* Tue Jan 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-1

- Rebase to QEMU 8.2.0 [RHEL-14111] - Fix machine type compatibility [RHEL-17067 RHEL-17068] - Add 9.4.0 machine type [RHEL-17168 RHEL-19117 RHEL-19119] - Resolves: RHEL-14111 (Rebase qemu-kvm to QEMU 8.2.0) - Resolves: RHEL-17067 (Check/fix machine type compatibility for qemu-kvm 8.2.0 [s390x]) - Resolves: RHEL-17068 (Check/fix machine type compatibility for qemu-kvm 8.2.0 [x86_64]) - Resolves: RHEL-17168 (Introduce virt-rhel9.4.0 arm-virt machine type [aarch64]) - Resolves: RHEL-19117 (Introduce virt-rhel9.4.0 arm-virt machine type [x86_64]) - Resolves: RHEL-19119 (Introduce virt-rhel9.4.0 arm-virt machine type [s390x])
2024-01-02 04:26:49 -05:00 · 2024-01-02 04:26:49 -05:00 · d69bd6ee5f
commit d69bd6ee5f
parent c11eb5441f
40 changed files with 493 additions and 2632 deletions
--- a/.gitignore
+++ b/.gitignore
@ -27,3 +27,4 @@
 /qemu-7.2.0.tar.xz
 /qemu-8.0.0.tar.xz
 /qemu-8.1.0.tar.xz
 /qemu-8.2.0.tar.xz
--- a/0004-Initial-redhat-build.patch
+++ b/0004-Initial-redhat-build.patch
@ -1,4 +1,4 @@
-From b8538e2099c040bfe7c98a3af1423abb30d91ab7 Mon Sep 17 00:00:00 2001
+From faae70a870156f86a5cf55ca967b15d7612941ff Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
@ -13,7 +13,7 @@ several issues are fixed in QEMU tree:
 We disable make check due to issues with some of the tests.
-This rebase is based on qemu-kvm-8.0.0-13.el9
+This rebase is based on qemu-kvm-8.1.0-5.el9
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
@ -78,6 +78,11 @@ Rebase changes (8.1.0):
 - Renamed --disable-pypi to --disable-downloads
 - Minor updates in README.tests
 Rebase changes (8.2.0):
 - Removed --disable-hax (upstream)
 - Added --disable-plugins configure option
 - Fixing frh.py strings
 Merged patches (6.0.0):
 - 605758c902 Limit build on Power to qemu-img and qemu-ga only
@ -185,6 +190,9 @@ Merged patches (8.1.0):
 - f356cae88f spec: Build DBUS display
 - 77b763efd5 Provide elf2dmp binary in qemu-tools
 Merged patches (8.2.0):
 - cd9efa221d Enable qemu-kvm-device-usb-redirec for aarch64
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/Makefile                        |  100 +
@ -192,9 +200,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 .distro/README.tests                    |   39 +
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 4860 +++++++++++++++++++++++
+ .distro/qemu-kvm.spec.template          | 4909 +++++++++++++++++++++++
 .distro/rpminspect.yaml                 |    6 +-
 .distro/scripts/extract_build_cmd.py    |   12 +
 .distro/scripts/frh.py                  |    4 +-
 .distro/scripts/process-patches.sh      |    4 +
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
@ -202,7 +211,7 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 ui/vnc-auth-sasl.c                      |    2 +-
- 15 files changed, 5117 insertions(+), 4 deletions(-)
+ 16 files changed, 5168 insertions(+), 6 deletions(-)
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0005-Enable-disable-devices-for-RHEL.patch
@ -1,4 +1,4 @@
-From ebbe3b0dc13b2f8ee7a1fcf9f6e687637a59ea35 Mon Sep 17 00:00:00 2001
+From 048067b4618ba1fa7c8c517185d4cd3a675eba72 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
@ -41,6 +41,12 @@ Rebase notes (8.1.0):
 - Disable CONFIG_ARM_V7M and remove related hack
 - Moved aarch64 tcg cpu disabling from arm machine type commit
 Rebase notes (8.2.0):
 - Disabled new a710 arm64 tcg cpu
 - No longer needed hack for removal of i2c-echo
 - Disable new neoverse-v2
 - Removed CONFIG_OPENGL from x86_64 config file
 Merged patches (6.1.0):
 - c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
 - 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
@ -65,6 +71,9 @@ Merged patches (7.1.0):
 Merged patches (8.1.0):
 - 8173d2eaba Disable unwanted new devices
 Merged patches (8.2.0):
 - b29f66431f Enable igb on x86_64
 ---
 .distro/qemu-kvm.spec.template                |  18 +--
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  41 +++++++
@ -75,18 +84,18 @@ Merged patches (8.1.0):
 hw/arm/virt.c                                 |   2 +
 hw/block/fdc.c                                |  10 ++
 hw/cpu/meson.build                            |   3 +-
 hw/cxl/meson.build                            |   3 +-
 hw/display/cirrus_vga.c                       |   4 +
 hw/ide/piix.c                                 |   5 +-
 hw/ide/qdev.c                                 |   9 ++
 hw/input/pckbd.c                              |   2 +
 hw/misc/meson.build                           |   3 +-
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/usb/meson.build                            |   2 +-
 hw/virtio/meson.build                         |   5 +-
 target/arm/arm-qmp-cmds.c                     |   2 +
- target/arm/cpu-qom.h                          |   1 +
+ target/arm/cpu.c                              |   4 +
- target/arm/cpu.c                              |   5 +
+ target/arm/cpu.h                              |   3 +
 target/arm/cpu.h                              |   2 +
 target/arm/cpu64.c                            |  12 +-
 target/arm/tcg/cpu32.c                        |   2 +
 target/arm/tcg/cpu64.c                        |   8 ++
@ -94,7 +103,7 @@ Merged patches (8.1.0):
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 tests/qtest/arm-cpu-features.c                |   4 +
- 28 files changed, 321 insertions(+), 13 deletions(-)
+ 28 files changed, 323 insertions(+), 15 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
@ -233,7 +242,7 @@ index 0000000000..69a799adbd
 +CONFIG_VHOST_USER_FS=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..6d16d81296
+index 0000000000..ce5be73633
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,110 @@
@ -275,6 +284,7 @@ index 0000000000..6d16d81296
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_QDEV=y
 +CONFIG_IGB_PCI_EXPRESS=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
@ -284,7 +294,6 @@ index 0000000000..6d16d81296
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_OPENGL=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
@ -348,10 +357,10 @@ index 0000000000..6d16d81296
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 7d9dbc2663..3fbe942822 100644
+index be2856c018..af9ea4dd1c 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -204,6 +204,7 @@ static const int a15irqmap[] = {
+@@ -205,6 +205,7 @@ static const int a15irqmap[] = {
 };
 static const char *valid_cpus[] = {
@ -359,8 +368,8 @@ index 7d9dbc2663..3fbe942822 100644
 #ifdef CONFIG_TCG
     ARM_CPU_TYPE_NAME("cortex-a7"),
     ARM_CPU_TYPE_NAME("cortex-a15"),
-@@ -216,6 +217,7 @@ static const char *valid_cpus[] = {
+@@ -219,6 +220,7 @@ static const char *valid_cpus[] = {
-     ARM_CPU_TYPE_NAME("neoverse-v1"),
+     ARM_CPU_TYPE_NAME("neoverse-n2"),
 #endif
     ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
@ -406,6 +415,20 @@ index 6d319947ca..91962fd863 100644
 system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
 index ea0aebf6e3..6878f06974 100644
 --- a/hw/cxl/meson.build
 +++ b/hw/cxl/meson.build
@@ -6,7 +6,8 @@ system_ss.add(when: 'CONFIG_CXL',
                    'cxl-host.c',
                    'cxl-cdat.c',
                    'cxl-events.c',
 -                   'switch-mailbox-cci.c',
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#                   'switch-mailbox-cci.c',
                ),
                if_false: files(
                    'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index b80f98b6c4..0370cf8a64 100644
 --- a/hw/display/cirrus_vga.c
@ -510,25 +533,11 @@ index b92b63bedc..3b6235dde6 100644
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index 892f8b91c5..736512a5c1 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -132,7 +132,8 @@ system_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
 system_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c'))
 -system_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
 +# Disabled for Red Hat Enterprise Linux
 +#system_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
 specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c'))
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index 093c2d4531..198562808d 100644
+index 8ffe1077f1..b3dfeeca4f 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1770,6 +1770,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -536,7 +545,7 @@ index 093c2d4531..198562808d 100644
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1782,6 +1783,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1758,6 +1759,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -545,10 +554,10 @@ index 093c2d4531..198562808d 100644
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index b482d9754a..5c52e01fb7 100644
+index 91fae56573..33e0c8724c 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -384,10 +384,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -386,10 +386,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
@ -574,8 +583,24 @@ index e94149ebde..4a8adbf3dc 100644
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index c0055a7832..12e1d6c67e 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
@@ -17,8 +17,9 @@ if have_vhost
   if have_vhost_user
     # fixme - this really should be generic
     specific_virtio_ss.add(files('vhost-user.c'))
 -    system_virtio_ss.add(files('vhost-user-device.c'))
 -    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(files('vhost-user-device.c'))
 +#    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
   endif
   if have_vhost_vdpa
     system_virtio_ss.add(files('vhost-vdpa.c'))
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
-index c8fa524002..3aa089abf3 100644
+index b53d5efe13..64989a02d1 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
@@ -231,6 +231,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
@ -594,29 +619,14 @@ index c8fa524002..3aa089abf3 100644
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
 index 514c22ced9..f789173451 100644
 --- a/target/arm/cpu-qom.h
 +++ b/target/arm/cpu-qom.h
@@ -35,6 +35,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 +    const char *deprecation_note;
 } ARMCPUInfo;
 void arm_cpu_register(const ARMCPUInfo *info);
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index 93c28d50e5..a8ecc1d474 100644
+index efb22a87f9..a32521ada9 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -2376,8 +2376,13 @@ static void arm_cpu_instance_init(Object *obj)
+@@ -2524,6 +2524,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
 +    
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
@ -625,7 +635,7 @@ index 93c28d50e5..a8ecc1d474 100644
 void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index 88e5accda6..6e191f6cc5 100644
+index a0282e0d28..7e0f0dfea7 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -34,6 +34,8 @@
@ -637,11 +647,19 @@ index 88e5accda6..6e191f6cc5 100644
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
@@ -1120,6 +1122,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 +    const char *deprecation_note;
 } ARMCPUInfo;
 /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index 96158093cc..446e88aba8 100644
+index 1e9c6c85ae..10be900803 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
-@@ -609,6 +609,7 @@ static void aarch64_a57_initfn(Object *obj)
+@@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -649,7 +667,7 @@ index 96158093cc..446e88aba8 100644
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -665,6 +666,7 @@ static void aarch64_a53_initfn(Object *obj)
+@@ -704,6 +705,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_pribits = 5;
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -657,7 +675,7 @@ index 96158093cc..446e88aba8 100644
 static void aarch64_host_initfn(Object *obj)
 {
-@@ -703,8 +705,11 @@ static void aarch64_max_initfn(Object *obj)
+@@ -742,8 +744,11 @@ static void aarch64_max_initfn(Object *obj)
 }
 static const ARMCPUInfo aarch64_cpus[] = {
@ -670,7 +688,7 @@ index 96158093cc..446e88aba8 100644
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
-@@ -776,8 +781,13 @@ static void aarch64_cpu_instance_init(Object *obj)
+@@ -815,8 +820,13 @@ static void aarch64_cpu_instance_init(Object *obj)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@ -685,10 +703,10 @@ index 96158093cc..446e88aba8 100644
 void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
-index 47d2e8e781..0501c5ac27 100644
+index d9e0e2a4dd..c5c639a6ea 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
-@@ -94,6 +94,7 @@ void aa32_max_features(ARMCPU *cpu)
+@@ -98,6 +98,7 @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
@ -696,24 +714,24 @@ index 47d2e8e781..0501c5ac27 100644
 #if !defined(CONFIG_USER_ONLY)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
-@@ -1183,3 +1184,4 @@ static void arm_tcg_cpu_register_types(void)
+@@ -1189,3 +1190,4 @@ static void arm_tcg_cpu_register_types(void)
 type_init(arm_tcg_cpu_register_types)
 #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-index 8019f00bc3..bf191113d8 100644
+index fcda99e158..bd5a993ff8 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
-@@ -27,6 +27,7 @@
+@@ -29,6 +29,7 @@
- #include "internals.h"
+ #include "cpu-features.h"
 #include "cpregs.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void aarch64_a35_initfn(Object *obj)
+ static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
                               unsigned cachesize)
 {
-     ARMCPU *cpu = ARM_CPU(obj);
+@@ -134,6 +135,7 @@ static void aarch64_a35_initfn(Object *obj)
@@ -106,6 +107,7 @@ static void aarch64_a35_initfn(Object *obj)
     /* These values are the same with A53/A57/A72. */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -721,7 +739,7 @@ index 8019f00bc3..bf191113d8 100644
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
-@@ -195,6 +197,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+@@ -223,6 +225,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
@ -729,7 +747,7 @@ index 8019f00bc3..bf191113d8 100644
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -699,6 +702,7 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
+@@ -1065,6 +1068,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
 }
@ -737,7 +755,7 @@ index 8019f00bc3..bf191113d8 100644
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
-@@ -883,6 +887,7 @@ void aarch64_max_tcg_initfn(Object *obj)
+@@ -1259,6 +1263,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
@ -745,9 +763,9 @@ index 8019f00bc3..bf191113d8 100644
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
-@@ -892,14 +897,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
+@@ -1270,14 +1275,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },
     { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
     { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
 };
 +#endif
@ -840,10 +858,10 @@ index 63981bf36b..87a4480c05 100644
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index a9e5880349..4b5df17983 100644
+index 33ab3551f4..912e493951 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
-@@ -2529,6 +2529,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2567,6 +2567,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
@ -859,10 +877,10 @@ index a9e5880349..4b5df17983 100644
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index 3fc33fc24d..e5e4007e9f 100644
+index a8a4c668ad..2458cc527c 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
-@@ -441,8 +441,10 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -451,8 +451,10 @@ static void test_query_cpu_model_expansion(const void *data)
     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
     /* Test expected feature presence/absence for some cpu types */
@ -873,7 +891,7 @@ index 3fc33fc24d..e5e4007e9f 100644
     /* Enabling and disabling pmu should always work. */
     assert_has_feature_enabled(qts, "max", "pmu");
-@@ -459,6 +461,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -469,6 +471,7 @@ static void test_query_cpu_model_expansion(const void *data)
         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
@ -881,7 +899,7 @@ index 3fc33fc24d..e5e4007e9f 100644
         assert_has_feature_enabled(qts, "a64fx", "pmu");
         assert_has_feature_enabled(qts, "a64fx", "aarch64");
         /*
-@@ -471,6 +474,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -481,6 +484,7 @@ static void test_query_cpu_model_expansion(const void *data)
                      "{ 'sve384': true }");
         assert_error(qts, "a64fx", "cannot enable sve640",
                      "{ 'sve640': true }");
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0006-Machine-type-related-general-changes.patch
@ -1,4 +1,4 @@
-From 145fbe0a1526bb68a7bd7acaf5b41539faf5f04a Mon Sep 17 00:00:00 2001
+From d9ff466c980d219ebf230ea24becce294c196f1f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@ -58,27 +58,30 @@ Merged patches (8.0.0):
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (general part)
 - 1165e24c6b hw/pci: Disable PCI_ERR_UNCOR_MASK reg for machine type <= pc-q35-rhel9.2.0
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
 hw/acpi/piix4.c              |   2 +-
 hw/arm/virt.c                |   2 +-
- hw/core/machine.c            | 241 +++++++++++++++++++++++++++++++++++
+ hw/core/machine.c            | 267 +++++++++++++++++++++++++++++++++++
 hw/i386/pc_piix.c            |   2 +
 hw/i386/pc_q35.c             |   2 +
 hw/net/rtl8139.c             |   4 +-
- hw/smbios/smbios.c           |  46 ++++++-
+ hw/smbios/smbios.c           |  46 +++++-
 hw/timer/i8254_common.c      |   2 +-
- hw/usb/hcd-xhci-pci.c        |  59 +++++++--
+ hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
- include/hw/boards.h          |  34 +++++
+ include/hw/boards.h          |  40 ++++++
 include/hw/firmware/smbios.h |   5 +-
 include/hw/i386/pc.h         |   3 +
- 13 files changed, 381 insertions(+), 22 deletions(-)
+ 13 files changed, 413 insertions(+), 22 deletions(-)
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 63d2113b86..a24b9aac92 100644
+index dd523d2e4c..5050c0ba97 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -247,7 +247,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
+@@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
@ -88,10 +91,10 @@ index 63d2113b86..a24b9aac92 100644
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 3fbe942822..33a36112da 100644
+index af9ea4dd1c..62f0f7d4d6 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1629,7 +1629,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1638,7 +1638,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
@ -101,10 +104,10 @@ index 3fbe942822..33a36112da 100644
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index f0d35c6401..2e54c7ae7c 100644
+index 0c17398141..446601ee30 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -53,6 +53,247 @@ GlobalProperty hw_compat_7_2[] = {
+@@ -57,6 +57,273 @@ GlobalProperty hw_compat_7_2[] = {
 };
 const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
@ -114,6 +117,32 @@ index f0d35c6401..2e54c7ae7c 100644
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
 +GlobalProperty hw_compat_rhel_9_4[] = {
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "host_uso", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "ramfb", "x-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "igb", "x-pcie-flr-init", "off" },
 +};
 +const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 +
 +GlobalProperty hw_compat_rhel_9_3[] = {
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { "migration", "multifd-flush-after-each-section", "on"},
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 +};
 +const size_t hw_compat_rhel_9_3_len = G_N_ELEMENTS(hw_compat_rhel_9_3);
 +
 +GlobalProperty hw_compat_rhel_9_2[] = {
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "e1000e", "migrate-timadj", "off" },
@ -353,10 +382,10 @@ index f0d35c6401..2e54c7ae7c 100644
     { "virtio-device", "queue_reset", "false" },
     { "virtio-rng-pci", "vectors", "0" },
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index ac72e8f5be..2ecd9bb2d8 100644
+index eace854335..2a9f465619 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -240,6 +240,8 @@ static void pc_init1(MachineState *machine,
+@@ -238,6 +238,8 @@ static void pc_init1(MachineState *machine,
