* Tue Sep 10 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-1

- Rebase to QEMU 9.1.0 [RHEL-41246] - Resolves: RHEL-41246 (Rebase qemu-9.1 for RHEL 10.0)
2024-09-10 02:42:37 -04:00 · 2024-09-10 02:42:37 -04:00 · fbc62c39fd
commit fbc62c39fd
parent 2e02c9c5da
60 changed files with 1726 additions and 5440 deletions
--- a/.gitignore
+++ b/.gitignore
@ -29,3 +29,4 @@
 /qemu-8.1.0.tar.xz
 /qemu-8.2.0.tar.xz
 /qemu-9.0.0.tar.xz
 /qemu-9.1.0.tar.xz
--- a/0004-Initial-redhat-build.patch
+++ b/0004-Initial-redhat-build.patch
@ -1,4 +1,4 @@
-From 91262ecfbd218a95dab8491e4226674f79debf5a Mon Sep 17 00:00:00 2001
+From 7e57931a524e1e805ba8d68e75828e98c591e975 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
@ -13,25 +13,33 @@ several issues are fixed in QEMU tree:
 We disable make check due to issues with some of the tests.
 We are rebasing from qemu-kvm-9.0.0-8.el10.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.1.0 rc0):
 - Remove --disable-block-migration and --disable-pvrdma configure options (upstream)
 - Removed --disable-avx512f configure option
 - Removed qemu-vsmr-helper (changed upstream)
 ---
 .distro/Makefile                        |  101 ++
 .distro/Makefile.common                 |   42 +
 .distro/README.tests                    |   39 +
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 1250 +++++++++++++++++++++++
+ .distro/qemu-kvm.spec.template          | 1332 +++++++++++++++++++++++
 .distro/rpminspect.yaml                 |    6 +-
 .distro/scripts/extract_build_cmd.py    |   12 +
 .distro/scripts/frh.py                  |    4 +-
- .distro/scripts/process-patches.sh      |    4 +
+ .distro/scripts/process-patches.sh      |    6 +-
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 ui/vnc-auth-sasl.c                      |    2 +-
- 16 files changed, 1510 insertions(+), 6 deletions(-)
+ 16 files changed, 1593 insertions(+), 7 deletions(-)
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0005-Enable-disable-devices-for-RHEL.patch
@ -1,4 +1,4 @@
-From 8e767ade83e18995692d3554b6b71c9e15b51d89 Mon Sep 17 00:00:00 2001
+From 003f37e17fb03b8977effd968426a0aeb5855028 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
@ -6,18 +6,45 @@ Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- .distro/qemu-kvm.spec.template                |  18 +--
+Rebase notes (9.1.0 rc0):
- .../aarch64-softmmu/aarch64-rh-devices.mak    |  42 +++++++
+- Return value added for kvm_s390_apply_cpu_model
- .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
+- Added new USB_HID and USB_HUB options
 Rebase notes (9.1.0 rc1):
 - Fixing valid_cpu_types preprocessing
 Rebase notes (9.1.0 rc4):
 - Moved x86 cpu deprecation from x86 machine type patch
 - Removed unnecessary chunk in cirrus_vga.c
 - Not needed hack removal of cpu-v7m.c from build
 Rebase notes (9.1.0):
 - Remove ppc64 device configuration
 - Remove unnecessary chunks
 - Removed CONFIG_VHOST_USER_SCMI and CONFIG_VHOST_USER_SND from some archs
 Merged commits (9.1.0 rc0):
 - f24c7a1fee Disable FDC devices
 - fe8c6cb1ce Disable vga-cirrus device
 - fccd117a12 Enable vhost-user-snd-pci device
 - c0b40cc648 target/cpu-models/x86: Remove the existing deprecated CPU models on c10s
 - ce42b3da0e x86/cpu: deprecate cpu models that do not support x86-64-v3
 - 01ffa96c3b target/s390x/cpu_models: Disable everything up to the z12 CPU model
 - cd57d17e3c target/s390x: Revert the old s390x CPU model disablement code
 - 42af7b3ad5 Enable vhost-user-scmi devices
 Merged commits (9.1.0 rc4):
 - aa374ce5ea x86/cpu: update deprecation string to match lowest undeprecated model
 ---
 .distro/qemu-kvm.spec.template                |  20 +--
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  46 +++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  19 +++
- .../x86_64-softmmu/x86_64-rh-devices.mak      | 112 ++++++++++++++++++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 114 ++++++++++++++++++
- hw/arm/virt.c                                 |   2 +
+ hw/arm/virt.c                                 |   4 +
 hw/block/fdc.c                                |  10 ++
 hw/cpu/meson.build                            |   3 +-
 hw/cxl/meson.build                            |   3 +-
 hw/display/cirrus_vga.c                       |   4 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
@ -30,22 +57,21 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 target/arm/tcg/cpu32.c                        |   2 +
 target/arm/tcg/cpu64.c                        |   8 ++
 target/arm/tcg/meson.build                    |   2 +-
- target/s390x/cpu_models_sysemu.c              |   3 +
+ target/i386/cpu.c                             |  19 +++
- target/s390x/kvm/kvm.c                        |   8 ++
+ target/s390x/cpu_models.c                     |   2 +-
 tests/qtest/arm-cpu-features.c                |   4 +
- 26 files changed, 309 insertions(+), 16 deletions(-)
+ 22 files changed, 275 insertions(+), 16 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..b0191d3c69
+index 0000000000..58075e2812
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,42 @@
+@@ -0,0 +1,46 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
@ -68,6 +94,8 @@ index 0000000000..b0191d3c69
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_HUB=y
 +CONFIG_USB_HID=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
@ -88,49 +116,8 @@ index 0000000000..b0191d3c69
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
-diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
+CONFIG_VHOST_USER_SND=y
-new file mode 100644
+CONFIG_VHOST_USER_SCMI=y
 index 0000000000..dbb7d30829
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,37 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
@ -174,10 +161,10 @@ index 0000000000..24cf6dbd03
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..d60ff1bcfc
+index 0000000000..45a8a15291
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,112 @@
+@@ -0,0 +1,114 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
@ -199,9 +186,9 @@ index 0000000000..d60ff1bcfc
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
-+CONFIG_FDC=y
+#CONFIG_FDC=y
-+CONFIG_FDC_SYSBUS=y
+#CONFIG_FDC_SYSBUS=y
-+CONFIG_FDC_ISA=y
+#CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
@ -264,10 +251,11 @@ index 0000000000..d60ff1bcfc
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_HUB=y
 +CONFIG_USB_HID=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
@ -290,11 +278,12 @@ index 0000000000..d60ff1bcfc
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 +CONFIG_VHOST_USER_SND=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index a9a913aead..6c6d155002 100644
+index 687fe0bb8b..eea7d2d038 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -2954,6 +2954,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3032,6 +3032,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     static const char * const valid_cpu_types[] = {
@ -302,53 +291,18 @@ index a9a913aead..6c6d155002 100644
 #ifdef CONFIG_TCG
         ARM_CPU_TYPE_NAME("cortex-a7"),
         ARM_CPU_TYPE_NAME("cortex-a15"),
-@@ -2971,6 +2972,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -3047,8 +3048,11 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
         ARM_CPU_TYPE_NAME("neoverse-n2"),
 #endif /* TARGET_AARCH64 */
 #endif /* CONFIG_TCG */
 +#endif /* disabled for RHEL */
 #ifdef TARGET_AARCH64
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
         ARM_CPU_TYPE_NAME("cortex-a57"),
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
         ARM_CPU_TYPE_NAME("host"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 6dd94e98bc..a05757fc9a 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -49,6 +49,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 38cdcfbe57..e588ecfd42 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,4 +1,5 @@
 -system_ss.add(files('core.c', 'cluster.c'))
 +#system_ss.add(files('core.c', 'cluster.c'))
 +system_ss.add(files('core.c'))
 system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
 index 3e375f61a9..613adb3ebb 100644
 --- a/hw/cxl/meson.build
@ -363,28 +317,6 @@ index 3e375f61a9..613adb3ebb 100644
                ),
                if_false: files(
                    'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index 150883a971..497365bd80 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -36,6 +36,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
 +#include "qemu/error-report.h"
 #include "sysemu/reset.h"
 #include "qapi/error.h"
 #include "trace.h"
@@ -2946,6 +2947,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
     int16_t device_id = pc->device_id;
 +    warn_report("'cirrus-vga' is deprecated, "
 +                "please use a different VGA card instead");
 +
     /*
      * Follow real hardware, cirrus card emulated has 4 MB video memory.
      * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index 80efc633d3..9cb82b8eea 100644
 --- a/hw/ide/piix.c
@ -422,7 +354,7 @@ index 74f10b640f..2e85ecf476 100644
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index 43f3a4a701..267f182883 100644
+index 5012b96464..b435e54228 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
@ -442,7 +374,7 @@ index 43f3a4a701..267f182883 100644
 static void e1000_register_types(void)
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index aac3bb35f2..5411ff35df 100644
+index d7de1003e3..1cdc0a1ba0 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -55,7 +55,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
@ -455,7 +387,7 @@ index aac3bb35f2..5411ff35df 100644
 endif
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-index d7f18c96e6..aaabbb8b0b 100644
+index 621fc65454..c38bdd6fa4 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
@@ -20,7 +20,8 @@ if have_vhost
@ -499,10 +431,10 @@ index 3cc8cc738b..6f21fea1f5 100644
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index ab8d007a86..e5dce20f19 100644
+index 19191c2391..465f423d25 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -2546,6 +2546,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
+@@ -2726,6 +2726,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
@ -514,10 +446,10 @@ index ab8d007a86..e5dce20f19 100644
 void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index bc0c84873f..e9472c8bb8 100644
+index 9a3fd59562..1261eae94d 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -37,6 +37,8 @@
+@@ -35,6 +35,8 @@
 #define KVM_HAVE_MCE_INJECTION 1
 #endif
@ -526,7 +458,7 @@ index bc0c84873f..e9472c8bb8 100644
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
-@@ -1092,6 +1094,7 @@ typedef struct ARMCPUInfo {
+@@ -1110,6 +1112,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
@ -535,10 +467,10 @@ index bc0c84873f..e9472c8bb8 100644
 /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index 985b1efe16..46a4e80171 100644
+index 262a1d6c0b..800514d3fc 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
-@@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
+@@ -653,6 +653,7 @@ static void aarch64_a57_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -546,7 +478,7 @@ index 985b1efe16..46a4e80171 100644
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -704,6 +705,7 @@ static void aarch64_a53_initfn(Object *obj)
+@@ -710,6 +711,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_pribits = 5;
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -554,7 +486,7 @@ index 985b1efe16..46a4e80171 100644
 static void aarch64_host_initfn(Object *obj)
 {
-@@ -742,8 +744,11 @@ static void aarch64_max_initfn(Object *obj)
+@@ -748,8 +750,11 @@ static void aarch64_max_initfn(Object *obj)
 }
 static const ARMCPUInfo aarch64_cpus[] = {
@ -567,7 +499,7 @@ index 985b1efe16..46a4e80171 100644
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
-@@ -814,8 +819,13 @@ static void aarch64_cpu_instance_init(Object *obj)
+@@ -820,8 +825,13 @@ static void aarch64_cpu_instance_init(Object *obj)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@ -582,10 +514,10 @@ index 985b1efe16..46a4e80171 100644
 void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
-index de8f2be941..8896295ae3 100644
+index 20c2737f17..7e66fb6f14 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
-@@ -92,6 +92,7 @@ void aa32_max_features(ARMCPU *cpu)
+@@ -120,6 +120,7 @@ void aa32_max_features(ARMCPU *cpu)
     cpu->isar.id_dfr1 = t;
 }
@ -593,13 +525,13 @@ index de8f2be941..8896295ae3 100644
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
-@@ -1037,3 +1038,4 @@ static void arm_tcg_cpu_register_types(void)
+@@ -1066,3 +1067,4 @@ static void arm_tcg_cpu_register_types(void)
 type_init(arm_tcg_cpu_register_types)
 #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-index 9f7a9f3d2c..7ec6851c9c 100644
+index fe232eb306..2678047488 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -29,6 +29,7 @@
@ -610,7 +542,7 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
                               unsigned cachesize)
 {
-@@ -134,6 +135,7 @@ static void aarch64_a35_initfn(Object *obj)
+@@ -135,6 +136,7 @@ static void aarch64_a35_initfn(Object *obj)
     /* These values are the same with A53/A57/A72. */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
@ -618,7 +550,7 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
-@@ -223,6 +225,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+@@ -224,6 +226,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
@ -626,7 +558,7 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -1065,6 +1068,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
+@@ -1074,6 +1077,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
 }
@ -634,7 +566,7 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
-@@ -1271,6 +1275,7 @@ void aarch64_max_tcg_initfn(Object *obj)
+@@ -1295,6 +1299,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
@ -642,7 +574,7 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
-@@ -1282,14 +1287,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
+@@ -1306,14 +1311,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
     { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
 };
@ -661,51 +593,161 @@ index 9f7a9f3d2c..7ec6851c9c 100644
 type_init(aarch64_cpu_register_types)
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
-index 3b1a9f0fc5..6c95d99181 100644
+index 508932a249..1293647501 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
-@@ -56,5 +56,5 @@ arm_system_ss.add(files(
+@@ -58,5 +58,5 @@ arm_system_ss.add(files(
   'psci.c',
 ))
 -arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +#arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2d99218069..0728bfcc20 100644
+index 85ef7452c0..34e0ce5e62 100644
--- a/target/s390x/cpu_models_sysemu.c
+--- a/target/i386/cpu.c
-+++ b/target/s390x/cpu_models_sysemu.c
+++ b/target/i386/cpu.c
-@@ -34,6 +34,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
+@@ -2411,9 +2411,13 @@ static const CPUCaches epyc_genoa_cache_info = {
-         (max_model->def->gen == model->def->gen &&
+  *  PT in VMX operation
-          max_model->def->ec_ga < model->def->ec_ga)) {
+  */
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
-     /* detect missing features if any to properly report them */
+#define RHEL_CPU_DEPRECATION \
-diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
+    "use at least 'Haswell' / 'EPYC', or 'host' / 'max'"
 index 4ce809c5d4..55fb4855b1 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2565,6 +2565,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
-+    /* Older CPU models are not supported on Red Hat Enterprise Linux */
+ static const X86CPUDefinition builtin_x86_defs[] = {
-+    if (model->def->gen < 11) {
+     {
-+        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
+         .name = "qemu64",
-+                   MACHINE(qdev_get_machine())->cpu_type);
+        .deprecation_note = RHEL_CPU_DEPRECATION,
-+        return;
+         .level = 0xd,
-+    }
+         .vendor = CPUID_VENDOR_AMD,
-+
+         .family = 15,
-     prop.cpuid = s390_cpuid_from_cpu_model(model);
+@@ -2432,6 +2436,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     prop.ibc = s390_ibc_from_cpu_model(model);
+         .xlevel = 0x8000000A,
-     /* configure cpu features indicated via STFL(e) */
+         .model_id = "QEMU Virtual CPU version " QEMU_HW_VERSION,
     },
 +#if 0 // Deprecated CPU models are removed in RHEL-10
     {
         .name = "phenom",
         .level = 5,
@@ -2796,8 +2801,10 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "Intel Core 2 Duo P9xxx (Penryn Class Core 2)",
     },
 +#endif // Removal of deprecated CPU models in RHEL-10
     {
         .name = "Nehalem",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 11,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2875,6 +2882,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Westmere",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 11,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2956,6 +2964,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "SandyBridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -3042,6 +3051,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "IvyBridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4469,6 +4479,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Denverton",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 21,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4579,6 +4590,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Snowridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 27,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4760,8 +4772,10 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "Intel Xeon Phi Processor (Knights Mill)",
     },
 +#if 0 // Deprecated CPU models are removed in RHEL-10
     {
         .name = "Opteron_G1",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4782,6 +4796,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4804,6 +4819,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
@@ -4827,8 +4843,10 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "AMD Opteron 23xx (Gen 3 Class Opteron)",
     },
 +#endif
     {
         .name = "Opteron_G4",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 21,
@@ -4861,6 +4879,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G5",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 21,
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index a27f4b6f79..798c18f940 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -72,7 +72,6 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2096, 9, 2, 40, 0x00000000U, "z9BC", "IBM System z9 BC GA1"),
     CPUDEF_INIT(0x2094, 9, 3, 40, 0x00000000U, "z9EC.3", "IBM System z9 EC GA3"),
     CPUDEF_INIT(0x2096, 9, 3, 40, 0x00000000U, "z9BC.2", "IBM System z9 BC GA2"),
 -#endif
     CPUDEF_INIT(0x2097, 10, 1, 43, 0x00000000U, "z10EC", "IBM System z10 EC GA1"),
     CPUDEF_INIT(0x2097, 10, 2, 43, 0x00000000U, "z10EC.2", "IBM System z10 EC GA2"),
     CPUDEF_INIT(0x2098, 10, 2, 43, 0x00000000U, "z10BC", "IBM System z10 BC GA1"),
@@ -81,6 +80,7 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2817, 11, 1, 44, 0x08000000U, "z196", "IBM zEnterprise 196 GA1"),
     CPUDEF_INIT(0x2817, 11, 2, 44, 0x08000000U, "z196.2", "IBM zEnterprise 196 GA2"),
     CPUDEF_INIT(0x2818, 11, 2, 44, 0x08000000U, "z114", "IBM zEnterprise 114 GA1"),
 +#endif
     CPUDEF_INIT(0x2827, 12, 1, 44, 0x08000000U, "zEC12", "IBM zEnterprise EC12 GA1"),
     CPUDEF_INIT(0x2827, 12, 2, 44, 0x08000000U, "zEC12.2", "IBM zEnterprise EC12 GA2"),
     CPUDEF_INIT(0x2828, 12, 2, 44, 0x08000000U, "zBC12", "IBM zEnterprise BC12 GA1"),
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index 9d6e6190d5..f822526acb 100644
+index cfd6f77353..3016e6233c 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
@@ -452,8 +452,10 @@ static void test_query_cpu_model_expansion(const void *data)
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0006-Machine-type-related-general-changes.patch
@ -1,4 +1,4 @@
-From 802da738d5231ef56d25f4ffcfa6e7d97698ee72 Mon Sep 17 00:00:00 2001
+From 18ae40658bedd6dceab0ffe0bce77ba48e6f0fae Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@ -8,10 +8,18 @@ split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.1.0 rc0):
 - Upstream removed uuid_encoced argument on smbios_set_defaults
 Merged commits (9.1.0 rc0):
 - 043ad5ce97 Add upstream compatibility bits (partial)
 - bfbdab5824 rhel 9.4.0 machine type compat for virtio-gpu migration
 ---
 hw/acpi/piix4.c              |   2 +-
- hw/arm/virt.c                |   2 +-
+ hw/arm/virt.c                |   3 +-
- hw/core/machine.c            | 269 +++++++++++++++++++++++++++++++++++
+ hw/core/machine.c            | 281 +++++++++++++++++++++++++++++++++++
 hw/i386/fw_cfg.c             |   3 +-
 hw/net/rtl8139.c             |   4 +-
 hw/smbios/smbios.c           |  46 +++++-
@ -19,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
 hw/virtio/virtio-mem.c       |   3 +-
- include/hw/boards.h          |  40 ++++++
+ include/hw/boards.h          |  43 ++++++
 include/hw/firmware/smbios.h |   4 +-
 include/hw/i386/pc.h         |   3 +
- 13 files changed, 414 insertions(+), 24 deletions(-)
+ 13 files changed, 430 insertions(+), 24 deletions(-)
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index debe1adb84..e8ddcd716e 100644
@ -38,23 +46,24 @@ index debe1adb84..e8ddcd716e 100644
     .fields = (const VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 6c6d155002..36e9b4b4e9 100644
+index eea7d2d038..b2aa3f1355 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1651,7 +1651,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1699,7 +1699,8 @@ static void virt_build_smbios(VirtMachineState *vms)
     }
     smbios_set_defaults("QEMU", product,
-                         vmc->smbios_old_sys_ver ? "1.0" : mc->name,
+-                        vmc->smbios_old_sys_ver ? "1.0" : mc->name);
-                        true);
+                        vmc->smbios_old_sys_ver ? "1.0" : mc->name,
-+                        true, NULL, NULL);
+                        NULL, NULL);
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 37ede0e7d4..695cb89a46 100644
+index 27dcda0248..f7fed78e4b 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -296,6 +296,275 @@ GlobalProperty hw_compat_2_1[] = {
+@@ -305,6 +305,287 @@ GlobalProperty hw_compat_2_1[] = {
 };
 const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
@ -64,6 +73,18 @@ index 37ede0e7d4..695cb89a46 100644
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
 +GlobalProperty hw_compat_rhel_9_5[] = {
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "migration", "zero-page-detection", "legacy"},
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
 +};
 +const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
 +
 +GlobalProperty hw_compat_rhel_9_4[] = {
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "host_uso", "off"},
@ -331,24 +352,24 @@ index 37ede0e7d4..695cb89a46 100644
 static char *machine_get_kernel(Object *obj, Error **errp)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index d802d2787f..c7aa39a13e 100644
+index 0e4494627c..33ef280420 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
-@@ -64,7 +64,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+@@ -73,7 +73,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
-         smbios_set_defaults("QEMU", mc->desc, mc->name,
+-        smbios_set_defaults("QEMU", mc->desc, mc->name);
-                            pcmc->smbios_uuid_encoded);
+        smbios_set_defaults("QEMU", mc->desc, mc->name,
 +                            pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
     /* tell smbios about cpuid version and features */
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 897c86ec41..2d0db43f49 100644
+index 03a204ef8a..f2fe057535 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
-@@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
+@@ -3173,7 +3173,7 @@ static int rtl8139_pre_save(void *opaque)
 static const VMStateDescription vmstate_rtl8139 = {
     .name = "rtl8139",
@ -357,7 +378,7 @@ index 897c86ec41..2d0db43f49 100644
     .minimum_version_id = 3,
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
-@@ -3250,7 +3250,9 @@ static const VMStateDescription vmstate_rtl8139 = {
+@@ -3254,7 +3254,9 @@ static const VMStateDescription vmstate_rtl8139 = {
         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
@ -368,10 +389,10 @@ index 897c86ec41..2d0db43f49 100644
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index eed5787b15..68608a3403 100644
+index a394514264..88642ccce0 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
-@@ -39,6 +39,10 @@ size_t usr_blobs_len;
+@@ -38,6 +38,10 @@ size_t usr_blobs_len;
 static unsigned usr_table_max;
 static unsigned usr_table_cnt;
@ -382,7 +403,7 @@ index eed5787b15..68608a3403 100644
 uint8_t *smbios_tables;
 size_t smbios_tables_len;
 unsigned smbios_table_max;
-@@ -629,7 +633,7 @@ static void smbios_build_type_1_table(void)
+@@ -626,7 +630,7 @@ static void smbios_build_type_1_table(void)
 static void smbios_build_type_2_table(void)
 {
@ -391,17 +412,16 @@ index eed5787b15..68608a3403 100644
     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -1018,16 +1022,52 @@ void smbios_set_default_processor_family(uint16_t processor_family)
+@@ -1014,15 +1018,51 @@ void smbios_set_default_processor_family(uint16_t processor_family)
 }
 void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version,
+-                         const char *version)
-                         bool uuid_encoded)
+                         const char *version,
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version)
 {
     smbios_have_defaults = true;
     smbios_uuid_encoded = uuid_encoded;
 +    /*
 +     * If @stream_product & @stream_version are non-NULL, then
@ -460,7 +480,7 @@ index 28fdabc321..bad13ec224 100644
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
-index 4423983308..43b4b71fdf 100644
+index 264d7ebb77..2b9a3e06d4 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
@ -524,7 +544,7 @@ index 4423983308..43b4b71fdf 100644
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
-@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+@@ -153,6 +169,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
@ -539,7 +559,7 @@ index 4423983308..43b4b71fdf 100644
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
-@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
+@@ -197,11 +221,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
@ -571,7 +591,7 @@ index 08f70ce97c..1be7527c1b 100644
 #endif
 diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index ffd119ebac..0e2be2219c 100644
+index ef64bf1b4a..ba11aa4646 100644
 --- a/hw/virtio/virtio-mem.c
 +++ b/hw/virtio/virtio-mem.c
@@ -1694,8 +1694,9 @@ static Property virtio_mem_properties[] = {
@ -586,13 +606,16 @@ index ffd119ebac..0e2be2219c 100644
 };
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 8b8f6d5c00..0466f9d0f3 100644
+index 48ff6d8b93..ccfc3e10eb 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -512,4 +512,44 @@ extern const size_t hw_compat_2_2_len;
+@@ -822,4 +822,47 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_5[];
 +extern const size_t hw_compat_rhel_9_5_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_4[];
 +extern const size_t hw_compat_rhel_9_4_len;
 +
@ -635,27 +658,27 @@ index 8b8f6d5c00..0466f9d0f3 100644
 +extern const char *rhel_old_machine_deprecation;
 #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 8d3fb2fb3b..d9d6d7a169 100644
+index f066ab7262..e805d25fbe 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
-@@ -332,7 +332,9 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
+@@ -331,7 +331,9 @@ void smbios_add_usr_blob_size(size_t size);
 void smbios_entry_add(QemuOpts *opts, Error **errp);
 void smbios_set_cpuid(uint32_t version, uint32_t features);
 void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version,
+-                         const char *version);
-                         bool uuid_encoded);
+                         const char *version,
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version);
 void smbios_set_default_processor_family(uint16_t processor_family);
 uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
 void smbios_get_tables(MachineState *ms,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 27a68071d7..ebd8f973f2 100644
+index 4e55d7ef6e..8776a3c937 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -112,6 +112,9 @@ struct PCMachineClass {
+@@ -103,6 +103,9 @@ struct PCMachineClass {
     bool smbios_defaults;
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
     SmbiosEntryPointType default_smbios_ep_type;
 +    /* New fields needed for Windows HardwareID-6 matching */
 +    const char *smbios_stream_product;
--- a/0007-Add-aarch64-machine-types.patch
+++ b/0007-Add-aarch64-machine-types.patch
@ -1,430 +0,0 @@
 From 3afc6e4cb6725d01b8f89207701bca199c9ecc9f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c         | 299 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/arm/virt.h |   8 ++
 2 files changed, 306 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 36e9b4b4e9..22bc345137 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -101,6 +101,7 @@ static void arm_virt_compat_set(MachineClass *mc)
                      arm_virt_compat_len);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
@@ -128,7 +129,63 @@ static void arm_virt_compat_set(MachineClass *mc)
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
 +#endif /* disabled for RHEL */
 +
 +/*
 + * This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type. They may be overriden by older machine compats.
 + *
 + * virtio-net-pci variant romfiles are not needed because edk2 does
 + * fully support the pxe boot. Besides virtio romfiles are not shipped
 + * on rhel/aarch64.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {"virtio-net-pci", "romfile", "" },
 +    {"virtio-net-pci-transitional", "romfile", "" },
 +    {"virtio-net-pci-non-transitional", "romfile", "" },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 +/*
 + * This cannot be called from the rhel_virt_class_init() because
 + * TYPE_RHEL_MACHINE is abstract and mc->compat_props g_ptr_array_new()
 + * only is called on virt-rhelm.n.s non abstract class init.
 + */
 +static void arm_rhel_compat_set(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat,
 +                     arm_rhel_compat_len);
 +}
 +
 +#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
 +    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
 +                                                void *data)             \
 +    {                                                                   \
 +        MachineClass *mc = MACHINE_CLASS(oc);                           \
 +        arm_rhel_compat_set(mc);                                        \
 +        rhel##m##n##s##_virt_options(mc);                               \
 +        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
 +        if (latest) {                                                   \
 +            mc->alias = "virt";                                         \
 +            mc->is_default = 1;                                         \
 +        }                                                               \
 +    }                                                                   \
 +    static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
 +        .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
 +        .parent = TYPE_RHEL_MACHINE,                                    \
 +        .class_init = rhel##m##n##s##_virt_class_init,                  \
 +    };                                                                  \
 +    static void rhel##m##n##s##_machvirt_init(void)                     \
 +    {                                                                   \
 +        type_register_static(&rhel##m##n##s##_machvirt_info);           \
 +    }                                                                   \
 +    type_init(rhel##m##n##s##_machvirt_init);
 +
 +#define DEFINE_RHEL_MACHINE_AS_LATEST(major, minor, subminor)   \
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
 +#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
@@ -2355,6 +2412,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2382,6 +2440,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
@@ -2397,6 +2456,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
     vms->highmem = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_compact_highmem(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2410,6 +2470,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
     vms->highmem_compact = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem_redists(Object *obj, Error **errp)
 {
@@ -2453,7 +2514,6 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
     vms->highmem_mmio = value;
 }
 -
 static bool virt_get_its(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2468,6 +2528,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2481,6 +2542,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
@@ -2564,6 +2626,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2577,6 +2640,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
@@ -2949,6 +3013,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -3463,3 +3528,235 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
 +#endif /* disabled for RHEL */
 +
 +static void rhel_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 +    arm_virt_compat_set(mc);
 +
 +    mc->family = "virt-rhel-Z";
 +    mc->init = machvirt_init;
 +    /* Maximum supported VCPU count for all virt-rhel* machines */
 +    mc->max_cpus = 384;
 +#ifdef CONFIG_TPM
 +    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 +#endif
 +    mc->block_default_type = IF_VIRTIO;
 +    mc->no_cdrom = 1;
 +    mc->pci_allow_0_address = true;
 +    /* We know we will never create a pre-ARMv7 CPU which needs 1K pages */
 +    mc->minimum_page_bits = 12;
 +    mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
 +    mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
 +    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
 +    mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
 +    mc->kvm_type = virt_kvm_type;
 +    assert(!mc->get_hotplug_handler);
 +    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
 +    hc->pre_plug = virt_machine_device_pre_plug_cb;
 +    hc->plug = virt_machine_device_plug_cb;
 +    hc->unplug_request = virt_machine_device_unplug_request_cb;
 +    hc->unplug = virt_machine_device_unplug_cb;
 +    mc->nvdimm_supported = true;
 +    mc->smp_props.clusters_supported = true;
 +    mc->auto_enable_numa_with_memhp = true;
 +    mc->auto_enable_numa_with_memdev = true;
 +    /* platform instead of architectural choice */
 +    mc->cpu_cluster_has_numa_boundary = true;
 +    mc->default_ram_id = "mach-virt.ram";
 +    mc->default_nic = "virtio-net-pci";
 +
 +    object_class_property_add(oc, "acpi", "OnOffAuto",
 +        virt_get_acpi, virt_set_acpi,
 +        NULL, NULL);
 +    object_class_property_set_description(oc, "acpi",
 +        "Enable ACPI");
 +
 +    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
 +                                   virt_set_highmem);
 +    object_class_property_set_description(oc, "highmem",
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
 +    object_class_property_add_bool(oc, "highmem-redists",
 +                                   virt_get_highmem_redists,
 +                                   virt_set_highmem_redists);
 +    object_class_property_set_description(oc, "highmem-redists",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for GICv3 or GICv4 "
 +                                          "redistributor");
 +
 +    object_class_property_add_bool(oc, "highmem-ecam",
 +                                   virt_get_highmem_ecam,
 +                                   virt_set_highmem_ecam);
 +    object_class_property_set_description(oc, "highmem-ecam",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI ECAM");
 +
 +    object_class_property_add_bool(oc, "highmem-mmio",
 +                                   virt_get_highmem_mmio,
 +                                   virt_set_highmem_mmio);
 +    object_class_property_set_description(oc, "highmem-mmio",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI MMIO");
 +
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
 +    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
 +    object_class_property_set_description(oc, "iommu",
 +                                          "Set the IOMMU type. "
 +                                          "Valid values are none and smmuv3");
 +
 +    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +    object_class_property_set_description(oc, "default-bus-bypass-iommu",
 +                                          "Set on/off to enable/disable "
 +                                          "bypass_iommu for default root bus");
 +
 +    object_class_property_add_bool(oc, "ras", virt_get_ras,
 +                                   virt_set_ras);
 +    object_class_property_set_description(oc, "ras",
 +                                          "Set on/off to enable/disable reporting host memory errors "
 +                                          "to a KVM guest using ACPI and guest external abort exceptions");
 +
 +    object_class_property_add_bool(oc, "its", virt_get_its,
 +                                   virt_set_its);
 +    object_class_property_set_description(oc, "its",
 +                                          "Set on/off to enable/disable "
 +                                          "ITS instantiation");
 +
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
 +    object_class_property_set_description(oc, "x-oem-id",
 +                                          "Override the default value of field OEMID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
 +
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
 +    object_class_property_set_description(oc, "x-oem-table-id",
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
 +{
 +    VirtMachineState *vms = VIRT_MACHINE(obj);
 +    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
 +
 +    /* EL3 is disabled by default and non-configurable for RHEL */
 +    vms->secure = false;
 +
 +    /* EL2 is disabled by default and non-configurable for RHEL */
 +    vms->virt = false;
 +
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    vms->highmem_compact = !vmc->no_highmem_compact;
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +    vms->highmem_mmio = true;
 +    vms->highmem_redists = true;
 +
 +    if (vmc->no_its) {
 +        vms->its = false;
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
 +
 +        if (vmc->no_tcg_its) {
 +            vms->tcg_its = false;
 +        } else {
 +            vms->tcg_its = true;
 +        }
 +    }
 +
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
 +
 +    /* The default root bus is attached to iommu by default */
 +    vms->default_bus_bypass_iommu = false;
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
 +
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
 +    /* Supply kaslr-seed and rng-seed by default, non-configurable for RHEL */
 +    vms->dtb_randomness = true;
 +
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
 +
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +}
 +
 +static const TypeInfo rhel_machine_info = {
 +    .name          = TYPE_RHEL_MACHINE,
 +    .parent        = TYPE_MACHINE,
 +    .abstract      = true,
 +    .instance_size = sizeof(VirtMachineState),
 +    .class_size    = sizeof(VirtMachineClass),
 +    .class_init    = rhel_machine_class_init,
 +    .instance_init = rhel_virt_instance_init,
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
 +};
 +
 +static void rhel_machine_init(void)
 +{
 +    type_register_static(&rhel_machine_info);
 +}
 +type_init(rhel_machine_init);
 +
 +static void rhel940_virt_options(MachineClass *mc)
 +{
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 +
 +static void rhel920_virt_options(MachineClass *mc)
 +{
 +    rhel940_virt_options(mc);
 +
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +
 +    /* RHEL 9.4 is the first supported release */
 +    mc->deprecation_reason =
 +        "machine types for versions prior to 9.4 are deprecated";
 +}
 +DEFINE_RHEL_MACHINE(9, 2, 0)
 +
 +static void rhel900_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
 +    rhel920_virt_options(mc);
 +
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
 +    /* Compact layout for high memory regions was introduced with 9.2.0 */
 +    vmc->no_highmem_compact = true;
 +}
 +DEFINE_RHEL_MACHINE(9, 0, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index bb486d36b1..237fc77bda 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
@@ -179,9 +179,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
 +#if 0 /* disabled for Red Hat Enterprise Linux */
 #define TYPE_VIRT_MACHINE   MACHINE_TYPE_NAME("virt")
 OBJECT_DECLARE_TYPE(VirtMachineState, VirtMachineClass, VIRT_MACHINE)
 +#else
 +#define TYPE_RHEL_MACHINE MACHINE_TYPE_NAME("virt-rhel")
 +typedef struct VirtMachineClass VirtMachineClass;
 +typedef struct VirtMachineState VirtMachineState;
 +DECLARE_OBJ_CHECKERS(VirtMachineState, VirtMachineClass, VIRT_MACHINE, TYPE_RHEL_MACHINE)
 +#endif
 +
 void virt_acpi_setup(VirtMachineState *vms);
 bool virt_is_acpi_enabled(VirtMachineState *vms);
 -- 
 2.39.3
--- a/0007-meson-temporarily-disable-Wunused-function.patch
+++ b/0007-meson-temporarily-disable-Wunused-function.patch
@ -0,0 +1,36 @@
 From 16946c2c7be0ae23dc1f267323cfc7630a1c9e87 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:32:32 +0100
 Subject: meson: temporarily disable -Wunused-function
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Deleting the upstream versioned machine types will leave some functions
 unused until RHEL machine types are added once again. Temporarily
 disable the -Wunused-function warning to preserve bisectability with
 fine grained patch splits.
