From f3b86471cdade5d7f5590fb20cd294bab1fc1d3c Mon Sep 17 00:00:00 2001
From: Miroslav Rezanina <mrezanin@redhat.com>
Date: Wed, 22 Oct 2025 09:16:35 +0200
Subject: [PATCH] * Wed Oct 22 2025 Miroslav Rezanina <mrezanin@redhat.com> -
 10.1.0-1

- Rebase to QEMU 10.1.0
- Resolves: RHEL-117664
  (Rebase qemu-kvm to QEMU 10.1)
---
 .gitignore                                    |    1 +
 ...d.patch => 0001-Initial-redhat-build.patch |   45 +-
 ...0002-Enable-disable-devices-for-RHEL.patch |  339 +--
 ...Machine-type-related-general-changes.patch |  154 +-
 ...temporarily-disable-Wunused-function.patch |   11 +-
 ...machine-type-versions-for-aarch64-s3.patch |   75 +-
 ...rsioned-machine-type-macros-for-RHEL.patch |  108 +-
 ...ease-deletion-schedule-to-3-releases.patch |   15 +-
 ...aarch64-versioned-virt-machine-types.patch |  246 +-
 ...-ppc64-versioned-spapr-machine-types.patch |   81 +-
 ...390x-versioned-s390-ccw-virtio-machi.patch |   72 +-
 ...86_64-versioned-pc-q35-machine-types.patch |  221 +-
 ...temporarily-disable-Wunused-function.patch |   11 +-
 ...heck.patch => 0013-Enable-make-check.patch |  230 +-
 ...mber-of-devices-that-can-be-assigned.patch |   81 +-
 ...Add-support-statement-to-help-output.patch |   13 +-
 ...documentation-instead-of-qemu-system.patch |   11 +-
 ...on-warning-when-opening-v2-images-rw.patch |   14 +-
 ...hat-allow-5-level-paging-for-TDX-VMs.patch |   13 +-
 0019-Add-upstream-compat-bits.patch           |  155 +
 ...s390-virtio-ccw-Remove-the-deprecate.patch |   68 +
 ...s390-virtio-ccw-Remove-the-deprecate.patch |   67 +
 ...-Update-the-logfile-path-of-qga-fsfr.patch |   43 -
 ...s390-virtio-ccw-Remove-the-deprecate.patch |   69 +
 0023-Add-upstream-compatibility-bits.patch    |  109 -
 0023-redhat-Fix-rhel7.6.0-machine-type.patch  |   30 +
 ...9.1-compat-handling-to-the-s390x-mac.patch |   37 -
 ...lity-handling-for-the-s390-ccw-virti.patch |   41 +
 ...390-ccw-virtio-rhel9.8.0-machine-typ.patch |   60 +
 0025-redhat-Add-rhel9.6.0-machine-type.patch  |   55 -
 ...achine-rhel-machine-types-compat-fix.patch |   32 +
 ...tibility-of-pc-q35-rhel9-and-pc-i440.patch |   43 -
 ...m-ensure-compatibility-of-virt-rhel9.patch |   27 -
 0027-arm-rhel-machine-type-compat-fix.patch   |   26 +
 ...e-new-virt-machine-type-for-rhel-9.6.patch |   41 -
 ...compatibility-property-for-arch_capa.patch |  125 +
 ...compatibility-property-for-pdcm-feat.patch |  106 +
 ...new-pc-q35-machine-type-for-rhel-9.6.patch |   42 -
 ...e-new-virt-machine-type-for-rhel-9.8.patch |   38 +
 ...Manufacturer-and-Product-Name-in-emu.patch |   90 -
 kvm-Enable-amd-iommu-device.patch             |   38 -
 ...-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch |   49 -
 ...KVM-Dynamic-sized-kvm-memslots-array.patch |  250 --
 ...moryListener.nr_used_slots-to-nr_slo.patch |   72 -
 ...me-KVMState-nr_slots-to-nr_slots_max.patch |   89 -
 kvm-accel-kvm-refactor-dirty-ring-setup.patch |  143 -
 ...mmu-Add-support-for-pass-though-mode.patch |  141 -
 ...md_iommu-Check-APIC-ID-255-for-XTSup.patch |   66 -
 ...ommu-Rename-variable-mmio-to-mr_mmio.patch |   94 -
 ...otification-when-invalidate-interrup.patch |   81 -
 ...ared-memory-region-for-Interrupt-Rem.patch |  105 -
 ..._virt_compat_set-to-apply-the-compat.patch |   53 -
 kvm-arm-disable-pauth-for-virt-rhel9.patch    |   60 -
 ...-Add-active-field-to-BlockDeviceInfo.patch |  317 --
 ...-Add-blockdev-set-active-QMP-command.patch |  187 --
 ...d-new-bdrv_co_is_all_zeroes-function.patch |  145 -
 ...-Add-option-to-create-inactive-nodes.patch |  102 -
 ...-inactivating-already-inactive-nodes.patch |   80 -
 ...attach-inactive-child-to-active-node.patch |   46 -
 ...Drain-nodes-before-inactivating-them.patch |   52 -
 ...block-status-mode-from-bool-to-flags.patch |  689 -----
 ...ash-on-block_resize-on-inactive-node.patch |   68 -
 ...-external-snapshot-overlays-when-nec.patch |   68 -
 ...o_is_zero_fast-consolidate-adjacent-.patch |   90 -
 ...port-inactive-nodes-in-blk_insert_bs.patch |   66 -
 ...-option-to-allow-export-of-inactive-.patch |  135 -
 ...-t-ignore-image-activation-error-in-.patch |   50 -
 ...io-skip-head-tail-requests-on-EINVAL.patch |   74 -
 ...atic-zero-init-of-large-array-in-ioq.patch |   48 -
 ...skip-automatic-zero-init-of-large-ar.patch |   49 -
 ...-skip-automatic-zero-init-of-large-a.patch |   49 -
 ...ket-skip-automatic-zero-init-of-larg.patch |   49 -
 ...cpu_dirty-when-guest_state_protected.patch |   48 -
 ...Remove-nr_cores-from-struct-CPUState.patch |   76 -
 ...cros-for-hash-algorithm-digest-lengt.patch |   74 -
 kvm-docs-Add-TDX-documentation.patch          |  222 --
 ...-Document-reset-expectations-for-DMA.patch |   53 -
 ...m-Update-documentation-for-s390x-IPL.patch |   76 -
 ...index-Make-it-clear-that-s390x-can-a.patch |   45 -
 ...x-bootdevices-Update-loadparm-docume.patch |   65 -
 ...x-bootdevices-Update-the-documentati.patch |   66 -
 ...le-posix-Define-DM_MPATH_PROBE_PATHS.patch |   42 -
 ...x-Fix-crash-on-discard_granularity-0.patch |   46 -
 ...-paths-and-retry-SG_IO-on-potential-.patch |  215 --
 ...er-Handle-zero-block-status-hint-bet.patch |   64 -
 ...-discard-alignment-on-Linux-block-de.patch |  131 -
 ...nitions-from-UEFI-spec-for-volumes-r.patch |  233 --
 ...rge-property-after-the-memory-region.patch |   61 -
 ...property-to-scsi-disk-devices-for-bo.patch |  221 --
 ...-arm-smmuv3-Move-reset-to-exit-phase.patch |  123 -
 ...ip-automatic-zero-init-of-large-arra.patch |   57 -
 ...-skip-automatic-zero-init-of-large-a.patch |   59 -
 ...skip-automatic-zero-init-of-large-ar.patch |   49 -
 ...p-automatic-zero-init-of-large-array.patch |   48 -
 ..._88w8618-skip-automatic-zero-init-of.patch |   50 -
 ...ip-automatic-zero-init-of-large-arra.patch |   48 -
 ...7-skip-automatic-zero-init-of-large-.patch |   49 -
 ...-Use-correct-masks-for-IBRD-and-FBRD.patch |   69 -
 ...ole-lm-skip-automatic-zero-init-of-l.patch |   49 -
 ...e_vga-skip-automatic-zero-init-of-la.patch |   49 -
 ...dma-skip-automatic-zero-init-of-larg.patch |   47 -
 ...-skip-automatic-zero-init-of-large-a.patch |   56 -
 ...-i386-Fix-machine-type-compatibility.patch |   87 -
 ...u-Allow-migration-when-explicitly-cr.patch |  117 -
 ...u-Assign-pci-id-0x1419-for-the-AMD-I.patch |   57 -
 ...u-Isolate-AMDVI-PCI-from-amd-iommu-d.patch |  267 --
 ...intel-iommu-Migrate-to-3-phase-reset.patch |   96 -
 ...ace-skip-automatic-zero-init-of-larg.patch |   57 -
 ...kip-automatic-zero-init-of-large-arr.patch |   48 -
 ...p-automatic-zero-init-of-large-array.patch |   47 -
 ...t-skip-automatic-zero-init-of-large-.patch |   54 -
 ...p-automatic-zero-init-of-large-array.patch |   47 -
 ...p-automatic-zero-init-of-large-array.patch |   72 -
 ...sic-support-for-PCI-power-management.patch |  242 --
 kvm-hw-pci-Rename-has_power-to-enabled.patch  |  130 -
 ..._proxy-skip-automatic-zero-init-of-l.patch |   52 -
 ...-device-Convert-to-three-phase-reset.patch |   63 -
 ...tio-ccw-Convert-to-three-phase-reset.patch |   92 -
 ...x-Build-an-IPLB-for-each-boot-device.patch |  270 --
 ...the-possibility-to-load-the-s390-net.patch |  201 --
 ...t-loadparm-property-to-devices-that-.patch |  113 -
 ...ice-Fix-memory-leak-in-loadparm-sett.patch |   47 -
 ...vide-more-memory-to-the-s390-ccw.img.patch |   61 -
 ...5a-skip-automatic-zero-init-of-large.patch |   49 -
 ...skip-automatic-zero-init-of-large-ar.patch |   73 -
 ...p-automatic-zero-init-of-large-array.patch |   50 -
 ...skip-automatic-zero-init-of-large-ar.patch |   50 -
 ...dd-a-trace-point-in-vfio_reset_handl.patch |   61 -
 kvm-hw-vfio-pci-Re-order-pre-reset.patch      |   74 -
 ...nclude-md-stubs-in-case-CONFIG_VIRTI.patch |   59 -
 ...ix-crash-in-processing-balloon-stats.patch |  103 -
 ...-avoid-cost-of-ftrivial-auto-var-ini.patch |   73 -
 ...irtio-iommu-Migrate-to-3-phase-reset.patch |   96 -
 kvm-i386-Introduce-tdx-guest-object.patch     |  214 --
 ...ed-parameter-uint32_t-bit-in-feature.patch |   62 -
 kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch |   63 -
 ...ce-x86_confidential_guest_check_feat.patch |   80 -
 ...mask_cpuid_features-to-adjust_cpuid_.patch |  116 -
 ...u-Cleanup-host_cpu_max_instance_init.patch |   49 -
 ...date-the-helper-to-get-Host-s-vendor.patch |   78 -
 ...-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch |   55 -
 ...e-check-of-phys_bits-in-host_cpu_rea.patch |   79 -
 ...e-variable-smp_cores-and-smp_threads.patch |   68 -
 ...-a-common-fucntion-to-setup-value-of.patch |  112 -
 ...heck-of-CPUID_EXT3_TOPOEXT-against-t.patch |   80 -
 ...ce-enable_cpuid_0x1f-to-force-exposi.patch |  105 -
 ...justment-of-CPUID_EXT_PDCM-before-fe.patch |   59 -
 ...6_ext_save_areas-initialization-to-..patch |   91 -
 ...enable_cpuid_0x1f-to-force_cpuid_0x1.patch |   73 -
 ...-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch |   69 -
 ...CPUID_HT-in-x86_cpu_expand_features-.patch |   59 -
 ...-X86CPUTopoInfo-directly-in-CPUX86St.patch |  301 --
 ...ce-x86_confidential_guest_cpu_instan.patch |   87 -
 kvm-i386-tdvf-Fix-build-on-32-bit-host.patch  |   55 -
 ...duce-function-to-parse-TDVF-metadata.patch |  315 --
 ...F-memory-via-KVM_TDX_INIT_MEM_REGION.patch |  106 -
 ...-TDX-fixed1-bits-to-supported-CPUIDs.patch |  249 --
 ...-tdx-Add-XFD-to-supported-bit-of-TDX.patch |   60 -
 ...perty-sept-ve-disable-for-tdx-guest-.patch |  113 -
 ...ported-CPUID-bits-related-to-TD-Attr.patch |  144 -
 ...supported-CPUID-bits-relates-to-XFAM.patch |  220 --
 ...M_TDX_INIT_VCPU-to-initialize-TDX-vc.patch |   66 -
 ...-the-error-message-of-mrconfigid-mro.patch |   75 -
 ...efine-supported-KVM-features-for-TDX.patch |   80 -
 kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch    |   56 -
 kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch    |   61 -
 ...-Don-t-initialize-pc.rom-for-TDX-VMs.patch |   78 -
 ...86-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch |   59 -
 ...-Don-t-synchronize-guest-tsc-for-TDs.patch |   46 -
 ...x-Don-t-treat-SYSCALL-as-unavailable.patch |   60 -
 ...le-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch |   55 -
 ...nd-exit-when-named-cpu-model-is-requ.patch |   59 -
 ...Fetch-and-validate-CPUID-of-TD-guest.patch |  233 --
 kvm-i386-tdx-Finalize-TDX-VM.patch            |   44 -
 kvm-i386-tdx-Fix-build-on-32-bit-host.patch   |  121 -
 ...86-tdx-Fix-the-report-of-gpa-in-QAPI.patch |   78 -
 ...-typo-of-the-comment-of-struct-TdxGu.patch |   50 -
 kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch  |   45 -
 ..._capabilities-via-KVM_TDX_CAPABILITI.patch |  193 --
 ...dx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch |  146 -
 ...lement-adjust_cpuid_features-for-TDX.patch |  179 --
 ...nt-tdx_kvm_init-to-initialize-TDX-VM.patch |   92 -
 ...6-tdx-Implement-tdx_kvm_type-for-TDX.patch |   76 -
 ...plement-user-specified-tsc-frequency.patch |  101 -
 ...tialize-TDX-before-creating-TD-vcpus.patch |  283 --
 ...ce-is_tdx_vm-helper-and-cache-tdx_gu.patch |  104 -
 kvm-i386-tdx-Make-invtsc-default-on.patch     |   42 -
 ...-Make-sept_ve_disable-set-by-default.patch |   48 -
 ...nfigure-MSR_IA32_UCODE_REV-in-kvm_in.patch |   92 -
 ...6-tdx-Parse-TDVF-metadata-for-TDX-VM.patch |  116 -
 ...enumeration-of-GetQuote-in-tdx_handl.patch |   70 -
 ...move-task-watch-only-when-it-s-valid.patch |   50 -
 ...the-redundant-qemu_mutex_init-tdx-lo.patch |   50 -
 ...C-bus-rate-to-match-with-what-TDX-mo.patch |   78 -
 ...nd-check-kernel_irqchip-mode-for-TDX.patch |   64 -
 ..._readonly_mem_enabled-to-false-for-T.patch |   54 -
 ...ue-of-GetTdVmCallInfo-based-on-capab.patch |   60 -
 kvm-i386-tdx-Setup-the-TD-HOB-list.patch      |  264 --
 ...-user-configurable-mrconfigid-mrowne.patch |  226 --
 ...386-tdx-Track-RAM-entries-for-TDX-VM.patch |  223 --
 ...em_ptr-for-each-firmware-entry-of-TD.patch |  151 -
 kvm-i386-tdx-Validate-TD-attributes.patch     |  106 -
 ...alidate-phys_bits-against-host-value.patch |   88 -
 ...U-features-up-with-attributes-of-TD-.patch |   78 -
 ...X_REPORT_FATAL_ERROR-with-GuestPanic.patch |  240 --
 ...86-tdx-handle-TDG.VP.VMCALL-GetQuote.patch |  798 -----
 ...handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch |  111 -
 ...TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch |  197 --
 ...-tdx-implement-tdx_cpu_instance_init.patch |   50 -
 kvm-i386-tdx-load-TDVF-for-TD-guest.patch     |  105 -
 ...troduce-helpers-for-various-topology.patch |  101 -
 ...date-the-comment-of-x86_apicid_from_.patch |   49 -
 ...-Add-include-files-for-common-IPL-st.patch |  402 ---
 ...piler-add-QEMU_UNINITIALIZED-attribu.patch |   80 -
 ...truct-copy-in-qio_dns_resolver_looku.patch |   73 -
 ...d-NBD-based-tests-for-inactive-nodes.patch |  609 ----
 kvm-iotests-Add-filter_qtest.patch            |  113 -
 kvm-iotests-Add-qsd-migrate-case.patch        |  244 --
 ...ts-Improve-iotest-194-to-mirror-data.patch |   42 -
 ...ts-common.rc-add-disk_usage-function.patch |   68 -
 ...ch_get-put_registers-to-accept-Error.patch |  287 --
 ...-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch |   45 -
 ...m-Introduce-kvm_arch_pre_create_vcpu.patch |  187 --
 ...m_filter_msr-and-related-definitions.patch |   90 -
 ...e-virtual-machine-creation-into-its-.patch |  143 -
 kvm-kvm-remove-unnecessary-ifdef.patch        |   52 -
 ...ntf-with-error_report-printf-in-kvm_.patch |  131 -
 ...nux-headers-Update-to-Linux-6.13-rc1.patch | 1099 -------
 ...ux-headers-Update-to-Linux-v6.12-rc5.patch | 2559 -----------------
 ...ux-headers-Update-to-Linux-v6.14-rc3.patch |  495 ----
 ...ux-headers-Update-to-Linux-v6.15-rc3.patch |  949 ------
 ...ux-headers-update-from-6.15-kvm-next.patch |  126 -
 ...mory_region_set_ram_discard_manager-.patch |  160 --
 ...helper-to-get-intersection-of-a-Memo.patch |  157 -
 ...-definiton-of-ReplayRamPopulate-and-.patch |  277 --
 ...add-valgrind-option-en-dis-able-valg.patch |  110 -
 ...on-Add-helper-to-get-target-runstate.patch |   84 -
 ...pipes-to-keep-working-for-fd-migrati.patch |  116 -
 ...ration-Ensure-vmstate_save-sets-errp.patch |   92 -
 ...F-for-incoming-migration-on-Migratio.patch |  180 --
 ...Apply-late-block-active-behavior-to-.patch |   72 -
 ...Fix-possible-race-with-block_inactiv.patch |   78 -
 ...k-Make-late-block-active-the-default.patch |   94 -
 ...ration-block-Rewrite-disk-activation.patch |  565 ----
 ...ock-active-Remove-global-active-flag.patch |  158 -
 ...py-Spatial-locality-page-hint-for-pr.patch |  237 --
 ...-override-to-declare-target-already-.patch |  295 --
 ...Drop-redundant-zero_target-parameter.patch |  241 --
 kvm-mirror-Minor-refactoring.patch            |   92 -
 ...-sync-mode-rather-than-bool-to-inter.patch |  139 -
 ...O-when-destination-is-detect-zeroes-.patch |   58 -
 ...zeroing-destination-if-it-is-already.patch |  180 --
 ...ing-zeroes-when-target-is-already-ze.patch |  355 ---
 ...lence-server-warnings-on-port-probes.patch |  105 -
 kvm-nbd-server-Support-inactive-nodes.patch   |   68 -
 kvm-net-Fix-announce_self.patch               |   82 -
 ...p-automatic-zero-init-of-large-array.patch |   49 -
 ...p-automatic-zero-init-of-large-array.patch |   49 -
 ...dd-QAPI-events-to-report-connection-.patch |  133 -
 ...90-ccw-Abort-IPL-on-invalid-loadparm.patch |   71 -
 ...90-ccw-Clarify-alignment-is-in-bytes.patch |   60 -
 ...ios-s390-ccw-Don-t-generate-TEXTRELs.patch |   83 -
 ...-Enable-failed-IPL-to-return-after-e.patch |  426 ---
 ...-Fix-boot-problem-with-virtio-net-de.patch |  159 -
 ...ios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch |   63 -
 ...-Link-the-netboot-code-into-the-main.patch |  263 --
 ...-Merge-netboot.mak-into-the-main-Mak.patch |  141 -
 ...-Re-initialize-receive-queue-index-b.patch |   45 -
 ...ccw-Remove-panics-from-DASD-IPL-path.patch |  177 --
 ...ccw-Remove-panics-from-ECKD-IPL-path.patch |  475 ---
 ...-ccw-Remove-panics-from-ISO-IPL-path.patch |  269 --
 ...-Remove-panics-from-Netboot-IPL-path.patch |  130 -
 ...ccw-Remove-panics-from-SCSI-IPL-path.patch |  554 ----
 ...-Use-the-libc-from-SLOF-and-remove-s.patch | 1208 --------
 ...-netmain-Fix-error-messages-with-reg.patch |   72 -
 ...-virtio-Add-a-function-to-reset-a-vi.patch |   70 -
 ...-s390x-Enable-multi-device-boot-loop.patch |  227 --
 ...itialize-cdrom-type-to-false-for-eac.patch |   43 -
 ...itialize-machine-loadparm-before-pro.patch |   55 -
 kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch  |   75 -
 ...ci-Use-PCI-PM-capability-initializer.patch |  153 -
 ...-link-status-bits-for-downstream-por.patch |   76 -
 kvm-pcie-virtio-Remove-redundant-pm_cap.patch |   99 -
 ...coordinated-discarding-of-RAM-with-g.patch |  129 -
 ...physmem-replace-assertion-with-error.patch |   72 -
 ..._pci_devfn-to-visit-option-only-once.patch |  128 -
 ...tor-avoid-QemuOpts-in-QMP-device_add.patch |  131 -
 ...-freeze-hook-script-logic-of-logging.patch |   80 -
 ...d-log-to-guest-fsfreeze-thaw-command.patch |   54 -
 ...a-implement-a-guest-get-load-command.patch |  139 -
 kvm-qga-skip-bind-mounts-in-fs-list.patch     |   94 -
 ...ctivate-disks-if-migration-completed.patch |   73 -
 ...se-order-of-instance_post_init-calls.patch |   79 -
 ...utes-Introduce-RamBlockAttributes-to.patch |  613 ----
 ...drv_get_specific_info-implementation.patch |  273 --
 kvm-redhat-Enable-virtio-mem-on-s390x.patch   |   36 -
 kvm-redhat-enable-CONFIG_TDX.patch            |   33 -
 ...86-add-CPUID-and-MSR-bits-from-Clear.patch |   99 -
 kvm-reset-Add-RESET_TYPE_WAKEUP.patch         |   94 -
 ...ype-for-qemu_devices_reset-and-Machi.patch |  360 ---
 kvm-rocker-do-not-pollute-the-namespace.patch |  241 --
 ...dual-loadparm-assignment-to-CCW-devi.patch |  362 ---
 ...90x-Fix-leak-in-machine_set_loadparm.patch |   60 -
 ...LB-for-SCSI-device-directly-from-DIA.patch |  264 --
 ...-cpumodel-Add-PLO-extension-facility.patch |  221 --
 ...dd-Sequential-Instruction-Fetching-f.patch |   43 -
 ...dd-ptff-Query-Time-Stamp-Event-QTSE-.patch |   90 -
 ...dd-Concurrent-functions-facility-sup.patch |  169 --
 ...dd-Ineffective-nonconstrained-transa.patch |   56 -
 ...dd-Miscellaneous-Instruction-Extensi.patch |   42 -
 ...l-add-Vector-Enhancements-facility-3.patch |   56 -
 ...dd-Vector-Packed-Decimal-Enhancement.patch |   56 -
 ...390x-cpumodel-add-msa10-subfunctions.patch |  133 -
 ...390x-cpumodel-add-msa11-subfunctions.patch |  148 -
 kvm-s390x-cpumodel-add-msa12-changes.patch    |   88 -
 ...390x-cpumodel-add-msa13-subfunctions.patch |  200 --
 ...cpumodel-correct-PLO-feature-wording.patch |   69 -
 kvm-s390x-cpumodel-gen17-model.patch          |  107 -
 ...390x-introduce-s390_get_memory_limit.patch |  144 -
 ...pport-for-guests-that-request-direct.patch |  256 --
 ...te-QEMU-supports-relaxed-translation.patch |   72 -
 kvm-s390x-pv-prepare-for-memory-devices.patch |   46 -
 ...s390x-remember-the-maximum-page-size.patch |  107 -
 ...-s390-virtio-hcall-to-s390-hypercall.patch |  113 -
 ...call-introduce-DIAG500-STORAGE_LIMIT.patch |   99 -
 ...390-skeys-prepare-for-memory-devices.patch |   56 -
 ...rib-kvm-prepare-for-memory-devices-a.patch |  155 -
 ...o-ccw-don-t-crash-on-weird-RAM-sizes.patch |   63 -
 ...o-ccw-move-setting-the-maximum-guest.patch |  140 -
 ...irtio-ccw-prepare-for-memory-devices.patch |  117 -
 ...o-hcall-prepare-for-more-diag500-hyp.patch |  163 --
 ...o-hcall-remove-hypercall-registratio.patch |  296 --
 ...-add-support-for-virtio-based-memory.patch |  423 ---
 kvm-s390x-virtio-mem-support.patch            |  459 ---
 ...error-from-qemu-trace-stap-on-missin.patch |   90 -
 ...si-fix-allocation-for-s390x-loadparm.patch |   48 -
 ...AVX512-state-when-AVX10-is-supported.patch |   56 -
 ...arget-i386-Add-PerfMonV2-feature-bit.patch |  105 -
 ...couple-of-feature-bits-in-CPUID_Fn80.patch |   83 -
 ...6-Add-feature-dependencies-for-AVX10.patch |   89 -
 ...386-Add-support-for-EPYC-Turin-model.patch |  200 --
 ...ble-fdp-excptn-only-and-zero-fcs-fds.patch |   75 -
 ...xclude-hv-syndbg-from-hv-passthrough.patch |  102 -
 ...se-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch |   70 -
 ...se-bits-related-to-SRSO-vulnerabilit.patch |   84 -
 ...conditional-CONFIG_SYNDBG-enablement.patch |  108 -
 ...386-Introduce-GraniteRapids-v2-model.patch |   59 -
 ...-invtsc-migratable-when-user-sets-ts.patch |   73 -
 ...-sure-SynIC-state-is-really-updated-.patch |   64 -
 ...t-CPUID-subleaf-info-for-unsupported.patch |   47 -
 ...ve-AccelCPUClass-cpu_class_init-need.patch |  122 -
 ...te-EPYC-CPU-model-for-Cache-property.patch |  147 -
 ...te-EPYC-Genoa-for-Cache-property-per.patch |  167 --
 ...te-EPYC-Milan-CPU-model-for-Cache-pr.patch |  146 -
 ...te-EPYC-Rome-CPU-model-for-Cache-pro.patch |  147 -
 ...AVX10-feature-and-AVX10-version-prop.patch |  224 --
 ...i386-add-CPUID.24-features-for-AVX10.patch |   91 -
 ...i386-add-sha512-sm3-sm4-feature-bits.patch |   43 -
 ...w-reordering-max_x86_cpu_initfn-vs-a.patch |   84 -
 ...set-correct-supported-XCR0-features-.patch |   50 -
 ...ot-rely-on-ExtSaveArea-for-accelerat.patch |  117 -
 ...Report-which-action-failed-in-kvm_ar.patch |  176 --
 ...e-host_cpu_instance_init-and-host_cp.patch |  103 -
 ...-accel_cpu_instance_init-to-.instanc.patch |   68 -
 ...rget-i386-move-max_features-to-class.patch |  145 -
 ...-whpx-add-accel-CPU-class-that-sets-.patch |  164 --
 ...rn-bool-from-x86_cpu_filter_features.patch |   83 -
 ...-Reduce-system-specific-declarations.patch |   99 -
 ...-fix-locking-for-interrupt-injection.patch |   62 -
 ...-Convert-CPU-to-Resettable-interface.patch |  284 --
 ...est-mirror-sparse-for-recent-patches.patch |  545 ----
 ...tplug_blk-Fix-addr-in-device_add-com.patch |   51 -
 ...s390x-boot-order-tests-to-cdrom-test.patch |   74 -
 ...tests-qtest-disable-most-pauth-tests.patch |   48 -
 ...util-sockets-fix-mem-leak-on-error-o.patch |   53 -
 ...splay-update-interval-when-VM-state-.patch |   97 -
 ...ate-Linux-headers-to-KVM-tree-master.patch |   62 -
 kvm-update-Linux-headers-to-v6.16-rc3.patch   |  497 ----
 ...s-Add-support-for-keep-alive-flag-to.patch |   86 -
 ...s-Introduce-inet-socket-options-cont.patch |  314 --
 ...s-Refactor-inet_parse-to-use-QemuOpt.patch |  461 ---
 ...s-Refactor-setting-client-sockopts-i.patch |   83 -
 ...s-Refactor-success-and-failure-paths.patch |  141 -
 ...ner-Fix-container-object-destruction.patch |   61 -
 kvm-vfio-helpers-Align-mmaps.patch            |  100 -
 ...actor-vfio_region_mmap-error-handlin.patch |   93 -
 ...hange-trace-formats-from-hex-to-deci.patch |   70 -
 ...eport-only-stop-copy-size-in-vfio_st.patch |   66 -
 kvm-vfio-pci-Delete-local-pm_cap.patch        |   81 -
 ...for-the-migration-state-transfer-int.patch |   87 -
 ...l-device-start-if-iotlb-update-fails.patch |   62 -
 ...-kconfig-memory-devices-are-PCI-only.patch |   87 -
 ...upport-for-suspend-wake-up-with-plug.patch |   79 -
 ...ew-Resettable-framework-instead-of-L.patch |  141 -
 ...-warn-about-THP-sizes-on-a-kernel-wi.patch |   59 -
 ...g-memory-only-during-system-resets-n.patch |  258 --
 ...o-net-Add-queues-before-loading-them.patch |   94 -
 ...tio-net-disable-USO-for-virt-rhel9.6.patch |  135 -
 ...st-user-Implement-internal-migration.patch |  161 --
 ...evice_add-in-qemu_create_cli_devices.patch |   65 -
 ...c-fix-crash-when-no-console-attached.patch |   61 -
 qemu-kvm.spec                                 |  459 +--
 sources                                       |    2 +-
 403 files changed, 1741 insertions(+), 52644 deletions(-)
 rename 0004-Initial-redhat-build.patch => 0001-Initial-redhat-build.patch (90%)
 rename 0005-Enable-disable-devices-for-RHEL.patch => 0002-Enable-disable-devices-for-RHEL.patch (74%)
 rename 0006-Machine-type-related-general-changes.patch => 0003-Machine-type-related-general-changes.patch (86%)
 rename 0007-meson-temporarily-disable-Wunused-function.patch => 0004-meson-temporarily-disable-Wunused-function.patch (80%)
 rename 0008-Remove-upstream-machine-type-versions-for-aarch64-s3.patch => 0005-Remove-upstream-machine-type-versions-for-aarch64-s3.patch (60%)
 rename 0009-Adapt-versioned-machine-type-macros-for-RHEL.patch => 0006-Adapt-versioned-machine-type-macros-for-RHEL.patch (73%)
 rename 0010-Increase-deletion-schedule-to-3-releases.patch => 0007-Increase-deletion-schedule-to-3-releases.patch (71%)
 rename 0011-Add-downstream-aarch64-versioned-virt-machine-types.patch => 0008-Add-downstream-aarch64-versioned-virt-machine-types.patch (62%)
 rename 0012-Add-downstream-ppc64-versioned-spapr-machine-types.patch => 0009-Add-downstream-ppc64-versioned-spapr-machine-types.patch (89%)
 rename 0013-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch => 0010-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch (84%)
 rename 0014-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch => 0011-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch (82%)
 rename 0015-Revert-meson-temporarily-disable-Wunused-function.patch => 0012-Revert-meson-temporarily-disable-Wunused-function.patch (76%)
 rename 0016-Enable-make-check.patch => 0013-Enable-make-check.patch (53%)
 rename 0017-vfio-cap-number-of-devices-that-can-be-assigned.patch => 0014-vfio-cap-number-of-devices-that-can-be-assigned.patch (64%)
 rename 0018-Add-support-statement-to-help-output.patch => 0015-Add-support-statement-to-help-output.patch (85%)
 rename 0019-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch => 0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch (90%)
 rename 0020-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch => 0017-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch (90%)
 rename kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch => 0018-redhat-allow-5-level-paging-for-TDX-VMs.patch (80%)
 create mode 100644 0019-Add-upstream-compat-bits.patch
 create mode 100644 0020-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
 create mode 100644 0021-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
 delete mode 100644 0021-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
 create mode 100644 0022-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
 delete mode 100644 0023-Add-upstream-compatibility-bits.patch
 create mode 100644 0023-redhat-Fix-rhel7.6.0-machine-type.patch
 delete mode 100644 0024-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
 create mode 100644 0024-redhat-Compatibility-handling-for-the-s390-ccw-virti.patch
 create mode 100644 0025-redhat-Add-new-s390-ccw-virtio-rhel9.8.0-machine-typ.patch
 delete mode 100644 0025-redhat-Add-rhel9.6.0-machine-type.patch
 create mode 100644 0026-hw-core-machine-rhel-machine-types-compat-fix.patch
 delete mode 100644 0026-x86-ensure-compatibility-of-pc-q35-rhel9-and-pc-i440.patch
 delete mode 100644 0027-arm-ensure-compatibility-of-virt-rhel9.patch
 create mode 100644 0027-arm-rhel-machine-type-compat-fix.patch
 delete mode 100644 0028-arm-create-new-virt-machine-type-for-rhel-9.6.patch
 create mode 100644 0028-target-i386-add-compatibility-property-for-arch_capa.patch
 create mode 100644 0029-target-i386-add-compatibility-property-for-pdcm-feat.patch
 delete mode 100644 0029-x86-create-new-pc-q35-machine-type-for-rhel-9.6.patch
 create mode 100644 0030-arm-create-new-virt-machine-type-for-rhel-9.8.patch
 delete mode 100644 0030-hw-arm-virt-Fix-Manufacturer-and-Product-Name-in-emu.patch
 delete mode 100644 kvm-Enable-amd-iommu-device.patch
 delete mode 100644 kvm-KVM-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch
 delete mode 100644 kvm-KVM-Dynamic-sized-kvm-memslots-array.patch
 delete mode 100644 kvm-KVM-Rename-KVMMemoryListener.nr_used_slots-to-nr_slo.patch
 delete mode 100644 kvm-KVM-Rename-KVMState-nr_slots-to-nr_slots_max.patch
 delete mode 100644 kvm-accel-kvm-refactor-dirty-ring-setup.patch
 delete mode 100644 kvm-amd_iommu-Add-support-for-pass-though-mode.patch
 delete mode 100644 kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch
 delete mode 100644 kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch
 delete mode 100644 kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch
 delete mode 100644 kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch
 delete mode 100644 kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch
 delete mode 100644 kvm-arm-disable-pauth-for-virt-rhel9.patch
 delete mode 100644 kvm-block-Add-active-field-to-BlockDeviceInfo.patch
 delete mode 100644 kvm-block-Add-blockdev-set-active-QMP-command.patch
 delete mode 100644 kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch
 delete mode 100644 kvm-block-Add-option-to-create-inactive-nodes.patch
 delete mode 100644 kvm-block-Allow-inactivating-already-inactive-nodes.patch
 delete mode 100644 kvm-block-Don-t-attach-inactive-child-to-active-node.patch
 delete mode 100644 kvm-block-Drain-nodes-before-inactivating-them.patch
 delete mode 100644 kvm-block-Expand-block-status-mode-from-bool-to-flags.patch
 delete mode 100644 kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch
 delete mode 100644 kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch
 delete mode 100644 kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch
 delete mode 100644 kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch
 delete mode 100644 kvm-block-export-Add-option-to-allow-export-of-inactive-.patch
 delete mode 100644 kvm-block-export-Don-t-ignore-image-activation-error-in-.patch
 delete mode 100644 kvm-block-io-skip-head-tail-requests-on-EINVAL.patch
 delete mode 100644 kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch
 delete mode 100644 kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch
 delete mode 100644 kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch
 delete mode 100644 kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch
 delete mode 100644 kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch
 delete mode 100644 kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch
 delete mode 100644 kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch
 delete mode 100644 kvm-docs-Add-TDX-documentation.patch
 delete mode 100644 kvm-docs-devel-reset-Document-reset-expectations-for-DMA.patch
 delete mode 100644 kvm-docs-system-Update-documentation-for-s390x-IPL.patch
 delete mode 100644 kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch
 delete mode 100644 kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch
 delete mode 100644 kvm-docs-system-s390x-bootdevices-Update-the-documentati.patch
 delete mode 100644 kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch
 delete mode 100644 kvm-file-posix-Fix-crash-on-discard_granularity-0.patch
 delete mode 100644 kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch
 delete mode 100644 kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch
 delete mode 100644 kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch
 delete mode 100644 kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch
 delete mode 100644 kvm-hostmem-Apply-merge-property-after-the-memory-region.patch
 delete mode 100644 kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch
 delete mode 100644 kvm-hw-arm-smmuv3-Move-reset-to-exit-phase.patch
 delete mode 100644 kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch
 delete mode 100644 kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch
 delete mode 100644 kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch
 delete mode 100644 kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch
 delete mode 100644 kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch
 delete mode 100644 kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch
 delete mode 100644 kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
 delete mode 100644 kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch
 delete mode 100644 kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch
 delete mode 100644 kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch
 delete mode 100644 kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch
 delete mode 100644 kvm-hw-i386-Fix-machine-type-compatibility.patch
 delete mode 100644 kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch
 delete mode 100644 kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch
 delete mode 100644 kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch
 delete mode 100644 kvm-hw-i386-intel-iommu-Migrate-to-3-phase-reset.patch
 delete mode 100644 kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch
 delete mode 100644 kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch
 delete mode 100644 kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch
 delete mode 100644 kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-hw-pci-Basic-support-for-PCI-power-management.patch
 delete mode 100644 kvm-hw-pci-Rename-has_power-to-enabled.patch
 delete mode 100644 kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch
 delete mode 100644 kvm-hw-s390-ccw-device-Convert-to-three-phase-reset.patch
 delete mode 100644 kvm-hw-s390-virtio-ccw-Convert-to-three-phase-reset.patch
 delete mode 100644 kvm-hw-s390x-Build-an-IPLB-for-each-boot-device.patch
 delete mode 100644 kvm-hw-s390x-Remove-the-possibility-to-load-the-s390-net.patch
 delete mode 100644 kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch
 delete mode 100644 kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch
 delete mode 100644 kvm-hw-s390x-ipl-Provide-more-memory-to-the-s390-ccw.img.patch
 delete mode 100644 kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch
 delete mode 100644 kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch
 delete mode 100644 kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch
 delete mode 100644 kvm-hw-vfio-common-Add-a-trace-point-in-vfio_reset_handl.patch
 delete mode 100644 kvm-hw-vfio-pci-Re-order-pre-reset.patch
 delete mode 100644 kvm-hw-virtio-Also-include-md-stubs-in-case-CONFIG_VIRTI.patch
 delete mode 100644 kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
 delete mode 100644 kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch
 delete mode 100644 kvm-hw-virtio-virtio-iommu-Migrate-to-3-phase-reset.patch
 delete mode 100644 kvm-i386-Introduce-tdx-guest-object.patch
 delete mode 100644 kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch
 delete mode 100644 kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch
 delete mode 100644 kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch
 delete mode 100644 kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch
 delete mode 100644 kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch
 delete mode 100644 kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch
 delete mode 100644 kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch
 delete mode 100644 kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch
 delete mode 100644 kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch
 delete mode 100644 kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch
 delete mode 100644 kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch
 delete mode 100644 kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch
 delete mode 100644 kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch
 delete mode 100644 kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch
 delete mode 100644 kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch
 delete mode 100644 kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch
 delete mode 100644 kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch
 delete mode 100644 kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch
 delete mode 100644 kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch
 delete mode 100644 kvm-i386-tdvf-Fix-build-on-32-bit-host.patch
 delete mode 100644 kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch
 delete mode 100644 kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch
 delete mode 100644 kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch
 delete mode 100644 kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch
 delete mode 100644 kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch
 delete mode 100644 kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch
 delete mode 100644 kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch
 delete mode 100644 kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch
 delete mode 100644 kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch
 delete mode 100644 kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch
 delete mode 100644 kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch
 delete mode 100644 kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch
 delete mode 100644 kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch
 delete mode 100644 kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch
 delete mode 100644 kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch
 delete mode 100644 kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch
 delete mode 100644 kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch
 delete mode 100644 kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch
 delete mode 100644 kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch
 delete mode 100644 kvm-i386-tdx-Finalize-TDX-VM.patch
 delete mode 100644 kvm-i386-tdx-Fix-build-on-32-bit-host.patch
 delete mode 100644 kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch
 delete mode 100644 kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch
 delete mode 100644 kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch
 delete mode 100644 kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch
 delete mode 100644 kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch
 delete mode 100644 kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch
 delete mode 100644 kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch
 delete mode 100644 kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch
 delete mode 100644 kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch
 delete mode 100644 kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch
 delete mode 100644 kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch
 delete mode 100644 kvm-i386-tdx-Make-invtsc-default-on.patch
 delete mode 100644 kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch
 delete mode 100644 kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch
 delete mode 100644 kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch
 delete mode 100644 kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch
 delete mode 100644 kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch
 delete mode 100644 kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch
 delete mode 100644 kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch
 delete mode 100644 kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch
 delete mode 100644 kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch
 delete mode 100644 kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch
 delete mode 100644 kvm-i386-tdx-Setup-the-TD-HOB-list.patch
 delete mode 100644 kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch
 delete mode 100644 kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch
 delete mode 100644 kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch
 delete mode 100644 kvm-i386-tdx-Validate-TD-attributes.patch
 delete mode 100644 kvm-i386-tdx-Validate-phys_bits-against-host-value.patch
 delete mode 100644 kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch
 delete mode 100644 kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch
 delete mode 100644 kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch
 delete mode 100644 kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch
 delete mode 100644 kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch
 delete mode 100644 kvm-i386-tdx-implement-tdx_cpu_instance_init.patch
 delete mode 100644 kvm-i386-tdx-load-TDVF-for-TD-guest.patch
 delete mode 100644 kvm-i386-topology-Introduce-helpers-for-various-topology.patch
 delete mode 100644 kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch
 delete mode 100644 kvm-include-hw-s390x-Add-include-files-for-common-IPL-st.patch
 delete mode 100644 kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch
 delete mode 100644 kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch
 delete mode 100644 kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch
 delete mode 100644 kvm-iotests-Add-filter_qtest.patch
 delete mode 100644 kvm-iotests-Add-qsd-migrate-case.patch
 delete mode 100644 kvm-iotests-Improve-iotest-194-to-mirror-data.patch
 delete mode 100644 kvm-iotests-common.rc-add-disk_usage-function.patch
 delete mode 100644 kvm-kvm-Allow-kvm_arch_get-put_registers-to-accept-Error.patch
 delete mode 100644 kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch
 delete mode 100644 kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch
 delete mode 100644 kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch
 delete mode 100644 kvm-kvm-refactor-core-virtual-machine-creation-into-its-.patch
 delete mode 100644 kvm-kvm-remove-unnecessary-ifdef.patch
 delete mode 100644 kvm-kvm-replace-fprintf-with-error_report-printf-in-kvm_.patch
 delete mode 100644 kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
 delete mode 100644 kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
 delete mode 100644 kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch
 delete mode 100644 kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch
 delete mode 100644 kvm-linux-headers-update-from-6.15-kvm-next.patch
 delete mode 100644 kvm-memory-Change-memory_region_set_ram_discard_manager-.patch
 delete mode 100644 kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch
 delete mode 100644 kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch
 delete mode 100644 kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch
 delete mode 100644 kvm-migration-Add-helper-to-get-target-runstate.patch
 delete mode 100644 kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch
 delete mode 100644 kvm-migration-Ensure-vmstate_save-sets-errp.patch
 delete mode 100644 kvm-migration-Fix-UAF-for-incoming-migration-on-Migratio.patch
 delete mode 100644 kvm-migration-block-Apply-late-block-active-behavior-to-.patch
 delete mode 100644 kvm-migration-block-Fix-possible-race-with-block_inactiv.patch
 delete mode 100644 kvm-migration-block-Make-late-block-active-the-default.patch
 delete mode 100644 kvm-migration-block-Rewrite-disk-activation.patch
 delete mode 100644 kvm-migration-block-active-Remove-global-active-flag.patch
 delete mode 100644 kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch
 delete mode 100644 kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch
 delete mode 100644 kvm-mirror-Drop-redundant-zero_target-parameter.patch
 delete mode 100644 kvm-mirror-Minor-refactoring.patch
 delete mode 100644 kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch
 delete mode 100644 kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch
 delete mode 100644 kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch
 delete mode 100644 kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch
 delete mode 100644 kvm-nbd-server-Silence-server-warnings-on-port-probes.patch
 delete mode 100644 kvm-nbd-server-Support-inactive-nodes.patch
 delete mode 100644 kvm-net-Fix-announce_self.patch
 delete mode 100644 kvm-net-socket-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-net-stream-skip-automatic-zero-init-of-large-array.patch
 delete mode 100644 kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Clarify-alignment-is-in-bytes.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Don-t-generate-TEXTRELs.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Enable-failed-IPL-to-return-after-e.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Link-the-netboot-code-into-the-main.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Merge-netboot.mak-into-the-main-Mak.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Remove-panics-from-DASD-IPL-path.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Remove-panics-from-ECKD-IPL-path.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Remove-panics-from-ISO-IPL-path.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Remove-panics-from-Netboot-IPL-path.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Remove-panics-from-SCSI-IPL-path.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-Use-the-libc-from-SLOF-and-remove-s.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
 delete mode 100644 kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
 delete mode 100644 kvm-pc-bios-s390x-Enable-multi-device-boot-loop.patch
 delete mode 100644 kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch
 delete mode 100644 kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch
 delete mode 100644 kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
 delete mode 100644 kvm-pci-Use-PCI-PM-capability-initializer.patch
 delete mode 100644 kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
 delete mode 100644 kvm-pcie-virtio-Remove-redundant-pm_cap.patch
 delete mode 100644 kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch
 delete mode 100644 kvm-physmem-replace-assertion-with-error.patch
 delete mode 100644 kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
 delete mode 100644 kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
 delete mode 100644 kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
 delete mode 100644 kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
 delete mode 100644 kvm-qga-implement-a-guest-get-load-command.patch
 delete mode 100644 kvm-qga-skip-bind-mounts-in-fs-list.patch
 delete mode 100644 kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch
 delete mode 100644 kvm-qom-reverse-order-of-instance_post_init-calls.patch
 delete mode 100644 kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch
 delete mode 100644 kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch
 delete mode 100644 kvm-redhat-Enable-virtio-mem-on-s390x.patch
 delete mode 100644 kvm-redhat-enable-CONFIG_TDX.patch
 delete mode 100644 kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch
 delete mode 100644 kvm-reset-Add-RESET_TYPE_WAKEUP.patch
 delete mode 100644 kvm-reset-Use-ResetType-for-qemu_devices_reset-and-Machi.patch
 delete mode 100644 kvm-rocker-do-not-pollute-the-namespace.patch
 delete mode 100644 kvm-s390x-Add-individual-loadparm-assignment-to-CCW-devi.patch
 delete mode 100644 kvm-s390x-Fix-leak-in-machine_set_loadparm.patch
 delete mode 100644 kvm-s390x-Rebuild-IPLB-for-SCSI-device-directly-from-DIA.patch
 delete mode 100644 kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
 delete mode 100644 kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
 delete mode 100644 kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
 delete mode 100644 kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
 delete mode 100644 kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
 delete mode 100644 kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
 delete mode 100644 kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
 delete mode 100644 kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
 delete mode 100644 kvm-s390x-cpumodel-add-msa10-subfunctions.patch
 delete mode 100644 kvm-s390x-cpumodel-add-msa11-subfunctions.patch
 delete mode 100644 kvm-s390x-cpumodel-add-msa12-changes.patch
 delete mode 100644 kvm-s390x-cpumodel-add-msa13-subfunctions.patch
 delete mode 100644 kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
 delete mode 100644 kvm-s390x-cpumodel-gen17-model.patch
 delete mode 100644 kvm-s390x-introduce-s390_get_memory_limit.patch
 delete mode 100644 kvm-s390x-pci-add-support-for-guests-that-request-direct.patch
 delete mode 100644 kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch
 delete mode 100644 kvm-s390x-pv-prepare-for-memory-devices.patch
 delete mode 100644 kvm-s390x-remember-the-maximum-page-size.patch
 delete mode 100644 kvm-s390x-rename-s390-virtio-hcall-to-s390-hypercall.patch
 delete mode 100644 kvm-s390x-s390-hypercall-introduce-DIAG500-STORAGE_LIMIT.patch
 delete mode 100644 kvm-s390x-s390-skeys-prepare-for-memory-devices.patch
 delete mode 100644 kvm-s390x-s390-stattrib-kvm-prepare-for-memory-devices-a.patch
 delete mode 100644 kvm-s390x-s390-virtio-ccw-don-t-crash-on-weird-RAM-sizes.patch
 delete mode 100644 kvm-s390x-s390-virtio-ccw-move-setting-the-maximum-guest.patch
 delete mode 100644 kvm-s390x-s390-virtio-ccw-prepare-for-memory-devices.patch
 delete mode 100644 kvm-s390x-s390-virtio-hcall-prepare-for-more-diag500-hyp.patch
 delete mode 100644 kvm-s390x-s390-virtio-hcall-remove-hypercall-registratio.patch
 delete mode 100644 kvm-s390x-virtio-ccw-add-support-for-virtio-based-memory.patch
 delete mode 100644 kvm-s390x-virtio-mem-support.patch
 delete mode 100644 kvm-scripts-improve-error-from-qemu-trace-stap-on-missin.patch
 delete mode 100644 kvm-scsi-fix-allocation-for-s390x-loadparm.patch
 delete mode 100644 kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch
 delete mode 100644 kvm-target-i386-Add-PerfMonV2-feature-bit.patch
 delete mode 100644 kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch
 delete mode 100644 kvm-target-i386-Add-feature-dependencies-for-AVX10.patch
 delete mode 100644 kvm-target-i386-Add-support-for-EPYC-Turin-model.patch
 delete mode 100644 kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch
 delete mode 100644 kvm-target-i386-Exclude-hv-syndbg-from-hv-passthrough.patch
 delete mode 100644 kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch
 delete mode 100644 kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch
 delete mode 100644 kvm-target-i386-Fix-conditional-CONFIG_SYNDBG-enablement.patch
 delete mode 100644 kvm-target-i386-Introduce-GraniteRapids-v2-model.patch
 delete mode 100644 kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch
 delete mode 100644 kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
 delete mode 100644 kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch
 delete mode 100644 kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch
 delete mode 100644 kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch
 delete mode 100644 kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch
 delete mode 100644 kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch
 delete mode 100644 kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch
 delete mode 100644 kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch
 delete mode 100644 kvm-target-i386-add-CPUID.24-features-for-AVX10.patch
 delete mode 100644 kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch
 delete mode 100644 kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch
 delete mode 100644 kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch
 delete mode 100644 kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch
 delete mode 100644 kvm-target-i386-kvm-Report-which-action-failed-in-kvm_ar.patch
 delete mode 100644 kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch
 delete mode 100644 kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch
 delete mode 100644 kvm-target-i386-move-max_features-to-class.patch
 delete mode 100644 kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch
 delete mode 100644 kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch
 delete mode 100644 kvm-target-i386-sev-Reduce-system-specific-declarations.patch
 delete mode 100644 kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch
 delete mode 100644 kvm-target-s390-Convert-CPU-to-Resettable-interface.patch
 delete mode 100644 kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch
 delete mode 100644 kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
 delete mode 100644 kvm-tests-qtest-Add-s390x-boot-order-tests-to-cdrom-test.patch
 delete mode 100644 kvm-tests-qtest-disable-most-pauth-tests.patch
 delete mode 100644 kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch
 delete mode 100644 kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch
 delete mode 100644 kvm-update-Linux-headers-to-KVM-tree-master.patch
 delete mode 100644 kvm-update-Linux-headers-to-v6.16-rc3.patch
 delete mode 100644 kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch
 delete mode 100644 kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch
 delete mode 100644 kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch
 delete mode 100644 kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch
 delete mode 100644 kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch
 delete mode 100644 kvm-vfio-container-Fix-container-object-destruction.patch
 delete mode 100644 kvm-vfio-helpers-Align-mmaps.patch
 delete mode 100644 kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch
 delete mode 100644 kvm-vfio-migration-Change-trace-formats-from-hex-to-deci.patch
 delete mode 100644 kvm-vfio-migration-Report-only-stop-copy-size-in-vfio_st.patch
 delete mode 100644 kvm-vfio-pci-Delete-local-pm_cap.patch
 delete mode 100644 kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch
 delete mode 100644 kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
 delete mode 100644 kvm-virtio-kconfig-memory-devices-are-PCI-only.patch
 delete mode 100644 kvm-virtio-mem-Add-support-for-suspend-wake-up-with-plug.patch
 delete mode 100644 kvm-virtio-mem-Use-new-Resettable-framework-instead-of-L.patch
 delete mode 100644 kvm-virtio-mem-don-t-warn-about-THP-sizes-on-a-kernel-wi.patch
 delete mode 100644 kvm-virtio-mem-unplug-memory-only-during-system-resets-n.patch
 delete mode 100644 kvm-virtio-net-Add-queues-before-loading-them.patch
 delete mode 100644 kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch
 delete mode 100644 kvm-virtio-net-vhost-user-Implement-internal-migration.patch
 delete mode 100644 kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
 delete mode 100644 kvm-vnc-fix-crash-when-no-console-attached.patch

diff --git a/.gitignore b/.gitignore
index 2a426ee..2529480 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@
 /qemu-8.2.0.tar.xz
 /qemu-9.0.0.tar.xz
 /qemu-9.1.0.tar.xz
+/qemu-10.1.0.tar.xz
diff --git a/0004-Initial-redhat-build.patch b/0001-Initial-redhat-build.patch
similarity index 90%
rename from 0004-Initial-redhat-build.patch
rename to 0001-Initial-redhat-build.patch
index 6fae1c6..68aeee8 100644
--- a/0004-Initial-redhat-build.patch
+++ b/0001-Initial-redhat-build.patch
@@ -1,7 +1,7 @@
-From cbd36e2ba7f3e96ce441c7cfbf92017a7ba3bfe8 Mon Sep 17 00:00:00 2001
+From da33f839919c0a7b3bedc5d9986e4054b6533a73 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
-Subject: Initial redhat build
+Subject: [PATCH] Initial redhat build
 
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
@@ -208,28 +208,12 @@ Merged patches (9.0.0 rc0):
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- .distro/Makefile                        |  101 +
- .distro/Makefile.common                 |   42 +
- .distro/README.tests                    |   39 +
- .distro/modules-load.conf               |    4 +
- .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 5351 +++++++++++++++++++++++
- .distro/rpminspect.yaml                 |    6 +-
- .distro/scripts/extract_build_cmd.py    |   12 +
- .distro/scripts/frh.py                  |    4 +-
- .distro/scripts/process-patches.sh      |    6 +-
- .gitignore                              |    1 +
- README.systemtap                        |   43 +
- scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
- scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
- scripts/systemtap/script.d/qemu_kvm.stp |    1 +
- ui/vnc-auth-sasl.c                      |    2 +-
- 16 files changed, 5612 insertions(+), 7 deletions(-)
- create mode 100644 .distro/Makefile
- create mode 100644 .distro/Makefile.common
- create mode 100644 .distro/README.tests
- create mode 100644 .distro/modules-load.conf
- create mode 100644 .distro/qemu-kvm.spec.template
+ README.systemtap                        | 43 +++++++++++++++++++++++++
+ scripts/qemu-guest-agent/fsfreeze-hook  |  4 +--
+ scripts/systemtap/conf.d/qemu_kvm.conf  |  4 +++
+ scripts/systemtap/script.d/qemu_kvm.stp |  1 +
+ ui/vnc-auth-sasl.c                      |  2 +-
+ 5 files changed, 51 insertions(+), 3 deletions(-)
  create mode 100644 README.systemtap
  create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
  create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
@@ -284,14 +268,16 @@ index 0000000000..ad913fc990
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
-index 13aafd4845..e9b84ec028 100755
+index c1feb6f5ce..d5d8d4daf8 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
-@@ -8,7 +8,7 @@
+@@ -7,8 +7,8 @@
+ # "freeze" argument before the filesystem is frozen. And for fsfreeze-thaw
  # request, it is issued with "thaw" argument after filesystem is thawed.
  
- LOGFILE=/var/log/qga-fsfreeze-hook.log
+-LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
++LOGFILE=/var/log/qemu-ga/qga-fsfreeze-hook.log
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
  
  # Check whether file $1 is a backup or rpm-generated file and should be ignored
@@ -314,7 +300,7 @@ index 0000000000..c04abf9449
 @@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
-index 47fdae5b21..2a950caa2a 100644
+index 3f4cfc471d..09dafba18d 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
 @@ -42,7 +42,7 @@
@@ -326,6 +312,3 @@ index 47fdae5b21..2a950caa2a 100644
  
      if (saslErr != SASL_OK) {
          error_setg(errp, "Failed to initialize SASL auth: %s",
--- 
-2.39.3
-
diff --git a/0005-Enable-disable-devices-for-RHEL.patch b/0002-Enable-disable-devices-for-RHEL.patch
similarity index 74%
rename from 0005-Enable-disable-devices-for-RHEL.patch
rename to 0002-Enable-disable-devices-for-RHEL.patch
index 0fdb361..d059ca5 100644
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0002-Enable-disable-devices-for-RHEL.patch
@@ -1,104 +1,17 @@
-From f9c7b0f1176bc2a0ddd97de6e0fbc1055eab7b57 Mon Sep 17 00:00:00 2001
+From 8ac25eec353dc7b5458e9ad9832c0c909d54c808 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
-Subject: Enable/disable devices for RHEL
+Subject: [PATCH] Enable/disable devices for RHEL
 
 This commit adds all changes related to changes in supported devices.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase notes (6.1.0):
-- Added CONFIG_TPM (except s390x)
-- default-configs moved to configs
-- Use --with-device-<ARCH> configure option to use rhel configs
-
-Rebase notes (6.2.0):
-- Add CONFIG_ISA_FDC
-- Do not remove -no-hpet documentation
-
-Rebase notes (7.0.0):
-- Added CONFIG_ARM_GIC_TCG option for aarch64
-- Fixes necessary for layout change fixes
-- Renamed CONFIG_ARM_GIC_TCG to CONFIG_ARM_GICV3_TCG
-- Removed upstream devices
-
-Rebase notes (7.1.0):
-- Added CONFIG_VHOST_VSOCK and CONFIG_VHOST_USER_VSOCK configs
-- Added CONFIG_CXL and CONFIG_CXL_MEM_DEVICE for aarch64 and x86_64
-- Added CONFIG_VHOST_USER_FS option (all archs)
-
-Rebase notes (7.2.0):
-- Removed disabling a15mpcore.c as no longer needed
-
-Rebase notes (8.0.0):
-- Rename CONFIG_ACPI_X86_ICH to CONFIG_ACPI_ICH9
-- Inlude qemu/error-report.h in hw/display/cirrus_vga.c
-- Change virtiofsd dependency version
-
-Rebase notes (8.1.0):
-- Added CONFIG_PCIE_PCI_BRIDGE for x86_64
-- Disabling tcg cpus for aarch64
-- Disable CONFIG_ARM_V7M and remove related hack
-- Moved aarch64 tcg cpu disabling from arm machine type commit
-
-Rebase notes (8.2.0):
-- Disabled new a710 arm64 tcg cpu
-- No longer needed hack for removal of i2c-echo
-- Disable new neoverse-v2
-- Removed CONFIG_OPENGL from x86_64 config file
-
-Rebase notes (9.0.0 rc0):
-- Split CONFIG_IDE_QDEV to CONFIG_IDE_DEV and CONFIG_IDE_BUS (upstream change)
-
-Rebase notes (9.0.0 rc1):
-- Do not compile armv7 cpu types
-
-Rebase notes (9.1.0 rc0):
-- Return value added for kvm_s390_apply_cpu_model
-- Added new USB_HID and USB_HUB options
-
-Rebase notes (9.1.0 rc1):
-- Fix disabling cpus in valid_cpy_types
-
-Merged patches (6.1.0):
-- c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
-- 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
-- f2fe835153 aarch64-rh-devices: add CONFIG_PXB
-- b5431733ad disable CONFIG_USB_STORAGE_BOT
-- 478ba0cdf6 Disable TPM passthrough
-- 2504d68a7c aarch64: Add USB storage devices
-- 51c2a3253c disable ac97 audio
-
-Merged patches (6.2.0):
-- 9f2f9fa2ba disable sga device
-
-Merged patches (7.0.0):
-- fd7c45a5a8 redhat: Enable virtio-mem as tech-preview on x86-64
-- c9e68ea451 Enable SGX -- RH Only
-
-Merged patches (7.1.0):
-- 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/ich9.c chunk)
-- 8f663466c6 configs/devices/aarch64-softmmu: Enable CONFIG_VIRTIO_MEM
-- 1bf372717a Enable virtio-iommu-pci on aarch64
-- ae3f269458 Enable virtio-iommu-pci on x86_64
-
-Merged patches (8.1.0):
-- 8173d2eaba Disable unwanted new devices
-
-Merged patches (8.2.0):
-- b29f66431f Enable igb on x86_64
-
-Merged patches (9.0.0 rc0):
-- 3889ede5d9 Compile IOMMUFD on x86_64
-- 0beb18451f Compile IOMMUFD on s390x
-- 2b4b13f70d Compile IOMMUFD object on aarch64
 ---
- .distro/qemu-kvm.spec.template                |  18 +--
- .../aarch64-softmmu/aarch64-rh-devices.mak    |  44 +++++++
+ .../aarch64-softmmu/aarch64-rh-devices.mak    |  45 +++++++
  .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
  configs/devices/rh-virtio.mak                 |  10 ++
- .../s390x-softmmu/s390x-rh-devices.mak        |  19 +++
- .../x86_64-softmmu/x86_64-rh-devices.mak      | 114 ++++++++++++++++++
+ .../s390x-softmmu/s390x-rh-devices.mak        |  20 +++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 117 ++++++++++++++++++
  hw/arm/virt.c                                 |   4 +
  hw/block/fdc.c                                |  10 ++
  hw/cxl/meson.build                            |   3 +-
@@ -110,17 +23,17 @@ Merged patches (9.0.0 rc0):
  hw/usb/meson.build                            |   2 +-
  hw/virtio/meson.build                         |   6 +-
  target/arm/arm-qmp-cmds.c                     |   2 +
- target/arm/cpu.c                              |   4 +
- target/arm/cpu.h                              |   3 +
- target/arm/cpu64.c                            |  12 +-
+ target/arm/cpu.h                              |   2 +
+ target/arm/cpu64.c                            |   7 +-
  target/arm/tcg/cpu32.c                        |   2 +
  target/arm/tcg/cpu64.c                        |   8 ++
- target/arm/tcg/meson.build                    |   4 +-
+ target/arm/tcg/meson.build                    |   2 +-
+ target/i386/cpu.c                             |   4 +
  target/ppc/cpu-models.c                       |   9 ++
- target/s390x/cpu_models_sysemu.c              |   3 +
+ target/s390x/cpu_models_system.c              |   3 +
  target/s390x/kvm/kvm.c                        |   8 ++
  tests/qtest/arm-cpu-features.c                |   4 +
- 27 files changed, 325 insertions(+), 16 deletions(-)
+ 26 files changed, 313 insertions(+), 7 deletions(-)
  create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
  create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
  create mode 100644 configs/devices/rh-virtio.mak
@@ -129,20 +42,21 @@ Merged patches (9.0.0 rc0):
 
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..c7e4fdc25a
+index 0000000000..840f3a3674
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,44 @@
+@@ -0,0 +1,45 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
-+CONFIG_ARM_GICV3_TCG=y
++CONFIG_ARM_GICV3=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_EDID=y
++CONFIG_PCI_BRIDGE=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PCI_DEVICES=y
@@ -238,10 +152,10 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..24cf6dbd03
+index 0000000000..834281d872
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -0,0 +1,19 @@
+@@ -0,0 +1,20 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
@@ -256,6 +170,7 @@ index 0000000000..24cf6dbd03
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
++CONFIG_VIRTIO_MEM=y
 +CONFIG_WDT_DIAG288=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
@@ -263,10 +178,10 @@ index 0000000000..24cf6dbd03
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..3e5f693b62
+index 0000000000..8d3d9fc645
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,114 @@
+@@ -0,0 +1,117 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
@@ -329,6 +244,7 @@ index 0000000000..3e5f693b62
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
++CONFIG_PCI_BRIDGE=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
@@ -342,6 +258,7 @@ index 0000000000..3e5f693b62
 +CONFIG_SEV=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
++CONFIG_TDX=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
@@ -366,6 +283,7 @@ index 0000000000..3e5f693b62
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VIRTIO_IOMMU=y
++CONFIG_AMD_IOMMU=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
@@ -382,10 +300,10 @@ index 0000000000..3e5f693b62
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 687fe0bb8b..eea7d2d038 100644
+index ef6be3660f..b525e00365 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -3032,6 +3032,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3183,6 +3183,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
      MachineClass *mc = MACHINE_CLASS(oc);
      HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
      static const char * const valid_cpu_types[] = {
@@ -393,7 +311,7 @@ index 687fe0bb8b..eea7d2d038 100644
  #ifdef CONFIG_TCG
          ARM_CPU_TYPE_NAME("cortex-a7"),
          ARM_CPU_TYPE_NAME("cortex-a15"),
-@@ -3047,8 +3048,11 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3198,8 +3199,11 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
          ARM_CPU_TYPE_NAME("neoverse-n2"),
  #endif /* TARGET_AARCH64 */
  #endif /* CONFIG_TCG */
@@ -406,7 +324,7 @@ index 687fe0bb8b..eea7d2d038 100644
  #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
          ARM_CPU_TYPE_NAME("host"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index 6dd94e98bc..a05757fc9a 100644
+index d0f08c7be5..7f61684294 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
 @@ -49,6 +49,8 @@
@@ -418,7 +336,7 @@ index 6dd94e98bc..a05757fc9a 100644
  /********************************************************/
  /* debug Floppy devices */
  
-@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+@@ -2345,6 +2347,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
      FDrive *drive;
      static int command_tables_inited = 0;
  
@@ -448,17 +366,17 @@ index 3e375f61a9..613adb3ebb 100644
                 if_false: files(
                     'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 150883a971..497365bd80 100644
+index ef08694626..e2ae9f0c60 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
-@@ -36,6 +36,7 @@
- #include "qemu/module.h"
+@@ -37,6 +37,7 @@
  #include "qemu/units.h"
  #include "qemu/log.h"
+ #include "system/reset.h"
 +#include "qemu/error-report.h"
- #include "sysemu/reset.h"
  #include "qapi/error.h"
  #include "trace.h"
+ #include "hw/pci/pci_device.h"
 @@ -2946,6 +2947,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
@@ -470,10 +388,10 @@ index 150883a971..497365bd80 100644
       * Follow real hardware, cirrus card emulated has 4 MB video memory.
       * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
-index 80efc633d3..9cb82b8eea 100644
+index a0f2709c69..8c3962443b 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
-@@ -191,7 +191,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
+@@ -191,7 +191,8 @@ static void piix3_ide_class_init(ObjectClass *klass, const void *data)
      k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
      k->class_id = PCI_CLASS_STORAGE_IDE;
      set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
@@ -483,7 +401,7 @@ index 80efc633d3..9cb82b8eea 100644
  }
  
  static const TypeInfo piix3_ide_info = {
-@@ -215,6 +216,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
+@@ -215,6 +216,8 @@ static void piix4_ide_class_init(ObjectClass *klass, const void *data)
      k->class_id = PCI_CLASS_STORAGE_IDE;
      set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
      dc->hotpluggable = false;
@@ -493,10 +411,10 @@ index 80efc633d3..9cb82b8eea 100644
  
  static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index 74f10b640f..2e85ecf476 100644
+index 71f5f976e9..794078ed84 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -952,6 +952,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -950,6 +950,8 @@ static void i8042_class_initfn(ObjectClass *klass, const void *data)
      dc->vmsd = &vmstate_kbd_isa;
      adevc->build_dev_aml = i8042_build_aml;
      set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
@@ -506,10 +424,10 @@ index 74f10b640f..2e85ecf476 100644
  
  static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index 5012b96464..b435e54228 100644
+index a80a7b0cdb..7eb5a3b19d 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1732,6 +1732,7 @@ static const E1000Info e1000_devices[] = {
          .revision  = 0x03,
          .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
      },
@@ -517,7 +435,7 @@ index 5012b96464..b435e54228 100644
      {
          .name      = "e1000-82544gc",
          .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1758,6 +1759,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1744,6 +1745,7 @@ static const E1000Info e1000_devices[] = {
          .revision  = 0x03,
          .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
      },
@@ -526,10 +444,10 @@ index 5012b96464..b435e54228 100644
  
  static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 56090abcd1..0bf7c52077 100644
+index 4952f9bd2c..aaee248290 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -399,10 +399,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -401,10 +401,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
          .instance_size = sizeof(SpaprCpuCore),
          .class_size = sizeof(SpaprCpuCoreClass),
      },
@@ -543,10 +461,10 @@ index 56090abcd1..0bf7c52077 100644
      DEFINE_SPAPR_CPU_CORE_TYPE("power7p_v2.1"),
      DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index d7de1003e3..1cdc0a1ba0 100644
+index 17360a5b5a..3c4fdfc31d 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
-@@ -55,7 +55,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
+@@ -53,7 +53,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
  if cacard.found()
    usbsmartcard_ss = ss.source_set()
    usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
@@ -556,10 +474,10 @@ index d7de1003e3..1cdc0a1ba0 100644
  endif
  
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-index 621fc65454..c38bdd6fa4 100644
+index 3ea7b3cec8..3102d68bec 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
-@@ -20,7 +20,8 @@ if have_vhost
+@@ -22,7 +22,8 @@ if have_vhost
      system_virtio_ss.add(files('vhost-user-base.c'))
  
      # MMIO Stubs
@@ -569,7 +487,7 @@ index 621fc65454..c38bdd6fa4 100644
      system_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
      system_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
      system_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
-@@ -28,7 +29,8 @@ if have_vhost
+@@ -30,7 +31,8 @@ if have_vhost
      system_virtio_ss.add(when: 'CONFIG_VHOST_USER_INPUT', if_true: files('vhost-user-input.c'))
  
      # PCI Stubs
@@ -580,10 +498,10 @@ index 621fc65454..c38bdd6fa4 100644
                           if_true: files('vhost-user-gpio-pci.c'))
      system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_I2C'],
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
-index 3cc8cc738b..6f21fea1f5 100644
+index d292c974c4..9bb68866e1 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
-@@ -223,6 +223,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+@@ -225,6 +225,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
  static void arm_cpu_add_definition(gpointer data, gpointer user_data)
  {
      ObjectClass *oc = data;
@@ -591,7 +509,7 @@ index 3cc8cc738b..6f21fea1f5 100644
      CpuDefinitionInfoList **cpu_list = user_data;
      CpuDefinitionInfo *info;
      const char *typename;
-@@ -231,6 +232,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
+@@ -233,6 +234,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
      info = g_malloc0(sizeof(*info));
      info->name = cpu_model_from_type(typename);
      info->q_typename = g_strdup(typename);
@@ -599,47 +517,24 @@ index 3cc8cc738b..6f21fea1f5 100644
  
      QAPI_LIST_PREPEND(*cpu_list, info);
  }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index 19191c2391..465f423d25 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -2726,6 +2726,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
- 
-     acc->info = data;
-     cc->gdb_core_xml_file = "arm-core.xml";
-+
-+    if (acc->info->deprecation_note) {
-+        cc->deprecation_note = acc->info->deprecation_note;
-+    }
- }
- 
- void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index 9a3fd59562..1261eae94d 100644
+index dc9b6dce4c..dc0da8b0ae 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -35,6 +35,8 @@
- #define KVM_HAVE_MCE_INJECTION 1
- #endif
+@@ -34,6 +34,8 @@
+ #include "target/arm/gtimer.h"
+ #include "target/arm/cpu-sysregs.h"
  
 +#define RHEL_CPU_DEPRECATION "use 'host' / 'max'"
 +
  #define EXCP_UDEF            1   /* undefined instruction */
  #define EXCP_SWI             2   /* software interrupt */
  #define EXCP_PREFETCH_ABORT  3
-@@ -1110,6 +1112,7 @@ typedef struct ARMCPUInfo {
-     const char *name;
-     void (*initfn)(Object *obj);
-     void (*class_init)(ObjectClass *oc, void *data);
-+    const char *deprecation_note;
- } ARMCPUInfo;
- 
- /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index 262a1d6c0b..800514d3fc 100644
+index 26cf7e6dfa..051d5d653b 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
-@@ -653,6 +653,7 @@ static void aarch64_a57_initfn(Object *obj)
+@@ -698,6 +698,7 @@ static void aarch64_a57_initfn(Object *obj)
      define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
  
@@ -647,7 +542,7 @@ index 262a1d6c0b..800514d3fc 100644
  static void aarch64_a53_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
-@@ -710,6 +711,7 @@ static void aarch64_a53_initfn(Object *obj)
+@@ -759,6 +760,7 @@ static void aarch64_a53_initfn(Object *obj)
      cpu->gic_pribits = 5;
      define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
@@ -655,7 +550,7 @@ index 262a1d6c0b..800514d3fc 100644
  
  static void aarch64_host_initfn(Object *obj)
  {
-@@ -748,8 +750,11 @@ static void aarch64_max_initfn(Object *obj)
+@@ -797,8 +799,11 @@ static void aarch64_max_initfn(Object *obj)
  }
  
  static const ARMCPUInfo aarch64_cpus[] = {
@@ -668,39 +563,25 @@ index 262a1d6c0b..800514d3fc 100644
      { .name = "max",                .initfn = aarch64_max_initfn },
  #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
      { .name = "host",               .initfn = aarch64_host_initfn },
-@@ -820,8 +825,13 @@ static void aarch64_cpu_instance_init(Object *obj)
- static void cpu_register_class_init(ObjectClass *oc, void *data)
- {
-     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-+    CPUClass *cc = CPU_CLASS(oc);
- 
-     acc->info = data;
-+
-+    if (acc->info->deprecation_note) {
-+        cc->deprecation_note = acc->info->deprecation_note;
-+    }
- }
- 
- void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
-index 20c2737f17..7e66fb6f14 100644
+index a2a23eae0d..c362759d65 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
-@@ -120,6 +120,7 @@ void aa32_max_features(ARMCPU *cpu)
-     cpu->isar.id_dfr1 = t;
+@@ -115,6 +115,7 @@ void aa32_max_features(ARMCPU *cpu)
+     FIELD_DP32_IDREG(isar, ID_DFR1, HPMN0, 1);         /* FEAT_HPMN0 */
  }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
  
-@@ -1066,3 +1067,4 @@ static void arm_tcg_cpu_register_types(void)
+@@ -1084,3 +1085,4 @@ static void arm_tcg_cpu_register_types(void)
  type_init(arm_tcg_cpu_register_types)
  
  #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-index fe232eb306..2678047488 100644
+index 35cddbafa4..c7c464a0af 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
 @@ -29,6 +29,7 @@
@@ -708,10 +589,10 @@ index fe232eb306..2678047488 100644
  #include "cpregs.h"
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
-                               unsigned cachesize)
+ static void aarch64_a35_initfn(Object *obj)
  {
-@@ -135,6 +136,7 @@ static void aarch64_a35_initfn(Object *obj)
+     ARMCPU *cpu = ARM_CPU(obj);
+@@ -113,6 +114,7 @@ static void aarch64_a35_initfn(Object *obj)
      /* These values are the same with A53/A57/A72. */
      define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
@@ -719,15 +600,15 @@ index fe232eb306..2678047488 100644
  
  static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                     void *opaque, Error **errp)
-@@ -224,6 +226,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
- static Property arm_cpu_lpa2_property =
+@@ -199,6 +201,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+ static const Property arm_cpu_lpa2_property =
      DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void aarch64_a55_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
-@@ -1074,6 +1077,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
+@@ -1080,6 +1083,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
      aarch64_add_pauth_properties(obj);
      aarch64_add_sve_properties(obj);
  }
@@ -735,7 +616,7 @@ index fe232eb306..2678047488 100644
  
  /*
   * -cpu max: a CPU with as many features enabled as our emulation supports.
-@@ -1295,6 +1299,7 @@ void aarch64_max_tcg_initfn(Object *obj)
+@@ -1310,6 +1314,7 @@ void aarch64_max_tcg_initfn(Object *obj)
      qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
  }
  
@@ -743,7 +624,7 @@ index fe232eb306..2678047488 100644
  static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
      { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
-@@ -1306,14 +1311,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
+@@ -1321,14 +1326,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
      { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
  };
@@ -755,26 +636,63 @@ index fe232eb306..2678047488 100644
      size_t i;
  
      for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
-         aarch64_cpu_register(&aarch64_cpus[i]);
+         arm_cpu_register(&aarch64_cpus[i]);
      }
 +#endif
  }
  
  type_init(aarch64_cpu_register_types)
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
-index 508932a249..7a12d7bfba 100644
+index 895facdc30..f1a9e01c51 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
-@@ -58,5 +58,5 @@ arm_system_ss.add(files(
+@@ -53,7 +53,7 @@ arm_system_ss.add(files(
    'psci.c',
  ))
  
 -arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
--arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 +#arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
-+#arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
+ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
+ 
+ arm_common_ss.add(zlib)
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 6d85149e6e..ac1c06c3f9 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -3163,6 +3163,7 @@ static const CPUCaches xeon_srf_cache_info = {
+     },
+ };
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static const CPUCaches yongfeng_cache_info = {
+     .l1d_cache = &(CPUCacheInfo) {
+         /* CPUID 0x4.0x0.EAX */
+@@ -3261,6 +3262,7 @@ static const CPUCaches yongfeng_cache_info = {
+         .share_level = CPU_TOPOLOGY_LEVEL_DIE,
+     },
+ };
++#endif
+ 
+ /* The following VMX features are not supported by KVM and are left out in the
+  * CPU definitions:
+@@ -6420,6 +6422,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+             { /* end of list */ }
+         }
+     },
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     {
+         .name = "YongFeng",
+         .level = 0x1F,
+@@ -6565,6 +6568,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+             { /* end of list */ }
+         }
+     },
++#endif /* Disabled for RHEL */
+     {
+         .name = "EPYC-Turin",
+         .level = 0xd,
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index f2301b43f7..f77ebfcc81 100644
+index ea86ea202a..a545ff5f16 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
 @@ -66,6 +66,7 @@
@@ -804,7 +722,7 @@ index f2301b43f7..f77ebfcc81 100644
      POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                  "POWER7 v2.3")
      POWERPC_DEF("power7p_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
-@@ -894,13 +898,16 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -896,13 +900,16 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "7447a", "7447a_v1.2" },
      { "7457a", "7457a_v1.2" },
      { "apollo7pm", "7457a_v1.0" },
@@ -821,8 +739,8 @@ index f2301b43f7..f77ebfcc81 100644
      { "power7", "power7_v2.3" },
      { "power7+", "power7p_v2.1" },
      { "power7+_v2.1", "power7p_v2.1" },
-@@ -911,12 +918,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
-     { "power10", "power10_v2.0" },
+@@ -914,12 +921,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+     { "power11", "power11_v2.0" },
  #endif
  
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
@@ -836,10 +754,10 @@ index f2301b43f7..f77ebfcc81 100644
  
      { NULL, NULL }
  };
-diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index f6df691b66..72572726b8 100644
---- a/target/s390x/cpu_models_sysemu.c
-+++ b/target/s390x/cpu_models_sysemu.c
+diff --git a/target/s390x/cpu_models_system.c b/target/s390x/cpu_models_system.c
+index 5b84604867..7e06c75e6f 100644
+--- a/target/s390x/cpu_models_system.c
++++ b/target/s390x/cpu_models_system.c
 @@ -34,6 +34,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
          (max_model->def->gen == model->def->gen &&
           max_model->def->ec_ga < model->def->ec_ga)) {
@@ -851,10 +769,10 @@ index f6df691b66..72572726b8 100644
  
      /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 94181d9281..45c23758e7 100644
+index 491cc5f975..d40811ef2c 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
-@@ -2566,6 +2566,14 @@ bool kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2552,6 +2552,14 @@ bool kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
          error_setg(errp, "KVM doesn't support CPU models");
          return false;
      }
@@ -870,10 +788,10 @@ index 94181d9281..45c23758e7 100644
      prop.ibc = s390_ibc_from_cpu_model(model);
      /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index cfd6f77353..3016e6233c 100644
+index eb8ddebffb..2d3304bb4a 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
-@@ -452,8 +452,10 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -459,8 +459,10 @@ static void test_query_cpu_model_expansion(const void *data)
      assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
  
      /* Test expected feature presence/absence for some cpu types */
@@ -884,7 +802,7 @@ index cfd6f77353..3016e6233c 100644
  
      /* Enabling and disabling pmu should always work. */
      assert_has_feature_enabled(qts, "max", "pmu");
-@@ -470,6 +472,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -477,6 +479,7 @@ static void test_query_cpu_model_expansion(const void *data)
          assert_has_feature_enabled(qts, "cortex-a57", "pmu");
          assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
  
@@ -892,7 +810,7 @@ index cfd6f77353..3016e6233c 100644
          assert_has_feature_enabled(qts, "a64fx", "pmu");
          assert_has_feature_enabled(qts, "a64fx", "aarch64");
          /*
-@@ -482,6 +485,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -489,6 +492,7 @@ static void test_query_cpu_model_expansion(const void *data)
                       "{ 'sve384': true }");
          assert_error(qts, "a64fx", "cannot enable sve640",
                       "{ 'sve640': true }");
@@ -900,6 +818,3 @@ index cfd6f77353..3016e6233c 100644
  
          sve_tests_default(qts, "max");
          pauth_tests_default(qts, "max");
--- 
-2.39.3
-
diff --git a/0006-Machine-type-related-general-changes.patch b/0003-Machine-type-related-general-changes.patch
similarity index 86%
rename from 0006-Machine-type-related-general-changes.patch
rename to 0003-Machine-type-related-general-changes.patch
index 2d6ee37..55dfdf9 100644
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0003-Machine-type-related-general-changes.patch
@@ -1,7 +1,7 @@
-From dc310c3f76c0d986ec4dc5a548a8ff37a85d61cf Mon Sep 17 00:00:00 2001
+From 553a21117e86d4a72d2032bab9247b00f7592e3b Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
-Subject: Machine type related general changes
+Subject: [PATCH] Machine type related general changes
 
 This patch is first part of original "Add RHEL machine types" patch we
 split to allow easier review. It contains changes not related to any
@@ -76,22 +76,23 @@ Merged patches (9.1.0 rc0):
 - 770eeed61e rhel 9.4.0 machine type compat for virtio-gpu migration
 ---
  hw/acpi/piix4.c              |   2 +-
- hw/arm/virt.c                |   3 +-
- hw/core/machine.c            | 281 +++++++++++++++++++++++++++++++++++
+ hw/arm/virt.c                |  11 +-
+ hw/core/machine.c            | 298 +++++++++++++++++++++++++++++++++++
  hw/i386/fw_cfg.c             |   3 +-
  hw/net/rtl8139.c             |   4 +-
  hw/smbios/smbios.c           |  46 +++++-
  hw/timer/i8254_common.c      |   2 +-
- hw/usb/hcd-xhci-pci.c        |  59 ++++++--
+ hw/usb/hcd-xhci-pci.c        |  54 +++++--
  hw/usb/hcd-xhci-pci.h        |   1 +
  hw/virtio/virtio-mem.c       |   3 +-
- include/hw/boards.h          |  43 ++++++
+ include/hw/arm/virt.h        |   1 +
+ include/hw/boards.h          |  46 ++++++
  include/hw/firmware/smbios.h |   4 +-
  include/hw/i386/pc.h         |   3 +
- 13 files changed, 430 insertions(+), 24 deletions(-)
+ 14 files changed, 454 insertions(+), 24 deletions(-)
 
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index debe1adb84..e8ddcd716e 100644
+index 7a18f18dda..2b3678b8c6 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
 @@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
@@ -104,26 +105,40 @@ index debe1adb84..e8ddcd716e 100644
      .fields = (const VMStateField[]) {
          VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index eea7d2d038..b2aa3f1355 100644
+index b525e00365..6a6b841f91 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1699,7 +1699,8 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1749,13 +1749,22 @@ static void virt_build_smbios(VirtMachineState *vms)
+     uint8_t *smbios_tables, *smbios_anchor;
+     size_t smbios_tables_len, smbios_anchor_len;
+     struct smbios_phys_mem_area mem_array;
++    const char *manufacturer = "QEMU";
+     const char *product = "QEMU Virtual Machine";
++    const char *version = vmc->smbios_old_sys_ver ? "1.0" : mc->name;
+ 
+     if (kvm_enabled()) {
+         product = "KVM Virtual Machine";
      }
  
-     smbios_set_defaults("QEMU", product,
--                        vmc->smbios_old_sys_ver ? "1.0" : mc->name);
-+                        vmc->smbios_old_sys_ver ? "1.0" : mc->name,
+-    smbios_set_defaults("QEMU", product, mc->name);
++    if (!vmc->manufacturer_product_compat) {
++        manufacturer = "Red Hat";
++        product = "KVM";
++        version = mc->desc;
++    }
++
++    smbios_set_defaults(manufacturer, product, version,
 +                        NULL, NULL);
  
      /* build the array of physical mem area from base_memmap */
      mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 27dcda0248..f7fed78e4b 100644
+index bd47527479..7a7317941b 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -305,6 +305,287 @@ GlobalProperty hw_compat_2_1[] = {
+@@ -288,6 +288,304 @@ GlobalProperty hw_compat_2_6[] = {
  };
- const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
+ const size_t hw_compat_2_6_len = G_N_ELEMENTS(hw_compat_2_6);
  
 +/*
 + * RHEL only: machine types for previous major releases are deprecated
@@ -131,6 +146,23 @@ index 27dcda0248..f7fed78e4b 100644
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
++GlobalProperty hw_compat_rhel_9_6[] = {
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    {"arm-cpu", "backcompat-cntfrq", "true" },
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    { "scsi-hd", "migrate-emulated-scsi-request", "false" },
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    { "scsi-cd", "migrate-emulated-scsi-request", "false" },
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    {"vfio-pci", "skip-vsc-check", "false" },
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    { "virtio-pci", "x-pcie-pm-no-soft-reset", "off" },
++  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
++    {"sd-card", "spec_version", "2" },
++};
++const size_t hw_compat_rhel_9_6_len = G_N_ELEMENTS(hw_compat_rhel_9_6);
++
++
 +GlobalProperty hw_compat_rhel_9_5[] = {
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "migration", "zero-page-detection", "legacy"},
@@ -410,10 +442,10 @@ index 27dcda0248..f7fed78e4b 100644
  
  static char *machine_get_kernel(Object *obj, Error **errp)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 0e4494627c..33ef280420 100644
+index 5c0bcd5f8a..07df7281d2 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
-@@ -73,7 +73,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+@@ -75,7 +75,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
  
      if (pcmc->smbios_defaults) {
          /* These values are guest ABI, do not change */
@@ -424,10 +456,10 @@ index 0e4494627c..33ef280420 100644
  
      /* tell smbios about cpuid version and features */
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 03a204ef8a..f2fe057535 100644
+index 324fb932aa..f1def02bfb 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
-@@ -3173,7 +3173,7 @@ static int rtl8139_pre_save(void *opaque)
+@@ -3172,7 +3172,7 @@ static int rtl8139_pre_save(void *opaque)
  
  static const VMStateDescription vmstate_rtl8139 = {
      .name = "rtl8139",
@@ -436,7 +468,7 @@ index 03a204ef8a..f2fe057535 100644
      .minimum_version_id = 3,
      .post_load = rtl8139_post_load,
      .pre_save  = rtl8139_pre_save,
-@@ -3254,7 +3254,9 @@ static const VMStateDescription vmstate_rtl8139 = {
+@@ -3253,7 +3253,9 @@ static const VMStateDescription vmstate_rtl8139 = {
          VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
          VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
          VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
@@ -447,10 +479,10 @@ index 03a204ef8a..f2fe057535 100644
          VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
  
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index a394514264..88642ccce0 100644
+index 1ac063cfb4..03f7a00ed1 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
-@@ -38,6 +38,10 @@ size_t usr_blobs_len;
+@@ -39,6 +39,10 @@ size_t usr_blobs_len;
  static unsigned usr_table_max;
  static unsigned usr_table_cnt;
  
@@ -461,7 +493,7 @@ index a394514264..88642ccce0 100644
  uint8_t *smbios_tables;
  size_t smbios_tables_len;
  unsigned smbios_table_max;
-@@ -626,7 +630,7 @@ static void smbios_build_type_1_table(void)
+@@ -627,7 +631,7 @@ static void smbios_build_type_1_table(void)
  
  static void smbios_build_type_2_table(void)
  {
@@ -470,7 +502,7 @@ index a394514264..88642ccce0 100644
  
      SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
      SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -1014,15 +1018,51 @@ void smbios_set_default_processor_family(uint16_t processor_family)
+@@ -1015,15 +1019,51 @@ void smbios_set_default_processor_family(uint16_t processor_family)
  }
  
  void smbios_set_defaults(const char *manufacturer, const char *product,
@@ -525,7 +557,7 @@ index a394514264..88642ccce0 100644
      SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
      SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
-index 28fdabc321..bad13ec224 100644
+index ad091594cd..debf9f0c67 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
 @@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
@@ -538,10 +570,10 @@ index 28fdabc321..bad13ec224 100644
                               vmstate_pit_channel, PITChannelState),
          VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
-index 264d7ebb77..2b9a3e06d4 100644
+index b93c80b09d..f4a2f1a1de 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
-@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
+@@ -120,6 +120,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
     return 0;
  }
  
@@ -575,7 +607,7 @@ index 264d7ebb77..2b9a3e06d4 100644
  static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
  {
      int ret;
-@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+@@ -144,23 +171,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
          s->xhci.nec_quirks = true;
      }
  
@@ -602,7 +634,7 @@ index 264d7ebb77..2b9a3e06d4 100644
      }
      pci_register_bar(dev, 0,
                       PCI_BASE_ADDRESS_SPACE_MEMORY |
-@@ -153,6 +169,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+@@ -172,6 +188,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
          assert(ret > 0);
      }
  
@@ -617,42 +649,32 @@ index 264d7ebb77..2b9a3e06d4 100644
      if (s->msix != ON_OFF_AUTO_OFF) {
          /* TODO check for errors, and should fail when msix=on */
          msix_init(dev, s->xhci.numintrs,
-@@ -197,11 +221,18 @@ static void xhci_instance_init(Object *obj)
-     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
- }
- 
-+static Property xhci_pci_properties[] = {
+@@ -221,6 +245,8 @@ static const Property xhci_pci_properties[] = {
+     DEFINE_PROP_ON_OFF_AUTO("msix", XHCIPciState, msix, ON_OFF_AUTO_AUTO),
+     DEFINE_PROP_BOOL("conditional-intr-mapping", XHCIPciState,
+                      conditional_intr_mapping, false),
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
-+    DEFINE_PROP_END_OF_LIST()
-+};
-+
- static void xhci_class_init(ObjectClass *klass, void *data)
- {
-     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-     DeviceClass *dc = DEVICE_CLASS(klass);
+ };
  
-+    device_class_set_props(dc, xhci_pci_properties);
-     dc->reset   = xhci_pci_reset;
-     dc->vmsd    = &vmstate_xhci_pci;
-     set_bit(DEVICE_CATEGORY_USB, dc->categories);
+ static void xhci_class_init(ObjectClass *klass, const void *data)
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
-index 08f70ce97c..1be7527c1b 100644
+index 5b61ae8455..3170db064b 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
-@@ -40,6 +40,7 @@ typedef struct XHCIPciState {
-     XHCIState xhci;
+@@ -41,6 +41,7 @@ typedef struct XHCIPciState {
      OnOffAuto msi;
      OnOffAuto msix;
+     bool conditional_intr_mapping;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
  } XHCIPciState;
  
  #endif
 diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index ef64bf1b4a..ba11aa4646 100644
+index c46f6f9c3e..1805597879 100644
 --- a/hw/virtio/virtio-mem.c
 +++ b/hw/virtio/virtio-mem.c
-@@ -1694,8 +1694,9 @@ static Property virtio_mem_properties[] = {
+@@ -1699,8 +1699,9 @@ static const Property virtio_mem_properties[] = {
  #endif
      DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
                       early_migration, true),
@@ -660,17 +682,32 @@ index ef64bf1b4a..ba11aa4646 100644
      DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
 -                     dynamic_memslots, false),
 +                     dynamic_memslots, true),
-     DEFINE_PROP_END_OF_LIST(),
  };
  
+ static uint64_t virtio_mem_rdm_get_min_granularity(const RamDiscardManager *rdm,
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index 365a28b082..94c79d6c6d 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -132,6 +132,7 @@ struct VirtMachineClass {
+     bool no_tcg_lpa2;
+     bool no_ns_el2_virt_timer_irq;
+     bool no_nested_smmu;
++    bool manufacturer_product_compat;
+ };
+ 
+ struct VirtMachineState {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 48ff6d8b93..ccfc3e10eb 100644
+index f94713e6e2..1ec852293a 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -822,4 +822,47 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
+@@ -863,4 +863,50 @@ extern const size_t hw_compat_2_7_len;
+ extern GlobalProperty hw_compat_2_6[];
+ extern const size_t hw_compat_2_6_len;
  
++extern GlobalProperty hw_compat_rhel_9_6[];
++extern const size_t hw_compat_rhel_9_6_len;
++
 +extern GlobalProperty hw_compat_rhel_9_5[];
 +extern const size_t hw_compat_rhel_9_5_len;
 +
@@ -731,7 +768,7 @@ index f066ab7262..e805d25fbe 100644
  uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
  void smbios_get_tables(MachineState *ms,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 4e55d7ef6e..8776a3c937 100644
+index 79b72c54dd..3b4ea24c20 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
 @@ -103,6 +103,9 @@ struct PCMachineClass {
@@ -744,6 +781,3 @@ index 4e55d7ef6e..8776a3c937 100644
  
      /* RAM / address space compat: */
      bool gigabyte_align;
--- 
-2.39.3
-
diff --git a/0007-meson-temporarily-disable-Wunused-function.patch b/0004-meson-temporarily-disable-Wunused-function.patch
similarity index 80%
rename from 0007-meson-temporarily-disable-Wunused-function.patch
rename to 0004-meson-temporarily-disable-Wunused-function.patch
index 0716188..414e752 100644
--- a/0007-meson-temporarily-disable-Wunused-function.patch
+++ b/0004-meson-temporarily-disable-Wunused-function.patch
@@ -1,7 +1,7 @@
-From 8781d75adf542ea09e62a0cafd0c79875015a272 Mon Sep 17 00:00:00 2001
+From 4648464c6648b8ba6f196a394fa1d622155d063f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:32:32 +0100
-Subject: meson: temporarily disable -Wunused-function
+Subject: [PATCH] meson: temporarily disable -Wunused-function
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -20,10 +20,10 @@ Rebase notes (9.1.0 rc0)
  1 file changed, 1 insertion(+)
 
 diff --git a/meson.build b/meson.build
-index fbda17c987..161d496d55 100644
+index 50c774a195..0e0120a613 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -651,6 +651,7 @@ warn_flags = [
+@@ -757,6 +757,7 @@ warn_flags = [
    '-Wno-string-plus-int',
    '-Wno-tautological-type-limit-compare',
    '-Wno-typedef-redefinition',
@@ -31,6 +31,3 @@ index fbda17c987..161d496d55 100644
  ]
  
  if host_os != 'darwin'
--- 
-2.39.3
-
diff --git a/0008-Remove-upstream-machine-type-versions-for-aarch64-s3.patch b/0005-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
similarity index 60%
rename from 0008-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
rename to 0005-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
index 2590cc4..cae63ca 100644
--- a/0008-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
+++ b/0005-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
@@ -1,8 +1,8 @@
-From c5e6c533f498a698ef6797f58f3f8aced62476fd Mon Sep 17 00:00:00 2001
+From f37d0232b038edd22b87e24100e9bce0f5103bb7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:25:13 +0100
-Subject: Remove upstream machine type versions for aarch64, s390x and x86_64
- architectures
+Subject: [PATCH] Remove upstream machine type versions for aarch64, s390x and
+ x86_64 architectures
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,72 +24,72 @@ Rebase notes (9.1.0 rc0)
  5 files changed, 13 insertions(+)
 
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index b2aa3f1355..5396e7cb24 100644
+index 6a6b841f91..e454b29de6 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -3306,6 +3306,7 @@ static void machvirt_machine_init(void)
+@@ -3468,6 +3468,7 @@ static void machvirt_machine_init(void)
  }
  type_init(machvirt_machine_init);
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void virt_machine_9_1_options(MachineClass *mc)
+ static void virt_machine_10_1_options(MachineClass *mc)
  {
  }
-@@ -3552,3 +3553,4 @@ static void virt_machine_2_6_options(MachineClass *mc)
-     vmc->no_pmu = true;
+@@ -3643,3 +3644,4 @@ static void virt_machine_4_1_options(MachineClass *mc)
+     mc->auto_enable_numa_with_memhp = false;
  }
- DEFINE_VIRT_MACHINE(2, 6)
+ DEFINE_VIRT_MACHINE(4, 1)
 +#endif /* disabled for RHEL */
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 347afa4c37..67107b174a 100644
+index c03324281b..acf010e20f 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -448,6 +448,7 @@ static void pc_i440fx_init(MachineState *machine)
- #define DEFINE_I440FX_MACHINE(major, minor) \
-     DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor);
+@@ -475,6 +475,7 @@ static void pc_i440fx_init(MachineState *machine)
+ #define DEFINE_I440FX_MACHINE_AS_LATEST(major, minor) \
+     DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, true, "pc", major, minor);
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void pc_i440fx_machine_options(MachineClass *m)
  {
      PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -775,6 +776,7 @@ static void pc_i440fx_machine_2_4_options(MachineClass *m)
+@@ -802,6 +803,7 @@ static void pc_i440fx_machine_2_6_options(MachineClass *m)
  }
  
- DEFINE_I440FX_MACHINE(2, 4);
+ DEFINE_I440FX_MACHINE(2, 6);
 +#endif /* Disabled for Red Hat Enterprise Linux */
  
  #ifdef CONFIG_ISAPC
  static void isapc_machine_options(MachineClass *m)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index f2d8edfa84..5fb283f2df 100644
+index b309b2b378..2203ffd67e 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -356,6 +356,7 @@ static void pc_q35_machine_options(MachineClass *m)
+@@ -374,6 +374,7 @@ static void pc_q35_machine_options(MachineClass *m)
                       pc_q35_compat_defaults, pc_q35_compat_defaults_len);
  }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void pc_q35_machine_9_1_options(MachineClass *m)
+ static void pc_q35_machine_10_1_options(MachineClass *m)
  {
      pc_q35_machine_options(m);
-@@ -668,3 +669,4 @@ static void pc_q35_machine_2_4_options(MachineClass *m)
+@@ -685,3 +686,4 @@ static void pc_q35_machine_2_6_options(MachineClass *m)
  }
  
- DEFINE_Q35_MACHINE(2, 4);
+ DEFINE_Q35_MACHINE(2, 6);
 +#endif /* Disabled for Red Hat Enterprise Linux */
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 370d7c35d3..b48a2afc38 100644
+index 1855a3cd8d..6a5f75af7d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -4837,6 +4837,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
- #define DEFINE_SPAPR_MACHINE_TAGGED(major, minor, tag) \
-     DEFINE_SPAPR_MACHINE_IMPL(false, major, minor, _, tag)
+@@ -4793,6 +4793,7 @@ static void spapr_machine_9_2_class_options(MachineClass *mc)
+ 
+ DEFINE_SPAPR_MACHINE(9, 2);
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  /*
   * pseries-9.1
   */
-@@ -5041,6 +5042,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4999,6 +5000,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
  }
  
  DEFINE_SPAPR_MACHINE(4, 1);
@@ -97,7 +97,7 @@ index 370d7c35d3..b48a2afc38 100644
  
  /*
   * pseries-4.0
-@@ -5056,6 +5058,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -5014,6 +5016,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
      }
      return true;
  }
@@ -106,34 +106,31 @@ index 370d7c35d3..b48a2afc38 100644
  static void spapr_machine_4_0_class_options(MachineClass *mc)
  {
      SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5380,6 +5384,7 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
-     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
+@@ -5066,6 +5070,7 @@ static void spapr_machine_3_0_class_options(MachineClass *mc)
  }
- DEFINE_SPAPR_MACHINE(2, 1);
+ 
+ DEFINE_SPAPR_MACHINE(3, 0);
 +#endif /* disabled for RHEL */
  
  static void spapr_machine_register_types(void)
  {
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index c483ff8064..86bfc9d2eb 100644
+index a79bd13275..022376376e 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -871,6 +871,7 @@ static const TypeInfo ccw_machine_info = {
+@@ -911,6 +911,7 @@ static const TypeInfo ccw_machine_info = {
      DEFINE_CCW_MACHINE_IMPL(false, major, minor)
  
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_9_1_instance_options(MachineState *machine)
+ static void ccw_machine_10_1_instance_options(MachineState *machine)
  {
  }
-@@ -1305,6 +1306,7 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
- DEFINE_CCW_MACHINE(2, 4);
- 
- #endif
+@@ -1166,6 +1167,7 @@ static void ccw_machine_4_2_class_options(MachineClass *mc)
+     compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+ }
+ DEFINE_CCW_MACHINE(4, 2);
 +#endif /* disabled for RHEL */
  
  static void ccw_machine_register_types(void)
  {
--- 
-2.39.3
-
diff --git a/0009-Adapt-versioned-machine-type-macros-for-RHEL.patch b/0006-Adapt-versioned-machine-type-macros-for-RHEL.patch
similarity index 73%
rename from 0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
rename to 0006-Adapt-versioned-machine-type-macros-for-RHEL.patch
index e5b4b10..0afdfc1 100644
--- a/0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
+++ b/0006-Adapt-versioned-machine-type-macros-for-RHEL.patch
@@ -1,7 +1,7 @@
-From 3cb90f2fec9096ddde4038e037e82a9c44614791 Mon Sep 17 00:00:00 2001
+From 86f1871df0119909cedf16ee3c3e7b64382bc22a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 15:27:03 +0100
-Subject: Adapt versioned machine type macros for RHEL
+Subject: [PATCH] Adapt versioned machine type macros for RHEL
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -20,19 +20,33 @@ The versioned machine type macros are changed thus:
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- .distro/Makefile.common        |  1 +
- .distro/qemu-kvm.spec.template |  1 +
- include/hw/boards.h            | 60 +++++++++++-----------------------
- meson.build                    |  1 +
- meson_options.txt              |  2 ++
- scripts/meson-buildoptions.sh  |  2 ++
- 6 files changed, 26 insertions(+), 41 deletions(-)
+ docs/conf.py                  |  4 ++--
+ include/hw/boards.h           | 39 ++++++++++++++---------------------
+ meson.build                   |  1 +
+ meson_options.txt             |  2 ++
+ scripts/meson-buildoptions.sh |  2 ++
+ 5 files changed, 23 insertions(+), 25 deletions(-)
 
+diff --git a/docs/conf.py b/docs/conf.py
+index f892a6e1da..0b8861e4bf 100644
+--- a/docs/conf.py
++++ b/docs/conf.py
+@@ -140,8 +140,8 @@
+ # MACHINE_VER_DELETION_MAJOR  & MACHINE_VER_DEPRECATION_MAJOR
+ # defined in include/hw/boards.h and the introductory text in
+ # docs/about/deprecated.rst
+-ver_machine_deprecation_version = "%d.%d.0" % (major - 3, minor)
+-ver_machine_deletion_version = "%d.%d.0" % (major - 6, minor)
++ver_machine_deprecation_version = "%d.%d.0" % (major - 1, minor)
++ver_machine_deletion_version = "%d.%d.0" % (major - 2, minor)
+ 
+ # The language for content autogenerated by Sphinx. Refer to documentation
+ # for a list of supported languages.
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index ccfc3e10eb..7f7eb4ec40 100644
+index 1ec852293a..ba3978402f 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -548,16 +548,16 @@ struct MachineState {
+@@ -577,16 +577,16 @@ struct MachineState {
   *   "{prefix}-{major}.{minor}.{micro}-{tag}"
   */
  #define _MACHINE_VER_TYPE_NAME2(prefix, major, minor)   \
@@ -53,7 +67,7 @@ index ccfc3e10eb..7f7eb4ec40 100644
  
  #define MACHINE_VER_TYPE_NAME(prefix, ...) \
      _MACHINE_VER_PICK(__VA_ARGS__, \
-@@ -585,16 +585,16 @@ struct MachineState {
+@@ -614,16 +614,16 @@ struct MachineState {
   *   {prefix}_machine_{major}_{minor}_{micro}_{tag}_{sym}
   */
  #define _MACHINE_VER_SYM2(sym, prefix, major, minor) \
@@ -74,15 +88,9 @@ index ccfc3e10eb..7f7eb4ec40 100644
  
  #define MACHINE_VER_SYM(sym, prefix, ...) \
      _MACHINE_VER_PICK(__VA_ARGS__, \
-@@ -605,26 +605,22 @@ struct MachineState {
- 
- 
- /*
-- * How many years/major releases for each phase
-- * of the life cycle. Assumes use of versioning
-- * scheme where major is bumped each year
-+ * How many RHEL major releases for each phase
-+ * of the life cycle.
+@@ -642,17 +642,16 @@ struct MachineState {
+  * and ver_machine_deletion_version logic in docs/conf.py and
+  * the text in docs/about/deprecated.rst
   */
 -#define MACHINE_VER_DELETION_MAJOR 6
 -#define MACHINE_VER_DEPRECATION_MAJOR 3
@@ -100,15 +108,23 @@ index ccfc3e10eb..7f7eb4ec40 100644
 +    "machines from the previous RHEL major release are " \
 +    "subject to deletion in the next RHEL major release"
  
+ #define _MACHINE_VER_IS_CURRENT_EXPIRED(cutoff, major, minor) \
+     (((QEMU_VERSION_MAJOR - major) > cutoff) || \
+@@ -683,12 +682,7 @@ struct MachineState {
+  * If this ever changes the logic below will need modifying....
+  */
  #define _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor) \
--    (((QEMU_VERSION_MAJOR - major) > cutoff) || \
--     (((QEMU_VERSION_MAJOR - major) == cutoff) && \
--      (QEMU_VERSION_MINOR - minor) >= 0))
+-    ((QEMU_VERSION_MICRO < 50 && \
+-      _MACHINE_VER_IS_CURRENT_EXPIRED(cutoff, major, minor)) || \
+-     (QEMU_VERSION_MICRO >= 50 && QEMU_VERSION_MINOR < 2 && \
+-      _MACHINE_VER_IS_NEXT_MINOR_EXPIRED(cutoff, major, minor)) || \
+-     (QEMU_VERSION_MICRO >= 50 && QEMU_VERSION_MINOR == 2 && \
+-      _MACHINE_VER_IS_NEXT_MAJOR_EXPIRED(cutoff, major, minor)))
 +    ((RHEL_VERSION - major) >= cutoff)
  
  #define _MACHINE_VER_IS_EXPIRED2(cutoff, major, minor) \
      _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor)
-@@ -686,32 +682,14 @@ struct MachineState {
+@@ -750,10 +744,9 @@ struct MachineState {
   * This must be unconditionally used in the register
   * method for all machine types which support versioning.
   *
@@ -116,40 +132,17 @@ index ccfc3e10eb..7f7eb4ec40 100644
 - * suitable period of time has passed, it will cause
 - * execution of the method to return, avoiding registration
 - * of the machine
-- *
-- * The new deprecation and deletion policy for versioned
-- * machine types was introduced in QEMU 9.1.0.
-- *
-- * Under the new policy a number of old machine types (any
-- * prior to 2.12) would be liable for immediate deletion
-- * which would be a violation of our historical deprecation
-- * and removal policy
-- *
-- * Thus deletions are temporarily gated on existance of
-- * the env variable "QEMU_DELETE_MACHINES" / QEMU version
-- * number >= 10.1.0. This gate can be deleted in the 10.1.0
-- * dev cycle
 + * It will automatically avoid registration of machines
 + * that should have been deleted at the start of this
 + * RHEL release
   */
  #define MACHINE_VER_DELETION(...) \
      do { \
-         if (MACHINE_VER_SHOULD_DELETE(__VA_ARGS__)) { \
--            if (getenv("QEMU_DELETE_MACHINES") || \
--                QEMU_VERSION_MAJOR > 10 || (QEMU_VERSION_MAJOR == 10 && \
--                                            QEMU_VERSION_MINOR >= 1)) { \
--                return; \
--            } \
-+            return; \
-         } \
-     } while (0)
- 
 diff --git a/meson.build b/meson.build
-index 161d496d55..2de5ab024f 100644
+index 0e0120a613..23494666d9 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2440,6 +2440,7 @@ config_host_data.set('QEMU_VERSION', '"@0@"'.format(meson.project_version()))
+@@ -2636,6 +2636,7 @@ config_host_data.set('QEMU_VERSION', '"@0@"'.format(meson.project_version()))
  config_host_data.set('QEMU_VERSION_MAJOR', meson.project_version().split('.')[0])
  config_host_data.set('QEMU_VERSION_MINOR', meson.project_version().split('.')[1])
  config_host_data.set('QEMU_VERSION_MICRO', meson.project_version().split('.')[2])
@@ -158,7 +151,7 @@ index 161d496d55..2de5ab024f 100644
  config_host_data.set_quoted('CONFIG_HOST_DSOSUF', host_dsosuf)
  config_host_data.set('HAVE_HOST_BLOCK_DEVICE', have_host_block_device)
 diff --git a/meson_options.txt b/meson_options.txt
-index 0269fa0f16..aa2ba0baef 100644
+index fff1521e58..f45d7ded45 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -2,6 +2,8 @@
@@ -171,25 +164,22 @@ index 0269fa0f16..aa2ba0baef 100644
         description: 'Suffix for QEMU data/modules/config directories (can be empty)')
  option('docdir', type : 'string', value : 'share/doc',
 diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
-index c97079a38c..5f0cbfc725 100644
+index 0ebe6bc52a..4146dbc88d 100644
 --- a/scripts/meson-buildoptions.sh
 +++ b/scripts/meson-buildoptions.sh
-@@ -71,6 +71,7 @@ meson_options_help() {
-   printf "%s\n" '                           "manufacturer" name for qemu-ga registry entries'
+@@ -75,6 +75,7 @@ meson_options_help() {
    printf "%s\n" '                           [QEMU]'
    printf "%s\n" '  --qemu-ga-version=VALUE  version number for qemu-ga installer'
+   printf "%s\n" '  --rtsig-map=VALUE        default value of QEMU_RTSIG_MAP [NULL]'
 +  printf "%s\n" '  --rhel-version=VALUE     RHEL major/minor version [0.0]'
    printf "%s\n" '  --smbd=VALUE             Path to smbd for slirp networking'
    printf "%s\n" '  --sysconfdir=VALUE       Sysconf data directory [etc]'
    printf "%s\n" '  --tls-priority=VALUE     Default TLS protocol/cipher priority string'
-@@ -450,6 +451,7 @@ _meson_option_parse() {
+@@ -465,6 +466,7 @@ _meson_option_parse() {
      --disable-relocatable) printf "%s" -Drelocatable=false ;;
      --enable-replication) printf "%s" -Dreplication=enabled ;;
      --disable-replication) printf "%s" -Dreplication=disabled ;;
 +    --rhel-version=*) quote_sh "-Drhel_version=$2" ;;
      --enable-rng-none) printf "%s" -Drng_none=true ;;
      --disable-rng-none) printf "%s" -Drng_none=false ;;
-     --enable-rutabaga-gfx) printf "%s" -Drutabaga_gfx=enabled ;;
--- 
-2.39.3
-
+     --rtsig-map=*) quote_sh "-Drtsig_map=$2" ;;
diff --git a/0010-Increase-deletion-schedule-to-3-releases.patch b/0007-Increase-deletion-schedule-to-3-releases.patch
similarity index 71%
rename from 0010-Increase-deletion-schedule-to-3-releases.patch
rename to 0007-Increase-deletion-schedule-to-3-releases.patch
index 09bebec..67c9ce8 100644
--- a/0010-Increase-deletion-schedule-to-3-releases.patch
+++ b/0007-Increase-deletion-schedule-to-3-releases.patch
@@ -1,7 +1,7 @@
-From f25d2c0298d8d6328cb0071926d477f647a512fc Mon Sep 17 00:00:00 2001
+From 45028f888ffc2b43276c2d77b72fbd85effdc838 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 18:45:58 +0100
-Subject: Increase deletion schedule to 3 releases
+Subject: [PATCH] Increase deletion schedule to 3 releases
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -16,18 +16,15 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 7f7eb4ec40..32c4642f5a 100644
+index ba3978402f..1e03667fd1 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -608,7 +608,7 @@ struct MachineState {
-  * How many RHEL major releases for each phase
-  * of the life cycle.
+@@ -642,7 +642,7 @@ struct MachineState {
+  * and ver_machine_deletion_version logic in docs/conf.py and
+  * the text in docs/about/deprecated.rst
   */
 -#define MACHINE_VER_DELETION_MAJOR 2
 +#define MACHINE_VER_DELETION_MAJOR 3
  #define MACHINE_VER_DEPRECATION_MAJOR 1
  
  /*
--- 
-2.39.3
-
diff --git a/0011-Add-downstream-aarch64-versioned-virt-machine-types.patch b/0008-Add-downstream-aarch64-versioned-virt-machine-types.patch
similarity index 62%
rename from 0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
rename to 0008-Add-downstream-aarch64-versioned-virt-machine-types.patch
index df71e68..ebcdacd 100644
--- a/0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
+++ b/0008-Add-downstream-aarch64-versioned-virt-machine-types.patch
@@ -1,105 +1,35 @@
-From a2e5218bbe2e39712e06c5d8a51f836807c1cae9 Mon Sep 17 00:00:00 2001
+From bd6640b6a7ea4339dbb5aa1e9a6c36f2efc59085 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:25:47 +0100
-Subject: Add downstream aarch64 versioned 'virt' machine types
+Subject: [PATCH] Add downstream aarch64 versioned 'virt' machine types
 
 Adding changes to add RHEL machine types for aarch64 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
-Rebase notes (6.1.0):
-- Use CONFIG_TPM check when using TPM structures
-- Add support for default_bus_bypass_iommu
-- ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
-- 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
-
-Rebase notes (7.0.0):
-- Added dtb-kaslr-seed option
-- Set no_tcg_lpa2 to true
-
-Rebase notes (7.1.0):
-- replace dtb_kaslr_seed by dtb_randomness
-- Updated dtb_randomness comment
-
-Rebase notes (7.2.0):
-- Disabled cortex-a35
-
-Rebase notes (8.0.0):
-- Moved changed code from target/arm/helper.c to target/arm/arm-qmp-cmds.c
-
-Rebase notes (8.1.0):
-- Added setting default_nic
-
-Rebase notes (9.0.0 rc0):
-- call arm_virt_compat_set on rhel type class_init
-
-Rebase notes (9.1.0 rc0):
-- Merge copy+pasted base machine definition back with upstream
-  base machine definition to reduce RHEL delta, as is done with
-  other targets
-- Convert to new DEFINE_VIRT_MACHINE macros
-
-Rebase notes (9.1.0 rc1):
-- do not remove cpu_valid_types
-
-Rebase notes (9.1.0 rc2):
-- Use preprocessing to remove unwanted code instead of removal
-
-Merged patches (6.2.0):
-- 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
-- f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
-
-Merged patches (7.0.0):
-- 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
-- c354a86c9b hw/arm/virt: Register "iommu" as a class property
-- c1a2630dc9 hw/arm/virt: Register "its" as a class property
-- 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
-- a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
-- 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
-- ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
-
-Merged patches (7.0.0):
-- f79b31bdef hw/arm/virt: Remove the dtb-kaslr-seed machine option
-- b6fca85f4a hw/arm/virt: Fix missing initialization in instance/class_init()
-
-Merged patches (7.1.0):
-- ac97dd4f9f RHEL-only: AArch64: Drop unsupported CPU types
-- e9c0a70664 target/arm: deprecate named CPU models
-
-Merged patches (7.2.0):
-- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
-
-Merged patches (8.0.0):
-- c1a21266d8 redhat: aarch64: add rhel9.2.0 virt machine type
-- d97cd7c513 redhat: fix virt-rhel9.2.0 compat props
-
-Merged patches (8.1.0):
-- bd5d81d286 Add RHEL 9.2.0 compat structure (arm part)
-- c07f666086 hw/arm/virt: Validate cluster and NUMA node boundary for RHEL machines
-
-Merged patches (8.2.0):
-- 4ee284aca9 Add machine types compat bits. (partial)
-
-Merged patches (9.0.0 rc0):
-- 117068376a hw/arm/virt: Fix compats
-- 8bcccfabc4 hw/arm/virt: Add properties to disable high memory regions
- 0005a8b93a hw/arm/virt: deprecate virt-rhel9.{0,2}.0 machine types
-
-Merged patches (9.1.0 rc0):
-- 043ad5ce97 Add upstream compatibility bits (partial)
-- 092cb319ea hw/arm/virt: Fix spurious call to arm_virt_compat_set()
----
- hw/arm/virt.c | 101 ++++++++++++++++++++++++++++++++++++++++----------
- 1 file changed, 81 insertions(+), 20 deletions(-)
+ hw/arm/virt.c       | 131 ++++++++++++++++++++++++++++++++++++++------
+ hw/core/machine.c   |  15 +++--
+ include/hw/boards.h |   3 +
+ 3 files changed, 125 insertions(+), 24 deletions(-)
 
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 5396e7cb24..903c0f2e9f 100644
+index e454b29de6..21ab9257e7 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -90,6 +90,22 @@ static GlobalProperty arm_virt_compat[] = {
+@@ -97,6 +97,32 @@ static GlobalProperty arm_virt_compat[] = {
  };
  static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat);
  
++/*
++ * RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
++ * since qemu will setup the VM with pauth when KVM supports it we
++ * have to disable it for virt-rhel9* to support upgrades / migration.
++ */
++GlobalProperty arm_rhel9_compat[] = {
++    {TYPE_ARM_CPU, "pauth", "off", .optional = true},
++};
++const size_t arm_rhel9_compat_len = G_N_ELEMENTS(arm_rhel9_compat);
++
 +/*
 + * This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
@@ -119,16 +49,20 @@ index 5396e7cb24..903c0f2e9f 100644
  /*
   * This cannot be called from the virt_machine_class_init() because
   * TYPE_VIRT_MACHINE is abstract and mc->compat_props g_ptr_array_new()
-@@ -99,6 +115,8 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -106,6 +132,12 @@ static void arm_virt_compat_set(MachineClass *mc)
  {
      compat_props_add(mc->compat_props, arm_virt_compat,
                       arm_virt_compat_len);
 +    compat_props_add(mc->compat_props, arm_rhel_compat,
 +                     arm_rhel_compat_len);
++    compat_props_add(mc->compat_props, arm_rhel9_compat,
++                     arm_rhel9_compat_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_9,
++                     hw_compat_rhel_9_len);
  }
  
  #define DEFINE_VIRT_MACHINE_IMPL(latest, ...) \
-@@ -109,10 +127,11 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -116,10 +148,11 @@ static void arm_virt_compat_set(MachineClass *mc)
          MachineClass *mc = MACHINE_CLASS(oc); \
          arm_virt_compat_set(mc); \
          MACHINE_VER_SYM(options, virt, __VA_ARGS__)(mc); \
@@ -141,7 +75,7 @@ index 5396e7cb24..903c0f2e9f 100644
          } \
      } \
      static const TypeInfo MACHINE_VER_SYM(info, virt, __VA_ARGS__) = \
-@@ -128,10 +147,10 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -135,10 +168,10 @@ static void arm_virt_compat_set(MachineClass *mc)
      } \
      type_init(MACHINE_VER_SYM(register, virt, __VA_ARGS__));
  
@@ -156,7 +90,22 @@ index 5396e7cb24..903c0f2e9f 100644
  
  
  /* Number of external interrupt lines to configure the GIC with */
-@@ -2434,6 +2453,7 @@ static void machvirt_init(MachineState *machine)
+@@ -1746,12 +1779,13 @@ static void virt_build_smbios(VirtMachineState *vms)
+ {
+     MachineClass *mc = MACHINE_GET_CLASS(vms);
+     MachineState *ms = MACHINE(vms);
++    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+     uint8_t *smbios_tables, *smbios_anchor;
+     size_t smbios_tables_len, smbios_anchor_len;
+     struct smbios_phys_mem_area mem_array;
+     const char *manufacturer = "QEMU";
+     const char *product = "QEMU Virtual Machine";
+-    const char *version = vmc->smbios_old_sys_ver ? "1.0" : mc->name;
++    const char *version = mc->name;
+ 
+     if (kvm_enabled()) {
+         product = "KVM Virtual Machine";
+@@ -2526,6 +2560,7 @@ static void machvirt_init(MachineState *machine)
      qemu_add_machine_init_done_notifier(&vms->machine_done);
  }
  
@@ -164,7 +113,7 @@ index 5396e7cb24..903c0f2e9f 100644
  static bool virt_get_secure(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2461,6 +2481,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2553,6 +2588,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
  
      vms->virt = value;
  }
@@ -172,7 +121,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
  static bool virt_get_highmem(Object *obj, Error **errp)
  {
-@@ -2476,6 +2497,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2568,6 +2604,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
      vms->highmem = value;
  }
  
@@ -180,7 +129,7 @@ index 5396e7cb24..903c0f2e9f 100644
  static bool virt_get_compact_highmem(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2489,6 +2511,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
+@@ -2581,6 +2618,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
  
      vms->highmem_compact = value;
  }
@@ -188,7 +137,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
  static bool virt_get_highmem_redists(Object *obj, Error **errp)
  {
-@@ -2547,6 +2570,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
+@@ -2673,6 +2711,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
      vms->its = value;
  }
  
@@ -196,7 +145,7 @@ index 5396e7cb24..903c0f2e9f 100644
  static bool virt_get_dtb_randomness(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2560,6 +2584,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
+@@ -2686,6 +2725,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
  
      vms->dtb_randomness = value;
  }
@@ -204,7 +153,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
  static char *virt_get_oem_id(Object *obj, Error **errp)
  {
-@@ -2643,6 +2668,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
+@@ -2769,6 +2809,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
      vms->ras = value;
  }
  
@@ -212,7 +161,7 @@ index 5396e7cb24..903c0f2e9f 100644
  static bool virt_get_mte(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2656,6 +2682,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+@@ -2782,6 +2823,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
  
      vms->mte = value;
  }
@@ -220,7 +169,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
  static char *virt_get_gic_version(Object *obj, Error **errp)
  {
-@@ -3063,16 +3090,10 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3222,17 +3264,17 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
          NULL
      };
  
@@ -231,16 +180,20 @@ index 5396e7cb24..903c0f2e9f 100644
 -     * configuration of the particular instance.
 -     */
 -    mc->max_cpus = 512;
--    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_CALXEDA_XGMAC);
--    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_AMD_XGBE);
--    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
--    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
 +    /* Maximum supported VCPU count for all virt-rhel* machines */
 +    mc->max_cpus = 384;
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_CALXEDA_XGMAC);
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_AMD_XGBE);
+-    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
++#endif
++    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
  #ifdef CONFIG_TPM
      machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
  #endif
-@@ -3083,11 +3104,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3243,11 +3285,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
      mc->minimum_page_bits = 12;
      mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
      mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
@@ -253,7 +206,7 @@ index 5396e7cb24..903c0f2e9f 100644
      mc->valid_cpu_types = valid_cpu_types;
      mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
      mc->kvm_type = virt_kvm_type;
-@@ -3111,6 +3128,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3272,6 +3310,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
          NULL, NULL);
      object_class_property_set_description(oc, "acpi",
          "Enable ACPI");
@@ -261,7 +214,7 @@ index 5396e7cb24..903c0f2e9f 100644
      object_class_property_add_bool(oc, "secure", virt_get_secure,
                                     virt_set_secure);
      object_class_property_set_description(oc, "secure",
-@@ -3123,6 +3141,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3284,6 +3323,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                            "Set on/off to enable/disable emulating a "
                                            "guest CPU which implements the ARM "
                                            "Virtualization Extensions");
@@ -269,7 +222,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
      object_class_property_add_bool(oc, "highmem", virt_get_highmem,
                                     virt_set_highmem);
-@@ -3130,12 +3149,14 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3291,12 +3331,14 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                            "Set on/off to enable/disable using "
                                            "physical address space above 32 bits");
  
@@ -284,7 +237,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
      object_class_property_add_bool(oc, "highmem-redists",
                                     virt_get_highmem_redists,
-@@ -3163,7 +3184,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3332,7 +3374,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                    virt_set_gic_version);
      object_class_property_set_description(oc, "gic-version",
                                            "Set GIC version. "
@@ -293,7 +246,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
      object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
      object_class_property_set_description(oc, "iommu",
-@@ -3183,11 +3204,13 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3352,11 +3394,13 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                            "Set on/off to enable/disable reporting host memory errors "
                                            "to a KVM guest using ACPI and guest external abort exceptions");
  
@@ -307,7 +260,7 @@ index 5396e7cb24..903c0f2e9f 100644
  
      object_class_property_add_bool(oc, "its", virt_get_its,
                                     virt_set_its);
-@@ -3195,6 +3218,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3364,6 +3408,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                            "Set on/off to enable/disable "
                                            "ITS instantiation");
  
@@ -315,7 +268,7 @@ index 5396e7cb24..903c0f2e9f 100644
      object_class_property_add_bool(oc, "dtb-randomness",
                                     virt_get_dtb_randomness,
                                     virt_set_dtb_randomness);
-@@ -3207,6 +3231,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3376,6 +3421,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
                                     virt_set_dtb_randomness);
      object_class_property_set_description(oc, "dtb-kaslr-seed",
                                            "Deprecated synonym of dtb-randomness");
@@ -323,16 +276,29 @@ index 5396e7cb24..903c0f2e9f 100644
  
      object_class_property_add_str(oc, "x-oem-id",
                                    virt_get_oem_id,
-@@ -3554,3 +3579,39 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3645,3 +3691,52 @@ static void virt_machine_4_1_options(MachineClass *mc)
  }
- DEFINE_VIRT_MACHINE(2, 6)
+ DEFINE_VIRT_MACHINE(4, 1)
  #endif /* disabled for RHEL */
 +
++static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
++{
++}
++DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
++
 +static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
 +{
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++    virt_rhel_machine_9_6_0_options(mc);
++
++    /* From virt_machine_9_0_options() */
++    mc->smbios_memory_device_size = 16 * GiB;
++    vmc->manufacturer_product_compat = true;
++
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 +}
-+DEFINE_VIRT_MACHINE_AS_LATEST(9, 4, 0)
++DEFINE_VIRT_MACHINE(9, 4, 0)
 +
 +static void virt_rhel_machine_9_2_0_options(MachineClass *mc)
 +{
@@ -363,6 +329,50 @@ index 5396e7cb24..903c0f2e9f 100644
 +    vmc->no_highmem_compact = true;
 +}
 +DEFINE_VIRT_MACHINE(9, 0, 0)
--- 
-2.39.3
-
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 7a7317941b..2e69dc40f0 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -288,6 +288,15 @@ GlobalProperty hw_compat_2_6[] = {
+ };
+ const size_t hw_compat_2_6_len = G_N_ELEMENTS(hw_compat_2_6);
+ 
++/* Apply this to all RHEL9 boards going backward and forward */
++GlobalProperty hw_compat_rhel_9[] = {
++    /* supported by userspace, but RHEL 9 *kernels* do not support USO. */
++    { TYPE_VIRTIO_NET, "host_uso", "off"},
++    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
++    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
++};
++const size_t hw_compat_rhel_9_len = G_N_ELEMENTS(hw_compat_rhel_9);
++
+ /*
+  * RHEL only: machine types for previous major releases are deprecated
+  */
+@@ -324,12 +333,6 @@ GlobalProperty hw_compat_rhel_9_5[] = {
+ const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
+ 
+ GlobalProperty hw_compat_rhel_9_4[] = {
+-  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
+-    { TYPE_VIRTIO_NET, "host_uso", "off"},
+-  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
+-    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
+-  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
+-    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
+   /* hw_compat_rhel_9_4 from hw_compat_8_1 */
+      { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
+   /* hw_compat_rhel_9_4 from hw_compat_8_1 */
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 1e03667fd1..025f6899a7 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -856,6 +856,9 @@ extern const size_t hw_compat_2_7_len;
+ extern GlobalProperty hw_compat_2_6[];
+ extern const size_t hw_compat_2_6_len;
+ 
++extern GlobalProperty hw_compat_rhel_9[];
++extern const size_t hw_compat_rhel_9_len;
++
+ extern GlobalProperty hw_compat_rhel_9_6[];
+ extern const size_t hw_compat_rhel_9_6_len;
+ 
diff --git a/0012-Add-downstream-ppc64-versioned-spapr-machine-types.patch b/0009-Add-downstream-ppc64-versioned-spapr-machine-types.patch
similarity index 89%
rename from 0012-Add-downstream-ppc64-versioned-spapr-machine-types.patch
rename to 0009-Add-downstream-ppc64-versioned-spapr-machine-types.patch
index fb56514..cc37c2f 100644
--- a/0012-Add-downstream-ppc64-versioned-spapr-machine-types.patch
+++ b/0009-Add-downstream-ppc64-versioned-spapr-machine-types.patch
@@ -1,7 +1,7 @@
-From 676f3da2fc29ae71ed4189483b86e3c6496b8905 Mon Sep 17 00:00:00 2001
+From b6f5f329f080993e5f8e26ca376331479bef4ca7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:44:31 +0100
-Subject: Add downstream ppc64 versioned 'spapr' machine types
+Subject: [PATCH] Add downstream ppc64 versioned 'spapr' machine types
 
 Adding changes to add RHEL machine types for ppc64 architecture.
 
@@ -34,13 +34,13 @@ Merged patches (7.1.0):
  target/ppc/cpu.h        |   1 +
  target/ppc/kvm.c        |  27 +++++
  target/ppc/kvm_ppc.h    |  13 ++
- 7 files changed, 317 insertions(+), 6 deletions(-)
+ 7 files changed, 318 insertions(+), 5 deletions(-)
 
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index b48a2afc38..29e66f1b3f 100644
+index 6a5f75af7d..17b6bc6157 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1746,6 +1746,13 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+@@ -1717,6 +1717,13 @@ static void spapr_machine_reset(MachineState *machine, ResetType type)
      }
      spapr_caps_apply(spapr);
      spapr_nested_reset(spapr);
@@ -54,7 +54,7 @@ index b48a2afc38..29e66f1b3f 100644
  
      first_ppc_cpu = POWERPC_CPU(first_cpu);
      if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3452,6 +3459,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3408,6 +3415,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
      spapr->host_serial = g_strdup(value);
  }
  
@@ -75,7 +75,7 @@ index b48a2afc38..29e66f1b3f 100644
  static void spapr_instance_init(Object *obj)
  {
      SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3530,6 +3551,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3486,6 +3507,12 @@ static void spapr_instance_init(Object *obj)
          spapr_get_host_serial, spapr_set_host_serial);
      object_property_set_description(obj, "host-serial",
          "Host serial number to advertise in guest device tree");
@@ -88,7 +88,7 @@ index b48a2afc38..29e66f1b3f 100644
  }
  
  static void spapr_machine_finalizefn(Object *obj)
-@@ -4775,6 +4802,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4701,6 +4728,7 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
      vmc->client_architecture_support = spapr_vof_client_architecture_support;
      vmc->quiesce = spapr_vof_quiesce;
      vmc->setprop = spapr_vof_setprop;
@@ -96,7 +96,7 @@ index b48a2afc38..29e66f1b3f 100644
  }
  
  static const TypeInfo spapr_machine_info = {
-@@ -4830,12 +4858,12 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4756,11 +4784,14 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
      }                                                                \
      type_init(MACHINE_VER_SYM(register, spapr, __VA_ARGS__))
  
@@ -104,8 +104,6 @@ index b48a2afc38..29e66f1b3f 100644
 -    DEFINE_SPAPR_MACHINE_IMPL(true, major, minor)
 -#define DEFINE_SPAPR_MACHINE(major, minor) \
 -    DEFINE_SPAPR_MACHINE_IMPL(false, major, minor)
--#define DEFINE_SPAPR_MACHINE_TAGGED(major, minor, tag) \
--    DEFINE_SPAPR_MACHINE_IMPL(false, major, minor, _, tag)
 +#define DEFINE_SPAPR_MACHINE_AS_LATEST(major, minor, micro) \
 +    DEFINE_SPAPR_MACHINE_IMPL(true, major, minor, micro)
 +#define DEFINE_SPAPR_MACHINE(major, minor, micro) \
@@ -113,10 +111,20 @@ index b48a2afc38..29e66f1b3f 100644
 +#define DEFINE_SPAPR_MACHINE_TAGGED(major, minor, micro, tag) \
 +    DEFINE_SPAPR_MACHINE_IMPL(false, major, minor, micro, _, tag)
  
- #if 0 /* Disabled for Red Hat Enterprise Linux */
++#if 0 /* Disabled for Red Hat Enterprise Linux */
  /*
-@@ -5386,6 +5414,220 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
- DEFINE_SPAPR_MACHINE(2, 1);
+  * pseries-10.1
+  */
+@@ -4793,7 +4824,6 @@ static void spapr_machine_9_2_class_options(MachineClass *mc)
+ 
+ DEFINE_SPAPR_MACHINE(9, 2);
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ /*
+  * pseries-9.1
+  */
+@@ -5072,6 +5102,220 @@ static void spapr_machine_3_0_class_options(MachineClass *mc)
+ DEFINE_SPAPR_MACHINE(3, 0);
  #endif /* disabled for RHEL */
  
 +static void spapr_rhel_machine_default_class_options(MachineClass *mc)
@@ -337,18 +345,18 @@ index b48a2afc38..29e66f1b3f 100644
  {
      type_register_static(&spapr_machine_info);
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 0bf7c52077..c845f4acef 100644
+index aaee248290..e70317c6bc 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
 @@ -25,6 +25,7 @@
- #include "sysemu/reset.h"
- #include "sysemu/hw_accel.h"
+ #include "system/reset.h"
+ #include "system/hw_accel.h"
  #include "qemu/error-report.h"
 +#include "cpu-models.h"
  
  static void spapr_reset_vcpu(PowerPCCPU *cpu)
  {
-@@ -264,6 +265,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -268,6 +269,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
  {
      CPUPPCState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
@@ -356,7 +364,7 @@ index 0bf7c52077..c845f4acef 100644
  
      if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
          return false;
-@@ -280,6 +282,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -286,6 +288,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
      /* Set time-base frequency to 512 MHz. vhyp must be set first. */
      cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
  
@@ -375,10 +383,10 @@ index 0bf7c52077..c845f4acef 100644
          qdev_unrealize(DEVICE(cpu));
          return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index f6de3e9972..fc48348747 100644
+index 39bd5bd5ed..1bce0a59e0 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -157,6 +157,7 @@ struct SpaprMachineClass {
+@@ -156,6 +156,7 @@ struct SpaprMachineClass {
      bool pre_5_2_numa_associativity;
      bool pre_6_2_numa_affinity;
  
@@ -397,10 +405,10 @@ index f6de3e9972..fc48348747 100644
      char *kvm_type;
      char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
-index ebef2cccec..ab7ed76806 100644
+index 55de3bd5d5..1bf6994da7 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
-@@ -114,6 +114,17 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
+@@ -121,6 +121,17 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
      return NULL;
  }
  
@@ -419,10 +427,10 @@ index ebef2cccec..ab7ed76806 100644
                         uint32_t min_compat_pvr, uint32_t max_compat_pvr)
  {
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 321ed2da75..e35a997628 100644
+index 6b90543811..774565054b 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1673,6 +1673,7 @@ static inline int ppc_env_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1684,6 +1684,7 @@ static inline int ppc_env_mmu_index(CPUPPCState *env, bool ifetch)
  
  /* Compatibility modes */
  #if defined(TARGET_PPC64)
@@ -431,26 +439,26 @@ index 321ed2da75..e35a997628 100644
                        uint32_t min_compat_pvr, uint32_t max_compat_pvr);
  bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 907dba60d1..c942ff55b2 100644
+index 015658049e..d2d442ff5e 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
-@@ -92,6 +92,7 @@ static int cap_large_decr;
- static int cap_fwnmi;
+@@ -93,6 +93,7 @@ static int cap_fwnmi;
  static int cap_rpt_invalidate;
  static int cap_ail_mode_3;
+ static int cap_dawr1;
 +static int cap_ppc_secure_guest;
  
  #ifdef CONFIG_PSERIES
  static int cap_papr;
-@@ -150,6 +151,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -151,6 +152,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
      cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
      kvmppc_get_cpu_characteristics(s);
      cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
 +    cap_ppc_secure_guest = kvm_vm_check_extension(s, KVM_CAP_PPC_SECURE_GUEST);
      cap_large_decr = kvmppc_get_dec_bits();
      cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
-     /*
-@@ -2597,6 +2599,16 @@ bool kvmppc_supports_ail_3(void)
+     cap_dawr1 = kvm_vm_check_extension(s, KVM_CAP_PPC_DAWR1);
+@@ -2613,6 +2615,16 @@ bool kvmppc_supports_ail_3(void)
      return cap_ail_mode_3;
  }
  
@@ -467,7 +475,7 @@ index 907dba60d1..c942ff55b2 100644
  PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
  {
      uint32_t host_pvr = mfpvr();
-@@ -3012,3 +3024,18 @@ static void kvm_cpu_accel_register_types(void)
+@@ -3028,3 +3040,18 @@ static void kvm_cpu_accel_register_types(void)
      type_register_static(&kvm_cpu_accel_type_info);
  }
  type_init(kvm_cpu_accel_register_types);
@@ -487,7 +495,7 @@ index 907dba60d1..c942ff55b2 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 1975fb5ee6..d1017f98be 100644
+index a1d9ce9f9a..2176f7fa6c 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
 @@ -46,6 +46,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
@@ -498,7 +506,7 @@ index 1975fb5ee6..d1017f98be 100644
  bool kvmppc_spapr_use_multitce(void);
  int kvmppc_spapr_enable_inkernel_multitce(void);
  void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t page_shift,
-@@ -79,6 +80,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
+@@ -81,6 +82,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
  int kvmppc_has_cap_rpt_invalidate(void);
  bool kvmppc_supports_ail_3(void);
  int kvmppc_enable_hwrng(void);
@@ -507,7 +515,7 @@ index 1975fb5ee6..d1017f98be 100644
  int kvmppc_put_books_sregs(PowerPCCPU *cpu);
  PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
  void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -427,6 +430,16 @@ static inline bool kvmppc_supports_ail_3(void)
+@@ -437,6 +440,16 @@ static inline bool kvmppc_supports_ail_3(void)
      return false;
  }
  
@@ -524,6 +532,3 @@ index 1975fb5ee6..d1017f98be 100644
  static inline int kvmppc_enable_hwrng(void)
  {
      return -1;
--- 
-2.39.3
-
diff --git a/0013-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch b/0010-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
similarity index 84%
rename from 0013-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
rename to 0010-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
index adad3c7..bba4150 100644
--- a/0013-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
+++ b/0010-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
@@ -1,7 +1,8 @@
-From 450ae6631771593689f7f9c3eb2081e93d3e75c5 Mon Sep 17 00:00:00 2001
+From 8cd6ae0377f5b07272d17a9b30455a6f9d141c54 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:44:36 +0100
-Subject: Add downstream s390x versioned 's390-ccw-virtio' machine types
+Subject: [PATCH] Add downstream s390x versioned 's390-ccw-virtio' machine
+ types
 
 Adding changes to add RHEL machine types for s390x architecture.
 
@@ -48,26 +49,26 @@ Merged patches (8.2.0):
 Merged patches (9.1.0 rc0):
 - 043ad5ce97 Add upstream compatibility bits (partial)
 ---
- hw/s390x/s390-virtio-ccw.c       | 164 ++++++++++++++++++++++++++++++-
- target/s390x/cpu_models.c        |  11 +++
+ hw/s390x/s390-virtio-ccw.c       | 184 ++++++++++++++++++++++++++++++-
+ target/s390x/cpu_models.c        |  11 ++
  target/s390x/cpu_models.h        |   2 +
- target/s390x/cpu_models_sysemu.c |   2 +
- 4 files changed, 174 insertions(+), 5 deletions(-)
+ target/s390x/cpu_models_system.c |   2 +
+ 4 files changed, 194 insertions(+), 5 deletions(-)
 
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 86bfc9d2eb..72e1279db9 100644
+index 022376376e..46161d16a5 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -837,7 +837,7 @@ static const TypeInfo ccw_machine_info = {
+@@ -883,7 +883,7 @@ static const TypeInfo ccw_machine_info = {
      {                                                                         \
          MachineClass *mc = MACHINE_CLASS(oc);                                 \
          MACHINE_VER_SYM(class_options, ccw, __VA_ARGS__)(mc);                 \
 -        mc->desc = "Virtual s390x machine (version " MACHINE_VER_STR(__VA_ARGS__) ")"; \
 +        mc->desc = "Virtual s390x machine (version rhel" MACHINE_VER_STR(__VA_ARGS__) ")"; \
+         mc->init = MACHINE_VER_SYM(mach_init, ccw, __VA_ARGS__);              \
          MACHINE_VER_DEPRECATION(__VA_ARGS__);                                 \
          if (latest) {                                                         \
-             mc->alias = "s390-ccw-virtio";                                    \
-@@ -864,11 +864,11 @@ static const TypeInfo ccw_machine_info = {
+@@ -904,11 +904,11 @@ static const TypeInfo ccw_machine_info = {
      }                                                                         \
      type_init(MACHINE_VER_SYM(register, ccw, __VA_ARGS__))
  
@@ -83,19 +84,39 @@ index 86bfc9d2eb..72e1279db9 100644
  
  
  #if 0 /* Disabled for Red Hat Enterprise Linux */
-@@ -1308,6 +1308,160 @@ DEFINE_CCW_MACHINE(2, 4);
- #endif
+@@ -1169,6 +1169,180 @@ static void ccw_machine_4_2_class_options(MachineClass *mc)
+ DEFINE_CCW_MACHINE(4, 2);
  #endif /* disabled for RHEL */
  
++static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
++{
++}
++
++static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
++{
++    /* NB: remember to move this line to the *latest* RHEL 9 machine */
++    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++}
++DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
++
 +static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
 +{
++    ccw_rhel_machine_9_6_0_instance_options(machine);
 +}
 +
 +static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
 +{
++    static GlobalProperty compat[] = {
++        { TYPE_QEMU_S390_FLIC, "migrate-all-state", "off", },
++    };
++
++    ccw_rhel_machine_9_6_0_class_options(mc);
++
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
++    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +}
-+DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
++DEFINE_CCW_MACHINE(9, 4, 0);
 +
 +static void ccw_rhel_machine_9_2_0_instance_options(MachineState *machine)
 +{
@@ -217,7 +238,7 @@ index 86bfc9d2eb..72e1279db9 100644
 +
 +static void ccw_rhel_machine_7_6_0_instance_options(MachineState *machine)
 +{
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
++    static const S390FeatInit qemu_cpu_feat = { };
 +
 +    ccw_rhel_machine_8_2_0_instance_options(machine);
 +
@@ -245,7 +266,7 @@ index 86bfc9d2eb..72e1279db9 100644
  {
      type_register_static(&ccw_machine_info);
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index a27f4b6f79..9ee30310c6 100644
+index 954a7a99a9..570630a4dd 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
 @@ -47,6 +47,9 @@
@@ -258,8 +279,8 @@ index a27f4b6f79..9ee30310c6 100644
  static S390CPUDef s390_cpu_defs[] = {
      /*
       * Linux requires at least z10 nowadays, and IBM only supports recent CPUs
-@@ -871,22 +874,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
- static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
+@@ -931,22 +934,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, const void *data)
+ static void s390_base_cpu_model_class_init(ObjectClass *oc, const void *data)
  {
      S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
@@ -274,7 +295,7 @@ index a27f4b6f79..9ee30310c6 100644
 +    }
  }
  
- static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
+ static void s390_cpu_model_class_init(ObjectClass *oc, const void *data)
  {
      S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
@@ -288,9 +309,9 @@ index a27f4b6f79..9ee30310c6 100644
 +    }
  }
  
- static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
+ static void s390_qemu_cpu_model_class_init(ObjectClass *oc, const void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
-index 71d4bc2dd4..d6c7c2cb50 100644
+index f701bc0b53..670a567c67 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
 @@ -38,6 +38,8 @@ typedef struct S390CPUDef {
@@ -302,10 +323,10 @@ index 71d4bc2dd4..d6c7c2cb50 100644
  } S390CPUDef;
  
  /* CPU model based on a CPU definition */
-diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index 72572726b8..707d546ca1 100644
---- a/target/s390x/cpu_models_sysemu.c
-+++ b/target/s390x/cpu_models_sysemu.c
+diff --git a/target/s390x/cpu_models_system.c b/target/s390x/cpu_models_system.c
+index 7e06c75e6f..5fe1c6dd42 100644
+--- a/target/s390x/cpu_models_system.c
++++ b/target/s390x/cpu_models_system.c
 @@ -59,6 +59,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
      CpuDefinitionInfo *info;
      char *name = g_strdup(object_class_get_name(klass));
@@ -322,6 +343,3 @@ index 72572726b8..707d546ca1 100644
      /* check for unavailable features */
      if (cpu_list_data->model) {
          Object *obj;
--- 
-2.39.3
-
diff --git a/0014-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch b/0011-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
similarity index 82%
rename from 0014-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
rename to 0011-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
index 7959d6d..ab66480 100644
--- a/0014-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
+++ b/0011-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
@@ -1,7 +1,7 @@
-From a7d5687a80eca95a1c39b73bebb9d478f3adfb0c Mon Sep 17 00:00:00 2001
+From f730e8ae9b16a6fd9c2a77965228706a9bd61cb3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:44:41 +0100
-Subject: Add downstream x86_64 versioned 'pc' & 'q35' machine types
+Subject: [PATCH] Add downstream x86_64 versioned 'pc' & 'q35' machine types
 
 Adding changes to add RHEL machine types for x86_64 architecture.
 
@@ -77,22 +77,22 @@ Merged patches (9.1.0 rc2):
 - 0b6825631a i386/sev: Don't allow automatic fallback to legacy KVM_SEV*_INIT (partial)
 ---
  hw/i386/fw_cfg.c           |   2 +-
- hw/i386/pc.c               | 167 +++++++++++++++++++++++++++++-
- hw/i386/pc_piix.c          | 105 ++++++++++++++++++-
- hw/i386/pc_q35.c           | 207 +++++++++++++++++++++++++++++++++++--
+ hw/i386/pc.c               | 175 ++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c          | 120 ++++++++++++++++++-
+ hw/i386/pc_q35.c           | 237 +++++++++++++++++++++++++++++++++++--
  include/hw/boards.h        |   2 +
- include/hw/i386/pc.h       |  36 +++++++
+ include/hw/i386/pc.h       |  39 ++++++
  target/i386/cpu.c          |  21 ++++
  target/i386/kvm/kvm-cpu.c  |   1 +
  target/i386/kvm/kvm.c      |   4 +
  tests/qtest/pvpanic-test.c |   5 +-
- 10 files changed, 537 insertions(+), 13 deletions(-)
+ 10 files changed, 589 insertions(+), 17 deletions(-)
 
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 33ef280420..a322709ffa 100644
+index 07df7281d2..8009f5f31f 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
-@@ -73,7 +73,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+@@ -75,7 +75,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
  
      if (pcmc->smbios_defaults) {
          /* These values are guest ABI, do not change */
@@ -102,10 +102,10 @@ index 33ef280420..a322709ffa 100644
      }
  
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 7779c88a91..fa0e42d072 100644
+index 2f58e73d33..1b351085c0 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -276,6 +276,169 @@ const size_t pc_compat_2_4_len = G_N_ELEMENTS(pc_compat_2_4);
+@@ -273,6 +273,177 @@ const size_t pc_compat_2_6_len = G_N_ELEMENTS(pc_compat_2_6);
   */
  #define PC_FW_DATA (0x20000 + 0x8000)
  
@@ -131,6 +131,14 @@ index 7779c88a91..fa0e42d072 100644
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
++GlobalProperty pc_rhel_9_6_compat[] = {
++    /* pc_rhel_9_6_compat from pc_compat_9_0 */
++    { TYPE_X86_CPU, "x-amd-topoext-features-only", "false" },
++    { TYPE_X86_CPU, "x-l1-cache-per-thread", "false" },
++    { TYPE_X86_CPU, "legacy-multi-node", "on" },
++};
++const size_t pc_rhel_9_6_compat_len = G_N_ELEMENTS(pc_rhel_9_6_compat);
++
 +GlobalProperty pc_rhel_9_5_compat[] = {
 +    /* pc_rhel_9_5_compat from pc_compat_pc_9_0 (backported from 9.1) */
 +    { TYPE_X86_CPU, "guest-phys-bits", "0" },
@@ -275,7 +283,7 @@ index 7779c88a91..fa0e42d072 100644
  GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
  {
      GSIState *s;
-@@ -1767,6 +1930,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1754,6 +1925,7 @@ static void pc_machine_class_init(ObjectClass *oc, const void *data)
      pcmc->kvmclock_create_always = true;
      x86mc->apic_xrupt_override = true;
      assert(!mc->get_hotplug_handler);
@@ -283,7 +291,7 @@ index 7779c88a91..fa0e42d072 100644
      mc->get_hotplug_handler = pc_get_hotplug_handler;
      mc->hotplug_allowed = pc_hotplug_allowed;
      mc->auto_enable_numa_with_memhp = true;
-@@ -1774,7 +1938,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1761,7 +1933,8 @@ static void pc_machine_class_init(ObjectClass *oc, const void *data)
      mc->has_hotpluggable_cpus = true;
      mc->default_boot_order = "cad";
      mc->block_default_type = IF_IDE;
@@ -294,29 +302,34 @@ index 7779c88a91..fa0e42d072 100644
      mc->wakeup = pc_machine_wakeup;
      hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 67107b174a..c93e78e896 100644
+index acf010e20f..d9fd4d207e 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -52,6 +52,7 @@
+@@ -53,6 +53,7 @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
- #include "sysemu/xen.h"
+ #include "system/xen.h"
 +#include "migration/migration.h"
  #ifdef CONFIG_XEN
  #include <xen/hvm/hvm_info_table.h>
  #include "hw/xen/xen_pt.h"
-@@ -445,8 +446,8 @@ static void pc_i440fx_init(MachineState *machine)
+@@ -469,11 +470,11 @@ static void pc_i440fx_init(MachineState *machine)
      pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
  }
  
 -#define DEFINE_I440FX_MACHINE(major, minor) \
--    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor);
+-    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, false, NULL, major, minor);
 +#define DEFINE_I440FX_MACHINE(major, minor, micro) \
-+    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor, micro);
++    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, false, NULL, major, minor, micro);
+ 
+-#define DEFINE_I440FX_MACHINE_AS_LATEST(major, minor) \
+-    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, true, "pc", major, minor);
++#define DEFINE_I440FX_MACHINE_AS_LATEST(major, minor, micro) \
++    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, true, "pc", major, minor, micro);
  
  #if 0 /* Disabled for Red Hat Enterprise Linux */
  static void pc_i440fx_machine_options(MachineClass *m)
-@@ -826,3 +827,103 @@ static void xenfv_machine_3_1_options(MachineClass *m)
+@@ -853,3 +854,114 @@ static void xenfv_machine_3_1_options(MachineClass *m)
  DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                    xenfv_machine_3_1_options);
  #endif
@@ -365,6 +378,9 @@ index 67107b174a..c93e78e896 100644
 +    pcmc->broken_32bit_mem_addr_check = true;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
++    /* From pc_i440fx_machine_9_0_options() */
++    m->smbios_memory_device_size = 16 * GiB;
++    pcmc->isa_bios_alias = false;
 +
 +    object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
 +                                   &PCSouthBridgeOption_lookup,
@@ -373,6 +389,10 @@ index 67107b174a..c93e78e896 100644
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
++    compat_props_add(m->compat_props, hw_compat_rhel_9_6,
++                     hw_compat_rhel_9_6_len);
++    compat_props_add(m->compat_props, pc_rhel_9_6_compat,
++		     pc_rhel_9_6_compat_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_5_compat,
 +		     pc_rhel_9_5_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
@@ -417,14 +437,34 @@ index 67107b174a..c93e78e896 100644
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
++    compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++
++    compat_props_add(m->compat_props,
++                     pc_piix_compat_defaults, pc_piix_compat_defaults_len);
 +}
 +
-+DEFINE_I440FX_MACHINE(7, 6, 0);
++DEFINE_I440FX_MACHINE_AS_LATEST(7, 6, 0);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 5fb283f2df..76f0ac1acd 100644
+index 2203ffd67e..3165d9bbfe 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -338,20 +338,19 @@ static void pc_q35_machine_options(MachineClass *m)
+@@ -340,11 +340,11 @@ static void pc_q35_init(MachineState *machine)
+ #endif
+ }
+ 
+-#define DEFINE_Q35_MACHINE(major, minor) \
+-    DEFINE_PC_VER_MACHINE(pc_q35, "pc-q35", pc_q35_init, false, NULL, major, minor);
++#define DEFINE_Q35_MACHINE(major, minor, micro) \
++    DEFINE_PC_VER_MACHINE(pc_q35, "pc-q35", pc_q35_init, false, NULL, major, minor, micro);
+ 
+-#define DEFINE_Q35_MACHINE_AS_LATEST(major, minor) \
+-    DEFINE_PC_VER_MACHINE(pc_q35, "pc-q35", pc_q35_init, false, "q35", major, minor);
++#define DEFINE_Q35_MACHINE_AS_LATEST(major, minor, micro) \
++    DEFINE_PC_VER_MACHINE(pc_q35, "pc-q35", pc_q35_init, false, "q35", major, minor, micro);
+ 
+ #define DEFINE_Q35_MACHINE_BUGFIX(major, minor, micro) \
+     DEFINE_PC_VER_MACHINE(pc_q35, "pc-q35", pc_q35_init, false, NULL, major, minor, micro);
+@@ -355,21 +355,21 @@ static void pc_q35_machine_options(MachineClass *m)
      pcmc->pci_root_uid = 0;
      pcmc->default_cpu_version = 1;
  
@@ -438,42 +478,67 @@ index 5fb283f2df..76f0ac1acd 100644
      m->default_nic = "e1000e";
 -    m->default_kernel_irqchip_split = false;
      m->no_floppy = 1;
--    m->max_cpus = 4096;
+     m->max_cpus = 4096;
 -    m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
-+    m->max_cpus = 710;
 +    m->no_parallel = 1;
++    m->alias = "q35";
      machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
      machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
      machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
--    machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
-+    m->alias = "q35";
+     machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
+     machine_class_allow_dynamic_sysbus_dev(m, TYPE_UEFI_VARS_X64);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
      compat_props_add(m->compat_props,
                       pc_q35_compat_defaults, pc_q35_compat_defaults_len);
  }
-@@ -670,3 +669,197 @@ static void pc_q35_machine_2_4_options(MachineClass *m)
+@@ -687,3 +687,222 @@ static void pc_q35_machine_2_6_options(MachineClass *m)
  
- DEFINE_Q35_MACHINE(2, 4);
+ DEFINE_Q35_MACHINE(2, 6);
  #endif /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
-+static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
++static void pc_q35_rhel_machine_9_6_0_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_options(m);
++    m->desc = "RHEL-9.6.0 PC (Q35 + ICH9, 2009)";
++    pcmc->smbios_stream_product = "RHEL";
++    pcmc->smbios_stream_version = "9.6.0";
++
++    /* NB: remember to move this line to the *latest* RHEL 9 machine */
++    compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++}
++
++DEFINE_Q35_MACHINE_AS_LATEST(9, 6, 0);
++
++static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
++{
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    pc_q35_rhel_machine_9_6_0_options(m);
++
++    /* older RHEL machines continue to support 710 vcpus */
++    m->max_cpus = 710;
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
++    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
-+    pcmc->isa_bios_alias = false;
 +
++    /* From pc_q35_machine_9_0_options() */
++    pcmc->isa_bios_alias = false;
++    m->smbios_memory_device_size = 16 * GiB;
++
++    compat_props_add(m->compat_props, hw_compat_rhel_9_6,
++                     hw_compat_rhel_9_6_len);
++    compat_props_add(m->compat_props, pc_rhel_9_6_compat,
++		     pc_rhel_9_6_compat_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_5_compat,
 +		     pc_rhel_9_5_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(9, 4, 0);
++DEFINE_Q35_MACHINE(9, 4, 0);
 +
 +static void pc_q35_rhel_machine_9_2_0_options(MachineClass *m)
 +{
@@ -501,7 +566,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +                     pc_rhel_9_2_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(9, 2, 0);
++DEFINE_Q35_MACHINE(9, 2, 0);
 +
 +static void pc_q35_rhel_machine_9_0_0_options(MachineClass *m)
 +{
@@ -520,7 +585,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +                     pc_rhel_9_0_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(9, 0, 0);
++DEFINE_Q35_MACHINE(9, 0, 0);
 +
 +static void pc_q35_rhel_machine_8_6_0_options(MachineClass *m)
 +{
@@ -535,7 +600,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +                     hw_compat_rhel_8_6_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 6, 0);
++DEFINE_Q35_MACHINE(8, 6, 0);
 +
 +static void pc_q35_rhel_machine_8_5_0_options(MachineClass *m)
 +{
@@ -552,7 +617,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +    m->smp_props.prefer_sockets = true;
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 5, 0);
++DEFINE_Q35_MACHINE(8, 5, 0);
 +
 +static void pc_q35_rhel_machine_8_4_0_options(MachineClass *m)
 +{
@@ -568,7 +633,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +                     pc_rhel_8_4_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 4, 0);
++DEFINE_Q35_MACHINE(8, 4, 0);
 +
 +static void pc_q35_rhel_machine_8_3_0_options(MachineClass *m)
 +{
@@ -588,7 +653,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +    pcmc->pci_root_uid = 1;
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 3, 0);
++DEFINE_Q35_MACHINE(8, 3, 0);
 +
 +static void pc_q35_rhel_machine_8_2_0_options(MachineClass *m)
 +{
@@ -606,7 +671,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +                     pc_rhel_8_2_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 2, 0);
++DEFINE_Q35_MACHINE(8, 2, 0);
 +
 +static void pc_q35_rhel_machine_8_1_0_options(MachineClass *m)
 +{
@@ -620,7 +685,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 1, 0);
++DEFINE_Q35_MACHINE(8, 1, 0);
 +
 +static void pc_q35_rhel_machine_8_0_0_options(MachineClass *m)
 +{
@@ -635,7 +700,7 @@ index 5fb283f2df..76f0ac1acd 100644
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(8, 0, 0);
++DEFINE_Q35_MACHINE(8, 0, 0);
 +
 +static void pc_q35_rhel_machine_7_6_0_options(MachineClass *m)
 +{
@@ -647,13 +712,13 @@ index 5fb283f2df..76f0ac1acd 100644
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
-+DEFINE_Q35_MACHINE_BUGFIX(7, 6, 0);
++DEFINE_Q35_MACHINE(7, 6, 0);
 +
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 32c4642f5a..85b43e3d0d 100644
+index 025f6899a7..ad077677f4 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -289,6 +289,8 @@ struct MachineClass {
+@@ -308,6 +308,8 @@ struct MachineClass {
      strList *allowed_dynamic_sysbus_devices;
      bool auto_enable_numa_with_memhp;
      bool auto_enable_numa_with_memdev;
@@ -663,16 +728,19 @@ index 32c4642f5a..85b43e3d0d 100644
      bool smbus_no_migration_support;
      bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 8776a3c937..75c9271cdd 100644
+index 3b4ea24c20..75c797bb0e 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -302,6 +302,42 @@ extern const size_t pc_compat_2_4_len;
- extern GlobalProperty pc_compat_2_3[];
- extern const size_t pc_compat_2_3_len;
+@@ -301,6 +301,45 @@ extern const size_t pc_compat_2_7_len;
+ extern GlobalProperty pc_compat_2_6[];
+ extern const size_t pc_compat_2_6_len;
  
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
++extern GlobalProperty pc_rhel_9_6_compat[];
++extern const size_t pc_rhel_9_6_compat_len;
++
 +extern GlobalProperty pc_rhel_9_5_compat[];
 +extern const size_t pc_rhel_9_5_compat_len;
 +
@@ -707,13 +775,13 @@ index 8776a3c937..75c9271cdd 100644
 +extern const size_t pc_rhel_7_6_compat_len;
 +
  #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
-     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
-     { \
+     static void pc_machine_##suffix##_class_init(ObjectClass *oc, \
+                                                  const void *data) \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 85ef7452c0..ed278dd4a1 100644
+index ac1c06c3f9..2c4ddd7c63 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
-@@ -2411,9 +2411,13 @@ static const CPUCaches epyc_genoa_cache_info = {
+@@ -3292,9 +3292,13 @@ static const CPUCaches yongfeng_cache_info = {
   *  PT in VMX operation
   */
  
@@ -727,7 +795,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 0xd,
          .vendor = CPUID_VENDOR_AMD,
          .family = 15,
-@@ -2434,6 +2438,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3315,6 +3319,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "phenom",
@@ -735,7 +803,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 5,
          .vendor = CPUID_VENDOR_AMD,
          .family = 16,
-@@ -2466,6 +2471,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3347,6 +3352,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "core2duo",
@@ -743,7 +811,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 10,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2508,6 +2514,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3389,6 +3395,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "kvm64",
@@ -751,7 +819,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 0xd,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 15,
-@@ -2549,6 +2556,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3430,6 +3437,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "qemu32",
@@ -759,7 +827,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 4,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2563,6 +2571,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3444,6 +3452,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "kvm32",
@@ -767,7 +835,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 5,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 15,
-@@ -2593,6 +2602,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3474,6 +3483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "coreduo",
@@ -775,7 +843,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 10,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2626,6 +2636,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3507,6 +3517,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "486",
@@ -783,7 +851,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 1,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 4,
-@@ -2638,6 +2649,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3520,6 +3531,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "pentium",
@@ -791,7 +859,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 1,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 5,
-@@ -2650,6 +2662,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3533,6 +3545,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "pentium2",
@@ -799,7 +867,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 2,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2662,6 +2675,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3546,6 +3559,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "pentium3",
@@ -807,7 +875,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 3,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2674,6 +2688,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3559,6 +3573,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "athlon",
@@ -815,7 +883,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 2,
          .vendor = CPUID_VENDOR_AMD,
          .family = 6,
-@@ -2689,6 +2704,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3574,6 +3589,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "n270",
@@ -823,7 +891,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 10,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2714,6 +2730,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3599,6 +3615,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "Conroe",
@@ -831,7 +899,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 10,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -2754,6 +2771,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -3639,6 +3656,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "Penryn",
@@ -839,7 +907,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 10,
          .vendor = CPUID_VENDOR_INTEL,
          .family = 6,
-@@ -4762,6 +4780,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -5846,6 +5864,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "Opteron_G1",
@@ -847,7 +915,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 5,
          .vendor = CPUID_VENDOR_AMD,
          .family = 15,
-@@ -4782,6 +4801,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -5866,6 +5885,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "Opteron_G2",
@@ -855,7 +923,7 @@ index 85ef7452c0..ed278dd4a1 100644
          .level = 5,
          .vendor = CPUID_VENDOR_AMD,
          .family = 15,
-@@ -4804,6 +4824,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+@@ -5888,6 +5908,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
      },
      {
          .name = "Opteron_G3",
@@ -864,10 +932,10 @@ index 85ef7452c0..ed278dd4a1 100644
          .vendor = CPUID_VENDOR_AMD,
          .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 6bf8dcfc60..684e731cbc 100644
+index 89a7953659..74c0b036e3 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
-@@ -178,6 +178,7 @@ static PropValue kvm_default_props[] = {
+@@ -175,6 +175,7 @@ static PropValue kvm_default_props[] = {
      { "acpi", "off" },
      { "monitor", "off" },
      { "svm", "off" },
@@ -876,10 +944,10 @@ index 6bf8dcfc60..684e731cbc 100644
  };
  
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 2fa88ef1e3..2b28c18693 100644
+index 369626f8c8..0eb39d22d6 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
-@@ -4244,6 +4244,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4389,6 +4389,7 @@ static int kvm_get_msrs(X86CPU *cpu)
      struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
      int ret, i;
      uint64_t mtrr_top_bits;
@@ -887,7 +955,7 @@ index 2fa88ef1e3..2b28c18693 100644
  
      kvm_msr_buf_reset(cpu);
  
-@@ -4636,6 +4637,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4786,6 +4787,9 @@ static int kvm_get_msrs(X86CPU *cpu)
              break;
          case MSR_KVM_ASYNC_PF_EN:
              env->async_pf_en_msr = msrs[i].data;
@@ -898,7 +966,7 @@ index 2fa88ef1e3..2b28c18693 100644
          case MSR_KVM_ASYNC_PF_INT:
              env->async_pf_int_msr = msrs[i].data;
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-index d49d2ba931..c18f63e255 100644
+index 5606baf47b..094c56b0cd 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
 @@ -18,7 +18,7 @@ static void test_panic_nopause(void)
@@ -920,6 +988,3 @@ index d49d2ba931..c18f63e255 100644
  
      val = qtest_inb(qts, 0x505);
      g_assert_cmpuint(val, ==, PVPANIC_EVENTS);
--- 
-2.39.3
-
diff --git a/0015-Revert-meson-temporarily-disable-Wunused-function.patch b/0012-Revert-meson-temporarily-disable-Wunused-function.patch
similarity index 76%
rename from 0015-Revert-meson-temporarily-disable-Wunused-function.patch
rename to 0012-Revert-meson-temporarily-disable-Wunused-function.patch
index e528ecf..95240e9 100644
--- a/0015-Revert-meson-temporarily-disable-Wunused-function.patch
+++ b/0012-Revert-meson-temporarily-disable-Wunused-function.patch
@@ -1,7 +1,7 @@
-From 2698c3de00b8736553112a037c7ffb5f5d9086b1 Mon Sep 17 00:00:00 2001
+From b96d91774d7358316cff003d0891c1cbc3857a3d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:47:04 +0100
-Subject: Revert "meson: temporarily disable -Wunused-function"
+Subject: [PATCH] Revert "meson: temporarily disable -Wunused-function"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -16,10 +16,10 @@ Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 2de5ab024f..b3529aa0e1 100644
+index 23494666d9..ef2e5be6e2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -651,7 +651,6 @@ warn_flags = [
+@@ -757,7 +757,6 @@ warn_flags = [
    '-Wno-string-plus-int',
    '-Wno-tautological-type-limit-compare',
    '-Wno-typedef-redefinition',
@@ -27,6 +27,3 @@ index 2de5ab024f..b3529aa0e1 100644
  ]
  
  if host_os != 'darwin'
--- 
-2.39.3
-
diff --git a/0016-Enable-make-check.patch b/0013-Enable-make-check.patch
similarity index 53%
rename from 0016-Enable-make-check.patch
rename to 0013-Enable-make-check.patch
index 0afff4e..61c54ea 100644
--- a/0016-Enable-make-check.patch
+++ b/0013-Enable-make-check.patch
@@ -1,121 +1,78 @@
-From b877c7926d84e264bcfa57e6797f997d400fb19d Mon Sep 17 00:00:00 2001
+From b442024a21912abc44edf9d305f1bdce863c6a3a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
-Subject: Enable make check
+Subject: [PATCH] Enable make check
 
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+fix test
 ---
-Rebase changes (6.1.0):
-- removed unnecessary test changes
+ tests/functional/meson.build                  |  2 +-
+ tests/functional/test_aarch64_tcg_plugins.py  |  2 +-
+ .../functional/test_x86_cpu_model_versions.py |  3 +-
+ tests/qemu-iotests/meson.build                | 34 +++++++++----------
+ tests/qemu-iotests/testenv.py                 |  3 ++
+ tests/qtest/arm-cpu-features.c                |  2 ++
+ tests/qtest/fuzz-e1000e-test.c                |  2 +-
+ tests/qtest/fuzz-virtio-scsi-test.c           |  2 +-
+ tests/qtest/intel-hda-test.c                  |  2 +-
+ tests/qtest/libqos/meson.build                |  2 +-
+ tests/qtest/lpc-ich9-test.c                   |  2 +-
+ tests/qtest/meson.build                       |  2 --
+ tests/qtest/pvpanic-test.c                    |  2 +-
+ tests/qtest/virtio-net-failover.c             |  1 +
+ 14 files changed, 33 insertions(+), 28 deletions(-)
 
-Rebase changes (6.2.0):
-- new way of disabling bios-table-test
-
-Rebase changes (7.0.0):
-- Disable testing virtio-iommu-pci
-- Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
-- Disable qtest-bios-table for aarch64
-- Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
-- Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
-- Use rhel machine type for new intel hda qtest
-- Remove unnecessary changes in iotest 051
-- Remove changes in bios-tables-test.c and prom-env-test.c qtests
-
-Rebase changes (7.1.0):
-- Disable bcm2835-dma-test (added upstream)
-
-Rebase changes (8.0.0):
-- Removed chunks for disabling bios-table-test (protected upstream)
-- Disable new qemu-iotests execution
-- Revert change in tco qtest (blocking test run)
-
-Rebase changes (8.1.0):
-- Do not disable device-plug-test for s390x
-
-Rebase changes (8.2.0 rc1):
-- Remove unneeded hack in qtest/usb-hcd-xhci-test.c
-
-Rebase changes (9.1.0 rc0):
-- use q35 for new pvpanic test
-
-Merged patches (6.1.0):
-- 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
-
-Merged patches (7.1.0):
-- 64d736640e RHEL-only: tests/avocado: Switch aarch64 tests from a53 to a57
-
-Merged patches (8.1.0):
-- f468163234 iotests: Use alternative CPU type that is not deprecated in RHEL
----
- .distro/Makefile                    |  2 +-
- .distro/qemu-kvm.spec.template      |  4 ++--
- .distro/scripts/process-patches.sh  |  3 +++
- tests/avocado/replay_kernel.py      |  2 +-
- tests/avocado/reverse_debugging.py  |  2 +-
- tests/avocado/tcg_plugins.py        |  4 ++--
- tests/qemu-iotests/meson.build      | 34 ++++++++++++++---------------
- tests/qemu-iotests/testenv.py       |  3 +++
- tests/qtest/fuzz-e1000e-test.c      |  2 +-
- tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
- tests/qtest/intel-hda-test.c        |  2 +-
- tests/qtest/libqos/meson.build      |  2 +-
- tests/qtest/lpc-ich9-test.c         |  2 +-
- tests/qtest/meson.build             |  1 -
- tests/qtest/pvpanic-test.c          |  2 +-
- tests/qtest/virtio-net-failover.c   |  1 +
- 16 files changed, 37 insertions(+), 31 deletions(-)
-
-diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index e22c200a36..cb7ca19b1b 100644
---- a/tests/avocado/replay_kernel.py
-+++ b/tests/avocado/replay_kernel.py
-@@ -193,7 +193,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index f24287cd0a..3880b81df6 100644
---- a/tests/avocado/reverse_debugging.py
-+++ b/tests/avocado/reverse_debugging.py
-@@ -228,7 +228,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
-index a6ff457e27..5172ee9b9e 100644
---- a/tests/avocado/tcg_plugins.py
-+++ b/tests/avocado/tcg_plugins.py
-@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
+diff --git a/tests/functional/meson.build b/tests/functional/meson.build
+index 311c6f1806..c7f9051c90 100644
+--- a/tests/functional/meson.build
++++ b/tests/functional/meson.build
+@@ -319,7 +319,7 @@ tests_sparc64_system_thorough = [
+ 
+ tests_x86_64_system_quick = [
+   'cpu_queries',
+-  'mem_addr_space',
++#  'mem_addr_space',
+   'migration',
+   'pc_cpu_hotplug_props',
+   'virtio_version',
+diff --git a/tests/functional/test_aarch64_tcg_plugins.py b/tests/functional/test_aarch64_tcg_plugins.py
+index cb7e9298fb..a5560cedb9 100755
+--- a/tests/functional/test_aarch64_tcg_plugins.py
++++ b/tests/functional/test_aarch64_tcg_plugins.py
+@@ -64,7 +64,7 @@ class PluginKernelNormal(PluginKernelBase):
+ 
+     def test_aarch64_virt_insn(self):
+         self.set_machine('virt')
+-        self.cpu='cortex-a53'
++        self.cpu='cortex-a57'
+         kernel_path = self.ASSET_KERNEL.fetch()
          kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -96,7 +96,7 @@ def test_aarch64_virt_insn_icount(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
+                                'console=ttyAMA0')
+diff --git a/tests/functional/test_x86_cpu_model_versions.py b/tests/functional/test_x86_cpu_model_versions.py
+index 36c968f1c0..01213d9c14 100755
+--- a/tests/functional/test_x86_cpu_model_versions.py
++++ b/tests/functional/test_x86_cpu_model_versions.py
+@@ -23,7 +23,7 @@
+ 
+ import re
+ 
+-from qemu_test import QemuSystemTest
++from qemu_test import QemuSystemTest, skipFlakyTest
+ 
+ class X86CPUModelAliases(QemuSystemTest):
+     """
+@@ -72,6 +72,7 @@ def validate_variant_aliases(self, cpus):
+         self.assertNotIn("EPYC-IBPB-v1", cpus,
+                          "EPYC-IBPB shouldn't be versioned")
+ 
++    @skipFlakyTest("Incompatible with RHEL 7.6.0 machine")
+     def test_unversioned_alias(self):
          """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+         Check if unversioned CPU model is an alias pointing to right version
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
 index fad340ad59..3c0d5241f6 100644
 --- a/tests/qemu-iotests/meson.build
@@ -160,10 +117,10 @@ index fad340ad59..3c0d5241f6 100644
 +#  endforeach
  endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
-index c8848f2ec2..d515e5b8b0 100644
+index 6326e46b7b..bc849ae9cf 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
-@@ -249,6 +249,9 @@ def __init__(self, source_dir: str, build_dir: str,
+@@ -252,6 +252,9 @@ def __init__(self, source_dir: str, build_dir: str,
              if self.qemu_prog.endswith(f'qemu-system-{suffix}'):
                  self.qemu_options += f' -machine {machine}'
  
@@ -173,6 +130,26 @@ index c8848f2ec2..d515e5b8b0 100644
          # QEMU_DEFAULT_MACHINE
          self.qemu_default_machine = get_default_machine(self.qemu_prog)
  
+diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
+index 2d3304bb4a..ddb9fd1a4b 100644
+--- a/tests/qtest/arm-cpu-features.c
++++ b/tests/qtest/arm-cpu-features.c
+@@ -416,6 +416,7 @@ static void sve_tests_sve_off_kvm(const void *data)
+ 
+ static void pauth_tests_default(QTestState *qts, const char *cpu_type)
+ {
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     assert_has_feature_enabled(qts, cpu_type, "pauth");
+     assert_has_feature_disabled(qts, cpu_type, "pauth-impdef");
+     assert_has_feature_disabled(qts, cpu_type, "pauth-qarma3");
+@@ -428,6 +429,7 @@ static void pauth_tests_default(QTestState *qts, const char *cpu_type)
+     assert_set_feature(qts, cpu_type, "pauth-qarma3", false);
+     assert_set_feature(qts, cpu_type, "pauth-qarma5", true);
+     assert_set_feature(qts, cpu_type, "pauth-qarma5", false);
++#endif /* disabled for RHEL */
+     assert_error(qts, cpu_type,
+                  "cannot enable pauth-impdef, pauth-qarma3 or pauth-qarma5 without pauth",
+                  "{ 'pauth': false, 'pauth-impdef': true }");
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 5052883fb6..b5286f4b12 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
@@ -213,10 +190,10 @@ index 663bb6c485..2efc43e3f7 100644
                     "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
  
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
-index 1b2b2dbb22..86afbddb58 100644
+index 1ddaf7b095..1cb403e90d 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
-@@ -44,7 +44,7 @@ libqos_srcs = files(
+@@ -43,7 +43,7 @@ libqos_srcs = files(
          'virtio-rng.c',
          'virtio-scsi.c',
          'virtio-serial.c',
@@ -239,19 +216,23 @@ index 8ac95b89f7..cd2102555c 100644
  
      qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index 2f0d3ef080..44ee791508 100644
+index 669d07c06b..b6b1e920bc 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -102,7 +102,6 @@ qtests_i386 = \
-    'drive_del-test',
-    'tco-test',
-    'cpu-plug-test',
--   'q35-test',
-    'vmgenid-test',
-    'migration-test',
-    'test-x86-cpuid-compat',
+@@ -90,11 +90,9 @@ qtests_i386 = \
+   (config_all_devices.has_key('CONFIG_LSI_SCSI_PCI') ? ['fuzz-lsi53c895a-test'] : []) +     \
+   (config_all_devices.has_key('CONFIG_VIRTIO_SCSI') ? ['fuzz-virtio-scsi-test'] : []) +     \
+   (config_all_devices.has_key('CONFIG_VIRTIO_BALLOON') ? ['virtio-balloon-test'] : []) + \
+-  (config_all_devices.has_key('CONFIG_Q35') ? ['q35-test'] : []) +                          \
+   (config_all_devices.has_key('CONFIG_SB16') ? ['fuzz-sb16-test'] : []) +                   \
+   (config_all_devices.has_key('CONFIG_SDHCI_PCI') ? ['fuzz-sdcard-test'] : []) +            \
+   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
+-  (config_all_devices.has_key('CONFIG_VTD') ? ['intel-iommu-test'] : []) +                 \
+   (host_os != 'windows' and                                                                \
+    config_all_devices.has_key('CONFIG_ACPI_ERST') ? ['erst-test'] : []) +                   \
+   (config_all_devices.has_key('CONFIG_PCIE_PORT') and                                       \
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-index c18f63e255..57fb129ae4 100644
+index 094c56b0cd..338f94dcd9 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
 @@ -65,7 +65,7 @@ static void test_pvshutdown(void)
@@ -264,10 +245,10 @@ index c18f63e255..57fb129ae4 100644
      val = qtest_inb(qts, 0x505);
      g_assert_cmpuint(val, ==, PVPANIC_EVENTS);
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
-index 73dfabc272..a9dd304781 100644
+index 5baf81c3e6..aa87bf5698 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
-@@ -26,6 +26,7 @@
+@@ -27,6 +27,7 @@
  #define PCI_SEL_BASE            0x0010
  
  #define BASE_MACHINE "-M q35 -nodefaults " \
@@ -275,6 +256,3 @@ index 73dfabc272..a9dd304781 100644
      "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
      "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
  
--- 
-2.39.3
-
diff --git a/0017-vfio-cap-number-of-devices-that-can-be-assigned.patch b/0014-vfio-cap-number-of-devices-that-can-be-assigned.patch
similarity index 64%
rename from 0017-vfio-cap-number-of-devices-that-can-be-assigned.patch
rename to 0014-vfio-cap-number-of-devices-that-can-be-assigned.patch
index b18c2bd..6987fa9 100644
--- a/0017-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0014-vfio-cap-number-of-devices-that-can-be-assigned.patch
@@ -1,7 +1,7 @@
-From a30996377bd8b1316cd79ac482b4f9ae9a50c31d Mon Sep 17 00:00:00 2001
+From e4d1359a325c1c91fff5c8701ddaa5c74266bb39 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
-Date: Tue, 3 Dec 2013 20:05:13 +0100
-Subject: vfio: cap number of devices that can be assigned
+Date: Mon, 29 Sep 2025 11:47:21 +0200
+Subject: [PATCH] vfio: cap number of devices that can be assigned
 
 RH-Author: Bandan Das <bsd@redhat.com>
 Message-id: <1386101113-31560-3-git-send-email-bsd@redhat.com>
@@ -30,15 +30,42 @@ Signed-off-by: Bandan Das <bsd@redhat.com>
 Rebase changes (8.2.0):
 - Update to upstream changes
 ---
- hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
- hw/vfio/pci.h |  1 +
- 2 files changed, 31 insertions(+), 1 deletion(-)
+ hw/vfio/container.c           | 14 ++++++++++++++
+ hw/vfio/pci.c                 | 21 +++++++++++++++++++++
+ hw/vfio/pci.h                 |  1 +
+ include/hw/vfio/vfio-device.h |  1 +
+ 4 files changed, 37 insertions(+)
 
+diff --git a/hw/vfio/container.c b/hw/vfio/container.c
+index 3e13feaa74..b912b9396b 100644
+--- a/hw/vfio/container.c
++++ b/hw/vfio/container.c
+@@ -44,6 +44,20 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
+ static VFIOGroupList vfio_group_list =
+     QLIST_HEAD_INITIALIZER(vfio_group_list);
+ 
++int vfio_device_count(void)
++{
++    int i = 0;
++    VFIOGroup *group;
++    VFIODevice *vbasedev_iter;
++
++    QLIST_FOREACH(group, &vfio_group_list, next) {
++        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
++            i++;
++        }
++    }
++    return i;
++}
++
+ static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
+ {
+     switch (container->iommu_type) {
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 2407720c35..82a47edc89 100644
+index 07257d0fa0..48da233cb2 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -50,6 +50,9 @@
+@@ -52,6 +52,9 @@
  /* Protected by BQL */
  static KVMRouteChange vfio_route_change;
  
@@ -48,14 +75,7 @@ index 2407720c35..82a47edc89 100644
  static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
  static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
  static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
-@@ -2963,10 +2966,33 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     ERRP_GUARD();
-     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
-     VFIODevice *vbasedev = &vdev->vbasedev;
--    int i, ret;
-+    int ret, i = 0;
-+    VFIODevice *vbasedev_iter;
-+    VFIOGroup *group;
+@@ -3355,6 +3358,21 @@ static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
      char uuid[UUID_STR_LEN];
      g_autofree char *name = NULL;
  
@@ -68,13 +88,7 @@ index 2407720c35..82a47edc89 100644
 +        device_limit = vdev->assigned_device_limit;
 +    }
 +
-+    QLIST_FOREACH(group, &vfio_group_list, next) {
-+        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
-+            i++;
-+        }
-+    }
-+
-+    if (i >= vdev->assigned_device_limit) {
++    if (vfio_device_count() >= vdev->assigned_device_limit) {
 +        error_setg(errp, "Maximum supported vfio devices (%d) "
 +                     "already attached", vdev->assigned_device_limit);
 +        return;
@@ -83,7 +97,7 @@ index 2407720c35..82a47edc89 100644
      if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
          if (!(~vdev->host.domain || ~vdev->host.bus ||
                ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3388,6 +3414,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3687,6 +3705,9 @@ static const Property vfio_pci_dev_properties[] = {
      DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
      DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                       no_geforce_quirks, false),
@@ -94,10 +108,10 @@ index 2407720c35..82a47edc89 100644
                       false),
      DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index bf67df2fbc..0d3c93fb2e 100644
+index 810a842f4a..81555d8774 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
+@@ -145,6 +145,7 @@ struct VFIOPCIDevice {
      EventNotifier err_notifier;
      EventNotifier req_notifier;
      int (*resetfn)(struct VFIOPCIDevice *);
@@ -105,6 +119,15 @@ index bf67df2fbc..0d3c93fb2e 100644
      uint32_t vendor_id;
      uint32_t device_id;
      uint32_t sub_vendor_id;
--- 
-2.39.3
-
+diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
+index 6e4d5ccdac..9290774299 100644
+--- a/include/hw/vfio/vfio-device.h
++++ b/include/hw/vfio/vfio-device.h
+@@ -140,6 +140,7 @@ struct VFIODeviceOps {
+ #define strwriteerror(ret) \
+     (ret < 0 ? strerror(-ret) : "short write")
+ 
++int vfio_device_count(void);
+ void vfio_device_irq_disable(VFIODevice *vbasedev, int index);
+ void vfio_device_irq_unmask(VFIODevice *vbasedev, int index);
+ void vfio_device_irq_mask(VFIODevice *vbasedev, int index);
diff --git a/0018-Add-support-statement-to-help-output.patch b/0015-Add-support-statement-to-help-output.patch
similarity index 85%
rename from 0018-Add-support-statement-to-help-output.patch
rename to 0015-Add-support-statement-to-help-output.patch
index a3ef6f6..ad9fde5 100644
--- a/0018-Add-support-statement-to-help-output.patch
+++ b/0015-Add-support-statement-to-help-output.patch
@@ -1,7 +1,7 @@
-From d2a73465e69118a37a2bbc487b6faa30c9b5a81f Mon Sep 17 00:00:00 2001
+From f4b2577d0920e0472760138b1f39e65c818eba63 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
-Subject: Add support statement to -help output
+Subject: [PATCH] Add support statement to -help output
 
 RH-Author: Eduardo Habkost <ehabkost@redhat.com>
 Message-id: <1386183197-27761-1-git-send-email-ehabkost@redhat.com>
@@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/system/vl.c b/system/vl.c
-index 01b8b8e77a..5359231bf5 100644
+index 3b7057e6c6..d3e6158753 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -877,9 +877,17 @@ static void version(void)
+@@ -872,9 +872,17 @@ static void version(void)
             QEMU_COPYRIGHT "\n");
  }
  
@@ -42,7 +42,7 @@ index 01b8b8e77a..5359231bf5 100644
      printf("usage: %s [options] [disk_image]\n\n"
             "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
              g_get_prgname());
-@@ -905,6 +913,7 @@ static void help(int exitcode)
+@@ -900,6 +908,7 @@ static void help(int exitcode)
             "\n"
             QEMU_HELP_BOTTOM "\n");
  
@@ -50,6 +50,3 @@ index 01b8b8e77a..5359231bf5 100644
      exit(exitcode);
  }
  
--- 
-2.39.3
-
diff --git a/0019-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch b/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
similarity index 90%
rename from 0019-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
rename to 0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
index 4eb7d29..e7915fd 100644
--- a/0019-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@@ -1,7 +1,7 @@
-From ca0507cfda11a73cb4311fc0b3a934ce8b40c5e9 Mon Sep 17 00:00:00 2001
+From b03b18b6e37a79c180cd7ba31ae378d0fa331f7c Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
-Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
+Subject: [PATCH] Use qemu-kvm in documentation instead of qemu-system-<arch>
 
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
@@ -36,10 +36,10 @@ index 52d6454b93..d74dbdeca9 100644
  .. |I2C| replace:: I\ :sup:`2`\ C
  .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
-index d94e2cbbae..a7444abc7f 100644
+index ab23f14d21..3837456a61 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3688,11 +3688,11 @@ SRST
+@@ -3858,11 +3858,11 @@ SRST
  
      ::
  
@@ -56,6 +56,3 @@ index d94e2cbbae..a7444abc7f 100644
  
  ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
      Establish a vhost-vdpa netdev.
--- 
-2.39.3
-
diff --git a/0020-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch b/0017-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
similarity index 90%
rename from 0020-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
rename to 0017-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
index f1414a2..d4bee2a 100644
--- a/0020-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/0017-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@@ -1,7 +1,7 @@
-From 3fbdf1e92fe0dbabb59b611dfb3ad906edf80979 Mon Sep 17 00:00:00 2001
+From 0407a816af91b00b3c537599377273f85a66f2ba Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
-Subject: qcow2: Deprecation warning when opening v2 images rw
+Subject: [PATCH] qcow2: Deprecation warning when opening v2 images rw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -35,16 +35,13 @@ Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
 present_in_specfile: true
 location_in_specfile: 116
----
-Rebase notes (6.1.0):
-- Replace bs->read_only with bdrv_is_read_only
 ---
  block/qcow2.c                    | 6 ++++++
  tests/qemu-iotests/common.filter | 1 +
  2 files changed, 7 insertions(+)
 
 diff --git a/block/qcow2.c b/block/qcow2.c
-index 70b19730a3..a4cffb628c 100644
+index 4aa9f9e068..6df65aab93 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
 @@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
@@ -61,7 +58,7 @@ index 70b19730a3..a4cffb628c 100644
      s->qcow_version = header.version;
  
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index fc3c64bcb8..4b238954d5 100644
+index 511a55b1e8..35c0fc0d20 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
 @@ -83,6 +83,7 @@ _filter_qemu()
@@ -72,6 +69,3 @@ index fc3c64bcb8..4b238954d5 100644
          -e $'s#\r##' # QEMU monitor uses \r\n line endings
  }
  
--- 
-2.39.3
-
diff --git a/kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch b/0018-redhat-allow-5-level-paging-for-TDX-VMs.patch
similarity index 80%
rename from kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch
rename to 0018-redhat-allow-5-level-paging-for-TDX-VMs.patch
index 18fd9cf..4be3a25 100644
--- a/kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch
+++ b/0018-redhat-allow-5-level-paging-for-TDX-VMs.patch
@@ -1,7 +1,7 @@
-From 3cb78d36244833d5e11e88de33bbdbe93a641e16 Mon Sep 17 00:00:00 2001
+From bf3e2ead4f851f66ab1c9ce5cd13d8a73267dce4 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 110/115] redhat: allow 5-level paging for TDX VMs
+Subject: [PATCH] redhat: allow 5-level paging for TDX VMs
 
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 391: TDX support, including attestation and device assignment
@@ -12,12 +12,16 @@ RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [110/115] dd69bc652e2a735234165832ea4bc674753d7fb7 (bonzini/rhel-qemu-kvm)
 
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Patch-name: kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch
+Patch-id: 387
+Patch-present-in-specfile: True
 ---
  target/i386/kvm/tdx.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 2ff5211794..e65b1727cf 100644
+index dbf0fa2c91..91fe19b7d4 100644
 --- a/target/i386/kvm/tdx.c
 +++ b/target/i386/kvm/tdx.c
 @@ -754,6 +754,7 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
@@ -28,6 +32,3 @@ index 2ff5211794..e65b1727cf 100644
  
