Merge branch 'c10s' into a10s

2025-01-28 11:18:24 +03:00 · 2025-01-28 11:18:24 +03:00 · 7e3c6e63de
commit 7e3c6e63de
parent aef569b85b 7b35fb4485
30 changed files with 6349 additions and 2 deletions
--- a/kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
+++ b/kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
@ -0,0 +1,67 @@
+From 133805a36691de83f0ca29165a2312d5ad4f0757 Mon Sep 17 00:00:00 2001
+From: Peter Maydell <peter.maydell@linaro.org>
+Date: Mon, 14 Oct 2024 17:05:53 +0100
+Subject: [PATCH 18/18] hw/char/pl011: Use correct masks for IBRD and FBRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: sansshar <None>
+RH-MergeRequest: 311: hw/char/pl011: Use correct masks for IBRD and FBRD
+RH-Jira: RHEL-67108
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] e615ca34db8ee95533eba8cd671d620112e80cfb (sansshar/qemu-kvm-centos)
+
+JIRA: RHEL-67108 <https://issues.redhat.com/browse/RHEL-67108>
+Brew build id: 5099404
+
+In commit b88cfee90268cad we defined masks for the IBRD and FBRD
+integer and fractional baud rate divider registers, to prevent the
+guest from writing invalid values which could cause division-by-zero.
+Unfortunately we got the mask values the wrong way around: the FBRD
+register is six bits and the IBRD register is 16 bits, not
+vice-versa.
+
+You would only run into this bug if you programmed the UART to a baud
+rate of less than 9600, because for 9600 baud and above the IBRD
+value will fit into 6 bits, as per the table in
+ https://developer.arm.com/documentation/ddi0183/g/programmers-model/register-descriptions/fractional-baud-rate-register--uartfbrd
+
+The only visible effects would be that the value read back from
+the register by the guest would be truncated, and we would
+print an incorrect baud rate in the debug logs.
+
+Cc: qemu-stable@nongnu.org
+Fixes: b88cfee90268 ("hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2610
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Gavin Shan <gshan@redhat.com>
+Message-id: 20241007144732.2491331-1-peter.maydell@linaro.org
+(cherry picked from commit cd247eae16ab1b9ce97fd34c000c1b883feeda45)
+Signed-off-by: Sana Sharma <sansshar@redhat.com>
+---
+ hw/char/pl011.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/char/pl011.c b/hw/char/pl011.c
+index f8078aa216..949e9d0e0d 100644
+--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
+@@ -88,10 +88,10 @@ DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr)
+ #define CR_LBE      (1 << 7)
+ 
+ /* Integer Baud Rate Divider, UARTIBRD */
+-#define IBRD_MASK 0x3f
+#define IBRD_MASK 0xffff
+ 
+ /* Fractional Baud Rate Divider, UARTFBRD */
+-#define FBRD_MASK 0xffff
+#define FBRD_MASK 0x3f
+ 
+ static const unsigned char pl011_id_arm[8] =
+   { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
+-- 
+2.39.3
+
--- a/kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
+++ b/kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
@ -0,0 +1,102 @@
+From 58ad1bbfe399cecf0f05ebc70d2d3189fb78851d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Fri, 29 Nov 2024 13:55:05 +0000
+Subject: [PATCH 2/4] hw/virtio: fix crash in processing balloon stats
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 322: hw/virtio: fix crash in processing balloon stats
+RH-Jira: RHEL-73835
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Commit: [1/1] 7a0f9b816b1ce5f82ae6d0f4686fbb2ca0632e00 (thuth/qemu-kvm-cs9)
+
+balloon_stats_get_all will iterate over guest stats upto the max
+VIRTIO_BALLOON_S_NR value, calling visit_type_uint64 to populate
+the QObject dict. The dict keys are obtained from the static
+array balloon_stat_names which is VIRTIO_BALLOON_S_NR in size.
+
+Unfortunately the way that array is declared results in any
+unassigned stats getting a NULL name, which will then cause
+visit_type_uint64 to trigger an assert in qobject_output_add_obj.
+
+The balloon_stat_names array was fortunately fully populated with
+names until recently:
+
+  commit 0d2eeef77a33315187df8519491a900bde4a3d83
+  Author: Bibo Mao <maobibo@loongson.cn>
+  Date:   Mon Oct 28 10:38:09 2024 +0800
+
+    linux-headers: Update to Linux v6.12-rc5
+
+pulled a change to include/standard-headers/linux/virtio_balloon.h
+which increased VIRTIO_BALLOON_S_NR by 6, and failed to add the new
+names to balloon_stat_names.
+
+This commit fills in the missing names, and uses a static assert to
+guarantee that any future changes to VIRTIO_BALLOON_S_NR will cause
+a build failure until balloon_stat_names is updated.
+
+This problem was detected by the Cockpit Project's automated
+integration tests on QEMU 9.2.0-rc1.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2329448
+Fixes: 0d2eeef77a3 ("linux-headers: Update to Linux v6.12-rc5")
+Reported-by: Martin Pitt <mpitt@redhat.com>
+Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20241129135507.699030-2-berrange@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit bff1050a5630ce5da6f43ed002725d52140bb9e6)
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/virtio/virtio-balloon.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
+index 609e39a821..afd2ad6dd6 100644
+--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
+@@ -167,19 +167,33 @@ static void balloon_deflate_page(VirtIOBalloon *balloon,
+     }
+ }
+ 
+/*
+ * All stats upto VIRTIO_BALLOON_S_NR /must/ have a
+ * non-NULL name declared here, since these are used
+ * as keys for populating the QDict with stats
+ */
+ static const char *balloon_stat_names[] = {
+    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
+    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
+    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
+    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
+    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
+
+    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
+    [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
+    [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
+    [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
+    [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
+-   [VIRTIO_BALLOON_S_NR] = NULL
+
+   [VIRTIO_BALLOON_S_OOM_KILL] = "stat-oom-kills",
+   [VIRTIO_BALLOON_S_ALLOC_STALL] = "stat-alloc-stalls",
+   [VIRTIO_BALLOON_S_ASYNC_SCAN] = "stat-async-scans",
+   [VIRTIO_BALLOON_S_DIRECT_SCAN] = "stat-direct-scans",
+   [VIRTIO_BALLOON_S_ASYNC_RECLAIM] = "stat-async-reclaims",
+
+   [VIRTIO_BALLOON_S_DIRECT_RECLAIM] = "stat-direct-reclaims",
+ };
+G_STATIC_ASSERT(G_N_ELEMENTS(balloon_stat_names) == VIRTIO_BALLOON_S_NR);
+ 
+ /*
+  * reset_stats - Mark all items in the stats array as unset
+-- 
+2.39.3
+
--- a/kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
+++ b/kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
--- a/kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
+++ b/kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
--- a/kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
+++ b/kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
@ -0,0 +1,72 @@
+From b270420c34cd990b1bcbe506c3fb0ef6f76d21a8 Mon Sep 17 00:00:00 2001
+From: Ani Sinha <anisinha@redhat.com>
+Date: Wed, 8 Jan 2025 15:10:22 +0530
+Subject: [PATCH 5/7] pc: q35: Bump max_cpus to 4096 vcpus
+
+RH-Author: Ani Sinha <anisinha@redhat.com>
+RH-MergeRequest: 317: pc: q35: Bump max_cpus to 4096 vcpus
+RH-Jira: RHEL-57668
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] 35242a1fa8fc21f7d73422d23074cd8da5f74781 (anisinha/centos-qemu-kvm)
+
+This is the downstream change equivalent of the upstream QEMU commit
+e4e98c7e ("pc: q35: Bump max_cpus to 4096 vcpus")
+
+Since upstream Linux kernel commit
+f10a570b093e6 ("KVM: x86: Add CONFIG_KVM_MAX_NR_VCPUS to allow up to 4096 vCPUs")
+Linux kernel can support upto a maximum number of 4096 vcpus when MAXSMP is
+enabled in the kernel. This upstream change has been backported to c9s kernel
+already. Please see JIRA https://issues.redhat.com/browse/RHEL-11579 and the
+following commit authored by Vitaly Kuznetsov:
+a85f846be686b0a ("KVM: x86: Add CONFIG_KVM_MAX_NR_VCPUS to allow up to 4096 vCPUs")
+
+At present, QEMU has been tested to correctly boot a linux guest with 4096
+vcpus using edk2 that has the fixes corresponding to the following two upstream
+edk2 PRs:
+
+https://github.com/tianocore/edk2/pull/5410
+https://github.com/tianocore/edk2/pull/5418
+
+The changes corresponding to the above two upstream edk2 PRs has been included
+in the downstream c9s edk2 with the following MR:
+https://gitlab.com/redhat/centos-stream/src/edk2/-/merge_requests/59
+
+So bump up the value max_cpus to 4096 for RHEL q35 machines versions 9.6 and
+newer. Q35 RHEL machines versions 9.4 and older continue to support 710 maximum
+vcpus as before for compatibility reasons.
+
+See also
+https://gitlab.com/redhat/centos-stream/src/qemu-kvm/-/merge_requests/236
+https://gitlab.com/redhat/centos-stream/src/qemu-kvm/-/merge_requests/273
+
+Signed-off-by: Ani Sinha <anisinha@redhat.com>
+---
+ hw/i386/pc_q35.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 37f54062c8..506f9dc0c0 100644
+--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
+@@ -344,7 +344,7 @@ static void pc_q35_machine_options(MachineClass *m)
+     m->default_display = "std";
+     m->default_nic = "e1000e";
+     m->no_floppy = 1;
+-    m->max_cpus = 710;
+    m->max_cpus = 4096;
+     m->no_parallel = 1;
+     machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
+     machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
+@@ -698,6 +698,9 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
+ {
+     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+     pc_q35_rhel_machine_9_6_0_options(m);
+
+    /* older RHEL machines continue to support 710 vcpus */
+    m->max_cpus = 710;
+     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
+-- 
+2.39.3
+
--- a/kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
+++ b/kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
@ -0,0 +1,128 @@
+From 33607f8bd2e0d56e854131c4e70c770b88fa5441 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Tue, 19 Nov 2024 13:03:53 +0100
+Subject: [PATCH 1/7] qdev: Fix set_pci_devfn() to visit option only once
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 312: qdev-monitor: avoid QemuOpts in QMP device_add
+RH-Jira: RHEL-43412
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Commit: [1/4] 4d9ce49f16904d34d4f751f1dec3a53abfe8c8a8 (stefanha/centos-stream-qemu-kvm)
+
+pci_devfn properties accept either a string or an integer as input. To
+implement this, set_pci_devfn() first tries to visit the option as a
+string, and if that fails, it visits it as an integer instead. While the
+QemuOpts visitor happens to accept this, it is invalid according to the
+visitor interface. QObject input visitors run into an assertion failure
+when this is done.
+
+QObject input visitors are used with the JSON syntax version of -device
+on the command line:
+
+$ ./qemu-system-x86_64 -enable-kvm -M q35 -device pcie-pci-bridge,id=pci.1,bus=pcie.0 -blockdev null-co,node-name=disk -device '{ "driver": "virtio-blk-pci", "drive": "disk", "id": "virtio-disk0", "bus": "pci.1", "addr": 1 }'
+qemu-system-x86_64: ../qapi/qobject-input-visitor.c:143: QObject *qobject_input_try_get_object(QObjectInputVisitor *, const char *, _Bool): Assertion `removed' failed.
+
+The proper way to accept both strings and integers is using the
+alternate mechanism, which tells us the type of the input before it's
+visited. With this information, we can directly visit it as the right
+type.
+
+This fixes set_pci_devfn() by using the alternate mechanism.
+
+Cc: qemu-stable@nongnu.org
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20241119120353.57812-1-kwolf@redhat.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 5102f9df4a9a7adfbd902f9515c3f8f53dba288e)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/core/qdev-properties-system.c | 54 +++++++++++++++++++++-----------
+ 1 file changed, 36 insertions(+), 18 deletions(-)
+
+diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
+index 5cd527cdba..b182dc293a 100644
+--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
+@@ -820,39 +820,57 @@ static void set_pci_devfn(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+ {
+     Property *prop = opaque;
+    g_autofree GenericAlternate *alt;
+     int32_t value, *ptr = object_field_prop_ptr(obj, prop);
+     unsigned int slot, fn, n;
+-    char *str;
+    g_autofree char *str = NULL;
+
+    if (!visit_start_alternate(v, name, &alt, sizeof(*alt), errp)) {
+        return;
+    }
+
+    switch (alt->type) {
+    case QTYPE_QSTRING:
+        if (!visit_type_str(v, name, &str, errp)) {
+            goto out;
+        }
+ 
+-    if (!visit_type_str(v, name, &str, NULL)) {
+        if (sscanf(str, "%x.%x%n", &slot, &fn, &n) != 2) {
+            fn = 0;
+            if (sscanf(str, "%x%n", &slot, &n) != 1) {
+                goto invalid;
+            }
+        }
+        if (str[n] != '\0' || fn > 7 || slot > 31) {
+            goto invalid;
+        }
+        *ptr = slot << 3 | fn;
+        break;
+
+    case QTYPE_QNUM:
+         if (!visit_type_int32(v, name, &value, errp)) {
+-            return;
+            goto out;
+         }
+         if (value < -1 || value > 255) {
+             error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                        name ? name : "null", "a value between -1 and 255");
+-            return;
+            goto out;
+         }
+         *ptr = value;
+-        return;
+-    }
+        break;
+ 
+-    if (sscanf(str, "%x.%x%n", &slot, &fn, &n) != 2) {
+-        fn = 0;
+-        if (sscanf(str, "%x%n", &slot, &n) != 1) {
+-            goto invalid;
+-        }
+-    }
+-    if (str[n] != '\0' || fn > 7 || slot > 31) {
+-        goto invalid;
+    default:
+        error_setg(errp, "Invalid parameter type for '%s', expected int or str",
+                   name ? name : "null");
+        goto out;
+     }
+-    *ptr = slot << 3 | fn;
+-    g_free(str);
+-    return;
+
+    goto out;
+ 
+ invalid:
+     error_set_from_qdev_prop_error(errp, EINVAL, obj, name, str);
+-    g_free(str);
+out:
+    visit_end_alternate(v, (void **) &alt);
+ }
+ 
+ static int print_pci_devfn(Object *obj, Property *prop, char *dest,
+-- 
+2.39.3
+
--- a/kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
+++ b/kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
@ -0,0 +1,131 @@
+From de4f7c3b6dbba3eb8450cd7714ae93787009cd17 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 27 Aug 2024 15:27:50 -0400
+Subject: [PATCH 3/7] qdev-monitor: avoid QemuOpts in QMP device_add
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 312: qdev-monitor: avoid QemuOpts in QMP device_add
+RH-Jira: RHEL-43412
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Commit: [3/4] 7c45f3791491cd66ec2476ef0aa515b5bffba456 (stefanha/centos-stream-qemu-kvm)
+
+The QMP device_add monitor command converts the QDict arguments to
+QemuOpts and then back again to QDict. This process only supports scalar
+types. Device properties like virtio-blk-pci's iothread-vq-mapping (an
+array of objects) are silently dropped by qemu_opts_from_qdict() during
+the QemuOpts conversion even though QAPI is capable of validating them.