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Rebase notes (9.1.0 rc0)
 - New patch
 ---
 meson.build | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/meson.build b/meson.build
 index fbda17c987..161d496d55 100644
 --- a/meson.build
 +++ b/meson.build
@@ -651,6 +651,7 @@ warn_flags = [
   '-Wno-string-plus-int',
   '-Wno-tautological-type-limit-compare',
   '-Wno-typedef-redefinition',
 +  '-Wno-unused-function',
 ]
 if host_os != 'darwin'
 -- 
 2.39.3
--- a/0008-Add-s390x-machine-types.patch
+++ b/0008-Add-s390x-machine-types.patch
@ -1,273 +0,0 @@
 From fa1d70b9a9cfe020e7ebe7798ebb70314658ccf7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c       | 159 +++++++++++++++++++++++++++++++
 target/s390x/cpu_models.c        |  11 +++
 target/s390x/cpu_models.h        |   2 +
 target/s390x/cpu_models_sysemu.c |   2 +
 4 files changed, 174 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index b1dcb3857f..ff753a29e0 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -859,6 +859,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_9_0_instance_options(MachineState *machine)
 {
 }
@@ -1272,6 +1273,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +
 +static void ccw_machine_rhel940_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel940_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 +
 +static void ccw_machine_rhel920_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel940_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel920_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel940_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
 +DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", false);
 +
 +static void ccw_machine_rhel900_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
 +
 +    ccw_machine_rhel920_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
 +}
 +
 +static void ccw_machine_rhel900_class_options(MachineClass *mc)
 +{
 +    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel920_class_options(mc);
 +
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +    s390mc->max_threads = S390_MAX_CPUS;
 +}
 +DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
 +
 +static void ccw_machine_rhel860_instance_options(MachineState *machine)
 +{
 +    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
 +    ccw_machine_rhel900_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel860_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "on", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "on", },
 +    };
 +
 +    ccw_machine_rhel900_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    mc->deprecation_reason = rhel_old_machine_deprecation;
 +}
 +DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    ccw_machine_rhel860_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel860_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    mc->smp_props.prefer_sockets = true;
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 static void ccw_machine_register_types(void)
 {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 8ed3bb6a27..370b3b3065 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -46,6 +46,9 @@
  * of a following release have been a superset of the previous release. With
  * generation 15 one base feature and one optional feature have been deprecated.
  */
 +
 +#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 +
 static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
@@ -866,22 +869,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* all base models are migration safe */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->is_static = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* model that can change between QEMU versions */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
 index d7b8912989..1a806a97c4 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
 } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 0728bfcc20..ca2e5d91e2 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -59,6 +59,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     CpuDefinitionInfo *info;
     char *name = g_strdup(object_class_get_name(klass));
     S390CPUClass *scc = S390_CPU_CLASS(klass);
 +    CPUClass *cc = CPU_CLASS(klass);
     /* strip off the -s390x-cpu */
     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
@@ -68,6 +69,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     info->migration_safe = scc->is_migration_safe;
     info->q_static = scc->is_static;
     info->q_typename = g_strdup(object_class_get_name(klass));
 +    info->deprecated = !!cc->deprecation_note;
     /* check for unavailable features */
     if (cpu_list_data->model) {
         Object *obj;
 -- 
 2.39.3
--- a/0008-Remove-upstream-machine-types-for-aarch64-s390x-and-.patch
+++ b/0008-Remove-upstream-machine-types-for-aarch64-s390x-and-.patch
@ -0,0 +1,101 @@
 From 2f0ba1a1ed66a8ae32e7a92f3d3b744d8b59b879 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 10 Jul 2024 02:25:51 -0400
 Subject: Remove upstream machine types for aarch64, s390x and x86_64
 architectures
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 We will replace upstream machine types on supported architectures with RHEL
 machine types.
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (9.1.0 rc0):
 - Split off commits adding RHEL machine types
 ---
 hw/arm/virt.c              | 2 ++
 hw/i386/pc_piix.c          | 2 ++
 hw/i386/pc_q35.c           | 2 ++
 hw/s390x/s390-virtio-ccw.c | 2 ++
 4 files changed, 8 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index b2aa3f1355..5396e7cb24 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3306,6 +3306,7 @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void virt_machine_9_1_options(MachineClass *mc)
 {
 }
@@ -3552,3 +3553,4 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
 +#endif /* disabled for RHEL */
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 347afa4c37..67107b174a 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -448,6 +448,7 @@ static void pc_i440fx_init(MachineState *machine)
 #define DEFINE_I440FX_MACHINE(major, minor) \
     DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
@@ -775,6 +776,7 @@ static void pc_i440fx_machine_2_4_options(MachineClass *m)
 }
 DEFINE_I440FX_MACHINE(2, 4);
 +#endif /* Disabled for Red Hat Enterprise Linux */
 #ifdef CONFIG_ISAPC
 static void isapc_machine_options(MachineClass *m)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index f2d8edfa84..5fb283f2df 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -356,6 +356,7 @@ static void pc_q35_machine_options(MachineClass *m)
                      pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_q35_machine_9_1_options(MachineClass *m)
 {
     pc_q35_machine_options(m);
@@ -668,3 +669,4 @@ static void pc_q35_machine_2_4_options(MachineClass *m)
 }
 DEFINE_Q35_MACHINE(2, 4);
 +#endif /* Disabled for Red Hat Enterprise Linux */
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index c483ff8064..86bfc9d2eb 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -871,6 +871,7 @@ static const TypeInfo ccw_machine_info = {
     DEFINE_CCW_MACHINE_IMPL(false, major, minor)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_9_1_instance_options(MachineState *machine)
 {
 }
@@ -1305,6 +1306,7 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
 DEFINE_CCW_MACHINE(2, 4);
 #endif
 +#endif /* disabled for RHEL */
 static void ccw_machine_register_types(void)
 {
 -- 
 2.39.3
--- a/0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
+++ b/0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
@ -0,0 +1,197 @@
 From ccb1eaa95ce9c92a196fe034c033502f582a324b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 15:27:03 +0100
 Subject: Adapt versioned machine type macros for RHEL
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The versioned machine type macros are changed thus:
 * All symbol names get 'rhel' inserted eg 'virt_rhel_macine_9_4_0_<blah>'
 * All machine type names get 'rhel' inserted eg 'virt-rhel9.4.0-machine'
 * Lifecycle is changed to deprecate after 1 major RHEL release,
   force non-registration (effectively deletion) after 2 major releases
 * Custom message to explain RHEL deprecation/deletion policy
 * Remove upstream logic that temporarily disabled deletion since
   the upstream constraints in this area don't apply to RHEL
 * For automatic deprecation/deletion, RHEL_VERSION is defined
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/Makefile                   |  2 +-
 .distro/Makefile.common            |  1 +
 .distro/qemu-kvm.spec.template     |  1 +
 .distro/scripts/process-patches.sh |  3 ++
 include/hw/boards.h                | 60 ++++++++++--------------------
 meson.build                        |  1 +
 meson_options.txt                  |  2 +
 scripts/meson-buildoptions.sh      |  2 +
 8 files changed, 30 insertions(+), 42 deletions(-)
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index ccfc3e10eb..7f7eb4ec40 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -548,16 +548,16 @@ struct MachineState {
  *   "{prefix}-{major}.{minor}.{micro}-{tag}"
  */
 #define _MACHINE_VER_TYPE_NAME2(prefix, major, minor)   \
 -    prefix "-" #major "." #minor TYPE_MACHINE_SUFFIX
 +    prefix "-rhel" #major "." #minor TYPE_MACHINE_SUFFIX
 #define _MACHINE_VER_TYPE_NAME3(prefix, major, minor, micro) \
 -    prefix "-" #major "." #minor "." #micro TYPE_MACHINE_SUFFIX
 +    prefix "-rhel" #major "." #minor "." #micro TYPE_MACHINE_SUFFIX
 #define _MACHINE_VER_TYPE_NAME4(prefix, major, minor, _unused_, tag) \
 -    prefix "-" #major "." #minor "-" #tag TYPE_MACHINE_SUFFIX
 +    prefix "-rhel" #major "." #minor "-" #tag TYPE_MACHINE_SUFFIX
 #define _MACHINE_VER_TYPE_NAME5(prefix, major, minor, micro, _unused_, tag) \
 -    prefix "-" #major "." #minor "." #micro "-" #tag TYPE_MACHINE_SUFFIX
 +    prefix "-rhel" #major "." #minor "." #micro "-" #tag TYPE_MACHINE_SUFFIX
 #define MACHINE_VER_TYPE_NAME(prefix, ...) \
     _MACHINE_VER_PICK(__VA_ARGS__, \
@@ -585,16 +585,16 @@ struct MachineState {
  *   {prefix}_machine_{major}_{minor}_{micro}_{tag}_{sym}
  */
 #define _MACHINE_VER_SYM2(sym, prefix, major, minor) \
 -    prefix ## _machine_ ## major ## _ ## minor ## _ ## sym
 +    prefix ## _rhel_machine_ ## major ## _ ## minor ## _ ## sym
 #define _MACHINE_VER_SYM3(sym, prefix, major, minor, micro) \
 -    prefix ## _machine_ ## major ## _ ## minor ## _ ## micro ## _ ## sym
 +    prefix ## _rhel_machine_ ## major ## _ ## minor ## _ ## micro ## _ ## sym
 #define _MACHINE_VER_SYM4(sym, prefix, major, minor, _unused_, tag) \
 -    prefix ## _machine_ ## major ## _ ## minor ## _ ## tag ## _ ## sym
 +    prefix ## _rhel_machine_ ## major ## _ ## minor ## _ ## tag ## _ ## sym
 #define _MACHINE_VER_SYM5(sym, prefix, major, minor, micro, _unused_, tag) \
 -    prefix ## _machine_ ## major ## _ ## minor ## _ ## micro ## _ ## tag ## _ ## sym
 +    prefix ## _rhel_machine_ ## major ## _ ## minor ## _ ## micro ## _ ## tag ## _ ## sym
 #define MACHINE_VER_SYM(sym, prefix, ...) \
     _MACHINE_VER_PICK(__VA_ARGS__, \
@@ -605,26 +605,22 @@ struct MachineState {
 /*
 - * How many years/major releases for each phase
 - * of the life cycle. Assumes use of versioning
 - * scheme where major is bumped each year
 + * How many RHEL major releases for each phase
 + * of the life cycle.
  */
 -#define MACHINE_VER_DELETION_MAJOR 6
 -#define MACHINE_VER_DEPRECATION_MAJOR 3
 +#define MACHINE_VER_DELETION_MAJOR 2
 +#define MACHINE_VER_DEPRECATION_MAJOR 1
 /*
  * Expands to a static string containing a deprecation
  * message for a versioned machine type
  */
 #define MACHINE_VER_DEPRECATION_MSG \
 -    "machines more than " stringify(MACHINE_VER_DEPRECATION_MAJOR) \
 -    " years old are subject to deletion after " \
 -    stringify(MACHINE_VER_DELETION_MAJOR) " years"
 +    "machines from the previous RHEL major release are " \
 +    "subject to deletion in the next RHEL major release"
 #define _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor) \
 -    (((QEMU_VERSION_MAJOR - major) > cutoff) || \
 -     (((QEMU_VERSION_MAJOR - major) == cutoff) && \
 -      (QEMU_VERSION_MINOR - minor) >= 0))
 +    ((RHEL_VERSION - major) >= cutoff)
 #define _MACHINE_VER_IS_EXPIRED2(cutoff, major, minor) \
     _MACHINE_VER_IS_EXPIRED_IMPL(cutoff, major, minor)
@@ -686,32 +682,14 @@ struct MachineState {
  * This must be unconditionally used in the register
  * method for all machine types which support versioning.
  *
 - * Inijtially it will effectively be a no-op, but after a
 - * suitable period of time has passed, it will cause
 - * execution of the method to return, avoiding registration
 - * of the machine
 - *
 - * The new deprecation and deletion policy for versioned
 - * machine types was introduced in QEMU 9.1.0.
 - *
 - * Under the new policy a number of old machine types (any
 - * prior to 2.12) would be liable for immediate deletion
 - * which would be a violation of our historical deprecation
 - * and removal policy
 - *
 - * Thus deletions are temporarily gated on existance of
 - * the env variable "QEMU_DELETE_MACHINES" / QEMU version
 - * number >= 10.1.0. This gate can be deleted in the 10.1.0
 - * dev cycle
 + * It will automatically avoid registration of machines
 + * that should have been deleted at the start of this
 + * RHEL release
  */
 #define MACHINE_VER_DELETION(...) \
     do { \
         if (MACHINE_VER_SHOULD_DELETE(__VA_ARGS__)) { \
 -            if (getenv("QEMU_DELETE_MACHINES") || \
 -                QEMU_VERSION_MAJOR > 10 || (QEMU_VERSION_MAJOR == 10 && \
 -                                            QEMU_VERSION_MINOR >= 1)) { \
 -                return; \
 -            } \
 +            return; \
         } \
     } while (0)
 diff --git a/meson.build b/meson.build
 index 161d496d55..2de5ab024f 100644
 --- a/meson.build
 +++ b/meson.build
@@ -2440,6 +2440,7 @@ config_host_data.set('QEMU_VERSION', '"@0@"'.format(meson.project_version()))
 config_host_data.set('QEMU_VERSION_MAJOR', meson.project_version().split('.')[0])
 config_host_data.set('QEMU_VERSION_MINOR', meson.project_version().split('.')[1])
 config_host_data.set('QEMU_VERSION_MICRO', meson.project_version().split('.')[2])
 +config_host_data.set('RHEL_VERSION', get_option('rhel_version').split('.')[0])
 config_host_data.set_quoted('CONFIG_HOST_DSOSUF', host_dsosuf)
 config_host_data.set('HAVE_HOST_BLOCK_DEVICE', have_host_block_device)
 diff --git a/meson_options.txt b/meson_options.txt
 index 0269fa0f16..aa2ba0baef 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -2,6 +2,8 @@
 # on the configure script command line.  If you add more, list them in
 # scripts/meson-buildoptions.py's SKIP_OPTIONS constant too.
 +option('rhel_version', type: 'string', value: '0.0',
 +       description: 'RHEL major/minor version')
 option('qemu_suffix', type : 'string', value: 'qemu',
        description: 'Suffix for QEMU data/modules/config directories (can be empty)')
 option('docdir', type : 'string', value : 'share/doc',
 diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
 index c97079a38c..5f0cbfc725 100644
 --- a/scripts/meson-buildoptions.sh
 +++ b/scripts/meson-buildoptions.sh
@@ -71,6 +71,7 @@ meson_options_help() {
   printf "%s\n" '                           "manufacturer" name for qemu-ga registry entries'
   printf "%s\n" '                           [QEMU]'
   printf "%s\n" '  --qemu-ga-version=VALUE  version number for qemu-ga installer'
 +  printf "%s\n" '  --rhel-version=VALUE     RHEL major/minor version [0.0]'
   printf "%s\n" '  --smbd=VALUE             Path to smbd for slirp networking'
   printf "%s\n" '  --sysconfdir=VALUE       Sysconf data directory [etc]'
   printf "%s\n" '  --tls-priority=VALUE     Default TLS protocol/cipher priority string'
@@ -450,6 +451,7 @@ _meson_option_parse() {
     --disable-relocatable) printf "%s" -Drelocatable=false ;;
     --enable-replication) printf "%s" -Dreplication=enabled ;;
     --disable-replication) printf "%s" -Dreplication=disabled ;;
 +    --rhel-version=*) quote_sh "-Drhel_version=$2" ;;
     --enable-rng-none) printf "%s" -Drng_none=true ;;
     --disable-rng-none) printf "%s" -Drng_none=false ;;
     --enable-rutabaga-gfx) printf "%s" -Drutabaga_gfx=enabled ;;
 -- 
 2.39.3
--- a/0010-Increase-deletion-schedule-to-4-releases.patch
+++ b/0010-Increase-deletion-schedule-to-4-releases.patch
@ -0,0 +1,37 @@
 From 551632921a8330cff09e7d92429aa45cf51c75e6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 18:45:58 +0100
 Subject: Increase deletion schedule to 4 releases
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Until RHEL 10 pc machine type is introduced, we have to keep
 7.6.0 machine types as a special exception to our normal rule of
 deleting machine types after 2 releases due to being a default
 machine type.
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Rebase notes (9.1.0 rc0)
  - New patch
 ---
 include/hw/boards.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 7f7eb4ec40..fd5a957cad 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -608,7 +608,7 @@ struct MachineState {
  * How many RHEL major releases for each phase
  * of the life cycle.
  */
 -#define MACHINE_VER_DELETION_MAJOR 2
 +#define MACHINE_VER_DELETION_MAJOR 4
 #define MACHINE_VER_DEPRECATION_MAJOR 1
 /*
 -- 
 2.39.3
--- a/0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
+++ b/0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
@ -0,0 +1,301 @@
 From 6cb1d3cf4ac08fe8c435e98500224a022d019e55 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:25:47 +0100
 Subject: Add downstream aarch64 versioned 'virt' machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.1.0 rc0):
 - Merge copy+pasted base machine definition back with upstream
  base machine definition to reduce RHEL delta, as is done with
  other targets
 - Convert to new DEFINE_VIRT_MACHINE macros
 Rebase notes (9.1.0 rc1):
 - do not remove cpu validation (review comment)
 Rebase notes (9.1.0 rc2):
 - use ifdef instead of removal for disabling unwanted upstream code
 Merged patches (9.1.0 rc0):
 - 043ad5ce97 Add upstream compatibility bits (partial)
 ---
 hw/arm/virt.c | 101 ++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 81 insertions(+), 20 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 5396e7cb24..903c0f2e9f 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -90,6 +90,22 @@ static GlobalProperty arm_virt_compat[] = {
 };
 static const size_t arm_virt_compat_len = G_N_ELEMENTS(arm_virt_compat);
 +/*
 + * This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type. They may be overriden by older machine compats.
 + *
 + * virtio-net-pci variant romfiles are not needed because edk2 does
 + * fully support the pxe boot. Besides virtio romfiles are not shipped
 + * on rhel/aarch64.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {"virtio-net-pci", "romfile", "" },
 +    {"virtio-net-pci-transitional", "romfile", "" },
 +    {"virtio-net-pci-non-transitional", "romfile", "" },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 +
 /*
  * This cannot be called from the virt_machine_class_init() because
  * TYPE_VIRT_MACHINE is abstract and mc->compat_props g_ptr_array_new()
@@ -99,6 +115,8 @@ static void arm_virt_compat_set(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, arm_virt_compat,
                      arm_virt_compat_len);
 +    compat_props_add(mc->compat_props, arm_rhel_compat,
 +                     arm_rhel_compat_len);
 }
 #define DEFINE_VIRT_MACHINE_IMPL(latest, ...) \
@@ -109,10 +127,11 @@ static void arm_virt_compat_set(MachineClass *mc)
         MachineClass *mc = MACHINE_CLASS(oc); \
         arm_virt_compat_set(mc); \
         MACHINE_VER_SYM(options, virt, __VA_ARGS__)(mc); \
 -        mc->desc = "QEMU " MACHINE_VER_STR(__VA_ARGS__) " ARM Virtual Machine"; \
 +        mc->desc = "RHEL " MACHINE_VER_STR(__VA_ARGS__) " ARM Virtual Machine"; \
         MACHINE_VER_DEPRECATION(__VA_ARGS__); \
         if (latest) { \
             mc->alias = "virt"; \
 +            mc->is_default = 1; \
         } \
     } \
     static const TypeInfo MACHINE_VER_SYM(info, virt, __VA_ARGS__) = \
@@ -128,10 +147,10 @@ static void arm_virt_compat_set(MachineClass *mc)
     } \
     type_init(MACHINE_VER_SYM(register, virt, __VA_ARGS__));
 -#define DEFINE_VIRT_MACHINE_AS_LATEST(major, minor) \
 -    DEFINE_VIRT_MACHINE_IMPL(true, major, minor)
 -#define DEFINE_VIRT_MACHINE(major, minor) \
 -    DEFINE_VIRT_MACHINE_IMPL(false, major, minor)
 +#define DEFINE_VIRT_MACHINE_AS_LATEST(major, minor, micro) \
 +    DEFINE_VIRT_MACHINE_IMPL(true, major, minor, micro)
 +#define DEFINE_VIRT_MACHINE(major, minor, micro) \
 +    DEFINE_VIRT_MACHINE_IMPL(false, major, minor, micro)
 /* Number of external interrupt lines to configure the GIC with */
@@ -2434,6 +2453,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2461,6 +2481,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
@@ -2476,6 +2497,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
     vms->highmem = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_compact_highmem(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2489,6 +2511,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
     vms->highmem_compact = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem_redists(Object *obj, Error **errp)
 {
@@ -2547,6 +2570,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2560,6 +2584,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
@@ -2643,6 +2668,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2656,6 +2682,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
@@ -3063,16 +3090,10 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
         NULL
     };
 +    mc->family = "virt-rhel-Z";
     mc->init = machvirt_init;
 -    /* Start with max_cpus set to 512, which is the maximum supported by KVM.
 -     * The value may be reduced later when we have more information about the
 -     * configuration of the particular instance.
 -     */
 -    mc->max_cpus = 512;
 -    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_CALXEDA_XGMAC);
 -    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_AMD_XGBE);
 -    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 -    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
 +    /* Maximum supported VCPU count for all virt-rhel* machines */
 +    mc->max_cpus = 384;
 #ifdef CONFIG_TPM
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
@@ -3083,11 +3104,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->minimum_page_bits = 12;
     mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
 -#ifdef CONFIG_TCG
 -    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -#else
 -    mc->default_cpu_type = ARM_CPU_TYPE_NAME("max");
 -#endif
 +    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
     mc->valid_cpu_types = valid_cpu_types;
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
     mc->kvm_type = virt_kvm_type;
@@ -3111,6 +3128,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
         NULL, NULL);
     object_class_property_set_description(oc, "acpi",
         "Enable ACPI");
 +#if 0 /* disabled for RHEL */
     object_class_property_add_bool(oc, "secure", virt_get_secure,
                                    virt_set_secure);
     object_class_property_set_description(oc, "secure",
@@ -3123,6 +3141,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                           "Set on/off to enable/disable emulating a "
                                           "guest CPU which implements the ARM "
                                           "Virtualization Extensions");
 +#endif /* disabled for RHEL */
     object_class_property_add_bool(oc, "highmem", virt_get_highmem,
                                    virt_set_highmem);
@@ -3130,12 +3149,14 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                           "Set on/off to enable/disable using "
                                           "physical address space above 32 bits");
 +#if 0 /* disabled for RHEL */
     object_class_property_add_bool(oc, "compact-highmem",
                                    virt_get_compact_highmem,
                                    virt_set_compact_highmem);
     object_class_property_set_description(oc, "compact-highmem",
                                           "Set on/off to enable/disable compact "
                                           "layout for high memory regions");
 +#endif /* disabled for RHEL */
     object_class_property_add_bool(oc, "highmem-redists",
                                    virt_get_highmem_redists,
@@ -3163,7 +3184,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                   virt_set_gic_version);
     object_class_property_set_description(oc, "gic-version",
                                           "Set GIC version. "
 -                                          "Valid values are 2, 3, 4, host and max");
 +                                          "Valid values are 2, 3, host and max");
     object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
     object_class_property_set_description(oc, "iommu",
@@ -3183,11 +3204,13 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                           "Set on/off to enable/disable reporting host memory errors "
                                           "to a KVM guest using ACPI and guest external abort exceptions");
 +#if 0 /* disabled for RHEL */
     object_class_property_add_bool(oc, "mte", virt_get_mte, virt_set_mte);
     object_class_property_set_description(oc, "mte",
                                           "Set on/off to enable/disable emulating a "
                                           "guest CPU which implements the ARM "
                                           "Memory Tagging Extension");
 +#endif /* disabled for RHEL */
     object_class_property_add_bool(oc, "its", virt_get_its,
                                    virt_set_its);
@@ -3195,6 +3218,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                           "Set on/off to enable/disable "
                                           "ITS instantiation");
 +#if 0 /* disabled for RHEL */
     object_class_property_add_bool(oc, "dtb-randomness",
                                    virt_get_dtb_randomness,
                                    virt_set_dtb_randomness);
@@ -3207,6 +3231,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                    virt_set_dtb_randomness);
     object_class_property_set_description(oc, "dtb-kaslr-seed",
                                           "Deprecated synonym of dtb-randomness");
 +#endif /* disabled for RHEL */
     object_class_property_add_str(oc, "x-oem-id",
                                   virt_get_oem_id,
@@ -3554,3 +3579,39 @@ static void virt_machine_2_6_options(MachineClass *mc)
 }
 DEFINE_VIRT_MACHINE(2, 6)
 #endif /* disabled for RHEL */
 +
 +static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 +}
 +DEFINE_VIRT_MACHINE_AS_LATEST(9, 4, 0)
 +
 +static void virt_rhel_machine_9_2_0_options(MachineClass *mc)
 +{
 +    virt_rhel_machine_9_4_0_options(mc);
 +
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +
 +    /* RHEL 9.4 is the first supported release */
 +    mc->deprecation_reason =
 +        "machine types for versions prior to 9.4 are deprecated";
 +}
 +DEFINE_VIRT_MACHINE(9, 2, 0)
 +
 +static void virt_rhel_machine_9_0_0_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
 +    virt_rhel_machine_9_2_0_options(mc);
 +
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
 +    /* Compact layout for high memory regions was introduced with 9.2.0 */
 +    vmc->no_highmem_compact = true;
 +}
 +DEFINE_VIRT_MACHINE(9, 0, 0)
 -- 
 2.39.3
--- a/0012-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
+++ b/0012-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
@ -0,0 +1,208 @@
 From 24d6b22e10c87e9a4bf4df834738f42caa1d5014 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:44:36 +0100
 Subject: Add downstream s390x versioned 's390-ccw-virtio' machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes(9.1.0 rc0):
 - Convert to new DEFINE_CCW_MACHINE macros
 Merged patches (9.1.0 rc0):
 - 043ad5ce97 Add upstream compatibility bits (partial)
 - 04596b496e s390x: remove deprecated rhel machine types
 ---
 hw/s390x/s390-virtio-ccw.c       | 65 +++++++++++++++++++++++++++++---
 target/s390x/cpu_models.c        | 11 ++++++
 target/s390x/cpu_models.h        |  2 +
 target/s390x/cpu_models_sysemu.c |  2 +
 4 files changed, 75 insertions(+), 5 deletions(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 86bfc9d2eb..451017c50e 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -617,6 +617,7 @@ static void s390_nmi(NMIState *n, int cpu_index, Error **errp)
     s390_cpu_restart(S390_CPU(cs));
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static ram_addr_t s390_fixup_ram_size(ram_addr_t sz)
 {
     /* same logic as in sclp.c */
@@ -636,6 +637,7 @@ static ram_addr_t s390_fixup_ram_size(ram_addr_t sz)
     }
     return newsz;
 }
 +#endif /* disabled for RHEL */
 static inline bool machine_get_aes_key_wrap(Object *obj, Error **errp)
 {
@@ -837,7 +839,7 @@ static const TypeInfo ccw_machine_info = {
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         MACHINE_VER_SYM(class_options, ccw, __VA_ARGS__)(mc);                 \
 -        mc->desc = "Virtual s390x machine (version " MACHINE_VER_STR(__VA_ARGS__) ")"; \
 +        mc->desc = "Virtual s390x machine (version rhel" MACHINE_VER_STR(__VA_ARGS__) ")"; \
         MACHINE_VER_DEPRECATION(__VA_ARGS__);                                 \
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
@@ -864,11 +866,11 @@ static const TypeInfo ccw_machine_info = {
     }                                                                         \
     type_init(MACHINE_VER_SYM(register, ccw, __VA_ARGS__))
 -#define DEFINE_CCW_MACHINE_AS_LATEST(major, minor) \
 -    DEFINE_CCW_MACHINE_IMPL(true, major, minor)
 +#define DEFINE_CCW_MACHINE_AS_LATEST(major, minor, micro) \
 +    DEFINE_CCW_MACHINE_IMPL(true, major, minor, micro)
 -#define DEFINE_CCW_MACHINE(major, minor) \
 -    DEFINE_CCW_MACHINE_IMPL(false, major, minor)
 +#define DEFINE_CCW_MACHINE(major, minor, micro) \
 +    DEFINE_CCW_MACHINE_IMPL(false, major, minor, micro)
 #if 0 /* Disabled for Red Hat Enterprise Linux */
@@ -1308,6 +1310,59 @@ DEFINE_CCW_MACHINE(2, 4);
 #endif
 #endif /* disabled for RHEL */
 +static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 +}
 +DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
 +
 +static void ccw_rhel_machine_9_2_0_instance_options(MachineState *machine)
 +{
 +    ccw_rhel_machine_9_4_0_instance_options(machine);
 +}
 +
 +static void ccw_rhel_machine_9_2_0_class_options(MachineClass *mc)
 +{
 +    ccw_rhel_machine_9_4_0_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
 +DEFINE_CCW_MACHINE(9, 2, 0);
 +
 +static void ccw_rhel_machine_9_0_0_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
 +
 +    ccw_rhel_machine_9_2_0_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
 +}
 +
 +static void ccw_rhel_machine_9_0_0_class_options(MachineClass *mc)
 +{
 +    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_rhel_machine_9_2_0_class_options(mc);
 +
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +    s390mc->max_threads = S390_MAX_CPUS;
 +}
 +DEFINE_CCW_MACHINE(9, 0, 0);
 +
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 798c18f940..8afa9af1a5 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -47,6 +47,9 @@
  * of a following release have been a superset of the previous release. With
  * generation 15 one base feature and one optional feature have been deprecated.