      /* invtsc is fixed1 for TD guest */
      object_property_set_bool(OBJECT(cpu), "invtsc", true, &error_abort);
--- 
-2.50.1
-
diff --git a/0019-Add-upstream-compat-bits.patch b/0019-Add-upstream-compat-bits.patch
new file mode 100644
index 0000000..c87255b
--- /dev/null
+++ b/0019-Add-upstream-compat-bits.patch
@@ -0,0 +1,155 @@
+From 512d36fc33342330362861f68c102504d37f5ff9 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Tue, 30 Sep 2025 12:22:25 +0200
+Subject: [PATCH] Add upstream compat bits
+
+Adding copied upstream compatibility bits
+---
+ hw/arm/virt.c              |  1 +
+ hw/core/machine.c          | 22 ++++++++++++++++++++++
+ hw/i386/pc.c               | 12 ++++++++++++
+ hw/i386/pc_piix.c          |  4 ++++
+ hw/i386/pc_q35.c           |  4 ++++
+ hw/s390x/s390-virtio-ccw.c |  1 +
+ include/hw/boards.h        |  3 +++
+ include/hw/i386/pc.h       |  3 +++
+ 8 files changed, 50 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 21ab9257e7..cb303e263b 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -3694,6 +3694,7 @@ DEFINE_VIRT_MACHINE(4, 1)
+ 
+ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+ {
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
+ }
+ DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 2e69dc40f0..f774a6ebdb 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -303,6 +303,28 @@ const size_t hw_compat_rhel_9_len = G_N_ELEMENTS(hw_compat_rhel_9);
+ const char *rhel_old_machine_deprecation =
+     "machine types for previous major releases are deprecated";
+ 
++GlobalProperty hw_compat_rhel_9_8[] = {
++  /* hw_compat_rhel_9_8 from hw_compat_9_1 */
++    { TYPE_PCI_DEVICE, "x-pcie-ext-tag", "false" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    {"arm-cpu", "backcompat-pauth-default-use-qarma5", "true"},
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "virtio-balloon-pci", "vectors", "0" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "virtio-balloon-pci-transitional", "vectors", "0" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "virtio-balloon-pci-non-transitional", "vectors", "0" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "virtio-mem-pci", "vectors", "0" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "migration", "multifd-clean-tls-termination", "false" },
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "migration", "send-switchover-start", "off"},
++  /* hw_compat_rhel_9_8 from hw_compat_9_2 */
++    { "vfio-pci", "x-migration-multifd-transfer", "off" },
++};
++const size_t hw_compat_rhel_9_8_len = G_N_ELEMENTS(hw_compat_rhel_9_8);
++
+ GlobalProperty hw_compat_rhel_9_6[] = {
+   /* hw_compat_rhel_9_6 from hw_compat_9_0 */
+     {"arm-cpu", "backcompat-cntfrq", "true" },
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 1b351085c0..79a6105f8b 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -295,6 +295,18 @@ GlobalProperty pc_rhel_compat[] = {
+ };
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
++GlobalProperty pc_rhel_9_8_compat[] = {
++    /* pc_rhel_10_2_compat from pc_compat_10_0 */
++    { TYPE_X86_CPU, "x-consistent-cache", "false" },
++    { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
++    /* pc_rhel_9_8_compat from pc_compat_9_1 */
++    { "ICH9-LPC", "x-smi-swsmi-timer", "off" },
++    { "ICH9-LPC", "x-smi-periodic-timer", "off" },
++    { TYPE_INTEL_IOMMU_DEVICE, "stale-tm", "on" },
++    { TYPE_INTEL_IOMMU_DEVICE, "aw-bits", "39" },
++};
++const size_t pc_rhel_9_8_compat_len = G_N_ELEMENTS(pc_rhel_9_8_compat);
++
+ GlobalProperty pc_rhel_9_6_compat[] = {
+     /* pc_rhel_9_6_compat from pc_compat_9_0 */
+     { TYPE_X86_CPU, "x-amd-topoext-features-only", "false" },
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index d9fd4d207e..1a46c16e19 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -910,6 +910,10 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
+     object_class_property_set_description(oc, "x-south-bridge",
+                                      "Use a different south bridge than PIIX3");
+ 
++    compat_props_add(m->compat_props, hw_compat_rhel_9_8,
++                     hw_compat_rhel_9_8_len);
++    compat_props_add(m->compat_props, pc_rhel_9_8_compat,
++                     pc_rhel_9_8_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_6,
+                      hw_compat_rhel_9_6_len);
+     compat_props_add(m->compat_props, pc_rhel_9_6_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 3165d9bbfe..a241f27c93 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -700,6 +700,10 @@ static void pc_q35_rhel_machine_9_6_0_options(MachineClass *m)
+ 
+     /* NB: remember to move this line to the *latest* RHEL 9 machine */
+     compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++    compat_props_add(m->compat_props, hw_compat_rhel_9_8,
++                     hw_compat_rhel_9_8_len);
++    compat_props_add(m->compat_props, pc_rhel_9_8_compat,
++                     pc_rhel_9_8_compat_len);
+ }
+ 
+ DEFINE_Q35_MACHINE_AS_LATEST(9, 6, 0);
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 46161d16a5..d5d32f6a75 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1177,6 +1177,7 @@ static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
+ {
+     /* NB: remember to move this line to the *latest* RHEL 9 machine */
+     compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
+ }
+ DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index ad077677f4..0a5ee450c1 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -864,6 +864,9 @@ extern const size_t hw_compat_rhel_9_len;
+ extern GlobalProperty hw_compat_rhel_9_6[];
+ extern const size_t hw_compat_rhel_9_6_len;
+ 
++extern GlobalProperty hw_compat_rhel_9_8[];
++extern const size_t hw_compat_rhel_9_8_len;
++
+ extern GlobalProperty hw_compat_rhel_9_5[];
+ extern const size_t hw_compat_rhel_9_5_len;
+ 
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 75c797bb0e..38c8471afc 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -304,6 +304,9 @@ extern const size_t pc_compat_2_6_len;
+ extern GlobalProperty pc_rhel_compat[];
+ extern const size_t pc_rhel_compat_len;
+ 
++extern GlobalProperty pc_rhel_9_8_compat[];
++extern const size_t pc_rhel_9_8_compat_len;
++
+ extern GlobalProperty pc_rhel_9_6_compat[];
+ extern const size_t pc_rhel_9_6_compat_len;
+ 
diff --git a/0020-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch b/0020-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
new file mode 100644
index 0000000..fdf50ce
--- /dev/null
+++ b/0020-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
@@ -0,0 +1,68 @@
+From c1918fcb1e6a7772f3e8c23657c1fb521dce5805 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 1 Oct 2025 09:23:06 +0200
+Subject: [PATCH] Revert "hw/s390x/s390-virtio-ccw: Remove the deprecated 4.1
+ machine type"
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+Upstream status: downstream-only
+
+This reverts commit 6ad3a47f15624176434490e895ac244375322607.
+
+We still need the code for the old machine types since the -rhel7.6.0
+machine type is based on these old upstream machine types.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c  | 15 +++++++++++++++
+ target/s390x/gen-features.c |  4 ++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index d5d32f6a75..0ff4114d2a 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1167,6 +1167,21 @@ static void ccw_machine_4_2_class_options(MachineClass *mc)
+     compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+ }
+ DEFINE_CCW_MACHINE(4, 2);
++
++static void ccw_machine_4_1_instance_options(MachineState *machine)
++{
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V4_1 };
++    ccw_machine_4_2_instance_options(machine);
++    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
++}
++
++static void ccw_machine_4_1_class_options(MachineClass *mc)
++{
++    ccw_machine_4_2_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_4_1, hw_compat_4_1_len);
++}
++DEFINE_CCW_MACHINE(4, 1);
++
+ #endif /* disabled for RHEL */
+ 
+ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 8218e6470e..a814ece82f 100644
+--- a/target/s390x/gen-features.c
++++ b/target/s390x/gen-features.c
+@@ -884,6 +884,9 @@ static uint16_t qemu_MIN[] = {
+      */
+     S390_FEAT_FLOATING_POINT_EXT,
+     S390_FEAT_ZPCI,
++};
++
++static uint16_t qemu_V4_1[] = {
+     S390_FEAT_STFLE_53,
+     S390_FEAT_VECTOR,
+ };
+@@ -1046,6 +1049,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+  *******************************/
+ static FeatGroupDefSpec QemuFeatDef[] = {
+     QEMU_FEAT_INITIALIZER(MIN),
++    QEMU_FEAT_INITIALIZER(V4_1),
+     QEMU_FEAT_INITIALIZER(V6_0),
+     QEMU_FEAT_INITIALIZER(V6_2),
+     QEMU_FEAT_INITIALIZER(V7_0),
diff --git a/0021-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch b/0021-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
new file mode 100644
index 0000000..a0db9ce
--- /dev/null
+++ b/0021-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
@@ -0,0 +1,67 @@
+From 0a6b205fed327c4649c6204a2e8c3b12b29c8459 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 1 Oct 2025 10:47:08 +0200
+Subject: [PATCH] Revert "hw/s390x/s390-virtio-ccw: Remove the deprecated 4.0
+ machine type"
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+Upstream status: downstream-only
+
+This reverts commit 1b432c51cd12e778079ee0cfd7e4c51aad928c65.
+
+We still need the code for the old machine types since the -rhel7.6.0
+machine type is based on these old upstream machine types.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c  | 14 ++++++++++++++
+ target/s390x/gen-features.c |  4 ++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 0ff4114d2a..ff2efc1b93 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1182,6 +1182,20 @@ static void ccw_machine_4_1_class_options(MachineClass *mc)
+ }
+ DEFINE_CCW_MACHINE(4, 1);
+ 
++static void ccw_machine_4_0_instance_options(MachineState *machine)
++{
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V4_0 };
++    ccw_machine_4_1_instance_options(machine);
++    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
++}
++
++static void ccw_machine_4_0_class_options(MachineClass *mc)
++{
++    ccw_machine_4_1_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
++}
++DEFINE_CCW_MACHINE(4, 0);
++
+ #endif /* disabled for RHEL */
+ 
+ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index a814ece82f..4346b92431 100644
+--- a/target/s390x/gen-features.c
++++ b/target/s390x/gen-features.c
+@@ -878,6 +878,9 @@ static uint16_t qemu_MIN[] = {
+     S390_FEAT_ADAPTER_INT_SUPPRESSION,
+     S390_FEAT_MSA_EXT_3,
+     S390_FEAT_MSA_EXT_4,
++};
++
++static uint16_t qemu_V4_0[] = {
+     /*
+      * Only BFP bits are implemented (HFP, DFP, PFPO and DIVIDE TO INTEGER not
+      * implemented yet).
+@@ -1049,6 +1052,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+  *******************************/
+ static FeatGroupDefSpec QemuFeatDef[] = {
+     QEMU_FEAT_INITIALIZER(MIN),
++    QEMU_FEAT_INITIALIZER(V4_0),
+     QEMU_FEAT_INITIALIZER(V4_1),
+     QEMU_FEAT_INITIALIZER(V6_0),
+     QEMU_FEAT_INITIALIZER(V6_2),
diff --git a/0021-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch b/0021-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
deleted file mode 100644
index 9657842..0000000
--- a/0021-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 8c62f120efeedfcdc43fece9f65b4c1b5b0a06e6 Mon Sep 17 00:00:00 2001
-From: Dehan Meng <demeng@redhat.com>
-Date: Wed, 21 Aug 2024 14:55:01 +0800
-Subject: qemu-guest-agent: Update the logfile path of qga-fsfreeze-hook.log
-
-RH-Author: 6-dehan <None>
-RH-MergeRequest: 265: qemu-guest-agent: Update the logfile path of qga-fsfreeze-hook.log
-RH-Jira: RHEL-52250
-RH-Acked-by: Konstantin Kostiuk <None>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 7c5cfb882dbc277becb7daa2c5d6b8eff3d601b2 (6-dehan/src_centosupstream_qemu-kvm)
-
-selinux context 'system_u:object_r:virt_qemu_ga_log_t:s0', it
-should be changed to '/var/log/qemu-ga/qga-fsfreeze-hook.log'. And
-it's worth to mention that this is RHEL-only change for matching
-existing SELinux boolean and policy.
-
-Jira: https://issues.redhat.com/browse/RHEL-52250
-Signed-off-by: Dehan Meng <demeng@redhat.com>
-
-Patch-name: kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
-Patch-id: 137
-Patch-present-in-specfile: True
----
- scripts/qemu-guest-agent/fsfreeze-hook | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
-index e9b84ec028..70536ba3e3 100755
---- a/scripts/qemu-guest-agent/fsfreeze-hook
-+++ b/scripts/qemu-guest-agent/fsfreeze-hook
-@@ -7,7 +7,7 @@
- # "freeze" argument before the filesystem is frozen. And for fsfreeze-thaw
- # request, it is issued with "thaw" argument after filesystem is thawed.
- 
--LOGFILE=/var/log/qga-fsfreeze-hook.log
-+LOGFILE=/var/log/qemu-ga/qga-fsfreeze-hook.log
- FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
- 
- # Check whether file $1 is a backup or rpm-generated file and should be ignored
--- 
-2.39.3
-
diff --git a/0022-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch b/0022-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
new file mode 100644
index 0000000..63329b4
--- /dev/null
+++ b/0022-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
@@ -0,0 +1,69 @@
+From 98acfd50ce2a7e540c89196020f70a1e95071f1d Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 1 Oct 2025 11:42:35 +0200
+Subject: [PATCH] Revert "hw/s390x/s390-virtio-ccw: Remove the deprecated 3.1
+ machine type"
+
+This reverts commit 3b912daea079445aad40d8e189c40597b229cf10.
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+Upstream status: downstream-only
+
+We still need the code for the old machine types since the -rhel7.6.0
+machine type is based on these old upstream machine types.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c  | 16 ++++++++++++++++
+ target/s390x/gen-features.c |  4 ++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index ff2efc1b93..40d9c209f4 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1196,6 +1196,22 @@ static void ccw_machine_4_0_class_options(MachineClass *mc)
+ }
+ DEFINE_CCW_MACHINE(4, 0);
+ 
++static void ccw_machine_3_1_instance_options(MachineState *machine)
++{
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
++    ccw_machine_4_0_instance_options(machine);
++    s390_cpudef_featoff_greater(14, 1, S390_FEAT_MULTIPLE_EPOCH);
++    s390_cpudef_group_featoff_greater(14, 1, S390_FEAT_GROUP_MULTIPLE_EPOCH_PTFF);
++    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
++}
++
++static void ccw_machine_3_1_class_options(MachineClass *mc)
++{
++    ccw_machine_4_0_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
++}
++DEFINE_CCW_MACHINE(3, 1);
++
+ #endif /* disabled for RHEL */
+ 
+ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 4346b92431..754fc843d2 100644
+--- a/target/s390x/gen-features.c
++++ b/target/s390x/gen-features.c
+@@ -849,6 +849,9 @@ static uint16_t qemu_MIN[] = {
+     S390_FEAT_GROUP_PLO,
+     S390_FEAT_ESAN3,
+     S390_FEAT_ZARCH,
++};
++
++static uint16_t qemu_V3_1[] = {
+     S390_FEAT_DAT_ENH,
+     S390_FEAT_IDTE_SEGMENT,
+     S390_FEAT_STFLE,
+@@ -1052,6 +1055,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
+  *******************************/
+ static FeatGroupDefSpec QemuFeatDef[] = {
+     QEMU_FEAT_INITIALIZER(MIN),
++    QEMU_FEAT_INITIALIZER(V3_1),
+     QEMU_FEAT_INITIALIZER(V4_0),
+     QEMU_FEAT_INITIALIZER(V4_1),
+     QEMU_FEAT_INITIALIZER(V6_0),
diff --git a/0023-Add-upstream-compatibility-bits.patch b/0023-Add-upstream-compatibility-bits.patch
deleted file mode 100644
index 8d75874..0000000
--- a/0023-Add-upstream-compatibility-bits.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From 2b6f52a948d4ee1bbaadec56151a6c30782693a2 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 15 May 2024 01:41:13 -0400
-Subject: Add upstream compatibility bits
-
----
- hw/arm/virt.c              |  1 +
- hw/core/machine.c          | 17 +++++++++++++++++
- hw/i386/pc_piix.c          |  2 ++
- hw/i386/pc_q35.c           |  2 ++
- hw/s390x/s390-virtio-ccw.c |  1 +
- include/hw/boards.h        |  3 +++
- 6 files changed, 26 insertions(+)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 903c0f2e9f..3c776b5011 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3582,6 +3582,7 @@ DEFINE_VIRT_MACHINE(2, 6)
- 
- static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
- }
- DEFINE_VIRT_MACHINE_AS_LATEST(9, 4, 0)
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index f7fed78e4b..add42660f8 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -311,6 +311,23 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
- const char *rhel_old_machine_deprecation =
-     "machine types for previous major releases are deprecated";
- 
-+GlobalProperty hw_compat_rhel_9_6[] = {
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    {"arm-cpu", "backcompat-cntfrq", "true" },
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    { "scsi-hd", "migrate-emulated-scsi-request", "false" },
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    { "scsi-cd", "migrate-emulated-scsi-request", "false" },
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    {"vfio-pci", "skip-vsc-check", "false" },
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    { "virtio-pci", "x-pcie-pm-no-soft-reset", "off" },
-+  /* hw_compat_rhel_9_6 from hw_compat_9_0 */
-+    {"sd-card", "spec_version", "2" },
-+};
-+const size_t hw_compat_rhel_9_6_len = G_N_ELEMENTS(hw_compat_rhel_9_6);
-+
-+
- GlobalProperty hw_compat_rhel_9_5[] = {
-   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
-     { "migration", "zero-page-detection", "legacy"},
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index c93e78e896..80323cc08c 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -880,6 +880,8 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
-     object_class_property_set_description(oc, "x-south-bridge",
-                                      "Use a different south bridge than PIIX3");
- 
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_6,
-+                     hw_compat_rhel_9_6_len);
-     compat_props_add(m->compat_props, pc_rhel_9_5_compat,
- 		     pc_rhel_9_5_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 76f0ac1acd..4580b2266e 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -681,6 +681,8 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
-     pcmc->smbios_stream_version = "9.4.0";
-     pcmc->isa_bios_alias = false;
- 
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_6,
-+                     hw_compat_rhel_9_6_len);
-     compat_props_add(m->compat_props, pc_rhel_9_5_compat,
- 		     pc_rhel_9_5_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 72e1279db9..f884528639 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1314,6 +1314,7 @@ static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
- 
- static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
- }
- DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 85b43e3d0d..ffefc0a625 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -802,6 +802,9 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_9_6[];
-+extern const size_t hw_compat_rhel_9_6_len;
-+
- extern GlobalProperty hw_compat_rhel_9_5[];
- extern const size_t hw_compat_rhel_9_5_len;
- 
--- 
-2.39.3
-
diff --git a/0023-redhat-Fix-rhel7.6.0-machine-type.patch b/0023-redhat-Fix-rhel7.6.0-machine-type.patch
new file mode 100644
index 0000000..b4603c8
--- /dev/null
+++ b/0023-redhat-Fix-rhel7.6.0-machine-type.patch
@@ -0,0 +1,30 @@
+From 0ba6c63f629423702bc836ae1a740f72d71aee99 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 1 Oct 2025 13:57:59 +0200
+Subject: [PATCH] redhat: Fix -rhel7.6.0 machine type
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+
+During the rebase to QEMU 10.1, we lost the S390_FEAT_LIST_QEMU_V3_1
+setting for the -rhel7.6.0 machine type. Now that the upstream
+patches that removed this setting got reverted, we can re-establish
+it for the -rhel7.6.0 machine.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 40d9c209f4..79fe544224 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1365,7 +1365,7 @@ DEFINE_CCW_MACHINE(8, 2, 0);
+ 
+ static void ccw_rhel_machine_7_6_0_instance_options(MachineState *machine)
+ {
+-    static const S390FeatInit qemu_cpu_feat = { };
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
+ 
+     ccw_rhel_machine_8_2_0_instance_options(machine);
+ 
diff --git a/0024-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch b/0024-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
deleted file mode 100644
index 1f2c796..0000000
--- a/0024-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 492900c0b6a99f157249c2706c2f2ef5f67d20df Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 26 Aug 2024 14:27:49 +0200
-Subject: redhat: Add QEMU 9.1 compat handling to the s390x machine types
-
-JIRA: https://issues.redhat.com/browse/RHEL-52323
-
-Upstream changed the amount of information that is migrated for
-the S390 interrupt controller (FLIC), so we have to switch on
-a compatibility property for older machine types.
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index f884528639..4b7290f7a8 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1314,8 +1314,13 @@ static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
- 
- static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
- {
-+    static GlobalProperty compat[] = {
-+        { TYPE_QEMU_S390_FLIC, "migrate-all-state", "off", },
-+    };
-+
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
-+    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
- }
- DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
- 
--- 
-2.39.3
-
diff --git a/0024-redhat-Compatibility-handling-for-the-s390-ccw-virti.patch b/0024-redhat-Compatibility-handling-for-the-s390-ccw-virti.patch
new file mode 100644
index 0000000..bdf6bff
--- /dev/null
+++ b/0024-redhat-Compatibility-handling-for-the-s390-ccw-virti.patch
@@ -0,0 +1,41 @@
+From 8c4b23a9759821f5b543cda3af3a443583c6484b Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 1 Oct 2025 16:12:28 +0200
+Subject: [PATCH] redhat: Compatibility handling for the
+ s390-ccw-virtio-rhel9.6.0 machine
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+Upstream status: downstream-only
+
+Add the compatiblity handling for the -rhel9.6.0 machine types (and
+older) after the rebase to QEMU 10.1. This adds the settings from
+the upstream machine types of QEMU 9.2 and 10.0 to the downstream
+machine types.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 79fe544224..906d45c813 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1220,9 +1220,17 @@ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+ 
+ static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
+ {
++    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
++    static GlobalProperty compat[] = {
++        { TYPE_S390_PCI_DEVICE, "relaxed-translation", "off", },
++    };
++
++    s390mc->use_cpi = false;
++
+     /* NB: remember to move this line to the *latest* RHEL 9 machine */
+     compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+     compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
++    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
+ }
+ DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
+ 
diff --git a/0025-redhat-Add-new-s390-ccw-virtio-rhel9.8.0-machine-typ.patch b/0025-redhat-Add-new-s390-ccw-virtio-rhel9.8.0-machine-typ.patch
new file mode 100644
index 0000000..ceff286
--- /dev/null
+++ b/0025-redhat-Add-new-s390-ccw-virtio-rhel9.8.0-machine-typ.patch
@@ -0,0 +1,60 @@
+From 9719dea4ff535eee322019ef4e768adbb8eff254 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Thu, 2 Oct 2025 09:09:20 +0200
+Subject: [PATCH] redhat: Add new s390-ccw-virtio-rhel9.8.0 machine type
+
+JIRA: https://issues.redhat.com/browse/RHEL-105900
+Upstream status: downstream-only
+
+Add a new machine type for RHEL 9.8.0. This machine type now has the
+"control-program identification" and the relaxed PCI translation
+features turned on.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 906d45c813..0939adf1ab 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1214,8 +1214,20 @@ DEFINE_CCW_MACHINE(3, 1);
+ 
+ #endif /* disabled for RHEL */
+ 
++static void ccw_rhel_machine_9_8_0_instance_options(MachineState *machine)
++{
++}
++
++static void ccw_rhel_machine_9_8_0_class_options(MachineClass *mc)
++{
++    /* NB: remember to move this line to the *latest* RHEL 9 machine */
++    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
++}
++DEFINE_CCW_MACHINE_AS_LATEST(9, 8, 0);
++
+ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
+ {
++    ccw_rhel_machine_9_8_0_instance_options(machine);
+ }
+ 
+ static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
+@@ -1225,14 +1237,14 @@ static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
+         { TYPE_S390_PCI_DEVICE, "relaxed-translation", "off", },
+     };
+ 
++    ccw_rhel_machine_9_8_0_class_options(mc);
++
+     s390mc->use_cpi = false;
+ 
+-    /* NB: remember to move this line to the *latest* RHEL 9 machine */
+-    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
+     compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
+     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
+ }
+-DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
++DEFINE_CCW_MACHINE(9, 6, 0);
+ 
+ static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
+ {
diff --git a/0025-redhat-Add-rhel9.6.0-machine-type.patch b/0025-redhat-Add-rhel9.6.0-machine-type.patch
deleted file mode 100644
index abaa414..0000000
--- a/0025-redhat-Add-rhel9.6.0-machine-type.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 1ceaf6413ec7cb19ea2b6147ec91c776c7c5df40 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 26 Aug 2024 14:42:24 +0200
-Subject: redhat: Add rhel9.6.0 machine type
-
-JIRA: https://issues.redhat.com/browse/RHEL-52323
-
-Add a new machine type to enable the latest features by default.
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 4b7290f7a8..a4a6ffa053 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1308,8 +1308,18 @@ DEFINE_CCW_MACHINE(2, 4);
- #endif
- #endif /* disabled for RHEL */
- 
-+static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
-+{
-+}
-+
-+static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
-+{
-+}
-+DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
-+
- static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
- {
-+    ccw_rhel_machine_9_6_0_instance_options(machine);
- }
- 
- static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
-@@ -1318,11 +1328,13 @@ static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
-         { TYPE_QEMU_S390_FLIC, "migrate-all-state", "off", },
-     };
- 
-+    ccw_rhel_machine_9_6_0_class_options(mc);
-+
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
-     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
- }
--DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
-+DEFINE_CCW_MACHINE(9, 4, 0);
- 
- static void ccw_rhel_machine_9_2_0_instance_options(MachineState *machine)
- {
--- 
-2.39.3
-
diff --git a/0026-hw-core-machine-rhel-machine-types-compat-fix.patch b/0026-hw-core-machine-rhel-machine-types-compat-fix.patch
new file mode 100644
index 0000000..f4a5783
--- /dev/null
+++ b/0026-hw-core-machine-rhel-machine-types-compat-fix.patch
@@ -0,0 +1,32 @@
+From fda4591f6ca6bcec0728583086622bef4bda4ff4 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Wed, 15 Oct 2025 16:39:16 +0200
+Subject: [PATCH] hw/core/machine: rhel machine types compat fix
+
+Incorporate hw_compat_10_0 to downstream compat bits.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/core/machine.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index f774a6ebdb..c10c733b7d 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -322,6 +322,15 @@ GlobalProperty hw_compat_rhel_9_8[] = {
+     { "migration", "send-switchover-start", "off"},
+   /* hw_compat_rhel_9_8 from hw_compat_9_2 */
+     { "vfio-pci", "x-migration-multifd-transfer", "off" },
++  /* hw_compat_rhel_9_8 from hw_compat_10_0 */
++    { "scsi-hd", "dpofua", "off" },
++  /* hw_compat_rhel_9_8 from hw_compat_10_0 */
++    { "vfio-pci", "x-migration-load-config-after-iter", "off" },
++  /* hw_compat_rhel_9_8 from hw_compat_10_0 */
++    { "ramfb", "use-legacy-x86-rom", "true"},
++  /* hw_compat_rhel_9_8 from hw_compat_10_0 */
++    { "vfio-pci-nohotplug", "use-legacy-x86-rom", "true" },
++
+ };
+ const size_t hw_compat_rhel_9_8_len = G_N_ELEMENTS(hw_compat_rhel_9_8);
+ 
diff --git a/0026-x86-ensure-compatibility-of-pc-q35-rhel9-and-pc-i440.patch b/0026-x86-ensure-compatibility-of-pc-q35-rhel9-and-pc-i440.patch
deleted file mode 100644
index e6f14b8..0000000
--- a/0026-x86-ensure-compatibility-of-pc-q35-rhel9-and-pc-i440.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From f35f400c9255be5fbb0158c6885a96ef23e7fb86 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 5 Sep 2024 12:54:34 +0200
-Subject: x86: ensure compatibility of pc-q35-rhel9* and pc-i440fx-rhel7.6.0
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/i386/pc_piix.c | 3 +++
- hw/i386/pc_q35.c  | 3 +++
- 2 files changed, 6 insertions(+)
-
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 80323cc08c..656abb5d39 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -872,6 +872,9 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
-     pcmc->broken_32bit_mem_addr_check = true;
-     /* Introduced in QEMU 8.2 */
-     pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
-+    /* From pc_i440fx_machine_9_0_options() */
-+    m->smbios_memory_device_size = 16 * GiB;
-+    pcmc->isa_bios_alias = false;
- 
-     object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
-                                    &PCSouthBridgeOption_lookup,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 4580b2266e..5cfed8b62f 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -679,7 +679,10 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
-     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.4.0";
-+
-+    /* From pc_q35_machine_9_0_options() */
-     pcmc->isa_bios_alias = false;
-+    m->smbios_memory_device_size = 16 * GiB;
- 
-     compat_props_add(m->compat_props, hw_compat_rhel_9_6,
-                      hw_compat_rhel_9_6_len);
--- 
-2.39.3
-
diff --git a/0027-arm-ensure-compatibility-of-virt-rhel9.patch b/0027-arm-ensure-compatibility-of-virt-rhel9.patch
deleted file mode 100644
index 2e09fa2..0000000
--- a/0027-arm-ensure-compatibility-of-virt-rhel9.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 9c65a3e2e15c96b3b74d7c7846dbd60b13474370 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 5 Sep 2024 13:02:32 +0200
-Subject: arm: ensure compatibility of virt-rhel9*
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/arm/virt.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 3c776b5011..1af1c9e170 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3582,6 +3582,9 @@ DEFINE_VIRT_MACHINE(2, 6)
- 
- static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
- {
-+    /* From virt_machine_9_0_options() */
-+    mc->smbios_memory_device_size = 16 * GiB;
-+
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
- }
--- 
-2.39.3
-
diff --git a/0027-arm-rhel-machine-type-compat-fix.patch b/0027-arm-rhel-machine-type-compat-fix.patch
new file mode 100644
index 0000000..5ebbde5
--- /dev/null
+++ b/0027-arm-rhel-machine-type-compat-fix.patch
@@ -0,0 +1,26 @@
+From 0a8d8f3826fdb4160cbb6e401daa58abdc914873 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Thu, 16 Oct 2025 16:12:37 +0200
+Subject: [PATCH] arm: rhel machine type compat fix
+
+Ensure compat of virt-rhel9.6.0 - same change as for virt-9.1 upstream.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/arm/virt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index cb303e263b..d3bab67991 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -3694,6 +3694,9 @@ DEFINE_VIRT_MACHINE(4, 1)
+ 
+ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+ {
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++
++    vmc->no_nested_smmu = true;
+     compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
+ }
+ DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
diff --git a/0028-arm-create-new-virt-machine-type-for-rhel-9.6.patch b/0028-arm-create-new-virt-machine-type-for-rhel-9.6.patch
deleted file mode 100644
index ff63e0a..0000000
--- a/0028-arm-create-new-virt-machine-type-for-rhel-9.6.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 005be8f390c038ab9674103e1644dc1549c434a9 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 5 Sep 2024 13:11:23 +0200
-Subject: arm: create new virt machine type for rhel 9.6
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/arm/virt.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 1af1c9e170..bf05499a12 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3580,15 +3580,22 @@ static void virt_machine_2_6_options(MachineClass *mc)
- DEFINE_VIRT_MACHINE(2, 6)
- #endif /* disabled for RHEL */
- 
-+static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
-+{
-+}
-+DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
-+
- static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
- {
-+    virt_rhel_machine_9_6_0_options(mc);
-+
-     /* From virt_machine_9_0_options() */
-     mc->smbios_memory_device_size = 16 * GiB;
- 
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
- }
--DEFINE_VIRT_MACHINE_AS_LATEST(9, 4, 0)
-+DEFINE_VIRT_MACHINE(9, 4, 0)
- 
- static void virt_rhel_machine_9_2_0_options(MachineClass *mc)
- {
--- 
-2.39.3
-
diff --git a/0028-target-i386-add-compatibility-property-for-arch_capa.patch b/0028-target-i386-add-compatibility-property-for-arch_capa.patch
new file mode 100644
index 0000000..bf74413
--- /dev/null
+++ b/0028-target-i386-add-compatibility-property-for-arch_capa.patch
@@ -0,0 +1,125 @@
+From f12894cd72bfe359ed3438fad9f28cc2d282ab0b Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 Oct 2025 16:47:10 +0200
+Subject: [PATCH] target/i386: add compatibility property for arch_capabilities
+
+JIRA: https://issues.redhat.com/browse/RHEL-120257
+
+Prior to v10.1, if requested by user, arch-capabilities is always on
+despite the fact that CPUID advertises it to be off/unvailable.
+This causes a migration issue for VMs that are run on a machine
+without arch-capabilities and expect this feature to be present
+on the destination host with QEMU 10.1.
+
+Add a compatibility property to restore the legacy behavior for all
+machines with version prior to 10.1.
+
+To preserve the functionality (added by 10.1) of turning off
+ARCH_CAPABILITIES where Windows does not like it, use directly
+the guest CPU vendor: x86_cpu_get_supported_feature_word is not
+KVM-specific and therefore should not necessarily use the host
+CPUID.
+
+Co-authored-by: Hector Cao <hector.cao@canonical.com>
+Signed-off-by: Hector Cao <hector.cao@canonical.com>
+Fixes: d3a24134e37 ("target/i386: do not expose ARCH_CAPABILITIES on AMD CPU", 2025-07-17)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit e9efa4a77168ac2816bf9471f878252ce6224710)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c          |  2 ++
+ target/i386/cpu.c     | 17 +++++++++++++++++
+ target/i386/cpu.h     |  6 ++++++
+ target/i386/kvm/kvm.c |  6 +-----
+ 4 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 79a6105f8b..ee8c221505 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -84,6 +84,7 @@
+ GlobalProperty pc_compat_10_0[] = {
+     { TYPE_X86_CPU, "x-consistent-cache", "false" },
+     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
++    { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
+ };
+ const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
+ 
+@@ -299,6 +300,7 @@ GlobalProperty pc_rhel_9_8_compat[] = {
+     /* pc_rhel_10_2_compat from pc_compat_10_0 */
+     { TYPE_X86_CPU, "x-consistent-cache", "false" },
+     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
++    { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
+     /* pc_rhel_9_8_compat from pc_compat_9_1 */
+     { "ICH9-LPC", "x-smi-swsmi-timer", "off" },
+     { "ICH9-LPC", "x-smi-periodic-timer", "off" },
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 2c4ddd7c63..9fb70ac344 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -7564,6 +7564,20 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w)
+ #endif
+         break;
+ 
++    case FEAT_7_0_EDX:
++        /*
++         * Windows does not like ARCH_CAPABILITIES on AMD machines at all.
++         * Do not show the fake ARCH_CAPABILITIES MSR that KVM sets up,
++         * except if needed for migration.
++         *
++         * When arch_cap_always_on is removed, this tweak can move to
++         * kvm_arch_get_supported_cpuid.
++         */
++        if (cpu && IS_AMD_CPU(&cpu->env) && !cpu->arch_cap_always_on) {
++            unavail = CPUID_7_0_EDX_ARCH_CAPABILITIES;
++        }
++        break;
++
+     default:
+         break;
+     }
+@@ -10029,6 +10043,9 @@ static const Property x86_cpu_properties[] = {
+                      true),
+     DEFINE_PROP_BOOL("x-l1-cache-per-thread", X86CPU, l1_cache_per_core, true),
+     DEFINE_PROP_BOOL("x-force-cpuid-0x1f", X86CPU, force_cpuid_0x1f, false),
++
++    DEFINE_PROP_BOOL("x-arch-cap-always-on", X86CPU,
++                     arch_cap_always_on, false),
+ };
+ 
+ #ifndef CONFIG_USER_ONLY
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index f977fc49a7..b966bc997c 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -2314,6 +2314,12 @@ struct ArchCPU {
+     /* Forcefully disable KVM PV features not exposed in guest CPUIDs */
+     bool kvm_pv_enforce_cpuid;
+ 
++    /*
++     * Expose arch-capabilities unconditionally even on AMD models, for backwards
++     * compatibility with QEMU <10.1.
++     */
++    bool arch_cap_always_on;
++
+     /* Number of physical address bits supported */
+     uint32_t phys_bits;
+ 
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 0eb39d22d6..baa2f80beb 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -503,12 +503,8 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
+          * Linux v4.17-v4.20 incorrectly return ARCH_CAPABILITIES on SVM hosts.
+          * We can detect the bug by checking if MSR_IA32_ARCH_CAPABILITIES is
+          * returned by KVM_GET_MSR_INDEX_LIST.
+-         *
+-         * But also, because Windows does not like ARCH_CAPABILITIES on AMD
+-         * mcahines at all, do not show the fake ARCH_CAPABILITIES MSR that
+-         * KVM sets up.
+          */
+-        if (!has_msr_arch_capabs || !(edx & CPUID_7_0_EDX_ARCH_CAPABILITIES)) {
++        if (!has_msr_arch_capabs) {
+             ret &= ~CPUID_7_0_EDX_ARCH_CAPABILITIES;
+         }
+     } else if (function == 7 && index == 1 && reg == R_EAX) {
diff --git a/0029-target-i386-add-compatibility-property-for-pdcm-feat.patch b/0029-target-i386-add-compatibility-property-for-pdcm-feat.patch
new file mode 100644
index 0000000..b467ce9
--- /dev/null
+++ b/0029-target-i386-add-compatibility-property-for-pdcm-feat.patch
@@ -0,0 +1,106 @@
+From 61b2a83e3d0aef9683eed3ada16ef183b027b44d Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 Oct 2025 16:47:47 +0200
+Subject: [PATCH] target/i386: add compatibility property for pdcm feature
+
+JIRA: https://issues.redhat.com/browse/RHEL-120257
+
+The pdcm feature is supposed to be disabled when PMU is not
+available. Up until v10.1, pdcm feature is enabled even when PMU
+is off. This behavior has been fixed but this change breaks the
+migration of VMs that are run with QEMU < 10.0 and expect the pdcm
+feature to be enabled on the destination host.
+
+This commit restores the legacy behavior for machines with version
+prior to 10.1 to allow the migration from older QEMU to QEMU 10.1.
+
+Signed-off-by: Hector Cao <hector.cao@canonical.com>
+Link: https://lore.kernel.org/r/20250910115733.21149-3-hector.cao@canonical.com
+Fixes: e68ec298090 ("i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check", 2025-06-20)
+[Move property from migration object to CPU. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 6529f31e0dccadb532c80b36e3efe7aef83f9cad)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c      |  2 ++
+ target/i386/cpu.c | 15 ++++++++++++---
+ target/i386/cpu.h |  6 ++++++
+ 3 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index ee8c221505..dc3f140fdc 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -85,6 +85,7 @@ GlobalProperty pc_compat_10_0[] = {
+     { TYPE_X86_CPU, "x-consistent-cache", "false" },
+     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
+     { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
++    { TYPE_X86_CPU, "x-pdcm-on-even-without-pmu", "true" },
+ };
+ const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
+ 
+@@ -301,6 +302,7 @@ GlobalProperty pc_rhel_9_8_compat[] = {
+     { TYPE_X86_CPU, "x-consistent-cache", "false" },
+     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
+     { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
++    { TYPE_X86_CPU, "x-pdcm-on-even-without-pmu", "true" },
+     /* pc_rhel_9_8_compat from pc_compat_9_1 */
+     { "ICH9-LPC", "x-smi-swsmi-timer", "off" },
+     { "ICH9-LPC", "x-smi-periodic-timer", "off" },
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 9fb70ac344..1c8e0154d1 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -7933,6 +7933,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
+             /* Fixup overflow: max value for bits 23-16 is 255. */
+             *ebx |= MIN(num, 255) << 16;
+         }
++        if (cpu->pdcm_on_even_without_pmu) {
++            if (!cpu->enable_pmu) {
++                *ecx &= ~CPUID_EXT_PDCM;
++            }
++        }
+         break;
+     case 2: { /* cache info: needed for Pentium Pro compatibility */
+         const CPUCaches *caches;
+@@ -8983,9 +8988,11 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
+         }
+     }
+ 
+-    /* PDCM is fixed1 bit for TDX */
+-    if (!cpu->enable_pmu && !is_tdx_vm()) {
+-        env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
++    if (!cpu->pdcm_on_even_without_pmu) {
++        /* PDCM is fixed1 bit for TDX */
++        if (!cpu->enable_pmu && !is_tdx_vm()) {
++            env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
++        }
+     }
+ 
+     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
+@@ -10046,6 +10053,8 @@ static const Property x86_cpu_properties[] = {
+ 
+     DEFINE_PROP_BOOL("x-arch-cap-always-on", X86CPU,
+                      arch_cap_always_on, false),
++    DEFINE_PROP_BOOL("x-pdcm-on-even-without-pmu", X86CPU,
++                     pdcm_on_even_without_pmu, false),
+ };
+ 
+ #ifndef CONFIG_USER_ONLY
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index b966bc997c..2187e61654 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -2320,6 +2320,12 @@ struct ArchCPU {
+      */
+     bool arch_cap_always_on;
+ 
++    /*
++     * Backwards compatibility with QEMU <10.1. The PDCM feature is now disabled when
++     * PMU is not available, but prior to 10.1 it was enabled even if PMU is off.
++     */
++    bool pdcm_on_even_without_pmu;
++
+     /* Number of physical address bits supported */
+     uint32_t phys_bits;
+ 
diff --git a/0029-x86-create-new-pc-q35-machine-type-for-rhel-9.6.patch b/0029-x86-create-new-pc-q35-machine-type-for-rhel-9.6.patch
deleted file mode 100644
index e118d8e..0000000
--- a/0029-x86-create-new-pc-q35-machine-type-for-rhel-9.6.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 826f14b90a0ad2427e4e80232c0fbaea80600650 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 5 Sep 2024 13:31:12 +0200
-Subject: x86: create new pc-q35 machine type for rhel 9.6
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/i386/pc_q35.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 5cfed8b62f..7606007bda 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -672,11 +672,23 @@ DEFINE_Q35_MACHINE(2, 4);
- 
- /* Red Hat Enterprise Linux machine types */
- 
--static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
-+static void pc_q35_rhel_machine_9_6_0_options(MachineClass *m)
- {
-     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-     pc_q35_machine_options(m);
-+    m->desc = "RHEL-9.6.0 PC (Q35 + ICH9, 2009)";
-+    pcmc->smbios_stream_product = "RHEL";
-+    pcmc->smbios_stream_version = "9.6.0";
-+}
-+
-+DEFINE_Q35_MACHINE_BUGFIX(9, 6, 0);
-+
-+static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_rhel_machine_9_6_0_options(m);
-     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.4.0";
- 
--- 
-2.39.3
-
diff --git a/0030-arm-create-new-virt-machine-type-for-rhel-9.8.patch b/0030-arm-create-new-virt-machine-type-for-rhel-9.8.patch
new file mode 100644
index 0000000..d20ab78
--- /dev/null
+++ b/0030-arm-create-new-virt-machine-type-for-rhel-9.8.patch
@@ -0,0 +1,38 @@
+From 13ccc4660a956a0c2b25558a85b6152c9b366181 Mon Sep 17 00:00:00 2001
+From: Shaoqin Huang <shahuang@redhat.com>
+Date: Thu, 9 Oct 2025 02:38:45 -0400
+Subject: [PATCH] arm: create new virt machine type for rhel 9.8
+
+Upstream Status: RHEL only
+JIRA: https://issues.redhat.com/browse/RHEL-105903
+
+Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
+---
+ hw/arm/virt.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index d3bab67991..b8699cb9a2 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -3692,6 +3692,11 @@ static void virt_machine_4_1_options(MachineClass *mc)
+ DEFINE_VIRT_MACHINE(4, 1)
+ #endif /* disabled for RHEL */
+ 
++static void virt_rhel_machine_9_8_0_options(MachineClass *mc)
++{
++}
++DEFINE_VIRT_MACHINE_AS_LATEST(9, 8, 0)
++
+ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+ {
+     VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+@@ -3699,7 +3704,7 @@ static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
+     vmc->no_nested_smmu = true;
+     compat_props_add(mc->compat_props, hw_compat_rhel_9_8, hw_compat_rhel_9_8_len);
+ }
+-DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
++DEFINE_VIRT_MACHINE(9, 6, 0)
+ 
+ static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
+ {
diff --git a/0030-hw-arm-virt-Fix-Manufacturer-and-Product-Name-in-emu.patch b/0030-hw-arm-virt-Fix-Manufacturer-and-Product-Name-in-emu.patch
deleted file mode 100644
index 1419445..0000000
--- a/0030-hw-arm-virt-Fix-Manufacturer-and-Product-Name-in-emu.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From d6a415e7a62ca1bc21f1833f4251f512b2072a93 Mon Sep 17 00:00:00 2001
-From: Shaoqin Huang <shahuang@redhat.com>
-Date: Wed, 22 May 2024 03:23:28 -0400
-Subject: hw/arm/virt: Fix Manufacturer and Product Name in emulated SMBIOS
- mode
-
-Status: RHEL-only
-
-In vm, when run 'dmidecode -t system', it outputs different Manufacturer
-and Product Name on x86_64 and aarch64 system. For example:
-
-For aarch64 vm:
-	Manufacturer: QEMU
-	Product Name: KVM Virtual Machine
-
-For x86_64 vm:
-	Manufacturer: Red Hat
-	Product Name: KVM
-
-Fixing this issue by changing Manufacturer to 'Red Hat' and Product
-Name to 'KVM' on aarch64 platform. Thus the output is aligned on both
-x86_64 and aarch64 platform.
-
-To keep the compatability, this only apply for the RHEL9.6 machine
-type. For RHEL9.4 machine type, it still keep the old Manufacturer and
-Product Name.
-
-Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
----
- hw/arm/virt.c         | 14 ++++++++++++--
- include/hw/arm/virt.h |  1 +
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index bf05499a12..c50bff2a6c 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -1711,14 +1711,21 @@ static void virt_build_smbios(VirtMachineState *vms)
-     uint8_t *smbios_tables, *smbios_anchor;
-     size_t smbios_tables_len, smbios_anchor_len;
-     struct smbios_phys_mem_area mem_array;
-+    const char *manufacturer = "QEMU";
-     const char *product = "QEMU Virtual Machine";
-+    const char *version = vmc->smbios_old_sys_ver ? "1.0" : mc->name;
- 
-     if (kvm_enabled()) {
-         product = "KVM Virtual Machine";
-     }
- 
--    smbios_set_defaults("QEMU", product,
--                        vmc->smbios_old_sys_ver ? "1.0" : mc->name,
-+    if (!vmc->manufacturer_product_compat) {
-+        manufacturer = "Red Hat";
-+        product = "KVM";
-+        version = mc->desc;
-+    }
-+
-+    smbios_set_defaults(manufacturer, product, version,
-                         NULL, NULL);
- 
-     /* build the array of physical mem area from base_memmap */
-@@ -3587,10 +3594,13 @@ DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
- 
- static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
- {
-+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-+
-     virt_rhel_machine_9_6_0_options(mc);
- 
-     /* From virt_machine_9_0_options() */
-     mc->smbios_memory_device_size = 16 * GiB;
-+    vmc->manufacturer_product_compat = true;
- 
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_6, hw_compat_rhel_9_6_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index a4d937ed45..2fc30a7626 100644
---- a/include/hw/arm/virt.h
-+++ b/include/hw/arm/virt.h
-@@ -134,6 +134,7 @@ struct VirtMachineClass {
-     bool no_cpu_topology;
-     bool no_tcg_lpa2;
-     bool no_ns_el2_virt_timer_irq;
-+    bool manufacturer_product_compat;
- };
- 
- struct VirtMachineState {
--- 
-2.39.3
-
diff --git a/kvm-Enable-amd-iommu-device.patch b/kvm-Enable-amd-iommu-device.patch
deleted file mode 100644
index 44846a5..0000000
--- a/kvm-Enable-amd-iommu-device.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0608561efc441f234d9aaf45f1867ffb5c43cffe Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Jun 2025 15:41:14 -0500
-Subject: [PATCH 26/57] Enable amd-iommu device
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 380: Add ability to manually specify the AMDVI-PCI device
-RH-Jira: RHEL-70925
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/3] 852500a18275e14bcd94d598ccd0ee33b76578dc (johnalle/qemu-kvm-fork)
-
-Now that the amdvi-pci device that amd-iommu creates can be specified
-manually, amd-iommu device can be enabled.
-
-JIRA: https://issues.redhat.com/browse/RHEL-70925
-
-Upstream: RHEL ONLY
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-index 3e5f693b62..2b15fdc2db 100644
---- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -97,6 +97,7 @@ CONFIG_VIRTIO_MEM=y
- CONFIG_VIRTIO_PCI=y
- CONFIG_VIRTIO_VGA=y
- CONFIG_VIRTIO_IOMMU=y
-+CONFIG_AMD_IOMMU=y
- CONFIG_VMMOUSE=y
- CONFIG_VMPORT=y
- CONFIG_VTD=y
--- 
-2.39.3
-
diff --git a/kvm-KVM-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch b/kvm-KVM-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch
deleted file mode 100644
index 2670a23..0000000
--- a/kvm-KVM-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From f9dfed0e5fd03ee6fa7364801db7d101bf085a79 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Tue, 17 Sep 2024 12:38:33 -0400
-Subject: [PATCH 6/9] KVM: Define KVM_MEMSLOTS_NUM_MAX_DEFAULT
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [5/7] c95bdaa406e76b943882fd75c4d345ca5fc397d4 (peterx/qemu-kvm)
-
-Make the default max nr_slots a macro, it's only used when KVM reports
-nothing.
-
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Link: https://lore.kernel.org/r/20240917163835.194664-3-peterx@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b34a908c8f24eedb0a8e5ff486b059b58fd793f4)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 44bf4180fa..3900de8883 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -71,6 +71,8 @@
- 
- /* Default num of memslots to be allocated when VM starts */
- #define  KVM_MEMSLOTS_NR_ALLOC_DEFAULT                      16
-+/* Default max allowed memslots if kernel reported nothing */
-+#define  KVM_MEMSLOTS_NR_MAX_DEFAULT                        32
- 
- struct KVMParkedVcpu {
-     unsigned long vcpu_id;
-@@ -2617,7 +2619,7 @@ static int kvm_init(MachineState *ms)
- 
-     /* If unspecified, use the default value */
-     if (!s->nr_slots) {
--        s->nr_slots = 32;
-+        s->nr_slots_max = KVM_MEMSLOTS_NR_MAX_DEFAULT;
-     }
- 
-     s->nr_as = kvm_check_extension(s, KVM_CAP_MULTI_ADDRESS_SPACE);
--- 
-2.39.3
-
diff --git a/kvm-KVM-Dynamic-sized-kvm-memslots-array.patch b/kvm-KVM-Dynamic-sized-kvm-memslots-array.patch
deleted file mode 100644
index f3f0522..0000000
--- a/kvm-KVM-Dynamic-sized-kvm-memslots-array.patch
+++ /dev/null
@@ -1,250 +0,0 @@
-From 9813dc1d19a6afedbab382b79e72691190e42fcf Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Tue, 17 Sep 2024 12:38:32 -0400
-Subject: [PATCH 5/9] KVM: Dynamic sized kvm memslots array
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [4/7] 04d74707873b28a50b1e1bc08e4788c79455518c (peterx/qemu-kvm)
-
-Zhiyi reported an infinite loop issue in VFIO use case.  The cause of that
-was a separate discussion, however during that I found a regression of
-dirty sync slowness when profiling.
-
-Each KVMMemoryListerner maintains an array of kvm memslots.  Currently it's
-statically allocated to be the max supported by the kernel.  However after
-Linux commit 4fc096a99e ("KVM: Raise the maximum number of user memslots"),
-the max supported memslots reported now grows to some number large enough
-so that it may not be wise to always statically allocate with the max
-reported.
-
-What's worse, QEMU kvm code still walks all the allocated memslots entries
-to do any form of lookups.  It can drastically slow down all memslot
-operations because each of such loop can run over 32K times on the new
-kernels.
-
-Fix this issue by making the memslots to be allocated dynamically.
-
-Here the initial size was set to 16 because it should cover the basic VM
-usages, so that the hope is the majority VM use case may not even need to
-grow at all (e.g. if one starts a VM with ./qemu-system-x86_64 by default
-it'll consume 9 memslots), however not too large to waste memory.
-
-There can also be even better way to address this, but so far this is the
-simplest and should be already better even than before we grow the max
-supported memslots.  For example, in the case of above issue when VFIO was
-attached on a 32GB system, there are only ~10 memslots used.  So it could
-be good enough as of now.
-
-In the above VFIO context, measurement shows that the precopy dirty sync
-shrinked from ~86ms to ~3ms after this patch applied.  It should also apply
-to any KVM enabled VM even without VFIO.
-
-NOTE: we don't have a FIXES tag for this patch because there's no real
-commit that regressed this in QEMU. Such behavior existed for a long time,
-but only start to be a problem when the kernel reports very large
-nr_slots_max value.  However that's pretty common now (the kernel change
-was merged in 2021) so we attached cc:stable because we'll want this change
-to be backported to stable branches.
-
-Cc: qemu-stable <qemu-stable@nongnu.org>
-Reported-by: Zhiyi Guo <zhguo@redhat.com>
-Tested-by: Zhiyi Guo <zhguo@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Link: https://lore.kernel.org/r/20240917163835.194664-2-peterx@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 5504a8126115d173687b37e657312a8ffe29fc0c)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c      | 87 +++++++++++++++++++++++++++++++++-------
- accel/kvm/trace-events   |  1 +
- include/sysemu/kvm_int.h |  1 +
- 3 files changed, 74 insertions(+), 15 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index de709fbc43..44bf4180fa 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -69,6 +69,9 @@
- #define KVM_GUESTDBG_BLOCKIRQ 0
- #endif
- 
-+/* Default num of memslots to be allocated when VM starts */
-+#define  KVM_MEMSLOTS_NR_ALLOC_DEFAULT                      16
-+
- struct KVMParkedVcpu {
-     unsigned long vcpu_id;
-     int kvm_fd;
-@@ -165,6 +168,57 @@ void kvm_resample_fd_notify(int gsi)
-     }
- }
- 
-+/**
-+ * kvm_slots_grow(): Grow the slots[] array in the KVMMemoryListener
-+ *
-+ * @kml: The KVMMemoryListener* to grow the slots[] array
-+ * @nr_slots_new: The new size of slots[] array
-+ *
-+ * Returns: True if the array grows larger, false otherwise.
-+ */
-+static bool kvm_slots_grow(KVMMemoryListener *kml, unsigned int nr_slots_new)
-+{
-+    unsigned int i, cur = kml->nr_slots_allocated;
-+    KVMSlot *slots;
-+
-+    if (nr_slots_new > kvm_state->nr_slots) {
-+        nr_slots_new = kvm_state->nr_slots;
-+    }
-+
-+    if (cur >= nr_slots_new) {
-+        /* Big enough, no need to grow, or we reached max */
-+        return false;
-+    }
-+
-+    if (cur == 0) {
-+        slots = g_new0(KVMSlot, nr_slots_new);
-+    } else {
-+        assert(kml->slots);
-+        slots = g_renew(KVMSlot, kml->slots, nr_slots_new);
-+        /*
-+         * g_renew() doesn't initialize extended buffers, however kvm
-+         * memslots require fields to be zero-initialized. E.g. pointers,
-+         * memory_size field, etc.
-+         */
-+        memset(&slots[cur], 0x0, sizeof(slots[0]) * (nr_slots_new - cur));
-+    }
-+
-+    for (i = cur; i < nr_slots_new; i++) {
-+        slots[i].slot = i;
-+    }
-+
-+    kml->slots = slots;
-+    kml->nr_slots_allocated = nr_slots_new;
-+    trace_kvm_slots_grow(cur, nr_slots_new);
-+
-+    return true;
-+}
-+
-+static bool kvm_slots_double(KVMMemoryListener *kml)
-+{
-+    return kvm_slots_grow(kml, kml->nr_slots_allocated * 2);
-+}
-+
- unsigned int kvm_get_max_memslots(void)
- {
-     KVMState *s = KVM_STATE(current_accel());
-@@ -193,15 +247,26 @@ unsigned int kvm_get_free_memslots(void)
- /* Called with KVMMemoryListener.slots_lock held */
- static KVMSlot *kvm_get_free_slot(KVMMemoryListener *kml)
- {
--    KVMState *s = kvm_state;
-+    unsigned int n;
-     int i;
- 
--    for (i = 0; i < s->nr_slots; i++) {
-+    for (i = 0; i < kml->nr_slots_allocated; i++) {
-         if (kml->slots[i].memory_size == 0) {
-             return &kml->slots[i];
-         }
-     }
- 
-+    /*
-+     * If no free slots, try to grow first by doubling.  Cache the old size
-+     * here to avoid another round of search: if the grow succeeded, it
-+     * means slots[] now must have the existing "n" slots occupied,
-+     * followed by one or more free slots starting from slots[n].
-+     */
-+    n = kml->nr_slots_allocated;
-+    if (kvm_slots_double(kml)) {
-+        return &kml->slots[n];
-+    }
-+
-     return NULL;
- }
- 
-@@ -222,10 +287,9 @@ static KVMSlot *kvm_lookup_matching_slot(KVMMemoryListener *kml,
-                                          hwaddr start_addr,
-                                          hwaddr size)
- {
--    KVMState *s = kvm_state;
-     int i;
- 
--    for (i = 0; i < s->nr_slots; i++) {
-+    for (i = 0; i < kml->nr_slots_allocated; i++) {
-         KVMSlot *mem = &kml->slots[i];
- 
-         if (start_addr == mem->start_addr && size == mem->memory_size) {
-@@ -267,7 +331,7 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
-     int i, ret = 0;
- 
-     kvm_slots_lock();
--    for (i = 0; i < s->nr_slots; i++) {
-+    for (i = 0; i < kml->nr_slots_allocated; i++) {
-         KVMSlot *mem = &kml->slots[i];
- 
-         if (ram >= mem->ram && ram < mem->ram + mem->memory_size) {
-@@ -1071,7 +1135,7 @@ static int kvm_physical_log_clear(KVMMemoryListener *kml,
- 
-     kvm_slots_lock();
- 
--    for (i = 0; i < s->nr_slots; i++) {
-+    for (i = 0; i < kml->nr_slots_allocated; i++) {
-         mem = &kml->slots[i];
-         /* Discard slots that are empty or do not overlap the section */
-         if (!mem->memory_size ||
-@@ -1719,12 +1783,8 @@ static void kvm_log_sync_global(MemoryListener *l, bool last_stage)
-     /* Flush all kernel dirty addresses into KVMSlot dirty bitmap */
-     kvm_dirty_ring_flush();
- 
--    /*
--     * TODO: make this faster when nr_slots is big while there are
--     * only a few used slots (small VMs).
--     */
-     kvm_slots_lock();
--    for (i = 0; i < s->nr_slots; i++) {
-+    for (i = 0; i < kml->nr_slots_allocated; i++) {
-         mem = &kml->slots[i];
-         if (mem->memory_size && mem->flags & KVM_MEM_LOG_DIRTY_PAGES) {
-             kvm_slot_sync_dirty_pages(mem);
-@@ -1839,12 +1899,9 @@ void kvm_memory_listener_register(KVMState *s, KVMMemoryListener *kml,
- {
-     int i;
- 
--    kml->slots = g_new0(KVMSlot, s->nr_slots);
-     kml->as_id = as_id;
- 
--    for (i = 0; i < s->nr_slots; i++) {
--        kml->slots[i].slot = i;
--    }
-+    kvm_slots_grow(kml, KVM_MEMSLOTS_NR_ALLOC_DEFAULT);
- 
-     QSIMPLEQ_INIT(&kml->transaction_add);
-     QSIMPLEQ_INIT(&kml->transaction_del);
-diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
-index 37626c1ac5..ad2ae6fca5 100644
---- a/accel/kvm/trace-events
-+++ b/accel/kvm/trace-events
-@@ -36,3 +36,4 @@ kvm_io_window_exit(void) ""
- kvm_run_exit_system_event(int cpu_index, uint32_t event_type) "cpu_index %d, system_even_type %"PRIu32
- kvm_convert_memory(uint64_t start, uint64_t size, const char *msg) "start 0x%" PRIx64 " size 0x%" PRIx64 " %s"
- kvm_memory_fault(uint64_t start, uint64_t size, uint64_t flags) "start 0x%" PRIx64 " size 0x%" PRIx64 " flags 0x%" PRIx64
-+kvm_slots_grow(unsigned int old, unsigned int new) "%u -> %u"
-diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
-index 1d8fb1473b..48e496b3d4 100644
---- a/include/sysemu/kvm_int.h
-+++ b/include/sysemu/kvm_int.h
-@@ -46,6 +46,7 @@ typedef struct KVMMemoryListener {
-     MemoryListener listener;
-     KVMSlot *slots;
-     unsigned int nr_used_slots;
-+    unsigned int nr_slots_allocated;
-     int as_id;
-     QSIMPLEQ_HEAD(, KVMMemoryUpdate) transaction_add;
-     QSIMPLEQ_HEAD(, KVMMemoryUpdate) transaction_del;
--- 
-2.39.3
-
diff --git a/kvm-KVM-Rename-KVMMemoryListener.nr_used_slots-to-nr_slo.patch b/kvm-KVM-Rename-KVMMemoryListener.nr_used_slots-to-nr_slo.patch
deleted file mode 100644
index 2998318..0000000
--- a/kvm-KVM-Rename-KVMMemoryListener.nr_used_slots-to-nr_slo.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 6c0a0d9734c507af2c84aa33eb1624f35e1f51fb Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Tue, 17 Sep 2024 12:38:34 -0400
-Subject: [PATCH 7/9] KVM: Rename KVMMemoryListener.nr_used_slots to
- nr_slots_used
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [6/7] 74e9576751e0adeb8113a5e8e495b4b1285b0d76 (peterx/qemu-kvm)
-
-This will make all nr_slots counters to be named in the same manner.
-
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Link: https://lore.kernel.org/r/20240917163835.194664-4-peterx@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit dbdc00ba5b136bba80d850f61cc79a9cafaae1cd)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c      | 6 +++---
- include/sysemu/kvm_int.h | 2 +-
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 3900de8883..e414d015c9 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -239,7 +239,7 @@ unsigned int kvm_get_free_memslots(void)
-         if (!s->as[i].ml) {
-             continue;
-         }
--        used_slots = MAX(used_slots, s->as[i].ml->nr_used_slots);
-+        used_slots = MAX(used_slots, s->as[i].ml->nr_slots_used);
-     }
-     kvm_slots_unlock();
- 
-@@ -1516,7 +1516,7 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
-             }
-             start_addr += slot_size;
-             size -= slot_size;
--            kml->nr_used_slots--;
-+            kml->nr_slots_used--;
-         } while (size);
-         return;
-     }
-@@ -1555,7 +1555,7 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
-         ram_start_offset += slot_size;
-         ram += slot_size;
-         size -= slot_size;
--        kml->nr_used_slots++;
-+        kml->nr_slots_used++;
-     } while (size);
- }
- 
-diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
-index 48e496b3d4..b705dfc9b4 100644
---- a/include/sysemu/kvm_int.h
-+++ b/include/sysemu/kvm_int.h
-@@ -45,7 +45,7 @@ typedef struct KVMMemoryUpdate {
- typedef struct KVMMemoryListener {
-     MemoryListener listener;
-     KVMSlot *slots;
--    unsigned int nr_used_slots;
-+    unsigned int nr_slots_used;
-     unsigned int nr_slots_allocated;
-     int as_id;
-     QSIMPLEQ_HEAD(, KVMMemoryUpdate) transaction_add;
--- 
-2.39.3
-
diff --git a/kvm-KVM-Rename-KVMState-nr_slots-to-nr_slots_max.patch b/kvm-KVM-Rename-KVMState-nr_slots-to-nr_slots_max.patch
deleted file mode 100644
index 1787c16..0000000
--- a/kvm-KVM-Rename-KVMState-nr_slots-to-nr_slots_max.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 5b731abd3a932fe9a21f83f3849a3b3769906e19 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Tue, 17 Sep 2024 12:38:35 -0400
-Subject: [PATCH 8/9] KVM: Rename KVMState->nr_slots to nr_slots_max
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [7/7] 43471483e7380119ba6415bff6d8ee6c69aa9cd7 (peterx/qemu-kvm)
-
-This value used to reflect the maximum supported memslots from KVM kernel.
-Rename it to be clearer.
-
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Link: https://lore.kernel.org/r/20240917163835.194664-5-peterx@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 943c742868c739c0b14fd996bad3adf744156fec)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c      | 12 ++++++------
- include/sysemu/kvm_int.h |  4 ++--
- 2 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index e414d015c9..49dedda47e 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -183,8 +183,8 @@ static bool kvm_slots_grow(KVMMemoryListener *kml, unsigned int nr_slots_new)
-     unsigned int i, cur = kml->nr_slots_allocated;
-     KVMSlot *slots;
- 
--    if (nr_slots_new > kvm_state->nr_slots) {
--        nr_slots_new = kvm_state->nr_slots;
-+    if (nr_slots_new > kvm_state->nr_slots_max) {
-+        nr_slots_new = kvm_state->nr_slots_max;
-     }
- 
-     if (cur >= nr_slots_new) {
-@@ -225,7 +225,7 @@ unsigned int kvm_get_max_memslots(void)
- {
-     KVMState *s = KVM_STATE(current_accel());
- 
--    return s->nr_slots;
-+    return s->nr_slots_max;
- }
- 
- unsigned int kvm_get_free_memslots(void)
-@@ -243,7 +243,7 @@ unsigned int kvm_get_free_memslots(void)
-     }
-     kvm_slots_unlock();
- 
--    return s->nr_slots - used_slots;
-+    return s->nr_slots_max - used_slots;
- }
- 
- /* Called with KVMMemoryListener.slots_lock held */
-@@ -2615,10 +2615,10 @@ static int kvm_init(MachineState *ms)
-         (kvm_supported_memory_attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE);
- 
-     kvm_immediate_exit = kvm_check_extension(s, KVM_CAP_IMMEDIATE_EXIT);
--    s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
-+    s->nr_slots_max = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
- 
-     /* If unspecified, use the default value */
--    if (!s->nr_slots) {
-+    if (!s->nr_slots_max) {
-         s->nr_slots_max = KVM_MEMSLOTS_NR_MAX_DEFAULT;
-     }
- 
-diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
-index b705dfc9b4..2c57194b6b 100644
---- a/include/sysemu/kvm_int.h
-+++ b/include/sysemu/kvm_int.h
-@@ -103,8 +103,8 @@ struct KVMDirtyRingReaper {
- struct KVMState
- {
-     AccelState parent_obj;
--
--    int nr_slots;
-+    /* Max number of KVM slots supported */
-+    int nr_slots_max;
-     int fd;
-     int vmfd;
-     int coalesced_mmio;
--- 
-2.39.3
-
diff --git a/kvm-accel-kvm-refactor-dirty-ring-setup.patch b/kvm-accel-kvm-refactor-dirty-ring-setup.patch
deleted file mode 100644
index ec064f5..0000000
--- a/kvm-accel-kvm-refactor-dirty-ring-setup.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From e27a9d1e5194243084efe4405fe50463442f0fe3 Mon Sep 17 00:00:00 2001
-From: Ani Sinha <anisinha@redhat.com>
-Date: Thu, 12 Sep 2024 11:48:38 +0530
-Subject: [PATCH 4/9] accel/kvm: refactor dirty ring setup
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [3/7] 226ae9826237887fc55f75b9175524f12b4fa4a9 (peterx/qemu-kvm)
-
-Refactor setting up of dirty ring code in kvm_init() so that is can be
-reused in the future patchsets.
-
-Signed-off-by: Ani Sinha <anisinha@redhat.com>
-Link: https://lore.kernel.org/r/20240912061838.4501-1-anisinha@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 28ed7f9761eb273e7dedcfdc0507d158106d0451)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c | 88 +++++++++++++++++++++++++--------------------
- 1 file changed, 50 insertions(+), 38 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 4f96d8b45e..de709fbc43 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2439,6 +2439,55 @@ static int find_kvm_machine_type(MachineState *ms)
-     return type;
- }
- 
-+static int kvm_setup_dirty_ring(KVMState *s)
-+{
-+    uint64_t dirty_log_manual_caps;
-+    int ret;
-+
-+    /*
-+     * Enable KVM dirty ring if supported, otherwise fall back to
-+     * dirty logging mode
-+     */
-+    ret = kvm_dirty_ring_init(s);
-+    if (ret < 0) {
-+        return ret;
-+    }
-+
-+    /*
-+     * KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 is not needed when dirty ring is
-+     * enabled.  More importantly, KVM_DIRTY_LOG_INITIALLY_SET will assume no
-+     * page is wr-protected initially, which is against how kvm dirty ring is
-+     * usage - kvm dirty ring requires all pages are wr-protected at the very
-+     * beginning.  Enabling this feature for dirty ring causes data corruption.
-+     *
-+     * TODO: Without KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 and kvm clear dirty log,
-+     * we may expect a higher stall time when starting the migration.  In the
-+     * future we can enable KVM_CLEAR_DIRTY_LOG to work with dirty ring too:
-+     * instead of clearing dirty bit, it can be a way to explicitly wr-protect
-+     * guest pages.
-+     */
-+    if (!s->kvm_dirty_ring_size) {
-+        dirty_log_manual_caps =
-+            kvm_check_extension(s, KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2);
-+        dirty_log_manual_caps &= (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE |
-+                                  KVM_DIRTY_LOG_INITIALLY_SET);
-+        s->manual_dirty_log_protect = dirty_log_manual_caps;
-+        if (dirty_log_manual_caps) {
-+            ret = kvm_vm_enable_cap(s, KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2, 0,
-+                                    dirty_log_manual_caps);
-+            if (ret) {
-+                warn_report("Trying to enable capability %"PRIu64" of "
-+                            "KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 but failed. "
-+                            "Falling back to the legacy mode. ",
-+                            dirty_log_manual_caps);
-+                s->manual_dirty_log_protect = 0;
-+            }
-+        }
-+    }
-+
-+    return 0;
-+}
-+
- static int kvm_init(MachineState *ms)
- {
-     MachineClass *mc = MACHINE_GET_CLASS(ms);
-@@ -2458,7 +2507,6 @@ static int kvm_init(MachineState *ms)
-     const KVMCapabilityInfo *missing_cap;
-     int ret;
-     int type;
--    uint64_t dirty_log_manual_caps;
- 
-     qemu_mutex_init(&kml_slots_lock);
- 
-@@ -2570,47 +2618,11 @@ static int kvm_init(MachineState *ms)
-     s->coalesced_pio = s->coalesced_mmio &&
-                        kvm_check_extension(s, KVM_CAP_COALESCED_PIO);
- 
--    /*
--     * Enable KVM dirty ring if supported, otherwise fall back to
--     * dirty logging mode
--     */
--    ret = kvm_dirty_ring_init(s);
-+    ret = kvm_setup_dirty_ring(s);
-     if (ret < 0) {
-         goto err;
-     }
- 
--    /*
--     * KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 is not needed when dirty ring is
--     * enabled.  More importantly, KVM_DIRTY_LOG_INITIALLY_SET will assume no
--     * page is wr-protected initially, which is against how kvm dirty ring is
--     * usage - kvm dirty ring requires all pages are wr-protected at the very
--     * beginning.  Enabling this feature for dirty ring causes data corruption.
--     *
--     * TODO: Without KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 and kvm clear dirty log,
--     * we may expect a higher stall time when starting the migration.  In the
--     * future we can enable KVM_CLEAR_DIRTY_LOG to work with dirty ring too:
--     * instead of clearing dirty bit, it can be a way to explicitly wr-protect
--     * guest pages.
--     */
--    if (!s->kvm_dirty_ring_size) {
--        dirty_log_manual_caps =
--            kvm_check_extension(s, KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2);
--        dirty_log_manual_caps &= (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE |
--                                  KVM_DIRTY_LOG_INITIALLY_SET);
--        s->manual_dirty_log_protect = dirty_log_manual_caps;
--        if (dirty_log_manual_caps) {
--            ret = kvm_vm_enable_cap(s, KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2, 0,
--                                    dirty_log_manual_caps);
--            if (ret) {
--                warn_report("Trying to enable capability %"PRIu64" of "
--                            "KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2 but failed. "
--                            "Falling back to the legacy mode. ",
--                            dirty_log_manual_caps);
--                s->manual_dirty_log_protect = 0;
--            }
--        }
--    }
--
- #ifdef KVM_CAP_VCPU_EVENTS
-     s->vcpu_events = kvm_check_extension(s, KVM_CAP_VCPU_EVENTS);
- #endif
--- 
-2.39.3
-
diff --git a/kvm-amd_iommu-Add-support-for-pass-though-mode.patch b/kvm-amd_iommu-Add-support-for-pass-though-mode.patch
deleted file mode 100644
index b0038a7..0000000
--- a/kvm-amd_iommu-Add-support-for-pass-though-mode.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 4114553452f7187283aefa001bc8342fc65b6b72 Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Dec 2024 15:06:48 -0600
-Subject: [PATCH 04/57] amd_iommu: Add support for pass though mode
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 303: Interrupt Remap support for emulated amd viommu
-RH-Jira: RHEL-66202
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/5] 0434fefd554baf27fb9d93026af513c621f8cdb0 (johnalle/qemu-kvm-fork)
-
-JIRA: https://issues.redhat.com/browse/RHEL-66202
-
-commit c1f46999ef506d9854534560a94d02cf3cf9edd1
-Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date:   Fri Sep 27 12:29:10 2024 -0500
-
-    amd_iommu: Add support for pass though mode
-
-    Introduce 'nodma' shared memory region to support PT mode
-    so that for each device, we only create an alias to shared memory
-    region when DMA-remapping is disabled.
-
-    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
-    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-    Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
-    Message-Id: <20240927172913.121477-3-santosh.shukla@amd.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: John Allen <john.allen@amd.com>
----
- hw/i386/amd_iommu.c | 49 ++++++++++++++++++++++++++++++++++++---------
- hw/i386/amd_iommu.h |  2 ++
- 2 files changed, 42 insertions(+), 9 deletions(-)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 148b5ee51d..567cb8adc9 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -60,8 +60,9 @@ struct AMDVIAddressSpace {
-     uint8_t bus_num;            /* bus number                           */
-     uint8_t devfn;              /* device function                      */
-     AMDVIState *iommu_state;    /* AMDVI - one per machine              */
--    MemoryRegion root;          /* AMDVI Root memory map region */
-+    MemoryRegion root;          /* AMDVI Root memory map region         */
-     IOMMUMemoryRegion iommu;    /* Device's address translation region  */
-+    MemoryRegion iommu_nodma;   /* Alias of shared nodma memory region  */
-     MemoryRegion iommu_ir;      /* Device's interrupt remapping region  */
-     AddressSpace as;            /* device's corresponding address space */
- };
-@@ -1412,6 +1413,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-     AMDVIState *s = opaque;
-     AMDVIAddressSpace **iommu_as, *amdvi_dev_as;
-     int bus_num = pci_bus_num(bus);
-+    X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
- 
-     iommu_as = s->address_spaces[bus_num];
- 
-@@ -1436,13 +1438,13 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-          * Memory region relationships looks like (Address range shows
-          * only lower 32 bits to make it short in length...):
-          *
--         * |-----------------+-------------------+----------|
--         * | Name            | Address range     | Priority |
--         * |-----------------+-------------------+----------+
--         * | amdvi_root      | 00000000-ffffffff |        0 |
--         * |  amdvi_iommu    | 00000000-ffffffff |        1 |
--         * |  amdvi_iommu_ir | fee00000-feefffff |       64 |
--         * |-----------------+-------------------+----------|
-+         * |--------------------+-------------------+----------|
-+         * | Name               | Address range     | Priority |
-+         * |--------------------+-------------------+----------+
-+         * | amdvi-root         | 00000000-ffffffff |        0 |
-+         * |  amdvi-iommu_nodma  | 00000000-ffffffff |       0 |
-+         * |  amdvi-iommu_ir     | fee00000-feefffff |      64 |
-+         * |--------------------+-------------------+----------|
-          */
-         memory_region_init_iommu(&amdvi_dev_as->iommu,
-                                  sizeof(amdvi_dev_as->iommu),
-@@ -1461,7 +1463,25 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-                                             64);
-         memory_region_add_subregion_overlap(&amdvi_dev_as->root, 0,
-                                             MEMORY_REGION(&amdvi_dev_as->iommu),
--                                            1);
-+                                            0);
-+
-+        /* Build the DMA Disabled alias to shared memory */
-+        memory_region_init_alias(&amdvi_dev_as->iommu_nodma, OBJECT(s),
-+                                 "amdvi-sys", &s->mr_sys, 0,
-+                                 memory_region_size(&s->mr_sys));
-+        memory_region_add_subregion_overlap(&amdvi_dev_as->root, 0,
-+                                            &amdvi_dev_as->iommu_nodma,
-+                                            0);
-+
-+        if (!x86_iommu->pt_supported) {
-+            memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, false);
-+            memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu),
-+                                      true);
-+        } else {
-+            memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu),
-+                                      false);
-+            memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, true);
-+        }
-     }
-     return &iommu_as[devfn]->as;
- }
-@@ -1602,6 +1622,17 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-                           "amdvi-mmio", AMDVI_MMIO_SIZE);
-     memory_region_add_subregion(get_system_memory(), AMDVI_BASE_ADDR,
-                                 &s->mr_mmio);
-+
-+    /* Create the share memory regions by all devices */
-+    memory_region_init(&s->mr_sys, OBJECT(s), "amdvi-sys", UINT64_MAX);
-+
-+    /* set up the DMA disabled memory region */
-+    memory_region_init_alias(&s->mr_nodma, OBJECT(s),
-+                             "amdvi-nodma", get_system_memory(), 0,
-+                             memory_region_size(get_system_memory()));
-+    memory_region_add_subregion_overlap(&s->mr_sys, 0,
-+                                        &s->mr_nodma, 0);
-+
-     pci_setup_iommu(bus, &amdvi_iommu_ops, s);
-     amdvi_init(s);
- }
-diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
-index e5c2ae94f2..be417e51c4 100644
---- a/hw/i386/amd_iommu.h
-+++ b/hw/i386/amd_iommu.h
-@@ -354,6 +354,8 @@ struct AMDVIState {
-     uint32_t pprlog_tail;        /* ppr log tail */
- 
-     MemoryRegion mr_mmio;              /* MMIO region                  */
-+    MemoryRegion mr_sys;
-+    MemoryRegion mr_nodma;
-     uint8_t mmior[AMDVI_MMIO_SIZE];    /* read/write MMIO              */
-     uint8_t w1cmask[AMDVI_MMIO_SIZE];  /* read/write 1 clear mask      */
-     uint8_t romask[AMDVI_MMIO_SIZE];   /* MMIO read/only mask          */
--- 
-2.39.3
-
diff --git a/kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch b/kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch
deleted file mode 100644
index a230203..0000000
--- a/kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 0397ebacdba6539147d9986255c3f81cbfdabf1e Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Dec 2024 15:07:03 -0600
-Subject: [PATCH 07/57] amd_iommu: Check APIC ID > 255 for XTSup
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 303: Interrupt Remap support for emulated amd viommu
-RH-Jira: RHEL-66202
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/5] f39b3e3cdefc2b562f1ad2ef939a37bf404f355a (johnalle/qemu-kvm-fork)
-
-JIRA: https://issues.redhat.com/browse/RHEL-66202
-
-commit b12cb3819baf6d9ee8140d4dd6d36fa829e2c6d9
-Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date:   Fri Sep 27 12:29:13 2024 -0500
-
-    amd_iommu: Check APIC ID > 255 for XTSup
-
-    The XTSup mode enables x2APIC support for AMD IOMMU, which is needed
-    to support vcpu w/ APIC ID > 255.
-
-    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
-    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-    Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
-    Message-Id: <20240927172913.121477-6-santosh.shukla@amd.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: John Allen <john.allen@amd.com>
----
- hw/i386/amd_iommu.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 82d76dfca9..d804656ea8 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -32,6 +32,7 @@
- #include "trace.h"
- #include "hw/i386/apic-msidef.h"
- #include "hw/qdev-properties.h"
-+#include "kvm/kvm_i386.h"
- 
- /* used AMD-Vi MMIO registers */
- const char *amdvi_mmio_low[] = {
-@@ -1651,6 +1652,16 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-     memory_region_add_subregion_overlap(&s->mr_sys, AMDVI_INT_ADDR_FIRST,
-                                         &s->mr_ir, 1);
- 
-+    /* AMD IOMMU with x2APIC mode requires xtsup=on */
-+    if (x86ms->apic_id_limit > 255 && !s->xtsup) {
-+        error_report("AMD IOMMU with x2APIC confguration requires xtsup=on");
-+        exit(EXIT_FAILURE);
-+    }
-+    if (s->xtsup && kvm_irqchip_is_split() && !kvm_enable_x2apic()) {
-+        error_report("AMD IOMMU xtsup=on requires support on the KVM side");
-+        exit(EXIT_FAILURE);
-+    }
-+
-     pci_setup_iommu(bus, &amdvi_iommu_ops, s);
-     amdvi_init(s);
- }
--- 
-2.39.3
-
diff --git a/kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch b/kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch
deleted file mode 100644
index 76c9fd6..0000000
--- a/kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From f733325d3d91576ae9f6e341faabc301542fc6c8 Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Dec 2024 15:06:44 -0600
-Subject: [PATCH 03/57] amd_iommu: Rename variable mmio to mr_mmio
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 303: Interrupt Remap support for emulated amd viommu
-RH-Jira: RHEL-66202
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/5] 1996a48efb7210d4d1e0b929be2d115d672e1a02 (johnalle/qemu-kvm-fork)
-
-JIRA: https://issues.redhat.com/browse/RHEL-66202
-
-commit 2e6f051cfc58e69dcb392cd245d8f01b0c2e963f
-Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date:   Fri Sep 27 12:29:09 2024 -0500
-
-    amd_iommu: Rename variable mmio to mr_mmio
-
-    Rename the MMIO memory region variable 'mmio' to 'mr_mmio'
-    so to correctly name align with struct AMDVIState::variable type.
-
-    No functional change intended.
-
-    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
-    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-    Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
-    Message-Id: <20240927172913.121477-2-santosh.shukla@amd.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: John Allen <john.allen@amd.com>
----
- hw/i386/acpi-build.c | 4 ++--
- hw/i386/amd_iommu.c  | 6 +++---
- hw/i386/amd_iommu.h  | 2 +-
- 3 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
-index 5d4bd2b710..032fb1f904 100644
---- a/hw/i386/acpi-build.c
-+++ b/hw/i386/acpi-build.c
-@@ -2397,7 +2397,7 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
-     /* Capability offset */
-     build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
-     /* IOMMU base address */
--    build_append_int_noprefix(table_data, s->mmio.addr, 8);
-+    build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
-     /* PCI Segment Group */
-     build_append_int_noprefix(table_data, 0, 2);
-     /* IOMMU info */
-@@ -2432,7 +2432,7 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
-     /* Capability offset */
-     build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
-     /* IOMMU base address */
--    build_append_int_noprefix(table_data, s->mmio.addr, 8);
-+    build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
-     /* PCI Segment Group */
-     build_append_int_noprefix(table_data, 0, 2);
-     /* IOMMU info */
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 87643d2891..148b5ee51d 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -1598,10 +1598,10 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-     x86ms->ioapic_as = amdvi_host_dma_iommu(bus, s, AMDVI_IOAPIC_SB_DEVID);
- 
-     /* set up MMIO */
--    memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "amdvi-mmio",
--                          AMDVI_MMIO_SIZE);
-+    memory_region_init_io(&s->mr_mmio, OBJECT(s), &mmio_mem_ops, s,
-+                          "amdvi-mmio", AMDVI_MMIO_SIZE);
-     memory_region_add_subregion(get_system_memory(), AMDVI_BASE_ADDR,
--                                &s->mmio);
-+                                &s->mr_mmio);
-     pci_setup_iommu(bus, &amdvi_iommu_ops, s);
-     amdvi_init(s);
- }
-diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
-index 73619fe9ea..e5c2ae94f2 100644
---- a/hw/i386/amd_iommu.h
-+++ b/hw/i386/amd_iommu.h
-@@ -353,7 +353,7 @@ struct AMDVIState {
-     uint32_t pprlog_head;        /* ppr log head */
-     uint32_t pprlog_tail;        /* ppr log tail */
- 
--    MemoryRegion mmio;                 /* MMIO region                  */
-+    MemoryRegion mr_mmio;              /* MMIO region                  */
-     uint8_t mmior[AMDVI_MMIO_SIZE];    /* read/write MMIO              */
-     uint8_t w1cmask[AMDVI_MMIO_SIZE];  /* read/write 1 clear mask      */
-     uint8_t romask[AMDVI_MMIO_SIZE];   /* MMIO read/only mask          */
--- 
-2.39.3
-
diff --git a/kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch b/kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch
deleted file mode 100644
index 044f8d1..0000000
--- a/kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 17ce6ac0d8edb04ba79bb39d3f695cd0506a9dc2 Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Dec 2024 15:06:59 -0600
-Subject: [PATCH 06/57] amd_iommu: Send notification when invalidate interrupt
- entry cache
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 303: Interrupt Remap support for emulated amd viommu
-RH-Jira: RHEL-66202
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/5] d57e8fb4e69f3c01d32673bf658aae5067d6b969 (johnalle/qemu-kvm-fork)
-
-JIRA: https://issues.redhat.com/browse/RHEL-66202
-
-commit f84aad4d718b83d2a4d90485992e5421430032e1
-Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date:   Fri Sep 27 12:29:12 2024 -0500
-
-    amd_iommu: Send notification when invalidate interrupt entry cache
-
-    In order to support AMD IOMMU interrupt remapping emulation with PCI
-    pass-through devices, QEMU needs to notify VFIO when guest IOMMU driver
-    updates and invalidate the guest interrupt remapping table (IRT), and
-    communicate information so that the host IOMMU driver can update
-    the shadowed interrupt remapping table in the host IOMMU.
-
-    Therefore, send notification when guest IOMMU emulates the IRT
-    invalidation commands.
-
-    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
-    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-    Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
-    Message-Id: <20240927172913.121477-5-santosh.shukla@amd.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: John Allen <john.allen@amd.com>
----
- hw/i386/amd_iommu.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 8fcf5eacb4..82d76dfca9 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -431,6 +431,12 @@ static void amdvi_complete_ppr(AMDVIState *s, uint64_t *cmd)
-     trace_amdvi_ppr_exec();
- }
- 
-+static void amdvi_intremap_inval_notify_all(AMDVIState *s, bool global,
-+                               uint32_t index, uint32_t mask)
-+{
-+    x86_iommu_iec_notify_all(X86_IOMMU_DEVICE(s), global, index, mask);
-+}
-+
- static void amdvi_inval_all(AMDVIState *s, uint64_t *cmd)
- {
-     if (extract64(cmd[0], 0, 60) || cmd[1]) {
-@@ -438,6 +444,9 @@ static void amdvi_inval_all(AMDVIState *s, uint64_t *cmd)
-                                    s->cmdbuf + s->cmdbuf_head);
-     }
- 
-+    /* Notify global invalidation */
-+    amdvi_intremap_inval_notify_all(s, true, 0, 0);
-+
-     amdvi_iotlb_reset(s);
-     trace_amdvi_all_inval();
- }
-@@ -486,6 +495,9 @@ static void amdvi_inval_inttable(AMDVIState *s, uint64_t *cmd)
-         return;
-     }
- 
-+    /* Notify global invalidation */
-+    amdvi_intremap_inval_notify_all(s, true, 0, 0);
-+
-     trace_amdvi_intr_inval();
- }
- 
--- 
-2.39.3
-
diff --git a/kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch b/kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch
deleted file mode 100644
index 39ad4ef..0000000
--- a/kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 4859d41adfaae8933e074dcefdc81edd3832c914 Mon Sep 17 00:00:00 2001
-From: John Allen <john.allen@amd.com>
-Date: Wed, 11 Dec 2024 15:06:55 -0600
-Subject: [PATCH 05/57] amd_iommu: Use shared memory region for Interrupt
- Remapping
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 303: Interrupt Remap support for emulated amd viommu
-RH-Jira: RHEL-66202
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/5] 48c0513c80257bfbd12c2cf3bab2503bd95d0b1c (johnalle/qemu-kvm-fork)
-
-JIRA: https://issues.redhat.com/browse/RHEL-66202
-
-commit 9fc9dbac61ddde7d8df37e84c8e02cec249d3222
-Author: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date:   Fri Sep 27 12:29:11 2024 -0500
-
-    amd_iommu: Use shared memory region for Interrupt Remapping
-
-    Use shared memory region for interrupt remapping which can be
-    aliased by all devices.
-
-    Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
-    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-    Signed-off-by: Santosh Shukla <santosh.shukla@amd.com>
-    Message-Id: <20240927172913.121477-4-santosh.shukla@amd.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: John Allen <john.allen@amd.com>
----
- hw/i386/amd_iommu.c | 22 ++++++++++++++--------
- hw/i386/amd_iommu.h |  1 +
- 2 files changed, 15 insertions(+), 8 deletions(-)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 567cb8adc9..8fcf5eacb4 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -1443,7 +1443,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-          * |--------------------+-------------------+----------+
-          * | amdvi-root         | 00000000-ffffffff |        0 |
-          * |  amdvi-iommu_nodma  | 00000000-ffffffff |       0 |
--         * |  amdvi-iommu_ir     | fee00000-feefffff |      64 |
-+         * |  amdvi-iommu_ir     | fee00000-feefffff |       1 |
-          * |--------------------+-------------------+----------|
-          */
-         memory_region_init_iommu(&amdvi_dev_as->iommu,
-@@ -1454,13 +1454,6 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-         memory_region_init(&amdvi_dev_as->root, OBJECT(s),
-                            "amdvi_root", UINT64_MAX);
-         address_space_init(&amdvi_dev_as->as, &amdvi_dev_as->root, name);
--        memory_region_init_io(&amdvi_dev_as->iommu_ir, OBJECT(s),
--                              &amdvi_ir_ops, s, "amd_iommu_ir",
--                              AMDVI_INT_ADDR_SIZE);
--        memory_region_add_subregion_overlap(&amdvi_dev_as->root,
--                                            AMDVI_INT_ADDR_FIRST,
--                                            &amdvi_dev_as->iommu_ir,
--                                            64);
-         memory_region_add_subregion_overlap(&amdvi_dev_as->root, 0,
-                                             MEMORY_REGION(&amdvi_dev_as->iommu),
-                                             0);
-@@ -1472,6 +1465,13 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
-         memory_region_add_subregion_overlap(&amdvi_dev_as->root, 0,
-                                             &amdvi_dev_as->iommu_nodma,
-                                             0);
-+        /* Build the Interrupt Remapping alias to shared memory */
-+        memory_region_init_alias(&amdvi_dev_as->iommu_ir, OBJECT(s),
-+                                 "amdvi-ir", &s->mr_ir, 0,
-+                                 memory_region_size(&s->mr_ir));
-+        memory_region_add_subregion_overlap(MEMORY_REGION(&amdvi_dev_as->iommu),
-+                                            AMDVI_INT_ADDR_FIRST,
-+                                            &amdvi_dev_as->iommu_ir, 1);
- 
-         if (!x86_iommu->pt_supported) {
-             memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, false);
-@@ -1633,6 +1633,12 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-     memory_region_add_subregion_overlap(&s->mr_sys, 0,
-                                         &s->mr_nodma, 0);
- 
-+    /* set up the Interrupt Remapping memory region */
-+    memory_region_init_io(&s->mr_ir, OBJECT(s), &amdvi_ir_ops,
-+                          s, "amdvi-ir", AMDVI_INT_ADDR_SIZE);
-+    memory_region_add_subregion_overlap(&s->mr_sys, AMDVI_INT_ADDR_FIRST,
-+                                        &s->mr_ir, 1);
-+
-     pci_setup_iommu(bus, &amdvi_iommu_ops, s);
-     amdvi_init(s);
- }
-diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
-index be417e51c4..e0dac4d9a9 100644
---- a/hw/i386/amd_iommu.h
-+++ b/hw/i386/amd_iommu.h
-@@ -356,6 +356,7 @@ struct AMDVIState {
-     MemoryRegion mr_mmio;              /* MMIO region                  */
-     MemoryRegion mr_sys;
-     MemoryRegion mr_nodma;
-+    MemoryRegion mr_ir;
-     uint8_t mmior[AMDVI_MMIO_SIZE];    /* read/write MMIO              */
-     uint8_t w1cmask[AMDVI_MMIO_SIZE];  /* read/write 1 clear mask      */
-     uint8_t romask[AMDVI_MMIO_SIZE];   /* MMIO read/only mask          */
--- 
-2.39.3
-
diff --git a/kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch b/kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch
deleted file mode 100644
index e293f6a..0000000
--- a/kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 173beb6698538dcffefab36772e107ffb0b4fbbd Mon Sep 17 00:00:00 2001
-From: Shaoqin Huang <shahuang@redhat.com>
-Date: Mon, 28 Apr 2025 04:34:27 -0400
-Subject: [PATCH 2/5] arm: Use arm_virt_compat_set() to apply the compat
-
-RH-Author: Shaoqin Huang <shahuang@redhat.com>
-RH-MergeRequest: 353: virtio-net: disable USO for virt-rhel9.6
-RH-Jira: RHEL-80313
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Commit: [2/2] 6e7a158e65296928040e70622b3cee59e45c1c36 (shahuang/qemu-kvm)
-
-JIRA: https://issues.redhat.com/browse/RHEL-80313
-Upstream Status: RHEL only
-
-Since the pauth and uso both should apply for the latest machine type,
-move them to the arm_virt_compat_set() which applies the compat to all
-machine types automatically.
-
-Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
----
- hw/arm/virt.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 896deaa025..2aef94e776 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -127,6 +127,10 @@ static void arm_virt_compat_set(MachineClass *mc)
-                      arm_virt_compat_len);
-     compat_props_add(mc->compat_props, arm_rhel_compat,
-                      arm_rhel_compat_len);
-+    compat_props_add(mc->compat_props, arm_rhel9_compat,
-+                     arm_rhel9_compat_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9,
-+                     hw_compat_rhel_9_len);
- }
- 
- #define DEFINE_VIRT_MACHINE_IMPL(latest, ...) \
-@@ -3599,10 +3603,6 @@ DEFINE_VIRT_MACHINE(2, 6)
- 
- static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
- {
--    compat_props_add(mc->compat_props, arm_rhel9_compat, arm_rhel9_compat_len);
--
--    /* NB: remember to move this line to the *latest* RHEL 9 machine */
--    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
- }
- DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
- 
--- 
-2.48.1
-
diff --git a/kvm-arm-disable-pauth-for-virt-rhel9.patch b/kvm-arm-disable-pauth-for-virt-rhel9.patch
deleted file mode 100644
index dd121ff..0000000
--- a/kvm-arm-disable-pauth-for-virt-rhel9.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 664e672182e39516f26e5f6b10784e42c9dd9864 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Wed, 22 Jan 2025 06:01:21 -0500
-Subject: [PATCH 10/11] arm: disable pauth for virt-rhel9*
-
-RH-Author: Sebastian Ott <sebott@redhat.com>
-RH-MergeRequest: 330: arm: disable pauth for virt-rhel9*
-RH-Jira: RHEL-75782
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Kashyap Chamarthy <None>
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Commit: [1/2] 6b30d9a755f06d6823b8a874babf12a1b5fc3295 (seott1/cos-qemu-kvm)
-
-RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
-since qemu will setup the VM/VCPU with pauth when KVM supports it
-the guest visible ID registers will change when a RHEL9 qemu is
-used on a RHEL10 kernel (e.g. in a container on a host with pauth
-support).
-
-Make sure that virt-rhel9* machine types in RHEL9 stay the same
-independent of the kernel.
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
-JIRA: https://issues.redhat.com/browse/RHEL-75782
----
- hw/arm/virt.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index c50bff2a6c..c5270a5abc 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -90,6 +90,16 @@ static GlobalProperty arm_virt_compat[] = {
- };
- static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat);
- 
-+/*
-+ * RHEL9 kernels have pauth disabled while RHEL10 has it enabled,
-+ * since qemu will setup the VM with pauth when KVM supports it we
-+ * have to disable it for virt-rhel9* to support upgrades / migration.
-+ */
-+GlobalProperty arm_rhel9_compat[] = {
-+    {TYPE_ARM_CPU, "pauth", "off", .optional = true},
-+};
-+const size_t arm_rhel9_compat_len = G_N_ELEMENTS(arm_rhel9_compat);
-+
- /*
-  * This variable is for changes to properties that are RHEL specific,
-  * different to the current upstream and to be applied to the latest
-@@ -3589,6 +3599,7 @@ DEFINE_VIRT_MACHINE(2, 6)
- 
- static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, arm_rhel9_compat, arm_rhel9_compat_len);
- }
- DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
- 
--- 
-2.48.0
-
diff --git a/kvm-block-Add-active-field-to-BlockDeviceInfo.patch b/kvm-block-Add-active-field-to-BlockDeviceInfo.patch
deleted file mode 100644
index 42ce35b..0000000
--- a/kvm-block-Add-active-field-to-BlockDeviceInfo.patch
+++ /dev/null
@@ -1,317 +0,0 @@
-From 454a498569318365a16ed65bd2110daef5bb3fc3 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:52 +0100
-Subject: [PATCH 08/23] block: Add 'active' field to BlockDeviceInfo
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [7/22] 6309d1a9ac2a7a21013cfe71dc40474cbdc89464 (kmwolf/centos-qemu-kvm)
-
-This allows querying from QMP (and also HMP) whether an image is
-currently active or inactive (in the sense of BDRV_O_INACTIVE).
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-2-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit aec81049c2daa8a97b89e59f03733b21ae0f8c2d)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                            |  4 ++++
- block/monitor/block-hmp-cmds.c     |  5 +++--
- block/qapi.c                       |  1 +
- include/block/block-global-state.h |  3 +++
- qapi/block-core.json               |  6 +++++-
- tests/qemu-iotests/184.out         |  2 ++
- tests/qemu-iotests/191.out         | 16 ++++++++++++++++
- tests/qemu-iotests/273.out         |  5 +++++
- 8 files changed, 39 insertions(+), 3 deletions(-)
-
-diff --git a/block.c b/block.c
-index c317de9eaa..c94d78eefd 100644
---- a/block.c
-+++ b/block.c
-@@ -6824,6 +6824,10 @@ void bdrv_init_with_whitelist(void)
-     bdrv_init();
- }
- 
-+bool bdrv_is_inactive(BlockDriverState *bs) {
-+    return bs->open_flags & BDRV_O_INACTIVE;
-+}
-+
- int bdrv_activate(BlockDriverState *bs, Error **errp)
- {
-     BdrvChild *child, *parent;
-diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index bdf2eb50b6..cc832549e1 100644
---- a/block/monitor/block-hmp-cmds.c
-+++ b/block/monitor/block-hmp-cmds.c
-@@ -630,11 +630,12 @@ static void print_block_info(Monitor *mon, BlockInfo *info,
-     }
- 
-     if (inserted) {
--        monitor_printf(mon, ": %s (%s%s%s)\n",
-+        monitor_printf(mon, ": %s (%s%s%s%s)\n",
-                        inserted->file,
-                        inserted->drv,
-                        inserted->ro ? ", read-only" : "",
--                       inserted->encrypted ? ", encrypted" : "");
-+                       inserted->encrypted ? ", encrypted" : "",
-+                       inserted->active ? "" : ", inactive");
-     } else {
-         monitor_printf(mon, ": [not inserted]\n");
-     }
-diff --git a/block/qapi.c b/block/qapi.c
-index 2b5793f1d9..709170e63d 100644
---- a/block/qapi.c
-+++ b/block/qapi.c
-@@ -63,6 +63,7 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
-     info->file                   = g_strdup(bs->filename);
-     info->ro                     = bdrv_is_read_only(bs);
-     info->drv                    = g_strdup(bs->drv->format_name);
-+    info->active                 = !bdrv_is_inactive(bs);
-     info->encrypted              = bs->encrypted;
- 
-     info->cache = g_new(BlockdevCacheInfo, 1);
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
-index bd7cecd1cf..a826bf5f78 100644
---- a/include/block/block-global-state.h
-+++ b/include/block/block-global-state.h
-@@ -175,6 +175,9 @@ BlockDriverState * GRAPH_RDLOCK
- check_to_replace_node(BlockDriverState *parent_bs, const char *node_name,
-                       Error **errp);
- 
-+
-+bool GRAPH_RDLOCK bdrv_is_inactive(BlockDriverState *bs);
-+
- int no_coroutine_fn GRAPH_RDLOCK
- bdrv_activate(BlockDriverState *bs, Error **errp);
- 
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index aa40d44f1d..92af032744 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -486,6 +486,10 @@
- # @backing_file_depth: number of files in the backing file chain
- #     (since: 1.2)
- #
-+# @active: true if the backend is active; typical cases for inactive backends
-+#     are on the migration source instance after migration completes and on the
-+#     destination before it completes. (since: 10.0)
-+#
- # @encrypted: true if the backing device is encrypted
- #
- # @detect_zeroes: detect and optimize zero writes (Since 2.1)
-@@ -556,7 +560,7 @@
- { 'struct': 'BlockDeviceInfo',
-   'data': { 'file': 'str', '*node-name': 'str', 'ro': 'bool', 'drv': 'str',
-             '*backing_file': 'str', 'backing_file_depth': 'int',
--            'encrypted': 'bool',
-+            'active': 'bool', 'encrypted': 'bool',
-             'detect_zeroes': 'BlockdevDetectZeroesOptions',
-             'bps': 'int', 'bps_rd': 'int', 'bps_wr': 'int',
-             'iops': 'int', 'iops_rd': 'int', 'iops_wr': 'int',
-diff --git a/tests/qemu-iotests/184.out b/tests/qemu-iotests/184.out
-index e8f631f853..52692b6b3b 100644
---- a/tests/qemu-iotests/184.out
-+++ b/tests/qemu-iotests/184.out
-@@ -26,6 +26,7 @@ Testing:
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 1073741824,
-@@ -59,6 +60,7 @@ Testing:
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 1073741824,
-                 "filename": "null-co://",
-diff --git a/tests/qemu-iotests/191.out b/tests/qemu-iotests/191.out
-index c3309e4bc6..2a72ca7106 100644
---- a/tests/qemu-iotests/191.out
-+++ b/tests/qemu-iotests/191.out
-@@ -114,6 +114,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 67108864,
-@@ -155,6 +156,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT.ovl2",
-@@ -183,6 +185,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 67108864,
-@@ -224,6 +227,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT",
-@@ -252,6 +256,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 67108864,
-@@ -293,6 +298,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 393216,
-                 "filename": "TEST_DIR/t.IMGFMT.mid",
-@@ -321,6 +327,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 67108864,
-                 "filename": "TEST_DIR/t.IMGFMT.base",
-@@ -350,6 +357,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 393216,
-                 "filename": "TEST_DIR/t.IMGFMT.base",
-@@ -521,6 +529,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 67108864,
-@@ -562,6 +571,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT.ovl2",
-@@ -590,6 +600,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "backing-image": {
-@@ -642,6 +653,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT.ovl3",
-@@ -670,6 +682,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 67108864,
-                 "filename": "TEST_DIR/t.IMGFMT.base",
-@@ -699,6 +712,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 393216,
-                 "filename": "TEST_DIR/t.IMGFMT.base",
-@@ -727,6 +741,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 67108864,
-@@ -768,6 +783,7 @@ wrote 65536/65536 bytes at offset 1048576
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT",
-diff --git a/tests/qemu-iotests/273.out b/tests/qemu-iotests/273.out
-index 71843f02de..c19753c685 100644
---- a/tests/qemu-iotests/273.out
-+++ b/tests/qemu-iotests/273.out
-@@ -23,6 +23,7 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "backing-image": {
-@@ -74,6 +75,7 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT",
-@@ -102,6 +104,7 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "backing-image": {
-                     "virtual-size": 197120,
-@@ -142,6 +145,7 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT.mid",
-@@ -170,6 +174,7 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         {
-             "iops_rd": 0,
-             "detect_zeroes": "off",
-+            "active": true,
-             "image": {
-                 "virtual-size": 197120,
-                 "filename": "TEST_DIR/t.IMGFMT.base",
--- 
-2.48.1
-
diff --git a/kvm-block-Add-blockdev-set-active-QMP-command.patch b/kvm-block-Add-blockdev-set-active-QMP-command.patch
deleted file mode 100644
index 1c0b59a..0000000
--- a/kvm-block-Add-blockdev-set-active-QMP-command.patch
+++ /dev/null
@@ -1,187 +0,0 @@
-From c6c40cc92fbb91d704d3739bb78bfd936f111625 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:59 +0100
-Subject: [PATCH 15/23] block: Add blockdev-set-active QMP command
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [14/22] e494fb6df6c363b6266e5fb7d09c31b3e7694f04 (kmwolf/centos-qemu-kvm)
-
-The system emulator tries to automatically activate and inactivate block
-nodes at the right point during migration. However, there are still
-cases where it's necessary that the user can do this manually.
-
-Images are only activated on the destination VM of a migration when the
-VM is actually resumed. If the VM was paused, this doesn't happen
-automatically. The user may want to perform some operation on a block
-device (e.g. taking a snapshot or starting a block job) without also
-resuming the VM yet. This is an example where a manual command is
-necessary.
-
-Another example is VM migration when the image files are opened by an
-external qemu-storage-daemon instance on each side. In this case, the
-process that needs to hand over the images isn't even part of the
-migration and can't know when the migration completes. Management tools
-need a way to explicitly inactivate images on the source and activate
-them on the destination.
-
-This adds a new blockdev-set-active QMP command that lets the user
-change the status of individual nodes (this is necessary in
-qemu-storage-daemon because it could be serving multiple VMs and only
-one of them migrates at a time). For convenience, operating on all
-devices (like QEMU does automatically during migration) is offered as an
-option, too, and can be used in the context of single VM.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-9-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 8cd37207f8a90c5f995283ecf95f1cb5f7518a77)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                            | 21 ++++++++++++++++++++
- blockdev.c                         | 32 ++++++++++++++++++++++++++++++
- include/block/block-global-state.h |  3 +++
- qapi/block-core.json               | 32 ++++++++++++++++++++++++++++++
- 4 files changed, 88 insertions(+)
-
-diff --git a/block.c b/block.c
-index fd2ac177ef..2140a5d3b7 100644
---- a/block.c
-+++ b/block.c
-@@ -7052,6 +7052,27 @@ bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
-     return 0;
- }
- 
-+int bdrv_inactivate(BlockDriverState *bs, Error **errp)
-+{
-+    int ret;
-+
-+    GLOBAL_STATE_CODE();
-+    GRAPH_RDLOCK_GUARD_MAINLOOP();
-+
-+    if (bdrv_has_bds_parent(bs, true)) {
-+        error_setg(errp, "Node has active parent node");
-+        return -EPERM;
-+    }
-+
-+    ret = bdrv_inactivate_recurse(bs, true);
-+    if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to inactivate node");
-+        return ret;
-+    }
-+
-+    return 0;
-+}
-+
- int bdrv_inactivate_all(void)
- {
-     BlockDriverState *bs = NULL;
-diff --git a/blockdev.c b/blockdev.c
-index 81430122df..70046b6690 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -3468,6 +3468,38 @@ void qmp_blockdev_del(const char *node_name, Error **errp)
-     bdrv_unref(bs);
- }
- 
-+void qmp_blockdev_set_active(const char *node_name, bool active, Error **errp)
-+{
-+    int ret;
-+
-+    GLOBAL_STATE_CODE();
-+    GRAPH_RDLOCK_GUARD_MAINLOOP();
-+
-+    if (!node_name) {
-+        if (active) {
-+            bdrv_activate_all(errp);
-+        } else {
-+            ret = bdrv_inactivate_all();
-+            if (ret < 0) {
-+                error_setg_errno(errp, -ret, "Failed to inactivate all nodes");
-+            }
-+        }
-+    } else {
-+        BlockDriverState *bs = bdrv_find_node(node_name);
-+        if (!bs) {
-+            error_setg(errp, "Failed to find node with node-name='%s'",
-+                       node_name);
-+            return;
-+        }
-+
-+        if (active) {
-+            bdrv_activate(bs, errp);
-+        } else {
-+            bdrv_inactivate(bs, errp);
-+        }
-+    }
-+}
-+
- static BdrvChild * GRAPH_RDLOCK
- bdrv_find_child(BlockDriverState *parent_bs, const char *child_name)
- {
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
-index a826bf5f78..9be34b3c99 100644
---- a/include/block/block-global-state.h
-+++ b/include/block/block-global-state.h
-@@ -184,6 +184,9 @@ bdrv_activate(BlockDriverState *bs, Error **errp);
- int coroutine_fn no_co_wrapper_bdrv_rdlock
- bdrv_co_activate(BlockDriverState *bs, Error **errp);
- 
-+int no_coroutine_fn
-+bdrv_inactivate(BlockDriverState *bs, Error **errp);
-+
- void bdrv_activate_all(Error **errp);
- int bdrv_inactivate_all(void);
- 
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 6ec603aa6f..c1af3d1f7d 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -4930,6 +4930,38 @@
- { 'command': 'blockdev-del', 'data': { 'node-name': 'str' },
-   'allow-preconfig': true }
- 
-+##
-+# @blockdev-set-active:
-+#
-+# Activate or inactivate a block device. Use this to manage the handover of
-+# block devices on migration with qemu-storage-daemon.
-+#
-+# Activating a node automatically activates all of its child nodes first.
-+# Inactivating a node automatically inactivates any of its child nodes that are
-+# not in use by a still active node.
-+#
-+# @node-name: Name of the graph node to activate or inactivate. By default, all
-+#     nodes are affected by the operation.
-+#
-+# @active: true if the nodes should be active when the command returns success,
-+#     false if they should be inactive.
-+#
-+# Since: 10.0
-+#
-+# .. qmp-example::
-+#
-+#     -> { "execute": "blockdev-set-active",
-+#          "arguments": {
-+#               "node-name": "node0",
-+#               "active": false
-+#          }
-+#        }
-+#     <- { "return": {} }
-+##
-+{ 'command': 'blockdev-set-active',
-+  'data': { '*node-name': 'str', 'active': 'bool' },
-+  'allow-preconfig': true }
-+
- ##
- # @BlockdevCreateOptionsFile:
- #
--- 
-2.48.1
-
diff --git a/kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch b/kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch
deleted file mode 100644
index 174ab4f..0000000
--- a/kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From f2cd96a040dd7863484d22a3995a2904605dadde Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:21 -0500
-Subject: [PATCH 06/16] block: Add new bdrv_co_is_all_zeroes() function
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [4/14] aabcba8323df698a72842f299e9242a5eee3aea6 (ebblake/centos-qemu-kvm)
-
-There are some optimizations that require knowing if an image starts
-out as reading all zeroes, such as making blockdev-mirror faster by
-skipping the copying of source zeroes to the destination.  The
-existing bdrv_co_is_zero_fast() is a good building block for answering
-this question, but it tends to give an answer of 0 for a file we just
-created via QMP 'blockdev-create' or similar (such as 'qemu-img create
--f raw').  Why?  Because file-posix.c insists on allocating a tiny
-header to any file rather than leaving it 100% sparse, due to some
-filesystems that are unable to answer alignment probes on a hole.  But
-teaching file-posix.c to read the tiny header doesn't scale - the
-problem of a small header is also visible when libvirt sets up an NBD
-client to a just-created file on a migration destination host.
-
-So, we need a wrapper function that handles a bit more complexity in a
-common manner for all block devices - when the BDS is mostly a hole,
-but has a small non-hole header, it is still worth the time to read
-that header and check if it reads as all zeroes before giving up and
-returning a pessimistic answer.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-19-eblake@redhat.com>
-(cherry picked from commit 52726096707c5c8b90597c445de897fa64d56e73)
-Conflicts:
-	block/io.c - context with header names
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/io.c               | 62 ++++++++++++++++++++++++++++++++++++++++
- include/block/block-io.h |  2 ++
- 2 files changed, 64 insertions(+)
-
-diff --git a/block/io.c b/block/io.c
-index 293c5dd393..1f01337599 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -38,10 +38,14 @@
- #include "qemu/error-report.h"
- #include "qemu/main-loop.h"
- #include "sysemu/replay.h"
-+#include "qemu/units.h"
- 
- /* Maximum bounce buffer for copy-on-read and write zeroes, in bytes */
- #define MAX_BOUNCE_BUFFER (32768 << BDRV_SECTOR_BITS)
- 
-+/* Maximum read size for checking if data reads as zero, in bytes */
-+#define MAX_ZERO_CHECK_BUFFER (128 * KiB)
-+
- static void coroutine_fn GRAPH_RDLOCK
- bdrv_parent_cb_resize(BlockDriverState *bs);
- 
-@@ -2774,6 +2778,64 @@ int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
-     return 1;
- }
- 
-+/*
-+ * Check @bs (and its backing chain) to see if the entire image is known
-+ * to read as zeroes.
-+ * Return 1 if that is the case, 0 otherwise and -errno on error.
-+ * This test is meant to be fast rather than accurate so returning 0
-+ * does not guarantee non-zero data; however, a return of 1 is reliable,
-+ * and this function can report 1 in more cases than bdrv_co_is_zero_fast.
-+ */
-+int coroutine_fn bdrv_co_is_all_zeroes(BlockDriverState *bs)
-+{
-+    int ret;
-+    int64_t pnum, bytes;
-+    char *buf;
-+    QEMUIOVector local_qiov;
-+    IO_CODE();
-+
-+    bytes = bdrv_co_getlength(bs);
-+    if (bytes < 0) {
-+        return bytes;
-+    }
-+
-+    /* First probe - see if the entire image reads as zero */
-+    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
-+                                            0, bytes, &pnum, NULL, NULL,
-+                                            NULL);
-+    if (ret < 0) {
-+        return ret;
-+    }
-+    if (ret & BDRV_BLOCK_ZERO) {
-+        return bdrv_co_is_zero_fast(bs, pnum, bytes - pnum);
-+    }
-+
-+    /*
-+     * Because of the way 'blockdev-create' works, raw files tend to
-+     * be created with a non-sparse region at the front to make
-+     * alignment probing easier.  If the block starts with only a
-+     * small allocated region, it is still worth the effort to see if
-+     * the rest of the image is still sparse, coupled with manually
-+     * reading the first region to see if it reads zero after all.
-+     */
-+    if (pnum > MAX_ZERO_CHECK_BUFFER) {
-+        return 0;
-+    }
-+    ret = bdrv_co_is_zero_fast(bs, pnum, bytes - pnum);
-+    if (ret <= 0) {
-+        return ret;
-+    }
-+    /* Only the head of the image is unknown, and it's small.  Read it.  */
-+    buf = qemu_blockalign(bs, pnum);
-+    qemu_iovec_init_buf(&local_qiov, buf, pnum);
-+    ret = bdrv_driver_preadv(bs, 0, pnum, &local_qiov, 0, 0);
-+    if (ret >= 0) {
-+        ret = buffer_is_zero(buf, pnum);
-+    }
-+    qemu_vfree(buf);
-+    return ret;
-+}
-+
- int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,
-                                       int64_t bytes, int64_t *pnum)
- {
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index b49e0537dd..b99cc98d26 100644
---- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -161,6 +161,8 @@ bdrv_is_allocated_above(BlockDriverState *bs, BlockDriverState *base,
- 
- int coroutine_fn GRAPH_RDLOCK
- bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset, int64_t bytes);
-+int coroutine_fn GRAPH_RDLOCK
-+bdrv_co_is_all_zeroes(BlockDriverState *bs);
- 
- int GRAPH_RDLOCK
- bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
--- 
-2.48.1
-
diff --git a/kvm-block-Add-option-to-create-inactive-nodes.patch b/kvm-block-Add-option-to-create-inactive-nodes.patch
deleted file mode 100644
index 8502b88..0000000
--- a/kvm-block-Add-option-to-create-inactive-nodes.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From d44250363b08e627e06a9afe288d02a3d995afc0 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:58 +0100
-Subject: [PATCH 14/23] block: Add option to create inactive nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [13/22] 45b01b9c09d5f12715e4977cab6140d2cac90714 (kmwolf/centos-qemu-kvm)
-
-In QEMU, nodes are automatically created inactive while expecting an
-incoming migration (i.e. RUN_STATE_INMIGRATE). In qemu-storage-daemon,
-the notion of runstates doesn't exist. It also wouldn't necessarily make
-sense to introduce it because a single daemon can serve multiple VMs
-that can be in different states.
-
-Therefore, allow the user to explicitly open images as inactive with a
-new option. The default is as before: Nodes are usually active, except
-when created during RUN_STATE_INMIGRATE.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-8-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit faecd16fe5c65a25b5b55b5edbe4322cec5a9d96)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                      | 9 +++++++++
- include/block/block-common.h | 1 +
- qapi/block-core.json         | 6 ++++++
- 3 files changed, 16 insertions(+)
-
-diff --git a/block.c b/block.c
-index bedd54deaa..fd2ac177ef 100644
---- a/block.c
-+++ b/block.c
-@@ -1573,6 +1573,10 @@ static void update_flags_from_options(int *flags, QemuOpts *opts)
-     if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
-         *flags |= BDRV_O_AUTO_RDONLY;
-     }
-+
-+    if (!qemu_opt_get_bool_del(opts, BDRV_OPT_ACTIVE, true)) {
-+        *flags |= BDRV_O_INACTIVE;
-+    }
- }
- 
- static void update_options_from_flags(QDict *options, int flags)
-@@ -1799,6 +1803,11 @@ QemuOptsList bdrv_runtime_opts = {
-             .type = QEMU_OPT_BOOL,
-             .help = "Ignore flush requests",
-         },
-+        {
-+            .name = BDRV_OPT_ACTIVE,
-+            .type = QEMU_OPT_BOOL,
-+            .help = "Node is activated",
-+        },
-         {
-             .name = BDRV_OPT_READ_ONLY,
-             .type = QEMU_OPT_BOOL,
-diff --git a/include/block/block-common.h b/include/block/block-common.h
-index 338fe5ff7a..7030669f04 100644
---- a/include/block/block-common.h
-+++ b/include/block/block-common.h
-@@ -257,6 +257,7 @@ typedef enum {
- #define BDRV_OPT_AUTO_READ_ONLY "auto-read-only"
- #define BDRV_OPT_DISCARD        "discard"
- #define BDRV_OPT_FORCE_SHARE    "force-share"
-+#define BDRV_OPT_ACTIVE         "active"
- 
- 
- #define BDRV_SECTOR_BITS   9
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 92af032744..6ec603aa6f 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -4668,6 +4668,11 @@
- #
- # @cache: cache-related options
- #
-+# @active: whether the block node should be activated (default: true).
-+#     Having inactive block nodes is useful primarily for migration because it
-+#     allows opening an image on the destination while the source is still
-+#     holding locks for it. (Since 10.0)
-+#
- # @read-only: whether the block device should be read-only (default:
- #     false).  Note that some block drivers support only read-only
- #     access, either generally or in certain configurations.  In this
-@@ -4694,6 +4699,7 @@
-             '*node-name': 'str',
-             '*discard': 'BlockdevDiscardOptions',
-             '*cache': 'BlockdevCacheOptions',
-+            '*active': 'bool',
-             '*read-only': 'bool',
-             '*auto-read-only': 'bool',
-             '*force-share': 'bool',
--- 
-2.48.1
-
diff --git a/kvm-block-Allow-inactivating-already-inactive-nodes.patch b/kvm-block-Allow-inactivating-already-inactive-nodes.patch
deleted file mode 100644
index 7001529..0000000
--- a/kvm-block-Allow-inactivating-already-inactive-nodes.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From f7f73025679c5d001256d87bc47566d1db4e98c7 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:53 +0100
-Subject: [PATCH 09/23] block: Allow inactivating already inactive nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [8/22] 781a749ae61e038b5b562407b01d53a1bfba598c (kmwolf/centos-qemu-kvm)
-
-What we wanted to catch with the assertion is cases where the recursion
-finds that a child was inactive before its parent. This should never
-happen. But if the user tries to inactivate an image that is already
-inactive, that's harmless and we don't want to fail the assertion.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-3-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit a6490ec9d56b9e95a13918813585a3a9891710bc)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/block.c b/block.c
-index c94d78eefd..a2aa454312 100644
---- a/block.c
-+++ b/block.c
-@@ -6959,7 +6959,8 @@ bdrv_has_bds_parent(BlockDriverState *bs, bool only_active)
-     return false;
- }
- 
--static int GRAPH_RDLOCK bdrv_inactivate_recurse(BlockDriverState *bs)
-+static int GRAPH_RDLOCK
-+bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
- {
-     BdrvChild *child, *parent;
-     int ret;
-@@ -6977,7 +6978,14 @@ static int GRAPH_RDLOCK bdrv_inactivate_recurse(BlockDriverState *bs)
-         return 0;
-     }
- 
--    assert(!(bs->open_flags & BDRV_O_INACTIVE));
-+    /*
-+     * Inactivating an already inactive node on user request is harmless, but if
-+     * a child is already inactive before its parent, that's bad.
-+     */
-+    if (bs->open_flags & BDRV_O_INACTIVE) {
-+        assert(top_level);
-+        return 0;
-+    }
- 
-     /* Inactivate this node */
-     if (bs->drv->bdrv_inactivate) {
-@@ -7014,7 +7022,7 @@ static int GRAPH_RDLOCK bdrv_inactivate_recurse(BlockDriverState *bs)
- 
-     /* Recursively inactivate children */
-     QLIST_FOREACH(child, &bs->children, next) {
--        ret = bdrv_inactivate_recurse(child->bs);
-+        ret = bdrv_inactivate_recurse(child->bs, false);
-         if (ret < 0) {
-             return ret;
-         }
-@@ -7039,7 +7047,7 @@ int bdrv_inactivate_all(void)
-         if (bdrv_has_bds_parent(bs, false)) {
-             continue;
-         }
--        ret = bdrv_inactivate_recurse(bs);
-+        ret = bdrv_inactivate_recurse(bs, true);
-         if (ret < 0) {
-             bdrv_next_cleanup(&it);
-             break;
--- 
-2.48.1
-
diff --git a/kvm-block-Don-t-attach-inactive-child-to-active-node.patch b/kvm-block-Don-t-attach-inactive-child-to-active-node.patch
deleted file mode 100644
index f2a9219..0000000
--- a/kvm-block-Don-t-attach-inactive-child-to-active-node.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 0f0968badaa11f4ac56f8ee93cbe11f9a6d5fc95 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:56 +0100
-Subject: [PATCH 12/23] block: Don't attach inactive child to active node
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [11/22] 1ca560728b97bd1d5f7498a7e5d23e2d8bb0808d (kmwolf/centos-qemu-kvm)
-
-An active node makes unrestricted use of its children and would possibly
-run into assertion failures when it operates on an inactive child node.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-6-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 9b81361aedcc47905de5e91f68221de89c6f5467)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/block.c b/block.c
-index a2aa454312..41e72e6965 100644
---- a/block.c
-+++ b/block.c
-@@ -3183,6 +3183,11 @@ bdrv_attach_child_noperm(BlockDriverState *parent_bs,
-                    child_bs->node_name, child_name, parent_bs->node_name);
-         return NULL;
-     }
-+    if (bdrv_is_inactive(child_bs) && !bdrv_is_inactive(parent_bs)) {
-+        error_setg(errp, "Inactive '%s' can't be a %s child of active '%s'",
-+                   child_bs->node_name, child_name, parent_bs->node_name);
-+        return NULL;
-+    }
- 
-     bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
-     bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
--- 
-2.48.1
-
diff --git a/kvm-block-Drain-nodes-before-inactivating-them.patch b/kvm-block-Drain-nodes-before-inactivating-them.patch
deleted file mode 100644
index 6514f25..0000000
--- a/kvm-block-Drain-nodes-before-inactivating-them.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From bc9b651ce0f36da5a5b6eb8631e7040e59ea2493 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:02 +0100
-Subject: [PATCH 18/23] block: Drain nodes before inactivating them
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [17/22] f0fec0f51ed033038b565297a7217cbf61ab70f7 (kmwolf/centos-qemu-kvm)
-
-So far the assumption has always been that if we try to inactivate a
-node, it is already idle. This doesn't hold true any more if we allow
-inactivating exported nodes because we can't know when new external
-requests come in.
-
-Drain the node around setting BDRV_O_INACTIVE so that requests can't
-start operating on an active node and then in the middle it suddenly
-becomes inactive. With this change, it's enough for exports to check
-for new requests that they operate on an active node (or, like reads,
-are allowed even on an inactive node).
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Message-ID: <20250204211407.381505-12-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 2849092a0024405e74c96f0a5ec41bb182ec8538)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/block.c b/block.c
-index 2140a5d3b7..38cb8481a8 100644
---- a/block.c
-+++ b/block.c
-@@ -7032,7 +7032,9 @@ bdrv_inactivate_recurse(BlockDriverState *bs, bool top_level)
-         return -EPERM;
-     }
- 
-+    bdrv_drained_begin(bs);
-     bs->open_flags |= BDRV_O_INACTIVE;
-+    bdrv_drained_end(bs);
- 
-     /*
-      * Update permissions, they may differ for inactive nodes.
--- 
-2.48.1
-
diff --git a/kvm-block-Expand-block-status-mode-from-bool-to-flags.patch b/kvm-block-Expand-block-status-mode-from-bool-to-flags.patch
deleted file mode 100644
index ce9b9cc..0000000
--- a/kvm-block-Expand-block-status-mode-from-bool-to-flags.patch
+++ /dev/null
@@ -1,689 +0,0 @@
-From 26f5d221dd16137bed3527ee120cdf085e2c7e23 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:18 -0500
-Subject: [PATCH 03/16] block: Expand block status mode from bool to flags
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/14] 9de5245def80e9815ed306e4abce9caec56cef6f (ebblake/centos-qemu-kvm)
-
-This patch is purely mechanical, changing bool want_zero into an
-unsigned int for bitwise-or of flags.  As of this patch, all
-implementations are unchanged (the old want_zero==true is now
-mode==BDRV_WANT_PRECISE which is a superset of BDRV_WANT_ZERO); but
-the callers in io.c that used to pass want_zero==false are now
-prepared for future driver changes that can now distinguish bewteen
-BDRV_WANT_ZERO vs. BDRV_WANT_ALLOCATED.  The next patch will actually
-change the file-posix driver along those lines, now that we have
-more-specific hints.
-
-As for the background why this patch is useful: right now, the
-file-posix driver recognizes that if allocation is being queried, the
-entire image can be reported as allocated (there is no backing file to
-refer to) - but this throws away information on whether the entire
-image reads as zero (trivially true if lseek(SEEK_HOLE) at offset 0
-returns -ENXIO, a bit more complicated to prove if the raw file was
-created with 'qemu-img create' since we intentionally allocate a small
-chunk of all-zero data to help with alignment probing).  Later patches
-will add a generic algorithm for seeing if an entire file reads as
-zeroes.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-16-eblake@redhat.com>
-(cherry picked from commit c33159dec79069514f78faecfe268439226b0f5b)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/blkdebug.c                 |  6 ++--
- block/copy-before-write.c        |  4 +--
- block/coroutines.h               |  4 +--
- block/file-posix.c               |  4 +--
- block/gluster.c                  |  4 +--
- block/io.c                       | 51 ++++++++++++++++----------------
- block/iscsi.c                    |  6 ++--
- block/nbd.c                      |  4 +--
- block/null.c                     |  6 ++--
- block/parallels.c                |  6 ++--
- block/qcow.c                     |  2 +-
- block/qcow2.c                    |  6 ++--
- block/qed.c                      |  6 ++--
- block/quorum.c                   |  4 +--
- block/raw-format.c               |  4 +--
- block/rbd.c                      |  6 ++--
- block/snapshot-access.c          |  4 +--
- block/vdi.c                      |  4 +--
- block/vmdk.c                     |  2 +-
- block/vpc.c                      |  2 +-
- block/vvfat.c                    |  6 ++--
- include/block/block-common.h     | 11 +++++++
- include/block/block_int-common.h | 27 +++++++++--------
- include/block/block_int-io.h     |  4 +--
- tests/unit/test-block-iothread.c |  2 +-
- 25 files changed, 99 insertions(+), 86 deletions(-)
-
-diff --git a/block/blkdebug.c b/block/blkdebug.c
-index c95c818c38..736ae2b56b 100644
---- a/block/blkdebug.c
-+++ b/block/blkdebug.c
-@@ -751,9 +751,9 @@ blkdebug_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--blkdebug_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
--                         int64_t bytes, int64_t *pnum, int64_t *map,
--                         BlockDriverState **file)
-+blkdebug_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                         int64_t offset, int64_t bytes, int64_t *pnum,
-+                         int64_t *map, BlockDriverState **file)
- {
-     int err;
- 
-diff --git a/block/copy-before-write.c b/block/copy-before-write.c
-index 853e01a1eb..36488cdeca 100644
---- a/block/copy-before-write.c
-+++ b/block/copy-before-write.c
-@@ -290,8 +290,8 @@ cbw_co_preadv_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes,
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--cbw_co_snapshot_block_status(BlockDriverState *bs,
--                             bool want_zero, int64_t offset, int64_t bytes,
-+cbw_co_snapshot_block_status(BlockDriverState *bs, unsigned int mode,
-+                             int64_t offset, int64_t bytes,
-                              int64_t *pnum, int64_t *map,
-                              BlockDriverState **file)
- {
-diff --git a/block/coroutines.h b/block/coroutines.h
-index f3226682d6..811ef12e43 100644
---- a/block/coroutines.h
-+++ b/block/coroutines.h
-@@ -47,7 +47,7 @@ int coroutine_fn GRAPH_RDLOCK
- bdrv_co_common_block_status_above(BlockDriverState *bs,
-                                   BlockDriverState *base,
-                                   bool include_base,
--                                  bool want_zero,
-+                                  unsigned int mode,
-                                   int64_t offset,
-                                   int64_t bytes,
-                                   int64_t *pnum,
-@@ -78,7 +78,7 @@ int co_wrapper_mixed_bdrv_rdlock
- bdrv_common_block_status_above(BlockDriverState *bs,
-                                BlockDriverState *base,
-                                bool include_base,
--                               bool want_zero,
-+                               unsigned int mode,
-                                int64_t offset,
-                                int64_t bytes,
-                                int64_t *pnum,
-diff --git a/block/file-posix.c b/block/file-posix.c
-index f17a3f4d10..9ca55620ca 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -3277,7 +3277,7 @@ static int find_allocation(BlockDriverState *bs, off_t start,
-  * well exceed it.
-  */
- static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
--                                            bool want_zero,
-+                                            unsigned int mode,
-                                             int64_t offset,
-                                             int64_t bytes, int64_t *pnum,
-                                             int64_t *map,
-@@ -3293,7 +3293,7 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
-         return ret;
-     }
- 
--    if (!want_zero) {
-+    if (mode != BDRV_WANT_PRECISE) {
-         *pnum = bytes;
-         *map = offset;
-         *file = bs;
-diff --git a/block/gluster.c b/block/gluster.c
-index f8b415f381..ae5c45666b 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -1466,7 +1466,7 @@ exit:
-  * (Based on raw_co_block_status() from file-posix.c.)
-  */
- static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
--                                                     bool want_zero,
-+                                                     unsigned int mode,
-                                                      int64_t offset,
-                                                      int64_t bytes,
-                                                      int64_t *pnum,
-@@ -1483,7 +1483,7 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
-         return ret;
-     }
- 
--    if (!want_zero) {
-+    if (mode != BDRV_WANT_PRECISE) {
-         *pnum = bytes;
-         *map = offset;
-         *file = bs;
-diff --git a/block/io.c b/block/io.c
-index 3e189837a1..daaafe00d7 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -2360,10 +2360,8 @@ int bdrv_flush_all(void)
-  * Drivers not implementing the functionality are assumed to not support
-  * backing files, hence all their sectors are reported as allocated.
-  *
-- * If 'want_zero' is true, the caller is querying for mapping
-- * purposes, with a focus on valid BDRV_BLOCK_OFFSET_VALID, _DATA, and
-- * _ZERO where possible; otherwise, the result favors larger 'pnum',
-- * with a focus on accurate BDRV_BLOCK_ALLOCATED.
-+ * 'mode' serves as a hint as to which results are favored; see the
-+ * BDRV_WANT_* macros for details.
-  *
-  * If 'offset' is beyond the end of the disk image the return value is
-  * BDRV_BLOCK_EOF and 'pnum' is set to 0.
-@@ -2383,7 +2381,7 @@ int bdrv_flush_all(void)
-  * set to the host mapping and BDS corresponding to the guest offset.
-  */
- static int coroutine_fn GRAPH_RDLOCK
--bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
-+bdrv_co_do_block_status(BlockDriverState *bs, unsigned int mode,
-                         int64_t offset, int64_t bytes,
-                         int64_t *pnum, int64_t *map, BlockDriverState **file)
- {
-@@ -2472,7 +2470,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
-             local_file = bs;
-             local_map = aligned_offset;
-         } else {
--            ret = bs->drv->bdrv_co_block_status(bs, want_zero, aligned_offset,
-+            ret = bs->drv->bdrv_co_block_status(bs, mode, aligned_offset,
-                                                 aligned_bytes, pnum, &local_map,
-                                                 &local_file);
- 
-@@ -2484,10 +2482,10 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
-              * the cache requires an RCU update, so double check here to avoid
-              * such an update if possible.
-              *
--             * Check want_zero, because we only want to update the cache when we
-+             * Check mode, because we only want to update the cache when we
-              * have accurate information about what is zero and what is data.
-              */
--            if (want_zero &&
-+            if (mode == BDRV_WANT_PRECISE &&
-                 ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
-                 QLIST_EMPTY(&bs->children))
-             {
-@@ -2544,7 +2542,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
- 
-     if (ret & BDRV_BLOCK_RAW) {
-         assert(ret & BDRV_BLOCK_OFFSET_VALID && local_file);
--        ret = bdrv_co_do_block_status(local_file, want_zero, local_map,
-+        ret = bdrv_co_do_block_status(local_file, mode, local_map,
-                                       *pnum, pnum, &local_map, &local_file);
-         goto out;
-     }
-@@ -2556,7 +2554,7 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
- 
-         if (!cow_bs) {
-             ret |= BDRV_BLOCK_ZERO;
--        } else if (want_zero) {
-+        } else if (mode == BDRV_WANT_PRECISE) {
-             int64_t size2 = bdrv_co_getlength(cow_bs);
- 
-             if (size2 >= 0 && offset >= size2) {
-@@ -2565,14 +2563,14 @@ bdrv_co_do_block_status(BlockDriverState *bs, bool want_zero,
-         }
-     }
- 
--    if (want_zero && ret & BDRV_BLOCK_RECURSE &&
-+    if (mode == BDRV_WANT_PRECISE && ret & BDRV_BLOCK_RECURSE &&
-         local_file && local_file != bs &&
-         (ret & BDRV_BLOCK_DATA) && !(ret & BDRV_BLOCK_ZERO) &&
-         (ret & BDRV_BLOCK_OFFSET_VALID)) {
-         int64_t file_pnum;
-         int ret2;
- 
--        ret2 = bdrv_co_do_block_status(local_file, want_zero, local_map,
-+        ret2 = bdrv_co_do_block_status(local_file, mode, local_map,
-                                        *pnum, &file_pnum, NULL, NULL);
-         if (ret2 >= 0) {
-             /* Ignore errors.  This is just providing extra information, it
-@@ -2623,7 +2621,7 @@ int coroutine_fn
- bdrv_co_common_block_status_above(BlockDriverState *bs,
-                                   BlockDriverState *base,
-                                   bool include_base,
--                                  bool want_zero,
-+                                  unsigned int mode,
-                                   int64_t offset,
-                                   int64_t bytes,
-                                   int64_t *pnum,
-@@ -2650,7 +2648,7 @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
-         return 0;
-     }
- 
--    ret = bdrv_co_do_block_status(bs, want_zero, offset, bytes, pnum,
-+    ret = bdrv_co_do_block_status(bs, mode, offset, bytes, pnum,
-                                   map, file);
-     ++*depth;
-     if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
-@@ -2667,7 +2665,7 @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
-     for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base;
-          p = bdrv_filter_or_cow_bs(p))
-     {
--        ret = bdrv_co_do_block_status(p, want_zero, offset, bytes, pnum,
-+        ret = bdrv_co_do_block_status(p, mode, offset, bytes, pnum,
-                                       map, file);
-         ++*depth;
-         if (ret < 0) {
-@@ -2730,7 +2728,8 @@ int coroutine_fn bdrv_co_block_status_above(BlockDriverState *bs,
-                                             BlockDriverState **file)
- {
-     IO_CODE();
--    return bdrv_co_common_block_status_above(bs, base, false, true, offset,
-+    return bdrv_co_common_block_status_above(bs, base, false,
-+                                             BDRV_WANT_PRECISE, offset,
-                                              bytes, pnum, map, file, NULL);
- }
- 
-@@ -2761,8 +2760,9 @@ int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
-         return 1;
-     }
- 
--    ret = bdrv_co_common_block_status_above(bs, NULL, false, false, offset,
--                                            bytes, &pnum, NULL, NULL, NULL);
-+    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
-+                                            offset, bytes, &pnum, NULL, NULL,
-+                                            NULL);
- 
-     if (ret < 0) {
-         return ret;
-@@ -2778,9 +2778,9 @@ int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,
-     int64_t dummy;
-     IO_CODE();
- 
--    ret = bdrv_co_common_block_status_above(bs, bs, true, false, offset,
--                                            bytes, pnum ? pnum : &dummy, NULL,
--                                            NULL, NULL);
-+    ret = bdrv_co_common_block_status_above(bs, bs, true, BDRV_WANT_ALLOCATED,
-+                                            offset, bytes, pnum ? pnum : &dummy,
-+                                            NULL, NULL, NULL);
-     if (ret < 0) {
-         return ret;
-     }
-@@ -2813,7 +2813,8 @@ int coroutine_fn bdrv_co_is_allocated_above(BlockDriverState *bs,
-     int ret;
-     IO_CODE();
- 
--    ret = bdrv_co_common_block_status_above(bs, base, include_base, false,
-+    ret = bdrv_co_common_block_status_above(bs, base, include_base,
-+                                            BDRV_WANT_ALLOCATED,
-                                             offset, bytes, pnum, NULL, NULL,
-                                             &depth);
-     if (ret < 0) {
-@@ -3710,8 +3711,8 @@ bdrv_co_preadv_snapshot(BdrvChild *child, int64_t offset, int64_t bytes,
- }
- 
- int coroutine_fn
--bdrv_co_snapshot_block_status(BlockDriverState *bs,
--                              bool want_zero, int64_t offset, int64_t bytes,
-+bdrv_co_snapshot_block_status(BlockDriverState *bs, unsigned int mode,
-+                              int64_t offset, int64_t bytes,
-                               int64_t *pnum, int64_t *map,
-                               BlockDriverState **file)
- {
-@@ -3729,7 +3730,7 @@ bdrv_co_snapshot_block_status(BlockDriverState *bs,
-     }
- 
-     bdrv_inc_in_flight(bs);
--    ret = drv->bdrv_co_snapshot_block_status(bs, want_zero, offset, bytes,
-+    ret = drv->bdrv_co_snapshot_block_status(bs, mode, offset, bytes,
-                                              pnum, map, file);
-     bdrv_dec_in_flight(bs);
- 
-diff --git a/block/iscsi.c b/block/iscsi.c
-index 979bf90cb7..d7caa4b363 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -694,9 +694,9 @@ out_unlock:
- 
- 
- static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
--                                              bool want_zero, int64_t offset,
--                                              int64_t bytes, int64_t *pnum,
--                                              int64_t *map,
-+                                              unsigned int mode,
-+                                              int64_t offset, int64_t bytes,
-+                                              int64_t *pnum, int64_t *map,
-                                               BlockDriverState **file)
- {
-     IscsiLun *iscsilun = bs->opaque;
-diff --git a/block/nbd.c b/block/nbd.c
-index d464315766..a359aa236e 100644
---- a/block/nbd.c
-+++ b/block/nbd.c
-@@ -1397,8 +1397,8 @@ nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
- }
- 
- static int coroutine_fn GRAPH_RDLOCK nbd_client_co_block_status(
--        BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
--        int64_t *pnum, int64_t *map, BlockDriverState **file)
-+        BlockDriverState *bs, unsigned int mode, int64_t offset,
-+        int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file)
- {
-     int ret, request_ret;
-     NBDExtent64 extent = { 0 };
-diff --git a/block/null.c b/block/null.c
-index 4730acc1eb..95021230c8 100644
---- a/block/null.c
-+++ b/block/null.c
-@@ -227,9 +227,9 @@ static int null_reopen_prepare(BDRVReopenState *reopen_state,
- }
- 
- static int coroutine_fn null_co_block_status(BlockDriverState *bs,
--                                             bool want_zero, int64_t offset,
--                                             int64_t bytes, int64_t *pnum,
--                                             int64_t *map,
-+                                             unsigned int mode,
-+                                             int64_t offset, int64_t bytes,
-+                                             int64_t *pnum, int64_t *map,
-                                              BlockDriverState **file)
- {
-     BDRVNullState *s = bs->opaque;
-diff --git a/block/parallels.c b/block/parallels.c
-index 9205a0864f..22ea7834fd 100644
---- a/block/parallels.c
-+++ b/block/parallels.c
-@@ -416,9 +416,9 @@ parallels_co_flush_to_os(BlockDriverState *bs)
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--parallels_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
--                          int64_t bytes, int64_t *pnum, int64_t *map,
--                          BlockDriverState **file)
-+parallels_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                          int64_t offset, int64_t bytes, int64_t *pnum,
-+                          int64_t *map, BlockDriverState **file)
- {
-     BDRVParallelsState *s = bs->opaque;
-     int count;
-diff --git a/block/qcow.c b/block/qcow.c
-index c2f89db055..2e18c42d8f 100644
---- a/block/qcow.c
-+++ b/block/qcow.c
-@@ -530,7 +530,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--qcow_co_block_status(BlockDriverState *bs, bool want_zero,
-+qcow_co_block_status(BlockDriverState *bs, unsigned int mode,
-                      int64_t offset, int64_t bytes, int64_t *pnum,
-                      int64_t *map, BlockDriverState **file)
- {
-diff --git a/block/qcow2.c b/block/qcow2.c
-index a4cffb628c..788da07fee 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -2147,9 +2147,9 @@ static void qcow2_join_options(QDict *options, QDict *old_options)
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--qcow2_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
--                      int64_t count, int64_t *pnum, int64_t *map,
--                      BlockDriverState **file)
-+qcow2_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                      int64_t offset, int64_t count, int64_t *pnum,
-+                      int64_t *map, BlockDriverState **file)
- {
-     BDRVQcow2State *s = bs->opaque;
-     uint64_t host_offset;
-diff --git a/block/qed.c b/block/qed.c
-index fa5bc11085..b135e981e5 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -832,9 +832,9 @@ fail:
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--bdrv_qed_co_block_status(BlockDriverState *bs, bool want_zero, int64_t pos,
--                         int64_t bytes, int64_t *pnum, int64_t *map,
--                         BlockDriverState **file)
-+bdrv_qed_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                         int64_t pos, int64_t bytes, int64_t *pnum,
-+                         int64_t *map, BlockDriverState **file)
- {
-     BDRVQEDState *s = bs->opaque;
-     size_t len = MIN(bytes, SIZE_MAX);
-diff --git a/block/quorum.c b/block/quorum.c
-index db8fe891c4..bb4ed9483e 100644
---- a/block/quorum.c
-+++ b/block/quorum.c
-@@ -1226,7 +1226,7 @@ static void quorum_child_perm(BlockDriverState *bs, BdrvChild *c,
-  * region contains zeroes, and BDRV_BLOCK_DATA otherwise.
-  */
- static int coroutine_fn GRAPH_RDLOCK
--quorum_co_block_status(BlockDriverState *bs, bool want_zero,
-+quorum_co_block_status(BlockDriverState *bs, unsigned int mode,
-                        int64_t offset, int64_t count,
-                        int64_t *pnum, int64_t *map, BlockDriverState **file)
- {
-@@ -1238,7 +1238,7 @@ quorum_co_block_status(BlockDriverState *bs, bool want_zero,
-     for (i = 0; i < s->num_children; i++) {
-         int64_t bytes;
-         ret = bdrv_co_common_block_status_above(s->children[i]->bs, NULL, false,
--                                                want_zero, offset, count,
-+                                                mode, offset, count,
-                                                 &bytes, NULL, NULL, NULL);
-         if (ret < 0) {
-             quorum_report_bad(QUORUM_OP_TYPE_READ, offset, count,
-diff --git a/block/raw-format.c b/block/raw-format.c
-index ac7e8495f6..623bca87a6 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -283,8 +283,8 @@ fail:
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--raw_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
--                    int64_t bytes, int64_t *pnum, int64_t *map,
-+raw_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                    int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map,
-                     BlockDriverState **file)
- {
-     BDRVRawState *s = bs->opaque;
-diff --git a/block/rbd.c b/block/rbd.c
-index 9c0fd0cb3f..627f8eb05a 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -1504,9 +1504,9 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
- }
- 
- static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
--                                                 bool want_zero, int64_t offset,
--                                                 int64_t bytes, int64_t *pnum,
--                                                 int64_t *map,
-+                                                 unsigned int mode,
-+                                                 int64_t offset, int64_t bytes,
-+                                                 int64_t *pnum, int64_t *map,
-                                                  BlockDriverState **file)
- {
-     BDRVRBDState *s = bs->opaque;
-diff --git a/block/snapshot-access.c b/block/snapshot-access.c
-index 84d0d13f86..972b8f2e68 100644
---- a/block/snapshot-access.c
-+++ b/block/snapshot-access.c
-@@ -41,11 +41,11 @@ snapshot_access_co_preadv_part(BlockDriverState *bs,
- 
- static int coroutine_fn GRAPH_RDLOCK
- snapshot_access_co_block_status(BlockDriverState *bs,
--                                bool want_zero, int64_t offset,
-+                                unsigned int mode, int64_t offset,
-                                 int64_t bytes, int64_t *pnum,
-                                 int64_t *map, BlockDriverState **file)
- {
--    return bdrv_co_snapshot_block_status(bs->file->bs, want_zero, offset,
-+    return bdrv_co_snapshot_block_status(bs->file->bs, mode, offset,
-                                          bytes, pnum, map, file);
- }
- 
-diff --git a/block/vdi.c b/block/vdi.c
-index 6363da08ce..028fe68488 100644
---- a/block/vdi.c
-+++ b/block/vdi.c
-@@ -521,8 +521,8 @@ static int vdi_reopen_prepare(BDRVReopenState *state,
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--vdi_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
--                    int64_t bytes, int64_t *pnum, int64_t *map,
-+vdi_co_block_status(BlockDriverState *bs, unsigned int mode,
-+                    int64_t offset, int64_t bytes, int64_t *pnum, int64_t *map,
-                     BlockDriverState **file)
- {
-     BDRVVdiState *s = (BDRVVdiState *)bs->opaque;
-diff --git a/block/vmdk.c b/block/vmdk.c
-index 78f6433607..6f1af82078 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -1777,7 +1777,7 @@ static inline uint64_t vmdk_find_offset_in_cluster(VmdkExtent *extent,
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--vmdk_co_block_status(BlockDriverState *bs, bool want_zero,
-+vmdk_co_block_status(BlockDriverState *bs, unsigned int mode,
-                      int64_t offset, int64_t bytes, int64_t *pnum,
-                      int64_t *map, BlockDriverState **file)
- {
-diff --git a/block/vpc.c b/block/vpc.c
-index d95a204612..0dd641b614 100644
---- a/block/vpc.c
-+++ b/block/vpc.c
-@@ -721,7 +721,7 @@ fail:
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
--vpc_co_block_status(BlockDriverState *bs, bool want_zero,
-+vpc_co_block_status(BlockDriverState *bs, unsigned int mode,
-                     int64_t offset, int64_t bytes,
-                     int64_t *pnum, int64_t *map,
-                     BlockDriverState **file)
-diff --git a/block/vvfat.c b/block/vvfat.c
-index 8ffe8b3b9b..d59231357e 100644
---- a/block/vvfat.c
-+++ b/block/vvfat.c
-@@ -3135,9 +3135,9 @@ vvfat_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
- }
- 
- static int coroutine_fn vvfat_co_block_status(BlockDriverState *bs,
--                                              bool want_zero, int64_t offset,
--                                              int64_t bytes, int64_t *n,
--                                              int64_t *map,
-+                                              unsigned int mode,
-+                                              int64_t offset, int64_t bytes,
-+                                              int64_t *n, int64_t *map,
-                                               BlockDriverState **file)
- {
-     *n = bytes;
-diff --git a/include/block/block-common.h b/include/block/block-common.h
-index 7030669f04..5beee6402b 100644
---- a/include/block/block-common.h
-+++ b/include/block/block-common.h
-@@ -333,6 +333,17 @@ typedef enum {
- #define BDRV_BLOCK_RECURSE      0x40
- #define BDRV_BLOCK_COMPRESSED   0x80
- 
-+/*
-+ * Block status hints: the bitwise-or of these flags emphasize what
-+ * the caller hopes to learn, and some drivers may be able to give
-+ * faster answers by doing less work when the hint permits.
-+ */
-+#define BDRV_WANT_ZERO          BDRV_BLOCK_ZERO
-+#define BDRV_WANT_OFFSET_VALID  BDRV_BLOCK_OFFSET_VALID
-+#define BDRV_WANT_ALLOCATED     BDRV_BLOCK_ALLOCATED
-+#define BDRV_WANT_PRECISE       (BDRV_WANT_ZERO | BDRV_WANT_OFFSET_VALID | \
-+                                 BDRV_WANT_OFFSET_VALID)
-+
- typedef QTAILQ_HEAD(BlockReopenQueue, BlockReopenQueueEntry) BlockReopenQueue;
- 
- typedef struct BDRVReopenState {
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index ebb4e56a50..a9c0daa2a4 100644
---- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -608,15 +608,16 @@ struct BlockDriver {
-      * according to the current layer, and should only need to set
-      * BDRV_BLOCK_DATA, BDRV_BLOCK_ZERO, BDRV_BLOCK_OFFSET_VALID,
-      * and/or BDRV_BLOCK_RAW; if the current layer defers to a backing
--     * layer, the result should be 0 (and not BDRV_BLOCK_ZERO).  See
--     * block.h for the overall meaning of the bits.  As a hint, the
--     * flag want_zero is true if the caller cares more about precise
--     * mappings (favor accurate _OFFSET_VALID/_ZERO) or false for
--     * overall allocation (favor larger *pnum, perhaps by reporting
--     * _DATA instead of _ZERO).  The block layer guarantees input
--     * clamped to bdrv_getlength() and aligned to request_alignment,
--     * as well as non-NULL pnum, map, and file; in turn, the driver
--     * must return an error or set pnum to an aligned non-zero value.
-+     * layer, the result should be 0 (and not BDRV_BLOCK_ZERO).  The
-+     * caller will synthesize BDRV_BLOCK_ALLOCATED based on the
-+     * non-zero results.  See block.h for the overall meaning of the
-+     * bits.  As a hint, the flags in @mode may include a bitwise-or
-+     * of BDRV_WANT_ALLOCATED, BDRV_WANT_OFFSET_VALID, or
-+     * BDRV_WANT_ZERO based on what the caller is looking for in the
-+     * results.  The block layer guarantees input clamped to
-+     * bdrv_getlength() and aligned to request_alignment, as well as
-+     * non-NULL pnum, map, and file; in turn, the driver must return
-+     * an error or set pnum to an aligned non-zero value.
-      *
-      * Note that @bytes is just a hint on how big of a region the
-      * caller wants to inspect.  It is not a limit on *pnum.
-@@ -628,8 +629,8 @@ struct BlockDriver {
-      * to clamping *pnum for return to its caller.
-      */
-     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_block_status)(
--        BlockDriverState *bs,
--        bool want_zero, int64_t offset, int64_t bytes, int64_t *pnum,
-+        BlockDriverState *bs, unsigned int mode,
-+        int64_t offset, int64_t bytes, int64_t *pnum,
-         int64_t *map, BlockDriverState **file);
- 
-     /*
-@@ -653,8 +654,8 @@ struct BlockDriver {
-         QEMUIOVector *qiov, size_t qiov_offset);
- 
-     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_snapshot_block_status)(
--        BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
--        int64_t *pnum, int64_t *map, BlockDriverState **file);
-+        BlockDriverState *bs, unsigned int mode, int64_t offset,
-+        int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file);
- 
-     int coroutine_fn GRAPH_RDLOCK_PTR (*bdrv_co_pdiscard_snapshot)(
-         BlockDriverState *bs, int64_t offset, int64_t bytes);
-diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
-index 4a7cf2b4fd..4f94eb3c5a 100644
---- a/include/block/block_int-io.h
-+++ b/include/block/block_int-io.h
-@@ -38,8 +38,8 @@
- int coroutine_fn GRAPH_RDLOCK bdrv_co_preadv_snapshot(BdrvChild *child,
-     int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset);
- int coroutine_fn GRAPH_RDLOCK bdrv_co_snapshot_block_status(
--    BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
--    int64_t *pnum, int64_t *map, BlockDriverState **file);
-+    BlockDriverState *bs, unsigned int mode, int64_t offset,
-+    int64_t bytes, int64_t *pnum, int64_t *map, BlockDriverState **file);
- int coroutine_fn GRAPH_RDLOCK bdrv_co_pdiscard_snapshot(BlockDriverState *bs,
-     int64_t offset, int64_t bytes);
- 
-diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 3766d5de6b..373b72fdd8 100644
---- a/tests/unit/test-block-iothread.c
-+++ b/tests/unit/test-block-iothread.c
-@@ -63,7 +63,7 @@ bdrv_test_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
- }
- 
- static int coroutine_fn bdrv_test_co_block_status(BlockDriverState *bs,
--                                                  bool want_zero,
-+                                                  unsigned int mode,
-                                                   int64_t offset, int64_t count,
-                                                   int64_t *pnum, int64_t *map,
-                                                   BlockDriverState **file)
--- 
-2.48.1
-
diff --git a/kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch b/kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch
deleted file mode 100644
index 63d37e6..0000000
--- a/kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From eed2b4b40553cae162407b375f18c935f5025c53 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:57 +0100
-Subject: [PATCH 13/23] block: Fix crash on block_resize on inactive node
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [12/22] e352c665f68a865859cc62fe1ed6e4044407b8e3 (kmwolf/centos-qemu-kvm)
-
-In order for block_resize to fail gracefully on an inactive node instead
-of crashing with an assertion failure in bdrv_co_write_req_prepare()
-(called from bdrv_co_truncate()), we need to check for inactive nodes
-also when they are attached as a root node and make sure that
-BLK_PERM_RESIZE isn't among the permissions allowed for inactive nodes.
-To this effect, don't enumerate the permissions that are incompatible
-with inactive nodes any more, but allow only BLK_PERM_CONSISTENT_READ
-for them.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-7-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 8c2c72a33581987af8d8c484d03af3cd69b9e10a)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c               | 7 +++++++
- block/block-backend.c | 2 +-
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/block.c b/block.c
-index 41e72e6965..bedd54deaa 100644
---- a/block.c
-+++ b/block.c
-@@ -3077,6 +3077,13 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
-     assert(child_class->get_parent_desc);
-     GLOBAL_STATE_CODE();
- 
-+    if (bdrv_is_inactive(child_bs) && (perm & ~BLK_PERM_CONSISTENT_READ)) {
-+        g_autofree char *perm_names = bdrv_perm_names(perm);
-+        error_setg(errp, "Permission '%s' unavailable on inactive node",
-+                   perm_names);
-+        return NULL;
-+    }
-+
-     new_child = g_new(BdrvChild, 1);
-     *new_child = (BdrvChild) {
-         .bs             = NULL,
-diff --git a/block/block-backend.c b/block/block-backend.c
-index db6f9b92a3..356db1b703 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -253,7 +253,7 @@ static bool blk_can_inactivate(BlockBackend *blk)
-      * guest.  For block job BBs that satisfy this, we can just allow
-      * it.  This is the case for mirror job source, which is required
-      * by libvirt non-shared block migration. */
--    if (!(blk->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED))) {
-+    if (!(blk->perm & ~BLK_PERM_CONSISTENT_READ)) {
-         return true;
-     }
- 
--- 
-2.48.1
-
diff --git a/kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch b/kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch
deleted file mode 100644
index 3c38d06..0000000
--- a/kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 6f4a7e3489a104137f60e034157cf687e4c3158f Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:54 +0100
-Subject: [PATCH 10/23] block: Inactivate external snapshot overlays when
- necessary
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [9/22] 59b39138f0da734d497f3a58d458992abc348978 (kmwolf/centos-qemu-kvm)
-
-Putting an active block node on top of an inactive one is strictly
-speaking an invalid configuration and the next patch will turn it into a
-hard error.
-
-However, taking a snapshot while disk images are inactive after
-completing migration has an important use case: After migrating to a
-file, taking an external snapshot is what is needed to take a full VM
-snapshot.
-
-In order for this to keep working after the later patches, change
-creating a snapshot such that it automatically inactivates an overlay
-that is added on top of an already inactive node.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-4-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit e80210ffb24c4e47650344ba77ce3ed354af596c)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- blockdev.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/blockdev.c b/blockdev.c
-index 835064ed03..81430122df 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -1497,6 +1497,22 @@ static void external_snapshot_action(TransactionAction *action,
-         return;
-     }
- 
-+    /*
-+     * Older QEMU versions have allowed adding an active parent node to an
-+     * inactive child node. This is unsafe in the general case, but there is an
-+     * important use case, which is taking a VM snapshot with migration to file
-+     * and then adding an external snapshot while the VM is still stopped and
-+     * images are inactive. Requiring the user to explicitly create the overlay
-+     * as inactive would break compatibility, so just do it automatically here
-+     * to keep this working.
-+     */
-+    if (bdrv_is_inactive(state->old_bs) && !bdrv_is_inactive(state->new_bs)) {
-+        ret = bdrv_inactivate(state->new_bs, errp);
-+        if (ret < 0) {
-+            return;
-+        }
-+    }
-+
-     ret = bdrv_append(state->new_bs, state->old_bs, errp);
-     if (ret < 0) {
-         return;
--- 
-2.48.1
-
diff --git a/kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch b/kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch
deleted file mode 100644
index 8b86f66..0000000
--- a/kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 9f8158e56beae4221e91feb5a98cb4db9076cac4 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:20 -0500
-Subject: [PATCH 05/16] block: Let bdrv_co_is_zero_fast consolidate adjacent
- extents
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [3/14] 98bf9ff773d9a36f8a8e294e38629e3f20c41334 (ebblake/centos-qemu-kvm)
-
-Some BDS drivers have a cap on how much block status they can supply
-in one query (for example, NBD talking to an older server cannot
-inspect more than 4G per query; and qcow2 tends to cap its answers
-rather than cross a cluster boundary of an L1 table).  Although the
-existing callers of bdrv_co_is_zero_fast are not passing in that large
-of a 'bytes' parameter, an upcoming caller wants to query the entire
-image at once, and will thus benefit from being able to treat adjacent
-zero regions in a coalesced manner, rather than claiming the region is
-non-zero merely because pnum was truncated and didn't match the
-incoming bytes.
-
-While refactoring this into a loop, note that there is no need to
-assign pnum prior to calling bdrv_co_common_block_status_above() (it
-is guaranteed to be assigned deeper in the callstack).
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-18-eblake@redhat.com>
-(cherry picked from commit 31bf15d97dd1d205a3b264675f9a1b3bd1939068)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/io.c | 27 +++++++++++++++------------
- 1 file changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/block/io.c b/block/io.c
-index daaafe00d7..293c5dd393 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -2747,28 +2747,31 @@ int coroutine_fn bdrv_co_block_status(BlockDriverState *bs, int64_t offset,
-  * by @offset and @bytes is known to read as zeroes.
-  * Return 1 if that is the case, 0 otherwise and -errno on error.
-  * This test is meant to be fast rather than accurate so returning 0
-- * does not guarantee non-zero data.
-+ * does not guarantee non-zero data; but a return of 1 is reliable.
-  */
- int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
-                                       int64_t bytes)
- {
-     int ret;
--    int64_t pnum = bytes;
-+    int64_t pnum;
-     IO_CODE();
- 
--    if (!bytes) {
--        return 1;
--    }
--
--    ret = bdrv_co_common_block_status_above(bs, NULL, false, BDRV_WANT_ZERO,
--                                            offset, bytes, &pnum, NULL, NULL,
--                                            NULL);
-+    while (bytes) {
-+        ret = bdrv_co_common_block_status_above(bs, NULL, false,
-+                                                BDRV_WANT_ZERO, offset, bytes,
-+                                                &pnum, NULL, NULL, NULL);
- 
--    if (ret < 0) {
--        return ret;
-+        if (ret < 0) {
-+            return ret;
-+        }
-+        if (!(ret & BDRV_BLOCK_ZERO)) {
-+            return 0;
-+        }
-+        offset += pnum;
-+        bytes -= pnum;
-     }
- 
--    return (pnum == bytes) && (ret & BDRV_BLOCK_ZERO);
-+    return 1;
- }
- 
- int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t offset,
--- 
-2.48.1
-
diff --git a/kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch b/kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch
deleted file mode 100644
index fbe6fda..0000000
--- a/kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 9ab8c39284c0fc2d9d685706b2d788ab02930a08 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:00 +0100
-Subject: [PATCH 16/23] block: Support inactive nodes in blk_insert_bs()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [15/22] 17405266afeddc47f73828816d0b8c1ab5ece462 (kmwolf/centos-qemu-kvm)
-
-Device models have a relatively complex way to set up their block
-backends, in which blk_attach_dev() sets blk->disable_perm = true.
-We want to support inactive images in exports, too, so that
-qemu-storage-daemon can be used with migration. Because they don't use
-blk_attach_dev(), they need another way to set this flag. The most
-convenient is to do this automatically when an inactive node is attached
-to a BlockBackend that can be inactivated.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-10-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c1c5c7cc4ef6c45ca769c640566fd40d2cb7d5c1)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/block-backend.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index 356db1b703..4a5a1c1f6a 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -909,14 +909,24 @@ void blk_remove_bs(BlockBackend *blk)
- int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
- {
-     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
-+    uint64_t perm, shared_perm;
- 
-     GLOBAL_STATE_CODE();
-     bdrv_ref(bs);
-     bdrv_graph_wrlock();
-+
-+    if ((bs->open_flags & BDRV_O_INACTIVE) && blk_can_inactivate(blk)) {
-+        blk->disable_perm = true;
-+        perm = 0;
-+        shared_perm = BLK_PERM_ALL;
-+    } else {
-+        perm = blk->perm;
-+        shared_perm = blk->shared_perm;
-+    }
-+
-     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
-                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
--                                       blk->perm, blk->shared_perm,
--                                       blk, errp);
-+                                       perm, shared_perm, blk, errp);
-     bdrv_graph_wrunlock();
-     if (blk->root == NULL) {
-         return -EPERM;
--- 
-2.48.1
-
diff --git a/kvm-block-export-Add-option-to-allow-export-of-inactive-.patch b/kvm-block-export-Add-option-to-allow-export-of-inactive-.patch
deleted file mode 100644
index e3db67a..0000000
--- a/kvm-block-export-Add-option-to-allow-export-of-inactive-.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From 22de4ba6cec94a38cd56156d9114f06dc4d2a5a5 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:03 +0100
-Subject: [PATCH 19/23] block/export: Add option to allow export of inactive
- nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [18/22] 985eadb03f27d046b89ffeef1fb36ef2e4579552 (kmwolf/centos-qemu-kvm)
-
-Add an option in BlockExportOptions to allow creating an export on an
-inactive node without activating the node. This mode needs to be
-explicitly supported by the export type (so that it doesn't perform any
-operations that are forbidden for inactive nodes), so this patch alone
-doesn't allow this option to be successfully used yet.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-13-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 1600ef01ab1296ca8230daa6bc41ba983751f646)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/export/export.c  | 31 +++++++++++++++++++++----------
- include/block/export.h |  3 +++
- qapi/block-export.json | 10 +++++++++-
- 3 files changed, 33 insertions(+), 11 deletions(-)
-
-diff --git a/block/export/export.c b/block/export/export.c
-index 23a86efcdb..71af65b3e5 100644
---- a/block/export/export.c
-+++ b/block/export/export.c
-@@ -75,6 +75,7 @@ static const BlockExportDriver *blk_exp_find_driver(BlockExportType type)
- BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
- {
-     bool fixed_iothread = export->has_fixed_iothread && export->fixed_iothread;
-+    bool allow_inactive = export->has_allow_inactive && export->allow_inactive;
-     const BlockExportDriver *drv;
-     BlockExport *exp = NULL;
-     BlockDriverState *bs;
-@@ -138,17 +139,24 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-         }
-     }
- 
--    /*
--     * Block exports are used for non-shared storage migration. Make sure
--     * that BDRV_O_INACTIVE is cleared and the image is ready for write
--     * access since the export could be available before migration handover.
--     * ctx was acquired in the caller.
--     */
-     bdrv_graph_rdlock_main_loop();
--    ret = bdrv_activate(bs, errp);
--    if (ret < 0) {
--        bdrv_graph_rdunlock_main_loop();
--        goto fail;
-+    if (allow_inactive) {
-+        if (!drv->supports_inactive) {
-+            error_setg(errp, "Export type does not support inactive exports");
-+            bdrv_graph_rdunlock_main_loop();
-+            goto fail;
-+        }
-+    } else {
-+        /*
-+         * Block exports are used for non-shared storage migration. Make sure
-+         * that BDRV_O_INACTIVE is cleared and the image is ready for write
-+         * access since the export could be available before migration handover.
-+         */
-+        ret = bdrv_activate(bs, errp);
-+        if (ret < 0) {
-+            bdrv_graph_rdunlock_main_loop();
-+            goto fail;
-+        }
-     }
-     bdrv_graph_rdunlock_main_loop();
- 
-@@ -162,6 +170,9 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-     if (!fixed_iothread) {
-         blk_set_allow_aio_context_change(blk, true);
-     }
-+    if (allow_inactive) {
-+        blk_set_force_allow_inactivate(blk);
-+    }
- 
-     ret = blk_insert_bs(blk, bs, errp);
-     if (ret < 0) {
-diff --git a/include/block/export.h b/include/block/export.h
-index f2fe0f8078..4bd9531d4d 100644
---- a/include/block/export.h
-+++ b/include/block/export.h
-@@ -29,6 +29,9 @@ typedef struct BlockExportDriver {
-      */
-     size_t instance_size;
- 
-+    /* True if the export type supports running on an inactive node */
-+    bool supports_inactive;
-+
-     /* Creates and starts a new block export */
-     int (*create)(BlockExport *, BlockExportOptions *, Error **);
- 
-diff --git a/qapi/block-export.json b/qapi/block-export.json
-index ce33fe378d..117b05d13c 100644
---- a/qapi/block-export.json
-+++ b/qapi/block-export.json
-@@ -372,6 +372,13 @@
- #     cannot be moved to the iothread.  The default is false.
- #     (since: 5.2)
- #
-+# @allow-inactive: If true, the export allows the exported node to be inactive.
-+#     If it is created for an inactive block node, the node remains inactive. If
-+#     the export type doesn't support running on an inactive node, an error is
-+#     returned. If false, inactive block nodes are automatically activated before
-+#     creating the export and trying to inactivate them later fails.
-+#     (since: 10.0; default: false)
-+#
- # Since: 4.2
- ##
- { 'union': 'BlockExportOptions',
-@@ -381,7 +388,8 @@
-             '*iothread': 'str',
-             'node-name': 'str',
-             '*writable': 'bool',
--            '*writethrough': 'bool' },
-+            '*writethrough': 'bool',
-+            '*allow-inactive': 'bool' },
-   'discriminator': 'type',
-   'data': {
-       'nbd': 'BlockExportOptionsNbd',
--- 
-2.48.1
-
diff --git a/kvm-block-export-Don-t-ignore-image-activation-error-in-.patch b/kvm-block-export-Don-t-ignore-image-activation-error-in-.patch
deleted file mode 100644
index 217851f..0000000
--- a/kvm-block-export-Don-t-ignore-image-activation-error-in-.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 0cced76da63a886e6aaaa96a2c40620db27cb8cc Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:01 +0100
-Subject: [PATCH 17/23] block/export: Don't ignore image activation error in
- blk_exp_add()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [16/22] 86e791a19948c88a3512bb7ba3bd3ed0f03a2a18 (kmwolf/centos-qemu-kvm)
-
-Currently, block exports can't handle inactive images correctly.
-Incoming write requests would run into assertion failures. Make sure
-that we return an error when creating an export can't activate the
-image.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-11-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 69f28176ca0af850db23a1c6364f0c8525b20801)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/export/export.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/block/export/export.c b/block/export/export.c
-index 6d51ae8ed7..23a86efcdb 100644
---- a/block/export/export.c
-+++ b/block/export/export.c
-@@ -145,7 +145,11 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-      * ctx was acquired in the caller.
-      */
-     bdrv_graph_rdlock_main_loop();
--    bdrv_activate(bs, NULL);
-+    ret = bdrv_activate(bs, errp);
-+    if (ret < 0) {
-+        bdrv_graph_rdunlock_main_loop();
-+        goto fail;
-+    }
-     bdrv_graph_rdunlock_main_loop();
- 
-     perm = BLK_PERM_CONSISTENT_READ;
--- 
-2.48.1
-
diff --git a/kvm-block-io-skip-head-tail-requests-on-EINVAL.patch b/kvm-block-io-skip-head-tail-requests-on-EINVAL.patch
deleted file mode 100644
index 42e6ecf..0000000
--- a/kvm-block-io-skip-head-tail-requests-on-EINVAL.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From e629a362860977161e43ed80bb59d1d05a06b2f2 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 17 Apr 2025 11:05:28 -0400
-Subject: [PATCH 4/5] block/io: skip head/tail requests on EINVAL
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 355: file-posix: probe discard alignment on Linux block devices
-RH-Jira: RHEL-86032
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Commit: [2/3] 0028fb11f18e16e2aba9506eabb2383c406d17b5 (stefanha/centos-stream-qemu-kvm)
-
-When guests send misaligned discard requests, the block layer breaks
-them up into a misaligned head, an aligned main body, and a misaligned
-tail.
-
-The file-posix block driver on Linux returns -EINVAL on misaligned
-discard requests. This causes bdrv_co_pdiscard() to fail and guests
-configured with werror=stop will pause.
-
-Add a special case for misaligned head/tail requests. Simply continue
-when EINVAL is encountered so that the aligned main body of the request
-can be completed and the guest is not paused. This is the best we can do
-when guest discard limits do not match the host discard limits.
-
-Fixes: https://issues.redhat.com/browse/RHEL-86032
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20250417150528.76470-3-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 4733cb0833c4b223f92ec0136980eeb5239ecb87)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/io.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/block/io.c b/block/io.c
-index 301514c880..3e189837a1 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -3105,11 +3105,12 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
-     /* Invalidate the cached block-status data range if this discard overlaps */
-     bdrv_bsc_invalidate_range(bs, offset, bytes);
- 
--    /* Discard is advisory, but some devices track and coalesce
-+    /*
-+     * Discard is advisory, but some devices track and coalesce
-      * unaligned requests, so we must pass everything down rather than
--     * round here.  Still, most devices will just silently ignore
--     * unaligned requests (by returning -ENOTSUP), so we must fragment
--     * the request accordingly.  */
-+     * round here.  Still, most devices reject unaligned requests with
-+     * -EINVAL or -ENOTSUP, so we must fragment the request accordingly.
-+     */
-     align = MAX(bs->bl.pdiscard_alignment, bs->bl.request_alignment);
-     assert(align % bs->bl.request_alignment == 0);
-     head = offset % align;
-@@ -3176,7 +3177,11 @@ int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
-             }
-         }
-         if (ret && ret != -ENOTSUP) {
--            goto out;
-+            if (ret == -EINVAL && (offset % align != 0 || num % align != 0)) {
-+                /* Silently skip rejected unaligned head/tail requests */
-+            } else {
-+                goto out; /* bail out */
-+            }
-         }
- 
-         offset += num;
--- 
-2.48.1
-
diff --git a/kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch b/kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch
deleted file mode 100644
index 72c7a02..0000000
--- a/kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From d38bdce712f572e1920e3344132ff6600d657de2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:41 +0100
-Subject: [PATCH 29/57] block: skip automatic zero-init of large array in
- ioq_submit
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/30] 301a08b3acdcd95634dec5dab1d96fcfe3abf3be (stefanha/centos-stream-qemu-kvm)
-
-The 'ioq_submit' method has a struct array that is 8k in size.
-Skip the automatic zero-init of this array to eliminate the
-performance overhead in the I/O hot path.
-
-The 'iocbs' array will selectively initialized when processing
-the I/O data.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-4-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 83750c1da807c973b0b11d977d61df7e41122d03)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/linux-aio.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/block/linux-aio.c b/block/linux-aio.c
-index e3b5ec9aba..26d9f086d2 100644
---- a/block/linux-aio.c
-+++ b/block/linux-aio.c
-@@ -291,7 +291,7 @@ static void ioq_submit(LinuxAioState *s)
- {
-     int ret, len;
-     struct qemu_laiocb *aiocb;
--    struct iocb *iocbs[MAX_EVENTS];
-+    QEMU_UNINITIALIZED struct iocb *iocbs[MAX_EVENTS];
-     QSIMPLEQ_HEAD(, qemu_laiocb) completed;
- 
-     do {
--- 
-2.39.3
-
diff --git a/kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch b/kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch
deleted file mode 100644
index 4d56bf1..0000000
--- a/kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 1e8798a3adbbfc42167aaba0ee18175deac37193 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:42 +0100
-Subject: [PATCH 30/57] chardev/char-fd: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/30] b16fe5c9af4756e1856cd330df02a1a09d9f33ea (stefanha/centos-stream-qemu-kvm)
-
-The 'fd_chr_read' method has a 4k byte array used for copying
-data between the socket and device. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O
-hot path.
-
-The 'buf' array will be fully initialized when reading data off
-the network socket.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-5-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit a503bdc22b91869e3bf45522e36b122889465306)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- chardev/char-fd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/chardev/char-fd.c b/chardev/char-fd.c
-index d2c4923359..8dd662c066 100644
---- a/chardev/char-fd.c
-+++ b/chardev/char-fd.c
-@@ -50,7 +50,7 @@ static gboolean fd_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
-     Chardev *chr = CHARDEV(opaque);
-     FDChardev *s = FD_CHARDEV(opaque);
-     int len;
--    uint8_t buf[CHR_READ_BUF_LEN];
-+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
-     ssize_t ret;
- 
-     len = sizeof(buf);
--- 
-2.39.3
-
diff --git a/kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch b/kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch
deleted file mode 100644
index 7edacc8..0000000
--- a/kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 74311b0ee8e211fccff211b975e4ae9236c063dc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:43 +0100
-Subject: [PATCH 31/57] chardev/char-pty: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/30] a3b8458c30f485551093f292c00c20b0e118df77 (stefanha/centos-stream-qemu-kvm)
-
-The 'pty_chr_read' method has a 4k byte array used for copying
-data between the PTY and device. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O
-hot path.
-
-The 'buf' array will be fully initialized when reading data off
-the PTY.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-6-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 45bb7fb21c8d18294a9f92da99d01ab3c67c7df2)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- chardev/char-pty.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/chardev/char-pty.c b/chardev/char-pty.c
-index cc2f7617fe..3319ad215d 100644
---- a/chardev/char-pty.c
-+++ b/chardev/char-pty.c
-@@ -152,7 +152,7 @@ static gboolean pty_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
-     Chardev *chr = CHARDEV(opaque);
-     PtyChardev *s = PTY_CHARDEV(opaque);
-     gsize len;
--    uint8_t buf[CHR_READ_BUF_LEN];
-+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
-     ssize_t ret;
- 
-     len = sizeof(buf);
--- 
-2.39.3
-
diff --git a/kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch b/kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch
deleted file mode 100644
index 3b6889b..0000000
--- a/kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From d56a8ce56f0de70ab2de266a80e25cf309e72fda Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:44 +0100
-Subject: [PATCH 32/57] chardev/char-socket: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/30] 86a2ac03efa1838fb30931c38945ee77de9bbe06 (stefanha/centos-stream-qemu-kvm)
-
-The 'tcp_chr_read' method has a 4k byte array used for copying
-data between the socket and device. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O
-hot path.
-
-The 'buf' array will be fully initialized when reading data off
-the network socket.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-7-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 9a23075cef1ac6e73a95a489ac72f41c573ceb9b)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- chardev/char-socket.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/chardev/char-socket.c b/chardev/char-socket.c
-index 1ca9441b1b..99d644e89f 100644
---- a/chardev/char-socket.c
-+++ b/chardev/char-socket.c
-@@ -497,7 +497,7 @@ static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
- {
-     Chardev *chr = CHARDEV(opaque);
-     SocketChardev *s = SOCKET_CHARDEV(opaque);
--    uint8_t buf[CHR_READ_BUF_LEN];
-+    QEMU_UNINITIALIZED uint8_t buf[CHR_READ_BUF_LEN];
-     int len, size;
- 
-     if ((s->state != TCP_CHARDEV_STATE_CONNECTED) ||
--- 
-2.39.3
-
diff --git a/kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch b/kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch
deleted file mode 100644
index b07a22d..0000000
--- a/kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From dd4ab64754a52f1e50273cb8153567b0d2f382de Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 071/115] cpu: Don't set vcpu_dirty when guest_state_protected
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [71/115] c876a59ee5bbfccea9837ac373a2e664354db3ae (bonzini/rhel-qemu-kvm)
-
-QEMU calls kvm_arch_put_registers() when vcpu_dirty is true in
-kvm_vcpu_exec(). However, for confidential guest, like TDX, putting
-registers is disallowed due to guest state is protected.
-
-Only set vcpu_dirty to true with guest state is not protected when
-creating the vcpu.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-43-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b4b7fb5a773e1d2215c2aaa99789eca51914b78f)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- accel/kvm/kvm-all.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index c1605bc4fa..43c10c82f6 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -456,7 +456,9 @@ int kvm_create_vcpu(CPUState *cpu)
- 
-     cpu->kvm_fd = kvm_fd;
-     cpu->kvm_state = s;
--    cpu->vcpu_dirty = true;
-+    if (!s->guest_state_protected) {
-+        cpu->vcpu_dirty = true;
-+    }
-     cpu->dirty_pages = 0;
-     cpu->throttle_us_per_full = 0;
- 
--- 
-2.50.1
-
diff --git a/kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch b/kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch
deleted file mode 100644
index b61e5f3..0000000
--- a/kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From c57b5e38fd95a68f36a342e19ba7ccb6cbb07948 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 014/115] cpu: Remove nr_cores from struct CPUState
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [14/115] 80f6414c5f8f5e963b0f2251147b8a1ca04f55e4 (bonzini/rhel-qemu-kvm)
-
-There is no user of it now, remove it.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-9-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 6e090ffe0d188e1f09d4efcd10d82158f92abfbb)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d4c699c310519b99bedf1bdb516cab230d5d846c)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/core/cpu-common.c  | 1 -
- include/hw/core/cpu.h | 2 --
- system/cpus.c         | 1 -
- 3 files changed, 4 deletions(-)
-
-diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
-index 7982ecd39a..1ac8ab488f 100644
---- a/hw/core/cpu-common.c
-+++ b/hw/core/cpu-common.c
-@@ -242,7 +242,6 @@ static void cpu_common_initfn(Object *obj)
-     cpu->cluster_index = UNASSIGNED_CLUSTER_INDEX;
-     /* user-mode doesn't have configurable SMP topology */
-     /* the default value is changed by qemu_init_vcpu() for system-mode */
--    cpu->nr_cores = 1;
-     cpu->nr_threads = 1;
-     cpu->cflags_next_tb = -1;
- 
-diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index 1c9c775df6..d90e3b3f2c 100644
---- a/include/hw/core/cpu.h
-+++ b/include/hw/core/cpu.h
-@@ -402,7 +402,6 @@ struct qemu_work_item;
-  *   Under TCG this value is propagated to @tcg_cflags.
-  *   See TranslationBlock::TCG CF_CLUSTER_MASK.
-  * @tcg_cflags: Pre-computed cflags for this cpu.
-- * @nr_cores: Number of cores within this CPU package.
-  * @nr_threads: Number of threads within this CPU core.
-  * @thread: Host thread details, only live once @created is #true
-  * @sem: WIN32 only semaphore used only for qtest
-@@ -461,7 +460,6 @@ struct CPUState {
-     CPUClass *cc;
-     /*< public >*/
- 
--    int nr_cores;
-     int nr_threads;
- 
-     struct QemuThread *thread;
-diff --git a/system/cpus.c b/system/cpus.c
-index 1c818ff682..909d8128e8 100644
---- a/system/cpus.c
-+++ b/system/cpus.c
-@@ -666,7 +666,6 @@ void qemu_init_vcpu(CPUState *cpu)
- {
-     MachineState *ms = MACHINE(qdev_get_machine());
- 
--    cpu->nr_cores = machine_topo_get_cores_per_socket(ms);
-     cpu->nr_threads =  ms->smp.threads;
-     cpu->stopped = true;
-     cpu->random_seed = qemu_guest_random_seed_thread_part1();
--- 
-2.50.1
-
diff --git a/kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch b/kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch
deleted file mode 100644
index 5712581..0000000
--- a/kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 4df071fec89ab867f8e2d970de48256034e4b286 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:29:04 +0200
-Subject: [PATCH 005/115] crypto: Define macros for hash algorithm digest
- lengths
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [5/115] f5f6e0c3cd10baf7a490b67dd6c0542bddba8dfe (bonzini/rhel-qemu-kvm)
-
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 5d04de7de54e163b056980be10ee1c281a600276)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- crypto/hash.c         | 14 +++++++-------
- include/crypto/hash.h |  8 ++++++++
- 2 files changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/crypto/hash.c b/crypto/hash.c
-index b0f8228bdc..8087f5dae6 100644
---- a/crypto/hash.c
-+++ b/crypto/hash.c
-@@ -23,13 +23,13 @@
- #include "hashpriv.h"
- 
- static size_t qcrypto_hash_alg_size[QCRYPTO_HASH_ALG__MAX] = {
--    [QCRYPTO_HASH_ALG_MD5] = 16,
--    [QCRYPTO_HASH_ALG_SHA1] = 20,
--    [QCRYPTO_HASH_ALG_SHA224] = 28,
--    [QCRYPTO_HASH_ALG_SHA256] = 32,
--    [QCRYPTO_HASH_ALG_SHA384] = 48,
--    [QCRYPTO_HASH_ALG_SHA512] = 64,
--    [QCRYPTO_HASH_ALG_RIPEMD160] = 20,
-+    [QCRYPTO_HASH_ALG_MD5]       = QCRYPTO_HASH_DIGEST_LEN_MD5,
-+    [QCRYPTO_HASH_ALG_SHA1]      = QCRYPTO_HASH_DIGEST_LEN_SHA1,
-+    [QCRYPTO_HASH_ALG_SHA224]    = QCRYPTO_HASH_DIGEST_LEN_SHA224,
-+    [QCRYPTO_HASH_ALG_SHA256]    = QCRYPTO_HASH_DIGEST_LEN_SHA256,
-+    [QCRYPTO_HASH_ALG_SHA384]    = QCRYPTO_HASH_DIGEST_LEN_SHA384,
-+    [QCRYPTO_HASH_ALG_SHA512]    = QCRYPTO_HASH_DIGEST_LEN_SHA512,
-+    [QCRYPTO_HASH_ALG_RIPEMD160] = QCRYPTO_HASH_DIGEST_LEN_RIPEMD160,
- };
- 
- size_t qcrypto_hash_digest_len(QCryptoHashAlgorithm alg)
-diff --git a/include/crypto/hash.h b/include/crypto/hash.h
-index 54d87aa2a1..a113cc3b04 100644
---- a/include/crypto/hash.h
-+++ b/include/crypto/hash.h
-@@ -23,6 +23,14 @@
- 
- #include "qapi/qapi-types-crypto.h"
- 
-+#define QCRYPTO_HASH_DIGEST_LEN_MD5       16
-+#define QCRYPTO_HASH_DIGEST_LEN_SHA1      20
-+#define QCRYPTO_HASH_DIGEST_LEN_SHA224    28
-+#define QCRYPTO_HASH_DIGEST_LEN_SHA256    32
-+#define QCRYPTO_HASH_DIGEST_LEN_SHA384    48
-+#define QCRYPTO_HASH_DIGEST_LEN_SHA512    64
-+#define QCRYPTO_HASH_DIGEST_LEN_RIPEMD160 20
-+
- /* See also "QCryptoHashAlgorithm" defined in qapi/crypto.json */
- 
- /**
--- 
-2.50.1
-
diff --git a/kvm-docs-Add-TDX-documentation.patch b/kvm-docs-Add-TDX-documentation.patch
deleted file mode 100644
index 3b0a3ae..0000000
--- a/kvm-docs-Add-TDX-documentation.patch
+++ /dev/null
@@ -1,222 +0,0 @@
-From a9c7bbb7a32ba2ea5cd76b87c41f1fbdd789fb3b Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 084/115] docs: Add TDX documentation
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [84/115] 4f9930f4415e7195bf5bbbcc0d79cfc6aaa385e1 (bonzini/rhel-qemu-kvm)
-
-Add docs/system/i386/tdx.rst for TDX support, and add tdx in
-confidential-guest-support.rst
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-56-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit dc1424319311f86449c6825ceec2364ee645a363)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- docs/system/confidential-guest-support.rst |   1 +
- docs/system/i386/tdx.rst                   | 161 +++++++++++++++++++++
- docs/system/target-i386.rst                |   1 +
- 3 files changed, 163 insertions(+)
- create mode 100644 docs/system/i386/tdx.rst
-
-diff --git a/docs/system/confidential-guest-support.rst b/docs/system/confidential-guest-support.rst
-index 0c490dbda2..66129fbab6 100644
---- a/docs/system/confidential-guest-support.rst
-+++ b/docs/system/confidential-guest-support.rst
-@@ -38,6 +38,7 @@ Supported mechanisms
- Currently supported confidential guest mechanisms are:
- 
- * AMD Secure Encrypted Virtualization (SEV) (see :doc:`i386/amd-memory-encryption`)
-+* Intel Trust Domain Extension (TDX) (see :doc:`i386/tdx`)
- * POWER Protected Execution Facility (PEF) (see :ref:`power-papr-protected-execution-facility-pef`)
- * s390x Protected Virtualization (PV) (see :doc:`s390x/protvirt`)
- 
-diff --git a/docs/system/i386/tdx.rst b/docs/system/i386/tdx.rst
-new file mode 100644
-index 0000000000..8131750b64
---- /dev/null
-+++ b/docs/system/i386/tdx.rst
-@@ -0,0 +1,161 @@
-+Intel Trusted Domain eXtension (TDX)
-+====================================
-+
-+Intel Trusted Domain eXtensions (TDX) refers to an Intel technology that extends
-+Virtual Machine Extensions (VMX) and Multi-Key Total Memory Encryption (MKTME)
-+with a new kind of virtual machine guest called a Trust Domain (TD). A TD runs
-+in a CPU mode that is designed to protect the confidentiality of its memory
-+contents and its CPU state from any other software, including the hosting
-+Virtual Machine Monitor (VMM), unless explicitly shared by the TD itself.
-+
-+Prerequisites
-+-------------
-+
-+To run TD, the physical machine needs to have TDX module loaded and initialized
-+while KVM hypervisor has TDX support and has TDX enabled. If those requirements
-+are met, the ``KVM_CAP_VM_TYPES`` will report the support of ``KVM_X86_TDX_VM``.
-+
-+Trust Domain Virtual Firmware (TDVF)
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-+
-+Trust Domain Virtual Firmware (TDVF) is required to provide TD services to boot
-+TD Guest OS. TDVF needs to be copied to guest private memory and measured before
-+the TD boots.
-+
-+KVM vcpu ioctl ``KVM_TDX_INIT_MEM_REGION`` can be used to populate the TDVF
-+content into its private memory.
-+
-+Since TDX doesn't support readonly memslot, TDVF cannot be mapped as pflash
-+device and it actually works as RAM. "-bios" option is chosen to load TDVF.
-+
-+OVMF is the opensource firmware that implements the TDVF support. Thus the
-+command line to specify and load TDVF is ``-bios OVMF.fd``
-+
-+Feature Configuration
-+---------------------
-+
-+Unlike non-TDX VM, the CPU features (enumerated by CPU or MSR) of a TD are not
-+under full control of VMM. VMM can only configure part of features of a TD on
-+``KVM_TDX_INIT_VM`` command of VM scope ``MEMORY_ENCRYPT_OP`` ioctl.
-+
-+The configurable features have three types:
-+
-+- Attributes:
-+  - PKS (bit 30) controls whether Supervisor Protection Keys is exposed to TD,
-+  which determines related CPUID bit and CR4 bit;
-+  - PERFMON (bit 63) controls whether PMU is exposed to TD.
-+
-+- XSAVE related features (XFAM):
-+  XFAM is a 64b mask, which has the same format as XCR0 or IA32_XSS MSR. It
-+  determines the set of extended features available for use by the guest TD.
-+
-+- CPUID features:
-+  Only some bits of some CPUID leaves are directly configurable by VMM.
-+
-+What features can be configured is reported via TDX capabilities.
-+
-+TDX capabilities
-+~~~~~~~~~~~~~~~~
-+
-+The VM scope ``MEMORY_ENCRYPT_OP`` ioctl provides command ``KVM_TDX_CAPABILITIES``
-+to get the TDX capabilities from KVM. It returns a data structure of
-+``struct kvm_tdx_capabilities``, which tells the supported configuration of
-+attributes, XFAM and CPUIDs.
-+
-+TD attributes
-+~~~~~~~~~~~~~
-+
-+QEMU supports configuring raw 64-bit TD attributes directly via "attributes"
-+property of "tdx-guest" object. Note, it's users' responsibility to provide a
-+valid value because some bits may not supported by current QEMU or KVM yet.
-+
-+QEMU also supports the configuration of individual attribute bits that are
-+supported by it, via properties of "tdx-guest" object.
-+E.g., "sept-ve-disable" (bit 28).
-+
-+MSR based features
-+~~~~~~~~~~~~~~~~~~
-+
-+Current KVM doesn't support MSR based feature (e.g., MSR_IA32_ARCH_CAPABILITIES)
-+configuration for TDX, and it's a future work to enable it in QEMU when KVM adds
-+support of it.
-+
-+Feature check
-+~~~~~~~~~~~~~
-+
-+QEMU checks if the final (CPU) features, determined by given cpu model and
-+explicit feature adjustment of "+featureA/-featureB", can be supported or not.
-+It can produce feature not supported warning like
-+
-+  "warning: host doesn't support requested feature: CPUID.07H:EBX.intel-pt [bit 25]"
-+
-+It can also produce warning like
-+
-+  "warning: TDX forcibly sets the feature: CPUID.80000007H:EDX.invtsc [bit 8]"
-+
-+if the fixed-1 feature is requested to be disabled explicitly. This is newly
-+added to QEMU for TDX because TDX has fixed-1 features that are forcibly enabled
-+by TDX module and VMM cannot disable them.
-+
-+Launching a TD (TDX VM)
-+-----------------------
-+
-+To launch a TD, the necessary command line options are tdx-guest object and
-+split kernel-irqchip, as below:
-+
-+.. parsed-literal::
-+
-+    |qemu_system_x86| \\
-+        -accel kvm \\
-+        -cpu host \\
-+        -object tdx-guest,id=tdx0 \\
-+        -machine ...,confidential-guest-support=tdx0 \\
-+        -bios OVMF.fd \\
-+
-+Restrictions
-+------------
-+
-+ - kernel-irqchip must be split;
-+
-+   This is set by default for TDX guest if kernel-irqchip is left on its default
-+   'auto' setting.
-+
-+ - No readonly support for private memory;
-+
-+ - No SMM support: SMM support requires manipulating the guest register states
-+   which is not allowed;
-+
-+Debugging
-+---------
-+
-+Bit 0 of TD attributes, is DEBUG bit, which decides if the TD runs in off-TD
-+debug mode. When in off-TD debug mode, TD's VCPU state and private memory are
-+accessible via given SEAMCALLs. This requires KVM to expose APIs to invoke those
-+SEAMCALLs and corresonponding QEMU change.
-+
-+It's targeted as future work.
-+
-+TD attestation
-+--------------
-+
-+In TD guest, the attestation process is used to verify the TDX guest
-+trustworthiness to other entities before provisioning secrets to the guest.
-+
-+TD attestation is initiated first by calling TDG.MR.REPORT inside TD to get the
-+REPORT. Then the REPORT data needs to be converted into a remotely verifiable
-+Quote by SGX Quoting Enclave (QE).
-+
-+It's a future work in QEMU to add support of TD attestation since it lacks
-+support in current KVM.
-+
-+Live Migration
-+--------------
-+
-+Future work.
-+
-+References
-+----------
-+
-+- `TDX Homepage <https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html>`__
-+
-+- `SGX QE <https://github.com/intel/SGXDataCenterAttestationPrimitives/tree/master/QuoteGeneration>`__
-diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
-index 1b8a1f248a..4d58cdbc4e 100644
---- a/docs/system/target-i386.rst
-+++ b/docs/system/target-i386.rst
-@@ -29,6 +29,7 @@ Architectural features
-    i386/kvm-pv
-    i386/sgx
-    i386/amd-memory-encryption
-+   i386/tdx
- 
- OS requirements
- ~~~~~~~~~~~~~~~
--- 
-2.50.1
-
diff --git a/kvm-docs-devel-reset-Document-reset-expectations-for-DMA.patch b/kvm-docs-devel-reset-Document-reset-expectations-for-DMA.patch
deleted file mode 100644
index fcd1246..0000000
--- a/kvm-docs-devel-reset-Document-reset-expectations-for-DMA.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 389c3c6b4215c9be3fd784c73af0e9795e796380 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 18 Feb 2025 19:25:35 +0100
-Subject: [PATCH 5/9] docs/devel/reset: Document reset expectations for DMA and
- IOMMU
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 341: Fix vIOMMU reset order
-RH-Jira: RHEL-7188
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Donald Dutile <None>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [5/5] be8b9d9e34a2b301430dfa229c6785ab17d3fb16 (eauger1/centos-qemu-kvm)
-
-To avoid any translation faults, the IOMMUs are expected to be
-reset after the devices they protect. Document that we expect
-DMA requests to be stopped during the 'enter' or 'hold' phase
-while IOMMUs should be reset during the 'exit' phase.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Message-Id: <20250218182737.76722-6-eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit dd6d545e8f2d9a0e8a8c287ec16469f03ef5c198)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- docs/devel/reset.rst | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
-index 9746a4e8a0..24ab630465 100644
---- a/docs/devel/reset.rst
-+++ b/docs/devel/reset.rst
-@@ -123,6 +123,11 @@ The *exit* phase is executed only when the last reset operation ends. Therefore
- the object does not need to care how many of reset controllers it has and how
- many of them have started a reset.
- 
-+DMA capable devices are expected to cancel all outstanding DMA operations
-+during either 'enter' or 'hold' phases. IOMMUs are expected to reset during
-+the 'exit' phase and this sequencing makes sure no outstanding DMA request
-+will fault.
-+
- 
- Handling reset in a resettable object
- -------------------------------------
--- 
-2.48.1
-
diff --git a/kvm-docs-system-Update-documentation-for-s390x-IPL.patch b/kvm-docs-system-Update-documentation-for-s390x-IPL.patch
deleted file mode 100644
index 2b707e6..0000000
--- a/kvm-docs-system-Update-documentation-for-s390x-IPL.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 38df1fff536527bf47e190d000d8c05679f0f220 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:52 -0400
-Subject: [PATCH 19/27] docs/system: Update documentation for s390x IPL
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [19/23] feefab248336e1744eeb6bdf86e9033fe8184b3a (thuth/qemu-kvm-cs9)
-
-Update docs to show that s390x PC BIOS can support more than one boot device.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-19-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 0bd107138ff0b171e3cd314dbc200950bcab2b05)
----
- docs/system/bootindex.rst         | 7 ++++---
- docs/system/s390x/bootdevices.rst | 9 ++++++---
- 2 files changed, 10 insertions(+), 6 deletions(-)
-
-diff --git a/docs/system/bootindex.rst b/docs/system/bootindex.rst
-index 8b057f812f..988f7b3beb 100644
---- a/docs/system/bootindex.rst
-+++ b/docs/system/bootindex.rst
-@@ -49,10 +49,11 @@ Limitations
- -----------
- 
- Some firmware has limitations on which devices can be considered for
--booting.  For instance, the PC BIOS boot specification allows only one
--disk to be bootable.  If boot from disk fails for some reason, the BIOS
-+booting.  For instance, the x86 PC BIOS boot specification allows only one
-+disk to be bootable.  If boot from disk fails for some reason, the x86 BIOS
- won't retry booting from other disk.  It can still try to boot from
--floppy or net, though.
-+floppy or net, though. In the case of s390x BIOS, the BIOS will try up to
-+8 total devices, any number of which may be disks.
- 
- Sometimes, firmware cannot map the device path QEMU wants firmware to
- boot from to a boot method.  It doesn't happen for devices the firmware
-diff --git a/docs/system/s390x/bootdevices.rst b/docs/system/s390x/bootdevices.rst
-index c97efb8fc0..1a1a764c1c 100644
---- a/docs/system/s390x/bootdevices.rst
-+++ b/docs/system/s390x/bootdevices.rst
-@@ -6,9 +6,7 @@ Booting with bootindex parameter
- 
- For classical mainframe guests (i.e. LPAR or z/VM installations), you always
- have to explicitly specify the disk where you want to boot from (or "IPL" from,
--in s390x-speak -- IPL means "Initial Program Load"). In particular, there can
--also be only one boot device according to the architecture specification, thus
--specifying multiple boot devices is not possible (yet).
-+in s390x-speak -- IPL means "Initial Program Load").
- 
- So for booting an s390x guest in QEMU, you should always mark the
- device where you want to boot from with the ``bootindex`` property, for
-@@ -17,6 +15,11 @@ example::
-  qemu-system-s390x -drive if=none,id=dr1,file=guest.qcow2 \
-                    -device virtio-blk,drive=dr1,bootindex=1
- 
-+Multiple devices may have a bootindex. The lowest bootindex is assigned to the
-+device to IPL first.  If the IPL fails for the first, the device with the second
-+lowest bootindex will be tried and so on until IPL is successful or there are no
-+remaining boot devices to try.
-+
- For booting from a CD-ROM ISO image (which needs to include El-Torito boot
- information in order to be bootable), it is recommended to specify a ``scsi-cd``
- device, for example like this::
--- 
-2.39.3
-
diff --git a/kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch b/kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch
deleted file mode 100644
index 0956149..0000000
--- a/kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 5a0451f82a143dbaa0f75543a75c8e4560ac477f Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 11 Nov 2024 11:55:06 +0100
-Subject: [PATCH 03/10] docs/system/bootindex: Make it clear that s390x can
- also boot from virtio-net
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/8] 2921f4532ad7b0891dea251a4d768776170c6271 (thuth/qemu-kvm-cs9)
-
-Let's make it clear that s390x can also boot from virtio-net, to avoid
-that people think that s390x can only boot from disk devices.
-
-Reported-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
-Message-ID: <20241111105506.264640-1-thuth@redhat.com>
-Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
-Reviewed-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit b8c5fdc6588f82d95807be0eb2215d215a3ba16e)
----
- docs/system/bootindex.rst | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/docs/system/bootindex.rst b/docs/system/bootindex.rst
-index 988f7b3beb..5e1b33ee22 100644
---- a/docs/system/bootindex.rst
-+++ b/docs/system/bootindex.rst
-@@ -53,7 +53,7 @@ booting.  For instance, the x86 PC BIOS boot specification allows only one
- disk to be bootable.  If boot from disk fails for some reason, the x86 BIOS
- won't retry booting from other disk.  It can still try to boot from
- floppy or net, though. In the case of s390x BIOS, the BIOS will try up to
--8 total devices, any number of which may be disks.
-+8 total devices, any number of which may be disks or virtio-net devices.
- 
- Sometimes, firmware cannot map the device path QEMU wants firmware to
- boot from to a boot method.  It doesn't happen for devices the firmware
--- 
-2.39.3
-
diff --git a/kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch b/kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch
deleted file mode 100644
index 900b9ab..0000000
--- a/kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 255d789ab8fbc5a79236e0943a222371ceded164 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Thu, 14 Nov 2024 19:27:42 -0500
-Subject: [PATCH 02/10] docs/system/s390x/bootdevices: Update loadparm
- documentation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/8] df997bcf56bad83b5d4832dbf6c3298abd15b249 (thuth/qemu-kvm-cs9)
-
-Update documentation to include per-device loadparm support.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241115002742.3576842-1-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 0271fdc650b212533b8aeaecbedfe8ccf6bbbef3)
----
- docs/system/s390x/bootdevices.rst | 24 +++++++++++++++++++++++-
- 1 file changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/docs/system/s390x/bootdevices.rst b/docs/system/s390x/bootdevices.rst
-index 1a1a764c1c..97b3914785 100644
---- a/docs/system/s390x/bootdevices.rst
-+++ b/docs/system/s390x/bootdevices.rst
-@@ -79,7 +79,29 @@ The second way to use this parameter is to use a number in the range from 0
- to 31. The numbers that can be used here correspond to the numbers that are
- shown when using the ``PROMPT`` option, and the s390-ccw bios will then try
- to automatically boot the kernel that is associated with the given number.
--Note that ``0`` can be used to boot the default entry.
-+Note that ``0`` can be used to boot the default entry. If the machine
-+``loadparm`` is not assigned a value, then the default entry is used.
-+
-+By default, the machine ``loadparm`` applies to all boot devices. If multiple
-+devices are assigned a ``bootindex`` and the ``loadparm`` is to be different
-+between them, an independent ``loadparm`` may be assigned on a per-device basis.
-+
-+An example guest using per-device ``loadparm``::
-+
-+  qemu-system-s390x -drive if=none,id=dr1,file=primary.qcow2 \
-+                   -device virtio-blk,drive=dr1,bootindex=1 \
-+                   -drive if=none,id=dr2,file=secondary.qcow2 \
-+                   -device virtio-blk,drive=dr2,bootindex=2,loadparm=3
-+
-+In this case, the primary boot device will attempt to IPL using the default
-+entry (because no ``loadparm`` is specified for this device or for the
-+machine). If that device fails to boot, the secondary device will attempt to
-+IPL using entry number 3.
-+
-+If a ``loadparm`` is specified on both the machine and a device, the per-device
-+value will superseded the machine value.  Per-device ``loadparm`` values are
-+only used for devices with an assigned ``bootindex``. The machine ``loadparm``
-+is used when attempting to boot without a ``bootindex``.
- 
- 
- Booting from a network device
--- 
-2.39.3
-
diff --git a/kvm-docs-system-s390x-bootdevices-Update-the-documentati.patch b/kvm-docs-system-s390x-bootdevices-Update-the-documentati.patch
deleted file mode 100644
index fdc7d4b..0000000
--- a/kvm-docs-system-s390x-bootdevices-Update-the-documentati.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 63c705bdd8d8f17860988d22aa29a238e9fae631 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:40 -0400
-Subject: [PATCH 07/27] docs/system/s390x/bootdevices: Update the documentation
- about network booting
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/23] 31b1f484e98304c385adbefb6eb50b501d179268 (thuth/qemu-kvm-cs9)
-
-Remove the information about the separate s390-netboot.img from
-the documentation.
-
-Co-authored by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20241020012953.1380075-7-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit ab2691b6c7ff360875e0af86ff463278f17786f5)
----
- docs/system/s390x/bootdevices.rst | 20 +++++++-------------
- 1 file changed, 7 insertions(+), 13 deletions(-)
-
-diff --git a/docs/system/s390x/bootdevices.rst b/docs/system/s390x/bootdevices.rst
-index 1a7a18b43b..c97efb8fc0 100644
---- a/docs/system/s390x/bootdevices.rst
-+++ b/docs/system/s390x/bootdevices.rst
-@@ -82,23 +82,17 @@ Note that ``0`` can be used to boot the default entry.
- Booting from a network device
- -----------------------------
- 
--Beside the normal guest firmware (which is loaded from the file ``s390-ccw.img``
--in the data directory of QEMU, or via the ``-bios`` option), QEMU ships with
--a small TFTP network bootloader firmware for virtio-net-ccw devices, too. This
--firmware is loaded from a file called ``s390-netboot.img`` in the QEMU data
--directory. In case you want to load it from a different filename instead,
--you can specify it via the ``-global s390-ipl.netboot_fw=filename``
--command line option.
--
--The ``bootindex`` property is especially important for booting via the network.
--If you don't specify the ``bootindex`` property here, the network bootloader
--firmware code won't get loaded into the guest memory so that the network boot
--will fail. For a successful network boot, try something like this::
-+The firmware that ships with QEMU includes a small TFTP network bootloader
-+for virtio-net-ccw devices.  The ``bootindex`` property is especially
-+important for booting via the network. If you don't specify the ``bootindex``
-+property here, the network bootloader won't be taken into consideration and
-+the network boot will fail. For a successful network boot, try something
-+like this::
- 
-  qemu-system-s390x -netdev user,id=n1,tftp=...,bootfile=... \
-                    -device virtio-net-ccw,netdev=n1,bootindex=1
- 
--The network bootloader firmware also has basic support for pxelinux.cfg-style
-+The network bootloader also has basic support for pxelinux.cfg-style
- configuration files. See the `PXELINUX Configuration page
- <https://wiki.syslinux.org/wiki/index.php?title=PXELINUX#Configuration>`__
- for details how to set up the configuration file on your TFTP server.
--- 
-2.39.3
-
diff --git a/kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch b/kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch
deleted file mode 100644
index 08287d4..0000000
--- a/kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From d565fe385b3c45a41fa8e25942220aff38a04fc3 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 29 Apr 2025 17:05:41 +0200
-Subject: [PATCH 2/3] file-posix: Define DM_MPATH_PROBE_PATHS
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 372: file-posix: Fix multipath failover with SCSI passthrough [9.7]
-RH-Jira: RHEL-95408
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/2] 7615906833a6bb2b4645fa5cd60d78aa9631cb7c (kmwolf/centos-qemu-kvm)
-
-While the kernel side isn't merged yet and we're still using old kernel
-headers, just define DM_MPATH_PROBE_PATHS manually.
-
-This is a downstream-only patch that can be removed after the next minor
-release.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/file-posix.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 0cb4e922c0..6a5c506549 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -134,6 +134,11 @@
- #define RAW_LOCK_PERM_BASE             100
- #define RAW_LOCK_SHARED_BASE           200
- 
-+/* TODO Remove this when the kernel side is merged */
-+#if !defined(DM_MPATH_PROBE_PATHS) && defined(DM_GET_TARGET_VERSION)
-+#define DM_MPATH_PROBE_PATHS _IO(DM_IOCTL, DM_GET_TARGET_VERSION_CMD + 1)
-+#endif
-+
- typedef struct BDRVRawState {
-     int fd;
-     bool use_lock;
--- 
-2.48.1
-
diff --git a/kvm-file-posix-Fix-crash-on-discard_granularity-0.patch b/kvm-file-posix-Fix-crash-on-discard_granularity-0.patch
deleted file mode 100644
index 8a45dcc..0000000
--- a/kvm-file-posix-Fix-crash-on-discard_granularity-0.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 3515c6541f71817727a3a8b18ec5252644b51bc0 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 29 Apr 2025 17:56:54 +0200
-Subject: [PATCH 5/5] file-posix: Fix crash on discard_granularity == 0
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 355: file-posix: probe discard alignment on Linux block devices
-RH-Jira: RHEL-86032
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Commit: [3/3] b8139a4c5b19efff1f15c314447a6abb89db0ae7 (stefanha/centos-stream-qemu-kvm)
-
-Block devices that don't support discard have a discard_granularity of
-0. Currently, this results in a division by zero when we try to make
-sure that it's a multiple of request_alignment. Only try to update
-bs->bl.pdiscard_alignment when we got a non-zero discard_granularity
-from sysfs.
-
-Fixes: f605796aae4 ('file-posix: probe discard alignment on Linux block devices')
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250429155654.102735-1-kwolf@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 71a30d54e6ab1d5c102a8bee2c263414697402ea)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/file-posix.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 3d5b024459..0cb4e922c0 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -1565,7 +1565,7 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
-         int ret;
- 
-         ret = hdev_get_pdiscard_alignment(&st, &dalign);
--        if (ret == 0) {
-+        if (ret == 0 && dalign != 0) {
-             uint32_t ralign = bs->bl.request_alignment;
- 
-             /* Probably never happens, but handle it just in case */
--- 
-2.48.1
-
diff --git a/kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch b/kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch
deleted file mode 100644
index bd716a1..0000000
--- a/kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-From 95c651ba1177bd88dbd9b52fe2ec8fedadcdb5c8 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 22 May 2025 15:08:03 +0200
-Subject: [PATCH 3/3] file-posix: Probe paths and retry SG_IO on potential path
- errors
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 372: file-posix: Fix multipath failover with SCSI passthrough [9.7]
-RH-Jira: RHEL-95408
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/2] 4312e9ec609e511afdfb6634e1d2370032d41543 (kmwolf/centos-qemu-kvm)
-
-When scsi-block is used on a host multipath device, it runs into the
-problem that the kernel dm-mpath doesn't know anything about SCSI or
-SG_IO and therefore can't decide if a SG_IO request returned an error
-and needs to be retried on a different path. Instead of getting working
-failover, an error is returned to scsi-block and handled according to
-the configured error policy. Obviously, this is not what users want,
-they want working failover.
-
-QEMU can parse the SG_IO result and determine whether this could have
-been a path error, but just retrying the same request could just send it
-to the same failing path again and result in the same error.
-
-With a kernel that supports the DM_MPATH_PROBE_PATHS ioctl on dm-mpath
-block devices (queued in the device mapper tree for Linux 6.16), we can
-tell the kernel to probe all paths and tell us if any usable paths
-remained. If so, we can now retry the SG_IO ioctl and expect it to be
-sent to a working path.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20250522130803.34738-1-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit bf627788ef17721955bfcfba84209a07ae5f54ea)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/file-posix.c | 115 ++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 114 insertions(+), 1 deletion(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 6a5c506549..f17a3f4d10 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -41,6 +41,7 @@
- 
- #include "scsi/pr-manager.h"
- #include "scsi/constants.h"
-+#include "scsi/utils.h"
- 
- #if defined(__APPLE__) && (__MACH__)
- #include <sys/ioctl.h>
-@@ -72,6 +73,7 @@
- #include <linux/blkzoned.h>
- #endif
- #include <linux/cdrom.h>
-+#include <linux/dm-ioctl.h>
- #include <linux/fd.h>
- #include <linux/fs.h>
- #include <linux/hdreg.h>
-@@ -139,6 +141,22 @@
- #define DM_MPATH_PROBE_PATHS _IO(DM_IOCTL, DM_GET_TARGET_VERSION_CMD + 1)
- #endif
- 
-+/*
-+ * Multiple retries are mostly meant for two separate scenarios:
-+ *
-+ * - DM_MPATH_PROBE_PATHS returns success, but before SG_IO completes, another
-+ *   path goes down.
-+ *
-+ * - DM_MPATH_PROBE_PATHS failed all paths in the current path group, so we have
-+ *   to send another SG_IO to switch to another path group to probe the paths in
-+ *   it.
-+ *
-+ * Even if each path is in a separate path group (path_grouping_policy set to
-+ * failover), it's rare to have more than eight path groups - and even then
-+ * pretty unlikely that only bad path groups would be chosen in eight retries.
-+ */
-+#define SG_IO_MAX_RETRIES 8
-+
- typedef struct BDRVRawState {
-     int fd;
-     bool use_lock;
-@@ -166,6 +184,7 @@ typedef struct BDRVRawState {
-     bool use_linux_aio:1;
-     bool has_laio_fdsync:1;
-     bool use_linux_io_uring:1;
-+    bool use_mpath:1;
-     int page_cache_inconsistent; /* errno from fdatasync failure */
-     bool has_fallocate;
-     bool needs_alignment;
-@@ -4248,15 +4267,105 @@ hdev_open_Mac_error:
-     /* Since this does ioctl the device must be already opened */
-     bs->sg = hdev_is_sg(bs);
- 
-+    /* sg devices aren't even block devices and can't use dm-mpath */
-+    s->use_mpath = !bs->sg;
-+
-     return ret;
- }
- 
- #if defined(__linux__)
-+#if defined(DM_MPATH_PROBE_PATHS)
-+static bool coroutine_fn sgio_path_error(int ret, sg_io_hdr_t *io_hdr)
-+{
-+    if (ret < 0) {
-+        switch (ret) {
-+        case -ENODEV:
-+            return true;
-+        case -EAGAIN:
-+            /*
-+             * The device is probably suspended. This happens while the dm table
-+             * is reloaded, e.g. because a path is added or removed. This is an
-+             * operation that should complete within 1ms, so just wait a bit and
-+             * retry.
-+             *
-+             * If the device was suspended for another reason, we'll wait and
-+             * retry SG_IO_MAX_RETRIES times. This is a tolerable delay before
-+             * we return an error and potentially stop the VM.
-+             */
-+            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
-+            return true;
-+        default:
-+            return false;
-+        }
-+    }
-+
-+    if (io_hdr->host_status != SCSI_HOST_OK) {
-+        return true;
-+    }
-+
-+    switch (io_hdr->status) {
-+    case GOOD:
-+    case CONDITION_GOOD:
-+    case INTERMEDIATE_GOOD:
-+    case INTERMEDIATE_C_GOOD:
-+    case RESERVATION_CONFLICT:
-+    case COMMAND_TERMINATED:
-+        return false;
-+    case CHECK_CONDITION:
-+        return !scsi_sense_buf_is_guest_recoverable(io_hdr->sbp,
-+                                                    io_hdr->mx_sb_len);
-+    default:
-+        return true;
-+    }
-+}
-+
-+static bool coroutine_fn hdev_co_ioctl_sgio_retry(RawPosixAIOData *acb, int ret)
-+{
-+    BDRVRawState *s = acb->bs->opaque;
-+    RawPosixAIOData probe_acb;
-+
-+    if (!s->use_mpath) {
-+        return false;
-+    }
-+
-+    if (!sgio_path_error(ret, acb->ioctl.buf)) {
-+        return false;
-+    }
-+
-+    probe_acb = (RawPosixAIOData) {
-+        .bs         = acb->bs,
-+        .aio_type   = QEMU_AIO_IOCTL,
-+        .aio_fildes = s->fd,
-+        .aio_offset = 0,
-+        .ioctl      = {
-+            .buf        = NULL,
-+            .cmd        = DM_MPATH_PROBE_PATHS,
-+        },
-+    };
-+
-+    ret = raw_thread_pool_submit(handle_aiocb_ioctl, &probe_acb);
-+    if (ret == -ENOTTY) {
-+        s->use_mpath = false;
-+    } else if (ret == -EAGAIN) {
-+        /* The device might be suspended for a table reload, worth retrying */
-+        return true;
-+    }
-+
-+    return ret == 0;
-+}
-+#else
-+static bool coroutine_fn hdev_co_ioctl_sgio_retry(RawPosixAIOData *acb, int ret)
-+{
-+    return false;
-+}
-+#endif /* DM_MPATH_PROBE_PATHS */
-+
- static int coroutine_fn
- hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
- {
-     BDRVRawState *s = bs->opaque;
-     RawPosixAIOData acb;
-+    int retries = SG_IO_MAX_RETRIES;
-     int ret;
- 
-     ret = fd_open(bs);
-@@ -4284,7 +4393,11 @@ hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
-         },
-     };
- 
--    return raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
-+    do {
-+        ret = raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
-+    } while (req == SG_IO && retries-- && hdev_co_ioctl_sgio_retry(&acb, ret));
-+
-+    return ret;
- }
- #endif /* linux */
- 
--- 
-2.48.1
-
diff --git a/kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch b/kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch
deleted file mode 100644
index 4b0d130..0000000
--- a/kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 39e0c370357a414abacd64fb6a172e7b25eb4d82 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:19 -0500
-Subject: [PATCH 04/16] file-posix, gluster: Handle zero block status hint
- better
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [2/14] 1f7b47ce5f5fb321aee41a16accf5bce3d1bfe95 (ebblake/centos-qemu-kvm)
-
-Although the previous patch to change 'bool want_zero' into a bitmask
-made no semantic change, it is now time to differentiate.  When the
-caller specifically wants to know what parts of the file read as zero,
-we need to use lseek and actually reporting holes, rather than
-short-circuiting and advertising full allocation.
-
-This change will be utilized in later patches to let mirroring
-optimize for the case when the destination already reads as zeroes.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-17-eblake@redhat.com>
-(cherry picked from commit a6a0a7fb0e327d17594c971b4a39de14e025b415)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/file-posix.c | 3 ++-
- block/gluster.c    | 2 +-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 9ca55620ca..ce5da2b4c2 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -3293,7 +3293,8 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
-         return ret;
-     }
- 
--    if (mode != BDRV_WANT_PRECISE) {
-+    if (!(mode & BDRV_WANT_ZERO)) {
-+        /* There is no backing file - all bytes are allocated in this file.  */
-         *pnum = bytes;
-         *map = offset;
-         *file = bs;
-diff --git a/block/gluster.c b/block/gluster.c
-index ae5c45666b..175c70164c 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -1483,7 +1483,7 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
-         return ret;
-     }
- 
--    if (mode != BDRV_WANT_PRECISE) {
-+    if (!(mode & BDRV_WANT_ZERO)) {
-         *pnum = bytes;
-         *map = offset;
-         *file = bs;
--- 
-2.48.1
-
diff --git a/kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch b/kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch
deleted file mode 100644
index 7d60479..0000000
--- a/kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From 29ae77d77cabc3582267cb8a7c4fe10d279a21e6 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 17 Apr 2025 11:05:27 -0400
-Subject: [PATCH 3/5] file-posix: probe discard alignment on Linux block
- devices
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 355: file-posix: probe discard alignment on Linux block devices
-RH-Jira: RHEL-86032
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Commit: [1/3] bb3c17b0da6edeb209874e97d4e2c3b1762a1749 (stefanha/centos-stream-qemu-kvm)
-
-Populate the pdiscard_alignment block limit so the block layer is able
-align discard requests correctly.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250417150528.76470-2-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit f605796aae42885034400c83ed6a9b07cd6d6481)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/file-posix.c | 67 +++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 66 insertions(+), 1 deletion(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index ff928b5e85..3d5b024459 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -1268,10 +1268,10 @@ static int get_sysfs_zoned_model(struct stat *st, BlockZoneModel *zoned)
- }
- #endif /* defined(CONFIG_BLKZONED) */
- 
-+#ifdef CONFIG_LINUX
- /*
-  * Get a sysfs attribute value as a long integer.
-  */
--#ifdef CONFIG_LINUX
- static long get_sysfs_long_val(struct stat *st, const char *attribute)
- {
-     g_autofree char *str = NULL;
-@@ -1291,6 +1291,30 @@ static long get_sysfs_long_val(struct stat *st, const char *attribute)
-     }
-     return ret;
- }
-+
-+/*
-+ * Get a sysfs attribute value as a uint32_t.
-+ */
-+static int get_sysfs_u32_val(struct stat *st, const char *attribute,
-+                             uint32_t *u32)
-+{
-+    g_autofree char *str = NULL;
-+    const char *end;
-+    unsigned int val;
-+    int ret;
-+
-+    ret = get_sysfs_str_val(st, attribute, &str);
-+    if (ret < 0) {
-+        return ret;
-+    }
-+
-+    /* The file is ended with '\n', pass 'end' to accept that. */
-+    ret = qemu_strtoui(str, &end, 10, &val);
-+    if (ret == 0 && end && *end == '\0') {
-+        *u32 = val;
-+    }
-+    return ret;
-+}
- #endif
- 
- static int hdev_get_max_segments(int fd, struct stat *st)
-@@ -1310,6 +1334,23 @@ static int hdev_get_max_segments(int fd, struct stat *st)
- #endif
- }
- 
-+/*
-+ * Fills in *dalign with the discard alignment and returns 0 on success,
-+ * -errno otherwise.
-+ */
-+static int hdev_get_pdiscard_alignment(struct stat *st, uint32_t *dalign)
-+{
-+#ifdef CONFIG_LINUX
-+    /*
-+     * Note that Linux "discard_granularity" is QEMU "discard_alignment". Linux
-+     * "discard_alignment" is something else.
-+     */
-+    return get_sysfs_u32_val(st, "discard_granularity", dalign);
-+#else
-+    return -ENOTSUP;
-+#endif
-+}
-+
- #if defined(CONFIG_BLKZONED)
- /*
-  * If the reset_all flag is true, then the wps of zone whose state is
-@@ -1519,6 +1560,30 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
-         }
-     }
- 
-+    if (S_ISBLK(st.st_mode)) {
-+        uint32_t dalign = 0;
-+        int ret;
-+
-+        ret = hdev_get_pdiscard_alignment(&st, &dalign);
-+        if (ret == 0) {
-+            uint32_t ralign = bs->bl.request_alignment;
-+
-+            /* Probably never happens, but handle it just in case */
-+            if (dalign < ralign && (ralign % dalign == 0)) {
-+                dalign = ralign;
-+            }
-+
-+            /* The block layer requires a multiple of request_alignment */
-+            if (dalign % ralign != 0) {
-+                error_setg(errp, "Invalid pdiscard_alignment limit %u is not a "
-+                        "multiple of request_alignment %u", dalign, ralign);
-+                return;
-+            }
-+
-+            bs->bl.pdiscard_alignment = dalign;
-+        }
-+    }
-+
-     raw_refresh_zoned_limits(bs, &st, errp);
- }
- 
--- 
-2.48.1
-
diff --git a/kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch b/kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch
deleted file mode 100644
index e983ea3..0000000
--- a/kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From 43245dc5a297d6c4097a0191af4f818e416a3f45 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 051/115] headers: Add definitions from UEFI spec for volumes,
- resources, etc...
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [51/115] c44f8b832aa268a5b2d3e98a8ce6bfbda7e1c684 (bonzini/rhel-qemu-kvm)
-
-Add UEFI definitions for literals, enums, structs, GUIDs, etc... that
-will be used by TDX to build the UEFI Hand-Off Block (HOB) that is passed
-to the Trusted Domain Virtual Firmware (TDVF).
-
-All values come from the UEFI specification [1], PI spec [2] and TDVF
-design guide[3].
-
-[1] UEFI Specification v2.1.0 https://uefi.org/sites/default/files/resources/UEFI_Spec_2_10_Aug29.pdf
-[2] UEFI PI spec v1.8 https://uefi.org/sites/default/files/resources/UEFI_PI_Spec_1_8_March3.pdf
-[3] https://software.intel.com/content/dam/develop/external/us/en/documents/tdx-virtual-firmware-design-guide-rev-1.pdf
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-23-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 88aa6576e4ab40b538f543852128cb17fce37f87)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/standard-headers/uefi/uefi.h | 187 +++++++++++++++++++++++++++
- 1 file changed, 187 insertions(+)
- create mode 100644 include/standard-headers/uefi/uefi.h
-
-diff --git a/include/standard-headers/uefi/uefi.h b/include/standard-headers/uefi/uefi.h
-new file mode 100644
-index 0000000000..5256349ec0
---- /dev/null
-+++ b/include/standard-headers/uefi/uefi.h
-@@ -0,0 +1,187 @@
-+/*
-+ * Copyright (C) 2025 Intel Corporation
-+ *
-+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
-+ *                        <isaku.yamahata at intel.com>
-+ *         Xiaoyao Li <xiaoyao.li@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef HW_I386_UEFI_H
-+#define HW_I386_UEFI_H
-+
-+/***************************************************************************/
-+/*
-+ * basic EFI definitions
-+ * supplemented with UEFI Specification Version 2.8 (Errata A)
-+ * released February 2020
-+ */
-+/* UEFI integer is little endian */
-+
-+typedef struct {
-+    uint32_t Data1;
-+    uint16_t Data2;
-+    uint16_t Data3;
-+    uint8_t Data4[8];
-+} EFI_GUID;
-+
-+typedef enum {
-+    EfiReservedMemoryType,
-+    EfiLoaderCode,
-+    EfiLoaderData,
-+    EfiBootServicesCode,
-+    EfiBootServicesData,
-+    EfiRuntimeServicesCode,
-+    EfiRuntimeServicesData,
-+    EfiConventionalMemory,
-+    EfiUnusableMemory,
-+    EfiACPIReclaimMemory,
-+    EfiACPIMemoryNVS,
-+    EfiMemoryMappedIO,
-+    EfiMemoryMappedIOPortSpace,
-+    EfiPalCode,
-+    EfiPersistentMemory,
-+    EfiUnacceptedMemoryType,
-+    EfiMaxMemoryType
-+} EFI_MEMORY_TYPE;
-+
-+#define EFI_HOB_HANDOFF_TABLE_VERSION 0x0009
-+
-+#define EFI_HOB_TYPE_HANDOFF              0x0001
-+#define EFI_HOB_TYPE_MEMORY_ALLOCATION    0x0002
-+#define EFI_HOB_TYPE_RESOURCE_DESCRIPTOR  0x0003
-+#define EFI_HOB_TYPE_GUID_EXTENSION       0x0004
-+#define EFI_HOB_TYPE_FV                   0x0005
-+#define EFI_HOB_TYPE_CPU                  0x0006
-+#define EFI_HOB_TYPE_MEMORY_POOL          0x0007
-+#define EFI_HOB_TYPE_FV2                  0x0009
-+#define EFI_HOB_TYPE_LOAD_PEIM_UNUSED     0x000A
-+#define EFI_HOB_TYPE_UEFI_CAPSULE         0x000B
-+#define EFI_HOB_TYPE_FV3                  0x000C
-+#define EFI_HOB_TYPE_UNUSED               0xFFFE
-+#define EFI_HOB_TYPE_END_OF_HOB_LIST      0xFFFF
-+
-+typedef struct {
-+    uint16_t HobType;
-+    uint16_t HobLength;
-+    uint32_t Reserved;
-+} EFI_HOB_GENERIC_HEADER;
-+
-+typedef uint64_t EFI_PHYSICAL_ADDRESS;
-+typedef uint32_t EFI_BOOT_MODE;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    uint32_t Version;
-+    EFI_BOOT_MODE BootMode;
-+    EFI_PHYSICAL_ADDRESS EfiMemoryTop;
-+    EFI_PHYSICAL_ADDRESS EfiMemoryBottom;
-+    EFI_PHYSICAL_ADDRESS EfiFreeMemoryTop;
-+    EFI_PHYSICAL_ADDRESS EfiFreeMemoryBottom;
-+    EFI_PHYSICAL_ADDRESS EfiEndOfHobList;
-+} EFI_HOB_HANDOFF_INFO_TABLE;
-+
-+#define EFI_RESOURCE_SYSTEM_MEMORY          0x00000000
-+#define EFI_RESOURCE_MEMORY_MAPPED_IO       0x00000001
-+#define EFI_RESOURCE_IO                     0x00000002
-+#define EFI_RESOURCE_FIRMWARE_DEVICE        0x00000003
-+#define EFI_RESOURCE_MEMORY_MAPPED_IO_PORT  0x00000004
-+#define EFI_RESOURCE_MEMORY_RESERVED        0x00000005
-+#define EFI_RESOURCE_IO_RESERVED            0x00000006
-+#define EFI_RESOURCE_MEMORY_UNACCEPTED      0x00000007
-+#define EFI_RESOURCE_MAX_MEMORY_TYPE        0x00000008
-+
-+#define EFI_RESOURCE_ATTRIBUTE_PRESENT                  0x00000001
-+#define EFI_RESOURCE_ATTRIBUTE_INITIALIZED              0x00000002
-+#define EFI_RESOURCE_ATTRIBUTE_TESTED                   0x00000004
-+#define EFI_RESOURCE_ATTRIBUTE_SINGLE_BIT_ECC           0x00000008
-+#define EFI_RESOURCE_ATTRIBUTE_MULTIPLE_BIT_ECC         0x00000010
-+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_1           0x00000020
-+#define EFI_RESOURCE_ATTRIBUTE_ECC_RESERVED_2           0x00000040
-+#define EFI_RESOURCE_ATTRIBUTE_READ_PROTECTED           0x00000080
-+#define EFI_RESOURCE_ATTRIBUTE_WRITE_PROTECTED          0x00000100
-+#define EFI_RESOURCE_ATTRIBUTE_EXECUTION_PROTECTED      0x00000200
-+#define EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE              0x00000400
-+#define EFI_RESOURCE_ATTRIBUTE_WRITE_COMBINEABLE        0x00000800
-+#define EFI_RESOURCE_ATTRIBUTE_WRITE_THROUGH_CACHEABLE  0x00001000
-+#define EFI_RESOURCE_ATTRIBUTE_WRITE_BACK_CACHEABLE     0x00002000
-+#define EFI_RESOURCE_ATTRIBUTE_16_BIT_IO                0x00004000
-+#define EFI_RESOURCE_ATTRIBUTE_32_BIT_IO                0x00008000
-+#define EFI_RESOURCE_ATTRIBUTE_64_BIT_IO                0x00010000
-+#define EFI_RESOURCE_ATTRIBUTE_UNCACHED_EXPORTED        0x00020000
-+#define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTED      0x00040000
-+#define EFI_RESOURCE_ATTRIBUTE_READ_ONLY_PROTECTABLE    0x00080000
-+#define EFI_RESOURCE_ATTRIBUTE_READ_PROTECTABLE         0x00100000
-+#define EFI_RESOURCE_ATTRIBUTE_WRITE_PROTECTABLE        0x00200000
-+#define EFI_RESOURCE_ATTRIBUTE_EXECUTION_PROTECTABLE    0x00400000
-+#define EFI_RESOURCE_ATTRIBUTE_PERSISTENT               0x00800000
-+#define EFI_RESOURCE_ATTRIBUTE_PERSISTABLE              0x01000000
-+#define EFI_RESOURCE_ATTRIBUTE_MORE_RELIABLE            0x02000000
-+
-+typedef uint32_t EFI_RESOURCE_TYPE;
-+typedef uint32_t EFI_RESOURCE_ATTRIBUTE_TYPE;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    EFI_GUID Owner;
-+    EFI_RESOURCE_TYPE ResourceType;
-+    EFI_RESOURCE_ATTRIBUTE_TYPE ResourceAttribute;
-+    EFI_PHYSICAL_ADDRESS PhysicalStart;
-+    uint64_t ResourceLength;
-+} EFI_HOB_RESOURCE_DESCRIPTOR;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    EFI_GUID Name;
-+
-+    /* guid specific data follows */
-+} EFI_HOB_GUID_TYPE;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    EFI_PHYSICAL_ADDRESS BaseAddress;
-+    uint64_t Length;
-+} EFI_HOB_FIRMWARE_VOLUME;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    EFI_PHYSICAL_ADDRESS BaseAddress;
-+    uint64_t Length;
-+    EFI_GUID FvName;
-+    EFI_GUID FileName;
-+} EFI_HOB_FIRMWARE_VOLUME2;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    EFI_PHYSICAL_ADDRESS BaseAddress;
-+    uint64_t Length;
-+    uint32_t AuthenticationStatus;
-+    bool ExtractedFv;
-+    EFI_GUID FvName;
-+    EFI_GUID FileName;
-+} EFI_HOB_FIRMWARE_VOLUME3;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+    uint8_t SizeOfMemorySpace;
-+    uint8_t SizeOfIoSpace;
-+    uint8_t Reserved[6];
-+} EFI_HOB_CPU;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+} EFI_HOB_MEMORY_POOL;
-+
-+typedef struct {
-+    EFI_HOB_GENERIC_HEADER Header;
-+
-+    EFI_PHYSICAL_ADDRESS BaseAddress;
-+    uint64_t Length;
-+} EFI_HOB_UEFI_CAPSULE;
-+
-+#define EFI_HOB_OWNER_ZERO                                      \
-+    ((EFI_GUID){ 0x00000000, 0x0000, 0x0000,                    \
-+        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } })
-+
-+#endif
--- 
-2.50.1
-
diff --git a/kvm-hostmem-Apply-merge-property-after-the-memory-region.patch b/kvm-hostmem-Apply-merge-property-after-the-memory-region.patch
deleted file mode 100644
index 70e6bcc..0000000
--- a/kvm-hostmem-Apply-merge-property-after-the-memory-region.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 34266f76ec5c96aceee89d1dd25c338af81f99dc Mon Sep 17 00:00:00 2001
-From: Gavin Shan <gshan@redhat.com>
-Date: Wed, 20 Nov 2024 17:13:44 +1000
-Subject: [PATCH 2/2] hostmem: Apply merge property after the memory region is
- initialized
-
-RH-Author: Gavin Shan <gshan@redhat.com>
-RH-MergeRequest: 296: hostmem: Apply merge property after the memory region is initialized
-RH-Jira: RHEL-68289
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [1/1] fc01302c3299a15fd523247e5a3df0957becba6a (gwshan/qemu-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-68289
-
-The semantic change has been introduced by commit 5becdc0ab0 ("hostmem:
-simplify the code for merge and dump properties") even it clarifies that
-no senmatic change has been introduced. After the commit, the merge
-property can be applied even the corresponding memory region isn't
-initialized yet. This leads to crash dump by the following command
-lines.
-
-  # /home/gavin/sandbox/qemu.main/build/qemu-system-aarch64  \
-    -accel kvm  -machine virt -cpu host                      \
-    -object memory-backend-ram,id=mem-memN0,size=4096M,merge=off
-    :
-    qemu-system-aarch64: ../system/memory.c:2419: memory_region_get_ram_ptr: \
-    Assertion `mr->ram_block' failed.
-
-Fix it by applying the merge property only when the memory region is
-initialized.
-
-Message-ID: <20240915233117.478169-1-gshan@redhat.com>
-Fixes: 5becdc0ab083 ("hostmem: simplify the code for merge and dump properties")
-Reported-by: Zhenyu Zhang <zhenyzha@redhat.com>
-Tested-by: Zhenyu Zhang <zhenyzha@redhat.com>
-Signed-off-by: Gavin Shan <gshan@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 78c8f780d3f0d6d17aa93d6f99ff72960080fdd7)
-Signed-off-by: Gavin Shan <gshan@redhat.com>
----
- backends/hostmem.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/backends/hostmem.c b/backends/hostmem.c
-index 4e5576a4ad..181446626a 100644
---- a/backends/hostmem.c
-+++ b/backends/hostmem.c
-@@ -178,7 +178,7 @@ static void host_memory_backend_set_merge(Object *obj, bool value, Error **errp)
-         return;
-     }
- 
--    if (!host_memory_backend_mr_inited(backend) &&
-+    if (host_memory_backend_mr_inited(backend) &&
-         value != backend->merge) {
-         void *ptr = memory_region_get_ram_ptr(&backend->mr);
-         uint64_t sz = memory_region_size(&backend->mr);
--- 
-2.45.1
-
diff --git a/kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch b/kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch
deleted file mode 100644
index 14fe2f0..0000000
--- a/kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch
+++ /dev/null
@@ -1,221 +0,0 @@
-From 7aa02e169dde52b4a7f6ec832a3fe55027fbd5e2 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Fri, 15 Nov 2024 15:12:02 +0100
-Subject: [PATCH 05/10] hw: Add "loadparm" property to scsi disk devices for
- booting on s390x
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/8] 7e3444e1fda776ca3b6de246b2dd696edf4980dd (thuth/qemu-kvm-cs9)
-
-While adding the new flexible boot order feature on s390x recently,
-we missed to add the "loadparm" property to the scsi-hd and scsi-cd
-devices. This property is required on s390x to pass the information
-to the boot loader about which kernel should be started or whether
-the boot menu should be shown. But even more serious: The missing
-property is now causing trouble with the corresponding libvirt patches
-that assume that the "loadparm" property is either settable for all
-bootable devices (when the "boot order" feature is implemented in
-QEMU), or none (meaning the behaviour of older QEMUs that only allowed
-one "loadparm" at the machine level). To fix this broken situation,
-let's implement the "loadparm" property in for the SCSI devices, too.
-
-Message-ID: <20241115141202.1877294-1-thuth@redhat.com>
-Acked-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 429442e52d94f890fa194a151e8cd649b04e9e63)
----
- hw/core/qdev-properties-system.c    | 26 +++++++++++++++++
- hw/s390x/ipl.c                      | 19 ++++---------
- hw/scsi/scsi-disk.c                 | 43 +++++++++++++++++++++++++++++
- include/hw/qdev-properties-system.h |  3 ++
- 4 files changed, 78 insertions(+), 13 deletions(-)
-
-diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
-index f13350b4fb..5cd527cdba 100644
---- a/hw/core/qdev-properties-system.c
-+++ b/hw/core/qdev-properties-system.c
-@@ -58,6 +58,32 @@ static bool check_prop_still_unset(Object *obj, const char *name,
-     return false;
- }
- 
-+bool qdev_prop_sanitize_s390x_loadparm(uint8_t *loadparm, const char *str,
-+                                       Error **errp)
-+{
-+    int i, len;
-+
-+    len = strlen(str);
-+    if (len > 8) {
-+        error_setg(errp, "'loadparm' can only contain up to 8 characters");
-+        return false;
-+    }
-+
-+    for (i = 0; i < len; i++) {
-+        uint8_t c = qemu_toupper(str[i]); /* mimic HMC */
-+
-+        if (qemu_isalnum(c) || c == '.' || c == ' ') {
-+            loadparm[i] = c;
-+        } else {
-+            error_setg(errp,
-+                       "invalid character in 'loadparm': '%c' (ASCII 0x%02x)",
-+                       c, c);
-+            return false;
-+        }
-+    }
-+
-+    return true;
-+}
- 
- /* --- drive --- */
- 
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index 5fbd43c346..8101825dfe 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -418,21 +418,9 @@ static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain)
- 
- void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp)
- {
--    int i;
--
-     /* Initialize the loadparm with spaces */
-     memset(loadparm, ' ', LOADPARM_LEN);
--    for (i = 0; i < LOADPARM_LEN && str[i]; i++) {
--        uint8_t c = qemu_toupper(str[i]); /* mimic HMC */
--
--        if (qemu_isalnum(c) || c == '.' || c == ' ') {
--            loadparm[i] = c;
--        } else {
--            error_setg(errp, "LOADPARM: invalid character '%c' (ASCII 0x%02x)",
--                       c, c);
--            return;
--        }
--    }
-+    qdev_prop_sanitize_s390x_loadparm(loadparm, str, errp);
- }
- 
- void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp)
-@@ -452,6 +440,7 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
-     SCSIDevice *sd;
-     int devtype;
-     uint8_t *lp;
-+    g_autofree void *scsi_lp = NULL;
- 
-     /*
-      * Currently allow IPL only from CCW devices.
-@@ -463,6 +452,10 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
-         switch (devtype) {
-         case CCW_DEVTYPE_SCSI:
-             sd = SCSI_DEVICE(dev_st);
-+            scsi_lp = object_property_get_str(OBJECT(sd), "loadparm", NULL);
-+            if (scsi_lp && strlen(scsi_lp) > 0) {
-+                lp = scsi_lp;
-+            }
-             iplb->len = cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN);
-             iplb->blk0_len =
-                 cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN - S390_IPLB_HEADER_LEN);
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 4d94b2b816..7566a5f531 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -32,6 +32,7 @@
- #include "migration/vmstate.h"
- #include "hw/scsi/emulation.h"
- #include "scsi/constants.h"
-+#include "sysemu/arch_init.h"
- #include "sysemu/block-backend.h"
- #include "sysemu/blockdev.h"
- #include "hw/block/block.h"
-@@ -111,6 +112,7 @@ struct SCSIDiskState {
-     char *vendor;
-     char *product;
-     char *device_id;
-+    char *loadparm;     /* only for s390x */
-     bool tray_open;
-     bool tray_locked;
-     /*
-@@ -3135,6 +3137,43 @@ BlockAIOCB *scsi_dma_writev(int64_t offset, QEMUIOVector *iov,
-     return blk_aio_pwritev(s->qdev.conf.blk, offset, iov, 0, cb, cb_opaque);
- }
- 
-+static char *scsi_property_get_loadparm(Object *obj, Error **errp)
-+{
-+    return g_strdup(SCSI_DISK_BASE(obj)->loadparm);
-+}
-+
-+static void scsi_property_set_loadparm(Object *obj, const char *value,
-+                                       Error **errp)
-+{
-+    void *lp_str;
-+
-+    if (object_property_get_int(obj, "bootindex", NULL) < 0) {
-+        error_setg(errp, "'loadparm' is only valid for boot devices");
-+        return;
-+    }
-+
-+    lp_str = g_malloc0(strlen(value));
-+    if (!qdev_prop_sanitize_s390x_loadparm(lp_str, value, errp)) {
-+        g_free(lp_str);
-+        return;
-+    }
-+    SCSI_DISK_BASE(obj)->loadparm = lp_str;
-+}
-+
-+static void scsi_property_add_specifics(DeviceClass *dc)
-+{
-+    ObjectClass *oc = OBJECT_CLASS(dc);
-+
-+    /* The loadparm property is only supported on s390x */
-+    if (arch_type & QEMU_ARCH_S390X) {
-+        object_class_property_add_str(oc, "loadparm",
-+                                      scsi_property_get_loadparm,
-+                                      scsi_property_set_loadparm);
-+        object_class_property_set_description(oc, "loadparm",
-+                                              "load parameter (s390x only)");
-+    }
-+}
-+
- static void scsi_disk_base_class_initfn(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -3218,6 +3257,8 @@ static void scsi_hd_class_initfn(ObjectClass *klass, void *data)
-     dc->desc = "virtual SCSI disk";
-     device_class_set_props(dc, scsi_hd_properties);
-     dc->vmsd  = &vmstate_scsi_disk_state;
-+
-+    scsi_property_add_specifics(dc);
- }
- 
- static const TypeInfo scsi_hd_info = {
-@@ -3258,6 +3299,8 @@ static void scsi_cd_class_initfn(ObjectClass *klass, void *data)
-     dc->desc = "virtual SCSI CD-ROM";
-     device_class_set_props(dc, scsi_cd_properties);
-     dc->vmsd  = &vmstate_scsi_disk_state;
-+
-+    scsi_property_add_specifics(dc);
- }
- 
- static const TypeInfo scsi_cd_info = {
-diff --git a/include/hw/qdev-properties-system.h b/include/hw/qdev-properties-system.h
-index 438f65389f..88e4257ad0 100644
---- a/include/hw/qdev-properties-system.h
-+++ b/include/hw/qdev-properties-system.h
-@@ -3,6 +3,9 @@
- 
- #include "hw/qdev-properties.h"
- 
-+bool qdev_prop_sanitize_s390x_loadparm(uint8_t *loadparm, const char *str,
-+                                       Error **errp);
-+
- extern const PropertyInfo qdev_prop_chr;
- extern const PropertyInfo qdev_prop_macaddr;
- extern const PropertyInfo qdev_prop_reserved_region;
--- 
-2.39.3
-
diff --git a/kvm-hw-arm-smmuv3-Move-reset-to-exit-phase.patch b/kvm-hw-arm-smmuv3-Move-reset-to-exit-phase.patch
deleted file mode 100644
index 689a6f5..0000000
--- a/kvm-hw-arm-smmuv3-Move-reset-to-exit-phase.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From a3dfbe30e930c8d794057e45fffd91a9b0e6afd0 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 18 Feb 2025 19:25:33 +0100
-Subject: [PATCH 3/9] hw/arm/smmuv3: Move reset to exit phase
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 341: Fix vIOMMU reset order
-RH-Jira: RHEL-7188
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Donald Dutile <None>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [3/5] e291cb45c32e0fab49b200c275553bbe76b97264 (eauger1/centos-qemu-kvm)
-
-Currently the iommu may be reset before the devices
-it protects. For example this happens with virtio-scsi-pci.
-when system_reset is issued from qmp monitor: spurious
-"virtio: zero sized buffers are not allowed" warnings can
-be observed. This happens because outstanding DMA requests
-are still happening while the SMMU gets reset.
-
-This can also happen with VFIO devices. In that case
-spurious DMA translation faults can be observed on host.
-
-Make sure the SMMU is reset in the 'exit' phase after
-all DMA capable devices have been reset during the 'enter'
-or 'hold' phase.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-
-Message-Id: <20250218182737.76722-4-eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit e39e3f8b8dea856f141e9945167d2b18021ef445)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/arm/smmu-common.c |  9 +++++++--
- hw/arm/smmuv3.c      | 14 ++++++++++----
- hw/arm/trace-events  |  1 +
- 3 files changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
-index 3f82728758..f4210fcbc1 100644
---- a/hw/arm/smmu-common.c
-+++ b/hw/arm/smmu-common.c
-@@ -924,7 +924,12 @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
-     }
- }
- 
--static void smmu_base_reset_hold(Object *obj, ResetType type)
-+/*
-+ * Make sure the IOMMU is reset in 'exit' phase after
-+ * all outstanding DMA requests have been quiesced during
-+ * the 'enter' or 'hold' reset phases
-+ */
-+static void smmu_base_reset_exit(Object *obj, ResetType type)
- {
-     SMMUState *s = ARM_SMMU(obj);
- 
-@@ -950,7 +955,7 @@ static void smmu_base_class_init(ObjectClass *klass, void *data)
-     device_class_set_props(dc, smmu_dev_properties);
-     device_class_set_parent_realize(dc, smmu_base_realize,
-                                     &sbc->parent_realize);
--    rc->phases.hold = smmu_base_reset_hold;
-+    rc->phases.exit = smmu_base_reset_exit;
- }
- 
- static const TypeInfo smmu_base_info = {
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-index 3971976389..2e90570915 100644
---- a/hw/arm/smmuv3.c
-+++ b/hw/arm/smmuv3.c
-@@ -1870,13 +1870,19 @@ static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
-     }
- }
- 
--static void smmu_reset_hold(Object *obj, ResetType type)
-+/*
-+ * Make sure the IOMMU is reset in 'exit' phase after
-+ * all outstanding DMA requests have been quiesced during
-+ * the 'enter' or 'hold' reset phases
-+ */
-+static void smmu_reset_exit(Object *obj, ResetType type)
- {
-     SMMUv3State *s = ARM_SMMUV3(obj);
-     SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
- 
--    if (c->parent_phases.hold) {
--        c->parent_phases.hold(obj, type);
-+    trace_smmu_reset_exit();
-+    if (c->parent_phases.exit) {
-+        c->parent_phases.exit(obj, type);
-     }
- 
-     smmuv3_init_regs(s);
-@@ -1999,7 +2005,7 @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
-     SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
- 
-     dc->vmsd = &vmstate_smmuv3;
--    resettable_class_set_parent_phases(rc, NULL, smmu_reset_hold, NULL,
-+    resettable_class_set_parent_phases(rc, NULL, NULL, smmu_reset_exit,
-                                        &c->parent_phases);
-     device_class_set_parent_realize(dc, smmu_realize,
-                                     &c->parent_realize);
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-index be6c8f720b..79ef347e3e 100644
---- a/hw/arm/trace-events
-+++ b/hw/arm/trace-events
-@@ -56,6 +56,7 @@ smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
- smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
- smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
- smmuv3_inv_notifiers_iova(const char *name, int asid, int vmid, uint64_t iova, uint8_t tg, uint64_t num_pages, int stage) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" stage=%d"
-+smmu_reset_exit(void) ""
- 
- # strongarm.c
- strongarm_uart_update_parameters(const char *label, int speed, char parity, int data_bits, int stop_bits) "%s speed=%d parity=%c data=%d stop=%d"
--- 
-2.48.1
-
diff --git a/kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch b/kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch
deleted file mode 100644
index ccaf1c4..0000000
--- a/kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 2018f62f2242d8d4a970d83ebef9b3c2bccf6fda Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:45 +0100
-Subject: [PATCH 33/57] hw/audio/ac97: skip automatic zero-init of large arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/30] 4a6b59a9b9122d9f89e99b3e44df19e6d92ed941 (stefanha/centos-stream-qemu-kvm)
-
-The 'read_audio' & 'write_audio' methods have a 4k byte array used
-for copying data between the audio backend and device. Skip the
-automatic zero-init of these arrays to eliminate the performance
-overhead in the I/O hot path.
-
-The 'tmpbuf' array will be fully initialized when reading data from
-the audio backend and/or device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-8-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 2553d2d26a9d0f46386bf8c37d184567e5cede6c)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/ac97.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
-index 3f0053f94d..681b5752a1 100644
---- a/hw/audio/ac97.c
-+++ b/hw/audio/ac97.c
-@@ -886,7 +886,7 @@ static void nabm_writel(void *opaque, uint32_t addr, uint32_t val)
- static int write_audio(AC97LinkState *s, AC97BusMasterRegs *r,
-                        int max, int *stop)
- {
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
-     uint32_t addr = r->bd.addr;
-     uint32_t temp = r->picb << 1;
-     uint32_t written = 0;
-@@ -959,7 +959,7 @@ static void write_bup(AC97LinkState *s, int elapsed)
- static int read_audio(AC97LinkState *s, AC97BusMasterRegs *r,
-                       int max, int *stop)
- {
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
-     uint32_t addr = r->bd.addr;
-     uint32_t temp = r->picb << 1;
-     uint32_t nread = 0;
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch b/kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch
deleted file mode 100644
index 95f535f..0000000
--- a/kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From bd32bb22fb324a37b31ed9ac3387524f6f4ea5be Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:46 +0100
-Subject: [PATCH 34/57] hw/audio/cs4231a: skip automatic zero-init of large
- arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [8/30] 6c454bcc2927e49896c62718287fb9e4b37b3bb9 (stefanha/centos-stream-qemu-kvm)
-
-The 'cs_write_audio' method has a pair of byte arrays, one 4k in size
-and one 8k, which are used in converting audio samples. Skip the
-automatic zero-init of these arrays to eliminate the performance
-overhead in the I/O hot path.
-
-The 'tmpbuf' array will be fully initialized when reading a block of
-data from the guest. The 'linbuf' array will be fully initialized
-when converting the audio samples.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-9-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit ca2cc0385d97cea66cd54ee42553f385c403d4a6)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/cs4231a.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
-index 9ef57f042d..5c312642cc 100644
---- a/hw/audio/cs4231a.c
-+++ b/hw/audio/cs4231a.c
-@@ -528,7 +528,7 @@ static int cs_write_audio (CSState *s, int nchan, int dma_pos,
-                            int dma_len, int len)
- {
-     int temp, net;
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
-     IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma);
- 
-     temp = len;
-@@ -547,7 +547,7 @@ static int cs_write_audio (CSState *s, int nchan, int dma_pos,
-         copied = k->read_memory(s->isa_dma, nchan, tmpbuf, dma_pos, to_copy);
-         if (s->tab) {
-             int i;
--            int16_t linbuf[4096];
-+            QEMU_UNINITIALIZED int16_t linbuf[4096];
- 
-             for (i = 0; i < copied; ++i)
-                 linbuf[i] = s->tab[tmpbuf[i]];
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch b/kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch
deleted file mode 100644
index 76a5d89..0000000
--- a/kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From cb12ddc6ed836091aa7724e2f77ab79cd9089cad Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:47 +0100
-Subject: [PATCH 35/57] hw/audio/es1370: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [9/30] b992e4247d8d31dc09f9dc7671e7a532558174ec (stefanha/centos-stream-qemu-kvm)
-
-The 'es1370_transfer_audio' method has a 4k byte array used for
-copying data between the audio backend and device. Skip the automatic
-zero-init of this array to eliminate the performance overhead in
-the I/O hot path.
-
-The 'tmpbuf' array will be fully initialized when reading data from
-the audio backend and/or device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-10-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 8236e206084b832d1d7ec947a4798b818f4cdf1f)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/es1370.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
-index 4ab61d3b9d..6aea934f54 100644
---- a/hw/audio/es1370.c
-+++ b/hw/audio/es1370.c
-@@ -604,7 +604,7 @@ static uint64_t es1370_read(void *opaque, hwaddr addr, unsigned size)
- static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
-                                    int max, bool *irq)
- {
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
-     size_t to_transfer;
-     uint32_t addr = d->frame_addr;
-     int sc = d->scount & 0xffff;
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch b/kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index 2ce4fa8..0000000
--- a/kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 9ad7091d82fd0577488f27ab54bb7851fe957020 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:48 +0100
-Subject: [PATCH 36/57] hw/audio/gus: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [10/30] 366953d0417ac31e3060fdc327fe8dade3375bf0 (stefanha/centos-stream-qemu-kvm)
-
-The 'GUS_read_DMA' method has a 4k byte array used for copying
-data between the audio backend and device. Skip the automatic
-zero-init of this array to eliminate the performance overhead in
-the I/O hot path.
-
-The 'tmpbuf' array will be fully initialized when reading data
-from device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-11-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 2e438da4929018c62609381e1156aac0b2fe3de3)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/gus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/audio/gus.c b/hw/audio/gus.c
-index 4beb3fd74e..e8b0b85d44 100644
---- a/hw/audio/gus.c
-+++ b/hw/audio/gus.c
-@@ -183,7 +183,7 @@ static int GUS_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
- {
-     GUSState *s = opaque;
-     IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma);
--    char tmpbuf[4096];
-+    QEMU_UNINITIALIZED char tmpbuf[4096];
-     int pos = dma_pos, mode, left = dma_len - dma_pos;
- 
-     ldebug ("read DMA %#x %d\n", dma_pos, dma_len);
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch b/kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch
deleted file mode 100644
index 3608901..0000000
--- a/kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 5cf61823cbe80b1ace2f5bdb9cc1971956425b98 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:49 +0100
-Subject: [PATCH 37/57] hw/audio/marvell_88w8618: skip automatic zero-init of
- large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [11/30] e09cdb76430552081168873dadfef1b5c8f74327 (stefanha/centos-stream-qemu-kvm)
-
-The 'mv88w8618_audio_callback' method has a 4k byte array used for
-copying data between the audio backend and device. Skip the automatic
-zero-init of this array to eliminate the performance overhead in
-the I/O hot path.
-
-The 'buf' array will be fully initialized when reading data from
-device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-12-berrange@redhat.com
-[Fixed hw/audio/gus in commit message --Stefan]
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 5b6cd5c5df4229972d8a0fd9dd9a089a1644d6ba)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/marvell_88w8618.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
-index cc285444bc..b7b4b27272 100644
---- a/hw/audio/marvell_88w8618.c
-+++ b/hw/audio/marvell_88w8618.c
-@@ -66,7 +66,7 @@ static void mv88w8618_audio_callback(void *opaque, int free_out, int free_in)
- {
-     mv88w8618_audio_state *s = opaque;
-     int16_t *codec_buffer;
--    int8_t buf[4096];
-+    QEMU_UNINITIALIZED int8_t buf[4096];
-     int8_t *mem_buffer;
-     int pos, block_size;
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch b/kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch
deleted file mode 100644
index 7e531d6..0000000
--- a/kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 0b4d59d75edd49ef99f0a82fbcbe360c5b48e4f8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:50 +0100
-Subject: [PATCH 38/57] hw/audio/sb16: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [12/30] 6475d67546bf04745636b317e965bcd89b6fb2d2 (stefanha/centos-stream-qemu-kvm)
-
-The 'write_audio' method has a 4k byte array used for copying data
-between the audio backend and device. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O hot
-path.
-
-The 'tmpbuf' array will be fully initialized when reading data from
-device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-13-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 30c82f6657c1ee9fbb5473924b4d3273f214bd6f)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/sb16.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
-index fd76e78d18..04c818ed3d 100644
---- a/hw/audio/sb16.c
-+++ b/hw/audio/sb16.c
-@@ -1181,7 +1181,7 @@ static int write_audio (SB16State *s, int nchan, int dma_pos,
-     IsaDma *isa_dma = nchan == s->dma ? s->isa_dma : s->isa_hdma;
-     IsaDmaClass *k = ISADMA_GET_CLASS(isa_dma);
-     int temp, net;
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
- 
-     temp = len;
-     net = 0;
--- 
-2.39.3
-
diff --git a/kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch b/kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch
deleted file mode 100644
index c52f0c1..0000000
--- a/kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 35332282ef8bd06f59206266006eff222ffe6bec Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:51 +0100
-Subject: [PATCH 39/57] hw/audio/via-ac97: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [13/30] 6391a04b29fcbb8bcdbce2c6b786758fc34f0d71 (stefanha/centos-stream-qemu-kvm)
-
-The 'out_cb' method has a 4k byte array used for copying data
-between the audio backend and device. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O hot
-path.
-
-The 'tmpbuf' array will be fully initialized when reading data from
-device memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-14-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit bb71d9fe1419f44529c91d1b09464718d157e647)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/audio/via-ac97.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
-index 4c127a1def..e8fcf44e5d 100644
---- a/hw/audio/via-ac97.c
-+++ b/hw/audio/via-ac97.c
-@@ -175,7 +175,7 @@ static void out_cb(void *opaque, int avail)
-     ViaAC97SGDChannel *c = &s->aur;
-     int temp, to_copy, copied;
-     bool stop = false;
--    uint8_t tmpbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t tmpbuf[4096];
- 
-     if (c->stat & STAT_PAUSED) {
-         return;
--- 
-2.39.3
-
diff --git a/kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch b/kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
deleted file mode 100644
index 0ab609d..0000000
--- a/kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 6aa786b145f484ed6e2e8a1a5089ad6e150306a8 Mon Sep 17 00:00:00 2001
-From: Sana Sharm <sansshar@redhat.com>
-Date: Fri, 3 Jan 2025 13:27:20 -0500
-Subject: [PATCH 19/19] hw/char/pl011: Use correct masks for IBRD and FBRD
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: sansshar <None>
-RH-MergeRequest: 310: hw/char/pl011: Use correct masks for IBRD and FBRD
-RH-Jira: RHEL-67107
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 4c7174da1dff8de3d7e2d88d84973eb69d6fc28a (sansshar/qemu-kvm-centos)
-
-Brew build id: 5098441
-
-In commit b88cfee90268cad we defined masks for the IBRD and FBRD
-integer and fractional baud rate divider registers, to prevent the
-guest from writing invalid values which could cause division-by-zero.
-Unfortunately we got the mask values the wrong way around: the FBRD
-register is six bits and the IBRD register is 16 bits, not
-vice-versa.
-
-You would only run into this bug if you programmed the UART to a baud
-rate of less than 9600, because for 9600 baud and above the IBRD
-value will fit into 6 bits, as per the table in
- https://developer.arm.com/documentation/ddi0183/g/programmers-model/register-descriptions/fractional-baud-rate-register--uartfbrd
-
-The only visible effects would be that the value read back from
-the register by the guest would be truncated, and we would
-print an incorrect baud rate in the debug logs.
-
-Cc: qemu-stable@nongnu.org
-Fixes: b88cfee90268 ("hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()")
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2610
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Gavin Shan <gshan@redhat.com>
-Message-id: 20241007144732.2491331-1-peter.maydell@linaro.org
-(cherry picked from commit cd247eae16ab1b9ce97fd34c000c1b883feeda45)
-Signed-off-by: Sana Sharma <sansshar@redhat.com>
-
- Changes to be committed:
-	modified:   hw/char/pl011.c
----
- hw/char/pl011.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/char/pl011.c b/hw/char/pl011.c
-index f8078aa216..949e9d0e0d 100644
---- a/hw/char/pl011.c
-+++ b/hw/char/pl011.c
-@@ -88,10 +88,10 @@ DeviceState *pl011_create(hwaddr addr, qemu_irq irq, Chardev *chr)
- #define CR_LBE      (1 << 7)
- 
- /* Integer Baud Rate Divider, UARTIBRD */
--#define IBRD_MASK 0x3f
-+#define IBRD_MASK 0xffff
- 
- /* Fractional Baud Rate Divider, UARTFBRD */
--#define FBRD_MASK 0xffff
-+#define FBRD_MASK 0x3f
- 
- static const unsigned char pl011_id_arm[8] =
-   { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
--- 
-2.39.3
-
diff --git a/kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch b/kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch
deleted file mode 100644
index 98d11f0..0000000
--- a/kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From b0c16a93460c2dfe834a9f439d25dc833dfb7427 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:52 +0100
-Subject: [PATCH 40/57] hw/char/sclpconsole-lm: skip automatic zero-init of
- large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [14/30] 1491e0147a799ec523fa67fd49649722a07299e7 (stefanha/centos-stream-qemu-kvm)
-
-The 'process_mdb' method has a 4k byte array used for copying data
-between the guest and the chardev backend. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O hot
-path.
-
-The 'buffer' array will be selectively initialized when data is converted
-between EBCDIC and ASCII.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-15-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 8b1dac1ad57082611419b0e2f347acd96115d25f)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/char/sclpconsole-lm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
-index 7719f438f6..19e64b92f6 100644
---- a/hw/char/sclpconsole-lm.c
-+++ b/hw/char/sclpconsole-lm.c
-@@ -214,7 +214,7 @@ static int process_mdb(SCLPEvent *event, MDBO *mdbo)
- {
-     int rc;
-     int len;
--    uint8_t buffer[SIZE_BUFFER];
-+    QEMU_UNINITIALIZED uint8_t buffer[SIZE_BUFFER];
- 
-     len = be16_to_cpu(mdbo->length);
-     len -= sizeof(mdbo->length) + sizeof(mdbo->type)
--- 
-2.39.3
-
diff --git a/kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch b/kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch
deleted file mode 100644
index 607fd50..0000000
--- a/kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 7b5624efccf55184278c6f4924efc2141df460f0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:54 +0100
-Subject: [PATCH 42/57] hw/display/vmware_vga: skip automatic zero-init of
- large struct
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [16/30] 4aaf459d4356bf28164be742889b9a78d3656703 (stefanha/centos-stream-qemu-kvm)
-
-The 'vmsvga_fifo_run' method has a struct which is a little over 20k
-in size, used for holding image data for cursor changes. Skip the
-automatic zero-init of this struct to eliminate the performance
-overhead in the I/O hot path.
-
-The cursor variable will be fully initialized only when processing
-a cursor definition message from the guest.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-17-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7048e70f391df76d009eecca25f8027858f9f304)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/display/vmware_vga.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
-index 3db3ff98f7..69afe98a2f 100644
---- a/hw/display/vmware_vga.c
-+++ b/hw/display/vmware_vga.c
-@@ -618,7 +618,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
-     uint32_t cmd, colour;
-     int args, len, maxloop = 1024;
-     int x, y, dx, dy, width, height;
--    struct vmsvga_cursor_definition_s cursor;
-+    QEMU_UNINITIALIZED struct vmsvga_cursor_definition_s cursor;
-     uint32_t cmd_start;
- 
-     len = vmsvga_fifo_length(s);
--- 
-2.39.3
-
diff --git a/kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch b/kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch
deleted file mode 100644
index d38d141..0000000
--- a/kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From cd3500c9e248dbefb36273046e6eee44ee0d5cbe Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:53 +0100
-Subject: [PATCH 41/57] hw/dma/xlnx_csu_dma: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [15/30] 063c88269c7d3bf07ae05aaf2d3d154e2016db81 (stefanha/centos-stream-qemu-kvm)
-
-The 'xlnx_csu_dma_src_notify' method has a 4k byte array used for
-copying DMA data. Skip the automatic zero-init of this array to
-eliminate the performance overhead in the I/O hot path.
-
-The 'buf' array will be fully initialized when data is copied.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-16-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit ce14f24611aa0469b464a9512e192b4fd51dca2b)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/dma/xlnx_csu_dma.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
-index ae307482f2..9d1cccc5ca 100644
---- a/hw/dma/xlnx_csu_dma.c
-+++ b/hw/dma/xlnx_csu_dma.c
-@@ -287,7 +287,7 @@ static uint32_t xlnx_csu_dma_advance(XlnxCSUDMA *s, uint32_t len)
- static void xlnx_csu_dma_src_notify(void *opaque)
- {
-     XlnxCSUDMA *s = XLNX_CSU_DMA(opaque);
--    unsigned char buf[4 * 1024];
-+    QEMU_UNINITIALIZED unsigned char buf[4 * 1024];
-     size_t rlen = 0;
- 
-     ptimer_transaction_begin(s->src_timer);
--- 
-2.39.3
-
