* Mon Jan 27 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-12

- kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch [RHEL-65618] - kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch [RHEL-72717] - kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch [RHEL-72717] - kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch [RHEL-72717] - kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch [RHEL-72717] - kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch [RHEL-71761] - Resolves: RHEL-65618 ([RHEL10] Failed to hot add PCIe device behind xio3130 downstream) - Resolves: RHEL-72717 (Boot fall back to cdrom from network not always working) - Resolves: RHEL-71761 ([Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10)
2025-01-27 05:59:04 -05:00 · 2025-01-27 05:59:04 -05:00 · b7456aa7c8
commit b7456aa7c8
parent 7b35fb4485
7 changed files with 535 additions and 1 deletions
--- a/kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch
+++ b/kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch
@ -0,0 +1,60 @@
+From d36ac428991e700dd5cec62dfa16f1d414a9dda8 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Fri, 17 Jan 2025 05:50:54 -0500
+Subject: [PATCH 6/6] arm: disable pauth for virt-rhel9* in RHEL10
+
+RH-Author: Sebastian Ott <sebott@redhat.com>
+RH-MergeRequest: 327: arm: disable pauth for virt-rhel9* in RHEL10
+RH-Jira: RHEL-71761
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Kashyap Chamarthy <None>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Commit: [1/1] fef388b1aafce66fa1a176739264bca49596bb94 (seott1/cos-qemu-kvm)
+
+RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
+since qemu will setup the VM/VCPU with pauth when KVM supports it
+the guest visible ID registers will differ between RHEL9 and RHEL10
+(on a host with pauth support) leading to migration / upgrade failures.
+
+Fix this by disabling pauth for virt-rhel9* machine types in RHEL10.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+JIRA: https://issues.redhat.com/browse/RHEL-71761
+---
+ hw/arm/virt.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 6d55bba241..55bd92e6d0 100644
+--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
+@@ -90,6 +90,16 @@ static GlobalProperty arm_virt_compat[] = {
+ };
+ static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat);
+ 
+/*
+ * RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
+ * since qemu will setup the VM with pauth when KVM supports it we
+ * have to disable it for virt-rhel9* to support upgrades / migration.
+ */
+GlobalProperty arm_rhel9_compat[] = {
+    {TYPE_ARM_CPU, "pauth", "off", .optional = true},
+};
+const size_t arm_rhel9_compat_len = G_N_ELEMENTS(arm_rhel9_compat);
+
+ /*
+  * This variable is for changes to properties that are RHEL specific,
+  * different to the current upstream and to be applied to the latest
+@@ -3596,6 +3606,8 @@ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+ {
+     virt_rhel_machine_10_0_0_options(mc);
+ 
+    compat_props_add(mc->compat_props, arm_rhel9_compat, arm_rhel9_compat_len);
+
+     /* NB: remember to move this line to the *latest* RHEL 9 machine */
+     compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+ }
+-- 
+2.39.3
+
--- a/kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
+++ b/kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
@ -0,0 +1,71 @@
+From 3add991f9da7abac1ddc293a17f90a8b3ab5bb67 Mon Sep 17 00:00:00 2001
+From: Jared Rossi <jrossi@linux.ibm.com>
+Date: Fri, 17 Jan 2025 16:22:35 -0500
+Subject: [PATCH 2/6] pc-bios/s390-ccw: Abort IPL on invalid loadparm
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 331: Fix boot problems when falling back from network to another boot device on s390x [RHEL10]
+RH-Jira: RHEL-72717
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/4] fdde5c57ff03fa0d2e69d711bbf485dcefc8f55b (thuth/qemu-kvm-cs)
+
+Because the loadparm specifies an exact kernel the user wants to boot, if the
+loadparm is invalid it must represent a misconfiguration of the guest. Thus we
+should abort the IPL immediately, without attempting to use other devices, to
+avoid booting into an unintended guest image.
