* Thu Sep 02 2021 Miroslav Rezanina <mrezanin@redhat.com> - 6.1.0-1

- Rebase to QEMU 6.1.0 [bz#1997408] - Resolves: #bz#1997408 (Rebase to QEMU 6.1.0)
2021-09-02 02:44:51 -04:00 · 2021-09-02 02:44:51 -04:00 · f788c1346a
commit f788c1346a
parent 9b74567af7
120 changed files with 656 additions and 17696 deletions
--- a/.gitignore
+++ b/.gitignore
@ -19,3 +19,4 @@
 /qemu-kvm*.src.rpm
 /patches.*
 /*.orig
 /qemu-6.1.0.tar.xz
--- a/0004-Initial-redhat-build.patch
+++ b/0004-Initial-redhat-build.patch
@ -1,49 +1,149 @@
-From 431955e872aa010376b1f94665908c2ba8194b44 Mon Sep 17 00:00:00 2001
+From 4a0a5d5019938a8b4b5526d33e1bf3d7dcfc56a5 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 12 Oct 2018 07:31:11 +0200
+Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
- - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
+- Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
 - As we use qemu-kvm as name in all places, this is updated to be consistent
- - Man page renamed from qemu to qemu-kvm
+- Man page renamed from qemu to qemu-kvm
 - man page is installed using make install so we have to fix it in qemu tree
 We disable make check due to issues with some of the tests.
-This rebase is based on qemu-kvm-5.2.0-16.el9
+This rebase is based on qemu-kvm-5.2.0-13.el9
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase changes (210526):
 - Move build to .distro
 - Move changes for support file to related commit
 - Added dependency for python3-sphinx-rtd_theme
 - Removed --disable-sheepdog configure option
 - Added new hw-display modules
 Rebase changes (210623):
 - SASL initialization moved to ui/vnc-auth-sasl.c
 Rebase changes (210714):
 - Add accel-qtest-<arch> and accel-tcg-x86_64 libraries
 Rebase changes (6.1.0 rc1):
 - Added hw-usb-host module
 Rebase changes (6.1.0 rc4):
 - Disable new configure options (bpf, nvmm, slirp-smbd)
 Rebase chagnes (6.1.0):
 - Use -pie for ksmctl build (annocheck complain fix)
 Merged patches (6.0.0):
- 605758c902 Limit build on Power to qemu-img and qemu-ga only
+ - 605758c902 Limit build on Power to qemu-img and qemu-ga only
 Merged patches (6.1.0 RC1):
 - f04f91751f Use cached tarballs
 - 6581165c65 Remove message with running VM count
 - 03c3cac9fc spec-file: build qemu-kvm without SPICE and QXL
 - e0ae6c1f6c spec-file: Obsolete qemu-kvm-ui-spice
 - 9d2e9f9ecf spec: Do not build qemu-kvm-block-gluster
 - cf470b4234 spec: Do not link pcnet and ne2k_pci roms
 - e981284a6b redhat: Install the s390-netboot.img that we've built
 - 24ef557f33 spec: Remove usage of Group: tag
 - c40d69b4f4 spec: Drop %defattr usage
 - f8e98798ce spec: Clean up BuildRequires
 - 47246b43ee spec: Remove iasl BuildRequires
 - 170dc1cbe0 spec: Remove redundant 0 in conditionals
 - 8718f6fa11 spec: Add more have_XXX conditionals
 - a001269ce9 spec: Remove binutils versioned Requires
 - 34545ee641 spec: Remove diffutils BuildRequires
 - c2c82beac9 spec: Remove redundant Requires:
 - 9314c231f4 spec: Add XXX_version macros
 - c43db0bf0f spec: Add have_block_rbd
 - 3ecb0c0319 qga: drop StandardError=syslog
 - 018049dc80 Remove iscsi support
 - a2edf18777 redhat: Replace the kvm-setup.service with a /etc/modules-load.d config file
 - 387b5fbcfe redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - 4ead693178 redhat: introducting qemu-kvm-hw-usbredir
 - 4dc6fc3035 redhat: use the standard vhost-user JSON path
 - 84757178b4 Fix local build
 - 8c394227dd spec: Restrict block drivers in tools
 - b6aa7c1fae Move tools to separate package
 - eafd82e509 Split qemu-pr-helper to separate package
 - 2c0182e2aa spec: RPM_BUILD_ROOT -> %{buildroot}
 - 91bd55ca13 spec: More use of %{name} instead of 'qemu-kvm'
 - 50ba299c61 spec: Use qemu-pr-helper.service from qemu.git (partial)
 - ee08d4e0a3 spec: Use %{_sourcedir} for referencing sources
 - 039e7f7d02 spec: Add tools_only
 - 884ba71617 spec: %build: Add run_configure helper
 - 8ebd864d65 spec: %build: Disable more bits with %{disable_everything} (partial)
 - f23fdb53f5 spec: %build: Add macros for some 'configure' parameters
 - fe951a8bd8 spec: %files: Move qemu-guest-agent and qemu-img earlier
 - 353b632e37 spec: %install: Remove redundant bits
 - 9d2015b752 spec: %install: Add %{modprobe_kvm_conf} macro
 - 6d05134e8c spec: %install: Remove qemu-guest-agent /etc/qemu-kvm usage
 - 985b226467 spec: %install: clean up qemu-ga section
 - dfaf9c600d spec: %install: Use a single %{tools_only} section
 - f6978ddb46 spec: Make tools_only not cross spec sections
 - 071c211098 spec: %install: Limit time spent in %{qemu_kvm_build}
 - 1b65c674be spec: misc syntactic merges with Fedora
 - 4da16294cf spec: Use Fedora's pattern for specifying rc version
 - d7ee259a79 spec: %files: don't use fine grained -docs file list
 - 64cad0c60f spec: %files: Add licenses to qemu-common too
 - c3de4f080a spec: %install: Drop python3 shebang fixup
 Merged patches (6.1.0 RC2):
 - 46fc216115 Update local build to work with spec file improvements
 Merged patches (6.1.0 RC3):
 - bab9531548 spec: Remove buildldflags
 - c8360ab6a9 spec: Use %make_build macro
 - f6966c66e9 spec: Drop make install sharedir and datadir usage
 - 86982421bc spec: use %make_install macro
 - 191c405d22 spec: parallelize `make check`
 - 251a1fb958 spec: Drop explicit --build-id
 - 44c7dda6c3 spec: use %{build_ldflags}
 - 0009a34354 Move virtiofsd to separate package
 -  34d1b200b3 Utilize --firmware configure option
 Merged patches (6.1.0):
 - 2800e1dd03 spec: Switch toolchain to Clang/LLVM (except process-patches.sh)
 - e8a70f500f spec: Use safe-stack for x86_64
 - e29445d50d spec: Reenable write support for VMDK etc. in tools
 - a4fe2a3e16 redhat: Disable LTO on non-x86 architectures
 fixes
 ---
 .distro/85-kvm.preset                   |    5 -
 .distro/Makefile                        |  100 +
 .distro/Makefile.common                 |   45 +
 .distro/README.tests                    |   39 +
 .distro/kvm-setup                       |   49 -
 .distro/kvm-setup.service               |   14 -
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
 .distro/qemu-kvm.spec.template          | 3767 +++++++++++++++++++++++
 .distro/scripts/extract_build_cmd.py    |   12 +
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
- configure                               |    5 -
+ configure                               |    1 -
- hw/remote/memory.c                      |    2 +-
+ meson.build                             |    6 +-
 hw/remote/proxy.c                       |    2 +-
 meson.build                             |    8 +-
 redhat/Makefile                         |   90 +
 redhat/Makefile.common                  |   50 +
 redhat/README.tests                     |   39 +
 redhat/qemu-kvm.spec.template           | 3609 +++++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py     |    5 +-
 redhat/scripts/process-patches.sh       |   20 +-
 redhat/udev-kvm-check.c                 |   19 +-
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 tests/check-block.sh                    |    2 +
- ui/vnc.c                                |    2 +-
+ ui/vnc-auth-sasl.c                      |    2 +-
- 18 files changed, 3860 insertions(+), 44 deletions(-)
+ 19 files changed, 4024 insertions(+), 74 deletions(-)
 delete mode 100644 .distro/85-kvm.preset
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
 delete mode 100644 .distro/kvm-setup
 delete mode 100644 .distro/kvm-setup.service
 create mode 100644 .distro/modules-load.conf
 create mode 100644 .distro/qemu-kvm.spec.template
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
@ -97,21 +197,10 @@ index 0000000000..ad913fc990
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/configure b/configure
-index 4f374b4889..53b2fa583a 100755
+index 9a79a004d7..b0dbdded06 100755
 --- a/configure
 +++ b/configure
-@@ -6383,10 +6383,6 @@ fi
+@@ -5189,7 +5189,6 @@ if test "$skip_meson" = no; then
 mv $cross config-meson.cross
 rm -rf meson-private meson-info meson-logs
 -unset staticpic
 -if ! version_ge "$($meson --version)" 0.56.0; then
 -  staticpic=$(if test "$pie" = yes; then echo true; else echo false; fi)
 -fi
 NINJA=$ninja $meson setup \
         --prefix "$prefix" \
         --libdir "$libdir" \
@@ -6406,7 +6402,6 @@ NINJA=$ninja $meson setup \
         -Dwerror=$(if test "$werror" = yes; then echo true; else echo false; fi) \
         -Dstrip=$(if test "$strip_opt" = yes; then echo true; else echo false; fi) \
         -Db_pie=$(if test "$pie" = yes; then echo true; else echo false; fi) \
@ -119,46 +208,19 @@ index 4f374b4889..53b2fa583a 100755
         -Db_coverage=$(if test "$gcov" = yes; then echo true; else echo false; fi) \
         -Db_lto=$lto -Dcfi=$cfi -Dcfi_debug=$cfi_debug \
         -Dmalloc=$malloc -Dmalloc_trim=$malloc_trim -Dsparse=$sparse \
 diff --git a/hw/remote/memory.c b/hw/remote/memory.c
 index 32085b1e05..bf0047a81b 100644
 --- a/hw/remote/memory.c
 +++ b/hw/remote/memory.c
@@ -43,7 +43,7 @@ void remote_sysmem_reconfig(MPQemuMsg *msg, Error **errp)
     remote_sysmem_reset();
     for (region = 0; region < msg->num_fds; region++) {
 -        g_autofree char *name;
 +        g_autofree char *name = NULL;
         subregion = g_new(MemoryRegion, 1);
         name = g_strdup_printf("remote-mem-%u", suffix++);
         memory_region_init_ram_from_fd(subregion, NULL,
 diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
 index 4fa4be079d..253c1aa7ec 100644
 --- a/hw/remote/proxy.c
 +++ b/hw/remote/proxy.c
@@ -347,7 +347,7 @@ static void probe_pci_info(PCIDevice *dev, Error **errp)
                    PCI_BASE_ADDRESS_SPACE_IO : PCI_BASE_ADDRESS_SPACE_MEMORY;
         if (size) {
 -            g_autofree char *name;
 +            g_autofree char *name = NULL;
             pdev->region[i].dev = pdev;
             pdev->region[i].present = true;
             if (type == PCI_BASE_ADDRESS_SPACE_MEMORY) {
 diff --git a/meson.build b/meson.build
-index c6f4b0cf5e..06c15bd6d2 100644
+index b3e7ec0e92..17707c8748 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1,6 +1,6 @@
 project('qemu', ['c'], meson_version: '>=0.55.0',
-        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto'] +
+         default_options: ['warning_level=1', 'c_std=gnu11', 'cpp_std=gnu++11', 'b_colorout=auto'] +
 -                         (meson.version().version_compare('>=0.56.0') ? [ 'b_staticpic=false' ] : []),
-+        default_options: ['warning_level=1', 'c_std=gnu99', 'cpp_std=gnu++11', 'b_colorout=auto',
+                          [ 'b_staticpic=false' ],
 +                          'b_staticpic=false' ],
         version: run_command('head', meson.source_root() / 'VERSION').stdout().strip())
 not_found = dependency('', required: false)
-@@ -1482,7 +1482,9 @@ if capstone_opt == 'internal'
+@@ -1790,7 +1790,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
@ -212,14 +274,14 @@ index f86cb863de..6d38340d49 100755
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
-diff --git a/ui/vnc.c b/ui/vnc.c
+diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
-index 456db47d71..97ae92b181 100644
+index 47fdae5b21..2a950caa2a 100644
--- a/ui/vnc.c
+--- a/ui/vnc-auth-sasl.c
-+++ b/ui/vnc.c
+++ b/ui/vnc-auth-sasl.c
-@@ -4146,7 +4146,7 @@ void vnc_display_open(const char *id, Error **errp)
+@@ -42,7 +42,7 @@
- #ifdef CONFIG_VNC_SASL
+ bool vnc_sasl_server_init(Error **errp)
-     if (sasl) {
+ {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0005-Enable-disable-devices-for-RHEL.patch
@ -1,22 +1,41 @@
-From f46ca4c7e719e0a70f8e0ffe3de882c017c216e7 Mon Sep 17 00:00:00 2001
+From 0818ec19b1626de85d061b240e0c369a6fb524fb Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 2 Sep 2020 09:11:07 +0200
+Date: Thu, 15 Jul 2021 03:22:36 -0400
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes (210623):
 - Added CONFIG_TPM (except s390x)
 Rebase notes (210714):
 - default-configs moved to configs
 Rebaes notes (6.1.0 RC2):
 - Use --with-device-<ARCH> configure option to use rhel configs
 Merged patches (210526):
 - c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
 Merged patches (6.1.0 RC1):
 - 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
 - f2fe835153 aarch64-rh-devices: add CONFIG_PXB
 - b5431733ad disable CONFIG_USB_STORAGE_BOT
 - 478ba0cdf6 Disable TPM passthrough
 Merged patches (6.1.0):
 - 2504d68a7c aarch64: Add USB storage devices
 - 51c2a3253c disable ac97 audio
 ---
- .../devices/aarch64-rh-devices.mak            |  28 +++++
+ .distro/qemu-kvm.spec.template                |  12 ++-
- default-configs/devices/aarch64-softmmu.mak   |  10 +-
+ .../aarch64-softmmu/aarch64-rh-devices.mak    |  33 ++++++
- default-configs/devices/ppc64-rh-devices.mak  |  36 ++++++
+ .../ppc64-softmmu/ppc64-rh-devices.mak        |  35 ++++++
- default-configs/devices/ppc64-softmmu.mak     |  10 +-
+ configs/devices/rh-virtio.mak                 |  10 ++
- default-configs/devices/rh-virtio.mak         |  10 ++
+ .../s390x-softmmu/s390x-rh-devices.mak        |  15 +++
- default-configs/devices/s390x-rh-devices.mak  |  16 +++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 102 ++++++++++++++++++
- default-configs/devices/s390x-softmmu.mak     |   4 +-
+ .../x86_64-upstream-devices.mak               |   4 +
 default-configs/devices/x86_64-rh-devices.mak | 104 ++++++++++++++++++
 default-configs/devices/x86_64-softmmu.mak    |  10 +-
 .../devices/x86_64-upstream-devices.mak       |   4 +
 hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
@ -30,26 +49,25 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
 qemu-options.hx                               |   4 -
 redhat/qemu-kvm.spec.template                 |   5 +-
 target/arm/cpu_tcg.c                          |  10 ++
 target/ppc/cpu-models.c                       |  10 ++
- target/s390x/cpu_models.c                     |   3 +
+ target/s390x/cpu_models_sysemu.c              |   3 +
- target/s390x/kvm.c                            |   8 ++
+ target/s390x/kvm/kvm.c                        |   8 ++
- 28 files changed, 304 insertions(+), 22 deletions(-)
+ 24 files changed, 285 insertions(+), 15 deletions(-)
- create mode 100644 default-configs/devices/aarch64-rh-devices.mak
+ create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
- create mode 100644 default-configs/devices/ppc64-rh-devices.mak
+ create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
- create mode 100644 default-configs/devices/rh-virtio.mak
+ create mode 100644 configs/devices/rh-virtio.mak
- create mode 100644 default-configs/devices/s390x-rh-devices.mak
+ create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
- create mode 100644 default-configs/devices/x86_64-rh-devices.mak
+ create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
- create mode 100644 default-configs/devices/x86_64-upstream-devices.mak
+ create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
-diff --git a/default-configs/devices/aarch64-rh-devices.mak b/default-configs/devices/aarch64-rh-devices.mak
+diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..a4d67274c0
+index 0000000000..cd9c7c5127
 --- /dev/null
-+++ b/default-configs/devices/aarch64-rh-devices.mak
+++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,33 @@
-+include rh-virtio.mak
+include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GIC=y
@ -66,6 +84,8 @@ index 0000000000..a4d67274c0
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
@ -73,36 +93,20 @@ index 0000000000..a4d67274c0
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
-diff --git a/default-configs/devices/aarch64-softmmu.mak b/default-configs/devices/aarch64-softmmu.mak
+CONFIG_PVPANIC_PCI=y
-index 958b1e08e4..8f6867d48a 100644
+CONFIG_PXB=y
--- a/default-configs/devices/aarch64-softmmu.mak
+diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 +++ b/default-configs/devices/aarch64-softmmu.mak
@@ -1,8 +1,10 @@
 # Default configuration for aarch64-softmmu
 # We support all the 32 bit boards so need all their config
 -include arm-softmmu.mak
 +#include arm-softmmu.mak
 -CONFIG_XLNX_ZYNQMP_ARM=y
 -CONFIG_XLNX_VERSAL=y
 -CONFIG_SBSA_REF=y
 +#CONFIG_XLNX_ZYNQMP_ARM=y
 +#CONFIG_XLNX_VERSAL=y
 +#CONFIG_SBSA_REF=y
 +
 +include aarch64-rh-devices.mak
 diff --git a/default-configs/devices/ppc64-rh-devices.mak b/default-configs/devices/ppc64-rh-devices.mak
 new file mode 100644
-index 0000000000..5b01b7fac0
+index 0000000000..6a3e3f0227
 --- /dev/null
-+++ b/default-configs/devices/ppc64-rh-devices.mak
+++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
-@@ -0,0 +1,36 @@
+@@ -0,0 +1,35 @@
-+include rh-virtio.mak
+include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
@ -119,7 +123,6 @@ index 0000000000..5b01b7fac0
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_BOT=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
@ -135,36 +138,14 @@ index 0000000000..5b01b7fac0
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
-+CONFIG_TPM_PASSTHROUGH=y
+diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 diff --git a/default-configs/devices/ppc64-softmmu.mak b/default-configs/devices/ppc64-softmmu.mak
 index ae0841fa3a..040e5575e7 100644
 --- a/default-configs/devices/ppc64-softmmu.mak
 +++ b/default-configs/devices/ppc64-softmmu.mak
@@ -1,11 +1,13 @@
 # Default configuration for ppc64-softmmu
 # Include all 32-bit boards
 -include ppc-softmmu.mak
 +#include ppc-softmmu.mak
 # For PowerNV
 -CONFIG_POWERNV=y
 +#CONFIG_POWERNV=y
 # For pSeries
 -CONFIG_PSERIES=y
 -CONFIG_NVDIMM=y
 +#CONFIG_PSERIES=y
 +#CONFIG_NVDIMM=y
 +
 +include ppc64-rh-devices.mak
 diff --git a/default-configs/devices/rh-virtio.mak b/default-configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
-+++ b/default-configs/devices/rh-virtio.mak
+++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
@ -176,13 +157,13 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
-diff --git a/default-configs/devices/s390x-rh-devices.mak b/default-configs/devices/s390x-rh-devices.mak
+diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..08a15f3e01
+index 0000000000..d3b38312e1
 --- /dev/null
-+++ b/default-configs/devices/s390x-rh-devices.mak
+++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -0,0 +1,16 @@
+@@ -0,0 +1,15 @@
-+include rh-virtio.mak
+include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
@ -190,7 +171,6 @@ index 0000000000..08a15f3e01
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
@ -198,27 +178,15 @@ index 0000000000..08a15f3e01
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
-diff --git a/default-configs/devices/s390x-softmmu.mak b/default-configs/devices/s390x-softmmu.mak
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index f2287a133f..3e2e388e91 100644
 --- a/default-configs/devices/s390x-softmmu.mak
 +++ b/default-configs/devices/s390x-softmmu.mak
@@ -10,4 +10,6 @@
 # Boards:
 #
 -CONFIG_S390_CCW_VIRTIO=y
 +#CONFIG_S390_CCW_VIRTIO=y
 +
 +include s390x-rh-devices.mak
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..9f41400530
+index 0000000000..24b96ba0c4
 --- /dev/null
-+++ b/default-configs/devices/x86_64-rh-devices.mak
+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,104 @@
+@@ -0,0 +1,102 @@
-+include rh-virtio.mak
+include ../rh-virtio.mak
 +include x86_64-upstream-devices.mak
 +
 +CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
@ -237,6 +205,7 @@ index 0000000000..9f41400530
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
@ -278,7 +247,6 @@ index 0000000000..9f41400530
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
@ -288,13 +256,11 @@ index 0000000000..9f41400530
 +CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_SPICE=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_BOT=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
@ -316,42 +282,25 @@ index 0000000000..9f41400530
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
-+CONFIG_TPM_PASSTHROUGH=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/default-configs/devices/x86_64-softmmu.mak b/default-configs/devices/x86_64-softmmu.mak
 index 64b2ee2960..e57bcff7d9 100644
 --- a/default-configs/devices/x86_64-softmmu.mak
 +++ b/default-configs/devices/x86_64-softmmu.mak
@@ -1,3 +1,11 @@
 # Default configuration for x86_64-softmmu
 -include i386-softmmu.mak
 +#include i386-softmmu.mak
 +
 +include x86_64-rh-devices.mak
 +
 +#
 +# RHEL: this is for the limited upstream machine type support, so to export
 +# some more devices than what RHEL machines have.
 +#
 +include x86_64-upstream-devices.mak
 diff --git a/default-configs/devices/x86_64-upstream-devices.mak b/default-configs/devices/x86_64-upstream-devices.mak
 new file mode 100644
 index 0000000000..2cd20f54d2
 --- /dev/null
-+++ b/default-configs/devices/x86_64-upstream-devices.mak
+++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
@@ -0,0 +1,4 @@
 +# We need "isa-parallel"
 +CONFIG_PARALLEL=y
 +# We need "hpet"
 +CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index 853447cf9d..7f01fad64c 100644
+index 778e27b659..802501881f 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
-@@ -374,8 +374,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+@@ -424,8 +424,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
     pm->acpi_memory_hotplug.is_enabled = true;
     pm->cpu_hotplug_legacy = true;
@ -360,13 +309,13 @@ index 853447cf9d..7f01fad64c 100644
 +    pm->disable_s3 = 1;
 +    pm->disable_s4 = 1;
     pm->s4_val = 2;
     pm->use_acpi_hotplug_bridge = true;
     object_property_add_uint32_ptr(obj, ACPI_PM_PROP_PM_IO_BASE,
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
-index be39117b9b..6fcc5ede50 100644
+index 721a8eb8be..87ed4dd914 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
-@@ -30,7 +30,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
+@@ -31,7 +31,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
@ -376,19 +325,19 @@ index be39117b9b..6fcc5ede50 100644
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index a825c2acba..c62927bb3a 100644
+index 9014cd30b3..46cee8c544 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
-@@ -49,6 +49,8 @@
+@@ -48,6 +48,8 @@
 #include "trace.h"
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
-@@ -2554,6 +2556,14 @@ static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
+@@ -2320,6 +2322,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
@ -459,10 +408,10 @@ index fdca6ca659..fa1a7eee51 100644
        Also accept 8 MB/16 MB for backward compatibility. */
      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
-index b9860e35a5..beb1ea6c46 100644
+index d3e738320b..7c77312463 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
-@@ -220,7 +220,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
+@@ -232,7 +232,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
@ -472,7 +421,7 @@ index b9860e35a5..beb1ea6c46 100644
 }
 static const TypeInfo piix3_ide_info = {
-@@ -249,6 +250,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
+@@ -261,6 +262,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
@ -482,10 +431,10 @@ index b9860e35a5..beb1ea6c46 100644
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index dde85ba6c6..62cf60c9c9 100644
+index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -597,6 +597,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     isa->build_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
@ -495,10 +444,10 @@ index dde85ba6c6..62cf60c9c9 100644
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index 4f75b44cfc..6f075fe235 100644
+index a30546c5d5..c2877978d9 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1797,6 +1797,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1814,6 +1814,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -506,7 +455,7 @@ index 4f75b44cfc..6f075fe235 100644
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1809,6 +1810,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1826,6 +1827,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -551,11 +500,11 @@ index 9520471be2..202e032524 100644
         warn_report("Hpet's intcap not initialized");
     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index fb7a74e73a..674993aa4f 100644
+index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
-@@ -55,7 +55,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
+@@ -52,7 +52,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
- if config_host.has_key('CONFIG_SMARTCARD')
+ if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
@ -564,10 +513,10 @@ index fb7a74e73a..674993aa4f 100644
 endif
 diff --git a/qemu-options.hx b/qemu-options.hx
-index fd21002bd6..0d4fb61bf7 100644
+index 83aa59a920..ac596e01a1 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -2327,10 +2327,6 @@ ERST
+@@ -2412,10 +2412,6 @@ ERST
 DEF("no-hpet", 0, QEMU_OPTION_no_hpet,
     "-no-hpet        disable HPET\n", QEMU_ARCH_I386)
@ -579,7 +528,7 @@ index fd21002bd6..0d4fb61bf7 100644
 DEF("acpitable", HAS_ARG, QEMU_OPTION_acpitable,
     "-acpitable [sig=str][,rev=n][,oem_id=str][,oem_table_id=str][,oem_rev=n][,asl_compiler_id=str][,asl_compiler_rev=n][,{data|file}=file1[:file2]...]\n"
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index 046e476f65..c3cd0ca039 100644
+index ed444bf436..fafd019539 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -22,6 +22,7 @@
@ -622,7 +571,7 @@ index 046e476f65..c3cd0ca039 100644
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -927,6 +932,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
+@@ -928,6 +933,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
@ -630,7 +579,7 @@ index 046e476f65..c3cd0ca039 100644
 #ifndef TARGET_AARCH64
 /*
-@@ -1004,6 +1010,7 @@ static void arm_max_initfn(Object *obj)
+@@ -1007,6 +1013,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 static const ARMCPUInfo arm_tcg_cpus[] = {
@ -638,7 +587,7 @@ index 046e476f65..c3cd0ca039 100644
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
-@@ -1019,7 +1026,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+@@ -1022,7 +1029,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
@ -648,7 +597,7 @@ index 046e476f65..c3cd0ca039 100644
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-@@ -1050,6 +1059,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+@@ -1053,6 +1062,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
@ -726,11 +675,11 @@ index 87e4228614..6eaa65efff 100644
 +#endif
     { NULL, NULL }
 };
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
+diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index 050dcf2d42..9254ff46bf 100644
+index 05c3ccaaff..6a04ccab1b 100644
--- a/target/s390x/cpu_models.c
+--- a/target/s390x/cpu_models_sysemu.c
-+++ b/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models_sysemu.c
-@@ -430,6 +430,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
+@@ -36,6 +36,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
@ -740,11 +689,11 @@ index 050dcf2d42..9254ff46bf 100644
     }
     /* detect missing features if any to properly report them */
-diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
+diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 4fb3bbfef5..6c69d84b84 100644
+index 5b1fdb55c4..c52434985b 100644
--- a/target/s390x/kvm.c
+--- a/target/s390x/kvm/kvm.c
-+++ b/target/s390x/kvm.c
+++ b/target/s390x/kvm/kvm.c
-@@ -2516,6 +2516,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0006-Machine-type-related-general-changes.patch
@ -1,4 +1,4 @@
-From 80e9b92048e6fe7c7aef0e64cbc0f855bd3a6272 Mon Sep 17 00:00:00 2001
+From fd2a04cf2221d8c541a70a66021c12a9b9c93aaa Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@ -8,72 +8,43 @@ split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Merged patches (6.1.0 RC1):
 - f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
 - 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 Merged patches (6.1.0):
 - a3995e2eff Remove RHEL 7.0.0 machine type (only generic changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only generic changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only generic changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only generic changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only generic changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only generic changes)
 ---
 hw/acpi/ich9.c               |  15 +++
 hw/acpi/piix4.c              |   5 +-
 hw/arm/virt.c                |   2 +-
- hw/char/serial.c             |  16 +++
+ hw/char/serial.c             |   4 +
- hw/core/machine.c            | 251 +++++++++++++++++++++++++++++++++++
+ hw/core/machine.c            | 159 +++++++++++++++++++++++++++++++++++
 hw/display/vga-isa.c         |   2 +-
 hw/i386/pc_piix.c            |   2 +
 hw/i386/pc_q35.c             |   2 +
 hw/net/e1000e.c              |  21 +++
 hw/net/rtl8139.c             |   4 +-
- hw/rtc/mc146818rtc.c         |   6 +
+ hw/rtc/mc146818rtc.c         |   2 +
- hw/smbios/smbios.c           |  46 ++++++-
+ hw/smbios/smbios.c           |  46 +++++++++-
 hw/timer/i8254_common.c      |   2 +-
 hw/usb/hcd-uhci.c            |   4 +-
- hw/usb/hcd-xhci-pci.c        |  59 ++++++--
+ hw/usb/hcd-xhci-pci.c        |  59 ++++++++++---
 hw/usb/hcd-xhci-pci.h        |   1 +
- hw/usb/hcd-xhci.c            |  20 +++
+ include/hw/boards.h          |  18 ++++
 hw/usb/hcd-xhci.h            |   2 +
 include/hw/acpi/ich9.h       |   3 +
 include/hw/boards.h          |  33 +++++
 include/hw/firmware/smbios.h |   5 +-
 include/hw/i386/pc.h         |   3 +
- include/hw/usb.h             |   3 +
+ 17 files changed, 295 insertions(+), 25 deletions(-)
 migration/migration.c        |   2 +
 migration/migration.h        |   5 +
 25 files changed, 489 insertions(+), 25 deletions(-)
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
 index 7f01fad64c..33b0c6e33c 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -369,6 +369,18 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
     s->pm.enable_tco = value;
 }
 +static bool ich9_pm_get_force_rev1_fadt(Object *obj, Error **errp)
 +{
 +    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
 +    return s->pm.force_rev1_fadt;
 +}
 +
 +static void ich9_pm_set_force_rev1_fadt(Object *obj, bool value, Error **errp)
 +{
 +    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
 +    s->pm.force_rev1_fadt = value;
 +}
 +
 void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
 {
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
@@ -391,6 +403,9 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     object_property_add_bool(obj, "cpu-hotplug-legacy",
                              ich9_pm_get_cpu_hotplug_legacy,
                              ich9_pm_set_cpu_hotplug_legacy);
 +    object_property_add_bool(obj, "__com.redhat_force-rev1-fadt",
 +                             ich9_pm_get_force_rev1_fadt,
 +                             ich9_pm_set_force_rev1_fadt);
     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S3_DISABLED,
                                   &pm->disable_s3, OBJ_PROP_FLAG_READWRITE);
     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S4_DISABLED,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 8f8b0e95e5..9865d1a349 100644
+index 48f7a1edbc..af21cb4ac3 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -278,6 +278,7 @@ static const VMStateDescription vmstate_acpi = {
+@@ -279,6 +279,7 @@ static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
     .minimum_version_id = 3,
@ -81,7 +52,7 @@ index 8f8b0e95e5..9865d1a349 100644
     .post_load = vmstate_acpi_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
-@@ -643,8 +644,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
+@@ -644,8 +645,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
 static Property piix4_pm_properties[] = {
     DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
@ -93,20 +64,20 @@ index 8f8b0e95e5..9865d1a349 100644
     DEFINE_PROP_BOOL("acpi-pci-hotplug-with-bridge-support", PIIX4PMState,
                      use_acpi_hotplug_bridge, true),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 9f01d9041b..f904d3e98e 100644
+index 81eda46b0b..cd1a2d985d 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1522,7 +1522,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1524,7 +1524,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
 -                        true, SMBIOS_ENTRY_POINT_30);
 +                        true, NULL, NULL, SMBIOS_ENTRY_POINT_30);
-     smbios_get_tables(MACHINE(vms), NULL, 0, &smbios_tables, &smbios_tables_len,
+     smbios_get_tables(MACHINE(vms), NULL, 0,
-                       &smbios_anchor, &smbios_anchor_len);
+                       &smbios_tables, &smbios_tables_len,
 diff --git a/hw/char/serial.c b/hw/char/serial.c
-index bc2e322970..cc378142a3 100644
+index 7061aacbce..8fa5ab1e8e 100644
 --- a/hw/char/serial.c
 +++ b/hw/char/serial.c
@@ -37,6 +37,7 @@
@ -117,54 +88,35 @@ index bc2e322970..cc378142a3 100644
 #define UART_LCR_DLAB	0x80	/* Divisor latch access bit */
-@@ -689,6 +690,9 @@ static int serial_post_load(void *opaque, int version_id)
+@@ -770,6 +771,7 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
 static bool serial_thr_ipending_needed(void *opaque)
 {
     SerialState *s = opaque;
 +    if (migrate_pre_2_2) {
 +        return false;
 +    }
     if (s->ier & UART_IER_THRI) {
         bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
@@ -770,6 +774,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
 static bool serial_fifo_timeout_timer_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 +    if (migrate_pre_2_2) {
 +        return false;
 +    }
 +
     return timer_pending(s->fifo_timeout_timer);
 }
-@@ -787,6 +795,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+@@ -787,6 +789,7 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
 static bool serial_timeout_ipending_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 +    if (migrate_pre_2_2) {
 +        return false;
 +    }
 +
     return s->timeout_ipending != 0;
 }
-@@ -804,6 +816,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
+@@ -804,6 +807,7 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
 static bool serial_poll_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 +    if (migrate_pre_2_2) {
 +        return false;
 +    }
 +
     return s->poll_msl >= 0;
 }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 40def78183..848e7fdff6 100644
+index 54e040587d..d681a06a47 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -36,6 +36,257 @@
+@@ -37,6 +37,165 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-pci.h"
@ -176,6 +128,10 @@ index 40def78183..848e7fdff6 100644
 +    { "ICH9-LPC", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "PIIX4_PM", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-net-pci", "vectors", "3"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
@ -197,6 +153,8 @@ index 40def78183..848e7fdff6 100644
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
@ -321,107 +279,9 @@ index 40def78183..848e7fdff6 100644
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
-+/* The same as hw_compat_2_11 + hw_compat_2_10 */
+ GlobalProperty hw_compat_6_0[] = {
-+GlobalProperty hw_compat_rhel_7_5[] = {
+     { "gpex-pcihost", "allow-unmapped-accesses", "false" },
-+    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
+     { "i8042", "extended-state", "false"},
 +    { "hpet", "hpet-offset-saved", "false" },
 +    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
 +    { "virtio-blk-pci", "vectors", "2" },
 +    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
 +    { "vhost-user-blk-pci", "vectors", "2" },
 +    /* hw_compat_rhel_7_5 from hw_compat_2_11
 +       bz 1608778 modified for our naming */
 +    { "e1000-82540em", "migrate_tso_props", "off" },
 +    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
 +    { "virtio-mouse-device", "wheel-axis", "false" },
 +    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
 +    { "virtio-tablet-device", "wheel-axis", "false" },
 +    { "cirrus-vga", "vgamem_mb", "16" },
 +    { "migration", "decompress-error-check", "off" },
 +};
 +const size_t hw_compat_rhel_7_5_len = G_N_ELEMENTS(hw_compat_rhel_7_5);
 +
 +/* Mostly like hw_compat_2_9 except
 + * x-mtu-bypass-backend, x-migrate-msix has already been
 + * backported to RHEL7.4. shpc was already on in 7.4.
 + */
 +GlobalProperty hw_compat_rhel_7_4[] = {
 +    { "intel-iommu", "pt", "off" },
 +};
 +
 +const size_t hw_compat_rhel_7_4_len = G_N_ELEMENTS(hw_compat_rhel_7_4);
 +/* Mostly like HW_COMPAT_2_6 + HW_COMPAT_2_7 + HW_COMPAT_2_8 except
 + * disable-modern, disable-legacy, page-per-vq have already been
 + * backported to RHEL7.3
 + */
 +GlobalProperty hw_compat_rhel_7_3[] = {
 +    { "virtio-mmio", "format_transport_address", "off" },
 +    { "virtio-serial-device", "emergency-write", "off" },
 +    { "ioapic", "version", "0x11" },
 +    { "intel-iommu", "x-buggy-eim", "true" },
 +    { "virtio-pci", "x-ignore-backend-features", "on" },
 +    { "fw_cfg_mem", "x-file-slots", stringify(0x10) },
 +    { "fw_cfg_io", "x-file-slots", stringify(0x10) },
 +    { "pflash_cfi01", "old-multiple-chip-handling", "on" },
 +    { TYPE_PCI_DEVICE, "x-pcie-extcap-init", "off" },
 +    { "virtio-pci", "x-pcie-deverr-init", "off" },
 +    { "virtio-pci", "x-pcie-lnkctl-init", "off" },
 +    { "virtio-pci", "x-pcie-pm-init", "off" },
 +    { "virtio-net-device", "x-mtu-bypass-backend", "off" },
 +    { "e1000e", "__redhat_e1000e_7_3_intr_state", "on" },
 +};
 +const size_t hw_compat_rhel_7_3_len = G_N_ELEMENTS(hw_compat_rhel_7_3);
 +
 +/* Mostly like hw_compat_2_4 + 2_3 but:
 + *  we don't need "any_layout" as it has been backported to 7.2
 + */
 +GlobalProperty hw_compat_rhel_7_2[] = {
 +        { "virtio-blk-device", "scsi", "true" },
 +        { "e1000-82540em", "extra_mac_registers", "off" },
 +        { "virtio-pci", "x-disable-pcie", "on" },
 +        { "virtio-pci", "migrate-extra", "off" },
 +        { "fw_cfg_mem", "dma_enabled", "off" },
 +        { "fw_cfg_io", "dma_enabled", "off" },
 +        { "isa-fdc", "fallback", "144" },
 +        /* Optional because not all virtio-pci devices support legacy mode */
 +        { "virtio-pci", "disable-modern", "on", .optional = true },
 +        { "virtio-pci", "disable-legacy", "off", .optional = true },
 +        { TYPE_PCI_DEVICE, "x-pcie-lnksta-dllla", "off" },
 +        { "virtio-pci", "page-per-vq", "on" },
 +        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
 +        { "migration", "send-section-footer", "off" },
 +        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
 +        { "migration", "store-global-state", "off",
 +        },
 +};
 +const size_t hw_compat_rhel_7_2_len = G_N_ELEMENTS(hw_compat_rhel_7_2);
 +
 +/* Mostly like hw_compat_2_1 but:
 + *    we don't need virtio-scsi-pci since 7.0 already had that on
 + *
 + * RH: Note, qemu-extended-regs should have been enabled in the 7.1
 + * machine type, but was accidentally turned off in 7.2 onwards.
 + */
 +GlobalProperty hw_compat_rhel_7_1[] = {
 +    { "intel-hda-generic", "old_msi_addr", "on" },
 +    { "VGA", "qemu-extended-regs", "off" },
 +    { "secondary-vga", "qemu-extended-regs", "off" },
 +    { "usb-mouse", "usb_version", stringify(1) },
 +    { "usb-kbd", "usb_version", stringify(1) },
 +    { "virtio-pci",  "virtio-pci-bus-master-bug-migration", "on" },
 +    { "virtio-blk-pci", "any_layout", "off" },
 +    { "virtio-balloon-pci", "any_layout", "off" },
 +    { "virtio-serial-pci", "any_layout", "off" },
 +    { "virtio-9p-pci", "any_layout", "off" },
 +    { "virtio-rng-pci", "any_layout", "off" },
 +    /* HW_COMPAT_RHEL7_1 - introduced with 2.10.0 */
 +    { "migration", "send-configuration", "off" },
 +};
 +const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
 index 90851e730b..a91c5d7467 100644
 --- a/hw/display/vga-isa.c
@ -436,10 +296,10 @@ index 90851e730b..a91c5d7467 100644
 };
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 46cc951073..62433d8022 100644
+index 30b8bd6ea9..eebb4f3141 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -179,6 +179,8 @@ static void pc_init1(MachineState *machine,
+@@ -177,6 +177,8 @@ static void pc_init1(MachineState *machine,
         smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
@ -449,10 +309,10 @@ index 46cc951073..62433d8022 100644
     }
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 53450190f5..fce52ca70b 100644
+index 04b4a4788d..e7724fd02c 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -198,6 +198,8 @@ static void pc_q35_init(MachineState *machine)
+@@ -199,6 +199,8 @@ static void pc_q35_init(MachineState *machine)
         smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
@ -461,80 +321,6 @@ index 53450190f5..fce52ca70b 100644
                             SMBIOS_ENTRY_POINT_21);
     }
 diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
 index a8a77eca95..6d39c1f1c4 100644
 --- a/hw/net/e1000e.c
 +++ b/hw/net/e1000e.c
@@ -80,6 +80,11 @@ struct E1000EState {
     E1000ECore core;
 +    /* 7.3 had the intr_state field that was in the original e1000e code
 +     * but that was removed prior to 2.7's release
 +     */
 +    bool redhat_7_3_intr_state_enable;
 +    uint32_t redhat_7_3_intr_state;
 };
 #define E1000E_MMIO_IDX     0
@@ -95,6 +100,10 @@ struct E1000EState {
 #define E1000E_MSIX_TABLE   (0x0000)
 #define E1000E_MSIX_PBA     (0x2000)
 +/* Values as in RHEL 7.3 build and original upstream */
 +#define RH_E1000E_USE_MSI     BIT(0)
 +#define RH_E1000E_USE_MSIX    BIT(1)
 +
 static uint64_t
 e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size)
 {
@@ -306,6 +315,8 @@ e1000e_init_msix(E1000EState *s)
     } else {
         if (!e1000e_use_msix_vectors(s, E1000E_MSIX_VEC_NUM)) {
             msix_uninit(d, &s->msix, &s->msix);
 +        } else {
 +            s->redhat_7_3_intr_state |= RH_E1000E_USE_MSIX;
         }
     }
 }
@@ -477,6 +488,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
     ret = msi_init(PCI_DEVICE(s), 0xD0, 1, true, false, NULL);
     if (ret) {
         trace_e1000e_msi_init_fail(ret);
 +    } else {
 +        s->redhat_7_3_intr_state |= RH_E1000E_USE_MSI;
     }
     if (e1000e_add_pm_capability(pci_dev, e1000e_pmrb_offset,
@@ -600,6 +613,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
     VMSTATE_STRUCT_ARRAY(_f, _s, _num, 0,                           \
                          e1000e_vmstate_intr_timer, E1000IntrDelayTimer)
 +static bool rhel_7_3_check(void *opaque, int version_id)
 +{
 +    return ((E1000EState *)opaque)->redhat_7_3_intr_state_enable;
 +}
 +
 static const VMStateDescription e1000e_vmstate = {
     .name = "e1000e",
     .version_id = 1,
@@ -611,6 +629,7 @@ static const VMStateDescription e1000e_vmstate = {
         VMSTATE_MSIX(parent_obj, E1000EState),
         VMSTATE_UINT32(ioaddr, E1000EState),
 +        VMSTATE_UINT32_TEST(redhat_7_3_intr_state, E1000EState, rhel_7_3_check),
         VMSTATE_UINT32(core.rxbuf_min_shift, E1000EState),
         VMSTATE_UINT8(core.rx_desc_len, E1000EState),
         VMSTATE_UINT32_ARRAY(core.rxbuf_sizes, E1000EState,
@@ -659,6 +678,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
 static Property e1000e_properties[] = {
     DEFINE_NIC_PROPERTIES(E1000EState, conf),
 +    DEFINE_PROP_BOOL("__redhat_e1000e_7_3_intr_state", E1000EState,
 +                        redhat_7_3_intr_state_enable, false),
     DEFINE_PROP_SIGNED("disable_vnet_hdr", E1000EState, disable_vnet, false,
                         e1000e_prop_disable_vnet, bool),
     DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
 index 90b4fc63ce..3ffb9dd22c 100644
 --- a/hw/net/rtl8139.c
@ -559,34 +345,30 @@ index 90b4fc63ce..3ffb9dd22c 100644
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
-index 5d0fcacd0c..4a2e52031b 100644
+index 4fbafddb22..6c42cc22cd 100644
 --- a/hw/rtc/mc146818rtc.c
 +++ b/hw/rtc/mc146818rtc.c
-@@ -44,6 +44,7 @@
+@@ -43,6 +43,7 @@
 #include "qapi/qapi-events-misc-target.h"
 #include "qapi/visitor.h"
 #include "exec/address-spaces.h"
 #include "hw/rtc/mc146818rtc_regs.h"
 +#include "migration/migration.h"
 #ifdef TARGET_I386
 #include "qapi/qapi-commands-misc-target.h"
-@@ -822,6 +823,11 @@ static int rtc_post_load(void *opaque, int version_id)
+@@ -821,6 +822,7 @@ static int rtc_post_load(void *opaque, int version_id)
 static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
 {
     RTCState *s = (RTCState *)opaque;
 +
 +    if (migrate_pre_2_2) {
 +        return false;
 +    }
 +
     return s->irq_reinject_on_ack_count != 0;
 }
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index f22c4f5b73..a305a4bcea 100644
+index 7397e56737..3a4bb894ba 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
-@@ -56,6 +56,9 @@ static bool smbios_legacy = true;
+@@ -57,6 +57,9 @@ static bool smbios_legacy = true;
 static bool smbios_uuid_encoded = true;
 /* end: legacy structures & constants for <= 2.0 machines */
@ -596,7 +378,7 @@ index f22c4f5b73..a305a4bcea 100644
 uint8_t *smbios_tables;
 size_t smbios_tables_len;
-@@ -570,7 +573,7 @@ static void smbios_build_type_1_table(void)
+@@ -619,7 +622,7 @@ static void smbios_build_type_1_table(void)
 static void smbios_build_type_2_table(void)
 {
@ -605,7 +387,7 @@ index f22c4f5b73..a305a4bcea 100644
     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -792,7 +795,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
+@@ -888,7 +891,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version, bool legacy_mode,
@ -617,7 +399,7 @@ index f22c4f5b73..a305a4bcea 100644
 {
     smbios_have_defaults = true;
     smbios_legacy = legacy_mode;
-@@ -813,11 +819,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
+@@ -909,11 +915,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
         g_free(smbios_entries);
     }
@ -698,10 +480,10 @@ index 0cb02a6432..962a9622e5 100644
     if (s->masterbus) {
         USBPort *ports[NB_PORTS];
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
-index 9421734d0f..9bfe236a7d 100644
+index e934b1a5b1..e18b05e528 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
-@@ -101,6 +101,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
+@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
@ -735,7 +517,7 @@ index 9421734d0f..9bfe236a7d 100644
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
-@@ -122,23 +149,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
@ -762,7 +544,7 @@ index 9421734d0f..9bfe236a7d 100644
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
-@@ -151,6 +167,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
@ -777,7 +559,7 @@ index 9421734d0f..9bfe236a7d 100644
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
-@@ -195,11 +219,18 @@ static void xhci_instance_init(Object *obj)
+@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
@ -808,79 +590,11 @@ index c193f79443..086a1feb1e 100644
 } XHCIPciState;
 #endif
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
 index 46212b1e69..6d1f278aad 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
@@ -3490,9 +3490,27 @@ static const VMStateDescription vmstate_xhci_slot = {
     }
 };
 +static int xhci_event_pre_save(void *opaque)
 +{
 +    XHCIEvent *s = opaque;
 +
 +    s->cve_2014_5263_a = ((uint8_t *)&s->type)[0];
 +    s->cve_2014_5263_b = ((uint8_t *)&s->type)[1];
 +
 +    return 0;
 +}
 +
 +bool migrate_cve_2014_5263_xhci_fields;
 +
 +static bool xhci_event_cve_2014_5263(void *opaque, int version_id)
 +{
 +    return migrate_cve_2014_5263_xhci_fields;
 +}
 +
 static const VMStateDescription vmstate_xhci_event = {
     .name = "xhci-event",
     .version_id = 1,
 +    .pre_save = xhci_event_pre_save,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(type,   XHCIEvent),
         VMSTATE_UINT32(ccode,  XHCIEvent),
@@ -3501,6 +3519,8 @@ static const VMStateDescription vmstate_xhci_event = {
         VMSTATE_UINT32(flags,  XHCIEvent),
         VMSTATE_UINT8(slotid,  XHCIEvent),
         VMSTATE_UINT8(epid,    XHCIEvent),
 +        VMSTATE_UINT8_TEST(cve_2014_5263_a, XHCIEvent, xhci_event_cve_2014_5263),
 +        VMSTATE_UINT8_TEST(cve_2014_5263_b, XHCIEvent, xhci_event_cve_2014_5263),
         VMSTATE_END_OF_LIST()
     }
 };
 diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h
 index 7bba361f3b..f450ffd13b 100644
 --- a/hw/usb/hcd-xhci.h
 +++ b/hw/usb/hcd-xhci.h
@@ -149,6 +149,8 @@ typedef struct XHCIEvent {
     uint32_t flags;
     uint8_t slotid;
     uint8_t epid;
 +    uint8_t cve_2014_5263_a;
 +    uint8_t cve_2014_5263_b;
 } XHCIEvent;
 typedef struct XHCIInterrupter {
 diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
 index df519e40b5..e1ecfbaf1f 100644
 --- a/include/hw/acpi/ich9.h
 +++ b/include/hw/acpi/ich9.h
@@ -62,6 +62,9 @@ typedef struct ICH9LPCPMRegs {
     bool smm_compat;
     bool enable_tco;
     TCOIORegs tco_regs;
 +
 +    /* RH addition, see bz 1489800 */
 +    bool force_rev1_fadt;
 } ICH9LPCPMRegs;
 #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index ad6c8fd537..2d7a65724a 100644
+index accd6eff35..f5423f351a 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -413,4 +413,37 @@ extern const size_t hw_compat_2_2_len;
+@@ -416,4 +416,22 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
@ -901,28 +615,13 @@ index ad6c8fd537..2d7a65724a 100644
 +
 +extern GlobalProperty hw_compat_rhel_7_6[];
 +extern const size_t hw_compat_rhel_7_6_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_5[];
 +extern const size_t hw_compat_rhel_7_5_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_4[];
 +extern const size_t hw_compat_rhel_7_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_3[];
 +extern const size_t hw_compat_rhel_7_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_2[];
 +extern const size_t hw_compat_rhel_7_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_1[];
 +extern const size_t hw_compat_rhel_7_1_len;
 +
 #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 02a0ced0a0..67e38a1b13 100644
+index 5a0dd0c8cf..2cb1ec2bab 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
-@@ -267,7 +267,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
+@@ -278,7 +278,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
 void smbios_set_cpuid(uint32_t version, uint32_t features);
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version, bool legacy_mode,
@ -935,7 +634,7 @@ index 02a0ced0a0..67e38a1b13 100644
 void smbios_get_tables(MachineState *ms,
                        const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index dcf060b791..93c012ac95 100644
+index 88dffe7517..17ad7bfc3a 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -107,6 +107,9 @@ struct PCMachineClass {
@ -948,47 +647,6 @@ index dcf060b791..93c012ac95 100644
     /* RAM / address space compat: */
     bool gigabyte_align;
 diff --git a/include/hw/usb.h b/include/hw/usb.h
 index 436e07b304..edb2cd94b6 100644
 --- a/include/hw/usb.h
 +++ b/include/hw/usb.h
@@ -577,4 +577,7 @@ void usb_pcap_init(FILE *fp);
 void usb_pcap_ctrl(USBPacket *p, bool setup);
 void usb_pcap_data(USBPacket *p, bool setup);
 +/* hcd-xhci.c -- rhel7.0.0 machine type compatibility */
 +extern bool migrate_cve_2014_5263_xhci_fields;
 +
 #endif
 diff --git a/migration/migration.c b/migration/migration.c
 index 8ca034136b..4afc6069b6 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -167,6 +167,8 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
     MIGRATION_CAPABILITY_X_COLO,
     MIGRATION_CAPABILITY_VALIDATE_UUID);
 +bool migrate_pre_2_2;
 +
 /* When we add fault tolerance, we could have several
    migrations at once.  For now we don't need to add
    dynamic creation of migration */
 diff --git a/migration/migration.h b/migration/migration.h
 index db6708326b..1b6c69751c 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
@@ -368,6 +368,11 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
 void migrate_add_address(SocketAddress *address);
 int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
 +/*
 + * Disables a load of subsections that were added in 2.2/rh7.2 for backwards
 + * migration compatibility.