diff --git a/kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch b/kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch
deleted file mode 100644
index 26d816e..0000000
--- a/kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From a4673aab85958c60867b12c65cc3483d734bb6e0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:55 +0100
-Subject: [PATCH 43/57] hw/hyperv/syndbg: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [17/30] 5f71779c431128601baf46115fe65178532a3836 (stefanha/centos-stream-qemu-kvm)
-
-The 'handle_recv_msg' method has a 4k byte array used for copying
-data between the network socket and guest memory. Skip the automatic
-zero-init of this array to eliminate the performance overhead in the
-I/O hot path.
-
-The 'data_buf' array will be fully initialized when data is read
-off the network socket.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-18-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 5a1f614d0cd0bcc8e84e0b7ab6af63d56bd348a2)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Conflicts:
-  hw/hyperv/syndbg.c
-
-  Context conflict due to missing commit 3efb9d226221
-  ("hw/hyperv/syndbg: common compilation unit") downstream. There is no
-  need to backport the commit because it's not a bug fix.
----
- hw/hyperv/syndbg.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
-index 065e12fb1e..c7c43c8009 100644
---- a/hw/hyperv/syndbg.c
-+++ b/hw/hyperv/syndbg.c
-@@ -188,7 +188,7 @@ static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
-                                 uint64_t timeout, uint32_t *retrieved_count)
- {
-     uint16_t ret;
--    uint8_t data_buf[TARGET_PAGE_SIZE - UDP_PKT_HEADER_SIZE];
-+    QEMU_UNINITIALIZED uint8_t data_buf[TARGET_PAGE_SIZE - UDP_PKT_HEADER_SIZE];
-     hwaddr out_len;
-     void *out_data;
-     ssize_t recv_byte_count;
--- 
-2.39.3
-
diff --git a/kvm-hw-i386-Fix-machine-type-compatibility.patch b/kvm-hw-i386-Fix-machine-type-compatibility.patch
deleted file mode 100644
index 430ba65..0000000
--- a/kvm-hw-i386-Fix-machine-type-compatibility.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 2bb5dff02fb393530a12f4f00219cd2f90cd442a Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 15 May 2025 18:45:51 +0200
-Subject: [PATCH 3/5] hw/i386: Fix machine type compatibility
-
-RH-Author: Sebastian Ott <sebott@redhat.com>
-RH-MergeRequest: 364: hw/i386: Fix machine type compatibility
-RH-Jira: RHEL-91307
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/1] 44ddbcb3af119c65e99018d7ed90887f3948907e (seott1/cos-qemu-kvm)
-
-Upstream Status: RHEL only
-
-Ensure compatibility of rhel specific i440fx and q35 machine types.
-Pick up missing bits from pc_compat_9_0 upstream.
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/i386/pc.c         | 8 ++++++++
- hw/i386/pc_piix.c    | 2 ++
- hw/i386/pc_q35.c     | 2 ++
- include/hw/i386/pc.h | 3 +++
- 4 files changed, 15 insertions(+)
-
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index fa9f16cbaf..5237538640 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -298,6 +298,14 @@ GlobalProperty pc_rhel_compat[] = {
- };
- const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
- 
-+GlobalProperty pc_rhel_9_6_compat[] = {
-+    /* pc_rhel_9_6_compat from pc_compat_9_0 */
-+    { TYPE_X86_CPU, "x-amd-topoext-features-only", "false" },
-+    { TYPE_X86_CPU, "x-l1-cache-per-thread", "false" },
-+    { TYPE_X86_CPU, "legacy-multi-node", "on" },
-+};
-+const size_t pc_rhel_9_6_compat_len = G_N_ELEMENTS(pc_rhel_9_6_compat);
-+
- GlobalProperty pc_rhel_9_5_compat[] = {
-     /* pc_rhel_9_5_compat from pc_compat_pc_9_0 (backported from 9.1) */
-     { TYPE_X86_CPU, "guest-phys-bits", "0" },
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 10764bf596..0687317db5 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -885,6 +885,8 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
- 
-     compat_props_add(m->compat_props, hw_compat_rhel_9_6,
-                      hw_compat_rhel_9_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_6_compat,
-+		     pc_rhel_9_6_compat_len);
-     compat_props_add(m->compat_props, pc_rhel_9_5_compat,
- 		     pc_rhel_9_5_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 5bf08be0fb..871c760aea 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -704,6 +704,8 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
- 
-     compat_props_add(m->compat_props, hw_compat_rhel_9_6,
-                      hw_compat_rhel_9_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_6_compat,
-+		     pc_rhel_9_6_compat_len);
-     compat_props_add(m->compat_props, pc_rhel_9_5_compat,
- 		     pc_rhel_9_5_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 75c9271cdd..2b7c18f2b0 100644
---- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -305,6 +305,9 @@ extern const size_t pc_compat_2_3_len;
- extern GlobalProperty pc_rhel_compat[];
- extern const size_t pc_rhel_compat_len;
- 
-+extern GlobalProperty pc_rhel_9_6_compat[];
-+extern const size_t pc_rhel_9_6_compat_len;
-+
- extern GlobalProperty pc_rhel_9_5_compat[];
- extern const size_t pc_rhel_9_5_compat_len;
- 
--- 
-2.48.1
-
diff --git a/kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch b/kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch
deleted file mode 100644
index d68826a..0000000
--- a/kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From f1ff9d3b379697a2d4627e9529067195841d86a8 Mon Sep 17 00:00:00 2001
-From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date: Sun, 4 May 2025 17:04:05 +0000
-Subject: [PATCH 25/57] hw/i386/amd_iommu: Allow migration when explicitly
- create the AMDVI-PCI device
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 380: Add ability to manually specify the AMDVI-PCI device
-RH-Jira: RHEL-70925
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/3] a42b88116e608a79b6fae13ebe3709874f2a853f (johnalle/qemu-kvm-fork)
-
-Add migration support for AMD IOMMU model by saving necessary AMDVIState
-parameters for MMIO registers, device table, command buffer, and event
-buffers.
-
-Also change devtab_len type from size_t to uint64_t to avoid 32-bit build
-issue.
-
-Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Message-Id: <20250504170405.12623-3-suravee.suthikulpanit@amd.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 28931c2e1591deb4bfaaf744fdc8813e96c230f1)
-
-JIRA: https://issues.redhat.com/browse/RHEL-70925
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- hw/i386/amd_iommu.c | 48 +++++++++++++++++++++++++++++++++++++++++++++
- hw/i386/amd_iommu.h |  2 +-
- 2 files changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 6a5e76cfef..a34e0c5f59 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -1611,8 +1611,55 @@ static void amdvi_sysbus_reset(DeviceState *dev)
-     amdvi_init(s);
- }
- 
-+static const VMStateDescription vmstate_amdvi_sysbus_migratable = {
-+    .name = "amd-iommu",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .priority = MIG_PRI_IOMMU,
-+    .fields = (VMStateField[]) {
-+      /* Updated in  amdvi_handle_control_write() */
-+      VMSTATE_BOOL(enabled, AMDVIState),
-+      VMSTATE_BOOL(ga_enabled, AMDVIState),
-+      VMSTATE_BOOL(ats_enabled, AMDVIState),
-+      VMSTATE_BOOL(cmdbuf_enabled, AMDVIState),
-+      VMSTATE_BOOL(completion_wait_intr, AMDVIState),
-+      VMSTATE_BOOL(evtlog_enabled, AMDVIState),
-+      VMSTATE_BOOL(evtlog_intr, AMDVIState),
-+      /* Updated in amdvi_handle_devtab_write() */
-+      VMSTATE_UINT64(devtab, AMDVIState),
-+      VMSTATE_UINT64(devtab_len, AMDVIState),
-+      /* Updated in amdvi_handle_cmdbase_write() */
-+      VMSTATE_UINT64(cmdbuf, AMDVIState),
-+      VMSTATE_UINT64(cmdbuf_len, AMDVIState),
-+      /* Updated in amdvi_handle_cmdhead_write() */
-+      VMSTATE_UINT32(cmdbuf_head, AMDVIState),
-+      /* Updated in amdvi_handle_cmdtail_write() */
-+      VMSTATE_UINT32(cmdbuf_tail, AMDVIState),
-+      /* Updated in amdvi_handle_evtbase_write() */
-+      VMSTATE_UINT64(evtlog, AMDVIState),
-+      VMSTATE_UINT32(evtlog_len, AMDVIState),
-+      /* Updated in amdvi_handle_evthead_write() */
-+      VMSTATE_UINT32(evtlog_head, AMDVIState),
-+      /* Updated in amdvi_handle_evttail_write() */
-+      VMSTATE_UINT32(evtlog_tail, AMDVIState),
-+      /* Updated in amdvi_handle_pprbase_write() */
-+      VMSTATE_UINT64(ppr_log, AMDVIState),
-+      VMSTATE_UINT32(pprlog_len, AMDVIState),
-+      /* Updated in amdvi_handle_pprhead_write() */
-+      VMSTATE_UINT32(pprlog_head, AMDVIState),
-+      /* Updated in amdvi_handle_tailhead_write() */
-+      VMSTATE_UINT32(pprlog_tail, AMDVIState),
-+      /* MMIO registers */
-+      VMSTATE_UINT8_ARRAY(mmior, AMDVIState, AMDVI_MMIO_SIZE),
-+      VMSTATE_UINT8_ARRAY(romask, AMDVIState, AMDVI_MMIO_SIZE),
-+      VMSTATE_UINT8_ARRAY(w1cmask, AMDVIState, AMDVI_MMIO_SIZE),
-+      VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
- {
-+    DeviceClass *dc = (DeviceClass *) object_get_class(OBJECT(dev));
-     AMDVIState *s = AMD_IOMMU_DEVICE(dev);
-     MachineState *ms = MACHINE(qdev_get_machine());
-     PCMachineState *pcms = PC_MACHINE(ms);
-@@ -1634,6 +1681,7 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-         }
- 
-         s->pci = AMD_IOMMU_PCI(pdev);
-+        dc->vmsd = &vmstate_amdvi_sysbus_migratable;
-     } else {
-         s->pci = AMD_IOMMU_PCI(object_new(TYPE_AMD_IOMMU_PCI));
-         /* This device should take care of IOMMU PCI properties */
-diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
-index ece71ff0b6..741dd9a910 100644
---- a/hw/i386/amd_iommu.h
-+++ b/hw/i386/amd_iommu.h
-@@ -329,7 +329,7 @@ struct AMDVIState {
-     bool excl_enabled;
- 
-     hwaddr devtab;               /* base address device table    */
--    size_t devtab_len;           /* device table length          */
-+    uint64_t devtab_len;         /* device table length          */
- 
-     hwaddr cmdbuf;               /* command buffer base address  */
-     uint64_t cmdbuf_len;         /* command buffer length        */
--- 
-2.39.3
-
diff --git a/kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch b/kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch
deleted file mode 100644
index 4542745..0000000
--- a/kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From e611119b8b4e0712ab103628051d69ea84538719 Mon Sep 17 00:00:00 2001
-From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date: Tue, 25 Mar 2025 02:11:40 +0000
-Subject: [PATCH 23/57] hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD
- IOMMU device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 379: hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU device
-RH-Jira: RHEL-70926
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 69d847f64543caf328da3e7663e7d2ebe53cd448 (johnalle/qemu-kvm-fork)
-
-Currently, the QEMU-emulated AMD IOMMU device use PCI vendor id 0x1022
-(AMD) with device id zero (undefined). Eventhough this does not cause any
-functional issue for AMD IOMMU driver since it normally uses information
-in the ACPI IVRS table to probe and initialize the device per
-recommendation in the AMD IOMMU specification, the device id zero causes
-the Windows Device Manager utility to show the device as an unknown device.
-
-Since Windows only recognizes AMD IOMMU device with device id 0x1419 as
-listed in the machine.inf file, modify the QEMU AMD IOMMU model to use
-the id 0x1419 to avoid the issue. This advertise the IOMMU as the AMD
-IOMMU device for Family 15h (Models 10h-1fh).
-
-Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Message-Id: <20250325021140.5676-1-suravee.suthikulpanit@amd.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 719255486df2fcbe1b8599786b37f4bb80272f1a)
-
-JIRA: https://issues.redhat.com/browse/RHEL-70926
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- hw/i386/amd_iommu.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index d804656ea8..59e1a01b7c 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -1714,6 +1714,7 @@ static void amdvi_pci_class_init(ObjectClass *klass, void *data)
-     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
- 
-     k->vendor_id = PCI_VENDOR_ID_AMD;
-+    k->device_id = 0x1419;
-     k->class_id = 0x0806;
-     k->realize = amdvi_pci_realize;
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch b/kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch
deleted file mode 100644
index 6da1d5d..0000000
--- a/kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch
+++ /dev/null
@@ -1,267 +0,0 @@
-From 5a697d0f66360acca8216f49c06dc9702231d470 Mon Sep 17 00:00:00 2001
-From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Date: Sun, 4 May 2025 17:04:04 +0000
-Subject: [PATCH 24/57] hw/i386/amd_iommu: Isolate AMDVI-PCI from amd-iommu
- device to allow full control over the PCI device creation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 380: Add ability to manually specify the AMDVI-PCI device
-RH-Jira: RHEL-70925
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/3] 58254a72ba2d810b57c610462494f76691126521 (johnalle/qemu-kvm-fork)
-
-Current amd-iommu model internally creates an AMDVI-PCI device. Here is
-a snippet from info qtree:
-
-  bus: main-system-bus
-    type System
-    dev: amd-iommu, id ""
-      xtsup = false
-      pci-id = ""
-      intremap = "on"
-      device-iotlb = false
-      pt = true
-    ...
-    dev: q35-pcihost, id ""
-      MCFG = -1 (0xffffffffffffffff)
-      pci-hole64-size = 34359738368 (32 GiB)
-      below-4g-mem-size = 134217728 (128 MiB)
-      above-4g-mem-size = 0 (0 B)
-      smm-ranges = true
-      x-pci-hole64-fix = true
-      x-config-reg-migration-enabled = true
-      bypass-iommu = false
-      bus: pcie.0
-        type PCIE
-        dev: AMDVI-PCI, id ""
-          addr = 01.0
-          romfile = ""
-          romsize = 4294967295 (0xffffffff)
-          rombar = -1 (0xffffffffffffffff)
-          multifunction = false
-          x-pcie-lnksta-dllla = true
-          x-pcie-extcap-init = true
-          failover_pair_id = ""
-          acpi-index = 0 (0x0)
-          x-pcie-err-unc-mask = true
-          x-pcie-ari-nextfn-1 = false
-          x-max-bounce-buffer-size = 4096 (4 KiB)
-          x-pcie-ext-tag = true
-          busnr = 0 (0x0)
-          class Class 0806, addr 00:01.0, pci id 1022:0000 (sub 1af4:1100)
-    ...
-
-This prohibits users from specifying the PCI topology for the amd-iommu device,
-which becomes a problem when trying to support VM migration since it does not
-guarantee the same enumeration of AMD IOMMU device.
-
-Therefore, allow the 'AMDVI-PCI' device to optionally be pre-created and
-associated with a 'amd-iommu' device via a new 'pci-id' parameter on the
-latter.
-
-For example:
-  -device AMDVI-PCI,id=iommupci0,bus=pcie.0,addr=0x05 \
-  -device amd-iommu,intremap=on,pt=on,xtsup=on,pci-id=iommupci0 \
-
-For backward-compatibility, internally create the AMDVI-PCI device if not
-specified on the CLI.
-
-Co-developed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
-Message-Id: <20250504170405.12623-2-suravee.suthikulpanit@amd.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit f864a3235ea1d1d714b3cde2d9a810ea6344a7b5)
-
-JIRA: https://issues.redhat.com/browse/RHEL-70925
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- hw/i386/acpi-build.c |  8 +++----
- hw/i386/amd_iommu.c  | 53 ++++++++++++++++++++++++++------------------
- hw/i386/amd_iommu.h  |  3 ++-
- 3 files changed, 38 insertions(+), 26 deletions(-)
-
-diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
-index 032fb1f904..236261f8aa 100644
---- a/hw/i386/acpi-build.c
-+++ b/hw/i386/acpi-build.c
-@@ -2392,10 +2392,10 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
-     build_append_int_noprefix(table_data, ivhd_blob->len + 24, 2);
-     /* DeviceID */
-     build_append_int_noprefix(table_data,
--                              object_property_get_int(OBJECT(&s->pci), "addr",
-+                              object_property_get_int(OBJECT(s->pci), "addr",
-                                                       &error_abort), 2);
-     /* Capability offset */
--    build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
-+    build_append_int_noprefix(table_data, s->pci->capab_offset, 2);
-     /* IOMMU base address */
-     build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
-     /* PCI Segment Group */
-@@ -2427,10 +2427,10 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
-     build_append_int_noprefix(table_data, ivhd_blob->len + 40, 2);
-     /* DeviceID */
-     build_append_int_noprefix(table_data,
--                              object_property_get_int(OBJECT(&s->pci), "addr",
-+                              object_property_get_int(OBJECT(s->pci), "addr",
-                                                       &error_abort), 2);
-     /* Capability offset */
--    build_append_int_noprefix(table_data, s->pci.capab_offset, 2);
-+    build_append_int_noprefix(table_data, s->pci->capab_offset, 2);
-     /* IOMMU base address */
-     build_append_int_noprefix(table_data, s->mr_mmio.addr, 8);
-     /* PCI Segment Group */
-diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
-index 59e1a01b7c..6a5e76cfef 100644
---- a/hw/i386/amd_iommu.c
-+++ b/hw/i386/amd_iommu.c
-@@ -167,11 +167,11 @@ static void amdvi_generate_msi_interrupt(AMDVIState *s)
- {
-     MSIMessage msg = {};
-     MemTxAttrs attrs = {
--        .requester_id = pci_requester_id(&s->pci.dev)
-+        .requester_id = pci_requester_id(&s->pci->dev)
-     };
- 
--    if (msi_enabled(&s->pci.dev)) {
--        msg = msi_get_message(&s->pci.dev, 0);
-+    if (msi_enabled(&s->pci->dev)) {
-+        msg = msi_get_message(&s->pci->dev, 0);
-         address_space_stl_le(&address_space_memory, msg.address, msg.data,
-                              attrs, NULL);
-     }
-@@ -239,7 +239,7 @@ static void amdvi_page_fault(AMDVIState *s, uint16_t devid,
-     info |= AMDVI_EVENT_IOPF_I | AMDVI_EVENT_IOPF;
-     amdvi_encode_event(evt, devid, addr, info);
-     amdvi_log_event(s, evt);
--    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
-+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
-             PCI_STATUS_SIG_TARGET_ABORT);
- }
- /*
-@@ -256,7 +256,7 @@ static void amdvi_log_devtab_error(AMDVIState *s, uint16_t devid,
- 
-     amdvi_encode_event(evt, devid, devtab, info);
-     amdvi_log_event(s, evt);
--    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
-+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
-             PCI_STATUS_SIG_TARGET_ABORT);
- }
- /* log an event trying to access command buffer
-@@ -269,7 +269,7 @@ static void amdvi_log_command_error(AMDVIState *s, hwaddr addr)
- 
-     amdvi_encode_event(evt, 0, addr, info);
-     amdvi_log_event(s, evt);
--    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
-+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
-             PCI_STATUS_SIG_TARGET_ABORT);
- }
- /* log an illegal command event
-@@ -310,7 +310,7 @@ static void amdvi_log_pagetab_error(AMDVIState *s, uint16_t devid,
-     info |= AMDVI_EVENT_PAGE_TAB_HW_ERROR;
-     amdvi_encode_event(evt, devid, addr, info);
-     amdvi_log_event(s, evt);
--    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
-+    pci_word_test_and_set_mask(s->pci->dev.config + PCI_STATUS,
-              PCI_STATUS_SIG_TARGET_ABORT);
- }
- 
-@@ -1607,7 +1607,7 @@ static void amdvi_sysbus_reset(DeviceState *dev)
- {
-     AMDVIState *s = AMD_IOMMU_DEVICE(dev);
- 
--    msi_reset(&s->pci.dev);
-+    msi_reset(&s->pci->dev);
-     amdvi_init(s);
- }
- 
-@@ -1619,14 +1619,32 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
-     X86MachineState *x86ms = X86_MACHINE(ms);
-     PCIBus *bus = pcms->pcibus;
- 
--    s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
--                                     amdvi_uint64_equal, g_free, g_free);
-+    if (s->pci_id) {
-+        PCIDevice *pdev = NULL;
-+        int ret = pci_qdev_find_device(s->pci_id, &pdev);
- 
--    /* This device should take care of IOMMU PCI properties */
--    if (!qdev_realize(DEVICE(&s->pci), &bus->qbus, errp)) {
--        return;
-+        if (ret) {
-+            error_report("Cannot find PCI device '%s'", s->pci_id);
-+            return;
-+        }
-+
-+        if (!object_dynamic_cast(OBJECT(pdev), TYPE_AMD_IOMMU_PCI)) {
-+            error_report("Device '%s' must be an AMDVI-PCI device type", s->pci_id);
-+            return;
-+        }
-+
-+        s->pci = AMD_IOMMU_PCI(pdev);
-+    } else {
-+        s->pci = AMD_IOMMU_PCI(object_new(TYPE_AMD_IOMMU_PCI));
-+        /* This device should take care of IOMMU PCI properties */
-+        if (!qdev_realize(DEVICE(s->pci), &bus->qbus, errp)) {
-+            return;
-+        }
-     }
- 
-+    s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
-+                                     amdvi_uint64_equal, g_free, g_free);
-+
-     /* Pseudo address space under root PCI bus. */
-     x86ms->ioapic_as = amdvi_host_dma_iommu(bus, s, AMDVI_IOAPIC_SB_DEVID);
- 
-@@ -1668,6 +1686,7 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
- 
- static Property amdvi_properties[] = {
-     DEFINE_PROP_BOOL("xtsup", AMDVIState, xtsup, false),
-+    DEFINE_PROP_STRING("pci-id", AMDVIState, pci_id),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-@@ -1676,13 +1695,6 @@ static const VMStateDescription vmstate_amdvi_sysbus = {
-     .unmigratable = 1
- };
- 
--static void amdvi_sysbus_instance_init(Object *klass)
--{
--    AMDVIState *s = AMD_IOMMU_DEVICE(klass);
--
--    object_initialize(&s->pci, sizeof(s->pci), TYPE_AMD_IOMMU_PCI);
--}
--
- static void amdvi_sysbus_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -1704,7 +1716,6 @@ static const TypeInfo amdvi_sysbus = {
-     .name = TYPE_AMD_IOMMU_DEVICE,
-     .parent = TYPE_X86_IOMMU_DEVICE,
-     .instance_size = sizeof(AMDVIState),
--    .instance_init = amdvi_sysbus_instance_init,
-     .class_init = amdvi_sysbus_class_init
- };
- 
-diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
-index e0dac4d9a9..ece71ff0b6 100644
---- a/hw/i386/amd_iommu.h
-+++ b/hw/i386/amd_iommu.h
-@@ -315,7 +315,8 @@ struct AMDVIPCIState {
- 
- struct AMDVIState {
-     X86IOMMUState iommu;        /* IOMMU bus device             */
--    AMDVIPCIState pci;          /* IOMMU PCI device             */
-+    AMDVIPCIState *pci;         /* IOMMU PCI device             */
-+    char *pci_id;               /* ID of AMDVI-PCI device, if user created */
- 
-     uint32_t version;
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-i386-intel-iommu-Migrate-to-3-phase-reset.patch b/kvm-hw-i386-intel-iommu-Migrate-to-3-phase-reset.patch
deleted file mode 100644
index 827c43c..0000000
--- a/kvm-hw-i386-intel-iommu-Migrate-to-3-phase-reset.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 67b281dc1ccdae05da6c6052c264ecd94723c0b2 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 18 Feb 2025 19:25:32 +0100
-Subject: [PATCH 2/9] hw/i386/intel-iommu: Migrate to 3-phase reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 341: Fix vIOMMU reset order
-RH-Jira: RHEL-7188
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Donald Dutile <None>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [2/5] 5b9b60b2b796529db10b846881e82e7df4626ec1 (eauger1/centos-qemu-kvm)
-
-Currently the IOMMU may be reset before the devices
-it protects. For example this happens with virtio devices
-but also with VFIO devices. In this latter case this
-produces spurious translation faults on host.
-
-Let's use 3-phase reset mechanism and reset the IOMMU on
-exit phase after all DMA capable devices have been reset
-on 'enter' or 'hold' phase.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Jason Wang <jasowang@redhat.com>
-Zhenzhong Duan <zhenzhong.duan@intel.com>
-
-Message-Id: <20250218182737.76722-3-eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 2aaf48bcf27d8b3da5b30af6c1ced464d3df30f7)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-
-Conflicts: Code change
-	hw/i386/intel_iommu.c
-We miss e3d0814368d0 ("hw: Use device_class_set_legacy_reset() instead
-of opencoding") meaning that instead of removing
-device_class_set_legacy_reset(dc, vtd_reset) we remove
-dc->reset = vtd_reset;
----
- hw/i386/intel_iommu.c | 12 +++++++++---
- hw/i386/trace-events  |  1 +
- 2 files changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
-index 16d2885fcc..4acefcf5c8 100644
---- a/hw/i386/intel_iommu.c
-+++ b/hw/i386/intel_iommu.c
-@@ -4212,10 +4212,11 @@ static void vtd_init(IntelIOMMUState *s)
- /* Should not reset address_spaces when reset because devices will still use
-  * the address space they got at first (won't ask the bus again).
-  */
--static void vtd_reset(DeviceState *dev)
-+static void vtd_reset_exit(Object *obj, ResetType type)
- {
--    IntelIOMMUState *s = INTEL_IOMMU_DEVICE(dev);
-+    IntelIOMMUState *s = INTEL_IOMMU_DEVICE(obj);
- 
-+    trace_vtd_reset_exit();
-     vtd_init(s);
-     vtd_address_space_refresh_all(s);
- }
-@@ -4367,8 +4368,13 @@ static void vtd_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     X86IOMMUClass *x86_class = X86_IOMMU_DEVICE_CLASS(klass);
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
--    dc->reset = vtd_reset;
-+    /*
-+     * Use 'exit' reset phase to make sure all DMA requests
-+     * have been quiesced during 'enter' or 'hold' phase
-+     */
-+    rc->phases.exit = vtd_reset_exit;
-     dc->vmsd = &vtd_vmstate;
-     device_class_set_props(dc, vtd_properties);
-     dc->hotpluggable = false;
-diff --git a/hw/i386/trace-events b/hw/i386/trace-events
-index 53c02d7ac8..ac9e1a10aa 100644
---- a/hw/i386/trace-events
-+++ b/hw/i386/trace-events
-@@ -68,6 +68,7 @@ vtd_frr_new(int index, uint64_t hi, uint64_t lo) "index %d high 0x%"PRIx64" low
- vtd_warn_invalid_qi_tail(uint16_t tail) "tail 0x%"PRIx16
- vtd_warn_ir_vector(uint16_t sid, int index, int vec, int target) "sid 0x%"PRIx16" index %d vec %d (should be: %d)"
- vtd_warn_ir_trigger(uint16_t sid, int index, int trig, int target) "sid 0x%"PRIx16" index %d trigger %d (should be: %d)"
-+vtd_reset_exit(void) ""
- 
- # amd_iommu.c
- amdvi_evntlog_fail(uint64_t addr, uint32_t head) "error: fail to write at addr 0x%"PRIx64" +  offset 0x%"PRIx32
--- 
-2.48.1
-
diff --git a/kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch b/kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch
deleted file mode 100644
index a1553f8..0000000
--- a/kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 0bfbd2c49c01ee77d3b5a21bf9fe675916cbf0ed Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:56 +0100
-Subject: [PATCH 44/57] hw/misc/aspeed_hace: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [18/30] ec8510be6b23b26b3eecd6767e1deb0c0c50dd58 (stefanha/centos-stream-qemu-kvm)
-
-The 'do_hash_operation' method has a 256 element iovec array used for
-holding pointers to data that is to be hashed. Skip the automatic
-zero-init of this array to eliminate the performance overhead in the
-I/O hot path.
-
-The 'iovec' array will be selectively initialized based on data that
-needs to be hashed.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-19-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 6992c886838282f36b20deee44b666bbfc573a8f)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Conflicts:
-  hw/misc/aspeed_hace.c
-
-  Context conflict due to missing commit b9ccbe212e24
-  ("hw/misc/aspeed_hace: Extract accumulation-mode hash execution into
-  helper function") downstream. The commit is not a bug fix, so there is
-  no need to backport it.
----
- hw/misc/aspeed_hace.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
-index c06c04ddc6..d2118f1864 100644
---- a/hw/misc/aspeed_hace.c
-+++ b/hw/misc/aspeed_hace.c
-@@ -188,7 +188,7 @@ static int gen_acc_mode_iov(AspeedHACEState *s, struct iovec *iov, int id,
- static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
-                               bool acc_mode)
- {
--    struct iovec iov[ASPEED_HACE_MAX_SG];
-+    QEMU_UNINITIALIZED struct iovec iov[ASPEED_HACE_MAX_SG];
-     g_autofree uint8_t *digest_buf = NULL;
-     size_t digest_len = 0;
-     int niov = 0;
--- 
-2.39.3
-
diff --git a/kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch b/kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch
deleted file mode 100644
index 8161972..0000000
--- a/kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From cc173deaaa4d9dc6ad9188e0b03f46b7e64f26b2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:57 +0100
-Subject: [PATCH 45/57] hw/net/rtl8139: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [19/30] 344c720aef2feb35f84fd4b21f2b1b31e5572286 (stefanha/centos-stream-qemu-kvm)
-
-The 'rtl8139_transmit_one' method has a 8k byte array used for
-copying data between guest and host. Skip the automatic zero-init
-of this array to eliminate the performance overhead in the I/O
-hot path.
-
-The 'txbuffer' will be fully initialized when reading PCI DMA
-buffers.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-20-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 3ccc6489dd4925ddd1f3066bd3751389169cd7aa)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/net/rtl8139.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index f2fe057535..a2732bf1c1 100644
---- a/hw/net/rtl8139.c
-+++ b/hw/net/rtl8139.c
-@@ -1818,7 +1818,7 @@ static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
- 
-     PCIDevice *d = PCI_DEVICE(s);
-     int txsize = s->TxStatus[descriptor] & 0x1fff;
--    uint8_t txbuffer[0x2000];
-+    QEMU_UNINITIALIZED uint8_t txbuffer[0x2000];
- 
-     DPRINTF("+++ transmit reading %d bytes from host memory at 0x%08x\n",
-         txsize, s->TxAddr[descriptor]);
--- 
-2.39.3
-
diff --git a/kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch b/kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index 06ea05e..0000000
--- a/kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 400b5c8ae7f06a450ef91230343d7ce489142a38 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:58 +0100
-Subject: [PATCH 46/57] hw/net/tulip: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [20/30] b3d29de8495c0ff40c26974673adefe4eb27a417 (stefanha/centos-stream-qemu-kvm)
-
-The 'tulip_setup_frame' method has a 4k byte array used for copynig
-DMA data from the device. Skip the automatic zero-init of this array
-to eliminate the performance overhead in the I/O hot path.
-
-The 'buf' array will be fully initialized when reading data from the
-device.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-21-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit e1afd5ee6eb2954f4baf3c97820e4aaf7de97d2a)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/net/tulip.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/net/tulip.c b/hw/net/tulip.c
-index 1f2ef20977..5cf2b96fbd 100644
---- a/hw/net/tulip.c
-+++ b/hw/net/tulip.c
-@@ -629,7 +629,7 @@ static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
- static void tulip_setup_frame(TULIPState *s,
-         struct tulip_descriptor *desc)
- {
--    uint8_t buf[4096];
-+    QEMU_UNINITIALIZED uint8_t buf[4096];
-     int len = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
-     int i;
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch b/kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch
deleted file mode 100644
index 4fbe7a4..0000000
--- a/kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 0925796a4537e20e033a675ebc8899e4580235f3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:59 +0100
-Subject: [PATCH 47/57] hw/net/virtio-net: skip automatic zero-init of large
- arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [21/30] 0450189a4c4c779b5a1850e9ea8278a5129c5f7f (stefanha/centos-stream-qemu-kvm)
-
-The 'virtio_net_receive_rcu' method has three arrays with
-VIRTQUEUE_MAX_SIZE elements, which are apprixmately 32k in
-size used for copying data between guest and host. Skip the
-automatic zero-init of these arrays to eliminate the
-performance overhead in the I/O hot path.
-
-The three arrays will be selectively initialized as required
-when processing network buffers.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-22-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 21cf31c51a7aeff4270c9b30b37e019c536d54b2)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/net/virtio-net.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index 3d2b2460ad..086ea20ea0 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -1895,9 +1895,9 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-     VirtIONet *n = qemu_get_nic_opaque(nc);
-     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
-     VirtIODevice *vdev = VIRTIO_DEVICE(n);
--    VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
--    size_t lens[VIRTQUEUE_MAX_SIZE];
--    struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
-+    QEMU_UNINITIALIZED VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
-+    QEMU_UNINITIALIZED size_t lens[VIRTQUEUE_MAX_SIZE];
-+    QEMU_UNINITIALIZED struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
-     struct virtio_net_hdr_v1_hash extra_hdr;
-     unsigned mhdr_cnt = 0;
-     size_t offset, i, guest_offset, j;
--- 
-2.39.3
-
diff --git a/kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch b/kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index 027ab99..0000000
--- a/kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 34116b3a243f005938a30e9b38c6f47a62752c3e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:00 +0100
-Subject: [PATCH 48/57] hw/net/xgamc: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [22/30] 63536d627705775c4bf72a511de3d68ec30ac7de (stefanha/centos-stream-qemu-kvm)
-
-The 'xgmac_enet_send' method has a 8k byte array used for copying
-data between guest and host. Skip the automatic zero-init of this
-array to eliminate the performance overhead in the I/O hot path.
-
-The 'frame' buffer will be fully initialized when reading guest
-memory to fetch the data to send.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-23-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 8b723287b84a62bb5d1a7799ef0959ca8e6c293a)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/net/xgmac.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c
-index ffe3fc8dbe..eff8022aca 100644
---- a/hw/net/xgmac.c
-+++ b/hw/net/xgmac.c
-@@ -207,7 +207,7 @@ static void xgmac_enet_send(XgmacState *s)
-     struct desc bd;
-     int frame_size;
-     int len;
--    uint8_t frame[8192];
-+    QEMU_UNINITIALIZED uint8_t frame[8192];
-     uint8_t *ptr;
- 
-     ptr = frame;
--- 
-2.39.3
-
diff --git a/kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch b/kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index 6a84a1c..0000000
--- a/kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 3e0134b45828bf9a623a26ac41d5fbb3a8d2917b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:01 +0100
-Subject: [PATCH 49/57] hw/nvme/ctrl: skip automatic zero-init of large arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [23/30] 57ce4361ffb307be4ea4d3edf9e0dac269d16908 (stefanha/centos-stream-qemu-kvm)
-
-The 'nvme_map_sgl' method has a 256 element array used for copying
-data from the device. Skip the automatic zero-init of this array
-to eliminate the performance overhead in the I/O hot path.
-
-The 'segment' array will be fully initialized when reading data from
-the device.
-
-The 'nme_changed_nslist' method has a 4k byte array that is manually
-initialized with memset(). The compiler ought to be intelligent
-enough to turn the memset() into a static initialization operation,
-and thus not duplicate the automatic zero-init. Replacing memset()
-with '{}' makes it unambiguous that the array is statically initialized.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Message-id: 20250610123709.835102-24-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7eeb1d3acc175813ad3d5e824f26123e0992093a)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/nvme/ctrl.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
-index d451ee0d00..75d7f20801 100644
---- a/hw/nvme/ctrl.c
-+++ b/hw/nvme/ctrl.c
-@@ -1047,7 +1047,8 @@ static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl,
-      */
- #define SEG_CHUNK_SIZE 256
- 
--    NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld;
-+    QEMU_UNINITIALIZED NvmeSglDescriptor segment[SEG_CHUNK_SIZE];
-+    NvmeSglDescriptor *sgld, *last_sgld;
-     uint64_t nsgld;
-     uint32_t seg_len;
-     uint16_t status;
-@@ -5029,7 +5030,7 @@ static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
- static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
-                                     uint64_t off, NvmeRequest *req)
- {
--    uint32_t nslist[1024];
-+    uint32_t nslist[1024] = {};
-     uint32_t trans_len;
-     int i = 0;
-     uint32_t nsid;
-@@ -5039,7 +5040,6 @@ static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
-         return NVME_INVALID_FIELD | NVME_DNR;
-     }
- 
--    memset(nslist, 0x0, sizeof(nslist));
-     trans_len = MIN(sizeof(nslist) - off, buf_len);
- 
-     while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=
--- 
-2.39.3
-
diff --git a/kvm-hw-pci-Basic-support-for-PCI-power-management.patch b/kvm-hw-pci-Basic-support-for-PCI-power-management.patch
deleted file mode 100644
index 6287a46..0000000
--- a/kvm-hw-pci-Basic-support-for-PCI-power-management.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From 98b0cd83c09d35a3da0ae142c09038174355e87e Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 25 Feb 2025 14:52:25 -0700
-Subject: [PATCH 2/7] hw/pci: Basic support for PCI power management
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [2/6] 5faff6382c124711887704fff4f857e8f85e7be5 (eauger1/centos-qemu-kvm)
-
-Conflicts: contextual conflict in include/hw/pci/pci.h
-we don't have 449dca6ac93a ("pcie: enable Extended tag field support")
-downstream so we don't have x-pcie-ext-tag definition.
-
-The memory and IO BARs for devices are only accessible in the D0 power
-state.  In other power states the PCI spec defines that the device
-responds to TLPs and messages with an Unsupported Request response.
-
-To approximate this behavior, consider the BARs as unmapped when the
-device is not in the D0 power state.  This makes the BARs inaccessible
-and has the additional bonus for vfio-pci that we don't attempt to DMA
-map BARs for devices in a non-D0 power state.
-
-To support this, an interface is added for devices to register the PM
-capability, which allows central tracking to enforce valid transitions
-and unmap BARs in non-D0 states.
-
-NB. We currently have device models (eepro100 and pcie_pci_bridge)
-that register a PM capability but do not set wmask to enable writes to
-the power state field.  In order to maintain migration compatibility,
-this new helper does not manage the wmask to enable guest writes to
-initiate a power state change.  The contents and write access of the
-PM capability are still managed by the caller.
-
-Cc: Michael S. Tsirkin <mst@redhat.com>
-Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250225215237.3314011-2-alex.williamson@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 9461afd2008b0820fc45a6a7bc675df1b6791e4f)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/pci/pci.c                | 93 ++++++++++++++++++++++++++++++++++++-
- hw/pci/trace-events         |  2 +
- include/hw/pci/pci.h        |  3 ++
- include/hw/pci/pci_device.h |  3 ++
- 4 files changed, 99 insertions(+), 2 deletions(-)
-
-diff --git a/hw/pci/pci.c b/hw/pci/pci.c
-index 83c9d5b9ea..d774ae47d2 100644
---- a/hw/pci/pci.c
-+++ b/hw/pci/pci.c
-@@ -365,6 +365,84 @@ static void pci_msi_trigger(PCIDevice *dev, MSIMessage msg)
-                          attrs, NULL);
- }
- 
-+/*
-+ * Register and track a PM capability.  If wmask is also enabled for the power
-+ * state field of the pmcsr register, guest writes may change the device PM
-+ * state.  BAR access is only enabled while the device is in the D0 state.
-+ * Return the capability offset or negative error code.
-+ */
-+int pci_pm_init(PCIDevice *d, uint8_t offset, Error **errp)
-+{
-+    int cap = pci_add_capability(d, PCI_CAP_ID_PM, offset, PCI_PM_SIZEOF, errp);
-+
-+    if (cap < 0) {
-+        return cap;
-+    }
-+
-+    d->pm_cap = cap;
-+    d->cap_present |= QEMU_PCI_CAP_PM;
-+
-+    return cap;
-+}
-+
-+static uint8_t pci_pm_state(PCIDevice *d)
-+{
-+    uint16_t pmcsr;
-+
-+    if (!(d->cap_present & QEMU_PCI_CAP_PM)) {
-+        return 0;
-+    }
-+
-+    pmcsr = pci_get_word(d->config + d->pm_cap + PCI_PM_CTRL);
-+
-+    return pmcsr & PCI_PM_CTRL_STATE_MASK;
-+}
-+
-+/*
-+ * Update the PM capability state based on the new value stored in config
-+ * space respective to the old, pre-write state provided.  If the new value
-+ * is rejected (unsupported or invalid transition) restore the old value.
-+ * Return the resulting PM state.
-+ */
-+static uint8_t pci_pm_update(PCIDevice *d, uint32_t addr, int l, uint8_t old)
-+{
-+    uint16_t pmc;
-+    uint8_t new;
-+
-+    if (!(d->cap_present & QEMU_PCI_CAP_PM) ||
-+        !range_covers_byte(addr, l, d->pm_cap + PCI_PM_CTRL)) {
-+        return old;
-+    }
-+
-+    new = pci_pm_state(d);
-+    if (new == old) {
-+        return old;
-+    }
-+
-+    pmc = pci_get_word(d->config + d->pm_cap + PCI_PM_PMC);
-+
-+    /*
-+     * Transitions to D1 & D2 are only allowed if supported.  Devices may
-+     * only transition to higher D-states or to D0.
-+     */
-+    if ((!(pmc & PCI_PM_CAP_D1) && new == 1) ||
-+        (!(pmc & PCI_PM_CAP_D2) && new == 2) ||
-+        (old && new && new < old)) {
-+        pci_word_test_and_clear_mask(d->config + d->pm_cap + PCI_PM_CTRL,
-+                                     PCI_PM_CTRL_STATE_MASK);
-+        pci_word_test_and_set_mask(d->config + d->pm_cap + PCI_PM_CTRL,
-+                                   old);
-+        trace_pci_pm_bad_transition(d->name, pci_dev_bus_num(d),
-+                                    PCI_SLOT(d->devfn), PCI_FUNC(d->devfn),
-+                                    old, new);
-+        return old;
-+    }
-+
-+    trace_pci_pm_transition(d->name, pci_dev_bus_num(d), PCI_SLOT(d->devfn),
-+                            PCI_FUNC(d->devfn), old, new);
-+    return new;
-+}
-+
- static void pci_reset_regions(PCIDevice *dev)
- {
-     int r;
-@@ -404,6 +482,11 @@ static void pci_do_device_reset(PCIDevice *dev)
-                               pci_get_word(dev->wmask + PCI_INTERRUPT_LINE) |
-                               pci_get_word(dev->w1cmask + PCI_INTERRUPT_LINE));
-     dev->config[PCI_CACHE_LINE_SIZE] = 0x0;
-+    /* Default PM state is D0 */
-+    if (dev->cap_present & QEMU_PCI_CAP_PM) {
-+        pci_word_test_and_clear_mask(dev->config + dev->pm_cap + PCI_PM_CTRL,
-+                                     PCI_PM_CTRL_STATE_MASK);
-+    }
-     pci_reset_regions(dev);
-     pci_update_mappings(dev);
- 
-@@ -1525,7 +1608,7 @@ static void pci_update_mappings(PCIDevice *d)
-             continue;
- 
-         new_addr = pci_bar_address(d, i, r->type, r->size);
--        if (!d->enabled) {
-+        if (!d->enabled || pci_pm_state(d)) {
-             new_addr = PCI_BAR_UNMAPPED;
-         }
- 
-@@ -1591,6 +1674,7 @@ uint32_t pci_default_read_config(PCIDevice *d,
- 
- void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int l)
- {
-+    uint8_t new_pm_state, old_pm_state = pci_pm_state(d);
-     int i, was_irq_disabled = pci_irq_disabled(d);
-     uint32_t val = val_in;
- 
-@@ -1603,11 +1687,16 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int
-         d->config[addr + i] = (d->config[addr + i] & ~wmask) | (val & wmask);
-         d->config[addr + i] &= ~(val & w1cmask); /* W1C: Write 1 to Clear */
-     }
-+
-+    new_pm_state = pci_pm_update(d, addr, l, old_pm_state);
-+
-     if (ranges_overlap(addr, l, PCI_BASE_ADDRESS_0, 24) ||
-         ranges_overlap(addr, l, PCI_ROM_ADDRESS, 4) ||
-         ranges_overlap(addr, l, PCI_ROM_ADDRESS1, 4) ||
--        range_covers_byte(addr, l, PCI_COMMAND))
-+        range_covers_byte(addr, l, PCI_COMMAND) ||
-+        !!new_pm_state != !!old_pm_state) {
-         pci_update_mappings(d);
-+    }
- 
-     if (ranges_overlap(addr, l, PCI_COMMAND, 2)) {
-         pci_update_irq_disabled(d, was_irq_disabled);
-diff --git a/hw/pci/trace-events b/hw/pci/trace-events
-index 19643aa8c6..c82a87ffdd 100644
---- a/hw/pci/trace-events
-+++ b/hw/pci/trace-events
-@@ -1,6 +1,8 @@
- # See docs/devel/tracing.rst for syntax documentation.
- 
- # pci.c
-+pci_pm_bad_transition(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, uint8_t old, uint8_t new) "%s %02x:%02x.%x REJECTED PM transition D%d->D%d"
-+pci_pm_transition(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, uint8_t old, uint8_t new) "%s %02x:%02x.%x PM transition D%d->D%d"
- pci_update_mappings_del(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, int bar, uint64_t addr, uint64_t size) "%s %02x:%02x.%x %d,0x%"PRIx64"+0x%"PRIx64
- pci_update_mappings_add(const char *dev, uint32_t bus, uint32_t slot, uint32_t func, int bar, uint64_t addr, uint64_t size) "%s %02x:%02x.%x %d,0x%"PRIx64"+0x%"PRIx64
- pci_route_irq(int dev_irq, const char *dev_path, int parent_irq, const char *parent_path) "IRQ %d @%s -> IRQ %d @%s"
-diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
-index 45365ae085..afeb5a2263 100644
---- a/include/hw/pci/pci.h
-+++ b/include/hw/pci/pci.h
-@@ -213,6 +213,8 @@ enum {
-     QEMU_PCIE_ERR_UNC_MASK = (1 << QEMU_PCIE_ERR_UNC_MASK_BITNR),
- #define QEMU_PCIE_ARI_NEXTFN_1_BITNR 12
-     QEMU_PCIE_ARI_NEXTFN_1 = (1 << QEMU_PCIE_ARI_NEXTFN_1_BITNR),
-+#define QEMU_PCI_CAP_PM_BITNR 14
-+    QEMU_PCI_CAP_PM = (1 << QEMU_PCI_CAP_PM_BITNR),
- };
- 
- typedef struct PCIINTxRoute {
-@@ -680,5 +682,6 @@ static inline void pci_irq_pulse(PCIDevice *pci_dev)
- MSIMessage pci_get_msi_message(PCIDevice *dev, int vector);
- void pci_set_enabled(PCIDevice *pci_dev, bool state);
- void pci_set_power(PCIDevice *pci_dev, bool state);
-+int pci_pm_init(PCIDevice *pci_dev, uint8_t offset, Error **errp);
- 
- #endif
-diff --git a/include/hw/pci/pci_device.h b/include/hw/pci/pci_device.h
-index f38fb31119..325d7bcaf7 100644
---- a/include/hw/pci/pci_device.h
-+++ b/include/hw/pci/pci_device.h
-@@ -105,6 +105,9 @@ struct PCIDevice {
-     /* Capability bits */
-     uint32_t cap_present;
- 
-+    /* Offset of PM capability in config space */
-+    uint8_t pm_cap;
-+
-     /* Offset of MSI-X capability in config space */
-     uint8_t msix_cap;
- 
--- 
-2.48.1
-
diff --git a/kvm-hw-pci-Rename-has_power-to-enabled.patch b/kvm-hw-pci-Rename-has_power-to-enabled.patch
deleted file mode 100644
index 4041ddb..0000000
--- a/kvm-hw-pci-Rename-has_power-to-enabled.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 8711bb1a54d4f5734d44545cd8e7262bc358f51d Mon Sep 17 00:00:00 2001
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
-Date: Thu, 9 Jan 2025 15:29:46 +0900
-Subject: [PATCH 1/7] hw/pci: Rename has_power to enabled
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/6] ac8a7427a1203e33aa323933818a7114c0eb4520 (eauger1/centos-qemu-kvm)
-
-The renamed state will not only represent powering state of PFs, but
-also represent SR-IOV VF enablement in the future.
-
-Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-ID: <20250109-reuse-v19-1-f541e82ca5f7@daynix.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-(cherry picked from commit c407eef162f765dd83d45e048585731be41a66fc)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/pci/pci.c                | 17 +++++++++++------
- hw/pci/pci_host.c           |  4 ++--
- include/hw/pci/pci.h        |  1 +
- include/hw/pci/pci_device.h |  2 +-
- 4 files changed, 15 insertions(+), 9 deletions(-)
-
-diff --git a/hw/pci/pci.c b/hw/pci/pci.c
-index fab86d0567..83c9d5b9ea 100644
---- a/hw/pci/pci.c
-+++ b/hw/pci/pci.c
-@@ -1525,7 +1525,7 @@ static void pci_update_mappings(PCIDevice *d)
-             continue;
- 
-         new_addr = pci_bar_address(d, i, r->type, r->size);
--        if (!d->has_power) {
-+        if (!d->enabled) {
-             new_addr = PCI_BAR_UNMAPPED;
-         }
- 
-@@ -1613,7 +1613,7 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int
-         pci_update_irq_disabled(d, was_irq_disabled);
-         memory_region_set_enabled(&d->bus_master_enable_region,
-                                   (pci_get_word(d->config + PCI_COMMAND)
--                                   & PCI_COMMAND_MASTER) && d->has_power);
-+                                   & PCI_COMMAND_MASTER) && d->enabled);
-     }
- 
-     msi_write_config(d, addr, val_in, l);
-@@ -2886,16 +2886,21 @@ MSIMessage pci_get_msi_message(PCIDevice *dev, int vector)
- 
- void pci_set_power(PCIDevice *d, bool state)
- {
--    if (d->has_power == state) {
-+    pci_set_enabled(d, state);
-+}
-+
-+void pci_set_enabled(PCIDevice *d, bool state)
-+{
-+    if (d->enabled == state) {
-         return;
-     }
- 
--    d->has_power = state;
-+    d->enabled = state;
-     pci_update_mappings(d);
-     memory_region_set_enabled(&d->bus_master_enable_region,
-                               (pci_get_word(d->config + PCI_COMMAND)
--                               & PCI_COMMAND_MASTER) && d->has_power);
--    if (!d->has_power) {
-+                               & PCI_COMMAND_MASTER) && d->enabled);
-+    if (!d->enabled) {
-         pci_device_reset(d);
-     }
- }
-diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
-index dfe6fe6184..0d82727cc9 100644
---- a/hw/pci/pci_host.c
-+++ b/hw/pci/pci_host.c
-@@ -86,7 +86,7 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
-      * allowing direct removal of unexposed functions.
-      */
-     if ((pci_dev->qdev.hotplugged && !pci_get_function_0(pci_dev)) ||
--        !pci_dev->has_power || is_pci_dev_ejected(pci_dev)) {
-+        !pci_dev->enabled || is_pci_dev_ejected(pci_dev)) {
-         return;
-     }
- 
-@@ -111,7 +111,7 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr,
-      * allowing direct removal of unexposed functions.
-      */
-     if ((pci_dev->qdev.hotplugged && !pci_get_function_0(pci_dev)) ||
--        !pci_dev->has_power || is_pci_dev_ejected(pci_dev)) {
-+        !pci_dev->enabled || is_pci_dev_ejected(pci_dev)) {
-         return ~0x0;
-     }
- 
-diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
-index eb26cac810..45365ae085 100644
---- a/include/hw/pci/pci.h
-+++ b/include/hw/pci/pci.h
-@@ -678,6 +678,7 @@ static inline void pci_irq_pulse(PCIDevice *pci_dev)
- }
- 
- MSIMessage pci_get_msi_message(PCIDevice *dev, int vector);
-+void pci_set_enabled(PCIDevice *pci_dev, bool state);
- void pci_set_power(PCIDevice *pci_dev, bool state);
- 
- #endif
-diff --git a/include/hw/pci/pci_device.h b/include/hw/pci/pci_device.h
-index 15694f2489..f38fb31119 100644
---- a/include/hw/pci/pci_device.h
-+++ b/include/hw/pci/pci_device.h
-@@ -57,7 +57,7 @@ typedef struct PCIReqIDCache PCIReqIDCache;
- struct PCIDevice {
-     DeviceState qdev;
-     bool partially_hotplugged;
--    bool has_power;
-+    bool enabled;
- 
-     /* PCI config space */
-     uint8_t *config;
--- 
-2.48.1
-
diff --git a/kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch b/kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch
deleted file mode 100644
index 4b12664..0000000
--- a/kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 4c3fe6e7b88c58713c0c499d4bf0658a055ee52e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:03 +0100
-Subject: [PATCH 50/57] hw/ppc/spapr_tpm_proxy: skip automatic zero-init of
- large arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [24/30] 8d963380c64a33a27adc99738b42b52864229111 (stefanha/centos-stream-qemu-kvm)
-
-The 'tpm_execute' method has a pair of 4k arrays used for copying
-data between guest and host. Skip the automatic zero-init of these
-arrays to eliminate the performance overhead in the I/O hot path.
-
-The two arrays will be fully initialized when reading data from
-guest memory or reading data from the proxy FD.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-26-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 5dd9087fff74b5672526cad254e76f790fb35c7a)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/ppc/spapr_tpm_proxy.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/ppc/spapr_tpm_proxy.c b/hw/ppc/spapr_tpm_proxy.c
-index e10af35a18..88833d9e2e 100644
---- a/hw/ppc/spapr_tpm_proxy.c
-+++ b/hw/ppc/spapr_tpm_proxy.c
-@@ -41,8 +41,8 @@ static ssize_t tpm_execute(SpaprTpmProxy *tpm_proxy, target_ulong *args)
-     target_ulong data_in_size = args[2];
-     uint64_t data_out = ppc64_phys_to_real(args[3]);
-     target_ulong data_out_size = args[4];
--    uint8_t buf_in[TPM_SPAPR_BUFSIZE];
--    uint8_t buf_out[TPM_SPAPR_BUFSIZE];
-+    QEMU_UNINITIALIZED uint8_t buf_in[TPM_SPAPR_BUFSIZE];
-+    QEMU_UNINITIALIZED uint8_t buf_out[TPM_SPAPR_BUFSIZE];
-     ssize_t ret;
- 
-     trace_spapr_tpm_execute(data_in, data_in_size, data_out, data_out_size);
--- 
-2.39.3
-
diff --git a/kvm-hw-s390-ccw-device-Convert-to-three-phase-reset.patch b/kvm-hw-s390-ccw-device-Convert-to-three-phase-reset.patch
deleted file mode 100644
index d5b71e3..0000000
--- a/kvm-hw-s390-ccw-device-Convert-to-three-phase-reset.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 5126609c0714c66a0ec41328017e7e8388c78bf4 Mon Sep 17 00:00:00 2001
-From: Peter Maydell <peter.maydell@linaro.org>
-Date: Fri, 13 Sep 2024 15:31:43 +0100
-Subject: [PATCH 02/26] hw/s390/ccw-device: Convert to three-phase reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [2/26] 58f6fc2e65a101e069feac399859464d31e43045 (thuth/qemu-kvm-cs)
-
-Convert the TYPE_CCW_DEVICE to three-phase reset. This is a
-device class which is subclassed, so it needs to be three-phase
-before we can convert the subclass.
-
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20240830145812.1967042-2-peter.maydell@linaro.org
-(cherry picked from commit 6a0e10b76b68e2f412746a1d5ed7d6efee804864)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/ccw-device.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
-index d7bb364579..30f2fb486f 100644
---- a/hw/s390x/ccw-device.c
-+++ b/hw/s390x/ccw-device.c
-@@ -88,9 +88,9 @@ static Property ccw_device_properties[] = {
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--static void ccw_device_reset(DeviceState *d)
-+static void ccw_device_reset_hold(Object *obj, ResetType type)
- {
--    CcwDevice *ccw_dev = CCW_DEVICE(d);
-+    CcwDevice *ccw_dev = CCW_DEVICE(obj);
- 
-     css_reset_sch(ccw_dev->sch);
- }
-@@ -99,11 +99,12 @@ static void ccw_device_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     CCWDeviceClass *k = CCW_DEVICE_CLASS(klass);
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
-     k->realize = ccw_device_realize;
-     k->refill_ids = ccw_device_refill_ids;
-     device_class_set_props(dc, ccw_device_properties);
--    dc->reset = ccw_device_reset;
-+    rc->phases.hold = ccw_device_reset_hold;
-     dc->bus_type = TYPE_VIRTUAL_CSS_BUS;
- }
- 
--- 
-2.48.1
-
diff --git a/kvm-hw-s390-virtio-ccw-Convert-to-three-phase-reset.patch b/kvm-hw-s390-virtio-ccw-Convert-to-three-phase-reset.patch
deleted file mode 100644
index 15ea0b0..0000000
--- a/kvm-hw-s390-virtio-ccw-Convert-to-three-phase-reset.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 7cbf9be09907407a64d739a2d0862af2ad08eaf5 Mon Sep 17 00:00:00 2001
-From: Peter Maydell <peter.maydell@linaro.org>
-Date: Fri, 13 Sep 2024 15:31:43 +0100
-Subject: [PATCH 03/26] hw/s390/virtio-ccw: Convert to three-phase reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [3/26] e06ee194fa289a387433b905eb0999a048681a92 (thuth/qemu-kvm-cs)
-
-Convert the virtio-ccw code to three-phase reset.  This allows us to
-remove a call to device_class_set_parent_reset(), replacing it with
-the three-phase equivalent resettable_class_set_parent_phases().
-Removing all the device_class_set_parent_reset() uses will allow us
-to remove some of the glue code that interworks between three-phase
-and legacy reset.
-
-This is a simple conversion, with no behavioural changes.
-
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20240830145812.1967042-3-peter.maydell@linaro.org
-(cherry picked from commit 6affa00d6ebebf24485667fe146470b0d6feb90d)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/virtio-ccw.c | 13 ++++++++-----
- hw/s390x/virtio-ccw.h |  2 +-
- 2 files changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
-index b4676909dd..96747318d2 100644
---- a/hw/s390x/virtio-ccw.c
-+++ b/hw/s390x/virtio-ccw.c
-@@ -913,14 +913,15 @@ static void virtio_ccw_notify(DeviceState *d, uint16_t vector)
-     }
- }
- 
--static void virtio_ccw_reset(DeviceState *d)
-+static void virtio_ccw_reset_hold(Object *obj, ResetType type)
- {
--    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
-+    VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(obj);
-     VirtIOCCWDeviceClass *vdc = VIRTIO_CCW_DEVICE_GET_CLASS(dev);
- 
-     virtio_ccw_reset_virtio(dev);
--    if (vdc->parent_reset) {
--        vdc->parent_reset(d);
-+
-+    if (vdc->parent_phases.hold) {
-+        vdc->parent_phases.hold(obj, type);
-     }
- }
- 
-@@ -1233,11 +1234,13 @@ static void virtio_ccw_device_class_init(ObjectClass *klass, void *data)
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     CCWDeviceClass *k = CCW_DEVICE_CLASS(dc);
-     VirtIOCCWDeviceClass *vdc = VIRTIO_CCW_DEVICE_CLASS(klass);
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
-     k->unplug = virtio_ccw_busdev_unplug;
-     dc->realize = virtio_ccw_busdev_realize;
-     dc->unrealize = virtio_ccw_busdev_unrealize;
--    device_class_set_parent_reset(dc, virtio_ccw_reset, &vdc->parent_reset);
-+    resettable_class_set_parent_phases(rc, NULL, virtio_ccw_reset_hold, NULL,
-+                                       &vdc->parent_phases);
- }
- 
- static const TypeInfo virtio_ccw_device_info = {
-diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
-index fac186c8f6..c7a830a194 100644
---- a/hw/s390x/virtio-ccw.h
-+++ b/hw/s390x/virtio-ccw.h
-@@ -57,7 +57,7 @@ struct VirtIOCCWDeviceClass {
-     CCWDeviceClass parent_class;
-     void (*realize)(VirtioCcwDevice *dev, Error **errp);
-     void (*unrealize)(VirtioCcwDevice *dev);
--    void (*parent_reset)(DeviceState *dev);
-+    ResettablePhases parent_phases;
- };
- 
- /* Performance improves when virtqueue kick processing is decoupled from the
--- 
-2.48.1
-
diff --git a/kvm-hw-s390x-Build-an-IPLB-for-each-boot-device.patch b/kvm-hw-s390x-Build-an-IPLB-for-each-boot-device.patch
deleted file mode 100644
index 2b89353..0000000
--- a/kvm-hw-s390x-Build-an-IPLB-for-each-boot-device.patch
+++ /dev/null
@@ -1,270 +0,0 @@
-From ca648a6167953204a9ec55131e9aa836f63ab7e8 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:49 -0400
-Subject: [PATCH 16/27] hw/s390x: Build an IPLB for each boot device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [16/23] 4b87f66a28d9a34b0182e0a2c92af406d2e492a6 (thuth/qemu-kvm-cs9)
-
-Build an IPLB for any device with a bootindex (up to a maximum of 8 devices).
-
-The IPLB chain is placed immediately before the BIOS in memory. Because this
-is not a fixed address, the location of the next IPLB and number of remaining
-boot devices is stored in the QIPL global variable for possible later access by
-the guest during IPL.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-16-jrossi@linux.ibm.com>
-[thuth: Fix endianness problem when accessing the qipl structure]
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 0927875e704e93ace03bb7533c0877bf97e4bda9)
----
- hw/s390x/ipl.c              | 129 ++++++++++++++++++++++++++++--------
- hw/s390x/ipl.h              |   1 +
- include/hw/s390x/ipl/qipl.h |   4 +-
- 3 files changed, 105 insertions(+), 29 deletions(-)
-
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index d83832d975..f4576f8822 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -56,6 +56,13 @@ static bool iplb_extended_needed(void *opaque)
-     return ipl->iplbext_migration;
- }
- 
-+/* Place the IPLB chain immediately before the BIOS in memory */
-+static uint64_t find_iplb_chain_addr(uint64_t bios_addr, uint16_t count)
-+{
-+    return (bios_addr & TARGET_PAGE_MASK)
-+            - (count * sizeof(IplParameterBlock));
-+}
-+
- static const VMStateDescription vmstate_iplb_extended = {
-     .name = "ipl/iplb_extended",
-     .version_id = 0,
-@@ -398,6 +405,17 @@ static CcwDevice *s390_get_ccw_device(DeviceState *dev_st, int *devtype)
-     return ccw_dev;
- }
- 
-+static uint64_t s390_ipl_map_iplb_chain(IplParameterBlock *iplb_chain)
-+{
-+    S390IPLState *ipl = get_ipl_device();
-+    uint16_t count = be16_to_cpu(ipl->qipl.chain_len);
-+    uint64_t len = sizeof(IplParameterBlock) * count;
-+    uint64_t chain_addr = find_iplb_chain_addr(ipl->bios_start_addr, count);
-+
-+    cpu_physical_memory_write(chain_addr, iplb_chain, len);
-+    return chain_addr;
-+}
-+
- void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp)
- {
-     int i;
-@@ -428,54 +446,51 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp)
-     }
- }
- 
--static bool s390_gen_initial_iplb(S390IPLState *ipl)
-+static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
- {
--    DeviceState *dev_st;
-+    S390IPLState *ipl = get_ipl_device();
-     CcwDevice *ccw_dev = NULL;
-     SCSIDevice *sd;
-     int devtype;
-     uint8_t *lp;
- 
--    dev_st = get_boot_device(0);
--    if (dev_st) {
--        ccw_dev = s390_get_ccw_device(dev_st, &devtype);
--    }
--
-     /*
-      * Currently allow IPL only from CCW devices.
-      */
-+    ccw_dev = s390_get_ccw_device(dev_st, &devtype);
-     if (ccw_dev) {
-         lp = ccw_dev->loadparm;
- 
-         switch (devtype) {
-         case CCW_DEVTYPE_SCSI:
-             sd = SCSI_DEVICE(dev_st);
--            ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN);
--            ipl->iplb.blk0_len =
-+            iplb->len = cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN);
-+            iplb->blk0_len =
-                 cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN - S390_IPLB_HEADER_LEN);
--            ipl->iplb.pbt = S390_IPL_TYPE_QEMU_SCSI;
--            ipl->iplb.scsi.lun = cpu_to_be32(sd->lun);
--            ipl->iplb.scsi.target = cpu_to_be16(sd->id);
--            ipl->iplb.scsi.channel = cpu_to_be16(sd->channel);
--            ipl->iplb.scsi.devno = cpu_to_be16(ccw_dev->sch->devno);
--            ipl->iplb.scsi.ssid = ccw_dev->sch->ssid & 3;
-+            iplb->pbt = S390_IPL_TYPE_QEMU_SCSI;
-+            iplb->scsi.lun = cpu_to_be32(sd->lun);
-+            iplb->scsi.target = cpu_to_be16(sd->id);
-+            iplb->scsi.channel = cpu_to_be16(sd->channel);
-+            iplb->scsi.devno = cpu_to_be16(ccw_dev->sch->devno);
-+            iplb->scsi.ssid = ccw_dev->sch->ssid & 3;
-             break;
-         case CCW_DEVTYPE_VFIO:
--            ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
--            ipl->iplb.pbt = S390_IPL_TYPE_CCW;
--            ipl->iplb.ccw.devno = cpu_to_be16(ccw_dev->sch->devno);
--            ipl->iplb.ccw.ssid = ccw_dev->sch->ssid & 3;
-+            iplb->len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
-+            iplb->pbt = S390_IPL_TYPE_CCW;
-+            iplb->ccw.devno = cpu_to_be16(ccw_dev->sch->devno);
-+            iplb->ccw.ssid = ccw_dev->sch->ssid & 3;
-             break;
-         case CCW_DEVTYPE_VIRTIO_NET:
-+            /* The S390IPLState netboot is true if ANY IPLB may use netboot */
-             ipl->netboot = true;
-             /* Fall through to CCW_DEVTYPE_VIRTIO case */
-         case CCW_DEVTYPE_VIRTIO:
--            ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
--            ipl->iplb.blk0_len =
-+            iplb->len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
-+            iplb->blk0_len =
-                 cpu_to_be32(S390_IPLB_MIN_CCW_LEN - S390_IPLB_HEADER_LEN);
--            ipl->iplb.pbt = S390_IPL_TYPE_CCW;
--            ipl->iplb.ccw.devno = cpu_to_be16(ccw_dev->sch->devno);
--            ipl->iplb.ccw.ssid = ccw_dev->sch->ssid & 3;
-+            iplb->pbt = S390_IPL_TYPE_CCW;
-+            iplb->ccw.devno = cpu_to_be16(ccw_dev->sch->devno);
-+            iplb->ccw.ssid = ccw_dev->sch->ssid & 3;
-             break;
-         }
- 
-@@ -484,8 +499,8 @@ static bool s390_gen_initial_iplb(S390IPLState *ipl)
-             lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
-         }
- 
--        s390_ipl_convert_loadparm((char *)lp, ipl->iplb.loadparm);
--        ipl->iplb.flags |= DIAG308_FLAGS_LP_VALID;
-+        s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
-+        iplb->flags |= DIAG308_FLAGS_LP_VALID;
- 
-         return true;
-     }
-@@ -493,6 +508,62 @@ static bool s390_gen_initial_iplb(S390IPLState *ipl)
-     return false;
- }
- 
-+static bool s390_init_all_iplbs(S390IPLState *ipl)
-+{
-+    int iplb_num = 0;
-+    IplParameterBlock iplb_chain[7];
-+    DeviceState *dev_st = get_boot_device(0);
-+    Object *machine = qdev_get_machine();
-+
-+    /*
-+     * Parse the boot devices.  Generate an IPLB for only the first boot device
-+     * which will later be set with DIAG308.
-+     */
-+    if (!dev_st) {
-+        ipl->qipl.chain_len = 0;
-+        return false;
-+    }
-+
-+    /* If no machine loadparm was defined fill it with spaces */
-+    if (memcmp(S390_CCW_MACHINE(machine)->loadparm, NO_LOADPARM, 8) == 0) {
-+        object_property_set_str(machine, "loadparm", "        ", NULL);
-+    }
-+
-+    iplb_num = 1;
-+    s390_build_iplb(dev_st, &ipl->iplb);
-+
-+    /*  Index any fallback boot devices */
-+    while (get_boot_device(iplb_num)) {
-+        iplb_num++;
-+    }
-+
-+    if (iplb_num > MAX_BOOT_DEVS) {
-+        warn_report("Excess boot devices defined! %d boot devices found, "
-+                    "but only the first %d will be considered.",
-+                    iplb_num, MAX_BOOT_DEVS);
-+
-+        iplb_num = MAX_BOOT_DEVS;
-+    }
-+
-+    ipl->qipl.chain_len = cpu_to_be16(iplb_num - 1);
-+
-+    /*
-+     * Build fallback IPLBs for any boot devices above index 0, up to a
-+     * maximum amount as defined in ipl.h
-+     */
-+    if (iplb_num > 1) {
-+        /* Start at 1 because the IPLB for boot index 0 is not chained */
-+        for (int i = 1; i < iplb_num; i++) {
-+            dev_st = get_boot_device(i);
-+            s390_build_iplb(dev_st, &iplb_chain[i - 1]);
-+        }
-+
-+        ipl->qipl.next_iplb = cpu_to_be64(s390_ipl_map_iplb_chain(iplb_chain));
-+    }
-+
-+    return iplb_num;
-+}
-+
- static bool is_virtio_ccw_device_of_type(IplParameterBlock *iplb,
-                                          int virtio_id)
- {
-@@ -620,7 +691,7 @@ void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type)
-              * this is the original boot device's SCSI
-              * so restore IPL parameter info from it
-              */
--            ipl->iplb_valid = s390_gen_initial_iplb(ipl);
-+            ipl->iplb_valid = s390_build_iplb(get_boot_device(0), &ipl->iplb);
-         }
-     }
-     if (reset_type == S390_RESET_MODIFIED_CLEAR ||
-@@ -714,7 +785,9 @@ void s390_ipl_prepare_cpu(S390CPU *cpu)
-     if (!ipl->kernel || ipl->iplb_valid) {
-         cpu->env.psw.addr = ipl->bios_start_addr;
-         if (!ipl->iplb_valid) {
--            ipl->iplb_valid = s390_gen_initial_iplb(ipl);
-+            ipl->iplb_valid = s390_init_all_iplbs(ipl);
-+        } else {
-+            ipl->qipl.chain_len = 0;
-         }
-     }
-     s390_ipl_set_boot_menu(ipl);
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index b670bad551..54eb48fd6e 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -20,6 +20,7 @@
- #include "qom/object.h"
- 
- #define DIAG308_FLAGS_LP_VALID 0x80
-+#define MAX_BOOT_DEVS 8 /* Max number of devices that may have a bootindex */
- 
- void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp);
- void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp);
-diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h
-index b67d2ae061..1da4f75aa8 100644
---- a/include/hw/s390x/ipl/qipl.h
-+++ b/include/hw/s390x/ipl/qipl.h
-@@ -32,7 +32,9 @@ struct QemuIplParameters {
-     uint8_t  reserved1[3];
-     uint64_t reserved2;
-     uint32_t boot_menu_timeout;
--    uint8_t  reserved3[12];
-+    uint8_t  reserved3[2];
-+    uint16_t chain_len;
-+    uint64_t next_iplb;
- } QEMU_PACKED;
- typedef struct QemuIplParameters QemuIplParameters;
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-s390x-Remove-the-possibility-to-load-the-s390-net.patch b/kvm-hw-s390x-Remove-the-possibility-to-load-the-s390-net.patch
deleted file mode 100644
index b5b820d..0000000
--- a/kvm-hw-s390x-Remove-the-possibility-to-load-the-s390-net.patch
+++ /dev/null
@@ -1,201 +0,0 @@
-From 99d6e739324ff1be46ad89a2682978cc1fa3a56c Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 20 Jun 2024 16:59:28 +0200
-Subject: [PATCH 05/27] hw/s390x: Remove the possibility to load the
- s390-netboot.img binary
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/23] e4e037f24be08626c02f8e870992e8f0a5ed505e (thuth/qemu-kvm-cs9)
-
-Since the netboot code has now been merged into the main s390-ccw.img
-binary, we don't need the separate s390-netboot.img anymore. Remove
-it and the code that was responsible for loading it.
-
-Message-Id: <20240621082422.136217-6-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 188e255bf8ed68fa64bcb63577cb100eeb326254)
----
- hw/s390x/ipl.c             | 55 --------------------------------------
- hw/s390x/ipl.h             | 12 +++------
- hw/s390x/s390-virtio-ccw.c | 10 ++-----
- pc-bios/meson.build        |  1 -
- 4 files changed, 6 insertions(+), 72 deletions(-)
-
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index 9362de0b6f..8a0a3e6961 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -288,7 +288,6 @@ static Property s390_ipl_properties[] = {
-     DEFINE_PROP_STRING("initrd", S390IPLState, initrd),
-     DEFINE_PROP_STRING("cmdline", S390IPLState, cmdline),
-     DEFINE_PROP_STRING("firmware", S390IPLState, firmware),
--    DEFINE_PROP_STRING("netboot_fw", S390IPLState, netboot_fw),
-     DEFINE_PROP_BOOL("enforce_bios", S390IPLState, enforce_bios, false),
-     DEFINE_PROP_BOOL("iplbext_migration", S390IPLState, iplbext_migration,
-                      true),
-@@ -480,56 +479,6 @@ int s390_ipl_set_loadparm(uint8_t *loadparm)
-     return -1;
- }
- 
--static int load_netboot_image(Error **errp)
--{
--    MachineState *ms = MACHINE(qdev_get_machine());
--    S390IPLState *ipl = get_ipl_device();
--    char *netboot_filename;
--    MemoryRegion *sysmem =  get_system_memory();
--    MemoryRegion *mr = NULL;
--    void *ram_ptr = NULL;
--    int img_size = -1;
--
--    mr = memory_region_find(sysmem, 0, 1).mr;
--    if (!mr) {
--        error_setg(errp, "Failed to find memory region at address 0");
--        return -1;
--    }
--
--    ram_ptr = memory_region_get_ram_ptr(mr);
--    if (!ram_ptr) {
--        error_setg(errp, "No RAM found");
--        goto unref_mr;
--    }
--
--    netboot_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, ipl->netboot_fw);
--    if (netboot_filename == NULL) {
--        error_setg(errp, "Could not find network bootloader '%s'",
--                   ipl->netboot_fw);
--        goto unref_mr;
--    }
--
--    img_size = load_elf_ram(netboot_filename, NULL, NULL, NULL,
--                            &ipl->start_addr,
--                            NULL, NULL, NULL, 1, EM_S390, 0, 0, NULL,
--                            false);
--
--    if (img_size < 0) {
--        img_size = load_image_size(netboot_filename, ram_ptr, ms->ram_size);
--        ipl->start_addr = KERN_IMAGE_START;
--    }
--
--    if (img_size < 0) {
--        error_setg(errp, "Failed to load network bootloader");
--    }
--
--    g_free(netboot_filename);
--
--unref_mr:
--    memory_region_unref(mr);
--    return img_size;
--}
--
- static bool is_virtio_ccw_device_of_type(IplParameterBlock *iplb,
-                                          int virtio_id)
- {
-@@ -754,10 +703,6 @@ void s390_ipl_prepare_cpu(S390CPU *cpu)
-             ipl->iplb_valid = s390_gen_initial_iplb(ipl);
-         }
-     }
--    if (ipl->netboot) {
--        load_netboot_image(&error_fatal);
--        ipl->qipl.netboot_start_addr = cpu_to_be64(ipl->start_addr);
--    }
-     s390_ipl_set_boot_menu(ipl);
-     s390_ipl_prepare_qipl(cpu);
- }
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index 57cd125769..b2105b616a 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -134,11 +134,8 @@ void s390_ipl_clear_reset_request(void);
- /*
-  * The QEMU IPL Parameters will be stored at absolute address
-  * 204 (0xcc) which means it is 32-bit word aligned but not
-- * double-word aligned.
-- * Placement of data fields in this area must account for
-- * their alignment needs. E.g., netboot_start_address must
-- * have an offset of 4 + n * 8 bytes within the struct in order
-- * to keep it double-word aligned.
-+ * double-word aligned. Placement of 64-bit data fields in this
-+ * area must account for their alignment needs.
-  * The total size of the struct must never exceed 28 bytes.
-  * This definition must be kept in sync with the definition
-  * in pc-bios/s390-ccw/iplb.h.
-@@ -146,9 +143,9 @@ void s390_ipl_clear_reset_request(void);
- struct QemuIplParameters {
-     uint8_t  qipl_flags;
-     uint8_t  reserved1[3];
--    uint64_t netboot_start_addr;
-+    uint64_t reserved2;
-     uint32_t boot_menu_timeout;
--    uint8_t  reserved2[12];
-+    uint8_t  reserved3[12];
- } QEMU_PACKED;
- typedef struct QemuIplParameters QemuIplParameters;
- 
-@@ -178,7 +175,6 @@ struct S390IPLState {
-     char *initrd;
-     char *cmdline;
-     char *firmware;
--    char *netboot_fw;
-     uint8_t cssid;
-     uint8_t ssid;
-     uint16_t devno;
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index a4a6ffa053..5113313aa8 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -197,11 +197,10 @@ static void s390_memory_init(MemoryRegion *ram)
- static void s390_init_ipl_dev(const char *kernel_filename,
-                               const char *kernel_cmdline,
-                               const char *initrd_filename, const char *firmware,
--                              const char *netboot_fw, bool enforce_bios)
-+                              bool enforce_bios)
- {
-     Object *new = object_new(TYPE_S390_IPL);
-     DeviceState *dev = DEVICE(new);
--    char *netboot_fw_prop;
- 
-     if (kernel_filename) {
-         qdev_prop_set_string(dev, "kernel", kernel_filename);
-@@ -212,11 +211,6 @@ static void s390_init_ipl_dev(const char *kernel_filename,
-     qdev_prop_set_string(dev, "cmdline", kernel_cmdline);
-     qdev_prop_set_string(dev, "firmware", firmware);
-     qdev_prop_set_bit(dev, "enforce_bios", enforce_bios);
--    netboot_fw_prop = object_property_get_str(new, "netboot_fw", &error_abort);
--    if (!strlen(netboot_fw_prop)) {
--        qdev_prop_set_string(dev, "netboot_fw", netboot_fw);
--    }
--    g_free(netboot_fw_prop);
-     object_property_add_child(qdev_get_machine(), TYPE_S390_IPL,
-                               new);
-     object_unref(new);
-@@ -284,7 +278,7 @@ static void ccw_init(MachineState *machine)
-     s390_init_ipl_dev(machine->kernel_filename, machine->kernel_cmdline,
-                       machine->initrd_filename,
-                       machine->firmware ?: "s390-ccw.img",
--                      "s390-netboot.img", true);
-+                      true);
- 
-     dev = qdev_new(TYPE_S390_PCI_HOST_BRIDGE);
-     object_property_add_child(qdev_get_machine(), TYPE_S390_PCI_HOST_BRIDGE,
-diff --git a/pc-bios/meson.build b/pc-bios/meson.build
-index 8602b45b9b..ea85c54c86 100644
---- a/pc-bios/meson.build
-+++ b/pc-bios/meson.build
-@@ -66,7 +66,6 @@ blobs = [
-   'kvmvapic.bin',
-   'pvh.bin',
-   's390-ccw.img',
--  's390-netboot.img',
-   'slof.bin',
-   'skiboot.lid',
-   'palcode-clipper',
--- 
-2.39.3
-
diff --git a/kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch b/kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch
deleted file mode 100644
index 3395dec..0000000
--- a/kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From ffffba85b269096d25fef307b342b8f576610d34 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Wed, 13 Nov 2024 12:47:41 +0100
-Subject: [PATCH 04/10] hw/s390x: Restrict "loadparm" property to devices that
- can be used for booting
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/8] e381997b44f5b8c80a90ae99f5ae5d863f6d5aa5 (thuth/qemu-kvm-cs9)
-
-Commit bb185de423 ("s390x: Add individual loadparm assignment to
-CCW device") added a "loadparm" property to all CCW devices. This
-was a little bit unfortunate, since this property is only useful
-for devices that can be used for booting, but certainly it is not
-useful for devices like virtio-gpu or virtio-tablet.
-
-Thus let's restrict the property to CCW devices that we can boot from
-(i.e. virtio-block, virtio-net and vfio-ccw devices).
-
-Message-ID: <20241113114741.681096-1-thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 6e7c96ae61e0542e97d385084f1f2281a0331054)
----
- hw/s390x/ccw-device.c     | 4 +---
- hw/s390x/ccw-device.h     | 5 +++++
- hw/s390x/virtio-ccw-blk.c | 1 +
- hw/s390x/virtio-ccw-net.c | 1 +
- hw/vfio/ccw.c             | 1 +
- 5 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
-index 4e54f34b1c..d7bb364579 100644
---- a/hw/s390x/ccw-device.c
-+++ b/hw/s390x/ccw-device.c
-@@ -73,7 +73,7 @@ static void ccw_device_set_loadparm(Object *obj, Visitor *v,
-     s390_ipl_fmt_loadparm(dev->loadparm, val, errp);
- }
- 
--static const PropertyInfo ccw_loadparm = {
-+const PropertyInfo ccw_loadparm = {
-     .name  = "ccw_loadparm",
-     .description = "Up to 8 chars in set of [A-Za-z0-9. ] to pass"
-             " to the guest loader/kernel",
-@@ -85,8 +85,6 @@ static Property ccw_device_properties[] = {
-     DEFINE_PROP_CSS_DEV_ID("devno", CcwDevice, devno),
-     DEFINE_PROP_CSS_DEV_ID_RO("dev_id", CcwDevice, dev_id),
-     DEFINE_PROP_CSS_DEV_ID_RO("subch_id", CcwDevice, subch_id),
--    DEFINE_PROP("loadparm", CcwDevice, loadparm, ccw_loadparm,
--            typeof(uint8_t[8])),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/s390x/ccw-device.h b/hw/s390x/ccw-device.h
-index 1e1737c0f3..4439feb140 100644
---- a/hw/s390x/ccw-device.h
-+++ b/hw/s390x/ccw-device.h
-@@ -51,4 +51,9 @@ static inline CcwDevice *to_ccw_dev_fast(DeviceState *d)
- 
- OBJECT_DECLARE_TYPE(CcwDevice, CCWDeviceClass, CCW_DEVICE)
- 
-+extern const PropertyInfo ccw_loadparm;
-+
-+#define DEFINE_PROP_CCW_LOADPARM(_n, _s, _f) \
-+    DEFINE_PROP(_n, _s, _f, ccw_loadparm, typeof(uint8_t[8]))
-+
- #endif
-diff --git a/hw/s390x/virtio-ccw-blk.c b/hw/s390x/virtio-ccw-blk.c
-index 8e0e58b77d..2364432c6e 100644
---- a/hw/s390x/virtio-ccw-blk.c
-+++ b/hw/s390x/virtio-ccw-blk.c
-@@ -48,6 +48,7 @@ static Property virtio_ccw_blk_properties[] = {
-                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
-     DEFINE_PROP_UINT32("max_revision", VirtioCcwDevice, max_rev,
-                        VIRTIO_CCW_MAX_REV),
-+    DEFINE_PROP_CCW_LOADPARM("loadparm", CcwDevice, loadparm),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/s390x/virtio-ccw-net.c b/hw/s390x/virtio-ccw-net.c
-index 484e617659..a4a3f65c7e 100644
---- a/hw/s390x/virtio-ccw-net.c
-+++ b/hw/s390x/virtio-ccw-net.c
-@@ -51,6 +51,7 @@ static Property virtio_ccw_net_properties[] = {
-                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
-     DEFINE_PROP_UINT32("max_revision", VirtioCcwDevice, max_rev,
-                        VIRTIO_CCW_MAX_REV),
-+    DEFINE_PROP_CCW_LOADPARM("loadparm", CcwDevice, loadparm),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index 115862f430..99f16614ad 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -662,6 +662,7 @@ static Property vfio_ccw_properties[] = {
-     DEFINE_PROP_LINK("iommufd", VFIOCCWDevice, vdev.iommufd,
-                      TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
- #endif
-+    DEFINE_PROP_CCW_LOADPARM("loadparm", CcwDevice, loadparm),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch b/kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch
deleted file mode 100644
index 5bf4b1a..0000000
--- a/kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From b25bbfcad4a3df94555f6b5f238910314a5d17ea Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 25 Jun 2025 10:27:51 +0200
-Subject: [PATCH 02/57] hw/s390x/ccw-device: Fix memory leak in loadparm setter
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 387: s390x: Fix memory leaks related to loadparm [rhel-9]
-RH-Jira: RHEL-98554
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [2/2] d85cf8b3c93ede47b51c4aa1336dc54f58b8cc3f (thuth/qemu-kvm-cs)
-
-Commit bdf12f2a fixed the setter for the "loadparm" machine property,
-which gets a string from a visitor, passes it to s390_ipl_fmt_loadparm()
-and then forgot to free it. It left another instance of the same problem
-unfixed in the "loadparm" device property. Fix it.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20250625082751.24896-1-kwolf@redhat.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
-Tested-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 78e3781541209b3dcd6f4bb66adf3a3e504b88a4)
----
- hw/s390x/ccw-device.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
-index 30f2fb486f..63e937401e 100644
---- a/hw/s390x/ccw-device.c
-+++ b/hw/s390x/ccw-device.c
-@@ -57,7 +57,7 @@ static void ccw_device_set_loadparm(Object *obj, Visitor *v,
-                                  Error **errp)
- {
-     CcwDevice *dev = CCW_DEVICE(obj);
--    char *val;
-+    g_autofree char *val = NULL;
-     int index;
- 
-     index = object_property_get_int(obj, "bootindex", NULL);
--- 
-2.39.3
-
diff --git a/kvm-hw-s390x-ipl-Provide-more-memory-to-the-s390-ccw.img.patch b/kvm-hw-s390x-ipl-Provide-more-memory-to-the-s390-ccw.img.patch
deleted file mode 100644
index 3e333d4..0000000
--- a/kvm-hw-s390x-ipl-Provide-more-memory-to-the-s390-ccw.img.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 22693a98eca5872f87249006d873a95e71c448f2 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Fri, 21 Jun 2024 10:24:17 +0200
-Subject: [PATCH 01/27] hw/s390x/ipl: Provide more memory to the s390-ccw.img
- firmware
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/23] b54cc7784876becb9fcec189811f505c22119b72 (thuth/qemu-kvm-cs9)
-
-We are going to link the SLOF libc into the s390-ccw.img, and this
-libc needs more memory for providing space for malloc() and friends.
-Thus bump the memory size that we reserve for the bios to 3 MiB
-instead of only 2 MiB. While we're at it, add a proper check that
-there is really enough memory assigned to the machine before blindly
-using it.
-
-Message-ID: <20240621082422.136217-3-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit abaabb2e601adfe296a64471746a997eabcc607f)
----
- hw/s390x/ipl.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index e934bf89d1..9362de0b6f 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -45,6 +45,7 @@
- #define INITRD_PARM_START               0x010408UL
- #define PARMFILE_START                  0x001000UL
- #define ZIPL_IMAGE_START                0x009000UL
-+#define BIOS_MAX_SIZE                   0x300000UL
- #define IPL_PSW_MASK                    (PSW_MASK_32 | PSW_MASK_64)
- 
- static bool iplb_extended_needed(void *opaque)
-@@ -144,7 +145,14 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
-      * even if an external kernel has been defined.
-      */
-     if (!ipl->kernel || ipl->enforce_bios) {
--        uint64_t fwbase = (MIN(ms->ram_size, 0x80000000U) - 0x200000) & ~0xffffUL;
-+        uint64_t fwbase;
-+
-+        if (ms->ram_size < BIOS_MAX_SIZE) {
-+            error_setg(errp, "not enough RAM to load the BIOS file");
-+            return;
-+        }
-+
-+        fwbase = (MIN(ms->ram_size, 0x80000000U) - BIOS_MAX_SIZE) & ~0xffffUL;
- 
-         bios_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, ipl->firmware);
-         if (bios_filename == NULL) {
--- 
-2.39.3
-
diff --git a/kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch b/kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch
deleted file mode 100644
index 77a1f92..0000000
--- a/kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 45884bfad1f14585407a04eff9230a75bc5095fa Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:05 +0100
-Subject: [PATCH 52/57] hw/scsi/lsi53c895a: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [26/30] 235884d43fcb3e49b320e36faa631a3656d07de6 (stefanha/centos-stream-qemu-kvm)
-
-The 'lsi_memcpy' method has a 4k byte array used for copying data
-to/from the device. Skip the automatic zero-init of this array to
-eliminate the performance overhead in the I/O hot path.
-
-The 'buf' array will be fully initialized when data is copied.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-28-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 55243edf42ee87bce9f36ca251f3ab9cda1563e4)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/scsi/lsi53c895a.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
-index f1935e5328..f165705f8a 100644
---- a/hw/scsi/lsi53c895a.c
-+++ b/hw/scsi/lsi53c895a.c
-@@ -1112,7 +1112,7 @@ bad:
- static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
- {
-     int n;
--    uint8_t buf[LSI_BUF_SIZE];
-+    QEMU_UNINITIALIZED uint8_t buf[LSI_BUF_SIZE];
- 
-     trace_lsi_memcpy(dest, src, count);
-     while (count) {
--- 
-2.39.3
-
diff --git a/kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch b/kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch
deleted file mode 100644
index 140160c..0000000
--- a/kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 9f76103e90ce8406bc5bbda72a7314b82e56652e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:06 +0100
-Subject: [PATCH 53/57] hw/scsi/megasas: skip automatic zero-init of large
- arrays
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [27/30] b3a3f466fd03c64c665c52e26079b03def376f48 (stefanha/centos-stream-qemu-kvm)
-
-The 'megasas_dcmd_pd_get_list' and 'megasas_dcmd_get_properties'
-methods have 4k structs used for copying data from the device.
-Skip the automatic zero-init of this array to eliminate the
-performance overhead in the I/O hot path.
-
-The 'info' structs are manually initialized with memset(). The
-compiler ought to be intelligent enough to turn the memset()
-into a static initialization operation, and thus not duplicate
-the automatic zero-init. Replacing memset() with '{}' makes it
-unambiguous that the arrays are statically initialized.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-29-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit ca0559e2350c618048f7caf80cb79c1259e7cfd2)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/scsi/megasas.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
-index 2d0c607177..91b65accbc 100644
---- a/hw/scsi/megasas.c
-+++ b/hw/scsi/megasas.c
-@@ -981,13 +981,11 @@ static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
- 
- static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
- {
--    struct mfi_pd_list info;
--    size_t dcmd_size = sizeof(info);
-+    struct mfi_pd_list info = {};
-     BusChild *kid;
-     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
-     dma_addr_t residual;
- 
--    memset(&info, 0, dcmd_size);
-     offset = 8;
-     dcmd_limit = offset + sizeof(struct mfi_pd_address);
-     if (cmd->iov_size < dcmd_limit) {
-@@ -1429,11 +1427,10 @@ static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
- 
- static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
- {
--    struct mfi_ctrl_props info;
-+    struct mfi_ctrl_props info = {};
-     size_t dcmd_size = sizeof(info);
-     dma_addr_t residual;
- 
--    memset(&info, 0x0, dcmd_size);
-     if (cmd->iov_size < dcmd_size) {
-         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
-                                             dcmd_size);
--- 
-2.39.3
-
diff --git a/kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch b/kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index 175b89b..0000000
--- a/kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 3a0ae5a2f873fc7062262efc24a5403233988f5f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:07 +0100
-Subject: [PATCH 54/57] hw/ufs/lu: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [28/30] 62e7c83d15143387f6d6b366c8ec46b312d05577 (stefanha/centos-stream-qemu-kvm)
-
-The 'ufs_emulate_scsi_cmd' method has a 4k byte array used for
-copying data from the device. Skip the automatic zero-init of
-this array to eliminate the performance overhead in the I/O hot
-path.
-
-The 'outbuf' array will be fully initialized when data is copied
-from the guest.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-30-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7708e298180550eac262c1fd742e6e80c711a5d8)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/ufs/lu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c
-index 81bfff9b4e..caad82dcc4 100644
---- a/hw/ufs/lu.c
-+++ b/hw/ufs/lu.c
-@@ -194,7 +194,7 @@ static int ufs_emulate_wlun_inquiry(UfsRequest *req, uint8_t *outbuf,
- static UfsReqResult ufs_emulate_scsi_cmd(UfsLu *lu, UfsRequest *req)
- {
-     uint8_t lun = lu->lun;
--    uint8_t outbuf[4096];
-+    QEMU_UNINITIALIZED uint8_t outbuf[4096];
-     uint8_t sense_buf[UFS_SENSE_SIZE];
-     uint8_t scsi_status;
-     int len = 0;
--- 
-2.39.3
-
diff --git a/kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch b/kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch
deleted file mode 100644
index b5daa5b..0000000
--- a/kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 6d4761010ea4dc218a1623513f410fc2d1cfc832 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:04 +0100
-Subject: [PATCH 51/57] hw/usb/hcd-ohci: skip automatic zero-init of large
- array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [25/30] 721dd97d384fb755c4a6a00cfc3d867e43f25b0b (stefanha/centos-stream-qemu-kvm)
-
-The 'ohci_service_iso_td' method has a 8k byte array used for copying
-data between guest and host. Skip the automatic zero-init of this
-array to eliminate the performance overhead in the I/O hot path.
-
-The 'buf' array will be fully initialized when reading data from guest
-memory.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-27-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 14997d521d1cd0bb36c902ef1032f0d3f2a3c912)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/usb/hcd-ohci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
-index 71b54914d3..72a9f9f474 100644
---- a/hw/usb/hcd-ohci.c
-+++ b/hw/usb/hcd-ohci.c
-@@ -577,7 +577,7 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed)
-     USBDevice *dev;
-     USBEndpoint *ep;
-     USBPacket *pkt;
--    uint8_t buf[8192];
-+    QEMU_UNINITIALIZED uint8_t buf[8192];
-     bool int_req;
-     struct ohci_iso_td iso_td;
-     uint32_t addr;
--- 
-2.39.3
-
diff --git a/kvm-hw-vfio-common-Add-a-trace-point-in-vfio_reset_handl.patch b/kvm-hw-vfio-common-Add-a-trace-point-in-vfio_reset_handl.patch
deleted file mode 100644
index 0c06398..0000000
--- a/kvm-hw-vfio-common-Add-a-trace-point-in-vfio_reset_handl.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 04f11749dd21b4df1ea2818785d650dd6eee2cbe Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 18 Feb 2025 19:25:34 +0100
-Subject: [PATCH 4/9] hw/vfio/common: Add a trace point in vfio_reset_handler
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 341: Fix vIOMMU reset order
-RH-Jira: RHEL-7188
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Donald Dutile <None>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [4/5] 46878ffdc96997d1f6d09bde3fce350564e499fd (eauger1/centos-qemu-kvm)
-
-To ease the debug of reset sequence, let's add a trace point
-in vfio_reset_handler()
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Message-Id: <20250218182737.76722-5-eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit d410e709526d1cd4aa9085c6e254a622594a02a5)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c     | 1 +
- hw/vfio/trace-events | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 36d0cf6585..6982f88fc8 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1395,6 +1395,7 @@ void vfio_reset_handler(void *opaque)
- {
-     VFIODevice *vbasedev;
- 
-+    trace_vfio_reset_handler();
-     QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-         if (vbasedev->dev->realized) {
-             vbasedev->ops->vfio_compute_needs_reset(vbasedev);
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 3756ff660e..9523a9ccb0 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -120,6 +120,7 @@ vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype
- vfio_legacy_dma_unmap_overflow_workaround(void) ""
- vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
- vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
-+vfio_reset_handler(void) ""
- 
- # platform.c
- vfio_platform_realize(char *name, char *compat) "vfio device %s, compat = %s"
--- 
-2.48.1
-
diff --git a/kvm-hw-vfio-pci-Re-order-pre-reset.patch b/kvm-hw-vfio-pci-Re-order-pre-reset.patch
deleted file mode 100644
index 7318f84..0000000
--- a/kvm-hw-vfio-pci-Re-order-pre-reset.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From d6a961077e753b9ad5a670a1529634fe20322ce2 Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 25 Feb 2025 14:52:29 -0700
-Subject: [PATCH 6/7] hw/vfio/pci: Re-order pre-reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [6/6] c6c386ecbabda93f8a79da926ece95c2195fbc36 (eauger1/centos-qemu-kvm)
-
-We want the device in the D0 power state going into reset, but the
-config write can enable the BARs in the address space, which are
-then removed from the address space once we clear the memory enable
-bit in the command register.  Re-order to clear the command bit
-first, so the power state change doesn't enable the BARs.
-
-Cc: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250225215237.3314011-6-alex.williamson@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 518a69a598916749338de3852d41d961d4503115)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/pci.c | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 595b5c9b25..ffe72fd1d0 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2414,6 +2414,15 @@ void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
- 
-     vfio_disable_interrupts(vdev);
- 
-+    /*
-+     * Stop any ongoing DMA by disconnecting I/O, MMIO, and bus master.
-+     * Also put INTx Disable in known state.
-+     */
-+    cmd = vfio_pci_read_config(pdev, PCI_COMMAND, 2);
-+    cmd &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER |
-+             PCI_COMMAND_INTX_DISABLE);
-+    vfio_pci_write_config(pdev, PCI_COMMAND, cmd, 2);
-+
-     /* Make sure the device is in D0 */
-     if (pdev->pm_cap) {
-         uint16_t pmcsr;
-@@ -2433,15 +2442,6 @@ void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
-             }
-         }
-     }
--
--    /*
--     * Stop any ongoing DMA by disconnecting I/O, MMIO, and bus master.
--     * Also put INTx Disable in known state.
--     */
--    cmd = vfio_pci_read_config(pdev, PCI_COMMAND, 2);
--    cmd &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER |
--             PCI_COMMAND_INTX_DISABLE);
--    vfio_pci_write_config(pdev, PCI_COMMAND, cmd, 2);
- }
- 
- void vfio_pci_post_reset(VFIOPCIDevice *vdev)
--- 
-2.48.1
-
diff --git a/kvm-hw-virtio-Also-include-md-stubs-in-case-CONFIG_VIRTI.patch b/kvm-hw-virtio-Also-include-md-stubs-in-case-CONFIG_VIRTI.patch
deleted file mode 100644
index c062e65..0000000
--- a/kvm-hw-virtio-Also-include-md-stubs-in-case-CONFIG_VIRTI.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From afa3a488f3ca52a5455987e4cd643882c4b15d8a Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 13 Mar 2025 07:35:22 +0100
-Subject: [PATCH 24/26] hw/virtio: Also include md stubs in case
- CONFIG_VIRTIO_PCI is not set
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [24/26] ae6307b26d01d2a317f7e5d1d3b3a16b6d5f56de (thuth/qemu-kvm-cs)
-
-For the s390x target, it's possible to build the QEMU binary without
-CONFIG_VIRTIO_PCI and only have the virtio-mem device via the ccw
-transport. In that case, QEMU currently fails to link correctly:
-
- /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_pre_plug':
- ../hw/s390x/s390-virtio-ccw.c:579:(.text+0x1e96): undefined reference to `virtio_md_pci_pre_plug'
- /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_plug':
- ../hw/s390x/s390-virtio-ccw.c:608:(.text+0x21a4): undefined reference to `virtio_md_pci_plug'
- /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_unplug_request':
- ../hw/s390x/s390-virtio-ccw.c:622:(.text+0x2334): undefined reference to `virtio_md_pci_unplug_request'
- /usr/bin/ld: libqemu-s390x-softmmu.a.p/hw_s390x_s390-virtio-ccw.c.o: in function `s390_machine_device_unplug':
- ../hw/s390x/s390-virtio-ccw.c:633:(.text+0x2436): undefined reference to `virtio_md_pci_unplug'
- clang: error: linker command failed with exit code 1 (use -v to see invocation)
-
-We also need to include the stubs when CONFIG_VIRTIO_PCI is missing.
-
-Fixes: aa910c20ec5 ("s390x: virtio-mem support")
-Message-ID: <20250313063522.1348288-1-thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit c1a6bff276ca52ffde472532d92bb5bb122dab3f)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/meson.build | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-index c38bdd6fa4..e2f9c75625 100644
---- a/hw/virtio/meson.build
-+++ b/hw/virtio/meson.build
-@@ -89,7 +89,8 @@ specific_virtio_ss.add_all(when: 'CONFIG_VIRTIO_PCI', if_true: virtio_pci_ss)
- system_ss.add_all(when: 'CONFIG_VIRTIO', if_true: system_virtio_ss)
- system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('vhost-stub.c'))
- system_ss.add(when: 'CONFIG_VIRTIO', if_false: files('virtio-stub.c'))
--system_ss.add(when: 'CONFIG_VIRTIO_MD', if_false: files('virtio-md-stubs.c'))
-+system_ss.add(when: ['CONFIG_VIRTIO_MD', 'CONFIG_VIRTIO_PCI'],
-+              if_false: files('virtio-md-stubs.c'))
- 
- system_ss.add(files('virtio-hmp-cmds.c'))
- 
--- 
-2.48.1
-
diff --git a/kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch b/kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
deleted file mode 100644
index a88b622..0000000
--- a/kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 714fff9a66f8894f5397d367182c550e3f1c1605 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Fri, 29 Nov 2024 13:55:05 +0000
-Subject: [PATCH 2/4] hw/virtio: fix crash in processing balloon stats
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 321: hw/virtio: fix crash in processing balloon stats
-RH-Jira: RHEL-73688
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
-RH-Commit: [1/1] 590aaa6c243617dcc24ef4fcc3cffc51d10a4ba0 (thuth/qemu-kvm-cs9)
-
-balloon_stats_get_all will iterate over guest stats upto the max
-VIRTIO_BALLOON_S_NR value, calling visit_type_uint64 to populate
-the QObject dict. The dict keys are obtained from the static
-array balloon_stat_names which is VIRTIO_BALLOON_S_NR in size.
-
-Unfortunately the way that array is declared results in any
-unassigned stats getting a NULL name, which will then cause
-visit_type_uint64 to trigger an assert in qobject_output_add_obj.
-
-The balloon_stat_names array was fortunately fully populated with
-names until recently:
-
-  commit 0d2eeef77a33315187df8519491a900bde4a3d83
-  Author: Bibo Mao <maobibo@loongson.cn>
-  Date:   Mon Oct 28 10:38:09 2024 +0800
-
-    linux-headers: Update to Linux v6.12-rc5
-
-pulled a change to include/standard-headers/linux/virtio_balloon.h
-which increased VIRTIO_BALLOON_S_NR by 6, and failed to add the new
-names to balloon_stat_names.
-
-This commit fills in the missing names, and uses a static assert to
-guarantee that any future changes to VIRTIO_BALLOON_S_NR will cause
-a build failure until balloon_stat_names is updated.
-
-This problem was detected by the Cockpit Project's automated
-integration tests on QEMU 9.2.0-rc1.
-
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2329448
-Fixes: 0d2eeef77a3 ("linux-headers: Update to Linux v6.12-rc5")
-Reported-by: Martin Pitt <mpitt@redhat.com>
-Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20241129135507.699030-2-berrange@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-(cherry picked from commit bff1050a5630ce5da6f43ed002725d52140bb9e6)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/virtio-balloon.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 609e39a821..afd2ad6dd6 100644
---- a/hw/virtio/virtio-balloon.c
-+++ b/hw/virtio/virtio-balloon.c
-@@ -167,19 +167,33 @@ static void balloon_deflate_page(VirtIOBalloon *balloon,
-     }
- }
- 
-+/*
-+ * All stats upto VIRTIO_BALLOON_S_NR /must/ have a
-+ * non-NULL name declared here, since these are used
-+ * as keys for populating the QDict with stats
-+ */
- static const char *balloon_stat_names[] = {
-    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
-    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
-    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
-    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
-    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
-+
-    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
-    [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
-    [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
-    [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
-    [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
--   [VIRTIO_BALLOON_S_NR] = NULL
-+
-+   [VIRTIO_BALLOON_S_OOM_KILL] = "stat-oom-kills",
-+   [VIRTIO_BALLOON_S_ALLOC_STALL] = "stat-alloc-stalls",
-+   [VIRTIO_BALLOON_S_ASYNC_SCAN] = "stat-async-scans",
-+   [VIRTIO_BALLOON_S_DIRECT_SCAN] = "stat-direct-scans",
-+   [VIRTIO_BALLOON_S_ASYNC_RECLAIM] = "stat-async-reclaims",
-+
-+   [VIRTIO_BALLOON_S_DIRECT_RECLAIM] = "stat-direct-reclaims",
- };
-+G_STATIC_ASSERT(G_N_ELEMENTS(balloon_stat_names) == VIRTIO_BALLOON_S_NR);
- 
- /*
-  * reset_stats - Mark all items in the stats array as unset
--- 
-2.39.3
-
diff --git a/kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch b/kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch
deleted file mode 100644
index e006e88..0000000
--- a/kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 4727c044a09fb8c4fb6d667f26eb55bb6de7554d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:40 +0100
-Subject: [PATCH 28/57] hw/virtio/virtio: avoid cost of -ftrivial-auto-var-init
- in hot path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/30] 1c2cc6292deaaac068f4514439703c22c9ccb300 (stefanha/centos-stream-qemu-kvm)
-
-Since commit 7ff9ff039380 ("meson: mitigate against use of uninitialize
-stack for exploits") the -ftrivial-auto-var-init=zero compiler option is
-used to zero local variables. While this reduces security risks
-associated with uninitialized stack data, it introduced a measurable
-bottleneck in the virtqueue_split_pop() and virtqueue_packed_pop()
-functions.
-
-These virtqueue functions are in the hot path. They are called for each
-element (request) that is popped from a VIRTIO device's virtqueue. Using
-__attribute__((uninitialized)) on large stack variables in these
-functions improves fio randread bs=4k iodepth=64 performance from 304k
-to 332k IOPS (+9%).
-
-This issue was found using perf-top(1). virtqueue_split_pop() was one of
-the top CPU consumers and the "annotate" feature showed that the memory
-zeroing instructions at the beginning of the functions were hot.
-
-Fixes: 7ff9ff039380 ("meson: mitigate against use of uninitialize stack for exploits")
-Cc: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20250610123709.835102-3-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit ba2868ce091cd4abe4be6de4b7e44b3be303b352)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/virtio/virtio.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index 10f24a58dd..7f7b178a50 100644
---- a/hw/virtio/virtio.c
-+++ b/hw/virtio/virtio.c
-@@ -1680,8 +1680,8 @@ static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
-     VirtIODevice *vdev = vq->vdev;
-     VirtQueueElement *elem = NULL;
-     unsigned out_num, in_num, elem_entries;
--    hwaddr addr[VIRTQUEUE_MAX_SIZE];
--    struct iovec iov[VIRTQUEUE_MAX_SIZE];
-+    hwaddr QEMU_UNINITIALIZED addr[VIRTQUEUE_MAX_SIZE];
-+    struct iovec QEMU_UNINITIALIZED iov[VIRTQUEUE_MAX_SIZE];
-     VRingDesc desc;
-     int rc;
- 
-@@ -1826,8 +1826,8 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
-     VirtIODevice *vdev = vq->vdev;
-     VirtQueueElement *elem = NULL;
-     unsigned out_num, in_num, elem_entries;
--    hwaddr addr[VIRTQUEUE_MAX_SIZE];
--    struct iovec iov[VIRTQUEUE_MAX_SIZE];
-+    hwaddr QEMU_UNINITIALIZED addr[VIRTQUEUE_MAX_SIZE];
-+    struct iovec QEMU_UNINITIALIZED iov[VIRTQUEUE_MAX_SIZE];
-     VRingPackedDesc desc;
-     uint16_t id;
-     int rc;
--- 
-2.39.3
-
diff --git a/kvm-hw-virtio-virtio-iommu-Migrate-to-3-phase-reset.patch b/kvm-hw-virtio-virtio-iommu-Migrate-to-3-phase-reset.patch
deleted file mode 100644
index 3922e9b..0000000
--- a/kvm-hw-virtio-virtio-iommu-Migrate-to-3-phase-reset.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 9ca5d7ac4f0ff5f10bf424df8104fe5abe01e431 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 18 Feb 2025 19:25:31 +0100
-Subject: [PATCH 1/9] hw/virtio/virtio-iommu: Migrate to 3-phase reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 341: Fix vIOMMU reset order
-RH-Jira: RHEL-7188
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Donald Dutile <None>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [1/5] 32bf47497d5d4817a448d07ffa7a844aee82ae3c (eauger1/centos-qemu-kvm)
-
-Currently the iommu may be reset before the devices
-it protects. For example this happens with virtio-net.
-
-Let's use 3-phase reset mechanism and reset the IOMMU on
-exit phase after all DMA capable devices have been
-reset during the 'enter' or 'hold' phase.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Acked-by: Jason Wang <jasowang@redhat.com>
-
-Message-Id: <20250218182737.76722-2-eric.auger@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit d261b84d354a41a38336af813f92f636d3fb3f78)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/virtio/trace-events   |  2 +-
- hw/virtio/virtio-iommu.c | 14 ++++++++++----
- 2 files changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
-index 04e36ae047..76f0d458b2 100644
---- a/hw/virtio/trace-events
-+++ b/hw/virtio/trace-events
-@@ -108,7 +108,7 @@ virtio_pci_notify_write(uint64_t addr, uint64_t val, unsigned int size) "0x%" PR
- virtio_pci_notify_write_pio(uint64_t addr, uint64_t val, unsigned int size) "0x%" PRIx64" = 0x%" PRIx64 " (%d)"
- 
- # hw/virtio/virtio-iommu.c
--virtio_iommu_device_reset(void) "reset!"
-+virtio_iommu_device_reset_exit(void) "reset!"
- virtio_iommu_system_reset(void) "system reset!"
- virtio_iommu_get_features(uint64_t features) "device supports features=0x%"PRIx64
- virtio_iommu_device_status(uint8_t status) "driver status = %d"
-diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
-index 59ef4fb217..496200ebc5 100644
---- a/hw/virtio/virtio-iommu.c
-+++ b/hw/virtio/virtio-iommu.c
-@@ -1504,11 +1504,11 @@ static void virtio_iommu_device_unrealize(DeviceState *dev)
-     virtio_cleanup(vdev);
- }
- 
--static void virtio_iommu_device_reset(VirtIODevice *vdev)
-+static void virtio_iommu_device_reset_exit(Object *obj, ResetType type)
- {
--    VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);
-+    VirtIOIOMMU *s = VIRTIO_IOMMU(obj);
- 
--    trace_virtio_iommu_device_reset();
-+    trace_virtio_iommu_device_reset_exit();
- 
-     if (s->domains) {
-         g_tree_destroy(s->domains);
-@@ -1669,6 +1669,7 @@ static void virtio_iommu_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
-     device_class_set_props(dc, virtio_iommu_properties);
-     dc->vmsd = &vmstate_virtio_iommu;
-@@ -1676,7 +1677,12 @@ static void virtio_iommu_class_init(ObjectClass *klass, void *data)
-     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-     vdc->realize = virtio_iommu_device_realize;
-     vdc->unrealize = virtio_iommu_device_unrealize;
--    vdc->reset = virtio_iommu_device_reset;
-+
-+    /*
-+     * Use 'exit' reset phase to make sure all DMA requests
-+     * have been quiesced during 'enter' or 'hold' phase
-+     */
-+    rc->phases.exit = virtio_iommu_device_reset_exit;
-     vdc->get_config = virtio_iommu_get_config;
-     vdc->set_config = virtio_iommu_set_config;
-     vdc->get_features = virtio_iommu_get_features;
--- 
-2.48.1
-
diff --git a/kvm-i386-Introduce-tdx-guest-object.patch b/kvm-i386-Introduce-tdx-guest-object.patch
deleted file mode 100644
index 4dccdee..0000000
--- a/kvm-i386-Introduce-tdx-guest-object.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-From dc14d1444d4ad525663848160cd7687ef291c85e Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 031/115] i386: Introduce tdx-guest object
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [31/115] f279a3b477fbbe84bb5d6c3a8eb588916b41128e (bonzini/rhel-qemu-kvm)
-
-Introduce tdx-guest object which inherits X86_CONFIDENTIAL_GUEST,
-and will be used to create TDX VMs (TDs) by
-
-  qemu -machine ...,confidential-guest-support=tdx0	\
-       -object tdx-guest,id=tdx0
-
-It has one QAPI member 'attributes' defined, which allows user to set
-TD's attributes directly.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-3-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 756e12e791771034ac105a5d2c9887bbbb6b7c73)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflict: class_init's second argument is not const
----
- configs/devices/i386-softmmu/default.mak |  1 +
- hw/i386/Kconfig                          |  5 +++
- qapi/qom.json                            | 15 +++++++++
- target/i386/kvm/meson.build              |  2 ++
- target/i386/kvm/tdx.c                    | 43 ++++++++++++++++++++++++
- target/i386/kvm/tdx.h                    | 21 ++++++++++++
- 6 files changed, 87 insertions(+)
- create mode 100644 target/i386/kvm/tdx.c
- create mode 100644 target/i386/kvm/tdx.h
-
-diff --git a/configs/devices/i386-softmmu/default.mak b/configs/devices/i386-softmmu/default.mak
-index 448e3e3b1b..34c21224eb 100644
---- a/configs/devices/i386-softmmu/default.mak
-+++ b/configs/devices/i386-softmmu/default.mak
-@@ -18,6 +18,7 @@
- #CONFIG_QXL=n
- #CONFIG_SEV=n
- #CONFIG_SGA=n
-+#CONFIG_TDX=n
- #CONFIG_TEST_DEVICES=n
- #CONFIG_TPM_CRB=n
- #CONFIG_TPM_TIS_ISA=n
-diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-index f4a33b6c08..edd61cd2aa 100644
---- a/hw/i386/Kconfig
-+++ b/hw/i386/Kconfig
-@@ -10,6 +10,10 @@ config SGX
-     bool
-     depends on KVM
- 
-+config TDX
-+    bool
-+    depends on KVM
-+
- config PC
-     bool
-     imply APPLESMC
-@@ -26,6 +30,7 @@ config PC
-     imply QXL
-     imply SEV
-     imply SGX
-+    imply TDX
-     imply TEST_DEVICES
-     imply TPM_CRB
-     imply TPM_TIS_ISA
-diff --git a/qapi/qom.json b/qapi/qom.json
-index 321ccd708a..530efeb7c5 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -1008,6 +1008,19 @@
-             '*host-data': 'str',
-             '*vcek-disabled': 'bool' } }
- 
-+##
-+# @TdxGuestProperties:
-+#
-+# Properties for tdx-guest objects.
-+#
-+# @attributes: The 'attributes' of a TD guest that is passed to
-+#     KVM_TDX_INIT_VM
-+#
-+# Since: 10.1
-+##
-+{ 'struct': 'TdxGuestProperties',
-+  'data': { '*attributes': 'uint64' } }
-+
- ##
- # @ThreadContextProperties:
- #
-@@ -1092,6 +1105,7 @@
-     'sev-snp-guest',
-     'thread-context',
-     's390-pv-guest',
-+    'tdx-guest',
-     'throttle-group',
-     'tls-creds-anon',
-     'tls-creds-psk',
-@@ -1163,6 +1177,7 @@
-                                       'if': 'CONFIG_SECRET_KEYRING' },
-       'sev-guest':                  'SevGuestProperties',
-       'sev-snp-guest':              'SevSnpGuestProperties',
-+      'tdx-guest':                  'TdxGuestProperties',
-       'thread-context':             'ThreadContextProperties',
-       'throttle-group':             'ThrottleGroupProperties',
-       'tls-creds-anon':             'TlsCredsAnonProperties',
-diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
-index 3996cafaf2..466bccb9cb 100644
---- a/target/i386/kvm/meson.build
-+++ b/target/i386/kvm/meson.build
-@@ -8,6 +8,8 @@ i386_kvm_ss.add(files(
- 
- i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
- 
-+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'))
-+
- i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
- 
- i386_system_ss.add_all(when: 'CONFIG_KVM', if_true: i386_kvm_ss)
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-new file mode 100644
-index 0000000000..ec84ae2947
---- /dev/null
-+++ b/target/i386/kvm/tdx.c
-@@ -0,0 +1,43 @@
-+/*
-+ * QEMU TDX support
-+ *
-+ * Copyright (c) 2025 Intel Corporation
-+ *
-+ * Author:
-+ *      Xiaoyao Li <xiaoyao.li@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qom/object_interfaces.h"
-+
-+#include "tdx.h"
-+
-+/* tdx guest */
-+OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-+                                   tdx_guest,
-+                                   TDX_GUEST,
-+                                   X86_CONFIDENTIAL_GUEST,
-+                                   { TYPE_USER_CREATABLE },
-+                                   { NULL })
-+
-+static void tdx_guest_init(Object *obj)
-+{
-+    ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj);
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    cgs->require_guest_memfd = true;
-+    tdx->attributes = 0;
-+
-+    object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
-+                                   OBJ_PROP_FLAG_READWRITE);
-+}
-+
-+static void tdx_guest_finalize(Object *obj)
-+{
-+}
-+
-+static void tdx_guest_class_init(ObjectClass *oc, void *data)
-+{
-+}
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-new file mode 100644
-index 0000000000..f3b7253361
---- /dev/null
-+++ b/target/i386/kvm/tdx.h
-@@ -0,0 +1,21 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+
-+#ifndef QEMU_I386_TDX_H
-+#define QEMU_I386_TDX_H
-+
-+#include "confidential-guest.h"
-+
-+#define TYPE_TDX_GUEST "tdx-guest"
-+#define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
-+
-+typedef struct TdxGuestClass {
-+    X86ConfidentialGuestClass parent_class;
-+} TdxGuestClass;
-+
-+typedef struct TdxGuest {
-+    X86ConfidentialGuest parent_obj;
-+
-+    uint64_t attributes;    /* TD attributes */
-+} TdxGuest;
-+
-+#endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch b/kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch
deleted file mode 100644
index 30aae17..0000000
--- a/kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 9d654537f0f667a36eb45d80fda283b31ace3d39 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 017/115] i386: Remove unused parameter "uint32_t bit" in
- feature_word_description()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [17/115] 37ee215225ee0757e51718df4548d4a43fe09e99 (bonzini/rhel-qemu-kvm)
-
-Parameter "uint32_t bit" is not used in function feature_word_description(),
-so remove it.
-
-Signed-off-by: Lei Wang <lei4.wang@intel.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Message-ID: <20241217123932.948789-2-xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit bab32b8b4bf9da5d13386c8faa5a9389e63244b7)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index a97d042a2e..32e89f1a5c 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5897,7 +5897,7 @@ static const TypeInfo max_x86_cpu_type_info = {
-     .class_init = max_x86_cpu_class_init,
- };
- 
--static char *feature_word_description(FeatureWordInfo *f, uint32_t bit)
-+static char *feature_word_description(FeatureWordInfo *f)
- {
-     assert(f->type == CPUID_FEATURE_WORD || f->type == MSR_FEATURE_WORD);
- 
-@@ -5936,6 +5936,7 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-     CPUX86State *env = &cpu->env;
-     FeatureWordInfo *f = &feature_word_info[w];
-     int i;
-+    g_autofree char *feat_word_str = feature_word_description(f);
- 
-     if (!cpu->force_features) {
-         env->features[w] &= ~mask;
-@@ -5948,7 +5949,6 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
- 
-     for (i = 0; i < 64; ++i) {
-         if ((1ULL << i) & mask) {
--            g_autofree char *feat_word_str = feature_word_description(f, i);
-             warn_report("%s: %s%s%s [bit %d]",
-                         verbose_prefix,
-                         feat_word_str,
--- 
-2.50.1
-
diff --git a/kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch b/kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch
deleted file mode 100644
index dec6bca..0000000
--- a/kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From f5b6984efa1bf825410011b957b4f46fcfe963db Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 070/115] i386/apic: Skip kvm_apic_put() for TDX
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [70/115] d4e1631ebceb6441a608ff92c1964b64cf116094 (bonzini/rhel-qemu-kvm)
-
-KVM neithers allow writing to MSR_IA32_APICBASE for TDs, nor allow for
-KVM_SET_LAPIC[*].
-
-Note, KVM_GET_LAPIC is also disallowed for TDX. It is called in the path
-
-  do_kvm_cpu_synchronize_state()
-  -> kvm_arch_get_registers()
-     -> kvm_get_apic()
-
-and it's already disllowed for confidential guest through
-guest_state_protected.
-
-[*] https://lore.kernel.org/all/Z3w4Ku4Jq0CrtXne@google.com/
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-42-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 62a1a8b89d90cd3fbee0e6d38e6a4c0d833e978a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/kvm/apic.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
-index a72c28e8a7..9c12a9c856 100644
---- a/hw/i386/kvm/apic.c
-+++ b/hw/i386/kvm/apic.c
-@@ -17,6 +17,7 @@
- #include "sysemu/hw_accel.h"
- #include "sysemu/kvm.h"
- #include "kvm/kvm_i386.h"
-+#include "kvm/tdx.h"
- 
- static inline void kvm_apic_set_reg(struct kvm_lapic_state *kapic,
-                                     int reg_id, uint32_t val)
-@@ -141,6 +142,10 @@ static void kvm_apic_put(CPUState *cs, run_on_cpu_data data)
-     struct kvm_lapic_state kapic;
-     int ret;
- 
-+    if (is_tdx_vm()) {
-+        return;
-+    }
-+
-     kvm_put_apicbase(s->cpu, s->apicbase);
-     kvm_put_apic_state(s, &kapic);
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch b/kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch
deleted file mode 100644
index 7d75d73..0000000
--- a/kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 0d8993cabc26807ef973630f38ec2b09557497fe Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 079/115] i386/cgs: Introduce
- x86_confidential_guest_check_features()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [79/115] 1fce5742b7746e6ba589c486fb1a6aec8ab8391a (bonzini/rhel-qemu-kvm)
-
-To do cgs specific feature checking. Note the feature checking in
-x86_cpu_filter_features() is valid for non-cgs VMs. For cgs VMs like
-TDX, what features can be supported has more restrictions.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-51-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit dc0b08b303ad34983b43936a4c978672e0f9a9d8)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/confidential-guest.h | 13 +++++++++++++
- target/i386/kvm/kvm.c            |  8 ++++++++
- 2 files changed, 21 insertions(+)
-
-diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
-index 8a5cc7ecff..4e7eb43416 100644
---- a/target/i386/confidential-guest.h
-+++ b/target/i386/confidential-guest.h
-@@ -42,6 +42,7 @@ struct X86ConfidentialGuestClass {
-     void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
-     uint32_t (*adjust_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature,
-                                       uint32_t index, int reg, uint32_t value);
-+    int (*check_features)(X86ConfidentialGuest *cg, CPUState *cs);
- };
- 
- /**
-@@ -91,4 +92,16 @@ static inline int x86_confidential_guest_adjust_cpuid_features(X86ConfidentialGu
-     }
- }
- 
-+static inline int x86_confidential_guest_check_features(X86ConfidentialGuest *cg,
-+                                                        CPUState *cs)
-+{
-+    X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
-+
-+    if (klass->check_features) {
-+        return klass->check_features(cg, cs);
-+    }
-+
-+    return 0;
-+}
-+
- #endif
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 76352323e4..b6fddcd543 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -2081,6 +2081,14 @@ int kvm_arch_init_vcpu(CPUState *cs)
-     int r;
-     Error *local_err = NULL;
- 
-+    if (current_machine->cgs) {
-+        r = x86_confidential_guest_check_features(
-+                X86_CONFIDENTIAL_GUEST(current_machine->cgs), cs);
-+        if (r < 0) {
-+            return r;
-+        }
-+    }
-+
-     memset(&cpuid_data, 0, sizeof(cpuid_data));
- 
-     cpuid_i = 0;
--- 
-2.50.1
-
diff --git a/kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch b/kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch
deleted file mode 100644
index 2bb8084..0000000
--- a/kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From fa35367ae78505390b5915c9bf96542ffed1787d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 072/115] i386/cgs: Rename *mask_cpuid_features() to
- *adjust_cpuid_features()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [72/115] 0633336351c17f73620bc7d13cee5ba53b100e13 (bonzini/rhel-qemu-kvm)
-
-Because for TDX case, there are also fixed-1 bits that enforced by TDX
-module.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-44-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 695bfaee7153153708228946aa26c6d879599c04)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/confidential-guest.h | 20 ++++++++++----------
- target/i386/kvm/kvm.c            |  2 +-
- target/i386/sev.c                |  4 ++--
- 3 files changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
-index 38169ed68e..8a5cc7ecff 100644
---- a/target/i386/confidential-guest.h
-+++ b/target/i386/confidential-guest.h
-@@ -40,8 +40,8 @@ struct X86ConfidentialGuestClass {
-     /* <public> */
-     int (*kvm_type)(X86ConfidentialGuest *cg);
-     void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
--    uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
--                                    int reg, uint32_t value);
-+    uint32_t (*adjust_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature,
-+                                      uint32_t index, int reg, uint32_t value);
- };
- 
- /**
-@@ -71,21 +71,21 @@ static inline void x86_confidential_guest_cpu_instance_init(X86ConfidentialGuest
- }
- 
- /**
-- * x86_confidential_guest_mask_cpuid_features:
-+ * x86_confidential_guest_adjust_cpuid_features:
-  *
-- * Removes unsupported features from a confidential guest's CPUID values, returns
-- * the value with the bits removed.  The bits removed should be those that KVM
-- * provides independent of host-supported CPUID features, but are not supported by
-- * the confidential computing firmware.
-+ * Adjust the supported features from a confidential guest's CPUID values,
-+ * returns the adjusted value.  There are bits being removed that are not
-+ * supported by the confidential computing firmware or bits being added that
-+ * are forcibly exposed to guest by the confidential computing firmware.
-  */
--static inline int x86_confidential_guest_mask_cpuid_features(X86ConfidentialGuest *cg,
-+static inline int x86_confidential_guest_adjust_cpuid_features(X86ConfidentialGuest *cg,
-                                                              uint32_t feature, uint32_t index,
-                                                              int reg, uint32_t value)
- {
-     X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
- 
--    if (klass->mask_cpuid_features) {
--        return klass->mask_cpuid_features(cg, feature, index, reg, value);
-+    if (klass->adjust_cpuid_features) {
-+        return klass->adjust_cpuid_features(cg, feature, index, reg, value);
-     } else {
-         return value;
-     }
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index f3fe553151..5349ff4db7 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -565,7 +565,7 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
-     }
- 
-     if (current_machine->cgs) {
--        ret = x86_confidential_guest_mask_cpuid_features(
-+        ret = x86_confidential_guest_adjust_cpuid_features(
-             X86_CONFIDENTIAL_GUEST(current_machine->cgs),
-             function, index, reg, ret);
-     }
-diff --git a/target/i386/sev.c b/target/i386/sev.c
-index a0d271f898..24fcd078fc 100644
---- a/target/i386/sev.c
-+++ b/target/i386/sev.c
-@@ -946,7 +946,7 @@ out:
- }
- 
- static uint32_t
--sev_snp_mask_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
-+sev_snp_adjust_cpuid_features(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
-                             int reg, uint32_t value)
- {
-     switch (feature) {
-@@ -2404,7 +2404,7 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
-     klass->launch_finish = sev_snp_launch_finish;
-     klass->launch_update_data = sev_snp_launch_update_data;
-     klass->kvm_init = sev_snp_kvm_init;
--    x86_klass->mask_cpuid_features = sev_snp_mask_cpuid_features;
-+    x86_klass->adjust_cpuid_features = sev_snp_adjust_cpuid_features;
-     x86_klass->kvm_type = sev_snp_kvm_type;
- 
-     object_class_property_add(oc, "policy", "uint64",
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch b/kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch
deleted file mode 100644
index b787654..0000000
--- a/kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 70ffde0038f36b6720b73136a4368b26f2bf6181 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 107/115] i386/cpu: Cleanup host_cpu_max_instance_init()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [107/115] 140ba66d2ff544b6ae498798e1f6ad3ade1791bc (bonzini/rhel-qemu-kvm)
-
-The implementation of host_cpu_max_instance_init() was merged into
-host_cpu_instance_init() by commit 29f1ba338baf ("target/i386: merge
-host_cpu_instance_init() and host_cpu_max_instance_init()"), while the
-declaration of it remains in host-cpu.h.
-
-Clean it up.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250716063117.602050-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 5fe6b9a854a91df86fdb794cbeb67d0656756137)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/host-cpu.h | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/target/i386/host-cpu.h b/target/i386/host-cpu.h
-index b97ec01c9b..5b2ad491a8 100644
---- a/target/i386/host-cpu.h
-+++ b/target/i386/host-cpu.h
-@@ -12,7 +12,6 @@
- 
- uint32_t host_cpu_phys_bits(void);
- void host_cpu_instance_init(X86CPU *cpu);
--void host_cpu_max_instance_init(X86CPU *cpu);
- bool host_cpu_realizefn(CPUState *cs, Error **errp);
- 
- void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping);
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch b/kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch
deleted file mode 100644
index d566885..0000000
--- a/kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 0a568fbac880efdda740808e6fbbd8be09cfb46a Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 024/115] i386/cpu: Consolidate the helper to get Host's vendor
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [24/115] cd823d475dc0a0ec4135f0c9d5546db996579d30 (bonzini/rhel-qemu-kvm)
-
-Extend host_cpu_vendor_fms() to help more cases to get Host's vendor
-information.
-
-Cc: Dongli Zhang <dongli.zhang@oracle.com>
-Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250410075619.145792-1-zhao1.liu@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ae39acef49e29169f90cd3a799d6cd0b50bc65d2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/host-cpu.c        | 10 ++++++----
- target/i386/kvm/vmsr_energy.c |  3 +--
- 2 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
-index 03b9d1b169..4a77ecc1fc 100644
---- a/target/i386/host-cpu.c
-+++ b/target/i386/host-cpu.c
-@@ -109,9 +109,13 @@ void host_cpu_vendor_fms(char *vendor, int *family, int *model, int *stepping)
- {
-     uint32_t eax, ebx, ecx, edx;
- 
--    host_cpuid(0x0, 0, &eax, &ebx, &ecx, &edx);
-+    host_cpuid(0x0, 0, NULL, &ebx, &ecx, &edx);
-     x86_cpu_vendor_words2str(vendor, ebx, edx, ecx);
- 
-+    if (!family && !model && !stepping) {
-+        return;
-+    }
-+
-     host_cpuid(0x1, 0, &eax, &ebx, &ecx, &edx);
-     if (family) {
-         *family = ((eax >> 8) & 0x0F) + ((eax >> 20) & 0xFF);
-@@ -129,11 +133,9 @@ void host_cpu_instance_init(X86CPU *cpu)
-     X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
- 
-     if (xcc->model) {
--        uint32_t ebx = 0, ecx = 0, edx = 0;
-         char vendor[CPUID_VENDOR_SZ + 1];
- 
--        host_cpuid(0, 0, NULL, &ebx, &ecx, &edx);
--        x86_cpu_vendor_words2str(vendor, ebx, edx, ecx);
-+        host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
-         object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
-     }
- }
-diff --git a/target/i386/kvm/vmsr_energy.c b/target/i386/kvm/vmsr_energy.c
-index 7e064c5aef..615f23b6cf 100644
---- a/target/i386/kvm/vmsr_energy.c
-+++ b/target/i386/kvm/vmsr_energy.c
-@@ -29,10 +29,9 @@ char *vmsr_compute_default_paths(void)
- 
- bool is_host_cpu_intel(void)
- {
--    int family, model, stepping;
-     char vendor[CPUID_VENDOR_SZ + 1];
- 
--    host_cpu_vendor_fms(vendor, &family, &model, &stepping);
-+    host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
- 
-     return strcmp(vendor, CPUID_VENDOR_INTEL);
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch b/kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch
deleted file mode 100644
index e7304fc..0000000
--- a/kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From da6c7cae87a945451617014a97c83b0e38879786 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 009/115] i386/cpu: Drop cores_per_pkg in cpu_x86_cpuid()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [9/115] 1e8cca4b6784adde542654cd45b4f921fbc91fcd (bonzini/rhel-qemu-kvm)
-
-Local variable cores_per_pkg is only used to calculate threads_per_pkg.
-No need for it. Drop it and open-code it instead.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-4-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 00ec7be67c3981b486293aa8e0aef9534f229c5e)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 589e1863d4e871e09af4ff176df97c23e2a33b8b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 1fe492f33d..b639769ef3 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -6950,7 +6950,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-     uint32_t limit;
-     uint32_t signature[3];
-     X86CPUTopoInfo topo_info;
--    uint32_t cores_per_pkg;
-     uint32_t threads_per_pkg;
- 
-     topo_info.dies_per_pkg = env->nr_dies;
-@@ -6958,9 +6957,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-     topo_info.cores_per_module = cs->nr_cores / env->nr_dies / env->nr_modules;
-     topo_info.threads_per_core = cs->nr_threads;
- 
--    cores_per_pkg = topo_info.cores_per_module * topo_info.modules_per_die *
--                    topo_info.dies_per_pkg;
--    threads_per_pkg = cores_per_pkg * topo_info.threads_per_core;
-+    threads_per_pkg = topo_info.threads_per_core * topo_info.cores_per_module *
-+                      topo_info.modules_per_die * topo_info.dies_per_pkg;
- 
-     /* Calculate & apply limits for different index ranges */
-     if (index >= 0xC0000000) {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch b/kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch
deleted file mode 100644
index 2809367..0000000
--- a/kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 8e732c71def28ac963a8f8d530c7dc063abc6d97 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 006/115] i386/cpu: Drop the check of phys_bits in
- host_cpu_realizefn()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [6/115] a53971f358752d7c850baee4f8f3c7912854f160 (bonzini/rhel-qemu-kvm)
-
-The check of cpu->phys_bits to be in range between
-[32, TARGET_PHYS_ADDR_SPACE_BITS] in host_cpu_realizefn()
-is duplicated with check in x86_cpu_realizefn().
-
-Since the ckeck in x86_cpu_realizefn() is called later and can cover all
-the x86 cases. Remove the one in host_cpu_realizefn().
-
-Opportunistically adjust cpu->phys_bits directly in
-host_cpu_adjust_phys_bits(), which matches more with the function name.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20240929085747.2023198-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 855bdb6c8a60ae20043531dc965fcb1ed171d7d9)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/host-cpu.c | 16 +++-------------
- 1 file changed, 3 insertions(+), 13 deletions(-)
-
-diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
-index 8b8bf5afec..03b9d1b169 100644
---- a/target/i386/host-cpu.c
-+++ b/target/i386/host-cpu.c
-@@ -42,7 +42,7 @@ static uint32_t host_cpu_phys_bits(void)
-     return host_phys_bits;
- }
- 
--static uint32_t host_cpu_adjust_phys_bits(X86CPU *cpu)
-+static void host_cpu_adjust_phys_bits(X86CPU *cpu)
- {
-     uint32_t host_phys_bits = host_cpu_phys_bits();
-     uint32_t phys_bits = cpu->phys_bits;
-@@ -66,7 +66,7 @@ static uint32_t host_cpu_adjust_phys_bits(X86CPU *cpu)
-         }
-     }
- 
--    return phys_bits;
-+    cpu->phys_bits = phys_bits;
- }
- 
- bool host_cpu_realizefn(CPUState *cs, Error **errp)
-@@ -75,17 +75,7 @@ bool host_cpu_realizefn(CPUState *cs, Error **errp)
-     CPUX86State *env = &cpu->env;
- 
-     if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
--        uint32_t phys_bits = host_cpu_adjust_phys_bits(cpu);
--
--        if (phys_bits &&
--            (phys_bits > TARGET_PHYS_ADDR_SPACE_BITS ||
--             phys_bits < 32)) {
--            error_setg(errp, "phys-bits should be between 32 and %u "
--                       " (but is %u)",
--                       TARGET_PHYS_ADDR_SPACE_BITS, phys_bits);
--            return false;
--        }
--        cpu->phys_bits = phys_bits;
-+        host_cpu_adjust_phys_bits(cpu);
-     }
-     return true;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch b/kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch
deleted file mode 100644
index 1b658bc..0000000
--- a/kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 368e0e988c60d0391c1e47db7e3f1aff7742f697 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 008/115] i386/cpu: Drop the variable smp_cores and smp_threads
- in x86_cpu_pre_plug()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [8/115] bc67c58c23402a05899559f8ecfa61218aa3ef2a (bonzini/rhel-qemu-kvm)
-
-No need to define smp_cores and smp_threads, just using ms->smp.cores
-and ms->smp.threads is straightforward. It's also consistent with other
-checks of socket/die/module.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-3-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 81bd60625fc23cb8d4d0e682dcc4223d5e1ead84)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit c263000e490ddb361e0ef8a45342dea034036682)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/x86-common.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
-index 992ea1f25e..2806be98f3 100644
---- a/hw/i386/x86-common.c
-+++ b/hw/i386/x86-common.c
-@@ -248,8 +248,6 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-     CPUX86State *env = &cpu->env;
-     MachineState *ms = MACHINE(hotplug_dev);
-     X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
--    unsigned int smp_cores = ms->smp.cores;
--    unsigned int smp_threads = ms->smp.threads;
-     X86CPUTopoInfo topo_info;
- 
-     if (!object_dynamic_cast(OBJECT(cpu), ms->cpu_type)) {
-@@ -329,17 +327,17 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-         if (cpu->core_id < 0) {
-             error_setg(errp, "CPU core-id is not set");
-             return;
--        } else if (cpu->core_id > (smp_cores - 1)) {
-+        } else if (cpu->core_id > (ms->smp.cores - 1)) {
-             error_setg(errp, "Invalid CPU core-id: %u must be in range 0:%u",
--                       cpu->core_id, smp_cores - 1);
-+                       cpu->core_id, ms->smp.cores - 1);
-             return;
-         }
-         if (cpu->thread_id < 0) {
-             error_setg(errp, "CPU thread-id is not set");
-             return;
--        } else if (cpu->thread_id > (smp_threads - 1)) {
-+        } else if (cpu->thread_id > (ms->smp.threads - 1)) {
-             error_setg(errp, "Invalid CPU thread-id: %u must be in range 0:%u",
--                       cpu->thread_id, smp_threads - 1);
-+                       cpu->thread_id, ms->smp.threads - 1);
-             return;
-         }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch b/kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch
deleted file mode 100644
index ff72ddf..0000000
--- a/kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 54403f52f9be5f4d05f1cc866b397820340099ab Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 007/115] i386/cpu: Extract a common fucntion to setup value of
- MSR_CORE_THREAD_COUNT
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [7/115] d61186d383365a629a8d74a5618b4df6b2723a88 (bonzini/rhel-qemu-kvm)
-
-There are duplicated code to setup the value of MSR_CORE_THREAD_COUNT.
-Extract a common function for it.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-2-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d3bb5d0d4f5d4ad7dc6c02ea5fea51ca2f946593)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 66f4008d32a6cddd1ada5906487ecc9fb0b62fed)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu-sysemu.c             | 11 +++++++++++
- target/i386/cpu.h                    |  2 ++
- target/i386/hvf/x86_emu.c            |  3 +--
- target/i386/kvm/kvm.c                |  5 +----
- target/i386/tcg/sysemu/misc_helper.c |  3 +--
- 5 files changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/target/i386/cpu-sysemu.c b/target/i386/cpu-sysemu.c
-index 227ac021f6..4e9df0bc01 100644
---- a/target/i386/cpu-sysemu.c
-+++ b/target/i386/cpu-sysemu.c
-@@ -309,3 +309,14 @@ void x86_cpu_get_crash_info_qom(Object *obj, Visitor *v,
-                                      errp);
-     qapi_free_GuestPanicInformation(panic_info);
- }
-+
-+uint64_t cpu_x86_get_msr_core_thread_count(X86CPU *cpu)
-+{
-+    CPUState *cs = CPU(cpu);
-+    uint64_t val;
-+
-+    val = cs->nr_threads * cs->nr_cores;  /* thread count, bits 15..0 */
-+    val |= ((uint32_t)cs->nr_cores << 16); /* core count, bits 31..16 */
-+
-+    return val;
-+}
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 5924761551..8c9216d9d0 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2368,6 +2368,8 @@ static inline void cpu_x86_load_seg_cache_sipi(X86CPU *cpu,
-     cs->halted = 0;
- }
- 
-+uint64_t cpu_x86_get_msr_core_thread_count(X86CPU *cpu);
-+
- int cpu_x86_get_descr_debug(CPUX86State *env, unsigned int selector,
-                             target_ulong *base, unsigned int *limit,
-                             unsigned int *flags);
-diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
-index 38c782b8e3..425f1afda8 100644
---- a/target/i386/hvf/x86_emu.c
-+++ b/target/i386/hvf/x86_emu.c
-@@ -745,8 +745,7 @@ void simulate_rdmsr(CPUX86State *env)
-         val = env->mtrr_deftype;
-         break;
-     case MSR_CORE_THREAD_COUNT:
--        val = cs->nr_threads * cs->nr_cores;  /* thread count, bits 15..0 */
--        val |= ((uint32_t)cs->nr_cores << 16); /* core count, bits 31..16 */
-+        val = cpu_x86_get_msr_core_thread_count(cpu);
-         break;
-     default:
-         /* fprintf(stderr, "%s: unknown msr 0x%x\n", __func__, msr); */
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index b02aec915c..fe6b34bb10 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -2586,10 +2586,7 @@ static bool kvm_rdmsr_core_thread_count(X86CPU *cpu,
-                                         uint32_t msr,
-                                         uint64_t *val)
- {
--    CPUState *cs = CPU(cpu);
--
--    *val = cs->nr_threads * cs->nr_cores; /* thread count, bits 15..0 */
--    *val |= ((uint32_t)cs->nr_cores << 16); /* core count, bits 31..16 */
-+    *val = cpu_x86_get_msr_core_thread_count(cpu);
- 
-     return true;
- }
-diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
-index 094aa56a20..ff7b201b44 100644
---- a/target/i386/tcg/sysemu/misc_helper.c
-+++ b/target/i386/tcg/sysemu/misc_helper.c
-@@ -468,8 +468,7 @@ void helper_rdmsr(CPUX86State *env)
-         val = x86_cpu->ucode_rev;
-         break;
-     case MSR_CORE_THREAD_COUNT: {
--        CPUState *cs = CPU(x86_cpu);
--        val = (cs->nr_threads * cs->nr_cores) | (cs->nr_cores << 16);
-+        val = cpu_x86_get_msr_core_thread_count(x86_cpu);
-         break;
-     }
-     case MSR_APIC_START ... MSR_APIC_END: {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch b/kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch
deleted file mode 100644
index 00f22c2..0000000
--- a/kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 97edfb8e45b34e3909f387162785f0aa8979aba6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 013/115] i386/cpu: Hoist check of CPUID_EXT3_TOPOEXT against
- threads_per_core
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [13/115] e8e81cac13bb9363c167e92a8478efb97ceab79a (bonzini/rhel-qemu-kvm)
-
-Now it changes to use env->topo_info.threads_per_core and doesn't depend
-on qemu_init_vcpu() anymore.  Put it together with other feature checks
-before qemu_init_vcpu()
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-8-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 473d79b56a1645be90b890f9623b27acd0afba49)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 8098c705a5d8f82d2a772194ebdbef87784b0461)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 30 +++++++++++++++---------------
- 1 file changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 554455169a..2295149bfa 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -8327,6 +8327,21 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
-      */
-     cpu->mwait.ecx |= CPUID_MWAIT_EMX | CPUID_MWAIT_IBE;
- 
-+    /*
-+     * Most Intel and certain AMD CPUs support hyperthreading. Even though QEMU
-+     * fixes this issue by adjusting CPUID_0000_0001_EBX and CPUID_8000_0008_ECX
-+     * based on inputs (sockets,cores,threads), it is still better to give
-+     * users a warning.
-+     */
-+    if (IS_AMD_CPU(env) &&
-+        !(env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_TOPOEXT) &&
-+        env->topo_info.threads_per_core > 1) {
-+            warn_report_once("This family of AMD CPU doesn't support "
-+                             "hyperthreading(%d). Please configure -smp "
-+                             "options properly or try enabling topoext "
-+                             "feature.", env->topo_info.threads_per_core);
-+    }
-+
-     /* For 64bit systems think about the number of physical bits to present.
-      * ideally this should be the same as the host; anything other than matching
-      * the host can cause incorrect guest behaviour.
-@@ -8430,21 +8445,6 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
- 
-     qemu_init_vcpu(cs);
- 
--    /*
--     * Most Intel and certain AMD CPUs support hyperthreading. Even though QEMU
--     * fixes this issue by adjusting CPUID_0000_0001_EBX and CPUID_8000_0008_ECX
--     * based on inputs (sockets,cores,threads), it is still better to give
--     * users a warning.
--     */
--    if (IS_AMD_CPU(env) &&
--        !(env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_TOPOEXT) &&
--        env->topo_info.threads_per_core > 1) {
--            warn_report_once("This family of AMD CPU doesn't support "
--                             "hyperthreading(%d). Please configure -smp "
--                             "options properly or try enabling topoext "
--                             "feature.", env->topo_info.threads_per_core);
--    }
--
- #ifndef CONFIG_USER_ONLY
-     x86_cpu_apic_realize(cpu, &local_err);
-     if (local_err != NULL) {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch b/kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch
deleted file mode 100644
index 25db7b1..0000000
--- a/kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From c45bc21b4c191ceb2523bfeac4ff2eb042469d89 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 062/115] i386/cpu: Introduce enable_cpuid_0x1f to force
- exposing CPUID 0x1f
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [62/115] 046ef898225f70d84fbcf20266aff8478c6fb428 (bonzini/rhel-qemu-kvm)
-
-Currently, QEMU exposes CPUID 0x1f to guest only when necessary, i.e.,
-when topology level that cannot be enumerated by leaf 0xB, e.g., die or
-module level, are configured for the guest, e.g., -smp xx,dies=2.
-
-However, TDX architecture forces to require CPUID 0x1f to configure CPU
-topology.
-
-Introduce a bool flag, enable_cpuid_0x1f, in CPU for the case that
-requires CPUID leaf 0x1f to be exposed to guest.
-
-Introduce a new function x86_has_cpuid_0x1f(), which is the wrapper of
-cpu->enable_cpuid_0x1f and x86_has_extended_topo() to check if it needs
-to enable cpuid leaf 0x1f for the guest.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-34-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ab8bd85adf75900edc2764d0ebe8b53867cc54aa)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c     | 4 ++--
- target/i386/cpu.h     | 9 +++++++++
- target/i386/kvm/kvm.c | 2 +-
- 3 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ee6f1c0627..ab34626b19 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -7177,7 +7177,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         break;
-     case 0x1F:
-         /* V2 Extended Topology Enumeration Leaf */
--        if (!x86_has_extended_topo(env->avail_cpu_topo)) {
-+        if (!x86_has_cpuid_0x1f(cpu)) {
-             *eax = *ebx = *ecx = *edx = 0;
-             break;
-         }
-@@ -8035,7 +8035,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-          * cpu->vendor_cpuid_only has been unset for compatibility with older
-          * machine types.
-          */
--        if (x86_has_extended_topo(env->avail_cpu_topo) &&
-+        if (x86_has_cpuid_0x1f(cpu) &&
-             (IS_INTEL_CPU(env) || !cpu->vendor_cpuid_only)) {
-             x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x1F);
-         }
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index ee1a1b6622..83fa89bf0a 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2168,6 +2168,9 @@ struct ArchCPU {
-     /* Compatibility bits for old machine types: */
-     bool enable_cpuid_0xb;
- 
-+    /* Force to enable cpuid 0x1f */
-+    bool enable_cpuid_0x1f;
-+
-     /* Enable auto level-increase for all CPUID leaves */
-     bool full_cpuid_auto_level;
- 
-@@ -2429,6 +2432,12 @@ void host_cpuid(uint32_t function, uint32_t count,
-                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
- bool cpu_has_x2apic_feature(CPUX86State *env);
- 
-+static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
-+{
-+    return cpu->enable_cpuid_0x1f ||
-+           x86_has_extended_topo(cpu->env.avail_cpu_topo);
-+}
-+
- /* helper.c */
- void x86_cpu_set_a20(X86CPU *cpu, int a20_state);
- void cpu_sync_avx_hflag(CPUX86State *env);
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 4bda4f5525..f4809ee004 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -1861,7 +1861,7 @@ uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
-             break;
-         }
-         case 0x1f:
--            if (!x86_has_extended_topo(env->avail_cpu_topo)) {
-+            if (!x86_has_cpuid_0x1f(env_archcpu(env))) {
-                 cpuid_i--;
-                 break;
-             }
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch b/kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch
deleted file mode 100644
index f720123..0000000
--- a/kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From faffdc7fae7e90e9b4bdbb36ab2e753ebbf26732 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 087/115] i386/cpu: Move adjustment of CPUID_EXT_PDCM before
- feature_dependencies[] check
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [87/115] 8e3628cfafdd307c5a38cbd2ec52ce3f679c1796 (bonzini/rhel-qemu-kvm)
-
-There is one entry relates to CPUID_EXT_PDCM in feature_dependencies[].
-So it needs to get correct value of CPUID_EXT_PDCM before using
-feature_dependencies[] to apply dependencies.
-
-Besides, it also ensures CPUID_EXT_PDCM value is tracked in
-env->features[FEAT_1_ECX].
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250304052450.465445-2-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e68ec2980901c8e7f948f3305770962806c53f0b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 433d0a0418..a9d6811032 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -7026,9 +7026,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         if (threads_per_pkg > 1) {
-             *ebx |= threads_per_pkg << 16;
-         }
--        if (!cpu->enable_pmu) {
--            *ecx &= ~CPUID_EXT_PDCM;
--        }
-         break;
-     case 2:
-         /* cache info: needed for Pentium Pro compatibility */
-@@ -8012,6 +8009,10 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-         }
-     }
- 
-+    if (!cpu->enable_pmu) {
-+        env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
-+    }
-+
-     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
-         FeatureDep *d = &feature_dependencies[i];
-         if (!(env->features[d->from.index] & d->from.mask)) {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch b/kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch
deleted file mode 100644
index c668f8f..0000000
--- a/kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From eb67f5f683c98892292aa40695d7ec59a17c122f Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 105/115] i386/cpu: Move x86_ext_save_areas[] initialization to
- .instance_init
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [105/115] 289d5143a71cd0dc24c6d8e32d510657d5c77091 (bonzini/rhel-qemu-kvm)
-
-In x86_cpu_post_initfn(), the initialization of x86_ext_save_areas[]
-marks the unsupported xsave areas based on Host support.
-
-This step must be done before accel_cpu_instance_init(), otherwise,
-KVM's assertion on host xsave support would fail:
-
-qemu-system-x86_64: ../target/i386/kvm/kvm-cpu.c:149:
-kvm_cpu_xsave_init: Assertion `esa->size == eax' failed.
-
-(on AMD EPYC 7302 16-Core Processor)
-
-Move x86_ext_save_areas[] initialization to .instance_init and place it
-before accel_cpu_instance_init().
-
-Fixes: commit 5f158abef44c ("target/i386: move accel_cpu_instance_init to .instance_init")
-Reported-by: Paolo Abeni <pabeni@redhat.com>
-Tested-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250717023933.2502109-1-zhao1.liu@intel.com
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e52af92e9e6f8fc00f2ae6b63214b3d6213b3cec)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 22 +++++++++++++++-------
- 1 file changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index d0161f922c..ee753351fc 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -8617,6 +8617,16 @@ static void x86_cpu_register_feature_bit_props(X86CPUClass *xcc,
- }
- 
- static void x86_cpu_post_initfn(Object *obj)
-+{
-+#ifndef CONFIG_USER_ONLY
-+    if (current_machine && current_machine->cgs) {
-+        x86_confidential_guest_cpu_instance_init(
-+            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
-+    }
-+#endif
-+}
-+
-+static void x86_cpu_init_xsave(void)
- {
-     static bool first = true;
-     uint64_t supported_xcr0;
-@@ -8637,13 +8647,6 @@ static void x86_cpu_post_initfn(Object *obj)
-             }
-         }
-     }
--
--#ifndef CONFIG_USER_ONLY
--    if (current_machine && current_machine->cgs) {
--        x86_confidential_guest_cpu_instance_init(
--            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
--    }
--#endif
- }
- 
- static void x86_cpu_init_default_topo(X86CPU *cpu)
-@@ -8713,6 +8716,11 @@ static void x86_cpu_initfn(Object *obj)
-         x86_cpu_load_model(cpu, xcc->model);
-     }
- 
-+    /*
-+     * accel's cpu_instance_init may have the xsave check,
-+     * so x86_ext_save_areas[] must be initialized before this.
-+     */
-+    x86_cpu_init_xsave();
-     accel_cpu_instance_init(CPU(obj));
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch b/kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch
deleted file mode 100644
index 0d3aa45..0000000
--- a/kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 07bba3fcfd6b8eb6e833e7d675be3ccc667423de Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 089/115] i386/cpu: Rename enable_cpuid_0x1f to
- force_cpuid_0x1f
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [89/115] d1152aea8e699b1563750d286b41a47d9036429e (bonzini/rhel-qemu-kvm)
-
-The name of "enable_cpuid_0x1f" isn't right to its behavior because the
-leaf 0x1f can be enabled even when "enable_cpuid_0x1f" is false.
-
-Rename it to "force_cpuid_0x1f" to better reflect its behavior.
-
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Link: https://lore.kernel.org/r/20250603050305.1704586-2-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 90d2bbd1f6edfa22a056070ee62ded55099cd56d)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.h     | 4 ++--
- target/i386/kvm/tdx.c | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 2e73945b28..a08931f969 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2195,7 +2195,7 @@ struct ArchCPU {
-     bool enable_cpuid_0xb;
- 
-     /* Force to enable cpuid 0x1f */
--    bool enable_cpuid_0x1f;
-+    bool force_cpuid_0x1f;
- 
-     /* Enable auto level-increase for all CPUID leaves */
-     bool full_cpuid_auto_level;
-@@ -2465,7 +2465,7 @@ void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
- 
- static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
- {
--    return cpu->enable_cpuid_0x1f ||
-+    return cpu->force_cpuid_0x1f ||
-            x86_has_extended_topo(cpu->env.avail_cpu_topo);
- }
- 
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 3099e40baa..ca3641441c 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -752,7 +752,7 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
-     /* invtsc is fixed1 for TD guest */
-     object_property_set_bool(OBJECT(cpu), "invtsc", true, &error_abort);
- 
--    x86cpu->enable_cpuid_0x1f = true;
-+    x86cpu->force_cpuid_0x1f = true;
- }
- 
- static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch b/kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch
deleted file mode 100644
index a9c1cb4..0000000
--- a/kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 90ccca2272ea05adc4ecedbbac70692f72831533 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 016/115] i386/cpu: Set and track CPUID_EXT3_CMP_LEG in
- env->features[FEAT_8000_0001_ECX]
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [16/115] 8d6efb657ea34f7adccb5f8648cf0d10ba126299 (bonzini/rhel-qemu-kvm)
-
-The correct usage is tracking and maintaining features in env->features[]
-instead of manually set it in cpu_x86_cpuid().
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-11-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 99a637a86f55c8486b06c698656befdf012eec4d)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit eb7304fc81c136a475a951720b76afa1f128ae95)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 20 +++++++++-----------
- 1 file changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index e20977411d..a97d042a2e 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -7404,17 +7404,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         *ecx = env->features[FEAT_8000_0001_ECX];
-         *edx = env->features[FEAT_8000_0001_EDX];
- 
--        /* The Linux kernel checks for the CMPLegacy bit and
--         * discards multiple thread information if it is set.
--         * So don't set it here for Intel to make Linux guests happy.
--         */
--        if (threads_per_pkg > 1) {
--            if (env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1 ||
--                env->cpuid_vendor2 != CPUID_VENDOR_INTEL_2 ||
--                env->cpuid_vendor3 != CPUID_VENDOR_INTEL_3) {
--                *ecx |= 1 << 1;    /* CmpLegacy bit */
--            }
--        }
-         if (tcg_enabled() && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1 &&
-             !(env->hflags & HF_LMA_MASK)) {
-             *edx &= ~CPUID_EXT2_SYSCALL;
-@@ -7976,6 +7965,15 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
- 
-     if (x86_threads_per_pkg(&env->topo_info) > 1) {
-         env->features[FEAT_1_EDX] |= CPUID_HT;
-+
-+        /*
-+         * The Linux kernel checks for the CMPLegacy bit and
-+         * discards multiple thread information if it is set.
-+         * So don't set it here for Intel to make Linux guests happy.
-+         */
-+        if (!IS_INTEL_CPU(env)) {
-+            env->features[FEAT_8000_0001_ECX] |= CPUID_EXT3_CMP_LEG;
-+        }
-     }
- 
-     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch b/kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch
deleted file mode 100644
index 4c7342e..0000000
--- a/kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 673bbd9c79946356d2863f0944a576d100750c64 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 015/115] i386/cpu: Set up CPUID_HT in
- x86_cpu_expand_features() instead of cpu_x86_cpuid()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [15/115] c763ec424a0cc64f46fd27aa2f03fd1b2933c23b (bonzini/rhel-qemu-kvm)
-
-Currently CPUID_HT is evaluated in cpu_x86_cpuid() each time. It's not a
-correct usage of how feature bit is maintained and evaluated. The
-expected practice is that features are tracked in env->features[] and
-cpu_x86_cpuid() should be the consumer of env->features[].
-
-Track CPUID_HT in env->features[FEAT_1_EDX] instead and evaluate it in
-cpu's realizefn().
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-10-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit c6bd2dd634208ca717b6dc010064fe34d1359080)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 4e3da2efde9f16460e90246bec15b29739930bb1)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2295149bfa..e20977411d 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -6989,7 +6989,6 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         *edx = env->features[FEAT_1_EDX];
-         if (threads_per_pkg > 1) {
-             *ebx |= threads_per_pkg << 16;
--            *edx |= CPUID_HT;
-         }
-         if (!cpu->enable_pmu) {
-             *ecx &= ~CPUID_EXT_PDCM;
-@@ -7975,6 +7974,10 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-         }
-     }
- 
-+    if (x86_threads_per_pkg(&env->topo_info) > 1) {
-+        env->features[FEAT_1_EDX] |= CPUID_HT;
-+    }
-+
-     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
-         FeatureDep *d = &feature_dependencies[i];
-         if (!(env->features[d->from.index] & d->from.mask)) {
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch b/kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch
deleted file mode 100644
index 05b5ca0..0000000
--- a/kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch
+++ /dev/null
@@ -1,301 +0,0 @@
-From 03d6e64ed980335602368d3b470e33cb21af307d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 012/115] i386/cpu: Track a X86CPUTopoInfo directly in
- CPUX86State
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [12/115] 4d23b4e386ec4179739869c1ace2bb2b9f728bde (bonzini/rhel-qemu-kvm)
-
-The name of nr_modules/nr_dies are ambiguous and they mislead people.
-
-The purpose of them is to record and form the topology information. So
-just maintain a X86CPUTopoInfo member in CPUX86State instead. Then
-nr_modules and nr_dies can be dropped.
-
-As the benefit, x86 can switch to use information in
-CPUX86State::topo_info and get rid of the nr_cores and nr_threads in
-CPUState. This helps remove the dependency on qemu_init_vcpu(), so that
-x86 can get and use topology info earlier in x86_cpu_realizefn(); drop
-the comment that highlighted the depedency.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-7-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 84b71a131c1bc84c36fafb63271080ecf9f2ff7a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f598befcd2cddbf01f7606102400cec4acd35d48)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/x86-common.c     | 12 ++++------
- target/i386/cpu-sysemu.c |  6 ++---
- target/i386/cpu.c        | 51 +++++++++++++++++-----------------------
- target/i386/cpu.h        |  6 +----
- 4 files changed, 30 insertions(+), 45 deletions(-)
-
-diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
-index 2806be98f3..562215990d 100644
---- a/hw/i386/x86-common.c
-+++ b/hw/i386/x86-common.c
-@@ -248,7 +248,7 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-     CPUX86State *env = &cpu->env;
-     MachineState *ms = MACHINE(hotplug_dev);
-     X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
--    X86CPUTopoInfo topo_info;
-+    X86CPUTopoInfo *topo_info = &env->topo_info;
- 
-     if (!object_dynamic_cast(OBJECT(cpu), ms->cpu_type)) {
-         error_setg(errp, "Invalid CPU type, expected cpu type: '%s'",
-@@ -267,15 +267,13 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-         }
-     }
- 
--    init_topo_info(&topo_info, x86ms);
-+    init_topo_info(topo_info, x86ms);
- 
-     if (ms->smp.modules > 1) {
--        env->nr_modules = ms->smp.modules;
-         set_bit(CPU_TOPO_LEVEL_MODULE, env->avail_cpu_topo);
-     }
- 
-     if (ms->smp.dies > 1) {
--        env->nr_dies = ms->smp.dies;
-         set_bit(CPU_TOPO_LEVEL_DIE, env->avail_cpu_topo);
-     }
- 
-@@ -346,12 +344,12 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-         topo_ids.module_id = cpu->module_id;
-         topo_ids.core_id = cpu->core_id;
-         topo_ids.smt_id = cpu->thread_id;
--        cpu->apic_id = x86_apicid_from_topo_ids(&topo_info, &topo_ids);
-+        cpu->apic_id = x86_apicid_from_topo_ids(topo_info, &topo_ids);
-     }
- 
-     cpu_slot = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx);
-     if (!cpu_slot) {
--        x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
-+        x86_topo_ids_from_apicid(cpu->apic_id, topo_info, &topo_ids);
- 
-         error_setg(errp,
-             "Invalid CPU [socket: %u, die: %u, module: %u, core: %u, thread: %u]"
-@@ -374,7 +372,7 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
-     /* TODO: move socket_id/core_id/thread_id checks into x86_cpu_realizefn()
-      * once -smp refactoring is complete and there will be CPU private
-      * CPUState::nr_cores and CPUState::nr_threads fields instead of globals */
--    x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
-+    x86_topo_ids_from_apicid(cpu->apic_id, topo_info, &topo_ids);
-     if (cpu->socket_id != -1 && cpu->socket_id != topo_ids.pkg_id) {
-         error_setg(errp, "property socket-id: %u doesn't match set apic-id:"
-             " 0x%x (socket-id: %u)", cpu->socket_id, cpu->apic_id,
-diff --git a/target/i386/cpu-sysemu.c b/target/i386/cpu-sysemu.c
-index 4e9df0bc01..31b37c6325 100644
---- a/target/i386/cpu-sysemu.c
-+++ b/target/i386/cpu-sysemu.c
-@@ -312,11 +312,11 @@ void x86_cpu_get_crash_info_qom(Object *obj, Visitor *v,
- 
- uint64_t cpu_x86_get_msr_core_thread_count(X86CPU *cpu)
- {
--    CPUState *cs = CPU(cpu);
-+    CPUX86State *env = &cpu->env;
-     uint64_t val;
- 
--    val = cs->nr_threads * cs->nr_cores;  /* thread count, bits 15..0 */
--    val |= ((uint32_t)cs->nr_cores << 16); /* core count, bits 31..16 */
-+    val = x86_threads_per_pkg(&env->topo_info);  /* thread count, bits 15..0 */
-+    val |= x86_cores_per_pkg(&env->topo_info) << 16; /* core count, bits 31..16 */
- 
-     return val;
- }
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 1c79eb9a06..554455169a 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -6947,15 +6947,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-     CPUState *cs = env_cpu(env);
-     uint32_t limit;
-     uint32_t signature[3];
--    X86CPUTopoInfo topo_info;
-+    X86CPUTopoInfo *topo_info = &env->topo_info;
-     uint32_t threads_per_pkg;
- 
--    topo_info.dies_per_pkg = env->nr_dies;
--    topo_info.modules_per_die = env->nr_modules;
--    topo_info.cores_per_module = cs->nr_cores / env->nr_dies / env->nr_modules;
--    topo_info.threads_per_core = cs->nr_threads;
--
--    threads_per_pkg = x86_threads_per_pkg(&topo_info);
-+    threads_per_pkg = x86_threads_per_pkg(topo_info);
- 
-     /* Calculate & apply limits for different index ranges */
-     if (index >= 0xC0000000) {
-@@ -7032,12 +7027,12 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-                 int host_vcpus_per_cache = 1 + ((*eax & 0x3FFC000) >> 14);
- 
-                 *eax &= ~0xFC000000;
--                *eax |= max_core_ids_in_package(&topo_info) << 26;
-+                *eax |= max_core_ids_in_package(topo_info) << 26;
-                 if (host_vcpus_per_cache > threads_per_pkg) {
-                     *eax &= ~0x3FFC000;
- 
-                     /* Share the cache at package level. */
--                    *eax |= max_thread_ids_for_cache(&topo_info,
-+                    *eax |= max_thread_ids_for_cache(topo_info,
-                                 CPU_TOPO_LEVEL_PACKAGE) << 14;
-                 }
-             }
-@@ -7049,7 +7044,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-             switch (count) {
-             case 0: /* L1 dcache info */
-                 encode_cache_cpuid4(env->cache_info_cpuid4.l1d_cache,
--                                    &topo_info,
-+                                    topo_info,
-                                     eax, ebx, ecx, edx);
-                 if (!cpu->l1_cache_per_core) {
-                     *eax &= ~MAKE_64BIT_MASK(14, 12);
-@@ -7057,7 +7052,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-                 break;
-             case 1: /* L1 icache info */
-                 encode_cache_cpuid4(env->cache_info_cpuid4.l1i_cache,
--                                    &topo_info,
-+                                    topo_info,
-                                     eax, ebx, ecx, edx);
-                 if (!cpu->l1_cache_per_core) {
-                     *eax &= ~MAKE_64BIT_MASK(14, 12);
-@@ -7065,13 +7060,13 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-                 break;
-             case 2: /* L2 cache info */
-                 encode_cache_cpuid4(env->cache_info_cpuid4.l2_cache,
--                                    &topo_info,
-+                                    topo_info,
-                                     eax, ebx, ecx, edx);
-                 break;
-             case 3: /* L3 cache info */
-                 if (cpu->enable_l3_cache) {
-                     encode_cache_cpuid4(env->cache_info_cpuid4.l3_cache,
--                                        &topo_info,
-+                                        topo_info,
-                                         eax, ebx, ecx, edx);
-                     break;
-                 }
-@@ -7154,12 +7149,12 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
- 
-         switch (count) {
-         case 0:
--            *eax = apicid_core_offset(&topo_info);
--            *ebx = topo_info.threads_per_core;
-+            *eax = apicid_core_offset(topo_info);
-+            *ebx = topo_info->threads_per_core;
-             *ecx |= CPUID_B_ECX_TOPO_LEVEL_SMT << 8;
-             break;
-         case 1:
--            *eax = apicid_pkg_offset(&topo_info);
-+            *eax = apicid_pkg_offset(topo_info);
-             *ebx = threads_per_pkg;
-             *ecx |= CPUID_B_ECX_TOPO_LEVEL_CORE << 8;
-             break;
-@@ -7185,7 +7180,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-             break;
-         }
- 
--        encode_topo_cpuid1f(env, count, &topo_info, eax, ebx, ecx, edx);
-+        encode_topo_cpuid1f(env, count, topo_info, eax, ebx, ecx, edx);
-         break;
-     case 0xD: {
-         /* Processor Extended State */
-@@ -7488,7 +7483,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-              * thread ID within a package".
-              * Bits 7:0 is "The number of threads in the package is NC+1"
-              */
--            *ecx = (apicid_pkg_offset(&topo_info) << 12) |
-+            *ecx = (apicid_pkg_offset(topo_info) << 12) |
-                    (threads_per_pkg - 1);
-         } else {
-             *ecx = 0;
-@@ -7517,19 +7512,19 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         switch (count) {
-         case 0: /* L1 dcache info */
-             encode_cache_cpuid8000001d(env->cache_info_amd.l1d_cache,
--                                       &topo_info, eax, ebx, ecx, edx);
-+                                       topo_info, eax, ebx, ecx, edx);
-             break;
-         case 1: /* L1 icache info */
-             encode_cache_cpuid8000001d(env->cache_info_amd.l1i_cache,
--                                       &topo_info, eax, ebx, ecx, edx);
-+                                       topo_info, eax, ebx, ecx, edx);
-             break;
-         case 2: /* L2 cache info */
-             encode_cache_cpuid8000001d(env->cache_info_amd.l2_cache,
--                                       &topo_info, eax, ebx, ecx, edx);
-+                                       topo_info, eax, ebx, ecx, edx);
-             break;
-         case 3: /* L3 cache info */
-             encode_cache_cpuid8000001d(env->cache_info_amd.l3_cache,
--                                       &topo_info, eax, ebx, ecx, edx);
-+                                       topo_info, eax, ebx, ecx, edx);
-             break;
-         default: /* end of info */
-             *eax = *ebx = *ecx = *edx = 0;
-@@ -7541,7 +7536,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         break;
-     case 0x8000001E:
-         if (cpu->core_id <= 255) {
--            encode_topo_cpuid8000001e(cpu, &topo_info, eax, ebx, ecx, edx);
-+            encode_topo_cpuid8000001e(cpu, topo_info, eax, ebx, ecx, edx);
-         } else {
-             *eax = 0;
-             *ebx = 0;
-@@ -8440,17 +8435,14 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
-      * fixes this issue by adjusting CPUID_0000_0001_EBX and CPUID_8000_0008_ECX
-      * based on inputs (sockets,cores,threads), it is still better to give
-      * users a warning.
--     *
--     * NOTE: the following code has to follow qemu_init_vcpu(). Otherwise
--     * cs->nr_threads hasn't be populated yet and the checking is incorrect.
-      */
-     if (IS_AMD_CPU(env) &&
-         !(env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_TOPOEXT) &&
--        cs->nr_threads > 1) {
-+        env->topo_info.threads_per_core > 1) {
-             warn_report_once("This family of AMD CPU doesn't support "
-                              "hyperthreading(%d). Please configure -smp "
-                              "options properly or try enabling topoext "
--                             "feature.", cs->nr_threads);
-+                             "feature.", env->topo_info.threads_per_core);
-     }
- 
- #ifndef CONFIG_USER_ONLY
-@@ -8611,8 +8603,7 @@ static void x86_cpu_init_default_topo(X86CPU *cpu)
- {
-     CPUX86State *env = &cpu->env;
- 
--    env->nr_modules = 1;
--    env->nr_dies = 1;
-+    env->topo_info = (X86CPUTopoInfo) {1, 1, 1, 1};
- 
-     /* SMT, core and package levels are set by default. */
-     set_bit(CPU_TOPO_LEVEL_SMT, env->avail_cpu_topo);
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 8c9216d9d0..cc42a2c520 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2024,11 +2024,7 @@ typedef struct CPUArchState {
- 
-     TPRAccess tpr_access_type;
- 
--    /* Number of dies within this CPU package. */
--    unsigned nr_dies;
--
--    /* Number of modules within one die. */
--    unsigned nr_modules;
-+    X86CPUTopoInfo topo_info;
- 
-     /* Bitmap of available CPU topology levels for this CPU. */
-     DECLARE_BITMAP(avail_cpu_topo, CPU_TOPO_LEVEL_MAX);
--- 
-2.50.1
-
diff --git a/kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch b/kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch
deleted file mode 100644
index abde4c4..0000000
--- a/kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 831b04c3f8f66705a01b4fd455dbe53fa3193a4e Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 060/115] i386/cpu: introduce
- x86_confidential_guest_cpu_instance_init()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [60/115] be57d5108231bb12dc6c9ffd8c9c639b87b1f15c (bonzini/rhel-qemu-kvm)
-
-To allow execute confidential guest specific cpu init operations.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-32-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 8583c53e2b619b1b9569d3f2d3f3cb2904a573ad)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflict: include/system/ is still include/sysemu/
----
- target/i386/confidential-guest.h | 11 +++++++++++
- target/i386/cpu.c                |  8 ++++++++
- 2 files changed, 19 insertions(+)
-
-diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
-index 7342d2843a..38169ed68e 100644
---- a/target/i386/confidential-guest.h
-+++ b/target/i386/confidential-guest.h
-@@ -39,6 +39,7 @@ struct X86ConfidentialGuestClass {
- 
-     /* <public> */
-     int (*kvm_type)(X86ConfidentialGuest *cg);
-+    void (*cpu_instance_init)(X86ConfidentialGuest *cg, CPUState *cpu);
-     uint32_t (*mask_cpuid_features)(X86ConfidentialGuest *cg, uint32_t feature, uint32_t index,
-                                     int reg, uint32_t value);
- };
-@@ -59,6 +60,16 @@ static inline int x86_confidential_guest_kvm_type(X86ConfidentialGuest *cg)
-     }
- }
- 
-+static inline void x86_confidential_guest_cpu_instance_init(X86ConfidentialGuest *cg,
-+                                                            CPUState *cpu)
-+{
-+    X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
-+
-+    if (klass->cpu_instance_init) {
-+        klass->cpu_instance_init(cg, cpu);
-+    }
-+}
-+
- /**
-  * x86_confidential_guest_mask_cpuid_features:
-  *
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 4eef3d1dbd..ee6f1c0627 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -36,6 +36,7 @@
- #include "hw/qdev-properties.h"
- #include "hw/i386/topology.h"
- #ifndef CONFIG_USER_ONLY
-+#include "confidential-guest.h"
- #include "sysemu/reset.h"
- #include "qapi/qapi-commands-machine-target.h"
- #include "exec/address-spaces.h"
-@@ -8600,6 +8601,13 @@ static void x86_cpu_post_initfn(Object *obj)
-     }
- 
-     accel_cpu_instance_init(CPU(obj));
-+
-+#ifndef CONFIG_USER_ONLY
-+    if (current_machine && current_machine->cgs) {
-+        x86_confidential_guest_cpu_instance_init(
-+            X86_CONFIDENTIAL_GUEST(current_machine->cgs), (CPU(obj)));
-+    }
-+#endif
- }
- 
- static void x86_cpu_init_default_topo(X86CPU *cpu)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdvf-Fix-build-on-32-bit-host.patch b/kvm-i386-tdvf-Fix-build-on-32-bit-host.patch
deleted file mode 100644
index 7120003..0000000
--- a/kvm-i386-tdvf-Fix-build-on-32-bit-host.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From d77454aef08828ab25881dbd9acb25f3d6f59d10 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 086/115] i386/tdvf: Fix build on 32-bit host
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [86/115] 99b8d992079a248091911010238eb20588acca6a (bonzini/rhel-qemu-kvm)
-
-Use PRI formats where required.
-
-Cc: Isaku Yamahata <isaku.yamahata@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Link: https://lore.kernel.org/r/20250602173101.1052983-3-clg@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 6f1035fc65406c4e72e1dbd76e64924415edd616)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/tdvf.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
-index 88453cf3a5..6fcc794880 100644
---- a/hw/i386/tdvf.c
-+++ b/hw/i386/tdvf.c
-@@ -101,16 +101,16 @@ static int tdvf_parse_and_check_section_entry(const TdvfSectionEntry *src,
- 
-     /* sanity check */
-     if (entry->size < entry->data_len) {
--        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%lx",
-+        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%"PRIx64,
-                      entry->data_len, entry->size);
-         return -1;
-     }
-     if (!QEMU_IS_ALIGNED(entry->address, TDVF_ALIGNMENT)) {
--        error_report("MemoryAddress 0x%lx not page aligned", entry->address);
-+        error_report("MemoryAddress 0x%"PRIx64" not page aligned", entry->address);
-         return -1;
-     }
-     if (!QEMU_IS_ALIGNED(entry->size, TDVF_ALIGNMENT)) {
--        error_report("MemoryDataSize 0x%lx not page aligned", entry->size);
-+        error_report("MemoryDataSize 0x%"PRIx64" not page aligned", entry->size);
-         return -1;
-     }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch b/kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch
deleted file mode 100644
index 952fcb8..0000000
--- a/kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch
+++ /dev/null
@@ -1,315 +0,0 @@
-From e31406cad5a27e2a807dfacb92d9d44efd1615fe Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 046/115] i386/tdvf: Introduce function to parse TDVF metadata
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [46/115] 5eed49eea4f80f57a310e69a47ee220bd41f6188 (bonzini/rhel-qemu-kvm)
-
-TDX VM needs to boot with its specialized firmware, Trusted Domain
-Virtual Firmware (TDVF). QEMU needs to parse TDVF and map it in TD
-guest memory prior to running the TDX VM.
-
-A TDVF Metadata in TDVF image describes the structure of firmware.
-QEMU refers to it to setup memory for TDVF. Introduce function
-tdvf_parse_metadata() to parse the metadata from TDVF image and store
-the info of each TDVF section.
-
-TDX metadata is located by a TDX metadata offset block, which is a
-GUID-ed structure. The data portion of the GUID structure contains
-only an 4-byte field that is the offset of TDX metadata to the end
-of firmware file.
-
-Select X86_FW_OVMF when TDX is enable to leverage existing functions
-to parse and search OVMF's GUID-ed structures.
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-18-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b65a6011d16c4f7cb2eb227ab1bc735850475288)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/
----
- hw/i386/Kconfig        |   1 +
- hw/i386/meson.build    |   1 +
- hw/i386/tdvf.c         | 188 +++++++++++++++++++++++++++++++++++++++++
- include/hw/i386/tdvf.h |  38 +++++++++
- 4 files changed, 228 insertions(+)
- create mode 100644 hw/i386/tdvf.c
- create mode 100644 include/hw/i386/tdvf.h
-
-diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-index edd61cd2aa..31e50e2ebf 100644
---- a/hw/i386/Kconfig
-+++ b/hw/i386/Kconfig
-@@ -12,6 +12,7 @@ config SGX
- 
- config TDX
-     bool
-+    select X86_FW_OVMF
-     depends on KVM
- 
- config PC
-diff --git a/hw/i386/meson.build b/hw/i386/meson.build
-index 03aad10df7..d6d8023664 100644
---- a/hw/i386/meson.build
-+++ b/hw/i386/meson.build
-@@ -31,6 +31,7 @@ i386_ss.add(when: 'CONFIG_PC', if_true: files(
-   'port92.c'))
- i386_ss.add(when: 'CONFIG_X86_FW_OVMF', if_true: files('pc_sysfw_ovmf.c'),
-                                         if_false: files('pc_sysfw_ovmf-stubs.c'))
-+i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c'))
- 
- subdir('kvm')
- subdir('xen')
-diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
-new file mode 100644
-index 0000000000..824a387d42
---- /dev/null
-+++ b/hw/i386/tdvf.c
-@@ -0,0 +1,188 @@
-+/*
-+ * Copyright (c) 2025 Intel Corporation
-+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
-+ *                        <isaku.yamahata at intel.com>
-+ *         Xiaoyao Li <xiaoyao.li@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/error-report.h"
-+
-+#include "hw/i386/pc.h"
-+#include "hw/i386/tdvf.h"
-+#include "sysemu/kvm.h"
-+
-+#define TDX_METADATA_OFFSET_GUID    "e47a6535-984a-4798-865e-4685a7bf8ec2"
-+#define TDX_METADATA_VERSION        1
-+#define TDVF_SIGNATURE              0x46564454 /* TDVF as little endian */
-+#define TDVF_ALIGNMENT              4096
-+
-+/*
-+ * the raw structs read from TDVF keeps the name convention in
-+ * TDVF Design Guide spec.
-+ */
-+typedef struct {
-+    uint32_t DataOffset;
-+    uint32_t RawDataSize;
-+    uint64_t MemoryAddress;
-+    uint64_t MemoryDataSize;
-+    uint32_t Type;
-+    uint32_t Attributes;
-+} TdvfSectionEntry;
-+
-+typedef struct {
-+    uint32_t Signature;
-+    uint32_t Length;
-+    uint32_t Version;
-+    uint32_t NumberOfSectionEntries;
-+    TdvfSectionEntry SectionEntries[];
-+} TdvfMetadata;
-+
-+struct tdx_metadata_offset {
-+    uint32_t offset;
-+};
-+
-+static TdvfMetadata *tdvf_get_metadata(void *flash_ptr, int size)
-+{
-+    TdvfMetadata *metadata;
-+    uint32_t offset = 0;
-+    uint8_t *data;
-+
-+    if ((uint32_t) size != size) {
-+        return NULL;
-+    }
-+
-+    if (pc_system_ovmf_table_find(TDX_METADATA_OFFSET_GUID, &data, NULL)) {
-+        offset = size - le32_to_cpu(((struct tdx_metadata_offset *)data)->offset);
-+
-+        if (offset + sizeof(*metadata) > size) {
-+            return NULL;
-+        }
-+    } else {
-+        error_report("Cannot find TDX_METADATA_OFFSET_GUID");
-+        return NULL;
-+    }
-+
-+    metadata = flash_ptr + offset;
-+
-+    /* Finally, verify the signature to determine if this is a TDVF image. */
-+    metadata->Signature = le32_to_cpu(metadata->Signature);
-+    if (metadata->Signature != TDVF_SIGNATURE) {
-+        error_report("Invalid TDVF signature in metadata!");
-+        return NULL;
-+    }
-+
-+    /* Sanity check that the TDVF doesn't overlap its own metadata. */
-+    metadata->Length = le32_to_cpu(metadata->Length);
-+    if (offset + metadata->Length > size) {
-+        return NULL;
-+    }
-+
-+    /* Only version 1 is supported/defined. */
-+    metadata->Version = le32_to_cpu(metadata->Version);
-+    if (metadata->Version != TDX_METADATA_VERSION) {
-+        return NULL;
-+    }
-+
-+    return metadata;
-+}
-+
-+static int tdvf_parse_and_check_section_entry(const TdvfSectionEntry *src,
-+                                              TdxFirmwareEntry *entry)
-+{
-+    entry->data_offset = le32_to_cpu(src->DataOffset);
-+    entry->data_len = le32_to_cpu(src->RawDataSize);
-+    entry->address = le64_to_cpu(src->MemoryAddress);
-+    entry->size = le64_to_cpu(src->MemoryDataSize);
-+    entry->type = le32_to_cpu(src->Type);
-+    entry->attributes = le32_to_cpu(src->Attributes);
-+
-+    /* sanity check */
-+    if (entry->size < entry->data_len) {
-+        error_report("Broken metadata RawDataSize 0x%x MemoryDataSize 0x%lx",
-+                     entry->data_len, entry->size);
-+        return -1;
-+    }
-+    if (!QEMU_IS_ALIGNED(entry->address, TDVF_ALIGNMENT)) {
-+        error_report("MemoryAddress 0x%lx not page aligned", entry->address);
-+        return -1;
-+    }
-+    if (!QEMU_IS_ALIGNED(entry->size, TDVF_ALIGNMENT)) {
-+        error_report("MemoryDataSize 0x%lx not page aligned", entry->size);
-+        return -1;
-+    }
-+
-+    switch (entry->type) {
-+    case TDVF_SECTION_TYPE_BFV:
-+    case TDVF_SECTION_TYPE_CFV:
-+        /* The sections that must be copied from firmware image to TD memory */
-+        if (entry->data_len == 0) {
-+            error_report("%d section with RawDataSize == 0", entry->type);
-+            return -1;
-+        }
-+        break;
-+    case TDVF_SECTION_TYPE_TD_HOB:
-+    case TDVF_SECTION_TYPE_TEMP_MEM:
-+        /* The sections that no need to be copied from firmware image */
-+        if (entry->data_len != 0) {
-+            error_report("%d section with RawDataSize 0x%x != 0",
-+                         entry->type, entry->data_len);
-+            return -1;
-+        }
-+        break;
-+    default:
-+        error_report("TDVF contains unsupported section type %d", entry->type);
-+        return -1;
-+    }
-+
-+    return 0;
-+}
-+
-+int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size)
-+{
-+    g_autofree TdvfSectionEntry *sections = NULL;
-+    TdvfMetadata *metadata;
-+    ssize_t entries_size;
-+    int i;
-+
-+    metadata = tdvf_get_metadata(flash_ptr, size);
-+    if (!metadata) {
-+        return -EINVAL;
-+    }
-+
-+    /* load and parse metadata entries */
-+    fw->nr_entries = le32_to_cpu(metadata->NumberOfSectionEntries);
-+    if (fw->nr_entries < 2) {
-+        error_report("Invalid number of fw entries (%u) in TDVF Metadata",
-+                     fw->nr_entries);
-+        return -EINVAL;
-+    }
-+
-+    entries_size = fw->nr_entries * sizeof(TdvfSectionEntry);
-+    if (metadata->Length != sizeof(*metadata) + entries_size) {
-+        error_report("TDVF metadata len (0x%x) mismatch, expected (0x%x)",
-+                     metadata->Length,
-+                     (uint32_t)(sizeof(*metadata) + entries_size));
-+        return -EINVAL;
-+    }
-+
-+    fw->entries = g_new(TdxFirmwareEntry, fw->nr_entries);
-+    sections = g_new(TdvfSectionEntry, fw->nr_entries);
-+
-+    memcpy(sections, (void *)metadata + sizeof(*metadata), entries_size);
-+
-+    for (i = 0; i < fw->nr_entries; i++) {
-+        if (tdvf_parse_and_check_section_entry(&sections[i], &fw->entries[i])) {
-+            goto err;
-+        }
-+    }
-+
-+    return 0;
-+
-+err:
-+    fw->entries = 0;
-+    g_free(fw->entries);
-+    return -EINVAL;
-+}
-diff --git a/include/hw/i386/tdvf.h b/include/hw/i386/tdvf.h
-new file mode 100644
-index 0000000000..7ebcac42a3
---- /dev/null
-+++ b/include/hw/i386/tdvf.h
-@@ -0,0 +1,38 @@
-+/*
-+ * Copyright (c) 2025 Intel Corporation
-+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
-+ *                        <isaku.yamahata at intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef HW_I386_TDVF_H
-+#define HW_I386_TDVF_H
-+
-+#include "qemu/osdep.h"
-+
-+#define TDVF_SECTION_TYPE_BFV               0
-+#define TDVF_SECTION_TYPE_CFV               1
-+#define TDVF_SECTION_TYPE_TD_HOB            2
-+#define TDVF_SECTION_TYPE_TEMP_MEM          3
-+
-+#define TDVF_SECTION_ATTRIBUTES_MR_EXTEND   (1U << 0)
-+#define TDVF_SECTION_ATTRIBUTES_PAGE_AUG    (1U << 1)
-+
-+typedef struct TdxFirmwareEntry {
-+    uint32_t data_offset;
-+    uint32_t data_len;
-+    uint64_t address;
-+    uint64_t size;
-+    uint32_t type;
-+    uint32_t attributes;
-+} TdxFirmwareEntry;
-+
-+typedef struct TdxFirmware {
-+    uint32_t nr_entries;
-+    TdxFirmwareEntry *entries;
-+} TdxFirmware;
-+
-+int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size);
-+
-+#endif /* HW_I386_TDVF_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch b/kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch
deleted file mode 100644
index 81944df..0000000
--- a/kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 62fd2fea6ebca35e3bd12685ce5b10635375968b Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:25:28 +0200
-Subject: [PATCH 053/115] i386/tdx: Add TDVF memory via KVM_TDX_INIT_MEM_REGION
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [53/115] 44c8cbffafa5b307c5e28c6ad76abb496287cf47 (bonzini/rhel-qemu-kvm)
-
-TDVF firmware (CODE and VARS) needs to be copied to TD's private
-memory via KVM_TDX_INIT_MEM_REGION, as well as TD HOB and TEMP memory.
-
-If the TDVF section has TDVF_SECTION_ATTRIBUTES_MR_EXTEND set in the
-flag, calling KVM_TDX_EXTEND_MEMORY to extend the measurement.
-
-After populating the TDVF memory, the original image located in shared
-ramblock can be discarded.
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-25-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ebc2d2b497c59414ac3c91de32bc546d27940e74)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/,exec/
----
- target/i386/kvm/tdx.c | 42 ++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 42 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index db5d58b600..8f0826ac11 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -17,6 +17,7 @@
- #include "qom/object_interfaces.h"
- #include "crypto/hash.h"
- #include "sysemu/sysemu.h"
-+#include "exec/ramblock.h"
- 
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
-@@ -262,6 +263,9 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
- {
-     TdxFirmware *tdvf = &tdx_guest->tdvf;
-     TdxFirmwareEntry *entry;
-+    RAMBlock *ram_block;
-+    Error *local_err = NULL;
-+    int r;
- 
-     tdx_init_ram_entries();
- 
-@@ -297,6 +301,44 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
-           sizeof(TdxRamEntry), &tdx_ram_entry_compare);
- 
-     tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
-+
-+    for_each_tdx_fw_entry(tdvf, entry) {
-+        struct kvm_tdx_init_mem_region region;
-+        uint32_t flags;
-+
-+        region = (struct kvm_tdx_init_mem_region) {
-+            .source_addr = (uint64_t)entry->mem_ptr,
-+            .gpa = entry->address,
-+            .nr_pages = entry->size >> 12,
-+        };
-+
-+        flags = entry->attributes & TDVF_SECTION_ATTRIBUTES_MR_EXTEND ?
-+                KVM_TDX_MEASURE_MEMORY_REGION : 0;
-+
-+        do {
-+            error_free(local_err);
-+            local_err = NULL;
-+            r = tdx_vcpu_ioctl(first_cpu, KVM_TDX_INIT_MEM_REGION, flags,
-+                               &region, &local_err);
-+        } while (r == -EAGAIN || r == -EINTR);
-+        if (r < 0) {
-+            error_report_err(local_err);
-+            exit(1);
-+        }
-+
-+        if (entry->type == TDVF_SECTION_TYPE_TD_HOB ||
-+            entry->type == TDVF_SECTION_TYPE_TEMP_MEM) {
-+            qemu_ram_munmap(-1, entry->mem_ptr, entry->size);
-+            entry->mem_ptr = NULL;
-+        }
-+    }
-+
-+    /*
-+     * TDVF image has been copied into private region above via
-+     * KVM_MEMORY_MAPPING. It becomes useless.
-+     */
-+    ram_block = tdx_guest->tdvf_mr->ram_block;
-+    ram_block_discard_range(ram_block, 0, ram_block->max_length);
- }
- 
- static Notifier tdx_machine_done_notify = {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch b/kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch
deleted file mode 100644
index 94b41df..0000000
--- a/kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch
+++ /dev/null
@@ -1,249 +0,0 @@
-From 70f7099dfd895a7ffeee3f66e188c1853d3885d6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 074/115] i386/tdx: Add TDX fixed1 bits to supported CPUIDs
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [74/115] 81fb39c826363f892e46386883c69c0e862d7850 (bonzini/rhel-qemu-kvm)
-
-TDX architecture forcibly sets some CPUID bits for TD guest that VMM
-cannot disable it. They are fixed1 bits.
-
-Fixed1 bits are not covered by tdx_caps.cpuid (which only contains the
-directly configurable bits), while fixed1 bits are supported for TD guest
-obviously.
-
-Add fixed1 bits to tdx_supported_cpuid. Besides, set all the fixed1
-bits to the initial set of KVM's support since KVM might not report them
-as supported.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-46-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0ba06e46d09b84a2cb97a268da5576aaca3a24ca)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.h          |   2 +
- target/i386/kvm/kvm_i386.h |   7 ++
- target/i386/kvm/tdx.c      | 134 +++++++++++++++++++++++++++++++++++++
- target/i386/sev.c          |   8 ---
- 4 files changed, 143 insertions(+), 8 deletions(-)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 601e828577..529f24df00 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -924,6 +924,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_0_EDX_FSRM              (1U << 4)
- /* AVX512 Vector Pair Intersection to a Pair of Mask Registers */
- #define CPUID_7_0_EDX_AVX512_VP2INTERSECT (1U << 8)
-+ /* "md_clear" VERW clears CPU buffers */
-+#define CPUID_7_0_EDX_MD_CLEAR          (1U << 10)
- /* SERIALIZE instruction */
- #define CPUID_7_0_EDX_SERIALIZE         (1U << 14)
- /* TSX Suspend Load Address Tracking instruction */
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index 797610496a..f1d55d5b75 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -44,6 +44,13 @@ void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask);
- 
- #ifdef CONFIG_KVM
- 
-+#include <linux/kvm.h>
-+
-+typedef struct KvmCpuidInfo {
-+    struct kvm_cpuid2 cpuid;
-+    struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
-+} KvmCpuidInfo;
-+
- bool kvm_is_vm_type_supported(int type);
- bool kvm_has_adjust_clock_stable(void);
- bool kvm_has_exception_payload(void);
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 4949d01f22..6fa30c3ec4 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -367,6 +367,133 @@ static Notifier tdx_machine_done_notify = {
-     .notify = tdx_finalize_vm,
- };
- 
-+/*
-+ * Some CPUID bits change from fixed1 to configurable bits when TDX module
-+ * supports TDX_FEATURES0.VE_REDUCTION. e.g., MCA/MCE/MTRR/CORE_CAPABILITY.
-+ *
-+ * To make QEMU work with all the versions of TDX module, keep the fixed1 bits
-+ * here if they are ever fixed1 bits in any of the version though not fixed1 in
-+ * the latest version. Otherwise, with the older version of TDX module, QEMU may
-+ * treat the fixed1 bit as unsupported.
-+ *
-+ * For newer TDX module, it does no harm to keep them in tdx_fixed1_bits even
-+ * though they changed to configurable bits. Because tdx_fixed1_bits is used to
-+ * setup the supported bits.
-+ */
-+KvmCpuidInfo tdx_fixed1_bits = {
-+    .cpuid.nent = 8,
-+    .entries[0] = {
-+        .function = 0x1,
-+        .index = 0,
-+        .ecx = CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_DTES64 |
-+               CPUID_EXT_DSCPL | CPUID_EXT_SSSE3 | CPUID_EXT_CX16 |
-+               CPUID_EXT_PDCM | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
-+               CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
-+               CPUID_EXT_POPCNT | CPUID_EXT_AES | CPUID_EXT_XSAVE |
-+               CPUID_EXT_RDRAND | CPUID_EXT_HYPERVISOR,
-+        .edx = CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
-+               CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
-+               CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
-+               CPUID_PAT | CPUID_CLFLUSH | CPUID_DTS | CPUID_MMX | CPUID_FXSR |
-+               CPUID_SSE | CPUID_SSE2,
-+    },
-+    .entries[1] = {
-+        .function = 0x6,
-+        .index = 0,
-+        .eax = CPUID_6_EAX_ARAT,
-+    },
-+    .entries[2] = {
-+        .function = 0x7,
-+        .index = 0,
-+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
-+        .ebx = CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_FDP_EXCPTN_ONLY |
-+               CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_INVPCID |
-+               CPUID_7_0_EBX_ZERO_FCS_FDS | CPUID_7_0_EBX_RDSEED |
-+               CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
-+               CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_SHA_NI,
-+        .ecx = CPUID_7_0_ECX_BUS_LOCK_DETECT | CPUID_7_0_ECX_MOVDIRI |
-+               CPUID_7_0_ECX_MOVDIR64B,
-+        .edx = CPUID_7_0_EDX_MD_CLEAR | CPUID_7_0_EDX_SPEC_CTRL |
-+               CPUID_7_0_EDX_STIBP | CPUID_7_0_EDX_FLUSH_L1D |
-+               CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_CORE_CAPABILITY |
-+               CPUID_7_0_EDX_SPEC_CTRL_SSBD,
-+    },
-+    .entries[3] = {
-+        .function = 0x7,
-+        .index = 2,
-+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
-+        .edx = CPUID_7_2_EDX_PSFD | CPUID_7_2_EDX_IPRED_CTRL |
-+               CPUID_7_2_EDX_RRSBA_CTRL | CPUID_7_2_EDX_BHI_CTRL,
-+    },
-+    .entries[4] = {
-+        .function = 0xD,
-+        .index = 0,
-+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
-+        .eax = XSTATE_FP_MASK | XSTATE_SSE_MASK,
-+    },
-+    .entries[5] = {
-+        .function = 0xD,
-+        .index = 1,
-+        .flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX,
-+        .eax = CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC|
-+               CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
-+    },
-+    .entries[6] = {
-+        .function = 0x80000001,
-+        .index = 0,
-+        .ecx = CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
-+        /*
-+         * Strictly speaking, SYSCALL is not fixed1 bit since it depends on
-+         * the CPU to be in 64-bit mode. But here fixed1 is used to serve the
-+         * purpose of supported bits for TDX. In this sense, SYACALL is always
-+         * supported.
-+         */
-+        .edx = CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
-+               CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
-+    },
-+    .entries[7] = {
-+        .function = 0x80000007,
-+        .index = 0,
-+        .edx = CPUID_APM_INVTSC,
-+    },
-+};
-+
-+static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
-+                                                        uint32_t index)
-+{
-+    struct kvm_cpuid_entry2 *e;
-+
-+    e = cpuid_find_entry(tdx_supported_cpuid, function, index);
-+    if (!e) {
-+        if (tdx_supported_cpuid->nent >= KVM_MAX_CPUID_ENTRIES) {
-+            error_report("tdx_supported_cpuid requries more space than %d entries",
-+                          KVM_MAX_CPUID_ENTRIES);
-+            exit(1);
-+        }
-+        e = &tdx_supported_cpuid->entries[tdx_supported_cpuid->nent++];
-+        e->function = function;
-+        e->index = index;
-+    }
-+
-+    return e;
-+}
-+
-+static void tdx_add_supported_cpuid_by_fixed1_bits(void)
-+{
-+    struct kvm_cpuid_entry2 *e, *e1;
-+    int i;
-+
-+    for (i = 0; i < tdx_fixed1_bits.cpuid.nent; i++) {
-+        e = &tdx_fixed1_bits.entries[i];
-+
-+        e1 = find_in_supported_entry(e->function, e->index);
-+        e1->eax |= e->eax;
-+        e1->ebx |= e->ebx;
-+        e1->ecx |= e->ecx;
-+        e1->edx |= e->edx;
-+    }
-+}
-+
- static void tdx_setup_supported_cpuid(void)
- {
-     if (tdx_supported_cpuid) {
-@@ -379,6 +506,8 @@ static void tdx_setup_supported_cpuid(void)
-     memcpy(tdx_supported_cpuid->entries, tdx_caps->cpuid.entries,
-            tdx_caps->cpuid.nent * sizeof(struct kvm_cpuid_entry2));
-     tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
-+
-+    tdx_add_supported_cpuid_by_fixed1_bits();
- }
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-@@ -463,6 +592,11 @@ static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
- {
-     struct kvm_cpuid_entry2 *e;
- 
-+    e = cpuid_find_entry(&tdx_fixed1_bits.cpuid, feature, index);
-+    if (e) {
-+        value |= cpuid_entry_get_reg(e, reg);
-+    }
-+
-     if (is_feature_word_cpuid(feature, index, reg)) {
-         e = cpuid_find_entry(tdx_supported_cpuid, feature, index);
-         if (e) {
-diff --git a/target/i386/sev.c b/target/i386/sev.c
-index 24fcd078fc..edbad9bb92 100644
---- a/target/i386/sev.c
-+++ b/target/i386/sev.c
-@@ -211,14 +211,6 @@ static const char *const sev_fw_errlist[] = {
- 
- #define SEV_FW_MAX_ERROR      ARRAY_SIZE(sev_fw_errlist)
- 
--/* <linux/kvm.h> doesn't expose this, so re-use the max from kvm.c */
--#define KVM_MAX_CPUID_ENTRIES 100
--
--typedef struct KvmCpuidInfo {
--    struct kvm_cpuid2 cpuid;
--    struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
--} KvmCpuidInfo;
--
- #define SNP_CPUID_FUNCTION_MAXCOUNT 64
- #define SNP_CPUID_FUNCTION_UNKNOWN 0xFFFFFFFF
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch b/kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch
deleted file mode 100644
index e3e00bf..0000000
--- a/kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 2c833c9f0b720bcf4267f9025344586b4eaa4906 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 077/115] i386/tdx: Add XFD to supported bit of TDX
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [77/115] 12485d15d9f665ad75d51f92380997df371180e4 (bonzini/rhel-qemu-kvm)
-
-Just mark XFD as always supported for TDX. This simple solution relies
-on the fact KVM will report XFD as 0 when it's not supported by the
-hardware.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-49-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 9f5771c57dbe92d46361afd992a5851c846d0322)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.h     | 1 +
- target/i386/kvm/tdx.c | 6 ++++++
- 2 files changed, 7 insertions(+)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 3a7a409809..19645eb6f8 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -1100,6 +1100,7 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_XSAVE_XSAVEC     (1U << 1)
- #define CPUID_XSAVE_XGETBV1    (1U << 2)
- #define CPUID_XSAVE_XSAVES     (1U << 3)
-+#define CPUID_XSAVE_XFD        (1U << 4)
- 
- #define CPUID_6_EAX_ARAT       (1U << 2)
- 
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index feb9cd7466..f15ed51a32 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -621,6 +621,12 @@ static void tdx_add_supported_cpuid_by_xfam(void)
-     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK) >> 32;
- 
-     e = find_in_supported_entry(0xd, 1);
-+    /*
-+     * Mark XFD always support for TDX, it will be cleared finally in
-+     * tdx_adjust_cpuid_features() if XFD is unavailable on the hardware
-+     * because in this case the original data has it as 0.
-+     */
-+    e->eax |= CPUID_XSAVE_XFD;
-     e->ecx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK);
-     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch b/kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch
deleted file mode 100644
index 17a6754..0000000
--- a/kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From b62e9f0a875520807daa28d0b808e2ba9d96ca79 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 038/115] i386/tdx: Add property sept-ve-disable for tdx-guest
- object
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [38/115] 3a21966b474dde36a34aa215e45262ba83a809ac (bonzini/rhel-qemu-kvm)
-
-Bit 28 of TD attribute, named SEPT_VE_DISABLE. When set to 1, it disables
-EPT violation conversion to #VE on guest TD access of PENDING pages.
-
-Some guest OS (e.g., Linux TD guest) may require this bit as 1.
-Otherwise refuse to boot.
-
-Add sept-ve-disable property for tdx-guest object, for user to configure
-this bit.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-10-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 6016e2972d94c90307b6caf55a8e3aee5424c09b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- qapi/qom.json         |  8 +++++++-
- target/i386/kvm/tdx.c | 23 +++++++++++++++++++++++
- 2 files changed, 30 insertions(+), 1 deletion(-)
-
-diff --git a/qapi/qom.json b/qapi/qom.json
-index 530efeb7c5..fefb54f90b 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -1016,10 +1016,16 @@
- # @attributes: The 'attributes' of a TD guest that is passed to
- #     KVM_TDX_INIT_VM
- #
-+# @sept-ve-disable: toggle bit 28 of TD attributes to control disabling
-+#     of EPT violation conversion to #VE on guest TD access of PENDING
-+#     pages.  Some guest OS (e.g., Linux TD guest) may require this to
-+#     be set, otherwise they refuse to boot.
-+#
- # Since: 10.1
- ##
- { 'struct': 'TdxGuestProperties',
--  'data': { '*attributes': 'uint64' } }
-+  'data': { '*attributes': 'uint64',
-+            '*sept-ve-disable': 'bool' } }
- 
- ##
- # @ThreadContextProperties:
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 8f02c76249..370bd86f2c 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -18,6 +18,8 @@
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+#define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
-+
- static TdxGuest *tdx_guest;
- 
- static struct kvm_tdx_capabilities *tdx_caps;
-@@ -252,6 +254,24 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     return 0;
- }
- 
-+static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    return !!(tdx->attributes & TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE);
-+}
-+
-+static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    if (value) {
-+        tdx->attributes |= TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
-+    } else {
-+        tdx->attributes &= ~TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
-+    }
-+}
-+
- /* tdx guest */
- OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-                                    tdx_guest,
-@@ -272,6 +292,9 @@ static void tdx_guest_init(Object *obj)
- 
-     object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
-                                    OBJ_PROP_FLAG_READWRITE);
-+    object_property_add_bool(obj, "sept-ve-disable",
-+                             tdx_guest_get_sept_ve_disable,
-+                             tdx_guest_set_sept_ve_disable);
- }
- 
- static void tdx_guest_finalize(Object *obj)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch b/kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch
deleted file mode 100644
index c6978ce..0000000
--- a/kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From d228f2ad7fb96be3ec1fa3256ee0404cf7e2b094 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 075/115] i386/tdx: Add supported CPUID bits related to TD
- Attributes
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [75/115] 095f42329711d2cb7f147856ebf2775a522fd8e3 (bonzini/rhel-qemu-kvm)
-
-For TDX, some CPUID feature bit is configured via TD attributes. They
-are not covered by tdx_caps.cpuid (which only contians the directly
-configurable CPUID bits), but they are actually supported when the
-related attributre bit is supported.
-
-Note, LASS and KeyLocker are not supported by KVM for TDX, nor does
-QEMU support it (see TDX_SUPPORTED_TD_ATTRS). They are defined in
-tdx_attrs_maps[] for the completeness of the existing TD Attribute
-bits that are related with CPUID features.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-47-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 31df29c532a9ef473c6efd497950a620099bf1da)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.h     |  4 +++
- target/i386/kvm/tdx.c | 60 +++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 64 insertions(+)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 529f24df00..e02cb75619 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -903,6 +903,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_0_ECX_LA57              (1U << 16)
- /* Read Processor ID */
- #define CPUID_7_0_ECX_RDPID             (1U << 22)
-+/* KeyLocker */
-+#define CPUID_7_0_ECX_KeyLocker         (1U << 23)
- /* Bus Lock Debug Exception */
- #define CPUID_7_0_ECX_BUS_LOCK_DETECT   (1U << 24)
- /* Cache Line Demote Instruction */
-@@ -963,6 +965,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_1_EAX_AVX_VNNI          (1U << 4)
- /* AVX512 BFloat16 Instruction */
- #define CPUID_7_1_EAX_AVX512_BF16       (1U << 5)
-+/* Linear address space separation */
-+#define CPUID_7_1_EAX_LASS              (1U << 6)
- /* CMPCCXADD Instructions */
- #define CPUID_7_1_EAX_CMPCCXADD         (1U << 7)
- /* Fast Zero REP MOVS */
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 6fa30c3ec4..60dd239c05 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -458,6 +458,34 @@ KvmCpuidInfo tdx_fixed1_bits = {
-     },
- };
- 
-+typedef struct TdxAttrsMap {
-+    uint32_t attr_index;
-+    uint32_t cpuid_leaf;
-+    uint32_t cpuid_subleaf;
-+    int cpuid_reg;
-+    uint32_t feat_mask;
-+} TdxAttrsMap;
-+
-+static TdxAttrsMap tdx_attrs_maps[] = {
-+    {.attr_index = 27,
-+     .cpuid_leaf = 7,
-+     .cpuid_subleaf = 1,
-+     .cpuid_reg = R_EAX,
-+     .feat_mask = CPUID_7_1_EAX_LASS,},
-+
-+    {.attr_index = 30,
-+     .cpuid_leaf = 7,
-+     .cpuid_subleaf = 0,
-+     .cpuid_reg = R_ECX,
-+     .feat_mask = CPUID_7_0_ECX_PKS,},
-+
-+    {.attr_index = 31,
-+     .cpuid_leaf = 7,
-+     .cpuid_subleaf = 0,
-+     .cpuid_reg = R_ECX,
-+     .feat_mask = CPUID_7_0_ECX_KeyLocker,},
-+};
-+
- static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
-                                                         uint32_t index)
- {
-@@ -494,6 +522,37 @@ static void tdx_add_supported_cpuid_by_fixed1_bits(void)
-     }
- }
- 
-+static void tdx_add_supported_cpuid_by_attrs(void)
-+{
-+    struct kvm_cpuid_entry2 *e;
-+    TdxAttrsMap *map;
-+    int i;
-+
-+    for (i = 0; i < ARRAY_SIZE(tdx_attrs_maps); i++) {
-+        map = &tdx_attrs_maps[i];
-+        if (!((1ULL << map->attr_index) & tdx_caps->supported_attrs)) {
-+            continue;
-+        }
-+
-+        e = find_in_supported_entry(map->cpuid_leaf, map->cpuid_subleaf);
-+
-+        switch(map->cpuid_reg) {
-+        case R_EAX:
-+            e->eax |= map->feat_mask;
-+            break;
-+        case R_EBX:
-+            e->ebx |= map->feat_mask;
-+            break;
-+        case R_ECX:
-+            e->ecx |= map->feat_mask;
-+            break;
-+        case R_EDX:
-+            e->edx |= map->feat_mask;
-+            break;
-+        }
-+    }
-+}
-+
- static void tdx_setup_supported_cpuid(void)
- {
-     if (tdx_supported_cpuid) {
-@@ -508,6 +567,7 @@ static void tdx_setup_supported_cpuid(void)
-     tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
- 
-     tdx_add_supported_cpuid_by_fixed1_bits();
-+    tdx_add_supported_cpuid_by_attrs();
- }
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch b/kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch
deleted file mode 100644
index 3913487..0000000
--- a/kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch
+++ /dev/null
@@ -1,220 +0,0 @@
-From 714abb122a2cc4819b05a3893dfd2c61a9204c5e Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 076/115] i386/tdx: Add supported CPUID bits relates to XFAM
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [76/115] 459d99074c90bfd8048585dec42749cb18493ee9 (bonzini/rhel-qemu-kvm)
-
-Some CPUID bits are controlled by XFAM. They are not covered by
-tdx_caps.cpuid (which only contians the directly configurable bits), but
-they are actually supported when the related XFAM bit is supported.
-
-Add these XFAM controlled bits to TDX supported CPUID bits based on the
-supported_xfam.
-
-Besides, incorporate the supported_xfam into the supported CPUID leaf of
-0xD.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-48-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 8c94c84cb9e0140b48acc9c9d404525ca7ef7457)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c     | 12 -------
- target/i386/cpu.h     | 16 ++++++++++
- target/i386/kvm/tdx.c | 73 +++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 89 insertions(+), 12 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2da456da64..cd6d9e8c1c 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1660,15 +1660,6 @@ bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg)
-     return false;
- }
- 
--typedef struct FeatureMask {
--    FeatureWord index;
--    uint64_t mask;
--} FeatureMask;
--
--typedef struct FeatureDep {
--    FeatureMask from, to;
--} FeatureDep;
--
- static FeatureDep feature_dependencies[] = {
-     {
-         .from = { FEAT_7_0_EDX,             CPUID_7_0_EDX_ARCH_CAPABILITIES },
-@@ -1837,9 +1828,6 @@ static const X86RegisterInfo32 x86_reg_info_32[CPU_NB_REGS32] = {
- };
- #undef REGISTER
- 
--/* CPUID feature bits available in XSS */
--#define CPUID_XSTATE_XSS_MASK    (XSTATE_ARCH_LBR_MASK)
--
- ExtSaveArea x86_ext_save_areas[XSAVE_STATE_AREA_COUNT] = {
-     [XSTATE_FP_BIT] = {
-         /* x87 FP state component is always enabled if XSAVE is supported */
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index e02cb75619..3a7a409809 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -589,6 +589,7 @@ typedef enum X86Seg {
- #define XSTATE_OPMASK_BIT               5
- #define XSTATE_ZMM_Hi256_BIT            6
- #define XSTATE_Hi16_ZMM_BIT             7
-+#define XSTATE_PT_BIT                   8
- #define XSTATE_PKRU_BIT                 9
- #define XSTATE_ARCH_LBR_BIT             15
- #define XSTATE_XTILE_CFG_BIT            17
-@@ -602,6 +603,7 @@ typedef enum X86Seg {
- #define XSTATE_OPMASK_MASK              (1ULL << XSTATE_OPMASK_BIT)
- #define XSTATE_ZMM_Hi256_MASK           (1ULL << XSTATE_ZMM_Hi256_BIT)
- #define XSTATE_Hi16_ZMM_MASK            (1ULL << XSTATE_Hi16_ZMM_BIT)
-+#define XSTATE_PT_MASK                  (1ULL << XSTATE_PT_BIT)
- #define XSTATE_PKRU_MASK                (1ULL << XSTATE_PKRU_BIT)
- #define XSTATE_ARCH_LBR_MASK            (1ULL << XSTATE_ARCH_LBR_BIT)
- #define XSTATE_XTILE_CFG_MASK           (1ULL << XSTATE_XTILE_CFG_BIT)
-@@ -624,6 +626,11 @@ typedef enum X86Seg {
-                                  XSTATE_Hi16_ZMM_MASK | XSTATE_PKRU_MASK | \
-                                  XSTATE_XTILE_CFG_MASK | XSTATE_XTILE_DATA_MASK)
- 
-+/* CPUID feature bits available in XSS */
-+#define CPUID_XSTATE_XSS_MASK    (XSTATE_ARCH_LBR_MASK)
-+
-+#define CPUID_XSTATE_MASK       (CPUID_XSTATE_XCR0_MASK | CPUID_XSTATE_XSS_MASK)
-+
- /* CPUID feature words */
- typedef enum FeatureWord {
-     FEAT_1_EDX,         /* CPUID[1].EDX */
-@@ -671,6 +678,15 @@ typedef enum FeatureWord {
-     FEATURE_WORDS,
- } FeatureWord;
- 
-+typedef struct FeatureMask {
-+    FeatureWord index;
-+    uint64_t mask;
-+} FeatureMask;
-+
-+typedef struct FeatureDep {
-+    FeatureMask from, to;
-+} FeatureDep;
-+
- typedef uint64_t FeatureWordArray[FEATURE_WORDS];
- uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- 
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 60dd239c05..feb9cd7466 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -23,6 +23,8 @@
- 
- #include <linux/kvm_para.h>
- 
-+#include "cpu.h"
-+#include "cpu-internal.h"
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
-@@ -486,6 +488,32 @@ static TdxAttrsMap tdx_attrs_maps[] = {
-      .feat_mask = CPUID_7_0_ECX_KeyLocker,},
- };
- 
-+typedef struct TdxXFAMDep {
-+    int xfam_bit;
-+    FeatureMask feat_mask;
-+} TdxXFAMDep;
-+
-+/*
-+ * Note, only the CPUID bits whose virtualization type are "XFAM & Native" are
-+ * defiend here.
-+ *
-+ * For those whose virtualization type are "XFAM & Configured & Native", they
-+ * are reported as configurable bits. And they are not supported if not in the
-+ * configureable bits list from KVM even if the corresponding XFAM bit is
-+ * supported.
-+ */
-+TdxXFAMDep tdx_xfam_deps[] = {
-+    { XSTATE_YMM_BIT,       { FEAT_1_ECX, CPUID_EXT_FMA }},
-+    { XSTATE_YMM_BIT,       { FEAT_7_0_EBX, CPUID_7_0_EBX_AVX2 }},
-+    { XSTATE_OPMASK_BIT,    { FEAT_7_0_ECX, CPUID_7_0_ECX_AVX512_VBMI}},
-+    { XSTATE_OPMASK_BIT,    { FEAT_7_0_EDX, CPUID_7_0_EDX_AVX512_FP16}},
-+    { XSTATE_PT_BIT,        { FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT}},
-+    { XSTATE_PKRU_BIT,      { FEAT_7_0_ECX, CPUID_7_0_ECX_PKU}},
-+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_BF16 }},
-+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_TILE }},
-+    { XSTATE_XTILE_CFG_BIT, { FEAT_7_0_EDX, CPUID_7_0_EDX_AMX_INT8 }},
-+};
-+
- static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function,
-                                                         uint32_t index)
- {
-@@ -553,6 +581,50 @@ static void tdx_add_supported_cpuid_by_attrs(void)
-     }
- }
- 
-+static void tdx_add_supported_cpuid_by_xfam(void)
-+{
-+    struct kvm_cpuid_entry2 *e;
-+    int i;
-+
-+    const TdxXFAMDep *xfam_dep;
-+    const FeatureWordInfo *f;
-+    for (i = 0; i < ARRAY_SIZE(tdx_xfam_deps); i++) {
-+        xfam_dep = &tdx_xfam_deps[i];
-+        if (!((1ULL << xfam_dep->xfam_bit) & tdx_caps->supported_xfam)) {
-+            continue;
-+        }
-+
-+        f = &feature_word_info[xfam_dep->feat_mask.index];
-+        if (f->type != CPUID_FEATURE_WORD) {
-+            continue;
-+        }
-+
-+        e = find_in_supported_entry(f->cpuid.eax, f->cpuid.ecx);
-+        switch(f->cpuid.reg) {
-+        case R_EAX:
-+            e->eax |= xfam_dep->feat_mask.mask;
-+            break;
-+        case R_EBX:
-+            e->ebx |= xfam_dep->feat_mask.mask;
-+            break;
-+        case R_ECX:
-+            e->ecx |= xfam_dep->feat_mask.mask;
-+            break;
-+        case R_EDX:
-+            e->edx |= xfam_dep->feat_mask.mask;
-+            break;
-+        }
-+    }
-+
-+    e = find_in_supported_entry(0xd, 0);
-+    e->eax |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK);
-+    e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XCR0_MASK) >> 32;
-+
-+    e = find_in_supported_entry(0xd, 1);
-+    e->ecx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK);
-+    e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
-+}
-+
- static void tdx_setup_supported_cpuid(void)
- {
-     if (tdx_supported_cpuid) {
-@@ -568,6 +640,7 @@ static void tdx_setup_supported_cpuid(void)
- 
-     tdx_add_supported_cpuid_by_fixed1_bits();
-     tdx_add_supported_cpuid_by_attrs();
-+    tdx_add_supported_cpuid_by_xfam();
- }
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch b/kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch
deleted file mode 100644
index 171eb8f..0000000
--- a/kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 8d316b8468ec2e87ffc2e75c422698a2acdbcd16 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 054/115] i386/tdx: Call KVM_TDX_INIT_VCPU to initialize TDX
- vcpu
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [54/115] 01b560fa024020f7be4e649cabd47f9f6bca920a (bonzini/rhel-qemu-kvm)
-
-TDX vcpu needs to be initialized by SEAMCALL(TDH.VP.INIT) and KVM
-provides vcpu level IOCTL KVM_TDX_INIT_VCPU for it.
-
-KVM_TDX_INIT_VCPU needs the address of the HOB as input. Invoke it for
-each vcpu after HOB list is created.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-26-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 41f7fd22073561a23229c0479d9d708dee9d3a1e)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 8f0826ac11..7980daf8c4 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -259,6 +259,18 @@ static void tdx_init_ram_entries(void)
-     tdx_guest->nr_ram_entries = j;
- }
- 
-+static void tdx_post_init_vcpus(void)
-+{
-+    TdxFirmwareEntry *hob;
-+    CPUState *cpu;
-+
-+    hob = tdx_get_hob_entry(tdx_guest);
-+    CPU_FOREACH(cpu) {
-+        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)hob->address,
-+                       &error_fatal);
-+    }
-+}
-+
- static void tdx_finalize_vm(Notifier *notifier, void *unused)
- {
-     TdxFirmware *tdvf = &tdx_guest->tdvf;
-@@ -302,6 +314,8 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
- 
-     tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
- 
-+    tdx_post_init_vcpus();
-+
-     for_each_tdx_fw_entry(tdvf, entry) {
-         struct kvm_tdx_init_mem_region region;
-         uint32_t flags;
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch b/kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch
deleted file mode 100644
index 543928e..0000000
--- a/kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 7dd643f8005449c3e34643f2cb85fcbab8011482 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 091/115] i386/tdx: Clarify the error message of
- mrconfigid/mrowner/mrownerconfig
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [91/115] 5f8559f8d9f842f79916f49f4806dd4cf2f8c686 (bonzini/rhel-qemu-kvm)
-
-The error message is misleading - we successfully decoded the data,
-the decoded data was simply with the wrong length.
-
-Change the error message to show it is an length check failure with both
-the received and expected values.
-
-Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Link: https://lore.kernel.org/r/20250603050305.1704586-4-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 41cd354d350d3c64915be9c5decbf20abd84e486)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index ca3641441c..ed3a55991a 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1032,7 +1032,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-             return -1;
-         }
-         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
--            error_setg(errp, "TDX: failed to decode mrconfigid");
-+            error_setg(errp, "TDX 'mrconfigid' sha384 digest was %ld bytes, "
-+                             "expected %d bytes", data_len,
-+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
-             return -1;
-         }
-         memcpy(init_vm->mrconfigid, data, data_len);
-@@ -1045,7 +1047,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-             return -1;
-         }
-         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
--            error_setg(errp, "TDX: failed to decode mrowner");
-+            error_setg(errp, "TDX 'mrowner' sha384 digest was %ld bytes, "
-+                             "expected %d bytes", data_len,
-+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
-             return -1;
-         }
-         memcpy(init_vm->mrowner, data, data_len);
-@@ -1058,7 +1062,9 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-             return -1;
-         }
-         if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
--            error_setg(errp, "TDX: failed to decode mrownerconfig");
-+            error_setg(errp, "TDX 'mrownerconfig' sha384 digest was %ld bytes, "
-+                             "expected %d bytes", data_len,
-+                             QCRYPTO_HASH_DIGEST_LEN_SHA384);
-             return -1;
-         }
-         memcpy(init_vm->mrownerconfig, data, data_len);
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch b/kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch
deleted file mode 100644
index 8c8bc4e..0000000
--- a/kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 25f3b21b6b1654d1ffde72e231a4635b5929a6a8 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 078/115] i386/tdx: Define supported KVM features for TDX
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [78/115] d0ab8e6f6795d750c9fd07bf19bec65078424075 (bonzini/rhel-qemu-kvm)
-
-For TDX, only limited KVM PV features are supported.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-50-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 4d6e288a350a977b0fb0613db952087928ccd93e)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index f15ed51a32..32e03caf43 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -32,6 +32,8 @@
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+#include "standard-headers/asm-x86/kvm_para.h"
-+
- #define TDX_MIN_TSC_FREQUENCY_KHZ   (100 * 1000)
- #define TDX_MAX_TSC_FREQUENCY_KHZ   (10 * 1000 * 1000)
- 
-@@ -44,6 +46,14 @@
-                                  TDX_TD_ATTRIBUTES_PKS | \
-                                  TDX_TD_ATTRIBUTES_PERFMON)
- 
-+#define TDX_SUPPORTED_KVM_FEATURES  ((1U << KVM_FEATURE_NOP_IO_DELAY) | \
-+                                     (1U << KVM_FEATURE_PV_UNHALT) | \
-+                                     (1U << KVM_FEATURE_PV_TLB_FLUSH) | \
-+                                     (1U << KVM_FEATURE_PV_SEND_IPI) | \
-+                                     (1U << KVM_FEATURE_POLL_CONTROL) | \
-+                                     (1U << KVM_FEATURE_PV_SCHED_YIELD) | \
-+                                     (1U << KVM_FEATURE_MSI_EXT_DEST_ID))
-+
- static TdxGuest *tdx_guest;
- 
- static struct kvm_tdx_capabilities *tdx_caps;
-@@ -631,6 +641,14 @@ static void tdx_add_supported_cpuid_by_xfam(void)
-     e->edx |= (tdx_caps->supported_xfam & CPUID_XSTATE_XSS_MASK) >> 32;
- }
- 
-+static void tdx_add_supported_kvm_features(void)
-+{
-+    struct kvm_cpuid_entry2 *e;
-+
-+    e = find_in_supported_entry(0x40000001, 0);
-+    e->eax = TDX_SUPPORTED_KVM_FEATURES;
-+}
-+
- static void tdx_setup_supported_cpuid(void)
- {
-     if (tdx_supported_cpuid) {
-@@ -647,6 +665,8 @@ static void tdx_setup_supported_cpuid(void)
-     tdx_add_supported_cpuid_by_fixed1_bits();
-     tdx_add_supported_cpuid_by_attrs();
-     tdx_add_supported_cpuid_by_xfam();
-+
-+    tdx_add_supported_kvm_features();
- }
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch b/kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch
deleted file mode 100644
index abe8a91..0000000
--- a/kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 52482dfcf0f97cd5db7a210497bdf45390cb7600 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 066/115] i386/tdx: Disable PIC for TDX VMs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [66/115] 8f3badca2c7cb18d3d10bb1208396f63b7aeb47b (bonzini/rhel-qemu-kvm)
-
-Legacy PIC (8259) cannot be supported for TDX VMs since TDX module
-doesn't allow directly interrupt injection.  Using posted interrupts
-for the PIC is not a viable option as the guest BIOS/kernel will not
-do EOI for PIC IRQs, i.e. will leave the vIRR bit set.
-
-Hence disable PIC for TDX VMs and error out if user wants PIC.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-38-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e7ef60892c80a9ce5b8504ceb13a81f4e0d4b3f7)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 9bd6843988..4f17e17308 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -381,6 +381,13 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         return -EINVAL;
-     }
- 
-+    if (x86ms->pic == ON_OFF_AUTO_AUTO) {
-+        x86ms->pic = ON_OFF_AUTO_OFF;
-+    } else if (x86ms->pic == ON_OFF_AUTO_ON) {
-+        error_setg(errp, "TDX VM doesn't support PIC");
-+        return -EINVAL;
-+    }
-+
-     if (!tdx_caps) {
-         r = get_tdx_capabilities(errp);
-         if (r) {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch b/kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch
deleted file mode 100644
index c836e5d..0000000
--- a/kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From e8e1554e0b626131745170c94a780b0d875aad63 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 065/115] i386/tdx: Disable SMM for TDX VMs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [65/115] 69f950f26ffbea4f8ad6ff7f0be7ee3a4ce13c2b (bonzini/rhel-qemu-kvm)
-
-TDX doesn't support SMM and VMM cannot emulate SMM for TDX VMs because
-VMM cannot manipulate TDX VM's memory.
-
-Disable SMM for TDX VMs and error out if user requests to enable SMM.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-37-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 810d4e83d07ca0d072205453a42c324a51d5a5fa)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 7bc36b620e..9bd6843988 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -367,11 +367,20 @@ static Notifier tdx_machine_done_notify = {
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-+    MachineState *ms = MACHINE(qdev_get_machine());
-+    X86MachineState *x86ms = X86_MACHINE(ms);
-     TdxGuest *tdx = TDX_GUEST(cgs);
-     int r = 0;
- 
-     kvm_mark_guest_state_protected();
- 
-+    if (x86ms->smm == ON_OFF_AUTO_AUTO) {
-+        x86ms->smm = ON_OFF_AUTO_OFF;
-+    } else if (x86ms->smm == ON_OFF_AUTO_ON) {
-+        error_setg(errp, "TDX VM doesn't support SMM");
-+        return -EINVAL;
-+    }
-+
-     if (!tdx_caps) {
-         r = get_tdx_capabilities(errp);
-         if (r) {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch b/kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch
deleted file mode 100644
index 71bb3aa..0000000
--- a/kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 43d75b6ffdd152f55c366befb9eabbc8d0a7f6e7 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 048/115] i386/tdx: Don't initialize pc.rom for TDX VMs
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [48/115] 857ab7fccb138b45db15621688e412aef24b5821 (bonzini/rhel-qemu-kvm)
-
-For TDX, the address below 1MB are entirely general RAM. No need to
-initialize pc.rom memory region for TDs.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-20-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 49b1f0f812372129736c1df0421c8f67d86d362b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/pc.c | 29 ++++++++++++++++-------------
- 1 file changed, 16 insertions(+), 13 deletions(-)
-
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 5237538640..057cd1fb86 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -43,6 +43,7 @@
- #include "sysemu/xen.h"
- #include "sysemu/reset.h"
- #include "kvm/kvm_i386.h"
-+#include "kvm/tdx.h"
- #include "hw/xen/xen.h"
- #include "qapi/qmp/qlist.h"
- #include "qemu/error-report.h"
-@@ -1131,21 +1132,23 @@ void pc_memory_init(PCMachineState *pcms,
-     /* Initialize PC system firmware */
-     pc_system_firmware_init(pcms, rom_memory);
- 
--    option_rom_mr = g_malloc(sizeof(*option_rom_mr));
--    if (machine_require_guest_memfd(machine)) {
--        memory_region_init_ram_guest_memfd(option_rom_mr, NULL, "pc.rom",
--                                           PC_ROM_SIZE, &error_fatal);
--    } else {
--        memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
--                               &error_fatal);
--        if (pcmc->pci_enabled) {
--            memory_region_set_readonly(option_rom_mr, true);
-+    if (!is_tdx_vm()) {
-+        option_rom_mr = g_malloc(sizeof(*option_rom_mr));
-+        if (machine_require_guest_memfd(machine)) {
-+            memory_region_init_ram_guest_memfd(option_rom_mr, NULL, "pc.rom",
-+                                            PC_ROM_SIZE, &error_fatal);
-+        } else {
-+            memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
-+                                &error_fatal);
-+            if (pcmc->pci_enabled) {
-+                memory_region_set_readonly(option_rom_mr, true);
-+            }
-         }
-+        memory_region_add_subregion_overlap(rom_memory,
-+                                            PC_ROM_MIN_VGA,
-+                                            option_rom_mr,
-+                                            1);
-     }
--    memory_region_add_subregion_overlap(rom_memory,
--                                        PC_ROM_MIN_VGA,
--                                        option_rom_mr,
--                                        1);
- 
-     fw_cfg = fw_cfg_arch_create(machine,
-                                 x86ms->boot_cpus, x86ms->apic_id_limit);
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch b/kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch
deleted file mode 100644
index 5f806b7..0000000
--- a/kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From ec1ff403bb13fbb487a19a16c3da299038fecf2c Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 104/115] i386/tdx: Don't mask off CPUID_EXT_PDCM
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [104/115] 46c1e5c86031d5d9ab9082e2d0affb3ddf7d1fb2 (bonzini/rhel-qemu-kvm)
-
-It gets below warning when booting TDX VMs:
-
-  warning: TDX forcibly sets the feature: CPUID[eax=01h].ECX.pdcm [bit 15]
-
-Because CPUID_EXT_PDCM is fixed1 for TDX, and MSR_IA32_PERF_CAPABILITIES is
-supported for TDX guest unconditioanlly.
-
-Don't mask off CPUID_EXT_PDCM for TDX.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250625035710.2770679-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 7ff24fb657d35c014f735f69aef03810fde607ab)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflict: no call to mark_unavailable_features
----
- target/i386/cpu.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2160754869..d0161f922c 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -27,6 +27,7 @@
- #include "sysemu/hvf.h"
- #include "hvf/hvf-i386.h"
- #include "kvm/kvm_i386.h"
-+#include "kvm/tdx.h"
- #include "sev.h"
- #include "qapi/error.h"
- #include "qemu/error-report.h"
-@@ -8011,7 +8012,8 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-         }
-     }
- 
--    if (!cpu->enable_pmu) {
-+    /* PDCM is fixed1 bit for TDX */
-+    if (!cpu->enable_pmu && !is_tdx_vm()) {
-         env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
-     }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch b/kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch
deleted file mode 100644
index 91733a7..0000000
--- a/kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 6339bd26122c876a663e841810de28c064e09128 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 068/115] i386/tdx: Don't synchronize guest tsc for TDs
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [68/115] 56f6dc49e20933d8539b2413a902a2fbad2751e0 (bonzini/rhel-qemu-kvm)
-
-TSC of TDs is not accessible and KVM doesn't allow access of
-MSR_IA32_TSC for TDs. To avoid the assert() in kvm_get_tsc, make
-kvm_synchronize_all_tsc() noop for TDs,
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-40-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0ed55865b49b703af93e160d48935812a7114e07)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index f4809ee004..0c47eef03c 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -319,7 +319,7 @@ void kvm_synchronize_all_tsc(void)
- {
-     CPUState *cpu;
- 
--    if (kvm_enabled()) {
-+    if (kvm_enabled() && !is_tdx_vm()) {
-         CPU_FOREACH(cpu) {
-             run_on_cpu(cpu, do_kvm_synchronize_tsc, RUN_ON_CPU_NULL);
-         }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch b/kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch
deleted file mode 100644
index 418f3b1..0000000
--- a/kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From fd2d6e5623acae8b935c2ee5cb03d1a1b1631bb9 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 081/115] i386/tdx: Don't treat SYSCALL as unavailable
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [81/115] f742fd685ae68e7828947fa1013a5bdb0b49750d (bonzini/rhel-qemu-kvm)
-
-On Intel CPU, the value of CPUID_EXT2_SYSCALL depends on the mode of
-the vcpu. It's 0 outside 64-bit mode and 1 in 64-bit mode.
-
-The initial state of TDX vcpu is 32-bit protected mode. At the time of
-calling KVM_TDX_GET_CPUID, vcpu hasn't started running so the value read
-is 0.
-
-In reality, 64-bit mode should always be supported. So mark
-CPUID_EXT2_SYSCALL always supported to avoid false warning.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-53-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit deb9db6fb789cfe80527b75983e86137589227a4)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 01fff9a27a..3e23010094 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -845,6 +845,19 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
-             continue;
-         }
- 
-+        /* Fixup for special cases */
-+        switch (w) {
-+        case FEAT_8000_0001_EDX:
-+            /*
-+             * Intel enumerates SYSCALL bit as 1 only when processor in 64-bit
-+             * mode and before vcpu running it's not in 64-bit mode.
-+             */
-+            actual |= CPUID_EXT2_SYSCALL;
-+            break;
-+        default:
-+            break;
-+        }
-+
-         requested = env->features[w];
-         unavailable = requested & ~actual;
-         mark_unavailable_features(cpu, w, unavailable, unav_prefix);
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch b/kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch
deleted file mode 100644
index f18fc54..0000000
--- a/kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From b7e4b3d2a67cf3af83f9226a8f3b7b159d15fba1 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 056/115] i386/tdx: Enable user exit on KVM_HC_MAP_GPA_RANGE
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [56/115] 88e3d0cfdca0c78873aed608518d75ed1703c5fb (bonzini/rhel-qemu-kvm)
-
-KVM translates TDG.VP.VMCALL<MapGPA> to KVM_HC_MAP_GPA_RANGE, and QEMU
-needs to enable user exit on KVM_HC_MAP_GPA_RANGE in order to handle the
-memory conversion requested by TD guest.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-28-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 1ff5048d74e661943260c33e864c4118acb37ab4)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 19ed1038a7..62c83394d0 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -19,6 +19,8 @@
- #include "sysemu/sysemu.h"
- #include "exec/ramblock.h"
- 
-+#include <linux/kvm_para.h>
-+
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
-@@ -376,6 +378,11 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         }
-     }
- 
-+    /* TDX relies on KVM_HC_MAP_GPA_RANGE to handle TDG.VP.VMCALL<MapGPA> */
-+    if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) {
-+        return -EOPNOTSUPP;
-+    }
-+
-     qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
- 
-     tdx_guest = tdx;
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch b/kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch
deleted file mode 100644
index 977700b..0000000
--- a/kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From bbfdcd93ce27ea64b6f6854dfdb8635f107de76c Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 088/115] i386/tdx: Error and exit when named cpu model is
- requested
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [88/115] 7ffb866075f6c8951eee9fbbd6ff3a0362519c4a (bonzini/rhel-qemu-kvm)
-
-Currently, it gets below error when requesting any named cpu model with
-"-cpu" to boot a TDX VM:
-
-  qemu-system-x86_64: KVM_TDX_INIT_VM failed: Invalid argument
-
-It misleads people to think it's the bug of KVM or QEMU. It is just that
-current QEMU doesn't support named cpu model for TDX.
-
-To support named cpu models for TDX guest, there are opens to be
-finalized and needs a mount of additional work.
-
-For now, explicitly check the case when named cpu model is requested.
-Error report a hint and exit.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250612133801.2238342-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 750560f8a832361cf5cc4cd7bc4f56e1e76206f6)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index cca2b11622..3099e40baa 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -739,8 +739,14 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
- 
- static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
- {
-+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
-     X86CPU *x86cpu = X86_CPU(cpu);
- 
-+    if (xcc->model) {
-+        error_report("Named cpu model is not supported for TDX yet!");
-+        exit(1);
-+    }
-+
-     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
- 
-     /* invtsc is fixed1 for TD guest */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch b/kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch
deleted file mode 100644
index 17bf4a5..0000000
--- a/kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From 58e6218a7d4b00316cf4ccd6a394190169a4cc61 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 080/115] i386/tdx: Fetch and validate CPUID of TD guest
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [80/115] c2ba91b28a4d0191fb186aea069733b81ab56e0f (bonzini/rhel-qemu-kvm)
-
-Use KVM_TDX_GET_CPUID to get the CPUIDs that are managed and enfored
-by TDX module for TD guest. Check QEMU's configuration against the
-fetched data.
-
-Print wanring  message when 1. a feature is not supported but requested
-by QEMU or 2. QEMU doesn't want to expose a feature while it is enforced
-enabled.
-
-- If cpu->enforced_cpuid is not set, prints the warning message of both
-1) and 2) and tweak QEMU's configuration.
-
-- If cpu->enforced_cpuid is set, quit if any case of 1) or 2).
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-52-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e3d1a4a6d1d61cf5fbd0e4b389cfb3976093739f)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c     |  33 +++++++++++++-
- target/i386/cpu.h     |   7 +++
- target/i386/kvm/tdx.c | 101 ++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 139 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index cd6d9e8c1c..433d0a0418 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5937,8 +5937,8 @@ static bool x86_cpu_have_filtered_features(X86CPU *cpu)
-     return false;
- }
- 
--static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
--                                      const char *verbose_prefix)
-+void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-+                               const char *verbose_prefix)
- {
-     CPUX86State *env = &cpu->env;
-     FeatureWordInfo *f = &feature_word_info[w];
-@@ -5965,6 +5965,35 @@ static void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-     }
- }
- 
-+void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-+                             const char *verbose_prefix)
-+{
-+    CPUX86State *env = &cpu->env;
-+    FeatureWordInfo *f = &feature_word_info[w];
-+    int i;
-+
-+    if (!cpu->force_features) {
-+        env->features[w] |= mask;
-+    }
-+
-+    cpu->forced_on_features[w] |= mask;
-+
-+    if (!verbose_prefix) {
-+        return;
-+    }
-+
-+    for (i = 0; i < 64; ++i) {
-+        if ((1ULL << i) & mask) {
-+            g_autofree char *feat_word_str = feature_word_description(f);
-+            warn_report("%s: %s%s%s [bit %d]",
-+                        verbose_prefix,
-+                        feat_word_str,
-+                        f->feat_names[i] ? "." : "",
-+                        f->feat_names[i] ? f->feat_names[i] : "", i);
-+        }
-+    }
-+}
-+
- static void x86_cpuid_version_get_family(Object *obj, Visitor *v,
-                                          const char *name, void *opaque,
-                                          Error **errp)
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 19645eb6f8..2e73945b28 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2144,6 +2144,9 @@ struct ArchCPU {
-     /* Features that were filtered out because of missing host capabilities */
-     FeatureWordArray filtered_features;
- 
-+    /* Features that are forced enabled by underlying hypervisor, e.g., TDX */
-+    FeatureWordArray forced_on_features;
-+
-     /* Enable PMU CPUID bits. This can't be enabled by default yet because
-      * it doesn't have ABI stability guarantees, as it passes all PMU CPUID
-      * bits returned by GET_SUPPORTED_CPUID (that depend on host CPU and kernel
-@@ -2455,6 +2458,10 @@ void host_cpuid(uint32_t function, uint32_t count,
-                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
- bool cpu_has_x2apic_feature(CPUX86State *env);
- bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg);
-+void mark_unavailable_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-+                               const char *verbose_prefix);
-+void mark_forced_on_features(X86CPU *cpu, FeatureWord w, uint64_t mask,
-+                             const char *verbose_prefix);
- 
- static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
- {
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 32e03caf43..01fff9a27a 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -766,6 +766,106 @@ static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
-     return value;
- }
- 
-+static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
-+{
-+    struct kvm_cpuid2 *fetch_cpuid;
-+    int size = KVM_MAX_CPUID_ENTRIES;
-+    Error *local_err = NULL;
-+    int r;
-+
-+    do {
-+        error_free(local_err);
-+        local_err = NULL;
-+
-+        fetch_cpuid = g_malloc0(sizeof(*fetch_cpuid) +
-+                                sizeof(struct kvm_cpuid_entry2) * size);
-+        fetch_cpuid->nent = size;
-+        r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
-+        if (r == -E2BIG) {
-+            g_free(fetch_cpuid);
-+            size = fetch_cpuid->nent;
-+        }
-+    } while (r == -E2BIG);
-+
-+    if (r < 0) {
-+        error_report_err(local_err);
-+        *ret = r;
-+        return NULL;
-+    }
-+
-+    return fetch_cpuid;
-+}
-+
-+static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
-+{
-+    uint64_t actual, requested, unavailable, forced_on;
-+    g_autofree struct kvm_cpuid2 *fetch_cpuid;
-+    const char *forced_on_prefix = NULL;
-+    const char *unav_prefix = NULL;
-+    struct kvm_cpuid_entry2 *entry;
-+    X86CPU *cpu = X86_CPU(cs);
-+    CPUX86State *env = &cpu->env;
-+    FeatureWordInfo *wi;
-+    FeatureWord w;
-+    bool mismatch = false;
-+    int r;
-+
-+    fetch_cpuid = tdx_fetch_cpuid(cs, &r);
-+    if (!fetch_cpuid) {
-+        return r;
-+    }
-+
-+    if (cpu->check_cpuid || cpu->enforce_cpuid) {
-+        unav_prefix = "TDX doesn't support requested feature";
-+        forced_on_prefix = "TDX forcibly sets the feature";
-+    }
-+
-+    for (w = 0; w < FEATURE_WORDS; w++) {
-+        wi = &feature_word_info[w];
-+        actual = 0;
-+
-+        switch (wi->type) {
-+        case CPUID_FEATURE_WORD:
-+            entry = cpuid_find_entry(fetch_cpuid, wi->cpuid.eax, wi->cpuid.ecx);
-+            if (!entry) {
-+                /*
-+                 * If KVM doesn't report it means it's totally configurable
-+                 * by QEMU
-+                 */
-+                continue;
-+            }
-+
-+            actual = cpuid_entry_get_reg(entry, wi->cpuid.reg);
-+            break;
-+        case MSR_FEATURE_WORD:
-+            /*
-+             * TODO:
-+             * validate MSR features when KVM has interface report them.
-+             */
-+            continue;
-+        }
-+
-+        requested = env->features[w];
-+        unavailable = requested & ~actual;
-+        mark_unavailable_features(cpu, w, unavailable, unav_prefix);
-+        if (unavailable) {
-+            mismatch = true;
-+        }
-+
-+        forced_on = actual & ~requested;
-+        mark_forced_on_features(cpu, w, forced_on, forced_on_prefix);
-+        if (forced_on) {
-+            mismatch = true;
-+        }
-+    }
-+
-+    if (cpu->enforce_cpuid && mismatch) {
-+        return -EINVAL;
-+    }
-+
-+    return 0;
-+}
-+
- static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
- {
-     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
-@@ -1161,4 +1261,5 @@ static void tdx_guest_class_init(ObjectClass *oc, void *data)
-     x86_klass->kvm_type = tdx_kvm_type;
-     x86_klass->cpu_instance_init = tdx_cpu_instance_init;
-     x86_klass->adjust_cpuid_features = tdx_adjust_cpuid_features;
-+    x86_klass->check_features = tdx_check_features;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Finalize-TDX-VM.patch b/kvm-i386-tdx-Finalize-TDX-VM.patch
deleted file mode 100644
index 38a3ebd..0000000
--- a/kvm-i386-tdx-Finalize-TDX-VM.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 8468a1a6a23c02c4a4b09501d7702d7e44095df9 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 055/115] i386/tdx: Finalize TDX VM
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [55/115] 391331e4b8c4582cc4db040188c44ab5ff23987e (bonzini/rhel-qemu-kvm)
-
-Invoke KVM_TDX_FINALIZE_VM to finalize the TD's measurement and make
-the TD vCPUs runnable once machine initialization is complete.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-27-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ae60ff4e9f9e5790f79abf866ec67270c28ca477)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 7980daf8c4..19ed1038a7 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -353,6 +353,9 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
-      */
-     ram_block = tdx_guest->tdvf_mr->ram_block;
-     ram_block_discard_range(ram_block, 0, ram_block->max_length);
-+
-+    tdx_vm_ioctl(KVM_TDX_FINALIZE_VM, 0, NULL, &error_fatal);
-+    CONFIDENTIAL_GUEST_SUPPORT(tdx_guest)->ready = true;
- }
- 
- static Notifier tdx_machine_done_notify = {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Fix-build-on-32-bit-host.patch b/kvm-i386-tdx-Fix-build-on-32-bit-host.patch
deleted file mode 100644
index 5a6f2e6..0000000
--- a/kvm-i386-tdx-Fix-build-on-32-bit-host.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From 537c96692b8d9830e4712a74f17d294cfd43a2bb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 085/115] i386/tdx: Fix build on 32-bit host
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [85/115] e62d030c943c217f64f1488b4ef3f52e8d77cab9 (bonzini/rhel-qemu-kvm)
-
-Use PRI formats where required and fix pointer cast.
-
-Cc: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Link: https://lore.kernel.org/r/20250602173101.1052983-2-clg@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e7f926eb7f5b81c709313974b476ed181c9c76d5)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 26 +++++++++++++-------------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index b9c3ba3725..cca2b11622 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -284,7 +284,7 @@ static void tdx_post_init_vcpus(void)
- 
-     hob = tdx_get_hob_entry(tdx_guest);
-     CPU_FOREACH(cpu) {
--        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)hob->address,
-+        tdx_vcpu_ioctl(cpu, KVM_TDX_INIT_VCPU, 0, (void *)(uintptr_t)hob->address,
-                        &error_fatal);
-     }
- }
-@@ -339,7 +339,7 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
-         uint32_t flags;
- 
-         region = (struct kvm_tdx_init_mem_region) {
--            .source_addr = (uint64_t)entry->mem_ptr,
-+            .source_addr = (uintptr_t)entry->mem_ptr,
-             .gpa = entry->address,
-             .nr_pages = entry->size >> 12,
-         };
-@@ -893,16 +893,16 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
- static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
- {
-     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
--        error_setg(errp, "Invalid attributes 0x%lx for TDX VM "
--                   "(KVM supported: 0x%llx)", tdx->attributes,
--                   tdx_caps->supported_attrs);
-+        error_setg(errp, "Invalid attributes 0x%"PRIx64" for TDX VM "
-+                   "(KVM supported: 0x%"PRIx64")", tdx->attributes,
-+                   (uint64_t)tdx_caps->supported_attrs);
-         return -1;
-     }
- 
-     if (tdx->attributes & ~TDX_SUPPORTED_TD_ATTRS) {
-         error_setg(errp, "Some QEMU unsupported TD attribute bits being "
--                    "requested: 0x%lx (QEMU supported: 0x%llx)",
--                    tdx->attributes, TDX_SUPPORTED_TD_ATTRS);
-+                    "requested: 0x%"PRIx64" (QEMU supported: 0x%"PRIx64")",
-+                    tdx->attributes, (uint64_t)TDX_SUPPORTED_TD_ATTRS);
-         return -1;
-     }
- 
-@@ -931,8 +931,8 @@ static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
-            env->features[FEAT_XSAVE_XSS_HI];
- 
-     if (xfam & ~tdx_caps->supported_xfam) {
--        error_setg(errp, "Invalid XFAM 0x%lx for TDX VM (supported: 0x%llx))",
--                   xfam, tdx_caps->supported_xfam);
-+        error_setg(errp, "Invalid XFAM 0x%"PRIx64" for TDX VM (supported: 0x%"PRIx64"))",
-+                   xfam, (uint64_t)tdx_caps->supported_xfam);
-         return -1;
-     }
- 
-@@ -999,14 +999,14 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
- 
-     if (env->tsc_khz && (env->tsc_khz < TDX_MIN_TSC_FREQUENCY_KHZ ||
-                          env->tsc_khz > TDX_MAX_TSC_FREQUENCY_KHZ)) {
--        error_setg(errp, "Invalid TSC %ld KHz, must specify cpu_frequency "
-+        error_setg(errp, "Invalid TSC %"PRId64" KHz, must specify cpu_frequency "
-                          "between [%d, %d] kHz", env->tsc_khz,
-                          TDX_MIN_TSC_FREQUENCY_KHZ, TDX_MAX_TSC_FREQUENCY_KHZ);
-        return -EINVAL;
-     }
- 
-     if (env->tsc_khz % (25 * 1000)) {
--        error_setg(errp, "Invalid TSC %ld KHz, it must be multiple of 25MHz",
-+        error_setg(errp, "Invalid TSC %"PRId64" KHz, it must be multiple of 25MHz",
-                    env->tsc_khz);
-         return -EINVAL;
-     }
-@@ -1014,7 +1014,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     /* it's safe even env->tsc_khz is 0. KVM uses host's tsc_khz in this case */
-     r = kvm_vm_ioctl(kvm_state, KVM_SET_TSC_KHZ, env->tsc_khz);
-     if (r < 0) {
--        error_setg_errno(errp, -r, "Unable to set TSC frequency to %ld kHz",
-+        error_setg_errno(errp, -r, "Unable to set TSC frequency to %"PRId64" kHz",
-                          env->tsc_khz);
-         return r;
-     }
-@@ -1139,7 +1139,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-     uint64_t gpa = -1ull;
- 
-     if (error_code & 0xffff) {
--        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
-+        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%"PRIx64,
-                      error_code);
-         return -1;
-     }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch b/kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch
deleted file mode 100644
index d798c5e..0000000
--- a/kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 6c84c60f50287a00c91dd390b8d71f008c704048 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 102/115] i386/tdx: Fix the report of gpa in QAPI
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [102/115] ccaf1112d985ac652bd118bce4486853163cbc16 (bonzini/rhel-qemu-kvm)
-
-Gpa is defined in QAPI but never reported to monitor because has_gpa is
-never set to ture.
-
-Fix it by setting has_gpa to ture when TDX_REPORT_FATAL_ERROR_GPA_VALID
-is set in error_code.
-
-Fixes: 6e250463b08b ("i386/tdx: Wire TDX_REPORT_FATAL_ERROR with GuestPanic facility")
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Link: https://lore.kernel.org/r/20250710035538.303136-1-zhenzhong.duan@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b28f6d5c16f19f8c56926c10929db29f913895ad)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index e56db74f58..20fcd9a4c5 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1321,7 +1321,8 @@ void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
- }
- 
- static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
--                                        char *message, uint64_t gpa)
-+                                        char *message, bool has_gpa,
-+                                        uint64_t gpa)
- {
-     GuestPanicInformation *panic_info;
- 
-@@ -1330,6 +1331,7 @@ static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-     panic_info->u.tdx.error_code = (uint32_t) error_code;
-     panic_info->u.tdx.message = message;
-     panic_info->u.tdx.gpa = gpa;
-+    panic_info->u.tdx.has_gpa = has_gpa;
- 
-     qemu_system_guest_panicked(panic_info);
- }
-@@ -1349,6 +1351,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-     char *message = NULL;
-     uint64_t *tmp;
-     uint64_t gpa = -1ull;
-+    bool has_gpa = false;
- 
-     if (error_code & 0xffff) {
-         error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%"PRIx64,
-@@ -1381,9 +1384,10 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
- 
-     if (error_code & TDX_REPORT_FATAL_ERROR_GPA_VALID) {
-         gpa = run->system_event.data[R_R13];
-+        has_gpa = true;
-     }
- 
--    tdx_panicked_on_fatal_error(cpu, error_code, message, gpa);
-+    tdx_panicked_on_fatal_error(cpu, error_code, message, has_gpa, gpa);
- 
-     return -1;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch b/kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch
deleted file mode 100644
index d790d05..0000000
--- a/kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 3d855c5ffd0b235642c334ea3e9680451e2e50a6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 090/115] i386/tdx: Fix the typo of the comment of struct
- TdxGuest
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [90/115] 86befce58e11c4eba084141ec177648b901dd165 (bonzini/rhel-qemu-kvm)
-
-Change sha348 to sha384.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Link: https://lore.kernel.org/r/20250603050305.1704586-3-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a38da9f4876bb17d7ed9c6e24964b12b61877d38)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 04b5afe199..8dd66e9014 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -40,9 +40,9 @@ typedef struct TdxGuest {
-     bool initialized;
-     uint64_t attributes;    /* TD attributes */
-     uint64_t xfam;
--    char *mrconfigid;       /* base64 encoded sha348 digest */
--    char *mrowner;          /* base64 encoded sha348 digest */
--    char *mrownerconfig;    /* base64 encoded sha348 digest */
-+    char *mrconfigid;       /* base64 encoded sha384 digest */
-+    char *mrowner;          /* base64 encoded sha384 digest */
-+    char *mrownerconfig;    /* base64 encoded sha384 digest */
- 
-     MemoryRegion *tdvf_mr;
-     TdxFirmware tdvf;
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch b/kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch
deleted file mode 100644
index cfc0e54..0000000
--- a/kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 06700e387cf55d20af5fa85245b189408f35a851 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 063/115] i386/tdx: Force exposing CPUID 0x1f
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [63/115] 45b63d9803eb03a2f9014c9a3eb084c2edf5f11d (bonzini/rhel-qemu-kvm)
-
-TDX uses CPUID 0x1f to configure TD guest's CPU topology. So set
-enable_cpuid_0x1f for TDs.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-35-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 9002494f80b751a7655045c5f46bf90bc1d3bbd0)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index afd7e62422..410f8a9997 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -400,7 +400,11 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
- 
- static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
- {
-+    X86CPU *x86cpu = X86_CPU(cpu);
-+
-     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
-+
-+    x86cpu->enable_cpuid_0x1f = true;
- }
- 
- static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch b/kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch
deleted file mode 100644
index 256ddc3..0000000
--- a/kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-From 5c6bd0700ee50d40a791c1a00c475f9042e23343 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 034/115] i386/tdx: Get tdx_capabilities via
- KVM_TDX_CAPABILITIES
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [34/115] bd4711c0cf17e73ea2f21417b6b031c9118a35c6 (bonzini/rhel-qemu-kvm)
-
-KVM provides TDX capabilities via sub command KVM_TDX_CAPABILITIES of
-IOCTL(KVM_MEMORY_ENCRYPT_OP). Get the capabilities when initializing
-TDX context. It will be used to validate user's setting later.
-
-Since there is no interface reporting how many cpuid configs contains in
-KVM_TDX_CAPABILITIES, QEMU chooses to try starting with a known number
-and abort when it exceeds KVM_MAX_CPUID_ENTRIES.
-
-Besides, introduce the interfaces to invoke TDX "ioctls" at VCPU scope
-in preparation.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-6-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 8eddedc3701d2190db976a05155a8263c8ec175b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c      |   2 -
- target/i386/kvm/kvm_i386.h |   2 +
- target/i386/kvm/tdx.c      | 107 ++++++++++++++++++++++++++++++++++++-
- 3 files changed, 108 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 12da34b9c5..bf4493dd84 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -1771,8 +1771,6 @@ static int hyperv_init_vcpu(X86CPU *cpu)
- 
- static Error *invtsc_mig_blocker;
- 
--#define KVM_MAX_CPUID_ENTRIES  100
--
- static void kvm_init_xsave(CPUX86State *env)
- {
-     if (has_xsave2) {
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index 7edb154a16..499691e8d0 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -13,6 +13,8 @@
- 
- #include "sysemu/kvm.h"
- 
-+#define KVM_MAX_CPUID_ENTRIES  100
-+
- /* always false if !CONFIG_KVM */
- #define kvm_pit_in_kernel() \
-     (kvm_irqchip_in_kernel() && !kvm_irqchip_is_split())
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 4ff9486081..c67be5e618 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -10,17 +10,122 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include "qemu/error-report.h"
-+#include "qapi/error.h"
- #include "qom/object_interfaces.h"
- 
- #include "hw/i386/x86.h"
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+static struct kvm_tdx_capabilities *tdx_caps;
-+
-+enum tdx_ioctl_level {
-+    TDX_VM_IOCTL,
-+    TDX_VCPU_IOCTL,
-+};
-+
-+static int tdx_ioctl_internal(enum tdx_ioctl_level level, void *state,
-+                              int cmd_id, __u32 flags, void *data,
-+                              Error **errp)
-+{
-+    struct kvm_tdx_cmd tdx_cmd = {};
-+    int r;
-+
-+    const char *tdx_ioctl_name[] = {
-+        [KVM_TDX_CAPABILITIES] = "KVM_TDX_CAPABILITIES",
-+        [KVM_TDX_INIT_VM] = "KVM_TDX_INIT_VM",
-+        [KVM_TDX_INIT_VCPU] = "KVM_TDX_INIT_VCPU",
-+        [KVM_TDX_INIT_MEM_REGION] = "KVM_TDX_INIT_MEM_REGION",
-+        [KVM_TDX_FINALIZE_VM] = "KVM_TDX_FINALIZE_VM",
-+        [KVM_TDX_GET_CPUID] = "KVM_TDX_GET_CPUID",
-+    };
-+
-+    tdx_cmd.id = cmd_id;
-+    tdx_cmd.flags = flags;
-+    tdx_cmd.data = (__u64)(unsigned long)data;
-+
-+    switch (level) {
-+    case TDX_VM_IOCTL:
-+        r = kvm_vm_ioctl(kvm_state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
-+        break;
-+    case TDX_VCPU_IOCTL:
-+        r = kvm_vcpu_ioctl(state, KVM_MEMORY_ENCRYPT_OP, &tdx_cmd);
-+        break;
-+    default:
-+        error_setg(errp, "Invalid tdx_ioctl_level %d", level);
-+        return -EINVAL;
-+    }
-+
-+    if (r < 0) {
-+        error_setg_errno(errp, -r, "TDX ioctl %s failed, hw_errors: 0x%llx",
-+                         tdx_ioctl_name[cmd_id], tdx_cmd.hw_error);
-+    }
-+    return r;
-+}
-+
-+static inline int tdx_vm_ioctl(int cmd_id, __u32 flags, void *data,
-+                               Error **errp)
-+{
-+    return tdx_ioctl_internal(TDX_VM_IOCTL, NULL, cmd_id, flags, data, errp);
-+}
-+
-+static inline int tdx_vcpu_ioctl(CPUState *cpu, int cmd_id, __u32 flags,
-+                                 void *data, Error **errp)
-+{
-+    return  tdx_ioctl_internal(TDX_VCPU_IOCTL, cpu, cmd_id, flags, data, errp);
-+}
-+
-+static int get_tdx_capabilities(Error **errp)
-+{
-+    struct kvm_tdx_capabilities *caps;
-+    /* 1st generation of TDX reports 6 cpuid configs */
-+    int nr_cpuid_configs = 6;
-+    size_t size;
-+    int r;
-+
-+    do {
-+        Error *local_err = NULL;
-+        size = sizeof(struct kvm_tdx_capabilities) +
-+                      nr_cpuid_configs * sizeof(struct kvm_cpuid_entry2);
-+        caps = g_malloc0(size);
-+        caps->cpuid.nent = nr_cpuid_configs;
-+
-+        r = tdx_vm_ioctl(KVM_TDX_CAPABILITIES, 0, caps, &local_err);
-+        if (r == -E2BIG) {
-+            g_free(caps);
-+            nr_cpuid_configs *= 2;
-+            if (nr_cpuid_configs > KVM_MAX_CPUID_ENTRIES) {
-+                error_report("KVM TDX seems broken that number of CPUID entries"
-+                             " in kvm_tdx_capabilities exceeds limit: %d",
-+                             KVM_MAX_CPUID_ENTRIES);
-+                error_propagate(errp, local_err);
-+                return r;
-+            }
-+            error_free(local_err);
-+        } else if (r < 0) {
-+            g_free(caps);
-+            error_propagate(errp, local_err);
-+            return r;
-+        }
-+    } while (r == -E2BIG);
-+
-+    tdx_caps = caps;
-+
-+    return 0;
-+}
-+
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-+    int r = 0;
-+
-     kvm_mark_guest_state_protected();
- 
--    return 0;
-+    if (!tdx_caps) {
-+        r = get_tdx_capabilities(errp);
-+    }
-+
-+    return r;
- }
- 
- static int tdx_kvm_type(X86ConfidentialGuest *cg)
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch b/kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch
deleted file mode 100644
index 257be66..0000000
--- a/kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch
+++ /dev/null
@@ -1,146 +0,0 @@
-From 7c045d8fcd636f8e2e52f303fc668bff20bc6e5d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 057/115] i386/tdx: Handle KVM_SYSTEM_EVENT_TDX_FATAL
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [57/115] 2b4612a6e7c55849578ab1dc803849190c80692d (bonzini/rhel-qemu-kvm)
-
-TD guest can use TDG.VP.VMCALL<REPORT_FATAL_ERROR> to request
-termination. KVM translates such request into KVM_EXIT_SYSTEM_EVENT with
-type of KVM_SYSTEM_EVENT_TDX_FATAL.
-
-Add hanlder for such exit. Parse and print the error message, and
-terminate the TD guest in the handler.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-29-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 98dbfd6849f117de02ac6f513f2a1f95563e60ae)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c      | 10 +++++++++
- target/i386/kvm/tdx-stub.c |  5 +++++
- target/i386/kvm/tdx.c      | 46 ++++++++++++++++++++++++++++++++++++++
- target/i386/kvm/tdx.h      |  2 ++
- 4 files changed, 63 insertions(+)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index fa61221190..4bda4f5525 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -6019,6 +6019,16 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-     case KVM_EXIT_HYPERCALL:
-         ret = kvm_handle_hypercall(run);
-         break;
-+    case KVM_EXIT_SYSTEM_EVENT:
-+        switch (run->system_event.type) {
-+        case KVM_SYSTEM_EVENT_TDX_FATAL:
-+            ret = tdx_handle_report_fatal_error(cpu, run);
-+            break;
-+        default:
-+            ret = -1;
-+            break;
-+        }
-+        break;
-     default:
-         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
-         ret = -1;
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-index 7748b6d0a4..720a4ff046 100644
---- a/target/i386/kvm/tdx-stub.c
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -13,3 +13,8 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
- {
-     return -EINVAL;
- }
-+
-+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-+{
-+    return -EINVAL;
-+}
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 62c83394d0..679613ab55 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -615,6 +615,52 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
-+/*
-+ * Only 8 registers can contain valid ASCII byte stream to form the fatal
-+ * message, and their sequence is: R14, R15, RBX, RDI, RSI, R8, R9, RDX
-+ */
-+#define TDX_FATAL_MESSAGE_MAX        64
-+
-+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-+{
-+    uint64_t error_code = run->system_event.data[R_R12];
-+    uint64_t reg_mask = run->system_event.data[R_ECX];
-+    char *message = NULL;
-+    uint64_t *tmp;
-+
-+    if (error_code & 0xffff) {
-+        error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
-+                     error_code);
-+        return -1;
-+    }
-+
-+    if (reg_mask) {
-+        message = g_malloc0(TDX_FATAL_MESSAGE_MAX + 1);
-+        tmp = (uint64_t *)message;
-+
-+#define COPY_REG(REG)                               \
-+    do {                                            \
-+        if (reg_mask & BIT_ULL(REG)) {              \
-+            *(tmp++) = run->system_event.data[REG]; \
-+        }                                           \
-+    } while (0)
-+
-+        COPY_REG(R_R14);
-+        COPY_REG(R_R15);
-+        COPY_REG(R_EBX);
-+        COPY_REG(R_EDI);
-+        COPY_REG(R_ESI);
-+        COPY_REG(R_R8);
-+        COPY_REG(R_R9);
-+        COPY_REG(R_EDX);
-+        *((char *)tmp) = '\0';
-+    }
-+#undef COPY_REG
-+
-+    error_report("TD guest reports fatal error. %s", message ? : "");
-+    return -1;
-+}
-+
- static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
- {
-     TdxGuest *tdx = TDX_GUEST(obj);
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 36a7400e74..04b5afe199 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -8,6 +8,7 @@
- #endif
- 
- #include "confidential-guest.h"
-+#include "cpu.h"
- #include "hw/i386/tdvf.h"
- 
- #define TYPE_TDX_GUEST "tdx-guest"
-@@ -59,5 +60,6 @@ bool is_tdx_vm(void);
- int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
- void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
- int tdx_parse_tdvf(void *flash_ptr, int size);
-+int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch b/kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch
deleted file mode 100644
index 2100c04..0000000
--- a/kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch
+++ /dev/null
@@ -1,179 +0,0 @@
-From 8f50b918a55f8a30e782eef028a625a209a19fde Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 073/115] i386/tdx: Implement adjust_cpuid_features() for TDX
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [73/115] 115b0cd2bbc276b2cf915e9ad48fd89c4ee7ce8e (bonzini/rhel-qemu-kvm)
-
-Maintain a TDX specific supported CPUID set, and use it to mask the
-common supported CPUID value of KVM. It can avoid newly added supported
-features (reported via KVM_GET_SUPPORTED_CPUID) for common VMs being
-falsely reported as supported for TDX.
-
-As the first step, initialize the TDX supported CPUID set with all the
-configurable CPUID bits. It's not complete because there are other CPUID
-bits are supported for TDX but not reported as directly configurable.
-E.g. the XFAM related bits, attribute related bits and fixed-1 bits.
-They will be handled in the future.
-
-Also, what matters are the CPUID bits related to QEMU's feature word.
-Only mask the CPUID leafs which are feature word leaf.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-45-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 75ec6189f5c65cab210dd9f16cf4eef368038d45)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c          | 16 ++++++++++++++++
- target/i386/cpu.h          |  1 +
- target/i386/kvm/kvm.c      |  2 +-
- target/i386/kvm/kvm_i386.h |  1 +
- target/i386/kvm/tdx.c      | 34 ++++++++++++++++++++++++++++++++++
- 5 files changed, 53 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ab34626b19..2da456da64 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1644,6 +1644,22 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-     },
- };
- 
-+bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg)
-+{
-+    FeatureWordInfo *wi;
-+    FeatureWord w;
-+
-+    for (w = 0; w < FEATURE_WORDS; w++) {
-+        wi = &feature_word_info[w];
-+        if (wi->type == CPUID_FEATURE_WORD && wi->cpuid.eax == feature &&
-+            (!wi->cpuid.needs_ecx || wi->cpuid.ecx == index) &&
-+            wi->cpuid.reg == reg) {
-+            return true;
-+        }
-+    }
-+    return false;
-+}
-+
- typedef struct FeatureMask {
-     FeatureWord index;
-     uint64_t mask;
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 83fa89bf0a..601e828577 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2431,6 +2431,7 @@ void cpu_set_apic_feature(CPUX86State *env);
- void host_cpuid(uint32_t function, uint32_t count,
-                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
- bool cpu_has_x2apic_feature(CPUX86State *env);
-+bool is_feature_word_cpuid(uint32_t feature, uint32_t index, int reg);
- 
- static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
- {
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 5349ff4db7..76352323e4 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -385,7 +385,7 @@ static bool host_tsx_broken(void)
- 
- /* Returns the value for a specific register on the cpuid entry
-  */
--static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
-+uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
- {
-     uint32_t ret = 0;
-     switch (reg) {
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index f2fbf3f99f..797610496a 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -62,6 +62,7 @@ void kvm_update_msi_routes_all(void *private, bool global,
- struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
-                                           uint32_t function,
-                                           uint32_t index);
-+uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg);
- uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
-                              uint32_t cpuid_i);
- #endif /* CONFIG_KVM */
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 58fb68cab0..4949d01f22 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -45,6 +45,7 @@
- static TdxGuest *tdx_guest;
- 
- static struct kvm_tdx_capabilities *tdx_caps;
-+static struct kvm_cpuid2 *tdx_supported_cpuid;
- 
- /* Valid after kvm_arch_init()->confidential_guest_kvm_init()->tdx_kvm_init() */
- bool is_tdx_vm(void)
-@@ -366,6 +367,20 @@ static Notifier tdx_machine_done_notify = {
-     .notify = tdx_finalize_vm,
- };
- 
-+static void tdx_setup_supported_cpuid(void)
-+{
-+    if (tdx_supported_cpuid) {
-+        return;
-+    }
-+
-+    tdx_supported_cpuid = g_malloc0(sizeof(*tdx_supported_cpuid) +
-+                    KVM_MAX_CPUID_ENTRIES * sizeof(struct kvm_cpuid_entry2));
-+
-+    memcpy(tdx_supported_cpuid->entries, tdx_caps->cpuid.entries,
-+           tdx_caps->cpuid.nent * sizeof(struct kvm_cpuid_entry2));
-+    tdx_supported_cpuid->nent = tdx_caps->cpuid.nent;
-+}
-+
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-     MachineState *ms = MACHINE(qdev_get_machine());
-@@ -403,6 +418,8 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         }
-     }
- 
-+    tdx_setup_supported_cpuid();
-+
-     /* TDX relies on KVM_HC_MAP_GPA_RANGE to handle TDG.VP.VMCALL<MapGPA> */
-     if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) {
-         return -EOPNOTSUPP;
-@@ -440,6 +457,22 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
-     x86cpu->enable_cpuid_0x1f = true;
- }
- 
-+static uint32_t tdx_adjust_cpuid_features(X86ConfidentialGuest *cg,
-+                                          uint32_t feature, uint32_t index,
-+                                          int reg, uint32_t value)
-+{
-+    struct kvm_cpuid_entry2 *e;
-+
-+    if (is_feature_word_cpuid(feature, index, reg)) {
