net_listener_set_name(QIONetListener *listener,
  */
 int qio_net_listener_open_sync(QIONetListener *listener,
                                SocketAddress *addr,
 +                               int num,
                                Error **errp);
 /**
 diff --git a/io/net-listener.c b/io/net-listener.c
 index dc81150..5d8a226 100644
 --- a/io/net-listener.c
 +++ b/io/net-listener.c
@@ -62,6 +62,7 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
 int qio_net_listener_open_sync(QIONetListener *listener,
                                SocketAddress *addr,
 +                               int num,
                                Error **errp)
 {
     QIODNSResolver *resolver = qio_dns_resolver_get_instance();
@@ -82,7 +83,7 @@ int qio_net_listener_open_sync(QIONetListener *listener,
     for (i = 0; i < nresaddrs; i++) {
         QIOChannelSocket *sioc = qio_channel_socket_new();
 -        if (qio_channel_socket_listen_sync(sioc, resaddrs[i], 1,
 +        if (qio_channel_socket_listen_sync(sioc, resaddrs[i], num,
                                            err ? NULL : &err) == 0) {
             success = true;
 diff --git a/migration/socket.c b/migration/socket.c
 index 98efdc0..e63f5e1 100644
 --- a/migration/socket.c
 +++ b/migration/socket.c
@@ -181,7 +181,7 @@ static void socket_start_incoming_migration(SocketAddress *saddr,
     qio_net_listener_set_name(listener, "migration-socket-listener");
 -    if (qio_net_listener_open_sync(listener, saddr, errp) < 0) {
 +    if (qio_net_listener_open_sync(listener, saddr, 1, errp) < 0) {
         object_unref(OBJECT(listener));
         return;
     }
 diff --git a/qemu-nbd.c b/qemu-nbd.c
 index a8cb39e..e6a52bf 100644
 --- a/qemu-nbd.c
 +++ b/qemu-nbd.c
@@ -1054,7 +1054,7 @@ int main(int argc, char **argv)
     server = qio_net_listener_new();
     if (socket_activation == 0) {
         saddr = nbd_build_socket_address(sockpath, bindto, port);
 -        if (qio_net_listener_open_sync(server, saddr, &local_err) < 0) {
 +        if (qio_net_listener_open_sync(server, saddr, 1, &local_err) < 0) {
             object_unref(OBJECT(server));
             error_report_err(local_err);
             exit(EXIT_FAILURE);
 diff --git a/ui/vnc.c b/ui/vnc.c
 index 933dc36..b042593 100644
 --- a/ui/vnc.c
 +++ b/ui/vnc.c
@@ -3760,7 +3760,7 @@ static int vnc_display_listen(VncDisplay *vd,
         qio_net_listener_set_name(vd->listener, "vnc-listen");
         for (i = 0; i < nsaddr; i++) {
             if (qio_net_listener_open_sync(vd->listener,
 -                                           saddr[i],
 +                                           saddr[i], 1,
                                            errp) < 0)  {
                 return -1;
             }
@@ -3775,7 +3775,7 @@ static int vnc_display_listen(VncDisplay *vd,
         qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
         for (i = 0; i < nwsaddr; i++) {
             if (qio_net_listener_open_sync(vd->wslistener,
 -                                           wsaddr[i],
 +                                           wsaddr[i], 1,
                                            errp) < 0)  {
                 return -1;
             }
 -- 
 1.8.3.1
--- a/kvm-spapr-Set-compat-mode-in-spapr_core_plug.patch
+++ b/kvm-spapr-Set-compat-mode-in-spapr_core_plug.patch
@ -1,127 +0,0 @@
 From 50cee68ce9dc31033969905cf0358d0f641d056a Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 4 Sep 2019 10:31:39 +0100
 Subject: [PATCH 8/8] spapr: Set compat mode in spapr_core_plug()
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20190904103139.29870-3-lvivier@redhat.com>
 Patchwork-id: 90276
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 2/2] spapr: Set compat mode in spapr_core_plug()
 Bugzilla: 1744107
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: David Gibson <dgibson@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 A recent change in spapr_machine_reset() showed that resetting the compat
 mode in spapr_machine_reset() for the boot vCPU and in spapr_cpu_reset()
 for all other vCPUs was fragile. The fix was thus to reset the compat mode
 for all vCPUs in spapr_machine_reset(), but we still have to propagate
 it to hot-plugged CPUs. This is still performed from spapr_cpu_reset(),
 hence resulting in ppc_set_compat() being called twice for every vCPU at
 machine reset. Apart from wasting cycles, which isn't really an issue
 during machine reset, this seems to indicate that spapr_cpu_reset() isn't
 the best place to set the compat mode.
 A natural candidate for CPU-hotplug specific code is spapr_core_plug().
 Also, it sits in the same file as spapr_machine_reset() : this makes
 it easier for someone who wants to know when the compat PVR is set.
 Call ppc_set_compat() from there. This doesn't need to be done for
 initial vCPUs since the compat PVR is 0 and spapr_machine_reset() sets
 the appropriate value later. No need to do this on manually added vCPUS
 on the destination QEMU during migration since the compat PVR is
 part of the migrated vCPU state. Both conditions can be checked with
 spapr_drc_hotplugged().
 Signed-off-by: Greg Kurz <groug@kaod.org>
 Message-Id: <156701285312.499757.7807417667750711711.stgit@bahia.lan>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit b1e815674343a171e51ce447495957e289091e9f)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1744107
 BRANCH: rhel-av-8.1.0/master-4.1.0
 UPSTREAM: Merged
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr.c          | 24 ++++++++++++++++--------
 hw/ppc/spapr_cpu_core.c |  7 -------
 2 files changed, 16 insertions(+), 15 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 30bf7bb..41a6070 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -1746,12 +1746,6 @@ static void spapr_machine_reset(MachineState *machine)
         spapr_ovec_cleanup(spapr->ov5_cas);
         spapr->ov5_cas = spapr_ovec_new();
 -        /*
 -         * reset compat_pvr for all CPUs
 -         * as qemu_devices_reset() is called before this,
 -         * it can't be propagated by spapr_cpu_reset()
 -         * from the first CPU to all the others
 -         */
         ppc_set_compat_all(spapr->max_compat_pvr, &error_fatal);
     }
@@ -3826,6 +3820,7 @@ static void spapr_core_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
     CPUArchId *core_slot;
     int index;
     bool hotplugged = spapr_drc_hotplugged(dev);
 +    int i;
     core_slot = spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index);
     if (!core_slot) {
@@ -3859,13 +3854,26 @@ static void spapr_core_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
     core_slot->cpu = OBJECT(dev);
     if (smc->pre_2_10_has_unused_icps) {
 -        int i;
 -
         for (i = 0; i < cc->nr_threads; i++) {
             cs = CPU(core->threads[i]);
             pre_2_10_vmstate_unregister_dummy_icp(cs->cpu_index);
         }
     }
 +
 +    /*
 +     * Set compatibility mode to match the boot CPU, which was either set
 +     * by the machine reset code or by CAS.
 +     */
 +    if (hotplugged) {
 +        for (i = 0; i < cc->nr_threads; i++) {
 +            ppc_set_compat(core->threads[i], POWERPC_CPU(first_cpu)->compat_pvr,
 +                           &local_err);
 +            if (local_err) {
 +                error_propagate(errp, local_err);
 +                return;
 +            }
 +        }
 +    }
 }
 static void spapr_core_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index ae43c57..85f2746 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -39,13 +39,6 @@ static void spapr_cpu_reset(void *opaque)
      * using an RTAS call */
     cs->halted = 1;
 -    /* Set compatibility mode to match the boot CPU, which was either set
 -     * by the machine reset code or by CAS. This should never fail.