         smbios_set_defaults("QEMU", mc->desc,
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
@ -366,10 +395,10 @@ index ac72e8f5be..2ecd9bb2d8 100644
     }
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index dc27a9e223..27a4ec0641 100644
+index 4f3e5412f6..912cb0c0dc 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -202,6 +202,8 @@ static void pc_q35_init(MachineState *machine)
+@@ -206,6 +206,8 @@ static void pc_q35_init(MachineState *machine)
         smbios_set_defaults("QEMU", mc->desc,
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
@ -379,7 +408,7 @@ index dc27a9e223..27a4ec0641 100644
     }
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index b4df75b2c9..fce2af5dd2 100644
+index 4af8c66266..7dc12907ab 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
@@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
@ -402,7 +431,7 @@ index b4df75b2c9..fce2af5dd2 100644
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 10cd22f610..944b2c31e3 100644
+index 2a90601ac5..7bde23e59d 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -58,6 +58,9 @@ static bool smbios_legacy = true;
@ -484,10 +513,10 @@ index 10cd22f610..944b2c31e3 100644
     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
-index e4093e2904..3a6588b46d 100644
+index b25da448c8..0331e84398 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
-@@ -231,7 +231,7 @@ static const VMStateDescription vmstate_pit_common = {
+@@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (VMStateField[]) {
@ -608,13 +637,19 @@ index 08f70ce97c..1be7527c1b 100644
 #endif
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index ed83360198..6dafe2c3a9 100644
+index da85f86efb..4a21eddbf9 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -471,4 +471,38 @@ extern const size_t hw_compat_2_2_len;
+@@ -503,4 +503,44 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_4[];
 +extern const size_t hw_compat_rhel_9_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_3[];
 +extern const size_t hw_compat_rhel_9_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_2[];
 +extern const size_t hw_compat_rhel_9_2_len;
 +
@ -667,10 +702,10 @@ index 7f3259a630..d24b3ccd32 100644
 void smbios_get_tables(MachineState *ms,
                        const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index d54e8b1101..ae0f49b93c 100644
+index a10ceeabbf..037942d233 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -110,6 +110,9 @@ struct PCMachineClass {
+@@ -113,6 +113,9 @@ struct PCMachineClass {
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
     SmbiosEntryPointType default_smbios_ep_type;
--- a/0007-Add-aarch64-machine-types.patch
+++ b/0007-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From f68fb44c79615701195203b2548135579b1fd596 Mon Sep 17 00:00:00 2001
+From 23f614ab0b79ec1c6f65a7f0d6993bfdfc53fd23 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -61,16 +61,19 @@ Merged patches (8.0.0):
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (arm part)
 - c07f666086 hw/arm/virt: Validate cluster and NUMA node boundary for RHEL machines
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
- hw/arm/virt.c         | 248 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 250 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 255 insertions(+), 1 deletion(-)
+ 2 files changed, 257 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 33a36112da..3c36106eb5 100644
+index 62f0f7d4d6..c541efee5e 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -81,6 +81,7 @@
+@@ -82,6 +82,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
@ -78,7 +81,7 @@ index 33a36112da..3c36106eb5 100644
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -107,7 +108,48 @@
+@@ -108,7 +109,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@ -127,7 +130,7 @@ index 33a36112da..3c36106eb5 100644
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2332,6 +2374,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2341,6 +2383,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -135,7 +138,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2359,6 +2402,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2368,6 +2411,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -143,7 +146,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-@@ -2374,6 +2418,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2383,6 +2427,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
     vms->highmem = value;
 }
@ -151,7 +154,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_compact_highmem(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2429,7 +2474,7 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
+@@ -2438,7 +2483,7 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
     vms->highmem_mmio = value;
 }
@ -160,7 +163,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_its(Object *obj, Error **errp)
 {
-@@ -2445,6 +2490,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
+@@ -2454,6 +2499,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
@ -168,7 +171,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2458,6 +2504,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
+@@ -2467,6 +2513,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
@ -176,7 +179,7 @@ index 33a36112da..3c36106eb5 100644
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
-@@ -2541,6 +2588,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
+@@ -2550,6 +2597,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
@ -184,7 +187,7 @@ index 33a36112da..3c36106eb5 100644
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2554,6 +2602,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+@@ -2563,6 +2611,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
@ -192,7 +195,7 @@ index 33a36112da..3c36106eb5 100644
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-@@ -2925,6 +2974,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2935,6 +2984,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
@ -200,7 +203,7 @@ index 33a36112da..3c36106eb5 100644
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3388,3 +3438,199 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3405,3 +3455,201 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -382,6 +385,8 @@ index 33a36112da..3c36106eb5 100644
 +static void rhel920_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
@ -401,10 +406,10 @@ index 33a36112da..3c36106eb5 100644
 +}
 +DEFINE_RHEL_MACHINE(9, 0, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index e1ddbea96b..81c2363a40 100644
+index f69239850e..7b8abe5645 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -187,9 +187,17 @@ struct VirtMachineState {
+@@ -177,9 +177,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
--- a/0008-Add-ppc64-machine-types.patch
+++ b/0008-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From bfe11e8d63f27ebc5bba4ca915e6e641af3a340b Mon Sep 17 00:00:00 2001
+From d03cff85f5f1b69b1a66011ebaa974ece81d31bc Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -34,10 +34,10 @@ Merged patches (7.1.0):
 8 files changed, 314 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 1c8b8d57a7..e6c6be9e1d 100644
+index df09aa9d6a..ff459e1a46 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1640,6 +1640,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+@@ -1689,6 +1689,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
@ -47,7 +47,7 @@ index 1c8b8d57a7..e6c6be9e1d 100644
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3359,6 +3362,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3397,6 +3400,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
@ -68,7 +68,7 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3437,6 +3454,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3475,6 +3492,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -81,7 +81,7 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 }
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4701,6 +4724,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4734,6 +4757,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
     vmc->setprop = spapr_vof_setprop;
@ -89,15 +89,15 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4752,6 +4776,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4785,6 +4809,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-8.1
+  * pseries-8.2
  */
-@@ -4923,6 +4948,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4967,6 +4992,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -105,8 +105,8 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 /*
  * pseries-4.0
-@@ -4942,6 +4968,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4982,6 +5008,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
-     *nv2atsd = 0;
+     }
     return true;
 }
 +
@ -114,7 +114,7 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5269,6 +5297,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -5306,6 +5334,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -337,7 +337,7 @@ index 1c8b8d57a7..e6c6be9e1d 100644
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 5c52e01fb7..27ec35f98a 100644
+index 33e0c8724c..9d01663f43 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -25,6 +25,7 @@
@ -348,7 +348,7 @@ index 5c52e01fb7..27ec35f98a 100644
 static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-@@ -259,6 +260,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -261,6 +262,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
@ -356,7 +356,7 @@ index 5c52e01fb7..27ec35f98a 100644
     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
         return false;
-@@ -275,6 +277,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -277,6 +279,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
@ -375,10 +375,10 @@ index 5c52e01fb7..27ec35f98a 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index 538b2dfb89..7d5aea4e28 100644
+index e91791a1a9..1951d8a2a0 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -157,6 +157,7 @@ struct SpaprMachineClass {
+@@ -154,6 +154,7 @@ struct SpaprMachineClass {
     bool pre_5_2_numa_associativity;
     bool pre_6_2_numa_affinity;
@ -386,7 +386,7 @@ index 538b2dfb89..7d5aea4e28 100644
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -259,6 +260,9 @@ struct SpaprMachineState {
+@@ -256,6 +257,9 @@ struct SpaprMachineState {
     /* Set by -boot */
     char *boot_device;
@ -397,7 +397,7 @@ index 538b2dfb89..7d5aea4e28 100644
     char *kvm_type;
     char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
-index 7949a24f5a..f207a9ba01 100644
+index ebef2cccec..ff2c00c60e 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
@@ -114,8 +114,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
@ -434,10 +434,10 @@ index 69fddb05bc..64a05aaef3 100644
     { "405cr", "405crc" },
     { "405gp", "405gpd" },
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 25fac9577a..26e4a5cd00 100644
+index f8101ffa29..e799a2bee6 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1486,6 +1486,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1635,6 +1635,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -446,7 +446,7 @@ index 25fac9577a..26e4a5cd00 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index a8a935e267..5471407d02 100644
+index 9b1abe2fc4..56f1c46e8e 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
@@ -89,6 +89,7 @@ static int cap_large_decr;
@ -457,7 +457,7 @@ index a8a935e267..5471407d02 100644
 static uint32_t debug_inst_opcode;
-@@ -136,6 +137,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -141,6 +142,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
@ -502,10 +502,10 @@ index a8a935e267..5471407d02 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 6a4dd9c560..e0cd6fb1c7 100644
+index 1975fb5ee6..d1017f98be 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
-@@ -42,6 +42,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
+@@ -46,6 +46,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
@ -513,7 +513,7 @@ index 6a4dd9c560..e0cd6fb1c7 100644
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
 void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t page_shift,
-@@ -75,6 +76,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
+@@ -79,6 +80,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_has_cap_rpt_invalidate(void);
 bool kvmppc_supports_ail_3(void);
 int kvmppc_enable_hwrng(void);
@ -522,7 +522,7 @@ index 6a4dd9c560..e0cd6fb1c7 100644
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -423,6 +426,16 @@ static inline bool kvmppc_supports_ail_3(void)
+@@ -427,6 +430,16 @@ static inline bool kvmppc_supports_ail_3(void)
     return false;
 }
--- a/0009-Add-s390x-machine-types.patch
+++ b/0009-Add-s390x-machine-types.patch
@ -1,4 +1,4 @@
-From a3b5d9d0d0b59de4956ad88e5e855fe1a56ae215 Mon Sep 17 00:00:00 2001
+From 3623043d4a923bf9f541d439c76e7874cf0fa81d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@ -38,41 +38,59 @@ Merged patches (8.0.0):
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (s390x part)
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
- hw/s390x/s390-virtio-ccw.c       | 144 +++++++++++++++++++++++++++++++
+ hw/s390x/s390-virtio-ccw.c       | 159 +++++++++++++++++++++++++++++++
 target/s390x/cpu_models.c        |  11 +++
 target/s390x/cpu_models.h        |   2 +
 target/s390x/cpu_models_sysemu.c |   2 +
- 4 files changed, 159 insertions(+)
+ 4 files changed, 174 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 4516d73ff5..2a5dbd2728 100644
+index 7262725d2e..984891b82a 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -828,6 +828,7 @@ bool css_migration_enabled(void)
+@@ -855,6 +855,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_8_1_instance_options(MachineState *machine)
+ static void ccw_machine_8_2_instance_options(MachineState *machine)
 {
 }
-@@ -1215,6 +1216,149 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1256,6 +1257,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +
 +static void ccw_machine_rhel940_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel940_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 +
 +static void ccw_machine_rhel920_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel940_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel920_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel940_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
-+DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", true);
+DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", false);
 +
 +static void ccw_machine_rhel900_instance_options(MachineState *machine)
 +{
@ -208,7 +226,7 @@ index 4516d73ff5..2a5dbd2728 100644
 static void ccw_machine_register_types(void)
 {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 91ce896491..2479776573 100644
+index a63d990e4e..198b81f2c0 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -46,6 +46,9 @@
@ -221,7 +239,7 @@ index 91ce896491..2479776573 100644
 static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
-@@ -857,22 +860,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
+@@ -856,22 +859,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
@ -253,16 +271,16 @@ index 91ce896491..2479776573 100644
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
-index cc7305ec21..05abe5b92e 100644
+index d7b8912989..1a806a97c4 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
-@@ -38,6 +38,8 @@ struct S390CPUDef {
+@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
- };
+ } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
--- a/0010-Add-x86_64-machine-types.patch
+++ b/0010-Add-x86_64-machine-types.patch
@ -1,4 +1,4 @@
-From 70b66fab556a893f7f8b328f92bcd94c9b2978dd Mon Sep 17 00:00:00 2001
+From b432505cb28bc3b9b0c1849210ac6c63bca3fe37 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@ -53,25 +53,29 @@ Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (x86_64 part)
 - c6eaf73add redhat: hw/i386/pc: Update x86 machine type compatibility for QEMU 8.0.0 update
 - 6cbf496e5e hw/acpi: Mark acpi blobs as resizable on RHEL pc machines version 7.6 and above
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 - 719e2ac147 Fix x86 machine type compatibility for qemu-kvm 8.1.0
 ---
- hw/i386/pc.c               | 153 +++++++++++++++++++++-
+ hw/i386/pc.c               | 159 ++++++++++++++++++++-
- hw/i386/pc_piix.c          |  91 ++++++++++++-
+ hw/i386/pc_piix.c          | 112 ++++++++++++++-
- hw/i386/pc_q35.c           | 257 ++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc_q35.c           | 285 ++++++++++++++++++++++++++++++++++++-
 include/hw/boards.h        |   2 +
- include/hw/i386/pc.h       |  30 +++++
+ include/hw/i386/pc.h       |  33 +++++
 target/i386/cpu.c          |  21 +++
 target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
- 9 files changed, 557 insertions(+), 7 deletions(-)
+ 9 files changed, 615 insertions(+), 7 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 3109d5e0e0..4be9a7db82 100644
+index 29b9964733..a1faa9e92c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -410,6 +410,155 @@ GlobalProperty pc_compat_1_4[] = {
+@@ -323,6 +323,161 @@ GlobalProperty pc_compat_2_0[] = {
 };
- const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
+ const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
 +/* This macro is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
@ -95,6 +99,12 @@ index 3109d5e0e0..4be9a7db82 100644
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_9_3_compat[] = {
 +    /* pc_rhel_9_3_compat from pc_compat_8_0 */
 +    { "virtio-mem", "unplugged-inaccessible", "auto" },
 +};
 +const size_t pc_rhel_9_3_compat_len = G_N_ELEMENTS(pc_rhel_9_3_compat);
 +
 +GlobalProperty pc_rhel_9_2_compat[] = {
 +    /* pc_rhel_9_2_compat from pc_compat_7_2 */
 +    { "ICH9-LPC", "noreboot", "true" },
@ -225,7 +235,7 @@ index 3109d5e0e0..4be9a7db82 100644
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
-@@ -1865,6 +2014,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1826,6 +1981,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->kvmclock_create_always = true;
     pcmc->resizable_acpi_blob = true;
     assert(!mc->get_hotplug_handler);
@ -233,7 +243,7 @@ index 3109d5e0e0..4be9a7db82 100644
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1875,7 +2025,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1836,7 +1992,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->has_hotpluggable_cpus = true;
     mc->default_boot_order = "cad";
     mc->block_default_type = IF_IDE;
@ -244,10 +254,10 @@ index 3109d5e0e0..4be9a7db82 100644
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 2ecd9bb2d8..db7d8e26e1 100644
+index 2a9f465619..44038391fb 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -56,6 +56,7 @@
+@@ -53,6 +53,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/xen.h"
@ -255,7 +265,7 @@ index 2ecd9bb2d8..db7d8e26e1 100644
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
-@@ -237,8 +238,8 @@ static void pc_init1(MachineState *machine,
+@@ -235,8 +236,8 @@ static void pc_init1(MachineState *machine,
     if (pcmc->smbios_defaults) {
         MachineClass *mc = MACHINE_GET_CLASS(machine);
         /* These values are guest ABI, do not change */
@ -266,7 +276,7 @@ index 2ecd9bb2d8..db7d8e26e1 100644
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
-@@ -400,6 +401,7 @@ static void pc_init1(MachineState *machine,
+@@ -453,6 +454,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
@ -274,7 +284,7 @@ index 2ecd9bb2d8..db7d8e26e1 100644
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -966,3 +968,88 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+@@ -970,3 +972,109 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
@ -311,6 +321,7 @@ index 2ecd9bb2d8..db7d8e26e1 100644
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    ObjectClass *oc = OBJECT_CLASS(m);
 +    pc_machine_rhel7_options(m);
 +    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
 +    m->async_pf_vmexit_disable = true;
@ -324,7 +335,27 @@ index 2ecd9bb2d8..db7d8e26e1 100644
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +    /* From pc_i440fx_7_0_machine_options() */
 +    pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
 +
 +    object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
 +                                   &PCSouthBridgeOption_lookup,
 +                                   pc_get_south_bridge,