+
+Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
+Message-ID: <20250117212235.1324063-2-jrossi@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 64fa0de46ee3cc972af5d3ce8c5dc0db8198cd2b)
+---
+ pc-bios/s390-ccw/bootmap.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
+index 56f2f75640..0f8baa0198 100644
+--- a/pc-bios/s390-ccw/bootmap.c
+++ b/pc-bios/s390-ccw/bootmap.c
+@@ -336,8 +336,7 @@ static int run_eckd_boot_script(block_number_t bmt_block_nr,
+ 
+     debug_print_int("loadparm", loadparm);
+     if (loadparm >= MAX_BOOT_ENTRIES) {
+-        puts("loadparm value greater than max number of boot entries allowed");
+-        return -EINVAL;
+        panic("loadparm value greater than max number of boot entries allowed");
+     }
+ 
+     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
+@@ -348,8 +347,8 @@ static int run_eckd_boot_script(block_number_t bmt_block_nr,
+ 
+     block_nr = gen_eckd_block_num(&bmt->entry[loadparm].xeckd, ldipl);
+     if (block_nr == NULL_BLOCK_NR) {
+-        puts("Cannot find Boot Map Table Entry");
+-        return -EIO;
+        printf("The requested boot entry (%d) is invalid\n", loadparm);
+        panic("Invalid loadparm");
+     }
+ 
+     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
+@@ -792,8 +791,12 @@ static int ipl_scsi(void)
+ 
+     debug_print_int("loadparm", loadparm);
+     if (loadparm >= MAX_BOOT_ENTRIES) {
+-        puts("loadparm value greater than max number of boot entries allowed");
+-        return -EINVAL;
+        panic("loadparm value greater than max number of boot entries allowed");
+    }
+
+    if (!valid_entries[loadparm]) {
+        printf("The requested boot entry (%d) is invalid\n", loadparm);
+        panic("Invalid loadparm");
+     }
+ 
+     return zipl_run(&prog_table->entry[loadparm].scsi);
+-- 
+2.39.3
+
--- a/kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
+++ b/kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
@ -0,0 +1,159 @@
+From 548a415cff7d590d86033902fb29d5e15f57d17f Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Thu, 16 Jan 2025 12:58:25 +0100
+Subject: [PATCH 4/6] pc-bios/s390-ccw: Fix boot problem with virtio-net
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 331: Fix boot problems when falling back from network to another boot device on s390x [RHEL10]
+RH-Jira: RHEL-72717
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [3/4] f7ef8c63507c7f1ee8d05083f9540bee1697071c (thuth/qemu-kvm-cs)
+
+When we are trying to boot from virtio-net devices, the
+s390-ccw bios currently leaves the virtio-net device enabled
+after using it. That means that the receiving virt queues will
+continue to happily write incoming network packets into memory.
+This can corrupt data of the following boot process. For example,
+if you set up a second guest on a virtual network and create a
+lot of broadcast traffic there, e.g. with:
+
+ ping -i 0.02 -s 1400  -b 192.168.1.255
+
+and then you try to boot a guest with two boot devices, a network
+device first (which should not be bootable) and e.g. a bootable SCSI
+CD second, then this guest will fail to load the kernel from the CD
+image:
+
+ $ qemu-system-s390x -m 2G -nographic -device virtio-scsi-ccw \
+    -netdev tap,id=net0 -device virtio-net-ccw,netdev=net0,bootindex=1 \
+    -drive if=none,file=test.iso,format=raw,id=cd1 \
+    -device scsi-cd,drive=cd1,bootindex=2
+ LOADPARM=[        ]
+
+ Network boot device detected
+ Network boot starting...
+   Using MAC address: 52:54:00:12:34:56
+   Requesting information via DHCP: done
+   Using IPv4 address: 192.168.1.76
+   Using TFTP server: 192.168.1.1
+ Trying pxelinux.cfg files...
+   TFTP error: ICMP ERROR "port unreachable"
+   Receiving data:  0 KBytes
+ Repeating TFTP read request...
+   TFTP error: ICMP ERROR "port unreachable"
+ Failed to load OS from network.
+ Failed to IPL from this network!
+ LOADPARM=[        ]
+
+ Using virtio-scsi.
+
+ ! virtio-scsi:setup:inquiry: response VS RESP=ff !
+ ERROR: No suitable device for IPL. Halting...
+
+We really have to shut up the virtio-net devices after we're not
+using it anymore. The easiest way to do this is to simply reset
+the device, so let's do that now.