 -     * At startup the value is already set for all the CPUs
 -     * but we need this when we hotplug a new CPU
 -     */
 -    ppc_set_compat(cpu, POWERPC_CPU(first_cpu)->compat_pvr, &error_abort);
 -
     env->spr[SPR_HIOR] = 0;
     lpcr = env->spr[SPR_LPCR];
 -- 
 1.8.3.1
--- a/kvm-spapr-Use-SHUTDOWN_CAUSE_SUBSYSTEM_RESET-for-CAS-reb.patch
+++ b/kvm-spapr-Use-SHUTDOWN_CAUSE_SUBSYSTEM_RESET-for-CAS-reb.patch
@ -1,60 +0,0 @@
 From c8d3479746b17fcdf56b8afb3eccdba2c14578e8 Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Fri, 6 Sep 2019 03:58:36 +0100
 Subject: [PATCH 3/6] spapr: Use SHUTDOWN_CAUSE_SUBSYSTEM_RESET for CAS reboots
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190906035836.23689-1-dgibson@redhat.com>
 Patchwork-id: 90293
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH] spapr: Use SHUTDOWN_CAUSE_SUBSYSTEM_RESET for CAS reboots
 Bugzilla: 1743477
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: David Gibson <david@gibson.dropbear.id.au>
 The sPAPR platform includes feature negotiation between the guest and
 platform.  That sometimes requires reconfiguring the virtual hardware, and
 in some cases that is a complex enough process that we trigger a system
 reset to handle it.  That interacts badly with -no-reboot - we trigger the
 reboot, -no-reboot means we exit and so the guest never gets to try again.
 Eventually we want to get rid of CAS reboots entirely, since they're odd
 and irritating for the user.  But in the meantime we can fix the -no-reboot
 problem by using SHUTDOWN_CAUSE_SUBSYSTEM_RESET which ignores -no-reboot
 and seems to be designed for this sort of faux-reset for internal purposes
 only.
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit 9146206eb26c1436c80a7c2ca1e4c5f86b27179d)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1743477
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23395494
 Branch: rhel-av-8.1.0/master-4.1.0
 Testing: Started a guest and verified that -no-reboot no longer
          prevents the CAS reboot to negotiate XIVE support from
          completing
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_hcall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
 index 6808d4c..687bb7b 100644
 --- a/hw/ppc/spapr_hcall.c
 +++ b/hw/ppc/spapr_hcall.c
@@ -1672,7 +1672,7 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
     spapr_ovec_cleanup(ov5_updates);
     if (spapr->cas_reboot) {
 -        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +        qemu_system_reset_request(SHUTDOWN_CAUSE_SUBSYSTEM_RESET);
     }
     return H_SUCCESS;
 -- 
 1.8.3.1
--- a/kvm-spapr-pci-Consolidate-de-allocation-of-MSIs.patch
+++ b/kvm-spapr-pci-Consolidate-de-allocation-of-MSIs.patch
@ -1,103 +0,0 @@
 From b27062f4b3ddf47dea926026e5511f15d5b31320 Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Tue, 10 Sep 2019 07:04:27 +0100
 Subject: [PATCH 5/6] spapr/pci: Consolidate de-allocation of MSIs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190910070428.28628-2-dgibson@redhat.com>
 Patchwork-id: 90362
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 1/2] spapr/pci: Consolidate de-allocation of MSIs
 Bugzilla: 1750200
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 When freeing MSIs, we need to:
 - remove them from the machine's MSI bitmap
 - remove them from the IC backend
 - remove them from the PHB's MSI cache
 This is currently open coded in two places in rtas_ibm_change_msi(),
 and we're about to need this in spapr_phb_reset() as well. Instead of
 duplicating this code again, make it a destroy function for the PHB's
 MSI cache. Removing an MSI device from the cache will call the destroy
 function internally.
 Signed-off-by: Greg Kurz <groug@kaod.org>
 Message-Id: <156415227855.1064338.5657793835271464648.stgit@bahia.lan>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit 078eb6b05b7f962e43d8bc376e0b96cdd550c17a)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1750200
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_pci.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)
 diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
 index 9003fe9..1ffcfae 100644
 --- a/hw/ppc/spapr_pci.c
 +++ b/hw/ppc/spapr_pci.c
@@ -336,10 +336,6 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, SpaprMachineState *spapr,
             return;
         }
 -        if (!smc->legacy_irq_allocation) {
 -            spapr_irq_msi_free(spapr, msi->first_irq, msi->num);
 -        }
 -        spapr_irq_free(spapr, msi->first_irq, msi->num);
         if (msi_present(pdev)) {
             spapr_msi_setmsg(pdev, 0, false, 0, 0);
         }
@@ -409,10 +405,6 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, SpaprMachineState *spapr,
     /* Release previous MSIs */
     if (msi) {
 -        if (!smc->legacy_irq_allocation) {
 -            spapr_irq_msi_free(spapr, msi->first_irq, msi->num);
 -        }
 -        spapr_irq_free(spapr, msi->first_irq, msi->num);
         g_hash_table_remove(phb->msi, &config_addr);
     }
@@ -1806,6 +1798,19 @@ static void spapr_phb_unrealize(DeviceState *dev, Error **errp)
     memory_region_del_subregion(get_system_memory(), &sphb->mem32window);
 }
 +static void spapr_phb_destroy_msi(gpointer opaque)
 +{
 +    SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
 +    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
 +    spapr_pci_msi *msi = opaque;
 +
 +    if (!smc->legacy_irq_allocation) {
 +        spapr_irq_msi_free(spapr, msi->first_irq, msi->num);
 +    }
 +    spapr_irq_free(spapr, msi->first_irq, msi->num);
 +    g_free(msi);
 +}
 +
 static void spapr_phb_realize(DeviceState *dev, Error **errp)
 {
     /* We don't use SPAPR_MACHINE() in order to exit gracefully if the user
@@ -2017,7 +2022,8 @@ static void spapr_phb_realize(DeviceState *dev, Error **errp)
                                     spapr_tce_get_iommu(tcet));
     }
 -    sphb->msi = g_hash_table_new_full(g_int_hash, g_int_equal, g_free, g_free);
 +    sphb->msi = g_hash_table_new_full(g_int_hash, g_int_equal, g_free,
 +                                      spapr_phb_destroy_msi);
     return;
 unrealize:
 -- 
 1.8.3.1
--- a/kvm-spapr-pci-Free-MSIs-during-reset.patch
+++ b/kvm-spapr-pci-Free-MSIs-during-reset.patch
@ -1,56 +0,0 @@
 From 26879f41a890a93beabefebb19c399561013a615 Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Tue, 10 Sep 2019 07:04:28 +0100
 Subject: [PATCH 6/6] spapr/pci: Free MSIs during reset
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190910070428.28628-3-dgibson@redhat.com>
 Patchwork-id: 90363
 O-Subject: [RHEL-AV-8.1 qemu-kvm PATCH 2/2] spapr/pci: Free MSIs during reset
 Bugzilla: 1750200
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 When the machine is reset, the MSI bitmap is cleared but the allocated
 MSIs are not freed. Some operating systems, such as AIX, can detect the
 previous configuration and assert.
 Empty the MSI cache, this performs the needed cleanup.