 +                                   pc_set_south_bridge);
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
@ -364,10 +395,10 @@ index 2ecd9bb2d8..db7d8e26e1 100644
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 27a4ec0641..e878bf4626 100644
+index 912cb0c0dc..6387df97c8 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -199,8 +199,8 @@ static void pc_q35_init(MachineState *machine)
+@@ -203,8 +203,8 @@ static void pc_q35_init(MachineState *machine)
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
@ -378,7 +409,7 @@ index 27a4ec0641..e878bf4626 100644
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
-@@ -359,6 +359,7 @@ static void pc_q35_init(MachineState *machine)
+@@ -363,6 +363,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
@ -386,7 +417,7 @@ index 27a4ec0641..e878bf4626 100644
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -683,3 +684,255 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -699,3 +700,283 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
@ -415,6 +446,24 @@ index 27a4ec0641..e878bf4626 100644
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel940_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 +                  pc_q35_machine_rhel940_options);
 +
 +
 +static void pc_q35_init_rhel920(MachineState *machine)
 +{
 +    pc_q35_init(machine);
@ -423,11 +472,21 @@ index 27a4ec0641..e878bf4626 100644
 +static void pc_q35_machine_rhel920_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
+    pc_q35_machine_rhel940_options(m);
 +    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.2.0";
 +
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
@ -643,10 +702,10 @@ index 27a4ec0641..e878bf4626 100644
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 6dafe2c3a9..d9d1ae6dd1 100644
+index 4a21eddbf9..4edfdb0ddb 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -272,6 +272,8 @@ struct MachineClass {
+@@ -277,6 +277,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
@ -656,16 +715,19 @@ index 6dafe2c3a9..d9d1ae6dd1 100644
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index ae0f49b93c..7b569fa254 100644
+index 037942d233..37644ede7e 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -301,6 +301,36 @@ extern const size_t pc_compat_1_4_len;
+@@ -314,6 +314,39 @@ extern const size_t pc_compat_1_4_len;
 int pc_machine_kvm_type(MachineState *machine, const char *vm_type);
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_3_compat[];
 +extern const size_t pc_rhel_9_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_2_compat[];
 +extern const size_t pc_rhel_9_2_compat_len;
 +
@ -697,10 +759,10 @@ index ae0f49b93c..7b569fa254 100644
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
     { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 97ad229d8b..c1c9992e6f 100644
+index cd16cb893d..93203d9b91 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
-@@ -2183,9 +2183,13 @@ static const CPUCaches epyc_genoa_cache_info = {
+@@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
  *  PT in VMX operation
  */
@ -714,7 +776,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
-@@ -2206,6 +2210,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2213,6 +2217,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "phenom",
@ -722,7 +784,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
-@@ -2238,6 +2243,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2245,6 +2250,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "core2duo",
@ -730,7 +792,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2280,6 +2286,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2287,6 +2293,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm64",
@ -738,7 +800,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
-@@ -2321,6 +2328,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2328,6 +2335,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "qemu32",
@ -746,7 +808,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 4,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2335,6 +2343,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2342,6 +2350,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm32",
@ -754,7 +816,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 5,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
-@@ -2365,6 +2374,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2372,6 +2381,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "coreduo",
@ -762,7 +824,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2398,6 +2408,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2405,6 +2415,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "486",
@ -770,7 +832,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 4,
-@@ -2410,6 +2421,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2417,6 +2428,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium",
@ -778,7 +840,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 5,
-@@ -2422,6 +2434,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2429,6 +2441,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium2",
@ -786,7 +848,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 2,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2434,6 +2447,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2441,6 +2454,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium3",
@ -794,7 +856,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 3,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2446,6 +2460,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2453,6 +2467,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "athlon",
@ -802,7 +864,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 2,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
-@@ -2461,6 +2476,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2468,6 +2483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "n270",
@ -810,7 +872,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2486,6 +2502,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2493,6 +2509,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Conroe",
@ -818,7 +880,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -2526,6 +2543,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -2533,6 +2550,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Penryn",
@ -826,7 +888,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
-@@ -4387,6 +4405,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -4394,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G1",
@ -834,7 +896,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
-@@ -4407,6 +4426,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -4414,6 +4433,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
@ -842,7 +904,7 @@ index 97ad229d8b..c1c9992e6f 100644
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
-@@ -4429,6 +4449,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -4436,6 +4456,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
@ -851,10 +913,10 @@ index 97ad229d8b..c1c9992e6f 100644
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 7237378a7d..7b8a3d5af0 100644
+index 9c791b7b05..b91af5051f 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
-@@ -137,6 +137,7 @@ static PropValue kvm_default_props[] = {
+@@ -138,6 +138,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
@ -863,10 +925,10 @@ index 7237378a7d..7b8a3d5af0 100644
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index ebfaf3d24c..147f6c4587 100644
+index 4ce80555b4..9d41edf01e 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
-@@ -3826,6 +3826,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3711,6 +3711,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
@ -874,7 +936,7 @@ index ebfaf3d24c..147f6c4587 100644
     kvm_msr_buf_reset(cpu);
-@@ -4181,6 +4182,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4065,6 +4066,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
--- a/0011-Enable-make-check.patch
+++ b/0011-Enable-make-check.patch
@ -1,4 +1,4 @@
-From 301a52cd6a94e98e69b8beac2810e76f1cc47073 Mon Sep 17 00:00:00 2001
+From 66a0510405e5142a1f9e38e0770aa0f10aed3e03 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
@ -35,6 +35,9 @@ Rebase changes (8.0.0):
 Rebase changes (8.1.0):
 - Do not disable device-plug-test for s390x
 Rebase changes (8.2.0 rc1):
 - Remove unneeded hack in qtest/usb-hcd-xhci-test.c
 Merged patches (6.1.0):
 - 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
@ -56,16 +59,14 @@ Merged patches (8.1.0):
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             |  1 -
 tests/qtest/tco-test.c              |  2 +-
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
 tests/qtest/virtio-net-failover.c   |  1 +
- 15 files changed, 38 insertions(+), 31 deletions(-)
+ 13 files changed, 33 insertions(+), 30 deletions(-)
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index 79c607b0e7..c8827624f8 100644
+index c37afa662c..61c95a2198 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
-@@ -147,7 +147,7 @@ def test_aarch64_virt(self):
+@@ -153,7 +153,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -75,10 +76,10 @@ index 79c607b0e7..c8827624f8 100644
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index 680c314cfc..71eccb8fb6 100644
+index 4cce5a5598..e9248a04a2 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
-@@ -206,7 +206,7 @@ def test_aarch64_virt(self):
+@@ -230,7 +230,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -88,10 +89,10 @@ index 680c314cfc..71eccb8fb6 100644
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
-index 642d2e49e3..93b3afd823 100644
+index 15fd87b2c1..f0d9d89c93 100644
 --- a/tests/avocado/tcg_plugins.py
 +++ b/tests/avocado/tcg_plugins.py
-@@ -68,7 +68,7 @@ def test_aarch64_virt_insn(self):
+@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -100,7 +101,7 @@ index 642d2e49e3..93b3afd823 100644
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -94,7 +94,7 @@ def test_aarch64_virt_insn_icount(self):
+@@ -96,7 +96,7 @@ def test_aarch64_virt_insn_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -109,7 +110,7 @@ index 642d2e49e3..93b3afd823 100644
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -120,7 +120,7 @@ def test_aarch64_virt_mem_icount(self):
+@@ -126,7 +126,7 @@ def test_aarch64_virt_mem_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -119,7 +120,7 @@ index 642d2e49e3..93b3afd823 100644
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
-index 44761e1e4d..f4b71900f3 100644
+index 53847cb98f..a2abdb650e 100644
 --- a/tests/qemu-iotests/meson.build
 +++ b/tests/qemu-iotests/meson.build
@@ -51,21 +51,21 @@ foreach format, speed: qemu_iotests_formats
@ -162,7 +163,7 @@ index 44761e1e4d..f4b71900f3 100644
 +#  endforeach
 endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
-index 9a37ad9152..963514aab3 100644
+index 3ff38f2661..cab9a2bd6c 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
@@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
@ -202,18 +203,18 @@ index e37b48b2cc..88647da054 100644
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
-index d4a8db6fd6..1a796ec15a 100644
+index 663bb6c485..2efc43e3f7 100644
 --- a/tests/qtest/intel-hda-test.c
 +++ b/tests/qtest/intel-hda-test.c
-@@ -38,7 +38,7 @@ static void test_issue542_ich6(void)
+@@ -42,7 +42,7 @@ static void test_issue542_ich6(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
 +    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
                    AUDIODEV
                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
     qtest_outl(s, 0xcf8, 0x80000804);
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 90aae42a22..9bc4e41af0 100644
 --- a/tests/qtest/libqos/meson.build
@ -241,7 +242,7 @@ index 8ac95b89f7..cd2102555c 100644
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index b071d400b3..1c81155565 100644
+index 47dabf91d0..0bdfa3a821 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -97,7 +97,6 @@ qtests_i386 = \
@ -252,54 +253,11 @@ index b071d400b3..1c81155565 100644
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
 diff --git a/tests/qtest/tco-test.c b/tests/qtest/tco-test.c
 index 0547d41173..3756ce82d8 100644
 --- a/tests/qtest/tco-test.c
 +++ b/tests/qtest/tco-test.c
@@ -60,7 +60,7 @@ static void test_init(TestData *d)
     QTestState *qs;
     qs = qtest_initf("-machine q35 %s %s",
 -                     d->noreboot ? "-global ICH9-LPC.noreboot=true" : "",
 +                     d->noreboot ? "" : "-global ICH9-LPC.noreboot=false",
                      !d->args ? "" : d->args);
     qtest_irq_intercept_in(qs, "ioapic");
 diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
 index 10ef9d2a91..3855873050 100644
 --- a/tests/qtest/usb-hcd-xhci-test.c
 +++ b/tests/qtest/usb-hcd-xhci-test.c
@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_usb_uas_hotplug(void)
 {
     QTestState *qts = global_qtest;
@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
     qtest_qmp_device_del(qts, "scsihd");
     qtest_qmp_device_del(qts, "uas");
 }
 +#endif
 static void test_usb_ccid_hotplug(void)
 {
@@ -56,7 +58,9 @@ int main(int argc, char **argv)
     qtest_add_func("/xhci/pci/init", test_xhci_init);
     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
 +#endif
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
-index 4a809590bf..1bf3fa641c 100644
+index 0d40bc1f2d..4c633c1584 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
-@@ -25,6 +25,7 @@
+@@ -26,6 +26,7 @@
 #define PCI_SEL_BASE            0x0010
 #define BASE_MACHINE "-M q35 -nodefaults " \
--- a/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From 6e5c0cde105d9250a6c46c06e44c4066cb804bf4 Mon Sep 17 00:00:00 2001
+From a27cfa0b407bd806ce389a7c69d0130bcfd35244 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -26,13 +26,16 @@ Count of slots increased to 509 later so we could increase limit
 to 64 as some usecases require more than 32 devices.
 Signed-off-by: Bandan Das <bsd@redhat.com>
 Rebase changes (231025):
 - Update to upstream changes
 ---
- hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
+ hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
- 2 files changed, 29 insertions(+), 1 deletion(-)
+ 2 files changed, 31 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index a205c6b113..07ea78beed 100644
+index c62c02f7b6..ec98080f28 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
@@ -48,6 +48,9 @@
@ -45,14 +48,19 @@ index a205c6b113..07ea78beed 100644
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
 static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
-@@ -2985,11 +2988,32 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -3076,14 +3079,37 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     ssize_t len;
+ {
     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char *tmp, *subsys;
     Error *err = NULL;
     struct stat st;
     int groupid;
 -    int i, ret;
 +    int ret, i = 0;
     bool is_mdev;
-     char uuid[UUID_FMT_LEN];
+     char uuid[UUID_STR_LEN];
     char *name;
 +    if (device_limit && device_limit != vdev->assigned_device_limit) {
@ -79,7 +87,7 @@ index a205c6b113..07ea78beed 100644
     if (!vbasedev->sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3443,6 +3467,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3501,6 +3527,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -90,10 +98,10 @@ index a205c6b113..07ea78beed 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index a2771b9ff3..a69af7bdde 100644
+index fba8737ab2..eb74d9de2d 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -141,6 +141,7 @@ struct VFIOPCIDevice {
+@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
     EventNotifier err_notifier;
     EventNotifier req_notifier;
     int (*resetfn)(struct VFIOPCIDevice *);
--- a/0013-Add-support-statement-to-help-output.patch
+++ b/0013-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From b6d7732d3fb071c96a86d8e98d8ef9f73932deaf Mon Sep 17 00:00:00 2001
+From 424f14d123fe1043518758605d94ed5ba50e52ad Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -17,14 +17,14 @@ as unsupported by Red Hat, and advising users to use libvirt instead.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 ---
- softmmu/vl.c | 9 +++++++++
+ system/vl.c | 9 +++++++++
 1 file changed, 9 insertions(+)
-diff --git a/softmmu/vl.c b/softmmu/vl.c
+diff --git a/system/vl.c b/system/vl.c
-index b0b96f67fa..e24c74771b 100644
+index 2bcd9efb9a..93635ffc5b 100644
--- a/softmmu/vl.c
+--- a/system/vl.c
-+++ b/softmmu/vl.c
+++ b/system/vl.c
-@@ -835,9 +835,17 @@ static void version(void)
+@@ -870,9 +870,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -42,7 +42,7 @@ index b0b96f67fa..e24c74771b 100644
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
             g_get_prgname());
-@@ -863,6 +871,7 @@ static void help(int exitcode)
+@@ -898,6 +906,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
--- a/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,4 +1,4 @@
-From 9f13719399c2b07b3fe8d691134363075ccd8a32 Mon Sep 17 00:00:00 2001
+From c683ff4a770b77dbe707413840918a46f67fa825 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
@ -36,10 +36,10 @@ index 52d6454b93..d74dbdeca9 100644
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 29b98c3d4c..75a6396ed6 100644
+index 42fd09e4de..557118cb1f 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3370,11 +3370,11 @@ SRST
+@@ -3469,11 +3469,11 @@ SRST
     ::
--- a/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,4 +1,4 @@
-From 28f0f014754e68ca5e5e00ba0dfbb38e3f60e77b Mon Sep 17 00:00:00 2001
+From 776bff1be5e98982a9bbc8345ff27274ff5b8c0f Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
@ -44,10 +44,10 @@ Rebase notes (6.1.0):
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
-index c51388e99d..3afcc6d326 100644
+index 13e032bd5e..7968735346 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
-@@ -1357,6 +1357,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
+@@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
         ret = -ENOTSUP;
         goto fail;
     }
@ -61,7 +61,7 @@ index c51388e99d..3afcc6d326 100644
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index fc3c64bcb8..4b238954d5 100644
+index 2846c83808..83472953a2 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -83,6 +83,7 @@ _filter_qemu()
--- a/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
+++ b/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
@ -0,0 +1,44 @@
 From 3b9b38339346ebfaf3e8ddf0822eba1cc9e78408 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 14 Dec 2023 04:42:01 -0500
 Subject: Introduce RHEL 9.4.0 qemu-kvm machine type for aarch64
 Jira: https://issues.redhat.com/browse/RHEL-17168
 Adding new machine type to support enabling new features.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index c541efee5e..0b17c94ad7 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3630,14 +3630,21 @@ static void rhel_machine_init(void)
 }
 type_init(rhel_machine_init);
 +static void rhel940_virt_options(MachineClass *mc)
 +{
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 +
 static void rhel920_virt_options(MachineClass *mc)
 {
 +    rhel940_virt_options(mc);
 +
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 }
 -DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
 +DEFINE_RHEL_MACHINE(9, 2, 0)
 static void rhel900_virt_options(MachineClass *mc)
 {
 -- 
 2.39.3
--- a/0016-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
+++ b/0016-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
@ -1,50 +0,0 @@
 From 1b07788415a3d9729a3b11fc14d1d56ce5e6c888 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Thu, 10 Aug 2023 16:08:18 +0200
 Subject: vdpa: use first queue SVQ state for CVQ default
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eugenio Pérez <eperezma@redhat.com>
 RH-MergeRequest: 199: CVQ migration support
 RH-Jira: RHEL-923
 RH-Acked-by: Jason Wang <jasowang@redhat.com>
 RH-Acked-by: Cindy Lu <lulu@redhat.com>
 RH-Commit: [3/7] 5c98f11b5080552a62c8e37ff2c23339455b7b86 (eperezmartin/qemu-kvm)
 Previous to this patch the only way CVQ would be shadowed is if it does
 support to isolate CVQ group or if all vqs were shadowed from the
 beginning.  The second condition was checked at the beginning, and no
 more configuration was done.