-+        e = cpuid_find_entry(tdx_supported_cpuid, feature, index);
-+        if (e) {
-+            value &= cpuid_entry_get_reg(e, reg);
-+        }
-+    }
-+
-+    return value;
-+}
-+
- static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
- {
-     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
-@@ -834,4 +867,5 @@ static void tdx_guest_class_init(ObjectClass *oc, void *data)
-     klass->kvm_init = tdx_kvm_init;
-     x86_klass->kvm_type = tdx_kvm_type;
-     x86_klass->cpu_instance_init = tdx_cpu_instance_init;
-+    x86_klass->adjust_cpuid_features = tdx_adjust_cpuid_features;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch b/kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch
deleted file mode 100644
index 06bfecf..0000000
--- a/kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 08b7b3ce573d25b6130c28620c51ac57532bd454 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 033/115] i386/tdx: Implement tdx_kvm_init() to initialize TDX
- VM context
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [33/115] 1c018f800145aced56f1268aa0f70cbbe1ec4658 (bonzini/rhel-qemu-kvm)
-
-Implement TDX specific ConfidentialGuestSupportClass::kvm_init()
-callback, tdx_kvm_init().
-
-Mark guest state is proctected for TDX VM.  More TDX specific
-initialization will be added later.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-5-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 631a2ac5a4beab740b342367550562cd659b4c4a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c | 11 +----------
- target/i386/kvm/tdx.c | 10 ++++++++++
- 2 files changed, 11 insertions(+), 10 deletions(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index d7c2dc3c71..12da34b9c5 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -3021,16 +3021,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
-     Error *local_err = NULL;
- 
-     /*
--     * Initialize SEV context, if required
--     *
--     * If no memory encryption is requested (ms->cgs == NULL) this is
--     * a no-op.
--     *
--     * It's also a no-op if a non-SEV confidential guest support
--     * mechanism is selected.  SEV is the only mechanism available to
--     * select on x86 at present, so this doesn't arise, but if new
--     * mechanisms are supported in future (e.g. TDX), they'll need
--     * their own initialization either here or elsewhere.
-+     * Initialize confidential guest (SEV/TDX) context, if required
-      */
-     if (ms->cgs) {
-         ret = confidential_guest_kvm_init(ms->cgs, &local_err);
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index d785c1f6d1..4ff9486081 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -12,9 +12,17 @@
- #include "qemu/osdep.h"
- #include "qom/object_interfaces.h"
- 
-+#include "hw/i386/x86.h"
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-+{
-+    kvm_mark_guest_state_protected();
-+
-+    return 0;
-+}
-+
- static int tdx_kvm_type(X86ConfidentialGuest *cg)
- {
-     /* Do the object check */
-@@ -49,7 +57,9 @@ static void tdx_guest_finalize(Object *obj)
- 
- static void tdx_guest_class_init(ObjectClass *oc, void *data)
- {
-+    ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
-     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
- 
-+    klass->kvm_init = tdx_kvm_init;
-     x86_klass->kvm_type = tdx_kvm_type;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch b/kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch
deleted file mode 100644
index 5d42fcf..0000000
--- a/kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From c741697e7ae55ca5742e9518b8b5071b66b1eff0 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 032/115] i386/tdx: Implement tdx_kvm_type() for TDX
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [32/115] db2604869e78aaf67a57ed2bfc34b15d7e9a830f (bonzini/rhel-qemu-kvm)
-
-TDX VM requires VM type to be KVM_X86_TDX_VM. Implement tdx_kvm_type()
-as X86ConfidentialGuestClass->kvm_type.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-4-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b455880e5515a9fc2b923bfc6c60bb54519b51d3)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c |  1 +
- target/i386/kvm/tdx.c | 12 ++++++++++++
- 2 files changed, 13 insertions(+)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index fe6b34bb10..d7c2dc3c71 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -183,6 +183,7 @@ static const char *vm_type_name[] = {
-     [KVM_X86_SEV_VM] = "SEV",
-     [KVM_X86_SEV_ES_VM] = "SEV-ES",
-     [KVM_X86_SNP_VM] = "SEV-SNP",
-+    [KVM_X86_TDX_VM] = "TDX",
- };
- 
- bool kvm_is_vm_type_supported(int type)
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index ec84ae2947..d785c1f6d1 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -12,8 +12,17 @@
- #include "qemu/osdep.h"
- #include "qom/object_interfaces.h"
- 
-+#include "kvm_i386.h"
- #include "tdx.h"
- 
-+static int tdx_kvm_type(X86ConfidentialGuest *cg)
-+{
-+    /* Do the object check */
-+    TDX_GUEST(cg);
-+
-+    return KVM_X86_TDX_VM;
-+}
-+
- /* tdx guest */
- OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-                                    tdx_guest,
-@@ -40,4 +49,7 @@ static void tdx_guest_finalize(Object *obj)
- 
- static void tdx_guest_class_init(ObjectClass *oc, void *data)
- {
-+    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
-+
-+    x86_klass->kvm_type = tdx_kvm_type;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch b/kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch
deleted file mode 100644
index 55898ec..0000000
--- a/kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From a71b4e5d1ce8bcb7cf076500a1fe8871a674b03c Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 044/115] i386/tdx: Implement user specified tsc frequency
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [44/115] f12a5f1a60aa8bdd69d79e31b92dcf21380b7659 (bonzini/rhel-qemu-kvm)
-
-Reuse "-cpu,tsc-frequency=" to get user wanted tsc frequency and call VM
-scope VM_SET_TSC_KHZ to set the tsc frequency of TD before KVM_TDX_INIT_VM.
-
-Besides, sanity check the tsc frequency to be in the legal range and
-legal granularity (required by TDX module).
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-16-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0e73b843616e52882940ab89e1b0e86e22be2162)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c |  9 +++++++++
- target/i386/kvm/tdx.c | 25 +++++++++++++++++++++++++
- 2 files changed, 34 insertions(+)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 3b71c182ab..fa61221190 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -861,6 +861,15 @@ static int kvm_arch_set_tsc_khz(CPUState *cs)
-     int r, cur_freq;
-     bool set_ioctl = false;
- 
-+    /*
-+     * TSC of TD vcpu is immutable, it cannot be set/changed via vcpu scope
-+     * VM_SET_TSC_KHZ, but only be initialized via VM scope VM_SET_TSC_KHZ
-+     * before ioctl KVM_TDX_INIT_VM in tdx_pre_create_vcpu()
-+     */
-+    if (is_tdx_vm()) {
-+        return 0;
-+    }
-+
-     if (!env->tsc_khz) {
-         return 0;
-     }
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index c96e8eb7b8..56ad5f599d 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -20,6 +20,9 @@
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+#define TDX_MIN_TSC_FREQUENCY_KHZ   (100 * 1000)
-+#define TDX_MAX_TSC_FREQUENCY_KHZ   (10 * 1000 * 1000)
-+
- #define TDX_TD_ATTRIBUTES_DEBUG             BIT_ULL(0)
- #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
- #define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
-@@ -267,6 +270,28 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-         return r;
-     }
- 
-+    if (env->tsc_khz && (env->tsc_khz < TDX_MIN_TSC_FREQUENCY_KHZ ||
-+                         env->tsc_khz > TDX_MAX_TSC_FREQUENCY_KHZ)) {
-+        error_setg(errp, "Invalid TSC %ld KHz, must specify cpu_frequency "
-+                         "between [%d, %d] kHz", env->tsc_khz,
-+                         TDX_MIN_TSC_FREQUENCY_KHZ, TDX_MAX_TSC_FREQUENCY_KHZ);
-+       return -EINVAL;
-+    }
-+
-+    if (env->tsc_khz % (25 * 1000)) {
-+        error_setg(errp, "Invalid TSC %ld KHz, it must be multiple of 25MHz",
-+                   env->tsc_khz);
-+        return -EINVAL;
-+    }
-+
-+    /* it's safe even env->tsc_khz is 0. KVM uses host's tsc_khz in this case */
-+    r = kvm_vm_ioctl(kvm_state, KVM_SET_TSC_KHZ, env->tsc_khz);
-+    if (r < 0) {
-+        error_setg_errno(errp, -r, "Unable to set TSC frequency to %ld kHz",
-+                         env->tsc_khz);
-+        return r;
-+    }
-+
-     if (tdx_guest->mrconfigid) {
-         g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
-                               strlen(tdx_guest->mrconfigid), &data_len, errp);
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch b/kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch
deleted file mode 100644
index fb2e89b..0000000
--- a/kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-From 7f2aa231529a03552d642eccae4c4cc209a3ccdb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 037/115] i386/tdx: Initialize TDX before creating TD vcpus
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [37/115] 1626ea547590c6f25d7d51b66a23820a701398af (bonzini/rhel-qemu-kvm)
-
-Invoke KVM_TDX_INIT_VM in kvm_arch_pre_create_vcpu() that
-KVM_TDX_INIT_VM configures global TD configurations, e.g. the canonical
-CPUID config, and must be executed prior to creating vCPUs.
-
-Use kvm_x86_arch_cpuid() to setup the CPUID settings for TDX VM.
-
-Note, this doesn't address the fact that QEMU may change the CPUID
-configuration when creating vCPUs, i.e. punts on refactoring QEMU to
-provide a stable CPUID config prior to kvm_arch_init().
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-9-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f15898b0f50609d66465326221aa54b6699da674)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c       |  16 +++---
- target/i386/kvm/kvm_i386.h  |   5 ++
- target/i386/kvm/meson.build |   2 +-
- target/i386/kvm/tdx-stub.c  |  10 ++++
- target/i386/kvm/tdx.c       | 105 ++++++++++++++++++++++++++++++++++++
- target/i386/kvm/tdx.h       |   6 +++
- 6 files changed, 137 insertions(+), 7 deletions(-)
- create mode 100644 target/i386/kvm/tdx-stub.c
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 1fddec6b9c..3b71c182ab 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -38,6 +38,7 @@
- #include "kvm_i386.h"
- #include "../confidential-guest.h"
- #include "sev.h"
-+#include "tdx.h"
- #include "xen-emu.h"
- #include "hyperv.h"
- #include "hyperv-proto.h"
-@@ -406,9 +407,9 @@ static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
- 
- /* Find matching entry for function/index on kvm_cpuid2 struct
-  */
--static struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
--                                                 uint32_t function,
--                                                 uint32_t index)
-+struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
-+                                          uint32_t function,
-+                                          uint32_t index)
- {
-     int i;
-     for (i = 0; i < cpuid->nent; ++i) {
-@@ -1813,9 +1814,8 @@ static void kvm_init_nested_state(CPUX86State *env)
-     }
- }
- 
--static uint32_t kvm_x86_build_cpuid(CPUX86State *env,
--                                    struct kvm_cpuid_entry2 *entries,
--                                    uint32_t cpuid_i)
-+uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
-+                             uint32_t cpuid_i)
- {
-     uint32_t limit, i, j;
-     uint32_t unused;
-@@ -2041,6 +2041,10 @@ full:
- 
- int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
- {
-+    if (is_tdx_vm()) {
-+        return tdx_pre_create_vcpu(cpu, errp);
-+    }
-+
-     return 0;
- }
- 
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index 499691e8d0..f2fbf3f99f 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -59,6 +59,11 @@ uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address);
- void kvm_update_msi_routes_all(void *private, bool global,
-                                uint32_t index, uint32_t mask);
- 
-+struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
-+                                          uint32_t function,
-+                                          uint32_t index);
-+uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
-+                             uint32_t cpuid_i);
- #endif /* CONFIG_KVM */
- 
- void kvm_pc_setup_irq_routing(bool pci_enabled);
-diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
-index 466bccb9cb..3f44cdedb7 100644
---- a/target/i386/kvm/meson.build
-+++ b/target/i386/kvm/meson.build
-@@ -8,7 +8,7 @@ i386_kvm_ss.add(files(
- 
- i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
- 
--i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'))
-+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'), if_false: files('tdx-stub.c'))
- 
- i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
- 
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-new file mode 100644
-index 0000000000..2344433594
---- /dev/null
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -0,0 +1,10 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+
-+#include "qemu/osdep.h"
-+
-+#include "tdx.h"
-+
-+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return -EINVAL;
-+}
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 16f67e18ae..8f02c76249 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -149,6 +149,109 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
-     return KVM_X86_TDX_VM;
- }
- 
-+static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
-+{
-+    CPUX86State *env = &x86cpu->env;
-+    uint64_t xfam;
-+
-+    xfam = env->features[FEAT_XSAVE_XCR0_LO] |
-+           env->features[FEAT_XSAVE_XCR0_HI] |
-+           env->features[FEAT_XSAVE_XSS_LO] |
-+           env->features[FEAT_XSAVE_XSS_HI];
-+
-+    if (xfam & ~tdx_caps->supported_xfam) {
-+        error_setg(errp, "Invalid XFAM 0x%lx for TDX VM (supported: 0x%llx))",
-+                   xfam, tdx_caps->supported_xfam);
-+        return -1;
-+    }
-+
-+    tdx_guest->xfam = xfam;
-+    return 0;
-+}
-+
-+static void tdx_filter_cpuid(struct kvm_cpuid2 *cpuids)
-+{
-+    int i, dest_cnt = 0;
-+    struct kvm_cpuid_entry2 *src, *dest, *conf;
-+
-+    for (i = 0; i < cpuids->nent; i++) {
-+        src = cpuids->entries + i;
-+        conf = cpuid_find_entry(&tdx_caps->cpuid, src->function, src->index);
-+        if (!conf) {
-+            continue;
-+        }
-+        dest = cpuids->entries + dest_cnt;
-+
-+        dest->function = src->function;
-+        dest->index = src->index;
-+        dest->flags = src->flags;
-+        dest->eax = src->eax & conf->eax;
-+        dest->ebx = src->ebx & conf->ebx;
-+        dest->ecx = src->ecx & conf->ecx;
-+        dest->edx = src->edx & conf->edx;
-+
-+        dest_cnt++;
-+    }
-+    cpuids->nent = dest_cnt++;
-+}
-+
-+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    X86CPU *x86cpu = X86_CPU(cpu);
-+    CPUX86State *env = &x86cpu->env;
-+    g_autofree struct kvm_tdx_init_vm *init_vm = NULL;
-+    Error *local_err = NULL;
-+    int retry = 10000;
-+    int r = 0;
-+
-+    QEMU_LOCK_GUARD(&tdx_guest->lock);
-+    if (tdx_guest->initialized) {
-+        return r;
-+    }
-+
-+    init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
-+                        sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
-+
-+    r = setup_td_xfam(x86cpu, errp);
-+    if (r) {
-+        return r;
-+    }
-+
-+    init_vm->cpuid.nent = kvm_x86_build_cpuid(env, init_vm->cpuid.entries, 0);
-+    tdx_filter_cpuid(&init_vm->cpuid);
-+
-+    init_vm->attributes = tdx_guest->attributes;
-+    init_vm->xfam = tdx_guest->xfam;
-+
-+    /*
-+     * KVM_TDX_INIT_VM gets -EAGAIN when KVM side SEAMCALL(TDH_MNG_CREATE)
-+     * gets TDX_RND_NO_ENTROPY due to Random number generation (e.g., RDRAND or
-+     * RDSEED) is busy.
-+     *
-+     * Retry for the case.
-+     */
-+    do {
-+        error_free(local_err);
-+        local_err = NULL;
-+        r = tdx_vm_ioctl(KVM_TDX_INIT_VM, 0, init_vm, &local_err);
-+    } while (r == -EAGAIN && --retry);
-+
-+    if (r < 0) {
-+        if (!retry) {
-+            error_append_hint(&local_err, "Hardware RNG (Random Number "
-+            "Generator) is busy occupied by someone (via RDRAND/RDSEED) "
-+            "maliciously, which leads to KVM_TDX_INIT_VM keeping failure "
-+            "due to lack of entropy.\n");
-+        }
-+        error_propagate(errp, local_err);
-+        return r;
-+    }
-+
-+    tdx_guest->initialized = true;
-+
-+    return 0;
-+}
-+
- /* tdx guest */
- OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-                                    tdx_guest,
-@@ -162,6 +265,8 @@ static void tdx_guest_init(Object *obj)
-     ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj);
-     TdxGuest *tdx = TDX_GUEST(obj);
- 
-+    qemu_mutex_init(&tdx->lock);
-+
-     cgs->require_guest_memfd = true;
-     tdx->attributes = 0;
- 
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index de8ae91961..4e2b5c61ff 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -19,7 +19,11 @@ typedef struct TdxGuestClass {
- typedef struct TdxGuest {
-     X86ConfidentialGuest parent_obj;
- 
-+    QemuMutex lock;
-+
-+    bool initialized;
-     uint64_t attributes;    /* TD attributes */
-+    uint64_t xfam;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
-@@ -28,4 +32,6 @@ bool is_tdx_vm(void);
- #define is_tdx_vm() 0
- #endif /* CONFIG_TDX */
- 
-+int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
-+
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch b/kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch
deleted file mode 100644
index d75bfaa..0000000
--- a/kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From af03f2b600e6d02d86b21cc25bbeeaa35d104cfc Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 035/115] i386/tdx: Introduce is_tdx_vm() helper and cache
- tdx_guest object
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [35/115] 8e84ea1bc7eaf07ccfd915601b471cd75d01bf90 (bonzini/rhel-qemu-kvm)
-
-It will need special handling for TDX VMs all around the QEMU.
-Introduce is_tdx_vm() helper to query if it's a TDX VM.
-
-Cache tdx_guest object thus no need to cast from ms->cgs every time.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-7-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 1619d0e45be0d1e48a46d80963b4e77dc1b000a2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 15 ++++++++++++++-
- target/i386/kvm/tdx.h | 10 ++++++++++
- 2 files changed, 24 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index c67be5e618..16f67e18ae 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -18,8 +18,16 @@
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+static TdxGuest *tdx_guest;
-+
- static struct kvm_tdx_capabilities *tdx_caps;
- 
-+/* Valid after kvm_arch_init()->confidential_guest_kvm_init()->tdx_kvm_init() */
-+bool is_tdx_vm(void)
-+{
-+    return !!tdx_guest;
-+}
-+
- enum tdx_ioctl_level {
-     TDX_VM_IOCTL,
-     TDX_VCPU_IOCTL,
-@@ -117,15 +125,20 @@ static int get_tdx_capabilities(Error **errp)
- 
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-+    TdxGuest *tdx = TDX_GUEST(cgs);
-     int r = 0;
- 
-     kvm_mark_guest_state_protected();
- 
-     if (!tdx_caps) {
-         r = get_tdx_capabilities(errp);
-+        if (r) {
-+            return r;
-+        }
-     }
- 
--    return r;
-+    tdx_guest = tdx;
-+    return 0;
- }
- 
- static int tdx_kvm_type(X86ConfidentialGuest *cg)
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index f3b7253361..de8ae91961 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -3,6 +3,10 @@
- #ifndef QEMU_I386_TDX_H
- #define QEMU_I386_TDX_H
- 
-+#ifndef CONFIG_USER_ONLY
-+#include CONFIG_DEVICES /* CONFIG_TDX */
-+#endif
-+
- #include "confidential-guest.h"
- 
- #define TYPE_TDX_GUEST "tdx-guest"
-@@ -18,4 +22,10 @@ typedef struct TdxGuest {
-     uint64_t attributes;    /* TD attributes */
- } TdxGuest;
- 
-+#ifdef CONFIG_TDX
-+bool is_tdx_vm(void);
-+#else
-+#define is_tdx_vm() 0
-+#endif /* CONFIG_TDX */
-+
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Make-invtsc-default-on.patch b/kvm-i386-tdx-Make-invtsc-default-on.patch
deleted file mode 100644
index 4e47392..0000000
--- a/kvm-i386-tdx-Make-invtsc-default-on.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 0fe5ae12f6e427821edddf3bb1618aa0576f73cb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 082/115] i386/tdx: Make invtsc default on
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [82/115] 24e58b9f91fca93c4e17de19592f4e232abee39a (bonzini/rhel-qemu-kvm)
-
-Because it's fixed1 bit that enforced by TDX module.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-54-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ea4867b911fc2f6d4c8bd50ec62f0dc0fa190fab)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 3e23010094..3ec31d4872 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -742,6 +742,9 @@ static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
- 
-     object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
- 
-+    /* invtsc is fixed1 for TD guest */
-+    object_property_set_bool(OBJECT(cpu), "invtsc", true, &error_abort);
-+
-     x86cpu->enable_cpuid_0x1f = true;
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch b/kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch
deleted file mode 100644
index 01c0b5d..0000000
--- a/kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From c0f849d9cc9b60aff17fd9a1349788856c0e98b9 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 039/115] i386/tdx: Make sept_ve_disable set by default
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [39/115] ccfc985bc607ff9d1c91e65d810003347d410088 (bonzini/rhel-qemu-kvm)
-
-For TDX KVM use case, Linux guest is the most major one.  It requires
-sept_ve_disable set.  Make it default for the main use case.  For other use
-case, it can be enabled/disabled via qemu command line.
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-11-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 714af52276e74a1829674d180ef26ecb6261834c)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 370bd86f2c..2ed40b7614 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -288,7 +288,7 @@ static void tdx_guest_init(Object *obj)
-     qemu_mutex_init(&tdx->lock);
- 
-     cgs->require_guest_memfd = true;
--    tdx->attributes = 0;
-+    tdx->attributes = TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE;
- 
-     object_property_add_uint64_ptr(obj, "attributes", &tdx->attributes,
-                                    OBJ_PROP_FLAG_READWRITE);
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch b/kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch
deleted file mode 100644
index d52c5f5..0000000
--- a/kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 44207fd96718352fce68c68515fecf3ea4cee2e9 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 069/115] i386/tdx: Only configure MSR_IA32_UCODE_REV in
- kvm_init_msrs() for TDs
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [69/115] eeff1e580ba5e6da1e2eaddeb51784999b994951 (bonzini/rhel-qemu-kvm)
-
-For TDs, only MSR_IA32_UCODE_REV in kvm_init_msrs() can be configured
-by VMM, while the features enumerated/controlled by other MSRs except
-MSR_IA32_UCODE_REV in kvm_init_msrs() are not under control of VMM.
-
-Only configure MSR_IA32_UCODE_REV for TDs.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-41-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f9aaad3362a5886d78e7d4d50d563ac16c6acdde)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c | 40 +++++++++++++++++++++-------------------
- 1 file changed, 21 insertions(+), 19 deletions(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 0c47eef03c..f3fe553151 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -3761,32 +3761,34 @@ static void kvm_init_msrs(X86CPU *cpu)
-     CPUX86State *env = &cpu->env;
- 
-     kvm_msr_buf_reset(cpu);
--    if (has_msr_arch_capabs) {
--        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
--                          env->features[FEAT_ARCH_CAPABILITIES]);
--    }
- 
--    if (has_msr_core_capabs) {
--        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
--                          env->features[FEAT_CORE_CAPABILITY]);
--    }
-+    if (!is_tdx_vm()) {
-+        if (has_msr_arch_capabs) {
-+            kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
-+                                env->features[FEAT_ARCH_CAPABILITIES]);
-+        }
-+
-+        if (has_msr_core_capabs) {
-+            kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
-+                                env->features[FEAT_CORE_CAPABILITY]);
-+        }
-+
-+        if (has_msr_perf_capabs && cpu->enable_pmu) {
-+            kvm_msr_entry_add_perf(cpu, env->features);
-+        }
- 
--    if (has_msr_perf_capabs && cpu->enable_pmu) {
--        kvm_msr_entry_add_perf(cpu, env->features);
-+        /*
-+         * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
-+         * all kernels with MSR features should have them.
-+         */
-+        if (kvm_feature_msrs && cpu_has_vmx(env)) {
-+            kvm_msr_entry_add_vmx(cpu, env->features);
-+        }
-     }
- 
-     if (has_msr_ucode_rev) {
-         kvm_msr_entry_add(cpu, MSR_IA32_UCODE_REV, cpu->ucode_rev);
-     }
--
--    /*
--     * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
--     * all kernels with MSR features should have them.
--     */
--    if (kvm_feature_msrs && cpu_has_vmx(env)) {
--        kvm_msr_entry_add_vmx(cpu, env->features);
--    }
--
-     assert(kvm_buf_set_msrs(cpu) == 0);
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch b/kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch
deleted file mode 100644
index 0633ae2..0000000
--- a/kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 2a27aea7e254e3828051e68a4c369068eacfb09e Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 047/115] i386/tdx: Parse TDVF metadata for TDX VM
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [47/115] bf2f78d0bbeb0b720e00b1593d02aeeaf46eb13e (bonzini/rhel-qemu-kvm)
-
-After TDVF is loaded to bios MemoryRegion, it needs parse TDVF metadata.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-19-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit cb5d65a854e58abeb705a2ce14cc3eb28973c606)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/pc_sysfw.c         | 7 +++++++
- target/i386/kvm/tdx-stub.c | 5 +++++
- target/i386/kvm/tdx.c      | 5 +++++
- target/i386/kvm/tdx.h      | 3 +++
- 4 files changed, 20 insertions(+)
-
-diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
-index e6271e1020..7436a4f33e 100644
---- a/hw/i386/pc_sysfw.c
-+++ b/hw/i386/pc_sysfw.c
-@@ -37,6 +37,7 @@
- #include "hw/block/flash.h"
- #include "sysemu/kvm.h"
- #include "target/i386/sev.h"
-+#include "kvm/tdx.h"
- 
- #define FLASH_SECTOR_SIZE 4096
- 
-@@ -280,5 +281,11 @@ void x86_firmware_configure(hwaddr gpa, void *ptr, int size)
-         }
- 
-         sev_encrypt_flash(gpa, ptr, size, &error_fatal);
-+    } else if (is_tdx_vm()) {
-+        ret = tdx_parse_tdvf(ptr, size);
-+        if (ret) {
-+            error_report("failed to parse TDVF for TDX VM");
-+            exit(1);
-+        }
-     }
- }
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-index 2344433594..7748b6d0a4 100644
---- a/target/i386/kvm/tdx-stub.c
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -8,3 +8,8 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
- {
-     return -EINVAL;
- }
-+
-+int tdx_parse_tdvf(void *flash_ptr, int size)
-+{
-+    return -EINVAL;
-+}
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 2522f2030d..71be3bd28d 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -382,6 +382,11 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     return 0;
- }
- 
-+int tdx_parse_tdvf(void *flash_ptr, int size)
-+{
-+    return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
-+}
-+
- static bool tdx_guest_get_sept_ve_disable(Object *obj, Error **errp)
- {
-     TdxGuest *tdx = TDX_GUEST(obj);
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index b73461b8d8..28a03c2a7b 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -8,6 +8,7 @@
- #endif
- 
- #include "confidential-guest.h"
-+#include "hw/i386/tdvf.h"
- 
- #define TYPE_TDX_GUEST "tdx-guest"
- #define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
-@@ -32,6 +33,7 @@ typedef struct TdxGuest {
-     char *mrownerconfig;    /* base64 encoded sha348 digest */
- 
-     MemoryRegion *tdvf_mr;
-+    TdxFirmware tdvf;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
-@@ -42,5 +44,6 @@ bool is_tdx_vm(void);
- 
- int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
- void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
-+int tdx_parse_tdvf(void *flash_ptr, int size);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch b/kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch
deleted file mode 100644
index 6095a7b..0000000
--- a/kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 7ead76d9444ad38538033a070836121cb4a7e20f Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 099/115] i386/tdx: Remove enumeration of GetQuote in
- tdx_handle_get_tdvmcall_info()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [99/115] 0d402fadbfd0059369166a44d98f51fa46fd7ca3 (bonzini/rhel-qemu-kvm)
-
-GHCI is finalized with the <GetQuote> being one of the base VMCALLs, and
-not enuemrated via <GetTdVmCallInfo>.
-
-Adjust tdx_handle_get_tdvmcall_info() to match with GHCI.
-
-Opportunistically fix the wrong indentation and explicitly set the
-ret to TDG_VP_VMCALL_SUCCESS (in case KVM leaves unexpected value).
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250703024021.3559286-2-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b57999bb258349fabe497c8ff70277b5e5b281e2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 6 ++++--
- target/i386/kvm/tdx.h | 2 --
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 201da78b06..2ca661cbc4 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1259,13 +1259,15 @@ out_free:
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
- {
-     if (run->tdx.get_tdvmcall_info.leaf != 1) {
--	return;
-+        return;
-     }
- 
--    run->tdx.get_tdvmcall_info.r11 = TDG_VP_VMCALL_SUBFUNC_GET_QUOTE;
-+    run->tdx.get_tdvmcall_info.r11 = 0;
-     run->tdx.get_tdvmcall_info.r12 = 0;
-     run->tdx.get_tdvmcall_info.r13 = 0;
-     run->tdx.get_tdvmcall_info.r14 = 0;
-+
-+    run->tdx.get_tdvmcall_info.ret = TDG_VP_VMCALL_SUCCESS;
- }
- 
- static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 35a09c19c5..d439078a87 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -32,8 +32,6 @@ typedef struct TdxGuestClass {
- #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
- #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
- 
--#define TDG_VP_VMCALL_SUBFUNC_GET_QUOTE 0x0000000000000001ULL
--
- enum TdxRamType {
-     TDX_RAM_UNACCEPTED,
-     TDX_RAM_ADDED,
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch b/kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch
deleted file mode 100644
index 3c21f99..0000000
--- a/kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From a31b5ed8480b9f7e4d49a9e3ab1077fb1d4eb269 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 103/115] i386/tdx: Remove task->watch only when it's valid
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [103/115] a9a4c03cf0f589eab2dc07572c2cb724cca5686c (bonzini/rhel-qemu-kvm)
-
-In some case (e.g., failed to connect to QGS socket),
-tdx_generate_quote_cleanup() is called with task->watch invalid. It
-triggers assertion of
-
-  qemu-system-x86_64: GLib: g_source_remove: assertion 'tag > 0' failed
-
-Fix it by checking task->watch.
-
-Fixes: 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>")
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250625035505.2770580-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 50fd57418c3f08f13eb964dcb49f065246f2ecbf)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx-quote-generator.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/kvm/tdx-quote-generator.c b/target/i386/kvm/tdx-quote-generator.c
-index f59715f617..dee8334b27 100644
---- a/target/i386/kvm/tdx-quote-generator.c
-+++ b/target/i386/kvm/tdx-quote-generator.c
-@@ -75,7 +75,9 @@ static void tdx_generate_quote_cleanup(TdxGenerateQuoteTask *task)
- {
-     timer_del(&task->timer);
- 
--    g_source_remove(task->watch);
-+    if (task->watch) {
-+        g_source_remove(task->watch);
-+    }
-     qio_channel_close(QIO_CHANNEL(task->sioc), NULL);
-     object_unref(OBJECT(task->sioc));
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch b/kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch
deleted file mode 100644
index fcea188..0000000
--- a/kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From b01012b874646e7f5ce3d5da8f9c5539ca97ea16 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 108/115] i386/tdx: Remove the redundant
- qemu_mutex_init(&tdx->lock)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [108/115] 51fa7fa495c526d62f144a0eb2ff4c87df397c8c (bonzini/rhel-qemu-kvm)
-
-Commit 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>") added
-redundant qemu_mutex_init(&tdx->lock) in tdx_guest_init by mistake.
-
-Fix it by removing the redundant one.
-
-Fixes: 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>")
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Link: https://lore.kernel.org/r/20250717103707.688929-1-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f64832033d1262983bfe759669b4f65080f760dc)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 08eed19960..2ff5211794 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1527,8 +1527,6 @@ static void tdx_guest_init(Object *obj)
-                             tdx_guest_set_qgs,
-                             NULL, NULL);
- 
--    qemu_mutex_init(&tdx->lock);
--
-     tdx->event_notify_vector = -1;
-     tdx->event_notify_apicid = -1;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch b/kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch
deleted file mode 100644
index e1ffadc..0000000
--- a/kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From c97fb38ea2145d0f827cc693e03628d9582433c3 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 043/115] i386/tdx: Set APIC bus rate to match with what TDX
- module enforces
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [43/115] 2a25d2d762dba32fd6d0d3f4669c254cf0cb6a65 (bonzini/rhel-qemu-kvm)
-
-TDX advertises core crystal clock with cpuid[0x15] as 25MHz for TD
-guests and it's unchangeable from VMM. As a result, TDX guest reads
-the APIC timer at the same frequency, 25MHz.
-
-While KVM's default emulated frequency for APIC bus is 1GHz, set the
-APIC bus rate to match with TDX explicitly to ensure KVM provide correct
-emulated APIC timer for TD guest.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-15-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d529a2ac5ef4620173439942f78ec668f9165fc1)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 13 +++++++++++++
- target/i386/kvm/tdx.h |  3 +++
- 2 files changed, 16 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 39fd964c6b..c96e8eb7b8 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -254,6 +254,19 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
-                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
- 
-+    if (!kvm_check_extension(kvm_state, KVM_CAP_X86_APIC_BUS_CYCLES_NS)) {
-+        error_setg(errp, "KVM doesn't support KVM_CAP_X86_APIC_BUS_CYCLES_NS");
-+        return -EOPNOTSUPP;
-+    }
-+
-+    r = kvm_vm_enable_cap(kvm_state, KVM_CAP_X86_APIC_BUS_CYCLES_NS,
-+                          0, TDX_APIC_BUS_CYCLES_NS);
-+    if (r < 0) {
-+        error_setg_errno(errp, -r,
-+                         "Unable to set core crystal clock frequency to 25MHz");
-+        return r;
-+    }
-+
-     if (tdx_guest->mrconfigid) {
-         g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
-                               strlen(tdx_guest->mrconfigid), &data_len, errp);
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index e472b11fb0..d39e733d9f 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -16,6 +16,9 @@ typedef struct TdxGuestClass {
-     X86ConfidentialGuestClass parent_class;
- } TdxGuestClass;
- 
-+/* TDX requires bus frequency 25MHz */
-+#define TDX_APIC_BUS_CYCLES_NS 40
-+
- typedef struct TdxGuest {
-     X86ConfidentialGuest parent_obj;
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch b/kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch
deleted file mode 100644
index 7d9280d..0000000
--- a/kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 13e58b76efc0c20373a21d319d43361af80d82f6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 067/115] i386/tdx: Set and check kernel_irqchip mode for TDX
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [67/115] 6d1c37af7cbaf0e84d1f1e2eb493f2397afaf452 (bonzini/rhel-qemu-kvm)
-
-KVM mandates kernel_irqchip to be split mode.
-
-Set it to split mode automatically when users don't provide an explicit
-value, otherwise check it to be the split mode.
-
-Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-39-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit bb45580d842530d78b58179eaf80b6331b15324e)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/
----
- target/i386/kvm/tdx.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 4f17e17308..58fb68cab0 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -16,6 +16,7 @@
- #include "qapi/error.h"
- #include "qom/object_interfaces.h"
- #include "crypto/hash.h"
-+#include "sysemu/kvm_int.h"
- #include "sysemu/runstate.h"
- #include "sysemu/sysemu.h"
- #include "exec/ramblock.h"
-@@ -388,6 +389,13 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         return -EINVAL;
-     }
- 
-+    if (kvm_state->kernel_irqchip_split == ON_OFF_AUTO_AUTO) {
-+        kvm_state->kernel_irqchip_split = ON_OFF_AUTO_ON;
-+    } else if (kvm_state->kernel_irqchip_split != ON_OFF_AUTO_ON) {
-+        error_setg(errp, "TDX VM requires kernel_irqchip to be split");
-+        return -EINVAL;
-+    }
-+
-     if (!tdx_caps) {
-         r = get_tdx_capabilities(errp);
-         if (r) {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch b/kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch
deleted file mode 100644
index fee6a89..0000000
--- a/kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 23e6031f307d262cae8a76306acb5341706098d6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 064/115] i386/tdx: Set kvm_readonly_mem_enabled to false for
- TDX VM
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [64/115] ee2c60314038f35359ea6bd00422b39c8573da88 (bonzini/rhel-qemu-kvm)
-
-TDX only supports readonly for shared memory but not for private memory.
-
-In the view of QEMU, it has no idea whether a memslot is used as shared
-memory of private. Thus just mark kvm_readonly_mem_enabled to false to
-TDX VM for simplicity.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-36-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit da6728658bf63d6a3989f1587a33566b3e54bed8)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 410f8a9997..7bc36b620e 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -384,6 +384,15 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         return -EOPNOTSUPP;
-     }
- 
-+    /*
-+     * Set kvm_readonly_mem_allowed to false, because TDX only supports readonly
-+     * memory for shared memory but not for private memory. Besides, whether a
-+     * memslot is private or shared is not determined by QEMU.
-+     *
-+     * Thus, just mark readonly memory not supported for simplicity.
-+     */
-+    kvm_readonly_mem_allowed = false;
-+
-     qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
- 
-     tdx_guest = tdx;
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch b/kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch
deleted file mode 100644
index f83432a..0000000
--- a/kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 53a6bd5c6e3e4f0cf3fcf1b0a326c13e9defdc50 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 100/115] i386/tdx: Set value of <GetTdVmCallInfo> based on
- capabilities of both KVM and QEMU
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [100/115] ebdd2061181d3ce95404931904e816171ae4f5ac (bonzini/rhel-qemu-kvm)
-
-KVM reports the supported TDVMCALL sub leafs in TDX capabilities.
-
-one for kernel-supported
-    TDVMCALLs (userspace can set those blindly) and one for user-supported
-    TDVMCALLs (userspace can set those if it knows how to handle them)
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250703024021.3559286-4-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 55be385b10658a2372f944fa41aaba016e1e8433)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 2ca661cbc4..a24e15571a 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1256,14 +1256,21 @@ out_free:
-     g_free(task);
- }
- 
-+#define SUPPORTED_TDVMCALLINFO_1_R11    (0)
-+#define SUPPORTED_TDVMCALLINFO_1_R12    (0)
-+
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
- {
-     if (run->tdx.get_tdvmcall_info.leaf != 1) {
-         return;
-     }
- 
--    run->tdx.get_tdvmcall_info.r11 = 0;
--    run->tdx.get_tdvmcall_info.r12 = 0;
-+    run->tdx.get_tdvmcall_info.r11 = (tdx_caps->user_tdvmcallinfo_1_r11 &
-+                                      SUPPORTED_TDVMCALLINFO_1_R11) |
-+                                      tdx_caps->kernel_tdvmcallinfo_1_r11;
-+    run->tdx.get_tdvmcall_info.r12 = (tdx_caps->user_tdvmcallinfo_1_r12 &
-+                                      SUPPORTED_TDVMCALLINFO_1_R12) |
-+                                      tdx_caps->kernel_tdvmcallinfo_1_r12;
-     run->tdx.get_tdvmcall_info.r13 = 0;
-     run->tdx.get_tdvmcall_info.r14 = 0;
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Setup-the-TD-HOB-list.patch b/kvm-i386-tdx-Setup-the-TD-HOB-list.patch
deleted file mode 100644
index dd97485..0000000
--- a/kvm-i386-tdx-Setup-the-TD-HOB-list.patch
+++ /dev/null
@@ -1,264 +0,0 @@
-From 2e545a2564bcece4b3f1e2baa18e93d81a94b20d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 052/115] i386/tdx: Setup the TD HOB list
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [52/115] 789ad8477ccd49c1977e874d30963ebf9ac7f8b3 (bonzini/rhel-qemu-kvm)
-
-The TD HOB list is used to pass the information from VMM to TDVF. The TD
-HOB must include PHIT HOB and Resource Descriptor HOB. More details can
-be found in TDVF specification and PI specification.
-
-Build the TD HOB in TDX's machine_init_done callback.
-
-Co-developed-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
-Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-24-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a731425980a4d3f8bb96fc41893b6437672875ee)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/meson.build   |   2 +-
- hw/i386/tdvf-hob.c    | 130 ++++++++++++++++++++++++++++++++++++++++++
- hw/i386/tdvf-hob.h    |  26 +++++++++
- target/i386/kvm/tdx.c |  16 ++++++
- 4 files changed, 173 insertions(+), 1 deletion(-)
- create mode 100644 hw/i386/tdvf-hob.c
- create mode 100644 hw/i386/tdvf-hob.h
-
-diff --git a/hw/i386/meson.build b/hw/i386/meson.build
-index d6d8023664..cbac982039 100644
---- a/hw/i386/meson.build
-+++ b/hw/i386/meson.build
-@@ -31,7 +31,7 @@ i386_ss.add(when: 'CONFIG_PC', if_true: files(
-   'port92.c'))
- i386_ss.add(when: 'CONFIG_X86_FW_OVMF', if_true: files('pc_sysfw_ovmf.c'),
-                                         if_false: files('pc_sysfw_ovmf-stubs.c'))
--i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c'))
-+i386_ss.add(when: 'CONFIG_TDX', if_true: files('tdvf.c', 'tdvf-hob.c'))
- 
- subdir('kvm')
- subdir('xen')
-diff --git a/hw/i386/tdvf-hob.c b/hw/i386/tdvf-hob.c
-new file mode 100644
-index 0000000000..782b3d1578
---- /dev/null
-+++ b/hw/i386/tdvf-hob.c
-@@ -0,0 +1,130 @@
-+/*
-+ * Copyright (c) 2025 Intel Corporation
-+ * Author: Isaku Yamahata <isaku.yamahata at gmail.com>
-+ *                        <isaku.yamahata at intel.com>
-+ *         Xiaoyao Li <xiaoyao.li@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/error-report.h"
-+#include "standard-headers/uefi/uefi.h"
-+#include "hw/pci/pcie_host.h"
-+#include "tdvf-hob.h"
-+
-+typedef struct TdvfHob {
-+    hwaddr hob_addr;
-+    void *ptr;
-+    int size;
-+
-+    /* working area */
-+    void *current;
-+    void *end;
-+} TdvfHob;
-+
-+static uint64_t tdvf_current_guest_addr(const TdvfHob *hob)
-+{
-+    return hob->hob_addr + (hob->current - hob->ptr);
-+}
-+
-+static void tdvf_align(TdvfHob *hob, size_t align)
-+{
-+    hob->current = QEMU_ALIGN_PTR_UP(hob->current, align);
-+}
-+
-+static void *tdvf_get_area(TdvfHob *hob, uint64_t size)
-+{
-+    void *ret;
-+
-+    if (hob->current + size > hob->end) {
-+        error_report("TD_HOB overrun, size = 0x%" PRIx64, size);
-+        exit(1);
-+    }
-+
-+    ret = hob->current;
-+    hob->current += size;
-+    tdvf_align(hob, 8);
-+    return ret;
-+}
-+
-+static void tdvf_hob_add_memory_resources(TdxGuest *tdx, TdvfHob *hob)
-+{
-+    EFI_HOB_RESOURCE_DESCRIPTOR *region;
-+    EFI_RESOURCE_ATTRIBUTE_TYPE attr;
-+    EFI_RESOURCE_TYPE resource_type;
-+
-+    TdxRamEntry *e;
-+    int i;
-+
-+    for (i = 0; i < tdx->nr_ram_entries; i++) {
-+        e = &tdx->ram_entries[i];
-+
-+        if (e->type == TDX_RAM_UNACCEPTED) {
-+            resource_type = EFI_RESOURCE_MEMORY_UNACCEPTED;
-+            attr = EFI_RESOURCE_ATTRIBUTE_TDVF_UNACCEPTED;
-+        } else if (e->type == TDX_RAM_ADDED) {
-+            resource_type = EFI_RESOURCE_SYSTEM_MEMORY;
-+            attr = EFI_RESOURCE_ATTRIBUTE_TDVF_PRIVATE;
-+        } else {
-+            error_report("unknown TDX_RAM_ENTRY type %d", e->type);
-+            exit(1);
-+        }
-+
-+        region = tdvf_get_area(hob, sizeof(*region));
-+        *region = (EFI_HOB_RESOURCE_DESCRIPTOR) {
-+            .Header = {
-+                .HobType = EFI_HOB_TYPE_RESOURCE_DESCRIPTOR,
-+                .HobLength = cpu_to_le16(sizeof(*region)),
-+                .Reserved = cpu_to_le32(0),
-+            },
-+            .Owner = EFI_HOB_OWNER_ZERO,
-+            .ResourceType = cpu_to_le32(resource_type),
-+            .ResourceAttribute = cpu_to_le32(attr),
-+            .PhysicalStart = cpu_to_le64(e->address),
-+            .ResourceLength = cpu_to_le64(e->length),
-+        };
-+    }
-+}
-+
-+void tdvf_hob_create(TdxGuest *tdx, TdxFirmwareEntry *td_hob)
-+{
-+    TdvfHob hob = {
-+        .hob_addr = td_hob->address,
-+        .size = td_hob->size,
-+        .ptr = td_hob->mem_ptr,
-+
-+        .current = td_hob->mem_ptr,
-+        .end = td_hob->mem_ptr + td_hob->size,
-+    };
-+
-+    EFI_HOB_GENERIC_HEADER *last_hob;
-+    EFI_HOB_HANDOFF_INFO_TABLE *hit;
-+
-+    /* Note, Efi{Free}Memory{Bottom,Top} are ignored, leave 'em zeroed. */
-+    hit = tdvf_get_area(&hob, sizeof(*hit));
-+    *hit = (EFI_HOB_HANDOFF_INFO_TABLE) {
-+        .Header = {
-+            .HobType = EFI_HOB_TYPE_HANDOFF,
-+            .HobLength = cpu_to_le16(sizeof(*hit)),
-+            .Reserved = cpu_to_le32(0),
-+        },
-+        .Version = cpu_to_le32(EFI_HOB_HANDOFF_TABLE_VERSION),
-+        .BootMode = cpu_to_le32(0),
-+        .EfiMemoryTop = cpu_to_le64(0),
-+        .EfiMemoryBottom = cpu_to_le64(0),
-+        .EfiFreeMemoryTop = cpu_to_le64(0),
-+        .EfiFreeMemoryBottom = cpu_to_le64(0),
-+        .EfiEndOfHobList = cpu_to_le64(0), /* initialized later */
-+    };
-+
-+    tdvf_hob_add_memory_resources(tdx, &hob);
-+
-+    last_hob = tdvf_get_area(&hob, sizeof(*last_hob));
-+    *last_hob =  (EFI_HOB_GENERIC_HEADER) {
-+        .HobType = EFI_HOB_TYPE_END_OF_HOB_LIST,
-+        .HobLength = cpu_to_le16(sizeof(*last_hob)),
-+        .Reserved = cpu_to_le32(0),
-+    };
-+    hit->EfiEndOfHobList = tdvf_current_guest_addr(&hob);
-+}
-diff --git a/hw/i386/tdvf-hob.h b/hw/i386/tdvf-hob.h
-new file mode 100644
-index 0000000000..4fc6a3740a
---- /dev/null
-+++ b/hw/i386/tdvf-hob.h
-@@ -0,0 +1,26 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+
-+#ifndef HW_I386_TD_HOB_H
-+#define HW_I386_TD_HOB_H
-+
-+#include "hw/i386/tdvf.h"
-+#include "target/i386/kvm/tdx.h"
-+
-+void tdvf_hob_create(TdxGuest *tdx, TdxFirmwareEntry *td_hob);
-+
-+#define EFI_RESOURCE_ATTRIBUTE_TDVF_PRIVATE     \
-+    (EFI_RESOURCE_ATTRIBUTE_PRESENT |           \
-+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
-+     EFI_RESOURCE_ATTRIBUTE_TESTED)
-+
-+#define EFI_RESOURCE_ATTRIBUTE_TDVF_UNACCEPTED  \
-+    (EFI_RESOURCE_ATTRIBUTE_PRESENT |           \
-+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
-+     EFI_RESOURCE_ATTRIBUTE_TESTED)
-+
-+#define EFI_RESOURCE_ATTRIBUTE_TDVF_MMIO        \
-+    (EFI_RESOURCE_ATTRIBUTE_PRESENT     |       \
-+     EFI_RESOURCE_ATTRIBUTE_INITIALIZED |       \
-+     EFI_RESOURCE_ATTRIBUTE_UNCACHEABLE)
-+
-+#endif
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index d1c7821347..db5d58b600 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -21,6 +21,7 @@
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
-+#include "hw/i386/tdvf-hob.h"
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-@@ -147,6 +148,19 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
-     tdx_guest->tdvf_mr = tdvf_mr;
- }
- 
-+static TdxFirmwareEntry *tdx_get_hob_entry(TdxGuest *tdx)
-+{
-+    TdxFirmwareEntry *entry;
-+
-+    for_each_tdx_fw_entry(&tdx->tdvf, entry) {
-+        if (entry->type == TDVF_SECTION_TYPE_TD_HOB) {
-+            return entry;
-+        }
-+    }
-+    error_report("TDVF metadata doesn't specify TD_HOB location.");
-+    exit(1);
-+}
-+
- static void tdx_add_ram_entry(uint64_t address, uint64_t length,
-                               enum TdxRamType type)
- {
-@@ -281,6 +295,8 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
- 
-     qsort(tdx_guest->ram_entries, tdx_guest->nr_ram_entries,
-           sizeof(TdxRamEntry), &tdx_ram_entry_compare);
-+
-+    tdvf_hob_create(tdx_guest, tdx_get_hob_entry(tdx_guest));
- }
- 
- static Notifier tdx_machine_done_notify = {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch b/kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch
deleted file mode 100644
index af194c4..0000000
--- a/kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch
+++ /dev/null
@@ -1,226 +0,0 @@
-From 9c3c02aab32a45468605b6872c358968615681ef Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 042/115] i386/tdx: Support user configurable
- mrconfigid/mrowner/mrownerconfig
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [42/115] 7f7acc5c5153f3486fcad084c036f67dbc483c66 (bonzini/rhel-qemu-kvm)
-
-Three sha384 hash values, mrconfigid, mrowner and mrownerconfig, of a TD
-can be provided for TDX attestation. Detailed meaning of them can be
-found: https://lore.kernel.org/qemu-devel/31d6dbc1-f453-4cef-ab08-4813f4e0ff92@intel.com/
-
-Allow user to specify those values via property mrconfigid, mrowner and
-mrownerconfig. They are all in base64 format.
-
-example
--object tdx-guest, \
-  mrconfigid=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\
-  mrowner=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v,\
-  mrownerconfig=ASNFZ4mrze8BI0VniavN7wEjRWeJq83vASNFZ4mrze8BI0VniavN7wEjRWeJq83v
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-14-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d05a0858cf876f79b57a622716fbad07f5b2ea08)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- qapi/qom.json         | 16 +++++++-
- target/i386/kvm/tdx.c | 95 +++++++++++++++++++++++++++++++++++++++++++
- target/i386/kvm/tdx.h |  3 ++
- 3 files changed, 113 insertions(+), 1 deletion(-)
-
-diff --git a/qapi/qom.json b/qapi/qom.json
-index fefb54f90b..970ffeee9e 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -1021,11 +1021,25 @@
- #     pages.  Some guest OS (e.g., Linux TD guest) may require this to
- #     be set, otherwise they refuse to boot.
- #
-+# @mrconfigid: ID for non-owner-defined configuration of the guest TD,
-+#     e.g., run-time or OS configuration (base64 encoded SHA384 digest).
-+#     Defaults to all zeros.
-+#
-+# @mrowner: ID for the guest TD’s owner (base64 encoded SHA384 digest).
-+#     Defaults to all zeros.
-+#
-+# @mrownerconfig: ID for owner-defined configuration of the guest TD,
-+#     e.g., specific to the workload rather than the run-time or OS
-+#     (base64 encoded SHA384 digest).  Defaults to all zeros.
-+#
- # Since: 10.1
- ##
- { 'struct': 'TdxGuestProperties',
-   'data': { '*attributes': 'uint64',
--            '*sept-ve-disable': 'bool' } }
-+            '*sept-ve-disable': 'bool',
-+            '*mrconfigid': 'str',
-+            '*mrowner': 'str',
-+            '*mrownerconfig': 'str' } }
- 
- ##
- # @ThreadContextProperties:
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 3de3b5fa6a..39fd964c6b 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -11,8 +11,10 @@
- 
- #include "qemu/osdep.h"
- #include "qemu/error-report.h"
-+#include "qemu/base64.h"
- #include "qapi/error.h"
- #include "qom/object_interfaces.h"
-+#include "crypto/hash.h"
- 
- #include "hw/i386/x86.h"
- #include "kvm_i386.h"
-@@ -240,6 +242,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     CPUX86State *env = &x86cpu->env;
-     g_autofree struct kvm_tdx_init_vm *init_vm = NULL;
-     Error *local_err = NULL;
-+    size_t data_len;
-     int retry = 10000;
-     int r = 0;
- 
-@@ -251,6 +254,45 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
-                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
- 
-+    if (tdx_guest->mrconfigid) {
-+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrconfigid,
-+                              strlen(tdx_guest->mrconfigid), &data_len, errp);
-+        if (!data) {
-+            return -1;
-+        }
-+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-+            error_setg(errp, "TDX: failed to decode mrconfigid");
-+            return -1;
-+        }
-+        memcpy(init_vm->mrconfigid, data, data_len);
-+    }
-+
-+    if (tdx_guest->mrowner) {
-+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrowner,
-+                              strlen(tdx_guest->mrowner), &data_len, errp);
-+        if (!data) {
-+            return -1;
-+        }
-+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-+            error_setg(errp, "TDX: failed to decode mrowner");
-+            return -1;
-+        }
-+        memcpy(init_vm->mrowner, data, data_len);
-+    }
-+
-+    if (tdx_guest->mrownerconfig) {
-+        g_autofree uint8_t *data = qbase64_decode(tdx_guest->mrownerconfig,
-+                            strlen(tdx_guest->mrownerconfig), &data_len, errp);
-+        if (!data) {
-+            return -1;
-+        }
-+        if (data_len != QCRYPTO_HASH_DIGEST_LEN_SHA384) {
-+            error_setg(errp, "TDX: failed to decode mrownerconfig");
-+            return -1;
-+        }
-+        memcpy(init_vm->mrownerconfig, data, data_len);
-+    }
-+
-     r = setup_td_guest_attributes(x86cpu, errp);
-     if (r) {
-         return r;
-@@ -314,6 +356,51 @@ static void tdx_guest_set_sept_ve_disable(Object *obj, bool value, Error **errp)
-     }
- }
- 
-+static char *tdx_guest_get_mrconfigid(Object *obj, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    return g_strdup(tdx->mrconfigid);
-+}
-+
-+static void tdx_guest_set_mrconfigid(Object *obj, const char *value, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    g_free(tdx->mrconfigid);
-+    tdx->mrconfigid = g_strdup(value);
-+}
-+
-+static char *tdx_guest_get_mrowner(Object *obj, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    return g_strdup(tdx->mrowner);
-+}
-+
-+static void tdx_guest_set_mrowner(Object *obj, const char *value, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    g_free(tdx->mrowner);
-+    tdx->mrowner = g_strdup(value);
-+}
-+
-+static char *tdx_guest_get_mrownerconfig(Object *obj, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    return g_strdup(tdx->mrownerconfig);
-+}
-+
-+static void tdx_guest_set_mrownerconfig(Object *obj, const char *value, Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    g_free(tdx->mrownerconfig);
-+    tdx->mrownerconfig = g_strdup(value);
-+}
-+
- /* tdx guest */
- OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-                                    tdx_guest,
-@@ -337,6 +424,14 @@ static void tdx_guest_init(Object *obj)
-     object_property_add_bool(obj, "sept-ve-disable",
-                              tdx_guest_get_sept_ve_disable,
-                              tdx_guest_set_sept_ve_disable);
-+    object_property_add_str(obj, "mrconfigid",
-+                            tdx_guest_get_mrconfigid,
-+                            tdx_guest_set_mrconfigid);
-+    object_property_add_str(obj, "mrowner",
-+                            tdx_guest_get_mrowner, tdx_guest_set_mrowner);
-+    object_property_add_str(obj, "mrownerconfig",
-+                            tdx_guest_get_mrownerconfig,
-+                            tdx_guest_set_mrownerconfig);
- }
- 
- static void tdx_guest_finalize(Object *obj)
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 4e2b5c61ff..e472b11fb0 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -24,6 +24,9 @@ typedef struct TdxGuest {
-     bool initialized;
-     uint64_t attributes;    /* TD attributes */
-     uint64_t xfam;
-+    char *mrconfigid;       /* base64 encoded sha348 digest */
-+    char *mrowner;          /* base64 encoded sha348 digest */
-+    char *mrownerconfig;    /* base64 encoded sha348 digest */
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch b/kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch
deleted file mode 100644
index eebb3ba..0000000
--- a/kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch
+++ /dev/null
@@ -1,223 +0,0 @@
-From c4a9204c7d8521c6fdc6b02b48db74ac109bcf09 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 050/115] i386/tdx: Track RAM entries for TDX VM
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [50/115] fc14b8ad21b0be7179f9af62b6b32068122cae61 (bonzini/rhel-qemu-kvm)
-
-The RAM of TDX VM can be classified into two types:
-
- - TDX_RAM_UNACCEPTED: default type of TDX memory, which needs to be
-   accepted by TDX guest before it can be used and will be all-zeros
-   after being accepted.
-
- - TDX_RAM_ADDED: the RAM that is ADD'ed to TD guest before running, and
-   can be used directly. E.g., TD HOB and TEMP MEM that needed by TDVF.
-
-Maintain TdxRamEntries[] which grabs the initial RAM info from e820 table
-and mark each RAM range as default type TDX_RAM_UNACCEPTED.
-
-Then turn the range of TD HOB and TEMP MEM to TDX_RAM_ADDED since these
-ranges will be ADD'ed before TD runs and no need to be accepted runtime.
-
-The TdxRamEntries[] are later used to setup the memory TD resource HOB
-that passes memory info from QEMU to TDVF.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-22-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f18672e4cf91feed4b91ef85a264a500935a2865)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 109 ++++++++++++++++++++++++++++++++++++++++++
- target/i386/kvm/tdx.h |  14 ++++++
- 2 files changed, 123 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 95687e3a91..d1c7821347 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -18,6 +18,7 @@
- #include "crypto/hash.h"
- #include "sysemu/sysemu.h"
- 
-+#include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
- #include "kvm_i386.h"
-@@ -146,11 +147,110 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
-     tdx_guest->tdvf_mr = tdvf_mr;
- }
- 
-+static void tdx_add_ram_entry(uint64_t address, uint64_t length,
-+                              enum TdxRamType type)
-+{
-+    uint32_t nr_entries = tdx_guest->nr_ram_entries;
-+    tdx_guest->ram_entries = g_renew(TdxRamEntry, tdx_guest->ram_entries,
-+                                     nr_entries + 1);
-+
-+    tdx_guest->ram_entries[nr_entries].address = address;
-+    tdx_guest->ram_entries[nr_entries].length = length;
-+    tdx_guest->ram_entries[nr_entries].type = type;
-+    tdx_guest->nr_ram_entries++;
-+}
-+
-+static int tdx_accept_ram_range(uint64_t address, uint64_t length)
-+{
-+    uint64_t head_start, tail_start, head_length, tail_length;
-+    uint64_t tmp_address, tmp_length;
-+    TdxRamEntry *e;
-+    int i = 0;
-+
-+    do {
-+        if (i == tdx_guest->nr_ram_entries) {
-+            return -1;
-+        }
-+
-+        e = &tdx_guest->ram_entries[i++];
-+    } while (address + length <= e->address || address >= e->address + e->length);
-+
-+    /*
-+     * The to-be-accepted ram range must be fully contained by one
-+     * RAM entry.
-+     */
-+    if (e->address > address ||
-+        e->address + e->length < address + length) {
-+        return -1;
-+    }
-+
-+    if (e->type == TDX_RAM_ADDED) {
-+        return 0;
-+    }
-+
-+    tmp_address = e->address;
-+    tmp_length = e->length;
-+
-+    e->address = address;
-+    e->length = length;
-+    e->type = TDX_RAM_ADDED;
-+
-+    head_length = address - tmp_address;
-+    if (head_length > 0) {
-+        head_start = tmp_address;
-+        tdx_add_ram_entry(head_start, head_length, TDX_RAM_UNACCEPTED);
-+    }
-+
-+    tail_start = address + length;
-+    if (tail_start < tmp_address + tmp_length) {
-+        tail_length = tmp_address + tmp_length - tail_start;
-+        tdx_add_ram_entry(tail_start, tail_length, TDX_RAM_UNACCEPTED);
-+    }
-+
-+    return 0;
-+}
-+
-+static int tdx_ram_entry_compare(const void *lhs_, const void* rhs_)
-+{
-+    const TdxRamEntry *lhs = lhs_;
-+    const TdxRamEntry *rhs = rhs_;
-+
-+    if (lhs->address == rhs->address) {
-+        return 0;
-+    }
-+    if (le64_to_cpu(lhs->address) > le64_to_cpu(rhs->address)) {
-+        return 1;
-+    }
-+    return -1;
-+}
-+
-+static void tdx_init_ram_entries(void)
-+{
-+    unsigned i, j, nr_e820_entries;
-+
-+    nr_e820_entries = e820_get_table(NULL);
-+    tdx_guest->ram_entries = g_new(TdxRamEntry, nr_e820_entries);
-+
-+    for (i = 0, j = 0; i < nr_e820_entries; i++) {
-+        uint64_t addr, len;
-+
-+        if (e820_get_entry(i, E820_RAM, &addr, &len)) {
-+            tdx_guest->ram_entries[j].address = addr;
-+            tdx_guest->ram_entries[j].length = len;
-+            tdx_guest->ram_entries[j].type = TDX_RAM_UNACCEPTED;
-+            j++;
-+        }
-+    }
-+    tdx_guest->nr_ram_entries = j;
-+}
-+
- static void tdx_finalize_vm(Notifier *notifier, void *unused)
- {
-     TdxFirmware *tdvf = &tdx_guest->tdvf;
-     TdxFirmwareEntry *entry;
- 
-+    tdx_init_ram_entries();
-+
-     for_each_tdx_fw_entry(tdvf, entry) {
-         switch (entry->type) {
-         case TDVF_SECTION_TYPE_BFV:
-@@ -166,12 +266,21 @@ static void tdx_finalize_vm(Notifier *notifier, void *unused)
-                              entry->type);
-                 exit(1);
-             }
-+            if (tdx_accept_ram_range(entry->address, entry->size)) {
-+                error_report("Failed to accept memory for TDVF section %d",
-+                             entry->type);
-+                qemu_ram_munmap(-1, entry->mem_ptr, entry->size);
-+                exit(1);
-+            }
-             break;
-         default:
-             error_report("Unsupported TDVF section %d", entry->type);
-             exit(1);
-         }
-     }
-+
-+    qsort(tdx_guest->ram_entries, tdx_guest->nr_ram_entries,
-+          sizeof(TdxRamEntry), &tdx_ram_entry_compare);
- }
- 
- static Notifier tdx_machine_done_notify = {
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 28a03c2a7b..36a7400e74 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -20,6 +20,17 @@ typedef struct TdxGuestClass {
- /* TDX requires bus frequency 25MHz */
- #define TDX_APIC_BUS_CYCLES_NS 40
- 
-+enum TdxRamType {
-+    TDX_RAM_UNACCEPTED,
-+    TDX_RAM_ADDED,
-+};
-+
-+typedef struct TdxRamEntry {
-+    uint64_t address;
-+    uint64_t length;
-+    enum TdxRamType type;
-+} TdxRamEntry;
-+
- typedef struct TdxGuest {
-     X86ConfidentialGuest parent_obj;
- 
-@@ -34,6 +45,9 @@ typedef struct TdxGuest {
- 
-     MemoryRegion *tdvf_mr;
-     TdxFirmware tdvf;
-+
-+    uint32_t nr_ram_entries;
-+    TdxRamEntry *ram_entries;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch b/kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch
deleted file mode 100644
index bb416b2..0000000
--- a/kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch
+++ /dev/null
@@ -1,151 +0,0 @@
-From 95f727555b05af436c6e23a0dde42155a217a6e8 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 049/115] i386/tdx: Track mem_ptr for each firmware entry of
- TDVF
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [49/115] 8cee9537e1387c718ec037bbc1a8d0a6b17bbf49 (bonzini/rhel-qemu-kvm)
-
-For each TDVF sections, QEMU needs to copy the content to guest
-private memory via KVM API (KVM_TDX_INIT_MEM_REGION).
-
-Introduce a field @mem_ptr for TdxFirmwareEntry to track the memory
-pointer of each TDVF sections. So that QEMU can add/copy them to guest
-private memory later.
-
-TDVF sections can be classified into two groups:
- - Firmware itself, e.g., TDVF BFV and CFV, that located separately from
-   guest RAM. Its memory pointer is the bios pointer.
-
- - Sections located at guest RAM, e.g., TEMP_MEM and TD_HOB.
-   mmap a new memory range for them.
-
-Register a machine_init_done callback to do the stuff.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-21-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 4420ba0ebbf014acc68f78669e0767e288313ed6)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/
----
- hw/i386/tdvf.c         |  1 +
- include/hw/i386/tdvf.h |  7 +++++++
- target/i386/kvm/tdx.c  | 37 +++++++++++++++++++++++++++++++++++++
- 3 files changed, 45 insertions(+)
-
-diff --git a/hw/i386/tdvf.c b/hw/i386/tdvf.c
-index 824a387d42..88453cf3a5 100644
---- a/hw/i386/tdvf.c
-+++ b/hw/i386/tdvf.c
-@@ -179,6 +179,7 @@ int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size)
-         }
-     }
- 
-+    fw->mem_ptr = flash_ptr;
-     return 0;
- 
- err:
-diff --git a/include/hw/i386/tdvf.h b/include/hw/i386/tdvf.h
-index 7ebcac42a3..e75c8d1acc 100644
---- a/include/hw/i386/tdvf.h
-+++ b/include/hw/i386/tdvf.h
-@@ -26,13 +26,20 @@ typedef struct TdxFirmwareEntry {
-     uint64_t size;
-     uint32_t type;
-     uint32_t attributes;
-+
-+    void *mem_ptr;
- } TdxFirmwareEntry;
- 
- typedef struct TdxFirmware {
-+    void *mem_ptr;
-+
-     uint32_t nr_entries;
-     TdxFirmwareEntry *entries;
- } TdxFirmware;
- 
-+#define for_each_tdx_fw_entry(fw, e)    \
-+    for (e = (fw)->entries; e != (fw)->entries + (fw)->nr_entries; e++)
-+
- int tdvf_parse_metadata(TdxFirmware *fw, void *flash_ptr, int size);
- 
- #endif /* HW_I386_TDVF_H */
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 71be3bd28d..95687e3a91 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -12,10 +12,13 @@
- #include "qemu/osdep.h"
- #include "qemu/error-report.h"
- #include "qemu/base64.h"
-+#include "qemu/mmap-alloc.h"
- #include "qapi/error.h"
- #include "qom/object_interfaces.h"
- #include "crypto/hash.h"
-+#include "sysemu/sysemu.h"
- 
-+#include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
- #include "kvm_i386.h"
- #include "tdx.h"
-@@ -143,6 +146,38 @@ void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
-     tdx_guest->tdvf_mr = tdvf_mr;
- }
- 
-+static void tdx_finalize_vm(Notifier *notifier, void *unused)
-+{
-+    TdxFirmware *tdvf = &tdx_guest->tdvf;
-+    TdxFirmwareEntry *entry;
-+
-+    for_each_tdx_fw_entry(tdvf, entry) {
-+        switch (entry->type) {
-+        case TDVF_SECTION_TYPE_BFV:
-+        case TDVF_SECTION_TYPE_CFV:
-+            entry->mem_ptr = tdvf->mem_ptr + entry->data_offset;
-+            break;
-+        case TDVF_SECTION_TYPE_TD_HOB:
-+        case TDVF_SECTION_TYPE_TEMP_MEM:
-+            entry->mem_ptr = qemu_ram_mmap(-1, entry->size,
-+                                           qemu_real_host_page_size(), 0, 0);
-+            if (entry->mem_ptr == MAP_FAILED) {
-+                error_report("Failed to mmap memory for TDVF section %d",
-+                             entry->type);
-+                exit(1);
-+            }
-+            break;
-+        default:
-+            error_report("Unsupported TDVF section %d", entry->type);
-+            exit(1);
-+        }
-+    }
-+}
-+
-+static Notifier tdx_machine_done_notify = {
-+    .notify = tdx_finalize_vm,
-+};
-+
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-     TdxGuest *tdx = TDX_GUEST(cgs);
-@@ -157,6 +192,8 @@ static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
-         }
-     }
- 
-+    qemu_add_machine_init_done_notifier(&tdx_machine_done_notify);
-+
-     tdx_guest = tdx;
-     return 0;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Validate-TD-attributes.patch b/kvm-i386-tdx-Validate-TD-attributes.patch
deleted file mode 100644
index 19c2394..0000000
--- a/kvm-i386-tdx-Validate-TD-attributes.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From e0384fc5822eb8fcea9a5e59b89b9430dedadba3 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 041/115] i386/tdx: Validate TD attributes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [41/115] c95c6476092eb717dd042c64d656c2b1aa70a409 (bonzini/rhel-qemu-kvm)
-
-Validate TD attributes with tdx_caps that only supported bits are
-allowed by KVM.
-
-Besides, sanity check the attribute bits that have not been supported by
-QEMU yet. e.g., debug bit, it will be allowed in the future when debug
-TD support lands in QEMU.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-13-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 53b6f406b4f1a215fb3ec60e56ddba2e019a45ef)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 33 +++++++++++++++++++++++++++++++--
- 1 file changed, 31 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 1ab063f790..3de3b5fa6a 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -18,10 +18,15 @@
- #include "kvm_i386.h"
- #include "tdx.h"
- 
-+#define TDX_TD_ATTRIBUTES_DEBUG             BIT_ULL(0)
- #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
- #define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
- #define TDX_TD_ATTRIBUTES_PERFMON           BIT_ULL(63)
- 
-+#define TDX_SUPPORTED_TD_ATTRS  (TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE |\
-+                                 TDX_TD_ATTRIBUTES_PKS | \
-+                                 TDX_TD_ATTRIBUTES_PERFMON)
-+
- static TdxGuest *tdx_guest;
- 
- static struct kvm_tdx_capabilities *tdx_caps;
-@@ -153,13 +158,34 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
-     return KVM_X86_TDX_VM;
- }
- 
--static void setup_td_guest_attributes(X86CPU *x86cpu)
-+static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
-+{
-+    if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
-+        error_setg(errp, "Invalid attributes 0x%lx for TDX VM "
-+                   "(KVM supported: 0x%llx)", tdx->attributes,
-+                   tdx_caps->supported_attrs);
-+        return -1;
-+    }
-+
-+    if (tdx->attributes & ~TDX_SUPPORTED_TD_ATTRS) {
-+        error_setg(errp, "Some QEMU unsupported TD attribute bits being "
-+                    "requested: 0x%lx (QEMU supported: 0x%llx)",
-+                    tdx->attributes, TDX_SUPPORTED_TD_ATTRS);
-+        return -1;
-+    }
-+
-+    return 0;
-+}
-+
-+static int setup_td_guest_attributes(X86CPU *x86cpu, Error **errp)
- {
-     CPUX86State *env = &x86cpu->env;
- 
-     tdx_guest->attributes |= (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS) ?
-                              TDX_TD_ATTRIBUTES_PKS : 0;
-     tdx_guest->attributes |= x86cpu->enable_pmu ? TDX_TD_ATTRIBUTES_PERFMON : 0;
-+
-+    return tdx_validate_attributes(tdx_guest, errp);
- }
- 
- static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
-@@ -225,7 +251,10 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
-                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
- 
--    setup_td_guest_attributes(x86cpu);
-+    r = setup_td_guest_attributes(x86cpu, errp);
-+    if (r) {
-+        return r;
-+    }
- 
-     r = setup_td_xfam(x86cpu, errp);
-     if (r) {
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Validate-phys_bits-against-host-value.patch b/kvm-i386-tdx-Validate-phys_bits-against-host-value.patch
deleted file mode 100644
index b5c4419..0000000
--- a/kvm-i386-tdx-Validate-phys_bits-against-host-value.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From b7e8674a1d3d577a3e88e95d2dab6aac626eca41 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:48 +0200
-Subject: [PATCH 083/115] i386/tdx: Validate phys_bits against host value
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [83/115] 42a17d80e8c176a2dc4e2d3da0ea74f7fdb85577 (bonzini/rhel-qemu-kvm)
-
-For TDX guest, the phys_bits is not configurable and can only be
-host/native value.
-
-Validate phys_bits inside tdx_check_features().
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-55-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 907ee7b67e50a7eea2768c66e3ad67c9aa4ffd3c)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/host-cpu.c | 2 +-
- target/i386/host-cpu.h | 1 +
- target/i386/kvm/tdx.c  | 8 ++++++++
- 3 files changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
-index 4a77ecc1fc..4ab536ab80 100644
---- a/target/i386/host-cpu.c
-+++ b/target/i386/host-cpu.c
-@@ -15,7 +15,7 @@
- #include "sysemu/sysemu.h"
- 
- /* Note: Only safe for use on x86(-64) hosts */
--static uint32_t host_cpu_phys_bits(void)
-+uint32_t host_cpu_phys_bits(void)
- {
-     uint32_t eax;
-     uint32_t host_phys_bits;
-diff --git a/target/i386/host-cpu.h b/target/i386/host-cpu.h
-index 6a9bc918ba..b97ec01c9b 100644
---- a/target/i386/host-cpu.h
-+++ b/target/i386/host-cpu.h
-@@ -10,6 +10,7 @@
- #ifndef HOST_CPU_H
- #define HOST_CPU_H
- 
-+uint32_t host_cpu_phys_bits(void);
- void host_cpu_instance_init(X86CPU *cpu);
- void host_cpu_max_instance_init(X86CPU *cpu);
- bool host_cpu_realizefn(CPUState *cs, Error **errp);
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 3ec31d4872..b9c3ba3725 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -25,6 +25,7 @@
- 
- #include "cpu.h"
- #include "cpu-internal.h"
-+#include "host-cpu.h"
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
-@@ -879,6 +880,13 @@ static int tdx_check_features(X86ConfidentialGuest *cg, CPUState *cs)
-         return -EINVAL;
-     }
- 
-+    if (cpu->phys_bits != host_cpu_phys_bits()) {
-+        error_report("TDX requires guest CPU physical bits (%u) "
-+                     "to match host CPU physical bits (%u)",
-+                     cpu->phys_bits, host_cpu_phys_bits());
-+        return -EINVAL;
-+    }
-+
-     return 0;
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch b/kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch
deleted file mode 100644
index cea4e11..0000000
--- a/kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From e417afeb76f30fca6c16e57971521c5c9c25681c Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 040/115] i386/tdx: Wire CPU features up with attributes of TD
- guest
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [40/115] ce59bfc2281e630283095aec8975d93ef455d599 (bonzini/rhel-qemu-kvm)
-
-For QEMU VMs,
-  - PKS is configured via CPUID_7_0_ECX_PKS, e.g., -cpu xxx,+pks  and
-  - PMU is configured by x86cpu->enable_pmu, e.g., -cpu xxx,pmu=on
-
-While the bit 30 (PKS) and bit 63 (PERFMON) of TD's attributes are also
-used to configure the PKS and PERFMON/PMU of TD, reuse the existing
-configuration interfaces of 'cpu' for TD's attributes.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-12-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit bb3be394cf80d68251e5b89e823dddc679b6e644)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 13 +++++++++++++
- 1 file changed, 13 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 2ed40b7614..1ab063f790 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -19,6 +19,8 @@
- #include "tdx.h"
- 
- #define TDX_TD_ATTRIBUTES_SEPT_VE_DISABLE   BIT_ULL(28)
-+#define TDX_TD_ATTRIBUTES_PKS               BIT_ULL(30)
-+#define TDX_TD_ATTRIBUTES_PERFMON           BIT_ULL(63)
- 
- static TdxGuest *tdx_guest;
- 
-@@ -151,6 +153,15 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
-     return KVM_X86_TDX_VM;
- }
- 
-+static void setup_td_guest_attributes(X86CPU *x86cpu)
-+{
-+    CPUX86State *env = &x86cpu->env;
-+
-+    tdx_guest->attributes |= (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_PKS) ?
-+                             TDX_TD_ATTRIBUTES_PKS : 0;
-+    tdx_guest->attributes |= x86cpu->enable_pmu ? TDX_TD_ATTRIBUTES_PERFMON : 0;
-+}
-+
- static int setup_td_xfam(X86CPU *x86cpu, Error **errp)
- {
-     CPUX86State *env = &x86cpu->env;
-@@ -214,6 +225,8 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp)
-     init_vm = g_malloc0(sizeof(struct kvm_tdx_init_vm) +
-                         sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
- 
-+    setup_td_guest_attributes(x86cpu);
-+
-     r = setup_td_xfam(x86cpu, errp);
-     if (r) {
-         return r;
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch b/kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch
deleted file mode 100644
index 6114d52..0000000
--- a/kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch
+++ /dev/null
@@ -1,240 +0,0 @@
-From 7f2a5ac9ad2e2d54b09e1bcd1a1d59cbde1443eb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 058/115] i386/tdx: Wire TDX_REPORT_FATAL_ERROR with GuestPanic
- facility
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [58/115] 4cdc786e5ad029e8ed5713b4a27bb038a4b6f935 (bonzini/rhel-qemu-kvm)
-
-Integrate TDX's TDX_REPORT_FATAL_ERROR into QEMU GuestPanic facility
-
-Originated-from: Isaku Yamahata <isaku.yamahata@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-30-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 6e250463b08b4028123f201343ee72099ef81e68)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/
----
- qapi/run-state.json   | 31 +++++++++++++++++++--
- system/runstate.c     | 65 +++++++++++++++++++++++++++++++++++++++++++
- target/i386/kvm/tdx.c | 25 ++++++++++++++++-
- 3 files changed, 118 insertions(+), 3 deletions(-)
-
-diff --git a/qapi/run-state.json b/qapi/run-state.json
-index ce95cfa46b..ee11adc508 100644
---- a/qapi/run-state.json
-+++ b/qapi/run-state.json
-@@ -501,10 +501,12 @@
- #
- # @s390: s390 guest panic information type (Since: 2.12)
- #
-+# @tdx: tdx guest panic information type (Since: 10.1)
-+#
- # Since: 2.9
- ##
- { 'enum': 'GuestPanicInformationType',
--  'data': [ 'hyper-v', 's390' ] }
-+  'data': [ 'hyper-v', 's390', 'tdx' ] }
- 
- ##
- # @GuestPanicInformation:
-@@ -519,7 +521,8 @@
-  'base': {'type': 'GuestPanicInformationType'},
-  'discriminator': 'type',
-  'data': {'hyper-v': 'GuestPanicInformationHyperV',
--          's390': 'GuestPanicInformationS390'}}
-+          's390': 'GuestPanicInformationS390',
-+          'tdx' : 'GuestPanicInformationTdx'}}
- 
- ##
- # @GuestPanicInformationHyperV:
-@@ -598,6 +601,30 @@
-           'psw-addr': 'uint64',
-           'reason': 'S390CrashReason'}}
- 
-+##
-+# @GuestPanicInformationTdx:
-+#
-+# TDX Guest panic information specific to TDX, as specified in the
-+# "Guest-Hypervisor Communication Interface (GHCI) Specification",
-+# section TDG.VP.VMCALL<ReportFatalError>.
-+#
-+# @error-code: TD-specific error code
-+#
-+# @message: Human-readable error message provided by the guest. Not
-+#     to be trusted.
-+#
-+# @gpa: guest-physical address of a page that contains more verbose
-+#     error information, as zero-terminated string.  Present when the
-+#     "GPA valid" bit (bit 63) is set in @error-code.
-+#
-+#
-+# Since: 10.1
-+##
-+{'struct': 'GuestPanicInformationTdx',
-+ 'data': {'error-code': 'uint32',
-+          'message': 'str',
-+          '*gpa': 'uint64'}}
-+
- ##
- # @MEMORY_FAILURE:
- #
-diff --git a/system/runstate.c b/system/runstate.c
-index c2c9afa905..31970c522e 100644
---- a/system/runstate.c
-+++ b/system/runstate.c
-@@ -565,6 +565,58 @@ static void qemu_system_wakeup(void)
-     }
- }
- 
-+static char *tdx_parse_panic_message(char *message)
-+{
-+    bool printable = false;
-+    char *buf = NULL;
-+    int len = 0, i;
-+
-+    /*
-+     * Although message is defined as a json string, we shouldn't
-+     * unconditionally treat it as is because the guest generated it and
-+     * it's not necessarily trustable.
-+     */
-+    if (message) {
-+        /* The caller guarantees the NULL-terminated string. */
-+        len = strlen(message);
-+
-+        printable = len > 0;
-+        for (i = 0; i < len; i++) {
-+            if (!(0x20 <= message[i] && message[i] <= 0x7e)) {
-+                printable = false;
-+                break;
-+            }
-+        }
-+    }
-+
-+    if (len == 0) {
-+        buf = g_malloc(1);
-+        buf[0] = '\0';
-+    } else {
-+        if (!printable) {
-+            /* 3 = length of "%02x " */
-+            buf = g_malloc(len * 3);
-+            for (i = 0; i < len; i++) {
-+                if (message[i] == '\0') {
-+                    break;
-+                } else {
-+                    sprintf(buf + 3 * i, "%02x ", message[i]);
-+                }
-+            }
-+            if (i > 0) {
-+                /* replace the last ' '(space) to NULL */
-+                buf[i * 3 - 1] = '\0';
-+            } else {
-+                buf[0] = '\0';
-+            }
-+        } else {
-+            buf = g_strdup(message);
-+        }
-+    }
-+
-+    return buf;
-+}
-+
- void qemu_system_guest_panicked(GuestPanicInformation *info)
- {
-     qemu_log_mask(LOG_GUEST_ERROR, "Guest crashed");
-@@ -606,7 +658,20 @@ void qemu_system_guest_panicked(GuestPanicInformation *info)
-                           S390CrashReason_str(info->u.s390.reason),
-                           info->u.s390.psw_mask,
-                           info->u.s390.psw_addr);
-+        } else if (info->type == GUEST_PANIC_INFORMATION_TYPE_TDX) {
-+            char *message = tdx_parse_panic_message(info->u.tdx.message);
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "\nTDX guest reports fatal error."
-+                          " error code: 0x%" PRIx32 " error message:\"%s\"\n",
-+                          info->u.tdx.error_code, message);
-+            g_free(message);
-+            if (info->u.tdx.gpa != -1ull) {
-+                qemu_log_mask(LOG_GUEST_ERROR, "Additional error information "
-+                              "can be found at gpa page: 0x%" PRIx64 "\n",
-+                              info->u.tdx.gpa);
-+            }
-         }
-+
-         qapi_free_GuestPanicInformation(info);
-     }
- }
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 679613ab55..7611f51aae 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -16,6 +16,7 @@
- #include "qapi/error.h"
- #include "qom/object_interfaces.h"
- #include "crypto/hash.h"
-+#include "sysemu/runstate.h"
- #include "sysemu/sysemu.h"
- #include "exec/ramblock.h"
- 
-@@ -615,18 +616,35 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
-+static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-+                                        char *message, uint64_t gpa)
-+{
-+    GuestPanicInformation *panic_info;
-+
-+    panic_info = g_new0(GuestPanicInformation, 1);
-+    panic_info->type = GUEST_PANIC_INFORMATION_TYPE_TDX;
-+    panic_info->u.tdx.error_code = (uint32_t) error_code;
-+    panic_info->u.tdx.message = message;
-+    panic_info->u.tdx.gpa = gpa;
-+
-+    qemu_system_guest_panicked(panic_info);
-+}
-+
- /*
-  * Only 8 registers can contain valid ASCII byte stream to form the fatal
-  * message, and their sequence is: R14, R15, RBX, RDI, RSI, R8, R9, RDX
-  */
- #define TDX_FATAL_MESSAGE_MAX        64
- 
-+#define TDX_REPORT_FATAL_ERROR_GPA_VALID    BIT_ULL(63)
-+
- int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
- {
-     uint64_t error_code = run->system_event.data[R_R12];
-     uint64_t reg_mask = run->system_event.data[R_ECX];
-     char *message = NULL;
-     uint64_t *tmp;
-+    uint64_t gpa = -1ull;
- 
-     if (error_code & 0xffff) {
-         error_report("TDX: REPORT_FATAL_ERROR: invalid error code: 0x%lx",
-@@ -657,7 +675,12 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-     }
- #undef COPY_REG
- 
--    error_report("TD guest reports fatal error. %s", message ? : "");
-+    if (error_code & TDX_REPORT_FATAL_ERROR_GPA_VALID) {
-+        gpa = run->system_event.data[R_R13];
-+    }
-+
-+    tdx_panicked_on_fatal_error(cpu, error_code, message, gpa);
-+
-     return -1;
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch b/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch
deleted file mode 100644
index 0ecf41d..0000000
--- a/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch
+++ /dev/null
@@ -1,798 +0,0 @@
-From e100b3595bacf3d18af8a6b8234e8c1abdd1f87c Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:26:18 +0200
-Subject: [PATCH 093/115] i386/tdx: handle TDG.VP.VMCALL<GetQuote>
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [93/115] 4e656b0d7f8a022d25573b9583ed7864815cb88b (bonzini/rhel-qemu-kvm)
-
-Add property "quote-generation-socket" to tdx-guest, which is a property
-of type SocketAddress to specify Quote Generation Service(QGS).
-
-On request of GetQuote, it connects to the QGS socket, read request
-data from shared guest memory, send the request data to the QGS,
-and store the response into shared guest memory, at last notify
-TD guest by interrupt.
-
-command line example:
-  qemu-system-x86_64 \
-    -object '{"qom-type":"tdx-guest","id":"tdx0","quote-generation-socket":{"type":"unix", "path":"/var/run/tdx-qgs/qgs.socket"}}' \
-    -machine confidential-guest-support=tdx0
-
-Note, above example uses the unix socket. It can be other types, like vsock,
-which depends on the implementation of QGS.
-
-To avoid no response from QGS server, setup a timer for the transaction.
-If timeout, make it an error and interrupt guest. Define the threshold of
-time to 30s at present, maybe change to other value if not appropriate.
-
-Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
-Co-developed-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Tested-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 40da501d8989913935660dc24953ece02c9e98b8)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/,exec/
----
- qapi/qom.json                         |   8 +-
- target/i386/kvm/kvm.c                 |   3 +
- target/i386/kvm/meson.build           |   2 +-
- target/i386/kvm/tdx-quote-generator.c | 300 ++++++++++++++++++++++++++
- target/i386/kvm/tdx-quote-generator.h |  82 +++++++
- target/i386/kvm/tdx-stub.c            |   4 +
- target/i386/kvm/tdx.c                 | 176 ++++++++++++++-
- target/i386/kvm/tdx.h                 |  10 +
- 8 files changed, 582 insertions(+), 3 deletions(-)
- create mode 100644 target/i386/kvm/tdx-quote-generator.c
- create mode 100644 target/i386/kvm/tdx-quote-generator.h
-
-diff --git a/qapi/qom.json b/qapi/qom.json
-index 970ffeee9e..72c1605ad7 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -1032,6 +1032,11 @@
- #     e.g., specific to the workload rather than the run-time or OS
- #     (base64 encoded SHA384 digest).  Defaults to all zeros.
- #
-+# @quote-generation-socket: socket address for Quote Generation
-+#     Service (QGS).  QGS is a daemon running on the host.  Without
-+#     it, the guest will not be able to get a TD quote for
-+#     attestation.
-+#
- # Since: 10.1
- ##
- { 'struct': 'TdxGuestProperties',
-@@ -1039,7 +1044,8 @@
-             '*sept-ve-disable': 'bool',
-             '*mrconfigid': 'str',
-             '*mrowner': 'str',
--            '*mrownerconfig': 'str' } }
-+            '*mrownerconfig': 'str',
-+            '*quote-generation-socket': 'SocketAddress' } }
- 
- ##
- # @ThreadContextProperties:
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 26328a1d3b..fbf11b2122 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -6045,6 +6045,9 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-          * does not handle the TDVMCALL.
-          */
-         switch (run->tdx.nr) {
-+        case TDVMCALL_GET_QUOTE:
-+            tdx_handle_get_quote(cpu, run);
-+            break;
-         case TDVMCALL_GET_TD_VM_CALL_INFO:
-             tdx_handle_get_tdvmcall_info(cpu, run);
-             break;
-diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
-index 3f44cdedb7..2675bf8902 100644
---- a/target/i386/kvm/meson.build
-+++ b/target/i386/kvm/meson.build
-@@ -8,7 +8,7 @@ i386_kvm_ss.add(files(
- 
- i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
- 
--i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c'), if_false: files('tdx-stub.c'))
-+i386_kvm_ss.add(when: 'CONFIG_TDX', if_true: files('tdx.c', 'tdx-quote-generator.c'), if_false: files('tdx-stub.c'))
- 
- i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
- 
-diff --git a/target/i386/kvm/tdx-quote-generator.c b/target/i386/kvm/tdx-quote-generator.c
-new file mode 100644
-index 0000000000..f59715f617
---- /dev/null
-+++ b/target/i386/kvm/tdx-quote-generator.c
-@@ -0,0 +1,300 @@
-+/*
-+ * QEMU TDX Quote Generation Support
-+ *
-+ * Copyright (c) 2025 Intel Corporation
-+ *
-+ * Author:
-+ *      Xiaoyao Li <xiaoyao.li@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/error-report.h"
-+#include "qapi/error.h"
-+#include "qapi/qapi-visit-sockets.h"
-+
-+#include "tdx-quote-generator.h"
-+
-+#define QGS_MSG_LIB_MAJOR_VER 1
-+#define QGS_MSG_LIB_MINOR_VER 1
-+
-+typedef enum _qgs_msg_type_t {
-+    GET_QUOTE_REQ = 0,
-+    GET_QUOTE_RESP = 1,
-+    GET_COLLATERAL_REQ = 2,
-+    GET_COLLATERAL_RESP = 3,
-+    GET_PLATFORM_INFO_REQ = 4,
-+    GET_PLATFORM_INFO_RESP = 5,
-+    QGS_MSG_TYPE_MAX
-+} qgs_msg_type_t;
-+
-+typedef struct _qgs_msg_header_t {
-+    uint16_t major_version;
-+    uint16_t minor_version;
-+    uint32_t type;
-+    uint32_t size;              // size of the whole message, include this header, in byte
-+    uint32_t error_code;        // used in response only
-+} qgs_msg_header_t;
-+
-+typedef struct _qgs_msg_get_quote_req_t {
-+    qgs_msg_header_t header;    // header.type = GET_QUOTE_REQ
-+    uint32_t report_size;       // cannot be 0
-+    uint32_t id_list_size;      // length of id_list, in byte, can be 0
-+} qgs_msg_get_quote_req_t;
-+
-+typedef struct _qgs_msg_get_quote_resp_s {
-+    qgs_msg_header_t header;    // header.type = GET_QUOTE_RESP
-+    uint32_t selected_id_size;  // can be 0 in case only one id is sent in request
-+    uint32_t quote_size;        // length of quote_data, in byte
-+    uint8_t id_quote[];         // selected id followed by quote
-+} qgs_msg_get_quote_resp_t;
-+
-+#define HEADER_SIZE 4
-+
-+static uint32_t decode_header(const char *buf, size_t len) {
-+    if (len < HEADER_SIZE) {
-+        return 0;
-+    }
-+    uint32_t msg_size = 0;
-+    for (uint32_t i = 0; i < HEADER_SIZE; ++i) {
-+        msg_size = msg_size * 256 + (buf[i] & 0xFF);
-+    }
-+    return msg_size;
-+}
-+
-+static void encode_header(char *buf, size_t len, uint32_t size) {
-+    assert(len >= HEADER_SIZE);
-+    buf[0] = ((size >> 24) & 0xFF);
-+    buf[1] = ((size >> 16) & 0xFF);
-+    buf[2] = ((size >> 8) & 0xFF);
-+    buf[3] = (size & 0xFF);
-+}
-+
-+static void tdx_generate_quote_cleanup(TdxGenerateQuoteTask *task)
-+{
-+    timer_del(&task->timer);
-+
-+    g_source_remove(task->watch);
-+    qio_channel_close(QIO_CHANNEL(task->sioc), NULL);
-+    object_unref(OBJECT(task->sioc));
-+
-+    task->completion(task);
-+}
-+
-+static gboolean tdx_get_quote_read(QIOChannel *ioc, GIOCondition condition,
-+                                   gpointer opaque)
-+{
-+    TdxGenerateQuoteTask *task = opaque;
-+    Error *err = NULL;
-+    int ret;
-+
-+    ret = qio_channel_read(ioc, task->receive_buf + task->receive_buf_received,
-+                           task->payload_len - task->receive_buf_received, &err);
-+    if (ret < 0) {
-+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
-+            return G_SOURCE_CONTINUE;
-+        } else {
-+            error_report_err(err);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+    }
-+
-+    if (ret == 0) {
-+        error_report("End of file before reply received");
-+        task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+        goto end;
-+    }
-+
-+    task->receive_buf_received += ret;
-+    if (task->receive_buf_received >= HEADER_SIZE) {
-+        uint32_t len = decode_header(task->receive_buf,
-+                                     task->receive_buf_received);
-+        if (len == 0 ||
-+            len > (task->payload_len - HEADER_SIZE)) {
-+            error_report("Message len %u must be non-zero & less than %zu",
-+                         len, (task->payload_len - HEADER_SIZE));
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+
-+        /* Now we know the size, shrink to fit */
-+        task->payload_len = HEADER_SIZE + len;
-+        task->receive_buf = g_renew(char,
-+                                    task->receive_buf,
-+                                    task->payload_len);
-+    }
-+
-+    if (task->receive_buf_received >= (sizeof(qgs_msg_header_t) + HEADER_SIZE)) {
-+        qgs_msg_header_t *hdr = (qgs_msg_header_t *)(task->receive_buf + HEADER_SIZE);
-+        if (hdr->major_version != QGS_MSG_LIB_MAJOR_VER ||
-+            hdr->minor_version != QGS_MSG_LIB_MINOR_VER) {
-+            error_report("Invalid QGS message header version %d.%d",
-+                         hdr->major_version,
-+                         hdr->minor_version);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+        if (hdr->type != GET_QUOTE_RESP) {
-+            error_report("Invalid QGS message type %d",
-+                         hdr->type);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+        if (hdr->size > (task->payload_len - HEADER_SIZE)) {
-+            error_report("QGS message size %d exceeds payload capacity %zu",
-+                         hdr->size, task->payload_len);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+        if (hdr->error_code != 0) {
-+            error_report("QGS message error code %d",
-+                         hdr->error_code);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+    }
-+    if (task->receive_buf_received >= (sizeof(qgs_msg_get_quote_resp_t) + HEADER_SIZE)) {
-+        qgs_msg_get_quote_resp_t *msg = (qgs_msg_get_quote_resp_t *)(task->receive_buf + HEADER_SIZE);
-+        if (msg->selected_id_size != 0) {
-+            error_report("QGS message selected ID was %d not 0",
-+                         msg->selected_id_size);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+
-+        if ((task->payload_len - HEADER_SIZE - sizeof(qgs_msg_get_quote_resp_t)) !=
-+            msg->quote_size) {
-+            error_report("QGS quote size %d should be %zu",
-+                         msg->quote_size,
-+                         (task->payload_len - sizeof(qgs_msg_get_quote_resp_t)));
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            goto end;
-+        }
-+    }
-+
-+    if (task->receive_buf_received == task->payload_len) {
-+        size_t strip = HEADER_SIZE + sizeof(qgs_msg_get_quote_resp_t);
-+        memmove(task->receive_buf,
-+                task->receive_buf + strip,
-+                task->receive_buf_received - strip);
-+        task->receive_buf_received -= strip;
-+        task->status_code = TDX_VP_GET_QUOTE_SUCCESS;
-+        goto end;
-+    }
-+
-+    return G_SOURCE_CONTINUE;
-+
-+end:
-+    tdx_generate_quote_cleanup(task);
-+    return G_SOURCE_REMOVE;
-+}
-+
-+static gboolean tdx_send_report(QIOChannel *ioc, GIOCondition condition,
-+                                gpointer opaque)
-+{
-+    TdxGenerateQuoteTask *task = opaque;
-+    Error *err = NULL;
-+    int ret;
-+
-+    ret = qio_channel_write(ioc, task->send_data + task->send_data_sent,
-+                            task->send_data_size - task->send_data_sent, &err);
-+    if (ret < 0) {
-+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
-+            ret = 0;
-+        } else {
-+            error_report_err(err);
-+            task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+            tdx_generate_quote_cleanup(task);
-+            goto end;
-+        }
-+    }
-+    task->send_data_sent += ret;
-+
-+    if (task->send_data_sent == task->send_data_size) {
-+        task->watch = qio_channel_add_watch(QIO_CHANNEL(task->sioc), G_IO_IN,
-+                                            tdx_get_quote_read, task, NULL);
-+        goto end;
-+    }
-+
-+    return G_SOURCE_CONTINUE;
-+
-+end:
-+    return G_SOURCE_REMOVE;
-+}
-+
-+static void tdx_quote_generator_connected(QIOTask *qio_task, gpointer opaque)
-+{
-+    TdxGenerateQuoteTask *task = opaque;
-+    Error *err = NULL;
-+    int ret;
-+
-+    ret = qio_task_propagate_error(qio_task, &err);
-+    if (ret) {
-+        error_report_err(err);
-+        task->status_code = TDX_VP_GET_QUOTE_QGS_UNAVAILABLE;
-+        tdx_generate_quote_cleanup(task);
-+        return;
-+    }
-+
-+    task->watch = qio_channel_add_watch(QIO_CHANNEL(task->sioc), G_IO_OUT,
-+                                        tdx_send_report, task, NULL);
-+}
-+
-+#define TRANSACTION_TIMEOUT 30000
-+
-+static void getquote_expired(void *opaque)
-+{
-+    TdxGenerateQuoteTask *task = opaque;
-+
-+    task->status_code = TDX_VP_GET_QUOTE_ERROR;
-+    tdx_generate_quote_cleanup(task);
-+}
-+
-+static void setup_get_quote_timer(TdxGenerateQuoteTask *task)
-+{
-+    int64_t time;
-+
-+    timer_init_ms(&task->timer, QEMU_CLOCK_VIRTUAL, getquote_expired, task);
-+    time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
-+    timer_mod(&task->timer, time + TRANSACTION_TIMEOUT);
-+}
-+
-+void tdx_generate_quote(TdxGenerateQuoteTask *task,
-+                        SocketAddress *qg_sock_addr)
-+{
-+    QIOChannelSocket *sioc;
-+    qgs_msg_get_quote_req_t msg;
-+
-+    /* Prepare a QGS message prelude */
-+    msg.header.major_version = QGS_MSG_LIB_MAJOR_VER;
-+    msg.header.minor_version = QGS_MSG_LIB_MINOR_VER;
-+    msg.header.type = GET_QUOTE_REQ;
-+    msg.header.size = sizeof(msg) + task->send_data_size;
-+    msg.header.error_code = 0;
-+    msg.report_size = task->send_data_size;
-+    msg.id_list_size = 0;
-+
-+    /* Make room to add the QGS message prelude */
-+    task->send_data = g_renew(char,
-+                              task->send_data,
-+                              task->send_data_size + sizeof(msg) + HEADER_SIZE);
-+    memmove(task->send_data + sizeof(msg) + HEADER_SIZE,
-+            task->send_data,
-+            task->send_data_size);
-+    memcpy(task->send_data + HEADER_SIZE,
-+           &msg,
-+           sizeof(msg));
-+    encode_header(task->send_data, HEADER_SIZE, task->send_data_size + sizeof(msg));
-+    task->send_data_size += sizeof(msg) + HEADER_SIZE;
-+
-+    sioc = qio_channel_socket_new();
-+    task->sioc = sioc;
-+
-+    setup_get_quote_timer(task);
-+
-+    qio_channel_socket_connect_async(sioc, qg_sock_addr,
-+                                     tdx_quote_generator_connected, task,
-+                                     NULL, NULL);
-+}
-diff --git a/target/i386/kvm/tdx-quote-generator.h b/target/i386/kvm/tdx-quote-generator.h
-new file mode 100644
-index 0000000000..3bd9b8ef33
---- /dev/null
-+++ b/target/i386/kvm/tdx-quote-generator.h
-@@ -0,0 +1,82 @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
-+
-+#ifndef QEMU_I386_TDX_QUOTE_GENERATOR_H
-+#define QEMU_I386_TDX_QUOTE_GENERATOR_H
-+
-+#include "qom/object_interfaces.h"
-+#include "io/channel-socket.h"
-+#include "exec/hwaddr.h"
-+
-+#define TDX_GET_QUOTE_STRUCTURE_VERSION         1ULL
-+
-+#define TDX_VP_GET_QUOTE_SUCCESS                0ULL
-+#define TDX_VP_GET_QUOTE_IN_FLIGHT              (-1ULL)
-+#define TDX_VP_GET_QUOTE_ERROR                  0x8000000000000000ULL
-+#define TDX_VP_GET_QUOTE_QGS_UNAVAILABLE        0x8000000000000001ULL
-+
-+/* Limit to avoid resource starvation. */
-+#define TDX_GET_QUOTE_MAX_BUF_LEN       (128 * 1024)
-+#define TDX_MAX_GET_QUOTE_REQUEST       16
-+
-+#define TDX_GET_QUOTE_HDR_SIZE          24
-+
-+/* Format of pages shared with guest. */
-+struct tdx_get_quote_header {
-+    /* Format version: must be 1 in little endian. */
-+    uint64_t structure_version;
-+
-+    /*
-+     * GetQuote status code in little endian:
-+     *   Guest must set error_code to 0 to avoid information leak.
-+     *   Qemu sets this before interrupting guest.
-+     */
-+    uint64_t error_code;
-+
-+    /*
-+     * in-message size in little endian: The message will follow this header.
-+     * The in-message will be send to QGS.
-+     */
-+    uint32_t in_len;
-+
-+    /*
-+     * out-message size in little endian:
-+     * On request, out_len must be zero to avoid information leak.
-+     * On return, message size from QGS. Qemu overwrites this field.
-+     * The message will follows this header.  The in-message is overwritten.
-+     */
-+    uint32_t out_len;
-+
-+    /*
-+     * Message buffer follows.
-+     * Guest sets message that will be send to QGS.  If out_len > in_len, guest
-+     * should zero remaining buffer to avoid information leak.
-+     * Qemu overwrites this buffer with a message returned from QGS.
-+     */
-+};
-+
-+typedef struct TdxGenerateQuoteTask {
-+    hwaddr buf_gpa;
-+    hwaddr payload_gpa;
-+    uint64_t payload_len;
-+
-+    char *send_data;
-+    uint64_t send_data_size;
-+    uint64_t send_data_sent;
-+
-+    char *receive_buf;
-+    uint64_t receive_buf_received;
-+
-+    uint64_t status_code;
-+    struct tdx_get_quote_header hdr;
-+
-+    QIOChannelSocket *sioc;
-+    guint watch;
-+    QEMUTimer timer;
-+
-+    void (*completion)(struct TdxGenerateQuoteTask *task);
-+    void *opaque;
-+} TdxGenerateQuoteTask;
-+
-+void tdx_generate_quote(TdxGenerateQuoteTask *task, SocketAddress *qg_sock_addr);
-+
-+#endif /* QEMU_I386_TDX_QUOTE_GENERATOR_H */
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-index 62a12a0677..76fee49eff 100644
---- a/target/i386/kvm/tdx-stub.c
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -19,6 +19,10 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
-     return -EINVAL;
- }
- 
-+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
-+{
-+}
-+
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
- {
- }
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index e0197b6582..201da78b06 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -14,12 +14,14 @@
- #include "qemu/base64.h"
- #include "qemu/mmap-alloc.h"
- #include "qapi/error.h"
-+#include "qapi/qapi-visit-sockets.h"
- #include "qom/object_interfaces.h"
- #include "crypto/hash.h"
- #include "sysemu/kvm_int.h"
- #include "sysemu/runstate.h"
- #include "sysemu/sysemu.h"
- #include "exec/ramblock.h"
-+#include "exec/address-spaces.h"
- 
- #include <linux/kvm_para.h>
- 
-@@ -32,6 +34,7 @@
- #include "hw/i386/tdvf-hob.h"
- #include "kvm_i386.h"
- #include "tdx.h"
-+#include "tdx-quote-generator.h"
- 
- #include "standard-headers/asm-x86/kvm_para.h"
- 
-@@ -1120,13 +1123,146 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
-+static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
-+{
-+    TdxGuest *tdx = task->opaque;
-+    int ret;
-+
-+    /* Maintain the number of in-flight requests. */
-+    qemu_mutex_lock(&tdx->lock);
-+    tdx->num--;
-+    qemu_mutex_unlock(&tdx->lock);
-+
-+    if (task->status_code == TDX_VP_GET_QUOTE_SUCCESS) {
-+        ret = address_space_write(&address_space_memory, task->payload_gpa,
-+                                  MEMTXATTRS_UNSPECIFIED, task->receive_buf,
-+                                  task->receive_buf_received);
-+        if (ret != MEMTX_OK) {
-+            error_report("TDX: get-quote: failed to write quote data.");
-+        } else {
-+            task->hdr.out_len = cpu_to_le64(task->receive_buf_received);
-+        }
-+    }
-+    task->hdr.error_code = cpu_to_le64(task->status_code);
-+
-+    /* Publish the response contents before marking this request completed. */
-+    smp_wmb();
-+    ret = address_space_write(&address_space_memory, task->buf_gpa,
-+                              MEMTXATTRS_UNSPECIFIED, &task->hdr,
-+                              TDX_GET_QUOTE_HDR_SIZE);
-+    if (ret != MEMTX_OK) {
-+        error_report("TDX: get-quote: failed to update GetQuote header.");
-+    }
-+
-+    g_free(task->send_data);
-+    g_free(task->receive_buf);
-+    g_free(task);
-+    object_unref(tdx);
-+}
-+
-+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
-+{
-+    TdxGenerateQuoteTask *task;
-+    struct tdx_get_quote_header hdr;
-+    hwaddr buf_gpa = run->tdx.get_quote.gpa;
-+    uint64_t buf_len = run->tdx.get_quote.size;
-+
-+    QEMU_BUILD_BUG_ON(sizeof(struct tdx_get_quote_header) != TDX_GET_QUOTE_HDR_SIZE);
-+
-+    run->tdx.get_quote.ret = TDG_VP_VMCALL_INVALID_OPERAND;
-+
-+    if (buf_len == 0) {
-+        return;
-+    }
-+
-+    if (!QEMU_IS_ALIGNED(buf_gpa, 4096) || !QEMU_IS_ALIGNED(buf_len, 4096)) {
-+        run->tdx.get_quote.ret = TDG_VP_VMCALL_ALIGN_ERROR;
-+        return;
-+    }
-+
-+    if (address_space_read(&address_space_memory, buf_gpa, MEMTXATTRS_UNSPECIFIED,
-+                           &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
-+        error_report("TDX: get-quote: failed to read GetQuote header.");
-+        return;
-+    }
-+
-+    if (le64_to_cpu(hdr.structure_version) != TDX_GET_QUOTE_STRUCTURE_VERSION) {
-+        return;
-+    }
-+
-+    /* Only safe-guard check to avoid too large buffer size. */
-+    if (buf_len > TDX_GET_QUOTE_MAX_BUF_LEN ||
-+        le32_to_cpu(hdr.in_len) > buf_len - TDX_GET_QUOTE_HDR_SIZE) {
-+        return;
-+    }
-+
-+    if (!tdx_guest->qg_sock_addr) {
-+        hdr.error_code = cpu_to_le64(TDX_VP_GET_QUOTE_QGS_UNAVAILABLE);
-+        if (address_space_write(&address_space_memory, buf_gpa,
-+                                MEMTXATTRS_UNSPECIFIED,
-+                                &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
-+            error_report("TDX: failed to update GetQuote header.");
-+            return;
-+        }
-+        run->tdx.get_quote.ret = TDG_VP_VMCALL_SUCCESS;
-+        return;
-+    }
-+
-+    qemu_mutex_lock(&tdx_guest->lock);
-+    if (tdx_guest->num >= TDX_MAX_GET_QUOTE_REQUEST) {
-+        qemu_mutex_unlock(&tdx_guest->lock);
-+        run->tdx.get_quote.ret = TDG_VP_VMCALL_RETRY;
-+        return;
-+    }
-+    tdx_guest->num++;
-+    qemu_mutex_unlock(&tdx_guest->lock);
-+
-+    task = g_new(TdxGenerateQuoteTask, 1);
-+    task->buf_gpa = buf_gpa;
-+    task->payload_gpa = buf_gpa + TDX_GET_QUOTE_HDR_SIZE;
-+    task->payload_len = buf_len - TDX_GET_QUOTE_HDR_SIZE;
-+    task->hdr = hdr;
-+    task->completion = tdx_get_quote_completion;
-+
-+    task->send_data_size = le32_to_cpu(hdr.in_len);
-+    task->send_data = g_malloc(task->send_data_size);
-+    task->send_data_sent = 0;
-+
-+    if (address_space_read(&address_space_memory, task->payload_gpa,
-+                           MEMTXATTRS_UNSPECIFIED, task->send_data,
-+                           task->send_data_size) != MEMTX_OK) {
-+        goto out_free;
-+    }
-+
-+    /* Mark the buffer in-flight. */
-+    hdr.error_code = cpu_to_le64(TDX_VP_GET_QUOTE_IN_FLIGHT);
-+    if (address_space_write(&address_space_memory, buf_gpa,
-+                            MEMTXATTRS_UNSPECIFIED,
-+                            &hdr, TDX_GET_QUOTE_HDR_SIZE) != MEMTX_OK) {
-+        goto out_free;
-+    }
-+
-+    task->receive_buf = g_malloc0(task->payload_len);
-+    task->receive_buf_received = 0;
-+    task->opaque = tdx_guest;
-+
-+    object_ref(tdx_guest);
-+    tdx_generate_quote(task, tdx_guest->qg_sock_addr);
-+    run->tdx.get_quote.ret = TDG_VP_VMCALL_SUCCESS;
-+    return;
-+
-+out_free:
-+    g_free(task->send_data);
-+    g_free(task);
-+}
-+
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
- {
-     if (run->tdx.get_tdvmcall_info.leaf != 1) {
- 	return;
-     }
- 
--    run->tdx.get_tdvmcall_info.r11 = 0;
-+    run->tdx.get_tdvmcall_info.r11 = TDG_VP_VMCALL_SUBFUNC_GET_QUOTE;
-     run->tdx.get_tdvmcall_info.r12 = 0;
-     run->tdx.get_tdvmcall_info.r13 = 0;
-     run->tdx.get_tdvmcall_info.r14 = 0;
-@@ -1263,6 +1399,37 @@ static void tdx_guest_set_mrownerconfig(Object *obj, const char *value, Error **
-     tdx->mrownerconfig = g_strdup(value);
- }
- 
-+static void tdx_guest_get_qgs(Object *obj, Visitor *v,
-+                              const char *name, void *opaque,
-+                              Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+
-+    if (!tdx->qg_sock_addr) {
-+        error_setg(errp, "quote-generation-socket is not set");
-+        return;
-+    }
-+    visit_type_SocketAddress(v, name, &tdx->qg_sock_addr, errp);
-+}
-+
-+static void tdx_guest_set_qgs(Object *obj, Visitor *v,
-+                              const char *name, void *opaque,
-+                              Error **errp)
-+{
-+    TdxGuest *tdx = TDX_GUEST(obj);
-+    SocketAddress *sock = NULL;
-+
-+    if (!visit_type_SocketAddress(v, name, &sock, errp)) {
-+        return;
-+    }
-+
-+    if (tdx->qg_sock_addr) {
-+        qapi_free_SocketAddress(tdx->qg_sock_addr);
-+    }
-+
-+    tdx->qg_sock_addr = sock;
-+}
-+
- /* tdx guest */
- OBJECT_DEFINE_TYPE_WITH_INTERFACES(TdxGuest,
-                                    tdx_guest,
-@@ -1294,6 +1461,13 @@ static void tdx_guest_init(Object *obj)
-     object_property_add_str(obj, "mrownerconfig",
-                             tdx_guest_get_mrownerconfig,
-                             tdx_guest_set_mrownerconfig);
-+
-+    object_property_add(obj, "quote-generation-socket", "SocketAddress",
-+                            tdx_guest_get_qgs,
-+                            tdx_guest_set_qgs,
-+                            NULL, NULL);
-+
-+    qemu_mutex_init(&tdx->lock);
- }
- 
- static void tdx_guest_finalize(Object *obj)
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 0dd41d5811..35a09c19c5 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -11,6 +11,8 @@
- #include "cpu.h"
- #include "hw/i386/tdvf.h"
- 
-+#include "tdx-quote-generator.h"
-+
- #define TYPE_TDX_GUEST "tdx-guest"
- #define TDX_GUEST(obj)  OBJECT_CHECK(TdxGuest, (obj), TYPE_TDX_GUEST)
- 
-@@ -22,6 +24,7 @@ typedef struct TdxGuestClass {
- #define TDX_APIC_BUS_CYCLES_NS 40
- 
- #define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
-+#define TDVMCALL_GET_QUOTE		 0x10002
- 
- #define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
- #define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
-@@ -29,6 +32,8 @@ typedef struct TdxGuestClass {
- #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
- #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
- 
-+#define TDG_VP_VMCALL_SUBFUNC_GET_QUOTE 0x0000000000000001ULL
-+
- enum TdxRamType {
-     TDX_RAM_UNACCEPTED,
-     TDX_RAM_ADDED,
-@@ -57,6 +62,10 @@ typedef struct TdxGuest {
- 
-     uint32_t nr_ram_entries;
-     TdxRamEntry *ram_entries;
-+
-+    /* GetQuote */
-+    SocketAddress *qg_sock_addr;
-+    int num;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
-@@ -69,6 +78,7 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
- void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
- int tdx_parse_tdvf(void *flash_ptr, int size);
- int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
-+void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run);
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch b/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch
deleted file mode 100644
index 9205f08..0000000
--- a/kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-From 432fbc1dacdb5de4fb3af42e21749c53cd26a855 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 092/115] i386/tdx: handle TDG.VP.VMCALL<GetTdVmCallInfo>
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [92/115] 443c167d16e725f756cab6371aad04b7c2b4f15a (bonzini/rhel-qemu-kvm)
-
-Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 427b8cf47a6959cd8b0db12bcf66e9009afa2c07)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c      | 12 ++++++++++++
- target/i386/kvm/tdx-stub.c |  4 ++++
- target/i386/kvm/tdx.c      | 12 ++++++++++++
- target/i386/kvm/tdx.h      |  9 +++++++++
- 4 files changed, 37 insertions(+)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index b6fddcd543..26328a1d3b 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -6039,6 +6039,18 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-             break;
-         }
-         break;
-+    case KVM_EXIT_TDX:
-+        /*
-+         * run->tdx is already set up for the case where userspace
-+         * does not handle the TDVMCALL.
-+         */
-+        switch (run->tdx.nr) {
-+        case TDVMCALL_GET_TD_VM_CALL_INFO:
-+            tdx_handle_get_tdvmcall_info(cpu, run);
-+            break;
-+        }
-+        ret = 0;
-+        break;
-     default:
-         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
-         ret = -1;
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-index 720a4ff046..62a12a0677 100644
---- a/target/i386/kvm/tdx-stub.c
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -18,3 +18,7 @@ int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run)
- {
-     return -EINVAL;
- }
-+
-+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
-+{
-+}
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index ed3a55991a..e0197b6582 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1120,6 +1120,18 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
-+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
-+{
-+    if (run->tdx.get_tdvmcall_info.leaf != 1) {
-+	return;
-+    }
-+
-+    run->tdx.get_tdvmcall_info.r11 = 0;
-+    run->tdx.get_tdvmcall_info.r12 = 0;
-+    run->tdx.get_tdvmcall_info.r13 = 0;
-+    run->tdx.get_tdvmcall_info.r14 = 0;
-+}
-+
- static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-                                         char *message, uint64_t gpa)
- {
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index 8dd66e9014..0dd41d5811 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -21,6 +21,14 @@ typedef struct TdxGuestClass {
- /* TDX requires bus frequency 25MHz */
- #define TDX_APIC_BUS_CYCLES_NS 40
- 
-+#define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
-+
-+#define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
-+#define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
-+#define TDG_VP_VMCALL_INVALID_OPERAND   0x8000000000000000ULL
-+#define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
-+#define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
-+
- enum TdxRamType {
-     TDX_RAM_UNACCEPTED,
-     TDX_RAM_ADDED,
-@@ -61,5 +69,6 @@ int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
- void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
- int tdx_parse_tdvf(void *flash_ptr, int size);
- int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
-+void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch b/kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch
deleted file mode 100644
index e1bafaa..0000000
--- a/kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch
+++ /dev/null
@@ -1,197 +0,0 @@
-From e2157a814aa2a700736e97d2548460e9c6c808f2 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 101/115] i386/tdx: handle
- TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [101/115] 747409544735f7e2da43ce3906c0d0d487b5d78f (bonzini/rhel-qemu-kvm)
-
-Record the interrupt vector and the apic id of the vcpu that calls
-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT.
-
-Inject the interrupt to TD guest to notify the completion of <GetQuote>
-when notify interrupt vector is valid.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250703024021.3559286-5-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit efa742b23eff2a799c196d756bd506fe74e96fdc)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c      |  3 +++
- target/i386/kvm/tdx-stub.c |  4 ++++
- target/i386/kvm/tdx.c      | 48 +++++++++++++++++++++++++++++++++++++-
- target/i386/kvm/tdx.h      |  7 ++++++
- 4 files changed, 61 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index fbf11b2122..f789965a33 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -6051,6 +6051,9 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-         case TDVMCALL_GET_TD_VM_CALL_INFO:
-             tdx_handle_get_tdvmcall_info(cpu, run);
-             break;
-+        case TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT:
-+            tdx_handle_setup_event_notify_interrupt(cpu, run);
-+            break;
-         }
-         ret = 0;
-         break;
-diff --git a/target/i386/kvm/tdx-stub.c b/target/i386/kvm/tdx-stub.c
-index 76fee49eff..1f0e108a69 100644
---- a/target/i386/kvm/tdx-stub.c
-+++ b/target/i386/kvm/tdx-stub.c
-@@ -26,3 +26,7 @@ void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run)
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
- {
- }
-+
-+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
-+{
-+}
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index a24e15571a..e56db74f58 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -28,10 +28,13 @@
- #include "cpu.h"
- #include "cpu-internal.h"
- #include "host-cpu.h"
-+#include "hw/i386/apic_internal.h"
-+#include "hw/i386/apic-msidef.h"
- #include "hw/i386/e820_memory_layout.h"
- #include "hw/i386/tdvf.h"
- #include "hw/i386/x86.h"
- #include "hw/i386/tdvf-hob.h"
-+#include "hw/pci/msi.h"
- #include "kvm_i386.h"
- #include "tdx.h"
- #include "tdx-quote-generator.h"
-@@ -1123,6 +1126,28 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
-+static void tdx_inject_interrupt(uint32_t apicid, uint32_t vector)
-+{
-+    int ret;
-+
-+    if (vector < 32 || vector > 255) {
-+        return;
-+    }
-+
-+    MSIMessage msg = {
-+        .address = ((apicid & 0xff) << MSI_ADDR_DEST_ID_SHIFT) |
-+                   (((uint64_t)apicid & 0xffffff00) << 32),
-+        .data = vector | (APIC_DM_FIXED << MSI_DATA_DELIVERY_MODE_SHIFT),
-+    };
-+
-+    ret = kvm_irqchip_send_msi(kvm_state, msg);
-+    if (ret < 0) {
-+        /* In this case, no better way to tell it to guest. Log it. */
-+        error_report("TDX: injection interrupt %d failed, interrupt lost (%s).",
-+                     vector, strerror(-ret));
-+    }
-+}
-+
- static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
- {
-     TdxGuest *tdx = task->opaque;
-@@ -1154,6 +1179,9 @@ static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
-         error_report("TDX: get-quote: failed to update GetQuote header.");
-     }
- 
-+    tdx_inject_interrupt(tdx_guest->event_notify_apicid,
-+                         tdx_guest->event_notify_vector);
-+
-     g_free(task->send_data);
-     g_free(task->receive_buf);
-     g_free(task);
-@@ -1256,7 +1284,7 @@ out_free:
-     g_free(task);
- }
- 
--#define SUPPORTED_TDVMCALLINFO_1_R11    (0)
-+#define SUPPORTED_TDVMCALLINFO_1_R11    (TDG_VP_VMCALL_SUBFUNC_SET_EVENT_NOTIFY_INTERRUPT)
- #define SUPPORTED_TDVMCALLINFO_1_R12    (0)
- 
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
-@@ -1277,6 +1305,21 @@ void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run)
-     run->tdx.get_tdvmcall_info.ret = TDG_VP_VMCALL_SUCCESS;
- }
- 
-+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run)
-+{
-+    uint64_t vector = run->tdx.setup_event_notify.vector;
-+
-+    if (vector >= 32 && vector < 256) {
-+        qemu_mutex_lock(&tdx_guest->lock);
-+        tdx_guest->event_notify_vector = vector;
-+        tdx_guest->event_notify_apicid = cpu->apic_id;
-+        qemu_mutex_unlock(&tdx_guest->lock);
-+        run->tdx.setup_event_notify.ret = TDG_VP_VMCALL_SUCCESS;
-+    } else {
-+        run->tdx.setup_event_notify.ret = TDG_VP_VMCALL_INVALID_OPERAND;
-+    }
-+}
-+
- static void tdx_panicked_on_fatal_error(X86CPU *cpu, uint64_t error_code,
-                                         char *message, uint64_t gpa)
- {
-@@ -1477,6 +1520,9 @@ static void tdx_guest_init(Object *obj)
-                             NULL, NULL);
- 
-     qemu_mutex_init(&tdx->lock);
-+
-+    tdx->event_notify_vector = -1;
-+    tdx->event_notify_apicid = -1;
- }
- 
- static void tdx_guest_finalize(Object *obj)
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index d439078a87..1c38faf983 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -25,6 +25,7 @@ typedef struct TdxGuestClass {
- 
- #define TDVMCALL_GET_TD_VM_CALL_INFO    0x10000
- #define TDVMCALL_GET_QUOTE		 0x10002
-+#define TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT   0x10004
- 
- #define TDG_VP_VMCALL_SUCCESS           0x0000000000000000ULL
- #define TDG_VP_VMCALL_RETRY             0x0000000000000001ULL
-@@ -32,6 +33,8 @@ typedef struct TdxGuestClass {
- #define TDG_VP_VMCALL_GPA_INUSE         0x8000000000000001ULL
- #define TDG_VP_VMCALL_ALIGN_ERROR       0x8000000000000002ULL
- 
-+#define TDG_VP_VMCALL_SUBFUNC_SET_EVENT_NOTIFY_INTERRUPT BIT_ULL(1)
-+
- enum TdxRamType {
-     TDX_RAM_UNACCEPTED,
-     TDX_RAM_ADDED,
-@@ -64,6 +67,9 @@ typedef struct TdxGuest {
-     /* GetQuote */
-     SocketAddress *qg_sock_addr;
-     int num;
-+
-+    uint32_t event_notify_vector;
-+    uint32_t event_notify_apicid;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
-@@ -78,5 +84,6 @@ int tdx_parse_tdvf(void *flash_ptr, int size);
- int tdx_handle_report_fatal_error(X86CPU *cpu, struct kvm_run *run);
- void tdx_handle_get_quote(X86CPU *cpu, struct kvm_run *run);
- void tdx_handle_get_tdvmcall_info(X86CPU *cpu, struct kvm_run *run);
-+void tdx_handle_setup_event_notify_interrupt(X86CPU *cpu, struct kvm_run *run);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-implement-tdx_cpu_instance_init.patch b/kvm-i386-tdx-implement-tdx_cpu_instance_init.patch
deleted file mode 100644
index 5b1fc65..0000000
--- a/kvm-i386-tdx-implement-tdx_cpu_instance_init.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 99563f467faeace2726e62292b128faf3fb56fcb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 061/115] i386/tdx: implement tdx_cpu_instance_init()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [61/115] 20d53c1ff1d645a043cac27f33f9778732c1469e (bonzini/rhel-qemu-kvm)
-
-Currently, pmu is not supported for TDX by KVM.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-33-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 7c615242671dbe65e198c20889dcaa9b4b9a1624)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 7611f51aae..afd7e62422 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -398,6 +398,11 @@ static int tdx_kvm_type(X86ConfidentialGuest *cg)
-     return KVM_X86_TDX_VM;
- }
- 
-+static void tdx_cpu_instance_init(X86ConfidentialGuest *cg, CPUState *cpu)
-+{
-+    object_property_set_bool(OBJECT(cpu), "pmu", false, &error_abort);
-+}
-+
- static int tdx_validate_attributes(TdxGuest *tdx, Error **errp)
- {
-     if ((tdx->attributes & ~tdx_caps->supported_attrs)) {
-@@ -791,4 +796,5 @@ static void tdx_guest_class_init(ObjectClass *oc, void *data)
- 
-     klass->kvm_init = tdx_kvm_init;
-     x86_klass->kvm_type = tdx_kvm_type;
-+    x86_klass->cpu_instance_init = tdx_cpu_instance_init;
- }
--- 
-2.50.1
-
diff --git a/kvm-i386-tdx-load-TDVF-for-TD-guest.patch b/kvm-i386-tdx-load-TDVF-for-TD-guest.patch
deleted file mode 100644
index 0e0b11f..0000000
--- a/kvm-i386-tdx-load-TDVF-for-TD-guest.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 69a39313aa07e1e4845e53e34a6b866395863c73 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:46 +0200
-Subject: [PATCH 045/115] i386/tdx: load TDVF for TD guest
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [45/115] cdf138cb88831b4c28f78cd9ad72d75465a731cf (bonzini/rhel-qemu-kvm)
-
-TDVF(OVMF) needs to run at private memory for TD guest. TDX cannot
-support pflash device since it doesn't support read-only private memory.
-Thus load TDVF(OVMF) with -bios option for TDs.
-
-Use memory_region_init_ram_guest_memfd() to allocate the MemoryRegion
-for TDVF because it needs to be located at private memory.
-
-Also store the MemoryRegion pointer of TDVF since the shared ramblock of
-it can be discared after it gets copied to private ramblock.
-
-Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
-Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-17-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0dd5fe5ebeabefc7b3d7f043991b1edfe6b8eda9)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/x86-common.c  | 6 +++++-
- target/i386/kvm/tdx.c | 6 ++++++
- target/i386/kvm/tdx.h | 3 +++
- 3 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
-index 562215990d..97cd84d618 100644
---- a/hw/i386/x86-common.c
-+++ b/hw/i386/x86-common.c
-@@ -44,6 +44,7 @@
- #include "standard-headers/asm-x86/bootparam.h"
- #include CONFIG_DEVICES
- #include "kvm/kvm_i386.h"
-+#include "kvm/tdx.h"
- 
- #ifdef CONFIG_XEN_EMU
- #include "hw/xen/xen.h"
-@@ -1003,11 +1004,14 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
-     if (machine_require_guest_memfd(MACHINE(x86ms))) {
-         memory_region_init_ram_guest_memfd(&x86ms->bios, NULL, "pc.bios",
-                                            bios_size, &error_fatal);
-+        if (is_tdx_vm()) {
-+            tdx_set_tdvf_region(&x86ms->bios);
-+        }
-     } else {
-         memory_region_init_ram(&x86ms->bios, NULL, "pc.bios",
-                                bios_size, &error_fatal);
-     }
--    if (sev_enabled()) {
-+    if (sev_enabled() || is_tdx_vm()) {
-         /*
-          * The concept of a "reset" simply doesn't exist for
-          * confidential computing guests, we have to destroy and
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 56ad5f599d..2522f2030d 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -137,6 +137,12 @@ static int get_tdx_capabilities(Error **errp)
-     return 0;
- }
- 
-+void tdx_set_tdvf_region(MemoryRegion *tdvf_mr)
-+{
-+    assert(!tdx_guest->tdvf_mr);
-+    tdx_guest->tdvf_mr = tdvf_mr;
-+}
-+
- static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
- {
-     TdxGuest *tdx = TDX_GUEST(cgs);
-diff --git a/target/i386/kvm/tdx.h b/target/i386/kvm/tdx.h
-index d39e733d9f..b73461b8d8 100644
---- a/target/i386/kvm/tdx.h
-+++ b/target/i386/kvm/tdx.h
-@@ -30,6 +30,8 @@ typedef struct TdxGuest {
-     char *mrconfigid;       /* base64 encoded sha348 digest */
-     char *mrowner;          /* base64 encoded sha348 digest */
-     char *mrownerconfig;    /* base64 encoded sha348 digest */
-+
-+    MemoryRegion *tdvf_mr;
- } TdxGuest;
- 
- #ifdef CONFIG_TDX
-@@ -39,5 +41,6 @@ bool is_tdx_vm(void);
- #endif /* CONFIG_TDX */
- 
- int tdx_pre_create_vcpu(CPUState *cpu, Error **errp);
-+void tdx_set_tdvf_region(MemoryRegion *tdvf_mr);
- 
- #endif /* QEMU_I386_TDX_H */
--- 
-2.50.1
-
diff --git a/kvm-i386-topology-Introduce-helpers-for-various-topology.patch b/kvm-i386-topology-Introduce-helpers-for-various-topology.patch
deleted file mode 100644
index 49a2d4e..0000000
--- a/kvm-i386-topology-Introduce-helpers-for-various-topology.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 693fa1348914dfa37ce5fa4a654e67d573e4941a Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 011/115] i386/topology: Introduce helpers for various topology
- info of different level
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [11/115] 52179ff6718bd4bfd9eac78efd20e7e5337d3b07 (bonzini/rhel-qemu-kvm)
-
-Introduce various helpers for getting the topology info of different
-semantics. Using the helper is more self-explanatory.
-
-Besides, the semantic of the helper will stay unchanged even when new
-topology is added in the future. At that time, updating the
-implementation of the helper without affecting the callers.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-6-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e60cbeec190d349682bf97cf55446e8ae260b11a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 12b80c6f6e6edf61c998aa5bac9d0c44a81144a0)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/hw/i386/topology.h | 25 +++++++++++++++++++++++++
- target/i386/cpu.c          | 11 ++++-------
- 2 files changed, 29 insertions(+), 7 deletions(-)
-
-diff --git a/include/hw/i386/topology.h b/include/hw/i386/topology.h
-index 1880df621a..e533a117c3 100644
---- a/include/hw/i386/topology.h
-+++ b/include/hw/i386/topology.h
-@@ -217,4 +217,29 @@ static inline bool x86_has_extended_topo(unsigned long *topo_bitmap)
-            test_bit(CPU_TOPO_LEVEL_DIE, topo_bitmap);
- }
- 
-+static inline unsigned x86_module_per_pkg(X86CPUTopoInfo *topo_info)
-+{
-+    return topo_info->modules_per_die * topo_info->dies_per_pkg;
-+}
-+
-+static inline unsigned x86_cores_per_pkg(X86CPUTopoInfo *topo_info)
-+{
-+    return topo_info->cores_per_module * x86_module_per_pkg(topo_info);
-+}
-+
-+static inline unsigned x86_threads_per_pkg(X86CPUTopoInfo *topo_info)
-+{
-+    return topo_info->threads_per_core * x86_cores_per_pkg(topo_info);
-+}
-+
-+static inline unsigned x86_threads_per_module(X86CPUTopoInfo *topo_info)
-+{
-+    return topo_info->threads_per_core * topo_info->cores_per_module;
-+}
-+
-+static inline unsigned x86_threads_per_die(X86CPUTopoInfo *topo_info)
-+{
-+    return x86_threads_per_module(topo_info) * topo_info->modules_per_die;
-+}
-+
- #endif /* HW_I386_TOPOLOGY_H */
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index b639769ef3..1c79eb9a06 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -312,13 +312,11 @@ static uint32_t num_threads_by_topo_level(X86CPUTopoInfo *topo_info,
-     case CPU_TOPO_LEVEL_CORE:
-         return topo_info->threads_per_core;
-     case CPU_TOPO_LEVEL_MODULE:
--        return topo_info->threads_per_core * topo_info->cores_per_module;
-+        return x86_threads_per_module(topo_info);
-     case CPU_TOPO_LEVEL_DIE:
--        return topo_info->threads_per_core * topo_info->cores_per_module *
--               topo_info->modules_per_die;
-+        return x86_threads_per_die(topo_info);
-     case CPU_TOPO_LEVEL_PACKAGE:
--        return topo_info->threads_per_core * topo_info->cores_per_module *
--               topo_info->modules_per_die * topo_info->dies_per_pkg;
-+        return x86_threads_per_pkg(topo_info);
-     default:
-         g_assert_not_reached();
-     }
-@@ -6957,8 +6955,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-     topo_info.cores_per_module = cs->nr_cores / env->nr_dies / env->nr_modules;
-     topo_info.threads_per_core = cs->nr_threads;
- 
--    threads_per_pkg = topo_info.threads_per_core * topo_info.cores_per_module *
--                      topo_info.modules_per_die * topo_info.dies_per_pkg;
-+    threads_per_pkg = x86_threads_per_pkg(&topo_info);
- 
-     /* Calculate & apply limits for different index ranges */
-     if (index >= 0xC0000000) {
--- 
-2.50.1
-
diff --git a/kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch b/kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch
deleted file mode 100644
index 090a4c7..0000000
--- a/kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 544ec72c98bdb325589cf9cddc7356ce5d4ae586 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 010/115] i386/topology: Update the comment of
- x86_apicid_from_topo_ids()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [10/115] 62641dcd4cb51e9d252e4d5b3257ac87cfb165c0 (bonzini/rhel-qemu-kvm)
-
-Update the comment of x86_apicid_from_topo_ids() to match the current
-implementation,
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241219110125.1266461-5-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 8f78378de70fc79fdc7e1318496bd91ddd22df49)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a4452a3e65f1fdbbafd22e9089864d37d323d7e0)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/hw/i386/topology.h | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/include/hw/i386/topology.h b/include/hw/i386/topology.h
-index dff49fce11..1880df621a 100644
---- a/include/hw/i386/topology.h
-+++ b/include/hw/i386/topology.h
-@@ -135,9 +135,10 @@ static inline unsigned apicid_pkg_offset(X86CPUTopoInfo *topo_info)
- }
- 
- /*
-- * Make APIC ID for the CPU based on Pkg_ID, Core_ID, SMT_ID
-+ * Make APIC ID for the CPU based on topology and IDs of each topology level.
-  *
-- * The caller must make sure core_id < nr_cores and smt_id < nr_threads.
-+ * The caller must make sure the ID of each level doesn't exceed the width of
-+ * the level.
-  */
- static inline apic_id_t x86_apicid_from_topo_ids(X86CPUTopoInfo *topo_info,
-                                                  const X86CPUTopoIDs *topo_ids)
--- 
-2.50.1
-
diff --git a/kvm-include-hw-s390x-Add-include-files-for-common-IPL-st.patch b/kvm-include-hw-s390x-Add-include-files-for-common-IPL-st.patch
deleted file mode 100644
index 944c549..0000000
--- a/kvm-include-hw-s390x-Add-include-files-for-common-IPL-st.patch
+++ /dev/null
@@ -1,402 +0,0 @@
-From 40b5689f28e6fef2dfdd0269639c8556200458a3 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:47 -0400
-Subject: [PATCH 14/27] include/hw/s390x: Add include files for common IPL
- structs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [14/23] 632d18ef238ded324c962855edb77e3d3f0b4eae (thuth/qemu-kvm-cs9)
-
-Currently, structures defined in both hw/s390x/ipl.h and pc-bios/s390-ccw/iplb.h
-must be kept in sync, which is prone to error. Instead, create a new directory
-at include/hw/s390x/ipl/ to contain the definitions that must be shared.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-14-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit ba3658adc80a9370257a9c4e114829ec691311e3)
----
- hw/s390x/ipl.h              | 104 +-----------------------------
- include/hw/s390x/ipl/qipl.h | 123 ++++++++++++++++++++++++++++++++++++
- pc-bios/s390-ccw/Makefile   |   2 +-
- pc-bios/s390-ccw/iplb.h     |  84 ++----------------------
- 4 files changed, 130 insertions(+), 183 deletions(-)
- create mode 100644 include/hw/s390x/ipl/qipl.h
-
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index b2105b616a..fa394c339d 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -16,95 +16,11 @@
- #include "cpu.h"
- #include "exec/address-spaces.h"
- #include "hw/qdev-core.h"
-+#include "hw/s390x/ipl/qipl.h"
- #include "qom/object.h"
- 
--struct IPLBlockPVComp {
--    uint64_t tweak_pref;
--    uint64_t addr;
--    uint64_t size;
--} QEMU_PACKED;
--typedef struct IPLBlockPVComp IPLBlockPVComp;
--
--struct IPLBlockPV {
--    uint8_t  reserved18[87];    /* 0x18 */
--    uint8_t  version;           /* 0x6f */
--    uint32_t reserved70;        /* 0x70 */
--    uint32_t num_comp;          /* 0x74 */
--    uint64_t pv_header_addr;    /* 0x78 */
--    uint64_t pv_header_len;     /* 0x80 */
--    struct IPLBlockPVComp components[0];
--} QEMU_PACKED;
--typedef struct IPLBlockPV IPLBlockPV;
--
--struct IplBlockCcw {
--    uint8_t  reserved0[85];
--    uint8_t  ssid;
--    uint16_t devno;
--    uint8_t  vm_flags;
--    uint8_t  reserved3[3];
--    uint32_t vm_parm_len;
--    uint8_t  nss_name[8];
--    uint8_t  vm_parm[64];
--    uint8_t  reserved4[8];
--} QEMU_PACKED;
--typedef struct IplBlockCcw IplBlockCcw;
--
--struct IplBlockFcp {
--    uint8_t  reserved1[305 - 1];
--    uint8_t  opt;
--    uint8_t  reserved2[3];
--    uint16_t reserved3;
--    uint16_t devno;
--    uint8_t  reserved4[4];
--    uint64_t wwpn;
--    uint64_t lun;
--    uint32_t bootprog;
--    uint8_t  reserved5[12];
--    uint64_t br_lba;
--    uint32_t scp_data_len;
--    uint8_t  reserved6[260];
--    uint8_t  scp_data[0];
--} QEMU_PACKED;
--typedef struct IplBlockFcp IplBlockFcp;
--
--struct IplBlockQemuScsi {
--    uint32_t lun;
--    uint16_t target;
--    uint16_t channel;
--    uint8_t  reserved0[77];
--    uint8_t  ssid;
--    uint16_t devno;
--} QEMU_PACKED;
--typedef struct IplBlockQemuScsi IplBlockQemuScsi;
--
- #define DIAG308_FLAGS_LP_VALID 0x80
- 
--union IplParameterBlock {
--    struct {
--        uint32_t len;
--        uint8_t  reserved0[3];
--        uint8_t  version;
--        uint32_t blk0_len;
--        uint8_t  pbt;
--        uint8_t  flags;
--        uint16_t reserved01;
--        uint8_t  loadparm[8];
--        union {
--            IplBlockCcw ccw;
--            IplBlockFcp fcp;
--            IPLBlockPV pv;
--            IplBlockQemuScsi scsi;
--        };
--    } QEMU_PACKED;
--    struct {
--        uint8_t  reserved1[110];
--        uint16_t devno;
--        uint8_t  reserved2[88];
--        uint8_t  reserved_ext[4096 - 200];
--    } QEMU_PACKED;
--} QEMU_PACKED;
--typedef union IplParameterBlock IplParameterBlock;
--
- int s390_ipl_set_loadparm(uint8_t *loadparm);
- void s390_ipl_update_diag308(IplParameterBlock *iplb);
- int s390_ipl_prepare_pv_header(Error **errp);
-@@ -131,24 +47,6 @@ void s390_ipl_clear_reset_request(void);
- #define QIPL_FLAG_BM_OPTS_CMD   0x80
- #define QIPL_FLAG_BM_OPTS_ZIPL  0x40
- 
--/*
-- * The QEMU IPL Parameters will be stored at absolute address
-- * 204 (0xcc) which means it is 32-bit word aligned but not
-- * double-word aligned. Placement of 64-bit data fields in this
-- * area must account for their alignment needs.
-- * The total size of the struct must never exceed 28 bytes.
-- * This definition must be kept in sync with the definition
-- * in pc-bios/s390-ccw/iplb.h.
-- */
--struct QemuIplParameters {
--    uint8_t  qipl_flags;
--    uint8_t  reserved1[3];
--    uint64_t reserved2;
--    uint32_t boot_menu_timeout;
--    uint8_t  reserved3[12];
--} QEMU_PACKED;
--typedef struct QemuIplParameters QemuIplParameters;
--
- #define TYPE_S390_IPL "s390-ipl"
- OBJECT_DECLARE_SIMPLE_TYPE(S390IPLState, S390_IPL)
- 
-diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h
-new file mode 100644
-index 0000000000..0ef04af027
---- /dev/null
-+++ b/include/hw/s390x/ipl/qipl.h
-@@ -0,0 +1,123 @@
-+/*
-+ * S/390 boot structures
-+ *
-+ * Copyright 2024 IBM Corp.
-+ * Author(s): Jared Rossi <jrossi@linux.ibm.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
-+ * your option) any later version. See the COPYING file in the top-level
-+ * directory.
-+ */
-+
-+#ifndef S390X_QIPL_H
-+#define S390X_QIPL_H
-+
-+/* Boot Menu flags */
-+#define QIPL_FLAG_BM_OPTS_CMD   0x80
-+#define QIPL_FLAG_BM_OPTS_ZIPL  0x40
-+
-+#define QIPL_ADDRESS  0xcc
-+#define LOADPARM_LEN    8
-+
-+/*
-+ * The QEMU IPL Parameters will be stored at absolute address
-+ * 204 (0xcc) which means it is 32-bit word aligned but not
-+ * double-word aligned. Placement of 64-bit data fields in this
-+ * area must account for their alignment needs.
-+ * The total size of the struct must never exceed 28 bytes.
-+ */
-+struct QemuIplParameters {
-+    uint8_t  qipl_flags;
-+    uint8_t  reserved1[3];
-+    uint64_t reserved2;
-+    uint32_t boot_menu_timeout;
-+    uint8_t  reserved3[12];
-+} QEMU_PACKED;
-+typedef struct QemuIplParameters QemuIplParameters;
-+
-+struct IPLBlockPVComp {
-+    uint64_t tweak_pref;
-+    uint64_t addr;
-+    uint64_t size;
-+} QEMU_PACKED;
-+typedef struct IPLBlockPVComp IPLBlockPVComp;
-+
-+struct IPLBlockPV {
-+    uint8_t  reserved18[87];    /* 0x18 */
-+    uint8_t  version;           /* 0x6f */
-+    uint32_t reserved70;        /* 0x70 */
-+    uint32_t num_comp;          /* 0x74 */
-+    uint64_t pv_header_addr;    /* 0x78 */
-+    uint64_t pv_header_len;     /* 0x80 */
-+    struct IPLBlockPVComp components[0];
-+} QEMU_PACKED;
-+typedef struct IPLBlockPV IPLBlockPV;
-+
-+struct IplBlockCcw {
-+    uint8_t  reserved0[85];
-+    uint8_t  ssid;
-+    uint16_t devno;
-+    uint8_t  vm_flags;
-+    uint8_t  reserved3[3];
-+    uint32_t vm_parm_len;
-+    uint8_t  nss_name[8];
-+    uint8_t  vm_parm[64];
-+    uint8_t  reserved4[8];
-+} QEMU_PACKED;
-+typedef struct IplBlockCcw IplBlockCcw;
-+
-+struct IplBlockFcp {
-+    uint8_t  reserved1[305 - 1];
-+    uint8_t  opt;
-+    uint8_t  reserved2[3];
-+    uint16_t reserved3;
-+    uint16_t devno;
-+    uint8_t  reserved4[4];
-+    uint64_t wwpn;
-+    uint64_t lun;
-+    uint32_t bootprog;
-+    uint8_t  reserved5[12];
-+    uint64_t br_lba;
-+    uint32_t scp_data_len;
-+    uint8_t  reserved6[260];
-+    uint8_t  scp_data[0];
-+} QEMU_PACKED;
-+typedef struct IplBlockFcp IplBlockFcp;
-+
-+struct IplBlockQemuScsi {
-+    uint32_t lun;
-+    uint16_t target;
-+    uint16_t channel;
-+    uint8_t  reserved0[77];
-+    uint8_t  ssid;
-+    uint16_t devno;
-+} QEMU_PACKED;
-+typedef struct IplBlockQemuScsi IplBlockQemuScsi;
-+
-+union IplParameterBlock {
-+    struct {
-+        uint32_t len;
-+        uint8_t  reserved0[3];
-+        uint8_t  version;
-+        uint32_t blk0_len;
-+        uint8_t  pbt;
-+        uint8_t  flags;
-+        uint16_t reserved01;
-+        uint8_t  loadparm[LOADPARM_LEN];
-+        union {
-+            IplBlockCcw ccw;
-+            IplBlockFcp fcp;
-+            IPLBlockPV pv;
-+            IplBlockQemuScsi scsi;
-+        };
-+    } QEMU_PACKED;
-+    struct {
-+        uint8_t  reserved1[110];
-+        uint16_t devno;
-+        uint8_t  reserved2[88];
-+        uint8_t  reserved_ext[4096 - 200];
-+    } QEMU_PACKED;
-+} QEMU_PACKED;
-+typedef union IplParameterBlock IplParameterBlock;
-+
-+#endif
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index 27cbb354af..db9e8f0892 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -3,7 +3,7 @@ all: build-all
- 	@true
- 
- include config-host.mak
--CFLAGS = -O2 -g
-+CFLAGS = -O2 -g -I $(SRC_PATH)/../../include/hw/s390x/ipl
- MAKEFLAGS += -rR
- 
- GIT_SUBMODULES = roms/SLOF
-diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h
-index 3758698468..16643f5879 100644
---- a/pc-bios/s390-ccw/iplb.h
-+++ b/pc-bios/s390-ccw/iplb.h
-@@ -12,88 +12,14 @@
- #ifndef IPLB_H
- #define IPLB_H
- 
--#define LOADPARM_LEN    8
-+#ifndef QEMU_PACKED
-+#define QEMU_PACKED __attribute__((packed))
-+#endif
- 
--struct IplBlockCcw {
--    uint8_t  reserved0[85];
--    uint8_t  ssid;
--    uint16_t devno;
--    uint8_t  vm_flags;
--    uint8_t  reserved3[3];
--    uint32_t vm_parm_len;
--    uint8_t  nss_name[8];
--    uint8_t  vm_parm[64];
--    uint8_t  reserved4[8];
--} __attribute__ ((packed));
--typedef struct IplBlockCcw IplBlockCcw;
--
--struct IplBlockFcp {
--    uint8_t  reserved1[305 - 1];
--    uint8_t  opt;
--    uint8_t  reserved2[3];
--    uint16_t reserved3;
--    uint16_t devno;
--    uint8_t  reserved4[4];
--    uint64_t wwpn;
--    uint64_t lun;
--    uint32_t bootprog;
--    uint8_t  reserved5[12];
--    uint64_t br_lba;
--    uint32_t scp_data_len;
--    uint8_t  reserved6[260];
--    uint8_t  scp_data[];
--} __attribute__ ((packed));
--typedef struct IplBlockFcp IplBlockFcp;
--
--struct IplBlockQemuScsi {
--    uint32_t lun;
--    uint16_t target;
--    uint16_t channel;
--    uint8_t  reserved0[77];
--    uint8_t  ssid;
--    uint16_t devno;
--} __attribute__ ((packed));
--typedef struct IplBlockQemuScsi IplBlockQemuScsi;
--
--struct IplParameterBlock {
--    uint32_t len;
--    uint8_t  reserved0[3];
--    uint8_t  version;
--    uint32_t blk0_len;
--    uint8_t  pbt;
--    uint8_t  flags;
--    uint16_t reserved01;
--    uint8_t  loadparm[LOADPARM_LEN];
--    union {
--        IplBlockCcw ccw;
--        IplBlockFcp fcp;
--        IplBlockQemuScsi scsi;
--    };
--} __attribute__ ((packed));
--typedef struct IplParameterBlock IplParameterBlock;
--
--extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
--
--#define QIPL_ADDRESS  0xcc
--
--/* Boot Menu flags */
--#define QIPL_FLAG_BM_OPTS_CMD   0x80
--#define QIPL_FLAG_BM_OPTS_ZIPL  0x40
--
--/*
-- * This definition must be kept in sync with the definition
-- * in hw/s390x/ipl.h
-- */
--struct QemuIplParameters {
--    uint8_t  qipl_flags;
--    uint8_t  reserved1[3];
--    uint64_t reserved2;
--    uint32_t boot_menu_timeout;
--    uint8_t  reserved3[12];
--} __attribute__ ((packed));
--typedef struct QemuIplParameters QemuIplParameters;
-+#include <qipl.h>
- 
- extern QemuIplParameters qipl;
-+extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
- 
- #define S390_IPL_TYPE_FCP 0x00
- #define S390_IPL_TYPE_CCW 0x02
--- 
-2.39.3
-
diff --git a/kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch b/kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch
deleted file mode 100644
index a196764..0000000
--- a/kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From cf92fd8487195ac45bfbdad15168eaec70f3aaa9 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 10 Jun 2025 13:36:39 +0100
-Subject: [PATCH 27/57] include/qemu/compiler: add QEMU_UNINITIALIZED attribute
- macro
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/30] 43c2412d318b6d8e0dcb0b37340640a9d90c3188 (stefanha/centos-stream-qemu-kvm)
-
-The QEMU_UNINITIALIZED macro is to be used to skip the default compiler
-variable initialization done by -ftrivial-auto-var-init=zero.
-
-Use this in cases where there a method in the device I/O path (or other
-important hot paths), that has large variables on the stack. A rule of
-thumb is that "large" means a method with 4kb data in the local stack
-frame. Any variables which are KB in size, should be annotated with this
-attribute, to pre-emptively eliminate any potential overhead from the
-compiler zero'ing memory.
-
-Given that this turns off a security hardening feature, when using this
-to flag variables, it is important that the code is double-checked to
-ensure there is no possible use of uninitialized data in the method.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Message-id: 20250610123709.835102-2-berrange@redhat.com
-[DB: split off patch & rewrite guidance on when to use the annotation]
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit c653b67d1863b7ebfa67f7c9f4aec209d7b5ced5)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Conflicts:
-  include/qemu/compiler.h
-  Context conflict due to clang Thread Safety Analysis macros.
----
- include/qemu/compiler.h | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
-index c06954ccb4..cc193d5b82 100644
---- a/include/qemu/compiler.h
-+++ b/include/qemu/compiler.h
-@@ -212,6 +212,26 @@
- # define QEMU_USED
- #endif
- 
-+/*
-+ * Disable -ftrivial-auto-var-init on a local variable.
-+ *
-+ * Use this in cases where there a method in the device I/O path (or other
-+ * important hot paths), that has large variables on the stack. A rule of
-+ * thumb is that "large" means a method with 4kb data in the local stack
-+ * frame. Any variables which are KB in size, should be annotated with this
-+ * attribute, to pre-emptively eliminate any potential overhead from the
-+ * compiler's implicit zero'ing of memory.
-+ *
-+ * Given that this turns off a security hardening feature, when using this
-+ * to flag variables, it is important that the code is double-checked to
-+ * ensure there is no possible use of uninitialized data in the method.
-+ */
-+#if __has_attribute(uninitialized)
-+# define QEMU_UNINITIALIZED __attribute__((uninitialized))
-+#else
-+# define QEMU_UNINITIALIZED
-+#endif
-+
- /*
-  * Ugly CPP trick that is like "defined FOO", but also works in C
-  * code.  Useful to replace #ifdef with "if" statements; assumes
--- 
-2.39.3
-
diff --git a/kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch b/kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch
deleted file mode 100644
index 23d927a..0000000
--- a/kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 4545870823aea92b18a7e747b686b666d08006a4 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:30 +0200
-Subject: [PATCH 08/57] io: Fix partial struct copy in
- qio_dns_resolver_lookup_sync_inet()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/7] 92c8b3e63c22a3ca6e5adc76cac1a9f812034912 (JurajMarcin/centos-src-qemu-kvm)
-
-Commit aec21d3175 (qapi: Add InetSocketAddress member keep-alive)
-introduces the keep-alive flag, but this flag is not copied together
-with other options in qio_dns_resolver_lookup_sync_inet().
-
-This patch fixes this issue and also prevents future ones by copying the
-entire structure first and only then overriding a few attributes that
-need to be different.
-
-Fixes: aec21d31756c (qapi: Add InetSocketAddress member keep-alive)
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit 0dc051aa85e1bd68d5c5110fa8af69204e6dbd3d)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- io/dns-resolver.c | 21 +++++----------------
- 1 file changed, 5 insertions(+), 16 deletions(-)
-
-diff --git a/io/dns-resolver.c b/io/dns-resolver.c
-index 53b0e8407a..3712438f82 100644
---- a/io/dns-resolver.c
-+++ b/io/dns-resolver.c
-@@ -111,22 +111,11 @@ static int qio_dns_resolver_lookup_sync_inet(QIODNSResolver *resolver,
-                     uaddr, INET6_ADDRSTRLEN, uport, 32,
-                     NI_NUMERICHOST | NI_NUMERICSERV);
- 
--        newaddr->u.inet = (InetSocketAddress){
--            .host = g_strdup(uaddr),
--            .port = g_strdup(uport),
--            .has_numeric = true,
--            .numeric = true,
--            .has_to = iaddr->has_to,
--            .to = iaddr->to,
--            .has_ipv4 = iaddr->has_ipv4,
--            .ipv4 = iaddr->ipv4,
--            .has_ipv6 = iaddr->has_ipv6,
--            .ipv6 = iaddr->ipv6,
--#ifdef HAVE_IPPROTO_MPTCP
--            .has_mptcp = iaddr->has_mptcp,
--            .mptcp = iaddr->mptcp,
--#endif
--        };
-+        newaddr->u.inet = *iaddr;
-+        newaddr->u.inet.host = g_strdup(uaddr),
-+        newaddr->u.inet.port = g_strdup(uport),
-+        newaddr->u.inet.has_numeric = true,
-+        newaddr->u.inet.numeric = true,
- 
-         (*addrs)[i] = newaddr;
-     }
--- 
-2.39.3
-
diff --git a/kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch b/kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch
deleted file mode 100644
index 0308722..0000000
--- a/kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch
+++ /dev/null
@@ -1,609 +0,0 @@
-From 9cf467603ed9b5f4a3a16fbd5da21eb02ec2e224 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:07 +0100
-Subject: [PATCH 23/23] iotests: Add (NBD-based) tests for inactive nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [22/22] 60b324d221718b24a5d0f95e1a052607aa8b9338 (kmwolf/centos-qemu-kvm)
-
-This tests different types of operations on inactive block nodes
-(including graph changes, block jobs and NBD exports) to make sure that
-users manually activating and inactivating nodes doesn't break things.
-
-Support for inactive nodes in other export types will have to come with
-separate test cases because they have different dependencies like blkio
-or root permissions and we don't want to disable this basic test when
-they are not fulfilled.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Message-ID: <20250204211407.381505-17-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit bbf105ef3cc48fff282789e9bf56b7a81e1407bd)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- tests/qemu-iotests/iotests.py                 |   4 +
- tests/qemu-iotests/tests/inactive-node-nbd    | 303 ++++++++++++++++++
- .../qemu-iotests/tests/inactive-node-nbd.out  | 239 ++++++++++++++
- 3 files changed, 546 insertions(+)
- create mode 100755 tests/qemu-iotests/tests/inactive-node-nbd
- create mode 100644 tests/qemu-iotests/tests/inactive-node-nbd.out
-
-diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
-index 1a42aa1416..c8cb028c2d 100644
---- a/tests/qemu-iotests/iotests.py
-+++ b/tests/qemu-iotests/iotests.py
-@@ -913,6 +913,10 @@ def add_incoming(self, addr):
-         self._args.append(addr)
-         return self
- 
-+    def add_paused(self):
-+        self._args.append('-S')
-+        return self
-+
-     def hmp(self, command_line: str, use_log: bool = False) -> QMPMessage:
-         cmd = 'human-monitor-command'
-         kwargs: Dict[str, Any] = {'command-line': command_line}
-diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotests/tests/inactive-node-nbd
-new file mode 100755
-index 0000000000..a95b37e796
---- /dev/null
-+++ b/tests/qemu-iotests/tests/inactive-node-nbd
-@@ -0,0 +1,303 @@
-+#!/usr/bin/env python3
-+# group: rw quick
-+#
-+# Copyright (C) Red Hat, Inc.
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 2 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+#
-+# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
-+
-+import iotests
-+
-+from iotests import QemuIoInteractive
-+from iotests import filter_qemu_io, filter_qtest, filter_qmp_testfiles
-+
-+iotests.script_initialize(supported_fmts=['generic'],
-+                          supported_protocols=['file'],
-+                          supported_platforms=['linux'])
-+
-+def get_export(node_name='disk-fmt', allow_inactive=None):
-+    exp = {
-+        'id': 'exp0',
-+        'type': 'nbd',
-+        'node-name': node_name,
-+        'writable': True,
-+    }
-+
-+    if allow_inactive is not None:
-+        exp['allow-inactive'] = allow_inactive
-+
-+    return exp
-+
-+def node_is_active(_vm, node_name):
-+    nodes = _vm.cmd('query-named-block-nodes', flat=True)
-+    node = next(n for n in nodes if n['node-name'] == node_name)
-+    return node['active']
-+
-+with iotests.FilePath('disk.img') as path, \
-+     iotests.FilePath('snap.qcow2') as snap_path, \
-+     iotests.FilePath('snap2.qcow2') as snap2_path, \
-+     iotests.FilePath('target.img') as target_path, \
-+     iotests.FilePath('nbd.sock', base_dir=iotests.sock_dir) as nbd_sock, \
-+     iotests.VM() as vm:
-+
-+    img_size = '10M'
-+
-+    iotests.log('Preparing disk...')
-+    iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size)
-+    iotests.qemu_img_create('-f', iotests.imgfmt, target_path, img_size)
-+
-+    iotests.qemu_img_create('-f', 'qcow2', '-b', path, '-F', iotests.imgfmt,
-+                            snap_path)
-+    iotests.qemu_img_create('-f', 'qcow2', '-b', snap_path, '-F', 'qcow2',
-+                            snap2_path)
-+
-+    iotests.log('Launching VM...')
-+    vm.add_blockdev(f'file,node-name=disk-file,filename={path}')
-+    vm.add_blockdev(f'{iotests.imgfmt},file=disk-file,node-name=disk-fmt,'
-+                     'active=off')
-+    vm.add_blockdev(f'file,node-name=target-file,filename={target_path}')
-+    vm.add_blockdev(f'{iotests.imgfmt},file=target-file,node-name=target-fmt')
-+    vm.add_blockdev(f'file,node-name=snap-file,filename={snap_path}')
-+    vm.add_blockdev(f'file,node-name=snap2-file,filename={snap2_path}')
-+
-+    # Actually running the VM activates all images
-+    vm.add_paused()
-+
-+    vm.launch()
-+    vm.qmp_log('nbd-server-start',
-+                addr={'type': 'unix', 'data':{'path': nbd_sock}},
-+                filters=[filter_qmp_testfiles])
-+
-+    iotests.log('\n=== Creating export of inactive node ===')
-+
-+    iotests.log('\nExports activate nodes without allow-inactive')
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('block-export-add', **get_export())
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\nExports activate nodes with allow-inactive=false')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('block-export-add', **get_export(allow_inactive=False))
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\nExport leaves nodes inactive with allow-inactive=true')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('block-export-add', **get_export(allow_inactive=True))
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\n=== Inactivating node with existing export ===')
-+
-+    iotests.log('\nInactivating nodes with an export fails without '
-+                'allow-inactive')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=True)
-+    vm.qmp_log('block-export-add', **get_export(node_name='disk-fmt'))
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\nInactivating nodes with an export fails with '
-+                'allow-inactive=false')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=True)
-+    vm.qmp_log('block-export-add',
-+               **get_export(node_name='disk-fmt', allow_inactive=False))
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\nInactivating nodes with an export works with '
-+                'allow-inactive=true')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=True)
-+    vm.qmp_log('block-export-add',
-+               **get_export(node_name='disk-fmt', allow_inactive=True))
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    vm.qmp_log('query-block-exports')
-+    vm.qmp_log('block-export-del', id='exp0')
-+    vm.event_wait('BLOCK_EXPORT_DELETED')
-+    vm.qmp_log('query-block-exports')
-+
-+    iotests.log('\n=== Inactive nodes with parent ===')
-+
-+    iotests.log('\nInactivating nodes with an active parent fails')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=True)
-+    vm.qmp_log('blockdev-set-active', node_name='disk-file', active=False)
-+    iotests.log('disk-file active: %s' % node_is_active(vm, 'disk-file'))
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+
-+    iotests.log('\nInactivating nodes with an inactive parent works')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=False)
-+    vm.qmp_log('blockdev-set-active', node_name='disk-file', active=False)
-+    iotests.log('disk-file active: %s' % node_is_active(vm, 'disk-file'))
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+
-+    iotests.log('\nCreating active parent node with an inactive child fails')
-+    vm.qmp_log('blockdev-add', driver='raw', file='disk-fmt',
-+               node_name='disk-filter')
-+    vm.qmp_log('blockdev-add', driver='raw', file='disk-fmt',
-+               node_name='disk-filter', active=True)
-+
-+    iotests.log('\nCreating inactive parent node with an inactive child works')
-+    vm.qmp_log('blockdev-add', driver='raw', file='disk-fmt',
-+               node_name='disk-filter', active=False)
-+    vm.qmp_log('blockdev-del', node_name='disk-filter')
-+
-+    iotests.log('\n=== Resizing an inactive node ===')
-+    vm.qmp_log('block_resize', node_name='disk-fmt', size=16*1024*1024)
-+
-+    iotests.log('\n=== Taking a snapshot of an inactive node ===')
-+
-+    iotests.log('\nActive overlay over inactive backing file automatically '
-+                'makes both inactive for compatibility')
-+    vm.qmp_log('blockdev-add', driver='qcow2', node_name='snap-fmt',
-+               file='snap-file', backing=None)
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    vm.qmp_log('blockdev-snapshot', node='disk-fmt', overlay='snap-fmt')
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    vm.qmp_log('blockdev-del', node_name='snap-fmt')
-+
-+    iotests.log('\nInactive overlay over inactive backing file just works')
-+    vm.qmp_log('blockdev-add', driver='qcow2', node_name='snap-fmt',
-+               file='snap-file', backing=None, active=False)
-+    vm.qmp_log('blockdev-snapshot', node='disk-fmt', overlay='snap-fmt')
-+
-+    iotests.log('\n=== Block jobs with inactive nodes ===')
-+
-+    iotests.log('\nStreaming into an inactive node')
-+    vm.qmp_log('block-stream', device='snap-fmt',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nCommitting an inactive root node (active commit)')
-+    vm.qmp_log('block-commit', job_id='job0', device='snap-fmt',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nCommitting an inactive intermediate node to inactive base')
-+    vm.qmp_log('blockdev-add', driver='qcow2', node_name='snap2-fmt',
-+               file='snap2-file', backing='snap-fmt', active=False)
-+
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
-+
-+    vm.qmp_log('block-commit', job_id='job0', device='snap2-fmt',
-+               top_node='snap-fmt',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nCommitting an inactive intermediate node to active base')
-+    vm.qmp_log('blockdev-set-active', node_name='disk-fmt', active=True)
-+    vm.qmp_log('block-commit', job_id='job0', device='snap2-fmt',
-+               top_node='snap-fmt',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nMirror from inactive source to active target')
-+    vm.qmp_log('blockdev-mirror', job_id='job0', device='snap2-fmt',
-+               target='target-fmt', sync='full',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nMirror from active source to inactive target')
-+
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
-+    iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt'))
-+
-+    # Activating snap2-fmt recursively activates the whole backing chain
-+    vm.qmp_log('blockdev-set-active', node_name='snap2-fmt', active=True)
-+    vm.qmp_log('blockdev-set-active', node_name='target-fmt', active=False)
-+
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
-+    iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt'))
-+
-+    vm.qmp_log('blockdev-mirror', job_id='job0', device='snap2-fmt',
-+               target='target-fmt', sync='full',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nBackup from active source to inactive target')
-+
-+    vm.qmp_log('blockdev-backup', job_id='job0', device='snap2-fmt',
-+               target='target-fmt', sync='full',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\nBackup from inactive source to active target')
-+
-+    # Inactivating snap2-fmt recursively inactivates the whole backing chain
-+    vm.qmp_log('blockdev-set-active', node_name='snap2-fmt', active=False)
-+    vm.qmp_log('blockdev-set-active', node_name='target-fmt', active=True)
-+
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
-+    iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt'))
-+
-+    vm.qmp_log('blockdev-backup', job_id='job0', device='snap2-fmt',
-+               target='target-fmt', sync='full',
-+               filters=[iotests.filter_qmp_generated_node_ids])
-+
-+    iotests.log('\n=== Accessing export on inactive node ===')
-+
-+    # Use the target node because it has the right image format and isn't the
-+    # (read-only) backing file of a qcow2 node
-+    vm.qmp_log('blockdev-set-active', node_name='target-fmt', active=False)
-+    vm.qmp_log('block-export-add',
-+               **get_export(node_name='target-fmt', allow_inactive=True))
-+
-+    # The read should succeed, everything else should fail gracefully
-+    qemu_io = QemuIoInteractive('-f', 'raw',
-+                                f'nbd+unix:///target-fmt?socket={nbd_sock}')
-+    iotests.log(qemu_io.cmd('read 0 64k'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('write 0 64k'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('write -z 0 64k'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('write -zu 0 64k'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('discard 0 64k'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('flush'), filters=[filter_qemu_io])
-+    iotests.log(qemu_io.cmd('map'), filters=[filter_qemu_io])
-+    qemu_io.close()
-+
-+    iotests.log('\n=== Resuming VM activates all images ===')
-+    vm.qmp_log('cont')
-+
-+    iotests.log('disk-fmt active: %s' % node_is_active(vm, 'disk-fmt'))
-+    iotests.log('snap-fmt active: %s' % node_is_active(vm, 'snap-fmt'))
-+    iotests.log('snap2-fmt active: %s' % node_is_active(vm, 'snap2-fmt'))
-+    iotests.log('target-fmt active: %s' % node_is_active(vm, 'target-fmt'))
-+
-+    iotests.log('\nShutting down...')
-+    vm.shutdown()
-+    log = vm.get_log()
-+    if log:
-+        iotests.log(log, [filter_qtest, filter_qemu_io])
-diff --git a/tests/qemu-iotests/tests/inactive-node-nbd.out b/tests/qemu-iotests/tests/inactive-node-nbd.out
-new file mode 100644
-index 0000000000..a458b4fc05
---- /dev/null
-+++ b/tests/qemu-iotests/tests/inactive-node-nbd.out
-@@ -0,0 +1,239 @@
-+Preparing disk...
-+Launching VM...
-+{"execute": "nbd-server-start", "arguments": {"addr": {"data": {"path": "SOCK_DIR/PID-nbd.sock"}, "type": "unix"}}}
-+{"return": {}}
-+
-+=== Creating export of inactive node ===
-+
-+Exports activate nodes without allow-inactive
-+disk-fmt active: False
-+{"execute": "block-export-add", "arguments": {"id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+disk-fmt active: True
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+Exports activate nodes with allow-inactive=false
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+{"execute": "block-export-add", "arguments": {"allow-inactive": false, "id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+disk-fmt active: True
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+Export leaves nodes inactive with allow-inactive=true
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+{"execute": "block-export-add", "arguments": {"allow-inactive": true, "id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+disk-fmt active: False
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+=== Inactivating node with existing export ===
-+
-+Inactivating nodes with an export fails without allow-inactive
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "block-export-add", "arguments": {"id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Failed to inactivate node: Operation not permitted"}}
-+disk-fmt active: True
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+Inactivating nodes with an export fails with allow-inactive=false
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "block-export-add", "arguments": {"allow-inactive": false, "id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Failed to inactivate node: Operation not permitted"}}
-+disk-fmt active: True
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+Inactivating nodes with an export works with allow-inactive=true
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "block-export-add", "arguments": {"allow-inactive": true, "id": "exp0", "node-name": "disk-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": [{"id": "exp0", "node-name": "disk-fmt", "shutting-down": false, "type": "nbd"}]}
-+{"execute": "block-export-del", "arguments": {"id": "exp0"}}
-+{"return": {}}
-+{"execute": "query-block-exports", "arguments": {}}
-+{"return": []}
-+
-+=== Inactive nodes with parent ===
-+
-+Inactivating nodes with an active parent fails
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-file"}}
-+{"error": {"class": "GenericError", "desc": "Node has active parent node"}}
-+disk-file active: True
-+disk-fmt active: True
-+
-+Inactivating nodes with an inactive parent works
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "disk-file"}}
-+{"return": {}}
-+disk-file active: False
-+disk-fmt active: False
-+
-+Creating active parent node with an inactive child fails
-+{"execute": "blockdev-add", "arguments": {"driver": "raw", "file": "disk-fmt", "node-name": "disk-filter"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'disk-fmt' can't be a file child of active 'disk-filter'"}}
-+{"execute": "blockdev-add", "arguments": {"active": true, "driver": "raw", "file": "disk-fmt", "node-name": "disk-filter"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'disk-fmt' can't be a file child of active 'disk-filter'"}}
-+
-+Creating inactive parent node with an inactive child works
-+{"execute": "blockdev-add", "arguments": {"active": false, "driver": "raw", "file": "disk-fmt", "node-name": "disk-filter"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "disk-filter"}}
-+{"return": {}}
-+
-+=== Resizing an inactive node ===
-+{"execute": "block_resize", "arguments": {"node-name": "disk-fmt", "size": 16777216}}
-+{"error": {"class": "GenericError", "desc": "Permission 'resize' unavailable on inactive node"}}
-+
-+=== Taking a snapshot of an inactive node ===
-+
-+Active overlay over inactive backing file automatically makes both inactive for compatibility
-+{"execute": "blockdev-add", "arguments": {"backing": null, "driver": "qcow2", "file": "snap-file", "node-name": "snap-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+snap-fmt active: True
-+{"execute": "blockdev-snapshot", "arguments": {"node": "disk-fmt", "overlay": "snap-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+snap-fmt active: False
-+{"execute": "blockdev-del", "arguments": {"node-name": "snap-fmt"}}
-+{"return": {}}
-+
-+Inactive overlay over inactive backing file just works
-+{"execute": "blockdev-add", "arguments": {"active": false, "backing": null, "driver": "qcow2", "file": "snap-file", "node-name": "snap-fmt"}}
-+{"return": {}}
-+{"execute": "blockdev-snapshot", "arguments": {"node": "disk-fmt", "overlay": "snap-fmt"}}
-+{"return": {}}
-+
-+=== Block jobs with inactive nodes ===
-+
-+Streaming into an inactive node
-+{"execute": "block-stream", "arguments": {"device": "snap-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Could not create node: Inactive 'snap-fmt' can't be a file child of active 'NODE_NAME'"}}
-+
-+Committing an inactive root node (active commit)
-+{"execute": "block-commit", "arguments": {"device": "snap-fmt", "job-id": "job0"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'snap-fmt' can't be a backing child of active 'NODE_NAME'"}}
-+
-+Committing an inactive intermediate node to inactive base
-+{"execute": "blockdev-add", "arguments": {"active": false, "backing": "snap-fmt", "driver": "qcow2", "file": "snap2-file", "node-name": "snap2-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+snap-fmt active: False
-+snap2-fmt active: False
-+{"execute": "block-commit", "arguments": {"device": "snap2-fmt", "job-id": "job0", "top-node": "snap-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'snap-fmt' can't be a backing child of active 'NODE_NAME'"}}
-+
-+Committing an inactive intermediate node to active base
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "disk-fmt"}}
-+{"return": {}}
-+{"execute": "block-commit", "arguments": {"device": "snap2-fmt", "job-id": "job0", "top-node": "snap-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'snap-fmt' can't be a backing child of active 'NODE_NAME'"}}
-+
-+Mirror from inactive source to active target
-+{"execute": "blockdev-mirror", "arguments": {"device": "snap2-fmt", "job-id": "job0", "sync": "full", "target": "target-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Inactive 'snap2-fmt' can't be a backing child of active 'NODE_NAME'"}}
-+
-+Mirror from active source to inactive target
-+disk-fmt active: True
-+snap-fmt active: False
-+snap2-fmt active: False
-+target-fmt active: True
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "snap2-fmt"}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "target-fmt"}}
-+{"return": {}}
-+disk-fmt active: True
-+snap-fmt active: True
-+snap2-fmt active: True
-+target-fmt active: False
-+{"execute": "blockdev-mirror", "arguments": {"device": "snap2-fmt", "job-id": "job0", "sync": "full", "target": "target-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Permission 'write' unavailable on inactive node"}}
-+
-+Backup from active source to inactive target
-+{"execute": "blockdev-backup", "arguments": {"device": "snap2-fmt", "job-id": "job0", "sync": "full", "target": "target-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Could not create node: Inactive 'target-fmt' can't be a target child of active 'NODE_NAME'"}}
-+
-+Backup from inactive source to active target
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "snap2-fmt"}}
-+{"return": {}}
-+{"execute": "blockdev-set-active", "arguments": {"active": true, "node-name": "target-fmt"}}
-+{"return": {}}
-+disk-fmt active: False
-+snap-fmt active: False
-+snap2-fmt active: False
-+target-fmt active: True
-+{"execute": "blockdev-backup", "arguments": {"device": "snap2-fmt", "job-id": "job0", "sync": "full", "target": "target-fmt"}}
-+{"error": {"class": "GenericError", "desc": "Could not create node: Inactive 'snap2-fmt' can't be a file child of active 'NODE_NAME'"}}
-+
-+=== Accessing export on inactive node ===
-+{"execute": "blockdev-set-active", "arguments": {"active": false, "node-name": "target-fmt"}}
-+{"return": {}}
-+{"execute": "block-export-add", "arguments": {"allow-inactive": true, "id": "exp0", "node-name": "target-fmt", "type": "nbd", "writable": true}}
-+{"return": {}}
-+read 65536/65536 bytes at offset 0
-+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+
-+write failed: Operation not permitted
-+
-+write failed: Operation not permitted
-+
-+write failed: Operation not permitted
-+
-+discard failed: Operation not permitted
-+
-+
-+qemu-io: Failed to get allocation status: Operation not permitted
-+
-+
-+=== Resuming VM activates all images ===
-+{"execute": "cont", "arguments": {}}
-+{"return": {}}
-+disk-fmt active: True
-+snap-fmt active: True
-+snap2-fmt active: True
-+target-fmt active: True
-+
-+Shutting down...
-+
--- 
-2.48.1
-
diff --git a/kvm-iotests-Add-filter_qtest.patch b/kvm-iotests-Add-filter_qtest.patch
deleted file mode 100644
index 7b8d69a..0000000
--- a/kvm-iotests-Add-filter_qtest.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 1597f6bec5764608fead44fccdf2822846a506ef Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:05 +0100
-Subject: [PATCH 21/23] iotests: Add filter_qtest()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [20/22] 7b62d4e707582e94a2ca92f27fb217a721cdad0c (kmwolf/centos-qemu-kvm)
-
-The open-coded form of this filter has been copied into enough tests
-that it's better to move it into iotests.py.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250204211407.381505-15-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ed26db83673f4a190332d2a378e2f6e342b8904d)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- tests/qemu-iotests/041                        | 4 +---
- tests/qemu-iotests/165                        | 4 +---
- tests/qemu-iotests/iotests.py                 | 4 ++++
- tests/qemu-iotests/tests/copy-before-write    | 3 +--
- tests/qemu-iotests/tests/migrate-bitmaps-test | 7 +++----
- 5 files changed, 10 insertions(+), 12 deletions(-)
-
-diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
-index 98d17b1388..8452845f44 100755
---- a/tests/qemu-iotests/041
-+++ b/tests/qemu-iotests/041
-@@ -1100,10 +1100,8 @@ class TestRepairQuorum(iotests.QMPTestCase):
- 
-         # Check the full error message now
-         self.vm.shutdown()
--        log = self.vm.get_log()
--        log = re.sub(r'^\[I \d+\.\d+\] OPENED\n', '', log)
-+        log = iotests.filter_qtest(self.vm.get_log())
-         log = re.sub(r'^Formatting.*\n', '', log)
--        log = re.sub(r'\n\[I \+\d+\.\d+\] CLOSED\n?$', '', log)
-         log = re.sub(r'^%s: ' % os.path.basename(iotests.qemu_prog), '', log)
- 
-         self.assertEqual(log,
-diff --git a/tests/qemu-iotests/165 b/tests/qemu-iotests/165
-index b24907a62f..b3b1709d71 100755
---- a/tests/qemu-iotests/165
-+++ b/tests/qemu-iotests/165
-@@ -82,9 +82,7 @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
-         self.vm.shutdown()
- 
-         #catch 'Persistent bitmaps are lost' possible error
--        log = self.vm.get_log()
--        log = re.sub(r'^\[I \d+\.\d+\] OPENED\n', '', log)
--        log = re.sub(r'\[I \+\d+\.\d+\] CLOSED\n?$', '', log)
-+        log = iotests.filter_qtest(self.vm.get_log())
-         if log:
-             print(log)
- 
-diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
-index ea48af4a7b..1a42aa1416 100644
---- a/tests/qemu-iotests/iotests.py
-+++ b/tests/qemu-iotests/iotests.py
-@@ -701,6 +701,10 @@ def _filter(_key, value):
- def filter_nbd_exports(output: str) -> str:
-     return re.sub(r'((min|opt|max) block): [0-9]+', r'\1: XXX', output)
- 
-+def filter_qtest(output: str) -> str:
-+    output = re.sub(r'^\[I \d+\.\d+\] OPENED\n', '', output)
-+    output = re.sub(r'\n?\[I \+\d+\.\d+\] CLOSED\n?$', '', output)
-+    return output
- 
- Msg = TypeVar('Msg', Dict[str, Any], List[Any], str)
- 
-diff --git a/tests/qemu-iotests/tests/copy-before-write b/tests/qemu-iotests/tests/copy-before-write
-index d33bea577d..498c558008 100755
---- a/tests/qemu-iotests/tests/copy-before-write
-+++ b/tests/qemu-iotests/tests/copy-before-write
-@@ -95,8 +95,7 @@ class TestCbwError(iotests.QMPTestCase):
- 
-         self.vm.shutdown()
-         log = self.vm.get_log()
--        log = re.sub(r'^\[I \d+\.\d+\] OPENED\n', '', log)
--        log = re.sub(r'\[I \+\d+\.\d+\] CLOSED\n?$', '', log)
-+        log = iotests.filter_qtest(log)
-         log = iotests.filter_qemu_io(log)
-         return log
- 
-diff --git a/tests/qemu-iotests/tests/migrate-bitmaps-test b/tests/qemu-iotests/tests/migrate-bitmaps-test
-index f98e721e97..8fb4099201 100755
---- a/tests/qemu-iotests/tests/migrate-bitmaps-test
-+++ b/tests/qemu-iotests/tests/migrate-bitmaps-test
-@@ -122,11 +122,10 @@ class TestDirtyBitmapMigration(iotests.QMPTestCase):
- 
-         # catch 'Could not reopen qcow2 layer: Bitmap already exists'
-         # possible error
--        log = self.vm_a.get_log()
--        log = re.sub(r'^\[I \d+\.\d+\] OPENED\n', '', log)
--        log = re.sub(r'^(wrote .* bytes at offset .*\n.*KiB.*ops.*sec.*\n){3}',
-+        log = iotests.filter_qtest(self.vm_a.get_log())
-+        log = re.sub(r'^(wrote .* bytes at offset .*\n'
-+                     r'.*KiB.*ops.*sec.*\n?){3}',
-                      '', log)
--        log = re.sub(r'\[I \+\d+\.\d+\] CLOSED\n?$', '', log)
-         self.assertEqual(log, '')
- 
-         # test that bitmap is still persistent
--- 
-2.48.1
-
diff --git a/kvm-iotests-Add-qsd-migrate-case.patch b/kvm-iotests-Add-qsd-migrate-case.patch
deleted file mode 100644
index 63c2513..0000000
--- a/kvm-iotests-Add-qsd-migrate-case.patch
+++ /dev/null
@@ -1,244 +0,0 @@
-From 21587defa46a2862be2322b6433dde23b7a9a5c9 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:06 +0100
-Subject: [PATCH 22/23] iotests: Add qsd-migrate case
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [21/22] 5467d4c29cf44bf1ad7bf3068baef0c0b4ee05ce (kmwolf/centos-qemu-kvm)
-
-Test that it's possible to migrate a VM that uses an image on shared
-storage through qemu-storage-daemon.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250204211407.381505-16-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 3ea437ab3d561ca79b95a34c5128e370de4738e3)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- tests/qemu-iotests/tests/qsd-migrate     | 140 +++++++++++++++++++++++
- tests/qemu-iotests/tests/qsd-migrate.out |  59 ++++++++++
- 2 files changed, 199 insertions(+)
- create mode 100755 tests/qemu-iotests/tests/qsd-migrate
- create mode 100644 tests/qemu-iotests/tests/qsd-migrate.out
-
-diff --git a/tests/qemu-iotests/tests/qsd-migrate b/tests/qemu-iotests/tests/qsd-migrate
-new file mode 100755
-index 0000000000..de17562cb0
---- /dev/null
-+++ b/tests/qemu-iotests/tests/qsd-migrate
-@@ -0,0 +1,140 @@
-+#!/usr/bin/env python3
-+# group: rw quick
-+#
-+# Copyright (C) Red Hat, Inc.
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 2 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+#
-+# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
-+
-+import iotests
-+
-+from iotests import filter_qemu_io, filter_qtest
-+
-+iotests.script_initialize(supported_fmts=['generic'],
-+                          supported_protocols=['file'],
-+                          supported_platforms=['linux'])
-+
-+with iotests.FilePath('disk.img') as path, \
-+     iotests.FilePath('nbd-src.sock', base_dir=iotests.sock_dir) as nbd_src, \
-+     iotests.FilePath('nbd-dst.sock', base_dir=iotests.sock_dir) as nbd_dst, \
-+     iotests.FilePath('migrate.sock', base_dir=iotests.sock_dir) as mig_sock, \
-+     iotests.VM(path_suffix="-src") as vm_src, \
-+     iotests.VM(path_suffix="-dst") as vm_dst:
-+
-+    img_size = '10M'
-+
-+    iotests.log('Preparing disk...')
-+    iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size)
-+
-+    iotests.log('Launching source QSD...')
-+    qsd_src = iotests.QemuStorageDaemon(
-+        '--blockdev', f'file,node-name=disk-file,filename={path}',
-+        '--blockdev', f'{iotests.imgfmt},file=disk-file,node-name=disk-fmt',
-+        '--nbd-server', f'addr.type=unix,addr.path={nbd_src}',
-+        '--export', 'nbd,id=exp0,node-name=disk-fmt,writable=true,'
-+                    'allow-inactive=true',
-+        qmp=True,
-+    )
-+
-+    iotests.log('Launching source VM...')
-+    vm_src.add_args('-blockdev', f'nbd,node-name=disk,server.type=unix,'
-+                                 f'server.path={nbd_src},export=disk-fmt')
-+    vm_src.add_args('-device', 'virtio-blk,drive=disk,id=virtio0')
-+    vm_src.launch()
-+
-+    iotests.log('Launching destination QSD...')
-+    qsd_dst = iotests.QemuStorageDaemon(
-+        '--blockdev', f'file,node-name=disk-file,filename={path},active=off',
-+        '--blockdev', f'{iotests.imgfmt},file=disk-file,node-name=disk-fmt,'
-+                      f'active=off',
-+        '--nbd-server', f'addr.type=unix,addr.path={nbd_dst}',
-+        '--export', 'nbd,id=exp0,node-name=disk-fmt,writable=true,'
-+                    'allow-inactive=true',
-+        qmp=True,
-+        instance_id='b',
-+    )
-+
-+    iotests.log('Launching destination VM...')
-+    vm_dst.add_args('-blockdev', f'nbd,node-name=disk,server.type=unix,'
-+                                 f'server.path={nbd_dst},export=disk-fmt')
-+    vm_dst.add_args('-device', 'virtio-blk,drive=disk,id=virtio0')
-+    vm_dst.add_args('-incoming', f'unix:{mig_sock}')
-+    vm_dst.launch()
-+
-+    iotests.log('\nTest I/O on the source')
-+    vm_src.hmp_qemu_io('virtio0/virtio-backend', 'write -P 0x11 0 4k',
-+                       use_log=True, qdev=True)
-+    vm_src.hmp_qemu_io('virtio0/virtio-backend', 'read -P 0x11 0 4k',
-+                       use_log=True, qdev=True)
-+
-+    iotests.log('\nStarting migration...')
-+
-+    mig_caps = [
-+        {'capability': 'events', 'state': True},
-+        {'capability': 'pause-before-switchover', 'state': True},
-+    ]
-+    vm_src.qmp_log('migrate-set-capabilities', capabilities=mig_caps)
-+    vm_dst.qmp_log('migrate-set-capabilities', capabilities=mig_caps)
-+    vm_src.qmp_log('migrate', uri=f'unix:{mig_sock}',
-+                   filters=[iotests.filter_qmp_testfiles])
-+
-+    vm_src.event_wait('MIGRATION',
-+                      match={'data': {'status': 'pre-switchover'}})
-+
-+    iotests.log('\nPre-switchover: Reconfigure QSD instances')
-+
-+    iotests.log(qsd_src.qmp('blockdev-set-active', {'active': False}))
-+
-+    # Reading is okay from both sides while the image is inactive. Note that
-+    # the destination may have stale data until it activates the image, though.
-+    vm_src.hmp_qemu_io('virtio0/virtio-backend', 'read -P 0x11 0 4k',
-+                       use_log=True, qdev=True)
-+    vm_dst.hmp_qemu_io('virtio0/virtio-backend', 'read 0 4k',
-+                       use_log=True, qdev=True)
-+
-+    iotests.log(qsd_dst.qmp('blockdev-set-active', {'active': True}))
-+
-+    iotests.log('\nCompleting migration...')
-+
-+    vm_src.qmp_log('migrate-continue', state='pre-switchover')
-+    vm_dst.event_wait('MIGRATION', match={'data': {'status': 'completed'}})
-+
-+    iotests.log('\nTest I/O on the destination')
-+
-+    # Now the destination must see what the source wrote
-+    vm_dst.hmp_qemu_io('virtio0/virtio-backend', 'read -P 0x11 0 4k',
-+                       use_log=True, qdev=True)
-+
-+    # And be able to overwrite it
-+    vm_dst.hmp_qemu_io('virtio0/virtio-backend', 'write -P 0x22 0 4k',
-+                       use_log=True, qdev=True)
-+    vm_dst.hmp_qemu_io('virtio0/virtio-backend', 'read -P 0x22 0 4k',
-+                       use_log=True, qdev=True)
-+
-+    iotests.log('\nDone')
-+
-+    vm_src.shutdown()
-+    iotests.log('\n--- vm_src log ---')
-+    log = vm_src.get_log()
-+    if log:
-+        iotests.log(log, [filter_qtest, filter_qemu_io])
-+    qsd_src.stop()
-+
-+    vm_dst.shutdown()
-+    iotests.log('\n--- vm_dst log ---')
-+    log = vm_dst.get_log()
-+    if log:
-+        iotests.log(log, [filter_qtest, filter_qemu_io])
-+    qsd_dst.stop()
-diff --git a/tests/qemu-iotests/tests/qsd-migrate.out b/tests/qemu-iotests/tests/qsd-migrate.out
-new file mode 100644
-index 0000000000..4a5241e5d4
---- /dev/null
-+++ b/tests/qemu-iotests/tests/qsd-migrate.out
-@@ -0,0 +1,59 @@
-+Preparing disk...
-+Launching source QSD...
-+Launching source VM...
-+Launching destination QSD...
-+Launching destination VM...
-+
-+Test I/O on the source
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"write -P 0x11 0 4k\""}}
-+{"return": ""}
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"read -P 0x11 0 4k\""}}
-+{"return": ""}
-+
-+Starting migration...
-+{"execute": "migrate-set-capabilities", "arguments": {"capabilities": [{"capability": "events", "state": true}, {"capability": "pause-before-switchover", "state": true}]}}
-+{"return": {}}
-+{"execute": "migrate-set-capabilities", "arguments": {"capabilities": [{"capability": "events", "state": true}, {"capability": "pause-before-switchover", "state": true}]}}
-+{"return": {}}
-+{"execute": "migrate", "arguments": {"uri": "unix:SOCK_DIR/PID-migrate.sock"}}
-+{"return": {}}
-+
-+Pre-switchover: Reconfigure QSD instances
-+{"return": {}}
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"read -P 0x11 0 4k\""}}
-+{"return": ""}
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"read 0 4k\""}}
-+{"return": ""}
-+{"return": {}}
-+
-+Completing migration...
-+{"execute": "migrate-continue", "arguments": {"state": "pre-switchover"}}
-+{"return": {}}
-+
-+Test I/O on the destination
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"read -P 0x11 0 4k\""}}
-+{"return": ""}
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"write -P 0x22 0 4k\""}}
-+{"return": ""}
-+{"execute": "human-monitor-command", "arguments": {"command-line": "qemu-io -d virtio0/virtio-backend \"read -P 0x22 0 4k\""}}
-+{"return": ""}
-+
-+Done
-+
-+--- vm_src log ---
-+wrote 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+read 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+read 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+
-+--- vm_dst log ---
-+read 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+read 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+wrote 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+read 4096/4096 bytes at offset 0
-+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
--- 
-2.48.1
-
diff --git a/kvm-iotests-Improve-iotest-194-to-mirror-data.patch b/kvm-iotests-Improve-iotest-194-to-mirror-data.patch
deleted file mode 100644
index f696184..0000000
--- a/kvm-iotests-Improve-iotest-194-to-mirror-data.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 8832268a98104ba3065a57dedcd3db43231512ba Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:22 -0500
-Subject: [PATCH 07/16] iotests: Improve iotest 194 to mirror data
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [5/14] bfbe8eab1035480cef9d69d1974ba66b755b1b60 (ebblake/centos-qemu-kvm)
-
-Mirroring a completely sparse image to a sparse destination should be
-practically instantaneous.  It isn't yet, but the test will be more
-realistic if it has some non-zero to mirror as well as the holes.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-20-eblake@redhat.com>
-(cherry picked from commit eb89627899bb84148d272394e885725eff456ae9)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- tests/qemu-iotests/194 | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tests/qemu-iotests/194 b/tests/qemu-iotests/194
-index c0ce82dd25..d0b9c084f5 100755
---- a/tests/qemu-iotests/194
-+++ b/tests/qemu-iotests/194
-@@ -34,6 +34,7 @@ with iotests.FilePath('source.img') as source_img_path, \
- 
-     img_size = '1G'
-     iotests.qemu_img_create('-f', iotests.imgfmt, source_img_path, img_size)
-+    iotests.qemu_io('-f', iotests.imgfmt, '-c', 'write 512M 1M', source_img_path)
-     iotests.qemu_img_create('-f', iotests.imgfmt, dest_img_path, img_size)
- 
-     iotests.log('Launching VMs...')
--- 
-2.48.1
-
diff --git a/kvm-iotests-common.rc-add-disk_usage-function.patch b/kvm-iotests-common.rc-add-disk_usage-function.patch
deleted file mode 100644
index 14ffba7..0000000
--- a/kvm-iotests-common.rc-add-disk_usage-function.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 644f39de9e2466a9570833b1070acf47a53863ea Mon Sep 17 00:00:00 2001
-From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
-Date: Fri, 9 May 2025 15:40:29 -0500
-Subject: [PATCH 14/16] iotests/common.rc: add disk_usage function
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [12/14] 0e5d4217f97fe6e952de23eedbc2b8d9c7600665 (ebblake/centos-qemu-kvm)
-
-Move the definition from iotests/250 to common.rc.  This is used to
-detect real disk usage of sparse files.  In particular, we want to use
-it for checking subclusters-based discards.
-
-Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
-Reviewed-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
-Reviewed-by: Alberto Garcia <berto@igalia.com>
-Message-ID: <20240913163942.423050-6-andrey.drobyshev@virtuozzo.com>
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-27-eblake@redhat.com>
-(cherry picked from commit be9bac072ede6e6aa27079f59efcf17b56bd7b26)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- tests/qemu-iotests/250       | 5 -----
- tests/qemu-iotests/common.rc | 6 ++++++
- 2 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/tests/qemu-iotests/250 b/tests/qemu-iotests/250
-index af48f83aba..c0a0dbc0ff 100755
---- a/tests/qemu-iotests/250
-+++ b/tests/qemu-iotests/250
-@@ -52,11 +52,6 @@ _unsupported_imgopts data_file
- # bdrv_co_truncate(bs->file) call in qcow2_co_truncate(), which might succeed
- # anyway.
- 
--disk_usage()
--{
--    du --block-size=1 $1 | awk '{print $1}'
--}
--
- size=2100M
- 
- _make_test_img -o "cluster_size=1M,preallocation=metadata" $size
-diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
-index 95c12577dd..237f746af8 100644
---- a/tests/qemu-iotests/common.rc
-+++ b/tests/qemu-iotests/common.rc
-@@ -140,6 +140,12 @@ _optstr_add()
-     fi
- }
- 
-+# report real disk usage for sparse files
-+disk_usage()
-+{
-+    du --block-size=1 "$1" | awk '{print $1}'
-+}
-+
- # Set the variables to the empty string to turn Valgrind off
- # for specific processes, e.g.
- # $ VALGRIND_QEMU_IO= ./check -qcow2 -valgrind 015
--- 
-2.48.1
-
diff --git a/kvm-kvm-Allow-kvm_arch_get-put_registers-to-accept-Error.patch b/kvm-kvm-Allow-kvm_arch_get-put_registers-to-accept-Error.patch
deleted file mode 100644
index 5432fd3..0000000
--- a/kvm-kvm-Allow-kvm_arch_get-put_registers-to-accept-Error.patch
+++ /dev/null
@@ -1,287 +0,0 @@
-From 07a472e19f11c6364e787e71c95c990b76aaf187 Mon Sep 17 00:00:00 2001
-From: Julia Suvorova <jusual@redhat.com>
-Date: Fri, 27 Sep 2024 12:47:40 +0200
-Subject: [PATCH 26/27] kvm: Allow kvm_arch_get/put_registers to accept Error**
-
-RH-Author: Julia Suvorova <None>
-RH-MergeRequest: 286: kvm: Allow kvm_arch_get/put_registers to accept Error**
-RH-Jira: RHEL-60914
-RH-Acked-by: Juraj Marcin <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Commit: [1/2] 2ab30f24245a52c4254a5b9238b1b2e966a8c6a2
-
-This is necessary to provide discernible error messages to the caller.
-
-Signed-off-by: Julia Suvorova <jusual@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Link: https://lore.kernel.org/r/20240927104743.218468-2-jusual@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a1676bb3047f28b292ecbce3a378ccc0b4721d47)
----
- accel/kvm/kvm-all.c        | 41 +++++++++++++++++++++++++++++---------
- include/sysemu/kvm.h       |  4 ++--
- target/arm/kvm.c           |  4 ++--
- target/i386/kvm/kvm.c      |  4 ++--
- target/loongarch/kvm/kvm.c |  4 ++--
- target/mips/kvm.c          |  4 ++--
- target/ppc/kvm.c           |  4 ++--
- target/riscv/kvm/kvm-cpu.c |  4 ++--
- target/s390x/kvm/kvm.c     |  4 ++--
- 9 files changed, 48 insertions(+), 25 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 75d11a07b2..a220178822 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2766,9 +2766,15 @@ void kvm_flush_coalesced_mmio_buffer(void)
- static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
- {
-     if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
--        int ret = kvm_arch_get_registers(cpu);
-+        Error *err = NULL;
-+        int ret = kvm_arch_get_registers(cpu, &err);
-         if (ret) {
--            error_report("Failed to get registers: %s", strerror(-ret));
-+            if (err) {
-+                error_reportf_err(err, "Failed to synchronize CPU state: ");
-+            } else {
-+                error_report("Failed to get registers: %s", strerror(-ret));
-+            }
-+
-             cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
-             vm_stop(RUN_STATE_INTERNAL_ERROR);
-         }
-@@ -2786,9 +2792,15 @@ void kvm_cpu_synchronize_state(CPUState *cpu)
- 
- static void do_kvm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
- {
--    int ret = kvm_arch_put_registers(cpu, KVM_PUT_RESET_STATE);
-+    Error *err = NULL;
-+    int ret = kvm_arch_put_registers(cpu, KVM_PUT_RESET_STATE, &err);
-     if (ret) {
--        error_report("Failed to put registers after reset: %s", strerror(-ret));
-+        if (err) {
-+            error_reportf_err(err, "Restoring resisters after reset: ");
-+        } else {
-+            error_report("Failed to put registers after reset: %s",
-+                         strerror(-ret));
-+        }
-         cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
-         vm_stop(RUN_STATE_INTERNAL_ERROR);
-     }
-@@ -2803,9 +2815,15 @@ void kvm_cpu_synchronize_post_reset(CPUState *cpu)
- 
- static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
- {
--    int ret = kvm_arch_put_registers(cpu, KVM_PUT_FULL_STATE);
-+    Error *err = NULL;
-+    int ret = kvm_arch_put_registers(cpu, KVM_PUT_FULL_STATE, &err);
-     if (ret) {
--        error_report("Failed to put registers after init: %s", strerror(-ret));
-+        if (err) {
-+            error_reportf_err(err, "Putting registers after init: ");
-+        } else {
-+            error_report("Failed to put registers after init: %s",
-+                         strerror(-ret));
-+        }
-         exit(1);
-     }
- 
-@@ -2995,10 +3013,15 @@ int kvm_cpu_exec(CPUState *cpu)
-         MemTxAttrs attrs;
- 
-         if (cpu->vcpu_dirty) {
--            ret = kvm_arch_put_registers(cpu, KVM_PUT_RUNTIME_STATE);
-+            Error *err = NULL;
-+            ret = kvm_arch_put_registers(cpu, KVM_PUT_RUNTIME_STATE, &err);
-             if (ret) {
--                error_report("Failed to put registers after init: %s",
--                             strerror(-ret));
-+                if (err) {
-+                    error_reportf_err(err, "Putting registers after init: ");
-+                } else {
-+                    error_report("Failed to put registers after init: %s",
-+                                 strerror(-ret));
-+                }
-                 ret = -1;
-                 break;
-             }
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
-index 9cf14ca3d5..d9ad723f78 100644
---- a/include/sysemu/kvm.h
-+++ b/include/sysemu/kvm.h
-@@ -359,7 +359,7 @@ int kvm_arch_handle_exit(CPUState *cpu, struct kvm_run *run);
- 
- int kvm_arch_process_async_events(CPUState *cpu);
- 
--int kvm_arch_get_registers(CPUState *cpu);
-+int kvm_arch_get_registers(CPUState *cpu, Error **errp);
- 
- /* state subset only touched by the VCPU itself during runtime */
- #define KVM_PUT_RUNTIME_STATE   1
-@@ -368,7 +368,7 @@ int kvm_arch_get_registers(CPUState *cpu);
- /* full state set, modified during initialization or on vmload */
- #define KVM_PUT_FULL_STATE      3
- 
--int kvm_arch_put_registers(CPUState *cpu, int level);
-+int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp);
- 
- int kvm_arch_get_default_type(MachineState *ms);
- 
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-index 849e2e21b3..f1f1b5b375 100644
---- a/target/arm/kvm.c
-+++ b/target/arm/kvm.c
-@@ -2042,7 +2042,7 @@ static int kvm_arch_put_sve(CPUState *cs)
-     return 0;
- }
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     uint64_t val;
-     uint32_t fpr;
-@@ -2226,7 +2226,7 @@ static int kvm_arch_get_sve(CPUState *cs)
-     return 0;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     uint64_t val;
-     unsigned int el;
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 2b28c18693..423e6922d8 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -5121,7 +5121,7 @@ static int kvm_get_nested_state(X86CPU *cpu)
-     return ret;
- }
- 
--int kvm_arch_put_registers(CPUState *cpu, int level)
-+int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
- {
-     X86CPU *x86_cpu = X86_CPU(cpu);
-     int ret;
-@@ -5209,7 +5209,7 @@ int kvm_arch_put_registers(CPUState *cpu, int level)
-     return 0;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     X86CPU *cpu = X86_CPU(cs);
-     int ret;
-diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
-index e1be6a6959..9204d4295d 100644
---- a/target/loongarch/kvm/kvm.c
-+++ b/target/loongarch/kvm/kvm.c
-@@ -585,7 +585,7 @@ static int kvm_loongarch_put_cpucfg(CPUState *cs)
-     return ret;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     int ret;
- 
-@@ -613,7 +613,7 @@ int kvm_arch_get_registers(CPUState *cs)
-     return ret;
- }
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     int ret;
- 
-diff --git a/target/mips/kvm.c b/target/mips/kvm.c
-index a631ab544f..a98798c669 100644
---- a/target/mips/kvm.c
-+++ b/target/mips/kvm.c
-@@ -1172,7 +1172,7 @@ static int kvm_mips_get_cp0_registers(CPUState *cs)
-     return ret;
- }
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     CPUMIPSState *env = cpu_env(cs);
-     struct kvm_regs regs;
-@@ -1207,7 +1207,7 @@ int kvm_arch_put_registers(CPUState *cs, int level)
-     return ret;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     CPUMIPSState *env = cpu_env(cs);
-     int ret = 0;
-diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index c942ff55b2..7daa097164 100644
---- a/target/ppc/kvm.c
-+++ b/target/ppc/kvm.c
-@@ -902,7 +902,7 @@ int kvmppc_put_books_sregs(PowerPCCPU *cpu)
-     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS, &sregs);
- }
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-     CPUPPCState *env = &cpu->env;
-@@ -1207,7 +1207,7 @@ static int kvmppc_get_books_sregs(PowerPCCPU *cpu)
-     return 0;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-     CPUPPCState *env = &cpu->env;
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index f6e3156b8d..2bfb112be0 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -1192,7 +1192,7 @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
-     KVM_CAP_LAST_INFO
- };
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     int ret = 0;
- 
-@@ -1237,7 +1237,7 @@ int kvm_riscv_sync_mpstate_to_kvm(RISCVCPU *cpu, int state)
-     return 0;
- }
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     int ret = 0;
- 
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 45c23758e7..0d51a4ea6b 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -472,7 +472,7 @@ static int can_sync_regs(CPUState *cs, int regs)
- #define KVM_SYNC_REQUIRED_REGS (KVM_SYNC_GPRS | KVM_SYNC_ACRS | \
-                                 KVM_SYNC_CRS | KVM_SYNC_PREFIX)
- 
--int kvm_arch_put_registers(CPUState *cs, int level)
-+int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
- {
-     CPUS390XState *env = cpu_env(cs);
-     struct kvm_fpu fpu = {};
-@@ -598,7 +598,7 @@ int kvm_arch_put_registers(CPUState *cs, int level)
-     return 0;
- }
- 
--int kvm_arch_get_registers(CPUState *cs)
-+int kvm_arch_get_registers(CPUState *cs, Error **errp)
- {
-     CPUS390XState *env = cpu_env(cs);
-     struct kvm_fpu fpu;
--- 
-2.39.3
-
diff --git a/kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch b/kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch
deleted file mode 100644
index 6926857..0000000
--- a/kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From f88758420a256bb2b277d21cb3f3b60426caf51d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:47 +0200
-Subject: [PATCH 059/115] kvm: Check KVM_CAP_MAX_VCPUS at vm level
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [59/115] aac4b448f0e64cdca79d2a8f3c53f683b9514a8a (bonzini/rhel-qemu-kvm)
-
-KVM with TDX support starts to report different KVM_CAP_MAX_VCPUS per
-different VM types. So switch to check the KVM_CAP_MAX_VCPUS at vm level.
-
-KVM still returns the global KVM_CAP_MAX_VCPUS when the KVM is old that
-doesn't report different value at vm level.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-31-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 77b5403a0298a5460554f768a2098fd21588e555)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- accel/kvm/kvm-all.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 65952d7f4e..c1605bc4fa 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2419,7 +2419,7 @@ static int kvm_recommended_vcpus(KVMState *s)
- 
- static int kvm_max_vcpus(KVMState *s)
- {
--    int ret = kvm_check_extension(s, KVM_CAP_MAX_VCPUS);
-+    int ret = kvm_vm_check_extension(s, KVM_CAP_MAX_VCPUS);
-     return (ret) ? ret : kvm_recommended_vcpus(s);
- }
- 
--- 
-2.50.1
-
diff --git a/kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch b/kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch
deleted file mode 100644
index a957f4c..0000000
--- a/kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch
+++ /dev/null
@@ -1,187 +0,0 @@
-From cb4a0164407562ac307b9ccc0031455cf1065bdb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 036/115] kvm: Introduce kvm_arch_pre_create_vcpu()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [36/115] 1c3f6170a844694bc1d4b5d48860330d5961d26d (bonzini/rhel-qemu-kvm)
-
-Introduce kvm_arch_pre_create_vcpu(), to perform arch-dependent
-work prior to create any vcpu. This is for i386 TDX because it needs
-call TDX_INIT_VM before creating any vcpu.
-
-The specific implementation for i386 will be added in the future patch.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250508150002.689633-8-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a668268dc08f7f4d30cecd513054bb38ce48c0d6)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: different context in loongarch
----
- accel/kvm/kvm-all.c        | 5 +++++
- include/sysemu/kvm.h       | 1 +
- target/arm/kvm.c           | 5 +++++
- target/i386/kvm/kvm.c      | 5 +++++
- target/loongarch/kvm/kvm.c | 5 +++++
- target/mips/kvm.c          | 5 +++++
- target/ppc/kvm.c           | 5 +++++
- target/riscv/kvm/kvm-cpu.c | 5 +++++
- target/s390x/kvm/kvm.c     | 5 +++++
- 9 files changed, 41 insertions(+)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 49dedda47e..65952d7f4e 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -530,6 +530,11 @@ int kvm_init_vcpu(CPUState *cpu, Error **errp)
- 
-     trace_kvm_init_vcpu(cpu->cpu_index, kvm_arch_vcpu_id(cpu));
- 
-+    ret = kvm_arch_pre_create_vcpu(cpu, errp);
-+    if (ret < 0) {
-+        goto err;
-+    }
-+
-     ret = kvm_create_vcpu(cpu);
-     if (ret < 0) {
-         error_setg_errno(errp, -ret,
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
-index d9ad723f78..0e6b29b331 100644
---- a/include/sysemu/kvm.h
-+++ b/include/sysemu/kvm.h
-@@ -374,6 +374,7 @@ int kvm_arch_get_default_type(MachineState *ms);
- 
- int kvm_arch_init(MachineState *ms, KVMState *s);
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp);
- int kvm_arch_init_vcpu(CPUState *cpu);
- int kvm_arch_destroy_vcpu(CPUState *cpu);
- 
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-index f1f1b5b375..e0469e7831 100644
---- a/target/arm/kvm.c
-+++ b/target/arm/kvm.c
-@@ -1860,6 +1860,11 @@ static int kvm_arm_sve_set_vls(ARMCPU *cpu)
- 
- #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     int ret;
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index bf4493dd84..1fddec6b9c 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -2039,6 +2039,11 @@ full:
-     abort();
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     struct {
-diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
-index 9204d4295d..f6e20dbc61 100644
---- a/target/loongarch/kvm/kvm.c
-+++ b/target/loongarch/kvm/kvm.c
-@@ -663,6 +663,11 @@ static void kvm_loongarch_vm_stage_change(void *opaque, bool running,
-     }
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     uint64_t val;
-diff --git a/target/mips/kvm.c b/target/mips/kvm.c
-index a98798c669..75058f8938 100644
---- a/target/mips/kvm.c
-+++ b/target/mips/kvm.c
-@@ -61,6 +61,11 @@ int kvm_arch_irqchip_create(KVMState *s)
-     return 0;
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     CPUMIPSState *env = cpu_env(cs);
-diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 7daa097164..7a86d09802 100644
---- a/target/ppc/kvm.c
-+++ b/target/ppc/kvm.c
-@@ -479,6 +479,11 @@ static void kvmppc_hw_debug_points_init(CPUPPCState *cenv)
-     }
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     PowerPCCPU *cpu = POWERPC_CPU(cs);
-diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
-index 2bfb112be0..18ab470549 100644
---- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/kvm/kvm-cpu.c
-@@ -1355,6 +1355,11 @@ static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
-     return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     int ret = 0;
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index afc8d570c9..3273beff18 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -408,6 +408,11 @@ unsigned long kvm_arch_vcpu_id(CPUState *cpu)
-     return cpu->cpu_index;
- }
- 
-+int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
-+{
-+    return 0;
-+}
-+
- int kvm_arch_init_vcpu(CPUState *cs)
- {
-     unsigned int max_cpus = MACHINE(qdev_get_machine())->smp.max_cpus;
--- 
-2.50.1
-
diff --git a/kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch b/kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch
deleted file mode 100644
index c65a3f5..0000000
--- a/kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From e1658c60f353f93b195fb6f569cb44a5fb1f3e99 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:43 +0200
-Subject: [PATCH 003/115] kvm/i386: make kvm_filter_msr() and related
- definitions private to kvm module
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [3/115] ef00896ed2cac6bc1ef39f21aad422ae5b571cb6 (bonzini/rhel-qemu-kvm)
-
-kvm_filer_msr() is only used from i386 kvm module. Make it static so that its
-easy for developers to understand that its not used anywhere else.
-Same for QEMURDMSRHandler, QEMUWRMSRHandler and KVMMSRHandlers definitions.
-
-CC: philmd@linaro.org
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Ani Sinha <anisinha@redhat.com>
-Link: https://lore.kernel.org/r/20240903140045.41167-1-anisinha@redhat.com
-[Make struct unnamed. - Paolo]
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit ed2880f4e93bf83106ebdc8562a5ee4d93285a3b)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm.c      | 12 +++++++++++-
- target/i386/kvm/kvm_i386.h | 11 -----------
- 2 files changed, 11 insertions(+), 12 deletions(-)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 94b678e9e3..b02aec915c 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -92,7 +92,17 @@
-  * 255 kvm_msr_entry structs */
- #define MSR_BUF_SIZE 4096
- 
-+typedef bool QEMURDMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t *val);
-+typedef bool QEMUWRMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t val);
-+typedef struct {
-+    uint32_t msr;
-+    QEMURDMSRHandler *rdmsr;
-+    QEMUWRMSRHandler *wrmsr;
-+} KVMMSRHandlers;
-+
- static void kvm_init_msrs(X86CPU *cpu);
-+static bool kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
-+                           QEMUWRMSRHandler *wrmsr);
- 
- const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
-     KVM_CAP_INFO(SET_TSS_ADDR),
-@@ -5762,7 +5772,7 @@ static bool kvm_install_msr_filters(KVMState *s)
-     return true;
- }
- 
--bool kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
-+static bool kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
-                     QEMUWRMSRHandler *wrmsr)
- {
-     int i;
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index 34fc60774b..9de9c0d303 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -66,17 +66,6 @@ uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address);
- void kvm_update_msi_routes_all(void *private, bool global,
-                                uint32_t index, uint32_t mask);
- 
--typedef bool QEMURDMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t *val);
--typedef bool QEMUWRMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t val);
--typedef struct kvm_msr_handlers {
--    uint32_t msr;
--    QEMURDMSRHandler *rdmsr;
--    QEMUWRMSRHandler *wrmsr;
--} KVMMSRHandlers;
--
--bool kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
--                    QEMUWRMSRHandler *wrmsr);
--
- #endif /* CONFIG_KVM */
- 
- void kvm_pc_setup_irq_routing(bool pci_enabled);
--- 
-2.50.1
-
diff --git a/kvm-kvm-refactor-core-virtual-machine-creation-into-its-.patch b/kvm-kvm-refactor-core-virtual-machine-creation-into-its-.patch
deleted file mode 100644
index b4ed917..0000000
--- a/kvm-kvm-refactor-core-virtual-machine-creation-into-its-.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 90a18a9e2e585413eba96ab96df4a878f6c405be Mon Sep 17 00:00:00 2001
-From: Ani Sinha <anisinha@redhat.com>
-Date: Thu, 8 Aug 2024 17:08:38 +0530
-Subject: [PATCH 3/9] kvm: refactor core virtual machine creation into its own
- function
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [2/7] 3db75ee31b109048ef2de5c7f193116ab8c185a7 (peterx/qemu-kvm)
-
-Refactoring the core logic around KVM_CREATE_VM into its own separate function
-so that it can be called from other functions in subsequent patches. There is
-no functional change in this patch.
-
-CC: pbonzini@redhat.com
-CC: zhao1.liu@intel.com
-Signed-off-by: Ani Sinha <anisinha@redhat.com>
-Link: https://lore.kernel.org/r/20240808113838.1697366-1-anisinha@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 67388078da1cf6dac89e5a7c748cca3444d49690)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c | 89 ++++++++++++++++++++++++++++-----------------
- 1 file changed, 56 insertions(+), 33 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index b51441523d..4f96d8b45e 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2385,6 +2385,60 @@ uint32_t kvm_dirty_ring_size(void)
-     return kvm_state->kvm_dirty_ring_size;
- }
- 
-+static int do_kvm_create_vm(MachineState *ms, int type)
-+{
-+    KVMState *s;
-+    int ret;
-+
-+    s = KVM_STATE(ms->accelerator);
-+
-+    do {
-+        ret = kvm_ioctl(s, KVM_CREATE_VM, type);
-+    } while (ret == -EINTR);
-+
-+    if (ret < 0) {
-+        error_report("ioctl(KVM_CREATE_VM) failed: %s", strerror(-ret));
-+
-+#ifdef TARGET_S390X
-+        if (ret == -EINVAL) {
-+            error_printf("Host kernel setup problem detected."
-+                         " Please verify:\n");
-+            error_printf("- for kernels supporting the"
-+                        " switch_amode or user_mode parameters, whether");
-+            error_printf(" user space is running in primary address space\n");
-+            error_printf("- for kernels supporting the vm.allocate_pgste"
-+                         " sysctl, whether it is enabled\n");
-+        }
-+#elif defined(TARGET_PPC)
-+        if (ret == -EINVAL) {
-+            error_printf("PPC KVM module is not loaded. Try modprobe kvm_%s.\n",
-+                         (type == 2) ? "pr" : "hv");
-+        }
-+#endif
-+    }
-+
-+    return ret;
-+}
-+
-+static int find_kvm_machine_type(MachineState *ms)
-+{
-+    MachineClass *mc = MACHINE_GET_CLASS(ms);
-+    int type;
-+
-+    if (object_property_find(OBJECT(current_machine), "kvm-type")) {
-+        g_autofree char *kvm_type;
-+        kvm_type = object_property_get_str(OBJECT(current_machine),
-+                                           "kvm-type",
-+                                           &error_abort);
-+        type = mc->kvm_type(ms, kvm_type);
-+    } else if (mc->kvm_type) {
-+        type = mc->kvm_type(ms, NULL);
-+    } else {
-+        type = kvm_arch_get_default_type(ms);
-+    }
-+    return type;
-+}
-+
- static int kvm_init(MachineState *ms)
- {
-     MachineClass *mc = MACHINE_GET_CLASS(ms);
-@@ -2467,45 +2521,14 @@ static int kvm_init(MachineState *ms)
-     }
-     s->as = g_new0(struct KVMAs, s->nr_as);
- 
--    if (object_property_find(OBJECT(current_machine), "kvm-type")) {
--        g_autofree char *kvm_type = object_property_get_str(OBJECT(current_machine),
--                                                            "kvm-type",
--                                                            &error_abort);
--        type = mc->kvm_type(ms, kvm_type);
--    } else if (mc->kvm_type) {
--        type = mc->kvm_type(ms, NULL);
--    } else {
--        type = kvm_arch_get_default_type(ms);
--    }
--
-+    type = find_kvm_machine_type(ms);
-     if (type < 0) {
-         ret = -EINVAL;
-         goto err;
-     }
- 
--    do {
--        ret = kvm_ioctl(s, KVM_CREATE_VM, type);
--    } while (ret == -EINTR);
--
-+    ret = do_kvm_create_vm(ms, type);
-     if (ret < 0) {
--        error_report("ioctl(KVM_CREATE_VM) failed: %s", strerror(-ret));
--
--#ifdef TARGET_S390X
--        if (ret == -EINVAL) {
--            error_printf("Host kernel setup problem detected."
--                         " Please verify:\n");
--            error_printf("- for kernels supporting the"
--                        " switch_amode or user_mode parameters, whether");
--            error_printf(" user space is running in primary address space\n");
--            error_printf("- for kernels supporting the vm.allocate_pgste"
--                         " sysctl, whether it is enabled\n");
--        }
--#elif defined(TARGET_PPC)
--        if (ret == -EINVAL) {
--            error_printf("PPC KVM module is not loaded. Try modprobe kvm_%s.\n",
--                         (type == 2) ? "pr" : "hv");
--        }
--#endif
-         goto err;
-     }
- 
--- 
-2.39.3
-
diff --git a/kvm-kvm-remove-unnecessary-ifdef.patch b/kvm-kvm-remove-unnecessary-ifdef.patch
deleted file mode 100644
index a474ebe..0000000
--- a/kvm-kvm-remove-unnecessary-ifdef.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From be25ddc3910de08325880177c16d4f0c38feeb73 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:43 +0200
-Subject: [PATCH 004/115] kvm: remove unnecessary #ifdef
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [4/115] c7a7b57246c2c345961d5b5923f8b086c58b82c6 (bonzini/rhel-qemu-kvm)
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit feccfa77bed975e2e60c90756f08b8a56df6daf6)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/kvm_i386.h | 11 +----------
- 1 file changed, 1 insertion(+), 10 deletions(-)
-
-diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
-index 9de9c0d303..7edb154a16 100644
---- a/target/i386/kvm/kvm_i386.h
-+++ b/target/i386/kvm/kvm_i386.h
-@@ -13,8 +13,7 @@
- 
- #include "sysemu/kvm.h"
- 
--#ifdef CONFIG_KVM
--
-+/* always false if !CONFIG_KVM */
- #define kvm_pit_in_kernel() \
-     (kvm_irqchip_in_kernel() && !kvm_irqchip_is_split())
- #define kvm_pic_in_kernel()  \
-@@ -22,14 +21,6 @@
- #define kvm_ioapic_in_kernel() \
-     (kvm_irqchip_in_kernel() && !kvm_irqchip_is_split())
- 
--#else
--
--#define kvm_pit_in_kernel()      0
--#define kvm_pic_in_kernel()      0
--#define kvm_ioapic_in_kernel()   0
--
--#endif  /* CONFIG_KVM */
--
- bool kvm_has_smm(void);
- bool kvm_enable_x2apic(void);
- bool kvm_hv_vpindex_settable(void);
--- 
-2.50.1
-
diff --git a/kvm-kvm-replace-fprintf-with-error_report-printf-in-kvm_.patch b/kvm-kvm-replace-fprintf-with-error_report-printf-in-kvm_.patch
deleted file mode 100644
index 3ebe06d..0000000
--- a/kvm-kvm-replace-fprintf-with-error_report-printf-in-kvm_.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From 66c634c4749d58c0c3644ace27a656c507433288 Mon Sep 17 00:00:00 2001
-From: Ani Sinha <anisinha@redhat.com>
-Date: Wed, 28 Aug 2024 18:15:39 +0530
-Subject: [PATCH 2/9] kvm: replace fprintf with error_report()/printf() in
- kvm_init()
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 284: KVM: Dynamic sized kvm memslots array
-RH-Jira: RHEL-57682
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [1/7] 3dd0b67d3b6662001eb35201ca41b15d0dd97994 (peterx/qemu-kvm)
-
-error_report() is more appropriate for error situations. Replace fprintf with
-error_report() and error_printf() as appropriate. Some improvement in error
-reporting also happens as a part of this change. For example:
-
-From:
-$ ./qemu-system-x86_64 --accel kvm
-Could not access KVM kernel module: No such file or directory
-
-To:
-$ ./qemu-system-x86_64 --accel kvm
-qemu-system-x86_64: --accel kvm: Could not access KVM kernel module: No such file or directory
-
-CC: qemu-trivial@nongnu.org
-CC: zhao1.liu@intel.com
-CC: armbru@redhat.com
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Ani Sinha <anisinha@redhat.com>
-Link: https://lore.kernel.org/r/20240828124539.62672-1-anisinha@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 804dfbe3ef5e950328b162ae85741be2e228544f)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- accel/kvm/kvm-all.c | 40 ++++++++++++++++++----------------------
- 1 file changed, 18 insertions(+), 22 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index a220178822..b51441523d 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2427,7 +2427,7 @@ static int kvm_init(MachineState *ms)
-     QLIST_INIT(&s->kvm_parked_vcpus);
-     s->fd = qemu_open_old(s->device ?: "/dev/kvm", O_RDWR);
-     if (s->fd == -1) {
--        fprintf(stderr, "Could not access KVM kernel module: %m\n");
-+        error_report("Could not access KVM kernel module: %m");
-         ret = -errno;
-         goto err;
-     }
-@@ -2437,13 +2437,13 @@ static int kvm_init(MachineState *ms)
-         if (ret >= 0) {
-             ret = -EINVAL;
-         }
--        fprintf(stderr, "kvm version too old\n");
-+        error_report("kvm version too old");
-         goto err;
-     }
- 
-     if (ret > KVM_API_VERSION) {
-         ret = -EINVAL;
--        fprintf(stderr, "kvm version not supported\n");
-+        error_report("kvm version not supported");
-         goto err;
-     }
- 
-@@ -2488,26 +2488,22 @@ static int kvm_init(MachineState *ms)
-     } while (ret == -EINTR);
- 
-     if (ret < 0) {
--        fprintf(stderr, "ioctl(KVM_CREATE_VM) failed: %d %s\n", -ret,
--                strerror(-ret));
-+        error_report("ioctl(KVM_CREATE_VM) failed: %s", strerror(-ret));
- 
- #ifdef TARGET_S390X
-         if (ret == -EINVAL) {
--            fprintf(stderr,
--                    "Host kernel setup problem detected. Please verify:\n");
--            fprintf(stderr, "- for kernels supporting the switch_amode or"
--                    " user_mode parameters, whether\n");
--            fprintf(stderr,
--                    "  user space is running in primary address space\n");
--            fprintf(stderr,
--                    "- for kernels supporting the vm.allocate_pgste sysctl, "
--                    "whether it is enabled\n");
-+            error_printf("Host kernel setup problem detected."
-+                         " Please verify:\n");
-+            error_printf("- for kernels supporting the"
-+                        " switch_amode or user_mode parameters, whether");
-+            error_printf(" user space is running in primary address space\n");
-+            error_printf("- for kernels supporting the vm.allocate_pgste"
-+                         " sysctl, whether it is enabled\n");
-         }
- #elif defined(TARGET_PPC)
-         if (ret == -EINVAL) {
--            fprintf(stderr,
--                    "PPC KVM module is not loaded. Try modprobe kvm_%s.\n",
--                    (type == 2) ? "pr" : "hv");
-+            error_printf("PPC KVM module is not loaded. Try modprobe kvm_%s.\n",
-+                         (type == 2) ? "pr" : "hv");
-         }
- #endif
-         goto err;
-@@ -2526,9 +2522,9 @@ static int kvm_init(MachineState *ms)
-                         nc->name, nc->num, soft_vcpus_limit);
- 
-             if (nc->num > hard_vcpus_limit) {
--                fprintf(stderr, "Number of %s cpus requested (%d) exceeds "
--                        "the maximum cpus supported by KVM (%d)\n",
--                        nc->name, nc->num, hard_vcpus_limit);
-+                error_report("Number of %s cpus requested (%d) exceeds "
-+                             "the maximum cpus supported by KVM (%d)",
-+                             nc->name, nc->num, hard_vcpus_limit);
-                 exit(1);
-             }
-         }
-@@ -2542,8 +2538,8 @@ static int kvm_init(MachineState *ms)
-     }
-     if (missing_cap) {
-         ret = -EINVAL;
--        fprintf(stderr, "kvm does not support %s\n%s",
--                missing_cap->name, upgrade_note);
-+        error_report("kvm does not support %s", missing_cap->name);
-+        error_printf("%s", upgrade_note);
-         goto err;
-     }
- 
--- 
-2.39.3
-
diff --git a/kvm-linux-headers-Update-to-Linux-6.13-rc1.patch b/kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
deleted file mode 100644
index e5f0642..0000000
--- a/kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
+++ /dev/null
@@ -1,1099 +0,0 @@
-From 1b3ac759d88c02b43c3b649f72f70f8ca6df2fab Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:42 +0100
-Subject: [PATCH 07/19] linux-headers: Update to Linux 6.13-rc1
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [7/16] 66249db1edfa93b4b5c2ae8afbb879f59568443c (thuth/qemu-kvm-cs9)
-
-This linux headers update includes required changes for
-the gen17 CPU model.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Suggested-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241206122751.189721-7-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 44fe383c274174405da79f5fcb028e39fe688036)
----
- include/standard-headers/drm/drm_fourcc.h     |   1 +
- include/standard-headers/linux/ethtool.h      |   5 +
- include/standard-headers/linux/pci_regs.h     |  38 ++-
- .../standard-headers/linux/virtio_crypto.h    |   1 +
- include/standard-headers/linux/virtio_pci.h   | 131 ++++++++++
- linux-headers/asm-arm64/kvm.h                 |   6 +
- linux-headers/asm-arm64/unistd_64.h           |   4 +
- linux-headers/asm-generic/mman-common.h       |   3 +
- linux-headers/asm-generic/mman.h              |   4 +
- linux-headers/asm-generic/unistd.h            |  11 +-
- linux-headers/asm-loongarch/kvm.h             |  20 ++
- linux-headers/asm-loongarch/unistd_64.h       |   4 +
- linux-headers/asm-mips/mman.h                 |   3 +
- linux-headers/asm-mips/unistd_n32.h           |   4 +
- linux-headers/asm-mips/unistd_n64.h           |   4 +
- linux-headers/asm-mips/unistd_o32.h           |   4 +
- linux-headers/asm-powerpc/unistd_32.h         |   4 +
- linux-headers/asm-powerpc/unistd_64.h         |   4 +
- linux-headers/asm-riscv/kvm.h                 |   4 +
- linux-headers/asm-riscv/unistd_32.h           |   4 +
- linux-headers/asm-riscv/unistd_64.h           |   4 +
- linux-headers/asm-s390/kvm.h                  |   3 +-
- linux-headers/asm-s390/unistd_32.h            |   4 +
- linux-headers/asm-s390/unistd_64.h            |   4 +
- linux-headers/asm-x86/kvm.h                   |   1 +
- linux-headers/asm-x86/mman.h                  |   3 -
- linux-headers/asm-x86/unistd_32.h             |   4 +
- linux-headers/asm-x86/unistd_64.h             |   4 +
- linux-headers/asm-x86/unistd_x32.h            |   4 +
- linux-headers/linux/iommufd.h                 | 224 +++++++++++++++++-
- linux-headers/linux/kvm.h                     |   8 +
- linux-headers/linux/psci.h                    |   5 +
- linux-headers/linux/vfio.h                    |   2 +-
- 33 files changed, 506 insertions(+), 23 deletions(-)
-
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
-index d4a2231306..708647776f 100644
---- a/include/standard-headers/drm/drm_fourcc.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
-@@ -1515,6 +1515,7 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
-  * 64K_D_2D on GFX12 is identical to 64K_D on GFX11.
-  */
- #define AMD_FMT_MOD_TILE_GFX9_64K_D 10
-+#define AMD_FMT_MOD_TILE_GFX9_4K_D_X 22
- #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
- #define AMD_FMT_MOD_TILE_GFX9_64K_D_X 26
- #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
-index b05e84825b..67c47912e5 100644
---- a/include/standard-headers/linux/ethtool.h
-+++ b/include/standard-headers/linux/ethtool.h
-@@ -2526,6 +2526,11 @@ struct ethtool_link_settings {
- 	uint8_t	master_slave_state;
- 	uint8_t	rate_matching;
- 	uint32_t	reserved[7];
-+	/* Linux builds with -Wflex-array-member-not-at-end but does
-+	 * not use the "link_mode_masks" member. Leave it defined for
-+	 * userspace for now, and when userspace wants to start using
-+	 * -Wfamnae, we'll need a new solution.
-+	 */
- 	uint32_t	link_mode_masks[];
- 	/* layout of link_mode_masks fields:
- 	 * uint32_t map_supported[link_mode_masks_nwords];
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index 12323b3334..1601c7ed5f 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -340,7 +340,8 @@
- #define PCI_MSIX_ENTRY_UPPER_ADDR	0x4  /* Message Upper Address */
- #define PCI_MSIX_ENTRY_DATA		0x8  /* Message Data */
- #define PCI_MSIX_ENTRY_VECTOR_CTRL	0xc  /* Vector Control */
--#define  PCI_MSIX_ENTRY_CTRL_MASKBIT	0x00000001
-+#define  PCI_MSIX_ENTRY_CTRL_MASKBIT	0x00000001  /* Mask Bit */
-+#define  PCI_MSIX_ENTRY_CTRL_ST		0xffff0000  /* Steering Tag */
- 
- /* CompactPCI Hotswap Register */
- 
-@@ -659,6 +660,7 @@
- #define  PCI_EXP_DEVCAP2_ATOMIC_COMP64	0x00000100 /* 64b AtomicOp completion */
- #define  PCI_EXP_DEVCAP2_ATOMIC_COMP128	0x00000200 /* 128b AtomicOp completion */
- #define  PCI_EXP_DEVCAP2_LTR		0x00000800 /* Latency tolerance reporting */
-+#define  PCI_EXP_DEVCAP2_TPH_COMP_MASK	0x00003000 /* TPH completer support */
- #define  PCI_EXP_DEVCAP2_OBFF_MASK	0x000c0000 /* OBFF support mechanism */
- #define  PCI_EXP_DEVCAP2_OBFF_MSG	0x00040000 /* New message signaling */
- #define  PCI_EXP_DEVCAP2_OBFF_WAKE	0x00080000 /* Re-use WAKE# for OBFF */
-@@ -678,6 +680,7 @@
- #define PCI_EXP_DEVSTA2		0x2a	/* Device Status 2 */
- #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V2 0x2c	/* end of v2 EPs w/o link */
- #define PCI_EXP_LNKCAP2		0x2c	/* Link Capabilities 2 */
-+#define  PCI_EXP_LNKCAP2_SLS		0x000000fe /* Supported Link Speeds Vector */
- #define  PCI_EXP_LNKCAP2_SLS_2_5GB	0x00000002 /* Supported Speed 2.5GT/s */
- #define  PCI_EXP_LNKCAP2_SLS_5_0GB	0x00000004 /* Supported Speed 5GT/s */
- #define  PCI_EXP_LNKCAP2_SLS_8_0GB	0x00000008 /* Supported Speed 8GT/s */
-@@ -1023,15 +1026,34 @@
- #define  PCI_DPA_CAP_SUBSTATE_MASK	0x1F	/* # substates - 1 */
- #define PCI_DPA_BASE_SIZEOF	16	/* size with 0 substates */
- 
-+/* TPH Completer Support */
-+#define PCI_EXP_DEVCAP2_TPH_COMP_NONE		0x0 /* None */
-+#define PCI_EXP_DEVCAP2_TPH_COMP_TPH_ONLY	0x1 /* TPH only */
-+#define PCI_EXP_DEVCAP2_TPH_COMP_EXT_TPH	0x3 /* TPH and Extended TPH */
-+
- /* TPH Requester */
- #define PCI_TPH_CAP		4	/* capability register */
--#define  PCI_TPH_CAP_LOC_MASK	0x600	/* location mask */
--#define   PCI_TPH_LOC_NONE	0x000	/* no location */
--#define   PCI_TPH_LOC_CAP	0x200	/* in capability */
--#define   PCI_TPH_LOC_MSIX	0x400	/* in MSI-X */
--#define PCI_TPH_CAP_ST_MASK	0x07FF0000	/* ST table mask */
--#define PCI_TPH_CAP_ST_SHIFT	16	/* ST table shift */
--#define PCI_TPH_BASE_SIZEOF	0xc	/* size with no ST table */
-+#define  PCI_TPH_CAP_ST_NS	0x00000001 /* No ST Mode Supported */
-+#define  PCI_TPH_CAP_ST_IV	0x00000002 /* Interrupt Vector Mode Supported */
-+#define  PCI_TPH_CAP_ST_DS	0x00000004 /* Device Specific Mode Supported */
-+#define  PCI_TPH_CAP_EXT_TPH	0x00000100 /* Ext TPH Requester Supported */
-+#define  PCI_TPH_CAP_LOC_MASK	0x00000600 /* ST Table Location */
-+#define   PCI_TPH_LOC_NONE	0x00000000 /* Not present */
-+#define   PCI_TPH_LOC_CAP	0x00000200 /* In capability */
-+#define   PCI_TPH_LOC_MSIX	0x00000400 /* In MSI-X */
-+#define  PCI_TPH_CAP_ST_MASK	0x07FF0000 /* ST Table Size */
-+#define  PCI_TPH_CAP_ST_SHIFT	16	/* ST Table Size shift */
-+#define PCI_TPH_BASE_SIZEOF	0xc	/* Size with no ST table */
-+
-+#define PCI_TPH_CTRL		8	/* control register */
-+#define  PCI_TPH_CTRL_MODE_SEL_MASK	0x00000007 /* ST Mode Select */
-+#define   PCI_TPH_ST_NS_MODE		0x0 /* No ST Mode */
-+#define   PCI_TPH_ST_IV_MODE		0x1 /* Interrupt Vector Mode */
-+#define   PCI_TPH_ST_DS_MODE		0x2 /* Device Specific Mode */
-+#define  PCI_TPH_CTRL_REQ_EN_MASK	0x00000300 /* TPH Requester Enable */
-+#define   PCI_TPH_REQ_DISABLE		0x0 /* No TPH requests allowed */
-+#define   PCI_TPH_REQ_TPH_ONLY		0x1 /* TPH only requests allowed */
-+#define   PCI_TPH_REQ_EXT_TPH		0x3 /* Extended TPH requests allowed */
- 
- /* Downstream Port Containment */
- #define PCI_EXP_DPC_CAP			0x04	/* DPC Capability */
-diff --git a/include/standard-headers/linux/virtio_crypto.h b/include/standard-headers/linux/virtio_crypto.h
-index 68066dafb6..4d350ae595 100644
---- a/include/standard-headers/linux/virtio_crypto.h
-+++ b/include/standard-headers/linux/virtio_crypto.h
-@@ -329,6 +329,7 @@ struct virtio_crypto_op_header {
- 	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x00)
- #define VIRTIO_CRYPTO_AKCIPHER_DECRYPT \
- 	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x01)
-+	/* akcipher sign/verify opcodes are deprecated */
- #define VIRTIO_CRYPTO_AKCIPHER_SIGN \
- 	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x02)
- #define VIRTIO_CRYPTO_AKCIPHER_VERIFY \
-diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
-index 4010216103..b177ed8972 100644
---- a/include/standard-headers/linux/virtio_pci.h
-+++ b/include/standard-headers/linux/virtio_pci.h
-@@ -40,6 +40,7 @@
- #define _LINUX_VIRTIO_PCI_H
- 
- #include "standard-headers/linux/types.h"
-+#include "standard-headers/linux/kernel.h"
- 
- #ifndef VIRTIO_PCI_NO_LEGACY
- 
-@@ -240,6 +241,17 @@ struct virtio_pci_cfg_cap {
- #define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_READ		0x5
- #define VIRTIO_ADMIN_CMD_LEGACY_NOTIFY_INFO		0x6
- 
-+/* Device parts access commands. */
-+#define VIRTIO_ADMIN_CMD_CAP_ID_LIST_QUERY		0x7
-+#define VIRTIO_ADMIN_CMD_DEVICE_CAP_GET			0x8
-+#define VIRTIO_ADMIN_CMD_DRIVER_CAP_SET			0x9
-+#define VIRTIO_ADMIN_CMD_RESOURCE_OBJ_CREATE		0xa
-+#define VIRTIO_ADMIN_CMD_RESOURCE_OBJ_DESTROY		0xd
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_METADATA_GET		0xe
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_GET			0xf
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_SET			0x10
-+#define VIRTIO_ADMIN_CMD_DEV_MODE_SET			0x11
-+
- struct virtio_admin_cmd_hdr {
- 	uint16_t opcode;
- 	/*
-@@ -286,4 +298,123 @@ struct virtio_admin_cmd_notify_info_result {
- 	struct virtio_admin_cmd_notify_info_data entries[VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO];
- };
- 
-+#define VIRTIO_DEV_PARTS_CAP 0x0000
-+
-+struct virtio_dev_parts_cap {
-+	uint8_t get_parts_resource_objects_limit;
-+	uint8_t set_parts_resource_objects_limit;
-+};
-+
-+#define MAX_CAP_ID __KERNEL_DIV_ROUND_UP(VIRTIO_DEV_PARTS_CAP + 1, 64)
-+
-+struct virtio_admin_cmd_query_cap_id_result {
-+	uint64_t supported_caps[MAX_CAP_ID];
-+};
-+
-+struct virtio_admin_cmd_cap_get_data {
-+	uint16_t id;
-+	uint8_t reserved[6];
-+};
-+
-+struct virtio_admin_cmd_cap_set_data {
-+	uint16_t id;
-+	uint8_t reserved[6];
-+	uint8_t cap_specific_data[];
-+};
-+
-+struct virtio_admin_cmd_resource_obj_cmd_hdr {
-+	uint16_t type;
-+	uint8_t reserved[2];
-+	uint32_t id; /* Indicates unique resource object id per resource object type */
-+};
-+
-+struct virtio_admin_cmd_resource_obj_create_data {
-+	struct virtio_admin_cmd_resource_obj_cmd_hdr hdr;
-+	uint64_t flags;
-+	uint8_t resource_obj_specific_data[];
-+};
-+
-+#define VIRTIO_RESOURCE_OBJ_DEV_PARTS 0
-+
-+#define VIRTIO_RESOURCE_OBJ_DEV_PARTS_TYPE_GET 0
-+#define VIRTIO_RESOURCE_OBJ_DEV_PARTS_TYPE_SET 1
-+
-+struct virtio_resource_obj_dev_parts {
-+	uint8_t type;
-+	uint8_t reserved[7];
-+};
-+
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_METADATA_TYPE_SIZE 0
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_METADATA_TYPE_COUNT 1
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_METADATA_TYPE_LIST 2
-+
-+struct virtio_admin_cmd_dev_parts_metadata_data {
-+	struct virtio_admin_cmd_resource_obj_cmd_hdr hdr;
-+	uint8_t type;
-+	uint8_t reserved[7];
-+};
-+
-+#define VIRTIO_DEV_PART_F_OPTIONAL 0
-+
-+struct virtio_dev_part_hdr {
-+	uint16_t part_type;
-+	uint8_t flags;
-+	uint8_t reserved;
-+	union {
-+		struct {
-+			uint32_t offset;
-+			uint32_t reserved;
-+		} pci_common_cfg;
-+		struct {
-+			uint16_t index;
-+			uint8_t reserved[6];
-+		} vq_index;
-+	} selector;
-+	uint32_t length;
-+};
-+
-+struct virtio_dev_part {
-+	struct virtio_dev_part_hdr hdr;
-+	uint8_t value[];
-+};
-+
-+struct virtio_admin_cmd_dev_parts_metadata_result {
-+	union {
-+		struct {
-+			uint32_t size;
-+			uint32_t reserved;
-+		} parts_size;
-+		struct {
-+			uint32_t count;
-+			uint32_t reserved;
-+		} hdr_list_count;
-+		struct {
-+			uint32_t count;
-+			uint32_t reserved;
-+			struct virtio_dev_part_hdr hdrs[];
-+		} hdr_list;
-+	};
-+};
-+
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_GET_TYPE_SELECTED 0
-+#define VIRTIO_ADMIN_CMD_DEV_PARTS_GET_TYPE_ALL 1
-+
-+struct virtio_admin_cmd_dev_parts_get_data {
-+	struct virtio_admin_cmd_resource_obj_cmd_hdr hdr;
-+	uint8_t type;
-+	uint8_t reserved[7];
-+	struct virtio_dev_part_hdr hdr_list[];
-+};
-+
-+struct virtio_admin_cmd_dev_parts_set_data {
-+	struct virtio_admin_cmd_resource_obj_cmd_hdr hdr;
-+	struct virtio_dev_part parts[];
-+};
-+
-+#define VIRTIO_ADMIN_CMD_DEV_MODE_F_STOPPED 0
-+
-+struct virtio_admin_cmd_dev_mode_set_data {
-+	uint8_t flags;
-+};
-+
- #endif
-diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
-index 2af9931ae9..dccd5d965f 100644
---- a/linux-headers/asm-arm64/kvm.h
-+++ b/linux-headers/asm-arm64/kvm.h
-@@ -473,6 +473,12 @@ enum {
-  */
- #define KVM_SYSTEM_EVENT_RESET_FLAG_PSCI_RESET2	(1ULL << 0)
- 
-+/*
-+ * Shutdown caused by a PSCI v1.3 SYSTEM_OFF2 call.
-+ * Valid only when the system event has a type of KVM_SYSTEM_EVENT_SHUTDOWN.
-+ */
-+#define KVM_SYSTEM_EVENT_SHUTDOWN_FLAG_PSCI_OFF2	(1ULL << 0)
-+
- /* run->fail_entry.hardware_entry_failure_reason codes. */
- #define KVM_EXIT_FAIL_ENTRY_CPU_UNSUPPORTED	(1ULL << 0)
- 
-diff --git a/linux-headers/asm-arm64/unistd_64.h b/linux-headers/asm-arm64/unistd_64.h
-index 99a1d70459..d4e90fff76 100644
---- a/linux-headers/asm-arm64/unistd_64.h
-+++ b/linux-headers/asm-arm64/unistd_64.h
-@@ -319,6 +319,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-generic/mman-common.h b/linux-headers/asm-generic/mman-common.h
-index 6ce1f1ceb4..1ea2c4c33b 100644
---- a/linux-headers/asm-generic/mman-common.h
-+++ b/linux-headers/asm-generic/mman-common.h
-@@ -79,6 +79,9 @@
- 
- #define MADV_COLLAPSE	25		/* Synchronous hugepage collapse */
- 
-+#define MADV_GUARD_INSTALL 102		/* fatal signal on access to range */
-+#define MADV_GUARD_REMOVE 103		/* unguard range */
-+
- /* compatibility flags */
- #define MAP_FILE	0
- 
-diff --git a/linux-headers/asm-generic/mman.h b/linux-headers/asm-generic/mman.h
-index 57e8195d0b..5e3d61ddbd 100644
---- a/linux-headers/asm-generic/mman.h
-+++ b/linux-headers/asm-generic/mman.h
-@@ -19,4 +19,8 @@
- #define MCL_FUTURE	2		/* lock all future mappings */
- #define MCL_ONFAULT	4		/* lock all pages that are faulted in */
- 
-+#define SHADOW_STACK_SET_TOKEN (1ULL << 0)     /* Set up a restore token in the shadow stack */
-+#define SHADOW_STACK_SET_MARKER (1ULL << 1)     /* Set up a top of stack marker in the shadow stack */
-+
-+
- #endif /* __ASM_GENERIC_MMAN_H */
-diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
-index 5bf6148cac..88dc393c2b 100644
---- a/linux-headers/asm-generic/unistd.h
-+++ b/linux-headers/asm-generic/unistd.h
-@@ -841,8 +841,17 @@ __SYSCALL(__NR_lsm_list_modules, sys_lsm_list_modules)
- #define __NR_mseal 462
- __SYSCALL(__NR_mseal, sys_mseal)
- 
-+#define __NR_setxattrat 463
-+__SYSCALL(__NR_setxattrat, sys_setxattrat)
-+#define __NR_getxattrat 464
-+__SYSCALL(__NR_getxattrat, sys_getxattrat)
-+#define __NR_listxattrat 465
-+__SYSCALL(__NR_listxattrat, sys_listxattrat)
-+#define __NR_removexattrat 466
-+__SYSCALL(__NR_removexattrat, sys_removexattrat)
-+
- #undef __NR_syscalls
--#define __NR_syscalls 463
-+#define __NR_syscalls 467
- 
- /*
-  * 32 bit systems traditionally used different
-diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
-index 70d89070bf..5f354f5c68 100644
---- a/linux-headers/asm-loongarch/kvm.h
-+++ b/linux-headers/asm-loongarch/kvm.h
-@@ -8,6 +8,8 @@
- 
- #include <linux/types.h>
- 
-+#define __KVM_HAVE_IRQ_LINE
-+
- /*
-  * KVM LoongArch specific structures and definitions.
-  *
-@@ -132,4 +134,22 @@ struct kvm_iocsr_entry {
- #define KVM_IRQCHIP_NUM_PINS	64
- #define KVM_MAX_CORES		256
- 
-+#define KVM_DEV_LOONGARCH_IPI_GRP_REGS			0x40000001
-+
-+#define KVM_DEV_LOONGARCH_EXTIOI_GRP_REGS		0x40000002
-+
-+#define KVM_DEV_LOONGARCH_EXTIOI_GRP_SW_STATUS		0x40000003
-+#define KVM_DEV_LOONGARCH_EXTIOI_SW_STATUS_NUM_CPU	0x0
-+#define KVM_DEV_LOONGARCH_EXTIOI_SW_STATUS_FEATURE	0x1
-+#define KVM_DEV_LOONGARCH_EXTIOI_SW_STATUS_STATE	0x2
-+
-+#define KVM_DEV_LOONGARCH_EXTIOI_GRP_CTRL		0x40000004
-+#define KVM_DEV_LOONGARCH_EXTIOI_CTRL_INIT_NUM_CPU	0x0
-+#define KVM_DEV_LOONGARCH_EXTIOI_CTRL_INIT_FEATURE	0x1
-+#define KVM_DEV_LOONGARCH_EXTIOI_CTRL_LOAD_FINISHED	0x3
-+
-+#define KVM_DEV_LOONGARCH_PCH_PIC_GRP_REGS	        0x40000005
-+#define KVM_DEV_LOONGARCH_PCH_PIC_GRP_CTRL	        0x40000006
-+#define KVM_DEV_LOONGARCH_PCH_PIC_CTRL_INIT	        0
-+
- #endif /* __UAPI_ASM_LOONGARCH_KVM_H */
-diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
-index 887ea50cca..23fb96a8a7 100644
---- a/linux-headers/asm-loongarch/unistd_64.h
-+++ b/linux-headers/asm-loongarch/unistd_64.h
-@@ -315,6 +315,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-mips/mman.h b/linux-headers/asm-mips/mman.h
-index 9c48d9a21a..b700dae28c 100644
---- a/linux-headers/asm-mips/mman.h
-+++ b/linux-headers/asm-mips/mman.h
-@@ -105,6 +105,9 @@
- 
- #define MADV_COLLAPSE	25		/* Synchronous hugepage collapse */
- 
-+#define MADV_GUARD_INSTALL 102		/* fatal signal on access to range */
-+#define MADV_GUARD_REMOVE 103		/* unguard range */
-+
- /* compatibility flags */
- #define MAP_FILE	0
- 
-diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
-index fc93b3be30..9a75719644 100644
---- a/linux-headers/asm-mips/unistd_n32.h
-+++ b/linux-headers/asm-mips/unistd_n32.h
-@@ -391,5 +391,9 @@
- #define __NR_lsm_set_self_attr (__NR_Linux + 460)
- #define __NR_lsm_list_modules (__NR_Linux + 461)
- #define __NR_mseal (__NR_Linux + 462)
-+#define __NR_setxattrat (__NR_Linux + 463)
-+#define __NR_getxattrat (__NR_Linux + 464)
-+#define __NR_listxattrat (__NR_Linux + 465)
-+#define __NR_removexattrat (__NR_Linux + 466)
- 
- #endif /* _ASM_UNISTD_N32_H */
-diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
-index e72a3eb2c9..7086783b0c 100644
---- a/linux-headers/asm-mips/unistd_n64.h
-+++ b/linux-headers/asm-mips/unistd_n64.h
-@@ -367,5 +367,9 @@
- #define __NR_lsm_set_self_attr (__NR_Linux + 460)
- #define __NR_lsm_list_modules (__NR_Linux + 461)
- #define __NR_mseal (__NR_Linux + 462)
-+#define __NR_setxattrat (__NR_Linux + 463)
-+#define __NR_getxattrat (__NR_Linux + 464)
-+#define __NR_listxattrat (__NR_Linux + 465)
-+#define __NR_removexattrat (__NR_Linux + 466)
- 
- #endif /* _ASM_UNISTD_N64_H */
-diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
-index b86eb0786c..b3825823e4 100644
---- a/linux-headers/asm-mips/unistd_o32.h
-+++ b/linux-headers/asm-mips/unistd_o32.h
-@@ -437,5 +437,9 @@
- #define __NR_lsm_set_self_attr (__NR_Linux + 460)
- #define __NR_lsm_list_modules (__NR_Linux + 461)
- #define __NR_mseal (__NR_Linux + 462)
-+#define __NR_setxattrat (__NR_Linux + 463)
-+#define __NR_getxattrat (__NR_Linux + 464)
-+#define __NR_listxattrat (__NR_Linux + 465)
-+#define __NR_removexattrat (__NR_Linux + 466)
- 
- #endif /* _ASM_UNISTD_O32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
-index 28627b6546..38ee4dc35d 100644
---- a/linux-headers/asm-powerpc/unistd_32.h
-+++ b/linux-headers/asm-powerpc/unistd_32.h
-@@ -444,6 +444,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
-index 1fc42a8300..5e5f156834 100644
---- a/linux-headers/asm-powerpc/unistd_64.h
-+++ b/linux-headers/asm-powerpc/unistd_64.h
-@@ -416,6 +416,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-index e97db32964..3482c9a73d 100644
---- a/linux-headers/asm-riscv/kvm.h
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -175,6 +175,10 @@ enum KVM_RISCV_ISA_EXT_ID {
- 	KVM_RISCV_ISA_EXT_ZCF,
- 	KVM_RISCV_ISA_EXT_ZCMOP,
- 	KVM_RISCV_ISA_EXT_ZAWRS,
-+	KVM_RISCV_ISA_EXT_SMNPM,
-+	KVM_RISCV_ISA_EXT_SSNPM,
-+	KVM_RISCV_ISA_EXT_SVADE,
-+	KVM_RISCV_ISA_EXT_SVADU,
- 	KVM_RISCV_ISA_EXT_MAX,
- };
- 
-diff --git a/linux-headers/asm-riscv/unistd_32.h b/linux-headers/asm-riscv/unistd_32.h
-index 9625743dfd..74f6127aed 100644
---- a/linux-headers/asm-riscv/unistd_32.h
-+++ b/linux-headers/asm-riscv/unistd_32.h
-@@ -310,6 +310,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-riscv/unistd_64.h b/linux-headers/asm-riscv/unistd_64.h
-index 95bca8ae81..bb6a15a2ec 100644
---- a/linux-headers/asm-riscv/unistd_64.h
-+++ b/linux-headers/asm-riscv/unistd_64.h
-@@ -320,6 +320,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-s390/kvm.h b/linux-headers/asm-s390/kvm.h
-index 684c4e1205..ab5a6bce59 100644
---- a/linux-headers/asm-s390/kvm.h
-+++ b/linux-headers/asm-s390/kvm.h
-@@ -469,7 +469,8 @@ struct kvm_s390_vm_cpu_subfunc {
- 	__u8 kdsa[16];		/* with MSA9 */
- 	__u8 sortl[32];		/* with STFLE.150 */
- 	__u8 dfltcc[32];	/* with STFLE.151 */
--	__u8 reserved[1728];
-+	__u8 pfcr[16];		/* with STFLE.201 */
-+	__u8 reserved[1712];
- };
- 
- #define KVM_S390_VM_CPU_PROCESSOR_UV_FEAT_GUEST	6
-diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
-index 7706c21b87..620201cb36 100644
---- a/linux-headers/asm-s390/unistd_32.h
-+++ b/linux-headers/asm-s390/unistd_32.h
-@@ -435,5 +435,9 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- #endif /* _ASM_S390_UNISTD_32_H */
-diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
-index 62082d592d..e7e4a10aaf 100644
---- a/linux-headers/asm-s390/unistd_64.h
-+++ b/linux-headers/asm-s390/unistd_64.h
-@@ -383,5 +383,9 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- #endif /* _ASM_S390_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index 4711ef2c3d..96589490c4 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -438,6 +438,7 @@ struct kvm_sync_regs {
- #define KVM_X86_QUIRK_FIX_HYPERCALL_INSN	(1 << 5)
- #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
- #define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
-+#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS	(1 << 8)
- 
- #define KVM_STATE_NESTED_FORMAT_VMX	0
- #define KVM_STATE_NESTED_FORMAT_SVM	1
-diff --git a/linux-headers/asm-x86/mman.h b/linux-headers/asm-x86/mman.h
-index 46cdc941f9..ac1e627721 100644
---- a/linux-headers/asm-x86/mman.h
-+++ b/linux-headers/asm-x86/mman.h
-@@ -5,9 +5,6 @@
- #define MAP_32BIT	0x40		/* only give out 32bit addresses */
- #define MAP_ABOVE4G	0x80		/* only map above 4GB */
- 
--/* Flags for map_shadow_stack(2) */
--#define SHADOW_STACK_SET_TOKEN	(1ULL << 0)	/* Set up a restore token in the shadow stack */
--
- #include <asm-generic/mman.h>
- 
- #endif /* _ASM_X86_MMAN_H */
-diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
-index fb7b8b169b..a2eb492a75 100644
---- a/linux-headers/asm-x86/unistd_32.h
-+++ b/linux-headers/asm-x86/unistd_32.h
-@@ -453,6 +453,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
-index 24c979be54..2f5fc400f5 100644
---- a/linux-headers/asm-x86/unistd_64.h
-+++ b/linux-headers/asm-x86/unistd_64.h
-@@ -376,6 +376,10 @@
- #define __NR_lsm_set_self_attr 460
- #define __NR_lsm_list_modules 461
- #define __NR_mseal 462
-+#define __NR_setxattrat 463
-+#define __NR_getxattrat 464
-+#define __NR_listxattrat 465
-+#define __NR_removexattrat 466
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
-index c23dd21a2d..fecd832e7f 100644
---- a/linux-headers/asm-x86/unistd_x32.h
-+++ b/linux-headers/asm-x86/unistd_x32.h
-@@ -329,6 +329,10 @@
- #define __NR_lsm_set_self_attr (__X32_SYSCALL_BIT + 460)
- #define __NR_lsm_list_modules (__X32_SYSCALL_BIT + 461)
- #define __NR_mseal (__X32_SYSCALL_BIT + 462)
-+#define __NR_setxattrat (__X32_SYSCALL_BIT + 463)
-+#define __NR_getxattrat (__X32_SYSCALL_BIT + 464)
-+#define __NR_listxattrat (__X32_SYSCALL_BIT + 465)
-+#define __NR_removexattrat (__X32_SYSCALL_BIT + 466)
- #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
- #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
- #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
-diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
-index 782baf477f..37aae16502 100644
---- a/linux-headers/linux/iommufd.h
-+++ b/linux-headers/linux/iommufd.h
-@@ -51,6 +51,10 @@ enum {
- 	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP = 0x8c,
- 	IOMMUFD_CMD_HWPT_INVALIDATE = 0x8d,
- 	IOMMUFD_CMD_FAULT_QUEUE_ALLOC = 0x8e,
-+	IOMMUFD_CMD_IOAS_MAP_FILE = 0x8f,
-+	IOMMUFD_CMD_VIOMMU_ALLOC = 0x90,
-+	IOMMUFD_CMD_VDEVICE_ALLOC = 0x91,
-+	IOMMUFD_CMD_IOAS_CHANGE_PROCESS = 0x92,
- };
- 
- /**
-@@ -213,6 +217,30 @@ struct iommu_ioas_map {
- };
- #define IOMMU_IOAS_MAP _IO(IOMMUFD_TYPE, IOMMUFD_CMD_IOAS_MAP)
- 
-+/**
-+ * struct iommu_ioas_map_file - ioctl(IOMMU_IOAS_MAP_FILE)
-+ * @size: sizeof(struct iommu_ioas_map_file)
-+ * @flags: same as for iommu_ioas_map
-+ * @ioas_id: same as for iommu_ioas_map
-+ * @fd: the memfd to map
-+ * @start: byte offset from start of file to map from
-+ * @length: same as for iommu_ioas_map
-+ * @iova: same as for iommu_ioas_map
-+ *
-+ * Set an IOVA mapping from a memfd file.  All other arguments and semantics
-+ * match those of IOMMU_IOAS_MAP.
-+ */
-+struct iommu_ioas_map_file {
-+	__u32 size;
-+	__u32 flags;
-+	__u32 ioas_id;
-+	__s32 fd;
-+	__aligned_u64 start;
-+	__aligned_u64 length;
-+	__aligned_u64 iova;
-+};
-+#define IOMMU_IOAS_MAP_FILE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_IOAS_MAP_FILE)
-+
- /**
-  * struct iommu_ioas_copy - ioctl(IOMMU_IOAS_COPY)
-  * @size: sizeof(struct iommu_ioas_copy)
-@@ -359,11 +387,19 @@ struct iommu_vfio_ioas {
-  *                                   enforced on device attachment
-  * @IOMMU_HWPT_FAULT_ID_VALID: The fault_id field of hwpt allocation data is
-  *                             valid.
-+ * @IOMMU_HWPT_ALLOC_PASID: Requests a domain that can be used with PASID. The
-+ *                          domain can be attached to any PASID on the device.
-+ *                          Any domain attached to the non-PASID part of the
-+ *                          device must also be flaged, otherwise attaching a
-+ *                          PASID will blocked.
-+ *                          If IOMMU does not support PASID it will return
-+ *                          error (-EOPNOTSUPP).
-  */
- enum iommufd_hwpt_alloc_flags {
- 	IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
- 	IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
- 	IOMMU_HWPT_FAULT_ID_VALID = 1 << 2,
-+	IOMMU_HWPT_ALLOC_PASID = 1 << 3,
- };
- 
- /**
-@@ -394,14 +430,36 @@ struct iommu_hwpt_vtd_s1 {
- 	__u32 __reserved;
- };
- 
-+/**
-+ * struct iommu_hwpt_arm_smmuv3 - ARM SMMUv3 nested STE
-+ *                                (IOMMU_HWPT_DATA_ARM_SMMUV3)
-+ *
-+ * @ste: The first two double words of the user space Stream Table Entry for
-+ *       the translation. Must be little-endian.
-+ *       Allowed fields: (Refer to "5.2 Stream Table Entry" in SMMUv3 HW Spec)
-+ *       - word-0: V, Cfg, S1Fmt, S1ContextPtr, S1CDMax
-+ *       - word-1: EATS, S1DSS, S1CIR, S1COR, S1CSH, S1STALLD
-+ *
-+ * -EIO will be returned if @ste is not legal or contains any non-allowed field.
-+ * Cfg can be used to select a S1, Bypass or Abort configuration. A Bypass
-+ * nested domain will translate the same as the nesting parent. The S1 will
-+ * install a Context Descriptor Table pointing at userspace memory translated
-+ * by the nesting parent.
-+ */
-+struct iommu_hwpt_arm_smmuv3 {
-+	__aligned_le64 ste[2];
-+};
-+
- /**
-  * enum iommu_hwpt_data_type - IOMMU HWPT Data Type
-  * @IOMMU_HWPT_DATA_NONE: no data
-  * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
-+ * @IOMMU_HWPT_DATA_ARM_SMMUV3: ARM SMMUv3 Context Descriptor Table
-  */
- enum iommu_hwpt_data_type {
- 	IOMMU_HWPT_DATA_NONE = 0,
- 	IOMMU_HWPT_DATA_VTD_S1 = 1,
-+	IOMMU_HWPT_DATA_ARM_SMMUV3 = 2,
- };
- 
- /**
-@@ -409,7 +467,7 @@ enum iommu_hwpt_data_type {
-  * @size: sizeof(struct iommu_hwpt_alloc)
-  * @flags: Combination of enum iommufd_hwpt_alloc_flags
-  * @dev_id: The device to allocate this HWPT for
-- * @pt_id: The IOAS or HWPT to connect this HWPT to
-+ * @pt_id: The IOAS or HWPT or vIOMMU to connect this HWPT to
-  * @out_hwpt_id: The ID of the new HWPT
-  * @__reserved: Must be 0
-  * @data_type: One of enum iommu_hwpt_data_type
-@@ -428,11 +486,13 @@ enum iommu_hwpt_data_type {
-  * IOMMU_HWPT_DATA_NONE. The HWPT can be allocated as a parent HWPT for a
-  * nesting configuration by passing IOMMU_HWPT_ALLOC_NEST_PARENT via @flags.
-  *
-- * A user-managed nested HWPT will be created from a given parent HWPT via
-- * @pt_id, in which the parent HWPT must be allocated previously via the
-- * same ioctl from a given IOAS (@pt_id). In this case, the @data_type
-- * must be set to a pre-defined type corresponding to an I/O page table
-- * type supported by the underlying IOMMU hardware.
-+ * A user-managed nested HWPT will be created from a given vIOMMU (wrapping a
-+ * parent HWPT) or a parent HWPT via @pt_id, in which the parent HWPT must be
-+ * allocated previously via the same ioctl from a given IOAS (@pt_id). In this
-+ * case, the @data_type must be set to a pre-defined type corresponding to an
-+ * I/O page table type supported by the underlying IOMMU hardware. The device
-+ * via @dev_id and the vIOMMU via @pt_id must be associated to the same IOMMU
-+ * instance.
-  *
-  * If the @data_type is set to IOMMU_HWPT_DATA_NONE, @data_len and
-  * @data_uptr should be zero. Otherwise, both @data_len and @data_uptr
-@@ -484,15 +544,50 @@ struct iommu_hw_info_vtd {
- 	__aligned_u64 ecap_reg;
- };
- 
-+/**
-+ * struct iommu_hw_info_arm_smmuv3 - ARM SMMUv3 hardware information
-+ *                                   (IOMMU_HW_INFO_TYPE_ARM_SMMUV3)
-+ *
-+ * @flags: Must be set to 0
-+ * @__reserved: Must be 0
-+ * @idr: Implemented features for ARM SMMU Non-secure programming interface
-+ * @iidr: Information about the implementation and implementer of ARM SMMU,
-+ *        and architecture version supported
-+ * @aidr: ARM SMMU architecture version
-+ *
-+ * For the details of @idr, @iidr and @aidr, please refer to the chapters
-+ * from 6.3.1 to 6.3.6 in the SMMUv3 Spec.
-+ *
-+ * User space should read the underlying ARM SMMUv3 hardware information for
-+ * the list of supported features.
-+ *
-+ * Note that these values reflect the raw HW capability, without any insight if
-+ * any required kernel driver support is present. Bits may be set indicating the
-+ * HW has functionality that is lacking kernel software support, such as BTM. If
-+ * a VMM is using this information to construct emulated copies of these
-+ * registers it should only forward bits that it knows it can support.
-+ *
-+ * In future, presence of required kernel support will be indicated in flags.
-+ */
-+struct iommu_hw_info_arm_smmuv3 {
-+	__u32 flags;
-+	__u32 __reserved;
-+	__u32 idr[6];
-+	__u32 iidr;
-+	__u32 aidr;
-+};
-+
- /**
-  * enum iommu_hw_info_type - IOMMU Hardware Info Types
-  * @IOMMU_HW_INFO_TYPE_NONE: Used by the drivers that do not report hardware
-  *                           info
-  * @IOMMU_HW_INFO_TYPE_INTEL_VTD: Intel VT-d iommu info type
-+ * @IOMMU_HW_INFO_TYPE_ARM_SMMUV3: ARM SMMUv3 iommu info type
-  */
- enum iommu_hw_info_type {
- 	IOMMU_HW_INFO_TYPE_NONE = 0,
- 	IOMMU_HW_INFO_TYPE_INTEL_VTD = 1,
-+	IOMMU_HW_INFO_TYPE_ARM_SMMUV3 = 2,
- };
- 
- /**
-@@ -627,9 +722,11 @@ struct iommu_hwpt_get_dirty_bitmap {
-  * enum iommu_hwpt_invalidate_data_type - IOMMU HWPT Cache Invalidation
-  *                                        Data Type
-  * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
-+ * @IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3: Invalidation data for ARM SMMUv3
-  */
- enum iommu_hwpt_invalidate_data_type {
- 	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1 = 0,
-+	IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3 = 1,
- };
- 
- /**
-@@ -668,10 +765,32 @@ struct iommu_hwpt_vtd_s1_invalidate {
- 	__u32 __reserved;
- };
- 
-+/**
-+ * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cahce invalidation
-+ *         (IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3)
-+ * @cmd: 128-bit cache invalidation command that runs in SMMU CMDQ.
-+ *       Must be little-endian.
-+ *
-+ * Supported command list only when passing in a vIOMMU via @hwpt_id:
-+ *     CMDQ_OP_TLBI_NSNH_ALL
-+ *     CMDQ_OP_TLBI_NH_VA
-+ *     CMDQ_OP_TLBI_NH_VAA
-+ *     CMDQ_OP_TLBI_NH_ALL
-+ *     CMDQ_OP_TLBI_NH_ASID
-+ *     CMDQ_OP_ATC_INV
-+ *     CMDQ_OP_CFGI_CD
-+ *     CMDQ_OP_CFGI_CD_ALL
-+ *
-+ * -EIO will be returned if the command is not supported.
-+ */
-+struct iommu_viommu_arm_smmuv3_invalidate {
-+	__aligned_le64 cmd[2];
-+};
-+
- /**
-  * struct iommu_hwpt_invalidate - ioctl(IOMMU_HWPT_INVALIDATE)
-  * @size: sizeof(struct iommu_hwpt_invalidate)
-- * @hwpt_id: ID of a nested HWPT for cache invalidation
-+ * @hwpt_id: ID of a nested HWPT or a vIOMMU, for cache invalidation
-  * @data_uptr: User pointer to an array of driver-specific cache invalidation
-  *             data.
-  * @data_type: One of enum iommu_hwpt_invalidate_data_type, defining the data
-@@ -682,8 +801,11 @@ struct iommu_hwpt_vtd_s1_invalidate {
-  *             Output the number of requests successfully handled by kernel.
-  * @__reserved: Must be 0.
-  *
-- * Invalidate the iommu cache for user-managed page table. Modifications on a
-- * user-managed page table should be followed by this operation to sync cache.
-+ * Invalidate iommu cache for user-managed page table or vIOMMU. Modifications
-+ * on a user-managed page table should be followed by this operation, if a HWPT
-+ * is passed in via @hwpt_id. Other caches, such as device cache or descriptor
-+ * cache can be flushed if a vIOMMU is passed in via the @hwpt_id field.
-+ *
-  * Each ioctl can support one or more cache invalidation requests in the array
-  * that has a total size of @entry_len * @entry_num.
-  *
-@@ -797,4 +919,88 @@ struct iommu_fault_alloc {
- 	__u32 out_fault_fd;
- };
- #define IOMMU_FAULT_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_FAULT_QUEUE_ALLOC)
-+
-+/**
-+ * enum iommu_viommu_type - Virtual IOMMU Type
-+ * @IOMMU_VIOMMU_TYPE_DEFAULT: Reserved for future use
-+ * @IOMMU_VIOMMU_TYPE_ARM_SMMUV3: ARM SMMUv3 driver specific type
-+ */
-+enum iommu_viommu_type {
-+	IOMMU_VIOMMU_TYPE_DEFAULT = 0,
-+	IOMMU_VIOMMU_TYPE_ARM_SMMUV3 = 1,
-+};
-+
-+/**
-+ * struct iommu_viommu_alloc - ioctl(IOMMU_VIOMMU_ALLOC)
-+ * @size: sizeof(struct iommu_viommu_alloc)
-+ * @flags: Must be 0
-+ * @type: Type of the virtual IOMMU. Must be defined in enum iommu_viommu_type
-+ * @dev_id: The device's physical IOMMU will be used to back the virtual IOMMU
-+ * @hwpt_id: ID of a nesting parent HWPT to associate to
-+ * @out_viommu_id: Output virtual IOMMU ID for the allocated object
-+ *
-+ * Allocate a virtual IOMMU object, representing the underlying physical IOMMU's
-+ * virtualization support that is a security-isolated slice of the real IOMMU HW
-+ * that is unique to a specific VM. Operations global to the IOMMU are connected
-+ * to the vIOMMU, such as:
-+ * - Security namespace for guest owned ID, e.g. guest-controlled cache tags
-+ * - Non-device-affiliated event reporting, e.g. invalidation queue errors
-+ * - Access to a sharable nesting parent pagetable across physical IOMMUs
-+ * - Virtualization of various platforms IDs, e.g. RIDs and others
-+ * - Delivery of paravirtualized invalidation
-+ * - Direct assigned invalidation queues
-+ * - Direct assigned interrupts
-+ */
-+struct iommu_viommu_alloc {
-+	__u32 size;
-+	__u32 flags;
-+	__u32 type;
-+	__u32 dev_id;
-+	__u32 hwpt_id;
-+	__u32 out_viommu_id;
-+};
-+#define IOMMU_VIOMMU_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VIOMMU_ALLOC)
-+
-+/**
-+ * struct iommu_vdevice_alloc - ioctl(IOMMU_VDEVICE_ALLOC)
-+ * @size: sizeof(struct iommu_vdevice_alloc)
-+ * @viommu_id: vIOMMU ID to associate with the virtual device
-+ * @dev_id: The physical device to allocate a virtual instance on the vIOMMU
-+ * @out_vdevice_id: Object handle for the vDevice. Pass to IOMMU_DESTORY
-+ * @virt_id: Virtual device ID per vIOMMU, e.g. vSID of ARM SMMUv3, vDeviceID
-+ *           of AMD IOMMU, and vRID of a nested Intel VT-d to a Context Table
-+ *
-+ * Allocate a virtual device instance (for a physical device) against a vIOMMU.
-+ * This instance holds the device's information (related to its vIOMMU) in a VM.
-+ */
-+struct iommu_vdevice_alloc {
-+	__u32 size;
-+	__u32 viommu_id;
-+	__u32 dev_id;
-+	__u32 out_vdevice_id;
-+	__aligned_u64 virt_id;
-+};
-+#define IOMMU_VDEVICE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VDEVICE_ALLOC)
-+
-+/**
-+ * struct iommu_ioas_change_process - ioctl(VFIO_IOAS_CHANGE_PROCESS)
-+ * @size: sizeof(struct iommu_ioas_change_process)
-+ * @__reserved: Must be 0
-+ *
-+ * This transfers pinned memory counts for every memory map in every IOAS
-+ * in the context to the current process.  This only supports maps created
-+ * with IOMMU_IOAS_MAP_FILE, and returns EINVAL if other maps are present.
-+ * If the ioctl returns a failure status, then nothing is changed.
-+ *
-+ * This API is useful for transferring operation of a device from one process
-+ * to another, such as during userland live update.
-+ */
-+struct iommu_ioas_change_process {
-+	__u32 size;
-+	__u32 __reserved;
-+};
-+
-+#define IOMMU_IOAS_CHANGE_PROCESS \
-+	_IO(IOMMUFD_TYPE, IOMMUFD_CMD_IOAS_CHANGE_PROCESS)
-+
- #endif
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index 49dd1b30ce..3bcd4eabe3 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -1150,7 +1150,15 @@ enum kvm_device_type {
- #define KVM_DEV_TYPE_ARM_PV_TIME	KVM_DEV_TYPE_ARM_PV_TIME
- 	KVM_DEV_TYPE_RISCV_AIA,
- #define KVM_DEV_TYPE_RISCV_AIA		KVM_DEV_TYPE_RISCV_AIA
-+	KVM_DEV_TYPE_LOONGARCH_IPI,
-+#define KVM_DEV_TYPE_LOONGARCH_IPI	KVM_DEV_TYPE_LOONGARCH_IPI
-+	KVM_DEV_TYPE_LOONGARCH_EIOINTC,
-+#define KVM_DEV_TYPE_LOONGARCH_EIOINTC	KVM_DEV_TYPE_LOONGARCH_EIOINTC
-+	KVM_DEV_TYPE_LOONGARCH_PCHPIC,
-+#define KVM_DEV_TYPE_LOONGARCH_PCHPIC	KVM_DEV_TYPE_LOONGARCH_PCHPIC
-+
- 	KVM_DEV_TYPE_MAX,
-+
- };
- 
- struct kvm_vfio_spapr_tce {
-diff --git a/linux-headers/linux/psci.h b/linux-headers/linux/psci.h
-index 74f3cb5007..a982afd498 100644
---- a/linux-headers/linux/psci.h
-+++ b/linux-headers/linux/psci.h
-@@ -59,6 +59,7 @@
- #define PSCI_1_1_FN_SYSTEM_RESET2		PSCI_0_2_FN(18)
- #define PSCI_1_1_FN_MEM_PROTECT			PSCI_0_2_FN(19)
- #define PSCI_1_1_FN_MEM_PROTECT_CHECK_RANGE	PSCI_0_2_FN(20)
-+#define PSCI_1_3_FN_SYSTEM_OFF2			PSCI_0_2_FN(21)
- 
- #define PSCI_1_0_FN64_CPU_DEFAULT_SUSPEND	PSCI_0_2_FN64(12)
- #define PSCI_1_0_FN64_NODE_HW_STATE		PSCI_0_2_FN64(13)
-@@ -68,6 +69,7 @@
- 
- #define PSCI_1_1_FN64_SYSTEM_RESET2		PSCI_0_2_FN64(18)
- #define PSCI_1_1_FN64_MEM_PROTECT_CHECK_RANGE	PSCI_0_2_FN64(20)
-+#define PSCI_1_3_FN64_SYSTEM_OFF2		PSCI_0_2_FN64(21)
- 
- /* PSCI v0.2 power state encoding for CPU_SUSPEND function */
- #define PSCI_0_2_POWER_STATE_ID_MASK		0xffff
-@@ -100,6 +102,9 @@
- #define PSCI_1_1_RESET_TYPE_SYSTEM_WARM_RESET	0
- #define PSCI_1_1_RESET_TYPE_VENDOR_START	0x80000000U
- 
-+/* PSCI v1.3 hibernate type for SYSTEM_OFF2 */
-+#define PSCI_1_3_OFF_TYPE_HIBERNATE_OFF		BIT(0)
-+
- /* PSCI version decoding (independent of PSCI version) */
- #define PSCI_VERSION_MAJOR_SHIFT		16
- #define PSCI_VERSION_MINOR_MASK			\
-diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
-index b4be37b225..1b5e254d6a 100644
---- a/linux-headers/linux/vfio.h
-+++ b/linux-headers/linux/vfio.h
-@@ -35,7 +35,7 @@
- #define VFIO_EEH			5
- 
- /* Two-stage IOMMU */
--#define VFIO_TYPE1_NESTING_IOMMU	6	/* Implies v2 */
-+#define __VFIO_RESERVED_TYPE1_NESTING_IOMMU	6	/* Implies v2 */
- 
- #define VFIO_SPAPR_TCE_v2_IOMMU		7
- 
--- 
-2.39.3
-
diff --git a/kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch b/kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
deleted file mode 100644
index 5dcd477..0000000
--- a/kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
+++ /dev/null
@@ -1,2559 +0,0 @@
-From cec04b18c1f11b527df9d80148e3dda9d6d24997 Mon Sep 17 00:00:00 2001
-From: Bibo Mao <maobibo@loongson.cn>
-Date: Mon, 28 Oct 2024 10:38:09 +0800
-Subject: [PATCH 01/19] linux-headers: Update to Linux v6.12-rc5
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [1/16] c6470d080ff4bea31d04d40220bda9854610bf6b (thuth/qemu-kvm-cs9)
-
-update linux-headers to v6.12-rc5. Pass to compile on aarch64, arm,
-loongarch64, x86_64, i386, riscv64,riscv32 softmmu and linux-user.
-
-Signed-off-by: Bibo Mao <maobibo@loongson.cn>
-Acked-by: Song Gao <gaosong@loongson.cn>
-Message-Id: <20241028023809.1554405-4-maobibo@loongson.cn>
-Signed-off-by: Song Gao <gaosong@loongson.cn>
-(cherry picked from commit 0d2eeef77a33315187df8519491a900bde4a3d83)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- include/standard-headers/drm/drm_fourcc.h     |  43 +++
- include/standard-headers/linux/const.h        |  17 +
- include/standard-headers/linux/ethtool.h      | 226 ++++++++++++
- include/standard-headers/linux/fuse.h         |  22 +-
- .../linux/input-event-codes.h                 |   2 +
- include/standard-headers/linux/pci_regs.h     |  41 ++-
- .../standard-headers/linux/virtio_balloon.h   |  16 +-
- include/standard-headers/linux/virtio_gpu.h   |   1 +
- linux-headers/asm-arm64/mman.h                |   9 +
- linux-headers/asm-arm64/unistd.h              |  25 +-
- linux-headers/asm-arm64/unistd_64.h           | 324 +++++++++++++++++
- linux-headers/asm-generic/unistd.h            |   6 +-
- linux-headers/asm-loongarch/kvm.h             |  24 ++
- linux-headers/asm-loongarch/kvm_para.h        |  21 ++
- linux-headers/asm-loongarch/unistd.h          |   4 +-
- linux-headers/asm-loongarch/unistd_64.h       | 320 +++++++++++++++++
- linux-headers/asm-riscv/kvm.h                 |   7 +
- linux-headers/asm-riscv/unistd.h              |  41 +--
- linux-headers/asm-riscv/unistd_32.h           | 315 +++++++++++++++++
- linux-headers/asm-riscv/unistd_64.h           | 325 ++++++++++++++++++
- linux-headers/asm-x86/kvm.h                   |   2 +
- linux-headers/asm-x86/unistd_64.h             |   1 +
- linux-headers/asm-x86/unistd_x32.h            |   1 +
- linux-headers/linux/bits.h                    |   3 +
- linux-headers/linux/const.h                   |  17 +
- linux-headers/linux/iommufd.h                 | 143 +++++++-
- linux-headers/linux/kvm.h                     |  23 +-
- linux-headers/linux/mman.h                    |   1 +
- linux-headers/linux/psp-sev.h                 |  28 ++
- 29 files changed, 1915 insertions(+), 93 deletions(-)
- create mode 100644 linux-headers/asm-arm64/unistd_64.h
- create mode 100644 linux-headers/asm-loongarch/kvm_para.h
- create mode 100644 linux-headers/asm-loongarch/unistd_64.h
- create mode 100644 linux-headers/asm-riscv/unistd_32.h
- create mode 100644 linux-headers/asm-riscv/unistd_64.h
-
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
-index b72917073d..d4a2231306 100644
---- a/include/standard-headers/drm/drm_fourcc.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
-@@ -701,6 +701,31 @@ extern "C" {
-  */
- #define I915_FORMAT_MOD_4_TILED_MTL_RC_CCS_CC fourcc_mod_code(INTEL, 15)
- 
-+/*
-+ * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
-+ * on integrated graphics
-+ *
-+ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
-+ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
-+ * 0 and 1, respectively. The CCS for all planes are stored outside of the
-+ * GEM object in a reserved memory area dedicated for the storage of the
-+ * CCS data for all compressible GEM objects.
-+ */
-+#define I915_FORMAT_MOD_4_TILED_LNL_CCS fourcc_mod_code(INTEL, 16)
-+
-+/*
-+ * Intel Color Control Surfaces (CCS) for graphics ver. 20 unified compression
-+ * on discrete graphics
-+ *
-+ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
-+ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
-+ * 0 and 1, respectively. The CCS for all planes are stored outside of the
-+ * GEM object in a reserved memory area dedicated for the storage of the
-+ * CCS data for all compressible GEM objects. The GEM object must be stored in
-+ * contiguous memory with a size aligned to 64KB
-+ */
-+#define I915_FORMAT_MOD_4_TILED_BMG_CCS fourcc_mod_code(INTEL, 17)
-+
- /*
-  * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks
-  *
-@@ -1475,6 +1500,7 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
- #define AMD_FMT_MOD_TILE_VER_GFX10 2
- #define AMD_FMT_MOD_TILE_VER_GFX10_RBPLUS 3
- #define AMD_FMT_MOD_TILE_VER_GFX11 4
-+#define AMD_FMT_MOD_TILE_VER_GFX12 5
- 
- /*
-  * 64K_S is the same for GFX9/GFX10/GFX10_RBPLUS and hence has GFX9 as canonical
-@@ -1485,6 +1511,8 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
- /*
-  * 64K_D for non-32 bpp is the same for GFX9/GFX10/GFX10_RBPLUS and hence has
-  * GFX9 as canonical version.
-+ *
-+ * 64K_D_2D on GFX12 is identical to 64K_D on GFX11.
-  */
- #define AMD_FMT_MOD_TILE_GFX9_64K_D 10
- #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
-@@ -1492,6 +1520,21 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
- #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
- #define AMD_FMT_MOD_TILE_GFX11_256K_R_X 31
- 
-+/* Gfx12 swizzle modes:
-+ *    0 - LINEAR
-+ *    1 - 256B_2D  - 2D block dimensions
-+ *    2 - 4KB_2D
-+ *    3 - 64KB_2D
-+ *    4 - 256KB_2D
-+ *    5 - 4KB_3D   - 3D block dimensions
-+ *    6 - 64KB_3D
-+ *    7 - 256KB_3D
-+ */
-+#define AMD_FMT_MOD_TILE_GFX12_256B_2D 1
-+#define AMD_FMT_MOD_TILE_GFX12_4K_2D 2
-+#define AMD_FMT_MOD_TILE_GFX12_64K_2D 3
-+#define AMD_FMT_MOD_TILE_GFX12_256K_2D 4
-+
- #define AMD_FMT_MOD_DCC_BLOCK_64B 0
- #define AMD_FMT_MOD_DCC_BLOCK_128B 1
- #define AMD_FMT_MOD_DCC_BLOCK_256B 2
-diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
-index 1eb84b5087..2122610de7 100644
---- a/include/standard-headers/linux/const.h
-+++ b/include/standard-headers/linux/const.h
-@@ -28,6 +28,23 @@
- #define _BITUL(x)	(_UL(1) << (x))
- #define _BITULL(x)	(_ULL(1) << (x))
- 
-+#if !defined(__ASSEMBLY__)
-+/*
-+ * Missing __asm__ support
-+ *
-+ * __BIT128() would not work in the __asm__ code, as it shifts an
-+ * 'unsigned __init128' data type as direct representation of
-+ * 128 bit constants is not supported in the gcc compiler, as
-+ * they get silently truncated.
-+ *
-+ * TODO: Please revisit this implementation when gcc compiler
-+ * starts representing 128 bit constants directly like long
-+ * and unsigned long etc. Subsequently drop the comment for
-+ * GENMASK_U128() which would then start supporting __asm__ code.
-+ */
-+#define _BIT128(x)	((unsigned __int128)(1) << (x))
-+#endif
-+
- #define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
- #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
- 
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
-index b0b4b68410..b05e84825b 100644
---- a/include/standard-headers/linux/ethtool.h
-+++ b/include/standard-headers/linux/ethtool.h
-@@ -752,6 +752,197 @@ enum ethtool_module_power_mode {
- 	ETHTOOL_MODULE_POWER_MODE_HIGH,
- };
- 
-+/**
-+ * enum ethtool_c33_pse_ext_state - groups of PSE extended states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION: Group of error_condition states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID: Group of mr_mps_valid states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE: Group of mr_pse_enable states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED: Group of option_detect_ted
-+ *	states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM: Group of option_vport_lim states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED: Group of ovld_detected states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE: Group of pd_dll_power_type
-+ *	states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE: Group of power_not_available
-+ *	states
-+ * @ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED: Group of short_detected states
-+ */
-+enum ethtool_c33_pse_ext_state {
-+	ETHTOOL_C33_PSE_EXT_STATE_ERROR_CONDITION = 1,
-+	ETHTOOL_C33_PSE_EXT_STATE_MR_MPS_VALID,
-+	ETHTOOL_C33_PSE_EXT_STATE_MR_PSE_ENABLE,
-+	ETHTOOL_C33_PSE_EXT_STATE_OPTION_DETECT_TED,
-+	ETHTOOL_C33_PSE_EXT_STATE_OPTION_VPORT_LIM,
-+	ETHTOOL_C33_PSE_EXT_STATE_OVLD_DETECTED,
-+	ETHTOOL_C33_PSE_EXT_STATE_PD_DLL_POWER_TYPE,
-+	ETHTOOL_C33_PSE_EXT_STATE_POWER_NOT_AVAILABLE,
-+	ETHTOOL_C33_PSE_EXT_STATE_SHORT_DETECTED,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_mr_mps_valid - mr_mps_valid states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD: Underload
-+ *	state
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN: Port is not
-+ *	connected
-+ *
-+ * The PSE monitors either the DC or AC Maintain Power Signature
-+ * (MPS, see 33.2.9.1). This variable indicates the presence or absence of
-+ * a valid MPS.
-+ */
-+enum ethtool_c33_pse_ext_substate_mr_mps_valid {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_DETECTED_UNDERLOAD = 1,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_MPS_VALID_CONNECTION_OPEN,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_error_condition - error_condition states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT: Non-existing
-+ *	port number
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT: Undefined port
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT: Internal
-+ *	hardware fault
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON:
-+ *	Communication error after force on
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS: Unknown
-+ *	port status
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF: Host
-+ *	crash turn off
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN:
-+ *	Host crash force shutdown
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE: Configuration
-+ *	change
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP: Over
-+ *	temperature detected
-+ *
-+ * error_condition is a variable indicating the status of
-+ * implementation-specific fault conditions or optionally other system faults
-+ * that prevent the PSE from meeting the specifications in Table 33–11 and that
-+ * require the PSE not to source power. These error conditions are different
-+ * from those monitored by the state diagrams in Figure 33–10.
-+ */
-+enum ethtool_c33_pse_ext_substate_error_condition {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_NON_EXISTING_PORT = 1,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNDEFINED_PORT,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_INTERNAL_HW_FAULT,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_COMM_ERROR_AFTER_FORCE_ON,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_UNKNOWN_PORT_STATUS,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_TURN_OFF,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_HOST_CRASH_FORCE_SHUTDOWN,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_CONFIG_CHANGE,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_ERROR_CONDITION_DETECTED_OVER_TEMP,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_mr_pse_enable - mr_pse_enable states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE: Disable
-+ *	pin active
-+ *
-+ * mr_pse_enable is control variable that selects PSE operation and test
-+ * functions.
-+ */
-+enum ethtool_c33_pse_ext_substate_mr_pse_enable {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_MR_PSE_ENABLE_DISABLE_PIN_ACTIVE = 1,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_option_detect_ted - option_detect_ted
-+ *	states functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS: Detection
-+ *	in process
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR:
-+ *	Connection check error
-+ *
-+ * option_detect_ted is a variable indicating if detection can be performed
-+ * by the PSE during the ted_timer interval.
-+ */
-+enum ethtool_c33_pse_ext_substate_option_detect_ted {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_DET_IN_PROCESS = 1,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_DETECT_TED_CONNECTION_CHECK_ERROR,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_option_vport_lim - option_vport_lim states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE: Main supply
-+ *	voltage is high
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE: Main supply
-+ *	voltage is low
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION: Voltage
-+ *	injection into the port
-+ *
-+ * option_vport_lim is an optional variable indicates if VPSE is out of the
-+ * operating range during normal operating state.
-+ */