 Signed-off-by: Greg Kurz <groug@kaod.org>
 Message-Id: <156415228410.1064338.4486161194061636096.stgit@bahia.lan>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit ea52074d3a1c5fbe70f3014dc1b1f2e7d5ced5de)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1750200
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_pci.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
 index 1ffcfae..128c981 100644
 --- a/hw/ppc/spapr_pci.c
 +++ b/hw/ppc/spapr_pci.c
@@ -2078,6 +2078,8 @@ static void spapr_phb_reset(DeviceState *qdev)
     if (spapr_phb_eeh_available(SPAPR_PCI_HOST_BRIDGE(qdev))) {
         spapr_phb_vfio_reset(qdev);
     }
 +
 +    g_hash_table_remove_all(sphb->msi);
 }
 static Property spapr_phb_properties[] = {
 -- 
 1.8.3.1
--- a/kvm-spapr-xive-Mask-the-EAS-when-allocating-an-IRQ.patch
+++ b/kvm-spapr-xive-Mask-the-EAS-when-allocating-an-IRQ.patch
@ -1,63 +0,0 @@
 From 6a7245ed7802dff5479228376a4119e095db33b2 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 11 Sep 2019 09:43:17 +0100
 Subject: [PATCH 1/4] spapr/xive: Mask the EAS when allocating an IRQ
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 Message-id: <20190911094317.21266-1-lvivier@redhat.com>
 Patchwork-id: 90392
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH] spapr/xive: Mask the EAS when allocating an IRQ
 Bugzilla: 1748725
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 From: Cédric Le Goater <clg@kaod.org>
 If an IRQ is allocated and not configured, such as a MSI requested by
 a PCI driver, it can be saved in its default state and possibly later
 on restored using the same state. If not initially MASKED, KVM will
 try to find a matching priority/target tuple for the interrupt and
 fail to restore the VM because 0/0 is not a valid target.
 When allocating a IRQ number, the EAS should be set to a sane default :
 VALID and MASKED.
 Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20190813164420.9829-1-clg@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit f55750e4e4fb35b6a12c81c485f16494e2c61ad2)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1748725
 BRANCH: rhel-av-8.1.0/master-4.1.0
 UPSTREAM: merged
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23451934
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/intc/spapr_xive.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
 index 3ae311d..1f9c624 100644
 --- a/hw/intc/spapr_xive.c
 +++ b/hw/intc/spapr_xive.c
@@ -534,7 +534,10 @@ bool spapr_xive_irq_claim(SpaprXive *xive, uint32_t lisn, bool lsi)
         return false;
     }
 -    xive->eat[lisn].w |= cpu_to_be64(EAS_VALID);
 +    /*
 +     * Set default values when allocating an IRQ number
 +     */
 +    xive->eat[lisn].w |= cpu_to_be64(EAS_VALID | EAS_MASKED);
     if (lsi) {
         xive_source_irq_set_lsi(xsrc, lisn);
     }
 -- 
 1.8.3.1
--- a/kvm-spapr-xive-skip-partially-initialized-vCPUs-in-prese.patch
+++ b/kvm-spapr-xive-skip-partially-initialized-vCPUs-in-prese.patch
@ -1,65 +0,0 @@
 From 3a7d0411addca79192ed60939f55ec019c27a72a Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Tue, 8 Oct 2019 05:08:36 +0100
 Subject: [PATCH 4/6] spapr/xive: skip partially initialized vCPUs in presenter
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20191008050836.11479-1-dgibson@redhat.com>
 Patchwork-id: 90994
 O-Subject: [RHEL-AV-8.1.1 qemu-kvm PATCH] spapr/xive: skip partially initialized vCPUs in presenter
 Bugzilla: 1754710
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 From: Cédric Le Goater <clg@kaod.org>
 When vCPUs are hotplugged, they are added to the QEMU CPU list before
 being fully realized. This can crash the XIVE presenter because the
 'tctx' pointer is not necessarily initialized when looking for a
 matching target.
 These vCPUs are not valid targets for the presenter. Skip them.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20191001085722.32755-1-clg@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 Reviewed-by: Greg Kurz <groug@kaod.org>
 (cherry picked from commit 627fa61746f70f7c799f08e9048bb6a482402138)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1754710
 Branch: rhel-av-8.1.1
 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=23900462
 Testing: Could no longer reproduce bug with brewed qemu
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/intc/xive.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/hw/intc/xive.c b/hw/intc/xive.c
 index da148e9..8f639f6 100644
 --- a/hw/intc/xive.c
 +++ b/hw/intc/xive.c
@@ -1345,6 +1345,14 @@ static bool xive_presenter_match(XiveRouter *xrtr, uint8_t format,
         int ring;
         /*
 +         * Skip partially initialized vCPUs. This can happen when
 +         * vCPUs are hotplugged.
 +         */
 +        if (!tctx) {
 +            continue;
 +        }
 +
 +        /*
          * HW checks that the CPU is enabled in the Physical Thread
          * Enable Register (PTER).
          */
 -- 
 1.8.3.1
--- a/kvm-tests-Use-iothreads-during-iotest-223.patch
+++ b/kvm-tests-Use-iothreads-during-iotest-223.patch
@ -1,73 +0,0 @@
 From c03d23733166328e70f98504d7dfaa528e889633 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 9 Oct 2019 14:10:08 +0100
 Subject: [PATCH 6/6] tests: Use iothreads during iotest 223
 RH-Author: Eric Blake <eblake@redhat.com>
 Message-id: <20191009141008.24439-3-eblake@redhat.com>
 Patchwork-id: 91355
 O-Subject: [RHEL-AV-8.1.1 qemu-kvm PATCH 2/2] tests: Use iothreads during iotest 223
 Bugzilla: 1741094
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 Doing so catches the bugs we just fixed with NBD not properly using
 correct contexts.
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20190920220729.31801-1-eblake@redhat.com>
 (cherry picked from commit 506902c6fa80210b002e30ff33794bfc718b15c6)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 tests/qemu-iotests/223     | 6 ++++--
 tests/qemu-iotests/223.out | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)
 diff --git a/tests/qemu-iotests/223 b/tests/qemu-iotests/223
 index cc48e78..2ba3d81 100755
 --- a/tests/qemu-iotests/223
 +++ b/tests/qemu-iotests/223
@@ -2,7 +2,7 @@
 #
 # Test reading dirty bitmap over NBD
 #
 -# Copyright (C) 2018 Red Hat, Inc.
 +# Copyright (C) 2018-2019 Red Hat, Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -109,7 +109,7 @@ echo
 echo "=== End dirty bitmaps, and start serving image over NBD ==="
 echo
 -_launch_qemu 2> >(_filter_nbd)
 +_launch_qemu -object iothread,id=io0 2> >(_filter_nbd)
 # Intentionally provoke some errors as well, to check error handling
 silent=
@@ -117,6 +117,8 @@ _send_qemu_cmd $QEMU_HANDLE '{"execute":"qmp_capabilities"}' "return"
 _send_qemu_cmd $QEMU_HANDLE '{"execute":"blockdev-add",
   "arguments":{"driver":"qcow2", "node-name":"n",
     "file":{"driver":"file", "filename":"'"$TEST_IMG"'"}}}' "return"
 +_send_qemu_cmd $QEMU_HANDLE '{"execute":"x-blockdev-set-iothread",
 +  "arguments":{"node-name":"n", "iothread":"io0"}}' "return"
 _send_qemu_cmd $QEMU_HANDLE '{"execute":"block-dirty-bitmap-disable",
   "arguments":{"node":"n", "name":"b"}}' "return"
 _send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-add",
 diff --git a/tests/qemu-iotests/223.out b/tests/qemu-iotests/223.out
 index d5201b2..90cc4b6 100644
 --- a/tests/qemu-iotests/223.out
 +++ b/tests/qemu-iotests/223.out
@@ -27,6 +27,7 @@ wrote 2097152/2097152 bytes at offset 2097152
 {"return": {}}
 {"return": {}}
 {"return": {}}
 +{"return": {}}
 {"error": {"class": "GenericError", "desc": "NBD server not running"}}
 {"return": {}}
 {"error": {"class": "GenericError", "desc": "NBD server already running"}}
 -- 
 1.8.3.1
--- a/kvm-trace-Clarify-DTrace-SystemTap-help-message.patch
+++ b/kvm-trace-Clarify-DTrace-SystemTap-help-message.patch
@ -1,80 +0,0 @@
 From 5d45e3a5d2e2d929095489a37579c3b7fc059450 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Tue, 3 Sep 2019 14:21:10 +0100
 Subject: [PATCH 1/8] trace: Clarify DTrace/SystemTap help message
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: <20190903142110.25673-2-philmd@redhat.com>
 Patchwork-id: 90255
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/1] trace: Clarify DTrace/SystemTap help message
 Bugzilla: 1516220
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 Most tracing backends are implemented within QEMU, except the
 DTrace/SystemTap backends.