 After this series we need to check if data queues are shadowed because
 they are in the middle of the migration.  As checking if they are
 shadowed already covers the previous case, let's just mimic it.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Patch-name: kvm-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
 Patch-id: 189
 Patch-present-in-specfile: True
 ---
 net/vhost-vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index 9795306742..a772540250 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -505,7 +505,7 @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
     s0 = vhost_vdpa_net_first_nc_vdpa(s);
     v->shadow_data = s0->vhost_vdpa.shadow_vqs_enabled;
 -    v->shadow_vqs_enabled = s->always_svq;
 +    v->shadow_vqs_enabled = s0->vhost_vdpa.shadow_vqs_enabled;
     s->vhost_vdpa.address_space_id = VHOST_VDPA_GUEST_PA_ASID;
     if (s->vhost_vdpa.shadow_data) {
 -- 
 2.39.3
--- a/0017-vdpa-export-vhost_vdpa_set_vring_ready.patch
+++ b/0017-vdpa-export-vhost_vdpa_set_vring_ready.patch
@ -1,109 +0,0 @@
 From 90235be168d252feb40376ea5a3cc67fcfe097af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Wed, 25 Jan 2023 08:47:34 +0100
 Subject: vdpa: export vhost_vdpa_set_vring_ready
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eugenio Pérez <eperezma@redhat.com>
 RH-MergeRequest: 199: CVQ migration support
 RH-Jira: RHEL-923
 RH-Acked-by: Jason Wang <jasowang@redhat.com>
 RH-Acked-by: Cindy Lu <lulu@redhat.com>
 RH-Commit: [4/7] 8d1fecec7a993b8b68e268e8783c200c158f5ee0 (eperezmartin/qemu-kvm)
 The vhost-vdpa net backend needs to enable vrings in a different order
 than default, so export it.
 No functional change intended except for tracing, that now includes the
 (virtio) index being enabled and the return value of the ioctl.
 Still ignoring return value of this function if called from
 vhost_vdpa_dev_start, as reorganize calling code around it is out of
 the scope of this series.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Patch-name: kvm-vdpa-export-vhost_vdpa_set_vring_ready.patch
 Patch-id: 190
 Patch-present-in-specfile: True
 ---
 hw/virtio/trace-events         |  2 +-
 hw/virtio/vhost-vdpa.c         | 25 +++++++++++++------------
 include/hw/virtio/vhost-vdpa.h |  1 +
 3 files changed, 15 insertions(+), 13 deletions(-)
 diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
 index 7109cf1a3b..1cb9027d1e 100644
 --- a/hw/virtio/trace-events
 +++ b/hw/virtio/trace-events
@@ -48,7 +48,7 @@ vhost_vdpa_set_features(void *dev, uint64_t features) "dev: %p features: 0x%"PRI
 vhost_vdpa_get_device_id(void *dev, uint32_t device_id) "dev: %p device_id %"PRIu32
 vhost_vdpa_reset_device(void *dev) "dev: %p"
 vhost_vdpa_get_vq_index(void *dev, int idx, int vq_idx) "dev: %p idx: %d vq idx: %d"
 -vhost_vdpa_set_vring_ready(void *dev) "dev: %p"
 +vhost_vdpa_set_vring_ready(void *dev, unsigned i, int r) "dev: %p, idx: %u, r: %d"
 vhost_vdpa_dump_config(void *dev, const char *line) "dev: %p %s"
 vhost_vdpa_set_config(void *dev, uint32_t offset, uint32_t size, uint32_t flags) "dev: %p offset: %"PRIu32" size: %"PRIu32" flags: 0x%"PRIx32
 vhost_vdpa_get_config(void *dev, void *config, uint32_t config_len) "dev: %p config: %p config_len: %"PRIu32
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index 42f2a4bae9..0d9975b5b5 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -876,18 +876,17 @@ static int vhost_vdpa_get_vq_index(struct vhost_dev *dev, int idx)
     return idx;
 }
 -static int vhost_vdpa_set_vring_ready(struct vhost_dev *dev)
 +int vhost_vdpa_set_vring_ready(struct vhost_vdpa *v, unsigned idx)
 {
 -    int i;
 -    trace_vhost_vdpa_set_vring_ready(dev);
 -    for (i = 0; i < dev->nvqs; ++i) {
 -        struct vhost_vring_state state = {
 -            .index = dev->vq_index + i,
 -            .num = 1,
 -        };
 -        vhost_vdpa_call(dev, VHOST_VDPA_SET_VRING_ENABLE, &state);
 -    }
 -    return 0;
 +    struct vhost_dev *dev = v->dev;
 +    struct vhost_vring_state state = {
 +        .index = idx,
 +        .num = 1,
 +    };
 +    int r = vhost_vdpa_call(dev, VHOST_VDPA_SET_VRING_ENABLE, &state);
 +
 +    trace_vhost_vdpa_set_vring_ready(dev, idx, r);
 +    return r;
 }
 static int vhost_vdpa_set_config_call(struct vhost_dev *dev,
@@ -1298,7 +1297,9 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
         if (unlikely(!ok)) {
             return -1;
         }
 -        vhost_vdpa_set_vring_ready(dev);
 +        for (int i = 0; i < dev->nvqs; ++i) {
 +            vhost_vdpa_set_vring_ready(v, dev->vq_index + i);
 +        }
     } else {
         vhost_vdpa_suspend(dev);
         vhost_vdpa_svqs_stop(dev);
 diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
 index e64bfc7f98..5407d54fd7 100644
 --- a/include/hw/virtio/vhost-vdpa.h
 +++ b/include/hw/virtio/vhost-vdpa.h
@@ -57,6 +57,7 @@ typedef struct vhost_vdpa {
 } VhostVDPA;
 int vhost_vdpa_get_iova_range(int fd, struct vhost_vdpa_iova_range *iova_range);
 +int vhost_vdpa_set_vring_ready(struct vhost_vdpa *v, unsigned idx);
 int vhost_vdpa_dma_map(struct vhost_vdpa *v, uint32_t asid, hwaddr iova,
                        hwaddr size, void *vaddr, bool readonly);
 -- 
 2.39.3
--- a/0018-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
+++ b/0018-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
@ -1,52 +0,0 @@
 From 772d982f7aa1101dcd873b2f7d800d9f841d3171 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Wed, 9 Aug 2023 18:07:26 +0200
 Subject: vdpa: rename vhost_vdpa_net_load to vhost_vdpa_net_cvq_load
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eugenio Pérez <eperezma@redhat.com>
 RH-MergeRequest: 199: CVQ migration support
 RH-Jira: RHEL-923
 RH-Acked-by: Jason Wang <jasowang@redhat.com>
 RH-Acked-by: Cindy Lu <lulu@redhat.com>
 RH-Commit: [5/7] aea91f3274786665725af892eb905818eb0f44f1 (eperezmartin/qemu-kvm)
 Next patches will add the corresponding data load.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Patch-name: kvm-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
 Patch-id: 191
 Patch-present-in-specfile: True
 ---
 net/vhost-vdpa.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index a772540250..9251351b4b 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -965,7 +965,7 @@ static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
     return 0;
 }
 -static int vhost_vdpa_net_load(NetClientState *nc)
 +static int vhost_vdpa_net_cvq_load(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
     struct vhost_vdpa *v = &s->vhost_vdpa;
@@ -1004,7 +1004,7 @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
     .size = sizeof(VhostVDPAState),
     .receive = vhost_vdpa_receive,
     .start = vhost_vdpa_net_cvq_start,
 -    .load = vhost_vdpa_net_load,
 +    .load = vhost_vdpa_net_cvq_load,
     .stop = vhost_vdpa_net_cvq_stop,
     .cleanup = vhost_vdpa_cleanup,
     .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
 -- 
 2.39.3
--- a/0019-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch
+++ b/0019-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch
@ -1,149 +0,0 @@
 From aa519f65c777fd7dbb1236a4f4db73f90e51660c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Thu, 10 Aug 2023 11:27:28 +0200
 Subject: vdpa: move vhost_vdpa_set_vring_ready to the caller
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eugenio Pérez <eperezma@redhat.com>
 RH-MergeRequest: 199: CVQ migration support
 RH-Jira: RHEL-923
 RH-Acked-by: Jason Wang <jasowang@redhat.com>
 RH-Acked-by: Cindy Lu <lulu@redhat.com>
 RH-Commit: [6/7] cf4fd1071ca127914c8e8d6aefec451cad97ecc1 (eperezmartin/qemu-kvm)
 Doing that way allows CVQ to be enabled before the dataplane vqs,
 restoring the state as MQ or MAC addresses properly in the case of a
 migration.
 The patch does it by defining a ->load NetClientInfo callback also for
 dataplane.  Ideally, this should be done by an independent patch, but
 the function is already static so it would only add an empty
 vhost_vdpa_net_data_load stub.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 ---
 Rebase notes (8.1.0):
 - Moved additional upstream calls to conditional block
 ---
 hw/virtio/vdpa-dev.c   |  3 +++
 hw/virtio/vhost-vdpa.c |  3 ---
 net/vhost-vdpa.c       | 57 +++++++++++++++++++++++++++++-------------
 3 files changed, 42 insertions(+), 21 deletions(-)
 diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
 index 363b625243..f22d5d5bc0 100644
 --- a/hw/virtio/vdpa-dev.c
 +++ b/hw/virtio/vdpa-dev.c
@@ -255,6 +255,9 @@ static int vhost_vdpa_device_start(VirtIODevice *vdev, Error **errp)
         error_setg_errno(errp, -ret, "Error starting vhost");
         goto err_guest_notifiers;
     }
 +    for (i = 0; i < s->dev.nvqs; ++i) {
 +        vhost_vdpa_set_vring_ready(&s->vdpa, i);
 +    }
     s->started = true;
     /*
 diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
 index 0d9975b5b5..8ca2e3800c 100644
 --- a/hw/virtio/vhost-vdpa.c
 +++ b/hw/virtio/vhost-vdpa.c
@@ -1297,9 +1297,6 @@ static int vhost_vdpa_dev_start(struct vhost_dev *dev, bool started)
         if (unlikely(!ok)) {
             return -1;
         }
 -        for (int i = 0; i < dev->nvqs; ++i) {
 -            vhost_vdpa_set_vring_ready(v, dev->vq_index + i);
 -        }
     } else {
         vhost_vdpa_suspend(dev);
         vhost_vdpa_svqs_stop(dev);
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index 9251351b4b..3bf60f9431 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -371,6 +371,22 @@ static int vhost_vdpa_net_data_start(NetClientState *nc)
     return 0;
 }
 +static int vhost_vdpa_net_data_load(NetClientState *nc)
 +{
 +    VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
 +    struct vhost_vdpa *v = &s->vhost_vdpa;
 +    bool has_cvq = v->dev->vq_index_end % 2;
 +
 +    if (has_cvq) {
 +        return 0;
 +    }
 +
 +    for (int i = 0; i < v->dev->nvqs; ++i) {
 +        vhost_vdpa_set_vring_ready(v, i + v->dev->vq_index);
 +    }
 +    return 0;
 +}
 +
 static void vhost_vdpa_net_client_stop(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
@@ -393,6 +409,7 @@ static NetClientInfo net_vhost_vdpa_info = {
         .size = sizeof(VhostVDPAState),
         .receive = vhost_vdpa_receive,
         .start = vhost_vdpa_net_data_start,
 +        .load = vhost_vdpa_net_data_load,
         .stop = vhost_vdpa_net_client_stop,
         .cleanup = vhost_vdpa_cleanup,
         .has_vnet_hdr = vhost_vdpa_has_vnet_hdr,
@@ -974,26 +991,30 @@ static int vhost_vdpa_net_cvq_load(NetClientState *nc)
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
 -    if (!v->shadow_vqs_enabled) {
 -        return 0;
 -    }
 +    vhost_vdpa_set_vring_ready(v, v->dev->vq_index);
 -    n = VIRTIO_NET(v->dev->vdev);
 -    r = vhost_vdpa_net_load_mac(s, n);
 -    if (unlikely(r < 0)) {
 -        return r;
 -    }
 -    r = vhost_vdpa_net_load_mq(s, n);
 -    if (unlikely(r)) {
 -        return r;
 -    }
 -    r = vhost_vdpa_net_load_offloads(s, n);
 -    if (unlikely(r)) {
 -        return r;
 +    if (v->shadow_vqs_enabled) {
 +        n = VIRTIO_NET(v->dev->vdev);
 +        r = vhost_vdpa_net_load_mac(s, n);
 +        if (unlikely(r < 0)) {
 +            return r;
 +        }
 +        r = vhost_vdpa_net_load_mq(s, n);
 +        if (unlikely(r)) {
 +            return r;
 +        }
 +        r = vhost_vdpa_net_load_offloads(s, n);
 +        if (unlikely(r)) {
 +            return r;
 +        }
 +        r = vhost_vdpa_net_load_rx(s, n);
 +        if (unlikely(r)) {
 +            return r;
 +        }
     }
 -    r = vhost_vdpa_net_load_rx(s, n);
 -    if (unlikely(r)) {
 -        return r;
 +
 +    for (int i = 0; i < v->dev->vq_index; ++i) {
 +        vhost_vdpa_set_vring_ready(v, i);
     }
     return 0;
 -- 
 2.39.3
--- a/0020-vdpa-remove-net-cvq-migration-blocker.patch
+++ b/0020-vdpa-remove-net-cvq-migration-blocker.patch
@ -1,55 +0,0 @@
 From aab6b27d559afb03cac1e9f873a65abc540b04c8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
 Date: Fri, 24 Mar 2023 13:28:15 +0100
 Subject: vdpa: remove net cvq migration blocker
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eugenio Pérez <eperezma@redhat.com>
 RH-MergeRequest: 199: CVQ migration support
 RH-Jira: RHEL-923
 RH-Acked-by: Jason Wang <jasowang@redhat.com>
 RH-Acked-by: Cindy Lu <lulu@redhat.com>
 RH-Commit: [7/7] 9542e305c7ea3a47e0f1fe0629281238b0bb2111 (eperezmartin/qemu-kvm)
 Now that we have add migration blockers if the device does not support
 all the needed features, remove the general blocker applied to all net
 devices with CVQ.
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Patch-name: kvm-vdpa-remove-net-cvq-migration-blocker.patch
 Patch-id: 193
 Patch-present-in-specfile: True
 ---
 net/vhost-vdpa.c | 12 ------------
 1 file changed, 12 deletions(-)
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index 3bf60f9431..6bb56f7d94 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -1413,18 +1413,6 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
         s->vhost_vdpa.shadow_vq_ops_opaque = s;
         s->cvq_isolated = cvq_isolated;
 -
 -        /*
 -         * TODO: We cannot migrate devices with CVQ and no x-svq enabled as
 -         * there is no way to set the device state (MAC, MQ, etc) before
 -         * starting the datapath.
 -         *
 -         * Migration blocker ownership now belongs to s->vhost_vdpa.
 -         */
 -        if (!svq) {
 -            error_setg(&s->vhost_vdpa.migration_blocker,
 -                       "net vdpa cannot migrate with CVQ feature");
 -        }
     }
     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
     if (ret) {
 -- 
 2.39.3
--- a/0021-Add-machine-types-compat-bits.patch
+++ b/0021-Add-machine-types-compat-bits.patch
@ -1,140 +0,0 @@
 From 4ee284aca9a6fb151f85f266b375a8c1d9213a28 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 28 Jun 2023 01:40:03 -0400
 Subject: Add machine types compat bits.