  */
 +
 +#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 +
 static S390CPUDef s390_cpu_defs[] = {
     /*
      * Linux requires at least z10 nowadays, and IBM only supports recent CPUs
@@ -871,22 +874,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* all base models are migration safe */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->is_static = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* model that can change between QEMU versions */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
 index 71d4bc2dd4..d6c7c2cb50 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
 } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index f6df691b66..b8de04de99 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -56,6 +56,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     CpuDefinitionInfo *info;
     char *name = g_strdup(object_class_get_name(klass));
     S390CPUClass *scc = S390_CPU_CLASS(klass);
 +    CPUClass *cc = CPU_CLASS(klass);
     /* strip off the -s390x-cpu */
     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
@@ -65,6 +66,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     info->migration_safe = scc->is_migration_safe;
     info->q_static = scc->is_static;
     info->q_typename = g_strdup(object_class_get_name(klass));
 +    info->deprecated = !!cc->deprecation_note;
     /* check for unavailable features */
     if (cpu_list_data->model) {
         Object *obj;
 -- 
 2.39.3
--- a/0013-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
+++ b/0013-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
@ -1,44 +1,54 @@
-From ec10588d2f5d748005e0dca42b299ae15868a900 Mon Sep 17 00:00:00 2001
+From c8510c21f0fde361d6cbce81bfb2f4acb6941b58 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Fri, 19 Oct 2018 13:10:31 +0200
+Date: Wed, 3 Jul 2024 13:44:41 +0100
-Subject: Add x86_64 machine types
+Subject: Add downstream x86_64 versioned 'pc' & 'q35' machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.1.0 rc0):
 - Merged pc_q35_machine_rhel_options back into
  pc_q35_machine_options to reduce delta to upstream
 - Convert to new DEFINE_(I440FX|Q35)_MACHINE macros
 Rebase notes (9.1.0 rc4):
 - Moved x86 cpu deprecation note to device disable patch
 Merged patches (9.1.0 rc0):
 - 043ad5ce97 Add upstream compatibility bits (partial)
 ---
 hw/i386/fw_cfg.c           |   2 +-
- hw/i386/pc.c               | 159 ++++++++++++++++++++-
+ hw/i386/pc.c               | 159 ++++++++++++++++++++++++++++-
- hw/i386/pc_piix.c          | 109 ++++++++++++++
+ hw/i386/pc_piix.c          | 102 ++++++++++++++++++-
- hw/i386/pc_q35.c           | 285 +++++++++++++++++++++++++++++++++++++
+ hw/i386/pc_q35.c           | 204 +++++++++++++++++++++++++++++++++++--
 include/hw/boards.h        |   2 +
- include/hw/i386/pc.h       |  33 +++++
+ include/hw/i386/pc.h       |  33 ++++++
 target/i386/cpu.c          |  21 +++
 target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
- 10 files changed, 617 insertions(+), 4 deletions(-)
+ 9 files changed, 499 insertions(+), 13 deletions(-)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index c7aa39a13e..283c3f4c16 100644
+index 33ef280420..a322709ffa 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
-@@ -63,7 +63,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+@@ -73,7 +73,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
 -        smbios_set_defaults("QEMU", mc->desc, mc->name,
 +        smbios_set_defaults("Red Hat", "KVM", mc->desc,
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 5c21b0c4db..4a154c1a9a 100644
+index 7779c88a91..a49d346d2e 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -326,6 +326,161 @@ GlobalProperty pc_compat_2_0[] = {
+@@ -276,6 +276,161 @@ const size_t pc_compat_2_4_len = G_N_ELEMENTS(pc_compat_2_4);
- };
+  */
- const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
+ #define PC_FW_DATA (0x20000 + 0x8000)
 +/* This macro is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
@ -198,15 +208,15 @@ index 5c21b0c4db..4a154c1a9a 100644
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
-@@ -1813,6 +1968,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1767,6 +1922,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->resizable_acpi_blob = true;
+     pcmc->kvmclock_create_always = true;
     x86mc->apic_xrupt_override = true;
     assert(!mc->get_hotplug_handler);
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
-     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
+     mc->auto_enable_numa_with_memhp = true;
-@@ -1823,7 +1979,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1774,7 +1930,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->has_hotpluggable_cpus = true;
     mc->default_boot_order = "cad";
     mc->block_default_type = IF_IDE;
@ -217,7 +227,7 @@ index 5c21b0c4db..4a154c1a9a 100644
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 18ba076609..a647262d63 100644
+index 67107b174a..5535e1ffbf 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -52,6 +52,7 @@
@ -228,19 +238,21 @@ index 18ba076609..a647262d63 100644
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
-@@ -422,6 +423,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
+@@ -445,8 +446,8 @@ static void pc_i440fx_init(MachineState *machine)
-  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
+     pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
-  */
+ }
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
+-#define DEFINE_I440FX_MACHINE(major, minor) \
- static void pc_compat_2_3_fn(MachineState *machine)
+-    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor);
- {
+#define DEFINE_I440FX_MACHINE(major, minor, micro) \
-     X86MachineState *x86ms = X86_MACHINE(machine);
+    DEFINE_PC_VER_MACHINE(pc_i440fx, "pc-i440fx", pc_i440fx_init, major, minor, micro);
-@@ -951,3 +953,110 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+ 
 #if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_machine_options(MachineClass *m)
@@ -826,3 +827,100 @@ static void xenfv_machine_3_1_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
-                   xenfv_3_1_machine_options);
+                   xenfv_machine_3_1_options);
 #endif
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
@ -251,7 +263,6 @@ index 18ba076609..a647262d63 100644
 +    m->family = "pc_piix_Y";
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->pci_root_uid = 0;
 +    pcmc->resizable_acpi_blob = true;
 +    m->default_nic = "e1000";
 +    m->default_display = "std";
 +    m->no_parallel = 1;
@ -264,12 +275,7 @@ index 18ba076609..a647262d63 100644
 +    m->smp_props.prefer_sockets = true;
 +}
 +
-+static void pc_init_rhel760(MachineState *machine)
+static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    ObjectClass *oc = OBJECT_CLASS(m);
@ -278,9 +284,6 @@ index 18ba076609..a647262d63 100644
 +    m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
@ -302,7 +305,8 @@ index 18ba076609..a647262d63 100644
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
-+
+    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
@ -345,78 +349,63 @@ index 18ba076609..a647262d63 100644
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
+DEFINE_I440FX_MACHINE(7, 6, 0);
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index c7bc8a2041..e872dc7e46 100644
+index 5fb283f2df..2ca9ff3747 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -341,6 +341,7 @@ static void pc_q35_init(MachineState *machine)
+@@ -338,20 +338,19 @@ static void pc_q35_machine_options(MachineClass *m)
-     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
+     pcmc->pci_root_uid = 0;
     pcmc->default_cpu_version = 1;
 -    m->family = "pc_q35";
 -    m->desc = "Standard PC (Q35 + ICH9, 2009)";
 +    m->family = "pc_q35_Z";
     m->units_per_default_bus = 1;
 -    m->default_machine_opts = "firmware=bios-256k.bin";
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
     m->default_display = "std";
     m->default_nic = "e1000e";
 -    m->default_kernel_irqchip_split = false;
     m->no_floppy = 1;
 -    m->max_cpus = 4096;
 -    m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
 +    m->max_cpus = 710;
 +    m->no_parallel = 1;
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 -    machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
 +    m->alias = "q35";
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
     compat_props_add(m->compat_props,
                      pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 }
@@ -670,3 +669,194 @@ static void pc_q35_machine_2_4_options(MachineClass *m)
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_Q35_MACHINE(2, 4);
- static void pc_q35_machine_options(MachineClass *m)
+ #endif /* Disabled for Red Hat Enterprise Linux */
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
@@ -693,3 +694,287 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
-+/* Options for the latest rhel q35 machine type */
+static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
 +static void pc_q35_machine_rhel_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pcmc->pci_root_uid = 0;
+    pc_q35_machine_options(m);
 +    m->default_nic = "e1000e";
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
 +    pcmc->default_cpu_version = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
 +    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    compat_props_add(m->compat_props,
 +                     pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel940_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
+DEFINE_Q35_MACHINE_BUGFIX(9, 4, 0);
 +                  pc_q35_machine_rhel940_options);
 +
-+
+static void pc_q35_rhel_machine_9_2_0_options(MachineClass *m)
 +static void pc_q35_init_rhel920(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel920_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel940_options(m);
+    pc_q35_rhel_machine_9_4_0_options(m);
 +    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
@ -439,18 +428,12 @@ index c7bc8a2041..e872dc7e46 100644
 +                     pc_rhel_9_2_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel920, "pc-q35-rhel9.2.0", pc_q35_init_rhel920,
+DEFINE_Q35_MACHINE_BUGFIX(9, 2, 0);
 +                  pc_q35_machine_rhel920_options);
 +
-+static void pc_q35_init_rhel900(MachineState *machine)
+static void pc_q35_rhel_machine_9_0_0_options(MachineClass *m)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel900_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel920_options(m);
+    pc_q35_rhel_machine_9_2_0_options(m);
 +    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
@ -464,43 +447,27 @@ index c7bc8a2041..e872dc7e46 100644
 +                     pc_rhel_9_0_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
+DEFINE_Q35_MACHINE_BUGFIX(9, 0, 0);
 +                  pc_q35_machine_rhel900_options);
 +
-+static void pc_q35_init_rhel860(MachineState *machine)
+static void pc_q35_rhel_machine_8_6_0_options(MachineClass *m)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel860_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel900_options(m);
+    pc_q35_rhel_machine_9_0_0_options(m);
 +    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
+DEFINE_Q35_MACHINE_BUGFIX(8, 6, 0);
 +                  pc_q35_machine_rhel860_options);
 +
-+
+static void pc_q35_rhel_machine_8_5_0_options(MachineClass *m)
 +static void pc_q35_init_rhel850(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel850_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel860_options(m);
+    pc_q35_rhel_machine_8_6_0_options(m);
 +    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
@ -512,19 +479,12 @@ index c7bc8a2041..e872dc7e46 100644
 +    m->smp_props.prefer_sockets = true;
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
+DEFINE_Q35_MACHINE_BUGFIX(8, 5, 0);
 +                  pc_q35_machine_rhel850_options);
 +
-+
+static void pc_q35_rhel_machine_8_4_0_options(MachineClass *m)
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel850_options(m);
+    pc_q35_rhel_machine_8_5_0_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
@ -535,19 +495,12 @@ index c7bc8a2041..e872dc7e46 100644
 +                     pc_rhel_8_4_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
+DEFINE_Q35_MACHINE_BUGFIX(8, 4, 0);
 +                  pc_q35_machine_rhel840_options);
 +
-+
+static void pc_q35_rhel_machine_8_3_0_options(MachineClass *m)
 +static void pc_q35_init_rhel830(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel830_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel840_options(m);
+    pc_q35_rhel_machine_8_4_0_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
@ -562,18 +515,12 @@ index c7bc8a2041..e872dc7e46 100644
 +    pcmc->pci_root_uid = 1;
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
+DEFINE_Q35_MACHINE_BUGFIX(8, 3, 0);
 +                  pc_q35_machine_rhel830_options);
 +
-+static void pc_q35_init_rhel820(MachineState *machine)
+static void pc_q35_rhel_machine_8_2_0_options(MachineClass *m)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel830_options(m);
+    pc_q35_rhel_machine_8_3_0_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    m->numa_mem_supported = true;
@ -586,18 +533,12 @@ index c7bc8a2041..e872dc7e46 100644
 +                     pc_rhel_8_2_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
+DEFINE_Q35_MACHINE_BUGFIX(8, 2, 0);
 +                  pc_q35_machine_rhel820_options);
 +
-+static void pc_q35_init_rhel810(MachineState *machine)
+static void pc_q35_rhel_machine_8_1_0_options(MachineClass *m)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel820_options(m);
+    pc_q35_rhel_machine_8_2_0_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = NULL;
@ -606,18 +547,12 @@ index c7bc8a2041..e872dc7e46 100644
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
+DEFINE_Q35_MACHINE_BUGFIX(8, 1, 0);
 +                  pc_q35_machine_rhel810_options);
 +
-+static void pc_q35_init_rhel800(MachineState *machine)
+static void pc_q35_rhel_machine_8_0_0_options(MachineClass *m)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel800_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel810_options(m);
+    pc_q35_rhel_machine_8_1_0_options(m);
 +    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
@ -627,17 +562,11 @@ index c7bc8a2041..e872dc7e46 100644
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
+DEFINE_Q35_MACHINE_BUGFIX(8, 0, 0);
 +                  pc_q35_machine_rhel800_options);
 +
-+static void pc_q35_init_rhel760(MachineState *machine)
+static void pc_q35_rhel_machine_7_6_0_options(MachineClass *m)
 +{
-+    pc_q35_init(machine);
+    pc_q35_rhel_machine_8_0_0_options(m);
 +}
 +
 +static void pc_q35_machine_rhel760_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel800_options(m);
 +    m->alias = NULL;
 +    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
 +    m->async_pf_vmexit_disable = true;
@ -645,13 +574,13 @@ index c7bc8a2041..e872dc7e46 100644
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
-+DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
+DEFINE_Q35_MACHINE_BUGFIX(7, 6, 0);
-+                  pc_q35_machine_rhel760_options);
+
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 0466f9d0f3..46b8725c41 100644
+index fd5a957cad..3dea5cee73 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -283,6 +283,8 @@ struct MachineClass {
+@@ -289,6 +289,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
@ -661,12 +590,12 @@ index 0466f9d0f3..46b8725c41 100644
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index ebd8f973f2..a984c951ad 100644
+index 8776a3c937..8e9597f40f 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -291,6 +291,39 @@ extern const size_t pc_compat_2_1_len;
+@@ -302,6 +302,39 @@ extern const size_t pc_compat_2_4_len;
- extern GlobalProperty pc_compat_2_0[];
+ extern GlobalProperty pc_compat_2_3[];
- extern const size_t pc_compat_2_0_len;
+ extern const size_t pc_compat_2_3_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
@ -704,165 +633,11 @@ index ebd8f973f2..a984c951ad 100644
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
     { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 33760a2ee1..be7b0663cd 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
  *  PT in VMX operation
  */
 +#define RHEL_CPU_DEPRECATION \
 +    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
 +
 static const X86CPUDefinition builtin_x86_defs[] = {
     {
         .name = "qemu64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -2213,6 +2217,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "phenom",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
@@ -2245,6 +2250,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "core2duo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2287,6 +2293,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2328,6 +2335,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "qemu32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 4,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2342,6 +2350,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2372,6 +2381,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "coreduo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2405,6 +2415,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "486",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 4,
@@ -2417,6 +2428,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 5,
@@ -2429,6 +2441,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2441,6 +2454,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 3,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2453,6 +2467,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "athlon",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
@@ -2468,6 +2483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "n270",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2493,6 +2509,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Conroe",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2533,6 +2550,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Penryn",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4394,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G1",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4414,6 +4433,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4436,6 +4456,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 9c791b7b05..b91af5051f 100644
+index 6bf8dcfc60..684e731cbc 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
-@@ -138,6 +138,7 @@ static PropValue kvm_default_props[] = {
+@@ -178,6 +178,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
@ -871,10 +646,10 @@ index 9c791b7b05..b91af5051f 100644
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index e68cbe9293..739f33db47 100644
+index 2fa88ef1e3..2b28c18693 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
-@@ -3715,6 +3715,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4244,6 +4244,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
@ -882,7 +657,7 @@ index e68cbe9293..739f33db47 100644
     kvm_msr_buf_reset(cpu);
-@@ -4069,6 +4070,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4636,6 +4637,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
@ -893,10 +668,10 @@ index e68cbe9293..739f33db47 100644
         case MSR_KVM_ASYNC_PF_INT:
             env->async_pf_int_msr = msrs[i].data;
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-index 78f1cf8186..ac954c9b06 100644
+index d49d2ba931..c18f63e255 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
-@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
+@@ -18,7 +18,7 @@ static void test_panic_nopause(void)
     QDict *response, *data;
     QTestState *qts;
@ -904,8 +679,8 @@ index 78f1cf8186..ac954c9b06 100644
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
+     g_assert_cmpuint(val, ==, PVPANIC_EVENTS);
-@@ -40,7 +40,8 @@ static void test_panic(void)
+@@ -41,7 +41,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
@ -914,7 +689,7 @@ index 78f1cf8186..ac954c9b06 100644
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
+     g_assert_cmpuint(val, ==, PVPANIC_EVENTS);
 -- 
 2.39.3
--- a/0014-Revert-meson-temporarily-disable-Wunused-function.patch
+++ b/0014-Revert-meson-temporarily-disable-Wunused-function.patch
@ -0,0 +1,32 @@
 From bd6f1170d3a011c475ec4a8315512c7c190de3e4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Wed, 3 Jul 2024 13:47:04 +0100
 Subject: Revert "meson: temporarily disable -Wunused-function"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This reverts commit c682111eaa73d9b985187b8be330338f50b78a7a.
 No longer needed after introduction of downstream machines.
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 ---
 meson.build | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/meson.build b/meson.build
 index 2de5ab024f..b3529aa0e1 100644
 --- a/meson.build
 +++ b/meson.build
@@ -651,7 +651,6 @@ warn_flags = [
   '-Wno-string-plus-int',
   '-Wno-tautological-type-limit-compare',
   '-Wno-typedef-redefinition',
 -  '-Wno-unused-function',
 ]
 if host_os != 'darwin'
 -- 
 2.39.3
--- a/0015-Add-upstream-compatibility-bits.patch
+++ b/0015-Add-upstream-compatibility-bits.patch
@ -1,145 +0,0 @@
 From 043ad5ce9789dbbfe1a888de58f6039ea7ae47a4 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 20 Mar 2024 05:34:32 -0400
 Subject: Add upstream compatibility bits
 Adding new compats structure for changes introduced during rebase to QEMU 9.0.0.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.0.0 rc2):
 - Add aw-bits setting for aarch compat record (overwritten for 9.4 and older)
 ---
 hw/arm/virt.c              |  6 ++++--
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  3 ++-
 hw/i386/pc_q35.c           |  3 +++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 6 files changed, 23 insertions(+), 3 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 22bc345137..3f0496cdb9 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -85,6 +85,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static GlobalProperty arm_virt_compat[] = {
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
 };
@@ -101,7 +102,6 @@ static void arm_virt_compat_set(MachineClass *mc)
                      arm_virt_compat_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
@@ -144,6 +144,8 @@ GlobalProperty arm_rhel_compat[] = {
     {"virtio-net-pci", "romfile", "" },
     {"virtio-net-pci-transitional", "romfile", "" },
     {"virtio-net-pci-non-transitional", "romfile", "" },
 +    /* arm_rhel_compat from arm_virt_compat, added for 9.0.0 rebase */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
 };
 const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
@@ -3534,7 +3536,6 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 -    arm_virt_compat_set(mc);
     mc->family = "virt-rhel-Z";
     mc->init = machvirt_init;
@@ -3728,6 +3729,7 @@ type_init(rhel_machine_init);
 static void rhel940_virt_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 695cb89a46..0f256d9633 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -302,6 +302,16 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +GlobalProperty hw_compat_rhel_9_5[] = {
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "migration", "zero-page-detection", "legacy"},
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +};
 +const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
 +
 GlobalProperty hw_compat_rhel_9_4[] = {
   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
     { TYPE_VIRTIO_NET, "host_uso", "off"},
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index a647262d63..6b260682eb 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1015,7 +1015,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     object_class_property_set_description(oc, "x-south-bridge",
                                      "Use a different south bridge than PIIX3");
 -
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
                      hw_compat_rhel_9_4_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index e872dc7e46..2b54944c0f 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -733,6 +733,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 }
 DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index ff753a29e0..9ad54682c6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1282,6 +1282,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
 static void ccw_machine_rhel940_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 46b8725c41..cca62f906b 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -514,6 +514,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_5[];
 +extern const size_t hw_compat_rhel_9_5_len;
 +
 extern GlobalProperty hw_compat_rhel_9_4[];
 extern const size_t hw_compat_rhel_9_4_len;
 -- 
 2.39.3
--- a/0015-Enable-make-check.patch
+++ b/0015-Enable-make-check.patch
@ -1,4 +1,4 @@
-From 241ad69d849fce983685fc754fc0572c5b737cbe Mon Sep 17 00:00:00 2001
+From 3c4bab07566d32859e227ca1083b0dc64111e3f7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
@ -7,11 +7,18 @@ Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.1.0 rc0):
 - Disable fdc-testa
 Rebase notes (9.1.0 rc0):
 - Use q35 machine type for new pvpanic test
 ---
 .distro/qemu-kvm.spec.template      |  4 ++--
 tests/avocado/replay_kernel.py      |  2 +-
 tests/avocado/reverse_debugging.py  |  2 +-
- tests/avocado/tcg_plugins.py        |  6 ++---
+ tests/avocado/tcg_plugins.py        |  4 ++--
 tests/qemu-iotests/meson.build      | 34 ++++++++++++++---------------
 tests/qemu-iotests/testenv.py       |  3 +++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
@ -19,15 +26,16 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 tests/qtest/intel-hda-test.c        |  2 +-
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
- tests/qtest/meson.build             |  1 -
+ tests/qtest/meson.build             |  3 +--
 tests/qtest/pvpanic-test.c          |  2 +-
 tests/qtest/virtio-net-failover.c   |  1 +
- 13 files changed, 33 insertions(+), 30 deletions(-)
+ 14 files changed, 34 insertions(+), 31 deletions(-)
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index 10d99403a4..c3422ea1e4 100644
+index e22c200a36..cb7ca19b1b 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
-@@ -166,7 +166,7 @@ def test_aarch64_virt(self):
+@@ -193,7 +193,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -37,10 +45,10 @@ index 10d99403a4..c3422ea1e4 100644
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index 92855a02a5..87822074b6 100644
+index f24287cd0a..3880b81df6 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
-@@ -230,7 +230,7 @@ def test_aarch64_virt(self):
+@@ -228,7 +228,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
@ -50,7 +58,7 @@ index 92855a02a5..87822074b6 100644
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
-index 15fd87b2c1..f0d9d89c93 100644
+index a6ff457e27..5172ee9b9e 100644
 --- a/tests/avocado/tcg_plugins.py
 +++ b/tests/avocado/tcg_plugins.py
@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
@ -67,15 +75,6 @@ index 15fd87b2c1..f0d9d89c93 100644
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -126,7 +126,7 @@ def test_aarch64_virt_mem_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
@ -124,10 +123,10 @@ index fad340ad59..3c0d5241f6 100644
 +#  endforeach
 endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
-index 588f30a4f1..3929a3634f 100644
+index c8848f2ec2..d515e5b8b0 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
-@@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
+@@ -249,6 +249,9 @@ def __init__(self, source_dir: str, build_dir: str,
             if self.qemu_prog.endswith(f'qemu-system-{suffix}'):
                 self.qemu_options += f' -machine {machine}'
@ -177,7 +176,7 @@ index 663bb6c485..2efc43e3f7 100644
                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
-index 3aed6efcb8..119613237e 100644
+index 1b2b2dbb22..86afbddb58 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -44,7 +44,7 @@ libqos_srcs = files(
@ -203,10 +202,19 @@ index 8ac95b89f7..0e118b76eb 100644
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index 36c5c13a7b..a2887d6057 100644
+index 2f0d3ef080..134c48c10e 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -101,7 +101,6 @@ qtests_i386 = \
+@@ -91,7 +91,7 @@ qtests_i386 = \
    config_all_devices.has_key('CONFIG_PARALLEL') ? ['bios-tables-test'] : []) +             \
   qtests_pci +                                                                              \
   qtests_cxl +                                                                              \
 -  ['fdc-test',
 +  [
    'ide-test',
    'hd-geo-test',
    'boot-order-test',
@@ -102,7 +102,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
@ -214,6 +222,19 @@ index 36c5c13a7b..a2887d6057 100644
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
 index c18f63e255..57fb129ae4 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -65,7 +65,7 @@ static void test_pvshutdown(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic");
 +    qts = qtest_init("-M q35 -device pvpanic");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, PVPANIC_EVENTS);
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
 index 73dfabc272..a9dd304781 100644
 --- a/tests/qtest/virtio-net-failover.c
--- a/0016-Disable-FDC-devices.patch
+++ b/0016-Disable-FDC-devices.patch
@ -1,29 +0,0 @@
 From f24c7a1feef2a6f153582c06f10871b78a014bf1 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 26 Apr 2024 05:58:31 -0400
 Subject: Disable FDC devices
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index d60ff1bcfc..ee75bb4c21 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -19,9 +19,9 @@ CONFIG_DIMM=y
 CONFIG_E1000E_PCI_EXPRESS=y
 CONFIG_E1000_PCI=y
 CONFIG_EDU=y
 -CONFIG_FDC=y
 -CONFIG_FDC_SYSBUS=y
 -CONFIG_FDC_ISA=y
 +#CONFIG_FDC=y
 +#CONFIG_FDC_SYSBUS=y
 +#CONFIG_FDC_ISA=y
 CONFIG_FW_CFG_DMA=y
 CONFIG_HDA=y
 CONFIG_HYPERV=y
 -- 
 2.39.3
--- a/0016-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/0016-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From 8ba1a6d1a432e2ae82ae532253c2b254e6ce82a7 Mon Sep 17 00:00:00 2001
+From 9813098fb73e899dd1d824f9c1e7e570a87b1771 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -23,7 +23,7 @@ Signed-off-by: Bandan Das <bsd@redhat.com>
 2 files changed, 31 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 64780d1b79..57ac63c10c 100644
+index 2407720c35..82a47edc89 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
@@ -50,6 +50,9 @@
@ -36,19 +36,16 @@ index 64780d1b79..57ac63c10c 100644
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
 static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
-@@ -2946,13 +2949,36 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2963,10 +2966,33 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     ERRP_GUARD();
     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char *tmp, *subsys;
     Error *err = NULL;
 -    int i, ret;
 +    int ret, i = 0;
-     bool is_mdev;
+    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char uuid[UUID_STR_LEN];
-     char *name;
+     g_autofree char *name = NULL;
 +    if (device_limit && device_limit != vdev->assigned_device_limit) {
 +            error_setg(errp, "Assigned device limit has been redefined. "
@ -74,7 +71,7 @@ index 64780d1b79..57ac63c10c 100644
     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3370,6 +3396,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3388,6 +3414,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -85,7 +82,7 @@ index 64780d1b79..57ac63c10c 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 6e64a2654e..b7de39c010 100644
+index bf67df2fbc..0d3c93fb2e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
--- a/0017-Add-support-statement-to-help-output.patch
+++ b/0017-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From 7bc7a2d39bb2c00bcc8e573f05e629f5f21edc35 Mon Sep 17 00:00:00 2001
+From e46f7b696ec32b18969c9cd7c1553d7d30e489b3 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -12,10 +12,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 1 file changed, 9 insertions(+)
 diff --git a/system/vl.c b/system/vl.c
-index c644222982..03c3b0aa94 100644
+index 01b8b8e77a..5359231bf5 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -869,9 +869,17 @@ static void version(void)
+@@ -877,9 +877,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -33,7 +33,7 @@ index c644222982..03c3b0aa94 100644
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
             g_get_prgname());
-@@ -897,6 +905,7 @@ static void help(int exitcode)
+@@ -905,6 +913,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
--- a/0017-Disable-vga-cirrus-device.patch
+++ b/0017-Disable-vga-cirrus-device.patch
@ -1,24 +0,0 @@
 From fe8c6cb1cecb3cde16871c4ec7368e4d004fa42a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 26 Apr 2024 05:59:53 -0400
 Subject: Disable vga-cirrus device
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ee75bb4c21..fe69f04ead 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -87,7 +87,6 @@ CONFIG_USB_XHCI_PCI=y
 CONFIG_VFIO=y
 CONFIG_VFIO_PCI=y
 CONFIG_VGA=y
 -CONFIG_VGA_CIRRUS=y
 CONFIG_VGA_PCI=y
 CONFIG_VHOST_USER=y
 CONFIG_VHOST_USER_BLK=y
 -- 
 2.39.3
--- a/0018-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0018-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,4 +1,4 @@
-From ec651d300d350a37219b09f5baab827ae6891006 Mon Sep 17 00:00:00 2001
+From 40274d161d20719709d92356077175f93795ea1e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
@ -27,10 +27,10 @@ index 52d6454b93..d74dbdeca9 100644
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 8ce85d4559..4fc27ee2e2 100644
+index d94e2cbbae..a7444abc7f 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3493,11 +3493,11 @@ SRST
+@@ -3688,11 +3688,11 @@ SRST
     ::
--- a/0019-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/0019-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,4 +1,4 @@
-From 080f22d8fb8ca63996f1b6ecb3637033529d8016 Mon Sep 17 00:00:00 2001
+From 728e3d8a124f4ec51c005ad6867270f3e60df16c Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
@ -25,7 +25,7 @@ Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
-index 956128b409..0e8b2f7518 100644
+index 70b19730a3..a4cffb628c 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
@ -42,7 +42,7 @@ index 956128b409..0e8b2f7518 100644
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index 2846c83808..83472953a2 100644
+index fc3c64bcb8..4b238954d5 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -83,6 +83,7 @@ _filter_qemu()
--- a/0021-Add-upstream-compatibility-bits.patch
+++ b/0021-Add-upstream-compatibility-bits.patch
@ -0,0 +1,109 @@
 From 03502faf7012e20fb7c4f1efee7e429ad3727fd1 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 15 May 2024 01:41:13 -0400
 Subject: Add upstream compatibility bits
 ---
 hw/arm/virt.c              |  1 +
 hw/core/machine.c          | 17 +++++++++++++++++
 hw/i386/pc_piix.c          |  2 ++
 hw/i386/pc_q35.c           |  2 ++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 6 files changed, 26 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 903c0f2e9f..3374d3b0bc 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3582,6 +3582,7 @@ DEFINE_VIRT_MACHINE(2, 6)
 static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_10_0, hw_compat_rhel_10_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_VIRT_MACHINE_AS_LATEST(9, 4, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index f7fed78e4b..9cf8242b32 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -311,6 +311,23 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +GlobalProperty hw_compat_rhel_10_0[] = {
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    {"arm-cpu", "backcompat-cntfrq", "true" },
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    { "scsi-hd", "migrate-emulated-scsi-request", "false" },
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    { "scsi-cd", "migrate-emulated-scsi-request", "false" },
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    {"vfio-pci", "skip-vsc-check", "false" },
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    { "virtio-pci", "x-pcie-pm-no-soft-reset", "off" },
 +  /* hw_compat_rhel_10_0 from hw_compat_9_0 */
 +    {"sd-card", "spec_version", "2" },
 +};
 +const size_t hw_compat_rhel_10_0_len = G_N_ELEMENTS(hw_compat_rhel_10_0);
 +
 +
 GlobalProperty hw_compat_rhel_9_5[] = {
   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
     { "migration", "zero-page-detection", "legacy"},
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 5535e1ffbf..447f98b438 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -879,6 +879,8 @@ static void pc_i440fx_rhel_machine_7_6_0_options(MachineClass *m)
     object_class_property_set_description(oc, "x-south-bridge",
                                      "Use a different south bridge than PIIX3");
 +    compat_props_add(m->compat_props, hw_compat_rhel_10_0,
 +                     hw_compat_rhel_10_0_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 		     hw_compat_rhel_9_5_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 2ca9ff3747..849b231a74 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -680,6 +680,8 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_10_0,
 +                     hw_compat_rhel_10_0_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 		     hw_compat_rhel_9_5_len);
 }
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 451017c50e..5db5fed1bf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1316,6 +1316,7 @@ static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
 static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_10_0, hw_compat_rhel_10_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 3dea5cee73..6d98aaf4c7 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -802,6 +802,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_10_0[];
 +extern const size_t hw_compat_rhel_10_0_len;
 +
 extern GlobalProperty hw_compat_rhel_9_5[];
 extern const size_t hw_compat_rhel_9_5_len;
 -- 
 2.39.3
--- a/0022-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
+++ b/0022-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
@ -0,0 +1,37 @@
 From d27437e5baba347cb3392280399d402414dcb21c Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 26 Aug 2024 14:27:49 +0200
 Subject: redhat: Add QEMU 9.1 compat handling to the s390x machine types
 JIRA: https://issues.redhat.com/browse/RHEL-52319
 Upstream changed the amount of information that is migrated for
 the S390 interrupt controller (FLIC), so we have to switch on
 a compatibility property for older machine types.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 5db5fed1bf..feef81ed8b 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1316,8 +1316,13 @@ static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
 static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
 {
 +    static GlobalProperty compat[] = {
 +        { TYPE_QEMU_S390_FLIC, "migrate-all-state", "off", },
 +    };
 +
     compat_props_add(mc->compat_props, hw_compat_rhel_10_0, hw_compat_rhel_10_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
 -- 
 2.39.3
--- a/0023-redhat-Add-rhel9.6.0-and-rhel10.0.0-machine-types.patch
+++ b/0023-redhat-Add-rhel9.6.0-and-rhel10.0.0-machine-types.patch
@ -0,0 +1,66 @@
 From 926a9d0ca2437b4c4270062f707ed24284ad469f Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 26 Aug 2024 14:42:24 +0200
 Subject: redhat: Add rhel9.6.0 and rhel10.0.0 machine types
 JIRA: https://issues.redhat.com/browse/RHEL-52319
 Add a new machine types to enable the latest features by default.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index feef81ed8b..b61392bac1 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1310,8 +1310,29 @@ DEFINE_CCW_MACHINE(2, 4);
 #endif
 #endif /* disabled for RHEL */
 +static void ccw_rhel_machine_10_0_0_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_rhel_machine_10_0_0_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE_AS_LATEST(10, 0, 0);
 +
 +static void ccw_rhel_machine_9_6_0_instance_options(MachineState *machine)
 +{
 +    ccw_rhel_machine_10_0_0_instance_options(machine);
 +}
 +
 +static void ccw_rhel_machine_9_6_0_class_options(MachineClass *mc)
 +{
 +    ccw_rhel_machine_10_0_0_class_options(mc);
 +}
 +DEFINE_CCW_MACHINE(9, 6, 0);
 +
 static void ccw_rhel_machine_9_4_0_instance_options(MachineState *machine)
 {
 +    ccw_rhel_machine_9_6_0_instance_options(machine);
 }
 static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
@@ -1320,11 +1341,13 @@ static void ccw_rhel_machine_9_4_0_class_options(MachineClass *mc)
         { TYPE_QEMU_S390_FLIC, "migrate-all-state", "off", },
     };
 +    ccw_rhel_machine_9_6_0_class_options(mc);
 +
     compat_props_add(mc->compat_props, hw_compat_rhel_10_0, hw_compat_rhel_10_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 -DEFINE_CCW_MACHINE_AS_LATEST(9, 4, 0);
 +DEFINE_CCW_MACHINE(9, 4, 0);
 static void ccw_rhel_machine_9_2_0_instance_options(MachineState *machine)
 {
 -- 
 2.39.3
--- a/0024-x86-ensure-compatibility-of-pc-q35-rhel9.patch
+++ b/0024-x86-ensure-compatibility-of-pc-q35-rhel9.patch
@ -0,0 +1,28 @@
 From 6be70c681bf7a1b9666ed5896b5be8be7df2bf50 Mon Sep 17 00:00:00 2001
 From: Sebastian Ott <sebott@redhat.com>
 Date: Wed, 4 Sep 2024 15:46:53 +0200
 Subject: x86: ensure compatibility of pc-q35-rhel9*
 Signed-off-by: Sebastian Ott <sebott@redhat.com>
 ---
 hw/i386/pc_q35.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 849b231a74..a05df61cfc 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -680,6 +680,10 @@ static void pc_q35_rhel_machine_9_4_0_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +    /* From pc_q35_machine_9_0_options() */
 +    pcmc->isa_bios_alias = false;
 +    m->smbios_memory_device_size = 16 * GiB;
 +
     compat_props_add(m->compat_props, hw_compat_rhel_10_0,
                      hw_compat_rhel_10_0_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 -- 
 2.39.3
--- a/0025-arm-ensure-compatibility-of-virt-rhel9.patch
+++ b/0025-arm-ensure-compatibility-of-virt-rhel9.patch
@ -0,0 +1,27 @@
 From 17c3bccf2f2804772ab60bf4f04d7437f13ed48a Mon Sep 17 00:00:00 2001
 From: Sebastian Ott <sebott@redhat.com>
 Date: Wed, 4 Sep 2024 15:52:00 +0200
 Subject: arm: ensure compatibility of virt-rhel9*
 Signed-off-by: Sebastian Ott <sebott@redhat.com>
 ---
 hw/arm/virt.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 3374d3b0bc..31a71a7f45 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3582,6 +3582,9 @@ DEFINE_VIRT_MACHINE(2, 6)
 static void virt_rhel_machine_9_4_0_options(MachineClass *mc)
 {
 +    /* From virt_machine_9_0_options() */
 +    mc->smbios_memory_device_size = 16 * GiB;
 +
     compat_props_add(mc->compat_props, hw_compat_rhel_10_0, hw_compat_rhel_10_0_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 -- 
 2.39.3
--- a/README.rst
+++ b/README.rst
@ -0,0 +1,19 @@
 ===================
 qemu-kvm development
 ===================
 qemu-kvm is maintained in a `source tree`_ rather than directly in dist-git.