 One side effect is when running 'qemu -trace help', an incomplete
 list of trace events is displayed when using the DTrace/SystemTap
 backends.
 This is partly due to trace events registered as modules with
 trace_init(), and since the events are not used within QEMU,
 the linker optimize and remove the unused modules (which is
 OK in this particular case).
 Currently only the events compiled in trace-root.o and in the
 last trace.o member of libqemuutil.a are linked, resulting in
 an incomplete list of events.
 To avoid confusion, improve the help message, recommending to
 use the proper systemtap script to display the events list.
 Before:
  $ lm32-softmmu/qemu-system-lm32 -trace help 2>&1 | wc -l
  70
 After:
  $ lm32-softmmu/qemu-system-lm32 -trace help
  Run 'qemu-trace-stap list qemu-system-lm32' to print a list
  of names of trace points with the DTrace/SystemTap backends.
  $ qemu-trace-stap list qemu-system-lm32 | wc -l
  1136
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190823142203.5210-1-philmd@redhat.com
 Message-Id: <20190823142203.5210-1-philmd@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit 9f591a5d95e1969969632ab44cf35e505c8ddc3b)
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 trace/control.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/trace/control.c b/trace/control.c
 index 43fb786..d9cafc1 100644
 --- a/trace/control.c
 +++ b/trace/control.c
@@ -165,6 +165,12 @@ void trace_list_events(void)
     while ((ev = trace_event_iter_next(&iter)) != NULL) {
         fprintf(stderr, "%s\n", trace_event_get_name(ev));
     }
 +#ifdef CONFIG_TRACE_DTRACE
 +    fprintf(stderr, "This list of names of trace points may be incomplete "
 +                    "when using the DTrace/SystemTap backends.\n"
 +                    "Run 'qemu-trace-stap list %s' to print the full list.\n",
 +            error_get_progname());
 +#endif
 }
 static void do_trace_enable_events(const char *line_buf)
 -- 
 1.8.3.1
--- a/kvm-virtio-Make-disable-legacy-disable-modern-compat-pro.patch
+++ b/kvm-virtio-Make-disable-legacy-disable-modern-compat-pro.patch
@ -1,48 +0,0 @@
 From ca4a5e85de406a495512d544c3b2187ac3654e97 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Thu, 1 Aug 2019 10:26:47 +0100
 Subject: [PATCH 6/6] virtio: Make disable-legacy/disable-modern compat
 properties optional
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190801102647.14173-1-dgilbert@redhat.com>
 Patchwork-id: 89849
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 6/5] virtio: Make disable-legacy/disable-modern compat properties optional
 Bugzilla: 1719649
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Upstream 53921bfdce3 by Eduardo made some hw_compat_2_6 entries optional
 to fix a bug where non-transitional devices failed to be created on
 old upstream machine types.  Do the same fix to our old downstream
 machines.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/core/machine.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index e2f812a..c796b54 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -152,8 +152,9 @@ GlobalProperty hw_compat_rhel_7_2[] = {
         { "fw_cfg_mem", "dma_enabled", "off" },
         { "fw_cfg_io", "dma_enabled", "off" },
         { "isa-fdc", "fallback", "144" },
 -        { "virtio-pci", "disable-modern", "on" },
 -        { "virtio-pci", "disable-legacy", "off" },
 +        /* Optional because not all virtio-pci devices support legacy mode */
 +        { "virtio-pci", "disable-modern", "on", .optional = true },
 +        { "virtio-pci", "disable-legacy", "off", .optional = true },
         { TYPE_PCI_DEVICE, "x-pcie-lnksta-dllla", "off" },
         { "virtio-pci", "page-per-vq", "on" },
         /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
 -- 
 1.8.3.1
--- a/kvm-virtio-blk-Cancel-the-pending-BH-when-the-dataplane-.patch
+++ b/kvm-virtio-blk-Cancel-the-pending-BH-when-the-dataplane-.patch
@ -1,92 +0,0 @@
 From df7d91dda24b27c89ff8ce1b9cc72c7ed7350be2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Fri, 13 Sep 2019 14:16:25 +0100
 Subject: [PATCH 3/4] virtio-blk: Cancel the pending BH when the dataplane is
 reset
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: <20190913141625.12521-2-philmd@redhat.com>
 Patchwork-id: 90453
 O-Subject: [RHEL-7.7.z qemu-kvm-rhev + RHEL-8.1.0 qemu-kvm + RHEL-AV-8.1.0 qemu-kvm PATCH v2 1/1] virtio-blk: Cancel the pending BH when the dataplane is reset
 Bugzilla: 1717321
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 When 'system_reset' is called, the main loop clear the memory
 region cache before the BH has a chance to execute. Later when
 the deferred function is called, some assumptions that were
 made when scheduling them are no longer true when they actually
 execute.
 This is what happens using a virtio-blk device (fresh RHEL7.8 install):
 $ (sleep 12.3; echo system_reset; sleep 12.3; echo system_reset; sleep 1; echo q) \
   | qemu-system-x86_64 -m 4G -smp 8 -boot menu=on \
     -device virtio-blk-pci,id=image1,drive=drive_image1 \
     -drive file=/var/lib/libvirt/images/rhel78.qcow2,if=none,id=drive_image1,format=qcow2,cache=none \
     -device virtio-net-pci,netdev=net0,id=nic0,mac=52:54:00:c4:e7:84 \
     -netdev tap,id=net0,script=/bin/true,downscript=/bin/true,vhost=on \
     -monitor stdio -serial null -nographic
  (qemu) system_reset
  (qemu) system_reset
  (qemu) qemu-system-x86_64: hw/virtio/virtio.c:225: vring_get_region_caches: Assertion `caches != NULL' failed.
  Aborted
  (gdb) bt
  Thread 1 (Thread 0x7f109c17b680 (LWP 10939)):
  #0  0x00005604083296d1 in vring_get_region_caches (vq=0x56040a24bdd0) at hw/virtio/virtio.c:227
  #1  0x000056040832972b in vring_avail_flags (vq=0x56040a24bdd0) at hw/virtio/virtio.c:235
  #2  0x000056040832d13d in virtio_should_notify (vdev=0x56040a240630, vq=0x56040a24bdd0) at hw/virtio/virtio.c:1648
  #3  0x000056040832d1f8 in virtio_notify_irqfd (vdev=0x56040a240630, vq=0x56040a24bdd0) at hw/virtio/virtio.c:1662
  #4  0x00005604082d213d in notify_guest_bh (opaque=0x56040a243ec0) at hw/block/dataplane/virtio-blk.c:75
  #5  0x000056040883dc35 in aio_bh_call (bh=0x56040a243f10) at util/async.c:90
  #6  0x000056040883dccd in aio_bh_poll (ctx=0x560409161980) at util/async.c:118
  #7  0x0000560408842af7 in aio_dispatch (ctx=0x560409161980) at util/aio-posix.c:460
  #8  0x000056040883e068 in aio_ctx_dispatch (source=0x560409161980, callback=0x0, user_data=0x0) at util/async.c:261
  #9  0x00007f10a8fca06d in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
  #10 0x0000560408841445 in glib_pollfds_poll () at util/main-loop.c:215
  #11 0x00005604088414bf in os_host_main_loop_wait (timeout=0) at util/main-loop.c:238
  #12 0x00005604088415c4 in main_loop_wait (nonblocking=0) at util/main-loop.c:514
  #13 0x0000560408416b1e in main_loop () at vl.c:1923
  #14 0x000056040841e0e8 in main (argc=20, argv=0x7ffc2c3f9c58, envp=0x7ffc2c3f9d00) at vl.c:4578
 Fix this by cancelling the BH when the virtio dataplane is stopped.