 Adding upstream compat changes to rhel machine types.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c              | 1 +
 hw/core/machine.c          | 8 ++++++++
 hw/i386/pc.c               | 6 ++++++
 hw/i386/pc_piix.c          | 4 ++++
 hw/i386/pc_q35.c           | 4 ++++
 hw/s390x/s390-virtio-ccw.c | 1 +
 include/hw/boards.h        | 3 +++
 include/hw/i386/pc.h       | 3 +++
 8 files changed, 30 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 3c36106eb5..c2283275b5 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3616,6 +3616,7 @@ type_init(rhel_machine_init);
 static void rhel920_virt_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 2e54c7ae7c..8e23b9263d 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -59,6 +59,14 @@ const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +GlobalProperty hw_compat_rhel_9_3[] = {
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { "migration", "multifd-flush-after-each-section", "on"},
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 +};
 +const size_t hw_compat_rhel_9_3_len = G_N_ELEMENTS(hw_compat_rhel_9_3);
 +
 GlobalProperty hw_compat_rhel_9_2[] = {
   /* hw_compat_rhel_9_2 from hw_compat_7_2 */
   { "e1000e", "migrate-timadj", "off" },
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 4be9a7db82..173815cc7e 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -432,6 +432,12 @@ GlobalProperty pc_rhel_compat[] = {
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_9_3_compat[] = {
 +    /* pc_rhel_9_3_compat from pc_compat_8_0 */
 +    { "virtio-mem", "unplugged-inaccessible", "auto" },
 +};
 +const size_t pc_rhel_9_3_compat_len = G_N_ELEMENTS(pc_rhel_9_3_compat);
 +
 GlobalProperty pc_rhel_9_2_compat[] = {
     /* pc_rhel_9_2_compat from pc_compat_7_2 */
     { "ICH9-LPC", "noreboot", "true" },
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index db7d8e26e1..014c017344 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1015,6 +1015,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
     pcmc->enforce_amd_1tb_hole = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +		     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_2,
                      hw_compat_rhel_9_2_len);
     compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index e878bf4626..0b8adb0adb 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -722,6 +722,10 @@ static void pc_q35_machine_rhel920_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.2.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +     compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_2,
                      hw_compat_rhel_9_2_len);
     compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 2a5dbd2728..4892db6d04 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1225,6 +1225,7 @@ static void ccw_machine_rhel920_instance_options(MachineState *machine)
 static void ccw_machine_rhel920_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 }
 DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index d9d1ae6dd1..60cc08865c 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -473,6 +473,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_3[];
 +extern const size_t hw_compat_rhel_9_3_len;
 +
 extern GlobalProperty hw_compat_rhel_9_2[];
 extern const size_t hw_compat_rhel_9_2_len;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 7b569fa254..eb6ff6b099 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -304,6 +304,9 @@ int pc_machine_kvm_type(MachineState *machine, const char *vm_type);
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_9_3_compat[];
 +extern const size_t pc_rhel_9_3_compat_len;
 +
 extern GlobalProperty pc_rhel_9_2_compat[];
 extern const size_t pc_rhel_9_2_compat_len;
 -- 
 2.39.3
--- a/0022-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch
+++ b/0022-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch
@ -1,61 +0,0 @@
 From 719e2ac147c64d3caa1b86fb94a4182e9ff43f1b Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 22 Aug 2023 14:36:29 +0200
 Subject: Fix x86 machine type compatibility for qemu-kvm 8.1.0
 Jira: https://issues.redhat.com/browse/RHEL-874
 Upstream Status: RHEL-only
 Upstream changes pcmc->default_smbios_ep_type in the -8.0 machine
 type, so we should reflect this change in our -rhel9.2.0 machine
 types (and older).
 While we're at it, add a comment that the pcmc->enforce_amd_1tb_hole
 setting comes from pc_i440fx_7_0_machine_options() in pc_piix.c.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/i386/pc_piix.c | 6 +++++-
 hw/i386/pc_q35.c  | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 014c017344..10a8d7576d 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1014,9 +1014,13 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    /* From pc_i440fx_7_0_machine_options() */
     pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 -		     hw_compat_rhel_9_3_len);
 +                     hw_compat_rhel_9_3_len);
     compat_props_add(m->compat_props, pc_rhel_9_3_compat,
                      pc_rhel_9_3_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 0b8adb0adb..a205226381 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -722,9 +722,12 @@ static void pc_q35_machine_rhel920_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.2.0";
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
                      hw_compat_rhel_9_3_len);
 -     compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
                      pc_rhel_9_3_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_2,
                      hw_compat_rhel_9_2_len);
 -- 
 2.39.3
--- a/kvm-Enable-igb-on-x86_64.patch
+++ b/kvm-Enable-igb-on-x86_64.patch
@ -1,34 +0,0 @@
 From d22860e56e47f8d0a3ffc9ff3c3bbf13b4cc46e9 Mon Sep 17 00:00:00 2001
 From: Akihiko Odaki <aodaki@redhat.com>
 Date: Mon, 30 Oct 2023 21:25:23 +0900
 Subject: [PATCH 2/4] Enable igb on x86_64
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: 小田喜陽彦 <None>
 RH-MergeRequest: 205: Enable igb on x86_64
 RH-Jira: RHEL-1308
 RH-Commit: [1/1] e5079378c2e674d13b70c122096997c46ccc3dbf (akihiko.odaki/qemu-kvm)
 Resolves: RHEL-1308
 Signed-off-by: Akihiko Odaki <akihiko.odaki@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index 6d16d81296..ef82f431cb 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -36,6 +36,7 @@ CONFIG_IDE_CORE=y
 CONFIG_IDE_PCI=y
 CONFIG_IDE_PIIX=y
 CONFIG_IDE_QDEV=y
 +CONFIG_IGB_PCI_EXPRESS=y
 CONFIG_IOAPIC=y
 CONFIG_IOH3420=y
 CONFIG_ISA_BUS=y
 -- 
 2.39.3
--- a/kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch
+++ b/kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch
@ -1,73 +0,0 @@
 From 42dac3d063e0f44e92211a4fbdaf1f0d64843562 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Thu, 24 Aug 2023 17:53:41 +0200
 Subject: [PATCH 10/13] file-posix: Check bs->bl.zoned for zone info
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
 RH-Jira: RHEL-7360
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/5] d853b88d6b71b6f4fe1bb70ae2e3b6108cbdb8dc (hreitz/qemu-kvm-c-9-s)
 Instead of checking bs->wps or bs->bl.zone_size for whether zone
 information is present, check bs->bl.zoned.  That is the flag that
 raw_refresh_zoned_limits() reliably sets to indicate zone support.  If
 it is set to something other than BLK_Z_NONE, other values and objects
 like bs->wps and bs->bl.zone_size must be non-null/zero and valid; if it
 is not, we cannot rely on their validity.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230824155345.109765-3-hreitz@redhat.com>
 Reviewed-by: Sam Li <faithilikerun@gmail.com>
 (cherry picked from commit 4b5d80f3d02096a9bb1f651f6b3401ba40877159)
 Downstream: Fixed typo in the last hunk ("bs->blk" changed to
            "bs->blk").  This code is removed in the commit after the
            next, still, should be fixed now that I noticed.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/file-posix.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 2b88b9eefa..9f14850e24 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2455,9 +2455,10 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
     if (fd_open(bs) < 0)
         return -EIO;
 #if defined(CONFIG_BLKZONED)
 -    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) && bs->wps) {
 +    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 +        bs->bl.zoned != BLK_Z_NONE) {
         qemu_co_mutex_lock(&bs->wps->colock);
 -        if (type & QEMU_AIO_ZONE_APPEND && bs->bl.zone_size) {
 +        if (type & QEMU_AIO_ZONE_APPEND) {
             int index = offset / bs->bl.zone_size;
             offset = bs->wps->wp[index];
         }
@@ -2508,8 +2509,8 @@ out:
 {
     BlockZoneWps *wps = bs->wps;
     if (ret == 0) {
 -        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND))
 -            && wps && bs->bl.zone_size) {
 +        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 +            bs->bl.zoned != BLK_Z_NONE) {
             uint64_t *wp = &wps->wp[offset / bs->bl.zone_size];
             if (!BDRV_ZT_IS_CONV(*wp)) {
                 if (type & QEMU_AIO_ZONE_APPEND) {
@@ -2529,7 +2530,8 @@ out:
         }
     }
 -    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) && wps) {
 +    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 +        bs->bl.zoned != BLK_Z_NONE) {
         qemu_co_mutex_unlock(&wps->colock);
     }
 }
 -- 
 2.39.3
--- a/kvm-file-posix-Clear-bs-bl.zoned-on-error.patch
+++ b/kvm-file-posix-Clear-bs-bl.zoned-on-error.patch
@ -1,96 +0,0 @@
 From 1eba7b686a41c71f24f60f8adcd51ddf1882686d Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Thu, 24 Aug 2023 17:53:40 +0200
 Subject: [PATCH 09/13] file-posix: Clear bs->bl.zoned on error
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
 RH-Jira: RHEL-7360
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/5] 3e2419b64b35afdfa45f70c5eb61478321de5233 (hreitz/qemu-kvm-c-9-s)
 bs->bl.zoned is what indicates whether the zone information is present
 and valid; it is the only thing that raw_refresh_zoned_limits() sets if
 CONFIG_BLKZONED is not defined, and it is also the only thing that it
 sets if CONFIG_BLKZONED is defined, but there are no zones.
 Make sure that it is always set to BLK_Z_NONE if there is an error
 anywhere in raw_refresh_zoned_limits() so that we do not accidentally
 announce zones while our information is incomplete or invalid.
 This also fixes a memory leak in the last error path in
 raw_refresh_zoned_limits().
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230824155345.109765-2-hreitz@redhat.com>
 Reviewed-by: Sam Li <faithilikerun@gmail.com>
 (cherry picked from commit 56d1a022a77ea2125564913665eeadf3e303a671)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/file-posix.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b16e9c21a1..2b88b9eefa 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1412,11 +1412,9 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
     BlockZoneModel zoned;
     int ret;
 -    bs->bl.zoned = BLK_Z_NONE;
 -
     ret = get_sysfs_zoned_model(st, &zoned);
     if (ret < 0 || zoned == BLK_Z_NONE) {
 -        return;
 +        goto no_zoned;
     }
     bs->bl.zoned = zoned;
@@ -1437,10 +1435,10 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Unable to read chunk_sectors "
                                      "sysfs attribute");
 -        return;
 +        goto no_zoned;
     } else if (!ret) {
         error_setg(errp, "Read 0 from chunk_sectors sysfs attribute");
 -        return;
 +        goto no_zoned;
     }
     bs->bl.zone_size = ret << BDRV_SECTOR_BITS;
@@ -1448,10 +1446,10 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Unable to read nr_zones "
                                      "sysfs attribute");
 -        return;
 +        goto no_zoned;
     } else if (!ret) {
         error_setg(errp, "Read 0 from nr_zones sysfs attribute");
 -        return;
 +        goto no_zoned;
     }
     bs->bl.nr_zones = ret;
@@ -1472,10 +1470,15 @@ static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
     ret = get_zones_wp(bs, s->fd, 0, bs->bl.nr_zones, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "report wps failed");
 -        bs->wps = NULL;
 -        return;
 +        goto no_zoned;
     }
     qemu_co_mutex_init(&bs->wps->colock);
 +    return;
 +
 +no_zoned:
 +    bs->bl.zoned = BLK_Z_NONE;
 +    g_free(bs->wps);
 +    bs->wps = NULL;
 }
 #else /* !defined(CONFIG_BLKZONED) */
 static void raw_refresh_zoned_limits(BlockDriverState *bs, struct stat *st,
 -- 
 2.39.3
--- a/kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch
+++ b/kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch
@ -1,42 +0,0 @@
 From fc9ca44d7df182a0a483d8376054850ba46e633d Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Thu, 24 Aug 2023 17:53:42 +0200
 Subject: [PATCH 11/13] file-posix: Fix zone update in I/O error path
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
 RH-Jira: RHEL-7360
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [3/5] 28a8540b2ac0c437f8afb90fd5566fc83bfcfdc4 (hreitz/qemu-kvm-c-9-s)
 We must check that zone information is present before running
 update_zones_wp().
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2234374
 Fixes: Coverity CID 1512459
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230824155345.109765-4-hreitz@redhat.com>
 Reviewed-by: Sam Li <faithilikerun@gmail.com>
 (cherry picked from commit deab5c9a4ed74f76a713008a42527762b30a7e84)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/file-posix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 9f14850e24..b9d5e4741b 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2525,7 +2525,8 @@ out:
             }
         }
     } else {
 -        if (type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) {
 +        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 +            bs->bl.zoned != BLK_Z_NONE) {
             update_zones_wp(bs, s->fd, 0, 1);
         }
     }
 -- 
 2.39.3
--- a/kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch
+++ b/kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch
@ -1,71 +0,0 @@
 From fbf511a9f7272815fc6d7414735049689186c750 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Thu, 24 Aug 2023 17:53:43 +0200
 Subject: [PATCH 12/13] file-posix: Simplify raw_co_prw's 'out' zone code
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
 RH-Jira: RHEL-7360
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [4/5] c0b37cc9ff308de300e45d1a10942d11fbabea26 (hreitz/qemu-kvm-c-9-s)
 We duplicate the same condition three times here, pull it out to the top
 level.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230824155345.109765-5-hreitz@redhat.com>
 Reviewed-by: Sam Li <faithilikerun@gmail.com>
 (cherry picked from commit d31b50a15dd25a560749b25fc40b6484fd1a57b7)
 Downstream conflict with the downstream change in HEAD^^ (conflicting
 code is removed).
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/file-posix.c | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b9d5e4741b..aa89789737 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2506,11 +2506,10 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
 out:
 #if defined(CONFIG_BLKZONED)
 -{
 -    BlockZoneWps *wps = bs->wps;
 -    if (ret == 0) {
 -        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 -            bs->bl.zoned != BLK_Z_NONE) {
 +    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 +        bs->bl.zoned != BLK_Z_NONE) {
 +        BlockZoneWps *wps = bs->wps;
 +        if (ret == 0) {
             uint64_t *wp = &wps->wp[offset / bs->bl.zone_size];
             if (!BDRV_ZT_IS_CONV(*wp)) {
                 if (type & QEMU_AIO_ZONE_APPEND) {
@@ -2523,19 +2522,12 @@ out:
                     *wp = offset + bytes;
                 }
             }
 -        }
 -    } else {
 -        if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 -            bs->bl.zoned != BLK_Z_NONE) {
 +        } else {
             update_zones_wp(bs, s->fd, 0, 1);
         }
 -    }
 -    if ((type & (QEMU_AIO_WRITE | QEMU_AIO_ZONE_APPEND)) &&
 -        bs->bl.zoned != BLK_Z_NONE) {
         qemu_co_mutex_unlock(&wps->colock);
     }
 -}
 #endif
     return ret;
 }
 -- 
 2.39.3
--- a/kvm-host-include-generic-host-atomic128-Fix-compilation-.patch
+++ b/kvm-host-include-generic-host-atomic128-Fix-compilation-.patch
@ -1,89 +0,0 @@
 From ea6970ef4413f0390778b58c633da931faa932c2 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 18 Oct 2023 17:27:41 +0200
 Subject: [PATCH 3/4] host/include/generic/host/atomic128: Fix compilation
 problem with Clang 17
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 207: Fix compilation problem with Clang 17
 RH-Jira: RHEL-12991
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] db90fc8c1c67b7c401cb1e061f6fa5fd14d91717 (thuth/qemu-kvm-cs9)
 Upstream Status: proposed (https://lore.kernel.org/qemu-devel/20231108085954.313071-1-thuth@redhat.com/)
 When compiling QEMU with Clang 17 on a s390x, the compilation fails:
 In file included from ../accel/tcg/cputlb.c:32:
 In file included from /root/qemu/include/exec/helper-proto-common.h:10:
 In file included from /root/qemu/include/qemu/atomic128.h:62:
 /root/qemu/host/include/generic/host/atomic128-ldst.h:68:15: error:
 __sync builtin operation MUST have natural alignment (consider using __
 atomic). [-Werror,-Wsync-alignment]
   68 |     } while (!__sync_bool_compare_and_swap_16(ptr_align, old, new.i));
      |               ^
 In file included from ../accel/tcg/cputlb.c:32:
 In file included from /root/qemu/include/exec/helper-proto-common.h:10:
 In file included from /root/qemu/include/qemu/atomic128.h:61:
 /root/qemu/host/include/generic/host/atomic128-cas.h:36:11: error:
 __sync builtin operation MUST have natural alignment (consider using __a
 tomic). [-Werror,-Wsync-alignment]
   36 |     r.i = __sync_val_compare_and_swap_16(ptr_align, c.i, n.i);
      |           ^
 2 errors generated.
 It's arguably a bug in Clang since we already use __builtin_assume_aligned()
 to tell the compiler that the pointer is properly aligned. But according to
 https://github.com/llvm/llvm-project/issues/69146 it seems like the Clang
 folks don't see an easy fix on their side and recommend to use a type
 declared with __attribute__((aligned(16))) to work around this problem.