 This provides way to develope using regular source code structure and provides 
 way to generate SRPM and build using koji service. In addition, local build using
 CentOS 9 Stream specific configuration.
 Developers deliver all changes to source-git using merge request. Only maintainers
 will be pushing changes sent to source-git to dist-git.
 Each release in dist-git is tagged in the source repository so you can easily
 check out the source tree for a build. The tags are in the format
 name-version-release, but note release doesn't contain the dist tag since the
 source can be built in different build roots (Fedora, CentOS, etc.)
 .. _source tree: https://gitlab.com/redhat/centos-stream/src/qemu-kvm
--- a/kvm-Enable-vhost-user-scmi-devices.patch
+++ b/kvm-Enable-vhost-user-scmi-devices.patch
@ -1,50 +0,0 @@
 From ca89f2eb9588bfebe2796a579a563bd974dadf72 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 24 Jul 2024 07:31:12 -0400
 Subject: [PATCH] Enable vhost-user-scmi devices
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 258: Enable vhost-user-scmi devices
 RH-Jira: RHEL-50165
 RH-Acked-by: Sandro Bonazzola <None>
 RH-Commit: [1/1] edf95ef0fab99eb079beb16409fdab2a3cb0b94b (mrezanin/centos-src-qemu-kvm)
 Enabling vhost-user-scmi and vhost-user-scmi-pci devices for qemu-kvm.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
 configs/devices/s390x-softmmu/s390x-rh-devices.mak     | 1 +
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak   | 1 +
 3 files changed, 3 insertions(+)
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 index 0a95438e25..4495d033e5 100644
 --- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -41,3 +41,4 @@ CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 CONFIG_VHOST_USER_SND=y
 +CONFIG_VHOST_USER_SCMI=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 index 719f802565..963ec43b6c 100644
 --- a/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -18,3 +18,4 @@ CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 CONFIG_VHOST_USER_SND=y
 +CONFIG_VHOST_USER_SCMI=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index b85bb1fe53..276397f3be 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -110,3 +110,4 @@ CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 CONFIG_VHOST_USER_SND=y
 +CONFIG_VHOST_USER_SCMI=y
 -- 
 2.39.3
--- a/kvm-Enable-vhost-user-snd-pci-device.patch
+++ b/kvm-Enable-vhost-user-snd-pci-device.patch
@ -1,50 +0,0 @@
 From d7256c0d15a3ae142c80462c66e0d68120ebd001 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 22 May 2024 03:56:55 -0400
 Subject: [PATCH] Enable vhost-user-snd-pci device
 RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
 RH-MergeRequest: 242: Enable vhost-user-snd-pci device
 RH-Jira: RHEL-37563
 RH-Acked-by: Sandro Bonazzola <None>
 RH-Commit: [1/1] 014f47770fc9f7d4bd0e7fac9a072911325f3283 (mrezanin/centos-src-qemu-kvm)
 RHIVOS requires vhost-user-snd-pci device. Enabling it for aarch64 and x86_64 only.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
 configs/devices/s390x-softmmu/s390x-rh-devices.mak     | 1 +
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak   | 1 +
 3 files changed, 3 insertions(+)
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 index b0191d3c69..0a95438e25 100644
 --- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -40,3 +40,4 @@ CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 +CONFIG_VHOST_USER_SND=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 index 24cf6dbd03..719f802565 100644
 --- a/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -17,3 +17,4 @@ CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 +CONFIG_VHOST_USER_SND=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index fe69f04ead..b85bb1fe53 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -109,3 +109,4 @@ CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 CONFIG_IOMMUFD=y
 +CONFIG_VHOST_USER_SND=y
 -- 
 2.39.3
--- a/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
+++ b/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
@ -1,67 +0,0 @@
 From 53cc7daf2b6356f236a493cbe63d01afc5636fd3 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 6 May 2024 15:06:21 -0400
 Subject: [PATCH 13/14] Revert "monitor: use aio_co_reschedule_self()"
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 253: Revert "monitor: use aio_co_reschedule_self()"
 RH-Jira: RHEL-43409 RHEL-43410
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Commit: [1/2] 772eccc9da09e6c1793d46ab6cf9ee6615812154 (kmwolf/centos-qemu-kvm)
 Commit 1f25c172f837 ("monitor: use aio_co_reschedule_self()") was a code
 cleanup that uses aio_co_reschedule_self() instead of open coding
 coroutine rescheduling.
 Bug RHEL-34618 was reported and Kevin Wolf <kwolf@redhat.com> identified
 the root cause. I missed that aio_co_reschedule_self() ->
 qemu_get_current_aio_context() only knows about
 qemu_aio_context/IOThread AioContexts and not about iohandler_ctx. It
 does not function correctly when going back from the iohandler_ctx to
 qemu_aio_context.
 Go back to open coding the AioContext transitions to avoid this bug.
 This reverts commit 1f25c172f83704e350c0829438d832384084a74d.
 Cc: qemu-stable@nongnu.org
 Buglink: https://issues.redhat.com/browse/RHEL-34618
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20240506190622.56095-2-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 719c6819ed9a9838520fa732f9861918dc693bda)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 qapi/qmp-dispatch.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
 index f3488afeef..176b549473 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
@@ -212,7 +212,8 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
              * executing the command handler so that it can make progress if it
              * involves an AIO_WAIT_WHILE().
              */
 -            aio_co_reschedule_self(qemu_get_aio_context());
 +            aio_co_schedule(qemu_get_aio_context(), qemu_coroutine_self());
 +            qemu_coroutine_yield();
         }
         monitor_set_cur(qemu_coroutine_self(), cur_mon);
@@ -226,7 +227,9 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
              * Move back to iohandler_ctx so that nested event loops for
              * qemu_aio_context don't start new monitor commands.
              */
 -            aio_co_reschedule_self(iohandler_get_aio_context());
 +            aio_co_schedule(iohandler_get_aio_context(),
 +                            qemu_coroutine_self());
 +            qemu_coroutine_yield();
         }
     } else {
        /*
 -- 
 2.39.3
--- a/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
+++ b/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
@ -1,64 +0,0 @@
 From 6c8da957fd534b3546354a8b8252c01cf9ee3511 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 6 May 2024 15:06:22 -0400
 Subject: [PATCH 14/14] aio: warn about iohandler_ctx special casing
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 253: Revert "monitor: use aio_co_reschedule_self()"
 RH-Jira: RHEL-43409 RHEL-43410
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Commit: [2/2] 895231553731f09f51275c1abbf50c3440fe977f (kmwolf/centos-qemu-kvm)
 The main loop has two AioContexts: qemu_aio_context and iohandler_ctx.
 The main loop runs them both, but nested aio_poll() calls on
 qemu_aio_context exclude iohandler_ctx.
 Which one should qemu_get_current_aio_context() return when called from
 the main loop? Document that it's always qemu_aio_context.
 This has subtle effects on functions that use
 qemu_get_current_aio_context(). For example, aio_co_reschedule_self()
 does not work when moving from iohandler_ctx to qemu_aio_context because
 qemu_get_current_aio_context() does not differentiate these two
 AioContexts.
 Document this in order to reduce the chance of future bugs.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20240506190622.56095-3-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit e669e800fc9ef8806af5c5578249ab758a4f8a5a)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 include/block/aio.h | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 8378553eb9..4ee81936ed 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -629,6 +629,9 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co);
  *
  * Move the currently running coroutine to new_ctx. If the coroutine is already
  * running in new_ctx, do nothing.
 + *
 + * Note that this function cannot reschedule from iohandler_ctx to
 + * qemu_aio_context.
  */
 void coroutine_fn aio_co_reschedule_self(AioContext *new_ctx);
@@ -661,6 +664,9 @@ void aio_co_enter(AioContext *ctx, Coroutine *co);
  * If called from an IOThread this will be the IOThread's AioContext.  If
  * called from the main thread or with the "big QEMU lock" taken it
  * will be the main loop AioContext.
 + *
 + * Note that the return value is never the main loop's iohandler_ctx and the
 + * return value is the main loop AioContext instead.
  */
 AioContext *qemu_get_current_aio_context(void);
 -- 
 2.39.3
--- a/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+++ b/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
@ -1,252 +0,0 @@
 From 53153ebcf066e962cd73d7fcfeca53039be2a945 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 25 Apr 2024 14:56:02 +0200
 Subject: [PATCH 4/4] block: Parse filenames only when explicitly requested
 RH-Author: Hana Czenczek <hczenczek@redhat.com>
 RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
 RH-Jira: RHEL-46239
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Commit: [4/4] f44c2941d4419e60f16dea3e9adca164e75aa78d
 When handling image filenames from legacy options such as -drive or from
 tools, these filenames are parsed for protocol prefixes, including for
 the json:{} pseudo-protocol.
 This behaviour is intended for filenames that come directly from the
 command line and for backing files, which may come from the image file
 itself. Higher level management tools generally take care to verify that
 untrusted images don't contain a bad (or any) backing file reference;
 'qemu-img info' is a suitable tool for this.
 However, for other files that can be referenced in images, such as
 qcow2 data files or VMDK extents, the string from the image file is
 usually not verified by management tools - and 'qemu-img info' wouldn't
 be suitable because in contrast to backing files, it already opens these
 other referenced files. So here the string should be interpreted as a
 literal local filename. More complex configurations need to be specified
 explicitly on the command line or in QMP.
 This patch changes bdrv_open_inherit() so that it only parses filenames
 if a new parameter parse_filename is true. It is set for the top level
 in bdrv_open(), for the file child and for the backing file child. All
 other callers pass false and disable filename parsing this way.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
 Upstream: N/A, embargoed
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block.c | 90 ++++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 57 insertions(+), 33 deletions(-)
 diff --git a/block.c b/block.c
 index 468cf5e67d..50bdd197b7 100644
 --- a/block.c
 +++ b/block.c
@@ -86,6 +86,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BlockDriverState *parent,
                                            const BdrvChildClass *child_class,
                                            BdrvChildRole child_role,
 +                                           bool parse_filename,
                                            Error **errp);
 static bool bdrv_recurse_has_child(BlockDriverState *bs,
@@ -2058,7 +2059,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
  * block driver has been specified explicitly.
  */
 static int bdrv_fill_options(QDict **options, const char *filename,
 -                             int *flags, Error **errp)
 +                             int *flags, bool allow_parse_filename,
 +                             Error **errp)
 {
     const char *drvname;
     bool protocol = *flags & BDRV_O_PROTOCOL;
@@ -2100,7 +2102,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
     if (protocol && filename) {
         if (!qdict_haskey(*options, "filename")) {
             qdict_put_str(*options, "filename", filename);
 -            parse_filename = true;
 +            parse_filename = allow_parse_filename;
         } else {
             error_setg(errp, "Can't specify 'file' and 'filename' options at "
                              "the same time");
@@ -3663,7 +3665,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     }
     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
 -                                   &child_of_bds, bdrv_backing_role(bs), errp);
 +                                   &child_of_bds, bdrv_backing_role(bs), true,
 +                                   errp);
     if (!backing_hd) {
         bs->open_flags |= BDRV_O_NO_BACKING;
         error_prepend(errp, "Could not open backing file: ");
@@ -3697,7 +3700,8 @@ free_exit:
 static BlockDriverState *
 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
                    BlockDriverState *parent, const BdrvChildClass *child_class,
 -                   BdrvChildRole child_role, bool allow_none, Error **errp)
 +                   BdrvChildRole child_role, bool allow_none,
 +                   bool parse_filename, Error **errp)
 {
     BlockDriverState *bs = NULL;
     QDict *image_options;
@@ -3728,7 +3732,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
     }
     bs = bdrv_open_inherit(filename, reference, image_options, 0,
 -                           parent, child_class, child_role, errp);
 +                           parent, child_class, child_role, parse_filename,
 +                           errp);
     if (!bs) {
         goto done;
     }
@@ -3738,6 +3743,33 @@ done:
     return bs;
 }
 +static BdrvChild *bdrv_open_child_common(const char *filename,
 +                                         QDict *options, const char *bdref_key,
 +                                         BlockDriverState *parent,
 +                                         const BdrvChildClass *child_class,
 +                                         BdrvChildRole child_role,
 +                                         bool allow_none, bool parse_filename,
 +                                         Error **errp)
 +{
 +    BlockDriverState *bs;
 +    BdrvChild *child;
 +
 +    GLOBAL_STATE_CODE();
 +
 +    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 +                            child_role, allow_none, parse_filename, errp);
 +    if (bs == NULL) {
 +        return NULL;
 +    }
 +
 +    bdrv_graph_wrlock();
 +    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 +                              errp);
 +    bdrv_graph_wrunlock();
 +
 +    return child;
 +}
 +
 /*
  * Opens a disk image whose options are given as BlockdevRef in another block
  * device's options.
@@ -3761,27 +3793,15 @@ BdrvChild *bdrv_open_child(const char *filename,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp)
 {
 -    BlockDriverState *bs;
 -    BdrvChild *child;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 -                            child_role, allow_none, errp);
 -    if (bs == NULL) {
 -        return NULL;
 -    }
 -
 -    bdrv_graph_wrlock();
 -    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -                              errp);
 -    bdrv_graph_wrunlock();
 -
 -    return child;
 +    return bdrv_open_child_common(filename, options, bdref_key, parent,
 +                                  child_class, child_role, allow_none, false,
 +                                  errp);
 }
 /*
 - * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
 + * This does mostly the same as bdrv_open_child(), but for opening the primary
 + * child of a node. A notable difference from bdrv_open_child() is that it
 + * enables filename parsing for protocol names (including json:).
  *
  * @parent can move to a different AioContext in this function.
  */
@@ -3796,8 +3816,8 @@ int bdrv_open_file_child(const char *filename,
     role = parent->drv->is_filter ?
         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
 -    if (!bdrv_open_child(filename, options, bdref_key, parent,
 -                         &child_of_bds, role, false, errp))
 +    if (!bdrv_open_child_common(filename, options, bdref_key, parent,
 +                                &child_of_bds, role, false, true, errp))
     {
         return -EINVAL;
     }
@@ -3842,7 +3862,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
     }
 -    bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
 +    bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, false,
 +                           errp);
     obj = NULL;
     qobject_unref(obj);
     visit_free(v);
@@ -3932,7 +3953,7 @@ static BlockDriverState * no_coroutine_fn
 bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
                   int flags, BlockDriverState *parent,
                   const BdrvChildClass *child_class, BdrvChildRole child_role,
 -                  Error **errp)
 +                  bool parse_filename, Error **errp)
 {
     int ret;
     BlockBackend *file = NULL;
@@ -3980,9 +4001,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
     }
     /* json: syntax counts as explicit options, as if in the QDict */
 -    parse_json_protocol(options, &filename, &local_err);
 -    if (local_err) {
 -        goto fail;
 +    if (parse_filename) {
 +        parse_json_protocol(options, &filename, &local_err);
 +        if (local_err) {
 +            goto fail;
 +        }
     }
     bs->explicit_options = qdict_clone_shallow(options);
@@ -4007,7 +4030,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
                                      parent->open_flags, parent->options);
     }
 -    ret = bdrv_fill_options(&options, filename, &flags, &local_err);
 +    ret = bdrv_fill_options(&options, filename, &flags, parse_filename,
 +                            &local_err);
     if (ret < 0) {
         goto fail;
     }
@@ -4076,7 +4100,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
                                      &child_of_bds, BDRV_CHILD_IMAGE,
 -                                     true, &local_err);
 +                                     true, true, &local_err);
         if (local_err) {
             goto fail;
         }
@@ -4225,7 +4249,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
     GLOBAL_STATE_CODE();
     return bdrv_open_inherit(filename, reference, options, flags, NULL,
 -                             NULL, 0, errp);
 +                             NULL, 0, true, errp);
 }
 /* Return true if the NULL-terminated @list contains @str */
 -- 
 2.39.3
--- a/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
+++ b/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
@ -1,61 +0,0 @@
 From 80e197ac72a4b0c810f69833e1f9e552a415e82a Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 25 Apr 2024 14:49:40 +0200
 Subject: [PATCH 2/4] iotests/244: Don't store data-file with protocol in image
 RH-Author: Hana Czenczek <hczenczek@redhat.com>
 RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
 RH-Jira: RHEL-46239
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Commit: [2/4] 92e00dab8be1570b13172353d77d2af44cb4e22b
 We want to disable filename parsing for data files because it's too easy
 to abuse in malicious image files. Make the test ready for the change by
 passing the data file explicitly in command line options.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
 Upstream: N/A, embargoed
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 tests/qemu-iotests/244 | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)
 diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
 index 3e61fa25bb..bb9cc6512f 100755
 --- a/tests/qemu-iotests/244
 +++ b/tests/qemu-iotests/244
@@ -215,9 +215,22 @@ $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n -C "$TEST_IMG.src" "$TEST_IMG"
 $QEMU_IMG compare -f $IMGFMT -F $IMGFMT "$TEST_IMG.src" "$TEST_IMG"
 # blkdebug doesn't support copy offloading, so this tests the error path
 -$QEMU_IMG amend -f $IMGFMT -o "data_file=blkdebug::$TEST_IMG.data" "$TEST_IMG"
 -$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n -C "$TEST_IMG.src" "$TEST_IMG"
 -$QEMU_IMG compare -f $IMGFMT -F $IMGFMT "$TEST_IMG.src" "$TEST_IMG"
 +test_img_with_blkdebug="json:{
 +    'driver': 'qcow2',
 +    'file': {
 +        'driver': 'file',
 +        'filename': '$TEST_IMG'
 +    },
 +    'data-file': {
 +        'driver': 'blkdebug',
 +        'image': {
 +            'driver': 'file',
 +            'filename': '$TEST_IMG.data'
 +        }
 +    }
 +}"
 +$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n -C "$TEST_IMG.src" "$test_img_with_blkdebug"
 +$QEMU_IMG compare -f $IMGFMT -F $IMGFMT "$TEST_IMG.src" "$test_img_with_blkdebug"
 echo
 echo "=== Flushing should flush the data file ==="
 -- 
 2.39.3
--- a/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
+++ b/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
@ -1,64 +0,0 @@
 From bf01c03b0120f5ed8e54c2a30b7830901b22b893 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 25 Apr 2024 14:49:40 +0200
 Subject: [PATCH 3/4] iotests/270: Don't store data-file with json: prefix in
 image
 RH-Author: Hana Czenczek <hczenczek@redhat.com>
 RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
 RH-Jira: RHEL-46239
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Commit: [3/4] 705bcc2819ce8e0f8b9d660a93bc48de26413aec
 We want to disable filename parsing for data files because it's too easy
 to abuse in malicious image files. Make the test ready for the change by
 passing the data file explicitly in command line options.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
 Upstream: N/A, embargoed
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 tests/qemu-iotests/270 | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
 diff --git a/tests/qemu-iotests/270 b/tests/qemu-iotests/270
 index 74352342db..c37b674aa2 100755
 --- a/tests/qemu-iotests/270
 +++ b/tests/qemu-iotests/270
@@ -60,8 +60,16 @@ _make_test_img -o cluster_size=2M,data_file="$TEST_IMG.orig" \
 # "write" 2G of data without using any space.
 # (qemu-img create does not like it, though, because null-co does not
 # support image creation.)
 -$QEMU_IMG amend -o data_file="json:{'driver':'null-co',,'size':'4294967296'}" \
 -    "$TEST_IMG"
 +test_img_with_null_data="json:{
 +    'driver': '$IMGFMT',
 +    'file': {
 +        'filename': '$TEST_IMG'
 +    },
 +    'data-file': {
 +        'driver': 'null-co',
 +        'size':'4294967296'
 +    }
 +}"
 # This gives us a range of:
 #   2^31 - 512 + 768 - 1 = 2^31 + 255 > 2^31
@@ -74,7 +82,7 @@ $QEMU_IMG amend -o data_file="json:{'driver':'null-co',,'size':'4294967296'}" \
 # on L2 boundaries, we need large L2 tables; hence the cluster size of
 # 2 MB.  (Anything from 256 kB should work, though, because then one L2
 # table covers 8 GB.)
 -$QEMU_IO -c "write 768 $((2 ** 31 - 512))" "$TEST_IMG" | _filter_qemu_io
 +$QEMU_IO -c "write 768 $((2 ** 31 - 512))" "$test_img_with_null_data" | _filter_qemu_io
 _check_test_img
 -- 
 2.39.3
--- a/kvm-iotests-test-NBD-TLS-iothread.patch
+++ b/kvm-iotests-test-NBD-TLS-iothread.patch
@ -1,276 +0,0 @@
 From 2f12be8abfc90dc383a221441f60bdaae6b617d2 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 17 May 2024 21:50:15 -0500
 Subject: [PATCH 4/4] iotests: test NBD+TLS+iothread
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 257: nbd/server: fix TLS negotiation across coroutine context
 RH-Jira: RHEL-40959
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [4/4] 39a37bf3ae6e7046577de151ef2f6fd1fd694e62 (ebblake/centos-qemu-kvm)
 Prevent regressions when using NBD with TLS in the presence of
 iothreads, adding coverage the fix to qio channels made in the
 previous patch.
 The shell function pick_unused_port() was copied from
 nbdkit.git/tests/functions.sh.in, where it had all authors from Red
 Hat, agreeing to the resulting relicensing from 2-clause BSD to GPLv2.
 CC: qemu-stable@nongnu.org
 CC: "Richard W.M. Jones" <rjones@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240531180639.1392905-6-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit a73c99378022ebb785481e84cfe1e81097546268)
 Jira: https://issues.redhat.com/browse/RHEL-40959
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 tests/qemu-iotests/tests/nbd-tls-iothread     | 168 ++++++++++++++++++
 tests/qemu-iotests/tests/nbd-tls-iothread.out |  54 ++++++
 2 files changed, 222 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/nbd-tls-iothread
 create mode 100644 tests/qemu-iotests/tests/nbd-tls-iothread.out
 diff --git a/tests/qemu-iotests/tests/nbd-tls-iothread b/tests/qemu-iotests/tests/nbd-tls-iothread
 new file mode 100755
 index 0000000000..a2fb07206e
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/nbd-tls-iothread
@@ -0,0 +1,168 @@
 +#!/usr/bin/env bash
 +# group: rw quick
 +#
 +# Test of NBD+TLS+iothread
 +#
 +# Copyright (C) 2024 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +
 +# creator
 +owner=eblake@redhat.com
 +
 +seq=`basename $0`
 +echo "QA output created by $seq"
 +
 +status=1    # failure is the default!
 +
 +_cleanup()
 +{
 +    _cleanup_qemu
 +    _cleanup_test_img
 +    rm -f "$dst_image"
 +    tls_x509_cleanup
 +}
 +trap "_cleanup; exit \$status" 0 1 2 3 15
 +
 +# get standard environment, filters and checks
 +cd ..
 +. ./common.rc
 +. ./common.filter
 +. ./common.qemu
 +. ./common.tls
 +. ./common.nbd
 +
 +_supported_fmt qcow2  # Hardcoded to qcow2 command line and QMP below
 +_supported_proto file
 +
 +# pick_unused_port
 +#
 +# Picks and returns an "unused" port, setting the global variable
 +# $port.
 +#
 +# This is inherently racy, but we need it because qemu does not currently
 +# permit NBD+TLS over a Unix domain socket
 +pick_unused_port ()
 +{
 +    if ! (ss --version) >/dev/null 2>&1; then
 +        _notrun "ss utility required, skipped this test"
 +    fi
 +
 +    # Start at a random port to make it less likely that two parallel
 +    # tests will conflict.