 [This is version of the patch was modified as discussed with Philippe on
 the mailing list thread.
 --Stefan]
 Reported-by: Yihuang Yu <yihyu@redhat.com>
 Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
 Fixes: https://bugs.launchpad.net/qemu/+bug/1839428
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-Id: <20190816171503.24761-1-philmd@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit ebb6ff25cd888a52a64a9adc3692541c6d1d9a42)
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/block/dataplane/virtio-blk.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
 index 158c78f..5fea76d 100644
 --- a/hw/block/dataplane/virtio-blk.c
 +++ b/hw/block/dataplane/virtio-blk.c
@@ -297,6 +297,9 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
         virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
     }
 +    qemu_bh_cancel(s->bh);
 +    notify_guest_bh(s); /* final chance to notify guest */
 +
     /* Clean up guest notifier (irq) */
     k->set_guest_notifiers(qbus->parent, nvqs, false);
 -- 
 1.8.3.1
--- a/kvm-virtio-blk-schedule-virtio_notify_config-to-run-on-m.patch
+++ b/kvm-virtio-blk-schedule-virtio_notify_config-to-run-on-m.patch
@ -1,91 +0,0 @@
 From 6b292920dbdd463bb80b82bef2063623a8e2da17 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Fri, 27 Sep 2019 11:46:41 +0100
 Subject: [PATCH 2/2] virtio-blk: schedule virtio_notify_config to run on main
 context
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Sergio Lopez Pascual <slp@redhat.com>
 Message-id: <20190927114641.20992-2-slp@redhat.com>
 Patchwork-id: 90907
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/1] virtio-blk: schedule virtio_notify_config to run on main context
 Bugzilla: 1744955
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 virtio_notify_config() needs to acquire the global mutex, which isn't
 allowed from an iothread, and may lead to a deadlock like this:
 - main thead
  * Has acquired: qemu_global_mutex.
  * Is trying the acquire: iothread AioContext lock via
    AIO_WAIT_WHILE (after aio_poll).
 - iothread
  * Has acquired: AioContext lock.
  * Is trying to acquire: qemu_global_mutex (via
    virtio_notify_config->prepare_mmio_access).
 If virtio_blk_resize() is called from an iothread, schedule
 virtio_notify_config() to be run in the main context BH.
 [Removed unnecessary newline as suggested by Kevin Wolf
 <kwolf@redhat.com>.
 --Stefan]
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-id: 20190916112411.21636-1-slp@redhat.com
 Message-Id: <20190916112411.21636-1-slp@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit f9a7e3698a737ee75a7b0af34203303df982550f)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/block/virtio-blk.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)
 diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index cbb3729..0d9adcd 100644
 --- a/hw/block/virtio-blk.c
 +++ b/hw/block/virtio-blk.c
@@ -16,6 +16,7 @@
 #include "qemu/iov.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 +#include "qemu/main-loop.h"
 #include "trace.h"
 #include "hw/block/block.h"
 #include "sysemu/blockdev.h"
@@ -1082,11 +1083,24 @@ static int virtio_blk_load_device(VirtIODevice *vdev, QEMUFile *f,
     return 0;
 }
 +static void virtio_resize_cb(void *opaque)
 +{
 +    VirtIODevice *vdev = opaque;
 +
 +    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
 +    virtio_notify_config(vdev);
 +}
 +
 static void virtio_blk_resize(void *opaque)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
 -    virtio_notify_config(vdev);
 +    /*
 +     * virtio_notify_config() needs to acquire the global mutex,
 +     * so it can't be called from an iothread. Instead, schedule
 +     * it to be run in the main context BH.
 +     */
 +    aio_bh_schedule_oneshot(qemu_get_aio_context(), virtio_resize_cb, vdev);
 }
 static const BlockDevOps virtio_block_ops = {
 -- 
 1.8.3.1
--- a/kvm-x86-machine-types-Fixup-dynamic-sysbus-entries.patch
+++ b/kvm-x86-machine-types-Fixup-dynamic-sysbus-entries.patch
@ -1,60 +0,0 @@
 From 6df1559af7cd65e3faf7c61a2bb8f02667767ad6 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 31 Jul 2019 15:08:12 +0100
 Subject: [PATCH 3/6] x86 machine types: Fixup dynamic sysbus entries
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190731150814.29571-4-dgilbert@redhat.com>
 Patchwork-id: 89814
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 3/5] x86 machine types: Fixup dynamic sysbus entries
 Bugzilla: 1719649
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 We're missing a couple of upstream changes, add them for
 consistency:
   v2.11.0-824-gef18310d54   Shouldn't have any effect
   v2.12.0-1411-g94692dcd71  Should allow us to use RAMFB if we enable
                             it
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc_piix.c | 1 +
 hw/i386/pc_q35.c  | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index c86c48c..3b9ba95 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1037,6 +1037,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
     pcmc->default_nic_model = "e1000";
     m->default_display = "std";
     m->no_parallel = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
     m->alias = "pc";
     m->is_default = 1;
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 068813d..edf8e54 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -554,7 +554,9 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     m->default_display = "std";
     m->no_floppy = 1;
     m->no_parallel = 1;
 -    machine_class_allow_dynamic_sysbus_dev(m, TYPE_SYS_BUS_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
     m->alias = "q35";
     m->max_cpus = 384;
     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 -- 
 1.8.3.1
--- a/kvm-x86-machine-types-add-pc-q35-rhel8.1.0.patch
+++ b/kvm-x86-machine-types-add-pc-q35-rhel8.1.0.patch
@ -1,103 +0,0 @@
 From 0784125ba3ccd72a590d210cf3f52d80e96b4263 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 31 Jul 2019 15:08:13 +0100
 Subject: [PATCH 4/6] x86 machine types: add pc-q35-rhel8.1.0
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190731150814.29571-5-dgilbert@redhat.com>
 Patchwork-id: 89813
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 4/5] x86 machine types: add pc-q35-rhel8.1.0
 Bugzilla: 1719649
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Create the 8.1.0 machine type for q35 and update the _options
 functions to keep compatibility.
 Note:
   We don't have to copy the kernel_irqchip_split from 4_0 since it
   immediately got reverted in 4_0_1
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc_piix.c |  6 ++++++
 hw/i386/pc_q35.c  | 24 +++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 3b9ba95..bf6b444 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1051,9 +1051,15 @@ static void pc_init_rhel760(MachineState *machine)
 static void pc_machine_rhel760_options(MachineClass *m)
 {
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     pc_machine_rhel7_options(m);
     m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
     m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
     compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 }
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index edf8e54..b6d0bb3 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -554,6 +554,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     m->default_display = "std";
     m->no_floppy = 1;
     m->no_parallel = 1;
 +    pcmc->default_cpu_version = 1;
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
@@ -562,6 +563,20 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 }
 +static void pc_q35_init_rhel810(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
 +                  pc_q35_machine_rhel810_options);
 +
 static void pc_q35_init_rhel800(MachineState *machine)
 {
     pc_q35_init(machine);
@@ -569,8 +584,15 @@ static void pc_q35_init_rhel800(MachineState *machine)
 static void pc_q35_machine_rhel800_options(MachineClass *m)
 {
 -    pc_q35_machine_rhel_options(m);
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel810_options(m);
     m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 }
 DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
 -- 
 1.8.3.1
--- a/kvm-x86-machine-types-pc_rhel_8_0_compat.patch
+++ b/kvm-x86-machine-types-pc_rhel_8_0_compat.patch
@ -1,88 +0,0 @@
 From e42808c29bdcebe62cdb5cdb1de4dc0910dd21d9 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 31 Jul 2019 15:08:10 +0100
 Subject: [PATCH 1/6] x86 machine types: pc_rhel_8_0_compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190731150814.29571-2-dgilbert@redhat.com>
 Patchwork-id: 89816
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 1/5] x86 machine types: pc_rhel_8_0_compat
 Bugzilla: 1719649
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Create the pc_rhel_8_0_compat array based off pc_compat_3_1.