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1934
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 host/include/generic/host/atomic128-cas.h  | 2 +-
 host/include/generic/host/atomic128-ldst.h | 2 +-
 include/qemu/int128.h                      | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)
 diff --git a/host/include/generic/host/atomic128-cas.h b/host/include/generic/host/atomic128-cas.h
 index 991d3da082..6b40cc2271 100644
 --- a/host/include/generic/host/atomic128-cas.h
 +++ b/host/include/generic/host/atomic128-cas.h
@@ -28,7 +28,7 @@ atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
 static inline Int128 ATTRIBUTE_ATOMIC128_OPT
 atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
 {
 -    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
 +    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
     Int128Alias r, c, n;
     c.s = cmp;
 diff --git a/host/include/generic/host/atomic128-ldst.h b/host/include/generic/host/atomic128-ldst.h
 index 80fff0643a..691e6a8531 100644
 --- a/host/include/generic/host/atomic128-ldst.h
 +++ b/host/include/generic/host/atomic128-ldst.h
@@ -58,7 +58,7 @@ atomic16_read_rw(Int128 *ptr)
 static inline void ATTRIBUTE_ATOMIC128_OPT
 atomic16_set(Int128 *ptr, Int128 val)
 {
 -    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
 +    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
     __int128_t old;
     Int128Alias new;
 diff --git a/include/qemu/int128.h b/include/qemu/int128.h
 index 73624e8be7..44530d3e10 100644
 --- a/include/qemu/int128.h
 +++ b/include/qemu/int128.h
@@ -10,6 +10,7 @@
  */
 #if defined(CONFIG_INT128) && !defined(CONFIG_TCG_INTERPRETER)
 typedef __int128_t Int128;
 +typedef __int128_t __attribute__((aligned(16))) Int128Aligned;
 static inline Int128 int128_make64(uint64_t a)
 {
 -- 
 2.39.3
--- a/kvm-hw-scsi-scsi-disk-Disallow-block-sizes-smaller-than-.patch
+++ b/kvm-hw-scsi-scsi-disk-Disallow-block-sizes-smaller-than-.patch
@ -1,63 +0,0 @@
 From 3e9164c9c80be093d7c9c590a643bf1aecf23496 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 18 Oct 2023 11:31:15 -0400
 Subject: [PATCH 1/4] hw/scsi/scsi-disk: Disallow block sizes smaller than 512
 [CVE-2023-42467]
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 204: hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
 RH-Jira: RHEL-2828
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [1/1] 7b5306fdadb000216505b8f47a6ab8e4c4336506 (jmaloy/jmaloy-qemu-kvm-2)
 Jira: https://issues.redhat.com/browse/RHEL-2828
 CVE: CVE-2023-42467
 Upstream: Merged
 commit 7cfcc79b0ab800959716738aff9419f53fc68c9c
 Author: Thomas Huth <thuth@redhat.com>
 Date:   Mon Sep 25 11:18:54 2023 +0200
    hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
    We are doing things like
        nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
    in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
    the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
    with a division by 0 exception. Thus disallow block sizes of 256
    bytes to avoid this situation.
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
    CVE: 2023-42467
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Message-ID: <20230925091854.49198-1-thuth@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/scsi/scsi-disk.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
 index e0d79c7966..477ee2bcd4 100644
 --- a/hw/scsi/scsi-disk.c
 +++ b/hw/scsi/scsi-disk.c
@@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
          * Since the existing code only checks/updates bits 8-15 of the block
          * size, restrict ourselves to the same requirement for now to ensure
          * that a block size set by a block descriptor and then read back by
 -         * a subsequent SCSI command will be the same
 +         * a subsequent SCSI command will be the same. Also disallow a block
 +         * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
          */
 -        if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) {
 +        if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
             s->qdev.blocksize = bs;
             trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
         }
 -- 
 2.39.3
--- a/kvm-migration-Consolidate-return-path-closing-code.patch
+++ b/kvm-migration-Consolidate-return-path-closing-code.patch
@ -1,86 +0,0 @@
 From 33f0f63da753fff2a3d2bf14542abe0665878e3d Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:20 -0300
 Subject: [PATCH 06/13] migration: Consolidate return path closing code
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [6/8] d3a4e08e1f1afe92afac12a3404a84d1c23e0f02 (peterx/qemu-kvm)
 We'll start calling the await_return_path_close_on_source() function
 from other parts of the code, so move all of the related checks and
 tracepoints into it.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-7-farosas@suse.de>
 (cherry picked from commit d50f5dc075cbb891bfe4a9378600a4871264468a)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index e2e4a7d8ae..ac4541b971 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -2050,6 +2050,14 @@ static int open_return_path_on_source(MigrationState *ms,
 /* Returns 0 if the RP was ok, otherwise there was an error on the RP */
 static int await_return_path_close_on_source(MigrationState *ms)
 {
 +    int ret;
 +
 +    if (!ms->rp_state.rp_thread_created) {
 +        return 0;
 +    }
 +
 +    trace_migration_return_path_end_before();
 +
     /*
      * If this is a normal exit then the destination will send a SHUT
      * and the rp_thread will exit, however if there's an error we
@@ -2067,7 +2075,10 @@ static int await_return_path_close_on_source(MigrationState *ms)
     qemu_thread_join(&ms->rp_state.rp_thread);
     ms->rp_state.rp_thread_created = false;
     trace_await_return_path_close_on_source_close();
 -    return ms->rp_state.error;
 +
 +    ret = ms->rp_state.error;
 +    trace_migration_return_path_end_after(ret);
 +    return ret;
 }
 static inline void
@@ -2363,20 +2374,8 @@ static void migration_completion(MigrationState *s)
         goto fail;
     }
 -    /*
 -     * If rp was opened we must clean up the thread before
 -     * cleaning everything else up (since if there are no failures
 -     * it will wait for the destination to send it's status in
 -     * a SHUT command).
 -     */
 -    if (s->rp_state.rp_thread_created) {
 -        int rp_error;
 -        trace_migration_return_path_end_before();
 -        rp_error = await_return_path_close_on_source(s);
 -        trace_migration_return_path_end_after(rp_error);
 -        if (rp_error) {
 -            goto fail;
 -        }
 +    if (await_return_path_close_on_source(s)) {
 +        goto fail;
     }
     if (qemu_file_get_error(s->to_dst_file)) {
 -- 
 2.39.3
--- a/kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch
+++ b/kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch
@ -1,48 +0,0 @@
 From 93aa615c5e8de7422d7162a0731739b2bd82a582 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:16 -0300
 Subject: [PATCH 02/13] migration: Fix possible race when setting
 rp_state.error
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [2/8] 97305847fc18b6b18cb6f3ff32c82918c2562664 (peterx/qemu-kvm)
 We don't need to set the rp_state.error right after a shutdown because
 qemu_file_shutdown() always sets the QEMUFile error, so the return
 path thread would have seen it and set the rp error itself.
 Setting the error outside of the thread is also racy because the
 thread could clear it after we set it.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-3-farosas@suse.de>
 (cherry picked from commit 28a8347281e24c2e7bba6d3301472eda41d4c096)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 6a7122694a..b92c6ae436 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -2063,7 +2063,6 @@ static int await_return_path_close_on_source(MigrationState *ms)
          * waiting for the destination.
          */
         qemu_file_shutdown(ms->rp_state.from_dst_file);
 -        mark_source_rp_bad(ms);
     }
     trace_await_return_path_close_on_source_joining();
     qemu_thread_join(&ms->rp_state.rp_thread);
 -- 
 2.39.3
--- a/kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch
+++ b/kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch
@ -1,82 +0,0 @@
 From 52e2456a41678f29a67e4b7cd4d7ee20e5298bc0 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:18 -0300
 Subject: [PATCH 04/13] migration: Fix possible race when shutting down
 to_dst_file
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [4/8] 99b9ce27c4477b9630cedfb02a534f8c490ab1eb (peterx/qemu-kvm)
 It's not safe to call qemu_file_shutdown() on the to_dst_file without
 first checking for the file's presence under the lock. The cleanup of
 this file happens at postcopy_pause() and migrate_fd_cleanup() which
 are not necessarily running in the same thread as migrate_fd_cancel().
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-5-farosas@suse.de>
 (cherry picked from commit 7478fb0df914f0a5ab551ff74b1df62dd250500e)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 517b3e04d2..169e6bdce8 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1246,7 +1246,7 @@ static void migrate_fd_error(MigrationState *s, const Error *error)
 static void migrate_fd_cancel(MigrationState *s)
 {
     int old_state ;
 -    QEMUFile *f = migrate_get_current()->to_dst_file;
 +
     trace_migrate_fd_cancel();
     WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
@@ -1272,11 +1272,13 @@ static void migrate_fd_cancel(MigrationState *s)
      * If we're unlucky the migration code might be stuck somewhere in a
      * send/write while the network has failed and is waiting to timeout;
      * if we've got shutdown(2) available then we can force it to quit.
 -     * The outgoing qemu file gets closed in migrate_fd_cleanup that is
 -     * called in a bh, so there is no race against this cancel.
      */
 -    if (s->state == MIGRATION_STATUS_CANCELLING && f) {
 -        qemu_file_shutdown(f);
 +    if (s->state == MIGRATION_STATUS_CANCELLING) {
 +        WITH_QEMU_LOCK_GUARD(&s->qemu_file_lock) {
 +            if (s->to_dst_file) {
 +                qemu_file_shutdown(s->to_dst_file);
 +            }
 +        }
     }
     if (s->state == MIGRATION_STATUS_CANCELLING && s->block_inactive) {
         Error *local_err = NULL;
@@ -1520,12 +1522,14 @@ void qmp_migrate_pause(Error **errp)
 {
     MigrationState *ms = migrate_get_current();
     MigrationIncomingState *mis = migration_incoming_get_current();
 -    int ret;
 +    int ret = 0;
     if (ms->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
         /* Source side, during postcopy */
         qemu_mutex_lock(&ms->qemu_file_lock);
 -        ret = qemu_file_shutdown(ms->to_dst_file);
 +        if (ms->to_dst_file) {
 +            ret = qemu_file_shutdown(ms->to_dst_file);
 +        }
         qemu_mutex_unlock(&ms->qemu_file_lock);
         if (ret) {
             error_setg(errp, "Failed to pause source migration");
 -- 
 2.39.3
--- a/kvm-migration-Fix-possible-races-when-shutting-down-the-.patch
+++ b/kvm-migration-Fix-possible-races-when-shutting-down-the-.patch
@ -1,74 +0,0 @@
 From 1cc26aac30b883244e300d872fa3a19f39afbb66 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:17 -0300
 Subject: [PATCH 03/13] migration: Fix possible races when shutting down the
 return path
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [3/8] d734387cf07e956a1f1e817c200e5b36cf0a00b1 (peterx/qemu-kvm)
 We cannot call qemu_file_shutdown() on the return path file without
 taking the file lock. The return path thread could be running it's
 cleanup code and have just cleared the from_dst_file pointer.
 Checking ms->to_dst_file for errors could also race with
 migrate_fd_cleanup() which clears the to_dst_file pointer.
 Protect both accesses by taking the file lock.
 This was caught by inspection, it should be rare, but the next patches
 will start calling this code from other places, so let's do the
 correct thing.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-4-farosas@suse.de>
 (cherry picked from commit 639decf529793fc544c8055b82be8abe77fa48fa)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index b92c6ae436..517b3e04d2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -2053,17 +2053,18 @@ static int open_return_path_on_source(MigrationState *ms,
 static int await_return_path_close_on_source(MigrationState *ms)
 {
     /*
 -     * If this is a normal exit then the destination will send a SHUT and the
 -     * rp_thread will exit, however if there's an error we need to cause
 -     * it to exit.
 +     * If this is a normal exit then the destination will send a SHUT
 +     * and the rp_thread will exit, however if there's an error we
 +     * need to cause it to exit. shutdown(2), if we have it, will
 +     * cause it to unblock if it's stuck waiting for the destination.
      */
 -    if (qemu_file_get_error(ms->to_dst_file) && ms->rp_state.from_dst_file) {
 -        /*
 -         * shutdown(2), if we have it, will cause it to unblock if it's stuck
 -         * waiting for the destination.
 -         */
 -        qemu_file_shutdown(ms->rp_state.from_dst_file);
 +    WITH_QEMU_LOCK_GUARD(&ms->qemu_file_lock) {
 +        if (ms->to_dst_file && ms->rp_state.from_dst_file &&
 +            qemu_file_get_error(ms->to_dst_file)) {
 +            qemu_file_shutdown(ms->rp_state.from_dst_file);
 +        }
     }
 +
     trace_await_return_path_close_on_source_joining();
     qemu_thread_join(&ms->rp_state.rp_thread);
     ms->rp_state.rp_thread_created = false;
 -- 
 2.39.3
--- a/kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch
+++ b/kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch
@ -1,172 +0,0 @@
 From c98eb88ce49927f612753b53c890135fde14c3a4 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Mon, 18 Sep 2023 14:28:15 -0300
 Subject: [PATCH 01/13] migration: Fix race that dest preempt thread close too
 early
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [1/8] a1197ca99878d5d8bbb271c6941aa36d91c66122 (peterx/qemu-kvm)
 We hit intermit CI issue on failing at migration-test over the unit test
 preempt/plain:
 qemu-system-x86_64: Unable to read from socket: Connection reset by peer
 Memory content inconsistency at 5b43000 first_byte = bd last_byte = bc current = 4f hit_edge = 1
 **
 ERROR:../tests/qtest/migration-test.c:300:check_guests_ram: assertion failed: (bad == 0)
 (test program exited with status code -6)
 Fabiano debugged into it and found that the preempt thread can quit even
 without receiving all the pages, which can cause guest not receiving all
 the pages and corrupt the guest memory.
 To make sure preempt thread finished receiving all the pages, we can rely
 on the page_requested_count being zero because preempt channel will only
 receive requested page faults. Note, not all the faulted pages are required
 to be sent via the preempt channel/thread; imagine the case when a
 requested page is just queued into the background main channel for
 migration, the src qemu will just still send it via the background channel.
 Here instead of spinning over reading the count, we add a condvar so the
 main thread can wait on it if that unusual case happened, without burning
 the cpu for no good reason, even if the duration is short; so even if we
 spin in this rare case is probably fine.  It's just better to not do so.
 The condvar is only used when that special case is triggered.  Some memory
 ordering trick is needed to guarantee it from happening (against the
 preempt thread status field), so the main thread will always get a kick
 when that triggers correctly.
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/1886
 Debugged-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-2-farosas@suse.de>
 (cherry picked from commit cf02f29e1e3843784630d04783e372fa541a77e5)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c    |  3 ++-
 migration/migration.h    | 13 ++++++++++++-
 migration/postcopy-ram.c | 38 +++++++++++++++++++++++++++++++++++++-
 3 files changed, 51 insertions(+), 3 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 5528acb65e..6a7122694a 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -153,6 +153,7 @@ void migration_object_init(void)
     qemu_sem_init(&current_incoming->postcopy_qemufile_dst_done, 0);
     qemu_mutex_init(&current_incoming->page_request_mutex);
 +    qemu_cond_init(&current_incoming->page_request_cond);
     current_incoming->page_requested = g_tree_new(page_request_addr_cmp);
     migration_object_check(current_migration, &error_fatal);
@@ -367,7 +368,7 @@ int migrate_send_rp_req_pages(MigrationIncomingState *mis,
              * things like g_tree_lookup() will return TRUE (1) when found.
              */
             g_tree_insert(mis->page_requested, aligned, (gpointer)1);
 -            mis->page_requested_count++;
 +            qatomic_inc(&mis->page_requested_count);
             trace_postcopy_page_req_add(aligned, mis->page_requested_count);
         }
     }
 diff --git a/migration/migration.h b/migration/migration.h
 index 6eea18db36..9a30216895 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
@@ -196,7 +196,10 @@ struct MigrationIncomingState {
     /* A tree of pages that we requested to the source VM */
     GTree *page_requested;
 -    /* For debugging purpose only, but would be nice to keep */
 +    /*
 +     * For postcopy only, count the number of requested page faults that
 +     * still haven't been resolved.
 +     */
     int page_requested_count;
     /*
      * The mutex helps to maintain the requested pages that we sent to the
@@ -210,6 +213,14 @@ struct MigrationIncomingState {
      * contains valid information.
      */
     QemuMutex page_request_mutex;
 +    /*
 +     * If postcopy preempt is enabled, there is a chance that the main
 +     * thread finished loading its data before the preempt channel has
 +     * finished loading the urgent pages.  If that happens, the two threads
 +     * will use this condvar to synchronize, so the main thread will always
 +     * wait until all pages received.
 +     */
 +    QemuCond page_request_cond;
     /*
      * Number of devices that have yet to approve switchover. When this reaches
 diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
 index 29aea9456d..5408e028c6 100644
 --- a/migration/postcopy-ram.c
 +++ b/migration/postcopy-ram.c
@@ -599,6 +599,30 @@ int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis)
     if (mis->preempt_thread_status == PREEMPT_THREAD_CREATED) {
         /* Notify the fast load thread to quit */
         mis->preempt_thread_status = PREEMPT_THREAD_QUIT;
 +        /*
 +         * Update preempt_thread_status before reading count.  Note: mutex
 +         * lock only provide ACQUIRE semantic, and it doesn't stops this
 +         * write to be reordered after reading the count.
 +         */
 +        smp_mb();
 +        /*
 +         * It's possible that the preempt thread is still handling the last
 +         * pages to arrive which were requested by guest page faults.
 +         * Making sure nothing is left behind by waiting on the condvar if
 +         * that unlikely case happened.
 +         */
 +        WITH_QEMU_LOCK_GUARD(&mis->page_request_mutex) {
 +            if (qatomic_read(&mis->page_requested_count)) {
 +                /*
 +                 * It is guaranteed to receive a signal later, because the
 +                 * count>0 now, so it's destined to be decreased to zero
 +                 * very soon by the preempt thread.