 + */
 +extern bool migrate_pre_2_2;
 #define qemu_ram_foreach_block \
   #warning "Use foreach_not_ignored_block in migration code"
 -- 
 2.27.0
--- a/0007-Add-aarch64-machine-types.patch
+++ b/0007-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From ee8aeb6b79bde21b581090c479faf10e716a7e6d Mon Sep 17 00:00:00 2001
+From 38c87d1469539d2b5224d298db85b0fd43d8bb0c Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -7,15 +7,25 @@ Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- hw/arm/virt.c         | 211 +++++++++++++++++++++++++++++++++++++++++-
+Rebase notes (210623):
 - Use CONFIG_TPM check when using TPM structures
 Rebase notes (6.1.0 rc0):
 - Add support for default_bus_bypass_iommu
 Merged patches (6.1.0 rc1):
 - ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
 - 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
 ---
 hw/arm/virt.c         | 210 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 218 insertions(+), 1 deletion(-)
+ 2 files changed, 217 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index f904d3e98e..080cf54ef1 100644
+index cd1a2d985d..3c8e6de36d 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -80,6 +80,7 @@
+@@ -78,6 +78,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
@ -23,7 +33,7 @@ index f904d3e98e..080cf54ef1 100644
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -106,7 +107,48 @@
+@@ -104,7 +105,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@ -73,7 +83,7 @@ index f904d3e98e..080cf54ef1 100644
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2113,6 +2155,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2117,6 +2159,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -81,7 +91,7 @@ index f904d3e98e..080cf54ef1 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2140,6 +2183,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2144,6 +2187,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -89,7 +99,7 @@ index f904d3e98e..080cf54ef1 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-@@ -2237,6 +2281,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
+@@ -2241,6 +2285,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
@ -97,7 +107,7 @@ index f904d3e98e..080cf54ef1 100644
 static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2264,6 +2309,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+@@ -2268,6 +2313,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
@ -105,7 +115,7 @@ index f904d3e98e..080cf54ef1 100644
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-@@ -2584,6 +2630,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2603,6 +2649,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
@ -113,7 +123,7 @@ index f904d3e98e..080cf54ef1 100644
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -2910,3 +2957,165 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -2948,3 +2995,164 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -128,7 +138,9 @@ index f904d3e98e..080cf54ef1 100644
 +    mc->init = machvirt_init;
 +    /* Maximum supported VCPU count for all virt-rhel* machines */
 +    mc->max_cpus = 384;
 +#ifdef CONFIG_TPM
 +    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 +#endif
 +    mc->block_default_type = IF_VIRTIO;
 +    mc->no_cdrom = 1;
 +    mc->pci_allow_0_address = true;
@ -156,6 +168,18 @@ index f904d3e98e..080cf54ef1 100644
 +    object_class_property_set_description(oc, "acpi",
 +        "Enable ACPI");
 +
 +    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
 +                                   virt_set_highmem);
 +    object_class_property_set_description(oc, "highmem",
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
@ -164,7 +188,6 @@ index f904d3e98e..080cf54ef1 100644
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
 +
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
@ -172,6 +195,13 @@ index f904d3e98e..080cf54ef1 100644
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +    object_class_property_set_description(oc, "default_bus_bypass_iommu",
 +                                          "Set on/off to enable/disable "
 +                                          "bypass_iommu for default root bus");
 +
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
@ -187,17 +217,7 @@ index f904d3e98e..080cf54ef1 100644
 +
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    object_property_add_bool(obj, "highmem", virt_get_highmem,
 +                             virt_set_highmem);
 +    object_property_set_description(obj, "highmem",
 +                                    "Set on/off to enable/disable using "
 +                                    "physical address space above 32 bits");
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +    object_property_add_str(obj, "gic-version", virt_get_gic_version,
 +                        virt_set_gic_version);
 +    object_property_set_description(obj, "gic-version",
 +                                    "Set GIC version. "
 +                                    "Valid values are 2, 3, host and max");
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +
@ -226,6 +246,9 @@ index f904d3e98e..080cf54ef1 100644
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
 +    /* The default root bus is attached to iommu by default */
 +    vms->default_bus_bypass_iommu = false;
 +
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
@ -254,36 +277,22 @@ index f904d3e98e..080cf54ef1 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel840_virt_options(MachineClass *mc)
+static void rhel900_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(8, 4, 0)
+DEFINE_RHEL_MACHINE_AS_LATEST(9, 0, 0)
 +
-+static void rhel830_virt_options(MachineClass *mc)
+static void rhel850_virt_options(MachineClass *mc)
 +{
-+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+    rhel900_virt_options(mc);
 +
 +    rhel840_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    vmc->no_kvm_steal_time = true;
 +}
-+DEFINE_RHEL_MACHINE(8, 3, 0)
+DEFINE_RHEL_MACHINE(8, 5, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
 +    rhel830_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +    mc->numa_mem_supported = true;
 +    mc->auto_enable_numa_with_memdev = false;
 +}
 +DEFINE_RHEL_MACHINE(8, 2, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index 921416f918..6c34864a0a 100644
+index 9661c46699..ac21ca712a 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -170,9 +170,17 @@ struct VirtMachineState {
+@@ -171,9 +171,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
--- a/0008-Add-ppc64-machine-types.patch
+++ b/0008-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From d70214aa1d8bf7aae9ef3a6bbc04f01735722e3c Mon Sep 17 00:00:00 2001
+From 01fe9632c4dcc7a6ce9c0100db6256e815e6bf87 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -6,21 +6,32 @@ Subject: Add ppc64 machine types
 Adding changes to add RHEL machine types for ppc64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Merged patches (6.1.0 RC1):
 - c438c25ac3 redhat: Define pseries-rhel8.5.0 machine type
 Merged patches (6.1.0):
 - a3995e2eff Remove RHEL 7.0.0 machine type (only ppc64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only ppc64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only ppc64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only ppc64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only ppc64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only ppc64 changes)
 ---
- hw/ppc/spapr.c          | 368 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 238 +++++++++++++++++++++++++++++++++++++++-
- hw/ppc/spapr_cpu_core.c |  13 ++
+ hw/ppc/spapr_cpu_core.c |  13 +++
 include/hw/ppc/spapr.h  |   4 +
- target/ppc/compat.c     |  13 +-
+ target/ppc/compat.c     |  13 ++-
 target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 +++
+ target/ppc/kvm.c        |  28 +++++
- target/ppc/kvm_ppc.h    |  13 ++
+ target/ppc/kvm_ppc.h    |  13 +++
- 7 files changed, 438 insertions(+), 1 deletion(-)
+ 7 files changed, 307 insertions(+), 3 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index e4be00b732..f9e8dfdfc9 100644
+index 81699d4f8b..1386e45e70 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1568,6 +1568,9 @@ static void spapr_machine_reset(MachineState *machine)
+@@ -1592,6 +1592,9 @@ static void spapr_machine_reset(MachineState *machine)
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
@ -30,7 +41,7 @@ index e4be00b732..f9e8dfdfc9 100644
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3254,6 +3257,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3315,6 +3318,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
@ -51,7 +62,7 @@ index e4be00b732..f9e8dfdfc9 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3327,6 +3344,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3393,6 +3410,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -64,23 +75,23 @@ index e4be00b732..f9e8dfdfc9 100644
 }
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4554,6 +4577,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4634,6 +4657,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
-     smc->smp_threads_vsmt = true;
+     vmc->client_architecture_support = spapr_vof_client_architecture_support;
-     smc->nr_xirqs = SPAPR_NR_XIRQS;
+     vmc->quiesce = spapr_vof_quiesce;
-     xfc->match_nvt = spapr_match_nvt;
+     vmc->setprop = spapr_vof_setprop;
 +    smc->has_power9_support = true;
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4604,6 +4628,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4685,6 +4709,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-6.0
+  * pseries-6.1
  */
-@@ -4694,6 +4719,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4786,6 +4811,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -88,7 +99,7 @@ index e4be00b732..f9e8dfdfc9 100644
 /*
  * pseries-4.0
-@@ -4713,6 +4739,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4805,6 +4831,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
     return true;
 }
@ -97,7 +108,7 @@ index e4be00b732..f9e8dfdfc9 100644
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4871,6 +4899,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+@@ -4963,6 +4991,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
@ -105,7 +116,7 @@ index e4be00b732..f9e8dfdfc9 100644
 static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
-@@ -4926,6 +4955,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+@@ -5018,6 +5047,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     return true;
 }
@ -113,7 +124,7 @@ index e4be00b732..f9e8dfdfc9 100644
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5040,6 +5070,344 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -5132,10 +5162,214 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -131,19 +142,31 @@ index e4be00b732..f9e8dfdfc9 100644
 +}
 +
 +/*
 + * pseries-rhel8.5.0
 + * like pseries-6.0
 + */
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +/*
 + * pseries-rhel8.4.0
 + * like pseries-5.2
 + */
 +
 +static void spapr_machine_rhel840_class_options(MachineClass *mc)
 +{
-+    /* The default machine type must apply the RHEL specific defaults */
+    spapr_machine_rhel850_class_options(mc);
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +}
 +
-+DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", true);
+DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +/*
 + * pseries-rhel8.3.0
@ -216,7 +239,8 @@ index e4be00b732..f9e8dfdfc9 100644
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1,
 +                     hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-+
+ 
 -static void spapr_machine_register_types(void)
 +    /* from pseries-4.2 */
 +    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
 +}
@ -231,7 +255,8 @@ index e4be00b732..f9e8dfdfc9 100644
 + */
 +
 +static void spapr_machine_rhel800_class_options(MachineClass *mc)
-+{
+ {
 -    type_register_static(&spapr_machine_info);
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel810_class_options(mc);
@ -249,8 +274,8 @@ index e4be00b732..f9e8dfdfc9 100644
 +    smc->dr_phb_enabled = false;
 +    smc->broken_host_serial_model = true;
 +    smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_OFF;
-+}
+ }
-+
+ 
 +DEFINE_SPAPR_MACHINE(rhel800, "rhel8.0.0", false);
 +
 +/*
@ -315,149 +340,7 @@ index e4be00b732..f9e8dfdfc9 100644
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
 +
-+static void spapr_machine_rhel750_class_options(MachineClass *mc)
+ type_init(spapr_machine_register_types)
 +{
 +    spapr_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
 +
 +/*
 + * pseries-rhel7.5.0-sxxm
 + *
 + * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.4.0
 + * like spapr_compat_2_9
 + */
 +GlobalProperty spapr_compat_rhel7_4[] = {
 +    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
 +};
 +const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
 +
 +static void spapr_machine_rhel740_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
 +    smc->has_power9_support = false;
 +    smc->pre_2_10_has_unused_icps = true;
 +    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
 +    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
 +
 +/*
 + * pseries-rhel7.4.0-sxxm
 + *
 + * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.3.0
 + * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
 + */
 +GlobalProperty spapr_compat_rhel7_3[] = {
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
 +    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
 +};
 +const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
 +
 +static void spapr_machine_rhel730_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
 +    mc->default_machine_opts = "modern-hotplug-events=off";
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
 +
 +    smc->phb_placement = phb_placement_2_7;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
 +
 +/*
 + * pseries-rhel7.3.0-sxxm
 + *
 + * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.2.0
 + */
 +/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
 + * has been backported to RHEL7_2 so we don't need it here.
 + */
 +
 +GlobalProperty spapr_compat_rhel7_2[] = {
 +    { "spapr-vlan", "use-rx-buffer-pools", "off" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
 +};
 +const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
 +
 +static void spapr_machine_rhel720_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->use_ohci_by_default = true;
 +    mc->has_hotpluggable_cpus = NULL;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 64178f0f9a..2bff13a6ab 100644
 --- a/hw/ppc/spapr_cpu_core.c
@ -497,10 +380,10 @@ index 64178f0f9a..2bff13a6ab 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index bf7cab7a2c..54cdde8980 100644
+index 637652ad16..589d1a262c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -143,6 +143,7 @@ struct SpaprMachineClass {
+@@ -146,6 +146,7 @@ struct SpaprMachineClass {
     bool pre_5_1_assoc_refpoints;
     bool pre_5_2_numa_associativity;
@ -508,9 +391,9 @@ index bf7cab7a2c..54cdde8980 100644
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -223,6 +224,9 @@ struct SpaprMachineState {
+@@ -230,6 +231,9 @@ struct SpaprMachineState {
-     int fwnmi_machine_check_interlock;
+     /* Set by -boot */
-     QemuCond fwnmi_machine_check_interlock_cond;
+     char *boot_device;
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
@ -544,10 +427,10 @@ index 7949a24f5a..f207a9ba01 100644
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index e73416da68..4eb427a601 100644
+index 93d308ac8f..dca9bdf846 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1347,6 +1347,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1378,6 +1378,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -556,18 +439,18 @@ index e73416da68..4eb427a601 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 104a308abb..cb0fb67383 100644
+index dc93b99189..0f4f072fbd 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
-@@ -89,6 +89,7 @@ static int cap_ppc_count_cache_flush_assist;
+@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
 static int cap_ppc_nested_kvm_hv;
 static int cap_large_decr;
 static int cap_fwnmi;
 static int cap_rpt_invalidate;
 +static int cap_ppc_secure_guest;
 static uint32_t debug_inst_opcode;
-@@ -136,6 +137,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
@ -575,10 +458,15 @@ index 104a308abb..cb0fb67383 100644
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
-@@ -2551,6 +2553,16 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
+@@ -2558,9 +2560,20 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
     return 0;
 }
 +<<<<<<< HEAD
 int kvmppc_has_cap_rpt_invalidate(void)
 {
     return cap_rpt_invalidate;
 +=======
 +bool kvmppc_has_cap_secure_guest(void)
 +{
 +    return !!cap_ppc_secure_guest;
@ -587,12 +475,11 @@ index 104a308abb..cb0fb67383 100644
 +int kvmppc_enable_cap_secure_guest(void)
 +{
 +    return kvm_vm_enable_cap(kvm_state, KVM_CAP_PPC_SECURE_GUEST, 0, 1);
-+}
+>>>>>>> 89c02f0e37... Add ppc64 machine types
-+
+ }
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
- {
+@@ -2959,3 +2972,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
     uint32_t host_pvr = mfpvr();
@@ -2947,3 +2959,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
 {
     return true;
 }
@ -612,10 +499,10 @@ index 104a308abb..cb0fb67383 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 989f61ace0..2e7a5d3fc1 100644
+index ee9325bf9a..20dbb95989 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
-@@ -39,6 +39,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
+@@ -40,6 +40,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
@ -623,17 +510,17 @@ index 989f61ace0..2e7a5d3fc1 100644
 #ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
-@@ -72,6 +73,8 @@ int kvmppc_set_cap_nested_kvm_hv(int enable);
+@@ -74,6 +75,8 @@ int kvmppc_get_cap_large_decr(void);
 int kvmppc_get_cap_large_decr(void);
 int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_has_cap_rpt_invalidate(void);
 int kvmppc_enable_hwrng(void);
 +bool kvmppc_has_cap_secure_guest(void);
 +int kvmppc_enable_cap_secure_guest(void);
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -381,6 +384,16 @@ static inline int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable)
+@@ -393,6 +396,16 @@ static inline int kvmppc_has_cap_rpt_invalidate(void)
-     return -1;
+     return false;
 }
 +static inline bool kvmppc_has_cap_secure_guest(void)
--- a/0009-Add-s390x-machine-types.patch
+++ b/0009-Add-s390x-machine-types.patch
@ -1,4 +1,4 @@
-From 09eba380295aef0a27d3fbcdda43019ab2898e08 Mon Sep 17 00:00:00 2001
+From 8ae9e40c13f4beb1eedaef46e6b00f562de692e2 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@ -6,15 +6,19 @@ Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Merged patches (6.1.0 RC1):
 - 64a9a5c971 hw/s390x: Remove the RHEL7-only machine type
 - 395516d62b redhat: s390x: add rhel-8.5.0 compat machine
 ---
- hw/s390x/s390-virtio-ccw.c | 87 +++++++++++++++++++++++++++++++++++++-
+ hw/s390x/s390-virtio-ccw.c | 66 +++++++++++++++++++++++++++++++++++++-
- 1 file changed, 86 insertions(+), 1 deletion(-)
+ 1 file changed, 65 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 2972b607f3..8df6dd1c71 100644
+index e4b18aef49..9a51dd8de2 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -771,7 +771,7 @@ bool css_migration_enabled(void)
+@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
@ -23,29 +27,40 @@ index 2972b607f3..8df6dd1c71 100644
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = true;                                            \
-@@ -795,6 +795,7 @@ bool css_migration_enabled(void)
+@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_6_0_instance_options(MachineState *machine)
+ static void ccw_machine_6_1_instance_options(MachineState *machine)
 {
 }
-@@ -1071,6 +1072,90 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1082,6 +1083,69 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
-+DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", true);
+DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
@ -87,38 +102,6 @@ index 2972b607f3..8df6dd1c71 100644
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 +
 +static void ccw_machine_rhel750_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
 +    ccw_machine_rhel760_instance_options(machine);
 +
 +    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
 +       based on 2.10 */
 +    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
 +
 +    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
 +}
 +
 +GlobalProperty ccw_compat_rhel_7_5[] = {
 +        {
 +            .driver   = TYPE_SCLP_EVENT_FACILITY,
 +            .property = "allow_all_mask_sizes",
 +            .value    = "off",
 +        },
 +};
 +const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 +
 +static void ccw_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
 +    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 +}
 +DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
 static void ccw_machine_register_types(void)
 {
--- a/0010-Add-x86_64-machine-types.patch
+++ b/0010-Add-x86_64-machine-types.patch
@ -1,4 +1,4 @@
-From a082c53cc14afcd2ad77262575af50e164e75649 Mon Sep 17 00:00:00 2001
+From afc727ec3b2ad5a5c4033f25a63c877500b0194d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@ -6,37 +6,37 @@ Subject: Add x86_64 machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (210609):
 - Update qemu64 cpu spec
 Merged patches (6.1.0 RC1):
 - 59c284ad3b x86: Add x86 rhel8.5 machine types
 - a8868b42fe redhat: x86: Enable 'kvm-asyncpf-int' by default
 Merged patches (6.1.0):
 - a3995e2eff Remove RHEL 7.0.0 machine type (only x86_64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only x86_64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only x86_64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only x86_64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only x86_64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only x86_64 changes)
 ---
- hw/i386/acpi-build.c       |   3 +
+ hw/i386/pc.c               | 114 +++++++++++++++++++++++-
- hw/i386/pc.c               | 277 ++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c          |  68 +++++++++++++-
- hw/i386/pc_piix.c          | 225 +++++++++++++++++++++++++++++-
+ hw/i386/pc_q35.c           | 177 ++++++++++++++++++++++++++++++++++++-
 hw/i386/pc_q35.c           | 214 +++++++++++++++++++++++++++-
 include/hw/boards.h        |   2 +
- include/hw/i386/pc.h       |  39 ++++++
+ include/hw/i386/pc.h       |  21 +++++
- target/i386/cpu.c          |   3 +-
+ target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
- 9 files changed, 763 insertions(+), 9 deletions(-)
+ 8 files changed, 385 insertions(+), 7 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index de98750aef..7bd67f7877 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -231,6 +231,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
         pm->fadt.reset_reg = r;
         pm->fadt.reset_val = 0xf;
         pm->fadt.flags |= 1 << ACPI_FADT_F_RESET_REG_SUP;
 +        if (object_property_get_bool(lpc,
 +                                     "__com.redhat_force-rev1-fadt", NULL))
 +            pm->fadt.rev = 1;
         pm->cpu_hp_io_base = ICH9_CPU_HOTPLUG_IO_BASE;
         pm->smi_on_cpuhp =
             !!(smi_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT));
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 8a84b25a03..edc02a68ca 100644
+index c2b9d62a35..719cedaa4b 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -355,6 +355,275 @@ GlobalProperty pc_compat_1_4[] = {
+@@ -362,6 +362,116 @@ GlobalProperty pc_compat_1_4[] = {
 };
 const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
@ -51,9 +51,18 @@ index 8a84b25a03..edc02a68ca 100644
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */ 
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_8_4_compat[] = {
 +    /* pc_rhel_8_4_compat from pc_compat_5_2 */
 +    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
 +};
 +const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
 +
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
@ -135,203 +144,24 @@ index 8a84b25a03..edc02a68ca 100644
 +};
 +const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
 +
 +/* Similar to PC_COMPAT_2_11 + PC_COMPAT_2_10, but:
 + * - x-hv-max-vps was backported to 7.5
 + * - x-pci-hole64-fix was backported to 7.5
 + */
 +GlobalProperty pc_rhel_7_5_compat[] = {
 +    /* pc_rhel_7_5_compat from pc_compat_2_11 */  
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "clflushopt", "off" },
 +    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 +    { TYPE_X86_CPU, "legacy-cache", "on" },
 +    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 +    { TYPE_X86_CPU, "topoext", "off" },
 +    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 +    { "EPYC-" TYPE_X86_CPU, "xlevel", stringify(0x8000000a) },
 +    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 +    { "EPYC-IBPB-" TYPE_X86_CPU, "xlevel", stringify(0x8000000a) },
 +};
 +const size_t pc_rhel_7_5_compat_len = G_N_ELEMENTS(pc_rhel_7_5_compat);
 +
 +GlobalProperty pc_rhel_7_4_compat[] = {
 +    /* pc_rhel_7_4_compat from pc_compat_2_9 */ 
 +    { "mch", "extended-tseg-mbytes", stringify(0) },
 +    /* bz 1489800 */ 
 +    { "ICH9-LPC", "__com.redhat_force-rev1-fadt", "on" },
 +    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 +    { "i440FX-pcihost", "x-pci-hole64-fix", "off" },
 +    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 +    { "q35-pcihost", "x-pci-hole64-fix", "off" },
 +    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 +    { TYPE_X86_CPU, "x-hv-max-vps", "0x40" },
 +};
 +const size_t pc_rhel_7_4_compat_len = G_N_ELEMENTS(pc_rhel_7_4_compat);
 +
 +GlobalProperty pc_rhel_7_3_compat[] = {
 +    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 +    { "kvmclock", "x-mach-use-reliable-get-clock", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { TYPE_X86_CPU, "l3-cache", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { TYPE_X86_CPU, "full-cpuid-auto-level", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "family", "15" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "stepping", "1" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 +    { "isa-pcspk", "migrate", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_6 */ 
 +    { TYPE_X86_CPU, "cpuid-0xb", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 +    { "ICH9-LPC", "x-smi-broadcast", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 +    { TYPE_X86_CPU, "vmware-cpuid-freq", "off" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 +    { "Haswell-" TYPE_X86_CPU, "stepping", "1" },
 +    /* pc_rhel_7_3_compat from pc_compat_2_3 added in 2.9*/ 
 +    { TYPE_X86_CPU, "kvm-no-smi-migration", "on" },
 +};
 +const size_t pc_rhel_7_3_compat_len = G_N_ELEMENTS(pc_rhel_7_3_compat);
 +
 +GlobalProperty pc_rhel_7_2_compat[] = {
 +    { "phenom" "-" TYPE_X86_CPU, "rdtscp", "off"},
 +    { "qemu64" "-" TYPE_X86_CPU, "sse4a", "on" },
 +    { "qemu64" "-" TYPE_X86_CPU, "abm", "on" },
 +    { "Haswell-" TYPE_X86_CPU, "abm", "off" },
 +    { "Haswell-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 +    { "Haswell-noTSX-" TYPE_X86_CPU, "abm", "off" },
 +    { "Haswell-noTSX-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 +    { "Broadwell-" TYPE_X86_CPU, "abm", "off" },
 +    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 +    { "Broadwell-noTSX-" TYPE_X86_CPU, "abm", "off" },
 +    { "Broadwell-noTSX-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 +    { "host" "-" TYPE_X86_CPU, "host-cache-info", "on" },
 +    { TYPE_X86_CPU, "check", "off" },
 +    { "qemu32" "-" TYPE_X86_CPU, "popcnt", "on" },
 +    { TYPE_X86_CPU, "arat", "off" },
 +    { "usb-redir", "streams", "off" },
 +    { TYPE_X86_CPU, "fill-mtrr-mask", "off" },
 +    { "apic-common", "legacy-instance-id", "on" },
 +};
 +const size_t pc_rhel_7_2_compat_len = G_N_ELEMENTS(pc_rhel_7_2_compat);
 +
 +GlobalProperty pc_rhel_7_1_compat[] = {
 +    { "kvm64" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "kvm32" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Conroe" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Penryn" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Nehalem" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Nehalem-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Westmere" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Westmere-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "SandyBridge" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "SandyBridge-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Haswell" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Haswell-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Broadwell" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Opteron_G1" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Opteron_G2" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "vme", "off" },
 +    { "Haswell" "-" TYPE_X86_CPU,  "f16c", "off" },
 +    { "Haswell-IBRS" "-" TYPE_X86_CPU, "f16c", "off" },
 +    { "Haswell" "-" TYPE_X86_CPU, "rdrand", "off" },
 +    { "Haswell-IBRS" "-" TYPE_X86_CPU, "rdrand", "off" },
 +    { "Broadwell" "-" TYPE_X86_CPU, "f16c", "off" },
 +    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "f16c", "off" },
 +    { "Broadwell" "-" TYPE_X86_CPU, "rdrand", "off" },
 +    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "rdrand", "off" },
 +    { "coreduo" "-" TYPE_X86_CPU, "vmx", "on" },
 +    { "core2duo" "-" TYPE_X86_CPU, "vmx", "on" },
 +    { "qemu64" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 +    { "kvm64" "-" TYPE_X86_CPU, "min-level", stringify(5) },
 +    { "pentium3" "-" TYPE_X86_CPU, "min-level", stringify(2) },
 +    { "n270" "-" TYPE_X86_CPU, "min-level", stringify(5) },
 +    { "Conroe" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 +    { "Penryn" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 +    { "Nehalem" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 +    { "n270" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Penryn" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Conroe" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Nehalem" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Westmere" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "SandyBridge" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "IvyBridge" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Haswell" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Haswell-noTSX" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Broadwell" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +    { "Broadwell-noTSX" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 +};
 +const size_t pc_rhel_7_1_compat_len = G_N_ELEMENTS(pc_rhel_7_1_compat);
 +
 +/*
 + * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
 + * types as the PC_COMPAT_* do for upstream types.
 + * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
 + */
 +
 +/*
 + * RHEL-7 is based on QEMU 1.5.3, so this needs the PC_COMPAT_*
 + * between our base and 1.5, less stuff backported to RHEL-7.0
 + * (usb-device.msos-desc), less stuff for devices we changed
 + * (qemu64-x86_64-cpu) or don't support (hpet, pci-serial-2x,
 + * pci-serial-4x) in 7.0.
 + */
 +GlobalProperty pc_rhel_7_0_compat[] = {
 +    { "virtio-scsi-pci", "any_layout", "off" },
 +    { "PIIX4_PM", "memory-hotplug-support", "off" },
 +    { "apic", "version", stringify(0x11) },
 +    { "nec-usb-xhci", "superspeed-ports-first", "off" },
 +    { "nec-usb-xhci", "force-pcie-endcap", "on" },
 +    { "pci-serial", "prog_if", stringify(0) },
 +    { "virtio-net-pci", "guest_announce", "off" },
 +    { "ICH9-LPC", "memory-hotplug-support", "off" },
 +    { "xio3130-downstream", COMPAT_PROP_PCP, "off" },
 +    { "ioh3420", COMPAT_PROP_PCP, "off" },
 +    { "PIIX4_PM", "acpi-pci-hotplug-with-bridge-support", "off" },
 +    { "e1000", "mitigation", "off" },
 +    { "virtio-net-pci", "ctrl_guest_offloads", "off" },
 +    { "Conroe" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Penryn" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Nehalem" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Nehalem-IBRS" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Westmere" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Westmere-IBRS" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Opteron_G1" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Opteron_G2" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "x2apic", "on" },
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "x2apic", "on" },
 +};
 +const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 +
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
-@@ -952,7 +1221,8 @@ void pc_memory_init(PCMachineState *pcms,
+@@ -1713,6 +1823,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
                            &error_fatal);
 -    if (pcmc->pci_enabled) {
 +    /* RH difference: See bz 1489800, explicitly make ROM ro */
 +    if (pcmc->pc_rom_ro) {
         memory_region_set_readonly(option_rom_mr, true);
     }
     memory_region_add_subregion_overlap(rom_memory,
@@ -1702,6 +1972,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->pvh_enabled = true;
     pcmc->kvmclock_create_always = true;
     assert(!mc->get_hotplug_handler);
 +    pcmc->pc_rom_ro = true;
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1713,7 +1985,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1724,7 +1835,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_boot_order = "cad";
     mc->smp_parse = pc_smp_parse;
     mc->block_default_type = IF_IDE;
@ -342,10 +172,10 @@ index 8a84b25a03..edc02a68ca 100644
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 62433d8022..d9c5df16d8 100644
+index eebb4f3141..19d6721f3d 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -54,6 +54,7 @@
+@@ -51,6 +51,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/xen.h"
@ -353,7 +183,7 @@ index 62433d8022..d9c5df16d8 100644
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
-@@ -176,8 +177,8 @@ static void pc_init1(MachineState *machine,
+@@ -174,8 +175,8 @@ static void pc_init1(MachineState *machine,
     if (pcmc->smbios_defaults) {
         MachineClass *mc = MACHINE_GET_CLASS(machine);
         /* These values are guest ABI, do not change */
@ -364,7 +194,7 @@ index 62433d8022..d9c5df16d8 100644
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
-@@ -316,6 +317,7 @@ static void pc_init1(MachineState *machine,
+@@ -314,6 +315,7 @@ static void pc_init1(MachineState *machine,
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
@ -372,7 +202,7 @@ index 62433d8022..d9c5df16d8 100644
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -927,3 +929,222 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+@@ -937,3 +939,65 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
@ -418,6 +248,8 @@ index 62433d8022..d9c5df16d8 100644
 +    pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
@ -436,170 +268,11 @@ index 62433d8022..d9c5df16d8 100644
 +
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 +
 +static void pc_init_rhel750(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel750_options(MachineClass *m)
 +{
 +    pc_machine_rhel760_options(m);
 +    m->alias = NULL;
 +    m->is_default = 0;
 +    m->desc = "RHEL 7.5.0 PC (i440FX + PIIX, 1996)";
 +    m->auto_enable_numa_with_memhp = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_5_compat, pc_rhel_7_5_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel750, "pc-i440fx-rhel7.5.0", pc_init_rhel750,
 +                  pc_machine_rhel750_options);
 +
 +static void pc_init_rhel740(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel740_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_machine_rhel750_options(m);
 +    m->desc = "RHEL 7.4.0 PC (i440FX + PIIX, 1996)";
 +    pcmc->pc_rom_ro = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel740, "pc-i440fx-rhel7.4.0", pc_init_rhel740,
 +                  pc_machine_rhel740_options);
 +
 +static void pc_init_rhel730(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel730_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_machine_rhel740_options(m);
 +    m->desc = "RHEL 7.3.0 PC (i440FX + PIIX, 1996)";
 +    pcmc->linuxboot_dma_enabled = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel730, "pc-i440fx-rhel7.3.0", pc_init_rhel730,
 +                  pc_machine_rhel730_options);
 +
 +
 +static void pc_init_rhel720(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel720_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
 +    pc_machine_rhel730_options(m);
 +    m->desc = "RHEL 7.2.0 PC (i440FX + PIIX, 1996)";
 +    /* From pc_i440fx_2_5_machine_options */
 +    x86mc->save_tsc_khz = false;
 +    m->legacy_fw_cfg_order = 1;
 +    /* Note: broken_reserved_end was already in 7.2 */
 +    /* From pc_i440fx_2_6_machine_options */
 +    pcmc->legacy_cpu_hotplug = true;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_2_compat, pc_rhel_7_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel720, "pc-i440fx-rhel7.2.0", pc_init_rhel720,
 +                  pc_machine_rhel720_options);
 +
 +static void pc_compat_rhel710(MachineState *machine)
 +{
 +    PCMachineState *pcms = PC_MACHINE(machine);
 +    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
 +
 +    /* From pc_compat_2_2 */
 +    pcmc->rsdp_in_ram = false;
 +    machine->suppress_vmdesc = true;
 +
 +    /* From pc_compat_2_1 */
 +    pcmc->smbios_uuid_encoded = false;
 +    x86_cpu_change_kvm_default("svm", NULL);
 +    pcmc->enforce_aligned_dimm = false;
 +
 +    /* Disable all the extra subsections that were added in 2.2 */
 +    migrate_pre_2_2 = true;
 +
 +    /* From pc_i440fx_2_4_machine_options */
 +    pcmc->broken_reserved_end = true;
 +}
 +
 +static void pc_init_rhel710(MachineState *machine)
 +{
 +    pc_compat_rhel710(machine);
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel710_options(MachineClass *m)
 +{
 +    pc_machine_rhel720_options(m);
 +    m->family = "pc_piix_Y";
 +    m->desc = "RHEL 7.1.0 PC (i440FX + PIIX, 1996)";
 +    m->default_display = "cirrus";
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_1, hw_compat_rhel_7_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_1_compat, pc_rhel_7_1_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel710, "pc-i440fx-rhel7.1.0", pc_init_rhel710,
 +                  pc_machine_rhel710_options);
 +
 +static void pc_compat_rhel700(MachineState *machine)
 +{
 +    PCMachineState *pcms = PC_MACHINE(machine);
 +    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
 +
 +    pc_compat_rhel710(machine);
 +
 +    /* Upstream enables it for everyone, we're a little more selective */
 +    x86_cpu_change_kvm_default("x2apic", NULL);
 +    x86_cpu_change_kvm_default("svm", NULL);
 +    pcmc->legacy_acpi_table_size = 6418; /* see pc_compat_2_0() */
 +    pcmc->smbios_legacy_mode = true;
 +    pcmc->has_reserved_memory = false;
 +    migrate_cve_2014_5263_xhci_fields = true;
 +}
 +
 +static void pc_init_rhel700(MachineState *machine)
 +{
 +    pc_compat_rhel700(machine);
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel700_options(MachineClass *m)
 +{
 +    pc_machine_rhel710_options(m);
 +    m->family = "pc_piix_Y";
 +    m->desc = "RHEL 7.0.0 PC (i440FX + PIIX, 1996)";
 +    compat_props_add(m->compat_props, pc_rhel_7_0_compat, pc_rhel_7_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel700, "pc-i440fx-rhel7.0.0", pc_init_rhel700,
 +                  pc_machine_rhel700_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index fce52ca70b..44109e4876 100644
+index e7724fd02c..8032babda5 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -195,8 +195,8 @@ static void pc_q35_init(MachineState *machine)
+@@ -196,8 +196,8 @@ static void pc_q35_init(MachineState *machine)
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
@ -610,7 +283,7 @@ index fce52ca70b..44109e4876 100644
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
-@@ -327,6 +327,7 @@ static void pc_q35_init(MachineState *machine)
+@@ -337,6 +337,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
@ -618,7 +291,7 @@ index fce52ca70b..44109e4876 100644
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -581,3 +582,212 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -602,3 +603,175 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
@ -647,6 +320,24 @@ index fce52ca70b..44109e4876 100644
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
 +static void pc_q35_init_rhel850(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel850_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.5.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 +                  pc_q35_machine_rhel850_options);
 +
 +
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
@ -655,12 +346,15 @@ index fce52ca70b..44109e4876 100644
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
+    pc_q35_machine_rhel850_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
@ -677,7 +371,6 @@ index fce52ca70b..44109e4876 100644
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel840_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
@ -774,68 +467,11 @@ index fce52ca70b..44109e4876 100644
 +
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 +
 +static void pc_q35_init_rhel750(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel750_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel760_options(m);
 +    m->alias = NULL;
 +    m->desc = "RHEL-7.5.0 PC (Q35 + ICH9, 2009)";
 +    m->auto_enable_numa_with_memhp = false;
 +    pcmc->default_nic_model = "e1000";
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_5_compat, pc_rhel_7_5_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel750, "pc-q35-rhel7.5.0", pc_q35_init_rhel750,
 +                  pc_q35_machine_rhel750_options);
 +
 +static void pc_q35_init_rhel740(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel740_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel750_options(m);
 +    m->desc = "RHEL-7.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->pc_rom_ro = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel740, "pc-q35-rhel7.4.0", pc_q35_init_rhel740,
 +                  pc_q35_machine_rhel740_options);
 +
 +static void pc_q35_init_rhel730(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel730_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel740_options(m);
 +    m->desc = "RHEL-7.3.0 PC (Q35 + ICH9, 2009)";
 +    m->max_cpus = 255;
 +    pcmc->linuxboot_dma_enabled = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel730, "pc-q35-rhel7.3.0", pc_q35_init_rhel730,
 +                  pc_q35_machine_rhel730_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 2d7a65724a..90ae100bfc 100644
+index f5423f351a..a2b1681027 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -243,6 +243,8 @@ struct MachineClass {
+@@ -242,6 +242,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
@ -845,26 +481,19 @@ index 2d7a65724a..90ae100bfc 100644
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 93c012ac95..79a7803a2f 100644
+index 17ad7bfc3a..75b338d66d 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -128,6 +128,9 @@ struct PCMachineClass {
+@@ -277,6 +277,27 @@ extern const size_t pc_compat_1_5_len;
     /* create kvmclock device even when KVM PV features are not exposed */
     bool kvmclock_create_always;
 +
 +    /* RH only, see bz 1489800 */
 +    bool pc_rom_ro;
 };
 #define TYPE_PC_MACHINE "generic-pc-machine"
@@ -275,6 +278,42 @@ extern const size_t pc_compat_1_5_len;
 extern GlobalProperty pc_compat_1_4[];
 extern const size_t pc_compat_1_4_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_4_compat[];
 +extern const size_t pc_rhel_8_4_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
@ -879,42 +508,15 @@ index 93c012ac95..79a7803a2f 100644
 +
 +extern GlobalProperty pc_rhel_7_6_compat[];
 +extern const size_t pc_rhel_7_6_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_5_compat[];
 +extern const size_t pc_rhel_7_5_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_4_compat[];
 +extern const size_t pc_rhel_7_4_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_3_compat[];
 +extern const size_t pc_rhel_7_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_2_compat[];
 +extern const size_t pc_rhel_7_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_1_compat[];
 +extern const size_t pc_rhel_7_1_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_0_compat[];
 +extern const size_t pc_rhel_7_0_compat_len;
 +
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index ad99cad0e7..c30bb2a6b0 100644
+index d95028018e..7b004065ae 100644
--- a/target/i386/cpu.c
+--- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
-@@ -1882,7 +1882,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
+@@ -131,6 +131,7 @@ static PropValue kvm_default_props[] = {
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
 -        .model = 6,
 +        .model = 13,
         .stepping = 3,
         .features[FEAT_1_EDX] =
             PPRO_FEATURES |
@@ -4264,6 +4264,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
@ -923,10 +525,10 @@ index ad99cad0e7..c30bb2a6b0 100644
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 7fe9f52710..4c69c2cb4b 100644
+index e69abe48e3..4a3077b3f0 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
-@@ -3181,6 +3181,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3261,6 +3261,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
@ -934,7 +536,7 @@ index 7fe9f52710..4c69c2cb4b 100644
     kvm_msr_buf_reset(cpu);
-@@ -3499,6 +3500,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3579,6 +3580,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
--- a/0011-Enable-make-check.patch
+++ b/0011-Enable-make-check.patch
@ -1,4 +1,4 @@
-From 5f6a55a218029af944a8d02ab9264647315890d3 Mon Sep 17 00:00:00 2001
+From e05f30c4899bfec4084cda3223e7141ddc97be6f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
@ -8,24 +8,27 @@ make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- redhat/qemu-kvm.spec.template       |  6 ++----
+Rebase changes (6.1.0):
 - removed unnecessary test changes
 Merged patches (6.1.0):
 - 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
 ---
 .distro/qemu-kvm.spec.template      |  5 ++---
 tests/qemu-iotests/051              |  8 ++++----
 tests/qtest/bios-tables-test.c      |  6 +++---
 tests/qtest/boot-serial-test.c      |  6 +++++-
 tests/qtest/cdrom-test.c            |  4 ++++
 tests/qtest/cpu-plug-test.c         |  4 ++--
 tests/qtest/e1000-test.c            |  2 ++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/hd-geo-test.c           |  4 ++++
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             | 11 +++--------
 tests/qtest/prom-env-test.c         |  4 ++++
 tests/qtest/test-x86-cpuid-compat.c |  2 ++
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
- tests/unit/meson.build              |  2 +-
+ 14 files changed, 40 insertions(+), 24 deletions(-)
 17 files changed, 44 insertions(+), 27 deletions(-)
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
 index 7bf29343d7..fd63402d78 100755
@ -56,10 +59,10 @@ index 7bf29343d7..fd63402d78 100755
      *)
         ;;
 diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
-index 156d4174aa..b4a1074b77 100644
+index 51d3a4e239..fe01fd8b7d 100644
 --- a/tests/qtest/bios-tables-test.c
 +++ b/tests/qtest/bios-tables-test.c
-@@ -1299,7 +1299,7 @@ static void test_acpi_virt_tcg_numamem(void)
+@@ -1303,7 +1303,7 @@ static void test_acpi_virt_tcg_numamem(void)
     free_test_data(&data);
 }
@ -68,7 +71,7 @@ index 156d4174aa..b4a1074b77 100644
 static void test_acpi_virt_tcg_pxb(void)
 {
     test_data data = {
-@@ -1331,7 +1331,7 @@ static void test_acpi_virt_tcg_pxb(void)
+@@ -1335,7 +1335,7 @@ static void test_acpi_virt_tcg_pxb(void)
     free_test_data(&data);
 }
@ -77,7 +80,7 @@ index 156d4174aa..b4a1074b77 100644
 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
     test_data data;
-@@ -1561,7 +1561,7 @@ int main(int argc, char *argv[])
+@@ -1565,7 +1565,7 @@ int main(int argc, char *argv[])
         qtest_add_func("acpi/virt", test_acpi_virt_tcg);
         qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
         qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
@ -87,10 +90,10 @@ index 156d4174aa..b4a1074b77 100644
     }
     ret = g_test_run();
 diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
-index d74509b1c5..a64c55e384 100644
+index 96849cec91..81df62e01a 100644
 --- a/tests/qtest/boot-serial-test.c
 +++ b/tests/qtest/boot-serial-test.c
-@@ -120,19 +120,23 @@ static testdef_t tests[] = {
+@@ -148,19 +148,23 @@ static testdef_t tests[] = {
     { "ppc", "g3beige", "", "PowerPC,750" },
     { "ppc", "mac99", "", "PowerPC,G4" },
     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
@ -166,22 +169,6 @@ index a1c689414b..a8f076711c 100644
         return;
     }
     data = g_new(PlugTestData, 1);
 diff --git a/tests/qtest/e1000-test.c b/tests/qtest/e1000-test.c
 index ea286d1793..a1847ac8ed 100644
 --- a/tests/qtest/e1000-test.c
 +++ b/tests/qtest/e1000-test.c
@@ -22,9 +22,11 @@ struct QE1000 {
 static const char *models[] = {
     "e1000",
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     "e1000-82540em",
     "e1000-82544gc",
     "e1000-82545em",
 +#endif
 };
 static void *e1000_get_driver(void *obj, const char *interface)
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 66229e6096..947fba73b7 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
@ -209,7 +196,7 @@ index aaf6d10e18..43727d62ac 100644
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
-index f7b7cfbc2d..99cccf8638 100644
+index 113126ae06..999ef2aace 100644
 --- a/tests/qtest/hd-geo-test.c
 +++ b/tests/qtest/hd-geo-test.c
@@ -737,6 +737,7 @@ static void test_override_ide(void)
@ -240,19 +227,6 @@ index f7b7cfbc2d..99cccf8638 100644
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 1cddf5bdaa..2f4a564105 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -41,7 +41,7 @@ libqos_srcs = files('../libqtest.c',
         'virtio-serial.c',
         # qgraph machines:
 -        'aarch64-xlnx-zcu102-machine.c',
 +#        'aarch64-xlnx-zcu102-machine.c',
         'arm-imx25-pdk-machine.c',
         'arm-n800-machine.c',
         'arm-raspi2-machine.c',
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index fe0bef9980..7a9d51579b 100644
 --- a/tests/qtest/lpc-ich9-test.c
@ -267,10 +241,10 @@ index fe0bef9980..7a9d51579b 100644
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index 0c76738921..b9a7426a7b 100644
+index 2bc3efd49f..53ce4b6416 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -71,7 +71,6 @@ qtests_i386 = \
+@@ -73,7 +73,6 @@ qtests_i386 = \
    'ide-test',
    'hd-geo-test',
    'boot-order-test',
@ -278,7 +252,7 @@ index 0c76738921..b9a7426a7b 100644
    'rtc-test',
    'i440fx-test',
    'fw_cfg-test',
-@@ -79,7 +78,6 @@ qtests_i386 = \
+@@ -81,7 +80,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
@ -286,7 +260,7 @@ index 0c76738921..b9a7426a7b 100644
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
-@@ -130,17 +128,15 @@ qtests_moxie = [ 'boot-serial-test' ]
+@@ -130,17 +128,15 @@ qtests_mips64el = \
 qtests_ppc = \
   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
@ -306,7 +280,7 @@ index 0c76738921..b9a7426a7b 100644
   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
 qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
-@@ -183,7 +179,7 @@ qtests_aarch64 = \
+@@ -186,7 +182,7 @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
@ -315,7 +289,7 @@ index 0c76738921..b9a7426a7b 100644
    'migration-test']
 qtests_s390x = \
-@@ -192,7 +188,6 @@ qtests_s390x = \
+@@ -195,7 +191,6 @@ qtests_s390x = \
   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
   ['boot-serial-test',
    'drive_del-test',
@ -392,19 +366,6 @@ index 10ef9d2a91..3855873050 100644
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 diff --git a/tests/unit/meson.build b/tests/unit/meson.build
 index b3bc2109da..244d35f5d4 100644
 --- a/tests/unit/meson.build
 +++ b/tests/unit/meson.build
@@ -65,7 +65,7 @@ if have_block
     'test-blockjob': [testblock],
     'test-blockjob-txn': [testblock],
     'test-block-backend': [testblock],
 -    'test-block-iothread': [testblock],
 +#    'test-block-iothread': [testblock],
     'test-write-threshold': [testblock],
     'test-crypto-hash': [crypto],
     'test-crypto-hmac': [crypto],
 -- 
 2.27.0
--- a/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From 22c0f47f02c5db63f3857dabc6cc7cb6bfc78158 Mon Sep 17 00:00:00 2001
+From 79697eeae5ecc81c6e334b4a5164c9a664541a22 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -22,6 +22,9 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.
 Count of slots increased to 509 later so we could increase limit
 to 64 as some usecases require more than 32 devices.
 Signed-off-by: Bandan Das <bsd@redhat.com>
 ---
 hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
@ -29,10 +32,10 @@ Signed-off-by: Bandan Das <bsd@redhat.com>
 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 5c65aa0a98..327b86703a 100644
+index e1ea1d8a23..717af74b9a 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -46,6 +46,9 @@
+@@ -45,6 +45,9 @@
 #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
@ -42,7 +45,7 @@ index 5c65aa0a98..327b86703a 100644
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
-@@ -2783,9 +2786,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2790,9 +2793,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     ssize_t len;
     struct stat st;
     int groupid;
@ -74,7 +77,7 @@ index 5c65aa0a98..327b86703a 100644
     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3222,6 +3246,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3229,6 +3253,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
--- a/0013-Add-support-statement-to-help-output.patch
+++ b/0013-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From ffd8eff2ce1d7eda81d425324593924c098f6c39 Mon Sep 17 00:00:00 2001
+From 5209e0f91395c9240142f75123edd55a6fcce8d7 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index aadb526138..6c8498022b 100644
+index 5ca11e7469..55673d7302 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -848,9 +848,17 @@ static void version(void)
+@@ -802,9 +802,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -42,7 +42,7 @@ index aadb526138..6c8498022b 100644
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
             error_get_progname());
-@@ -867,6 +875,7 @@ static void help(int exitcode)
+@@ -830,6 +838,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
--- a/0014-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/0014-globally-limit-the-maximum-number-of-CPUs.patch
@ -1,4 +1,4 @@
-From b5dab6e678d9b53359b3a915421114258e803cad Mon Sep 17 00:00:00 2001
+From 9ca40e0d1c7644ab781dc382effa8eb32f589322 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
@ -18,10 +18,10 @@ Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 1 file changed, 12 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index b6d9f92f15..70a94ba76d 100644
+index 0125c17edb..b5d488a027 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -2095,6 +2095,18 @@ static int kvm_init(MachineState *ms)
+@@ -2413,6 +2413,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
--- a/0015-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0015-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,4 +1,4 @@
-From 55fde02ee1a9aa0e812af8534a9adf553accc522 Mon Sep 17 00:00:00 2001
+From 67b5eb11440c75e0fea275eccea43266760b831e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
@ -18,11 +18,9 @@ to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/defs.rst.inc              |  4 ++--
 docs/interop/live-block-operations.rst |  4 ++--
 docs/tools/qemu-trace-stap.rst | 14 +++++++-------
 docs/tools/virtiofsd.rst               |  2 +-
 qemu-options.hx                | 10 +++++-----
- 5 files changed, 17 insertions(+), 17 deletions(-)
+ 3 files changed, 14 insertions(+), 14 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
@ -38,28 +36,6 @@ index 52d6454b93..d74dbdeca9 100644
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
 index 1073b930dc..881432253f 100644
 --- a/docs/interop/live-block-operations.rst
 +++ b/docs/interop/live-block-operations.rst
@@ -129,7 +129,7 @@ To show some example invocations of command-line, we will use the
 following invocation of QEMU, with a QMP server running over UNIX
 socket::
 -    $ ./qemu-system-x86_64 -display none -no-user-config \
 +    $ qemu-kvm -display none -no-user-config \
         -M q35 -nodefaults -m 512 \
         -blockdev node-name=node-A,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./a.qcow2 \
         -device virtio-blk,drive=node-A,id=virtio0 \
@@ -694,7 +694,7 @@ instance, with the following invocation.  (As noted earlier, for
 simplicity's sake, the destination QEMU is started on the same host, but
 it could be located elsewhere)::
 -    $ ./qemu-system-x86_64 -display none -no-user-config \
 +    $ qemu-kvm -display none -no-user-config \
         -M q35 -nodefaults -m 512 \
         -blockdev node-name=node-TargetDisk,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./target-disk.qcow2 \
         -device virtio-blk,drive=node-TargetDisk,id=virtio0 \
 diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
 index fb70445c75..0d9a783112 100644
 --- a/docs/tools/qemu-trace-stap.rst
@ -118,24 +94,11 @@ index fb70445c75..0d9a783112 100644
 See also
 --------
 diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst
 index 00554c75bd..6e0fc94005 100644
 --- a/docs/tools/virtiofsd.rst
 +++ b/docs/tools/virtiofsd.rst
@@ -301,7 +301,7 @@ Export ``/var/lib/fs/vm001/`` on vhost-user UNIX domain socket
 ::
   host# virtiofsd --socket-path=/var/run/vm001-vhost-fs.sock -o source=/var/lib/fs/vm001
 -  host# qemu-system-x86_64 \
 +  host# qemu-kvm \
       -chardev socket,id=char0,path=/var/run/vm001-vhost-fs.sock \
       -device vhost-user-fs-pci,chardev=char0,tag=myfs \
       -object memory-backend-memfd,id=mem,size=4G,share=on \
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 0d4fb61bf7..79ca09feac 100644
+index ac596e01a1..eea5fe9f68 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3011,11 +3011,11 @@ SRST
+@@ -3124,11 +3124,11 @@ SRST
     ::
--- a/0016-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/0016-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -1,4 +1,4 @@
-From 2ab1a61510036bd409532f24ea14fa693ec0362c Mon Sep 17 00:00:00 2001
+From 121a8bb81575086f84563f1dffc4d045cdc65a64 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
--- a/0017-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/0017-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -1,4 +1,4 @@
-From 7b3d9142f3b296b127dce35336765dc16265d155 Mon Sep 17 00:00:00 2001
+From 6e87ea18ca021e10fd99698bb3f744ed3dc06552 Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@ -32,7 +32,7 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index 9ea7ddd1e9..1338b677d2 100644
+index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
--- a/0018-block-Versioned-x-blockdev-reopen-API-with-feature-f.patch
+++ b/0018-block-Versioned-x-blockdev-reopen-API-with-feature-f.patch
@ -1,70 +0,0 @@
 From acdc84c1077be7d347414f781014ea785ce41d7b Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 13 Mar 2020 12:34:32 +0000
 Subject: block: Versioned x-blockdev-reopen API with feature flag
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 Message-id: <20200313123439.10548-7-kwolf@redhat.com>
 Patchwork-id: 94283
 O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 06/13] block: Versioned x-blockdev-reopen API with feature flag
 Bugzilla: 1790482 1805143
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: John Snow <jsnow@redhat.com>
 RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
 RH-Acked-by: Peter Krempa <pkrempa@redhat.com>
 x-blockdev-reopen is still considered unstable upstream. libvirt needs
 (a small subset of) it for incremental backups, though.