 +    port=$(( 50000 + (RANDOM%15000) ))
 +    while ss -ltn | grep -sqE ":$port\b"; do
 +        ((port++))
 +        if [ $port -eq 65000 ]; then port=50000; fi
 +    done
 +    echo picked unused port
 +}
 +
 +tls_x509_init
 +
 +size=1G
 +DST_IMG="$TEST_DIR/dst.qcow2"
 +
 +echo
 +echo "== preparing TLS creds and spare port =="
 +
 +pick_unused_port
 +tls_x509_create_root_ca "ca1"
 +tls_x509_create_server "ca1" "server1"
 +tls_x509_create_client "ca1" "client1"
 +tls_obj_base=tls-creds-x509,id=tls0,verify-peer=true,dir="${tls_dir}"
 +
 +echo
 +echo "== preparing image =="
 +
 +_make_test_img $size
 +$QEMU_IMG create -f qcow2 "$DST_IMG" $size | _filter_img_create
 +
 +echo
 +echo === Starting Src QEMU ===
 +echo
 +
 +_launch_qemu -machine q35 \
 +    -object iothread,id=iothread0 \
 +    -object "${tls_obj_base}"/client1,endpoint=client \
 +    -device '{"driver":"pcie-root-port", "id":"root0", "multifunction":true,
 +              "bus":"pcie.0"}' \
 +    -device '{"driver":"virtio-scsi-pci", "id":"virtio_scsi_pci0",
 +              "bus":"root0", "iothread":"iothread0"}' \
 +    -device '{"driver":"scsi-hd", "id":"image1", "drive":"drive_image1",
 +              "bus":"virtio_scsi_pci0.0"}' \
 +    -blockdev '{"driver":"file", "cache":{"direct":true, "no-flush":false},
 +                "filename":"'"$TEST_IMG"'", "node-name":"drive_sys1"}' \
 +    -blockdev '{"driver":"qcow2", "node-name":"drive_image1",
 +                "file":"drive_sys1"}'
 +h1=$QEMU_HANDLE
 +_send_qemu_cmd $h1 '{"execute": "qmp_capabilities"}' 'return'
 +
 +echo
 +echo === Starting Dst VM2 ===
 +echo
 +
 +_launch_qemu -machine q35 \
 +    -object iothread,id=iothread0 \
 +    -object "${tls_obj_base}"/server1,endpoint=server \
 +    -device '{"driver":"pcie-root-port", "id":"root0", "multifunction":true,
 +              "bus":"pcie.0"}' \
 +    -device '{"driver":"virtio-scsi-pci", "id":"virtio_scsi_pci0",
 +              "bus":"root0", "iothread":"iothread0"}' \
 +    -device '{"driver":"scsi-hd", "id":"image1", "drive":"drive_image1",
 +              "bus":"virtio_scsi_pci0.0"}' \
 +    -blockdev '{"driver":"file", "cache":{"direct":true, "no-flush":false},
 +                "filename":"'"$DST_IMG"'", "node-name":"drive_sys1"}' \
 +    -blockdev '{"driver":"qcow2", "node-name":"drive_image1",
 +                "file":"drive_sys1"}' \
 +    -incoming defer
 +h2=$QEMU_HANDLE
 +_send_qemu_cmd $h2 '{"execute": "qmp_capabilities"}' 'return'
 +
 +echo
 +echo === Dst VM: Enable NBD server for incoming storage migration ===
 +echo
 +
 +_send_qemu_cmd $h2 '{"execute": "nbd-server-start", "arguments":
 +    {"addr": {"type": "inet", "data": {"host": "127.0.0.1", "port": "'$port'"}},
 +              "tls-creds": "tls0"}}' '{"return": {}}' | sed "s/\"$port\"/PORT/g"
 +_send_qemu_cmd $h2 '{"execute": "block-export-add", "arguments":
 +    {"node-name": "drive_image1", "type": "nbd", "writable": true,
 +      "id": "drive_image1"}}' '{"return": {}}'
 +
 +echo
 +echo === Src VM: Mirror to dst NBD for outgoing storage migration ===
 +echo
 +
 +_send_qemu_cmd $h1 '{"execute": "blockdev-add", "arguments":
 +    {"node-name": "mirror", "driver": "nbd",
 +     "server": {"type": "inet", "host": "127.0.0.1", "port": "'$port'"},
 +     "export": "drive_image1", "tls-creds": "tls0",
 +     "tls-hostname": "127.0.0.1"}}' '{"return": {}}' | sed "s/\"$port\"/PORT/g"
 +_send_qemu_cmd $h1 '{"execute": "blockdev-mirror", "arguments":
 +    {"sync": "full", "device": "drive_image1", "target": "mirror",
 +     "job-id": "drive_image1_53"}}' '{"return": {}}'
 +_timed_wait_for $h1 '"ready"'
 +
 +echo
 +echo === Cleaning up ===
 +echo
 +
 +_send_qemu_cmd $h1 '{"execute":"quit"}' ''
 +_send_qemu_cmd $h2 '{"execute":"quit"}' ''
 +
 +echo "*** done"
 +rm -f $seq.full
 +status=0
 diff --git a/tests/qemu-iotests/tests/nbd-tls-iothread.out b/tests/qemu-iotests/tests/nbd-tls-iothread.out
 new file mode 100644
 index 0000000000..1d83d4f903
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/nbd-tls-iothread.out
@@ -0,0 +1,54 @@
 +QA output created by nbd-tls-iothread
 +
 +== preparing TLS creds and spare port ==
 +picked unused port
 +Generating a self signed certificate...
 +Generating a signed certificate...
 +Generating a signed certificate...
 +
 +== preparing image ==
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
 +Formatting 'TEST_DIR/dst.IMGFMT', fmt=IMGFMT size=1073741824
 +
 +=== Starting Src QEMU ===
 +
 +{"execute": "qmp_capabilities"}
 +{"return": {}}
 +
 +=== Starting Dst VM2 ===
 +
 +{"execute": "qmp_capabilities"}
 +{"return": {}}
 +
 +=== Dst VM: Enable NBD server for incoming storage migration ===
 +
 +{"execute": "nbd-server-start", "arguments":
 +    {"addr": {"type": "inet", "data": {"host": "127.0.0.1", "port": PORT}},
 +              "tls-creds": "tls0"}}
 +{"return": {}}
 +{"execute": "block-export-add", "arguments":
 +    {"node-name": "drive_image1", "type": "nbd", "writable": true,
 +      "id": "drive_image1"}}
 +{"return": {}}
 +
 +=== Src VM: Mirror to dst NBD for outgoing storage migration ===
 +
 +{"execute": "blockdev-add", "arguments":
 +    {"node-name": "mirror", "driver": "nbd",
 +     "server": {"type": "inet", "host": "127.0.0.1", "port": PORT},
 +     "export": "drive_image1", "tls-creds": "tls0",
 +     "tls-hostname": "127.0.0.1"}}
 +{"return": {}}
 +{"execute": "blockdev-mirror", "arguments":
 +    {"sync": "full", "device": "drive_image1", "target": "mirror",
 +     "job-id": "drive_image1_53"}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "drive_image1_53"}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "drive_image1_53"}}
 +{"return": {}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "drive_image1_53"}}
 +
 +=== Cleaning up ===
 +
 +{"execute":"quit"}
 +{"execute":"quit"}
 +*** done
 -- 
 2.39.3
--- a/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
+++ b/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
@ -1,126 +0,0 @@
 From 11faa773637f76f573f5320c063f7e55263c3a84 Mon Sep 17 00:00:00 2001
 From: Prasad Pandit <pjp@fedoraproject.org>
 Date: Thu, 25 Apr 2024 12:34:12 +0530
 Subject: [PATCH 1/5] linux-aio: add IO_CMD_FDSYNC command support
 RH-Author: Prasad Pandit <None>
 RH-MergeRequest: 260: linux-aio: add IO_CMD_FDSYNC command support
 RH-Jira: RHEL-51901
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] 2830edc801f9fbbc373631cf5b12a396f4b2bced (pjp/cs-qemu-kvm)
 Libaio defines IO_CMD_FDSYNC command to sync all outstanding
 asynchronous I/O operations, by flushing out file data to the
 disk storage. Enable linux-aio to submit such aio request.
 When using aio=native without fdsync() support, QEMU creates
 pthreads, and destroying these pthreads results in TLB flushes.
 In a real-time guest environment, TLB flushes cause a latency
 spike. This patch helps to avoid such spikes.
 Jira: https://issues.redhat.com/browse/RHEL-51901
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
 Message-ID: <20240425070412.37248-1-ppandit@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 24687abf237e3c15816d689a8e4b08d7c3190dcb)
 Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
 ---
 block/file-posix.c      |  9 +++++++++
 block/linux-aio.c       | 21 ++++++++++++++++++++-
 include/block/raw-aio.h |  1 +
 3 files changed, 30 insertions(+), 1 deletion(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index 35684f7e21..9831b08fb6 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -159,6 +159,7 @@ typedef struct BDRVRawState {
     bool has_discard:1;
     bool has_write_zeroes:1;
     bool use_linux_aio:1;
 +    bool has_laio_fdsync:1;
     bool use_linux_io_uring:1;
     int page_cache_inconsistent; /* errno from fdatasync failure */
     bool has_fallocate;
@@ -718,6 +719,9 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
         ret = -EINVAL;
         goto fail;
     }
 +    if (s->use_linux_aio) {
 +        s->has_laio_fdsync = laio_has_fdsync(s->fd);
 +    }
 #else
     if (s->use_linux_aio) {
         error_setg(errp, "aio=native was specified, but is not supported "
@@ -2599,6 +2603,11 @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
     if (raw_check_linux_io_uring(s)) {
         return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH);
     }
 +#endif
 +#ifdef CONFIG_LINUX_AIO
 +    if (s->has_laio_fdsync && raw_check_linux_aio(s)) {
 +        return laio_co_submit(s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
 +    }
 #endif
     return raw_thread_pool_submit(handle_aiocb_flush, &acb);
 }
 diff --git a/block/linux-aio.c b/block/linux-aio.c
 index ec05d946f3..e3b5ec9aba 100644
 --- a/block/linux-aio.c
 +++ b/block/linux-aio.c
@@ -384,6 +384,9 @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
     case QEMU_AIO_READ:
         io_prep_preadv(iocbs, fd, qiov->iov, qiov->niov, offset);
         break;
 +    case QEMU_AIO_FLUSH:
 +        io_prep_fdsync(iocbs, fd);
 +        break;
     /* Currently Linux kernel does not support other operations */
     default:
         fprintf(stderr, "%s: invalid AIO request type 0x%x.\n",
@@ -412,7 +415,7 @@ int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
     AioContext *ctx = qemu_get_current_aio_context();
     struct qemu_laiocb laiocb = {
         .co         = qemu_coroutine_self(),
 -        .nbytes     = qiov->size,
 +        .nbytes     = qiov ? qiov->size : 0,
         .ctx        = aio_get_linux_aio(ctx),
         .ret        = -EINPROGRESS,
         .is_read    = (type == QEMU_AIO_READ),
@@ -486,3 +489,19 @@ void laio_cleanup(LinuxAioState *s)
     }
     g_free(s);
 }
 +
 +bool laio_has_fdsync(int fd)
 +{
 +    struct iocb cb;
 +    struct iocb *cbs[] = {&cb, NULL};
 +
 +    io_context_t ctx = 0;
 +    io_setup(1, &ctx);
 +
 +    /* check if host kernel supports IO_CMD_FDSYNC */
 +    io_prep_fdsync(&cb, fd);
 +    int ret = io_submit(ctx, 1, cbs);
 +
 +    io_destroy(ctx);
 +    return (ret == -EINVAL) ? false : true;
 +}
 diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
 index 20e000b8ef..626706827f 100644
 --- a/include/block/raw-aio.h
 +++ b/include/block/raw-aio.h
@@ -60,6 +60,7 @@ void laio_cleanup(LinuxAioState *s);
 int coroutine_fn laio_co_submit(int fd, uint64_t offset, QEMUIOVector *qiov,
                                 int type, uint64_t dev_max_batch);
 +bool laio_has_fdsync(int);
 void laio_detach_aio_context(LinuxAioState *s, AioContext *old_context);
 void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context);
 #endif
 -- 
 2.39.3
--- a/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
+++ b/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
@ -1,184 +0,0 @@
 From 20b179691fcd3a58aaf76269e66bd102dfbd0d2e Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Tue, 6 Aug 2024 13:53:00 -0500
 Subject: [PATCH 3/5] nbd/server: CVE-2024-7409: Cap default max-connections to
 100
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 263: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [RHEL 10.0]
 RH-Jira: RHEL-52599
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/4] ad547c43ee9bae4cf6476408176aa7a7892427ff (redhat/centos-stream/src/qemu-kvm)
 Allowing an unlimited number of clients to any web service is a recipe
 for a rudimentary denial of service attack: the client merely needs to
 open lots of sockets without closing them, until qemu no longer has
 any more fds available to allocate.
 For qemu-nbd, we default to allowing only 1 connection unless more are
 explicitly asked for (-e or --shared); this was historically picked as
 a nice default (without an explicit -t, a non-persistent qemu-nbd goes
 away after a client disconnects, without needing any additional
 follow-up commands), and we are not going to change that interface now
 (besides, someday we want to point people towards qemu-storage-daemon
 instead of qemu-nbd).
 But for qemu proper, and the newer qemu-storage-daemon, the QMP
 nbd-server-start command has historically had a default of unlimited
 number of connections, in part because unlike qemu-nbd it is
 inherently persistent until nbd-server-stop.  Allowing multiple client
 sockets is particularly useful for clients that can take advantage of
 MULTI_CONN (creating parallel sockets to increase throughput),
 although known clients that do so (such as libnbd's nbdcopy) typically
 use only 8 or 16 connections (the benefits of scaling diminish once
 more sockets are competing for kernel attention).  Picking a number
 large enough for typical use cases, but not unlimited, makes it
 slightly harder for a malicious client to perform a denial of service
 merely by opening lots of connections withot progressing through the
 handshake.
 This change does not eliminate CVE-2024-7409 on its own, but reduces
 the chance for fd exhaustion or unlimited memory usage as an attack
 surface.  On the other hand, by itself, it makes it more obvious that
 with a finite limit, we have the problem of an unauthenticated client
 holding 100 fds opened as a way to block out a legitimate client from
 being able to connect; thus, later patches will further add timeouts
 to reject clients that are not making progress.
 This is an INTENTIONAL change in behavior, and will break any client
 of nbd-server-start that was not passing an explicit max-connections
 parameter, yet expects more than 100 simultaneous connections.  We are
 not aware of any such client (as stated above, most clients aware of
 MULTI_CONN get by just fine on 8 or 16 connections, and probably cope
 with later connections failing by relying on the earlier connections;
 libvirt has not yet been passing max-connections, but generally
 creates NBD servers with the intent for a single client for the sake
 of live storage migration; meanwhile, the KubeSAN project anticipates
 a large cluster sharing multiple clients [up to 8 per node, and up to
 100 nodes in a cluster], but it currently uses qemu-nbd with an
 explicit --shared=0 rather than qemu-storage-daemon with
 nbd-server-start).
 We considered using a deprecation period (declare that omitting
 max-parameters is deprecated, and make it mandatory in 3 releases -
 then we don't need to pick an arbitrary default); that has zero risk
 of breaking any apps that accidentally depended on more than 100
 connections, and where such breakage might not be noticed under unit
 testing but only under the larger loads of production usage.  But it
 does not close the denial-of-service hole until far into the future,
 and requires all apps to change to add the parameter even if 100 was
 good enough.  It also has a drawback that any app (like libvirt) that
 is accidentally relying on an unlimited default should seriously
 consider their own CVE now, at which point they are going to change to
 pass explicit max-connections sooner than waiting for 3 qemu releases.
 Finally, if our changed default breaks an app, that app can always
 pass in an explicit max-parameters with a larger value.
 It is also intentional that the HMP interface to nbd-server-start is
 not changed to expose max-connections (any client needing to fine-tune
 things should be using QMP).
 Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240807174943.771624-12-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 [ericb: Expand commit message to summarize Dan's argument for why we
 break corner-case back-compat behavior without a deprecation period]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit c8a76dbd90c2f48df89b75bef74917f90a59b623)
 Jira: https://issues.redhat.com/browse/RHEL-52599
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 block/monitor/block-hmp-cmds.c | 3 ++-
 blockdev-nbd.c                 | 8 ++++++++
 include/block/nbd.h            | 7 +++++++
 qapi/block-export.json         | 4 ++--
 4 files changed, 19 insertions(+), 3 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index d954bec6f1..bdf2eb50b6 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -402,7 +402,8 @@ void hmp_nbd_server_start(Monitor *mon, const QDict *qdict)
         goto exit;
     }
 -    nbd_server_start(addr, NULL, NULL, 0, &local_err);
 +    nbd_server_start(addr, NULL, NULL, NBD_DEFAULT_MAX_CONNECTIONS,
 +                     &local_err);
     qapi_free_SocketAddress(addr);
     if (local_err != NULL) {
         goto exit;
 diff --git a/blockdev-nbd.c b/blockdev-nbd.c
 index 267a1de903..24ba5382db 100644
 --- a/blockdev-nbd.c
 +++ b/blockdev-nbd.c
@@ -170,6 +170,10 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds,
 void nbd_server_start_options(NbdServerOptions *arg, Error **errp)
 {
 +    if (!arg->has_max_connections) {
 +        arg->max_connections = NBD_DEFAULT_MAX_CONNECTIONS;
 +    }
 +
     nbd_server_start(arg->addr, arg->tls_creds, arg->tls_authz,
                      arg->max_connections, errp);
 }
@@ -182,6 +186,10 @@ void qmp_nbd_server_start(SocketAddressLegacy *addr,
 {
     SocketAddress *addr_flat = socket_address_flatten(addr);
 +    if (!has_max_connections) {
 +        max_connections = NBD_DEFAULT_MAX_CONNECTIONS;
 +    }
 +
     nbd_server_start(addr_flat, tls_creds, tls_authz, max_connections, errp);
     qapi_free_SocketAddress(addr_flat);
 }
 diff --git a/include/block/nbd.h b/include/block/nbd.h
 index 1d4d65922d..d4f8b21aec 100644
 --- a/include/block/nbd.h
 +++ b/include/block/nbd.h
@@ -39,6 +39,13 @@ extern const BlockExportDriver blk_exp_nbd;
  */
 #define NBD_DEFAULT_HANDSHAKE_MAX_SECS 10
 +/*
 + * NBD_DEFAULT_MAX_CONNECTIONS: Number of client sockets to allow at
 + * once; must be large enough to allow a MULTI_CONN-aware client like
 + * nbdcopy to create its typical number of 8-16 sockets.
 + */
 +#define NBD_DEFAULT_MAX_CONNECTIONS 100
 +
 /* Handshake phase structs - this struct is passed on the wire */
 typedef struct NBDOption {
 diff --git a/qapi/block-export.json b/qapi/block-export.json
 index 3919a2d5b9..f45e4fd481 100644
 --- a/qapi/block-export.json
 +++ b/qapi/block-export.json
@@ -28,7 +28,7 @@
 # @max-connections: The maximum number of connections to allow at the
 #     same time, 0 for unlimited.  Setting this to 1 also stops the
 #     server from advertising multiple client support (since 5.2;
 -#     default: 0)
 +#     default: 100)
 #
 # Since: 4.2
 ##
@@ -63,7 +63,7 @@
 # @max-connections: The maximum number of connections to allow at the
 #     same time, 0 for unlimited.  Setting this to 1 also stops the
 #     server from advertising multiple client support (since 5.2;
 -#     default: 0).
 +#     default: 100).
 #
 # Errors:
 #     - if the server is already running
 -- 
 2.39.3
--- a/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
+++ b/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
@ -1,173 +0,0 @@
 From 1b4bf69b064815a41ac18ef7276ceab0b9e0eb5b Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 7 Aug 2024 12:23:13 -0500
 Subject: [PATCH 5/5] nbd/server: CVE-2024-7409: Close stray clients at
 server-stop
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 263: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [RHEL 10.0]
 RH-Jira: RHEL-52599
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [4/4] 6c5c7b5daa2b450122e98eb08ade1e1db56d20ae (redhat/centos-stream/src/qemu-kvm)
 A malicious client can attempt to connect to an NBD server, and then
 intentionally delay progress in the handshake, including if it does
 not know the TLS secrets.  Although the previous two patches reduce
 this behavior by capping the default max-connections parameter and
 killing slow clients, they did not eliminate the possibility of a
 client waiting to close the socket until after the QMP nbd-server-stop
 command is executed, at which point qemu would SEGV when trying to
 dereference the NULL nbd_server global which is no longer present.
 This amounts to a denial of service attack.  Worse, if another NBD
 server is started before the malicious client disconnects, I cannot
 rule out additional adverse effects when the old client interferes
 with the connection count of the new server (although the most likely
 is a crash due to an assertion failure when checking
 nbd_server->connections > 0).
 For environments without this patch, the CVE can be mitigated by
 ensuring (such as via a firewall) that only trusted clients can
 connect to an NBD server.  Note that using frameworks like libvirt
 that ensure that TLS is used and that nbd-server-stop is not executed
 while any trusted clients are still connected will only help if there
 is also no possibility for an untrusted client to open a connection
 but then stall on the NBD handshake.
 Given the previous patches, it would be possible to guarantee that no
 clients remain connected by having nbd-server-stop sleep for longer
 than the default handshake deadline before finally freeing the global
 nbd_server object, but that could make QMP non-responsive for a long
 time.  So intead, this patch fixes the problem by tracking all client
 sockets opened while the server is running, and forcefully closing any
 such sockets remaining without a completed handshake at the time of
 nbd-server-stop, then waiting until the coroutines servicing those
 sockets notice the state change.  nbd-server-stop now has a second
 AIO_WAIT_WHILE_UNLOCKED (the first is indirectly through the
 blk_exp_close_all_type() that disconnects all clients that completed
 handshakes), but forced socket shutdown is enough to progress the
 coroutines and quickly tear down all clients before the server is
 freed, thus finally fixing the CVE.
 This patch relies heavily on the fact that nbd/server.c guarantees
 that it only calls nbd_blockdev_client_closed() from the main loop
 (see the assertion in nbd_client_put() and the hoops used in
 nbd_client_put_nonzero() to achieve that); if we did not have that
 guarantee, we would also need a mutex protecting our accesses of the
 list of connections to survive re-entrancy from independent iothreads.
 Although I did not actually try to test old builds, it looks like this
 problem has existed since at least commit 862172f45c (v2.12.0, 2017) -
 even back when that patch started using a QIONetListener to handle
 listening on multiple sockets, nbd_server_free() was already unaware
 that the nbd_blockdev_client_closed callback can be reached later by a
 client thread that has not completed handshakes (and therefore the
 client's socket never got added to the list closed in
 nbd_export_close_all), despite that patch intentionally tearing down
 the QIONetListener to prevent new clients.
 Reported-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
 Fixes: CVE-2024-7409
 CC: qemu-stable@nongnu.org
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240807174943.771624-14-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 3e7ef738c8462c45043a1d39f702a0990406a3b3)
 Jira: https://issues.redhat.com/browse/RHEL-52599
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 blockdev-nbd.c | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)
 diff --git a/blockdev-nbd.c b/blockdev-nbd.c
 index 24ba5382db..f73409ae49 100644
 --- a/blockdev-nbd.c
 +++ b/blockdev-nbd.c
@@ -21,12 +21,18 @@
 #include "io/channel-socket.h"
 #include "io/net-listener.h"
 +typedef struct NBDConn {
 +    QIOChannelSocket *cioc;
 +    QLIST_ENTRY(NBDConn) next;
 +} NBDConn;
 +
 typedef struct NBDServerData {
     QIONetListener *listener;
     QCryptoTLSCreds *tlscreds;
     char *tlsauthz;
     uint32_t max_connections;
     uint32_t connections;
 +    QLIST_HEAD(, NBDConn) conns;
 } NBDServerData;
 static NBDServerData *nbd_server;
@@ -51,6 +57,14 @@ int nbd_server_max_connections(void)
 static void nbd_blockdev_client_closed(NBDClient *client, bool ignored)
 {
 +    NBDConn *conn = nbd_client_owner(client);
 +
 +    assert(qemu_in_main_thread() && nbd_server);
 +
 +    object_unref(OBJECT(conn->cioc));
 +    QLIST_REMOVE(conn, next);
 +    g_free(conn);
 +
     nbd_client_put(client);
     assert(nbd_server->connections > 0);
     nbd_server->connections--;
@@ -60,14 +74,20 @@ static void nbd_blockdev_client_closed(NBDClient *client, bool ignored)
 static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
                        gpointer opaque)
 {
 +    NBDConn *conn = g_new0(NBDConn, 1);
 +
 +    assert(qemu_in_main_thread() && nbd_server);
     nbd_server->connections++;
 +    object_ref(OBJECT(cioc));
 +    conn->cioc = cioc;
 +    QLIST_INSERT_HEAD(&nbd_server->conns, conn, next);
     nbd_update_server_watch(nbd_server);
     qio_channel_set_name(QIO_CHANNEL(cioc), "nbd-server");
     /* TODO - expose handshake timeout as QMP option */
     nbd_client_new(cioc, NBD_DEFAULT_HANDSHAKE_MAX_SECS,
                    nbd_server->tlscreds, nbd_server->tlsauthz,
 -                   nbd_blockdev_client_closed, NULL);
 +                   nbd_blockdev_client_closed, conn);
 }
 static void nbd_update_server_watch(NBDServerData *s)
@@ -81,12 +101,25 @@ static void nbd_update_server_watch(NBDServerData *s)
 static void nbd_server_free(NBDServerData *server)
 {
 +    NBDConn *conn, *tmp;
 +
     if (!server) {
         return;
     }
 +    /*
 +     * Forcefully close the listener socket, and any clients that have
 +     * not yet disconnected on their own.
 +     */
     qio_net_listener_disconnect(server->listener);
     object_unref(OBJECT(server->listener));
 +    QLIST_FOREACH_SAFE(conn, &server->conns, next, tmp) {
 +        qio_channel_shutdown(QIO_CHANNEL(conn->cioc), QIO_CHANNEL_SHUTDOWN_BOTH,
 +                             NULL);
 +    }
 +
 +    AIO_WAIT_WHILE_UNLOCKED(NULL, server->connections > 0);
 +
     if (server->tlscreds) {
         object_unref(OBJECT(server->tlscreds));
     }
 -- 
 2.39.3
--- a/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
+++ b/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
@ -1,134 +0,0 @@
 From 97012ea86a4a0a28fef68e43b989d858c8392e2a Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Thu, 8 Aug 2024 16:05:08 -0500
 Subject: [PATCH 4/5] nbd/server: CVE-2024-7409: Drop non-negotiating clients
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 263: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [RHEL 10.0]
 RH-Jira: RHEL-52599
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [3/4] c3dad94d423d2f431d1e605c412099b9fe0bd76e (redhat/centos-stream/src/qemu-kvm)
 A client that opens a socket but does not negotiate is merely hogging
 qemu's resources (an open fd and a small amount of memory); and a
 malicious client that can access the port where NBD is listening can
 attempt a denial of service attack by intentionally opening and
 abandoning lots of unfinished connections.  The previous patch put a
 default bound on the number of such ongoing connections, but once that
 limit is hit, no more clients can connect (including legitimate ones).
 The solution is to insist that clients complete handshake within a
 reasonable time limit, defaulting to 10 seconds.  A client that has
 not successfully completed NBD_OPT_GO by then (including the case of
 where the client didn't know TLS credentials to even reach the point
 of NBD_OPT_GO) is wasting our time and does not deserve to stay
 connected.  Later patches will allow fine-tuning the limit away from
 the default value (including disabling it for doing integration
 testing of the handshake process itself).
 Note that this patch in isolation actually makes it more likely to see
 qemu SEGV after nbd-server-stop, as any client socket still connected
 when the server shuts down will now be closed after 10 seconds rather
 than at the client's whims.  That will be addressed in the next patch.
 For a demo of this patch in action:
 $ qemu-nbd -f raw -r -t -e 10 file &
 $ nbdsh --opt-mode -c '
 H = list()
 for i in range(20):
  print(i)
  H.insert(i, nbd.NBD())
  H[i].set_opt_mode(True)
  H[i].connect_uri("nbd://localhost")
 '
 $ kill $!
 where later connections get to start progressing once earlier ones are
 forcefully dropped for taking too long, rather than hanging.
 Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240807174943.771624-13-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 [eblake: rebase to changes earlier in series, reduce scope of timer]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit b9b72cb3ce15b693148bd09cef7e50110566d8a0)
 Jira: https://issues.redhat.com/browse/RHEL-52599
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 nbd/server.c     | 28 +++++++++++++++++++++++++++-
 nbd/trace-events |  1 +
 2 files changed, 28 insertions(+), 1 deletion(-)
 diff --git a/nbd/server.c b/nbd/server.c
 index e50012499f..39285cc971 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -3186,22 +3186,48 @@ static void nbd_client_receive_next_request(NBDClient *client)
     }
 }
 +static void nbd_handshake_timer_cb(void *opaque)
 +{
 +    QIOChannel *ioc = opaque;
 +
 +    trace_nbd_handshake_timer_cb();
 +    qio_channel_shutdown(ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
 +}
 +
 static coroutine_fn void nbd_co_client_start(void *opaque)
 {
     NBDClient *client = opaque;
     Error *local_err = NULL;
 +    QEMUTimer *handshake_timer = NULL;
     qemu_co_mutex_init(&client->send_lock);
 -    /* TODO - utilize client->handshake_max_secs */
 +    /*
 +     * Create a timer to bound the time spent in negotiation. If the
 +     * timer expires, it is likely nbd_negotiate will fail because the
 +     * socket was shutdown.
 +     */
 +    if (client->handshake_max_secs > 0) {
 +        handshake_timer = aio_timer_new(qemu_get_aio_context(),
 +                                        QEMU_CLOCK_REALTIME,
 +                                        SCALE_NS,
 +                                        nbd_handshake_timer_cb,
 +                                        client->sioc);
 +        timer_mod(handshake_timer,
 +                  qemu_clock_get_ns(QEMU_CLOCK_REALTIME) +
 +                  client->handshake_max_secs * NANOSECONDS_PER_SECOND);
 +    }
 +
     if (nbd_negotiate(client, &local_err)) {
         if (local_err) {
             error_report_err(local_err);
         }
 +        timer_free(handshake_timer);
         client_close(client, false);
         return;
     }
 +    timer_free(handshake_timer);
     WITH_QEMU_LOCK_GUARD(&client->lock) {
         nbd_client_receive_next_request(client);
     }
 diff --git a/nbd/trace-events b/nbd/trace-events
 index 00ae3216a1..cbd0a4ab7e 100644
 --- a/nbd/trace-events
 +++ b/nbd/trace-events
@@ -76,6 +76,7 @@ nbd_co_receive_request_payload_received(uint64_t cookie, uint64_t len) "Payload
 nbd_co_receive_ext_payload_compliance(uint64_t from, uint64_t len) "client sent non-compliant write without payload flag: from=0x%" PRIx64 ", len=0x%" PRIx64
 nbd_co_receive_align_compliance(const char *op, uint64_t from, uint64_t len, uint32_t align) "client sent non-compliant unaligned %s request: from=0x%" PRIx64 ", len=0x%" PRIx64 ", align=0x%" PRIx32
 nbd_trip(void) "Reading request"
 +nbd_handshake_timer_cb(void) "client took too long to negotiate"
 # client-connection.c
 nbd_connect_thread_sleep(uint64_t timeout) "timeout %" PRIu64
 -- 
 2.39.3
--- a/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
+++ b/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
@ -1,330 +0,0 @@
 From 55e78a14c6a6956a3ac65f36b9b8b8c49eff959b Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Mon, 8 Apr 2024 11:00:44 -0500
 Subject: [PATCH 2/4] nbd/server: Mark negotiation functions as coroutine_fn
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 257: nbd/server: fix TLS negotiation across coroutine context
 RH-Jira: RHEL-40959
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/4] f364e5cd2a9eac2d4f6af2841479f1dfb2f8df58 (ebblake/centos-qemu-kvm)
 nbd_negotiate() is already marked coroutine_fn.  And given the fix in
 the previous patch to have nbd_negotiate_handle_starttls not create
 and wait on a g_main_loop (as that would violate coroutine
 constraints), it is worth marking the rest of the related static
 functions reachable only during option negotiation as also being
 coroutine_fn.
 Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240408160214.1200629-6-eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 [eblake: drop one spurious coroutine_fn marking]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Jira: https://issues.redhat.com/browse/RHEL-40959
 (cherry picked from commit 4fa333e08dd96395a99ea8dd9e4c73a29dd23344)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 nbd/server.c | 102 +++++++++++++++++++++++++++++----------------------
 1 file changed, 59 insertions(+), 43 deletions(-)
 diff --git a/nbd/server.c b/nbd/server.c
 index 98ae0e1632..892797bb11 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -195,8 +195,9 @@ static inline void set_be_option_rep(NBDOptionReply *rep, uint32_t option,
 /* Send a reply header, including length, but no payload.