 It's the same except for a chunk of mpx=on entries that
 we already put in the pc_rhel_7_6_compat.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc.c         | 33 +++++++++++++++++++++++++++++++++
 include/hw/i386/pc.h |  3 +++
 2 files changed, 36 insertions(+)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index b3d2d1e..f19fed4 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -366,6 +366,39 @@ GlobalProperty pc_rhel_compat[] = {
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_8_0_compat[] = {
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "intel-iommu", "dma-drain", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
 +};
 +const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
 +
 /* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
  * all of the 2_12 stuff was already in 7.6 from bz 1481253
  * x-migrate-smi-count comes from PC_COMPAT_2_11 but
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 605cc71..2f24333 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -368,6 +368,9 @@ extern const size_t pc_compat_1_4_len;
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_8_0_compat[];
 +extern const size_t pc_rhel_8_0_compat_len;
 +
 extern GlobalProperty pc_rhel_7_6_compat[];
 extern const size_t pc_rhel_7_6_compat_len;
 -- 
 1.8.3.1
--- a/kvm-x86-machine-types-q35-Fixup-units_per_default_bus.patch
+++ b/kvm-x86-machine-types-q35-Fixup-units_per_default_bus.patch
@ -1,57 +0,0 @@
 From 9de83a880cf0e397db7c8bfdbf009f137c8eaf8a Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 31 Jul 2019 15:08:11 +0100
 Subject: [PATCH 2/6] x86 machine types: q35: Fixup units_per_default_bus
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: <20190731150814.29571-3-dgilbert@redhat.com>
 Patchwork-id: 89818
 O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH v3 2/5] x86 machine types: q35: Fixup units_per_default_bus
 Bugzilla: 1719649
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 x86 machine types: q35: Fixup units_per_default_bus
 We omitted the line:
   m->units_per_default_bus = 1;
 in our rebase from 2.1.2 (which doesn't have ->units_per_default_bus)
 to 2.3.0 (which does).  Specifically, in commit ed6d215ef93.
 It's safe for us to add, because:
   a) It changes the behaviour when you don't specify a bus/device
      number, however libvirt always specifies it, so it's always
      safe downstream for us with libvirt which we require.
   b) The behaviour change isn't actually seen by the guest.  i.e.
     the change from having two SATA devices from:
         ide0-hd0, ide0-hd1
      to
         ide0-hd0, ide1-hd0
     is hidden because by the time it gets through the SATA code
     it ends up back as two single SATA devices on their own bus.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/i386/pc_q35.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 4959ed3..068813d 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -549,6 +549,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     pcmc->default_nic_model = "e1000e";
     m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
     m->default_machine_opts = "firmware=bios-256k.bin";
     m->default_display = "std";
     m->no_floppy = 1;
 -- 
 1.8.3.1
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -1,5 +1,6 @@
 %global SLOF_gittagdate 20170724
 %global SLOF_gittagcommit 89f519f
 %global rcversion -rc1
 %global have_usbredir 1
 %global have_spice    1
@ -66,8 +67,8 @@ Obsoletes: %1-rhev
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
-Version: 4.1.0
+Version: 4.2.0
-Release: 14%{?dist}
+Release: 0%{?dist}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 Epoch: 15
 License: GPLv2 and GPLv2+ and CC-BY
@ -76,7 +77,7 @@ URL: http://www.qemu.org/
 ExclusiveArch: x86_64 %{power64} aarch64 s390x
-Source0: http://wiki.qemu.org/download/qemu-4.1.0.tar.xz
+Source0: http://wiki.qemu.org/download/qemu-4.2.0-rc1.tar.xz
 # KSM control scripts
 Source4: ksm.service
@ -104,134 +105,23 @@ Source35: udev-kvm-check.c
 Source36: README.tests
-Patch0004: 0004-Initial-redhat-build.patch
+Patch0005: 0005-Initial-redhat-build.patch
-Patch0005: 0005-Enable-disable-devices-for-RHEL.patch
+Patch0006: 0006-Enable-disable-devices-for-RHEL.patch
-Patch0006: 0006-Machine-type-related-general-changes.patch
+Patch0007: 0007-Machine-type-related-general-changes.patch
-Patch0007: 0007-Add-aarch64-machine-types.patch
+Patch0008: 0008-Add-aarch64-machine-types.patch
-Patch0008: 0008-Add-ppc64-machine-types.patch
+Patch0009: 0009-Add-ppc64-machine-types.patch
-Patch0009: 0009-Add-s390x-machine-types.patch
+Patch0010: 0010-Add-s390x-machine-types.patch
-Patch0010: 0010-Add-x86_64-machine-types.patch
+Patch0011: 0011-Add-x86_64-machine-types.patch
-Patch0011: 0011-Enable-make-check.patch
+Patch0012: 0012-Enable-make-check.patch
-Patch0012: 0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+Patch0013: 0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
-Patch0013: 0013-Add-support-statement-to-help-output.patch
+Patch0014: 0014-Add-support-statement-to-help-output.patch
-Patch0014: 0014-globally-limit-the-maximum-number-of-CPUs.patch
+Patch0015: 0015-globally-limit-the-maximum-number-of-CPUs.patch
-Patch0015: 0015-Add-support-for-simpletrace.patch
+Patch0016: 0016-Add-support-for-simpletrace.patch
-Patch0016: 0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+Patch0017: 0017-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
-Patch0017: 0017-usb-xhci-Fix-PCI-capability-order.patch
+Patch0018: 0018-usb-xhci-Fix-PCI-capability-order.patch
-Patch0018: 0018-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+Patch0019: 0019-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
-Patch0019: 0019-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+Patch0020: 0020-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
-Patch0020: 0020-pc-Don-t-make-die-id-mandatory-unless-necessary.patch
+Patch0021: 0021-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch21: kvm-x86-machine-types-pc_rhel_8_0_compat.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch22: kvm-x86-machine-types-q35-Fixup-units_per_default_bus.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch23: kvm-x86-machine-types-Fixup-dynamic-sysbus-entries.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch24: kvm-x86-machine-types-add-pc-q35-rhel8.1.0.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch25: kvm-machine-types-Update-hw_compat_rhel_8_0-from-hw_comp.patch
 # For bz#1719649 - 8.1 machine type for x86
 Patch26: kvm-virtio-Make-disable-legacy-disable-modern-compat-pro.patch
 # For bz#1738626 - Disable memfd in QEMU
 # For bz#1740797 - Disable memfd in QEMU
 Patch27: kvm-RHEL-disable-hostmem-memfd.patch
 # For bz#1693772 - [IBM zKVM] RHEL AV 8.1.0 machine type update for s390x
 Patch28: kvm-redhat-s390x-Rename-s390-ccw-virtio-rhel8.0.0-to-s39.patch
 # For bz#1693772 - [IBM zKVM] RHEL AV 8.1.0 machine type update for s390x
 Patch29: kvm-redhat-s390x-Add-proper-compatibility-options-for-th.patch
 # For bz#1744170 - [IBM Power] New 8.1.0 machine type for pseries
 Patch31: kvm-redhat-update-pseries-rhel8.1.0-machine-type.patch
 # For bz#1743142 - Boot guest with multiple e1000 devices, qemu will crash after several guest reboots: kvm_mem_ioeventfd_add: error adding ioeventfd: No space left on device (28)
 Patch32: kvm-memory-Refactor-memory_region_clear_coalescing.patch
 # For bz#1743142 - Boot guest with multiple e1000 devices, qemu will crash after several guest reboots: kvm_mem_ioeventfd_add: error adding ioeventfd: No space left on device (28)
 Patch33: kvm-memory-Split-zones-when-do-coalesced_io_del.patch