+
+Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
+Reviewed-by: Eric Farman <farman@linux.ibm.com>
+Tested-by: Jared Rossi <jrossi@linux.ibm.com>
+Message-ID: <20250116115826.192047-3-thuth@redhat.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 68c95ed1db070f7545e487e742715f01a545aab0)
+---
+ pc-bios/s390-ccw/netmain.c    | 33 +++++++++++++++++++++++----------
+ pc-bios/s390-ccw/virtio-net.c |  5 +++++
+ pc-bios/s390-ccw/virtio.h     |  1 +
+ 3 files changed, 29 insertions(+), 10 deletions(-)
+
+diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
+index e46e470db4..335ea9b63e 100644
+--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
+@@ -153,19 +153,10 @@ static int tftp_load(filename_ip_t *fnip, void *buffer, int len)
+     return rc;
+ }
+ 
+-static int net_init(filename_ip_t *fn_ip)
+static int net_init_ip(filename_ip_t *fn_ip)
+ {
+     int rc;
+ 
+-    memset(fn_ip, 0, sizeof(filename_ip_t));
+-
+-    rc = virtio_net_init(mac);
+-    if (rc < 0) {
+-        puts("Could not initialize network device");
+-        return -101;
+-    }
+-    fn_ip->fd = rc;
+-
+     printf("  Using MAC address: %02x:%02x:%02x:%02x:%02x:%02x\n",
+            mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+ 
+@@ -221,11 +212,33 @@ static int net_init(filename_ip_t *fn_ip)
+     return rc;
+ }
+ 
+static int net_init(filename_ip_t *fn_ip)
+{
+    int rc;
+
+    memset(fn_ip, 0, sizeof(filename_ip_t));
+
+    rc = virtio_net_init(mac);
+    if (rc < 0) {
+        puts("Could not initialize network device");
+        return -101;
+    }
+    fn_ip->fd = rc;
+
+    rc = net_init_ip(fn_ip);
+    if (rc < 0) {
+        virtio_net_deinit();
+    }
+
+    return rc;
+}
+
+ static void net_release(filename_ip_t *fn_ip)
+ {
+     if (fn_ip->ip_version == 4) {
+         dhcp_send_release(fn_ip->fd);
+     }
+    virtio_net_deinit();
+ }
+ 
+ /**
+diff --git a/pc-bios/s390-ccw/virtio-net.c b/pc-bios/s390-ccw/virtio-net.c
+index 578c89d0c5..301445bf97 100644
+--- a/pc-bios/s390-ccw/virtio-net.c
+++ b/pc-bios/s390-ccw/virtio-net.c
+@@ -140,3 +140,8 @@ int recv(int fd, void *buf, int maxlen, int flags)
+ 
+     return len;
+ }
+
+void virtio_net_deinit(void)
+{
+    virtio_reset(virtio_get_device());
+}
+diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
+index f13fa6f5fe..5c5e808a50 100644
+--- a/pc-bios/s390-ccw/virtio.h
+++ b/pc-bios/s390-ccw/virtio.h
+@@ -278,5 +278,6 @@ int virtio_reset(VDev *vdev);
+ int virtio_setup_ccw(VDev *vdev);
+ 
+ int virtio_net_init(void *mac_addr);
+void virtio_net_deinit(void);
+ 
+ #endif /* VIRTIO_H */
+-- 
+2.39.3
+
--- a/kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
+++ b/kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
@ -0,0 +1,72 @@
+From 3f7951b9a46772a1c942aed1fe87fc7461acb197 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Thu, 16 Jan 2025 12:58:26 +0100
+Subject: [PATCH 5/6] pc-bios/s390-ccw/netmain: Fix error messages with regards
+ to the TFTP server
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 331: Fix boot problems when falling back from network to another boot device on s390x [RHEL10]
+RH-Jira: RHEL-72717
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [4/4] 5b87d859a69ff0f399ba516a87c847a0f3942666 (thuth/qemu-kvm-cs)
+
+The code in net_init_ip() currently bails out early if "rc" is less
+than 0, so the if-statements that check for negative "rc" codes to
+print out some specific error messages with regards to the TFTP server
+are never reached. Move them earlier to bring that dead code back to
+life.