  * Return -errno on error, 0 on success. */
 -static int nbd_negotiate_send_rep_len(NBDClient *client, uint32_t type,
 -                                      uint32_t len, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_send_rep_len(NBDClient *client, uint32_t type,
 +                           uint32_t len, Error **errp)
 {
     NBDOptionReply rep;
@@ -211,15 +212,15 @@ static int nbd_negotiate_send_rep_len(NBDClient *client, uint32_t type,
 /* Send a reply header with default 0 length.
  * Return -errno on error, 0 on success. */
 -static int nbd_negotiate_send_rep(NBDClient *client, uint32_t type,
 -                                  Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_send_rep(NBDClient *client, uint32_t type, Error **errp)
 {
     return nbd_negotiate_send_rep_len(client, type, 0, errp);
 }
 /* Send an error reply.
  * Return -errno on error, 0 on success. */
 -static int G_GNUC_PRINTF(4, 0)
 +static coroutine_fn int G_GNUC_PRINTF(4, 0)
 nbd_negotiate_send_rep_verr(NBDClient *client, uint32_t type,
                             Error **errp, const char *fmt, va_list va)
 {
@@ -259,7 +260,7 @@ nbd_sanitize_name(const char *name)
 /* Send an error reply.
  * Return -errno on error, 0 on success. */
 -static int G_GNUC_PRINTF(4, 5)
 +static coroutine_fn int G_GNUC_PRINTF(4, 5)
 nbd_negotiate_send_rep_err(NBDClient *client, uint32_t type,
                            Error **errp, const char *fmt, ...)
 {
@@ -275,7 +276,7 @@ nbd_negotiate_send_rep_err(NBDClient *client, uint32_t type,
 /* Drop remainder of the current option, and send a reply with the
  * given error type and message. Return -errno on read or write
  * failure; or 0 if connection is still live. */
 -static int G_GNUC_PRINTF(4, 0)
 +static coroutine_fn int G_GNUC_PRINTF(4, 0)
 nbd_opt_vdrop(NBDClient *client, uint32_t type, Error **errp,
               const char *fmt, va_list va)
 {
@@ -288,7 +289,7 @@ nbd_opt_vdrop(NBDClient *client, uint32_t type, Error **errp,
     return ret;
 }
 -static int G_GNUC_PRINTF(4, 5)
 +static coroutine_fn int G_GNUC_PRINTF(4, 5)
 nbd_opt_drop(NBDClient *client, uint32_t type, Error **errp,
              const char *fmt, ...)
 {
@@ -302,7 +303,7 @@ nbd_opt_drop(NBDClient *client, uint32_t type, Error **errp,
     return ret;
 }
 -static int G_GNUC_PRINTF(3, 4)
 +static coroutine_fn int G_GNUC_PRINTF(3, 4)
 nbd_opt_invalid(NBDClient *client, Error **errp, const char *fmt, ...)
 {
     int ret;
@@ -319,8 +320,9 @@ nbd_opt_invalid(NBDClient *client, Error **errp, const char *fmt, ...)
  * If @check_nul, require that no NUL bytes appear in buffer.
  * Return -errno on I/O error, 0 if option was completely handled by
  * sending a reply about inconsistent lengths, or 1 on success. */
 -static int nbd_opt_read(NBDClient *client, void *buffer, size_t size,
 -                        bool check_nul, Error **errp)
 +static coroutine_fn int
 +nbd_opt_read(NBDClient *client, void *buffer, size_t size,
 +             bool check_nul, Error **errp)
 {
     if (size > client->optlen) {
         return nbd_opt_invalid(client, errp,
@@ -343,7 +345,8 @@ static int nbd_opt_read(NBDClient *client, void *buffer, size_t size,
 /* Drop size bytes from the unparsed payload of the current option.
  * Return -errno on I/O error, 0 if option was completely handled by
  * sending a reply about inconsistent lengths, or 1 on success. */
 -static int nbd_opt_skip(NBDClient *client, size_t size, Error **errp)
 +static coroutine_fn int
 +nbd_opt_skip(NBDClient *client, size_t size, Error **errp)
 {
     if (size > client->optlen) {
         return nbd_opt_invalid(client, errp,
@@ -366,8 +369,9 @@ static int nbd_opt_skip(NBDClient *client, size_t size, Error **errp)
  * Return -errno on I/O error, 0 if option was completely handled by
  * sending a reply about inconsistent lengths, or 1 on success.
  */
 -static int nbd_opt_read_name(NBDClient *client, char **name, uint32_t *length,
 -                             Error **errp)
 +static coroutine_fn int
 +nbd_opt_read_name(NBDClient *client, char **name, uint32_t *length,
 +                  Error **errp)
 {
     int ret;
     uint32_t len;
@@ -402,8 +406,8 @@ static int nbd_opt_read_name(NBDClient *client, char **name, uint32_t *length,
 /* Send a single NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
  * Return -errno on error, 0 on success. */
 -static int nbd_negotiate_send_rep_list(NBDClient *client, NBDExport *exp,
 -                                       Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_send_rep_list(NBDClient *client, NBDExport *exp, Error **errp)
 {
     ERRP_GUARD();
     size_t name_len, desc_len;
@@ -444,7 +448,8 @@ static int nbd_negotiate_send_rep_list(NBDClient *client, NBDExport *exp,
 /* Process the NBD_OPT_LIST command, with a potential series of replies.
  * Return -errno on error, 0 on success. */
 -static int nbd_negotiate_handle_list(NBDClient *client, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_handle_list(NBDClient *client, Error **errp)
 {
     NBDExport *exp;
     assert(client->opt == NBD_OPT_LIST);
@@ -459,7 +464,8 @@ static int nbd_negotiate_handle_list(NBDClient *client, Error **errp)
     return nbd_negotiate_send_rep(client, NBD_REP_ACK, errp);
 }
 -static void nbd_check_meta_export(NBDClient *client, NBDExport *exp)
 +static coroutine_fn void
 +nbd_check_meta_export(NBDClient *client, NBDExport *exp)
 {
     if (exp != client->contexts.exp) {
         client->contexts.count = 0;
@@ -468,8 +474,9 @@ static void nbd_check_meta_export(NBDClient *client, NBDExport *exp)
 /* Send a reply to NBD_OPT_EXPORT_NAME.
  * Return -errno on error, 0 on success. */
 -static int nbd_negotiate_handle_export_name(NBDClient *client, bool no_zeroes,
 -                                            Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_handle_export_name(NBDClient *client, bool no_zeroes,
 +                                 Error **errp)
 {
     ERRP_GUARD();
     g_autofree char *name = NULL;
@@ -536,9 +543,9 @@ static int nbd_negotiate_handle_export_name(NBDClient *client, bool no_zeroes,
 /* Send a single NBD_REP_INFO, with a buffer @buf of @length bytes.
  * The buffer does NOT include the info type prefix.
  * Return -errno on error, 0 if ready to send more. */
 -static int nbd_negotiate_send_info(NBDClient *client,
 -                                   uint16_t info, uint32_t length, void *buf,
 -                                   Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_send_info(NBDClient *client, uint16_t info, uint32_t length,
 +                        void *buf, Error **errp)
 {
     int rc;
@@ -565,7 +572,8 @@ static int nbd_negotiate_send_info(NBDClient *client,
  * -errno  transmission error occurred or @fatal was requested, errp is set
  * 0       error message successfully sent to client, errp is not set
  */
 -static int nbd_reject_length(NBDClient *client, bool fatal, Error **errp)
 +static coroutine_fn int
 +nbd_reject_length(NBDClient *client, bool fatal, Error **errp)
 {
     int ret;
@@ -583,7 +591,8 @@ static int nbd_reject_length(NBDClient *client, bool fatal, Error **errp)
 /* Handle NBD_OPT_INFO and NBD_OPT_GO.
  * Return -errno on error, 0 if ready for next option, and 1 to move
  * into transmission phase.  */
 -static int nbd_negotiate_handle_info(NBDClient *client, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_handle_info(NBDClient *client, Error **errp)
 {
     int rc;
     g_autofree char *name = NULL;
@@ -755,7 +764,8 @@ struct NBDTLSServerHandshakeData {
     Coroutine *co;
 };
 -static void nbd_server_tls_handshake(QIOTask *task, void *opaque)
 +static void
 +nbd_server_tls_handshake(QIOTask *task, void *opaque)
 {
     struct NBDTLSServerHandshakeData *data = opaque;
@@ -768,8 +778,8 @@ static void nbd_server_tls_handshake(QIOTask *task, void *opaque)
 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
  * new channel for all further (now-encrypted) communication. */
 -static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
 -                                                 Error **errp)
 +static coroutine_fn QIOChannel *
 +nbd_negotiate_handle_starttls(NBDClient *client, Error **errp)
 {
     QIOChannel *ioc;
     QIOChannelTLS *tioc;
@@ -821,10 +831,9 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
  *
  * For NBD_OPT_LIST_META_CONTEXT @context_id is ignored, 0 is used instead.
  */
 -static int nbd_negotiate_send_meta_context(NBDClient *client,
 -                                           const char *context,
 -                                           uint32_t context_id,
 -                                           Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_send_meta_context(NBDClient *client, const char *context,
 +                                uint32_t context_id, Error **errp)
 {
     NBDOptionReplyMetaContext opt;
     struct iovec iov[] = {
@@ -849,8 +858,9 @@ static int nbd_negotiate_send_meta_context(NBDClient *client,
  * Return true if @query matches @pattern, or if @query is empty when
  * the @client is performing _LIST_.
  */
 -static bool nbd_meta_empty_or_pattern(NBDClient *client, const char *pattern,
 -                                      const char *query)
 +static coroutine_fn bool
 +nbd_meta_empty_or_pattern(NBDClient *client, const char *pattern,
 +                          const char *query)
 {
     if (!*query) {
         trace_nbd_negotiate_meta_query_parse("empty");
@@ -867,7 +877,8 @@ static bool nbd_meta_empty_or_pattern(NBDClient *client, const char *pattern,
 /*
  * Return true and adjust @str in place if it begins with @prefix.
  */
 -static bool nbd_strshift(const char **str, const char *prefix)
 +static coroutine_fn bool
 +nbd_strshift(const char **str, const char *prefix)
 {
     size_t len = strlen(prefix);
@@ -883,8 +894,9 @@ static bool nbd_strshift(const char **str, const char *prefix)
  * Handle queries to 'base' namespace. For now, only the base:allocation
  * context is available.  Return true if @query has been handled.
  */
 -static bool nbd_meta_base_query(NBDClient *client, NBDMetaContexts *meta,
 -                                const char *query)
 +static coroutine_fn bool
 +nbd_meta_base_query(NBDClient *client, NBDMetaContexts *meta,
 +                    const char *query)
 {
     if (!nbd_strshift(&query, "base:")) {
         return false;
@@ -903,8 +915,9 @@ static bool nbd_meta_base_query(NBDClient *client, NBDMetaContexts *meta,
  * and qemu:allocation-depth contexts are available.  Return true if @query
  * has been handled.
  */
 -static bool nbd_meta_qemu_query(NBDClient *client, NBDMetaContexts *meta,
 -                                const char *query)
 +static coroutine_fn bool
 +nbd_meta_qemu_query(NBDClient *client, NBDMetaContexts *meta,
 +                    const char *query)
 {
     size_t i;
@@ -968,8 +981,9 @@ static bool nbd_meta_qemu_query(NBDClient *client, NBDMetaContexts *meta,
  *
  * Return -errno on I/O error, 0 if option was completely handled by
  * sending a reply about inconsistent lengths, or 1 on success. */
 -static int nbd_negotiate_meta_query(NBDClient *client,
 -                                    NBDMetaContexts *meta, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_meta_query(NBDClient *client,
 +                         NBDMetaContexts *meta, Error **errp)
 {
     int ret;
     g_autofree char *query = NULL;
@@ -1008,7 +1022,8 @@ static int nbd_negotiate_meta_query(NBDClient *client,
  * Handle NBD_OPT_LIST_META_CONTEXT and NBD_OPT_SET_META_CONTEXT
  *
  * Return -errno on I/O error, or 0 if option was completely handled. */
 -static int nbd_negotiate_meta_queries(NBDClient *client, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_meta_queries(NBDClient *client, Error **errp)
 {
     int ret;
     g_autofree char *export_name = NULL;
@@ -1136,7 +1151,8 @@ static int nbd_negotiate_meta_queries(NBDClient *client, Error **errp)
  * 1       if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
  *         errp is not set
  */
 -static int nbd_negotiate_options(NBDClient *client, Error **errp)
 +static coroutine_fn int
 +nbd_negotiate_options(NBDClient *client, Error **errp)
 {
     uint32_t flags;
     bool fixedNewstyle = false;
 -- 
 2.39.3
--- a/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
+++ b/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
@ -1,175 +0,0 @@
 From 785893c171d994bbcffe0585953ca0d290f3c27e Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 7 Aug 2024 08:50:01 -0500
 Subject: [PATCH 2/5] nbd/server: Plumb in new args to nbd_client_add()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 263: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [RHEL 10.0]
 RH-Jira: RHEL-52599
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/4] 68e9f83d467704d3dfbf0a879b2bb4d9a568f81c (redhat/centos-stream/src/qemu-kvm)
 Upcoming patches to fix a CVE need to track an opaque pointer passed
 in by the owner of a client object, as well as request for a time
 limit on how fast negotiation must complete.  Prepare for that by
 changing the signature of nbd_client_new() and adding an accessor to
 get at the opaque pointer, although for now the two servers
 (qemu-nbd.c and blockdev-nbd.c) do not change behavior even though
 they pass in a new default timeout value.
 Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240807174943.771624-11-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 [eblake: s/LIMIT/MAX_SECS/ as suggested by Dan]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit fb1c2aaa981e0a2fa6362c9985f1296b74f055ac)
 Jira: https://issues.redhat.com/browse/RHEL-52599
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 blockdev-nbd.c      |  6 ++++--
 include/block/nbd.h | 11 ++++++++++-
 nbd/server.c        | 20 +++++++++++++++++---
 qemu-nbd.c          |  4 +++-
 4 files changed, 34 insertions(+), 7 deletions(-)
 diff --git a/blockdev-nbd.c b/blockdev-nbd.c
 index 213012435f..267a1de903 100644
 --- a/blockdev-nbd.c
 +++ b/blockdev-nbd.c
@@ -64,8 +64,10 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
     nbd_update_server_watch(nbd_server);
     qio_channel_set_name(QIO_CHANNEL(cioc), "nbd-server");
 -    nbd_client_new(cioc, nbd_server->tlscreds, nbd_server->tlsauthz,
 -                   nbd_blockdev_client_closed);
 +    /* TODO - expose handshake timeout as QMP option */
 +    nbd_client_new(cioc, NBD_DEFAULT_HANDSHAKE_MAX_SECS,
 +                   nbd_server->tlscreds, nbd_server->tlsauthz,
 +                   nbd_blockdev_client_closed, NULL);
 }
 static void nbd_update_server_watch(NBDServerData *s)
 diff --git a/include/block/nbd.h b/include/block/nbd.h
 index 4e7bd6342f..1d4d65922d 100644
 --- a/include/block/nbd.h
 +++ b/include/block/nbd.h
@@ -33,6 +33,12 @@ typedef struct NBDMetaContexts NBDMetaContexts;
 extern const BlockExportDriver blk_exp_nbd;
 +/*
 + * NBD_DEFAULT_HANDSHAKE_MAX_SECS: Number of seconds in which client must
 + * succeed at NBD_OPT_GO before being forcefully dropped as too slow.
 + */
 +#define NBD_DEFAULT_HANDSHAKE_MAX_SECS 10
 +
 /* Handshake phase structs - this struct is passed on the wire */
 typedef struct NBDOption {
@@ -403,9 +409,12 @@ AioContext *nbd_export_aio_context(NBDExport *exp);
 NBDExport *nbd_export_find(const char *name);
 void nbd_client_new(QIOChannelSocket *sioc,
 +                    uint32_t handshake_max_secs,
                     QCryptoTLSCreds *tlscreds,
                     const char *tlsauthz,
 -                    void (*close_fn)(NBDClient *, bool));
 +                    void (*close_fn)(NBDClient *, bool),
 +                    void *owner);
 +void *nbd_client_owner(NBDClient *client);
 void nbd_client_get(NBDClient *client);
 void nbd_client_put(NBDClient *client);
 diff --git a/nbd/server.c b/nbd/server.c
 index 892797bb11..e50012499f 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -124,12 +124,14 @@ struct NBDMetaContexts {
 struct NBDClient {
     int refcount; /* atomic */
     void (*close_fn)(NBDClient *client, bool negotiated);
 +    void *owner;
     QemuMutex lock;
     NBDExport *exp;
     QCryptoTLSCreds *tlscreds;
     char *tlsauthz;
 +    uint32_t handshake_max_secs;
     QIOChannelSocket *sioc; /* The underlying data channel */
     QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
@@ -3191,6 +3193,7 @@ static coroutine_fn void nbd_co_client_start(void *opaque)
     qemu_co_mutex_init(&client->send_lock);
 +    /* TODO - utilize client->handshake_max_secs */
     if (nbd_negotiate(client, &local_err)) {
         if (local_err) {
             error_report_err(local_err);
@@ -3205,14 +3208,17 @@ static coroutine_fn void nbd_co_client_start(void *opaque)
 }
 /*
 - * Create a new client listener using the given channel @sioc.
 + * Create a new client listener using the given channel @sioc and @owner.
  * Begin servicing it in a coroutine.  When the connection closes, call
 - * @close_fn with an indication of whether the client completed negotiation.
 + * @close_fn with an indication of whether the client completed negotiation
 + * within @handshake_max_secs seconds (0 for unbounded).
  */
 void nbd_client_new(QIOChannelSocket *sioc,
 +                    uint32_t handshake_max_secs,
                     QCryptoTLSCreds *tlscreds,
                     const char *tlsauthz,
 -                    void (*close_fn)(NBDClient *, bool))
 +                    void (*close_fn)(NBDClient *, bool),
 +                    void *owner)
 {
     NBDClient *client;
     Coroutine *co;
@@ -3225,13 +3231,21 @@ void nbd_client_new(QIOChannelSocket *sioc,
         object_ref(OBJECT(client->tlscreds));
     }
     client->tlsauthz = g_strdup(tlsauthz);
 +    client->handshake_max_secs = handshake_max_secs;
     client->sioc = sioc;
     qio_channel_set_delay(QIO_CHANNEL(sioc), false);
     object_ref(OBJECT(client->sioc));
     client->ioc = QIO_CHANNEL(sioc);
     object_ref(OBJECT(client->ioc));
     client->close_fn = close_fn;
 +    client->owner = owner;
     co = qemu_coroutine_create(nbd_co_client_start, client);
     qemu_coroutine_enter(co);
 }
 +
 +void *
 +nbd_client_owner(NBDClient *client)
 +{
 +    return client->owner;
 +}
 diff --git a/qemu-nbd.c b/qemu-nbd.c
 index d7b3ccab21..48e2fa5858 100644
 --- a/qemu-nbd.c
 +++ b/qemu-nbd.c
@@ -390,7 +390,9 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
     nb_fds++;
     nbd_update_server_watch();
 -    nbd_client_new(cioc, tlscreds, tlsauthz, nbd_client_closed);
 +    /* TODO - expose handshake timeout as command line option */
 +    nbd_client_new(cioc, NBD_DEFAULT_HANDSHAKE_MAX_SECS,
 +                   tlscreds, tlsauthz, nbd_client_closed, NULL);
 }
 static void nbd_update_server_watch(void)
 -- 
 2.39.3
--- a/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
+++ b/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
@ -1,208 +0,0 @@
 From 484fe3af54a3e421be9e370d47eabe0d8cc5c50d Mon Sep 17 00:00:00 2001
 From: Zhu Yangyang <zhuyangyang14@huawei.com>
 Date: Mon, 8 Apr 2024 11:00:43 -0500
 Subject: [PATCH 1/4] nbd/server: do not poll within a coroutine context
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 257: nbd/server: fix TLS negotiation across coroutine context
 RH-Jira: RHEL-40959
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/4] 379f38d46d204890e47a5eb744292d728badc7db (ebblake/centos-qemu-kvm)
 Coroutines are not supposed to block. Instead, they should yield.
 The client performs TLS upgrade outside of an AIOContext, during
 synchronous handshake; this still requires g_main_loop.  But the
 server responds to TLS upgrade inside a coroutine, so a nested
 g_main_loop is wrong.  Since the two callbacks no longer share more
 than the setting of data.complete and data.error, it's just as easy to
 use static helpers instead of trying to share a common code path.  It
 is also possible to add assertions that no other code is interfering
 with the eventual path to qio reaching the callback, whether or not it
 required a yield or main loop.
 Fixes: f95910f ("nbd: implement TLS support in the protocol negotiation")
 Signed-off-by: Zhu Yangyang <zhuyangyang14@huawei.com>
 [eblake: move callbacks to their use point, add assertions]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240408160214.1200629-5-eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Jira: https://issues.redhat.com/browse/RHEL-40959
 (cherry picked from commit ae6d91a7e9b77abb029ed3fa9fad461422286942)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 nbd/client.c       | 28 ++++++++++++++++++++++++----
 nbd/common.c       | 11 -----------
 nbd/nbd-internal.h | 10 ----------
 nbd/server.c       | 28 +++++++++++++++++++++++-----
 4 files changed, 47 insertions(+), 30 deletions(-)
 diff --git a/nbd/client.c b/nbd/client.c
 index 29ffc609a4..c89c750467 100644
 --- a/nbd/client.c
 +++ b/nbd/client.c
@@ -596,13 +596,31 @@ static int nbd_request_simple_option(QIOChannel *ioc, int opt, bool strict,
     return 1;
 }
 +/* Callback to learn when QIO TLS upgrade is complete */
 +struct NBDTLSClientHandshakeData {
 +    bool complete;
 +    Error *error;
 +    GMainLoop *loop;
 +};
 +
 +static void nbd_client_tls_handshake(QIOTask *task, void *opaque)
 +{
 +    struct NBDTLSClientHandshakeData *data = opaque;
 +
 +    qio_task_propagate_error(task, &data->error);
 +    data->complete = true;
 +    if (data->loop) {
 +        g_main_loop_quit(data->loop);
 +    }
 +}
 +
 static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
                                         QCryptoTLSCreds *tlscreds,
                                         const char *hostname, Error **errp)
 {
     int ret;
     QIOChannelTLS *tioc;
 -    struct NBDTLSHandshakeData data = { 0 };
 +    struct NBDTLSClientHandshakeData data = { 0 };
     ret = nbd_request_simple_option(ioc, NBD_OPT_STARTTLS, true, errp);
     if (ret <= 0) {
@@ -619,18 +637,20 @@ static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
         return NULL;
     }
     qio_channel_set_name(QIO_CHANNEL(tioc), "nbd-client-tls");
 -    data.loop = g_main_loop_new(g_main_context_default(), FALSE);
     trace_nbd_receive_starttls_tls_handshake();
     qio_channel_tls_handshake(tioc,
 -                              nbd_tls_handshake,
 +                              nbd_client_tls_handshake,
                               &data,
                               NULL,
                               NULL);
     if (!data.complete) {
 +        data.loop = g_main_loop_new(g_main_context_default(), FALSE);
         g_main_loop_run(data.loop);
 +        assert(data.complete);
 +        g_main_loop_unref(data.loop);
     }
 -    g_main_loop_unref(data.loop);
 +
     if (data.error) {
         error_propagate(errp, data.error);
         object_unref(OBJECT(tioc));
 diff --git a/nbd/common.c b/nbd/common.c
 index 3247c1d618..589a748cfe 100644
 --- a/nbd/common.c
 +++ b/nbd/common.c
@@ -47,17 +47,6 @@ int nbd_drop(QIOChannel *ioc, size_t size, Error **errp)
 }
 -void nbd_tls_handshake(QIOTask *task,
 -                       void *opaque)
 -{
 -    struct NBDTLSHandshakeData *data = opaque;
 -
 -    qio_task_propagate_error(task, &data->error);
 -    data->complete = true;
 -    g_main_loop_quit(data->loop);
 -}
 -
 -
 const char *nbd_opt_lookup(uint32_t opt)
 {
     switch (opt) {
 diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
 index dfa02f77ee..91895106a9 100644
 --- a/nbd/nbd-internal.h
 +++ b/nbd/nbd-internal.h
@@ -72,16 +72,6 @@ static inline int nbd_write(QIOChannel *ioc, const void *buffer, size_t size,
     return qio_channel_write_all(ioc, buffer, size, errp) < 0 ? -EIO : 0;
 }
 -struct NBDTLSHandshakeData {
 -    GMainLoop *loop;
 -    bool complete;
 -    Error *error;
 -};
 -
 -
 -void nbd_tls_handshake(QIOTask *task,
 -                       void *opaque);
 -
 int nbd_drop(QIOChannel *ioc, size_t size, Error **errp);
 #endif
 diff --git a/nbd/server.c b/nbd/server.c
 index c3484cc1eb..98ae0e1632 100644
 --- a/nbd/server.c
 +++ b/nbd/server.c
@@ -748,6 +748,23 @@ static int nbd_negotiate_handle_info(NBDClient *client, Error **errp)
     return rc;
 }
 +/* Callback to learn when QIO TLS upgrade is complete */
 +struct NBDTLSServerHandshakeData {
 +    bool complete;
 +    Error *error;
 +    Coroutine *co;
 +};
 +
 +static void nbd_server_tls_handshake(QIOTask *task, void *opaque)
 +{
 +    struct NBDTLSServerHandshakeData *data = opaque;
 +
 +    qio_task_propagate_error(task, &data->error);
 +    data->complete = true;
 +    if (!qemu_coroutine_entered(data->co)) {
 +        aio_co_wake(data->co);
 +    }
 +}
 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
  * new channel for all further (now-encrypted) communication. */
@@ -756,7 +773,7 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
 {
     QIOChannel *ioc;
     QIOChannelTLS *tioc;
 -    struct NBDTLSHandshakeData data = { 0 };
 +    struct NBDTLSServerHandshakeData data = { 0 };
     assert(client->opt == NBD_OPT_STARTTLS);
@@ -777,17 +794,18 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
     qio_channel_set_name(QIO_CHANNEL(tioc), "nbd-server-tls");
     trace_nbd_negotiate_handle_starttls_handshake();
 -    data.loop = g_main_loop_new(g_main_context_default(), FALSE);
 +    data.co = qemu_coroutine_self();
     qio_channel_tls_handshake(tioc,
 -                              nbd_tls_handshake,
 +                              nbd_server_tls_handshake,
                               &data,
                               NULL,
                               NULL);
     if (!data.complete) {
 -        g_main_loop_run(data.loop);
 +        qemu_coroutine_yield();
 +        assert(data.complete);
     }
 -    g_main_loop_unref(data.loop);
 +
     if (data.error) {
         object_unref(OBJECT(tioc));
         error_propagate(errp, data.error);
 -- 
 2.39.3
--- a/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
+++ b/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
@ -1,117 +0,0 @@
 From 57ec055ce7615d4838ae19c4980c2a1799c6cb3d Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 11 Apr 2024 15:06:01 +0200
 Subject: [PATCH 1/4] qcow2: Don't open data_file with BDRV_O_NO_IO
 RH-Author: Hana Czenczek <hczenczek@redhat.com>
 RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
 RH-Jira: RHEL-46239
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Commit: [1/4] f9843ce5c519901654a7d8ba43ee95ce25ca13c2
 One use case for 'qemu-img info' is verifying that untrusted images
 don't reference an unwanted external file, be it as a backing file or an
 external data file. To make sure that calling 'qemu-img info' can't
 already have undesired side effects with a malicious image, just don't
 open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
 I/O, we don't need to have it open.
 This changes the output of iotests case 061, which used 'qemu-img info'
 to show that opening an image with an invalid data file fails. After
 this patch, it succeeds. Replace this part of the test with a qemu-io
 call, but keep the final 'qemu-img info' to show that the invalid data
 file is correctly displayed in the output.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
 Upstream: N/A, embargoed
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/qcow2.c              | 17 ++++++++++++++++-
 tests/qemu-iotests/061     |  6 ++++--
 tests/qemu-iotests/061.out |  8 ++++++--
 3 files changed, 26 insertions(+), 5 deletions(-)
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 0e8b2f7518..3b8d2db9f9 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1642,7 +1642,22 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 -    if (open_data_file) {
 +    if (open_data_file && (flags & BDRV_O_NO_IO)) {
 +        /*
 +         * Don't open the data file for 'qemu-img info' so that it can be used
 +         * to verify that an untrusted qcow2 image doesn't refer to external
 +         * files.
 +         *
 +         * Note: This still makes has_data_file() return true.
 +         */
 +        if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
 +            s->data_file = NULL;
 +        } else {
 +            s->data_file = bs->file;
 +        }
 +        qdict_extract_subqdict(options, NULL, "data-file.");
 +        qdict_del(options, "data-file");
 +    } else if (open_data_file) {
         /* Open external data file */
         bdrv_graph_co_rdunlock();
         s->data_file = bdrv_co_open_child(NULL, options, "data-file", bs,
 diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
 index 53c7d428e3..b71ac097d1 100755
 --- a/tests/qemu-iotests/061
 +++ b/tests/qemu-iotests/061
@@ -326,12 +326,14 @@ $QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
 echo
 _make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M
 $QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
 -_img_info --format-specific
 +$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
 +$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
 TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
 echo
 $QEMU_IMG amend -o "data_file=" --image-opts "data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG"
 -_img_info --format-specific
 +$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
 +$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
 TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
 echo
 diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
 index 139fc68177..24c33add7c 100644
 --- a/tests/qemu-iotests/061.out
 +++ b/tests/qemu-iotests/061.out
@@ -545,7 +545,9 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
 qemu-img: data-file can only be set for images that use an external data file
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 data_file=TEST_DIR/t.IMGFMT.data
 -qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Could not open 'foo': No such file or directory
 +qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open 'foo': No such file or directory
 +read 4096/4096 bytes at offset 0
 +4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
@@ -560,7 +562,9 @@ Format specific information:
     corrupt: false
     extended l2: false
 -qemu-img: Could not open 'TEST_DIR/t.IMGFMT': 'data-file' is required for this image
 +qemu-io: can't open device TEST_DIR/t.IMGFMT: 'data-file' is required for this image
 +read 4096/4096 bytes at offset 0
 +4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
 -- 
 2.39.3
--- a/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
+++ b/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
@ -1,130 +0,0 @@
 From 120a2c8a7d936e24948f8f4ada6b781b6cbc9931 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 17 May 2024 21:50:14 -0500
 Subject: [PATCH 3/4] qio: Inherit follow_coroutine_ctx across TLS
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Blake <eblake@redhat.com>
 RH-MergeRequest: 257: nbd/server: fix TLS negotiation across coroutine context
 RH-Jira: RHEL-40959
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [3/4] b7fd03af5985bbc5504b1a8e2f5cd165f6e438e5 (ebblake/centos-qemu-kvm)
 Since qemu 8.2, the combination of NBD + TLS + iothread crashes on an
 assertion failure:
 qemu-kvm: ../io/channel.c:534: void qio_channel_restart_read(void *): Assertion `qemu_get_current_aio_context() == qemu_coroutine_get_aio_context(co)' failed.
 It turns out that when we removed AioContext locking, we did so by
 having NBD tell its qio channels that it wanted to opt in to
 qio_channel_set_follow_coroutine_ctx(); but while we opted in on the
 main channel, we did not opt in on the TLS wrapper channel.
 qemu-iotests has coverage of NBD+iothread and NBD+TLS, but apparently
 no coverage of NBD+TLS+iothread, or we would have noticed this
 regression sooner.  (I'll add that in the next patch)
 But while we could manually opt in to the TLS channel in nbd/server.c
 (a one-line change), it is more generic if all qio channels that wrap
 other channels inherit the follow status, in the same way that they
 inherit feature bits.