 Add a downstream-only feature flag that effectively makes this a
 versioned interface. As long as the feature is present, we promise that
 we won't change the interface incompatibly. Incompatible changes to the
 command will require us to drop the feature flag (and possibly introduce
 a new one if the new version is still not stable upstream).
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 qapi/block-core.json | 9 ++++++++-
 scripts/qapi/expr.py | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 6d227924d0..15ad8cee05 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -4166,10 +4166,17 @@
 # image does not have a default backing file name as part of its
 # metadata.
 #
 +# Features:
 +# @__com.redhat_rhel-av-8_2_0-api: Versioning the downstream interface while
 +#                                  it's still unstable upstream. As long as
 +#                                  this flag is present, this command will not
 +#                                  change incompatibly.
 +#
 # Since: 4.0
 ##
 { 'command': 'x-blockdev-reopen',
 -  'data': 'BlockdevOptions', 'boxed': true }
 +  'data': 'BlockdevOptions', 'boxed': true,
 +  'features': [ '__com.redhat_rhel-av-8_2_0-api' ] }
 ##
 # @blockdev-del:
 diff --git a/scripts/qapi/expr.py b/scripts/qapi/expr.py
 index 540b3982b1..884874d205 100644
 --- a/scripts/qapi/expr.py
 +++ b/scripts/qapi/expr.py
@@ -215,7 +215,7 @@ def check_features(features, info):
         check_keys(f, info, source, ['name'], ['if'])
         check_name_is_str(f['name'], info, source)
         source = "%s '%s'" % (source, f['name'])
 -        check_name_lower(f['name'], info, source)
 +        check_name_lower(f['name'], info, source, permit_underscore=True)
         check_if(f, info, source)
 -- 
 2.27.0
--- a/0018-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/0018-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,7 +1,7 @@
-From 9d2700ed836cdfabbd031da74cd5a3d01c9127dd Mon Sep 17 00:00:00 2001
+From 0486a5468aee70d74e8ad65f3b2e5fa16cacba56 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
-Subject: [PATCH 1/4] qcow2: Deprecation warning when opening v2 images rw
+Subject: qcow2: Deprecation warning when opening v2 images rw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -31,20 +31,27 @@ but it's what is available and the same function qcow2_do_open() already
 uses it this way for another warning.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
 present_in_specfile: true
 location_in_specfile: 116
 ---
 Rebase notes (6.1.0):
 - Replace bs->read_only with bdrv_is_read_only
 ---
 block/qcow2.c                    | 6 ++++++
 tests/qemu-iotests/common.filter | 1 +
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
-index 9727ae8fe3..7c061bf315 100644
+index 9f1b6461c8..4c303e6666 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1336,6 +1336,12 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
         ret = -ENOTSUP;
         goto fail;
     }
-+    if (header.version < 3 && !bs->read_only && bdrv_uses_whitelist()) {
+    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
 +        warn_report_once("qcow2 v2 images are deprecated and may not be "
 +                         "supported in future versions. Please consider "
 +                         "upgrading the image with 'qemu-img amend "
@ -54,7 +61,7 @@ index 9727ae8fe3..7c061bf315 100644
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index 268b749e2f..1f243a8bc1 100644
+index 2b2b53946c..c5c2dc39bd 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -82,6 +82,7 @@ _filter_qemu()
--- a/README.rst
+++ b/README.rst
@ -1,18 +0,0 @@
 ===================
 qemu-kvm development
 ===================
 qemu-kvm is maintained in a `source tree`_ rather than directly in dist-git
 using packit service that provides way to develope using regular source code
 structure and provides way to generate SRPM and build using koji service.
 Developers deliver all changes to source-git using merge request. Only maintainers
 will be pushing changes sent to source-git to dist-git.
 Each release in dist-git is tagged in the source repository so you can easily
 check out the source tree for a build. The tags are in the format
 name-version-release, but note release doesn't contain the dist tag since the
 source can be built in different build roots (Fedora, CentOS, etc.)
 .. _source tree: https://gitlab.com/redhat/centos-stream/src/qemu-kvm
--- a/kvm-Disable-TPM-passthrough.patch
+++ b/kvm-Disable-TPM-passthrough.patch
@ -1,44 +0,0 @@
 From 651798d03827dda7eb8dc33fb3482f872ec81d16 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Mon, 5 Jul 2021 15:23:48 +0400
 Subject: [PATCH 1/2] Disable TPM passthrough
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <None>
 RH-MergeRequest: 17: Disable TPM passthrough
 RH-Commit: [1/1] 735b79065149b968350b3f14d763030d5ef66457
 RH-Bugzilla: 1978911
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 default-configs/devices/ppc64-rh-devices.mak  | 1 -
 default-configs/devices/x86_64-rh-devices.mak | 1 -
 2 files changed, 2 deletions(-)
 diff --git a/default-configs/devices/ppc64-rh-devices.mak b/default-configs/devices/ppc64-rh-devices.mak
 index 3ec5603ace..d6e424540e 100644
 --- a/default-configs/devices/ppc64-rh-devices.mak
 +++ b/default-configs/devices/ppc64-rh-devices.mak
@@ -32,4 +32,3 @@ CONFIG_XICS=y
 CONFIG_XIVE=y
 CONFIG_TPM_SPAPR=y
 CONFIG_TPM_EMULATOR=y
 -CONFIG_TPM_PASSTHROUGH=y
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 index 81bda09f4c..c2dd112f81 100644
 --- a/default-configs/devices/x86_64-rh-devices.mak
 +++ b/default-configs/devices/x86_64-rh-devices.mak
@@ -98,4 +98,3 @@ CONFIG_XIO3130=y
 CONFIG_TPM_CRB=y
 CONFIG_TPM_TIS_ISA=y
 CONFIG_TPM_EMULATOR=y
 -CONFIG_TPM_PASSTHROUGH=y
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.0.0-machine-type.patch
+++ b/kvm-Remove-RHEL-7.0.0-machine-type.patch
@ -1,197 +0,0 @@
 From 4fa7a78aa900988816d07034943be384d57117f0 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 10:24:56 +0200
 Subject: [PATCH 03/39] Remove RHEL 7.0.0 machine type
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [1/6] f182af372d3c38c3c1960af0d5cd37aba7205848 (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Everything is used elsewhere except for cve_2014_5263 fields.  Remove those.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc.c         | 35 -----------------------------------
 hw/i386/pc_piix.c    | 34 ----------------------------------
 hw/usb/hcd-xhci.c    | 20 --------------------
 hw/usb/hcd-xhci.h    |  2 --
 include/hw/i386/pc.h |  3 ---
 include/hw/usb.h     |  3 ---
 6 files changed, 97 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index cdbfa84d2e..516ca50353 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -598,41 +598,6 @@ const size_t pc_rhel_7_1_compat_len = G_N_ELEMENTS(pc_rhel_7_1_compat);
  * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
  */
 -/*
 - * RHEL-7 is based on QEMU 1.5.3, so this needs the PC_COMPAT_*
 - * between our base and 1.5, less stuff backported to RHEL-7.0
 - * (usb-device.msos-desc), less stuff for devices we changed
 - * (qemu64-x86_64-cpu) or don't support (hpet, pci-serial-2x,
 - * pci-serial-4x) in 7.0.
 - */
 -GlobalProperty pc_rhel_7_0_compat[] = {
 -    { "virtio-scsi-pci", "any_layout", "off" },
 -    { "PIIX4_PM", "memory-hotplug-support", "off" },
 -    { "apic", "version", stringify(0x11) },
 -    { "nec-usb-xhci", "superspeed-ports-first", "off" },
 -    { "nec-usb-xhci", "force-pcie-endcap", "on" },
 -    { "pci-serial", "prog_if", stringify(0) },
 -    { "virtio-net-pci", "guest_announce", "off" },
 -    { "ICH9-LPC", "memory-hotplug-support", "off" },
 -    { "xio3130-downstream", COMPAT_PROP_PCP, "off" },
 -    { "ioh3420", COMPAT_PROP_PCP, "off" },
 -    { "PIIX4_PM", "acpi-pci-hotplug-with-bridge-support", "off" },
 -    { "e1000", "mitigation", "off" },
 -    { "virtio-net-pci", "ctrl_guest_offloads", "off" },
 -    { "Conroe" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Penryn" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Nehalem" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Nehalem-IBRS" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Westmere" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Westmere-IBRS" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Opteron_G1" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Opteron_G2" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Opteron_G3" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Opteron_G4" "-" TYPE_X86_CPU, "x2apic", "on" },
 -    { "Opteron_G5" "-" TYPE_X86_CPU, "x2apic", "on" },
 -};
 -const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 -
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 5d61c9b833..b4e8034671 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1116,37 +1116,3 @@ static void pc_machine_rhel710_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel710, "pc-i440fx-rhel7.1.0", pc_init_rhel710,
                   pc_machine_rhel710_options);
 -
 -static void pc_compat_rhel700(MachineState *machine)
 -{
 -    PCMachineState *pcms = PC_MACHINE(machine);
 -    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
 -
 -    pc_compat_rhel710(machine);
 -
 -    /* Upstream enables it for everyone, we're a little more selective */
 -    x86_cpu_change_kvm_default("x2apic", NULL);
 -    x86_cpu_change_kvm_default("svm", NULL);
 -    pcmc->legacy_acpi_table_size = 6418; /* see pc_compat_2_0() */
 -    pcmc->smbios_legacy_mode = true;
 -    pcmc->has_reserved_memory = false;
 -    migrate_cve_2014_5263_xhci_fields = true;
 -}
 -
 -static void pc_init_rhel700(MachineState *machine)
 -{
 -    pc_compat_rhel700(machine);
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel700_options(MachineClass *m)
 -{
 -    pc_machine_rhel710_options(m);
 -    m->family = "pc_piix_Y";
 -    m->desc = "RHEL 7.0.0 PC (i440FX + PIIX, 1996)";
 -    compat_props_add(m->compat_props, pc_rhel_7_0_compat, pc_rhel_7_0_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel700, "pc-i440fx-rhel7.0.0", pc_init_rhel700,
 -                  pc_machine_rhel700_options);
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
 index 6d1f278aad..46212b1e69 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
@@ -3490,27 +3490,9 @@ static const VMStateDescription vmstate_xhci_slot = {
     }
 };
 -static int xhci_event_pre_save(void *opaque)
 -{
 -    XHCIEvent *s = opaque;
 -
 -    s->cve_2014_5263_a = ((uint8_t *)&s->type)[0];
 -    s->cve_2014_5263_b = ((uint8_t *)&s->type)[1];
 -
 -    return 0;
 -}
 -
 -bool migrate_cve_2014_5263_xhci_fields;
 -
 -static bool xhci_event_cve_2014_5263(void *opaque, int version_id)
 -{
 -    return migrate_cve_2014_5263_xhci_fields;
 -}
 -
 static const VMStateDescription vmstate_xhci_event = {
     .name = "xhci-event",
     .version_id = 1,
 -    .pre_save = xhci_event_pre_save,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(type,   XHCIEvent),
         VMSTATE_UINT32(ccode,  XHCIEvent),
@@ -3519,8 +3501,6 @@ static const VMStateDescription vmstate_xhci_event = {
         VMSTATE_UINT32(flags,  XHCIEvent),
         VMSTATE_UINT8(slotid,  XHCIEvent),
         VMSTATE_UINT8(epid,    XHCIEvent),
 -        VMSTATE_UINT8_TEST(cve_2014_5263_a, XHCIEvent, xhci_event_cve_2014_5263),
 -        VMSTATE_UINT8_TEST(cve_2014_5263_b, XHCIEvent, xhci_event_cve_2014_5263),
         VMSTATE_END_OF_LIST()
     }
 };
 diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h
 index f450ffd13b..7bba361f3b 100644
 --- a/hw/usb/hcd-xhci.h
 +++ b/hw/usb/hcd-xhci.h
@@ -149,8 +149,6 @@ typedef struct XHCIEvent {
     uint32_t flags;
     uint8_t slotid;
     uint8_t epid;
 -    uint8_t cve_2014_5263_a;
 -    uint8_t cve_2014_5263_b;
 } XHCIEvent;
 typedef struct XHCIInterrupter {
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 1980c93f41..2d17daf71f 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -314,9 +314,6 @@ extern const size_t pc_rhel_7_2_compat_len;
 extern GlobalProperty pc_rhel_7_1_compat[];
 extern const size_t pc_rhel_7_1_compat_len;
 -extern GlobalProperty pc_rhel_7_0_compat[];
 -extern const size_t pc_rhel_7_0_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 diff --git a/include/hw/usb.h b/include/hw/usb.h
 index edb2cd94b6..436e07b304 100644
 --- a/include/hw/usb.h
 +++ b/include/hw/usb.h
@@ -577,7 +577,4 @@ void usb_pcap_init(FILE *fp);
 void usb_pcap_ctrl(USBPacket *p, bool setup);
 void usb_pcap_data(USBPacket *p, bool setup);
 -/* hcd-xhci.c -- rhel7.0.0 machine type compatibility */
 -extern bool migrate_cve_2014_5263_xhci_fields;
 -
 #endif
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.1.0-machine-type.patch
+++ b/kvm-Remove-RHEL-7.1.0-machine-type.patch
@ -1,292 +0,0 @@
 From 224b28d337f36a937b34685519d7b657974a95d0 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 10:46:56 +0200
 Subject: [PATCH 04/39] Remove RHEL 7.1.0 machine type
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [2/6] af1d8896d63756d1acc5af8658465808c4a13ca3 (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 migrate_pre_2_2 was a redhat artifact, removed.
 broken_reserved_end is already fixed, nothing to do.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/char/serial.c      | 12 ----------
 hw/core/machine.c     | 23 -------------------
 hw/i386/pc.c          | 51 -------------------------------------------
 hw/i386/pc_piix.c     | 41 ----------------------------------
 hw/rtc/mc146818rtc.c  |  4 ----
 include/hw/boards.h   |  3 ---
 include/hw/i386/pc.h  |  3 ---
 migration/migration.c |  2 --
 migration/migration.h |  5 -----
 9 files changed, 144 deletions(-)
 diff --git a/hw/char/serial.c b/hw/char/serial.c
 index cc378142a3..3e4344cb2a 100644
 --- a/hw/char/serial.c
 +++ b/hw/char/serial.c
@@ -690,9 +690,6 @@ static int serial_post_load(void *opaque, int version_id)
 static bool serial_thr_ipending_needed(void *opaque)
 {
     SerialState *s = opaque;
 -    if (migrate_pre_2_2) {
 -        return false;
 -    }
     if (s->ier & UART_IER_THRI) {
         bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
@@ -774,9 +771,6 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
 static bool serial_fifo_timeout_timer_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 -    if (migrate_pre_2_2) {
 -        return false;
 -    }
     return timer_pending(s->fifo_timeout_timer);
 }
@@ -795,9 +789,6 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
 static bool serial_timeout_ipending_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 -    if (migrate_pre_2_2) {
 -        return false;
 -    }
     return s->timeout_ipending != 0;
 }
@@ -816,9 +807,6 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
 static bool serial_poll_needed(void *opaque)
 {
     SerialState *s = (SerialState *)opaque;
 -    if (migrate_pre_2_2) {
 -        return false;
 -    }
     return s->poll_msl >= 0;
 }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 6c534e14fa..cc7c826593 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -270,29 +270,6 @@ GlobalProperty hw_compat_rhel_7_2[] = {
 };
 const size_t hw_compat_rhel_7_2_len = G_N_ELEMENTS(hw_compat_rhel_7_2);
 -/* Mostly like hw_compat_2_1 but:
 - *    we don't need virtio-scsi-pci since 7.0 already had that on
 - *
 - * RH: Note, qemu-extended-regs should have been enabled in the 7.1
 - * machine type, but was accidentally turned off in 7.2 onwards.
 - */
 -GlobalProperty hw_compat_rhel_7_1[] = {
 -    { "intel-hda-generic", "old_msi_addr", "on" },
 -    { "VGA", "qemu-extended-regs", "off" },
 -    { "secondary-vga", "qemu-extended-regs", "off" },
 -    { "usb-mouse", "usb_version", stringify(1) },
 -    { "usb-kbd", "usb_version", stringify(1) },
 -    { "virtio-pci",  "virtio-pci-bus-master-bug-migration", "on" },
 -    { "virtio-blk-pci", "any_layout", "off" },
 -    { "virtio-balloon-pci", "any_layout", "off" },
 -    { "virtio-serial-pci", "any_layout", "off" },
 -    { "virtio-9p-pci", "any_layout", "off" },
 -    { "virtio-rng-pci", "any_layout", "off" },
 -    /* HW_COMPAT_RHEL7_1 - introduced with 2.10.0 */
 -    { "migration", "send-configuration", "off" },
 -};
 -const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 -
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 516ca50353..3c1f5be4fa 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -541,57 +541,6 @@ GlobalProperty pc_rhel_7_2_compat[] = {
 };
 const size_t pc_rhel_7_2_compat_len = G_N_ELEMENTS(pc_rhel_7_2_compat);
 -GlobalProperty pc_rhel_7_1_compat[] = {
 -    { "kvm64" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "kvm32" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Conroe" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Penryn" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Nehalem" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Nehalem-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Westmere" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Westmere-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "SandyBridge" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "SandyBridge-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Haswell" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Haswell-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Broadwell" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Opteron_G1" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Opteron_G2" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Opteron_G3" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Opteron_G4" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Opteron_G5" "-" TYPE_X86_CPU, "vme", "off" },
 -    { "Haswell" "-" TYPE_X86_CPU,  "f16c", "off" },
 -    { "Haswell-IBRS" "-" TYPE_X86_CPU, "f16c", "off" },
 -    { "Haswell" "-" TYPE_X86_CPU, "rdrand", "off" },
 -    { "Haswell-IBRS" "-" TYPE_X86_CPU, "rdrand", "off" },
 -    { "Broadwell" "-" TYPE_X86_CPU, "f16c", "off" },
 -    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "f16c", "off" },
 -    { "Broadwell" "-" TYPE_X86_CPU, "rdrand", "off" },
 -    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "rdrand", "off" },
 -    { "coreduo" "-" TYPE_X86_CPU, "vmx", "on" },
 -    { "core2duo" "-" TYPE_X86_CPU, "vmx", "on" },
 -    { "qemu64" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 -    { "kvm64" "-" TYPE_X86_CPU, "min-level", stringify(5) },
 -    { "pentium3" "-" TYPE_X86_CPU, "min-level", stringify(2) },
 -    { "n270" "-" TYPE_X86_CPU, "min-level", stringify(5) },
 -    { "Conroe" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 -    { "Penryn" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 -    { "Nehalem" "-" TYPE_X86_CPU, "min-level", stringify(4) },
 -    { "n270" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Penryn" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Conroe" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Nehalem" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Westmere" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "SandyBridge" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "IvyBridge" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Haswell" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Haswell-noTSX" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Broadwell" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -    { "Broadwell-noTSX" "-" TYPE_X86_CPU, "min-xlevel", stringify(0x8000000a) },
 -};
 -const size_t pc_rhel_7_1_compat_len = G_N_ELEMENTS(pc_rhel_7_1_compat);
 -
 /*
  * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
  * types as the PC_COMPAT_* do for upstream types.
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index b4e8034671..2a6a28f1e5 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1075,44 +1075,3 @@ static void pc_machine_rhel720_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel720, "pc-i440fx-rhel7.2.0", pc_init_rhel720,
                   pc_machine_rhel720_options);
 -
 -static void pc_compat_rhel710(MachineState *machine)
 -{
 -    PCMachineState *pcms = PC_MACHINE(machine);
 -    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
 -
 -    /* From pc_compat_2_2 */
 -    pcmc->rsdp_in_ram = false;
 -    machine->suppress_vmdesc = true;
 -
 -    /* From pc_compat_2_1 */
 -    pcmc->smbios_uuid_encoded = false;
 -    x86_cpu_change_kvm_default("svm", NULL);
 -    pcmc->enforce_aligned_dimm = false;
 -
 -    /* Disable all the extra subsections that were added in 2.2 */
 -    migrate_pre_2_2 = true;
 -
 -    /* From pc_i440fx_2_4_machine_options */
 -    pcmc->broken_reserved_end = true;
 -}
 -
 -static void pc_init_rhel710(MachineState *machine)
 -{
 -    pc_compat_rhel710(machine);
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel710_options(MachineClass *m)
 -{
 -    pc_machine_rhel720_options(m);
 -    m->family = "pc_piix_Y";
 -    m->desc = "RHEL 7.1.0 PC (i440FX + PIIX, 1996)";
 -    m->default_display = "cirrus";
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_1, hw_compat_rhel_7_1_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_1_compat, pc_rhel_7_1_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel710, "pc-i440fx-rhel7.1.0", pc_init_rhel710,
 -                  pc_machine_rhel710_options);
 diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
 index 4a2e52031b..3a70a988e1 100644
 --- a/hw/rtc/mc146818rtc.c
 +++ b/hw/rtc/mc146818rtc.c
@@ -824,10 +824,6 @@ static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
 {
     RTCState *s = (RTCState *)opaque;
 -    if (migrate_pre_2_2) {
 -        return false;
 -    }
 -
     return s->irq_reinject_on_ack_count != 0;
 }
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 90ae100bfc..070db0b9b1 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -445,7 +445,4 @@ extern const size_t hw_compat_rhel_7_3_len;
 extern GlobalProperty hw_compat_rhel_7_2[];
 extern const size_t hw_compat_rhel_7_2_len;
 -extern GlobalProperty hw_compat_rhel_7_1[];
 -extern const size_t hw_compat_rhel_7_1_len;
 -
 #endif
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 2d17daf71f..84d985f57c 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -311,9 +311,6 @@ extern const size_t pc_rhel_7_3_compat_len;
 extern GlobalProperty pc_rhel_7_2_compat[];
 extern const size_t pc_rhel_7_2_compat_len;
 -extern GlobalProperty pc_rhel_7_1_compat[];
 -extern const size_t pc_rhel_7_1_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 diff --git a/migration/migration.c b/migration/migration.c
 index 9d185f0e28..9cf1cde39d 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -167,8 +167,6 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
     MIGRATION_CAPABILITY_X_COLO,
     MIGRATION_CAPABILITY_VALIDATE_UUID);
 -bool migrate_pre_2_2;
 -
 /* When we add fault tolerance, we could have several
    migrations at once.  For now we don't need to add
    dynamic creation of migration */
 diff --git a/migration/migration.h b/migration/migration.h
 index 1b6c69751c..db6708326b 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
@@ -368,11 +368,6 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
 void migrate_add_address(SocketAddress *address);
 int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
 -/*
 - * Disables a load of subsections that were added in 2.2/rh7.2 for backwards
 - * migration compatibility.
 - */
 -extern bool migrate_pre_2_2;
 #define qemu_ram_foreach_block \
   #warning "Use foreach_not_ignored_block in migration code"
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.2.0-machine-type.patch
+++ b/kvm-Remove-RHEL-7.2.0-machine-type.patch
@ -1,192 +0,0 @@
 From 999b28683394c2939ca8bd6b692ed2169860ced9 Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 11:02:24 +0200
 Subject: [PATCH 05/39] Remove RHEL 7.2.0 machine type
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [3/6] 575f0fe16c1928a41628f1f704a4d5d370679a82 (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c    | 24 ------------------------
 hw/i386/pc.c         | 22 ----------------------
 hw/i386/pc_piix.c    | 26 --------------------------
 hw/ppc/spapr.c       | 26 --------------------------
 include/hw/boards.h  |  3 ---
 include/hw/i386/pc.h |  3 ---
 6 files changed, 104 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index cc7c826593..54eb8376a7 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -246,30 +246,6 @@ GlobalProperty hw_compat_rhel_7_3[] = {
 };
 const size_t hw_compat_rhel_7_3_len = G_N_ELEMENTS(hw_compat_rhel_7_3);
 -/* Mostly like hw_compat_2_4 + 2_3 but:
 - *  we don't need "any_layout" as it has been backported to 7.2
 - */
 -GlobalProperty hw_compat_rhel_7_2[] = {
 -        { "virtio-blk-device", "scsi", "true" },
 -        { "e1000-82540em", "extra_mac_registers", "off" },
 -        { "virtio-pci", "x-disable-pcie", "on" },
 -        { "virtio-pci", "migrate-extra", "off" },
 -        { "fw_cfg_mem", "dma_enabled", "off" },
 -        { "fw_cfg_io", "dma_enabled", "off" },
 -        { "isa-fdc", "fallback", "144" },
 -        /* Optional because not all virtio-pci devices support legacy mode */
 -        { "virtio-pci", "disable-modern", "on", .optional = true },
 -        { "virtio-pci", "disable-legacy", "off", .optional = true },
 -        { TYPE_PCI_DEVICE, "x-pcie-lnksta-dllla", "off" },
 -        { "virtio-pci", "page-per-vq", "on" },
 -        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
 -        { "migration", "send-section-footer", "off" },
 -        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
 -        { "migration", "store-global-state", "off",
 -        },
 -};
 -const size_t hw_compat_rhel_7_2_len = G_N_ELEMENTS(hw_compat_rhel_7_2);
 -
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 3c1f5be4fa..938cb82818 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -519,28 +519,6 @@ GlobalProperty pc_rhel_7_3_compat[] = {
 };
 const size_t pc_rhel_7_3_compat_len = G_N_ELEMENTS(pc_rhel_7_3_compat);
 -GlobalProperty pc_rhel_7_2_compat[] = {
 -    { "phenom" "-" TYPE_X86_CPU, "rdtscp", "off"},
 -    { "qemu64" "-" TYPE_X86_CPU, "sse4a", "on" },
 -    { "qemu64" "-" TYPE_X86_CPU, "abm", "on" },
 -    { "Haswell-" TYPE_X86_CPU, "abm", "off" },
 -    { "Haswell-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 -    { "Haswell-noTSX-" TYPE_X86_CPU, "abm", "off" },
 -    { "Haswell-noTSX-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 -    { "Broadwell-" TYPE_X86_CPU, "abm", "off" },
 -    { "Broadwell-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 -    { "Broadwell-noTSX-" TYPE_X86_CPU, "abm", "off" },
 -    { "Broadwell-noTSX-IBRS" "-" TYPE_X86_CPU, "abm", "off" },
 -    { "host" "-" TYPE_X86_CPU, "host-cache-info", "on" },
 -    { TYPE_X86_CPU, "check", "off" },
 -    { "qemu32" "-" TYPE_X86_CPU, "popcnt", "on" },
 -    { TYPE_X86_CPU, "arat", "off" },
 -    { "usb-redir", "streams", "off" },
 -    { TYPE_X86_CPU, "fill-mtrr-mask", "off" },
 -    { "apic-common", "legacy-instance-id", "on" },
 -};
 -const size_t pc_rhel_7_2_compat_len = G_N_ELEMENTS(pc_rhel_7_2_compat);
 -
 /*
  * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
  * types as the PC_COMPAT_* do for upstream types.
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2a6a28f1e5..201cbbdb01 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1049,29 +1049,3 @@ static void pc_machine_rhel730_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel730, "pc-i440fx-rhel7.3.0", pc_init_rhel730,
                   pc_machine_rhel730_options);
 -
 -
 -static void pc_init_rhel720(MachineState *machine)
 -{
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel720_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
 -    pc_machine_rhel730_options(m);
 -    m->desc = "RHEL 7.2.0 PC (i440FX + PIIX, 1996)";
 -    /* From pc_i440fx_2_5_machine_options */
 -    x86mc->save_tsc_khz = false;
 -    m->legacy_fw_cfg_order = 1;
 -    /* Note: broken_reserved_end was already in 7.2 */
 -    /* From pc_i440fx_2_6_machine_options */
 -    pcmc->legacy_cpu_hotplug = true;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_2_compat, pc_rhel_7_2_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel720, "pc-i440fx-rhel7.2.0", pc_init_rhel720,
 -                  pc_machine_rhel720_options);
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 11db32c537..0bc558e0b7 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5397,32 +5397,6 @@ static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 -/*
 - * pseries-rhel7.2.0
 - */
 -/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
 - * has been backported to RHEL7_2 so we don't need it here.
 - */
 -
 -GlobalProperty spapr_compat_rhel7_2[] = {
 -    { "spapr-vlan", "use-rx-buffer-pools", "off" },
 -    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
 -};
 -const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
 -
 -static void spapr_machine_rhel720_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel730_class_options(mc);
 -    smc->use_ohci_by_default = true;
 -    mc->has_hotpluggable_cpus = NULL;
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 -    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 -
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 070db0b9b1..43eb868ceb 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -442,7 +442,4 @@ extern const size_t hw_compat_rhel_7_4_len;
 extern GlobalProperty hw_compat_rhel_7_3[];
 extern const size_t hw_compat_rhel_7_3_len;
 -extern GlobalProperty hw_compat_rhel_7_2[];
 -extern const size_t hw_compat_rhel_7_2_len;
 -
 #endif
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 84d985f57c..c26c6dcc72 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -308,9 +308,6 @@ extern const size_t pc_rhel_7_4_compat_len;
 extern GlobalProperty pc_rhel_7_3_compat[];
 extern const size_t pc_rhel_7_3_compat_len;
 -extern GlobalProperty pc_rhel_7_2_compat[];
 -extern const size_t pc_rhel_7_2_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.3.0-machine-types.patch
+++ b/kvm-Remove-RHEL-7.3.0-machine-types.patch
@ -1,315 +0,0 @@
 From 1610bd2ce98e3d93296fd3bc4d2c24e905428a4a Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 11:24:26 +0200
 Subject: [PATCH 06/39] Remove RHEL 7.3.0 machine types
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [4/6] 7a674496dd29a7a87843770fd0459b85831cc866 (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Only thing to remove with care was __redhat_e1000e_7_3_intr_state.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c    | 22 ---------------------
 hw/i386/pc.c         | 28 ---------------------------
 hw/i386/pc_piix.c    | 19 ------------------
 hw/i386/pc_q35.c     | 19 ------------------
 hw/net/e1000e.c      | 22 ---------------------
 hw/ppc/spapr.c       | 46 --------------------------------------------
 include/hw/boards.h  |  3 ---
 include/hw/i386/pc.h |  3 ---
 8 files changed, 162 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 54eb8376a7..0bcaabd8a9 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -224,28 +224,6 @@ GlobalProperty hw_compat_rhel_7_4[] = {
 };
 const size_t hw_compat_rhel_7_4_len = G_N_ELEMENTS(hw_compat_rhel_7_4);
 -/* Mostly like HW_COMPAT_2_6 + HW_COMPAT_2_7 + HW_COMPAT_2_8 except
 - * disable-modern, disable-legacy, page-per-vq have already been
 - * backported to RHEL7.3
 - */
 -GlobalProperty hw_compat_rhel_7_3[] = {
 -    { "virtio-mmio", "format_transport_address", "off" },
 -    { "virtio-serial-device", "emergency-write", "off" },
 -    { "ioapic", "version", "0x11" },
 -    { "intel-iommu", "x-buggy-eim", "true" },
 -    { "virtio-pci", "x-ignore-backend-features", "on" },
 -    { "fw_cfg_mem", "x-file-slots", stringify(0x10) },
 -    { "fw_cfg_io", "x-file-slots", stringify(0x10) },
 -    { "pflash_cfi01", "old-multiple-chip-handling", "on" },
 -    { TYPE_PCI_DEVICE, "x-pcie-extcap-init", "off" },
 -    { "virtio-pci", "x-pcie-deverr-init", "off" },
 -    { "virtio-pci", "x-pcie-lnkctl-init", "off" },
 -    { "virtio-pci", "x-pcie-pm-init", "off" },
 -    { "virtio-net-device", "x-mtu-bypass-backend", "off" },
 -    { "e1000e", "__redhat_e1000e_7_3_intr_state", "on" },
 -};
 -const size_t hw_compat_rhel_7_3_len = G_N_ELEMENTS(hw_compat_rhel_7_3);
 -
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 938cb82818..75abe0acc2 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -491,34 +491,6 @@ GlobalProperty pc_rhel_7_4_compat[] = {
 };
 const size_t pc_rhel_7_4_compat_len = G_N_ELEMENTS(pc_rhel_7_4_compat);
 -GlobalProperty pc_rhel_7_3_compat[] = {
 -    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 -    { "kvmclock", "x-mach-use-reliable-get-clock", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { TYPE_X86_CPU, "l3-cache", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { TYPE_X86_CPU, "full-cpuid-auto-level", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { "Opteron_G3" "-" TYPE_X86_CPU, "family", "15" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { "Opteron_G3" "-" TYPE_X86_CPU, "model", "6" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { "Opteron_G3" "-" TYPE_X86_CPU, "stepping", "1" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_7 */ 
 -    { "isa-pcspk", "migrate", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_6 */ 
 -    { TYPE_X86_CPU, "cpuid-0xb", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 -    { "ICH9-LPC", "x-smi-broadcast", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 -    { TYPE_X86_CPU, "vmware-cpuid-freq", "off" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_8 */ 
 -    { "Haswell-" TYPE_X86_CPU, "stepping", "1" },
 -    /* pc_rhel_7_3_compat from pc_compat_2_3 added in 2.9*/ 
 -    { TYPE_X86_CPU, "kvm-no-smi-migration", "on" },
 -};
 -const size_t pc_rhel_7_3_compat_len = G_N_ELEMENTS(pc_rhel_7_3_compat);
 -
 /*
  * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
  * types as the PC_COMPAT_* do for upstream types.
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 201cbbdb01..64662cc3d5 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1030,22 +1030,3 @@ static void pc_machine_rhel740_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel740, "pc-i440fx-rhel7.4.0", pc_init_rhel740,
                   pc_machine_rhel740_options);
 -
 -static void pc_init_rhel730(MachineState *machine)
 -{
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel730_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_machine_rhel740_options(m);
 -    m->desc = "RHEL 7.3.0 PC (i440FX + PIIX, 1996)";
 -    pcmc->linuxboot_dma_enabled = false;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel730, "pc-i440fx-rhel7.3.0", pc_init_rhel730,
 -                  pc_machine_rhel730_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 01ff3e0544..bf49a943dc 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -792,22 +792,3 @@ static void pc_q35_machine_rhel740_options(MachineClass *m)
 DEFINE_PC_MACHINE(q35_rhel740, "pc-q35-rhel7.4.0", pc_q35_init_rhel740,
                   pc_q35_machine_rhel740_options);
 -
 -static void pc_q35_init_rhel730(MachineState *machine)
 -{
 -    pc_q35_init(machine);
 -}
 -
 -static void pc_q35_machine_rhel730_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_q35_machine_rhel740_options(m);
 -    m->desc = "RHEL-7.3.0 PC (Q35 + ICH9, 2009)";
 -    m->max_cpus = 255;
 -    pcmc->linuxboot_dma_enabled = false;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(q35_rhel730, "pc-q35-rhel7.3.0", pc_q35_init_rhel730,
 -                  pc_q35_machine_rhel730_options);
 diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
 index 6d39c1f1c4..b22f232863 100644
 --- a/hw/net/e1000e.c
 +++ b/hw/net/e1000e.c
@@ -79,12 +79,6 @@ struct E1000EState {
     bool disable_vnet;
     E1000ECore core;
 -
 -    /* 7.3 had the intr_state field that was in the original e1000e code
 -     * but that was removed prior to 2.7's release
 -     */
 -    bool redhat_7_3_intr_state_enable;
 -    uint32_t redhat_7_3_intr_state;
 };
 #define E1000E_MMIO_IDX     0
@@ -100,10 +94,6 @@ struct E1000EState {
 #define E1000E_MSIX_TABLE   (0x0000)
 #define E1000E_MSIX_PBA     (0x2000)
 -/* Values as in RHEL 7.3 build and original upstream */
 -#define RH_E1000E_USE_MSI     BIT(0)
 -#define RH_E1000E_USE_MSIX    BIT(1)
 -
 static uint64_t
 e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size)
 {
@@ -315,8 +305,6 @@ e1000e_init_msix(E1000EState *s)
     } else {
         if (!e1000e_use_msix_vectors(s, E1000E_MSIX_VEC_NUM)) {
             msix_uninit(d, &s->msix, &s->msix);
 -        } else {
 -            s->redhat_7_3_intr_state |= RH_E1000E_USE_MSIX;
         }
     }
 }
@@ -488,8 +476,6 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
     ret = msi_init(PCI_DEVICE(s), 0xD0, 1, true, false, NULL);
     if (ret) {
         trace_e1000e_msi_init_fail(ret);
 -    } else {
 -        s->redhat_7_3_intr_state |= RH_E1000E_USE_MSI;
     }
     if (e1000e_add_pm_capability(pci_dev, e1000e_pmrb_offset,
@@ -613,11 +599,6 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
     VMSTATE_STRUCT_ARRAY(_f, _s, _num, 0,                           \
                          e1000e_vmstate_intr_timer, E1000IntrDelayTimer)
 -static bool rhel_7_3_check(void *opaque, int version_id)
 -{
 -    return ((E1000EState *)opaque)->redhat_7_3_intr_state_enable;
 -}
 -
 static const VMStateDescription e1000e_vmstate = {
     .name = "e1000e",
     .version_id = 1,
@@ -629,7 +610,6 @@ static const VMStateDescription e1000e_vmstate = {
         VMSTATE_MSIX(parent_obj, E1000EState),
         VMSTATE_UINT32(ioaddr, E1000EState),
 -        VMSTATE_UINT32_TEST(redhat_7_3_intr_state, E1000EState, rhel_7_3_check),
         VMSTATE_UINT32(core.rxbuf_min_shift, E1000EState),
         VMSTATE_UINT8(core.rx_desc_len, E1000EState),
         VMSTATE_UINT32_ARRAY(core.rxbuf_sizes, E1000EState,
@@ -678,8 +658,6 @@ static PropertyInfo e1000e_prop_disable_vnet,
 static Property e1000e_properties[] = {
     DEFINE_NIC_PROPERTIES(E1000EState, conf),
 -    DEFINE_PROP_BOOL("__redhat_e1000e_7_3_intr_state", E1000EState,
 -                        redhat_7_3_intr_state_enable, false),
     DEFINE_PROP_SIGNED("disable_vnet_hdr", E1000EState, disable_vnet, false,
                         e1000e_prop_disable_vnet, bool),
     DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 0bc558e0b7..ca0b99403e 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5351,52 +5351,6 @@ static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 -/*
 - * pseries-rhel7.3.0
 - * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
 - */
 -GlobalProperty spapr_compat_rhel7_3[] = {
 -    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
 -    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
 -    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
 -    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
 -    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
 -};
 -const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
 -
 -static void spapr_machine_rhel730_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel740_class_options(mc);
 -    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
 -    mc->default_machine_opts = "modern-hotplug-events=off";
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 -    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
 -
 -    smc->phb_placement = phb_placement_2_7;
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
 -
 -/*
 - * pseries-rhel7.3.0-sxxm
 - *
 - * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
 - */
 -
 -static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel730_class_options(mc);
 -    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 -
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 43eb868ceb..24d4d726d8 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -439,7 +439,4 @@ extern const size_t hw_compat_rhel_7_5_len;
 extern GlobalProperty hw_compat_rhel_7_4[];
 extern const size_t hw_compat_rhel_7_4_len;
 -extern GlobalProperty hw_compat_rhel_7_3[];
 -extern const size_t hw_compat_rhel_7_3_len;
 -
 #endif
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index c26c6dcc72..820fb3f577 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -305,9 +305,6 @@ extern const size_t pc_rhel_7_5_compat_len;
 extern GlobalProperty pc_rhel_7_4_compat[];
 extern const size_t pc_rhel_7_4_compat_len;
 -extern GlobalProperty pc_rhel_7_3_compat[];
 -extern const size_t pc_rhel_7_3_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.4.0-machine-types.patch
+++ b/kvm-Remove-RHEL-7.4.0-machine-types.patch
@ -1,301 +0,0 @@
 From b64f8848efe610c52791587ec41301b73ec9165a Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 11:53:07 +0200
 Subject: [PATCH 07/39] Remove RHEL 7.4.0 machine types
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [5/6] a1940ac35591cebff52379f85656caf6a03328dd (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Revert pc_rom_ro hack.
 Remove force_rev1_fadt hack, it is not needed anymore.
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/acpi/ich9.c         | 15 ---------------
 hw/core/machine.c      |  9 ---------
 hw/i386/acpi-build.c   |  3 ---
 hw/i386/pc.c           | 18 +-----------------
 hw/i386/pc_piix.c      | 19 -------------------
 hw/i386/pc_q35.c       | 18 ------------------
 hw/ppc/spapr.c         | 43 ------------------------------------------
 include/hw/acpi/ich9.h |  3 ---
 include/hw/boards.h    |  3 ---
 include/hw/i386/pc.h   |  6 ------
 10 files changed, 1 insertion(+), 136 deletions(-)
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
 index 33b0c6e33c..7f01fad64c 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -369,18 +369,6 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
     s->pm.enable_tco = value;
 }
 -static bool ich9_pm_get_force_rev1_fadt(Object *obj, Error **errp)
 -{
 -    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
 -    return s->pm.force_rev1_fadt;
 -}
 -
 -static void ich9_pm_set_force_rev1_fadt(Object *obj, bool value, Error **errp)
 -{
 -    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
 -    s->pm.force_rev1_fadt = value;
 -}
 -
 void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
 {
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
@@ -403,9 +391,6 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     object_property_add_bool(obj, "cpu-hotplug-legacy",
                              ich9_pm_get_cpu_hotplug_legacy,
                              ich9_pm_set_cpu_hotplug_legacy);
 -    object_property_add_bool(obj, "__com.redhat_force-rev1-fadt",
 -                             ich9_pm_get_force_rev1_fadt,
 -                             ich9_pm_set_force_rev1_fadt);
     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S3_DISABLED,
                                   &pm->disable_s3, OBJ_PROP_FLAG_READWRITE);
     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S4_DISABLED,
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 0bcaabd8a9..6dc2651d73 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -215,15 +215,6 @@ GlobalProperty hw_compat_rhel_7_5[] = {
 };
 const size_t hw_compat_rhel_7_5_len = G_N_ELEMENTS(hw_compat_rhel_7_5);
 -/* Mostly like hw_compat_2_9 except
 - * x-mtu-bypass-backend, x-migrate-msix has already been
 - * backported to RHEL7.4. shpc was already on in 7.4.
 - */
 -GlobalProperty hw_compat_rhel_7_4[] = {
 -    { "intel-iommu", "pt", "off" },
 -};
 -
 -const size_t hw_compat_rhel_7_4_len = G_N_ELEMENTS(hw_compat_rhel_7_4);
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index 7bd67f7877..de98750aef 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -231,9 +231,6 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
         pm->fadt.reset_reg = r;
         pm->fadt.reset_val = 0xf;
         pm->fadt.flags |= 1 << ACPI_FADT_F_RESET_REG_SUP;
 -        if (object_property_get_bool(lpc,
 -                                     "__com.redhat_force-rev1-fadt", NULL))
 -            pm->fadt.rev = 1;
         pm->cpu_hp_io_base = ICH9_CPU_HOTPLUG_IO_BASE;
         pm->smi_on_cpuhp =
             !!(smi_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT));
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 75abe0acc2..6b39abce02 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -477,20 +477,6 @@ GlobalProperty pc_rhel_7_5_compat[] = {
 };
 const size_t pc_rhel_7_5_compat_len = G_N_ELEMENTS(pc_rhel_7_5_compat);
 -GlobalProperty pc_rhel_7_4_compat[] = {
 -    /* pc_rhel_7_4_compat from pc_compat_2_9 */ 
 -    { "mch", "extended-tseg-mbytes", stringify(0) },
 -    /* bz 1489800 */ 
 -    { "ICH9-LPC", "__com.redhat_force-rev1-fadt", "on" },
 -    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 -    { "i440FX-pcihost", "x-pci-hole64-fix", "off" },
 -    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 -    { "q35-pcihost", "x-pci-hole64-fix", "off" },
 -    /* pc_rhel_7_4_compat from pc_compat_2_10 */ 
 -    { TYPE_X86_CPU, "x-hv-max-vps", "0x40" },
 -};
 -const size_t pc_rhel_7_4_compat_len = G_N_ELEMENTS(pc_rhel_7_4_compat);
 -
 /*
  * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
  * types as the PC_COMPAT_* do for upstream types.
@@ -1094,8 +1080,7 @@ void pc_memory_init(PCMachineState *pcms,
     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
     memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
                            &error_fatal);
 -    /* RH difference: See bz 1489800, explicitly make ROM ro */
 -    if (pcmc->pc_rom_ro) {
 +    if (pcmc->pci_enabled) {
         memory_region_set_readonly(option_rom_mr, true);
     }
     memory_region_add_subregion_overlap(rom_memory,
@@ -1845,7 +1830,6 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->pvh_enabled = true;
     pcmc->kvmclock_create_always = true;
     assert(!mc->get_hotplug_handler);
 -    pcmc->pc_rom_ro = true;
     mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 64662cc3d5..fe2ac7593a 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1011,22 +1011,3 @@ static void pc_machine_rhel750_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel750, "pc-i440fx-rhel7.5.0", pc_init_rhel750,
                   pc_machine_rhel750_options);
 -
 -static void pc_init_rhel740(MachineState *machine)
 -{
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel740_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_machine_rhel750_options(m);
 -    m->desc = "RHEL 7.4.0 PC (i440FX + PIIX, 1996)";
 -    pcmc->pc_rom_ro = false;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel740, "pc-i440fx-rhel7.4.0", pc_init_rhel740,
 -                  pc_machine_rhel740_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index bf49a943dc..9958ed9184 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -774,21 +774,3 @@ static void pc_q35_machine_rhel750_options(MachineClass *m)
 DEFINE_PC_MACHINE(q35_rhel750, "pc-q35-rhel7.5.0", pc_q35_init_rhel750,
                   pc_q35_machine_rhel750_options);
 -
 -static void pc_q35_init_rhel740(MachineState *machine)
 -{
 -    pc_q35_init(machine);
 -}
 -
 -static void pc_q35_machine_rhel740_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_q35_machine_rhel750_options(m);
 -    m->desc = "RHEL-7.4.0 PC (Q35 + ICH9, 2009)";
 -    pcmc->pc_rom_ro = false;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(q35_rhel740, "pc-q35-rhel7.4.0", pc_q35_init_rhel740,
 -                  pc_q35_machine_rhel740_options);
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index ca0b99403e..bdabbf8b81 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5308,49 +5308,6 @@ static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 -
 -/*
 - * pseries-rhel7.4.0
 - * like spapr_compat_2_9
 - */
 -GlobalProperty spapr_compat_rhel7_4[] = {
 -    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
 -};
 -const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
 -
 -static void spapr_machine_rhel740_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel750_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 -    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
 -    smc->has_power9_support = false;
 -    smc->pre_2_10_has_unused_icps = true;
 -    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
 -    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
 -
 -/*
 - * pseries-rhel7.4.0-sxxm
 - *
 - * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
 - */
 -
 -static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel740_class_options(mc);
 -    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 -
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
 diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
 index e1ecfbaf1f..df519e40b5 100644
 --- a/include/hw/acpi/ich9.h
 +++ b/include/hw/acpi/ich9.h
@@ -62,9 +62,6 @@ typedef struct ICH9LPCPMRegs {
     bool smm_compat;
     bool enable_tco;
     TCOIORegs tco_regs;
 -
 -    /* RH addition, see bz 1489800 */
 -    bool force_rev1_fadt;
 } ICH9LPCPMRegs;
 #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 24d4d726d8..f27170b6fb 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -436,7 +436,4 @@ extern const size_t hw_compat_rhel_7_6_len;
 extern GlobalProperty hw_compat_rhel_7_5[];
 extern const size_t hw_compat_rhel_7_5_len;
 -extern GlobalProperty hw_compat_rhel_7_4[];
 -extern const size_t hw_compat_rhel_7_4_len;
 -
 #endif
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 820fb3f577..ff93dfb372 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -128,9 +128,6 @@ struct PCMachineClass {
     /* create kvmclock device even when KVM PV features are not exposed */
     bool kvmclock_create_always;
 -
 -    /* RH only, see bz 1489800 */
 -    bool pc_rom_ro;
 };
 #define TYPE_PC_MACHINE "generic-pc-machine"
@@ -302,9 +299,6 @@ extern const size_t pc_rhel_7_6_compat_len;
 extern GlobalProperty pc_rhel_7_5_compat[];
 extern const size_t pc_rhel_7_5_compat_len;
 -extern GlobalProperty pc_rhel_7_4_compat[];
 -extern const size_t pc_rhel_7_4_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/kvm-Remove-RHEL-7.5.0-machine-types.patch
+++ b/kvm-Remove-RHEL-7.5.0-machine-types.patch
@ -1,210 +0,0 @@
 From 6de2502ef6f2ee68842bed7d09b0a2c7ac57b11b Mon Sep 17 00:00:00 2001
 From: Juan Quintela <quintela@redhat.com>
 Date: Tue, 3 Aug 2021 12:24:36 +0200
 Subject: [PATCH 08/39] Remove RHEL 7.5.0 machine types
 RH-Author: quintela1 <quintela@redhat.com>
 RH-MergeRequest: 30: Remove RHEL 7.x.0 machine types
 RH-Commit: [6/6] a4a72853fda905fe5036520f6095032e308cb51f (juan.quintela/qemu-kvm)
 RH-Bugzilla: 1968519
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c    | 20 --------------------
 hw/i386/pc.c         | 18 ------------------
 hw/i386/pc_piix.c    | 20 --------------------
 hw/i386/pc_q35.c     | 20 --------------------
 hw/ppc/spapr.c       | 31 -------------------------------
 include/hw/boards.h  |  3 ---
 include/hw/i386/pc.h |  3 ---
 7 files changed, 115 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 6dc2651d73..b271389681 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -195,26 +195,6 @@ GlobalProperty hw_compat_rhel_7_6[] = {
 };
 const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 -/* The same as hw_compat_2_11 + hw_compat_2_10 */
 -GlobalProperty hw_compat_rhel_7_5[] = {
 -    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
 -    { "hpet", "hpet-offset-saved", "false" },
 -    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
 -    { "virtio-blk-pci", "vectors", "2" },
 -    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
 -    { "vhost-user-blk-pci", "vectors", "2" },
 -    /* hw_compat_rhel_7_5 from hw_compat_2_11
 -       bz 1608778 modified for our naming */
 -    { "e1000-82540em", "migrate_tso_props", "off" },
 -    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
 -    { "virtio-mouse-device", "wheel-axis", "false" },
 -    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
 -    { "virtio-tablet-device", "wheel-axis", "false" },
 -    { "cirrus-vga", "vgamem_mb", "16" },
 -    { "migration", "decompress-error-check", "off" },
 -};
 -const size_t hw_compat_rhel_7_5_len = G_N_ELEMENTS(hw_compat_rhel_7_5);
 -
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 6b39abce02..88972dc3e6 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -459,24 +459,6 @@ GlobalProperty pc_rhel_7_6_compat[] = {
 };
 const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
 -/* Similar to PC_COMPAT_2_11 + PC_COMPAT_2_10, but:
 - * - x-hv-max-vps was backported to 7.5
 - * - x-pci-hole64-fix was backported to 7.5
 - */
 -GlobalProperty pc_rhel_7_5_compat[] = {
 -    /* pc_rhel_7_5_compat from pc_compat_2_11 */  
 -    { "Skylake-Server" "-" TYPE_X86_CPU, "clflushopt", "off" },
 -    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 -    { TYPE_X86_CPU, "legacy-cache", "on" },
 -    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 -    { TYPE_X86_CPU, "topoext", "off" },
 -    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 -    { "EPYC-" TYPE_X86_CPU, "xlevel", stringify(0x8000000a) },
 -    /* pc_rhel_7_5_compat from pc_compat_2_12 */  
 -    { "EPYC-IBPB-" TYPE_X86_CPU, "xlevel", stringify(0x8000000a) },
 -};
 -const size_t pc_rhel_7_5_compat_len = G_N_ELEMENTS(pc_rhel_7_5_compat);
 -
 /*
  * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
  * types as the PC_COMPAT_* do for upstream types.