-+enum ethtool_c33_pse_ext_substate_option_vport_lim {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_HIGH_VOLTAGE = 1,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_LOW_VOLTAGE,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OPTION_VPORT_LIM_VOLTAGE_INJECTION,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_ovld_detected - ovld_detected states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD: Overload state
-+ *
-+ * ovld_detected is a variable indicating if the PSE output current has been
-+ * in an overload condition (see 33.2.7.6) for at least TCUT of a one-second
-+ * sliding time.
-+ */
-+enum ethtool_c33_pse_ext_substate_ovld_detected {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_OVLD_DETECTED_OVERLOAD = 1,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_power_not_available - power_not_available
-+ *	states functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED: Power
-+ *	budget exceeded for the controller
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET:
-+ *	Configured port power limit exceeded controller power budget
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT:
-+ *	Power request from PD exceeds port limit
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT: Power
-+ *	denied due to Hardware power limit
-+ *
-+ * power_not_available is a variable that is asserted in an
-+ * implementation-dependent manner when the PSE is no longer capable of
-+ * sourcing sufficient power to support the attached PD. Sufficient power
-+ * is defined by classification; see 33.2.6.
-+ */
-+enum ethtool_c33_pse_ext_substate_power_not_available {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_BUDGET_EXCEEDED =  1,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PORT_PW_LIMIT_EXCEEDS_CONTROLLER_BUDGET,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_PD_REQUEST_EXCEEDS_PORT_LIMIT,
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_POWER_NOT_AVAILABLE_HW_PW_LIMIT,
-+};
-+
-+/**
-+ * enum ethtool_c33_pse_ext_substate_short_detected - short_detected states
-+ *      functions. IEEE 802.3-2022 33.2.4.4 Variables
-+ *
-+ * @ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION: Short
-+ *	condition was detected
-+ *
-+ * short_detected is a variable indicating if the PSE output current has been
-+ * in a short circuit condition for TLIM within a sliding window (see 33.2.7.7).
-+ */
-+enum ethtool_c33_pse_ext_substate_short_detected {
-+	ETHTOOL_C33_PSE_EXT_SUBSTATE_SHORT_DETECTED_SHORT_CONDITION = 1,
-+};
-+
- /**
-  * enum ethtool_pse_types - Types of PSE controller.
-  * @ETHTOOL_PSE_UNKNOWN: Type of PSE controller is unknown
-@@ -877,6 +1068,24 @@ enum ethtool_mm_verify_status {
- 	ETHTOOL_MM_VERIFY_STATUS_DISABLED,
- };
- 
-+/**
-+ * enum ethtool_module_fw_flash_status - plug-in module firmware flashing status
-+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED: The firmware flashing process has
-+ *	started.
-+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS: The firmware flashing process
-+ *	is in progress.
-+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED: The firmware flashing process was
-+ *	completed successfully.
-+ * @ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR: The firmware flashing process was
-+ *	stopped due to an error.
-+ */
-+enum ethtool_module_fw_flash_status {
-+	ETHTOOL_MODULE_FW_FLASH_STATUS_STARTED = 1,
-+	ETHTOOL_MODULE_FW_FLASH_STATUS_IN_PROGRESS,
-+	ETHTOOL_MODULE_FW_FLASH_STATUS_COMPLETED,
-+	ETHTOOL_MODULE_FW_FLASH_STATUS_ERROR,
-+};
-+
- /**
-  * struct ethtool_gstrings - string set for data tagging
-  * @cmd: Command number = %ETHTOOL_GSTRINGS
-@@ -1845,6 +2054,7 @@ enum ethtool_link_mode_bit_indices {
- 	ETHTOOL_LINK_MODE_10baseT1S_Full_BIT		 = 99,
- 	ETHTOOL_LINK_MODE_10baseT1S_Half_BIT		 = 100,
- 	ETHTOOL_LINK_MODE_10baseT1S_P2MP_Half_BIT	 = 101,
-+	ETHTOOL_LINK_MODE_10baseT1BRR_Full_BIT		 = 102,
- 
- 	/* must be last entry */
- 	__ETHTOOL_LINK_MODE_MASK_NBITS
-@@ -2323,4 +2533,20 @@ struct ethtool_link_settings {
- 	 * uint32_t map_lp_advertising[link_mode_masks_nwords];
- 	 */
- };
-+
-+/**
-+ * enum phy_upstream - Represents the upstream component a given PHY device
-+ * is connected to, as in what is on the other end of the MII bus. Most PHYs
-+ * will be attached to an Ethernet MAC controller, but in some cases, there's
-+ * an intermediate PHY used as a media-converter, which will driver another
-+ * MII interface as its output.
-+ * @PHY_UPSTREAM_MAC: Upstream component is a MAC (a switch port,
-+ *		      or ethernet controller)
-+ * @PHY_UPSTREAM_PHY: Upstream component is a PHY (likely a media converter)
-+ */
-+enum phy_upstream {
-+	PHY_UPSTREAM_MAC,
-+	PHY_UPSTREAM_PHY,
-+};
-+
- #endif /* _LINUX_ETHTOOL_H */
-diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
-index bac9dbc49f..889e12ad15 100644
---- a/include/standard-headers/linux/fuse.h
-+++ b/include/standard-headers/linux/fuse.h
-@@ -217,6 +217,9 @@
-  *  - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag
-  *  - add FUSE_NO_EXPORT_SUPPORT init flag
-  *  - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag
-+ *
-+ *  7.41
-+ *  - add FUSE_ALLOW_IDMAP
-  */
- 
- #ifndef _LINUX_FUSE_H
-@@ -248,7 +251,7 @@
- #define FUSE_KERNEL_VERSION 7
- 
- /** Minor version number of this interface */
--#define FUSE_KERNEL_MINOR_VERSION 40
-+#define FUSE_KERNEL_MINOR_VERSION 41
- 
- /** The node ID of the root inode */
- #define FUSE_ROOT_ID 1
-@@ -417,6 +420,7 @@ struct fuse_file_lock {
-  * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support
-  * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
-  *		    of the request ID indicates resend requests
-+ * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
-  */
- #define FUSE_ASYNC_READ		(1 << 0)
- #define FUSE_POSIX_LOCKS	(1 << 1)
-@@ -462,6 +466,7 @@ struct fuse_file_lock {
- 
- /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
- #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
-+#define FUSE_ALLOW_IDMAP	(1ULL << 40)
- 
- /**
-  * CUSE INIT request/reply flags
-@@ -980,6 +985,21 @@ struct fuse_fallocate_in {
-  */
- #define FUSE_UNIQUE_RESEND (1ULL << 63)
- 
-+/**
-+ * This value will be set by the kernel to
-+ * (struct fuse_in_header).{uid,gid} fields in
-+ * case when:
-+ * - fuse daemon enabled FUSE_ALLOW_IDMAP
-+ * - idmapping information is not available and uid/gid
-+ *   can not be mapped in accordance with an idmapping.
-+ *
-+ * Note: an idmapping information always available
-+ * for inode creation operations like:
-+ * FUSE_MKNOD, FUSE_SYMLINK, FUSE_MKDIR, FUSE_TMPFILE,
-+ * FUSE_CREATE and FUSE_RENAME2 (with RENAME_WHITEOUT).
-+ */
-+#define FUSE_INVALID_UIDGID ((uint32_t)(-1))
-+
- struct fuse_in_header {
- 	uint32_t	len;
- 	uint32_t	opcode;
-diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
-index 2221b0c383..50b2b7497e 100644
---- a/include/standard-headers/linux/input-event-codes.h
-+++ b/include/standard-headers/linux/input-event-codes.h
-@@ -618,6 +618,8 @@
- #define KEY_CAMERA_ACCESS_ENABLE	0x24b	/* Enables programmatic access to camera devices. (HUTRR72) */
- #define KEY_CAMERA_ACCESS_DISABLE	0x24c	/* Disables programmatic access to camera devices. (HUTRR72) */
- #define KEY_CAMERA_ACCESS_TOGGLE	0x24d	/* Toggles the current state of the camera access control. (HUTRR72) */
-+#define KEY_ACCESSIBILITY		0x24e	/* Toggles the system bound accessibility UI/command (HUTRR116) */
-+#define KEY_DO_NOT_DISTURB		0x24f	/* Toggles the system-wide "Do Not Disturb" control (HUTRR94)*/
- 
- #define KEY_BRIGHTNESS_MIN		0x250	/* Set Brightness to Minimum */
- #define KEY_BRIGHTNESS_MAX		0x251	/* Set Brightness to Maximum */
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index 94c00996e6..12323b3334 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -634,9 +634,11 @@
- #define  PCI_EXP_RTCTL_SENFEE	0x0002	/* System Error on Non-Fatal Error */
- #define  PCI_EXP_RTCTL_SEFEE	0x0004	/* System Error on Fatal Error */
- #define  PCI_EXP_RTCTL_PMEIE	0x0008	/* PME Interrupt Enable */
--#define  PCI_EXP_RTCTL_CRSSVE	0x0010	/* CRS Software Visibility Enable */
-+#define  PCI_EXP_RTCTL_RRS_SVE	0x0010	/* Config RRS Software Visibility Enable */
-+#define  PCI_EXP_RTCTL_CRSSVE PCI_EXP_RTCTL_RRS_SVE /* compatibility */
- #define PCI_EXP_RTCAP		0x1e	/* Root Capabilities */
--#define  PCI_EXP_RTCAP_CRSVIS	0x0001	/* CRS Software Visibility capability */
-+#define  PCI_EXP_RTCAP_RRS_SV	0x0001	/* Config RRS Software Visibility */
-+#define  PCI_EXP_RTCAP_CRSVIS PCI_EXP_RTCAP_RRS_SV /* compatibility */
- #define PCI_EXP_RTSTA		0x20	/* Root Status */
- #define  PCI_EXP_RTSTA_PME_RQ_ID 0x0000ffff /* PME Requester ID */
- #define  PCI_EXP_RTSTA_PME	0x00010000 /* PME status */
-@@ -740,6 +742,7 @@
- #define PCI_EXT_CAP_ID_DVSEC	0x23	/* Designated Vendor-Specific */
- #define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
- #define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
-+#define PCI_EXT_CAP_ID_NPEM	0x29	/* Native PCIe Enclosure Management */
- #define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
- #define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
- #define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
-@@ -1121,6 +1124,40 @@
- #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
- #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
- 
-+/* Native PCIe Enclosure Management */
-+#define PCI_NPEM_CAP     0x04 /* NPEM capability register */
-+#define  PCI_NPEM_CAP_CAPABLE     0x00000001 /* NPEM Capable */
-+
-+#define PCI_NPEM_CTRL    0x08 /* NPEM control register */
-+#define  PCI_NPEM_CTRL_ENABLE     0x00000001 /* NPEM Enable */
-+
-+/*
-+ * Native PCIe Enclosure Management indication bits and Reset command bit
-+ * are corresponding for capability and control registers.
-+ */
-+#define  PCI_NPEM_CMD_RESET       0x00000002 /* Reset Command */
-+#define  PCI_NPEM_IND_OK          0x00000004 /* OK */
-+#define  PCI_NPEM_IND_LOCATE      0x00000008 /* Locate */
-+#define  PCI_NPEM_IND_FAIL        0x00000010 /* Fail */
-+#define  PCI_NPEM_IND_REBUILD     0x00000020 /* Rebuild */
-+#define  PCI_NPEM_IND_PFA         0x00000040 /* Predicted Failure Analysis */
-+#define  PCI_NPEM_IND_HOTSPARE    0x00000080 /* Hot Spare */
-+#define  PCI_NPEM_IND_ICA         0x00000100 /* In Critical Array */
-+#define  PCI_NPEM_IND_IFA         0x00000200 /* In Failed Array */
-+#define  PCI_NPEM_IND_IDT         0x00000400 /* Device Type */
-+#define  PCI_NPEM_IND_DISABLED    0x00000800 /* Disabled */
-+#define  PCI_NPEM_IND_SPEC_0      0x01000000
-+#define  PCI_NPEM_IND_SPEC_1      0x02000000
-+#define  PCI_NPEM_IND_SPEC_2      0x04000000
-+#define  PCI_NPEM_IND_SPEC_3      0x08000000
-+#define  PCI_NPEM_IND_SPEC_4      0x10000000
-+#define  PCI_NPEM_IND_SPEC_5      0x20000000
-+#define  PCI_NPEM_IND_SPEC_6      0x40000000
-+#define  PCI_NPEM_IND_SPEC_7      0x80000000
-+
-+#define PCI_NPEM_STATUS  0x0c /* NPEM status register */
-+#define  PCI_NPEM_STATUS_CC       0x00000001 /* Command Completed */
-+
- /* Data Object Exchange */
- #define PCI_DOE_CAP		0x04    /* DOE Capabilities Register */
- #define  PCI_DOE_CAP_INT_SUP			0x00000001  /* Interrupt Support */
-diff --git a/include/standard-headers/linux/virtio_balloon.h b/include/standard-headers/linux/virtio_balloon.h
-index f343bfefd8..3121cd2e0e 100644
---- a/include/standard-headers/linux/virtio_balloon.h
-+++ b/include/standard-headers/linux/virtio_balloon.h
-@@ -71,7 +71,13 @@ struct virtio_balloon_config {
- #define VIRTIO_BALLOON_S_CACHES   7   /* Disk caches */
- #define VIRTIO_BALLOON_S_HTLB_PGALLOC  8  /* Hugetlb page allocations */
- #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
--#define VIRTIO_BALLOON_S_NR       10
-+#define VIRTIO_BALLOON_S_OOM_KILL      10 /* OOM killer invocations */
-+#define VIRTIO_BALLOON_S_ALLOC_STALL   11 /* Stall count of memory allocatoin */
-+#define VIRTIO_BALLOON_S_ASYNC_SCAN    12 /* Amount of memory scanned asynchronously */
-+#define VIRTIO_BALLOON_S_DIRECT_SCAN   13 /* Amount of memory scanned directly */
-+#define VIRTIO_BALLOON_S_ASYNC_RECLAIM 14 /* Amount of memory reclaimed asynchronously */
-+#define VIRTIO_BALLOON_S_DIRECT_RECLAIM 15 /* Amount of memory reclaimed directly */
-+#define VIRTIO_BALLOON_S_NR       16
- 
- #define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
- 	VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
-@@ -83,7 +89,13 @@ struct virtio_balloon_config {
- 	VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
- 	VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
- 	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
--	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
-+	VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "oom-kills", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "alloc-stalls", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "async-scans", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "direct-scans", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "async-reclaims", \
-+	VIRTIO_BALLOON_S_NAMES_prefix "direct-reclaims" \
- }
- 
- #define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
-diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
-index 2db643ed8f..6459fdb9fb 100644
---- a/include/standard-headers/linux/virtio_gpu.h
-+++ b/include/standard-headers/linux/virtio_gpu.h
-@@ -311,6 +311,7 @@ struct virtio_gpu_cmd_submit {
- #define VIRTIO_GPU_CAPSET_VIRGL2 2
- /* 3 is reserved for gfxstream */
- #define VIRTIO_GPU_CAPSET_VENUS 4
-+#define VIRTIO_GPU_CAPSET_DRM 6
- 
- /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
- struct virtio_gpu_get_capset_info {
-diff --git a/linux-headers/asm-arm64/mman.h b/linux-headers/asm-arm64/mman.h
-index d0dbfe9587..7b500a3a7b 100644
---- a/linux-headers/asm-arm64/mman.h
-+++ b/linux-headers/asm-arm64/mman.h
-@@ -7,4 +7,13 @@
- #define PROT_BTI	0x10		/* BTI guarded page */
- #define PROT_MTE	0x20		/* Normal Tagged mapping */
- 
-+/* Override any generic PKEY permission defines */
-+#define PKEY_DISABLE_EXECUTE	0x4
-+#define PKEY_DISABLE_READ	0x8
-+#undef PKEY_ACCESS_MASK
-+#define PKEY_ACCESS_MASK       (PKEY_DISABLE_ACCESS |\
-+				PKEY_DISABLE_WRITE  |\
-+				PKEY_DISABLE_READ   |\
-+				PKEY_DISABLE_EXECUTE)
-+
- #endif /* ! _UAPI__ASM_MMAN_H */
-diff --git a/linux-headers/asm-arm64/unistd.h b/linux-headers/asm-arm64/unistd.h
-index ce2ee8f1e3..df36f23876 100644
---- a/linux-headers/asm-arm64/unistd.h
-+++ b/linux-headers/asm-arm64/unistd.h
-@@ -1,25 +1,2 @@
- /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
--/*
-- * Copyright (C) 2012 ARM Ltd.
-- *
-- * This program is free software; you can redistribute it and/or modify
-- * it under the terms of the GNU General Public License version 2 as
-- * published by the Free Software Foundation.
-- *
-- * This program is distributed in the hope that it will be useful,
-- * but WITHOUT ANY WARRANTY; without even the implied warranty of
-- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-- * GNU General Public License for more details.
-- *
-- * You should have received a copy of the GNU General Public License
-- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-- */
--
--#define __ARCH_WANT_RENAMEAT
--#define __ARCH_WANT_NEW_STAT
--#define __ARCH_WANT_SET_GET_RLIMIT
--#define __ARCH_WANT_TIME32_SYSCALLS
--#define __ARCH_WANT_SYS_CLONE3
--#define __ARCH_WANT_MEMFD_SECRET
--
--#include <asm-generic/unistd.h>
-+#include <asm/unistd_64.h>
-diff --git a/linux-headers/asm-arm64/unistd_64.h b/linux-headers/asm-arm64/unistd_64.h
-new file mode 100644
-index 0000000000..99a1d70459
---- /dev/null
-+++ b/linux-headers/asm-arm64/unistd_64.h
-@@ -0,0 +1,324 @@
-+#ifndef _ASM_UNISTD_64_H
-+#define _ASM_UNISTD_64_H
-+
-+#define __NR_io_setup 0
-+#define __NR_io_destroy 1
-+#define __NR_io_submit 2
-+#define __NR_io_cancel 3
-+#define __NR_io_getevents 4
-+#define __NR_setxattr 5
-+#define __NR_lsetxattr 6
-+#define __NR_fsetxattr 7
-+#define __NR_getxattr 8
-+#define __NR_lgetxattr 9
-+#define __NR_fgetxattr 10
-+#define __NR_listxattr 11
-+#define __NR_llistxattr 12
-+#define __NR_flistxattr 13
-+#define __NR_removexattr 14
-+#define __NR_lremovexattr 15
-+#define __NR_fremovexattr 16
-+#define __NR_getcwd 17
-+#define __NR_lookup_dcookie 18
-+#define __NR_eventfd2 19
-+#define __NR_epoll_create1 20
-+#define __NR_epoll_ctl 21
-+#define __NR_epoll_pwait 22
-+#define __NR_dup 23
-+#define __NR_dup3 24
-+#define __NR_fcntl 25
-+#define __NR_inotify_init1 26
-+#define __NR_inotify_add_watch 27
-+#define __NR_inotify_rm_watch 28
-+#define __NR_ioctl 29
-+#define __NR_ioprio_set 30
-+#define __NR_ioprio_get 31
-+#define __NR_flock 32
-+#define __NR_mknodat 33
-+#define __NR_mkdirat 34
-+#define __NR_unlinkat 35
-+#define __NR_symlinkat 36
-+#define __NR_linkat 37
-+#define __NR_renameat 38
-+#define __NR_umount2 39
-+#define __NR_mount 40
-+#define __NR_pivot_root 41
-+#define __NR_nfsservctl 42
-+#define __NR_statfs 43
-+#define __NR_fstatfs 44
-+#define __NR_truncate 45
-+#define __NR_ftruncate 46
-+#define __NR_fallocate 47
-+#define __NR_faccessat 48
-+#define __NR_chdir 49
-+#define __NR_fchdir 50
-+#define __NR_chroot 51
-+#define __NR_fchmod 52
-+#define __NR_fchmodat 53
-+#define __NR_fchownat 54
-+#define __NR_fchown 55
-+#define __NR_openat 56
-+#define __NR_close 57
-+#define __NR_vhangup 58
-+#define __NR_pipe2 59
-+#define __NR_quotactl 60
-+#define __NR_getdents64 61
-+#define __NR_lseek 62
-+#define __NR_read 63
-+#define __NR_write 64
-+#define __NR_readv 65
-+#define __NR_writev 66
-+#define __NR_pread64 67
-+#define __NR_pwrite64 68
-+#define __NR_preadv 69
-+#define __NR_pwritev 70
-+#define __NR_sendfile 71
-+#define __NR_pselect6 72
-+#define __NR_ppoll 73
-+#define __NR_signalfd4 74
-+#define __NR_vmsplice 75
-+#define __NR_splice 76
-+#define __NR_tee 77
-+#define __NR_readlinkat 78
-+#define __NR_newfstatat 79
-+#define __NR_fstat 80
-+#define __NR_sync 81
-+#define __NR_fsync 82
-+#define __NR_fdatasync 83
-+#define __NR_sync_file_range 84
-+#define __NR_timerfd_create 85
-+#define __NR_timerfd_settime 86
-+#define __NR_timerfd_gettime 87
-+#define __NR_utimensat 88
-+#define __NR_acct 89
-+#define __NR_capget 90
-+#define __NR_capset 91
-+#define __NR_personality 92
-+#define __NR_exit 93
-+#define __NR_exit_group 94
-+#define __NR_waitid 95
-+#define __NR_set_tid_address 96
-+#define __NR_unshare 97
-+#define __NR_futex 98
-+#define __NR_set_robust_list 99
-+#define __NR_get_robust_list 100
-+#define __NR_nanosleep 101
-+#define __NR_getitimer 102
-+#define __NR_setitimer 103
-+#define __NR_kexec_load 104
-+#define __NR_init_module 105
-+#define __NR_delete_module 106
-+#define __NR_timer_create 107
-+#define __NR_timer_gettime 108
-+#define __NR_timer_getoverrun 109
-+#define __NR_timer_settime 110
-+#define __NR_timer_delete 111
-+#define __NR_clock_settime 112
-+#define __NR_clock_gettime 113
-+#define __NR_clock_getres 114
-+#define __NR_clock_nanosleep 115
-+#define __NR_syslog 116
-+#define __NR_ptrace 117
-+#define __NR_sched_setparam 118
-+#define __NR_sched_setscheduler 119
-+#define __NR_sched_getscheduler 120
-+#define __NR_sched_getparam 121
-+#define __NR_sched_setaffinity 122
-+#define __NR_sched_getaffinity 123
-+#define __NR_sched_yield 124
-+#define __NR_sched_get_priority_max 125
-+#define __NR_sched_get_priority_min 126
-+#define __NR_sched_rr_get_interval 127
-+#define __NR_restart_syscall 128
-+#define __NR_kill 129
-+#define __NR_tkill 130
-+#define __NR_tgkill 131
-+#define __NR_sigaltstack 132
-+#define __NR_rt_sigsuspend 133
-+#define __NR_rt_sigaction 134
-+#define __NR_rt_sigprocmask 135
-+#define __NR_rt_sigpending 136
-+#define __NR_rt_sigtimedwait 137
-+#define __NR_rt_sigqueueinfo 138
-+#define __NR_rt_sigreturn 139
-+#define __NR_setpriority 140
-+#define __NR_getpriority 141
-+#define __NR_reboot 142
-+#define __NR_setregid 143
-+#define __NR_setgid 144
-+#define __NR_setreuid 145
-+#define __NR_setuid 146
-+#define __NR_setresuid 147
-+#define __NR_getresuid 148
-+#define __NR_setresgid 149
-+#define __NR_getresgid 150
-+#define __NR_setfsuid 151
-+#define __NR_setfsgid 152
-+#define __NR_times 153
-+#define __NR_setpgid 154
-+#define __NR_getpgid 155
-+#define __NR_getsid 156
-+#define __NR_setsid 157
-+#define __NR_getgroups 158
-+#define __NR_setgroups 159
-+#define __NR_uname 160
-+#define __NR_sethostname 161
-+#define __NR_setdomainname 162
-+#define __NR_getrlimit 163
-+#define __NR_setrlimit 164
-+#define __NR_getrusage 165
-+#define __NR_umask 166
-+#define __NR_prctl 167
-+#define __NR_getcpu 168
-+#define __NR_gettimeofday 169
-+#define __NR_settimeofday 170
-+#define __NR_adjtimex 171
-+#define __NR_getpid 172
-+#define __NR_getppid 173
-+#define __NR_getuid 174
-+#define __NR_geteuid 175
-+#define __NR_getgid 176
-+#define __NR_getegid 177
-+#define __NR_gettid 178
-+#define __NR_sysinfo 179
-+#define __NR_mq_open 180
-+#define __NR_mq_unlink 181
-+#define __NR_mq_timedsend 182
-+#define __NR_mq_timedreceive 183
-+#define __NR_mq_notify 184
-+#define __NR_mq_getsetattr 185
-+#define __NR_msgget 186
-+#define __NR_msgctl 187
-+#define __NR_msgrcv 188
-+#define __NR_msgsnd 189
-+#define __NR_semget 190
-+#define __NR_semctl 191
-+#define __NR_semtimedop 192
-+#define __NR_semop 193
-+#define __NR_shmget 194
-+#define __NR_shmctl 195
-+#define __NR_shmat 196
-+#define __NR_shmdt 197
-+#define __NR_socket 198
-+#define __NR_socketpair 199
-+#define __NR_bind 200
-+#define __NR_listen 201
-+#define __NR_accept 202
-+#define __NR_connect 203
-+#define __NR_getsockname 204
-+#define __NR_getpeername 205
-+#define __NR_sendto 206
-+#define __NR_recvfrom 207
-+#define __NR_setsockopt 208
-+#define __NR_getsockopt 209
-+#define __NR_shutdown 210
-+#define __NR_sendmsg 211
-+#define __NR_recvmsg 212
-+#define __NR_readahead 213
-+#define __NR_brk 214
-+#define __NR_munmap 215
-+#define __NR_mremap 216
-+#define __NR_add_key 217
-+#define __NR_request_key 218
-+#define __NR_keyctl 219
-+#define __NR_clone 220
-+#define __NR_execve 221
-+#define __NR_mmap 222
-+#define __NR_fadvise64 223
-+#define __NR_swapon 224
-+#define __NR_swapoff 225
-+#define __NR_mprotect 226
-+#define __NR_msync 227
-+#define __NR_mlock 228
-+#define __NR_munlock 229
-+#define __NR_mlockall 230
-+#define __NR_munlockall 231
-+#define __NR_mincore 232
-+#define __NR_madvise 233
-+#define __NR_remap_file_pages 234
-+#define __NR_mbind 235
-+#define __NR_get_mempolicy 236
-+#define __NR_set_mempolicy 237
-+#define __NR_migrate_pages 238
-+#define __NR_move_pages 239
-+#define __NR_rt_tgsigqueueinfo 240
-+#define __NR_perf_event_open 241
-+#define __NR_accept4 242
-+#define __NR_recvmmsg 243
-+#define __NR_wait4 260
-+#define __NR_prlimit64 261
-+#define __NR_fanotify_init 262
-+#define __NR_fanotify_mark 263
-+#define __NR_name_to_handle_at 264
-+#define __NR_open_by_handle_at 265
-+#define __NR_clock_adjtime 266
-+#define __NR_syncfs 267
-+#define __NR_setns 268
-+#define __NR_sendmmsg 269
-+#define __NR_process_vm_readv 270
-+#define __NR_process_vm_writev 271
-+#define __NR_kcmp 272
-+#define __NR_finit_module 273
-+#define __NR_sched_setattr 274
-+#define __NR_sched_getattr 275
-+#define __NR_renameat2 276
-+#define __NR_seccomp 277
-+#define __NR_getrandom 278
-+#define __NR_memfd_create 279
-+#define __NR_bpf 280
-+#define __NR_execveat 281
-+#define __NR_userfaultfd 282
-+#define __NR_membarrier 283
-+#define __NR_mlock2 284
-+#define __NR_copy_file_range 285
-+#define __NR_preadv2 286
-+#define __NR_pwritev2 287
-+#define __NR_pkey_mprotect 288
-+#define __NR_pkey_alloc 289
-+#define __NR_pkey_free 290
-+#define __NR_statx 291
-+#define __NR_io_pgetevents 292
-+#define __NR_rseq 293
-+#define __NR_kexec_file_load 294
-+#define __NR_pidfd_send_signal 424
-+#define __NR_io_uring_setup 425
-+#define __NR_io_uring_enter 426
-+#define __NR_io_uring_register 427
-+#define __NR_open_tree 428
-+#define __NR_move_mount 429
-+#define __NR_fsopen 430
-+#define __NR_fsconfig 431
-+#define __NR_fsmount 432
-+#define __NR_fspick 433
-+#define __NR_pidfd_open 434
-+#define __NR_clone3 435
-+#define __NR_close_range 436
-+#define __NR_openat2 437
-+#define __NR_pidfd_getfd 438
-+#define __NR_faccessat2 439
-+#define __NR_process_madvise 440
-+#define __NR_epoll_pwait2 441
-+#define __NR_mount_setattr 442
-+#define __NR_quotactl_fd 443
-+#define __NR_landlock_create_ruleset 444
-+#define __NR_landlock_add_rule 445
-+#define __NR_landlock_restrict_self 446
-+#define __NR_memfd_secret 447
-+#define __NR_process_mrelease 448
-+#define __NR_futex_waitv 449
-+#define __NR_set_mempolicy_home_node 450
-+#define __NR_cachestat 451
-+#define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
-+#define __NR_statmount 457
-+#define __NR_listmount 458
-+#define __NR_lsm_get_self_attr 459
-+#define __NR_lsm_set_self_attr 460
-+#define __NR_lsm_list_modules 461
-+#define __NR_mseal 462
-+
-+
-+#endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
-index d983c48a3b..5bf6148cac 100644
---- a/linux-headers/asm-generic/unistd.h
-+++ b/linux-headers/asm-generic/unistd.h
-@@ -737,7 +737,7 @@ __SC_COMP(__NR_pselect6_time64, sys_pselect6, compat_sys_pselect6_time64)
- #define __NR_ppoll_time64 414
- __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)
- #define __NR_io_pgetevents_time64 416
--__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents)
-+__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64)
- #define __NR_recvmmsg_time64 417
- __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)
- #define __NR_mq_timedsend_time64 418
-@@ -776,12 +776,8 @@ __SYSCALL(__NR_fsmount, sys_fsmount)
- __SYSCALL(__NR_fspick, sys_fspick)
- #define __NR_pidfd_open 434
- __SYSCALL(__NR_pidfd_open, sys_pidfd_open)
--
--#ifdef __ARCH_WANT_SYS_CLONE3
- #define __NR_clone3 435
- __SYSCALL(__NR_clone3, sys_clone3)
--#endif
--
- #define __NR_close_range 436
- __SYSCALL(__NR_close_range, sys_close_range)
- #define __NR_openat2 437
-diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
-index f9abef3823..70d89070bf 100644
---- a/linux-headers/asm-loongarch/kvm.h
-+++ b/linux-headers/asm-loongarch/kvm.h
-@@ -64,6 +64,7 @@ struct kvm_fpu {
- #define KVM_REG_LOONGARCH_KVM		(KVM_REG_LOONGARCH | 0x20000ULL)
- #define KVM_REG_LOONGARCH_FPSIMD	(KVM_REG_LOONGARCH | 0x30000ULL)
- #define KVM_REG_LOONGARCH_CPUCFG	(KVM_REG_LOONGARCH | 0x40000ULL)
-+#define KVM_REG_LOONGARCH_LBT		(KVM_REG_LOONGARCH | 0x50000ULL)
- #define KVM_REG_LOONGARCH_MASK		(KVM_REG_LOONGARCH | 0x70000ULL)
- #define KVM_CSR_IDX_MASK		0x7fff
- #define KVM_CPUCFG_IDX_MASK		0x7fff
-@@ -77,11 +78,34 @@ struct kvm_fpu {
- /* Debugging: Special instruction for software breakpoint */
- #define KVM_REG_LOONGARCH_DEBUG_INST	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 3)
- 
-+/* LBT registers */
-+#define KVM_REG_LOONGARCH_LBT_SCR0	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 1)
-+#define KVM_REG_LOONGARCH_LBT_SCR1	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 2)
-+#define KVM_REG_LOONGARCH_LBT_SCR2	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 3)
-+#define KVM_REG_LOONGARCH_LBT_SCR3	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 4)
-+#define KVM_REG_LOONGARCH_LBT_EFLAGS	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 5)
-+#define KVM_REG_LOONGARCH_LBT_FTOP	(KVM_REG_LOONGARCH_LBT | KVM_REG_SIZE_U64 | 6)
-+
- #define LOONGARCH_REG_SHIFT		3
- #define LOONGARCH_REG_64(TYPE, REG)	(TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
- #define KVM_IOC_CSRID(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CSR, REG)
- #define KVM_IOC_CPUCFG(REG)		LOONGARCH_REG_64(KVM_REG_LOONGARCH_CPUCFG, REG)
-+
-+/* Device Control API on vm fd */
-+#define KVM_LOONGARCH_VM_FEAT_CTRL		0
-+#define  KVM_LOONGARCH_VM_FEAT_LSX		0
-+#define  KVM_LOONGARCH_VM_FEAT_LASX		1
-+#define  KVM_LOONGARCH_VM_FEAT_X86BT		2
-+#define  KVM_LOONGARCH_VM_FEAT_ARMBT		3
-+#define  KVM_LOONGARCH_VM_FEAT_MIPSBT		4
-+#define  KVM_LOONGARCH_VM_FEAT_PMU		5
-+#define  KVM_LOONGARCH_VM_FEAT_PV_IPI		6
-+#define  KVM_LOONGARCH_VM_FEAT_PV_STEALTIME	7
-+
-+/* Device Control API on vcpu fd */
- #define KVM_LOONGARCH_VCPU_CPUCFG	0
-+#define KVM_LOONGARCH_VCPU_PVTIME_CTRL	1
-+#define  KVM_LOONGARCH_VCPU_PVTIME_GPA	0
- 
- struct kvm_debug_exit_arch {
- };
-diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
-new file mode 100644
-index 0000000000..4ba4ad8db1
---- /dev/null
-+++ b/linux-headers/asm-loongarch/kvm_para.h
-@@ -0,0 +1,21 @@
-+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-+#ifndef _ASM_KVM_PARA_H
-+#define _ASM_KVM_PARA_H
-+
-+#include <linux/types.h>
-+
-+/*
-+ * CPUCFG index area: 0x40000000 -- 0x400000ff
-+ * SW emulation for KVM hypervirsor
-+ */
-+#define CPUCFG_KVM_BASE			0x40000000
-+#define CPUCFG_KVM_SIZE			0x100
-+#define CPUCFG_KVM_SIG			(CPUCFG_KVM_BASE + 0)
-+#define  KVM_SIGNATURE			"KVM\0"
-+#define CPUCFG_KVM_FEATURE		(CPUCFG_KVM_BASE + 4)
-+#define  KVM_FEATURE_IPI		1
-+#define  KVM_FEATURE_STEAL_TIME		2
-+/* BIT 24 - 31 are features configurable by user space vmm */
-+#define  KVM_FEATURE_VIRT_EXTIOI	24
-+
-+#endif /* _ASM_KVM_PARA_H */
-diff --git a/linux-headers/asm-loongarch/unistd.h b/linux-headers/asm-loongarch/unistd.h
-index fcb668984f..1f01980f9c 100644
---- a/linux-headers/asm-loongarch/unistd.h
-+++ b/linux-headers/asm-loongarch/unistd.h
-@@ -1,5 +1,3 @@
- /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
--#define __ARCH_WANT_SYS_CLONE
--#define __ARCH_WANT_SYS_CLONE3
- 
--#include <asm-generic/unistd.h>
-+#include <asm/unistd_64.h>
-diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
-new file mode 100644
-index 0000000000..887ea50cca
---- /dev/null
-+++ b/linux-headers/asm-loongarch/unistd_64.h
-@@ -0,0 +1,320 @@
-+#ifndef _ASM_UNISTD_64_H
-+#define _ASM_UNISTD_64_H
-+
-+#define __NR_io_setup 0
-+#define __NR_io_destroy 1
-+#define __NR_io_submit 2
-+#define __NR_io_cancel 3
-+#define __NR_io_getevents 4
-+#define __NR_setxattr 5
-+#define __NR_lsetxattr 6
-+#define __NR_fsetxattr 7
-+#define __NR_getxattr 8
-+#define __NR_lgetxattr 9
-+#define __NR_fgetxattr 10
-+#define __NR_listxattr 11
-+#define __NR_llistxattr 12
-+#define __NR_flistxattr 13
-+#define __NR_removexattr 14
-+#define __NR_lremovexattr 15
-+#define __NR_fremovexattr 16
-+#define __NR_getcwd 17
-+#define __NR_lookup_dcookie 18
-+#define __NR_eventfd2 19
-+#define __NR_epoll_create1 20
-+#define __NR_epoll_ctl 21
-+#define __NR_epoll_pwait 22
-+#define __NR_dup 23
-+#define __NR_dup3 24
-+#define __NR_fcntl 25
-+#define __NR_inotify_init1 26
-+#define __NR_inotify_add_watch 27
-+#define __NR_inotify_rm_watch 28
-+#define __NR_ioctl 29
-+#define __NR_ioprio_set 30
-+#define __NR_ioprio_get 31
-+#define __NR_flock 32
-+#define __NR_mknodat 33
-+#define __NR_mkdirat 34
-+#define __NR_unlinkat 35
-+#define __NR_symlinkat 36
-+#define __NR_linkat 37
-+#define __NR_umount2 39
-+#define __NR_mount 40
-+#define __NR_pivot_root 41
-+#define __NR_nfsservctl 42
-+#define __NR_statfs 43
-+#define __NR_fstatfs 44
-+#define __NR_truncate 45
-+#define __NR_ftruncate 46
-+#define __NR_fallocate 47
-+#define __NR_faccessat 48
-+#define __NR_chdir 49
-+#define __NR_fchdir 50
-+#define __NR_chroot 51
-+#define __NR_fchmod 52
-+#define __NR_fchmodat 53
-+#define __NR_fchownat 54
-+#define __NR_fchown 55
-+#define __NR_openat 56
-+#define __NR_close 57
-+#define __NR_vhangup 58
-+#define __NR_pipe2 59
-+#define __NR_quotactl 60
-+#define __NR_getdents64 61
-+#define __NR_lseek 62
-+#define __NR_read 63
-+#define __NR_write 64
-+#define __NR_readv 65
-+#define __NR_writev 66
-+#define __NR_pread64 67
-+#define __NR_pwrite64 68
-+#define __NR_preadv 69
-+#define __NR_pwritev 70
-+#define __NR_sendfile 71
-+#define __NR_pselect6 72
-+#define __NR_ppoll 73
-+#define __NR_signalfd4 74
-+#define __NR_vmsplice 75
-+#define __NR_splice 76
-+#define __NR_tee 77
-+#define __NR_readlinkat 78
-+#define __NR_newfstatat 79
-+#define __NR_fstat 80
-+#define __NR_sync 81
-+#define __NR_fsync 82
-+#define __NR_fdatasync 83
-+#define __NR_sync_file_range 84
-+#define __NR_timerfd_create 85
-+#define __NR_timerfd_settime 86
-+#define __NR_timerfd_gettime 87
-+#define __NR_utimensat 88
-+#define __NR_acct 89
-+#define __NR_capget 90
-+#define __NR_capset 91
-+#define __NR_personality 92
-+#define __NR_exit 93
-+#define __NR_exit_group 94
-+#define __NR_waitid 95
-+#define __NR_set_tid_address 96
-+#define __NR_unshare 97
-+#define __NR_futex 98
-+#define __NR_set_robust_list 99
-+#define __NR_get_robust_list 100
-+#define __NR_nanosleep 101
-+#define __NR_getitimer 102
-+#define __NR_setitimer 103
-+#define __NR_kexec_load 104
-+#define __NR_init_module 105
-+#define __NR_delete_module 106
-+#define __NR_timer_create 107
-+#define __NR_timer_gettime 108
-+#define __NR_timer_getoverrun 109
-+#define __NR_timer_settime 110
-+#define __NR_timer_delete 111
-+#define __NR_clock_settime 112
-+#define __NR_clock_gettime 113
-+#define __NR_clock_getres 114
-+#define __NR_clock_nanosleep 115
-+#define __NR_syslog 116
-+#define __NR_ptrace 117
-+#define __NR_sched_setparam 118
-+#define __NR_sched_setscheduler 119
-+#define __NR_sched_getscheduler 120
-+#define __NR_sched_getparam 121
-+#define __NR_sched_setaffinity 122
-+#define __NR_sched_getaffinity 123
-+#define __NR_sched_yield 124
-+#define __NR_sched_get_priority_max 125
-+#define __NR_sched_get_priority_min 126
-+#define __NR_sched_rr_get_interval 127
-+#define __NR_restart_syscall 128
-+#define __NR_kill 129
-+#define __NR_tkill 130
-+#define __NR_tgkill 131
-+#define __NR_sigaltstack 132
-+#define __NR_rt_sigsuspend 133
-+#define __NR_rt_sigaction 134
-+#define __NR_rt_sigprocmask 135
-+#define __NR_rt_sigpending 136
-+#define __NR_rt_sigtimedwait 137
-+#define __NR_rt_sigqueueinfo 138
-+#define __NR_rt_sigreturn 139
-+#define __NR_setpriority 140
-+#define __NR_getpriority 141
-+#define __NR_reboot 142
-+#define __NR_setregid 143
-+#define __NR_setgid 144
-+#define __NR_setreuid 145
-+#define __NR_setuid 146
-+#define __NR_setresuid 147
-+#define __NR_getresuid 148
-+#define __NR_setresgid 149
-+#define __NR_getresgid 150
-+#define __NR_setfsuid 151
-+#define __NR_setfsgid 152
-+#define __NR_times 153
-+#define __NR_setpgid 154
-+#define __NR_getpgid 155
-+#define __NR_getsid 156
-+#define __NR_setsid 157
-+#define __NR_getgroups 158
-+#define __NR_setgroups 159
-+#define __NR_uname 160
-+#define __NR_sethostname 161
-+#define __NR_setdomainname 162
-+#define __NR_getrusage 165
-+#define __NR_umask 166
-+#define __NR_prctl 167
-+#define __NR_getcpu 168
-+#define __NR_gettimeofday 169
-+#define __NR_settimeofday 170
-+#define __NR_adjtimex 171
-+#define __NR_getpid 172
-+#define __NR_getppid 173
-+#define __NR_getuid 174
-+#define __NR_geteuid 175
-+#define __NR_getgid 176
-+#define __NR_getegid 177
-+#define __NR_gettid 178
-+#define __NR_sysinfo 179
-+#define __NR_mq_open 180
-+#define __NR_mq_unlink 181
-+#define __NR_mq_timedsend 182
-+#define __NR_mq_timedreceive 183
-+#define __NR_mq_notify 184
-+#define __NR_mq_getsetattr 185
-+#define __NR_msgget 186
-+#define __NR_msgctl 187
-+#define __NR_msgrcv 188
-+#define __NR_msgsnd 189
-+#define __NR_semget 190
-+#define __NR_semctl 191
-+#define __NR_semtimedop 192
-+#define __NR_semop 193
-+#define __NR_shmget 194
-+#define __NR_shmctl 195
-+#define __NR_shmat 196
-+#define __NR_shmdt 197
-+#define __NR_socket 198
-+#define __NR_socketpair 199
-+#define __NR_bind 200
-+#define __NR_listen 201
-+#define __NR_accept 202
-+#define __NR_connect 203
-+#define __NR_getsockname 204
-+#define __NR_getpeername 205
-+#define __NR_sendto 206
-+#define __NR_recvfrom 207
-+#define __NR_setsockopt 208
-+#define __NR_getsockopt 209
-+#define __NR_shutdown 210
-+#define __NR_sendmsg 211
-+#define __NR_recvmsg 212
-+#define __NR_readahead 213
-+#define __NR_brk 214
-+#define __NR_munmap 215
-+#define __NR_mremap 216
-+#define __NR_add_key 217
-+#define __NR_request_key 218
-+#define __NR_keyctl 219
-+#define __NR_clone 220
-+#define __NR_execve 221
-+#define __NR_mmap 222
-+#define __NR_fadvise64 223
-+#define __NR_swapon 224
-+#define __NR_swapoff 225
-+#define __NR_mprotect 226
-+#define __NR_msync 227
-+#define __NR_mlock 228
-+#define __NR_munlock 229
-+#define __NR_mlockall 230
-+#define __NR_munlockall 231
-+#define __NR_mincore 232
-+#define __NR_madvise 233
-+#define __NR_remap_file_pages 234
-+#define __NR_mbind 235
-+#define __NR_get_mempolicy 236
-+#define __NR_set_mempolicy 237
-+#define __NR_migrate_pages 238
-+#define __NR_move_pages 239
-+#define __NR_rt_tgsigqueueinfo 240
-+#define __NR_perf_event_open 241
-+#define __NR_accept4 242
-+#define __NR_recvmmsg 243
-+#define __NR_wait4 260
-+#define __NR_prlimit64 261
-+#define __NR_fanotify_init 262
-+#define __NR_fanotify_mark 263
-+#define __NR_name_to_handle_at 264
-+#define __NR_open_by_handle_at 265
-+#define __NR_clock_adjtime 266
-+#define __NR_syncfs 267
-+#define __NR_setns 268
-+#define __NR_sendmmsg 269
-+#define __NR_process_vm_readv 270
-+#define __NR_process_vm_writev 271
-+#define __NR_kcmp 272
-+#define __NR_finit_module 273
-+#define __NR_sched_setattr 274
-+#define __NR_sched_getattr 275
-+#define __NR_renameat2 276
-+#define __NR_seccomp 277
-+#define __NR_getrandom 278
-+#define __NR_memfd_create 279
-+#define __NR_bpf 280
-+#define __NR_execveat 281
-+#define __NR_userfaultfd 282
-+#define __NR_membarrier 283
-+#define __NR_mlock2 284
-+#define __NR_copy_file_range 285
-+#define __NR_preadv2 286
-+#define __NR_pwritev2 287
-+#define __NR_pkey_mprotect 288
-+#define __NR_pkey_alloc 289
-+#define __NR_pkey_free 290
-+#define __NR_statx 291
-+#define __NR_io_pgetevents 292
-+#define __NR_rseq 293
-+#define __NR_kexec_file_load 294
-+#define __NR_pidfd_send_signal 424
-+#define __NR_io_uring_setup 425
-+#define __NR_io_uring_enter 426
-+#define __NR_io_uring_register 427
-+#define __NR_open_tree 428
-+#define __NR_move_mount 429
-+#define __NR_fsopen 430
-+#define __NR_fsconfig 431
-+#define __NR_fsmount 432
-+#define __NR_fspick 433
-+#define __NR_pidfd_open 434
-+#define __NR_clone3 435
-+#define __NR_close_range 436
-+#define __NR_openat2 437
-+#define __NR_pidfd_getfd 438
-+#define __NR_faccessat2 439
-+#define __NR_process_madvise 440
-+#define __NR_epoll_pwait2 441
-+#define __NR_mount_setattr 442
-+#define __NR_quotactl_fd 443
-+#define __NR_landlock_create_ruleset 444
-+#define __NR_landlock_add_rule 445
-+#define __NR_landlock_restrict_self 446
-+#define __NR_process_mrelease 448
-+#define __NR_futex_waitv 449
-+#define __NR_set_mempolicy_home_node 450
-+#define __NR_cachestat 451
-+#define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
-+#define __NR_statmount 457
-+#define __NR_listmount 458
-+#define __NR_lsm_get_self_attr 459
-+#define __NR_lsm_set_self_attr 460
-+#define __NR_lsm_list_modules 461
-+#define __NR_mseal 462
-+
-+
-+#endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-index e878e7cc39..e97db32964 100644
---- a/linux-headers/asm-riscv/kvm.h
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -168,6 +168,13 @@ enum KVM_RISCV_ISA_EXT_ID {
- 	KVM_RISCV_ISA_EXT_ZTSO,
- 	KVM_RISCV_ISA_EXT_ZACAS,
- 	KVM_RISCV_ISA_EXT_SSCOFPMF,
-+	KVM_RISCV_ISA_EXT_ZIMOP,
-+	KVM_RISCV_ISA_EXT_ZCA,
-+	KVM_RISCV_ISA_EXT_ZCB,
-+	KVM_RISCV_ISA_EXT_ZCD,
-+	KVM_RISCV_ISA_EXT_ZCF,
-+	KVM_RISCV_ISA_EXT_ZCMOP,
-+	KVM_RISCV_ISA_EXT_ZAWRS,
- 	KVM_RISCV_ISA_EXT_MAX,
- };
- 
-diff --git a/linux-headers/asm-riscv/unistd.h b/linux-headers/asm-riscv/unistd.h
-index 950ab3fd44..81896bbbf7 100644
---- a/linux-headers/asm-riscv/unistd.h
-+++ b/linux-headers/asm-riscv/unistd.h
-@@ -14,41 +14,10 @@
-  * You should have received a copy of the GNU General Public License
-  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
-  */
-+#include <asm/bitsperlong.h>
- 
--#if defined(__LP64__) && !defined(__SYSCALL_COMPAT)
--#define __ARCH_WANT_NEW_STAT
--#define __ARCH_WANT_SET_GET_RLIMIT
--#endif /* __LP64__ */
--
--#define __ARCH_WANT_SYS_CLONE3
--#define __ARCH_WANT_MEMFD_SECRET
--
--#include <asm-generic/unistd.h>
--
--/*
-- * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
-- * having a direct 'fence.i' instruction available to userspace (which we
-- * can't trap!), that's not actually viable when running on Linux because the
-- * kernel might schedule a process on another hart.  There is no way for
-- * userspace to handle this without invoking the kernel (as it doesn't know the
-- * thread->hart mappings), so we've defined a RISC-V specific system call to
-- * flush the instruction cache.
-- *
-- * __NR_riscv_flush_icache is defined to flush the instruction cache over an
-- * address range, with the flush applying to either all threads or just the
-- * caller.  We don't currently do anything with the address range, that's just
-- * in there for forwards compatibility.
-- */
--#ifndef __NR_riscv_flush_icache
--#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
--#endif
--__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
--
--/*
-- * Allows userspace to query the kernel for CPU architecture and
-- * microarchitecture details across a given set of CPUs.
-- */
--#ifndef __NR_riscv_hwprobe
--#define __NR_riscv_hwprobe (__NR_arch_specific_syscall + 14)
-+#if __BITS_PER_LONG == 64
-+#include <asm/unistd_64.h>
-+#else
-+#include <asm/unistd_32.h>
- #endif
--__SYSCALL(__NR_riscv_hwprobe, sys_riscv_hwprobe)
-diff --git a/linux-headers/asm-riscv/unistd_32.h b/linux-headers/asm-riscv/unistd_32.h
-new file mode 100644
-index 0000000000..9625743dfd
---- /dev/null
-+++ b/linux-headers/asm-riscv/unistd_32.h
-@@ -0,0 +1,315 @@
-+#ifndef _ASM_UNISTD_32_H
-+#define _ASM_UNISTD_32_H
-+
-+#define __NR_io_setup 0
-+#define __NR_io_destroy 1
-+#define __NR_io_submit 2
-+#define __NR_io_cancel 3
-+#define __NR_setxattr 5
-+#define __NR_lsetxattr 6
-+#define __NR_fsetxattr 7
-+#define __NR_getxattr 8
-+#define __NR_lgetxattr 9
-+#define __NR_fgetxattr 10
-+#define __NR_listxattr 11
-+#define __NR_llistxattr 12
-+#define __NR_flistxattr 13
-+#define __NR_removexattr 14
-+#define __NR_lremovexattr 15
-+#define __NR_fremovexattr 16
-+#define __NR_getcwd 17
-+#define __NR_lookup_dcookie 18
-+#define __NR_eventfd2 19
-+#define __NR_epoll_create1 20
-+#define __NR_epoll_ctl 21
-+#define __NR_epoll_pwait 22
-+#define __NR_dup 23
-+#define __NR_dup3 24
-+#define __NR_fcntl64 25
-+#define __NR_inotify_init1 26
-+#define __NR_inotify_add_watch 27
-+#define __NR_inotify_rm_watch 28
-+#define __NR_ioctl 29
-+#define __NR_ioprio_set 30
-+#define __NR_ioprio_get 31
-+#define __NR_flock 32
-+#define __NR_mknodat 33
-+#define __NR_mkdirat 34
-+#define __NR_unlinkat 35
-+#define __NR_symlinkat 36
-+#define __NR_linkat 37
-+#define __NR_umount2 39
-+#define __NR_mount 40
-+#define __NR_pivot_root 41
-+#define __NR_nfsservctl 42
-+#define __NR_statfs64 43
-+#define __NR_fstatfs64 44
-+#define __NR_truncate64 45
-+#define __NR_ftruncate64 46
-+#define __NR_fallocate 47
-+#define __NR_faccessat 48
-+#define __NR_chdir 49
-+#define __NR_fchdir 50
-+#define __NR_chroot 51
-+#define __NR_fchmod 52
-+#define __NR_fchmodat 53
-+#define __NR_fchownat 54
-+#define __NR_fchown 55
-+#define __NR_openat 56
-+#define __NR_close 57
-+#define __NR_vhangup 58
-+#define __NR_pipe2 59
-+#define __NR_quotactl 60
-+#define __NR_getdents64 61
-+#define __NR_llseek 62
-+#define __NR_read 63
-+#define __NR_write 64
-+#define __NR_readv 65
-+#define __NR_writev 66
-+#define __NR_pread64 67
-+#define __NR_pwrite64 68
-+#define __NR_preadv 69
-+#define __NR_pwritev 70
-+#define __NR_sendfile64 71
-+#define __NR_signalfd4 74
-+#define __NR_vmsplice 75
-+#define __NR_splice 76
-+#define __NR_tee 77
-+#define __NR_readlinkat 78
-+#define __NR_sync 81
-+#define __NR_fsync 82
-+#define __NR_fdatasync 83
-+#define __NR_sync_file_range 84
-+#define __NR_timerfd_create 85
-+#define __NR_acct 89
-+#define __NR_capget 90
-+#define __NR_capset 91
-+#define __NR_personality 92
-+#define __NR_exit 93
-+#define __NR_exit_group 94
-+#define __NR_waitid 95
-+#define __NR_set_tid_address 96
-+#define __NR_unshare 97
-+#define __NR_set_robust_list 99
-+#define __NR_get_robust_list 100
-+#define __NR_getitimer 102
-+#define __NR_setitimer 103
-+#define __NR_kexec_load 104
-+#define __NR_init_module 105
-+#define __NR_delete_module 106
-+#define __NR_timer_create 107
-+#define __NR_timer_getoverrun 109
-+#define __NR_timer_delete 111
-+#define __NR_syslog 116
-+#define __NR_ptrace 117
-+#define __NR_sched_setparam 118
-+#define __NR_sched_setscheduler 119
-+#define __NR_sched_getscheduler 120
-+#define __NR_sched_getparam 121
-+#define __NR_sched_setaffinity 122
-+#define __NR_sched_getaffinity 123
-+#define __NR_sched_yield 124
-+#define __NR_sched_get_priority_max 125
-+#define __NR_sched_get_priority_min 126
-+#define __NR_restart_syscall 128
-+#define __NR_kill 129
-+#define __NR_tkill 130
-+#define __NR_tgkill 131
-+#define __NR_sigaltstack 132
-+#define __NR_rt_sigsuspend 133
-+#define __NR_rt_sigaction 134
-+#define __NR_rt_sigprocmask 135
-+#define __NR_rt_sigpending 136
-+#define __NR_rt_sigqueueinfo 138
-+#define __NR_rt_sigreturn 139
-+#define __NR_setpriority 140
-+#define __NR_getpriority 141
-+#define __NR_reboot 142
-+#define __NR_setregid 143
-+#define __NR_setgid 144
-+#define __NR_setreuid 145
-+#define __NR_setuid 146
-+#define __NR_setresuid 147
-+#define __NR_getresuid 148
-+#define __NR_setresgid 149
-+#define __NR_getresgid 150
-+#define __NR_setfsuid 151
-+#define __NR_setfsgid 152
-+#define __NR_times 153
-+#define __NR_setpgid 154
-+#define __NR_getpgid 155
-+#define __NR_getsid 156
-+#define __NR_setsid 157
-+#define __NR_getgroups 158
-+#define __NR_setgroups 159
-+#define __NR_uname 160
-+#define __NR_sethostname 161
-+#define __NR_setdomainname 162
-+#define __NR_getrusage 165
-+#define __NR_umask 166
-+#define __NR_prctl 167
-+#define __NR_getcpu 168
-+#define __NR_getpid 172
-+#define __NR_getppid 173
-+#define __NR_getuid 174
-+#define __NR_geteuid 175
-+#define __NR_getgid 176
-+#define __NR_getegid 177
-+#define __NR_gettid 178
-+#define __NR_sysinfo 179
-+#define __NR_mq_open 180
-+#define __NR_mq_unlink 181
-+#define __NR_mq_notify 184
-+#define __NR_mq_getsetattr 185
-+#define __NR_msgget 186
-+#define __NR_msgctl 187
-+#define __NR_msgrcv 188
-+#define __NR_msgsnd 189
-+#define __NR_semget 190
-+#define __NR_semctl 191
-+#define __NR_semop 193
-+#define __NR_shmget 194
-+#define __NR_shmctl 195
-+#define __NR_shmat 196
-+#define __NR_shmdt 197
-+#define __NR_socket 198
-+#define __NR_socketpair 199
-+#define __NR_bind 200
-+#define __NR_listen 201
-+#define __NR_accept 202
-+#define __NR_connect 203
-+#define __NR_getsockname 204
-+#define __NR_getpeername 205
-+#define __NR_sendto 206
-+#define __NR_recvfrom 207
-+#define __NR_setsockopt 208
-+#define __NR_getsockopt 209
-+#define __NR_shutdown 210
-+#define __NR_sendmsg 211
-+#define __NR_recvmsg 212
-+#define __NR_readahead 213
-+#define __NR_brk 214
-+#define __NR_munmap 215
-+#define __NR_mremap 216
-+#define __NR_add_key 217
-+#define __NR_request_key 218
-+#define __NR_keyctl 219
-+#define __NR_clone 220
-+#define __NR_execve 221
-+#define __NR_mmap2 222
-+#define __NR_fadvise64_64 223
-+#define __NR_swapon 224
-+#define __NR_swapoff 225
-+#define __NR_mprotect 226
-+#define __NR_msync 227
-+#define __NR_mlock 228
-+#define __NR_munlock 229
-+#define __NR_mlockall 230
-+#define __NR_munlockall 231
-+#define __NR_mincore 232
-+#define __NR_madvise 233
-+#define __NR_remap_file_pages 234
-+#define __NR_mbind 235
-+#define __NR_get_mempolicy 236
-+#define __NR_set_mempolicy 237
-+#define __NR_migrate_pages 238
-+#define __NR_move_pages 239
-+#define __NR_rt_tgsigqueueinfo 240
-+#define __NR_perf_event_open 241
-+#define __NR_accept4 242
-+#define __NR_riscv_hwprobe 258
-+#define __NR_riscv_flush_icache 259
-+#define __NR_prlimit64 261
-+#define __NR_fanotify_init 262
-+#define __NR_fanotify_mark 263
-+#define __NR_name_to_handle_at 264
-+#define __NR_open_by_handle_at 265
-+#define __NR_syncfs 267
-+#define __NR_setns 268
-+#define __NR_sendmmsg 269
-+#define __NR_process_vm_readv 270
-+#define __NR_process_vm_writev 271
-+#define __NR_kcmp 272
-+#define __NR_finit_module 273
-+#define __NR_sched_setattr 274
-+#define __NR_sched_getattr 275
-+#define __NR_renameat2 276
-+#define __NR_seccomp 277
-+#define __NR_getrandom 278
-+#define __NR_memfd_create 279
-+#define __NR_bpf 280
-+#define __NR_execveat 281
-+#define __NR_userfaultfd 282
-+#define __NR_membarrier 283
-+#define __NR_mlock2 284
-+#define __NR_copy_file_range 285
-+#define __NR_preadv2 286
-+#define __NR_pwritev2 287
-+#define __NR_pkey_mprotect 288
-+#define __NR_pkey_alloc 289
-+#define __NR_pkey_free 290
-+#define __NR_statx 291
-+#define __NR_rseq 293
-+#define __NR_kexec_file_load 294
-+#define __NR_clock_gettime64 403
-+#define __NR_clock_settime64 404
-+#define __NR_clock_adjtime64 405
-+#define __NR_clock_getres_time64 406
-+#define __NR_clock_nanosleep_time64 407
-+#define __NR_timer_gettime64 408
-+#define __NR_timer_settime64 409
-+#define __NR_timerfd_gettime64 410
-+#define __NR_timerfd_settime64 411
-+#define __NR_utimensat_time64 412
-+#define __NR_pselect6_time64 413
-+#define __NR_ppoll_time64 414
-+#define __NR_io_pgetevents_time64 416
-+#define __NR_recvmmsg_time64 417
-+#define __NR_mq_timedsend_time64 418
-+#define __NR_mq_timedreceive_time64 419
-+#define __NR_semtimedop_time64 420
-+#define __NR_rt_sigtimedwait_time64 421
-+#define __NR_futex_time64 422
-+#define __NR_sched_rr_get_interval_time64 423
-+#define __NR_pidfd_send_signal 424
-+#define __NR_io_uring_setup 425
-+#define __NR_io_uring_enter 426
-+#define __NR_io_uring_register 427
-+#define __NR_open_tree 428
-+#define __NR_move_mount 429
-+#define __NR_fsopen 430
-+#define __NR_fsconfig 431
-+#define __NR_fsmount 432
-+#define __NR_fspick 433
-+#define __NR_pidfd_open 434
-+#define __NR_clone3 435
-+#define __NR_close_range 436
-+#define __NR_openat2 437
-+#define __NR_pidfd_getfd 438
-+#define __NR_faccessat2 439
-+#define __NR_process_madvise 440
-+#define __NR_epoll_pwait2 441
-+#define __NR_mount_setattr 442
-+#define __NR_quotactl_fd 443
-+#define __NR_landlock_create_ruleset 444
-+#define __NR_landlock_add_rule 445
-+#define __NR_landlock_restrict_self 446
-+#define __NR_memfd_secret 447
-+#define __NR_process_mrelease 448
-+#define __NR_futex_waitv 449
-+#define __NR_set_mempolicy_home_node 450
-+#define __NR_cachestat 451
-+#define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
-+#define __NR_statmount 457
-+#define __NR_listmount 458
-+#define __NR_lsm_get_self_attr 459
-+#define __NR_lsm_set_self_attr 460
-+#define __NR_lsm_list_modules 461
-+#define __NR_mseal 462
-+
-+
-+#endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-riscv/unistd_64.h b/linux-headers/asm-riscv/unistd_64.h
-new file mode 100644
-index 0000000000..95bca8ae81
---- /dev/null
-+++ b/linux-headers/asm-riscv/unistd_64.h
-@@ -0,0 +1,325 @@
-+#ifndef _ASM_UNISTD_64_H
-+#define _ASM_UNISTD_64_H
-+
-+#define __NR_io_setup 0
-+#define __NR_io_destroy 1
-+#define __NR_io_submit 2
-+#define __NR_io_cancel 3
-+#define __NR_io_getevents 4
-+#define __NR_setxattr 5
-+#define __NR_lsetxattr 6
-+#define __NR_fsetxattr 7
-+#define __NR_getxattr 8
-+#define __NR_lgetxattr 9
-+#define __NR_fgetxattr 10
-+#define __NR_listxattr 11
-+#define __NR_llistxattr 12
-+#define __NR_flistxattr 13
-+#define __NR_removexattr 14
-+#define __NR_lremovexattr 15
-+#define __NR_fremovexattr 16
-+#define __NR_getcwd 17
-+#define __NR_lookup_dcookie 18
-+#define __NR_eventfd2 19
-+#define __NR_epoll_create1 20
-+#define __NR_epoll_ctl 21
-+#define __NR_epoll_pwait 22
-+#define __NR_dup 23
-+#define __NR_dup3 24
-+#define __NR_fcntl 25
-+#define __NR_inotify_init1 26
-+#define __NR_inotify_add_watch 27
-+#define __NR_inotify_rm_watch 28
-+#define __NR_ioctl 29
-+#define __NR_ioprio_set 30
-+#define __NR_ioprio_get 31
-+#define __NR_flock 32
-+#define __NR_mknodat 33
-+#define __NR_mkdirat 34
-+#define __NR_unlinkat 35
-+#define __NR_symlinkat 36
-+#define __NR_linkat 37
-+#define __NR_umount2 39
-+#define __NR_mount 40
-+#define __NR_pivot_root 41
-+#define __NR_nfsservctl 42
-+#define __NR_statfs 43
-+#define __NR_fstatfs 44
-+#define __NR_truncate 45
-+#define __NR_ftruncate 46
-+#define __NR_fallocate 47
-+#define __NR_faccessat 48
-+#define __NR_chdir 49
-+#define __NR_fchdir 50
-+#define __NR_chroot 51
-+#define __NR_fchmod 52
-+#define __NR_fchmodat 53
-+#define __NR_fchownat 54
-+#define __NR_fchown 55
-+#define __NR_openat 56
-+#define __NR_close 57
-+#define __NR_vhangup 58
-+#define __NR_pipe2 59
-+#define __NR_quotactl 60
-+#define __NR_getdents64 61
-+#define __NR_lseek 62
-+#define __NR_read 63
-+#define __NR_write 64
-+#define __NR_readv 65
-+#define __NR_writev 66
-+#define __NR_pread64 67
-+#define __NR_pwrite64 68
-+#define __NR_preadv 69
-+#define __NR_pwritev 70
-+#define __NR_sendfile 71
-+#define __NR_pselect6 72
-+#define __NR_ppoll 73
-+#define __NR_signalfd4 74
-+#define __NR_vmsplice 75
-+#define __NR_splice 76
-+#define __NR_tee 77
-+#define __NR_readlinkat 78
-+#define __NR_newfstatat 79
-+#define __NR_fstat 80
-+#define __NR_sync 81
-+#define __NR_fsync 82
-+#define __NR_fdatasync 83
-+#define __NR_sync_file_range 84
-+#define __NR_timerfd_create 85
-+#define __NR_timerfd_settime 86
-+#define __NR_timerfd_gettime 87
-+#define __NR_utimensat 88
-+#define __NR_acct 89
-+#define __NR_capget 90
-+#define __NR_capset 91
-+#define __NR_personality 92
-+#define __NR_exit 93
-+#define __NR_exit_group 94
-+#define __NR_waitid 95
-+#define __NR_set_tid_address 96
-+#define __NR_unshare 97
-+#define __NR_futex 98
-+#define __NR_set_robust_list 99
-+#define __NR_get_robust_list 100
-+#define __NR_nanosleep 101
-+#define __NR_getitimer 102
-+#define __NR_setitimer 103
-+#define __NR_kexec_load 104
-+#define __NR_init_module 105
-+#define __NR_delete_module 106
-+#define __NR_timer_create 107
-+#define __NR_timer_gettime 108
-+#define __NR_timer_getoverrun 109
-+#define __NR_timer_settime 110
-+#define __NR_timer_delete 111
-+#define __NR_clock_settime 112
-+#define __NR_clock_gettime 113
-+#define __NR_clock_getres 114
-+#define __NR_clock_nanosleep 115
-+#define __NR_syslog 116
-+#define __NR_ptrace 117
-+#define __NR_sched_setparam 118
-+#define __NR_sched_setscheduler 119
-+#define __NR_sched_getscheduler 120
-+#define __NR_sched_getparam 121
-+#define __NR_sched_setaffinity 122
-+#define __NR_sched_getaffinity 123
-+#define __NR_sched_yield 124
-+#define __NR_sched_get_priority_max 125
-+#define __NR_sched_get_priority_min 126
-+#define __NR_sched_rr_get_interval 127
-+#define __NR_restart_syscall 128
-+#define __NR_kill 129
-+#define __NR_tkill 130
-+#define __NR_tgkill 131
-+#define __NR_sigaltstack 132
-+#define __NR_rt_sigsuspend 133
-+#define __NR_rt_sigaction 134
-+#define __NR_rt_sigprocmask 135
-+#define __NR_rt_sigpending 136
-+#define __NR_rt_sigtimedwait 137
-+#define __NR_rt_sigqueueinfo 138
-+#define __NR_rt_sigreturn 139
-+#define __NR_setpriority 140
-+#define __NR_getpriority 141
-+#define __NR_reboot 142
-+#define __NR_setregid 143
-+#define __NR_setgid 144
-+#define __NR_setreuid 145
-+#define __NR_setuid 146
-+#define __NR_setresuid 147
-+#define __NR_getresuid 148
-+#define __NR_setresgid 149
-+#define __NR_getresgid 150
-+#define __NR_setfsuid 151
-+#define __NR_setfsgid 152
-+#define __NR_times 153
-+#define __NR_setpgid 154
-+#define __NR_getpgid 155
-+#define __NR_getsid 156
-+#define __NR_setsid 157
-+#define __NR_getgroups 158
-+#define __NR_setgroups 159
-+#define __NR_uname 160
-+#define __NR_sethostname 161
-+#define __NR_setdomainname 162
-+#define __NR_getrlimit 163
-+#define __NR_setrlimit 164
-+#define __NR_getrusage 165
-+#define __NR_umask 166
-+#define __NR_prctl 167
-+#define __NR_getcpu 168
-+#define __NR_gettimeofday 169
-+#define __NR_settimeofday 170
-+#define __NR_adjtimex 171
-+#define __NR_getpid 172
-+#define __NR_getppid 173
-+#define __NR_getuid 174
-+#define __NR_geteuid 175
-+#define __NR_getgid 176
-+#define __NR_getegid 177
-+#define __NR_gettid 178
-+#define __NR_sysinfo 179
-+#define __NR_mq_open 180
-+#define __NR_mq_unlink 181
-+#define __NR_mq_timedsend 182
-+#define __NR_mq_timedreceive 183
-+#define __NR_mq_notify 184
-+#define __NR_mq_getsetattr 185
-+#define __NR_msgget 186
-+#define __NR_msgctl 187
-+#define __NR_msgrcv 188
-+#define __NR_msgsnd 189
-+#define __NR_semget 190
-+#define __NR_semctl 191
-+#define __NR_semtimedop 192
-+#define __NR_semop 193
-+#define __NR_shmget 194
-+#define __NR_shmctl 195
-+#define __NR_shmat 196
-+#define __NR_shmdt 197
-+#define __NR_socket 198
-+#define __NR_socketpair 199
-+#define __NR_bind 200
-+#define __NR_listen 201
-+#define __NR_accept 202
-+#define __NR_connect 203
-+#define __NR_getsockname 204
-+#define __NR_getpeername 205
-+#define __NR_sendto 206
-+#define __NR_recvfrom 207
-+#define __NR_setsockopt 208
-+#define __NR_getsockopt 209
-+#define __NR_shutdown 210
-+#define __NR_sendmsg 211
-+#define __NR_recvmsg 212
-+#define __NR_readahead 213
-+#define __NR_brk 214
-+#define __NR_munmap 215
-+#define __NR_mremap 216
-+#define __NR_add_key 217
-+#define __NR_request_key 218
-+#define __NR_keyctl 219
-+#define __NR_clone 220
-+#define __NR_execve 221
-+#define __NR_mmap 222
-+#define __NR_fadvise64 223
-+#define __NR_swapon 224
-+#define __NR_swapoff 225
-+#define __NR_mprotect 226
-+#define __NR_msync 227
-+#define __NR_mlock 228
-+#define __NR_munlock 229
-+#define __NR_mlockall 230
-+#define __NR_munlockall 231
-+#define __NR_mincore 232
-+#define __NR_madvise 233
-+#define __NR_remap_file_pages 234
-+#define __NR_mbind 235
-+#define __NR_get_mempolicy 236
-+#define __NR_set_mempolicy 237
-+#define __NR_migrate_pages 238
-+#define __NR_move_pages 239
-+#define __NR_rt_tgsigqueueinfo 240
-+#define __NR_perf_event_open 241
-+#define __NR_accept4 242
-+#define __NR_recvmmsg 243
-+#define __NR_riscv_hwprobe 258
-+#define __NR_riscv_flush_icache 259
-+#define __NR_wait4 260
-+#define __NR_prlimit64 261
-+#define __NR_fanotify_init 262
-+#define __NR_fanotify_mark 263
-+#define __NR_name_to_handle_at 264
-+#define __NR_open_by_handle_at 265
-+#define __NR_clock_adjtime 266
-+#define __NR_syncfs 267
-+#define __NR_setns 268
-+#define __NR_sendmmsg 269
-+#define __NR_process_vm_readv 270
-+#define __NR_process_vm_writev 271
-+#define __NR_kcmp 272
-+#define __NR_finit_module 273
-+#define __NR_sched_setattr 274
-+#define __NR_sched_getattr 275
-+#define __NR_renameat2 276
-+#define __NR_seccomp 277
-+#define __NR_getrandom 278
-+#define __NR_memfd_create 279
-+#define __NR_bpf 280
-+#define __NR_execveat 281
-+#define __NR_userfaultfd 282
-+#define __NR_membarrier 283
-+#define __NR_mlock2 284
-+#define __NR_copy_file_range 285
-+#define __NR_preadv2 286
-+#define __NR_pwritev2 287
-+#define __NR_pkey_mprotect 288
-+#define __NR_pkey_alloc 289
-+#define __NR_pkey_free 290
-+#define __NR_statx 291
-+#define __NR_io_pgetevents 292
-+#define __NR_rseq 293
-+#define __NR_kexec_file_load 294
-+#define __NR_pidfd_send_signal 424
-+#define __NR_io_uring_setup 425
-+#define __NR_io_uring_enter 426
-+#define __NR_io_uring_register 427
-+#define __NR_open_tree 428
-+#define __NR_move_mount 429
-+#define __NR_fsopen 430
-+#define __NR_fsconfig 431
-+#define __NR_fsmount 432
-+#define __NR_fspick 433
-+#define __NR_pidfd_open 434
-+#define __NR_clone3 435
-+#define __NR_close_range 436
-+#define __NR_openat2 437
-+#define __NR_pidfd_getfd 438
-+#define __NR_faccessat2 439
-+#define __NR_process_madvise 440
-+#define __NR_epoll_pwait2 441
-+#define __NR_mount_setattr 442
-+#define __NR_quotactl_fd 443
-+#define __NR_landlock_create_ruleset 444
-+#define __NR_landlock_add_rule 445
-+#define __NR_landlock_restrict_self 446
-+#define __NR_memfd_secret 447
-+#define __NR_process_mrelease 448
-+#define __NR_futex_waitv 449
-+#define __NR_set_mempolicy_home_node 450
-+#define __NR_cachestat 451
-+#define __NR_fchmodat2 452
-+#define __NR_map_shadow_stack 453
-+#define __NR_futex_wake 454
-+#define __NR_futex_wait 455
-+#define __NR_futex_requeue 456
-+#define __NR_statmount 457
-+#define __NR_listmount 458
-+#define __NR_lsm_get_self_attr 459
-+#define __NR_lsm_set_self_attr 460
-+#define __NR_lsm_list_modules 461
-+#define __NR_mseal 462
-+
-+
-+#endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index 1c8f918234..4711ef2c3d 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -106,6 +106,7 @@ struct kvm_ioapic_state {
- 
- #define KVM_RUN_X86_SMM		 (1 << 0)
- #define KVM_RUN_X86_BUS_LOCK     (1 << 1)
-+#define KVM_RUN_X86_GUEST_MODE   (1 << 2)
- 
- /* for KVM_GET_REGS and KVM_SET_REGS */
- struct kvm_regs {
-@@ -436,6 +437,7 @@ struct kvm_sync_regs {
- #define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT	(1 << 4)
- #define KVM_X86_QUIRK_FIX_HYPERCALL_INSN	(1 << 5)
- #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
-+#define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
- 
- #define KVM_STATE_NESTED_FORMAT_VMX	0
- #define KVM_STATE_NESTED_FORMAT_SVM	1
-diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
-index da439afee1..24c979be54 100644
---- a/linux-headers/asm-x86/unistd_64.h
-+++ b/linux-headers/asm-x86/unistd_64.h
-@@ -336,6 +336,7 @@
- #define __NR_statx 332
- #define __NR_io_pgetevents 333
- #define __NR_rseq 334
-+#define __NR_uretprobe 335
- #define __NR_pidfd_send_signal 424
- #define __NR_io_uring_setup 425
- #define __NR_io_uring_enter 426
-diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
-index 4fcb607c72..c23dd21a2d 100644
---- a/linux-headers/asm-x86/unistd_x32.h
-+++ b/linux-headers/asm-x86/unistd_x32.h
-@@ -289,6 +289,7 @@
- #define __NR_statx (__X32_SYSCALL_BIT + 332)
- #define __NR_io_pgetevents (__X32_SYSCALL_BIT + 333)
- #define __NR_rseq (__X32_SYSCALL_BIT + 334)
-+#define __NR_uretprobe (__X32_SYSCALL_BIT + 335)
- #define __NR_pidfd_send_signal (__X32_SYSCALL_BIT + 424)
- #define __NR_io_uring_setup (__X32_SYSCALL_BIT + 425)
- #define __NR_io_uring_enter (__X32_SYSCALL_BIT + 426)
-diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
-index d9897771be..c0d00c0a98 100644
---- a/linux-headers/linux/bits.h
-+++ b/linux-headers/linux/bits.h
-@@ -12,4 +12,7 @@
-         (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
-          (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
- 
-+#define __GENMASK_U128(h, l) \
-+	((_BIT128((h)) << 1) - (_BIT128(l)))
-+
- #endif /* _LINUX_BITS_H */
-diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
-index 1eb84b5087..2122610de7 100644
---- a/linux-headers/linux/const.h
-+++ b/linux-headers/linux/const.h
-@@ -28,6 +28,23 @@
- #define _BITUL(x)	(_UL(1) << (x))
- #define _BITULL(x)	(_ULL(1) << (x))
- 
-+#if !defined(__ASSEMBLY__)
-+/*
-+ * Missing __asm__ support
-+ *
-+ * __BIT128() would not work in the __asm__ code, as it shifts an
-+ * 'unsigned __init128' data type as direct representation of
-+ * 128 bit constants is not supported in the gcc compiler, as
-+ * they get silently truncated.
-+ *
-+ * TODO: Please revisit this implementation when gcc compiler
-+ * starts representing 128 bit constants directly like long
-+ * and unsigned long etc. Subsequently drop the comment for
-+ * GENMASK_U128() which would then start supporting __asm__ code.
-+ */
-+#define _BIT128(x)	((unsigned __int128)(1) << (x))
-+#endif
-+
- #define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
- #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
- 
-diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
-index 72e8f4b9dd..782baf477f 100644
---- a/linux-headers/linux/iommufd.h
-+++ b/linux-headers/linux/iommufd.h
-@@ -4,8 +4,8 @@
- #ifndef _IOMMUFD_H
- #define _IOMMUFD_H
- 
--#include <linux/types.h>
- #include <linux/ioctl.h>
-+#include <linux/types.h>
- 
- #define IOMMUFD_TYPE (';')
- 
-@@ -37,19 +37,20 @@
- enum {
- 	IOMMUFD_CMD_BASE = 0x80,
- 	IOMMUFD_CMD_DESTROY = IOMMUFD_CMD_BASE,
--	IOMMUFD_CMD_IOAS_ALLOC,
--	IOMMUFD_CMD_IOAS_ALLOW_IOVAS,
--	IOMMUFD_CMD_IOAS_COPY,
--	IOMMUFD_CMD_IOAS_IOVA_RANGES,
--	IOMMUFD_CMD_IOAS_MAP,
--	IOMMUFD_CMD_IOAS_UNMAP,
--	IOMMUFD_CMD_OPTION,
--	IOMMUFD_CMD_VFIO_IOAS,
--	IOMMUFD_CMD_HWPT_ALLOC,
--	IOMMUFD_CMD_GET_HW_INFO,
--	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING,
--	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP,
--	IOMMUFD_CMD_HWPT_INVALIDATE,
-+	IOMMUFD_CMD_IOAS_ALLOC = 0x81,
-+	IOMMUFD_CMD_IOAS_ALLOW_IOVAS = 0x82,
-+	IOMMUFD_CMD_IOAS_COPY = 0x83,
-+	IOMMUFD_CMD_IOAS_IOVA_RANGES = 0x84,
-+	IOMMUFD_CMD_IOAS_MAP = 0x85,
-+	IOMMUFD_CMD_IOAS_UNMAP = 0x86,
-+	IOMMUFD_CMD_OPTION = 0x87,
-+	IOMMUFD_CMD_VFIO_IOAS = 0x88,
-+	IOMMUFD_CMD_HWPT_ALLOC = 0x89,
-+	IOMMUFD_CMD_GET_HW_INFO = 0x8a,
-+	IOMMUFD_CMD_HWPT_SET_DIRTY_TRACKING = 0x8b,
-+	IOMMUFD_CMD_HWPT_GET_DIRTY_BITMAP = 0x8c,
-+	IOMMUFD_CMD_HWPT_INVALIDATE = 0x8d,
-+	IOMMUFD_CMD_FAULT_QUEUE_ALLOC = 0x8e,
- };
- 
- /**
-@@ -356,10 +357,13 @@ struct iommu_vfio_ioas {
-  *                                the parent HWPT in a nesting configuration.
-  * @IOMMU_HWPT_ALLOC_DIRTY_TRACKING: Dirty tracking support for device IOMMU is
-  *                                   enforced on device attachment
-+ * @IOMMU_HWPT_FAULT_ID_VALID: The fault_id field of hwpt allocation data is
-+ *                             valid.
-  */
- enum iommufd_hwpt_alloc_flags {
- 	IOMMU_HWPT_ALLOC_NEST_PARENT = 1 << 0,
- 	IOMMU_HWPT_ALLOC_DIRTY_TRACKING = 1 << 1,
-+	IOMMU_HWPT_FAULT_ID_VALID = 1 << 2,
- };
- 
- /**
-@@ -396,8 +400,8 @@ struct iommu_hwpt_vtd_s1 {
-  * @IOMMU_HWPT_DATA_VTD_S1: Intel VT-d stage-1 page table
-  */
- enum iommu_hwpt_data_type {
--	IOMMU_HWPT_DATA_NONE,
--	IOMMU_HWPT_DATA_VTD_S1,
-+	IOMMU_HWPT_DATA_NONE = 0,
-+	IOMMU_HWPT_DATA_VTD_S1 = 1,
- };
- 
- /**
-@@ -411,6 +415,9 @@ enum iommu_hwpt_data_type {
-  * @data_type: One of enum iommu_hwpt_data_type
-  * @data_len: Length of the type specific data
-  * @data_uptr: User pointer to the type specific data
-+ * @fault_id: The ID of IOMMUFD_FAULT object. Valid only if flags field of
-+ *            IOMMU_HWPT_FAULT_ID_VALID is set.
-+ * @__reserved2: Padding to 64-bit alignment. Must be 0.
-  *
-  * Explicitly allocate a hardware page table object. This is the same object
-  * type that is returned by iommufd_device_attach() and represents the
-@@ -441,6 +448,8 @@ struct iommu_hwpt_alloc {
- 	__u32 data_type;
- 	__u32 data_len;
- 	__aligned_u64 data_uptr;
-+	__u32 fault_id;
-+	__u32 __reserved2;
- };
- #define IOMMU_HWPT_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_ALLOC)
- 
-@@ -482,8 +491,8 @@ struct iommu_hw_info_vtd {
-  * @IOMMU_HW_INFO_TYPE_INTEL_VTD: Intel VT-d iommu info type
-  */
- enum iommu_hw_info_type {
--	IOMMU_HW_INFO_TYPE_NONE,
--	IOMMU_HW_INFO_TYPE_INTEL_VTD,
-+	IOMMU_HW_INFO_TYPE_NONE = 0,
-+	IOMMU_HW_INFO_TYPE_INTEL_VTD = 1,
- };
- 
- /**
-@@ -620,7 +629,7 @@ struct iommu_hwpt_get_dirty_bitmap {
-  * @IOMMU_HWPT_INVALIDATE_DATA_VTD_S1: Invalidation data for VTD_S1
-  */
- enum iommu_hwpt_invalidate_data_type {
--	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1,
-+	IOMMU_HWPT_INVALIDATE_DATA_VTD_S1 = 0,
- };
- 
- /**
-@@ -692,4 +701,100 @@ struct iommu_hwpt_invalidate {
- 	__u32 __reserved;
- };
- #define IOMMU_HWPT_INVALIDATE _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_INVALIDATE)
-+
-+/**
-+ * enum iommu_hwpt_pgfault_flags - flags for struct iommu_hwpt_pgfault
-+ * @IOMMU_PGFAULT_FLAGS_PASID_VALID: The pasid field of the fault data is
-+ *                                   valid.
-+ * @IOMMU_PGFAULT_FLAGS_LAST_PAGE: It's the last fault of a fault group.
-+ */
-+enum iommu_hwpt_pgfault_flags {
-+	IOMMU_PGFAULT_FLAGS_PASID_VALID		= (1 << 0),
-+	IOMMU_PGFAULT_FLAGS_LAST_PAGE		= (1 << 1),
-+};
-+
-+/**
-+ * enum iommu_hwpt_pgfault_perm - perm bits for struct iommu_hwpt_pgfault
-+ * @IOMMU_PGFAULT_PERM_READ: request for read permission
-+ * @IOMMU_PGFAULT_PERM_WRITE: request for write permission
-+ * @IOMMU_PGFAULT_PERM_EXEC: (PCIE 10.4.1) request with a PASID that has the
-+ *                           Execute Requested bit set in PASID TLP Prefix.
-+ * @IOMMU_PGFAULT_PERM_PRIV: (PCIE 10.4.1) request with a PASID that has the
-+ *                           Privileged Mode Requested bit set in PASID TLP
-+ *                           Prefix.
-+ */
-+enum iommu_hwpt_pgfault_perm {
-+	IOMMU_PGFAULT_PERM_READ			= (1 << 0),
-+	IOMMU_PGFAULT_PERM_WRITE		= (1 << 1),
-+	IOMMU_PGFAULT_PERM_EXEC			= (1 << 2),
-+	IOMMU_PGFAULT_PERM_PRIV			= (1 << 3),
-+};
-+
-+/**
-+ * struct iommu_hwpt_pgfault - iommu page fault data
-+ * @flags: Combination of enum iommu_hwpt_pgfault_flags
-+ * @dev_id: id of the originated device
-+ * @pasid: Process Address Space ID
-+ * @grpid: Page Request Group Index
-+ * @perm: Combination of enum iommu_hwpt_pgfault_perm
-+ * @addr: Fault address
-+ * @length: a hint of how much data the requestor is expecting to fetch. For
-+ *          example, if the PRI initiator knows it is going to do a 10MB
-+ *          transfer, it could fill in 10MB and the OS could pre-fault in
-+ *          10MB of IOVA. It's default to 0 if there's no such hint.
-+ * @cookie: kernel-managed cookie identifying a group of fault messages. The
-+ *          cookie number encoded in the last page fault of the group should
-+ *          be echoed back in the response message.
-+ */
-+struct iommu_hwpt_pgfault {
-+	__u32 flags;
-+	__u32 dev_id;
-+	__u32 pasid;
-+	__u32 grpid;
-+	__u32 perm;
-+	__u64 addr;
-+	__u32 length;
-+	__u32 cookie;
-+};
-+
-+/**
-+ * enum iommufd_page_response_code - Return status of fault handlers
-+ * @IOMMUFD_PAGE_RESP_SUCCESS: Fault has been handled and the page tables
-+ *                             populated, retry the access. This is the
-+ *                             "Success" defined in PCI 10.4.2.1.
-+ * @IOMMUFD_PAGE_RESP_INVALID: Could not handle this fault, don't retry the
-+ *                             access. This is the "Invalid Request" in PCI
-+ *                             10.4.2.1.
-+ */
-+enum iommufd_page_response_code {
-+	IOMMUFD_PAGE_RESP_SUCCESS = 0,
-+	IOMMUFD_PAGE_RESP_INVALID = 1,
-+};
-+
-+/**
-+ * struct iommu_hwpt_page_response - IOMMU page fault response
-+ * @cookie: The kernel-managed cookie reported in the fault message.
-+ * @code: One of response code in enum iommufd_page_response_code.
-+ */
-+struct iommu_hwpt_page_response {
-+	__u32 cookie;
-+	__u32 code;
-+};
-+
-+/**
-+ * struct iommu_fault_alloc - ioctl(IOMMU_FAULT_QUEUE_ALLOC)
-+ * @size: sizeof(struct iommu_fault_alloc)
-+ * @flags: Must be 0
-+ * @out_fault_id: The ID of the new FAULT
-+ * @out_fault_fd: The fd of the new FAULT
-+ *
-+ * Explicitly allocate a fault handling object.
-+ */
-+struct iommu_fault_alloc {
-+	__u32 size;
-+	__u32 flags;
-+	__u32 out_fault_id;
-+	__u32 out_fault_fd;
-+};
-+#define IOMMU_FAULT_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_FAULT_QUEUE_ALLOC)
- #endif
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index c93876ca0b..49dd1b30ce 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -192,11 +192,20 @@ struct kvm_xen_exit {
- /* Flags that describe what fields in emulation_failure hold valid data. */
- #define KVM_INTERNAL_ERROR_EMULATION_FLAG_INSTRUCTION_BYTES (1ULL << 0)
- 
-+/*
-+ * struct kvm_run can be modified by userspace at any time, so KVM must be
-+ * careful to avoid TOCTOU bugs. In order to protect KVM, HINT_UNSAFE_IN_KVM()
-+ * renames fields in struct kvm_run from <symbol> to <symbol>__unsafe when
-+ * compiled into the kernel, ensuring that any use within KVM is obvious and
-+ * gets extra scrutiny.
-+ */
-+#define HINT_UNSAFE_IN_KVM(_symbol) _symbol
-+
- /* for KVM_RUN, returned by mmap(vcpu_fd, offset=0) */
- struct kvm_run {
- 	/* in */
- 	__u8 request_interrupt_window;
--	__u8 immediate_exit;
-+	__u8 HINT_UNSAFE_IN_KVM(immediate_exit);
- 	__u8 padding1[6];
- 
- 	/* out */
-@@ -913,6 +922,9 @@ struct kvm_enable_cap {
- #define KVM_CAP_MEMORY_ATTRIBUTES 233
- #define KVM_CAP_GUEST_MEMFD 234
- #define KVM_CAP_VM_TYPES 235
-+#define KVM_CAP_PRE_FAULT_MEMORY 236
-+#define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
-+#define KVM_CAP_X86_GUEST_MODE 238
- 
- struct kvm_irq_routing_irqchip {
- 	__u32 irqchip;
-@@ -1544,4 +1556,13 @@ struct kvm_create_guest_memfd {
- 	__u64 reserved[6];
- };
- 
-+#define KVM_PRE_FAULT_MEMORY	_IOWR(KVMIO, 0xd5, struct kvm_pre_fault_memory)
-+
-+struct kvm_pre_fault_memory {
-+	__u64 gpa;
-+	__u64 size;
-+	__u64 flags;
-+	__u64 padding[5];
-+};
-+
- #endif /* __LINUX_KVM_H */
-diff --git a/linux-headers/linux/mman.h b/linux-headers/linux/mman.h
-index 4e8cb60780..2b83059586 100644
---- a/linux-headers/linux/mman.h
-+++ b/linux-headers/linux/mman.h
-@@ -17,6 +17,7 @@
- #define MAP_SHARED	0x01		/* Share changes */
- #define MAP_PRIVATE	0x02		/* Changes are private */
- #define MAP_SHARED_VALIDATE 0x03	/* share + validate extension flags */
-+#define MAP_DROPPABLE	0x08		/* Zero memory under memory pressure. */
- 
- /*
-  * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
-diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
-index c3046c6bff..17bf191573 100644
---- a/linux-headers/linux/psp-sev.h
-+++ b/linux-headers/linux/psp-sev.h
-@@ -31,6 +31,7 @@ enum {
- 	SNP_PLATFORM_STATUS,
- 	SNP_COMMIT,
- 	SNP_SET_CONFIG,
-+	SNP_VLEK_LOAD,
- 
- 	SEV_MAX,
- };
-@@ -50,6 +51,7 @@ typedef enum {
- 	SEV_RET_INVALID_PLATFORM_STATE,
- 	SEV_RET_INVALID_GUEST_STATE,
- 	SEV_RET_INAVLID_CONFIG,
-+	SEV_RET_INVALID_CONFIG = SEV_RET_INAVLID_CONFIG,
- 	SEV_RET_INVALID_LEN,
- 	SEV_RET_ALREADY_OWNED,
- 	SEV_RET_INVALID_CERTIFICATE,
-@@ -214,6 +216,32 @@ struct sev_user_data_snp_config {
- 	__u8 rsvd1[52];
- } __attribute__((packed));
- 
-+/**
-+ * struct sev_data_snp_vlek_load - SNP_VLEK_LOAD structure
-+ *
-+ * @len: length of the command buffer read by the PSP
-+ * @vlek_wrapped_version: version of wrapped VLEK hashstick (Must be 0h)
-+ * @rsvd: reserved
-+ * @vlek_wrapped_address: address of a wrapped VLEK hashstick
-+ *                        (struct sev_user_data_snp_wrapped_vlek_hashstick)
-+ */
-+struct sev_user_data_snp_vlek_load {
-+	__u32 len;				/* In */
-+	__u8 vlek_wrapped_version;		/* In */
-+	__u8 rsvd[3];				/* In */
-+	__u64 vlek_wrapped_address;		/* In */
-+} __attribute__((packed));
-+
-+/**
-+ * struct sev_user_data_snp_vlek_wrapped_vlek_hashstick - Wrapped VLEK data
-+ *
-+ * @data: Opaque data provided by AMD KDS (as described in SEV-SNP Firmware ABI
-+ *        1.54, SNP_VLEK_LOAD)
-+ */
-+struct sev_user_data_snp_wrapped_vlek_hashstick {
-+	__u8 data[432];				/* In */
-+} __attribute__((packed));
-+
- /**
-  * struct sev_issue_cmd - SEV ioctl parameters
-  *
--- 
-2.39.3
-
diff --git a/kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch b/kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch
deleted file mode 100644
index ccd11d1..0000000
--- a/kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch
+++ /dev/null
@@ -1,495 +0,0 @@
-From d90604bca41cef828b4e37d77b53e472b272dbca Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 026/115] linux-headers: Update to Linux v6.14-rc3
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [26/115] 6674b075f7bd2c7fd4cbd4ccb1689fed0fc3b026 (bonzini/rhel-qemu-kvm)
-
-Update headers to retrieve the latest KVM caps for RISC-V.
-
-Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-ID: <20250221153758.652078-2-dbarboza@ventanamicro.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-(cherry picked from commit 421ee1ec6f0de0b0fd96b262bda18b97e54263b4)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/standard-headers/linux/ethtool.h      |  4 +
- include/standard-headers/linux/fuse.h         | 76 ++++++++++++++++++-
- .../linux/input-event-codes.h                 |  1 +
- include/standard-headers/linux/pci_regs.h     | 16 ++--
- include/standard-headers/linux/virtio_pci.h   | 14 ++++
- linux-headers/asm-arm64/kvm.h                 |  3 -
- linux-headers/asm-loongarch/kvm_para.h        |  1 +
- linux-headers/asm-riscv/kvm.h                 |  7 +-
- linux-headers/asm-x86/kvm.h                   |  1 +
- linux-headers/linux/iommufd.h                 | 35 ++++++---
- linux-headers/linux/kvm.h                     |  8 +-
- linux-headers/linux/stddef.h                  | 13 +++-
- linux-headers/linux/vduse.h                   |  2 +-
- 13 files changed, 146 insertions(+), 35 deletions(-)
-
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
-index 67c47912e5..e83382531c 100644
---- a/include/standard-headers/linux/ethtool.h
-+++ b/include/standard-headers/linux/ethtool.h
-@@ -681,6 +681,8 @@ enum ethtool_link_ext_substate_module {
-  * @ETH_SS_STATS_ETH_MAC: names of IEEE 802.3 MAC statistics
-  * @ETH_SS_STATS_ETH_CTRL: names of IEEE 802.3 MAC Control statistics
-  * @ETH_SS_STATS_RMON: names of RMON statistics
-+ * @ETH_SS_STATS_PHY: names of PHY(dev) statistics
-+ * @ETH_SS_TS_FLAGS: hardware timestamping flags
-  *
-  * @ETH_SS_COUNT: number of defined string sets
-  */
-@@ -706,6 +708,8 @@ enum ethtool_stringset {
- 	ETH_SS_STATS_ETH_MAC,
- 	ETH_SS_STATS_ETH_CTRL,
- 	ETH_SS_STATS_RMON,
-+	ETH_SS_STATS_PHY,
-+	ETH_SS_TS_FLAGS,
- 
- 	/* add new constants above here */
- 	ETH_SS_COUNT
-diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
-index 889e12ad15..d303effb2a 100644
---- a/include/standard-headers/linux/fuse.h
-+++ b/include/standard-headers/linux/fuse.h
-@@ -220,6 +220,15 @@
-  *
-  *  7.41
-  *  - add FUSE_ALLOW_IDMAP
-+ *  7.42
-+ *  - Add FUSE_OVER_IO_URING and all other io-uring related flags and data
-+ *    structures:
-+ *    - struct fuse_uring_ent_in_out
-+ *    - struct fuse_uring_req_header
-+ *    - struct fuse_uring_cmd_req
-+ *    - FUSE_URING_IN_OUT_HEADER_SZ
-+ *    - FUSE_URING_OP_IN_OUT_SZ
-+ *    - enum fuse_uring_cmd
-  */
- 
- #ifndef _LINUX_FUSE_H
-@@ -251,7 +260,7 @@
- #define FUSE_KERNEL_VERSION 7
- 
- /** Minor version number of this interface */
--#define FUSE_KERNEL_MINOR_VERSION 41
-+#define FUSE_KERNEL_MINOR_VERSION 42
- 
- /** The node ID of the root inode */
- #define FUSE_ROOT_ID 1
-@@ -421,6 +430,7 @@ struct fuse_file_lock {
-  * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
-  *		    of the request ID indicates resend requests
-  * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
-+ * FUSE_OVER_IO_URING: Indicate that client supports io-uring
-  */
- #define FUSE_ASYNC_READ		(1 << 0)
- #define FUSE_POSIX_LOCKS	(1 << 1)
-@@ -467,6 +477,7 @@ struct fuse_file_lock {
- /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
- #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
- #define FUSE_ALLOW_IDMAP	(1ULL << 40)
-+#define FUSE_OVER_IO_URING	(1ULL << 41)
- 
- /**
-  * CUSE INIT request/reply flags
-@@ -1202,4 +1213,67 @@ struct fuse_supp_groups {
- 	uint32_t	groups[];
- };
- 
-+/**
-+ * Size of the ring buffer header
-+ */
-+#define FUSE_URING_IN_OUT_HEADER_SZ 128
-+#define FUSE_URING_OP_IN_OUT_SZ 128
-+
-+/* Used as part of the fuse_uring_req_header */
-+struct fuse_uring_ent_in_out {
-+	uint64_t flags;
-+
-+	/*
-+	 * commit ID to be used in a reply to a ring request (see also
-+	 * struct fuse_uring_cmd_req)
-+	 */
-+	uint64_t commit_id;
-+
-+	/* size of user payload buffer */
-+	uint32_t payload_sz;
-+	uint32_t padding;
-+
-+	uint64_t reserved;
-+};
-+
-+/**
-+ * Header for all fuse-io-uring requests
-+ */
-+struct fuse_uring_req_header {
-+	/* struct fuse_in_header / struct fuse_out_header */
-+	char in_out[FUSE_URING_IN_OUT_HEADER_SZ];
-+
-+	/* per op code header */
-+	char op_in[FUSE_URING_OP_IN_OUT_SZ];
-+
-+	struct fuse_uring_ent_in_out ring_ent_in_out;
-+};
-+
-+/**
-+ * sqe commands to the kernel
-+ */
-+enum fuse_uring_cmd {
-+	FUSE_IO_URING_CMD_INVALID = 0,
-+
-+	/* register the request buffer and fetch a fuse request */
-+	FUSE_IO_URING_CMD_REGISTER = 1,
-+
-+	/* commit fuse request result and fetch next request */
-+	FUSE_IO_URING_CMD_COMMIT_AND_FETCH = 2,
-+};
-+
-+/**
-+ * In the 80B command area of the SQE.
-+ */
-+struct fuse_uring_cmd_req {
-+	uint64_t flags;
-+
-+	/* entry identifier for commits */
-+	uint64_t commit_id;
-+
-+	/* queue the command is for (queue index) */
-+	uint16_t qid;
-+	uint8_t padding[6];
-+};
-+
- #endif /* _LINUX_FUSE_H */
-diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
-index 50b2b7497e..09ba0ad878 100644
---- a/include/standard-headers/linux/input-event-codes.h
-+++ b/include/standard-headers/linux/input-event-codes.h
-@@ -519,6 +519,7 @@
- #define KEY_NOTIFICATION_CENTER	0x1bc	/* Show/hide the notification center */
- #define KEY_PICKUP_PHONE	0x1bd	/* Answer incoming call */
- #define KEY_HANGUP_PHONE	0x1be	/* Decline incoming call */
-+#define KEY_LINK_PHONE		0x1bf   /* AL Phone Syncing */
- 
- #define KEY_DEL_EOL		0x1c0
- #define KEY_DEL_EOS		0x1c1
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index 1601c7ed5f..3445c4970e 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -533,7 +533,7 @@
- #define  PCI_EXP_DEVSTA_TRPND	0x0020	/* Transactions Pending */
- #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V1	12	/* v1 endpoints without link end here */
- #define PCI_EXP_LNKCAP		0x0c	/* Link Capabilities */
--#define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Supported Link Speeds */
-+#define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Max Link Speed (prior to PCIe r3.0: Supported Link Speeds) */
- #define  PCI_EXP_LNKCAP_SLS_2_5GB 0x00000001 /* LNKCAP2 SLS Vector bit 0 */
- #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
- #define  PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
-@@ -665,6 +665,7 @@
- #define  PCI_EXP_DEVCAP2_OBFF_MSG	0x00040000 /* New message signaling */
- #define  PCI_EXP_DEVCAP2_OBFF_WAKE	0x00080000 /* Re-use WAKE# for OBFF */
- #define  PCI_EXP_DEVCAP2_EE_PREFIX	0x00200000 /* End-End TLP Prefix */
-+#define  PCI_EXP_DEVCAP2_EE_PREFIX_MAX	0x00c00000 /* Max End-End TLP Prefixes */
- #define PCI_EXP_DEVCTL2		0x28	/* Device Control 2 */
- #define  PCI_EXP_DEVCTL2_COMP_TIMEOUT	0x000f	/* Completion Timeout Value */
- #define  PCI_EXP_DEVCTL2_COMP_TMOUT_DIS	0x0010	/* Completion Timeout Disable */
-@@ -789,10 +790,11 @@
- 	/* Same bits as above */
- #define PCI_ERR_CAP		0x18	/* Advanced Error Capabilities & Ctrl*/
- #define  PCI_ERR_CAP_FEP(x)	((x) & 0x1f)	/* First Error Pointer */
--#define  PCI_ERR_CAP_ECRC_GENC	0x00000020	/* ECRC Generation Capable */
--#define  PCI_ERR_CAP_ECRC_GENE	0x00000040	/* ECRC Generation Enable */
--#define  PCI_ERR_CAP_ECRC_CHKC	0x00000080	/* ECRC Check Capable */
--#define  PCI_ERR_CAP_ECRC_CHKE	0x00000100	/* ECRC Check Enable */
-+#define  PCI_ERR_CAP_ECRC_GENC		0x00000020 /* ECRC Generation Capable */
-+#define  PCI_ERR_CAP_ECRC_GENE		0x00000040 /* ECRC Generation Enable */
-+#define  PCI_ERR_CAP_ECRC_CHKC		0x00000080 /* ECRC Check Capable */
-+#define  PCI_ERR_CAP_ECRC_CHKE		0x00000100 /* ECRC Check Enable */
-+#define  PCI_ERR_CAP_PREFIX_LOG_PRESENT	0x00000800 /* TLP Prefix Log Present */
- #define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
- #define PCI_ERR_ROOT_COMMAND	0x2c	/* Root Error Command */
- #define  PCI_ERR_ROOT_CMD_COR_EN	0x00000001 /* Correctable Err Reporting Enable */
-@@ -808,6 +810,7 @@
- #define  PCI_ERR_ROOT_FATAL_RCV		0x00000040 /* Fatal Received */
- #define  PCI_ERR_ROOT_AER_IRQ		0xf8000000 /* Advanced Error Interrupt Message Number */
- #define PCI_ERR_ROOT_ERR_SRC	0x34	/* Error Source Identification */
-+#define PCI_ERR_PREFIX_LOG	0x38	/* TLP Prefix LOG Register (up to 16 bytes) */
- 
- /* Virtual Channel */
- #define PCI_VC_PORT_CAP1	0x04
-@@ -1001,9 +1004,6 @@
- #define PCI_ACS_CTRL		0x06	/* ACS Control Register */
- #define PCI_ACS_EGRESS_CTL_V	0x08	/* ACS Egress Control Vector */
- 
--#define PCI_VSEC_HDR		4	/* extended cap - vendor-specific */
--#define  PCI_VSEC_HDR_LEN_SHIFT	20	/* shift for length field */
--
- /* SATA capability */
- #define PCI_SATA_REGS		4	/* SATA REGs specifier */
- #define  PCI_SATA_REGS_MASK	0xF	/* location - BAR#/inline */
-diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
-index b177ed8972..91fec6f502 100644
---- a/include/standard-headers/linux/virtio_pci.h
-+++ b/include/standard-headers/linux/virtio_pci.h
-@@ -116,6 +116,8 @@
- #define VIRTIO_PCI_CAP_PCI_CFG		5
- /* Additional shared memory capability */
- #define VIRTIO_PCI_CAP_SHARED_MEMORY_CFG 8
-+/* PCI vendor data configuration */
-+#define VIRTIO_PCI_CAP_VENDOR_CFG	9
- 
- /* This is the PCI capability header: */
- struct virtio_pci_cap {
-@@ -130,6 +132,18 @@ struct virtio_pci_cap {
- 	uint32_t length;		/* Length of the structure, in bytes. */
- };
- 
-+/* This is the PCI vendor data capability header: */
-+struct virtio_pci_vndr_data {
-+	uint8_t cap_vndr;		/* Generic PCI field: PCI_CAP_ID_VNDR */
-+	uint8_t cap_next;		/* Generic PCI field: next ptr. */
-+	uint8_t cap_len;		/* Generic PCI field: capability length */
-+	uint8_t cfg_type;		/* Identifies the structure. */
-+	uint16_t vendor_id;	/* Identifies the vendor-specific format. */
-+	/* For Vendor Definition */
-+	/* Pads structure to a multiple of 4 bytes */
-+	/* Reads must not have side effects */
-+};
-+
- struct virtio_pci_cap64 {
- 	struct virtio_pci_cap cap;
- 	uint32_t offset_hi;             /* Most sig 32 bits of offset */
-diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
-index dccd5d965f..ec1e82bdc8 100644
---- a/linux-headers/asm-arm64/kvm.h
-+++ b/linux-headers/asm-arm64/kvm.h
-@@ -43,9 +43,6 @@
- #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
- #define KVM_DIRTY_LOG_PAGE_OFFSET 64
- 
--#define KVM_REG_SIZE(id)						\
--	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
--
- struct kvm_regs {
- 	struct user_pt_regs regs;	/* sp = sp_el0 */
- 
-diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
-index 4ba4ad8db1..fd7f40713d 100644
---- a/linux-headers/asm-loongarch/kvm_para.h
-+++ b/linux-headers/asm-loongarch/kvm_para.h
-@@ -17,5 +17,6 @@
- #define  KVM_FEATURE_STEAL_TIME		2
- /* BIT 24 - 31 are features configurable by user space vmm */
- #define  KVM_FEATURE_VIRT_EXTIOI	24
-+#define  KVM_FEATURE_USER_HCALL		25
- 
- #endif /* _ASM_KVM_PARA_H */
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-index 3482c9a73d..f06bc5efcd 100644
---- a/linux-headers/asm-riscv/kvm.h
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -179,6 +179,9 @@ enum KVM_RISCV_ISA_EXT_ID {
- 	KVM_RISCV_ISA_EXT_SSNPM,
- 	KVM_RISCV_ISA_EXT_SVADE,
- 	KVM_RISCV_ISA_EXT_SVADU,
-+	KVM_RISCV_ISA_EXT_SVVPTC,
-+	KVM_RISCV_ISA_EXT_ZABHA,
-+	KVM_RISCV_ISA_EXT_ZICCRSE,
- 	KVM_RISCV_ISA_EXT_MAX,
- };
- 
-@@ -198,6 +201,7 @@ enum KVM_RISCV_SBI_EXT_ID {
- 	KVM_RISCV_SBI_EXT_VENDOR,
- 	KVM_RISCV_SBI_EXT_DBCN,
- 	KVM_RISCV_SBI_EXT_STA,
-+	KVM_RISCV_SBI_EXT_SUSP,
- 	KVM_RISCV_SBI_EXT_MAX,
- };
- 
-@@ -211,9 +215,6 @@ struct kvm_riscv_sbi_sta {
- #define KVM_RISCV_TIMER_STATE_OFF	0
- #define KVM_RISCV_TIMER_STATE_ON	1
- 
--#define KVM_REG_SIZE(id)		\
--	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
--
- /* If you need to interpret the index values, here is the key: */
- #define KVM_REG_RISCV_TYPE_MASK		0x00000000FF000000
- #define KVM_REG_RISCV_TYPE_SHIFT	24
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index 96589490c4..86f2c34e7a 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -923,5 +923,6 @@ struct kvm_hyperv_eventfd {
- #define KVM_X86_SEV_VM		2
- #define KVM_X86_SEV_ES_VM	3
- #define KVM_X86_SNP_VM		4
-+#define KVM_X86_TDX_VM		5
- 
- #endif /* _ASM_X86_KVM_H */
-diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
-index 37aae16502..ccbdca5e11 100644
---- a/linux-headers/linux/iommufd.h
-+++ b/linux-headers/linux/iommufd.h
-@@ -297,7 +297,7 @@ struct iommu_ioas_unmap {
-  *                       ioctl(IOMMU_OPTION_HUGE_PAGES)
-  * @IOMMU_OPTION_RLIMIT_MODE:
-  *    Change how RLIMIT_MEMLOCK accounting works. The caller must have privilege
-- *    to invoke this. Value 0 (default) is user based accouting, 1 uses process
-+ *    to invoke this. Value 0 (default) is user based accounting, 1 uses process
-  *    based accounting. Global option, object_id must be 0
-  * @IOMMU_OPTION_HUGE_PAGES:
-  *    Value 1 (default) allows contiguous pages to be combined when generating
-@@ -390,7 +390,7 @@ struct iommu_vfio_ioas {
-  * @IOMMU_HWPT_ALLOC_PASID: Requests a domain that can be used with PASID. The
-  *                          domain can be attached to any PASID on the device.
-  *                          Any domain attached to the non-PASID part of the
-- *                          device must also be flaged, otherwise attaching a
-+ *                          device must also be flagged, otherwise attaching a
-  *                          PASID will blocked.
-  *                          If IOMMU does not support PASID it will return
-  *                          error (-EOPNOTSUPP).
-@@ -558,16 +558,25 @@ struct iommu_hw_info_vtd {
-  * For the details of @idr, @iidr and @aidr, please refer to the chapters
-  * from 6.3.1 to 6.3.6 in the SMMUv3 Spec.
-  *
-- * User space should read the underlying ARM SMMUv3 hardware information for
-- * the list of supported features.
-+ * This reports the raw HW capability, and not all bits are meaningful to be
-+ * read by userspace. Only the following fields should be used:
-  *
-- * Note that these values reflect the raw HW capability, without any insight if
-- * any required kernel driver support is present. Bits may be set indicating the
-- * HW has functionality that is lacking kernel software support, such as BTM. If
-- * a VMM is using this information to construct emulated copies of these
-- * registers it should only forward bits that it knows it can support.
-+ * idr[0]: ST_LEVEL, TERM_MODEL, STALL_MODEL, TTENDIAN , CD2L, ASID16, TTF
-+ * idr[1]: SIDSIZE, SSIDSIZE
-+ * idr[3]: BBML, RIL
-+ * idr[5]: VAX, GRAN64K, GRAN16K, GRAN4K
-  *
-- * In future, presence of required kernel support will be indicated in flags.
-+ * - S1P should be assumed to be true if a NESTED HWPT can be created
-+ * - VFIO/iommufd only support platforms with COHACC, it should be assumed to be
-+ *   true.
-+ * - ATS is a per-device property. If the VMM describes any devices as ATS
-+ *   capable in ACPI/DT it should set the corresponding idr.
-+ *
-+ * This list may expand in future (eg E0PD, AIE, PBHA, D128, DS etc). It is
-+ * important that VMMs do not read bits outside the list to allow for
-+ * compatibility with future kernels. Several features in the SMMUv3
-+ * architecture are not currently supported by the kernel for nesting: HTTU,
-+ * BTM, MPAM and others.
-  */
- struct iommu_hw_info_arm_smmuv3 {
- 	__u32 flags;
-@@ -766,7 +775,7 @@ struct iommu_hwpt_vtd_s1_invalidate {
- };
- 
- /**
-- * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cahce invalidation
-+ * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cache invalidation
-  *         (IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3)
-  * @cmd: 128-bit cache invalidation command that runs in SMMU CMDQ.
-  *       Must be little-endian.
-@@ -859,6 +868,7 @@ enum iommu_hwpt_pgfault_perm {
-  * @pasid: Process Address Space ID
-  * @grpid: Page Request Group Index
-  * @perm: Combination of enum iommu_hwpt_pgfault_perm
-+ * @__reserved: Must be 0.
-  * @addr: Fault address
-  * @length: a hint of how much data the requestor is expecting to fetch. For
-  *          example, if the PRI initiator knows it is going to do a 10MB
-@@ -874,7 +884,8 @@ struct iommu_hwpt_pgfault {
- 	__u32 pasid;
- 	__u32 grpid;
- 	__u32 perm;
--	__u64 addr;
-+	__u32 __reserved;
-+	__aligned_u64 addr;
- 	__u32 length;
- 	__u32 cookie;
- };
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index 3bcd4eabe3..27181b3dd8 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -609,10 +609,6 @@ struct kvm_ioeventfd {
- #define KVM_X86_DISABLE_EXITS_HLT            (1 << 1)
- #define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
- #define KVM_X86_DISABLE_EXITS_CSTATE         (1 << 3)
--#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
--                                              KVM_X86_DISABLE_EXITS_HLT | \
--                                              KVM_X86_DISABLE_EXITS_PAUSE | \
--                                              KVM_X86_DISABLE_EXITS_CSTATE)
- 
- /* for KVM_ENABLE_CAP */
- struct kvm_enable_cap {
-@@ -1062,6 +1058,10 @@ struct kvm_dirty_tlb {
- 
- #define KVM_REG_SIZE_SHIFT	52
- #define KVM_REG_SIZE_MASK	0x00f0000000000000ULL
-+
-+#define KVM_REG_SIZE(id)		\
-+	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
-+
- #define KVM_REG_SIZE_U8		0x0000000000000000ULL
- #define KVM_REG_SIZE_U16	0x0010000000000000ULL
- #define KVM_REG_SIZE_U32	0x0020000000000000ULL
-diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
-index 96aa341942..e1416f7937 100644
---- a/linux-headers/linux/stddef.h
-+++ b/linux-headers/linux/stddef.h
-@@ -8,6 +8,13 @@
- #define __always_inline __inline__
- #endif
- 
-+/* Not all C++ standards support type declarations inside an anonymous union */
-+#ifndef __cplusplus
-+#define __struct_group_tag(TAG)		TAG
-+#else
-+#define __struct_group_tag(TAG)
-+#endif
-+
- /**
-  * __struct_group() - Create a mirrored named and anonyomous struct
-  *
-@@ -20,13 +27,13 @@
-  * and size: one anonymous and one named. The former's members can be used
-  * normally without sub-struct naming, and the latter can be used to
-  * reason about the start, end, and size of the group of struct members.
-- * The named struct can also be explicitly tagged for layer reuse, as well
-- * as both having struct attributes appended.
-+ * The named struct can also be explicitly tagged for layer reuse (C only),
-+ * as well as both having struct attributes appended.
-  */
- #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
- 	union { \
- 		struct { MEMBERS } ATTRS; \
--		struct TAG { MEMBERS } ATTRS NAME; \
-+		struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
- 	} ATTRS
- 
- #ifdef __cplusplus
-diff --git a/linux-headers/linux/vduse.h b/linux-headers/linux/vduse.h
-index 6d2ca064b5..f46269af34 100644
---- a/linux-headers/linux/vduse.h
-+++ b/linux-headers/linux/vduse.h
-@@ -1,4 +1,4 @@
--/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
- #ifndef _VDUSE_H_
- #define _VDUSE_H_
- 
--- 
-2.50.1
-
diff --git a/kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch b/kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch
deleted file mode 100644
index dbfde0e..0000000
--- a/kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch
+++ /dev/null
@@ -1,949 +0,0 @@
-From a02b11f5744f20a44c1dc3291ffa20985e3302d3 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 027/115] linux-headers: Update to Linux v6.15-rc3
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [27/115] 019c5b8dd28df2c5a0822468c3c485569983b2c1 (bonzini/rhel-qemu-kvm)
-
-Update headers to retrieve uapi information for vfio-ap
-
-Signed-off-by: Rorie Reyes <rreyes@linux.ibm.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250425052401.8287-3-rreyes@linux.ibm.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 1cab5a02ab8144aad2abd001835e49104e4aae0f)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/standard-headers/asm-x86/setup_data.h |   4 +-
- include/standard-headers/drm/drm_fourcc.h     |  41 ++++++
- include/standard-headers/linux/const.h        |   2 +-
- include/standard-headers/linux/ethtool.h      |  22 +++
- include/standard-headers/linux/fuse.h         |  12 +-
- include/standard-headers/linux/pci_regs.h     |  13 +-
- include/standard-headers/linux/virtio_net.h   |  13 ++
- include/standard-headers/linux/virtio_snd.h   |   2 +-
- linux-headers/asm-arm64/kvm.h                 |  11 ++
- linux-headers/asm-arm64/unistd_64.h           |   1 +
- linux-headers/asm-generic/mman-common.h       |   1 +
- linux-headers/asm-generic/unistd.h            |   4 +-
- linux-headers/asm-loongarch/unistd_64.h       |   1 +
- linux-headers/asm-mips/unistd_n32.h           |   1 +
- linux-headers/asm-mips/unistd_n64.h           |   1 +
- linux-headers/asm-mips/unistd_o32.h           |   1 +
- linux-headers/asm-powerpc/unistd_32.h         |   1 +
- linux-headers/asm-powerpc/unistd_64.h         |   1 +
- linux-headers/asm-riscv/kvm.h                 |   2 +
- linux-headers/asm-riscv/unistd_32.h           |   1 +
- linux-headers/asm-riscv/unistd_64.h           |   1 +
- linux-headers/asm-s390/unistd_32.h            |   1 +
- linux-headers/asm-s390/unistd_64.h            |   1 +
- linux-headers/asm-x86/kvm.h                   |   3 +
- linux-headers/asm-x86/unistd_32.h             |   1 +
- linux-headers/asm-x86/unistd_64.h             |   1 +
- linux-headers/asm-x86/unistd_x32.h            |   1 +
- linux-headers/linux/bits.h                    |   8 +-
- linux-headers/linux/const.h                   |   2 +-
- linux-headers/linux/iommufd.h                 | 129 +++++++++++++++++-
- linux-headers/linux/kvm.h                     |   1 +
- linux-headers/linux/psp-sev.h                 |  21 ++-
- linux-headers/linux/stddef.h                  |   2 +
- linux-headers/linux/vfio.h                    |  30 ++--
- 34 files changed, 301 insertions(+), 36 deletions(-)
-
-diff --git a/include/standard-headers/asm-x86/setup_data.h b/include/standard-headers/asm-x86/setup_data.h
-index 09355f54c5..a483d72f42 100644
---- a/include/standard-headers/asm-x86/setup_data.h
-+++ b/include/standard-headers/asm-x86/setup_data.h
-@@ -18,7 +18,7 @@
- #define SETUP_INDIRECT			(1<<31)
- #define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
- 
--#ifndef __ASSEMBLY__
-+#ifndef __ASSEMBLER__
- 
- #include "standard-headers/linux/types.h"
- 
-@@ -78,6 +78,6 @@ struct ima_setup_data {
- 	uint64_t size;
- } QEMU_PACKED;
- 
--#endif /* __ASSEMBLY__ */
-+#endif /* __ASSEMBLER__ */
- 
- #endif /* _ASM_X86_SETUP_DATA_H */
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
-index 708647776f..a8b759dcbc 100644
---- a/include/standard-headers/drm/drm_fourcc.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
-@@ -420,6 +420,7 @@ extern "C" {
- #define DRM_FORMAT_MOD_VENDOR_ARM     0x08
- #define DRM_FORMAT_MOD_VENDOR_ALLWINNER 0x09
- #define DRM_FORMAT_MOD_VENDOR_AMLOGIC 0x0a
-+#define DRM_FORMAT_MOD_VENDOR_MTK     0x0b
- 
- /* add more to the end as needed */
- 
-@@ -1452,6 +1453,46 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
-  */
- #define AMLOGIC_FBC_OPTION_MEM_SAVING		(1ULL << 0)
- 
-+/* MediaTek modifiers
-+ * Bits  Parameter                Notes
-+ * ----- ------------------------ ---------------------------------------------
-+ *   7: 0 TILE LAYOUT              Values are MTK_FMT_MOD_TILE_*
-+ *  15: 8 COMPRESSION              Values are MTK_FMT_MOD_COMPRESS_*
-+ *  23:16 10 BIT LAYOUT            Values are MTK_FMT_MOD_10BIT_LAYOUT_*
-+ *
-+ */
-+
-+#define DRM_FORMAT_MOD_MTK(__flags)		fourcc_mod_code(MTK, __flags)
-+
-+/*
-+ * MediaTek Tiled Modifier
-+ * The lowest 8 bits of the modifier is used to specify the tiling
-+ * layout. Only the 16L_32S tiling is used for now, but we define an
-+ * "untiled" version and leave room for future expansion.
-+ */
-+#define MTK_FMT_MOD_TILE_MASK     0xf
-+#define MTK_FMT_MOD_TILE_NONE     0x0
-+#define MTK_FMT_MOD_TILE_16L32S   0x1
-+
-+/*
-+ * Bits 8-15 specify compression options
-+ */
-+#define MTK_FMT_MOD_COMPRESS_MASK (0xf << 8)
-+#define MTK_FMT_MOD_COMPRESS_NONE (0x0 << 8)
-+#define MTK_FMT_MOD_COMPRESS_V1   (0x1 << 8)
-+
-+/*
-+ * Bits 16-23 specify how the bits of 10 bit formats are
-+ * stored out in memory
-+ */
-+#define MTK_FMT_MOD_10BIT_LAYOUT_MASK      (0xf << 16)
-+#define MTK_FMT_MOD_10BIT_LAYOUT_PACKED    (0x0 << 16)
-+#define MTK_FMT_MOD_10BIT_LAYOUT_LSBTILED  (0x1 << 16)
-+#define MTK_FMT_MOD_10BIT_LAYOUT_LSBRASTER (0x2 << 16)
-+
-+/* alias for the most common tiling format */
-+#define DRM_FORMAT_MOD_MTK_16L_32S_TILE  DRM_FORMAT_MOD_MTK(MTK_FMT_MOD_TILE_16L32S)
-+
- /*
-  * AMD modifiers
-  *
-diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
-index 2122610de7..95ede23342 100644
---- a/include/standard-headers/linux/const.h
-+++ b/include/standard-headers/linux/const.h
-@@ -33,7 +33,7 @@
-  * Missing __asm__ support
-  *
-  * __BIT128() would not work in the __asm__ code, as it shifts an
-- * 'unsigned __init128' data type as direct representation of
-+ * 'unsigned __int128' data type as direct representation of
-  * 128 bit constants is not supported in the gcc compiler, as
-  * they get silently truncated.
-  *
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
-index e83382531c..5d1ad5fdea 100644
---- a/include/standard-headers/linux/ethtool.h
-+++ b/include/standard-headers/linux/ethtool.h
-@@ -2059,6 +2059,24 @@ enum ethtool_link_mode_bit_indices {
- 	ETHTOOL_LINK_MODE_10baseT1S_Half_BIT		 = 100,
- 	ETHTOOL_LINK_MODE_10baseT1S_P2MP_Half_BIT	 = 101,
- 	ETHTOOL_LINK_MODE_10baseT1BRR_Full_BIT		 = 102,
-+	ETHTOOL_LINK_MODE_200000baseCR_Full_BIT		 = 103,
-+	ETHTOOL_LINK_MODE_200000baseKR_Full_BIT		 = 104,
-+	ETHTOOL_LINK_MODE_200000baseDR_Full_BIT		 = 105,
-+	ETHTOOL_LINK_MODE_200000baseDR_2_Full_BIT	 = 106,
-+	ETHTOOL_LINK_MODE_200000baseSR_Full_BIT		 = 107,
-+	ETHTOOL_LINK_MODE_200000baseVR_Full_BIT		 = 108,
-+	ETHTOOL_LINK_MODE_400000baseCR2_Full_BIT	 = 109,
-+	ETHTOOL_LINK_MODE_400000baseKR2_Full_BIT	 = 110,
-+	ETHTOOL_LINK_MODE_400000baseDR2_Full_BIT	 = 111,
-+	ETHTOOL_LINK_MODE_400000baseDR2_2_Full_BIT	 = 112,
-+	ETHTOOL_LINK_MODE_400000baseSR2_Full_BIT	 = 113,
-+	ETHTOOL_LINK_MODE_400000baseVR2_Full_BIT	 = 114,
-+	ETHTOOL_LINK_MODE_800000baseCR4_Full_BIT	 = 115,
-+	ETHTOOL_LINK_MODE_800000baseKR4_Full_BIT	 = 116,
-+	ETHTOOL_LINK_MODE_800000baseDR4_Full_BIT	 = 117,
-+	ETHTOOL_LINK_MODE_800000baseDR4_2_Full_BIT	 = 118,
-+	ETHTOOL_LINK_MODE_800000baseSR4_Full_BIT	 = 119,
-+	ETHTOOL_LINK_MODE_800000baseVR4_Full_BIT	 = 120,
- 
- 	/* must be last entry */
- 	__ETHTOOL_LINK_MODE_MASK_NBITS
-@@ -2271,6 +2289,10 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
-  * be exploited to reduce the RSS queue spread.
-  */
- #define	RXH_XFRM_SYM_XOR	(1 << 0)
-+/* Similar to SYM_XOR, except that one copy of the XOR'ed fields is replaced by
-+ * an OR of the same fields
-+ */
-+#define	RXH_XFRM_SYM_OR_XOR	(1 << 1)
- #define	RXH_XFRM_NO_CHANGE	0xff
- 
- /* L2-L4 network traffic flow types */
-diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
-index d303effb2a..a2b5815d89 100644
---- a/include/standard-headers/linux/fuse.h
-+++ b/include/standard-headers/linux/fuse.h
-@@ -229,6 +229,9 @@
-  *    - FUSE_URING_IN_OUT_HEADER_SZ
-  *    - FUSE_URING_OP_IN_OUT_SZ
-  *    - enum fuse_uring_cmd
-+ *
-+ *  7.43
-+ *  - add FUSE_REQUEST_TIMEOUT
-  */
- 
- #ifndef _LINUX_FUSE_H
-@@ -260,7 +263,7 @@
- #define FUSE_KERNEL_VERSION 7
- 
- /** Minor version number of this interface */
--#define FUSE_KERNEL_MINOR_VERSION 42
-+#define FUSE_KERNEL_MINOR_VERSION 43
- 
- /** The node ID of the root inode */
- #define FUSE_ROOT_ID 1
-@@ -431,6 +434,8 @@ struct fuse_file_lock {
-  *		    of the request ID indicates resend requests
-  * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
-  * FUSE_OVER_IO_URING: Indicate that client supports io-uring
-+ * FUSE_REQUEST_TIMEOUT: kernel supports timing out requests.
-+ *			 init_out.request_timeout contains the timeout (in secs)
-  */
- #define FUSE_ASYNC_READ		(1 << 0)
- #define FUSE_POSIX_LOCKS	(1 << 1)
-@@ -473,11 +478,11 @@ struct fuse_file_lock {
- #define FUSE_PASSTHROUGH	(1ULL << 37)
- #define FUSE_NO_EXPORT_SUPPORT	(1ULL << 38)
- #define FUSE_HAS_RESEND		(1ULL << 39)
--
- /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
- #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
- #define FUSE_ALLOW_IDMAP	(1ULL << 40)
- #define FUSE_OVER_IO_URING	(1ULL << 41)
-+#define FUSE_REQUEST_TIMEOUT	(1ULL << 42)
- 
- /**
-  * CUSE INIT request/reply flags
-@@ -905,7 +910,8 @@ struct fuse_init_out {
- 	uint16_t	map_alignment;
- 	uint32_t	flags2;
- 	uint32_t	max_stack_depth;
--	uint32_t	unused[6];
-+	uint16_t	request_timeout;
-+	uint16_t	unused[11];
- };
- 
- #define CUSE_INIT_INFO_MAX 4096
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index 3445c4970e..ba326710f9 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -486,6 +486,7 @@
- #define   PCI_EXP_TYPE_RC_EC	   0xa	/* Root Complex Event Collector */
- #define  PCI_EXP_FLAGS_SLOT	0x0100	/* Slot implemented */
- #define  PCI_EXP_FLAGS_IRQ	0x3e00	/* Interrupt message number */
-+#define  PCI_EXP_FLAGS_FLIT	0x8000	/* Flit Mode Supported */
- #define PCI_EXP_DEVCAP		0x04	/* Device capabilities */
- #define  PCI_EXP_DEVCAP_PAYLOAD	0x00000007 /* Max_Payload_Size */
- #define  PCI_EXP_DEVCAP_PHANTOM	0x00000018 /* Phantom functions */
-@@ -795,6 +796,8 @@
- #define  PCI_ERR_CAP_ECRC_CHKC		0x00000080 /* ECRC Check Capable */
- #define  PCI_ERR_CAP_ECRC_CHKE		0x00000100 /* ECRC Check Enable */
- #define  PCI_ERR_CAP_PREFIX_LOG_PRESENT	0x00000800 /* TLP Prefix Log Present */
-+#define  PCI_ERR_CAP_TLP_LOG_FLIT	0x00040000 /* TLP was logged in Flit Mode */
-+#define  PCI_ERR_CAP_TLP_LOG_SIZE	0x00f80000 /* Logged TLP Size (only in Flit mode) */
- #define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
- #define PCI_ERR_ROOT_COMMAND	0x2c	/* Root Error Command */
- #define  PCI_ERR_ROOT_CMD_COR_EN	0x00000001 /* Correctable Err Reporting Enable */
-@@ -1013,7 +1016,7 @@
- 
- /* Resizable BARs */
- #define PCI_REBAR_CAP		4	/* capability register */
--#define  PCI_REBAR_CAP_SIZES		0x00FFFFF0  /* supported BAR sizes */
-+#define  PCI_REBAR_CAP_SIZES		0xFFFFFFF0  /* supported BAR sizes */
- #define PCI_REBAR_CTRL		8	/* control register */
- #define  PCI_REBAR_CTRL_BAR_IDX		0x00000007  /* BAR index */
- #define  PCI_REBAR_CTRL_NBAR_MASK	0x000000E0  /* # of resizable BARs */
-@@ -1061,8 +1064,9 @@
- #define  PCI_EXP_DPC_CAP_RP_EXT		0x0020	/* Root Port Extensions */
- #define  PCI_EXP_DPC_CAP_POISONED_TLP	0x0040	/* Poisoned TLP Egress Blocking Supported */
- #define  PCI_EXP_DPC_CAP_SW_TRIGGER	0x0080	/* Software Triggering Supported */
--#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE	0x0F00	/* RP PIO Log Size */
-+#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE	0x0F00	/* RP PIO Log Size [3:0] */
- #define  PCI_EXP_DPC_CAP_DL_ACTIVE	0x1000	/* ERR_COR signal on DL_Active supported */
-+#define  PCI_EXP_DPC_RP_PIO_LOG_SIZE4	0x2000	/* RP PIO Log Size [4] */
- 
- #define PCI_EXP_DPC_CTL			0x06	/* DPC control */
- #define  PCI_EXP_DPC_CTL_EN_FATAL	0x0001	/* Enable trigger on ERR_FATAL message */
-@@ -1205,9 +1209,12 @@
- #define PCI_DOE_DATA_OBJECT_DISC_REQ_3_INDEX		0x000000ff
- #define PCI_DOE_DATA_OBJECT_DISC_REQ_3_VER		0x0000ff00
- #define PCI_DOE_DATA_OBJECT_DISC_RSP_3_VID		0x0000ffff
--#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL		0x00ff0000
-+#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE		0x00ff0000
- #define PCI_DOE_DATA_OBJECT_DISC_RSP_3_NEXT_INDEX	0xff000000
- 
-+/* Deprecated old name, replaced with PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE */
-+#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL		PCI_DOE_DATA_OBJECT_DISC_RSP_3_TYPE
-+
- /* Compute Express Link (CXL r3.1, sec 8.1.5) */
- #define PCI_DVSEC_CXL_PORT				3
- #define PCI_DVSEC_CXL_PORT_CTL				0x0c
-diff --git a/include/standard-headers/linux/virtio_net.h b/include/standard-headers/linux/virtio_net.h
-index fc594fe5fc..982e854f14 100644
---- a/include/standard-headers/linux/virtio_net.h
-+++ b/include/standard-headers/linux/virtio_net.h
-@@ -327,6 +327,19 @@ struct virtio_net_rss_config {
- 	uint8_t hash_key_data[/* hash_key_length */];
- };
- 
-+struct virtio_net_rss_config_hdr {
-+	uint32_t hash_types;
-+	uint16_t indirection_table_mask;
-+	uint16_t unclassified_queue;
-+	uint16_t indirection_table[/* 1 + indirection_table_mask */];
-+};
-+
-+struct virtio_net_rss_config_trailer {
-+	uint16_t max_tx_vq;
-+	uint8_t hash_key_length;
-+	uint8_t hash_key_data[/* hash_key_length */];
-+};
-+
-  #define VIRTIO_NET_CTRL_MQ_RSS_CONFIG          1
- 
- /*
-diff --git a/include/standard-headers/linux/virtio_snd.h b/include/standard-headers/linux/virtio_snd.h
-index 860f12e0a4..160d57899f 100644
---- a/include/standard-headers/linux/virtio_snd.h
-+++ b/include/standard-headers/linux/virtio_snd.h
-@@ -25,7 +25,7 @@ struct virtio_snd_config {
- 	uint32_t streams;
- 	/* # of available channel maps */
- 	uint32_t chmaps;
--	/* # of available control elements */
-+	/* # of available control elements (if VIRTIO_SND_F_CTLS) */
- 	uint32_t controls;
- };
- 
-diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
-index ec1e82bdc8..4e6aff08df 100644
---- a/linux-headers/asm-arm64/kvm.h
-+++ b/linux-headers/asm-arm64/kvm.h
-@@ -105,6 +105,7 @@ struct kvm_regs {
- #define KVM_ARM_VCPU_PTRAUTH_ADDRESS	5 /* VCPU uses address authentication */
- #define KVM_ARM_VCPU_PTRAUTH_GENERIC	6 /* VCPU uses generic authentication */
- #define KVM_ARM_VCPU_HAS_EL2		7 /* Support nested virtualization */
-+#define KVM_ARM_VCPU_HAS_EL2_E2H0	8 /* Limit NV support to E2H RES0 */
- 
- struct kvm_vcpu_init {
- 	__u32 target;
-@@ -365,6 +366,7 @@ enum {
- 	KVM_REG_ARM_STD_HYP_BIT_PV_TIME	= 0,
- };
- 
-+/* Vendor hyper call function numbers 0-63 */
- #define KVM_REG_ARM_VENDOR_HYP_BMAP		KVM_REG_ARM_FW_FEAT_BMAP_REG(2)
- 
- enum {
-@@ -372,6 +374,14 @@ enum {
- 	KVM_REG_ARM_VENDOR_HYP_BIT_PTP		= 1,
- };
- 
-+/* Vendor hyper call function numbers 64-127 */
-+#define KVM_REG_ARM_VENDOR_HYP_BMAP_2		KVM_REG_ARM_FW_FEAT_BMAP_REG(3)
-+
-+enum {
-+	KVM_REG_ARM_VENDOR_HYP_BIT_DISCOVER_IMPL_VER	= 0,
-+	KVM_REG_ARM_VENDOR_HYP_BIT_DISCOVER_IMPL_CPUS	= 1,
-+};
-+
- /* Device Control API on vm fd */
- #define KVM_ARM_VM_SMCCC_CTRL		0
- #define   KVM_ARM_VM_SMCCC_FILTER	0
-@@ -394,6 +404,7 @@ enum {
- #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
- #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
- #define KVM_DEV_ARM_VGIC_GRP_ITS_REGS 8
-+#define KVM_DEV_ARM_VGIC_GRP_MAINT_IRQ  9
- #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT	10
- #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
- 			(0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
-diff --git a/linux-headers/asm-arm64/unistd_64.h b/linux-headers/asm-arm64/unistd_64.h
-index d4e90fff76..ee9aaebdf3 100644
---- a/linux-headers/asm-arm64/unistd_64.h
-+++ b/linux-headers/asm-arm64/unistd_64.h
-@@ -323,6 +323,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-generic/mman-common.h b/linux-headers/asm-generic/mman-common.h
-index 1ea2c4c33b..ef1c27fa3c 100644
---- a/linux-headers/asm-generic/mman-common.h
-+++ b/linux-headers/asm-generic/mman-common.h
-@@ -85,6 +85,7 @@
- /* compatibility flags */
- #define MAP_FILE	0
- 
-+#define PKEY_UNRESTRICTED	0x0
- #define PKEY_DISABLE_ACCESS	0x1
- #define PKEY_DISABLE_WRITE	0x2
- #define PKEY_ACCESS_MASK	(PKEY_DISABLE_ACCESS |\
-diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
-index 88dc393c2b..2892a45023 100644
---- a/linux-headers/asm-generic/unistd.h
-+++ b/linux-headers/asm-generic/unistd.h
-@@ -849,9 +849,11 @@ __SYSCALL(__NR_getxattrat, sys_getxattrat)
- __SYSCALL(__NR_listxattrat, sys_listxattrat)
- #define __NR_removexattrat 466
- __SYSCALL(__NR_removexattrat, sys_removexattrat)
-+#define __NR_open_tree_attr 467
-+__SYSCALL(__NR_open_tree_attr, sys_open_tree_attr)
- 
- #undef __NR_syscalls
--#define __NR_syscalls 467
-+#define __NR_syscalls 468
- 
- /*
-  * 32 bit systems traditionally used different
-diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
-index 23fb96a8a7..50d22df8f7 100644
---- a/linux-headers/asm-loongarch/unistd_64.h
-+++ b/linux-headers/asm-loongarch/unistd_64.h
-@@ -319,6 +319,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
-index 9a75719644..bdcc2f460b 100644
---- a/linux-headers/asm-mips/unistd_n32.h
-+++ b/linux-headers/asm-mips/unistd_n32.h
-@@ -395,5 +395,6 @@
- #define __NR_getxattrat (__NR_Linux + 464)
- #define __NR_listxattrat (__NR_Linux + 465)
- #define __NR_removexattrat (__NR_Linux + 466)
-+#define __NR_open_tree_attr (__NR_Linux + 467)
- 
- #endif /* _ASM_UNISTD_N32_H */
-diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
-index 7086783b0c..3b6b0193b6 100644
---- a/linux-headers/asm-mips/unistd_n64.h
-+++ b/linux-headers/asm-mips/unistd_n64.h
-@@ -371,5 +371,6 @@
- #define __NR_getxattrat (__NR_Linux + 464)
- #define __NR_listxattrat (__NR_Linux + 465)
- #define __NR_removexattrat (__NR_Linux + 466)
-+#define __NR_open_tree_attr (__NR_Linux + 467)
- 
- #endif /* _ASM_UNISTD_N64_H */
-diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
-index b3825823e4..4609a4b4d3 100644
---- a/linux-headers/asm-mips/unistd_o32.h
-+++ b/linux-headers/asm-mips/unistd_o32.h
-@@ -441,5 +441,6 @@
- #define __NR_getxattrat (__NR_Linux + 464)
- #define __NR_listxattrat (__NR_Linux + 465)
- #define __NR_removexattrat (__NR_Linux + 466)
-+#define __NR_open_tree_attr (__NR_Linux + 467)
- 
- #endif /* _ASM_UNISTD_O32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
-index 38ee4dc35d..5d38a427e0 100644
---- a/linux-headers/asm-powerpc/unistd_32.h
-+++ b/linux-headers/asm-powerpc/unistd_32.h
-@@ -448,6 +448,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
-index 5e5f156834..860a488e4d 100644
---- a/linux-headers/asm-powerpc/unistd_64.h
-+++ b/linux-headers/asm-powerpc/unistd_64.h
-@@ -420,6 +420,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-index f06bc5efcd..5f59fd226c 100644
---- a/linux-headers/asm-riscv/kvm.h
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -182,6 +182,8 @@ enum KVM_RISCV_ISA_EXT_ID {
- 	KVM_RISCV_ISA_EXT_SVVPTC,
- 	KVM_RISCV_ISA_EXT_ZABHA,
- 	KVM_RISCV_ISA_EXT_ZICCRSE,
-+	KVM_RISCV_ISA_EXT_ZAAMO,
-+	KVM_RISCV_ISA_EXT_ZALRSC,
- 	KVM_RISCV_ISA_EXT_MAX,
- };
- 
-diff --git a/linux-headers/asm-riscv/unistd_32.h b/linux-headers/asm-riscv/unistd_32.h
-index 74f6127aed..a5e769f1d9 100644
---- a/linux-headers/asm-riscv/unistd_32.h
-+++ b/linux-headers/asm-riscv/unistd_32.h
-@@ -314,6 +314,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-riscv/unistd_64.h b/linux-headers/asm-riscv/unistd_64.h
-index bb6a15a2ec..8df4d64841 100644
---- a/linux-headers/asm-riscv/unistd_64.h
-+++ b/linux-headers/asm-riscv/unistd_64.h
-@@ -324,6 +324,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
-index 620201cb36..85eedbd18e 100644
---- a/linux-headers/asm-s390/unistd_32.h
-+++ b/linux-headers/asm-s390/unistd_32.h
-@@ -439,5 +439,6 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- #endif /* _ASM_S390_UNISTD_32_H */
-diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
-index e7e4a10aaf..c03b1b9701 100644
---- a/linux-headers/asm-s390/unistd_64.h
-+++ b/linux-headers/asm-s390/unistd_64.h
-@@ -387,5 +387,6 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- #endif /* _ASM_S390_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index 86f2c34e7a..dc591fb17e 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -557,6 +557,9 @@ struct kvm_x86_mce {
- #define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE	(1 << 7)
- #define KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA	(1 << 8)
- 
-+#define KVM_XEN_MSR_MIN_INDEX			0x40000000u
-+#define KVM_XEN_MSR_MAX_INDEX			0x4fffffffu
-+
- struct kvm_xen_hvm_config {
- 	__u32 flags;
- 	__u32 msr;
-diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
-index a2eb492a75..491d6b4eb6 100644
---- a/linux-headers/asm-x86/unistd_32.h
-+++ b/linux-headers/asm-x86/unistd_32.h
-@@ -457,6 +457,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_32_H */
-diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
-index 2f5fc400f5..7cf88bf9bd 100644
---- a/linux-headers/asm-x86/unistd_64.h
-+++ b/linux-headers/asm-x86/unistd_64.h
-@@ -380,6 +380,7 @@
- #define __NR_getxattrat 464
- #define __NR_listxattrat 465
- #define __NR_removexattrat 466
-+#define __NR_open_tree_attr 467
- 
- 
- #endif /* _ASM_UNISTD_64_H */
-diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
-index fecd832e7f..82959111e6 100644
---- a/linux-headers/asm-x86/unistd_x32.h
-+++ b/linux-headers/asm-x86/unistd_x32.h
-@@ -333,6 +333,7 @@
- #define __NR_getxattrat (__X32_SYSCALL_BIT + 464)
- #define __NR_listxattrat (__X32_SYSCALL_BIT + 465)
- #define __NR_removexattrat (__X32_SYSCALL_BIT + 466)
-+#define __NR_open_tree_attr (__X32_SYSCALL_BIT + 467)
- #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
- #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
- #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
-diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
-index c0d00c0a98..58596d18f4 100644
---- a/linux-headers/linux/bits.h
-+++ b/linux-headers/linux/bits.h
-@@ -4,13 +4,9 @@
- #ifndef _LINUX_BITS_H
- #define _LINUX_BITS_H
- 
--#define __GENMASK(h, l) \
--        (((~_UL(0)) - (_UL(1) << (l)) + 1) & \
--         (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
-+#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))
- 
--#define __GENMASK_ULL(h, l) \
--        (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
--         (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
-+#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
- 
- #define __GENMASK_U128(h, l) \
- 	((_BIT128((h)) << 1) - (_BIT128(l)))
-diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
-index 2122610de7..95ede23342 100644
---- a/linux-headers/linux/const.h
-+++ b/linux-headers/linux/const.h
-@@ -33,7 +33,7 @@
-  * Missing __asm__ support
-  *
-  * __BIT128() would not work in the __asm__ code, as it shifts an
-- * 'unsigned __init128' data type as direct representation of
-+ * 'unsigned __int128' data type as direct representation of
-  * 128 bit constants is not supported in the gcc compiler, as
-  * they get silently truncated.
-  *
-diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
-index ccbdca5e11..cb0f7d6b4d 100644
---- a/linux-headers/linux/iommufd.h
-+++ b/linux-headers/linux/iommufd.h
-@@ -55,6 +55,7 @@ enum {
- 	IOMMUFD_CMD_VIOMMU_ALLOC = 0x90,
- 	IOMMUFD_CMD_VDEVICE_ALLOC = 0x91,
- 	IOMMUFD_CMD_IOAS_CHANGE_PROCESS = 0x92,
-+	IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
- };
- 
- /**
-@@ -392,6 +393,9 @@ struct iommu_vfio_ioas {
-  *                          Any domain attached to the non-PASID part of the
-  *                          device must also be flagged, otherwise attaching a
-  *                          PASID will blocked.
-+ *                          For the user that wants to attach PASID, ioas is
-+ *                          not recommended for both the non-PASID part
-+ *                          and PASID part of the device.
-  *                          If IOMMU does not support PASID it will return
-  *                          error (-EOPNOTSUPP).
-  */
-@@ -608,9 +612,17 @@ enum iommu_hw_info_type {
-  *                                   IOMMU_HWPT_GET_DIRTY_BITMAP
-  *                                   IOMMU_HWPT_SET_DIRTY_TRACKING
-  *
-+ * @IOMMU_HW_CAP_PCI_PASID_EXEC: Execute Permission Supported, user ignores it
-+ *                               when the struct
-+ *                               iommu_hw_info::out_max_pasid_log2 is zero.
-+ * @IOMMU_HW_CAP_PCI_PASID_PRIV: Privileged Mode Supported, user ignores it
-+ *                               when the struct
-+ *                               iommu_hw_info::out_max_pasid_log2 is zero.
-  */
- enum iommufd_hw_capabilities {
- 	IOMMU_HW_CAP_DIRTY_TRACKING = 1 << 0,
-+	IOMMU_HW_CAP_PCI_PASID_EXEC = 1 << 1,
-+	IOMMU_HW_CAP_PCI_PASID_PRIV = 1 << 2,
- };
- 
- /**
-@@ -626,6 +638,9 @@ enum iommufd_hw_capabilities {
-  *                 iommu_hw_info_type.
-  * @out_capabilities: Output the generic iommu capability info type as defined
-  *                    in the enum iommu_hw_capabilities.
-+ * @out_max_pasid_log2: Output the width of PASIDs. 0 means no PASID support.
-+ *                      PCI devices turn to out_capabilities to check if the
-+ *                      specific capabilities is supported or not.
-  * @__reserved: Must be 0
-  *
-  * Query an iommu type specific hardware information data from an iommu behind
-@@ -649,7 +664,8 @@ struct iommu_hw_info {
- 	__u32 data_len;
- 	__aligned_u64 data_uptr;
- 	__u32 out_data_type;
--	__u32 __reserved;
-+	__u8 out_max_pasid_log2;
-+	__u8 __reserved[3];
- 	__aligned_u64 out_capabilities;
- };
- #define IOMMU_GET_HW_INFO _IO(IOMMUFD_TYPE, IOMMUFD_CMD_GET_HW_INFO)
-@@ -1014,4 +1030,115 @@ struct iommu_ioas_change_process {
- #define IOMMU_IOAS_CHANGE_PROCESS \
- 	_IO(IOMMUFD_TYPE, IOMMUFD_CMD_IOAS_CHANGE_PROCESS)
- 
-+/**
-+ * enum iommu_veventq_flag - flag for struct iommufd_vevent_header
-+ * @IOMMU_VEVENTQ_FLAG_LOST_EVENTS: vEVENTQ has lost vEVENTs
-+ */
-+enum iommu_veventq_flag {
-+	IOMMU_VEVENTQ_FLAG_LOST_EVENTS = (1U << 0),
-+};
-+
-+/**
-+ * struct iommufd_vevent_header - Virtual Event Header for a vEVENTQ Status
-+ * @flags: Combination of enum iommu_veventq_flag
-+ * @sequence: The sequence index of a vEVENT in the vEVENTQ, with a range of
-+ *            [0, INT_MAX] where the following index of INT_MAX is 0
-+ *
-+ * Each iommufd_vevent_header reports a sequence index of the following vEVENT:
-+ *
-+ * +----------------------+-------+----------------------+-------+---+-------+
-+ * | header0 {sequence=0} | data0 | header1 {sequence=1} | data1 |...| dataN |
-+ * +----------------------+-------+----------------------+-------+---+-------+
-+ *
-+ * And this sequence index is expected to be monotonic to the sequence index of
-+ * the previous vEVENT. If two adjacent sequence indexes has a delta larger than
-+ * 1, it means that delta - 1 number of vEVENTs has lost, e.g. two lost vEVENTs:
-+ *
-+ * +-----+----------------------+-------+----------------------+-------+-----+
-+ * | ... | header3 {sequence=3} | data3 | header6 {sequence=6} | data6 | ... |
-+ * +-----+----------------------+-------+----------------------+-------+-----+
-+ *
-+ * If a vEVENT lost at the tail of the vEVENTQ and there is no following vEVENT
-+ * providing the next sequence index, an IOMMU_VEVENTQ_FLAG_LOST_EVENTS header
-+ * would be added to the tail, and no data would follow this header:
-+ *
-+ * +--+----------------------+-------+-----------------------------------------+
-+ * |..| header3 {sequence=3} | data3 | header4 {flags=LOST_EVENTS, sequence=4} |
-+ * +--+----------------------+-------+-----------------------------------------+
-+ */
-+struct iommufd_vevent_header {
-+	__u32 flags;
-+	__u32 sequence;
-+};
-+
-+/**
-+ * enum iommu_veventq_type - Virtual Event Queue Type
-+ * @IOMMU_VEVENTQ_TYPE_DEFAULT: Reserved for future use
-+ * @IOMMU_VEVENTQ_TYPE_ARM_SMMUV3: ARM SMMUv3 Virtual Event Queue
-+ */
-+enum iommu_veventq_type {
-+	IOMMU_VEVENTQ_TYPE_DEFAULT = 0,
-+	IOMMU_VEVENTQ_TYPE_ARM_SMMUV3 = 1,
-+};
-+
-+/**
-+ * struct iommu_vevent_arm_smmuv3 - ARM SMMUv3 Virtual Event
-+ *                                  (IOMMU_VEVENTQ_TYPE_ARM_SMMUV3)
-+ * @evt: 256-bit ARM SMMUv3 Event record, little-endian.
-+ *       Reported event records: (Refer to "7.3 Event records" in SMMUv3 HW Spec)
-+ *       - 0x04 C_BAD_STE
-+ *       - 0x06 F_STREAM_DISABLED
-+ *       - 0x08 C_BAD_SUBSTREAMID
-+ *       - 0x0a C_BAD_CD
-+ *       - 0x10 F_TRANSLATION
-+ *       - 0x11 F_ADDR_SIZE
-+ *       - 0x12 F_ACCESS
-+ *       - 0x13 F_PERMISSION
-+ *
-+ * StreamID field reports a virtual device ID. To receive a virtual event for a
-+ * device, a vDEVICE must be allocated via IOMMU_VDEVICE_ALLOC.
-+ */
-+struct iommu_vevent_arm_smmuv3 {
-+	__aligned_le64 evt[4];
-+};
-+
-+/**
-+ * struct iommu_veventq_alloc - ioctl(IOMMU_VEVENTQ_ALLOC)
-+ * @size: sizeof(struct iommu_veventq_alloc)
-+ * @flags: Must be 0
-+ * @viommu_id: virtual IOMMU ID to associate the vEVENTQ with
-+ * @type: Type of the vEVENTQ. Must be defined in enum iommu_veventq_type
-+ * @veventq_depth: Maximum number of events in the vEVENTQ
-+ * @out_veventq_id: The ID of the new vEVENTQ
-+ * @out_veventq_fd: The fd of the new vEVENTQ. User space must close the
-+ *                  successfully returned fd after using it
-+ * @__reserved: Must be 0
-+ *
-+ * Explicitly allocate a virtual event queue interface for a vIOMMU. A vIOMMU
-+ * can have multiple FDs for different types, but is confined to one per @type.
-+ * User space should open the @out_veventq_fd to read vEVENTs out of a vEVENTQ,
-+ * if there are vEVENTs available. A vEVENTQ will lose events due to overflow,
-+ * if the number of the vEVENTs hits @veventq_depth.
-+ *
-+ * Each vEVENT in a vEVENTQ encloses a struct iommufd_vevent_header followed by
-+ * a type-specific data structure, in a normal case:
-+ *
-+ * +-+---------+-------+---------+-------+-----+---------+-------+-+
-+ * | | header0 | data0 | header1 | data1 | ... | headerN | dataN | |
-+ * +-+---------+-------+---------+-------+-----+---------+-------+-+
-+ *
-+ * unless a tailing IOMMU_VEVENTQ_FLAG_LOST_EVENTS header is logged (refer to
-+ * struct iommufd_vevent_header).
-+ */
-+struct iommu_veventq_alloc {
-+	__u32 size;
-+	__u32 flags;
-+	__u32 viommu_id;
-+	__u32 type;
-+	__u32 veventq_depth;
-+	__u32 out_veventq_id;
-+	__u32 out_veventq_fd;
-+	__u32 __reserved;
-+};
-+#define IOMMU_VEVENTQ_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VEVENTQ_ALLOC)
- #endif
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index 27181b3dd8..e5f3e8b5a0 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -921,6 +921,7 @@ struct kvm_enable_cap {
- #define KVM_CAP_PRE_FAULT_MEMORY 236
- #define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
- #define KVM_CAP_X86_GUEST_MODE 238
-+#define KVM_CAP_ARM_WRITABLE_IMP_ID_REGS 239
- 
- struct kvm_irq_routing_irqchip {
- 	__u32 irqchip;
-diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
-index 17bf191573..113c4ceb78 100644
---- a/linux-headers/linux/psp-sev.h
-+++ b/linux-headers/linux/psp-sev.h
-@@ -73,13 +73,20 @@ typedef enum {
- 	SEV_RET_INVALID_PARAM,
- 	SEV_RET_RESOURCE_LIMIT,
- 	SEV_RET_SECURE_DATA_INVALID,
--	SEV_RET_INVALID_KEY = 0x27,
--	SEV_RET_INVALID_PAGE_SIZE,
--	SEV_RET_INVALID_PAGE_STATE,
--	SEV_RET_INVALID_MDATA_ENTRY,
--	SEV_RET_INVALID_PAGE_OWNER,
--	SEV_RET_INVALID_PAGE_AEAD_OFLOW,
--	SEV_RET_RMP_INIT_REQUIRED,
-+	SEV_RET_INVALID_PAGE_SIZE          = 0x0019,
-+	SEV_RET_INVALID_PAGE_STATE         = 0x001A,
-+	SEV_RET_INVALID_MDATA_ENTRY        = 0x001B,
-+	SEV_RET_INVALID_PAGE_OWNER         = 0x001C,
-+	SEV_RET_AEAD_OFLOW                 = 0x001D,
-+	SEV_RET_EXIT_RING_BUFFER           = 0x001F,
-+	SEV_RET_RMP_INIT_REQUIRED          = 0x0020,
-+	SEV_RET_BAD_SVN                    = 0x0021,
-+	SEV_RET_BAD_VERSION                = 0x0022,
-+	SEV_RET_SHUTDOWN_REQUIRED          = 0x0023,
-+	SEV_RET_UPDATE_FAILED              = 0x0024,
-+	SEV_RET_RESTORE_REQUIRED           = 0x0025,
-+	SEV_RET_RMP_INITIALIZATION_FAILED  = 0x0026,
-+	SEV_RET_INVALID_KEY                = 0x0027,
- 	SEV_RET_MAX,
- } sev_ret_code;
- 
-diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
-index e1416f7937..e1fcfcf3b3 100644
---- a/linux-headers/linux/stddef.h
-+++ b/linux-headers/linux/stddef.h
-@@ -70,4 +70,6 @@
- #define __counted_by_be(m)
- #endif
- 
-+#define __kernel_nonstring
-+
- #endif /* _LINUX_STDDEF_H */
-diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
-index 1b5e254d6a..79bf8c0cc5 100644
---- a/linux-headers/linux/vfio.h
-+++ b/linux-headers/linux/vfio.h
-@@ -671,6 +671,7 @@ enum {
-  */
- enum {
- 	VFIO_AP_REQ_IRQ_INDEX,
-+	VFIO_AP_CFG_CHG_IRQ_INDEX,
- 	VFIO_AP_NUM_IRQS
- };
- 
-@@ -931,29 +932,34 @@ struct vfio_device_bind_iommufd {
-  * VFIO_DEVICE_ATTACH_IOMMUFD_PT - _IOW(VFIO_TYPE, VFIO_BASE + 19,
-  *					struct vfio_device_attach_iommufd_pt)
-  * @argsz:	User filled size of this data.
-- * @flags:	Must be 0.
-+ * @flags:	Flags for attach.
-  * @pt_id:	Input the target id which can represent an ioas or a hwpt
-  *		allocated via iommufd subsystem.
-  *		Output the input ioas id or the attached hwpt id which could
-  *		be the specified hwpt itself or a hwpt automatically created
-  *		for the specified ioas by kernel during the attachment.
-+ * @pasid:	The pasid to be attached, only meaningful when
-+ *		VFIO_DEVICE_ATTACH_PASID is set in @flags
-  *
-  * Associate the device with an address space within the bound iommufd.
-  * Undo by VFIO_DEVICE_DETACH_IOMMUFD_PT or device fd close.  This is only
-  * allowed on cdev fds.
-  *
-- * If a vfio device is currently attached to a valid hw_pagetable, without doing
-- * a VFIO_DEVICE_DETACH_IOMMUFD_PT, a second VFIO_DEVICE_ATTACH_IOMMUFD_PT ioctl
-- * passing in another hw_pagetable (hwpt) id is allowed. This action, also known
-- * as a hw_pagetable replacement, will replace the device's currently attached
-- * hw_pagetable with a new hw_pagetable corresponding to the given pt_id.
-+ * If a vfio device or a pasid of this device is currently attached to a valid
-+ * hw_pagetable (hwpt), without doing a VFIO_DEVICE_DETACH_IOMMUFD_PT, a second
-+ * VFIO_DEVICE_ATTACH_IOMMUFD_PT ioctl passing in another hwpt id is allowed.
-+ * This action, also known as a hw_pagetable replacement, will replace the
-+ * currently attached hwpt of the device or the pasid of this device with a new
-+ * hwpt corresponding to the given pt_id.
-  *
-  * Return: 0 on success, -errno on failure.
-  */
- struct vfio_device_attach_iommufd_pt {
- 	__u32	argsz;
- 	__u32	flags;
-+#define VFIO_DEVICE_ATTACH_PASID	(1 << 0)
- 	__u32	pt_id;
-+	__u32	pasid;
- };
- 
- #define VFIO_DEVICE_ATTACH_IOMMUFD_PT		_IO(VFIO_TYPE, VFIO_BASE + 19)
-@@ -962,17 +968,21 @@ struct vfio_device_attach_iommufd_pt {
-  * VFIO_DEVICE_DETACH_IOMMUFD_PT - _IOW(VFIO_TYPE, VFIO_BASE + 20,
-  *					struct vfio_device_detach_iommufd_pt)
-  * @argsz:	User filled size of this data.
-- * @flags:	Must be 0.
-+ * @flags:	Flags for detach.
-+ * @pasid:	The pasid to be detached, only meaningful when
-+ *		VFIO_DEVICE_DETACH_PASID is set in @flags
-  *
-- * Remove the association of the device and its current associated address
-- * space.  After it, the device should be in a blocking DMA state.  This is only
-- * allowed on cdev fds.
-+ * Remove the association of the device or a pasid of the device and its current
-+ * associated address space.  After it, the device or the pasid should be in a
-+ * blocking DMA state.  This is only allowed on cdev fds.
-  *
-  * Return: 0 on success, -errno on failure.
-  */
- struct vfio_device_detach_iommufd_pt {
- 	__u32	argsz;
- 	__u32	flags;
-+#define VFIO_DEVICE_DETACH_PASID	(1 << 0)
-+	__u32	pasid;
- };
- 
- #define VFIO_DEVICE_DETACH_IOMMUFD_PT		_IO(VFIO_TYPE, VFIO_BASE + 20)
--- 
-2.50.1
-
diff --git a/kvm-linux-headers-update-from-6.15-kvm-next.patch b/kvm-linux-headers-update-from-6.15-kvm-next.patch
deleted file mode 100644
index 963a4ad..0000000
--- a/kvm-linux-headers-update-from-6.15-kvm-next.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From f1d5a02a236b16c839f4acdbb493d532c95987e0 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 028/115] linux-headers: update from 6.15 + kvm/next
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [28/115] 8eeb6840c789d026eff3112d23332bc3172c51be (bonzini/rhel-qemu-kvm)
-
-This brings in the userspace TDX API.
-
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 428c0acd953a626dab55e2c07401ce99c2271119)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- linux-headers/asm-x86/kvm.h | 71 +++++++++++++++++++++++++++++++++++++
- linux-headers/linux/kvm.h   |  1 +
- 2 files changed, 72 insertions(+)
-
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index dc591fb17e..7fb57ccb2a 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -439,6 +439,7 @@ struct kvm_sync_regs {
- #define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
- #define KVM_X86_QUIRK_SLOT_ZAP_ALL		(1 << 7)
- #define KVM_X86_QUIRK_STUFF_FEATURE_MSRS	(1 << 8)
-+#define KVM_X86_QUIRK_IGNORE_GUEST_PAT		(1 << 9)
- 
- #define KVM_STATE_NESTED_FORMAT_VMX	0
- #define KVM_STATE_NESTED_FORMAT_SVM	1
-@@ -928,4 +929,74 @@ struct kvm_hyperv_eventfd {
- #define KVM_X86_SNP_VM		4
- #define KVM_X86_TDX_VM		5
- 
-+/* Trust Domain eXtension sub-ioctl() commands. */
-+enum kvm_tdx_cmd_id {
-+	KVM_TDX_CAPABILITIES = 0,
-+	KVM_TDX_INIT_VM,
-+	KVM_TDX_INIT_VCPU,
-+	KVM_TDX_INIT_MEM_REGION,
-+	KVM_TDX_FINALIZE_VM,
-+	KVM_TDX_GET_CPUID,
-+
-+	KVM_TDX_CMD_NR_MAX,
-+};
-+
-+struct kvm_tdx_cmd {
-+	/* enum kvm_tdx_cmd_id */
-+	__u32 id;
-+	/* flags for sub-commend. If sub-command doesn't use this, set zero. */
-+	__u32 flags;
-+	/*
-+	 * data for each sub-command. An immediate or a pointer to the actual
-+	 * data in process virtual address.  If sub-command doesn't use it,
-+	 * set zero.
-+	 */
-+	__u64 data;
-+	/*
-+	 * Auxiliary error code.  The sub-command may return TDX SEAMCALL
-+	 * status code in addition to -Exxx.
-+	 */
-+	__u64 hw_error;
-+};
-+
-+struct kvm_tdx_capabilities {
-+	__u64 supported_attrs;
-+	__u64 supported_xfam;
-+	__u64 reserved[254];
-+
-+	/* Configurable CPUID bits for userspace */
-+	struct kvm_cpuid2 cpuid;
-+};
-+
-+struct kvm_tdx_init_vm {
-+	__u64 attributes;
-+	__u64 xfam;
-+	__u64 mrconfigid[6];	/* sha384 digest */
-+	__u64 mrowner[6];	/* sha384 digest */
-+	__u64 mrownerconfig[6];	/* sha384 digest */
-+
-+	/* The total space for TD_PARAMS before the CPUIDs is 256 bytes */
-+	__u64 reserved[12];
-+
-+	/*
-+	 * Call KVM_TDX_INIT_VM before vcpu creation, thus before
-+	 * KVM_SET_CPUID2.
-+	 * This configuration supersedes KVM_SET_CPUID2s for VCPUs because the
-+	 * TDX module directly virtualizes those CPUIDs without VMM.  The user
-+	 * space VMM, e.g. qemu, should make KVM_SET_CPUID2 consistent with
-+	 * those values.  If it doesn't, KVM may have wrong idea of vCPUIDs of
-+	 * the guest, and KVM may wrongly emulate CPUIDs or MSRs that the TDX
-+	 * module doesn't virtualize.
-+	 */
-+	struct kvm_cpuid2 cpuid;
-+};
-+
-+#define KVM_TDX_MEASURE_MEMORY_REGION   _BITULL(0)
-+
-+struct kvm_tdx_init_mem_region {
-+	__u64 source_addr;
-+	__u64 gpa;
-+	__u64 nr_pages;
-+};
-+
- #endif /* _ASM_X86_KVM_H */
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index e5f3e8b5a0..99cc82a275 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -369,6 +369,7 @@ struct kvm_run {
- #define KVM_SYSTEM_EVENT_WAKEUP         4
- #define KVM_SYSTEM_EVENT_SUSPEND        5
- #define KVM_SYSTEM_EVENT_SEV_TERM       6
-+#define KVM_SYSTEM_EVENT_TDX_FATAL      7
- 			__u32 type;
- 			__u32 ndata;
- 			union {
--- 
-2.50.1
-
diff --git a/kvm-memory-Change-memory_region_set_ram_discard_manager-.patch b/kvm-memory-Change-memory_region_set_ram_discard_manager-.patch
deleted file mode 100644
index facc8c4..0000000
--- a/kvm-memory-Change-memory_region_set_ram_discard_manager-.patch
+++ /dev/null
@@ -1,160 +0,0 @@
-From 9e0c4adad755988ea9f94f57a87e000dd7045962 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:11:27 +0200
-Subject: [PATCH 112/115] memory: Change
- memory_region_set_ram_discard_manager() to return the result
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [112/115] 43deb5763dfabf964b55c7a6bb4363b96a5020cc (bonzini/rhel-qemu-kvm)
-
-Modify memory_region_set_ram_discard_manager() to return -EBUSY if a
-RamDiscardManager is already set in the MemoryRegion. The caller must
-handle this failure, such as having virtio-mem undo its actions and fail
-the realize() process. Opportunistically move the call earlier to avoid
-complex error handling.
-
-This change is beneficial when introducing a new RamDiscardManager
-instance besides virtio-mem. After
-ram_block_coordinated_discard_require(true) unlocks all
-RamDiscardManager instances, only one instance is allowed to be set for
-one MemoryRegion at present.
-
-Suggested-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Tested-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Link: https://lore.kernel.org/r/20250612082747.51539-3-chenyi.qiang@intel.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit ff1211154c45c9f7f82116ae9a8c72a848e4a8b5)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/virtio/virtio-mem.c | 30 +++++++++++++++++-------------
- include/exec/memory.h  |  6 +++---
- system/memory.c        | 10 +++++++---
- 3 files changed, 27 insertions(+), 19 deletions(-)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index ae26133f58..6284539243 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -1049,6 +1049,17 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-         return;
-     }
- 
-+    /*
-+     * Set ourselves as RamDiscardManager before the plug handler maps the
-+     * memory region and exposes it via an address space.
-+     */
-+    if (memory_region_set_ram_discard_manager(&vmem->memdev->mr,
-+                                              RAM_DISCARD_MANAGER(vmem))) {
-+        error_setg(errp, "Failed to set RamDiscardManager");
-+        ram_block_coordinated_discard_require(false);
-+        return;
-+    }
-+
-     /*
-      * We don't know at this point whether shared RAM is migrated using
-      * QEMU or migrated using the file content. "x-ignore-shared" will be
-@@ -1063,6 +1074,7 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-         ret = ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb));
-         if (ret) {
-             error_setg_errno(errp, -ret, "Unexpected error discarding RAM");
-+            memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
-             ram_block_coordinated_discard_require(false);
-             return;
-         }
-@@ -1124,13 +1136,6 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-     vmem->system_reset = VIRTIO_MEM_SYSTEM_RESET(obj);
-     vmem->system_reset->vmem = vmem;
-     qemu_register_resettable(obj);
--
--    /*
--     * Set ourselves as RamDiscardManager before the plug handler maps the
--     * memory region and exposes it via an address space.
--     */
--    memory_region_set_ram_discard_manager(&vmem->memdev->mr,
--                                          RAM_DISCARD_MANAGER(vmem));
- }
- 
- static void virtio_mem_device_unrealize(DeviceState *dev)
-@@ -1138,12 +1143,6 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
-     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
-     VirtIOMEM *vmem = VIRTIO_MEM(dev);
- 
--    /*
--     * The unplug handler unmapped the memory region, it cannot be
--     * found via an address space anymore. Unset ourselves.
--     */
--    memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
--
-     qemu_unregister_resettable(OBJECT(vmem->system_reset));
-     object_unref(OBJECT(vmem->system_reset));
- 
-@@ -1156,6 +1155,11 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
-     virtio_del_queue(vdev, 0);
-     virtio_cleanup(vdev);
-     g_free(vmem->bitmap);
-+    /*
-+     * The unplug handler unmapped the memory region, it cannot be
-+     * found via an address space anymore. Unset ourselves.
-+     */
-+    memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
-     ram_block_coordinated_discard_require(false);
- }
- 
-diff --git a/include/exec/memory.h b/include/exec/memory.h
-index 71b4a411cc..7cfbe203f4 100644
---- a/include/exec/memory.h
-+++ b/include/exec/memory.h
-@@ -2488,13 +2488,13 @@ static inline bool memory_region_has_ram_discard_manager(MemoryRegion *mr)
-  *
-  * This function must not be called for a mapped #MemoryRegion, a #MemoryRegion
-  * that does not cover RAM, or a #MemoryRegion that already has a
-- * #RamDiscardManager assigned.
-+ * #RamDiscardManager assigned. Return 0 if the rdm is set successfully.
-  *
-  * @mr: the #MemoryRegion
-  * @rdm: #RamDiscardManager to set
-  */
--void memory_region_set_ram_discard_manager(MemoryRegion *mr,
--                                           RamDiscardManager *rdm);
-+int memory_region_set_ram_discard_manager(MemoryRegion *mr,
-+                                          RamDiscardManager *rdm);
- 
- /**
-  * memory_region_find: translate an address/size relative to a
-diff --git a/system/memory.c b/system/memory.c
-index 5e6eb459d5..35011f731e 100644
---- a/system/memory.c
-+++ b/system/memory.c
-@@ -2083,12 +2083,16 @@ RamDiscardManager *memory_region_get_ram_discard_manager(MemoryRegion *mr)
-     return mr->rdm;
- }
- 
--void memory_region_set_ram_discard_manager(MemoryRegion *mr,
--                                           RamDiscardManager *rdm)
-+int memory_region_set_ram_discard_manager(MemoryRegion *mr,
-+                                          RamDiscardManager *rdm)
- {
-     g_assert(memory_region_is_ram(mr));
--    g_assert(!rdm || !mr->rdm);
-+    if (mr->rdm && rdm) {
-+        return -EBUSY;
-+    }
-+
-     mr->rdm = rdm;
-+    return 0;
- }
- 
- uint64_t ram_discard_manager_get_min_granularity(const RamDiscardManager *rdm,
--- 
-2.50.1
-
diff --git a/kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch b/kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch
deleted file mode 100644
index b76b842..0000000
--- a/kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-From 3a2ef25070d8135a62dfca5bff35114f520c52ad Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:11:27 +0200
-Subject: [PATCH 111/115] memory: Export a helper to get intersection of a
- MemoryRegionSection with a given range
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [111/115] d7812c678358993209bbe280985f58fce9a34e18 (bonzini/rhel-qemu-kvm)
-
-Rename the helper to memory_region_section_intersect_range() to make it
-more generic. Meanwhile, define the @end as Int128 and replace the
-related operations with Int128_* format since the helper is exported as
-a wider API.
-
-Suggested-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Link: https://lore.kernel.org/r/20250612082747.51539-2-chenyi.qiang@intel.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit f47a672a72acd6e2712031f0bc4d4f3ae4b6302c)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/virtio/virtio-mem.c | 32 +++++---------------------------
- include/exec/memory.h  | 30 ++++++++++++++++++++++++++++++
- 2 files changed, 35 insertions(+), 27 deletions(-)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 4977658312..ae26133f58 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -244,28 +244,6 @@ static int virtio_mem_for_each_plugged_range(VirtIOMEM *vmem, void *arg,
-     return ret;
- }
- 
--/*
-- * Adjust the memory section to cover the intersection with the given range.
-- *
-- * Returns false if the intersection is empty, otherwise returns true.
-- */
--static bool virtio_mem_intersect_memory_section(MemoryRegionSection *s,
--                                                uint64_t offset, uint64_t size)
--{
--    uint64_t start = MAX(s->offset_within_region, offset);
--    uint64_t end = MIN(s->offset_within_region + int128_get64(s->size),
--                       offset + size);
--
--    if (end <= start) {
--        return false;
--    }
--
--    s->offset_within_address_space += start - s->offset_within_region;
--    s->offset_within_region = start;
--    s->size = int128_make64(end - start);
--    return true;
--}
--
- typedef int (*virtio_mem_section_cb)(MemoryRegionSection *s, void *arg);
- 
- static int virtio_mem_for_each_plugged_section(const VirtIOMEM *vmem,
-@@ -287,7 +265,7 @@ static int virtio_mem_for_each_plugged_section(const VirtIOMEM *vmem,
-                                       first_bit + 1) - 1;
-         size = (last_bit - first_bit + 1) * vmem->block_size;
- 
--        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-             break;
-         }
-         ret = cb(&tmp, arg);
-@@ -319,7 +297,7 @@ static int virtio_mem_for_each_unplugged_section(const VirtIOMEM *vmem,
-                                  first_bit + 1) - 1;
-         size = (last_bit - first_bit + 1) * vmem->block_size;
- 
--        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-             break;
-         }
-         ret = cb(&tmp, arg);
-@@ -355,7 +333,7 @@ static void virtio_mem_notify_unplug(VirtIOMEM *vmem, uint64_t offset,
-     QLIST_FOREACH(rdl, &vmem->rdl_list, next) {
-         MemoryRegionSection tmp = *rdl->section;
- 
--        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-             continue;
-         }
-         rdl->notify_discard(rdl, &tmp);
-@@ -371,7 +349,7 @@ static int virtio_mem_notify_plug(VirtIOMEM *vmem, uint64_t offset,
-     QLIST_FOREACH(rdl, &vmem->rdl_list, next) {
-         MemoryRegionSection tmp = *rdl->section;
- 
--        if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-             continue;
-         }
-         ret = rdl->notify_populate(rdl, &tmp);
-@@ -388,7 +366,7 @@ static int virtio_mem_notify_plug(VirtIOMEM *vmem, uint64_t offset,
-             if (rdl2 == rdl) {
-                 break;
-             }
--            if (!virtio_mem_intersect_memory_section(&tmp, offset, size)) {
-+            if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-                 continue;
-             }
-             rdl2->notify_discard(rdl2, &tmp);
-diff --git a/include/exec/memory.h b/include/exec/memory.h
-index 296fd068c0..71b4a411cc 100644
---- a/include/exec/memory.h
-+++ b/include/exec/memory.h
-@@ -1200,6 +1200,36 @@ MemoryRegionSection *memory_region_section_new_copy(MemoryRegionSection *s);
-  */
- void memory_region_section_free_copy(MemoryRegionSection *s);
- 
-+/**
-+ * memory_region_section_intersect_range: Adjust the memory section to cover
-+ * the intersection with the given range.
-+ *
-+ * @s: the #MemoryRegionSection to be adjusted
-+ * @offset: the offset of the given range in the memory region
-+ * @size: the size of the given range
-+ *
-+ * Returns false if the intersection is empty, otherwise returns true.
-+ */
-+static inline bool memory_region_section_intersect_range(MemoryRegionSection *s,
-+                                                         uint64_t offset,
-+                                                         uint64_t size)
-+{
-+    uint64_t start = MAX(s->offset_within_region, offset);
-+    Int128 end = int128_min(int128_add(int128_make64(s->offset_within_region),
-+                                       s->size),
-+                            int128_add(int128_make64(offset),
-+                                       int128_make64(size)));
-+
-+    if (int128_le(end, int128_make64(start))) {
-+        return false;
-+    }
-+
-+    s->offset_within_address_space += start - s->offset_within_region;
-+    s->offset_within_region = start;
-+    s->size = int128_sub(end, int128_make64(start));
-+    return true;
-+}
-+
- /**
-  * memory_region_init: Initialize a memory region
-  *
--- 
-2.50.1
-
diff --git a/kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch b/kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch
deleted file mode 100644
index bf89604..0000000
--- a/kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch
+++ /dev/null
@@ -1,277 +0,0 @@
-From a0a6a0d1131461f2695f28a673f410bbb33262ef Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:11:28 +0200
-Subject: [PATCH 113/115] memory: Unify the definiton of ReplayRamPopulate()
- and ReplayRamDiscard()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [113/115] 8ad320473d66f2956d701a4625f815d2fcd8ae4b (bonzini/rhel-qemu-kvm)
-
-Update ReplayRamDiscard() function to return the result and unify the
-ReplayRamPopulate() and ReplayRamDiscard() to ReplayRamDiscardState() at
-the same time due to their identical definitions. This unification
-simplifies related structures, such as VirtIOMEMReplayData, which makes
-it cleaner.
-
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Link: https://lore.kernel.org/r/20250612082747.51539-4-chenyi.qiang@intel.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 2205b8466733f8c6e3306c964f31c5a7cac69dfa)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/virtio/virtio-mem.c | 21 ++++++------
- include/exec/memory.h  | 74 ++++++++++++++++++++++++++++++++----------
- migration/ram.c        |  5 +--
- system/memory.c        | 12 +++----
- 4 files changed, 76 insertions(+), 36 deletions(-)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 6284539243..32af43852a 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -1736,7 +1736,7 @@ static bool virtio_mem_rdm_is_populated(const RamDiscardManager *rdm,
- }
- 
- struct VirtIOMEMReplayData {
--    void *fn;
-+    ReplayRamDiscardState fn;
-     void *opaque;
- };
- 
-@@ -1744,12 +1744,12 @@ static int virtio_mem_rdm_replay_populated_cb(MemoryRegionSection *s, void *arg)
- {
-     struct VirtIOMEMReplayData *data = arg;
- 
--    return ((ReplayRamPopulate)data->fn)(s, data->opaque);
-+    return data->fn(s, data->opaque);
- }
- 
- static int virtio_mem_rdm_replay_populated(const RamDiscardManager *rdm,
-                                            MemoryRegionSection *s,
--                                           ReplayRamPopulate replay_fn,
-+                                           ReplayRamDiscardState replay_fn,
-                                            void *opaque)
- {
-     const VirtIOMEM *vmem = VIRTIO_MEM(rdm);
-@@ -1768,14 +1768,13 @@ static int virtio_mem_rdm_replay_discarded_cb(MemoryRegionSection *s,
- {
-     struct VirtIOMEMReplayData *data = arg;
- 
--    ((ReplayRamDiscard)data->fn)(s, data->opaque);
--    return 0;
-+    return data->fn(s, data->opaque);
- }
- 
--static void virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
--                                            MemoryRegionSection *s,
--                                            ReplayRamDiscard replay_fn,
--                                            void *opaque)
-+static int virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
-+                                           MemoryRegionSection *s,
-+                                           ReplayRamDiscardState replay_fn,
-+                                           void *opaque)
- {
-     const VirtIOMEM *vmem = VIRTIO_MEM(rdm);
-     struct VirtIOMEMReplayData data = {
-@@ -1784,8 +1783,8 @@ static void virtio_mem_rdm_replay_discarded(const RamDiscardManager *rdm,
-     };
- 
-     g_assert(s->mr == &vmem->memdev->mr);
--    virtio_mem_for_each_unplugged_section(vmem, s, &data,
--                                          virtio_mem_rdm_replay_discarded_cb);
-+    return virtio_mem_for_each_unplugged_section(vmem, s, &data,
-+                                                 virtio_mem_rdm_replay_discarded_cb);
- }
- 
- static void virtio_mem_rdm_register_listener(RamDiscardManager *rdm,
-diff --git a/include/exec/memory.h b/include/exec/memory.h
-index 7cfbe203f4..563353eab6 100644
---- a/include/exec/memory.h
-+++ b/include/exec/memory.h
-@@ -566,8 +566,20 @@ static inline void ram_discard_listener_init(RamDiscardListener *rdl,
-     rdl->double_discard_supported = double_discard_supported;
- }
- 
--typedef int (*ReplayRamPopulate)(MemoryRegionSection *section, void *opaque);
--typedef void (*ReplayRamDiscard)(MemoryRegionSection *section, void *opaque);
-+/**
-+ * typedef ReplayRamDiscardState:
-+ *
-+ * The callback handler for #RamDiscardManagerClass.replay_populated/
-+ * #RamDiscardManagerClass.replay_discarded to invoke on populated/discarded
-+ * parts.
-+ *
-+ * @section: the #MemoryRegionSection of populated/discarded part
-+ * @opaque: pointer to forward to the callback
-+ *
-+ * Returns 0 on success, or a negative error if failed.
-+ */
-+typedef int (*ReplayRamDiscardState)(MemoryRegionSection *section,
-+                                     void *opaque);
- 
- /*
-  * RamDiscardManagerClass:
-@@ -641,36 +653,38 @@ struct RamDiscardManagerClass {
-     /**
-      * @replay_populated:
-      *
--     * Call the #ReplayRamPopulate callback for all populated parts within the
--     * #MemoryRegionSection via the #RamDiscardManager.
-+     * Call the #ReplayRamDiscardState callback for all populated parts within
-+     * the #MemoryRegionSection via the #RamDiscardManager.
-      *
-      * In case any call fails, no further calls are made.
-      *
-      * @rdm: the #RamDiscardManager
-      * @section: the #MemoryRegionSection
--     * @replay_fn: the #ReplayRamPopulate callback
-+     * @replay_fn: the #ReplayRamDiscardState callback
-      * @opaque: pointer to forward to the callback
-      *
-      * Returns 0 on success, or a negative error if any notification failed.
-      */
-     int (*replay_populated)(const RamDiscardManager *rdm,
-                             MemoryRegionSection *section,
--                            ReplayRamPopulate replay_fn, void *opaque);
-+                            ReplayRamDiscardState replay_fn, void *opaque);
- 
-     /**
-      * @replay_discarded:
-      *
--     * Call the #ReplayRamDiscard callback for all discarded parts within the
--     * #MemoryRegionSection via the #RamDiscardManager.
-+     * Call the #ReplayRamDiscardState callback for all discarded parts within
-+     * the #MemoryRegionSection via the #RamDiscardManager.
-      *
-      * @rdm: the #RamDiscardManager
-      * @section: the #MemoryRegionSection
--     * @replay_fn: the #ReplayRamDiscard callback
-+     * @replay_fn: the #ReplayRamDiscardState callback
-      * @opaque: pointer to forward to the callback
-+     *
-+     * Returns 0 on success, or a negative error if any notification failed.
-      */
--    void (*replay_discarded)(const RamDiscardManager *rdm,
--                             MemoryRegionSection *section,
--                             ReplayRamDiscard replay_fn, void *opaque);
-+    int (*replay_discarded)(const RamDiscardManager *rdm,
-+                            MemoryRegionSection *section,
-+                            ReplayRamDiscardState replay_fn, void *opaque);
- 
-     /**
-      * @register_listener:
-@@ -711,15 +725,41 @@ uint64_t ram_discard_manager_get_min_granularity(const RamDiscardManager *rdm,
- bool ram_discard_manager_is_populated(const RamDiscardManager *rdm,
-                                       const MemoryRegionSection *section);
- 
-+/**
-+ * ram_discard_manager_replay_populated:
-+ *
-+ * A wrapper to call the #RamDiscardManagerClass.replay_populated callback
-+ * of the #RamDiscardManager.
-+ *
-+ * @rdm: the #RamDiscardManager
-+ * @section: the #MemoryRegionSection
-+ * @replay_fn: the #ReplayRamDiscardState callback
-+ * @opaque: pointer to forward to the callback
-+ *
-+ * Returns 0 on success, or a negative error if any notification failed.
-+ */
- int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
-                                          MemoryRegionSection *section,
--                                         ReplayRamPopulate replay_fn,
-+                                         ReplayRamDiscardState replay_fn,
-                                          void *opaque);
- 
--void ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
--                                          MemoryRegionSection *section,
--                                          ReplayRamDiscard replay_fn,
--                                          void *opaque);
-+/**
-+ * ram_discard_manager_replay_discarded:
-+ *
-+ * A wrapper to call the #RamDiscardManagerClass.replay_discarded callback
-+ * of the #RamDiscardManager.
-+ *
-+ * @rdm: the #RamDiscardManager
-+ * @section: the #MemoryRegionSection
-+ * @replay_fn: the #ReplayRamDiscardState callback
-+ * @opaque: pointer to forward to the callback
-+ *
-+ * Returns 0 on success, or a negative error if any notification failed.
-+ */
-+int ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
-+                                         MemoryRegionSection *section,
-+                                         ReplayRamDiscardState replay_fn,
-+                                         void *opaque);
- 
- void ram_discard_manager_register_listener(RamDiscardManager *rdm,
-                                            RamDiscardListener *rdl,
-diff --git a/migration/ram.c b/migration/ram.c
-index 0803f85b8a..aaeea04546 100644
---- a/migration/ram.c
-+++ b/migration/ram.c
-@@ -874,8 +874,8 @@ static inline bool migration_bitmap_clear_dirty(RAMState *rs,
-     return ret;
- }
- 
--static void dirty_bitmap_clear_section(MemoryRegionSection *section,
--                                       void *opaque)
-+static int dirty_bitmap_clear_section(MemoryRegionSection *section,
-+                                      void *opaque)
- {
-     const hwaddr offset = section->offset_within_region;
-     const hwaddr size = int128_get64(section->size);
-@@ -894,6 +894,7 @@ static void dirty_bitmap_clear_section(MemoryRegionSection *section,
-     }
-     *cleared_bits += bitmap_count_one_with_offset(rb->bmap, start, npages);
-     bitmap_clear(rb->bmap, start, npages);
-+    return 0;
- }
- 
- /*
-diff --git a/system/memory.c b/system/memory.c
-index 35011f731e..8c36ab17b6 100644
---- a/system/memory.c
-+++ b/system/memory.c
-@@ -2115,7 +2115,7 @@ bool ram_discard_manager_is_populated(const RamDiscardManager *rdm,
- 
- int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
-                                          MemoryRegionSection *section,
--                                         ReplayRamPopulate replay_fn,
-+                                         ReplayRamDiscardState replay_fn,
-                                          void *opaque)
- {
-     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_GET_CLASS(rdm);
-@@ -2124,15 +2124,15 @@ int ram_discard_manager_replay_populated(const RamDiscardManager *rdm,
-     return rdmc->replay_populated(rdm, section, replay_fn, opaque);
- }
- 
--void ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
--                                          MemoryRegionSection *section,
--                                          ReplayRamDiscard replay_fn,
--                                          void *opaque)
-+int ram_discard_manager_replay_discarded(const RamDiscardManager *rdm,
-+                                         MemoryRegionSection *section,
-+                                         ReplayRamDiscardState replay_fn,
-+                                         void *opaque)
- {
-     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_GET_CLASS(rdm);
- 
-     g_assert(rdmc->replay_discarded);
--    rdmc->replay_discarded(rdm, section, replay_fn, opaque);
-+    return rdmc->replay_discarded(rdm, section, replay_fn, opaque);
- }
- 
- void ram_discard_manager_register_listener(RamDiscardManager *rdm,
--- 
-2.50.1
-
diff --git a/kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch b/kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch
deleted file mode 100644
index 93c87f9..0000000
--- a/kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 0277328b5a2d1df5d9843423ab5f5fa9481bad79 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Fri, 25 Apr 2025 13:17:12 +0100
-Subject: [PATCH 1/5] meson/configure: add 'valgrind' option & --{en,
- dis}able-valgrind flag
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 359: distro: add an explicit valgrind-devel build dep
-RH-Jira: RHEL-88153
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/2] ba9bc44ef9cef6fa76e2092500608575f223f1f7 (berrange/centos-src-qemu)
-
-Currently valgrind debugging support for coroutine stacks is enabled
-unconditionally when valgrind/valgrind.h is found. There is no way
-to disable valgrind support if valgrind.h is present in the build env.
-
-This is bad for distros, as an dependency far down the chain may cause
-valgrind.h to become installed, inadvertently enabling QEMU's valgrind
-debugging support. It also means if a distro wants valgrind support
-there is no way to mandate this.
-
-The solution is to add a 'valgrind' build feature to meson and thus
-configure script.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20250425121713.1913424-1-berrange@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 6b1c744ec0d66d6d568f9a156282153fc11a21cf)
-
-Conflicts:
-    meson.build - context from upstream is not present in older tree
----
- meson.build                   | 13 ++++++++++++-
- meson_options.txt             |  2 ++
- scripts/meson-buildoptions.sh |  3 +++
- 3 files changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index 1dd97c6f49..5bb2b757c3 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2463,7 +2463,17 @@ config_host_data.set('CONFIG_FSTRIM', qga_fstrim)
- # has_header
- config_host_data.set('CONFIG_EPOLL', cc.has_header('sys/epoll.h'))
- config_host_data.set('CONFIG_LINUX_MAGIC_H', cc.has_header('linux/magic.h'))
--config_host_data.set('CONFIG_VALGRIND_H', cc.has_header('valgrind/valgrind.h'))
-+valgrind = false
-+if get_option('valgrind').allowed()
-+    if cc.has_header('valgrind/valgrind.h')
-+        valgrind = true
-+    else
-+        if get_option('valgrind').enabled()
-+            error('valgrind requested but valgrind.h not found')
-+        endif
-+    endif
-+endif
-+config_host_data.set('CONFIG_VALGRIND_H', valgrind)
- config_host_data.set('HAVE_BTRFS_H', cc.has_header('linux/btrfs.h'))
- config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
- config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
-@@ -4549,6 +4559,7 @@ summary_info += {'libdw':             libdw}
- if host_os == 'freebsd'
-   summary_info += {'libinotify-kqueue': inotify}
- endif
-+summary_info += {'valgrind':          valgrind}
- summary(summary_info, bool_yn: true, section: 'Dependencies')
- 
- if host_arch == 'unknown'
-diff --git a/meson_options.txt b/meson_options.txt
-index aa2ba0baef..da06441fdf 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -113,6 +113,8 @@ option('dbus_display', type: 'feature', value: 'auto',
-        description: '-display dbus support')
- option('tpm', type : 'feature', value : 'auto',
-        description: 'TPM support')
-+option('valgrind', type : 'feature', value: 'auto',
-+       description: 'valgrind debug support for coroutine stacks')
- 
- # Do not enable it by default even for Mingw32, because it doesn't
- # work on Wine.
-diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
-index 5f0cbfc725..251470ea6d 100644
---- a/scripts/meson-buildoptions.sh
-+++ b/scripts/meson-buildoptions.sh
-@@ -191,6 +191,7 @@ meson_options_help() {
-   printf "%s\n" '  u2f             U2F emulation support'
-   printf "%s\n" '  uadk            UADK Library support'
-   printf "%s\n" '  usb-redir       libusbredir support'
-+  printf "%s\n" '  valgrind        valgrind debug support for coroutine stacks'
-   printf "%s\n" '  vde             vde network backend support'
-   printf "%s\n" '  vdi             vdi image format support'
-   printf "%s\n" '  vduse-blk-export'
-@@ -509,6 +510,8 @@ _meson_option_parse() {
-     --disable-uadk) printf "%s" -Duadk=disabled ;;
-     --enable-usb-redir) printf "%s" -Dusb_redir=enabled ;;
-     --disable-usb-redir) printf "%s" -Dusb_redir=disabled ;;
-+    --enable-valgrind) printf "%s" -Dvalgrind=enabled ;;
-+    --disable-valgrind) printf "%s" -Dvalgrind=disabled ;;
-     --enable-vde) printf "%s" -Dvde=enabled ;;
-     --disable-vde) printf "%s" -Dvde=disabled ;;
-     --enable-vdi) printf "%s" -Dvdi=enabled ;;
--- 
-2.48.1
-
diff --git a/kvm-migration-Add-helper-to-get-target-runstate.patch b/kvm-migration-Add-helper-to-get-target-runstate.patch
deleted file mode 100644
index 7c58ada..0000000
--- a/kvm-migration-Add-helper-to-get-target-runstate.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 21e971c2d7a8aee5cb95b7714c15374331add796 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:33 -0500
-Subject: [PATCH 02/23] migration: Add helper to get target runstate
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/22] d1b2ee0d6a878e71ad04ace9fd82d8aab2d5217b (kmwolf/centos-qemu-kvm)
-
-In 99% cases, after QEMU migrates to dest host, it tries to detect the
-target VM runstate using global_state_get_runstate().
-
-There's one outlier so far which is Xen that won't send global state.
-That's the major reason why global_state_received() check was always there
-together with global_state_get_runstate().
-
-However it's utterly confusing why global_state_received() has anything to
-do with "let's start VM or not".
-
-Provide a helper to explain it, then we have an unified entry for getting
-the target dest QEMU runstate after migration.
-
-Suggested-by: Fabiano Rosas <farosas@suse.de>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Message-Id: <20241206230838.1111496-2-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit 7815f69867da92335055d4b5248430b0f122ce4e)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- migration/migration.c | 21 +++++++++++++++++----
- 1 file changed, 17 insertions(+), 4 deletions(-)
-
-diff --git a/migration/migration.c b/migration/migration.c
-index 3dea06d577..c7a9e2e026 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -135,6 +135,21 @@ static bool migration_needs_multiple_sockets(void)
-     return migrate_multifd() || migrate_postcopy_preempt();
- }
- 
-+static RunState migration_get_target_runstate(void)
-+{
-+    /*
-+     * When the global state is not migrated, it means we don't know the
-+     * runstate of the src QEMU.  We don't have much choice but assuming
-+     * the VM is running.  NOTE: this is pretty rare case, so far only Xen
-+     * uses it.
-+     */
-+    if (!global_state_received()) {
-+        return RUN_STATE_RUNNING;
-+    }
-+
-+    return global_state_get_runstate();
-+}
-+
- static bool transport_supports_multi_channels(MigrationAddress *addr)
- {
-     if (addr->transport == MIGRATION_ADDRESS_TYPE_SOCKET) {
-@@ -727,8 +742,7 @@ static void process_incoming_migration_bh(void *opaque)
-      * unless we really are starting the VM.
-      */
-     if (!migrate_late_block_activate() ||
--         (autostart && (!global_state_received() ||
--            runstate_is_live(global_state_get_runstate())))) {
-+        (autostart && runstate_is_live(migration_get_target_runstate()))) {
-         /* Make sure all file formats throw away their mutable metadata.
-          * If we get an error here, just don't restart the VM yet. */
-         bdrv_activate_all(&local_err);
-@@ -751,8 +765,7 @@ static void process_incoming_migration_bh(void *opaque)
- 
-     dirty_bitmap_mig_before_vm_start();
- 
--    if (!global_state_received() ||
--        runstate_is_live(global_state_get_runstate())) {
-+    if (runstate_is_live(migration_get_target_runstate())) {
-         if (autostart) {
-             vm_start();
-         } else {
--- 
-2.48.1
-
diff --git a/kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch b/kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch
deleted file mode 100644
index 45c09e0..0000000
--- a/kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 090cdb81ce6913f1c5989853d0af0dbb2f1d3f9f Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Wed, 20 Nov 2024 11:01:32 -0500
-Subject: [PATCH] migration: Allow pipes to keep working for fd migrations
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 301: migration: Allow pipes to keep working for fd migrations
-RH-Jira: RHEL-66089
-RH-Acked-by: Juraj Marcin <None>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 8b62be63720f81e9d1633844917ab6992d99566f (peterx/qemu-kvm)
-
-Libvirt may still use pipes for old file migrations in fd: URI form,
-especially when loading old images dumped from Libvirt's compression
-algorithms.
-
-In that case, Libvirt needs to compress / uncompress the images on its own
-over the migration binary stream, and pipes are passed over to QEMU for
-outgoing / incoming migrations in "fd:" URIs.
-
-For future such use case, it should be suggested to use mapped-ram when
-saving such VM image.  However there can still be old images that was
-compressed in such way, so libvirt needs to be able to load those images,
-uncompress them and use the same pipe mechanism to pass that over to QEMU.
-
-It means, even if new file migrations can be gradually moved over to
-mapped-ram (after Libvirt start supporting it), Libvirt still needs the
-uncompressor for the old images to be able to load like before.
-
-Meanwhile since Libvirt currently exposes the compression capability to
-guest images, it may needs its own lifecycle management to move that over
-to mapped-ram, maybe can be done after mapped-ram saved the image, however
-Dan and PeterK raised concern on temporary double disk space consumption.
-I suppose for now the easiest is to enable pipes for both sides of "fd:"
-migrations, until all things figured out from Libvirt side on how to move
-on.
-
-And for "channels" QMP interface support on "migrate" / "migrate-incoming"
-commands, we'll also need to move away from pipe.  But let's leave that for
-later too.
-
-So far, still allow pipes to happen like before on both save/load sides,
-just like we would allow sockets to pass.
-
-Cc: qemu-stable <qemu-stable@nongnu.org>
-Cc: Fabiano Rosas <farosas@suse.de>
-Cc: Peter Krempa <pkrempa@redhat.com>
-Cc: Daniel P. Berrangé <berrange@redhat.com>
-Fixes: c55deb860c ("migration: Deprecate fd: for file migration")
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Link: https://lore.kernel.org/r/20241120160132.3659735-1-peterx@redhat.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 87ae45e602e2943d58509e470e3a1d4ba084ab2f)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- migration/fd.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
-diff --git a/migration/fd.c b/migration/fd.c
-index aab5189eac..9bf9be6acb 100644
---- a/migration/fd.c
-+++ b/migration/fd.c
-@@ -25,6 +25,29 @@
- #include "io/channel-util.h"
- #include "trace.h"
- 
-+static bool fd_is_pipe(int fd)
-+{
-+    struct stat statbuf;
-+
-+    if (fstat(fd, &statbuf) == -1) {
-+        return false;
-+    }
-+
-+    return S_ISFIFO(statbuf.st_mode);
-+}
-+
-+static bool migration_fd_valid(int fd)
-+{
-+    if (fd_is_socket(fd)) {
-+        return true;
-+    }
-+
-+    if (fd_is_pipe(fd)) {
-+        return true;
-+    }
-+
-+    return false;
-+}
- 
- void fd_start_outgoing_migration(MigrationState *s, const char *fdname, Error **errp)
- {
-@@ -34,7 +57,7 @@ void fd_start_outgoing_migration(MigrationState *s, const char *fdname, Error **
-         return;
-     }
- 
--    if (!fd_is_socket(fd)) {
-+    if (!migration_fd_valid(fd)) {
-         warn_report("fd: migration to a file is deprecated."
-                     " Use file: instead.");
-     }
-@@ -68,7 +91,7 @@ void fd_start_incoming_migration(const char *fdname, Error **errp)
-         return;
-     }
- 
--    if (!fd_is_socket(fd)) {
-+    if (!migration_fd_valid(fd)) {
-         warn_report("fd: migration to a file is deprecated."
-                     " Use file: instead.");
-     }
--- 
-2.39.3
-
diff --git a/kvm-migration-Ensure-vmstate_save-sets-errp.patch b/kvm-migration-Ensure-vmstate_save-sets-errp.patch
deleted file mode 100644
index 6493c3e..0000000
--- a/kvm-migration-Ensure-vmstate_save-sets-errp.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 91f67a47a3fd31be578988d7ac11bb814314ec5a Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Tue, 15 Oct 2024 19:04:37 +0200
-Subject: [PATCH] migration: Ensure vmstate_save() sets errp
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 295: migration: Ensure vmstate_save() sets errp
-RH-Jira: RHEL-67844
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/1] df65f254fa6bf241b1fd4f4d2101f137d2a6e44b (hreitz/qemu-kvm-c-9-s)
-
-migration/savevm.c contains some calls to vmstate_save() that are
-followed by migrate_set_error() if the integer return value indicates an
-error.  migrate_set_error() requires that the `Error *` object passed to
-it is set.  Therefore, vmstate_save() is assumed to always set *errp on
-error.
-
-Right now, that assumption is not met: vmstate_save_state_v() (called
-internally by vmstate_save()) will not set *errp if
-vmstate_subsection_save() or vmsd->post_save() fail.  Fix that by adding
-an *errp parameter to vmstate_subsection_save(), and by generating a
-generic error in case post_save() fails (as is already done for
-pre_save()).
-
-Without this patch, qemu will crash after vmstate_subsection_save() or
-post_save() have failed inside of a vmstate_save() call (unless
-migrate_set_error() then happen to discard the new error because
-s->error is already set).  This happens e.g. when receiving the state
-from a virtio-fs back-end (virtiofsd) fails.
-
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Link: https://lore.kernel.org/r/20241015170437.310358-1-hreitz@redhat.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 37dfcba1a04989830c706f9cbc00450e5d3a7447)
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
----
- migration/vmstate.c | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/migration/vmstate.c b/migration/vmstate.c
-index ef26f26ccd..d19b42630a 100644
---- a/migration/vmstate.c
-+++ b/migration/vmstate.c
-@@ -22,7 +22,8 @@
- #include "trace.h"
- 
- static int vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
--                                   void *opaque, JSONWriter *vmdesc);
-+                                   void *opaque, JSONWriter *vmdesc,
-+                                   Error **errp);
- static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
-                                    void *opaque);
- 
-@@ -440,12 +441,13 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
-         json_writer_end_array(vmdesc);
-     }
- 
--    ret = vmstate_subsection_save(f, vmsd, opaque, vmdesc);
-+    ret = vmstate_subsection_save(f, vmsd, opaque, vmdesc, errp);
- 
-     if (vmsd->post_save) {
-         int ps_ret = vmsd->post_save(opaque);
--        if (!ret) {
-+        if (!ret && ps_ret) {
-             ret = ps_ret;
-+            error_setg(errp, "post-save failed: %s", vmsd->name);
-         }
-     }
-     return ret;
-@@ -517,7 +519,8 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
- }
- 
- static int vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
--                                   void *opaque, JSONWriter *vmdesc)
-+                                   void *opaque, JSONWriter *vmdesc,
-+                                   Error **errp)
- {
-     const VMStateDescription * const *sub = vmsd->subsections;
-     bool vmdesc_has_subsections = false;
-@@ -545,7 +548,7 @@ static int vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
-             qemu_put_byte(f, len);
-             qemu_put_buffer(f, (uint8_t *)vmsdsub->name, len);
-             qemu_put_be32(f, vmsdsub->version_id);
--            ret = vmstate_save_state(f, vmsdsub, opaque, vmdesc);
-+            ret = vmstate_save_state_with_err(f, vmsdsub, opaque, vmdesc, errp);
-             if (ret) {
-                 return ret;
-             }
--- 
-2.45.1
-
diff --git a/kvm-migration-Fix-UAF-for-incoming-migration-on-Migratio.patch b/kvm-migration-Fix-UAF-for-incoming-migration-on-Migratio.patch
deleted file mode 100644
index d9d12bf..0000000
--- a/kvm-migration-Fix-UAF-for-incoming-migration-on-Migratio.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 5d7d7a2ec6301f4d0b0dbea4fbdcab4e41a9cf07 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Thu, 20 Feb 2025 08:24:59 -0500
-Subject: [PATCH 7/9] migration: Fix UAF for incoming migration on
- MigrationState
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 344: migration: Fix UAF for incoming migration on MigrationState
-RH-Jira: RHEL-69775
-RH-Acked-by: Juraj Marcin <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/1] 106e2b4c1c461202c912b5e3ea7e586c4ab05d8c (peterx/qemu-kvm)
-
-On the incoming migration side, QEMU uses a coroutine to load all the VM
-states.  Inside, it may reference MigrationState on global states like
-migration capabilities, parameters, error state, shared mutexes and more.
-
-However there's nothing yet to make sure MigrationState won't get
-destroyed (e.g. after migration_shutdown()).  Meanwhile there's also no API
-available to remove the incoming coroutine in migration_shutdown(),
-avoiding it to access the freed elements.
-
-There's a bug report showing this can happen and crash dest QEMU when
-migration is cancelled on source.
-
-When it happens, the dest main thread is trying to cleanup everything:
-
-  #0  qemu_aio_coroutine_enter
-  #1  aio_dispatch_handler
-  #2  aio_poll
-  #3  monitor_cleanup
-  #4  qemu_cleanup
-  #5  qemu_default_main
-
-Then it found the migration incoming coroutine, schedule it (even after
-migration_shutdown()), causing crash:
-
-  #0  __pthread_kill_implementation
-  #1  __pthread_kill_internal
-  #2  __GI_raise
-  #3  __GI_abort
-  #4  __assert_fail_base
-  #5  __assert_fail
-  #6  qemu_mutex_lock_impl
-  #7  qemu_lockable_mutex_lock
-  #8  qemu_lockable_lock
-  #9  qemu_lockable_auto_lock
-  #10 migrate_set_error
-  #11 process_incoming_migration_co
-  #12 coroutine_trampoline
-
-To fix it, take a refcount after an incoming setup is properly done when
-qmp_migrate_incoming() succeeded the 1st time.  As it's during a QMP
-handler which needs BQL, it means the main loop is still alive (without
-going into cleanups, which also needs BQL).
-
-Releasing the refcount now only until the incoming migration coroutine
-finished or failed.  Hence the refcount is valid for both (1) setup phase
-of incoming ports, mostly IO watches (e.g. qio_channel_add_watch_full()),
-and (2) the incoming coroutine itself (process_incoming_migration_co()).
-
-Note that we can't unref in migration_incoming_state_destroy(), because
-both qmp_xen_load_devices_state() and load_snapshot() will use it without
-an incoming migration.  Those hold BQL so they're not prone to this issue.
-
-PS: I suspect nobody uses Xen's command at all, as it didn't register yank,
-hence AFAIU the command should crash on master when trying to unregister
-yank in migration_incoming_state_destroy()..  but that's another story.
-
-Also note that in some incoming failure cases we may not always unref the
-MigrationState refcount, which is a trade-off to keep things simple.  We
-could make it accurate, but it can be an overkill.  Some examples:
-
-  - Unlike most of the rest protocols, socket_start_incoming_migration()
-    may create net listener after incoming port setup sucessfully.
-    It means we can't unref in migration_channel_process_incoming() as a
-    generic path because socket protocol might keep using MigrationState.
-
-  - For either socket or file, multiple IO watches might be created, it
-    means logically each IO watch needs to take one refcount for
-    MigrationState so as to be 100% accurate on ownership of refcount taken.
-
-In general, we at least need per-protocol handling to make it accurate,
-which can be an overkill if we know incoming failed after all.  Add a short
-comment to explain that when taking the refcount in qmp_migrate_incoming().
-
-Bugzilla: https://issues.redhat.com/browse/RHEL-69775
-Tested-by: Yan Fu <yafu@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-ID: <20250220132459.512610-1-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit d657a14de5d597bbfe7b54e4c4f0646f440e98ad)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- migration/migration.c | 40 ++++++++++++++++++++++++++++++++++++++--
- 1 file changed, 38 insertions(+), 2 deletions(-)
-
-diff --git a/migration/migration.c b/migration/migration.c
-index 999d4cac54..aabdc45c16 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -115,6 +115,27 @@ static void migration_downtime_start(MigrationState *s)
-     s->downtime_start = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
- }
- 
-+/*
-+ * This is unfortunate: incoming migration actually needs the outgoing
-+ * migration state (MigrationState) to be there too, e.g. to query
-+ * capabilities, parameters, using locks, setup errors, etc.
-+ *
-+ * NOTE: when calling this, making sure current_migration exists and not
-+ * been freed yet!  Otherwise trying to access the refcount is already
-+ * an use-after-free itself..
-+ *
-+ * TODO: Move shared part of incoming / outgoing out into separate object.
-+ * Then this is not needed.
-+ */
-+static void migrate_incoming_ref_outgoing_state(void)
-+{
-+    object_ref(migrate_get_current());
-+}
-+static void migrate_incoming_unref_outgoing_state(void)
-+{
-+    object_unref(migrate_get_current());
-+}
-+
- static void migration_downtime_end(MigrationState *s)
- {
-     int64_t now = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
-@@ -821,7 +842,7 @@ process_incoming_migration_co(void *opaque)
-              * postcopy thread.
-              */
-             trace_process_incoming_migration_co_postcopy_end_main();
--            return;
-+            goto out;
-         }
-         /* Else if something went wrong then just fall out of the normal exit */
-     }
-@@ -837,7 +858,8 @@ process_incoming_migration_co(void *opaque)
-     }
- 
-     migration_bh_schedule(process_incoming_migration_bh, mis);
--    return;
-+    goto out;
-+
- fail:
-     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
-                       MIGRATION_STATUS_FAILED);
-@@ -854,6 +876,9 @@ fail:
- 
-         exit(EXIT_FAILURE);
-     }
-+out:
-+    /* Pairs with the refcount taken in qmp_migrate_incoming() */
-+    migrate_incoming_unref_outgoing_state();
- }
- 
- /**
-@@ -1875,6 +1900,17 @@ void qmp_migrate_incoming(const char *uri, bool has_channels,
-         return;
-     }
- 
-+    /*
-+     * Making sure MigrationState is available until incoming migration
-+     * completes.
-+     *
-+     * NOTE: QEMU _might_ leak this refcount in some failure paths, but
-+     * that's OK.  This is the minimum change we need to at least making
-+     * sure success case is clean on the refcount.  We can try harder to
-+     * make it accurate for any kind of failures, but it might be an
-+     * overkill and doesn't bring us much benefit.
-+     */
-+    migrate_incoming_ref_outgoing_state();
-     once = false;
- }
- 
--- 
-2.48.1
-
diff --git a/kvm-migration-block-Apply-late-block-active-behavior-to-.patch b/kvm-migration-block-Apply-late-block-active-behavior-to-.patch
deleted file mode 100644
index f052aa3..0000000
--- a/kvm-migration-block-Apply-late-block-active-behavior-to-.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 149fdbbe765e0153a533d5bed653e7de16f8ad9b Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:36 -0500
-Subject: [PATCH 05/23] migration/block: Apply late-block-active behavior to
- postcopy
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [4/22] 1ba47fc6bb9e3b244f75b2f29a89b9fd4014deea (kmwolf/centos-qemu-kvm)
-
-Postcopy never cared about late-block-active.  However there's no mention
-in the capability that it doesn't apply to postcopy.
-
-Considering that we _assumed_ late activation is always good, do that too
-for postcopy unconditionally, just like precopy.  After this patch, we
-should have unified the behavior across all.
-
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-Id: <20241206230838.1111496-5-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit 61f2b489987c51159c53101a072c6aa901b50506)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- migration/savevm.c | 25 ++++++++++++-------------
- 1 file changed, 12 insertions(+), 13 deletions(-)
-
-diff --git a/migration/savevm.c b/migration/savevm.c
-index 6bb404b9c8..a0c4befdc1 100644
---- a/migration/savevm.c
-+++ b/migration/savevm.c
-@@ -2156,22 +2156,21 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
- 
-     trace_vmstate_downtime_checkpoint("dst-postcopy-bh-announced");
- 
--    /* Make sure all file formats throw away their mutable metadata.
--     * If we get an error here, just don't restart the VM yet. */
--    bdrv_activate_all(&local_err);
--    if (local_err) {
--        error_report_err(local_err);
--        local_err = NULL;
--        autostart = false;
--    }
--
--    trace_vmstate_downtime_checkpoint("dst-postcopy-bh-cache-invalidated");
--
-     dirty_bitmap_mig_before_vm_start();
- 
-     if (autostart) {
--        /* Hold onto your hats, starting the CPU */
--        vm_start();
-+        /*
-+         * Make sure all file formats throw away their mutable metadata.
-+         * If we get an error here, just don't restart the VM yet.
-+         */
-+        bdrv_activate_all(&local_err);
-+        trace_vmstate_downtime_checkpoint("dst-postcopy-bh-cache-invalidated");
-+        if (local_err) {
-+            error_report_err(local_err);
-+            local_err = NULL;
-+        } else {
-+            vm_start();
-+        }
-     } else {
-         /* leave it paused and let management decide when to start the CPU */
-         runstate_set(RUN_STATE_PAUSED);
--- 
-2.48.1
-
diff --git a/kvm-migration-block-Fix-possible-race-with-block_inactiv.patch b/kvm-migration-block-Fix-possible-race-with-block_inactiv.patch
deleted file mode 100644
index f0a36d4..0000000
--- a/kvm-migration-block-Fix-possible-race-with-block_inactiv.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 703a2b932f8b6e06f4a1c0cdfdf7f4cf030a6e38 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:37 -0500
-Subject: [PATCH 06/23] migration/block: Fix possible race with block_inactive
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [5/22] 6300de6a4a19d4648e5a5503ef8cec557fe8e666 (kmwolf/centos-qemu-kvm)
-
-Src QEMU sets block_inactive=true very early before the invalidation takes
-place.  It means if something wrong happened during setting the flag but
-before reaching qemu_savevm_state_complete_precopy_non_iterable() where it
-did the invalidation work, it'll make block_inactive flag inconsistent.
-
-For example, think about when qemu_savevm_state_complete_precopy_iterable()
-can fail: it will have block_inactive set to true even if all block drives
-are active.
-
-Fix that by only update the flag after the invalidation is done.
-
-No Fixes for any commit, because it's not an issue if bdrv_activate_all()
-is re-entrant upon all-active disks - false positive block_inactive can
-bring nothing more than "trying to active the blocks but they're already
-active".  However let's still do it right to avoid the inconsistent flag
-v.s. reality.
-
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-Id: <20241206230838.1111496-6-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit 8c97c5a476d146b35b2873ef73df601216a494d9)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- migration/migration.c | 9 +++------
- migration/savevm.c    | 2 ++
- 2 files changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/migration/migration.c b/migration/migration.c
-index 8a262e01ff..784b7e9b90 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -2779,14 +2779,11 @@ static int migration_completion_precopy(MigrationState *s,
-         goto out_unlock;
-     }
- 
--    /*
--     * Inactivate disks except in COLO, and track that we have done so in order
--     * to remember to reactivate them if migration fails or is cancelled.
--     */
--    s->block_inactive = !migrate_colo();
-     migration_rate_set(RATE_LIMIT_DISABLED);
-+
-+    /* Inactivate disks except in COLO */
-     ret = qemu_savevm_state_complete_precopy(s->to_dst_file, false,
--                                             s->block_inactive);
-+                                             !migrate_colo());
- out_unlock:
-     bql_unlock();
-     return ret;
-diff --git a/migration/savevm.c b/migration/savevm.c
-index a0c4befdc1..b88dadd904 100644
---- a/migration/savevm.c
-+++ b/migration/savevm.c
-@@ -1577,6 +1577,8 @@ int qemu_savevm_state_complete_precopy_non_iterable(QEMUFile *f,
-             qemu_file_set_error(f, ret);
-             return ret;
-         }
-+        /* Remember that we did this */
-+        s->block_inactive = true;
-     }
-     if (!in_postcopy) {
-         /* Postcopy stream will still be going */
--- 
-2.48.1
-
diff --git a/kvm-migration-block-Make-late-block-active-the-default.patch b/kvm-migration-block-Make-late-block-active-the-default.patch
deleted file mode 100644
index 9313498..0000000
--- a/kvm-migration-block-Make-late-block-active-the-default.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 5a3017fbfb1081fc0a074ee53e1ad7ba8489c8c1 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:35 -0500
-Subject: [PATCH 04/23] migration/block: Make late-block-active the default
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [3/22] 74d95ded9153bf0969ede7d7d2708e9452d7cd11 (kmwolf/centos-qemu-kvm)
-
-Migration capability 'late-block-active' controls when the block drives
-will be activated.  If enabled, block drives will only be activated until
-VM starts, either src runstate was "live" (RUNNING, or SUSPENDED), or it'll
-be postponed until qmp_cont().
-
-Let's do this unconditionally.  There's no harm to delay activation of
-block drives.  Meanwhile there's no ABI breakage if dest does it, because
-src QEMU has nothing to do with it, so it's no concern on ABI breakage.
-
-IIUC we could avoid introducing this cap when introducing it before, but
-now it's still not too late to just always do it.  Cap now prone to
-removal, but it'll be for later patches.
-
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-Id: <20241206230838.1111496-4-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit fca9aef1c8d8fc4482cc541638dbfac76dc125d6)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- migration/migration.c | 38 +++++++++++++++++++-------------------
- 1 file changed, 19 insertions(+), 19 deletions(-)
-
-diff --git a/migration/migration.c b/migration/migration.c
-index c7a9e2e026..8a262e01ff 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -735,24 +735,6 @@ static void process_incoming_migration_bh(void *opaque)
- 
-     trace_vmstate_downtime_checkpoint("dst-precopy-bh-enter");
- 
--    /* If capability late_block_activate is set:
--     * Only fire up the block code now if we're going to restart the
--     * VM, else 'cont' will do it.
--     * This causes file locking to happen; so we don't want it to happen
--     * unless we really are starting the VM.
--     */
--    if (!migrate_late_block_activate() ||
--        (autostart && runstate_is_live(migration_get_target_runstate()))) {
--        /* Make sure all file formats throw away their mutable metadata.
--         * If we get an error here, just don't restart the VM yet. */
--        bdrv_activate_all(&local_err);
--        if (local_err) {
--            error_report_err(local_err);
--            local_err = NULL;
--            autostart = false;
--        }
--    }
--
-     /*
-      * This must happen after all error conditions are dealt with and
-      * we're sure the VM is going to be running on this host.
-@@ -767,7 +749,25 @@ static void process_incoming_migration_bh(void *opaque)
- 
-     if (runstate_is_live(migration_get_target_runstate())) {
-         if (autostart) {
--            vm_start();
-+            /*
-+             * Block activation is always delayed until VM starts, either
-+             * here (which means we need to start the dest VM right now..),
-+             * or until qmp_cont() later.
-+             *
-+             * We used to have cap 'late-block-activate' but now we do this
-+             * unconditionally, as it has no harm but only benefit.  E.g.,
-+             * it's not part of migration ABI on the time of disk activation.
-+             *
-+             * Make sure all file formats throw away their mutable
-+             * metadata.  If error, don't restart the VM yet.
-+             */
-+            bdrv_activate_all(&local_err);
-+            if (local_err) {
-+                error_report_err(local_err);
-+                local_err = NULL;
-+            } else {
-+                vm_start();
-+            }
-         } else {
-             runstate_set(RUN_STATE_PAUSED);
-         }
--- 
-2.48.1
-
diff --git a/kvm-migration-block-Rewrite-disk-activation.patch b/kvm-migration-block-Rewrite-disk-activation.patch
deleted file mode 100644
index dc8cb1d..0000000
--- a/kvm-migration-block-Rewrite-disk-activation.patch
+++ /dev/null
@@ -1,565 +0,0 @@
-From f478efadbb1629028af0e65e8408fe49256b2f17 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:38 -0500
-Subject: [PATCH 07/23] migration/block: Rewrite disk activation
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [6/22] cd000f0b00e6f768288f340e1801dd5a236d430c (kmwolf/centos-qemu-kvm)
-
-This patch proposes a flag to maintain disk activation status globally.  It
-mostly rewrites disk activation mgmt for QEMU, including COLO and QMP
-command xen_save_devices_state.
-
-Backgrounds
-===========
-
-We have two problems on disk activations, one resolved, one not.
-
-Problem 1: disk activation recover (for switchover interruptions)
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When migration is either cancelled or failed during switchover, especially
-when after the disks are inactivated, QEMU needs to remember re-activate
-the disks again before vm starts.
-
-It used to be done separately in two paths: one in qmp_migrate_cancel(),
-the other one in the failure path of migration_completion().
-
-It used to be fixed in different commits, all over the places in QEMU.  So
-these are the relevant changes I saw, I'm not sure if it's complete list:
-
- - In 2016, commit fe904ea824 ("migration: regain control of images when
-   migration fails to complete")
-
- - In 2017, commit 1d2acc3162 ("migration: re-active images while migration
-   been canceled after inactive them")
-
- - In 2023, commit 6dab4c93ec ("migration: Attempt disk reactivation in
-   more failure scenarios")
-
-Now since we have a slightly better picture maybe we can unify the
-reactivation in a single path.
-
-One side benefit of doing so is, we can move the disk operation outside QMP
-command "migrate_cancel".  It's possible that in the future we may want to
-make "migrate_cancel" be OOB-compatible, while that requires the command
-doesn't need BQL in the first place.  This will already do that and make
-migrate_cancel command lightweight.
-
-Problem 2: disk invalidation on top of invalidated disks
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This is an unresolved bug for current QEMU.  Link in "Resolves:" at the
-end.  It turns out besides the src switchover phase (problem 1 above), QEMU
-also needs to remember block activation on destination.
-
-Consider two continuous migration in a row, where the VM was always paused.
-In that scenario, the disks are not activated even until migration
-completed in the 1st round.  When the 2nd round starts, if QEMU doesn't
-know the status of the disks, it needs to try inactivate the disk again.
-
-Here the issue is the block layer API bdrv_inactivate_all() will crash a
-QEMU if invoked on already inactive disks for the 2nd migration.  For
-detail, see the bug link at the end.
-
-Implementation
-==============
-
-This patch proposes to maintain disk activation with a global flag, so we
-know:
-
-  - If we used to inactivate disks for migration, but migration got
-  cancelled, or failed, QEMU will know it should reactivate the disks.
-
-  - On incoming side, if the disks are never activated but then another
-  migration is triggered, QEMU should be able to tell that inactivate is
-  not needed for the 2nd migration.
-
-We used to have disk_inactive, but it only solves the 1st issue, not the
-2nd.  Also, it's done in completely separate paths so it's extremely hard
-to follow either how the flag changes, or the duration that the flag is
-valid, and when we will reactivate the disks.
-
-Convert the existing disk_inactive flag into that global flag (also invert
-its naming), and maintain the disk activation status for the whole
-lifecycle of qemu.  That includes the incoming QEMU.
-
-Put both of the error cases of source migration (failure, cancelled)
-together into migration_iteration_finish(), which will be invoked for
-either of the scenario.  So from that part QEMU should behave the same as
-before.  However with such global maintenance on disk activation status, we
-not only cleanup quite a few temporary paths that we try to maintain the
-disk activation status (e.g. in postcopy code), meanwhile it fixes the
-crash for problem 2 in one shot.
-
-For freshly started QEMU, the flag is initialized to TRUE showing that the
-QEMU owns the disks by default.
-
-For incoming migrated QEMU, the flag will be initialized to FALSE once and
-for all showing that the dest QEMU doesn't own the disks until switchover.
-That is guaranteed by the "once" variable.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2395
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-Id: <20241206230838.1111496-7-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit 8597af76153a87068b675d8099063c3ad8695773)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- include/migration/misc.h |  4 ++
- migration/block-active.c | 94 ++++++++++++++++++++++++++++++++++++++++
- migration/colo.c         |  2 +-
- migration/meson.build    |  1 +
- migration/migration.c    | 80 ++++++++--------------------------
- migration/migration.h    |  5 +--
- migration/savevm.c       | 33 ++++++--------
- migration/trace-events   |  3 ++
- monitor/qmp-cmds.c       |  8 +---
- 9 files changed, 139 insertions(+), 91 deletions(-)
- create mode 100644 migration/block-active.c
-
-diff --git a/include/migration/misc.h b/include/migration/misc.h
-index bfadc5613b..35ca8e1194 100644
---- a/include/migration/misc.h
-+++ b/include/migration/misc.h
-@@ -111,4 +111,8 @@ bool migration_in_bg_snapshot(void);
- /* migration/block-dirty-bitmap.c */
- void dirty_bitmap_mig_init(void);
- 
-+/* Wrapper for block active/inactive operations */
-+bool migration_block_activate(Error **errp);
-+bool migration_block_inactivate(void);
-+
- #endif
-diff --git a/migration/block-active.c b/migration/block-active.c
-new file mode 100644
-index 0000000000..d477cf8182
---- /dev/null
-+++ b/migration/block-active.c
-@@ -0,0 +1,94 @@
-+/*
-+ * Block activation tracking for migration purpose
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ *
-+ * Copyright (C) 2024 Red Hat, Inc.
-+ */
-+#include "qemu/osdep.h"
-+#include "block/block.h"
-+#include "qapi/error.h"
-+#include "migration/migration.h"
-+#include "qemu/error-report.h"
-+#include "trace.h"
-+
-+/*
-+ * Migration-only cache to remember the block layer activation status.
-+ * Protected by BQL.
-+ *
-+ * We need this because..
-+ *
-+ * - Migration can fail after block devices are invalidated (during
-+ *   switchover phase).  When that happens, we need to be able to recover
-+ *   the block drive status by re-activating them.
-+ *
-+ * - Currently bdrv_inactivate_all() is not safe to be invoked on top of
-+ *   invalidated drives (even if bdrv_activate_all() is actually safe to be
-+ *   called any time!).  It means remembering this could help migration to
-+ *   make sure it won't invalidate twice in a row, crashing QEMU.  It can
-+ *   happen when we migrate a PAUSED VM from host1 to host2, then migrate
-+ *   again to host3 without starting it.  TODO: a cleaner solution is to
-+ *   allow safe invoke of bdrv_inactivate_all() at anytime, like
-+ *   bdrv_activate_all().
-+ *
-+ * For freshly started QEMU, the flag is initialized to TRUE reflecting the
-+ * scenario where QEMU owns block device ownerships.
-+ *
-+ * For incoming QEMU taking a migration stream, the flag is initialized to
-+ * FALSE reflecting that the incoming side doesn't own the block devices,
-+ * not until switchover happens.
-+ */
-+static bool migration_block_active;
-+
-+/* Setup the disk activation status */
-+void migration_block_active_setup(bool active)
-+{
-+    migration_block_active = active;
-+}
-+
-+bool migration_block_activate(Error **errp)
-+{
-+    ERRP_GUARD();
-+
-+    assert(bql_locked());
-+
-+    if (migration_block_active) {
-+        trace_migration_block_activation("active-skipped");
-+        return true;
-+    }
-+
-+    trace_migration_block_activation("active");
-+
-+    bdrv_activate_all(errp);
-+    if (*errp) {
-+        error_report_err(error_copy(*errp));
-+        return false;
-+    }
-+
-+    migration_block_active = true;
-+    return true;
-+}
-+
-+bool migration_block_inactivate(void)
-+{
-+    int ret;
-+
-+    assert(bql_locked());
-+
-+    if (!migration_block_active) {
-+        trace_migration_block_activation("inactive-skipped");
-+        return true;
-+    }
-+
-+    trace_migration_block_activation("inactive");
-+
-+    ret = bdrv_inactivate_all();
-+    if (ret) {
-+        error_report("%s: bdrv_inactivate_all() failed: %d",
-+                     __func__, ret);
-+        return false;
-+    }
-+
-+    migration_block_active = false;
-+    return true;
-+}
-diff --git a/migration/colo.c b/migration/colo.c
-index 6449490221..ab903f34cb 100644
---- a/migration/colo.c
-+++ b/migration/colo.c
-@@ -836,7 +836,7 @@ static void *colo_process_incoming_thread(void *opaque)
- 
-     /* Make sure all file formats throw away their mutable metadata */
-     bql_lock();
--    bdrv_activate_all(&local_err);
-+    migration_block_activate(&local_err);
-     bql_unlock();
-     if (local_err) {
-         error_report_err(local_err);
-diff --git a/migration/meson.build b/migration/meson.build
-index 5ce2acb41e..6b79861d3c 100644
---- a/migration/meson.build
-+++ b/migration/meson.build
-@@ -11,6 +11,7 @@ migration_files = files(
- 
- system_ss.add(files(
-   'block-dirty-bitmap.c',
-+  'block-active.c',
-   'channel.c',
-   'channel-block.c',
-   'dirtyrate.c',
-diff --git a/migration/migration.c b/migration/migration.c
-index 784b7e9b90..38631d1206 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -730,7 +730,6 @@ static void qemu_start_incoming_migration(const char *uri, bool has_channels,
- 
- static void process_incoming_migration_bh(void *opaque)
- {
--    Error *local_err = NULL;
-     MigrationIncomingState *mis = opaque;
- 
-     trace_vmstate_downtime_checkpoint("dst-precopy-bh-enter");
-@@ -761,11 +760,7 @@ static void process_incoming_migration_bh(void *opaque)
-              * Make sure all file formats throw away their mutable
-              * metadata.  If error, don't restart the VM yet.
-              */
--            bdrv_activate_all(&local_err);
--            if (local_err) {
--                error_report_err(local_err);
--                local_err = NULL;
--            } else {
-+            if (migration_block_activate(NULL)) {
-                 vm_start();
-             }
-         } else {
-@@ -1562,16 +1557,6 @@ static void migrate_fd_cancel(MigrationState *s)
-             }
-         }
-     }
--    if (s->state == MIGRATION_STATUS_CANCELLING && s->block_inactive) {
--        Error *local_err = NULL;
--
--        bdrv_activate_all(&local_err);
--        if (local_err) {
--            error_report_err(local_err);
--        } else {
--            s->block_inactive = false;
--        }
--    }
- }
- 
- void migration_add_notifier_mode(NotifierWithReturn *notify,
-@@ -1890,6 +1875,12 @@ void qmp_migrate_incoming(const char *uri, bool has_channels,
-         return;
-     }
- 
-+    /*
-+     * Newly setup incoming QEMU.  Mark the block active state to reflect
-+     * that the src currently owns the disks.
-+     */
-+    migration_block_active_setup(false);
-+
-     once = false;
- }
- 
-@@ -2542,7 +2533,6 @@ static int postcopy_start(MigrationState *ms, Error **errp)
-     QIOChannelBuffer *bioc;
-     QEMUFile *fb;
-     uint64_t bandwidth = migrate_max_postcopy_bandwidth();
--    bool restart_block = false;
-     int cur_state = MIGRATION_STATUS_ACTIVE;
- 
-     if (migrate_postcopy_preempt()) {
-@@ -2578,13 +2568,10 @@ static int postcopy_start(MigrationState *ms, Error **errp)
-         goto fail;
-     }
- 
--    ret = bdrv_inactivate_all();
--    if (ret < 0) {
--        error_setg_errno(errp, -ret, "%s: Failed in bdrv_inactivate_all()",
--                         __func__);
-+    if (!migration_block_inactivate()) {
-+        error_setg(errp, "%s: Failed in bdrv_inactivate_all()", __func__);
-         goto fail;
-     }
--    restart_block = true;
- 
-     /*
-      * Cause any non-postcopiable, but iterative devices to
-@@ -2654,8 +2641,6 @@ static int postcopy_start(MigrationState *ms, Error **errp)
-         goto fail_closefb;
-     }
- 
--    restart_block = false;
--
-     /* Now send that blob */
-     if (qemu_savevm_send_packaged(ms->to_dst_file, bioc->data, bioc->usage)) {
-         error_setg(errp, "%s: Failed to send packaged data", __func__);
-@@ -2700,17 +2685,7 @@ fail_closefb:
- fail:
-     migrate_set_state(&ms->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
-                           MIGRATION_STATUS_FAILED);
--    if (restart_block) {
--        /* A failure happened early enough that we know the destination hasn't
--         * accessed block devices, so we're safe to recover.
--         */
--        Error *local_err = NULL;
--
--        bdrv_activate_all(&local_err);
--        if (local_err) {
--            error_report_err(local_err);
--        }
--    }
-+    migration_block_activate(NULL);
-     migration_call_notifiers(ms, MIG_EVENT_PRECOPY_FAILED, NULL);
-     bql_unlock();
-     return -1;
-@@ -2808,31 +2783,6 @@ static void migration_completion_postcopy(MigrationState *s)
-     trace_migration_completion_postcopy_end_after_complete();
- }
- 
--static void migration_completion_failed(MigrationState *s,
--                                        int current_active_state)
--{
--    if (s->block_inactive && (s->state == MIGRATION_STATUS_ACTIVE ||
--                              s->state == MIGRATION_STATUS_DEVICE)) {
--        /*
--         * If not doing postcopy, vm_start() will be called: let's
--         * regain control on images.
--         */
--        Error *local_err = NULL;
--
--        bql_lock();
--        bdrv_activate_all(&local_err);
--        if (local_err) {
--            error_report_err(local_err);
--        } else {
--            s->block_inactive = false;
--        }
--        bql_unlock();
--    }
--
--    migrate_set_state(&s->state, current_active_state,
--                      MIGRATION_STATUS_FAILED);
--}
--
- /**
-  * migration_completion: Used by migration_thread when there's not much left.
-  *   The caller 'breaks' the loop when this returns.
-@@ -2886,7 +2836,8 @@ fail:
-         error_free(local_err);
-     }
- 
--    migration_completion_failed(s, current_active_state);
-+    migrate_set_state(&s->state, current_active_state,
-+                      MIGRATION_STATUS_FAILED);
- }
- 
- /**
-@@ -3309,6 +3260,11 @@ static void migration_iteration_finish(MigrationState *s)
-     case MIGRATION_STATUS_FAILED:
-     case MIGRATION_STATUS_CANCELLED:
-     case MIGRATION_STATUS_CANCELLING:
-+        /*
-+         * Re-activate the block drives if they're inactivated.  Note, COLO
-+         * shouldn't use block_active at all, so it should be no-op there.
-+         */
-+        migration_block_activate(NULL);
-         if (runstate_is_live(s->vm_old_state)) {
-             if (!runstate_check(RUN_STATE_SHUTDOWN)) {
-                 vm_start();
-@@ -3869,6 +3825,8 @@ static void migration_instance_init(Object *obj)
-     ms->state = MIGRATION_STATUS_NONE;
-     ms->mbps = -1;
-     ms->pages_per_second = -1;
-+    /* Freshly started QEMU owns all the block devices */
-+    migration_block_active_setup(true);
-     qemu_sem_init(&ms->pause_sem, 0);
-     qemu_mutex_init(&ms->error_mutex);
- 
-diff --git a/migration/migration.h b/migration/migration.h
-index 38aa1402d5..5b17c1344d 100644
---- a/migration/migration.h
-+++ b/migration/migration.h
-@@ -356,9 +356,6 @@ struct MigrationState {
-     /* Flag set once the migration thread is running (and needs joining) */
-     bool migration_thread_running;
- 
--    /* Flag set once the migration thread called bdrv_inactivate_all */
--    bool block_inactive;
--
-     /* Migration is waiting for guest to unplug device */
-     QemuSemaphore wait_unplug_sem;
- 
-@@ -537,4 +534,6 @@ int migration_rp_wait(MigrationState *s);
-  */
- void migration_rp_kick(MigrationState *s);
- 
-+/* migration/block-active.c */
-+void migration_block_active_setup(bool active);
- #endif
-diff --git a/migration/savevm.c b/migration/savevm.c
-index b88dadd904..7f8d177462 100644
---- a/migration/savevm.c
-+++ b/migration/savevm.c
-@@ -1566,19 +1566,18 @@ int qemu_savevm_state_complete_precopy_non_iterable(QEMUFile *f,
-     }
- 
-     if (inactivate_disks) {
--        /* Inactivate before sending QEMU_VM_EOF so that the
--         * bdrv_activate_all() on the other end won't fail. */
--        ret = bdrv_inactivate_all();
--        if (ret) {
--            error_setg(&local_err, "%s: bdrv_inactivate_all() failed (%d)",
--                       __func__, ret);
-+        /*
-+         * Inactivate before sending QEMU_VM_EOF so that the
-+         * bdrv_activate_all() on the other end won't fail.
-+         */
-+        if (!migration_block_inactivate()) {
-+            error_setg(&local_err, "%s: bdrv_inactivate_all() failed",
-+                       __func__);
-             migrate_set_error(ms, local_err);
-             error_report_err(local_err);
--            qemu_file_set_error(f, ret);
-+            qemu_file_set_error(f, -EFAULT);
-             return ret;
-         }
--        /* Remember that we did this */
--        s->block_inactive = true;
-     }
-     if (!in_postcopy) {
-         /* Postcopy stream will still be going */
-@@ -2142,7 +2141,6 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
- 
- static void loadvm_postcopy_handle_run_bh(void *opaque)
- {
--    Error *local_err = NULL;
-     MigrationIncomingState *mis = opaque;
- 
-     trace_vmstate_downtime_checkpoint("dst-postcopy-bh-enter");
-@@ -2165,12 +2163,11 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
-          * Make sure all file formats throw away their mutable metadata.
-          * If we get an error here, just don't restart the VM yet.
-          */
--        bdrv_activate_all(&local_err);
-+        bool success = migration_block_activate(NULL);
-+
-         trace_vmstate_downtime_checkpoint("dst-postcopy-bh-cache-invalidated");
--        if (local_err) {
--            error_report_err(local_err);
--            local_err = NULL;
--        } else {
-+
-+        if (success) {
-             vm_start();
-         }
-     } else {
-@@ -3214,11 +3211,7 @@ void qmp_xen_save_devices_state(const char *filename, bool has_live, bool live,
-          * side of the migration take control of the images.
-          */
-         if (live && !saved_vm_running) {
--            ret = bdrv_inactivate_all();
--            if (ret) {
--                error_setg(errp, "%s: bdrv_inactivate_all() failed (%d)",
--                           __func__, ret);
--            }
-+            migration_block_inactivate();
-         }
-     }
- 
-diff --git a/migration/trace-events b/migration/trace-events
-index 0b7c3324fb..62141dc2ff 100644
---- a/migration/trace-events
-+++ b/migration/trace-events
-@@ -377,3 +377,6 @@ migration_block_progression(unsigned percent) "Completed %u%%"
- # page_cache.c
- migration_pagecache_init(int64_t max_num_items) "Setting cache buckets to %" PRId64
- migration_pagecache_insert(void) "Error allocating page"
-+
-+# block-active.c
-+migration_block_activation(const char *name) "%s"
-diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
-index 76f21e8af3..6f76d9beaf 100644
---- a/monitor/qmp-cmds.c
-+++ b/monitor/qmp-cmds.c
-@@ -31,6 +31,7 @@
- #include "qapi/type-helpers.h"
- #include "hw/mem/memory-device.h"
- #include "hw/intc/intc.h"
-+#include "migration/misc.h"
- 
- NameInfo *qmp_query_name(Error **errp)
- {
-@@ -103,13 +104,8 @@ void qmp_cont(Error **errp)
-          * Continuing after completed migration. Images have been
-          * inactivated to allow the destination to take control. Need to
-          * get control back now.
--         *
--         * If there are no inactive block nodes (e.g. because the VM was
--         * just paused rather than completing a migration),
--         * bdrv_inactivate_all() simply doesn't do anything.
-          */
--        bdrv_activate_all(&local_err);
--        if (local_err) {
-+        if (!migration_block_activate(&local_err)) {
-             error_propagate(errp, local_err);
-             return;
-         }
--- 
-2.48.1
-
diff --git a/kvm-migration-block-active-Remove-global-active-flag.patch b/kvm-migration-block-active-Remove-global-active-flag.patch
deleted file mode 100644
index 7ae5712..0000000
--- a/kvm-migration-block-active-Remove-global-active-flag.patch
+++ /dev/null
@@ -1,158 +0,0 @@
-From a0ebf9fca3b4c6a11c4476c1d1a67fecce7c7e3e Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:13:55 +0100
-Subject: [PATCH 11/23] migration/block-active: Remove global active flag
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [10/22] 4bdf1da765bde05e2d427fc3ccca10bcc9f1dfbe (kmwolf/centos-qemu-kvm)
-
-Block devices have an individual active state, a single global flag
-can't cover this correctly. This becomes more important as we allow
-users to manually manage which nodes are active or inactive.
-
-Now that it's allowed to call bdrv_inactivate_all() even when some
-nodes are already inactive, we can remove the flag and just
-unconditionally call bdrv_inactivate_all() and, more importantly,
-bdrv_activate_all() before we make use of the nodes.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250204211407.381505-5-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c2a189976e211c9ff782538d5a5ed5e5cffeccd6)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- migration/block-active.c | 46 ----------------------------------------
- migration/migration.c    |  8 -------
- migration/migration.h    |  2 --
- 3 files changed, 56 deletions(-)
-
-diff --git a/migration/block-active.c b/migration/block-active.c
-index d477cf8182..40e986aade 100644
---- a/migration/block-active.c
-+++ b/migration/block-active.c
-@@ -12,51 +12,12 @@
- #include "qemu/error-report.h"
- #include "trace.h"
- 
--/*
-- * Migration-only cache to remember the block layer activation status.
-- * Protected by BQL.
-- *
-- * We need this because..
-- *
-- * - Migration can fail after block devices are invalidated (during
-- *   switchover phase).  When that happens, we need to be able to recover
-- *   the block drive status by re-activating them.
-- *
-- * - Currently bdrv_inactivate_all() is not safe to be invoked on top of
-- *   invalidated drives (even if bdrv_activate_all() is actually safe to be
-- *   called any time!).  It means remembering this could help migration to
-- *   make sure it won't invalidate twice in a row, crashing QEMU.  It can
-- *   happen when we migrate a PAUSED VM from host1 to host2, then migrate
-- *   again to host3 without starting it.  TODO: a cleaner solution is to
-- *   allow safe invoke of bdrv_inactivate_all() at anytime, like
-- *   bdrv_activate_all().
-- *
-- * For freshly started QEMU, the flag is initialized to TRUE reflecting the
-- * scenario where QEMU owns block device ownerships.
-- *
-- * For incoming QEMU taking a migration stream, the flag is initialized to
-- * FALSE reflecting that the incoming side doesn't own the block devices,
-- * not until switchover happens.
-- */
--static bool migration_block_active;
--
--/* Setup the disk activation status */
--void migration_block_active_setup(bool active)
--{
--    migration_block_active = active;
--}
--
- bool migration_block_activate(Error **errp)
- {
-     ERRP_GUARD();
- 
-     assert(bql_locked());
- 
--    if (migration_block_active) {
--        trace_migration_block_activation("active-skipped");
--        return true;
--    }
--
-     trace_migration_block_activation("active");
- 
-     bdrv_activate_all(errp);
-@@ -65,7 +26,6 @@ bool migration_block_activate(Error **errp)
-         return false;
-     }
- 
--    migration_block_active = true;
-     return true;
- }
- 
-@@ -75,11 +35,6 @@ bool migration_block_inactivate(void)
- 
-     assert(bql_locked());
- 
--    if (!migration_block_active) {
--        trace_migration_block_activation("inactive-skipped");
--        return true;
--    }
--
-     trace_migration_block_activation("inactive");
- 
-     ret = bdrv_inactivate_all();
-@@ -89,6 +44,5 @@ bool migration_block_inactivate(void)
-         return false;
-     }
- 
--    migration_block_active = false;
-     return true;
- }
-diff --git a/migration/migration.c b/migration/migration.c
-index 38631d1206..999d4cac54 100644
---- a/migration/migration.c
-+++ b/migration/migration.c
-@@ -1875,12 +1875,6 @@ void qmp_migrate_incoming(const char *uri, bool has_channels,
-         return;
-     }
- 
--    /*
--     * Newly setup incoming QEMU.  Mark the block active state to reflect
--     * that the src currently owns the disks.
--     */
--    migration_block_active_setup(false);
--
-     once = false;
- }
- 
-@@ -3825,8 +3819,6 @@ static void migration_instance_init(Object *obj)
-     ms->state = MIGRATION_STATUS_NONE;
-     ms->mbps = -1;
-     ms->pages_per_second = -1;
--    /* Freshly started QEMU owns all the block devices */
--    migration_block_active_setup(true);
-     qemu_sem_init(&ms->pause_sem, 0);
-     qemu_mutex_init(&ms->error_mutex);
- 
-diff --git a/migration/migration.h b/migration/migration.h
-index 5b17c1344d..c38d2a37e4 100644
---- a/migration/migration.h
-+++ b/migration/migration.h
-@@ -534,6 +534,4 @@ int migration_rp_wait(MigrationState *s);
-  */
- void migration_rp_kick(MigrationState *s);
- 
--/* migration/block-active.c */
--void migration_block_active_setup(bool active);
- #endif
--- 
-2.48.1
-
diff --git a/kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch b/kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch
deleted file mode 100644
index bacd275..0000000
--- a/kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch
+++ /dev/null
@@ -1,237 +0,0 @@
-From 1fa31324da8ebba64a44c1e9b64f7e59c29f3d75 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Thu, 24 Apr 2025 18:07:05 -0400
-Subject: [PATCH 1/2] migration/postcopy: Spatial locality page hint for
- preempt mode
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Peter Xu <peterx@redhat.com>
-RH-MergeRequest: 358: migration/postcopy: Spatial locality page hint for preempt mode
-RH-Jira: RHEL-85159
-RH-Acked-by: Juraj Marcin <None>
-RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
-RH-Commit: [1/1] f5bce349c80f98428c73a3898f87d4d10ec2f4bd (peterx/qemu-kvm)
-
-The preempt mode postcopy has been introduced for a while.  From latency
-POV, it should always win the vanilla postcopy.
-
-However there's one thing missing when preempt mode is enabled right now,
-which is the spatial locality hint when there're page requests from the
-destination side.
-
-In vanilla postcopy, as long as a page request was unqueued, it will update
-the PSS of the precopy background stream, so that after a page request the
-background thread will move the pages after whatever was requested.  It's
-pretty much a natural behavior when there's only one channel anyway, and
-one scanner to send the pages.
-
-Preempt mode didn't follow that, because preempt mode has its own channel
-and its own PSS (which doesn't linearly scan the guest memory, but
-dedicated to resolve page requested from destination).  So the page request
-process and the background migration process are completely separate.
-
-This patch adds the hint explicitly for preempt mode.  With that, whenever
-the preempt mode receives a page request on the source, it will service the
-remote page fault in the return path, then it'll provide a hint to the
-background thread so that we'll start sending the pages right after the
-requested ones in the background, assuming the follow up pages have a
-higher chance to be accessed later.
-
-NOTE: since the background migration thread and return path thread run
-completely concurrently, it doesn't always mean the hint will be applied
-every single time.  For example, it's possible that the return path thread
-receives multiple page requests in a row without the background thread
-getting the chance to consume one.  In such case, the preempt thread only
-provide the hint if the previous hint has been consumed.  After all,
-there's no point queuing hints when we only have one linear scanner.
-
-This could measureably improve the simple sequential memory access pattern
-during postcopy (when preempt is on).  For random accesses, I can measure a
-slight increase of remote page fault latency from ~500us -> ~600us, that
-could be a trade-off to have such hint mechanism, and after all that's
-still greatly improved comparing to vanilla postcopy on random (~10ms).
-
-The patch is verified by our QE team in a video streaming test case, to
-reduce the pause of the video from ~1min to a few seconds when switching
-over to postcopy with preempt mode.
-
-Reported-by: Xiaohui Li <xiaohli@redhat.com>
-Tested-by: Xiaohui Li <xiaohli@redhat.com>
-Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
-Link: https://lore.kernel.org/r/20250424220705.195544-1-peterx@redhat.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 20d82622812d888478d04a2d0d8575d70eb5d749)
-Signed-off-by: Peter Xu <peterx@redhat.com>
----
- migration/ram.c | 97 ++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 96 insertions(+), 1 deletion(-)
-
-diff --git a/migration/ram.c b/migration/ram.c
-index edec1a2d07..0803f85b8a 100644
---- a/migration/ram.c
-+++ b/migration/ram.c
-@@ -112,6 +112,36 @@
- 
- XBZRLECacheStats xbzrle_counters;
- 
-+/*
-+ * This structure locates a specific location of a guest page.  In QEMU,
-+ * it's described in a tuple of (ramblock, offset).
-+ */
-+struct PageLocation {
-+    RAMBlock *block;
-+    unsigned long offset;
-+};
-+typedef struct PageLocation PageLocation;
-+
-+/**
-+ * PageLocationHint: describes a hint to a page location
-+ *
-+ * @valid     set if the hint is vaild and to be consumed
-+ * @location: the hint content
-+ *
-+ * In postcopy preempt mode, the urgent channel may provide hints to the
-+ * background channel, so that QEMU source can try to migrate whatever is
-+ * right after the requested urgent pages.
-+ *
-+ * This is based on the assumption that the VM (already running on the
-+ * destination side) tends to access the memory with spatial locality.
-+ * This is also the default behavior of vanilla postcopy (preempt off).
-+ */
-+struct PageLocationHint {
-+    bool valid;
-+    PageLocation location;
-+};
-+typedef struct PageLocationHint PageLocationHint;
-+
- /* used by the search for pages to send */
- struct PageSearchStatus {
-     /* The migration channel used for a specific host page */
-@@ -414,6 +444,13 @@ struct RAMState {
-      * RAM migration.
-      */
-     unsigned int postcopy_bmap_sync_requested;
-+    /*
-+     * Page hint during postcopy when preempt mode is on.  Return path
-+     * thread sets it, while background migration thread consumes it.
-+     *
-+     * Protected by @bitmap_mutex.
-+     */
-+    PageLocationHint page_hint;
- };
- typedef struct RAMState RAMState;
- 
-@@ -2091,6 +2128,21 @@ static void pss_host_page_finish(PageSearchStatus *pss)
-     pss->host_page_start = pss->host_page_end = 0;
- }
- 
-+static void ram_page_hint_update(RAMState *rs, PageSearchStatus *pss)
-+{
-+    PageLocationHint *hint = &rs->page_hint;
-+
-+    /* If there's a pending hint not consumed, don't bother */
-+    if (hint->valid) {
-+        return;
-+    }
-+
-+    /* Provide a hint to the background stream otherwise */
-+    hint->location.block = pss->block;
-+    hint->location.offset = pss->page;
-+    hint->valid = true;
-+}
-+
- /*
-  * Send an urgent host page specified by `pss'.  Need to be called with
-  * bitmap_mutex held.
-@@ -2136,6 +2188,7 @@ out:
-     /* For urgent requests, flush immediately if sent */
-     if (sent) {
-         qemu_fflush(pss->pss_channel);
-+        ram_page_hint_update(rs, pss);
-     }
-     return ret;
- }
-@@ -2223,6 +2276,30 @@ static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss)
-     return (res < 0 ? res : pages);
- }
- 
-+static bool ram_page_hint_valid(RAMState *rs)
-+{
-+    /* There's only page hint during postcopy preempt mode */
-+    if (!postcopy_preempt_active()) {
-+        return false;
-+    }
-+
-+    return rs->page_hint.valid;
-+}
-+
-+static void ram_page_hint_collect(RAMState *rs, RAMBlock **block,
-+                                  unsigned long *page)
-+{
-+    PageLocationHint *hint = &rs->page_hint;
-+
-+    assert(hint->valid);
-+
-+    *block = hint->location.block;
-+    *page = hint->location.offset;
-+
-+    /* Mark the hint consumed */
-+    hint->valid = false;
-+}
-+
- /**
-  * ram_find_and_save_block: finds a dirty page and sends it to f
-  *
-@@ -2239,6 +2316,8 @@ static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss)
- static int ram_find_and_save_block(RAMState *rs)
- {
-     PageSearchStatus *pss = &rs->pss[RAM_CHANNEL_PRECOPY];
-+    unsigned long next_page;
-+    RAMBlock *next_block;
-     int pages = 0;
- 
-     /* No dirty page as there is zero RAM */
-@@ -2258,7 +2337,14 @@ static int ram_find_and_save_block(RAMState *rs)
-         rs->last_page = 0;
-     }
- 
--    pss_init(pss, rs->last_seen_block, rs->last_page);
-+    if (ram_page_hint_valid(rs)) {
-+        ram_page_hint_collect(rs, &next_block, &next_page);
-+    } else {
-+        next_block = rs->last_seen_block;
-+        next_page = rs->last_page;
-+    }
-+
-+    pss_init(pss, next_block, next_page);
- 
-     while (true){
-         if (!get_queued_page(rs, pss)) {
-@@ -2392,6 +2478,13 @@ static void ram_save_cleanup(void *opaque)
-     migration_ops = NULL;
- }
- 
-+static void ram_page_hint_reset(PageLocationHint *hint)
-+{
-+    hint->location.block = NULL;
-+    hint->location.offset = 0;
-+    hint->valid = false;
-+}
-+
- static void ram_state_reset(RAMState *rs)
- {
-     int i;
-@@ -2404,6 +2497,8 @@ static void ram_state_reset(RAMState *rs)
-     rs->last_page = 0;
-     rs->last_version = ram_list.version;
-     rs->xbzrle_started = false;
-+
-+    ram_page_hint_reset(&rs->page_hint);
- }
- 
- #define MAX_WAIT 50 /* ms, half buffered_file limit */
--- 
-2.48.1
-
diff --git a/kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch b/kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch
deleted file mode 100644
index c00be71..0000000
--- a/kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch
+++ /dev/null
@@ -1,295 +0,0 @@
-From a5f6042a0c80daf3672fa071b724cb05e6f6e928 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:25 -0500
-Subject: [PATCH 10/16] mirror: Allow QMP override to declare target already
- zero
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [8/14] fb054864175d83e9d232464295b170808bee0e6c (ebblake/centos-qemu-kvm)
-
-QEMU has an optimization for a just-created drive-mirror destination
-that is not possible for blockdev-mirror (which can't create the
-destination) - any time we know the destination starts life as all
-zeroes, we can skip a pre-zeroing pass on the destination.  Recent
-patches have added an improved heuristic for detecting if a file
-contains all zeroes, and we plan to use that heuristic in upcoming
-patches.  But since a heuristic cannot quickly detect all scenarios,
-and there may be cases where the caller is aware of information that
-QEMU cannot learn quickly, it makes sense to have a way to tell QEMU
-to assume facts about the destination that can make the mirror
-operation faster.  Given our existing example of "qemu-img convert
---target-is-zero", it is time to expose this override in QMP for
-blockdev-mirror as well.
-
-This patch results in some slight redundancy between the older
-s->zero_target (set any time mode==FULL and the destination image was
-not just created - ie. clear if drive-mirror is asking to skip the
-pre-zero pass) and the newly-introduced s->target_is_zero (in addition
-to the QMP override, it is set when drive-mirror creates the
-destination image); this will be cleaned up in the next patch.
-
-There is also a subtlety that we must consider.  When drive-mirror is
-passing target_is_zero on behalf of a just-created image, we know the
-image is sparse (skipping the pre-zeroing keeps it that way), so it
-doesn't matter whether the destination also has "discard":"unmap" and
-"detect-zeroes":"unmap".  But now that we are letting the user set the
-knob for target-is-zero, if the user passes a pre-existing file that
-is fully allocated, it is fine to leave the file fully allocated under
-"detect-zeroes":"on", but if the file is open with
-"detect-zeroes":"unmap", we should really be trying harder to punch
-holes in the destination for every region of zeroes copied from the
-source.  The easiest way to do this is to still run the pre-zeroing
-pass (turning the entire destination file sparse before populating
-just the allocated portions of the source), even though that currently
-results in double I/O to the portions of the file that are allocated.
-A later patch will add further optimizations to reduce redundant
-zeroing I/O during the mirror operation.
-
-Since "target-is-zero":true is designed for optimizations, it is okay
-to silently ignore the parameter rather than erroring if the user ever
-sets the parameter in a scenario where the mirror job can't exploit it
-(for example, when doing "sync":"top" instead of "sync":"full", we
-can't pre-zero, so setting the parameter won't make a speed
-difference).
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Message-ID: <20250509204341.3553601-23-eblake@redhat.com>
-Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit d17a34bfb94bda3a89d7320ae67255ded1d8c939)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c                         | 27 ++++++++++++++++++++++----
- blockdev.c                             | 18 ++++++++++-------
- include/block/block_int-global-state.h |  3 ++-
- qapi/block-core.json                   |  8 +++++++-
- tests/unit/test-block-iothread.c       |  2 +-
- 5 files changed, 44 insertions(+), 14 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index c8bbaa0b35..bba3e3b05c 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -55,6 +55,8 @@ typedef struct MirrorBlockJob {
-     BlockMirrorBackingMode backing_mode;
-     /* Whether the target image requires explicit zero-initialization */
-     bool zero_target;
-+    /* Whether the target should be assumed to be already zero initialized */
-+    bool target_is_zero;
-     /*
-      * To be accesssed with atomics. Written only under the BQL (required by the
-      * current implementation of mirror_change()).
-@@ -844,12 +846,26 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-     BlockDriverState *target_bs = blk_bs(s->target);
-     int ret = -EIO;
-     int64_t count;
-+    bool punch_holes =
-+        target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-+        bdrv_can_write_zeroes_with_unmap(target_bs);
- 
-     bdrv_graph_co_rdlock();
-     bs = s->mirror_top_bs->backing->bs;
-     bdrv_graph_co_rdunlock();
- 
--    if (s->zero_target) {
-+    if (s->zero_target && (!s->target_is_zero || punch_holes)) {
-+        /*
-+         * Here, we are in FULL mode; our goal is to avoid writing
-+         * zeroes if the destination already reads as zero, except
-+         * when we are trying to punch holes.  This is possible if
-+         * zeroing happened externally (s->target_is_zero) or if we
-+         * have a fast way to pre-zero the image (the dirty bitmap
-+         * will be populated later by the non-zero portions, the same
-+         * as for TOP mode).  If pre-zeroing is not fast, or we need
-+         * to punch holes, then our only recourse is to write the
-+         * entire image.
-+         */
-         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
-             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
-             return 0;
-@@ -1714,7 +1730,7 @@ static BlockJob *mirror_start_job(
-                              uint32_t granularity, int64_t buf_size,
-                              MirrorSyncMode sync_mode,
-                              BlockMirrorBackingMode backing_mode,
--                             bool zero_target,
-+                             bool zero_target, bool target_is_zero,
-                              BlockdevOnError on_source_error,
-                              BlockdevOnError on_target_error,
-                              bool unmap,
-@@ -1883,6 +1899,7 @@ static BlockJob *mirror_start_job(
-     s->sync_mode = sync_mode;
-     s->backing_mode = backing_mode;
-     s->zero_target = zero_target;
-+    s->target_is_zero = target_is_zero;
-     qatomic_set(&s->copy_mode, copy_mode);
-     s->base = base;
-     s->base_overlay = bdrv_find_overlay(bs, base);
-@@ -2011,7 +2028,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   int creation_flags, int64_t speed,
-                   uint32_t granularity, int64_t buf_size,
-                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
--                  bool zero_target,
-+                  bool zero_target, bool target_is_zero,
-                   BlockdevOnError on_source_error,
-                   BlockdevOnError on_target_error,
-                   bool unmap, const char *filter_node_name,
-@@ -2034,7 +2051,8 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
- 
-     mirror_start_job(job_id, bs, creation_flags, target, replaces,
-                      speed, granularity, buf_size, mode, backing_mode,
--                     zero_target, on_source_error, on_target_error, unmap,
-+                     zero_target,
-+                     target_is_zero, on_source_error, on_target_error, unmap,
-                      NULL, NULL, &mirror_job_driver, base, false,
-                      filter_node_name, true, copy_mode, false, errp);
- }
-@@ -2062,6 +2080,7 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-     job = mirror_start_job(
-                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
-                      MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
-+                     false,
-                      on_error, on_error, true, cb, opaque,
-                      &commit_active_job_driver, base, auto_complete,
-                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
-diff --git a/blockdev.c b/blockdev.c
-index 70046b6690..db11a99312 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -2795,7 +2795,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-                                    const char *replaces,
-                                    enum MirrorSyncMode sync,
-                                    BlockMirrorBackingMode backing_mode,
--                                   bool zero_target,
-+                                   bool zero_target, bool target_is_zero,
-                                    bool has_speed, int64_t speed,
-                                    bool has_granularity, uint32_t granularity,
-                                    bool has_buf_size, int64_t buf_size,
-@@ -2906,11 +2906,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-     /* pass the node name to replace to mirror start since it's loose coupling
-      * and will allow to check whether the node still exist at mirror completion
-      */
--    mirror_start(job_id, bs, target,
--                 replaces, job_flags,
-+    mirror_start(job_id, bs, target, replaces, job_flags,
-                  speed, granularity, buf_size, sync, backing_mode, zero_target,
--                 on_source_error, on_target_error, unmap, filter_node_name,
--                 copy_mode, errp);
-+                 target_is_zero, on_source_error, on_target_error, unmap,
-+                 filter_node_name, copy_mode, errp);
- }
- 
- void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-@@ -2925,6 +2924,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     int64_t size;
-     const char *format = arg->format;
-     bool zero_target;
-+    bool target_is_zero;
-     int ret;
- 
-     bs = qmp_get_root_bs(arg->device, errp);
-@@ -3041,6 +3041,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     zero_target = (arg->sync == MIRROR_SYNC_MODE_FULL &&
-                    (arg->mode == NEW_IMAGE_MODE_EXISTING ||
-                     !bdrv_has_zero_init(target_bs)));
-+    target_is_zero = (arg->mode != NEW_IMAGE_MODE_EXISTING &&
-+                      bdrv_has_zero_init(target_bs));
-     bdrv_graph_rdunlock_main_loop();
- 
- 
-@@ -3052,7 +3054,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
- 
-     blockdev_mirror_common(arg->job_id, bs, target_bs,
-                            arg->replaces, arg->sync,
--                           backing_mode, zero_target,
-+                           backing_mode, zero_target, target_is_zero,
-                            arg->has_speed, arg->speed,
-                            arg->has_granularity, arg->granularity,
-                            arg->has_buf_size, arg->buf_size,
-@@ -3082,6 +3084,7 @@ void qmp_blockdev_mirror(const char *job_id,
-                          bool has_copy_mode, MirrorCopyMode copy_mode,
-                          bool has_auto_finalize, bool auto_finalize,
-                          bool has_auto_dismiss, bool auto_dismiss,
-+                         bool has_target_is_zero, bool target_is_zero,
-                          Error **errp)
- {
-     BlockDriverState *bs;
-@@ -3112,7 +3115,8 @@ void qmp_blockdev_mirror(const char *job_id,
- 
-     blockdev_mirror_common(job_id, bs, target_bs,
-                            replaces, sync, backing_mode,
--                           zero_target, has_speed, speed,
-+                           zero_target, has_target_is_zero && target_is_zero,
-+                           has_speed, speed,
-                            has_granularity, granularity,
-                            has_buf_size, buf_size,
-                            has_on_source_error, on_source_error,
-diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index eb2d92a226..8cf0003ce7 100644
---- a/include/block/block_int-global-state.h
-+++ b/include/block/block_int-global-state.h
-@@ -140,6 +140,7 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-  * @mode: Whether to collapse all images in the chain to the target.
-  * @backing_mode: How to establish the target's backing chain after completion.
-  * @zero_target: Whether the target should be explicitly zero-initialized
-+ * @target_is_zero: Whether the target already is zero-initialized.
-  * @on_source_error: The action to take upon error reading from the source.
-  * @on_target_error: The action to take upon error writing to the target.
-  * @unmap: Whether to unmap target where source sectors only contain zeroes.
-@@ -159,7 +160,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   int creation_flags, int64_t speed,
-                   uint32_t granularity, int64_t buf_size,
-                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
--                  bool zero_target,
-+                  bool zero_target, bool target_is_zero,
-                   BlockdevOnError on_source_error,
-                   BlockdevOnError on_target_error,
-                   bool unmap, const char *filter_node_name,
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c1af3d1f7d..3969c60b93 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -2535,6 +2535,11 @@
- #     disappear from the query list without user intervention.
- #     Defaults to true.  (Since 3.1)
- #
-+# @target-is-zero: Assume the destination reads as all zeroes before
-+#     the mirror started.  Setting this to true can speed up the
-+#     mirror.  Setting this to true when the destination is not
-+#     actually all zero can corrupt the destination.  (Since 10.1)
-+#
- # Since: 2.6
- #
- # .. qmp-example::
-@@ -2554,7 +2559,8 @@
-             '*on-target-error': 'BlockdevOnError',
-             '*filter-node-name': 'str',
-             '*copy-mode': 'MirrorCopyMode',
--            '*auto-finalize': 'bool', '*auto-dismiss': 'bool' },
-+            '*auto-finalize': 'bool', '*auto-dismiss': 'bool',
-+            '*target-is-zero': 'bool'},
-   'allow-preconfig': true }
- 
- ##
-diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 373b72fdd8..033711d8d7 100644
---- a/tests/unit/test-block-iothread.c
-+++ b/tests/unit/test-block-iothread.c
-@@ -755,7 +755,7 @@ static void test_propagate_mirror(void)
- 
-     /* Start a mirror job */
-     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
--                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
-+                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false, false,
-                  BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
-                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
-                  &error_abort);
--- 
-2.48.1
-
diff --git a/kvm-mirror-Drop-redundant-zero_target-parameter.patch b/kvm-mirror-Drop-redundant-zero_target-parameter.patch
deleted file mode 100644
index ee01f81..0000000
--- a/kvm-mirror-Drop-redundant-zero_target-parameter.patch
+++ /dev/null
@@ -1,241 +0,0 @@
-From 5040f835f07f3355ae80b3da2ae83ce35de022e0 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:26 -0500
-Subject: [PATCH 11/16] mirror: Drop redundant zero_target parameter
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [9/14] b84a938c69e3761211b9fee4c59b465d55f61855 (ebblake/centos-qemu-kvm)
-
-The two callers to a mirror job (drive-mirror and blockdev-mirror) set
-zero_target precisely when sync mode == FULL, with the one exception
-that drive-mirror skips zeroing the target if it was newly created and
-reads as zero.  But given the previous patch, that exception is
-equally captured by target_is_zero.
-
-Meanwhile, there is another slight wrinkle, fortunately caught by
-iotest 185: if the caller uses "sync":"top" but the source has no
-backing file, the code in blockdev.c was changing sync to be FULL, but
-only after it had set zero_target=false.  In mirror.c, prior to recent
-patches, this didn't matter: the only places that inspected sync were
-setting is_none_mode (both TOP and FULL had set that to false), and
-mirror_start() setting base = mode == MIRROR_SYNC_MODE_TOP ?
-bdrv_backing_chain_next(bs) : NULL.  But now that we are passing sync
-around, the slammed sync mode would result in a new pre-zeroing pass
-even when the user had passed "sync":"top" in an effort to skip
-pre-zeroing.  Fortunately, the assignment of base when bs has no
-backing chain still works out to NULL if we don't slam things.  So
-with the forced change of sync ripped out of blockdev.c, the sync mode
-is passed through the full callstack unmolested, and we can now
-reliably reconstruct the same settings as what used to be passed in by
-zero_target=false, without the redundant parameter.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250509204341.3553601-24-eblake@redhat.com>
-Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-[eblake: Fix regression in iotest 185]
-Signed-off-by: Eric Blake <eblake@redhat.com>
-(cherry picked from commit 253b43a29077de9266351e120c600a73b82e9c49)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c                         | 13 +++++--------
- blockdev.c                             | 19 ++++---------------
- include/block/block_int-global-state.h |  3 +--
- tests/unit/test-block-iothread.c       |  2 +-
- 4 files changed, 11 insertions(+), 26 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index bba3e3b05c..b35d12adaa 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -53,8 +53,6 @@ typedef struct MirrorBlockJob {
-     Error *replace_blocker;
-     MirrorSyncMode sync_mode;
-     BlockMirrorBackingMode backing_mode;
--    /* Whether the target image requires explicit zero-initialization */
--    bool zero_target;
-     /* Whether the target should be assumed to be already zero initialized */
-     bool target_is_zero;
-     /*
-@@ -854,7 +852,9 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-     bs = s->mirror_top_bs->backing->bs;
-     bdrv_graph_co_rdunlock();
- 
--    if (s->zero_target && (!s->target_is_zero || punch_holes)) {
-+    if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
-+        /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
-+    } else if (!s->target_is_zero || punch_holes) {
-         /*
-          * Here, we are in FULL mode; our goal is to avoid writing
-          * zeroes if the destination already reads as zero, except
-@@ -1730,7 +1730,7 @@ static BlockJob *mirror_start_job(
-                              uint32_t granularity, int64_t buf_size,
-                              MirrorSyncMode sync_mode,
-                              BlockMirrorBackingMode backing_mode,
--                             bool zero_target, bool target_is_zero,
-+                             bool target_is_zero,
-                              BlockdevOnError on_source_error,
-                              BlockdevOnError on_target_error,
-                              bool unmap,
-@@ -1898,7 +1898,6 @@ static BlockJob *mirror_start_job(
-     s->on_target_error = on_target_error;
-     s->sync_mode = sync_mode;
-     s->backing_mode = backing_mode;
--    s->zero_target = zero_target;
-     s->target_is_zero = target_is_zero;
-     qatomic_set(&s->copy_mode, copy_mode);
-     s->base = base;
-@@ -2028,7 +2027,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   int creation_flags, int64_t speed,
-                   uint32_t granularity, int64_t buf_size,
-                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
--                  bool zero_target, bool target_is_zero,
-+                  bool target_is_zero,
-                   BlockdevOnError on_source_error,
-                   BlockdevOnError on_target_error,
-                   bool unmap, const char *filter_node_name,
-@@ -2051,7 +2050,6 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
- 
-     mirror_start_job(job_id, bs, creation_flags, target, replaces,
-                      speed, granularity, buf_size, mode, backing_mode,
--                     zero_target,
-                      target_is_zero, on_source_error, on_target_error, unmap,
-                      NULL, NULL, &mirror_job_driver, base, false,
-                      filter_node_name, true, copy_mode, false, errp);
-@@ -2080,7 +2078,6 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-     job = mirror_start_job(
-                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
-                      MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
--                     false,
-                      on_error, on_error, true, cb, opaque,
-                      &commit_active_job_driver, base, auto_complete,
-                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
-diff --git a/blockdev.c b/blockdev.c
-index db11a99312..04fa759e30 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -2795,7 +2795,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-                                    const char *replaces,
-                                    enum MirrorSyncMode sync,
-                                    BlockMirrorBackingMode backing_mode,
--                                   bool zero_target, bool target_is_zero,
-+                                   bool target_is_zero,
-                                    bool has_speed, int64_t speed,
-                                    bool has_granularity, uint32_t granularity,
-                                    bool has_buf_size, int64_t buf_size,
-@@ -2862,10 +2862,6 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-         return;
-     }
- 
--    if (!bdrv_backing_chain_next(bs) && sync == MIRROR_SYNC_MODE_TOP) {
--        sync = MIRROR_SYNC_MODE_FULL;
--    }
--
-     if (!replaces) {
-         /* We want to mirror from @bs, but keep implicit filters on top */
-         unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -2907,7 +2903,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-      * and will allow to check whether the node still exist at mirror completion
-      */
-     mirror_start(job_id, bs, target, replaces, job_flags,
--                 speed, granularity, buf_size, sync, backing_mode, zero_target,
-+                 speed, granularity, buf_size, sync, backing_mode,
-                  target_is_zero, on_source_error, on_target_error, unmap,
-                  filter_node_name, copy_mode, errp);
- }
-@@ -2923,7 +2919,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     int flags;
-     int64_t size;
-     const char *format = arg->format;
--    bool zero_target;
-     bool target_is_zero;
-     int ret;
- 
-@@ -3038,9 +3033,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     }
- 
-     bdrv_graph_rdlock_main_loop();
--    zero_target = (arg->sync == MIRROR_SYNC_MODE_FULL &&
--                   (arg->mode == NEW_IMAGE_MODE_EXISTING ||
--                    !bdrv_has_zero_init(target_bs)));
-     target_is_zero = (arg->mode != NEW_IMAGE_MODE_EXISTING &&
-                       bdrv_has_zero_init(target_bs));
-     bdrv_graph_rdunlock_main_loop();
-@@ -3054,7 +3046,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
- 
-     blockdev_mirror_common(arg->job_id, bs, target_bs,
-                            arg->replaces, arg->sync,
--                           backing_mode, zero_target, target_is_zero,
-+                           backing_mode, target_is_zero,
-                            arg->has_speed, arg->speed,
-                            arg->has_granularity, arg->granularity,
-                            arg->has_buf_size, arg->buf_size,
-@@ -3091,7 +3083,6 @@ void qmp_blockdev_mirror(const char *job_id,
-     BlockDriverState *target_bs;
-     AioContext *aio_context;
-     BlockMirrorBackingMode backing_mode = MIRROR_LEAVE_BACKING_CHAIN;
--    bool zero_target;
-     int ret;
- 
-     bs = qmp_get_root_bs(device, errp);
-@@ -3104,8 +3095,6 @@ void qmp_blockdev_mirror(const char *job_id,
-         return;
-     }
- 
--    zero_target = (sync == MIRROR_SYNC_MODE_FULL);
--
-     aio_context = bdrv_get_aio_context(bs);
- 
-     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
-@@ -3115,7 +3104,7 @@ void qmp_blockdev_mirror(const char *job_id,
- 
-     blockdev_mirror_common(job_id, bs, target_bs,
-                            replaces, sync, backing_mode,
--                           zero_target, has_target_is_zero && target_is_zero,
-+                           has_target_is_zero && target_is_zero,
-                            has_speed, speed,
-                            has_granularity, granularity,
-                            has_buf_size, buf_size,
-diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index 8cf0003ce7..d21bd7fd2f 100644
---- a/include/block/block_int-global-state.h
-+++ b/include/block/block_int-global-state.h
-@@ -139,7 +139,6 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-  * @buf_size: The amount of data that can be in flight at one time.
-  * @mode: Whether to collapse all images in the chain to the target.
-  * @backing_mode: How to establish the target's backing chain after completion.
-- * @zero_target: Whether the target should be explicitly zero-initialized
-  * @target_is_zero: Whether the target already is zero-initialized.
-  * @on_source_error: The action to take upon error reading from the source.
-  * @on_target_error: The action to take upon error writing to the target.
-@@ -160,7 +159,7 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   int creation_flags, int64_t speed,
-                   uint32_t granularity, int64_t buf_size,
-                   MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
--                  bool zero_target, bool target_is_zero,
-+                  bool target_is_zero,
-                   BlockdevOnError on_source_error,
-                   BlockdevOnError on_target_error,
-                   bool unmap, const char *filter_node_name,
-diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 033711d8d7..373b72fdd8 100644
---- a/tests/unit/test-block-iothread.c
-+++ b/tests/unit/test-block-iothread.c
-@@ -755,7 +755,7 @@ static void test_propagate_mirror(void)
- 
-     /* Start a mirror job */
-     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
--                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false, false,
-+                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
-                  BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
-                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
-                  &error_abort);
--- 
-2.48.1
-
diff --git a/kvm-mirror-Minor-refactoring.patch b/kvm-mirror-Minor-refactoring.patch
deleted file mode 100644
index eda26ee..0000000
--- a/kvm-mirror-Minor-refactoring.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 0102da22fe5aefde9d398d539fc290ab062346f1 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:23 -0500
-Subject: [PATCH 08/16] mirror: Minor refactoring
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [6/14] 886fa2e3249f48f89d3e04ba619d370031851d89 (ebblake/centos-qemu-kvm)
-
-Commit 5791ba52 (v9.2) pre-initialized ret in mirror_dirty_init to
-silence a false positive compiler warning, even though in all code
-paths where ret is used, it was guaranteed to be reassigned
-beforehand.  But since the function returns -errno, and -1 is not
-always the right errno, it's better to initialize to -EIO.
-
-An upcoming patch wants to track two bitmaps in
-do_sync_target_write(); this will be easier if the current variables
-related to the dirty bitmap are renamed.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20250509204341.3553601-21-eblake@redhat.com>
-(cherry picked from commit 870f8963cf1a84f8ec929b05a6d68906974a76c5)
-Conflicts:
-	block/mirror.c - commit 5791ba52 not present
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 61f0a717b7..22f8bd98c4 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -841,7 +841,7 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-     int64_t offset;
-     BlockDriverState *bs;
-     BlockDriverState *target_bs = blk_bs(s->target);
--    int ret;
-+    int ret = -EIO;
-     int64_t count;
- 
-     bdrv_graph_co_rdlock();
-@@ -1341,7 +1341,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
- {
-     int ret;
-     size_t qiov_offset = 0;
--    int64_t bitmap_offset, bitmap_end;
-+    int64_t dirty_bitmap_offset, dirty_bitmap_end;
- 
-     if (!QEMU_IS_ALIGNED(offset, job->granularity) &&
-         bdrv_dirty_bitmap_get(job->dirty_bitmap, offset))
-@@ -1388,11 +1388,11 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-      * Tails are either clean or shrunk, so for bitmap resetting
-      * we safely align the range down.
-      */
--    bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
--    bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
--    if (bitmap_offset < bitmap_end) {
--        bdrv_reset_dirty_bitmap(job->dirty_bitmap, bitmap_offset,
--                                bitmap_end - bitmap_offset);
-+    dirty_bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
-+    dirty_bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
-+    if (dirty_bitmap_offset < dirty_bitmap_end) {
-+        bdrv_reset_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
-+                                dirty_bitmap_end - dirty_bitmap_offset);
-     }
- 
-     job_progress_increase_remaining(&job->common.job, bytes);
-@@ -1430,10 +1430,10 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-          * at function start, and they must be still dirty, as we've locked
-          * the region for in-flight op.
-          */
--        bitmap_offset = QEMU_ALIGN_DOWN(offset, job->granularity);
--        bitmap_end = QEMU_ALIGN_UP(offset + bytes, job->granularity);
--        bdrv_set_dirty_bitmap(job->dirty_bitmap, bitmap_offset,
--                              bitmap_end - bitmap_offset);
-+        dirty_bitmap_offset = QEMU_ALIGN_DOWN(offset, job->granularity);
-+        dirty_bitmap_end = QEMU_ALIGN_UP(offset + bytes, job->granularity);
-+        bdrv_set_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
-+                              dirty_bitmap_end - dirty_bitmap_offset);
-         qatomic_set(&job->actively_synced, false);
- 
-         action = mirror_error_action(job, false, -ret);
--- 
-2.48.1
-
diff --git a/kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch b/kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch
deleted file mode 100644
index 653bb20..0000000
--- a/kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 482db3e637a16d5877e523e87c53ddb2579b4b66 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:24 -0500
-Subject: [PATCH 09/16] mirror: Pass full sync mode rather than bool to
- internals
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [7/14] f45a83a14b0eea07517176d44ab0c49db8233ea0 (ebblake/centos-qemu-kvm)
-
-Out of the five possible values for MirrorSyncMode, INCREMENTAL and
-BITMAP are already rejected up front in mirror_start, leaving NONE,
-TOP, and FULL as the remaining values that the code was collapsing
-into a single bool is_none_mode.  Furthermore, mirror_dirty_init() is
-only reachable for modes TOP and FULL, as further guided by
-s->zero_target.  However, upcoming patches want to further optimize
-the pre-zeroing pass of a sync=full mirror in mirror_dirty_init(),
-while avoiding that pass on a sync=top action.  Instead of throwing
-away context by collapsing these two values into
-s->is_none_mode=false, it is better to pass s->sync_mode throughout
-the entire operation.  For active commit, the desired semantics match
-sync mode TOP.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250509204341.3553601-22-eblake@redhat.com>
-Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 9474d97bd7421b4fe7c806ab0949697514d11e88)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c | 24 ++++++++++++------------
- 1 file changed, 12 insertions(+), 12 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 22f8bd98c4..c8bbaa0b35 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -51,7 +51,7 @@ typedef struct MirrorBlockJob {
-     BlockDriverState *to_replace;
-     /* Used to block operations on the drive-mirror-replace target */
-     Error *replace_blocker;
--    bool is_none_mode;
-+    MirrorSyncMode sync_mode;
-     BlockMirrorBackingMode backing_mode;
-     /* Whether the target image requires explicit zero-initialization */
-     bool zero_target;
-@@ -723,9 +723,10 @@ static int mirror_exit_common(Job *job)
-                              &error_abort);
- 
-     if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
--        BlockDriverState *backing = s->is_none_mode ? src : s->base;
-+        BlockDriverState *backing;
-         BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
- 
-+        backing = s->sync_mode == MIRROR_SYNC_MODE_NONE ? src : s->base;
-         if (bdrv_cow_bs(unfiltered_target) != backing) {
-             bdrv_set_backing_hd(unfiltered_target, backing, &local_err);
-             if (local_err) {
-@@ -1020,7 +1021,7 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
-     mirror_free_init(s);
- 
-     s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
--    if (!s->is_none_mode) {
-+    if (s->sync_mode != MIRROR_SYNC_MODE_NONE) {
-         ret = mirror_dirty_init(s);
-         if (ret < 0 || job_is_cancelled(&s->common.job)) {
-             goto immediate_exit;
-@@ -1711,6 +1712,7 @@ static BlockJob *mirror_start_job(
-                              int creation_flags, BlockDriverState *target,
-                              const char *replaces, int64_t speed,
-                              uint32_t granularity, int64_t buf_size,
-+                             MirrorSyncMode sync_mode,
-                              BlockMirrorBackingMode backing_mode,
-                              bool zero_target,
-                              BlockdevOnError on_source_error,
-@@ -1719,7 +1721,7 @@ static BlockJob *mirror_start_job(
-                              BlockCompletionFunc *cb,
-                              void *opaque,
-                              const BlockJobDriver *driver,
--                             bool is_none_mode, BlockDriverState *base,
-+                             BlockDriverState *base,
-                              bool auto_complete, const char *filter_node_name,
-                              bool is_mirror, MirrorCopyMode copy_mode,
-                              bool base_ro,
-@@ -1878,7 +1880,7 @@ static BlockJob *mirror_start_job(
-     s->replaces = g_strdup(replaces);
-     s->on_source_error = on_source_error;
-     s->on_target_error = on_target_error;
--    s->is_none_mode = is_none_mode;
-+    s->sync_mode = sync_mode;
-     s->backing_mode = backing_mode;
-     s->zero_target = zero_target;
-     qatomic_set(&s->copy_mode, copy_mode);
-@@ -2015,7 +2017,6 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   bool unmap, const char *filter_node_name,
-                   MirrorCopyMode copy_mode, Error **errp)
- {
--    bool is_none_mode;
-     BlockDriverState *base;
- 
-     GLOBAL_STATE_CODE();
-@@ -2028,14 +2029,13 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-     }
- 
-     bdrv_graph_rdlock_main_loop();
--    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
-     base = mode == MIRROR_SYNC_MODE_TOP ? bdrv_backing_chain_next(bs) : NULL;
-     bdrv_graph_rdunlock_main_loop();
- 
-     mirror_start_job(job_id, bs, creation_flags, target, replaces,
--                     speed, granularity, buf_size, backing_mode, zero_target,
--                     on_source_error, on_target_error, unmap, NULL, NULL,
--                     &mirror_job_driver, is_none_mode, base, false,
-+                     speed, granularity, buf_size, mode, backing_mode,
-+                     zero_target, on_source_error, on_target_error, unmap,
-+                     NULL, NULL, &mirror_job_driver, base, false,
-                      filter_node_name, true, copy_mode, false, errp);
- }
- 
-@@ -2061,9 +2061,9 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
- 
-     job = mirror_start_job(
-                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
--                     MIRROR_LEAVE_BACKING_CHAIN, false,
-+                     MIRROR_SYNC_MODE_TOP, MIRROR_LEAVE_BACKING_CHAIN, false,
-                      on_error, on_error, true, cb, opaque,
--                     &commit_active_job_driver, false, base, auto_complete,
-+                     &commit_active_job_driver, base, auto_complete,
-                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
-                      base_read_only, errp);
-     if (!job) {
--- 
-2.48.1
-
diff --git a/kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch b/kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch
deleted file mode 100644
index 3864b3d..0000000
--- a/kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From be6ce2c91fe949d1c264de974ab4f6c4efc6976e Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Tue, 13 May 2025 17:00:45 -0500
-Subject: [PATCH 16/16] mirror: Reduce I/O when destination is
- detect-zeroes:unmap
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [14/14] 66f3de2ba9f977c9bc1c54f67d76b366df132e62 (ebblake/centos-qemu-kvm)
-
-If we are going to punch holes in the mirror destination even for the
-portions where the source image is unallocated, it is nicer to treat
-the entire image as dirty and punch as we go, rather than pre-zeroing
-the entire image just to re-do I/O to the allocated portions of the
-image.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250513220142.535200-2-eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 9abfc81246c9cc1845080eec5920779961187c07)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 7f3b5477ce..87c19ddf0d 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -920,11 +920,16 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-          * zeroing happened externally (ret > 0) or if we have a fast
-          * way to pre-zero the image (the dirty bitmap will be
-          * populated later by the non-zero portions, the same as for
--         * TOP mode).  If pre-zeroing is not fast, then our only
--         * recourse is to mark the entire image dirty.  The act of
--         * pre-zeroing will populate the zero bitmap.
-+         * TOP mode).  If pre-zeroing is not fast, or we need to visit
-+         * the entire image in order to punch holes even in the
-+         * non-allocated regions of the source, then just mark the
-+         * entire image dirty and leave the zero bitmap clear at this
-+         * point in time.  Otherwise, it can be faster to pre-zero the
-+         * image now, even if we re-write the allocated portions of
-+         * the disk later, and the pre-zero pass will populate the
-+         * zero bitmap.
-          */
--        if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
-+        if (!bdrv_can_write_zeroes_with_unmap(target_bs) || punch_holes) {
-             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
-             return 0;
-         }
--- 
-2.48.1
-
diff --git a/kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch b/kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch
deleted file mode 100644
index ea9ad0b..0000000
--- a/kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 423ce7727eecae647330287e1264ac0d938fa7f9 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:27 -0500
-Subject: [PATCH 12/16] mirror: Skip pre-zeroing destination if it is already
- zero
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [10/14] e754ae559123099f4aed322f6a4287cf3323f54d (ebblake/centos-qemu-kvm)
-
-When doing a sync=full mirroring, we can skip pre-zeroing the
-destination if it already reads as zeroes and we are not also trying
-to punch holes due to detect-zeroes.  With this patch, there are fewer
-scenarios that have to pass in an explicit target-is-zero, while still
-resulting in a sparse destination remaining sparse.
-
-A later patch will then further improve things to skip writing to the
-destination for parts of the image where the source is zero; but even
-with just this patch, it is possible to see a difference for any
-source that does not report itself as fully allocated, coupled with a
-destination BDS that can quickly report that it already reads as zero.
-(For a source that reports as fully allocated, such as a file, the
-rest of mirror_dirty_init() still sets the entire dirty bitmap to
-true, so even though we avoided the pre-zeroing, we are not yet
-avoiding all redundant I/O).
-
-Iotest 194 detects the difference made by this patch: for a file
-source (where block status reports the entire image as allocated, and
-therefore we end up writing zeroes everywhere in the destination
-anyways), the job length remains the same.  But for a qcow2 source and
-a destination that reads as all zeroes, the dirty bitmap changes to
-just tracking the allocated portions of the source, which results in
-faster completion and smaller job statistics.  For the test to pass
-with both ./check -file and -qcow2, a new python filter is needed to
-mask out the now-varying job amounts (this matches the shell filters
-_filter_block_job_{offset,len} in common.filter).  A later test will
-also be added which further validates expected sparseness, so it does
-not matter that 194 is no longer explicitly looking at how many bytes
-were copied.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250509204341.3553601-25-eblake@redhat.com>
-Reviewed-by: Sunny Zhu <sunnyzhyy@qq.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 181a63667adf16c35b57e446def3e41c70f1fea6)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c                | 24 ++++++++++++++++--------
- tests/qemu-iotests/194        |  6 ++++--
- tests/qemu-iotests/194.out    |  4 ++--
- tests/qemu-iotests/iotests.py | 12 +++++++++++-
- 4 files changed, 33 insertions(+), 13 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index b35d12adaa..29cac1777c 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -848,23 +848,31 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-         target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-         bdrv_can_write_zeroes_with_unmap(target_bs);
- 
-+    /* Determine if the image is already zero, regardless of sync mode.  */
-     bdrv_graph_co_rdlock();
-     bs = s->mirror_top_bs->backing->bs;
-+    if (s->target_is_zero) {
-+        ret = 1;
-+    } else {
-+        ret = bdrv_co_is_all_zeroes(target_bs);
-+    }
-     bdrv_graph_co_rdunlock();
- 
--    if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
-+    /* Determine if a pre-zeroing pass is necessary.  */
-+    if (ret < 0) {
-+        return ret;
-+    } else if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
-         /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
--    } else if (!s->target_is_zero || punch_holes) {
-+    } else if (ret == 0 || punch_holes) {
-         /*
-          * Here, we are in FULL mode; our goal is to avoid writing
-          * zeroes if the destination already reads as zero, except
-          * when we are trying to punch holes.  This is possible if
--         * zeroing happened externally (s->target_is_zero) or if we
--         * have a fast way to pre-zero the image (the dirty bitmap
--         * will be populated later by the non-zero portions, the same
--         * as for TOP mode).  If pre-zeroing is not fast, or we need
--         * to punch holes, then our only recourse is to write the
--         * entire image.
-+         * zeroing happened externally (ret > 0) or if we have a fast
-+         * way to pre-zero the image (the dirty bitmap will be
-+         * populated later by the non-zero portions, the same as for
-+         * TOP mode).  If pre-zeroing is not fast, or we need to punch
-+         * holes, then our only recourse is to write the entire image.
-          */
-         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
-             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
-diff --git a/tests/qemu-iotests/194 b/tests/qemu-iotests/194
-index d0b9c084f5..e114c0b269 100755
---- a/tests/qemu-iotests/194
-+++ b/tests/qemu-iotests/194
-@@ -62,7 +62,8 @@ with iotests.FilePath('source.img') as source_img_path, \
- 
-     iotests.log('Waiting for `drive-mirror` to complete...')
-     iotests.log(source_vm.event_wait('BLOCK_JOB_READY'),
--                filters=[iotests.filter_qmp_event])
-+                filters=[iotests.filter_qmp_event,
-+                         iotests.filter_block_job])
- 
-     iotests.log('Starting migration...')
-     capabilities = [{'capability': 'events', 'state': True},
-@@ -88,7 +89,8 @@ with iotests.FilePath('source.img') as source_img_path, \
- 
-     while True:
-         event2 = source_vm.event_wait('BLOCK_JOB_COMPLETED')
--        iotests.log(event2, filters=[iotests.filter_qmp_event])
-+        iotests.log(event2, filters=[iotests.filter_qmp_event,
-+                                     iotests.filter_block_job])
-         if event2['event'] == 'BLOCK_JOB_COMPLETED':
-             iotests.log('Stopping the NBD server on destination...')
-             iotests.log(dest_vm.qmp('nbd-server-stop'))
-diff --git a/tests/qemu-iotests/194.out b/tests/qemu-iotests/194.out
-index 376ed1d2e6..84e0fc34be 100644
---- a/tests/qemu-iotests/194.out
-+++ b/tests/qemu-iotests/194.out
-@@ -7,7 +7,7 @@ Launching NBD server on destination...
- Starting `drive-mirror` on source...
- {"return": {}}
- Waiting for `drive-mirror` to complete...
--{"data": {"device": "mirror-job0", "len": 1073741824, "offset": 1073741824, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"data": {"device": "mirror-job0", "len": "LEN", "offset": "OFFSET", "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
- Starting migration...
- {"return": {}}
- {"execute": "migrate-start-postcopy", "arguments": {}}
-@@ -17,7 +17,7 @@ Starting migration...
- {"data": {"status": "completed"}, "event": "MIGRATION", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
- Gracefully ending the `drive-mirror` job on source...
- {"return": {}}
--{"data": {"device": "mirror-job0", "len": 1073741824, "offset": 1073741824, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"data": {"device": "mirror-job0", "len": "LEN", "offset": "OFFSET", "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
- Stopping the NBD server on destination...
- {"return": {}}
- Wait for migration completion on target...
-diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
-index c8cb028c2d..978bef1499 100644
---- a/tests/qemu-iotests/iotests.py
-+++ b/tests/qemu-iotests/iotests.py
-@@ -601,13 +601,23 @@ def filter_chown(msg):
-     return chown_re.sub("chown UID:GID", msg)
- 
- def filter_qmp_event(event):
--    '''Filter a QMP event dict'''
-+    '''Filter the timestamp of a QMP event dict'''
-     event = dict(event)
-     if 'timestamp' in event:
-         event['timestamp']['seconds'] = 'SECS'
-         event['timestamp']['microseconds'] = 'USECS'
-     return event
- 
-+def filter_block_job(event):
-+    '''Filter the offset and length of a QMP block job event dict'''
-+    event = dict(event)
-+    if 'data' in event:
-+        if 'offset' in event['data']:
-+            event['data']['offset'] = 'OFFSET'
-+        if 'len' in event['data']:
-+            event['data']['len'] = 'LEN'
-+    return event
-+
- def filter_qmp(qmsg, filter_fn):
-     '''Given a string filter, filter a QMP object's values.
-     filter_fn takes a (key, value) pair.'''
--- 
-2.48.1
-
diff --git a/kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch b/kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch
deleted file mode 100644
index 4da52ce..0000000
--- a/kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch
+++ /dev/null
@@ -1,355 +0,0 @@
-From 8a2e660ff3ec7f7506fbd4197d4dc8f53db7859a Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:28 -0500
-Subject: [PATCH 13/16] mirror: Skip writing zeroes when target is already zero
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [11/14] f6bb5e0cecee07af0389aa18c3bddb47d6c5cf54 (ebblake/centos-qemu-kvm)
-
-When mirroring, the goal is to ensure that the destination reads the
-same as the source; this goal is met whether the destination is sparse
-or fully-allocated (except when explicitly punching holes, then merely
-reading zero is not enough to know if it is sparse, so we still want
-to punch the hole).  Avoiding a redundant write to zero (whether in
-the background because the zero cluster was marked in the dirty