+
+Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
+Reviewed-by: Eric Farman <farman@linux.ibm.com>
+Tested-by: Jared Rossi <jrossi@linux.ibm.com>
+Message-ID: <20250116115826.192047-4-thuth@redhat.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit bbfa7f8558d5346b6884108ad50df3517fe17358)
+---
+ pc-bios/s390-ccw/netmain.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
+index 335ea9b63e..719a547ada 100644
+--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
+@@ -168,6 +168,14 @@ static int net_init_ip(filename_ip_t *fn_ip)
+         if (fn_ip->ip_version == 4) {
+             set_ipv4_address(fn_ip->own_ip);
+         }
+    } else if (rc == -2) {
+        printf("ARP request to TFTP server (%d.%d.%d.%d) failed\n",
+               (fn_ip->server_ip >> 24) & 0xFF, (fn_ip->server_ip >> 16) & 0xFF,
+               (fn_ip->server_ip >>  8) & 0xFF, fn_ip->server_ip & 0xFF);
+        return -102;
+    } else if (rc == -4 || rc == -3) {
+        puts("Can't obtain TFTP server IP address");
+        return -107;
+     } else {
+         puts("Could not get IP address");
+         return -101;
+@@ -183,17 +191,6 @@ static int net_init_ip(filename_ip_t *fn_ip)
+         printf("  Using IPv6 address: %s\n", ip6_str);
+     }
+ 
+-    if (rc == -2) {
+-        printf("ARP request to TFTP server (%d.%d.%d.%d) failed\n",
+-               (fn_ip->server_ip >> 24) & 0xFF, (fn_ip->server_ip >> 16) & 0xFF,
+-               (fn_ip->server_ip >>  8) & 0xFF, fn_ip->server_ip & 0xFF);
+-        return -102;
+-    }
+-    if (rc == -4 || rc == -3) {
+-        puts("Can't obtain TFTP server IP address");
+-        return -107;
+-    }
+-
+     printf("  Using TFTP server: ");
+     if (fn_ip->ip_version == 4) {
+         printf("%d.%d.%d.%d\n",
+-- 
+2.39.3
+
--- a/kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
+++ b/kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
@ -0,0 +1,70 @@
+From 75a9cc1fb986e96ad5ee9df22daf93afb4624bd3 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Thu, 16 Jan 2025 12:58:24 +0100
+Subject: [PATCH 3/6] pc-bios/s390-ccw/virtio: Add a function to reset a virtio
+ device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 331: Fix boot problems when falling back from network to another boot device on s390x [RHEL10]
+RH-Jira: RHEL-72717
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/4] 96435852a2dc8955f9deef6d82c7fac90ce90e96 (thuth/qemu-kvm-cs)
+
+To be able to properly silence a virtio device after using it,
+we need a global function to reset the device.
+
+Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
+Reviewed-by: Eric Farman <farman@linux.ibm.com>
+Tested-by: Jared Rossi <jrossi@linux.ibm.com>
+Message-ID: <20250116115826.192047-2-thuth@redhat.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 3936d0556383829b8db9518aed8badfed6513953)
+---
+ pc-bios/s390-ccw/virtio.c | 7 ++++++-
+ pc-bios/s390-ccw/virtio.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
+index 8b5a370bb3..cd6c99c7e3 100644
+--- a/pc-bios/s390-ccw/virtio.c
+++ b/pc-bios/s390-ccw/virtio.c
+@@ -217,6 +217,11 @@ int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd)
+     return 0;
+ }
+ 
+int virtio_reset(VDev *vdev)
+{
+    return run_ccw(vdev, CCW_CMD_VDEV_RESET, NULL, 0, false);
+}
+
+ int virtio_setup_ccw(VDev *vdev)
+ {
+     int i, cfg_size = 0;
+@@ -235,7 +240,7 @@ int virtio_setup_ccw(VDev *vdev)
+     vdev->config.blk.blk_size = 0; /* mark "illegal" - setup started... */
+     vdev->guessed_disk_nature = VIRTIO_GDN_NONE;
+ 
+-    run_ccw(vdev, CCW_CMD_VDEV_RESET, NULL, 0, false);
+    virtio_reset(vdev);
+ 
+     status = VIRTIO_CONFIG_S_ACKNOWLEDGE;
+     if (run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false)) {
+diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
+index 9faf3986b1..f13fa6f5fe 100644
+--- a/pc-bios/s390-ccw/virtio.h
+++ b/pc-bios/s390-ccw/virtio.h
+@@ -274,6 +274,7 @@ void vring_send_buf(VRing *vr, void *p, int len, int flags);
+ int vr_poll(VRing *vr);
+ int vring_wait_reply(void);
+ int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd);
+int virtio_reset(VDev *vdev);
+ int virtio_setup_ccw(VDev *vdev);
+ 
+ int virtio_net_init(void *mac_addr);
+-- 
+2.39.3
+
--- a/kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
+++ b/kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
@ -0,0 +1,76 @@
+From 765eed6ea5144c19658897e852efcd24fbebaf87 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Tue, 3 Dec 2024 13:19:28 +0100
+Subject: [PATCH 1/6] pci: ensure valid link status bits for downstream ports
+
+RH-Author: Sebastian Ott <sebott@redhat.com>
+RH-MergeRequest: 328: pci: ensure valid link status bits for downstream ports
+RH-Jira: RHEL-65618
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Kashyap Chamarthy <None>
+RH-Commit: [1/1] fe92e0cd7ab04bfede6d1bf416b1080061cca172 (seott1/cos-qemu-kvm)
+