+As a result, hotplugging virtio-blk-pci devices with the
+iothread-vq-mapping property does not work as expected (the property is
+ignored).
+
+Get rid of the QemuOpts conversion in qmp_device_add() and call
+qdev_device_add_from_qdict() with from_json=true. Using the QMP
+command's QDict arguments directly allows non-scalar properties.
+
+The HMP is also adjusted since qmp_device_add()'s now expects properly
+typed JSON arguments and cannot be used from HMP anymore. Move the code
+that was previously in qmp_device_add() (with QemuOpts conversion and
+from_json=false) into hmp_device_add() so that its behavior is
+unchanged.
+
+This patch changes the behavior of QMP device_add but not HMP
+device_add. QMP clients that sent incorrectly typed device_add QMP
+commands no longer work. This is a breaking change but clients should be
+using the correct types already. See the netdev_add QAPIfication in
+commit db2a380c8457 for similar reasoning and object-add in commit
+9151e59a8b6e. Unlike those commits, we continue to rely on 'gen': false
+for the time being.
+
+Markus helped me figure this out and even provided a draft patch. The
+code ended up very close to what he suggested.
+
+Suggested-by: Markus Armbruster <armbru@redhat.com>
+Cc: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240827192751.948633-2-stefanha@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit be93fd53723cbdca675bd9ed112dae5cabbe1e91)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ system/qdev-monitor.c | 42 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
+index 6af6ef7d66..8b27cc42b0 100644
+--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
+@@ -849,18 +849,9 @@ void hmp_info_qdm(Monitor *mon, const QDict *qdict)
+ 
+ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
+ {
+-    QemuOpts *opts;
+     DeviceState *dev;
+ 
+-    opts = qemu_opts_from_qdict(qemu_find_opts("device"), qdict, errp);
+-    if (!opts) {
+-        return;
+-    }
+-    if (!monitor_cur_is_qmp() && qdev_device_help(opts)) {
+-        qemu_opts_del(opts);
+-        return;
+-    }
+-    dev = qdev_device_add(opts, errp);
+    dev = qdev_device_add_from_qdict(qdict, true, errp);
+     if (!dev) {
+         /*
+          * Drain all pending RCU callbacks. This is done because
+@@ -872,9 +863,6 @@ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
+          * to the user
+          */
+         drain_call_rcu();
+-
+-        qemu_opts_del(opts);
+-        return;
+     }
+     object_unref(OBJECT(dev));
+ }
+@@ -967,8 +955,34 @@ void qmp_device_del(const char *id, Error **errp)
+ void hmp_device_add(Monitor *mon, const QDict *qdict)
+ {
+     Error *err = NULL;
+    QemuOpts *opts;
+    DeviceState *dev;
+ 
+-    qmp_device_add((QDict *)qdict, NULL, &err);
+    opts = qemu_opts_from_qdict(qemu_find_opts("device"), qdict, &err);
+    if (!opts) {
+        goto out;
+    }
+    if (qdev_device_help(opts)) {
+        qemu_opts_del(opts);
+        return;
+    }
+    dev = qdev_device_add(opts, &err);
+    if (!dev) {
+        /*
+         * Drain all pending RCU callbacks. This is done because
+         * some bus related operations can delay a device removal
+         * (in this case this can happen if device is added and then
+         * removed due to a configuration error)
+         * to a RCU callback, but user might expect that this interface
+         * will finish its job completely once qmp command returns result
+         * to the user
+         */
+        drain_call_rcu();
+
+        qemu_opts_del(opts);
+    }
+    object_unref(dev);
+out:
+     hmp_handle_error(mon, err);
+ }
+ 
+-- 
+2.39.3
+
--- a/kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
+++ b/kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
@ -0,0 +1,80 @@
+From 14fc984df8059560815cc1f55f058569fe480832 Mon Sep 17 00:00:00 2001
+From: Dehan Meng <demeng@redhat.com>
+Date: Wed, 25 Dec 2024 16:37:44 +0800
+Subject: [PATCH 4/4] qemu-ga: Optimize freeze-hook script logic of logging
+ error
+
+RH-Author: 6-dehan <demeng@redhat.com>
+RH-MergeRequest: 326: qemu-ga: Optimize freeze-hook script logic of logging error
+RH-Jira: RHEL-74461
+RH-Acked-by: Konstantin Kostiuk <None>
+RH-Acked-by: Yan Vugenfirer <None>
+RH-Commit: [1/1] f133428aa9b511a93e528823e8253a41d46e1de5 (6-dehan/centos-qemu-kvm)
+
+Make sure the error log of fsfreeze hooks
+when freeze/thaw/snapshot could be logged
+to system logs if the default logfile of
+qga can't be written or other situations
+
+Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
+Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
+Signed-off-by: Dehan Meng <demeng@redhat.com>
+---
+ scripts/qemu-guest-agent/fsfreeze-hook | 36 +++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 4 deletions(-)
+
+diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
+index 70536ba3e3..d5d8d4daf8 100755
+--- a/scripts/qemu-guest-agent/fsfreeze-hook
+++ b/scripts/qemu-guest-agent/fsfreeze-hook
+@@ -19,15 +19,43 @@ is_ignored_file() {
+     return 1
+ }
+ 
+USE_SYSLOG=0
+# if log file is not writable, fallback to syslog
+[ ! -w "$LOGFILE" ] && USE_SYSLOG=1
+# try to update log file and fallback to syslog if it fails
+touch "$LOGFILE" &>/dev/null || USE_SYSLOG=1
+
+# Ensure the log file is writable, fallback to syslog if not
+log_message() {
+    local message="$1"
+    if [ "$USE_SYSLOG" -eq 0 ]; then
+        printf "%s: %s\n" "$(date)" "$message" >>"$LOGFILE"
+    else
+        logger -t qemu-ga-freeze-hook "$message"
+    fi
+}
+
+ # Iterate executables in directory "fsfreeze-hook.d" with the specified args
+ [ ! -d "$FSFREEZE_D" ] && exit 0
+
+ for file in "$FSFREEZE_D"/* ; do
+     is_ignored_file "$file" && continue
+     [ -x "$file" ] || continue
+-    printf "$(date): execute $file $@\n" >>$LOGFILE
+-    "$file" "$@" >>$LOGFILE 2>&1
+-    STATUS=$?
+-    printf "$(date): $file finished with status=$STATUS\n" >>$LOGFILE
+
+    log_message "Executing $file $@"
+    if [ "$USE_SYSLOG" -eq 0 ]; then
+        "$file" "$@" >>"$LOGFILE" 2>&1
+        STATUS=$?
+    else
+        "$file" "$@" 2>&1 | logger -t qemu-ga-freeze-hook
+        STATUS=${PIPESTATUS[0]}
+    fi
+
+    if [ $STATUS -ne 0 ]; then
+        log_message "Error: $file finished with status=$STATUS"
+    else
+        log_message "$file finished successfully"
+    fi
+ done
+ 
+ exit 0
+-- 
+2.39.3
+
--- a/kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
+++ b/kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
@ -0,0 +1,54 @@
+From 53cc229c86bd0c555cdf68adb75918bec6c525fb Mon Sep 17 00:00:00 2001
+From: Konstantin Kostiuk <kkostiuk@redhat.com>
+Date: Mon, 16 Dec 2024 17:45:52 +0200
+Subject: [PATCH 3/4] qga: Add log to guest-fsfreeze-thaw command
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: 6-dehan <demeng@redhat.com>
+RH-MergeRequest: 325: qga: Add log to guest-fsfreeze-thaw command
+RH-Jira: RHEL-74361
+RH-Acked-by: Konstantin Kostiuk <None>
+RH-Acked-by: Yan Vugenfirer <None>
+RH-Commit: [1/1] a6f5a87f592136857fb76b8261d1de98f1d28772 (6-dehan/centos-qemu-kvm)
+
+Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ qga/commands-posix.c | 2 ++
+ qga/commands-win32.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/qga/commands-posix.c b/qga/commands-posix.c
+index c2bd0b4316..49e40f9127 100644
+--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
+@@ -806,8 +806,10 @@ int64_t qmp_guest_fsfreeze_thaw(Error **errp)
+     int ret;
+ 
+     ret = qmp_guest_fsfreeze_do_thaw(errp);
+
+     if (ret >= 0) {
+         ga_unset_frozen(ga_state);
+        slog("guest-fsthaw called");
+         execute_fsfreeze_hook(FSFREEZE_HOOK_THAW, errp);
+     } else {
+         ret = 0;
+diff --git a/qga/commands-win32.c b/qga/commands-win32.c
+index 61b36da469..1aea6cd167 100644
+--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
+@@ -1273,6 +1273,9 @@ int64_t qmp_guest_fsfreeze_thaw(Error **errp)
+     qga_vss_fsfreeze(&i, false, NULL, errp);
+ 
+     ga_unset_frozen(ga_state);
+
+    slog("guest-fsthaw called");
+
+     return i;
+ }
+ 
+-- 
+2.39.3
+
--- a/kvm-qga-skip-bind-mounts-in-fs-list.patch
+++ b/kvm-qga-skip-bind-mounts-in-fs-list.patch
@ -0,0 +1,94 @@
+From 5aec8bc4d0458e6011f5e0242a8f18bdba835af8 Mon Sep 17 00:00:00 2001
+From: Jean-Louis Dupond <jean-louis@dupond.be>
+Date: Wed, 2 Oct 2024 12:06:35 +0200
+Subject: [PATCH 17/18] qga: skip bind mounts in fs list
+
+RH-Author: Konstantin Kostiuk <None>
+RH-MergeRequest: 307: qga: skip bind mounts in fs list
+RH-Jira: RHEL-71939
+RH-Acked-by: yvugenfi <None>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] 787cdc9477275959892800418ea37b76fce28ac3 (kkostiuk/redhat-centos-stream-src-qemu-kvm)
+
+The filesystem list in build_fs_mount_list should skip bind mounts.
+This because we end up in locking situations when doing fsFreeze. Like
+mentioned in [1] and [2].
+
+Next to that, the build_fs_mount_list call did a fallback via
+build_fs_mount_list_from_mtab if mountinfo did not exist.
+There it skipped bind mounts, but this is broken for newer OS.
+This as mounts does not return the path of the bind mount but the
+underlying dev/partition, so S_ISDIR will never return true in
+dev_major_minor call.
+
+This patch simply checks the existing devmajor:devminor tuple in the
+mounts, and if it already exists, this means we have the same devices
+mounted again, a bind mount. So skip this.
+
+Same approach is used in open-vm-tools [3].
+
+[1]: https://gitlab.com/qemu-project/qemu/-/issues/592
+[2]: https://gitlab.com/qemu-project/qemu/-/issues/520
+[3]: https://github.com/vmware/open-vm-tools/commit/d58847b497e212737007958c945af1df22a8ab58
+
+Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be>
+Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
+Link: https://lore.kernel.org/r/20241002100634.162499-2-jean-louis@dupond.be
+Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
+---
+ qga/commands-linux.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/qga/commands-linux.c b/qga/commands-linux.c
+index 51d5e3d927..426b040ab8 100644
+--- a/qga/commands-linux.c
+++ b/qga/commands-linux.c
+@@ -59,6 +59,22 @@ static int dev_major_minor(const char *devpath,
+     return -1;
+ }
+ 
+/*
+ * Check if we already have the devmajor:devminor in the mounts
+ * If thats the case return true.