 CC: Stefan Hajnoczi <stefanha@redhat.com>
 CC: Daniel P. Berrangé <berrange@redhat.com>
 CC: qemu-stable@nongnu.org
 Fixes: https://issues.redhat.com/browse/RHEL-34786
 Fixes: 06e0f098 ("io: follow coroutine AioContext in qio_channel_yield()", v8.2.0)
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-ID: <20240518025246.791593-5-eblake@redhat.com>
 (cherry picked from commit 199e84de1c903ba5aa1f7256310bbc4a20dd930b)
 Jira: https://issues.redhat.com/browse/RHEL-40959
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
 io/channel-tls.c     | 26 +++++++++++++++-----------
 io/channel-websock.c |  1 +
 2 files changed, 16 insertions(+), 11 deletions(-)
 diff --git a/io/channel-tls.c b/io/channel-tls.c
 index 1d9c9c72bf..67b9700006 100644
 --- a/io/channel-tls.c
 +++ b/io/channel-tls.c
@@ -69,37 +69,40 @@ qio_channel_tls_new_server(QIOChannel *master,
                            const char *aclname,
                            Error **errp)
 {
 -    QIOChannelTLS *ioc;
 +    QIOChannelTLS *tioc;
 +    QIOChannel *ioc;
 -    ioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 +    tioc = QIO_CHANNEL_TLS(object_new(TYPE_QIO_CHANNEL_TLS));
 +    ioc = QIO_CHANNEL(tioc);
 -    ioc->master = master;
 +    tioc->master = master;
 +    ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
 -        qio_channel_set_feature(QIO_CHANNEL(ioc), QIO_CHANNEL_FEATURE_SHUTDOWN);
 +        qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
     }
     object_ref(OBJECT(master));
 -    ioc->session = qcrypto_tls_session_new(
 +    tioc->session = qcrypto_tls_session_new(
         creds,
         NULL,
         aclname,
         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
         errp);
 -    if (!ioc->session) {
 +    if (!tioc->session) {
         goto error;
     }
     qcrypto_tls_session_set_callbacks(
 -        ioc->session,
 +        tioc->session,
         qio_channel_tls_write_handler,
         qio_channel_tls_read_handler,
 -        ioc);
 +        tioc);
 -    trace_qio_channel_tls_new_server(ioc, master, creds, aclname);
 -    return ioc;
 +    trace_qio_channel_tls_new_server(tioc, master, creds, aclname);
 +    return tioc;
  error:
 -    object_unref(OBJECT(ioc));
 +    object_unref(OBJECT(tioc));
     return NULL;
 }
@@ -116,6 +119,7 @@ qio_channel_tls_new_client(QIOChannel *master,
     ioc = QIO_CHANNEL(tioc);
     tioc->master = master;
 +    ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
     }
 diff --git a/io/channel-websock.c b/io/channel-websock.c
 index a12acc27cf..de39f0d182 100644
 --- a/io/channel-websock.c
 +++ b/io/channel-websock.c
@@ -883,6 +883,7 @@ qio_channel_websock_new_server(QIOChannel *master)
     ioc = QIO_CHANNEL(wioc);
     wioc->master = master;
 +    ioc->follow_coroutine_ctx = master->follow_coroutine_ctx;
     if (qio_channel_has_feature(master, QIO_CHANNEL_FEATURE_SHUTDOWN)) {
         qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
     }
 -- 
 2.39.3
--- a/kvm-qtest-x86-numa-test-do-not-use-the-obsolete-pentium-.patch
+++ b/kvm-qtest-x86-numa-test-do-not-use-the-obsolete-pentium-.patch
@ -1,46 +0,0 @@
 From 2c7512b27b8d8862e26c6e07169752078513f40c Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Mon, 10 Jun 2024 21:22:58 +0530
 Subject: [PATCH 01/14] qtest/x86/numa-test: do not use the obsolete 'pentium'
 cpu
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 243: target/cpu-models/x86: Remove the existing deprecated CPU models on c10s
 RH-Jira: RHEL-28972
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: MST <mst@redhat.com>
 RH-Commit: [1/4] a9b38ebd4e772a0a1fe40301a6f1abab6b961cd7 (anisinha/centos-qemu-kvm)
 'pentium' cpu is old and obsolete and should be avoided for running tests if
 its not strictly needed. Use 'max' cpu instead for generic non-cpu specific
 numa test.
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Tested-by: Mario Casquero <mcasquer@redhat.com>
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 Message-ID: <20240610155303.7933-2-anisinha@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 07c8d9ac0fa30712fdf78046a7998ee8d2231d6f)
 ---
 tests/qtest/numa-test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/tests/qtest/numa-test.c b/tests/qtest/numa-test.c
 index 4f4404a4b1..a512f743c4 100644
 --- a/tests/qtest/numa-test.c
 +++ b/tests/qtest/numa-test.c
@@ -125,7 +125,8 @@ static void pc_numa_cpu(const void *data)
     QTestState *qts;
     g_autofree char *cli = NULL;
 -    cli = make_cli(data, "-cpu pentium -machine smp.cpus=8,smp.sockets=2,smp.cores=2,smp.threads=2 "
 +    cli = make_cli(data,
 +        "-cpu max -machine smp.cpus=8,smp.sockets=2,smp.cores=2,smp.threads=2 "
         "-numa node,nodeid=0,memdev=ram -numa node,nodeid=1 "
         "-numa cpu,node-id=1,socket-id=0 "
         "-numa cpu,node-id=0,socket-id=1,core-id=0 "
 -- 
 2.39.3
--- a/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
+++ b/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
@ -1,36 +0,0 @@
 From 44ee061e1904c20cae9cab5e8a62f1b506395383 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Wed, 5 Jun 2024 10:28:20 +0400
 Subject: [PATCH 07/14] rhel 9.4.0 machine type compat for virtio-gpu migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
 RH-MergeRequest: 250: virtio-gpu: fix v2 migration
 RH-Jira: RHEL-36329
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/2] 66c98702c691e3454377f5a98230fd1f619a9a87 (marcandre.lureau-rh/qemu-kvm-centos)
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 ---
 hw/core/machine.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index cf1d7faaaf..92609aae27 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -310,6 +310,8 @@ GlobalProperty hw_compat_rhel_9_5[] = {
     { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
 };
 const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
 -- 
 2.39.3
--- a/kvm-s390x-remove-deprecated-rhel-machine-types.patch
+++ b/kvm-s390x-remove-deprecated-rhel-machine-types.patch
@ -1,164 +0,0 @@
 From eb773f38d127117597a1640cd623f1fcd000c067 Mon Sep 17 00:00:00 2001
 From: Sebastian Ott <sebott@redhat.com>
 Date: Fri, 19 Apr 2024 16:37:57 +0200
 Subject: [PATCH 08/14] s390x: remove deprecated rhel machine types
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 252: s390x: remove legacy CPU types
 RH-Jira: RHEL-39898
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/5] 5ed0651c38584980b1fe51592a788032526c0f2f (thuth/qemu-kvm-cs9)
 Upstream-status: N/A
 Remove the following deprecated s390x rhel specific machine types:
 s390-ccw-virtio-rhel8.6.0
 s390-ccw-virtio-rhel8.5.0
 s390-ccw-virtio-rhel8.4.0
 s390-ccw-virtio-rhel8.2.0
 s390-ccw-virtio-rhel7.6.0
 Signed-off-by: Sebastian Ott <sebott@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 106 +------------------------------------
 1 file changed, 2 insertions(+), 104 deletions(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 9ad54682c6..b0b903b78c 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -610,6 +610,7 @@ static void s390_nmi(NMIState *n, int cpu_index, Error **errp)
     s390_cpu_restart(S390_CPU(cs));
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static ram_addr_t s390_fixup_ram_size(ram_addr_t sz)
 {
     /* same logic as in sclp.c */
@@ -629,6 +630,7 @@ static ram_addr_t s390_fixup_ram_size(ram_addr_t sz)
     }
     return newsz;
 }
 +#endif /* disabled for RHEL */
 static inline bool machine_get_aes_key_wrap(Object *obj, Error **errp)
 {
@@ -1329,110 +1331,6 @@ static void ccw_machine_rhel900_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
 -static void ccw_machine_rhel860_instance_options(MachineState *machine)
 -{
 -    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
 -    ccw_machine_rhel900_instance_options(machine);
 -}
 -
 -static void ccw_machine_rhel860_class_options(MachineClass *mc)
 -{
 -    static GlobalProperty compat[] = {
 -        { TYPE_S390_PCI_DEVICE, "interpret", "on", },
 -        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "on", },
 -    };
 -
 -    ccw_machine_rhel900_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 -    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 -
 -    /* All RHEL machines for prior major releases are deprecated */
 -    mc->deprecation_reason = rhel_old_machine_deprecation;
 -}
 -DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
 -
 -static void ccw_machine_rhel850_instance_options(MachineState *machine)
 -{
 -    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 -
 -    ccw_machine_rhel860_instance_options(machine);
 -
 -    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 -
 -    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 -    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 -    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 -    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 -    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 -}
 -
 -static void ccw_machine_rhel850_class_options(MachineClass *mc)
 -{
 -    static GlobalProperty compat[] = {
 -        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 -        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 -    };
 -
 -    ccw_machine_rhel860_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 -    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 -    mc->smp_props.prefer_sockets = true;
 -}
 -DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
 -
 -static void ccw_machine_rhel840_instance_options(MachineState *machine)
 -{
 -    ccw_machine_rhel850_instance_options(machine);
 -}
 -
 -static void ccw_machine_rhel840_class_options(MachineClass *mc)
 -{
 -    ccw_machine_rhel850_class_options(mc);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 -}
 -DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 -
 -static void ccw_machine_rhel820_instance_options(MachineState *machine)
 -{
 -    ccw_machine_rhel840_instance_options(machine);
 -}
 -
 -static void ccw_machine_rhel820_class_options(MachineClass *mc)
 -{
 -    ccw_machine_rhel840_class_options(mc);
 -    mc->fixup_ram_size = s390_fixup_ram_size;
 -    /* we did not publish a rhel8.3.0 machine */
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 -}
 -DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 -
 -static void ccw_machine_rhel760_instance_options(MachineState *machine)
 -{
 -    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 -
 -    ccw_machine_rhel820_instance_options(machine);
 -
 -    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 -
 -    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 -    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 -    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 -    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 -    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 -    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 -}
 -
 -static void ccw_machine_rhel760_class_options(MachineClass *mc)
 -{
 -    ccw_machine_rhel820_class_options(mc);
 -    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 -    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 -}
 -DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 -
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);
 -- 
 2.39.3
--- a/kvm-s390x-select-correct-components-for-no-board-build.patch
+++ b/kvm-s390x-select-correct-components-for-no-board-build.patch
@ -1,41 +0,0 @@
 From 874c2ad98804caf0db862c2a45db66a9bceb4fc4 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Thu, 9 May 2024 19:00:35 +0200
 Subject: [PATCH 09/14] s390x: select correct components for no-board build
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 252: s390x: remove legacy CPU types
 RH-Jira: RHEL-39898
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/5] 441dfae234f21f801ac9f9e417e96e2edff48bd4 (thuth/qemu-kvm-cs9)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-ID: <20240509170044.190795-5-pbonzini@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit e799b65faef129f2905bd9bf66c30aaaa7115dac)
 Conflicts:
 	.gitlab-ci.d/buildtest.yml
 	(skipped the changes to the CI files, they don't apply and
 	 are not needed in downstream)
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 target/s390x/Kconfig | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/target/s390x/Kconfig b/target/s390x/Kconfig
 index 72da48136c..d886be48b4 100644
 --- a/target/s390x/Kconfig
 +++ b/target/s390x/Kconfig
@@ -1,2 +1,4 @@
 config S390X
     bool
 +    select PCI
 +    select S390_FLIC
 -- 
 2.39.3
--- a/kvm-target-cpu-models-x86-Remove-the-existing-deprecated.patch
+++ b/kvm-target-cpu-models-x86-Remove-the-existing-deprecated.patch
@ -1,62 +0,0 @@
 From 0d3444e4ba998bbebce282fe1367ef16b635e3ae Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Fri, 14 Jun 2024 13:34:47 +0530
 Subject: [PATCH 04/14] target/cpu-models/x86: Remove the existing deprecated
 CPU models on c10s
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 243: target/cpu-models/x86: Remove the existing deprecated CPU models on c10s
 RH-Jira: RHEL-28972
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: MST <mst@redhat.com>
 RH-Commit: [4/4] ca6905d2f6cae5f120d3acef973cadb1164e0864 (anisinha/centos-qemu-kvm)
 The cpu models that were deprecated in c9s can be removed in c10s. This change
 compiled out these cpu models. For x86, 'qemu64' cpu model is still kept as is
 as its the default cpu model.
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 ---
 target/i386/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index be7b0663cd..c83d585c9b 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2215,6 +2215,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x8000000A,
         .model_id = "QEMU Virtual CPU version " QEMU_HW_VERSION,
     },
 +#if 0 // Deprecated CPU models are removed in RHEL-10
     {
         .name = "phenom",
         .deprecation_note = RHEL_CPU_DEPRECATION,
@@ -2593,6 +2594,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "Intel Core 2 Duo P9xxx (Penryn Class Core 2)",
     },
 +#endif // Removal of deprecated CPU models in RHEL-10
     {
         .name = "Nehalem",
         .level = 11,
@@ -4410,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "Intel Xeon Phi Processor (Knights Mill)",
     },
 +#if 0 // Deprecated CPU models are removed in RHEL-10
     {
         .name = "Opteron_G1",
         .deprecation_note = RHEL_CPU_DEPRECATION,
@@ -4480,6 +4483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .xlevel = 0x80000008,
         .model_id = "AMD Opteron 23xx (Gen 3 Class Opteron)",
     },
 +#endif
     {
         .name = "Opteron_G4",
         .level = 0xd,
 -- 
 2.39.3
--- a/kvm-target-s390x-Add-a-CONFIG-switch-to-disable-legacy-C.patch
+++ b/kvm-target-s390x-Add-a-CONFIG-switch-to-disable-legacy-C.patch
@ -1,116 +0,0 @@
 From d0f88c7a0c95b4d9ab03221400736cb17cb4b995 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Thu, 13 Jun 2024 16:14:22 +0200
 Subject: [PATCH 10/14] target/s390x: Add a CONFIG switch to disable legacy
 CPUs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 252: s390x: remove legacy CPU types
 RH-Jira: RHEL-39898
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [3/5] f8e78c8e0349c8645e7df7b0bebed1635865b454 (thuth/qemu-kvm-cs9)
 The oldest model that IBM still supports is the z13. Considering
 that each generation can "emulate" the previous two generations
 in hardware (via the "IBC" feature of the CPUs), this means that
 everything that is older than z114/196 is not an officially supported
 CPU model anymore. The Linux kernel still support the z10, so if
 we also take this into account, everything older than that can
 definitely be considered as a legacy CPU model.
 For downstream builds of QEMU, we would like to be able to disable
 these legacy CPUs in the build. Thus add a CONFIG switch that can be
 used to disable them (and old machine types that use them by default).
 Message-Id: <20240614125019.588928-1-thuth@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit d6a7c3f44cf3f60c066dbf087ef79d4b12acc642)
 ---
 hw/s390x/s390-virtio-ccw.c | 4 ++++
 target/s390x/Kconfig       | 5 +++++
 target/s390x/cpu_models.c  | 9 +++++++++
 3 files changed, 18 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index b0b903b78c..527b05d1d6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -46,6 +46,7 @@
 #include "migration/blocker.h"
 #include "qapi/visitor.h"
 #include "hw/s390x/cpu-topology.h"
 +#include CONFIG_DEVICES
 static Error *pv_mig_blocker;
@@ -1130,6 +1131,8 @@ static void ccw_machine_2_12_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(2_12, "2.12", false);
 +#ifdef CONFIG_S390X_LEGACY_CPUS
 +
 static void ccw_machine_2_11_instance_options(MachineState *machine)
 {
     static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
@@ -1277,6 +1280,7 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 #endif
 +#endif
 static void ccw_machine_rhel940_instance_options(MachineState *machine)
 {
 diff --git a/target/s390x/Kconfig b/target/s390x/Kconfig
 index d886be48b4..8a95f2bc3f 100644
 --- a/target/s390x/Kconfig
 +++ b/target/s390x/Kconfig
@@ -2,3 +2,8 @@ config S390X
     bool
     select PCI
     select S390_FLIC
 +
 +config S390X_LEGACY_CPUS
 +    bool
 +    default y
 +    depends on S390X
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 370b3b3065..f4dbcc67bb 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -25,6 +25,7 @@
 #ifndef CONFIG_USER_ONLY
 #include "sysemu/sysemu.h"
 #include "target/s390x/kvm/pv.h"
 +#include CONFIG_DEVICES
 #endif
 #define CPUDEF_INIT(_type, _gen, _ec_ga, _mha_pow, _hmfai, _name, _desc) \
@@ -50,6 +51,13 @@
 #define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 static S390CPUDef s390_cpu_defs[] = {
 +    /*
 +     * Linux requires at least z10 nowadays, and IBM only supports recent CPUs
 +     * (see https://www.ibm.com/support/pages/ibm-mainframe-life-cycle-history),
 +     * so we consider older CPUs as legacy that can optionally be disabled via
 +     * the CONFIG_S390X_LEGACY_CPUS config switch.
 +     */
 +#if defined(CONFIG_S390X_LEGACY_CPUS) || defined(CONFIG_USER_ONLY)
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
     CPUDEF_INIT(0x2064, 7, 3, 38, 0x00000000U, "z900.3", "IBM zSeries 900 GA3"),
@@ -67,6 +75,7 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2096, 9, 2, 40, 0x00000000U, "z9BC", "IBM System z9 BC GA1"),
     CPUDEF_INIT(0x2094, 9, 3, 40, 0x00000000U, "z9EC.3", "IBM System z9 EC GA3"),
     CPUDEF_INIT(0x2096, 9, 3, 40, 0x00000000U, "z9BC.2", "IBM System z9 BC GA2"),
 +#endif
     CPUDEF_INIT(0x2097, 10, 1, 43, 0x00000000U, "z10EC", "IBM System z10 EC GA1"),
     CPUDEF_INIT(0x2097, 10, 2, 43, 0x00000000U, "z10EC.2", "IBM System z10 EC GA2"),
     CPUDEF_INIT(0x2098, 10, 2, 43, 0x00000000U, "z10BC", "IBM System z10 BC GA1"),
 -- 
 2.39.3
--- a/kvm-target-s390x-Revert-the-old-s390x-CPU-model-disablem.patch
+++ b/kvm-target-s390x-Revert-the-old-s390x-CPU-model-disablem.patch
@ -1,66 +0,0 @@
 From 64eecc611dfdb9252b5e9d20b96cba715ecc1d07 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 24 Jun 2024 14:26:14 +0200
 Subject: [PATCH 12/14] target/s390x: Revert the old s390x CPU model
 disablement code
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 252: s390x: remove legacy CPU types
 RH-Jira: RHEL-39898
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [5/5] da022e5acaeb1c86fba6245aa2c20491ac83046f (thuth/qemu-kvm-cs9)
 Upstream-Status: N/A
 We now completely disable the old CPU models up to the z12 in
 target/s390x/cpu_models.c, so we don't need these old checks
 anymore.
 This patch should get squashed into the downstream patch
 "Enable/disable devices for RHEL" during the next rebase.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 target/s390x/cpu_models_sysemu.c | 3 ---
 target/s390x/kvm/kvm.c           | 7 -------
 2 files changed, 10 deletions(-)
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index ca2e5d91e2..906d5d42b7 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -34,9 +34,6 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 -    } else if (model->def->gen < 11 && kvm_enabled()) {
 -        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 -        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 55fb4855b1..6dcb8dba2d 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2566,13 +2566,6 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         return;
     }
 -    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 -    if (model->def->gen < 11) {
 -        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 -                   MACHINE(qdev_get_machine())->cpu_type);
 -        return;
 -    }
 -
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
 2.39.3
--- a/kvm-target-s390x-cpu_models-Disable-everything-up-to-the.patch
+++ b/kvm-target-s390x-cpu_models-Disable-everything-up-to-the.patch
@ -1,56 +0,0 @@
 From 947ee045103e9148c80a1df0dc300fc840df2680 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 24 Jun 2024 14:15:08 +0200
 Subject: [PATCH 11/14] target/s390x/cpu_models: Disable everything up to the
 z12 CPU model
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 252: s390x: remove legacy CPU types
 RH-Jira: RHEL-39898
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [4/5] f5236c8041bfcb63df4046f7bb0a12c1fa90062d (thuth/qemu-kvm-cs9)
 Upstream-Status: N/A
 JIRA: https://issues.redhat.com/browse/RHEL-39898
 When RHEL 10.0 gets released, the z14 will be the oldest mainframe
 that is still officially supported by IBM, see:
 https://www.ibm.com/support/pages/ibm-mainframe-life-cycle-history
 Now each IBM Z machine can "emulate" the previous two CPU types in
 hardware for virtual guests, so we should still allow the z12 and
 z13 in our qemu-kvm builds, too. But everything that is older than
 the z12 can be disabled now.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 target/s390x/cpu_models.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index f4dbcc67bb..ad65149844 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -75,7 +75,6 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2096, 9, 2, 40, 0x00000000U, "z9BC", "IBM System z9 BC GA1"),
     CPUDEF_INIT(0x2094, 9, 3, 40, 0x00000000U, "z9EC.3", "IBM System z9 EC GA3"),
     CPUDEF_INIT(0x2096, 9, 3, 40, 0x00000000U, "z9BC.2", "IBM System z9 BC GA2"),
 -#endif
     CPUDEF_INIT(0x2097, 10, 1, 43, 0x00000000U, "z10EC", "IBM System z10 EC GA1"),
     CPUDEF_INIT(0x2097, 10, 2, 43, 0x00000000U, "z10EC.2", "IBM System z10 EC GA2"),
     CPUDEF_INIT(0x2098, 10, 2, 43, 0x00000000U, "z10BC", "IBM System z10 BC GA1"),
@@ -84,6 +83,7 @@ static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2817, 11, 1, 44, 0x08000000U, "z196", "IBM zEnterprise 196 GA1"),
     CPUDEF_INIT(0x2817, 11, 2, 44, 0x08000000U, "z196.2", "IBM zEnterprise 196 GA2"),
     CPUDEF_INIT(0x2818, 11, 2, 44, 0x08000000U, "z114", "IBM zEnterprise 114 GA1"),
 +#endif
     CPUDEF_INIT(0x2827, 12, 1, 44, 0x08000000U, "zEC12", "IBM zEnterprise EC12 GA1"),
     CPUDEF_INIT(0x2827, 12, 2, 44, 0x08000000U, "zEC12.2", "IBM zEnterprise EC12 GA2"),
     CPUDEF_INIT(0x2828, 12, 2, 44, 0x08000000U, "zBC12", "IBM zEnterprise BC12 GA1"),
 -- 
 2.39.3
--- a/kvm-tests-qtest-libqtest-add-qtest_has_cpu_model-api.patch
+++ b/kvm-tests-qtest-libqtest-add-qtest_has_cpu_model-api.patch
@ -1,162 +0,0 @@
 From 83bed1458ca3c0137658b53f0a1115d232091703 Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Mon, 10 Jun 2024 21:22:59 +0530
 Subject: [PATCH 02/14] tests/qtest/libqtest: add qtest_has_cpu_model() api
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 243: target/cpu-models/x86: Remove the existing deprecated CPU models on c10s
 RH-Jira: RHEL-28972
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: MST <mst@redhat.com>
 RH-Commit: [2/4] af128c3ae0a563ca5e2b50bdbdf44f6ce1404aad (anisinha/centos-qemu-kvm)
 Added a new test api qtest_has_cpu_model() in order to check availability of
 some cpu models in the current QEMU binary. The specific architecture of the
 QEMU binary is selected using the QTEST_QEMU_BINARY environment variable.
 This api would be useful to run tests against some older cpu models after
 checking if QEMU actually supported these models.
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 Reviewed-by: Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-ID: <20240610155303.7933-3-anisinha@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit f43f8abe457a4aa32441bd190638e1118d291c42)
 ---
 tests/qtest/libqtest.c | 83 ++++++++++++++++++++++++++++++++++++++++++
 tests/qtest/libqtest.h |  8 ++++
 2 files changed, 91 insertions(+)
 diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
 index d8f80d335e..18e2f7f282 100644
 --- a/tests/qtest/libqtest.c
 +++ b/tests/qtest/libqtest.c
@@ -37,6 +37,7 @@
 #include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qlist.h"
 #include "qapi/qmp/qstring.h"
 +#include "qapi/qmp/qbool.h"
 #define MAX_IRQ 256
@@ -1471,6 +1472,12 @@ struct MachInfo {
     char *alias;
 };
 +struct CpuModel {
 +    char *name;
 +    char *alias_of;
 +    bool deprecated;
 +};
 +
 static void qtest_free_machine_list(struct MachInfo *machines)
 {
     if (machines) {
@@ -1550,6 +1557,82 @@ static struct MachInfo *qtest_get_machines(const char *var)
     return machines;
 }
 +static struct CpuModel *qtest_get_cpu_models(void)
 +{
 +    static struct CpuModel *cpus;
 +    QDict *response, *minfo;
 +    QList *list;
 +    const QListEntry *p;
 +    QObject *qobj;
 +    QString *qstr;
 +    QBool *qbool;
 +    QTestState *qts;
 +    int idx;
 +
 +    if (cpus) {
 +        return cpus;
 +    }
 +
 +    silence_spawn_log = !g_test_verbose();
 +
 +    qts = qtest_init_with_env(NULL, "-machine none");
 +    response = qtest_qmp(qts, "{ 'execute': 'query-cpu-definitions' }");
 +    g_assert(response);
 +    list = qdict_get_qlist(response, "return");
 +    g_assert(list);
 +
 +    cpus = g_new0(struct CpuModel, qlist_size(list) + 1);
 +
 +    for (p = qlist_first(list), idx = 0; p; p = qlist_next(p), idx++) {
 +        minfo = qobject_to(QDict, qlist_entry_obj(p));
 +        g_assert(minfo);
 +
 +        qobj = qdict_get(minfo, "name");
 +        g_assert(qobj);
 +        qstr = qobject_to(QString, qobj);
 +        g_assert(qstr);
 +        cpus[idx].name = g_strdup(qstring_get_str(qstr));
 +
 +        qobj = qdict_get(minfo, "alias_of");
 +        if (qobj) { /* old machines do not report aliases */
 +            qstr = qobject_to(QString, qobj);
 +            g_assert(qstr);
 +            cpus[idx].alias_of = g_strdup(qstring_get_str(qstr));
 +        } else {
 +            cpus[idx].alias_of = NULL;
 +        }
 +
 +        qobj = qdict_get(minfo, "deprecated");
 +        qbool = qobject_to(QBool, qobj);
 +        g_assert(qbool);
 +        cpus[idx].deprecated = qbool_get_bool(qbool);
 +    }
 +
 +    qtest_quit(qts);
 +    qobject_unref(response);
 +
 +    silence_spawn_log = false;
 +
 +    return cpus;
 +}
 +
 +bool qtest_has_cpu_model(const char *cpu)
 +{
 +    struct CpuModel *cpus;
 +    int i;
 +
 +    cpus = qtest_get_cpu_models();
 +
 +    for (i = 0; cpus[i].name != NULL; i++) {
 +        if (g_str_equal(cpu, cpus[i].name) ||
 +            (cpus[i].alias_of && g_str_equal(cpu, cpus[i].alias_of))) {
 +            return true;
 +        }
 +    }
 +
 +    return false;
 +}
 +
 void qtest_cb_for_every_machine(void (*cb)(const char *machine),
                                 bool skip_old_versioned)
 {
 diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
 index 6e3d3525bf..beb96b18eb 100644
 --- a/tests/qtest/libqtest.h
 +++ b/tests/qtest/libqtest.h
@@ -949,6 +949,14 @@ bool qtest_has_machine(const char *machine);
  */
 bool qtest_has_machine_with_env(const char *var, const char *machine);
 +/**
 + * qtest_has_cpu_model:
 + * @cpu: The cpu to look for
 + *
 + * Returns: true if the cpu is available in the target binary.
 + */
 +bool qtest_has_cpu_model(const char *cpu);
 +
 /**
  * qtest_has_device:
  * @device: The device to look for
 -- 
 2.39.3
--- a/kvm-tests-qtest-x86-check-for-availability-of-older-cpu-.patch
+++ b/kvm-tests-qtest-x86-check-for-availability-of-older-cpu-.patch
@ -1,359 +0,0 @@
 From 31bce7b3e6776e60e0994a45691bded22cc68476 Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Mon, 10 Jun 2024 21:23:00 +0530
 Subject: [PATCH 03/14] tests/qtest/x86: check for availability of older cpu
 models before running tests
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 243: target/cpu-models/x86: Remove the existing deprecated CPU models on c10s
 RH-Jira: RHEL-28972
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: MST <mst@redhat.com>
 RH-Commit: [3/4] 5a049fbd48fda9c1b2d74dc8b389c43547029df2 (anisinha/centos-qemu-kvm)
 It is better to check if some older cpu models like 486, athlon, pentium,
 penryn, phenom, core2duo etc are available before running their corresponding
 tests. Some downstream distributions may no longer support these older cpu
 models.
 Signature of add_feature_test() has been modified to return void as
 FeatureTestArgs* was not used by the caller.
 One minor correction. Replaced 'phenom' with '486' in the test
 'x86/cpuid/auto-level/phenom/arat' matching the cpu used.
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-ID: <20240610155303.7933-4-anisinha@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit e08f6e0b9fcf708f641bbb8839b7e30d857989d9)
 ---
 tests/qtest/test-x86-cpuid-compat.c | 170 ++++++++++++++++++----------
 1 file changed, 108 insertions(+), 62 deletions(-)
 diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
 index 6a39454fce..b9e7e5ef7b 100644
 --- a/tests/qtest/test-x86-cpuid-compat.c
 +++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -67,10 +67,29 @@ static void test_cpuid_prop(const void *data)
     g_free(path);
 }
 -static void add_cpuid_test(const char *name, const char *cmdline,
 +static void add_cpuid_test(const char *name, const char *cpu,
 +                           const char *cpufeat, const char *machine,
                            const char *property, int64_t expected_value)
 {
     CpuidTestArgs *args = g_new0(CpuidTestArgs, 1);
 +    char *cmdline;
 +    char *save;
 +
 +    if (!qtest_has_cpu_model(cpu)) {
 +        return;
 +    }
 +    cmdline = g_strdup_printf("-cpu %s", cpu);
 +
 +    if (cpufeat) {
 +        save = cmdline;
 +        cmdline = g_strdup_printf("%s,%s", cmdline, cpufeat);
 +        g_free(save);
 +    }
 +    if (machine) {
 +        save = cmdline;
 +        cmdline = g_strdup_printf("-machine %s %s", machine, cmdline);
 +        g_free(save);
 +    }
     args->cmdline = cmdline;
     args->property = property;
     args->expected_value = expected_value;
@@ -149,12 +168,24 @@ static void test_feature_flag(const void *data)
  * either "feature-words" or "filtered-features", when running QEMU
  * using cmdline
  */
 -static FeatureTestArgs *add_feature_test(const char *name, const char *cmdline,
 -                                         uint32_t eax, uint32_t ecx,
 -                                         const char *reg, int bitnr,
 -                                         bool expected_value)
 +static void add_feature_test(const char *name, const char *cpu,
 +                             const char *cpufeat, uint32_t eax,
 +                             uint32_t ecx, const char *reg,
 +                             int bitnr, bool expected_value)
 {
     FeatureTestArgs *args = g_new0(FeatureTestArgs, 1);
 +    char *cmdline;
 +
 +    if (!qtest_has_cpu_model(cpu)) {
 +        return;
 +    }
 +
 +    if (cpufeat) {
 +        cmdline = g_strdup_printf("-cpu %s,%s", cpu, cpufeat);
 +    } else {
 +        cmdline = g_strdup_printf("-cpu %s", cpu);
 +    }
 +
     args->cmdline = cmdline;
     args->in_eax = eax;
     args->in_ecx = ecx;
@@ -162,13 +193,17 @@ static FeatureTestArgs *add_feature_test(const char *name, const char *cmdline,
     args->bitnr = bitnr;
     args->expected_value = expected_value;
     qtest_add_data_func(name, args, test_feature_flag);
 -    return args;
 +    return;
 }
 static void test_plus_minus_subprocess(void)
 {
     char *path;
 +    if (!qtest_has_cpu_model("pentium")) {
 +        return;
 +    }
 +
     /* Rules:
      * 1)"-foo" overrides "+foo"
      * 2) "[+-]foo" overrides "foo=..."