+PCI hotplug for downstream endpoints on arm fails because Linux'
+PCIe hotplug driver doesn't like the QEMU provided LNKSTA:
+
+  pcieport 0000:08:01.0: pciehp: Slot(2): Card present
+  pcieport 0000:08:01.0: pciehp: Slot(2): Link Up
+  pcieport 0000:08:01.0: pciehp: Slot(2): Cannot train link: status 0x2000
+
+There's 2 cases where LNKSTA isn't setup properly:
+* the downstream device has no express capability
+* max link width of the bridge is 0
+
+Move the sanity checks added via 88c869198aa63
+("pci: Sanity test minimum downstream LNKSTA") outside of the
+branch to make sure downstream ports always have a valid LNKSTA.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+Tested-by: Zhenyu Zhang <zhenyzha@redhat.com>
+Message-Id: <20241203121928.14861-1-sebott@redhat.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 694632fd44987cc4618612a38ad151047524a590)
+JIRA: https://issues.redhat.com/browse/RHEL-65618
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/pci/pcie.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
+index 4b2f0805c6..9cb137c30f 100644
+--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
+@@ -1080,18 +1080,22 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
+         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
+             lnksta &= ~PCI_EXP_LNKSTA_NLW;
+             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
+-        } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
+-            lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
+         }
+ 
+         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
+             lnksta &= ~PCI_EXP_LNKSTA_CLS;
+             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
+-        } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
+-            lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
+         }
+     }
+ 
+    if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
+        lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
+    }
+
+    if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
+        lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
+    }
+
+     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
+                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
+     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
+-- 
+2.39.3
+
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -143,7 +143,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
 Version: 9.1.0
-Release: 11%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 12%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -418,6 +418,18 @@ Patch120: kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
 Patch121: kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
 # For RHEL-74461 - fsfreeze hooks doesn't log error on system logs when running hook fails [rhel-10]
 Patch122: kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
+# For RHEL-65618 - [RHEL10] Failed to hot add PCIe device behind xio3130 downstream
+Patch123: kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
+# For RHEL-72717 - Boot fall back to cdrom from network not always working
+Patch124: kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
+# For RHEL-72717 - Boot fall back to cdrom from network not always working
+Patch125: kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
+# For RHEL-72717 - Boot fall back to cdrom from network not always working
+Patch126: kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
+# For RHEL-72717 - Boot fall back to cdrom from network not always working
+Patch127: kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
+# For RHEL-71761 - [Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10
+Patch128: kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch

 %if %{have_clang}
 BuildRequires: clang
@ -1484,6 +1496,20 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif

 %changelog
+* Mon Jan 27 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-12
+- kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch [RHEL-65618]
+- kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch [RHEL-72717]
+- kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch [RHEL-72717]
+- kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch [RHEL-72717]
+- kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch [RHEL-72717]
+- kvm-arm-disable-pauth-for-virt-rhel9-in-RHEL10.patch [RHEL-71761]
+- Resolves: RHEL-65618
+  ([RHEL10] Failed to hot add PCIe device behind xio3130 downstream)
+- Resolves: RHEL-72717
+  (Boot fall back to cdrom from network not always working)
+- Resolves: RHEL-71761
+  ([Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10)
+
 * Mon Jan 20 2025 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-11
 - kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch [RHEL-73002]
 - kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch [RHEL-73835]