+ */
+static bool dev_exists(FsMountList *mounts, unsigned int devmajor, unsigned int devminor)
+{
+    FsMount *mount;
+
+    QTAILQ_FOREACH(mount, mounts, next) {
+        if (mount->devmajor == devmajor && mount->devminor == devminor) {
+            return true;
+        }
+    }
+    return false;
+}
+
+ static bool build_fs_mount_list_from_mtab(FsMountList *mounts, Error **errp)
+ {
+     struct mntent *ment;
+@@ -89,6 +105,10 @@ static bool build_fs_mount_list_from_mtab(FsMountList *mounts, Error **errp)
+             /* Skip bind mounts */
+             continue;
+         }
+        if (dev_exists(mounts, devmajor, devminor)) {
+            /* Skip already existing devices (bind mounts) */
+            continue;
+        }
+ 
+         mount = g_new0(FsMount, 1);
+         mount->dirname = g_strdup(ment->mnt_dir);
+@@ -172,6 +192,11 @@ bool build_fs_mount_list(FsMountList *mounts, Error **errp)
+             }
+         }
+ 
+        if (dev_exists(mounts, devmajor, devminor)) {
+            /* Skip already existing devices (bind mounts) */
+            continue;
+        }
+
+         mount = g_new0(FsMount, 1);
+         mount->dirname = g_strdup(line + dir_s);
+         mount->devtype = g_strdup(dash + type_s);
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
+++ b/kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
@ -0,0 +1,221 @@
+From e4bdbc368426bc9aeb6dbfeeb2de46de1256861d Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:50 +0100
+Subject: [PATCH 15/18] s390x/cpumodel: Add PLO-extension facility
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [15/16] 6e8bb7b1f0e8c84ba0c3cd7e7714d22642402513 (thuth/qemu-kvm-cs9)
+
+The PLO-extension facility introduces numerous locking related
+subfunctions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-15-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 393c835e341e8921d1d6ae45da308e85176c4f00)
+---
+ target/s390x/cpu_features.c         |  1 +
+ target/s390x/cpu_features_def.h.inc | 39 +++++++++++++++++++++++++
+ target/s390x/cpu_models.c           | 38 ++++++++++++++++++++++++
+ target/s390x/gen-features.c         | 45 +++++++++++++++++++++++++++++
+ 4 files changed, 123 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index 5f8b02f12c..4b5be6798e 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -240,6 +240,7 @@ void s390_get_deprecated_features(S390FeatBitmap features)
+ /* indexed by feature group number for easy lookup */
+ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("plo", PLO, "Perform-locked-operation facility"),
+    FEAT_GROUP_INIT("plo_ext", PLO_EXT, "PLO-extension facility"),
+     FEAT_GROUP_INIT("tods", TOD_CLOCK_STEERING, "Tod-clock-steering facility"),
+     FEAT_GROUP_INIT("gen13ptff", GEN13_PTFF, "PTFF enhancements introduced with z13"),
+     FEAT_GROUP_INIT("gen17ptff", GEN17_PTFF, "PTFF enhancements introduced with gen17"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index fe7e1bd19c..e23e603a79 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -93,6 +93,7 @@ DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
+ DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
+ DEF_FEAT(SIF, "sif", STFL, 85, "Sequential-instruction-fetching facility")
+ DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
+DEF_FEAT(PLO_EXT, "plo-ext", STFL, 87, "PLO-extension facility")
+ DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
+ DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
+ DEF_FEAT(SIDE_EFFECT_ACCESS_ESOP2, "sea_esop2", STFL, 131, "Side-effect-access facility and Enhanced-suppression-on-protection facility 2")
+@@ -180,6 +181,44 @@ DEF_FEAT(PLO_CSTST, "plo-cstst", PLO, 20, "PLO Compare and swap and triple store
+ DEF_FEAT(PLO_CSTSTG, "plo-cststg", PLO, 21, "PLO Compare and swap and triple store (64 bit in parameter list)")
+ DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (64 bit in general registers)")
+ DEF_FEAT(PLO_CSTSTX, "plo-cststx", PLO, 23, "PLO Compare and swap and triple store (128 bit in parameter list)")
+DEF_FEAT(PLO_CLO, "plo-clo", PLO, 24, "PLO Compare and load (256 bit in parameter list)")
+DEF_FEAT(PLO_CSO, "plo-cso", PLO, 25, "PLO Compare and swap (256 bit in parameter list)")
+DEF_FEAT(PLO_DCSO, "plo-dcso", PLO, 26, "PLO Double compare and swap (256 bit in parameter list)")
+DEF_FEAT(PLO_CSSTO, "plo-cssto", PLO, 27, "PLO Compare and swap and store (256 bit in parameter list)")
+DEF_FEAT(PLO_CSDSTO, "plo-csdsto", PLO, 28, "PLO Compare and swap and double store (256 bit in parameter list)")
+DEF_FEAT(PLO_CSTSTO, "plo-cststo", PLO, 29, "PLO Compare and swap and trible store (256 bit in parameter list)")
+DEF_FEAT(PLO_TCS, "plo-tcs", PLO, 30, "Triple compare and swap (32 bit in parameter list)")
+DEF_FEAT(PLO_TCSG, "plo-tcsg", PLO, 31, "Triple compare and swap (64 bit in parameter list)")
+DEF_FEAT(PLO_TCSX, "plo-tcsx", PLO, 32, "Triple compare and swap (128 bit in parameter list)")
+DEF_FEAT(PLO_TCSO, "plo-tcso", PLO, 33, "Triple compare and swap (256 bit in parameter list)")
+DEF_FEAT(PLO_QCS, "plo-qcs", PLO, 34, "Quadruple compare and swap (32 bit in parameter list)")
+DEF_FEAT(PLO_QCSG, "plo-qcsg", PLO, 35, "Quadruple compare and swap (64 bit in parameter list)")
+DEF_FEAT(PLO_QCSX, "plo-qcsx", PLO, 36, "Quadruple compare and swap (128 bit in parameter list)")
+DEF_FEAT(PLO_QCSO, "plo-qcso", PLO, 37, "Quadruple compare and swap (256 bit in parameter list)")
+DEF_FEAT(PLO_LO, "plo-lo", PLO, 38, "Load (256 bit in parameter list)")
+DEF_FEAT(PLO_DLX, "plo-dlx", PLO, 39, "Double load (128 bit in parameter list)")
+DEF_FEAT(PLO_DLO, "plo-dlo", PLO, 40, "Double load (256 bit in parameter list)")
+DEF_FEAT(PLO_TL, "plo-tl", PLO, 41, "Triple load (32 bit in parameter list)")
+DEF_FEAT(PLO_TLG, "plo-tlg", PLO, 42, "Triple load (64 bit in parameter list)")
+DEF_FEAT(PLO_TLX, "plo-tlx", PLO, 43, "Triple load (128 bit in parameter list)")
+DEF_FEAT(PLO_TLO, "plo-tlo", PLO, 44, "Triple load (256 bit in parameter list)")
+DEF_FEAT(PLO_QL, "plo-ql", PLO, 45, "Quadruple load (32 bit in parameter list)")
+DEF_FEAT(PLO_QLG, "plo-qlg", PLO, 46, "Quadruple load (64 bit in parameter list)")
+DEF_FEAT(PLO_QLX, "plo-qlx", PLO, 47, "Quadruple load (128 bit in parameter list)")
+DEF_FEAT(PLO_QLO, "plo-qlo", PLO, 48, "Quadruple load (256 bit in parameter list)")
+DEF_FEAT(PLO_STO, "plo-sto", PLO, 49, "Store (256 bit in parameter list)")
+DEF_FEAT(PLO_DST, "plo-dst", PLO, 50, "Double store (32 bit in parameter list)")
+DEF_FEAT(PLO_DSTG, "plo-dstg", PLO, 51, "Double store (64 bit in parameter list)")
+DEF_FEAT(PLO_DSTX, "plo-dstx", PLO, 52, "Double store (128 bit in parameter list)")
+DEF_FEAT(PLO_DSTO, "plo-dsto", PLO, 53, "Double store (256 bit in parameter list)")
+DEF_FEAT(PLO_TST, "plo-tst", PLO, 54, "Triple store (32 bit in parameter list)")
+DEF_FEAT(PLO_TSTG, "plo-tstg", PLO, 55, "Triple store (64 bit in parameter list)")
+DEF_FEAT(PLO_TSTX, "plo-tstx", PLO, 56, "Triple store (128 bit in parameter list)")
+DEF_FEAT(PLO_TSTO, "plo-tsto", PLO, 57, "Triple store (256 bit in parameter list)")
+DEF_FEAT(PLO_QST, "plo-qst", PLO, 58, "Quadruple store (32 bit in parameter list)")
+DEF_FEAT(PLO_QSTG, "plo-qstg", PLO, 59, "Quadruple store (64 bit in parameter list)")
+DEF_FEAT(PLO_QSTX, "plo-qstx", PLO, 60, "Quadruple store (128 bit in parameter list)")
+DEF_FEAT(PLO_QSTO, "plo-qsto", PLO, 61, "Quadruple store (256 bit in parameter list)")
+ 
+ /* Features exposed via the PTFF instruction. */
+ DEF_FEAT(PTFF_QTO, "ptff-qto", PTFF, 1, "PTFF Query TOD Offset")
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index 9e9f6dae07..3fb5b0980e 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -516,6 +516,44 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
+         { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
+         { S390_FEAT_INEFF_NC_TX, S390_FEAT_TRANSACTIONAL_EXE },
+        { S390_FEAT_PLO_CLO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_CSO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DCSO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_CSSTO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_CSDSTO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_CSTSTO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TCS, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TCSG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TCSX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TCSO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QCS, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QCSG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QCSX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QCSO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_LO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DLX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DLO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TL, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TLG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TLX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TLO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QL, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QLG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QLX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QLO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_STO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DST, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DSTG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DSTX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_DSTO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TST, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TSTG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TSTX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_TSTO, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QST, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QSTG, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QSTX, S390_FEAT_PLO_EXT },
+        { S390_FEAT_PLO_QSTO, S390_FEAT_PLO_EXT },
+     };
+     int i;
+ 
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 6d00ffcda7..680d45d303 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -46,6 +46,47 @@
+     S390_FEAT_PLO_CSTSTGR, \
+     S390_FEAT_PLO_CSTSTX
+ 
+#define S390_FEAT_GROUP_PLO_EXT \
+    S390_FEAT_PLO_EXT, \
+    S390_FEAT_PLO_CLO, \
+    S390_FEAT_PLO_CSO, \
+    S390_FEAT_PLO_DCSO, \
+    S390_FEAT_PLO_CSSTO, \
+    S390_FEAT_PLO_CSDSTO, \
+    S390_FEAT_PLO_CSTSTO, \
+    S390_FEAT_PLO_TCS, \
+    S390_FEAT_PLO_TCSG, \
+    S390_FEAT_PLO_TCSX, \
+    S390_FEAT_PLO_TCSO, \
+    S390_FEAT_PLO_QCS, \
+    S390_FEAT_PLO_QCSG, \
+    S390_FEAT_PLO_QCSX, \
+    S390_FEAT_PLO_QCSO, \
+    S390_FEAT_PLO_LO, \
+    S390_FEAT_PLO_DLX, \
+    S390_FEAT_PLO_DLO, \
+    S390_FEAT_PLO_TL, \
+    S390_FEAT_PLO_TLG, \
+    S390_FEAT_PLO_TLX, \
+    S390_FEAT_PLO_TLO, \
+    S390_FEAT_PLO_QL, \
+    S390_FEAT_PLO_QLG, \
+    S390_FEAT_PLO_QLX, \
+    S390_FEAT_PLO_QLO, \
+    S390_FEAT_PLO_STO, \
+    S390_FEAT_PLO_DST, \
+    S390_FEAT_PLO_DSTG, \
+    S390_FEAT_PLO_DSTX, \
+    S390_FEAT_PLO_DSTO, \
+    S390_FEAT_PLO_TST, \
+    S390_FEAT_PLO_TSTG, \
+    S390_FEAT_PLO_TSTX, \
+    S390_FEAT_PLO_TSTO, \
+    S390_FEAT_PLO_QST, \
+    S390_FEAT_PLO_QSTG, \
+    S390_FEAT_PLO_QSTX, \
+    S390_FEAT_PLO_QSTO
+
+ #define S390_FEAT_GROUP_TOD_CLOCK_STEERING \
+     S390_FEAT_TOD_CLOCK_STEERING, \
+     S390_FEAT_PTFF_QTO, \
+@@ -320,6 +361,9 @@
+ static uint16_t group_PLO[] = {
+     S390_FEAT_GROUP_PLO,
+ };
+static uint16_t group_PLO_EXT[] = {
+    S390_FEAT_GROUP_PLO_EXT,
+};
+ static uint16_t group_TOD_CLOCK_STEERING[] = {
+     S390_FEAT_GROUP_TOD_CLOCK_STEERING,
+ };
+@@ -936,6 +980,7 @@ typedef struct {
+  *******************************/
+ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(PLO),
+    FEAT_GROUP_INITIALIZER(PLO_EXT),
+     FEAT_GROUP_INITIALIZER(TOD_CLOCK_STEERING),
+     FEAT_GROUP_INITIALIZER(GEN13_PTFF),
+     FEAT_GROUP_INITIALIZER(GEN17_PTFF),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
+++ b/kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
@ -0,0 +1,43 @@
+From dcfaf859fa755f9c75b1e848f1b61b293b500d0d Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:48 +0100
+Subject: [PATCH 13/18] s390x/cpumodel: Add Sequential-Instruction-Fetching
+ facility
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [13/16] 5f8facceda9ecad3b417ed3da2d360fdd480f6d4 (thuth/qemu-kvm-cs9)
+
+The sequential instruction fetching facility provides few guarantees,
+for example, to avoid stop machine calls on enabling/disabling kprobes.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-13-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit a5fa8bee72847406bfc32e15c8e41c0a2a0812e1)
+---
+ target/s390x/cpu_features_def.h.inc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 2c1d1cd98a..09a80844a7 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -91,6 +91,7 @@ DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packe
+ DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
+ DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
+ DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
+DEF_FEAT(SIF, "sif", STFL, 85, "Sequential-instruction-fetching facility")
+ DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
+ DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
+ DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
+++ b/kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
@ -0,0 +1,90 @@
+From d1313d94cb0a2b69b18cf7e7531945cb131c23c2 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:41 +0100
+Subject: [PATCH 06/18] s390x/cpumodel: Add ptff Query Time-Stamp Event (QTSE)
+ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [6/16] f5642cffc8deb0caf96d59da72e82db435e28205 (thuth/qemu-kvm-cs9)