-bitmap, or in the foreground because the guest is writing zeroes) when
-the destination already reads as zero makes mirroring faster, and
-avoids allocating the destination merely because the source reports as
-allocated.
-
-The effect is especially pronounced when the source is a raw file.
-That's because when the source is a qcow2 file, the dirty bitmap only
-visits the portions of the source that are allocated, which tend to be
-non-zero.  But when the source is a raw file,
-bdrv_co_is_allocated_above() reports the entire file as allocated so
-mirror_dirty_init sets the entire dirty bitmap, and it is only later
-during mirror_iteration that we change to consulting the more precise
-bdrv_co_block_status_above() to learn where the source reads as zero.
-
-Remember that since a mirror operation can write a cluster more than
-once (every time the guest changes the source, the destination is also
-changed to keep up), and the guest can change whether a given cluster
-reads as zero, is discarded, or has non-zero data over the course of
-the mirror operation, we can't take the shortcut of relying on
-s->target_is_zero (which is static for the life of the job) in
-mirror_co_zero() to see if the destination is already zero, because
-that information may be stale.  Any solution we use must be dynamic in
-the face of the guest writing or discarding a cluster while the mirror
-has been ongoing.
-
-We could just teach mirror_co_zero() to do a block_status() probe of
-the destination, and skip the zeroes if the destination already reads
-as zero, but we know from past experience that extra block_status()
-calls are not always cheap (tmpfs, anyone?), especially when they are
-random access rather than linear.  Use of block_status() of the source
-by the background task in a linear fashion is not our bottleneck (it's
-a background task, after all); but since mirroring can be done while
-the source is actively being changed, we don't want a slow
-block_status() of the destination to occur on the hot path of the
-guest trying to do random-access writes to the source.
-
-So this patch takes a slightly different approach: any time we have to
-track dirty clusters, we can also track which clusters are known to
-read as zero.  For sync=TOP or when we are punching holes from
-"detect-zeroes":"unmap", the zero bitmap starts out empty, but
-prevents a second write zero to a cluster that was already zero by an
-earlier pass; for sync=FULL when we are not punching holes, the zero
-bitmap starts out full if the destination reads as zero during
-initialization.  Either way, I/O to the destination can now avoid
-redundant write zero to a cluster that already reads as zero, all
-without having to do a block_status() per write on the destination.
-
-With this patch, if I create a raw sparse destination file, connect it
-with QMP 'blockdev-add' while leaving it at the default "discard":
-"ignore", then run QMP 'blockdev-mirror' with "sync": "full", the
-destination remains sparse rather than fully allocated.  Meanwhile, a
-destination image that is already fully allocated remains so unless it
-was opened with "detect-zeroes": "unmap".  And any time writing zeroes
-is skipped, the job counters are not incremented.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250509204341.3553601-26-eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7e277545b90874171128804e256a538fb0e8dd7e)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- block/mirror.c | 107 ++++++++++++++++++++++++++++++++++++++++++-------
- 1 file changed, 93 insertions(+), 14 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 29cac1777c..7f3b5477ce 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -73,6 +73,7 @@ typedef struct MirrorBlockJob {
-     size_t buf_size;
-     int64_t bdev_length;
-     unsigned long *cow_bitmap;
-+    unsigned long *zero_bitmap;
-     BdrvDirtyBitmap *dirty_bitmap;
-     BdrvDirtyBitmapIter *dbi;
-     uint8_t *buf;
-@@ -108,9 +109,12 @@ struct MirrorOp {
-     int64_t offset;
-     uint64_t bytes;
- 
--    /* The pointee is set by mirror_co_read(), mirror_co_zero(), and
--     * mirror_co_discard() before yielding for the first time */
-+    /*
-+     * These pointers are set by mirror_co_read(), mirror_co_zero(), and
-+     * mirror_co_discard() before yielding for the first time
-+     */
-     int64_t *bytes_handled;
-+    bool *io_skipped;
- 
-     bool is_pseudo_op;
-     bool is_active_write;
-@@ -408,15 +412,34 @@ static void coroutine_fn mirror_co_read(void *opaque)
- static void coroutine_fn mirror_co_zero(void *opaque)
- {
-     MirrorOp *op = opaque;
--    int ret;
-+    bool write_needed = true;
-+    int ret = 0;
- 
-     op->s->in_flight++;
-     op->s->bytes_in_flight += op->bytes;
-     *op->bytes_handled = op->bytes;
-     op->is_in_flight = true;
- 
--    ret = blk_co_pwrite_zeroes(op->s->target, op->offset, op->bytes,
--                               op->s->unmap ? BDRV_REQ_MAY_UNMAP : 0);
-+    if (op->s->zero_bitmap) {
-+        unsigned long end = DIV_ROUND_UP(op->offset + op->bytes,
-+                                         op->s->granularity);
-+        assert(QEMU_IS_ALIGNED(op->offset, op->s->granularity));
-+        assert(QEMU_IS_ALIGNED(op->bytes, op->s->granularity) ||
-+               op->offset + op->bytes == op->s->bdev_length);
-+        if (find_next_zero_bit(op->s->zero_bitmap, end,
-+                               op->offset / op->s->granularity) == end) {
-+            write_needed = false;
-+            *op->io_skipped = true;
-+        }
-+    }
-+    if (write_needed) {
-+        ret = blk_co_pwrite_zeroes(op->s->target, op->offset, op->bytes,
-+                                   op->s->unmap ? BDRV_REQ_MAY_UNMAP : 0);
-+    }
-+    if (ret >= 0 && op->s->zero_bitmap) {
-+        bitmap_set(op->s->zero_bitmap, op->offset / op->s->granularity,
-+                   DIV_ROUND_UP(op->bytes, op->s->granularity));
-+    }
-     mirror_write_complete(op, ret);
- }
- 
-@@ -435,29 +458,43 @@ static void coroutine_fn mirror_co_discard(void *opaque)
- }
- 
- static unsigned mirror_perform(MirrorBlockJob *s, int64_t offset,
--                               unsigned bytes, MirrorMethod mirror_method)
-+                               unsigned bytes, MirrorMethod mirror_method,
-+                               bool *io_skipped)
- {
-     MirrorOp *op;
-     Coroutine *co;
-     int64_t bytes_handled = -1;
- 
-+    assert(QEMU_IS_ALIGNED(offset, s->granularity));
-+    assert(QEMU_IS_ALIGNED(bytes, s->granularity) ||
-+           offset + bytes == s->bdev_length);
-     op = g_new(MirrorOp, 1);
-     *op = (MirrorOp){
-         .s              = s,
-         .offset         = offset,
-         .bytes          = bytes,
-         .bytes_handled  = &bytes_handled,
-+        .io_skipped     = io_skipped,
-     };
-     qemu_co_queue_init(&op->waiting_requests);
- 
-     switch (mirror_method) {
-     case MIRROR_METHOD_COPY:
-+        if (s->zero_bitmap) {
-+            bitmap_clear(s->zero_bitmap, offset / s->granularity,
-+                         DIV_ROUND_UP(bytes, s->granularity));
-+        }
-         co = qemu_coroutine_create(mirror_co_read, op);
-         break;
-     case MIRROR_METHOD_ZERO:
-+        /* s->zero_bitmap handled in mirror_co_zero */
-         co = qemu_coroutine_create(mirror_co_zero, op);
-         break;
-     case MIRROR_METHOD_DISCARD:
-+        if (s->zero_bitmap) {
-+            bitmap_clear(s->zero_bitmap, offset / s->granularity,
-+                         DIV_ROUND_UP(bytes, s->granularity));
-+        }
-         co = qemu_coroutine_create(mirror_co_discard, op);
-         break;
-     default:
-@@ -568,6 +605,7 @@ static void coroutine_fn GRAPH_UNLOCKED mirror_iteration(MirrorBlockJob *s)
-         int ret;
-         int64_t io_bytes;
-         int64_t io_bytes_acct;
-+        bool io_skipped = false;
-         MirrorMethod mirror_method = MIRROR_METHOD_COPY;
- 
-         assert(!(offset % s->granularity));
-@@ -611,8 +649,10 @@ static void coroutine_fn GRAPH_UNLOCKED mirror_iteration(MirrorBlockJob *s)
-         }
- 
-         io_bytes = mirror_clip_bytes(s, offset, io_bytes);
--        io_bytes = mirror_perform(s, offset, io_bytes, mirror_method);
--        if (mirror_method != MIRROR_METHOD_COPY && write_zeroes_ok) {
-+        io_bytes = mirror_perform(s, offset, io_bytes, mirror_method,
-+                                  &io_skipped);
-+        if (io_skipped ||
-+            (mirror_method != MIRROR_METHOD_COPY && write_zeroes_ok)) {
-             io_bytes_acct = 0;
-         } else {
-             io_bytes_acct = io_bytes;
-@@ -847,8 +887,10 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-     bool punch_holes =
-         target_bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-         bdrv_can_write_zeroes_with_unmap(target_bs);
-+    int64_t bitmap_length = DIV_ROUND_UP(s->bdev_length, s->granularity);
- 
-     /* Determine if the image is already zero, regardless of sync mode.  */
-+    s->zero_bitmap = bitmap_new(bitmap_length);
-     bdrv_graph_co_rdlock();
-     bs = s->mirror_top_bs->backing->bs;
-     if (s->target_is_zero) {
-@@ -862,7 +904,14 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-     if (ret < 0) {
-         return ret;
-     } else if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
--        /* In TOP mode, there is no benefit to a pre-zeroing pass.  */
-+        /*
-+         * In TOP mode, there is no benefit to a pre-zeroing pass, but
-+         * the zero bitmap can be set if the destination already reads
-+         * as zero and we are not punching holes.
-+         */
-+        if (ret > 0 && !punch_holes) {
-+            bitmap_set(s->zero_bitmap, 0, bitmap_length);
-+        }
-     } else if (ret == 0 || punch_holes) {
-         /*
-          * Here, we are in FULL mode; our goal is to avoid writing
-@@ -871,8 +920,9 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-          * zeroing happened externally (ret > 0) or if we have a fast
-          * way to pre-zero the image (the dirty bitmap will be
-          * populated later by the non-zero portions, the same as for
--         * TOP mode).  If pre-zeroing is not fast, or we need to punch
--         * holes, then our only recourse is to write the entire image.
-+         * TOP mode).  If pre-zeroing is not fast, then our only
-+         * recourse is to mark the entire image dirty.  The act of
-+         * pre-zeroing will populate the zero bitmap.
-          */
-         if (!bdrv_can_write_zeroes_with_unmap(target_bs)) {
-             bdrv_set_dirty_bitmap(s->dirty_bitmap, 0, s->bdev_length);
-@@ -883,6 +933,7 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-         for (offset = 0; offset < s->bdev_length; ) {
-             int bytes = MIN(s->bdev_length - offset,
-                             QEMU_ALIGN_DOWN(INT_MAX, s->granularity));
-+            bool ignored;
- 
-             mirror_throttle(s);
- 
-@@ -898,12 +949,15 @@ static int coroutine_fn GRAPH_UNLOCKED mirror_dirty_init(MirrorBlockJob *s)
-                 continue;
-             }
- 
--            mirror_perform(s, offset, bytes, MIRROR_METHOD_ZERO);
-+            mirror_perform(s, offset, bytes, MIRROR_METHOD_ZERO, &ignored);
-             offset += bytes;
-         }
- 
-         mirror_wait_for_all_io(s);
-         s->initial_zeroing_ongoing = false;
-+    } else {
-+        /* In FULL mode, and image already reads as zero.  */
-+        bitmap_set(s->zero_bitmap, 0, bitmap_length);
-     }
- 
-     /* First part, loop on the sectors and initialize the dirty bitmap.  */
-@@ -1188,6 +1242,7 @@ immediate_exit:
-     assert(s->in_flight == 0);
-     qemu_vfree(s->buf);
-     g_free(s->cow_bitmap);
-+    g_free(s->zero_bitmap);
-     g_free(s->in_flight_bitmap);
-     bdrv_dirty_iter_free(s->dbi);
- 
-@@ -1367,6 +1422,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-     int ret;
-     size_t qiov_offset = 0;
-     int64_t dirty_bitmap_offset, dirty_bitmap_end;
-+    int64_t zero_bitmap_offset, zero_bitmap_end;
- 
-     if (!QEMU_IS_ALIGNED(offset, job->granularity) &&
-         bdrv_dirty_bitmap_get(job->dirty_bitmap, offset))
-@@ -1410,8 +1466,9 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-     }
- 
-     /*
--     * Tails are either clean or shrunk, so for bitmap resetting
--     * we safely align the range down.
-+     * Tails are either clean or shrunk, so for dirty bitmap resetting
-+     * we safely align the range narrower.  But for zero bitmap, round
-+     * range wider for checking or clearing, and narrower for setting.
-      */
-     dirty_bitmap_offset = QEMU_ALIGN_UP(offset, job->granularity);
-     dirty_bitmap_end = QEMU_ALIGN_DOWN(offset + bytes, job->granularity);
-@@ -1419,22 +1476,44 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-         bdrv_reset_dirty_bitmap(job->dirty_bitmap, dirty_bitmap_offset,
-                                 dirty_bitmap_end - dirty_bitmap_offset);
-     }
-+    zero_bitmap_offset = offset / job->granularity;
-+    zero_bitmap_end = DIV_ROUND_UP(offset + bytes, job->granularity);
- 
-     job_progress_increase_remaining(&job->common.job, bytes);
-     job->active_write_bytes_in_flight += bytes;
- 
-     switch (method) {
-     case MIRROR_METHOD_COPY:
-+        if (job->zero_bitmap) {
-+            bitmap_clear(job->zero_bitmap, zero_bitmap_offset,
-+                         zero_bitmap_end - zero_bitmap_offset);
-+        }
-         ret = blk_co_pwritev_part(job->target, offset, bytes,
-                                   qiov, qiov_offset, flags);
-         break;
- 
-     case MIRROR_METHOD_ZERO:
-+        if (job->zero_bitmap) {
-+            if (find_next_zero_bit(job->zero_bitmap, zero_bitmap_end,
-+                                   zero_bitmap_offset) == zero_bitmap_end) {
-+                ret = 0;
-+                break;
-+            }
-+        }
-         assert(!qiov);
-         ret = blk_co_pwrite_zeroes(job->target, offset, bytes, flags);
-+        if (job->zero_bitmap && ret >= 0) {
-+            bitmap_set(job->zero_bitmap, dirty_bitmap_offset / job->granularity,
-+                       (dirty_bitmap_end - dirty_bitmap_offset) /
-+                       job->granularity);
-+        }
-         break;
- 
-     case MIRROR_METHOD_DISCARD:
-+        if (job->zero_bitmap) {
-+            bitmap_clear(job->zero_bitmap, zero_bitmap_offset,
-+                         zero_bitmap_end - zero_bitmap_offset);
-+        }
-         assert(!qiov);
-         ret = blk_co_pdiscard(job->target, offset, bytes);
-         break;
--- 
-2.48.1
-
diff --git a/kvm-nbd-server-Silence-server-warnings-on-port-probes.patch b/kvm-nbd-server-Silence-server-warnings-on-port-probes.patch
deleted file mode 100644
index c28bb0f..0000000
--- a/kvm-nbd-server-Silence-server-warnings-on-port-probes.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 908997de5fa9470549347d66f7c8e125989fa4b1 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 15 Nov 2024 13:55:53 -0600
-Subject: [PATCH 1/3] nbd-server: Silence server warnings on port probes
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 333: nbd-server: Silence server warnings on port probes
-RH-Jira: RHEL-67863
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] c09db866ba3028702996ab1db459061cbf9e8bfa (ebblake/centos-qemu-kvm)
-
-While testing the use of qemu-nbd in a Pod of a Kubernetes cluster, I
-got LOTS of log messages of the forms:
-
-qemu-nbd: option negotiation failed: Failed to read flags: Unexpected end-of-file before all data were read
-qemu-nbd: option negotiation failed: Failed to read flags: Unable to read from socket: Connection reset by peer
-
-While it is nice to warn about clients that aren't following protocol
-(in case it helps diagnosing bugs in those clients), a mere port probe
-(where the client never write()s any bytes, and where we might even
-hit EPIPE in trying to send our greeting to the client) is NOT
-abnormal, but merely serves to pollute the log.  And Kubernetes
-_really_ likes to do port probes to determine whether a given Pod is
-up and running.
-
-Easy ways to demonstrate the above port probes:
-$ qemu-nbd -r -f raw path/to/file &
-$ nc localhost 10809 </dev/null
-$ bash -c 'exec </dev/tcp/localhost/10809'
-$ kill $!
-
-Silence the noise by not capturing errors until after our first
-successful read() from a client.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20241115195638.1132007-2-eblake@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-(cherry picked from commit efd3dda312129b91986f85976afbda58d40f757f)
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- nbd/server.c | 26 +++++++++++++++++---------
- 1 file changed, 17 insertions(+), 9 deletions(-)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index c30e687fc8..f64e47270c 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -1150,8 +1150,8 @@ nbd_negotiate_meta_queries(NBDClient *client, Error **errp)
-  * Return:
-  * -errno  on error, errp is set
-  * 0       on successful negotiation, errp is not set
-- * 1       if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
-- *         errp is not set
-+ * 1       if client sent NBD_OPT_ABORT (i.e. on valid disconnect) or never
-+ *         wrote anything (i.e. port probe); errp is not set
-  */
- static coroutine_fn int
- nbd_negotiate_options(NBDClient *client, Error **errp)
-@@ -1175,8 +1175,13 @@ nbd_negotiate_options(NBDClient *client, Error **errp)
-         ...           Rest of request
-     */
- 
--    if (nbd_read32(client->ioc, &flags, "flags", errp) < 0) {
--        return -EIO;
-+    /*
-+     * Intentionally ignore errors on this first read - we do not want
-+     * to be noisy about a mere port probe, but only for clients that
-+     * start talking the protocol and then quit abruptly.
-+     */
-+    if (nbd_read32(client->ioc, &flags, "flags", NULL) < 0) {
-+        return 1;
-     }
-     client->mode = NBD_MODE_EXPORT_NAME;
-     trace_nbd_negotiate_options_flags(flags);
-@@ -1383,8 +1388,8 @@ nbd_negotiate_options(NBDClient *client, Error **errp)
-  * Return:
-  * -errno  on error, errp is set
-  * 0       on successful negotiation, errp is not set
-- * 1       if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
-- *         errp is not set
-+ * 1       if client sent NBD_OPT_ABORT (i.e. on valid disconnect) or never
-+ *         wrote anything (i.e. port probe); errp is not set
-  */
- static coroutine_fn int nbd_negotiate(NBDClient *client, Error **errp)
- {
-@@ -1415,9 +1420,12 @@ static coroutine_fn int nbd_negotiate(NBDClient *client, Error **errp)
-     stq_be_p(buf + 8, NBD_OPTS_MAGIC);
-     stw_be_p(buf + 16, NBD_FLAG_FIXED_NEWSTYLE | NBD_FLAG_NO_ZEROES);
- 
--    if (nbd_write(client->ioc, buf, 18, errp) < 0) {
--        error_prepend(errp, "write failed: ");
--        return -EINVAL;
-+    /*
-+     * Be silent about failure to write our greeting: there is nothing
-+     * wrong with a client testing if our port is alive.
-+     */
-+    if (nbd_write(client->ioc, buf, 18, NULL) < 0) {
-+        return 1;
-     }
-     ret = nbd_negotiate_options(client, errp);
-     if (ret != 0) {
--- 
-2.48.1
-
diff --git a/kvm-nbd-server-Support-inactive-nodes.patch b/kvm-nbd-server-Support-inactive-nodes.patch
deleted file mode 100644
index c37a341..0000000
--- a/kvm-nbd-server-Support-inactive-nodes.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 77ec8365bf04afadee0a2dd7354deedd57606c54 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 4 Feb 2025 22:14:04 +0100
-Subject: [PATCH 20/23] nbd/server: Support inactive nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [19/22] 8c113dd6a862b1f4ad4e5d498f4e70a5dbfdfb32 (kmwolf/centos-qemu-kvm)
-
-In order to support running an NBD export on inactive nodes, we must
-make sure to return errors for any operations that aren't allowed on
-inactive nodes. Reads are the only operation we know we need for
-inactive images, so to err on the side of caution, return errors for
-everything else, even if some operations could possibly be okay.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Acked-by: Fabiano Rosas <farosas@suse.de>
-Message-ID: <20250204211407.381505-14-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 2e73a17c68f4d80023dc616e596e8c1f3ea8dd75)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- nbd/server.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index f64e47270c..2076fb2666 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -2026,6 +2026,7 @@ static void nbd_export_delete(BlockExport *blk_exp)
- const BlockExportDriver blk_exp_nbd = {
-     .type               = BLOCK_EXPORT_TYPE_NBD,
-     .instance_size      = sizeof(NBDExport),
-+    .supports_inactive  = true,
-     .create             = nbd_export_create,
-     .delete             = nbd_export_delete,
-     .request_shutdown   = nbd_export_request_shutdown,
-@@ -2920,6 +2921,22 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
-     NBDExport *exp = client->exp;
-     char *msg;
-     size_t i;
-+    bool inactive;
-+
-+    WITH_GRAPH_RDLOCK_GUARD() {
-+        inactive = bdrv_is_inactive(blk_bs(exp->common.blk));
-+        if (inactive) {
-+            switch (request->type) {
-+            case NBD_CMD_READ:
-+                /* These commands are allowed on inactive nodes */
-+                break;
-+            default:
-+                /* Return an error for the rest */
-+                return nbd_send_generic_reply(client, request, -EPERM,
-+                                              "export is inactive", errp);
-+            }
-+        }
-+    }
- 
-     switch (request->type) {
-     case NBD_CMD_CACHE:
--- 
-2.48.1
-
diff --git a/kvm-net-Fix-announce_self.patch b/kvm-net-Fix-announce_self.patch
deleted file mode 100644
index 7c99e5c..0000000
--- a/kvm-net-Fix-announce_self.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From ba42b9bf3f193bbc7f47d494bdc888e881539f4b Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Fri, 17 Jan 2025 12:17:08 +0100
-Subject: [PATCH 01/23] net: Fix announce_self
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 338: net: Fix announce_self
-RH-Jira: RHEL-73891
-RH-Acked-by: Eugenio Pérez <eperezma@redhat.com>
-RH-Acked-by: Cindy Lu <lulu@redhat.com>
-RH-Commit: [1/1] dfee696c1c444af0ba2b2d3d8c7012385e84885c (lvivier/qemu-kvm-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-73891
-
-b9ad513e1876 ("net: Remove receive_raw()") adds an iovec entry
-in qemu_deliver_packet_iov() to add the virtio-net header
-in the data when QEMU_NET_PACKET_FLAG_RAW is set but forgets
-to increase the number of iovec entries in the array, so
-receive_iov() will only send the first entry (the virtio-net
-entry, full of 0) and no data. The packet will be discarded.
-
-The only user of QEMU_NET_PACKET_FLAG_RAW is announce_self.
-
-We can see the problem with tcpdump:
-
-- QEMU parameters:
-
-  .. -monitor stdio \
-     -netdev bridge,id=netdev0,br=virbr0 \
-     -device virtio-net,mac=9a:2b:2c:2d:2e:2f,netdev=netdev0 \
-
-- HMP command:
-
-  (qemu) announce_self
-
-- TCP dump:
-
-  $ sudo tcpdump -nxi virbr0
-
-  without the fix:
-
-    <nothing>
-
-  with the fix:
-
-   ARP, Reverse Request who-is 9a:2b:2c:2d:2e:2f tell 9a:2b:2c:2d:2e:2f, length 46
-        0x0000:  0001 0800 0604 0003 9a2b 2c2d 2e2f 0000
-        0x0010:  0000 9a2b 2c2d 2e2f 0000 0000 0000 0000
-        0x0020:  0000 0000 0000 0000 0000 0000 0000
-
-Reported-by: Xiaohui Li <xiaohli@redhat.com>
-Bug: https://issues.redhat.com/browse/RHEL-73891
-Fixes: b9ad513e1876 ("net: Remove receive_raw()")
-Cc: akihiko.odaki@daynix.com
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-(cherry picked from commit 84dfdcbff33fff185528501be408c25c44499f32)
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
----
- net/net.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/net/net.c b/net/net.c
-index fc1125111c..94f51b6e5f 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -828,6 +828,7 @@ static ssize_t qemu_deliver_packet_iov(NetClientState *sender,
-         iov_copy[0].iov_len =  nc->vnet_hdr_len;
-         memcpy(&iov_copy[1], iov, iovcnt * sizeof(*iov));
-         iov = iov_copy;
-+        iovcnt++;
-     }
- 
-     if (nc->info->receive_iov) {
--- 
-2.48.1
-
diff --git a/kvm-net-socket-skip-automatic-zero-init-of-large-array.patch b/kvm-net-socket-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index f5361cf..0000000
--- a/kvm-net-socket-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 4b9a1a9154467fd65ac2a0a26959d3342d8fcd49 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:08 +0100
-Subject: [PATCH 55/57] net/socket: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [29/30] 645ad4d138d1222ea9bd1b2ac3b84d9ff83e2fa2 (stefanha/centos-stream-qemu-kvm)
-
-The 'net_socket_send' method has a 68k byte array used for copying
-data between guest and host. Skip the automatic zero-init of this
-array to eliminate the performance overhead in the I/O hot path.
-
-The 'buf1' array will be fully initialized when reading data off
-the network socket.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-31-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 751b0e79f1e0e7f88fad2fe2f22595ad03d78859)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- net/socket.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/socket.c b/net/socket.c
-index 8e3702e1f3..784dda686f 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -157,7 +157,7 @@ static void net_socket_send(void *opaque)
-     NetSocketState *s = opaque;
-     int size;
-     int ret;
--    uint8_t buf1[NET_BUFSIZE];
-+    QEMU_UNINITIALIZED uint8_t buf1[NET_BUFSIZE];
-     const uint8_t *buf;
- 
-     size = recv(s->fd, buf1, sizeof(buf1), 0);
--- 
-2.39.3
-
diff --git a/kvm-net-stream-skip-automatic-zero-init-of-large-array.patch b/kvm-net-stream-skip-automatic-zero-init-of-large-array.patch
deleted file mode 100644
index e9abf3f..0000000
--- a/kvm-net-stream-skip-automatic-zero-init-of-large-array.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 94310a4168257297e52058d5d6aea4a2d06630c6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 10 Jun 2025 13:37:09 +0100
-Subject: [PATCH 56/57] net/stream: skip automatic zero-init of large array
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 382: Solve -ftrivial-auto-var-init performance regression with QEMU_UNINITIALIZED
-RH-Jira: RHEL-99888
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [30/30] 9dfec5c0e6358e3557bf58d66eee8e4ba6e93621 (stefanha/centos-stream-qemu-kvm)
-
-The 'net_stream_send' method has a 68k byte array used for copying
-data between guest and host. Skip the automatic zero-init of this
-array to eliminate the performance overhead in the I/O hot path.
-
-The 'buf1' array will be fully initialized when reading data off
-the network socket.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
-Message-id: 20250610123709.835102-32-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 837b87c4c5ba9ac7a255133c6642b8d578272a70)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- net/stream.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/stream.c b/net/stream.c
-index 97e6ec6679..12384ffee5 100644
---- a/net/stream.c
-+++ b/net/stream.c
-@@ -148,7 +148,7 @@ static gboolean net_stream_send(QIOChannel *ioc,
-     NetStreamState *s = data;
-     int size;
-     int ret;
--    char buf1[NET_BUFSIZE];
-+    QEMU_UNINITIALIZED char buf1[NET_BUFSIZE];
-     const char *buf;
- 
-     size = qio_channel_read(s->ioc, buf1, sizeof(buf1), NULL);
--- 
-2.39.3
-
diff --git a/kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch b/kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch
deleted file mode 100644
index a792e7c..0000000
--- a/kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From b6de1e19ba778547e92997c6cad77d7cf755c78b Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Mon, 17 Feb 2025 10:25:50 +0100
-Subject: [PATCH 1/3] net: vhost-user: add QAPI events to report connection
- state
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 371: net: vhost-user: add QAPI events to report connection state
-RH-Jira: RHEL-95120
-RH-Acked-by: Eugenio Pérez <eperezma@redhat.com>
-RH-Acked-by: Cindy Lu <lulu@redhat.com>
-RH-Commit: [1/1] c8f65026e3548891fe713a1622438388e285dbf3 (lvivier/qemu-kvm-centos)
-
-The netdev reports NETDEV_VHOST_USER_CONNECTED event when
-the chardev is connected, and NETDEV_VHOST_USER_DISCONNECTED
-when it is disconnected.
-
-The NETDEV_VHOST_USER_CONNECTED event includes the chardev id.
-
-This allows a system manager like libvirt to detect when the server
-fails.
-
-For instance with passt:
-
-{ 'execute': 'qmp_capabilities' }
-{ "return": { } }
-
-[killing passt here]
-
-{ "timestamp": { "seconds": 1739538634, "microseconds": 920450 },
-  "event": "NETDEV_VHOST_USER_DISCONNECTED",
-  "data": { "netdev-id": "netdev0" } }
-
-[automatic reconnection with reconnect-ms]
-
-{ "timestamp": { "seconds": 1739538638, "microseconds": 354181 },
-  "event": "NETDEV_VHOST_USER_CONNECTED",
-  "data": { "netdev-id": "netdev0", "chardev-id": "chr0" } }
-
-Tested-by: Stefano Brivio <sbrivio@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Message-Id: <20250217092550.1172055-1-lvivier@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 02fd9f8aeeb184276b283ae2f404bc3acf1e7b7a)
----
- net/vhost-user.c |  3 +++
- qapi/net.json    | 40 ++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 43 insertions(+)
-
-diff --git a/net/vhost-user.c b/net/vhost-user.c
-index 12555518e8..0b235e50c6 100644
---- a/net/vhost-user.c
-+++ b/net/vhost-user.c
-@@ -16,6 +16,7 @@
- #include "chardev/char-fe.h"
- #include "qapi/error.h"
- #include "qapi/qapi-commands-net.h"
-+#include "qapi/qapi-events-net.h"
- #include "qemu/config-file.h"
- #include "qemu/error-report.h"
- #include "qemu/option.h"
-@@ -271,6 +272,7 @@ static void chr_closed_bh(void *opaque)
-     if (err) {
-         error_report_err(err);
-     }
-+    qapi_event_send_netdev_vhost_user_disconnected(name);
- }
- 
- static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
-@@ -300,6 +302,7 @@ static void net_vhost_user_event(void *opaque, QEMUChrEvent event)
-                                          net_vhost_user_watch, s);
-         qmp_set_link(name, true, &err);
-         s->started = true;
-+        qapi_event_send_netdev_vhost_user_connected(name, chr->label);
-         break;
-     case CHR_EVENT_CLOSED:
-         /* a close event may happen during a read/write, but vhost
-diff --git a/qapi/net.json b/qapi/net.json
-index 87fc0d0b28..7bd1eaa1ba 100644
---- a/qapi/net.json
-+++ b/qapi/net.json
-@@ -1020,3 +1020,43 @@
- ##
- { 'event': 'NETDEV_STREAM_DISCONNECTED',
-   'data': { 'netdev-id': 'str' } }
-+
-+##
-+# @NETDEV_VHOST_USER_CONNECTED:
-+#
-+# Emitted when the vhost-user chardev is connected
-+#
-+# @netdev-id: QEMU netdev id that is connected
-+#
-+# @chardev-id: The character device id used by the QEMU netdev
-+#
-+# Since: 10.0
-+#
-+# .. qmp-example::
-+#
-+#     <- { "timestamp": {"seconds": 1739538638, "microseconds": 354181 },
-+#          "event": "NETDEV_VHOST_USER_CONNECTED",
-+#          "data": { "netdev-id": "netdev0", "chardev-id": "chr0" } }
-+#
-+##
-+{ 'event': 'NETDEV_VHOST_USER_CONNECTED',
-+  'data': { 'netdev-id': 'str', 'chardev-id': 'str' } }
-+
-+##
-+# @NETDEV_VHOST_USER_DISCONNECTED:
-+#
-+# Emitted when the vhost-user chardev is disconnected
-+#
-+# @netdev-id: QEMU netdev id that is disconnected
-+#
-+# Since: 10.0
-+#
-+# .. qmp-example::
-+#
-+#     <- { "timestamp": { "seconds": 1739538634, "microseconds": 920450 },
-+#          "event": "NETDEV_VHOST_USER_DISCONNECTED",
-+#          "data": { "netdev-id": "netdev0" } }
-+#
-+##
-+{ 'event': 'NETDEV_VHOST_USER_DISCONNECTED',
-+  'data': { 'netdev-id': 'str' } }
--- 
-2.48.1
-
diff --git a/kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch b/kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
deleted file mode 100644
index 204b045..0000000
--- a/kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From df7e7db91357db9f4abd07d2bc5fb44216a2f286 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Fri, 17 Jan 2025 16:22:35 -0500
-Subject: [PATCH 1/4] pc-bios/s390-ccw: Abort IPL on invalid loadparm
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 332: Fix boot problems when falling back from network to another boot device on s390x  [RHEL9]
-RH-Jira: RHEL-72716
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/4] 4d19e5051374f8939bc86c5fc9eb02dede6d83d3 (thuth/qemu-kvm-cs)
-
-Because the loadparm specifies an exact kernel the user wants to boot, if the
-loadparm is invalid it must represent a misconfiguration of the guest. Thus we
-should abort the IPL immediately, without attempting to use other devices, to
-avoid booting into an unintended guest image.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20250117212235.1324063-2-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 64fa0de46ee3cc972af5d3ce8c5dc0db8198cd2b)
----
- pc-bios/s390-ccw/bootmap.c | 15 +++++++++------
- 1 file changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index 56f2f75640..0f8baa0198 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -336,8 +336,7 @@ static int run_eckd_boot_script(block_number_t bmt_block_nr,
- 
-     debug_print_int("loadparm", loadparm);
-     if (loadparm >= MAX_BOOT_ENTRIES) {
--        puts("loadparm value greater than max number of boot entries allowed");
--        return -EINVAL;
-+        panic("loadparm value greater than max number of boot entries allowed");
-     }
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
-@@ -348,8 +347,8 @@ static int run_eckd_boot_script(block_number_t bmt_block_nr,
- 
-     block_nr = gen_eckd_block_num(&bmt->entry[loadparm].xeckd, ldipl);
-     if (block_nr == NULL_BLOCK_NR) {
--        puts("Cannot find Boot Map Table Entry");
--        return -EIO;
-+        printf("The requested boot entry (%d) is invalid\n", loadparm);
-+        panic("Invalid loadparm");
-     }
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
-@@ -792,8 +791,12 @@ static int ipl_scsi(void)
- 
-     debug_print_int("loadparm", loadparm);
-     if (loadparm >= MAX_BOOT_ENTRIES) {
--        puts("loadparm value greater than max number of boot entries allowed");
--        return -EINVAL;
-+        panic("loadparm value greater than max number of boot entries allowed");
-+    }
-+
-+    if (!valid_entries[loadparm]) {
-+        printf("The requested boot entry (%d) is invalid\n", loadparm);
-+        panic("Invalid loadparm");
-     }
- 
-     return zipl_run(&prog_table->entry[loadparm].scsi);
--- 
-2.48.0
-
diff --git a/kvm-pc-bios-s390-ccw-Clarify-alignment-is-in-bytes.patch b/kvm-pc-bios-s390-ccw-Clarify-alignment-is-in-bytes.patch
deleted file mode 100644
index 83c0a3c..0000000
--- a/kvm-pc-bios-s390-ccw-Clarify-alignment-is-in-bytes.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 77dab9f12b3c4cdaacea1dff687cf1c49e95f304 Mon Sep 17 00:00:00 2001
-From: Jens Remus <jremus@linux.ibm.com>
-Date: Tue, 1 Oct 2024 17:36:16 +0200
-Subject: [PATCH 21/27] pc-bios/s390-ccw: Clarify alignment is in bytes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [21/23] d00be9e7c87cb047d20b729f2ac539fe624f5ce0 (thuth/qemu-kvm-cs9)
-
-The assembler directive .align [1] has architecture-dependent behavior,
-which may be ambiguous for the reader. Some architectures perform the
-alignment in bytes, others in power of two. s390 does in bytes.
-
-Use the directive .balign [2] instead, to clarify that the alignment
-request is in bytes. No functional change.
-
-[1] https://sourceware.org/binutils/docs/as/Align.html
-[2] https://sourceware.org/binutils/docs/as/Balign.html
-
-Signed-off-by: Jens Remus <jremus@linux.ibm.com>
-Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
-Message-ID: <20241001153618.17791-2-mhartmay@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit c58df213af7ec8924d219025a593b8f3ac475f16)
----
- pc-bios/s390-ccw/start.S | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
-index 061b06591c..576fc12c06 100644
---- a/pc-bios/s390-ccw/start.S
-+++ b/pc-bios/s390-ccw/start.S
-@@ -112,7 +112,7 @@ io_new_code:
-     lctlg   %c6,%c6,0(%r15)
-     br      %r14
- 
--    .align  8
-+    .balign 8
- bss_start_literal:
-     .quad   __bss_start
- disabled_wait_psw:
-@@ -125,7 +125,7 @@ io_new_mask:
-     .quad   0x0000000180000000
- 
- .bss
--    .align  8
-+    .balign 8
- stack:
-     .space  STACK_SIZE
-     .size   stack,STACK_SIZE
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Don-t-generate-TEXTRELs.patch b/kvm-pc-bios-s390-ccw-Don-t-generate-TEXTRELs.patch
deleted file mode 100644
index 95d42fc..0000000
--- a/kvm-pc-bios-s390-ccw-Don-t-generate-TEXTRELs.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 7a5f9ea3bb8ff78bd93eb2cee9b8be876e745346 Mon Sep 17 00:00:00 2001
-From: Jens Remus <jremus@linux.ibm.com>
-Date: Tue, 1 Oct 2024 17:36:17 +0200
-Subject: [PATCH 22/27] pc-bios/s390-ccw: Don't generate TEXTRELs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [22/23] 8d8b2959be6c798f24e1991252fe6c680a6c6025 (thuth/qemu-kvm-cs9)
-
-Commit 7cd50cbe4ca3 ("pc-bios/s390-ccw: Don't use __bss_start with the
-"larl" instruction") introduced the address constant bss_start_literal
-for __bss_start in the .text section, which introduced a relocation in
-code (i.e. TEXTREL). The dedicated constant is required, as __bss_start
-may not necessarily be aligned on a 2-byte boundary (see subject commit
-for details).
-
-Move the constant to the .data section to get rid of the relocation in
-the .text section. Add the linker option -z text to prevent TEXTRELs to
-get introduced in the future.
-
-Note that the R_390_RELATIVE relocations are taken care of by function
-glue() in include/hw/elf_ops.h.inc introduced by commit 5dce07e1cb67
-("elf-loader: Provide the possibility to relocate s390 ELF files").
-
-Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
-Signed-off-by: Jens Remus <jremus@linux.ibm.com>
-Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
-Message-ID: <20241001153618.17791-3-mhartmay@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 3259b4424a85d9cdfd1a33ed6030a6c51c1b9b8b)
----
- pc-bios/s390-ccw/Makefile | 2 +-
- pc-bios/s390-ccw/start.S  | 7 +++++--
- 2 files changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index db9e8f0892..38254e22df 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -46,7 +46,7 @@ EXTRA_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
- EXTRA_CFLAGS += -msoft-float
- EXTRA_CFLAGS += -std=gnu99
- EXTRA_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
--LDFLAGS += -Wl,-pie -nostdlib -z noexecstack
-+LDFLAGS += -Wl,-pie -nostdlib -z noexecstack -z text
- 
- cc-test = $(CC) -Werror $1 -c -o /dev/null -xc /dev/null >/dev/null 2>/dev/null
- cc-option = if $(call cc-test, $1); then \
-diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
-index 576fc12c06..b70213e412 100644
---- a/pc-bios/s390-ccw/start.S
-+++ b/pc-bios/s390-ccw/start.S
-@@ -113,8 +113,6 @@ io_new_code:
-     br      %r14
- 
-     .balign 8
--bss_start_literal:
--    .quad   __bss_start
- disabled_wait_psw:
-     .quad   0x0002000180000000,0x0000000000000000
- enabled_wait_psw:
-@@ -124,6 +122,11 @@ external_new_mask:
- io_new_mask:
-     .quad   0x0000000180000000
- 
-+.data
-+    .balign 8
-+bss_start_literal:
-+    .quad   __bss_start
-+
- .bss
-     .balign 8
- stack:
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Enable-failed-IPL-to-return-after-e.patch b/kvm-pc-bios-s390-ccw-Enable-failed-IPL-to-return-after-e.patch
deleted file mode 100644
index b513e7d..0000000
--- a/kvm-pc-bios-s390-ccw-Enable-failed-IPL-to-return-after-e.patch
+++ /dev/null
@@ -1,426 +0,0 @@
-From 41a56360a0f4124252180132e28c166792ee8853 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:46 -0400
-Subject: [PATCH 13/27] pc-bios/s390-ccw: Enable failed IPL to return after
- error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [13/23] c86e8a72a631081348e88ac1df99c2eec8ca27dd (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from IPL functions such that a return code is propagated
-back to the main IPL calling function (rather than terminating immediately),
-which facilitates possible error recovery in the future.
-
-A select few panics remain, which indicate fatal non-devices errors that must
-result in termination.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-13-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 0181e23713114fd4c33326c3372aaf48dcfb412a)
----
- pc-bios/s390-ccw/bootmap.c       | 53 ++++++++++++++++++--------
- pc-bios/s390-ccw/cio.c           |  3 +-
- pc-bios/s390-ccw/jump2ipl.c      |  5 ++-
- pc-bios/s390-ccw/main.c          | 32 +++++++++-------
- pc-bios/s390-ccw/s390-ccw.h      |  2 +-
- pc-bios/s390-ccw/virtio-blkdev.c |  2 +-
- pc-bios/s390-ccw/virtio.c        | 65 +++++++++++++++++++++-----------
- pc-bios/s390-ccw/virtio.h        |  2 +-
- 8 files changed, 108 insertions(+), 56 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index 95ef9104d0..56f2f75640 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -62,15 +62,34 @@ static void *s2_prev_blk = _s2;
- static void *s2_cur_blk = _s2 + MAX_SECTOR_SIZE;
- static void *s2_next_blk = _s2 + MAX_SECTOR_SIZE * 2;
- 
--static inline void verify_boot_info(BootInfo *bip)
-+static inline int verify_boot_info(BootInfo *bip)
- {
--    IPL_assert(magic_match(bip->magic, ZIPL_MAGIC), "No zIPL sig in BootInfo");
--    IPL_assert(bip->version == BOOT_INFO_VERSION, "Wrong zIPL version");
--    IPL_assert(bip->bp_type == BOOT_INFO_BP_TYPE_IPL, "DASD is not for IPL");
--    IPL_assert(bip->dev_type == BOOT_INFO_DEV_TYPE_ECKD, "DASD is not ECKD");
--    IPL_assert(bip->flags == BOOT_INFO_FLAGS_ARCH, "Not for this arch");
--    IPL_assert(block_size_ok(bip->bp.ipl.bm_ptr.eckd.bptr.size),
--               "Bad block size in zIPL section of the 1st record.");
-+    if (!magic_match(bip->magic, ZIPL_MAGIC)) {
-+        puts("No zIPL sig in BootInfo");
-+        return -EINVAL;
-+    }
-+    if (bip->version != BOOT_INFO_VERSION) {
-+        puts("Wrong zIPL version");
-+        return -EINVAL;
-+    }
-+    if (bip->bp_type != BOOT_INFO_BP_TYPE_IPL) {
-+        puts("DASD is not for IPL");
-+        return -ENODEV;
-+    }
-+    if (bip->dev_type != BOOT_INFO_DEV_TYPE_ECKD) {
-+        puts("DASD is not ECKD");
-+        return -ENODEV;
-+    }
-+    if (bip->flags != BOOT_INFO_FLAGS_ARCH) {
-+        puts("Not for this arch");
-+        return -EINVAL;
-+    }
-+    if (!block_size_ok(bip->bp.ipl.bm_ptr.eckd.bptr.size)) {
-+        puts("Bad block size in zIPL section of 1st record");
-+        return -EINVAL;
-+    }
-+
-+    return 0;
- }
- 
- static void eckd_format_chs(ExtEckdBlockPtr *ptr,  bool ldipl,
-@@ -367,8 +386,8 @@ static int run_eckd_boot_script(block_number_t bmt_block_nr,
-         puts("Unknown script entry type");
-         return -EINVAL;
-     }
--    write_reset_psw(bms->entry[i].address.load_address); /* no return */
--    jump_to_IPL_code(0); /* no return */
-+    write_reset_psw(bms->entry[i].address.load_address);
-+    jump_to_IPL_code(0);
-     return -1;
- }
- 
-@@ -1067,16 +1086,19 @@ void zipl_load(void)
- 
-     if (vdev->is_cdrom) {
-         ipl_iso_el_torito();
--        panic("\n! Cannot IPL this ISO image !\n");
-+        puts("Failed to IPL this ISO image!");
-+        return;
-     }
- 
-     if (virtio_get_device_type() == VIRTIO_ID_NET) {
-         netmain();
--        panic("\n! Cannot IPL from this network !\n");
-+        puts("Failed to IPL from this network!");
-+        return;
-     }
- 
-     if (ipl_scsi()) {
--        panic("\n! Cannot IPL this SCSI device !\n");
-+        puts("Failed to IPL from this SCSI device!");
-+        return;
-     }
- 
-     switch (virtio_get_device_type()) {
-@@ -1087,8 +1109,9 @@ void zipl_load(void)
-         zipl_load_vscsi();
-         break;
-     default:
--        panic("\n! Unknown IPL device type !\n");
-+        puts("Unknown IPL device type!");
-+        return;
-     }
- 
--    puts("zIPL load failed.");
-+    puts("zIPL load failed!");
- }
-diff --git a/pc-bios/s390-ccw/cio.c b/pc-bios/s390-ccw/cio.c
-index 7b09a38c96..5d543da73f 100644
---- a/pc-bios/s390-ccw/cio.c
-+++ b/pc-bios/s390-ccw/cio.c
-@@ -59,7 +59,8 @@ uint16_t cu_type(SubChannelId schid)
-     };
- 
-     if (do_cio(schid, CU_TYPE_UNKNOWN, ptr2u32(&sense_id_ccw), CCW_FMT1)) {
--        panic("Failed to run SenseID CCw\n");
-+        puts("Failed to run SenseID CCW");
-+        return CU_TYPE_UNKNOWN;
-     }
- 
-     return sense_data.cu_type;
-diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
-index 80b7f6a1f3..8db1764ff3 100644
---- a/pc-bios/s390-ccw/jump2ipl.c
-+++ b/pc-bios/s390-ccw/jump2ipl.c
-@@ -33,7 +33,7 @@ static void jump_to_IPL_addr(void)
-     /* should not return */
- }
- 
--void jump_to_IPL_code(uint64_t address)
-+int jump_to_IPL_code(uint64_t address)
- {
-     /* store the subsystem information _after_ the bootmap was loaded */
-     write_subsystem_identification();
-@@ -68,7 +68,8 @@ void jump_to_IPL_code(uint64_t address)
-     asm volatile("lghi %%r1,1\n\t"
-                  "diag %%r1,%%r1,0x308\n\t"
-                  : : : "1", "memory");
--    panic("\n! IPL returns !\n");
-+    puts("IPL code jump failed");
-+    return -1;
- }
- 
- void jump_to_low_kernel(void)
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index fc44da3161..34ef27d7a6 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -77,6 +77,9 @@ static int is_dev_possibly_bootable(int dev_no, int sch_no)
- 
-     enable_subchannel(blk_schid);
-     cutype = cu_type(blk_schid);
-+    if (cutype == CU_TYPE_UNKNOWN) {
-+        return -EIO;
-+    }
- 
-     /*
-      * Note: we always have to run virtio_is_supported() here to make
-@@ -194,10 +197,10 @@ static void boot_setup(void)
-     have_iplb = store_iplb(&iplb);
- }
- 
--static void find_boot_device(void)
-+static bool find_boot_device(void)
- {
-     VDev *vdev = virtio_get_device();
--    bool found;
-+    bool found = false;
- 
-     switch (iplb.pbt) {
-     case S390_IPL_TYPE_CCW:
-@@ -215,10 +218,10 @@ static void find_boot_device(void)
-         found = find_subch(iplb.scsi.devno);
-         break;
-     default:
--        panic("List-directed IPL not supported yet!\n");
-+        puts("Unsupported IPLB");
-     }
- 
--    IPL_assert(found, "Boot device not found\n");
-+    return found;
- }
- 
- static int virtio_setup(void)
-@@ -244,11 +247,13 @@ static int virtio_setup(void)
-         ret = virtio_scsi_setup_device(blk_schid);
-         break;
-     default:
--        panic("\n! No IPL device available !\n");
-+        puts("\n! No IPL device available !\n");
-+        return -1;
-     }
- 
--    if (!ret) {
--        IPL_assert(virtio_ipl_disk_is_valid(), "No valid IPL device detected");
-+    if (!ret && !virtio_ipl_disk_is_valid()) {
-+        puts("No valid IPL device detected");
-+        return -ENODEV;
-     }
- 
-     return ret;
-@@ -259,16 +264,16 @@ static void ipl_boot_device(void)
-     switch (cutype) {
-     case CU_TYPE_DASD_3990:
-     case CU_TYPE_DASD_2107:
--        dasd_ipl(blk_schid, cutype); /* no return */
-+        dasd_ipl(blk_schid, cutype);
-         break;
-     case CU_TYPE_VIRTIO:
--        if (virtio_setup() == 0) {
--            zipl_load();             /* Only returns in case of errors */
-+        if (virtio_setup()) {
-+            return;    /* Only returns in case of errors */
-         }
-+        zipl_load();
-         break;
-     default:
-         printf("Attempting to boot from unexpected device type 0x%X\n", cutype);
--        panic("\nBoot failed.\n");
-     }
- }
- 
-@@ -301,12 +306,11 @@ void main(void)
-     sclp_setup();
-     css_setup();
-     boot_setup();
--    if (have_iplb) {
--        find_boot_device();
-+    if (have_iplb && find_boot_device()) {
-         ipl_boot_device();
-     } else {
-         probe_boot_device();
-     }
- 
--    panic("Failed to load OS from hard disk\n");
-+    panic("Failed to IPL. Halting...");
- }
-diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
-index 344ad15655..6cdce3e5e5 100644
---- a/pc-bios/s390-ccw/s390-ccw.h
-+++ b/pc-bios/s390-ccw/s390-ccw.h
-@@ -78,7 +78,7 @@ void zipl_load(void);
- 
- /* jump2ipl.c */
- void write_reset_psw(uint64_t psw);
--void jump_to_IPL_code(uint64_t address);
-+int jump_to_IPL_code(uint64_t address);
- void jump_to_low_kernel(void);
- 
- /* menu.c */
-diff --git a/pc-bios/s390-ccw/virtio-blkdev.c b/pc-bios/s390-ccw/virtio-blkdev.c
-index 1c585f034b..7b2d1e20f4 100644
---- a/pc-bios/s390-ccw/virtio-blkdev.c
-+++ b/pc-bios/s390-ccw/virtio-blkdev.c
-@@ -59,7 +59,7 @@ int virtio_read_many(unsigned long sector, void *load_addr, int sec_num)
-     case VIRTIO_ID_SCSI:
-         return virtio_scsi_read_many(vdev, sector, load_addr, sec_num);
-     }
--    panic("\n! No readable IPL device !\n");
-+
-     return -1;
- }
- 
-diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
-index 8c6b0a8a92..8b5a370bb3 100644
---- a/pc-bios/s390-ccw/virtio.c
-+++ b/pc-bios/s390-ccw/virtio.c
-@@ -217,16 +217,19 @@ int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd)
-     return 0;
- }
- 
--void virtio_setup_ccw(VDev *vdev)
-+int virtio_setup_ccw(VDev *vdev)
- {
--    int i, rc, cfg_size = 0;
-+    int i, cfg_size = 0;
-     uint8_t status;
-     struct VirtioFeatureDesc {
-         uint32_t features;
-         uint8_t index;
-     } __attribute__((packed)) feats;
- 
--    IPL_assert(virtio_is_supported(vdev->schid), "PE");
-+    if (!virtio_is_supported(vdev->schid)) {
-+        puts("Virtio unsupported for this device ID");
-+        return -ENODEV;
-+    }
-     /* device ID has been established now */
- 
-     vdev->config.blk.blk_size = 0; /* mark "illegal" - setup started... */
-@@ -235,8 +238,10 @@ void virtio_setup_ccw(VDev *vdev)
-     run_ccw(vdev, CCW_CMD_VDEV_RESET, NULL, 0, false);
- 
-     status = VIRTIO_CONFIG_S_ACKNOWLEDGE;
--    rc = run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false);
--    IPL_assert(rc == 0, "Could not write ACKNOWLEDGE status to host");
-+    if (run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false)) {
-+        puts("Could not write ACKNOWLEDGE status to host");
-+        return -EIO;
-+    }
- 
-     switch (vdev->senseid.cu_model) {
-     case VIRTIO_ID_NET:
-@@ -255,27 +260,37 @@ void virtio_setup_ccw(VDev *vdev)
-         cfg_size = sizeof(vdev->config.scsi);
-         break;
-     default:
--        panic("Unsupported virtio device\n");
-+        puts("Unsupported virtio device");
-+        return -ENODEV;
-     }
- 
-     status |= VIRTIO_CONFIG_S_DRIVER;
--    rc = run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false);
--    IPL_assert(rc == 0, "Could not write DRIVER status to host");
-+    if (run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false)) {
-+        puts("Could not write DRIVER status to host");
-+        return -EIO;
-+    }
- 
-     /* Feature negotiation */
-     for (i = 0; i < ARRAY_SIZE(vdev->guest_features); i++) {
-         feats.features = 0;
-         feats.index = i;
--        rc = run_ccw(vdev, CCW_CMD_READ_FEAT, &feats, sizeof(feats), false);
--        IPL_assert(rc == 0, "Could not get features bits");
-+        if (run_ccw(vdev, CCW_CMD_READ_FEAT, &feats, sizeof(feats), false)) {
-+            puts("Could not get features bits");
-+            return -EIO;
-+        }
-+
-         vdev->guest_features[i] &= bswap32(feats.features);
-         feats.features = bswap32(vdev->guest_features[i]);
--        rc = run_ccw(vdev, CCW_CMD_WRITE_FEAT, &feats, sizeof(feats), false);
--        IPL_assert(rc == 0, "Could not set features bits");
-+        if (run_ccw(vdev, CCW_CMD_WRITE_FEAT, &feats, sizeof(feats), false)) {
-+            puts("Could not set features bits");
-+            return -EIO;
-+        }
-     }
- 
--    rc = run_ccw(vdev, CCW_CMD_READ_CONF, &vdev->config, cfg_size, false);
--    IPL_assert(rc == 0, "Could not get virtio device configuration");
-+    if (run_ccw(vdev, CCW_CMD_READ_CONF, &vdev->config, cfg_size, false)) {
-+        puts("Could not get virtio device configuration");
-+        return -EIO;
-+    }
- 
-     for (i = 0; i < vdev->nr_vqs; i++) {
-         VqInfo info = {
-@@ -289,19 +304,27 @@ void virtio_setup_ccw(VDev *vdev)
-             .num = 0,
-         };
- 
--        rc = run_ccw(vdev, CCW_CMD_READ_VQ_CONF, &config, sizeof(config), false);
--        IPL_assert(rc == 0, "Could not get virtio device VQ configuration");
-+        if (run_ccw(vdev, CCW_CMD_READ_VQ_CONF, &config, sizeof(config),
-+                false)) {
-+            puts("Could not get virtio device VQ config");
-+            return -EIO;
-+        }
-         info.num = config.num;
-         vring_init(&vdev->vrings[i], &info);
-         vdev->vrings[i].schid = vdev->schid;
--        IPL_assert(
--            run_ccw(vdev, CCW_CMD_SET_VQ, &info, sizeof(info), false) == 0,
--            "Cannot set VQ info");
-+        if (run_ccw(vdev, CCW_CMD_SET_VQ, &info, sizeof(info), false)) {
-+            puts("Cannot set VQ info");
-+            return -EIO;
-+        }
-     }
- 
-     status |= VIRTIO_CONFIG_S_DRIVER_OK;
--    rc = run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false);
--    IPL_assert(rc == 0, "Could not write DRIVER_OK status to host");
-+    if (run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false)) {
-+        puts("Could not write DRIVER_OK status to host");
-+        return -EIO;
-+    }
-+
-+    return 0;
- }
- 
- bool virtio_is_supported(SubChannelId schid)
-diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
-index 6f9a558ff5..9faf3986b1 100644
---- a/pc-bios/s390-ccw/virtio.h
-+++ b/pc-bios/s390-ccw/virtio.h
-@@ -274,7 +274,7 @@ void vring_send_buf(VRing *vr, void *p, int len, int flags);
- int vr_poll(VRing *vr);
- int vring_wait_reply(void);
- int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd);
--void virtio_setup_ccw(VDev *vdev);
-+int virtio_setup_ccw(VDev *vdev);
- 
- int virtio_net_init(void *mac_addr);
- 
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch b/kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
deleted file mode 100644
index ef42b92..0000000
--- a/kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From 7059f85f0f29707de0115cd05d951592137d9814 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 16 Jan 2025 12:58:25 +0100
-Subject: [PATCH 3/4] pc-bios/s390-ccw: Fix boot problem with virtio-net
- devices
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 332: Fix boot problems when falling back from network to another boot device on s390x  [RHEL9]
-RH-Jira: RHEL-72716
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [3/4] e7428f24f109aeade9fe0622ecc259dd251cd08e (thuth/qemu-kvm-cs)
-
-When we are trying to boot from virtio-net devices, the
-s390-ccw bios currently leaves the virtio-net device enabled
-after using it. That means that the receiving virt queues will
-continue to happily write incoming network packets into memory.
-This can corrupt data of the following boot process. For example,
-if you set up a second guest on a virtual network and create a
-lot of broadcast traffic there, e.g. with:
-
- ping -i 0.02 -s 1400  -b 192.168.1.255
-
-and then you try to boot a guest with two boot devices, a network
-device first (which should not be bootable) and e.g. a bootable SCSI
-CD second, then this guest will fail to load the kernel from the CD
-image:
-
- $ qemu-system-s390x -m 2G -nographic -device virtio-scsi-ccw \
-    -netdev tap,id=net0 -device virtio-net-ccw,netdev=net0,bootindex=1 \
-    -drive if=none,file=test.iso,format=raw,id=cd1 \
-    -device scsi-cd,drive=cd1,bootindex=2
- LOADPARM=[        ]
-
- Network boot device detected
- Network boot starting...
-   Using MAC address: 52:54:00:12:34:56
-   Requesting information via DHCP: done
-   Using IPv4 address: 192.168.1.76
-   Using TFTP server: 192.168.1.1
- Trying pxelinux.cfg files...
-   TFTP error: ICMP ERROR "port unreachable"
-   Receiving data:  0 KBytes
- Repeating TFTP read request...
-   TFTP error: ICMP ERROR "port unreachable"
- Failed to load OS from network.
- Failed to IPL from this network!
- LOADPARM=[        ]
-
- Using virtio-scsi.
-
- ! virtio-scsi:setup:inquiry: response VS RESP=ff !
- ERROR: No suitable device for IPL. Halting...
-
-We really have to shut up the virtio-net devices after we're not
-using it anymore. The easiest way to do this is to simply reset
-the device, so let's do that now.
-
-Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20250116115826.192047-3-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 68c95ed1db070f7545e487e742715f01a545aab0)
----
- pc-bios/s390-ccw/netmain.c    | 33 +++++++++++++++++++++++----------
- pc-bios/s390-ccw/virtio-net.c |  5 +++++
- pc-bios/s390-ccw/virtio.h     |  1 +
- 3 files changed, 29 insertions(+), 10 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index e46e470db4..335ea9b63e 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -153,19 +153,10 @@ static int tftp_load(filename_ip_t *fnip, void *buffer, int len)
-     return rc;
- }
- 
--static int net_init(filename_ip_t *fn_ip)
-+static int net_init_ip(filename_ip_t *fn_ip)
- {
-     int rc;
- 
--    memset(fn_ip, 0, sizeof(filename_ip_t));
--
--    rc = virtio_net_init(mac);
--    if (rc < 0) {
--        puts("Could not initialize network device");
--        return -101;
--    }
--    fn_ip->fd = rc;
--
-     printf("  Using MAC address: %02x:%02x:%02x:%02x:%02x:%02x\n",
-            mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
- 
-@@ -221,11 +212,33 @@ static int net_init(filename_ip_t *fn_ip)
-     return rc;
- }
- 
-+static int net_init(filename_ip_t *fn_ip)
-+{
-+    int rc;
-+
-+    memset(fn_ip, 0, sizeof(filename_ip_t));
-+
-+    rc = virtio_net_init(mac);
-+    if (rc < 0) {
-+        puts("Could not initialize network device");
-+        return -101;
-+    }
-+    fn_ip->fd = rc;
-+
-+    rc = net_init_ip(fn_ip);
-+    if (rc < 0) {
-+        virtio_net_deinit();
-+    }
-+
-+    return rc;
-+}
-+
- static void net_release(filename_ip_t *fn_ip)
- {
-     if (fn_ip->ip_version == 4) {
-         dhcp_send_release(fn_ip->fd);
-     }
-+    virtio_net_deinit();
- }
- 
- /**
-diff --git a/pc-bios/s390-ccw/virtio-net.c b/pc-bios/s390-ccw/virtio-net.c
-index 578c89d0c5..301445bf97 100644
---- a/pc-bios/s390-ccw/virtio-net.c
-+++ b/pc-bios/s390-ccw/virtio-net.c
-@@ -140,3 +140,8 @@ int recv(int fd, void *buf, int maxlen, int flags)
- 
-     return len;
- }
-+
-+void virtio_net_deinit(void)
-+{
-+    virtio_reset(virtio_get_device());
-+}
-diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
-index f13fa6f5fe..5c5e808a50 100644
---- a/pc-bios/s390-ccw/virtio.h
-+++ b/pc-bios/s390-ccw/virtio.h
-@@ -278,5 +278,6 @@ int virtio_reset(VDev *vdev);
- int virtio_setup_ccw(VDev *vdev);
- 
- int virtio_net_init(void *mac_addr);
-+void virtio_net_deinit(void);
- 
- #endif /* VIRTIO_H */
--- 
-2.48.0
-
diff --git a/kvm-pc-bios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch b/kvm-pc-bios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch
deleted file mode 100644
index 6b5269f..0000000
--- a/kvm-pc-bios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 499df84ffe62c783d35d5e67cd0d0c35ba6bd44c Mon Sep 17 00:00:00 2001
-From: Marc Hartmayer <mhartmay@linux.ibm.com>
-Date: Tue, 1 Oct 2024 17:36:18 +0200
-Subject: [PATCH 23/27] pc-bios/s390-ccw: Introduce `EXTRA_LDFLAGS`
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [23/23] e27a9f3997924573bbacc1a7cf48004b2daeaaaa (thuth/qemu-kvm-cs9)
-
-Some packaging tools want to override `LDFLAGS` when building QEMU, this will
-result in a build error as most likely no `-nostdlib` flag is passed. Introduce
-`EXTRA_LDFLAGS` so that the packager can override `LDFLAGS` without breaking the
-build.
-
-Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
-Message-ID: <20241001153618.17791-4-mhartmay@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-[thuth: Drop the hunk to netbook.mak which is not necessary anymore]
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 694d79ffce996c0993cebccc07c2ab6fc281e7d0)
----
- pc-bios/s390-ccw/Makefile | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index 38254e22df..dc69dd484f 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -4,6 +4,7 @@ all: build-all
- 
- include config-host.mak
- CFLAGS = -O2 -g -I $(SRC_PATH)/../../include/hw/s390x/ipl
-+LDFLAGS ?=
- MAKEFLAGS += -rR
- 
- GIT_SUBMODULES = roms/SLOF
-@@ -46,7 +47,7 @@ EXTRA_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
- EXTRA_CFLAGS += -msoft-float
- EXTRA_CFLAGS += -std=gnu99
- EXTRA_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
--LDFLAGS += -Wl,-pie -nostdlib -z noexecstack -z text
-+EXTRA_LDFLAGS += -Wl,-pie -nostdlib -z noexecstack -z text
- 
- cc-test = $(CC) -Werror $1 -c -o /dev/null -xc /dev/null >/dev/null 2>/dev/null
- cc-option = if $(call cc-test, $1); then \
-@@ -111,7 +112,7 @@ libnet.a: $(LIBNETOBJS)
- build-all: s390-ccw.img
- 
- s390-ccw.elf: $(OBJECTS) libnet.a libc.a
--	$(call quiet-command,$(CC) $(LDFLAGS) -o $@ $^,Linking)
-+	$(call quiet-command,$(CC) $(EXTRA_LDFLAGS) $(LDFLAGS) -o $@ $^,Linking)
- 
- s390-ccw.img: s390-ccw.elf
- 	$(call quiet-command,$(STRIP) --strip-unneeded $< -o $@,Stripping $< into)
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Link-the-netboot-code-into-the-main.patch b/kvm-pc-bios-s390-ccw-Link-the-netboot-code-into-the-main.patch
deleted file mode 100644
index 1b243e5..0000000
--- a/kvm-pc-bios-s390-ccw-Link-the-netboot-code-into-the-main.patch
+++ /dev/null
@@ -1,263 +0,0 @@
-From 5dd12012ec95bbac035a7a8b22216082def604f3 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:37 -0400
-Subject: [PATCH 03/27] pc-bios/s390-ccw: Link the netboot code into the main
- s390-ccw.img binary
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/23] d369fc67aa9e10ba97618182e8f9681d151bcc49 (thuth/qemu-kvm-cs9)
-
-We originally built a separate binary for the netboot code since it
-was considered as experimental and we could not be sure that the
-necessary SLOF module had been checked out. Time passed, the code
-proved its usefulness, and the build system nowadays makes sure that
-the SLOF module is checked out if you have a s390x compiler available
-for building the s390-ccw bios. So there is no real compelling reason
-anymore to keep the netboot code in a separate binary. Linking the
-code together with the main s390-ccw.img will make future enhancements
-much easier, like supporting more than one boot device.
-
-Co-authored by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20241020012953.1380075-4-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 8e5739ce4b0b04d7121cb2b29521acde2a8f3a24)
----
- pc-bios/s390-ccw/Makefile    | 13 +++++++------
- pc-bios/s390-ccw/bootmap.c   |  2 +-
- pc-bios/s390-ccw/cio.h       |  2 ++
- pc-bios/s390-ccw/iplb.h      |  4 ++--
- pc-bios/s390-ccw/main.c      | 10 +++++++---
- pc-bios/s390-ccw/netboot.mak | 14 --------------
- pc-bios/s390-ccw/netmain.c   | 15 ++-------------
- pc-bios/s390-ccw/s390-ccw.h  |  3 +++
- pc-bios/s390-ccw/virtio.h    |  1 -
- 9 files changed, 24 insertions(+), 40 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index 3f4232636e..cf6859823a 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -32,19 +32,20 @@ QEMU_DGFLAGS = -MMD -MP -MT $@ -MF $(@D)/$(*F).d
- 
- .PHONY : all clean build-all distclean
- 
--OBJECTS = start.o main.o bootmap.o jump2ipl.o sclp.o menu.o \
--	  virtio.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o
-+OBJECTS = start.o main.o bootmap.o jump2ipl.o sclp.o menu.o netmain.o \
-+	  virtio.o virtio-net.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o
- 
- SLOF_DIR := $(SRC_PATH)/../../roms/SLOF
- 
- LIBC_INC := -nostdinc -I$(SLOF_DIR)/lib/libc/include
-+LIBNET_INC := -I$(SLOF_DIR)/lib/libnet
- 
- EXTRA_CFLAGS += -Wall
- EXTRA_CFLAGS += -ffreestanding -fno-delete-null-pointer-checks -fno-common -fPIE
- EXTRA_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
- EXTRA_CFLAGS += -msoft-float
- EXTRA_CFLAGS += -std=gnu99
--EXTRA_CFLAGS += $(LIBC_INC)
-+EXTRA_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
- LDFLAGS += -Wl,-pie -nostdlib -z noexecstack
- 
- cc-test = $(CC) -Werror $1 -c -o /dev/null -xc /dev/null >/dev/null 2>/dev/null
-@@ -62,9 +63,9 @@ config-cc.mak: Makefile
- 
- include $(SRC_PATH)/netboot.mak
- 
--build-all: s390-ccw.img s390-netboot.img
-+build-all: s390-ccw.img
- 
--s390-ccw.elf: $(OBJECTS) libc.a
-+s390-ccw.elf: $(OBJECTS) libnet.a libc.a
- 	$(call quiet-command,$(CC) $(LDFLAGS) -o $@ $^,Linking)
- 
- s390-ccw.img: s390-ccw.elf
-@@ -72,7 +73,7 @@ s390-ccw.img: s390-ccw.elf
- 
- $(OBJECTS): Makefile
- 
--ALL_OBJS = $(sort $(OBJECTS) $(NETOBJS) $(LIBCOBJS) $(LIBNETOBJS))
-+ALL_OBJS = $(sort $(OBJECTS) $(LIBCOBJS) $(LIBNETOBJS))
- -include $(ALL_OBJS:%.o=%.d)
- 
- clean:
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index 3cc79706be..414c3f1b47 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -929,7 +929,7 @@ void zipl_load(void)
-     }
- 
-     if (virtio_get_device_type() == VIRTIO_ID_NET) {
--        jump_to_IPL_code(vdev->netboot_start_addr);
-+        netmain();
-     }
- 
-     ipl_scsi();
-diff --git a/pc-bios/s390-ccw/cio.h b/pc-bios/s390-ccw/cio.h
-index 8b18153deb..6a5e86ba01 100644
---- a/pc-bios/s390-ccw/cio.h
-+++ b/pc-bios/s390-ccw/cio.h
-@@ -361,6 +361,8 @@ typedef struct CcwSearchIdData {
-     uint8_t record;
- } __attribute__((packed)) CcwSearchIdData;
- 
-+extern SubChannelId net_schid;
-+
- int enable_mss_facility(void);
- void enable_subchannel(SubChannelId schid);
- uint16_t cu_type(SubChannelId schid);
-diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h
-index cb6ac8a880..3758698468 100644
---- a/pc-bios/s390-ccw/iplb.h
-+++ b/pc-bios/s390-ccw/iplb.h
-@@ -87,9 +87,9 @@ extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
- struct QemuIplParameters {
-     uint8_t  qipl_flags;
-     uint8_t  reserved1[3];
--    uint64_t netboot_start_addr;
-+    uint64_t reserved2;
-     uint32_t boot_menu_timeout;
--    uint8_t  reserved2[12];
-+    uint8_t  reserved3[12];
- } __attribute__ ((packed));
- typedef struct QemuIplParameters QemuIplParameters;
- 
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index 203df20965..fc44da3161 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -38,8 +38,13 @@ LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */
-  */
- void write_subsystem_identification(void)
- {
--    lowcore->subchannel_id = blk_schid.sch_id;
--    lowcore->subchannel_nr = blk_schid.sch_no;
-+    if (cutype == CU_TYPE_VIRTIO && virtio_get_device_type() == VIRTIO_ID_NET) {
-+        lowcore->subchannel_id = net_schid.sch_id;
-+        lowcore->subchannel_nr = net_schid.sch_no;
-+    } else {
-+        lowcore->subchannel_id = blk_schid.sch_id;
-+        lowcore->subchannel_nr = blk_schid.sch_no;
-+    }
-     lowcore->io_int_parm = 0;
- }
- 
-@@ -231,7 +236,6 @@ static int virtio_setup(void)
-     switch (vdev->senseid.cu_model) {
-     case VIRTIO_ID_NET:
-         puts("Network boot device detected");
--        vdev->netboot_start_addr = qipl.netboot_start_addr;
-         return 0;
-     case VIRTIO_ID_BLOCK:
-         ret = virtio_blk_setup_device(blk_schid);
-diff --git a/pc-bios/s390-ccw/netboot.mak b/pc-bios/s390-ccw/netboot.mak
-index d2b3d8ee74..0a24257ff4 100644
---- a/pc-bios/s390-ccw/netboot.mak
-+++ b/pc-bios/s390-ccw/netboot.mak
-@@ -1,18 +1,4 @@
- 
--NETOBJS := start.o sclp.o cio.o virtio.o virtio-net.o jump2ipl.o netmain.o
--
--LIBNET_INC := -I$(SLOF_DIR)/lib/libnet
--
--NETLDFLAGS := $(LDFLAGS) -Wl,-Ttext=0x7800000
--
--$(NETOBJS): EXTRA_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
--
--s390-netboot.elf: $(NETOBJS) libnet.a libc.a
--	$(call quiet-command,$(CC) $(NETLDFLAGS) -o $@ $^,Linking)
--
--s390-netboot.img: s390-netboot.elf
--	$(call quiet-command,$(STRIP) --strip-unneeded $< -o $@,Stripping $< into)
--
- # libc files:
- 
- LIBC_CFLAGS = $(EXTRA_CFLAGS) $(CFLAGS) $(LIBC_INC) $(LIBNET_INC) \
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index 509119be15..bc6ad8695f 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -41,7 +41,6 @@
- #define DEFAULT_TFTP_RETRIES 20
- 
- extern char _start[];
--void write_iplb_location(void) {}
- 
- #define KERNEL_ADDR             ((void *)0L)
- #define KERNEL_MAX_SIZE         ((long)_start)
-@@ -50,10 +49,9 @@ void write_iplb_location(void) {}
- /* STSI 3.2.2 offset of first vmdb + offset of uuid inside vmdb */
- #define STSI322_VMDB_UUID_OFFSET ((8 + 12) * 4)
- 
--IplParameterBlock iplb __attribute__((aligned(PAGE_SIZE)));
- static char cfgbuf[2048];
- 
--static SubChannelId net_schid = { .one = 1 };
-+SubChannelId net_schid = { .one = 1 };
- static uint8_t mac[6];
- static uint64_t dest_timer;
- 
-@@ -438,15 +436,6 @@ static int net_try_direct_tftp_load(filename_ip_t *fn_ip)
-     return rc;
- }
- 
--void write_subsystem_identification(void)
--{
--    SubChannelId *schid = (SubChannelId *) 184;
--    uint32_t *zeroes = (uint32_t *) 188;
--
--    *schid = net_schid;
--    *zeroes = 0;
--}
--
- static bool find_net_dev(Schib *schib, int dev_no)
- {
-     int i, r;
-@@ -509,7 +498,7 @@ static void virtio_setup(void)
-     IPL_assert(found, "No virtio net device found");
- }
- 
--void main(void)
-+void netmain(void)
- {
-     filename_ip_t fn_ip;
-     int rc, fnlen;
-diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
-index 6f6d95d170..6abb34e563 100644
---- a/pc-bios/s390-ccw/s390-ccw.h
-+++ b/pc-bios/s390-ccw/s390-ccw.h
-@@ -55,6 +55,9 @@ void write_iplb_location(void);
- unsigned int get_loadparm_index(void);
- void main(void);
- 
-+/* netmain.c */
-+void netmain(void);
-+
- /* sclp.c */
- void sclp_print(const char *string);
- void sclp_set_write_mask(uint32_t receive_mask, uint32_t send_mask);
-diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
-index 85bd9d1695..6f9a558ff5 100644
---- a/pc-bios/s390-ccw/virtio.h
-+++ b/pc-bios/s390-ccw/virtio.h
-@@ -253,7 +253,6 @@ struct VDev {
-     uint8_t scsi_dev_heads;
-     bool scsi_device_selected;
-     ScsiDevice selected_scsi_device;
--    uint64_t netboot_start_addr;
-     uint32_t max_transfer;
-     uint32_t guest_features[2];
- };
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Merge-netboot.mak-into-the-main-Mak.patch b/kvm-pc-bios-s390-ccw-Merge-netboot.mak-into-the-main-Mak.patch
deleted file mode 100644
index 9e35834..0000000
--- a/kvm-pc-bios-s390-ccw-Merge-netboot.mak-into-the-main-Mak.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 053fe7407d61ea7f885ae3a75b8dff18712e97fc Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Fri, 21 Jun 2024 09:40:11 +0200
-Subject: [PATCH 06/27] pc-bios/s390-ccw: Merge netboot.mak into the main
- Makefile
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/23] a0f3671677000e9bf00557df773fd72d9f9768a7 (thuth/qemu-kvm-cs9)
-
-Now that the netboot code has been merged into the main s390-ccw.img,
-it also does not make sense to keep the build rules in a separate
-file. Thus let's merge netboot.mak into the main Makefile.
-
-Message-Id: <20240621082422.136217-7-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit f1fdadda36f73c9a4a96f92deb3062528cd12acc)
----
- pc-bios/s390-ccw/Makefile    | 47 +++++++++++++++++++++++++++++++++++-
- pc-bios/s390-ccw/netboot.mak | 45 ----------------------------------
- 2 files changed, 46 insertions(+), 46 deletions(-)
- delete mode 100644 pc-bios/s390-ccw/netboot.mak
-
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index cf6859823a..27cbb354af 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -61,7 +61,52 @@ config-cc.mak: Makefile
- 	    $(call cc-option,-march=z900,-march=z10)) 3> config-cc.mak
- -include config-cc.mak
- 
--include $(SRC_PATH)/netboot.mak
-+# libc files:
-+
-+LIBC_CFLAGS = $(EXTRA_CFLAGS) $(CFLAGS) $(LIBC_INC) $(LIBNET_INC) \
-+	      -MMD -MP -MT $@ -MF $(@:%.o=%.d)
-+
-+CTYPE_OBJS = isdigit.o isxdigit.o toupper.o
-+%.o : $(SLOF_DIR)/lib/libc/ctype/%.c
-+	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
-+
-+STRING_OBJS = strcat.o strchr.o strrchr.o strcpy.o strlen.o strncpy.o \
-+	      strcmp.o strncmp.o strcasecmp.o strncasecmp.o strstr.o \
-+	      memset.o memcpy.o memmove.o memcmp.o
-+%.o : $(SLOF_DIR)/lib/libc/string/%.c
-+	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
-+
-+STDLIB_OBJS = atoi.o atol.o strtoul.o strtol.o rand.o malloc.o free.o
-+%.o : $(SLOF_DIR)/lib/libc/stdlib/%.c
-+	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
-+
-+STDIO_OBJS = sprintf.o snprintf.o vfprintf.o vsnprintf.o vsprintf.o fprintf.o \
-+	     printf.o putc.o puts.o putchar.o stdchnls.o fileno.o
-+%.o : $(SLOF_DIR)/lib/libc/stdio/%.c
-+	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
-+
-+sbrk.o: $(SLOF_DIR)/slof/sbrk.c
-+	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
-+
-+LIBCOBJS := $(STRING_OBJS) $(CTYPE_OBJS) $(STDLIB_OBJS) $(STDIO_OBJS) sbrk.o
-+
-+libc.a: $(LIBCOBJS)
-+	$(call quiet-command,$(AR) -rc $@ $^,Creating static library)
-+
-+# libnet files:
-+
-+LIBNETOBJS := args.o dhcp.o dns.o icmpv6.o ipv6.o tcp.o udp.o bootp.o \
-+	      dhcpv6.o ethernet.o ipv4.o ndp.o tftp.o pxelinux.o
-+LIBNETCFLAGS = $(EXTRA_CFLAGS) $(CFLAGS) $(LIBC_INC) $(LIBNET_INC) \
-+	       -DDHCPARCH=0x1F -MMD -MP -MT $@ -MF $(@:%.o=%.d)
-+
-+%.o : $(SLOF_DIR)/lib/libnet/%.c
-+	$(call quiet-command,$(CC) $(LIBNETCFLAGS) -c -o $@ $<,Compiling)
-+
-+libnet.a: $(LIBNETOBJS)
-+	$(call quiet-command,$(AR) -rc $@ $^,Creating static library)
-+
-+# Main targets:
- 
- build-all: s390-ccw.img
- 
-diff --git a/pc-bios/s390-ccw/netboot.mak b/pc-bios/s390-ccw/netboot.mak
-deleted file mode 100644
-index 0a24257ff4..0000000000
---- a/pc-bios/s390-ccw/netboot.mak
-+++ /dev/null
-@@ -1,45 +0,0 @@
--
--# libc files:
--
--LIBC_CFLAGS = $(EXTRA_CFLAGS) $(CFLAGS) $(LIBC_INC) $(LIBNET_INC) \
--	      -MMD -MP -MT $@ -MF $(@:%.o=%.d)
--
--CTYPE_OBJS = isdigit.o isxdigit.o toupper.o
--%.o : $(SLOF_DIR)/lib/libc/ctype/%.c
--	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
--
--STRING_OBJS = strcat.o strchr.o strrchr.o strcpy.o strlen.o strncpy.o \
--	      strcmp.o strncmp.o strcasecmp.o strncasecmp.o strstr.o \
--	      memset.o memcpy.o memmove.o memcmp.o
--%.o : $(SLOF_DIR)/lib/libc/string/%.c
--	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
--
--STDLIB_OBJS = atoi.o atol.o strtoul.o strtol.o rand.o malloc.o free.o
--%.o : $(SLOF_DIR)/lib/libc/stdlib/%.c
--	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
--
--STDIO_OBJS = sprintf.o snprintf.o vfprintf.o vsnprintf.o vsprintf.o fprintf.o \
--	     printf.o putc.o puts.o putchar.o stdchnls.o fileno.o
--%.o : $(SLOF_DIR)/lib/libc/stdio/%.c
--	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
--
--sbrk.o: $(SLOF_DIR)/slof/sbrk.c
--	$(call quiet-command,$(CC) $(LIBC_CFLAGS) -c -o $@ $<,Compiling)
--
--LIBCOBJS := $(STRING_OBJS) $(CTYPE_OBJS) $(STDLIB_OBJS) $(STDIO_OBJS) sbrk.o
--
--libc.a: $(LIBCOBJS)
--	$(call quiet-command,$(AR) -rc $@ $^,Creating static library)
--
--# libnet files:
--
--LIBNETOBJS := args.o dhcp.o dns.o icmpv6.o ipv6.o tcp.o udp.o bootp.o \
--	      dhcpv6.o ethernet.o ipv4.o ndp.o tftp.o pxelinux.o
--LIBNETCFLAGS = $(EXTRA_CFLAGS) $(CFLAGS) $(LIBC_INC) $(LIBNET_INC) \
--	       -DDHCPARCH=0x1F -MMD -MP -MT $@ -MF $(@:%.o=%.d)
--
--%.o : $(SLOF_DIR)/lib/libnet/%.c
--	$(call quiet-command,$(CC) $(LIBNETCFLAGS) -c -o $@ $<,Compiling)
--
--libnet.a: $(LIBNETOBJS)
--	$(call quiet-command,$(AR) -rc $@ $^,Creating static library)
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch b/kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch
deleted file mode 100644
index 8a5c675..0000000
--- a/kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 7e73d3ad9a7e3f047f8ef79131065e4386e1bc00 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 11 Nov 2024 14:11:20 +0100
-Subject: [PATCH 09/10] pc-bios/s390-ccw: Re-initialize receive queue index
- before each boot attempt
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [8/8] 3337c7737fa2eb33f1a27230ae1d6e0f2580a539 (thuth/qemu-kvm-cs9)
-
-Now that we can boot from multiple boot devices, we have to make sure
-to reinitialize static variables like rx_last_idx to avoid that they
-contain garbage data during the second boot attempt (which can lead to
-crashes when the code tries to access the wrong ring data).
-
-Message-ID: <20241111131120.317796-1-thuth@redhat.com>
-Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 6ba1f714c00f8839a8df9f643e0058f00da3fd25)
----
- pc-bios/s390-ccw/virtio-net.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/pc-bios/s390-ccw/virtio-net.c b/pc-bios/s390-ccw/virtio-net.c
-index f9854a22c3..578c89d0c5 100644
---- a/pc-bios/s390-ccw/virtio-net.c
-+++ b/pc-bios/s390-ccw/virtio-net.c
-@@ -51,6 +51,8 @@ int virtio_net_init(void *mac_addr)
-     void *buf;
-     int i;
- 
-+    rx_last_idx = 0;
-+
-     vdev->guest_features[0] = VIRTIO_NET_F_MAC_BIT;
-     virtio_setup_ccw(vdev);
- 
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Remove-panics-from-DASD-IPL-path.patch b/kvm-pc-bios-s390-ccw-Remove-panics-from-DASD-IPL-path.patch
deleted file mode 100644
index 5e0fd94..0000000
--- a/kvm-pc-bios-s390-ccw-Remove-panics-from-DASD-IPL-path.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From 032b512a919662ce65b173416815e29e8f5fb904 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:44 -0400
-Subject: [PATCH 11/27] pc-bios/s390-ccw: Remove panics from DASD IPL path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [11/23] 941e1e76db8d35a6ad6ca2e2a401e2ac122efd09 (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from DASD IPL specific functions so that error recovery
-may be possible in the future.
-
-Functions that would previously panic now provide a return code.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-11-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 1d5c7f078e938e6844f404429dd70bc52b39dac6)
----
- pc-bios/s390-ccw/dasd-ipl.c | 66 ++++++++++++++++++++-----------------
- pc-bios/s390-ccw/dasd-ipl.h |  2 +-
- 2 files changed, 37 insertions(+), 31 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/dasd-ipl.c b/pc-bios/s390-ccw/dasd-ipl.c
-index ae751adec1..babece95ea 100644
---- a/pc-bios/s390-ccw/dasd-ipl.c
-+++ b/pc-bios/s390-ccw/dasd-ipl.c
-@@ -111,38 +111,29 @@ static void make_readipl(void)
-     ccwIplRead->count = 0x18; /* Read 0x18 bytes of data */
- }
- 
--static void run_readipl(SubChannelId schid, uint16_t cutype)
-+static int run_readipl(SubChannelId schid, uint16_t cutype)
- {
--    if (do_cio(schid, cutype, 0x00, CCW_FMT0)) {
--        panic("dasd-ipl: Failed to run Read IPL channel program\n");
--    }
-+    return do_cio(schid, cutype, 0x00, CCW_FMT0);
- }
- 
- /*
-  * The architecture states that IPL1 data should consist of a psw followed by
-  * format-0 READ and TIC CCWs. Let's sanity check.
-  */
--static void check_ipl1(void)
-+static bool check_ipl1(void)
- {
-     Ccw0 *ccwread = (Ccw0 *)0x08;
-     Ccw0 *ccwtic = (Ccw0 *)0x10;
- 
--    if (ccwread->cmd_code != CCW_CMD_DASD_READ ||
--        ccwtic->cmd_code != CCW_CMD_TIC) {
--        panic("dasd-ipl: IPL1 data invalid. Is this disk really bootable?\n");
--    }
-+    return (ccwread->cmd_code == CCW_CMD_DASD_READ &&
-+            ccwtic->cmd_code == CCW_CMD_TIC);
- }
- 
--static void check_ipl2(uint32_t ipl2_addr)
-+static bool check_ipl2(uint32_t ipl2_addr)
- {
-     Ccw0 *ccw = u32toptr(ipl2_addr);
- 
--    if (ipl2_addr == 0x00) {
--        panic("IPL2 address invalid. Is this disk really bootable?\n");
--    }
--    if (ccw->cmd_code == 0x00) {
--        panic("IPL2 ccw data invalid. Is this disk really bootable?\n");
--    }
-+    return (ipl2_addr != 0x00 && ccw->cmd_code != 0x00);
- }
- 
- static uint32_t read_ipl2_addr(void)
-@@ -188,52 +179,67 @@ static void ipl1_fixup(void)
-     ccwSearchTic->cda = ptr2u32(ccwSearchID);
- }
- 
--static void run_ipl1(SubChannelId schid, uint16_t cutype)
-+static int run_ipl1(SubChannelId schid, uint16_t cutype)
-  {
-     uint32_t startAddr = 0x08;
- 
--    if (do_cio(schid, cutype, startAddr, CCW_FMT0)) {
--        panic("dasd-ipl: Failed to run IPL1 channel program\n");
--    }
-+    return do_cio(schid, cutype, startAddr, CCW_FMT0);
- }
- 
--static void run_ipl2(SubChannelId schid, uint16_t cutype, uint32_t addr)
-+static int run_ipl2(SubChannelId schid, uint16_t cutype, uint32_t addr)
- {
--    if (run_dynamic_ccw_program(schid, cutype, addr)) {
--        panic("dasd-ipl: Failed to run IPL2 channel program\n");
--    }
-+    return run_dynamic_ccw_program(schid, cutype, addr);
- }
- 
- /*
-  * Limitations in vfio-ccw support complicate the IPL process. Details can
-  * be found in docs/devel/s390-dasd-ipl.rst
-  */
--void dasd_ipl(SubChannelId schid, uint16_t cutype)
-+int dasd_ipl(SubChannelId schid, uint16_t cutype)
- {
-     PSWLegacy *pswl = (PSWLegacy *) 0x00;
-     uint32_t ipl2_addr;
- 
-     /* Construct Read IPL CCW and run it to read IPL1 from boot disk */
-     make_readipl();
--    run_readipl(schid, cutype);
-+    if (run_readipl(schid, cutype)) {
-+        puts("Failed to run Read IPL channel program");
-+        return -EIO;
-+    }
-+
-     ipl2_addr = read_ipl2_addr();
--    check_ipl1();
-+
-+    if (!check_ipl1()) {
-+        puts("IPL1 invalid for DASD-IPL");
-+        return -EINVAL;
-+    }
- 
-     /*
-      * Fixup IPL1 channel program to account for vfio-ccw limitations, then run
-      * it to read IPL2 channel program from boot disk.
-      */
-     ipl1_fixup();
--    run_ipl1(schid, cutype);
--    check_ipl2(ipl2_addr);
-+    if (run_ipl1(schid, cutype)) {
-+        puts("Failed to run IPL1 channel program");
-+        return -EIO;
-+    }
-+
-+    if (!check_ipl2(ipl2_addr)) {
-+        puts("IPL2 invalid for DASD-IPL");
-+        return -EINVAL;
-+    }
- 
-     /*
-      * Run IPL2 channel program to read operating system code from boot disk
-      */
--    run_ipl2(schid, cutype, ipl2_addr);
-+    if (run_ipl2(schid, cutype, ipl2_addr)) {
-+        puts("Failed to run IPL2 channel program");
-+        return -EIO;
-+    }
- 
-     /* Transfer control to the guest operating system */
-     pswl->mask |= PSW_MASK_EAMODE;   /* Force z-mode */
-     pswl->addr |= PSW_MASK_BAMODE;   /* ...          */
-     jump_to_low_kernel();
-+    return -1;
- }
-diff --git a/pc-bios/s390-ccw/dasd-ipl.h b/pc-bios/s390-ccw/dasd-ipl.h
-index c394828906..eb1898c84a 100644
---- a/pc-bios/s390-ccw/dasd-ipl.h
-+++ b/pc-bios/s390-ccw/dasd-ipl.h
-@@ -11,6 +11,6 @@
- #ifndef DASD_IPL_H
- #define DASD_IPL_H
- 
--void dasd_ipl(SubChannelId schid, uint16_t cutype);
-+int dasd_ipl(SubChannelId schid, uint16_t cutype);
- 
- #endif /* DASD_IPL_H */
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Remove-panics-from-ECKD-IPL-path.patch b/kvm-pc-bios-s390-ccw-Remove-panics-from-ECKD-IPL-path.patch
deleted file mode 100644
index fa854a1..0000000
--- a/kvm-pc-bios-s390-ccw-Remove-panics-from-ECKD-IPL-path.patch
+++ /dev/null
@@ -1,475 +0,0 @@
-From 237d714205394102a4cd60eeeddc12b98bfbfa3f Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:42 -0400
-Subject: [PATCH 09/27] pc-bios/s390-ccw: Remove panics from ECKD IPL path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [9/23] 1e6ecba95979a5bc12bd74c1b0bc631ccfbd57ec (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from ECKD block device IPL specific functions so that
-error recovery may be possible in the future.
-
-Functions that would previously panic now provide a return code.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-9-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 806315279d5c629e1cc3a945bcfba3fe5482d84b)
----
- pc-bios/s390-ccw/bootmap.c | 187 +++++++++++++++++++++++++------------
- pc-bios/s390-ccw/bootmap.h |   1 +
- 2 files changed, 130 insertions(+), 58 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index af73254acb..b9596e28c7 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -145,14 +145,17 @@ static block_number_t load_eckd_segments(block_number_t blk, bool ldipl,
-     bool more_data;
- 
-     memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
--    read_block(blk, bprs, "BPRS read failed");
-+    if (virtio_read(blk, bprs)) {
-+        puts("BPRS read failed");
-+        return ERROR_BLOCK_NR;
-+    }
- 
-     do {
-         more_data = false;
-         for (j = 0;; j++) {
-             block_nr = gen_eckd_block_num(&bprs[j].xeckd, ldipl);
-             if (is_null_block_number(block_nr)) { /* end of chunk */
--                break;
-+                return NULL_BLOCK_NR;
-             }
- 
-             /* we need the updated blockno for the next indirect entry
-@@ -163,15 +166,20 @@ static block_number_t load_eckd_segments(block_number_t blk, bool ldipl,
-             }
- 
-             /* List directed pointer does not store block size */
--            IPL_assert(ldipl || block_size_ok(bprs[j].xeckd.bptr.size),
--                       "bad chunk block size");
-+            if (!ldipl && !block_size_ok(bprs[j].xeckd.bptr.size)) {
-+                puts("Bad chunk block size");
-+                return ERROR_BLOCK_NR;
-+            }
- 
-             if (!eckd_valid_address(&bprs[j].xeckd, ldipl)) {
-                 /*
-                  * If an invalid address is found during LD-IPL then break and
--                 * retry as CCW
-+                 * retry as CCW-IPL, otherwise abort on error
-                  */
--                IPL_assert(ldipl, "bad chunk ECKD addr");
-+                if (!ldipl) {
-+                    puts("Bad chunk ECKD address");
-+                    return ERROR_BLOCK_NR;
-+                }
-                 break;
-             }
- 
-@@ -189,7 +197,10 @@ static block_number_t load_eckd_segments(block_number_t blk, bool ldipl,
-                  * I.e. the next ptr must point to the unused memory area
-                  */
-                 memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
--                read_block(block_nr, bprs, "BPRS continuation read failed");
-+                if (virtio_read(block_nr, bprs)) {
-+                    puts("BPRS continuation read failed");
-+                    return ERROR_BLOCK_NR;
-+                }
-                 more_data = true;
-                 break;
-             }
-@@ -198,7 +209,10 @@ static block_number_t load_eckd_segments(block_number_t blk, bool ldipl,
-              * to memory (address).
-              */
-             rc = virtio_read_many(block_nr, (void *)(*address), count + 1);
--            IPL_assert(rc == 0, "code chunk read failed");
-+            if (rc != 0) {
-+                puts("Code chunk read failed");
-+                return ERROR_BLOCK_NR;
-+            }
- 
-             *address += (count + 1) * virtio_get_block_size();
-         }
-@@ -232,7 +246,10 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
- 
-     /* Get Stage1b data */
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(s1b_block_nr, s1b, "Cannot read stage1b boot loader");
-+    if (virtio_read(s1b_block_nr, s1b)) {
-+        puts("Cannot read stage1b boot loader");
-+        return -EIO;
-+    }
- 
-     memset(_s2, FREE_SPACE_FILLER, sizeof(_s2));
- 
-@@ -244,7 +261,10 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
-             break;
-         }
- 
--        read_block(cur_block_nr, s2_cur_blk, "Cannot read stage2 boot loader");
-+        if (virtio_read(cur_block_nr, s2_cur_blk)) {
-+            puts("Cannot read stage2 boot loader");
-+            return -EIO;
-+        }
- 
-         if (find_zipl_boot_menu_banner(&banner_offset)) {
-             /*
-@@ -252,8 +272,10 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
-              * possibility of menu data spanning multiple blocks.
-              */
-             if (prev_block_nr) {
--                read_block(prev_block_nr, s2_prev_blk,
--                           "Cannot read stage2 boot loader");
-+                if (virtio_read(prev_block_nr, s2_prev_blk)) {
-+                    puts("Cannot read stage2 boot loader");
-+                    return -EIO;
-+                }
-             }
- 
-             if (i + 1 < STAGE2_BLK_CNT_MAX) {
-@@ -261,8 +283,10 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
-             }
- 
-             if (next_block_nr && !is_null_block_number(next_block_nr)) {
--                read_block(next_block_nr, s2_next_blk,
--                           "Cannot read stage2 boot loader");
-+                if (virtio_read(next_block_nr, s2_next_blk)) {
-+                    puts("Cannot read stage2 boot loader");
-+                    return -EIO;
-+                }
-             }
- 
-             return menu_get_zipl_boot_index(s2_cur_blk + banner_offset);
-@@ -275,7 +299,7 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
-     return 0;
- }
- 
--static void run_eckd_boot_script(block_number_t bmt_block_nr,
-+static int run_eckd_boot_script(block_number_t bmt_block_nr,
-                                  block_number_t s1b_block_nr)
- {
-     int i;
-@@ -292,17 +316,28 @@ static void run_eckd_boot_script(block_number_t bmt_block_nr,
-     }
- 
-     debug_print_int("loadparm", loadparm);
--    IPL_assert(loadparm < MAX_BOOT_ENTRIES, "loadparm value greater than"
--               " maximum number of boot entries allowed");
-+    if (loadparm >= MAX_BOOT_ENTRIES) {
-+        puts("loadparm value greater than max number of boot entries allowed");
-+        return -EINVAL;
-+    }
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(bmt_block_nr, sec, "Cannot read Boot Map Table");
-+    if (virtio_read(bmt_block_nr, sec)) {
-+        puts("Cannot read Boot Map Table");
-+        return -EIO;
-+    }
- 
-     block_nr = gen_eckd_block_num(&bmt->entry[loadparm].xeckd, ldipl);
--    IPL_assert(block_nr != -1, "Cannot find Boot Map Table Entry");
-+    if (block_nr == NULL_BLOCK_NR) {
-+        puts("Cannot find Boot Map Table Entry");
-+        return -EIO;
-+    }
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(block_nr, sec, "Cannot read Boot Map Script");
-+    if (virtio_read(block_nr, sec)) {
-+        puts("Cannot read Boot Map Script");
-+        return -EIO;
-+    }
- 
-     for (i = 0; bms->entry[i].type == BOOT_SCRIPT_LOAD ||
-                 bms->entry[i].type == BOOT_SCRIPT_SIGNATURE; i++) {
-@@ -317,21 +352,27 @@ static void run_eckd_boot_script(block_number_t bmt_block_nr,
- 
-         do {
-             block_nr = load_eckd_segments(block_nr, ldipl, &address);
--        } while (block_nr != -1);
-+            if (block_nr == ERROR_BLOCK_NR) {
-+                return ldipl ? 0 : -EIO;
-+            }
-+        } while (block_nr != NULL_BLOCK_NR);
-     }
- 
-     if (ldipl && bms->entry[i].type != BOOT_SCRIPT_EXEC) {
-         /* Abort LD-IPL and retry as CCW-IPL */
--        return;
-+        return 0;
-     }
- 
--    IPL_assert(bms->entry[i].type == BOOT_SCRIPT_EXEC,
--               "Unknown script entry type");
-+    if (bms->entry[i].type != BOOT_SCRIPT_EXEC) {
-+        puts("Unknown script entry type");
-+        return -EINVAL;
-+    }
-     write_reset_psw(bms->entry[i].address.load_address); /* no return */
-     jump_to_IPL_code(0); /* no return */
-+    return -1;
- }
- 
--static void ipl_eckd_cdl(void)
-+static int ipl_eckd_cdl(void)
- {
-     XEckdMbr *mbr;
-     EckdCdlIpl2 *ipl2 = (void *)sec;
-@@ -342,20 +383,23 @@ static void ipl_eckd_cdl(void)
-     puts("CDL");
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(1, ipl2, "Cannot read IPL2 record at block 1");
-+    if (virtio_read(1, ipl2)) {
-+        puts("Cannot read IPL2 record at block 1");
-+        return -EIO;
-+    }
- 
-     mbr = &ipl2->mbr;
-     if (!magic_match(mbr, ZIPL_MAGIC)) {
-         puts("No zIPL section in IPL2 record.");
--        return;
-+        return 0;
-     }
-     if (!block_size_ok(mbr->blockptr.xeckd.bptr.size)) {
-         puts("Bad block size in zIPL section of IPL2 record.");
--        return;
-+        return 0;
-     }
-     if (mbr->dev_type != DEV_TYPE_ECKD) {
-         puts("Non-ECKD device type in zIPL section of IPL2 record.");
--        return;
-+        return 0;
-     }
- 
-     /* save pointer to Boot Map Table */
-@@ -365,19 +409,21 @@ static void ipl_eckd_cdl(void)
-     s1b_block_nr = eckd_block_num(&ipl2->stage1.seek[0].chs);
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(2, vlbl, "Cannot read Volume Label at block 2");
-+    if (virtio_read(2, vlbl)) {
-+        puts("Cannot read Volume Label at block 2");
-+        return -EIO;
-+    }
-     if (!magic_match(vlbl->key, VOL1_MAGIC)) {
-         puts("Invalid magic of volume label block.");
--        return;
-+        return 0;
-     }
-     if (!magic_match(vlbl->f.key, VOL1_MAGIC)) {
-         puts("Invalid magic of volser block.");
--        return;
-+        return 0;
-     }
-     print_volser(vlbl->f.volser);
- 
--    run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
--    /* no return */
-+    return run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
- }
- 
- static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
-@@ -403,7 +449,7 @@ static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
-     print_volser(vlbl->volser);
- }
- 
--static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
-+static int ipl_eckd_ldl(ECKD_IPL_mode_t mode)
- {
-     block_number_t bmt_block_nr, s1b_block_nr;
-     EckdLdlIpl1 *ipl1 = (void *)sec;
-@@ -415,10 +461,13 @@ static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
-     /* DO NOT read BootMap pointer (only one, xECKD) at block #2 */
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(0, sec, "Cannot read block 0 to grab boot info.");
-+    if (virtio_read(0, sec)) {
-+        puts("Cannot read block 0 to grab boot info.");
-+        return -EIO;
-+    }
-     if (mode == ECKD_LDL_UNLABELED) {
-         if (!magic_match(ipl1->bip.magic, ZIPL_MAGIC)) {
--            return; /* not applicable layout */
-+            return 0; /* not applicable layout */
-         }
-         puts("unlabeled LDL.");
-     }
-@@ -430,8 +479,7 @@ static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
-     /* save pointer to Stage1b Data */
-     s1b_block_nr = eckd_block_num(&ipl1->stage1.seek[0].chs);
- 
--    run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
--    /* no return */
-+    return run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
- }
- 
- static block_number_t eckd_find_bmt(ExtEckdBlockPtr *ptr)
-@@ -441,7 +489,10 @@ static block_number_t eckd_find_bmt(ExtEckdBlockPtr *ptr)
-     BootRecord *br;
- 
-     blockno = gen_eckd_block_num(ptr, 0);
--    read_block(blockno, tmp_sec, "Cannot read boot record");
-+    if (virtio_read(blockno, tmp_sec)) {
-+        puts("Cannot read boot record");
-+        return ERROR_BLOCK_NR;
-+    }
-     br = (BootRecord *)tmp_sec;
-     if (!magic_match(br->magic, ZIPL_MAGIC)) {
-         /* If the boot record is invalid, return and try CCW-IPL instead */
-@@ -470,7 +521,7 @@ static void print_eckd_msg(void)
-     printf("%s", msg);
- }
- 
--static void ipl_eckd(void)
-+static int ipl_eckd(void)
- {
-     IplVolumeLabel *vlbl = (void *)sec;
-     LDL_VTOC *vtoc = (void *)sec;
-@@ -480,7 +531,10 @@ static void ipl_eckd(void)
- 
-     /* Block 2 can contain either the CDL VOL1 label or the LDL VTOC */
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(2, vlbl, "Cannot read block 2");
-+    if (virtio_read(2, vlbl)) {
-+        puts("Cannot read block 2");
-+        return -EIO;
-+    }
- 
-     /*
-      * First check for a list-directed-format pointer which would
-@@ -488,36 +542,53 @@ static void ipl_eckd(void)
-      */
-     if (eckd_valid_address((ExtEckdBlockPtr *)&vlbl->f.br, 0)) {
-         ldipl_bmt = eckd_find_bmt((ExtEckdBlockPtr *)&vlbl->f.br);
--        if (ldipl_bmt) {
-+        switch (ldipl_bmt) {
-+        case ERROR_BLOCK_NR:
-+            return -EIO;
-+        case NULL_BLOCK_NR:
-+            break; /* Invalid BMT but the device may still boot with CCW-IPL */
-+        default:
-             puts("List-Directed");
--            /* LD-IPL does not use the S1B bock, just make it NULL */
--            run_eckd_boot_script(ldipl_bmt, NULL_BLOCK_NR);
--            /* Only return in error, retry as CCW-IPL */
-+            /*
-+             * LD-IPL does not use the S1B bock, just make it NULL_BLOCK_NR.
-+             * In some failure cases retry IPL before aborting.
-+             */
-+            if (run_eckd_boot_script(ldipl_bmt, NULL_BLOCK_NR)) {
-+                return -EIO;
-+            }
-+            /* Non-fatal error, retry as CCW-IPL */
-             printf("Retrying IPL ");
-             print_eckd_msg();
-         }
-         memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--        read_block(2, vtoc, "Cannot read block 2");
-+        if (virtio_read(2, vtoc)) {
-+            puts("Cannot read block 2");
-+            return -EIO;
-+        }
-     }
- 
-     /* Not list-directed */
-     if (magic_match(vtoc->magic, VOL1_MAGIC)) {
--        ipl_eckd_cdl(); /* may return in error */
-+        if (ipl_eckd_cdl()) {
-+            return -1;
-+        }
-     }
- 
-     if (magic_match(vtoc->magic, CMS1_MAGIC)) {
--        ipl_eckd_ldl(ECKD_CMS); /* no return */
-+        return ipl_eckd_ldl(ECKD_CMS);
-     }
-     if (magic_match(vtoc->magic, LNX1_MAGIC)) {
--        ipl_eckd_ldl(ECKD_LDL); /* no return */
-+        return ipl_eckd_ldl(ECKD_LDL);
-     }
- 
--    ipl_eckd_ldl(ECKD_LDL_UNLABELED); /* it still may return */
-+    if (ipl_eckd_ldl(ECKD_LDL_UNLABELED)) {
-+        return -1;
-+    }
-     /*
-      * Ok, it is not a LDL by any means.
-      * It still might be a CDL with zero record keys for IPL1 and IPL2
-      */
--    ipl_eckd_cdl();
-+    return ipl_eckd_cdl();
- }
- 
- /***********************************************************************
-@@ -910,7 +981,7 @@ static bool has_iso_signature(void)
-  * Bus specific IPL sequences
-  */
- 
--static void zipl_load_vblk(void)
-+static int zipl_load_vblk(void)
- {
-     int blksize = virtio_get_block_size();
- 
-@@ -919,7 +990,7 @@ static void zipl_load_vblk(void)
-             virtio_assume_iso9660();
-         }
-         if (ipl_iso_el_torito()) {
--            return;
-+            return 0;
-         }
-     }
- 
-@@ -927,21 +998,21 @@ static void zipl_load_vblk(void)
-         puts("Using guessed DASD geometry.");
-         virtio_assume_eckd();
-     }
--    ipl_eckd();
-+    return ipl_eckd();
- }
- 
--static void zipl_load_vscsi(void)
-+static int zipl_load_vscsi(void)
- {
-     if (virtio_get_block_size() == VIRTIO_ISO_BLOCK_SIZE) {
-         /* Is it an ISO image in non-CD drive? */
-         if (ipl_iso_el_torito()) {
--            return;
-+            return 0;
-         }
-     }
- 
-     puts("Using guessed DASD geometry.");
-     virtio_assume_eckd();
--    ipl_eckd();
-+    return ipl_eckd();
- }
- 
- /***********************************************************************
-diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h
-index 3cb573b86b..95943441d3 100644
---- a/pc-bios/s390-ccw/bootmap.h
-+++ b/pc-bios/s390-ccw/bootmap.h
-@@ -16,6 +16,7 @@
- 
- typedef uint64_t block_number_t;
- #define NULL_BLOCK_NR 0xffffffffffffffffULL
-+#define ERROR_BLOCK_NR 0xfffffffffffffffeULL
- 
- #define FREE_SPACE_FILLER '\xAA'
- 
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Remove-panics-from-ISO-IPL-path.patch b/kvm-pc-bios-s390-ccw-Remove-panics-from-ISO-IPL-path.patch
deleted file mode 100644
index 0304180..0000000
--- a/kvm-pc-bios-s390-ccw-Remove-panics-from-ISO-IPL-path.patch
+++ /dev/null
@@ -1,269 +0,0 @@
-From b850578315ad498d581d8f09c9dfcd0d1dea1a5e Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:41 -0400
-Subject: [PATCH 08/27] pc-bios/s390-ccw: Remove panics from ISO IPL path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [8/23] 92ab09f2df4bcdc721aca11c4a75439ebd72212c (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from IPL ISO El Torito specific functions so that error
-recovery may be possible in the future.
-
-Functions that would previously panic now provide a return code.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-8-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit bef2b8dd1a36fc79cabcda48e667f2cba476924c)
----
- pc-bios/s390-ccw/bootmap.c  | 87 ++++++++++++++++++++++++-------------
- pc-bios/s390-ccw/bootmap.h  | 15 +++----
- pc-bios/s390-ccw/s390-ccw.h |  1 +
- 3 files changed, 65 insertions(+), 38 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index 414c3f1b47..af73254acb 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -678,8 +678,10 @@ static bool is_iso_bc_entry_compatible(IsoBcSection *s)
-     if (s->unused || !s->sector_count) {
-         return false;
-     }
--    read_iso_sector(bswap32(s->load_rba), magic_sec,
--                    "Failed to read image sector 0");
-+    if (virtio_read(bswap32(s->load_rba), magic_sec)) {
-+        puts("Failed to read image sector 0");
-+        return false;
-+    }
- 
-     /* Checking bytes 8 - 32 for S390 Linux magic */
-     return !memcmp(magic_sec + 8, linux_s390_magic, 24);
-@@ -692,28 +694,35 @@ static uint32_t sec_offset[ISO9660_MAX_DIR_DEPTH];
- /* Remained directory space in bytes */
- static uint32_t dir_rem[ISO9660_MAX_DIR_DEPTH];
- 
--static inline uint32_t iso_get_file_size(uint32_t load_rba)
-+static inline long iso_get_file_size(uint32_t load_rba)
- {
-     IsoVolDesc *vd = (IsoVolDesc *)sec;
-     IsoDirHdr *cur_record = &vd->vd.primary.rootdir;
-     uint8_t *temp = sec + ISO_SECTOR_SIZE;
-     int level = 0;
- 
--    read_iso_sector(ISO_PRIMARY_VD_SECTOR, sec,
--                    "Failed to read ISO primary descriptor");
-+    if (virtio_read(ISO_PRIMARY_VD_SECTOR, sec)) {
-+        puts("Failed to read ISO primary descriptor");
-+        return -EIO;
-+    }
-+
-     sec_loc[0] = iso_733_to_u32(cur_record->ext_loc);
-     dir_rem[0] = 0;
-     sec_offset[0] = 0;
- 
-     while (level >= 0) {
--        IPL_assert(sec_offset[level] <= ISO_SECTOR_SIZE,
--                   "Directory tree structure violation");
-+        if (sec_offset[level] > ISO_SECTOR_SIZE) {
-+            puts("Directory tree structure violation");
-+            return -EIO;
-+        }
- 
-         cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
- 
-         if (sec_offset[level] == 0) {
--            read_iso_sector(sec_loc[level], temp,
--                            "Failed to read ISO directory");
-+            if (virtio_read(sec_loc[level], temp)) {
-+                puts("Failed to read ISO directory");
-+                return -EIO;
-+            }
-             if (dir_rem[level] == 0) {
-                 /* Skip self and parent records */
-                 dir_rem[level] = iso_733_to_u32(cur_record->data_len) -
-@@ -758,8 +767,10 @@ static inline uint32_t iso_get_file_size(uint32_t load_rba)
-         if (dir_rem[level] == 0) {
-             /* Nothing remaining */
-             level--;
--            read_iso_sector(sec_loc[level], temp,
--                            "Failed to read ISO directory");
-+            if (virtio_read(sec_loc[level], temp)) {
-+                puts("Failed to read ISO directory");
-+                return -EIO;
-+            }
-         }
-     }
- 
-@@ -774,19 +785,24 @@ static void load_iso_bc_entry(IsoBcSection *load)
-      * is padded and ISO_SECTOR_SIZE bytes aligned
-      */
-     uint32_t blks_to_load = bswap16(s.sector_count) >> ET_SECTOR_SHIFT;
--    uint32_t real_size = iso_get_file_size(bswap32(s.load_rba));
-+    long real_size = iso_get_file_size(bswap32(s.load_rba));
- 
--    if (real_size) {
-+    if (real_size > 0) {
-         /* Round up blocks to load */
-         blks_to_load = (real_size + ISO_SECTOR_SIZE - 1) / ISO_SECTOR_SIZE;
-         puts("ISO boot image size verified");
-     } else {
-         puts("ISO boot image size could not be verified");
-+        if (real_size < 0) {
-+            return;
-+        }
-     }
- 
--    read_iso_boot_image(bswap32(s.load_rba),
-+    if (read_iso_boot_image(bswap32(s.load_rba),
-                         (void *)((uint64_t)bswap16(s.load_segment)),
--                        blks_to_load);
-+                        blks_to_load)) {
-+        return;
-+    }
- 
-     jump_to_low_kernel();
- }
-@@ -809,17 +825,18 @@ static uint32_t find_iso_bc(void)
-                 return bswap32(et->bc_offset);
-             }
-         }
--        read_iso_sector(block_num++, sec,
--                        "Failed to read ISO volume descriptor");
-+        if (virtio_read(block_num++, sec)) {
-+            puts("Failed to read ISO volume descriptor");
-+            return 0;
-+        }
-     }
- 
-     return 0;
- }
- 
--static IsoBcSection *find_iso_bc_entry(void)
-+static IsoBcSection *find_iso_bc_entry(uint32_t offset)
- {
-     IsoBcEntry *e = (IsoBcEntry *)sec;
--    uint32_t offset = find_iso_bc();
-     int i;
-     unsigned int loadparm = get_loadparm_index();
- 
-@@ -827,11 +844,13 @@ static IsoBcSection *find_iso_bc_entry(void)
-         return NULL;
-     }
- 
--    read_iso_sector(offset, sec, "Failed to read El Torito boot catalog");
-+    if (virtio_read(offset, sec)) {
-+        puts("Failed to read El Torito boot catalog");
-+        return NULL;
-+    }
- 
-     if (!is_iso_bc_valid(e)) {
-         /* The validation entry is mandatory */
--        panic("No valid boot catalog found!\n");
-         return NULL;
-     }
- 
-@@ -851,19 +870,25 @@ static IsoBcSection *find_iso_bc_entry(void)
-         }
-     }
- 
--    panic("No suitable boot entry found on ISO-9660 media!\n");
--
-     return NULL;
- }
- 
--static void ipl_iso_el_torito(void)
-+static int ipl_iso_el_torito(void)
- {
--    IsoBcSection *s = find_iso_bc_entry();
-+    uint32_t offset = find_iso_bc();
-+    if (!offset) {
-+        return 0;
-+    }
-+
-+    IsoBcSection *s = find_iso_bc_entry(offset);
- 
-     if (s) {
--        load_iso_bc_entry(s);
--        /* no return */
-+        load_iso_bc_entry(s); /* only return in error */
-+        return -1;
-     }
-+
-+    puts("No suitable boot entry found on ISO-9660 media!");
-+    return -EIO;
- }
- 
- /**
-@@ -893,7 +918,9 @@ static void zipl_load_vblk(void)
-         if (blksize != VIRTIO_ISO_BLOCK_SIZE) {
-             virtio_assume_iso9660();
-         }
--        ipl_iso_el_torito();
-+        if (ipl_iso_el_torito()) {
-+            return;
-+        }
-     }
- 
-     if (blksize != VIRTIO_DASD_DEFAULT_BLOCK_SIZE) {
-@@ -907,7 +934,9 @@ static void zipl_load_vscsi(void)
- {
-     if (virtio_get_block_size() == VIRTIO_ISO_BLOCK_SIZE) {
-         /* Is it an ISO image in non-CD drive? */
--        ipl_iso_el_torito();
-+        if (ipl_iso_el_torito()) {
-+            return;
-+        }
-     }
- 
-     puts("Using guessed DASD geometry.");
-diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h
-index 4a7d8a91f1..3cb573b86b 100644
---- a/pc-bios/s390-ccw/bootmap.h
-+++ b/pc-bios/s390-ccw/bootmap.h
-@@ -385,17 +385,14 @@ static inline uint32_t iso_733_to_u32(uint64_t x)
- 
- #define ISO_PRIMARY_VD_SECTOR 16
- 
--static inline void read_iso_sector(uint32_t block_offset, void *buf,
--                                   const char *errmsg)
--{
--    IPL_assert(virtio_read_many(block_offset, buf, 1) == 0, errmsg);
--}
--
--static inline void read_iso_boot_image(uint32_t block_offset, void *load_addr,
-+static inline int read_iso_boot_image(uint32_t block_offset, void *load_addr,
-                                        uint32_t blks_to_load)
- {
--    IPL_assert(virtio_read_many(block_offset, load_addr, blks_to_load) == 0,
--               "Failed to read boot image!");
-+    if (virtio_read_many(block_offset, load_addr, blks_to_load)) {
-+        puts("Failed to read boot image!");
-+        return -1;
-+    }
-+    return 0;
- }
- 
- #define ISO9660_MAX_DIR_DEPTH 8
-diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
-index 6abb34e563..3e844abd71 100644
---- a/pc-bios/s390-ccw/s390-ccw.h
-+++ b/pc-bios/s390-ccw/s390-ccw.h
-@@ -30,6 +30,7 @@ typedef unsigned long long u64;
- #define EIO     1
- #define EBUSY   2
- #define ENODEV  3
-+#define EINVAL  4
- 
- #ifndef MIN
- #define MIN(a, b) (((a) < (b)) ? (a) : (b))
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Remove-panics-from-Netboot-IPL-path.patch b/kvm-pc-bios-s390-ccw-Remove-panics-from-Netboot-IPL-path.patch
deleted file mode 100644
index 6507ce1..0000000
--- a/kvm-pc-bios-s390-ccw-Remove-panics-from-Netboot-IPL-path.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From e572d55c45c5c84e386034b0f853476326a08197 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:45 -0400
-Subject: [PATCH 12/27] pc-bios/s390-ccw: Remove panics from Netboot IPL path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [12/23] dd193b7e37849dc338d66ac40786e22ff050ae20 (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from Netboot specific functions so that error recovery
-may be possible in the future.
-
-Functions that would previously panic now provide a return code.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-12-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit f1a2a6e41ef76e02ddc5ede3dd042ef96b4fb8d2)
----
- pc-bios/s390-ccw/bootmap.c    |  1 +
- pc-bios/s390-ccw/netmain.c    | 17 +++++++++++------
- pc-bios/s390-ccw/s390-ccw.h   |  2 +-
- pc-bios/s390-ccw/virtio-net.c |  7 +++++--
- 4 files changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index 652807a16a..95ef9104d0 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -1072,6 +1072,7 @@ void zipl_load(void)
- 
-     if (virtio_get_device_type() == VIRTIO_ID_NET) {
-         netmain();
-+        panic("\n! Cannot IPL from this network !\n");
-     }
- 
-     if (ipl_scsi()) {
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index bc6ad8695f..d1a6c9a91c 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -464,7 +464,7 @@ static bool find_net_dev(Schib *schib, int dev_no)
-     return false;
- }
- 
--static void virtio_setup(void)
-+static bool virtio_setup(void)
- {
-     Schib schib;
-     int ssid;
-@@ -495,10 +495,10 @@ static void virtio_setup(void)
-         }
-     }
- 
--    IPL_assert(found, "No virtio net device found");
-+    return found;
- }
- 
--void netmain(void)
-+int netmain(void)
- {
-     filename_ip_t fn_ip;
-     int rc, fnlen;
-@@ -506,11 +506,15 @@ void netmain(void)
-     sclp_setup();
-     puts("Network boot starting...");
- 
--    virtio_setup();
-+    if (!virtio_setup()) {
-+        puts("No virtio net device found.");
-+        return -1;
-+    }
- 
-     rc = net_init(&fn_ip);
-     if (rc) {
--        panic("Network initialization failed. Halting.");
-+        puts("Network initialization failed.");
-+        return -1;
-     }
- 
-     fnlen = strlen(fn_ip.filename);
-@@ -528,5 +532,6 @@ void netmain(void)
-         jump_to_low_kernel();
-     }
- 
--    panic("Failed to load OS from network.");
-+    puts("Failed to load OS from network.");
-+    return -1;
- }
-diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
-index 3e844abd71..344ad15655 100644
---- a/pc-bios/s390-ccw/s390-ccw.h
-+++ b/pc-bios/s390-ccw/s390-ccw.h
-@@ -57,7 +57,7 @@ unsigned int get_loadparm_index(void);
- void main(void);
- 
- /* netmain.c */
--void netmain(void);
-+int netmain(void);
- 
- /* sclp.c */
- void sclp_print(const char *string);
-diff --git a/pc-bios/s390-ccw/virtio-net.c b/pc-bios/s390-ccw/virtio-net.c
-index 2fcb0a58c5..f9854a22c3 100644
---- a/pc-bios/s390-ccw/virtio-net.c
-+++ b/pc-bios/s390-ccw/virtio-net.c
-@@ -54,8 +54,11 @@ int virtio_net_init(void *mac_addr)
-     vdev->guest_features[0] = VIRTIO_NET_F_MAC_BIT;
-     virtio_setup_ccw(vdev);
- 
--    IPL_assert(vdev->guest_features[0] & VIRTIO_NET_F_MAC_BIT,
--               "virtio-net device does not support the MAC address feature");
-+    if (!(vdev->guest_features[0] & VIRTIO_NET_F_MAC_BIT)) {
-+        puts("virtio-net device does not support the MAC address feature");
-+        return -1;
-+    }
-+
-     memcpy(mac_addr, vdev->config.net.mac, ETH_ALEN);
- 
-     for (i = 0; i < 64; i++) {
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Remove-panics-from-SCSI-IPL-path.patch b/kvm-pc-bios-s390-ccw-Remove-panics-from-SCSI-IPL-path.patch
deleted file mode 100644
index 2d4fba4..0000000
--- a/kvm-pc-bios-s390-ccw-Remove-panics-from-SCSI-IPL-path.patch
+++ /dev/null
@@ -1,554 +0,0 @@
-From 23033a524625ad13448eda28d429d9265b213a7f Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:43 -0400
-Subject: [PATCH 10/27] pc-bios/s390-ccw: Remove panics from SCSI IPL path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [10/23] 4d8c58a0563e8977b045e7990deabe97c0614708 (thuth/qemu-kvm-cs9)
-
-Remove panic-on-error from virtio-scsi IPL specific functions so that error
-recovery may be possible in the future.
-
-Functions that would previously panic now provide a return code.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-10-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit facd91ac1af75b657fc80189fe9cb026bb1abdbc)
----
- pc-bios/s390-ccw/bootmap.c       |  88 ++++++++++++++-----
- pc-bios/s390-ccw/virtio-blkdev.c |   4 +-
- pc-bios/s390-ccw/virtio-scsi.c   | 143 +++++++++++++++++++++----------
- 3 files changed, 164 insertions(+), 71 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index b9596e28c7..652807a16a 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -595,7 +595,7 @@ static int ipl_eckd(void)
-  * IPL a SCSI disk
-  */
- 
--static void zipl_load_segment(ComponentEntry *entry)
-+static int zipl_load_segment(ComponentEntry *entry)
- {
-     const int max_entries = (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr));
-     ScsiBlockPtr *bprs = (void *)sec;
-@@ -615,7 +615,10 @@ static void zipl_load_segment(ComponentEntry *entry)
-     do {
-         memset(bprs, FREE_SPACE_FILLER, bprs_size);
-         fill_hex_val(blk_no, &blockno, sizeof(blockno));
--        read_block(blockno, bprs, err_msg);
-+        if (virtio_read(blockno, bprs)) {
-+            puts(err_msg);
-+            return -EIO;
-+        }
- 
-         for (i = 0;; i++) {
-             uint64_t *cur_desc = (void *)&bprs[i];
-@@ -643,23 +646,37 @@ static void zipl_load_segment(ComponentEntry *entry)
-             }
-             address = virtio_load_direct(cur_desc[0], cur_desc[1], 0,
-                                          (void *)address);
--            IPL_assert(address != -1, "zIPL load segment failed");
-+            if (!address) {
-+                puts("zIPL load segment failed");
-+                return -EIO;
-+            }
-         }
-     } while (blockno);
-+
-+    return 0;
- }
- 
- /* Run a zipl program */
--static void zipl_run(ScsiBlockPtr *pte)
-+static int zipl_run(ScsiBlockPtr *pte)
- {
-     ComponentHeader *header;
-     ComponentEntry *entry;
-     uint8_t tmp_sec[MAX_SECTOR_SIZE];
- 
--    read_block(pte->blockno, tmp_sec, "Cannot read header");
-+    if (virtio_read(pte->blockno, tmp_sec)) {
-+        puts("Cannot read header");
-+        return -EIO;
-+    }
-     header = (ComponentHeader *)tmp_sec;
- 
--    IPL_assert(magic_match(tmp_sec, ZIPL_MAGIC), "No zIPL magic in header");
--    IPL_assert(header->type == ZIPL_COMP_HEADER_IPL, "Bad header type");
-+    if (!magic_match(tmp_sec, ZIPL_MAGIC)) {
-+        puts("No zIPL magic in header");
-+        return -EINVAL;
-+    }
-+    if (header->type != ZIPL_COMP_HEADER_IPL) {
-+        puts("Bad header type");
-+        return -EINVAL;
-+    }
- 
-     dputs("start loading images\n");
- 
-@@ -674,22 +691,30 @@ static void zipl_run(ScsiBlockPtr *pte)
-             continue;
-         }
- 
--        zipl_load_segment(entry);
-+        if (zipl_load_segment(entry)) {
-+            return -1;
-+        }
- 
-         entry++;
- 
--        IPL_assert((uint8_t *)(&entry[1]) <= (tmp_sec + MAX_SECTOR_SIZE),
--                   "Wrong entry value");
-+        if ((uint8_t *)(&entry[1]) > (tmp_sec + MAX_SECTOR_SIZE)) {
-+            puts("Wrong entry value");
-+            return -EINVAL;
-+        }
-     }
- 
--    IPL_assert(entry->component_type == ZIPL_COMP_ENTRY_EXEC, "No EXEC entry");
-+    if (entry->component_type != ZIPL_COMP_ENTRY_EXEC) {
-+        puts("No EXEC entry");
-+        return -EINVAL;
-+    }
- 
-     /* should not return */
-     write_reset_psw(entry->compdat.load_psw);
-     jump_to_IPL_code(0);
-+    return -1;
- }
- 
--static void ipl_scsi(void)
-+static int ipl_scsi(void)
- {
-     ScsiMbr *mbr = (void *)sec;
-     int program_table_entries = 0;
-@@ -700,10 +725,13 @@ static void ipl_scsi(void)
- 
-     /* Grab the MBR */
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
--    read_block(0, mbr, "Cannot read block 0");
-+    if (virtio_read(0, mbr)) {
-+        puts("Cannot read block 0");
-+        return -EIO;
-+    }
- 
-     if (!magic_match(mbr->magic, ZIPL_MAGIC)) {
--        return;
-+        return 0;
-     }
- 
-     puts("Using SCSI scheme.");
-@@ -711,11 +739,20 @@ static void ipl_scsi(void)
-     IPL_check(mbr->version_id == 1,
-               "Unknown MBR layout version, assuming version 1");
-     debug_print_int("program table", mbr->pt.blockno);
--    IPL_assert(mbr->pt.blockno, "No Program Table");
-+    if (!mbr->pt.blockno) {
-+        puts("No Program Table");
-+        return -EINVAL;
-+    }
- 
-     /* Parse the program table */
--    read_block(mbr->pt.blockno, sec, "Error reading Program Table");
--    IPL_assert(magic_match(sec, ZIPL_MAGIC), "No zIPL magic in PT");
-+    if (virtio_read(mbr->pt.blockno, sec)) {
-+        puts("Error reading Program Table");
-+        return -EIO;
-+    }
-+    if (!magic_match(sec, ZIPL_MAGIC)) {
-+        puts("No zIPL magic in Program Table");
-+        return -EINVAL;
-+    }
- 
-     for (i = 0; i < MAX_BOOT_ENTRIES; i++) {
-         if (prog_table->entry[i].scsi.blockno) {
-@@ -725,17 +762,22 @@ static void ipl_scsi(void)
-     }
- 
-     debug_print_int("program table entries", program_table_entries);
--    IPL_assert(program_table_entries != 0, "Empty Program Table");
-+    if (program_table_entries == 0) {
-+        puts("Empty Program Table");
-+        return -EINVAL;
-+    }
- 
-     if (menu_is_enabled_enum()) {
-         loadparm = menu_get_enum_boot_index(valid_entries);
-     }
- 
-     debug_print_int("loadparm", loadparm);
--    IPL_assert(loadparm < MAX_BOOT_ENTRIES, "loadparm value greater than"
--               " maximum number of boot entries allowed");
-+    if (loadparm >= MAX_BOOT_ENTRIES) {
-+        puts("loadparm value greater than max number of boot entries allowed");
-+        return -EINVAL;
-+    }
- 
--    zipl_run(&prog_table->entry[loadparm].scsi); /* no return */
-+    return zipl_run(&prog_table->entry[loadparm].scsi);
- }
- 
- /***********************************************************************
-@@ -1032,7 +1074,9 @@ void zipl_load(void)
-         netmain();
-     }
- 
--    ipl_scsi();
-+    if (ipl_scsi()) {
-+        panic("\n! Cannot IPL this SCSI device !\n");
-+    }
- 
-     switch (virtio_get_device_type()) {
-     case VIRTIO_ID_BLOCK:
-diff --git a/pc-bios/s390-ccw/virtio-blkdev.c b/pc-bios/s390-ccw/virtio-blkdev.c
-index 2666326801..1c585f034b 100644
---- a/pc-bios/s390-ccw/virtio-blkdev.c
-+++ b/pc-bios/s390-ccw/virtio-blkdev.c
-@@ -73,13 +73,13 @@ unsigned long virtio_load_direct(unsigned long rec_list1, unsigned long rec_list
-     unsigned long addr = (unsigned long)load_addr;
- 
-     if (sec_len != virtio_get_block_size()) {
--        return -1;
-+        return 0;
-     }
- 
-     printf(".");
-     status = virtio_read_many(sec, (void *)addr, sec_num);
-     if (status) {
--        panic("I/O Error");
-+        return 0;
-     }
-     addr += sec_num * virtio_get_block_size();
- 
-diff --git a/pc-bios/s390-ccw/virtio-scsi.c b/pc-bios/s390-ccw/virtio-scsi.c
-index 6b4a1caf8a..71db75ce7b 100644
---- a/pc-bios/s390-ccw/virtio-scsi.c
-+++ b/pc-bios/s390-ccw/virtio-scsi.c
-@@ -26,7 +26,7 @@ static uint8_t scsi_inquiry_std_response[256];
- static ScsiInquiryEvpdPages scsi_inquiry_evpd_pages_response;
- static ScsiInquiryEvpdBl scsi_inquiry_evpd_bl_response;
- 
--static inline void vs_assert(bool term, const char **msgs)
-+static inline bool vs_assert(bool term, const char **msgs)
- {
-     if (!term) {
-         int i = 0;
-@@ -35,11 +35,13 @@ static inline void vs_assert(bool term, const char **msgs)
-         while (msgs[i]) {
-             printf("%s", msgs[i++]);
-         }
--        panic(" !\n");
-+        puts(" !");
-     }
-+
-+    return term;
- }
- 
--static void virtio_scsi_verify_response(VirtioScsiCmdResp *resp,
-+static bool virtio_scsi_verify_response(VirtioScsiCmdResp *resp,
-                                         const char *title)
- {
-     const char *mr[] = {
-@@ -56,8 +58,8 @@ static void virtio_scsi_verify_response(VirtioScsiCmdResp *resp,
-         0
-     };
- 
--    vs_assert(resp->response == VIRTIO_SCSI_S_OK, mr);
--    vs_assert(resp->status == CDB_STATUS_GOOD, ms);
-+    return vs_assert(resp->response == VIRTIO_SCSI_S_OK, mr) &&
-+           vs_assert(resp->status == CDB_STATUS_GOOD, ms);
- }
- 
- static void prepare_request(VDev *vdev, const void *cdb, int cdb_size,
-@@ -78,24 +80,31 @@ static void prepare_request(VDev *vdev, const void *cdb, int cdb_size,
-     }
- }
- 
--static inline void vs_io_assert(bool term, const char *msg)
-+static inline bool vs_io_assert(bool term, const char *msg)
- {
--    if (!term) {
--        virtio_scsi_verify_response(&resp, msg);
-+    if (!term && !virtio_scsi_verify_response(&resp, msg)) {
-+        return false;
-     }
-+
-+    return true;
- }
- 
--static void vs_run(const char *title, VirtioCmd *cmd, VDev *vdev,
-+static int vs_run(const char *title, VirtioCmd *cmd, VDev *vdev,
-                    const void *cdb, int cdb_size,
-                    void *data, uint32_t data_size)
- {
-     prepare_request(vdev, cdb, cdb_size, data, data_size);
--    vs_io_assert(virtio_run(vdev, VR_REQUEST, cmd) == 0, title);
-+    if (!vs_io_assert(virtio_run(vdev, VR_REQUEST, cmd) == 0, title)) {
-+        puts(title);
-+        return -EIO;
-+    }
-+
-+    return 0;
- }
- 
- /* SCSI protocol implementation routines */
- 
--static bool scsi_inquiry(VDev *vdev, uint8_t evpd, uint8_t page,
-+static int scsi_inquiry(VDev *vdev, uint8_t evpd, uint8_t page,
-                          void *data, uint32_t data_size)
- {
-     ScsiCdbInquiry cdb = {
-@@ -110,12 +119,13 @@ static bool scsi_inquiry(VDev *vdev, uint8_t evpd, uint8_t page,
-         { data, data_size, VRING_DESC_F_WRITE },
-     };
- 
--    vs_run("inquiry", inquiry, vdev, &cdb, sizeof(cdb), data, data_size);
-+    int ret = vs_run("inquiry", inquiry,
-+                     vdev, &cdb, sizeof(cdb), data, data_size);
- 
--    return virtio_scsi_response_ok(&resp);
-+    return ret ? ret : virtio_scsi_response_ok(&resp);
- }
- 
--static bool scsi_test_unit_ready(VDev *vdev)
-+static int scsi_test_unit_ready(VDev *vdev)
- {
-     ScsiCdbTestUnitReady cdb = {
-         .command = 0x00,
-@@ -131,7 +141,7 @@ static bool scsi_test_unit_ready(VDev *vdev)
-     return virtio_scsi_response_ok(&resp);
- }
- 
--static bool scsi_report_luns(VDev *vdev, void *data, uint32_t data_size)
-+static int scsi_report_luns(VDev *vdev, void *data, uint32_t data_size)
- {
-     ScsiCdbReportLuns cdb = {
-         .command = 0xa0,
-@@ -144,13 +154,13 @@ static bool scsi_report_luns(VDev *vdev, void *data, uint32_t data_size)
-         { data, data_size, VRING_DESC_F_WRITE },
-     };
- 
--    vs_run("report luns", report_luns,
-+    int ret = vs_run("report luns", report_luns,
-            vdev, &cdb, sizeof(cdb), data, data_size);
- 
--    return virtio_scsi_response_ok(&resp);
-+    return ret ? ret : virtio_scsi_response_ok(&resp);
- }
- 
--static bool scsi_read_10(VDev *vdev,
-+static int scsi_read_10(VDev *vdev,
-                          unsigned long sector, int sectors, void *data,
-                          unsigned int data_size)
- {
-@@ -168,12 +178,13 @@ static bool scsi_read_10(VDev *vdev,
-     debug_print_int("read_10  sector", sector);
-     debug_print_int("read_10 sectors", sectors);
- 
--    vs_run("read(10)", read_10, vdev, &cdb, sizeof(cdb), data, data_size);
-+    int ret = vs_run("read(10)", read_10,
-+            vdev, &cdb, sizeof(cdb), data, data_size);
- 
--    return virtio_scsi_response_ok(&resp);
-+    return ret ? ret : virtio_scsi_response_ok(&resp);
- }
- 
--static bool scsi_read_capacity(VDev *vdev,
-+static int scsi_read_capacity(VDev *vdev,
-                                void *data, uint32_t data_size)
- {
-     ScsiCdbReadCapacity16 cdb = {
-@@ -187,10 +198,10 @@ static bool scsi_read_capacity(VDev *vdev,
-         { data, data_size, VRING_DESC_F_WRITE },
-     };
- 
--    vs_run("read capacity", read_capacity_16,
-+    int ret = vs_run("read capacity", read_capacity_16,
-            vdev, &cdb, sizeof(cdb), data, data_size);
- 
--    return virtio_scsi_response_ok(&resp);
-+    return ret ? ret : virtio_scsi_response_ok(&resp);
- }
- 
- /* virtio-scsi routines */
-@@ -207,7 +218,7 @@ static int virtio_scsi_locate_device(VDev *vdev)
-     static uint8_t data[16 + 8 * 63];
-     ScsiLunReport *r = (void *) data;
-     ScsiDevice *sdev = vdev->scsi_device;
--    int i, luns;
-+    int i, ret, luns;
- 
-     /* QEMU has hardcoded channel #0 in many places.
-      * If this hardcoded value is ever changed, we'll need to add code for
-@@ -233,13 +244,21 @@ static int virtio_scsi_locate_device(VDev *vdev)
-         sdev->channel = channel;
-         sdev->target = target;
-         sdev->lun = 0;          /* LUN has to be 0 for REPORT LUNS */
--        if (!scsi_report_luns(vdev, data, sizeof(data))) {
-+        ret = scsi_report_luns(vdev, data, sizeof(data));
-+        if (ret < 0) {
-+            return ret;
-+        }
-+
-+        else if (ret == 0) {
-             if (resp.response == VIRTIO_SCSI_S_BAD_TARGET) {
-                 continue;
-             }
-             printf("target 0x%X\n", target);
--            virtio_scsi_verify_response(&resp, "SCSI cannot report LUNs");
-+            if (!virtio_scsi_verify_response(&resp, "SCSI cannot report LUNs")) {
-+                return -EIO;
-+            }
-         }
-+
-         if (r->lun_list_len == 0) {
-             printf("no LUNs for target 0x%X\n", target);
-             continue;
-@@ -283,7 +302,9 @@ int virtio_scsi_read_many(VDev *vdev,
-         data_size = sector_count * virtio_get_block_size() * f;
-         if (!scsi_read_10(vdev, sector * f, sector_count * f, load_addr,
-                           data_size)) {
--            virtio_scsi_verify_response(&resp, "virtio-scsi:read_many");
-+            if (!virtio_scsi_verify_response(&resp, "virtio-scsi:read_many")) {
-+                return -1;
-+            }
-         }
-         load_addr += data_size;
-         sector += sector_count;
-@@ -352,11 +373,16 @@ static int virtio_scsi_setup(VDev *vdev)
-             uint8_t code = resp.sense[0] & SCSI_SENSE_CODE_MASK;
-             uint8_t sense_key = resp.sense[2] & SCSI_SENSE_KEY_MASK;
- 
--            IPL_assert(resp.sense_len != 0, "virtio-scsi:setup: no SENSE data");
-+            if (resp.sense_len == 0) {
-+                puts("virtio-scsi: setup: no SENSE data");
-+                return -EINVAL;
-+            }
- 
--            IPL_assert(retry_test_unit_ready && code == 0x70 &&
--                       sense_key == SCSI_SENSE_KEY_UNIT_ATTENTION,
--                       "virtio-scsi:setup: cannot retry");
-+            if (!retry_test_unit_ready || code != 0x70 ||
-+                       sense_key != SCSI_SENSE_KEY_UNIT_ATTENTION) {
-+                puts("virtio-scsi:setup: cannot retry");
-+                return -EIO;
-+            }
- 
-             /* retry on CHECK_CONDITION/UNIT_ATTENTION as it
-              * may not designate a real error, but it may be
-@@ -367,16 +393,22 @@ static int virtio_scsi_setup(VDev *vdev)
-             continue;
-         }
- 
--        virtio_scsi_verify_response(&resp, "virtio-scsi:setup");
-+        if (!virtio_scsi_verify_response(&resp, "virtio-scsi:setup")) {
-+            return -1;
-+        }
-     }
- 
-     /* read and cache SCSI INQUIRY response */
--    if (!scsi_inquiry(vdev,
-+    ret = scsi_inquiry(vdev,
-                       SCSI_INQUIRY_STANDARD,
-                       SCSI_INQUIRY_STANDARD_NONE,
-                       scsi_inquiry_std_response,
--                      sizeof(scsi_inquiry_std_response))) {
--        virtio_scsi_verify_response(&resp, "virtio-scsi:setup:inquiry");
-+                      sizeof(scsi_inquiry_std_response));
-+    if (ret < 1) {
-+        if (ret != 0 || !virtio_scsi_verify_response(&resp,
-+                "virtio-scsi:setup:inquiry")) {
-+            return -1;
-+        }
-     }
- 
-     if (virtio_scsi_inquiry_response_is_cdrom(scsi_inquiry_std_response)) {
-@@ -385,12 +417,16 @@ static int virtio_scsi_setup(VDev *vdev)
-         vdev->scsi_block_size = VIRTIO_ISO_BLOCK_SIZE;
-     }
- 
--    if (!scsi_inquiry(vdev,
-+    ret = scsi_inquiry(vdev,
-                       SCSI_INQUIRY_EVPD,
-                       SCSI_INQUIRY_EVPD_SUPPORTED_PAGES,
-                       evpd,
--                      sizeof(*evpd))) {
--        virtio_scsi_verify_response(&resp, "virtio-scsi:setup:supported_pages");
-+                      sizeof(*evpd));
-+    if (ret < 1) {
-+        if (ret != 0 || !virtio_scsi_verify_response(&resp,
-+                "virtio-scsi:setup:supported_pages")) {
-+            return -1;
-+        }
-     }
- 
-     debug_print_int("EVPD length", evpd->page_length);
-@@ -402,12 +438,16 @@ static int virtio_scsi_setup(VDev *vdev)
-             continue;
-         }
- 
--        if (!scsi_inquiry(vdev,
-+        ret = scsi_inquiry(vdev,
-                           SCSI_INQUIRY_EVPD,
-                           SCSI_INQUIRY_EVPD_BLOCK_LIMITS,
-                           evpd_bl,
--                          sizeof(*evpd_bl))) {
--            virtio_scsi_verify_response(&resp, "virtio-scsi:setup:blocklimits");
-+                          sizeof(*evpd_bl));
-+        if (ret < 1) {
-+            if (ret != 0 || !virtio_scsi_verify_response(&resp,
-+                    "virtio-scsi:setup:blocklimits")) {
-+                return -1;
-+            }
-         }
- 
-         debug_print_int("max transfer", evpd_bl->max_transfer);
-@@ -423,8 +463,12 @@ static int virtio_scsi_setup(VDev *vdev)
-     vdev->max_transfer = MIN_NON_ZERO(VIRTIO_SCSI_MAX_SECTORS,
-                                       vdev->max_transfer);
- 
--    if (!scsi_read_capacity(vdev, data, data_size)) {
--        virtio_scsi_verify_response(&resp, "virtio-scsi:setup:read_capacity");
-+    ret = scsi_read_capacity(vdev, data, data_size);
-+    if (ret < 1) {
-+        if (ret != 0 || !virtio_scsi_verify_response(&resp,
-+                "virtio-scsi:setup:read_capacity")) {
-+            return -1;
-+        }
-     }
-     scsi_parse_capacity_report(data, &vdev->scsi_last_block,
-                                (uint32_t *) &vdev->scsi_block_size);
-@@ -439,10 +483,15 @@ int virtio_scsi_setup_device(SubChannelId schid)
-     vdev->schid = schid;
-     virtio_setup_ccw(vdev);
- 
--    IPL_assert(vdev->config.scsi.sense_size == VIRTIO_SCSI_SENSE_SIZE,
--               "Config: sense size mismatch");
--    IPL_assert(vdev->config.scsi.cdb_size == VIRTIO_SCSI_CDB_SIZE,
--               "Config: CDB size mismatch");
-+    if (vdev->config.scsi.sense_size != VIRTIO_SCSI_SENSE_SIZE) {
-+        puts("Config: sense size mismatch");
-+        return -EINVAL;
-+    }
-+
-+    if (vdev->config.scsi.cdb_size != VIRTIO_SCSI_CDB_SIZE) {
-+        puts("Config: CDB size mismatch");
-+        return -EINVAL;
-+    }
- 
-     puts("Using virtio-scsi.");
- 
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-Use-the-libc-from-SLOF-and-remove-s.patch b/kvm-pc-bios-s390-ccw-Use-the-libc-from-SLOF-and-remove-s.patch
deleted file mode 100644
index 037d987..0000000
--- a/kvm-pc-bios-s390-ccw-Use-the-libc-from-SLOF-and-remove-s.patch
+++ /dev/null
@@ -1,1208 +0,0 @@
-From 4207901122ef7ad3f08ed2e387bd133cc4a35baf Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:36 -0400
-Subject: [PATCH 02/27] pc-bios/s390-ccw: Use the libc from SLOF and remove
- sclp prints
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/23] ee701f93051e2bfb79da5cbbd089b24490bca128 (thuth/qemu-kvm-cs9)
-
-We are already using the libc from SLOF for the s390-netboot.img, and
-this libc implementation is way more complete and accurate than the
-simple implementation that we currently use for the s390-ccw.img binary.
-Since we are now always assuming that the SLOF submodule is available
-when building the s390-ccw bios (see commit bf6903f6944f), we can drop
-the simple implementation and use the SLOF libc for the s390-ccw.img
-binary, too.
-
-Additionally replace sclp_print calls with puts/printf now that it is
-available.
-
-Co-authored by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20241020012953.1380075-3-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 9f4278837dc770266c8a026696dd91a525dd2682)
----
- pc-bios/s390-ccw/Makefile               | 15 +++--
- pc-bios/s390-ccw/bootmap.c              | 47 ++++++-------
- pc-bios/s390-ccw/bootmap.h              |  4 +-
- pc-bios/s390-ccw/cio.c                  | 78 ++++++++++------------
- pc-bios/s390-ccw/dasd-ipl.c             |  5 +-
- pc-bios/s390-ccw/jump2ipl.c             |  5 +-
- pc-bios/s390-ccw/libc.c                 | 88 ------------------------
- pc-bios/s390-ccw/libc.h                 | 89 -------------------------
- pc-bios/s390-ccw/main.c                 | 14 ++--
- pc-bios/s390-ccw/menu.c                 | 51 +++++++-------
- pc-bios/s390-ccw/netboot.mak            |  3 -
- pc-bios/s390-ccw/netmain.c              | 10 +--
- pc-bios/s390-ccw/s390-ccw.h             | 30 +++------
- pc-bios/s390-ccw/sclp.c                 |  7 +-
- pc-bios/s390-ccw/virtio-blkdev.c        |  6 +-
- pc-bios/s390-ccw/virtio-scsi.c          | 17 ++---
- pc-bios/s390-ccw/virtio.c               |  2 +-
- tests/tcg/s390x/Makefile.softmmu-target |  2 +-
- tests/tcg/s390x/console.c               |  3 +
- 19 files changed, 140 insertions(+), 336 deletions(-)
- delete mode 100644 pc-bios/s390-ccw/libc.c
- delete mode 100644 pc-bios/s390-ccw/libc.h
-
-diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
-index 6207911b53..3f4232636e 100644
---- a/pc-bios/s390-ccw/Makefile
-+++ b/pc-bios/s390-ccw/Makefile
-@@ -33,13 +33,18 @@ QEMU_DGFLAGS = -MMD -MP -MT $@ -MF $(@D)/$(*F).d
- .PHONY : all clean build-all distclean
- 
- OBJECTS = start.o main.o bootmap.o jump2ipl.o sclp.o menu.o \
--	  virtio.o virtio-scsi.o virtio-blkdev.o libc.o cio.o dasd-ipl.o
-+	  virtio.o virtio-scsi.o virtio-blkdev.o cio.o dasd-ipl.o
-+
-+SLOF_DIR := $(SRC_PATH)/../../roms/SLOF
-+
-+LIBC_INC := -nostdinc -I$(SLOF_DIR)/lib/libc/include
- 
- EXTRA_CFLAGS += -Wall
- EXTRA_CFLAGS += -ffreestanding -fno-delete-null-pointer-checks -fno-common -fPIE
- EXTRA_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
- EXTRA_CFLAGS += -msoft-float
- EXTRA_CFLAGS += -std=gnu99
-+EXTRA_CFLAGS += $(LIBC_INC)
- LDFLAGS += -Wl,-pie -nostdlib -z noexecstack
- 
- cc-test = $(CC) -Werror $1 -c -o /dev/null -xc /dev/null >/dev/null 2>/dev/null
-@@ -55,18 +60,18 @@ config-cc.mak: Makefile
- 	    $(call cc-option,-march=z900,-march=z10)) 3> config-cc.mak
- -include config-cc.mak
- 
-+include $(SRC_PATH)/netboot.mak
-+
- build-all: s390-ccw.img s390-netboot.img
- 
--s390-ccw.elf: $(OBJECTS)
--	$(call quiet-command,$(CC) $(LDFLAGS) -o $@ $(OBJECTS),Linking)
-+s390-ccw.elf: $(OBJECTS) libc.a
-+	$(call quiet-command,$(CC) $(LDFLAGS) -o $@ $^,Linking)
- 
- s390-ccw.img: s390-ccw.elf
- 	$(call quiet-command,$(STRIP) --strip-unneeded $< -o $@,Stripping $< into)
- 
- $(OBJECTS): Makefile
- 
--include $(SRC_PATH)/netboot.mak
--
- ALL_OBJS = $(sort $(OBJECTS) $(NETOBJS) $(LIBCOBJS) $(LIBNETOBJS))
- -include $(ALL_OBJS:%.o=%.d)
- 
-diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
-index a2137449dc..3cc79706be 100644
---- a/pc-bios/s390-ccw/bootmap.c
-+++ b/pc-bios/s390-ccw/bootmap.c
-@@ -8,7 +8,8 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "s390-arch.h"
- #include "bootmap.h"
-@@ -21,7 +22,7 @@
- 
- #ifdef DEBUG_FALLBACK
- #define dputs(txt) \
--    do { sclp_print("zipl: " txt); } while (0)
-+    do { printf("zipl: " txt); } while (0)
- #else
- #define dputs(fmt, ...) \
-     do { } while (0)
-@@ -270,7 +271,7 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
-         prev_block_nr = cur_block_nr;
-     }
- 
--    sclp_print("No zipl boot menu data found. Booting default entry.");
-+    printf("No zipl boot menu data found. Booting default entry.");
-     return 0;
- }
- 
-@@ -338,22 +339,22 @@ static void ipl_eckd_cdl(void)
-     block_number_t bmt_block_nr, s1b_block_nr;
- 
-     /* we have just read the block #0 and recognized it as "IPL1" */
--    sclp_print("CDL\n");
-+    puts("CDL");
- 
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
-     read_block(1, ipl2, "Cannot read IPL2 record at block 1");
- 
-     mbr = &ipl2->mbr;
-     if (!magic_match(mbr, ZIPL_MAGIC)) {
--        sclp_print("No zIPL section in IPL2 record.\n");
-+        puts("No zIPL section in IPL2 record.");
-         return;
-     }
-     if (!block_size_ok(mbr->blockptr.xeckd.bptr.size)) {
--        sclp_print("Bad block size in zIPL section of IPL2 record.\n");
-+        puts("Bad block size in zIPL section of IPL2 record.");
-         return;
-     }
-     if (mbr->dev_type != DEV_TYPE_ECKD) {
--        sclp_print("Non-ECKD device type in zIPL section of IPL2 record.\n");
-+        puts("Non-ECKD device type in zIPL section of IPL2 record.");
-         return;
-     }
- 
-@@ -366,11 +367,11 @@ static void ipl_eckd_cdl(void)
-     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
-     read_block(2, vlbl, "Cannot read Volume Label at block 2");
-     if (!magic_match(vlbl->key, VOL1_MAGIC)) {
--        sclp_print("Invalid magic of volume label block.\n");
-+        puts("Invalid magic of volume label block.");
-         return;
-     }
-     if (!magic_match(vlbl->f.key, VOL1_MAGIC)) {
--        sclp_print("Invalid magic of volser block.\n");
-+        puts("Invalid magic of volser block.");
-         return;
-     }
-     print_volser(vlbl->f.volser);
-@@ -384,8 +385,8 @@ static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
-     LDL_VTOC *vlbl = (void *)sec; /* already read, 3rd block */
-     char msg[4] = { '?', '.', '\n', '\0' };
- 
--    sclp_print((mode == ECKD_CMS) ? "CMS" : "LDL");
--    sclp_print(" version ");
-+    printf((mode == ECKD_CMS) ? "CMS" : "LDL");
-+    printf(" version ");
-     switch (vlbl->LDL_version) {
-     case LDL1_VERSION:
-         msg[0] = '1';
-@@ -398,7 +399,7 @@ static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
-         msg[1] = '?';
-         break;
-     }
--    sclp_print(msg);
-+    printf("%s", msg);
-     print_volser(vlbl->volser);
- }
- 
-@@ -419,7 +420,7 @@ static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
-         if (!magic_match(ipl1->bip.magic, ZIPL_MAGIC)) {
-             return; /* not applicable layout */
-         }
--        sclp_print("unlabeled LDL.\n");
-+        puts("unlabeled LDL.");
-     }
-     verify_boot_info(&ipl1->bip);
- 
-@@ -466,7 +467,7 @@ static void print_eckd_msg(void)
-             *p-- = ' ';
-         }
-     }
--    sclp_print(msg);
-+    printf("%s", msg);
- }
- 
- static void ipl_eckd(void)
-@@ -488,11 +489,11 @@ static void ipl_eckd(void)
-     if (eckd_valid_address((ExtEckdBlockPtr *)&vlbl->f.br, 0)) {
-         ldipl_bmt = eckd_find_bmt((ExtEckdBlockPtr *)&vlbl->f.br);
-         if (ldipl_bmt) {
--            sclp_print("List-Directed\n");
-+            puts("List-Directed");
-             /* LD-IPL does not use the S1B bock, just make it NULL */
-             run_eckd_boot_script(ldipl_bmt, NULL_BLOCK_NR);
-             /* Only return in error, retry as CCW-IPL */
--            sclp_print("Retrying IPL ");
-+            printf("Retrying IPL ");
-             print_eckd_msg();
-         }
-         memset(sec, FREE_SPACE_FILLER, sizeof(sec));
-@@ -634,7 +635,7 @@ static void ipl_scsi(void)
-         return;
-     }
- 
--    sclp_print("Using SCSI scheme.\n");
-+    puts("Using SCSI scheme.");
-     debug_print_int("MBR Version", mbr->version_id);
-     IPL_check(mbr->version_id == 1,
-               "Unknown MBR layout version, assuming version 1");
-@@ -743,7 +744,7 @@ static inline uint32_t iso_get_file_size(uint32_t load_rba)
-             if (cur_record->file_flags & 0x2) {
-                 /* Subdirectory */
-                 if (level == ISO9660_MAX_DIR_DEPTH - 1) {
--                    sclp_print("ISO-9660 directory depth limit exceeded\n");
-+                    puts("ISO-9660 directory depth limit exceeded");
-                 } else {
-                     level++;
-                     sec_loc[level] = iso_733_to_u32(cur_record->ext_loc);
-@@ -778,9 +779,9 @@ static void load_iso_bc_entry(IsoBcSection *load)
-     if (real_size) {
-         /* Round up blocks to load */
-         blks_to_load = (real_size + ISO_SECTOR_SIZE - 1) / ISO_SECTOR_SIZE;
--        sclp_print("ISO boot image size verified\n");
-+        puts("ISO boot image size verified");
-     } else {
--        sclp_print("ISO boot image size could not be verified\n");
-+        puts("ISO boot image size could not be verified");
-     }
- 
-     read_iso_boot_image(bswap32(s.load_rba),
-@@ -896,7 +897,7 @@ static void zipl_load_vblk(void)
-     }
- 
-     if (blksize != VIRTIO_DASD_DEFAULT_BLOCK_SIZE) {
--        sclp_print("Using guessed DASD geometry.\n");
-+        puts("Using guessed DASD geometry.");
-         virtio_assume_eckd();
-     }
-     ipl_eckd();
-@@ -909,7 +910,7 @@ static void zipl_load_vscsi(void)
-         ipl_iso_el_torito();
-     }
- 
--    sclp_print("Using guessed DASD geometry.\n");
-+    puts("Using guessed DASD geometry.");
-     virtio_assume_eckd();
-     ipl_eckd();
- }
-@@ -944,5 +945,5 @@ void zipl_load(void)
-         panic("\n! Unknown IPL device type !\n");
-     }
- 
--    sclp_print("zIPL load failed.\n");
-+    puts("zIPL load failed.");
- }
-diff --git a/pc-bios/s390-ccw/bootmap.h b/pc-bios/s390-ccw/bootmap.h
-index d4690a88c2..4a7d8a91f1 100644
---- a/pc-bios/s390-ccw/bootmap.h
-+++ b/pc-bios/s390-ccw/bootmap.h
-@@ -336,9 +336,7 @@ static inline void print_volser(const void *volser)
- 
-     ebcdic_to_ascii((char *)volser, ascii, 6);
-     ascii[6] = '\0';
--    sclp_print("VOLSER=[");
--    sclp_print(ascii);
--    sclp_print("]\n");
-+    printf("VOLSER=[%s]\n", ascii);
- }
- 
- static inline bool unused_space(const void *p, size_t size)
-diff --git a/pc-bios/s390-ccw/cio.c b/pc-bios/s390-ccw/cio.c
-index 83ca27ab41..7b09a38c96 100644
---- a/pc-bios/s390-ccw/cio.c
-+++ b/pc-bios/s390-ccw/cio.c
-@@ -11,7 +11,8 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "s390-arch.h"
- #include "helper.h"
-@@ -90,9 +91,9 @@ static void print_eckd_dasd_sense_data(SenseDataEckdDasd *sd)
-     char msgline[512];
- 
-     if (sd->config_info & 0x8000) {
--        sclp_print("Eckd Dasd Sense Data (fmt 24-bytes):\n");
-+        puts("Eckd Dasd Sense Data (fmt 24-bytes):");
-     } else {
--        sclp_print("Eckd Dasd Sense Data (fmt 32-bytes):\n");
-+        puts("Eckd Dasd Sense Data (fmt 32-bytes):");
-     }
- 
-     strcat(msgline, "    Sense Condition Flags :");
-@@ -158,22 +159,21 @@ static void print_eckd_dasd_sense_data(SenseDataEckdDasd *sd)
-     if (sd->status[1] & SNS_STAT2_IMPRECISE_END) {
-         strcat(msgline, " [Imprecise-End]");
-     }
--    strcat(msgline, "\n");
--    sclp_print(msgline);
--
--    print_int("    Residual Count     =", sd->res_count);
--    print_int("    Phys Drive ID      =", sd->phys_drive_id);
--    print_int("    low cyl address    =", sd->low_cyl_addr);
--    print_int("    head addr & hi cyl =", sd->head_high_cyl_addr);
--    print_int("    format/message     =", sd->fmt_msg);
--    print_int("    fmt-dependent[0-7] =", sd->fmt_dependent_info[0]);
--    print_int("    fmt-dependent[8-15]=", sd->fmt_dependent_info[1]);
--    print_int("    prog action code   =", sd->program_action_code);
--    print_int("    Configuration info =", sd->config_info);
--    print_int("    mcode / hi-cyl     =", sd->mcode_hicyl);
--    print_int("    cyl & head addr [0]=", sd->cyl_head_addr[0]);
--    print_int("    cyl & head addr [1]=", sd->cyl_head_addr[1]);
--    print_int("    cyl & head addr [2]=", sd->cyl_head_addr[2]);
-+    puts(msgline);
-+
-+    printf("    Residual Count     = 0x%X\n", sd->res_count);
-+    printf("    Phys Drive ID      = 0x%X\n", sd->phys_drive_id);
-+    printf("    low cyl address    = 0x%X\n", sd->low_cyl_addr);
-+    printf("    head addr & hi cyl = 0x%X\n", sd->head_high_cyl_addr);
-+    printf("    format/message     = 0x%X\n", sd->fmt_msg);
-+    printf("    fmt-dependent[0-7] = 0x%llX\n", sd->fmt_dependent_info[0]);
-+    printf("    fmt-dependent[8-15]= 0x%llX\n", sd->fmt_dependent_info[1]);
-+    printf("    prog action code   = 0x%X\n", sd->program_action_code);
-+    printf("    Configuration info = 0x%X\n", sd->config_info);
-+    printf("    mcode / hi-cyl     = 0x%X\n", sd->mcode_hicyl);
-+    printf("    cyl & head addr [0]= 0x%X\n", sd->cyl_head_addr[0]);
-+    printf("    cyl & head addr [1]= 0x%X\n", sd->cyl_head_addr[1]);
-+    printf("    cyl & head addr [2]= 0x%X\n", sd->cyl_head_addr[2]);
- }
- 
- static void print_irb_err(Irb *irb)
-@@ -182,7 +182,7 @@ static void print_irb_err(Irb *irb)
-     uint64_t prev_ccw = *(uint64_t *)u32toptr(irb->scsw.cpa - 8);
-     char msgline[256];
- 
--    sclp_print("Interrupt Response Block Data:\n");
-+    puts("Interrupt Response Block Data:");
- 
-     strcat(msgline, "    Function Ctrl :");
-     if (irb->scsw.ctrl & SCSW_FCTL_START_FUNC) {
-@@ -194,8 +194,7 @@ static void print_irb_err(Irb *irb)
-     if (irb->scsw.ctrl & SCSW_FCTL_CLEAR_FUNC) {
-         strcat(msgline, " [Clear]");
-     }
--    strcat(msgline, "\n");
--    sclp_print(msgline);
-+    puts(msgline);
- 
-     msgline[0] = '\0';
-     strcat(msgline, "    Activity Ctrl :");
-@@ -220,8 +219,7 @@ static void print_irb_err(Irb *irb)
-     if (irb->scsw.ctrl & SCSW_ACTL_SUSPENDED) {
-         strcat(msgline, " [Suspended]");
-     }
--    strcat(msgline, "\n");
--    sclp_print(msgline);
-+    puts(msgline);
- 
-     msgline[0] = '\0';
-     strcat(msgline, "    Status Ctrl :");
-@@ -240,9 +238,7 @@ static void print_irb_err(Irb *irb)
-     if (irb->scsw.ctrl & SCSW_SCTL_STATUS_PEND) {
-         strcat(msgline, " [Status-Pending]");
-     }
--
--    strcat(msgline, "\n");
--    sclp_print(msgline);
-+    puts(msgline);
- 
-     msgline[0] = '\0';
-     strcat(msgline, "    Device Status :");
-@@ -270,8 +266,7 @@ static void print_irb_err(Irb *irb)
-     if (irb->scsw.dstat & SCSW_DSTAT_UEXCP) {
-         strcat(msgline, " [Unit-Exception]");
-     }
--    strcat(msgline, "\n");
--    sclp_print(msgline);
-+    puts(msgline);
- 
-     msgline[0] = '\0';
-     strcat(msgline, "    Channel Status :");
-@@ -299,12 +294,11 @@ static void print_irb_err(Irb *irb)
-     if (irb->scsw.cstat & SCSW_CSTAT_CHAINCHK) {
-         strcat(msgline, " [Chaining-Check]");
-     }
--    strcat(msgline, "\n");
--    sclp_print(msgline);
-+    puts(msgline);
- 
--    print_int("    cpa=", irb->scsw.cpa);
--    print_int("    prev_ccw=", prev_ccw);
--    print_int("    this_ccw=", this_ccw);
-+    printf("    cpa= 0x%X\n", irb->scsw.cpa);
-+    printf("    prev_ccw= 0x%llX\n", prev_ccw);
-+    printf("    this_ccw= 0x%llX\n", this_ccw);
- }
- 
- /*
-@@ -341,7 +335,7 @@ static int __do_cio(SubChannelId schid, uint32_t ccw_addr, int fmt, Irb *irb)
-         return -1;
-     }
-     if (rc) {
--        print_int("ssch failed with cc=", rc);
-+        printf("ssch failed with cc= 0x%x\n", rc);
-         return rc;
-     }
- 
-@@ -350,7 +344,7 @@ static int __do_cio(SubChannelId schid, uint32_t ccw_addr, int fmt, Irb *irb)
-     /* collect status */
-     rc = tsch(schid, irb);
-     if (rc) {
--        print_int("tsch failed with cc=", rc);
-+        printf("tsch failed with cc= 0x%X\n", rc);
-     }
- 
-     return rc;
-@@ -406,12 +400,12 @@ int do_cio(SubChannelId schid, uint16_t cutype, uint32_t ccw_addr, int fmt)
-             continue;
-         }
- 
--        sclp_print("cio device error\n");
--        print_int("  ssid  ", schid.ssid);
--        print_int("  cssid ", schid.cssid);
--        print_int("  sch_no", schid.sch_no);
--        print_int("  ctrl-unit type", cutype);
--        sclp_print("\n");
-+        printf("cio device error\n");
-+        printf("  ssid  0x%X\n", schid.ssid);
-+        printf("  cssid 0x%X\n", schid.cssid);
-+        printf("  sch_no 0x%X\n", schid.sch_no);
-+        printf("  ctrl-unit type 0x%X\n", cutype);
-+        printf("\n");
-         print_irb_err(&irb);
-         if (cutype == CU_TYPE_DASD_3990 || cutype == CU_TYPE_DASD_2107 ||
-             cutype == CU_TYPE_UNKNOWN) {
-diff --git a/pc-bios/s390-ccw/dasd-ipl.c b/pc-bios/s390-ccw/dasd-ipl.c
-index 254bb1a15e..ae751adec1 100644
---- a/pc-bios/s390-ccw/dasd-ipl.c
-+++ b/pc-bios/s390-ccw/dasd-ipl.c
-@@ -8,7 +8,8 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "s390-arch.h"
- #include "dasd-ipl.h"
-@@ -82,7 +83,7 @@ static int run_dynamic_ccw_program(SubChannelId schid, uint16_t cutype,
-     do {
-         has_next = dynamic_cp_fixup(cpa, &next_cpa);
- 
--        print_int("executing ccw chain at ", cpa);
-+        printf("executing ccw chain at 0x%X\n", cpa);
-         enable_prefixing();
-         rc = do_cio(schid, cutype, cpa, CCW_FMT0);
-         disable_prefixing();
-diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
-index 78f5f46533..80b7f6a1f3 100644
---- a/pc-bios/s390-ccw/jump2ipl.c
-+++ b/pc-bios/s390-ccw/jump2ipl.c
-@@ -6,7 +6,8 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "s390-arch.h"
- 
-@@ -57,7 +58,7 @@ void jump_to_IPL_code(uint64_t address)
-     debug_print_int("set IPL addr to", address ?: *reset_psw & PSW_MASK_SHORT_ADDR);
- 
-     /* Ensure the guest output starts fresh */
--    sclp_print("\n");
-+    printf("\n");
- 
-     /*
-      * HACK ALERT.
-diff --git a/pc-bios/s390-ccw/libc.c b/pc-bios/s390-ccw/libc.c
-deleted file mode 100644
-index 3187923950..0000000000
---- a/pc-bios/s390-ccw/libc.c
-+++ /dev/null
-@@ -1,88 +0,0 @@
--/*
-- * libc-style definitions and functions
-- *
-- * Copyright 2018 IBM Corp.
-- * Author(s): Collin L. Walling <walling@linux.vnet.ibm.com>
-- *
-- * This code is free software; you can redistribute it and/or modify it
-- * under the terms of the GNU General Public License as published by the
-- * Free Software Foundation; either version 2 of the License, or (at your
-- * option) any later version.
-- */
--
--#include "libc.h"
--#include "s390-ccw.h"
--
--/**
-- * atoui:
-- * @str: the string to be converted.
-- *
-- * Given a string @str, convert it to an integer. Leading spaces are
-- * ignored. Any other non-numerical value will terminate the conversion
-- * and return 0. This function only handles numbers between 0 and
-- * UINT64_MAX inclusive.
-- *
-- * Returns: an integer converted from the string @str, or the number 0
-- * if an error occurred.
-- */
--uint64_t atoui(const char *str)
--{
--    int val = 0;
--
--    if (!str || !str[0]) {
--        return 0;
--    }
--
--    while (*str == ' ') {
--        str++;
--    }
--
--    while (*str) {
--        if (!isdigit(*(unsigned char *)str)) {
--            break;
--        }
--        val = val * 10 + *str - '0';
--        str++;
--    }
--
--    return val;
--}
--
--/**
-- * uitoa:
-- * @num: an integer (base 10) to be converted.
-- * @str: a pointer to a string to store the conversion.
-- * @len: the length of the passed string.
-- *
-- * Given an integer @num, convert it to a string. The string @str must be
-- * allocated beforehand. The resulting string will be null terminated and
-- * returned. This function only handles numbers between 0 and UINT64_MAX
-- * inclusive.
-- *
-- * Returns: the string @str of the converted integer @num
-- */
--char *uitoa(uint64_t num, char *str, size_t len)
--{
--    long num_idx = 1; /* account for NUL */
--    uint64_t tmp = num;
--
--    IPL_assert(str != NULL, "uitoa: no space allocated to store string");
--
--    /* Count indices of num */
--    while ((tmp /= 10) != 0) {
--        num_idx++;
--    }
--
--    /* Check if we have enough space for num and NUL */
--    IPL_assert(len > num_idx, "uitoa: array too small for conversion");
--
--    str[num_idx--] = '\0';
--
--    /* Convert int to string */
--    while (num_idx >= 0) {
--        str[num_idx--] = num % 10 + '0';
--        num /= 10;
--    }
--
--    return str;
--}
-diff --git a/pc-bios/s390-ccw/libc.h b/pc-bios/s390-ccw/libc.h
-deleted file mode 100644
-index bcdc45732d..0000000000
---- a/pc-bios/s390-ccw/libc.h
-+++ /dev/null
-@@ -1,89 +0,0 @@
--/*
-- * libc-style definitions and functions
-- *
-- * Copyright (c) 2013 Alexander Graf <agraf@suse.de>
-- *
-- * This code is free software; you can redistribute it and/or modify it
-- * under the terms of the GNU General Public License as published by the
-- * Free Software Foundation; either version 2 of the License, or (at your
-- * option) any later version.
-- */
--
--#ifndef S390_CCW_LIBC_H
--#define S390_CCW_LIBC_H
--
--typedef unsigned long      size_t;
--typedef int                bool;
--typedef unsigned char      uint8_t;
--typedef unsigned short     uint16_t;
--typedef unsigned int       uint32_t;
--typedef unsigned long long uint64_t;
--
--static inline void *memset(void *s, int c, size_t n)
--{
--    size_t i;
--    unsigned char *p = s;
--
--    for (i = 0; i < n; i++) {
--        p[i] = c;
--    }
--
--    return s;
--}
--
--static inline void *memcpy(void *s1, const void *s2, size_t n)
--{
--    uint8_t *dest = s1;
--    const uint8_t *src = s2;
--    size_t i;
--
--    for (i = 0; i < n; i++) {
--        dest[i] = src[i];
--    }
--
--    return s1;
--}
--
--static inline int memcmp(const void *s1, const void *s2, size_t n)
--{
--    size_t i;
--    const uint8_t *p1 = s1, *p2 = s2;
--
--    for (i = 0; i < n; i++) {
--        if (p1[i] != p2[i]) {
--            return p1[i] > p2[i] ? 1 : -1;
--        }
--    }
--
--    return 0;
--}
--
--static inline size_t strlen(const char *str)
--{
--    size_t i;
--    for (i = 0; *str; i++) {
--        str++;
--    }
--    return i;
--}
--
--static inline char *strcat(char *dest, const char *src)
--{
--    int i;
--    char *dest_end = dest + strlen(dest);
--
--    for (i = 0; i <= strlen(src); i++) {
--        dest_end[i] = src[i];
--    }
--    return dest;
--}
--
--static inline int isdigit(int c)
--{
--    return (c >= '0') && (c <= '9');
--}
--
--uint64_t atoui(const char *str);
--char *uitoa(uint64_t num, char *str, size_t len);
--
--#endif
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index 5506798098..203df20965 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -8,7 +8,9 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <stdlib.h>
-+#include <string.h>
-+#include <stdio.h>
- #include "helper.h"
- #include "s390-arch.h"
- #include "s390-ccw.h"
-@@ -50,7 +52,7 @@ void write_iplb_location(void)
- 
- unsigned int get_loadparm_index(void)
- {
--    return atoui(loadparm_str);
-+    return atoi(loadparm_str);
- }
- 
- static int is_dev_possibly_bootable(int dev_no, int sch_no)
-@@ -176,7 +178,7 @@ static void boot_setup(void)
- 
-     sclp_get_loadparm_ascii(loadparm_str);
-     memcpy(lpmsg + 10, loadparm_str, 8);
--    sclp_print(lpmsg);
-+    puts(lpmsg);
- 
-     /*
-      * Clear out any potential S390EP magic (see jump_to_low_kernel()),
-@@ -228,7 +230,7 @@ static int virtio_setup(void)
- 
-     switch (vdev->senseid.cu_model) {
-     case VIRTIO_ID_NET:
--        sclp_print("Network boot device detected\n");
-+        puts("Network boot device detected");
-         vdev->netboot_start_addr = qipl.netboot_start_addr;
-         return 0;
-     case VIRTIO_ID_BLOCK:
-@@ -261,7 +263,7 @@ static void ipl_boot_device(void)
-         }
-         break;
-     default:
--        print_int("Attempting to boot from unexpected device type", cutype);
-+        printf("Attempting to boot from unexpected device type 0x%X\n", cutype);
-         panic("\nBoot failed.\n");
-     }
- }
-@@ -287,7 +289,7 @@ static void probe_boot_device(void)
-         }
-     }
- 
--    sclp_print("Could not find a suitable boot device (none specified)\n");
-+    puts("Could not find a suitable boot device (none specified)");
- }
- 
- void main(void)
-diff --git a/pc-bios/s390-ccw/menu.c b/pc-bios/s390-ccw/menu.c
-index d601952d3e..84062e94af 100644
---- a/pc-bios/s390-ccw/menu.c
-+++ b/pc-bios/s390-ccw/menu.c
-@@ -9,7 +9,10 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <ctype.h>
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <string.h>
- #include "s390-ccw.h"
- #include "sclp.h"
- #include "s390-time.h"
-@@ -93,7 +96,7 @@ static int read_prompt(char *buf, size_t len)
-         case KEYCODE_BACKSP:
-             if (idx > 0) {
-                 buf[--idx] = 0;
--                sclp_print("\b \b");
-+                printf("\b \b");
-             }
-             continue;
-         case KEYCODE_ENTER:
-@@ -103,7 +106,7 @@ static int read_prompt(char *buf, size_t len)
-             /* Echo input and add to buffer */
-             if (idx < len) {
-                 buf[idx++] = inp[0];
--                sclp_print(inp);
-+                printf("%s", inp);
-             }
-         }
-     }
-@@ -140,22 +143,19 @@ static int get_index(void)
-         }
-     }
- 
--    return atoui(buf);
-+    return atoi(buf);
- }
- 
- static void boot_menu_prompt(bool retry)
- {
--    char tmp[11];
--
-     if (retry) {
--        sclp_print("\nError: undefined configuration"
-+        printf("\nError: undefined configuration"
-                    "\nPlease choose:\n");
-     } else if (timeout > 0) {
--        sclp_print("Please choose (default will boot in ");
--        sclp_print(uitoa(timeout / 1000, tmp, sizeof(tmp)));
--        sclp_print(" seconds):\n");
-+        printf("Please choose (default will boot in %d seconds):\n",
-+               (int)(timeout / 1000));
-     } else {
--        sclp_print("Please choose:\n");
-+        puts("Please choose:");
-     }
- }
- 
-@@ -163,7 +163,6 @@ static int get_boot_index(bool *valid_entries)
- {
-     int boot_index;
-     bool retry = false;
--    char tmp[5];
- 
-     do {
-         boot_menu_prompt(retry);
-@@ -172,8 +171,7 @@ static int get_boot_index(bool *valid_entries)
-     } while (boot_index < 0 || boot_index >= MAX_BOOT_ENTRIES ||
-              !valid_entries[boot_index]);
- 
--    sclp_print("\nBooting entry #");
--    sclp_print(uitoa(boot_index, tmp, sizeof(tmp)));
-+    printf("\nBooting entry #%d", boot_index);
- 
-     return boot_index;
- }
-@@ -187,9 +185,9 @@ static int zipl_print_entry(const char *data, size_t len)
-     buf[len] = '\n';
-     buf[len + 1] = '\0';
- 
--    sclp_print(buf);
-+    printf("%s", buf);
- 
--    return buf[0] == ' ' ? atoui(buf + 1) : atoui(buf);
-+    return buf[0] == ' ' ? atoi(buf + 1) : atoi(buf);
- }
- 
- int menu_get_zipl_boot_index(const char *menu_data)
-@@ -209,7 +207,7 @@ int menu_get_zipl_boot_index(const char *menu_data)
-     }
- 
-     /* Print banner */
--    sclp_print("s390-ccw zIPL Boot Menu\n\n");
-+    puts("s390-ccw zIPL Boot Menu\n");
-     menu_data += strlen(menu_data) + 1;
- 
-     /* Print entries */
-@@ -221,37 +219,34 @@ int menu_get_zipl_boot_index(const char *menu_data)
-         valid_entries[entry] = true;
- 
-         if (entry == 0) {
--            sclp_print("\n");
-+            printf("\n");
-         }
-     }
- 
--    sclp_print("\n");
-+    printf("\n");
-     return get_boot_index(valid_entries);
- }
- 
- int menu_get_enum_boot_index(bool *valid_entries)
- {
--    char tmp[3];
-     int i;
- 
--    sclp_print("s390-ccw Enumerated Boot Menu.\n\n");
-+    puts("s390-ccw Enumerated Boot Menu.\n");
- 
-     for (i = 0; i < MAX_BOOT_ENTRIES; i++) {
-         if (valid_entries[i]) {
-             if (i < 10) {
--                sclp_print(" ");
-+                printf(" ");
-             }
--            sclp_print("[");
--            sclp_print(uitoa(i, tmp, sizeof(tmp)));
--            sclp_print("]");
-+            printf("[%d]", i);
-             if (i == 0) {
--                sclp_print(" default\n");
-+                printf(" default\n");
-             }
--            sclp_print("\n");
-+            printf("\n");
-         }
-     }
- 
--    sclp_print("\n");
-+    printf("\n");
-     return get_boot_index(valid_entries);
- }
- 
-diff --git a/pc-bios/s390-ccw/netboot.mak b/pc-bios/s390-ccw/netboot.mak
-index 046aa35587..d2b3d8ee74 100644
---- a/pc-bios/s390-ccw/netboot.mak
-+++ b/pc-bios/s390-ccw/netboot.mak
-@@ -1,9 +1,6 @@
- 
--SLOF_DIR := $(SRC_PATH)/../../roms/SLOF
--
- NETOBJS := start.o sclp.o cio.o virtio.o virtio-net.o jump2ipl.o netmain.o
- 
--LIBC_INC := -nostdinc -I$(SLOF_DIR)/lib/libc/include
- LIBNET_INC := -I$(SLOF_DIR)/lib/libnet
- 
- NETLDFLAGS := $(LDFLAGS) -Wl,-Ttext=0x7800000
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index 5cd619b2d6..509119be15 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -293,7 +293,7 @@ static int load_kernel_with_initrd(filename_ip_t *fn_ip,
-     printf("Loading pxelinux.cfg entry '%s'\n", entry->label);
- 
-     if (!entry->kernel) {
--        printf("Kernel entry is missing!\n");
-+        puts("Kernel entry is missing!\n");
-         return -1;
-     }
- 
-@@ -515,13 +515,13 @@ void main(void)
-     int rc, fnlen;
- 
-     sclp_setup();
--    sclp_print("Network boot starting...\n");
-+    puts("Network boot starting...");
- 
-     virtio_setup();
- 
-     rc = net_init(&fn_ip);
-     if (rc) {
--        panic("Network initialization failed. Halting.\n");
-+        panic("Network initialization failed. Halting.");
-     }
- 
-     fnlen = strlen(fn_ip.filename);
-@@ -535,9 +535,9 @@ void main(void)
-     net_release(&fn_ip);
- 
-     if (rc > 0) {
--        sclp_print("Network loading done, starting kernel...\n");
-+        puts("Network loading done, starting kernel...");
-         jump_to_low_kernel();
-     }
- 
--    panic("Failed to load OS from network\n");
-+    panic("Failed to load OS from network.");
- }
-diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
-index c977a52b50..6f6d95d170 100644
---- a/pc-bios/s390-ccw/s390-ccw.h
-+++ b/pc-bios/s390-ccw/s390-ccw.h
-@@ -13,6 +13,11 @@
- 
- /* #define DEBUG */
- 
-+#include <stdbool.h>
-+#include <stddef.h>
-+#include <stdint.h>
-+#include <stdio.h>
-+
- typedef unsigned char      u8;
- typedef unsigned short     u16;
- typedef unsigned int       u32;
-@@ -26,9 +31,6 @@ typedef unsigned long long u64;
- #define EBUSY   2
- #define ENODEV  3
- 
--#ifndef NULL
--#define NULL    0
--#endif
- #ifndef MIN
- #define MIN(a, b) (((a) < (b)) ? (a) : (b))
- #endif
-@@ -87,7 +89,7 @@ bool menu_is_enabled_enum(void);
- __attribute__ ((__noreturn__))
- static inline void panic(const char *string)
- {
--    sclp_print(string);
-+    printf("ERROR: %s\n ", string);
-     disabled_wait();
- }
- 
-@@ -109,20 +111,10 @@ static inline void fill_hex_val(char *out, void *ptr, unsigned size)
-     }
- }
- 
--static inline void print_int(const char *desc, u64 addr)
--{
--    char out[] = ": 0xffffffffffffffff\n";
--
--    fill_hex_val(&out[4], &addr, sizeof(addr));
--
--    sclp_print(desc);
--    sclp_print(out);
--}
--
- static inline void debug_print_int(const char *desc, u64 addr)
- {
- #ifdef DEBUG
--    print_int(desc, addr);
-+    printf("%s 0x%X\n", desc, addr);
- #endif
- }
- 
-@@ -147,18 +139,14 @@ static inline void debug_print_addr(const char *desc, void *p)
- static inline void IPL_assert(bool term, const char *message)
- {
-     if (!term) {
--        sclp_print("\n! ");
--        sclp_print(message);
--        panic(" !\n"); /* no return */
-+        panic(message); /* no return */
-     }
- }
- 
- static inline void IPL_check(bool term, const char *message)
- {
-     if (!term) {
--        sclp_print("\n! WARNING: ");
--        sclp_print(message);
--        sclp_print(" !\n");
-+        printf("WARNING: %s\n", message);
-     }
- }
- 
-diff --git a/pc-bios/s390-ccw/sclp.c b/pc-bios/s390-ccw/sclp.c
-index 7251f9af4d..4a07de018d 100644
---- a/pc-bios/s390-ccw/sclp.c
-+++ b/pc-bios/s390-ccw/sclp.c
-@@ -8,7 +8,7 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
- #include "s390-ccw.h"
- #include "sclp.h"
- 
-@@ -101,11 +101,6 @@ long write(int fd, const void *str, size_t len)
-     return len;
- }
- 
--void sclp_print(const char *str)
--{
--    write(1, str, strlen(str));
--}
--
- void sclp_get_loadparm_ascii(char *loadparm)
- {
- 
-diff --git a/pc-bios/s390-ccw/virtio-blkdev.c b/pc-bios/s390-ccw/virtio-blkdev.c
-index a81207b52e..2666326801 100644
---- a/pc-bios/s390-ccw/virtio-blkdev.c
-+++ b/pc-bios/s390-ccw/virtio-blkdev.c
-@@ -8,7 +8,7 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "virtio.h"
- #include "virtio-scsi.h"
-@@ -76,7 +76,7 @@ unsigned long virtio_load_direct(unsigned long rec_list1, unsigned long rec_list
-         return -1;
-     }
- 
--    sclp_print(".");
-+    printf(".");
-     status = virtio_read_many(sec, (void *)addr, sec_num);
-     if (status) {
-         panic("I/O Error");
-@@ -230,7 +230,7 @@ int virtio_blk_setup_device(SubChannelId schid)
-     vdev->schid = schid;
-     virtio_setup_ccw(vdev);
- 
--    sclp_print("Using virtio-blk.\n");
-+    puts("Using virtio-blk.");
- 
-     return 0;
- }
-diff --git a/pc-bios/s390-ccw/virtio-scsi.c b/pc-bios/s390-ccw/virtio-scsi.c
-index d1a84b937c..6b4a1caf8a 100644
---- a/pc-bios/s390-ccw/virtio-scsi.c
-+++ b/pc-bios/s390-ccw/virtio-scsi.c
-@@ -9,7 +9,8 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
-+#include <stdio.h>
- #include "s390-ccw.h"
- #include "virtio.h"
- #include "scsi.h"
-@@ -30,9 +31,9 @@ static inline void vs_assert(bool term, const char **msgs)
-     if (!term) {
-         int i = 0;
- 
--        sclp_print("\n! ");
-+        printf("\n! ");
-         while (msgs[i]) {
--            sclp_print(msgs[i++]);
-+            printf("%s", msgs[i++]);
-         }
-         panic(" !\n");
-     }
-@@ -236,11 +237,11 @@ static int virtio_scsi_locate_device(VDev *vdev)
-             if (resp.response == VIRTIO_SCSI_S_BAD_TARGET) {
-                 continue;
-             }
--            print_int("target", target);
-+            printf("target 0x%X\n", target);
-             virtio_scsi_verify_response(&resp, "SCSI cannot report LUNs");
-         }
-         if (r->lun_list_len == 0) {
--            print_int("no LUNs for target", target);
-+            printf("no LUNs for target 0x%X\n", target);
-             continue;
-         }
-         luns = r->lun_list_len / 8;
-@@ -264,7 +265,7 @@ static int virtio_scsi_locate_device(VDev *vdev)
-         }
-     }
- 
--    sclp_print("Warning: Could not locate a usable virtio-scsi device\n");
-+    puts("Warning: Could not locate a usable virtio-scsi device");
-     return -ENODEV;
- }
- 
-@@ -379,7 +380,7 @@ static int virtio_scsi_setup(VDev *vdev)
-     }
- 
-     if (virtio_scsi_inquiry_response_is_cdrom(scsi_inquiry_std_response)) {
--        sclp_print("SCSI CD-ROM detected.\n");
-+        puts("SCSI CD-ROM detected.");
-         vdev->is_cdrom = true;
-         vdev->scsi_block_size = VIRTIO_ISO_BLOCK_SIZE;
-     }
-@@ -443,7 +444,7 @@ int virtio_scsi_setup_device(SubChannelId schid)
-     IPL_assert(vdev->config.scsi.cdb_size == VIRTIO_SCSI_CDB_SIZE,
-                "Config: CDB size mismatch");
- 
--    sclp_print("Using virtio-scsi.\n");
-+    puts("Using virtio-scsi.");
- 
-     return virtio_scsi_setup(vdev);
- }
-diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
-index 5edd058d88..8c6b0a8a92 100644
---- a/pc-bios/s390-ccw/virtio.c
-+++ b/pc-bios/s390-ccw/virtio.c
-@@ -8,7 +8,7 @@
-  * directory.
-  */
- 
--#include "libc.h"
-+#include <string.h>
- #include "s390-ccw.h"
- #include "cio.h"
- #include "virtio.h"
-diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
-index f60f94b090..90964a2ccb 100644
---- a/tests/tcg/s390x/Makefile.softmmu-target
-+++ b/tests/tcg/s390x/Makefile.softmmu-target
-@@ -2,7 +2,7 @@ S390X_SRC=$(SRC_PATH)/tests/tcg/s390x
- VPATH+=$(S390X_SRC)
- QEMU_OPTS+=-action panic=exit-failure -nographic $(EXTFLAGS) -kernel
- LINK_SCRIPT=$(S390X_SRC)/softmmu.ld
--CFLAGS+=-ggdb -O0
-+CFLAGS+=-ggdb -O0 -I$(SRC_PATH)/include/hw/s390x/ipl/
- LDFLAGS=-nostdlib -static
- 
- %.o: %.S
-diff --git a/tests/tcg/s390x/console.c b/tests/tcg/s390x/console.c
-index d43ce3f44b..6c26f04949 100644
---- a/tests/tcg/s390x/console.c
-+++ b/tests/tcg/s390x/console.c
-@@ -4,7 +4,10 @@
-  *
-  * SPDX-License-Identifier: GPL-2.0-or-later
-  */
-+
- #include "../../../pc-bios/s390-ccw/sclp.c"
-+#include "../../../roms/SLOF/lib/libc/string/memset.c"
-+#include "../../../roms/SLOF/lib/libc/string/memcpy.c"
- 
- void __sys_outc(char c)
- {
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch b/kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
deleted file mode 100644
index 137eec6..0000000
--- a/kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 77d5de6e13404df1cb5c3beb0e656ee328732457 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 16 Jan 2025 12:58:26 +0100
-Subject: [PATCH 4/4] pc-bios/s390-ccw/netmain: Fix error messages with regards
- to the TFTP server
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 332: Fix boot problems when falling back from network to another boot device on s390x  [RHEL9]
-RH-Jira: RHEL-72716
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [4/4] a4ce330588044d40b94da46905d1021e7610cbf6 (thuth/qemu-kvm-cs)
-
-The code in net_init_ip() currently bails out early if "rc" is less
-than 0, so the if-statements that check for negative "rc" codes to
-print out some specific error messages with regards to the TFTP server
-are never reached. Move them earlier to bring that dead code back to
-life.
-
-Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20250116115826.192047-4-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit bbfa7f8558d5346b6884108ad50df3517fe17358)
----
- pc-bios/s390-ccw/netmain.c | 19 ++++++++-----------
- 1 file changed, 8 insertions(+), 11 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index 335ea9b63e..719a547ada 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -168,6 +168,14 @@ static int net_init_ip(filename_ip_t *fn_ip)
-         if (fn_ip->ip_version == 4) {
-             set_ipv4_address(fn_ip->own_ip);
-         }
-+    } else if (rc == -2) {
-+        printf("ARP request to TFTP server (%d.%d.%d.%d) failed\n",
-+               (fn_ip->server_ip >> 24) & 0xFF, (fn_ip->server_ip >> 16) & 0xFF,
-+               (fn_ip->server_ip >>  8) & 0xFF, fn_ip->server_ip & 0xFF);
-+        return -102;
-+    } else if (rc == -4 || rc == -3) {
-+        puts("Can't obtain TFTP server IP address");
-+        return -107;
-     } else {
-         puts("Could not get IP address");
-         return -101;
-@@ -183,17 +191,6 @@ static int net_init_ip(filename_ip_t *fn_ip)
-         printf("  Using IPv6 address: %s\n", ip6_str);
-     }
- 
--    if (rc == -2) {
--        printf("ARP request to TFTP server (%d.%d.%d.%d) failed\n",
--               (fn_ip->server_ip >> 24) & 0xFF, (fn_ip->server_ip >> 16) & 0xFF,
--               (fn_ip->server_ip >>  8) & 0xFF, fn_ip->server_ip & 0xFF);
--        return -102;
--    }
--    if (rc == -4 || rc == -3) {
--        puts("Can't obtain TFTP server IP address");
--        return -107;
--    }
--
-     printf("  Using TFTP server: ");
-     if (fn_ip->ip_version == 4) {
-         printf("%d.%d.%d.%d\n",
--- 
-2.48.0
-
diff --git a/kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch b/kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
deleted file mode 100644
index 7a511b0..0000000
--- a/kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From ede25f511ad49a8a7cc2d18a613775c1f706cf36 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 16 Jan 2025 12:58:24 +0100
-Subject: [PATCH 2/4] pc-bios/s390-ccw/virtio: Add a function to reset a virtio
- device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 332: Fix boot problems when falling back from network to another boot device on s390x  [RHEL9]
-RH-Jira: RHEL-72716
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [2/4] 99a826ae269ca45cf3092c75c45eaf2f8704576a (thuth/qemu-kvm-cs)
-
-To be able to properly silence a virtio device after using it,
-we need a global function to reset the device.
-
-Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Jared Rossi <jrossi@linux.ibm.com>
-Message-ID: <20250116115826.192047-2-thuth@redhat.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 3936d0556383829b8db9518aed8badfed6513953)
----
- pc-bios/s390-ccw/virtio.c | 7 ++++++-
- pc-bios/s390-ccw/virtio.h | 1 +
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
-index 8b5a370bb3..cd6c99c7e3 100644
---- a/pc-bios/s390-ccw/virtio.c
-+++ b/pc-bios/s390-ccw/virtio.c
-@@ -217,6 +217,11 @@ int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd)
-     return 0;
- }
- 
-+int virtio_reset(VDev *vdev)
-+{
-+    return run_ccw(vdev, CCW_CMD_VDEV_RESET, NULL, 0, false);
-+}
-+
- int virtio_setup_ccw(VDev *vdev)
- {
-     int i, cfg_size = 0;
-@@ -235,7 +240,7 @@ int virtio_setup_ccw(VDev *vdev)
-     vdev->config.blk.blk_size = 0; /* mark "illegal" - setup started... */
-     vdev->guessed_disk_nature = VIRTIO_GDN_NONE;
- 
--    run_ccw(vdev, CCW_CMD_VDEV_RESET, NULL, 0, false);
-+    virtio_reset(vdev);
- 
-     status = VIRTIO_CONFIG_S_ACKNOWLEDGE;
-     if (run_ccw(vdev, CCW_CMD_WRITE_STATUS, &status, sizeof(status), false)) {
-diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
-index 9faf3986b1..f13fa6f5fe 100644
---- a/pc-bios/s390-ccw/virtio.h
-+++ b/pc-bios/s390-ccw/virtio.h
-@@ -274,6 +274,7 @@ void vring_send_buf(VRing *vr, void *p, int len, int flags);
- int vr_poll(VRing *vr);
- int vring_wait_reply(void);
- int virtio_run(VDev *vdev, int vqid, VirtioCmd *cmd);
-+int virtio_reset(VDev *vdev);
- int virtio_setup_ccw(VDev *vdev);
- 
- int virtio_net_init(void *mac_addr);
--- 
-2.48.0
-
diff --git a/kvm-pc-bios-s390x-Enable-multi-device-boot-loop.patch b/kvm-pc-bios-s390x-Enable-multi-device-boot-loop.patch
deleted file mode 100644
index 80006bf..0000000
--- a/kvm-pc-bios-s390x-Enable-multi-device-boot-loop.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From 4fcfb2ccd90ffc1e0b121b3e5dbab1cdcba8ce4e Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:51 -0400
-Subject: [PATCH 18/27] pc-bios/s390x: Enable multi-device boot loop
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [18/23] 2aa3154bfb1c73a6054b1161ae284925e6069c48 (thuth/qemu-kvm-cs9)
-
-Allow attempts to boot from multiple IPL devices. If the first device fails to
-IPL, select the pre-built IPLB for the next device in the boot order and attempt
-to IPL from it. Continue this process until IPL is successful or there are no
-devices left to try.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-18-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit f697bed22f58eff9b2893ac2fe3d511847398400)
----
- pc-bios/s390-ccw/iplb.h     | 24 ++++++++++++++++++++
- pc-bios/s390-ccw/jump2ipl.c |  7 +++---
- pc-bios/s390-ccw/main.c     | 45 +++++++++++++++++++++++--------------
- pc-bios/s390-ccw/netmain.c  |  2 +-
- 4 files changed, 57 insertions(+), 21 deletions(-)
-
-diff --git a/pc-bios/s390-ccw/iplb.h b/pc-bios/s390-ccw/iplb.h
-index 16643f5879..08f259ff31 100644
---- a/pc-bios/s390-ccw/iplb.h
-+++ b/pc-bios/s390-ccw/iplb.h
-@@ -17,9 +17,11 @@
- #endif
- 
- #include <qipl.h>
-+#include <string.h>
- 
- extern QemuIplParameters qipl;
- extern IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
-+extern bool have_iplb;
- 
- #define S390_IPL_TYPE_FCP 0x00
- #define S390_IPL_TYPE_CCW 0x02
-@@ -49,4 +51,26 @@ static inline bool set_iplb(IplParameterBlock *iplb)
-     return manage_iplb(iplb, false);
- }
- 
-+/*
-+ * The IPL started on the device, but failed in some way.  If the IPLB chain
-+ * still has more devices left to try, use the next device in order.
-+ */
-+static inline bool load_next_iplb(void)
-+{
-+    IplParameterBlock *next_iplb;
-+
-+    if (qipl.chain_len < 1) {
-+        return false;
-+    }
-+
-+    qipl.index++;
-+    next_iplb = (IplParameterBlock *) qipl.next_iplb;
-+    memcpy(&iplb, next_iplb, sizeof(IplParameterBlock));
-+
-+    qipl.chain_len--;
-+    qipl.next_iplb = qipl.next_iplb + sizeof(IplParameterBlock);
-+
-+    return true;
-+}
-+
- #endif /* IPLB_H */
-diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
-index 99d18947d1..86321d0f46 100644
---- a/pc-bios/s390-ccw/jump2ipl.c
-+++ b/pc-bios/s390-ccw/jump2ipl.c
-@@ -45,9 +45,10 @@ int jump_to_IPL_code(uint64_t address)
-      */
-     if (iplb.pbt == S390_IPL_TYPE_QEMU_SCSI) {
-         iplb.devno = qipl.index;
--        if (!set_iplb(&iplb)) {
--            panic("Failed to set IPLB");
--        }
-+    }
-+
-+    if (have_iplb && !set_iplb(&iplb)) {
-+        panic("Failed to set IPLB");
-     }
- 
-     /*
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index ab4709e16e..a4d1c05aac 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -23,7 +23,7 @@ static SubChannelId blk_schid = { .one = 1 };
- static char loadparm_str[LOADPARM_LEN + 1];
- QemuIplParameters qipl;
- IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
--static bool have_iplb;
-+bool have_iplb;
- static uint16_t cutype;
- LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */
- 
-@@ -55,6 +55,12 @@ void write_iplb_location(void)
-     }
- }
- 
-+static void copy_qipl(void)
-+{
-+    QemuIplParameters *early_qipl = (QemuIplParameters *)QIPL_ADDRESS;
-+    memcpy(&qipl, early_qipl, sizeof(QemuIplParameters));
-+}
-+
- unsigned int get_loadparm_index(void)
- {
-     return atoi(loadparm_str);
-@@ -152,6 +158,7 @@ static void menu_setup(void)
- 
-     /* If loadparm was set to any other value, then do not enable menu */
-     if (memcmp(loadparm_str, LOADPARM_EMPTY, LOADPARM_LEN) != 0) {
-+        menu_set_parms(qipl.qipl_flags & ~BOOT_MENU_FLAG_MASK, 0);
-         return;
-     }
- 
-@@ -183,7 +190,6 @@ static void css_setup(void)
- static void boot_setup(void)
- {
-     char lpmsg[] = "LOADPARM=[________]\n";
--    have_iplb = store_iplb(&iplb);
- 
-     if (memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) != 0) {
-         ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN);
-@@ -191,6 +197,10 @@ static void boot_setup(void)
-         sclp_get_loadparm_ascii(loadparm_str);
-     }
- 
-+    if (have_iplb) {
-+        menu_setup();
-+    }
-+
-     memcpy(lpmsg + 10, loadparm_str, 8);
-     puts(lpmsg);
- 
-@@ -208,6 +218,7 @@ static bool find_boot_device(void)
- 
-     switch (iplb.pbt) {
-     case S390_IPL_TYPE_CCW:
-+        vdev->scsi_device_selected = false;
-         debug_print_int("device no. ", iplb.ccw.devno);
-         blk_schid.ssid = iplb.ccw.ssid & 0x3;
-         debug_print_int("ssid ", blk_schid.ssid);
-@@ -231,15 +242,8 @@ static bool find_boot_device(void)
- static int virtio_setup(void)
- {
-     VDev *vdev = virtio_get_device();
--    QemuIplParameters *early_qipl = (QemuIplParameters *)QIPL_ADDRESS;
-     int ret;
- 
--    memcpy(&qipl, early_qipl, sizeof(QemuIplParameters));
--
--    if (have_iplb) {
--        menu_setup();
--    }
--
-     switch (vdev->senseid.cu_model) {
-     case VIRTIO_ID_NET:
-         puts("Network boot device detected");
-@@ -271,10 +275,9 @@ static void ipl_boot_device(void)
-         dasd_ipl(blk_schid, cutype);
-         break;
-     case CU_TYPE_VIRTIO:
--        if (virtio_setup()) {
--            return;    /* Only returns in case of errors */
-+        if (virtio_setup() == 0) {
-+            zipl_load();
-         }
--        zipl_load();
-         break;
-     default:
-         printf("Attempting to boot from unexpected device type 0x%X\n", cutype);
-@@ -307,14 +310,22 @@ static void probe_boot_device(void)
- 
- void main(void)
- {
-+    copy_qipl();
-     sclp_setup();
-     css_setup();
--    boot_setup();
--    if (have_iplb && find_boot_device()) {
--        ipl_boot_device();
--    } else {
-+    have_iplb = store_iplb(&iplb);
-+    if (!have_iplb) {
-         probe_boot_device();
-     }
- 
--    panic("Failed to IPL. Halting...");
-+    while (have_iplb) {
-+        boot_setup();
-+        if (have_iplb && find_boot_device()) {
-+            ipl_boot_device();
-+        }
-+        have_iplb = load_next_iplb();
-+    }
-+
-+    panic("No suitable device for IPL. Halting...");
-+
- }
-diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
-index d1a6c9a91c..e46e470db4 100644
---- a/pc-bios/s390-ccw/netmain.c
-+++ b/pc-bios/s390-ccw/netmain.c
-@@ -478,7 +478,7 @@ static bool virtio_setup(void)
-      */
-     enable_mss_facility();
- 
--    if (store_iplb(&iplb)) {
-+    if (have_iplb || store_iplb(&iplb)) {
-         IPL_assert(iplb.pbt == S390_IPL_TYPE_CCW, "IPL_TYPE_CCW expected");
-         dev_no = iplb.ccw.devno;
-         debug_print_int("device no. ", dev_no);
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch b/kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch
deleted file mode 100644
index ebf1a48..0000000
--- a/kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 32ddd9e68b04cb231fa0adcaeacbbe6373a1972f Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Fri, 8 Nov 2024 14:41:36 -0500
-Subject: [PATCH 07/10] pc-bios/s390x: Initialize cdrom type to false for each
- IPL device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/8] 994d24c3292a38f5bc7fd87d7227e5beb8abc30b (thuth/qemu-kvm-cs9)
-
-Clear information about cdrom type so that current IPL device isn't tainted
-by stale data from previous devices.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241108194136.2833932-1-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 8c797468116d19940fb758efa749eae414616e3a)
----
- pc-bios/s390-ccw/main.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index a4d1c05aac..7509755e36 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -242,6 +242,7 @@ static bool find_boot_device(void)
- static int virtio_setup(void)
- {
-     VDev *vdev = virtio_get_device();
-+    vdev->is_cdrom = false;
-     int ret;
- 
-     switch (vdev->senseid.cu_model) {
--- 
-2.39.3
-
diff --git a/kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch b/kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch
deleted file mode 100644
index f0764e6..0000000
--- a/kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From d5fd6b575f36c09bb6ef11d3e1e4e698577637c3 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Thu, 14 Nov 2024 11:19:52 -0500
-Subject: [PATCH 08/10] pc-bios/s390x: Initialize machine loadparm before
- probing IPL devices
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/8] 5f9bca4a83d6a1bde08504d2655f486708765e6e (thuth/qemu-kvm-cs9)
-
-Commit bb185de423 ("s390x: Add individual loadparm assignment to
-CCW device") allowed boot devices to be assigned a loadparm value independent
-of the machine value, however, when no boot devices are defined, the machine
-loadparm becomes ignored. Therefore, let's check the machine loadparm
-prior to probing the devices.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241114161952.3508554-1-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 1056ca1e70dc6e0458238141bcebfb7810cede6d)
----
- pc-bios/s390-ccw/main.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index 7509755e36..76bf743900 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -191,7 +191,7 @@ static void boot_setup(void)
- {
-     char lpmsg[] = "LOADPARM=[________]\n";
- 
--    if (memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) != 0) {
-+    if (have_iplb && memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) != 0) {
-         ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN);
-     } else {
-         sclp_get_loadparm_ascii(loadparm_str);
-@@ -316,6 +316,7 @@ void main(void)
-     css_setup();
-     have_iplb = store_iplb(&iplb);
-     if (!have_iplb) {
-+        boot_setup();
-         probe_boot_device();
-     }
- 
--- 
-2.39.3
-
diff --git a/kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch b/kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
deleted file mode 100644
index 32064ea..0000000
--- a/kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From d06f8670b9304c66d45e2270a4f5b462ed6cbe09 Mon Sep 17 00:00:00 2001
-From: Ani Sinha <anisinha@redhat.com>
-Date: Wed, 16 Oct 2024 17:21:34 +0530
-Subject: [PATCH 1/9] pc: q35: Bump max_cpus to 4096 vcpus
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Ani Sinha <anisinha@redhat.com>
-RH-MergeRequest: 273: pc: q35: Bump max_cpus to 4096 vcpus
-RH-Jira: RHEL-11043
-RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
-RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
-RH-Acked-by: MST <mst@redhat.com>
-RH-Commit: [1/1] 23caa8c9e4f34c3114701b7a5bb25002a9372b2e (anisinha/centos-qemu-kvm)
-
-This is the downstream change equivalent of the upstream QEMU commit
-e4e98c7e ("pc: q35: Bump max_cpus to 4096 vcpus")
-
-Since upstream Linux kernel commit
-f10a570b093e6 ("KVM: x86: Add CONFIG_KVM_MAX_NR_VCPUS to allow up to 4096 vCPUs")
-Linux kernel can support upto a maximum number of 4096 vcpus when MAXSMP is
-enabled in the kernel. This upstream change has been backported to c9s kernel
-already. Please see JIRA https://issues.redhat.com/browse/RHEL-11579 and the
-following commit authored by Vitaly Kuznetsov:
-a85f846be686b0a ("KVM: x86: Add CONFIG_KVM_MAX_NR_VCPUS to allow up to 4096 vCPUs")
-
-At present, QEMU has been tested to correctly boot a linux guest with 4096
-vcpus using edk2 that has the fixes corresponding to the following two upstream
-edk2 PRs:
-
-https://github.com/tianocore/edk2/pull/5410
-https://github.com/tianocore/edk2/pull/5418
-
-The changes corresponding to the above two upstream edk2 PRs has been included
-in the downstream c9s edk2 with the following MR:
-https://gitlab.com/redhat/centos-stream/src/edk2/-/merge_requests/59
-
-So bump up the value max_cpus to 4096 for RHEL q35 machines versions 9.6 and
-newer. Q35 RHEL machines versions 9.4 and older continue to support 710 maximum
-vcpus as before for compatibility reasons.
-
-See also https://gitlab.com/redhat/centos-stream/src/qemu-kvm/-/merge_requests/236
-
-Signed-off-by: Ani Sinha <anisinha@redhat.com>
----
- hw/i386/pc_q35.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 7606007bda..578f63524f 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -344,7 +344,7 @@ static void pc_q35_machine_options(MachineClass *m)
-     m->default_display = "std";
-     m->default_nic = "e1000e";
-     m->no_floppy = 1;
--    m->max_cpus = 710;
-+    m->max_cpus = 4096;
-     m->no_parallel = 1;
-     machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
-     machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
-@@ -687,6 +687,9 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
- {
-     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-     pc_q35_rhel_machine_9_6_0_options(m);
-+
-+    /* older RHEL machines continue to support 710 vcpus */
-+    m->max_cpus = 710;
-     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
-     m->alias = NULL;
-     pcmc->smbios_stream_product = "RHEL";
--- 
-2.39.3
-
diff --git a/kvm-pci-Use-PCI-PM-capability-initializer.patch b/kvm-pci-Use-PCI-PM-capability-initializer.patch
deleted file mode 100644
index e2470de..0000000
--- a/kvm-pci-Use-PCI-PM-capability-initializer.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From 978951b390bb7073293c792c4714516ad40cba73 Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 25 Feb 2025 14:52:26 -0700
-Subject: [PATCH 3/7] pci: Use PCI PM capability initializer
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [3/6] fd862caa094490a9b8a04b00ad39ba58e0b46a7a (eauger1/centos-qemu-kvm)
-
-Switch callers directly initializing the PCI PM capability with
-pci_add_capability() to use pci_pm_init().
-
-Cc: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Stefan Weil <sw@weilnetz.de>
-Cc: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
-Cc: Keith Busch <kbusch@kernel.org>
-Cc: Klaus Jensen <its@irrelevant.dk>
-Cc: Jesper Devantier <foss@defmacro.it>
-Cc: Michael S. Tsirkin <mst@redhat.com>
-Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
-Cc: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250225215237.3314011-3-alex.williamson@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 0681ec253141d838210b3c5e6bc0d2d71f2e111e)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/net/e1000e.c                 | 3 +--
- hw/net/eepro100.c               | 4 +---
- hw/net/igb.c                    | 3 +--
- hw/nvme/ctrl.c                  | 3 +--
- hw/pci-bridge/pcie_pci_bridge.c | 2 +-
- hw/vfio/pci.c                   | 7 ++++++-
- hw/virtio/virtio-pci.c          | 3 +--
- 7 files changed, 12 insertions(+), 13 deletions(-)
-
-diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
-index 843892ce09..9eb93d049d 100644
---- a/hw/net/e1000e.c
-+++ b/hw/net/e1000e.c
-@@ -372,8 +372,7 @@ static int
- e1000e_add_pm_capability(PCIDevice *pdev, uint8_t offset, uint16_t pmc)
- {
-     Error *local_err = NULL;
--    int ret = pci_add_capability(pdev, PCI_CAP_ID_PM, offset,
--                                 PCI_PM_SIZEOF, &local_err);
-+    int ret = pci_pm_init(pdev, offset, &local_err);
- 
-     if (local_err) {
-         error_report_err(local_err);
-diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
-index d9a70c4544..668a410055 100644
---- a/hw/net/eepro100.c
-+++ b/hw/net/eepro100.c
-@@ -549,9 +549,7 @@ static void e100_pci_reset(EEPRO100State *s, Error **errp)
-     if (info->power_management) {
-         /* Power Management Capabilities */
-         int cfg_offset = 0xdc;
--        int r = pci_add_capability(&s->dev, PCI_CAP_ID_PM,
--                                   cfg_offset, PCI_PM_SIZEOF,
--                                   errp);
-+        int r = pci_pm_init(&s->dev, cfg_offset, errp);
-         if (r < 0) {
-             return;
-         }
-diff --git a/hw/net/igb.c b/hw/net/igb.c
-index b92bba402e..a3c22e2391 100644
---- a/hw/net/igb.c
-+++ b/hw/net/igb.c
-@@ -356,8 +356,7 @@ static int
- igb_add_pm_capability(PCIDevice *pdev, uint8_t offset, uint16_t pmc)
- {
-     Error *local_err = NULL;
--    int ret = pci_add_capability(pdev, PCI_CAP_ID_PM, offset,
--                                 PCI_PM_SIZEOF, &local_err);
-+    int ret = pci_pm_init(pdev, offset, &local_err);
- 
-     if (local_err) {
-         error_report_err(local_err);
-diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
-index 9f277b81d8..d451ee0d00 100644
---- a/hw/nvme/ctrl.c
-+++ b/hw/nvme/ctrl.c
-@@ -8293,8 +8293,7 @@ static int nvme_add_pm_capability(PCIDevice *pci_dev, uint8_t offset)
-     Error *err = NULL;
-     int ret;
- 
--    ret = pci_add_capability(pci_dev, PCI_CAP_ID_PM, offset,
--                             PCI_PM_SIZEOF, &err);
-+    ret = pci_pm_init(pci_dev, offset, &err);
-     if (err) {
-         error_report_err(err);
-         return ret;
-diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
-index 7646ac2397..2f098e3a13 100644
---- a/hw/pci-bridge/pcie_pci_bridge.c
-+++ b/hw/pci-bridge/pcie_pci_bridge.c
-@@ -52,7 +52,7 @@ static void pcie_pci_bridge_realize(PCIDevice *d, Error **errp)
-         goto cap_error;
-     }
- 
--    pos = pci_add_capability(d, PCI_CAP_ID_PM, 0, PCI_PM_SIZEOF, errp);
-+    pos = pci_pm_init(d, 0, errp);
-     if (pos < 0) {
-         goto pm_error;
-     }
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 82a47edc89..e18b57d864 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2220,7 +2220,12 @@ static bool vfio_add_std_cap(VFIOPCIDevice *vdev, uint8_t pos, Error **errp)
-     case PCI_CAP_ID_PM:
-         vfio_check_pm_reset(vdev, pos);
-         vdev->pm_cap = pos;
--        ret = pci_add_capability(pdev, cap_id, pos, size, errp) >= 0;
-+        ret = pci_pm_init(pdev, pos, errp) >= 0;
-+        /*
-+         * PCI-core config space emulation needs write access to the power
-+         * state enabled for tracking BAR mapping relative to PM state.
-+         */
-+        pci_set_word(pdev->wmask + pos + PCI_PM_CTRL, PCI_PM_CTRL_STATE_MASK);
-         break;
-     case PCI_CAP_ID_AF:
-         vfio_check_af_flr(vdev, pos);
-diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
-index 524b63e5c7..4b2aeaad8d 100644
---- a/hw/virtio/virtio-pci.c
-+++ b/hw/virtio/virtio-pci.c
-@@ -2195,8 +2195,7 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
-         pos = pcie_endpoint_cap_init(pci_dev, 0);
-         assert(pos > 0);
- 
--        pos = pci_add_capability(pci_dev, PCI_CAP_ID_PM, 0,
--                                 PCI_PM_SIZEOF, errp);
-+        pos = pci_pm_init(pci_dev, 0, errp);
-         if (pos < 0) {
-             return;
-         }
--- 
-2.48.1
-
diff --git a/kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch b/kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
deleted file mode 100644
index e5fe2c7..0000000
--- a/kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 8a9811c6442d2d836d7483e3b4af969df43b1781 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Tue, 3 Dec 2024 13:19:28 +0100
-Subject: [PATCH] pci: ensure valid link status bits for downstream ports
-
-RH-Author: Sebastian Ott <sebott@redhat.com>
-RH-MergeRequest: 329: pci: ensure valid link status bits for downstream ports
-RH-Jira: RHEL-65616
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Shaoqin Huang <shahuang@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [1/1] 93a557766cbc12314e83cdf2c89b6ca9275f0c45 (seott1/cos-qemu-kvm)
-
-PCI hotplug for downstream endpoints on arm fails because Linux'
-PCIe hotplug driver doesn't like the QEMU provided LNKSTA:
-
-  pcieport 0000:08:01.0: pciehp: Slot(2): Card present
-  pcieport 0000:08:01.0: pciehp: Slot(2): Link Up
-  pcieport 0000:08:01.0: pciehp: Slot(2): Cannot train link: status 0x2000
-
-There's 2 cases where LNKSTA isn't setup properly:
-* the downstream device has no express capability
-* max link width of the bridge is 0
-
-Move the sanity checks added via 88c869198aa63
-("pci: Sanity test minimum downstream LNKSTA") outside of the
-branch to make sure downstream ports always have a valid LNKSTA.
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
-Tested-by: Zhenyu Zhang <zhenyzha@redhat.com>
-Message-Id: <20241203121928.14861-1-sebott@redhat.com>
-Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 694632fd44987cc4618612a38ad151047524a590)
-JIRA: https://issues.redhat.com/browse/RHEL-65616
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
----
- hw/pci/pcie.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
-index 4b2f0805c6..9cb137c30f 100644
---- a/hw/pci/pcie.c
-+++ b/hw/pci/pcie.c
-@@ -1080,18 +1080,22 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
-         if ((lnksta & PCI_EXP_LNKSTA_NLW) > (lnkcap & PCI_EXP_LNKCAP_MLW)) {
-             lnksta &= ~PCI_EXP_LNKSTA_NLW;
-             lnksta |= lnkcap & PCI_EXP_LNKCAP_MLW;
--        } else if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
--            lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
-         }
- 
-         if ((lnksta & PCI_EXP_LNKSTA_CLS) > (lnkcap & PCI_EXP_LNKCAP_SLS)) {
-             lnksta &= ~PCI_EXP_LNKSTA_CLS;
-             lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
--        } else if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
--            lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
-         }
-     }
- 
-+    if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
-+        lnksta |= QEMU_PCI_EXP_LNKSTA_NLW(QEMU_PCI_EXP_LNK_X1);
-+    }
-+
-+    if (!(lnksta & PCI_EXP_LNKSTA_CLS)) {
-+        lnksta |= QEMU_PCI_EXP_LNKSTA_CLS(QEMU_PCI_EXP_LNK_2_5GT);
-+    }
-+
-     pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA,
-                                  PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
-     pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA, lnksta &
--- 
-2.48.0
-
diff --git a/kvm-pcie-virtio-Remove-redundant-pm_cap.patch b/kvm-pcie-virtio-Remove-redundant-pm_cap.patch
deleted file mode 100644
index 15d82a2..0000000
--- a/kvm-pcie-virtio-Remove-redundant-pm_cap.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 274e81bcf091c981d1e27e49fbe98e63d5308472 Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 25 Feb 2025 14:52:28 -0700
-Subject: [PATCH 5/7] pcie, virtio: Remove redundant pm_cap
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [5/6] 81c6e3c9c52a0b3f0b9269b4ac7f56e8e4b5d68b (eauger1/centos-qemu-kvm)
-
-The pm_cap on the PCIExpressDevice object can be distilled down
-to the new instance on the PCIDevice object.
-
-Cc: Michael S. Tsirkin <mst@redhat.com>
-Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250225215237.3314011-5-alex.williamson@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 8b8d08cf293b930d0f55b2d5385d8dd27e0c6b41)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/pci-bridge/pcie_pci_bridge.c | 1 -
- hw/virtio/virtio-pci.c          | 8 +++-----
- include/hw/pci/pcie.h           | 2 --
- 3 files changed, 3 insertions(+), 8 deletions(-)
-
-diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
-index 2f098e3a13..c0ba6d7928 100644
---- a/hw/pci-bridge/pcie_pci_bridge.c
-+++ b/hw/pci-bridge/pcie_pci_bridge.c
-@@ -56,7 +56,6 @@ static void pcie_pci_bridge_realize(PCIDevice *d, Error **errp)
-     if (pos < 0) {
-         goto pm_error;
-     }
--    d->exp.pm_cap = pos;
-     pci_set_word(d->config + pos + PCI_PM_PMC, 0x3);
- 
-     pcie_cap_arifwd_init(d);
-diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
-index 4b2aeaad8d..a85787b837 100644
---- a/hw/virtio/virtio-pci.c
-+++ b/hw/virtio/virtio-pci.c
-@@ -2200,8 +2200,6 @@ static void virtio_pci_realize(PCIDevice *pci_dev, Error **errp)
-             return;
-         }
- 
--        pci_dev->exp.pm_cap = pos;
--
-         /*
-          * Indicates that this function complies with revision 1.2 of the
-          * PCI Power Management Interface Specification.
-@@ -2295,11 +2293,11 @@ static bool virtio_pci_no_soft_reset(PCIDevice *dev)
- {
-     uint16_t pmcsr;
- 
--    if (!pci_is_express(dev) || !dev->exp.pm_cap) {
-+    if (!pci_is_express(dev) || !(dev->cap_present & QEMU_PCI_CAP_PM)) {
-         return false;
-     }
- 
--    pmcsr = pci_get_word(dev->config + dev->exp.pm_cap + PCI_PM_CTRL);
-+    pmcsr = pci_get_word(dev->config + dev->pm_cap + PCI_PM_CTRL);
- 
-     /*
-      * When No_Soft_Reset bit is set and the device
-@@ -2328,7 +2326,7 @@ static void virtio_pci_bus_reset_hold(Object *obj, ResetType type)
- 
-         if (proxy->flags & VIRTIO_PCI_FLAG_INIT_PM) {
-             pci_word_test_and_clear_mask(
--                dev->config + dev->exp.pm_cap + PCI_PM_CTRL,
-+                dev->config + dev->pm_cap + PCI_PM_CTRL,
-                 PCI_PM_CTRL_STATE_MASK);
-         }
-     }
-diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
-index 5eddb90976..8a30d07fd0 100644
---- a/include/hw/pci/pcie.h
-+++ b/include/hw/pci/pcie.h
-@@ -58,8 +58,6 @@ typedef enum {
- struct PCIExpressDevice {
-     /* Offset of express capability in config space */
-     uint8_t exp_cap;
--    /* Offset of Power Management capability in config space */
--    uint8_t pm_cap;
- 
-     /* SLOT */
-     bool hpev_notified; /* Logical AND of conditions for hot plug event.
--- 
-2.48.1
-
diff --git a/kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch b/kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch
deleted file mode 100644
index 0df872d..0000000
--- a/kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From 8d8fd49920c7b4c49d2d7ca1666c3cc7a53a3e96 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:11:28 +0200
-Subject: [PATCH 115/115] physmem: Support coordinated discarding of RAM with
- guest_memfd
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [115/115] 5dfe5036d7b5524f0d0af4cde23cdd9ca696717b (bonzini/rhel-qemu-kvm)
-
-A new field, attributes, was introduced in RAMBlock to link to a
-RamBlockAttributes object, which centralizes all guest_memfd related
-information (such as fd and status bitmap) within a RAMBlock.
-
-Create and initialize the RamBlockAttributes object upon ram_block_add().
-Meanwhile, register the object in the target RAMBlock's MemoryRegion.
-After that, guest_memfd-backed RAMBlock is associated with the
-RamDiscardManager interface, and the users can execute RamDiscardManager
-specific handling. For example, VFIO will register the
-RamDiscardListener and get notifications when the state_change() helper
-invokes.
-
-As coordinate discarding of RAM with guest_memfd is now supported, only
-block uncoordinated discard.
-
-Tested-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Link: https://lore.kernel.org/r/20250612082747.51539-6-chenyi.qiang@intel.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 2fde3fb916079ee0ff0fc26d9446c813b1d5cc28)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: No CPR
----
- accel/kvm/kvm-all.c     |  9 +++++++++
- include/exec/ramblock.h |  1 +
- system/physmem.c        | 23 +++++++++++++++++++++--
- 3 files changed, 31 insertions(+), 2 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 43c10c82f6..1fd7773a28 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -3073,6 +3073,15 @@ int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
-     addr = memory_region_get_ram_ptr(mr) + section.offset_within_region;
-     rb = qemu_ram_block_from_host(addr, false, &offset);
- 
-+    ret = ram_block_attributes_state_change(RAM_BLOCK_ATTRIBUTES(mr->rdm),
-+                                            offset, size, to_private);
-+    if (ret) {
-+        error_report("Failed to notify the listener the state change of "
-+                     "(0x%"HWADDR_PRIx" + 0x%"HWADDR_PRIx") to %s",
-+                     start, size, to_private ? "private" : "shared");
-+        goto out_unref;
-+    }
-+
-     if (to_private) {
-         if (rb->page_size != qemu_real_host_page_size()) {
-             /*
-diff --git a/include/exec/ramblock.h b/include/exec/ramblock.h
-index 9ae774d268..a504765038 100644
---- a/include/exec/ramblock.h
-+++ b/include/exec/ramblock.h
-@@ -46,6 +46,7 @@ struct RAMBlock {
-     int fd;
-     uint64_t fd_offset;
-     int guest_memfd;
-+    RamBlockAttributes *attributes;
-     size_t page_size;
-     /* dirty bitmap used during migration */
-     unsigned long *bmap;
-diff --git a/system/physmem.c b/system/physmem.c
-index dccc95030b..35f8f25e22 100644
---- a/system/physmem.c
-+++ b/system/physmem.c
-@@ -1889,7 +1889,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
-         }
-         assert(new_block->guest_memfd < 0);
- 
--        ret = ram_block_discard_require(true);
-+        ret = ram_block_coordinated_discard_require(true);
-         if (ret < 0) {
-             error_setg_errno(errp, -ret,
-                              "cannot set up private guest memory: discard currently blocked");
-@@ -1903,6 +1903,24 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
-             qemu_mutex_unlock_ramlist();
-             goto out_free;
-         }
-+
-+        /*
-+         * The attribute bitmap of the RamBlockAttributes is default to
-+         * discarded, which mimics the behavior of kvm_set_phys_mem() when it
-+         * calls kvm_set_memory_attributes_private(). This leads to a brief
-+         * period of inconsistency between the creation of the RAMBlock and its
-+         * mapping into the physical address space. However, this is not
-+         * problematic, as no users rely on the attribute status to perform
-+         * any actions during this interval.
-+         */
-+        new_block->attributes = ram_block_attributes_create(new_block);
-+        if (!new_block->attributes) {
-+            error_setg(errp, "Failed to create ram block attribute");
-+            close(new_block->guest_memfd);
-+            ram_block_coordinated_discard_require(false);
-+            qemu_mutex_unlock_ramlist();
-+            goto out_free;
-+        }
-     }
- 
-     new_ram_size = MAX(old_ram_size,
-@@ -2159,8 +2177,9 @@ static void reclaim_ramblock(RAMBlock *block)
-     }
- 
-     if (block->guest_memfd >= 0) {
-+        ram_block_attributes_destroy(block->attributes);
-         close(block->guest_memfd);
--        ram_block_discard_require(false);
-+        ram_block_coordinated_discard_require(false);
-     }
- 
-     g_free(block);
--- 
-2.50.1
-
diff --git a/kvm-physmem-replace-assertion-with-error.patch b/kvm-physmem-replace-assertion-with-error.patch
deleted file mode 100644
index 98fa4ce..0000000
--- a/kvm-physmem-replace-assertion-with-error.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 40d97d335471a77b1491c124d2c109db68bf8ca6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Mon, 17 Feb 2025 13:08:12 +0100
-Subject: [PATCH 020/115] physmem: replace assertion with error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [20/115] 5c17949c668857760ee80279e5776e8dcf4c7c11 (bonzini/rhel-qemu-kvm)
-
-It is possible to start QEMU with a confidential-guest-support object
-even in TCG mode.  While there is already a check in qemu_machine_creation_done:
-
-    if (machine->cgs && !machine->cgs->ready) {
-        error_setg(errp, "accelerator does not support confidential guest %s",
-                   object_get_typename(OBJECT(machine->cgs)));
-        exit(1);
-    }
-
-the creation of RAMBlocks happens earlier, in qemu_init_board(), if
-the command line does not override the default memory backend with
--M memdev.  Then the RAMBlock will try to use guest_memfd (because
-machine_require_guest_memfd correctly returns true; at least correctly
-according to the current implementation) and trigger the assertion
-failure for kvm_enabled().  This happend with a command line as
-simple as the following:
-
-    qemu-system-x86_64 -m 512 -nographic -object sev-snp-guest,reduced-phys-bits=48,id=sev0 \
-       -M q35,kernel-irqchip=split,confidential-guest-support=sev0
-    qemu-system-x86_64: ../system/physmem.c:1871: ram_block_add: Assertion `kvm_enabled()' failed.
-
-Cc: Xiaoyao Li <xiaoyao.li@intel.com>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250217120812.396522-1-pbonzini@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 6debfb2cb1795427d2dc6a741c7430a233c76695)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- system/physmem.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/system/physmem.c b/system/physmem.c
-index 94600a33ec..dccc95030b 100644
---- a/system/physmem.c
-+++ b/system/physmem.c
-@@ -1882,7 +1882,11 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
-     if (new_block->flags & RAM_GUEST_MEMFD) {
-         int ret;
- 
--        assert(kvm_enabled());
-+        if (!kvm_enabled()) {
-+            error_setg(errp, "cannot set up private guest memory for %s: KVM required",
-+                       object_get_typename(OBJECT(current_machine->cgs)));
-+            goto out_free;
-+        }
-         assert(new_block->guest_memfd < 0);
- 
-         ret = ram_block_discard_require(true);
--- 
-2.50.1
-
diff --git a/kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch b/kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
deleted file mode 100644
index 1339593..0000000
--- a/kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From dbd3404564697435456f654f297a6ad4a6a7a351 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 19 Nov 2024 13:03:53 +0100
-Subject: [PATCH 1/4] qdev: Fix set_pci_devfn() to visit option only once
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 316: qdev-monitor: avoid QemuOpts in QMP device_add
-RH-Jira: RHEL-39948
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [1/4] 03b399f0fb3aff073206bb5280da41ce4f4ea251 (stefanha/centos-stream-qemu-kvm)
-
-pci_devfn properties accept either a string or an integer as input. To
-implement this, set_pci_devfn() first tries to visit the option as a
-string, and if that fails, it visits it as an integer instead. While the
-QemuOpts visitor happens to accept this, it is invalid according to the
-visitor interface. QObject input visitors run into an assertion failure
-when this is done.
-
-QObject input visitors are used with the JSON syntax version of -device
-on the command line:
-
-$ ./qemu-system-x86_64 -enable-kvm -M q35 -device pcie-pci-bridge,id=pci.1,bus=pcie.0 -blockdev null-co,node-name=disk -device '{ "driver": "virtio-blk-pci", "drive": "disk", "id": "virtio-disk0", "bus": "pci.1", "addr": 1 }'
-qemu-system-x86_64: ../qapi/qobject-input-visitor.c:143: QObject *qobject_input_try_get_object(QObjectInputVisitor *, const char *, _Bool): Assertion `removed' failed.
-
-The proper way to accept both strings and integers is using the
-alternate mechanism, which tells us the type of the input before it's
-visited. With this information, we can directly visit it as the right
-type.
-
-This fixes set_pci_devfn() by using the alternate mechanism.
-
-Cc: qemu-stable@nongnu.org
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20241119120353.57812-1-kwolf@redhat.com>
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 5102f9df4a9a7adfbd902f9515c3f8f53dba288e)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/core/qdev-properties-system.c | 54 +++++++++++++++++++++-----------
- 1 file changed, 36 insertions(+), 18 deletions(-)
-
-diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
-index 5cd527cdba..b182dc293a 100644
---- a/hw/core/qdev-properties-system.c
-+++ b/hw/core/qdev-properties-system.c
-@@ -820,39 +820,57 @@ static void set_pci_devfn(Object *obj, Visitor *v, const char *name,
-                           void *opaque, Error **errp)
- {
-     Property *prop = opaque;
-+    g_autofree GenericAlternate *alt;
-     int32_t value, *ptr = object_field_prop_ptr(obj, prop);
-     unsigned int slot, fn, n;
--    char *str;
-+    g_autofree char *str = NULL;
-+
-+    if (!visit_start_alternate(v, name, &alt, sizeof(*alt), errp)) {
-+        return;
-+    }
-+
-+    switch (alt->type) {
-+    case QTYPE_QSTRING:
-+        if (!visit_type_str(v, name, &str, errp)) {
-+            goto out;
-+        }
- 
--    if (!visit_type_str(v, name, &str, NULL)) {
-+        if (sscanf(str, "%x.%x%n", &slot, &fn, &n) != 2) {
-+            fn = 0;
-+            if (sscanf(str, "%x%n", &slot, &n) != 1) {
-+                goto invalid;
-+            }
-+        }
-+        if (str[n] != '\0' || fn > 7 || slot > 31) {
-+            goto invalid;
-+        }
-+        *ptr = slot << 3 | fn;
-+        break;
-+
-+    case QTYPE_QNUM:
-         if (!visit_type_int32(v, name, &value, errp)) {
--            return;
-+            goto out;
-         }
-         if (value < -1 || value > 255) {
-             error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
-                        name ? name : "null", "a value between -1 and 255");
--            return;
-+            goto out;
-         }
-         *ptr = value;
--        return;
--    }
-+        break;
- 
--    if (sscanf(str, "%x.%x%n", &slot, &fn, &n) != 2) {
--        fn = 0;
--        if (sscanf(str, "%x%n", &slot, &n) != 1) {
--            goto invalid;
--        }
--    }
--    if (str[n] != '\0' || fn > 7 || slot > 31) {
--        goto invalid;
-+    default:
-+        error_setg(errp, "Invalid parameter type for '%s', expected int or str",
-+                   name ? name : "null");
-+        goto out;
-     }
--    *ptr = slot << 3 | fn;
--    g_free(str);
--    return;
-+
-+    goto out;
- 
- invalid:
-     error_set_from_qdev_prop_error(errp, EINVAL, obj, name, str);
--    g_free(str);
-+out:
-+    visit_end_alternate(v, (void **) &alt);
- }
- 
- static int print_pci_devfn(Object *obj, Property *prop, char *dest,
--- 
-2.39.3
-
diff --git a/kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch b/kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
deleted file mode 100644
index 40d54f5..0000000
--- a/kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From 16596225b9a4c686f6c0b0f5400681f3eed599ca Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 27 Aug 2024 15:27:50 -0400
-Subject: [PATCH 3/4] qdev-monitor: avoid QemuOpts in QMP device_add
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 316: qdev-monitor: avoid QemuOpts in QMP device_add
-RH-Jira: RHEL-39948
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [3/4] 1f6efb07255700e00243d067b5468b6840270ed0 (stefanha/centos-stream-qemu-kvm)
-
-The QMP device_add monitor command converts the QDict arguments to
-QemuOpts and then back again to QDict. This process only supports scalar
-types. Device properties like virtio-blk-pci's iothread-vq-mapping (an
-array of objects) are silently dropped by qemu_opts_from_qdict() during
-the QemuOpts conversion even though QAPI is capable of validating them.
-As a result, hotplugging virtio-blk-pci devices with the
-iothread-vq-mapping property does not work as expected (the property is
-ignored).
-
-Get rid of the QemuOpts conversion in qmp_device_add() and call
-qdev_device_add_from_qdict() with from_json=true. Using the QMP
-command's QDict arguments directly allows non-scalar properties.
-
-The HMP is also adjusted since qmp_device_add()'s now expects properly
-typed JSON arguments and cannot be used from HMP anymore. Move the code
-that was previously in qmp_device_add() (with QemuOpts conversion and
-from_json=false) into hmp_device_add() so that its behavior is
-unchanged.
-
-This patch changes the behavior of QMP device_add but not HMP
-device_add. QMP clients that sent incorrectly typed device_add QMP
-commands no longer work. This is a breaking change but clients should be
-using the correct types already. See the netdev_add QAPIfication in
-commit db2a380c8457 for similar reasoning and object-add in commit
-9151e59a8b6e. Unlike those commits, we continue to rely on 'gen': false
-for the time being.
-
-Markus helped me figure this out and even provided a draft patch. The
-code ended up very close to what he suggested.
-
-Suggested-by: Markus Armbruster <armbru@redhat.com>
-Cc: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240827192751.948633-2-stefanha@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit be93fd53723cbdca675bd9ed112dae5cabbe1e91)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- system/qdev-monitor.c | 42 ++++++++++++++++++++++++++++--------------
- 1 file changed, 28 insertions(+), 14 deletions(-)
-
-diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
-index 6af6ef7d66..8b27cc42b0 100644
---- a/system/qdev-monitor.c
-+++ b/system/qdev-monitor.c
-@@ -849,18 +849,9 @@ void hmp_info_qdm(Monitor *mon, const QDict *qdict)
- 
- void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
- {
--    QemuOpts *opts;
-     DeviceState *dev;
- 
--    opts = qemu_opts_from_qdict(qemu_find_opts("device"), qdict, errp);
--    if (!opts) {
--        return;
--    }
--    if (!monitor_cur_is_qmp() && qdev_device_help(opts)) {
--        qemu_opts_del(opts);
--        return;
--    }
--    dev = qdev_device_add(opts, errp);
-+    dev = qdev_device_add_from_qdict(qdict, true, errp);
-     if (!dev) {
-         /*
-          * Drain all pending RCU callbacks. This is done because
-@@ -872,9 +863,6 @@ void qmp_device_add(QDict *qdict, QObject **ret_data, Error **errp)
-          * to the user
-          */
-         drain_call_rcu();
--
--        qemu_opts_del(opts);
--        return;
-     }
-     object_unref(OBJECT(dev));
- }
-@@ -967,8 +955,34 @@ void qmp_device_del(const char *id, Error **errp)
- void hmp_device_add(Monitor *mon, const QDict *qdict)
- {
-     Error *err = NULL;
-+    QemuOpts *opts;
-+    DeviceState *dev;
- 
--    qmp_device_add((QDict *)qdict, NULL, &err);
-+    opts = qemu_opts_from_qdict(qemu_find_opts("device"), qdict, &err);
-+    if (!opts) {
-+        goto out;
-+    }
-+    if (qdev_device_help(opts)) {
-+        qemu_opts_del(opts);
-+        return;
-+    }
-+    dev = qdev_device_add(opts, &err);
-+    if (!dev) {
-+        /*
-+         * Drain all pending RCU callbacks. This is done because
-+         * some bus related operations can delay a device removal
-+         * (in this case this can happen if device is added and then
-+         * removed due to a configuration error)
-+         * to a RCU callback, but user might expect that this interface
-+         * will finish its job completely once qmp command returns result
-+         * to the user
-+         */
-+        drain_call_rcu();
-+
-+        qemu_opts_del(opts);
-+    }
-+    object_unref(dev);
-+out:
-     hmp_handle_error(mon, err);
- }
- 
--- 
-2.39.3
-
diff --git a/kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch b/kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
deleted file mode 100644
index 9abce97..0000000
--- a/kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 04cfa8cf613e924c40c457d8373763a650568813 Mon Sep 17 00:00:00 2001
-From: Dehan Meng <demeng@redhat.com>
-Date: Wed, 25 Dec 2024 16:37:44 +0800
-Subject: [PATCH 3/4] qemu-ga: Optimize freeze-hook script logic of logging
- error
-
-RH-Author: 6-dehan <demeng@redhat.com>
-RH-MergeRequest: 323: qemu-ga: Optimize freeze-hook script logic of logging error
-RH-Jira: RHEL-52278
-RH-Acked-by: Konstantin Kostiuk <None>
-RH-Acked-by: Yan Vugenfirer <None>
-RH-Commit: [1/1] 8ec4bf5d91ccd8f4b8a14c9dccfdc7a30db80834 (6-dehan/centos-qemu-kvm)
-
-Make sure the error log of fsfreeze hooks
-when freeze/thaw/snapshot could be logged
-to system logs if the default logfile of
-qga can't be written or other situations
-
-Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
-Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
-Signed-off-by: Dehan Meng <demeng@redhat.com>
----
- scripts/qemu-guest-agent/fsfreeze-hook | 36 +++++++++++++++++++++++---
- 1 file changed, 32 insertions(+), 4 deletions(-)
-
-diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
-index 70536ba3e3..d5d8d4daf8 100755
---- a/scripts/qemu-guest-agent/fsfreeze-hook
-+++ b/scripts/qemu-guest-agent/fsfreeze-hook
-@@ -19,15 +19,43 @@ is_ignored_file() {
-     return 1
- }
- 
-+USE_SYSLOG=0
-+# if log file is not writable, fallback to syslog
-+[ ! -w "$LOGFILE" ] && USE_SYSLOG=1
-+# try to update log file and fallback to syslog if it fails
-+touch "$LOGFILE" &>/dev/null || USE_SYSLOG=1
-+
-+# Ensure the log file is writable, fallback to syslog if not
-+log_message() {
-+    local message="$1"
-+    if [ "$USE_SYSLOG" -eq 0 ]; then
-+        printf "%s: %s\n" "$(date)" "$message" >>"$LOGFILE"
-+    else
-+        logger -t qemu-ga-freeze-hook "$message"
-+    fi
-+}
-+
- # Iterate executables in directory "fsfreeze-hook.d" with the specified args
- [ ! -d "$FSFREEZE_D" ] && exit 0
-+
- for file in "$FSFREEZE_D"/* ; do
-     is_ignored_file "$file" && continue
-     [ -x "$file" ] || continue
--    printf "$(date): execute $file $@\n" >>$LOGFILE
--    "$file" "$@" >>$LOGFILE 2>&1
--    STATUS=$?
--    printf "$(date): $file finished with status=$STATUS\n" >>$LOGFILE
-+
-+    log_message "Executing $file $@"
-+    if [ "$USE_SYSLOG" -eq 0 ]; then
-+        "$file" "$@" >>"$LOGFILE" 2>&1
-+        STATUS=$?
-+    else
-+        "$file" "$@" 2>&1 | logger -t qemu-ga-freeze-hook
-+        STATUS=${PIPESTATUS[0]}
-+    fi
-+
-+    if [ $STATUS -ne 0 ]; then
-+        log_message "Error: $file finished with status=$STATUS"
-+    else
-+        log_message "$file finished successfully"
-+    fi
- done
- 
- exit 0
--- 
-2.39.3
-
diff --git a/kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch b/kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
deleted file mode 100644
index 8ea78b1..0000000
--- a/kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From adae9bf218efc9e43f24bda6989f09aa63141694 Mon Sep 17 00:00:00 2001
-From: Konstantin Kostiuk <kkostiuk@redhat.com>
-Date: Mon, 16 Dec 2024 17:45:52 +0200
-Subject: [PATCH 4/4] qga: Add log to guest-fsfreeze-thaw command
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: 6-dehan <demeng@redhat.com>
-RH-MergeRequest: 324: qga: Add log to guest-fsfreeze-thaw command
-RH-Jira: RHEL-56340
-RH-Acked-by: Konstantin Kostiuk <None>
-RH-Acked-by: Yan Vugenfirer <None>
-RH-Commit: [1/1] 794ed8728c0ecc0c9050c6d5380cc2f8d7bb7723 (6-dehan/centos-qemu-kvm)
-
-Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
----
- qga/commands-posix.c | 2 ++
- qga/commands-win32.c | 3 +++
- 2 files changed, 5 insertions(+)
-
-diff --git a/qga/commands-posix.c b/qga/commands-posix.c
-index c2bd0b4316..49e40f9127 100644
---- a/qga/commands-posix.c
-+++ b/qga/commands-posix.c
-@@ -806,8 +806,10 @@ int64_t qmp_guest_fsfreeze_thaw(Error **errp)
-     int ret;
- 
-     ret = qmp_guest_fsfreeze_do_thaw(errp);
-+
-     if (ret >= 0) {
-         ga_unset_frozen(ga_state);
-+        slog("guest-fsthaw called");
-         execute_fsfreeze_hook(FSFREEZE_HOOK_THAW, errp);
-     } else {
-         ret = 0;
-diff --git a/qga/commands-win32.c b/qga/commands-win32.c
-index 61b36da469..1aea6cd167 100644
---- a/qga/commands-win32.c
-+++ b/qga/commands-win32.c
-@@ -1273,6 +1273,9 @@ int64_t qmp_guest_fsfreeze_thaw(Error **errp)
-     qga_vss_fsfreeze(&i, false, NULL, errp);
- 
-     ga_unset_frozen(ga_state);
-+
-+    slog("guest-fsthaw called");
-+
-     return i;
- }
- 
--- 
-2.39.3
-
diff --git a/kvm-qga-implement-a-guest-get-load-command.patch b/kvm-qga-implement-a-guest-get-load-command.patch
deleted file mode 100644
index d4622ff..0000000
--- a/kvm-qga-implement-a-guest-get-load-command.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 22f26a93ab94bf87c0724891a5886797a38c23b4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 2 Dec 2024 12:19:27 +0000
-Subject: [PATCH 6/9] qga: implement a 'guest-get-load' command
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Konstantin Kostiuk <None>
-RH-MergeRequest: 343: RHEL-69622: qga: implement a 'guest-get-load' command
-RH-Jira: RHEL-69622
-RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/1] 9284c70737ad9f700d37f8c3833f855f2354acb7 (kkostiuk/redhat-centos-stream-src-qemu-kvm)
-
-Provide a way to report the process load average, via a new
-'guest-get-load' command.
-
-This is only implemented for POSIX platforms providing 'getloadavg'.
-
-Example illustrated with qmp-shell:
-
-(QEMU) guest-get-load
-{
-    "return": {
-        "load15m": 1.546875,
-        "load1m": 1.669921875,
-        "load5m": 1.9306640625
-    }
-}
-
-Windows has no native equivalent API, but it would be possible to
-simulate it as illustrated here (BSD-3-Clause):
-
-  https://github.com/giampaolo/psutil/pull/1485
-
-This is left as an exercise for future contributors.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
-Message-ID: <20241202121927.864335-1-berrange@redhat.com>
-Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
----
- meson.build          |  1 +
- qga/commands-posix.c | 20 ++++++++++++++++++++
- qga/qapi-schema.json | 37 +++++++++++++++++++++++++++++++++++++
- 3 files changed, 58 insertions(+)
-
-diff --git a/meson.build b/meson.build
-index b3529aa0e1..1dd97c6f49 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2497,6 +2497,7 @@ config_host_data.set('CONFIG_SETNS', cc.has_function('setns') and cc.has_functio
- config_host_data.set('CONFIG_SYNCFS', cc.has_function('syncfs'))
- config_host_data.set('CONFIG_SYNC_FILE_RANGE', cc.has_function('sync_file_range'))
- config_host_data.set('CONFIG_TIMERFD', cc.has_function('timerfd_create'))
-+config_host_data.set('CONFIG_GETLOADAVG', cc.has_function('getloadavg'))
- config_host_data.set('HAVE_COPY_FILE_RANGE', cc.has_function('copy_file_range'))
- config_host_data.set('HAVE_GETIFADDRS', cc.has_function('getifaddrs'))
- config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', glib_has_gslice)
-diff --git a/qga/commands-posix.c b/qga/commands-posix.c
-index 49e40f9127..abfa53d6e9 100644
---- a/qga/commands-posix.c
-+++ b/qga/commands-posix.c
-@@ -1371,3 +1371,23 @@ char *qga_get_host_name(Error **errp)
- 
-     return g_steal_pointer(&hostname);
- }
-+
-+#ifdef CONFIG_GETLOADAVG
-+GuestLoadAverage *qmp_guest_get_load(Error **errp)
-+{
-+    double loadavg[3];
-+    GuestLoadAverage *ret = NULL;
-+
-+    if (getloadavg(loadavg, G_N_ELEMENTS(loadavg)) < 0) {
-+        error_setg_errno(errp, errno,
-+                         "cannot query load average");
-+        return NULL;
-+    }
-+
-+    ret = g_new0(GuestLoadAverage, 1);
-+    ret->load1m = loadavg[0];
-+    ret->load5m = loadavg[1];
-+    ret->load15m = loadavg[2];
-+    return ret;
-+}
-+#endif
-diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
-index 495706cf73..739f008ff2 100644
---- a/qga/qapi-schema.json
-+++ b/qga/qapi-schema.json
-@@ -1852,6 +1852,43 @@
-   'if': 'CONFIG_LINUX'
- }
- 
-+
-+##
-+# @GuestLoadAverage:
-+#
-+# Statistics about process load information
-+#
-+# @load1m: 1-minute load avage
-+#
-+# @load5m: 5-minute load avage
-+#
-+# @load15m: 15-minute load avage
-+#
-+# Since: 10.0
-+##
-+{ 'struct': 'GuestLoadAverage',
-+  'data': {
-+      'load1m': 'number',
-+      'load5m': 'number',
-+      'load15m': 'number'
-+  },
-+  'if': 'CONFIG_GETLOADAVG'
-+}
-+
-+##
-+# @guest-get-load:
-+#
-+# Retrieve CPU process load information
-+#
-+# Returns: load information
-+#
-+# Since: 10.0
-+##
-+{ 'command': 'guest-get-load',
-+  'returns': 'GuestLoadAverage',
-+  'if': 'CONFIG_GETLOADAVG'
-+}
-+
- ##
- # @GuestNetworkRoute:
- #
--- 
-2.48.1
-
diff --git a/kvm-qga-skip-bind-mounts-in-fs-list.patch b/kvm-qga-skip-bind-mounts-in-fs-list.patch
deleted file mode 100644
index bd12189..0000000
--- a/kvm-qga-skip-bind-mounts-in-fs-list.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 5f23535420c40755a2da63915b3c5a1c3eb185bd Mon Sep 17 00:00:00 2001
-From: Jean-Louis Dupond <jean-louis@dupond.be>
-Date: Wed, 2 Oct 2024 12:06:35 +0200
-Subject: [PATCH 17/19] qga: skip bind mounts in fs list
-
-RH-Author: Konstantin Kostiuk <None>
-RH-MergeRequest: 306: qga: skip bind mounts in fs list
-RH-Jira: RHEL-71940
-RH-Acked-by: yvugenfi <None>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 02f3a54f06caec953351bfdd6b25b91986d822c9 (kkostiuk/redhat-centos-stream-src-qemu-kvm)
-
-The filesystem list in build_fs_mount_list should skip bind mounts.
-This because we end up in locking situations when doing fsFreeze. Like
-mentioned in [1] and [2].
-
-Next to that, the build_fs_mount_list call did a fallback via
-build_fs_mount_list_from_mtab if mountinfo did not exist.
-There it skipped bind mounts, but this is broken for newer OS.
-This as mounts does not return the path of the bind mount but the
-underlying dev/partition, so S_ISDIR will never return true in
-dev_major_minor call.
-
-This patch simply checks the existing devmajor:devminor tuple in the
-mounts, and if it already exists, this means we have the same devices
-mounted again, a bind mount. So skip this.
-
-Same approach is used in open-vm-tools [3].
-
-[1]: https://gitlab.com/qemu-project/qemu/-/issues/592
-[2]: https://gitlab.com/qemu-project/qemu/-/issues/520
-[3]: https://github.com/vmware/open-vm-tools/commit/d58847b497e212737007958c945af1df22a8ab58
-
-Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be>
-Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
-Link: https://lore.kernel.org/r/20241002100634.162499-2-jean-louis@dupond.be
-Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
----
- qga/commands-linux.c | 25 +++++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
-
-diff --git a/qga/commands-linux.c b/qga/commands-linux.c
-index 51d5e3d927..426b040ab8 100644
---- a/qga/commands-linux.c
-+++ b/qga/commands-linux.c
-@@ -59,6 +59,22 @@ static int dev_major_minor(const char *devpath,
-     return -1;
- }
- 
-+/*
-+ * Check if we already have the devmajor:devminor in the mounts
-+ * If thats the case return true.
-+ */
-+static bool dev_exists(FsMountList *mounts, unsigned int devmajor, unsigned int devminor)
-+{
-+    FsMount *mount;
-+
-+    QTAILQ_FOREACH(mount, mounts, next) {
-+        if (mount->devmajor == devmajor && mount->devminor == devminor) {
-+            return true;
-+        }
-+    }
-+    return false;
-+}
-+
- static bool build_fs_mount_list_from_mtab(FsMountList *mounts, Error **errp)
- {
-     struct mntent *ment;
-@@ -89,6 +105,10 @@ static bool build_fs_mount_list_from_mtab(FsMountList *mounts, Error **errp)
-             /* Skip bind mounts */
-             continue;
-         }
-+        if (dev_exists(mounts, devmajor, devminor)) {
-+            /* Skip already existing devices (bind mounts) */
-+            continue;
-+        }
- 
-         mount = g_new0(FsMount, 1);
-         mount->dirname = g_strdup(ment->mnt_dir);
-@@ -172,6 +192,11 @@ bool build_fs_mount_list(FsMountList *mounts, Error **errp)
-             }
-         }
- 
-+        if (dev_exists(mounts, devmajor, devminor)) {
-+            /* Skip already existing devices (bind mounts) */
-+            continue;
-+        }
-+
-         mount = g_new0(FsMount, 1);
-         mount->dirname = g_strdup(line + dir_s);
-         mount->devtype = g_strdup(dash + type_s);
--- 
-2.39.3
-
diff --git a/kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch b/kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch
deleted file mode 100644
index db8efd2..0000000
--- a/kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From a99282ca32a1fef256c1fc155ef4f43aed9e1e48 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 6 Dec 2024 18:08:34 -0500
-Subject: [PATCH 03/23] qmp/cont: Only activate disks if migration completed
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 339: QMP command for block device reactivation after migration
-RH-Jira: RHEL-54296 RHEL-78397
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/22] 942fea0b972c992c52e6a1c85172afe899e4e312 (kmwolf/centos-qemu-kvm)
-
-As the comment says, the activation of disks is for the case where
-migration has completed, rather than when QEMU is still during
-migration (RUN_STATE_INMIGRATE).
-
-Move the code over to reflect what the comment is describing.
-
-Cc: Kevin Wolf <kwolf@redhat.com>
-Cc: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-Id: <20241206230838.1111496-3-peterx@redhat.com>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-(cherry picked from commit e4e5e89bbd8e731e86735d9d25b7b5f49e8f08b6)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- monitor/qmp-cmds.c | 26 ++++++++++++++------------
- 1 file changed, 14 insertions(+), 12 deletions(-)
-
-diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
-index f84a0dc523..76f21e8af3 100644
---- a/monitor/qmp-cmds.c
-+++ b/monitor/qmp-cmds.c
-@@ -96,21 +96,23 @@ void qmp_cont(Error **errp)
-         }
-     }
- 
--    /* Continuing after completed migration. Images have been inactivated to
--     * allow the destination to take control. Need to get control back now.
--     *
--     * If there are no inactive block nodes (e.g. because the VM was just
--     * paused rather than completing a migration), bdrv_inactivate_all() simply
--     * doesn't do anything. */
--    bdrv_activate_all(&local_err);
--    if (local_err) {
--        error_propagate(errp, local_err);
--        return;
--    }
--
-     if (runstate_check(RUN_STATE_INMIGRATE)) {
-         autostart = 1;
-     } else {
-+        /*
-+         * Continuing after completed migration. Images have been
-+         * inactivated to allow the destination to take control. Need to
-+         * get control back now.
-+         *
-+         * If there are no inactive block nodes (e.g. because the VM was
-+         * just paused rather than completing a migration),
-+         * bdrv_inactivate_all() simply doesn't do anything.
-+         */
-+        bdrv_activate_all(&local_err);
-+        if (local_err) {
-+            error_propagate(errp, local_err);
-+            return;
-+        }
-         vm_start();
-     }
- }
--- 
-2.48.1
-
diff --git a/kvm-qom-reverse-order-of-instance_post_init-calls.patch b/kvm-qom-reverse-order-of-instance_post_init-calls.patch
deleted file mode 100644
index 816de07..0000000
--- a/kvm-qom-reverse-order-of-instance_post_init-calls.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 60ab87c5cad64e3169ee65f396c6d9f1f7eb0daa Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 022/115] qom: reverse order of instance_post_init calls
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [22/115] e4e2393adffd671dc4d4f7147c620884757c7d74 (bonzini/rhel-qemu-kvm)
-
-Currently, the instance_post_init calls are performed from the leaf
-class and all the way up to Object.  This is incorrect because the
-leaf class cannot observe property values applied by the superclasses;
-for example, a compat property will be set on a device *after*
-the class's post_init callback has run.
-
-In particular this makes it impossible for implementations of
-accel_cpu_instance_init() to operate based on the actual values of
-the properties, though it seems that cxl_dsp_instance_post_init and
-rp_instance_post_init might have similar issues.
-
-Follow instead the same order as instance_init, starting with Object
-and running the child class's instance_post_init after the parent.
-
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 220c739903cec99df032219ac94c45b5269a0ab5)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/qom/object.h | 3 ++-
- qom/object.c         | 8 ++++----
- 2 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/include/qom/object.h b/include/qom/object.h
-index 13d3a655dd..668dd1cc08 100644
---- a/include/qom/object.h
-+++ b/include/qom/object.h
-@@ -444,7 +444,8 @@ struct Object
-  *   class will have already been initialized so the type is only responsible
-  *   for initializing its own members.
-  * @instance_post_init: This function is called to finish initialization of
-- *   an object, after all @instance_init functions were called.
-+ *   an object, after all @instance_init functions were called, as well as
-+ *   @instance_post_init functions for the parent classes.
-  * @instance_finalize: This function is called during object destruction.  This
-  *   is called before the parent @instance_finalize function has been called.
-  *   An object should only free the members that are unique to its type in this
-diff --git a/qom/object.c b/qom/object.c
-index 157a45c5f8..c03cd3c733 100644
---- a/qom/object.c
-+++ b/qom/object.c
-@@ -423,13 +423,13 @@ static void object_init_with_type(Object *obj, TypeImpl *ti)
- 
- static void object_post_init_with_type(Object *obj, TypeImpl *ti)
- {
--    if (ti->instance_post_init) {
--        ti->instance_post_init(obj);
--    }
--
-     if (type_has_parent(ti)) {
-         object_post_init_with_type(obj, type_get_parent(ti));
-     }
-+
-+    if (ti->instance_post_init) {
-+        ti->instance_post_init(obj);
-+    }
- }
- 
- bool object_apply_global_props(Object *obj, const GPtrArray *props,
--- 
-2.50.1
-
diff --git a/kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch b/kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch
deleted file mode 100644
index 22c3baf..0000000
--- a/kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch
+++ /dev/null
@@ -1,613 +0,0 @@
-From 13a29003f5a5502fc2cd13cb22f3fd6318e80196 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:11:28 +0200
-Subject: [PATCH 114/115] ram-block-attributes: Introduce RamBlockAttributes to
- manage RAMBlock with guest_memfd
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [114/115] eca60c04c6204ee91e4aedb84c993155605e6f5a (bonzini/rhel-qemu-kvm)
-
-Commit 852f0048f3 ("RAMBlock: make guest_memfd require uncoordinated
-discard") highlighted that subsystems like VFIO may disable RAM block
-discard. However, guest_memfd relies on discard operations for page
-conversion between private and shared memory, potentially leading to
-the stale IOMMU mapping issue when assigning hardware devices to
-confidential VMs via shared memory. To address this and allow shared
-device assignement, it is crucial to ensure the VFIO system refreshes
-its IOMMU mappings.
-
-RamDiscardManager is an existing interface (used by virtio-mem) to
-adjust VFIO mappings in relation to VM page assignment. Effectively page
-conversion is similar to hot-removing a page in one mode and adding it
-back in the other. Therefore, similar actions are required for page
-conversion events. Introduce the RamDiscardManager to guest_memfd to
-facilitate this process.
-
-Since guest_memfd is not an object, it cannot directly implement the
-RamDiscardManager interface. Implementing it in HostMemoryBackend is
-not appropriate because guest_memfd is per RAMBlock, and some RAMBlocks
-have a memory backend while others do not. Notably, virtual BIOS
-RAMBlocks using memory_region_init_ram_guest_memfd() do not have a
-backend.
-
-To manage RAMBlocks with guest_memfd, define a new object named
-RamBlockAttributes to implement the RamDiscardManager interface. This
-object can store the guest_memfd information such as the bitmap for
-shared memory and the registered listeners for event notifications. A
-new state_change() helper function is provided to notify listeners, such
-as VFIO, allowing VFIO to do dynamically DMA map and unmap for the shared
-memory according to conversion events. Note that in the current context
-of RamDiscardManager for guest_memfd, the shared state is analogous to
-being populated, while the private state can be considered discarded for
-simplicity. In the future, it would be more complicated if considering
-more states like private/shared/discarded at the same time.
-
-In current implementation, memory state tracking is performed at the
-host page size granularity, as the minimum conversion size can be one
-page per request. Additionally, VFIO expected the DMA mapping for a
-specific IOVA to be mapped and unmapped with the same granularity.
-Confidential VMs may perform partial conversions, such as conversions on
-small regions within a larger one. To prevent such invalid cases and
-until support for DMA mapping cut operations is available, all
-operations are performed with 4K granularity.
-
-In addition, memory conversion failures cause QEMU to quit rather than
-resuming the guest or retrying the operation at present. It would be
-future work to add more error handling or rollback mechanisms once
-conversion failures are allowed. For example, in-place conversion of
-guest_memfd could retry the unmap operation during the conversion from
-shared to private. For now, keep the complex error handling out of the
-picture as it is not required.
-
-Tested-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
-Link: https://lore.kernel.org/r/20250612082747.51539-5-chenyi.qiang@intel.com
-[peterx: squash fixup from Chenyi to fix builds]
-Signed-off-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 5d6483edaa9232d8f3709f68c8eab4bc2033fb70)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/->sysemu/ or exec/, context, class_init argument is not const
----
- MAINTAINERS                   |   1 +
- include/exec/ramblock.h       |  22 ++
- system/meson.build            |   1 +
- system/ram-block-attributes.c | 444 ++++++++++++++++++++++++++++++++++
- system/trace-events           |   3 +
- 5 files changed, 471 insertions(+)
- create mode 100644 system/ram-block-attributes.c
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index f7b7ceffc4..87ba88da84 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -3056,6 +3056,7 @@ F: system/memory.c
- F: system/memory_mapping.c
- F: system/physmem.c
- F: include/exec/memory-internal.h
-+F: system/ram-block-attributes.c
- F: scripts/coccinelle/memory-region-housekeeping.cocci
- 
- Memory devices
-diff --git a/include/exec/ramblock.h b/include/exec/ramblock.h
-index 0babd105c0..9ae774d268 100644
---- a/include/exec/ramblock.h
-+++ b/include/exec/ramblock.h
-@@ -23,6 +23,10 @@
- #include "cpu-common.h"
- #include "qemu/rcu.h"
- #include "exec/ramlist.h"
-+#include "sysemu/hostmem.h"
-+
-+#define TYPE_RAM_BLOCK_ATTRIBUTES "ram-block-attributes"
-+OBJECT_DECLARE_SIMPLE_TYPE(RamBlockAttributes, RAM_BLOCK_ATTRIBUTES)
- 
- struct RAMBlock {
-     struct rcu_head rcu;
-@@ -90,5 +94,23 @@ struct RAMBlock {
-      */
-     ram_addr_t postcopy_length;
- };
-+
-+struct RamBlockAttributes {
-+    Object parent;
-+
-+    RAMBlock *ram_block;
-+
-+    /* 1-setting of the bitmap represents ram is populated (shared) */
-+    unsigned bitmap_size;
-+    unsigned long *bitmap;
-+
-+    QLIST_HEAD(, RamDiscardListener) rdl_list;
-+};
-+
-+RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block);
-+void ram_block_attributes_destroy(RamBlockAttributes *attr);
-+int ram_block_attributes_state_change(RamBlockAttributes *attr, uint64_t offset,
-+                                      uint64_t size, bool to_discard);
-+
- #endif
- #endif
-diff --git a/system/meson.build b/system/meson.build
-index a296270cb0..b13d9e71ff 100644
---- a/system/meson.build
-+++ b/system/meson.build
-@@ -16,6 +16,7 @@ system_ss.add(files(
-   'dirtylimit.c',
-   'dma-helpers.c',
-   'globals.c',
-+  'ram-block-attributes.c',
-   'memory_mapping.c',
-   'qdev-monitor.c',
-   'qtest.c',
-diff --git a/system/ram-block-attributes.c b/system/ram-block-attributes.c
-new file mode 100644
-index 0000000000..0bded54e9c
---- /dev/null
-+++ b/system/ram-block-attributes.c
-@@ -0,0 +1,444 @@
-+/*
-+ * QEMU ram block attributes
-+ *
-+ * Copyright Intel
-+ *
-+ * Author:
-+ *      Chenyi Qiang <chenyi.qiang@intel.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/error-report.h"
-+#include "exec/ramblock.h"
-+#include "trace.h"
-+
-+OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RamBlockAttributes,
-+                                          ram_block_attributes,
-+                                          RAM_BLOCK_ATTRIBUTES,
-+                                          OBJECT,
-+                                          { TYPE_RAM_DISCARD_MANAGER },
-+                                          { })
-+
-+static size_t
-+ram_block_attributes_get_block_size(const RamBlockAttributes *attr)
-+{
-+    /*
-+     * Because page conversion could be manipulated in the size of at least 4K
-+     * or 4K aligned, Use the host page size as the granularity to track the
-+     * memory attribute.
-+     */
-+    g_assert(attr && attr->ram_block);
-+    g_assert(attr->ram_block->page_size == qemu_real_host_page_size());
-+    return attr->ram_block->page_size;
-+}
-+
-+
-+static bool
-+ram_block_attributes_rdm_is_populated(const RamDiscardManager *rdm,
-+                                      const MemoryRegionSection *section)
-+{
-+    const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+    const size_t block_size = ram_block_attributes_get_block_size(attr);
-+    const uint64_t first_bit = section->offset_within_region / block_size;
-+    const uint64_t last_bit =
-+        first_bit + int128_get64(section->size) / block_size - 1;
-+    unsigned long first_discarded_bit;
-+
-+    first_discarded_bit = find_next_zero_bit(attr->bitmap, last_bit + 1,
-+                                           first_bit);
-+    return first_discarded_bit > last_bit;
-+}
-+
-+typedef int (*ram_block_attributes_section_cb)(MemoryRegionSection *s,
-+                                               void *arg);
-+
-+static int
-+ram_block_attributes_notify_populate_cb(MemoryRegionSection *section,
-+                                        void *arg)
-+{
-+    RamDiscardListener *rdl = arg;
-+
-+    return rdl->notify_populate(rdl, section);
-+}
-+
-+static int
-+ram_block_attributes_notify_discard_cb(MemoryRegionSection *section,
-+                                       void *arg)
-+{
-+    RamDiscardListener *rdl = arg;
-+
-+    rdl->notify_discard(rdl, section);
-+    return 0;
-+}
-+
-+static int
-+ram_block_attributes_for_each_populated_section(const RamBlockAttributes *attr,
-+                                                MemoryRegionSection *section,
-+                                                void *arg,
-+                                                ram_block_attributes_section_cb cb)
-+{
-+    unsigned long first_bit, last_bit;
-+    uint64_t offset, size;
-+    const size_t block_size = ram_block_attributes_get_block_size(attr);
-+    int ret = 0;
-+
-+    first_bit = section->offset_within_region / block_size;
-+    first_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
-+                              first_bit);
-+
-+    while (first_bit < attr->bitmap_size) {
-+        MemoryRegionSection tmp = *section;
-+
-+        offset = first_bit * block_size;
-+        last_bit = find_next_zero_bit(attr->bitmap, attr->bitmap_size,
-+                                      first_bit + 1) - 1;
-+        size = (last_bit - first_bit + 1) * block_size;
-+
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-+            break;
-+        }
-+
-+        ret = cb(&tmp, arg);
-+        if (ret) {
-+            error_report("%s: Failed to notify RAM discard listener: %s",
-+                         __func__, strerror(-ret));
-+            break;
-+        }
-+
-+        first_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
-+                                  last_bit + 2);
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ram_block_attributes_for_each_discarded_section(const RamBlockAttributes *attr,
-+                                                MemoryRegionSection *section,
-+                                                void *arg,
-+                                                ram_block_attributes_section_cb cb)
-+{
-+    unsigned long first_bit, last_bit;
-+    uint64_t offset, size;
-+    const size_t block_size = ram_block_attributes_get_block_size(attr);
-+    int ret = 0;
-+
-+    first_bit = section->offset_within_region / block_size;
-+    first_bit = find_next_zero_bit(attr->bitmap, attr->bitmap_size,
-+                                   first_bit);
-+
-+    while (first_bit < attr->bitmap_size) {
-+        MemoryRegionSection tmp = *section;
-+
-+        offset = first_bit * block_size;
-+        last_bit = find_next_bit(attr->bitmap, attr->bitmap_size,
-+                                 first_bit + 1) - 1;
-+        size = (last_bit - first_bit + 1) * block_size;
-+
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-+            break;
-+        }
-+
-+        ret = cb(&tmp, arg);
-+        if (ret) {
-+            error_report("%s: Failed to notify RAM discard listener: %s",
-+                         __func__, strerror(-ret));
-+            break;
-+        }
-+
-+        first_bit = find_next_zero_bit(attr->bitmap,
-+                                       attr->bitmap_size,
-+                                       last_bit + 2);
-+    }
-+
-+    return ret;
-+}
-+
-+static uint64_t
-+ram_block_attributes_rdm_get_min_granularity(const RamDiscardManager *rdm,
-+                                             const MemoryRegion *mr)
-+{
-+    const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+
-+    g_assert(mr == attr->ram_block->mr);
-+    return ram_block_attributes_get_block_size(attr);
-+}
-+
-+static void
-+ram_block_attributes_rdm_register_listener(RamDiscardManager *rdm,
-+                                           RamDiscardListener *rdl,
-+                                           MemoryRegionSection *section)
-+{
-+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+    int ret;
-+
-+    g_assert(section->mr == attr->ram_block->mr);
-+    rdl->section = memory_region_section_new_copy(section);
-+
-+    QLIST_INSERT_HEAD(&attr->rdl_list, rdl, next);
-+
-+    ret = ram_block_attributes_for_each_populated_section(attr, section, rdl,
-+                                    ram_block_attributes_notify_populate_cb);
-+    if (ret) {
-+        error_report("%s: Failed to register RAM discard listener: %s",
-+                     __func__, strerror(-ret));
-+        exit(1);
-+    }
-+}
-+
-+static void
-+ram_block_attributes_rdm_unregister_listener(RamDiscardManager *rdm,
-+                                             RamDiscardListener *rdl)
-+{
-+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+    int ret;
-+
-+    g_assert(rdl->section);
-+    g_assert(rdl->section->mr == attr->ram_block->mr);
-+
-+    if (rdl->double_discard_supported) {
-+        rdl->notify_discard(rdl, rdl->section);
-+    } else {
-+        ret = ram_block_attributes_for_each_populated_section(attr,
-+                rdl->section, rdl, ram_block_attributes_notify_discard_cb);
-+        if (ret) {
-+            error_report("%s: Failed to unregister RAM discard listener: %s",
-+                         __func__, strerror(-ret));
-+            exit(1);
-+        }
-+    }
-+
-+    memory_region_section_free_copy(rdl->section);
-+    rdl->section = NULL;
-+    QLIST_REMOVE(rdl, next);
-+}
-+
-+typedef struct RamBlockAttributesReplayData {
-+    ReplayRamDiscardState fn;
-+    void *opaque;
-+} RamBlockAttributesReplayData;
-+
-+static int ram_block_attributes_rdm_replay_cb(MemoryRegionSection *section,
-+                                              void *arg)
-+{
-+    RamBlockAttributesReplayData *data = arg;
-+
-+    return data->fn(section, data->opaque);
-+}
-+
-+static int
-+ram_block_attributes_rdm_replay_populated(const RamDiscardManager *rdm,
-+                                          MemoryRegionSection *section,
-+                                          ReplayRamDiscardState replay_fn,
-+                                          void *opaque)
-+{
-+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+    RamBlockAttributesReplayData data = { .fn = replay_fn, .opaque = opaque };
-+
-+    g_assert(section->mr == attr->ram_block->mr);
-+    return ram_block_attributes_for_each_populated_section(attr, section, &data,
-+                                            ram_block_attributes_rdm_replay_cb);
-+}
-+
-+static int
-+ram_block_attributes_rdm_replay_discarded(const RamDiscardManager *rdm,
-+                                          MemoryRegionSection *section,
-+                                          ReplayRamDiscardState replay_fn,
-+                                          void *opaque)
-+{
-+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-+    RamBlockAttributesReplayData data = { .fn = replay_fn, .opaque = opaque };
-+
-+    g_assert(section->mr == attr->ram_block->mr);
-+    return ram_block_attributes_for_each_discarded_section(attr, section, &data,
-+                                            ram_block_attributes_rdm_replay_cb);
-+}
-+
-+static bool
-+ram_block_attributes_is_valid_range(RamBlockAttributes *attr, uint64_t offset,
-+                                    uint64_t size)
-+{
-+    MemoryRegion *mr = attr->ram_block->mr;
-+
-+    g_assert(mr);
-+
-+    uint64_t region_size = memory_region_size(mr);
-+    const size_t block_size = ram_block_attributes_get_block_size(attr);
-+
-+    if (!QEMU_IS_ALIGNED(offset, block_size) ||
-+        !QEMU_IS_ALIGNED(size, block_size)) {
-+        return false;
-+    }
-+    if (offset + size <= offset) {
-+        return false;
-+    }
-+    if (offset + size > region_size) {
-+        return false;
-+    }
-+    return true;
-+}
-+
-+static void ram_block_attributes_notify_discard(RamBlockAttributes *attr,
-+                                                uint64_t offset,
-+                                                uint64_t size)
-+{
-+    RamDiscardListener *rdl;
-+
-+    QLIST_FOREACH(rdl, &attr->rdl_list, next) {
-+        MemoryRegionSection tmp = *rdl->section;
-+
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-+            continue;
-+        }
-+        rdl->notify_discard(rdl, &tmp);
-+    }
-+}
-+
-+static int
-+ram_block_attributes_notify_populate(RamBlockAttributes *attr,
-+                                     uint64_t offset, uint64_t size)
-+{
-+    RamDiscardListener *rdl;
-+    int ret = 0;
-+
-+    QLIST_FOREACH(rdl, &attr->rdl_list, next) {
-+        MemoryRegionSection tmp = *rdl->section;
-+
-+        if (!memory_region_section_intersect_range(&tmp, offset, size)) {
-+            continue;
-+        }
-+        ret = rdl->notify_populate(rdl, &tmp);
-+        if (ret) {
-+            break;
-+        }
-+    }
-+
-+    return ret;
-+}
-+
-+int ram_block_attributes_state_change(RamBlockAttributes *attr,
-+                                      uint64_t offset, uint64_t size,
-+                                      bool to_discard)
-+{
-+    const size_t block_size = ram_block_attributes_get_block_size(attr);
-+    const unsigned long first_bit = offset / block_size;
-+    const unsigned long nbits = size / block_size;
-+    const unsigned long last_bit = first_bit + nbits - 1;
-+    const bool is_discarded = find_next_bit(attr->bitmap, attr->bitmap_size,
-+                                            first_bit) > last_bit;
-+    const bool is_populated = find_next_zero_bit(attr->bitmap,
-+                                attr->bitmap_size, first_bit) > last_bit;
-+    unsigned long bit;
-+    int ret = 0;
-+
-+    if (!ram_block_attributes_is_valid_range(attr, offset, size)) {
-+        error_report("%s, invalid range: offset 0x%" PRIx64 ", size "
-+                     "0x%" PRIx64, __func__, offset, size);
-+        return -EINVAL;
-+    }
-+
-+    trace_ram_block_attributes_state_change(offset, size,
-+                                            is_discarded ? "discarded" :
-+                                            is_populated ? "populated" :
-+                                            "mixture",
-+                                            to_discard ? "discarded" :
-+                                            "populated");
-+    if (to_discard) {
-+        if (is_discarded) {
-+            /* Already private */
-+        } else if (is_populated) {
-+            /* Completely shared */
-+            bitmap_clear(attr->bitmap, first_bit, nbits);
-+            ram_block_attributes_notify_discard(attr, offset, size);
-+        } else {
-+            /* Unexpected mixture: process individual blocks */
-+            for (bit = first_bit; bit < first_bit + nbits; bit++) {
-+                if (!test_bit(bit, attr->bitmap)) {
-+                    continue;
-+                }
-+                clear_bit(bit, attr->bitmap);
-+                ram_block_attributes_notify_discard(attr, bit * block_size,
-+                                                    block_size);
-+            }
-+        }
-+    } else {
-+        if (is_populated) {
-+            /* Already shared */
-+        } else if (is_discarded) {
-+            /* Completely private */
-+            bitmap_set(attr->bitmap, first_bit, nbits);
-+            ret = ram_block_attributes_notify_populate(attr, offset, size);
-+        } else {
-+            /* Unexpected mixture: process individual blocks */
-+            for (bit = first_bit; bit < first_bit + nbits; bit++) {
-+                if (test_bit(bit, attr->bitmap)) {
-+                    continue;
-+                }
-+                set_bit(bit, attr->bitmap);
-+                ret = ram_block_attributes_notify_populate(attr,
-+                                                           bit * block_size,
-+                                                           block_size);
-+                if (ret) {
-+                    break;
-+                }
-+            }
-+        }
-+    }
-+
-+    return ret;
-+}
-+
-+RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block)
-+{
-+    const int block_size  = qemu_real_host_page_size();
-+    RamBlockAttributes *attr;
-+    MemoryRegion *mr = ram_block->mr;
-+
-+    attr = RAM_BLOCK_ATTRIBUTES(object_new(TYPE_RAM_BLOCK_ATTRIBUTES));
-+
-+    attr->ram_block = ram_block;
-+    if (memory_region_set_ram_discard_manager(mr, RAM_DISCARD_MANAGER(attr))) {
-+        object_unref(OBJECT(attr));
-+        return NULL;
-+    }
-+    attr->bitmap_size =
-+        ROUND_UP(int128_get64(mr->size), block_size) / block_size;
-+    attr->bitmap = bitmap_new(attr->bitmap_size);
-+
-+    return attr;
-+}
-+
-+void ram_block_attributes_destroy(RamBlockAttributes *attr)
-+{
-+    g_assert(attr);
-+
-+    g_free(attr->bitmap);
-+    memory_region_set_ram_discard_manager(attr->ram_block->mr, NULL);
-+    object_unref(OBJECT(attr));
-+}
-+
-+static void ram_block_attributes_init(Object *obj)
-+{
-+    RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(obj);
-+
-+    QLIST_INIT(&attr->rdl_list);
-+}
-+
-+static void ram_block_attributes_finalize(Object *obj)
-+{
-+}
-+
-+static void ram_block_attributes_class_init(ObjectClass *klass,
-+                                            void *data)
-+{
-+    RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_CLASS(klass);
-+
-+    rdmc->get_min_granularity = ram_block_attributes_rdm_get_min_granularity;
-+    rdmc->register_listener = ram_block_attributes_rdm_register_listener;
-+    rdmc->unregister_listener = ram_block_attributes_rdm_unregister_listener;
-+    rdmc->is_populated = ram_block_attributes_rdm_is_populated;
-+    rdmc->replay_populated = ram_block_attributes_rdm_replay_populated;
-+    rdmc->replay_discarded = ram_block_attributes_rdm_replay_discarded;
-+}
-diff --git a/system/trace-events b/system/trace-events
-index 2ed1d59b1f..9fd7217472 100644
---- a/system/trace-events
-+++ b/system/trace-events
-@@ -44,3 +44,6 @@ dirtylimit_state_finalize(void)
- dirtylimit_throttle_pct(int cpu_index, uint64_t pct, int64_t time_us) "CPU[%d] throttle percent: %" PRIu64 ", throttle adjust time %"PRIi64 " us"
- dirtylimit_set_vcpu(int cpu_index, uint64_t quota) "CPU[%d] set dirty page rate limit %"PRIu64
- dirtylimit_vcpu_execute(int cpu_index, int64_t sleep_time_us) "CPU[%d] sleep %"PRIi64 " us"
-+
-+# ram-block-attributes.c
-+ram_block_attributes_state_change(uint64_t offset, uint64_t size, const char *from, const char *to) "offset 0x%"PRIx64" size 0x%"PRIx64" from '%s' to '%s'"
--- 
-2.50.1
-
diff --git a/kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch b/kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch
deleted file mode 100644
index e071b64..0000000
--- a/kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch
+++ /dev/null
@@ -1,273 +0,0 @@
-From 181b9ca805f3ae09c24a925eea0460525f30c90e Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Mon, 11 Aug 2025 15:40:10 +0200
-Subject: [PATCH] rbd: Fix .bdrv_get_specific_info implementation
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 400: rbd: Fix .bdrv_get_specific_info implementation
-RH-Jira: RHEL-108726
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/1] 5a488d6e2355adcec7fc4fd686c6be001808a146 (kmwolf/centos-qemu-kvm)
-
-qemu_rbd_get_specific_info() has at least two problems:
-
-The first is that it issues a blocking rbd_read() call in order to probe
-the encryption format for the image while querying the node. This means
-that if the connection to the server goes down, not only I/O is stuck
-(which is unavoidable), but query-names-block-nodes will actually make
-the whole QEMU instance unresponsive. .bdrv_get_specific_info
-implementations shouldn't perform blocking operations, but only return
-what is already known.
-
-The second is that the information returned isn't even correct. If the
-image is already opened with encryption enabled at the RBD level, we'll
-probe for "double encryption", i.e. if the encrypted data contains
-another encryption header. If it doesn't (which is the normal case), we
-won't return the encryption format. If it does, we return misleading
-information because it looks like we're talking about the outer level
-(the encryption format of the image itself) while the information is
-about an encryption header in the guest data.
-
-Fix this by storing the encryption format in BDRVRBDState when the image
-is opened (and we do blocking operations anyway) and returning only the
-stored information in qemu_rbd_get_specific_info().
-
-The information we'll store is either the actual encryption format that
-we enabled on the RBD level, or if the image is unencrypted, the result
-of the same probing as we previously did when querying the node. Probing
-image formats based on content that can be modified by the guest has
-long been known as problematic, but as long as we only output it to the
-user instead of making decisions based on it, it should be okay. It is
-undoubtedly useful in the context of 'qemu-img info' when you're trying
-to figure out which encryption options you have to use to open the
-image successfully.
-
-Fixes: 42e4ac9ef5a6 ("block/rbd: Add support for rbd image encryption")
-Buglink: https://issues.redhat.com/browse/RHEL-105440
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20250811134010.81787-1-kwolf@redhat.com>
-Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 4af976ef398e4e823addc00bf1c58787ba4952fe)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/rbd.c          | 104 ++++++++++++++++++++++++++++---------------
- qapi/block-core.json |   9 +++-
- 2 files changed, 76 insertions(+), 37 deletions(-)
-
-diff --git a/block/rbd.c b/block/rbd.c
-index 627f8eb05a..d5546da71b 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -99,6 +99,14 @@ typedef struct BDRVRBDState {
-     char *namespace;
-     uint64_t image_size;
-     uint64_t object_size;
-+
-+    /*
-+     * If @bs->encrypted is true, this is the encryption format actually loaded
-+     * at the librbd level. If it is false, it is the result of probing.
-+     * RBD_IMAGE_ENCRYPTION_FORMAT__MAX means that encryption is not enabled and
-+     * probing didn't find any known encryption header either.
-+     */
-+    RbdImageEncryptionFormat encryption_format;
- } BDRVRBDState;
- 
- typedef struct RBDTask {
-@@ -471,10 +479,12 @@ static int qemu_rbd_encryption_format(rbd_image_t image,
-     return 0;
- }
- 
--static int qemu_rbd_encryption_load(rbd_image_t image,
-+static int qemu_rbd_encryption_load(BlockDriverState *bs,
-+                                    rbd_image_t image,
-                                     RbdEncryptionOptions *encrypt,
-                                     Error **errp)
- {
-+    BDRVRBDState *s = bs->opaque;
-     int r = 0;
-     g_autofree char *passphrase = NULL;
-     rbd_encryption_luks1_format_options_t luks_opts;
-@@ -545,15 +555,19 @@ static int qemu_rbd_encryption_load(rbd_image_t image,
-         error_setg_errno(errp, -r, "encryption load fail");
-         return r;
-     }
-+    bs->encrypted = true;
-+    s->encryption_format = encrypt->format;
- 
-     return 0;
- }
- 
- #ifdef LIBRBD_SUPPORTS_ENCRYPTION_LOAD2
--static int qemu_rbd_encryption_load2(rbd_image_t image,
-+static int qemu_rbd_encryption_load2(BlockDriverState *bs,
-+                                     rbd_image_t image,
-                                      RbdEncryptionOptions *encrypt,
-                                      Error **errp)
- {
-+    BDRVRBDState *s = bs->opaque;
-     int r = 0;
-     int encrypt_count = 1;
-     int i;
-@@ -639,6 +653,8 @@ static int qemu_rbd_encryption_load2(rbd_image_t image,
-         error_setg_errno(errp, -r, "layered encryption load fail");
-         goto exit;
-     }
-+    bs->encrypted = true;
-+    s->encryption_format = encrypt->format;
- 
- exit:
-     for (i = 0; i < encrypt_count; ++i) {
-@@ -672,6 +688,45 @@ exit:
- #endif
- #endif
- 
-+/*
-+ * For an image without encryption enabled on the rbd layer, probe the start of
-+ * the image if it could be opened as an encrypted image so that we can display
-+ * it when the user queries the node (most importantly in qemu-img).
-+ *
-+ * If the guest writes an encryption header to its disk after this probing, this
-+ * won't be reflected when queried, but that's okay. There is no reason why the
-+ * user should want to apply encryption at the rbd level while the image is
-+ * still in use. This is just guest data.
-+ */
-+static void qemu_rbd_encryption_probe(BlockDriverState *bs)
-+{
-+    BDRVRBDState *s = bs->opaque;
-+    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
-+    int r;
-+
-+    assert(s->encryption_format == RBD_IMAGE_ENCRYPTION_FORMAT__MAX);
-+
-+    r = rbd_read(s->image, 0,
-+                 RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
-+    if (r < RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
-+        return;
-+    }
-+
-+    if (memcmp(buf, rbd_luks_header_verification,
-+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
-+    } else if (memcmp(buf, rbd_luks2_header_verification,
-+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
-+    } else if (memcmp(buf, rbd_layered_luks_header_verification,
-+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
-+    } else if (memcmp(buf, rbd_layered_luks2_header_verification,
-+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
-+        s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
-+    }
-+}
-+
- /* FIXME Deprecate and remove keypairs or make it available in QMP. */
- static int qemu_rbd_do_create(BlockdevCreateOptions *options,
-                               const char *keypairs, const char *password_secret,
-@@ -1134,17 +1189,18 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
-         goto failed_open;
-     }
- 
-+    s->encryption_format = RBD_IMAGE_ENCRYPTION_FORMAT__MAX;
-     if (opts->encrypt) {
- #ifdef LIBRBD_SUPPORTS_ENCRYPTION
-         if (opts->encrypt->parent) {
- #ifdef LIBRBD_SUPPORTS_ENCRYPTION_LOAD2
--            r = qemu_rbd_encryption_load2(s->image, opts->encrypt, errp);
-+            r = qemu_rbd_encryption_load2(bs, s->image, opts->encrypt, errp);
- #else
-             r = -ENOTSUP;
-             error_setg(errp, "RBD library does not support layered encryption");
- #endif
-         } else {
--            r = qemu_rbd_encryption_load(s->image, opts->encrypt, errp);
-+            r = qemu_rbd_encryption_load(bs, s->image, opts->encrypt, errp);
-         }
-         if (r < 0) {
-             goto failed_post_open;
-@@ -1154,6 +1210,8 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
-         error_setg(errp, "RBD library does not support image encryption");
-         goto failed_post_open;
- #endif
-+    } else {
-+        qemu_rbd_encryption_probe(bs);
-     }
- 
-     r = rbd_stat(s->image, &info, sizeof(info));
-@@ -1413,17 +1471,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
- {
-     BDRVRBDState *s = bs->opaque;
-     ImageInfoSpecific *spec_info;
--    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
--    int r;
--
--    if (s->image_size >= RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
--        r = rbd_read(s->image, 0,
--                     RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
--        if (r < 0) {
--            error_setg_errno(errp, -r, "cannot read image start for probe");
--            return NULL;
--        }
--    }
- 
-     spec_info = g_new(ImageInfoSpecific, 1);
-     *spec_info = (ImageInfoSpecific){
-@@ -1431,28 +1478,13 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
-         .u.rbd.data = g_new0(ImageInfoSpecificRbd, 1),
-     };
- 
--    if (memcmp(buf, rbd_luks_header_verification,
--               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
--        spec_info->u.rbd.data->encryption_format =
--                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
--        spec_info->u.rbd.data->has_encryption_format = true;
--    } else if (memcmp(buf, rbd_luks2_header_verification,
--               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
--        spec_info->u.rbd.data->encryption_format =
--                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
--        spec_info->u.rbd.data->has_encryption_format = true;
--    } else if (memcmp(buf, rbd_layered_luks_header_verification,
--               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
--        spec_info->u.rbd.data->encryption_format =
--                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
--        spec_info->u.rbd.data->has_encryption_format = true;
--    } else if (memcmp(buf, rbd_layered_luks2_header_verification,
--               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
--        spec_info->u.rbd.data->encryption_format =
--                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
--        spec_info->u.rbd.data->has_encryption_format = true;
-+    if (s->encryption_format == RBD_IMAGE_ENCRYPTION_FORMAT__MAX) {
-+        assert(!bs->encrypted);
-     } else {
--        spec_info->u.rbd.data->has_encryption_format = false;
-+        ImageInfoSpecificRbd *rbd_info = spec_info->u.rbd.data;
-+
-+        rbd_info->has_encryption_format = true;
-+        rbd_info->encryption_format = s->encryption_format;
-     }
- 
-     return spec_info;
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 3969c60b93..15b91e2d4a 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -158,7 +158,14 @@
- ##
- # @ImageInfoSpecificRbd:
- #
--# @encryption-format: Image encryption format
-+# @encryption-format: Image encryption format. If encryption is enabled for the
-+#     image (see encrypted in BlockNodeInfo), this is the actual format in which the
-+#     image is accessed. If encryption is not enabled, this is the result of
-+#     probing when the image was opened, to give a suggestion which encryption
-+#     format could be enabled. Note that probing results can be changed by the
-+#     guest by writing a (possibly partial) encryption format header to the
-+#     image, so don't treat this information as trusted if the guest is not
-+#     trusted.
- #
- # Since: 6.1
- ##
--- 
-2.50.1
-
diff --git a/kvm-redhat-Enable-virtio-mem-on-s390x.patch b/kvm-redhat-Enable-virtio-mem-on-s390x.patch
deleted file mode 100644
index ca56520..0000000
--- a/kvm-redhat-Enable-virtio-mem-on-s390x.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7300a435547b7e999227648fd1451db00e9c4867 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 24 Mar 2025 18:09:26 +0100
-Subject: [PATCH 26/26] redhat: Enable virtio-mem on s390x
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [26/26] 076b44c8f0262e903c5e17eda676614aec6f5c98 (thuth/qemu-kvm-cs)
-
-JIRA: https://issues.redhat.com/browse/RHEL-72977
-
-Enable virtio-mem on s390x now, too.
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- configs/devices/s390x-softmmu/s390x-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-index 24cf6dbd03..834281d872 100644
---- a/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-+++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -12,6 +12,7 @@ CONFIG_VFIO_CCW=y
- CONFIG_VFIO_PCI=y
- CONFIG_VHOST_USER=y
- CONFIG_VIRTIO_CCW=y
-+CONFIG_VIRTIO_MEM=y
- CONFIG_WDT_DIAG288=y
- CONFIG_VHOST_VSOCK=y
- CONFIG_VHOST_USER_VSOCK=y
--- 
-2.48.1
-
diff --git a/kvm-redhat-enable-CONFIG_TDX.patch b/kvm-redhat-enable-CONFIG_TDX.patch
deleted file mode 100644
index 441d61b..0000000
--- a/kvm-redhat-enable-CONFIG_TDX.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 2e9c06611ccabf1a31dfe666814395ce48adae2e Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 109/115] redhat: enable CONFIG_TDX
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [109/115] 66eac186ba4c28ffd4b8612053feab81ad7ac608 (bonzini/rhel-qemu-kvm)
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-index 2b15fdc2db..6379077253 100644
---- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -73,6 +73,7 @@ CONFIG_SERIAL_PCI=y
- CONFIG_SEV=y
- CONFIG_SMBIOS=y
- CONFIG_SMBUS_EEPROM=y
-+CONFIG_TDX=y
- CONFIG_TEST_DEVICES=y
- CONFIG_USB=y
- CONFIG_USB_EHCI=y
--- 
-2.50.1
-
diff --git a/kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch b/kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch
deleted file mode 100644
index 5c057f6..0000000
--- a/kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 9eae8d0c65d59aacbbd65f522c9d829f5f658c59 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:21:11 +0200
-Subject: [PATCH 021/115] redhat: target/i386: add CPUID and MSR bits from
- Clearwater Forest
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [21/115] 9f8fe79556c5a52cec955596a3ec8691c05fd65d (bonzini/rhel-qemu-kvm)
-
-They are used by TDX.  But do not add the model yet.
-
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20250121020650.1899618-4-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(extracted from commit 56e84d898f17606b5d88778726466540af96b234)
----
- target/i386/cpu.h | 33 +++++++++++++++++++++++++++------
- 1 file changed, 27 insertions(+), 6 deletions(-)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index cc42a2c520..ee1a1b6622 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -951,6 +951,12 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- /* Speculative Store Bypass Disable */
- #define CPUID_7_0_EDX_SPEC_CTRL_SSBD    (1U << 31)
- 
-+/* SHA512 Instruction */
-+#define CPUID_7_1_EAX_SHA512            (1U << 0)
-+/* SM3 Instruction */
-+#define CPUID_7_1_EAX_SM3               (1U << 1)
-+/* SM4 Instruction */
-+#define CPUID_7_1_EAX_SM4               (1U << 2)
- /* AVX VNNI Instruction */
- #define CPUID_7_1_EAX_AVX_VNNI          (1U << 4)
- /* AVX512 BFloat16 Instruction */
-@@ -963,6 +969,12 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_1_EAX_FSRS              (1U << 11)
- /* Fast Short REP CMPS/SCAS */
- #define CPUID_7_1_EAX_FSRC              (1U << 12)
-+/* Flexible return and event delivery (FRED) */
-+#define CPUID_7_1_EAX_FRED              (1U << 17)
-+/* Load into IA32_KERNEL_GS_BASE (LKGS) */