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index fe2ac7593a..ba7926cfae 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -991,23 +991,3 @@ static void pc_machine_rhel760_options(MachineClass *m)
 DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
                   pc_machine_rhel760_options);
 -
 -static void pc_init_rhel750(MachineState *machine)
 -{
 -    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 -             TYPE_I440FX_PCI_DEVICE);
 -}
 -
 -static void pc_machine_rhel750_options(MachineClass *m)
 -{
 -    pc_machine_rhel760_options(m);
 -    m->alias = NULL;
 -    m->is_default = 0;
 -    m->desc = "RHEL 7.5.0 PC (i440FX + PIIX, 1996)";
 -    m->auto_enable_numa_with_memhp = false;
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_5_compat, pc_rhel_7_5_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(rhel750, "pc-i440fx-rhel7.5.0", pc_init_rhel750,
 -                  pc_machine_rhel750_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 9958ed9184..f93825d603 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -754,23 +754,3 @@ static void pc_q35_machine_rhel760_options(MachineClass *m)
 DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
                   pc_q35_machine_rhel760_options);
 -
 -static void pc_q35_init_rhel750(MachineState *machine)
 -{
 -    pc_q35_init(machine);
 -}
 -
 -static void pc_q35_machine_rhel750_options(MachineClass *m)
 -{
 -    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 -    pc_q35_machine_rhel760_options(m);
 -    m->alias = NULL;
 -    m->desc = "RHEL-7.5.0 PC (Q35 + ICH9, 2009)";
 -    m->auto_enable_numa_with_memhp = false;
 -    pcmc->default_nic_model = "e1000";
 -    compat_props_add(m->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 -    compat_props_add(m->compat_props, pc_rhel_7_5_compat, pc_rhel_7_5_compat_len);
 -}
 -
 -DEFINE_PC_MACHINE(q35_rhel750, "pc-q35-rhel7.5.0", pc_q35_init_rhel750,
 -                  pc_q35_machine_rhel750_options);
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index bdabbf8b81..cda75a8cfe 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5282,35 +5282,4 @@ static void spapr_machine_rhel760sxxm_class_options(MachineClass *mc)
 DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
 -static void spapr_machine_rhel750_class_options(MachineClass *mc)
 -{
 -    spapr_machine_rhel760_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 -
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
 -
 -/*
 - * pseries-rhel7.5.0-sxxm
 - *
 - * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
 - */
 -
 -static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 -{
 -    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 -
 -    spapr_machine_rhel750_class_options(mc);
 -    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 -    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 -}
 -
 -DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 -static void spapr_machine_register_types(void)
 -{
 -    type_register_static(&spapr_machine_info);
 -}
 -
 type_init(spapr_machine_register_types)
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index f27170b6fb..73f7dcdb35 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -433,7 +433,4 @@ extern const size_t hw_compat_rhel_8_0_len;
 extern GlobalProperty hw_compat_rhel_7_6[];
 extern const size_t hw_compat_rhel_7_6_len;
 -extern GlobalProperty hw_compat_rhel_7_5[];
 -extern const size_t hw_compat_rhel_7_5_len;
 -
 #endif
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index ff93dfb372..549e581a98 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -296,9 +296,6 @@ extern const size_t pc_rhel_8_0_compat_len;
 extern GlobalProperty pc_rhel_7_6_compat[];
 extern const size_t pc_rhel_7_6_compat_len;
 -extern GlobalProperty pc_rhel_7_5_compat[];
 -extern const size_t pc_rhel_7_5_compat_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/kvm-Remove-SPICE-and-QXL-from-x86_64-rh-devices.mak.patch
+++ b/kvm-Remove-SPICE-and-QXL-from-x86_64-rh-devices.mak.patch
@ -1,43 +0,0 @@
 From c51bf45304812b4da010bdd3db1b1d59c44af4ee Mon Sep 17 00:00:00 2001
 From: Uri Lublin <uril@redhat.com>
 Date: Tue, 27 Apr 2021 18:37:09 +0300
 Subject: [PATCH 2/4] Remove SPICE and QXL from x86_64-rh-devices.mak
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Uri Lublin (uril)
 RH-MergeRequest: 3: Build qemu-kvm without SPICE and QXL
 RH-Commit: [1/3] 8f6186049d22c3a6e1bfb1cf2bfe88a8fc8c2271
 RH-Bugzilla: 1906168
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 default-configs/devices/x86_64-rh-devices.mak | 2 --
 1 file changed, 2 deletions(-)
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 index 9f41400530..d09c138fc6 100644
 --- a/default-configs/devices/x86_64-rh-devices.mak
 +++ b/default-configs/devices/x86_64-rh-devices.mak
@@ -60,7 +60,6 @@ CONFIG_PFLASH_CFI01=y
 CONFIG_PVPANIC_ISA=y
 CONFIG_PXB=y
 CONFIG_Q35=y
 -CONFIG_QXL=y
 CONFIG_RTL8139_PCI=y
 CONFIG_SCSI=y
 CONFIG_SERIAL=y
@@ -70,7 +69,6 @@ CONFIG_SEV=y
 CONFIG_SGA=y
 CONFIG_SMBIOS=y
 CONFIG_SMBUS_EEPROM=y
 -CONFIG_SPICE=y
 CONFIG_TEST_DEVICES=y
 CONFIG_USB=y
 CONFIG_USB_EHCI=y
 -- 
 2.27.0
--- a/kvm-Update-Linux-headers-to-5.13-rc4.patch
+++ b/kvm-Update-Linux-headers-to-5.13-rc4.patch
--- a/kvm-aarch64-Add-USB-storage-devices.patch
+++ b/kvm-aarch64-Add-USB-storage-devices.patch
@ -1,41 +0,0 @@
 From 7fd7892a21cf930f3d44dc3205bed9fb9128c11c Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Wed, 4 Aug 2021 07:10:15 -0400
 Subject: [PATCH 23/39] aarch64: Add USB storage devices
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [15/15] 7706801381d8dfc97231fa87f6a7c8de7e3c8e84 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 There's no reason not to support these devices and doing so allows us
 to match x86 and ppc. Also to match the other architectures we do not
 enable CONFIG_USB_STORAGE_BOT, as that was disabled for the other
 architectures for BZ1866133.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 default-configs/devices/aarch64-rh-devices.mak | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/default-configs/devices/aarch64-rh-devices.mak b/default-configs/devices/aarch64-rh-devices.mak
 index d8ce902720..a5bab23925 100644
 --- a/default-configs/devices/aarch64-rh-devices.mak
 +++ b/default-configs/devices/aarch64-rh-devices.mak
@@ -15,6 +15,8 @@ CONFIG_SEMIHOSTING=y
 CONFIG_USB=y
 CONFIG_USB_XHCI=y
 CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 CONFIG_VFIO=y
 CONFIG_VFIO_PCI=y
 CONFIG_VIRTIO_MMIO=y
 -- 
 2.27.0
--- a/kvm-aarch64-rh-devices-add-CONFIG_PVPANIC_PCI.patch
+++ b/kvm-aarch64-rh-devices-add-CONFIG_PVPANIC_PCI.patch
@ -1,38 +0,0 @@
 From 5cc3aacc241c0d26f63d51efd1b6fa35490d37c9 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Wed, 26 May 2021 10:33:20 -0400
 Subject: [PATCH 03/15] aarch64-rh-devices: add CONFIG_PVPANIC_PCI
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 2: aarch64-rh-devices: add CONFIG_PVPANIC_PCI
 RH-Commit: [1/1] f3d0a94a91ea1b3fff925f32affce1b77469e206 (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1747467
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 We want to enable the PVPANIC facility on ARM. On aarch64,
 the PVPANIC PCI device is used (on x86_64 the ISA device is used).
 so let's set the PVPANIC_PCI config.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 default-configs/devices/aarch64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/default-configs/devices/aarch64-rh-devices.mak b/default-configs/devices/aarch64-rh-devices.mak
 index a4d67274c0..4220469178 100644
 --- a/default-configs/devices/aarch64-rh-devices.mak
 +++ b/default-configs/devices/aarch64-rh-devices.mak
@@ -26,3 +26,4 @@ CONFIG_TPM_EMULATOR=y
 CONFIG_TPM_TIS_SYSBUS=y
 CONFIG_PTIMER=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 +CONFIG_PVPANIC_PCI=y
 -- 
 2.27.0
--- a/kvm-aarch64-rh-devices-add-CONFIG_PXB.patch
+++ b/kvm-aarch64-rh-devices-add-CONFIG_PXB.patch
@ -1,37 +0,0 @@
 From d05ba1e2208cb17b8cf7dac050d95137a67dd988 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Thu, 24 Jun 2021 10:32:08 +0200
 Subject: [PATCH 01/12] aarch64-rh-devices: add CONFIG_PXB
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 14: aarch64-rh-devices: add CONFIG_PXB
 RH-Commit: [1/1] 6a9e6a96ea6ba1bee220a60e5a691a174a0a044b (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1967502
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 We want to enable the PCIe expander bridge on aarch64. So let's
 set CONFIG_PXB.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 default-configs/devices/aarch64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/default-configs/devices/aarch64-rh-devices.mak b/default-configs/devices/aarch64-rh-devices.mak
 index 4220469178..d8ce902720 100644
 --- a/default-configs/devices/aarch64-rh-devices.mak
 +++ b/default-configs/devices/aarch64-rh-devices.mak
@@ -27,3 +27,4 @@ CONFIG_TPM_TIS_SYSBUS=y
 CONFIG_PTIMER=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 CONFIG_PVPANIC_PCI=y
 +CONFIG_PXB=y
 -- 
 2.27.0
--- a/kvm-acpi-pc-revert-back-to-v5.2-PCI-slot-enumeration.patch
+++ b/kvm-acpi-pc-revert-back-to-v5.2-PCI-slot-enumeration.patch
@ -1,111 +0,0 @@
 From 456bb6cb658b9d332fa0b5b91946916b48ed449e Mon Sep 17 00:00:00 2001
 From: Igor Mammedov <imammedo@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:10 -0400
 Subject: [PATCH 09/39] acpi: pc: revert back to v5.2 PCI slot enumeration
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [1/15] 57222343ccae17b99b4e166798d4d0eecca2e22b (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Commit [1] moved _SUN variable from only hot-pluggable to
 all devices. This made linux kernel enumerate extra slots
 that weren't present before. If extra slot happens to be
 be enumerated first and there is a device in th same slot
 but on other bridge, linux kernel will add -N suffix to
 slot name of the later, thus changing NIC name compared to
 QEMU 5.2. This in some case confuses systemd, if it is
 using SLOT NIC naming scheme and interface name becomes
 not the same as it was under QEMU-5.2.
 Reproducer QEMU CLI:
  -M pc-i440fx-5.2 -nodefaults \
  -device pci-bridge,chassis_nr=1,id=pci.1,bus=pci.0,addr=0x3 \
  -device virtio-net-pci,id=nic1,bus=pci.1,addr=0x1 \
  -device virtio-net-pci,id=nic2,bus=pci.1,addr=0x2 \
  -device virtio-net-pci,id=nic3,bus=pci.1,addr=0x3
 with RHEL8 guest produces following results:
  v5.2:
     kernel: virtio_net virtio0 ens1: renamed from eth0
     kernel: virtio_net virtio2 ens3: renamed from eth2
     kernel: virtio_net virtio1 enp1s2: renamed from eth1
      (slot 2 is assigned to empty bus 0 slot and virtio1
       is assigned to 2-2 slot, and renaming falls back,
       for some reason, to path based naming scheme)
  v6.0:
     kernel: virtio_net virtio0 ens1: renamed from eth0
     kernel: virtio_net virtio2 ens3: renamed from eth2
     systemd-udevd[299]: Error changing net interface name 'eth1' to 'ens3': File exists
     systemd-udevd[299]: could not rename interface '3' from 'eth1' to 'ens3': File exists
      (with commit [1] kernel assigns virtio2 to 3-2 slot
       since bridge advertises _SUN=0x3 and kernel assigns
       slot 3 to bridge. Still it manages to rename virtio2
       correctly to ens3, however systemd gets confused with virtio1
       where slot allocation exactly the same (2-2) as in 5.2 case
       and tries to rename it to ens3 which is rightfully taken by
       virtio2)
 I'm not sure what breaks in systemd interface renaming (it probably
 should be investigated), but on QEMU side we can safely revert
 _SUN to 5.2 behavior (i.e. avoid cold-plugged bridges and non
 hot-pluggable device classes), without breaking acpi-index, which uses
 slot numbers but it doesn't have to use _SUN, it could use an arbitrary
 variable name that has the same slot value).
 It will help existing VMs to keep networking with non trivial
 configs in working order since systemd will do its interface
 renaming magic as it used to do.
 1)
 Fixes: b7f23f62e40 (pci: acpi: add _DSM method to PCI devices)
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Message-Id: <20210624204229.998824-3-imammedo@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Tested-by: John Sucaet <john.sucaet@ekinops.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 7193d7cdd93e50f0e5f09803b98d27d3f9b147ac)
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/acpi-build.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index de98750aef..dbee0cd3bc 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -432,11 +432,15 @@ static void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus,
         aml_append(dev, aml_name_decl("_ADR", aml_int(slot << 16)));
         if (bsel) {
 -            aml_append(dev, aml_name_decl("_SUN", aml_int(slot)));
 +            /*
 +             * Can't declare _SUN here for every device as it changes 'slot'
 +             * enumeration order in linux kernel, so use another variable for it
 +             */
 +            aml_append(dev, aml_name_decl("ASUN", aml_int(slot)));
             method = aml_method("_DSM", 4, AML_SERIALIZED);
             aml_append(method, aml_return(
                 aml_call6("PDSM", aml_arg(0), aml_arg(1), aml_arg(2),
 -                          aml_arg(3), aml_name("BSEL"), aml_name("_SUN"))
 +                          aml_arg(3), aml_name("BSEL"), aml_name("ASUN"))
             ));
             aml_append(dev, method);
         }
@@ -463,6 +467,7 @@ static void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus,
             aml_append(method, aml_return(aml_int(s3d)));
             aml_append(dev, method);
         } else if (hotplug_enabled_dev) {
 +            aml_append(dev, aml_name_decl("_SUN", aml_int(slot)));
             /* add _EJ0 to make slot hotpluggable  */
             method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
             aml_append(method,
 -- 
 2.27.0
--- a/kvm-arm-virt-Enable-ARM-RAS-support.patch
+++ b/kvm-arm-virt-Enable-ARM-RAS-support.patch
@ -1,68 +0,0 @@
 From 170a9c7dc044a0094b48c658e0d57c97c4b854e0 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Wed, 30 Jun 2021 13:38:03 +0200
 Subject: [PATCH 03/13] arm/virt: Enable ARM RAS support
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 19: arm/virt: Support RAS
 RH-Commit: [3/3] 1572368bb0f47463a1f6ffa3f5baa97242440c98 (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1838608
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 We want to support ARM RAS (Reliability, Availability & Serviceability).
 So let's register the RAS property as a class property. It is
 unset by default.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index fe1111d527..0084935ec8 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -2281,7 +2281,6 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2296,6 +2295,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -3013,6 +3013,12 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
                                           "Set the IOMMU type. "
                                           "Valid values are none and smmuv3");
 +    object_class_property_add_bool(oc, "ras", virt_get_ras,
 +                                   virt_set_ras);
 +    object_class_property_set_description(oc, "ras",
 +                                          "Set on/off to enable/disable reporting host memory errors "
 +                                          "to a KVM guest using ACPI and guest external abort exceptions");
 +
     object_class_property_add_bool(oc, "its", virt_get_its,
                                    virt_set_its);
     object_class_property_set_description(oc, "its",
@@ -3063,7 +3069,7 @@ static void rhel_virt_instance_init(Object *obj)
     /* Default disallows iommu instantiation */
     vms->iommu = VIRT_IOMMU_NONE;
 -    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    /* Default disallows RAS instantiation */
     vms->ras = false;
     /* MTE is disabled by default and non-configurable for RHEL */
 -- 
 2.27.0
--- a/kvm-arm-virt-Register-highmem-and-gic-version-as-class-p.patch
+++ b/kvm-arm-virt-Register-highmem-and-gic-version-as-class-p.patch
@ -1,77 +0,0 @@
 From e808acaa50effe471c56a48b80d5e0d2d196b495 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 25 May 2021 09:22:23 +0200
 Subject: [PATCH 01/15] arm/virt: Register highmem and gic-version as class
 properties
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 1: Add 9.0.0 and 8.5.0 arm-virt machine types
 RH-Commit: [1/2] 1ff3970773e09f2efb194430511928ae852c02ba (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1952449
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 This mirrors changes made in commit
 b91def7b8382 ("rm/virt: Register most properties as class properties")
 for the highmem and gic-version properties. This makes the
 code easier to diff against upstream.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 080cf54ef1..51a415570c 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -2996,6 +2996,18 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
     object_class_property_set_description(oc, "acpi",
         "Enable ACPI");
 +    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
 +                                   virt_set_highmem);
 +    object_class_property_set_description(oc, "highmem",
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
     object_class_property_add_str(oc, "x-oem-id",
                                   virt_get_oem_id,
                                   virt_set_oem_id);
@@ -3004,7 +3016,6 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
                                           "in ACPI table header."
                                           "The string may be up to 6 bytes in size");
 -
     object_class_property_add_str(oc, "x-oem-table-id",
                                   virt_get_oem_table_id,
                                   virt_set_oem_table_id);
@@ -3027,17 +3038,7 @@ static void rhel_virt_instance_init(Object *obj)
     /* High memory is enabled by default */
     vms->highmem = true;
 -    object_property_add_bool(obj, "highmem", virt_get_highmem,
 -                             virt_set_highmem);
 -    object_property_set_description(obj, "highmem",
 -                                    "Set on/off to enable/disable using "
 -                                    "physical address space above 32 bits");
     vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 -    object_property_add_str(obj, "gic-version", virt_get_gic_version,
 -                        virt_set_gic_version);
 -    object_property_set_description(obj, "gic-version",
 -                                    "Set GIC version. "
 -                                    "Valid values are 2, 3, host and max");
     vms->highmem_ecam = !vmc->no_highmem_ecam;
 -- 
 2.27.0
--- a/kvm-arm-virt-Register-iommu-as-a-class-property.patch
+++ b/kvm-arm-virt-Register-iommu-as-a-class-property.patch
@ -1,54 +0,0 @@
 From 42e530c513914b83273ec8c6a29100eb3c737604 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Wed, 30 Jun 2021 07:28:38 -0400
 Subject: [PATCH 01/13] arm/virt: Register iommu as a class property
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 19: arm/virt: Support RAS
 RH-Commit: [1/3] 48428de4deb5af94891aa5552fb9f4ea6d69acef (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1838608
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 As done for highmem and gic-version, let's register the iommu property
 as a class property. This is closer to the upstream code. This
 change was originally made by upstream commit:
 b91def7b8382 ("arm/virt: Register most properties as class properties")
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index e4aa794f83..bdae24a753 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3008,6 +3008,11 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
                                           "Set GIC version. "
                                           "Valid values are 2, 3, host and max");
 +    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
 +    object_class_property_set_description(oc, "iommu",
 +                                          "Set the IOMMU type. "
 +                                          "Valid values are none and smmuv3");
 +
     object_class_property_add_str(oc, "x-oem-id",
                                   virt_get_oem_id,
                                   virt_set_oem_id);
@@ -3056,10 +3061,6 @@ static void rhel_virt_instance_init(Object *obj)
     /* Default disallows iommu instantiation */
     vms->iommu = VIRT_IOMMU_NONE;
 -    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
 -    object_property_set_description(obj, "iommu",
 -                                    "Set the IOMMU type. "
 -                                    "Valid values are none and smmuv3");
     /* Default disallows RAS instantiation and is non-configurable for RHEL */
     vms->ras = false;
 -- 
 2.27.0
--- a/kvm-arm-virt-Register-its-as-a-class-property.patch
+++ b/kvm-arm-virt-Register-its-as-a-class-property.patch
@ -1,56 +0,0 @@
 From 29d18bdaf3dad52a052b2b058cd8f74652a72f76 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Thu, 8 Jul 2021 05:14:47 -0400
 Subject: [PATCH 02/13] arm/virt: Register its as a class property
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 19: arm/virt: Support RAS
 RH-Commit: [2/3] 95debacfd59d06ed2dcaeb120b20a280ff515434 (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1838608
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 As done for highmem, gic-version, iommu, let's register the its property
 as a class property. This is closer to the upstream code. This
 change was originally made by upstream commit:
 b91def7b8382 ("arm/virt: Register most properties as class properties")
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index bdae24a753..fe1111d527 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3013,6 +3013,12 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
                                           "Set the IOMMU type. "
                                           "Valid values are none and smmuv3");
 +    object_class_property_add_bool(oc, "its", virt_get_its,
 +                                   virt_set_its);
 +    object_class_property_set_description(oc, "its",
 +                                          "Set on/off to enable/disable "
 +                                          "ITS instantiation");
 +
     object_class_property_add_str(oc, "x-oem-id",
                                   virt_get_oem_id,
                                   virt_set_oem_id);
@@ -3052,11 +3058,6 @@ static void rhel_virt_instance_init(Object *obj)
     } else {
         /* Default allows ITS instantiation */
         vms->its = true;
 -        object_property_add_bool(obj, "its", virt_get_its,
 -                                 virt_set_its);
 -        object_property_set_description(obj, "its",
 -                                        "Set on/off to enable/disable "
 -                                        "ITS instantiation");
     }
     /* Default disallows iommu instantiation */
 -- 
 2.27.0
--- a/kvm-audio-Never-send-migration-section.patch
+++ b/kvm-audio-Never-send-migration-section.patch
@ -1,63 +0,0 @@
 From 1e69dbe01e1cad1680723e1bc086cc52a1772c17 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 11 Aug 2021 08:40:38 -0400
 Subject: [PATCH 27/39] audio: Never send migration section
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 35: Synchronize with RHEL-AV 8.5 release 28 to RHEL 9
 RH-Commit: [4/4] 0b6ec114a3573ac7efcbe5ab3094d8020899c82d (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 The audio migration vmstate is empty, and always has been; we can't
 just remove it though because an old qemu might send it us.
 Changes with -audiodev now mean it's sometimes created when it didn't
 used to be, and can confuse migration to old qemu.
 Change it so that vmstate_audio is never sent; if it's received it
 should still be accepted, and old qemu's shouldn't be too upset if it's
 missing.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Tested-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-Id: <20210809170956.78536-1-dgilbert@redhat.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit da77adbaf619c4d170cb42d769145ad1803fbad9)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 audio/audio.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
 diff --git a/audio/audio.c b/audio/audio.c
 index 534278edfe..fa724ea8e0 100644
 --- a/audio/audio.c
 +++ b/audio/audio.c
@@ -1621,10 +1621,20 @@ void audio_cleanup(void)
     }
 }
 +static bool vmstate_audio_needed(void *opaque)
 +{
 +    /*
 +     * Never needed, this vmstate only exists in case
 +     * an old qemu sends it to us.
 +     */
 +    return false;
 +}
 +
 static const VMStateDescription vmstate_audio = {
     .name = "audio",
     .version_id = 1,
     .minimum_version_id = 1,
 +    .needed = vmstate_audio_needed,
     .fields = (VMStateField[]) {
         VMSTATE_END_OF_LIST()
     }
 -- 
 2.27.0
--- a/kvm-block-Add-option-to-use-driver-whitelist-even-in-too.patch
+++ b/kvm-block-Add-option-to-use-driver-whitelist-even-in-too.patch
@ -1,121 +0,0 @@
 From 0739f735f99a6f1760a422023c262c1aa542a2e5 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 9 Jul 2021 18:41:41 +0200
 Subject: [PATCH 19/43] block: Add option to use driver whitelist even in tools
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Kevin Wolf <None>
 RH-MergeRequest: 26: block: Disable unsupported/read-only block drivers even in tools
 RH-Commit: [1/2] 6755d5ff4ef43f275ae530de2b2a568ffd2d3497 (kmwolf/centos-qemu-kvm)
 RH-Bugzilla: 1957782
 RH-Acked-by: Max Reitz <None>
 RH-Acked-by: Richard W.M. Jones <None>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Currently, the block driver whitelists are only applied for the system
 emulator. All other binaries still give unrestricted access to all block
 drivers. There are use cases where this made sense because the main
 concern was avoiding customers running VMs on less optimised block
 drivers and getting bad performance. Allowing the same image format e.g.
 as a target for 'qemu-img convert' is not a problem then.
 However, if the concern is the supportability of the driver in general,
 either in full or when used read-write, not applying the list driver
 whitelist in tools doesn't help - especially since qemu-nbd and
 qemu-storage-daemon now give access to more or less the same operations
 in block drivers as running a system emulator.
 In order to address this, introduce a new configure option that enforces
 the driver whitelist in all binaries.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210709164141.254097-1-kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit e5f05f8c375157211c7da625a0d3f3ccdb4957d5)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block.c     |  3 +++
 configure   | 14 ++++++++++++--
 meson.build |  1 +
 3 files changed, 16 insertions(+), 2 deletions(-)
 diff --git a/block.c b/block.c
 index c5b887cec1..76ecede5af 100644
 --- a/block.c
 +++ b/block.c
@@ -5817,6 +5817,9 @@ BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
 void bdrv_init(void)
 {
 +#ifdef CONFIG_BDRV_WHITELIST_TOOLS
 +    use_bdrv_whitelist = 1;
 +#endif
     module_call_init(MODULE_INIT_BLOCK);
 }
 diff --git a/configure b/configure
 index 53b2fa583a..7edc08afb3 100755
 --- a/configure
 +++ b/configure
@@ -243,6 +243,7 @@ cross_prefix=""
 audio_drv_list=""
 block_drv_rw_whitelist=""
 block_drv_ro_whitelist=""
 +block_drv_whitelist_tools="no"
 host_cc="cc"
 audio_win_int=""
 libs_qga=""
@@ -1029,6 +1030,10 @@ for opt do
   ;;
   --block-drv-ro-whitelist=*) block_drv_ro_whitelist=$(echo "$optarg" | sed -e 's/,/ /g')
   ;;
 +  --enable-block-drv-whitelist-in-tools) block_drv_whitelist_tools="yes"
 +  ;;
 +  --disable-block-drv-whitelist-in-tools) block_drv_whitelist_tools="no"
 +  ;;
   --enable-debug-tcg) debug_tcg="yes"
   ;;
   --disable-debug-tcg) debug_tcg="no"
@@ -1764,10 +1769,12 @@ Advanced options (experts only):
   --block-drv-whitelist=L  Same as --block-drv-rw-whitelist=L
   --block-drv-rw-whitelist=L
                            set block driver read-write whitelist
 -                           (affects only QEMU, not qemu-img)
 +                           (by default affects only QEMU, not tools like qemu-img)
   --block-drv-ro-whitelist=L
                            set block driver read-only whitelist
 -                           (affects only QEMU, not qemu-img)
 +                           (by default affects only QEMU, not tools like qemu-img)
 +  --enable-block-drv-whitelist-in-tools
 +                           use block whitelist also in tools instead of only QEMU
   --enable-trace-backends=B Set trace backend
                            Available backends: $trace_backend_list
   --with-trace-file=NAME   Full PATH,NAME of file to store traces
@@ -5571,6 +5578,9 @@ if test "$audio_win_int" = "yes" ; then
 fi
 echo "CONFIG_BDRV_RW_WHITELIST=$block_drv_rw_whitelist" >> $config_host_mak
 echo "CONFIG_BDRV_RO_WHITELIST=$block_drv_ro_whitelist" >> $config_host_mak
 +if test "$block_drv_whitelist_tools" = "yes" ; then
 +  echo "CONFIG_BDRV_WHITELIST_TOOLS=y" >> $config_host_mak
 +fi
 if test "$xfs" = "yes" ; then
   echo "CONFIG_XFS=y" >> $config_host_mak
 fi
 diff --git a/meson.build b/meson.build
 index 06c15bd6d2..49b8164ade 100644
 --- a/meson.build
 +++ b/meson.build
@@ -2606,6 +2606,7 @@ summary_info += {'coroutine pool':    config_host['CONFIG_COROUTINE_POOL'] == '1
 if have_block
   summary_info += {'Block whitelist (rw)': config_host['CONFIG_BDRV_RW_WHITELIST']}
   summary_info += {'Block whitelist (ro)': config_host['CONFIG_BDRV_RO_WHITELIST']}
 +  summary_info += {'Use block whitelist in tools': config_host.has_key('CONFIG_BDRV_WHITELIST_TOOLS')}
   summary_info += {'VirtFS support':    have_virtfs}
   summary_info += {'build virtiofs daemon': have_virtiofsd}
   summary_info += {'Live block migration': config_host.has_key('CONFIG_LIVE_BLOCK_MIGRATION')}
 -- 
 2.27.0
--- a/kvm-block-Fix-in_flight-leak-in-request-padding-error-pa.patch
+++ b/kvm-block-Fix-in_flight-leak-in-request-padding-error-pa.patch
@ -1,71 +0,0 @@
 From 872e82621b1341e8b96bda47f7f43dfffd356249 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Tue, 27 Jul 2021 17:49:23 +0200
 Subject: [PATCH 04/13] block: Fix in_flight leak in request padding error path
 RH-Author: Kevin Wolf <None>
 RH-MergeRequest: 31: block: Fix in_flight leak in request padding error path
 RH-Commit: [1/1] a0d1bf38d9a69818cd6cefc3779f2988b484605a (kmwolf/centos-qemu-kvm)
 RH-Bugzilla: 1972079
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 When bdrv_pad_request() fails in bdrv_co_preadv_part(), bs->in_flight
 has been increased, but is never decreased again. This leads to a hang
 when trying to drain the block node.
 This bug was observed with Windows guests which issue a request that
 fully uses IOV_MAX during installation, so that when padding is
 necessary (O_DIRECT with a 4k sector size block device on the host),
 adding another entry causes failure.
 Call bdrv_dec_in_flight() to fix this. There is a larger problem to
 solve here because this request shouldn't even fail, but Windows doesn't
 seem to care and with this minimal fix the installation succeeds. So
 given that we're already in freeze, let's take this minimal fix for 6.1.
 Fixes: 98ca45494fcd6bf0336ecd559e440b6de6ea4cd3
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1972079
 Reported-by: Qing Wang <qinwang@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210727154923.91067-1-kwolf@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 87ab88025247b893aad5071fd38301b67be76d1a)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/io.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index a4b2e3adf1..5033d51334 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1811,7 +1811,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
     ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
                            NULL);
     if (ret < 0) {
 -        return ret;
 +        goto fail;
     }
     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_READ);
@@ -1819,10 +1819,11 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
                               bs->bl.request_alignment,
                               qiov, qiov_offset, flags);
     tracked_request_end(&req);
 -    bdrv_dec_in_flight(bs);
 -
     bdrv_padding_destroy(&pad);
 +fail:
 +    bdrv_dec_in_flight(bs);
 +
     return ret;
 }
 -- 
 2.27.0
--- a/kvm-block-add-max_hw_transfer-to-BlockLimits.patch
+++ b/kvm-block-add-max_hw_transfer-to-BlockLimits.patch
@ -1,131 +0,0 @@
 From 6773549977d94c504ec76aed67506ae85adff973 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:33 -0400
 Subject: [PATCH 17/43] block: add max_hw_transfer to BlockLimits
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 For block host devices, I/O can happen through either the kernel file
 descriptor I/O system calls (preadv/pwritev, io_submit, io_uring)
 or the SCSI passthrough ioctl SG_IO.
 In the latter case, the size of each transfer can be limited by the
 HBA, while for file descriptor I/O the kernel is able to split and
 merge I/O in smaller pieces as needed.  Applying the HBA limits to
 file descriptor I/O results in more system calls and suboptimal
 performance, so this patch splits the max_transfer limit in two:
 max_transfer remains valid and is used in general, while max_hw_transfer
 is limited to the maximum hardware size.  max_hw_transfer can then be
 included by the scsi-generic driver in the block limits page, to ensure
 that the stricter hardware limit is used.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 24b36e9813ec15da7db62e3b3621730710c5f020)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/block-backend.c          | 13 +++++++++++++
 block/file-posix.c             |  2 +-
 block/io.c                     |  2 ++
 hw/scsi/scsi-generic.c         |  2 +-
 include/block/block_int.h      |  7 +++++++
 include/sysemu/block-backend.h |  1 +
 6 files changed, 25 insertions(+), 2 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 136cc602c5..b5f5b4b048 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -1939,6 +1939,19 @@ uint32_t blk_get_request_alignment(BlockBackend *blk)
     return bs ? bs->bl.request_alignment : BDRV_SECTOR_SIZE;
 }
 +/* Returns the maximum hardware transfer length, in bytes; guaranteed nonzero */
 +uint64_t blk_get_max_hw_transfer(BlockBackend *blk)
 +{
 +    BlockDriverState *bs = blk_bs(blk);
 +    uint64_t max = INT_MAX;
 +
 +    if (bs) {
 +        max = MIN_NON_ZERO(max, bs->bl.max_hw_transfer);
 +        max = MIN_NON_ZERO(max, bs->bl.max_transfer);
 +    }
 +    return ROUND_DOWN(max, blk_get_request_alignment(blk));
 +}
 +
 /* Returns the maximum transfer length, in bytes; guaranteed nonzero */
 uint32_t blk_get_max_transfer(BlockBackend *blk)
 {
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 1a6c799e19..44325a635d 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1258,7 +1258,7 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
         int ret = sg_get_max_transfer_length(s->fd);
         if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
 -            bs->bl.max_transfer = pow2floor(ret);
 +            bs->bl.max_hw_transfer = pow2floor(ret);
         }
         ret = sg_get_max_segments(s->fd);
 diff --git a/block/io.c b/block/io.c
 index ca2dca3007..a4b2e3adf1 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -126,6 +126,8 @@ static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
 {
     dst->opt_transfer = MAX(dst->opt_transfer, src->opt_transfer);
     dst->max_transfer = MIN_NON_ZERO(dst->max_transfer, src->max_transfer);
 +    dst->max_hw_transfer = MIN_NON_ZERO(dst->max_hw_transfer,
 +                                        src->max_hw_transfer);
     dst->opt_mem_alignment = MAX(dst->opt_mem_alignment,
                                  src->opt_mem_alignment);
     dst->min_mem_alignment = MAX(dst->min_mem_alignment,
 diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
 index 82e1e2ee79..3762dce749 100644
 --- a/hw/scsi/scsi-generic.c
 +++ b/hw/scsi/scsi-generic.c
@@ -179,7 +179,7 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s)
         (r->req.cmd.buf[1] & 0x01)) {
         page = r->req.cmd.buf[2];
         if (page == 0xb0) {
 -            uint32_t max_transfer = blk_get_max_transfer(s->conf.blk);
 +            uint64_t max_transfer = blk_get_max_hw_transfer(s->conf.blk);
             uint32_t max_iov = blk_get_max_iov(s->conf.blk);
             assert(max_transfer);
 diff --git a/include/block/block_int.h b/include/block/block_int.h
 index 88e4111939..09d8630ec4 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
@@ -695,6 +695,13 @@ typedef struct BlockLimits {
      * clamped down. */
     uint32_t max_transfer;
 +    /* Maximal hardware transfer length in bytes.  Applies whenever
 +     * transfers to the device bypass the kernel I/O scheduler, for
 +     * example with SG_IO.  If larger than max_transfer or if zero,
 +     * blk_get_max_hw_transfer will fall back to max_transfer.
 +     */
 +    uint64_t max_hw_transfer;
 +
     /* memory alignment, in bytes so that no bounce buffer is needed */
     size_t min_mem_alignment;
 diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
 index 5423e3d9c6..9ac5f7bbd3 100644
 --- a/include/sysemu/block-backend.h
 +++ b/include/sysemu/block-backend.h
@@ -208,6 +208,7 @@ void blk_eject(BlockBackend *blk, bool eject_flag);
 int blk_get_flags(BlockBackend *blk);
 uint32_t blk_get_request_alignment(BlockBackend *blk);
 uint32_t blk_get_max_transfer(BlockBackend *blk);
 +uint64_t blk_get_max_hw_transfer(BlockBackend *blk);
 int blk_get_max_iov(BlockBackend *blk);
 void blk_set_guest_block_size(BlockBackend *blk, int align);
 void *blk_try_blockalign(BlockBackend *blk, size_t size);
 -- 
 2.27.0
--- a/kvm-block-backend-add-drained_poll.patch
+++ b/kvm-block-backend-add-drained_poll.patch
@ -1,74 +0,0 @@
 From e23a2be8c57666e091d9192e113a30ea06cd83ef Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 17 Jun 2021 09:13:20 -0400
 Subject: [PATCH 05/12] block-backend: add drained_poll
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [3/8] 4ad1f536b00a762a1b094d76383b74826228892a (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Allow block backends to poll their devices/users to check if they have
 been quiesced when entering a drained section.
 This will be used in the next patch to wait for the NBD server to be
 completely quiesced.
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20210602060552.17433-2-slp@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 095cc4d0f62513d75e9bc1da37f08d9e97f267c4)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/block-backend.c          | 7 ++++++-
 include/sysemu/block-backend.h | 4 ++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 413af51f3b..05d8e5fb5d 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -2378,8 +2378,13 @@ static void blk_root_drained_begin(BdrvChild *child)
 static bool blk_root_drained_poll(BdrvChild *child)
 {
     BlockBackend *blk = child->opaque;
 +    bool busy = false;
     assert(blk->quiesce_counter);
 -    return !!blk->in_flight;
 +
 +    if (blk->dev_ops && blk->dev_ops->drained_poll) {
 +        busy = blk->dev_ops->drained_poll(blk->dev_opaque);
 +    }
 +    return busy || !!blk->in_flight;
 }
 static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
 diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
 index 880e903293..5423e3d9c6 100644
 --- a/include/sysemu/block-backend.h
 +++ b/include/sysemu/block-backend.h
@@ -66,6 +66,10 @@ typedef struct BlockDevOps {
      * Runs when the backend's last drain request ends.
      */
     void (*drained_end)(void *opaque);
 +    /*
 +     * Is the device still busy?
 +     */
 +    bool (*drained_poll)(void *opaque);
 } BlockDevOps;
 /* This struct is embedded in (the private) BlockBackend struct and contains
 -- 
 2.27.0
--- a/kvm-block-backend-align-max_transfer-to-request-alignmen.patch
+++ b/kvm-block-backend-align-max_transfer-to-request-alignmen.patch
@ -1,47 +0,0 @@
 From 643c979c2bfa0fc3c45ec8ec5f05a77e0b075356 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:32 -0400
 Subject: [PATCH 16/43] block-backend: align max_transfer to request alignment
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 Block device requests must be aligned to bs->bl.request_alignment.
 It makes sense for drivers to align bs->bl.max_transfer the same
 way; however when there is no specified limit, blk_get_max_transfer
 just returns INT_MAX.  Since the contract of the function does not
 specify that INT_MAX means "no maximum", just align the outcome
 of the function (whether INT_MAX or bs->bl.max_transfer) before
 returning it.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit b99f7fa08a3df8b8a6a907642e5851cdcf43fa9f)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/block-backend.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 05d8e5fb5d..136cc602c5 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -1943,12 +1943,12 @@ uint32_t blk_get_request_alignment(BlockBackend *blk)
 uint32_t blk_get_max_transfer(BlockBackend *blk)
 {
     BlockDriverState *bs = blk_bs(blk);
 -    uint32_t max = 0;
 +    uint32_t max = INT_MAX;
     if (bs) {
 -        max = bs->bl.max_transfer;
 +        max = MIN_NON_ZERO(max, bs->bl.max_transfer);
     }
 -    return MIN_NON_ZERO(max, INT_MAX);
 +    return ROUND_DOWN(max, blk_get_request_alignment(blk));
 }
 int blk_get_max_iov(BlockBackend *blk)
 -- 
 2.27.0
--- a/kvm-block-nvme-Fix-VFIO_MAP_DMA-failed-No-space-left-on-.patch
+++ b/kvm-block-nvme-Fix-VFIO_MAP_DMA-failed-No-space-left-on-.patch
@ -1,106 +0,0 @@
 From 1d85424fe5208986fc07fe9baa1e9b33d77b185a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:35 -0400
 Subject: [PATCH 20/39] block/nvme: Fix VFIO_MAP_DMA failed: No space left on
 device
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [12/15] f4b3456e4ce1a876a64f9fb92c56f8f981076953 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 When the NVMe block driver was introduced (see commit bdd6a90a9e5,
 January 2018), Linux VFIO_IOMMU_MAP_DMA ioctl was only returning
 -ENOMEM in case of error. The driver was correctly handling the
 error path to recycle its volatile IOVA mappings.
 To fix CVE-2019-3882, Linux commit 492855939bdb ("vfio/type1: Limit
 DMA mappings per container", April 2019) added the -ENOSPC error to
 signal the user exhausted the DMA mappings available for a container.
 The block driver started to mis-behave:
  qemu-system-x86_64: VFIO_MAP_DMA failed: No space left on device
  (qemu)
  (qemu) info status
  VM status: paused (io-error)
  (qemu) c
  VFIO_MAP_DMA failed: No space left on device
  (qemu) c
  VFIO_MAP_DMA failed: No space left on device
 (The VM is not resumable from here, hence stuck.)
 Fix by handling the new -ENOSPC error (when DMA mappings are
 exhausted) without any distinction to the current -ENOMEM error,
 so we don't change the behavior on old kernels where the CVE-2019-3882
 fix is not present.
 An easy way to reproduce this bug is to restrict the DMA mapping
 limit (65535 by default) when loading the VFIO IOMMU module:
  # modprobe vfio_iommu_type1 dma_entry_limit=666
 Cc: qemu-stable@nongnu.org
 Cc: Fam Zheng <fam@euphon.net>
 Cc: Maxim Levitsky <mlevitsk@redhat.com>
 Cc: Alex Williamson <alex.williamson@redhat.com>
 Reported-by: Michal PrÃvoznÃk <mprivozn@redhat.com>
 Signed-off-by: Philippe Mathieu-DaudÃ© <philmd@redhat.com>
 Message-id: 20210723195843.1032825-1-philmd@redhat.com
 Fixes: bdd6a90a9e5 ("block: Add VFIO based NVMe driver")
 Buglink: https://bugs.launchpad.net/qemu/+bug/1863333
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/65
 Signed-off-by: Philippe Mathieu-DaudÃ© <philmd@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit 15a730e7a3aaac180df72cd5730e0617bcf44a5a)
 Signed-off-by: Philippe Mathieu-DaudÃ© <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/nvme.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 diff --git a/block/nvme.c b/block/nvme.c
 index 2b5421e7aa..e8dbbc2317 100644
 --- a/block/nvme.c
 +++ b/block/nvme.c
@@ -1030,7 +1030,29 @@ try_map:
         r = qemu_vfio_dma_map(s->vfio,
                               qiov->iov[i].iov_base,
                               len, true, &iova);
 +        if (r == -ENOSPC) {
 +            /*
 +             * In addition to the -ENOMEM error, the VFIO_IOMMU_MAP_DMA
 +             * ioctl returns -ENOSPC to signal the user exhausted the DMA
 +             * mappings available for a container since Linux kernel commit
 +             * 492855939bdb ("vfio/type1: Limit DMA mappings per container",
 +             * April 2019, see CVE-2019-3882).
 +             *
 +             * This block driver already handles this error path by checking
 +             * for the -ENOMEM error, so we directly replace -ENOSPC by
 +             * -ENOMEM. Beside, -ENOSPC has a specific meaning for blockdev
 +             * coroutines: it triggers BLOCKDEV_ON_ERROR_ENOSPC and
 +             * BLOCK_ERROR_ACTION_STOP which stops the VM, asking the operator
 +             * to add more storage to the blockdev. Not something we can do
 +             * easily with an IOMMU :)
 +             */
 +            r = -ENOMEM;
 +        }
         if (r == -ENOMEM && retry) {
 +            /*
 +             * We exhausted the DMA mappings available for our container:
 +             * recycle the volatile IOVA mappings.
 +             */
             retry = false;
             trace_nvme_dma_flush_queue_wait(s);
             if (s->dma_map_count) {
 -- 
 2.27.0
--- a/kvm-configure-Fix-endianess-test-with-LTO.patch
+++ b/kvm-configure-Fix-endianess-test-with-LTO.patch
@ -1,82 +0,0 @@
 From 40e5138fb1e615c927a21d0b3f2e24eca885ede4 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Thu, 15 Jul 2021 10:39:28 +0200
 Subject: [PATCH 36/39] configure: Fix endianess test with LTO
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [9/11] c4be415076356fe74efab6f74d7b347064bbdb40 (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 If a user is trying to compile QEMU with link-time optimization
 enabled by running the configure script like this:
 .../configure --extra-cflags="-flto"
 then the endianess test is failing since the magic values do not
 show up in the intermediate object files there. If the host is
 a big endian machine (like s390x), the QEMU binary is then unusable
 since the corresponding variable "bigendian" is pre-initialized
 with "no".
 To fix this issue, we should rather create a full binary and look
 for the magic strings there instead.
 And we really should not continue the build if the endianess check
 failed, to make it clear right from the start that something went
 wrong here, thus let's also add some "exit 1" statements here
 after emitting the error message.
 Message-Id: <20210715083928.933806-1-thuth@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 659eb157a55666bf379f5362238a86d855e262e2)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 configure | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)
 diff --git a/configure b/configure
 index 83d8af7fe4..dcd9520bed 100755
 --- a/configure
 +++ b/configure
@@ -2323,24 +2323,27 @@ feature_not_found() {
 # ---
 # big/little endian test
 cat > $TMPC << EOF
 +#include <stdio.h>
 short big_endian[] = { 0x4269, 0x4765, 0x4e64, 0x4961, 0x4e00, 0, };
 short little_endian[] = { 0x694c, 0x7454, 0x654c, 0x6e45, 0x6944, 0x6e41, 0, };
 -extern int foo(short *, short *);
 -int main(int argc, char *argv[]) {
 -    return foo(big_endian, little_endian);
 +int main(int argc, char *argv[])
 +{
 +    return printf("%s %s\n", (char *)big_endian, (char *)little_endian);
 }
 EOF
 -if compile_object ; then
 -    if strings -a $TMPO | grep -q BiGeNdIaN ; then
 +if compile_prog ; then
 +    if strings -a $TMPE | grep -q BiGeNdIaN ; then
         bigendian="yes"
 -    elif strings -a $TMPO | grep -q LiTtLeEnDiAn ; then
 +    elif strings -a $TMPE | grep -q LiTtLeEnDiAn ; then
         bigendian="no"
     else
         echo big/little test failed
 +        exit 1
     fi
 else
     echo big/little test failed
 +    exit 1
 fi
 ##########################################
 -- 
 2.27.0
--- a/kvm-disable-CONFIG_USB_STORAGE_BOT.patch
+++ b/kvm-disable-CONFIG_USB_STORAGE_BOT.patch
@ -1,49 +0,0 @@
 From 64ec0505fccf6f277430f3be1829a9e44cd00dbb Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 18 Jun 2021 12:04:24 -0400
 Subject: [PATCH 07/12] disable CONFIG_USB_STORAGE_BOT
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [5/8] 73d3ee0a17590c8cddf6bd812e6a758951c36ea4 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 default-configs/devices/ppc64-rh-devices.mak  | 1 -
 default-configs/devices/x86_64-rh-devices.mak | 1 -
 2 files changed, 2 deletions(-)
 diff --git a/default-configs/devices/ppc64-rh-devices.mak b/default-configs/devices/ppc64-rh-devices.mak
 index 5b01b7fac0..3ec5603ace 100644
 --- a/default-configs/devices/ppc64-rh-devices.mak
 +++ b/default-configs/devices/ppc64-rh-devices.mak
@@ -15,7 +15,6 @@ CONFIG_USB=y
 CONFIG_USB_OHCI=y
 CONFIG_USB_OHCI_PCI=y
 CONFIG_USB_SMARTCARD=y
 -CONFIG_USB_STORAGE_BOT=y
 CONFIG_USB_STORAGE_CORE=y
 CONFIG_USB_STORAGE_CLASSIC=y
 CONFIG_USB_XHCI=y
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 index d09c138fc6..81bda09f4c 100644
 --- a/default-configs/devices/x86_64-rh-devices.mak
 +++ b/default-configs/devices/x86_64-rh-devices.mak
@@ -74,7 +74,6 @@ CONFIG_USB=y
 CONFIG_USB_EHCI=y
 CONFIG_USB_EHCI_PCI=y
 CONFIG_USB_SMARTCARD=y
 -CONFIG_USB_STORAGE_BOT=y
 CONFIG_USB_STORAGE_CORE=y
 CONFIG_USB_STORAGE_CLASSIC=y
 CONFIG_USB_UHCI=y
 -- 
 2.27.0
--- a/kvm-disable-ac97-audio.patch
+++ b/kvm-disable-ac97-audio.patch
@ -1,37 +0,0 @@
 From e2bb4b752d68856c4c307640ae310f47f680aed6 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 20 Aug 2021 10:21:07 +0200
 Subject: [PATCH 2/4] disable ac97 audio
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: disable ac97 audio
 RH-Commit: [1/1] 5d1bd969d20f960cb0a023f0d6cd1ae5adda22e6 (kraxel/centos-qemu-kvm)
 RH-Bugzilla: 1995819
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Bugzilla: 1995819
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 default-configs/devices/x86_64-rh-devices.mak | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/default-configs/devices/x86_64-rh-devices.mak b/default-configs/devices/x86_64-rh-devices.mak
 index c2dd112f81..8ae2747bf6 100644
 --- a/default-configs/devices/x86_64-rh-devices.mak
 +++ b/default-configs/devices/x86_64-rh-devices.mak
@@ -1,6 +1,5 @@
 include rh-virtio.mak
 -CONFIG_AC97=y
 CONFIG_ACPI=y
 CONFIG_ACPI_PCI=y
 CONFIG_ACPI_CPU_HOTPLUG=y
 -- 
 2.27.0
--- a/kvm-doc-Fix-some-mistakes-in-the-SEV-documentation.patch
+++ b/kvm-doc-Fix-some-mistakes-in-the-SEV-documentation.patch
@ -1,151 +0,0 @@
 From 17c1559139d6a58794944901f84dd4e8cd1f5335 Mon Sep 17 00:00:00 2001
 From: Connor Kuehl <ckuehl@redhat.com>
 Date: Tue, 22 Jun 2021 20:00:20 -0400
 Subject: [PATCH 08/12] doc: Fix some mistakes in the SEV documentation
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [6/8] ce828f81de1320a1833241700cb13dfdcf7d82e7 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 From: Tom Lendacky <thomas.lendacky@amd.com>
 Fix some spelling and grammar mistakes in the amd-memory-encryption.txt
 file. No new information added.
 Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
 Message-Id: <a7c5ee6c056d840f46028f4a817c16a9862bdd9e.1619208498.git.thomas.lendacky@amd.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit f538adeccf4554e6402fe661a0a51bcc8d6bd227)
 Signed-off-by: Connor Kuehl <ckuehl@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/amd-memory-encryption.txt | 59 +++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 30 deletions(-)
 diff --git a/docs/amd-memory-encryption.txt b/docs/amd-memory-encryption.txt
 index 145896aec7..ed85159ea7 100644
 --- a/docs/amd-memory-encryption.txt
 +++ b/docs/amd-memory-encryption.txt
@@ -1,38 +1,38 @@
 Secure Encrypted Virtualization (SEV) is a feature found on AMD processors.
 SEV is an extension to the AMD-V architecture which supports running encrypted
 -virtual machine (VMs) under the control of KVM. Encrypted VMs have their pages
 +virtual machines (VMs) under the control of KVM. Encrypted VMs have their pages
 (code and data) secured such that only the guest itself has access to the
 unencrypted version. Each encrypted VM is associated with a unique encryption
 -key; if its data is accessed to a different entity using a different key the
 +key; if its data is accessed by a different entity using a different key the
 encrypted guests data will be incorrectly decrypted, leading to unintelligible
 data.
 -The key management of this feature is handled by separate processor known as
 -AMD secure processor (AMD-SP) which is present in AMD SOCs. Firmware running
 -inside the AMD-SP provide commands to support common VM lifecycle. This
 +Key management for this feature is handled by a separate processor known as the
 +AMD secure processor (AMD-SP), which is present in AMD SOCs. Firmware running
 +inside the AMD-SP provides commands to support a common VM lifecycle. This
 includes commands for launching, snapshotting, migrating and debugging the
 -encrypted guest. Those SEV command can be issued via KVM_MEMORY_ENCRYPT_OP
 +encrypted guest. These SEV commands can be issued via KVM_MEMORY_ENCRYPT_OP
 ioctls.
 Launching
 ---------
 -Boot images (such as bios) must be encrypted before guest can be booted.
 -MEMORY_ENCRYPT_OP ioctl provides commands to encrypt the images :LAUNCH_START,
 +Boot images (such as bios) must be encrypted before a guest can be booted. The
 +MEMORY_ENCRYPT_OP ioctl provides commands to encrypt the images: LAUNCH_START,
 LAUNCH_UPDATE_DATA, LAUNCH_MEASURE and LAUNCH_FINISH. These four commands
 together generate a fresh memory encryption key for the VM, encrypt the boot
 -images and provide a measurement than can be used as an attestation of the
 +images and provide a measurement than can be used as an attestation of a
 successful launch.
 LAUNCH_START is called first to create a cryptographic launch context within
 -the firmware. To create this context, guest owner must provides guest policy,
 +the firmware. To create this context, guest owner must provide a guest policy,
 its public Diffie-Hellman key (PDH) and session parameters. These inputs
 -should be treated as binary blob and must be passed as-is to the SEV firmware.
 +should be treated as a binary blob and must be passed as-is to the SEV firmware.
 -The guest policy is passed as plaintext and hypervisor may able to read it
 +The guest policy is passed as plaintext. A hypervisor may choose to read it,
 but should not modify it (any modification of the policy bits will result
 in bad measurement). The guest policy is a 4-byte data structure containing
 -several flags that restricts what can be done on running SEV guest.
 +several flags that restricts what can be done on a running SEV guest.
 See KM Spec section 3 and 6.2 for more details.
 The guest policy can be provided via the 'policy' property (see below)
@@ -40,31 +40,30 @@ The guest policy can be provided via the 'policy' property (see below)
 # ${QEMU} \
    sev-guest,id=sev0,policy=0x1...\
 -Guest owners provided DH certificate and session parameters will be used to
 +The guest owner provided DH certificate and session parameters will be used to
 establish a cryptographic session with the guest owner to negotiate keys used
 for the attestation.
 -The DH certificate and session blob can be provided via 'dh-cert-file' and
 -'session-file' property (see below
 +The DH certificate and session blob can be provided via the 'dh-cert-file' and
 +'session-file' properties (see below)
 # ${QEMU} \
      sev-guest,id=sev0,dh-cert-file=<file1>,session-file=<file2>
 LAUNCH_UPDATE_DATA encrypts the memory region using the cryptographic context
 -created via LAUNCH_START command. If required, this command can be called
 +created via the LAUNCH_START command. If required, this command can be called
 multiple times to encrypt different memory regions. The command also calculates
 the measurement of the memory contents as it encrypts.
 -LAUNCH_MEASURE command can be used to retrieve the measurement of encrypted
 -memory. This measurement is a signature of the memory contents that can be
 -sent to the guest owner as an attestation that the memory was encrypted
 -correctly by the firmware. The guest owner may wait to provide the guest
 -confidential information until it can verify the attestation measurement.
 -Since the guest owner knows the initial contents of the guest at boot, the
 -attestation measurement can be verified by comparing it to what the guest owner
 -expects.
 +LAUNCH_MEASURE can be used to retrieve the measurement of encrypted memory.
 +This measurement is a signature of the memory contents that can be sent to the
 +guest owner as an attestation that the memory was encrypted correctly by the
 +firmware. The guest owner may wait to provide the guest confidential information
 +until it can verify the attestation measurement. Since the guest owner knows the
 +initial contents of the guest at boot, the attestation measurement can be
 +verified by comparing it to what the guest owner expects.
 -LAUNCH_FINISH command finalizes the guest launch and destroy's the cryptographic
 +LAUNCH_FINISH finalizes the guest launch and destroys the cryptographic
 context.
 See SEV KM API Spec [1] 'Launching a guest' usage flow (Appendix A) for the
@@ -78,10 +77,10 @@ To launch a SEV guest
 Debugging
 -----------
 -Since memory contents of SEV guest is encrypted hence hypervisor access to the
 -guest memory will get a cipher text. If guest policy allows debugging, then
 -hypervisor can use DEBUG_DECRYPT and DEBUG_ENCRYPT commands access the guest
 -memory region for debug purposes.  This is not supported in QEMU yet.
 +Since the memory contents of a SEV guest are encrypted, hypervisor access to
 +the guest memory will return cipher text. If the guest policy allows debugging,
 +then a hypervisor can use the DEBUG_DECRYPT and DEBUG_ENCRYPT commands to access
 +the guest memory region for debug purposes.  This is not supported in QEMU yet.
 Snapshot/Restore
 -----------------
 -- 
 2.27.0
--- a/kvm-docs-Add-SEV-ES-documentation-to-amd-memory-encrypti.patch
+++ b/kvm-docs-Add-SEV-ES-documentation-to-amd-memory-encrypti.patch
@ -1,141 +0,0 @@
 From 1bd5660666d2a1f704ebabeed8a2bbfa02410f41 Mon Sep 17 00:00:00 2001
 From: Connor Kuehl <ckuehl@redhat.com>
 Date: Tue, 22 Jun 2021 20:00:21 -0400
 Subject: [PATCH 09/12] docs: Add SEV-ES documentation to
 amd-memory-encryption.txt
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [7/8] 36e49577484813866132b90c64cf99779326db74 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 From: Tom Lendacky <thomas.lendacky@amd.com>
 Update the amd-memory-encryption.txt file with information about SEV-ES,
 including how to launch an SEV-ES guest and some of the differences
 between SEV and SEV-ES guests in regards to launching and measuring the
 guest.
 Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
 Acked-by: Laszlo Ersek <lersek@redhat.com>
 Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
 Message-Id: <fa1825a5eb0290eac4712cde75ba4c6829946eac.1619208498.git.thomas.lendacky@amd.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit 61b7d7098cd53dd386939610d534f8bd79240881)
 Signed-off-by: Connor Kuehl <ckuehl@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/amd-memory-encryption.txt | 54 +++++++++++++++++++++++++++++-----
 1 file changed, 47 insertions(+), 7 deletions(-)
 diff --git a/docs/amd-memory-encryption.txt b/docs/amd-memory-encryption.txt
 index ed85159ea7..ffca382b5f 100644
 --- a/docs/amd-memory-encryption.txt
 +++ b/docs/amd-memory-encryption.txt
@@ -15,6 +15,13 @@ includes commands for launching, snapshotting, migrating and debugging the
 encrypted guest. These SEV commands can be issued via KVM_MEMORY_ENCRYPT_OP
 ioctls.
 +Secure Encrypted Virtualization - Encrypted State (SEV-ES) builds on the SEV
 +support to additionally protect the guest register state. In order to allow a
 +hypervisor to perform functions on behalf of a guest, there is architectural
 +support for notifying a guest's operating system when certain types of VMEXITs
 +are about to occur. This allows the guest to selectively share information with
 +the hypervisor to satisfy the requested function.
 +
 Launching
 ---------
 Boot images (such as bios) must be encrypted before a guest can be booted. The
@@ -24,6 +31,9 @@ together generate a fresh memory encryption key for the VM, encrypt the boot
 images and provide a measurement than can be used as an attestation of a
 successful launch.
 +For a SEV-ES guest, the LAUNCH_UPDATE_VMSA command is also used to encrypt the
 +guest register state, or VM save area (VMSA), for all of the guest vCPUs.
 +
 LAUNCH_START is called first to create a cryptographic launch context within
 the firmware. To create this context, guest owner must provide a guest policy,
 its public Diffie-Hellman key (PDH) and session parameters. These inputs
@@ -40,6 +50,12 @@ The guest policy can be provided via the 'policy' property (see below)
 # ${QEMU} \
    sev-guest,id=sev0,policy=0x1...\
 +Setting the "SEV-ES required" policy bit (bit 2) will launch the guest as a
 +SEV-ES guest (see below)
 +
 +# ${QEMU} \
 +   sev-guest,id=sev0,policy=0x5...\
 +
 The guest owner provided DH certificate and session parameters will be used to
 establish a cryptographic session with the guest owner to negotiate keys used
 for the attestation.
@@ -55,13 +71,19 @@ created via the LAUNCH_START command. If required, this command can be called
 multiple times to encrypt different memory regions. The command also calculates
 the measurement of the memory contents as it encrypts.
 -LAUNCH_MEASURE can be used to retrieve the measurement of encrypted memory.
 -This measurement is a signature of the memory contents that can be sent to the
 -guest owner as an attestation that the memory was encrypted correctly by the
 -firmware. The guest owner may wait to provide the guest confidential information
 -until it can verify the attestation measurement. Since the guest owner knows the
 -initial contents of the guest at boot, the attestation measurement can be
 -verified by comparing it to what the guest owner expects.
 +LAUNCH_UPDATE_VMSA encrypts all the vCPU VMSAs for a SEV-ES guest using the
 +cryptographic context created via the LAUNCH_START command. The command also
 +calculates the measurement of the VMSAs as it encrypts them.
 +
 +LAUNCH_MEASURE can be used to retrieve the measurement of encrypted memory and,
 +for a SEV-ES guest, encrypted VMSAs. This measurement is a signature of the
 +memory contents and, for a SEV-ES guest, the VMSA contents, that can be sent
 +to the guest owner as an attestation that the memory and VMSAs were encrypted
 +correctly by the firmware. The guest owner may wait to provide the guest
 +confidential information until it can verify the attestation measurement.
 +Since the guest owner knows the initial contents of the guest at boot, the
 +attestation measurement can be verified by comparing it to what the guest owner
 +expects.
 LAUNCH_FINISH finalizes the guest launch and destroys the cryptographic
 context.
@@ -75,6 +97,22 @@ To launch a SEV guest
     -machine ...,confidential-guest-support=sev0 \
     -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1
 +To launch a SEV-ES guest
 +
 +# ${QEMU} \
 +    -machine ...,confidential-guest-support=sev0 \
 +    -object sev-guest,id=sev0,cbitpos=47,reduced-phys-bits=1,policy=0x5
 +
 +An SEV-ES guest has some restrictions as compared to a SEV guest. Because the
 +guest register state is encrypted and cannot be updated by the VMM/hypervisor,
 +a SEV-ES guest:
 + - Does not support SMM - SMM support requires updating the guest register
 +   state.
 + - Does not support reboot - a system reset requires updating the guest register
 +   state.
 + - Requires in-kernel irqchip - the burden is placed on the hypervisor to
 +   manage booting APs.
 +
 Debugging
 -----------
 Since the memory contents of a SEV guest are encrypted, hypervisor access to
@@ -101,8 +139,10 @@ Secure Encrypted Virtualization Key Management:
 KVM Forum slides:
 http://www.linux-kvm.org/images/7/74/02x08A-Thomas_Lendacky-AMDs_Virtualizatoin_Memory_Encryption_Technology.pdf
 +https://www.linux-kvm.org/images/9/94/Extending-Secure-Encrypted-Virtualization-with-SEV-ES-Thomas-Lendacky-AMD.pdf
 AMD64 Architecture Programmer's Manual:
    http://support.amd.com/TechDocs/24593.pdf
    SME is section 7.10
    SEV is section 15.34
 +   SEV-ES is section 15.35
 -- 
 2.27.0
--- a/kvm-docs-interop-firmware.json-Add-SEV-ES-support.patch
+++ b/kvm-docs-interop-firmware.json-Add-SEV-ES-support.patch
@ -1,110 +0,0 @@
 From e408203bab17e32f8d42ae9ad61e94a73bfaec67 Mon Sep 17 00:00:00 2001
 From: Connor Kuehl <ckuehl@redhat.com>
 Date: Tue, 22 Jun 2021 20:00:22 -0400
 Subject: [PATCH 10/12] docs/interop/firmware.json: Add SEV-ES support
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [8/8] b49ebbaf40b56d95c67475a0373d6906a3e4f0e3 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 From: Tom Lendacky <thomas.lendacky@amd.com>
 Create an enum definition, '@amd-sev-es', for SEV-ES and add documention
 for the new enum. Add an example that shows some of the requirements for
 SEV-ES, including not having SMM support and the requirement for an
 X64-only build.
 Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
 Message-Id: <b941a7ee105dfeb67607cf2d24dafcb82658b212.1619208498.git.thomas.lendacky@amd.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit d44df1d73ce04d7f4b8f94cba5f715e2dadc998b)
 Signed-off-by: Connor Kuehl <ckuehl@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/interop/firmware.json | 47 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)
 diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
 index 9d94ccafa9..8d8b0be030 100644
 --- a/docs/interop/firmware.json
 +++ b/docs/interop/firmware.json
@@ -115,6 +115,12 @@
 #           this feature are documented in
 #           "docs/amd-memory-encryption.txt".
 #
 +# @amd-sev-es: The firmware supports running under AMD Secure Encrypted
 +#              Virtualization - Encrypted State, as specified in the AMD64
 +#              Architecture Programmer's Manual. QEMU command line options
 +#              related to this feature are documented in
 +#              "docs/amd-memory-encryption.txt".
 +#
 # @enrolled-keys: The variable store (NVRAM) template associated with
 #                 the firmware binary has the UEFI Secure Boot
 #                 operational mode turned on, with certificates
@@ -179,7 +185,7 @@
 # Since: 3.0
 ##
 { 'enum' : 'FirmwareFeature',
 -  'data' : [ 'acpi-s3', 'acpi-s4', 'amd-sev', 'enrolled-keys',
 +  'data' : [ 'acpi-s3', 'acpi-s4', 'amd-sev', 'amd-sev-es', 'enrolled-keys',
              'requires-smm', 'secure-boot', 'verbose-dynamic',
              'verbose-static' ] }
@@ -504,6 +510,45 @@
 # }
 #
 # {
 +#     "description": "OVMF with SEV-ES support",
 +#     "interface-types": [
 +#         "uefi"
 +#     ],
 +#     "mapping": {
 +#         "device": "flash",
 +#         "executable": {
 +#             "filename": "/usr/share/OVMF/OVMF_CODE.fd",
 +#             "format": "raw"
 +#         },
 +#         "nvram-template": {
 +#             "filename": "/usr/share/OVMF/OVMF_VARS.fd",
 +#             "format": "raw"
 +#         }
 +#     },
 +#     "targets": [
 +#         {
 +#             "architecture": "x86_64",
 +#             "machines": [
 +#                 "pc-q35-*"
 +#             ]
 +#         }
 +#     ],
 +#     "features": [
 +#         "acpi-s3",
 +#         "amd-sev",
 +#         "amd-sev-es",
 +#         "verbose-dynamic"
 +#     ],
 +#     "tags": [
 +#         "-a X64",
 +#         "-p OvmfPkg/OvmfPkgX64.dsc",
 +#         "-t GCC48",
 +#         "-b DEBUG",
 +#         "-D FD_SIZE_4MB"
 +#     ]
 +# }
 +#
 +# {
 #     "description": "UEFI firmware for ARM64 virtual machines",
 #     "interface-types": [
 #         "uefi"
 -- 
 2.27.0
--- a/kvm-file-posix-fix-max_iov-for-dev-sg-devices.patch
+++ b/kvm-file-posix-fix-max_iov-for-dev-sg-devices.patch
@ -1,50 +0,0 @@
 From 0111d01afe82c46656a40269bf21eb7702c02a09 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:29 -0400
 Subject: [PATCH 13/43] file-posix: fix max_iov for /dev/sg devices
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 Even though it was only called for devices that have bs->sg set (which
 must be character devices), sg_get_max_segments looked at /sys/dev/block
 which only works for block devices.
 On Linux the sg driver has its own way to provide the maximum number of
 iovecs in a scatter/gather list, so add support for it.  The block device
 path is kept because it will be reinstated in the next patches.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 8ad5ab6148dca8aad297c134c09c84b0b92d45ed)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/file-posix.c | 11 +++++++++++
 1 file changed, 11 insertions(+)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 20e14f8e96..74d4903dc1 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1204,6 +1204,17 @@ static int sg_get_max_segments(int fd)
         goto out;
     }
 +    if (S_ISCHR(st.st_mode)) {
 +        if (ioctl(fd, SG_GET_SG_TABLESIZE, &ret) == 0) {
 +            return ret;
 +        }
 +        return -ENOTSUP;
 +    }
 +
 +    if (!S_ISBLK(st.st_mode)) {
 +        return -ENOTSUP;
 +    }
 +
     sysfspath = g_strdup_printf("/sys/dev/block/%u:%u/queue/max_segments",
                                 major(st.st_rdev), minor(st.st_rdev));
     sysfd = open(sysfspath, O_RDONLY);
 -- 
 2.27.0
--- a/kvm-file-posix-try-BLKSECTGET-on-block-devices-too-do-no.patch
+++ b/kvm-file-posix-try-BLKSECTGET-on-block-devices-too-do-no.patch
@ -1,140 +0,0 @@
 From 9c8493d3a6d2e4d879d1ef67ff1abebd532c87a0 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:34 -0400
 Subject: [PATCH 18/43] file-posix: try BLKSECTGET on block devices too, do not
 round to power of 2
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 bs->sg is only true for character devices, but block devices can also
 be used with scsi-block and scsi-generic.  Unfortunately BLKSECTGET
 returns bytes in an int for /dev/sgN devices, and sectors in a short
 for block devices, so account for that in the code.
 The maximum transfer also need not be a power of 2 (for example I have
 seen disks with 1280 KiB maximum transfer) so there's no need to pass
 the result through pow2floor.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 18473467d55a20d643b6c9b3a52de42f705b4d35)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/file-posix.c | 57 +++++++++++++++++++++++++++-------------------
 1 file changed, 33 insertions(+), 24 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 44325a635d..7b4ebf65d5 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1173,22 +1173,27 @@ static void raw_reopen_abort(BDRVReopenState *state)
     s->reopen_state = NULL;
 }
 -static int sg_get_max_transfer_length(int fd)
 +static int hdev_get_max_hw_transfer(int fd, struct stat *st)
 {
 #ifdef BLKSECTGET
 -    int max_bytes = 0;
 -
 -    if (ioctl(fd, BLKSECTGET, &max_bytes) == 0) {
 -        return max_bytes;
 +    if (S_ISBLK(st->st_mode)) {
 +        unsigned short max_sectors = 0;
 +        if (ioctl(fd, BLKSECTGET, &max_sectors) == 0) {
 +            return max_sectors * 512;
 +        }
     } else {
 -        return -errno;
 +        int max_bytes = 0;
 +        if (ioctl(fd, BLKSECTGET, &max_bytes) == 0) {
 +            return max_bytes;
 +        }
     }
 +    return -errno;
 #else
     return -ENOSYS;
 #endif
 }
 -static int sg_get_max_segments(int fd)
 +static int hdev_get_max_segments(int fd, struct stat *st)
 {
 #ifdef CONFIG_LINUX
     char buf[32];
@@ -1197,26 +1202,20 @@ static int sg_get_max_segments(int fd)
     int ret;
     int sysfd = -1;
     long max_segments;
 -    struct stat st;
 -
 -    if (fstat(fd, &st)) {
 -        ret = -errno;
 -        goto out;
 -    }
 -    if (S_ISCHR(st.st_mode)) {
 +    if (S_ISCHR(st->st_mode)) {
         if (ioctl(fd, SG_GET_SG_TABLESIZE, &ret) == 0) {
             return ret;
         }
         return -ENOTSUP;
     }
 -    if (!S_ISBLK(st.st_mode)) {
 +    if (!S_ISBLK(st->st_mode)) {
         return -ENOTSUP;
     }
     sysfspath = g_strdup_printf("/sys/dev/block/%u:%u/queue/max_segments",
 -                                major(st.st_rdev), minor(st.st_rdev));
 +                                major(st->st_rdev), minor(st->st_rdev));
     sysfd = open(sysfspath, O_RDONLY);
     if (sysfd == -1) {
         ret = -errno;
@@ -1253,23 +1252,33 @@ out:
 static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
 {
     BDRVRawState *s = bs->opaque;
 +    struct stat st;
 -    if (bs->sg) {
 -        int ret = sg_get_max_transfer_length(s->fd);
 +    raw_probe_alignment(bs, s->fd, errp);
 +    bs->bl.min_mem_alignment = s->buf_align;
 +    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
 +
 +    /*
 +     * Maximum transfers are best effort, so it is okay to ignore any
 +     * errors.  That said, based on the man page errors in fstat would be
 +     * very much unexpected; the only possible case seems to be ENOMEM.
 +     */
 +    if (fstat(s->fd, &st)) {
 +        return;
 +    }
 +
 +    if (bs->sg || S_ISBLK(st.st_mode)) {
 +        int ret = hdev_get_max_hw_transfer(s->fd, &st);
         if (ret > 0 && ret <= BDRV_REQUEST_MAX_BYTES) {
 -            bs->bl.max_hw_transfer = pow2floor(ret);
 +            bs->bl.max_hw_transfer = ret;
         }
 -        ret = sg_get_max_segments(s->fd);
 +        ret = hdev_get_max_segments(s->fd, &st);
         if (ret > 0) {
             bs->bl.max_iov = ret;
         }
     }
 -
 -    raw_probe_alignment(bs, s->fd, errp);
 -    bs->bl.min_mem_alignment = s->buf_align;
 -    bs->bl.opt_mem_alignment = MAX(s->buf_align, qemu_real_host_page_size);
 }
 static int check_for_dasd(int fd)
 -- 
 2.27.0
--- a/kvm-hmp-Fix-loadvm-to-resume-the-VM-on-success-instead-o.patch
+++ b/kvm-hmp-Fix-loadvm-to-resume-the-VM-on-success-instead-o.patch
@ -1,51 +0,0 @@
 From 3347d61ff783d05f41f03097551460dc5825b301 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:14 -0400
 Subject: [PATCH 11/39] hmp: Fix loadvm to resume the VM on success instead of
 failure
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [3/15] 492cfb8ef252805b988a256abe73628605f630e9 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Commit f61fe11aa6f broke hmp_loadvm() by adding an incorrect negation
 when converting from 0/-errno return values to a bool value. The result
 is that loadvm resumes the VM now if it failed and keeps it stopped if
 it failed. Fix it to restore the old behaviour and do it the other way
 around.
 Fixes: f61fe11aa6f7f8f0ffe4ddaa56a8108f3ab57854
 Cc: qemu-stable@nongnu.org
 Reported-by: Yanhui Ma <yama@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210511163151.45167-1-kwolf@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit c53cd04e70641fdf9410aac40c617d074047b3e1)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 monitor/hmp-cmds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 0ad5b77477..cc15d9b6ee 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -1133,7 +1133,7 @@ void hmp_loadvm(Monitor *mon, const QDict *qdict)
     vm_stop(RUN_STATE_RESTORE_VM);
 -    if (!load_snapshot(name, NULL, false, NULL, &err) && saved_vm_running) {
 +    if (load_snapshot(name, NULL, false, NULL, &err) && saved_vm_running) {
         vm_start();
     }
     hmp_handle_error(mon, err);
 -- 
 2.27.0
--- a/kvm-hw-arm-smmuv3-Another-range-invalidation-fix.patch
+++ b/kvm-hw-arm-smmuv3-Another-range-invalidation-fix.patch
@ -1,111 +0,0 @@
 From e9abef24fae799febf81cd4ac02efe8987a698e8 Mon Sep 17 00:00:00 2001
 From: Auger Eric <eric.auger@redhat.com>
 Date: Wed, 26 May 2021 16:07:40 -0400
 Subject: [PATCH 15/15] hw/arm/smmuv3: Another range invalidation fix
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 5: Synchronize RHEL-AV 8.5 release 18 to RHEL 9 Beta
 RH-Commit: [12/12] dc064684e5f3f11d955565b05d37b0f2d9f79b91 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 6d9cd115b9 ("hw/arm/smmuv3: Enforce invalidation on a power of two range")
 failed to completely fix misalignment issues with range
 invalidation. For instance invalidations patterns like "invalidate 32
 4kB pages starting from 0xff395000 are not correctly handled" due
 to the fact the previous fix only made sure the number of invalidated
 pages were a power of 2 but did not properly handle the start
 address was not aligned with the range. This can be noticed when
 boothing a fedora 33 with protected virtio-blk-pci.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Fixes: 6d9cd115b9 ("hw/arm/smmuv3: Enforce invalidation on a power of two range")
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit 219729cfbf9e979020bffedac6a790144173ec62)
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/smmuv3.c | 50 +++++++++++++++++++++++++------------------------
 1 file changed, 26 insertions(+), 24 deletions(-)
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index 8705612535..e1979282e4 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -856,43 +856,45 @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
 static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 {
 -    uint8_t scale = 0, num = 0, ttl = 0;
 -    dma_addr_t addr = CMD_ADDR(cmd);
 +    dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
     uint16_t vmid = CMD_VMID(cmd);
 +    uint8_t scale = CMD_SCALE(cmd);
 +    uint8_t num = CMD_NUM(cmd);
 +    uint8_t ttl = CMD_TTL(cmd);
     bool leaf = CMD_LEAF(cmd);
     uint8_t tg = CMD_TG(cmd);
 -    uint64_t first_page = 0, last_page;
 -    uint64_t num_pages = 1;
 +    uint64_t num_pages;
 +    uint8_t granule;
     int asid = -1;
 -    if (tg) {
 -        scale = CMD_SCALE(cmd);
 -        num = CMD_NUM(cmd);
 -        ttl = CMD_TTL(cmd);
 -        num_pages = (num + 1) * BIT_ULL(scale);
 -    }
 -
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
     }
 -    /* Split invalidations into ^2 range invalidations */
 -    last_page = num_pages - 1;
 -    while (num_pages) {
 -        uint8_t granule = tg * 2 + 10;
 -        uint64_t mask, count;
 +    if (!tg) {
 +        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
 +        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
 +        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
 +        return;
 +    }
 +
 +    /* RIL in use */
 -        mask = dma_aligned_pow2_mask(first_page, last_page, 64 - granule);
 -        count = mask + 1;
 +    num_pages = (num + 1) * BIT_ULL(scale);
 +    granule = tg * 2 + 10;
 +
 +    /* Split invalidations into ^2 range invalidations */
 +    end = addr + (num_pages << granule) - 1;
 -        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, count, ttl, leaf);
 -        smmuv3_inv_notifiers_iova(s, asid, addr, tg, count);
 -        smmu_iotlb_inv_iova(s, asid, addr, tg, count, ttl);
 +    while (addr != end + 1) {
 +        uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 -        num_pages -= count;
 -        first_page += count;
 -        addr += count * BIT_ULL(granule);
 +        num_pages = (mask + 1) >> granule;
 +        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
 +        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 +        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
 +        addr += mask + 1;
     }
 }
 -- 
 2.27.0
--- a/kvm-hw-arm-virt-Add-8.5-and-9.0-machine-types-and-remove.patch
+++ b/kvm-hw-arm-virt-Add-8.5-and-9.0-machine-types-and-remove.patch
@ -1,63 +0,0 @@
 From ee0be09f3598596e41b3fc2dbefef3382c5b0541 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 25 May 2021 09:22:24 +0200
 Subject: [PATCH 02/15] hw/arm/virt: Add 8.5 and 9.0 machine types and remove
 older ones
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 1: Add 9.0.0 and 8.5.0 arm-virt machine types
 RH-Commit: [2/2] ace4619a1d505a3b552a236260b259bd6ddabc00 (eauger1/centos-qemu-kvm)
 RH-Bugzilla: 1952449
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Add 8.5 and 9.0 machine types and remove older ones.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 24 +++++-------------------
 1 file changed, 5 insertions(+), 19 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 51a415570c..e4aa794f83 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3095,28 +3095,14 @@ static void rhel_machine_init(void)
 }
 type_init(rhel_machine_init);
 -static void rhel840_virt_options(MachineClass *mc)
 +static void rhel900_virt_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 }
 -DEFINE_RHEL_MACHINE_AS_LATEST(8, 4, 0)
 +DEFINE_RHEL_MACHINE_AS_LATEST(9, 0, 0)
 -static void rhel830_virt_options(MachineClass *mc)
 +static void rhel850_virt_options(MachineClass *mc)
 {
 -    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 -
 -    rhel840_virt_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 -    vmc->no_kvm_steal_time = true;
 -}
 -DEFINE_RHEL_MACHINE(8, 3, 0)
 -
 -static void rhel820_virt_options(MachineClass *mc)
 -{
 -    rhel830_virt_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 -    mc->numa_mem_supported = true;
 -    mc->auto_enable_numa_with_memdev = false;
 +    rhel900_virt_options(mc);
 }
 -DEFINE_RHEL_MACHINE(8, 2, 0)
 +DEFINE_RHEL_MACHINE(8, 5, 0)
 -- 
 2.27.0
--- a/kvm-hw-arm-virt-Disable-PL011-clock-migration-through-hw.patch
+++ b/kvm-hw-arm-virt-Disable-PL011-clock-migration-through-hw.patch
@ -1,51 +0,0 @@
 From 7f76c347f17c5fc60f3bcb99ad65e26f9da4ed9f Mon Sep 17 00:00:00 2001
 From: Auger Eric <eric.auger@redhat.com>
 Date: Thu, 20 May 2021 19:23:26 -0400
 Subject: [PATCH 10/15] hw/arm/virt: Disable PL011 clock migration through
 hw_compat_rhel_8_3
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 5: Synchronize RHEL-AV 8.5 release 18 to RHEL 9 Beta
 RH-Commit: [6/12] 5f52975350b2497ee82cc5c9b8ba930e3a9b8c3d (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 Disable PL011 clock migration for machine types before
 virt-rhel8.4.0.
 The regression was introduced by aac63e0e6ea3
 ("hw/char/pl011: add a clock input"), in 8.4,
 causing failure of migration between qemu 8.4 towards
 older ones.
 The fix was taken in 8.5 as part of the rebase,
 e6fa978d8343 ("hw/arm/virt: Disable pl011 clock migration
 if needed"). But the compat needs to be applied in
 hw_compat_rhel_8_3[].
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index c665e869de..6c534e14fa 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -69,6 +69,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
     { "nvme", "use-intel-id", "on"},
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
     /* hw_compat_rhel_8_3 bz 1912846 */
     { "pci-xhci", "x-rh-late-msi-cap", "off" },
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 -- 
 2.27.0
--- a/kvm-hw-s390x-Remove-the-RHEL7-only-machine-type.patch
+++ b/kvm-hw-s390x-Remove-the-RHEL7-only-machine-type.patch
@ -1,67 +0,0 @@
 From 64a9a5c971c424ff2d8074f52d48dd6233dc97ac Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 18 May 2021 18:27:54 +0200
 Subject: [PATCH] hw/s390x: Remove the RHEL7-only machine type
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 7: hw/s390x: Remove the RHEL7-only machine type
 RH-Commit: [1/1] 8c53d4ae81 (thuth/qemu-kvm)
 RH-Bugzilla: 1944730
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 We only support live migration from RHEL8 in RHEL9, so we can remove
 the RHEL7 machine type "s390-ccw-virtio-rhel7.5.0".
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 32 --------------------------------
 1 file changed, 32 deletions(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 8df6dd1c71..432f36bce5 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1125,38 +1125,6 @@ static void ccw_machine_rhel760_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 -static void ccw_machine_rhel750_instance_options(MachineState *machine)
 -{
 -    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
 -    ccw_machine_rhel760_instance_options(machine);
 -
 -    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
 -       based on 2.10 */
 -    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
 -
 -    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
 -    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
 -    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
 -}
 -
 -GlobalProperty ccw_compat_rhel_7_5[] = {
 -        {
 -            .driver   = TYPE_SCLP_EVENT_FACILITY,
 -            .property = "allow_all_mask_sizes",
 -            .value    = "off",
 -        },
 -};
 -const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 -
 -static void ccw_machine_rhel750_class_options(MachineClass *mc)
 -{
 -    ccw_machine_rhel760_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 -    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
 -    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 -}
 -DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
 -
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
 -- 
 2.27.0
--- a/kvm-i386-Add-ratelimit-for-bus-locks-acquired-in-guest.patch
+++ b/kvm-i386-Add-ratelimit-for-bus-locks-acquired-in-guest.patch
@ -1,219 +0,0 @@
 From e92a6c64cb4b1437c5b75f25a638dbb6eb041383 Mon Sep 17 00:00:00 2001
 From: "plai@redhat.com" <plai@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:27 -0400
 Subject: [PATCH 16/39] i386: Add ratelimit for bus locks acquired in guest
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [8/15] 2b8f01e05e44388c2f90d5281a9fe5537ab2433d (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 A bus lock is acquired through either split locked access to writeback
 (WB) memory or any locked access to non-WB memory. It is typically >1000
 cycles slower than an atomic operation within a cache and can also
 disrupts performance on other cores.
 Virtual Machines can exploit bus locks to degrade the performance of
 system. To address this kind of performance DOS attack coming from the
 VMs, bus lock VM exit is introduced in KVM and it can report the bus
 locks detected in guest. If enabled in KVM, it would exit to the
 userspace to let the user enforce throttling policies once bus locks
 acquired in VMs.
 The availability of bus lock VM exit can be detected through the
 KVM_CAP_X86_BUS_LOCK_EXIT. The returned bitmap contains the potential
 policies supported by KVM. The field KVM_BUS_LOCK_DETECTION_EXIT in
 bitmap is the only supported strategy at present. It indicates that KVM
 will exit to userspace to handle the bus locks.
 This patch adds a ratelimit on the bus locks acquired in guest as a
 mitigation policy.
 Introduce a new field "bus_lock_ratelimit" to record the limited speed
 of bus locks in the target VM. The user can specify it through the
 "bus-lock-ratelimit" as a machine property. In current implementation,
 the default value of the speed is 0 per second, which means no
 restrictions on the bus locks.
 As for ratelimit on detected bus locks, simply set the ratelimit
 interval to 1s and restrict the quota of bus lock occurence to the value
 of "bus_lock_ratelimit". A potential alternative is to introduce the
 time slice as a property which can help the user achieve more precise
 control.
 The detail of bus lock VM exit can be found in spec:
 https://software.intel.com/content/www/us/en/develop/download/intel-architecture-instruction-set-extensions-programming-reference.html
 Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
 Message-Id: <20210521043820.29678-1-chenyi.qiang@intel.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit 035d1ef26565f8f8eae058c37f5731a9ae304b96)
 Signed-off-by: Paul Lai <plai@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/x86.c         | 24 ++++++++++++++++++++++++
 include/hw/i386/x86.h |  8 ++++++++
 target/i386/kvm/kvm.c | 41 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+)
 diff --git a/hw/i386/x86.c b/hw/i386/x86.c
 index ed796fe6ba..d30cf27e29 100644
 --- a/hw/i386/x86.c
 +++ b/hw/i386/x86.c
@@ -1246,6 +1246,23 @@ static void x86_machine_set_oem_table_id(Object *obj, const char *value,
     strncpy(x86ms->oem_table_id, value, 8);
 }
 +static void x86_machine_get_bus_lock_ratelimit(Object *obj, Visitor *v,
 +                                const char *name, void *opaque, Error **errp)
 +{
 +    X86MachineState *x86ms = X86_MACHINE(obj);
 +    uint64_t bus_lock_ratelimit = x86ms->bus_lock_ratelimit;
 +
 +    visit_type_uint64(v, name, &bus_lock_ratelimit, errp);
 +}
 +
 +static void x86_machine_set_bus_lock_ratelimit(Object *obj, Visitor *v,
 +                               const char *name, void *opaque, Error **errp)
 +{
 +    X86MachineState *x86ms = X86_MACHINE(obj);
 +
 +    visit_type_uint64(v, name, &x86ms->bus_lock_ratelimit, errp);
 +}
 +
 static void x86_machine_initfn(Object *obj)
 {
     X86MachineState *x86ms = X86_MACHINE(obj);
@@ -1256,6 +1273,7 @@ static void x86_machine_initfn(Object *obj)
     x86ms->pci_irq_mask = ACPI_BUILD_PCI_IRQS;
     x86ms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
     x86ms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +    x86ms->bus_lock_ratelimit = 0;
 }
 static void x86_machine_class_init(ObjectClass *oc, void *data)
@@ -1299,6 +1317,12 @@ static void x86_machine_class_init(ObjectClass *oc, void *data)
                                           "Override the default value of field OEM Table ID "
                                           "in ACPI table header."
                                           "The string may be up to 8 bytes in size");
 +
 +    object_class_property_add(oc, X86_MACHINE_BUS_LOCK_RATELIMIT, "uint64_t",
 +                                x86_machine_get_bus_lock_ratelimit,
 +                                x86_machine_set_bus_lock_ratelimit, NULL, NULL);
 +    object_class_property_set_description(oc, X86_MACHINE_BUS_LOCK_RATELIMIT,
 +            "Set the ratelimit for the bus locks acquired in VMs");
 }
 static const TypeInfo x86_machine_info = {
 diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
 index c09b648dff..25a1f16f01 100644
 --- a/include/hw/i386/x86.h
 +++ b/include/hw/i386/x86.h
@@ -74,12 +74,20 @@ struct X86MachineState {
      * will be translated to MSI messages in the address space.
      */
     AddressSpace *ioapic_as;
 +
 +    /*
 +     * Ratelimit enforced on detected bus locks in guest.
 +     * The default value of the bus_lock_ratelimit is 0 per second,
 +     * which means no limitation on the guest's bus locks.
 +     */
 +    uint64_t bus_lock_ratelimit;
 };
 #define X86_MACHINE_SMM              "smm"
 #define X86_MACHINE_ACPI             "acpi"
 #define X86_MACHINE_OEM_ID           "x-oem-id"
 #define X86_MACHINE_OEM_TABLE_ID     "x-oem-table-id"
 +#define X86_MACHINE_BUS_LOCK_RATELIMIT  "bus-lock-ratelimit"
 #define TYPE_X86_MACHINE   MACHINE_TYPE_NAME("x86")
 OBJECT_DECLARE_TYPE(X86MachineState, X86MachineClass, X86_MACHINE)
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
 index 4c69c2cb4b..af030af116 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
@@ -130,6 +130,9 @@ static bool has_msr_mcg_ext_ctl;
 static struct kvm_cpuid2 *cpuid_cache;
 static struct kvm_msr_list *kvm_feature_msrs;
 +#define BUS_LOCK_SLICE_TIME 1000000000ULL /* ns */
 +static RateLimit bus_lock_ratelimit_ctrl;
 +
 int kvm_has_pit_state2(void)
 {
     return has_pit_state2;
@@ -2267,6 +2270,28 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
         }
     }
 +    if (object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)) {
 +        X86MachineState *x86ms = X86_MACHINE(ms);
 +
 +        if (x86ms->bus_lock_ratelimit > 0) {
 +            ret = kvm_check_extension(s, KVM_CAP_X86_BUS_LOCK_EXIT);
 +            if (!(ret & KVM_BUS_LOCK_DETECTION_EXIT)) {
 +                error_report("kvm: bus lock detection unsupported");
 +                return -ENOTSUP;
 +            }
 +            ret = kvm_vm_enable_cap(s, KVM_CAP_X86_BUS_LOCK_EXIT, 0,
 +                                    KVM_BUS_LOCK_DETECTION_EXIT);
 +            if (ret < 0) {
 +                error_report("kvm: Failed to enable bus lock detection cap: %s",
 +                             strerror(-ret));
 +                return ret;
 +            }
 +            ratelimit_init(&bus_lock_ratelimit_ctrl);
 +            ratelimit_set_speed(&bus_lock_ratelimit_ctrl,
 +                                x86ms->bus_lock_ratelimit, BUS_LOCK_SLICE_TIME);
 +        }
 +    }
 +
     return 0;
 }
@@ -4225,6 +4250,15 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     }
 }
 +static void kvm_rate_limit_on_bus_lock(void)
 +{
 +    uint64_t delay_ns = ratelimit_calculate_delay(&bus_lock_ratelimit_ctrl, 1);
 +
 +    if (delay_ns) {
 +        g_usleep(delay_ns / SCALE_US);
 +    }
 +}
 +
 MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
@@ -4240,6 +4274,9 @@ MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
     } else {
         env->eflags &= ~IF_MASK;
     }
 +    if (run->flags & KVM_RUN_X86_BUS_LOCK) {
 +        kvm_rate_limit_on_bus_lock();
 +    }
     /* We need to protect the apic state against concurrent accesses from
      * different threads in case the userspace irqchip is used. */
@@ -4598,6 +4635,10 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
         ioapic_eoi_broadcast(run->eoi.vector);
         ret = 0;
         break;
 +    case KVM_EXIT_X86_BUS_LOCK:
 +        /* already handled in kvm_arch_post_run */
 +        ret = 0;
 +        break;
     default:
         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
         ret = -1;
 -- 
 2.27.0
--- a/kvm-i386-cpu-Expose-AVX_VNNI-instruction-to-guest.patch
+++ b/kvm-i386-cpu-Expose-AVX_VNNI-instruction-to-guest.patch
@ -1,82 +0,0 @@
 From c24fcdf0712ef81ec25ca3a4a1144cca18303fbe Mon Sep 17 00:00:00 2001
 From: "plai@redhat.com" <plai@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:19 -0400
 Subject: [PATCH 13/39] i386/cpu: Expose AVX_VNNI instruction to guest
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [5/15] 56381e35a1dc06af7d457d1fe61b1c108dd25d06 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Expose AVX (VEX-encoded) versions of the Vector Neural Network
 Instructions to guest.
 The bit definition:
 CPUID.(EAX=7,ECX=1):EAX[bit 4] AVX_VNNI
 The following instructions are available when this feature is
 present in the guest.
  1. VPDPBUS: Multiply and Add Unsigned and Signed Bytes
  2. VPDPBUSDS: Multiply and Add Unsigned and Signed Bytes with Saturation
  3. VPDPWSSD: Multiply and Add Signed Word Integers
  4. VPDPWSSDS: Multiply and Add Signed Integers with Saturation
 As for the kvm related code, please reference Linux commit id 1085a6b585d7.
 The release document ref below link:
 https://software.intel.com/content/www/us/en/develop/download/\
 intel-architecture-instruction-set-extensions-programming-reference.html
 Signed-off-by: Yang Zhong <yang.zhong@intel.com>
 Message-Id: <20210407015609.22936-1-yang.zhong@intel.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit c1826ea6a052084f2e6a0bae9dd5932a727df039)
 Signed-off-by: Paul Lai <plai@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 target/i386/cpu.c | 4 ++--
 target/i386/cpu.h | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index da47c3e50e..0de2932c79 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -996,7 +996,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
             NULL, NULL, NULL, NULL,
 -            NULL, "avx512-bf16", NULL, NULL,
 +            "avx-vnni", "avx512-bf16", NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
@@ -3284,7 +3284,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
             MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO,
         .features[FEAT_7_1_EAX] =
 -            CPUID_7_1_EAX_AVX512_BF16,
 +            CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16,
         /* XSAVES is added in version 2 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
 index 570f916878..edc8984448 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
@@ -804,6 +804,8 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 /* Speculative Store Bypass Disable */
 #define CPUID_7_0_EDX_SPEC_CTRL_SSBD    (1U << 31)
 +/* AVX VNNI Instruction */
 +#define CPUID_7_1_EAX_AVX_VNNI          (1U << 4)
 /* AVX512 BFloat16 Instruction */
 #define CPUID_7_1_EAX_AVX512_BF16       (1U << 5)
 -- 
 2.27.0
--- a/kvm-iotests-Improve-and-rename-test-291-to-qemu-img-bitm.patch
+++ b/kvm-iotests-Improve-and-rename-test-291-to-qemu-img-bitm.patch
@ -1,178 +0,0 @@
 From a6ab9f3d290c2ff3c2fc0187c69cf8cf69feff40 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 6 Aug 2021 15:07:47 -0400
 Subject: [PATCH 24/39] iotests: Improve and rename test 291 to qemu-img-bitmap
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 35: Synchronize with RHEL-AV 8.5 release 28 to RHEL 9
 RH-Commit: [1/4] bf400ceb9ef48b81c5f7cade97bc1cbf7bc4842c (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Enhance the test to demonstrate existing less-than-stellar behavior of
 qemu-img with a qcow2 image containing an inconsistent bitmap: we
 don't diagnose the problem until after copying the entire image (a
 potentially long time), and when we do diagnose the failure, we still
 end up leaving an empty bitmap in the destination.  This mess will be
 cleaned up in the next patch.
 While at it, rename the test now that we support useful iotest names,
 and fix a missing newline in the error message thus exposed.
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210709153951.2801666-2-eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Nir Soffer <nsoffer@redhat.com>
 (cherry picked from commit 94075c28eea0755173939dfaf1eae688b224a74e)
 Conflicts:
 	tests/qemu-iotests/tests/qemu-img-bitmaps.out - commit 8417e1378c not backported
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/dirty-bitmap.c                          |  2 +-
 .../{291 => tests/qemu-img-bitmaps}           | 21 +++++++-
 .../{291.out => tests/qemu-img-bitmaps.out}   | 49 ++++++++++++++++++-
 3 files changed, 69 insertions(+), 3 deletions(-)
 rename tests/qemu-iotests/{291 => tests/qemu-img-bitmaps} (87%)
 rename tests/qemu-iotests/{291.out => tests/qemu-img-bitmaps.out} (75%)
 diff --git a/block/dirty-bitmap.c b/block/dirty-bitmap.c
 index 68d295d6e3..0ef46163e3 100644
 --- a/block/dirty-bitmap.c
 +++ b/block/dirty-bitmap.c
@@ -193,7 +193,7 @@ int bdrv_dirty_bitmap_check(const BdrvDirtyBitmap *bitmap, uint32_t flags,
         error_setg(errp, "Bitmap '%s' is inconsistent and cannot be used",
                    bitmap->name);
         error_append_hint(errp, "Try block-dirty-bitmap-remove to delete"
 -                          " this bitmap from disk");
 +                          " this bitmap from disk\n");
         return -1;
     }
 diff --git a/tests/qemu-iotests/291 b/tests/qemu-iotests/tests/qemu-img-bitmaps
 similarity index 87%
 rename from tests/qemu-iotests/291
 rename to tests/qemu-iotests/tests/qemu-img-bitmaps
 index 20efb080a6..409c4497a3 100755
 --- a/tests/qemu-iotests/291
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps
@@ -3,7 +3,7 @@
 #
 # Test qemu-img bitmap handling
 #
 -# Copyright (C) 2018-2020 Red Hat, Inc.
 +# Copyright (C) 2018-2021 Red Hat, Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -27,11 +27,13 @@ status=1 # failure is the default!
 _cleanup()
 {
     _cleanup_test_img
 +    _rm_test_img "$TEST_IMG.copy"
     nbd_server_stop
 }
 trap "_cleanup; exit \$status" 0 1 2 3 15
 # get standard environment, filters and checks
 +cd ..
 . ./common.rc
 . ./common.filter
 . ./common.nbd
@@ -129,6 +131,23 @@ $QEMU_IMG map --output=json --image-opts \
 nbd_server_stop
 +echo
 +echo "=== Check handling of inconsistent bitmap ==="
 +echo
 +
 +# Prepare image with corrupted bitmap
 +$QEMU_IO -c abort "$TEST_IMG" 2>/dev/null
 +$QEMU_IMG bitmap --add "$TEST_IMG" b4
 +$QEMU_IMG bitmap --remove "$TEST_IMG" b1
 +_img_info --format-specific | _filter_irrelevant_img_info
 +echo
 +$QEMU_IMG convert --bitmaps -O qcow2 "$TEST_IMG" "$TEST_IMG.copy" &&
 +    echo "unexpected success"
 +# Bug - even though we failed at conversion, we left a file around with
 +# a bitmap marked as not corrupt
 +TEST_IMG=$TEST_IMG.copy _img_info --format-specific \
 +    | _filter_irrelevant_img_info
 +
 # success, all done
 echo '*** done'
 rm -f $seq.full
 diff --git a/tests/qemu-iotests/291.out b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
 similarity index 75%
 rename from tests/qemu-iotests/291.out
 rename to tests/qemu-iotests/tests/qemu-img-bitmaps.out
 index 23411c0ff4..543b028da6 100644
 --- a/tests/qemu-iotests/291.out
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
@@ -1,4 +1,4 @@
 -QA output created by 291
 +QA output created by qemu-img-bitmaps
 === Initial image setup ===
@@ -115,4 +115,51 @@ Format specific information:
 [{ "start": 0, "length": 2097152, "depth": 0, "zero": false, "data": true, "offset": OFFSET},
 { "start": 2097152, "length": 1048576, "depth": 0, "zero": false, "data": false},
 { "start": 3145728, "length": 7340032, "depth": 0, "zero": false, "data": true, "offset": OFFSET}]
 +
 +=== Check handling of inconsistent bitmap ===
 +
 +image: TEST_DIR/t.IMGFMT
 +file format: IMGFMT
 +virtual size: 10 MiB (10485760 bytes)
 +cluster_size: 65536
 +backing file: TEST_DIR/t.IMGFMT.base
 +backing file format: IMGFMT
 +Format specific information:
 +    bitmaps:
 +        [0]:
 +            flags:
 +                [0]: in-use
 +                [1]: auto
 +            name: b2
 +            granularity: 65536
 +        [1]:
 +            flags:
 +                [0]: in-use
 +            name: b0
 +            granularity: 65536
 +        [2]:
 +            flags:
 +                [0]: auto
 +            name: b4
 +            granularity: 65536
 +    corrupt: false
 +
 +qemu-img: Failed to populate bitmap b0: Bitmap 'b0' is inconsistent and cannot be used
 +Try block-dirty-bitmap-remove to delete this bitmap from disk
 +image: TEST_DIR/t.IMGFMT.copy
 +file format: IMGFMT
 +virtual size: 10 MiB (10485760 bytes)
 +cluster_size: 65536
 +Format specific information:
 +    bitmaps:
 +        [0]:
 +            flags:
 +            name: b0
 +            granularity: 65536
 +        [1]:
 +            flags:
 +                [0]: auto
 +            name: b4
 +            granularity: 65536
 +    corrupt: false
 *** done
 -- 
 2.27.0
--- a/kvm-iothread-add-aio-max-batch-parameter.patch
+++ b/kvm-iothread-add-aio-max-batch-parameter.patch
@ -1,324 +0,0 @@
 From d8682ef60e3a658d776473fee2299015dd5105d7 Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:31 -0400
 Subject: [PATCH 18/39] iothread: add aio-max-batch parameter
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [10/15] d033b3c8ddd71bae799103832039d6daa6dfad52 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 The `aio-max-batch` parameter will be propagated to AIO engines
 and it will be used to control the maximum number of queued requests.