@@ -198,6 +233,10 @@ static void test_plus_minus_subprocess(void)
 static void test_plus_minus(void)
 {
 +    if (!qtest_has_cpu_model("pentium")) {
 +        return;
 +    }
 +
     g_test_trap_subprocess("/x86/cpuid/parsing-plus-minus/subprocess", 0, 0);
     g_test_trap_assert_passed();
     g_test_trap_assert_stderr("*Ambiguous CPU model string. "
@@ -217,99 +256,105 @@ int main(int argc, char **argv)
     /* Original level values for CPU models: */
     add_cpuid_test("x86/cpuid/phenom/level",
 -                   "-cpu phenom", "level", 5);
 +                   "phenom", NULL, NULL, "level", 5);
     add_cpuid_test("x86/cpuid/Conroe/level",
 -                   "-cpu Conroe", "level", 10);
 +                   "Conroe", NULL, NULL, "level", 10);
     add_cpuid_test("x86/cpuid/SandyBridge/level",
 -                   "-cpu SandyBridge", "level", 0xd);
 +                   "SandyBridge", NULL, NULL, "level", 0xd);
     add_cpuid_test("x86/cpuid/486/xlevel",
 -                   "-cpu 486", "xlevel", 0);
 +                   "486", NULL, NULL, "xlevel", 0);
     add_cpuid_test("x86/cpuid/core2duo/xlevel",
 -                   "-cpu core2duo", "xlevel", 0x80000008);
 +                   "core2duo", NULL, NULL, "xlevel", 0x80000008);
     add_cpuid_test("x86/cpuid/phenom/xlevel",
 -                   "-cpu phenom", "xlevel", 0x8000001A);
 +                   "phenom", NULL, NULL, "xlevel", 0x8000001A);
     add_cpuid_test("x86/cpuid/athlon/xlevel",
 -                   "-cpu athlon", "xlevel", 0x80000008);
 +                   "athlon", NULL, NULL, "xlevel", 0x80000008);
     /* If level is not large enough, it should increase automatically: */
     /* CPUID[6].EAX: */
 -    add_cpuid_test("x86/cpuid/auto-level/phenom/arat",
 -                   "-cpu 486,arat=on", "level", 6);
 +    add_cpuid_test("x86/cpuid/auto-level/486/arat",
 +                   "486", "arat=on", NULL, "level", 6);
     /* CPUID[EAX=7,ECX=0].EBX: */
     add_cpuid_test("x86/cpuid/auto-level/phenom/fsgsbase",
 -                   "-cpu phenom,fsgsbase=on", "level", 7);
 +                   "phenom", "fsgsbase=on", NULL, "level", 7);
     /* CPUID[EAX=7,ECX=0].ECX: */
     add_cpuid_test("x86/cpuid/auto-level/phenom/avx512vbmi",
 -                   "-cpu phenom,avx512vbmi=on", "level", 7);
 +                   "phenom", "avx512vbmi=on", NULL, "level", 7);
     /* CPUID[EAX=0xd,ECX=1].EAX: */
     add_cpuid_test("x86/cpuid/auto-level/phenom/xsaveopt",
 -                   "-cpu phenom,xsaveopt=on", "level", 0xd);
 +                   "phenom", "xsaveopt=on", NULL, "level", 0xd);
     /* CPUID[8000_0001].EDX: */
     add_cpuid_test("x86/cpuid/auto-xlevel/486/3dnow",
 -                   "-cpu 486,3dnow=on", "xlevel", 0x80000001);
 +                   "486", "3dnow=on", NULL, "xlevel", 0x80000001);
     /* CPUID[8000_0001].ECX: */
     add_cpuid_test("x86/cpuid/auto-xlevel/486/sse4a",
 -                   "-cpu 486,sse4a=on", "xlevel", 0x80000001);
 +                   "486", "sse4a=on", NULL, "xlevel", 0x80000001);
     /* CPUID[8000_0007].EDX: */
     add_cpuid_test("x86/cpuid/auto-xlevel/486/invtsc",
 -                   "-cpu 486,invtsc=on", "xlevel", 0x80000007);
 +                   "486", "invtsc=on", NULL, "xlevel", 0x80000007);
     /* CPUID[8000_000A].EDX: */
     add_cpuid_test("x86/cpuid/auto-xlevel/486/npt",
 -                   "-cpu 486,svm=on,npt=on", "xlevel", 0x8000000A);
 +                   "486", "svm=on,npt=on", NULL, "xlevel", 0x8000000A);
     /* CPUID[C000_0001].EDX: */
     add_cpuid_test("x86/cpuid/auto-xlevel2/phenom/xstore",
 -                   "-cpu phenom,xstore=on", "xlevel2", 0xC0000001);
 +                   "phenom", "xstore=on", NULL, "xlevel2", 0xC0000001);
     /* SVM needs CPUID[0x8000000A] */
     add_cpuid_test("x86/cpuid/auto-xlevel/athlon/svm",
 -                   "-cpu athlon,svm=on", "xlevel", 0x8000000A);
 +                   "athlon", "svm=on", NULL, "xlevel", 0x8000000A);
     /* If level is already large enough, it shouldn't change: */
     add_cpuid_test("x86/cpuid/auto-level/SandyBridge/multiple",
 -                   "-cpu SandyBridge,arat=on,fsgsbase=on,avx512vbmi=on",
 -                   "level", 0xd);
 +                   "SandyBridge", "arat=on,fsgsbase=on,avx512vbmi=on",
 +                   NULL, "level", 0xd);
     /* If level is explicitly set, it shouldn't change: */
     add_cpuid_test("x86/cpuid/auto-level/486/fixed/0xF",
 -                   "-cpu 486,level=0xF,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 -                   "level", 0xF);
 +                   "486",
 +                   "level=0xF,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 +                   NULL, "level", 0xF);
     add_cpuid_test("x86/cpuid/auto-level/486/fixed/2",
 -                   "-cpu 486,level=2,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 -                   "level", 2);
 +                   "486",
 +                   "level=2,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 +                   NULL, "level", 2);
     add_cpuid_test("x86/cpuid/auto-level/486/fixed/0",
 -                   "-cpu 486,level=0,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 -                   "level", 0);
 +                   "486",
 +                   "level=0,arat=on,fsgsbase=on,avx512vbmi=on,xsaveopt=on",
 +                   NULL, "level", 0);
     /* if xlevel is already large enough, it shouldn't change: */
     add_cpuid_test("x86/cpuid/auto-xlevel/phenom/3dnow",
 -                   "-cpu phenom,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 -                   "xlevel", 0x8000001A);
 +                   "phenom", "3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 +                   NULL, "xlevel", 0x8000001A);
     /* If xlevel is explicitly set, it shouldn't change: */
     add_cpuid_test("x86/cpuid/auto-xlevel/486/fixed/80000002",
 -                   "-cpu 486,xlevel=0x80000002,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 -                   "xlevel", 0x80000002);
 +                   "486",
 +                   "xlevel=0x80000002,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 +                   NULL, "xlevel", 0x80000002);
     add_cpuid_test("x86/cpuid/auto-xlevel/486/fixed/8000001A",
 -                   "-cpu 486,xlevel=0x8000001A,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 -                   "xlevel", 0x8000001A);
 +                   "486",
 +                   "xlevel=0x8000001A,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 +                   NULL, "xlevel", 0x8000001A);
     add_cpuid_test("x86/cpuid/auto-xlevel/phenom/fixed/0",
 -                   "-cpu 486,xlevel=0,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 -                   "xlevel", 0);
 +                   "486",
 +                   "xlevel=0,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 +                   NULL, "xlevel", 0);
     /* if xlevel2 is already large enough, it shouldn't change: */
     add_cpuid_test("x86/cpuid/auto-xlevel2/486/fixed",
 -                   "-cpu 486,xlevel2=0xC0000002,xstore=on",
 -                   "xlevel2", 0xC0000002);
 +                   "486", "xlevel2=0xC0000002,xstore=on",
 +                   NULL, "xlevel2", 0xC0000002);
     /* Check compatibility of old machine-types that didn't
      * auto-increase level/xlevel/xlevel2: */
     if (qtest_has_machine("pc-i440fx-2.7")) {
         add_cpuid_test("x86/cpuid/auto-level/pc-2.7",
 -                       "-machine pc-i440fx-2.7 -cpu 486,arat=on,avx512vbmi=on,xsaveopt=on",
 -                       "level", 1);
 +                       "486", "arat=on,avx512vbmi=on,xsaveopt=on",
 +                       "pc-i440fx-2.7", "level", 1);
         add_cpuid_test("x86/cpuid/auto-xlevel/pc-2.7",
 -                       "-machine pc-i440fx-2.7 -cpu 486,3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 -                       "xlevel", 0);
 +                       "486", "3dnow=on,sse4a=on,invtsc=on,npt=on,svm=on",
 +                       "pc-i440fx-2.7", "xlevel", 0);
         add_cpuid_test("x86/cpuid/auto-xlevel2/pc-2.7",
 -                       "-machine pc-i440fx-2.7 -cpu 486,xstore=on",
 +                       "486", "xstore=on", "pc-i440fx-2.7",
                        "xlevel2", 0);
     }
     /*
@@ -319,18 +364,18 @@ int main(int argc, char **argv)
      */
     if (qtest_has_machine("pc-i440fx-2.3")) {
         add_cpuid_test("x86/cpuid/auto-level7/pc-i440fx-2.3/off",
 -                       "-machine pc-i440fx-2.3 -cpu Penryn",
 +                       "Penryn", NULL, "pc-i440fx-2.3",
                        "level", 4);
         add_cpuid_test("x86/cpuid/auto-level7/pc-i440fx-2.3/on",
 -                       "-machine pc-i440fx-2.3 -cpu Penryn,erms=on",
 +                       "Penryn", "erms=on", "pc-i440fx-2.3",
                        "level", 7);
     }
     if (qtest_has_machine("pc-i440fx-2.9")) {
         add_cpuid_test("x86/cpuid/auto-level7/pc-i440fx-2.9/off",
 -                       "-machine pc-i440fx-2.9 -cpu Conroe",
 +                       "Conroe", NULL, "pc-i440fx-2.9",
                        "level", 10);
         add_cpuid_test("x86/cpuid/auto-level7/pc-i440fx-2.9/on",
 -                       "-machine pc-i440fx-2.9 -cpu Conroe,erms=on",
 +                       "Conroe", "erms=on", "pc-i440fx-2.9",
                        "level", 10);
     }
@@ -341,42 +386,43 @@ int main(int argc, char **argv)
      */
     if (qtest_has_machine("pc-i440fx-2.3")) {
         add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.3",
 -                       "-machine pc-i440fx-2.3 -cpu SandyBridge",
 +                       "SandyBridge", NULL, "pc-i440fx-2.3",
                        "xlevel", 0x8000000a);
     }
     if (qtest_has_machine("pc-i440fx-2.4")) {
         add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-off",
 -                       "-machine pc-i440fx-2.4 -cpu SandyBridge,",
 +                       "SandyBridge", NULL, "pc-i440fx-2.4",
                        "xlevel", 0x80000008);
         add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
 -                       "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
 +                       "SandyBridge", "svm=on,npt=on", "pc-i440fx-2.4",
                        "xlevel", 0x80000008);
     }
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
 -                     "-cpu 486,+arat",
 +                     "486", "+arat",
                      6, 0, "EAX", 2, true);
     add_feature_test("x86/cpuid/features/minus",
 -                     "-cpu pentium,-mmx",
 +                     "pentium", "-mmx",
                      1, 0, "EDX", 23, false);
     add_feature_test("x86/cpuid/features/on",
 -                     "-cpu 486,arat=on",
 +                     "486", "arat=on",
                      6, 0, "EAX", 2, true);
     add_feature_test("x86/cpuid/features/off",
 -                     "-cpu pentium,mmx=off",
 +                     "pentium", "mmx=off",
                      1, 0, "EDX", 23, false);
 +
     add_feature_test("x86/cpuid/features/max-plus-invtsc",
 -                     "-cpu max,+invtsc",
 +                     "max" , "+invtsc",
                      0x80000007, 0, "EDX", 8, true);
     add_feature_test("x86/cpuid/features/max-invtsc-on",
 -                     "-cpu max,invtsc=on",
 +                     "max", "invtsc=on",
                      0x80000007, 0, "EDX", 8, true);
     add_feature_test("x86/cpuid/features/max-minus-mmx",
 -                     "-cpu max,-mmx",
 +                     "max", "-mmx",
                      1, 0, "EDX", 23, false);
     add_feature_test("x86/cpuid/features/max-invtsc-on,mmx=off",
 -                     "-cpu max,mmx=off",
 +                     "max", "mmx=off",
                      1, 0, "EDX", 23, false);
     return g_test_run();
 -- 
 2.39.3
--- a/kvm-virtio-gpu-fix-v2-migration.patch
+++ b/kvm-virtio-gpu-fix-v2-migration.patch
@ -1,122 +0,0 @@
 From 77e24d71549454d7d7b9e83f882e2817a5da7fac Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Thu, 16 May 2024 12:40:22 +0400
 Subject: [PATCH 06/14] virtio-gpu: fix v2 migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
 RH-MergeRequest: 250: virtio-gpu: fix v2 migration
 RH-Jira: RHEL-36329
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/2] 55624c9074aaf1226ca3ae8a34744134cd8a4d9f (marcandre.lureau-rh/qemu-kvm-centos)
 Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke
 forward/backward version migration. Versioning of nested VMSD structures
 is not straightforward, as the wire format doesn't have nested
 structures versions. Introduce x-scanout-vmstate-version and a field
 test to save/load appropriately according to the machine version.
 Fixes: dfcf74fa ("virtio-gpu: fix scanout migration post-load")
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Signed-off-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
 Tested-by: Fiona Ebner <f.ebner@proxmox.com>
 [fixed long lines]
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Jira: https://issues.redhat.com/browse/RHEL-36329
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 (cherry picked from commit 40a23ef643664b5c1021a9789f9d680b6294fb50)
 ---
 hw/core/machine.c              |  1 +
 hw/display/virtio-gpu.c        | 30 ++++++++++++++++++++++--------
 include/hw/virtio/virtio-gpu.h |  1 +
 3 files changed, 24 insertions(+), 8 deletions(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 0f256d9633..cf1d7faaaf 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -37,6 +37,7 @@ GlobalProperty hw_compat_8_2[] = {
     { "migration", "zero-page-detection", "legacy"},
     { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
 };
 const size_t hw_compat_8_2_len = G_N_ELEMENTS(hw_compat_8_2);
 diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
 index ae831b6b3e..d60b1b2973 100644
 --- a/hw/display/virtio-gpu.c
 +++ b/hw/display/virtio-gpu.c
@@ -1166,10 +1166,17 @@ static void virtio_gpu_cursor_bh(void *opaque)
     virtio_gpu_handle_cursor(&g->parent_obj.parent_obj, g->cursor_vq);
 }
 +static bool scanout_vmstate_after_v2(void *opaque, int version)
 +{
 +    struct VirtIOGPUBase *base = container_of(opaque, VirtIOGPUBase, scanout);
 +    struct VirtIOGPU *gpu = container_of(base, VirtIOGPU, parent_obj);
 +
 +    return gpu->scanout_vmstate_version >= 2;
 +}
 +
 static const VMStateDescription vmstate_virtio_gpu_scanout = {
     .name = "virtio-gpu-one-scanout",
 -    .version_id = 2,
 -    .minimum_version_id = 1,
 +    .version_id = 1,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout),
         VMSTATE_UINT32(width, struct virtio_gpu_scanout),
@@ -1181,12 +1188,18 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
         VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout),
         VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout),
         VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
 -        VMSTATE_UINT32_V(fb.format, struct virtio_gpu_scanout, 2),
 -        VMSTATE_UINT32_V(fb.bytes_pp, struct virtio_gpu_scanout, 2),
 -        VMSTATE_UINT32_V(fb.width, struct virtio_gpu_scanout, 2),
 -        VMSTATE_UINT32_V(fb.height, struct virtio_gpu_scanout, 2),
 -        VMSTATE_UINT32_V(fb.stride, struct virtio_gpu_scanout, 2),
 -        VMSTATE_UINT32_V(fb.offset, struct virtio_gpu_scanout, 2),
 +        VMSTATE_UINT32_TEST(fb.format, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
 +        VMSTATE_UINT32_TEST(fb.bytes_pp, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
 +        VMSTATE_UINT32_TEST(fb.width, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
 +        VMSTATE_UINT32_TEST(fb.height, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
 +        VMSTATE_UINT32_TEST(fb.stride, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
 +        VMSTATE_UINT32_TEST(fb.offset, struct virtio_gpu_scanout,
 +                            scanout_vmstate_after_v2),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -1659,6 +1672,7 @@ static Property virtio_gpu_properties[] = {
     DEFINE_PROP_BIT("blob", VirtIOGPU, parent_obj.conf.flags,
                     VIRTIO_GPU_FLAG_BLOB_ENABLED, false),
     DEFINE_PROP_SIZE("hostmem", VirtIOGPU, parent_obj.conf.hostmem, 0),
 +    DEFINE_PROP_UINT8("x-scanout-vmstate-version", VirtIOGPU, scanout_vmstate_version, 2),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
 index ed44cdad6b..842315d51d 100644
 --- a/include/hw/virtio/virtio-gpu.h
 +++ b/include/hw/virtio/virtio-gpu.h
@@ -177,6 +177,7 @@ typedef struct VGPUDMABuf {
 struct VirtIOGPU {
     VirtIOGPUBase parent_obj;
 +    uint8_t scanout_vmstate_version;
     uint64_t conf_max_hostmem;
     VirtQueue *ctrl_vq;
 -- 
 2.39.3
--- a/kvm-x86-cpu-deprecate-cpu-models-that-do-not-support-x86.patch
+++ b/kvm-x86-cpu-deprecate-cpu-models-that-do-not-support-x86.patch
@ -1,98 +0,0 @@
 From 8c735b34df1902f32eb68bb3e6c3e8f04b010bd4 Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Mon, 10 Jun 2024 15:34:22 +0530
 Subject: [PATCH 05/14] x86/cpu: deprecate cpu models that do not support
 x86-64-v3
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 247: x86/cpu: deprecate cpu models that do not support x86-64-v3
 RH-Jira: RHEL-28971
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: MST <mst@redhat.com>
 RH-Commit: [1/1] 1afb03048c674b54da8cd4ad5174f767a7514b51 (anisinha/centos-qemu-kvm)
 RHEL-10 has switched to a new baseline microarchitecture called "x86-64-v3".
 Deprecate the CPU models that do not support x86-64-v3. The following are the
 CPU models that do not support v3:
 Intel: Denverton, IvyBridge, Nehalem, SandyBridge, Snowridge, Westmere.
 AMD: Opteron_G4 and Opteron_G5.
 See also https://www.qemu.org/docs/master/system/i386/cpu.html#abi-compatibility-levels-for-cpu-models
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 ---
 target/i386/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index c83d585c9b..3eac3135a6 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2597,6 +2597,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 #endif // Removal of deprecated CPU models in RHEL-10
     {
         .name = "Nehalem",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 11,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2674,6 +2675,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Westmere",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 11,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2755,6 +2757,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "SandyBridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2841,6 +2844,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "IvyBridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4121,6 +4125,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Denverton",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 21,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4231,6 +4236,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Snowridge",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 27,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4486,6 +4492,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 #endif
     {
         .name = "Opteron_G4",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 21,
@@ -4518,6 +4525,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G5",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 21,
 -- 
 2.39.3
--- a/kvm-x86-cpu-update-deprecation-string-to-match-lowest-un.patch
+++ b/kvm-x86-cpu-update-deprecation-string-to-match-lowest-un.patch
@ -1,38 +0,0 @@
 From 03615078bc2e2f238e3eb00b11f697a7e68477df Mon Sep 17 00:00:00 2001
 From: Ani Sinha <anisinha@redhat.com>
 Date: Tue, 20 Aug 2024 13:32:49 +0530
 Subject: [PATCH] x86/cpu: update deprecation string to match lowest
 undeprecated model
 RH-Author: Ani Sinha <anisinha@redhat.com>
 RH-MergeRequest: 264: x86/cpu: update deprecation string to match lowest undeprecated model
 RH-Jira: RHEL-54260
 RH-Commit: [1/1] 834ef2694b441431c3da48fefde307eea96d90e4 (anisinha/centos-qemu-kvm)
 Commit a581f2824dce64 ("x86/cpu: deprecate cpu models that do not support x86-64-v3")
 deprecated a bunch of cpu models in RHEL-10 that do not support x86-64-v3. The
 deprecation string was not updated to match what was the lowest model that was
 still available and not deprecated. Update the string to reflect the new
 reality.
 Signed-off-by: Ani Sinha <anisinha@redhat.com>
 ---
 target/i386/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 3eac3135a6..46f82974fb 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2191,7 +2191,7 @@ static const CPUCaches epyc_genoa_cache_info = {
  */
 #define RHEL_CPU_DEPRECATION \
 -    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
 +    "use at least 'Haswell' / 'EPYC', or 'host' / 'max'"
 static const X86CPUDefinition builtin_x86_defs[] = {
     {
 -- 
 2.39.3
--- a/qemu-kvm.spec
+++ b/qemu-kvm.spec
@ -142,8 +142,8 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
-Version: 9.0.0
+Version: 9.1.0
-Release: 8%{?rcrel}%{?dist}%{?cc_suffix}
+Release: 1%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@ -171,79 +171,24 @@ Source36: README.tests
 Patch0004: 0004-Initial-redhat-build.patch
 Patch0005: 0005-Enable-disable-devices-for-RHEL.patch
 Patch0006: 0006-Machine-type-related-general-changes.patch
-Patch0007: 0007-Add-aarch64-machine-types.patch
+Patch0007: 0007-meson-temporarily-disable-Wunused-function.patch
-Patch0008: 0008-Add-s390x-machine-types.patch
+Patch0008: 0008-Remove-upstream-machine-types-for-aarch64-s390x-and-.patch
-Patch0009: 0009-Add-x86_64-machine-types.patch
+Patch0009: 0009-Adapt-versioned-machine-type-macros-for-RHEL.patch
-Patch0010: 0010-Enable-make-check.patch
+Patch0010: 0010-Increase-deletion-schedule-to-4-releases.patch
-Patch0011: 0011-vfio-cap-number-of-devices-that-can-be-assigned.patch
+Patch0011: 0011-Add-downstream-aarch64-versioned-virt-machine-types.patch
-Patch0012: 0012-Add-support-statement-to-help-output.patch
+Patch0012: 0012-Add-downstream-s390x-versioned-s390-ccw-virtio-machi.patch
-Patch0013: 0013-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+Patch0013: 0013-Add-downstream-x86_64-versioned-pc-q35-machine-types.patch
-Patch0014: 0014-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+Patch0014: 0014-Revert-meson-temporarily-disable-Wunused-function.patch
-Patch0015: 0015-Add-upstream-compatibility-bits.patch
+Patch0015: 0015-Enable-make-check.patch
-Patch0016: 0016-Disable-FDC-devices.patch
+Patch0016: 0016-vfio-cap-number-of-devices-that-can-be-assigned.patch
-Patch0017: 0017-Disable-vga-cirrus-device.patch
+Patch0017: 0017-Add-support-statement-to-help-output.patch
-# For RHEL-37563 - Enable 'vhost-user-snd-pci' in qemu-kvm for RHIVOS
+Patch0018: 0018-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
-Patch18: kvm-Enable-vhost-user-snd-pci-device.patch
+Patch0019: 0019-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-# For RHEL-28972 - x86: Remove the existing deprecated CPU models on RHEL10
+Patch0021: 0021-Add-upstream-compatibility-bits.patch
-Patch19: kvm-qtest-x86-numa-test-do-not-use-the-obsolete-pentium-.patch
+Patch0022: 0022-redhat-Add-QEMU-9.1-compat-handling-to-the-s390x-mac.patch
-# For RHEL-28972 - x86: Remove the existing deprecated CPU models on RHEL10
+Patch0023: 0023-redhat-Add-rhel9.6.0-and-rhel10.0.0-machine-types.patch
-Patch20: kvm-tests-qtest-libqtest-add-qtest_has_cpu_model-api.patch
+Patch0024: 0024-x86-ensure-compatibility-of-pc-q35-rhel9.patch
-# For RHEL-28972 - x86: Remove the existing deprecated CPU models on RHEL10
+Patch0025: 0025-arm-ensure-compatibility-of-virt-rhel9.patch
 Patch21: kvm-tests-qtest-x86-check-for-availability-of-older-cpu-.patch
 # For RHEL-28972 - x86: Remove the existing deprecated CPU models on RHEL10
 Patch22: kvm-target-cpu-models-x86-Remove-the-existing-deprecated.patch
 # For RHEL-28971 - Consider deprecating CPU models like "Nehalem" / "IvyBridge" on RHEL 10
 Patch23: kvm-x86-cpu-deprecate-cpu-models-that-do-not-support-x86.patch
 # For RHEL-36329 - [RHEL10.0.beta][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument
 Patch24: kvm-virtio-gpu-fix-v2-migration.patch
 # For RHEL-36329 - [RHEL10.0.beta][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument
 Patch25: kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
 # For RHEL-39898 - s390: Remove the legacy CPU models on RHEL10
 Patch26: kvm-s390x-remove-deprecated-rhel-machine-types.patch
 # For RHEL-39898 - s390: Remove the legacy CPU models on RHEL10
 Patch27: kvm-s390x-select-correct-components-for-no-board-build.patch
 # For RHEL-39898 - s390: Remove the legacy CPU models on RHEL10
 Patch28: kvm-target-s390x-Add-a-CONFIG-switch-to-disable-legacy-C.patch
 # For RHEL-39898 - s390: Remove the legacy CPU models on RHEL10
 Patch29: kvm-target-s390x-cpu_models-Disable-everything-up-to-the.patch
 # For RHEL-39898 - s390: Remove the legacy CPU models on RHEL10
 Patch30: kvm-target-s390x-Revert-the-old-s390x-CPU-model-disablem.patch
 # For RHEL-43409 - aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize
 # For RHEL-43410 - aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize
 Patch31: kvm-Revert-monitor-use-aio_co_reschedule_self.patch
 # For RHEL-43409 - aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize
 # For RHEL-43410 - aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize
 Patch32: kvm-aio-warn-about-iohandler_ctx-special-casing.patch
 # For RHEL-46239 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-10.0]
 Patch33: kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
 # For RHEL-46239 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-10.0]
 Patch34: kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
 # For RHEL-46239 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-10.0]
 Patch35: kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
 # For RHEL-46239 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-10.0]
 Patch36: kvm-block-Parse-filenames-only-when-explicitly-requested.patch
 # For RHEL-40959 - Qemu hang when quit dst vm after storage migration(nbd+tls)
 Patch37: kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
 # For RHEL-40959 - Qemu hang when quit dst vm after storage migration(nbd+tls)
 Patch38: kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
 # For RHEL-40959 - Qemu hang when quit dst vm after storage migration(nbd+tls)
 Patch39: kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
 # For RHEL-40959 - Qemu hang when quit dst vm after storage migration(nbd+tls)
 Patch40: kvm-iotests-test-NBD-TLS-iothread.patch
 # For RHEL-50165 - Enable 'vhost-user-scmi-pci' and 'vhost-user-scmi' in qemu-kvm for RHIVOS
 Patch41: kvm-Enable-vhost-user-scmi-devices.patch
 # For RHEL-51901 - qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command[RHEL-10]
 Patch42: kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
 # For RHEL-52599 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-10.0]
 Patch43: kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
 # For RHEL-52599 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-10.0]
 Patch44: kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
 # For RHEL-52599 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-10.0]
 Patch45: kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
 # For RHEL-52599 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-10.0]
 Patch46: kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
 # For RHEL-54260 - [RHEL10] Need to update the deprecated CPU model warning message
 Patch47: kvm-x86-cpu-update-deprecation-string-to-match-lowest-un.patch
 %if %{have_clang}
 BuildRequires: clang
@ -588,7 +533,6 @@ ulimit -n 10240
  --disable-attr                   \\\
  --disable-auth-pam               \\\
  --disable-avx2                   \\\
  --disable-avx512f                \\\
  --disable-avx512bw               \\\
  --disable-blkio                  \\\
  --disable-block-drv-whitelist-in-tools \\\
@ -644,7 +588,6 @@ ulimit -n 10240
  --disable-linux-aio              \\\
  --disable-linux-io-uring         \\\
  --disable-linux-user             \\\
  --disable-live-block-migration   \\\
  --disable-lto                    \\\
  --disable-lzfse                  \\\
  --disable-lzo                    \\\
@ -664,7 +607,6 @@ ulimit -n 10240
  --disable-parallels              \\\
  --disable-pie                    \\\
  --disable-plugins                \\\
  --disable-pvrdma                 \\\
  --disable-qcow1                  \\\
  --disable-qed                    \\\
  --disable-qga-vss                \\\
@ -742,7 +684,10 @@ run_configure() {
        --with-coroutine=ucontext \
        --tls-priority=@QEMU,SYSTEM \
        %{disable_everything} \
 %ifarch aarch64 s390x x86_64
        --with-devices-%{kvm_target}=%{kvm_target}-rh-devices \
 %endif
 	--rhel-version=10 \
        "$@"
    echo "config-host.mak contents:"
@ -1048,6 +993,8 @@ rm -rf %{buildroot}%{_mandir}/man1/virtfs-proxy-helper*
    rm -rf %{buildroot}%{_datadir}/%{name}/multiboot.bin
    rm -rf %{buildroot}%{_datadir}/%{name}/multiboot_dma.bin
    rm -rf %{buildroot}%{_datadir}/%{name}/pvh.bin
 %else
    rm -rf %{buildroot}%{_bindir}/qemu-vmsr-helper
 %endif
 # Remove sparc files
@ -1309,6 +1256,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 %changelog
 * Tue Sep 10 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-1
 - Rebase to QEMU 9.1.0 [RHEL-41246]
 - Resolves: RHEL-41246
  (Rebase qemu-9.1 for RHEL 10.0)
 * Mon Aug 26 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-8
 - kvm-x86-cpu-update-deprecation-string-to-match-lowest-un.patch [RHEL-54260]
 - Resolves: RHEL-54260
@ -1374,9 +1326,6 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 - Resolves: RHEL-43410
  (aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize)
 * Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 18:9.0.0-2.1
 - Bump release for June 2024 mass rebuild
 * Mon Jun 10 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-2
 - kvm-Enable-vhost-user-snd-pci-device.patch [RHEL-37563]
 - Resolves: RHEL-37563
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (qemu-9.0.0.tar.xz) = 1603517cd4c93632ba60ad7261eb67374f12a744bf58f10b0e8686e46d3a02d8b6bf58a0c617f23a1868084aaba6386c24341894f75539e0b816091718721427
+SHA512 (qemu-9.1.0.tar.xz) = bf61d65e37945fa8ee8640712c719ace05164d86e6df700b98bdc5f79e0a8d5e8f85bd48e726edb62b2419db20673f63ec8b63a60393a914b09cb365621b35e2
`@ -1 +1 @@`
	`SHA512 (qemu-9.0.0.tar.xz) = 1603517cd4c93632ba60ad7261eb67374f12a744bf58f10b0e8686e46d3a02d8b6bf58a0c617f23a1868084aaba6386c24341894f75539e0b816091718721427`	`SHA512 (qemu-9.1.0.tar.xz) = bf61d65e37945fa8ee8640712c719ace05164d86e6df700b98bdc5f79e0a8d5e8f85bd48e726edb62b2419db20673f63ec8b63a60393a914b09cb365621b35e2`