-+#define CPUID_7_1_EAX_LKGS              (1U << 18)
-+/* Non-Serializing Write to Model Specific Register (WRMSRNS) */
-+#define CPUID_7_1_EAX_WRMSRNS           (1U << 19)
- /* Support Tile Computational Operations on FP16 Numbers */
- #define CPUID_7_1_EAX_AMX_FP16          (1U << 21)
- /* Support for VPMADD52[H,L]UQ */
-@@ -976,17 +988,23 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_1_EDX_AVX_NE_CONVERT    (1U << 5)
- /* AMX COMPLEX Instructions */
- #define CPUID_7_1_EDX_AMX_COMPLEX       (1U << 8)
-+/* AVX-VNNI-INT16 Instructions */
-+#define CPUID_7_1_EDX_AVX_VNNI_INT16    (1U << 10)
- /* PREFETCHIT0/1 Instructions */
- #define CPUID_7_1_EDX_PREFETCHITI       (1U << 14)
- /* Support for Advanced Vector Extensions 10 */
- #define CPUID_7_1_EDX_AVX10             (1U << 19)
--/* Flexible return and event delivery (FRED) */
--#define CPUID_7_1_EAX_FRED              (1U << 17)
--/* Load into IA32_KERNEL_GS_BASE (LKGS) */
--#define CPUID_7_1_EAX_LKGS              (1U << 18)
--/* Non-Serializing Write to Model Specific Register (WRMSRNS) */
--#define CPUID_7_1_EAX_WRMSRNS           (1U << 19)
- 
-+/* Indicate bit 7 of the IA32_SPEC_CTRL MSR is supported */
-+#define CPUID_7_2_EDX_PSFD              (1U << 0)
-+/* Indicate bits 3 and 4 of the IA32_SPEC_CTRL MSR are supported */
-+#define CPUID_7_2_EDX_IPRED_CTRL        (1U << 1)
-+/* Indicate bits 5 and 6 of the IA32_SPEC_CTRL MSR are supported */
-+#define CPUID_7_2_EDX_RRSBA_CTRL        (1U << 2)
-+/* Indicate bit 8 of the IA32_SPEC_CTRL MSR is supported */
-+#define CPUID_7_2_EDX_DDPD_U            (1U << 3)
-+/* Indicate bit 10 of the IA32_SPEC_CTRL MSR is supported */
-+#define CPUID_7_2_EDX_BHI_CTRL          (1U << 4)
- /* Do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior */
- #define CPUID_7_2_EDX_MCDT_NO           (1U << 5)
- 
-@@ -1118,7 +1136,10 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define MSR_ARCH_CAP_FBSDP_NO           (1U << 14)
- #define MSR_ARCH_CAP_PSDP_NO            (1U << 15)
- #define MSR_ARCH_CAP_FB_CLEAR           (1U << 17)
-+#define MSR_ARCH_CAP_BHI_NO             (1U << 20)
- #define MSR_ARCH_CAP_PBRSB_NO           (1U << 24)
-+#define MSR_ARCH_CAP_GDS_NO             (1U << 26)
-+#define MSR_ARCH_CAP_RFDS_NO            (1U << 27)
- 
- #define MSR_CORE_CAP_SPLIT_LOCK_DETECT  (1U << 5)
- 
--- 
-2.50.1
-
diff --git a/kvm-reset-Add-RESET_TYPE_WAKEUP.patch b/kvm-reset-Add-RESET_TYPE_WAKEUP.patch
deleted file mode 100644
index bcdc6ac..0000000
--- a/kvm-reset-Add-RESET_TYPE_WAKEUP.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 2de79d978c2cd29ad686dd91e74a86dbf2121f1f Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 4 Sep 2024 12:37:13 +0200
-Subject: [PATCH 06/26] reset: Add RESET_TYPE_WAKEUP
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [6/26] 6169fe25bfa5715340c180ee8711d0ad61832106 (thuth/qemu-kvm-cs)
-
-Some devices need to distinguish cold start reset from waking up from a
-suspended state. This patch adds new value to the enum, and updates the
-i386 wakeup method to use this new reset type.
-
-Message-ID: <20240904103722.946194-3-jmarcin@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 759cbb4ee971da13ddfa8ad73befc2351d542044)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- docs/devel/reset.rst    | 12 +++++++++++-
- hw/i386/pc.c            |  2 +-
- include/hw/resettable.h |  2 ++
- 3 files changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
-index d2799eba7a..44bd51b42e 100644
---- a/docs/devel/reset.rst
-+++ b/docs/devel/reset.rst
-@@ -44,6 +44,17 @@ The Resettable interface handles reset types with an enum ``ResetType``:
-   value on each cold reset, such as RNG seed information, and which they
-   must not reinitialize on a snapshot-load reset.
- 
-+``RESET_TYPE_WAKEUP``
-+  If the machine supports waking up from a suspended state and needs to reset
-+  its devices during wake-up (from the ``MachineClass::wakeup()`` method), this
-+  reset type should be used for such a request. Devices can utilize this reset
-+  type to differentiate the reset requested during machine wake-up from other
-+  reset requests. For example, RAM content must not be lost during wake-up, and
-+  memory devices like virtio-mem that provide additional RAM must not reset
-+  such state during wake-ups, but might do so during cold resets. However, this
-+  reset type should not be used for wake-up detection, as not every machine
-+  type issues a device reset request during wake-up.
-+
- ``RESET_TYPE_S390_CPU_NORMAL``
-   This is only used for S390 CPU objects; it clears interrupts, stops
-   processing, and clears the TLB, but does not touch register contents.
-@@ -53,7 +64,6 @@ The Resettable interface handles reset types with an enum ``ResetType``:
-   ``RESET_TYPE_S390_CPU_NORMAL`` does and also clears the PSW, prefix,
-   FPC, timer and control registers. It does not touch gprs, fprs or acrs.
- 
--
- Devices which implement reset methods must treat any unknown ``ResetType``
- as equivalent to ``RESET_TYPE_COLD``; this will reduce the amount of
- existing code we need to change if we add more types in future.
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index fedcf2a65f..fa9f16cbaf 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -1889,7 +1889,7 @@ static void pc_machine_reset(MachineState *machine, ResetType type)
- static void pc_machine_wakeup(MachineState *machine)
- {
-     cpu_synchronize_all_states();
--    pc_machine_reset(machine, RESET_TYPE_COLD);
-+    pc_machine_reset(machine, RESET_TYPE_WAKEUP);
-     cpu_synchronize_all_post_reset();
- }
- 
-diff --git a/include/hw/resettable.h b/include/hw/resettable.h
-index 83b561fc83..cf37cd5ead 100644
---- a/include/hw/resettable.h
-+++ b/include/hw/resettable.h
-@@ -29,6 +29,7 @@ typedef struct ResettableState ResettableState;
-  * Types of reset.
-  *
-  * + Cold: reset resulting from a power cycle of the object.
-+ * + Wakeup: reset resulting from a wake-up from a suspended state.
-  *
-  * TODO: Support has to be added to handle more types. In particular,
-  * ResettableState structure needs to be expanded.
-@@ -36,6 +37,7 @@ typedef struct ResettableState ResettableState;
- typedef enum ResetType {
-     RESET_TYPE_COLD,
-     RESET_TYPE_SNAPSHOT_LOAD,
-+    RESET_TYPE_WAKEUP,
-     RESET_TYPE_S390_CPU_INITIAL,
-     RESET_TYPE_S390_CPU_NORMAL,
- } ResetType;
--- 
-2.48.1
-
diff --git a/kvm-reset-Use-ResetType-for-qemu_devices_reset-and-Machi.patch b/kvm-reset-Use-ResetType-for-qemu_devices_reset-and-Machi.patch
deleted file mode 100644
index 2b0b933..0000000
--- a/kvm-reset-Use-ResetType-for-qemu_devices_reset-and-Machi.patch
+++ /dev/null
@@ -1,360 +0,0 @@
-From 8d48193b5a661f31c1c1db068d241b31ae379339 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 4 Sep 2024 12:37:12 +0200
-Subject: [PATCH 05/26] reset: Use ResetType for qemu_devices_reset() and
- MachineClass::reset()
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [5/26] ea1324b27885d979bcc54cc355dbdf940686776c (thuth/qemu-kvm-cs)
-
-Currently, both qemu_devices_reset() and MachineClass::reset() use
-ShutdownCause for the reason of the reset. However, the Resettable
-interface uses ResetState, so ShutdownCause needs to be translated to
-ResetType somewhere. Translating it qemu_devices_reset() makes adding
-new reset types harder, as they cannot always be matched to a single
-ShutdownCause here, and devices may need to check the ResetType to
-determine what to reset and if to reset at all.
-
-This patch moves this translation up in the call stack to
-qemu_system_reset() and updates all MachineClass children to use the
-ResetType instead.
-
-Message-ID: <20240904103722.946194-2-jmarcin@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 1b063fe2df002052cc2d10799764979b8c583480)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/arm/aspeed.c            |  4 ++--
- hw/arm/mps2-tz.c           |  4 ++--
- hw/core/reset.c            |  5 +----
- hw/hppa/machine.c          |  4 ++--
- hw/i386/microvm.c          |  4 ++--
- hw/i386/pc.c               |  6 +++---
- hw/ppc/pegasos2.c          |  4 ++--
- hw/ppc/pnv.c               |  4 ++--
- hw/ppc/spapr.c             |  6 +++---
- hw/s390x/s390-virtio-ccw.c |  4 ++--
- include/hw/boards.h        |  3 ++-
- include/sysemu/reset.h     |  5 +++--
- system/runstate.c          | 13 +++++++++++--
- 13 files changed, 37 insertions(+), 29 deletions(-)
-
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index fd5603f7aa..cbca7685da 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -1529,12 +1529,12 @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
-     aspeed_machine_class_init_cpus_defaults(mc);
- }
- 
--static void fby35_reset(MachineState *state, ShutdownCause reason)
-+static void fby35_reset(MachineState *state, ResetType type)
- {
-     AspeedMachineState *bmc = ASPEED_MACHINE(state);
-     AspeedGPIOState *gpio = &bmc->soc->gpio;
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     /* Board ID: 7 (Class-1, 4 slots) */
-     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
-index aec57c0d68..8edf57a66d 100644
---- a/hw/arm/mps2-tz.c
-+++ b/hw/arm/mps2-tz.c
-@@ -1254,7 +1254,7 @@ static void mps2_set_remap(Object *obj, const char *value, Error **errp)
-     }
- }
- 
--static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void mps2_machine_reset(MachineState *machine, ResetType type)
- {
-     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
- 
-@@ -1264,7 +1264,7 @@ static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
-      * reset see the correct mapping.
-      */
-     remap_memory(mms, mms->remap);
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- }
- 
- static void mps2tz_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/core/reset.c b/hw/core/reset.c
-index 58dfc8db3d..14a2639fbf 100644
---- a/hw/core/reset.c
-+++ b/hw/core/reset.c
-@@ -170,11 +170,8 @@ void qemu_unregister_resettable(Object *obj)
-     resettable_container_remove(get_root_reset_container(), obj);
- }
- 
--void qemu_devices_reset(ShutdownCause reason)
-+void qemu_devices_reset(ResetType type)
- {
--    ResetType type = (reason == SHUTDOWN_CAUSE_SNAPSHOT_LOAD) ?
--        RESET_TYPE_SNAPSHOT_LOAD : RESET_TYPE_COLD;
--
-     /* Reset the simulation */
-     resettable_reset(OBJECT(get_root_reset_container()), type);
- }
-diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
-index 5d0a8739de..8259fe2e38 100644
---- a/hw/hppa/machine.c
-+++ b/hw/hppa/machine.c
-@@ -642,12 +642,12 @@ static void machine_HP_C3700_init(MachineState *machine)
-     machine_HP_common_init_tail(machine, pci_bus, translate);
- }
- 
--static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
-+static void hppa_machine_reset(MachineState *ms, ResetType type)
- {
-     unsigned int smp_cpus = ms->smp.cpus;
-     int i;
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     /* Start all CPUs at the firmware entry point.
-      *  Monarch CPU will initialize firmware, secondary CPUs
-diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
-index 40edcee7af..8ae4dff7f2 100644
---- a/hw/i386/microvm.c
-+++ b/hw/i386/microvm.c
-@@ -462,7 +462,7 @@ static void microvm_machine_state_init(MachineState *machine)
-     microvm_devices_init(mms);
- }
- 
--static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void microvm_machine_reset(MachineState *machine, ResetType type)
- {
-     MicrovmMachineState *mms = MICROVM_MACHINE(machine);
-     CPUState *cs;
-@@ -475,7 +475,7 @@ static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
-         mms->kernel_cmdline_fixed = true;
-     }
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     CPU_FOREACH(cs) {
-         cpu = X86_CPU(cs);
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index fa0e42d072..fedcf2a65f 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -1869,12 +1869,12 @@ static void pc_machine_initfn(Object *obj)
-     qemu_add_machine_init_done_notifier(&pcms->machine_done);
- }
- 
--static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void pc_machine_reset(MachineState *machine, ResetType type)
- {
-     CPUState *cs;
-     X86CPU *cpu;
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     /* Reset APIC after devices have been reset to cancel
-      * any changes that qemu_devices_reset() might have done.
-@@ -1889,7 +1889,7 @@ static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
- static void pc_machine_wakeup(MachineState *machine)
- {
-     cpu_synchronize_all_states();
--    pc_machine_reset(machine, SHUTDOWN_CAUSE_NONE);
-+    pc_machine_reset(machine, RESET_TYPE_COLD);
-     cpu_synchronize_all_post_reset();
- }
- 
-diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
-index 9b0a6b70ab..8ff4a00c34 100644
---- a/hw/ppc/pegasos2.c
-+++ b/hw/ppc/pegasos2.c
-@@ -291,14 +291,14 @@ static void pegasos2_superio_write(uint8_t addr, uint8_t val)
-     cpu_physical_memory_write(PCI1_IO_BASE + 0x3f1, &val, 1);
- }
- 
--static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void pegasos2_machine_reset(MachineState *machine, ResetType type)
- {
-     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
-     void *fdt;
-     uint64_t d[2];
-     int sz;
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
-     if (!pm->vof) {
-         return; /* Firmware should set up machine so nothing to do */
-     }
-diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
-index 3526852685..988fd55d88 100644
---- a/hw/ppc/pnv.c
-+++ b/hw/ppc/pnv.c
-@@ -709,13 +709,13 @@ static void pnv_powerdown_notify(Notifier *n, void *opaque)
-     }
- }
- 
--static void pnv_reset(MachineState *machine, ShutdownCause reason)
-+static void pnv_reset(MachineState *machine, ResetType type)
- {
-     PnvMachineState *pnv = PNV_MACHINE(machine);
-     IPMIBmc *bmc;
-     void *fdt;
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     /*
-      * The machine should provide by default an internal BMC simulator.
-diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 29e66f1b3f..11c953669a 100644
---- a/hw/ppc/spapr.c
-+++ b/hw/ppc/spapr.c
-@@ -1725,7 +1725,7 @@ void spapr_check_mmu_mode(bool guest_radix)
-     }
- }
- 
--static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void spapr_machine_reset(MachineState *machine, ResetType type)
- {
-     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
-     PowerPCCPU *first_ppc_cpu;
-@@ -1733,7 +1733,7 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
-     void *fdt;
-     int rc;
- 
--    if (reason != SHUTDOWN_CAUSE_SNAPSHOT_LOAD) {
-+    if (type != RESET_TYPE_SNAPSHOT_LOAD) {
-         /*
-          * Record-replay snapshot load must not consume random, this was
-          * already replayed from initial machine reset.
-@@ -1769,7 +1769,7 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
-         spapr_setup_hpt(spapr);
-     }
- 
--    qemu_devices_reset(reason);
-+    qemu_devices_reset(type);
- 
-     spapr_ovec_cleanup(spapr->ov5_cas);
-     spapr->ov5_cas = spapr_ovec_new();
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index ef2a9687c7..94cad1705b 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -434,7 +434,7 @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
-     s390_pv_prep_reset();
- }
- 
--static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
-+static void s390_machine_reset(MachineState *machine, ResetType type)
- {
-     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
-     enum s390_reset reset_type;
-@@ -466,7 +466,7 @@ static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
-          * Device reset includes CPU clear resets so this has to be
-          * done AFTER the unprotect call above.
-          */
--        qemu_devices_reset(reason);
-+        qemu_devices_reset(type);
-         s390_crypto_reset();
- 
-         /* configure and start the ipl CPU only */
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index ffefc0a625..fe011b1e86 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -10,6 +10,7 @@
- #include "qemu/module.h"
- #include "qom/object.h"
- #include "hw/core/cpu.h"
-+#include "hw/resettable.h"
- 
- #define TYPE_MACHINE_SUFFIX "-machine"
- 
-@@ -253,7 +254,7 @@ struct MachineClass {
-     const char *deprecation_reason;
- 
-     void (*init)(MachineState *state);
--    void (*reset)(MachineState *state, ShutdownCause reason);
-+    void (*reset)(MachineState *state, ResetType type);
-     void (*wakeup)(MachineState *state);
-     int (*kvm_type)(MachineState *machine, const char *arg);
- 
-diff --git a/include/sysemu/reset.h b/include/sysemu/reset.h
-index ae436044a9..0e297c0e02 100644
---- a/include/sysemu/reset.h
-+++ b/include/sysemu/reset.h
-@@ -27,6 +27,7 @@
- #ifndef QEMU_SYSEMU_RESET_H
- #define QEMU_SYSEMU_RESET_H
- 
-+#include "hw/resettable.h"
- #include "qapi/qapi-events-run-state.h"
- 
- typedef void QEMUResetHandler(void *opaque);
-@@ -110,7 +111,7 @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
- 
- /**
-  * qemu_devices_reset: Perform a complete system reset
-- * @reason: reason for the reset
-+ * @reason: type of the reset
-  *
-  * This function performs the low-level work needed to do a complete reset
-  * of the system (calling all the callbacks registered with
-@@ -121,6 +122,6 @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
-  * If you want to trigger a system reset from, for instance, a device
-  * model, don't use this function. Use qemu_system_reset_request().
-  */
--void qemu_devices_reset(ShutdownCause reason);
-+void qemu_devices_reset(ResetType type);
- 
- #endif
-diff --git a/system/runstate.c b/system/runstate.c
-index a0e2a5fd22..c2c9afa905 100644
---- a/system/runstate.c
-+++ b/system/runstate.c
-@@ -32,6 +32,7 @@
- #include "exec/cpu-common.h"
- #include "gdbstub/syscalls.h"
- #include "hw/boards.h"
-+#include "hw/resettable.h"
- #include "migration/misc.h"
- #include "migration/postcopy-ram.h"
- #include "monitor/monitor.h"
-@@ -507,15 +508,23 @@ static int qemu_debug_requested(void)
- void qemu_system_reset(ShutdownCause reason)
- {
-     MachineClass *mc;
-+    ResetType type;
- 
-     mc = current_machine ? MACHINE_GET_CLASS(current_machine) : NULL;
- 
-     cpu_synchronize_all_states();
- 
-+    switch (reason) {
-+    case SHUTDOWN_CAUSE_SNAPSHOT_LOAD:
-+        type = RESET_TYPE_SNAPSHOT_LOAD;
-+        break;
-+    default:
-+        type = RESET_TYPE_COLD;
-+    }
-     if (mc && mc->reset) {
--        mc->reset(current_machine, reason);
-+        mc->reset(current_machine, type);
-     } else {
--        qemu_devices_reset(reason);
-+        qemu_devices_reset(type);
-     }
-     switch (reason) {
-     case SHUTDOWN_CAUSE_NONE:
--- 
-2.48.1
-
diff --git a/kvm-rocker-do-not-pollute-the-namespace.patch b/kvm-rocker-do-not-pollute-the-namespace.patch
deleted file mode 100644
index cdaa569..0000000
--- a/kvm-rocker-do-not-pollute-the-namespace.patch
+++ /dev/null
@@ -1,241 +0,0 @@
-From b3366713a19f6a661c724ba3e10cf5a4226dc763 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 025/115] rocker: do not pollute the namespace
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [25/115] fc62404804eee1d9d745359f98b4d7528d1c281b (bonzini/rhel-qemu-kvm)
-
-Do not leave the __le* macros defined, in fact do not use them at all.  Fixes a
-build failure on Alpine with the TDX patches:
-
-In file included from ../hw/net/rocker/rocker_of_dpa.c:25:
-../hw/net/rocker/rocker_hw.h:14:16: error: conflicting types for 'uint64_t'; have '__u64' {aka 'long long unsigned int'}
-   14 | #define __le64 uint64_t
-      |                ^~~~~~~~
-In file included from /usr/include/stdint.h:20,
-                 from ../include/qemu/osdep.h:111,
-                 from ../hw/net/rocker/rocker_of_dpa.c:17:
-/usr/include/bits/alltypes.h:136:25: note: previous declaration of 'uint64_t' with type 'uint64_t' {aka 'long unsigned int'}
-  136 | typedef unsigned _Int64 uint64_t;
-      |                         ^~~~~~~~
-
-because the Linux headers include a typedef of __leNN.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 5150004ccf5fe72c35b3263fbed6f4d06ed3cc6a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/net/rocker/rocker.h        | 14 +++---------
- hw/net/rocker/rocker_hw.h     | 20 +++++++-----------
- hw/net/rocker/rocker_of_dpa.c | 40 +++++++++++++++++------------------
- 3 files changed, 31 insertions(+), 43 deletions(-)
-
-diff --git a/hw/net/rocker/rocker.h b/hw/net/rocker/rocker.h
-index f85354d9d1..fa13ae2993 100644
---- a/hw/net/rocker/rocker.h
-+++ b/hw/net/rocker/rocker.h
-@@ -36,15 +36,7 @@ static inline G_GNUC_PRINTF(1, 2) int DPRINTF(const char *fmt, ...)
- }
- #endif
- 
--#define __le16 uint16_t
--#define __le32 uint32_t
--#define __le64 uint64_t
--
--#define __be16 uint16_t
--#define __be32 uint32_t
--#define __be64 uint64_t
--
--static inline bool ipv4_addr_is_multicast(__be32 addr)
-+static inline bool ipv4_addr_is_multicast(uint32_t addr)
- {
-     return (addr & htonl(0xf0000000)) == htonl(0xe0000000);
- }
-@@ -52,8 +44,8 @@ static inline bool ipv4_addr_is_multicast(__be32 addr)
- typedef struct ipv6_addr {
-     union {
-         uint8_t addr8[16];
--        __be16 addr16[8];
--        __be32 addr32[4];
-+        uint16_t addr16[8];
-+        uint32_t addr32[4];
-     };
- } Ipv6Addr;
- 
-diff --git a/hw/net/rocker/rocker_hw.h b/hw/net/rocker/rocker_hw.h
-index 1786323fa4..7ec6bfbcb9 100644
---- a/hw/net/rocker/rocker_hw.h
-+++ b/hw/net/rocker/rocker_hw.h
-@@ -9,10 +9,6 @@
- #ifndef ROCKER_HW_H
- #define ROCKER_HW_H
- 
--#define __le16 uint16_t
--#define __le32 uint32_t
--#define __le64 uint64_t
--
- /*
-  * Return codes
-  */
-@@ -124,12 +120,12 @@ enum {
-  */
- 
- typedef struct rocker_desc {
--    __le64 buf_addr;
-+    uint64_t buf_addr;
-     uint64_t cookie;
--    __le16 buf_size;
--    __le16 tlv_size;
--    __le16 rsvd[5];   /* pad to 32 bytes */
--    __le16 comp_err;
-+    uint16_t buf_size;
-+    uint16_t tlv_size;
-+    uint16_t rsvd[5];   /* pad to 32 bytes */
-+    uint16_t comp_err;
- } __attribute__((packed, aligned(8))) RockerDesc;
- 
- /*
-@@ -137,9 +133,9 @@ typedef struct rocker_desc {
-  */
- 
- typedef struct rocker_tlv {
--    __le32 type;
--    __le16 len;
--    __le16 rsvd;
-+    uint32_t type;
-+    uint16_t len;
-+    uint16_t rsvd;
- } __attribute__((packed, aligned(8))) RockerTlv;
- 
- /* cmd msg */
-diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
-index 5e16056be6..a298805c89 100644
---- a/hw/net/rocker/rocker_of_dpa.c
-+++ b/hw/net/rocker/rocker_of_dpa.c
-@@ -52,10 +52,10 @@ typedef struct of_dpa_flow_key {
-     uint32_t tunnel_id;              /* overlay tunnel id */
-     uint32_t tbl_id;                 /* table id */
-     struct {
--        __be16 vlan_id;              /* 0 if no VLAN */
-+        uint16_t vlan_id;              /* 0 if no VLAN */
-         MACAddr src;                 /* ethernet source address */
-         MACAddr dst;                 /* ethernet destination address */
--        __be16 type;                 /* ethernet frame type */
-+        uint16_t type;                 /* ethernet frame type */
-     } eth;
-     struct {
-         uint8_t proto;               /* IP protocol or ARP opcode */
-@@ -66,14 +66,14 @@ typedef struct of_dpa_flow_key {
-     union {
-         struct {
-             struct {
--                __be32 src;          /* IP source address */
--                __be32 dst;          /* IP destination address */
-+                uint32_t src;          /* IP source address */
-+                uint32_t dst;          /* IP destination address */
-             } addr;
-             union {
-                 struct {
--                    __be16 src;      /* TCP/UDP/SCTP source port */
--                    __be16 dst;      /* TCP/UDP/SCTP destination port */
--                    __be16 flags;    /* TCP flags */
-+                    uint16_t src;      /* TCP/UDP/SCTP source port */
-+                    uint16_t dst;      /* TCP/UDP/SCTP destination port */
-+                    uint16_t flags;    /* TCP flags */
-                 } tp;
-                 struct {
-                     MACAddr sha;     /* ARP source hardware address */
-@@ -86,11 +86,11 @@ typedef struct of_dpa_flow_key {
-                 Ipv6Addr src;       /* IPv6 source address */
-                 Ipv6Addr dst;       /* IPv6 destination address */
-             } addr;
--            __be32 label;            /* IPv6 flow label */
-+            uint32_t label;            /* IPv6 flow label */
-             struct {
--                __be16 src;          /* TCP/UDP/SCTP source port */
--                __be16 dst;          /* TCP/UDP/SCTP destination port */
--                __be16 flags;        /* TCP flags */
-+                uint16_t src;          /* TCP/UDP/SCTP source port */
-+                uint16_t dst;          /* TCP/UDP/SCTP destination port */
-+                uint16_t flags;        /* TCP flags */
-             } tp;
-             struct {
-                 Ipv6Addr target;    /* ND target address */
-@@ -112,13 +112,13 @@ typedef struct of_dpa_flow_action {
-     struct {
-         uint32_t group_id;
-         uint32_t tun_log_lport;
--        __be16 vlan_id;
-+        uint16_t vlan_id;
-     } write;
-     struct {
--        __be16 new_vlan_id;
-+        uint16_t new_vlan_id;
-         uint32_t out_pport;
-         uint8_t copy_to_cpu;
--        __be16 vlan_id;
-+        uint16_t vlan_id;
-     } apply;
- } OfDpaFlowAction;
- 
-@@ -143,7 +143,7 @@ typedef struct of_dpa_flow {
- typedef struct of_dpa_flow_pkt_fields {
-     uint32_t tunnel_id;
-     struct eth_header *ethhdr;
--    __be16 *h_proto;
-+    uint16_t *h_proto;
-     struct vlan_header *vlanhdr;
-     struct ip_header *ipv4hdr;
-     struct ip6_header *ipv6hdr;
-@@ -180,7 +180,7 @@ typedef struct of_dpa_group {
-             uint32_t group_id;
-             MACAddr src_mac;
-             MACAddr dst_mac;
--            __be16 vlan_id;
-+            uint16_t vlan_id;
-         } l2_rewrite;
-         struct {
-             uint16_t group_count;
-@@ -190,13 +190,13 @@ typedef struct of_dpa_group {
-             uint32_t group_id;
-             MACAddr src_mac;
-             MACAddr dst_mac;
--            __be16 vlan_id;
-+            uint16_t vlan_id;
-             uint8_t ttl_check;
-         } l3_unicast;
-     };
- } OfDpaGroup;
- 
--static int of_dpa_mask2prefix(__be32 mask)
-+static int of_dpa_mask2prefix(uint32_t mask)
- {
-     int i;
-     int count = 32;
-@@ -451,7 +451,7 @@ static void of_dpa_flow_pkt_parse(OfDpaFlowContext *fc,
-     fc->iovcnt = iovcnt + 2;
- }
- 
--static void of_dpa_flow_pkt_insert_vlan(OfDpaFlowContext *fc, __be16 vlan_id)
-+static void of_dpa_flow_pkt_insert_vlan(OfDpaFlowContext *fc, uint16_t vlan_id)
- {
-     OfDpaFlowPktFields *fields = &fc->fields;
-     uint16_t h_proto = fields->ethhdr->h_proto;
-@@ -486,7 +486,7 @@ static void of_dpa_flow_pkt_strip_vlan(OfDpaFlowContext *fc)
- 
- static void of_dpa_flow_pkt_hdr_rewrite(OfDpaFlowContext *fc,
-                                         uint8_t *src_mac, uint8_t *dst_mac,
--                                        __be16 vlan_id)
-+                                        uint16_t vlan_id)
- {
-     OfDpaFlowPktFields *fields = &fc->fields;
- 
--- 
-2.50.1
-
diff --git a/kvm-s390x-Add-individual-loadparm-assignment-to-CCW-devi.patch b/kvm-s390x-Add-individual-loadparm-assignment-to-CCW-devi.patch
deleted file mode 100644
index 3440acb..0000000
--- a/kvm-s390x-Add-individual-loadparm-assignment-to-CCW-devi.patch
+++ /dev/null
@@ -1,362 +0,0 @@
-From 20a4a01fde02a619cee994af92721592e7d91716 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:48 -0400
-Subject: [PATCH 15/27] s390x: Add individual loadparm assignment to CCW device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [15/23] c4eaab72e6246db7295593b86f097773aa4f49b7 (thuth/qemu-kvm-cs9)
-
-Add a loadparm property to the VirtioCcwDevice object so that different
-loadparms can be defined on a per-device basis for CCW boot devices.
-
-The machine/global loadparm is still supported. If both a global and per-device
-loadparm are defined, the per-device value will override the global value for
-that device, but any other devices that do not specify a per-device loadparm
-will still use the global loadparm.
-
-It is invalid to assign a loadparm to a non-boot device.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-15-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit bb185de42339025db9bbd5aa11f3f644c2a077f8)
----
- hw/s390x/ccw-device.c       | 46 +++++++++++++++++++++++++
- hw/s390x/ccw-device.h       |  2 ++
- hw/s390x/ipl.c              | 68 ++++++++++++++++++++++---------------
- hw/s390x/ipl.h              |  3 +-
- hw/s390x/s390-virtio-ccw.c  | 18 +---------
- hw/s390x/sclp.c             |  9 ++---
- include/hw/s390x/ipl/qipl.h |  1 +
- pc-bios/s390-ccw/main.c     | 10 ++++--
- 8 files changed, 102 insertions(+), 55 deletions(-)
-
-diff --git a/hw/s390x/ccw-device.c b/hw/s390x/ccw-device.c
-index a7d682e5af..4e54f34b1c 100644
---- a/hw/s390x/ccw-device.c
-+++ b/hw/s390x/ccw-device.c
-@@ -13,6 +13,10 @@
- #include "ccw-device.h"
- #include "hw/qdev-properties.h"
- #include "qemu/module.h"
-+#include "ipl.h"
-+#include "qapi/visitor.h"
-+#include "qemu/ctype.h"
-+#include "qapi/error.h"
- 
- static void ccw_device_refill_ids(CcwDevice *dev)
- {
-@@ -37,10 +41,52 @@ static bool ccw_device_realize(CcwDevice *dev, Error **errp)
-     return true;
- }
- 
-+static void ccw_device_get_loadparm(Object *obj, Visitor *v,
-+                                 const char *name, void *opaque,
-+                                 Error **errp)
-+{
-+    CcwDevice *dev = CCW_DEVICE(obj);
-+    char *str = g_strndup((char *) dev->loadparm, sizeof(dev->loadparm));
-+
-+    visit_type_str(v, name, &str, errp);
-+    g_free(str);
-+}
-+
-+static void ccw_device_set_loadparm(Object *obj, Visitor *v,
-+                                 const char *name, void *opaque,
-+                                 Error **errp)
-+{
-+    CcwDevice *dev = CCW_DEVICE(obj);
-+    char *val;
-+    int index;
-+
-+    index = object_property_get_int(obj, "bootindex", NULL);
-+
-+    if (index < 0) {
-+        error_setg(errp, "LOADPARM is only valid for boot devices!");
-+    }
-+
-+    if (!visit_type_str(v, name, &val, errp)) {
-+        return;
-+    }
-+
-+    s390_ipl_fmt_loadparm(dev->loadparm, val, errp);
-+}
-+
-+static const PropertyInfo ccw_loadparm = {
-+    .name  = "ccw_loadparm",
-+    .description = "Up to 8 chars in set of [A-Za-z0-9. ] to pass"
-+            " to the guest loader/kernel",
-+    .get = ccw_device_get_loadparm,
-+    .set = ccw_device_set_loadparm,
-+};
-+
- static Property ccw_device_properties[] = {
-     DEFINE_PROP_CSS_DEV_ID("devno", CcwDevice, devno),
-     DEFINE_PROP_CSS_DEV_ID_RO("dev_id", CcwDevice, dev_id),
-     DEFINE_PROP_CSS_DEV_ID_RO("subch_id", CcwDevice, subch_id),
-+    DEFINE_PROP("loadparm", CcwDevice, loadparm, ccw_loadparm,
-+            typeof(uint8_t[8])),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/s390x/ccw-device.h b/hw/s390x/ccw-device.h
-index 5feeb0ee7a..1e1737c0f3 100644
---- a/hw/s390x/ccw-device.h
-+++ b/hw/s390x/ccw-device.h
-@@ -26,6 +26,8 @@ struct CcwDevice {
-     CssDevId dev_id;
-     /* The actual busid of the virtual subchannel. */
-     CssDevId subch_id;
-+    /* If set, use this loadparm value when device is boot target */
-+    uint8_t loadparm[8];
- };
- typedef struct CcwDevice CcwDevice;
- 
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index 8a0a3e6961..d83832d975 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -34,6 +34,7 @@
- #include "qemu/config-file.h"
- #include "qemu/cutils.h"
- #include "qemu/option.h"
-+#include "qemu/ctype.h"
- #include "standard-headers/linux/virtio_ids.h"
- 
- #define KERN_IMAGE_START                0x010000UL
-@@ -397,12 +398,43 @@ static CcwDevice *s390_get_ccw_device(DeviceState *dev_st, int *devtype)
-     return ccw_dev;
- }
- 
-+void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp)
-+{
-+    int i;
-+
-+    /* Initialize the loadparm with spaces */
-+    memset(loadparm, ' ', LOADPARM_LEN);
-+    for (i = 0; i < LOADPARM_LEN && str[i]; i++) {
-+        uint8_t c = qemu_toupper(str[i]); /* mimic HMC */
-+
-+        if (qemu_isalnum(c) || c == '.' || c == ' ') {
-+            loadparm[i] = c;
-+        } else {
-+            error_setg(errp, "LOADPARM: invalid character '%c' (ASCII 0x%02x)",
-+                       c, c);
-+            return;
-+        }
-+    }
-+}
-+
-+void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp)
-+{
-+    int i;
-+
-+    /* Initialize the loadparm with EBCDIC spaces (0x40) */
-+    memset(ebcdic_lp, '@', LOADPARM_LEN);
-+    for (i = 0; i < LOADPARM_LEN && ascii_lp[i]; i++) {
-+        ebcdic_lp[i] = ascii2ebcdic[(uint8_t) ascii_lp[i]];
-+    }
-+}
-+
- static bool s390_gen_initial_iplb(S390IPLState *ipl)
- {
-     DeviceState *dev_st;
-     CcwDevice *ccw_dev = NULL;
-     SCSIDevice *sd;
-     int devtype;
-+    uint8_t *lp;
- 
-     dev_st = get_boot_device(0);
-     if (dev_st) {
-@@ -413,6 +445,8 @@ static bool s390_gen_initial_iplb(S390IPLState *ipl)
-      * Currently allow IPL only from CCW devices.
-      */
-     if (ccw_dev) {
-+        lp = ccw_dev->loadparm;
-+
-         switch (devtype) {
-         case CCW_DEVTYPE_SCSI:
-             sd = SCSI_DEVICE(dev_st);
-@@ -445,40 +479,20 @@ static bool s390_gen_initial_iplb(S390IPLState *ipl)
-             break;
-         }
- 
--        if (!s390_ipl_set_loadparm(ipl->iplb.loadparm)) {
--            ipl->iplb.flags |= DIAG308_FLAGS_LP_VALID;
-+        /* If the device loadparm is empty use the global machine loadparm */
-+        if (memcmp(lp, NO_LOADPARM, 8) == 0) {
-+            lp = S390_CCW_MACHINE(qdev_get_machine())->loadparm;
-         }
- 
-+        s390_ipl_convert_loadparm((char *)lp, ipl->iplb.loadparm);
-+        ipl->iplb.flags |= DIAG308_FLAGS_LP_VALID;
-+
-         return true;
-     }
- 
-     return false;
- }
- 
--int s390_ipl_set_loadparm(uint8_t *loadparm)
--{
--    MachineState *machine = MACHINE(qdev_get_machine());
--    char *lp = object_property_get_str(OBJECT(machine), "loadparm", NULL);
--
--    if (lp) {
--        int i;
--
--        /* lp is an uppercase string without leading/embedded spaces */
--        for (i = 0; i < 8 && lp[i]; i++) {
--            loadparm[i] = ascii2ebcdic[(uint8_t) lp[i]];
--        }
--
--        if (i < 8) {
--            memset(loadparm + i, 0x40, 8 - i); /* fill with EBCDIC spaces */
--        }
--
--        g_free(lp);
--        return 0;
--    }
--
--    return -1;
--}
--
- static bool is_virtio_ccw_device_of_type(IplParameterBlock *iplb,
-                                          int virtio_id)
- {
-@@ -534,7 +548,7 @@ static void update_machine_ipl_properties(IplParameterBlock *iplb)
-         ascii_loadparm[i] = 0;
-         object_property_set_str(machine, "loadparm", ascii_loadparm, &err);
-     } else {
--        object_property_set_str(machine, "loadparm", "", &err);
-+        object_property_set_str(machine, "loadparm", "        ", &err);
-     }
-     if (err) {
-         warn_report_err(err);
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index fa394c339d..b670bad551 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -21,7 +21,8 @@
- 
- #define DIAG308_FLAGS_LP_VALID 0x80
- 
--int s390_ipl_set_loadparm(uint8_t *loadparm);
-+void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp);
-+void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp);
- void s390_ipl_update_diag308(IplParameterBlock *iplb);
- int s390_ipl_prepare_pv_header(Error **errp);
- int s390_ipl_pv_unpack(void);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 5113313aa8..ef2a9687c7 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -722,28 +722,12 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
- {
-     S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
-     char *val;
--    int i;
- 
-     if (!visit_type_str(v, name, &val, errp)) {
-         return;
-     }
- 
--    for (i = 0; i < sizeof(ms->loadparm) && val[i]; i++) {
--        uint8_t c = qemu_toupper(val[i]); /* mimic HMC */
--
--        if (('A' <= c && c <= 'Z') || ('0' <= c && c <= '9') || (c == '.') ||
--            (c == ' ')) {
--            ms->loadparm[i] = c;
--        } else {
--            error_setg(errp, "LOADPARM: invalid character '%c' (ASCII 0x%02x)",
--                       c, c);
--            return;
--        }
--    }
--
--    for (; i < sizeof(ms->loadparm); i++) {
--        ms->loadparm[i] = ' '; /* pad right with spaces */
--    }
-+    s390_ipl_fmt_loadparm(ms->loadparm, val, errp);
- }
- 
- static void ccw_machine_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
-index e725dcd5fd..8757626b5c 100644
---- a/hw/s390x/sclp.c
-+++ b/hw/s390x/sclp.c
-@@ -110,7 +110,6 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
-     MachineState *machine = MACHINE(qdev_get_machine());
-     int cpu_count;
-     int rnsize, rnmax;
--    IplParameterBlock *ipib = s390_ipl_get_iplb();
-     int required_len = SCCB_REQ_LEN(ReadInfo, machine->possible_cpus->len);
-     int offset_cpu = s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB) ?
-                      offsetof(ReadInfo, entries) :
-@@ -171,12 +170,8 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
-         read_info->rnmax2 = cpu_to_be64(rnmax);
-     }
- 
--    if (ipib && ipib->flags & DIAG308_FLAGS_LP_VALID) {
--        memcpy(&read_info->loadparm, &ipib->loadparm,
--               sizeof(read_info->loadparm));
--    } else {
--        s390_ipl_set_loadparm(read_info->loadparm);
--    }
-+    s390_ipl_convert_loadparm((char *)S390_CCW_MACHINE(machine)->loadparm,
-+                                read_info->loadparm);
- 
-     sccb->h.response_code = cpu_to_be16(SCLP_RC_NORMAL_READ_COMPLETION);
- }
-diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h
-index 0ef04af027..b67d2ae061 100644
---- a/include/hw/s390x/ipl/qipl.h
-+++ b/include/hw/s390x/ipl/qipl.h
-@@ -18,6 +18,7 @@
- 
- #define QIPL_ADDRESS  0xcc
- #define LOADPARM_LEN    8
-+#define NO_LOADPARM "\0\0\0\0\0\0\0\0"
- 
- /*
-  * The QEMU IPL Parameters will be stored at absolute address
-diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
-index 34ef27d7a6..ab4709e16e 100644
---- a/pc-bios/s390-ccw/main.c
-+++ b/pc-bios/s390-ccw/main.c
-@@ -183,8 +183,14 @@ static void css_setup(void)
- static void boot_setup(void)
- {
-     char lpmsg[] = "LOADPARM=[________]\n";
-+    have_iplb = store_iplb(&iplb);
-+
-+    if (memcmp(iplb.loadparm, NO_LOADPARM, LOADPARM_LEN) != 0) {
-+        ebcdic_to_ascii((char *) iplb.loadparm, loadparm_str, LOADPARM_LEN);
-+    } else {
-+        sclp_get_loadparm_ascii(loadparm_str);
-+    }
- 
--    sclp_get_loadparm_ascii(loadparm_str);
-     memcpy(lpmsg + 10, loadparm_str, 8);
-     puts(lpmsg);
- 
-@@ -193,8 +199,6 @@ static void boot_setup(void)
-      * so we don't taint our decision-making process during a reboot.
-      */
-     memset((char *)S390EP, 0, 6);
--
--    have_iplb = store_iplb(&iplb);
- }
- 
- static bool find_boot_device(void)
--- 
-2.39.3
-
diff --git a/kvm-s390x-Fix-leak-in-machine_set_loadparm.patch b/kvm-s390x-Fix-leak-in-machine_set_loadparm.patch
deleted file mode 100644
index 8b2660d..0000000
--- a/kvm-s390x-Fix-leak-in-machine_set_loadparm.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 4f627e0ae8efb96380070b6a8d50e88c71f40477 Mon Sep 17 00:00:00 2001
-From: Fabiano Rosas <farosas@suse.de>
-Date: Fri, 9 May 2025 14:49:38 -0300
-Subject: [PATCH 01/57] s390x: Fix leak in machine_set_loadparm
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 387: s390x: Fix memory leaks related to loadparm [rhel-9]
-RH-Jira: RHEL-98554
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [1/2] dadf5b9e187a644e0a8a8c565b1b913ef7f4dcc8 (thuth/qemu-kvm-cs)
-
-ASAN spotted a leaking string in machine_set_loadparm():
-
-Direct leak of 9 byte(s) in 1 object(s) allocated from:
-    #0 0x560ffb5bb379 in malloc ../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
-    #1 0x7f1aca926518 in g_malloc ../glib/gmem.c:106
-    #2 0x7f1aca94113e in g_strdup ../glib/gstrfuncs.c:364
-    #3 0x560ffc8afbf9 in qobject_input_type_str ../qapi/qobject-input-visitor.c:542:12
-    #4 0x560ffc8a80ff in visit_type_str ../qapi/qapi-visit-core.c:349:10
-    #5 0x560ffbe6053a in machine_set_loadparm ../hw/s390x/s390-virtio-ccw.c:802:10
-    #6 0x560ffc0c5e52 in object_property_set ../qom/object.c:1450:5
-    #7 0x560ffc0d4175 in object_property_set_qobject ../qom/qom-qobject.c:28:10
-    #8 0x560ffc0c6004 in object_property_set_str ../qom/object.c:1458:15
-    #9 0x560ffbe2ae60 in update_machine_ipl_properties ../hw/s390x/ipl.c:569:9
-    #10 0x560ffbe2aa65 in s390_ipl_update_diag308 ../hw/s390x/ipl.c:594:5
-    #11 0x560ffbdee132 in handle_diag_308 ../target/s390x/diag.c:147:9
-    #12 0x560ffbebb956 in helper_diag ../target/s390x/tcg/misc_helper.c:137:9
-    #13 0x7f1a3c51c730  (/memfd:tcg-jit (deleted)+0x39730)
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Message-ID: <20250509174938.25935-1-farosas@suse.de>
-Fixes: 1fd396e3228 ("s390x: Register TYPE_S390_CCW_MACHINE properties as class properties")
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit bdf12f2a56bf3f13c52eb51f0a994bbfe40706b2)
----
- hw/s390x/s390-virtio-ccw.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 77a1bde71e..fc18ab575f 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -782,6 +782,7 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
-     }
- 
-     s390_ipl_fmt_loadparm(ms->loadparm, val, errp);
-+    g_free(val);
- }
- 
- static void ccw_machine_class_init(ObjectClass *oc, void *data)
--- 
-2.39.3
-
diff --git a/kvm-s390x-Rebuild-IPLB-for-SCSI-device-directly-from-DIA.patch b/kvm-s390x-Rebuild-IPLB-for-SCSI-device-directly-from-DIA.patch
deleted file mode 100644
index 059798a..0000000
--- a/kvm-s390x-Rebuild-IPLB-for-SCSI-device-directly-from-DIA.patch
+++ /dev/null
@@ -1,264 +0,0 @@
-From 9d333e9e7614676aac3a39b0f4a5f5d67323b23d Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:50 -0400
-Subject: [PATCH 17/27] s390x: Rebuild IPLB for SCSI device directly from
- DIAG308
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [17/23] d0326ad7958cc82496bf57fd09bbc877c5b8c0ac (thuth/qemu-kvm-cs9)
-
-Because virtio-scsi type devices use a non-architected IPLB pbt code they cannot
-be set and stored normally. Instead, the IPLB must be rebuilt during re-ipl.
-
-As s390x does not natively support multiple boot devices, the devno field is
-used to store the position in the boot order for the device.
-
-Handling the rebuild as part of DIAG308 removes the need to check the devices
-for invalid IPLBs later in the IPL.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-17-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 455e3bc3f74ee76964efec2e0c646db15095d0d2)
----
- hw/s390x/ipl.c              | 74 ++++++-------------------------------
- hw/s390x/ipl.h              | 11 ++++--
- include/hw/s390x/ipl/qipl.h |  3 +-
- pc-bios/s390-ccw/jump2ipl.c | 11 ++++--
- target/s390x/diag.c         |  9 ++++-
- 5 files changed, 38 insertions(+), 70 deletions(-)
-
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index f4576f8822..5fbd43c346 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -448,7 +448,6 @@ void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp)
- 
- static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
- {
--    S390IPLState *ipl = get_ipl_device();
-     CcwDevice *ccw_dev = NULL;
-     SCSIDevice *sd;
-     int devtype;
-@@ -481,9 +480,6 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
-             iplb->ccw.ssid = ccw_dev->sch->ssid & 3;
-             break;
-         case CCW_DEVTYPE_VIRTIO_NET:
--            /* The S390IPLState netboot is true if ANY IPLB may use netboot */
--            ipl->netboot = true;
--            /* Fall through to CCW_DEVTYPE_VIRTIO case */
-         case CCW_DEVTYPE_VIRTIO:
-             iplb->len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
-             iplb->blk0_len =
-@@ -508,6 +504,16 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
-     return false;
- }
- 
-+void s390_rebuild_iplb(uint16_t dev_index, IplParameterBlock *iplb)
-+{
-+    S390IPLState *ipl = get_ipl_device();
-+    uint16_t index;
-+    index = ipl->rebuilt_iplb ? ipl->iplb_index : dev_index;
-+
-+    ipl->rebuilt_iplb = s390_build_iplb(get_boot_device(index), iplb);
-+    ipl->iplb_index = index;
-+}
-+
- static bool s390_init_all_iplbs(S390IPLState *ipl)
- {
-     int iplb_num = 0;
-@@ -564,44 +570,6 @@ static bool s390_init_all_iplbs(S390IPLState *ipl)
-     return iplb_num;
- }
- 
--static bool is_virtio_ccw_device_of_type(IplParameterBlock *iplb,
--                                         int virtio_id)
--{
--    uint8_t cssid;
--    uint8_t ssid;
--    uint16_t devno;
--    uint16_t schid;
--    SubchDev *sch = NULL;
--
--    if (iplb->pbt != S390_IPL_TYPE_CCW) {
--        return false;
--    }
--
--    devno = be16_to_cpu(iplb->ccw.devno);
--    ssid = iplb->ccw.ssid & 3;
--
--    for (schid = 0; schid < MAX_SCHID; schid++) {
--        for (cssid = 0; cssid < MAX_CSSID; cssid++) {
--            sch = css_find_subch(1, cssid, ssid, schid);
--
--            if (sch && sch->devno == devno) {
--                return sch->id.cu_model == virtio_id;
--            }
--        }
--    }
--    return false;
--}
--
--static bool is_virtio_net_device(IplParameterBlock *iplb)
--{
--    return is_virtio_ccw_device_of_type(iplb, VIRTIO_ID_NET);
--}
--
--static bool is_virtio_scsi_device(IplParameterBlock *iplb)
--{
--    return is_virtio_ccw_device_of_type(iplb, VIRTIO_ID_SCSI);
--}
--
- static void update_machine_ipl_properties(IplParameterBlock *iplb)
- {
-     Object *machine = qdev_get_machine();
-@@ -641,7 +609,7 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb)
-         ipl->iplb = *iplb;
-         ipl->iplb_valid = true;
-     }
--    ipl->netboot = is_virtio_net_device(iplb);
-+
-     update_machine_ipl_properties(iplb);
- }
- 
-@@ -668,32 +636,14 @@ IplParameterBlock *s390_ipl_get_iplb(void)
- void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type)
- {
-     S390IPLState *ipl = get_ipl_device();
--
-     if (reset_type == S390_RESET_EXTERNAL || reset_type == S390_RESET_REIPL) {
-         /* use CPU 0 for full resets */
-         ipl->reset_cpu_index = 0;
-     } else {
-         ipl->reset_cpu_index = cs->cpu_index;
-     }
--    ipl->reset_type = reset_type;
- 
--    if (reset_type == S390_RESET_REIPL &&
--        ipl->iplb_valid &&
--        !ipl->netboot &&
--        ipl->iplb.pbt == S390_IPL_TYPE_CCW &&
--        is_virtio_scsi_device(&ipl->iplb)) {
--        CcwDevice *ccw_dev = s390_get_ccw_device(get_boot_device(0), NULL);
--
--        if (ccw_dev &&
--            cpu_to_be16(ccw_dev->sch->devno) == ipl->iplb.ccw.devno &&
--            (ccw_dev->sch->ssid & 3) == ipl->iplb.ccw.ssid) {
--            /*
--             * this is the original boot device's SCSI
--             * so restore IPL parameter info from it
--             */
--            ipl->iplb_valid = s390_build_iplb(get_boot_device(0), &ipl->iplb);
--        }
--    }
-+    ipl->reset_type = reset_type;
-     if (reset_type == S390_RESET_MODIFIED_CLEAR ||
-         reset_type == S390_RESET_LOAD_NORMAL ||
-         reset_type == S390_RESET_PV) {
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index 54eb48fd6e..d7d0b7bfd2 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -24,6 +24,7 @@
- 
- void s390_ipl_convert_loadparm(char *ascii_lp, uint8_t *ebcdic_lp);
- void s390_ipl_fmt_loadparm(uint8_t *loadparm, char *str, Error **errp);
-+void s390_rebuild_iplb(uint16_t index, IplParameterBlock *iplb);
- void s390_ipl_update_diag308(IplParameterBlock *iplb);
- int s390_ipl_prepare_pv_header(Error **errp);
- int s390_ipl_pv_unpack(void);
-@@ -65,7 +66,8 @@ struct S390IPLState {
-     bool enforce_bios;
-     bool iplb_valid;
-     bool iplb_valid_pv;
--    bool netboot;
-+    bool rebuilt_iplb;
-+    uint16_t iplb_index;
-     /* reset related properties don't have to be migrated or reset */
-     enum s390_reset reset_type;
-     int reset_cpu_index;
-@@ -172,11 +174,14 @@ static inline bool iplb_valid_pv(IplParameterBlock *iplb)
- 
- static inline bool iplb_valid(IplParameterBlock *iplb)
- {
-+    uint32_t len = be32_to_cpu(iplb->len);
-+
-     switch (iplb->pbt) {
-     case S390_IPL_TYPE_FCP:
--        return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN;
-+        return len >= S390_IPLB_MIN_FCP_LEN;
-     case S390_IPL_TYPE_CCW:
--        return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN;
-+        return len >= S390_IPLB_MIN_CCW_LEN;
-+    case S390_IPL_TYPE_QEMU_SCSI:
-     default:
-         return false;
-     }
-diff --git a/include/hw/s390x/ipl/qipl.h b/include/hw/s390x/ipl/qipl.h
-index 1da4f75aa8..6824391111 100644
---- a/include/hw/s390x/ipl/qipl.h
-+++ b/include/hw/s390x/ipl/qipl.h
-@@ -29,7 +29,8 @@
-  */
- struct QemuIplParameters {
-     uint8_t  qipl_flags;
--    uint8_t  reserved1[3];
-+    uint8_t  index;
-+    uint8_t  reserved1[2];
-     uint64_t reserved2;
-     uint32_t boot_menu_timeout;
-     uint8_t  reserved3[2];
-diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
-index 8db1764ff3..99d18947d1 100644
---- a/pc-bios/s390-ccw/jump2ipl.c
-+++ b/pc-bios/s390-ccw/jump2ipl.c
-@@ -39,10 +39,15 @@ int jump_to_IPL_code(uint64_t address)
-     write_subsystem_identification();
-     write_iplb_location();
- 
--    /* prevent unknown IPL types in the guest */
-+    /*
-+     * The IPLB for QEMU SCSI type devices must be rebuilt during re-ipl. The
-+     * iplb.devno is set to the boot position of the target SCSI device.
-+     */
-     if (iplb.pbt == S390_IPL_TYPE_QEMU_SCSI) {
--        iplb.pbt = S390_IPL_TYPE_CCW;
--        set_iplb(&iplb);
-+        iplb.devno = qipl.index;
-+        if (!set_iplb(&iplb)) {
-+            panic("Failed to set IPLB");
-+        }
-     }
- 
-     /*
-diff --git a/target/s390x/diag.c b/target/s390x/diag.c
-index 27ffd48576..a1fd54ddac 100644
---- a/target/s390x/diag.c
-+++ b/target/s390x/diag.c
-@@ -133,7 +133,14 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
- 
-         valid = subcode == DIAG308_PV_SET ? iplb_valid_pv(iplb) : iplb_valid(iplb);
-         if (!valid) {
--            env->regs[r1 + 1] = DIAG_308_RC_INVALID;
-+            if (subcode == DIAG308_SET && iplb->pbt == S390_IPL_TYPE_QEMU_SCSI) {
-+                s390_rebuild_iplb(iplb->devno, iplb);
-+                s390_ipl_update_diag308(iplb);
-+                env->regs[r1 + 1] = DIAG_308_RC_OK;
-+            } else {
-+                env->regs[r1 + 1] = DIAG_308_RC_INVALID;
-+            }
-+
-             goto out;
-         }
- 
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-Add-PLO-extension-facility.patch b/kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
deleted file mode 100644
index 1d01e97..0000000
--- a/kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
+++ /dev/null
@@ -1,221 +0,0 @@
-From 67be3df75a0e2e3c0986bb8e482d8e4220dcbb44 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:50 +0100
-Subject: [PATCH 15/19] s390x/cpumodel: Add PLO-extension facility
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [15/16] 73ba29ed81fe2cab1419fb63b12a37c568a2d3ca (thuth/qemu-kvm-cs9)
-
-The PLO-extension facility introduces numerous locking related
-subfunctions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-15-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 393c835e341e8921d1d6ae45da308e85176c4f00)
----
- target/s390x/cpu_features.c         |  1 +
- target/s390x/cpu_features_def.h.inc | 39 +++++++++++++++++++++++++
- target/s390x/cpu_models.c           | 38 ++++++++++++++++++++++++
- target/s390x/gen-features.c         | 45 +++++++++++++++++++++++++++++
- 4 files changed, 123 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index 5f8b02f12c..4b5be6798e 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -240,6 +240,7 @@ void s390_get_deprecated_features(S390FeatBitmap features)
- /* indexed by feature group number for easy lookup */
- static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("plo", PLO, "Perform-locked-operation facility"),
-+    FEAT_GROUP_INIT("plo_ext", PLO_EXT, "PLO-extension facility"),
-     FEAT_GROUP_INIT("tods", TOD_CLOCK_STEERING, "Tod-clock-steering facility"),
-     FEAT_GROUP_INIT("gen13ptff", GEN13_PTFF, "PTFF enhancements introduced with z13"),
-     FEAT_GROUP_INIT("gen17ptff", GEN17_PTFF, "PTFF enhancements introduced with gen17"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index fe7e1bd19c..e23e603a79 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -93,6 +93,7 @@ DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
- DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
- DEF_FEAT(SIF, "sif", STFL, 85, "Sequential-instruction-fetching facility")
- DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
-+DEF_FEAT(PLO_EXT, "plo-ext", STFL, 87, "PLO-extension facility")
- DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
- DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
- DEF_FEAT(SIDE_EFFECT_ACCESS_ESOP2, "sea_esop2", STFL, 131, "Side-effect-access facility and Enhanced-suppression-on-protection facility 2")
-@@ -180,6 +181,44 @@ DEF_FEAT(PLO_CSTST, "plo-cstst", PLO, 20, "PLO Compare and swap and triple store
- DEF_FEAT(PLO_CSTSTG, "plo-cststg", PLO, 21, "PLO Compare and swap and triple store (64 bit in parameter list)")
- DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (64 bit in general registers)")
- DEF_FEAT(PLO_CSTSTX, "plo-cststx", PLO, 23, "PLO Compare and swap and triple store (128 bit in parameter list)")
-+DEF_FEAT(PLO_CLO, "plo-clo", PLO, 24, "PLO Compare and load (256 bit in parameter list)")
-+DEF_FEAT(PLO_CSO, "plo-cso", PLO, 25, "PLO Compare and swap (256 bit in parameter list)")
-+DEF_FEAT(PLO_DCSO, "plo-dcso", PLO, 26, "PLO Double compare and swap (256 bit in parameter list)")
-+DEF_FEAT(PLO_CSSTO, "plo-cssto", PLO, 27, "PLO Compare and swap and store (256 bit in parameter list)")
-+DEF_FEAT(PLO_CSDSTO, "plo-csdsto", PLO, 28, "PLO Compare and swap and double store (256 bit in parameter list)")
-+DEF_FEAT(PLO_CSTSTO, "plo-cststo", PLO, 29, "PLO Compare and swap and trible store (256 bit in parameter list)")
-+DEF_FEAT(PLO_TCS, "plo-tcs", PLO, 30, "Triple compare and swap (32 bit in parameter list)")
-+DEF_FEAT(PLO_TCSG, "plo-tcsg", PLO, 31, "Triple compare and swap (64 bit in parameter list)")
-+DEF_FEAT(PLO_TCSX, "plo-tcsx", PLO, 32, "Triple compare and swap (128 bit in parameter list)")
-+DEF_FEAT(PLO_TCSO, "plo-tcso", PLO, 33, "Triple compare and swap (256 bit in parameter list)")
-+DEF_FEAT(PLO_QCS, "plo-qcs", PLO, 34, "Quadruple compare and swap (32 bit in parameter list)")
-+DEF_FEAT(PLO_QCSG, "plo-qcsg", PLO, 35, "Quadruple compare and swap (64 bit in parameter list)")
-+DEF_FEAT(PLO_QCSX, "plo-qcsx", PLO, 36, "Quadruple compare and swap (128 bit in parameter list)")
-+DEF_FEAT(PLO_QCSO, "plo-qcso", PLO, 37, "Quadruple compare and swap (256 bit in parameter list)")
-+DEF_FEAT(PLO_LO, "plo-lo", PLO, 38, "Load (256 bit in parameter list)")
-+DEF_FEAT(PLO_DLX, "plo-dlx", PLO, 39, "Double load (128 bit in parameter list)")
-+DEF_FEAT(PLO_DLO, "plo-dlo", PLO, 40, "Double load (256 bit in parameter list)")
-+DEF_FEAT(PLO_TL, "plo-tl", PLO, 41, "Triple load (32 bit in parameter list)")
-+DEF_FEAT(PLO_TLG, "plo-tlg", PLO, 42, "Triple load (64 bit in parameter list)")
-+DEF_FEAT(PLO_TLX, "plo-tlx", PLO, 43, "Triple load (128 bit in parameter list)")
-+DEF_FEAT(PLO_TLO, "plo-tlo", PLO, 44, "Triple load (256 bit in parameter list)")
-+DEF_FEAT(PLO_QL, "plo-ql", PLO, 45, "Quadruple load (32 bit in parameter list)")
-+DEF_FEAT(PLO_QLG, "plo-qlg", PLO, 46, "Quadruple load (64 bit in parameter list)")
-+DEF_FEAT(PLO_QLX, "plo-qlx", PLO, 47, "Quadruple load (128 bit in parameter list)")
-+DEF_FEAT(PLO_QLO, "plo-qlo", PLO, 48, "Quadruple load (256 bit in parameter list)")
-+DEF_FEAT(PLO_STO, "plo-sto", PLO, 49, "Store (256 bit in parameter list)")
-+DEF_FEAT(PLO_DST, "plo-dst", PLO, 50, "Double store (32 bit in parameter list)")
-+DEF_FEAT(PLO_DSTG, "plo-dstg", PLO, 51, "Double store (64 bit in parameter list)")
-+DEF_FEAT(PLO_DSTX, "plo-dstx", PLO, 52, "Double store (128 bit in parameter list)")
-+DEF_FEAT(PLO_DSTO, "plo-dsto", PLO, 53, "Double store (256 bit in parameter list)")
-+DEF_FEAT(PLO_TST, "plo-tst", PLO, 54, "Triple store (32 bit in parameter list)")
-+DEF_FEAT(PLO_TSTG, "plo-tstg", PLO, 55, "Triple store (64 bit in parameter list)")
-+DEF_FEAT(PLO_TSTX, "plo-tstx", PLO, 56, "Triple store (128 bit in parameter list)")
-+DEF_FEAT(PLO_TSTO, "plo-tsto", PLO, 57, "Triple store (256 bit in parameter list)")
-+DEF_FEAT(PLO_QST, "plo-qst", PLO, 58, "Quadruple store (32 bit in parameter list)")
-+DEF_FEAT(PLO_QSTG, "plo-qstg", PLO, 59, "Quadruple store (64 bit in parameter list)")
-+DEF_FEAT(PLO_QSTX, "plo-qstx", PLO, 60, "Quadruple store (128 bit in parameter list)")
-+DEF_FEAT(PLO_QSTO, "plo-qsto", PLO, 61, "Quadruple store (256 bit in parameter list)")
- 
- /* Features exposed via the PTFF instruction. */
- DEF_FEAT(PTFF_QTO, "ptff-qto", PTFF, 1, "PTFF Query TOD Offset")
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 32b5bb7509..d2798c0f38 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -516,6 +516,44 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
-         { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
-         { S390_FEAT_INEFF_NC_TX, S390_FEAT_TRANSACTIONAL_EXE },
-+        { S390_FEAT_PLO_CLO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_CSO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DCSO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_CSSTO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_CSDSTO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_CSTSTO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TCS, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TCSG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TCSX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TCSO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QCS, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QCSG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QCSX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QCSO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_LO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DLX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DLO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TL, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TLG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TLX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TLO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QL, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QLG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QLX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QLO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_STO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DST, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DSTG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DSTX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_DSTO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TST, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TSTG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TSTX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_TSTO, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QST, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QSTG, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QSTX, S390_FEAT_PLO_EXT },
-+        { S390_FEAT_PLO_QSTO, S390_FEAT_PLO_EXT },
-     };
-     int i;
- 
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 6d00ffcda7..680d45d303 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -46,6 +46,47 @@
-     S390_FEAT_PLO_CSTSTGR, \
-     S390_FEAT_PLO_CSTSTX
- 
-+#define S390_FEAT_GROUP_PLO_EXT \
-+    S390_FEAT_PLO_EXT, \
-+    S390_FEAT_PLO_CLO, \
-+    S390_FEAT_PLO_CSO, \
-+    S390_FEAT_PLO_DCSO, \
-+    S390_FEAT_PLO_CSSTO, \
-+    S390_FEAT_PLO_CSDSTO, \
-+    S390_FEAT_PLO_CSTSTO, \
-+    S390_FEAT_PLO_TCS, \
-+    S390_FEAT_PLO_TCSG, \
-+    S390_FEAT_PLO_TCSX, \
-+    S390_FEAT_PLO_TCSO, \
-+    S390_FEAT_PLO_QCS, \
-+    S390_FEAT_PLO_QCSG, \
-+    S390_FEAT_PLO_QCSX, \
-+    S390_FEAT_PLO_QCSO, \
-+    S390_FEAT_PLO_LO, \
-+    S390_FEAT_PLO_DLX, \
-+    S390_FEAT_PLO_DLO, \
-+    S390_FEAT_PLO_TL, \
-+    S390_FEAT_PLO_TLG, \
-+    S390_FEAT_PLO_TLX, \
-+    S390_FEAT_PLO_TLO, \
-+    S390_FEAT_PLO_QL, \
-+    S390_FEAT_PLO_QLG, \
-+    S390_FEAT_PLO_QLX, \
-+    S390_FEAT_PLO_QLO, \
-+    S390_FEAT_PLO_STO, \
-+    S390_FEAT_PLO_DST, \
-+    S390_FEAT_PLO_DSTG, \
-+    S390_FEAT_PLO_DSTX, \
-+    S390_FEAT_PLO_DSTO, \
-+    S390_FEAT_PLO_TST, \
-+    S390_FEAT_PLO_TSTG, \
-+    S390_FEAT_PLO_TSTX, \
-+    S390_FEAT_PLO_TSTO, \
-+    S390_FEAT_PLO_QST, \
-+    S390_FEAT_PLO_QSTG, \
-+    S390_FEAT_PLO_QSTX, \
-+    S390_FEAT_PLO_QSTO
-+
- #define S390_FEAT_GROUP_TOD_CLOCK_STEERING \
-     S390_FEAT_TOD_CLOCK_STEERING, \
-     S390_FEAT_PTFF_QTO, \
-@@ -320,6 +361,9 @@
- static uint16_t group_PLO[] = {
-     S390_FEAT_GROUP_PLO,
- };
-+static uint16_t group_PLO_EXT[] = {
-+    S390_FEAT_GROUP_PLO_EXT,
-+};
- static uint16_t group_TOD_CLOCK_STEERING[] = {
-     S390_FEAT_GROUP_TOD_CLOCK_STEERING,
- };
-@@ -936,6 +980,7 @@ typedef struct {
-  *******************************/
- static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(PLO),
-+    FEAT_GROUP_INITIALIZER(PLO_EXT),
-     FEAT_GROUP_INITIALIZER(TOD_CLOCK_STEERING),
-     FEAT_GROUP_INITIALIZER(GEN13_PTFF),
-     FEAT_GROUP_INITIALIZER(GEN17_PTFF),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch b/kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
deleted file mode 100644
index 403a2e5..0000000
--- a/kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 6de82922c2fe7cad72f275d5ef49cabfe0a5e169 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:48 +0100
-Subject: [PATCH 13/19] s390x/cpumodel: Add Sequential-Instruction-Fetching
- facility
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [13/16] a858363caecc3bb6b09182ff43427d1677ebbed9 (thuth/qemu-kvm-cs9)
-
-The sequential instruction fetching facility provides few guarantees,
-for example, to avoid stop machine calls on enabling/disabling kprobes.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-13-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit a5fa8bee72847406bfc32e15c8e41c0a2a0812e1)
----
- target/s390x/cpu_features_def.h.inc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 2c1d1cd98a..09a80844a7 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -91,6 +91,7 @@ DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packe
- DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
- DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
- DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
-+DEF_FEAT(SIF, "sif", STFL, 85, "Sequential-instruction-fetching facility")
- DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
- DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
- DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch b/kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
deleted file mode 100644
index 3a4d243..0000000
--- a/kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From aeb20f5f209002675477b17e87577cd793151457 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:41 +0100
-Subject: [PATCH 06/19] s390x/cpumodel: Add ptff Query Time-Stamp Event (QTSE)
- support
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [6/16] 515643e8201e25958e81e36c22de0192eb1f1a19 (thuth/qemu-kvm-cs9)
-
-Introduce a new PTFF subfunction to query-stamp events.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-6-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit eba6f49128fbcf75d19acb6aef250d0664d03e9e)
----
- target/s390x/cpu_features.c         | 1 +
- target/s390x/cpu_features_def.h.inc | 1 +
- target/s390x/gen-features.c         | 9 +++++++++
- 3 files changed, 11 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index 9ba127e386..385a2ff860 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -241,6 +241,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("plo", PLO, "Perform-locked-operation facility"),
-     FEAT_GROUP_INIT("tods", TOD_CLOCK_STEERING, "Tod-clock-steering facility"),
-     FEAT_GROUP_INIT("gen13ptff", GEN13_PTFF, "PTFF enhancements introduced with z13"),
-+    FEAT_GROUP_INIT("gen17ptff", GEN17_PTFF, "PTFF enhancements introduced with gen17"),
-     FEAT_GROUP_INIT("msa", MSA, "Message-security-assist facility"),
-     FEAT_GROUP_INIT("msa1", MSA_EXT_1, "Message-security-assist-extension 1 facility"),
-     FEAT_GROUP_INIT("msa2", MSA_EXT_2, "Message-security-assist-extension 2 facility"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 2132837ffe..f96cb5a7d8 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -181,6 +181,7 @@ DEF_FEAT(PTFF_QSI, "ptff-qsi", PTFF, 2, "PTFF Query Steering Information")
- DEF_FEAT(PTFF_QPT, "ptff-qpc", PTFF, 3, "PTFF Query Physical Clock")
- DEF_FEAT(PTFF_QUI, "ptff-qui", PTFF, 4, "PTFF Query UTC Information")
- DEF_FEAT(PTFF_QTOU, "ptff-qtou", PTFF, 5, "PTFF Query TOD Offset User")
-+DEF_FEAT(PTFF_QTSE, "ptff-qtse", PTFF, 6, "PTFF Query Time-Stamp Event")
- DEF_FEAT(PTFF_QSIE, "ptff-qsie", PTFF, 10, "PTFF Query Steering Information Extended")
- DEF_FEAT(PTFF_QTOUE, "ptff-qtoue", PTFF, 13, "PTFF Query TOD Offset User Extended")
- DEF_FEAT(PTFF_STO, "ptff-sto", PTFF, 65, "PTFF Set TOD Offset")
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 3326e7df43..302b653214 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -64,6 +64,9 @@
-     S390_FEAT_PTFF_STOE, \
-     S390_FEAT_PTFF_STOUE
- 
-+#define S390_FEAT_GROUP_GEN17_PTFF \
-+    S390_FEAT_PTFF_QTSE
-+
- #define S390_FEAT_GROUP_MSA \
-     S390_FEAT_MSA, \
-     S390_FEAT_KMAC_DEA, \
-@@ -318,6 +321,11 @@ static uint16_t group_GEN13_PTFF[] = {
- static uint16_t group_MULTIPLE_EPOCH_PTFF[] = {
-     S390_FEAT_GROUP_MULTIPLE_EPOCH_PTFF,
- };
-+
-+static uint16_t group_GEN17_PTFF[] = {
-+    S390_FEAT_GROUP_GEN17_PTFF,
-+};
-+
- static uint16_t group_MSA[] = {
-     S390_FEAT_GROUP_MSA,
- };
-@@ -918,6 +926,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(PLO),
-     FEAT_GROUP_INITIALIZER(TOD_CLOCK_STEERING),
-     FEAT_GROUP_INITIALIZER(GEN13_PTFF),
-+    FEAT_GROUP_INITIALIZER(GEN17_PTFF),
-     FEAT_GROUP_INITIALIZER(MSA),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_1),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_2),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch b/kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
deleted file mode 100644
index d754098..0000000
--- a/kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From 2bf72baa123e5d55d9ebe62f457d22df4c53ef70 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:43 +0100
-Subject: [PATCH 08/19] s390x/cpumodel: add Concurrent-functions facility
- support
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [8/16] a98bb888a032f696ded722a8e614612f20b070f6 (thuth/qemu-kvm-cs9)
-
-The Concurrent-functions facility introduces the new instruction
-Perform Functions with Concurrent Results (PFCR) with few subfunctions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-8-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit c9ea365dce32bc114dacd7cfca7c478a82459b47)
----
- target/s390x/cpu_features.c         |  2 ++
- target/s390x/cpu_features.h         |  1 +
- target/s390x/cpu_features_def.h.inc |  8 ++++++++
- target/s390x/cpu_models.c           |  5 +++++
- target/s390x/gen-features.c         | 13 +++++++++++++
- target/s390x/kvm/kvm.c              |  6 ++++++
- 6 files changed, 35 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index 385a2ff860..5f8b02f12c 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -93,6 +93,7 @@ void s390_fill_feat_block(const S390FeatBitmap features, S390FeatType type,
-     case S390_FEAT_TYPE_KDSA:
-     case S390_FEAT_TYPE_SORTL:
-     case S390_FEAT_TYPE_DFLTCC:
-+    case S390_FEAT_TYPE_PFCR:
-         set_be_bit(0, data); /* query is always available */
-         break;
-     default:
-@@ -263,6 +264,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
-     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
-     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
-+    FEAT_GROUP_INIT("ccf", CONCURRENT_FUNCTIONS, "Concurrent-functions facility"),
- };
- 
- const S390FeatGroupDef *s390_feat_group_def(S390FeatGroup group)
-diff --git a/target/s390x/cpu_features.h b/target/s390x/cpu_features.h
-index 661a8cd6db..5635839d03 100644
---- a/target/s390x/cpu_features.h
-+++ b/target/s390x/cpu_features.h
-@@ -44,6 +44,7 @@ typedef enum {
-     S390_FEAT_TYPE_SORTL,
-     S390_FEAT_TYPE_DFLTCC,
-     S390_FEAT_TYPE_UV_FEAT_GUEST,
-+    S390_FEAT_TYPE_PFCR,
- } S390FeatType;
- 
- /* Definition of a CPU feature */
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index f96cb5a7d8..09872ab3d8 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -116,6 +116,7 @@ DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
- DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
- DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
- DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
-+DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
- 
- /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
- DEF_FEAT(SIE_GSLS, "gsls", SCLP_CONF_CHAR, 40, "SIE: Guest-storage-limit-suppression facility")
-@@ -413,3 +414,10 @@ DEF_FEAT(DEFLATE_F0, "dfltcc-f0", DFLTCC, 192, "DFLTCC format 0 parameter-block"
- /* Features exposed via the UV-CALL instruction */
- DEF_FEAT(UV_FEAT_AP, "appv", UV_FEAT_GUEST, 4, "AP instructions installed for secure guests")
- DEF_FEAT(UV_FEAT_AP_INTR, "appvi", UV_FEAT_GUEST, 5, "AP instructions interruption support for secure guests")
-+
-+/* Features exposed via the PFCR instruction (concurrent-functions facility). */
-+DEF_FEAT(PFCR_QAF, "pfcr-qaf", PFCR, 0, "PFCR Query-Available-Functions")
-+DEF_FEAT(PFCR_CSDST, "pfcr-csdst", PFCR, 1, "PFCR Compare-and-Swap-and-Double-Store (32)")
-+DEF_FEAT(PFCR_CSDSTG, "pfcr-csdstg", PFCR, 2, "PFCR Compare-and-Swap-and-Double-Store (64)")
-+DEF_FEAT(PFCR_CSTST, "pfcr-cstst", PFCR, 3, "PFCR Compare-and-Swap-and-Triple-Store (32)")
-+DEF_FEAT(PFCR_CSTSTG, "pfcr-cststg", PFCR, 4, "PFCR Compare-and-Swap-and-Triple-Store (64)")
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 93fbe7e6c8..1a7627b010 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -507,6 +507,11 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING },
-         { S390_FEAT_UV_FEAT_AP, S390_FEAT_AP },
-         { S390_FEAT_UV_FEAT_AP_INTR, S390_FEAT_UV_FEAT_AP },
-+        { S390_FEAT_PFCR_QAF, S390_FEAT_CCF_BASE },
-+        { S390_FEAT_PFCR_CSDST, S390_FEAT_CCF_BASE },
-+        { S390_FEAT_PFCR_CSDSTG, S390_FEAT_CCF_BASE },
-+        { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
-+        { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
-     };
-     int i;
- 
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 302b653214..6d00ffcda7 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -308,6 +308,14 @@
-     S390_FEAT_DEFLATE_XPND, \
-     S390_FEAT_DEFLATE_F0
- 
-+#define S390_FEAT_GROUP_CONCURRENT_FUNCTIONS \
-+    S390_FEAT_CCF_BASE, \
-+    S390_FEAT_PFCR_QAF, \
-+    S390_FEAT_PFCR_CSDST, \
-+    S390_FEAT_PFCR_CSDSTG, \
-+    S390_FEAT_PFCR_CSTST, \
-+    S390_FEAT_PFCR_CSTSTG
-+
- /* cpu feature groups */
- static uint16_t group_PLO[] = {
-     S390_FEAT_GROUP_PLO,
-@@ -398,6 +406,10 @@ static uint16_t group_DEFLATE_CONVERSION[] = {
-     S390_FEAT_GROUP_DEFLATE_CONVERSION,
- };
- 
-+static uint16_t group_CONCURRENT_FUNCTIONS[] = {
-+    S390_FEAT_GROUP_CONCURRENT_FUNCTIONS,
-+};
-+
- /* Base features (in order of release)
-  * Only non-hypervisor managed features belong here.
-  * Base feature sets are static meaning they do not change in future QEMU
-@@ -948,6 +960,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
-     FEAT_GROUP_INITIALIZER(ENH_SORT),
-     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
-+    FEAT_GROUP_INITIALIZER(CONCURRENT_FUNCTIONS),
- };
- 
- #define QEMU_FEAT_INITIALIZER(_name)                   \
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 0d51a4ea6b..7a0ca5570f 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -2195,6 +2195,9 @@ static int query_cpu_subfunc(S390FeatBitmap features)
-     if (test_bit(S390_FEAT_DEFLATE_BASE, features)) {
-         s390_add_from_feat_block(features, S390_FEAT_TYPE_DFLTCC, prop.dfltcc);
-     }
-+    if (test_bit(S390_FEAT_CCF_BASE, features)) {
-+        s390_add_from_feat_block(features, S390_FEAT_TYPE_PFCR, prop.pfcr);
-+    }
-     return 0;
- }
- 
-@@ -2248,6 +2251,9 @@ static int configure_cpu_subfunc(const S390FeatBitmap features)
-     if (test_bit(S390_FEAT_DEFLATE_BASE, features)) {
-         s390_fill_feat_block(features, S390_FEAT_TYPE_DFLTCC, prop.dfltcc);
-     }
-+    if (test_bit(S390_FEAT_CCF_BASE, features)) {
-+        s390_fill_feat_block(features, S390_FEAT_TYPE_PFCR, prop.pfcr);
-+    }
-     return kvm_vm_ioctl(kvm_state, KVM_SET_DEVICE_ATTR, &attr);
- }
- 
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch b/kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
deleted file mode 100644
index db4b689..0000000
--- a/kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From f6cefb05d503f1082a483bd57b10f764f160ac71 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:47 +0100
-Subject: [PATCH 12/19] s390x/cpumodel: add
- Ineffective-nonconstrained-transaction facility
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [12/16] 0b6f6157f96303f11e65db8a11d7ca1fbdeef238 (thuth/qemu-kvm-cs9)
-
-This facility indicates reduced support for noncontrained
-transactional-execution.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-12-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 12417b713c1fffc26c680e99e3429f055eb9af2e)
----
- target/s390x/cpu_features_def.h.inc | 1 +
- target/s390x/cpu_models.c           | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index df154d145f..2c1d1cd98a 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -112,6 +112,7 @@ DEF_FEAT(MSA_EXT_9, "msa9-base", STFL, 155, "Message-security-assist-extension-9
- DEF_FEAT(ETOKEN, "etoken", STFL, 156, "Etoken facility")
- DEF_FEAT(UNPACK, "unpack", STFL, 161, "Unpack facility")
- DEF_FEAT(NNPA, "nnpa", STFL, 165, "NNPA facility")
-+DEF_FEAT(INEFF_NC_TX, "ineff_nc_tx", STFL, 170, "Ineffective-nonconstrained-transaction facility")
- DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH2, "vxpdeh2", STFL, 192, "Vector-Packed-Decimal-Enhancement facility 2")
- DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
- DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 262e3daf3e..32b5bb7509 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -515,6 +515,7 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_PFCR_CSDSTG, S390_FEAT_CCF_BASE },
-         { S390_FEAT_PFCR_CSTST, S390_FEAT_CCF_BASE },
-         { S390_FEAT_PFCR_CSTSTG, S390_FEAT_CCF_BASE },
-+        { S390_FEAT_INEFF_NC_TX, S390_FEAT_TRANSACTIONAL_EXE },
-     };
-     int i;
- 
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch b/kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
deleted file mode 100644
index c3362b6..0000000
--- a/kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 330241441464585dcc5c0786356b7f467cc882f9 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:45 +0100
-Subject: [PATCH 10/19] s390x/cpumodel: add
- Miscellaneous-Instruction-Extensions Facility 4
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [10/16] 980ca7cdce99ccba7332de703ac9ec6f5e771d4b (thuth/qemu-kvm-cs9)
-
-This facility introduces few new instructions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-10-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit e68e5ea6fe87c0177ea6421045c1d46f223a861e)
----
- target/s390x/cpu_features_def.h.inc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 0b7be0e6e9..8be2e0e46d 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -90,6 +90,7 @@ DEF_FEAT(EDAT_2, "edat2", STFL, 78, "Enhanced-DAT facility 2")
- DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packed-conversion facility")
- DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
- DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
-+DEF_FEAT(MISC_INSTRUCTION_EXT4, "minste4", STFL, 84, "Miscellaneous-Instruction-Extensions Facility 4")
- DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
- DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
- DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch b/kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
deleted file mode 100644
index b8cbca4..0000000
--- a/kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 8f781722a638bce5472ddc47af7b85da28fc4c9d Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:44 +0100
-Subject: [PATCH 09/19] s390x/cpumodel: add Vector Enhancements facility 3
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [9/16] 5dd3aa305276bb7b75feb570d669bd0a9ab224dd (thuth/qemu-kvm-cs9)
-
-The Vector Enhancements facility 3 introduces new instructions and
-extends support for doubleword/quadword elements.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-9-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 0b2c66a3fa5ccecf26ea011d97d65a986b42b4d8)
----
- target/s390x/cpu_features_def.h.inc | 1 +
- target/s390x/cpu_models.c           | 2 ++
- 2 files changed, 3 insertions(+)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 09872ab3d8..0b7be0e6e9 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -116,6 +116,7 @@ DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
- DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
- DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
- DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
-+DEF_FEAT(VECTOR_ENH3, "vxeh3", STFL, 198, "Vector Enhancements facility 3")
- DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
- 
- /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 1a7627b010..05a2d15a70 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -461,6 +461,8 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
-         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
-         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
-+        { S390_FEAT_VECTOR_ENH2, S390_FEAT_VECTOR_ENH },
-+        { S390_FEAT_VECTOR_ENH3, S390_FEAT_VECTOR_ENH2 },
-         { S390_FEAT_INSTRUCTION_EXEC_PROT, S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2 },
-         { S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2, S390_FEAT_ESOP },
-         { S390_FEAT_CMM_NT, S390_FEAT_CMM },
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch b/kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
deleted file mode 100644
index efb3e81..0000000
--- a/kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 080e7d91315bbeef35726159cbab01c51d0dc63e Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:46 +0100
-Subject: [PATCH 11/19] s390x/cpumodel: add Vector-Packed-Decimal-Enhancement
- facility 3
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [11/16] a653881aae9e26d0644b0d47bbfaaf8d22fb622a (thuth/qemu-kvm-cs9)
-
-This facility introduces new capabilities for the signed-pack-decimal
-format.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-11-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit db4c208abde53a7ed16d566bf63a3520894bba8d)
----
- target/s390x/cpu_features_def.h.inc | 1 +
- target/s390x/cpu_models.c           | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 8be2e0e46d..df154d145f 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -118,6 +118,7 @@ DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
- DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
- DEF_FEAT(PAIE, "paie", STFL, 197, "Processor-Activity-Instrumentation extension-1")
- DEF_FEAT(VECTOR_ENH3, "vxeh3", STFL, 198, "Vector Enhancements facility 3")
-+DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH3, "vxpdeh3", STFL, 199, "Vector-Packed-Decimal-Enhancement facility 3")
- DEF_FEAT(CCF_BASE, "ccf-base", STFL, 201, "Concurrent-Functions facility")
- 
- /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 05a2d15a70..262e3daf3e 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -460,6 +460,7 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_VECTOR_PACKED_DECIMAL, S390_FEAT_VECTOR },
-         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
-         { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
-+        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2 },
-         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
-         { S390_FEAT_VECTOR_ENH2, S390_FEAT_VECTOR_ENH },
-         { S390_FEAT_VECTOR_ENH3, S390_FEAT_VECTOR_ENH2 },
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-msa10-subfunctions.patch b/kvm-s390x-cpumodel-add-msa10-subfunctions.patch
deleted file mode 100644
index a75075b..0000000
--- a/kvm-s390x-cpumodel-add-msa10-subfunctions.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From c479543e70213d3638e78122a3ff32a7fbf2cfb5 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:37 +0100
-Subject: [PATCH 02/19] s390x/cpumodel: add msa10 subfunctions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [2/16] 9b27810af579a1814c195a8c9453d4a95f3b0654 (thuth/qemu-kvm-cs9)
-
-MSA10 introduces new AES XTS subfunctions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Message-ID: <20241206122751.189721-2-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 1029cd5b9827ba6aa7f5e02eed1928a928e2fa5e)
----
- target/s390x/cpu_features.c         |  2 ++
- target/s390x/cpu_features_def.h.inc |  6 ++++++
- target/s390x/cpu_models.c           |  4 ++++
- target/s390x/gen-features.c         | 20 ++++++++++++++++++++
- 4 files changed, 32 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index cb4e2b8920..a3c239595a 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -252,6 +252,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("msa8", MSA_EXT_8, "Message-security-assist-extension 8 facility"),
-     FEAT_GROUP_INIT("msa9", MSA_EXT_9, "Message-security-assist-extension 9 facility"),
-     FEAT_GROUP_INIT("msa9_pckmo", MSA_EXT_9_PCKMO, "Message-security-assist-extension 9 PCKMO subfunctions"),
-+    FEAT_GROUP_INIT("msa10", MSA_EXT_10, "Message-security-assist-extension 10 facility"),
-+    FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
-     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
-     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index c53ac13352..104d186c3f 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -233,6 +233,10 @@ DEF_FEAT(KM_XTS_AES_128, "km-xts-aes-128", KM, 50, "KM XTS-AES-128")
- DEF_FEAT(KM_XTS_AES_256, "km-xts-aes-256", KM, 52, "KM XTS-AES-256")
- DEF_FEAT(KM_XTS_EAES_128, "km-xts-eaes-128", KM, 58, "KM XTS-Encrypted-AES-128")
- DEF_FEAT(KM_XTS_EAES_256, "km-xts-eaes-256", KM, 60, "KM XTS-Encrypted-AES-256")
-+DEF_FEAT(KM_FULL_XTS_AES_128, "km-full-xts-aes-128", KM, 82, "KM Full-XTS-AES-128")
-+DEF_FEAT(KM_FULL_XTS_AES_256, "km-full-xts-aes-256", KM, 84, "KM Full-XTS-AES-256")
-+DEF_FEAT(KM_FULL_XTS_EAES_128, "km-full-xts-eaes-128", KM, 90, "KM Full-XTS-Encrypted-AES-128")
-+DEF_FEAT(KM_FULL_XTS_EAES_256, "km-full-xts-eaes-256", KM, 92, "KM Full-XTS-Encrypted-AES-256")
- 
- /* Features exposed via the KIMD instruction. */
- DEF_FEAT(KIMD_SHA_1, "kimd-sha-1", KIMD, 1, "KIMD SHA-1")
-@@ -264,6 +268,8 @@ DEF_FEAT(PCKMO_ETDEA_256, "pckmo-etdea-192", PCKMO, 3, "PCKMO Encrypted-TDEA-192
- DEF_FEAT(PCKMO_AES_128, "pckmo-aes-128", PCKMO, 18, "PCKMO Encrypted-AES-128-Key")
- DEF_FEAT(PCKMO_AES_192, "pckmo-aes-192", PCKMO, 19, "PCKMO Encrypted-AES-192-Key")
- DEF_FEAT(PCKMO_AES_256, "pckmo-aes-256", PCKMO, 20, "PCKMO Encrypted-AES-256-Key")
-+DEF_FEAT(PCKMO_AES_XTS_128_DK, "pckmo-aes-xts-128-dk", PCKMO, 21, "PCKMO Encrypt-AES-XTS-128-Double-Key")
-+DEF_FEAT(PCKMO_AES_XTS_256_DK, "pckmo-aes-xts-256-dk", PCKMO, 22, "PCKMO Encrypt-AES-XTS-256-Double-Key")
- DEF_FEAT(PCKMO_ECC_P256, "pckmo-ecc-p256", PCKMO, 32, "PCKMO Encrypt-ECC-P256-Key")
- DEF_FEAT(PCKMO_ECC_P384, "pckmo-ecc-p384", PCKMO, 33, "PCKMO Encrypt-ECC-P384-Key")
- DEF_FEAT(PCKMO_ECC_P521, "pckmo-ecc-p521", PCKMO, 34, "PCKMO Encrypt-ECC-P521-Key")
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 9ee30310c6..313640ca12 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -480,6 +480,10 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_KLMD_SHA3_512, S390_FEAT_MSA },
-         { S390_FEAT_KLMD_SHAKE_128, S390_FEAT_MSA },
-         { S390_FEAT_KLMD_SHAKE_256, S390_FEAT_MSA },
-+        { S390_FEAT_KM_FULL_XTS_AES_128, S390_FEAT_MSA_EXT_4 },
-+        { S390_FEAT_KM_FULL_XTS_AES_256, S390_FEAT_MSA_EXT_4 },
-+        { S390_FEAT_KM_FULL_XTS_EAES_128, S390_FEAT_MSA_EXT_4 },
-+        { S390_FEAT_KM_FULL_XTS_EAES_256, S390_FEAT_MSA_EXT_4 },
-         { S390_FEAT_PRNO_TRNG_QRTCR, S390_FEAT_MSA_EXT_5 },
-         { S390_FEAT_PRNO_TRNG, S390_FEAT_MSA_EXT_5 },
-         { S390_FEAT_SIE_KSS, S390_FEAT_SIE_F2 },
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 2b2bfc3736..06c3bf64f3 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -246,6 +246,16 @@
-     S390_FEAT_PCKMO_ECC_ED25519, \
-     S390_FEAT_PCKMO_ECC_ED448
- 
-+#define S390_FEAT_GROUP_MSA_EXT_10 \
-+    S390_FEAT_KM_FULL_XTS_AES_128, \
-+    S390_FEAT_KM_FULL_XTS_AES_256, \
-+    S390_FEAT_KM_FULL_XTS_EAES_128, \
-+    S390_FEAT_KM_FULL_XTS_EAES_256
-+
-+#define S390_FEAT_GROUP_MSA_EXT_10_PCKMO \
-+    S390_FEAT_PCKMO_AES_XTS_128_DK, \
-+    S390_FEAT_PCKMO_AES_XTS_256_DK
-+
- #define S390_FEAT_GROUP_ENH_SORT \
-     S390_FEAT_ESORT_BASE, \
-     S390_FEAT_SORTL_SFLR, \
-@@ -307,10 +317,18 @@ static uint16_t group_MSA_EXT_9[] = {
-     S390_FEAT_GROUP_MSA_EXT_9,
- };
- 
-+static uint16_t group_MSA_EXT_10[] = {
-+    S390_FEAT_GROUP_MSA_EXT_10,
-+};
-+
- static uint16_t group_MSA_EXT_9_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
- };
- 
-+static uint16_t group_MSA_EXT_10_PCKMO[] = {
-+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
-+};
-+
- static uint16_t group_ENH_SORT[] = {
-     S390_FEAT_GROUP_ENH_SORT,
- };
-@@ -858,6 +876,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(MSA_EXT_8),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_9),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_9_PCKMO),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_10),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
-     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
-     FEAT_GROUP_INITIALIZER(ENH_SORT),
-     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-msa11-subfunctions.patch b/kvm-s390x-cpumodel-add-msa11-subfunctions.patch
deleted file mode 100644
index 452b873..0000000
--- a/kvm-s390x-cpumodel-add-msa11-subfunctions.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From 07bd1e9aee50f5239d73c7c506b4a1851f36585b Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:38 +0100
-Subject: [PATCH 03/19] s390x/cpumodel: add msa11 subfunctions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [3/16] 939476a6a4b38f269f1a419110c38ab42f545d6f (thuth/qemu-kvm-cs9)
-
-MSA11 introduces new HMAC subfunctions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Message-ID: <20241206122751.189721-3-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 11dc9020824c81552b021fbe0e2910e0348e7f8e)
----
- target/s390x/cpu_features.c         |  2 ++
- target/s390x/cpu_features_def.h.inc | 10 ++++++++++
- target/s390x/cpu_models.c           |  8 ++++++++
- target/s390x/gen-features.c         | 24 ++++++++++++++++++++++++
- 4 files changed, 44 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index a3c239595a..36930feccd 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -254,6 +254,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("msa9_pckmo", MSA_EXT_9_PCKMO, "Message-security-assist-extension 9 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("msa10", MSA_EXT_10, "Message-security-assist-extension 10 facility"),
-     FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
-+    FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
-+    FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
-     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
-     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 104d186c3f..15ea51fc54 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -200,6 +200,14 @@ DEF_FEAT(KMAC_AES_256, "kmac-aes-256", KMAC, 20, "KMAC AES-256")
- DEF_FEAT(KMAC_EAES_128, "kmac-eaes-128", KMAC, 26, "KMAC Encrypted-AES-128")
- DEF_FEAT(KMAC_EAES_192, "kmac-eaes-192", KMAC, 27, "KMAC Encrypted-AES-192")
- DEF_FEAT(KMAC_EAES_256, "kmac-eaes-256", KMAC, 28, "KMAC Encrypted-AES-256")
-+DEF_FEAT(KMAC_HMAC_SHA_224, "kmac-hmac-sha-224", KMAC, 112, "KMAC HMAC-SHA-224")
-+DEF_FEAT(KMAC_HMAC_SHA_256, "kmac-hmac-sha-246", KMAC, 113, "KMAC HMAC-SHA-256")
-+DEF_FEAT(KMAC_HMAC_SHA_384, "kmac-hmac-sha-384", KMAC, 114, "KMAC HMAC-SHA-384")
-+DEF_FEAT(KMAC_HMAC_SHA_512, "kmac-hmac-sha-512", KMAC, 115, "KMAC HMAC-SHA-512")
-+DEF_FEAT(KMAC_HMAC_ESHA_224, "kmac-hmac-esha-224", KMAC, 120, "KMAC HMAC-Encrypted-SHA-224")
-+DEF_FEAT(KMAC_HMAC_ESHA_256, "kmac-hmac-esha-246", KMAC, 121, "KMAC HMAC-Encrypted-SHA-256")
-+DEF_FEAT(KMAC_HMAC_ESHA_384, "kmac-hmac-esha-384", KMAC, 122, "KMAC HMAC-Encrypted-SHA-384")
-+DEF_FEAT(KMAC_HMAC_ESHA_512, "kmac-hmac-esha-512", KMAC, 123, "KMAC HMAC-Encrypted-SHA-512")
- 
- /* Features exposed via the KMC instruction. */
- DEF_FEAT(KMC_DEA, "kmc-dea", KMC, 1, "KMC DEA")
-@@ -275,6 +283,8 @@ DEF_FEAT(PCKMO_ECC_P384, "pckmo-ecc-p384", PCKMO, 33, "PCKMO Encrypt-ECC-P384-Ke
- DEF_FEAT(PCKMO_ECC_P521, "pckmo-ecc-p521", PCKMO, 34, "PCKMO Encrypt-ECC-P521-Key")
- DEF_FEAT(PCKMO_ECC_ED25519, "pckmo-ecc-ed25519", PCKMO, 40 , "PCKMO Encrypt-ECC-Ed25519-Key")
- DEF_FEAT(PCKMO_ECC_ED448, "pckmo-ecc-ed448", PCKMO, 41 , "PCKMO Encrypt-ECC-Ed448-Key")
-+DEF_FEAT(PCKMO_HMAC_512, "pckmo-hmac-512", PCKMO, 118, "PCKMO Encrypt-HMAC-512-Key")
-+DEF_FEAT(PCKMO_HMAC_1024, "pckmo-hmac-1024", PCKMO, 122, "PCKMO Encrypt-HMAC-1024-Key")
- 
- /* Features exposed via the KMCTR instruction. */
- DEF_FEAT(KMCTR_DEA, "kmctr-dea", KMCTR, 1, "KMCTR DEA")
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index 313640ca12..93fbe7e6c8 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -480,6 +480,14 @@ static void check_consistency(const S390CPUModel *model)
-         { S390_FEAT_KLMD_SHA3_512, S390_FEAT_MSA },
-         { S390_FEAT_KLMD_SHAKE_128, S390_FEAT_MSA },
-         { S390_FEAT_KLMD_SHAKE_256, S390_FEAT_MSA },
-+        { S390_FEAT_KMAC_HMAC_SHA_224, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_SHA_256, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_SHA_384, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_SHA_512, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_ESHA_224, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_ESHA_256, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_ESHA_384, S390_FEAT_MSA_EXT_3 },
-+        { S390_FEAT_KMAC_HMAC_ESHA_512, S390_FEAT_MSA_EXT_3 },
-         { S390_FEAT_KM_FULL_XTS_AES_128, S390_FEAT_MSA_EXT_4 },
-         { S390_FEAT_KM_FULL_XTS_AES_256, S390_FEAT_MSA_EXT_4 },
-         { S390_FEAT_KM_FULL_XTS_EAES_128, S390_FEAT_MSA_EXT_4 },
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 06c3bf64f3..d6305f945a 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -256,6 +256,20 @@
-     S390_FEAT_PCKMO_AES_XTS_128_DK, \
-     S390_FEAT_PCKMO_AES_XTS_256_DK
- 
-+#define S390_FEAT_GROUP_MSA_EXT_11 \
-+    S390_FEAT_KMAC_HMAC_SHA_224, \
-+    S390_FEAT_KMAC_HMAC_SHA_256, \
-+    S390_FEAT_KMAC_HMAC_SHA_384, \
-+    S390_FEAT_KMAC_HMAC_SHA_512, \
-+    S390_FEAT_KMAC_HMAC_ESHA_224, \
-+    S390_FEAT_KMAC_HMAC_ESHA_256, \
-+    S390_FEAT_KMAC_HMAC_ESHA_384, \
-+    S390_FEAT_KMAC_HMAC_ESHA_512
-+
-+#define S390_FEAT_GROUP_MSA_EXT_11_PCKMO \
-+    S390_FEAT_PCKMO_HMAC_512, \
-+    S390_FEAT_PCKMO_HMAC_1024
-+
- #define S390_FEAT_GROUP_ENH_SORT \
-     S390_FEAT_ESORT_BASE, \
-     S390_FEAT_SORTL_SFLR, \
-@@ -321,6 +335,10 @@ static uint16_t group_MSA_EXT_10[] = {
-     S390_FEAT_GROUP_MSA_EXT_10,
- };
- 
-+static uint16_t group_MSA_EXT_11[] = {
-+    S390_FEAT_GROUP_MSA_EXT_11,
-+};
-+
- static uint16_t group_MSA_EXT_9_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
- };
-@@ -329,6 +347,10 @@ static uint16_t group_MSA_EXT_10_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
- };
- 
-+static uint16_t group_MSA_EXT_11_PCKMO[] = {
-+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
-+};
-+
- static uint16_t group_ENH_SORT[] = {
-     S390_FEAT_GROUP_ENH_SORT,
- };
-@@ -878,6 +900,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(MSA_EXT_9_PCKMO),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_10),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_11),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
-     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
-     FEAT_GROUP_INITIALIZER(ENH_SORT),
-     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-msa12-changes.patch b/kvm-s390x-cpumodel-add-msa12-changes.patch
deleted file mode 100644
index 9363031..0000000
--- a/kvm-s390x-cpumodel-add-msa12-changes.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 0d5a636211e9f21547a077c8c5ab244b59f747f3 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:39 +0100
-Subject: [PATCH 04/19] s390x/cpumodel: add msa12 changes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [4/16] 32004bb7366a66319c54a0f23ad16f2ad093aa5e (thuth/qemu-kvm-cs9)
-
-MSA12 changes the KIMD/KLMD instruction format for SHA3/SHAKE.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Message-ID: <20241206122751.189721-4-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 496fc02e0e532f8917fa96e45fa531231e821c31)
----
- target/s390x/cpu_features.c         | 1 +
- target/s390x/cpu_features_def.h.inc | 1 +
- target/s390x/gen-features.c         | 8 ++++++++
- 3 files changed, 10 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index 36930feccd..0e0b37ab95 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -256,6 +256,7 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("msa10_pckmo", MSA_EXT_10_PCKMO, "Message-security-assist-extension 10 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
-     FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
-+    FEAT_GROUP_INIT("msa12", MSA_EXT_12, "Message-security-assist-extension 12 facility"),
-     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
-     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
-     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 15ea51fc54..2e5dc96984 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -90,6 +90,7 @@ DEF_FEAT(EDAT_2, "edat2", STFL, 78, "Enhanced-DAT facility 2")
- DEF_FEAT(DFP_PACKED_CONVERSION, "dfppc", STFL, 80, "Decimal-floating-point packed-conversion facility")
- DEF_FEAT(PPA15, "ppa15", STFL, 81, "PPA15 is installed")
- DEF_FEAT(BPB, "bpb", STFL, 82, "Branch prediction blocking")
-+DEF_FEAT(MSA_EXT_12, "msa12-base", STFL, 86, "Message-security-assist-extension-12 facility (excluding subfunctions)")
- DEF_FEAT(VECTOR, "vx", STFL, 129, "Vector facility")
- DEF_FEAT(INSTRUCTION_EXEC_PROT, "iep", STFL, 130, "Instruction-execution-protection facility")
- DEF_FEAT(SIDE_EFFECT_ACCESS_ESOP2, "sea_esop2", STFL, 131, "Side-effect-access facility and Enhanced-suppression-on-protection facility 2")
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index d6305f945a..ab9ad51d5e 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -270,6 +270,9 @@
-     S390_FEAT_PCKMO_HMAC_512, \
-     S390_FEAT_PCKMO_HMAC_1024
- 
-+#define S390_FEAT_GROUP_MSA_EXT_12 \
-+    S390_FEAT_MSA_EXT_12
-+
- #define S390_FEAT_GROUP_ENH_SORT \
-     S390_FEAT_ESORT_BASE, \
-     S390_FEAT_SORTL_SFLR, \
-@@ -339,6 +342,10 @@ static uint16_t group_MSA_EXT_11[] = {
-     S390_FEAT_GROUP_MSA_EXT_11,
- };
- 
-+static uint16_t group_MSA_EXT_12[] = {
-+    S390_FEAT_GROUP_MSA_EXT_12,
-+};
-+
- static uint16_t group_MSA_EXT_9_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
- };
-@@ -902,6 +909,7 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(MSA_EXT_10_PCKMO),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_11),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_12),
-     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
-     FEAT_GROUP_INITIALIZER(ENH_SORT),
-     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-add-msa13-subfunctions.patch b/kvm-s390x-cpumodel-add-msa13-subfunctions.patch
deleted file mode 100644
index eff2cf6..0000000
--- a/kvm-s390x-cpumodel-add-msa13-subfunctions.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-From 8c33d73160a6cf737c1519c10430378ff4ee13f9 Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:40 +0100
-Subject: [PATCH 05/19] s390x/cpumodel: add msa13 subfunctions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [5/16] ccd6aeea425b605d0c6155ef8e386b22394e210e (thuth/qemu-kvm-cs9)
-
-MSA13 introduces query authentication information (QAI) subfunctions.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-5-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit ba4614fdacc2ea55060ddb48bdb2ebd21d0c3464)
----
- target/s390x/cpu_features.c         |  2 ++
- target/s390x/cpu_features_def.h.inc | 12 ++++++++++++
- target/s390x/gen-features.c         | 26 ++++++++++++++++++++++++++
- 3 files changed, 40 insertions(+)
-
-diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
-index 0e0b37ab95..9ba127e386 100644
---- a/target/s390x/cpu_features.c
-+++ b/target/s390x/cpu_features.c
-@@ -257,6 +257,8 @@ static S390FeatGroupDef s390_feature_groups[] = {
-     FEAT_GROUP_INIT("msa11", MSA_EXT_11, "Message-security-assist-extension 11 facility"),
-     FEAT_GROUP_INIT("msa11_pckmo", MSA_EXT_11_PCKMO, "Message-security-assist-extension 11 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("msa12", MSA_EXT_12, "Message-security-assist-extension 12 facility"),
-+    FEAT_GROUP_INIT("msa13", MSA_EXT_13, "Message-security-assist-extension 13 facility"),
-+    FEAT_GROUP_INIT("msa13_pckmo", MSA_EXT_13_PCKMO, "Message-security-assist-extension 13 PCKMO subfunctions"),
-     FEAT_GROUP_INIT("mepochptff", MULTIPLE_EPOCH_PTFF, "PTFF enhancements introduced with Multiple-epoch facility"),
-     FEAT_GROUP_INIT("esort", ENH_SORT, "Enhanced-sort facility"),
-     FEAT_GROUP_INIT("deflate", DEFLATE_CONVERSION, "Deflate-conversion facility"),
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 2e5dc96984..2132837ffe 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -209,6 +209,7 @@ DEF_FEAT(KMAC_HMAC_ESHA_224, "kmac-hmac-esha-224", KMAC, 120, "KMAC HMAC-Encrypt
- DEF_FEAT(KMAC_HMAC_ESHA_256, "kmac-hmac-esha-246", KMAC, 121, "KMAC HMAC-Encrypted-SHA-256")
- DEF_FEAT(KMAC_HMAC_ESHA_384, "kmac-hmac-esha-384", KMAC, 122, "KMAC HMAC-Encrypted-SHA-384")
- DEF_FEAT(KMAC_HMAC_ESHA_512, "kmac-hmac-esha-512", KMAC, 123, "KMAC HMAC-Encrypted-SHA-512")
-+DEF_FEAT(KMAC_QAI, "kmac-qai", KMAC, 127, "KMAC Query-Authentication-Information")
- 
- /* Features exposed via the KMC instruction. */
- DEF_FEAT(KMC_DEA, "kmc-dea", KMC, 1, "KMC DEA")
-@@ -246,6 +247,7 @@ DEF_FEAT(KM_FULL_XTS_AES_128, "km-full-xts-aes-128", KM, 82, "KM Full-XTS-AES-12
- DEF_FEAT(KM_FULL_XTS_AES_256, "km-full-xts-aes-256", KM, 84, "KM Full-XTS-AES-256")
- DEF_FEAT(KM_FULL_XTS_EAES_128, "km-full-xts-eaes-128", KM, 90, "KM Full-XTS-Encrypted-AES-128")
- DEF_FEAT(KM_FULL_XTS_EAES_256, "km-full-xts-eaes-256", KM, 92, "KM Full-XTS-Encrypted-AES-256")
-+DEF_FEAT(KM_QAI, "km-qai", KM, 127, "KM Query-Authentication-Information")
- 
- /* Features exposed via the KIMD instruction. */
- DEF_FEAT(KIMD_SHA_1, "kimd-sha-1", KIMD, 1, "KIMD SHA-1")
-@@ -258,6 +260,7 @@ DEF_FEAT(KIMD_SHA3_512, "kimd-sha3-512", KIMD, 35, "KIMD SHA3-512")
- DEF_FEAT(KIMD_SHAKE_128, "kimd-shake-128", KIMD, 36, "KIMD SHAKE-128")
- DEF_FEAT(KIMD_SHAKE_256, "kimd-shake-256", KIMD, 37, "KIMD SHAKE-256")
- DEF_FEAT(KIMD_GHASH, "kimd-ghash", KIMD, 65, "KIMD GHASH")
-+DEF_FEAT(KIMD_QAI, "kimd-qai", KIMD, 127, "KIMD Query-Authentication-Information")
- 
- /* Features exposed via the KLMD instruction. */
- DEF_FEAT(KLMD_SHA_1, "klmd-sha-1", KLMD, 1, "KLMD SHA-1")
-@@ -269,6 +272,7 @@ DEF_FEAT(KLMD_SHA3_384, "klmd-sha3-384", KLMD, 34, "KLMD SHA3-384")
- DEF_FEAT(KLMD_SHA3_512, "klmd-sha3-512", KLMD, 35, "KLMD SHA3-512")
- DEF_FEAT(KLMD_SHAKE_128, "klmd-shake-128", KLMD, 36, "KLMD SHAKE-128")
- DEF_FEAT(KLMD_SHAKE_256, "klmd-shake-256", KLMD, 37, "KLMD SHAKE-256")
-+DEF_FEAT(KLMD_QAI, "klmd-qai", KLMD, 127, "KLMD Query-Authentication-Information")
- 
- /* Features exposed via the PCKMO instruction. */
- DEF_FEAT(PCKMO_EDEA, "pckmo-edea", PCKMO, 1, "PCKMO Encrypted-DEA-Key")
-@@ -286,6 +290,7 @@ DEF_FEAT(PCKMO_ECC_ED25519, "pckmo-ecc-ed25519", PCKMO, 40 , "PCKMO Encrypt-ECC-
- DEF_FEAT(PCKMO_ECC_ED448, "pckmo-ecc-ed448", PCKMO, 41 , "PCKMO Encrypt-ECC-Ed448-Key")
- DEF_FEAT(PCKMO_HMAC_512, "pckmo-hmac-512", PCKMO, 118, "PCKMO Encrypt-HMAC-512-Key")
- DEF_FEAT(PCKMO_HMAC_1024, "pckmo-hmac-1024", PCKMO, 122, "PCKMO Encrypt-HMAC-1024-Key")
-+DEF_FEAT(PCKMO_QAI, "pckmo-qai", PCKMO, 127, "PCKMO Query-Authentication-Information")
- 
- /* Features exposed via the KMCTR instruction. */
- DEF_FEAT(KMCTR_DEA, "kmctr-dea", KMCTR, 1, "KMCTR DEA")
-@@ -300,6 +305,7 @@ DEF_FEAT(KMCTR_AES_256, "kmctr-aes-256", KMCTR, 20, "KMCTR AES-256")
- DEF_FEAT(KMCTR_EAES_128, "kmctr-eaes-128", KMCTR, 26, "KMCTR Encrypted-AES-128")
- DEF_FEAT(KMCTR_EAES_192, "kmctr-eaes-192", KMCTR, 27, "KMCTR Encrypted-AES-192")
- DEF_FEAT(KMCTR_EAES_256, "kmctr-eaes-256", KMCTR, 28, "KMCTR Encrypted-AES-256")
-+DEF_FEAT(KMCTR_QAI, "kmctr-qai", KMCTR, 127, "KMCTR Query-Authentication-Information")
- 
- /* Features exposed via the KMF instruction. */
- DEF_FEAT(KMF_DEA, "kmf-dea", KMF, 1, "KMF DEA")
-@@ -314,6 +320,7 @@ DEF_FEAT(KMF_AES_256, "kmf-aes-256", KMF, 20, "KMF AES-256")
- DEF_FEAT(KMF_EAES_128, "kmf-eaes-128", KMF, 26, "KMF Encrypted-AES-128")
- DEF_FEAT(KMF_EAES_192, "kmf-eaes-192", KMF, 27, "KMF Encrypted-AES-192")
- DEF_FEAT(KMF_EAES_256, "kmf-eaes-256", KMF, 28, "KMF Encrypted-AES-256")
-+DEF_FEAT(KMF_QAI, "kmf-qai", KMF, 127, "KMF Query-Authentication-Information")
- 
- /* Features exposed via the KMO instruction. */
- DEF_FEAT(KMO_DEA, "kmo-dea", KMO, 1, "KMO DEA")
-@@ -328,6 +335,7 @@ DEF_FEAT(KMO_AES_256, "kmo-aes-256", KMO, 20, "KMO AES-256")
- DEF_FEAT(KMO_EAES_128, "kmo-eaes-128", KMO, 26, "KMO Encrypted-AES-128")
- DEF_FEAT(KMO_EAES_192, "kmo-eaes-192", KMO, 27, "KMO Encrypted-AES-192")
- DEF_FEAT(KMO_EAES_256, "kmo-eaes-256", KMO, 28, "KMO Encrypted-AES-256")
-+DEF_FEAT(KMO_QAI, "kmo-qai", KMO, 127, "KMO Query-Authentication-Information")
- 
- /* Features exposed via the PCC instruction. */
- DEF_FEAT(PCC_CMAC_DEA, "pcc-cmac-dea", PCC, 1, "PCC Compute-Last-Block-CMAC-Using-DEA")
-@@ -353,11 +361,13 @@ DEF_FEAT(PCC_SCALAR_MULT_ED25519, "pcc-scalar-mult-ed25519", PCC, 72, "PCC Scala
- DEF_FEAT(PCC_SCALAR_MULT_ED448, "pcc-scalar-mult-ed448", PCC, 73, "PCC Scalar-Multiply-Ed448")
- DEF_FEAT(PCC_SCALAR_MULT_X25519, "pcc-scalar-mult-x25519", PCC, 80, "PCC Scalar-Multiply-X25519")
- DEF_FEAT(PCC_SCALAR_MULT_X448, "pcc-scalar-mult-x448", PCC, 81, "PCC Scalar-Multiply-X448")
-+DEF_FEAT(PCC_QAI, "pcc-qai", PCC, 127, "PCC Query-Authentication-Information")
- 
- /* Features exposed via the PPNO/PRNO instruction. */
- DEF_FEAT(PPNO_SHA_512_DRNG, "ppno-sha-512-drng", PPNO, 3, "PPNO SHA-512-DRNG")
- DEF_FEAT(PRNO_TRNG_QRTCR, "prno-trng-qrtcr", PPNO, 112, "PRNO TRNG-Query-Raw-to-Conditioned-Ratio")
- DEF_FEAT(PRNO_TRNG, "prno-trng", PPNO, 114, "PRNO TRNG")
-+DEF_FEAT(PRNO_QAI, "prno-qai", PPNO, 127, "PRNO Query-Authentication-Information")
- 
- /* Features exposed via the KMA instruction. */
- DEF_FEAT(KMA_GCM_AES_128, "kma-gcm-aes-128", KMA, 18, "KMA GCM-AES-128")
-@@ -366,6 +376,7 @@ DEF_FEAT(KMA_GCM_AES_256, "kma-gcm-aes-256", KMA, 20, "KMA GCM-AES-256")
- DEF_FEAT(KMA_GCM_EAES_128, "kma-gcm-eaes-128", KMA, 26, "KMA GCM-Encrypted-AES-128")
- DEF_FEAT(KMA_GCM_EAES_192, "kma-gcm-eaes-192", KMA, 27, "KMA GCM-Encrypted-AES-192")
- DEF_FEAT(KMA_GCM_EAES_256, "kma-gcm-eaes-256", KMA, 28, "KMA GCM-Encrypted-AES-256")
-+DEF_FEAT(KMA_QAI, "kma-qai", KMA, 127, "KMA Query-Authentication-Information")
- 
- /* Features exposed via the KDSA instruction. */
- DEF_FEAT(KDSA_ECDSA_VERIFY_P256, "kdsa-ecdsa-verify-p256", KDSA, 1, "KDSA ECDSA-Verify-P256")
-@@ -383,6 +394,7 @@ DEF_FEAT(KDSA_EDDSA_SIGN_ED25519, "kdsa-eddsa-sign-ed25519", KDSA, 40, "KDSA EdD
- DEF_FEAT(KDSA_EDDSA_SIGN_ED448, "kdsa-eddsa-sign-ed448", KDSA, 44, "KDSA EdDSA-Sign-Ed448")
- DEF_FEAT(KDSA_EEDDSA_SIGN_ED25519, "kdsa-eeddsa-sign-ed25519", KDSA, 48, "KDSA Encrypted-EdDSA-Sign-Ed25519")
- DEF_FEAT(KDSA_EEDDSA_SIGN_ED448, "kdsa-eeddsa-sign-ed448", KDSA, 52, "KDSA Encrypted-EdDSA-Sign-Ed448")
-+DEF_FEAT(KDSA_QAI, "kdsa-qai", KDSA, 127, "KDSA Query-Authentication-Information")
- 
- /* Features exposed via the SORTL instruction. */
- DEF_FEAT(SORTL_SFLR, "sortl-sflr", SORTL, 1, "SORTL SFLR")
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index ab9ad51d5e..3326e7df43 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -273,6 +273,22 @@
- #define S390_FEAT_GROUP_MSA_EXT_12 \
-     S390_FEAT_MSA_EXT_12
- 
-+#define S390_FEAT_GROUP_MSA_EXT_13 \
-+    S390_FEAT_KDSA_QAI, \
-+    S390_FEAT_KIMD_QAI, \
-+    S390_FEAT_KLMD_QAI, \
-+    S390_FEAT_KMAC_QAI, \
-+    S390_FEAT_KMA_QAI, \
-+    S390_FEAT_KMCTR_QAI, \
-+    S390_FEAT_KMF_QAI, \
-+    S390_FEAT_KMO_QAI, \
-+    S390_FEAT_KM_QAI, \
-+    S390_FEAT_PCC_QAI, \
-+    S390_FEAT_PRNO_QAI
-+
-+#define S390_FEAT_GROUP_MSA_EXT_13_PCKMO \
-+    S390_FEAT_PCKMO_QAI
-+
- #define S390_FEAT_GROUP_ENH_SORT \
-     S390_FEAT_ESORT_BASE, \
-     S390_FEAT_SORTL_SFLR, \
-@@ -346,6 +362,10 @@ static uint16_t group_MSA_EXT_12[] = {
-     S390_FEAT_GROUP_MSA_EXT_12,
- };
- 
-+static uint16_t group_MSA_EXT_13[] = {
-+    S390_FEAT_GROUP_MSA_EXT_13,
-+};
-+
- static uint16_t group_MSA_EXT_9_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
- };
-@@ -358,6 +378,10 @@ static uint16_t group_MSA_EXT_11_PCKMO[] = {
-     S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
- };
- 
-+static uint16_t group_MSA_EXT_13_PCKMO[] = {
-+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
-+};
-+
- static uint16_t group_ENH_SORT[] = {
-     S390_FEAT_GROUP_ENH_SORT,
- };
-@@ -910,6 +934,8 @@ static FeatGroupDefSpec FeatGroupDef[] = {
-     FEAT_GROUP_INITIALIZER(MSA_EXT_11),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_11_PCKMO),
-     FEAT_GROUP_INITIALIZER(MSA_EXT_12),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_13),
-+    FEAT_GROUP_INITIALIZER(MSA_EXT_13_PCKMO),
-     FEAT_GROUP_INITIALIZER(MULTIPLE_EPOCH_PTFF),
-     FEAT_GROUP_INITIALIZER(ENH_SORT),
-     FEAT_GROUP_INITIALIZER(DEFLATE_CONVERSION),
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-correct-PLO-feature-wording.patch b/kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
deleted file mode 100644
index 5549f39..0000000
--- a/kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 148121817c34fa55226b2f02fd6d3f987e95fb3c Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:49 +0100
-Subject: [PATCH 14/19] s390x/cpumodel: correct PLO feature wording
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [14/16] a30038e374c8ee61d3c8f0546f55ec5ab5b73421 (thuth/qemu-kvm-cs9)
-
-The PLO functions 0, 4, 8, 12, 16, and 20 use 32-bit registers
-values.  The plo-*gr variants use 64-bit instead and, thus, correct
-the wording.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
-Message-ID: <20241206122751.189721-14-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 5a0a136df71b858d01f346af4a30ae1da23e8b3c)
----
- target/s390x/cpu_features_def.h.inc | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
-index 09a80844a7..fe7e1bd19c 100644
---- a/target/s390x/cpu_features_def.h.inc
-+++ b/target/s390x/cpu_features_def.h.inc
-@@ -158,27 +158,27 @@ DEF_FEAT(AP, "ap", MISC, 0, "AP instructions installed")
- /* Features exposed via the PLO instruction. */
- DEF_FEAT(PLO_CL, "plo-cl", PLO, 0, "PLO Compare and load (32 bit in general registers)")
- DEF_FEAT(PLO_CLG, "plo-clg", PLO, 1, "PLO Compare and load (64 bit in parameter list)")
--DEF_FEAT(PLO_CLGR, "plo-clgr", PLO, 2, "PLO Compare and load (32 bit in general registers)")
-+DEF_FEAT(PLO_CLGR, "plo-clgr", PLO, 2, "PLO Compare and load (64 bit in general registers)")
- DEF_FEAT(PLO_CLX, "plo-clx", PLO, 3, "PLO Compare and load (128 bit in parameter list)")
- DEF_FEAT(PLO_CS, "plo-cs", PLO, 4, "PLO Compare and swap (32 bit in general registers)")
- DEF_FEAT(PLO_CSG, "plo-csg", PLO, 5, "PLO Compare and swap (64 bit in parameter list)")
--DEF_FEAT(PLO_CSGR, "plo-csgr", PLO, 6, "PLO Compare and swap (32 bit in general registers)")
-+DEF_FEAT(PLO_CSGR, "plo-csgr", PLO, 6, "PLO Compare and swap (64 bit in general registers)")
- DEF_FEAT(PLO_CSX, "plo-csx", PLO, 7, "PLO Compare and swap (128 bit in parameter list)")
- DEF_FEAT(PLO_DCS, "plo-dcs", PLO, 8, "PLO Double compare and swap (32 bit in general registers)")
- DEF_FEAT(PLO_DCSG, "plo-dcsg", PLO, 9, "PLO Double compare and swap (64 bit in parameter list)")
--DEF_FEAT(PLO_DCSGR, "plo-dcsgr", PLO, 10, "PLO Double compare and swap (32 bit in general registers)")
-+DEF_FEAT(PLO_DCSGR, "plo-dcsgr", PLO, 10, "PLO Double compare and swap (64 bit in general registers)")
- DEF_FEAT(PLO_DCSX, "plo-dcsx", PLO, 11, "PLO Double compare and swap (128 bit in parameter list)")
- DEF_FEAT(PLO_CSST, "plo-csst", PLO, 12, "PLO Compare and swap and store (32 bit in general registers)")
- DEF_FEAT(PLO_CSSTG, "plo-csstg", PLO, 13, "PLO Compare and swap and store (64 bit in parameter list)")
--DEF_FEAT(PLO_CSSTGR, "plo-csstgr", PLO, 14, "PLO Compare and swap and store (32 bit in general registers)")
-+DEF_FEAT(PLO_CSSTGR, "plo-csstgr", PLO, 14, "PLO Compare and swap and store (64 bit in general registers)")
- DEF_FEAT(PLO_CSSTX, "plo-csstx", PLO, 15, "PLO Compare and swap and store (128 bit in parameter list)")
- DEF_FEAT(PLO_CSDST, "plo-csdst", PLO, 16, "PLO Compare and swap and double store (32 bit in general registers)")
- DEF_FEAT(PLO_CSDSTG, "plo-csdstg", PLO, 17, "PLO Compare and swap and double store (64 bit in parameter list)")
--DEF_FEAT(PLO_CSDSTGR, "plo-csdstgr", PLO, 18, "PLO Compare and swap and double store (32 bit in general registers)")
-+DEF_FEAT(PLO_CSDSTGR, "plo-csdstgr", PLO, 18, "PLO Compare and swap and double store (64 bit in general registers)")
- DEF_FEAT(PLO_CSDSTX, "plo-csdstx", PLO, 19, "PLO Compare and swap and double store (128 bit in parameter list)")
- DEF_FEAT(PLO_CSTST, "plo-cstst", PLO, 20, "PLO Compare and swap and triple store (32 bit in general registers)")
- DEF_FEAT(PLO_CSTSTG, "plo-cststg", PLO, 21, "PLO Compare and swap and triple store (64 bit in parameter list)")
--DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (32 bit in general registers)")
-+DEF_FEAT(PLO_CSTSTGR, "plo-cststgr", PLO, 22, "PLO Compare and swap and triple store (64 bit in general registers)")
- DEF_FEAT(PLO_CSTSTX, "plo-cststx", PLO, 23, "PLO Compare and swap and triple store (128 bit in parameter list)")
- 
- /* Features exposed via the PTFF instruction. */
--- 
-2.39.3
-
diff --git a/kvm-s390x-cpumodel-gen17-model.patch b/kvm-s390x-cpumodel-gen17-model.patch
deleted file mode 100644
index 8a63b9e..0000000
--- a/kvm-s390x-cpumodel-gen17-model.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 1b45ebaf1903c54a37f5a4324242cb17caf1064e Mon Sep 17 00:00:00 2001
-From: Hendrik Brueckner <brueckner@linux.ibm.com>
-Date: Fri, 6 Dec 2024 13:27:51 +0100
-Subject: [PATCH 16/19] s390x/cpumodel: gen17 model
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 304: CPU model for new IBM Z gen17 hardware
-RH-Jira: RHEL-50212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [16/16] c8cc00616e56ab99971aa930938b8ee36f9a909b (thuth/qemu-kvm-cs9)
-
-This commit introduces the definition of the gen17a/gen17b CPU model.
-
-Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
-Message-ID: <20241206122751.189721-16-brueckner@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit 21b8db229901a51f16aebe342c0508f588ea5006)
----
- target/s390x/cpu_models.c   |  2 ++
- target/s390x/gen-features.c | 33 +++++++++++++++++++++++++++++++++
- 2 files changed, 35 insertions(+)
-
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index d2798c0f38..14c4d63a5a 100644
---- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -97,6 +97,8 @@ static S390CPUDef s390_cpu_defs[] = {
-     CPUDEF_INIT(0x8562, 15, 1, 47, 0x08000000U, "gen15b", "IBM z15 T02 GA1"),
-     CPUDEF_INIT(0x3931, 16, 1, 47, 0x08000000U, "gen16a", "IBM 3931 GA1"),
-     CPUDEF_INIT(0x3932, 16, 1, 47, 0x08000000U, "gen16b", "IBM 3932 GA1"),
-+    CPUDEF_INIT(0x9175, 17, 1, 47, 0x08000000U, "gen17a", "IBM 9175 GA1"),
-+    CPUDEF_INIT(0x9176, 17, 1, 47, 0x08000000U, "gen17b", "IBM 9176 GA1"),
- };
- 
- #define QEMU_MAX_CPU_TYPE 0x8561
-diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
-index 680d45d303..41840677ce 100644
---- a/target/s390x/gen-features.c
-+++ b/target/s390x/gen-features.c
-@@ -561,6 +561,13 @@ static uint16_t base_GEN15_GA1[] = {
- 
- #define base_GEN16_GA1 EmptyFeat
- 
-+static uint16_t base_GEN17_GA1[] = {
-+    S390_FEAT_MISC_INSTRUCTION_EXT4,
-+    S390_FEAT_SIF,
-+    S390_FEAT_GROUP_MSA_EXT_12,
-+    S390_FEAT_GROUP_PLO_EXT,
-+};
-+
- /* Full features (in order of release)
-  * Automatically includes corresponding base features.
-  * Full features are all features this hardware supports even if kvm/QEMU do not
-@@ -715,6 +722,20 @@ static uint16_t full_GEN16_GA1[] = {
-     S390_FEAT_UV_FEAT_AP_INTR,
- };
- 
-+static uint16_t full_GEN17_GA1[] = {
-+    S390_FEAT_VECTOR_ENH3,
-+    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3,
-+    S390_FEAT_INEFF_NC_TX,
-+    S390_FEAT_GROUP_GEN17_PTFF,
-+    S390_FEAT_GROUP_MSA_EXT_10,
-+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
-+    S390_FEAT_GROUP_MSA_EXT_11,
-+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
-+    S390_FEAT_GROUP_MSA_EXT_13,
-+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
-+    S390_FEAT_GROUP_CONCURRENT_FUNCTIONS,
-+};
-+
- 
- /* Default features (in order of release)
-  * Automatically includes corresponding base features.
-@@ -810,6 +831,17 @@ static uint16_t default_GEN16_GA1[] = {
-     S390_FEAT_PAIE,
- };
- 
-+static uint16_t default_GEN17_GA1[] = {
-+    S390_FEAT_VECTOR_ENH3,
-+    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH3,
-+    S390_FEAT_GROUP_MSA_EXT_10,
-+    S390_FEAT_GROUP_MSA_EXT_10_PCKMO,
-+    S390_FEAT_GROUP_MSA_EXT_11,
-+    S390_FEAT_GROUP_MSA_EXT_11_PCKMO,
-+    S390_FEAT_GROUP_MSA_EXT_13,
-+    S390_FEAT_GROUP_MSA_EXT_13_PCKMO,
-+};
-+
- /* QEMU (CPU model) features */
- 
- static uint16_t qemu_V2_11[] = {
-@@ -958,6 +990,7 @@ static CpuFeatDefSpec CpuFeatDef[] = {
-     CPU_FEAT_INITIALIZER(GEN14_GA2),
-     CPU_FEAT_INITIALIZER(GEN15_GA1),
-     CPU_FEAT_INITIALIZER(GEN16_GA1),
-+    CPU_FEAT_INITIALIZER(GEN17_GA1),
- };
- 
- #define FEAT_GROUP_INITIALIZER(_name)                  \
--- 
-2.39.3
-
diff --git a/kvm-s390x-introduce-s390_get_memory_limit.patch b/kvm-s390x-introduce-s390_get_memory_limit.patch
deleted file mode 100644
index 8647d8e..0000000
--- a/kvm-s390x-introduce-s390_get_memory_limit.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From 1dd38383832fc27f2980f33bb5e10ec1af7e3fc3 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:07 +0100
-Subject: [PATCH 15/26] s390x: introduce s390_get_memory_limit()
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [15/26] 5ae6a624a6541283cb15e90ebeb8fef3940c823b (thuth/qemu-kvm-cs)
-
-Let's add s390_get_memory_limit(), to query what has been successfully
-set via s390_set_memory_limit(). Allow setting the limit only once.
-
-We'll remember the limit in the machine state. Move
-s390_set_memory_limit() to machine code, merging it into
-set_memory_limit(), because this really is a machine property.
-
-Message-ID: <20241219144115.2820241-7-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 27221b69a3ea49339a1f82b9622126f3928e0915)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c         | 17 ++++++++++++-----
- include/hw/s390x/s390-virtio-ccw.h |  8 ++++++++
- target/s390x/cpu-sysemu.c          |  8 --------
- target/s390x/cpu.h                 |  1 -
- 4 files changed, 20 insertions(+), 14 deletions(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 248ac28d20..f5f147eb92 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -45,6 +45,7 @@
- #include "migration/blocker.h"
- #include "qapi/visitor.h"
- #include "hw/s390x/cpu-topology.h"
-+#include "kvm/kvm_s390x.h"
- #include CONFIG_DEVICES
- 
- static Error *pv_mig_blocker;
-@@ -121,12 +122,16 @@ static void subsystem_reset(void)
-     }
- }
- 
--static void set_memory_limit(uint64_t new_limit)
-+static void s390_set_memory_limit(S390CcwMachineState *s390ms,
-+                                  uint64_t new_limit)
- {
--    uint64_t hw_limit;
--    int ret;
-+    uint64_t hw_limit = 0;
-+    int ret = 0;
- 
--    ret = s390_set_memory_limit(new_limit, &hw_limit);
-+    assert(!s390ms->memory_limit && new_limit);
-+    if (kvm_enabled()) {
-+        ret = kvm_s390_set_mem_limit(new_limit, &hw_limit);
-+    }
-     if (ret == -E2BIG) {
-         error_report("host supports a maximum of %" PRIu64 " GB",
-                      hw_limit / GiB);
-@@ -135,10 +140,12 @@ static void set_memory_limit(uint64_t new_limit)
-         error_report("setting the guest size failed");
-         exit(EXIT_FAILURE);
-     }
-+    s390ms->memory_limit = new_limit;
- }
- 
- static void s390_memory_init(MachineState *machine)
- {
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(machine);
-     MemoryRegion *sysmem = get_system_memory();
-     MemoryRegion *ram = machine->ram;
-     uint64_t ram_size = memory_region_size(ram);
-@@ -154,7 +161,7 @@ static void s390_memory_init(MachineState *machine)
-         exit(EXIT_FAILURE);
-     }
- 
--    set_memory_limit(ram_size);
-+    s390_set_memory_limit(s390ms, ram_size);
- 
-     /* Map the initial memory. Must happen after setting the memory limit. */
-     memory_region_add_subregion(sysmem, 0, ram);
-diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h
-index 996864a34e..de04336c5a 100644
---- a/include/hw/s390x/s390-virtio-ccw.h
-+++ b/include/hw/s390x/s390-virtio-ccw.h
-@@ -29,10 +29,18 @@ struct S390CcwMachineState {
-     bool dea_key_wrap;
-     bool pv;
-     uint8_t loadparm[8];
-+    uint64_t memory_limit;
- 
-     SCLPDevice *sclp;
- };
- 
-+static inline uint64_t s390_get_memory_limit(S390CcwMachineState *s390ms)
-+{
-+    /* We expect to be called only after the limit was set. */
-+    assert(s390ms->memory_limit);
-+    return s390ms->memory_limit;
-+}
-+
- #define S390_PTF_REASON_NONE (0x00 << 8)
- #define S390_PTF_REASON_DONE (0x01 << 8)
- #define S390_PTF_REASON_BUSY (0x02 << 8)
-diff --git a/target/s390x/cpu-sysemu.c b/target/s390x/cpu-sysemu.c
-index 1cd30c1d84..3118a25fee 100644
---- a/target/s390x/cpu-sysemu.c
-+++ b/target/s390x/cpu-sysemu.c
-@@ -255,14 +255,6 @@ unsigned int s390_cpu_set_state(uint8_t cpu_state, S390CPU *cpu)
-     return s390_count_running_cpus();
- }
- 
--int s390_set_memory_limit(uint64_t new_limit, uint64_t *hw_limit)
--{
--    if (kvm_enabled()) {
--        return kvm_s390_set_mem_limit(new_limit, hw_limit);
--    }
--    return 0;
--}
--
- void s390_set_max_pagesize(uint64_t pagesize, Error **errp)
- {
-     if (kvm_enabled()) {
-diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
-index 6a64472403..ecaf3191d2 100644
---- a/target/s390x/cpu.h
-+++ b/target/s390x/cpu.h
-@@ -881,7 +881,6 @@ static inline void s390_do_cpu_load_normal(CPUState *cs, run_on_cpu_data arg)
- 
- /* cpu.c */
- void s390_crypto_reset(void);
--int s390_set_memory_limit(uint64_t new_limit, uint64_t *hw_limit);
- void s390_set_max_pagesize(uint64_t pagesize, Error **errp);
- void s390_cmma_reset(void);
- void s390_enable_css_support(S390CPU *cpu);
--- 
-2.48.1
-
diff --git a/kvm-s390x-pci-add-support-for-guests-that-request-direct.patch b/kvm-s390x-pci-add-support-for-guests-that-request-direct.patch
deleted file mode 100644
index da8c553..0000000
--- a/kvm-s390x-pci-add-support-for-guests-that-request-direct.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From c60d0770ff3f9124e6e9d7beb03e1ef8067e8e26 Mon Sep 17 00:00:00 2001
-From: Christoph Schlameuss <cschlame@redhat.com>
-Date: Thu, 12 Jun 2025 13:25:32 +0200
-Subject: [PATCH 01/16] s390x/pci: add support for guests that request direct
- mapping
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Christoph Schlameuss <None>
-RH-MergeRequest: 376: Draft: KVM: Performance Enhanced Refresh PCI Translation
-RH-Jira: RHEL-11430
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [1/2] 11d1dd9a5add55ae43d5d922588a33945ecbfe27 (cschlame/qemu-kvm)
-
-JIRA: https://issues.redhat.com/browse/RHEL-11430
-Conflicts: hw/s390x/s390-pci-bus.c old s390_pci_device_properties[] still has DEFINE_PROP_END_OF_LIST()
-           hw/s390x/s390-pci-inst.c hw_accel.h is still in sysemu
-           hw/s390x/s390-virtio-ccw.c changes from ccw_machine_9_2_class_options() moved to ccw_rhel_machine_9_6_0_class_options()
-
-commit dfcee1ea4c52ac60e0a06221eafb7b6253eb10c3
-Author: Matthew Rosato <mjrosato@linux.ibm.com>
-Date:   Wed Feb 26 16:00:12 2025 -0500
-
-    s390x/pci: add support for guests that request direct mapping
-
-    When receiving a guest mpcifc(4) or mpcifc(6) instruction without the T
-    bit set, treat this as a request to perform direct mapping instead of
-    address translation.  In order to facilitate this, pin the entirety of
-    guest memory into the host iommu.
-
-    Pinning for the direct mapping case is handled via vfio and its memory
-    listener.  Additionally, ram discard settings are inherited from vfio:
-    coordinated discards (e.g. virtio-mem) are allowed while uncoordinated
-    discards (e.g. virtio-balloon) are disabled.
-
-    Subsequent guest DMA operations are all expected to be of the format
-    guest_phys+sdma, allowing them to be used as lookup into the host
-    iommu table.
-
-    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
-    Reviewed-by: David Hildenbrand <david@redhat.com>
-    Message-ID: <20250226210013.238349-2-mjrosato@linux.ibm.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
----
- hw/s390x/s390-pci-bus.c         | 39 +++++++++++++++++++++++++++++++--
- hw/s390x/s390-pci-inst.c        | 13 +++++++++--
- hw/s390x/s390-pci-vfio.c        | 23 +++++++++++++++----
- hw/s390x/s390-virtio-ccw.c      |  5 +++++
- include/hw/s390x/s390-pci-bus.h |  3 +++
- 5 files changed, 75 insertions(+), 8 deletions(-)
-
-diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
-index 3e57d5faca..13bc02d837 100644
---- a/hw/s390x/s390-pci-bus.c
-+++ b/hw/s390x/s390-pci-bus.c
-@@ -18,6 +18,8 @@
- #include "hw/s390x/s390-pci-inst.h"
- #include "hw/s390x/s390-pci-kvm.h"
- #include "hw/s390x/s390-pci-vfio.h"
-+#include "hw/s390x/s390-virtio-ccw.h"
-+#include "hw/boards.h"
- #include "hw/pci/pci_bus.h"
- #include "hw/qdev-properties.h"
- #include "hw/pci/pci_bridge.h"
-@@ -724,12 +726,42 @@ void s390_pci_iommu_enable(S390PCIIOMMU *iommu)
-     g_free(name);
- }
- 
-+void s390_pci_iommu_direct_map_enable(S390PCIIOMMU *iommu)
-+{
-+    MachineState *ms = MACHINE(qdev_get_machine());
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(ms);
-+
-+    /*
-+     * For direct-mapping we must map the entire guest address space.  Rather
-+     * than using an iommu, create a memory region alias that maps GPA X to
-+     * IOVA X + SDMA.  VFIO will handle pinning via its memory listener.
-+     */
-+    g_autofree char *name = g_strdup_printf("iommu-dm-s390-%04x",
-+                                            iommu->pbdev->uid);
-+
-+    iommu->dm_mr = g_malloc0(sizeof(*iommu->dm_mr));
-+    memory_region_init_alias(iommu->dm_mr, OBJECT(&iommu->mr), name,
-+                             get_system_memory(), 0,
-+                             s390_get_memory_limit(s390ms));
-+    iommu->enabled = true;
-+    memory_region_add_subregion(&iommu->mr, iommu->pbdev->zpci_fn.sdma,
-+                                iommu->dm_mr);
-+}
-+
- void s390_pci_iommu_disable(S390PCIIOMMU *iommu)
- {
-     iommu->enabled = false;
-     g_hash_table_remove_all(iommu->iotlb);
--    memory_region_del_subregion(&iommu->mr, MEMORY_REGION(&iommu->iommu_mr));
--    object_unparent(OBJECT(&iommu->iommu_mr));
-+    if (iommu->dm_mr) {
-+        memory_region_del_subregion(&iommu->mr, iommu->dm_mr);
-+        object_unparent(OBJECT(iommu->dm_mr));
-+        g_free(iommu->dm_mr);
-+        iommu->dm_mr = NULL;
-+    } else {
-+        memory_region_del_subregion(&iommu->mr,
-+                                    MEMORY_REGION(&iommu->iommu_mr));
-+        object_unparent(OBJECT(&iommu->iommu_mr));
-+    }
- }
- 
- static void s390_pci_iommu_free(S390pciState *s, PCIBus *bus, int32_t devfn)
-@@ -1130,6 +1162,7 @@ static void s390_pcihost_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
-             /* Always intercept emulated devices */
-             pbdev->interp = false;
-             pbdev->forwarding_assist = false;
-+            pbdev->rtr_avail = false;
-         }
- 
-         if (s390_pci_msix_init(pbdev) && !pbdev->interp) {
-@@ -1488,6 +1521,8 @@ static Property s390_pci_device_properties[] = {
-     DEFINE_PROP_BOOL("interpret", S390PCIBusDevice, interp, true),
-     DEFINE_PROP_BOOL("forwarding-assist", S390PCIBusDevice, forwarding_assist,
-                      true),
-+    DEFINE_PROP_BOOL("relaxed-translation", S390PCIBusDevice, rtr_avail,
-+                     true),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
-index 30149546c0..803ebcd9b3 100644
---- a/hw/s390x/s390-pci-inst.c
-+++ b/hw/s390x/s390-pci-inst.c
-@@ -16,6 +16,7 @@
- #include "exec/memory.h"
- #include "qemu/error-report.h"
- #include "sysemu/hw_accel.h"
-+#include "hw/boards.h"
- #include "hw/pci/pci_device.h"
- #include "hw/s390x/s390-pci-inst.h"
- #include "hw/s390x/s390-pci-bus.h"
-@@ -1008,17 +1009,25 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib,
-     }
- 
-     /* currently we only support designation type 1 with translation */
--    if (!(dt == ZPCI_IOTA_RTTO && t)) {
-+    if (t && dt != ZPCI_IOTA_RTTO) {
-         error_report("unsupported ioat dt %d t %d", dt, t);
-         s390_program_interrupt(env, PGM_OPERAND, ra);
-         return -EINVAL;
-+    } else if (!t && !pbdev->rtr_avail) {
-+        error_report("relaxed translation not allowed");
-+        s390_program_interrupt(env, PGM_OPERAND, ra);
-+        return -EINVAL;
-     }
- 
-     iommu->pba = pba;
-     iommu->pal = pal;
-     iommu->g_iota = g_iota;
- 
--    s390_pci_iommu_enable(iommu);
-+    if (t) {
-+        s390_pci_iommu_enable(iommu);
-+    } else {
-+        s390_pci_iommu_direct_map_enable(iommu);
-+    }
- 
-     return 0;
- }
-diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
-index 7dbbc76823..443e222912 100644
---- a/hw/s390x/s390-pci-vfio.c
-+++ b/hw/s390x/s390-pci-vfio.c
-@@ -131,13 +131,28 @@ static void s390_pci_read_base(S390PCIBusDevice *pbdev,
-     /* Store function type separately for type-specific behavior */
-     pbdev->pft = cap->pft;
- 
-+    /*
-+     * If the device is a passthrough ISM device, disallow relaxed
-+     * translation.
-+     */
-+    if (pbdev->pft == ZPCI_PFT_ISM) {
-+        pbdev->rtr_avail = false;
-+    }
-+
-     /*
-      * If appropriate, reduce the size of the supported DMA aperture reported
--     * to the guest based upon the vfio DMA limit.
-+     * to the guest based upon the vfio DMA limit.  This is applicable for
-+     * devices that are guaranteed to not use relaxed translation.  If the
-+     * device is capable of relaxed translation then we must advertise the
-+     * full aperture.  In this case, if translation is used then we will
-+     * rely on the vfio DMA limit counting and use RPCIT CC1 / status 16
-+     * to request that the guest free DMA mappings as necessary.
-      */
--    vfio_size = pbdev->iommu->max_dma_limit << TARGET_PAGE_BITS;
--    if (vfio_size > 0 && vfio_size < cap->end_dma - cap->start_dma + 1) {
--        pbdev->zpci_fn.edma = cap->start_dma + vfio_size - 1;
-+    if (!pbdev->rtr_avail) {
-+        vfio_size = pbdev->iommu->max_dma_limit << TARGET_PAGE_BITS;
-+        if (vfio_size > 0 && vfio_size < cap->end_dma - cap->start_dma + 1) {
-+            pbdev->zpci_fn.edma = cap->start_dma + vfio_size - 1;
-+        }
-     }
- }
- 
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 312e8f18aa..77a1bde71e 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1348,8 +1348,13 @@ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
- 
- static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
- {
-+    static GlobalProperty compat[] = {
-+        { TYPE_S390_PCI_DEVICE, "relaxed-translation", "off", },
-+    };
-+
-     /* NB: remember to move this line to the *latest* RHEL 9 machine */
-     compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
-+    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
- }
- DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
- 
-diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
-index 2c43ea123f..04944d4fed 100644
---- a/include/hw/s390x/s390-pci-bus.h
-+++ b/include/hw/s390x/s390-pci-bus.h
-@@ -277,6 +277,7 @@ struct S390PCIIOMMU {
-     AddressSpace as;
-     MemoryRegion mr;
-     IOMMUMemoryRegion iommu_mr;
-+    MemoryRegion *dm_mr;
-     bool enabled;
-     uint64_t g_iota;
-     uint64_t pba;
-@@ -362,6 +363,7 @@ struct S390PCIBusDevice {
-     bool interp;
-     bool forwarding_assist;
-     bool aif;
-+    bool rtr_avail;
-     QTAILQ_ENTRY(S390PCIBusDevice) link;
- };
- 
-@@ -389,6 +391,7 @@ int pci_chsc_sei_nt2_have_event(void);
- void s390_pci_sclp_configure(SCCB *sccb);
- void s390_pci_sclp_deconfigure(SCCB *sccb);
- void s390_pci_iommu_enable(S390PCIIOMMU *iommu);
-+void s390_pci_iommu_direct_map_enable(S390PCIIOMMU *iommu);
- void s390_pci_iommu_disable(S390PCIIOMMU *iommu);
- void s390_pci_generate_error_event(uint16_t pec, uint32_t fh, uint32_t fid,
-                                    uint64_t faddr, uint32_t e);
--- 
-2.48.1
-
diff --git a/kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch b/kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch
deleted file mode 100644
index 918fb63..0000000
--- a/kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 13e8ddbd282da692c8199a6cb9ca847334089e29 Mon Sep 17 00:00:00 2001
-From: Christoph Schlameuss <cschlame@redhat.com>
-Date: Thu, 12 Jun 2025 11:48:41 +0200
-Subject: [PATCH 02/16] s390x/pci: indicate QEMU supports relaxed translation
- for passthrough
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Christoph Schlameuss <None>
-RH-MergeRequest: 376: Draft: KVM: Performance Enhanced Refresh PCI Translation
-RH-Jira: RHEL-11430
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [2/2] afd514268347d0b434a60d7c6c09d20b84e5d902 (cschlame/qemu-kvm)
-
-JIRA: https://issues.redhat.com/browse/RHEL-11430
-
-commit d9b5dfc7122559e5b5959ecf534788b90c3dd102
-Author: Matthew Rosato <mjrosato@linux.ibm.com>
-Date:   Wed Feb 26 16:00:13 2025 -0500
-
-    s390x/pci: indicate QEMU supports relaxed translation for passthrough
-
-    Specifying this bit in the guest CLP response indicates that the guest
-    can optionally choose to skip translation and instead use
-    identity-mapped operations.
-
-    Tested-by: Niklas Schnelle <schnelle@linux.ibm.com>
-    Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
-    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
-    Message-ID: <20250226210013.238349-3-mjrosato@linux.ibm.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Christoph Schlameuss <cschlame@redhat.com>
----
- hw/s390x/s390-pci-vfio.c        | 5 ++++-
- include/hw/s390x/s390-pci-clp.h | 1 +
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
-index 443e222912..6236ac7f1e 100644
---- a/hw/s390x/s390-pci-vfio.c
-+++ b/hw/s390x/s390-pci-vfio.c
-@@ -238,8 +238,11 @@ static void s390_pci_read_group(S390PCIBusDevice *pbdev,
-         pbdev->pci_group = s390_group_create(pbdev->zpci_fn.pfgid, start_gid);
- 
-         resgrp = &pbdev->pci_group->zpci_group;
-+        if (pbdev->rtr_avail) {
-+            resgrp->fr |= CLP_RSP_QPCIG_MASK_RTR;
-+        }
-         if (cap->flags & VFIO_DEVICE_INFO_ZPCI_FLAG_REFRESH) {
--            resgrp->fr = 1;
-+            resgrp->fr |= CLP_RSP_QPCIG_MASK_REFRESH;
-         }
-         resgrp->dasm = cap->dasm;
-         resgrp->msia = cap->msi_addr;
-diff --git a/include/hw/s390x/s390-pci-clp.h b/include/hw/s390x/s390-pci-clp.h
-index 03b7f9ba5f..6a635d693b 100644
---- a/include/hw/s390x/s390-pci-clp.h
-+++ b/include/hw/s390x/s390-pci-clp.h
-@@ -158,6 +158,7 @@ typedef struct ClpRspQueryPciGrp {
- #define CLP_RSP_QPCIG_MASK_NOI 0xfff
-     uint16_t i;
-     uint8_t version;
-+#define CLP_RSP_QPCIG_MASK_RTR     0x20
- #define CLP_RSP_QPCIG_MASK_FRAME   0x2
- #define CLP_RSP_QPCIG_MASK_REFRESH 0x1
-     uint8_t fr;
--- 
-2.48.1
-
diff --git a/kvm-s390x-pv-prepare-for-memory-devices.patch b/kvm-s390x-pv-prepare-for-memory-devices.patch
deleted file mode 100644
index 16ff2c8..0000000
--- a/kvm-s390x-pv-prepare-for-memory-devices.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 9d5420c4370b74d60f082f2aa1225b19150ee629 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:12 +0100
-Subject: [PATCH 20/26] s390x/pv: prepare for memory devices
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [20/26] cdbe71168b9afa9657b94f1e7500568314c707a8 (thuth/qemu-kvm-cs)
-
-Let's avoid checking for the maxram_size, and instead rely on the memory
-limit determined in s390_memory_init(), that might be larger than
-maxram_size, for example due to alignment purposes.
-
-This check now correctly mimics what the kernel will check in
-kvm_s390_pv_set_aside(), whereby a VM <= 2 GiB VM would end up using
-a segment type ASCE.
-
-Message-ID: <20241219144115.2820241-12-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit a056332e732110c8ef0d40ffd49bd03afc2f04ca)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- target/s390x/kvm/pv.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
-index 424cce75ca..fa66607e7b 100644
---- a/target/s390x/kvm/pv.c
-+++ b/target/s390x/kvm/pv.c
-@@ -133,7 +133,7 @@ bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms)
-      * If the feature is not present or if the VM is not larger than 2 GiB,
-      * KVM_PV_ASYNC_CLEANUP_PREPARE fill fail; no point in attempting it.
-      */
--    if ((MACHINE(ms)->ram_size <= 2 * GiB) ||
-+    if (s390_get_memory_limit(ms) <= 2 * GiB ||
-         !kvm_check_extension(kvm_state, KVM_CAP_S390_PROTECTED_ASYNC_DISABLE)) {
-         return false;
-     }
--- 
-2.48.1
-
diff --git a/kvm-s390x-remember-the-maximum-page-size.patch b/kvm-s390x-remember-the-maximum-page-size.patch
deleted file mode 100644
index b2fd41e..0000000
--- a/kvm-s390x-remember-the-maximum-page-size.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 5a311d410bca4a5530a51c0b789ce8525d2d0653 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:13 +0100
-Subject: [PATCH 21/26] s390x: remember the maximum page size
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [21/26] 3b97c555b153d42e4fcb27dbb65fbf3edac622a4 (thuth/qemu-kvm-cs)
-
-Let's remember the value (successfully) set via s390_set_max_pagesize().
-This will be helpful to reject hotplugged memory devices that would exceed
-this initially set page size.
-
-Handle it just like how we handle s390_get_memory_limit(), storing it in
-the machine, and moving the handling to machine code.
-
-Message-ID: <20241219144115.2820241-13-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit df2ac211a62e6ced7f1495b634fa6f78962f2321)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c         | 12 +++++++++++-
- include/hw/s390x/s390-virtio-ccw.h |  1 +
- target/s390x/cpu-sysemu.c          |  7 -------
- target/s390x/cpu.h                 |  1 -
- 4 files changed, 12 insertions(+), 9 deletions(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 824c73536a..bd05a22b4e 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -143,6 +143,16 @@ static void s390_set_memory_limit(S390CcwMachineState *s390ms,
-     s390ms->memory_limit = new_limit;
- }
- 
-+static void s390_set_max_pagesize(S390CcwMachineState *s390ms,
-+                                  uint64_t pagesize)
-+{
-+    assert(!s390ms->max_pagesize && pagesize);
-+    if (kvm_enabled()) {
-+        kvm_s390_set_max_pagesize(pagesize, &error_fatal);
-+    }
-+    s390ms->max_pagesize = pagesize;
-+}
-+
- static void s390_memory_init(MachineState *machine)
- {
-     S390CcwMachineState *s390ms = S390_CCW_MACHINE(machine);
-@@ -191,7 +201,7 @@ static void s390_memory_init(MachineState *machine)
-      * Configure the maximum page size. As no memory devices were created
-      * yet, this is the page size of initial memory only.
-      */
--    s390_set_max_pagesize(qemu_maxrampagesize(), &error_fatal);
-+    s390_set_max_pagesize(s390ms, qemu_maxrampagesize());
-     /* Initialize storage key device */
-     s390_skeys_init();
-     /* Initialize storage attributes device */
-diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h
-index de04336c5a..599740a998 100644
---- a/include/hw/s390x/s390-virtio-ccw.h
-+++ b/include/hw/s390x/s390-virtio-ccw.h
-@@ -30,6 +30,7 @@ struct S390CcwMachineState {
-     bool pv;
-     uint8_t loadparm[8];
-     uint64_t memory_limit;
-+    uint64_t max_pagesize;
- 
-     SCLPDevice *sclp;
- };
-diff --git a/target/s390x/cpu-sysemu.c b/target/s390x/cpu-sysemu.c
-index 3118a25fee..706a5c53e2 100644
---- a/target/s390x/cpu-sysemu.c
-+++ b/target/s390x/cpu-sysemu.c
-@@ -255,13 +255,6 @@ unsigned int s390_cpu_set_state(uint8_t cpu_state, S390CPU *cpu)
-     return s390_count_running_cpus();
- }
- 
--void s390_set_max_pagesize(uint64_t pagesize, Error **errp)
--{
--    if (kvm_enabled()) {
--        kvm_s390_set_max_pagesize(pagesize, errp);
--    }
--}
--
- void s390_cmma_reset(void)
- {
-     if (kvm_enabled()) {
-diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
-index ecaf3191d2..9770a62ac9 100644
---- a/target/s390x/cpu.h
-+++ b/target/s390x/cpu.h
-@@ -881,7 +881,6 @@ static inline void s390_do_cpu_load_normal(CPUState *cs, run_on_cpu_data arg)
- 
- /* cpu.c */
- void s390_crypto_reset(void);
--void s390_set_max_pagesize(uint64_t pagesize, Error **errp);
- void s390_cmma_reset(void);
- void s390_enable_css_support(S390CPU *cpu);
- void s390_do_cpu_set_diag318(CPUState *cs, run_on_cpu_data arg);
--- 
-2.48.1
-
diff --git a/kvm-s390x-rename-s390-virtio-hcall-to-s390-hypercall.patch b/kvm-s390x-rename-s390-virtio-hcall-to-s390-hypercall.patch
deleted file mode 100644
index 90bb4c3..0000000
--- a/kvm-s390x-rename-s390-virtio-hcall-to-s390-hypercall.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 2fbdf7e3cf23daea470aaa4a29e16641feb76f3c Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:05 +0100
-Subject: [PATCH 13/26] s390x: rename s390-virtio-hcall* to s390-hypercall*
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [13/26] 3c1ef3cbb137517b306871f0a88a61a59740af5a (thuth/qemu-kvm-cs)
-
-Let's make it clearer that we are talking about general
-QEMU/KVM-specific hypercalls.
-
-Message-ID: <20241219144115.2820241-5-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 85489fc3652d0c4433c940f1a80a952e8cb5d3cb)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/meson.build                               | 2 +-
- hw/s390x/{s390-virtio-hcall.c => s390-hypercall.c} | 2 +-
- hw/s390x/{s390-virtio-hcall.h => s390-hypercall.h} | 6 +++---
- target/s390x/kvm/kvm.c                             | 2 +-
- target/s390x/tcg/misc_helper.c                     | 2 +-
- 5 files changed, 7 insertions(+), 7 deletions(-)
- rename hw/s390x/{s390-virtio-hcall.c => s390-hypercall.c} (97%)
- rename hw/s390x/{s390-virtio-hcall.h => s390-hypercall.h} (86%)
-
-diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
-index d6c8c33915..e344a3bd8c 100644
---- a/hw/s390x/meson.build
-+++ b/hw/s390x/meson.build
-@@ -29,7 +29,7 @@ s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
- ))
- s390x_ss.add(when: 'CONFIG_S390_CCW_VIRTIO', if_true: files(
-   's390-virtio-ccw.c',
--  's390-virtio-hcall.c',
-+  's390-hypercall.c',
- ))
- s390x_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('3270-ccw.c'))
- s390x_ss.add(when: 'CONFIG_VFIO', if_true: files('s390-pci-vfio.c'))
-diff --git a/hw/s390x/s390-virtio-hcall.c b/hw/s390x/s390-hypercall.c
-similarity index 97%
-rename from hw/s390x/s390-virtio-hcall.c
-rename to hw/s390x/s390-hypercall.c
-index 5fb78a719e..f816c2b1ef 100644
---- a/hw/s390x/s390-virtio-hcall.c
-+++ b/hw/s390x/s390-hypercall.c
-@@ -12,7 +12,7 @@
- #include "qemu/osdep.h"
- #include "cpu.h"
- #include "hw/boards.h"
--#include "hw/s390x/s390-virtio-hcall.h"
-+#include "hw/s390x/s390-hypercall.h"
- #include "hw/s390x/ioinst.h"
- #include "hw/s390x/css.h"
- #include "virtio-ccw.h"
-diff --git a/hw/s390x/s390-virtio-hcall.h b/hw/s390x/s390-hypercall.h
-similarity index 86%
-rename from hw/s390x/s390-virtio-hcall.h
-rename to hw/s390x/s390-hypercall.h
-index dca456b926..2fa81dbfdd 100644
---- a/hw/s390x/s390-virtio-hcall.h
-+++ b/hw/s390x/s390-hypercall.h
-@@ -9,8 +9,8 @@
-  * directory.
-  */
- 
--#ifndef HW_S390_VIRTIO_HCALL_H
--#define HW_S390_VIRTIO_HCALL_H
-+#ifndef HW_S390_HYPERCALL_H
-+#define HW_S390_HYPERCALL_H
- 
- #include "cpu.h"
- 
-@@ -21,4 +21,4 @@
- 
- void handle_diag_500(S390CPU *cpu, uintptr_t ra);
- 
--#endif /* HW_S390_VIRTIO_HCALL_H */
-+#endif /* HW_S390_HYPERCALL_H */
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 42d6a54126..afc8d570c9 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -49,7 +49,7 @@
- #include "hw/s390x/ebcdic.h"
- #include "exec/memattrs.h"
- #include "hw/s390x/s390-virtio-ccw.h"
--#include "hw/s390x/s390-virtio-hcall.h"
-+#include "hw/s390x/s390-hypercall.h"
- #include "target/s390x/kvm/pv.h"
- #include CONFIG_DEVICES
- 
-diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
-index 2b4310003b..b726a95352 100644
---- a/target/s390x/tcg/misc_helper.c
-+++ b/target/s390x/tcg/misc_helper.c
-@@ -36,7 +36,7 @@
- #include "sysemu/cpus.h"
- #include "sysemu/sysemu.h"
- #include "hw/s390x/ebcdic.h"
--#include "hw/s390x/s390-virtio-hcall.h"
-+#include "hw/s390x/s390-hypercall.h"
- #include "hw/s390x/sclp.h"
- #include "hw/s390x/s390_flic.h"
- #include "hw/s390x/ioinst.h"
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-hypercall-introduce-DIAG500-STORAGE_LIMIT.patch b/kvm-s390x-s390-hypercall-introduce-DIAG500-STORAGE_LIMIT.patch
deleted file mode 100644
index af613d5..0000000
--- a/kvm-s390x-s390-hypercall-introduce-DIAG500-STORAGE_LIMIT.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 86417a068f24964422d4fd5ea301d70a0f8142d2 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:08 +0100
-Subject: [PATCH 16/26] s390x/s390-hypercall: introduce DIAG500 STORAGE_LIMIT
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [16/26] c1c341227388735450ddbba0201e7523e0658c07 (thuth/qemu-kvm-cs)
-
-A guest OS that supports memory hotplug / memory devices must during
-boot be aware of the maximum possible physical memory address that it might
-have to handle at a later stage during its runtime.
-
-For example, the maximum possible memory address might be required to
-prepare the kernel virtual address space accordingly (e.g., select page
-table hierarchy depth).
-
-On s390x there is currently no such mechanism that is compatible with
-paravirtualized memory devices, because the whole SCLP interface was
-designed around the idea of "storage increments" and "standby memory".
-Paravirtualized memory devices we want to support, such as virtio-mem, have
-no intersection with any of that, but could co-exist with them in the
-future if ever needed.
-
-In particular, a guest OS must never detect and use device memory
-without the help of a proper device driver. Device memory must not be
-exposed in any firmware-provided memory map (SCLP or diag260 on s390x).
-For this reason, these memory devices will be places in memory *above*
-the "maximum storage increment" exposed via SCLP.
-
-Let's provide a new diag500 subcode to query the memory limit determined in
-s390_memory_init().
-
-Message-ID: <20241219144115.2820241-8-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit f7c168657816486527727d860b73747d41f0c5f6)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-hypercall.c | 12 +++++++++++-
- hw/s390x/s390-hypercall.h |  1 +
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/hw/s390x/s390-hypercall.c b/hw/s390x/s390-hypercall.c
-index f816c2b1ef..ac1b08b2cd 100644
---- a/hw/s390x/s390-hypercall.c
-+++ b/hw/s390x/s390-hypercall.c
-@@ -11,7 +11,7 @@
- 
- #include "qemu/osdep.h"
- #include "cpu.h"
--#include "hw/boards.h"
-+#include "hw/s390x/s390-virtio-ccw.h"
- #include "hw/s390x/s390-hypercall.h"
- #include "hw/s390x/ioinst.h"
- #include "hw/s390x/css.h"
-@@ -57,6 +57,13 @@ static int handle_virtio_ccw_notify(uint64_t subch_id, uint64_t data)
-     return 0;
- }
- 
-+static uint64_t handle_storage_limit(void)
-+{
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(qdev_get_machine());
-+
-+    return s390_get_memory_limit(s390ms) - 1;
-+}
-+
- void handle_diag_500(S390CPU *cpu, uintptr_t ra)
- {
-     CPUS390XState *env = &cpu->env;
-@@ -69,6 +76,9 @@ void handle_diag_500(S390CPU *cpu, uintptr_t ra)
-     case DIAG500_VIRTIO_CCW_NOTIFY:
-         env->regs[2] = handle_virtio_ccw_notify(env->regs[2], env->regs[3]);
-         break;
-+    case DIAG500_STORAGE_LIMIT:
-+        env->regs[2] = handle_storage_limit();
-+        break;
-     default:
-         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
-     }
-diff --git a/hw/s390x/s390-hypercall.h b/hw/s390x/s390-hypercall.h
-index 2fa81dbfdd..4f07209128 100644
---- a/hw/s390x/s390-hypercall.h
-+++ b/hw/s390x/s390-hypercall.h
-@@ -18,6 +18,7 @@
- #define DIAG500_VIRTIO_RESET            1 /* legacy */
- #define DIAG500_VIRTIO_SET_STATUS       2 /* legacy */
- #define DIAG500_VIRTIO_CCW_NOTIFY       3 /* KVM_S390_VIRTIO_CCW_NOTIFY */
-+#define DIAG500_STORAGE_LIMIT           4
- 
- void handle_diag_500(S390CPU *cpu, uintptr_t ra);
- 
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-skeys-prepare-for-memory-devices.patch b/kvm-s390x-s390-skeys-prepare-for-memory-devices.patch
deleted file mode 100644
index 885ebf1..0000000
--- a/kvm-s390x-s390-skeys-prepare-for-memory-devices.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 53d1b43699c6b30583f41a18a33c28893718aeac Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:10 +0100
-Subject: [PATCH 18/26] s390x/s390-skeys: prepare for memory devices
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [18/26] 47edda0eeb6d5932f81633f2d9d294b1ca5f413c (thuth/qemu-kvm-cs)
-
-With memory devices, we will have storage keys for memory that
-exceeds the initial ram size.
-
-The TODO already states that current handling is subopimal,
-but we won't worry about improving that (TCG-only) thing for now.
-
-Message-ID: <20241219144115.2820241-10-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit d1e3c2ac41b3f73708682e4e8212c32ad35013b9)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-skeys.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/s390x/s390-skeys.c b/hw/s390x/s390-skeys.c
-index bf22d6863e..e4297b3b8a 100644
---- a/hw/s390x/s390-skeys.c
-+++ b/hw/s390x/s390-skeys.c
-@@ -11,7 +11,7 @@
- 
- #include "qemu/osdep.h"
- #include "qemu/units.h"
--#include "hw/boards.h"
-+#include "hw/s390x/s390-virtio-ccw.h"
- #include "hw/qdev-properties.h"
- #include "hw/s390x/storage-keys.h"
- #include "qapi/error.h"
-@@ -251,9 +251,9 @@ static bool qemu_s390_enable_skeys(S390SKeysState *ss)
-      *    g_once_init_enter() is good enough.
-      */
-     if (g_once_init_enter(&initialized)) {
--        MachineState *machine = MACHINE(qdev_get_machine());
-+        S390CcwMachineState *s390ms = S390_CCW_MACHINE(qdev_get_machine());
- 
--        skeys->key_count = machine->ram_size / TARGET_PAGE_SIZE;
-+        skeys->key_count = s390_get_memory_limit(s390ms) / TARGET_PAGE_SIZE;
-         skeys->keydata = g_malloc0(skeys->key_count);
-         g_once_init_leave(&initialized, 1);
-     }
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-stattrib-kvm-prepare-for-memory-devices-a.patch b/kvm-s390x-s390-stattrib-kvm-prepare-for-memory-devices-a.patch
deleted file mode 100644
index e8102a4..0000000
--- a/kvm-s390x-s390-stattrib-kvm-prepare-for-memory-devices-a.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-From 1195c91d10892a888870248fd881612955b9e1eb Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:09 +0100
-Subject: [PATCH 17/26] s390x/s390-stattrib-kvm: prepare for memory devices and
- sparse memory layouts
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [17/26] 799aa7b2b9cc2a948e9f391bc0ecf739254c78b1 (thuth/qemu-kvm-cs)
-
-With memory devices, we will have storage attributes for memory that
-exceeds the initial ram size. Further, we can easily have memory holes,
-for which there (currently) are no storage attributes.
-
-In particular, with memory holes, KVM_S390_SET_CMMA_BITS will fail to set
-some storage attributes.
-
-So let's do it like we handle storage keys migration, relying on
-guest_phys_blocks_append(). However, in contrast to storage key
-migration, we will handle it on the migration destination.
-
-This is a preparation for virtio-mem support. Note that ever since the
-"early migration" feature was added (x-early-migration), the state
-of device blocks (plugged/unplugged) is migrated early such that
-guest_phys_blocks_append() will properly consider all currently plugged
-memory blocks and skip any unplugged ones.
-
-In the future, we should try getting rid of the large temporary buffer
-and also not send any attributes for any memory holes, just so they
-get ignored on the destination.
-
-Message-ID: <20241219144115.2820241-9-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 241e6b2d27b090b17cda5b011b2064544b0c458b)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-stattrib-kvm.c | 67 +++++++++++++++++++++++-------------
- 1 file changed, 43 insertions(+), 24 deletions(-)
-
-diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
-index eeaa811098..33ec91422a 100644
---- a/hw/s390x/s390-stattrib-kvm.c
-+++ b/hw/s390x/s390-stattrib-kvm.c
-@@ -10,11 +10,12 @@
-  */
- 
- #include "qemu/osdep.h"
--#include "hw/boards.h"
-+#include "hw/s390x/s390-virtio-ccw.h"
- #include "migration/qemu-file.h"
- #include "hw/s390x/storage-attributes.h"
- #include "qemu/error-report.h"
- #include "sysemu/kvm.h"
-+#include "sysemu/memory_mapping.h"
- #include "exec/ram_addr.h"
- #include "kvm/kvm_s390x.h"
- #include "qapi/error.h"
-@@ -84,8 +85,8 @@ static int kvm_s390_stattrib_set_stattr(S390StAttribState *sa,
-                                         uint8_t *values)
- {
-     KVMS390StAttribState *sas = KVM_S390_STATTRIB(sa);
--    MachineState *machine = MACHINE(qdev_get_machine());
--    unsigned long max = machine->ram_size / TARGET_PAGE_SIZE;
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(qdev_get_machine());
-+    unsigned long max = s390_get_memory_limit(s390ms) / TARGET_PAGE_SIZE;
- 
-     if (start_gfn + count > max) {
-         error_report("Out of memory bounds when setting storage attributes");
-@@ -103,39 +104,57 @@ static int kvm_s390_stattrib_set_stattr(S390StAttribState *sa,
- static void kvm_s390_stattrib_synchronize(S390StAttribState *sa)
- {
-     KVMS390StAttribState *sas = KVM_S390_STATTRIB(sa);
--    MachineState *machine = MACHINE(qdev_get_machine());
--    unsigned long max = machine->ram_size / TARGET_PAGE_SIZE;
--    /* We do not need to reach the maximum buffer size allowed */
--    unsigned long cx, len = KVM_S390_SKEYS_MAX / 2;
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(qdev_get_machine());
-+    unsigned long max = s390_get_memory_limit(s390ms) / TARGET_PAGE_SIZE;
-+    unsigned long start_gfn, end_gfn, pages;
-+    GuestPhysBlockList guest_phys_blocks;
-+    GuestPhysBlock *block;
-     int r;
-     struct kvm_s390_cmma_log clog = {
-         .flags = 0,
-         .mask = ~0ULL,
-     };
- 
--    if (sas->incoming_buffer) {
--        for (cx = 0; cx + len <= max; cx += len) {
--            clog.start_gfn = cx;
--            clog.count = len;
--            clog.values = (uint64_t)(sas->incoming_buffer + cx);
--            r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS, &clog);
--            if (r) {
--                error_report("KVM_S390_SET_CMMA_BITS failed: %s", strerror(-r));
--                return;
--            }
--        }
--        if (cx < max) {
--            clog.start_gfn = cx;
--            clog.count = max - cx;
--            clog.values = (uint64_t)(sas->incoming_buffer + cx);
-+    if (!sas->incoming_buffer) {
-+        return;
-+    }
-+    guest_phys_blocks_init(&guest_phys_blocks);
-+    guest_phys_blocks_append(&guest_phys_blocks);
-+
-+    QTAILQ_FOREACH(block, &guest_phys_blocks.head, next) {
-+        assert(QEMU_IS_ALIGNED(block->target_start, TARGET_PAGE_SIZE));
-+        assert(QEMU_IS_ALIGNED(block->target_end, TARGET_PAGE_SIZE));
-+
-+        start_gfn = block->target_start / TARGET_PAGE_SIZE;
-+        end_gfn = block->target_end / TARGET_PAGE_SIZE;
-+
-+        while (start_gfn < end_gfn) {
-+            /* Don't exceed the maximum buffer size. */
-+            pages = MIN(end_gfn - start_gfn, KVM_S390_SKEYS_MAX / 2);
-+
-+            /*
-+             * If we ever get guest physical memory beyond the configured
-+             * memory limit, something went very wrong.
-+             */
-+            assert(start_gfn + pages <= max);
-+
-+            clog.start_gfn = start_gfn;
-+            clog.count = pages;
-+            clog.values = (uint64_t)(sas->incoming_buffer + start_gfn);
-             r = kvm_vm_ioctl(kvm_state, KVM_S390_SET_CMMA_BITS, &clog);
-             if (r) {
-                 error_report("KVM_S390_SET_CMMA_BITS failed: %s", strerror(-r));
-+                goto out;
-             }
-+
-+            start_gfn += pages;
-         }
--        g_free(sas->incoming_buffer);
--        sas->incoming_buffer = NULL;
-     }
-+
-+out:
-+    guest_phys_blocks_free(&guest_phys_blocks);
-+    g_free(sas->incoming_buffer);
-+    sas->incoming_buffer = NULL;
- }
- 
- static int kvm_s390_stattrib_set_migrationmode(S390StAttribState *sa, bool val,
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-virtio-ccw-don-t-crash-on-weird-RAM-sizes.patch b/kvm-s390x-s390-virtio-ccw-don-t-crash-on-weird-RAM-sizes.patch
deleted file mode 100644
index fa99566..0000000
--- a/kvm-s390x-s390-virtio-ccw-don-t-crash-on-weird-RAM-sizes.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 4ee3076ac566622929f9410636483c4f0b2da967 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:02 +0100
-Subject: [PATCH 10/26] s390x/s390-virtio-ccw: don't crash on weird RAM sizes
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [10/26] 55738da52f3cf4746bee2b17780a10720fa05863 (thuth/qemu-kvm-cs)
-
-KVM is not happy when starting a VM with weird RAM sizes:
-
-  # qemu-system-s390x --enable-kvm --nographic -m 1234K
-  qemu-system-s390x: kvm_set_user_memory_region: KVM_SET_USER_MEMORY_REGION
-    failed, slot=0, start=0x0, size=0x244000: Invalid argument
-  kvm_set_phys_mem: error registering slot: Invalid argument
-  Aborted (core dumped)
-
-Let's handle that in a better way by rejecting such weird RAM sizes
-right from the start:
-
-  # qemu-system-s390x --enable-kvm --nographic -m 1234K
-  qemu-system-s390x: ram size must be multiples of 1 MiB
-
-Message-ID: <20241219144115.2820241-2-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Acked-by: Janosch Frank <frankja@linux.ibm.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 14e568ab4836347481af2e334009c385f456a734)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 94cad1705b..82ded9666c 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -180,6 +180,17 @@ static void s390_memory_init(MemoryRegion *ram)
- {
-     MemoryRegion *sysmem = get_system_memory();
- 
-+    if (!QEMU_IS_ALIGNED(memory_region_size(ram), 1 * MiB)) {
-+        /*
-+         * SCLP cannot possibly expose smaller granularity right now and KVM
-+         * cannot handle smaller granularity. As we don't support NUMA, the
-+         * region size directly corresponds to machine->ram_size, and the region
-+         * is a single RAM memory region.
-+         */
-+        error_report("ram size must be multiples of 1 MiB");
-+        exit(EXIT_FAILURE);
-+    }
-+
-     /* allocate RAM for core */
-     memory_region_add_subregion(sysmem, 0, ram);
- 
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-virtio-ccw-move-setting-the-maximum-guest.patch b/kvm-s390x-s390-virtio-ccw-move-setting-the-maximum-guest.patch
deleted file mode 100644
index 5a498d6..0000000
--- a/kvm-s390x-s390-virtio-ccw-move-setting-the-maximum-guest.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-From 9ec2d356210f1e66f50519cc4d58633a13db9004 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:06 +0100
-Subject: [PATCH 14/26] s390x/s390-virtio-ccw: move setting the maximum guest
- size from sclp to machine code
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [14/26] a5970c1c6d8d09a473a25a7eee533ec3a6711ec8 (thuth/qemu-kvm-cs)
-
-Nowadays, it feels more natural to have that code located in
-s390_memory_init(), where we also have direct access to the machine
-object.
-
-While at it, use the actual RAM size, not the maximum RAM size which
-cannot currently be reached without support for any memory devices.
-Consequently update s390_pv_vm_try_disable_async() to rely on the RAM size
-as well, to avoid temporary issues while we further rework that
-handling.
-
-set_memory_limit() is temporary, we'll merge it with
-s390_set_memory_limit() next.
-
-Message-ID: <20241219144115.2820241-6-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 3c6fb557d295949bea291c3bf88ee9c83392e78c)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 28 ++++++++++++++++++++++++----
- hw/s390x/sclp.c            | 11 -----------
- target/s390x/kvm/pv.c      |  2 +-
- 3 files changed, 25 insertions(+), 16 deletions(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index d47e99028e..248ac28d20 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -121,11 +121,29 @@ static void subsystem_reset(void)
-     }
- }
- 
--static void s390_memory_init(MemoryRegion *ram)
-+static void set_memory_limit(uint64_t new_limit)
-+{
-+    uint64_t hw_limit;
-+    int ret;
-+
-+    ret = s390_set_memory_limit(new_limit, &hw_limit);
-+    if (ret == -E2BIG) {
-+        error_report("host supports a maximum of %" PRIu64 " GB",
-+                     hw_limit / GiB);
-+        exit(EXIT_FAILURE);
-+    } else if (ret) {
-+        error_report("setting the guest size failed");
-+        exit(EXIT_FAILURE);
-+    }
-+}
-+
-+static void s390_memory_init(MachineState *machine)
- {
-     MemoryRegion *sysmem = get_system_memory();
-+    MemoryRegion *ram = machine->ram;
-+    uint64_t ram_size = memory_region_size(ram);
- 
--    if (!QEMU_IS_ALIGNED(memory_region_size(ram), 1 * MiB)) {
-+    if (!QEMU_IS_ALIGNED(ram_size, 1 * MiB)) {
-         /*
-          * SCLP cannot possibly expose smaller granularity right now and KVM
-          * cannot handle smaller granularity. As we don't support NUMA, the
-@@ -136,7 +154,9 @@ static void s390_memory_init(MemoryRegion *ram)
-         exit(EXIT_FAILURE);
-     }
- 
--    /* allocate RAM for core */
-+    set_memory_limit(ram_size);
-+
-+    /* Map the initial memory. Must happen after setting the memory limit. */
-     memory_region_add_subregion(sysmem, 0, ram);
- 
-     /*
-@@ -211,7 +231,7 @@ static void ccw_init(MachineState *machine)
-     qdev_realize_and_unref(DEVICE(ms->sclp), NULL, &error_fatal);
- 
-     /* init memory + setup max page size. Required for the CPU model */
--    s390_memory_init(machine->ram);
-+    s390_memory_init(machine);
- 
-     /* init CPUs (incl. CPU model) early so s390_has_feature() works */
-     s390_init_cpus(machine);
-diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
-index 8757626b5c..73e88ab4eb 100644
---- a/hw/s390x/sclp.c
-+++ b/hw/s390x/sclp.c
-@@ -376,10 +376,7 @@ void sclp_service_interrupt(uint32_t sccb)
- /* qemu object creation and initialization functions */
- static void sclp_realize(DeviceState *dev, Error **errp)
- {
--    MachineState *machine = MACHINE(qdev_get_machine());
-     SCLPDevice *sclp = SCLP(dev);
--    uint64_t hw_limit;
--    int ret;
- 
-     /*
-      * qdev_device_add searches the sysbus for TYPE_SCLP_EVENTS_BUS. As long
-@@ -389,14 +386,6 @@ static void sclp_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(sclp->event_facility), errp)) {
-         return;
-     }
--
--    ret = s390_set_memory_limit(machine->maxram_size, &hw_limit);
--    if (ret == -E2BIG) {
--        error_setg(errp, "host supports a maximum of %" PRIu64 " GB",
--                   hw_limit / GiB);
--    } else if (ret) {
--        error_setg(errp, "setting the guest size failed");
--    }
- }
- 
- static void sclp_memory_init(SCLPDevice *sclp)
-diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
-index dde836d21a..424cce75ca 100644
---- a/target/s390x/kvm/pv.c
-+++ b/target/s390x/kvm/pv.c
-@@ -133,7 +133,7 @@ bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms)
-      * If the feature is not present or if the VM is not larger than 2 GiB,
-      * KVM_PV_ASYNC_CLEANUP_PREPARE fill fail; no point in attempting it.
-      */
--    if ((MACHINE(ms)->maxram_size <= 2 * GiB) ||
-+    if ((MACHINE(ms)->ram_size <= 2 * GiB) ||
-         !kvm_check_extension(kvm_state, KVM_CAP_S390_PROTECTED_ASYNC_DISABLE)) {
-         return false;
-     }
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-virtio-ccw-prepare-for-memory-devices.patch b/kvm-s390x-s390-virtio-ccw-prepare-for-memory-devices.patch
deleted file mode 100644
index 17e7e6a..0000000
--- a/kvm-s390x-s390-virtio-ccw-prepare-for-memory-devices.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 0e7d7bf86fb242c1ea90bf9648fb061626790eda Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:11 +0100
-Subject: [PATCH 19/26] s390x/s390-virtio-ccw: prepare for memory devices
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [19/26] 2441c8c5f5a06d5ca93188dd44e8a08f06d1722b (thuth/qemu-kvm-cs)
-
-Let's prepare our address space for memory devices if enabled via
-"maxmem" and if we have CONFIG_MEM_DEVICE enabled at all. Note that
-CONFIG_MEM_DEVICE will be selected automatically once we add support
-for devices.
-
-Just like on other architectures, the region container for memory devices
-is placed directly above our initial memory. For now, we only align the
-start address of the region up to 1 GiB, but we won't add any additional
-space to the region for internal alignment purposes; this can be done in
-the future if really required.
-
-The RAM size returned via SCLP is not modified, as this only
-covers initial RAM (and standby memory we don't implement) and not memory
-devices; clarify that in the docs of read_SCP_info(). Existing OSes without
-support for memory devices will keep working as is, even when memory
-devices would be attached the VM.
-
-Guest OSs which support memory devices, such as virtio-mem, will
-consult diag500(), to find out the maximum possible pfn. Guest OSes that
-don't support memory devices, don't have to be changed and will continue
-relying on information provided by SCLP.
-
-There are no remaining maxram_size users in s390x code, and the remaining
-ram_size users only care about initial RAM:
-* hw/s390x/ipl.c
-* hw/s390x/s390-hypercall.c
-* hw/s390x/sclp.c
-* target/s390x/kvm/pv.c
-
-Message-ID: <20241219144115.2820241-11-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 1e86400298cf0fed5f7d49427db477775b859093)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 23 ++++++++++++++++++++++-
- hw/s390x/sclp.c            |  6 +++++-
- 2 files changed, 27 insertions(+), 2 deletions(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index f5f147eb92..824c73536a 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -149,6 +149,7 @@ static void s390_memory_init(MachineState *machine)
-     MemoryRegion *sysmem = get_system_memory();
-     MemoryRegion *ram = machine->ram;
-     uint64_t ram_size = memory_region_size(ram);
-+    uint64_t devmem_base, devmem_size;
- 
-     if (!QEMU_IS_ALIGNED(ram_size, 1 * MiB)) {
-         /*
-@@ -161,11 +162,31 @@ static void s390_memory_init(MachineState *machine)
-         exit(EXIT_FAILURE);
-     }
- 
--    s390_set_memory_limit(s390ms, ram_size);
-+    devmem_size = 0;
-+    devmem_base = ram_size;
-+#ifdef CONFIG_MEM_DEVICE
-+    if (machine->ram_size < machine->maxram_size) {
-+
-+        /*
-+         * Make sure memory devices have a sane default alignment, even
-+         * when weird initial memory sizes are specified.
-+         */
-+        devmem_base = QEMU_ALIGN_UP(devmem_base, 1 * GiB);
-+        devmem_size = machine->maxram_size - machine->ram_size;
-+    }
-+#endif
-+    s390_set_memory_limit(s390ms, devmem_base + devmem_size);
- 
-     /* Map the initial memory. Must happen after setting the memory limit. */
-     memory_region_add_subregion(sysmem, 0, ram);
- 
-+    /* Initialize address space for memory devices. */
-+#ifdef CONFIG_MEM_DEVICE
-+    if (devmem_size) {
-+        machine_memory_devices_init(machine, devmem_base, devmem_size);
-+    }
-+#endif /* CONFIG_MEM_DEVICE */
-+
-     /*
-      * Configure the maximum page size. As no memory devices were created
-      * yet, this is the page size of initial memory only.
-diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
-index 73e88ab4eb..5945c9b1d8 100644
---- a/hw/s390x/sclp.c
-+++ b/hw/s390x/sclp.c
-@@ -161,7 +161,11 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
-         read_info->rnsize2 = cpu_to_be32(rnsize);
-     }
- 
--    /* we don't support standby memory, maxram_size is never exposed */
-+    /*
-+     * We don't support standby memory. maxram_size is used for sizing the
-+     * memory device region, which is not exposed through SCLP but through
-+     * diag500.
-+     */
-     rnmax = machine->ram_size >> sclp->increment_size;
-     if (rnmax < 0x10000) {
-         read_info->rnmax = cpu_to_be16(rnmax);
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-virtio-hcall-prepare-for-more-diag500-hyp.patch b/kvm-s390x-s390-virtio-hcall-prepare-for-more-diag500-hyp.patch
deleted file mode 100644
index 4bc283e..0000000
--- a/kvm-s390x-s390-virtio-hcall-prepare-for-more-diag500-hyp.patch
+++ /dev/null
@@ -1,163 +0,0 @@
-From d2764db41fc6edcead9ad27b8d31e7bff524c0c0 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:04 +0100
-Subject: [PATCH 12/26] s390x/s390-virtio-hcall: prepare for more diag500
- hypercalls
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [12/26] 6573602d71b9e70679a48315f913309be29d6239 (thuth/qemu-kvm-cs)
-
-Let's generalize, abstracting the virtio bits. diag500 is now a generic
-hypercall to handle QEMU/KVM specific things. Explicitly specify all
-already defined subcodes, including legacy ones (so we know what we can
-use for new hypercalls).
-
-Move the PGM_SPECIFICATION injection into the renamed function
-handle_diag_500(), so we can turn it into a void function.
-
-We'll rename the files separately, so git properly detects the rename.
-
-Message-ID: <20241219144115.2820241-4-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 6e9cc2da4e8b997fd6ff3249034f436b84fc7974)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-hcall.c   | 15 ++++++++-------
- hw/s390x/s390-virtio-hcall.h   | 11 ++++++-----
- target/s390x/kvm/kvm.c         | 20 +++-----------------
- target/s390x/tcg/misc_helper.c |  5 +++--
- 4 files changed, 20 insertions(+), 31 deletions(-)
-
-diff --git a/hw/s390x/s390-virtio-hcall.c b/hw/s390x/s390-virtio-hcall.c
-index ca49e3cd22..5fb78a719e 100644
---- a/hw/s390x/s390-virtio-hcall.c
-+++ b/hw/s390x/s390-virtio-hcall.c
-@@ -1,5 +1,5 @@
- /*
-- * Support for virtio hypercalls on s390
-+ * Support for QEMU/KVM hypercalls on s390
-  *
-  * Copyright 2012 IBM Corp.
-  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
-@@ -57,18 +57,19 @@ static int handle_virtio_ccw_notify(uint64_t subch_id, uint64_t data)
-     return 0;
- }
- 
--int s390_virtio_hypercall(CPUS390XState *env)
-+void handle_diag_500(S390CPU *cpu, uintptr_t ra)
- {
-+    CPUS390XState *env = &cpu->env;
-     const uint64_t subcode = env->regs[1];
- 
-     switch (subcode) {
--    case KVM_S390_VIRTIO_NOTIFY:
-+    case DIAG500_VIRTIO_NOTIFY:
-         env->regs[2] = handle_virtio_notify(env->regs[2]);
--        return 0;
--    case KVM_S390_VIRTIO_CCW_NOTIFY:
-+        break;
-+    case DIAG500_VIRTIO_CCW_NOTIFY:
-         env->regs[2] = handle_virtio_ccw_notify(env->regs[2], env->regs[3]);
--        return 0;
-+        break;
-     default:
--        return -EINVAL;
-+        s390_program_interrupt(env, PGM_SPECIFICATION, ra);
-     }
- }
-diff --git a/hw/s390x/s390-virtio-hcall.h b/hw/s390x/s390-virtio-hcall.h
-index 3d9fe147d2..dca456b926 100644
---- a/hw/s390x/s390-virtio-hcall.h
-+++ b/hw/s390x/s390-virtio-hcall.h
-@@ -1,5 +1,5 @@
- /*
-- * Support for virtio hypercalls on s390x
-+ * Support for QEMU/KVM hypercalls on s390x
-  *
-  * Copyright IBM Corp. 2012, 2017
-  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
-@@ -12,12 +12,13 @@
- #ifndef HW_S390_VIRTIO_HCALL_H
- #define HW_S390_VIRTIO_HCALL_H
- 
--#include "standard-headers/asm-s390/virtio-ccw.h"
- #include "cpu.h"
- 
--/* The only thing that we need from the old kvm_virtio.h file */
--#define KVM_S390_VIRTIO_NOTIFY 0
-+#define DIAG500_VIRTIO_NOTIFY           0 /* legacy, implemented as a NOP */
-+#define DIAG500_VIRTIO_RESET            1 /* legacy */
-+#define DIAG500_VIRTIO_SET_STATUS       2 /* legacy */
-+#define DIAG500_VIRTIO_CCW_NOTIFY       3 /* KVM_S390_VIRTIO_CCW_NOTIFY */
- 
--int s390_virtio_hypercall(CPUS390XState *env);
-+void handle_diag_500(S390CPU *cpu, uintptr_t ra);
- 
- #endif /* HW_S390_VIRTIO_HCALL_H */
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 5947dda829..42d6a54126 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -1492,22 +1492,6 @@ static int handle_e3(S390CPU *cpu, struct kvm_run *run, uint8_t ipbl)
-     return r;
- }
- 
--static int handle_hypercall(S390CPU *cpu, struct kvm_run *run)
--{
--    CPUS390XState *env = &cpu->env;
--    int ret = -EINVAL;
--
--#ifdef CONFIG_S390_CCW_VIRTIO
--    ret = s390_virtio_hypercall(env);
--#endif /* CONFIG_S390_CCW_VIRTIO */
--    if (ret == -EINVAL) {
--        kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION);
--        return 0;
--    }
--
--    return ret;
--}
--
- static void kvm_handle_diag_288(S390CPU *cpu, struct kvm_run *run)
- {
-     uint64_t r1, r3;
-@@ -1603,9 +1587,11 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb)
-     case DIAG_SET_CONTROL_PROGRAM_CODES:
-         handle_diag_318(cpu, run);
-         break;
-+#ifdef CONFIG_S390_CCW_VIRTIO
-     case DIAG_KVM_HYPERCALL:
--        r = handle_hypercall(cpu, run);
-+        handle_diag_500(cpu, RA_IGNORED);
-         break;
-+#endif /* CONFIG_S390_CCW_VIRTIO */
-     case DIAG_KVM_BREAKPOINT:
-         r = handle_sw_breakpoint(cpu, run);
-         break;
-diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
-index f44136a568..2b4310003b 100644
---- a/target/s390x/tcg/misc_helper.c
-+++ b/target/s390x/tcg/misc_helper.c
-@@ -119,10 +119,11 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uint32_t r3, uint32_t num)
-     switch (num) {
- #ifdef CONFIG_S390_CCW_VIRTIO
-     case 0x500:
--        /* KVM hypercall */
-+        /* QEMU/KVM hypercall */
-         bql_lock();
--        r = s390_virtio_hypercall(env);
-+        handle_diag_500(env_archcpu(env), GETPC());
-         bql_unlock();
-+        r = 0;
-         break;
- #endif /* CONFIG_S390_CCW_VIRTIO */
-     case 0x44:
--- 
-2.48.1
-
diff --git a/kvm-s390x-s390-virtio-hcall-remove-hypercall-registratio.patch b/kvm-s390x-s390-virtio-hcall-remove-hypercall-registratio.patch
deleted file mode 100644
index 14d03de..0000000
--- a/kvm-s390x-s390-virtio-hcall-remove-hypercall-registratio.patch
+++ /dev/null
@@ -1,296 +0,0 @@
-From 16ccb16d393a3e63936dc993c30c67fdecb1f120 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:03 +0100
-Subject: [PATCH 11/26] s390x/s390-virtio-hcall: remove hypercall registration
- mechanism
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [11/26] 5e8d2720fe9fd6e6e24487d71988821f1cf27f17 (thuth/qemu-kvm-cs)
-
-Nowadays, we only have a single machine type in QEMU, everything is based
-on virtio-ccw and the traditional virtio machine does no longer exist. No
-need to dynamically register diag500 handlers. Move the two existing
-handlers into s390-virtio-hcall.c.
-
-Message-ID: <20241219144115.2820241-3-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 4be0fce498d0a08f18b3a9accdb9ded79484d30a)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/meson.build           |  6 ++--
- hw/s390x/s390-virtio-ccw.c     | 58 ------------------------------
- hw/s390x/s390-virtio-hcall.c   | 65 +++++++++++++++++++++++++---------
- hw/s390x/s390-virtio-hcall.h   |  2 --
- target/s390x/kvm/kvm.c         |  5 ++-
- target/s390x/tcg/misc_helper.c |  3 ++
- 6 files changed, 60 insertions(+), 79 deletions(-)
-
-diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
-index 482fd13420..d6c8c33915 100644
---- a/hw/s390x/meson.build
-+++ b/hw/s390x/meson.build
-@@ -12,7 +12,6 @@ s390x_ss.add(files(
-   's390-pci-inst.c',
-   's390-skeys.c',
-   's390-stattrib.c',
--  's390-virtio-hcall.c',
-   'sclp.c',
-   'sclpcpu.c',
-   'sclpquiesce.c',
-@@ -28,7 +27,10 @@ s390x_ss.add(when: 'CONFIG_KVM', if_true: files(
- s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
-   'tod-tcg.c',
- ))
--s390x_ss.add(when: 'CONFIG_S390_CCW_VIRTIO', if_true: files('s390-virtio-ccw.c'))
-+s390x_ss.add(when: 'CONFIG_S390_CCW_VIRTIO', if_true: files(
-+  's390-virtio-ccw.c',
-+  's390-virtio-hcall.c',
-+))
- s390x_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('3270-ccw.c'))
- s390x_ss.add(when: 'CONFIG_VFIO', if_true: files('s390-pci-vfio.c'))
- 
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 82ded9666c..d47e99028e 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -16,11 +16,8 @@
- #include "exec/ram_addr.h"
- #include "exec/confidential-guest-support.h"
- #include "hw/boards.h"
--#include "hw/s390x/s390-virtio-hcall.h"
- #include "hw/s390x/sclp.h"
- #include "hw/s390x/s390_flic.h"
--#include "hw/s390x/ioinst.h"
--#include "hw/s390x/css.h"
- #include "virtio-ccw.h"
- #include "qemu/config-file.h"
- #include "qemu/ctype.h"
-@@ -124,58 +121,6 @@ static void subsystem_reset(void)
-     }
- }
- 
--static int virtio_ccw_hcall_notify(const uint64_t *args)
--{
--    uint64_t subch_id = args[0];
--    uint64_t data = args[1];
--    SubchDev *sch;
--    VirtIODevice *vdev;
--    int cssid, ssid, schid, m;
--    uint16_t vq_idx = data;
--
--    if (ioinst_disassemble_sch_ident(subch_id, &m, &cssid, &ssid, &schid)) {
--        return -EINVAL;
--    }
--    sch = css_find_subch(m, cssid, ssid, schid);
--    if (!sch || !css_subch_visible(sch)) {
--        return -EINVAL;
--    }
--
--    vdev = virtio_ccw_get_vdev(sch);
--    if (vq_idx >= VIRTIO_QUEUE_MAX || !virtio_queue_get_num(vdev, vq_idx)) {
--        return -EINVAL;
--    }
--
--    if (virtio_vdev_has_feature(vdev, VIRTIO_F_NOTIFICATION_DATA)) {
--        virtio_queue_set_shadow_avail_idx(virtio_get_queue(vdev, vq_idx),
--                                          (data >> 16) & 0xFFFF);
--    }
--
--    virtio_queue_notify(vdev, vq_idx);
--    return 0;
--}
--
--static int virtio_ccw_hcall_early_printk(const uint64_t *args)
--{
--    uint64_t mem = args[0];
--    MachineState *ms = MACHINE(qdev_get_machine());
--
--    if (mem < ms->ram_size) {
--        /* Early printk */
--        return 0;
--    }
--    return -EINVAL;
--}
--
--static void virtio_ccw_register_hcalls(void)
--{
--    s390_register_virtio_hypercall(KVM_S390_VIRTIO_CCW_NOTIFY,
--                                   virtio_ccw_hcall_notify);
--    /* Tolerate early printk. */
--    s390_register_virtio_hypercall(KVM_S390_VIRTIO_NOTIFY,
--                                   virtio_ccw_hcall_early_printk);
--}
--
- static void s390_memory_init(MemoryRegion *ram)
- {
-     MemoryRegion *sysmem = get_system_memory();
-@@ -296,9 +241,6 @@ static void ccw_init(MachineState *machine)
-                               OBJECT(dev));
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
- 
--    /* register hypercalls */
--    virtio_ccw_register_hcalls();
--
-     s390_enable_css_support(s390_cpu_addr2state(0));
- 
-     ret = css_create_css_image(VIRTUAL_CSSID, true);
-diff --git a/hw/s390x/s390-virtio-hcall.c b/hw/s390x/s390-virtio-hcall.c
-index ec7cf8beb3..ca49e3cd22 100644
---- a/hw/s390x/s390-virtio-hcall.c
-+++ b/hw/s390x/s390-virtio-hcall.c
-@@ -11,31 +11,64 @@
- 
- #include "qemu/osdep.h"
- #include "cpu.h"
-+#include "hw/boards.h"
- #include "hw/s390x/s390-virtio-hcall.h"
-+#include "hw/s390x/ioinst.h"
-+#include "hw/s390x/css.h"
-+#include "virtio-ccw.h"
- 
--#define MAX_DIAG_SUBCODES 255
-+static int handle_virtio_notify(uint64_t mem)
-+{
-+    MachineState *ms = MACHINE(qdev_get_machine());
- 
--static s390_virtio_fn s390_diag500_table[MAX_DIAG_SUBCODES];
-+    if (mem < ms->ram_size) {
-+        /* Early printk */
-+        return 0;
-+    }
-+    return -EINVAL;
-+}
- 
--void s390_register_virtio_hypercall(uint64_t code, s390_virtio_fn fn)
-+static int handle_virtio_ccw_notify(uint64_t subch_id, uint64_t data)
- {
--    assert(code < MAX_DIAG_SUBCODES);
--    assert(!s390_diag500_table[code]);
-+    SubchDev *sch;
-+    VirtIODevice *vdev;
-+    int cssid, ssid, schid, m;
-+    uint16_t vq_idx = data;
-+
-+    if (ioinst_disassemble_sch_ident(subch_id, &m, &cssid, &ssid, &schid)) {
-+        return -EINVAL;
-+    }
-+    sch = css_find_subch(m, cssid, ssid, schid);
-+    if (!sch || !css_subch_visible(sch)) {
-+        return -EINVAL;
-+    }
- 
--    s390_diag500_table[code] = fn;
-+    vdev = virtio_ccw_get_vdev(sch);
-+    if (vq_idx >= VIRTIO_QUEUE_MAX || !virtio_queue_get_num(vdev, vq_idx)) {
-+        return -EINVAL;
-+    }
-+
-+    if (virtio_vdev_has_feature(vdev, VIRTIO_F_NOTIFICATION_DATA)) {
-+        virtio_queue_set_shadow_avail_idx(virtio_get_queue(vdev, vq_idx),
-+                                          (data >> 16) & 0xFFFF);
-+    }
-+
-+    virtio_queue_notify(vdev, vq_idx);
-+    return 0;
- }
- 
- int s390_virtio_hypercall(CPUS390XState *env)
- {
--    s390_virtio_fn fn;
--
--    if (env->regs[1] < MAX_DIAG_SUBCODES) {
--        fn = s390_diag500_table[env->regs[1]];
--        if (fn) {
--            env->regs[2] = fn(&env->regs[2]);
--            return 0;
--        }
--    }
-+    const uint64_t subcode = env->regs[1];
- 
--    return -EINVAL;
-+    switch (subcode) {
-+    case KVM_S390_VIRTIO_NOTIFY:
-+        env->regs[2] = handle_virtio_notify(env->regs[2]);
-+        return 0;
-+    case KVM_S390_VIRTIO_CCW_NOTIFY:
-+        env->regs[2] = handle_virtio_ccw_notify(env->regs[2], env->regs[3]);
-+        return 0;
-+    default:
-+        return -EINVAL;
-+    }
- }
-diff --git a/hw/s390x/s390-virtio-hcall.h b/hw/s390x/s390-virtio-hcall.h
-index 3ae6d6ae3a..3d9fe147d2 100644
---- a/hw/s390x/s390-virtio-hcall.h
-+++ b/hw/s390x/s390-virtio-hcall.h
-@@ -18,8 +18,6 @@
- /* The only thing that we need from the old kvm_virtio.h file */
- #define KVM_S390_VIRTIO_NOTIFY 0
- 
--typedef int (*s390_virtio_fn)(const uint64_t *args);
--void s390_register_virtio_hypercall(uint64_t code, s390_virtio_fn fn);
- int s390_virtio_hypercall(CPUS390XState *env);
- 
- #endif /* HW_S390_VIRTIO_HCALL_H */
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 7a0ca5570f..5947dda829 100644
---- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm/kvm.c
-@@ -51,6 +51,7 @@
- #include "hw/s390x/s390-virtio-ccw.h"
- #include "hw/s390x/s390-virtio-hcall.h"
- #include "target/s390x/kvm/pv.h"
-+#include CONFIG_DEVICES
- 
- #define kvm_vm_check_mem_attr(s, attr) \
-     kvm_vm_check_attr(s, KVM_S390_VM_MEM_CTRL, attr)
-@@ -1494,9 +1495,11 @@ static int handle_e3(S390CPU *cpu, struct kvm_run *run, uint8_t ipbl)
- static int handle_hypercall(S390CPU *cpu, struct kvm_run *run)
- {
-     CPUS390XState *env = &cpu->env;
--    int ret;
-+    int ret = -EINVAL;
- 
-+#ifdef CONFIG_S390_CCW_VIRTIO
-     ret = s390_virtio_hypercall(env);
-+#endif /* CONFIG_S390_CCW_VIRTIO */
-     if (ret == -EINVAL) {
-         kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION);
-         return 0;
-diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
-index 303f86d363..f44136a568 100644
---- a/target/s390x/tcg/misc_helper.c
-+++ b/target/s390x/tcg/misc_helper.c
-@@ -43,6 +43,7 @@
- #include "hw/s390x/s390-pci-inst.h"
- #include "hw/boards.h"
- #include "hw/s390x/tod.h"
-+#include CONFIG_DEVICES
- #endif
- 
- /* #define DEBUG_HELPER */
-@@ -116,12 +117,14 @@ void HELPER(diag)(CPUS390XState *env, uint32_t r1, uint32_t r3, uint32_t num)
-     uint64_t r;
- 
-     switch (num) {
-+#ifdef CONFIG_S390_CCW_VIRTIO
-     case 0x500:
-         /* KVM hypercall */
-         bql_lock();
-         r = s390_virtio_hypercall(env);
-         bql_unlock();
-         break;
-+#endif /* CONFIG_S390_CCW_VIRTIO */
-     case 0x44:
-         /* yield */
-         r = 0;
--- 
-2.48.1
-
diff --git a/kvm-s390x-virtio-ccw-add-support-for-virtio-based-memory.patch b/kvm-s390x-virtio-ccw-add-support-for-virtio-based-memory.patch
deleted file mode 100644
index 808f95b..0000000
--- a/kvm-s390x-virtio-ccw-add-support-for-virtio-based-memory.patch
+++ /dev/null
@@ -1,423 +0,0 @@
-From 6b82fca2ecac0c7b30780ebb71ce5bad0421b9b4 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:14 +0100
-Subject: [PATCH 22/26] s390x/virtio-ccw: add support for virtio based memory
- devices
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [22/26] 270a9fbe7e5bacfa6c9377815a01da26c4d26097 (thuth/qemu-kvm-cs)
-
-Let's implement support for abstract virtio based memory devices, using
-the virtio-pci implementation as an orientation. Wire them up in the
-machine hotplug handler, taking care of s390x page size limitations.
-
-As we neither support virtio-mem or virtio-pmem yet, the code is
-effectively unused. We'll implement support for virtio-mem based on this
-next.
-
-Note that we won't wire up the virtio-pci variant (should currently be
-impossible due to lack of support for MSI-X), but we'll add a safety net
-to reject plugging them in the pre-plug handler.
-
-Message-ID: <20241219144115.2820241-14-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 88d86f6f1e36741ba9e1625da19a7ccf1a343d39)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- MAINTAINERS                    |   3 +
- hw/s390x/meson.build           |   3 +
- hw/s390x/s390-virtio-ccw.c     |  47 +++++++++-
- hw/s390x/virtio-ccw-md-stubs.c |  24 ++++++
- hw/s390x/virtio-ccw-md.c       | 153 +++++++++++++++++++++++++++++++++
- hw/s390x/virtio-ccw-md.h       |  44 ++++++++++
- hw/virtio/Kconfig              |   1 +
- 7 files changed, 274 insertions(+), 1 deletion(-)
- create mode 100644 hw/s390x/virtio-ccw-md-stubs.c
- create mode 100644 hw/s390x/virtio-ccw-md.c
- create mode 100644 hw/s390x/virtio-ccw-md.h
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index 3584d6a6c6..f21dc3fa75 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2387,6 +2387,9 @@ F: include/hw/virtio/virtio-crypto.h
- virtio based memory device
- M: David Hildenbrand <david@redhat.com>
- S: Supported
-+F: hw/s390x/virtio-ccw-md.c
-+F: hw/s390x/virtio-ccw-md.h
-+F: hw/s390x/virtio-ccw-md-stubs.c
- F: hw/virtio/virtio-md-pci.c
- F: include/hw/virtio/virtio-md-pci.h
- F: stubs/virtio-md-pci.c
-diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
-index e344a3bd8c..4431868408 100644
---- a/hw/s390x/meson.build
-+++ b/hw/s390x/meson.build
-@@ -50,8 +50,11 @@ endif
- virtio_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi-ccw.c'))
- virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-ccw.c'))
- virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs-ccw.c'))
-+virtio_ss.add(when: 'CONFIG_VIRTIO_MD', if_true: files('virtio-ccw-md.c'))
- s390x_ss.add_all(when: 'CONFIG_VIRTIO_CCW', if_true: virtio_ss)
- 
-+s390x_ss.add(when: 'CONFIG_VIRTIO_MD', if_false: files('virtio-ccw-md-stubs.c'))
-+
- hw_arch += {'s390x': s390x_ss}
- 
- hw_s390x_modules = {}
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index bd05a22b4e..9f4ad01789 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -46,6 +46,8 @@
- #include "qapi/visitor.h"
- #include "hw/s390x/cpu-topology.h"
- #include "kvm/kvm_s390x.h"
-+#include "hw/virtio/virtio-md-pci.h"
-+#include "hw/s390x/virtio-ccw-md.h"
- #include CONFIG_DEVICES
- 
- static Error *pv_mig_blocker;
-@@ -546,11 +548,39 @@ static void s390_machine_reset(MachineState *machine, ResetType type)
-     s390_ipl_clear_reset_request();
- }
- 
-+static void s390_machine_device_pre_plug(HotplugHandler *hotplug_dev,
-+                                         DeviceState *dev, Error **errp)
-+{
-+    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_CCW)) {
-+        virtio_ccw_md_pre_plug(VIRTIO_MD_CCW(dev), MACHINE(hotplug_dev), errp);
-+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
-+        error_setg(errp,
-+                   "PCI-attached virtio based memory devices not supported");
-+    }
-+}
-+
- static void s390_machine_device_plug(HotplugHandler *hotplug_dev,
-                                      DeviceState *dev, Error **errp)
- {
-+    S390CcwMachineState *s390ms = S390_CCW_MACHINE(hotplug_dev);
-+
-     if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
-         s390_cpu_plug(hotplug_dev, dev, errp);
-+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_CCW)) {
-+        /*
-+         * At this point, the device is realized and set all memdevs mapped, so
-+         * qemu_maxrampagesize() will pick up the page sizes of these memdevs
-+         * as well. Before we plug the device and expose any RAM memory regions
-+         * to the system, make sure we don't exceed the previously set max page
-+         * size. While only relevant for KVM, there is not really any use case
-+         * for this with TCG, so we'll unconditionally reject it.
-+         */
-+        if (qemu_maxrampagesize() != s390ms->max_pagesize) {
-+            error_setg(errp, "Memory device uses a bigger page size than"
-+                       " initial memory");
-+            return;
-+        }
-+        virtio_ccw_md_plug(VIRTIO_MD_CCW(dev), MACHINE(hotplug_dev), errp);
-     }
- }
- 
-@@ -560,9 +590,20 @@ static void s390_machine_device_unplug_request(HotplugHandler *hotplug_dev,
-     if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
-         error_setg(errp, "CPU hot unplug not supported on this machine");
-         return;
-+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_CCW)) {
-+        virtio_ccw_md_unplug_request(VIRTIO_MD_CCW(dev), MACHINE(hotplug_dev),
-+                                     errp);
-     }
- }
- 
-+static void s390_machine_device_unplug(HotplugHandler *hotplug_dev,
-+                                       DeviceState *dev, Error **errp)
-+{
-+    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_CCW)) {
-+        virtio_ccw_md_unplug(VIRTIO_MD_CCW(dev), MACHINE(hotplug_dev), errp);
-+     }
-+ }
-+
- static CpuInstanceProperties s390_cpu_index_to_props(MachineState *ms,
-                                                      unsigned cpu_index)
- {
-@@ -609,7 +650,9 @@ static const CPUArchIdList *s390_possible_cpu_arch_ids(MachineState *ms)
- static HotplugHandler *s390_get_hotplug_handler(MachineState *machine,
-                                                 DeviceState *dev)
- {
--    if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
-+    if (object_dynamic_cast(OBJECT(dev), TYPE_CPU) ||
-+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_CCW) ||
-+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
-         return HOTPLUG_HANDLER(machine);
-     }
-     return NULL;
-@@ -769,8 +812,10 @@ static void ccw_machine_class_init(ObjectClass *oc, void *data)
-     mc->possible_cpu_arch_ids = s390_possible_cpu_arch_ids;
-     /* it is overridden with 'host' cpu *in kvm_arch_init* */
-     mc->default_cpu_type = S390_CPU_TYPE_NAME("qemu");
-+    hc->pre_plug = s390_machine_device_pre_plug;
-     hc->plug = s390_machine_device_plug;
-     hc->unplug_request = s390_machine_device_unplug_request;
-+    hc->unplug = s390_machine_device_unplug;
-     nc->nmi_monitor_handler = s390_nmi;
-     mc->default_ram_id = "s390.ram";
-     mc->default_nic = "virtio-net-ccw";
-diff --git a/hw/s390x/virtio-ccw-md-stubs.c b/hw/s390x/virtio-ccw-md-stubs.c
-new file mode 100644
-index 0000000000..e937865550
---- /dev/null
-+++ b/hw/s390x/virtio-ccw-md-stubs.c
-@@ -0,0 +1,24 @@
-+#include "qemu/osdep.h"
-+#include "qapi/error.h"
-+#include "hw/s390x/virtio-ccw-md.h"
-+
-+void virtio_ccw_md_pre_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    error_setg(errp, "virtio based memory devices not supported");
-+}
-+
-+void virtio_ccw_md_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    error_setg(errp, "virtio based memory devices not supported");
-+}
-+
-+void virtio_ccw_md_unplug_request(VirtIOMDCcw *vmd, MachineState *ms,
-+                                  Error **errp)
-+{
-+    error_setg(errp, "virtio based memory devices not supported");
-+}
-+
-+void virtio_ccw_md_unplug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    error_setg(errp, "virtio based memory devices not supported");
-+}
-diff --git a/hw/s390x/virtio-ccw-md.c b/hw/s390x/virtio-ccw-md.c
-new file mode 100644
-index 0000000000..de333282df
---- /dev/null
-+++ b/hw/s390x/virtio-ccw-md.c
-@@ -0,0 +1,153 @@
-+/*
-+ * Virtio CCW support for abstract virtio based memory device
-+ *
-+ * Copyright (C) 2024 Red Hat, Inc.
-+ *
-+ * Authors:
-+ *  David Hildenbrand <david@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/s390x/virtio-ccw-md.h"
-+#include "hw/mem/memory-device.h"
-+#include "qapi/error.h"
-+#include "qemu/error-report.h"
-+
-+void virtio_ccw_md_pre_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    DeviceState *dev = DEVICE(vmd);
-+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
-+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
-+    Error *local_err = NULL;
-+
-+    if (!bus_handler && dev->hotplugged) {
-+        /*
-+         * Without a bus hotplug handler, we cannot control the plug/unplug
-+         * order. We should never reach this point when hotplugging, but
-+         * better add a safety net.
-+         */
-+        error_setg(errp, "hotplug of virtio based memory devices not supported"
-+                   " on this bus.");
-+        return;
-+    }
-+
-+    /*
-+     * First, see if we can plug this memory device at all. If that
-+     * succeeds, branch of to the actual hotplug handler.
-+     */
-+    memory_device_pre_plug(md, ms, &local_err);
-+    if (!local_err && bus_handler) {
-+        hotplug_handler_pre_plug(bus_handler, dev, &local_err);
-+    }
-+    error_propagate(errp, local_err);
-+}
-+
-+void virtio_ccw_md_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    DeviceState *dev = DEVICE(vmd);
-+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
-+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
-+    Error *local_err = NULL;
-+
-+    /*
-+     * Plug the memory device first and then branch off to the actual
-+     * hotplug handler. If that one fails, we can easily undo the memory
-+     * device bits.
-+     */
-+    memory_device_plug(md, ms);
-+    if (bus_handler) {
-+        hotplug_handler_plug(bus_handler, dev, &local_err);
-+        if (local_err) {
-+            memory_device_unplug(md, ms);
-+        }
-+    }
-+    error_propagate(errp, local_err);
-+}
-+
-+void virtio_ccw_md_unplug_request(VirtIOMDCcw *vmd, MachineState *ms,
-+                                  Error **errp)
-+{
-+    VirtIOMDCcwClass *vmdc = VIRTIO_MD_CCW_GET_CLASS(vmd);
-+    DeviceState *dev = DEVICE(vmd);
-+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
-+    HotplugHandlerClass *hdc;
-+    Error *local_err = NULL;
-+
-+    if (!vmdc->unplug_request_check) {
-+        error_setg(errp,
-+                   "this virtio based memory devices cannot be unplugged");
-+        return;
-+    }
-+
-+    if (!bus_handler) {
-+        error_setg(errp, "hotunplug of virtio based memory devices not"
-+                   "supported on this bus");
-+        return;
-+    }
-+
-+    vmdc->unplug_request_check(vmd, &local_err);
-+    if (local_err) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-+    /*
-+     * Forward the async request or turn it into a sync request (handling it
-+     * like qdev_unplug()).
-+     */
-+    hdc = HOTPLUG_HANDLER_GET_CLASS(bus_handler);
-+    if (hdc->unplug_request) {
-+        hotplug_handler_unplug_request(bus_handler, dev, &local_err);
-+    } else {
-+        virtio_ccw_md_unplug(vmd, ms, &local_err);
-+        if (!local_err) {
-+            object_unparent(OBJECT(dev));
-+        }
-+    }
-+}
-+
-+void virtio_ccw_md_unplug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp)
-+{
-+    DeviceState *dev = DEVICE(vmd);
-+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
-+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
-+    Error *local_err = NULL;
-+
-+    /* Unplug the memory device while it is still realized. */
-+    memory_device_unplug(md, ms);
-+
-+    if (bus_handler) {
-+        hotplug_handler_unplug(bus_handler, dev, &local_err);
-+        if (local_err) {
-+            /* Not expected to fail ... but still try to recover. */
-+            memory_device_plug(md, ms);
-+            error_propagate(errp, local_err);
-+            return;
-+        }
-+    } else {
-+        /* Very unexpected, but let's just try to do the right thing. */
-+        warn_report("Unexpected unplug of virtio based memory device");
-+        qdev_unrealize(dev);
-+    }
-+}
-+
-+static const TypeInfo virtio_ccw_md_info = {
-+    .name = TYPE_VIRTIO_MD_CCW,
-+    .parent = TYPE_VIRTIO_CCW_DEVICE,
-+    .instance_size = sizeof(VirtIOMDCcw),
-+    .class_size = sizeof(VirtIOMDCcwClass),
-+    .abstract = true,
-+    .interfaces = (InterfaceInfo[]) {
-+        { TYPE_MEMORY_DEVICE },
-+        { }
-+    },
-+};
-+
-+static void virtio_ccw_md_register(void)
-+{
-+    type_register_static(&virtio_ccw_md_info);
-+}
-+type_init(virtio_ccw_md_register)
-diff --git a/hw/s390x/virtio-ccw-md.h b/hw/s390x/virtio-ccw-md.h
-new file mode 100644
-index 0000000000..39ba864c92
---- /dev/null
-+++ b/hw/s390x/virtio-ccw-md.h
-@@ -0,0 +1,44 @@
-+/*
-+ * Virtio CCW support for abstract virtio based memory device
-+ *
-+ * Copyright (C) 2024 Red Hat, Inc.
-+ *
-+ * Authors:
-+ *  David Hildenbrand <david@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef HW_S390X_VIRTIO_CCW_MD_H
-+#define HW_S390X_VIRTIO_CCW_MD_H
-+
-+#include "virtio-ccw.h"
-+#include "qom/object.h"
-+
-+/*
-+ * virtio-md-ccw: This extends VirtioCcwDevice.
-+ */
-+#define TYPE_VIRTIO_MD_CCW "virtio-md-ccw"
-+
-+OBJECT_DECLARE_TYPE(VirtIOMDCcw, VirtIOMDCcwClass, VIRTIO_MD_CCW)
-+
-+struct VirtIOMDCcwClass {
-+    /* private */
-+    VirtIOCCWDeviceClass parent;
-+
-+    /* public */
-+    void (*unplug_request_check)(VirtIOMDCcw *vmd, Error **errp);
-+};
-+
-+struct VirtIOMDCcw {
-+    VirtioCcwDevice parent_obj;
-+};
-+
-+void virtio_ccw_md_pre_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp);
-+void virtio_ccw_md_plug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp);
-+void virtio_ccw_md_unplug_request(VirtIOMDCcw *vmd, MachineState *ms,
-+                                  Error **errp);
-+void virtio_ccw_md_unplug(VirtIOMDCcw *vmd, MachineState *ms, Error **errp);
-+
-+#endif /* HW_S390X_VIRTIO_CCW_MD_H */
-diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
-index 0afec2ae92..f4b14e1a44 100644
---- a/hw/virtio/Kconfig
-+++ b/hw/virtio/Kconfig
-@@ -25,6 +25,7 @@ config VIRTIO_MMIO
- config VIRTIO_CCW
-     bool
-     select VIRTIO
-+    select VIRTIO_MD_SUPPORTED
- 
- config VIRTIO_BALLOON
-     bool
--- 
-2.48.1
-
diff --git a/kvm-s390x-virtio-mem-support.patch b/kvm-s390x-virtio-mem-support.patch
deleted file mode 100644
index 3c7313f..0000000
--- a/kvm-s390x-virtio-mem-support.patch
+++ /dev/null
@@ -1,459 +0,0 @@
-From fa68427f55bee8d18d846e03ebf9f1eeb80f274d Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Thu, 19 Dec 2024 15:41:15 +0100
-Subject: [PATCH 23/26] s390x: virtio-mem support
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [23/26] 4c59ba9025ce5ba7686a7f3e01bb70e8c580709f (thuth/qemu-kvm-cs)
-
-Let's add our virtio-mem-ccw proxy device and wire it up. We should
-be supporting everything (e.g., device unplug, "dynamic-memslots") that
-we already support for the virtio-pci variant.
-
-With a Linux guest that supports virtio-mem (and has automatic memory
-onlining properly configured) the following example will work:
-
-1. Start a VM with 4G initial memory and a virtio-mem device with a maximum
-   capacity of 16GB:
-
-   qemu/build/qemu-system-s390x \
-    --enable-kvm \
-    -m 4G,maxmem=20G \
-    -nographic \
-    -smp 8 \
-    -hda Fedora-Server-KVM-40-1.14.s390x.qcow2 \
-    -chardev socket,id=monitor,path=/var/tmp/monitor,server,nowait \
-    -mon chardev=monitor,mode=readline \
-    -object memory-backend-ram,id=mem0,size=16G,reserve=off \
-    -device virtio-mem-ccw,id=vmem0,memdev=mem0,dynamic-memslots=on
-
-2. Query the current size of virtio-mem device:
-
-    (qemu) info memory-devices
-    Memory device [virtio-mem]: "vmem0"
-      memaddr: 0x100000000
-      node: 0
-      requested-size: 0
-      size: 0
-      max-size: 17179869184
-      block-size: 1048576
-      memdev: /objects/mem0
-
-3. Request to grow it to 8GB (hotplug 8GB):
-
-    (qemu) qom-set vmem0 requested-size 8G
-    (qemu) info memory-devices
-    Memory device [virtio-mem]: "vmem0"
-      memaddr: 0x100000000
-      node: 0
-      requested-size: 8589934592
-      size: 8589934592
-      max-size: 17179869184
-      block-size: 1048576
-      memdev: /objects/mem0
-
-4. Request to grow to 16GB (hotplug another 8GB):
-
-    (qemu) qom-set vmem0 requested-size 16G
-    (qemu) info memory-devices
-    Memory device [virtio-mem]: "vmem0"
-      memaddr: 0x100000000
-      node: 0
-      requested-size: 17179869184
-      size: 17179869184
-      max-size: 17179869184
-      block-size: 1048576
-      memdev: /objects/mem0
-
-5. Try to hotunplug all memory again, shrinking to 0GB:
-
-    (qemu) qom-set vmem0 requested-size 0G
-    (qemu) info memory-devices
-    Memory device [virtio-mem]: "vmem0"
-      memaddr: 0x100000000
-      node: 0
-      requested-size: 0
-      size: 0
-      max-size: 17179869184
-      block-size: 1048576
-      memdev: /objects/mem0
-
-6. If it worked, unplug the device
-
-    (qemu) device_del vmem0
-    (qemu) info memory-devices
-    (qemu) object_del mem0
-
-7. Hotplug a new device with a smaller capacity and directly size it to 1GB
-
-    (qemu) object_add memory-backend-ram,id=mem0,size=8G,reserve=off
-    (qemu) device_add virtio-mem-ccw,id=vmem0,memdev=mem0,\
-                      dynamic-memslots=on,requested-size=1G
-    (qemu) info memory-devices
-    Memory device [virtio-mem]: "vmem0"
-      memaddr: 0x100000000
-      node: 0
-      requested-size: 1073741824
-      size: 1073741824
-      max-size: 8589934592
-      block-size: 1048576
-      memdev: /objects/mem0
-
-Trying to use a virtio-mem device backed by hugetlb into a !hugetlb VM
-correctly results in the error:
-   ... Memory device uses a bigger page size than initial memory
-
-Note that the virtio-mem driver in Linux will supports 1 MiB (pageblock)
-granularity.
-
-Message-ID: <20241219144115.2820241-15-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit aa910c20ec5f3b10551da19e441b3e2b54406e25)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- MAINTAINERS               |   2 +
- hw/s390x/Kconfig          |   1 +
- hw/s390x/meson.build      |   1 +
- hw/s390x/virtio-ccw-mem.c | 226 ++++++++++++++++++++++++++++++++++++++
- hw/s390x/virtio-ccw-mem.h |  34 ++++++
- hw/virtio/virtio-mem.c    |   4 +-
- 6 files changed, 267 insertions(+), 1 deletion(-)
- create mode 100644 hw/s390x/virtio-ccw-mem.c
- create mode 100644 hw/s390x/virtio-ccw-mem.h
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index f21dc3fa75..f7b7ceffc4 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2401,6 +2401,8 @@ W: https://virtio-mem.gitlab.io/
- F: hw/virtio/virtio-mem.c
- F: hw/virtio/virtio-mem-pci.h
- F: hw/virtio/virtio-mem-pci.c
-+F: hw/s390x/virtio-ccw-mem.c
-+F: hw/s390x/virtio-ccw-mem.h
- F: include/hw/virtio/virtio-mem.h
- 
- virtio-snd
-diff --git a/hw/s390x/Kconfig b/hw/s390x/Kconfig
-index 3bbf4ae56e..5d57daff77 100644
---- a/hw/s390x/Kconfig
-+++ b/hw/s390x/Kconfig
-@@ -15,3 +15,4 @@ config S390_CCW_VIRTIO
-     select SCLPCONSOLE
-     select VIRTIO_CCW
-     select MSI_NONBROKEN
-+    select VIRTIO_MEM_SUPPORTED
-diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
-index 4431868408..3bbebfd817 100644
---- a/hw/s390x/meson.build
-+++ b/hw/s390x/meson.build
-@@ -51,6 +51,7 @@ virtio_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi-ccw.c'))
- virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-ccw.c'))
- virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs-ccw.c'))
- virtio_ss.add(when: 'CONFIG_VIRTIO_MD', if_true: files('virtio-ccw-md.c'))
-+virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-ccw-mem.c'))
- s390x_ss.add_all(when: 'CONFIG_VIRTIO_CCW', if_true: virtio_ss)
- 
- s390x_ss.add(when: 'CONFIG_VIRTIO_MD', if_false: files('virtio-ccw-md-stubs.c'))
-diff --git a/hw/s390x/virtio-ccw-mem.c b/hw/s390x/virtio-ccw-mem.c
-new file mode 100644
-index 0000000000..bee0d560cb
---- /dev/null
-+++ b/hw/s390x/virtio-ccw-mem.c
-@@ -0,0 +1,226 @@
-+/*
-+ * virtio-mem CCW implementation
-+ *
-+ * Copyright (C) 2024 Red Hat, Inc.
-+ *
-+ * Authors:
-+ *  David Hildenbrand <david@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/qdev-properties.h"
-+#include "qapi/error.h"
-+#include "qemu/module.h"
-+#include "virtio-ccw-mem.h"
-+#include "hw/mem/memory-device.h"
-+#include "qapi/qapi-events-machine.h"
-+#include "qapi/qapi-events-misc.h"
-+
-+static void virtio_ccw_mem_realize(VirtioCcwDevice *ccw_dev, Error **errp)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(ccw_dev);
-+    DeviceState *vdev = DEVICE(&dev->vdev);
-+
-+    qdev_realize(vdev, BUS(&ccw_dev->bus), errp);
-+}
-+
-+static void virtio_ccw_mem_set_addr(MemoryDeviceState *md, uint64_t addr,
-+                                    Error **errp)
-+{
-+    object_property_set_uint(OBJECT(md), VIRTIO_MEM_ADDR_PROP, addr, errp);
-+}
-+
-+static uint64_t virtio_ccw_mem_get_addr(const MemoryDeviceState *md)
-+{
-+    return object_property_get_uint(OBJECT(md), VIRTIO_MEM_ADDR_PROP,
-+                                    &error_abort);
-+}
-+
-+static MemoryRegion *virtio_ccw_mem_get_memory_region(MemoryDeviceState *md,
-+                                                      Error **errp)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(md);
-+    VirtIOMEM *vmem = &dev->vdev;
-+    VirtIOMEMClass *vmc = VIRTIO_MEM_GET_CLASS(vmem);
-+
-+    return vmc->get_memory_region(vmem, errp);
-+}
-+
-+static void virtio_ccw_mem_decide_memslots(MemoryDeviceState *md,
-+                                           unsigned int limit)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(md);
-+    VirtIOMEM *vmem = VIRTIO_MEM(&dev->vdev);
-+    VirtIOMEMClass *vmc = VIRTIO_MEM_GET_CLASS(vmem);
-+
-+    vmc->decide_memslots(vmem, limit);
-+}
-+
-+static unsigned int virtio_ccw_mem_get_memslots(MemoryDeviceState *md)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(md);
-+    VirtIOMEM *vmem = VIRTIO_MEM(&dev->vdev);
-+    VirtIOMEMClass *vmc = VIRTIO_MEM_GET_CLASS(vmem);
-+
-+    return vmc->get_memslots(vmem);
-+}
-+
-+static uint64_t virtio_ccw_mem_get_plugged_size(const MemoryDeviceState *md,
-+                                                Error **errp)
-+{
-+    return object_property_get_uint(OBJECT(md), VIRTIO_MEM_SIZE_PROP,
-+                                    errp);
-+}
-+
-+static void virtio_ccw_mem_fill_device_info(const MemoryDeviceState *md,
-+                                            MemoryDeviceInfo *info)
-+{
-+    VirtioMEMDeviceInfo *vi = g_new0(VirtioMEMDeviceInfo, 1);
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(md);
-+    VirtIOMEM *vmem = &dev->vdev;
-+    VirtIOMEMClass *vpc = VIRTIO_MEM_GET_CLASS(vmem);
-+    DeviceState *vdev = DEVICE(md);
-+
-+    if (vdev->id) {
-+        vi->id = g_strdup(vdev->id);
-+    }
-+
-+    /* let the real device handle everything else */
-+    vpc->fill_device_info(vmem, vi);
-+
-+    info->u.virtio_mem.data = vi;
-+    info->type = MEMORY_DEVICE_INFO_KIND_VIRTIO_MEM;
-+}
-+
-+static uint64_t virtio_ccw_mem_get_min_alignment(const MemoryDeviceState *md)
-+{
-+    return object_property_get_uint(OBJECT(md), VIRTIO_MEM_BLOCK_SIZE_PROP,
-+                                    &error_abort);
-+}
-+
-+static void virtio_ccw_mem_size_change_notify(Notifier *notifier, void *data)
-+{
-+    VirtIOMEMCcw *dev = container_of(notifier, VirtIOMEMCcw,
-+                                         size_change_notifier);
-+    DeviceState *vdev = DEVICE(dev);
-+    char *qom_path = object_get_canonical_path(OBJECT(dev));
-+    const uint64_t * const size_p = data;
-+
-+    qapi_event_send_memory_device_size_change(vdev->id, *size_p, qom_path);
-+    g_free(qom_path);
-+}
-+
-+static void virtio_ccw_mem_unplug_request_check(VirtIOMDCcw *vmd, Error **errp)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(vmd);
-+    VirtIOMEM *vmem = &dev->vdev;
-+    VirtIOMEMClass *vpc = VIRTIO_MEM_GET_CLASS(vmem);
-+
-+    vpc->unplug_request_check(vmem, errp);
-+}
-+
-+static void virtio_ccw_mem_get_requested_size(Object *obj, Visitor *v,
-+                                              const char *name, void *opaque,
-+                                              Error **errp)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(obj);
-+
-+    object_property_get(OBJECT(&dev->vdev), name, v, errp);
-+}
-+
-+static void virtio_ccw_mem_set_requested_size(Object *obj, Visitor *v,
-+                                              const char *name, void *opaque,
-+                                              Error **errp)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(obj);
-+    DeviceState *vdev = DEVICE(obj);
-+
-+    /*
-+     * If we passed virtio_ccw_mem_unplug_request_check(), making sure that
-+     * the requested size is 0, don't allow modifying the requested size
-+     * anymore, otherwise the VM might end up hotplugging memory before
-+     * handling the unplug request.
-+     */
-+    if (vdev->pending_deleted_event) {
-+        error_setg(errp, "'%s' cannot be changed if the device is in the"
-+                   " process of unplug", name);
-+        return;
-+    }
-+
-+    object_property_set(OBJECT(&dev->vdev), name, v, errp);
-+}
-+
-+static Property virtio_ccw_mem_properties[] = {
-+    DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
-+                    VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
-+    DEFINE_PROP_UINT32("max_revision", VirtioCcwDevice, max_rev,
-+                       VIRTIO_CCW_MAX_REV),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void virtio_ccw_mem_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
-+    MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(klass);
-+    VirtIOMDCcwClass *vmdc = VIRTIO_MD_CCW_CLASS(klass);
-+
-+    k->realize = virtio_ccw_mem_realize;
-+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-+    device_class_set_props(dc, virtio_ccw_mem_properties);
-+
-+    mdc->get_addr = virtio_ccw_mem_get_addr;
-+    mdc->set_addr = virtio_ccw_mem_set_addr;
-+    mdc->get_plugged_size = virtio_ccw_mem_get_plugged_size;
-+    mdc->get_memory_region = virtio_ccw_mem_get_memory_region;
-+    mdc->decide_memslots = virtio_ccw_mem_decide_memslots;
-+    mdc->get_memslots = virtio_ccw_mem_get_memslots;
-+    mdc->fill_device_info = virtio_ccw_mem_fill_device_info;
-+    mdc->get_min_alignment = virtio_ccw_mem_get_min_alignment;
-+
-+    vmdc->unplug_request_check = virtio_ccw_mem_unplug_request_check;
-+}
-+
-+static void virtio_ccw_mem_instance_init(Object *obj)
-+{
-+    VirtIOMEMCcw *dev = VIRTIO_MEM_CCW(obj);
-+    VirtIOMEMClass *vmc;
-+    VirtIOMEM *vmem;
-+
-+    virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev),
-+                                TYPE_VIRTIO_MEM);
-+
-+    dev->size_change_notifier.notify = virtio_ccw_mem_size_change_notify;
-+    vmem = &dev->vdev;
-+    vmc = VIRTIO_MEM_GET_CLASS(vmem);
-+    /*
-+     * We never remove the notifier again, as we expect both devices to
-+     * disappear at the same time.
-+     */
-+    vmc->add_size_change_notifier(vmem, &dev->size_change_notifier);
-+
-+    object_property_add_alias(obj, VIRTIO_MEM_BLOCK_SIZE_PROP,
-+                              OBJECT(&dev->vdev), VIRTIO_MEM_BLOCK_SIZE_PROP);
-+    object_property_add_alias(obj, VIRTIO_MEM_SIZE_PROP, OBJECT(&dev->vdev),
-+                              VIRTIO_MEM_SIZE_PROP);
-+    object_property_add(obj, VIRTIO_MEM_REQUESTED_SIZE_PROP, "size",
-+                        virtio_ccw_mem_get_requested_size,
-+                        virtio_ccw_mem_set_requested_size, NULL, NULL);
-+}
-+
-+static const TypeInfo virtio_ccw_mem = {
-+    .name = TYPE_VIRTIO_MEM_CCW,
-+    .parent = TYPE_VIRTIO_MD_CCW,
-+    .instance_size = sizeof(VirtIOMEMCcw),
-+    .instance_init = virtio_ccw_mem_instance_init,
-+    .class_init = virtio_ccw_mem_class_init,
-+};
-+
-+static void virtio_ccw_mem_register_types(void)
-+{
-+    type_register_static(&virtio_ccw_mem);
-+}
-+type_init(virtio_ccw_mem_register_types)
-diff --git a/hw/s390x/virtio-ccw-mem.h b/hw/s390x/virtio-ccw-mem.h
-new file mode 100644
-index 0000000000..738ab2c744
---- /dev/null
-+++ b/hw/s390x/virtio-ccw-mem.h
-@@ -0,0 +1,34 @@
-+/*
-+ * Virtio MEM CCW device
-+ *
-+ * Copyright (C) 2024 Red Hat, Inc.
-+ *
-+ * Authors:
-+ *  David Hildenbrand <david@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef HW_S390X_VIRTIO_CCW_MEM_H
-+#define HW_S390X_VIRTIO_CCW_MEM_H
-+
-+#include "virtio-ccw-md.h"
-+#include "hw/virtio/virtio-mem.h"
-+#include "qom/object.h"
-+
-+typedef struct VirtIOMEMCcw VirtIOMEMCcw;
-+
-+/*
-+ * virtio-mem-ccw: This extends VirtIOMDCcw
-+ */
-+#define TYPE_VIRTIO_MEM_CCW "virtio-mem-ccw"
-+DECLARE_INSTANCE_CHECKER(VirtIOMEMCcw, VIRTIO_MEM_CCW, TYPE_VIRTIO_MEM_CCW)
-+
-+struct VirtIOMEMCcw {
-+    VirtIOMDCcw parent_obj;
-+    VirtIOMEM vdev;
-+    Notifier size_change_notifier;
-+};
-+
-+#endif /* HW_S390X_VIRTIO_CCW_MEM_H */
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 00da98b6e1..c9f8a23bbc 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -61,6 +61,8 @@ static uint32_t virtio_mem_default_thp_size(void)
-     } else if (qemu_real_host_page_size() == 64 * KiB) {
-         default_thp_size = 512 * MiB;
-     }
-+#elif defined(__s390x__)
-+    default_thp_size = 1 * MiB;
- #endif
- 
-     return default_thp_size;
-@@ -161,7 +163,7 @@ static bool virtio_mem_has_shared_zeropage(RAMBlock *rb)
-  * necessary (as the section size can change). But it's more likely that the
-  * section size will rather get smaller and not bigger over time.
-  */
--#if defined(TARGET_X86_64) || defined(TARGET_I386)
-+#if defined(TARGET_X86_64) || defined(TARGET_I386) || defined(TARGET_S390X)
- #define VIRTIO_MEM_USABLE_EXTENT (2 * (128 * MiB))
- #elif defined(TARGET_ARM)
- #define VIRTIO_MEM_USABLE_EXTENT (2 * (512 * MiB))
--- 
-2.48.1
-
diff --git a/kvm-scripts-improve-error-from-qemu-trace-stap-on-missin.patch b/kvm-scripts-improve-error-from-qemu-trace-stap-on-missin.patch
deleted file mode 100644
index a6c8257..0000000
--- a/kvm-scripts-improve-error-from-qemu-trace-stap-on-missin.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 314804fa4be6d653a7809b64076d4f3133a0ff59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Fri, 6 Dec 2024 11:45:24 +0000
-Subject: [PATCH 8/9] scripts: improve error from qemu-trace-stap on missing
- 'stap'
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 345: scripts: improve error from qemu-trace-stap on missing 'stap'
-RH-Jira: RHEL-47340
-RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/2] c90635123f40e683488d83b59c71a5236c6d4659 (berrange/centos-src-qemu)
-
-If the 'stap' binary is missing in $PATH, a huge trace is thrown
-
-  $ qemu-trace-stap list /usr/bin/qemu-system-x86_64
-  Traceback (most recent call last):
-  File "/usr/bin/qemu-trace-stap", line 169, in <module>
-  main()
-  File "/usr/bin/qemu-trace-stap", line 165, in main
-  args.func(args)
-  File "/usr/bin/qemu-trace-stap", line 83, in cmd_run
-  subprocess.call(stapargs)
-  File "/usr/lib64/python3.12/subprocess.py", line 389, in call
-  with Popen(*popenargs, **kwargs) as p:
-  ^^^^^^^^^^^^^^^^^^^^^^^^^^^
-  File "/usr/lib64/python3.12/subprocess.py", line 1026, in {}init{}
-  self._execute_child(args, executable, preexec_fn, close_fds,
-  File "/usr/lib64/python3.12/subprocess.py", line 1955, in _execute_child
-  raise child_exception_type(errno_num, err_msg, err_filename)
-  FileNotFoundError: [Errno 2] No such file or directory: 'stap'
-
-With this change the user now gets
-
-  $ qemu-trace-stap list /usr/bin/qemu-system-x86_64
-  Unable to find 'stap' in $PATH
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20241206114524.1666664-1-berrange@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 9976be3911a2d0503f026ae37c17077273bf30ee)
----
- scripts/qemu-trace-stap | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/scripts/qemu-trace-stap b/scripts/qemu-trace-stap
-index eb6e951ff2..e983460ee7 100755
---- a/scripts/qemu-trace-stap
-+++ b/scripts/qemu-trace-stap
-@@ -56,6 +56,7 @@ def tapset_dir(binary):
- 
- 
- def cmd_run(args):
-+    stap = which("stap")
-     prefix = probe_prefix(args.binary)
-     tapsets = tapset_dir(args.binary)
- 
-@@ -76,7 +77,7 @@ def cmd_run(args):
- 
-     # We request an 8MB buffer, since the stap default 1MB buffer
-     # can be easily overflowed by frequently firing QEMU traces
--    stapargs = ["stap", "-s", "8", "-I", tapsets ]
-+    stapargs = [stap, "-s", "8", "-I", tapsets ]
-     if args.pid is not None:
-         stapargs.extend(["-x", args.pid])
-     stapargs.extend(["-e", script])
-@@ -84,6 +85,7 @@ def cmd_run(args):
- 
- 
- def cmd_list(args):
-+    stap = which("stap")
-     tapsets = tapset_dir(args.binary)
- 
-     if args.verbose:
-@@ -96,7 +98,7 @@ def cmd_list(args):
- 
-         if verbose:
-             print("Listing probes with name '%s'" % script)
--        proc = subprocess.Popen(["stap", "-I", tapsets, "-l", script],
-+        proc = subprocess.Popen([stap, "-I", tapsets, "-l", script],
-                                 stdout=subprocess.PIPE,
-                                 universal_newlines=True)
-         out, err = proc.communicate()
--- 
-2.48.1
-
diff --git a/kvm-scsi-fix-allocation-for-s390x-loadparm.patch b/kvm-scsi-fix-allocation-for-s390x-loadparm.patch
deleted file mode 100644
index d2a9833..0000000
--- a/kvm-scsi-fix-allocation-for-s390x-loadparm.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 15f5e84210537514394b18e9dc6c710ad1218ecd Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 19 Nov 2024 22:31:22 +0100
-Subject: [PATCH 06/10] scsi: fix allocation for s390x loadparm
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 298: [c9s] Fixes for the new s390x "boot order" feature
-RH-Jira: RHEL-68440
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/8] 6a0e420261eb0521d4f979d2a6c250ee4aae7606 (thuth/qemu-kvm-cs9)
-
-Coverity reports a possible buffer overrun due to a non-NUL-terminated
-string in scsi_property_set_loadparm().  While things are not so easy,
-because qdev_prop_sanitize_s390x_loadparm is designed to operate on a
-buffer that is not NUL-terminated, in this case the string *does* have
-to be NUL-terminated because it is read by scsi_property_get_loadparm
-and s390_build_iplb.
-
-Reviewed-by: jrossi@linux.ibm.com
-Cc: thuth@redhat.com
-Fixes: 429442e52d9 ("hw: Add "loadparm" property to scsi disk devices for booting on s390x", 2024-11-18)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b73d7eff1eedb2399cd594bc872d5db13506d951)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/scsi/scsi-disk.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 7566a5f531..de0c295173 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -3152,7 +3152,7 @@ static void scsi_property_set_loadparm(Object *obj, const char *value,
-         return;
-     }
- 
--    lp_str = g_malloc0(strlen(value));
-+    lp_str = g_malloc0(strlen(value) + 1);
-     if (!qdev_prop_sanitize_s390x_loadparm(lp_str, value, errp)) {
-         g_free(lp_str);
-         return;
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch b/kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch
deleted file mode 100644
index 668cefa..0000000
--- a/kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From bc3752c831177ce5a57121b6a7f6753e024b211c Mon Sep 17 00:00:00 2001
-From: Tao Su <tao1.su@linux.intel.com>
-Date: Thu, 31 Oct 2024 16:52:32 +0800
-Subject: [PATCH 07/11] target/i386: Add AVX512 state when AVX10 is supported
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/9] 6c1875f13c0d3224e8afe7d03ef3681285f85c98 (bonzini/rhel-qemu-kvm)
-
-AVX10 state enumeration in CPUID leaf D and enabling in XCR0 register
-are identical to AVX512 state regardless of the supported vector lengths.
-
-Given that some E-cores will support AVX10 but not support AVX512, add
-AVX512 state components to guest when AVX10 is enabled.
-
-Based on a patch by Tao Su <tao1.su@linux.intel.com>
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Tested-by: Xuelian Guo <xuelian.guo@intel.com>
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-8-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0d7475be3b402c25d74c5a4573cbeb733c8f3559)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 71d1f362e2..5042cbaa0e 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -7142,7 +7142,15 @@ static bool cpuid_has_xsave_feature(CPUX86State *env, const ExtSaveArea *esa)
-         return false;
-     }
- 
--    return (env->features[esa->feature] & esa->bits);
-+    if (env->features[esa->feature] & esa->bits) {
-+        return true;
-+    }
-+    if (esa->feature == FEAT_7_0_EBX && esa->bits == CPUID_7_0_EBX_AVX512F
-+        && (env->features[FEAT_7_1_EDX] & CPUID_7_1_EDX_AVX10)) {
-+        return true;
-+    }
-+
-+    return false;
- }
- 
- static void x86_cpu_reset_hold(Object *obj, ResetType type)
--- 
-2.48.0
-
diff --git a/kvm-target-i386-Add-PerfMonV2-feature-bit.patch b/kvm-target-i386-Add-PerfMonV2-feature-bit.patch
deleted file mode 100644
index 217987d..0000000
--- a/kvm-target-i386-Add-PerfMonV2-feature-bit.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 1587da0703e72cca8325a20b709280b8df85d066 Mon Sep 17 00:00:00 2001
-From: Sandipan Das <sandipan.das@amd.com>
-Date: Thu, 24 Oct 2024 17:18:21 -0500
-Subject: [PATCH 16/57] target/i386: Add PerfMonV2 feature bit
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/8] ec365cf4ac558c6c83f7a957e8df937cb6fbfa27 (johnalle/qemu-kvm-fork)
-
-CPUID leaf 0x80000022, i.e. ExtPerfMonAndDbg, advertises new performance
-monitoring features for AMD processors. Bit 0 of EAX indicates support
-for Performance Monitoring Version 2 (PerfMonV2) features. If found to
-be set during PMU initialization, the EBX bits can be used to determine
-the number of available counters for different PMUs. It also denotes the
-availability of global control and status registers.
-
-Add the required CPUID feature word and feature bit to allow guests to
-make use of the PerfMonV2 features.
-
-Signed-off-by: Sandipan Das <sandipan.das@amd.com>
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/a96f00ee2637674c63c61e9fc4dee343ea818053.1729807947.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 209b0ac12074341d0093985eb9ad3e7edb252ce5)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 26 ++++++++++++++++++++++++++
- target/i386/cpu.h |  4 ++++
- 2 files changed, 30 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 53069a460c..4546369836 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1246,6 +1246,22 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-         .tcg_features = 0,
-         .unmigratable_flags = 0,
-     },
-+    [FEAT_8000_0022_EAX] = {
-+        .type = CPUID_FEATURE_WORD,
-+        .feat_names = {
-+            "perfmon-v2", NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, NULL,
-+        },
-+        .cpuid = { .eax = 0x80000022, .reg = R_EAX, },
-+        .tcg_features = 0,
-+        .unmigratable_flags = 0,
-+    },
-     [FEAT_XSAVE] = {
-         .type = CPUID_FEATURE_WORD,
-         .feat_names = {
-@@ -7096,6 +7112,16 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-             *edx = 0;
-         }
-         break;
-+    case 0x80000022:
-+        *eax = *ebx = *ecx = *edx = 0;
-+        /* AMD Extended Performance Monitoring and Debug */
-+        if (kvm_enabled() && cpu->enable_pmu &&
-+            (env->features[FEAT_8000_0022_EAX] & CPUID_8000_0022_EAX_PERFMON_V2)) {
-+            *eax |= CPUID_8000_0022_EAX_PERFMON_V2;
-+            *ebx |= kvm_arch_get_supported_cpuid(cs->kvm_state, index, count,
-+                                                 R_EBX) & 0xf;
-+        }
-+        break;
-     case 0xC0000000:
-         *eax = env->cpuid_xlevel2;
-         *ebx = 0;
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 9a16239b8e..cf92a4972c 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -638,6 +638,7 @@ typedef enum FeatureWord {
-     FEAT_8000_0007_EDX, /* CPUID[8000_0007].EDX */
-     FEAT_8000_0008_EBX, /* CPUID[8000_0008].EBX */
-     FEAT_8000_0021_EAX, /* CPUID[8000_0021].EAX */
-+    FEAT_8000_0022_EAX, /* CPUID[8000_0022].EAX */
-     FEAT_C000_0001_EDX, /* CPUID[C000_0001].EDX */
-     FEAT_KVM,           /* CPUID[4000_0001].EAX (KVM_CPUID_FEATURES) */
-     FEAT_KVM_HINTS,     /* CPUID[4000_0001].EDX */
-@@ -1044,6 +1045,9 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- /* Not vulnerable to SRSO at the user-kernel boundary */
- #define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)
- 
-+/* Performance Monitoring Version 2 */
-+#define CPUID_8000_0022_EAX_PERFMON_V2  (1U << 0)
-+
- #define CPUID_XSAVE_XSAVEOPT   (1U << 0)
- #define CPUID_XSAVE_XSAVEC     (1U << 1)
- #define CPUID_XSAVE_XGETBV1    (1U << 2)
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch b/kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch
deleted file mode 100644
index 6214232..0000000
--- a/kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 79ac76edecdbbe253ad42385730aac18cdc40bd7 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Fri, 20 Jun 2025 14:54:53 -0500
-Subject: [PATCH 20/57] target/i386: Add couple of feature bits in
- CPUID_Fn80000021_EAX
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/8] c6507eb24fcef271fdd6a234d2c255ef38c4e691 (johnalle/qemu-kvm-fork)
-
-Add CPUID bit indicates that a WRMSR to MSR_FS_BASE, MSR_GS_BASE, or
-MSR_KERNEL_GS_BASE is non-serializing amd PREFETCHI that the
-cates
-support for IC prefetch.
-
-CPUID_Fn80000021_EAX
-Bit    Feature description
-20     Indicates support for IC prefetch.
-1      FsGsKernelGsBaseNonSerializing.
-       WRMSR to FS_BASE, GS_BASE and KernelGSbase are
-serializing.
-
-Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/a5f6283a59579b09ac345b3f21ecb3b3b2d92451.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit dfd5b456108a75588ab094358ba5754787146d3d)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 4 ++--
- target/i386/cpu.h | 4 ++++
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 7d48c51767..2218071fca 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1233,12 +1233,12 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-     [FEAT_8000_0021_EAX] = {
-         .type = CPUID_FEATURE_WORD,
-         .feat_names = {
--            "no-nested-data-bp", NULL, "lfence-always-serializing", NULL,
-+            "no-nested-data-bp", "fs-gs-base-ns", "lfence-always-serializing", NULL,
-             NULL, NULL, "null-sel-clr-base", NULL,
-             "auto-ibrs", NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
--            NULL, NULL, NULL, NULL,
-+            "prefetchi", NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
-         },
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index cf92a4972c..e513e5f62d 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -1030,12 +1030,16 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- 
- /* Processor ignores nested data breakpoints */
- #define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
-+/* WRMSR to FS_BASE, GS_BASE, or KERNEL_GS_BASE is non-serializing */
-+#define CPUID_8000_0021_EAX_FS_GS_BASE_NS                (1U << 1)
- /* LFENCE is always serializing */
- #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
- /* Null Selector Clears Base */
- #define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
- /* Automatic IBRS */
- #define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
-+/* Indicates support for IC prefetch */
-+#define CPUID_8000_0021_EAX_PREFETCHI                    (1U << 20)
- /* Selective Branch Predictor Barrier */
- #define CPUID_8000_0021_EAX_SBPB                         (1U << 27)
- /* IBPB includes branch type prediction flushing */
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Add-feature-dependencies-for-AVX10.patch b/kvm-target-i386-Add-feature-dependencies-for-AVX10.patch
deleted file mode 100644
index b6a87af..0000000
--- a/kvm-target-i386-Add-feature-dependencies-for-AVX10.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From eaa0a5dae408cb2848fcd2a8fe3999cba992ddef Mon Sep 17 00:00:00 2001
-From: Tao Su <tao1.su@linux.intel.com>
-Date: Thu, 31 Oct 2024 16:52:31 +0800
-Subject: [PATCH 06/11] target/i386: Add feature dependencies for AVX10
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/9] cbe290c488128b5b5a8f11b29d90399fb6172c57 (bonzini/rhel-qemu-kvm)
-
-Since the highest supported vector length for a processor implies that
-all lesser vector lengths are also supported, add the dependencies of
-the supported vector lengths. If all vector lengths aren't supported,
-clear AVX10 enable bit as well.
-
-Note that the order of AVX10 related dependencies should be kept as:
-        CPUID_24_0_EBX_AVX10_128     -> CPUID_24_0_EBX_AVX10_256,
-        CPUID_24_0_EBX_AVX10_256     -> CPUID_24_0_EBX_AVX10_512,
-        CPUID_24_0_EBX_AVX10_VL_MASK -> CPUID_7_1_EDX_AVX10,
-        CPUID_7_1_EDX_AVX10          -> CPUID_24_0_EBX,
-so that prevent user from setting weird CPUID combinations, e.g. 256-bits
-and 512-bits are supported but 128-bits is not, no vector lengths are
-supported but AVX10 enable bit is still set.
-
-Since AVX10_128 will be reserved as 1, adding these dependencies has the
-bonus that when user sets -cpu host,-avx10-128, CPUID_7_1_EDX_AVX10 and
-CPUID_24_0_EBX will be disabled automatically.
-
-Tested-by: Xuelian Guo <xuelian.guo@intel.com>
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241028024512.156724-5-tao1.su@linux.intel.com
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-7-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 150ab84b2d0083e6af344cca70290614d4fe568d)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 16 ++++++++++++++++
- target/i386/cpu.h |  4 ++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index b6021be50d..71d1f362e2 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1766,6 +1766,22 @@ static FeatureDep feature_dependencies[] = {
-         .from = { FEAT_7_0_EBX,             CPUID_7_0_EBX_SGX },
-         .to = { FEAT_SGX_12_1_EAX,          ~0ull },
-     },
-+    {
-+        .from = { FEAT_24_0_EBX,            CPUID_24_0_EBX_AVX10_128 },
-+        .to = { FEAT_24_0_EBX,              CPUID_24_0_EBX_AVX10_256 },
-+    },
-+    {
-+        .from = { FEAT_24_0_EBX,            CPUID_24_0_EBX_AVX10_256 },
-+        .to = { FEAT_24_0_EBX,              CPUID_24_0_EBX_AVX10_512 },
-+    },
-+    {
-+        .from = { FEAT_24_0_EBX,            CPUID_24_0_EBX_AVX10_VL_MASK },
-+        .to = { FEAT_7_1_EDX,               CPUID_7_1_EDX_AVX10 },
-+    },
-+    {
-+        .from = { FEAT_7_1_EDX,             CPUID_7_1_EDX_AVX10 },
-+        .to = { FEAT_24_0_EBX,              ~0ull },
-+    },
- };
- 
- typedef struct X86RegisterInfo32 {
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index c60290b8d5..4da9ed5930 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -997,6 +997,10 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_24_0_EBX_AVX10_256        (1U << 17)
- /* AVX10 512-bit vector support is present */
- #define CPUID_24_0_EBX_AVX10_512        (1U << 18)
-+/* AVX10 vector length support mask */
-+#define CPUID_24_0_EBX_AVX10_VL_MASK    (CPUID_24_0_EBX_AVX10_128 | \
-+                                         CPUID_24_0_EBX_AVX10_256 | \
-+                                         CPUID_24_0_EBX_AVX10_512)
- 
- /* RAS Features */
- #define CPUID_8000_0007_EBX_OVERFLOW_RECOV    (1U << 0)
--- 
-2.48.0
-
diff --git a/kvm-target-i386-Add-support-for-EPYC-Turin-model.patch b/kvm-target-i386-Add-support-for-EPYC-Turin-model.patch
deleted file mode 100644
index 6293b4c..0000000
--- a/kvm-target-i386-Add-support-for-EPYC-Turin-model.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-From e0b59a57883faac254cd75cc243fed784ad4975b Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 8 May 2025 14:58:04 -0500
-Subject: [PATCH 22/57] target/i386: Add support for EPYC-Turin model
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [8/8] 42e90c7fc6bf858f98ae3a6be35d70b824a7d6bf (johnalle/qemu-kvm-fork)
-
-Add the support for AMD EPYC zen 5 processors (EPYC-Turin).
-
-Add the following new feature bits on top of the feature bits from
-the previous generation EPYC models.
-
-movdiri             : Move Doubleword as Direct Store Instruction
-movdir64b           : Move 64 Bytes as Direct Store Instruction
-avx512-vp2intersect : AVX512 Vector Pair Intersection to a Pair
-                      of Mask Register
-avx-vnni            : AVX VNNI Instruction
-prefetchi           : Indicates support for IC prefetch
-sbpb                : Selective Branch Predictor Barrier
-ibpb-brtype         : IBPB includes branch type prediction flushing
-srso-user-kernel-no : Not vulnerable to SRSO at the user-kernel boundary
-
-Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
-Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/b4fa7708a0e1453d2e9b8ec3dc881feb92eeca0b.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 3771a4daa273ba17cb27309984413790d1df5651)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 138 ++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 138 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2bc2d41259..fdfa183f4d 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -2651,6 +2651,61 @@ static const CPUCaches epyc_genoa_v2_cache_info = {
-         .share_level = CPU_TOPO_LEVEL_DIE,
-     },
- };
-+
-+static const CPUCaches epyc_turin_cache_info = {
-+    .l1d_cache = &(CPUCacheInfo) {
-+        .type = DATA_CACHE,
-+        .level = 1,
-+        .size = 48 * KiB,
-+        .line_size = 64,
-+        .associativity = 12,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l1i_cache = &(CPUCacheInfo) {
-+        .type = INSTRUCTION_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l2_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 2,
-+        .size = 1 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 1024,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .inclusive = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l3_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 3,
-+        .size = 32 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 32768,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .no_invd_sharing = true,
-+        .complex_indexing = false,
-+        .share_level = CPU_TOPO_LEVEL_DIE,
-+    },
-+};
-+
- /* The following VMX features are not supported by KVM and are left out in the
-  * CPU definitions:
-  *
-@@ -5644,6 +5699,89 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-             { /* end of list */ }
-         }
-     },
-+    {
-+        .name = "EPYC-Turin",
-+        .level = 0xd,
-+        .vendor = CPUID_VENDOR_AMD,
-+        .family = 26,
-+        .model = 0,
-+        .stepping = 0,
-+        .features[FEAT_1_ECX] =
-+            CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
-+            CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
-+            CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
-+            CPUID_EXT_PCID | CPUID_EXT_CX16 | CPUID_EXT_FMA |
-+            CPUID_EXT_SSSE3 | CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ |
-+            CPUID_EXT_SSE3,
-+        .features[FEAT_1_EDX] =
-+            CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
-+            CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
-+            CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
-+            CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
-+            CPUID_VME | CPUID_FP87,
-+        .features[FEAT_6_EAX] =
-+            CPUID_6_EAX_ARAT,
-+        .features[FEAT_7_0_EBX] =
-+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
-+            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
-+            CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_AVX512F |
-+            CPUID_7_0_EBX_AVX512DQ | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
-+            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_AVX512IFMA |
-+            CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB |
-+            CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI |
-+            CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
-+        .features[FEAT_7_0_ECX] =
-+            CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
-+            CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
-+            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
-+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
-+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
-+            CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_MOVDIRI |
-+            CPUID_7_0_ECX_MOVDIR64B,
-+        .features[FEAT_7_0_EDX] =
-+            CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_AVX512_VP2INTERSECT,
-+        .features[FEAT_7_1_EAX] =
-+            CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16,
-+        .features[FEAT_8000_0001_ECX] =
-+            CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
-+            CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
-+            CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
-+            CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
-+        .features[FEAT_8000_0001_EDX] =
-+            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
-+            CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
-+            CPUID_EXT2_SYSCALL,
-+        .features[FEAT_8000_0007_EBX] =
-+            CPUID_8000_0007_EBX_OVERFLOW_RECOV | CPUID_8000_0007_EBX_SUCCOR,
-+        .features[FEAT_8000_0008_EBX] =
-+            CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
-+            CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
-+            CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP |
-+            CPUID_8000_0008_EBX_STIBP_ALWAYS_ON |
-+            CPUID_8000_0008_EBX_AMD_SSBD | CPUID_8000_0008_EBX_AMD_PSFD,
-+        .features[FEAT_8000_0021_EAX] =
-+            CPUID_8000_0021_EAX_NO_NESTED_DATA_BP |
-+            CPUID_8000_0021_EAX_FS_GS_BASE_NS |
-+            CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING |
-+            CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE |
-+            CPUID_8000_0021_EAX_AUTO_IBRS | CPUID_8000_0021_EAX_PREFETCHI |
-+            CPUID_8000_0021_EAX_SBPB | CPUID_8000_0021_EAX_IBPB_BRTYPE |
-+            CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO,
-+        .features[FEAT_8000_0022_EAX] =
-+            CPUID_8000_0022_EAX_PERFMON_V2,
-+        .features[FEAT_XSAVE] =
-+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
-+            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
-+        .features[FEAT_SVM] =
-+            CPUID_SVM_NPT | CPUID_SVM_LBRV | CPUID_SVM_NRIPSAVE |
-+            CPUID_SVM_TSCSCALE | CPUID_SVM_VMCBCLEAN | CPUID_SVM_FLUSHASID |
-+            CPUID_SVM_PAUSEFILTER | CPUID_SVM_PFTHRESHOLD |
-+            CPUID_SVM_V_VMSAVE_VMLOAD | CPUID_SVM_VGIF |
-+            CPUID_SVM_VNMI | CPUID_SVM_SVME_ADDR_CHK,
-+        .xlevel = 0x80000022,
-+        .model_id = "AMD EPYC-Turin Processor",
-+        .cache_info = &epyc_turin_cache_info,
-+    },
- };
- 
- /*
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch b/kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch
deleted file mode 100644
index 1fac08e..0000000
--- a/kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From d6c70ced910aede72d11b6a698bfda9648a3c959 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:43 +0200
-Subject: [PATCH 002/115] target/i386: Enable fdp-excptn-only and zero-fcs-fds
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [2/115] 58b986eab9ccc86b3f50ca480ae184779cd85bee (bonzini/rhel-qemu-kvm)
-
-- CPUID.(EAX=07H,ECX=0H):EBX[bit 6]: x87 FPU Data Pointer updated only
-  on x87 exceptions if 1.
-
-- CPUID.(EAX=07H,ECX=0H):EBX[bit 13]: Deprecates FPU CS and FPU DS
-  values if 1. i.e., X87 FCS and FDS are always zero.
-
-Define names for them so that they can be exposed to guest with -cpu host.
-
-Also define the bit field MACROs so that named cpu models can add it as
-well in the future.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20240814075431.339209-3-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 7dddc3bb875e7141ab25931d0f30a1c319bc8457)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 4 ++--
- target/i386/cpu.h | 4 ++++
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 0ac6cd8ad7..1fe492f33d 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1058,9 +1058,9 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-         .type = CPUID_FEATURE_WORD,
-         .feat_names = {
-             "fsgsbase", "tsc-adjust", "sgx", "bmi1",
--            "hle", "avx2", NULL, "smep",
-+            "hle", "avx2", "fdp-excptn-only", "smep",
-             "bmi2", "erms", "invpcid", "rtm",
--            NULL, NULL, "mpx", NULL,
-+            NULL, "zero-fcs-fds", "mpx", NULL,
-             "avx512f", "avx512dq", "rdseed", "adx",
-             "smap", "avx512ifma", "pcommit", "clflushopt",
-             "clwb", "intel-pt", "avx512pf", "avx512er",
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index e513e5f62d..5924761551 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -828,6 +828,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_0_EBX_HLE               (1U << 4)
- /* Intel Advanced Vector Extensions 2 */
- #define CPUID_7_0_EBX_AVX2              (1U << 5)
-+/* FPU data pointer updated only on x87 exceptions */
-+#define CPUID_7_0_EBX_FDP_EXCPTN_ONLY (1u << 6)
- /* Supervisor-mode Execution Prevention */
- #define CPUID_7_0_EBX_SMEP              (1U << 7)
- /* 2nd Group of Advanced Bit Manipulation Extensions */
-@@ -838,6 +840,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_0_EBX_INVPCID           (1U << 10)
- /* Restricted Transactional Memory */
- #define CPUID_7_0_EBX_RTM               (1U << 11)
-+/* Zero out FPU CS and FPU DS */
-+#define CPUID_7_0_EBX_ZERO_FCS_FDS      (1U << 13)
- /* Memory Protection Extension */
- #define CPUID_7_0_EBX_MPX               (1U << 14)
- /* AVX-512 Foundation */
--- 
-2.50.1
-
diff --git a/kvm-target-i386-Exclude-hv-syndbg-from-hv-passthrough.patch b/kvm-target-i386-Exclude-hv-syndbg-from-hv-passthrough.patch
deleted file mode 100644
index df4e5e3..0000000
--- a/kvm-target-i386-Exclude-hv-syndbg-from-hv-passthrough.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 0288537593cd4452a2523b686b297dad3735f7f8 Mon Sep 17 00:00:00 2001
-From: Vitaly Kuznetsov <vkuznets@redhat.com>
-Date: Thu, 17 Apr 2025 15:30:50 +0200
-Subject: [PATCH 2/2] target/i386: Exclude 'hv-syndbg' from 'hv-passthrough'
-
-RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-MergeRequest: 352: hyper-v: exclude 'hv-syndbg' from 'hv-passthrough' set
-RH-Jira: RHEL-7130
-RH-Acked-by: Maxim Levitsky <None>
-RH-Acked-by: Ani Sinha <anisinha@redhat.com>
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Commit: [2/2] bf276ad5b340139f71b92e656a0c7756a55dec0b (vkuznets/qemu-kvm)
-
-Windows with Hyper-V role enabled doesn't boot with 'hv-passthrough' when
-no debugger is configured, this significantly limits the usefulness of the
-feature as there's no support for subtracting Hyper-V features from CPU
-flags at this moment (e.g. "-cpu host,hv-passthrough,-hv-syndbg" does not
-work). While this is also theoretically fixable, 'hv-syndbg' is likely
-very special and unneeded in the default set. Genuine Hyper-V doesn't seem
-to enable it either.
-
-Introduce 'skip_passthrough' flag to 'kvm_hyperv_properties' and use it as
-one-off to skip 'hv-syndbg' when enabling features in 'hv-passthrough'
-mode. Note, "-cpu host,hv-passthrough,hv-syndbg" can still be used if
-needed.
-
-As both 'hv-passthrough' and 'hv-syndbg' are debug features, the change
-should not have any effect on production environments.
-
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-Link: https://lore.kernel.org/r/20240917160051.2637594-3-vkuznets@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 7d7b9c7655a26e09c800ef40373078a80e90d9f3)
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
----
- docs/system/i386/hyperv.rst | 13 +++++++++----
- target/i386/kvm/kvm.c       |  7 +++++--
- 2 files changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/docs/system/i386/hyperv.rst b/docs/system/i386/hyperv.rst
-index 2505dc4c86..009947e391 100644
---- a/docs/system/i386/hyperv.rst
-+++ b/docs/system/i386/hyperv.rst
-@@ -262,14 +262,19 @@ Supplementary features
- ``hv-passthrough``
-   In some cases (e.g. during development) it may make sense to use QEMU in
-   'pass-through' mode and give Windows guests all enlightenments currently
--  supported by KVM. This pass-through mode is enabled by "hv-passthrough" CPU
--  flag.
-+  supported by KVM.
- 
-   Note: ``hv-passthrough`` flag only enables enlightenments which are known to QEMU
-   (have corresponding 'hv-' flag) and copies ``hv-spinlocks`` and ``hv-vendor-id``
-   values from KVM to QEMU. ``hv-passthrough`` overrides all other 'hv-' settings on
--  the command line. Also, enabling this flag effectively prevents migration as the
--  list of enabled enlightenments may differ between target and destination hosts.
-+  the command line.
-+
-+  Note: ``hv-passthrough`` does not enable ``hv-syndbg`` which can prevent certain
-+  Windows guests from booting when used without proper configuration. If needed,
-+  ``hv-syndbg`` can be enabled additionally.
-+
-+  Note: ``hv-passthrough`` effectively prevents migration as the list of enabled
-+  enlightenments may differ between target and destination hosts.
- 
- ``hv-enforce-cpuid``
-   By default, KVM allows the guest to use all currently supported Hyper-V
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 5bf77d761f..94b678e9e3 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -913,6 +913,7 @@ static struct {
-         uint32_t bits;
-     } flags[2];
-     uint64_t dependencies;
-+    bool skip_passthrough;
- } kvm_hyperv_properties[] = {
-     [HYPERV_FEAT_RELAXED] = {
-         .desc = "relaxed timing (hv-relaxed)",
-@@ -1041,7 +1042,8 @@ static struct {
-             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
-              .bits = HV_FEATURE_DEBUG_MSRS_AVAILABLE}
-         },
--        .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_RELAXED)
-+        .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_RELAXED),
-+        .skip_passthrough = true,
-     },
-     [HYPERV_FEAT_MSR_BITMAP] = {
-         .desc = "enlightened MSR-Bitmap (hv-emsr-bitmap)",
-@@ -1450,7 +1452,8 @@ bool kvm_hyperv_expand_features(X86CPU *cpu, Error **errp)
-          * hv_build_cpuid_leaf() uses this info to build guest CPUIDs.
-          */
-         for (feat = 0; feat < ARRAY_SIZE(kvm_hyperv_properties); feat++) {
--            if (hyperv_feature_supported(cs, feat)) {
-+            if (hyperv_feature_supported(cs, feat) &&
-+                !kvm_hyperv_properties[feat].skip_passthrough) {
-                 cpu->hyperv_features |= BIT(feat);
-             }
-         }
--- 
-2.48.1
-
diff --git a/kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch b/kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch
deleted file mode 100644
index 0b889e4..0000000
--- a/kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From dd03cf49fbf6a961a726506cb5264768d814d2c4 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 5 Aug 2024 17:20:41 -0300
-Subject: [PATCH] target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the
- guest
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 401: target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest
-RH-Jira: RHEL-17614
-RH-Acked-by: Ani Sinha <anisinha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [1/1] aa904a1ea0552fc37b61f79fda8a471928ea5d81 (imammedo/qemu-kvm-cs)
-
-According to AMD's Speculative Return Stack Overflow whitepaper (link
-below), the hypervisor should synthesize the value of IBPB_BRTYPE and
-SBPB CPUID bits to the guest.
-
-Support for this is already present in the kernel with commit
-e47d86083c66 ("KVM: x86: Add SBPB support") and commit 6f0f23ef76be
-("KVM: x86: Add IBPB_BRTYPE support").
-
-Add support in QEMU to expose the bits to the guest OS.
-
-host:
-  # cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
-  Mitigation: Safe RET
-
-before (guest):
-  $ cpuid -l 0x80000021 -1 -r
-  0x80000021 0x00: eax=0x00000045 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
-                            ^
-  $ cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
-  Vulnerable: Safe RET, no microcode
-
-after (guest):
-  $ cpuid -l 0x80000021 -1 -r
-  0x80000021 0x00: eax=0x18000045 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
-                            ^
-  $ cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
-  Mitigation: Safe RET
-
-Reported-by: Fabian Vogt <fvogt@suse.de>
-Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Link: https://lore.kernel.org/r/20240805202041.5936-1-farosas@suse.de
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-(cherry picked from commit 0701abbf9880b5ab1cf44e0caa6ad173aec840e7)
-JIRA: https://issues.redhat.com/browse/RHEL-17614
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- target/i386/cpu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ee753351fc..f75cc04cd3 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1241,7 +1241,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             "prefetchi", NULL, NULL, NULL,
--            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, "sbpb",
-             "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
-         },
-         .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
--- 
-2.50.1
-
diff --git a/kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch b/kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch
deleted file mode 100644
index 7c666cf..0000000
--- a/kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 1d667a354613385b1552fdbae91799882776f908 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 24 Oct 2024 17:18:23 -0500
-Subject: [PATCH 15/57] target/i386: Expose bits related to SRSO vulnerability
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/8] 9a6f4126ab023269e8afb3537aaa94ae60228382 (johnalle/qemu-kvm-fork)
-
-Add following bits related Speculative Return Stack Overflow (SRSO).
-Guests can make use of these bits if supported.
-
-These bits are reported via CPUID Fn8000_0021_EAX.
-===================================================================
-Bit Feature Description
-===================================================================
-27  SBPB                Indicates support for the Selective Branch Predictor Barrier.
-28  IBPB_BRTYPE         MSR_PRED_CMD[IBPB] flushes all branch type predictions.
-29  SRSO_NO             Not vulnerable to SRSO.
-30  SRSO_USER_KERNEL_NO Not vulnerable to SRSO at the user-kernel boundary.
-===================================================================
-
-Link: https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
-Link: https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/programmer-references/57238.zip
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Link: https://lore.kernel.org/r/dadbd70c38f4e165418d193918a3747bd715c5f4.1729807947.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 2ec282b8eaaddf5c136f7566b5f61d80288a2065)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c |  2 +-
- target/i386/cpu.h | 14 +++++++++++---
- 2 files changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 0a955b1c45..53069a460c 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1240,7 +1240,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
--            NULL, NULL, NULL, NULL,
-+            "ibpb-brtype", "srso-no", "srso-user-kernel-no", NULL,
-         },
-         .cpuid = { .eax = 0x80000021, .reg = R_EAX, },
-         .tcg_features = 0,
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 4da9ed5930..9a16239b8e 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -1028,13 +1028,21 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_8000_0008_EBX_AMD_PSFD    (1U << 28)
- 
- /* Processor ignores nested data breakpoints */
--#define CPUID_8000_0021_EAX_No_NESTED_DATA_BP    (1U << 0)
-+#define CPUID_8000_0021_EAX_NO_NESTED_DATA_BP            (1U << 0)
- /* LFENCE is always serializing */
- #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
- /* Null Selector Clears Base */
--#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE    (1U << 6)
-+#define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
- /* Automatic IBRS */
--#define CPUID_8000_0021_EAX_AUTO_IBRS   (1U << 8)
-+#define CPUID_8000_0021_EAX_AUTO_IBRS                    (1U << 8)
-+/* Selective Branch Predictor Barrier */
-+#define CPUID_8000_0021_EAX_SBPB                         (1U << 27)
-+/* IBPB includes branch type prediction flushing */
-+#define CPUID_8000_0021_EAX_IBPB_BRTYPE                  (1U << 28)
-+/* Not vulnerable to Speculative Return Stack Overflow */
-+#define CPUID_8000_0021_EAX_SRSO_NO                      (1U << 29)
-+/* Not vulnerable to SRSO at the user-kernel boundary */
-+#define CPUID_8000_0021_EAX_SRSO_USER_KERNEL_NO          (1U << 30)
- 
- #define CPUID_XSAVE_XSAVEOPT   (1U << 0)
- #define CPUID_XSAVE_XSAVEC     (1U << 1)
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Fix-conditional-CONFIG_SYNDBG-enablement.patch b/kvm-target-i386-Fix-conditional-CONFIG_SYNDBG-enablement.patch
deleted file mode 100644
index 049f3fe..0000000
--- a/kvm-target-i386-Fix-conditional-CONFIG_SYNDBG-enablement.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 26d5561f7a07c9bc6f8ea9a602c53bfa5daddd13 Mon Sep 17 00:00:00 2001
-From: Vitaly Kuznetsov <vkuznets@redhat.com>
-Date: Thu, 17 Apr 2025 15:30:42 +0200
-Subject: [PATCH 1/2] target/i386: Fix conditional CONFIG_SYNDBG enablement
-
-RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-MergeRequest: 352: hyper-v: exclude 'hv-syndbg' from 'hv-passthrough' set
-RH-Jira: RHEL-7130
-RH-Acked-by: Maxim Levitsky <None>
-RH-Acked-by: Ani Sinha <anisinha@redhat.com>
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Commit: [1/2] 0446b6202fb3dbae865da0dc7e08092399661f7a (vkuznets/qemu-kvm)
-
-Putting HYPERV_FEAT_SYNDBG entry under "#ifdef CONFIG_SYNDBG" in
-'kvm_hyperv_properties' array is wrong: as HYPERV_FEAT_SYNDBG is not
-the highest feature number, the result is an empty (zeroed) entry in
-the array (and not a skipped entry!). hyperv_feature_supported() is
-designed to check that all CPUID bits are set but for a zeroed
-feature in 'kvm_hyperv_properties' it returns 'true' so QEMU considers
-HYPERV_FEAT_SYNDBG as always supported, regardless of whether KVM host
-actually supports it.
-
-To fix the issue, leave HYPERV_FEAT_SYNDBG's definition in
-'kvm_hyperv_properties' array, there's nothing wrong in having it defined
-even when 'CONFIG_SYNDBG' is not set. Instead, put "hv-syndbg" CPU property
-under '#ifdef CONFIG_SYNDBG' to alter the existing behavior when the flag
-is silently skipped in !CONFIG_SYNDBG builds.
-
-Leave an 'assert' sentinel in hyperv_feature_supported() making sure there
-are no 'holes' or improperly defined features in 'kvm_hyperv_properties'.
-
-Fixes: d8701185f40c ("hw: hyperv: Initial commit for Synthetic Debugging device")
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-Link: https://lore.kernel.org/r/20240917160051.2637594-2-vkuznets@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit bbf3810f2c4f97bd7a1982d3e0ff0f00295b8169)
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
----
- target/i386/cpu.c     |  2 ++
- target/i386/kvm/kvm.c | 11 +++++++----
- 2 files changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index a70a3aa670..0a955b1c45 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -8450,8 +8450,10 @@ static Property x86_cpu_properties[] = {
-                       HYPERV_FEAT_TLBFLUSH_DIRECT, 0),
-     DEFINE_PROP_ON_OFF_AUTO("hv-no-nonarch-coresharing", X86CPU,
-                             hyperv_no_nonarch_cs, ON_OFF_AUTO_OFF),
-+#ifdef CONFIG_SYNDBG
-     DEFINE_PROP_BIT64("hv-syndbg", X86CPU, hyperv_features,
-                       HYPERV_FEAT_SYNDBG, 0),
-+#endif
-     DEFINE_PROP_BOOL("hv-passthrough", X86CPU, hyperv_passthrough, false),
-     DEFINE_PROP_BOOL("hv-enforce-cpuid", X86CPU, hyperv_enforce_cpuid, false),
- 
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index d0329a4ed7..5bf77d761f 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -1035,7 +1035,6 @@ static struct {
-              .bits = HV_DEPRECATING_AEOI_RECOMMENDED}
-         }
-     },
--#ifdef CONFIG_SYNDBG
-     [HYPERV_FEAT_SYNDBG] = {
-         .desc = "Enable synthetic kernel debugger channel (hv-syndbg)",
-         .flags = {
-@@ -1044,7 +1043,6 @@ static struct {
-         },
-         .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_RELAXED)
-     },
--#endif
-     [HYPERV_FEAT_MSR_BITMAP] = {
-         .desc = "enlightened MSR-Bitmap (hv-emsr-bitmap)",
-         .flags = {
-@@ -1296,6 +1294,13 @@ static bool hyperv_feature_supported(CPUState *cs, int feature)
-     uint32_t func, bits;
-     int i, reg;
- 
-+    /*
-+     * kvm_hyperv_properties needs to define at least one CPUID flag which
-+     * must be used to detect the feature, it's hard to say whether it is
-+     * supported or not otherwise.
-+     */
-+    assert(kvm_hyperv_properties[feature].flags[0].func);
-+
-     for (i = 0; i < ARRAY_SIZE(kvm_hyperv_properties[feature].flags); i++) {
- 
-         func = kvm_hyperv_properties[feature].flags[i].func;
-@@ -3925,13 +3930,11 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
-                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS,
-                                   env->msr_hv_tsc_emulation_status);
-             }
--#ifdef CONFIG_SYNDBG
-             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG) &&
-                 has_msr_hv_syndbg_options) {
-                 kvm_msr_entry_add(cpu, HV_X64_MSR_SYNDBG_OPTIONS,
-                                   hyperv_syndbg_query_options());
-             }
--#endif
-         }
-         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC)) {
-             kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE,
--- 
-2.48.1
-
diff --git a/kvm-target-i386-Introduce-GraniteRapids-v2-model.patch b/kvm-target-i386-Introduce-GraniteRapids-v2-model.patch
deleted file mode 100644
index a86f820..0000000
--- a/kvm-target-i386-Introduce-GraniteRapids-v2-model.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 1895c3aa9eb0037eb06745ef499eb7476bebd554 Mon Sep 17 00:00:00 2001
-From: Tao Su <tao1.su@linux.intel.com>
-Date: Thu, 31 Oct 2024 16:52:33 +0800
-Subject: [PATCH 08/11] target/i386: Introduce GraniteRapids-v2 model
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [8/9] 5b684731a1d2c2687515eb984398c9dc5bc3fc23 (bonzini/rhel-qemu-kvm)
-
-Update GraniteRapids CPU model to add AVX10 and the missing features(ss,
-tsc-adjust, cldemote, movdiri, movdir64b).
-
-Tested-by: Xuelian Guo <xuelian.guo@intel.com>
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241028024512.156724-7-tao1.su@linux.intel.com
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-9-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 1a519388a882fbb352e49cbebb0ed8f62d05842d)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 5042cbaa0e..ad368252d8 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -4393,6 +4393,23 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-         .model_id = "Intel Xeon Processor (GraniteRapids)",
-         .versions = (X86CPUVersionDefinition[]) {
-             { .version = 1 },
-+            {
-+                .version = 2,
-+                .props = (PropValue[]) {
-+                    { "ss", "on" },
-+                    { "tsc-adjust", "on" },
-+                    { "cldemote", "on" },
-+                    { "movdiri", "on" },
-+                    { "movdir64b", "on" },
-+                    { "avx10", "on" },
-+                    { "avx10-128", "on" },
-+                    { "avx10-256", "on" },
-+                    { "avx10-512", "on" },
-+                    { "avx10-version", "1" },
-+                    { "stepping", "1" },
-+                    { /* end of list */ }
-+                }
-+            },
-             { /* end of list */ },
-         },
-     },
--- 
-2.48.0
-
diff --git a/kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch b/kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch
deleted file mode 100644
index d6a6c44..0000000
--- a/kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 5c3ab9a195310186be83501c20c95033a2fff594 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:43 +0200
-Subject: [PATCH 001/115] target/i386: Make invtsc migratable when user sets
- tsc-khz explicitly
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [1/115] 14556e7f141ab24aa977392eb30819df061b608a (bonzini/rhel-qemu-kvm)
-
-When user sets tsc-frequency explicitly, the invtsc feature is actually
-migratable because the tsc-frequency is supposed to be fixed during the
-migration.
-
-See commit d99569d9d856 ("kvm: Allow invtsc migration if tsc-khz
-is set explicitly") for referrence.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20240814075431.339209-10-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 87c88db3143e91076d167a62dd7febf49afca8a2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 3a7e5d481be248bf0b81f23fd84da43663597504)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index fdfa183f4d..0ac6cd8ad7 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1917,9 +1917,10 @@ static inline uint64_t x86_cpu_xsave_xss_components(X86CPU *cpu)
-  * Returns the set of feature flags that are supported and migratable by
-  * QEMU, for a given FeatureWord.
-  */
--static uint64_t x86_cpu_get_migratable_flags(FeatureWord w)
-+static uint64_t x86_cpu_get_migratable_flags(X86CPU *cpu, FeatureWord w)
- {
-     FeatureWordInfo *wi = &feature_word_info[w];
-+    CPUX86State *env = &cpu->env;
-     uint64_t r = 0;
-     int i;
- 
-@@ -1933,6 +1934,12 @@ static uint64_t x86_cpu_get_migratable_flags(FeatureWord w)
-             r |= f;
-         }
-     }
-+
-+    /* when tsc-khz is set explicitly, invtsc is migratable */
-+    if ((w == FEAT_8000_0007_EDX) && env->user_tsc_khz) {
-+        r |= CPUID_APM_INVTSC;
-+    }
-+
-     return r;
- }
- 
-@@ -6650,7 +6657,7 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w)
- 
-     r &= ~unavail;
-     if (cpu && cpu->migratable) {
--        r &= x86_cpu_get_migratable_flags(w);
-+        r &= x86_cpu_get_migratable_flags(cpu, w);
-     }
-     return r;
- }
--- 
-2.50.1
-
diff --git a/kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch b/kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
deleted file mode 100644
index 1d10634..0000000
--- a/kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From a079f758233f53fbdcfbae78bb6c6ee7a610b374 Mon Sep 17 00:00:00 2001
-From: Vitaly Kuznetsov <vkuznets@redhat.com>
-Date: Tue, 7 Jan 2025 13:40:43 +0100
-Subject: [PATCH 1/4] target/i386: Make sure SynIC state is really updated
- before KVM_RUN
-
-RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-MergeRequest: 315: target/i386: Make sure SynIC state is really updated before KVM_RUN
-RH-Jira: RHEL-53073
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-RH-Acked-by: Maxim Levitsky <None>
-RH-Commit: [1/1] 24eb10f4c32a8dc348eaf32b7f19de19c30a9fca (vkuznets/qemu-kvm)
-
-'hyperv_synic' test from KVM unittests was observed to be flaky on certain
-hardware (hangs sometimes). Debugging shows that the problem happens in
-hyperv_sint_route_new() when the test tries to set up a new SynIC
-route. The function bails out on:
-
- if (!synic->sctl_enabled) {
-         goto cleanup;
- }
-
-but the test writes to HV_X64_MSR_SCONTROL just before it starts
-establishing SINT routes. Further investigation shows that
-synic_update() (called from async_synic_update()) happens after the SINT
-setup attempt and not before. Apparently, the comment before
-async_safe_run_on_cpu() in kvm_hv_handle_exit() does not correctly describe
-the guarantees async_safe_run_on_cpu() gives. In particular, async worked
-added to a CPU is actually processed from qemu_wait_io_event() which is not
-always called before KVM_RUN, i.e. kvm_cpu_exec() checks whether an exit
-request is pending for a CPU and if not, keeps running the vCPU until it
-meets an exit it can't handle internally. Hyper-V specific MSR writes are
-not automatically trigger an exit.
-
-Fix the issue by simply raising an exit request for the vCPU where SynIC
-update was queued. This is not a performance critical path as SynIC state
-does not get updated so often (and async_safe_run_on_cpu() is a big hammer
-anyways).
-
-Reported-by: Jan Richter <jarichte@redhat.com>
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-Link: https://lore.kernel.org/r/20240917160051.2637594-4-vkuznets@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d3177e2e4353824a650434c57471615d43507500)
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
----
- target/i386/kvm/hyperv.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
-index b94f12acc2..70b89cacf9 100644
---- a/target/i386/kvm/hyperv.c
-+++ b/target/i386/kvm/hyperv.c
-@@ -80,6 +80,7 @@ int kvm_hv_handle_exit(X86CPU *cpu, struct kvm_hyperv_exit *exit)
-          * necessary because memory hierarchy is being changed
-          */
-         async_safe_run_on_cpu(CPU(cpu), async_synic_update, RUN_ON_CPU_NULL);
-+        cpu_exit(CPU(cpu));
- 
-         return EXCP_INTERRUPT;
-     case KVM_EXIT_HYPERV_HCALL: {
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch b/kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch
deleted file mode 100644
index 56cf96d..0000000
--- a/kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 532fe3ba3d7c05387884bf3460894f9d2e0e8a91 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 018/115] target/i386: Print CPUID subleaf info for unsupported
- feature
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [18/115] 7a9640191aa0a03348b8c0162ba1957d749cd454 (bonzini/rhel-qemu-kvm)
-
-Some CPUID leaves have meaningful subleaf index. Print the subleaf info
-in feature_word_description for CPUID features.
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Message-ID: <20241217123932.948789-3-xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 22a2a701090b83d8dd06765edc1b61f6208c76b1)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 32e89f1a5c..816285facd 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5906,8 +5906,9 @@ static char *feature_word_description(FeatureWordInfo *f)
-         {
-             const char *reg = get_register_name_32(f->cpuid.reg);
-             assert(reg);
--            return g_strdup_printf("CPUID.%02XH:%s",
--                                   f->cpuid.eax, reg);
-+            return g_strdup_printf("CPUID.%02XH_%02XH:%s",
-+                                   f->cpuid.eax,
-+                                   f->cpuid.needs_ecx ? f->cpuid.ecx : 0, reg);
-         }
-     case MSR_FEATURE_WORD:
-         return g_strdup_printf("MSR(%02XH)",
--- 
-2.50.1
-
diff --git a/kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch b/kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch
deleted file mode 100644
index 027d184..0000000
--- a/kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 5be7728369a8f109a86b2d5aea89c6dc4014c559 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 023/115] target/i386: Remove AccelCPUClass::cpu_class_init
- need
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [23/115] a327127b0c6a96c8198420732006770480b18e69 (bonzini/rhel-qemu-kvm)
-
-Expose x86_tcg_ops symbol, then directly set it as
-CPUClass::tcg_ops in TYPE_X86_CPU's class_init(),
-using CONFIG_TCG #ifdef'ry. No need for the
-AccelCPUClass::cpu_class_init() handler anymore.
-
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-ID: <20250405161320.76854-3-philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-(cherry picked from commit a522b04bb9cf67789116ad7a6165946d4b214bac)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: missing one member of x86_tcg_ops
----
- target/i386/cpu.c         |  4 ++++
- target/i386/tcg/tcg-cpu.c | 14 +-------------
- target/i386/tcg/tcg-cpu.h |  4 ++++
- 3 files changed, 9 insertions(+), 13 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 816285facd..4eef3d1dbd 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -42,6 +42,7 @@
- #include "hw/boards.h"
- #include "hw/i386/sgx-epc.h"
- #endif
-+#include "tcg/tcg-cpu.h"
- 
- #include "disas/capstone.h"
- #include "cpu-internal.h"
-@@ -9034,6 +9035,9 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
- #ifndef CONFIG_USER_ONLY
-     cc->sysemu_ops = &i386_sysemu_ops;
- #endif /* !CONFIG_USER_ONLY */
-+#ifdef CONFIG_TCG
-+    cc->tcg_ops = &x86_tcg_ops;
-+#endif /* CONFIG_TCG */
- 
-     cc->gdb_arch_name = x86_gdb_arch_name;
- #ifdef TARGET_X86_64
-diff --git a/target/i386/tcg/tcg-cpu.c b/target/i386/tcg/tcg-cpu.c
-index cca19cd40e..0160f3f70d 100644
---- a/target/i386/tcg/tcg-cpu.c
-+++ b/target/i386/tcg/tcg-cpu.c
-@@ -106,7 +106,7 @@ static bool x86_debug_check_breakpoint(CPUState *cs)
- 
- #include "hw/core/tcg-cpu-ops.h"
- 
--static const TCGCPUOps x86_tcg_ops = {
-+const TCGCPUOps x86_tcg_ops = {
-     .initialize = tcg_x86_init,
-     .synchronize_from_tb = x86_cpu_synchronize_from_tb,
-     .restore_state_to_opc = x86_restore_state_to_opc,
-@@ -128,17 +128,6 @@ static const TCGCPUOps x86_tcg_ops = {
- #endif /* !CONFIG_USER_ONLY */
- };
- 
--static void x86_tcg_cpu_init_ops(AccelCPUClass *accel_cpu, CPUClass *cc)
--{
--    /* for x86, all cpus use the same set of operations */
--    cc->tcg_ops = &x86_tcg_ops;
--}
--
--static void x86_tcg_cpu_class_init(CPUClass *cc)
--{
--    cc->init_accel_cpu = x86_tcg_cpu_init_ops;
--}
--
- static void x86_tcg_cpu_xsave_init(void)
- {
- #define XO(bit, field) \
-@@ -187,7 +176,6 @@ static void x86_tcg_cpu_accel_class_init(ObjectClass *oc, void *data)
-     acc->cpu_target_realize = tcg_cpu_realizefn;
- #endif /* CONFIG_USER_ONLY */
- 
--    acc->cpu_class_init = x86_tcg_cpu_class_init;
-     acc->cpu_instance_init = x86_tcg_cpu_instance_init;
- }
- static const TypeInfo x86_tcg_cpu_accel_type_info = {
-diff --git a/target/i386/tcg/tcg-cpu.h b/target/i386/tcg/tcg-cpu.h
-index 53a8494455..9bbf0cb875 100644
---- a/target/i386/tcg/tcg-cpu.h
-+++ b/target/i386/tcg/tcg-cpu.h
-@@ -19,6 +19,8 @@
- #ifndef TCG_CPU_H
- #define TCG_CPU_H
- 
-+#include "cpu.h"
-+
- #define XSAVE_FCW_FSW_OFFSET    0x000
- #define XSAVE_FTW_FOP_OFFSET    0x004
- #define XSAVE_CWD_RIP_OFFSET    0x008
-@@ -76,6 +78,8 @@ QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, zmm_hi256_state) != XSAVE_ZMM_HI256_OFF
- QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, hi16_zmm_state) != XSAVE_HI16_ZMM_OFFSET);
- QEMU_BUILD_BUG_ON(offsetof(X86XSaveArea, pkru_state) != XSAVE_PKRU_OFFSET);
- 
-+extern const TCGCPUOps x86_tcg_ops;
-+
- bool tcg_cpu_realizefn(CPUState *cs, Error **errp);
- 
- #endif /* TCG_CPU_H */
--- 
-2.50.1
-
diff --git a/kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch b/kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch
deleted file mode 100644
index f5cfccc..0000000
--- a/kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-From 4091d13096918dfff5f3a292b43e613ea888ddc1 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 8 May 2025 14:57:59 -0500
-Subject: [PATCH 17/57] target/i386: Update EPYC CPU model for Cache property,
- RAS, SVM feature bits
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/8] afc52d066ad5f66732b0bb04142e210c52896708 (johnalle/qemu-kvm-fork)
-
-Found that some of the cache properties are not set correctly for EPYC models.
-
-l1d_cache.no_invd_sharing should not be true.
-l1i_cache.no_invd_sharing should not be true.
-
-L2.self_init should be true.
-L2.inclusive should be true.
-
-L3.inclusive should not be true.
-L3.no_invd_sharing should be true.
-
-Fix the cache properties.
-
-Also add the missing RAS and SVM features bits on AMD
-EPYC CPU models. The SVM feature bits are used in nested guests.
-
-succor		: Software uncorrectable error containment and recovery capability.
-overflow-recov	: MCA overflow recovery support.
-lbrv		: LBR virtualization
-tsc-scale	: MSR based TSC rate control
-vmcb-clean	: VMCB clean bits
-flushbyasid	: Flush by ASID
-pause-filter	: Pause intercept filter
-pfthreshold	: PAUSE filter threshold
-v-vmsave-vmload	: Virtualized VMLOAD and VMSAVE
-vgif		: Virtualized GIF
-
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/515941861700d7066186c9600bc5d96a1741ef0c.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 397db937e85d7b9f5a6f0b30764786cef09d1ff3)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 73 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 4546369836..32c575f63b 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -2166,6 +2166,60 @@ static CPUCaches epyc_v4_cache_info = {
-     },
- };
- 
-+static CPUCaches epyc_v5_cache_info = {
-+    .l1d_cache = &(CPUCacheInfo) {
-+        .type = DATA_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l1i_cache = &(CPUCacheInfo) {
-+        .type = INSTRUCTION_CACHE,
-+        .level = 1,
-+        .size = 64 * KiB,
-+        .line_size = 64,
-+        .associativity = 4,
-+        .partitions = 1,
-+        .sets = 256,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l2_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 2,
-+        .size = 512 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 1024,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .inclusive = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l3_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 3,
-+        .size = 8 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 8192,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .no_invd_sharing = true,
-+        .complex_indexing = false,
-+        .share_level = CPU_TOPO_LEVEL_DIE,
-+    },
-+};
-+
- static const CPUCaches epyc_rome_cache_info = {
-     .l1d_cache = &(CPUCacheInfo) {
-         .type = DATA_CACHE,
-@@ -5059,6 +5113,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-                 },
-                 .cache_info = &epyc_v4_cache_info
-             },
-+            {
-+                .version = 5,
-+                .props = (PropValue[]) {
-+                    { "overflow-recov", "on" },
-+                    { "succor", "on" },
-+                    { "lbrv", "on" },
-+                    { "tsc-scale", "on" },
-+                    { "vmcb-clean", "on" },
-+                    { "flushbyasid", "on" },
-+                    { "pause-filter", "on" },
-+                    { "pfthreshold", "on" },
-+                    { "v-vmsave-vmload", "on" },
-+                    { "vgif", "on" },
-+                    { "model-id",
-+                      "AMD EPYC-v5 Processor" },
-+                    { /* end of list */ }
-+                },
-+                .cache_info = &epyc_v5_cache_info
-+            },
-             { /* end of list */ }