+
+Introduce a new PTFF subfunction to query-stamp events.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-6-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit eba6f49128fbcf75d19acb6aef250d0664d03e9e)
+---
+ target/s390x/cpu_features.c         | 1 +
+ target/s390x/cpu_features_def.h.inc | 1 +
+ target/s390x/gen-features.c         | 9 +++++++++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index 9ba127e386..385a2ff860 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -241,6 +241,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("plo", PLO, "Perform-locked-operation facility"),
+     FEAT_GROUP_INIT("tods", TOD_CLOCK_STEERING, "Tod-clock-steering facility"),
+     FEAT_GROUP_INIT("gen13ptff", GEN13_PTFF, "PTFF enhancements introduced with z13"),
+    FEAT_GROUP_INIT("gen17ptff", GEN17_PTFF, "PTFF enhancements introduced with gen17"),
+     FEAT_GROUP_INIT("msa", MSA, "Message-security-assist facility"),
+     FEAT_GROUP_INIT("msa1", MSA_EXT_1, "Message-security-assist-extension 1 facility"),
+     FEAT_GROUP_INIT("msa2", MSA_EXT_2, "Message-security-assist-extension 2 facility"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 2132837ffe..f96cb5a7d8 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -181,6 +181,7 @@ DEF_FEAT(PTFF_QSI, "ptff-qsi", PTFF, 2, "PTFF Query Steering Information")
+ DEF_FEAT(PTFF_QPT, "ptff-qpc", PTFF, 3, "PTFF Query Physical Clock")
+ DEF_FEAT(PTFF_QUI, "ptff-qui", PTFF, 4, "PTFF Query UTC Information")
+ DEF_FEAT(PTFF_QTOU, "ptff-qtou", PTFF, 5, "PTFF Query TOD Offset User")
+DEF_FEAT(PTFF_QTSE, "ptff-qtse", PTFF, 6, "PTFF Query Time-Stamp Event")
+ DEF_FEAT(PTFF_QSIE, "ptff-qsie", PTFF, 10, "PTFF Query Steering Information Extended")
+ DEF_FEAT(PTFF_QTOUE, "ptff-qtoue", PTFF, 13, "PTFF Query TOD Offset User Extended")
+ DEF_FEAT(PTFF_STO, "ptff-sto", PTFF, 65, "PTFF Set TOD Offset")
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 3326e7df43..302b653214 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -64,6 +64,9 @@
+     S390_FEAT_PTFF_STOE, \
+     S390_FEAT_PTFF_STOUE
+ 
+#define S390_FEAT_GROUP_GEN17_PTFF \
+    S390_FEAT_PTFF_QTSE
+
+ #define S390_FEAT_GROUP_MSA \
+     S390_FEAT_MSA, \
+     S390_FEAT_KMAC_DEA, \
+@@ -318,6 +321,11 @@ static uint16_t group_GEN13_PTFF[] = {
+ static uint16_t group_MULTIPLE_EPOCH_PTFF[] = {
+     S390_FEAT_GROUP_MULTIPLE_EPOCH_PTFF,
+ };
+
+static uint16_t group_GEN17_PTFF[] = {
+    S390_FEAT_GROUP_GEN17_PTFF,
+};
+
+ static uint16_t group_MSA[] = {
+     S390_FEAT_GROUP_MSA,
+ };
+@@ -918,6 +926,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(PLO),
+     FEAT_GROUP_INITIALIZER(TOD_CLOCK_STEERING),
+     FEAT_GROUP_INITIALIZER(GEN13_PTFF),
+    FEAT_GROUP_INITIALIZER(GEN17_PTFF),
+     FEAT_GROUP_INITIALIZER(MSA),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_1),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_2),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
+++ b/kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
@ -0,0 +1,169 @@
+From 66725d6be2ad779432d3b02a0ad20a415bd37f1f Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:43 +0100
+Subject: [PATCH 08/18] s390x/cpumodel: add Concurrent-functions facility
+ support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [8/16] 891c3efec3d7dbce03e01f0fcb61cca9669570eb (thuth/qemu-kvm-cs9)
+
+The Concurrent-functions facility introduces the new instruction
+Perform Functions with Concurrent Results (PFCR) with few subfunctions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-8-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit c9ea365dce32bc114dacd7cfca7c478a82459b47)
+---
+ target/s390x/cpu_features.c         |  2 ++
+ target/s390x/cpu_features.h         |  1 +
+ target/s390x/cpu_features_def.h.inc |  8 ++++++++
+ target/s390x/cpu_models.c           |  5 +++++
+ target/s390x/gen-features.c         | 13 +++++++++++++
+ target/s390x/kvm/kvm.c              |  6 ++++++
+ 6 files changed, 35 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index 385a2ff860..5f8b02f12c 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -93,6 +93,7 @@ void s390_fill_feat_block(const S390FeatBitmap features, S390FeatType type,
+     case S390_FEAT_TYPE_KDSA:
+     case S390_FEAT_TYPE_SORTL:
+     case S390_FEAT_TYPE_DFLTCC:
+    case S390_FEAT_TYPE_PFCR:
+         set_be_bit(0, data); /* query is always available */
+         break;
+     default:
+@@ -263,6 +264,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
+     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
+     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
+    FEAT_GROUP_INIT("ccf", CONCURRENT_FUNCTIONS, "Concurrent-functions facility"),
+ };
+ 
+ const S390FeatGroupDef *s390_feat_group_def(S390FeatGroup group)
+diff --git a/target/s390x/cpu_features.h b/target/s390x/cpu_features.h
+index 661a8cd6db..5635839d03 100644
+--- a/target/s390x/cpu_features.h
+++ b/target/s390x/cpu_features.h
+@@ -44,6 +44,7 @@ typedef enum {
+     S390_FEAT_TYPE_SORTL,
+     S390_FEAT_TYPE_DFLTCC,
+     S390_FEAT_TYPE_UV_FEAT_GUEST,
+    S390_FEAT_TYPE_PFCR,
+ } S390FeatType;
+ 
+ /* Definition of a CPU feature */
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index f96cb5a7d8..09872ab3d8 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -116,6 +116,7 @@ DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
+ DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
+ DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
+ DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
+DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
+ 
+ /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
+ DEF_FEAT(SIE_GSLS, "gsls", SCLP_CONF_CHAR, 40, "SIE: Guest-storage-limit-suppression facility")
+@@ -413,3 +414,10 @@ DEF_FEAT(DEFLATE_F0, "dfltcc-f0", DFLTCC, 192, "DFLTCC format 0 parameter-block"
+ /* Features exposed via the UV-CALL instruction */
+ DEF_FEAT(UV_FEAT_AP, "appv", UV_FEAT_GUEST, 4, "AP instructions installed for secure guests")
+ DEF_FEAT(UV_FEAT_AP_INTR, "appvi", UV_FEAT_GUEST, 5, "AP instructions interruption support for secure guests")
+
+/* Features exposed via the PFCR instruction (concurrent-functions facility). */
+DEF_FEAT(PFCR_QAF, "pfcr-qaf", PFCR, 0, "PFCR Query-Available-Functions")
+DEF_FEAT(PFCR_CSDST, "pfcr-csdst", PFCR, 1, "PFCR Compare-and-Swap-and-Double-Store (32)")
+DEF_FEAT(PFCR_CSDSTG, "pfcr-csdstg", PFCR, 2, "PFCR Compare-and-Swap-and-Double-Store (64)")
+DEF_FEAT(PFCR_CSTST, "pfcr-cstst", PFCR, 3, "PFCR Compare-and-Swap-and-Triple-Store (32)")
+DEF_FEAT(PFCR_CSTSTG, "pfcr-cststg", PFCR, 4, "PFCR Compare-and-Swap-and-Triple-Store (64)")
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index da441b7b10..cb45911ac0 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -507,6 +507,11 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING },
+         { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP },
+         { S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_UV_FEAT_AP },
+        { S390_FEAT_PFCR_QAF, S390_FEAT_CCF_BASE },
+        { S390_FEAT_PFCR_CSDST, S390_FEAT_CCF_BASE },
+        { S390_FEAT_PFCR_CSDSTG, S390_FEAT_CCF_BASE },
+        { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
+        { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
+     };
+     int i;
+ 
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 302b653214..6d00ffcda7 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -308,6 +308,14 @@
+     S390_FEAT_DEFLATE_XPND, \
+     S390_FEAT_DEFLATE_F0
+ 
+#define S390_FEAT_GROUP_CONCURRENT_FUNCTIONS \
+    S390_FEAT_CCF_BASE, \
+    S390_FEAT_PFCR_QAF, \
+    S390_FEAT_PFCR_CSDST, \
+    S390_FEAT_PFCR_CSDSTG, \
+    S390_FEAT_PFCR_CSTST, \
+    S390_FEAT_PFCR_CSTSTG
+
+ /* cpu feature groups */
+ static uint16_t group_PLO[] = {
+     S390_FEAT_GROUP_PLO,
+@@ -398,6 +406,10 @@ static uint16_t group_DEFLATE_CONVERSION[] = {
+     S390_FEAT_GROUP_DEFLATE_CONVERSION,
+ };
+ 
+static uint16_t group_CONCURRENT_FUNCTIONS[] = {
+    S390_FEAT_GROUP_CONCURRENT_FUNCTIONS,
+};
+
+ /* Base features (in order of release)
+  * Only non-hypervisor managed features belong here.
+  * Base feature sets are static meaning they do not change in future QEMU
+@@ -948,6 +960,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
+     FEAT_GROUP_INITIALIZER(ENH_SORT),
+     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
+    FEAT_GROUP_INITIALIZER(CONCURRENT_FUNCTIONS),
+ };
+ 
+ #define QEMU_FEAT_INITIALIZER(_name)                   \
+diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
+index 8ffe0159d8..dd0322c43a 100644
+--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
+@@ -2195,6 +2195,9 @@ static int query_cpu_subfunc(S390FeatBitmap features)
+     if (test_bit(S390_FEAT_DEFLATE_BASE, features)) {
+         s390_add_from_feat_block(features, S390_FEAT_TYPE_DFLTCC, prop.dfltcc);
+     }
+    if (test_bit(S390_FEAT_CCF_BASE, features)) {
+        s390_add_from_feat_block(features, S390_FEAT_TYPE_PFCR, prop.pfcr);
+    }
+     return 0;
+ }
+ 
+@@ -2248,6 +2251,9 @@ static int configure_cpu_subfunc(const S390FeatBitmap features)
+     if (test_bit(S390_FEAT_DEFLATE_BASE, features)) {
+         s390_fill_feat_block(features, S390_FEAT_TYPE_DFLTCC, prop.dfltcc);
+     }
+    if (test_bit(S390_FEAT_CCF_BASE, features)) {
+        s390_fill_feat_block(features, S390_FEAT_TYPE_PFCR, prop.pfcr);
+    }
+     return kvm_vm_ioctl(kvm_state, KVM_SET_DEVICE_ATTR, &attr);
+ }
+ 
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
+++ b/kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
@ -0,0 +1,56 @@
+From e54ca265e81453305c96adce3e521d543ac124a6 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:47 +0100
+Subject: [PATCH 12/18] s390x/cpumodel: add
+ Ineffective-nonconstrained-transaction facility
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [12/16] 1a5530bb0a42f5771a46bb21934b77035d26aa54 (thuth/qemu-kvm-cs9)
+
+This facility indicates reduced support for noncontrained
+transactional-execution.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-12-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 12417b713c1fffc26c680e99e3429f055eb9af2e)
+---
+ target/s390x/cpu_features_def.h.inc | 1 +
+ target/s390x/cpu_models.c           | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index df154d145f..2c1d1cd98a 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -112,6 +112,7 @@ DEF_FEAT(MSA_EXT_9, "msa9-base", STFL, 155, "Message-security-assist-extension-9
+ DEF_FEAT(ETOKEN, "etoken", STFL, 156, "Etoken facility")
+ DEF_FEAT(UNPACK, "unpack", STFL, 161, "Unpack facility")
+ DEF_FEAT(NNPA, "nnpa", STFL, 165, "NNPA facility")
+DEF_FEAT(INEFF_NC_TX, "ineff_nc_tx", STFL, 170, "Ineffective-nonconstrained-transaction facility")
+ DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH2, "vxpdeh2", STFL, 192, "Vector-Packed-Decimal-Enhancement facility 2")
+ DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
+ DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index 94cc6a0f3e..9e9f6dae07 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -515,6 +515,7 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_PFCR_CSDSTG, S390_FEAT_CCF_BASE },
+         { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
+         { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
+        { S390_FEAT_INEFF_NC_TX, S390_FEAT_TRANSACTIONAL_EXE },
+     };
+     int i;
+ 
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
+++ b/kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
@ -0,0 +1,42 @@
+From f836a70baeebc6cfff87f3b8cf39bc82225cd88f Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:45 +0100
+Subject: [PATCH 10/18] s390x/cpumodel: add
+ Miscellaneous-Instruction-Extensions Facility 4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [10/16] 375acf46d9a9950c939e0bf95c6512f6df3b3b3d (thuth/qemu-kvm-cs9)
+
+This facility introduces few new instructions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-10-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit e68e5ea6fe87c0177ea6421045c1d46f223a861e)
+---
+ target/s390x/cpu_features_def.h.inc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 0b7be0e6e9..8be2e0e46d 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -90,6 +90,7 @@ DEF_FEAT(EDAT_2, "edat2", STFL, 78, "Enhanced-DAT facility 2")
+ DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packed-conversion facility")
+ DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
+ DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
+DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
+ DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
+ DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
+ DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
+++ b/kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
@ -0,0 +1,56 @@
+From 38d15311c53d6f973ad6bcffe5a851fed58d82cf Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:44 +0100
+Subject: [PATCH 09/18] s390x/cpumodel: add Vector Enhancements facility 3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [9/16] 0e28c1a3a458b035a165e6d0f6e65290efce4cf0 (thuth/qemu-kvm-cs9)
+
+The Vector Enhancements facility 3 introduces new instructions and
+extends support for doubleword/quadword elements.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-9-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 0b2c66a3fa5ccecf26ea011d97d65a986b42b4d8)
+---
+ target/s390x/cpu_features_def.h.inc | 1 +
+ target/s390x/cpu_models.c           | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 09872ab3d8..0b7be0e6e9 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -116,6 +116,7 @@ DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
+ DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
+ DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
+ DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
+DEF_FEAT(VECTOR_ENH3, "vxeh3", STFL, 198, "Vector Enhancements facility 3")
+ DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
+ 
+ /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index cb45911ac0..5fb5c6f38e 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -461,6 +461,8 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
+         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
+         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
+        { S390_FEAT_VECTOR_ENH2, S390_FEAT_VECTOR_ENH },
+        { S390_FEAT_VECTOR_ENH3, S390_FEAT_VECTOR_ENH2 },
+         { S390_FEAT_INSTRUCTION_EXEC_PROT, S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2 },
+         { S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2, S390_FEAT_ESOP },
+         { S390_FEAT_CMM_NT, S390_FEAT_CMM },
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
+++ b/kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
@ -0,0 +1,56 @@
+From 846d00e369c2ff33201c4a7ae4a303f4feb82c8f Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:46 +0100
+Subject: [PATCH 11/18] s390x/cpumodel: add Vector-Packed-Decimal-Enhancement
+ facility 3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [11/16] 4ab6618fe8fda8277fc92d0de6505df034f8c9fe (thuth/qemu-kvm-cs9)
+
+This facility introduces new capabilities for the signed-pack-decimal
+format.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-11-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit db4c208abde53a7ed16d566bf63a3520894bba8d)
+---
+ target/s390x/cpu_features_def.h.inc | 1 +
+ target/s390x/cpu_models.c           | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 8be2e0e46d..df154d145f 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -118,6 +118,7 @@ DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
+ DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
+ DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
+ DEF_FEAT(VECTOR_ENH3, "vxeh3", STFL, 198, "Vector Enhancements facility 3")
+DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH3, "vxpdeh3", STFL, 199, "Vector-Packed-Decimal-Enhancement facility 3")
+ DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
+ 
+ /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index 5fb5c6f38e..94cc6a0f3e 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -460,6 +460,7 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_VECTOR_PACKED_DECIMAL, S390_FEAT_VECTOR },
+         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
+         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
+        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2 },
+         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
+         { S390_FEAT_VECTOR_ENH2, S390_FEAT_VECTOR_ENH },
+         { S390_FEAT_VECTOR_ENH3, S390_FEAT_VECTOR_ENH2 },
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-msa10-subfunctions.patch
+++ b/kvm-s390x-cpumodel-add-msa10-subfunctions.patch
@ -0,0 +1,133 @@
+From be8c87d33304948258dad5e46582c588ff795344 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:37 +0100
+Subject: [PATCH 02/18] s390x/cpumodel: add msa10 subfunctions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [2/16] 967e78e0d496cf5241bfcee7b96b0308b5cedbda (thuth/qemu-kvm-cs9)
+
+MSA10 introduces new AES XTS subfunctions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Message-ID: <20241206122751.189721-2-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 1029cd5b9827ba6aa7f5e02eed1928a928e2fa5e)
+---
+ target/s390x/cpu_features.c         |  2 ++
+ target/s390x/cpu_features_def.h.inc |  6 ++++++
+ target/s390x/cpu_models.c           |  4 ++++
+ target/s390x/gen-features.c         | 20 ++++++++++++++++++++
+ 4 files changed, 32 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index cb4e2b8920..a3c239595a 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -252,6 +252,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("msa8", MSA_EXT_8, "Message-security-assist-extension 8 facility"),
+     FEAT_GROUP_INIT("msa9", MSA_EXT_9, "Message-security-assist-extension 9 facility"),
+     FEAT_GROUP_INIT("msa9_pckmo", MSA_EXT_9_PCKMO, "Message-security-assist-extension 9 PCKMO subfunctions"),
+    FEAT_GROUP_INIT("msa10", MSA_EXT_10, "Message-security-assist-extension 10 facility"),
+    FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
+     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
+     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index c53ac13352..104d186c3f 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -233,6 +233,10 @@ DEF_FEAT(KM_XTS_AES_128, "km-xts-aes-128", KM, 50, "KM XTS-AES-128")
+ DEF_FEAT(KM_XTS_AES_256, "km-xts-aes-256", KM, 52, "KM XTS-AES-256")
+ DEF_FEAT(KM_XTS_EAES_128, "km-xts-eaes-128", KM, 58, "KM XTS-Encrypted-AES-128")
+ DEF_FEAT(KM_XTS_EAES_256, "km-xts-eaes-256", KM, 60, "KM XTS-Encrypted-AES-256")
+DEF_FEAT(KM_FULL_XTS_AES_128, "km-full-xts-aes-128", KM, 82, "KM Full-XTS-AES-128")
+DEF_FEAT(KM_FULL_XTS_AES_256, "km-full-xts-aes-256", KM, 84, "KM Full-XTS-AES-256")
+DEF_FEAT(KM_FULL_XTS_EAES_128, "km-full-xts-eaes-128", KM, 90, "KM Full-XTS-Encrypted-AES-128")
+DEF_FEAT(KM_FULL_XTS_EAES_256, "km-full-xts-eaes-256", KM, 92, "KM Full-XTS-Encrypted-AES-256")
+ 
+ /* Features exposed via the KIMD instruction. */
+ DEF_FEAT(KIMD_SHA_1, "kimd-sha-1", KIMD, 1, "KIMD SHA-1")
+@@ -264,6 +268,8 @@ DEF_FEAT(PCKMO_ETDEA_256, "pckmo-etdea-192", PCKMO, 3, "PCKMO Encrypted-TDEA-192
+ DEF_FEAT(PCKMO_AES_128, "pckmo-aes-128", PCKMO, 18, "PCKMO Encrypted-AES-128-Key")
+ DEF_FEAT(PCKMO_AES_192, "pckmo-aes-192", PCKMO, 19, "PCKMO Encrypted-AES-192-Key")
+ DEF_FEAT(PCKMO_AES_256, "pckmo-aes-256", PCKMO, 20, "PCKMO Encrypted-AES-256-Key")
+DEF_FEAT(PCKMO_AES_XTS_128_DK, "pckmo-aes-xts-128-dk", PCKMO, 21, "PCKMO Encrypt-AES-XTS-128-Double-Key")
+DEF_FEAT(PCKMO_AES_XTS_256_DK, "pckmo-aes-xts-256-dk", PCKMO, 22, "PCKMO Encrypt-AES-XTS-256-Double-Key")
+ DEF_FEAT(PCKMO_ECC_P256, "pckmo-ecc-p256", PCKMO, 32, "PCKMO Encrypt-ECC-P256-Key")
+ DEF_FEAT(PCKMO_ECC_P384, "pckmo-ecc-p384", PCKMO, 33, "PCKMO Encrypt-ECC-P384-Key")
+ DEF_FEAT(PCKMO_ECC_P521, "pckmo-ecc-p521", PCKMO, 34, "PCKMO Encrypt-ECC-P521-Key")
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index 8afa9af1a5..e71c445379 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -480,6 +480,10 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_KLMD_SHA3_512, S390_FEAT_MSA },
+         { S390_FEAT_KLMD_SHAKE_128, S390_FEAT_MSA },
+         { S390_FEAT_KLMD_SHAKE_256, S390_FEAT_MSA },
+        { S390_FEAT_KM_FULL_XTS_AES_128, S390_FEAT_MSA_EXT_4 },
+        { S390_FEAT_KM_FULL_XTS_AES_256, S390_FEAT_MSA_EXT_4 },
+        { S390_FEAT_KM_FULL_XTS_EAES_128, S390_FEAT_MSA_EXT_4 },
+        { S390_FEAT_KM_FULL_XTS_EAES_256, S390_FEAT_MSA_EXT_4 },
+         { S390_FEAT_PRNO_TRNG_QRTCR, S390_FEAT_MSA_EXT_5 },
+         { S390_FEAT_PRNO_TRNG, S390_FEAT_MSA_EXT_5 },
+         { S390_FEAT_SIE_KSS, S390_FEAT_SIE_F2 },
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 2b2bfc3736..06c3bf64f3 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -246,6 +246,16 @@
+     S390_FEAT_PCKMO_ECC_ED25519, \
+     S390_FEAT_PCKMO_ECC_ED448
+ 
+#define S390_FEAT_GROUP_MSA_EXT_10 \
+    S390_FEAT_KM_FULL_XTS_AES_128, \
+    S390_FEAT_KM_FULL_XTS_AES_256, \
+    S390_FEAT_KM_FULL_XTS_EAES_128, \
+    S390_FEAT_KM_FULL_XTS_EAES_256
+
+#define S390_FEAT_GROUP_MSA_EXT_10_PCKMO \
+    S390_FEAT_PCKMO_AES_XTS_128_DK, \
+    S390_FEAT_PCKMO_AES_XTS_256_DK
+
+ #define S390_FEAT_GROUP_ENH_SORT \
+     S390_FEAT_ESORT_BASE, \
+     S390_FEAT_SORTL_SFLR, \
+@@ -307,10 +317,18 @@ static uint16_t group_MSA_EXT_9[] = {
+     S390_FEAT_GROUP_MSA_EXT_9,
+ };
+ 
+static uint16_t group_MSA_EXT_10[] = {
+    S390_FEAT_GROUP_MSA_EXT_10,
+};
+
+ static uint16_t group_MSA_EXT_9_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
+ };
+ 
+static uint16_t group_MSA_EXT_10_PCKMO[] = {
+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
+};
+
+ static uint16_t group_ENH_SORT[] = {
+     S390_FEAT_GROUP_ENH_SORT,
+ };
+@@ -858,6 +876,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(MSA_EXT_8),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_9),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_9_PCKMO),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_10),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
+     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
+     FEAT_GROUP_INITIALIZER(ENH_SORT),
+     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-msa11-subfunctions.patch
+++ b/kvm-s390x-cpumodel-add-msa11-subfunctions.patch
@ -0,0 +1,148 @@
+From 328b55dd31fce9e849d8dd10124cda47013d3035 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:38 +0100
+Subject: [PATCH 03/18] s390x/cpumodel: add msa11 subfunctions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [3/16] 8b4158361a17d973fa30a7bcb9d911a2c5a42b14 (thuth/qemu-kvm-cs9)
+
+MSA11 introduces new HMAC subfunctions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Message-ID: <20241206122751.189721-3-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 11dc9020824c81552b021fbe0e2910e0348e7f8e)
+---
+ target/s390x/cpu_features.c         |  2 ++
+ target/s390x/cpu_features_def.h.inc | 10 ++++++++++
+ target/s390x/cpu_models.c           |  8 ++++++++
+ target/s390x/gen-features.c         | 24 ++++++++++++++++++++++++
+ 4 files changed, 44 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index a3c239595a..36930feccd 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -254,6 +254,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("msa9_pckmo", MSA_EXT_9_PCKMO, "Message-security-assist-extension 9 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("msa10", MSA_EXT_10, "Message-security-assist-extension 10 facility"),
+     FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
+    FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
+    FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
+     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
+     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 104d186c3f..15ea51fc54 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -200,6 +200,14 @@ DEF_FEAT(KMAC_AES_256, "kmac-aes-256", KMAC, 20, "KMAC AES-256")
+ DEF_FEAT(KMAC_EAES_128, "kmac-eaes-128", KMAC, 26, "KMAC Encrypted-AES-128")
+ DEF_FEAT(KMAC_EAES_192, "kmac-eaes-192", KMAC, 27, "KMAC Encrypted-AES-192")
+ DEF_FEAT(KMAC_EAES_256, "kmac-eaes-256", KMAC, 28, "KMAC Encrypted-AES-256")
+DEF_FEAT(KMAC_HMAC_SHA_224, "kmac-hmac-sha-224", KMAC, 112, "KMAC HMAC-SHA-224")
+DEF_FEAT(KMAC_HMAC_SHA_256, "kmac-hmac-sha-246", KMAC, 113, "KMAC HMAC-SHA-256")
+DEF_FEAT(KMAC_HMAC_SHA_384, "kmac-hmac-sha-384", KMAC, 114, "KMAC HMAC-SHA-384")
+DEF_FEAT(KMAC_HMAC_SHA_512, "kmac-hmac-sha-512", KMAC, 115, "KMAC HMAC-SHA-512")
+DEF_FEAT(KMAC_HMAC_ESHA_224, "kmac-hmac-esha-224", KMAC, 120, "KMAC HMAC-Encrypted-SHA-224")
+DEF_FEAT(KMAC_HMAC_ESHA_256, "kmac-hmac-esha-246", KMAC, 121, "KMAC HMAC-Encrypted-SHA-256")
+DEF_FEAT(KMAC_HMAC_ESHA_384, "kmac-hmac-esha-384", KMAC, 122, "KMAC HMAC-Encrypted-SHA-384")
+DEF_FEAT(KMAC_HMAC_ESHA_512, "kmac-hmac-esha-512", KMAC, 123, "KMAC HMAC-Encrypted-SHA-512")
+ 
+ /* Features exposed via the KMC instruction. */
+ DEF_FEAT(KMC_DEA, "kmc-dea", KMC, 1, "KMC DEA")
+@@ -275,6 +283,8 @@ DEF_FEAT(PCKMO_ECC_P384, "pckmo-ecc-p384", PCKMO, 33, "PCKMO Encrypt-ECC-P384-Ke
+ DEF_FEAT(PCKMO_ECC_P521, "pckmo-ecc-p521", PCKMO, 34, "PCKMO Encrypt-ECC-P521-Key")
+ DEF_FEAT(PCKMO_ECC_ED25519, "pckmo-ecc-ed25519", PCKMO, 40 , "PCKMO Encrypt-ECC-Ed25519-Key")
+ DEF_FEAT(PCKMO_ECC_ED448, "pckmo-ecc-ed448", PCKMO, 41 , "PCKMO Encrypt-ECC-Ed448-Key")
+DEF_FEAT(PCKMO_HMAC_512, "pckmo-hmac-512", PCKMO, 118, "PCKMO Encrypt-HMAC-512-Key")
+DEF_FEAT(PCKMO_HMAC_1024, "pckmo-hmac-1024", PCKMO, 122, "PCKMO Encrypt-HMAC-1024-Key")
+ 
+ /* Features exposed via the KMCTR instruction. */
+ DEF_FEAT(KMCTR_DEA, "kmctr-dea", KMCTR, 1, "KMCTR DEA")
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index e71c445379..da441b7b10 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -480,6 +480,14 @@ static void check_consistency(const S390CPUModel *model)
+         { S390_FEAT_KLMD_SHA3_512, S390_FEAT_MSA },
+         { S390_FEAT_KLMD_SHAKE_128, S390_FEAT_MSA },
+         { S390_FEAT_KLMD_SHAKE_256, S390_FEAT_MSA },
+        { S390_FEAT_KMAC_HMAC_SHA_224, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_SHA_256, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_SHA_384, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_SHA_512, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_ESHA_224, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_ESHA_256, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_ESHA_384, S390_FEAT_MSA_EXT_3 },
+        { S390_FEAT_KMAC_HMAC_ESHA_512, S390_FEAT_MSA_EXT_3 },
+         { S390_FEAT_KM_FULL_XTS_AES_128, S390_FEAT_MSA_EXT_4 },
+         { S390_FEAT_KM_FULL_XTS_AES_256, S390_FEAT_MSA_EXT_4 },
+         { S390_FEAT_KM_FULL_XTS_EAES_128, S390_FEAT_MSA_EXT_4 },
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 06c3bf64f3..d6305f945a 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -256,6 +256,20 @@
+     S390_FEAT_PCKMO_AES_XTS_128_DK, \
+     S390_FEAT_PCKMO_AES_XTS_256_DK
+ 
+#define S390_FEAT_GROUP_MSA_EXT_11 \
+    S390_FEAT_KMAC_HMAC_SHA_224, \
+    S390_FEAT_KMAC_HMAC_SHA_256, \
+    S390_FEAT_KMAC_HMAC_SHA_384, \
+    S390_FEAT_KMAC_HMAC_SHA_512, \
+    S390_FEAT_KMAC_HMAC_ESHA_224, \
+    S390_FEAT_KMAC_HMAC_ESHA_256, \
+    S390_FEAT_KMAC_HMAC_ESHA_384, \
+    S390_FEAT_KMAC_HMAC_ESHA_512
+