 +                 */
 +                qemu_cond_wait(&mis->page_request_cond,
 +                               &mis->page_request_mutex);
 +            }
 +        }
 +        /* Notify the fast load thread to quit */
         if (mis->postcopy_qemufile_dst) {
             qemu_file_shutdown(mis->postcopy_qemufile_dst);
         }
@@ -1277,8 +1301,20 @@ static int qemu_ufd_copy_ioctl(MigrationIncomingState *mis, void *host_addr,
          */
         if (g_tree_lookup(mis->page_requested, host_addr)) {
             g_tree_remove(mis->page_requested, host_addr);
 -            mis->page_requested_count--;
 +            int left_pages = qatomic_dec_fetch(&mis->page_requested_count);
 +
             trace_postcopy_page_req_del(host_addr, mis->page_requested_count);
 +            /* Order the update of count and read of preempt status */
 +            smp_mb();
 +            if (mis->preempt_thread_status == PREEMPT_THREAD_QUIT &&
 +                left_pages == 0) {
 +                /*
 +                 * This probably means the main thread is waiting for us.
 +                 * Notify that we've finished receiving the last requested
 +                 * page.
 +                 */
 +                qemu_cond_signal(&mis->page_request_cond);
 +            }
         }
         qemu_mutex_unlock(&mis->page_request_mutex);
         mark_postcopy_blocktime_end((uintptr_t)host_addr);
 -- 
 2.39.3
--- a/kvm-migration-Move-return-path-cleanup-to-main-migration.patch
+++ b/kvm-migration-Move-return-path-cleanup-to-main-migration.patch
@ -1,76 +0,0 @@
 From 117f325d4983bb7e40a50e51c2fe056938d5add4 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:22 -0300
 Subject: [PATCH 08/13] migration: Move return path cleanup to main migration
 thread
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [8/8] 3f085c4ac6c0835d35346bf0cad778c17a248daf (peterx/qemu-kvm)
 Now that the return path thread is allowed to finish during a paused
 migration, we can move the cleanup of the QEMUFiles to the main
 migration thread.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-9-farosas@suse.de>
 (cherry picked from commit 36e9aab3c569d4c9ad780473596e18479838d1aa)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index a0782c64a1..7a4c8beb5d 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -98,6 +98,7 @@ static int migration_maybe_pause(MigrationState *s,
                                  int *current_active_state,
                                  int new_state);
 static void migrate_fd_cancel(MigrationState *s);
 +static int await_return_path_close_on_source(MigrationState *s);
 static bool migration_needs_multiple_sockets(void)
 {
@@ -1178,6 +1179,12 @@ static void migrate_fd_cleanup(MigrationState *s)
         qemu_fclose(tmp);
     }
 +    /*
 +     * We already cleaned up to_dst_file, so errors from the return
 +     * path might be due to that, ignore them.
 +     */
 +    await_return_path_close_on_source(s);
 +
     assert(!migration_is_active(s));
     if (s->state == MIGRATION_STATUS_CANCELLING) {
@@ -1986,7 +1993,6 @@ out:
     }
     trace_source_return_path_thread_end();
 -    migration_release_dst_files(ms);
     rcu_unregister_thread();
     return NULL;
 }
@@ -2040,6 +2046,9 @@ static int await_return_path_close_on_source(MigrationState *ms)
     ret = ms->rp_state.error;
     ms->rp_state.error = false;
 +
 +    migration_release_dst_files(ms);
 +
     trace_migration_return_path_end_after(ret);
     return ret;
 }
 -- 
 2.39.3
--- a/kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch
+++ b/kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch
@ -1,49 +0,0 @@
 From be84138fc49f3e6998d6af8fdfa9cc1054ae1549 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:19 -0300
 Subject: [PATCH 05/13] migration: Remove redundant cleanup of
 postcopy_qemufile_src
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [5/8] 2a63a021e923e6460d57f1c0850651f4ddcd5b4f (peterx/qemu-kvm)
 This file is owned by the return path thread which is already doing
 cleanup.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-6-farosas@suse.de>
 (cherry picked from commit b3b101157d4651f12e6b3361af2de6bace7f9b4a)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 6 ------
 1 file changed, 6 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 169e6bdce8..e2e4a7d8ae 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1178,12 +1178,6 @@ static void migrate_fd_cleanup(MigrationState *s)
         qemu_fclose(tmp);
     }
 -    if (s->postcopy_qemufile_src) {
 -        migration_ioc_unregister_yank_from_file(s->postcopy_qemufile_src);
 -        qemu_fclose(s->postcopy_qemufile_src);
 -        s->postcopy_qemufile_src = NULL;
 -    }
 -
     assert(!migration_is_active(s));
     if (s->state == MIGRATION_STATUS_CANCELLING) {
 -- 
 2.39.3
--- a/kvm-migration-Replace-the-return-path-retry-logic.patch
+++ b/kvm-migration-Replace-the-return-path-retry-logic.patch
@ -1,251 +0,0 @@
 From 74093a6ac7b5290965a2869512b998eac018a630 Mon Sep 17 00:00:00 2001
 From: Fabiano Rosas <farosas@suse.de>
 Date: Mon, 18 Sep 2023 14:28:21 -0300
 Subject: [PATCH 07/13] migration: Replace the return path retry logic
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 203: migration: Fix race that dest preempt thread close too early
 RH-Jira: RHEL-11219
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Commit: [7/8] 6b9d9b955f95ff14b47491865e7e45bfdcfc8a97 (peterx/qemu-kvm)
 Replace the return path retry logic with finishing and restarting the
 thread. This fixes a race when resuming the migration that leads to a
 segfault.
 Currently when doing postcopy we consider that an IO error on the
 return path file could be due to a network intermittency. We then keep
 the thread alive but have it do cleanup of the 'from_dst_file' and
 wait on the 'postcopy_pause_rp' semaphore. When the user issues a
 migrate resume, a new return path is opened and the thread is allowed
 to continue.
 There's a race condition in the above mechanism. It is possible for
 the new return path file to be setup *before* the cleanup code in the
 return path thread has had a chance to run, leading to the *new* file
 being closed and the pointer set to NULL. When the thread is released
 after the resume, it tries to dereference 'from_dst_file' and crashes:
 Thread 7 "return path" received signal SIGSEGV, Segmentation fault.
 [Switching to Thread 0x7fffd1dbf700 (LWP 9611)]
 0x00005555560e4893 in qemu_file_get_error_obj (f=0x0, errp=0x0) at ../migration/qemu-file.c:154
 154         return f->last_error;
 (gdb) bt
 #0  0x00005555560e4893 in qemu_file_get_error_obj (f=0x0, errp=0x0) at ../migration/qemu-file.c:154
 #1  0x00005555560e4983 in qemu_file_get_error (f=0x0) at ../migration/qemu-file.c:206
 #2  0x0000555555b9a1df in source_return_path_thread (opaque=0x555556e06000) at ../migration/migration.c:1876
 #3  0x000055555602e14f in qemu_thread_start (args=0x55555782e780) at ../util/qemu-thread-posix.c:541
 #4  0x00007ffff38d76ea in start_thread (arg=0x7fffd1dbf700) at pthread_create.c:477
 #5  0x00007ffff35efa6f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 Here's the race (important bit is open_return_path happening before
 migration_release_dst_files):
 migration                 | qmp                         | return path
 --------------------------+-----------------------------+---------------------------------
 			    qmp_migrate_pause()
 			     shutdown(ms->to_dst_file)
 			      f->last_error = -EIO
 migrate_detect_error()
 postcopy_pause()
  set_state(PAUSED)
  wait(postcopy_pause_sem)
 			    qmp_migrate(resume)
 			    migrate_fd_connect()
 			     resume = state == PAUSED
 			     open_return_path <-- TOO SOON!
 			     set_state(RECOVER)
 			     post(postcopy_pause_sem)
 							(incoming closes to_src_file)
 							res = qemu_file_get_error(rp)
 							migration_release_dst_files()
 							ms->rp_state.from_dst_file = NULL
  post(postcopy_pause_rp_sem)
 							postcopy_pause_return_path_thread()
 							  wait(postcopy_pause_rp_sem)
 							rp = ms->rp_state.from_dst_file
 							goto retry
 							qemu_file_get_error(rp)
 							SIGSEGV
 -------------------------------------------------------------------------------------------
 We can keep the retry logic without having the thread alive and
 waiting. The only piece of data used by it is the 'from_dst_file' and
 it is only allowed to proceed after a migrate resume is issued and the
 semaphore released at migrate_fd_connect().
 Move the retry logic to outside the thread by waiting for the thread
 to finish before pausing the migration.
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230918172822.19052-8-farosas@suse.de>
 (cherry picked from commit ef796ee93b313ed2f0b427ef30320417387d2ad5)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 migration/migration.c | 60 ++++++++-----------------------------------
 migration/migration.h |  1 -
 2 files changed, 11 insertions(+), 50 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index ac4541b971..a0782c64a1 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1776,18 +1776,6 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
     }
 }
 -/* Return true to retry, false to quit */
 -static bool postcopy_pause_return_path_thread(MigrationState *s)
 -{
 -    trace_postcopy_pause_return_path();
 -
 -    qemu_sem_wait(&s->postcopy_pause_rp_sem);
 -
 -    trace_postcopy_pause_return_path_continued();
 -
 -    return true;
 -}
 -
 static int migrate_handle_rp_recv_bitmap(MigrationState *s, char *block_name)
 {
     RAMBlock *block = qemu_ram_block_by_name(block_name);
@@ -1871,7 +1859,6 @@ static void *source_return_path_thread(void *opaque)
     trace_source_return_path_thread_entry();
     rcu_register_thread();
 -retry:
     while (!ms->rp_state.error && !qemu_file_get_error(rp) &&
            migration_is_setup_or_active(ms->state)) {
         trace_source_return_path_thread_loop_top();
@@ -1993,26 +1980,7 @@ retry:
     }
 out:
 -    res = qemu_file_get_error(rp);
 -    if (res) {
 -        if (res && migration_in_postcopy()) {
 -            /*
 -             * Maybe there is something we can do: it looks like a
 -             * network down issue, and we pause for a recovery.
 -             */
 -            migration_release_dst_files(ms);
 -            rp = NULL;
 -            if (postcopy_pause_return_path_thread(ms)) {
 -                /*
 -                 * Reload rp, reset the rest.  Referencing it is safe since
 -                 * it's reset only by us above, or when migration completes
 -                 */
 -                rp = ms->rp_state.from_dst_file;
 -                ms->rp_state.error = false;
 -                goto retry;
 -            }
 -        }
 -
 +    if (qemu_file_get_error(rp)) {
         trace_source_return_path_thread_bad_end();
         mark_source_rp_bad(ms);
     }
@@ -2023,8 +1991,7 @@ out:
     return NULL;
 }
 -static int open_return_path_on_source(MigrationState *ms,
 -                                      bool create_thread)
 +static int open_return_path_on_source(MigrationState *ms)
 {
     ms->rp_state.from_dst_file = qemu_file_get_return_path(ms->to_dst_file);
     if (!ms->rp_state.from_dst_file) {
@@ -2033,11 +2000,6 @@ static int open_return_path_on_source(MigrationState *ms,
     trace_open_return_path_on_source();
 -    if (!create_thread) {
 -        /* We're done */
 -        return 0;
 -    }
 -
     qemu_thread_create(&ms->rp_state.rp_thread, "return path",
                        source_return_path_thread, ms, QEMU_THREAD_JOINABLE);
     ms->rp_state.rp_thread_created = true;
@@ -2077,6 +2039,7 @@ static int await_return_path_close_on_source(MigrationState *ms)
     trace_await_return_path_close_on_source_close();
     ret = ms->rp_state.error;
 +    ms->rp_state.error = false;
     trace_migration_return_path_end_after(ret);
     return ret;
 }
@@ -2552,6 +2515,13 @@ static MigThrError postcopy_pause(MigrationState *s)
         qemu_file_shutdown(file);
         qemu_fclose(file);
 +        /*
 +         * We're already pausing, so ignore any errors on the return
 +         * path and just wait for the thread to finish. It will be
 +         * re-created when we resume.
 +         */
 +        await_return_path_close_on_source(s);
 +
         migrate_set_state(&s->state, s->state,
                           MIGRATION_STATUS_POSTCOPY_PAUSED);
@@ -2569,12 +2539,6 @@ static MigThrError postcopy_pause(MigrationState *s)
         if (s->state == MIGRATION_STATUS_POSTCOPY_RECOVER) {
             /* Woken up by a recover procedure. Give it a shot */
 -            /*
 -             * Firstly, let's wake up the return path now, with a new
 -             * return path channel.
 -             */
 -            qemu_sem_post(&s->postcopy_pause_rp_sem);
 -
             /* Do the resume logic */
             if (postcopy_do_resume(s) == 0) {
                 /* Let's continue! */
@@ -3264,7 +3228,7 @@ void migrate_fd_connect(MigrationState *s, Error *error_in)
      * QEMU uses the return path.
      */
     if (migrate_postcopy_ram() || migrate_return_path()) {
 -        if (open_return_path_on_source(s, !resume)) {
 +        if (open_return_path_on_source(s)) {
             error_setg(&local_err, "Unable to open return-path for postcopy");
             migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
             migrate_set_error(s, local_err);
@@ -3328,7 +3292,6 @@ static void migration_instance_finalize(Object *obj)
     qemu_sem_destroy(&ms->rate_limit_sem);
     qemu_sem_destroy(&ms->pause_sem);
     qemu_sem_destroy(&ms->postcopy_pause_sem);
 -    qemu_sem_destroy(&ms->postcopy_pause_rp_sem);
     qemu_sem_destroy(&ms->rp_state.rp_sem);
     qemu_sem_destroy(&ms->rp_state.rp_pong_acks);
     qemu_sem_destroy(&ms->postcopy_qemufile_src_sem);
@@ -3348,7 +3311,6 @@ static void migration_instance_init(Object *obj)
     migrate_params_init(&ms->parameters);
     qemu_sem_init(&ms->postcopy_pause_sem, 0);
 -    qemu_sem_init(&ms->postcopy_pause_rp_sem, 0);
     qemu_sem_init(&ms->rp_state.rp_sem, 0);
     qemu_sem_init(&ms->rp_state.rp_pong_acks, 0);
     qemu_sem_init(&ms->rate_limit_sem, 0);
 diff --git a/migration/migration.h b/migration/migration.h
 index 9a30216895..1034d617bf 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
@@ -393,7 +393,6 @@ struct MigrationState {
     /* Needed by postcopy-pause state */
     QemuSemaphore postcopy_pause_sem;
 -    QemuSemaphore postcopy_pause_rp_sem;
     /*
      * Whether we abort the migration if decompression errors are
      * detected at the destination. It is left at false for qemu
 -- 
 2.39.3
--- a/kvm-tests-file-io-error-New-test.patch
+++ b/kvm-tests-file-io-error-New-test.patch
@ -1,201 +0,0 @@
 From dbf091dd32daae0999fb62b74f7c834b445f6bf1 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Thu, 24 Aug 2023 17:53:44 +0200
 Subject: [PATCH 13/13] tests/file-io-error: New test
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 202: file-posix: Fix zone update in I/O error path
 RH-Jira: RHEL-7360
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [5/5] a07662c948f10bea7972a7d525b5941264651a4f (hreitz/qemu-kvm-c-9-s)
 This is a regression test for
 https://bugzilla.redhat.com/show_bug.cgi?id=2234374.
 All this test needs to do is trigger an I/O error inside of file-posix
 (specifically raw_co_prw()).  One reliable way to do this without
 requiring special privileges is to use a FUSE export, which allows us to
 inject any error that we want, e.g. via blkdebug.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230824155345.109765-6-hreitz@redhat.com>
 [hreitz: Fixed test to be skipped when there is no FUSE support, to
         suppress fusermount's allow_other warning, and to be skipped
         with $IMGOPTSSYNTAX enabled]
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 (cherry picked from commit 380448464dd89291cf7fd7434be6c225482a334d)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 tests/qemu-iotests/tests/file-io-error     | 119 +++++++++++++++++++++
 tests/qemu-iotests/tests/file-io-error.out |  33 ++++++
 2 files changed, 152 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/file-io-error
 create mode 100644 tests/qemu-iotests/tests/file-io-error.out
 diff --git a/tests/qemu-iotests/tests/file-io-error b/tests/qemu-iotests/tests/file-io-error
 new file mode 100755
 index 0000000000..88ee5f670c
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/file-io-error
@@ -0,0 +1,119 @@
 +#!/usr/bin/env bash
 +# group: rw
 +#
 +# Produce an I/O error in file-posix, and hope that it is not catastrophic.
 +# Regression test for: https://bugzilla.redhat.com/show_bug.cgi?id=2234374
 +#
 +# Copyright (C) 2023 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +
 +seq=$(basename "$0")
 +echo "QA output created by $seq"
 +
 +status=1	# failure is the default!