 # For bz#1743142 - Boot guest with multiple e1000 devices, qemu will crash after several guest reboots: kvm_mem_ioeventfd_add: error adding ioeventfd: No space left on device (28)
 Patch34: kvm-memory-Remove-has_coalesced_range-counter.patch
 # For bz#1743142 - Boot guest with multiple e1000 devices, qemu will crash after several guest reboots: kvm_mem_ioeventfd_add: error adding ioeventfd: No space left on device (28)
 Patch35: kvm-memory-Fix-up-memory_region_-add-del-_coalescing.patch
 # For bz#1516220 - -trace help prints an incomplete list of trace events
 Patch36: kvm-trace-Clarify-DTrace-SystemTap-help-message.patch
 # For bz#1726898 - Parallel migration fails with error "Unable to write to socket: Connection reset by peer" now and then
 Patch37: kvm-socket-Add-backlog-parameter-to-socket_listen.patch
 # For bz#1726898 - Parallel migration fails with error "Unable to write to socket: Connection reset by peer" now and then
 Patch38: kvm-socket-Add-num-connections-to-qio_channel_socket_syn.patch
 # For bz#1726898 - Parallel migration fails with error "Unable to write to socket: Connection reset by peer" now and then
 Patch39: kvm-socket-Add-num-connections-to-qio_channel_socket_asy.patch
 # For bz#1726898 - Parallel migration fails with error "Unable to write to socket: Connection reset by peer" now and then
 Patch40: kvm-socket-Add-num-connections-to-qio_net_listener_open_.patch
 # For bz#1726898 - Parallel migration fails with error "Unable to write to socket: Connection reset by peer" now and then
 Patch41: kvm-multifd-Use-number-of-channels-as-listen-backlog.patch
 # For bz#1744107 - Migration from P8(qemu4.1) to P9(qemu4.1), after migration, qemu crash on destination with error message "qemu-kvm: error while loading state for instance 0x1 of device 'cpu'"
 Patch42: kvm-pseries-Fix-compat_pvr-on-reset.patch
 # For bz#1744107 - Migration from P8(qemu4.1) to P9(qemu4.1), after migration, qemu crash on destination with error message "qemu-kvm: error while loading state for instance 0x1 of device 'cpu'"
 Patch43: kvm-spapr-Set-compat-mode-in-spapr_core_plug.patch
 # For bz#1747836 - Call traces after guest migration due to incorrect handling of the timebase
 Patch44: kvm-migration-Do-not-re-read-the-clock-on-pre_save-in-ca.patch
 # For bz#1746790 - qemu core dump while migrate from RHEL7.6 to RHEL8.1
 Patch45: kvm-ehci-fix-queue-dev-null-ptr-dereference.patch
 # For bz#1743477 - Since bd94bc06479a "spapr: change default interrupt mode to 'dual'", QEMU resets the machine to select the appropriate interrupt controller. And -no-reboot prevents that.
 Patch46: kvm-spapr-Use-SHUTDOWN_CAUSE_SUBSYSTEM_RESET-for-CAS-reb.patch
 # For bz#1749134 - I/O error when virtio-blk disk is backed by a raw image on 4k disk
 Patch47: kvm-file-posix-Handle-undetectable-alignment.patch
 # For bz#1749134 - I/O error when virtio-blk disk is backed by a raw image on 4k disk
 Patch48: kvm-block-posix-Always-allocate-the-first-block.patch
 # For bz#1749134 - I/O error when virtio-blk disk is backed by a raw image on 4k disk
 Patch49: kvm-iotests-Test-allocate_first_block-with-O_DIRECT.patch
 # For bz#1734316 - multifd migration does not honour speed limits, consumes entire bandwidth of NIC
 Patch50: kvm-migration-always-initialise-ram_counters-for-a-new-m.patch
 # For bz#1734316 - multifd migration does not honour speed limits, consumes entire bandwidth of NIC
 Patch51: kvm-migration-add-qemu_file_update_transfer-interface.patch
 # For bz#1734316 - multifd migration does not honour speed limits, consumes entire bandwidth of NIC
 Patch52: kvm-migration-add-speed-limit-for-multifd-migration.patch
 # For bz#1734316 - multifd migration does not honour speed limits, consumes entire bandwidth of NIC
 Patch53: kvm-migration-update-ram_counters-for-multifd-sync-packe.patch
 # For bz#1750200 - [RHEL8.1][QEMU4.1]boot up guest with vf device,then system_reset guest,error prompt(qemu-kvm: Can't allocate MSIs for device 2800: IRQ 4904 is not free)
 Patch54: kvm-spapr-pci-Consolidate-de-allocation-of-MSIs.patch
 # For bz#1750200 - [RHEL8.1][QEMU4.1]boot up guest with vf device,then system_reset guest,error prompt(qemu-kvm: Can't allocate MSIs for device 2800: IRQ 4904 is not free)
 Patch55: kvm-spapr-pci-Free-MSIs-during-reset.patch
 # For bz#1748725 - [ppc][migration][v6.3-rc1-p1ce8930]basic migration failed with "qemu-kvm: KVM_SET_DEVICE_ATTR failed: Group 3 attr 0x0000000000001309: Device or resource busy"
 Patch56: kvm-spapr-xive-Mask-the-EAS-when-allocating-an-IRQ.patch
 # For bz#1746267 - qemu coredump: qemu-kvm: block/create.c:68: qmp_blockdev_create: Assertion `drv' failed
 Patch57: kvm-block-create-Do-not-abort-if-a-block-driver-is-not-a.patch
 # For bz#1717321 - qemu-kvm core dumped when repeat "system_reset" multiple times during guest boot
 Patch58: kvm-virtio-blk-Cancel-the-pending-BH-when-the-dataplane-.patch
 # For bz#1749737 - CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-av-8]
 Patch59: kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch
 # For bz#1746631 - Qemu core dump when do block commit under stress
 Patch60: kvm-blockjob-update-nodes-head-while-removing-all-bdrv.patch
 # For bz#1724008 - QEMU core dumped "memory_region_get_ram_ptr: Assertion `mr->ram_block' failed"
 # For bz#1736788 - QEMU core dumped if boot guest with nvdimm backed by /dev/dax0.0 and option pmem=off
 Patch61: kvm-hostmem-file-fix-pmem-file-size-check.patch
 # For bz#1724008 - QEMU core dumped "memory_region_get_ram_ptr: Assertion `mr->ram_block' failed"
 # For bz#1736788 - QEMU core dumped if boot guest with nvdimm backed by /dev/dax0.0 and option pmem=off
 Patch62: kvm-memory-fetch-pmem-size-in-get_file_size.patch
 # For bz#1753992 - core dump when testing persistent reservation in guest
 Patch63: kvm-pr-manager-Fix-invalid-g_free-crash-bug.patch
 # For bz#1745922 - Luks-inside-qcow2 snapshot cannot boot after 'qemu-img rebase'
 Patch64: kvm-block-Use-QEMU_IS_ALIGNED.patch
 # For bz#1745922 - Luks-inside-qcow2 snapshot cannot boot after 'qemu-img rebase'
 Patch65: kvm-block-qcow2-Fix-corruption-introduced-by-commit-8ac0.patch
 # For bz#1745922 - Luks-inside-qcow2 snapshot cannot boot after 'qemu-img rebase'
 Patch66: kvm-block-qcow2-refactor-encryption-code.patch
 # For bz#1745922 - Luks-inside-qcow2 snapshot cannot boot after 'qemu-img rebase'
 Patch67: kvm-qemu-iotests-Add-test-for-bz-1745922.patch
 # For bz#1748253 - QEMU crashes (core dump) when using the integrated NDB server with data-plane
 Patch68: kvm-nbd-server-attach-client-channel-to-the-export-s-Aio.patch
 # For bz#1744955 - Qemu hang when block resize a qcow2 image
 Patch69: kvm-virtio-blk-schedule-virtio_notify_config-to-run-on-m.patch
 # For bz#1756413 - backport support for transactionable block-dirty-bitmap-remove for incremental backup support
 Patch70: kvm-blockdev-reduce-aio_context-locked-sections-in-bitma.patch
 # For bz#1756413 - backport support for transactionable block-dirty-bitmap-remove for incremental backup support
 Patch71: kvm-qapi-implement-block-dirty-bitmap-remove-transaction.patch
 # For bz#1756413 - backport support for transactionable block-dirty-bitmap-remove for incremental backup support
 Patch72: kvm-iotests-test-bitmap-moving-inside-254.patch
 # For bz#1754710 - qemu core dumped when hotpluging vcpus
 Patch73: kvm-spapr-xive-skip-partially-initialized-vCPUs-in-prese.patch
 # For bz#1741094 - [Upstream]Incremental backup: Qemu coredump when expose an active bitmap via pull mode(data plane enable)
 Patch74: kvm-nbd-Grab-aio-context-lock-in-more-places.patch
 # For bz#1741094 - [Upstream]Incremental backup: Qemu coredump when expose an active bitmap via pull mode(data plane enable)
 Patch75: kvm-tests-Use-iothreads-during-iotest-223.patch
 BuildRequires: wget
 BuildRequires: rpm-build
@ -517,7 +407,7 @@ the Secure Shell (SSH) protocol.