+#define S390_FEAT_GROUP_MSA_EXT_11_PCKMO \
+    S390_FEAT_PCKMO_HMAC_512, \
+    S390_FEAT_PCKMO_HMAC_1024
+
+ #define S390_FEAT_GROUP_ENH_SORT \
+     S390_FEAT_ESORT_BASE, \
+     S390_FEAT_SORTL_SFLR, \
+@@ -321,6 +335,10 @@ static uint16_t group_MSA_EXT_10[] = {
+     S390_FEAT_GROUP_MSA_EXT_10,
+ };
+ 
+static uint16_t group_MSA_EXT_11[] = {
+    S390_FEAT_GROUP_MSA_EXT_11,
+};
+
+ static uint16_t group_MSA_EXT_9_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
+ };
+@@ -329,6 +347,10 @@ static uint16_t group_MSA_EXT_10_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
+ };
+ 
+static uint16_t group_MSA_EXT_11_PCKMO[] = {
+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
+};
+
+ static uint16_t group_ENH_SORT[] = {
+     S390_FEAT_GROUP_ENH_SORT,
+ };
+@@ -878,6 +900,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(MSA_EXT_9_PCKMO),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_10),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_11),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
+     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
+     FEAT_GROUP_INITIALIZER(ENH_SORT),
+     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-msa12-changes.patch
+++ b/kvm-s390x-cpumodel-add-msa12-changes.patch
@ -0,0 +1,88 @@
+From 2016aa4ba5c5aecae350ce6ea81462c9ab5956c3 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:39 +0100
+Subject: [PATCH 04/18] s390x/cpumodel: add msa12 changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [4/16] c878296ee5c4f99f67f1c68172536b521be60e04 (thuth/qemu-kvm-cs9)
+
+MSA12 changes the KIMD/KLMD instruction format for SHA3/SHAKE.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Message-ID: <20241206122751.189721-4-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 496fc02e0e532f8917fa96e45fa531231e821c31)
+---
+ target/s390x/cpu_features.c         | 1 +
+ target/s390x/cpu_features_def.h.inc | 1 +
+ target/s390x/gen-features.c         | 8 ++++++++
+ 3 files changed, 10 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index 36930feccd..0e0b37ab95 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -256,6 +256,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
+     FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
+    FEAT_GROUP_INIT("msa12", MSA_EXT_12, "Message-security-assist-extension 12 facility"),
+     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
+     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
+     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 15ea51fc54..2e5dc96984 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -90,6 +90,7 @@ DEF_FEAT(EDAT_2, "edat2", STFL, 78, "Enhanced-DAT facility 2")
+ DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packed-conversion facility")
+ DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
+ DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
+DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
+ DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
+ DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
+ DEF_FEAT(SIDE_EFFECT_ACCESS_ESOP2, "sea_esop2", STFL, 131, "Side-effect-access facility and Enhanced-suppression-on-protection facility 2")
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index d6305f945a..ab9ad51d5e 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -270,6 +270,9 @@
+     S390_FEAT_PCKMO_HMAC_512, \
+     S390_FEAT_PCKMO_HMAC_1024
+ 
+#define S390_FEAT_GROUP_MSA_EXT_12 \
+    S390_FEAT_MSA_EXT_12
+
+ #define S390_FEAT_GROUP_ENH_SORT \
+     S390_FEAT_ESORT_BASE, \
+     S390_FEAT_SORTL_SFLR, \
+@@ -339,6 +342,10 @@ static uint16_t group_MSA_EXT_11[] = {
+     S390_FEAT_GROUP_MSA_EXT_11,
+ };
+ 
+static uint16_t group_MSA_EXT_12[] = {
+    S390_FEAT_GROUP_MSA_EXT_12,
+};
+
+ static uint16_t group_MSA_EXT_9_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
+ };
+@@ -902,6 +909,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_11),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_12),
+     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
+     FEAT_GROUP_INITIALIZER(ENH_SORT),
+     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-add-msa13-subfunctions.patch
+++ b/kvm-s390x-cpumodel-add-msa13-subfunctions.patch
@ -0,0 +1,200 @@
+From 003efbebc77300d3004f4613255e04058165ff33 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:40 +0100
+Subject: [PATCH 05/18] s390x/cpumodel: add msa13 subfunctions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [5/16] b3f42a4a831bc0582e3c14da6387d7db440c3c41 (thuth/qemu-kvm-cs9)
+
+MSA13 introduces query authentication information (QAI) subfunctions.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-5-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit ba4614fdacc2ea55060ddb48bdb2ebd21d0c3464)
+---
+ target/s390x/cpu_features.c         |  2 ++
+ target/s390x/cpu_features_def.h.inc | 12 ++++++++++++
+ target/s390x/gen-features.c         | 26 ++++++++++++++++++++++++++
+ 3 files changed, 40 insertions(+)
+
+diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
+index 0e0b37ab95..9ba127e386 100644
+--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
+@@ -257,6 +257,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
+     FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
+     FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("msa12", MSA_EXT_12, "Message-security-assist-extension 12 facility"),
+    FEAT_GROUP_INIT("msa13", MSA_EXT_13, "Message-security-assist-extension 13 facility"),
+    FEAT_GROUP_INIT("msa13_pckmo", MSA_EXT_13_PCKMO, "Message-security-assist-extension 13 PCKMO subfunctions"),
+     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
+     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
+     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 2e5dc96984..2132837ffe 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -209,6 +209,7 @@ DEF_FEAT(KMAC_HMAC_ESHA_224, "kmac-hmac-esha-224", KMAC, 120, "KMAC HMAC-Encrypt
+ DEF_FEAT(KMAC_HMAC_ESHA_256, "kmac-hmac-esha-246", KMAC, 121, "KMAC HMAC-Encrypted-SHA-256")
+ DEF_FEAT(KMAC_HMAC_ESHA_384, "kmac-hmac-esha-384", KMAC, 122, "KMAC HMAC-Encrypted-SHA-384")
+ DEF_FEAT(KMAC_HMAC_ESHA_512, "kmac-hmac-esha-512", KMAC, 123, "KMAC HMAC-Encrypted-SHA-512")
+DEF_FEAT(KMAC_QAI, "kmac-qai", KMAC, 127, "KMAC Query-Authentication-Information")
+ 
+ /* Features exposed via the KMC instruction. */
+ DEF_FEAT(KMC_DEA, "kmc-dea", KMC, 1, "KMC DEA")
+@@ -246,6 +247,7 @@ DEF_FEAT(KM_FULL_XTS_AES_128, "km-full-xts-aes-128", KM, 82, "KM Full-XTS-AES-12
+ DEF_FEAT(KM_FULL_XTS_AES_256, "km-full-xts-aes-256", KM, 84, "KM Full-XTS-AES-256")
+ DEF_FEAT(KM_FULL_XTS_EAES_128, "km-full-xts-eaes-128", KM, 90, "KM Full-XTS-Encrypted-AES-128")
+ DEF_FEAT(KM_FULL_XTS_EAES_256, "km-full-xts-eaes-256", KM, 92, "KM Full-XTS-Encrypted-AES-256")
+DEF_FEAT(KM_QAI, "km-qai", KM, 127, "KM Query-Authentication-Information")
+ 
+ /* Features exposed via the KIMD instruction. */
+ DEF_FEAT(KIMD_SHA_1, "kimd-sha-1", KIMD, 1, "KIMD SHA-1")
+@@ -258,6 +260,7 @@ DEF_FEAT(KIMD_SHA3_512, "kimd-sha3-512", KIMD, 35, "KIMD SHA3-512")
+ DEF_FEAT(KIMD_SHAKE_128, "kimd-shake-128", KIMD, 36, "KIMD SHAKE-128")
+ DEF_FEAT(KIMD_SHAKE_256, "kimd-shake-256", KIMD, 37, "KIMD SHAKE-256")
+ DEF_FEAT(KIMD_GHASH, "kimd-ghash", KIMD, 65, "KIMD GHASH")
+DEF_FEAT(KIMD_QAI, "kimd-qai", KIMD, 127, "KIMD Query-Authentication-Information")
+ 
+ /* Features exposed via the KLMD instruction. */
+ DEF_FEAT(KLMD_SHA_1, "klmd-sha-1", KLMD, 1, "KLMD SHA-1")
+@@ -269,6 +272,7 @@ DEF_FEAT(KLMD_SHA3_384, "klmd-sha3-384", KLMD, 34, "KLMD SHA3-384")
+ DEF_FEAT(KLMD_SHA3_512, "klmd-sha3-512", KLMD, 35, "KLMD SHA3-512")
+ DEF_FEAT(KLMD_SHAKE_128, "klmd-shake-128", KLMD, 36, "KLMD SHAKE-128")
+ DEF_FEAT(KLMD_SHAKE_256, "klmd-shake-256", KLMD, 37, "KLMD SHAKE-256")
+DEF_FEAT(KLMD_QAI, "klmd-qai", KLMD, 127, "KLMD Query-Authentication-Information")
+ 
+ /* Features exposed via the PCKMO instruction. */
+ DEF_FEAT(PCKMO_EDEA, "pckmo-edea", PCKMO, 1, "PCKMO Encrypted-DEA-Key")
+@@ -286,6 +290,7 @@ DEF_FEAT(PCKMO_ECC_ED25519, "pckmo-ecc-ed25519", PCKMO, 40 , "PCKMO Encrypt-ECC-
+ DEF_FEAT(PCKMO_ECC_ED448, "pckmo-ecc-ed448", PCKMO, 41 , "PCKMO Encrypt-ECC-Ed448-Key")
+ DEF_FEAT(PCKMO_HMAC_512, "pckmo-hmac-512", PCKMO, 118, "PCKMO Encrypt-HMAC-512-Key")
+ DEF_FEAT(PCKMO_HMAC_1024, "pckmo-hmac-1024", PCKMO, 122, "PCKMO Encrypt-HMAC-1024-Key")
+DEF_FEAT(PCKMO_QAI, "pckmo-qai", PCKMO, 127, "PCKMO Query-Authentication-Information")
+ 
+ /* Features exposed via the KMCTR instruction. */
+ DEF_FEAT(KMCTR_DEA, "kmctr-dea", KMCTR, 1, "KMCTR DEA")
+@@ -300,6 +305,7 @@ DEF_FEAT(KMCTR_AES_256, "kmctr-aes-256", KMCTR, 20, "KMCTR AES-256")
+ DEF_FEAT(KMCTR_EAES_128, "kmctr-eaes-128", KMCTR, 26, "KMCTR Encrypted-AES-128")
+ DEF_FEAT(KMCTR_EAES_192, "kmctr-eaes-192", KMCTR, 27, "KMCTR Encrypted-AES-192")
+ DEF_FEAT(KMCTR_EAES_256, "kmctr-eaes-256", KMCTR, 28, "KMCTR Encrypted-AES-256")
+DEF_FEAT(KMCTR_QAI, "kmctr-qai", KMCTR, 127, "KMCTR Query-Authentication-Information")
+ 
+ /* Features exposed via the KMF instruction. */
+ DEF_FEAT(KMF_DEA, "kmf-dea", KMF, 1, "KMF DEA")
+@@ -314,6 +320,7 @@ DEF_FEAT(KMF_AES_256, "kmf-aes-256", KMF, 20, "KMF AES-256")
+ DEF_FEAT(KMF_EAES_128, "kmf-eaes-128", KMF, 26, "KMF Encrypted-AES-128")
+ DEF_FEAT(KMF_EAES_192, "kmf-eaes-192", KMF, 27, "KMF Encrypted-AES-192")
+ DEF_FEAT(KMF_EAES_256, "kmf-eaes-256", KMF, 28, "KMF Encrypted-AES-256")
+DEF_FEAT(KMF_QAI, "kmf-qai", KMF, 127, "KMF Query-Authentication-Information")
+ 
+ /* Features exposed via the KMO instruction. */
+ DEF_FEAT(KMO_DEA, "kmo-dea", KMO, 1, "KMO DEA")
+@@ -328,6 +335,7 @@ DEF_FEAT(KMO_AES_256, "kmo-aes-256", KMO, 20, "KMO AES-256")
+ DEF_FEAT(KMO_EAES_128, "kmo-eaes-128", KMO, 26, "KMO Encrypted-AES-128")
+ DEF_FEAT(KMO_EAES_192, "kmo-eaes-192", KMO, 27, "KMO Encrypted-AES-192")
+ DEF_FEAT(KMO_EAES_256, "kmo-eaes-256", KMO, 28, "KMO Encrypted-AES-256")
+DEF_FEAT(KMO_QAI, "kmo-qai", KMO, 127, "KMO Query-Authentication-Information")
+ 
+ /* Features exposed via the PCC instruction. */
+ DEF_FEAT(PCC_CMAC_DEA, "pcc-cmac-dea", PCC, 1, "PCC Compute-Last-Block-CMAC-Using-DEA")
+@@ -353,11 +361,13 @@ DEF_FEAT(PCC_SCALAR_MULT_ED25519, "pcc-scalar-mult-ed25519", PCC, 72, "PCC Scala
+ DEF_FEAT(PCC_SCALAR_MULT_ED448, "pcc-scalar-mult-ed448", PCC, 73, "PCC Scalar-Multiply-Ed448")
+ DEF_FEAT(PCC_SCALAR_MULT_X25519, "pcc-scalar-mult-x25519", PCC, 80, "PCC Scalar-Multiply-X25519")
+ DEF_FEAT(PCC_SCALAR_MULT_X448, "pcc-scalar-mult-x448", PCC, 81, "PCC Scalar-Multiply-X448")
+DEF_FEAT(PCC_QAI, "pcc-qai", PCC, 127, "PCC Query-Authentication-Information")
+ 
+ /* Features exposed via the PPNO/PRNO instruction. */
+ DEF_FEAT(PPNO_SHA_512_DRNG, "ppno-sha-512-drng", PPNO, 3, "PPNO SHA-512-DRNG")
+ DEF_FEAT(PRNO_TRNG_QRTCR, "prno-trng-qrtcr", PPNO, 112, "PRNO TRNG-Query-Raw-to-Conditioned-Ratio")
+ DEF_FEAT(PRNO_TRNG, "prno-trng", PPNO, 114, "PRNO TRNG")
+DEF_FEAT(PRNO_QAI, "prno-qai", PPNO, 127, "PRNO Query-Authentication-Information")
+ 
+ /* Features exposed via the KMA instruction. */
+ DEF_FEAT(KMA_GCM_AES_128, "kma-gcm-aes-128", KMA, 18, "KMA GCM-AES-128")
+@@ -366,6 +376,7 @@ DEF_FEAT(KMA_GCM_AES_256, "kma-gcm-aes-256", KMA, 20, "KMA GCM-AES-256")
+ DEF_FEAT(KMA_GCM_EAES_128, "kma-gcm-eaes-128", KMA, 26, "KMA GCM-Encrypted-AES-128")
+ DEF_FEAT(KMA_GCM_EAES_192, "kma-gcm-eaes-192", KMA, 27, "KMA GCM-Encrypted-AES-192")
+ DEF_FEAT(KMA_GCM_EAES_256, "kma-gcm-eaes-256", KMA, 28, "KMA GCM-Encrypted-AES-256")
+DEF_FEAT(KMA_QAI, "kma-qai", KMA, 127, "KMA Query-Authentication-Information")
+ 
+ /* Features exposed via the KDSA instruction. */
+ DEF_FEAT(KDSA_ECDSA_VERIFY_P256, "kdsa-ecdsa-verify-p256", KDSA, 1, "KDSA ECDSA-Verify-P256")
+@@ -383,6 +394,7 @@ DEF_FEAT(KDSA_EDDSA_SIGN_ED25519, "kdsa-eddsa-sign-ed25519", KDSA, 40, "KDSA EdD
+ DEF_FEAT(KDSA_EDDSA_SIGN_ED448, "kdsa-eddsa-sign-ed448", KDSA, 44, "KDSA EdDSA-Sign-Ed448")
+ DEF_FEAT(KDSA_EEDDSA_SIGN_ED25519, "kdsa-eeddsa-sign-ed25519", KDSA, 48, "KDSA Encrypted-EdDSA-Sign-Ed25519")
+ DEF_FEAT(KDSA_EEDDSA_SIGN_ED448, "kdsa-eeddsa-sign-ed448", KDSA, 52, "KDSA Encrypted-EdDSA-Sign-Ed448")
+DEF_FEAT(KDSA_QAI, "kdsa-qai", KDSA, 127, "KDSA Query-Authentication-Information")
+ 
+ /* Features exposed via the SORTL instruction. */
+ DEF_FEAT(SORTL_SFLR, "sortl-sflr", SORTL, 1, "SORTL SFLR")
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index ab9ad51d5e..3326e7df43 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -273,6 +273,22 @@
+ #define S390_FEAT_GROUP_MSA_EXT_12 \
+     S390_FEAT_MSA_EXT_12
+ 
+#define S390_FEAT_GROUP_MSA_EXT_13 \
+    S390_FEAT_KDSA_QAI, \
+    S390_FEAT_KIMD_QAI, \
+    S390_FEAT_KLMD_QAI, \
+    S390_FEAT_KMAC_QAI, \
+    S390_FEAT_KMA_QAI, \
+    S390_FEAT_KMCTR_QAI, \
+    S390_FEAT_KMF_QAI, \
+    S390_FEAT_KMO_QAI, \
+    S390_FEAT_KM_QAI, \
+    S390_FEAT_PCC_QAI, \
+    S390_FEAT_PRNO_QAI
+
+#define S390_FEAT_GROUP_MSA_EXT_13_PCKMO \
+    S390_FEAT_PCKMO_QAI
+
+ #define S390_FEAT_GROUP_ENH_SORT \
+     S390_FEAT_ESORT_BASE, \
+     S390_FEAT_SORTL_SFLR, \
+@@ -346,6 +362,10 @@ static uint16_t group_MSA_EXT_12[] = {
+     S390_FEAT_GROUP_MSA_EXT_12,
+ };
+ 
+static uint16_t group_MSA_EXT_13[] = {
+    S390_FEAT_GROUP_MSA_EXT_13,
+};
+
+ static uint16_t group_MSA_EXT_9_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
+ };
+@@ -358,6 +378,10 @@ static uint16_t group_MSA_EXT_11_PCKMO[] = {
+     S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
+ };
+ 
+static uint16_t group_MSA_EXT_13_PCKMO[] = {
+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
+};
+
+ static uint16_t group_ENH_SORT[] = {
+     S390_FEAT_GROUP_ENH_SORT,
+ };
+@@ -910,6 +934,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+     FEAT_GROUP_INITIALIZER(MSA_EXT_11),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