 When there are in queue a number of requests equal to `aio-max-batch`,
 the engine invokes the system call to forward the requests to the kernel.
 This parameter allows us to control the maximum batch size to reduce
 the latency that requests might accumulate while queued in the AIO
 engine queue.
 If `aio-max-batch` is equal to 0 (default value), the AIO engine will
 use its default maximum batch size value.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Message-id: 20210721094211.69853-3-sgarzare@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit 1793ad0247cad35db1ebbc04fbea0446c30a27ca)
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 include/block/aio.h       | 12 +++++++++
 include/sysemu/iothread.h |  3 +++
 iothread.c                | 55 +++++++++++++++++++++++++++++++++++----
 monitor/hmp-cmds.c        |  2 ++
 qapi/misc.json            |  6 ++++-
 qapi/qom.json             |  7 ++++-
 qemu-options.hx           |  8 ++++--
 util/aio-posix.c          | 12 +++++++++
 util/aio-win32.c          |  5 ++++
 util/async.c              |  2 ++
 10 files changed, 103 insertions(+), 9 deletions(-)
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 5f342267d5..ea68a139c8 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -232,6 +232,9 @@ struct AioContext {
     int64_t poll_grow;      /* polling time growth factor */
     int64_t poll_shrink;    /* polling time shrink factor */
 +    /* AIO engine parameters */
 +    int64_t aio_max_batch;  /* maximum number of requests in a batch */
 +
     /*
      * List of handlers participating in userspace polling.  Protected by
      * ctx->list_lock.  Iterated and modified mostly by the event loop thread
@@ -727,4 +730,13 @@ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink,
                                  Error **errp);
 +/**
 + * aio_context_set_aio_params:
 + * @ctx: the aio context
 + * @max_batch: maximum number of requests in a batch, 0 means that the
 + *             engine will use its default
 + */
 +void aio_context_set_aio_params(AioContext *ctx, int64_t max_batch,
 +                                Error **errp);
 +
 #endif
 diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
 index f177142f16..7f714bd136 100644
 --- a/include/sysemu/iothread.h
 +++ b/include/sysemu/iothread.h
@@ -37,6 +37,9 @@ struct IOThread {
     int64_t poll_max_ns;
     int64_t poll_grow;
     int64_t poll_shrink;
 +
 +    /* AioContext AIO engine parameters */
 +    int64_t aio_max_batch;
 };
 typedef struct IOThread IOThread;
 diff --git a/iothread.c b/iothread.c
 index a12de6e455..272be5e146 100644
 --- a/iothread.c
 +++ b/iothread.c
@@ -159,6 +159,24 @@ static void iothread_init_gcontext(IOThread *iothread)
     iothread->main_loop = g_main_loop_new(iothread->worker_context, TRUE);
 }
 +static void iothread_set_aio_context_params(IOThread *iothread, Error **errp)
 +{
 +    ERRP_GUARD();
 +
 +    aio_context_set_poll_params(iothread->ctx,
 +                                iothread->poll_max_ns,
 +                                iothread->poll_grow,
 +                                iothread->poll_shrink,
 +                                errp);
 +    if (*errp) {
 +        return;
 +    }
 +
 +    aio_context_set_aio_params(iothread->ctx,
 +                               iothread->aio_max_batch,
 +                               errp);
 +}
 +
 static void iothread_complete(UserCreatable *obj, Error **errp)
 {
     Error *local_error = NULL;
@@ -178,11 +196,7 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
      */
     iothread_init_gcontext(iothread);
 -    aio_context_set_poll_params(iothread->ctx,
 -                                iothread->poll_max_ns,
 -                                iothread->poll_grow,
 -                                iothread->poll_shrink,
 -                                &local_error);
 +    iothread_set_aio_context_params(iothread, &local_error);
     if (local_error) {
         error_propagate(errp, local_error);
         aio_context_unref(iothread->ctx);
@@ -219,6 +233,9 @@ static PollParamInfo poll_grow_info = {
 static PollParamInfo poll_shrink_info = {
     "poll-shrink", offsetof(IOThread, poll_shrink),
 };
 +static PollParamInfo aio_max_batch_info = {
 +    "aio-max-batch", offsetof(IOThread, aio_max_batch),
 +};
 static void iothread_get_param(Object *obj, Visitor *v,
         const char *name, void *opaque, Error **errp)
@@ -278,6 +295,29 @@ static void iothread_set_poll_param(Object *obj, Visitor *v,
     }
 }
 +static void iothread_get_aio_param(Object *obj, Visitor *v,
 +        const char *name, void *opaque, Error **errp)
 +{
 +
 +    iothread_get_param(obj, v, name, opaque, errp);
 +}
 +
 +static void iothread_set_aio_param(Object *obj, Visitor *v,
 +        const char *name, void *opaque, Error **errp)
 +{
 +    IOThread *iothread = IOTHREAD(obj);
 +
 +    if (!iothread_set_param(obj, v, name, opaque, errp)) {
 +        return;
 +    }
 +
 +    if (iothread->ctx) {
 +        aio_context_set_aio_params(iothread->ctx,
 +                                   iothread->aio_max_batch,
 +                                   errp);
 +    }
 +}
 +
 static void iothread_class_init(ObjectClass *klass, void *class_data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
@@ -295,6 +335,10 @@ static void iothread_class_init(ObjectClass *klass, void *class_data)
                               iothread_get_poll_param,
                               iothread_set_poll_param,
                               NULL, &poll_shrink_info);
 +    object_class_property_add(klass, "aio-max-batch", "int",
 +                              iothread_get_aio_param,
 +                              iothread_set_aio_param,
 +                              NULL, &aio_max_batch_info);
 }
 static const TypeInfo iothread_info = {
@@ -344,6 +388,7 @@ static int query_one_iothread(Object *object, void *opaque)
     info->poll_max_ns = iothread->poll_max_ns;
     info->poll_grow = iothread->poll_grow;
     info->poll_shrink = iothread->poll_shrink;
 +    info->aio_max_batch = iothread->aio_max_batch;
     QAPI_LIST_APPEND(*tail, info);
     return 0;
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index cc15d9b6ee..2905bc1594 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -1889,6 +1889,8 @@ void hmp_info_iothreads(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "  poll-max-ns=%" PRId64 "\n", value->poll_max_ns);
         monitor_printf(mon, "  poll-grow=%" PRId64 "\n", value->poll_grow);
         monitor_printf(mon, "  poll-shrink=%" PRId64 "\n", value->poll_shrink);
 +        monitor_printf(mon, "  aio-max-batch=%" PRId64 "\n",
 +                       value->aio_max_batch);
     }
     qapi_free_IOThreadInfoList(info_list);
 diff --git a/qapi/misc.json b/qapi/misc.json
 index 156f98203e..5c2ca3b556 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
@@ -86,6 +86,9 @@
 # @poll-shrink: how many ns will be removed from polling time, 0 means that
 #               it's not configured (since 2.9)
 #
 +# @aio-max-batch: maximum number of requests in a batch for the AIO engine,
 +#                 0 means that the engine will use its default (since 6.1)
 +#
 # Since: 2.0
 ##
 { 'struct': 'IOThreadInfo',
@@ -93,7 +96,8 @@
            'thread-id': 'int',
            'poll-max-ns': 'int',
            'poll-grow': 'int',
 -           'poll-shrink': 'int' } }
 +           'poll-shrink': 'int',
 +           'aio-max-batch': 'int' } }
 ##
 # @query-iothreads:
 diff --git a/qapi/qom.json b/qapi/qom.json
 index cd0e76d564..f361157903 100644
 --- a/qapi/qom.json
 +++ b/qapi/qom.json
@@ -516,12 +516,17 @@
 #               algorithm detects it is spending too long polling without
 #               encountering events. 0 selects a default behaviour (default: 0)
 #
 +# @aio-max-batch: maximum number of requests in a batch for the AIO engine,
 +#                 0 means that the engine will use its default
 +#                 (default:0, since 6.1)
 +#
 # Since: 2.0
 ##
 { 'struct': 'IothreadProperties',
   'data': { '*poll-max-ns': 'int',
             '*poll-grow': 'int',
 -            '*poll-shrink': 'int' } }
 +            '*poll-shrink': 'int',
 +            '*aio-max-batch': 'int' } }
 ##
 # @MemoryBackendProperties:
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 79ca09feac..d5f1ec27c5 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -5185,7 +5185,7 @@ SRST
             CN=laptop.example.com,O=Example Home,L=London,ST=London,C=GB
 -    ``-object iothread,id=id,poll-max-ns=poll-max-ns,poll-grow=poll-grow,poll-shrink=poll-shrink``
 +    ``-object iothread,id=id,poll-max-ns=poll-max-ns,poll-grow=poll-grow,poll-shrink=poll-shrink,aio-max-batch=aio-max-batch``
         Creates a dedicated event loop thread that devices can be
         assigned to. This is known as an IOThread. By default device
         emulation happens in vCPU threads or the main event loop thread.
@@ -5221,7 +5221,11 @@ SRST
         the polling time when the algorithm detects it is spending too
         long polling without encountering events.
 -        The polling parameters can be modified at run-time using the
 +        The ``aio-max-batch`` parameter is the maximum number of requests
 +        in a batch for the AIO engine, 0 means that the engine will use
 +        its default.
 +
 +        The IOThread parameters can be modified at run-time using the
         ``qom-set`` command (where ``iothread1`` is the IOThread's
         ``id``):
 diff --git a/util/aio-posix.c b/util/aio-posix.c
 index 30f5354b1e..2b86777e91 100644
 --- a/util/aio-posix.c
 +++ b/util/aio-posix.c
@@ -716,3 +716,15 @@ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
     aio_notify(ctx);
 }
 +
 +void aio_context_set_aio_params(AioContext *ctx, int64_t max_batch,
 +                                Error **errp)
 +{
 +    /*
 +     * No thread synchronization here, it doesn't matter if an incorrect value
 +     * is used once.
 +     */
 +    ctx->aio_max_batch = max_batch;
 +
 +    aio_notify(ctx);
 +}
 diff --git a/util/aio-win32.c b/util/aio-win32.c
 index 168717b51b..d5b09a1193 100644
 --- a/util/aio-win32.c
 +++ b/util/aio-win32.c
@@ -440,3 +440,8 @@ void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
         error_setg(errp, "AioContext polling is not implemented on Windows");
     }
 }
 +
 +void aio_context_set_aio_params(AioContext *ctx, int64_t max_batch,
 +                                Error **errp)
 +{
 +}
 diff --git a/util/async.c b/util/async.c
 index 674dbefb7c..6a9588d86b 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -537,6 +537,8 @@ AioContext *aio_context_new(Error **errp)
     ctx->poll_grow = 0;
     ctx->poll_shrink = 0;
 +    ctx->aio_max_batch = 0;
 +
     return ctx;
 fail:
     g_source_destroy(&ctx->source);
 -- 
 2.27.0
--- a/kvm-iothread-generalize-iothread_set_param-iothread_get_.patch
+++ b/kvm-iothread-generalize-iothread_set_param-iothread_get_.patch
@ -1,96 +0,0 @@
 From 6f827f890e68c3b8bda80822edc09369e93da01f Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:29 -0400
 Subject: [PATCH 17/39] iothread: generalize
 iothread_set_param/iothread_get_param
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [9/15] 7c624847cfc636bdfa0d4f35062500a7f9e8437f (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Changes in preparation for next patches where we add a new
 parameter not related to the poll mechanism.
 Let's add two new generic functions (iothread_set_param and
 iothread_get_param) that we use to set and get IOThread
 parameters.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Message-id: 20210721094211.69853-2-sgarzare@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit 0445409d7497bededa1047f0d8298b0d4bb3b1a3)
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 iothread.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)
 diff --git a/iothread.c b/iothread.c
 index 7f086387be..a12de6e455 100644
 --- a/iothread.c
 +++ b/iothread.c
@@ -220,7 +220,7 @@ static PollParamInfo poll_shrink_info = {
     "poll-shrink", offsetof(IOThread, poll_shrink),
 };
 -static void iothread_get_poll_param(Object *obj, Visitor *v,
 +static void iothread_get_param(Object *obj, Visitor *v,
         const char *name, void *opaque, Error **errp)
 {
     IOThread *iothread = IOTHREAD(obj);
@@ -230,7 +230,7 @@ static void iothread_get_poll_param(Object *obj, Visitor *v,
     visit_type_int64(v, name, field, errp);
 }
 -static void iothread_set_poll_param(Object *obj, Visitor *v,
 +static bool iothread_set_param(Object *obj, Visitor *v,
         const char *name, void *opaque, Error **errp)
 {
     IOThread *iothread = IOTHREAD(obj);
@@ -239,17 +239,36 @@ static void iothread_set_poll_param(Object *obj, Visitor *v,
     int64_t value;
     if (!visit_type_int64(v, name, &value, errp)) {
 -        return;
 +        return false;
     }
     if (value < 0) {
         error_setg(errp, "%s value must be in range [0, %" PRId64 "]",
                    info->name, INT64_MAX);
 -        return;
 +        return false;
     }
     *field = value;
 +    return true;
 +}
 +
 +static void iothread_get_poll_param(Object *obj, Visitor *v,
 +        const char *name, void *opaque, Error **errp)
 +{
 +
 +    iothread_get_param(obj, v, name, opaque, errp);
 +}
 +
 +static void iothread_set_poll_param(Object *obj, Visitor *v,
 +        const char *name, void *opaque, Error **errp)
 +{
 +    IOThread *iothread = IOTHREAD(obj);
 +
 +    if (!iothread_set_param(obj, v, name, opaque, errp)) {
 +        return;
 +    }
 +
     if (iothread->ctx) {
         aio_context_set_poll_params(iothread->ctx,
                                     iothread->poll_max_ns,
 -- 
 2.27.0
--- a/kvm-linux-aio-limit-the-batch-size-using-aio-max-batch-p.patch
+++ b/kvm-linux-aio-limit-the-batch-size-using-aio-max-batch-p.patch
@ -1,84 +0,0 @@
 From 6f4cb3e1e5d718356f16645e806d47cb2159ae98 Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:33 -0400
 Subject: [PATCH 19/39] linux-aio: limit the batch size using `aio-max-batch`
 parameter
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [11/15] 44e2f2d294d8ed1d13fb29c5c1599543b86c67e5 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 When there are multiple queues attached to the same AIO context,
 some requests may experience high latency, since in the worst case
 the AIO engine queue is only flushed when it is full (MAX_EVENTS) or
 there are no more queues plugged.
 Commit 2558cb8dd4 ("linux-aio: increasing MAX_EVENTS to a larger
 hardcoded value") changed MAX_EVENTS from 128 to 1024, to increase
 the number of in-flight requests. But this change also increased
 the potential maximum batch to 1024 elements.
 When there is a single queue attached to the AIO context, the issue
 is mitigated from laio_io_unplug() that will flush the queue every
 time is invoked since there can't be others queue plugged.
 Let's use the new `aio-max-batch` IOThread parameter to mitigate
 this issue, limiting the number of requests in a batch.
 We also define a default value (32): this value is obtained running
 some benchmarks and it represents a good tradeoff between the latency
 increase while a request is queued and the cost of the io_submit(2)
 system call.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Message-id: 20210721094211.69853-4-sgarzare@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry picked from commit d7ddd0a1618a75b31dc308bb37365ce1da972154)
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/linux-aio.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/block/linux-aio.c b/block/linux-aio.c
 index 3c0527c2bf..0dab507b71 100644
 --- a/block/linux-aio.c
 +++ b/block/linux-aio.c
@@ -28,6 +28,9 @@
  */
 #define MAX_EVENTS 1024
 +/* Maximum number of requests in a batch. (default value) */
 +#define DEFAULT_MAX_BATCH 32
 +
 struct qemu_laiocb {
     Coroutine *co;
     LinuxAioState *ctx;
@@ -351,6 +354,10 @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
     LinuxAioState *s = laiocb->ctx;
     struct iocb *iocbs = &laiocb->iocb;
     QEMUIOVector *qiov = laiocb->qiov;
 +    int64_t max_batch = s->aio_context->aio_max_batch ?: DEFAULT_MAX_BATCH;
 +
 +    /* limit the batch with the number of available events */
 +    max_batch = MIN_NON_ZERO(MAX_EVENTS - s->io_q.in_flight, max_batch);
     switch (type) {
     case QEMU_AIO_WRITE:
@@ -371,7 +378,7 @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
     s->io_q.in_queue++;
     if (!s->io_q.blocked &&
         (!s->io_q.plugged ||
 -         s->io_q.in_flight + s->io_q.in_queue >= MAX_EVENTS)) {
 +         s->io_q.in_queue >= max_batch)) {
         ioq_submit(s);
     }
 -- 
 2.27.0
--- a/kvm-migration-Allow-reset-of-postcopy_recover_triggered-.patch
+++ b/kvm-migration-Allow-reset-of-postcopy_recover_triggered-.patch
@ -1,66 +0,0 @@
 From 5e1535771bba299aae4de2d810100fa7fedfeca8 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Tue, 29 Jun 2021 14:13:56 -0400
 Subject: [PATCH 02/39] migration: Allow reset of postcopy_recover_triggered
 when failed
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 25: migration: Move yank outside qemu_start_incoming_migration()
 RH-Commit: [2/2] b766a7f36df4f889d74a2e8d518e1100e52ab726 (LeoBras/centos-qemu-kvm)
 RH-Bugzilla: 1974683
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Peter Xu <Peter Xu <peterx@redhat.com>>
 It's possible qemu_start_incoming_migration() failed at any point, when it
 happens we should reset postcopy_recover_triggered to false so that the user
 can still retry with a saner incoming port.
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20210629181356.217312-3-peterx@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit b7f9afd48e7bc5c341e55348f2c2eed08314be7d)
 Fixes: b5eea99e ("migration: Add yank feature", 2021-01-13)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 migration/migration.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 diff --git a/migration/migration.c b/migration/migration.c
 index f077640df2..9d185f0e28 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -2109,6 +2109,13 @@ void qmp_migrate_recover(const char *uri, Error **errp)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 +    /*
 +     * Don't even bother to use ERRP_GUARD() as it _must_ always be set by
 +     * callers (no one should ignore a recover failure); if there is, it's a
 +     * programming error.
 +     */
 +    assert(errp);
 +
     if (mis->state != MIGRATION_STATUS_POSTCOPY_PAUSED) {
         error_setg(errp, "Migrate recover can only be run "
                    "when postcopy is paused.");
@@ -2127,6 +2134,12 @@ void qmp_migrate_recover(const char *uri, Error **errp)
      * to continue using that newly established channel.
      */
     qemu_start_incoming_migration(uri, errp);
 +
 +    /* Safe to dereference with the assert above */
 +    if (*errp) {
 +        /* Reset the flag so user could still retry */
 +        qatomic_set(&mis->postcopy_recover_triggered, false);
 +    }
 }
 void qmp_migrate_pause(Error **errp)
 -- 
 2.27.0
--- a/kvm-migration-Move-bitmap_mutex-out-of-migration_bitmap_.patch
+++ b/kvm-migration-Move-bitmap_mutex-out-of-migration_bitmap_.patch
@ -1,111 +0,0 @@
 From 7726f6461eebf2c4a4b129f1c98add25c0b1bee2 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:16 -0400
 Subject: [PATCH 12/39] migration: Move bitmap_mutex out of
 migration_bitmap_clear_dirty()
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [4/15] cc207372dab253a4db3b6d351fa2fb2f442437ad (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Taking the mutex every time for each dirty bit to clear is too slow, especially
 we'll take/release even if the dirty bit is cleared.  So far it's only used to
 sync with special cases with qemu_guest_free_page_hint() against migration
 thread, nothing really that serious yet.  Let's move the lock to be upper.
 There're two callers of migration_bitmap_clear_dirty().
 For migration, move it into ram_save_iterate().  With the help of MAX_WAIT
 logic, we'll only run ram_save_iterate() for no more than 50ms-ish time, so
 taking the lock once there at the entry.  It also means any call sites to
 qemu_guest_free_page_hint() can be delayed; but it should be very rare, only
 during migration, and I don't see a problem with it.
 For COLO, move it up to colo_flush_ram_cache().  I think COLO forgot to take
 that lock even when calling ramblock_sync_dirty_bitmap(), where another example
 is migration_bitmap_sync() who took it right.  So let the mutex cover both the
 ramblock_sync_dirty_bitmap() and migration_bitmap_clear_dirty() calls.
 It's even possible to drop the lock so we use atomic operations upon rb->bmap
 and the variable migration_dirty_pages.  I didn't do it just to still be safe,
 also not predictable whether the frequent atomic ops could bring overhead too
 e.g. on huge vms when it happens very often.  When that really comes, we can
 keep a local counter and periodically call atomic ops.  Keep it simple for now.
 Cc: Wei Wang <wei.w.wang@intel.com>
 Cc: David Hildenbrand <david@redhat.com>
 Cc: Hailiang Zhang <zhang.zhanghailiang@huawei.com>
 Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Cc: Juan Quintela <quintela@redhat.com>
 Cc: Leonardo Bras Soares Passos <lsoaresp@redhat.com>
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20210630200805.280905-1-peterx@redhat.com>
 Reviewed-by: Wei Wang <wei.w.wang@intel.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 63268c4970a5f126cc9af75f3ccb8057abef5ec0)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 migration/ram.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)
 diff --git a/migration/ram.c b/migration/ram.c
 index 4682f3625c..5d64917dce 100644
 --- a/migration/ram.c
 +++ b/migration/ram.c
@@ -819,8 +819,6 @@ static inline bool migration_bitmap_clear_dirty(RAMState *rs,
 {
     bool ret;
 -    QEMU_LOCK_GUARD(&rs->bitmap_mutex);
 -
     /*
      * Clear dirty bitmap if needed.  This _must_ be called before we
      * send any of the page in the chunk because we need to make sure
@@ -2869,6 +2867,14 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
         goto out;
     }
 +    /*
 +     * We'll take this lock a little bit long, but it's okay for two reasons.
 +     * Firstly, the only possible other thread to take it is who calls
 +     * qemu_guest_free_page_hint(), which should be rare; secondly, see
 +     * MAX_WAIT (if curious, further see commit 4508bd9ed8053ce) below, which
 +     * guarantees that we'll at least released it in a regular basis.
 +     */
 +    qemu_mutex_lock(&rs->bitmap_mutex);
     WITH_RCU_READ_LOCK_GUARD() {
         if (ram_list.version != rs->last_version) {
             ram_state_reset(rs);
@@ -2928,6 +2934,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
             i++;
         }
     }
 +    qemu_mutex_unlock(&rs->bitmap_mutex);
     /*
      * Must occur before EOS (or any QEMUFile operation)
@@ -3710,6 +3717,7 @@ void colo_flush_ram_cache(void)
     unsigned long offset = 0;
     memory_global_dirty_log_sync();
 +    qemu_mutex_lock(&ram_state->bitmap_mutex);
     WITH_RCU_READ_LOCK_GUARD() {
         RAMBLOCK_FOREACH_NOT_IGNORED(block) {
             ramblock_sync_dirty_bitmap(ram_state, block);
@@ -3738,6 +3746,7 @@ void colo_flush_ram_cache(void)
         }
     }
     trace_colo_flush_ram_cache_end();
 +    qemu_mutex_unlock(&ram_state->bitmap_mutex);
 }
 /**
 -- 
 2.27.0
--- a/kvm-migration-Move-yank-outside-qemu_start_incoming_migr.patch
+++ b/kvm-migration-Move-yank-outside-qemu_start_incoming_migr.patch
@ -1,94 +0,0 @@
 From 4c11e06222ca5a88f48f2d47adc3a7da306bb345 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Tue, 29 Jun 2021 14:13:55 -0400
 Subject: [PATCH 01/39] migration: Move yank outside
 qemu_start_incoming_migration()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 25: migration: Move yank outside qemu_start_incoming_migration()
 RH-Commit: [1/2] e5694b0ae9a55f6b147c336e86fce6f4f2163db6 (LeoBras/centos-qemu-kvm)
 RH-Bugzilla: 1974683
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Peter Xu <Peter Xu <peterx@redhat.com>>
 Starting from commit b5eea99ec2f5c, qmp_migrate_recover() calls unregister
 before calling qemu_start_incoming_migration(). I believe it wanted to mitigate
 the next call to yank_register_instance(), but I think that's wrong.
 Firstly, if during recover, we should keep the yank instance there, not
 "quickly removing and adding it back".
 Meanwhile, calling qmp_migrate_recover() twice with b5eea99ec2f5c will directly
 crash the dest qemu (right now it can't; but it'll start to work right after
 the next patch) because the 1st call of qmp_migrate_recover() will unregister
 permanently when the channel failed to establish, then the 2nd call of
 qmp_migrate_recover() crashes at yank_unregister_instance().
 This patch fixes it by moving yank ops out of qemu_start_incoming_migration()
 into qmp_migrate_incoming.  For qmp_migrate_recover(), drop the unregister of
 yank instance too since we keep it there during the recovery phase.
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-Id: <20210629181356.217312-2-peterx@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit cc48c587d25ff5dd7dddb4e5072de9ca8464c832)
 Fixes: b5eea99e ("migration: Add yank feature", 2021-01-13)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 migration/migration.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 4afc6069b6..f077640df2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -454,10 +454,6 @@ static void qemu_start_incoming_migration(const char *uri, Error **errp)
 {
     const char *p = NULL;
 -    if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
 -        return;
 -    }
 -
     qapi_event_send_migration(MIGRATION_STATUS_SETUP);
     if (strstart(uri, "tcp:", &p) ||
         strstart(uri, "unix:", NULL) ||
@@ -472,7 +468,6 @@ static void qemu_start_incoming_migration(const char *uri, Error **errp)
     } else if (strstart(uri, "fd:", &p)) {
         fd_start_incoming_migration(p, errp);
     } else {
 -        yank_unregister_instance(MIGRATION_YANK_INSTANCE);
         error_setg(errp, "unknown migration protocol: %s", uri);
     }
 }
@@ -2095,9 +2090,14 @@ void qmp_migrate_incoming(const char *uri, Error **errp)
         return;
     }
 +    if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
 +        return;
 +    }
 +
     qemu_start_incoming_migration(uri, &local_err);
     if (local_err) {
 +        yank_unregister_instance(MIGRATION_YANK_INSTANCE);
         error_propagate(errp, local_err);
         return;
     }
@@ -2126,7 +2126,6 @@ void qmp_migrate_recover(const char *uri, Error **errp)
      * only re-setup the migration stream and poke existing migration
      * to continue using that newly established channel.
      */
 -    yank_unregister_instance(MIGRATION_YANK_INSTANCE);
     qemu_start_incoming_migration(uri, errp);
 }
 -- 
 2.27.0
--- a/kvm-migration-failover-continue-to-wait-card-unplug-on-e.patch
+++ b/kvm-migration-failover-continue-to-wait-card-unplug-on-e.patch
@ -1,59 +0,0 @@
 From 0f41423f2bb57e77400cfec0683b7514c9798c55 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 4 Aug 2021 07:10:13 -0400
 Subject: [PATCH 22/39] migration: failover: continue to wait card unplug on
 error
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [14/15] e3bfdeee808b2ecd5b141464193b6ee97a4bca3a (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 If the user cancels the migration in the unplug-wait state,
 QEMU will try to plug back the card and this fails because the card
 is partially unplugged.
 To avoid the problem, continue to wait the card unplug, but to
 allow the migration to be canceled if the card never finishes to unplug
 use a timeout.
 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1976852
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-Id: <20210629155007.629086-3-lvivier@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 944bc528421aa848ca218ee535ea923a4147a525)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 migration/migration.c | 11 +++++++++++
 1 file changed, 11 insertions(+)
 diff --git a/migration/migration.c b/migration/migration.c
 index 58df1dac05..fc1d0db04a 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -3696,6 +3696,17 @@ static void qemu_savevm_wait_unplug(MigrationState *s, int old_state,
                qemu_savevm_state_guest_unplug_pending()) {
             qemu_sem_timedwait(&s->wait_unplug_sem, 250);
         }
 +        if (s->state != MIGRATION_STATUS_WAIT_UNPLUG) {
 +            int timeout = 120; /* 30 seconds */
 +            /*
 +             * migration has been canceled
 +             * but as we have started an unplug we must wait the end
 +             * to be able to plug back the card
 +             */
 +            while (timeout-- && qemu_savevm_state_guest_unplug_pending()) {
 +                qemu_sem_timedwait(&s->wait_unplug_sem, 250);
 +            }
 +        }
         migrate_set_state(&s->state, MIGRATION_STATUS_WAIT_UNPLUG, new_state);
     } else {
 -- 
 2.27.0
--- a/kvm-migration-failover-reset-partially_hotplugged.patch
+++ b/kvm-migration-failover-reset-partially_hotplugged.patch
@ -1,44 +0,0 @@
 From 2e07c4c66a1199ef33fb2e89164e03ca2acdcf10 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:12 -0400
 Subject: [PATCH 10/39] migration: failover: reset partially_hotplugged
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [2/15] b01f5640ce93192b2239ad4ef15ff53d977f2341 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 When the card is plugged back, reset the partially_hotplugged flag to false
 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1787194
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Message-Id: <20210629152937.619193-1-lvivier@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 109c20ea28cc0d82fa353e692345b172cb5721cc)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 914051feb7..c2e32fedbf 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3134,6 +3134,7 @@ static bool failover_replug_primary(VirtIONet *n, DeviceState *dev,
         }
         hotplug_handler_plug(hotplug_ctrl, dev, &err);
     }
 +    pdev->partially_hotplugged = false;
 out:
     error_propagate(errp, err);
 -- 
 2.27.0
--- a/kvm-migration-move-wait-unplug-loop-to-its-own-function.patch
+++ b/kvm-migration-move-wait-unplug-loop-to-its-own-function.patch
@ -1,118 +0,0 @@
 From e9848f4a4f45960bff1a2a7bc4a4670670de37a5 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 4 Aug 2021 07:10:12 -0400
 Subject: [PATCH 21/39] migration: move wait-unplug loop to its own function
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [13/15] ab3f26a86e4ea955678323608512e54af2a7c83b (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 The loop is used in migration_thread() and bg_migration_thread(),
 so we can move it to its own function and call it from these both places.
 Moreover, in migration_thread() we have a wrong state transition from
 SETUP to ACTIVE while state could be WAIT_UNPLUG. This is correctly
 managed in bg_migration_thread() so use this code instead.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Message-Id: <20210629155007.629086-2-lvivier@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit fde93d99d9c208c07e2dcc24cd04e824d2b65b35)
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 migration/migration.c | 54 +++++++++++++++++++++----------------------
 1 file changed, 26 insertions(+), 28 deletions(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index 9cf1cde39d..58df1dac05 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -3681,6 +3681,28 @@ bool migration_rate_limit(void)
     return urgent;
 }
 +/*
 + * if failover devices are present, wait they are completely
 + * unplugged
 + */
 +
 +static void qemu_savevm_wait_unplug(MigrationState *s, int old_state,
 +                                    int new_state)
 +{
 +    if (qemu_savevm_state_guest_unplug_pending()) {
 +        migrate_set_state(&s->state, old_state, MIGRATION_STATUS_WAIT_UNPLUG);
 +
 +        while (s->state == MIGRATION_STATUS_WAIT_UNPLUG &&
 +               qemu_savevm_state_guest_unplug_pending()) {
 +            qemu_sem_timedwait(&s->wait_unplug_sem, 250);
 +        }
 +
 +        migrate_set_state(&s->state, MIGRATION_STATUS_WAIT_UNPLUG, new_state);
 +    } else {
 +        migrate_set_state(&s->state, old_state, new_state);
 +    }
 +}
 +
 /*
  * Master migration thread on the source VM.
  * It drives the migration and pumps the data down the outgoing channel.
@@ -3727,22 +3749,10 @@ static void *migration_thread(void *opaque)
     qemu_savevm_state_setup(s->to_dst_file);
 -    if (qemu_savevm_state_guest_unplug_pending()) {
 -        migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
 -                          MIGRATION_STATUS_WAIT_UNPLUG);
 -
 -        while (s->state == MIGRATION_STATUS_WAIT_UNPLUG &&
 -               qemu_savevm_state_guest_unplug_pending()) {
 -            qemu_sem_timedwait(&s->wait_unplug_sem, 250);
 -        }
 -
 -        migrate_set_state(&s->state, MIGRATION_STATUS_WAIT_UNPLUG,
 -                MIGRATION_STATUS_ACTIVE);
 -    }
 +    qemu_savevm_wait_unplug(s, MIGRATION_STATUS_SETUP,
 +                               MIGRATION_STATUS_ACTIVE);
     s->setup_time = qemu_clock_get_ms(QEMU_CLOCK_HOST) - setup_start;
 -    migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
 -                      MIGRATION_STATUS_ACTIVE);
     trace_migration_thread_setup_complete();
@@ -3850,21 +3860,9 @@ static void *bg_migration_thread(void *opaque)
     qemu_savevm_state_header(s->to_dst_file);
     qemu_savevm_state_setup(s->to_dst_file);
 -    if (qemu_savevm_state_guest_unplug_pending()) {
 -        migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
 -                          MIGRATION_STATUS_WAIT_UNPLUG);
 -
 -        while (s->state == MIGRATION_STATUS_WAIT_UNPLUG &&
 -               qemu_savevm_state_guest_unplug_pending()) {
 -            qemu_sem_timedwait(&s->wait_unplug_sem, 250);
 -        }
 +    qemu_savevm_wait_unplug(s, MIGRATION_STATUS_SETUP,
 +                               MIGRATION_STATUS_ACTIVE);
 -        migrate_set_state(&s->state, MIGRATION_STATUS_WAIT_UNPLUG,
 -                          MIGRATION_STATUS_ACTIVE);
 -    } else {
 -        migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
 -                MIGRATION_STATUS_ACTIVE);
 -    }
     s->setup_time = qemu_clock_get_ms(QEMU_CLOCK_HOST) - setup_start;
     trace_migration_thread_setup_complete();
 -- 
 2.27.0
--- a/kvm-nbd-server-Use-drained-block-ops-to-quiesce-the-serv.patch
+++ b/kvm-nbd-server-Use-drained-block-ops-to-quiesce-the-serv.patch
@ -1,191 +0,0 @@
 From 9182af6a819e60a079349fd6d8b28a28adea90b1 Mon Sep 17 00:00:00 2001
 From: Sergio Lopez Pascual <slp@redhat.com>
 Date: Thu, 17 Jun 2021 09:13:21 -0400
 Subject: [PATCH 06/12] nbd/server: Use drained block ops to quiesce the server
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [4/8] ca32c99563254a8a31104948e41fa691453d0399 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Before switching between AioContexts we need to make sure that we're
 fully quiesced ("nb_requests == 0" for every client) when entering the
 drained section.
 To do this, we set "quiescing = true" for every client on
 ".drained_begin" to prevent new coroutines from being created, and
 check if "nb_requests == 0" on ".drained_poll". Finally, once we're
 exiting the drained section, on ".drained_end" we set "quiescing =
 false" and call "nbd_client_receive_next_request()" to resume the
 processing of new requests.
 With these changes, "blk_aio_attach()" and "blk_aio_detach()" can be
 reverted to be as simple as they were before f148ae7d36.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1960137
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Message-Id: <20210602060552.17433-3-slp@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit fd6afc501a019682d1b8468b562355a2887087bd)
 Signed-off-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 nbd/server.c | 82 ++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 61 insertions(+), 21 deletions(-)
 diff --git a/nbd/server.c b/nbd/server.c
 index 86a44a9b41..b60ebc3ab6 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -1513,6 +1513,11 @@ static void nbd_request_put(NBDRequestData *req)
     g_free(req);
     client->nb_requests--;
 +
 +    if (client->quiescing && client->nb_requests == 0) {
 +        aio_wait_kick();
 +    }
 +
     nbd_client_receive_next_request(client);
     nbd_client_put(client);
@@ -1530,49 +1535,68 @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
     QTAILQ_FOREACH(client, &exp->clients, next) {
         qio_channel_attach_aio_context(client->ioc, ctx);
 +        assert(client->nb_requests == 0);
         assert(client->recv_coroutine == NULL);
         assert(client->send_coroutine == NULL);
 -
 -        if (client->quiescing) {
 -            client->quiescing = false;
 -            nbd_client_receive_next_request(client);
 -        }
     }
 }
 -static void nbd_aio_detach_bh(void *opaque)
 +static void blk_aio_detach(void *opaque)
 {
     NBDExport *exp = opaque;
     NBDClient *client;
 +    trace_nbd_blk_aio_detach(exp->name, exp->common.ctx);
 +
     QTAILQ_FOREACH(client, &exp->clients, next) {
         qio_channel_detach_aio_context(client->ioc);
 +    }
 +
 +    exp->common.ctx = NULL;
 +}
 +
 +static void nbd_drained_begin(void *opaque)
 +{
 +    NBDExport *exp = opaque;
 +    NBDClient *client;
 +
 +    QTAILQ_FOREACH(client, &exp->clients, next) {
         client->quiescing = true;
 +    }
 +}
 -        if (client->recv_coroutine) {
 -            if (client->read_yielding) {
 -                qemu_aio_coroutine_enter(exp->common.ctx,
 -                                         client->recv_coroutine);
 -            } else {
 -                AIO_WAIT_WHILE(exp->common.ctx, client->recv_coroutine != NULL);
 -            }
 -        }
 +static void nbd_drained_end(void *opaque)
 +{
 +    NBDExport *exp = opaque;
 +    NBDClient *client;
 -        if (client->send_coroutine) {
 -            AIO_WAIT_WHILE(exp->common.ctx, client->send_coroutine != NULL);
 -        }
 +    QTAILQ_FOREACH(client, &exp->clients, next) {
 +        client->quiescing = false;
 +        nbd_client_receive_next_request(client);
     }
 }
 -static void blk_aio_detach(void *opaque)
 +static bool nbd_drained_poll(void *opaque)
 {
     NBDExport *exp = opaque;
 +    NBDClient *client;
 -    trace_nbd_blk_aio_detach(exp->name, exp->common.ctx);
 +    QTAILQ_FOREACH(client, &exp->clients, next) {
 +        if (client->nb_requests != 0) {
 +            /*
 +             * If there's a coroutine waiting for a request on nbd_read_eof()
 +             * enter it here so we don't depend on the client to wake it up.
 +             */
 +            if (client->recv_coroutine != NULL && client->read_yielding) {
 +                qemu_aio_coroutine_enter(exp->common.ctx,
 +                                         client->recv_coroutine);
 +            }
 -    aio_wait_bh_oneshot(exp->common.ctx, nbd_aio_detach_bh, exp);
 +            return true;
 +        }
 +    }
 -    exp->common.ctx = NULL;
 +    return false;
 }
 static void nbd_eject_notifier(Notifier *n, void *data)
@@ -1594,6 +1618,12 @@ void nbd_export_set_on_eject_blk(BlockExport *exp, BlockBackend *blk)
     blk_add_remove_bs_notifier(blk, &nbd_exp->eject_notifier);
 }
 +static const BlockDevOps nbd_block_ops = {
 +    .drained_begin = nbd_drained_begin,
 +    .drained_end = nbd_drained_end,
 +    .drained_poll = nbd_drained_poll,
 +};
 +
 static int nbd_export_create(BlockExport *blk_exp, BlockExportOptions *exp_args,
                              Error **errp)
 {
@@ -1715,8 +1745,17 @@ static int nbd_export_create(BlockExport *blk_exp, BlockExportOptions *exp_args,
     exp->allocation_depth = arg->allocation_depth;
 +    /*
 +     * We need to inhibit request queuing in the block layer to ensure we can
 +     * be properly quiesced when entering a drained section, as our coroutines
 +     * servicing pending requests might enter blk_pread().
 +     */
 +    blk_set_disable_request_queuing(blk, true);
 +
     blk_add_aio_context_notifier(blk, blk_aio_attached, blk_aio_detach, exp);
 +    blk_set_dev_ops(blk, &nbd_block_ops, exp);
 +
     QTAILQ_INSERT_TAIL(&exports, exp, next);
     return 0;
@@ -1788,6 +1827,7 @@ static void nbd_export_delete(BlockExport *blk_exp)
         }
         blk_remove_aio_context_notifier(exp->common.blk, blk_aio_attached,
                                         blk_aio_detach, exp);
 +        blk_set_disable_request_queuing(exp->common.blk, false);
     }
     for (i = 0; i < exp->nr_export_bitmaps; i++) {
 -- 
 2.27.0
--- a/kvm-osdep-provide-ROUND_DOWN-macro.patch
+++ b/kvm-osdep-provide-ROUND_DOWN-macro.patch
@ -1,75 +0,0 @@
 From d9fa07a04ee19ad713b053f6a649178361d822a8 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:31 -0400
 Subject: [PATCH 15/43] osdep: provide ROUND_DOWN macro
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 osdep.h provides a ROUND_UP macro to hide bitwise operations for the
 purpose of rounding a number up to a power of two; add a ROUND_DOWN
 macro that does the same with truncation towards zero.
 While at it, change the formatting of some comments.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit c9797456f64ce72c03eb2969d97ac1dd4698d91e)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 include/qemu/osdep.h | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index cb2a07e472..e327220992 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -316,11 +316,16 @@ extern "C" {
     })
 #endif
 -/* Round number down to multiple */
 +/*
 + * Round number down to multiple. Safe when m is not a power of 2 (see
 + * ROUND_DOWN for a faster version when a power of 2 is guaranteed).
 + */
 #define QEMU_ALIGN_DOWN(n, m) ((n) / (m) * (m))
 -/* Round number up to multiple. Safe when m is not a power of 2 (see
 - * ROUND_UP for a faster version when a power of 2 is guaranteed) */
 +/*
 + * Round number up to multiple. Safe when m is not a power of 2 (see
 + * ROUND_UP for a faster version when a power of 2 is guaranteed).
 + */
 #define QEMU_ALIGN_UP(n, m) QEMU_ALIGN_DOWN((n) + (m) - 1, (m))
 /* Check if n is a multiple of m */
@@ -337,11 +342,22 @@ extern "C" {
 /* Check if pointer p is n-bytes aligned */
 #define QEMU_PTR_IS_ALIGNED(p, n) QEMU_IS_ALIGNED((uintptr_t)(p), (n))
 -/* Round number up to multiple. Requires that d be a power of 2 (see
 +/*
 + * Round number down to multiple. Requires that d be a power of 2 (see
  * QEMU_ALIGN_UP for a safer but slower version on arbitrary
 - * numbers); works even if d is a smaller type than n.  */
 + * numbers); works even if d is a smaller type than n.
 + */
 +#ifndef ROUND_DOWN
 +#define ROUND_DOWN(n, d) ((n) & -(0 ? (n) : (d)))
 +#endif
 +
 +/*
 + * Round number up to multiple. Requires that d be a power of 2 (see
 + * QEMU_ALIGN_UP for a safer but slower version on arbitrary
 + * numbers); works even if d is a smaller type than n.
 + */
 #ifndef ROUND_UP
 -#define ROUND_UP(n, d) (((n) + (d) - 1) & -(0 ? (n) : (d)))
 +#define ROUND_UP(n, d) ROUND_DOWN((n) + (d) - 1, (d))
 #endif
 #ifndef DIV_ROUND_UP
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Allow-building-with-Clang-too.patch
+++ b/kvm-pc-bios-s390-ccw-Allow-building-with-Clang-too.patch
@ -1,77 +0,0 @@
 From 9da71839fdc4e8b9d034998b0ed8a7ee9dfe7645 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Sun, 2 May 2021 13:22:21 +0200
 Subject: [PATCH 34/39] pc-bios/s390-ccw: Allow building with Clang, too
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [7/11] d7c510f1e5f6434f6b3e4bab5b5f75403cbc7e1b (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 Clang unfortunately does not support generating code for the z900
 architecture level and starts with the z10 instead. Thus to be able
 to support compiling with Clang, we have to check for the supported
 compiler flags. The disadvantage is of course that the bios image
 will only run with z10 guest CPUs upwards (which is what most people
 use anyway), so just in case let's also emit a warning in that case
 (we will continue to ship firmware images that have been pre-built
 with GCC in future releases, so this should not impact normal users,
 too).
 Message-Id: <20210502174836.838816-5-thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit a5b2afd522dde375c38cf94b7c696ffa3faba2fb)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 configure                 | 9 ++++++++-
 pc-bios/s390-ccw/Makefile | 3 ++-
 2 files changed, 10 insertions(+), 2 deletions(-)
 diff --git a/configure b/configure
 index 7edc08afb3..83d8af7fe4 100755
 --- a/configure
 +++ b/configure
@@ -5424,9 +5424,16 @@ if { test "$cpu" = "i386" || test "$cpu" = "x86_64"; } && \
 fi
 # Only build s390-ccw bios if we're on s390x and the compiler has -march=z900
 +# or -march=z10 (which is the lowest architecture level that Clang supports)
 if test "$cpu" = "s390x" ; then
   write_c_skeleton
 -  if compile_prog "-march=z900" ""; then
 +  compile_prog "-march=z900" ""
 +  has_z900=$?
 +  if [ $has_z900 = 0 ] || compile_prog "-march=z10" ""; then
 +    if [ $has_z900 != 0 ]; then
 +      echo "WARNING: Your compiler does not support the z900!"
 +      echo "         The s390-ccw bios will only work with guest CPUs >= z10."
 +    fi
     roms="$roms s390-ccw"
     # SLOF is required for building the s390-ccw firmware on s390x,
     # since it is using the libnet code from SLOF for network booting.
 diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
 index 83fb1afb73..cee9d2c63b 100644
 --- a/pc-bios/s390-ccw/Makefile
 +++ b/pc-bios/s390-ccw/Makefile
@@ -34,7 +34,8 @@ QEMU_CFLAGS += $(call cc-option,-Werror $(QEMU_CFLAGS),-Wno-stringop-overflow)
 QEMU_CFLAGS += -ffreestanding -fno-delete-null-pointer-checks -fno-common -fPIE
 QEMU_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
 QEMU_CFLAGS += $(call cc-option, $(QEMU_CFLAGS), -fno-stack-protector)
 -QEMU_CFLAGS += -msoft-float -march=z900
 +QEMU_CFLAGS += -msoft-float
 +QEMU_CFLAGS += $(call cc-option, $(QEMU_CFLAGS),-march=z900,-march=z10)
 QEMU_CFLAGS += -std=gnu99
 LDFLAGS += -Wl,-pie -nostdlib
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Fix-inline-assembly-for-older-versi.patch
+++ b/kvm-pc-bios-s390-ccw-Fix-inline-assembly-for-older-versi.patch
@ -1,106 +0,0 @@
 From c783eab8a3770703a39bbbd7edd23af7b9cb8f14 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 12 May 2021 19:15:48 +0200
 Subject: [PATCH 35/39] pc-bios/s390-ccw: Fix inline assembly for older
 versions of Clang
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [8/11] 9a69c7705b8128b4098f818c6b672d484e459c83 (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 Clang versions before v11.0 insist on having the %rX or %cX register
 names instead of just a number. Since our Travis-CI is currently
 still using Clang v6.0, we have to fix this to avoid failing jobs.
 Message-Id: <20210512171550.476130-2-thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 052b66e7211af64964e005126eaa3c944b296b0e)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/helper.h   | 2 +-
 pc-bios/s390-ccw/jump2ipl.c | 4 ++--
 pc-bios/s390-ccw/menu.c     | 8 ++++----
 pc-bios/s390-ccw/virtio.c   | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)
 diff --git a/pc-bios/s390-ccw/helper.h b/pc-bios/s390-ccw/helper.h
 index dfcfea0ff0..3d0731c4c6 100644
 --- a/pc-bios/s390-ccw/helper.h
 +++ b/pc-bios/s390-ccw/helper.h
@@ -31,7 +31,7 @@ static inline void *u32toptr(uint32_t n)
 static inline void yield(void)
 {
 -    asm volatile ("diag 0,0,0x44"
 +    asm volatile ("diag %%r0,%%r0,0x44"
                   : :
                   : "memory", "cc");
 }
 diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
 index 73e4367e09..78f5f46533 100644
 --- a/pc-bios/s390-ccw/jump2ipl.c
 +++ b/pc-bios/s390-ccw/jump2ipl.c
@@ -64,8 +64,8 @@ void jump_to_IPL_code(uint64_t address)
      * We use the load normal reset to keep r15 unchanged. jump_to_IPL_2
      * can then use r15 as its stack pointer.
      */
 -    asm volatile("lghi 1,1\n\t"
 -                 "diag 1,1,0x308\n\t"
 +    asm volatile("lghi %%r1,1\n\t"
 +                 "diag %%r1,%%r1,0x308\n\t"
                  : : : "1", "memory");
     panic("\n! IPL returns !\n");
 }
 diff --git a/pc-bios/s390-ccw/menu.c b/pc-bios/s390-ccw/menu.c
 index de8260a5d6..d601952d3e 100644
 --- a/pc-bios/s390-ccw/menu.c
 +++ b/pc-bios/s390-ccw/menu.c
@@ -36,9 +36,9 @@ static inline void enable_clock_int(void)
     uint64_t tmp = 0;
     asm volatile(
 -        "stctg      0,0,%0\n"
 +        "stctg      %%c0,%%c0,%0\n"
         "oi         6+%0, 0x8\n"
 -        "lctlg      0,0,%0"
 +        "lctlg      %%c0,%%c0,%0"
         : : "Q" (tmp) : "memory"
     );
 }
@@ -48,9 +48,9 @@ static inline void disable_clock_int(void)
     uint64_t tmp = 0;
     asm volatile(
 -        "stctg      0,0,%0\n"
 +        "stctg      %%c0,%%c0,%0\n"
         "ni         6+%0, 0xf7\n"
 -        "lctlg      0,0,%0"
 +        "lctlg      %%c0,%%c0,%0"
         : : "Q" (tmp) : "memory"
     );
 }
 diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
 index ab49840db8..5d2c6e3381 100644
 --- a/pc-bios/s390-ccw/virtio.c
 +++ b/pc-bios/s390-ccw/virtio.c
@@ -54,7 +54,7 @@ static long kvm_hypercall(unsigned long nr, unsigned long param1,
     register ulong r_param3 asm("4") = param3;
     register long retval asm("2");
 -    asm volatile ("diag 2,4,0x500"
 +    asm volatile ("diag %%r2,%%r4,0x500"
                   : "=d" (retval)
                   : "d" (r_nr), "0" (r_param1), "r"(r_param2), "d"(r_param3)
                   : "memory", "cc");
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Fix-the-cc-option-macro-in-the-Make.patch
+++ b/kvm-pc-bios-s390-ccw-Fix-the-cc-option-macro-in-the-Make.patch
@ -1,48 +0,0 @@
 From f2d40216872a40bc5f5089de760c7ba0e3a710bc Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Sun, 2 May 2021 13:07:46 +0200
 Subject: [PATCH 32/39] pc-bios/s390-ccw: Fix the cc-option macro in the
 Makefile
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [5/11] 75379671567451e12ca32a3ea35d1ad2aa04bf5f (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 The cc-option macro is not doing what it should - compared with the
 original from the rules.mak file that got removed with commit
 660f793093 ("Makefile: inline the relevant parts of rules.mak"),
 the arguments got changed and thus the macro is rather doubling
 the QEMU_CFLAGS than adding the flag that should be tested.