 +
 +_cleanup()
 +{
 +    _cleanup_qemu
 +    rm -f "$TEST_DIR/fuse-export"
 +}
 +trap "_cleanup; exit \$status" 0 1 2 3 15
 +
 +# get standard environment, filters and checks
 +. ../common.rc
 +. ../common.filter
 +. ../common.qemu
 +
 +# Format-agnostic (we do not use any), but we do test the file protocol
 +_supported_proto file
 +_require_drivers blkdebug null-co
 +
 +if [ "$IMGOPTSSYNTAX" = "true" ]; then
 +    # We need `$QEMU_IO -f file` to work; IMGOPTSSYNTAX uses --image-opts,
 +    # breaking -f.
 +    _unsupported_fmt $IMGFMT
 +fi
 +
 +# This is a regression test of a bug in which flie-posix would access zone
 +# information in case of an I/O error even when there is no zone information,
 +# resulting in a division by zero.
 +# To reproduce the problem, we need to trigger an I/O error inside of
 +# file-posix, which can be done (rootless) by providing a FUSE export that
 +# presents only errors when accessed.
 +
 +_launch_qemu
 +_send_qemu_cmd $QEMU_HANDLE \
 +    "{'execute': 'qmp_capabilities'}" \
 +    'return'
 +
 +_send_qemu_cmd $QEMU_HANDLE \
 +    "{'execute': 'blockdev-add',
 +      'arguments': {
 +          'driver': 'blkdebug',
 +          'node-name': 'node0',
 +          'inject-error': [{'event': 'none'}],
 +          'image': {
 +              'driver': 'null-co'
 +          }
 +      }}" \
 +    'return'
 +
 +# FUSE mountpoint must exist and be a regular file
 +touch "$TEST_DIR/fuse-export"
 +
 +# The grep -v to filter fusermount's (benign) error when /etc/fuse.conf does
 +# not contain user_allow_other and the subsequent check for missing FUSE support
 +# have both been taken from iotest 308.
 +output=$(_send_qemu_cmd $QEMU_HANDLE \
 +    "{'execute': 'block-export-add',
 +      'arguments': {
 +          'id': 'exp0',
 +          'type': 'fuse',
 +          'node-name': 'node0',
 +          'mountpoint': '$TEST_DIR/fuse-export',
 +          'writable': true
 +      }}" \
 +    'return' \
 +    | grep -v 'option allow_other only allowed if')
 +
 +if echo "$output" | grep -q "Parameter 'type' does not accept value 'fuse'"; then
 +    _notrun 'No FUSE support'
 +fi
 +echo "$output"
 +
 +echo
 +# This should fail, but gracefully, i.e. just print an I/O error, not crash.
 +$QEMU_IO -f file -c 'write 0 64M' "$TEST_DIR/fuse-export" | _filter_qemu_io
 +echo
 +
 +_send_qemu_cmd $QEMU_HANDLE \
 +    "{'execute': 'block-export-del',
 +      'arguments': {'id': 'exp0'}}" \
 +    'return'
 +
 +_send_qemu_cmd $QEMU_HANDLE \
 +    '' \
 +    'BLOCK_EXPORT_DELETED'
 +
 +_send_qemu_cmd $QEMU_HANDLE \
 +    "{'execute': 'blockdev-del',
 +      'arguments': {'node-name': 'node0'}}" \
 +    'return'
 +
 +# success, all done
 +echo "*** done"
 +rm -f $seq.full
 +status=0
 diff --git a/tests/qemu-iotests/tests/file-io-error.out b/tests/qemu-iotests/tests/file-io-error.out
 new file mode 100644
 index 0000000000..0f46455a94
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/file-io-error.out
@@ -0,0 +1,33 @@
 +QA output created by file-io-error
 +{'execute': 'qmp_capabilities'}
 +{"return": {}}
 +{'execute': 'blockdev-add',
 +      'arguments': {
 +          'driver': 'blkdebug',
 +          'node-name': 'node0',
 +          'inject-error': [{'event': 'none'}],
 +          'image': {
 +              'driver': 'null-co'
 +          }
 +      }}
 +{"return": {}}
 +{'execute': 'block-export-add',
 +      'arguments': {
 +          'id': 'exp0',
 +          'type': 'fuse',
 +          'node-name': 'node0',
 +          'mountpoint': 'TEST_DIR/fuse-export',
 +          'writable': true
 +      }}
 +{"return": {}}
 +
 +write failed: Input/output error
 +
 +{'execute': 'block-export-del',
 +      'arguments': {'id': 'exp0'}}
 +{"return": {}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "exp0"}}
 +{'execute': 'blockdev-del',
 +      'arguments': {'node-name': 'node0'}}
 +{"return": {}}
 +*** done
 -- 
 2.39.3
--- a/kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch
+++ b/kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch
@ -1,151 +0,0 @@
 From be5adda1bfc78fea3655ee7a2e11048cfcd9247c Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Tue, 5 Sep 2023 16:50:02 +0200
 Subject: [PATCH] virtio: Drop out of coroutine context in virtio_load()
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 201: virtio: Drop out of coroutine context in virtio_load()
 RH-Jira: RHEL-832
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [1/1] 64ca84cf9bd82eb9e22a1840909e99958ceb51a6 (kmwolf/centos-qemu-kvm)
 virtio_load() as a whole should run in coroutine context because it
 reads from the migration stream and we don't want this to block.
 However, it calls virtio_set_features_nocheck() and devices don't
 expect their .set_features callback to run in a coroutine and therefore
 call functions that may not be called in coroutine context. To fix this,
 drop out of coroutine context for calling virtio_set_features_nocheck().
 Without this fix, the following crash was reported:
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007efc738c05d3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007efc73873d26 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007efc738477f3 in __GI_abort () at abort.c:79
  #4  0x00007efc7384771b in __assert_fail_base (fmt=0x7efc739dbcb8 "", assertion=assertion@entry=0x560aebfbf5cf "!qemu_in_coroutine()",
     file=file@entry=0x560aebfcd2d4 "../block/graph-lock.c", line=line@entry=275, function=function@entry=0x560aebfcd34d "void bdrv_graph_rdlock_main_loop(void)") at assert.c:92
  #5  0x00007efc7386ccc6 in __assert_fail (assertion=0x560aebfbf5cf "!qemu_in_coroutine()", file=0x560aebfcd2d4 "../block/graph-lock.c", line=275,
     function=0x560aebfcd34d "void bdrv_graph_rdlock_main_loop(void)") at assert.c:101
  #6  0x0000560aebcd8dd6 in bdrv_register_buf ()
  #7  0x0000560aeb97ed97 in ram_block_added.llvm ()
  #8  0x0000560aebb8303f in ram_block_add.llvm ()
  #9  0x0000560aebb834fa in qemu_ram_alloc_internal.llvm ()
  #10 0x0000560aebb2ac98 in vfio_region_mmap ()
  #11 0x0000560aebb3ea0f in vfio_bars_register ()
  #12 0x0000560aebb3c628 in vfio_realize ()
  #13 0x0000560aeb90f0c2 in pci_qdev_realize ()
  #14 0x0000560aebc40305 in device_set_realized ()
  #15 0x0000560aebc48e07 in property_set_bool.llvm ()
  #16 0x0000560aebc46582 in object_property_set ()
  #17 0x0000560aebc4cd58 in object_property_set_qobject ()
  #18 0x0000560aebc46ba7 in object_property_set_bool ()
  #19 0x0000560aeb98b3ca in qdev_device_add_from_qdict ()
  #20 0x0000560aebb1fbaf in virtio_net_set_features ()
  #21 0x0000560aebb46b51 in virtio_set_features_nocheck ()
  #22 0x0000560aebb47107 in virtio_load ()
  #23 0x0000560aeb9ae7ce in vmstate_load_state ()
  #24 0x0000560aeb9d2ee9 in qemu_loadvm_state_main ()
  #25 0x0000560aeb9d45e1 in qemu_loadvm_state ()
  #26 0x0000560aeb9bc32c in process_incoming_migration_co.llvm ()
  #27 0x0000560aebeace56 in coroutine_trampoline.llvm ()
 Cc: qemu-stable@nongnu.org
 Buglink: https://issues.redhat.com/browse/RHEL-832
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20230905145002.46391-3-kwolf@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 92e2e6a867334a990f8d29f07ca34e3162fdd6ec)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 hw/virtio/virtio.c | 45 ++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 5 deletions(-)
 diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
 index 309038fd46..969c25f4cf 100644
 --- a/hw/virtio/virtio.c
 +++ b/hw/virtio/virtio.c
@@ -2825,8 +2825,9 @@ static int virtio_device_put(QEMUFile *f, void *opaque, size_t size,
 }
 /* A wrapper for use as a VMState .get function */
 -static int virtio_device_get(QEMUFile *f, void *opaque, size_t size,
 -                             const VMStateField *field)
 +static int coroutine_mixed_fn
 +virtio_device_get(QEMUFile *f, void *opaque, size_t size,
 +                  const VMStateField *field)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
     DeviceClass *dc = DEVICE_CLASS(VIRTIO_DEVICE_GET_CLASS(vdev));
@@ -2853,6 +2854,39 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val)
     return bad ? -1 : 0;
 }
 +typedef struct VirtioSetFeaturesNocheckData {
 +    Coroutine *co;
 +    VirtIODevice *vdev;
 +    uint64_t val;
 +    int ret;
 +} VirtioSetFeaturesNocheckData;
 +
 +static void virtio_set_features_nocheck_bh(void *opaque)
 +{
 +    VirtioSetFeaturesNocheckData *data = opaque;
 +
 +    data->ret = virtio_set_features_nocheck(data->vdev, data->val);
 +    aio_co_wake(data->co);
 +}
 +
 +static int coroutine_mixed_fn
 +virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev, uint64_t val)
 +{
 +    if (qemu_in_coroutine()) {
 +        VirtioSetFeaturesNocheckData data = {
 +            .co = qemu_coroutine_self(),
 +            .vdev = vdev,
 +            .val = val,
 +        };
 +        aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
 +                                virtio_set_features_nocheck_bh, &data);
 +        qemu_coroutine_yield();
 +        return data.ret;
 +    } else {
 +        return virtio_set_features_nocheck(vdev, val);
 +    }
 +}
 +
 int virtio_set_features(VirtIODevice *vdev, uint64_t val)
 {
     int ret;
@@ -2906,7 +2940,8 @@ size_t virtio_get_config_size(const VirtIOConfigSizeParams *params,
     return config_size;
 }
 -int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
 +int coroutine_mixed_fn
 +virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
 {
     int i, ret;
     int32_t config_len;
@@ -3023,14 +3058,14 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
          * host_features.
          */
         uint64_t features64 = vdev->guest_features;
 -        if (virtio_set_features_nocheck(vdev, features64) < 0) {
 +        if (virtio_set_features_nocheck_maybe_co(vdev, features64) < 0) {
             error_report("Features 0x%" PRIx64 " unsupported. "
                          "Allowed features: 0x%" PRIx64,
                          features64, vdev->host_features);
             return -1;
         }
     } else {
 -        if (virtio_set_features_nocheck(vdev, features) < 0) {
 +        if (virtio_set_features_nocheck_maybe_co(vdev, features) < 0) {
             error_report("Features 0x%x unsupported. "
                          "Allowed features: 0x%" PRIx64,
                          features, vdev->host_features);
 -- 
 2.39.3
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -148,8 +148,8 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
-Version: 8.1.0
+Version: 8.2.0
-Release: 5%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 1%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -186,47 +186,7 @@ Patch0012: 0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
 Patch0013: 0013-Add-support-statement-to-help-output.patch
 Patch0014: 0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
 Patch0015: 0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-Patch0016: 0016-vdpa-use-first-queue-SVQ-state-for-CVQ-default.patch
+Patch0016: 0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
 Patch0017: 0017-vdpa-export-vhost_vdpa_set_vring_ready.patch
 Patch0018: 0018-vdpa-rename-vhost_vdpa_net_load-to-vhost_vdpa_net_cv.patch
 Patch0019: 0019-vdpa-move-vhost_vdpa_set_vring_ready-to-the-caller.patch
 Patch0020: 0020-vdpa-remove-net-cvq-migration-blocker.patch
 Patch0021: 0021-Add-machine-types-compat-bits.patch
 Patch0022: 0022-Fix-x86-machine-type-compatibility-for-qemu-kvm-8.1..patch
 # For RHEL-832 - qemu-kvm crashed when migrating guest with failover vf
 Patch23: kvm-virtio-Drop-out-of-coroutine-context-in-virtio_load.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch24: kvm-migration-Fix-race-that-dest-preempt-thread-close-to.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch25: kvm-migration-Fix-possible-race-when-setting-rp_state.er.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch26: kvm-migration-Fix-possible-races-when-shutting-down-the-.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch27: kvm-migration-Fix-possible-race-when-shutting-down-to_ds.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch28: kvm-migration-Remove-redundant-cleanup-of-postcopy_qemuf.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch29: kvm-migration-Consolidate-return-path-closing-code.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch30: kvm-migration-Replace-the-return-path-retry-logic.patch
 # For RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
 Patch31: kvm-migration-Move-return-path-cleanup-to-main-migration.patch
 # For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
 Patch32: kvm-file-posix-Clear-bs-bl.zoned-on-error.patch
 # For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
 Patch33: kvm-file-posix-Check-bs-bl.zoned-for-zone-info.patch
 # For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
 Patch34: kvm-file-posix-Fix-zone-update-in-I-O-error-path.patch
 # For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
 Patch35: kvm-file-posix-Simplify-raw_co_prw-s-out-zone-code.patch
 # For RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
 Patch36: kvm-tests-file-io-error-New-test.patch
 # For RHEL-2828 - CVE-2023-42467 qemu-kvm: qemu: denial of service due to division by zero [rhel-9]
 Patch37: kvm-hw-scsi-scsi-disk-Disallow-block-sizes-smaller-than-.patch
 # For RHEL-1308 - [RFE] iGB: Add an emulated SR-IOV network card
 Patch38: kvm-Enable-igb-on-x86_64.patch
 # For RHEL-12991 - qemu-kvm fails to build on s390x with clang-17
 Patch39: kvm-host-include-generic-host-atomic128-Fix-compilation-.patch
 %if %{have_clang}
 BuildRequires: clang
@ -609,7 +569,6 @@ ulimit -n 10240
  --disable-gtk                    \\\
  --disable-guest-agent            \\\
  --disable-guest-agent-msi        \\\
  --disable-hax                    \\\
  --disable-hvf                    \\\
  --disable-iconv                  \\\
  --disable-jack                   \\\
@ -646,6 +605,7 @@ ulimit -n 10240
  --disable-pa                     \\\
  --disable-parallels              \\\
  --disable-pie                    \\\
  --disable-plugins                \\\
  --disable-pvrdma                 \\\
  --disable-qcow1                  \\\
  --disable-qed                    \\\
@ -1286,6 +1246,23 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 %changelog
 * Tue Jan 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-1
 - Rebase to QEMU 8.2.0 [RHEL-14111]
 - Fix machine type compatibility [RHEL-17067 RHEL-17068]
 - Add 9.4.0 machine type [RHEL-17168 RHEL-19117 RHEL-19119]
 - Resolves: RHEL-14111
  (Rebase qemu-kvm to QEMU 8.2.0)
 - Resolves: RHEL-17067
  (Check/fix machine type compatibility for qemu-kvm 8.2.0 [s390x])
 - Resolves: RHEL-17068
  (Check/fix machine type compatibility for qemu-kvm 8.2.0 [x86_64])
 - Resolves: RHEL-17168
  (Introduce virt-rhel9.4.0 arm-virt machine type [aarch64])
 - Resolves: RHEL-19117
  (Introduce virt-rhel9.4.0 arm-virt machine type [x86_64])
 - Resolves: RHEL-19119
  (Introduce virt-rhel9.4.0 arm-virt machine type [s390x])
 * Thu Nov 30 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.1.0-5
 - kvm-Preparation-for-using-allow-rpcs-list-in-guest-agent.patch [RHEL-955]
 - kvm-Use-allow-rpcs-instead-of-block-rpcs-in-guest-agent..patch [RHEL-955]
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (qemu-8.1.0.tar.xz) = c5f5e7ce2d8e3c93a02012b136c866e8577df07da4705a0045916c71caeaa21fa1b2d59a4b22a660789a4159b192e12a443e7cbb0724ee85fea258251731724c
+SHA512 (qemu-8.2.0.tar.xz) = 92ec41196ff145cdbb98948f6b6e43214fa4b4419554a8a1927fb4527080c8212ccb703e184baf8ee0bdfa50ad7a84689e8f5a69eba1bd7bbbdfd69e3b91256c
`@ -1 +1 @@`
	`SHA512 (qemu-8.1.0.tar.xz) = c5f5e7ce2d8e3c93a02012b136c866e8577df07da4705a0045916c71caeaa21fa1b2d59a4b22a660789a4159b192e12a443e7cbb0724ee85fea258251731724c`	`SHA512 (qemu-8.2.0.tar.xz) = 92ec41196ff145cdbb98948f6b6e43214fa4b4419554a8a1927fb4527080c8212ccb703e184baf8ee0bdfa50ad7a84689e8f5a69eba1bd7bbbdfd69e3b91256c`