+     FEAT_GROUP_INITIALIZER(MSA_EXT_12),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_13),
+    FEAT_GROUP_INITIALIZER(MSA_EXT_13_PCKMO),
+     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
+     FEAT_GROUP_INITIALIZER(ENH_SORT),
+     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
+++ b/kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
@ -0,0 +1,69 @@
+From bec777b1ca5107cea4f4104c58cdd0c5d9613e33 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:49 +0100
+Subject: [PATCH 14/18] s390x/cpumodel: correct PLO feature wording
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [14/16] 346fd03bd68222125b0b04113a432ae739af84f1 (thuth/qemu-kvm-cs9)
+
+The PLO functions 0, 4, 8, 12, 16, and 20 use 32-bit registers
+values.  The plo-*gr variants use 64-bit instead and, thus, correct
+the wording.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Message-ID: <20241206122751.189721-14-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 5a0a136df71b858d01f346af4a30ae1da23e8b3c)
+---
+ target/s390x/cpu_features_def.h.inc | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
+index 09a80844a7..fe7e1bd19c 100644
+--- a/target/s390x/cpu_features_def.h.inc
+++ b/target/s390x/cpu_features_def.h.inc
+@@ -158,27 +158,27 @@ DEF_FEAT(AP, "ap", MISC, 0, "AP instructions installed")
+ /* Features exposed via the PLO instruction. */
+ DEF_FEAT(PLO_CL, "plo-cl", PLO, 0, "PLO Compare and load (32 bit in general registers)")
+ DEF_FEAT(PLO_CLG, "plo-clg", PLO, 1, "PLO Compare and load (64 bit in parameter list)")
+-DEF_FEAT(PLO_CLGR, "plo-clgr", PLO, 2, "PLO Compare and load (32 bit in general registers)")
+DEF_FEAT(PLO_CLGR, "plo-clgr", PLO, 2, "PLO Compare and load (64 bit in general registers)")
+ DEF_FEAT(PLO_CLX, "plo-clx", PLO, 3, "PLO Compare and load (128 bit in parameter list)")
+ DEF_FEAT(PLO_CS, "plo-cs", PLO, 4, "PLO Compare and swap (32 bit in general registers)")
+ DEF_FEAT(PLO_CSG, "plo-csg", PLO, 5, "PLO Compare and swap (64 bit in parameter list)")
+-DEF_FEAT(PLO_CSGR, "plo-csgr", PLO, 6, "PLO Compare and swap (32 bit in general registers)")
+DEF_FEAT(PLO_CSGR, "plo-csgr", PLO, 6, "PLO Compare and swap (64 bit in general registers)")
+ DEF_FEAT(PLO_CSX, "plo-csx", PLO, 7, "PLO Compare and swap (128 bit in parameter list)")
+ DEF_FEAT(PLO_DCS, "plo-dcs", PLO, 8, "PLO Double compare and swap (32 bit in general registers)")
+ DEF_FEAT(PLO_DCSG, "plo-dcsg", PLO, 9, "PLO Double compare and swap (64 bit in parameter list)")
+-DEF_FEAT(PLO_DCSGR, "plo-dcsgr", PLO, 10, "PLO Double compare and swap (32 bit in general registers)")
+DEF_FEAT(PLO_DCSGR, "plo-dcsgr", PLO, 10, "PLO Double compare and swap (64 bit in general registers)")
+ DEF_FEAT(PLO_DCSX, "plo-dcsx", PLO, 11, "PLO Double compare and swap (128 bit in parameter list)")
+ DEF_FEAT(PLO_CSST, "plo-csst", PLO, 12, "PLO Compare and swap and store (32 bit in general registers)")
+ DEF_FEAT(PLO_CSSTG, "plo-csstg", PLO, 13, "PLO Compare and swap and store (64 bit in parameter list)")
+-DEF_FEAT(PLO_CSSTGR, "plo-csstgr", PLO, 14, "PLO Compare and swap and store (32 bit in general registers)")
+DEF_FEAT(PLO_CSSTGR, "plo-csstgr", PLO, 14, "PLO Compare and swap and store (64 bit in general registers)")
+ DEF_FEAT(PLO_CSSTX, "plo-csstx", PLO, 15, "PLO Compare and swap and store (128 bit in parameter list)")
+ DEF_FEAT(PLO_CSDST, "plo-csdst", PLO, 16, "PLO Compare and swap and double store (32 bit in general registers)")
+ DEF_FEAT(PLO_CSDSTG, "plo-csdstg", PLO, 17, "PLO Compare and swap and double store (64 bit in parameter list)")
+-DEF_FEAT(PLO_CSDSTGR, "plo-csdstgr", PLO, 18, "PLO Compare and swap and double store (32 bit in general registers)")
+DEF_FEAT(PLO_CSDSTGR, "plo-csdstgr", PLO, 18, "PLO Compare and swap and double store (64 bit in general registers)")
+ DEF_FEAT(PLO_CSDSTX, "plo-csdstx", PLO, 19, "PLO Compare and swap and double store (128 bit in parameter list)")
+ DEF_FEAT(PLO_CSTST, "plo-cstst", PLO, 20, "PLO Compare and swap and triple store (32 bit in general registers)")
+ DEF_FEAT(PLO_CSTSTG, "plo-cststg", PLO, 21, "PLO Compare and swap and triple store (64 bit in parameter list)")
+-DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (32 bit in general registers)")
+DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (64 bit in general registers)")
+ DEF_FEAT(PLO_CSTSTX, "plo-cststx", PLO, 23, "PLO Compare and swap and triple store (128 bit in parameter list)")
+ 
+ /* Features exposed via the PTFF instruction. */
+-- 
+2.39.3
+
--- a/kvm-s390x-cpumodel-gen17-model.patch
+++ b/kvm-s390x-cpumodel-gen17-model.patch
@ -0,0 +1,107 @@
+From bf9dd3db72e0e8cde010f649fbe484fdd929ac96 Mon Sep 17 00:00:00 2001
+From: Hendrik Brueckner <brueckner@linux.ibm.com>
+Date: Fri, 6 Dec 2024 13:27:51 +0100
+Subject: [PATCH 16/18] s390x/cpumodel: gen17 model
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 305: CPU model for new IBM Z gen17 hardware
+RH-Jira: RHEL-32665
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [16/16] 97b19706656f5510d1aab760f01e501c1c332bc4 (thuth/qemu-kvm-cs9)
+
+This commit introduces the definition of the gen17a/gen17b CPU model.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Message-ID: <20241206122751.189721-16-brueckner@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 21b8db229901a51f16aebe342c0508f588ea5006)
+---
+ target/s390x/cpu_models.c   |  2 ++
+ target/s390x/gen-features.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+index 3fb5b0980e..c326a71237 100644
+--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
+@@ -97,6 +97,8 @@ static S390CPUDef s390_cpu_defs[] = {
+     CPUDEF_INIT(0x8562, 15, 1, 47, 0x08000000U, "gen15b", "IBM z15 T02 GA1"),
+     CPUDEF_INIT(0x3931, 16, 1, 47, 0x08000000U, "gen16a", "IBM 3931 GA1"),
+     CPUDEF_INIT(0x3932, 16, 1, 47, 0x08000000U, "gen16b", "IBM 3932 GA1"),
+    CPUDEF_INIT(0x9175, 17, 1, 47, 0x08000000U, "gen17a", "IBM 9175 GA1"),
+    CPUDEF_INIT(0x9176, 17, 1, 47, 0x08000000U, "gen17b", "IBM 9176 GA1"),
+ };
+ 
+ #define QEMU_MAX_CPU_TYPE 0x8561
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 680d45d303..41840677ce 100644
+--- a/target/s390x/gen-features.c
+++ b/target/s390x/gen-features.c
+@@ -561,6 +561,13 @@ static uint16_t base_GEN15_GA1[] = {
+ 
+ #define base_GEN16_GA1 EmptyFeat
+ 
+static uint16_t base_GEN17_GA1[] = {
+    S390_FEAT_MISC_INSTRUCTION_EXT4,
+    S390_FEAT_SIF,
+    S390_FEAT_GROUP_MSA_EXT_12,
+    S390_FEAT_GROUP_PLO_EXT,
+};
+
+ /* Full features (in order of release)
+  * Automatically includes corresponding base features.
+  * Full features are all features this hardware supports even if kvm/QEMU do not
+@@ -715,6 +722,20 @@ static uint16_t full_GEN16_GA1[] = {
+     S390_FEAT_UV_FEAT_AP_INTR,
+ };
+ 
+static uint16_t full_GEN17_GA1[] = {
+    S390_FEAT_VECTOR_ENH3,
+    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3,
+    S390_FEAT_INEFF_NC_TX,
+    S390_FEAT_GROUP_GEN17_PTFF,
+    S390_FEAT_GROUP_MSA_EXT_10,
+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
+    S390_FEAT_GROUP_MSA_EXT_11,
+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
+    S390_FEAT_GROUP_MSA_EXT_13,
+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
+    S390_FEAT_GROUP_CONCURRENT_FUNCTIONS,
+};
+
+ 
+ /* Default features (in order of release)
+  * Automatically includes corresponding base features.
+@@ -810,6 +831,17 @@ static uint16_t default_GEN16_GA1[] = {
+     S390_FEAT_PAIE,
+ };
+ 
+static uint16_t default_GEN17_GA1[] = {
+    S390_FEAT_VECTOR_ENH3,
+    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3,
+    S390_FEAT_GROUP_MSA_EXT_10,
+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
+    S390_FEAT_GROUP_MSA_EXT_11,
+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
+    S390_FEAT_GROUP_MSA_EXT_13,
+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
+};
+
+ /* QEMU (CPU model) features */
+ 
+ static uint16_t qemu_V2_11[] = {
+@@ -958,6 +990,7 @@ static CpuFeatDefSpec CpuFeatDef[] = {
+     CPU_FEAT_INITIALIZER(GEN14_GA2),
+     CPU_FEAT_INITIALIZER(GEN15_GA1),
+     CPU_FEAT_INITIALIZER(GEN16_GA1),
+    CPU_FEAT_INITIALIZER(GEN17_GA1),
+ };
+ 
+ #define FEAT_GROUP_INITIALIZER(_name)                  \
+-- 
+2.39.3
+
--- a/kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
+++ b/kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
@ -0,0 +1,64 @@
+From 327e8c65d28dc357c02b508e6485e7c57d4d1efa Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Tue, 7 Jan 2025 13:43:32 +0100
+Subject: [PATCH 1/4] target/i386: Make sure SynIC state is really updated
+ before KVM_RUN
+
+RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-MergeRequest: 314: target/i386: Make sure SynIC state is really updated before KVM_RUN
+RH-Jira: RHEL-73002
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Maxim Levitsky <None>
+RH-Commit: [1/1] 2d8f7605e3efd3c76d16a2cb9e7c0898786fb4e9 (vkuznets/qemu-kvm)
+
+'hyperv_synic' test from KVM unittests was observed to be flaky on certain
+hardware (hangs sometimes). Debugging shows that the problem happens in
+hyperv_sint_route_new() when the test tries to set up a new SynIC
+route. The function bails out on:
+
+ if (!synic->sctl_enabled) {
+         goto cleanup;
+ }
+
+but the test writes to HV_X64_MSR_SCONTROL just before it starts
+establishing SINT routes. Further investigation shows that
+synic_update() (called from async_synic_update()) happens after the SINT
+setup attempt and not before. Apparently, the comment before
+async_safe_run_on_cpu() in kvm_hv_handle_exit() does not correctly describe
+the guarantees async_safe_run_on_cpu() gives. In particular, async worked
+added to a CPU is actually processed from qemu_wait_io_event() which is not
+always called before KVM_RUN, i.e. kvm_cpu_exec() checks whether an exit
+request is pending for a CPU and if not, keeps running the vCPU until it
+meets an exit it can't handle internally. Hyper-V specific MSR writes are
+not automatically trigger an exit.
+
+Fix the issue by simply raising an exit request for the vCPU where SynIC
+update was queued. This is not a performance critical path as SynIC state
+does not get updated so often (and async_safe_run_on_cpu() is a big hammer
+anyways).
+
+Reported-by: Jan Richter <jarichte@redhat.com>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Link: https://lore.kernel.org/r/20240917160051.2637594-4-vkuznets@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit d3177e2e4353824a650434c57471615d43507500)
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+---
+ target/i386/kvm/hyperv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
+index b94f12acc2..70b89cacf9 100644
+--- a/target/i386/kvm/hyperv.c
+++ b/target/i386/kvm/hyperv.c
+@@ -80,6 +80,7 @@ int kvm_hv_handle_exit(X86CPU *cpu, struct kvm_hyperv_exit *exit)
+          * necessary because memory hierarchy is being changed
+          */
+         async_safe_run_on_cpu(CPU(cpu), async_synic_update, RUN_ON_CPU_NULL);
+        cpu_exit(CPU(cpu));
+ 
+         return EXCP_INTERRUPT;
+     case KVM_EXIT_HYPERV_HCALL: {
+-- 
+2.39.3
+
--- a/kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
+++ b/kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
@ -0,0 +1,51 @@
+From 693f65e183cc578eed213b1ea5dc11e9c2697f15 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Fri, 22 Nov 2024 23:40:42 +0100
+Subject: [PATCH 2/7] tests/avocado/hotplug_blk: Fix addr in device_add command
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 312: qdev-monitor: avoid QemuOpts in QMP device_add
+RH-Jira: RHEL-43412
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Commit: [2/4] 7e2d360d3bb8e606d868c17d6032f9fb8ee15814 (stefanha/centos-stream-qemu-kvm)
+
+pci_devfn properties accept both integer and string values, but
+integer 1 and string '1' have different meanings: The integer value
+means device 0, function 1 whereas the string value '1' is short for
+'1.0' and means device 1, function 0.
+
+This test wants the string version so that the device actually becomes
+visible for the guest. device_add hides the problem because it goes
+through QemuOpts, which turns all properties into strings - this is a
+QEMU bug that we want to fix, but that cancelled out the bug in this
+test.
+
+Fix the test first so that device_add can be fixed afterwards.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-ID: <20241122224042.149258-1-kwolf@redhat.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 770de685353e8c495ad4773fbd4bc0db997e4dfd)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tests/avocado/hotplug_blk.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/avocado/hotplug_blk.py b/tests/avocado/hotplug_blk.py
+index d55ded1c1d..b36bca02ec 100644
+--- a/tests/avocado/hotplug_blk.py
+++ b/tests/avocado/hotplug_blk.py
+@@ -33,7 +33,7 @@ def plug(self) -> None:
+             'drive': 'disk',
+             'id': 'virtio-disk0',
+             'bus': 'pci.1',
+-            'addr': 1
+            'addr': '1',
+         }
+ 
+         self.assert_no_vda()
+-- 
+2.39.3
+
--- a/kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
+++ b/kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
@ -0,0 +1,63 @@
+From 2b12ea393b9a5d8392cb510406626f4c99c9f4c5 Mon Sep 17 00:00:00 2001
+From: Prasad Pandit <pjp@fedoraproject.org>
+Date: Thu, 7 Nov 2024 17:02:47 +0530
+Subject: [PATCH 6/7] vhost: fail device start if iotlb update fails
+
+RH-Author: Prasad Pandit <None>
+RH-MergeRequest: 318: vhost: fail device start if iotlb update fails
+RH-Jira: RHEL-73005
+RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] f185f02378ebbf36a38aef0ea608b70c637a4816 (pjp/cs-qemu-kvm)
+
+While starting a vhost device, updating iotlb entries
+via 'vhost_device_iotlb_miss' may return an error.