 Message-Id: <20210502174836.838816-3-thuth@redhat.com>
 Fixes: 22fb2ab096 ("pc-bios/s390-ccw: do not use rules.mak")
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 3462ff35512e925df5ee8c079ed46d4c93b633a7)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
 index 29fd9019b8..f0fe84c9eb 100644
 --- a/pc-bios/s390-ccw/Makefile
 +++ b/pc-bios/s390-ccw/Makefile
@@ -6,8 +6,8 @@ include ../../config-host.mak
 CFLAGS = -O2 -g
 quiet-command = $(if $(V),$1,$(if $(2),@printf "  %-7s %s\n" $2 $3 && $1, @$1))
 -cc-option = $(if $(shell $(CC) $1 -S -o /dev/null -xc /dev/null > /dev/null \
 -	      2>&1 && echo OK), $1, $2)
 +cc-option = $(if $(shell $(CC) $1 $2 -S -o /dev/null -xc /dev/null \
 +			 >/dev/null 2>&1 && echo OK),$2,$3)
 VPATH_SUFFIXES = %.c %.h %.S %.m %.mak %.sh %.rc Kconfig% %.json.in
 set-vpath = $(if $1,$(foreach PATTERN,$(VPATH_SUFFIXES),$(eval vpath $(PATTERN) $1)))
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Silence-GCC-11-stringop-overflow-wa.patch
+++ b/kvm-pc-bios-s390-ccw-Silence-GCC-11-stringop-overflow-wa.patch
@ -1,75 +0,0 @@
 From c5b348e6d0334333295332c55fc4be51ce2668b8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 22 Apr 2021 16:59:11 +0200
 Subject: [PATCH 33/39] pc-bios/s390-ccw: Silence GCC 11 stringop-overflow
 warning
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [6/11] 92851a154f2425363aa1f5ed2bb12740f589229e (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 When building on Fedora 34 (gcc version 11.0.0 20210210) we get:
  In file included from pc-bios/s390-ccw/main.c:11:
  In function ‘memset’,
      inlined from ‘boot_setup’ at pc-bios/s390-ccw/main.c:185:5,
      inlined from ‘main’ at pc-bios/s390-ccw/main.c:288:5:
  pc-bios/s390-ccw/libc.h:28:14: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=]
     28 |         p[i] = c;
        |         ~~~~~^~~
 The offending code is:
  memset((char *)S390EP, 0, 6);
 where S390EP is a const address:
  #define S390EP 0x10008
 The compiler doesn't know how big that pointed area is, so it assume that
 its length is zero. This has been reported as BZ#99578 to GCC:
 "gcc-11 -Warray-bounds or -Wstringop-overread warning when accessing a
 pointer from integer literal"
 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578
 As this warning does us more harm than good in the BIOS code (where
 lot of direct accesses to low memory are done), silence this warning
 for all BIOS objects.
 Suggested-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-Id: <20210422145911.2513980-1-philmd@redhat.com>
 Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
 Message-Id: <20210502174836.838816-4-thuth@redhat.com>
 [thuth: Use the pre-existing cc-option macro instead of adding a new one]
 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit da231910d33084ccf63f07de210b145e0fa31d98)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/Makefile | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
 index f0fe84c9eb..83fb1afb73 100644
 --- a/pc-bios/s390-ccw/Makefile
 +++ b/pc-bios/s390-ccw/Makefile
@@ -30,6 +30,7 @@ OBJECTS = start.o main.o bootmap.o jump2ipl.o sclp.o menu.o \
 	  virtio.o virtio-scsi.o virtio-blkdev.o libc.o cio.o dasd-ipl.o
 QEMU_CFLAGS := -Wall $(filter -W%, $(QEMU_CFLAGS))
 +QEMU_CFLAGS += $(call cc-option,-Werror $(QEMU_CFLAGS),-Wno-stringop-overflow)
 QEMU_CFLAGS += -ffreestanding -fno-delete-null-pointer-checks -fno-common -fPIE
 QEMU_CFLAGS += -fwrapv -fno-strict-aliasing -fno-asynchronous-unwind-tables
 QEMU_CFLAGS += $(call cc-option, $(QEMU_CFLAGS), -fno-stack-protector)
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Silence-warning-from-Clang-by-marki.patch
+++ b/kvm-pc-bios-s390-ccw-Silence-warning-from-Clang-by-marki.patch
@ -1,59 +0,0 @@
 From 12acb42f2e6317a530fa01b5cf55a199231bfdce Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Sun, 2 May 2021 13:49:20 +0200
 Subject: [PATCH 31/39] pc-bios/s390-ccw: Silence warning from Clang by marking
 panic() as noreturn
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [4/11] 806b776bf01b733e04664534641cf89d1cb48f1b (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 When compiling the s390-ccw bios with Clang, the compiler emits a warning:
 pc-bios/s390-ccw/main.c:210:5: warning: variable 'found' is used uninitialized
  whenever switch default is taken [-Wsometimes-uninitialized]
     default:
     ^~~~~~~
 pc-bios/s390-ccw/main.c:214:16: note: uninitialized use occurs here
     IPL_assert(found, "Boot device not found\n");
                ^~~~~
 It's a false positive, it only happens because Clang is not smart enough
 to see that the panic() function in the "default:" case can never return.
 Anyway, let's explicitely mark panic() with "noreturn" to shut up the
 warning.
 Message-Id: <20210502174836.838816-2-thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 679196a646c91b8ce9a97b0aa81ffb3776cf8046)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/s390-ccw.h | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
 index 6cd92669e9..79db69ff54 100644
 --- a/pc-bios/s390-ccw/s390-ccw.h
 +++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -89,6 +89,7 @@ bool menu_is_enabled_enum(void);
 #define MAX_BOOT_ENTRIES  31
 +__attribute__ ((__noreturn__))
 static inline void panic(const char *string)
 {
     sclp_print(string);
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-Use-reset_psw-pointer-instead-of-ha.patch
+++ b/kvm-pc-bios-s390-ccw-Use-reset_psw-pointer-instead-of-ha.patch
@ -1,60 +0,0 @@
 From 609d8661171760c7ead04f64359d47a77c31d474 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 23 Apr 2021 10:30:51 +0200
 Subject: [PATCH 29/39] pc-bios/s390-ccw: Use reset_psw pointer instead of
 hard-coded null pointer
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [2/11] c65a986104a1830847e772879ca6eaf76c86b2f3 (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 When compiling the s390-ccw bios with clang, it emits a warning like this:
 pc-bios/s390-ccw/jump2ipl.c:86:9: warning: indirection of non-volatile null
  pointer will be deleted, not trap [-Wnull-dereference]
     if (*((uint64_t *)0) & RESET_PSW_MASK) {
         ^~~~~~~~~~~~~~~~
 pc-bios/s390-ccw/jump2ipl.c:86:9: note: consider using __builtin_trap() or
  qualifying pointer with 'volatile'
 We could add a "volatile" here to shut it up, but on the other hand,
 we also have a pointer variable called "reset_psw" in this file already
 that points to the PSW at address 0, so we can simply use that pointer
 variable instead.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-Id: <20210423142440.582188-1-thuth@redhat.com>
 Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit ff77712a8a2e15e5901fad35b9a6bb65974b2e4a)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/jump2ipl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
 index b9c70d64a5..73e4367e09 100644
 --- a/pc-bios/s390-ccw/jump2ipl.c
 +++ b/pc-bios/s390-ccw/jump2ipl.c
@@ -82,8 +82,8 @@ void jump_to_low_kernel(void)
         jump_to_IPL_code(KERN_IMAGE_START);
     }
 -    /* Trying to get PSW at zero address */
 -    if (*((uint64_t *)0) & RESET_PSW_MASK) {
 +    /* Trying to get PSW at zero address (pointed to by reset_psw) */
 +    if (*reset_psw & RESET_PSW_MASK) {
         /*
          * Surely nobody will try running directly from lowcore, so
          * let's use 0 as an indication that we want to load the reset
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-bootmap-Silence-compiler-warning-fr.patch
+++ b/kvm-pc-bios-s390-ccw-bootmap-Silence-compiler-warning-fr.patch
@ -1,56 +0,0 @@
 From c00df86dd570d78767c5435f97bbe1d06407e470 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 21 Apr 2021 17:48:48 +0200
 Subject: [PATCH 28/39] pc-bios/s390-ccw/bootmap: Silence compiler warning from
 Clang
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [1/11] 85e41a04a0f47afe23e62f70397a5f79b2703499 (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 When compiling the s390-ccw bios with Clang, the compiler complains:
 pc-bios/s390-ccw/bootmap.c:302:9: warning: logical not is only applied
  to the left hand side of this comparison [-Wlogical-not-parentheses]
    if (!mbr->dev_type == DEV_TYPE_ECKD) {
        ^              ~~
 The code works (more or less by accident), since dev_type can only be
 0 or 1, but it's better of course to use the intended != operator here
 instead.
 Fixes: 5dc739f343 ("Allow booting in case the first virtio-blk disk is bad")
 Message-Id: <20210421163331.358178-1-thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit d08a64940452060ab7ad5eb49cd5801131c2b9ec)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/bootmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
 index b46997c0b7..56411ab3b6 100644
 --- a/pc-bios/s390-ccw/bootmap.c
 +++ b/pc-bios/s390-ccw/bootmap.c
@@ -299,7 +299,7 @@ static void ipl_eckd_cdl(void)
         sclp_print("Bad block size in zIPL section of IPL2 record.\n");
         return;
     }
 -    if (!mbr->dev_type == DEV_TYPE_ECKD) {
 +    if (mbr->dev_type != DEV_TYPE_ECKD) {
         sclp_print("Non-ECKD device type in zIPL section of IPL2 record.\n");
         return;
     }
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch
+++ b/kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch
@ -1,51 +0,0 @@
 From bd1d37e3536136130df41ac8162ce5bb4f361f87 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Tue, 1 Jun 2021 08:52:10 -0400
 Subject: [PATCH 02/21] pc-bios/s390-ccw: don't try to read the next block if
 end of chunk is reached
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [1/8] 69a43520a9e7f0ab92bdfdc47281c7606f5159e7 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 From: Marc Hartmayer <mhartmay@linux.ibm.com>
 Don't read the block if a null block number is reached, because this means that
 the end of chunk is reached.
 Reviewed-by: Collin Walling <walling@linux.ibm.com>
 Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
 Message-Id: <20210416074736.17409-1-mhartmay@linux.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit a6625d38cce3901a7c1cba069f0abcf743a293f1)
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/bootmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
 index 44df7d16af..b46997c0b7 100644
 --- a/pc-bios/s390-ccw/bootmap.c
 +++ b/pc-bios/s390-ccw/bootmap.c
@@ -213,7 +213,7 @@ static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
                 next_block_nr = eckd_block_num(&s1b->seek[i + 1].chs);
             }
 -            if (next_block_nr) {
 +            if (next_block_nr && !is_null_block_number(next_block_nr)) {
                 read_block(next_block_nr, s2_next_blk,
                            "Cannot read stage2 boot loader");
             }
 -- 
 2.27.0
--- a/kvm-pc-bios-s390-ccw-netboot-Use-Wl-prefix-to-pass-param.patch
+++ b/kvm-pc-bios-s390-ccw-netboot-Use-Wl-prefix-to-pass-param.patch
@ -1,44 +0,0 @@
 From 354026a79551358a5be4ed561e080ff550738e92 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 23 Apr 2021 17:20:46 +0200
 Subject: [PATCH 30/39] pc-bios/s390-ccw/netboot: Use "-Wl," prefix to pass
 parameter to the linker
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 24: v7:  Add support for building qemu-kvm with clang and safe-stack
 RH-Commit: [3/11] 6a22a1705fbeb5fb2eab6c0e149a433286f98e5f (jmaloy/qemu-kvm-centos-jon)
 RH-Bugzilla: 1939509 1940132
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 We are using the compiler to do the linking of the bios files. GCC still
 accepts the "-Ttext=..." linker flag directly and is smart enough to
 pass it to the linker, but in case we are compiling with Clang, we have
 to use the official way with the "-Wl," prefix instead.
 Message-Id: <20210423153646.593153-1-thuth@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit b460a220872c28a8da95cbc7e9369d26aa268848)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 pc-bios/s390-ccw/netboot.mak | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/pc-bios/s390-ccw/netboot.mak b/pc-bios/s390-ccw/netboot.mak
 index 577c023afe..68b4d7edcb 100644
 --- a/pc-bios/s390-ccw/netboot.mak
 +++ b/pc-bios/s390-ccw/netboot.mak
@@ -6,7 +6,7 @@ NETOBJS := start.o sclp.o cio.o virtio.o virtio-net.o jump2ipl.o netmain.o
 LIBC_INC := -nostdinc -I$(SLOF_DIR)/lib/libc/include
 LIBNET_INC := -I$(SLOF_DIR)/lib/libnet
 -NETLDFLAGS := $(LDFLAGS) -Ttext=0x7800000
 +NETLDFLAGS := $(LDFLAGS) -Wl,-Ttext=0x7800000
 $(NETOBJS): QEMU_CFLAGS += $(LIBC_INC) $(LIBNET_INC)
 -- 
 2.27.0
--- a/kvm-ppc-pef.c-initialize-cgs-ready-in-kvmppc_svm_init.patch
+++ b/kvm-ppc-pef.c-initialize-cgs-ready-in-kvmppc_svm_init.patch
@ -1,69 +0,0 @@
 From e496360f627cdc4202f185b63175ced08c8b1f07 Mon Sep 17 00:00:00 2001
 From: Daniel Henrique Barboza <danielhb413@gmail.com>
 Date: Wed, 23 Jun 2021 19:39:32 -0400
 Subject: [PATCH 3/6] ppc/pef.c: initialize cgs->ready in kvmppc_svm_init()
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 22: Synchronize with RHEL-AV 8.5 release 23 to RHEL 9
 RH-Commit: [2/5] b204f898d2333686e30b14c050ac7a9289670f23 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 QEMU is failing to launch a CGS pSeries guest in a host that has PEF
 support:
 qemu-system-ppc64: ../softmmu/vl.c:2585: qemu_machine_creation_done: Assertion `machine->cgs->ready' failed.
 Aborted
 This is happening because we're not setting the cgs->ready flag that is
 asserted in qemu_machine_creation_done() during machine start.
 cgs->ready is set in s390_pv_kvm_init() and sev_kvm_init(). Let's set it
 in kvmppc_svm_init() as well.
 Reported-by: Ram Pai <linuxram@us.ibm.com>
 Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
 Message-Id: <20210528201619.52363-1-danielhb413@gmail.com>
 Acked-by: Ram Pai <linuxram@us.ibm.com>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit b873ed83311d96644b544b10f6869a430660585a)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/pef.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/hw/ppc/pef.c b/hw/ppc/pef.c
 index 573be3ed79..cc44d5e339 100644
 --- a/hw/ppc/pef.c
 +++ b/hw/ppc/pef.c
@@ -41,7 +41,7 @@ struct PefGuest {
     ConfidentialGuestSupport parent_obj;
 };
 -static int kvmppc_svm_init(Error **errp)
 +static int kvmppc_svm_init(ConfidentialGuestSupport *cgs, Error **errp)
 {
 #ifdef CONFIG_KVM
     static Error *pef_mig_blocker;
@@ -65,6 +65,8 @@ static int kvmppc_svm_init(Error **errp)
     /* NB: This can fail if --only-migratable is used */
     migrate_add_blocker(pef_mig_blocker, &error_fatal);
 +    cgs->ready = true;
 +
     return 0;
 #else
     g_assert_not_reached();
@@ -102,7 +104,7 @@ int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
         return -1;
     }
 -    return kvmppc_svm_init(errp);
 +    return kvmppc_svm_init(cgs, errp);
 }
 int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp)
 -- 
 2.27.0
--- a/kvm-qemu-img-Add-skip-broken-bitmaps-for-convert-bitmaps.patch
+++ b/kvm-qemu-img-Add-skip-broken-bitmaps-for-convert-bitmaps.patch
@ -1,265 +0,0 @@
 From c5a2313ba173568087d78f76cc0258e7a353830b Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 6 Aug 2021 15:07:49 -0400
 Subject: [PATCH 26/39] qemu-img: Add --skip-broken-bitmaps for 'convert
 --bitmaps'
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 35: Synchronize with RHEL-AV 8.5 release 28 to RHEL 9
 RH-Commit: [3/4] 4b7203c66367c601f9710bbcd91bdbdd56f0f8bd (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 The point of 'qemu-img convert --bitmaps' is to be a convenience for
 actions that are already possible through a string of smaller
 'qemu-img bitmap' sub-commands.  One situation not accounted for
 already is that if a source image contains an inconsistent bitmap (for
 example, because a qemu process died abruptly before flushing bitmap
 state), the user MUST delete those inconsistent bitmaps before
 anything else useful can be done with the image.
 We don't want to delete inconsistent bitmaps by default: although a
 corrupt bitmap is only a loss of optimization rather than a corruption
 of user-visible data, it is still nice to require the user to opt in
 to the fact that they are aware of the loss of the bitmap.  Still,
 requiring the user to check 'qemu-img info' to see whether bitmaps are
 consistent, then use 'qemu-img bitmap --remove' to remove offenders,
 all before using 'qemu-img convert', is a lot more work than just
 adding a knob 'qemu-img convert --bitmaps --skip-broken-bitmaps' which
 opts in to skipping the broken bitmaps.
 After testing the new option, also demonstrate the way to manually fix
 things (either deleting bad bitmaps, or re-creating them as empty) so
 that it is possible to convert without the option.
 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1946084
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210709153951.2801666-4-eblake@redhat.com>
 [eblake: warning message tweak, test enhancements]
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 955171e4417bf39edb5503e694501e082a757731)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/tools/qemu-img.rst                       |  8 ++++-
 qemu-img.c                                    | 29 +++++++++++----
 tests/qemu-iotests/tests/qemu-img-bitmaps     | 16 ++++++++-
 tests/qemu-iotests/tests/qemu-img-bitmaps.out | 35 ++++++++++++++++++-
 4 files changed, 79 insertions(+), 9 deletions(-)
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
 index c9efcfaefc..3df6277d6a 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
@@ -414,7 +414,7 @@ Command description:
   4
     Error on reading data
 -.. option:: convert [--object OBJECTDEF] [--image-opts] [--target-image-opts] [--target-is-zero] [--bitmaps] [-U] [-C] [-c] [-p] [-q] [-n] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-O OUTPUT_FMT] [-B BACKING_FILE] [-o OPTIONS] [-l SNAPSHOT_PARAM] [-S SPARSE_SIZE] [-r RATE_LIMIT] [-m NUM_COROUTINES] [-W] FILENAME [FILENAME2 [...]] OUTPUT_FILENAME
 +.. option:: convert [--object OBJECTDEF] [--image-opts] [--target-image-opts] [--target-is-zero] [--bitmaps [--skip-broken-bitmaps]] [-U] [-C] [-c] [-p] [-q] [-n] [-f FMT] [-t CACHE] [-T SRC_CACHE] [-O OUTPUT_FMT] [-B BACKING_FILE] [-o OPTIONS] [-l SNAPSHOT_PARAM] [-S SPARSE_SIZE] [-r RATE_LIMIT] [-m NUM_COROUTINES] [-W] FILENAME [FILENAME2 [...]] OUTPUT_FILENAME
   Convert the disk image *FILENAME* or a snapshot *SNAPSHOT_PARAM*
   to disk image *OUTPUT_FILENAME* using format *OUTPUT_FMT*. It can
@@ -456,6 +456,12 @@ Command description:
   *NUM_COROUTINES* specifies how many coroutines work in parallel during
   the convert process (defaults to 8).
 +  Use of ``--bitmaps`` requests that any persistent bitmaps present in
 +  the original are also copied to the destination.  If any bitmap is
 +  inconsistent in the source, the conversion will fail unless
 +  ``--skip-broken-bitmaps`` is also specified to copy only the
 +  consistent bitmaps.
 +
 .. option:: create [--object OBJECTDEF] [-q] [-f FMT] [-b BACKING_FILE] [-F BACKING_FMT] [-u] [-o OPTIONS] FILENAME [SIZE]
   Create the new disk image *FILENAME* of size *SIZE* and format
 diff --git a/qemu-img.c b/qemu-img.c
 index 7684684bfa..75bab32416 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -82,6 +82,7 @@ enum {
     OPTION_MERGE = 274,
     OPTION_BITMAPS = 275,
     OPTION_FORCE = 276,
 +    OPTION_SKIP_BROKEN = 277,
 };
 typedef enum OutputFormat {
@@ -2099,7 +2100,7 @@ static int convert_do_copy(ImgConvertState *s)
 }
 /* Check that bitmaps can be copied, or output an error */
 -static int convert_check_bitmaps(BlockDriverState *src)
 +static int convert_check_bitmaps(BlockDriverState *src, bool skip_broken)
 {
     BdrvDirtyBitmap *bm;
@@ -2111,17 +2112,19 @@ static int convert_check_bitmaps(BlockDriverState *src)
         if (!bdrv_dirty_bitmap_get_persistence(bm)) {
             continue;
         }
 -        if (bdrv_dirty_bitmap_inconsistent(bm)) {
 +        if (!skip_broken && bdrv_dirty_bitmap_inconsistent(bm)) {
             error_report("Cannot copy inconsistent bitmap '%s'",
                          bdrv_dirty_bitmap_name(bm));
 -            error_printf("Try 'qemu-img bitmap --remove' to delete it\n");
 +            error_printf("Try --skip-broken-bitmaps, or "
 +                         "use 'qemu-img bitmap --remove' to delete it\n");
             return -1;
         }
     }
     return 0;
 }
 -static int convert_copy_bitmaps(BlockDriverState *src, BlockDriverState *dst)
 +static int convert_copy_bitmaps(BlockDriverState *src, BlockDriverState *dst,
 +                                bool skip_broken)
 {
     BdrvDirtyBitmap *bm;
     Error *err = NULL;
@@ -2133,6 +2136,10 @@ static int convert_copy_bitmaps(BlockDriverState *src, BlockDriverState *dst)
             continue;
         }
         name = bdrv_dirty_bitmap_name(bm);
 +        if (skip_broken && bdrv_dirty_bitmap_inconsistent(bm)) {
 +            warn_report("Skipping inconsistent bitmap '%s'", name);
 +            continue;
 +        }
         qmp_block_dirty_bitmap_add(dst->node_name, name,
                                    true, bdrv_dirty_bitmap_granularity(bm),
                                    true, true,
@@ -2188,6 +2195,7 @@ static int img_convert(int argc, char **argv)
     bool force_share = false;
     bool explict_min_sparse = false;
     bool bitmaps = false;
 +    bool skip_broken = false;
     int64_t rate_limit = 0;
     ImgConvertState s = (ImgConvertState) {
@@ -2209,6 +2217,7 @@ static int img_convert(int argc, char **argv)
             {"salvage", no_argument, 0, OPTION_SALVAGE},
             {"target-is-zero", no_argument, 0, OPTION_TARGET_IS_ZERO},
             {"bitmaps", no_argument, 0, OPTION_BITMAPS},
 +            {"skip-broken-bitmaps", no_argument, 0, OPTION_SKIP_BROKEN},
             {0, 0, 0, 0}
         };
         c = getopt_long(argc, argv, ":hf:O:B:Cco:l:S:pt:T:qnm:WUr:",
@@ -2337,6 +2346,9 @@ static int img_convert(int argc, char **argv)
         case OPTION_BITMAPS:
             bitmaps = true;
             break;
 +        case OPTION_SKIP_BROKEN:
 +            skip_broken = true;
 +            break;
         }
     }
@@ -2344,6 +2356,11 @@ static int img_convert(int argc, char **argv)
         out_fmt = "raw";
     }
 +    if (skip_broken && !bitmaps) {
 +        error_report("Use of --skip-broken-bitmaps requires --bitmaps");
 +        goto fail_getopt;
 +    }
 +
     if (s.compressed && s.copy_range) {
         error_report("Cannot enable copy offloading when -c is used");
         goto fail_getopt;
@@ -2573,7 +2590,7 @@ static int img_convert(int argc, char **argv)
             ret = -1;
             goto out;
         }
 -        ret = convert_check_bitmaps(blk_bs(s.src[0]));
 +        ret = convert_check_bitmaps(blk_bs(s.src[0]), skip_broken);
         if (ret < 0) {
             goto out;
         }
@@ -2698,7 +2715,7 @@ static int img_convert(int argc, char **argv)
     /* Now copy the bitmaps */
     if (bitmaps && ret == 0) {
 -        ret = convert_copy_bitmaps(blk_bs(s.src[0]), out_bs);
 +        ret = convert_copy_bitmaps(blk_bs(s.src[0]), out_bs, skip_broken);
     }
 out:
 diff --git a/tests/qemu-iotests/tests/qemu-img-bitmaps b/tests/qemu-iotests/tests/qemu-img-bitmaps
 index 09c3d395d1..7a3fe8c3d3 100755
 --- a/tests/qemu-iotests/tests/qemu-img-bitmaps
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps
@@ -144,7 +144,21 @@ _img_info --format-specific | _filter_irrelevant_img_info
 echo
 $QEMU_IMG convert --bitmaps -O qcow2 "$TEST_IMG" "$TEST_IMG.copy" &&
     echo "unexpected success"
 -TEST_IMG=$TEST_IMG.copy _img_info --format-specific \
 +TEST_IMG="$TEST_IMG.copy" _img_info --format-specific \
 +    | _filter_irrelevant_img_info
 +# Skipping the broken bitmaps works,...
 +echo
 +$QEMU_IMG convert --bitmaps --skip-broken-bitmaps \
 +    -O qcow2 "$TEST_IMG" "$TEST_IMG.copy"
 +TEST_IMG="$TEST_IMG.copy" _img_info --format-specific \
 +    | _filter_irrelevant_img_info
 +# ...as does removing them
 +echo
 +_rm_test_img "$TEST_IMG.copy"
 +$QEMU_IMG bitmap --remove "$TEST_IMG" b0
 +$QEMU_IMG bitmap --remove --add "$TEST_IMG" b2
 +$QEMU_IMG convert --bitmaps -O qcow2 "$TEST_IMG" "$TEST_IMG.copy"
 +TEST_IMG="$TEST_IMG.copy" _img_info --format-specific \
     | _filter_irrelevant_img_info
 # success, all done
 diff --git a/tests/qemu-iotests/tests/qemu-img-bitmaps.out b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
 index 1e32833bf1..7a7429e320 100644
 --- a/tests/qemu-iotests/tests/qemu-img-bitmaps.out
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
@@ -145,6 +145,39 @@ Format specific information:
     corrupt: false
 qemu-img: Cannot copy inconsistent bitmap 'b0'
 -Try 'qemu-img bitmap --remove' to delete it
 +Try --skip-broken-bitmaps, or use 'qemu-img bitmap --remove' to delete it
 qemu-img: Could not open 'TEST_DIR/t.IMGFMT.copy': Could not open 'TEST_DIR/t.IMGFMT.copy': No such file or directory
 +
 +qemu-img: warning: Skipping inconsistent bitmap 'b0'
 +qemu-img: warning: Skipping inconsistent bitmap 'b2'
 +image: TEST_DIR/t.IMGFMT.copy
 +file format: IMGFMT
 +virtual size: 10 MiB (10485760 bytes)
 +cluster_size: 65536
 +Format specific information:
 +    bitmaps:
 +        [0]:
 +            flags:
 +                [0]: auto
 +            name: b4
 +            granularity: 65536
 +    corrupt: false
 +
 +image: TEST_DIR/t.IMGFMT.copy
 +file format: IMGFMT
 +virtual size: 10 MiB (10485760 bytes)
 +cluster_size: 65536
 +Format specific information:
 +    bitmaps:
 +        [0]:
 +            flags:
 +                [0]: auto
 +            name: b4
 +            granularity: 65536
 +        [1]:
 +            flags:
 +                [0]: auto
 +            name: b2
 +            granularity: 65536
 +    corrupt: false
 *** done
 -- 
 2.27.0
--- a/kvm-qemu-img-Fail-fast-on-convert-bitmaps-with-inconsist.patch
+++ b/kvm-qemu-img-Fail-fast-on-convert-bitmaps-with-inconsist.patch
@ -1,145 +0,0 @@
 From 5e8f99ea87409e1423c2e1c5e445003cf4a032a9 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 6 Aug 2021 15:07:48 -0400
 Subject: [PATCH 25/39] qemu-img: Fail fast on convert --bitmaps with
 inconsistent bitmap
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 35: Synchronize with RHEL-AV 8.5 release 28 to RHEL 9
 RH-Commit: [2/4] 3fd8d357c3a365d4bc142b3d339745e5b15c5894 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Waiting until the end of the convert operation (a potentially
 time-consuming task) to finally detect that we can't copy a bitmap is
 bad, comparing to failing fast up front.  Furthermore, this prevents
 us from leaving a file behind with a bitmap that is not marked as
 inconsistent even though it does not have sane contents.
 This fixes the problems exposed in the previous patch to the iotest:
 it adds a fast failure up front, and even if we don't fail early, it
 ensures that any bitmap we add but do not properly populate is removed
 again rather than left behind incomplete.
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210709153951.2801666-3-eblake@redhat.com>
 [eblake: add a hint to the warning message, simplify name computation]
 Reviewed-by: Nir Soffer <nsoffer@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 74a4320f30632fa539507861b3835698282e462e)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 qemu-img.c                                    | 29 +++++++++++++++++--
 tests/qemu-iotests/tests/qemu-img-bitmaps     |  3 +-
 tests/qemu-iotests/tests/qemu-img-bitmaps.out | 21 ++------------
 3 files changed, 30 insertions(+), 23 deletions(-)
 diff --git a/qemu-img.c b/qemu-img.c
 index babb5573ab..7684684bfa 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -2098,6 +2098,29 @@ static int convert_do_copy(ImgConvertState *s)
     return s->ret;
 }
 +/* Check that bitmaps can be copied, or output an error */
 +static int convert_check_bitmaps(BlockDriverState *src)
 +{
 +    BdrvDirtyBitmap *bm;
 +
 +    if (!bdrv_supports_persistent_dirty_bitmap(src)) {
 +        error_report("Source lacks bitmap support");
 +        return -1;
 +    }
 +    FOR_EACH_DIRTY_BITMAP(src, bm) {
 +        if (!bdrv_dirty_bitmap_get_persistence(bm)) {
 +            continue;
 +        }
 +        if (bdrv_dirty_bitmap_inconsistent(bm)) {
 +            error_report("Cannot copy inconsistent bitmap '%s'",
 +                         bdrv_dirty_bitmap_name(bm));
 +            error_printf("Try 'qemu-img bitmap --remove' to delete it\n");
 +            return -1;
 +        }
 +    }
 +    return 0;
 +}
 +
 static int convert_copy_bitmaps(BlockDriverState *src, BlockDriverState *dst)
 {
     BdrvDirtyBitmap *bm;
@@ -2124,6 +2147,7 @@ static int convert_copy_bitmaps(BlockDriverState *src, BlockDriverState *dst)
                               &err);
         if (err) {
             error_reportf_err(err, "Failed to populate bitmap %s: ", name);
 +            qmp_block_dirty_bitmap_remove(dst->node_name, name, NULL);
             return -1;
         }
     }
@@ -2549,9 +2573,8 @@ static int img_convert(int argc, char **argv)
             ret = -1;
             goto out;
         }
 -        if (!bdrv_supports_persistent_dirty_bitmap(blk_bs(s.src[0]))) {
 -            error_report("Source lacks bitmap support");
 -            ret = -1;
 +        ret = convert_check_bitmaps(blk_bs(s.src[0]));
 +        if (ret < 0) {
             goto out;
         }
     }
 diff --git a/tests/qemu-iotests/tests/qemu-img-bitmaps b/tests/qemu-iotests/tests/qemu-img-bitmaps
 index 409c4497a3..09c3d395d1 100755
 --- a/tests/qemu-iotests/tests/qemu-img-bitmaps
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps
@@ -140,11 +140,10 @@ $QEMU_IO -c abort "$TEST_IMG" 2>/dev/null
 $QEMU_IMG bitmap --add "$TEST_IMG" b4
 $QEMU_IMG bitmap --remove "$TEST_IMG" b1
 _img_info --format-specific | _filter_irrelevant_img_info
 +# Proof that we fail fast if bitmaps can't be copied
 echo
 $QEMU_IMG convert --bitmaps -O qcow2 "$TEST_IMG" "$TEST_IMG.copy" &&
     echo "unexpected success"
 -# Bug - even though we failed at conversion, we left a file around with
 -# a bitmap marked as not corrupt
 TEST_IMG=$TEST_IMG.copy _img_info --format-specific \
     | _filter_irrelevant_img_info
 diff --git a/tests/qemu-iotests/tests/qemu-img-bitmaps.out b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
 index 543b028da6..1e32833bf1 100644
 --- a/tests/qemu-iotests/tests/qemu-img-bitmaps.out
 +++ b/tests/qemu-iotests/tests/qemu-img-bitmaps.out
@@ -144,22 +144,7 @@ Format specific information:
             granularity: 65536
     corrupt: false
 -qemu-img: Failed to populate bitmap b0: Bitmap 'b0' is inconsistent and cannot be used
 -Try block-dirty-bitmap-remove to delete this bitmap from disk
 -image: TEST_DIR/t.IMGFMT.copy
 -file format: IMGFMT
 -virtual size: 10 MiB (10485760 bytes)
 -cluster_size: 65536
 -Format specific information:
 -    bitmaps:
 -        [0]:
 -            flags:
 -            name: b0
 -            granularity: 65536
 -        [1]:
 -            flags:
 -                [0]: auto
 -            name: b4
 -            granularity: 65536
 -    corrupt: false
 +qemu-img: Cannot copy inconsistent bitmap 'b0'
 +Try 'qemu-img bitmap --remove' to delete it
 +qemu-img: Could not open 'TEST_DIR/t.IMGFMT.copy': Could not open 'TEST_DIR/t.IMGFMT.copy': No such file or directory
 *** done
 -- 
 2.27.0
--- a/kvm-ratelimit-protect-with-a-mutex.patch
+++ b/kvm-ratelimit-protect-with-a-mutex.patch
@ -1,133 +0,0 @@
 From 05efd4675b1241f2cc68fd54c92a8a834699f212 Mon Sep 17 00:00:00 2001
 From: "plai@redhat.com" <plai@redhat.com>
 Date: Thu, 29 Jul 2021 07:42:21 -0400
 Subject: [PATCH 14/39] ratelimit: protect with a mutex
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 32: Synchronize with RHEL-AV 8.5 release 27 to RHEL 9
 RH-Commit: [6/15] 48586bf5d422cb676a6f2d2cd0abb0822cfc17b2 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 Right now, rate limiting is protected by the AioContext mutex, which is
 taken for example both by the block jobs and by qmp_block_job_set_speed
 (via find_block_job).
 We would like to remove the dependency of block layer code on the
 AioContext mutex, since most drivers and the core I/O code are already
 not relying on it.  However, there is no existing lock that can easily
 be taken by both ratelimit_set_speed and ratelimit_calculate_delay,
 especially because the latter might run in coroutine context (and
 therefore under a CoMutex) but the former will not.
 Since concurrent calls to ratelimit_calculate_delay are not possible,
 one idea could be to use a seqlock to get a snapshot of slice_ns and
 slice_quota.  But for now keep it simple, and just add a mutex to the
 RateLimit struct; block jobs are generally not performance critical to
 the point of optimizing the clock cycles spent in synchronization.
 This also requires the introduction of init/destroy functions, so
 add them to the two users of ratelimit.h.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 4951967d84a0acbf47895add9158e2d4c6056ea0)
 Signed-off-by: Paul Lai <plai@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/block-copy.c       |  2 ++
 blockjob.c               |  3 +++
 include/qemu/ratelimit.h | 14 ++++++++++++++
 3 files changed, 19 insertions(+)
 diff --git a/block/block-copy.c b/block/block-copy.c
 index 39ae481c8b..9b4af00614 100644
 --- a/block/block-copy.c
 +++ b/block/block-copy.c
@@ -230,6 +230,7 @@ void block_copy_state_free(BlockCopyState *s)
         return;
     }
 +    ratelimit_destroy(&s->rate_limit);
     bdrv_release_dirty_bitmap(s->copy_bitmap);
     shres_destroy(s->mem);
     g_free(s);
@@ -289,6 +290,7 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
         s->copy_size = MAX(s->cluster_size, BLOCK_COPY_MAX_BUFFER);
     }
 +    ratelimit_init(&s->rate_limit);
     QLIST_INIT(&s->tasks);
     QLIST_INIT(&s->calls);
 diff --git a/blockjob.c b/blockjob.c
 index 207e8c7fd9..46f15befe8 100644
 --- a/blockjob.c
 +++ b/blockjob.c
@@ -87,6 +87,7 @@ void block_job_free(Job *job)
     block_job_remove_all_bdrv(bjob);
     blk_unref(bjob->blk);
 +    ratelimit_destroy(&bjob->limit);
     error_free(bjob->blocker);
 }
@@ -435,6 +436,8 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
     assert(job->job.driver->free == &block_job_free);
     assert(job->job.driver->user_resume == &block_job_user_resume);
 +    ratelimit_init(&job->limit);
 +
     job->blk = blk;
     job->finalize_cancelled_notifier.notify = block_job_event_cancelled;
 diff --git a/include/qemu/ratelimit.h b/include/qemu/ratelimit.h
 index 01da8d63f1..003ea6d5a3 100644
 --- a/include/qemu/ratelimit.h
 +++ b/include/qemu/ratelimit.h
@@ -14,9 +14,11 @@
 #ifndef QEMU_RATELIMIT_H
 #define QEMU_RATELIMIT_H
 +#include "qemu/lockable.h"
 #include "qemu/timer.h"
 typedef struct {
 +    QemuMutex lock;
     int64_t slice_start_time;
     int64_t slice_end_time;
     uint64_t slice_quota;
@@ -40,6 +42,7 @@ static inline int64_t ratelimit_calculate_delay(RateLimit *limit, uint64_t n)
     int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     double delay_slices;
 +    QEMU_LOCK_GUARD(&limit->lock);
     assert(limit->slice_quota && limit->slice_ns);
     if (limit->slice_end_time < now) {
@@ -65,9 +68,20 @@ static inline int64_t ratelimit_calculate_delay(RateLimit *limit, uint64_t n)
     return limit->slice_end_time - now;
 }
 +static inline void ratelimit_init(RateLimit *limit)
 +{
 +    qemu_mutex_init(&limit->lock);
 +}
 +
 +static inline void ratelimit_destroy(RateLimit *limit)
 +{
 +    qemu_mutex_destroy(&limit->lock);
 +}
 +
 static inline void ratelimit_set_speed(RateLimit *limit, uint64_t speed,
                                        uint64_t slice_ns)
 {
 +    QEMU_LOCK_GUARD(&limit->lock);
     limit->slice_ns = slice_ns;
     limit->slice_quota = MAX(((double)speed * slice_ns) / 1000000000ULL, 1);
 }
 -- 
 2.27.0
--- a/kvm-redhat-Define-pseries-rhel8.5.0-machine-type.patch
+++ b/kvm-redhat-Define-pseries-rhel8.5.0-machine-type.patch
@ -1,67 +0,0 @@
 From 1194549a01a472b9ce21819cd32fe253d6263cd6 Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Mon, 10 May 2021 15:37:40 -0400
 Subject: [PATCH 08/15] redhat: Define pseries-rhel8.5.0 machine type
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 5: Synchronize RHEL-AV 8.5 release 18 to RHEL 9 Beta
 RH-Commit: [3/12] accc2ed549b94360bc6ab180c4266466816f122e (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 Note that the compat entries for 8.4.0 were already wired up
 in the rhel-8.4.0 machine type.
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/spapr.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index f9e8dfdfc9..653574ba91 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5083,6 +5083,19 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
     mc->max_cpus = 384;
 }
 +/*
 + * pseries-rhel8.5.0
 + * like pseries-6.0
 + */
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 +
 /*
  * pseries-rhel8.4.0
  * like pseries-5.2
@@ -5090,13 +5103,12 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 static void spapr_machine_rhel840_class_options(MachineClass *mc)
 {
 -    /* The default machine type must apply the RHEL specific defaults */
 -    spapr_machine_rhel_default_class_options(mc);
 +    spapr_machine_rhel850_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_4,
                      hw_compat_rhel_8_4_len);
 }
 -DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", true);
 +DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", false);
 /*
  * pseries-rhel8.3.0
 -- 
 2.27.0
--- a/kvm-redhat-Enable-the-test-block-iothread-test-again.patch
+++ b/kvm-redhat-Enable-the-test-block-iothread-test-again.patch
@ -1,43 +0,0 @@
 From 4231cac75289acd643c2daaa2dece485b958bef1 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 20 Aug 2021 10:27:12 +0200
 Subject: [PATCH 4/4] redhat: Enable the 'test-block-iothread' test again
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 36: Disable LTO on non-x86 architectures
 RH-Commit: [2/2] e010396f3ee0f3f39ff8bcd4749f8ae2e8624980 (thuth/qemu-kvm-cs9)
 RH-Bugzilla: 1950192
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1950192
 Now that we disabled LTO to fix the coroutines/iothreads on s390x and
 aarch64, we can also enable the 'test-block-iothread' test again.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 tests/unit/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tests/unit/meson.build b/tests/unit/meson.build
 index 244d35f5d4..b3bc2109da 100644
 --- a/tests/unit/meson.build
 +++ b/tests/unit/meson.build
@@ -65,7 +65,7 @@ if have_block
     'test-blockjob': [testblock],
     'test-blockjob-txn': [testblock],
     'test-block-backend': [testblock],
 -#    'test-block-iothread': [testblock],
 +    'test-block-iothread': [testblock],
     'test-write-threshold': [testblock],
     'test-crypto-hash': [crypto],
     'test-crypto-hmac': [crypto],
 -- 
 2.27.0
--- a/kvm-redhat-add-missing-entries-in-hw_compat_rhel_8_4.patch
+++ b/kvm-redhat-add-missing-entries-in-hw_compat_rhel_8_4.patch
@ -1,42 +0,0 @@
 From 8be260b07df50891463e6efbd45f84b1b8323983 Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Mon, 10 May 2021 15:37:39 -0400
 Subject: [PATCH 07/15] redhat: add missing entries in hw_compat_rhel_8_4
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 5: Synchronize RHEL-AV 8.5 release 18 to RHEL 9 Beta
 RH-Commit: [2/12] 69b6e4dff872478b6d0b09b2587f55967e1c9740 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 Some entries from hw_compat_5_2 were missing.
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 848e7fdff6..c665e869de 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_4[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
     { "PIIX4_PM", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-net-pci", "vectors", "3"},
 };
 const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 -- 
 2.27.0
--- a/kvm-redhat-s390x-add-rhel-8.5.0-compat-machine.patch
+++ b/kvm-redhat-s390x-add-rhel-8.5.0-compat-machine.patch
@ -1,59 +0,0 @@
 From a5e149c13279386c4fc3fae130289ac4ac53bd3e Mon Sep 17 00:00:00 2001
 From: Cornelia Huck <cohuck@redhat.com>
 Date: Mon, 10 May 2021 14:41:31 -0400
 Subject: [PATCH 06/15] redhat: s390x: add rhel-8.5.0 compat machine
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 5: Synchronize RHEL-AV 8.5 release 18 to RHEL 9 Beta
 RH-Commit: [1/12] 3560ef3f773425f1479a131df7a351df2cbb502c (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 Note that the compat entries for 8.4.0 were already wired up
 in the rhel-8.4.0 machine type.
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 432f36bce5..667a99f336 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1074,15 +1074,26 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 #endif
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 static void ccw_machine_rhel840_instance_options(MachineState *machine)
 {
 +    ccw_machine_rhel850_instance_options(machine);
 }
 static void ccw_machine_rhel840_class_options(MachineClass *mc)
 {
 +    ccw_machine_rhel850_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 }
 -DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", true);
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 static void ccw_machine_rhel820_instance_options(MachineState *machine)
 {
 -- 
 2.27.0
--- a/kvm-redhat-x86-Enable-kvm-asyncpf-int-by-default.patch
+++ b/kvm-redhat-x86-Enable-kvm-asyncpf-int-by-default.patch
@ -1,49 +0,0 @@
 From a9546384e1fe8b4dad9ab00c52f45dac3a8fbc00 Mon Sep 17 00:00:00 2001
 From: Vitaly Kuznetsov <vkuznets@redhat.com>
 Date: Tue, 8 Jun 2021 10:29:07 -0400
 Subject: [PATCH 04/12] redhat: x86: Enable 'kvm-asyncpf-int' by default
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 16: Synchronize with RHEL-AV 8.5 release 21 to RHEL 9
 RH-Commit: [2/8] 2ea940445291df74dfed2d2f9f2b1f88a3eca31b (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 'kvm-asyncpf-int' feature is supported by KVM starting with RHEL-8.4
 kernel, enable the feature by default starting with RHEL-8.5 machine
 type.
 Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 0a374dec39..cdbfa84d2e 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -366,12 +366,15 @@ GlobalProperty pc_rhel_compat[] = {
     { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
     /* bz 1508330 */ 
     { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 GlobalProperty pc_rhel_8_4_compat[] = {
     /* pc_rhel_8_4_compat from pc_compat_5_2 */
     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
 };
 const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
 -- 
 2.27.0
--- a/kvm-s390x-cpumodel-add-3931-and-3932.patch
+++ b/kvm-s390x-cpumodel-add-3931-and-3932.patch
@ -1,134 +0,0 @@
 From 5536da8458b7825b084bfc94256bfdc1ca0127a3 Mon Sep 17 00:00:00 2001
 From: Christian Borntraeger <borntraeger@de.ibm.com>
 Date: Tue, 22 Jun 2021 22:19:23 +0200
 Subject: [PATCH 1/6] s390x/cpumodel: add 3931 and 3932
 RH-Author: Cornelia Huck <cohuck@redhat.com>
 RH-MergeRequest: 21: s390x/cpumodel: add 3931 and 3932
 RH-Commit: [1/1] b678fdf9364407c615678980330e496676e04f9e (cohuck/qemu-kvm-c9s)
 RH-Bugzilla: 1932191
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 This defines 5 new facilities and the new 3931 and 3932 machines.
 As before the name is not yet known and we do use gen16a and gen16b.
 The new features are part of the full model.
 The default model is still empty (same as z15) and will be added
 in a separate patch at a later point in time.
 Also add the dependencies of new facilities and as a fix for z15 add
 a dependency from S390_FEAT_VECTOR_PACKED_DECIMAL_ENH to
 S390_VECTOR_PACKED_DECIMAL.
 [merged <20210701084348.26556-1-borntraeger@de.ibm.com>]
 Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
 Message-Id: <20210622201923.150205-2-borntraeger@de.ibm.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit fb4a08121695a88acefcbcd86f1376df079eefee)
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 target/s390x/cpu_features_def.h.inc |  5 +++++
 target/s390x/cpu_models.c           |  6 ++++++
 target/s390x/gen-features.c         | 14 ++++++++++++++
 3 files changed, 25 insertions(+)
 diff --git a/target/s390x/cpu_features_def.h.inc b/target/s390x/cpu_features_def.h.inc
 index 7db3449e04..e86662bb3b 100644
 --- a/target/s390x/cpu_features_def.h.inc
 +++ b/target/s390x/cpu_features_def.h.inc
@@ -109,6 +109,11 @@ DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH, "vxpdeh", STFL, 152, "Vector-Packed-Decimal-
 DEF_FEAT(MSA_EXT_9, "msa9-base", STFL, 155, "Message-security-assist-extension-9 facility (excluding subfunctions)")
 DEF_FEAT(ETOKEN, "etoken", STFL, 156, "Etoken facility")
 DEF_FEAT(UNPACK, "unpack", STFL, 161, "Unpack facility")
 +DEF_FEAT(NNPA, "nnpa", STFL, 165, "NNPA facility")
 +DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH2, "vxpdeh2", STFL, 192, "Vector-Packed-Decimal-Enhancement facility 2")
 +DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
 +DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
 +DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
 /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
 DEF_FEAT(SIE_GSLS, "gsls", SCLP_CONF_CHAR, 40, "SIE: Guest-storage-limit-suppression facility")
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 9254ff46bf..3cb4d25a10 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -88,6 +88,8 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x3907, 14, 1, 47, 0x08000000U, "z14ZR1", "IBM z14 Model ZR1 GA1"),
     CPUDEF_INIT(0x8561, 15, 1, 47, 0x08000000U, "gen15a", "IBM z15 T01 GA1"),
     CPUDEF_INIT(0x8562, 15, 1, 47, 0x08000000U, "gen15b", "IBM z15 T02 GA1"),
 +    CPUDEF_INIT(0x3931, 16, 1, 47, 0x08000000U, "gen16a", "IBM 3931 GA1"),
 +    CPUDEF_INIT(0x3932, 16, 1, 47, 0x08000000U, "gen16b", "IBM 3932 GA1"),
 };
 #define QEMU_MAX_CPU_TYPE 0x2964
@@ -815,6 +817,8 @@ static void check_consistency(const S390CPUModel *model)
         { S390_FEAT_MSA_EXT_9, S390_FEAT_MSA_EXT_4 },
         { S390_FEAT_MULTIPLE_EPOCH, S390_FEAT_TOD_CLOCK_STEERING },
         { S390_FEAT_VECTOR_PACKED_DECIMAL, S390_FEAT_VECTOR },
 +        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
 +        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
         { S390_FEAT_INSTRUCTION_EXEC_PROT, S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2 },
         { S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2, S390_FEAT_ESOP },
@@ -846,6 +850,8 @@ static void check_consistency(const S390CPUModel *model)
         { S390_FEAT_PTFF_STOUE, S390_FEAT_MULTIPLE_EPOCH },
         { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP },
         { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB },
 +        { S390_FEAT_NNPA, S390_FEAT_VECTOR },
 +        { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING },
     };
     int i;
 diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
 index a6ec918e90..8f99cea665 100644
 --- a/target/s390x/gen-features.c
 +++ b/target/s390x/gen-features.c
@@ -424,6 +424,8 @@ static uint16_t base_GEN15_GA1[] = {
     S390_FEAT_MISC_INSTRUCTION_EXT3,
 };
 +#define base_GEN16_GA1 EmptyFeat
 +
 /* Full features (in order of release)
  * Automatically includes corresponding base features.
  * Full features are all features this hardware supports even if kvm/QEMU do not
@@ -567,6 +569,15 @@ static uint16_t full_GEN15_GA1[] = {
     S390_FEAT_UNPACK,
 };
 +static uint16_t full_GEN16_GA1[] = {
 +    S390_FEAT_NNPA,
 +    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2,
 +    S390_FEAT_BEAR_ENH,
 +    S390_FEAT_RDP,
 +    S390_FEAT_PAI,
 +};
 +
 +
 /* Default features (in order of release)
  * Automatically includes corresponding base features.