-         }
-     },
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch b/kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch
deleted file mode 100644
index 59260d8..0000000
--- a/kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From 768e39f40b394eb4524a83857b86e8f7497f4414 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 8 May 2025 14:58:03 -0500
-Subject: [PATCH 21/57] target/i386: Update EPYC-Genoa for Cache property,
- perfmon-v2, RAS and SVM feature bits
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/8] b144233a1115385a1f792c4454f4511173f753d8 (johnalle/qemu-kvm-fork)
-
-Found that some of the cache properties are not set correctly for EPYC models.
-l1d_cache.no_invd_sharing should not be true.
-l1i_cache.no_invd_sharing should not be true.
-
-L2.self_init should be true.
-L2.inclusive should be true.
-
-L3.inclusive should not be true.
-L3.no_invd_sharing should be true.
-
-Fix these cache properties.
-
-Also add the missing RAS and SVM features bits on AMD EPYC-Genoa model.
-The SVM feature bits are used in nested guests.
-
-perfmon-v2     : Allow guests to make use of the PerfMonV2 features.
-succor         : Software uncorrectable error containment and recovery capability.
-overflow-recov : MCA overflow recovery support.
-lbrv           : LBR virtualization
-tsc-scale      : MSR based TSC rate control
-vmcb-clean     : VMCB clean bits
-flushbyasid    : Flush by ASID
-pause-filter   : Pause intercept filter
-pfthreshold    : PAUSE filter threshold
-v-vmsave-vmload: Virtualized VMLOAD and VMSAVE
-vgif           : Virtualized GIF
-fs-gs-base-ns  : WRMSR to {FS,GS,KERNEL_GS}_BASE is non-serializing
-
-The feature details are available in APM listed below [1].
-[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming
-Publication # 24593 Revision 3.41.
-
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/afe3f05d4116124fd5795f28fc23d7b396140313.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit abc92cc8488b5dbcc403b5be24d8092180605101)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 79 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2218071fca..2bc2d41259 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -2598,6 +2598,59 @@ static const CPUCaches epyc_genoa_cache_info = {
-     },
- };
- 
-+static const CPUCaches epyc_genoa_v2_cache_info = {
-+    .l1d_cache = &(CPUCacheInfo) {
-+        .type = DATA_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l1i_cache = &(CPUCacheInfo) {
-+        .type = INSTRUCTION_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l2_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 2,
-+        .size = 1 * MiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 2048,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .inclusive = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l3_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 3,
-+        .size = 32 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 32768,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .no_invd_sharing = true,
-+        .complex_indexing = false,
-+        .share_level = CPU_TOPO_LEVEL_DIE,
-+    },
-+};
- /* The following VMX features are not supported by KVM and are left out in the
-  * CPU definitions:
-  *
-@@ -5530,7 +5583,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-             CPUID_8000_0008_EBX_STIBP_ALWAYS_ON |
-             CPUID_8000_0008_EBX_AMD_SSBD | CPUID_8000_0008_EBX_AMD_PSFD,
-         .features[FEAT_8000_0021_EAX] =
--            CPUID_8000_0021_EAX_No_NESTED_DATA_BP |
-+            CPUID_8000_0021_EAX_NO_NESTED_DATA_BP |
-             CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING |
-             CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE |
-             CPUID_8000_0021_EAX_AUTO_IBRS,
-@@ -5565,6 +5618,31 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-         .xlevel = 0x80000022,
-         .model_id = "AMD EPYC-Genoa Processor",
-         .cache_info = &epyc_genoa_cache_info,
-+        .versions = (X86CPUVersionDefinition[]) {
-+            { .version = 1 },
-+            {
-+                .version = 2,
-+                .props = (PropValue[]) {
-+                    { "overflow-recov", "on" },
-+                    { "succor", "on" },
-+                    { "lbrv", "on" },
-+                    { "tsc-scale", "on" },
-+                    { "vmcb-clean", "on" },
-+                    { "flushbyasid", "on" },
-+                    { "pause-filter", "on" },
-+                    { "pfthreshold", "on" },
-+                    { "v-vmsave-vmload", "on" },
-+                    { "vgif", "on" },
-+                    { "fs-gs-base-ns", "on" },
-+                    { "perfmon-v2", "on" },
-+                    { "model-id",
-+                      "AMD EPYC-Genoa-v2 Processor" },
-+                    { /* end of list */ }
-+                },
-+                .cache_info = &epyc_genoa_v2_cache_info
-+            },
-+            { /* end of list */ }
-+        }
-     },
- };
- 
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch b/kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch
deleted file mode 100644
index ba143ba..0000000
--- a/kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch
+++ /dev/null
@@ -1,146 +0,0 @@
-From a2cd6a5aac0ba2bbb50d2ff22b83c8b9d7761028 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 8 May 2025 14:58:01 -0500
-Subject: [PATCH 19/57] target/i386: Update EPYC-Milan CPU model for Cache
- property, RAS, SVM feature bits
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/8] e9e34ade25cb7be05d40745e1d074c0356d1923f (johnalle/qemu-kvm-fork)
-
-Found that some of the cache properties are not set correctly for EPYC models.
-l1d_cache.no_invd_sharing should not be true.
-l1i_cache.no_invd_sharing should not be true.
-
-L2.self_init should be true.
-L2.inclusive should be true.
-
-L3.inclusive should not be true.
-L3.no_invd_sharing should be true.
-
-Fix these cache properties.
-
-Also add the missing RAS and SVM features bits on AMD EPYC-Milan model.
-The SVM feature bits are used in nested guests.
-
-succor          : Software uncorrectable error containment and recovery capability.
-overflow-recov  : MCA overflow recovery support.
-lbrv            : LBR virtualization
-tsc-scale       : MSR based TSC rate control
-vmcb-clean      : VMCB clean bits
-flushbyasid     : Flush by ASID
-pause-filter    : Pause intercept filter
-pfthreshold     : PAUSE filter threshold
-v-vmsave-vmload : Virtualized VMLOAD and VMSAVE
-vgif            : Virtualized GIF
-
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/c619c0e09a9d5d496819ed48d69181d65f416891.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit fc014d9ba5b26b27401e0e88a4e1ef827c68fe64)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 73 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index a73b5bfca4..7d48c51767 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -2490,6 +2490,60 @@ static const CPUCaches epyc_milan_v2_cache_info = {
-     },
- };
- 
-+static const CPUCaches epyc_milan_v3_cache_info = {
-+    .l1d_cache = &(CPUCacheInfo) {
-+        .type = DATA_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l1i_cache = &(CPUCacheInfo) {
-+        .type = INSTRUCTION_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l2_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 2,
-+        .size = 512 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 1024,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .inclusive = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l3_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 3,
-+        .size = 32 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 32768,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .no_invd_sharing = true,
-+        .complex_indexing = false,
-+        .share_level = CPU_TOPO_LEVEL_DIE,
-+    },
-+};
-+
- static const CPUCaches epyc_genoa_cache_info = {
-     .l1d_cache = &(CPUCacheInfo) {
-         .type = DATA_CACHE,
-@@ -5418,6 +5472,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-                 },
-                 .cache_info = &epyc_milan_v2_cache_info
-             },
-+            {
-+                .version = 3,
-+                .props = (PropValue[]) {
-+                    { "overflow-recov", "on" },
-+                    { "succor", "on" },
-+                    { "lbrv", "on" },
-+                    { "tsc-scale", "on" },
-+                    { "vmcb-clean", "on" },
-+                    { "flushbyasid", "on" },
-+                    { "pause-filter", "on" },
-+                    { "pfthreshold", "on" },
-+                    { "v-vmsave-vmload", "on" },
-+                    { "vgif", "on" },
-+                    { "model-id",
-+                      "AMD EPYC-Milan-v3 Processor" },
-+                    { /* end of list */ }
-+                },
-+                .cache_info = &epyc_milan_v3_cache_info
-+            },
-             { /* end of list */ }
-         }
-     },
--- 
-2.39.3
-
diff --git a/kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch b/kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch
deleted file mode 100644
index 82c2cb4..0000000
--- a/kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-From dc86ee01fb27b174871ff8be9095ed1a20513772 Mon Sep 17 00:00:00 2001
-From: Babu Moger <babu.moger@amd.com>
-Date: Thu, 8 May 2025 14:58:00 -0500
-Subject: [PATCH 18/57] target/i386: Update EPYC-Rome CPU model for Cache
- property, RAS, SVM feature bits
-
-RH-Author: John Allen <None>
-RH-MergeRequest: 378: Update EPYC Models and Feature Bits
-RH-Jira: RHEL-52649
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/8] f23618215eee3c54d9ba52c5b74f5d574c522649 (johnalle/qemu-kvm-fork)
-
-Found that some of the cache properties are not set correctly for EPYC models.
-
-l1d_cache.no_invd_sharing should not be true.
-l1i_cache.no_invd_sharing should not be true.
-
-L2.self_init should be true.
-L2.inclusive should be true.
-
-L3.inclusive should not be true.
-L3.no_invd_sharing should be true.
-
-Fix these cache properties.
-
-Also add the missing RAS and SVM features bits on AMD EPYC-Rome. The SVM
-feature bits are used in nested guests.
-
-succor		: Software uncorrectable error containment and recovery capability.
-overflow-recov	: MCA overflow recovery support.
-lbrv		: LBR virtualization
-tsc-scale	: MSR based TSC rate control
-vmcb-clean	: VMCB clean bits
-flushbyasid	: Flush by ASID
-pause-filter	: Pause intercept filter
-pfthreshold	: PAUSE filter threshold
-v-vmsave-vmload	: Virtualized VMLOAD and VMSAVE
-vgif		: Virtualized GIF
-
-Signed-off-by: Babu Moger <babu.moger@amd.com>
-Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/8265af72057b84c99ac3a02a5487e32759cc69b1.1746734284.git.babu.moger@amd.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 83d940e9700527ff080416ce2fa52ee1f4771d72)
-
-JIRA: https://issues.redhat.com/browse/RHEL-52649
-
-Signed-off-by: John Allen <johnalle@redhat.com>
----
- target/i386/cpu.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 73 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 32c575f63b..a73b5bfca4 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -2328,6 +2328,60 @@ static const CPUCaches epyc_rome_v3_cache_info = {
-     },
- };
- 
-+static const CPUCaches epyc_rome_v5_cache_info = {
-+    .l1d_cache = &(CPUCacheInfo) {
-+        .type = DATA_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l1i_cache = &(CPUCacheInfo) {
-+        .type = INSTRUCTION_CACHE,
-+        .level = 1,
-+        .size = 32 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 64,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l2_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 2,
-+        .size = 512 * KiB,
-+        .line_size = 64,
-+        .associativity = 8,
-+        .partitions = 1,
-+        .sets = 1024,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .inclusive = true,
-+        .share_level = CPU_TOPO_LEVEL_CORE,
-+    },
-+    .l3_cache = &(CPUCacheInfo) {
-+        .type = UNIFIED_CACHE,
-+        .level = 3,
-+        .size = 16 * MiB,
-+        .line_size = 64,
-+        .associativity = 16,
-+        .partitions = 1,
-+        .sets = 16384,
-+        .lines_per_tag = 1,
-+        .self_init = true,
-+        .no_invd_sharing = true,
-+        .complex_indexing = false,
-+        .share_level = CPU_TOPO_LEVEL_DIE,
-+    },
-+};
-+
- static const CPUCaches epyc_milan_cache_info = {
-     .l1d_cache = &(CPUCacheInfo) {
-         .type = DATA_CACHE,
-@@ -5270,6 +5324,25 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-                     { /* end of list */ }
-                 },
-             },
-+            {
-+                .version = 5,
-+                .props = (PropValue[]) {
-+                    { "overflow-recov", "on" },
-+                    { "succor", "on" },
-+                    { "lbrv", "on" },
-+                    { "tsc-scale", "on" },
-+                    { "vmcb-clean", "on" },
-+                    { "flushbyasid", "on" },
-+                    { "pause-filter", "on" },
-+                    { "pfthreshold", "on" },
-+                    { "v-vmsave-vmload", "on" },
-+                    { "vgif", "on" },
-+                    { "model-id",
-+                      "AMD EPYC-Rome-v5 Processor" },
-+                    { /* end of list */ }
-+                },
-+                .cache_info = &epyc_rome_v5_cache_info
-+            },
-             { /* end of list */ }
-         }
-     },
--- 
-2.39.3
-
diff --git a/kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch b/kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch
deleted file mode 100644
index b8492c0..0000000
--- a/kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch
+++ /dev/null
@@ -1,224 +0,0 @@
-From 887a4929ea393510d6867c160ced628798e17163 Mon Sep 17 00:00:00 2001
-From: Tao Su <tao1.su@linux.intel.com>
-Date: Thu, 31 Oct 2024 16:52:29 +0800
-Subject: [PATCH 04/11] target/i386: add AVX10 feature and AVX10 version
- property
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/9] c71d05d79d1a228c01ab5fc5f486ae5db9e98a1b (bonzini/rhel-qemu-kvm)
-
-When AVX10 enable bit is set, the 0x24 leaf will be present as "AVX10
-Converged Vector ISA leaf" containing fields for the version number and
-the supported vector bit lengths.
-
-Introduce avx10-version property so that avx10 version can be controlled
-by user and cpu model. Per spec, avx10 version can never be 0, the default
-value of avx10-version is set to 0 to determine whether it is specified by
-user.  The default can come from the device model or, for the max model,
-from KVM's reported value.
-
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241028024512.156724-3-tao1.su@linux.intel.com
-Link: https://lore.kernel.org/r/20241028024512.156724-4-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Tested-by: Xuelian Guo <xuelian.guo@intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-5-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit bccfb846fd52d6f20704ecfa4d01b60b43c6f640)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c     | 64 ++++++++++++++++++++++++++++++++++++++-----
- target/i386/cpu.h     |  4 +++
- target/i386/kvm/kvm.c |  3 +-
- 3 files changed, 63 insertions(+), 8 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 982d9bd7f6..6c041ec5af 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -47,6 +47,9 @@
- #include "cpu-internal.h"
- 
- static void x86_cpu_realizefn(DeviceState *dev, Error **errp);
-+static void x86_cpu_get_supported_cpuid(uint32_t func, uint32_t index,
-+                                        uint32_t *eax, uint32_t *ebx,
-+                                        uint32_t *ecx, uint32_t *edx);
- 
- /* Helpers for building CPUID[2] descriptors: */
- 
-@@ -1133,7 +1136,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             "avx-vnni-int8", "avx-ne-convert", NULL, NULL,
-             "amx-complex", NULL, "avx-vnni-int16", NULL,
-             NULL, NULL, "prefetchiti", NULL,
--            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, "avx10",
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-@@ -1961,6 +1964,7 @@ typedef struct X86CPUDefinition {
-     int family;
-     int model;
-     int stepping;
-+    uint8_t avx10_version;
-     FeatureWordArray features;
-     const char *model_id;
-     const CPUCaches *const cache_info;
-@@ -6328,6 +6332,9 @@ static void x86_cpu_load_model(X86CPU *cpu, X86CPUModel *model)
-      */
-     object_property_set_str(OBJECT(cpu), "vendor", def->vendor, &error_abort);
- 
-+    object_property_set_uint(OBJECT(cpu), "avx10-version", def->avx10_version,
-+                             &error_abort);
-+
-     x86_cpu_apply_version_props(cpu, model);
- 
-     /*
-@@ -6856,6 +6863,16 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
-         }
-         break;
-     }
-+    case 0x24: {
-+        *eax = 0;
-+        *ebx = 0;
-+        *ecx = 0;
-+        *edx = 0;
-+        if ((env->features[FEAT_7_1_EDX] & CPUID_7_1_EDX_AVX10) && count == 0) {
-+            *ebx = env->features[FEAT_24_0_EBX] | env->avx10_version;
-+        }
-+        break;
-+    }
-     case 0x40000000:
-         /*
-          * CPUID code in kvm_arch_init_vcpu() ignores stuff
-@@ -7436,6 +7453,12 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-                 ~env->user_features[w] &
-                 ~feature_word_info[w].no_autoenable_flags;
-         }
-+
-+        if ((env->features[FEAT_7_1_EDX] & CPUID_7_1_EDX_AVX10) && !env->avx10_version) {
-+            uint32_t eax, ebx, ecx, edx;
-+            x86_cpu_get_supported_cpuid(0x24, 0, &eax, &ebx, &ecx, &edx);
-+            env->avx10_version = ebx & 0xff;
-+        }
-     }
- 
-     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
-@@ -7499,6 +7522,11 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-             x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x1F);
-         }
- 
-+        /* Advanced Vector Extensions 10 (AVX10) requires CPUID[0x24] */
-+        if (env->features[FEAT_7_1_EDX] & CPUID_7_1_EDX_AVX10) {
-+            x86_cpu_adjust_level(cpu, &env->cpuid_min_level, 0x24);
-+        }
-+
-         /* SVM requires CPUID[0x8000000A] */
-         if (env->features[FEAT_8000_0001_ECX] & CPUID_EXT3_SVM) {
-             x86_cpu_adjust_level(cpu, &env->cpuid_min_xlevel, 0x8000000A);
-@@ -7549,6 +7577,10 @@ static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose)
-     CPUX86State *env = &cpu->env;
-     FeatureWord w;
-     const char *prefix = NULL;
-+    bool have_filtered_features;
-+
-+    uint32_t eax_0, ebx_0, ecx_0, edx_0;
-+    uint32_t eax_1, ebx_1, ecx_1, edx_1;
- 
-     if (verbose) {
-         prefix = accel_uses_host_cpuid()
-@@ -7570,13 +7602,10 @@ static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose)
-      */
-     if ((env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) &&
-         kvm_enabled()) {
--        uint32_t eax_0, ebx_0, ecx_0, edx_0_unused;
--        uint32_t eax_1, ebx_1, ecx_1_unused, edx_1_unused;
--
-         x86_cpu_get_supported_cpuid(0x14, 0,
--                                    &eax_0, &ebx_0, &ecx_0, &edx_0_unused);
-+                                    &eax_0, &ebx_0, &ecx_0, &edx_0);
-         x86_cpu_get_supported_cpuid(0x14, 1,
--                                    &eax_1, &ebx_1, &ecx_1_unused, &edx_1_unused);
-+                                    &eax_1, &ebx_1, &ecx_1, &edx_1);
- 
-         if (!eax_0 ||
-            ((ebx_0 & INTEL_PT_MINIMAL_EBX) != INTEL_PT_MINIMAL_EBX) ||
-@@ -7597,7 +7626,27 @@ static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose)
-         }
-     }
- 
--    return x86_cpu_have_filtered_features(cpu);
-+    have_filtered_features = x86_cpu_have_filtered_features(cpu);
-+
-+    if (env->features[FEAT_7_1_EDX] & CPUID_7_1_EDX_AVX10) {
-+        x86_cpu_get_supported_cpuid(0x24, 0,
-+                                    &eax_0, &ebx_0, &ecx_0, &edx_0);
-+        uint8_t version = ebx_0 & 0xff;
-+
-+        if (version < env->avx10_version) {
-+            if (prefix) {
-+                warn_report("%s: avx10.%d. Adjust to avx10.%d",
-+                            prefix, env->avx10_version, version);
-+            }
-+            env->avx10_version = version;
-+            have_filtered_features = true;
-+        }
-+    } else if (env->avx10_version && prefix) {
-+        warn_report("%s: avx10.%d.", prefix, env->avx10_version);
-+        have_filtered_features = true;
-+    }
-+
-+    return have_filtered_features;
- }
- 
- static void x86_cpu_hyperv_realize(X86CPU *cpu)
-@@ -8378,6 +8427,7 @@ static Property x86_cpu_properties[] = {
-     DEFINE_PROP_UINT32("min-level", X86CPU, env.cpuid_min_level, 0),
-     DEFINE_PROP_UINT32("min-xlevel", X86CPU, env.cpuid_min_xlevel, 0),
-     DEFINE_PROP_UINT32("min-xlevel2", X86CPU, env.cpuid_min_xlevel2, 0),
-+    DEFINE_PROP_UINT8("avx10-version", X86CPU, env.avx10_version, 0),
-     DEFINE_PROP_UINT64("ucode-rev", X86CPU, ucode_rev, 0),
-     DEFINE_PROP_BOOL("full-cpuid-auto-level", X86CPU, full_cpuid_auto_level, true),
-     DEFINE_PROP_STRING("hv-vendor-id", X86CPU, hyperv_vendor),
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 14edd57a37..591113349d 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -972,6 +972,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- #define CPUID_7_1_EDX_AMX_COMPLEX       (1U << 8)
- /* PREFETCHIT0/1 Instructions */
- #define CPUID_7_1_EDX_PREFETCHITI       (1U << 14)
-+/* Support for Advanced Vector Extensions 10 */
-+#define CPUID_7_1_EDX_AVX10             (1U << 19)
- /* Flexible return and event delivery (FRED) */
- #define CPUID_7_1_EAX_FRED              (1U << 17)
- /* Load into IA32_KERNEL_GS_BASE (LKGS) */
-@@ -1914,6 +1916,8 @@ typedef struct CPUArchState {
-     uint32_t cpuid_vendor3;
-     uint32_t cpuid_version;
-     FeatureWordArray features;
-+    /* AVX10 version */
-+    uint8_t avx10_version;
-     /* Features that were explicitly enabled/disabled */
-     FeatureWordArray user_features;
-     uint32_t cpuid_model[12];
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 814f93da19..d0329a4ed7 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -1891,7 +1891,8 @@ static uint32_t kvm_x86_build_cpuid(CPUX86State *env,
-         case 0x7:
-         case 0x14:
-         case 0x1d:
--        case 0x1e: {
-+        case 0x1e:
-+        case 0x24: {
-             uint32_t times;
- 
-             c->function = i;
--- 
-2.48.0
-
diff --git a/kvm-target-i386-add-CPUID.24-features-for-AVX10.patch b/kvm-target-i386-add-CPUID.24-features-for-AVX10.patch
deleted file mode 100644
index 0424c79..0000000
--- a/kvm-target-i386-add-CPUID.24-features-for-AVX10.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 4d68991ce4c1bbc6acf74d249c8cea504560780f Mon Sep 17 00:00:00 2001
-From: Tao Su <tao1.su@linux.intel.com>
-Date: Thu, 31 Oct 2024 16:52:30 +0800
-Subject: [PATCH 05/11] target/i386: add CPUID.24 features for AVX10
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/9] e70e79b79037c77df17a028b7451b92bde042c0e (bonzini/rhel-qemu-kvm)
-
-Introduce features for the supported vector bit lengths.
-
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241028024512.156724-3-tao1.su@linux.intel.com
-Link: https://lore.kernel.org/r/20241028024512.156724-4-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Tested-by: Xuelian Guo <xuelian.guo@intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-6-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 2d055b8fe11ee567c2ae8047311fd83697e494b6)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 15 +++++++++++++++
- target/i386/cpu.h |  8 ++++++++
- 2 files changed, 23 insertions(+)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 6c041ec5af..b6021be50d 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -902,6 +902,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
- #define TCG_SGX_12_0_EAX_FEATURES 0
- #define TCG_SGX_12_0_EBX_FEATURES 0
- #define TCG_SGX_12_1_EAX_FEATURES 0
-+#define TCG_24_0_EBX_FEATURES 0
- 
- #if defined CONFIG_USER_ONLY
- #define CPUID_8000_0008_EBX_KERNEL_FEATURES (CPUID_8000_0008_EBX_IBPB | \
-@@ -1167,6 +1168,20 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-         },
-         .tcg_features = TCG_7_2_EDX_FEATURES,
-     },
-+    [FEAT_24_0_EBX] = {
-+        .type = CPUID_FEATURE_WORD,
-+        .feat_names = {
-+            [16] = "avx10-128",
-+            [17] = "avx10-256",
-+            [18] = "avx10-512",
-+        },
-+        .cpuid = {
-+            .eax = 0x24,
-+            .needs_ecx = true, .ecx = 0,
-+            .reg = R_EBX,
-+        },
-+        .tcg_features = TCG_24_0_EBX_FEATURES,
-+    },
-     [FEAT_8000_0007_EDX] = {
-         .type = CPUID_FEATURE_WORD,
-         .feat_names = {
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 591113349d..c60290b8d5 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -666,6 +666,7 @@ typedef enum FeatureWord {
-     FEAT_XSAVE_XSS_HI,     /* CPUID[EAX=0xd,ECX=1].EDX */
-     FEAT_7_1_EDX,       /* CPUID[EAX=7,ECX=1].EDX */
-     FEAT_7_2_EDX,       /* CPUID[EAX=7,ECX=2].EDX */
-+    FEAT_24_0_EBX,      /* CPUID[EAX=0x24,ECX=0].EBX */
-     FEATURE_WORDS,
- } FeatureWord;
- 
-@@ -990,6 +991,13 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
- /* Packets which contain IP payload have LIP values */
- #define CPUID_14_0_ECX_LIP              (1U << 31)
- 
-+/* AVX10 128-bit vector support is present */
-+#define CPUID_24_0_EBX_AVX10_128        (1U << 16)
-+/* AVX10 256-bit vector support is present */
-+#define CPUID_24_0_EBX_AVX10_256        (1U << 17)
-+/* AVX10 512-bit vector support is present */
-+#define CPUID_24_0_EBX_AVX10_512        (1U << 18)
-+
- /* RAS Features */
- #define CPUID_8000_0007_EBX_OVERFLOW_RECOV    (1U << 0)
- #define CPUID_8000_0007_EBX_SUCCOR      (1U << 1)
--- 
-2.48.0
-
diff --git a/kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch b/kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch
deleted file mode 100644
index 8bf0c7e..0000000
--- a/kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 3edc5689dd2b5a55655ab99e0153ad85ab50d773 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 3 Jul 2024 13:42:49 +0200
-Subject: [PATCH 09/11] target/i386: add sha512, sm3, sm4 feature bits
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [9/9] ec773b43841f1a38f0e5829c1d66cd5b517c5267 (bonzini/rhel-qemu-kvm)
-
-Status: queued for QEMU 10.0
-
-SHA512, SM3, SM4 (CPUID[EAX=7,ECX=1).EAX bits 0 to 2) is supported by
-Clearwater Forest processor, add it to QEMU as it does not need any
-specific enablement.
-
-See https://lore.kernel.org/kvm/20241105054825.870939-1-tao1.su@linux.intel.com/
-for reference.
-
-Reviewed-by: Tao Su <tao1.su@linux.intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ad368252d8..a70a3aa670 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1114,7 +1114,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-     [FEAT_7_1_EAX] = {
-         .type = CPUID_FEATURE_WORD,
-         .feat_names = {
--            NULL, NULL, NULL, NULL,
-+            "sha512", "sm3", "sm4", NULL,
-             "avx-vnni", "avx512-bf16", NULL, "cmpccxadd",
-             NULL, NULL, "fzrm", "fsrs",
-             "fsrc", NULL, NULL, NULL,
--- 
-2.48.0
-
diff --git a/kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch b/kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch
deleted file mode 100644
index 66406c5..0000000
--- a/kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 12c5f0bbef0aed7da1b6afa1cd8303aef4f5caf1 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 096/115] target/i386: allow reordering max_x86_cpu_initfn vs
- accel CPU init
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [96/115] 3cd04c30a233f88bf0e2747bf5d5ad2a06ffe056 (bonzini/rhel-qemu-kvm)
-
-The PMU feature is only supported by KVM, so move it there.  And since
-all accelerators other than TCG overwrite the vendor, set it in
-max_x86_cpu_initfn only if it has not been initialized by the
-superclass.  This makes it possible to run max_x86_cpu_initfn
-after accelerator init.
-
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 810fcc41fc572d90b3c05af3f06f451626ee6b10)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c         | 24 ++++++++++++------------
- target/i386/kvm/kvm-cpu.c |  2 ++
- 2 files changed, 14 insertions(+), 12 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 4df98838a3..dd2180fc3a 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5880,21 +5880,21 @@ static void max_x86_cpu_class_init(ObjectClass *oc, void *data)
- static void max_x86_cpu_initfn(Object *obj)
- {
-     X86CPU *cpu = X86_CPU(obj);
--
--    /* We can't fill the features array here because we don't know yet if
--     * "migratable" is true or false.
--     */
--    object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
-+    CPUX86State *env = &cpu->env;
- 
-     /*
--     * these defaults are used for TCG and all other accelerators
--     * besides KVM and HVF, which overwrite these values
-+     * these defaults are used for TCG, other accelerators overwrite these
-+     * values
-      */
--    object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
--                            &error_abort);
--    object_property_set_str(OBJECT(cpu), "model-id",
--                            "QEMU TCG CPU version " QEMU_HW_VERSION,
--                            &error_abort);
-+    if (!env->cpuid_vendor1) {
-+        object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
-+                                &error_abort);
-+    }
-+    if (!env->cpuid_model[0]) {
-+        object_property_set_str(OBJECT(cpu), "model-id",
-+                                "QEMU TCG CPU version " QEMU_HW_VERSION,
-+                                &error_abort);
-+    }
- }
- 
- static const TypeInfo max_x86_cpu_type_info = {
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 49e820b69e..660ccb70f8 100644
---- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -111,6 +111,8 @@ static void kvm_cpu_max_instance_init(X86CPU *cpu)
- 
-     host_cpu_max_instance_init(cpu);
- 
-+    object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
-+
-     if (lmce_supported()) {
-         object_property_set_bool(OBJECT(cpu), "lmce", true, &error_abort);
-     }
--- 
-2.50.1
-
diff --git a/kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch b/kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch
deleted file mode 100644
index 070616a..0000000
--- a/kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 9ed7a4e63c88a9b2afe51ffad36c12b174ad6e7a Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Thu, 31 Oct 2024 16:52:26 +0800
-Subject: [PATCH 01/11] target/i386: cpu: set correct supported XCR0 features
- for TCG
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/9] a27738f95f7c00915cd16288e469276a879f6bdf (bonzini/rhel-qemu-kvm)
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-2-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 33098002a838a0450f243f5e17463aca700e923d)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index ed278dd4a1..cff7ae1c54 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1297,7 +1297,9 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             .needs_ecx = true, .ecx = 0,
-             .reg = R_EAX,
-         },
--        .tcg_features = ~0U,
-+        .tcg_features = XSTATE_FP_MASK | XSTATE_SSE_MASK |
-+            XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK | XSTATE_BNDCSR_MASK |
-+            XSTATE_PKRU_MASK,
-         .migratable_flags = XSTATE_FP_MASK | XSTATE_SSE_MASK |
-             XSTATE_YMM_MASK | XSTATE_BNDREGS_MASK | XSTATE_BNDCSR_MASK |
-             XSTATE_OPMASK_MASK | XSTATE_ZMM_Hi256_MASK | XSTATE_Hi16_ZMM_MASK |
-@@ -1310,7 +1312,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             .needs_ecx = true, .ecx = 0,
-             .reg = R_EDX,
-         },
--        .tcg_features = ~0U,
-+        .tcg_features = 0U,
-     },
-     /*Below are MSR exposed features*/
-     [FEAT_ARCH_CAPABILITIES] = {
--- 
-2.48.0
-
diff --git a/kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch b/kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch
deleted file mode 100644
index b9799fa..0000000
--- a/kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From a6d31ad703d50bce0c0fb054356f50e480cf5a4d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Thu, 31 Oct 2024 16:52:27 +0800
-Subject: [PATCH 02/11] target/i386: do not rely on ExtSaveArea for
- accelerator-supported XCR0 bits
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/9] e53b5e7a58018c0635012382d93819dbe7cb6201 (bonzini/rhel-qemu-kvm)
-
-Right now, QEMU is using the "feature" and "bits" fields of ExtSaveArea
-to query the accelerator for the support status of extended save areas.
-This is a problem for AVX10, which attaches two feature bits (AVX512F
-and AVX10) to the same extended save states.
-
-To keep the AVX10 hacks to the minimum, limit usage of esa->features
-and esa->bits.  Instead, just query the accelerator for the 0xD leaf.
-Do it in common code and clear esa->size if an extended save state is
-unsupported.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-3-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit b888c7807049cc044d10d70139cb945202fb7cd2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c         | 33 +++++++++++++++++++++++++++++++--
- target/i386/kvm/kvm-cpu.c |  4 ----
- 2 files changed, 31 insertions(+), 6 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index cff7ae1c54..4e240ab181 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -7088,6 +7088,15 @@ static void x86_cpu_set_sgxlepubkeyhash(CPUX86State *env)
- #endif
- }
- 
-+static bool cpuid_has_xsave_feature(CPUX86State *env, const ExtSaveArea *esa)
-+{
-+    if (!esa->size) {
-+        return false;
-+    }
-+
-+    return (env->features[esa->feature] & esa->bits);
-+}
-+
- static void x86_cpu_reset_hold(Object *obj, ResetType type)
- {
-     CPUState *cs = CPU(obj);
-@@ -7196,7 +7205,7 @@ static void x86_cpu_reset_hold(Object *obj, ResetType type)
-         if (!((1 << i) & CPUID_XSTATE_XCR0_MASK)) {
-             continue;
-         }
--        if (env->features[esa->feature] & esa->bits) {
-+        if (cpuid_has_xsave_feature(env, esa)) {
-             xcr0 |= 1ull << i;
-         }
-     }
-@@ -7334,7 +7343,7 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
-     mask = 0;
-     for (i = 0; i < ARRAY_SIZE(x86_ext_save_areas); i++) {
-         const ExtSaveArea *esa = &x86_ext_save_areas[i];
--        if (env->features[esa->feature] & esa->bits) {
-+        if (cpuid_has_xsave_feature(env, esa)) {
-             mask |= (1ULL << i);
-         }
-     }
-@@ -8005,6 +8014,26 @@ static void x86_cpu_register_feature_bit_props(X86CPUClass *xcc,
- 
- static void x86_cpu_post_initfn(Object *obj)
- {
-+    static bool first = true;
-+    uint64_t supported_xcr0;
-+    int i;
-+
-+    if (first) {
-+        first = false;
-+
-+        supported_xcr0 =
-+            ((uint64_t) x86_cpu_get_supported_feature_word(NULL, FEAT_XSAVE_XCR0_HI) << 32) |
-+            x86_cpu_get_supported_feature_word(NULL, FEAT_XSAVE_XCR0_LO);
-+
-+        for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
-+            ExtSaveArea *esa = &x86_ext_save_areas[i];
-+
-+            if (!(supported_xcr0 & (1 << i))) {
-+                esa->size = 0;
-+            }
-+        }
-+    }
-+
-     accel_cpu_instance_init(CPU(obj));
- }
- 
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 684e731cbc..961b87e98e 100644
---- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -143,10 +143,6 @@ static void kvm_cpu_xsave_init(void)
-         if (!esa->size) {
-             continue;
-         }
--        if ((x86_cpu_get_supported_feature_word(NULL, esa->feature) & esa->bits)
--            != esa->bits) {
--            continue;
--        }
-         host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
-         if (eax != 0) {
-             assert(esa->size == eax);
--- 
-2.48.0
-
diff --git a/kvm-target-i386-kvm-Report-which-action-failed-in-kvm_ar.patch b/kvm-target-i386-kvm-Report-which-action-failed-in-kvm_ar.patch
deleted file mode 100644
index d67b6f2..0000000
--- a/kvm-target-i386-kvm-Report-which-action-failed-in-kvm_ar.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-From 1ed2fd718be2161f5ad6156dd2311a65b7f3a5e4 Mon Sep 17 00:00:00 2001
-From: Julia Suvorova <jusual@redhat.com>
-Date: Fri, 27 Sep 2024 12:47:41 +0200
-Subject: [PATCH 27/27] target/i386/kvm: Report which action failed in
- kvm_arch_put/get_registers
-
-RH-Author: Julia Suvorova <None>
-RH-MergeRequest: 286: kvm: Allow kvm_arch_get/put_registers to accept Error**
-RH-Jira: RHEL-60914
-RH-Acked-by: Juraj Marcin <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Commit: [2/2] b5d003dc2ccf869d7a810425baf21c783a96dcd1
-
-To help debug and triage future failure reports (akin to [1,2]) that
-may occur during kvm_arch_put/get_registers, the error path of each
-action is accompanied by unique error message.
-
-[1] https://issues.redhat.com/browse/RHEL-7558
-[2] https://issues.redhat.com/browse/RHEL-21761
-
-Signed-off-by: Julia Suvorova <jusual@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Link: https://lore.kernel.org/r/20240927104743.218468-3-jusual@redhat.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit fc058618d1596d29e89016750a1aaf64c9fe8832)
----
- target/i386/kvm/kvm.c | 23 +++++++++++++++++++++++
- 1 file changed, 23 insertions(+)
-
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 423e6922d8..814f93da19 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -5136,6 +5136,7 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
-     if (level >= KVM_PUT_RESET_STATE) {
-         ret = kvm_put_msr_feature_control(x86_cpu);
-         if (ret < 0) {
-+            error_setg_errno(errp, -ret, "Failed to set feature control MSR");
-             return ret;
-         }
-     }
-@@ -5143,12 +5144,14 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
-     /* must be before kvm_put_nested_state so that EFER.SVME is set */
-     ret = has_sregs2 ? kvm_put_sregs2(x86_cpu) : kvm_put_sregs(x86_cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set special registers");
-         return ret;
-     }
- 
-     if (level >= KVM_PUT_RESET_STATE) {
-         ret = kvm_put_nested_state(x86_cpu);
-         if (ret < 0) {
-+            error_setg_errno(errp, -ret, "Failed to set nested state");
-             return ret;
-         }
-     }
-@@ -5166,6 +5169,7 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
-     if (xen_mode == XEN_EMULATE && level == KVM_PUT_FULL_STATE) {
-         ret = kvm_put_xen_state(cpu);
-         if (ret < 0) {
-+            error_setg_errno(errp, -ret, "Failed to set Xen state");
-             return ret;
-         }
-     }
-@@ -5173,37 +5177,45 @@ int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
- 
-     ret = kvm_getput_regs(x86_cpu, 1);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set general purpose registers");
-         return ret;
-     }
-     ret = kvm_put_xsave(x86_cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set XSAVE");
-         return ret;
-     }
-     ret = kvm_put_xcrs(x86_cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set XCRs");
-         return ret;
-     }
-     ret = kvm_put_msrs(x86_cpu, level);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set MSRs");
-         return ret;
-     }
-     ret = kvm_put_vcpu_events(x86_cpu, level);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set vCPU events");
-         return ret;
-     }
-     if (level >= KVM_PUT_RESET_STATE) {
-         ret = kvm_put_mp_state(x86_cpu);
-         if (ret < 0) {
-+            error_setg_errno(errp, -ret, "Failed to set MP state");
-             return ret;
-         }
-     }
- 
-     ret = kvm_put_tscdeadline_msr(x86_cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set TSC deadline MSR");
-         return ret;
-     }
-     ret = kvm_put_debugregs(x86_cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to set debug registers");
-         return ret;
-     }
-     return 0;
-@@ -5218,6 +5230,7 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
- 
-     ret = kvm_get_vcpu_events(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get vCPU events");
-         goto out;
-     }
-     /*
-@@ -5226,44 +5239,54 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
-      */
-     ret = kvm_get_mp_state(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get MP state");
-         goto out;
-     }
-     ret = kvm_getput_regs(cpu, 0);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get general purpose registers");
-         goto out;
-     }
-     ret = kvm_get_xsave(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get XSAVE");
-         goto out;
-     }
-     ret = kvm_get_xcrs(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get XCRs");
-         goto out;
-     }
-     ret = has_sregs2 ? kvm_get_sregs2(cpu) : kvm_get_sregs(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get special registers");
-         goto out;
-     }
-     ret = kvm_get_msrs(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get MSRs");
-         goto out;
-     }
-     ret = kvm_get_apic(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get APIC");
-         goto out;
-     }
-     ret = kvm_get_debugregs(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get debug registers");
-         goto out;
-     }
-     ret = kvm_get_nested_state(cpu);
-     if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Failed to get nested state");
-         goto out;
-     }
- #ifdef CONFIG_XEN_EMU
-     if (xen_mode == XEN_EMULATE) {
-         ret = kvm_get_xen_state(cs);
-         if (ret < 0) {
-+            error_setg_errno(errp, -ret, "Failed to get Xen state");
-             goto out;
-         }
-     }
--- 
-2.39.3
-
diff --git a/kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch b/kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch
deleted file mode 100644
index 2ffc422..0000000
--- a/kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 3a75b23ebb7bb11ed3f25c291df996d7aef21656 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 098/115] target/i386: merge host_cpu_instance_init() and
- host_cpu_max_instance_init()
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [98/115] 5b4cfd0432cc108ecf67ff80b7573e601a5bea42 (bonzini/rhel-qemu-kvm)
-
-Simplify the accelerators' cpu_instance_init callbacks by doing all
-host-cpu setup in a single function.
-
-Based-on: <20250711000603.438312-1-pbonzini@redhat.com>
-Cc: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 29f1ba338baf60a9e455b6fdc37489ca1efe25aa)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/host-cpu.c    | 28 ++++++++++++++--------------
- target/i386/hvf/hvf-cpu.c |  2 --
- target/i386/kvm/kvm-cpu.c |  2 --
- 3 files changed, 14 insertions(+), 18 deletions(-)
-
-diff --git a/target/i386/host-cpu.c b/target/i386/host-cpu.c
-index 4ab536ab80..52b13daee7 100644
---- a/target/i386/host-cpu.c
-+++ b/target/i386/host-cpu.c
-@@ -132,27 +132,27 @@ void host_cpu_instance_init(X86CPU *cpu)
- {
-     X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
- 
--    if (xcc->model) {
--        char vendor[CPUID_VENDOR_SZ + 1];
--
--        host_cpu_vendor_fms(vendor, NULL, NULL, NULL);
--        object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
--    }
--}
--
--void host_cpu_max_instance_init(X86CPU *cpu)
--{
-     char vendor[CPUID_VENDOR_SZ + 1] = { 0 };
-     char model_id[CPUID_MODEL_ID_SZ + 1] = { 0 };
-     int family, model, stepping;
- 
--    /* Use max host physical address bits if -cpu max option is applied */
--    object_property_set_bool(OBJECT(cpu), "host-phys-bits", true, &error_abort);
--
-+    /*
-+     * setting vendor applies to both max/host and builtin_x86_defs CPU.
-+     * FIXME: this probably should warn or should be skipped if vendors do
-+     * not match, because family numbers are incompatible between Intel and AMD.
-+     */
-     host_cpu_vendor_fms(vendor, &family, &model, &stepping);
-+    object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
-+
-+    if (!xcc->max_features) {
-+        return;
-+    }
-+
-     host_cpu_fill_model_id(model_id);
- 
--    object_property_set_str(OBJECT(cpu), "vendor", vendor, &error_abort);
-+    /* Use max host physical address bits if -cpu max option is applied */
-+    object_property_set_bool(OBJECT(cpu), "host-phys-bits", true, &error_abort);
-+
-     object_property_set_int(OBJECT(cpu), "family", family, &error_abort);
-     object_property_set_int(OBJECT(cpu), "model", model, &error_abort);
-     object_property_set_int(OBJECT(cpu), "stepping", stepping,
-diff --git a/target/i386/hvf/hvf-cpu.c b/target/i386/hvf/hvf-cpu.c
-index 35fc642b93..12cc9502ba 100644
---- a/target/i386/hvf/hvf-cpu.c
-+++ b/target/i386/hvf/hvf-cpu.c
-@@ -21,8 +21,6 @@ static void hvf_cpu_max_instance_init(X86CPU *cpu)
- {
-     CPUX86State *env = &cpu->env;
- 
--    host_cpu_max_instance_init(cpu);
--
-     env->cpuid_min_level =
-         hvf_get_supported_cpuid(0x0, 0, R_EAX);
-     env->cpuid_min_xlevel =
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 660ccb70f8..62ee570763 100644
---- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -109,8 +109,6 @@ static void kvm_cpu_max_instance_init(X86CPU *cpu)
-     CPUX86State *env = &cpu->env;
-     KVMState *s = kvm_state;
- 
--    host_cpu_max_instance_init(cpu);
--
-     object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
- 
-     if (lmce_supported()) {
--- 
-2.50.1
-
diff --git a/kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch b/kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch
deleted file mode 100644
index 793c170..0000000
--- a/kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 10a611c8c607b7c320eb7c01c444944d8ba318f6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 097/115] target/i386: move accel_cpu_instance_init to
- .instance_init
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [97/115] b2725f7b55754f8ec6a54428eb1d70c588eb09ef (bonzini/rhel-qemu-kvm)
-
-With the reordering of instance_post_init callbacks that is new in 10.1
-accel_cpu_instance_init must execute in .instance_init as is already
-the case for RISC-V.  Otherwise, for example, setting the vendor
-property is broken when using KVM or Hypervisor.framework, because
-KVM sets it *after* the user's value is set by DeviceState's
-intance_post_init callback.
-
-Reported-by: Like Xu <like.xu.linux@gmail.com>
-Reported-by: Dongli Zhang <dongli.zhang@oracle.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 5f158abef44c7e0945fc5f76715ef135a9bf9bd2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index dd2180fc3a..2160754869 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5883,8 +5883,8 @@ static void max_x86_cpu_initfn(Object *obj)
-     CPUX86State *env = &cpu->env;
- 
-     /*
--     * these defaults are used for TCG, other accelerators overwrite these
--     * values
-+     * these defaults are used for TCG, other accelerators have overwritten
-+     * these values
-      */
-     if (!env->cpuid_vendor1) {
-         object_property_set_str(OBJECT(cpu), "vendor", CPUID_VENDOR_AMD,
-@@ -8636,8 +8636,6 @@ static void x86_cpu_post_initfn(Object *obj)
-         }
-     }
- 
--    accel_cpu_instance_init(CPU(obj));
--
- #ifndef CONFIG_USER_ONLY
-     if (current_machine && current_machine->cgs) {
-         x86_confidential_guest_cpu_instance_init(
-@@ -8712,6 +8710,8 @@ static void x86_cpu_initfn(Object *obj)
-     if (xcc->model) {
-         x86_cpu_load_model(cpu, xcc->model);
-     }
-+
-+    accel_cpu_instance_init(CPU(obj));
- }
- 
- static int64_t x86_cpu_get_arch_id(CPUState *cs)
--- 
-2.50.1
-
diff --git a/kvm-target-i386-move-max_features-to-class.patch b/kvm-target-i386-move-max_features-to-class.patch
deleted file mode 100644
index 0b34c97..0000000
--- a/kvm-target-i386-move-max_features-to-class.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 62aee66f496828bec5574d7790501788ad602966 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 094/115] target/i386: move max_features to class
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [94/115] f1ce43d8d481176eed2bf0f51c4e1bb423480858 (bonzini/rhel-qemu-kvm)
-
-max_features is always set to true for instances created by -cpu max or
--cpu host; it's always false for other classes.  Therefore it can be
-turned into a field in the X86CPUClass.
-
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit cb2273edf5df57cb270bc19d7e92d8be5870c17a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c         | 7 ++++---
- target/i386/cpu.h         | 2 +-
- target/i386/hvf/hvf-cpu.c | 3 ++-
- target/i386/kvm/kvm-cpu.c | 5 +++--
- 4 files changed, 10 insertions(+), 7 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index a9d6811032..8685b9d998 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5868,6 +5868,7 @@ static void max_x86_cpu_class_init(ObjectClass *oc, void *data)
- 
-     xcc->ordering = 9;
- 
-+    xcc->max_features = true;
-     xcc->model_description =
-         "Enables all features supported by the accelerator in the current host";
- 
-@@ -5882,7 +5883,6 @@ static void max_x86_cpu_initfn(Object *obj)
-     /* We can't fill the features array here because we don't know yet if
-      * "migratable" is true or false.
-      */
--    cpu->max_features = true;
-     object_property_set_bool(OBJECT(cpu), "pmu", true, &error_abort);
- 
-     /*
-@@ -7954,6 +7954,7 @@ static void x86_cpu_enable_xsave_components(X86CPU *cpu)
-  */
- void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
- {
-+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
-     CPUX86State *env = &cpu->env;
-     FeatureWord w;
-     int i;
-@@ -7973,12 +7974,12 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-         }
-     }
- 
--    /*TODO: Now cpu->max_features doesn't overwrite features
-+    /* TODO: Now xcc->max_features doesn't overwrite features
-      * set using QOM properties, and we can convert
-      * plus_features & minus_features to global properties
-      * inside x86_cpu_parse_featurestr() too.
-      */
--    if (cpu->max_features) {
-+    if (xcc->max_features) {
-         for (w = 0; w < FEATURE_WORDS; w++) {
-             /* Override only features that weren't set explicitly
-              * by the user.
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index a08931f969..a419eb64a5 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -2122,7 +2122,6 @@ struct ArchCPU {
-     bool expose_tcg;
-     bool migratable;
-     bool migrate_smi_count;
--    bool max_features; /* Enable all supported features automatically */
-     uint32_t apic_id;
- 
-     /* Enables publishing of TSC increment and Local APIC bus frequencies to
-@@ -2275,6 +2274,7 @@ struct X86CPUClass {
-      */
-     X86CPUModel *model;
- 
-+    bool max_features; /* Enable all supported features automatically */
-     bool host_cpuid_required;
-     int ordering;
-     bool migration_safe;
-diff --git a/target/i386/hvf/hvf-cpu.c b/target/i386/hvf/hvf-cpu.c
-index ac617f17e7..35fc642b93 100644
---- a/target/i386/hvf/hvf-cpu.c
-+++ b/target/i386/hvf/hvf-cpu.c
-@@ -61,13 +61,14 @@ static void hvf_cpu_xsave_init(void)
- static void hvf_cpu_instance_init(CPUState *cs)
- {
-     X86CPU *cpu = X86_CPU(cs);
-+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
- 
-     host_cpu_instance_init(cpu);
- 
-     /* Special cases not set in the X86CPUDefinition structs: */
-     /* TODO: in-kernel irqchip for hvf */
- 
--    if (cpu->max_features) {
-+    if (xcc->max_features) {
-         hvf_cpu_max_instance_init(cpu);
-     }
- 
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 961b87e98e..49e820b69e 100644
---- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -41,6 +41,7 @@ static void kvm_set_guest_phys_bits(CPUState *cs)
- static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
- {
-     X86CPU *cpu = X86_CPU(cs);
-+    X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
-     CPUX86State *env = &cpu->env;
-     bool ret;
- 
-@@ -63,7 +64,7 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
-      *   check/update ucode_rev, phys_bits, guest_phys_bits, mwait
-      *   cpu_common_realizefn() (via xcc->parent_realize)
-      */
--    if (cpu->max_features) {
-+    if (xcc->max_features) {
-         if (enable_cpu_pm) {
-             if (kvm_has_waitpkg()) {
-                 env->features[FEAT_7_0_ECX] |= CPUID_7_0_ECX_WAITPKG;
-@@ -217,7 +218,7 @@ static void kvm_cpu_instance_init(CPUState *cs)
-         x86_cpu_apply_props(cpu, kvm_default_props);
-     }
- 
--    if (cpu->max_features) {
-+    if (xcc->max_features) {
-         kvm_cpu_max_instance_init(cpu);
-     }
- 
--- 
-2.50.1
-
diff --git a/kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch b/kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch
deleted file mode 100644
index 3bc3a21..0000000
--- a/kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From a0f80cbb64e88f7f4e222e31d2ace756ece782f7 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:49 +0200
-Subject: [PATCH 095/115] target/i386: nvmm, whpx: add accel/CPU class that
- sets host vendor
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [95/115] b579400cf9a23c6405af130a5fed54fc41063bcb (bonzini/rhel-qemu-kvm)
-
-NVMM and WHPX are virtualizers, and therefore they need to use
-(at least by default) the host vendor for the guest CPUID.
-Add a cpu_instance_init implementation to these accelerators.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d93972d88b0984ed0a2090493f8d62cc188976d2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Conflicts: system/ -> sysemu/
----
- target/i386/cpu.c           |  3 ++-
- target/i386/meson.build     |  2 ++
- target/i386/nvmm/nvmm-all.c | 25 +++++++++++++++++++++++++
- target/i386/whpx/whpx-all.c | 25 +++++++++++++++++++++++++
- 4 files changed, 54 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 8685b9d998..4df98838a3 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -43,6 +43,7 @@
- #include "hw/boards.h"
- #include "hw/i386/sgx-epc.h"
- #endif
-+#include "sysemu/qtest.h"
- #include "tcg/tcg-cpu.h"
- 
- #include "disas/capstone.h"
-@@ -1893,7 +1894,7 @@ uint32_t xsave_area_size(uint64_t mask, bool compacted)
- 
- static inline bool accel_uses_host_cpuid(void)
- {
--    return kvm_enabled() || hvf_enabled();
-+    return !tcg_enabled() && !qtest_enabled();
- }
- 
- static inline uint64_t x86_cpu_xsave_xcr0_components(X86CPU *cpu)
-diff --git a/target/i386/meson.build b/target/i386/meson.build
-index 075117989b..9572b31040 100644
---- a/target/i386/meson.build
-+++ b/target/i386/meson.build
-@@ -11,6 +11,8 @@ i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c', 'confidential-guest
- # x86 cpu type
- i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c'))
- i386_ss.add(when: 'CONFIG_HVF', if_true: files('host-cpu.c'))
-+i386_ss.add(when: 'CONFIG_WHPX', if_true: files('host-cpu.c'))
-+i386_ss.add(when: 'CONFIG_NVMM', if_true: files('host-cpu.c'))
- 
- i386_system_ss = ss.source_set()
- i386_system_ss.add(files(
-diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
-index 65768aca03..2cc84a15f9 100644
---- a/target/i386/nvmm/nvmm-all.c
-+++ b/target/i386/nvmm/nvmm-all.c
-@@ -19,6 +19,8 @@
- #include "qemu/error-report.h"
- #include "qapi/error.h"
- #include "qemu/queue.h"
-+#include "accel/accel-cpu-target.h"
-+#include "host-cpu.h"
- #include "migration/blocker.h"
- #include "strings.h"
- 
-@@ -1214,10 +1216,33 @@ static const TypeInfo nvmm_accel_type = {
-     .class_init = nvmm_accel_class_init,
- };
- 
-+static void nvmm_cpu_instance_init(CPUState *cs)
-+{
-+    X86CPU *cpu = X86_CPU(cs);
-+
-+    host_cpu_instance_init(cpu);
-+}
-+
-+static void nvmm_cpu_accel_class_init(ObjectClass *oc, const void *data)
-+{
-+    AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
-+
-+    acc->cpu_instance_init = nvmm_cpu_instance_init;
-+}
-+
-+static const TypeInfo nvmm_cpu_accel_type = {
-+    .name = ACCEL_CPU_NAME("nvmm"),
-+
-+    .parent = TYPE_ACCEL_CPU,
-+    .class_init = nvmm_cpu_accel_class_init,
-+    .abstract = true,
-+};
-+
- static void
- nvmm_type_init(void)
- {
-     type_register_static(&nvmm_accel_type);
-+    type_register_static(&nvmm_cpu_accel_type);
- }
- 
- type_init(nvmm_type_init);
-diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
-index a6674a826d..ea209d50f8 100644
---- a/target/i386/whpx/whpx-all.c
-+++ b/target/i386/whpx/whpx-all.c
-@@ -26,6 +26,8 @@
- #include "qapi/qapi-types-common.h"
- #include "qapi/qapi-visit-common.h"
- #include "migration/blocker.h"
-+#include "host-cpu.h"
-+#include "accel/accel-cpu-target.h"
- #include <winerror.h>
- 
- #include "whpx-internal.h"
-@@ -2512,6 +2514,28 @@ static void whpx_set_kernel_irqchip(Object *obj, Visitor *v,
-     }
- }
- 
-+static void whpx_cpu_instance_init(CPUState *cs)
-+{
-+    X86CPU *cpu = X86_CPU(cs);
-+
-+    host_cpu_instance_init(cpu);
-+}
-+
-+static void whpx_cpu_accel_class_init(ObjectClass *oc, const void *data)
-+{
-+    AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);
-+
-+    acc->cpu_instance_init = whpx_cpu_instance_init;
-+}
-+
-+static const TypeInfo whpx_cpu_accel_type = {
-+    .name = ACCEL_CPU_NAME("whpx"),
-+
-+    .parent = TYPE_ACCEL_CPU,
-+    .class_init = whpx_cpu_accel_class_init,
-+    .abstract = true,
-+};
-+
- /*
-  * Partition support
-  */
-@@ -2742,6 +2766,7 @@ static const TypeInfo whpx_accel_type = {
- static void whpx_type_init(void)
- {
-     type_register_static(&whpx_accel_type);
-+    type_register_static(&whpx_cpu_accel_type);
- }
- 
- bool init_whp_dispatch(void)
--- 
-2.50.1
-
diff --git a/kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch b/kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch
deleted file mode 100644
index 2e776fb..0000000
--- a/kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 6fd15c104cb9475311f68156ebf3603d406b90fa Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Thu, 31 Oct 2024 16:52:28 +0800
-Subject: [PATCH 03/11] target/i386: return bool from x86_cpu_filter_features
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 281: Add support for the AVX10.1, SHA512, SM3 and SM4 instruction sets.
-RH-Jira: RHEL-30316 RHEL-45111
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/9] a5cd846d3ade44b289d99b2742323f421fe30f8b (bonzini/rhel-qemu-kvm)
-
-Prepare for filtering non-boolean features such as AVX10 version.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Signed-off-by: Tao Su <tao1.su@linux.intel.com>
-Link: https://lore.kernel.org/r/20241031085233.425388-4-tao1.su@linux.intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 3507c6f04606593711408a6d26141bdbceff9377)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/cpu.c | 20 +++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 4e240ab181..982d9bd7f6 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -5837,7 +5837,7 @@ static void x86_cpu_parse_featurestr(const char *typename, char *features,
-     }
- }
- 
--static void x86_cpu_filter_features(X86CPU *cpu, bool verbose);
-+static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose);
- 
- /* Build a list with the name of all features on a feature word array */
- static void x86_cpu_list_feature_names(FeatureWordArray features,
-@@ -7542,9 +7542,9 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
-  * Finishes initialization of CPUID data, filters CPU feature
-  * words based on host availability of each feature.
-  *
-- * Returns: 0 if all flags are supported by the host, non-zero otherwise.
-+ * Returns: true if any flag is not supported by the host, false otherwise.
-  */
--static void x86_cpu_filter_features(X86CPU *cpu, bool verbose)
-+static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose)
- {
-     CPUX86State *env = &cpu->env;
-     FeatureWord w;
-@@ -7596,6 +7596,8 @@ static void x86_cpu_filter_features(X86CPU *cpu, bool verbose)
-             mark_unavailable_features(cpu, FEAT_7_0_EBX, CPUID_7_0_EBX_INTEL_PT, prefix);
-         }
-     }
-+
-+    return x86_cpu_have_filtered_features(cpu);
- }
- 
- static void x86_cpu_hyperv_realize(X86CPU *cpu)
-@@ -7693,14 +7695,14 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
-         }
-     }
- 
--    x86_cpu_filter_features(cpu, cpu->check_cpuid || cpu->enforce_cpuid);
--
--    if (cpu->enforce_cpuid && x86_cpu_have_filtered_features(cpu)) {
--        error_setg(&local_err,
--                   accel_uses_host_cpuid() ?
-+    if (x86_cpu_filter_features(cpu, cpu->check_cpuid || cpu->enforce_cpuid)) {
-+        if (cpu->enforce_cpuid) {
-+            error_setg(&local_err,
-+                       accel_uses_host_cpuid() ?
-                        "Host doesn't support requested features" :
-                        "TCG doesn't support requested features");
--        goto out;
-+            goto out;
-+        }
-     }
- 
-     /* On AMD CPUs, some CPUID[8000_0001].EDX bits must match the bits on
--- 
-2.48.0
-
diff --git a/kvm-target-i386-sev-Reduce-system-specific-declarations.patch b/kvm-target-i386-sev-Reduce-system-specific-declarations.patch
deleted file mode 100644
index cc5997a..0000000
--- a/kvm-target-i386-sev-Reduce-system-specific-declarations.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From a4bc6c4fc28364e8ca9fc99344b85254268744e3 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:44 +0200
-Subject: [PATCH 019/115] target/i386/sev: Reduce system specific declarations
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [19/115] 0015a372d990c69ce81241822722bf2521571ca7 (bonzini/rhel-qemu-kvm)
-
-"system/confidential-guest-support.h" is not needed,
-remove it. Reorder #ifdef'ry to reduce declarations
-exposed on user emulation.
-
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Message-Id: <20241218155913.72288-3-philmd@linaro.org>
-(cherry picked from commit 63cda19446c5307cc05b965c203742a583fc5abf)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- hw/i386/pc_sysfw.c |  2 +-
- target/i386/sev.h  | 29 ++++++++++++++++-------------
- 2 files changed, 17 insertions(+), 14 deletions(-)
-
-diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
-index ef80281d28..e6271e1020 100644
---- a/hw/i386/pc_sysfw.c
-+++ b/hw/i386/pc_sysfw.c
-@@ -36,7 +36,7 @@
- #include "hw/qdev-properties.h"
- #include "hw/block/flash.h"
- #include "sysemu/kvm.h"
--#include "sev.h"
-+#include "target/i386/sev.h"
- 
- #define FLASH_SECTOR_SIZE 4096
- 
-diff --git a/target/i386/sev.h b/target/i386/sev.h
-index 858005a119..373669eaac 100644
---- a/target/i386/sev.h
-+++ b/target/i386/sev.h
-@@ -18,7 +18,17 @@
- #include CONFIG_DEVICES /* CONFIG_SEV */
- #endif
- 
--#include "exec/confidential-guest-support.h"
-+#if !defined(CONFIG_SEV) || defined(CONFIG_USER_ONLY)
-+#define sev_enabled() 0
-+#define sev_es_enabled() 0
-+#define sev_snp_enabled() 0
-+#else
-+bool sev_enabled(void);
-+bool sev_es_enabled(void);
-+bool sev_snp_enabled(void);
-+#endif
-+
-+#if !defined(CONFIG_USER_ONLY)
- 
- #define TYPE_SEV_COMMON "sev-common"
- #define TYPE_SEV_GUEST "sev-guest"
-@@ -45,18 +55,6 @@ typedef struct SevKernelLoaderContext {
-     size_t cmdline_size;
- } SevKernelLoaderContext;
- 
--#ifdef CONFIG_SEV
--bool sev_enabled(void);
--bool sev_es_enabled(void);
--bool sev_snp_enabled(void);
--#else
--#define sev_enabled() 0
--#define sev_es_enabled() 0
--#define sev_snp_enabled() 0
--#endif
--
--uint32_t sev_get_cbit_position(void);
--uint32_t sev_get_reduced_phys_bits(void);
- bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp);
- 
- int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp);
-@@ -68,4 +66,9 @@ void sev_es_set_reset_vector(CPUState *cpu);
- 
- void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size);
- 
-+#endif /* !CONFIG_USER_ONLY */
-+
-+uint32_t sev_get_cbit_position(void);
-+uint32_t sev_get_reduced_phys_bits(void);
-+
- #endif
--- 
-2.50.1
-
diff --git a/kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch b/kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch
deleted file mode 100644
index c2775a6..0000000
--- a/kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From e8d9e0b0c8b44da13be0735e67576d6d2336750a Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:50 +0200
-Subject: [PATCH 106/115] target/i386: tdx: fix locking for interrupt injection
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [106/115] 0ec3f0d2a022735ef6dbd5b0cce10ee348dde3f1 (bonzini/rhel-qemu-kvm)
-
-Take tdx_guest->lock when injecting the event notification interrupt into
-the guest.
-
-Fixes CID 1612364.
-
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Cc: Xiaoyao Li <xiaoyao.li@intel.com>
-Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit f2b787976342a9e1d47810f3146ad74b86a5088a)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- target/i386/kvm/tdx.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
-index 20fcd9a4c5..08eed19960 100644
---- a/target/i386/kvm/tdx.c
-+++ b/target/i386/kvm/tdx.c
-@@ -1126,10 +1126,15 @@ int tdx_parse_tdvf(void *flash_ptr, int size)
-     return tdvf_parse_metadata(&tdx_guest->tdvf, flash_ptr, size);
- }
- 
--static void tdx_inject_interrupt(uint32_t apicid, uint32_t vector)
-+static void tdx_inject_interrupt(TdxGuest *tdx)
- {
-     int ret;
-+    uint32_t apicid, vector;
- 
-+    qemu_mutex_lock(&tdx->lock);
-+    vector = tdx->event_notify_vector;
-+    apicid = tdx->event_notify_apicid;
-+    qemu_mutex_unlock(&tdx->lock);
-     if (vector < 32 || vector > 255) {
-         return;
-     }
-@@ -1179,8 +1184,7 @@ static void tdx_get_quote_completion(TdxGenerateQuoteTask *task)
-         error_report("TDX: get-quote: failed to update GetQuote header.");
-     }
- 
--    tdx_inject_interrupt(tdx_guest->event_notify_apicid,
--                         tdx_guest->event_notify_vector);
-+    tdx_inject_interrupt(tdx);
- 
-     g_free(task->send_data);
-     g_free(task->receive_buf);
--- 
-2.50.1
-
diff --git a/kvm-target-s390-Convert-CPU-to-Resettable-interface.patch b/kvm-target-s390-Convert-CPU-to-Resettable-interface.patch
deleted file mode 100644
index 6b93825..0000000
--- a/kvm-target-s390-Convert-CPU-to-Resettable-interface.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-From 50c4cbbe0a8849dd0c720c6e706498cb0d46f5b3 Mon Sep 17 00:00:00 2001
-From: Peter Maydell <peter.maydell@linaro.org>
-Date: Fri, 13 Sep 2024 15:31:43 +0100
-Subject: [PATCH 04/26] target/s390: Convert CPU to Resettable interface
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [4/26] 157b29ced6b92ecec5e69f8bc60d0183a0c88fa0 (thuth/qemu-kvm-cs)
-
-Convert the s390 CPU to the Resettable interface.  This is slightly
-more involved than the other CPU types were (see commits
-9130cade5fc22..d66e64dd006df) because S390 has its own set of
-different kinds of reset with different behaviours that it needs to
-trigger.
-
-We handle this by adding these reset types to the Resettable
-ResetType enum.  Now instead of having an underlying implementation
-of reset that is s390-specific and which might be called either
-directly or via the DeviceClass::reset method, we can implement only
-the Resettable hold phase method, and have the places that need to
-trigger an s390-specific reset type do so by calling
-resettable_reset().
-
-The other option would have been to smuggle in the s390 reset
-type via, for instance, a field in the CPU state that we set
-in s390_do_cpu_initial_reset() etc and then examined in the
-reset method, but doing it this way seems cleaner.
-
-The motivation for this change is that this is the last caller
-of the legacy device_class_set_parent_reset() function, and
-removing that will let us clean up some glue code that we added
-for the transition to three-phase reset.
-
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20240830145812.1967042-4-peter.maydell@linaro.org
-(cherry picked from commit cf7f61d13f28f32d0b14abb70ce1bd9e41623b2e)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- docs/devel/reset.rst    | 10 ++++++++++
- include/hw/resettable.h |  2 ++
- target/s390x/cpu.c      | 38 +++++++++++++++++---------------------
- target/s390x/cpu.h      | 21 ++++-----------------
- target/s390x/sigp.c     |  8 ++------
- 5 files changed, 35 insertions(+), 44 deletions(-)
-
-diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
-index 24ab630465..d2799eba7a 100644
---- a/docs/devel/reset.rst
-+++ b/docs/devel/reset.rst
-@@ -44,6 +44,16 @@ The Resettable interface handles reset types with an enum ``ResetType``:
-   value on each cold reset, such as RNG seed information, and which they
-   must not reinitialize on a snapshot-load reset.
- 
-+``RESET_TYPE_S390_CPU_NORMAL``
-+  This is only used for S390 CPU objects; it clears interrupts, stops
-+  processing, and clears the TLB, but does not touch register contents.
-+
-+``RESET_TYPE_S390_CPU_INITIAL``
-+  This is only used for S390 CPU objects; it does everything
-+  ``RESET_TYPE_S390_CPU_NORMAL`` does and also clears the PSW, prefix,
-+  FPC, timer and control registers. It does not touch gprs, fprs or acrs.
-+
-+
- Devices which implement reset methods must treat any unknown ``ResetType``
- as equivalent to ``RESET_TYPE_COLD``; this will reduce the amount of
- existing code we need to change if we add more types in future.
-diff --git a/include/hw/resettable.h b/include/hw/resettable.h
-index 7e249deb8b..83b561fc83 100644
---- a/include/hw/resettable.h
-+++ b/include/hw/resettable.h
-@@ -36,6 +36,8 @@ typedef struct ResettableState ResettableState;
- typedef enum ResetType {
-     RESET_TYPE_COLD,
-     RESET_TYPE_SNAPSHOT_LOAD,
-+    RESET_TYPE_S390_CPU_INITIAL,
-+    RESET_TYPE_S390_CPU_NORMAL,
- } ResetType;
- 
- /*
-diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
-index 0fbfcd35d8..4e41a3dff5 100644
---- a/target/s390x/cpu.c
-+++ b/target/s390x/cpu.c
-@@ -32,6 +32,7 @@
- #include "sysemu/hw_accel.h"
- #include "hw/qdev-properties.h"
- #include "hw/qdev-properties-system.h"
-+#include "hw/resettable.h"
- #include "fpu/softfloat-helpers.h"
- #include "disas/capstone.h"
- #include "sysemu/tcg.h"
-@@ -162,23 +163,25 @@ static void s390_query_cpu_fast(CPUState *cpu, CpuInfoFast *value)
- #endif
- }
- 
--/* S390CPUClass::reset() */
--static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
-+/* S390CPUClass Resettable reset_hold phase method */
-+static void s390_cpu_reset_hold(Object *obj, ResetType type)
- {
--    S390CPU *cpu = S390_CPU(s);
-+    S390CPU *cpu = S390_CPU(obj);
-     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
-     CPUS390XState *env = &cpu->env;
--    DeviceState *dev = DEVICE(s);
- 
--    scc->parent_reset(dev);
-+    if (scc->parent_phases.hold) {
-+        scc->parent_phases.hold(obj, type);
-+    }
-     cpu->env.sigp_order = 0;
-     s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
- 
-     switch (type) {
--    case S390_CPU_RESET_CLEAR:
-+    default:
-+        /* RESET_TYPE_COLD: power on or "clear" reset */
-         memset(env, 0, offsetof(CPUS390XState, start_initial_reset_fields));
-         /* fall through */
--    case S390_CPU_RESET_INITIAL:
-+    case RESET_TYPE_S390_CPU_INITIAL:
-         /* initial reset does not clear everything! */
-         memset(&env->start_initial_reset_fields, 0,
-                offsetof(CPUS390XState, start_normal_reset_fields) -
-@@ -203,7 +206,7 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
-         set_float_detect_tininess(float_tininess_before_rounding,
-                                   &env->fpu_status);
-        /* fall through */
--    case S390_CPU_RESET_NORMAL:
-+    case RESET_TYPE_S390_CPU_NORMAL:
-         env->psw.mask &= ~PSW_MASK_RI;
-         memset(&env->start_normal_reset_fields, 0,
-                offsetof(CPUS390XState, end_reset_fields) -
-@@ -212,20 +215,18 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
-         env->pfault_token = -1UL;
-         env->bpbc = false;
-         break;
--    default:
--        g_assert_not_reached();
-     }
- 
-     /* Reset state inside the kernel that we cannot access yet from QEMU. */
-     if (kvm_enabled()) {
-         switch (type) {
--        case S390_CPU_RESET_CLEAR:
-+        default:
-             kvm_s390_reset_vcpu_clear(cpu);
-             break;
--        case S390_CPU_RESET_INITIAL:
-+        case RESET_TYPE_S390_CPU_INITIAL:
-             kvm_s390_reset_vcpu_initial(cpu);
-             break;
--        case S390_CPU_RESET_NORMAL:
-+        case RESET_TYPE_S390_CPU_NORMAL:
-             kvm_s390_reset_vcpu_normal(cpu);
-             break;
-         }
-@@ -315,12 +316,6 @@ static Property s390x_cpu_properties[] = {
-     DEFINE_PROP_END_OF_LIST()
- };
- 
--static void s390_cpu_reset_full(DeviceState *dev)
--{
--    CPUState *s = CPU(dev);
--    return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
--}
--
- #ifdef CONFIG_TCG
- #include "hw/core/tcg-cpu-ops.h"
- 
-@@ -383,15 +378,16 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
-     S390CPUClass *scc = S390_CPU_CLASS(oc);
-     CPUClass *cc = CPU_CLASS(scc);
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    ResettableClass *rc = RESETTABLE_CLASS(oc);
- 
-     device_class_set_parent_realize(dc, s390_cpu_realizefn,
-                                     &scc->parent_realize);
-     device_class_set_props(dc, s390x_cpu_properties);
-     dc->user_creatable = true;
- 
--    device_class_set_parent_reset(dc, s390_cpu_reset_full, &scc->parent_reset);
-+    resettable_class_set_parent_phases(rc, NULL, s390_cpu_reset_hold, NULL,
-+                                       &scc->parent_phases);
- 
--    scc->reset = s390_cpu_reset;
-     cc->class_by_name = s390_cpu_class_by_name,
-     cc->has_work = s390_cpu_has_work;
-     cc->mmu_index = s390x_cpu_mmu_index;
-diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
-index d6b75ad0e0..6a64472403 100644
---- a/target/s390x/cpu.h
-+++ b/target/s390x/cpu.h
-@@ -177,19 +177,11 @@ struct ArchCPU {
-     uint32_t irqstate_saved_size;
- };
- 
--typedef enum cpu_reset_type {
--    S390_CPU_RESET_NORMAL,
--    S390_CPU_RESET_INITIAL,
--    S390_CPU_RESET_CLEAR,
--} cpu_reset_type;
--
- /**
-  * S390CPUClass:
-  * @parent_realize: The parent class' realize handler.
-- * @parent_reset: The parent class' reset handler.
-+ * @parent_phases: The parent class' reset phase handlers.
-  * @load_normal: Performs a load normal.
-- * @cpu_reset: Performs a CPU reset.
-- * @initial_cpu_reset: Performs an initial CPU reset.
-  *
-  * An S/390 CPU model.
-  */
-@@ -203,9 +195,8 @@ struct S390CPUClass {
-     const char *desc;
- 
-     DeviceRealize parent_realize;
--    DeviceReset parent_reset;
-+    ResettablePhases parent_phases;
-     void (*load_normal)(CPUState *cpu);
--    void (*reset)(CPUState *cpu, cpu_reset_type type);
- };
- 
- #ifndef CONFIG_USER_ONLY
-@@ -872,16 +863,12 @@ static inline void s390_do_cpu_full_reset(CPUState *cs, run_on_cpu_data arg)
- 
- static inline void s390_do_cpu_reset(CPUState *cs, run_on_cpu_data arg)
- {
--    S390CPUClass *scc = S390_CPU_GET_CLASS(cs);
--
--    scc->reset(cs, S390_CPU_RESET_NORMAL);
-+    resettable_reset(OBJECT(cs), RESET_TYPE_S390_CPU_NORMAL);
- }
- 
- static inline void s390_do_cpu_initial_reset(CPUState *cs, run_on_cpu_data arg)
- {
--    S390CPUClass *scc = S390_CPU_GET_CLASS(cs);
--
--    scc->reset(cs, S390_CPU_RESET_INITIAL);
-+    resettable_reset(OBJECT(cs), RESET_TYPE_S390_CPU_INITIAL);
- }
- 
- static inline void s390_do_cpu_load_normal(CPUState *cs, run_on_cpu_data arg)
-diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
-index ad0ad61177..08aaecf12b 100644
---- a/target/s390x/sigp.c
-+++ b/target/s390x/sigp.c
-@@ -251,24 +251,20 @@ static void sigp_restart(CPUState *cs, run_on_cpu_data arg)
- 
- static void sigp_initial_cpu_reset(CPUState *cs, run_on_cpu_data arg)
- {
--    S390CPU *cpu = S390_CPU(cs);
--    S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
-     SigpInfo *si = arg.host_ptr;
- 
-     cpu_synchronize_state(cs);
--    scc->reset(cs, S390_CPU_RESET_INITIAL);
-+    resettable_reset(OBJECT(cs), RESET_TYPE_S390_CPU_INITIAL);
-     cpu_synchronize_post_reset(cs);
-     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
- }
- 
- static void sigp_cpu_reset(CPUState *cs, run_on_cpu_data arg)
- {
--    S390CPU *cpu = S390_CPU(cs);
--    S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
-     SigpInfo *si = arg.host_ptr;
- 
-     cpu_synchronize_state(cs);
--    scc->reset(cs, S390_CPU_RESET_NORMAL);
-+    resettable_reset(OBJECT(cs), RESET_TYPE_S390_CPU_NORMAL);
-     cpu_synchronize_post_reset(cs);
-     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
- }
--- 
-2.48.1
-
diff --git a/kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch b/kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch
deleted file mode 100644
index 2becf51..0000000
--- a/kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch
+++ /dev/null
@@ -1,545 +0,0 @@
-From e72aaba2efda48e083d92e6dacfe58667bdfa958 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Fri, 9 May 2025 15:40:30 -0500
-Subject: [PATCH 15/16] tests: Add iotest mirror-sparse for recent patches
-
-RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 365: blockdev-mirror: More efficient handling of sparse mirrors
-RH-Jira: RHEL-82906 RHEL-83015
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [13/14] 6b7792e85b81e45d11c2664349db75d905e72adf (ebblake/centos-qemu-kvm)
-
-Prove that blockdev-mirror can now result in sparse raw destination
-files, regardless of whether the source is raw or qcow2.  By making
-this a separate test, it was possible to test effects of individual
-patches for the various pieces that all have to work together for a
-sparse mirror to be successful.
-
-Note that ./check -file produces different job lengths than ./check
--qcow2 (the test uses a filter to normalize); that's because when
-deciding how much of the image to be mirrored, the code looks at how
-much of the source image was allocated (for qcow2, this is only the
-written clusters; for raw, it is the entire file).  But the important
-part is that the destination file ends up smaller than 3M, rather than
-the 20M it used to be before this patch series.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20250509204341.3553601-28-eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit c0ddcb2cbc146e64f666eaae4edc7b5db7e5814d)
-Jira: https://issues.redhat.com/browse/RHEL-82906
-Jira: https://issues.redhat.com/browse/RHEL-83015
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- tests/qemu-iotests/tests/mirror-sparse     | 125 +++++++
- tests/qemu-iotests/tests/mirror-sparse.out | 365 +++++++++++++++++++++
- 2 files changed, 490 insertions(+)
- create mode 100755 tests/qemu-iotests/tests/mirror-sparse
- create mode 100644 tests/qemu-iotests/tests/mirror-sparse.out
-
-diff --git a/tests/qemu-iotests/tests/mirror-sparse b/tests/qemu-iotests/tests/mirror-sparse
-new file mode 100755
-index 0000000000..8c52a4e244
---- /dev/null
-+++ b/tests/qemu-iotests/tests/mirror-sparse
-@@ -0,0 +1,125 @@
-+#!/usr/bin/env bash
-+# group: rw auto quick
-+#
-+# Test blockdev-mirror with raw sparse destination
-+#
-+# Copyright (C) 2025 Red Hat, Inc.
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 2 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+#
-+
-+seq="$(basename $0)"
-+echo "QA output created by $seq"
-+
-+status=1 # failure is the default!
-+
-+_cleanup()
-+{
-+    _cleanup_test_img
-+    _cleanup_qemu
-+}
-+trap "_cleanup; exit \$status" 0 1 2 3 15
-+
-+# get standard environment, filters and checks
-+cd ..
-+. ./common.rc
-+. ./common.filter
-+. ./common.qemu
-+
-+_supported_fmt qcow2 raw  # Format of the source. dst is always raw file
-+_supported_proto file
-+_supported_os Linux
-+
-+echo
-+echo "=== Initial image setup ==="
-+echo
-+
-+TEST_IMG="$TEST_IMG.base" _make_test_img 20M
-+$QEMU_IO -c 'w 8M 2M' -f $IMGFMT "$TEST_IMG.base" | _filter_qemu_io
-+
-+_launch_qemu \
-+    -blockdev '{"driver":"file", "cache":{"direct":true, "no-flush":false},
-+                "filename":"'"$TEST_IMG.base"'", "node-name":"src-file"}' \
-+    -blockdev '{"driver":"'$IMGFMT'", "node-name":"src", "file":"src-file"}'
-+h1=$QEMU_HANDLE
-+_send_qemu_cmd $h1 '{"execute": "qmp_capabilities"}' 'return'
-+
-+# Check several combinations; most should result in a sparse destination;
-+# the destination should only be fully allocated if pre-allocated
-+# and not punching holes due to detect-zeroes
-+# do_test creation discard zeroes result
-+do_test() {
-+    creation=$1
-+    discard=$2
-+    zeroes=$3
-+    expected=$4
-+
-+echo
-+echo "=== Testing creation=$creation discard=$discard zeroes=$zeroes ==="
-+echo
-+
-+rm -f $TEST_IMG
-+if test $creation = external; then
-+    truncate --size=20M $TEST_IMG
-+else
-+    _send_qemu_cmd $h1 '{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"'$TEST_IMG'",
-+            "size":'$((20*1024*1024))', "preallocation":"'$creation'"},
-+           "job-id":"job1"}}' 'concluded'
-+    _send_qemu_cmd $h1 '{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}' 'return'
-+fi
-+_send_qemu_cmd $h1 '{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"'$TEST_IMG'", "aio":"threads",
-+                      "auto-read-only":true, "discard":"'$discard'",
-+                      "detect-zeroes":"'$zeroes'"}}' 'return'
-+_send_qemu_cmd $h1 '{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}' 'return'
-+_timed_wait_for $h1 '"ready"'
-+_send_qemu_cmd $h1 '{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}' 'return' \
-+                  | _filter_block_job_offset | _filter_block_job_len
-+_send_qemu_cmd $h1 '{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}' 'return' \
-+                  | _filter_block_job_offset | _filter_block_job_len
-+$QEMU_IMG compare -U -f $IMGFMT -F raw $TEST_IMG.base $TEST_IMG
-+result=$(disk_usage $TEST_IMG)
-+if test $result -lt $((3*1024*1024)); then
-+    actual=sparse
-+elif test $result = $((20*1024*1024)); then
-+    actual=full
-+else
-+    actual=unknown
-+fi
-+echo "Destination is $actual; expected $expected"
-+}
-+
-+do_test external ignore off sparse
-+do_test external unmap off sparse
-+do_test external unmap unmap sparse
-+do_test off ignore off sparse
-+do_test off unmap off sparse
-+do_test off unmap unmap sparse
-+do_test full ignore off full
-+do_test full unmap off sparse
-+do_test full unmap unmap sparse
-+
-+_send_qemu_cmd $h1 '{"execute":"quit"}' ''
-+
-+# success, all done
-+echo '*** done'
-+rm -f $seq.full
-+status=0
-diff --git a/tests/qemu-iotests/tests/mirror-sparse.out b/tests/qemu-iotests/tests/mirror-sparse.out
-new file mode 100644
-index 0000000000..2103b891c3
---- /dev/null
-+++ b/tests/qemu-iotests/tests/mirror-sparse.out
-@@ -0,0 +1,365 @@
-+QA output created by mirror-sparse
-+
-+=== Initial image setup ===
-+
-+Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=20971520
-+wrote 2097152/2097152 bytes at offset 8388608
-+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-+{"execute": "qmp_capabilities"}
-+{"return": {}}
-+
-+=== Testing creation=external discard=ignore zeroes=off ===
-+
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"ignore",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=external discard=unmap zeroes=off ===
-+
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=external discard=unmap zeroes=unmap ===
-+
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"unmap"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=off discard=ignore zeroes=off ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"off"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"ignore",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=off discard=unmap zeroes=off ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"off"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=off discard=unmap zeroes=unmap ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"off"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"unmap"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=full discard=ignore zeroes=off ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"full"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"ignore",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is full; expected full
-+
-+=== Testing creation=full discard=unmap zeroes=off ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"full"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"off"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+
-+=== Testing creation=full discard=unmap zeroes=unmap ===
-+
-+{"execute": "blockdev-create", "arguments":
-+          {"options": {"driver":"file", "filename":"TEST_DIR/t.IMGFMT",
-+            "size":20971520, "preallocation":"full"},
-+           "job-id":"job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job1"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job1"}}
-+{"execute": "job-dismiss", "arguments":
-+          {"id": "job1"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job1"}}
-+{"return": {}}
-+{"execute": "blockdev-add", "arguments":
-+                     {"node-name": "dst", "driver":"file",
-+                      "filename":"TEST_DIR/t.IMGFMT", "aio":"threads",
-+                      "auto-read-only":true, "discard":"unmap",
-+                      "detect-zeroes":"unmap"}}
-+{"return": {}}
-+{"execute":"blockdev-mirror", "arguments":
-+                     {"sync":"full", "device":"src", "target":"dst",
-+                      "job-id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job2"}}
-+{"return": {}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job2"}}
-+{"execute": "job-complete", "arguments":
-+               {"id":"job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments":
-+                {"node-name": "dst"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job2", "len": LEN, "offset": OFFSET, "speed": 0, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job2"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job2"}}
-+{"return": {}}
-+Images are identical.
-+Destination is sparse; expected sparse
-+{"execute":"quit"}
-+*** done
--- 
-2.48.1
-
diff --git a/kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch b/kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
deleted file mode 100644
index 232d6a5..0000000
--- a/kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 6b2d9104632c948f37e640d471765f049cf01d57 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 22 Nov 2024 23:40:42 +0100
-Subject: [PATCH 2/4] tests/avocado/hotplug_blk: Fix addr in device_add command
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 316: qdev-monitor: avoid QemuOpts in QMP device_add
-RH-Jira: RHEL-39948
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [2/4] 5848a0ec61904674659ef5f1f19e29065c5c8271 (stefanha/centos-stream-qemu-kvm)
-
-pci_devfn properties accept both integer and string values, but
-integer 1 and string '1' have different meanings: The integer value
-means device 0, function 1 whereas the string value '1' is short for
-'1.0' and means device 1, function 0.
-
-This test wants the string version so that the device actually becomes
-visible for the guest. device_add hides the problem because it goes
-through QemuOpts, which turns all properties into strings - this is a
-QEMU bug that we want to fix, but that cancelled out the bug in this
-test.
-
-Fix the test first so that device_add can be fixed afterwards.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20241122224042.149258-1-kwolf@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 770de685353e8c495ad4773fbd4bc0db997e4dfd)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/avocado/hotplug_blk.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/avocado/hotplug_blk.py b/tests/avocado/hotplug_blk.py
-index d55ded1c1d..b36bca02ec 100644
---- a/tests/avocado/hotplug_blk.py
-+++ b/tests/avocado/hotplug_blk.py
-@@ -33,7 +33,7 @@ def plug(self) -> None:
-             'drive': 'disk',
-             'id': 'virtio-disk0',
-             'bus': 'pci.1',
--            'addr': 1
-+            'addr': '1',
-         }
- 
-         self.assert_no_vda()
--- 
-2.39.3
-
diff --git a/kvm-tests-qtest-Add-s390x-boot-order-tests-to-cdrom-test.patch b/kvm-tests-qtest-Add-s390x-boot-order-tests-to-cdrom-test.patch
deleted file mode 100644
index 4596afc..0000000
--- a/kvm-tests-qtest-Add-s390x-boot-order-tests-to-cdrom-test.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 0e5a728c1d46641bbf5c83289df56422efd374c8 Mon Sep 17 00:00:00 2001
-From: Jared Rossi <jrossi@linux.ibm.com>
-Date: Sat, 19 Oct 2024 21:29:53 -0400
-Subject: [PATCH 20/27] tests/qtest: Add s390x boot order tests to cdrom-test.c
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 277: Full boot order support for s390x [CentOS 9]
-RH-Jira: RHEL-11424
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [20/23] 6b8769f2fc5f8c8a6345a5961f54e52be62aae49 (thuth/qemu-kvm-cs9)
-
-Add two new qtests to verify that a valid IPL device can successfully boot after
-failed IPL attempts from one or more invalid devices.
-
-cdrom-test/as-fallback-device: Defines the primary boot target as a device that
-is invalid for IPL and a second boot target that is valid for IPL. Ensures that
-the valid device will be selected after the initial failed IPL.
-
-cdrom-test/as-last-option: Defines the maximum number of boot devices (8)
-where only the final entry in the boot order is valid. Ensures that a valid
-device will be selected even after multiple failed IPL attempts from both
-virtio-blk and virtio-scsi device types.
-
-Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20241020012953.1380075-20-jrossi@linux.ibm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-(cherry picked from commit f5aa2d9d4c6480fa73b89c935050afe57e5d8bd9)
----
- tests/qtest/cdrom-test.c | 24 ++++++++++++++++++++++++
- 1 file changed, 24 insertions(+)
-
-diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
-index 5d89e62515..ecba648144 100644
---- a/tests/qtest/cdrom-test.c
-+++ b/tests/qtest/cdrom-test.c
-@@ -206,6 +206,30 @@ static void add_s390x_tests(void)
-                         "-drive driver=null-co,read-zeroes=on,if=none,id=d1 "
-                         "-device virtio-blk,drive=d2,bootindex=1 "
-                         "-drive if=none,id=d2,media=cdrom,file=", test_cdboot);
-+    qtest_add_data_func("cdrom/boot/as-fallback-device",
-+                        "-device virtio-serial -device virtio-scsi "
-+                        "-device virtio-blk,drive=d1,bootindex=1 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d1 "
-+                        "-device virtio-blk,drive=d2,bootindex=2 "
-+                        "-drive if=none,id=d2,media=cdrom,file=", test_cdboot);
-+    qtest_add_data_func("cdrom/boot/as-last-option",
-+                        "-device virtio-serial -device virtio-scsi "
-+                        "-device virtio-blk,drive=d1,bootindex=1 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d1 "
-+                        "-device virtio-blk,drive=d2,bootindex=2 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d2 "
-+                        "-device virtio-blk,drive=d3,bootindex=3 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d3 "
-+                        "-device scsi-hd,drive=d4,bootindex=4 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d4 "
-+                        "-device scsi-hd,drive=d5,bootindex=5 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d5 "
-+                        "-device virtio-blk,drive=d6,bootindex=6 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d6 "
-+                        "-device scsi-hd,drive=d7,bootindex=7 "
-+                        "-drive driver=null-co,read-zeroes=on,if=none,id=d7 "
-+                        "-device scsi-cd,drive=d8,bootindex=8 "
-+                        "-drive if=none,id=d8,media=cdrom,file=", test_cdboot);
-     if (qtest_has_device("x-terminal3270")) {
-         qtest_add_data_func("cdrom/boot/without-bootindex",
-                             "-device virtio-scsi -device virtio-serial "
--- 
-2.39.3
-
diff --git a/kvm-tests-qtest-disable-most-pauth-tests.patch b/kvm-tests-qtest-disable-most-pauth-tests.patch
deleted file mode 100644
index 74069e5..0000000
--- a/kvm-tests-qtest-disable-most-pauth-tests.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 2cd838efaf2345497efab21fee689ff43d511f1c Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Thu, 23 Jan 2025 08:12:35 -0500
-Subject: [PATCH 11/11] tests/qtest: disable most pauth tests
-
-RH-Author: Sebastian Ott <sebott@redhat.com>
-RH-MergeRequest: 330: arm: disable pauth for virt-rhel9*
-RH-Jira: RHEL-75782
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Kashyap Chamarthy <None>
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Commit: [2/2] 373738aec33bf2dcaa47563b3c06595b21dca5be (seott1/cos-qemu-kvm)
-
-Since pauth is disabled for virt-rhel9* machine types (aliased via virt)
-the following assertions will trigger and need to be disabled as well:
-    assert_has_feature_enabled(qts, cpu_type, "pauth");
-    assert_set_feature(qts, cpu_type, "pauth-impdef", true);
-    assert_set_feature(qts, cpu_type, "pauth-qarma3", true);
-
-Signed-off-by: Sebastian Ott <sebott@redhat.com>
-JIRA: https://issues.redhat.com/browse/RHEL-75782
----
- tests/qtest/arm-cpu-features.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index 3016e6233c..6b680578a6 100644
---- a/tests/qtest/arm-cpu-features.c
-+++ b/tests/qtest/arm-cpu-features.c
-@@ -416,6 +416,7 @@ static void sve_tests_sve_off_kvm(const void *data)
- 
- static void pauth_tests_default(QTestState *qts, const char *cpu_type)
- {
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     assert_has_feature_enabled(qts, cpu_type, "pauth");
-     assert_has_feature_disabled(qts, cpu_type, "pauth-impdef");
-     assert_has_feature_disabled(qts, cpu_type, "pauth-qarma3");
-@@ -425,6 +426,7 @@ static void pauth_tests_default(QTestState *qts, const char *cpu_type)
-     assert_set_feature(qts, cpu_type, "pauth-impdef", false);
-     assert_set_feature(qts, cpu_type, "pauth-qarma3", true);
-     assert_set_feature(qts, cpu_type, "pauth-qarma3", false);
-+#endif /* disabled for RHEL */
-     assert_error(qts, cpu_type,
-                  "cannot enable pauth-impdef or pauth-qarma3 without pauth",
-                  "{ 'pauth': false, 'pauth-impdef': true }");
--- 
-2.48.0
-
diff --git a/kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch b/kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch
deleted file mode 100644
index d0787f4..0000000
--- a/kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 83f09a8c65e1fef416e39d9b0a4ead14ed00601e Mon Sep 17 00:00:00 2001
-From: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
-Date: Mon, 26 May 2025 10:20:55 -0700
-Subject: [PATCH 14/57] tests/unit/test-util-sockets: fix mem-leak on error
- object
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [7/7] 31c74f784a26812e5c5898efacda9b4069874ed7 (JurajMarcin/centos-src-qemu-kvm)
-
-The test fails with --enable-asan as the error struct is never freed.
-In the case where the test expects a success but it fails, let's also
-report the error for debugging (it will be freed internally).
-
-Fixes 316e8ee8d6 ("util/qemu-sockets: Refactor inet_parse() to use QemuOpts")
-
-Signed-off-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
-Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
-Message-ID: <518d94c7db20060b2a086cf55ee9bffab992a907.1748280011.git.matheus.bernardino@oss.qualcomm.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-(cherry picked from commit 5c54a367265ec19ed94a535cd15d178c16b8cae0)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- tests/unit/test-util-sockets.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
-index 8492f4d68f..ee66d727c3 100644
---- a/tests/unit/test-util-sockets.c
-+++ b/tests/unit/test-util-sockets.c
-@@ -341,8 +341,12 @@ static void inet_parse_test_helper(const char *str,
-     int rc = inet_parse(&addr, str, &error);
- 
-     if (success) {
-+        if (error) {
-+            error_report_err(error);
-+        }
-         g_assert_cmpint(rc, ==, 0);
-     } else {
-+        error_free(error);
-         g_assert_cmpint(rc, <, 0);
-     }
-     if (exp_addr != NULL) {
--- 
-2.39.3
-
diff --git a/kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch b/kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch
deleted file mode 100644
index 9d30908..0000000
--- a/kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From a69b8d66fb515cd55cef2fcaa626c350d761f1a9 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 17:16:13 +0200
-Subject: [PATCH 57/57] ui/vnc: Update display update interval when VM state
- changes to RUNNING
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 385: ui/vnc: Update display update interval when VM state changes to RUNNING
-RH-Jira: RHEL-100741
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Commit: [1/1] 30dd4790a607d646465c18d621073df997e8850b (JurajMarcin/centos-src-qemu-kvm)
-
-If a virtual machine is paused for an extended period time, for example,
-due to an incoming migration, there are also no changes on the screen.
-VNC in such case increases the display update interval by
-VNC_REFRESH_INTERVAL_INC (50 ms). The update interval can then grow up
-to VNC_REFRESH_INTERVAL_MAX (3000 ms).
-
-When the machine resumes, it can then take up to 3 seconds for the first
-display update. Furthermore, the update interval is then halved with
-each display update with changes on the screen. If there are moving
-elements on the screen, such as a video, this can be perceived as
-freezing and stuttering for few seconds before the movement is smooth
-again.
-
-This patch resolves this issue, by adding a listener to VM state changes
-and changing the update interval when the VM state changes to RUNNING.
-The update_displaychangelistener() function updates the internal timer,
-and the display is refreshed immediately if the timer is expired.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Link: https://lore.kernel.org/r/20250521151616.3951178-1-jmarcin@redhat.com
-Signed-off-by: Peter Xu <peterx@redhat.com>
-
-(cherry picked from commit 0310d594d98b39f9dde79b87fd8b0ad16e7c5459)
-
-JIRA: https://issues.redhat.com/browse/RHEL-100741
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- ui/vnc.c | 12 ++++++++++++
- ui/vnc.h |  2 ++
- 2 files changed, 14 insertions(+)
-
-diff --git a/ui/vnc.c b/ui/vnc.c
-index 5057ec8680..4afc925a18 100644
---- a/ui/vnc.c
-+++ b/ui/vnc.c
-@@ -3386,6 +3386,16 @@ static const DisplayChangeListenerOps dcl_ops = {
-     .dpy_cursor_define    = vnc_dpy_cursor_define,
- };
- 
-+static void vmstate_change_handler(void *opaque, bool running, RunState state)
-+{
-+    VncDisplay *vd = opaque;
-+
-+    if (state != RUN_STATE_RUNNING) {
-+        return;
-+    }
-+    update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
-+}
-+
- void vnc_display_init(const char *id, Error **errp)
- {
-     VncDisplay *vd;
-@@ -3422,6 +3432,8 @@ void vnc_display_init(const char *id, Error **errp)
-     vd->dcl.ops = &dcl_ops;
-     register_displaychangelistener(&vd->dcl);
-     vd->kbd = qkbd_state_init(vd->dcl.con);
-+    vd->vmstate_handler_entry = qemu_add_vm_change_state_handler(
-+        &vmstate_change_handler, vd);
- }
- 
- 
-diff --git a/ui/vnc.h b/ui/vnc.h
-index e5fa2efa3e..e9da707dbc 100644
---- a/ui/vnc.h
-+++ b/ui/vnc.h
-@@ -186,6 +186,8 @@ struct VncDisplay
- #endif
- 
-     AudioState *audio_state;
-+
-+    VMChangeStateEntry *vmstate_handler_entry;
- };
- 
- typedef struct VncTight {
--- 
-2.39.3
-
diff --git a/kvm-update-Linux-headers-to-KVM-tree-master.patch b/kvm-update-Linux-headers-to-KVM-tree-master.patch
deleted file mode 100644
index eb12dfc..0000000
--- a/kvm-update-Linux-headers-to-KVM-tree-master.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From ef8fda39f273b864ab558c48c6f3ff1f28b38e44 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 030/115] update Linux headers to KVM tree master
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [30/115] 8ca98dabb9f8b02543e363840ae9a23d0f736f5e (bonzini/rhel-qemu-kvm)
-
-To fetch the update of TDX
-
-Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
-Link: https://lore.kernel.org/r/20250703024021.3559286-3-xiaoyao.li@intel.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 25c98a135001559be905a0399669e5cdb3b0a613)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- linux-headers/asm-x86/kvm.h | 8 +++++++-
- linux-headers/linux/kvm.h   | 4 ++++
- 2 files changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index cd275ae76d..f0c1a730d9 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -963,7 +963,13 @@ struct kvm_tdx_cmd {
- struct kvm_tdx_capabilities {
- 	__u64 supported_attrs;
- 	__u64 supported_xfam;
--	__u64 reserved[254];
-+
-+	__u64 kernel_tdvmcallinfo_1_r11;
-+	__u64 user_tdvmcallinfo_1_r11;
-+	__u64 kernel_tdvmcallinfo_1_r12;
-+	__u64 user_tdvmcallinfo_1_r12;
-+
-+	__u64 reserved[250];
- 
- 	/* Configurable CPUID bits for userspace */
- 	struct kvm_cpuid2 cpuid;
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index 0690743944..32c5885a3c 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -459,6 +459,10 @@ struct kvm_run {
- 					__u64 leaf;
- 					__u64 r11, r12, r13, r14;
- 				} get_tdvmcall_info;
-+				struct {
-+					__u64 ret;
-+					__u64 vector;
-+				} setup_event_notify;
- 			};
- 		} tdx;
- 		/* Fix the size of the union. */
--- 
-2.50.1
-
diff --git a/kvm-update-Linux-headers-to-v6.16-rc3.patch b/kvm-update-Linux-headers-to-v6.16-rc3.patch
deleted file mode 100644
index 47a9f4a..0000000
--- a/kvm-update-Linux-headers-to-v6.16-rc3.patch
+++ /dev/null
@@ -1,497 +0,0 @@
-From 2fbd65006bac2b17a2fe6b709536bea965517b93 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 18 Jul 2025 18:03:45 +0200
-Subject: [PATCH 029/115] update Linux headers to v6.16-rc3
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-RH-MergeRequest: 391: TDX support, including attestation and device assignment
-RH-Jira: RHEL-15710 RHEL-20798 RHEL-49728
-RH-Acked-by: Yash Mankad <None>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Commit: [29/115] d92884a0574b2dd9037ee6911312b66b6c14299d (bonzini/rhel-qemu-kvm)
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 688b0756ad2fdbe8effdb66f724a1129f62be7a2)
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
- include/standard-headers/asm-x86/setup_data.h |  13 +-
- include/standard-headers/drm/drm_fourcc.h     |  45 ++++++
- include/standard-headers/linux/ethtool.h      | 134 +++++++++---------
- include/standard-headers/linux/fuse.h         |   6 +-
- .../linux/input-event-codes.h                 |   3 +-
- include/standard-headers/linux/pci_regs.h     |  12 +-
- include/standard-headers/linux/virtio_gpu.h   |   3 +-
- include/standard-headers/linux/virtio_pci.h   |   1 +
- linux-headers/asm-arm64/kvm.h                 |   9 +-
- linux-headers/asm-x86/kvm.h                   |   1 +
- linux-headers/linux/bits.h                    |   4 +-
- linux-headers/linux/kvm.h                     |  25 ++++
- linux-headers/linux/vhost.h                   |   4 +-
- 13 files changed, 182 insertions(+), 78 deletions(-)
-
-diff --git a/include/standard-headers/asm-x86/setup_data.h b/include/standard-headers/asm-x86/setup_data.h
-index a483d72f42..2e446c1d85 100644
---- a/include/standard-headers/asm-x86/setup_data.h
-+++ b/include/standard-headers/asm-x86/setup_data.h
-@@ -13,7 +13,8 @@
- #define SETUP_CC_BLOB			7
- #define SETUP_IMA			8
- #define SETUP_RNG_SEED			9
--#define SETUP_ENUM_MAX			SETUP_RNG_SEED
-+#define SETUP_KEXEC_KHO			10
-+#define SETUP_ENUM_MAX			SETUP_KEXEC_KHO
- 
- #define SETUP_INDIRECT			(1<<31)
- #define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
-@@ -78,6 +79,16 @@ struct ima_setup_data {
- 	uint64_t size;
- } QEMU_PACKED;
- 
-+/*
-+ * Locations of kexec handover metadata
-+ */
-+struct kho_data {
-+	uint64_t fdt_addr;
-+	uint64_t fdt_size;
-+	uint64_t scratch_addr;
-+	uint64_t scratch_size;
-+} QEMU_PACKED;
-+
- #endif /* __ASSEMBLER__ */
- 
- #endif /* _ASM_X86_SETUP_DATA_H */
-diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
-index a8b759dcbc..c8309d378b 100644
---- a/include/standard-headers/drm/drm_fourcc.h
-+++ b/include/standard-headers/drm/drm_fourcc.h
-@@ -421,6 +421,7 @@ extern "C" {
- #define DRM_FORMAT_MOD_VENDOR_ALLWINNER 0x09
- #define DRM_FORMAT_MOD_VENDOR_AMLOGIC 0x0a
- #define DRM_FORMAT_MOD_VENDOR_MTK     0x0b
-+#define DRM_FORMAT_MOD_VENDOR_APPLE   0x0c
- 
- /* add more to the end as needed */
- 
-@@ -1493,6 +1494,50 @@ drm_fourcc_canonicalize_nvidia_format_mod(uint64_t modifier)
- /* alias for the most common tiling format */
- #define DRM_FORMAT_MOD_MTK_16L_32S_TILE  DRM_FORMAT_MOD_MTK(MTK_FMT_MOD_TILE_16L32S)
- 
-+/*
-+ * Apple GPU-tiled layouts.
-+ *
-+ * Apple GPUs support nonlinear tilings with optional lossless compression.
-+ *
-+ * GPU-tiled images are divided into 16KiB tiles:
-+ *
-+ *     Bytes per pixel  Tile size
-+ *     ---------------  ---------
-+ *                   1  128x128
-+ *                   2  128x64
-+ *                   4  64x64
-+ *                   8  64x32
-+ *                  16  32x32
-+ *
-+ * Tiles are raster-order. Pixels within a tile are interleaved (Morton order).
-+ *
-+ * Compressed images pad the body to 128-bytes and are immediately followed by a
-+ * metadata section. The metadata section rounds the image dimensions to
-+ * powers-of-two and contains 8 bytes for each 16x16 compression subtile.
-+ * Subtiles are interleaved (Morton order).
-+ *
-+ * All images are 128-byte aligned.
-+ *
-+ * These layouts fundamentally do not have meaningful strides. No matter how we
-+ * specify strides for these layouts, userspace unaware of Apple image layouts
-+ * will be unable to use correctly the specified stride for any purpose.
-+ * Userspace aware of the image layouts do not use strides. The most "correct"
-+ * convention would be setting the image stride to 0. Unfortunately, some
-+ * software assumes the stride is at least (width * bytes per pixel). We
-+ * therefore require that stride equals (width * bytes per pixel). Since the
-+ * stride is arbitrary here, we pick the simplest convention.
-+ *
-+ * Although containing two sections, compressed image layouts are treated in
-+ * software as a single plane. This is modelled after AFBC, a similar
-+ * scheme. Attempting to separate the sections to be "explicit" in DRM would
-+ * only generate more confusion, as software does not treat the image this way.
-+ *
-+ * For detailed information on the hardware image layouts, see
-+ * https://docs.mesa3d.org/drivers/asahi.html#image-layouts
-+ */
-+#define DRM_FORMAT_MOD_APPLE_GPU_TILED fourcc_mod_code(APPLE, 1)
-+#define DRM_FORMAT_MOD_APPLE_GPU_TILED_COMPRESSED fourcc_mod_code(APPLE, 2)
-+
- /*
-  * AMD modifiers
-  *
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
-index 5d1ad5fdea..cef0d207a6 100644
---- a/include/standard-headers/linux/ethtool.h
-+++ b/include/standard-headers/linux/ethtool.h
-@@ -2295,71 +2295,75 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
- #define	RXH_XFRM_SYM_OR_XOR	(1 << 1)
- #define	RXH_XFRM_NO_CHANGE	0xff
- 
--/* L2-L4 network traffic flow types */
--#define	TCP_V4_FLOW	0x01	/* hash or spec (tcp_ip4_spec) */
--#define	UDP_V4_FLOW	0x02	/* hash or spec (udp_ip4_spec) */
--#define	SCTP_V4_FLOW	0x03	/* hash or spec (sctp_ip4_spec) */
--#define	AH_ESP_V4_FLOW	0x04	/* hash only */
--#define	TCP_V6_FLOW	0x05	/* hash or spec (tcp_ip6_spec; nfc only) */
--#define	UDP_V6_FLOW	0x06	/* hash or spec (udp_ip6_spec; nfc only) */
--#define	SCTP_V6_FLOW	0x07	/* hash or spec (sctp_ip6_spec; nfc only) */
--#define	AH_ESP_V6_FLOW	0x08	/* hash only */
--#define	AH_V4_FLOW	0x09	/* hash or spec (ah_ip4_spec) */
--#define	ESP_V4_FLOW	0x0a	/* hash or spec (esp_ip4_spec) */
--#define	AH_V6_FLOW	0x0b	/* hash or spec (ah_ip6_spec; nfc only) */
--#define	ESP_V6_FLOW	0x0c	/* hash or spec (esp_ip6_spec; nfc only) */
--#define	IPV4_USER_FLOW	0x0d	/* spec only (usr_ip4_spec) */
--#define	IP_USER_FLOW	IPV4_USER_FLOW
--#define	IPV6_USER_FLOW	0x0e	/* spec only (usr_ip6_spec; nfc only) */
--#define	IPV4_FLOW	0x10	/* hash only */
--#define	IPV6_FLOW	0x11	/* hash only */
--#define	ETHER_FLOW	0x12	/* spec only (ether_spec) */
--
--/* Used for GTP-U IPv4 and IPv6.
-- * The format of GTP packets only includes
-- * elements such as TEID and GTP version.
-- * It is primarily intended for data communication of the UE.
-- */
--#define GTPU_V4_FLOW 0x13	/* hash only */
--#define GTPU_V6_FLOW 0x14	/* hash only */
--
--/* Use for GTP-C IPv4 and v6.
-- * The format of these GTP packets does not include TEID.
-- * Primarily expected to be used for communication
-- * to create sessions for UE data communication,
-- * commonly referred to as CSR (Create Session Request).
-- */
--#define GTPC_V4_FLOW 0x15	/* hash only */
--#define GTPC_V6_FLOW 0x16	/* hash only */
--
--/* Use for GTP-C IPv4 and v6.
-- * Unlike GTPC_V4_FLOW, the format of these GTP packets includes TEID.
-- * After session creation, it becomes this packet.
-- * This is mainly used for requests to realize UE handover.
-- */
--#define GTPC_TEID_V4_FLOW 0x17	/* hash only */
--#define GTPC_TEID_V6_FLOW 0x18	/* hash only */
--
--/* Use for GTP-U and extended headers for the PSC (PDU Session Container).
-- * The format of these GTP packets includes TEID and QFI.
-- * In 5G communication using UPF (User Plane Function),
-- * data communication with this extended header is performed.
-- */
--#define GTPU_EH_V4_FLOW 0x19	/* hash only */
--#define GTPU_EH_V6_FLOW 0x1a	/* hash only */
--
--/* Use for GTP-U IPv4 and v6 PSC (PDU Session Container) extended headers.
-- * This differs from GTPU_EH_V(4|6)_FLOW in that it is distinguished by
-- * UL/DL included in the PSC.
-- * There are differences in the data included based on Downlink/Uplink,
-- * and can be used to distinguish packets.
-- * The functions described so far are useful when you want to
-- * handle communication from the mobile network in UPF, PGW, etc.
-- */
--#define GTPU_UL_V4_FLOW 0x1b	/* hash only */
--#define GTPU_UL_V6_FLOW 0x1c	/* hash only */
--#define GTPU_DL_V4_FLOW 0x1d	/* hash only */
--#define GTPU_DL_V6_FLOW 0x1e	/* hash only */
-+enum {
-+	/* L2-L4 network traffic flow types */
-+	TCP_V4_FLOW	= 0x01,	/* hash or spec (tcp_ip4_spec) */
-+	UDP_V4_FLOW	= 0x02,	/* hash or spec (udp_ip4_spec) */
-+	SCTP_V4_FLOW	= 0x03,	/* hash or spec (sctp_ip4_spec) */
-+	AH_ESP_V4_FLOW	= 0x04,	/* hash only */
-+	TCP_V6_FLOW	= 0x05,	/* hash or spec (tcp_ip6_spec; nfc only) */
-+	UDP_V6_FLOW	= 0x06,	/* hash or spec (udp_ip6_spec; nfc only) */
-+	SCTP_V6_FLOW	= 0x07,	/* hash or spec (sctp_ip6_spec; nfc only) */
-+	AH_ESP_V6_FLOW	= 0x08,	/* hash only */
-+	AH_V4_FLOW	= 0x09,	/* hash or spec (ah_ip4_spec) */
-+	ESP_V4_FLOW	= 0x0a,	/* hash or spec (esp_ip4_spec) */
-+	AH_V6_FLOW	= 0x0b,	/* hash or spec (ah_ip6_spec; nfc only) */
-+	ESP_V6_FLOW	= 0x0c,	/* hash or spec (esp_ip6_spec; nfc only) */
-+	IPV4_USER_FLOW	= 0x0d,	/* spec only (usr_ip4_spec) */
-+	IP_USER_FLOW	= IPV4_USER_FLOW,
-+	IPV6_USER_FLOW	= 0x0e, /* spec only (usr_ip6_spec; nfc only) */
-+	IPV4_FLOW	= 0x10, /* hash only */
-+	IPV6_FLOW	= 0x11, /* hash only */
-+	ETHER_FLOW	= 0x12, /* spec only (ether_spec) */
-+
-+	/* Used for GTP-U IPv4 and IPv6.
-+	 * The format of GTP packets only includes
-+	 * elements such as TEID and GTP version.
-+	 * It is primarily intended for data communication of the UE.
-+	 */
-+	GTPU_V4_FLOW	= 0x13,	/* hash only */
-+	GTPU_V6_FLOW	= 0x14,	/* hash only */
-+
-+	/* Use for GTP-C IPv4 and v6.
-+	 * The format of these GTP packets does not include TEID.
-+	 * Primarily expected to be used for communication
-+	 * to create sessions for UE data communication,
-+	 * commonly referred to as CSR (Create Session Request).
-+	 */
-+	GTPC_V4_FLOW	= 0x15,	/* hash only */
-+	GTPC_V6_FLOW	= 0x16,	/* hash only */
-+
-+	/* Use for GTP-C IPv4 and v6.
-+	 * Unlike GTPC_V4_FLOW, the format of these GTP packets includes TEID.
-+	 * After session creation, it becomes this packet.
-+	 * This is mainly used for requests to realize UE handover.
-+	 */
-+	GTPC_TEID_V4_FLOW	= 0x17,	/* hash only */
-+	GTPC_TEID_V6_FLOW	= 0x18,	/* hash only */
-+
-+	/* Use for GTP-U and extended headers for the PSC (PDU Session Container).
-+	 * The format of these GTP packets includes TEID and QFI.
-+	 * In 5G communication using UPF (User Plane Function),
-+	 * data communication with this extended header is performed.
-+	 */
-+	GTPU_EH_V4_FLOW	= 0x19,	/* hash only */
-+	GTPU_EH_V6_FLOW	= 0x1a,	/* hash only */
-+
-+	/* Use for GTP-U IPv4 and v6 PSC (PDU Session Container) extended headers.
-+	 * This differs from GTPU_EH_V(4|6)_FLOW in that it is distinguished by
-+	 * UL/DL included in the PSC.
-+	 * There are differences in the data included based on Downlink/Uplink,
-+	 * and can be used to distinguish packets.
-+	 * The functions described so far are useful when you want to
-+	 * handle communication from the mobile network in UPF, PGW, etc.
-+	 */
-+	GTPU_UL_V4_FLOW	= 0x1b,	/* hash only */
-+	GTPU_UL_V6_FLOW	= 0x1c,	/* hash only */
-+	GTPU_DL_V4_FLOW	= 0x1d,	/* hash only */
-+	GTPU_DL_V6_FLOW	= 0x1e,	/* hash only */
-+
-+	__FLOW_TYPE_COUNT,
-+};
- 
- /* Flag to enable additional fields in struct ethtool_rx_flow_spec */
- #define	FLOW_EXT	0x80000000
-diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
-index a2b5815d89..d8b2fd67e1 100644
---- a/include/standard-headers/linux/fuse.h
-+++ b/include/standard-headers/linux/fuse.h
-@@ -232,6 +232,9 @@
-  *
-  *  7.43
-  *  - add FUSE_REQUEST_TIMEOUT
-+ *
-+ *  7.44
-+ *  - add FUSE_NOTIFY_INC_EPOCH
-  */
- 
- #ifndef _LINUX_FUSE_H
-@@ -263,7 +266,7 @@
- #define FUSE_KERNEL_VERSION 7
- 
- /** Minor version number of this interface */
--#define FUSE_KERNEL_MINOR_VERSION 43
-+#define FUSE_KERNEL_MINOR_VERSION 44
- 
- /** The node ID of the root inode */
- #define FUSE_ROOT_ID 1
-@@ -667,6 +670,7 @@ enum fuse_notify_code {
- 	FUSE_NOTIFY_RETRIEVE = 5,
- 	FUSE_NOTIFY_DELETE = 6,
- 	FUSE_NOTIFY_RESEND = 7,
-+	FUSE_NOTIFY_INC_EPOCH = 8,
- 	FUSE_NOTIFY_CODE_MAX,
- };
- 
-diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
-index 09ba0ad878..a82ff795e0 100644
---- a/include/standard-headers/linux/input-event-codes.h
-+++ b/include/standard-headers/linux/input-event-codes.h
-@@ -925,7 +925,8 @@
- #define SW_MUTE_DEVICE		0x0e  /* set = device disabled */
- #define SW_PEN_INSERTED		0x0f  /* set = pen inserted */
- #define SW_MACHINE_COVER	0x10  /* set = cover closed */
--#define SW_MAX_			0x10
-+#define SW_USB_INSERT		0x11  /* set = USB audio device connected */
-+#define SW_MAX_			0x11
- #define SW_CNT			(SW_MAX_+1)
- 
- /*
-diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
-index ba326710f9..a3a3e942de 100644
---- a/include/standard-headers/linux/pci_regs.h
-+++ b/include/standard-headers/linux/pci_regs.h
-@@ -750,7 +750,8 @@
- #define PCI_EXT_CAP_ID_NPEM	0x29	/* Native PCIe Enclosure Management */
- #define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
- #define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
--#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
-+#define PCI_EXT_CAP_ID_PL_64GT	0x31	/* Physical Layer 64.0 GT/s */
-+#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_PL_64GT
- 
- #define PCI_EXT_CAP_DSN_SIZEOF	12
- #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
-@@ -1144,12 +1145,21 @@
- #define PCI_DLF_CAP		0x04	/* Capabilities Register */
- #define  PCI_DLF_EXCHANGE_ENABLE	0x80000000  /* Data Link Feature Exchange Enable */
- 
-+/* Secondary PCIe Capability 8.0 GT/s */
-+#define PCI_SECPCI_LE_CTRL	0x0c /* Lane Equalization Control Register */
-+
- /* Physical Layer 16.0 GT/s */
- #define PCI_PL_16GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
- #define  PCI_PL_16GT_LE_CTRL_DSP_TX_PRESET_MASK		0x0000000F
- #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
- #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
- 
-+/* Physical Layer 32.0 GT/s */
-+#define PCI_PL_32GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
-+
-+/* Physical Layer 64.0 GT/s */
-+#define PCI_PL_64GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
-+
- /* Native PCIe Enclosure Management */
- #define PCI_NPEM_CAP     0x04 /* NPEM capability register */
- #define  PCI_NPEM_CAP_CAPABLE     0x00000001 /* NPEM Capable */
-diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
-index 6459fdb9fb..00cd3f04af 100644
---- a/include/standard-headers/linux/virtio_gpu.h
-+++ b/include/standard-headers/linux/virtio_gpu.h
-@@ -309,8 +309,9 @@ struct virtio_gpu_cmd_submit {
- 
- #define VIRTIO_GPU_CAPSET_VIRGL 1
- #define VIRTIO_GPU_CAPSET_VIRGL2 2
--/* 3 is reserved for gfxstream */
-+#define VIRTIO_GPU_CAPSET_GFXSTREAM_VULKAN 3
- #define VIRTIO_GPU_CAPSET_VENUS 4
-+#define VIRTIO_GPU_CAPSET_CROSS_DOMAIN 5
- #define VIRTIO_GPU_CAPSET_DRM 6
- 
- /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
-diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
-index 91fec6f502..09e964e6ee 100644
---- a/include/standard-headers/linux/virtio_pci.h
-+++ b/include/standard-headers/linux/virtio_pci.h
-@@ -246,6 +246,7 @@ struct virtio_pci_cfg_cap {
- #define VIRTIO_ADMIN_CMD_LIST_USE	0x1
- 
- /* Admin command group type. */
-+#define VIRTIO_ADMIN_GROUP_TYPE_SELF	0x0
- #define VIRTIO_ADMIN_GROUP_TYPE_SRIOV	0x1
- 
- /* Transitional device admin command. */
-diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
-index 4e6aff08df..f4d9baafa1 100644
---- a/linux-headers/asm-arm64/kvm.h
-+++ b/linux-headers/asm-arm64/kvm.h
-@@ -419,10 +419,11 @@ enum {
- 
- /* Device Control API on vcpu fd */
- #define KVM_ARM_VCPU_PMU_V3_CTRL	0
--#define   KVM_ARM_VCPU_PMU_V3_IRQ	0
--#define   KVM_ARM_VCPU_PMU_V3_INIT	1
--#define   KVM_ARM_VCPU_PMU_V3_FILTER	2
--#define   KVM_ARM_VCPU_PMU_V3_SET_PMU	3
-+#define   KVM_ARM_VCPU_PMU_V3_IRQ		0
-+#define   KVM_ARM_VCPU_PMU_V3_INIT		1
-+#define   KVM_ARM_VCPU_PMU_V3_FILTER		2
-+#define   KVM_ARM_VCPU_PMU_V3_SET_PMU		3
-+#define   KVM_ARM_VCPU_PMU_V3_SET_NR_COUNTERS	4
- #define KVM_ARM_VCPU_TIMER_CTRL		1
- #define   KVM_ARM_VCPU_TIMER_IRQ_VTIMER		0
- #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
-diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
-index 7fb57ccb2a..cd275ae76d 100644
---- a/linux-headers/asm-x86/kvm.h
-+++ b/linux-headers/asm-x86/kvm.h
-@@ -843,6 +843,7 @@ struct kvm_sev_snp_launch_start {
- };
- 
- /* Kept in sync with firmware values for simplicity. */
-+#define KVM_SEV_PAGE_TYPE_INVALID		0x0
- #define KVM_SEV_SNP_PAGE_TYPE_NORMAL		0x1
- #define KVM_SEV_SNP_PAGE_TYPE_ZERO		0x3
- #define KVM_SEV_SNP_PAGE_TYPE_UNMEASURED	0x4
-diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
-index 58596d18f4..9243f38975 100644
---- a/linux-headers/linux/bits.h
-+++ b/linux-headers/linux/bits.h
-@@ -4,9 +4,9 @@
- #ifndef _LINUX_BITS_H
- #define _LINUX_BITS_H
- 
--#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))
-+#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
- 
--#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
-+#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
- 
- #define __GENMASK_U128(h, l) \
- 	((_BIT128((h)) << 1) - (_BIT128(l)))
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
-index 99cc82a275..0690743944 100644
---- a/linux-headers/linux/kvm.h
-+++ b/linux-headers/linux/kvm.h
-@@ -178,6 +178,7 @@ struct kvm_xen_exit {
- #define KVM_EXIT_NOTIFY           37
- #define KVM_EXIT_LOONGARCH_IOCSR  38
- #define KVM_EXIT_MEMORY_FAULT     39
-+#define KVM_EXIT_TDX              40
- 
- /* For KVM_EXIT_INTERNAL_ERROR */
- /* Emulate instruction failed. */
-@@ -439,6 +440,27 @@ struct kvm_run {
- 			__u64 gpa;
- 			__u64 size;
- 		} memory_fault;
-+		/* KVM_EXIT_TDX */
-+		struct {
-+			__u64 flags;
-+			__u64 nr;
-+			union {
-+				struct {
-+					__u64 ret;
-+					__u64 data[5];
-+				} unknown;
-+				struct {
-+					__u64 ret;
-+					__u64 gpa;
-+					__u64 size;
-+				} get_quote;
-+				struct {
-+					__u64 ret;
-+					__u64 leaf;
-+					__u64 r11, r12, r13, r14;
-+				} get_tdvmcall_info;
-+			};
-+		} tdx;
- 		/* Fix the size of the union. */
- 		char padding[256];
- 	};
-@@ -923,6 +945,9 @@ struct kvm_enable_cap {
- #define KVM_CAP_X86_APIC_BUS_CYCLES_NS 237
- #define KVM_CAP_X86_GUEST_MODE 238
- #define KVM_CAP_ARM_WRITABLE_IMP_ID_REGS 239
-+#define KVM_CAP_ARM_EL2 240
-+#define KVM_CAP_ARM_EL2_E2H0 241
-+#define KVM_CAP_RISCV_MP_STATE_RESET 242
- 
- struct kvm_irq_routing_irqchip {
- 	__u32 irqchip;
-diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
-index b95dd84eef..d4b3e2ae13 100644
---- a/linux-headers/linux/vhost.h
-+++ b/linux-headers/linux/vhost.h
-@@ -28,10 +28,10 @@
- 
- /* Set current process as the (exclusive) owner of this file descriptor.  This
-  * must be called before any other vhost command.  Further calls to
-- * VHOST_OWNER_SET fail until VHOST_OWNER_RESET is called. */
-+ * VHOST_SET_OWNER fail until VHOST_RESET_OWNER is called. */
- #define VHOST_SET_OWNER _IO(VHOST_VIRTIO, 0x01)
- /* Give up ownership, and reset the device to default values.
-- * Allows subsequent call to VHOST_OWNER_SET to succeed. */
-+ * Allows subsequent call to VHOST_SET_OWNER to succeed. */
- #define VHOST_RESET_OWNER _IO(VHOST_VIRTIO, 0x02)
- 
- /* Set up/modify memory layout */
--- 
-2.50.1
-
diff --git a/kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch b/kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch
deleted file mode 100644
index 9c53a87..0000000
--- a/kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 644b9e34d8c764598e663eb983e2d6eca4ed2510 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:33 +0200
-Subject: [PATCH 11/57] util/qemu-sockets: Add support for keep-alive flag to
- passive sockets
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/7] a8ec1996262b2bb657b8fe2e72c9045faee0a64c (JurajMarcin/centos-src-qemu-kvm)
-
-Commit aec21d3175 (qapi: Add InetSocketAddress member keep-alive)
-introduces the keep-alive flag, which enables the SO_KEEPALIVE socket
-option, but only on client-side sockets. However, this option is also
-useful for server-side sockets, so they can check if a client is still
-reachable or drop the connection otherwise.
-
-This patch enables the SO_KEEPALIVE socket option on passive server-side
-sockets if the keep-alive flag is enabled. This socket option is then
-inherited by active server-side sockets communicating with connected
-clients.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit 00064705ed1f3943d3634be25da434466c87e7d5)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- qapi/sockets.json   | 4 ++--
- util/qemu-sockets.c | 9 +++------
- 2 files changed, 5 insertions(+), 8 deletions(-)
-
-diff --git a/qapi/sockets.json b/qapi/sockets.json
-index 6a95023315..62797cd027 100644
---- a/qapi/sockets.json
-+++ b/qapi/sockets.json
-@@ -56,8 +56,8 @@
- # @ipv6: whether to accept IPv6 addresses, default try both IPv4 and
- #     IPv6
- #
--# @keep-alive: enable keep-alive when connecting to this socket.  Not
--#     supported for passive sockets.  (Since 4.2)
-+# @keep-alive: enable keep-alive when connecting to/listening on this socket.
-+#     (Since 4.2, not supported for listening sockets until 10.1)
- #
- # @mptcp: enable multi-path TCP.  (Since 6.1)
- #
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index 631d0c4023..8fc1f86145 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -236,12 +236,6 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
-     int saved_errno = 0;
-     bool socket_created = false;
- 
--    if (saddr->keep_alive) {
--        error_setg(errp, "keep-alive option is not supported for passive "
--                   "sockets");
--        return -1;
--    }
--
-     memset(&ai,0, sizeof(ai));
-     ai.ai_flags = AI_PASSIVE;
-     if (saddr->has_numeric && saddr->numeric) {
-@@ -349,6 +343,9 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
-                 goto fail;
-             }
-             /* We have a listening socket */
-+            if (inet_set_sockopts(slisten, saddr, errp) < 0) {
-+                goto fail;
-+            }
-             freeaddrinfo(res);
-             return slisten;
-         }
--- 
-2.39.3
-
diff --git a/kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch b/kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch
deleted file mode 100644
index 8839085..0000000
--- a/kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch
+++ /dev/null
@@ -1,314 +0,0 @@
-From 3e9458cd71f909474c1dd051f43fd3fbef8d53fd Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:35 +0200
-Subject: [PATCH 13/57] util/qemu-sockets: Introduce inet socket options
- controlling TCP keep-alive
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [6/7] 3861e7874d5952c53a5020c123b3b2e632149008 (JurajMarcin/centos-src-qemu-kvm)
-
-With the default TCP stack configuration, it could be even 2 hours
-before the connection times out due to the other side not being
-reachable. However, in some cases, the application needs to be aware of
-a connection issue much sooner.
-
-This is the case, for example, for postcopy live migration. If there is
-no traffic from the migration destination guest (server-side) to the
-migration source guest (client-side), the destination keeps waiting for
-pages indefinitely and does not switch to the postcopy-paused state.
-This can happen, for example, if the destination QEMU instance is
-started with the '-S' command line option and the machine is not started
-yet, or if the machine is idle and produces no new page faults for
-not-yet-migrated pages.
-
-This patch introduces new inet socket parameters that control count,
-idle period, and interval of TCP keep-alive packets before the
-connection is considered broken. These parameters are available on
-systems where the respective TCP socket options are defined, that
-includes Linux, Windows, macOS, but not OpenBSD. Additionally, macOS
-defines TCP_KEEPIDLE as TCP_KEEPALIVE instead, so the patch supplies its
-own definition.
-
-The default value for all is 0, which means the system configuration is
-used.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit 1bd4237cb1095d71c16afad3ce93b4a1e453173e)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- meson.build                    | 30 +++++++++++++
- qapi/sockets.json              | 19 ++++++++
- tests/unit/test-util-sockets.c | 39 +++++++++++++++++
- util/qemu-sockets.c            | 80 ++++++++++++++++++++++++++++++++++
- 4 files changed, 168 insertions(+)
-
-diff --git a/meson.build b/meson.build
-index 5bb2b757c3..c4539b66c5 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2581,6 +2581,36 @@ config_host_data.set('HAVE_OPTRESET',
-                      cc.has_header_symbol('getopt.h', 'optreset'))
- config_host_data.set('HAVE_IPPROTO_MPTCP',
-                      cc.has_header_symbol('netinet/in.h', 'IPPROTO_MPTCP'))
-+config_host_data.set('HAVE_TCP_KEEPCNT',
-+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPCNT') or
-+                     cc.compiles('''
-+                     #include <ws2tcpip.h>
-+                     #ifndef TCP_KEEPCNT
-+                     #error
-+                     #endif
-+                     int main(void) { return 0; }''',
-+                     name: 'Win32 TCP_KEEPCNT'))
-+# On Darwin TCP_KEEPIDLE is available under different name, TCP_KEEPALIVE.
-+# https://github.com/apple/darwin-xnu/blob/xnu-4570.1.46/bsd/man/man4/tcp.4#L172
-+config_host_data.set('HAVE_TCP_KEEPIDLE',
-+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPIDLE') or
-+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPALIVE') or
-+                     cc.compiles('''
-+                     #include <ws2tcpip.h>
-+                     #ifndef TCP_KEEPIDLE
-+                     #error
-+                     #endif
-+                     int main(void) { return 0; }''',
-+                     name: 'Win32 TCP_KEEPIDLE'))
-+config_host_data.set('HAVE_TCP_KEEPINTVL',
-+                     cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPINTVL') or
-+                     cc.compiles('''
-+                     #include <ws2tcpip.h>
-+                     #ifndef TCP_KEEPINTVL
-+                     #error
-+                     #endif
-+                     int main(void) { return 0; }''',
-+                     name: 'Win32 TCP_KEEPINTVL'))
- 
- # has_member
- config_host_data.set('HAVE_SIGEV_NOTIFY_THREAD_ID',
-diff --git a/qapi/sockets.json b/qapi/sockets.json
-index 62797cd027..f9f559daba 100644
---- a/qapi/sockets.json
-+++ b/qapi/sockets.json
-@@ -59,6 +59,22 @@
- # @keep-alive: enable keep-alive when connecting to/listening on this socket.
- #     (Since 4.2, not supported for listening sockets until 10.1)
- #
-+# @keep-alive-count: number of keep-alive packets sent before the connection is
-+#     closed.  Only supported for TCP sockets on systems where TCP_KEEPCNT
-+#     socket option is defined (this includes Linux, Windows, macOS, FreeBSD,
-+#     but not OpenBSD).  When set to 0, system setting is used.  (Since 10.1)
-+#
-+# @keep-alive-idle: time in seconds the connection needs to be idle before
-+#     sending a keepalive packet.  Only supported for TCP sockets on systems
-+#     where TCP_KEEPIDLE socket option is defined (this includes Linux,
-+#     Windows, macOS, FreeBSD, but not OpenBSD).  When set to 0, system setting
-+#     is used.  (Since 10.1)
-+#
-+# @keep-alive-interval: time in seconds between keep-alive packets.  Only
-+#     supported for TCP sockets on systems where TCP_KEEPINTVL is defined (this
-+#     includes Linux, Windows, macOS, FreeBSD, but not OpenBSD).  When set to
-+#     0, system setting is used.  (Since 10.1)
-+#
- # @mptcp: enable multi-path TCP.  (Since 6.1)
- #
- # Since: 1.3
-@@ -71,6 +87,9 @@
-     '*ipv4': 'bool',
-     '*ipv6': 'bool',
-     '*keep-alive': 'bool',
-+    '*keep-alive-count': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPCNT' },
-+    '*keep-alive-idle': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPIDLE' },
-+    '*keep-alive-interval': { 'type': 'uint32', 'if': 'HAVE_TCP_KEEPINTVL' },
-     '*mptcp': { 'type': 'bool', 'if': 'HAVE_IPPROTO_MPTCP' } } }
- 
- ##
-diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
-index 9e39b92e7c..8492f4d68f 100644
---- a/tests/unit/test-util-sockets.c
-+++ b/tests/unit/test-util-sockets.c
-@@ -359,6 +359,24 @@ static void inet_parse_test_helper(const char *str,
-         g_assert_cmpint(addr.ipv6, ==, exp_addr->ipv6);
-         g_assert_cmpint(addr.has_keep_alive, ==, exp_addr->has_keep_alive);
-         g_assert_cmpint(addr.keep_alive, ==, exp_addr->keep_alive);
-+#ifdef HAVE_TCP_KEEPCNT
-+        g_assert_cmpint(addr.has_keep_alive_count, ==,
-+                        exp_addr->has_keep_alive_count);
-+        g_assert_cmpint(addr.keep_alive_count, ==,
-+                        exp_addr->keep_alive_count);
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+        g_assert_cmpint(addr.has_keep_alive_idle, ==,
-+                        exp_addr->has_keep_alive_idle);
-+        g_assert_cmpint(addr.keep_alive_idle, ==,
-+                        exp_addr->keep_alive_idle);
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+        g_assert_cmpint(addr.has_keep_alive_interval, ==,
-+                        exp_addr->has_keep_alive_interval);
-+        g_assert_cmpint(addr.keep_alive_interval, ==,
-+                        exp_addr->keep_alive_interval);
-+#endif
- #ifdef HAVE_IPPROTO_MPTCP
-         g_assert_cmpint(addr.has_mptcp, ==, exp_addr->has_mptcp);
-         g_assert_cmpint(addr.mptcp, ==, exp_addr->mptcp);
-@@ -460,6 +478,18 @@ static void test_inet_parse_all_options_good(void)
-         .ipv6 = true,
-         .has_keep_alive = true,
-         .keep_alive = true,
-+#ifdef HAVE_TCP_KEEPCNT
-+        .has_keep_alive_count = true,
-+        .keep_alive_count = 10,
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+        .has_keep_alive_idle = true,
-+        .keep_alive_idle = 60,
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+        .has_keep_alive_interval = true,
-+        .keep_alive_interval = 30,
-+#endif
- #ifdef HAVE_IPPROTO_MPTCP
-         .has_mptcp = true,
-         .mptcp = false,
-@@ -467,6 +497,15 @@ static void test_inet_parse_all_options_good(void)
-     };
-     inet_parse_test_helper(
-         "[::1]:5000,numeric=on,to=5006,ipv4=off,ipv6=on,keep-alive=on"
-+#ifdef HAVE_TCP_KEEPCNT
-+        ",keep-alive-count=10"
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+        ",keep-alive-idle=60"
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+        ",keep-alive-interval=30"
-+#endif
- #ifdef HAVE_IPPROTO_MPTCP
-         ",mptcp=off"
- #endif
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index 8017124c74..ef0a137bd2 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -45,6 +45,14 @@
- # define AI_NUMERICSERV 0
- #endif
- 
-+/*
-+ * On macOS TCP_KEEPIDLE is available under a different name, TCP_KEEPALIVE.
-+ * https://github.com/apple/darwin-xnu/blob/xnu-4570.1.46/bsd/man/man4/tcp.4#L172
-+ */
-+#if defined(TCP_KEEPALIVE) && !defined(TCP_KEEPIDLE)
-+# define TCP_KEEPIDLE TCP_KEEPALIVE
-+#endif
-+
- 
- static int inet_getport(struct addrinfo *e)
- {
-@@ -218,6 +226,42 @@ static int inet_set_sockopts(int sock, InetSocketAddress *saddr, Error **errp)
-                              "Unable to set keep-alive option on socket");
-             return -1;
-         }
-+#ifdef HAVE_TCP_KEEPCNT
-+        if (saddr->has_keep_alive_count && saddr->keep_alive_count) {
-+            int keep_count = saddr->keep_alive_count;
-+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPCNT, &keep_count,
-+                             sizeof(keep_count));
-+            if (ret < 0) {
-+                error_setg_errno(errp, errno,
-+                                 "Unable to set TCP keep-alive count option on socket");
-+                return -1;
-+            }
-+        }
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+        if (saddr->has_keep_alive_idle && saddr->keep_alive_idle) {
-+            int keep_idle = saddr->keep_alive_idle;
-+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPIDLE, &keep_idle,
-+                             sizeof(keep_idle));
-+            if (ret < 0) {
-+                error_setg_errno(errp, errno,
-+                                 "Unable to set TCP keep-alive idle option on socket");
-+                return -1;
-+            }
-+        }
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+        if (saddr->has_keep_alive_interval && saddr->keep_alive_interval) {
-+            int keep_interval = saddr->keep_alive_interval;
-+            ret = setsockopt(sock, IPPROTO_TCP, TCP_KEEPINTVL, &keep_interval,
-+                             sizeof(keep_interval));
-+            if (ret < 0) {
-+                error_setg_errno(errp, errno,
-+                                 "Unable to set TCP keep-alive interval option on socket");
-+                return -1;
-+            }
-+        }
-+#endif
-     }
-     return 0;
- }
-@@ -631,6 +675,24 @@ static QemuOptsList inet_opts = {
-             .name = "keep-alive",
-             .type = QEMU_OPT_BOOL,
-         },
-+#ifdef HAVE_TCP_KEEPCNT
-+        {
-+            .name = "keep-alive-count",
-+            .type = QEMU_OPT_NUMBER,
-+        },
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+        {
-+            .name = "keep-alive-idle",
-+            .type = QEMU_OPT_NUMBER,
-+        },
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+        {
-+            .name = "keep-alive-interval",
-+            .type = QEMU_OPT_NUMBER,
-+        },
-+#endif
- #ifdef HAVE_IPPROTO_MPTCP
-         {
-             .name = "mptcp",
-@@ -696,6 +758,24 @@ int inet_parse(InetSocketAddress *addr, const char *str, Error **errp)
-         addr->has_keep_alive = true;
-         addr->keep_alive = qemu_opt_get_bool(opts, "keep-alive", false);
-     }
-+#ifdef HAVE_TCP_KEEPCNT
-+    if (qemu_opt_find(opts, "keep-alive-count")) {
-+        addr->has_keep_alive_count = true;
-+        addr->keep_alive_count = qemu_opt_get_number(opts, "keep-alive-count", 0);
-+    }
-+#endif
-+#ifdef HAVE_TCP_KEEPIDLE
-+    if (qemu_opt_find(opts, "keep-alive-idle")) {
-+        addr->has_keep_alive_idle = true;
-+        addr->keep_alive_idle = qemu_opt_get_number(opts, "keep-alive-idle", 0);
-+    }
-+#endif
-+#ifdef HAVE_TCP_KEEPINTVL
-+    if (qemu_opt_find(opts, "keep-alive-interval")) {
-+        addr->has_keep_alive_interval = true;
-+        addr->keep_alive_interval = qemu_opt_get_number(opts, "keep-alive-interval", 0);
-+    }
-+#endif
- #ifdef HAVE_IPPROTO_MPTCP
-     if (qemu_opt_find(opts, "mptcp")) {
-         addr->has_mptcp = true;
--- 
-2.39.3
-
diff --git a/kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch b/kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch
deleted file mode 100644
index e533fa2..0000000
--- a/kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch
+++ /dev/null
@@ -1,461 +0,0 @@
-From d2155b6fe1f200a588dd5e95d7587e96109da989 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:34 +0200
-Subject: [PATCH 12/57] util/qemu-sockets: Refactor inet_parse() to use
- QemuOpts
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [5/7] 7fd97ed112c6259928d94595c2ae23fe1208621e (JurajMarcin/centos-src-qemu-kvm)
-
-Currently, the inet address parser cannot handle multiple options where
-one is prefixed with the name of the other. For example, with the
-'keep-alive-idle' option added, the current parser cannot parse
-'127.0.0.1:5000,keep-alive-idle=60,keep-alive' correctly. Instead, it
-fails with "error parsing 'keep-alive' flag '-idle=60,keep-alive'".
-
-To resolve these issues, this patch rewrites the inet address parsing
-using the QemuOpts parser, which the inet_parse_flag() function tries to
-mimic. This new parser supports all previously supported options and on
-top of that the 'numeric' flag is now also supported. The only
-difference is, the new parser produces an error if an unknown option is
-passed, instead of silently ignoring it.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit 316e8ee8d614f049bfae697570a5e62af450491c)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- tests/unit/test-util-sockets.c | 196 +++++++++++++++++++++++++++++++++
- util/qemu-sockets.c            | 158 +++++++++++++-------------
- 2 files changed, 270 insertions(+), 84 deletions(-)
-
-diff --git a/tests/unit/test-util-sockets.c b/tests/unit/test-util-sockets.c
-index 4c9dd0b271..9e39b92e7c 100644
---- a/tests/unit/test-util-sockets.c
-+++ b/tests/unit/test-util-sockets.c
-@@ -332,6 +332,177 @@ static void test_socket_unix_abstract(void)
- 
- #endif  /* CONFIG_LINUX */
- 
-+static void inet_parse_test_helper(const char *str,
-+                                   InetSocketAddress *exp_addr, bool success)
-+{
-+    InetSocketAddress addr;
-+    Error *error = NULL;
-+
-+    int rc = inet_parse(&addr, str, &error);
-+
-+    if (success) {
-+        g_assert_cmpint(rc, ==, 0);
-+    } else {
-+        g_assert_cmpint(rc, <, 0);
-+    }
-+    if (exp_addr != NULL) {
-+        g_assert_cmpstr(addr.host, ==, exp_addr->host);
-+        g_assert_cmpstr(addr.port, ==, exp_addr->port);
-+        /* Own members: */
-+        g_assert_cmpint(addr.has_numeric, ==, exp_addr->has_numeric);
-+        g_assert_cmpint(addr.numeric, ==, exp_addr->numeric);
-+        g_assert_cmpint(addr.has_to, ==, exp_addr->has_to);
-+        g_assert_cmpint(addr.to, ==, exp_addr->to);
-+        g_assert_cmpint(addr.has_ipv4, ==, exp_addr->has_ipv4);
-+        g_assert_cmpint(addr.ipv4, ==, exp_addr->ipv4);
-+        g_assert_cmpint(addr.has_ipv6, ==, exp_addr->has_ipv6);
-+        g_assert_cmpint(addr.ipv6, ==, exp_addr->ipv6);
-+        g_assert_cmpint(addr.has_keep_alive, ==, exp_addr->has_keep_alive);
-+        g_assert_cmpint(addr.keep_alive, ==, exp_addr->keep_alive);
-+#ifdef HAVE_IPPROTO_MPTCP
-+        g_assert_cmpint(addr.has_mptcp, ==, exp_addr->has_mptcp);
-+        g_assert_cmpint(addr.mptcp, ==, exp_addr->mptcp);
-+#endif
-+    }
-+
-+    g_free(addr.host);
-+    g_free(addr.port);
-+}
-+
-+static void test_inet_parse_nohost_good(void)
-+{
-+    char host[] = "";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+    };
-+    inet_parse_test_helper(":5000", &exp_addr, true);
-+}
-+
-+static void test_inet_parse_empty_bad(void)
-+{
-+    inet_parse_test_helper("", NULL, false);
-+}
-+
-+static void test_inet_parse_only_colon_bad(void)
-+{
-+    inet_parse_test_helper(":", NULL, false);
-+}
-+
-+static void test_inet_parse_ipv4_good(void)
-+{
-+    char host[] = "127.0.0.1";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+    };
-+    inet_parse_test_helper("127.0.0.1:5000", &exp_addr, true);
-+}
-+
-+static void test_inet_parse_ipv4_noport_bad(void)
-+{
-+    inet_parse_test_helper("127.0.0.1", NULL, false);
-+}
-+
-+static void test_inet_parse_ipv6_good(void)
-+{
-+    char host[] = "::1";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+    };
-+    inet_parse_test_helper("[::1]:5000", &exp_addr, true);
-+}
-+
-+static void test_inet_parse_ipv6_noend_bad(void)
-+{
-+    inet_parse_test_helper("[::1", NULL, false);
-+}
-+
-+static void test_inet_parse_ipv6_noport_bad(void)
-+{
-+    inet_parse_test_helper("[::1]:", NULL, false);
-+}
-+
-+static void test_inet_parse_ipv6_empty_bad(void)
-+{
-+    inet_parse_test_helper("[]:5000", NULL, false);
-+}
-+
-+static void test_inet_parse_hostname_good(void)
-+{
-+    char host[] = "localhost";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+    };
-+    inet_parse_test_helper("localhost:5000", &exp_addr, true);
-+}
-+
-+static void test_inet_parse_all_options_good(void)
-+{
-+    char host[] = "::1";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+        .has_numeric = true,
-+        .numeric =  true,
-+        .has_to = true,
-+        .to = 5006,
-+        .has_ipv4 = true,
-+        .ipv4 = false,
-+        .has_ipv6 = true,
-+        .ipv6 = true,
-+        .has_keep_alive = true,
-+        .keep_alive = true,
-+#ifdef HAVE_IPPROTO_MPTCP
-+        .has_mptcp = true,
-+        .mptcp = false,
-+#endif
-+    };
-+    inet_parse_test_helper(
-+        "[::1]:5000,numeric=on,to=5006,ipv4=off,ipv6=on,keep-alive=on"
-+#ifdef HAVE_IPPROTO_MPTCP
-+        ",mptcp=off"
-+#endif
-+        , &exp_addr, true);
-+}
-+
-+static void test_inet_parse_all_implicit_bool_good(void)
-+{
-+    char host[] = "::1";
-+    char port[] = "5000";
-+    InetSocketAddress exp_addr = {
-+        .host = host,
-+        .port = port,
-+        .has_numeric = true,
-+        .numeric =  true,
-+        .has_to = true,
-+        .to = 5006,
-+        .has_ipv4 = true,
-+        .ipv4 = true,
-+        .has_ipv6 = true,
-+        .ipv6 = true,
-+        .has_keep_alive = true,
-+        .keep_alive = true,
-+#ifdef HAVE_IPPROTO_MPTCP
-+        .has_mptcp = true,
-+        .mptcp = true,
-+#endif
-+    };
-+    inet_parse_test_helper(
-+        "[::1]:5000,numeric,to=5006,ipv4,ipv6,keep-alive"
-+#ifdef HAVE_IPPROTO_MPTCP
-+        ",mptcp"
-+#endif
-+        , &exp_addr, true);
-+}
-+
- int main(int argc, char **argv)
- {
-     bool has_ipv4, has_ipv6;
-@@ -377,6 +548,31 @@ int main(int argc, char **argv)
-                     test_socket_unix_abstract);
- #endif
- 
-+    g_test_add_func("/util/socket/inet-parse/nohost-good",
-+                    test_inet_parse_nohost_good);
-+    g_test_add_func("/util/socket/inet-parse/empty-bad",
-+                    test_inet_parse_empty_bad);
-+    g_test_add_func("/util/socket/inet-parse/only-colon-bad",
-+                    test_inet_parse_only_colon_bad);
-+    g_test_add_func("/util/socket/inet-parse/ipv4-good",
-+                    test_inet_parse_ipv4_good);
-+    g_test_add_func("/util/socket/inet-parse/ipv4-noport-bad",
-+                    test_inet_parse_ipv4_noport_bad);
-+    g_test_add_func("/util/socket/inet-parse/ipv6-good",
-+                    test_inet_parse_ipv6_good);
-+    g_test_add_func("/util/socket/inet-parse/ipv6-noend-bad",
-+                    test_inet_parse_ipv6_noend_bad);
-+    g_test_add_func("/util/socket/inet-parse/ipv6-noport-bad",
-+                    test_inet_parse_ipv6_noport_bad);
-+    g_test_add_func("/util/socket/inet-parse/ipv6-empty-bad",
-+                    test_inet_parse_ipv6_empty_bad);
-+    g_test_add_func("/util/socket/inet-parse/hostname-good",
-+                    test_inet_parse_hostname_good);
-+    g_test_add_func("/util/socket/inet-parse/all-options-good",
-+                    test_inet_parse_all_options_good);
-+    g_test_add_func("/util/socket/inet-parse/all-bare-bool-good",
-+                    test_inet_parse_all_implicit_bool_good);
-+
- end:
-     return g_test_run();
- }
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index 8fc1f86145..8017124c74 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -30,6 +30,7 @@
- #include "qapi/qobject-input-visitor.h"
- #include "qapi/qobject-output-visitor.h"
- #include "qemu/cutils.h"
-+#include "qemu/option.h"
- #include "trace.h"
- 
- #ifndef AI_ADDRCONFIG
-@@ -601,115 +602,104 @@ err:
-     return -1;
- }
- 
--/* compatibility wrapper */
--static int inet_parse_flag(const char *flagname, const char *optstr, bool *val,
--                           Error **errp)
--{
--    char *end;
--    size_t len;
--
--    end = strstr(optstr, ",");
--    if (end) {
--        if (end[1] == ',') { /* Reject 'ipv6=on,,foo' */
--            error_setg(errp, "error parsing '%s' flag '%s'", flagname, optstr);
--            return -1;
--        }
--        len = end - optstr;
--    } else {
--        len = strlen(optstr);
--    }
--    if (len == 0 || (len == 3 && strncmp(optstr, "=on", len) == 0)) {
--        *val = true;
--    } else if (len == 4 && strncmp(optstr, "=off", len) == 0) {
--        *val = false;
--    } else {
--        error_setg(errp, "error parsing '%s' flag '%s'", flagname, optstr);
--        return -1;
--    }
--    return 0;
--}
-+static QemuOptsList inet_opts = {
-+    .name = "InetSocketAddress",
-+    .head = QTAILQ_HEAD_INITIALIZER(inet_opts.head),
-+    .implied_opt_name = "addr",
-+    .desc = {
-+        {
-+            .name = "addr",
-+            .type = QEMU_OPT_STRING,
-+        },
-+        {
-+            .name = "numeric",
-+            .type = QEMU_OPT_BOOL,
-+        },
-+        {
-+            .name = "to",
-+            .type = QEMU_OPT_NUMBER,
-+        },
-+        {
-+            .name = "ipv4",
-+            .type = QEMU_OPT_BOOL,
-+        },
-+        {
-+            .name = "ipv6",
-+            .type = QEMU_OPT_BOOL,
-+        },
-+        {
-+            .name = "keep-alive",
-+            .type = QEMU_OPT_BOOL,
-+        },
-+#ifdef HAVE_IPPROTO_MPTCP
-+        {
-+            .name = "mptcp",
-+            .type = QEMU_OPT_BOOL,
-+        },
-+#endif
-+        { /* end of list */ }
-+    },
-+};
- 
- int inet_parse(InetSocketAddress *addr, const char *str, Error **errp)
- {
--    const char *optstr, *h;
--    char host[65];
--    char port[33];
--    int to;
--    int pos;
--    char *begin;
--
-+    QemuOpts *opts = qemu_opts_parse(&inet_opts, str, true, errp);
-+    if (!opts) {
-+        return -1;
-+    }
-     memset(addr, 0, sizeof(*addr));
- 
-     /* parse address */
--    if (str[0] == ':') {
--        /* no host given */
--        host[0] = '\0';
--        if (sscanf(str, ":%32[^,]%n", port, &pos) != 1) {
--            error_setg(errp, "error parsing port in address '%s'", str);
--            return -1;
--        }
--    } else if (str[0] == '[') {
-+    const char *addr_str = qemu_opt_get(opts, "addr");
-+    if (!addr_str) {
-+        error_setg(errp, "error parsing address ''");
-+        return -1;
-+    }
-+    if (str[0] == '[') {
-         /* IPv6 addr */
--        if (sscanf(str, "[%64[^]]]:%32[^,]%n", host, port, &pos) != 2) {
--            error_setg(errp, "error parsing IPv6 address '%s'", str);
-+        const char *ip_end = strstr(addr_str, "]:");
-+        if (!ip_end || ip_end - addr_str < 2 || strlen(ip_end) < 3) {
-+            error_setg(errp, "error parsing IPv6 address '%s'", addr_str);
-             return -1;
-         }
-+        addr->host = g_strndup(addr_str + 1, ip_end - addr_str - 1);
-+        addr->port = g_strdup(ip_end + 2);
-     } else {
--        /* hostname or IPv4 addr */
--        if (sscanf(str, "%64[^:]:%32[^,]%n", host, port, &pos) != 2) {
--            error_setg(errp, "error parsing address '%s'", str);
-+        /* no host, hostname or IPv4 addr */
-+        const char *port = strchr(addr_str, ':');
-+        if (!port || strlen(port) < 2) {
-+            error_setg(errp, "error parsing address '%s'", addr_str);
-             return -1;
-         }
-+        addr->host = g_strndup(addr_str, port - addr_str);
-+        addr->port = g_strdup(port + 1);
-     }
- 
--    addr->host = g_strdup(host);
--    addr->port = g_strdup(port);
--
-     /* parse options */
--    optstr = str + pos;
--    h = strstr(optstr, ",to=");
--    if (h) {
--        h += 4;
--        if (sscanf(h, "%d%n", &to, &pos) != 1 ||
--            (h[pos] != '\0' && h[pos] != ',')) {
--            error_setg(errp, "error parsing to= argument");
--            return -1;
--        }
-+    if (qemu_opt_find(opts, "numeric")) {
-+        addr->has_numeric = true,
-+        addr->numeric = qemu_opt_get_bool(opts, "numeric", false);
-+    }
-+    if (qemu_opt_find(opts, "to")) {
-         addr->has_to = true;
--        addr->to = to;
-+        addr->to = qemu_opt_get_number(opts, "to", 0);
-     }
--    begin = strstr(optstr, ",ipv4");
--    if (begin) {
--        if (inet_parse_flag("ipv4", begin + 5, &addr->ipv4, errp) < 0) {
--            return -1;
--        }
-+    if (qemu_opt_find(opts, "ipv4")) {
-         addr->has_ipv4 = true;
-+        addr->ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
-     }
--    begin = strstr(optstr, ",ipv6");
--    if (begin) {
--        if (inet_parse_flag("ipv6", begin + 5, &addr->ipv6, errp) < 0) {
--            return -1;
--        }
-+    if (qemu_opt_find(opts, "ipv6")) {
-         addr->has_ipv6 = true;
-+        addr->ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
-     }
--    begin = strstr(optstr, ",keep-alive");
--    if (begin) {
--        if (inet_parse_flag("keep-alive", begin + strlen(",keep-alive"),
--                            &addr->keep_alive, errp) < 0)
--        {
--            return -1;
--        }
-+    if (qemu_opt_find(opts, "keep-alive")) {
-         addr->has_keep_alive = true;
-+        addr->keep_alive = qemu_opt_get_bool(opts, "keep-alive", false);
-     }
- #ifdef HAVE_IPPROTO_MPTCP
--    begin = strstr(optstr, ",mptcp");
--    if (begin) {
--        if (inet_parse_flag("mptcp", begin + strlen(",mptcp"),
--                            &addr->mptcp, errp) < 0)
--        {
--            return -1;
--        }
-+    if (qemu_opt_find(opts, "mptcp")) {
-         addr->has_mptcp = true;
-+        addr->mptcp = qemu_opt_get_bool(opts, "mptcp", 0);
-     }
- #endif
-     return 0;
--- 
-2.39.3
-
diff --git a/kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch b/kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch
deleted file mode 100644
index 6b95ffb..0000000
--- a/kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From cc7fbd3aabe3be1e2966472a151dc618be02ac4c Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:31 +0200
-Subject: [PATCH 09/57] util/qemu-sockets: Refactor setting client sockopts
- into a separate function
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/7] b9b258d9a21a31ead1dd4488f1f55f1728fa8b41 (JurajMarcin/centos-src-qemu-kvm)
-
-This is done in preparation for enabling the SO_KEEPALIVE support for
-server sockets and adding settings for more TCP keep-alive socket
-options.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit b8b5278aca78be4a1c2e7cbb11c6be176f63706d)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- util/qemu-sockets.c | 29 +++++++++++++++++++----------
- 1 file changed, 19 insertions(+), 10 deletions(-)
-
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index 60c44b2b56..2c0e4883ce 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -205,6 +205,22 @@ static int try_bind(int socket, InetSocketAddress *saddr, struct addrinfo *e)
- #endif
- }
- 
-+static int inet_set_sockopts(int sock, InetSocketAddress *saddr, Error **errp)
-+{
-+    if (saddr->keep_alive) {
-+        int keep_alive = 1;
-+        int ret = setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
-+                             &keep_alive, sizeof(keep_alive));
-+
-+        if (ret < 0) {
-+            error_setg_errno(errp, errno,
-+                             "Unable to set keep-alive option on socket");
-+            return -1;
-+        }
-+    }
-+    return 0;
-+}
-+
- static int inet_listen_saddr(InetSocketAddress *saddr,
-                              int port_offset,
-                              int num,
-@@ -476,16 +492,9 @@ int inet_connect_saddr(InetSocketAddress *saddr, Error **errp)
-         return sock;
-     }
- 
--    if (saddr->keep_alive) {
--        int val = 1;
--        int ret = setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
--                             &val, sizeof(val));
--
--        if (ret < 0) {
--            error_setg_errno(errp, errno, "Unable to set KEEPALIVE");
--            close(sock);
--            return -1;
--        }
-+    if (inet_set_sockopts(sock, saddr, errp) < 0) {
-+        close(sock);
-+        return -1;
-     }
- 
-     return sock;
--- 
-2.39.3
-
diff --git a/kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch b/kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch
deleted file mode 100644
index de5c984..0000000
--- a/kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 17af9176a1fff5af0d4c1bf1beb52228f7fc324d Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 21 May 2025 15:52:32 +0200
-Subject: [PATCH 10/57] util/qemu-sockets: Refactor success and failure paths
- in inet_listen_saddr()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Juraj Marcin <None>
-RH-MergeRequest: 369: util/qemu-sockets: Introduce inet socket options controlling TCP keep-alive
-RH-Jira: RHEL-67104
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/7] 5d5f0e704cdf3454a3c402ea7b130aa42705eb9f (JurajMarcin/centos-src-qemu-kvm)
-
-To get a listening socket, we need to first create a socket, try binding
-it to a certain port, and lastly starting listening to it. Each of these
-operations can fail due to various reasons, one of them being that the
-requested address/port is already in use. In such case, the function
-tries the same process with a new port number.
-
-This patch refactors the port number loop, so the success path is no
-longer buried inside the 'if' statements in the middle of the loop. Now,
-the success path is not nested and ends at the end of the iteration
-after successful socket creation, binding, and listening. In case any of
-the operations fails, it either continues to the next iteration (and the
-next port) or jumps out of the loop to handle the error and exits the
-function.
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-(cherry picked from commit 911e0f2c6e2d00c985affa75ec188c8edcf480f2)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67104
-
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
----
- util/qemu-sockets.c | 51 ++++++++++++++++++++++++---------------------
- 1 file changed, 27 insertions(+), 24 deletions(-)
-
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index 2c0e4883ce..631d0c4023 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -303,11 +303,20 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
-         port_min = inet_getport(e);
-         port_max = saddr->has_to ? saddr->to + port_offset : port_min;
-         for (p = port_min; p <= port_max; p++) {
-+            if (slisten >= 0) {
-+                /*
-+                 * We have a socket we tried with the previous port. It cannot
-+                 * be rebound, we need to close it and create a new one.
-+                 */
-+                close(slisten);
-+                slisten = -1;
-+            }
-             inet_setport(e, p);
- 
-             slisten = create_fast_reuse_socket(e);
-             if (slisten < 0) {
--                /* First time we expect we might fail to create the socket
-+                /*
-+                 * First time we expect we might fail to create the socket
-                  * eg if 'e' has AF_INET6 but ipv6 kmod is not loaded.
-                  * Later iterations should always succeed if first iteration
-                  * worked though, so treat that as fatal.
-@@ -317,40 +326,38 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
-                 } else {
-                     error_setg_errno(errp, errno,
-                                      "Failed to recreate failed listening socket");
--                    goto listen_failed;
-+                    goto fail;
-                 }
-             }
-             socket_created = true;
- 
-             rc = try_bind(slisten, saddr, e);
-             if (rc < 0) {
--                if (errno != EADDRINUSE) {
--                    error_setg_errno(errp, errno, "Failed to bind socket");
--                    goto listen_failed;
--                }
--            } else {
--                if (!listen(slisten, num)) {
--                    goto listen_ok;
-+                if (errno == EADDRINUSE) {
-+                    /* This port is already used, try the next one */
-+                    continue;
-                 }
--                if (errno != EADDRINUSE) {
--                    error_setg_errno(errp, errno, "Failed to listen on socket");
--                    goto listen_failed;
-+                error_setg_errno(errp, errno, "Failed to bind socket");
-+                goto fail;
-+            }
-+            if (listen(slisten, num)) {
-+                if (errno == EADDRINUSE) {
-+                    /* This port is already used, try the next one */
-+                    continue;
-                 }
-+                error_setg_errno(errp, errno, "Failed to listen on socket");
-+                goto fail;
-             }
--            /* Someone else managed to bind to the same port and beat us
--             * to listen on it! Socket semantics does not allow us to
--             * recover from this situation, so we need to recreate the
--             * socket to allow bind attempts for subsequent ports:
--             */
--            close(slisten);
--            slisten = -1;
-+            /* We have a listening socket */
-+            freeaddrinfo(res);
-+            return slisten;
-         }
-     }
-     error_setg_errno(errp, errno,
-                      socket_created ?
-                      "Failed to find an available port" :
-                      "Failed to create a socket");
--listen_failed:
-+fail:
-     saved_errno = errno;
-     if (slisten >= 0) {
-         close(slisten);
-@@ -358,10 +365,6 @@ listen_failed:
-     freeaddrinfo(res);
-     errno = saved_errno;
-     return -1;
--
--listen_ok:
--    freeaddrinfo(res);
--    return slisten;
- }
- 
- #ifdef _WIN32
--- 
-2.39.3
-
diff --git a/kvm-vfio-container-Fix-container-object-destruction.patch b/kvm-vfio-container-Fix-container-object-destruction.patch
deleted file mode 100644
index f82a592..0000000
--- a/kvm-vfio-container-Fix-container-object-destruction.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 18d64190c2bb43d42e02ea250ffe40b8ba4970f3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Mon, 18 Nov 2024 16:34:30 +0100
-Subject: [PATCH 1/2] vfio/container: Fix container object destruction
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 293: vfio/container: Fix container object destruction
-RH-Jira: RHEL-67935
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [1/1] cddda9554b1a858a7265d4ed9b81fdac46772a2c (clegoate/qemu-kvm-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-67935
-
-commit ebbf7c60bbd1ceedf9faf962e428ceda2388c248
-Author: Cédric Le Goater <clg@redhat.com>
-Date:   Fri Nov 15 09:34:40 2024 +0100
-
-    vfio/container: Fix container object destruction
-
-    When commit 96b7af4388b3 intoduced a .instance_finalize() handler,
-    it did not take into account that the container was not necessarily
-    inserted into the container list of the address space. Hence, if
-    the container object is destroyed, by calling object_unref() for
-    example, before vfio_address_space_insert() is called, QEMU may
-    crash when removing the container from the list as done in
-    vfio_container_instance_finalize(). This was seen with an SEV-SNP
-    guest for which discarding of RAM fails.
-
-    To resolve this issue, use the safe version of QLIST_REMOVE().
-
-    Cc: Zhenzhong Duan <zhenzhong.duan@intel.com>
-    Cc: Eric Auger <eric.auger@redhat.com>
-    Fixes: 96b7af4388b3 ("vfio/container: Move vfio_container_destroy() to an instance_finalize() handler")
-    Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-    Signed-off-by: Cédric Le Goater <clg@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/vfio/container-base.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 809b157674..6f86c37d97 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -103,7 +103,7 @@ static void vfio_container_instance_finalize(Object *obj)
-     VFIOContainerBase *bcontainer = VFIO_IOMMU(obj);
-     VFIOGuestIOMMU *giommu, *tmp;
- 
--    QLIST_REMOVE(bcontainer, next);
-+    QLIST_SAFE_REMOVE(bcontainer, next);
- 
-     QLIST_FOREACH_SAFE(giommu, &bcontainer->giommu_list, giommu_next, tmp) {
-         memory_region_unregister_iommu_notifier(
--- 
-2.45.1
-
diff --git a/kvm-vfio-helpers-Align-mmaps.patch b/kvm-vfio-helpers-Align-mmaps.patch
deleted file mode 100644
index 784e024..0000000
--- a/kvm-vfio-helpers-Align-mmaps.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 0e733c43122688a40b0bad9cf9af43ac3655fa30 Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 22 Oct 2024 14:08:29 -0600
-Subject: [PATCH 5/5] vfio/helpers: Align mmaps
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Donald Dutile <None>
-RH-MergeRequest: 366: Improve VFIO mmapping performance with huge pfnmaps
-RH-Jira: RHEL-88533
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [2/2] f0e99cf993f82796352376bc7280342729ea5624 (ddutile/qemu-kvm)
-
-Thanks to work by Peter Xu, support is introduced in Linux v6.12 to
-allow pfnmap insertions at PMD and PUD levels of the page table.  This
-means that provided a properly aligned mmap, the vfio driver is able
-to map MMIO at significantly larger intervals than PAGE_SIZE.  For
-example on x86_64 (the only architecture currently supporting huge
-pfnmaps for PUD), rather than 4KiB mappings, we can map device MMIO
-using 2MiB and even 1GiB page table entries.
-
-Typically mmap will already provide PMD aligned mappings, so devices
-with moderately sized MMIO ranges, even GPUs with standard 256MiB BARs,
-will already take advantage of this support.  However in order to better
-support devices exposing multi-GiB MMIO, such as 3D accelerators or GPUs
-with resizable BARs enabled, we need to manually align the mmap.
-
-There doesn't seem to be a way for userspace to easily learn about PMD
-and PUD mapping level sizes, therefore this takes the simple approach
-to align the mapping to the power-of-two size of the region, up to 1GiB,
-which is currently the maximum alignment we care about.
-
-Cc: Peter Xu <peterx@redhat.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 00b519c0bca0e933ed22e2e6f8bca6b23f41f950)
-
-Jira: https://issues.redhat.com/browse/RHEL-88533
-
-Signed-off-by: Donald Dutile <ddutile@redhat.com>
----
- hw/vfio/helpers.c | 32 ++++++++++++++++++++++++++++++--
- 1 file changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
-index b9e606e364..913796f437 100644
---- a/hw/vfio/helpers.c
-+++ b/hw/vfio/helpers.c
-@@ -27,6 +27,7 @@
- #include "trace.h"
- #include "qapi/error.h"
- #include "qemu/error-report.h"
-+#include "qemu/units.h"
- #include "monitor/monitor.h"
- 
- /*
-@@ -406,8 +407,35 @@ int vfio_region_mmap(VFIORegion *region)
-     prot |= region->flags & VFIO_REGION_INFO_FLAG_WRITE ? PROT_WRITE : 0;
- 
-     for (i = 0; i < region->nr_mmaps; i++) {
--        region->mmaps[i].mmap = mmap(NULL, region->mmaps[i].size, prot,
--                                     MAP_SHARED, region->vbasedev->fd,
-+        size_t align = MIN(1ULL << ctz64(region->mmaps[i].size), 1 * GiB);
-+        void *map_base, *map_align;
-+
-+        /*
-+         * Align the mmap for more efficient mapping in the kernel.  Ideally
-+         * we'd know the PMD and PUD mapping sizes to use as discrete alignment
-+         * intervals, but we don't.  As of Linux v6.12, the largest PUD size
-+         * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set
-+         * on x86_64).  Align by power-of-two size, capped at 1GiB.
-+         *
-+         * NB. qemu_memalign() and friends actually allocate memory, whereas
-+         * the region size here can exceed host memory, therefore we manually
-+         * create an oversized anonymous mapping and clean it up for alignment.
-+         */
-+        map_base = mmap(0, region->mmaps[i].size + align, PROT_NONE,
-+                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-+        if (map_base == MAP_FAILED) {
-+            ret = -errno;
-+            goto no_mmap;
-+        }
-+
-+        map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align);
-+        munmap(map_base, map_align - map_base);
-+        munmap(map_align + region->mmaps[i].size,
-+               align - (map_align - map_base));
-+
-+        region->mmaps[i].mmap = mmap(map_align, region->mmaps[i].size, prot,
-+                                     MAP_SHARED | MAP_FIXED,
-+                                     region->vbasedev->fd,
-                                      region->fd_offset +
-                                      region->mmaps[i].offset);
-         if (region->mmaps[i].mmap == MAP_FAILED) {
--- 
-2.48.1
-
diff --git a/kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch b/kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch
deleted file mode 100644
index 6b06e31..0000000
--- a/kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From f3af9e4476546c0bc814f78d5dd1047ec60768e8 Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 22 Oct 2024 14:08:28 -0600
-Subject: [PATCH 4/5] vfio/helpers: Refactor vfio_region_mmap() error handling
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Donald Dutile <None>
-RH-MergeRequest: 366: Improve VFIO mmapping performance with huge pfnmaps
-RH-Jira: RHEL-88533
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [1/2] b83c7dbc6a6037b465a141961ae810e5551fad30 (ddutile/qemu-kvm)
-
-Move error handling code to the end of the function so that it can more
-easily be shared by new mmap failure conditions.  No functional change
-intended.
-
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 49915c0d2c9868e6f25e52e4d839943611b69e98)
-
-Jira: https://issues.redhat.com/browse/RHEL-88533
-
-Signed-off-by: Donald Dutile <ddutile@redhat.com>
----
- hw/vfio/helpers.c | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
-index ea15c79db0..b9e606e364 100644
---- a/hw/vfio/helpers.c
-+++ b/hw/vfio/helpers.c
-@@ -395,7 +395,7 @@ static void vfio_subregion_unmap(VFIORegion *region, int index)
- 
- int vfio_region_mmap(VFIORegion *region)
- {
--    int i, prot = 0;
-+    int i, ret, prot = 0;
-     char *name;
- 
-     if (!region->mem) {
-@@ -411,22 +411,8 @@ int vfio_region_mmap(VFIORegion *region)
-                                      region->fd_offset +
-                                      region->mmaps[i].offset);
-         if (region->mmaps[i].mmap == MAP_FAILED) {
--            int ret = -errno;
--
--            trace_vfio_region_mmap_fault(memory_region_name(region->mem), i,
--                                         region->fd_offset +
--                                         region->mmaps[i].offset,
--                                         region->fd_offset +
--                                         region->mmaps[i].offset +
--                                         region->mmaps[i].size - 1, ret);
--
--            region->mmaps[i].mmap = NULL;
--
--            for (i--; i >= 0; i--) {
--                vfio_subregion_unmap(region, i);
--            }
--
--            return ret;
-+            ret = -errno;
-+            goto no_mmap;
-         }
- 
-         name = g_strdup_printf("%s mmaps[%d]",
-@@ -446,6 +432,20 @@ int vfio_region_mmap(VFIORegion *region)
-     }
- 
-     return 0;
-+
-+no_mmap:
-+    trace_vfio_region_mmap_fault(memory_region_name(region->mem), i,
-+                                 region->fd_offset + region->mmaps[i].offset,
-+                                 region->fd_offset + region->mmaps[i].offset +
-+                                 region->mmaps[i].size - 1, ret);
-+
-+    region->mmaps[i].mmap = NULL;
-+
-+    for (i--; i >= 0; i--) {
-+        vfio_subregion_unmap(region, i);
-+    }
-+
-+    return ret;
- }
- 
- void vfio_region_unmap(VFIORegion *region)
--- 
-2.48.1
-
diff --git a/kvm-vfio-migration-Change-trace-formats-from-hex-to-deci.patch b/kvm-vfio-migration-Change-trace-formats-from-hex-to-deci.patch
deleted file mode 100644
index 3dc09cc..0000000
--- a/kvm-vfio-migration-Change-trace-formats-from-hex-to-deci.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 619ad79630f5ff2c634fa2785acdaa8dc2f66f62 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Wed, 6 Nov 2024 17:28:32 +0100
-Subject: [PATCH 25/27] vfio/migration: Change trace formats from hex to
- decimal
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 282: vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
-RH-Jira: RHEL-64307
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [2/2] 04c78dea168c6b4edbbf0cbddadb0d760e7afeb5 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-64307
-
-commit fa4e20defe239e42af0a1b5c030dec114f799f56
-Author: Avihai Horon <avihaih@nvidia.com>
-Date:   Sun Oct 20 16:01:08 2024 +0300
-
-    vfio/migration: Change trace formats from hex to decimal
-
-    Data sizes in VFIO migration trace events are printed in hex format
-    while in migration core trace events they are printed in decimal format.
-
-    This inconsistency makes it less readable when using both trace event
-    types. Hence, change the data sizes print format to decimal in VFIO
-    migration trace events.
-
-    Signed-off-by: Avihai Horon <avihaih@nvidia.com>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/vfio/trace-events | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 98bd4dccea..3756ff660e 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -151,7 +151,7 @@ vfio_display_edid_write_error(void) ""
- vfio_load_cleanup(const char *name) " (%s)"
- vfio_load_device_config_state(const char *name) " (%s)"
- vfio_load_state(const char *name, uint64_t data) " (%s) data 0x%"PRIx64
--vfio_load_state_device_data(const char *name, uint64_t data_size, int ret) " (%s) size 0x%"PRIx64" ret %d"
-+vfio_load_state_device_data(const char *name, uint64_t data_size, int ret) " (%s) size %"PRIu64" ret %d"
- vfio_migration_realize(const char *name) " (%s)"
- vfio_migration_set_device_state(const char *name, const char *state) " (%s) state %s"
- vfio_migration_set_state(const char *name, const char *new_state, const char *recover_state) " (%s) new state %s, recover state %s"
-@@ -160,10 +160,10 @@ vfio_save_block(const char *name, int data_size) " (%s) data_size %d"
- vfio_save_cleanup(const char *name) " (%s)"
- vfio_save_complete_precopy(const char *name, int ret) " (%s) ret %d"
- vfio_save_device_config_state(const char *name) " (%s)"
--vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
--vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size 0x%"PRIx64
--vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
--vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
-+vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
-+vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
-+vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy %"PRIu64" postcopy %"PRIu64" precopy initial size %"PRIu64" precopy dirty size %"PRIu64
-+vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy %"PRIu64" postcopy %"PRIu64" stopcopy size %"PRIu64" precopy initial size %"PRIu64" precopy dirty size %"PRIu64
- vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
- vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
- 
--- 
-2.39.3
-
diff --git a/kvm-vfio-migration-Report-only-stop-copy-size-in-vfio_st.patch b/kvm-vfio-migration-Report-only-stop-copy-size-in-vfio_st.patch
deleted file mode 100644
index 2a2204c..0000000
--- a/kvm-vfio-migration-Report-only-stop-copy-size-in-vfio_st.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 4d37b5f77a60ea951c33ac715584bb6f5897006a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Wed, 6 Nov 2024 17:28:32 +0100
-Subject: [PATCH 24/27] vfio/migration: Report only stop-copy size in
- vfio_state_pending_exact()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 282: vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
-RH-Jira: RHEL-64307
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [1/2] 5330acbef6f8a8ada56bd4c7f616138df1a94112 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-64307
-
-commit 3b5948f808e3b99aedfa0aff45cffbe8b7ec07ed
-Author: Avihai Horon <avihaih@nvidia.com>
-Date:   Sun Oct 20 16:01:06 2024 +0300
-
-    vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
-
-    vfio_state_pending_exact() is used to update migration core how much
-    device data is left for the device migration. Currently, the sum of
-    pre-copy and stop-copy sizes of the VFIO device are reported.
-
-    The pre-copy size is obtained via the VFIO_MIG_GET_PRECOPY_INFO ioctl,
-    which returns the amount of device data available to be transferred
-    while the device is in the PRE_COPY states.
-
-    The stop-copy size is obtained via the VFIO_DEVICE_FEATURE_MIG_DATA_SIZE
-    ioctl, which returns the total amount of device data left to be
-    transferred in order to complete the device migration.
-
-    According to the above, current implementation is wrong -- it reports
-    extra overlapping data because pre-copy size is already contained in
-    stop-copy size. Fix it by reporting only stop-copy size.
-
-    Fixes: eda7362af959 ("vfio/migration: Add VFIO migration pre-copy support")
-    Signed-off-by: Avihai Horon <avihaih@nvidia.com>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/vfio/migration.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
-index 262d42a46e..dd717e8d6c 100644
---- a/hw/vfio/migration.c
-+++ b/hw/vfio/migration.c
-@@ -576,9 +576,6 @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
- 
-     if (vfio_device_state_is_precopy(vbasedev)) {
-         vfio_query_precopy_size(migration);
--
--        *must_precopy +=
--            migration->precopy_init_size + migration->precopy_dirty_size;
-     }
- 
-     trace_vfio_state_pending_exact(vbasedev->name, *must_precopy, *can_postcopy,
--- 
-2.39.3
-
diff --git a/kvm-vfio-pci-Delete-local-pm_cap.patch b/kvm-vfio-pci-Delete-local-pm_cap.patch
deleted file mode 100644
index 0d18886..0000000
--- a/kvm-vfio-pci-Delete-local-pm_cap.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 80be4b7d44d4721bacaa6205a47f2d898a090c6b Mon Sep 17 00:00:00 2001
-From: Alex Williamson <alex.williamson@redhat.com>
-Date: Tue, 25 Feb 2025 14:52:27 -0700
-Subject: [PATCH 4/7] vfio/pci: Delete local pm_cap
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 348: PCI: Implement basic PCI PM capability backing
-RH-Jira: RHEL-7301
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
-RH-Commit: [4/6] 85bd6b15af7c483e36e265c12b7b1689a4872f4c (eauger1/centos-qemu-kvm)
-
-This is now redundant to PCIDevice.pm_cap.
-
-Cc: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250225215237.3314011-4-alex.williamson@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 05c6a8eff6298675080aa2692ee05a310b3483b4)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/pci.c | 9 ++++-----
- hw/vfio/pci.h | 1 -
- 2 files changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index e18b57d864..595b5c9b25 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2219,7 +2219,6 @@ static bool vfio_add_std_cap(VFIOPCIDevice *vdev, uint8_t pos, Error **errp)
-         break;
-     case PCI_CAP_ID_PM:
-         vfio_check_pm_reset(vdev, pos);
--        vdev->pm_cap = pos;
-         ret = pci_pm_init(pdev, pos, errp) >= 0;
-         /*
-          * PCI-core config space emulation needs write access to the power
-@@ -2416,17 +2415,17 @@ void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
-     vfio_disable_interrupts(vdev);
- 
-     /* Make sure the device is in D0 */
--    if (vdev->pm_cap) {
-+    if (pdev->pm_cap) {
-         uint16_t pmcsr;
-         uint8_t state;
- 
--        pmcsr = vfio_pci_read_config(pdev, vdev->pm_cap + PCI_PM_CTRL, 2);
-+        pmcsr = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-         state = pmcsr & PCI_PM_CTRL_STATE_MASK;
-         if (state) {
-             pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
--            vfio_pci_write_config(pdev, vdev->pm_cap + PCI_PM_CTRL, pmcsr, 2);
-+            vfio_pci_write_config(pdev, pdev->pm_cap + PCI_PM_CTRL, pmcsr, 2);
-             /* vfio handles the necessary delay here */
--            pmcsr = vfio_pci_read_config(pdev, vdev->pm_cap + PCI_PM_CTRL, 2);
-+            pmcsr = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-             state = pmcsr & PCI_PM_CTRL_STATE_MASK;
-             if (state) {
-                 error_report("vfio: Unable to power on device, stuck in D%d",
-diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 0d3c93fb2e..ca8d55f8b2 100644
---- a/hw/vfio/pci.h
-+++ b/hw/vfio/pci.h
-@@ -161,7 +161,6 @@ struct VFIOPCIDevice {
-     int32_t bootindex;
-     uint32_t igd_gms;
-     OffAutoPCIBAR msix_relo;
--    uint8_t pm_cap;
-     uint8_t nv_gpudirect_clique;
-     bool pci_aer;
-     bool req_enabled;
--- 
-2.48.1
-
diff --git a/kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch b/kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch
deleted file mode 100644
index e3bac53..0000000
--- a/kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 592361992b26d7f357d45de2e9ee68c1cdb15ab0 Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Wed, 15 Jan 2025 14:50:43 +0100
-Subject: [PATCH 2/3] vhost: Add stubs for the migration state transfer
- interface
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 337: virtio-net: vhost-user: Implement internal migration
-RH-Jira: RHEL-78372
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/2] f9a24e45e618a22f867de0fd14e1000a9a38ba91 (lvivier/qemu-kvm-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-78372
-
-Migration state transfer interface is only used by vhost-user-fs,
-so the interface needs to be defined only when vhost is built.
-
-But I need to use this interface with virtio-net and vhost is not always
-enabled, and to avoid undefined reference error during build, define stub
-functions for vhost_supports_device_state(), vhost_save_backend_state() and
-vhost_load_backend_state().
-
-Cc: Hanna Czenczek <hreitz@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Message-Id: <20250115135044.799698-2-lvivier@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 3f65357313e0f928e0bd3ff868b705855d0405bc)
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
----
- include/hw/virtio/vhost.h | 23 +++++++++++++++++++++++
- 1 file changed, 23 insertions(+)
-
-diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
-index d75faf46e9..1d524f85b9 100644
---- a/include/hw/virtio/vhost.h
-+++ b/include/hw/virtio/vhost.h
-@@ -363,7 +363,14 @@ static inline int vhost_reset_device(struct vhost_dev *hdev)
-  * Returns true if the device supports these commands, and false if it
-  * does not.
-  */
-+#ifdef CONFIG_VHOST
- bool vhost_supports_device_state(struct vhost_dev *dev);
-+#else
-+static inline bool vhost_supports_device_state(struct vhost_dev *dev)
-+{
-+    return false;
-+}
-+#endif
- 
- /**
-  * vhost_set_device_state_fd(): Begin transfer of internal state from/to
-@@ -446,7 +453,15 @@ int vhost_check_device_state(struct vhost_dev *dev, Error **errp);
-  *
-  * Returns 0 on success, and -errno otherwise.
-  */
-+#ifdef CONFIG_VHOST
- int vhost_save_backend_state(struct vhost_dev *dev, QEMUFile *f, Error **errp);
-+#else
-+static inline int vhost_save_backend_state(struct vhost_dev *dev, QEMUFile *f,
-+                                           Error **errp)
-+{
-+    return -ENOSYS;
-+}
-+#endif
- 
- /**
-  * vhost_load_backend_state(): High-level function to load a vhost
-@@ -463,6 +478,14 @@ int vhost_save_backend_state(struct vhost_dev *dev, QEMUFile *f, Error **errp);
-  *
-  * Returns 0 on success, and -errno otherwise.
-  */
-+#ifdef CONFIG_VHOST
- int vhost_load_backend_state(struct vhost_dev *dev, QEMUFile *f, Error **errp);
-+#else
-+static inline int vhost_load_backend_state(struct vhost_dev *dev, QEMUFile *f,
-+                                           Error **errp)
-+{
-+    return -ENOSYS;
-+}
-+#endif
- 
- #endif
--- 
-2.48.1
-
diff --git a/kvm-vhost-fail-device-start-if-iotlb-update-fails.patch b/kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
deleted file mode 100644
index 0b3fed1..0000000
--- a/kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From f9b6f2440117eaa4c57a3b924ba935580ef2ecf1 Mon Sep 17 00:00:00 2001
-From: Prasad Pandit <pjp@fedoraproject.org>
-Date: Thu, 7 Nov 2024 17:02:47 +0530
-Subject: [PATCH 18/19] vhost: fail device start if iotlb update fails
-
-RH-Author: Prasad Pandit <None>
-RH-MergeRequest: 309: vhost: fail device start if iotlb update fails
-RH-Jira: RHEL-27832
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] c10d1b2d3414285c2feec8760eb8e63e186fd564 (pjp/cs-qemu-kvm)
-
-While starting a vhost device, updating iotlb entries
-via 'vhost_device_iotlb_miss' may return an error.
-
-  qemu-kvm: vhost_device_iotlb_miss:
-    700871,700871: Fail to update device iotlb
-
-Fail device start when such an error occurs.
-
-Jira: https://issues.redhat.com/browse/RHEL-27832
-Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
-Message-Id: <20241107113247.46532-1-ppandit@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-(cherry picked from commit 571bdc97b83646dfd3746ec56fb2f70bca55b9a2)
-Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
----
- hw/virtio/vhost.c | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
-index 06fc71746e..e25fdce3dd 100644
---- a/hw/virtio/vhost.c
-+++ b/hw/virtio/vhost.c
-@@ -2151,11 +2151,22 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
-          * vhost-kernel code requires for this.*/
-         for (i = 0; i < hdev->nvqs; ++i) {
-             struct vhost_virtqueue *vq = hdev->vqs + i;
--            vhost_device_iotlb_miss(hdev, vq->used_phys, true);
-+            r = vhost_device_iotlb_miss(hdev, vq->used_phys, true);
-+            if (r) {
-+                goto fail_iotlb;
-+            }
-         }
-     }
-     vhost_start_config_intr(hdev);
-     return 0;
-+fail_iotlb:
-+    if (vhost_dev_has_iommu(hdev) &&
-+        hdev->vhost_ops->vhost_set_iotlb_callback) {
-+        hdev->vhost_ops->vhost_set_iotlb_callback(hdev, false);
-+    }
-+    if (hdev->vhost_ops->vhost_dev_start) {
-+        hdev->vhost_ops->vhost_dev_start(hdev, false);
-+    }
- fail_start:
-     if (vrings) {
-         vhost_dev_set_vring_enable(hdev, false);
--- 
-2.39.3
-
diff --git a/kvm-virtio-kconfig-memory-devices-are-PCI-only.patch b/kvm-virtio-kconfig-memory-devices-are-PCI-only.patch
deleted file mode 100644
index 0ddc3e9..0000000
--- a/kvm-virtio-kconfig-memory-devices-are-PCI-only.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From a582cf6f68febba05e20548f643c8be637eab7b8 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 6 Sep 2024 12:16:58 +0200
-Subject: [PATCH 01/26] virtio: kconfig: memory devices are PCI only
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [1/26] 0f0eab06b6f79f84c2e8d4fee28309b3c7c57414 (thuth/qemu-kvm-cs)
-
-Virtio memory devices rely on PCI BARs to expose the contents of memory.
-Because of this they cannot be used (yet) with virtio-mmio or virtio-ccw.
-In fact the code that is common to virtio-mem and virtio-pmem, which
-is in hw/virtio/virtio-md-pci.c, is only included if CONFIG_VIRTIO_PCI
-is set.  Reproduce the same condition in the Kconfig file, only allowing
-VIRTIO_MEM and VIRTIO_PMEM to be defined if the transport supports it.
-
-Without this patch it is possible to create a configuration with
-CONFIG_VIRTIO_PCI=n and CONFIG_VIRTIO_MEM=y, but that causes a
-linking failure.
-
-Message-ID: <20240906101658.514470-1-pbonzini@redhat.com>
-Reported-by: Michael Tokarev <mjt@tls.msk.ru>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 8d018fe59a0beff580ac6b3399d642c4277d9dd0)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/Kconfig | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
-index aa63ff7fd4..0afec2ae92 100644
---- a/hw/virtio/Kconfig
-+++ b/hw/virtio/Kconfig
-@@ -16,6 +16,7 @@ config VIRTIO_PCI
-     default y if PCI_DEVICES
-     depends on PCI
-     select VIRTIO
-+    select VIRTIO_MD_SUPPORTED
- 
- config VIRTIO_MMIO
-     bool
-@@ -35,10 +36,17 @@ config VIRTIO_CRYPTO
-     default y
-     depends on VIRTIO
- 
-+# not all virtio transports support memory devices; if none does,
-+# no need to include the code
-+config VIRTIO_MD_SUPPORTED
-+    bool
-+
- config VIRTIO_MD
-     bool
-+    depends on VIRTIO_MD_SUPPORTED
-     select MEM_DEVICE
- 
-+# selected by the board if it has the required support code
- config VIRTIO_PMEM_SUPPORTED
-     bool
- 
-@@ -46,9 +54,11 @@ config VIRTIO_PMEM
-     bool
-     default y
-     depends on VIRTIO
-+    depends on VIRTIO_MD_SUPPORTED
-     depends on VIRTIO_PMEM_SUPPORTED
-     select VIRTIO_MD
- 
-+# selected by the board if it has the required support code
- config VIRTIO_MEM_SUPPORTED
-     bool
- 
-@@ -57,6 +67,7 @@ config VIRTIO_MEM
-     default y
-     depends on VIRTIO
-     depends on LINUX
-+    depends on VIRTIO_MD_SUPPORTED
-     depends on VIRTIO_MEM_SUPPORTED
-     select VIRTIO_MD
- 
--- 
-2.48.1
-
diff --git a/kvm-virtio-mem-Add-support-for-suspend-wake-up-with-plug.patch b/kvm-virtio-mem-Add-support-for-suspend-wake-up-with-plug.patch
deleted file mode 100644
index ba58998..0000000
--- a/kvm-virtio-mem-Add-support-for-suspend-wake-up-with-plug.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 001200670ce9076a34419828e7e7ba92f19a80b7 Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 4 Sep 2024 12:37:15 +0200
-Subject: [PATCH 08/26] virtio-mem: Add support for suspend+wake-up with
- plugged memory
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [8/26] 08e25d41e32b3ac2bf5e0266f9c7e91739eda4d4 (thuth/qemu-kvm-cs)
-
-Before, the virtio-mem device would unplug all the memory with any reset
-of the device, including during the wake-up of the guest from a
-suspended state. Due to this, the virtio-mem driver in the Linux kernel
-disallowed suspend-to-ram requests in the guest when the
-VIRTIO_MEM_F_PERSISTENT_SUSPEND feature is not exposed by QEMU.
-
-This patch adds the code to skip the reset on wake-up and exposes
-theVIRTIO_MEM_F_PERSISTENT_SUSPEND feature to the guest kernel driver
-when suspending is possible in QEMU (currently only x86).
-
-Message-ID: <20240904103722.946194-5-jmarcin@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 1f5f49056d0f140568805d66f33396ed5cd90369)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/virtio-mem.c | 10 ++++++++++
- hw/virtio/virtio-qmp.c |  3 +++
- 2 files changed, 13 insertions(+)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 025ae4abac..51642a15ef 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -883,6 +883,9 @@ static uint64_t virtio_mem_get_features(VirtIODevice *vdev, uint64_t features,
-     if (vmem->unplugged_inaccessible == ON_OFF_AUTO_ON) {
-         virtio_add_feature(&features, VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE);
-     }
-+    if (qemu_wakeup_suspend_enabled()) {
-+        virtio_add_feature(&features, VIRTIO_MEM_F_PERSISTENT_SUSPEND);
-+    }
-     return features;
- }
- 
-@@ -1842,6 +1845,13 @@ static void virtio_mem_system_reset_hold(Object *obj, ResetType type)
- {
-     VirtIOMEM *vmem = VIRTIO_MEM(obj);
- 
-+    /*
-+     * When waking up from standby/suspend-to-ram, do not unplug any memory.
-+     */
-+    if (type == RESET_TYPE_WAKEUP) {
-+        return;
-+    }
-+
-     /*
-      * During usual resets, we will unplug all memory and shrink the usable
-      * region size. This is, however, not possible in all scenarios. Then,
-diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
-index 1dd96ed20f..cccc6fe761 100644
---- a/hw/virtio/virtio-qmp.c
-+++ b/hw/virtio/virtio-qmp.c
-@@ -450,6 +450,9 @@ static const qmp_virtio_feature_map_t virtio_mem_feature_map[] = {
-     FEATURE_ENTRY(VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE, \
-             "VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE: Unplugged memory cannot be "
-             "accessed"),
-+    FEATURE_ENTRY(VIRTIO_MEM_F_PERSISTENT_SUSPEND, \
-+            "VIRTIO_MEM_F_PERSISTENT_SUSPND: Plugged memory will remain "
-+            "plugged when suspending+resuming"),
-     { -1, "" }
- };
- #endif
--- 
-2.48.1
-
diff --git a/kvm-virtio-mem-Use-new-Resettable-framework-instead-of-L.patch b/kvm-virtio-mem-Use-new-Resettable-framework-instead-of-L.patch
deleted file mode 100644
index 5bb3c9e..0000000
--- a/kvm-virtio-mem-Use-new-Resettable-framework-instead-of-L.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 6bc0cdecdc736d642bb6c040e07d79a0a3e591ea Mon Sep 17 00:00:00 2001
-From: Juraj Marcin <jmarcin@redhat.com>
-Date: Wed, 4 Sep 2024 12:37:14 +0200
-Subject: [PATCH 07/26] virtio-mem: Use new Resettable framework instead of
- LegacyReset
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [7/26] 31fddbeb4aaf6794b83399a7e2996f01d918d748 (thuth/qemu-kvm-cs)
-
-LegacyReset does not pass ResetType to the reset callback method, which
-the new Resettable framework uses. Due to this, virtio-mem cannot use
-the new RESET_TYPE_WAKEUP to skip the reset during wake-up from a
-suspended state.
-
-This patch adds overrides Resettable interface methods in VirtIOMEMClass
-to use the new Resettable framework and replaces
-qemu_[un]register_reset() calls with qemu_[un]register_resettable().
-
-Message-ID: <20240904103722.946194-4-jmarcin@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit c009a311e93963860cfba917605a4bf903a06bce)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/virtio-mem.c         | 38 +++++++++++++++++++++-------------
- include/hw/virtio/virtio-mem.h |  4 ++++
- 2 files changed, 28 insertions(+), 14 deletions(-)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index ba11aa4646..025ae4abac 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -895,18 +895,6 @@ static int virtio_mem_validate_features(VirtIODevice *vdev)
-     return 0;
- }
- 
--static void virtio_mem_system_reset(void *opaque)
--{
--    VirtIOMEM *vmem = VIRTIO_MEM(opaque);
--
--    /*
--     * During usual resets, we will unplug all memory and shrink the usable
--     * region size. This is, however, not possible in all scenarios. Then,
--     * the guest has to deal with this manually (VIRTIO_MEM_REQ_UNPLUG_ALL).
--     */
--    virtio_mem_unplug_all(vmem);
--}
--
- static void virtio_mem_prepare_mr(VirtIOMEM *vmem)
- {
-     const uint64_t region_size = memory_region_size(&vmem->memdev->mr);
-@@ -1123,7 +1111,7 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-         vmstate_register_any(VMSTATE_IF(vmem),
-                              &vmstate_virtio_mem_device_early, vmem);
-     }
--    qemu_register_reset(virtio_mem_system_reset, vmem);
-+    qemu_register_resettable(OBJECT(vmem));
- 
-     /*
-      * Set ourselves as RamDiscardManager before the plug handler maps the
-@@ -1143,7 +1131,7 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
-      * found via an address space anymore. Unset ourselves.
-      */
-     memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
--    qemu_unregister_reset(virtio_mem_system_reset, vmem);
-+    qemu_unregister_resettable(OBJECT(vmem));
-     if (vmem->early_migration) {
-         vmstate_unregister(VMSTATE_IF(vmem), &vmstate_virtio_mem_device_early,
-                            vmem);
-@@ -1844,12 +1832,31 @@ static void virtio_mem_unplug_request_check(VirtIOMEM *vmem, Error **errp)
-     }
- }
- 
-+static ResettableState *virtio_mem_get_reset_state(Object *obj)
-+{
-+    VirtIOMEM *vmem = VIRTIO_MEM(obj);
-+    return &vmem->reset_state;
-+}
-+
-+static void virtio_mem_system_reset_hold(Object *obj, ResetType type)
-+{
-+    VirtIOMEM *vmem = VIRTIO_MEM(obj);
-+
-+    /*
-+     * During usual resets, we will unplug all memory and shrink the usable
-+     * region size. This is, however, not possible in all scenarios. Then,
-+     * the guest has to deal with this manually (VIRTIO_MEM_REQ_UNPLUG_ALL).
-+     */
-+    virtio_mem_unplug_all(vmem);
-+}
-+
- static void virtio_mem_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
-     VirtIOMEMClass *vmc = VIRTIO_MEM_CLASS(klass);
-     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_CLASS(klass);
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
-     device_class_set_props(dc, virtio_mem_properties);
-     dc->vmsd = &vmstate_virtio_mem;
-@@ -1876,6 +1883,9 @@ static void virtio_mem_class_init(ObjectClass *klass, void *data)
-     rdmc->replay_discarded = virtio_mem_rdm_replay_discarded;
-     rdmc->register_listener = virtio_mem_rdm_register_listener;
-     rdmc->unregister_listener = virtio_mem_rdm_unregister_listener;
-+
-+    rc->get_state = virtio_mem_get_reset_state;
-+    rc->phases.hold = virtio_mem_system_reset_hold;
- }
- 
- static const TypeInfo virtio_mem_info = {
-diff --git a/include/hw/virtio/virtio-mem.h b/include/hw/virtio/virtio-mem.h
-index 5f5b02b8f9..a1af144c28 100644
---- a/include/hw/virtio/virtio-mem.h
-+++ b/include/hw/virtio/virtio-mem.h
-@@ -14,6 +14,7 @@
- #define HW_VIRTIO_MEM_H
- 
- #include "standard-headers/linux/virtio_mem.h"
-+#include "hw/resettable.h"
- #include "hw/virtio/virtio.h"
- #include "qapi/qapi-types-misc.h"
- #include "sysemu/hostmem.h"
-@@ -115,6 +116,9 @@ struct VirtIOMEM {
- 
-     /* listeners to notify on plug/unplug activity. */
-     QLIST_HEAD(, RamDiscardListener) rdl_list;
-+
-+    /* State of the resettable container */
-+    ResettableState reset_state;
- };
- 
- struct VirtIOMEMClass {
--- 
-2.48.1
-
diff --git a/kvm-virtio-mem-don-t-warn-about-THP-sizes-on-a-kernel-wi.patch b/kvm-virtio-mem-don-t-warn-about-THP-sizes-on-a-kernel-wi.patch
deleted file mode 100644
index f527a70..0000000
--- a/kvm-virtio-mem-don-t-warn-about-THP-sizes-on-a-kernel-wi.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From f4052d25199bfce8ce29a173934a805fe1cf7e3e Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Tue, 10 Sep 2024 18:34:33 +0200
-Subject: [PATCH 25/26] virtio-mem: don't warn about THP sizes on a kernel
- without THP support
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [25/26] 5dff17ef818722db8f1fa87cff5b7777afc3c814 (thuth/qemu-kvm-cs)
-
-If the config directory in sysfs does not exist at all, we are dealing
-with a system that does not support THPs. Simply use 1 MiB block size
-then, instead of warning "Could not detect THP size, falling back to
-..." and falling back to the default THP size.
-
-Cc: "Michael S. Tsirkin" <mst@redhat.com>
-Cc: Gavin Shan <gshan@redhat.com>
-Cc: Juraj Marcin <jmarcin@redhat.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Message-Id: <20240910163433.2100295-1-david@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 95b717a8154b955de2782305f305b63f357b0576)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/virtio-mem.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index c9f8a23bbc..4977658312 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -90,6 +90,7 @@ static uint32_t virtio_mem_default_thp_size(void)
- static uint32_t thp_size;
- 
- #define HPAGE_PMD_SIZE_PATH "/sys/kernel/mm/transparent_hugepage/hpage_pmd_size"
-+#define HPAGE_PATH "/sys/kernel/mm/transparent_hugepage/"
- static uint32_t virtio_mem_thp_size(void)
- {
-     gchar *content = NULL;
-@@ -100,6 +101,12 @@ static uint32_t virtio_mem_thp_size(void)
-         return thp_size;
-     }
- 
-+    /* No THP -> no restrictions. */
-+    if (!g_file_test(HPAGE_PATH, G_FILE_TEST_EXISTS)) {
-+        thp_size = VIRTIO_MEM_MIN_BLOCK_SIZE;
-+        return thp_size;
-+    }
-+
-     /*
-      * Try to probe the actual THP size, fallback to (sane but eventually
-      * incorrect) default sizes.
--- 
-2.48.1
-
diff --git a/kvm-virtio-mem-unplug-memory-only-during-system-resets-n.patch b/kvm-virtio-mem-unplug-memory-only-during-system-resets-n.patch
deleted file mode 100644
index cfb49f4..0000000
--- a/kvm-virtio-mem-unplug-memory-only-during-system-resets-n.patch
+++ /dev/null
@@ -1,258 +0,0 @@
-From e5f2bb584154eef665211228f1ac3113e2acc269 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Fri, 25 Oct 2024 12:41:03 +0200
-Subject: [PATCH 09/26] virtio-mem: unplug memory only during system resets,
- not device resets
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 351: Enable virtio-mem support on s390x
-RH-Jira: RHEL-72977
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Juraj Marcin <None>
-RH-Commit: [9/26] 7c5ddd4d3fd0d19caa946bcbe98cb5732404978b (thuth/qemu-kvm-cs)
-
-We recently converted from the LegacyReset to the new reset framework
-in commit c009a311e939 ("virtio-mem: Use new Resettable framework instead
-of LegacyReset") to be able to use the ResetType to filter out wakeup
-resets.
-
-However, this change had an undesired implications: as we override the
-Resettable interface methods in VirtIOMEMClass, the reset handler will
-not only get called during system resets (i.e., qemu_devices_reset())
-but also during any direct or indirect device rests (e.g.,
-device_cold_reset()).
-
-Further, we might now receive two reset callbacks during
-qemu_devices_reset(), first when reset by a parent and later when reset
-directly.
-
-The memory state of virtio-mem devices is rather special: it's supposed to
-be persistent/unchanged during most resets (similar to resetting a hard
-disk will not destroy the data), unless actually cold-resetting the whole
-system (different to a hard disk where a reboot will not destroy the data):
-ripping out system RAM is something guest OSes don't particularly enjoy,
-but we want to detect when rebooting to an OS that does not support
-virtio-mem and wouldn't be able to detect+use the memory -- and we want
-to force-defragment hotplugged memory to also shrink the usable device
-memory region. So we rally want to catch system resets to do that.
-
-On supported targets (e.g., x86), getting a cold reset on the
-device/parent triggers is not that easy (but looks like PCI code
-might trigger it), so this implication went unnoticed.
-
-However, with upcoming s390x support it is problematic: during
-kdump, s390x triggers a subsystem reset, ending up in
-s390_machine_reset() and calling only subsystem_reset() instead of
-qemu_devices_reset() -- because it's not a full system reset.
-
-In subsystem_reset(), s390x performs a device_cold_reset() of any
-TYPE_VIRTUAL_CSS_BRIDGE device, which ends up resetting all children,
-including the virtio-mem device. Consequently, we wrongly detect a system
-reset and unplug all device memory, resulting in hotplugged memory not
-getting included in the crash dump -- undesired.
-
-We really must not mess with hotplugged memory state during simple
-device resets. To fix, create+register a new reset object that will only
-get triggered during qemu_devices_reset() calls, but not during any other
-resets as it is logically not the child of any other object.
-
-Message-ID: <20241025104103.342188-1-david@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Cc: "Michael S. Tsirkin" <mst@redhat.com>
-Cc: Juraj Marcin <jmarcin@redhat.com>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 713484d0389c9d1cbb87eca060361281248b69f5)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/virtio/virtio-mem.c         | 103 +++++++++++++++++++++++----------
- include/hw/virtio/virtio-mem.h |  13 ++++-
- 2 files changed, 84 insertions(+), 32 deletions(-)
-
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 51642a15ef..00da98b6e1 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -949,6 +949,7 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-     VirtIOMEM *vmem = VIRTIO_MEM(dev);
-     uint64_t page_size;
-     RAMBlock *rb;
-+    Object *obj;
-     int ret;
- 
-     if (!vmem->memdev) {
-@@ -1114,7 +1115,28 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
-         vmstate_register_any(VMSTATE_IF(vmem),
-                              &vmstate_virtio_mem_device_early, vmem);
-     }
--    qemu_register_resettable(OBJECT(vmem));
-+
-+    /*
-+     * We only want to unplug all memory to start with a clean slate when
-+     * it is safe for the guest -- during system resets that call
-+     * qemu_devices_reset().
-+     *
-+     * We'll filter out selected qemu_devices_reset() calls used for other
-+     * purposes, like resetting all devices during wakeup from suspend on
-+     * x86 based on the reset type passed to qemu_devices_reset().
-+     *
-+     * Unplugging all memory during simple device resets can result in the VM
-+     * unexpectedly losing RAM, corrupting VM state.
-+     *
-+     * Simple device resets (or resets triggered by getting a parent device
-+     * reset) must not change the state of plugged memory blocks. Therefore,
-+     * we need a dedicated reset object that only gets called during
-+     * qemu_devices_reset().
-+     */
-+    obj = object_new(TYPE_VIRTIO_MEM_SYSTEM_RESET);
-+    vmem->system_reset = VIRTIO_MEM_SYSTEM_RESET(obj);
-+    vmem->system_reset->vmem = vmem;
-+    qemu_register_resettable(obj);
- 
-     /*
-      * Set ourselves as RamDiscardManager before the plug handler maps the
-@@ -1134,7 +1156,10 @@ static void virtio_mem_device_unrealize(DeviceState *dev)
-      * found via an address space anymore. Unset ourselves.
-      */
-     memory_region_set_ram_discard_manager(&vmem->memdev->mr, NULL);
--    qemu_unregister_resettable(OBJECT(vmem));
-+
-+    qemu_unregister_resettable(OBJECT(vmem->system_reset));
-+    object_unref(OBJECT(vmem->system_reset));
-+
-     if (vmem->early_migration) {
-         vmstate_unregister(VMSTATE_IF(vmem), &vmstate_virtio_mem_device_early,
-                            vmem);
-@@ -1835,38 +1860,12 @@ static void virtio_mem_unplug_request_check(VirtIOMEM *vmem, Error **errp)
-     }
- }
- 
--static ResettableState *virtio_mem_get_reset_state(Object *obj)
--{
--    VirtIOMEM *vmem = VIRTIO_MEM(obj);
--    return &vmem->reset_state;
--}
--
--static void virtio_mem_system_reset_hold(Object *obj, ResetType type)
--{
--    VirtIOMEM *vmem = VIRTIO_MEM(obj);
--
--    /*
--     * When waking up from standby/suspend-to-ram, do not unplug any memory.
--     */
--    if (type == RESET_TYPE_WAKEUP) {
--        return;
--    }
--
--    /*
--     * During usual resets, we will unplug all memory and shrink the usable
--     * region size. This is, however, not possible in all scenarios. Then,
--     * the guest has to deal with this manually (VIRTIO_MEM_REQ_UNPLUG_ALL).
--     */
--    virtio_mem_unplug_all(vmem);
--}
--
- static void virtio_mem_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
-     VirtIOMEMClass *vmc = VIRTIO_MEM_CLASS(klass);
-     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_CLASS(klass);
--    ResettableClass *rc = RESETTABLE_CLASS(klass);
- 
-     device_class_set_props(dc, virtio_mem_properties);
-     dc->vmsd = &vmstate_virtio_mem;
-@@ -1893,9 +1892,6 @@ static void virtio_mem_class_init(ObjectClass *klass, void *data)
-     rdmc->replay_discarded = virtio_mem_rdm_replay_discarded;
-     rdmc->register_listener = virtio_mem_rdm_register_listener;
-     rdmc->unregister_listener = virtio_mem_rdm_unregister_listener;
--
--    rc->get_state = virtio_mem_get_reset_state;
--    rc->phases.hold = virtio_mem_system_reset_hold;
- }
- 
- static const TypeInfo virtio_mem_info = {
-@@ -1918,3 +1914,48 @@ static void virtio_register_types(void)
- }
- 
- type_init(virtio_register_types)
-+
-+OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(VirtioMemSystemReset, virtio_mem_system_reset, VIRTIO_MEM_SYSTEM_RESET, OBJECT, { TYPE_RESETTABLE_INTERFACE }, { })
-+
-+static void virtio_mem_system_reset_init(Object *obj)
-+{
-+}
-+
-+static void virtio_mem_system_reset_finalize(Object *obj)
-+{
-+}
-+
-+static ResettableState *virtio_mem_system_reset_get_state(Object *obj)
-+{
-+    VirtioMemSystemReset *vmem_reset = VIRTIO_MEM_SYSTEM_RESET(obj);
-+
-+    return &vmem_reset->reset_state;
-+}
-+
-+static void virtio_mem_system_reset_hold(Object *obj, ResetType type)
-+{
-+    VirtioMemSystemReset *vmem_reset = VIRTIO_MEM_SYSTEM_RESET(obj);
-+    VirtIOMEM *vmem = vmem_reset->vmem;
-+
-+    /*
-+     * When waking up from standby/suspend-to-ram, do not unplug any memory.
-+     */
-+    if (type == RESET_TYPE_WAKEUP) {
-+        return;
-+    }
-+
-+    /*
-+     * During usual resets, we will unplug all memory and shrink the usable
-+     * region size. This is, however, not possible in all scenarios. Then,
-+     * the guest has to deal with this manually (VIRTIO_MEM_REQ_UNPLUG_ALL).
-+     */
-+    virtio_mem_unplug_all(vmem);
-+}
-+
-+static void virtio_mem_system_reset_class_init(ObjectClass *klass, void *data)
-+{
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+
-+    rc->get_state = virtio_mem_system_reset_get_state;
-+    rc->phases.hold = virtio_mem_system_reset_hold;
-+}
-diff --git a/include/hw/virtio/virtio-mem.h b/include/hw/virtio/virtio-mem.h
-index a1af144c28..550ce585b2 100644
---- a/include/hw/virtio/virtio-mem.h
-+++ b/include/hw/virtio/virtio-mem.h
-@@ -25,6 +25,10 @@
- OBJECT_DECLARE_TYPE(VirtIOMEM, VirtIOMEMClass,
-                     VIRTIO_MEM)
- 
-+#define TYPE_VIRTIO_MEM_SYSTEM_RESET "virtio-mem-system-reset"
-+
-+OBJECT_DECLARE_SIMPLE_TYPE(VirtioMemSystemReset, VIRTIO_MEM_SYSTEM_RESET)
-+
- #define VIRTIO_MEM_MEMDEV_PROP "memdev"
- #define VIRTIO_MEM_NODE_PROP "node"
- #define VIRTIO_MEM_SIZE_PROP "size"
-@@ -117,8 +121,15 @@ struct VirtIOMEM {
-     /* listeners to notify on plug/unplug activity. */
-     QLIST_HEAD(, RamDiscardListener) rdl_list;
- 
--    /* State of the resettable container */
-+    /* Catch system resets -> qemu_devices_reset() only. */
-+    VirtioMemSystemReset *system_reset;
-+};
-+
-+struct VirtioMemSystemReset {
-+    Object parent;
-+
-     ResettableState reset_state;
-+    VirtIOMEM *vmem;
- };
- 
- struct VirtIOMEMClass {
--- 
-2.48.1
-
diff --git a/kvm-virtio-net-Add-queues-before-loading-them.patch b/kvm-virtio-net-Add-queues-before-loading-them.patch
deleted file mode 100644
index 0474c68..0000000
--- a/kvm-virtio-net-Add-queues-before-loading-them.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 873e57548d92eb916656b6304a780f63958aa9fe Mon Sep 17 00:00:00 2001
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
-Date: Tue, 22 Oct 2024 15:49:01 +0900
-Subject: [PATCH 01/10] virtio-net: Add queues before loading them
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: 小田喜陽彦 <None>
-RH-MergeRequest: 299: virtio-net: Add queues before loading them
-RH-Jira: RHEL-69477
-RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
-RH-Acked-by: Jason Wang <jasowang@redhat.com>
-RH-Commit: [1/1] 7bd06d5f9c0f0ce3d211204c404451d7002bb7fb (akihiko.odaki/qemu-kvm)
-
-Call virtio_net_set_multiqueue() to add queues before loading their
-states. Otherwise the loaded queues will not have handlers and elements
-in them will not be processed.
-
-Cc: qemu-stable@nongnu.org
-Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing")
-Reported-by: Laurent Vivier <lvivier@redhat.com>
-Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit 9379ea9db3c0064fa2787db0794a23a30f7b2d2d)
----
- hw/net/virtio-net.c        | 10 ++++++++++
- hw/virtio/virtio.c         |  7 +++++++
- include/hw/virtio/virtio.h |  2 ++
- 3 files changed, 19 insertions(+)
-
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index ed33a32877..90d05f94d4 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -3032,6 +3032,15 @@ static void virtio_net_set_multiqueue(VirtIONet *n, int multiqueue)
-     virtio_net_set_queue_pairs(n);
- }
- 
-+static int virtio_net_pre_load_queues(VirtIODevice *vdev)
-+{
-+    virtio_net_set_multiqueue(VIRTIO_NET(vdev),
-+                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_RSS) ||
-+                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_MQ));
-+
-+    return 0;
-+}
-+
- static int virtio_net_post_load_device(void *opaque, int version_id)
- {
-     VirtIONet *n = opaque;
-@@ -4010,6 +4019,7 @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
-     vdc->guest_notifier_mask = virtio_net_guest_notifier_mask;
-     vdc->guest_notifier_pending = virtio_net_guest_notifier_pending;
-     vdc->legacy_features |= (0x1 << VIRTIO_NET_F_GSO);
-+    vdc->pre_load_queues = virtio_net_pre_load_queues;
-     vdc->post_load = virtio_net_post_load_virtio;
-     vdc->vmsd = &vmstate_virtio_net_device;
-     vdc->primary_unplug_pending = primary_unplug_pending;
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index 9e10cbc058..10f24a58dd 100644
---- a/hw/virtio/virtio.c
-+++ b/hw/virtio/virtio.c
-@@ -3251,6 +3251,13 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
-         config_len--;
-     }
- 
-+    if (vdc->pre_load_queues) {
-+        ret = vdc->pre_load_queues(vdev);
-+        if (ret) {
-+            return ret;
-+        }
-+    }
-+
-     num = qemu_get_be32(f);
- 
-     if (num > VIRTIO_QUEUE_MAX) {
-diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
-index 0fcbc5c0c6..953dfca27c 100644
---- a/include/hw/virtio/virtio.h
-+++ b/include/hw/virtio/virtio.h
-@@ -210,6 +210,8 @@ struct VirtioDeviceClass {
-     void (*guest_notifier_mask)(VirtIODevice *vdev, int n, bool mask);
-     int (*start_ioeventfd)(VirtIODevice *vdev);
-     void (*stop_ioeventfd)(VirtIODevice *vdev);
-+    /* Called before loading queues. Useful to add queues before loading. */
-+    int (*pre_load_queues)(VirtIODevice *vdev);
-     /* Saving and loading of a device; trying to deprecate save/load
-      * use vmsd for new devices.
-      */
--- 
-2.39.3
-
diff --git a/kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch b/kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch
deleted file mode 100644
index 632c5aa..0000000
--- a/kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From a7cd7f5b3bd6df30e75532fb19b645c5349f6183 Mon Sep 17 00:00:00 2001
-From: Shaoqin Huang <shahuang@redhat.com>
-Date: Thu, 24 Apr 2025 04:48:29 -0400
-Subject: [PATCH 1/5] virtio-net: disable USO for virt-rhel9.6
-
-RH-Author: Shaoqin Huang <shahuang@redhat.com>
-RH-MergeRequest: 353: virtio-net: disable USO for virt-rhel9.6
-RH-Jira: RHEL-80313
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Commit: [1/2] c7099480e656106219040d45ce7b76b19376227a (shahuang/qemu-kvm)
-
-JIRA: https://issues.redhat.com/browse/RHEL-80313
-Upstream Status: RHEL only
-
-RHEL9 kernels have USO* disabled while RHEL10 has it enabled, this can
-cause the migration to fail when running a RHEL9 qemu on a RHEL10 kernel
-and then migrate to a RHEL9 kernel.
-
-Make sure the virt-rhel9.6 machine type in RHEL9 stay the same
-independent of the kernel.
-
-Signed-off-by: Shaoqin Huang <shahuang@redhat.com>
----
- hw/arm/virt.c              |  3 +++
- hw/core/machine.c          | 15 +++++++++------
- hw/i386/pc_piix.c          |  1 +
- hw/i386/pc_q35.c           |  3 +++
- hw/s390x/s390-virtio-ccw.c |  2 ++
- include/hw/boards.h        |  3 +++
- 6 files changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index c5270a5abc..896deaa025 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3600,6 +3600,9 @@ DEFINE_VIRT_MACHINE(2, 6)
- static void virt_rhel_machine_9_6_0_options(MachineClass *mc)
- {
-     compat_props_add(mc->compat_props, arm_rhel9_compat, arm_rhel9_compat_len);
-+
-+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
- }
- DEFINE_VIRT_MACHINE_AS_LATEST(9, 6, 0)
- 
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index add42660f8..37751f6b9b 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -305,6 +305,15 @@ GlobalProperty hw_compat_2_1[] = {
- };
- const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
- 
-+/* Apply this to all RHEL9 boards going backward and forward */
-+GlobalProperty hw_compat_rhel_9[] = {
-+    /* supported by userspace, but RHEL 9 *kernels* do not support USO. */
-+    { TYPE_VIRTIO_NET, "host_uso", "off"},
-+    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
-+    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
-+};
-+const size_t hw_compat_rhel_9_len = G_N_ELEMENTS(hw_compat_rhel_9);
-+
- /*
-  * RHEL only: machine types for previous major releases are deprecated
-  */
-@@ -341,12 +350,6 @@ GlobalProperty hw_compat_rhel_9_5[] = {
- const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
- 
- GlobalProperty hw_compat_rhel_9_4[] = {
--  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
--    { TYPE_VIRTIO_NET, "host_uso", "off"},
--  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
--    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
--  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
--    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
-   /* hw_compat_rhel_9_4 from hw_compat_8_1 */
-      { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
-   /* hw_compat_rhel_9_4 from hw_compat_8_1 */
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 656abb5d39..10764bf596 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -929,6 +929,7 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
-     compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-     compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
- }
- 
- DEFINE_I440FX_MACHINE(7, 6, 0);
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 578f63524f..5bf08be0fb 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -679,6 +679,9 @@ static void pc_q35_rhel_machine_9_6_0_options(MachineClass *m)
-     m->desc = "RHEL-9.6.0 PC (Q35 + ICH9, 2009)";
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.6.0";
-+
-+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
-+    compat_props_add(m->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
- }
- 
- DEFINE_Q35_MACHINE_BUGFIX(9, 6, 0);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 9f4ad01789..312e8f18aa 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1348,6 +1348,8 @@ static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
- 
- static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
- {
-+    /* NB: remember to move this line to the *latest* RHEL 9 machine */
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9, hw_compat_rhel_9_len);
- }
- DEFINE_CCW_MACHINE_AS_LATEST(9, 6, 0);
- 
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index fe011b1e86..8f3fa40cf9 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -803,6 +803,9 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_9[];
-+extern const size_t hw_compat_rhel_9_len;
-+
- extern GlobalProperty hw_compat_rhel_9_6[];
- extern const size_t hw_compat_rhel_9_6_len;
- 
--- 
-2.48.1
-
diff --git a/kvm-virtio-net-vhost-user-Implement-internal-migration.patch b/kvm-virtio-net-vhost-user-Implement-internal-migration.patch
deleted file mode 100644
index 50fdaca..0000000
--- a/kvm-virtio-net-vhost-user-Implement-internal-migration.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-From f73b4e686c289ef6409c945d16582af16d2c28fc Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Wed, 15 Jan 2025 14:50:44 +0100
-Subject: [PATCH 3/3] virtio-net: vhost-user: Implement internal migration
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 337: virtio-net: vhost-user: Implement internal migration
-RH-Jira: RHEL-78372
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/2] 5832e25e230407a36022318a2a1e0d4f6f54bb92 (lvivier/qemu-kvm-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-78372
-
-Add support of VHOST_USER_PROTOCOL_F_DEVICE_STATE in virtio-net
-with vhost-user backend.
-
-Cc: Hanna Czenczek <hreitz@redhat.com>
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Message-Id: <20250115135044.799698-3-lvivier@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 60f543ad917fad731e39ff8ce2ca83b9a9cc9d90)
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
----
- hw/net/virtio-net.c | 105 ++++++++++++++++++++++++++++++++++++++++----
- 1 file changed, 97 insertions(+), 8 deletions(-)
-
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index 90d05f94d4..3d2b2460ad 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -3305,6 +3305,102 @@ static const VMStateDescription vmstate_virtio_net_rss = {
-     },
- };
- 
-+static struct vhost_dev *virtio_net_get_vhost(VirtIODevice *vdev)
-+{
-+    VirtIONet *n = VIRTIO_NET(vdev);
-+    NetClientState *nc = qemu_get_queue(n->nic);
-+    struct vhost_net *net = get_vhost_net(nc->peer);
-+    return &net->dev;
-+}
-+
-+static int vhost_user_net_save_state(QEMUFile *f, void *pv, size_t size,
-+                                     const VMStateField *field,
-+                                     JSONWriter *vmdesc)
-+{
-+    VirtIONet *n = pv;
-+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
-+    struct vhost_dev *vhdev;
-+    Error *local_error = NULL;
-+    int ret;
-+
-+    vhdev = virtio_net_get_vhost(vdev);
-+    if (vhdev == NULL) {
-+        error_reportf_err(local_error,
-+                          "Error getting vhost back-end of %s device %s: ",
-+                          vdev->name, vdev->parent_obj.canonical_path);
-+        return -1;
-+    }
-+
-+    ret = vhost_save_backend_state(vhdev, f, &local_error);
-+    if (ret < 0) {
-+        error_reportf_err(local_error,
-+                          "Error saving back-end state of %s device %s: ",
-+                          vdev->name, vdev->parent_obj.canonical_path);
-+        return ret;
-+    }
-+
-+    return 0;
-+}
-+
-+static int vhost_user_net_load_state(QEMUFile *f, void *pv, size_t size,
-+                                     const VMStateField *field)
-+{
-+    VirtIONet *n = pv;
-+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
-+    struct vhost_dev *vhdev;
-+    Error *local_error = NULL;
-+    int ret;
-+
-+    vhdev = virtio_net_get_vhost(vdev);
-+    if (vhdev == NULL) {
-+        error_reportf_err(local_error,
-+                          "Error getting vhost back-end of %s device %s: ",
-+                          vdev->name, vdev->parent_obj.canonical_path);
-+        return -1;
-+    }
-+
-+    ret = vhost_load_backend_state(vhdev, f, &local_error);
-+    if (ret < 0) {
-+        error_reportf_err(local_error,
-+                          "Error loading  back-end state of %s device %s: ",
-+                          vdev->name, vdev->parent_obj.canonical_path);
-+        return ret;
-+    }
-+
-+    return 0;
-+}
-+
-+static bool vhost_user_net_is_internal_migration(void *opaque)
-+{
-+    VirtIONet *n = opaque;
-+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
-+    struct vhost_dev *vhdev;
-+
-+    vhdev = virtio_net_get_vhost(vdev);
-+    if (vhdev == NULL) {
-+        return false;
-+    }
-+
-+    return vhost_supports_device_state(vhdev);
-+}
-+
-+static const VMStateDescription vhost_user_net_backend_state = {
-+    .name = "virtio-net-device/backend",
-+    .version_id = 0,
-+    .needed = vhost_user_net_is_internal_migration,
-+    .fields = (const VMStateField[]) {
-+        {
-+            .name = "backend",
-+            .info = &(const VMStateInfo) {
-+                .name = "virtio-net vhost-user backend state",
-+                .get = vhost_user_net_load_state,
-+                .put = vhost_user_net_save_state,
-+            },
-+         },
-+         VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static const VMStateDescription vmstate_virtio_net_device = {
-     .name = "virtio-net-device",
-     .version_id = VIRTIO_NET_VM_VERSION,
-@@ -3357,6 +3453,7 @@ static const VMStateDescription vmstate_virtio_net_device = {
-     },
-     .subsections = (const VMStateDescription * const []) {
-         &vmstate_virtio_net_rss,
-+        &vhost_user_net_backend_state,
-         NULL
-     }
- };
-@@ -3902,14 +3999,6 @@ static bool dev_unplug_pending(void *opaque)
-     return vdc->primary_unplug_pending(dev);
- }
- 
--static struct vhost_dev *virtio_net_get_vhost(VirtIODevice *vdev)
--{
--    VirtIONet *n = VIRTIO_NET(vdev);
--    NetClientState *nc = qemu_get_queue(n->nic);
--    struct vhost_net *net = get_vhost_net(nc->peer);
--    return &net->dev;
--}
--
- static const VMStateDescription vmstate_virtio_net = {
-     .name = "virtio-net",
-     .minimum_version_id = VIRTIO_NET_VM_VERSION,
--- 
-2.48.1
-
diff --git a/kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch b/kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
deleted file mode 100644
index c0fc2c4..0000000
--- a/kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 621bad5cbfd7585f7bcef8bb4fcb17ab7ba52baa Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 27 Aug 2024 15:27:51 -0400
-Subject: [PATCH 4/4] vl: use qmp_device_add() in qemu_create_cli_devices()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 316: qdev-monitor: avoid QemuOpts in QMP device_add
-RH-Jira: RHEL-39948
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [4/4] e653aca40742b262e36e4d8dc554a54235e40e99 (stefanha/centos-stream-qemu-kvm)
-
-qemu_create_cli_devices() should use qmp_device_add() to match the
-behavior of the QMP monitor. A comment explained that libvirt changes
-implementing strict CLI syntax were needed.
-
-Peter Krempa <pkrempa@redhat.com> has confirmed that modern libvirt uses
-the same JSON for -device (CLI) and device_add (QMP). Go ahead and use
-qmp_device_add().
-
-Cc: Peter Krempa <pkrempa@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240827192751.948633-3-stefanha@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 11bf1d6aa06138e93b274e942d6992af63ffc510)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- system/vl.c | 14 ++++----------
- 1 file changed, 4 insertions(+), 10 deletions(-)
-
-diff --git a/system/vl.c b/system/vl.c
-index 5359231bf5..900d471f5e 100644
---- a/system/vl.c
-+++ b/system/vl.c
-@@ -2661,17 +2661,11 @@ static void qemu_create_cli_devices(void)
-     qemu_opts_foreach(qemu_find_opts("device"),
-                       device_init_func, NULL, &error_fatal);
-     QTAILQ_FOREACH(opt, &device_opts, next) {
--        DeviceState *dev;
-+        QObject *ret_data = NULL;
-+
-         loc_push_restore(&opt->loc);
--        /*
--         * TODO Eventually we should call qmp_device_add() here to make sure it
--         * behaves the same, but QMP still has to accept incorrectly typed
--         * options until libvirt is fixed and we want to be strict on the CLI
--         * from the start, so call qdev_device_add_from_qdict() directly for
--         * now.
--         */
--        dev = qdev_device_add_from_qdict(opt->opts, true, &error_fatal);
--        object_unref(OBJECT(dev));
-+        qmp_device_add(opt->opts, &ret_data, &error_fatal);
-+        assert(ret_data == NULL); /* error_fatal aborts */
-         loc_pop(&opt->loc);
-     }
-     rom_reset_order_override();
--- 
-2.39.3
-
diff --git a/kvm-vnc-fix-crash-when-no-console-attached.patch b/kvm-vnc-fix-crash-when-no-console-attached.patch
deleted file mode 100644
index 39d808a..0000000
--- a/kvm-vnc-fix-crash-when-no-console-attached.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From b38e94f0f0d45f8edd30828d4bb620430e604048 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Tue, 20 Aug 2024 17:11:12 +0400
-Subject: [PATCH 10/10] vnc: fix crash when no console attached
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 300: vnc: fix crash when no console attached
-RH-Jira: RHEL-61633
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 91fc70408701fa1e20ed8fefb8cdf424451dcc20 (marcandre.lureau-rh/qemu-kvm-centos)
-
-JIRA: https://issues.redhat.com/browse/RHEL-61633
-
-Since commit e99441a3793b5 ("ui/curses: Do not use console_select()")
-qemu_text_console_put_keysym() no longer checks for NULL console
-argument, which leads to a later crash:
-
-Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
-0x00005555559ee186 in qemu_text_console_handle_keysym (s=0x0, keysym=31) at ../ui/console-vc.c:332
-332	        } else if (s->echo && (keysym == '\r' || keysym == '\n')) {
-(gdb) bt
- #0  0x00005555559ee186 in qemu_text_console_handle_keysym (s=0x0, keysym=31) at ../ui/console-vc.c:332
- #1  0x00005555559e18e5 in qemu_text_console_put_keysym (s=<optimized out>, keysym=<optimized out>) at ../ui/console.c:303
- #2  0x00005555559f2e88 in do_key_event (vs=vs@entry=0x5555579045c0, down=down@entry=1, keycode=keycode@entry=60, sym=sym@entry=65471) at ../ui/vnc.c:2034
- #3  0x00005555559f845c in ext_key_event (vs=0x5555579045c0, down=1, sym=65471, keycode=<optimized out>) at ../ui/vnc.c:2070
- #4  protocol_client_msg (vs=0x5555579045c0, data=<optimized out>, len=<optimized out>) at ../ui/vnc.c:2514
- #5  0x00005555559f515c in vnc_client_read (vs=0x5555579045c0) at ../ui/vnc.c:1607
-
-Fixes: e99441a3793b5 ("ui/curses: Do not use console_select()")
-Fixes: https://issues.redhat.com/browse/RHEL-50529
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-
-(cherry picked from commit 0e60fc80938d9ce84274a36ddfaaa640bdef2be8)
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----
- ui/vnc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ui/vnc.c b/ui/vnc.c
-index dae5d51210..5057ec8680 100644
---- a/ui/vnc.c
-+++ b/ui/vnc.c
-@@ -1935,7 +1935,7 @@ static void do_key_event(VncState *vs, int down, int keycode, int sym)
-     }
- 
-     qkbd_state_key_event(vs->vd->kbd, qcode, down);
--    if (!qemu_console_is_graphic(vs->vd->dcl.con)) {
-+    if (QEMU_IS_TEXT_CONSOLE(vs->vd->dcl.con)) {
-         QemuTextConsole *con = QEMU_TEXT_CONSOLE(vs->vd->dcl.con);
-         bool numlock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK);
-         bool control = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL);
--- 
-2.39.3
-
diff --git a/qemu-kvm.spec b/qemu-kvm.spec
index 981ceac..5e36cfc 100644
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@@ -148,8 +148,8 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
-Version: 9.1.0
-Release: 29%{?rcrel}%{?dist}%{?cc_suffix}
+Version: 10.1.0
+Release: 1%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@@ -172,1033 +172,675 @@ Source28: 95-kvm-memlock.conf
 Source30: kvm-s390x.conf
 Source31: kvm-x86.conf
 Source36: README.tests
+Patch1: 0001-Initial-redhat-build.patch
+Patch2: 0002-Enable-disable-devices-for-RHEL.patch
+Patch3: 0003-Machine-type-related-general-changes.patch
+Patch4: 0004-meson-temporarily-disable-Wunused-function.patch
+Patch5: 0005-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
+Patch6: 0006-Adapt-versioned-machine-type-macros-for-RHEL.patch
+Patch7: 0007-Increase-deletion-schedule-to-3-releases.patch
+Patch8: 0008-Add-downstream-aarch64-versioned-virt-machine-types.patch
+Patch9: 0009-Add-downstream-ppc64-versioned-spapr-machine-types.patch
+Patch10: 0010-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
+Patch11: 0011-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
+Patch12: 0012-Revert-meson-temporarily-disable-Wunused-function.patch
+Patch13: 0013-Enable-make-check.patch
+Patch14: 0014-vfio-cap-number-of-devices-that-can-be-assigned.patch
+Patch15: 0015-Add-support-statement-to-help-output.patch
+Patch16: 0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+Patch17: 0017-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+Patch18: 0018-redhat-allow-5-level-paging-for-TDX-VMs.patch
+Patch19: 0019-Add-upstream-compat-bits.patch
+Patch20: 0020-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
+Patch21: 0021-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
+Patch22: 0022-Revert-hw-s390x-s390-virtio-ccw-Remove-the-deprecate.patch
+Patch23: 0023-redhat-Fix-rhel7.6.0-machine-type.patch
+Patch24: 0024-redhat-Compatibility-handling-for-the-s390-ccw-virti.patch
+Patch25: 0025-redhat-Add-new-s390-ccw-virtio-rhel9.8.0-machine-typ.patch
+Patch26: 0026-hw-core-machine-rhel-machine-types-compat-fix.patch
+Patch27: 0027-arm-rhel-machine-type-compat-fix.patch
+Patch28: 0028-target-i386-add-compatibility-property-for-arch_capa.patch
+Patch29: 0029-target-i386-add-compatibility-property-for-pdcm-feat.patch
+Patch30: 0030-arm-create-new-virt-machine-type-for-rhel-9.8.patch
 
 
-Patch0004: 0004-Initial-redhat-build.patch
-Patch0005: 0005-Enable-disable-devices-for-RHEL.patch
-Patch0006: 0006-Machine-type-related-general-changes.patch
-Patch0007: 0007-meson-temporarily-disable-Wunused-function.patch
-Patch0008: 0008-Remove-upstream-machine-type-versions-for-aarch64-s3.patch
-Patch0009: 0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
-Patch0010: 0010-Increase-deletion-schedule-to-3-releases.patch
-Patch0011: 0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
-Patch0012: 0012-Add-downstream-ppc64-versioned-spapr-machine-types.patch
-Patch0013: 0013-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
-Patch0014: 0014-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
-Patch0015: 0015-Revert-meson-temporarily-disable-Wunused-function.patch
-Patch0016: 0016-Enable-make-check.patch
-Patch0017: 0017-vfio-cap-number-of-devices-that-can-be-assigned.patch
-Patch0018: 0018-Add-support-statement-to-help-output.patch
-Patch0019: 0019-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
-Patch0020: 0020-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-Patch0021: 0021-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
-Patch0023: 0023-Add-upstream-compatibility-bits.patch
-Patch0024: 0024-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
-Patch0025: 0025-redhat-Add-rhel9.6.0-machine-type.patch
-Patch0026: 0026-x86-ensure-compatibility-of-pc-q35-rhel9-and-pc-i440.patch
-Patch0027: 0027-arm-ensure-compatibility-of-virt-rhel9.patch
-Patch0028: 0028-arm-create-new-virt-machine-type-for-rhel-9.6.patch
-Patch0029: 0029-x86-create-new-pc-q35-machine-type-for-rhel-9.6.patch
-Patch0030: 0030-hw-arm-virt-Fix-Manufacturer-and-Product-Name-in-emu.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch31: kvm-hw-s390x-ipl-Provide-more-memory-to-the-s390-ccw.img.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch32: kvm-pc-bios-s390-ccw-Use-the-libc-from-SLOF-and-remove-s.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch33: kvm-pc-bios-s390-ccw-Link-the-netboot-code-into-the-main.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch35: kvm-hw-s390x-Remove-the-possibility-to-load-the-s390-net.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch36: kvm-pc-bios-s390-ccw-Merge-netboot.mak-into-the-main-Mak.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch37: kvm-docs-system-s390x-bootdevices-Update-the-documentati.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch38: kvm-pc-bios-s390-ccw-Remove-panics-from-ISO-IPL-path.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch39: kvm-pc-bios-s390-ccw-Remove-panics-from-ECKD-IPL-path.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch40: kvm-pc-bios-s390-ccw-Remove-panics-from-SCSI-IPL-path.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch41: kvm-pc-bios-s390-ccw-Remove-panics-from-DASD-IPL-path.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch42: kvm-pc-bios-s390-ccw-Remove-panics-from-Netboot-IPL-path.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch43: kvm-pc-bios-s390-ccw-Enable-failed-IPL-to-return-after-e.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch44: kvm-include-hw-s390x-Add-include-files-for-common-IPL-st.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch45: kvm-s390x-Add-individual-loadparm-assignment-to-CCW-devi.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch46: kvm-hw-s390x-Build-an-IPLB-for-each-boot-device.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch47: kvm-s390x-Rebuild-IPLB-for-SCSI-device-directly-from-DIA.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch48: kvm-pc-bios-s390x-Enable-multi-device-boot-loop.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch49: kvm-docs-system-Update-documentation-for-s390x-IPL.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch50: kvm-tests-qtest-Add-s390x-boot-order-tests-to-cdrom-test.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch51: kvm-pc-bios-s390-ccw-Clarify-alignment-is-in-bytes.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch52: kvm-pc-bios-s390-ccw-Don-t-generate-TEXTRELs.patch
 # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part
-Patch53: kvm-pc-bios-s390-ccw-Introduce-EXTRA_LDFLAGS.patch
 # For RHEL-64307 - High threshold value observed in vGPU live migration
-Patch54: kvm-vfio-migration-Report-only-stop-copy-size-in-vfio_st.patch
 # For RHEL-64307 - High threshold value observed in vGPU live migration
-Patch55: kvm-vfio-migration-Change-trace-formats-from-hex-to-deci.patch
 # For RHEL-60914 - Fail migration properly when put cpu register fails
-Patch56: kvm-kvm-Allow-kvm_arch_get-put_registers-to-accept-Error.patch
 # For RHEL-60914 - Fail migration properly when put cpu register fails
-Patch57: kvm-target-i386-kvm-Report-which-action-failed-in-kvm_ar.patch
 # For RHEL-11043 - [RFE] [HPEMC] [RHEL-9.6] qemu-kvm: support up to 4096 VCPUs
-Patch58: kvm-pc-q35-Bump-max_cpus-to-4096-vcpus.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch59: kvm-kvm-replace-fprintf-with-error_report-printf-in-kvm_.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch60: kvm-kvm-refactor-core-virtual-machine-creation-into-its-.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch61: kvm-accel-kvm-refactor-dirty-ring-setup.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch62: kvm-KVM-Dynamic-sized-kvm-memslots-array.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch63: kvm-KVM-Define-KVM_MEMSLOTS_NUM_MAX_DEFAULT.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch64: kvm-KVM-Rename-KVMMemoryListener.nr_used_slots-to-nr_slo.patch
 # For RHEL-57682 - Bad migration performance when performing vGPU VM live migration 
-Patch65: kvm-KVM-Rename-KVMState-nr_slots-to-nr_slots_max.patch
 # For RHEL-67844 - qemu crashed after killed virtiofsd during migration
-Patch66: kvm-migration-Ensure-vmstate_save-sets-errp.patch
 # For RHEL-67935 - QEMU should fail gracefully with passthrough devices in SEV-SNP guests
-Patch67: kvm-vfio-container-Fix-container-object-destruction.patch
 # For RHEL-68289 - [RHEL-9.6] QEMU core dump on applying merge property to memory backend
-Patch68: kvm-hostmem-Apply-merge-property-after-the-memory-region.patch
 # For RHEL-69477 - qemu crashed when migrate vm with multiqueue from rhel9.4 to rhel9.6
-Patch69: kvm-virtio-net-Add-queues-before-loading-them.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch70: kvm-docs-system-s390x-bootdevices-Update-loadparm-docume.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch71: kvm-docs-system-bootindex-Make-it-clear-that-s390x-can-a.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch72: kvm-hw-s390x-Restrict-loadparm-property-to-devices-that-.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch73: kvm-hw-Add-loadparm-property-to-scsi-disk-devices-for-bo.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch74: kvm-scsi-fix-allocation-for-s390x-loadparm.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch75: kvm-pc-bios-s390x-Initialize-cdrom-type-to-false-for-eac.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch76: kvm-pc-bios-s390x-Initialize-machine-loadparm-before-pro.patch
 # For RHEL-68440 - The new "boot order" feature is sometimes not working as expected [RHEL 9]
-Patch77: kvm-pc-bios-s390-ccw-Re-initialize-receive-queue-index-b.patch
 # For RHEL-61633 - Qemu-kvm  crashed  if  no display device setting and switching display by remote-viewer [rhel-9]
-Patch78: kvm-vnc-fix-crash-when-no-console-attached.patch
 # For RHEL-66089 - warning: fd: migration to a file is deprecated when create or revert a snapshot
-Patch79: kvm-migration-Allow-pipes-to-keep-working-for-fd-migrati.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch80: kvm-linux-headers-Update-to-Linux-v6.12-rc5.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch81: kvm-s390x-cpumodel-add-msa10-subfunctions.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch82: kvm-s390x-cpumodel-add-msa11-subfunctions.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch83: kvm-s390x-cpumodel-add-msa12-changes.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch84: kvm-s390x-cpumodel-add-msa13-subfunctions.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch85: kvm-s390x-cpumodel-Add-ptff-Query-Time-Stamp-Event-QTSE-.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch86: kvm-linux-headers-Update-to-Linux-6.13-rc1.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch87: kvm-s390x-cpumodel-add-Concurrent-functions-facility-sup.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch88: kvm-s390x-cpumodel-add-Vector-Enhancements-facility-3.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch89: kvm-s390x-cpumodel-add-Miscellaneous-Instruction-Extensi.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch90: kvm-s390x-cpumodel-add-Vector-Packed-Decimal-Enhancement.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch91: kvm-s390x-cpumodel-add-Ineffective-nonconstrained-transa.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch92: kvm-s390x-cpumodel-Add-Sequential-Instruction-Fetching-f.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch93: kvm-s390x-cpumodel-correct-PLO-feature-wording.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch94: kvm-s390x-cpumodel-Add-PLO-extension-facility.patch
 # For RHEL-50212 - [IBM 9.6 FEAT] KVM: CPU model for new IBM Z HW - qemu part
-Patch95: kvm-s390x-cpumodel-gen17-model.patch
 # For RHEL-71940 - qemu-ga cannot freeze filesystems with sentinelone
-Patch96: kvm-qga-skip-bind-mounts-in-fs-list.patch
 # For RHEL-27832 - The post-copy migration of RT-VM leads to race while accessing vhost-user device and hung/stalled target VM
-Patch97: kvm-vhost-fail-device-start-if-iotlb-update-fails.patch
 # For RHEL-67107 - [aarch64] [rhel-9.6] Backport some important post 9.1 qemu fixes
-Patch98: kvm-hw-char-pl011-Use-correct-masks-for-IBRD-and-FBRD.patch
 # For RHEL-39948 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-9.5]
-Patch99: kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch
 # For RHEL-39948 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-9.5]
-Patch100: kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch
 # For RHEL-39948 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-9.5]
-Patch101: kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch
 # For RHEL-39948 - qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-9.5]
-Patch102: kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch
 # For RHEL-53073 - kvm-unti kvm-hyperv_synic test is stuck on AMD with COS9
-Patch103: kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch
 # For RHEL-73688 - VM crashes when requesting domstats
-Patch104: kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch
 # For RHEL-52278 - fsfreeze hooks doesn't log error on system logs when running hook fails
-Patch105: kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch
 # For RHEL-56340 - qemu-ga logs only "guest-fsfreeze called" (but not "guest-fsthaw called")
-Patch106: kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch
 # For RHEL-65616 - Failed to hot add PCIe device behind xio3130 downstream port
-Patch107: kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch108: kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch109: kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch110: kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch111: kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch112: kvm-target-i386-add-CPUID.24-features-for-AVX10.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch113: kvm-target-i386-Add-feature-dependencies-for-AVX10.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch114: kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch115: kvm-target-i386-Introduce-GraniteRapids-v2-model.patch
 # For RHEL-30316 - [Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support
 # For RHEL-45111 - [Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4
-Patch116: kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch
 # For RHEL-75782 - [Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10
-Patch117: kvm-arm-disable-pauth-for-virt-rhel9.patch
 # For RHEL-75782 - [Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10
-Patch118: kvm-tests-qtest-disable-most-pauth-tests.patch
 # For RHEL-72716 - Boot fall back to cdrom from network not always working
-Patch119: kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch
 # For RHEL-72716 - Boot fall back to cdrom from network not always working
-Patch120: kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch
 # For RHEL-72716 - Boot fall back to cdrom from network not always working
-Patch121: kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch
 # For RHEL-72716 - Boot fall back to cdrom from network not always working
-Patch122: kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch
 # For RHEL-67863 - Ensure qemu as NBD server does not flood logs [rhel 9.6]
-Patch123: kvm-nbd-server-Silence-server-warnings-on-port-probes.patch
 # For RHEL-78372 - Add vhost-user internal migration for passt [rhel-9]
-Patch124: kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch
 # For RHEL-78372 - Add vhost-user internal migration for passt [rhel-9]
-Patch125: kvm-virtio-net-vhost-user-Implement-internal-migration.patch
 # For RHEL-73891 - No RARP packets on the destination after migration [rhel-9.6]
-Patch126: kvm-net-Fix-announce_self.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch127: kvm-migration-Add-helper-to-get-target-runstate.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch128: kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch129: kvm-migration-block-Make-late-block-active-the-default.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch130: kvm-migration-block-Apply-late-block-active-behavior-to-.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch131: kvm-migration-block-Fix-possible-race-with-block_inactiv.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch132: kvm-migration-block-Rewrite-disk-activation.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch133: kvm-block-Add-active-field-to-BlockDeviceInfo.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch134: kvm-block-Allow-inactivating-already-inactive-nodes.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch135: kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch136: kvm-migration-block-active-Remove-global-active-flag.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch137: kvm-block-Don-t-attach-inactive-child-to-active-node.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch138: kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch139: kvm-block-Add-option-to-create-inactive-nodes.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch140: kvm-block-Add-blockdev-set-active-QMP-command.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch141: kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch142: kvm-block-export-Don-t-ignore-image-activation-error-in-.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch143: kvm-block-Drain-nodes-before-inactivating-them.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch144: kvm-block-export-Add-option-to-allow-export-of-inactive-.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch145: kvm-nbd-server-Support-inactive-nodes.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch146: kvm-iotests-Add-filter_qtest.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch147: kvm-iotests-Add-qsd-migrate-case.patch
 # For RHEL-54296 - Provide QMP command for block device reactivation after migration [rhel-9.5]
 # For RHEL-78397 - backport fix for double migration of a paused VM (disk activation rewrite)
-Patch148: kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch
 # For RHEL-7188 - [intel iommu][PF] DMAR: DRHD: handling fault status reg
-Patch149: kvm-hw-virtio-virtio-iommu-Migrate-to-3-phase-reset.patch
 # For RHEL-7188 - [intel iommu][PF] DMAR: DRHD: handling fault status reg
-Patch150: kvm-hw-i386-intel-iommu-Migrate-to-3-phase-reset.patch
 # For RHEL-7188 - [intel iommu][PF] DMAR: DRHD: handling fault status reg
-Patch151: kvm-hw-arm-smmuv3-Move-reset-to-exit-phase.patch
 # For RHEL-7188 - [intel iommu][PF] DMAR: DRHD: handling fault status reg
-Patch152: kvm-hw-vfio-common-Add-a-trace-point-in-vfio_reset_handl.patch
 # For RHEL-7188 - [intel iommu][PF] DMAR: DRHD: handling fault status reg
-Patch153: kvm-docs-devel-reset-Document-reset-expectations-for-DMA.patch
 # For RHEL-69622 - [qemu-guest-agent][RFE] Report CPU load average
-Patch154: kvm-qga-implement-a-guest-get-load-command.patch
 # For RHEL-69775 - Guest crashed on the target host when the migration was canceled
-Patch155: kvm-migration-Fix-UAF-for-incoming-migration-on-Migratio.patch
 # For RHEL-47340 - [Qemu RHEL-9] qemu-trace-stap should handle lack of stap more gracefully
-Patch156: kvm-scripts-improve-error-from-qemu-trace-stap-on-missin.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch157: kvm-hw-pci-Rename-has_power-to-enabled.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch158: kvm-hw-pci-Basic-support-for-PCI-power-management.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch159: kvm-pci-Use-PCI-PM-capability-initializer.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch160: kvm-vfio-pci-Delete-local-pm_cap.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch161: kvm-pcie-virtio-Remove-redundant-pm_cap.patch
 # For RHEL-7301 - [intel iommu] VFIO_MAP_DMA failed: Bad address on system_powerdown
-Patch162: kvm-hw-vfio-pci-Re-order-pre-reset.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch163: kvm-virtio-kconfig-memory-devices-are-PCI-only.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch164: kvm-hw-s390-ccw-device-Convert-to-three-phase-reset.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch165: kvm-hw-s390-virtio-ccw-Convert-to-three-phase-reset.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch166: kvm-target-s390-Convert-CPU-to-Resettable-interface.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch167: kvm-reset-Use-ResetType-for-qemu_devices_reset-and-Machi.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch168: kvm-reset-Add-RESET_TYPE_WAKEUP.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch169: kvm-virtio-mem-Use-new-Resettable-framework-instead-of-L.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch170: kvm-virtio-mem-Add-support-for-suspend-wake-up-with-plug.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch171: kvm-virtio-mem-unplug-memory-only-during-system-resets-n.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch172: kvm-s390x-s390-virtio-ccw-don-t-crash-on-weird-RAM-sizes.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch173: kvm-s390x-s390-virtio-hcall-remove-hypercall-registratio.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch174: kvm-s390x-s390-virtio-hcall-prepare-for-more-diag500-hyp.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch175: kvm-s390x-rename-s390-virtio-hcall-to-s390-hypercall.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch176: kvm-s390x-s390-virtio-ccw-move-setting-the-maximum-guest.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch177: kvm-s390x-introduce-s390_get_memory_limit.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch178: kvm-s390x-s390-hypercall-introduce-DIAG500-STORAGE_LIMIT.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch179: kvm-s390x-s390-stattrib-kvm-prepare-for-memory-devices-a.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch180: kvm-s390x-s390-skeys-prepare-for-memory-devices.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch181: kvm-s390x-s390-virtio-ccw-prepare-for-memory-devices.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch182: kvm-s390x-pv-prepare-for-memory-devices.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch183: kvm-s390x-remember-the-maximum-page-size.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch184: kvm-s390x-virtio-ccw-add-support-for-virtio-based-memory.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch185: kvm-s390x-virtio-mem-support.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch186: kvm-hw-virtio-Also-include-md-stubs-in-case-CONFIG_VIRTI.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch187: kvm-virtio-mem-don-t-warn-about-THP-sizes-on-a-kernel-wi.patch
 # For RHEL-72977 - [IBM 9.7 FEAT] KVM: Enable virtio-mem support - qemu part
-Patch188: kvm-redhat-Enable-virtio-mem-on-s390x.patch
 # For RHEL-7130 - [Hyper-V][RHEL9.2] Nested Hyper-V on KVM: L1 Windows VM with BIOS mode fails to boot up when using '-cpu host,hv_passthrough’ flag
-Patch189: kvm-target-i386-Fix-conditional-CONFIG_SYNDBG-enablement.patch
 # For RHEL-7130 - [Hyper-V][RHEL9.2] Nested Hyper-V on KVM: L1 Windows VM with BIOS mode fails to boot up when using '-cpu host,hv_passthrough’ flag
-Patch190: kvm-target-i386-Exclude-hv-syndbg-from-hv-passthrough.patch
 # For RHEL-80313 - Unable to migrate VM from RHEL10.0/qemu-kvm-9.6 to RHEL9.6/qemu-kvm-9.6
-Patch191: kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch
 # For RHEL-80313 - Unable to migrate VM from RHEL10.0/qemu-kvm-9.6 to RHEL9.6/qemu-kvm-9.6
-Patch192: kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch
 # For RHEL-86032 - QEMU sends unaligned discards on 4K devices [RHEL-9.7]
-Patch193: kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch
 # For RHEL-86032 - QEMU sends unaligned discards on 4K devices [RHEL-9.7]
-Patch194: kvm-block-io-skip-head-tail-requests-on-EINVAL.patch
 # For RHEL-86032 - QEMU sends unaligned discards on 4K devices [RHEL-9.7]
-Patch195: kvm-file-posix-Fix-crash-on-discard_granularity-0.patch
 # For RHEL-88153 - [s390x] valgrind not working with qemu-kvm for non-x86 builds
-Patch196: kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch
 # For RHEL-88153 - [s390x] valgrind not working with qemu-kvm for non-x86 builds
-Patch197: kvm-hw-i386-Fix-machine-type-compatibility.patch
 # For RHEL-88533 - Improve VFIO mmapping performance with  huge  pfnmaps
-Patch198: kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch
 # For RHEL-88533 - Improve VFIO mmapping performance with  huge  pfnmaps
-Patch199: kvm-vfio-helpers-Align-mmaps.patch
 # For RHEL-85159 - Video stuck about 1 min after switchover phase when play one video during postcopy-preempt migration
-Patch200: kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch
 # For RHEL-95120 - Allow libvirt to restart passt/vhost-user when the process is killed [rhel-9.7]
-Patch201: kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch
 # For RHEL-95408 - Support multipath failover with scsi-block [rhel-9]
-Patch202: kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch
 # For RHEL-95408 - Support multipath failover with scsi-block [rhel-9]
-Patch203: kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch
 # For RHEL-11430 - [IBM 9.7 FEAT] KVM: Performance Enhanced Refresh PCI Translation - qemu part
-Patch204: kvm-s390x-pci-add-support-for-guests-that-request-direct.patch
 # For RHEL-11430 - [IBM 9.7 FEAT] KVM: Performance Enhanced Refresh PCI Translation - qemu part
-Patch205: kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch206: kvm-block-Expand-block-status-mode-from-bool-to-flags.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch207: kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch208: kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch209: kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch210: kvm-iotests-Improve-iotest-194-to-mirror-data.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch211: kvm-mirror-Minor-refactoring.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch212: kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch213: kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch214: kvm-mirror-Drop-redundant-zero_target-parameter.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch215: kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch216: kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch217: kvm-iotests-common.rc-add-disk_usage-function.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch218: kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch
 # For RHEL-82906 - --migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7]
 # For RHEL-83015 - Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7]
-Patch219: kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch
 # For RHEL-98554 - [s390x][RHEL9.7.0][virtio_block] there would be memory leak with virtio_blk disks
-Patch220: kvm-s390x-Fix-leak-in-machine_set_loadparm.patch
 # For RHEL-98554 - [s390x][RHEL9.7.0][virtio_block] there would be memory leak with virtio_blk disks
-Patch221: kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch
 # For RHEL-66202 - [AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu
-Patch222: kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch
 # For RHEL-66202 - [AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu
-Patch223: kvm-amd_iommu-Add-support-for-pass-though-mode.patch
 # For RHEL-66202 - [AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu
-Patch224: kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch
 # For RHEL-66202 - [AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu
-Patch225: kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch
 # For RHEL-66202 - [AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu
-Patch226: kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch227: kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch228: kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch229: kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch230: kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch231: kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch232: kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch
 # For RHEL-67104 - postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S'
-Patch233: kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch234: kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch235: kvm-target-i386-Add-PerfMonV2-feature-bit.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch236: kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch237: kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch238: kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch239: kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch240: kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch
 # For RHEL-52649 - [AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model
-Patch241: kvm-target-i386-Add-support-for-EPYC-Turin-model.patch
 # For RHEL-70926 - Qemu/amd-iommu: Advertise a suitable device id
-Patch242: kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch
 # For RHEL-70925 - Qemu/amd-iommu: Add ability to manually specify the AMDVI-PCI device
-Patch243: kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch
 # For RHEL-70925 - Qemu/amd-iommu: Add ability to manually specify the AMDVI-PCI device
-Patch244: kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch
 # For RHEL-70925 - Qemu/amd-iommu: Add ability to manually specify the AMDVI-PCI device
-Patch245: kvm-Enable-amd-iommu-device.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch246: kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch247: kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch248: kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch249: kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch250: kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch251: kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch252: kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch253: kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch254: kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch255: kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch256: kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch257: kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch258: kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch259: kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch260: kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch261: kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch262: kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch263: kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch264: kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch265: kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch266: kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch267: kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch268: kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch269: kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch270: kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch271: kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch272: kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch273: kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch274: kvm-net-socket-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-99888 - -ftrivial-auto-var-init=zero reduced performance [rhel-9]
-Patch275: kvm-net-stream-skip-automatic-zero-init-of-large-array.patch
 # For RHEL-100741 - Video stuck after switchover phase when play one video during migration [rhel-9]
-Patch276: kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch
 # For RHEL-108726 - Openstack guest becomes inaccessible via network when storage network on the hypervisor is disabled/lost [rhel-9]
-Patch277: kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch278: kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch279: kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch280: kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch281: kvm-kvm-remove-unnecessary-ifdef.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch282: kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch283: kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch284: kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch285: kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch286: kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch287: kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch288: kvm-i386-topology-Introduce-helpers-for-various-topology.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch289: kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch290: kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch291: kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch292: kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch293: kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch294: kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch295: kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch296: kvm-target-i386-sev-Reduce-system-specific-declarations.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch297: kvm-physmem-replace-assertion-with-error.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch298: kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch299: kvm-qom-reverse-order-of-instance_post_init-calls.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch300: kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch301: kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch302: kvm-rocker-do-not-pollute-the-namespace.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch303: kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch304: kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch305: kvm-linux-headers-update-from-6.15-kvm-next.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch306: kvm-update-Linux-headers-to-v6.16-rc3.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch307: kvm-update-Linux-headers-to-KVM-tree-master.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch308: kvm-i386-Introduce-tdx-guest-object.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch309: kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch310: kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch311: kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch312: kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch313: kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch314: kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch315: kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch316: kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch317: kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch318: kvm-i386-tdx-Validate-TD-attributes.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch319: kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch320: kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch321: kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch322: kvm-i386-tdx-load-TDVF-for-TD-guest.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch323: kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch324: kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch325: kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch326: kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch327: kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch328: kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch329: kvm-i386-tdx-Setup-the-TD-HOB-list.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch330: kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch331: kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch332: kvm-i386-tdx-Finalize-TDX-VM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch333: kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch334: kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch335: kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch336: kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch337: kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch338: kvm-i386-tdx-implement-tdx_cpu_instance_init.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch339: kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch340: kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch341: kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch342: kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch343: kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch344: kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch345: kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch346: kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch347: kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch348: kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch349: kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch350: kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch351: kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch352: kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch353: kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch354: kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch355: kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch356: kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch357: kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch358: kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch359: kvm-i386-tdx-Make-invtsc-default-on.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch360: kvm-i386-tdx-Validate-phys_bits-against-host-value.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch361: kvm-docs-Add-TDX-documentation.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch362: kvm-i386-tdx-Fix-build-on-32-bit-host.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch363: kvm-i386-tdvf-Fix-build-on-32-bit-host.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch364: kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch365: kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch366: kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch367: kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch368: kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch369: kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch370: kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch371: kvm-target-i386-move-max_features-to-class.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch372: kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch373: kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch374: kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch375: kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch376: kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch377: kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch378: kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch379: kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch380: kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch381: kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch382: kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch383: kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch384: kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch385: kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch386: kvm-redhat-enable-CONFIG_TDX.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch387: kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch388: kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch389: kvm-memory-Change-memory_region_set_ram_discard_manager-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch390: kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch391: kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch
 # For RHEL-15710 - [Intel 9.7 FEAT] TDX: QEMU Support
 # For RHEL-20798 - [Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD
 # For RHEL-49728 - [Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock
-Patch392: kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch
 # For RHEL-17614 - VM reports Vulnerable to spec_rstack_overflow when reading status in '/sys/devices/system/cpu/vulnerabilities/'
-Patch393: kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch
 
 %if %{have_clang}
 BuildRequires: clang
@@ -1408,8 +1050,7 @@ Requires: %{name} = %{epoch}:%{version}-%{release}
 The %{name}-tests rpm contains tests that can be used to verify
 the functionality of the installed %{name} package
 
-Install this package if you want access to the avocado_qemu
-tests, or qemu-iotests.
+Install this package if you want access to the qemu tests or qemu-iotests.
 
 
 %package  block-blkio
@@ -1548,10 +1189,9 @@ ulimit -n 10240
 %define disable_everything         \\\
   --audio-drv-list=                \\\
   --disable-alsa                   \\\
+  --disable-asan                   \\\
   --disable-attr                   \\\
   --disable-auth-pam               \\\
-  --disable-avx2                   \\\
-  --disable-avx512bw               \\\
   --disable-blkio                  \\\
   --disable-block-drv-whitelist-in-tools \\\
   --disable-bochs                  \\\
@@ -1625,6 +1265,7 @@ ulimit -n 10240
   --disable-parallels              \\\
   --disable-pie                    \\\
   --disable-plugins                \\\
+  --disable-pvg                    \\\
   --disable-qcow1                  \\\
   --disable-qed                    \\\
   --disable-qga-vss                \\\
@@ -1634,7 +1275,6 @@ ulimit -n 10240
   --disable-replication            \\\
   --disable-rng-none               \\\
   --disable-safe-stack             \\\
-  --disable-sanitizers             \\\
   --disable-sdl                    \\\
   --disable-sdl-image              \\\
   --disable-seccomp                \\\
@@ -1653,6 +1293,7 @@ ulimit -n 10240
   --disable-tools                  \\\
   --disable-tpm                    \\\
   --disable-u2f                    \\\
+  --disable-ubsan                  \\\
   --disable-usb-redir              \\\
   --disable-user                   \\\
   --disable-valgrind               \\\
@@ -1840,6 +1481,7 @@ cp -a qemu-system-%{kvm_target} qemu-kvm
     cp pc-bios/s390-ccw/s390-ccw.img pc-bios/
 %endif
 
+
 popd
 # endif !tools_only
 %endif
@@ -1890,7 +1532,6 @@ install -D -p -m 0644 %{modprobe_kvm_conf} $RPM_BUILD_ROOT%{_sysconfdir}/modprob
 # Create new directories and put them all under tests-src
 mkdir -p %{buildroot}%{testsdir}/python
 mkdir -p %{buildroot}%{testsdir}/tests
-mkdir -p %{buildroot}%{testsdir}/tests/avocado
 mkdir -p %{buildroot}%{testsdir}/tests/qemu-iotests
 mkdir -p %{buildroot}%{testsdir}/scripts/qmp
 
@@ -1898,10 +1539,8 @@ mkdir -p %{buildroot}%{testsdir}/scripts/qmp
 install -m 0644 scripts/dump-guest-memory.py \
                 %{buildroot}%{_datadir}/%{name}
 
-# Install avocado_qemu tests
-cp -R %{qemu_kvm_build}/tests/avocado/* %{buildroot}%{testsdir}/tests/avocado/
 
-# Install qemu.py and qmp/ scripts required to run avocado_qemu tests
+# Install qemu.py and qmp/ scripts required to run tests
 cp -R %{qemu_kvm_build}/python/qemu %{buildroot}%{testsdir}/python
 cp -R %{qemu_kvm_build}/scripts/qmp/* %{buildroot}%{testsdir}/scripts/qmp
 install -p -m 0644 tests/Makefile.include %{buildroot}%{testsdir}/tests/
@@ -1966,19 +1605,20 @@ rm -rf %{buildroot}%{_datadir}/%{name}/slof.bin
 
 # Remove unpackaged files.
 rm -rf %{buildroot}%{_datadir}/%{name}/palcode-clipper
-rm -rf %{buildroot}%{_datadir}/%{name}/petalogix*.dtb
-rm -f %{buildroot}%{_datadir}/%{name}/bamboo.dtb
+rm -rf %{buildroot}%{_datadir}/%{name}/dtb/petalogix*.dtb
+rm -f %{buildroot}%{_datadir}/%{name}/dtb/bamboo.dtb
 rm -f %{buildroot}%{_datadir}/%{name}/ppc_rom.bin
 rm -rf %{buildroot}%{_datadir}/%{name}/s390-zipl.rom
 rm -rf %{buildroot}%{_datadir}/%{name}/u-boot.e500
 rm -rf %{buildroot}%{_datadir}/%{name}/qemu_vga.ndrv
 rm -rf %{buildroot}%{_datadir}/%{name}/skiboot.lid
 rm -rf %{buildroot}%{_datadir}/%{name}/qboot.rom
+rm -rf %{buildroot}%{_datadir}/%{name}/pnv-pnor.bin
 
 rm -rf %{buildroot}%{_datadir}/%{name}/s390-ccw.img
 rm -rf %{buildroot}%{_datadir}/%{name}/hppa-firmware.img
 rm -rf %{buildroot}%{_datadir}/%{name}/hppa-firmware64.img
-rm -rf %{buildroot}%{_datadir}/%{name}/canyonlands.dtb
+rm -rf %{buildroot}%{_datadir}/%{name}/dtb/canyonlands.dtb
 rm -rf %{buildroot}%{_datadir}/%{name}/u-boot-sam460-20100605.bin
 
 rm -rf %{buildroot}%{_datadir}/%{name}/firmware
@@ -1993,6 +1633,8 @@ rm -rf %{buildroot}%{_datadir}/%{name}/opensbi-riscv64-virt-fw_jump.bin
 rm -rf %{buildroot}%{_datadir}/%{name}/opensbi-riscv64-generic-fw_dynamic.*
 rm -rf %{buildroot}%{_datadir}/%{name}/qemu-nsis.bmp
 rm -rf %{buildroot}%{_datadir}/%{name}/npcm7xx_bootrom.bin
+rm -rf %{buildroot}%{_datadir}/%{name}/npcm8xx_bootrom.bin
+rm -rf %{buildroot}%{_datadir}/%{name}/ast27x0_bootrom.bin
 
 # Remove virtfs-proxy-helper files
 rm -rf %{buildroot}%{_libexecdir}/virtfs-proxy-helper
@@ -2001,6 +1643,8 @@ rm -rf %{buildroot}%{_mandir}/man1/virtfs-proxy-helper*
 %ifarch s390x
     # Use the s390-ccw.img that we've just built, not the pre-built one
     install -m 0644 %{qemu_kvm_build}/pc-bios/s390-ccw/s390-ccw.img %{buildroot}%{_datadir}/%{name}/
+    # Remove uefi vars
+    rm -rf %{buildroot}%{_libdir}/%{name}/hw-uefi-vars.so
 %else
     rm -rf %{buildroot}%{_libdir}/%{name}/hw-s390x-virtio-gpu-ccw.so
 %endif
@@ -2191,6 +1835,8 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 %ifarch s390x
     %{_datadir}/%{name}/s390-ccw.img
+%else
+    %{_libdir}/%{name}/hw-uefi-vars.so
 %endif
 %{_datadir}/icons/*
 %{_datadir}/%{name}/linuxboot_dma.bin
@@ -2213,10 +1859,6 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %{_datadir}/systemtap/tapset/qemu-nbd*.stp
 %{_datadir}/systemtap/tapset/qemu-storage-daemon*.stp
 
-%ifarch x86_64
-    %{_libdir}/%{name}/accel-tcg-%{kvm_target}.so
-%endif
-
 %files device-display-virtio-gpu
 %{_libdir}/%{name}/hw-display-virtio-gpu.so
 
@@ -2274,6 +1916,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 
 %changelog
+* Wed Oct 22 2025 Miroslav Rezanina <mrezanin@redhat.com> - 10.1.0-1
+- Rebase to QEMU 10.1.0
+- Resolves: RHEL-117664
+  (Rebase qemu-kvm to QEMU 10.1)
+
 * Tue Sep 16 2025 Jon Maloy <jmaloy@redhat.com> - 9.1.0-29
 - kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch [RHEL-17614]
 - Resolves: RHEL-17614
diff --git a/sources b/sources
index 5f32cdc..cf81344 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-9.1.0.tar.xz) = bf61d65e37945fa8ee8640712c719ace05164d86e6df700b98bdc5f79e0a8d5e8f85bd48e726edb62b2419db20673f63ec8b63a60393a914b09cb365621b35e2
+SHA512 (qemu-10.1.0.tar.xz) = 20552a524b6b298181df1af7084b470ded3fe8d1505f05011dda3c33cbc3d91f518ce026b44ba1a8b7f34c64ae81afddceda383066f4772a3a2a6333a2638caf