+
+  qemu-kvm: vhost_device_iotlb_miss:
+    700871,700871: Fail to update device iotlb
+
+Fail device start when such an error occurs.
+
+Jira: https://issues.redhat.com/browse/RHEL-73005
+Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
+Message-Id: <20241107113247.46532-1-ppandit@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+(cherry picked from commit 571bdc97b83646dfd3746ec56fb2f70bca55b9a2)
+Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
+---
+ hw/virtio/vhost.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
+index 06fc71746e..e25fdce3dd 100644
+--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
+@@ -2151,11 +2151,22 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
+          * vhost-kernel code requires for this.*/
+         for (i = 0; i < hdev->nvqs; ++i) {
+             struct vhost_virtqueue *vq = hdev->vqs + i;
+-            vhost_device_iotlb_miss(hdev, vq->used_phys, true);
+            r = vhost_device_iotlb_miss(hdev, vq->used_phys, true);
+            if (r) {
+                goto fail_iotlb;
+            }
+         }
+     }
+     vhost_start_config_intr(hdev);
+     return 0;
+fail_iotlb:
+    if (vhost_dev_has_iommu(hdev) &&
+        hdev->vhost_ops->vhost_set_iotlb_callback) {
+        hdev->vhost_ops->vhost_set_iotlb_callback(hdev, false);
+    }
+    if (hdev->vhost_ops->vhost_dev_start) {
+        hdev->vhost_ops->vhost_dev_start(hdev, false);
+    }
+ fail_start:
+     if (vrings) {
+         vhost_dev_set_vring_enable(hdev, false);
+-- 
+2.39.3
+
--- a/kvm-virtio-net-disable-USO-for-all-RHEL9.patch
+++ b/kvm-virtio-net-disable-USO-for-all-RHEL9.patch
@ -0,0 +1,125 @@
+From 76376a85ff5cbe555db6a6d729fcb83f56988f25 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 6 Nov 2024 17:29:35 -0500
+Subject: [PATCH 7/7] virtio-net: disable USO for all RHEL9
+
+RH-Author: MST <mst@redhat.com>
+RH-MergeRequest: 319: virtio-net migration: ensure compatibility of rhel9*
+RH-Jira: RHEL-69500
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] c7518d8293e1cfdd928f0ce454249ecb7bd7117a (mstredhat/qemu-kvm-centos)
+
+With commit 298dae99b77f ("virtio-net: disable USO for RHEL9")
+we fixed migration for 9.6 but we forgot to apply the fix
+for 9.6 when it was created.
+
+To help us not forget in 9.7 and beyond, create a generic RHEL9 compat
+and apply it.
+
+Upstream status: n/a: upstream has no guarantee if kernel features change
+Tested: lightly on developer's machine.
+JIRA: https://issues.redhat.com/browse/RHEL-69500
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+Patch-name: kvm-virtio-net-disable-USO-for-RHEL9.patch
+Patch-id: 83
+Patch-present-in-specfile: True
+---
+ hw/arm/virt.c              |  3 +++
+ hw/core/machine.c          | 13 ++++++++-----
+ hw/i386/pc_q35.c           |  3 +++
+ hw/s390x/s390-virtio-ccw.c |  3 +++
+ include/hw/boards.h        |  3 +++
+ 5 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 078098ec3a..6d55bba241 100644
+--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
+@@ -3595,6 +3595,9 @@ DEFINE_VIRT_MACHINE_AS_LATEST(10, 0, 0)
+ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+ {
+     virt_rhel_machine_10_0_0_options(mc);
+
+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
+    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+ }
+ DEFINE_VIRT_MACHINE(9, 6, 0)
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 04d180eac4..1ee0e1dee8 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -327,6 +327,14 @@ GlobalProperty hw_compat_rhel_10_0[] = {
+ };
+ const size_t hw_compat_rhel_10_0_len = G_N_ELEMENTS(hw_compat_rhel_10_0);
+ 
+/* Apply this to all RHEL9 boards going backward and forward */
+GlobalProperty hw_compat_rhel_9[] = {
+    /* supported by userspace, but RHEL 9 *kernels* do not support USO. */
+    { TYPE_VIRTIO_NET, "host_uso", "off"},
+    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
+    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
+};
+const size_t hw_compat_rhel_9_len = G_N_ELEMENTS(hw_compat_rhel_9);
+ 
+ GlobalProperty hw_compat_rhel_9_5[] = {
+   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
+@@ -337,11 +345,6 @@ GlobalProperty hw_compat_rhel_9_5[] = {
+     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
+   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
+     { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
+-    /* supported by userspace, but RHEL 9 *kernels* do not support USO. */
+-    /* TODO: if we ever add 9.6 compat, this has to be there, too */
+-    { TYPE_VIRTIO_NET, "host_uso", "off"},
+-    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
+-    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
+ };
+ const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
+ 
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 506f9dc0c0..b2b8124225 100644
+--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
+@@ -690,6 +690,9 @@ static void pc_q35_rhel_machine_9_6_0_options(MachineClass *m)
+     m->alias = NULL;
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.6.0";
+
+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
+    compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+ }
+ 
+ DEFINE_Q35_MACHINE_BUGFIX(9, 6, 0);
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 0347dc69ca..2e276ad72b 100644
+--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1305,6 +1305,9 @@ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+ static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
+ {
+     ccw_rhel_machine_10_0_0_class_options(mc);
+
+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
+    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+ }
+ DEFINE_CCW_MACHINE(9, 6, 0);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index ac917b87fb..83d11de42f 100644
+--- a/include/hw/boards.h
+++ b/include/hw/boards.h
+@@ -805,6 +805,9 @@ extern const size_t hw_compat_2_1_len;
+ extern GlobalProperty hw_compat_rhel_10_0[];
+ extern const size_t hw_compat_rhel_10_0_len;
+ 
+extern GlobalProperty hw_compat_rhel_9[];
+extern const size_t hw_compat_rhel_9_len;
+
+ extern GlobalProperty hw_compat_rhel_9_5[];
+ extern const size_t hw_compat_rhel_9_5_len;
+ 
+-- 
+2.39.3
+
--- a/kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
+++ b/kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
@ -0,0 +1,65 @@
+From 59fe7329e9f1660a3b26e5147de2df348b1bbaed Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 27 Aug 2024 15:27:51 -0400
+Subject: [PATCH 4/7] vl: use qmp_device_add() in qemu_create_cli_devices()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 312: qdev-monitor: avoid QemuOpts in QMP device_add
+RH-Jira: RHEL-43412
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Commit: [4/4] b581207df4723f8a278452c92cb1b71a207aabe8 (stefanha/centos-stream-qemu-kvm)
+
+qemu_create_cli_devices() should use qmp_device_add() to match the
+behavior of the QMP monitor. A comment explained that libvirt changes
+implementing strict CLI syntax were needed.
+
+Peter Krempa <pkrempa@redhat.com> has confirmed that modern libvirt uses
+the same JSON for -device (CLI) and device_add (QMP). Go ahead and use
+qmp_device_add().
+
+Cc: Peter Krempa <pkrempa@redhat.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240827192751.948633-3-stefanha@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 11bf1d6aa06138e93b274e942d6992af63ffc510)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ system/vl.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/system/vl.c b/system/vl.c
+index 5359231bf5..900d471f5e 100644
+--- a/system/vl.c
+++ b/system/vl.c
+@@ -2661,17 +2661,11 @@ static void qemu_create_cli_devices(void)
+     qemu_opts_foreach(qemu_find_opts("device"),
+                       device_init_func, NULL, &error_fatal);
+     QTAILQ_FOREACH(opt, &device_opts, next) {
+-        DeviceState *dev;
+        QObject *ret_data = NULL;
+
+         loc_push_restore(&opt->loc);
+-        /*
+-         * TODO Eventually we should call qmp_device_add() here to make sure it
+-         * behaves the same, but QMP still has to accept incorrectly typed
+-         * options until libvirt is fixed and we want to be strict on the CLI
+-         * from the start, so call qdev_device_add_from_qdict() directly for
+-         * now.
+-         */
+-        dev = qdev_device_add_from_qdict(opt->opts, true, &error_fatal);
+-        object_unref(OBJECT(dev));
+        qmp_device_add(opt->opts, &ret_data, &error_fatal);
+        assert(ret_data == NULL); /* error_fatal aborts */
+         loc_pop(&opt->loc);
+     }
+     rom_reset_order_override();
+-- 
+2.39.3
+
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -157,7 +157,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
 Version: 9.1.0
-Release: 8%{?rcrel}%{?dist}%{?cc_suffix}.alma.1
+Release: 11%{?rcrel}%{?dist}%{?cc_suffix}.alma.1
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -374,6 +374,64 @@ Patch91: kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch
 Patch92: kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch
 # For RHEL-69047 - warning: fd: migration to a file is deprecated when create or revert a snapshot
 Patch93: kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch94: kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch95: kvm-s390x-cpumodel-add-msa10-subfunctions.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch96: kvm-s390x-cpumodel-add-msa11-subfunctions.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch97: kvm-s390x-cpumodel-add-msa12-changes.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch98: kvm-s390x-cpumodel-add-msa13-subfunctions.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch99: kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch100: kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch101: kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch102: kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch103: kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch104: kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch105: kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch106: kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch107: kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch108: kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
+# For RHEL-32665 - [IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part
+Patch109: kvm-s390x-cpumodel-gen17-model.patch
+# For RHEL-71939 - qemu-ga cannot freeze filesystems with sentinelone
+Patch110: kvm-qga-skip-bind-mounts-in-fs-list.patch
+# For RHEL-67108 - [aarch64] [rhel-10.0] Backport some important post 9.1 qemu fixes
+Patch111: kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
+# For RHEL-43412 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta]
+Patch112: kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
+# For RHEL-43412 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta]
+Patch113: kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
+# For RHEL-43412 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta]
+Patch114: kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
+# For RHEL-43412 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta]
+Patch115: kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
+# For RHEL-57668 - [RFE] [HPEMC] [RHEL-10.0] qemu-kvm: support up to 4096 VCPUs
+Patch116: kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
+# For RHEL-73005 - qemu-kvm: vhost: reports error while updating IOTLB entries
+Patch117: kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
+# For RHEL-69500 - [Stable_Guest_ABI][USO][9.6.0-machine-type]From 10.0 to RHEL.9.6.0 the guest with 9.6 machine type only, the guest crashed with - qemu-kvm: Features 0x1c0010130afffa7 unsupported. Allowed features: 0x10179bfffe7
+Patch118: kvm-virtio-net-disable-USO-for-all-RHEL9.patch
+# For RHEL-73002 - kvm-unti kvm-hyperv_synic test is stuck on AMD with COS9 [rhel-10]
+Patch119: kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
+# For RHEL-73835 - VM crashes when requesting domstats [rhel-10]
+Patch120: kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
+# For RHEL-74361 - qemu-ga logs only "guest-fsfreeze called" (but not "guest-fsthaw called")
+Patch121: kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
+# For RHEL-74461 - fsfreeze hooks doesn't log error on system logs when running hook fails [rhel-10]
+Patch122: kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch


 # AlmaLinux patches
@ -1490,12 +1548,69 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif

 %changelog
-* Wed Jan 08 2025 Eduard Abdullin <eabdullin@almalinux.org> - 9.1.0-8.alma.1
+* Tue Jan 28 2025 Eduard Abdullin <eabdullin@almalinux.org> - 9.1.0-11.alma.1
 - Enable QXL device build
 - Enable building for ppc64le
 - Re-added Spice support
 - Don't remove slof.bin for ppc64le

+* Mon Jan 20 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-11
+- kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch [RHEL-73002]
+- kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch [RHEL-73835]
+- kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch [RHEL-74361]
+- kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch [RHEL-74461]
+- Resolves: RHEL-73002
+  (kvm-unti kvm-hyperv_synic test is stuck on AMD with COS9 [rhel-10])
+- Resolves: RHEL-73835
+  (VM crashes when requesting domstats [rhel-10])
+- Resolves: RHEL-74361
+  (qemu-ga logs only "guest-fsfreeze called" (but not "guest-fsthaw called"))
+- Resolves: RHEL-74461
+  (fsfreeze hooks doesn't log error on system logs when running hook fails [rhel-10])
+
+* Mon Jan 13 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-10
+- kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch [RHEL-43412]
+- kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch [RHEL-43412]
+- kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch [RHEL-43412]
+- kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch [RHEL-43412]
+- kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch [RHEL-57668]
+- kvm-vhost-fail-device-start-if-iotlb-update-fails.patch [RHEL-73005]
+- kvm-virtio-net-disable-USO-for-all-RHEL9.patch [RHEL-69500]
+- Resolves: RHEL-43412
+  (qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-10.0-beta])
+- Resolves: RHEL-57668
+  ([RFE] [HPEMC] [RHEL-10.0] qemu-kvm: support up to 4096 VCPUs)
+- Resolves: RHEL-73005
+  (qemu-kvm: vhost: reports error while updating IOTLB entries)
+- Resolves: RHEL-69500
+  ([Stable_Guest_ABI][USO][9.6.0-machine-type]From 10.0 to RHEL.9.6.0 the guest with 9.6 machine type only, the guest crashed with - qemu-kvm: Features 0x1c0010130afffa7 unsupported. Allowed features: 0x10179bfffe7)
+
+* Mon Jan 06 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-9
+- kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-msa10-subfunctions.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-msa11-subfunctions.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-msa12-changes.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-msa13-subfunctions.patch [RHEL-32665]
+- kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch [RHEL-32665]
+- kvm-linux-headers-Update-to-Linux-6.13-rc1.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch [RHEL-32665]
+- kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch [RHEL-32665]
+- kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch [RHEL-32665]
+- kvm-s390x-cpumodel-correct-PLO-feature-wording.patch [RHEL-32665]
+- kvm-s390x-cpumodel-Add-PLO-extension-facility.patch [RHEL-32665]
+- kvm-s390x-cpumodel-gen17-model.patch [RHEL-32665]
+- kvm-qga-skip-bind-mounts-in-fs-list.patch [RHEL-71939]
+- kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch [RHEL-67108]
+- Resolves: RHEL-32665
+  ([IBM 10.0 FEAT] KVM: CPU model for new IBM Z HW - qemu-kvm part)
+- Resolves: RHEL-71939
+  (qemu-ga cannot freeze filesystems with sentinelone)
+- Resolves: RHEL-67108
+  ([aarch64] [rhel-10.0] Backport some important post 9.1 qemu fixes)
+
 * Fri Dec 13 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-8
 - kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch [RHEL-69047]
 - Resolves: RHEL-69047