  * Default features are all features this version of QEMU supports for this
@@ -652,6 +663,8 @@ static uint16_t default_GEN15_GA1[] = {
     S390_FEAT_ETOKEN,
 };
 +#define default_GEN16_GA1 EmptyFeat
 +
 /* QEMU (CPU model) features */
 static uint16_t qemu_V2_11[] = {
@@ -782,6 +795,7 @@ static CpuFeatDefSpec CpuFeatDef[] = {
     CPU_FEAT_INITIALIZER(GEN14_GA1),
     CPU_FEAT_INITIALIZER(GEN14_GA2),
     CPU_FEAT_INITIALIZER(GEN15_GA1),
 +    CPU_FEAT_INITIALIZER(GEN16_GA1),
 };
 #define FEAT_GROUP_INITIALIZER(_name)                  \
 -- 
 2.27.0
--- a/kvm-s390x-css-Add-passthrough-IRB.patch
+++ b/kvm-s390x-css-Add-passthrough-IRB.patch
@ -1,127 +0,0 @@
 From 4eb1f0936bfc921cad9af37f1573075148843b1d Mon Sep 17 00:00:00 2001
 From: Eric Farman <farman@linux.ibm.com>
 Date: Thu, 24 Jun 2021 14:15:16 -0400
 Subject: [PATCH 04/43] s390x/css: Add passthrough IRB
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 Wire in the subchannel callback for building the IRB
 ESW and ECW space for passthrough devices, and copy
 the hardware's ESW into the IRB we are building.
 If the hardware presented concurrent sense, then copy
 that sense data into the IRB's ECW space.
 Signed-off-by: Eric Farman <farman@linux.ibm.com>
 Message-Id: <20210617232537.1337506-5-farman@linux.ibm.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit c626710fc755628d0d6b88aab0514c9238a84522)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/css.c         | 16 +++++++++++++++-
 hw/s390x/s390-ccw.c    |  1 +
 hw/vfio/ccw.c          |  4 ++++
 include/hw/s390x/css.h |  3 +++
 4 files changed, 23 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/css.c b/hw/s390x/css.c
 index e77a0e523d..c3150da4f7 100644
 --- a/hw/s390x/css.c
 +++ b/hw/s390x/css.c
@@ -1336,7 +1336,7 @@ static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
     }
 }
 -static void copy_esw_to_guest(ESW *dest, const ESW *src)
 +void copy_esw_to_guest(ESW *dest, const ESW *src)
 {
     dest->word0 = cpu_to_be32(src->word0);
     dest->erw = cpu_to_be32(src->erw);
@@ -1651,6 +1651,20 @@ static void build_irb_sense_data(SubchDev *sch, IRB *irb)
     }
 }
 +void build_irb_passthrough(SubchDev *sch, IRB *irb)
 +{
 +    /* Copy ESW from hardware */
 +    irb->esw = sch->esw;
 +
 +    /*
 +     * If (irb->esw.erw & ESW_ERW_SENSE) is true, then the contents
 +     * of the ECW is sense data. If false, then it is model-dependent
 +     * information. Either way, copy it into the IRB for the guest to
 +     * read/decide what to do with.
 +     */
 +    build_irb_sense_data(sch, irb);
 +}
 +
 void build_irb_virtual(SubchDev *sch, IRB *irb)
 {
     SCHIB *schib = &sch->curr_status;
 diff --git a/hw/s390x/s390-ccw.c b/hw/s390x/s390-ccw.c
 index b497571863..39cbea615b 100644
 --- a/hw/s390x/s390-ccw.c
 +++ b/hw/s390x/s390-ccw.c
@@ -125,6 +125,7 @@ static void s390_ccw_realize(S390CCWDevice *cdev, char *sysfsdev, Error **errp)
     }
     sch->driver_data = cdev;
     sch->do_subchannel_work = do_subchannel_work_passthrough;
 +    sch->irb_cb = build_irb_passthrough;
     ccw_dev->sch = sch;
     ret = css_sch_build_schib(sch, &cdev->hostid);
 diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
 index b2df708e4b..5f141d44a4 100644
 --- a/hw/vfio/ccw.c
 +++ b/hw/vfio/ccw.c
@@ -322,6 +322,7 @@ static void vfio_ccw_io_notifier_handler(void *opaque)
     SCHIB *schib = &sch->curr_status;
     SCSW s;
     IRB irb;
 +    ESW esw;
     int size;
     if (!event_notifier_test_and_clear(&vcdev->io_notifier)) {
@@ -372,6 +373,9 @@ static void vfio_ccw_io_notifier_handler(void *opaque)
     copy_scsw_to_guest(&s, &irb.scsw);
     schib->scsw = s;
 +    copy_esw_to_guest(&esw, &irb.esw);
 +    sch->esw = esw;
 +
     /* If a uint check is pending, copy sense data. */
     if ((schib->scsw.dstat & SCSW_DSTAT_UNIT_CHECK) &&
         (schib->pmcw.chars & PMCW_CHARS_MASK_CSENSE)) {
 diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h
 index 7c23a13f3d..10ed1df1bb 100644
 --- a/include/hw/s390x/css.h
 +++ b/include/hw/s390x/css.h
@@ -141,6 +141,7 @@ struct SubchDev {
     void (*irb_cb)(SubchDev *, IRB *);
     SenseId id;
     void *driver_data;
 +    ESW esw;
 };
 static inline void sch_gen_unit_exception(SubchDev *sch)
@@ -202,6 +203,7 @@ int css_sch_build_schib(SubchDev *sch, CssDevId *dev_id);
 unsigned int css_find_free_chpid(uint8_t cssid);
 uint16_t css_build_subchannel_id(SubchDev *sch);
 void copy_scsw_to_guest(SCSW *dest, const SCSW *src);
 +void copy_esw_to_guest(ESW *dest, const ESW *src);
 void css_inject_io_interrupt(SubchDev *sch);
 void css_reset(void);
 void css_reset_sch(SubchDev *sch);
@@ -216,6 +218,7 @@ void css_clear_sei_pending(void);
 IOInstEnding s390_ccw_cmd_request(SubchDev *sch);
 IOInstEnding do_subchannel_work_virtual(SubchDev *sub);
 IOInstEnding do_subchannel_work_passthrough(SubchDev *sub);
 +void build_irb_passthrough(SubchDev *sch, IRB *irb);
 void build_irb_virtual(SubchDev *sch, IRB *irb);
 int s390_ccw_halt(SubchDev *sch);
 -- 
 2.27.0
--- a/kvm-s390x-css-Introduce-an-ESW-struct.patch
+++ b/kvm-s390x-css-Introduce-an-ESW-struct.patch
@ -1,111 +0,0 @@
 From 9a12329325d94ab56dbab976b4423fe7db0e8d0b Mon Sep 17 00:00:00 2001
 From: Eric Farman <farman@linux.ibm.com>
 Date: Thu, 24 Jun 2021 14:15:13 -0400
 Subject: [PATCH 01/43] s390x/css: Introduce an ESW struct
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 The Interrupt Response Block is comprised of several other
 structures concatenated together, but only the 12-byte
 Subchannel-Status Word (SCSW) is defined as a proper struct.
 Everything else is a simple array of 32-bit words.
 Let's define a proper struct for the 20-byte Extended-Status
 Word (ESW) so that we can make good decisions about the sense
 data that would go into the ECW area for virtual vs
 passthrough devices.
 [CH: adapted ESW definition to build with mingw, as discussed]
 Signed-off-by: Eric Farman <farman@linux.ibm.com>
 Message-Id: <20210617232537.1337506-2-farman@linux.ibm.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit 3fdc622ad79636f3d7f8bed50a53bc28af1850e1)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/css.c            | 19 +++++++++++++------
 include/hw/s390x/ioinst.h | 12 +++++++++++-
 2 files changed, 24 insertions(+), 7 deletions(-)
 diff --git a/hw/s390x/css.c b/hw/s390x/css.c
 index 4149b8e5a7..bd3172a688 100644
 --- a/hw/s390x/css.c
 +++ b/hw/s390x/css.c
@@ -1336,6 +1336,14 @@ static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
     }
 }
 +static void copy_esw_to_guest(ESW *dest, const ESW *src)
 +{
 +    dest->word0 = cpu_to_be32(src->word0);
 +    dest->erw = cpu_to_be32(src->erw);
 +    dest->word2 = cpu_to_be64(src->word2);
 +    dest->word4 = cpu_to_be32(src->word4);
 +}
 +
 IOInstEnding css_do_stsch(SubchDev *sch, SCHIB *schib)
 {
     int ret;
@@ -1605,9 +1613,8 @@ static void copy_irb_to_guest(IRB *dest, const IRB *src, const PMCW *pmcw,
     copy_scsw_to_guest(&dest->scsw, &src->scsw);
 -    for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
 -        dest->esw[i] = cpu_to_be32(src->esw[i]);
 -    }
 +    copy_esw_to_guest(&dest->esw, &src->esw);
 +
     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
     }
@@ -1656,9 +1663,9 @@ int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
                         SCSW_CSTAT_CHN_CTRL_CHK |
                         SCSW_CSTAT_INTF_CTRL_CHK)) {
             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
 -            irb.esw[0] = 0x04804000;
 +            irb.esw.word0 = 0x04804000;
         } else {
 -            irb.esw[0] = 0x00800000;
 +            irb.esw.word0 = 0x00800000;
         }
         /* If a unit check is pending, copy sense data. */
         if ((schib->scsw.dstat & SCSW_DSTAT_UNIT_CHECK) &&
@@ -1671,7 +1678,7 @@ int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
             }
 -            irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
 +            irb.esw.erw = ESW_ERW_SENSE | (sizeof(sch->sense_data) << 8);
         }
     }
     /* Store the irb to the guest. */
 diff --git a/include/hw/s390x/ioinst.h b/include/hw/s390x/ioinst.h
 index c6737a30d4..3771fff9d4 100644
 --- a/include/hw/s390x/ioinst.h
 +++ b/include/hw/s390x/ioinst.h
@@ -123,10 +123,20 @@ typedef struct SCHIB {
     uint8_t mda[4];
 } QEMU_PACKED SCHIB;
 +/* format-0 extended-status word */
 +typedef struct ESW {
 +    uint32_t word0;      /* subchannel logout for format 0 */
 +    uint32_t erw;
 +    uint64_t word2;     /* failing-storage address for format 0 */
 +    uint32_t word4;     /* secondary-CCW address for format 0 */
 +} QEMU_PACKED ESW;
 +
 +#define ESW_ERW_SENSE 0x01000000
 +
 /* interruption response block */
 typedef struct IRB {
     SCSW scsw;
 -    uint32_t esw[5];
 +    ESW esw;
     uint32_t ecw[8];
     uint32_t emw[8];
 } IRB;
 -- 
 2.27.0
--- a/kvm-s390x-css-Refactor-IRB-construction.patch
+++ b/kvm-s390x-css-Refactor-IRB-construction.patch
@ -1,144 +0,0 @@
 From 0f4d8c51b51a23a87f1e3e9e764151352f652f3b Mon Sep 17 00:00:00 2001
 From: Eric Farman <farman@linux.ibm.com>
 Date: Thu, 24 Jun 2021 14:15:15 -0400
 Subject: [PATCH 03/43] s390x/css: Refactor IRB construction
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 Currently, all subchannel types have "sense data" copied into
 the IRB.ECW space, and a couple flags enabled in the IRB.SCSW
 and IRB.ESW. But for passthrough (vfio-ccw) subchannels,
 this data isn't populated in the first place, so enabling
 those flags leads to unexpected behavior if the guest tries to
 process the sense data (zeros) in the IRB.ECW.
 Let's add a subchannel callback that builds these portions of
 the IRB, and move the existing code into a routine for those
 virtual subchannels. The passthrough subchannels will be able
 to piggy-back onto this later.
 Signed-off-by: Eric Farman <farman@linux.ibm.com>
 Message-Id: <20210617232537.1337506-4-farman@linux.ibm.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit 0599a046acf1b625e97cef0aa702b5d86528c642)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/3270-ccw.c    |  1 +
 hw/s390x/css.c         | 45 +++++++++++++++++++++++++++---------------
 hw/s390x/virtio-ccw.c  |  1 +
 include/hw/s390x/css.h |  2 ++
 4 files changed, 33 insertions(+), 16 deletions(-)
 diff --git a/hw/s390x/3270-ccw.c b/hw/s390x/3270-ccw.c
 index f3e7342b1e..9efee591f9 100644
 --- a/hw/s390x/3270-ccw.c
 +++ b/hw/s390x/3270-ccw.c
@@ -130,6 +130,7 @@ static void emulated_ccw_3270_realize(DeviceState *ds, Error **errp)
                                 EMULATED_CCW_3270_CHPID_TYPE);
     sch->do_subchannel_work = do_subchannel_work_virtual;
     sch->ccw_cb = emulated_ccw_3270_cb;
 +    sch->irb_cb = build_irb_virtual;
     ck->init(dev, &err);
     if (err) {
 diff --git a/hw/s390x/css.c b/hw/s390x/css.c
 index fac7d5b39d..e77a0e523d 100644
 --- a/hw/s390x/css.c
 +++ b/hw/s390x/css.c
@@ -1651,6 +1651,30 @@ static void build_irb_sense_data(SubchDev *sch, IRB *irb)
     }
 }
 +void build_irb_virtual(SubchDev *sch, IRB *irb)
 +{
 +    SCHIB *schib = &sch->curr_status;
 +    uint16_t stctl = schib->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
 +
 +    if (stctl & SCSW_STCTL_STATUS_PEND) {
 +        if (schib->scsw.cstat & (SCSW_CSTAT_DATA_CHECK |
 +                        SCSW_CSTAT_CHN_CTRL_CHK |
 +                        SCSW_CSTAT_INTF_CTRL_CHK)) {
 +            irb->scsw.flags |= SCSW_FLAGS_MASK_ESWF;
 +            irb->esw.word0 = 0x04804000;
 +        } else {
 +            irb->esw.word0 = 0x00800000;
 +        }
 +        /* If a unit check is pending, copy sense data. */
 +        if ((schib->scsw.dstat & SCSW_DSTAT_UNIT_CHECK) &&
 +            (schib->pmcw.chars & PMCW_CHARS_MASK_CSENSE)) {
 +            irb->scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
 +            build_irb_sense_data(sch, irb);
 +            irb->esw.erw = ESW_ERW_SENSE | (sizeof(sch->sense_data) << 8);
 +        }
 +    }
 +}
 +
 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
 {
     SCHIB *schib = &sch->curr_status;
@@ -1669,23 +1693,12 @@ int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
     /* Copy scsw from current status. */
     irb.scsw = schib->scsw;
 -    if (stctl & SCSW_STCTL_STATUS_PEND) {
 -        if (schib->scsw.cstat & (SCSW_CSTAT_DATA_CHECK |
 -                        SCSW_CSTAT_CHN_CTRL_CHK |
 -                        SCSW_CSTAT_INTF_CTRL_CHK)) {
 -            irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
 -            irb.esw.word0 = 0x04804000;
 -        } else {
 -            irb.esw.word0 = 0x00800000;
 -        }
 -        /* If a unit check is pending, copy sense data. */
 -        if ((schib->scsw.dstat & SCSW_DSTAT_UNIT_CHECK) &&
 -            (schib->pmcw.chars & PMCW_CHARS_MASK_CSENSE)) {
 -            irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
 -            build_irb_sense_data(sch, &irb);
 -            irb.esw.erw = ESW_ERW_SENSE | (sizeof(sch->sense_data) << 8);
 -        }
 +
 +    /* Build other IRB data, if necessary */
 +    if (sch->irb_cb) {
 +        sch->irb_cb(sch, &irb);
     }
 +
     /* Store the irb to the guest. */
     p = schib->pmcw;
     copy_irb_to_guest(target_irb, &irb, &p, irb_len);
 diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
 index 8195f3546e..5a1eb39325 100644
 --- a/hw/s390x/virtio-ccw.c
 +++ b/hw/s390x/virtio-ccw.c
@@ -754,6 +754,7 @@ static void virtio_ccw_device_realize(VirtioCcwDevice *dev, Error **errp)
     sch->id.reserved = 0xff;
     sch->id.cu_type = VIRTIO_CCW_CU_TYPE;
     sch->do_subchannel_work = do_subchannel_work_virtual;
 +    sch->irb_cb = build_irb_virtual;
     ccw_dev->sch = sch;
     dev->indicators = NULL;
     dev->revision = -1;
 diff --git a/include/hw/s390x/css.h b/include/hw/s390x/css.h
 index bba7593d2e..7c23a13f3d 100644
 --- a/include/hw/s390x/css.h
 +++ b/include/hw/s390x/css.h
@@ -138,6 +138,7 @@ struct SubchDev {
     int (*ccw_cb) (SubchDev *, CCW1);
     void (*disable_cb)(SubchDev *);
     IOInstEnding (*do_subchannel_work) (SubchDev *);
 +    void (*irb_cb)(SubchDev *, IRB *);
     SenseId id;
     void *driver_data;
 };
@@ -215,6 +216,7 @@ void css_clear_sei_pending(void);
 IOInstEnding s390_ccw_cmd_request(SubchDev *sch);
 IOInstEnding do_subchannel_work_virtual(SubchDev *sub);
 IOInstEnding do_subchannel_work_passthrough(SubchDev *sub);
 +void build_irb_virtual(SubchDev *sch, IRB *irb);
 int s390_ccw_halt(SubchDev *sch);
 int s390_ccw_clear(SubchDev *sch);
 -- 
 2.27.0
--- a/kvm-s390x-css-Split-out-the-IRB-sense-data.patch
+++ b/kvm-s390x-css-Split-out-the-IRB-sense-data.patch
@ -1,63 +0,0 @@
 From a987dfced200adf1e4c2d3c39f0b5da0fb7e6ead Mon Sep 17 00:00:00 2001
 From: Eric Farman <farman@linux.ibm.com>
 Date: Thu, 24 Jun 2021 14:15:14 -0400
 Subject: [PATCH 02/43] s390x/css: Split out the IRB sense data
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 Let's move this logic into its own routine,
 so it can be reused later.
 Signed-off-by: Eric Farman <farman@linux.ibm.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-Id: <20210617232537.1337506-3-farman@linux.ibm.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 (cherry picked from commit 1b01dedaed41c2ca6129475c22b7b778b109fae8)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/css.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
 diff --git a/hw/s390x/css.c b/hw/s390x/css.c
 index bd3172a688..fac7d5b39d 100644
 --- a/hw/s390x/css.c
 +++ b/hw/s390x/css.c
@@ -1640,6 +1640,17 @@ static void copy_irb_to_guest(IRB *dest, const IRB *src, const PMCW *pmcw,
     *irb_len = sizeof(*dest);
 }
 +static void build_irb_sense_data(SubchDev *sch, IRB *irb)
 +{
 +    int i;
 +
 +    /* Attention: sense_data is already BE! */
 +    memcpy(irb->ecw, sch->sense_data, sizeof(sch->sense_data));
 +    for (i = 0; i < ARRAY_SIZE(irb->ecw); i++) {
 +        irb->ecw[i] = be32_to_cpu(irb->ecw[i]);
 +    }
 +}
 +
 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
 {
     SCHIB *schib = &sch->curr_status;
@@ -1670,14 +1681,8 @@ int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
         /* If a unit check is pending, copy sense data. */
         if ((schib->scsw.dstat & SCSW_DSTAT_UNIT_CHECK) &&
             (schib->pmcw.chars & PMCW_CHARS_MASK_CSENSE)) {
 -            int i;
 -
             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
 -            /* Attention: sense_data is already BE! */
 -            memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
 -            for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
 -                irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
 -            }
 +            build_irb_sense_data(sch, &irb);
             irb.esw.erw = ESW_ERW_SENSE | (sizeof(sch->sense_data) << 8);
         }
     }
 -- 
 2.27.0
--- a/kvm-s390x-redhat-disable-experimental-3270-device.patch
+++ b/kvm-s390x-redhat-disable-experimental-3270-device.patch
@ -1,40 +0,0 @@
 From 5101527fb425c2d17ef04b0ed87b3810cf6db7bc Mon Sep 17 00:00:00 2001
 From: Cornelia Huck <cohuck@redhat.com>
 Date: Wed, 26 May 2021 11:01:00 +0200
 Subject: [PATCH] s390x/redhat: disable experimental 3270 device
 RH-Author: Cornelia Huck <cohuck@redhat.com>
 RH-MergeRequest: 9: Disable the 'x-terminal3270' device in qemu-kvm on s390x
 RH-Commit: [1/1] 1df70e856fba434d06587a05c44c4dc5a367f1f7 (cohuck/qemu-kvm)
 RH-Bugzilla: 1962479
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 The "x-terminal3270" device has been experimental for years,
 has known limitations, has no known users anymore, and is not
 supported by libvirt.
 Therefore, disable it in our downstream builds, as it is not
 really supported.
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 ---
 default-configs/devices/s390x-rh-devices.mak | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/default-configs/devices/s390x-rh-devices.mak b/default-configs/devices/s390x-rh-devices.mak
 index 08a15f3e01..fe8613b8f6 100644
 --- a/default-configs/devices/s390x-rh-devices.mak
 +++ b/default-configs/devices/s390x-rh-devices.mak
@@ -6,7 +6,6 @@ CONFIG_S390_FLIC=y
 CONFIG_S390_FLIC_KVM=y
 CONFIG_SCLPCONSOLE=y
 CONFIG_SCSI=y
 -CONFIG_TERMINAL3270=y
 CONFIG_VFIO=y
 CONFIG_VFIO_AP=y
 CONFIG_VFIO_CCW=y
 -- 
 2.27.0
--- a/kvm-scsi-generic-pass-max_segments-via-max_iov-field-in-.patch
+++ b/kvm-scsi-generic-pass-max_segments-via-max_iov-field-in-.patch
@ -1,64 +0,0 @@
 From 05038edf628c6bca7cef061b7b1fac2b0b2163af Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 16 Jul 2021 16:51:30 -0400
 Subject: [PATCH 14/43] scsi-generic: pass max_segments via max_iov field in
 BlockLimits
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Bugzilla: 1957194
 I/O to a disk via read/write is not limited by the number of segments allowed
 by the host adapter; the kernel can split requests if needed, and the limit
 imposed by the host adapter can be very low (256k or so) to avoid that SG_IO
 returns EINVAL if memory is heavily fragmented.
 Since this value is only interesting for SG_IO-based I/O, do not include
 it in the max_transfer and only take it into account when patching the
 block limits VPD page in the scsi-generic device.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 (cherry picked from commit 01ef8185b809af9d287e1a03a3f9d8ea8231118a)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 block/file-posix.c     | 3 +--
 hw/scsi/scsi-generic.c | 6 ++++--
 2 files changed, 5 insertions(+), 4 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 74d4903dc1..1a6c799e19 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -1263,8 +1263,7 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
         ret = sg_get_max_segments(s->fd);
         if (ret > 0) {
 -            bs->bl.max_transfer = MIN(bs->bl.max_transfer,
 -                                      ret * qemu_real_host_page_size);
 +            bs->bl.max_iov = ret;
         }
     }
 diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
 index 98c30c5d5c..82e1e2ee79 100644
 --- a/hw/scsi/scsi-generic.c
 +++ b/hw/scsi/scsi-generic.c
@@ -179,10 +179,12 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s)
         (r->req.cmd.buf[1] & 0x01)) {
         page = r->req.cmd.buf[2];
         if (page == 0xb0) {
 -            uint32_t max_transfer =
 -                blk_get_max_transfer(s->conf.blk) / s->blocksize;
 +            uint32_t max_transfer = blk_get_max_transfer(s->conf.blk);
 +            uint32_t max_iov = blk_get_max_iov(s->conf.blk);
             assert(max_transfer);
 +            max_transfer = MIN_NON_ZERO(max_transfer, max_iov * qemu_real_host_page_size)
 +                / s->blocksize;
             stl_be_p(&r->buf[8], max_transfer);
             /* Also take care of the opt xfer len. */
             stl_be_p(&r->buf[12],
 -- 
 2.27.0
--- a/kvm-sockets-update-SOCKET_ADDRESS_TYPE_FD-listen-2-backl.patch
+++ b/kvm-sockets-update-SOCKET_ADDRESS_TYPE_FD-listen-2-backl.patch
@ -1,115 +0,0 @@
 From 415a6a1ced90cc8b8691eb7ab027bba4611fc236 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Wed, 2 Jun 2021 15:51:02 -0400
 Subject: [PATCH 04/21] sockets: update SOCKET_ADDRESS_TYPE_FD listen(2)
 backlog
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [3/8] a8fd97eb477ad51fca75c1cc344185e1de59caf1 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 socket_get_fd() fails with the error "socket_get_fd: too many
 connections" if the given listen backlog value is not 1.
 Not all callers set the backlog to 1. For example, commit
 582d4210eb2f2ab5baac328fe4b479cd86da1647 ("qemu-nbd: Use SOMAXCONN for
 socket listen() backlog") uses SOMAXCONN. This will always fail with in
 socket_get_fd().
 This patch calls listen(2) on the fd to update the backlog value. The
 socket may already be in the listen state. I have tested that this works
 on Linux 5.10 and macOS Catalina.
 As a bonus this allows us to detect when the fd cannot listen. Now we'll
 be able to catch unbound or connected fds in socket_listen().
 Drop the num argument from socket_get_fd() since this function is also
 called by socket_connect() where a listen backlog value does not make
 sense.
 Fixes: e5b6353cf25c99c3f08bf51e29933352f7140e8f ("socket: Add backlog parameter to socket_listen")
 Reported-by: Richard W.M. Jones <rjones@redhat.com>
 Cc: Juan Quintela <quintela@redhat.com>
 Cc: Eric Blake <eblake@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20210310173004.420190-1-stefanha@redhat.com>
 Tested-by: Richard W.M. Jones <rjones@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 37179e9ea45d6428b29ae789209c119ac18c1d39)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 util/qemu-sockets.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)
 diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
 index 8af0278f15..2463c49773 100644
 --- a/util/qemu-sockets.c
 +++ b/util/qemu-sockets.c
@@ -1116,14 +1116,10 @@ fail:
     return NULL;
 }
 -static int socket_get_fd(const char *fdstr, int num, Error **errp)
 +static int socket_get_fd(const char *fdstr, Error **errp)
 {
     Monitor *cur_mon = monitor_cur();
     int fd;
 -    if (num != 1) {
 -        error_setg_errno(errp, EINVAL, "socket_get_fd: too many connections");
 -        return -1;
 -    }
     if (cur_mon) {
         fd = monitor_get_fd(cur_mon, fdstr, errp);
         if (fd < 0) {
@@ -1159,7 +1155,7 @@ int socket_connect(SocketAddress *addr, Error **errp)
         break;
     case SOCKET_ADDRESS_TYPE_FD:
 -        fd = socket_get_fd(addr->u.fd.str, 1, errp);
 +        fd = socket_get_fd(addr->u.fd.str, errp);
         break;
     case SOCKET_ADDRESS_TYPE_VSOCK:
@@ -1187,7 +1183,26 @@ int socket_listen(SocketAddress *addr, int num, Error **errp)
         break;
     case SOCKET_ADDRESS_TYPE_FD:
 -        fd = socket_get_fd(addr->u.fd.str, num, errp);
 +        fd = socket_get_fd(addr->u.fd.str, errp);
 +        if (fd < 0) {
 +            return -1;
 +        }
 +
 +        /*
 +         * If the socket is not yet in the listen state, then transition it to
 +         * the listen state now.
 +         *
 +         * If it's already listening then this updates the backlog value as
 +         * requested.
 +         *
 +         * If this socket cannot listen because it's already in another state
 +         * (e.g. unbound or connected) then we'll catch the error here.
 +         */
 +        if (listen(fd, num) != 0) {
 +            error_setg_errno(errp, errno, "Failed to listen on fd socket");
 +            closesocket(fd);
 +            return -1;
 +        }
         break;
     case SOCKET_ADDRESS_TYPE_VSOCK:
 -- 
 2.27.0
--- a/kvm-spapr-Don-t-hijack-current_machine-boot_order.patch
+++ b/kvm-spapr-Don-t-hijack-current_machine-boot_order.patch
@ -1,115 +0,0 @@
 From b859b919acc83ea12c5c5b2991afac47e9532660 Mon Sep 17 00:00:00 2001
 From: Greg Kurz <gkurz@redhat.com>
 Date: Thu, 3 Jun 2021 13:29:40 -0400
 Subject: [PATCH 06/21] spapr: Don't hijack current_machine->boot_order
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [5/8] 04822ea86e438f013915cd46e09a33627a640a47 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 From: Greg Kurz <groug@kaod.org>
 QEMU 6.0 moved all the -boot variables to the machine. Especially, the
 removal of the boot_order static changed the handling of '-boot once'
 from:
    if (boot_once) {
        qemu_boot_set(boot_once, &error_fatal);
        qemu_register_reset(restore_boot_order, g_strdup(boot_order));
    }
 to
    if (current_machine->boot_once) {
        qemu_boot_set(current_machine->boot_once, &error_fatal);
        qemu_register_reset(restore_boot_order,
                            g_strdup(current_machine->boot_order));
    }
 This means that we now register as subsequent boot order a copy
 of current_machine->boot_once that was just set with the previous
 call to qemu_boot_set(), i.e. we never transition away from the
 once boot order.
 It is certainly fragile^Wwrong for the spapr code to hijack a
 field of the base machine type object like that. The boot order
 rework simply turned this software boundary violation into an
 actual bug.
 Have the spapr code to handle that with its own field in
 SpaprMachineState. Also kfree() the initial boot device
 string when "once" was used.
 Fixes: 4b7acd2ac821 ("vl: clean up -boot variables")
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1960119
 Cc: pbonzini@redhat.com
 Signed-off-by: Greg Kurz <groug@kaod.org>
 Message-Id: <20210521160735.1901914-1-groug@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit 3bf0844f3be77b24cc8f56fc8df9ff199f8324cb)
 Signed-off-by: Greg Kurz <gkurz@redhat.com>
 Conflicts:
 	include/hw/ppc/spapr.h
 Trivial context conflict because downstream has experimental support
 for secure guests (f23e4b5090ba).
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/spapr.c         | 8 +++++---
 include/hw/ppc/spapr.h | 3 +++
 2 files changed, 8 insertions(+), 3 deletions(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 653574ba91..11db32c537 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -1006,7 +1006,7 @@ static void spapr_dt_chosen(SpaprMachineState *spapr, void *fdt, bool reset)
     _FDT(chosen = fdt_add_subnode(fdt, 0, "chosen"));
     if (reset) {
 -        const char *boot_device = machine->boot_order;
 +        const char *boot_device = spapr->boot_device;
         char *stdout_path = spapr_vio_stdout_path(spapr->vio_bus);
         size_t cb = 0;
         char *bootlist = get_boot_devices_list(&cb);
@@ -2364,8 +2364,10 @@ static SaveVMHandlers savevm_htab_handlers = {
 static void spapr_boot_set(void *opaque, const char *boot_device,
                            Error **errp)
 {
 -    MachineState *machine = MACHINE(opaque);
 -    machine->boot_order = g_strdup(boot_device);
 +    SpaprMachineState *spapr = SPAPR_MACHINE(opaque);
 +
 +    g_free(spapr->boot_device);
 +    spapr->boot_device = g_strdup(boot_device);
 }
 static void spapr_create_lmb_dr_connectors(SpaprMachineState *spapr)
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
 index 54cdde8980..6d15066bc3 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
@@ -227,6 +227,9 @@ struct SpaprMachineState {
     /* Secure Guest support via x-svm-allowed */
     bool svm_allowed;
 +    /* Set by -boot */
 +    char *boot_device;
 +
     /*< public >*/
     char *kvm_type;
     char *host_model;
 -- 
 2.27.0
--- a/kvm-spapr-Fix-EEH-capability-issue-on-KVM-guest-for-PCI-.patch
+++ b/kvm-spapr-Fix-EEH-capability-issue-on-KVM-guest-for-PCI-.patch
@ -1,160 +0,0 @@
 From 389b2a01f9b75575996eaab195a9697840ae5f29 Mon Sep 17 00:00:00 2001
 From: Mahesh Salgaonkar <mahesh@linux.ibm.com>
 Date: Wed, 30 Jun 2021 13:27:47 -0400
 Subject: [PATCH 2/6] spapr: Fix EEH capability issue on KVM guest for PCI
 passthru
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 22: Synchronize with RHEL-AV 8.5 release 23 to RHEL 9
 RH-Commit: [1/5] 86642761bad229c080e180ea9ebd0a4f67d2a4f7 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 With upstream kernel, especially after commit 98ba956f6a389
 ("powerpc/pseries/eeh: Rework device EEH PE determination") we see that KVM
 guest isn't able to enable EEH option for PCI pass-through devices anymore.
 [root@atest-guest ~]# dmesg | grep EEH
 [    0.032337] EEH: pSeries platform initialized
 [    0.298207] EEH: No capable adapters found: recovery disabled.
 [root@atest-guest ~]#
 So far the linux kernel was assuming pe_config_addr equal to device's
 config_addr and using it to enable EEH on the PE through ibm,set-eeh-option
 RTAS call. Which wasn't the correct way as per PAPR. The linux kernel
 commit 98ba956f6a389 fixed this flow. With that fixed, linux now uses PE
 config address returned by ibm,get-config-addr-info2 RTAS call to enable
 EEH option per-PE basis instead of per-device basis. However this has
 uncovered a bug in qemu where ibm,set-eeh-option is treating PE config
 address as per-device config address.
 Hence in qemu guest with recent kernel the ibm,set-eeh-option RTAS call
 fails with -3 return value indicating that there is no PCI device exist for
 the specified PE config address. The rtas_ibm_set_eeh_option call uses
 pci_find_device() to get the PC device that matches specific bus and devfn
 extracted from PE config address passed as argument. Thus it tries to map
 the PE config address to a single specific PCI device 'bus->devices[devfn]'
 which always results into checking device on slot 0 'bus->devices[0]'.
 This succeeds when there is a pass-through device (vfio-pci) present on
 slot 0. But in cases where there is no pass-through device present in slot
 0, but present in non-zero slots, ibm,set-eeh-option call fails to enable
 the EEH capability.
 hw/ppc/spapr_pci_vfio.c: spapr_phb_vfio_eeh_set_option()
   case RTAS_EEH_ENABLE: {
        PCIHostState *phb;
        PCIDevice *pdev;
        /*
         * The EEH functionality is enabled on basis of PCI device,
         * instead of PE. We need check the validity of the PCI
         * device address.
         */
        phb = PCI_HOST_BRIDGE(sphb);
        pdev = pci_find_device(phb->bus,
                               (addr >> 16) & 0xFF, (addr >> 8) & 0xFF);
        if (!pdev || !object_dynamic_cast(OBJECT(pdev), "vfio-pci")) {
            return RTAS_OUT_PARAM_ERROR;
        }
 hw/pci/pci.c:pci_find_device()
 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn)
 {
    bus = pci_find_bus_nr(bus, bus_num);
    if (!bus)
        return NULL;
    return bus->devices[devfn];
 }
 This patch fixes ibm,set-eeh-option to check for presence of any PCI device
 (vfio-pci) under specified bus and enable the EEH if found. The current
 code already makes sure that all the devices on that bus are from same
 iommu group (within same PE) and fail very early if it does not.
 After this fix guest is able to find EEH capable devices and enable EEH
 recovery on it.
 [root@atest-guest ~]# dmesg | grep EEH
 [    0.048139] EEH: pSeries platform initialized
 [    0.405115] EEH: Capable adapter found: recovery enabled.
 [root@atest-guest ~]#
 Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
 Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
 Message-Id: <162158429107.145117.5843504911924013125.stgit@jupiter>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 (cherry picked from commit ac9ef668321ebb6eb871a0c4dd380fa7d7891b4e)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/spapr_pci_vfio.c | 40 +++++++++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 7 deletions(-)
 diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
 index e0547b1740..6587c8cb5b 100644
 --- a/hw/ppc/spapr_pci_vfio.c
 +++ b/hw/ppc/spapr_pci_vfio.c
@@ -47,6 +47,16 @@ void spapr_phb_vfio_reset(DeviceState *qdev)
     spapr_phb_vfio_eeh_reenable(SPAPR_PCI_HOST_BRIDGE(qdev));
 }
 +static void spapr_eeh_pci_find_device(PCIBus *bus, PCIDevice *pdev,
 +                                      void *opaque)
 +{
 +    bool *found = opaque;
 +
 +    if (object_dynamic_cast(OBJECT(pdev), "vfio-pci")) {
 +        *found = true;
 +    }
 +}
 +
 int spapr_phb_vfio_eeh_set_option(SpaprPhbState *sphb,
                                   unsigned int addr, int option)
 {
@@ -59,17 +69,33 @@ int spapr_phb_vfio_eeh_set_option(SpaprPhbState *sphb,
         break;
     case RTAS_EEH_ENABLE: {
         PCIHostState *phb;
 -        PCIDevice *pdev;
 +        bool found = false;
         /*
 -         * The EEH functionality is enabled on basis of PCI device,
 -         * instead of PE. We need check the validity of the PCI
 -         * device address.
 +         * The EEH functionality is enabled per sphb level instead of
 +         * per PCI device. We have already identified this specific sphb
 +         * based on buid passed as argument to ibm,set-eeh-option rtas
 +         * call. Now we just need to check the validity of the PCI
 +         * pass-through devices (vfio-pci) under this sphb bus.
 +         * We have already validated that all the devices under this sphb
 +         * are from same iommu group (within same PE) before comming here.
 +         *
 +         * Prior to linux commit 98ba956f6a389 ("powerpc/pseries/eeh:
 +         * Rework device EEH PE determination") kernel would call
 +         * eeh-set-option for each device in the PE using the device's
 +         * config_address as the argument rather than the PE address.
 +         * Hence if we check validity of supplied config_addr whether
 +         * it matches to this PHB will cause issues with older kernel
 +         * versions v5.9 and older. If we return an error from
 +         * eeh-set-option when the argument isn't a valid PE address
 +         * then older kernels (v5.9 and older) will interpret that as
 +         * EEH not being supported.
          */
         phb = PCI_HOST_BRIDGE(sphb);
 -        pdev = pci_find_device(phb->bus,
 -                               (addr >> 16) & 0xFF, (addr >> 8) & 0xFF);
 -        if (!pdev || !object_dynamic_cast(OBJECT(pdev), "vfio-pci")) {
 +        pci_for_each_device(phb->bus, (addr >> 16) & 0xFF,
 +                            spapr_eeh_pci_find_device, &found);
 +
 +        if (!found) {
             return RTAS_OUT_PARAM_ERROR;
         }
 -- 
 2.27.0
--- a/kvm-spapr-Remove-stale-comment-about-power-saving-LPCR-b.patch
+++ b/kvm-spapr-Remove-stale-comment-about-power-saving-LPCR-b.patch
@ -1,52 +0,0 @@
 From 63933b51e447d4acb08d3900ff64d150a3f2bdf8 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 9 Jun 2021 05:58:34 -0400
 Subject: [PATCH 08/21] spapr: Remove stale comment about power-saving LPCR
 bits
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [7/8] 12872a0193d22915de5d71d8055094f9f15e63b0 (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 From: Nicholas Piggin <npiggin@gmail.com>
 Commit 47a9b551547 ("spapr: Clean up handling of LPCR power-saving exit
 bits") moved this logic but did not remove the comment from the
 previous location.
 Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
 Message-Id: <20210526091626.3388262-2-npiggin@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Greg Kurz <groug@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 (cherry picked from commit 7be3bf6c8429969f97728bb712d9a99997835607)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/spapr_rtas.c | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
 index 8a79f9c628..91c71d1c94 100644
 --- a/hw/ppc/spapr_rtas.c
 +++ b/hw/ppc/spapr_rtas.c
@@ -164,7 +164,6 @@ static void rtas_start_cpu(PowerPCCPU *callcpu, SpaprMachineState *spapr,
     env->msr = (1ULL << MSR_SF) | (1ULL << MSR_ME);
 -    /* Enable Power-saving mode Exit Cause exceptions for the new CPU */
     lpcr = env->spr[SPR_LPCR];
     if (!pcc->interrupts_big_endian(callcpu)) {
         lpcr |= LPCR_ILE;
 -- 
 2.27.0
--- a/kvm-spapr-Set-LPCR-to-current-AIL-mode-when-starting-a-n.patch
+++ b/kvm-spapr-Set-LPCR-to-current-AIL-mode-when-starting-a-n.patch
@ -1,90 +0,0 @@
 From 8bb294ea3f26a8ce01ad76c19a6de359dce0c113 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Wed, 9 Jun 2021 05:58:35 -0400
 Subject: [PATCH 09/21] spapr: Set LPCR to current AIL mode when starting a new
 CPU
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [8/8] 7a1cb27881f93c245ab9e8b8540cbd06d4f8c14f (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 From: Nicholas Piggin <npiggin@gmail.com>
 TCG does not keep track of AIL mode in a central place, it's based on
 the current LPCR[AIL] bits. Synchronize the new CPU's LPCR to the
 current LPCR in rtas_start_cpu(), similarly to the way the ILE bit is
 synchronized.
 Open-code the ILE setting as well now that the caller's LPCR is
 available directly, there is no need for the indirection.
 Without this, under both TCG and KVM, adding a POWER8/9/10 class CPU
 with a new core ID after a modern Linux has booted results in the new
 CPU's LPCR missing the LPCR[AIL]=0b11 setting that the other CPUs have.
 This can cause crashes and unexpected behaviour.
 Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
 Message-Id: <20210526091626.3388262-3-npiggin@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Greg Kurz <groug@kaod.org>
 Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 (cherry picked from commit ac559ecbea2649819e7b3fdd09f4e0243e0128db)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/ppc/spapr_rtas.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
 index 91c71d1c94..27ab339b0c 100644
 --- a/hw/ppc/spapr_rtas.c
 +++ b/hw/ppc/spapr_rtas.c
@@ -133,8 +133,8 @@ static void rtas_start_cpu(PowerPCCPU *callcpu, SpaprMachineState *spapr,
     target_ulong id, start, r3;
     PowerPCCPU *newcpu;
     CPUPPCState *env;
 -    PowerPCCPUClass *pcc;
     target_ulong lpcr;
 +    target_ulong caller_lpcr;
     if (nargs != 3 || nret != 1) {
         rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
@@ -153,7 +153,6 @@ static void rtas_start_cpu(PowerPCCPU *callcpu, SpaprMachineState *spapr,
     }
     env = &newcpu->env;
 -    pcc = POWERPC_CPU_GET_CLASS(newcpu);
     if (!CPU(newcpu)->halted) {
         rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
@@ -164,10 +163,15 @@ static void rtas_start_cpu(PowerPCCPU *callcpu, SpaprMachineState *spapr,
     env->msr = (1ULL << MSR_SF) | (1ULL << MSR_ME);
 +    caller_lpcr = callcpu->env.spr[SPR_LPCR];
     lpcr = env->spr[SPR_LPCR];
 -    if (!pcc->interrupts_big_endian(callcpu)) {
 -        lpcr |= LPCR_ILE;
 -    }
 +
 +    /* Set ILE the same way */
 +    lpcr = (lpcr & ~LPCR_ILE) | (caller_lpcr & LPCR_ILE);
 +
 +    /* Set AIL the same way */
 +    lpcr = (lpcr & ~LPCR_AIL) | (caller_lpcr & LPCR_AIL);
 +
     if (env->mmu_model == POWERPC_MMU_3_00) {
         /*
          * New cpus are expected to start in the same radix/hash mode
 -- 
 2.27.0
--- a/kvm-target-i386-Add-CPU-model-versions-supporting-xsaves.patch
+++ b/kvm-target-i386-Add-CPU-model-versions-supporting-xsaves.patch
@ -1,322 +0,0 @@
 From a7752067b45bc05f1127a62e39c38a3361bb1840 Mon Sep 17 00:00:00 2001
 From: Vitaly Kuznetsov <vkuznets@redhat.com>
 Date: Thu, 3 Jun 2021 14:04:18 -0400
 Subject: [PATCH 07/21] target/i386: Add CPU model versions supporting 'xsaves'
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 8: Synchronize with RHEL-AV 8.5 release 19 to RHEL 9
 RH-Commit: [6/8] 814973113f19a21d10a90fcbbcd881eef354933d (mrezanin/centos-src-qemu-kvm)
 RH-Bugzilla: 1957194
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Hyper-V 2016 refuses to boot on Skylake+ CPU models because they lack
 'xsaves'/'vmx-xsaves' features and this diverges from real hardware. The
 same issue emerges with AMD "EPYC" CPU model prior to version 3 which got
 'xsaves' added. EPYC-Rome/EPYC-Milan CPU models have 'xsaves' enabled from
 the very beginning so the comment blaming KVM to explain why other CPUs
 lack 'xsaves' is likely outdated.
 Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Message-Id: <20210412073952.860944-1-vkuznets@redhat.com>
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit 7bde6b18575dd79c26ce1616e0c33151e83d9d7e)
 Conflicts:
 	target/i386/cpu.c (context, skipping c1826ea6a0520)
 Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 target/i386/cpu.c | 150 +++++++++++++++++++++++++++++-----------------
 1 file changed, 94 insertions(+), 56 deletions(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index c30bb2a6b0..da47c3e50e 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2881,12 +2881,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID |
             CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
             CPUID_7_0_EBX_SMAP,
 -        /* Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component,
 -         * and the only one defined in Skylake (processor tracing)
 -         * probably will block migration anyway.
 -         */
 +        /* XSAVES is added in version 4 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -2962,6 +2957,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
 +            {
 +                .version = 4,
 +                .note = "IBRS, XSAVES, no TSX",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ }
 +                }
 +            },
             { /* end of list */ }
         }
     },
@@ -3001,12 +3005,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_EBX_AVX512VL | CPUID_7_0_EBX_CLFLUSHOPT,
         .features[FEAT_7_0_ECX] =
             CPUID_7_0_ECX_PKU,
 -        /* Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component,
 -         * and the only one defined in Skylake (processor tracing)
 -         * probably will block migration anyway.
 -         */
 +        /* XSAVES is added in version 5 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3094,6 +3093,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 }
             },
 +            {
 +                .version = 5,
 +                .note = "IBRS, XSAVES, EPT switching, no TSX",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ }
 +                }
 +            },
             { /* end of list */ }
         }
     },
@@ -3136,12 +3144,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_ECX_AVX512VNNI,
         .features[FEAT_7_0_EDX] =
             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
 -        /* Missing: XSAVES (not supported by some Linux versions,
 -                * including v4.1 to v4.12).
 -                * KVM doesn't yet expose any XSAVES state save component,
 -                * and the only one defined in Skylake (processor tracing)
 -                * probably will block migration anyway.
 -                */
 +        /* XSAVES is added in version 5 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3225,6 +3228,14 @@ static X86CPUDefinition builtin_x86_defs[] = {
                   { /* end of list */ }
               },
             },
 +            { .version = 5,
 +              .note = "ARCH_CAPABILITIES, EPT switching, XSAVES, no TSX",
 +              .props = (PropValue[]) {
 +                  { "xsaves", "on" },
 +                  { "vmx-xsaves", "on" },
 +                  { /* end of list */ }
 +              },
 +            },
             { /* end of list */ }
         }
     },
@@ -3274,13 +3285,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO,
         .features[FEAT_7_1_EAX] =
             CPUID_7_1_EAX_AVX512_BF16,
 -        /*
 -         * Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component,
 -         * and the only one defined in Skylake (processor tracing)
 -         * probably will block migration anyway.
 -         */
 +        /* XSAVES is added in version 2 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3336,6 +3341,18 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .features[FEAT_VMX_VMFUNC] = MSR_VMX_VMFUNC_EPT_SWITCHING,
         .xlevel = 0x80000008,
         .model_id = "Intel Xeon Processor (Cooperlake)",
 +        .versions = (X86CPUVersionDefinition[]) {
 +            { .version = 1 },
 +            { .version = 2,
 +              .note = "XSAVES",
 +              .props = (PropValue[]) {
 +                  { "xsaves", "on" },
 +                  { "vmx-xsaves", "on" },
 +                  { /* end of list */ }
 +              },
 +            },
 +            { /* end of list */ }
 +        }
     },
     {
         .name = "Icelake-Client",
@@ -3378,12 +3395,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_ECX_AVX512_VPOPCNTDQ,
         .features[FEAT_7_0_EDX] =
             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
 -        /* Missing: XSAVES (not supported by some Linux versions,
 -                * including v4.1 to v4.12).
 -                * KVM doesn't yet expose any XSAVES state save component,
 -                * and the only one defined in Skylake (processor tracing)
 -                * probably will block migration anyway.
 -                */
 +        /* XSAVES is added in version 3 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3451,6 +3463,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 },
             },
 +            {
 +                .version = 3,
 +                .note = "no TSX, XSAVES, deprecated",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ }
 +                },
 +            },
             { /* end of list */ }
         },
         .deprecation_note = "use Icelake-Server instead"
@@ -3499,12 +3520,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57,
         .features[FEAT_7_0_EDX] =
             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
 -        /* Missing: XSAVES (not supported by some Linux versions,
 -                * including v4.1 to v4.12).
 -                * KVM doesn't yet expose any XSAVES state save component,
 -                * and the only one defined in Skylake (processor tracing)
 -                * probably will block migration anyway.
 -                */
 +        /* XSAVES is added in version 5 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3597,6 +3613,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ }
                 },
             },
 +            {
 +                .version = 5,
 +                .note = "XSAVES",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ }
 +                },
 +            },
             { /* end of list */ }
         }
     },
@@ -3631,13 +3656,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .features[FEAT_7_0_EDX] =
             CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_ARCH_CAPABILITIES |
             CPUID_7_0_EDX_SPEC_CTRL_SSBD,
 -        /*
 -         * Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component,
 -         * and the only one defined in Skylake (processor tracing)
 -         * probably will block migration anyway.
 -         */
 +        /* XSAVES is added in version 3 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC | CPUID_XSAVE_XGETBV1,
         .features[FEAT_6_EAX] =
@@ -3704,6 +3723,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ },
                 },
             },
 +            {
 +                .version = 3,
 +                .note = "XSAVES, no MPX, no MONITOR",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ },
 +                },
 +            },
             { /* end of list */ },
         },
     },
@@ -3762,13 +3790,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_EDX_CORE_CAPABILITY,
         .features[FEAT_CORE_CAPABILITY] =
             MSR_CORE_CAP_SPLIT_LOCK_DETECT,
 -        /*
 -         * Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component,
 -         * and the only one defined in Skylake (processor tracing)
 -         * probably will block migration anyway.
 -         */
 +        /* XSAVES is is added in version 3 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -3833,6 +3855,15 @@ static X86CPUDefinition builtin_x86_defs[] = {
                     { /* end of list */ },
                 },
             },
 +            {
 +                .version = 3,
 +                .note = "XSAVES, no MPX",
 +                .props = (PropValue[]) {
 +                    { "xsaves", "on" },
 +                    { "vmx-xsaves", "on" },
 +                    { /* end of list */ },
 +                },
 +            },
             { /* end of list */ },
         },
     },
@@ -4114,11 +4145,7 @@ static X86CPUDefinition builtin_x86_defs[] = {
             CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
             CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT,
 -        /*
 -         * Missing: XSAVES (not supported by some Linux versions,
 -         * including v4.1 to v4.12).
 -         * KVM doesn't yet expose any XSAVES state save component.
 -         */
 +        /* XSAVES is added in version 2 */
         .features[FEAT_XSAVE] =
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1,
@@ -4129,6 +4156,17 @@ static X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x8000001E,
         .model_id = "Hygon Dhyana Processor",
         .cache_info = &epyc_cache_info,
 +        .versions = (X86CPUVersionDefinition[]) {
 +            { .version = 1 },
 +            { .version = 2,
 +              .note = "XSAVES",
 +              .props = (PropValue[]) {
 +                  { "xsaves", "on" },
 +                  { /* end of list */ }
 +              },
 +            },
 +            { /* end of list */ }
 +        }
     },
     {
         .name = "EPYC-Rome",
 -- 
 2.27.0
--- a/Show More
+++ b/Show More