 %prep
-%setup -n qemu-%{version}
+%setup -n qemu-%{version}%{rcversion}
 %autopatch -p1
 %build
@ -808,8 +698,6 @@ mkdir -p $RPM_BUILD_ROOT%{_bindir}
 install -c -m 0755  qemu-ga ${RPM_BUILD_ROOT}%{_bindir}/qemu-ga
 mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
 install -m 0644  qemu-ga.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/
 install -m 0755 qemu-kvm $RPM_BUILD_ROOT%{_libexecdir}/
 install -m 0644 qemu-kvm.stp $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/
@ -838,7 +726,7 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}/tracetool/format
 install -m 0644 -t $RPM_BUILD_ROOT%{_datadir}/%{name}/tracetool/format scripts/tracetool/format/*.py
 mkdir -p $RPM_BUILD_ROOT%{qemudocdir}
-install -p -m 0644 -t ${RPM_BUILD_ROOT}%{qemudocdir} Changelog README README.systemtap COPYING COPYING.LIB LICENSE docs/interop/qmp-spec.txt
+install -p -m 0644 -t ${RPM_BUILD_ROOT}%{qemudocdir} Changelog README.rst README.systemtap COPYING COPYING.LIB LICENSE docs/interop/qmp-spec.txt
 chmod -x ${RPM_BUILD_ROOT}%{_mandir}/man1/*
 chmod -x ${RPM_BUILD_ROOT}%{_mandir}/man8/*
@ -875,6 +763,8 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/opensbi-riscv64-sifive_u-fw_jump.bin
 rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/opensbi-riscv64-virt-fw_jump.bin
 rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/qemu-nsis.bmp
 rm -rf ${RPM_BUILD_ROOT}%{_libdir}/qemu-kvm/ui-spice-app.so
 %ifarch s390x
    # Use the s390-ccw.img that we've just built, not the pre-built one
    install -m 0644 pc-bios/s390-ccw/s390-ccw.img $RPM_BUILD_ROOT%{_datadir}/%{name}/
@ -882,10 +772,6 @@ rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/qemu-nsis.bmp
    rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/s390-netboot.img
 %endif
 %ifnarch %{power64}
    rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}/spapr-rtas.bin
 %endif
 %ifnarch x86_64
    rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/kvmvapic.bin
    rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}/linuxboot.bin
@ -1026,7 +912,7 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %defattr(-,root,root)
 %dir %{qemudocdir}
 %doc %{qemudocdir}/Changelog
-%doc %{qemudocdir}/README
+%doc %{qemudocdir}/README.rst
 %doc %{qemudocdir}/qemu-doc.html
 %doc %{qemudocdir}/COPYING
 %doc %{qemudocdir}/COPYING.LIB
@ -1108,9 +994,6 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %{_datadir}/icons/*
 %{_datadir}/%{name}/linuxboot_dma.bin
 %{_datadir}/%{name}/dump-guest-memory.py*
 %ifarch %{power64}
    %{_datadir}/%{name}/spapr-rtas.bin
 %endif
 %{_libexecdir}/qemu-kvm
 %{_datadir}/systemtap/tapset/qemu-kvm.stp
 %{_datadir}/systemtap/tapset/qemu-kvm-log.stp
@ -1141,7 +1024,7 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %files -n qemu-guest-agent
 %defattr(-,root,root,-)
-%doc COPYING README
+%doc COPYING README.rst
 %{_bindir}/qemu-ga
 %{_mandir}/man8/qemu-ga.8*
 %{_unitdir}/qemu-guest-agent.service
@ -1173,19 +1056,17 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %changelog
-* Tue Nov 12 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.1.0-14.el8
+* Fri Nov 15 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-0.el8
- kvm-blockdev-reduce-aio_context-locked-sections-in-bitma.patch [bz#1756413]
+- Rebase to 4.2
- kvm-qapi-implement-block-dirty-bitmap-remove-transaction.patch [bz#1756413]
+
- kvm-iotests-test-bitmap-moving-inside-254.patch [bz#1756413]
+* Tue Oct 29 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.1.0-14.el8
- kvm-spapr-xive-skip-partially-initialized-vCPUs-in-prese.patch [bz#1754710]
+- kvm-Revert-qcow2-skip-writing-zero-buffers-to-empty-COW-.patch [bz#1751934]
- kvm-nbd-Grab-aio-context-lock-in-more-places.patch [bz#1741094]
+- kvm-coroutine-Add-qemu_co_mutex_assert_locked.patch [bz#1764721]
- kvm-tests-Use-iothreads-during-iotest-223.patch [bz#1741094]
+- kvm-qcow2-Fix-corruption-bug-in-qcow2_detect_metadata_pr.patch [bz#1764721]
- Resolves: bz#1741094
+- Resolves: bz#1751934
-  ([Upstream]Incremental backup: Qemu coredump when expose an active bitmap via pull mode(data plane enable))
+  (Fail to install guest when xfs is the host filesystem)
- Resolves: bz#1754710
+- Resolves: bz#1764721
-  (qemu core dumped when hotpluging vcpus)
+  (qcow2 image corruption due to incorrect locking in preallocation detection)
 - Resolves: bz#1756413
  (backport support for transactionable block-dirty-bitmap-remove for incremental backup support)
 * Fri Sep 27 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.1.0-13.el8
 - kvm-nbd-server-attach-client-channel-to-the-export-s-Aio.patch [bz#1748253]
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (qemu-4.1.0.tar.xz) = 82fd51702a7b9b1b00b2f1bd3b4a832b80249018dbba1add0b0a73e7d4bee452afd45574b4d8df7ce4477d8711f3bda4ca072a1a6de25895c93eb21cf78fc4b2
+SHA512 (qemu-4.2.0-rc1.tar.xz) = 8ad5e0472fd384a9ba03b2e8fbb1e887169abb47a50a3f130b1943b39f45677a9e65ca5d1deb96338a5b3c3953db67f50e194a6763e9121c0eb5f620896162a9
`@ -1 +1 @@`
	`SHA512 (qemu-4.1.0.tar.xz) = 82fd51702a7b9b1b00b2f1bd3b4a832b80249018dbba1add0b0a73e7d4bee452afd45574b4d8df7ce4477d8711f3bda4ca072a1a6de25895c93eb21cf78fc4b2`	`SHA512 (qemu-4.2.0-rc1.tar.xz) = 8ad5e0472fd384a9ba03b2e8fbb1e887169abb47a50a3f130b1943b39f45677a9e65ca5d1deb96338a5b3c3953db67f50e194a6763e9121c0eb5f620896162a9`